proxmox-mirrors/qemu-server
1
0
Fork 0
mirror of https://git.proxmox.com/git/qemu-server synced 2025-08-06 11:08:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

api: update vm: prohibit changing version of TPM state

Browse Source 
After the TPM state has been created (to be precise, initialized by
swtpm) it is not possible to change the version anymore. Doing so will
lead to failure starting the associated VM. While documented in the
description, it's better to enforce this via API.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
This commit is contained in:
Fiona Ebner 2024-06-27 13:03:17 +02:00 committed by Fabian Grünbichler
parent 87084b18dd
commit 242a5c6ed1
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
PVE/API2/Qemu.pm
View File

@ -314,6 +314,24 @@ my $import_from_volid = sub {
return $cloned->@{qw(file size)};
};
my sub prohibit_tpm_version_change {
my ($old, $new) = @_;
return if !$old || !$new;
my $old_drive = PVE::QemuServer::parse_drive('tpmstate0', $old);
my $new_drive = PVE::QemuServer::parse_drive('tpmstate0', $new);
return if $old_drive->{file} ne $new_drive->{file};
my $old_version = $old_drive->{version} // 'v1.2';
my $new_version = $new_drive->{version} // 'v1.2';
die "cannot change TPM state version after creation\n" if $old_version ne $new_version;
return;
}
# Note: $pool is only needed when creating a VM, because pool permissions
# are automatically inherited if VM already exists inside a pool.
my sub create_disks : prototype($$$$$$$$$$) {
@ -1930,6 +1948,7 @@ my $update_vm_api = sub {
# old drive
if ($conf->{$opt}) {
$check_drive_perms->($opt, $conf->{$opt});
prohibit_tpm_version_change($conf->{$opt}, $param->{$opt}) if $opt eq 'tpmstate0';
}
# new drive