[PATCH v3 0/3] hw/tpm: fix tpm-tis-device backward migration on aarch64

[PATCH v3 0/3] hw/tpm: fix tpm-tis-device backward migration on aarch64

[Mohammadfaiz Bawa]

46cd2c1050f0 ("hw/tpm: add PPI support to tpm-tis-device for ARM64
virt") unconditionally registers a "tpm-ppi" RAMBlock when the TPM
TIS sysbus device is realized.  This breaks backward migration: a
QEMU with PPI support cannot migrate to an older QEMU without it:

  Unknown ramblock "tpm-ppi", cannot accept migration

The failure is 100% reproducible on any aarch64 guest that uses
tpm-tis-device when migrating to a host whose QEMU predates the PPI
commit.

Fix by gating the PPI memory region behind a new "ppi" device
property, and disabling it via hw_compat_11_0[] for machine types
<= virt-11.0.  Also move the sysbus_init_mmio() calls from
instance_init to realizefn so the memory regions are properly
initialized before being registered (Peter).

Not exposing the 2nd MMIO slot when ppi=off triggers a NULL
dereference in platform_bus_get_mmio_addr(), so patch 1 adds a
guard first.

Changes in v3:
- Reordered: platform-bus NULL guard is now patch 1 (Peter)

Changes in v2:
- Dropped zero-size memory region hack (Peter)
- Moved sysbus_init_mmio() from initfn to realizefn (Peter)
- Only expose PPI MMIO region when ppi=on (Peter)
- Added NULL guard in platform_bus_get_mmio_addr() (found via testing)
- v1: https://lore.kernel.org/qemu-devel/20260618123317.633869-1-mbawa@redhat.com
- v2: https://lore.kernel.org/qemu-devel/20260619053623.756021-1-mbawa@redhat.com

Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>

Mohammadfaiz Bawa (3):
  hw/core/platform-bus: guard platform_bus_get_mmio_addr() against NULL
  hw/tpm: gate PPI support on tpm-tis-device behind a device property
  hw/core/machine: disable tpm-tis-device PPI for machine type <= 11.0

 hw/core/machine.c       |  1 +
 hw/core/platform-bus.c  |  3 +--
 hw/tpm/tpm_tis.h        |  1 +
 hw/tpm/tpm_tis_sysbus.c | 18 +++++++++++-------
 4 files changed, 14 insertions(+), 9 deletions(-)

-- 
2.54.0

[PATCH v3 1/3] hw/core/platform-bus: guard platform_bus_get_mmio_addr() against NULL

[Mohammadfaiz Bawa]

sysbus_mmio_get_region() returns NULL when a device has fewer MMIO
regions than the requested slot index.  platform_bus_get_mmio_addr()
passes the result directly to memory_region_is_mapped() without a
NULL check, causing a SIGSEGV.

Return -1 early when the region pointer is NULL, consistent with the
existing "not mapped" path.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
---
 hw/core/platform-bus.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/core/platform-bus.c b/hw/core/platform-bus.c
index a2217a2dee..16d0ecc0f3 100644
--- a/hw/core/platform-bus.c
+++ b/hw/core/platform-bus.c
@@ -59,8 +59,7 @@ hwaddr platform_bus_get_mmio_addr(PlatformBusDevice *pbus, SysBusDevice *sbdev,
     Object *pbus_mr_obj = OBJECT(pbus_mr);
     Object *parent_mr;
 
-    if (!memory_region_is_mapped(sbdev_mr)) {
-        /* Region is not mapped? */
+    if (!sbdev_mr || !memory_region_is_mapped(sbdev_mr)) {
         return -1;
     }
 
-- 
2.54.0

[PATCH v3 2/3] hw/tpm: gate PPI support on tpm-tis-device behind a device property

[Mohammadfaiz Bawa]

Add a "ppi" boolean property (default: true) to tpm-tis-device.
When ppi=off the RAMBlock is never registered and the migration
stream omits "tpm-ppi", restoring backward compatibility.

Move sysbus_init_mmio() calls from instance_init to realizefn so
the memory regions are initialized before being registered.  When
ppi=off, the PPI MMIO region is simply not exposed.

Fixes: 46cd2c1050f0 ("hw/tpm: add PPI support to tpm-tis-device for ARM64 virt")
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
---
 hw/tpm/tpm_tis.h        |  1 +
 hw/tpm/tpm_tis_sysbus.c | 18 +++++++++++-------
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/hw/tpm/tpm_tis.h b/hw/tpm/tpm_tis.h
index 1531620bf9..6ac9804050 100644
--- a/hw/tpm/tpm_tis.h
+++ b/hw/tpm/tpm_tis.h
@@ -76,6 +76,7 @@ typedef struct TPMState {
     size_t be_buffer_size;
 
     TPMPPI ppi;
+    bool ppi_enabled;
 } TPMState;
 
 extern const VMStateDescription vmstate_locty;
diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index 16bb17874b..a7b0002d82 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -94,6 +94,7 @@ static void tpm_tis_sysbus_reset(DeviceState *dev)
 static const Property tpm_tis_sysbus_properties[] = {
     DEFINE_PROP_UINT32("irq", TPMStateSysBus, state.irq_num, TPM_TIS_IRQ),
     DEFINE_PROP_TPMBE("tpmdev", TPMStateSysBus, state.be_driver),
+    DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, true),
 };
 
 static void tpm_tis_sysbus_initfn(Object *obj)
@@ -101,9 +102,7 @@ static void tpm_tis_sysbus_initfn(Object *obj)
     TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(obj);
     TPMState *s = &sbdev->state;
 
-    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->ppi.ram);
 }
 
 static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
@@ -122,14 +121,19 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
-    s->ppi.buf = qemu_memalign(host_page_size,
-                               ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
     memory_region_init_io(&s->mmio, OBJECT(dev), &tpm_tis_memory_ops,
                           s, "tpm-tis-mmio",
                           TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);
-    memory_region_init_ram_device_ptr(&s->ppi.ram, OBJECT(dev), "tpm-ppi",
-                                      TPM_PPI_ADDR_SIZE, s->ppi.buf);
-    vmstate_register_ram(&s->ppi.ram, dev);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
+
+    if (s->ppi_enabled) {
+        s->ppi.buf = qemu_memalign(host_page_size,
+                                   ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
+        memory_region_init_ram_device_ptr(&s->ppi.ram, OBJECT(dev), "tpm-ppi",
+                                          TPM_PPI_ADDR_SIZE, s->ppi.buf);
+        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->ppi.ram);
+        vmstate_register_ram(&s->ppi.ram, dev);
+    }
 }
 
 static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data)
-- 
2.54.0

Re: [PATCH v3 2/3] hw/tpm: gate PPI support on tpm-tis-device behind a device property

[Stefan Berger]

On 6/19/26 5:31 AM, Mohammadfaiz Bawa wrote:
> Add a "ppi" boolean property (default: true) to tpm-tis-device.
> When ppi=off the RAMBlock is never registered and the migration
> stream omits "tpm-ppi", restoring backward compatibility.
> 
> Move sysbus_init_mmio() calls from instance_init to realizefn so
> the memory regions are initialized before being registered.  When
> ppi=off, the PPI MMIO region is simply not exposed.
> 
> Fixes: 46cd2c1050f0 ("hw/tpm: add PPI support to tpm-tis-device for ARM64 virt")
> Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
> ---
>   hw/tpm/tpm_tis.h        |  1 +
>   hw/tpm/tpm_tis_sysbus.c | 18 +++++++++++-------
>   2 files changed, 12 insertions(+), 7 deletions(-)
> 
> diff --git a/hw/tpm/tpm_tis.h b/hw/tpm/tpm_tis.h
> index 1531620bf9..6ac9804050 100644
> --- a/hw/tpm/tpm_tis.h
> +++ b/hw/tpm/tpm_tis.h
> @@ -76,6 +76,7 @@ typedef struct TPMState {
>       size_t be_buffer_size;
>   
>       TPMPPI ppi;
> +    bool ppi_enabled;
>   } TPMState;
>   
>   extern const VMStateDescription vmstate_locty;
> diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
> index 16bb17874b..a7b0002d82 100644
> --- a/hw/tpm/tpm_tis_sysbus.c
> +++ b/hw/tpm/tpm_tis_sysbus.c
> @@ -94,6 +94,7 @@ static void tpm_tis_sysbus_reset(DeviceState *dev)
>   static const Property tpm_tis_sysbus_properties[] = {
>       DEFINE_PROP_UINT32("irq", TPMStateSysBus, state.irq_num, TPM_TIS_IRQ),
>       DEFINE_PROP_TPMBE("tpmdev", TPMStateSysBus, state.be_driver),
> +    DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, true),
>   };
>   
>   static void tpm_tis_sysbus_initfn(Object *obj)
> @@ -101,9 +102,7 @@ static void tpm_tis_sysbus_initfn(Object *obj)
>       TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(obj);
>       TPMState *s = &sbdev->state;
>   
> -    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
>       sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
> -    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->ppi.ram);
>   }
>   
>   static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
> @@ -122,14 +121,19 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
>           return;
>       }
>   
> -    s->ppi.buf = qemu_memalign(host_page_size,
> -                               ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
>       memory_region_init_io(&s->mmio, OBJECT(dev), &tpm_tis_memory_ops,
>                             s, "tpm-tis-mmio",
>                             TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);
> -    memory_region_init_ram_device_ptr(&s->ppi.ram, OBJECT(dev), "tpm-ppi",
> -                                      TPM_PPI_ADDR_SIZE, s->ppi.buf);
> -    vmstate_register_ram(&s->ppi.ram, dev);
> +    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
> +
> +    if (s->ppi_enabled) {
> +        s->ppi.buf = qemu_memalign(host_page_size,
> +                                   ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
> +        memory_region_init_ram_device_ptr(&s->ppi.ram, OBJECT(dev), "tpm-ppi",
> +                                          TPM_PPI_ADDR_SIZE, s->ppi.buf);
> +        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->ppi.ram);
> +        vmstate_register_ram(&s->ppi.ram, dev);
> +    }
>   }
>   
>   static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data)

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>

[PATCH v3 3/3] hw/core/machine: disable tpm-tis-device PPI for machine type <= 11.0

[Mohammadfaiz Bawa]

Set ppi=off in hw_compat_11_0[] so that older machine types do not
register the "tpm-ppi" RAMBlock, restoring backward migration.

Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
---
 hw/core/machine.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 9a10e45aab..92cf5e1ca1 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -44,6 +44,7 @@ GlobalProperty hw_compat_11_0[] = {
     { "chardev-vc", "encoding", "cp437" },
     { "tpm-crb", "cap-chunk", "off" },
     { "tpm-crb", "x-allow-chunk-migration", "off" },
+    { "tpm-tis-device", "ppi", "off" },
     { TYPE_ARM_SMMUV3, "ats", "off" },
     { TYPE_ARM_SMMUV3, "ril", "on" },
     { TYPE_ARM_SMMUV3, "ssidsize", "0" },
-- 
2.54.0

Re: [PATCH v3 3/3] hw/core/machine: disable tpm-tis-device PPI for machine type <= 11.0

[Stefan Berger]

On 6/19/26 5:31 AM, Mohammadfaiz Bawa wrote:
> Set ppi=off in hw_compat_11_0[] so that older machine types do not
> register the "tpm-ppi" RAMBlock, restoring backward migration.
> 
> Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
> ---
>   hw/core/machine.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/hw/core/machine.c b/hw/core/machine.c
> index 9a10e45aab..92cf5e1ca1 100644
> --- a/hw/core/machine.c
> +++ b/hw/core/machine.c
> @@ -44,6 +44,7 @@ GlobalProperty hw_compat_11_0[] = {
>       { "chardev-vc", "encoding", "cp437" },
>       { "tpm-crb", "cap-chunk", "off" },
>       { "tpm-crb", "x-allow-chunk-migration", "off" },
> +    { "tpm-tis-device", "ppi", "off" },
>       { TYPE_ARM_SMMUV3, "ats", "off" },
>       { TYPE_ARM_SMMUV3, "ril", "on" },
>       { TYPE_ARM_SMMUV3, "ssidsize", "0" },

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>

Re: [PATCH v3 0/3] hw/tpm: fix tpm-tis-device backward migration on aarch64

[Mohammadfaiz Bawa]

On Fri, Jun 19, 2026 at 3:01 PM Mohammadfaiz Bawa <mbawa@redhat.com> wrote:
>
> 46cd2c1050f0 ("hw/tpm: add PPI support to tpm-tis-device for ARM64
> virt") unconditionally registers a "tpm-ppi" RAMBlock when the TPM
> TIS sysbus device is realized.  This breaks backward migration: a
> QEMU with PPI support cannot migrate to an older QEMU without it:
>
>   Unknown ramblock "tpm-ppi", cannot accept migration
>
> The failure is 100% reproducible on any aarch64 guest that uses
> tpm-tis-device when migrating to a host whose QEMU predates the PPI
> commit.
>
> Fix by gating the PPI memory region behind a new "ppi" device
> property, and disabling it via hw_compat_11_0[] for machine types
> <= virt-11.0.  Also move the sysbus_init_mmio() calls from
> instance_init to realizefn so the memory regions are properly
> initialized before being registered (Peter).
>
> Not exposing the 2nd MMIO slot when ppi=off triggers a NULL
> dereference in platform_bus_get_mmio_addr(), so patch 1 adds a
> guard first.
>
> Changes in v3:
> - Reordered: platform-bus NULL guard is now patch 1 (Peter)
>
> Changes in v2:
> - Dropped zero-size memory region hack (Peter)
> - Moved sysbus_init_mmio() from initfn to realizefn (Peter)
> - Only expose PPI MMIO region when ppi=on (Peter)
> - Added NULL guard in platform_bus_get_mmio_addr() (found via testing)
> - v1: https://lore.kernel.org/qemu-devel/20260618123317.633869-1-mbawa@redhat.com
> - v2: https://lore.kernel.org/qemu-devel/20260619053623.756021-1-mbawa@redhat.com
>
> Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
>
> Mohammadfaiz Bawa (3):
>   hw/core/platform-bus: guard platform_bus_get_mmio_addr() against NULL
>   hw/tpm: gate PPI support on tpm-tis-device behind a device property
>   hw/core/machine: disable tpm-tis-device PPI for machine type <= 11.0
>
>  hw/core/machine.c       |  1 +
>  hw/core/platform-bus.c  |  3 +--
>  hw/tpm/tpm_tis.h        |  1 +
>  hw/tpm/tpm_tis_sysbus.c | 18 +++++++++++-------
>  4 files changed, 14 insertions(+), 9 deletions(-)
>
> --
> 2.54.0
>
Gentle ping.
Patch 1/3 has Peter's Reviewed-by. Looking for review on the other two.

Thanks,
Faiz