[PATCH v3 0/3] hw/tpm: add PPI support to tpm-tis-device on ARM64 virt

[PATCH v3 0/3] hw/tpm: add PPI support to tpm-tis-device on ARM64 virt

[Mohammadfaiz Bawa]

The ARM virt machine's tpm-tis-device lacks Physical Presence Interface
(PPI) support - no _DSM, _STA, or PPI operation regions in the ACPI
namespace. This causes Windows 11 ARM64 guests to log Event ID 15
(tpm.sys) errors per boot.

This series documents the change, refactors tpm_build_ppi_acpi() to
accept a dynamic PPI base address, then wires up PPI MMIO and ACPI
on tpm-tis-sysbus via the platform bus.

Tested: aarch64 KVM, upstream QEMU, Win11 ARM64 25H2, swtpm.
Event ID 15 eliminated.

Changes in v3:
- Rebased on top of Philippe's ppi_enabled refactoring series
- Updated sysbus to set ppi_enabled on TPMIfClass instead of
  instance property
- Updated x86 CRB caller in hw/i386/acpi-build.c to pass
  ppi_base (Stefan)

Changes in v2:
- Moved tpm.rst documentation hunk from patch 3 into patch 1 (Stefan)
- Added Reviewed-by tags

Based-on: 20260317120241.16320-1-philmd@linaro.org
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>

Mohammadfaiz Bawa (3):
  docs/specs/tpm: document PPI support on ARM64 virt
  hw/acpi/tpm: parameterize PPI base address in tpm_build_ppi_acpi
  hw/tpm: add PPI support to tpm-tis-device for ARM64 virt

 docs/specs/tpm.rst       | 24 ++++++++++++++++++++++++
 hw/acpi/tpm.c            |  8 ++++----
 hw/arm/virt-acpi-build.c |  9 ++++++++-
 hw/i386/acpi-build.c     |  2 +-
 hw/tpm/tpm_tis_isa.c     |  2 +-
 hw/tpm/tpm_tis_sysbus.c  | 11 +++++++++++
 include/hw/acpi/tpm.h    |  3 ++-
 7 files changed, 51 insertions(+), 8 deletions(-)


base-commit: 9eadbfc48dc892339273890709539e45d7d14219
-- 
2.53.0

[PATCH v3 1/3] docs/specs/tpm: document PPI support on ARM64 virt

[Mohammadfaiz Bawa]

Document that tpm-tis-device on the ARM virt machine supports PPI
with dynamically allocated MMIO via the platform bus, unlike x86
where PPI is at the fixed address 0xFED45000.

Also add hw/arm/virt-acpi-build.c and hw/acpi/tpm.c to the list
of files related to TPM ACPI tables.

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
---
 docs/specs/tpm.rst | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst
index b630a351b4..ba2b0d7267 100644
--- a/docs/specs/tpm.rst
+++ b/docs/specs/tpm.rst
@@ -187,8 +187,32 @@ The location of the table is given by the fw_cfg ``tpmppi_address``
 field.  The PPI memory region size is 0x400 (``TPM_PPI_ADDR_SIZE``) to
 leave enough room for future updates.
 
+PPI on ARM64 virt
+-----------------
+
+The ARM virt machine supports PPI for ``tpm-tis-device`` as defined
+in the `PPI specification`_.
+
+Unlike the x86 TIS device where the PPI memory region is mapped at
+the fixed address ``0xFED45000`` (within the TIS MMIO range), the
+ARM64 sysbus device registers PPI memory as a second MMIO region
+on the platform bus. The platform bus assigns the guest physical
+address dynamically at device plug time. The ACPI ``_DSM`` method
+and PPI operation regions reference this dynamically resolved
+address.
+
+PPI is controlled by the ``ppi`` property (default ``on``)::
+
+    -device tpm-tis-device,tpmdev=tpm0,ppi=on
+
+Without PPI, guest operating systems such as Windows 11
+ARM64 will log errors when attempting to query TPM Physical
+Presence capabilities via the ACPI ``_DSM`` method.
+
 QEMU files related to TPM ACPI tables:
  - ``hw/i386/acpi-build.c``
+ - ``hw/arm/virt-acpi-build.c``
+ - ``hw/acpi/tpm.c``
  - ``include/hw/acpi/tpm.h``
 
 TPM backend devices
-- 
2.53.0

[PATCH v3 2/3] hw/acpi/tpm: parameterize PPI base address in tpm_build_ppi_acpi

[Mohammadfaiz Bawa]

Add a ppi_base parameter to tpm_build_ppi_acpi() instead of
hardcoding TPM_PPI_ADDR_BASE. This prepares for ARM64 support where
PPI memory is dynamically allocated by the platform bus and the
address is not known at compile time.

Update the x86 callers (ISA TIS and CRB) to pass TPM_PPI_ADDR_BASE
explicitly. No behavioral change.

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
---
 hw/acpi/tpm.c         | 8 ++++----
 hw/i386/acpi-build.c  | 2 +-
 hw/tpm/tpm_tis_isa.c  | 2 +-
 include/hw/acpi/tpm.h | 3 ++-
 4 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/hw/acpi/tpm.c b/hw/acpi/tpm.c
index 5fe95f2e3f..e703775984 100644
--- a/hw/acpi/tpm.c
+++ b/hw/acpi/tpm.c
@@ -20,7 +20,7 @@
 #include "qapi/error.h"
 #include "hw/acpi/tpm.h"
 
-void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev)
+void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev, hwaddr ppi_base)
 {
     Aml *method, *field, *ifctx, *ifctx2, *ifctx3, *func_mask,
         *not_implemented, *pak, *tpm2, *tpm3, *pprm, *pprq, *zero, *one;
@@ -40,7 +40,7 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev)
      */
     aml_append(dev,
                aml_operation_region("TPP2", AML_SYSTEM_MEMORY,
-                                    aml_int(TPM_PPI_ADDR_BASE + 0x100),
+                                    aml_int(ppi_base + 0x100),
                                     0x5A));
     field = aml_field("TPP2", AML_ANY_ACC, AML_NOLOCK, AML_PRESERVE);
     aml_append(field, aml_named_field("PPIN", 8));
@@ -56,7 +56,7 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev)
     aml_append(dev,
                aml_operation_region(
                    "TPP3", AML_SYSTEM_MEMORY,
-                   aml_int(TPM_PPI_ADDR_BASE +
+                   aml_int(ppi_base +
                            0x15a /* movv, docs/specs/tpm.rst */),
                            0x1));
     field = aml_field("TPP3", AML_BYTE_ACC, AML_NOLOCK, AML_PRESERVE);
@@ -78,7 +78,7 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev)
 
         aml_append(method,
             aml_operation_region("TPP1", AML_SYSTEM_MEMORY,
-                aml_add(aml_int(TPM_PPI_ADDR_BASE), op, NULL), 0x1));
+                aml_add(aml_int(ppi_base), op, NULL), 0x1));
         field = aml_field("TPP1", AML_BYTE_ACC, AML_NOLOCK, AML_PRESERVE);
         aml_append(field, aml_named_field("TPPF", 8));
         aml_append(method, field);
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 4f01e2c476..0d7c83d5e9 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -1219,7 +1219,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         aml_append(dev, aml_name_decl("_STA", aml_int(0xf)));
         aml_append(dev, aml_name_decl("_UID", aml_int(1)));
 
-        tpm_build_ppi_acpi(tpm, dev);
+        tpm_build_ppi_acpi(tpm, dev, TPM_PPI_ADDR_BASE);
 
         aml_append(sb_scope, dev);
     }
diff --git a/hw/tpm/tpm_tis_isa.c b/hw/tpm/tpm_tis_isa.c
index 1ca403241d..2b1267133a 100644
--- a/hw/tpm/tpm_tis_isa.c
+++ b/hw/tpm/tpm_tis_isa.c
@@ -159,7 +159,7 @@ static void build_tpm_tis_isa_aml(AcpiDevAmlIf *adev, Aml *scope)
      */
     /* aml_append(crs, aml_irq_no_flags(isadev->state.irq_num)); */
     aml_append(dev, aml_name_decl("_CRS", crs));
-    tpm_build_ppi_acpi(ti, dev);
+    tpm_build_ppi_acpi(ti, dev, TPM_PPI_ADDR_BASE);
     aml_append(scope, dev);
 }
 
diff --git a/include/hw/acpi/tpm.h b/include/hw/acpi/tpm.h
index d2bf6637c5..2ab186a745 100644
--- a/include/hw/acpi/tpm.h
+++ b/include/hw/acpi/tpm.h
@@ -20,6 +20,7 @@
 #include "hw/core/registerfields.h"
 #include "hw/acpi/aml-build.h"
 #include "system/tpm.h"
+#include "exec/hwaddr.h"
 
 #ifdef CONFIG_TPM
 
@@ -250,7 +251,7 @@ REG32(CRB_DATA_BUFFER, 0x80)
  */
 #define TPM_I2C_INT_ENABLE_MASK   0x0
 
-void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev);
+void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev, hwaddr ppi_base);
 
 #endif /* CONFIG_TPM */
 
-- 
2.53.0

[PATCH v3 3/3] hw/tpm: add PPI support to tpm-tis-device for ARM64 virt

[Mohammadfaiz Bawa]

Add PPI memory region and ACPI _STA, _DSM to tpm-tis-sysbus so
Windows 11 ARM64 guests no longer log Event ID 15 errors from
tpm.sys on every boot.

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
---
 hw/arm/virt-acpi-build.c |  9 ++++++++-
 hw/tpm/tpm_tis_sysbus.c  | 11 +++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 591cfc993c..5b5ac551f8 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -240,7 +240,8 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms)
     Aml *dev = aml_device("TPM0");
     aml_append(dev, aml_name_decl("_HID", aml_string("MSFT0101")));
     aml_append(dev, aml_name_decl("_STR", aml_string("TPM 2.0 Device")));
-    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
+    aml_append(dev, aml_name_decl("_UID", aml_int(1)));
+    aml_append(dev, aml_name_decl("_STA", aml_int(0xF)));
 
     Aml *crs = aml_resource_template();
     aml_append(crs,
@@ -248,6 +249,12 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms)
                                   (uint32_t)memory_region_size(sbdev_mr),
                                   AML_READ_WRITE));
     aml_append(dev, aml_name_decl("_CRS", crs));
+
+    hwaddr ppi_base = platform_bus_get_mmio_addr(pbus, sbdev, 1);
+    if (ppi_base != -1) {
+        ppi_base += pbus_base;
+        tpm_build_ppi_acpi(TPM_IF(sbdev), dev, ppi_base);
+    }
     aml_append(scope, dev);
 }
 #endif
diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index dd30344d5a..6bec30c36f 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -30,6 +30,7 @@
 #include "hw/core/sysbus.h"
 #include "tpm_tis.h"
 #include "qom/object.h"
+#include "qemu/memalign.h"
 
 struct TPMStateSysBus {
     /*< private >*/
@@ -99,6 +100,7 @@ static void tpm_tis_sysbus_initfn(Object *obj)
 {
     TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(obj);
     TPMState *s = &sbdev->state;
+    size_t host_page_size = qemu_real_host_page_size();
 
     memory_region_init_io(&s->mmio, obj, &tpm_tis_memory_ops,
                           s, "tpm-tis-mmio",
@@ -106,6 +108,12 @@ static void tpm_tis_sysbus_initfn(Object *obj)
 
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+
+    s->ppi.buf = qemu_memalign(host_page_size,
+                                ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
+    memory_region_init_ram_device_ptr(&s->ppi.ram, obj, "tpm-ppi",
+                                      TPM_PPI_ADDR_SIZE, s->ppi.buf);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->ppi.ram);
 }
 
 static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
@@ -122,6 +130,8 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
         error_setg(errp, "'tpmdev' property is required");
         return;
     }
+
+    vmstate_register_ram(&s->ppi.ram, dev);
 }
 
 static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data)
@@ -132,6 +142,7 @@ static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data)
     device_class_set_props(dc, tpm_tis_sysbus_properties);
     dc->vmsd  = &vmstate_tpm_tis_sysbus;
     tc->model = TPM_MODEL_TPM_TIS;
+    tc->ppi_enabled = true;
     dc->realize = tpm_tis_sysbus_realizefn;
     device_class_set_legacy_reset(dc, tpm_tis_sysbus_reset);
     tc->request_completed = tpm_tis_sysbus_request_completed;
-- 
2.53.0

Re: [PATCH v3 2/3] hw/acpi/tpm: parameterize PPI base address in tpm_build_ppi_acpi

[Philippe Mathieu-Daudé]

On 27/3/26 18:32, Mohammadfaiz Bawa wrote:
> Add a ppi_base parameter to tpm_build_ppi_acpi() instead of
> hardcoding TPM_PPI_ADDR_BASE. This prepares for ARM64 support where
> PPI memory is dynamically allocated by the platform bus and the
> address is not known at compile time.
> 
> Update the x86 callers (ISA TIS and CRB) to pass TPM_PPI_ADDR_BASE
> explicitly. No behavioral change.
> 
> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
> Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
> ---
>   hw/acpi/tpm.c         | 8 ++++----
>   hw/i386/acpi-build.c  | 2 +-
>   hw/tpm/tpm_tis_isa.c  | 2 +-
>   include/hw/acpi/tpm.h | 3 ++-
>   4 files changed, 8 insertions(+), 7 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Re: [PATCH v3 3/3] hw/tpm: add PPI support to tpm-tis-device for ARM64 virt

[Philippe Mathieu-Daudé]

Hi,

On 27/3/26 18:32, Mohammadfaiz Bawa wrote:
> Add PPI memory region and ACPI _STA, _DSM to tpm-tis-sysbus so
> Windows 11 ARM64 guests no longer log Event ID 15 errors from
> tpm.sys on every boot.
> 
> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
> Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
> ---
>   hw/arm/virt-acpi-build.c |  9 ++++++++-
>   hw/tpm/tpm_tis_sysbus.c  | 11 +++++++++++
>   2 files changed, 19 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
> index 591cfc993c..5b5ac551f8 100644
> --- a/hw/arm/virt-acpi-build.c
> +++ b/hw/arm/virt-acpi-build.c
> @@ -240,7 +240,8 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms)
>       Aml *dev = aml_device("TPM0");
>       aml_append(dev, aml_name_decl("_HID", aml_string("MSFT0101")));
>       aml_append(dev, aml_name_decl("_STR", aml_string("TPM 2.0 Device")));
> -    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
> +    aml_append(dev, aml_name_decl("_UID", aml_int(1)));
> +    aml_append(dev, aml_name_decl("_STA", aml_int(0xF)));
>   
>       Aml *crs = aml_resource_template();
>       aml_append(crs,
> @@ -248,6 +249,12 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms)
>                                     (uint32_t)memory_region_size(sbdev_mr),
>                                     AML_READ_WRITE));
>       aml_append(dev, aml_name_decl("_CRS", crs));
> +
> +    hwaddr ppi_base = platform_bus_get_mmio_addr(pbus, sbdev, 1);
> +    if (ppi_base != -1) {
> +        ppi_base += pbus_base;
> +        tpm_build_ppi_acpi(TPM_IF(sbdev), dev, ppi_base);

Matter of style, I'd rather:

            tpm_build_ppi_acpi(TPM_IF(sbdev), dev, pbus_base + ppi_base);

> +    }
>       aml_append(scope, dev);
>   }
>   #endif

Hmm I see in tests/qtest/bios-tables-test.c that test_acpi_tcg_tpm()
only tests X86 (Q35). Could you see how to add coverage for Aarch64
virt machine? (It could be a patch on top, no need to repost a v4).

Otherwise,

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Re: [PATCH v3 3/3] hw/tpm: add PPI support to tpm-tis-device for ARM64 virt

[Mohammadfaiz Bawa]

On Sat, Mar 28, 2026 at 5:17 AM Philippe Mathieu-Daudé
<philmd@linaro.org> wrote:
>
> Hi,
>
> On 27/3/26 18:32, Mohammadfaiz Bawa wrote:
> > Add PPI memory region and ACPI _STA, _DSM to tpm-tis-sysbus so
> > Windows 11 ARM64 guests no longer log Event ID 15 errors from
> > tpm.sys on every boot.
> >
> > Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
> > Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
> > ---
> >   hw/arm/virt-acpi-build.c |  9 ++++++++-
> >   hw/tpm/tpm_tis_sysbus.c  | 11 +++++++++++
> >   2 files changed, 19 insertions(+), 1 deletion(-)
> >
> > diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
> > index 591cfc993c..5b5ac551f8 100644
> > --- a/hw/arm/virt-acpi-build.c
> > +++ b/hw/arm/virt-acpi-build.c
> > @@ -240,7 +240,8 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms)
> >       Aml *dev = aml_device("TPM0");
> >       aml_append(dev, aml_name_decl("_HID", aml_string("MSFT0101")));
> >       aml_append(dev, aml_name_decl("_STR", aml_string("TPM 2.0 Device")));
> > -    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
> > +    aml_append(dev, aml_name_decl("_UID", aml_int(1)));
> > +    aml_append(dev, aml_name_decl("_STA", aml_int(0xF)));
> >
> >       Aml *crs = aml_resource_template();
> >       aml_append(crs,
> > @@ -248,6 +249,12 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms)
> >                                     (uint32_t)memory_region_size(sbdev_mr),
> >                                     AML_READ_WRITE));
> >       aml_append(dev, aml_name_decl("_CRS", crs));
> > +
> > +    hwaddr ppi_base = platform_bus_get_mmio_addr(pbus, sbdev, 1);
> > +    if (ppi_base != -1) {
> > +        ppi_base += pbus_base;
> > +        tpm_build_ppi_acpi(TPM_IF(sbdev), dev, ppi_base);
>
> Matter of style, I'd rather:
>
>             tpm_build_ppi_acpi(TPM_IF(sbdev), dev, pbus_base + ppi_base);
>
> > +    }
> >       aml_append(scope, dev);
> >   }
> >   #endif
>
> Hmm I see in tests/qtest/bios-tables-test.c that test_acpi_tcg_tpm()
> only tests X86 (Q35). Could you see how to add coverage for Aarch64
> virt machine? (It could be a patch on top, no need to repost a v4).
>
> Otherwise,
>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
>

Noted, and I'll look into adding tests aarch64 virt coverage as a follow-up.

Thanks,
Faiz