[pve-devel] [PATCH v2 qemu-server] fix #3963: Skip TPM startup for template VMs

[pve-devel] [PATCH v2 qemu-server] fix #3963: Skip TPM startup for template VMs

[Filip Schauer]

Skip the software TPM startup when starting a template VM for performing
a backup. This fixes an error that occurs when the TPM state disk is
write-protected.

Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
---
 PVE/QemuServer.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index 484bc7f..c262c68 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -5923,7 +5923,7 @@ sub vm_start_nolock {
 	    PVE::Systemd::enter_systemd_scope($vmid, "Proxmox VE VM $vmid", %systemd_properties);
 
 	    my $tpmpid;
-	    if (my $tpm = $conf->{tpmstate0}) {
+	    if ((my $tpm = $conf->{tpmstate0}) && !PVE::QemuConfig->is_template($conf)) {
 		# start the TPM emulator so QEMU can connect on start
 		$tpmpid = start_swtpm($storecfg, $vmid, $tpm, $migratedfrom);
 	    }
-- 

Whoops, missed a not in front of the is_template check.

2.39.2

Re: [pve-devel] [PATCH v2 qemu-server] fix #3963: Skip TPM startup for template VMs

[Filip Schauer]

I messed up the formatting the formatting there. What I meant to say:

Changes since v1:
* Add a missing not sign in front of the is_template check

> On 09.08.2023 11:22 CEST Filip Schauer <f.schauer@proxmox.com> wrote:
> 
>  
> Skip the software TPM startup when starting a template VM for performing
> a backup. This fixes an error that occurs when the TPM state disk is
> write-protected.
> 
> Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
> ---
>  PVE/QemuServer.pm | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
> index 484bc7f..c262c68 100644
> --- a/PVE/QemuServer.pm
> +++ b/PVE/QemuServer.pm
> @@ -5923,7 +5923,7 @@ sub vm_start_nolock {
>  	    PVE::Systemd::enter_systemd_scope($vmid, "Proxmox VE VM $vmid", %systemd_properties);
>  
>  	    my $tpmpid;
> -	    if (my $tpm = $conf->{tpmstate0}) {
> +	    if ((my $tpm = $conf->{tpmstate0}) && !PVE::QemuConfig->is_template($conf)) {
>  		# start the TPM emulator so QEMU can connect on start
>  		$tpmpid = start_swtpm($storecfg, $vmid, $tpm, $migratedfrom);
>  	    }
> -- 
> 
> Whoops, missed a not in front of the is_template check.
> 
> 2.39.2
> 
> 
> 
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH v2 qemu-server] fix #3963: Skip TPM startup for template VMs

[Fiona Ebner]

Am 09.08.23 um 11:22 schrieb Filip Schauer:
> Skip the software TPM startup when starting a template VM for performing
> a backup. This fixes an error that occurs when the TPM state disk is
> write-protected.
> 
> Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
> ---
>  PVE/QemuServer.pm | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
> index 484bc7f..c262c68 100644
> --- a/PVE/QemuServer.pm
> +++ b/PVE/QemuServer.pm
> @@ -5923,7 +5923,7 @@ sub vm_start_nolock {
>  	    PVE::Systemd::enter_systemd_scope($vmid, "Proxmox VE VM $vmid", %systemd_properties);
>  
>  	    my $tpmpid;
> -	    if (my $tpm = $conf->{tpmstate0}) {
> +	    if ((my $tpm = $conf->{tpmstate0}) && !PVE::QemuConfig->is_template($conf)) {
>  		# start the TPM emulator so QEMU can connect on start
>  		$tpmpid = start_swtpm($storecfg, $vmid, $tpm, $migratedfrom);
>  	    }

Well, this fixes the error that swtpm tries to write to the immutable
image, but a quick test shows that it's still not possible to do a
backup of the template (which is what the bug is about):

> INFO: starting kvm to execute backup task
> kvm: -chardev socket,id=tpmchar,path=/var/run/qemu-server/115.swtpm: Failed to connect to '/var/run/qemu-server/115.swtpm': No such file or directory
> ERROR: Backup of VM 115 failed - start failed: QEMU exited with code 
The QEMU command line would need to be adapted accordingly too.