Backups hanging when VM has TPM device

[HW-Team]

Hello,
since upgrading from Proxmox VE 8 to 9, my backups of VMs with a TPM device no longer work.

Symptoms​

• Backup job starts normally
• VM stops/suspends as expected
• vzdump tries to attach TPM device to the temporary QEMU process
• Then the backup stalls at 0% and eventually fails with a QMP socket timeout

Task View during backup (hangs at 0%):

INFO: starting new backup job: vzdump 100 --compress zstd --node proxmox --notes-template '{{vmid}}-{{guestname}}' --mailnotification always --all 0 --prune-backups 'keep-daily=7' --mode stop --storage backups
INFO: Starting Backup of VM 100 (qemu)
INFO: Backup started at 2025-08-20 13:23:09
INFO: status = running
INFO: backup mode: stop INFO: ionice priority: 7
INFO: VM Name: Heizungs-Lueftungssystem
INFO: include disk 'scsi0' 'local-btrfs:100/vm-100-disk-1.raw' 100G
INFO: include disk 'efidisk0' 'local-btrfs:100/vm-100-disk-0.raw' 528K
INFO: include disk 'tpmstate0' 'local-btrfs:100/vm-100-disk-2.raw' 4M
INFO: stopping virtual guest
INFO: creating vzdump archive '/mnt/pve/backups/dump/vzdump-qemu-100-2025_08_20-13_23_08.vma.zst'
INFO: starting kvm to execute backup task swtpm_setup: Not overwriting existing state file.
INFO: attaching TPM drive to QEMU for backup
INFO: started backup task '6005b622-49b6-4eb5-9be3-5d2743453aa9'
INFO: resuming VM again after 37 seconds INFO: 0% (128.0 KiB of 100.0 GiB) in 3s, read: 42.7 KiB/s, write: 42.7 KiB/s

Task View after backup fails:

INFO: starting new backup job: vzdump 100 --compress zstd --mode stop --prune-backups 'keep-daily=7' --mailnotification always --notes-template '{{vmid}}-{{guestname}}' --storage backups --quiet 1
INFO: Starting Backup of VM 100 (qemu)
INFO: Backup started at 2025-08-19 21:00:00
INFO: status = running
INFO: backup mode: stop
INFO: ionice priority: 7
ERROR: Backup of VM 100 failed - VM 100 qmp command 'query-backup' failed - unable to connect to VM 100 qmp socket - timeout after 5978 retries
INFO: Failed at 2025-08-19 21:10:00
INFO: Backup job finished with errors
INFO: notified via target mail-to-root
TASK ERROR: job errors

What I’ve tested​

• Works fine if I remove the TPM device → backup completes normally.
• Issue happens with both stop mode and suspend mode.
• VM still boots normally without TPM state, so TPM is present but not actively used for BitLocker/LUKS in my case.

​

Is this a known regression in Proxmox 9 with QEMU + TPM?
For now I can exclude tpmstate0 manually (or remove it), but ideally backups should include it to support full restore of Windows 11 / BitLocker-protected VMs.

Thanks in advance for any hints or confirmation!

 

[kociubin]

I have the same issue. I just upgraded from 8.4 to 9.0.

One of my VM's started doing this immediately after the upgrade to 9.0. I spent several hours troubleshooting it today but couldn't find the culprit. When I saw this post, it all clicked. Once I removed the TPM device (which in my case was not needed) backups started to work again.

Thank you for the post. It helped me work around the issue.

Also, while troubleshooting, I noticed that the VM has to be started at least once for the issue to occur (i.e. if you just restore the affected VM and never start it the backups will work).

 

[akxx]

same here. interesting artefact:
when VM is backed up only offline backup is working.
but after first backup (with running VM) backup will hang (also when VM is offline)
after cloning the VM, offline backup start working again

@HW-Team: did you opened a ticket in proxmox bugzilla?

 

[fiona]

Hi,
please share the VM configuration qm config <ID> replacing <ID> with the actual ID, as well as the output of pveversion -v. What file system does the backup storage have? Is there anything in the system journal around the time of the issue?

@kociubin @akxx are you also using btrfs for the VM disks or something else?

 

[kociubin]

Hi,
please share the VM configuration qm config <ID> replacing <ID> with the actual ID, as well as the output of pveversion -v. What file system does the backup storage have? Is there anything in the system journal around the time of the issue?

@kociubin @akxx are you also using btrfs for the VM disks or something else?

Yes. I'm using btrfs for the VM disks.

Sorry, I no longer have a broken configuration because I worked around it by removing the TPM device.

 

[akxx]

Hi,
please share the VM configuration qm config <ID> replacing <ID> with the actual ID, as well as the output of pveversion -v. What file system does the backup storage have? Is there anything in the system journal around the time of the issue?

puh ... in between i updated to the latest pve (manager from 9.0.6 -> 9.0.9) .. and backup is not hanging anymore ...

 

[HW-Team]

Hi,
please share the VM configuration qm config <ID> replacing <ID> with the actual ID, as well as the output of pveversion -v. What file system does the backup storage have? Is there anything in the system journal around the time of the issue?

@kociubin @akxx are you also using btrfs for the VM disks or something else?

Proxmox has been updated to 9.0.10, but the problem persists.

qm config:

agent: 1
bios: ovmf
boot: order=scsi0
cores: 4
cpu: x86-64-v2-AES
efidisk0: local-btrfs:100/vm-100-disk-0.raw,efitype=4m,pre-enrolled-keys=1,size=528K
machine: pc-q35-8.0
memory: 8192
meta: creation-qemu=8.0.2,ctime=1688395634
name: Heizungs-Lueftungssystem
net0: virtio=DE:E6:8C:51:35:DF,bridge=vmbr0,firewall=1
numa: 0
onboot: 1
ostype: win11
scsi0: local-btrfs:100/vm-100-disk-1.raw,aio=threads,cache=writeback,discard=on,iothread=1,size=100G
scsihw: virtio-scsi-single
smbios1: uuid=739d7827-d699-44c7-a59d-469f6a237460
sockets: 1
tpmstate0: local-btrfs:100/vm-100-disk-2.raw,size=4M,version=v2.0
vmgenid: 5336dd7b-df94-4ddf-bbc1-632aa1f4b6ac
root@proxmox:~# qm config 100
agent: 1
bios: ovmf
boot: order=scsi0
cores: 4
cpu: x86-64-v2-AES
efidisk0: local-btrfs:100/vm-100-disk-0.raw,efitype=4m,pre-enrolled-keys=1,size=528K
machine: pc-q35-8.0
memory: 8192
meta: creation-qemu=8.0.2,ctime=1688395634
name: Heizungs-Lueftungssystem
net0: virtio=DE:E6:8C:51:35:DF,bridge=vmbr0,firewall=1
numa: 0
onboot: 1
ostype: win11
scsi0: local-btrfs:100/vm-100-disk-1.raw,aio=threads,cache=writeback,discard=on,iothread=1,size=100G
scsihw: virtio-scsi-single
smbios1: uuid=739d7827-d699-44c7-a59d-469f6a237460
sockets: 1
tpmstate0: local-btrfs:100/vm-100-disk-2.raw,size=4M,version=v2.0
vmgenid: 5336dd7b-df94-4ddf-bbc1-632aa1f4b6ac

pveversion:

proxmox-ve: 9.0.0 (running kernel: 6.14.11-2-pve)
pve-manager: 9.0.10 (running version: 9.0.10/deb1ca707ec72a89)
proxmox-kernel-helper: 9.0.4
proxmox-kernel-6.14.11-2-pve-signed: 6.14.11-2
proxmox-kernel-6.14: 6.14.11-2
proxmox-kernel-6.14.8-2-pve-signed: 6.14.8-2
proxmox-kernel-6.8.12-13-pve-signed: 6.8.12-13
proxmox-kernel-6.8: 6.8.12-13
proxmox-kernel-6.8.12-11-pve-signed: 6.8.12-11
proxmox-kernel-6.5.13-6-pve-signed: 6.5.13-6
proxmox-kernel-6.5: 6.5.13-6
proxmox-kernel-6.2.16-20-pve: 6.2.16-20
proxmox-kernel-6.2: 6.2.16-20
pve-kernel-6.2.16-3-pve: 6.2.16-3
ceph-fuse: 19.2.3-pve1
corosync: 3.1.9-pve2
criu: 4.1.1-1
frr-pythontools: 10.3.1-1+pve4
ifupdown2: 3.3.0-1+pmx10
ksm-control-daemon: 1.5-1
libjs-extjs: 7.0.0-5
libproxmox-acme-perl: 1.7.0
libproxmox-backup-qemu0: 2.0.1
libproxmox-rs-perl: 0.4.1
libpve-access-control: 9.0.3
libpve-apiclient-perl: 3.4.0
libpve-cluster-api-perl: 9.0.6
libpve-cluster-perl: 9.0.6
libpve-common-perl: 9.0.10
libpve-guest-common-perl: 6.0.2
libpve-http-server-perl: 6.0.4
libpve-network-perl: 1.1.7
libpve-rs-perl: 0.10.10
libpve-storage-perl: 9.0.13
libspice-server1: 0.15.2-1+b1
lvm2: 2.03.31-2+pmx1
lxc-pve: 6.0.5-1
lxcfs: 6.0.4-pve1
novnc-pve: 1.6.0-3
proxmox-backup-client: 4.0.14-1
proxmox-backup-file-restore: 4.0.14-1
proxmox-backup-restore-image: 1.0.0
proxmox-firewall: 1.1.2
proxmox-kernel-helper: 9.0.4
proxmox-mail-forward: 1.0.2
proxmox-mini-journalreader: 1.6
proxmox-widget-toolkit: 5.0.5
pve-cluster: 9.0.6
pve-container: 6.0.12
pve-docs: 9.0.8
pve-edk2-firmware: 4.2025.02-4
pve-esxi-import-tools: 1.0.1
pve-firewall: 6.0.3
pve-firmware: 3.16-4
pve-ha-manager: 5.0.4
pve-i18n: 3.6.0
pve-qemu-kvm: 10.0.2-4
pve-xtermjs: 5.5.0-2
qemu-server: 9.0.21
smartmontools: 7.4-pve1
spiceterm: 3.4.0
swtpm: 0.8.0+pve2
vncterm: 1.9.0
zfsutils-linux: 2.3.4-pve1

The backup storage is using ext4


I have added the complet jounal log in the attachment. it constanly gives this error:

Sep 17 09:05:16 proxmox pvestatd[1177]: VM 100 qmp command failed - VM 100 qmp command 'query-proxmox-support' failed - unable to connect to VM 100 qmp socket - timeout after 51 retries
Sep 17 09:05:17 proxmox pvestatd[1177]: status update time (8.051 seconds)

 

[fiona]

How does the CPU/IO load on the server look like during backup? You might want to configure a bandwidth limit and reduce the number of workers (can be done in the Advanced settings of the backup job).

 

[itsctlml]

Hi everyone,

after upgrading my host from Proxmox 8.x to 9.0.10 I ran into a problem when trying to back up a Windows 11 Pro VM. The VM uses a virtual TPM device (tpmstate0). Since the upgrade, backups with vzdump start but never progress beyond 0% – the job just hangs. On Proxmox 8.x everything worked fine. The issue happens regardless of the storage target (CIFS/NAS or local).

The root cause turned out to be the TPM state drive. During the backup Proxmox tries to attach the TPM device to the temporary QEMU process, and that step never completes.

The workaround is to edit the VM configuration and disable backup for the TPM state. In the configuration file of the VM (for example /etc/pve/qemu-server/205.conf), the line for the TPM device normally looks like:

tpmstate0: local-btrfs:205/vm-205-disk-2.raw,size=4M

By appending “,backup=0” to that line, it becomes:

tpmstate0: local-btrfs:205/vm-205-disk-2.raw,size=4M,backup=0

With this change, the TPM state is excluded from the backup. After saving the configuration, backups complete normally again.

One important note: with backup=0 the TPM data is not included in the archive. On restore, Windows might therefore prompt for the BitLocker recovery key, so make sure you have that key safe. Once Proxmox or QEMU includes a fix for this issue, it will be possible to re-enable TPM backups again by changing the setting back to backup=1.

Hopefully this helps others who upgraded from Proxmox 8.x to 9.0.10 and are now seeing their Windows 11 VM backups stuck when a TPM device is present.