Add PPI memory region and ACPI _STA, _DSM to tpm-tis-sysbus so
Windows 11 ARM64 guests no longer log Event ID 15 errors from
tpm.sys on every boot.

Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
---
 docs/specs/tpm.rst       |  8 +++++---
 hw/arm/virt-acpi-build.c |  9 ++++++++-
 hw/tpm/tpm_tis_sysbus.c  | 11 +++++++++++
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst
index 63cc0b68cd79d64138d4dd05ae158430c6a74643..ba2b0d726745fdf8ebc4c73c9c42e1ff8047a9db 100644
--- a/docs/specs/tpm.rst
+++ b/docs/specs/tpm.rst
@@ -201,9 +201,11 @@ address dynamically at device plug time. The ACPI ``_DSM`` method
 and PPI operation regions reference this dynamically resolved
 address.
 
-PPI is enabled by default and can be controlled with the ``ppi``
-property (e.g. ``-device tpm-tis-device,tpmdev=tpm0,ppi=on``).
-Without PPI support, guest operating systems such as Windows 11
+PPI is controlled by the ``ppi`` property (default ``on``)::
+
+    -device tpm-tis-device,tpmdev=tpm0,ppi=on
+
+Without PPI, guest operating systems such as Windows 11
 ARM64 will log errors when attempting to query TPM Physical
 Presence capabilities via the ACPI ``_DSM`` method.
 
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 719d2f994e65f976f6e754259d0b4f1336f82f13..27a7389a33df221a9dfb0cde1bc35b3ab62e56be 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -240,7 +240,8 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms)
     Aml *dev = aml_device("TPM0");
     aml_append(dev, aml_name_decl("_HID", aml_string("MSFT0101")));
     aml_append(dev, aml_name_decl("_STR", aml_string("TPM 2.0 Device")));
-    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
+    aml_append(dev, aml_name_decl("_UID", aml_int(1)));
+    aml_append(dev, aml_name_decl("_STA", aml_int(0xF)));
 
     Aml *crs = aml_resource_template();
     aml_append(crs,
@@ -248,6 +249,12 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms)
                                   (uint32_t)memory_region_size(sbdev_mr),
                                   AML_READ_WRITE));
     aml_append(dev, aml_name_decl("_CRS", crs));
+
+    hwaddr ppi_base = platform_bus_get_mmio_addr(pbus, sbdev, 1);
+    if (ppi_base != -1) {
+        ppi_base += pbus_base;
+        tpm_build_ppi_acpi(TPM_IF(sbdev), dev, ppi_base);
+    }
     aml_append(scope, dev);
 }
 #endif
diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index e9372e7316305fe1a4d415a712ab516e0fd5f073..f8b63dd4607cacb319e27ea83e421ec5bdc1cb0f 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -30,6 +30,7 @@
 #include "hw/core/sysbus.h"
 #include "tpm_tis.h"
 #include "qom/object.h"
+#include "qemu/memalign.h"
 
 struct TPMStateSysBus {
     /*< private >*/
@@ -93,12 +94,14 @@ static void tpm_tis_sysbus_reset(DeviceState *dev)
 static const Property tpm_tis_sysbus_properties[] = {
     DEFINE_PROP_UINT32("irq", TPMStateSysBus, state.irq_num, TPM_TIS_IRQ),
     DEFINE_PROP_TPMBE("tpmdev", TPMStateSysBus, state.be_driver),
+    DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, true),
 };
 
 static void tpm_tis_sysbus_initfn(Object *obj)
 {
     TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(obj);
     TPMState *s = &sbdev->state;
+    size_t host_page_size = qemu_real_host_page_size();
 
     memory_region_init_io(&s->mmio, obj, &tpm_tis_memory_ops,
                           s, "tpm-tis-mmio",
@@ -106,6 +109,12 @@ static void tpm_tis_sysbus_initfn(Object *obj)
 
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+
+    s->ppi.buf = qemu_memalign(host_page_size,
+                                ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
+    memory_region_init_ram_device_ptr(&s->ppi.ram, obj, "tpm-ppi",
+                                      TPM_PPI_ADDR_SIZE, s->ppi.buf);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->ppi.ram);
 }
 
 static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
@@ -122,6 +131,8 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
         error_setg(errp, "'tpmdev' property is required");
         return;
     }
+
+    vmstate_register_ram(&s->ppi.ram, dev);
 }
 
 static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data)

-- 
2.53.0

On 3/24/26 3:10 AM, Mohammadfaiz Bawa wrote:
> Add PPI memory region and ACPI _STA, _DSM to tpm-tis-sysbus so
> Windows 11 ARM64 guests no longer log Event ID 15 errors from
> tpm.sys on every boot.
> 
> Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
> ---
>   docs/specs/tpm.rst       |  8 +++++---
>   hw/arm/virt-acpi-build.c |  9 ++++++++-
>   hw/tpm/tpm_tis_sysbus.c  | 11 +++++++++++
>   3 files changed, 24 insertions(+), 4 deletions(-)
> 
> diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst
> index 63cc0b68cd79d64138d4dd05ae158430c6a74643..ba2b0d726745fdf8ebc4c73c9c42e1ff8047a9db 100644
> --- a/docs/specs/tpm.rst
> +++ b/docs/specs/tpm.rst
> @@ -201,9 +201,11 @@ address dynamically at device plug time. The ACPI ``_DSM`` method
>   and PPI operation regions reference this dynamically resolved
>   address.
> 
> -PPI is enabled by default and can be controlled with the ``ppi``
> -property (e.g. ``-device tpm-tis-device,tpmdev=tpm0,ppi=on``).
> -Without PPI support, guest operating systems such as Windows 11
> +PPI is controlled by the ``ppi`` property (default ``on``)::
> +
> +    -device tpm-tis-device,tpmdev=tpm0,ppi=on
> +
> +Without PPI, guest operating systems such as Windows 11

This change brings nothing new. It could be in the first patch.

>   ARM64 will log errors when attempting to query TPM Physical
>   Presence capabilities via the ACPI ``_DSM`` method.
> 
> diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
> index 719d2f994e65f976f6e754259d0b4f1336f82f13..27a7389a33df221a9dfb0cde1bc35b3ab62e56be 100644
> --- a/hw/arm/virt-acpi-build.c
> +++ b/hw/arm/virt-acpi-build.c
> @@ -240,7 +240,8 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms)
>       Aml *dev = aml_device("TPM0");
>       aml_append(dev, aml_name_decl("_HID", aml_string("MSFT0101")));
>       aml_append(dev, aml_name_decl("_STR", aml_string("TPM 2.0 Device")));
> -    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
> +    aml_append(dev, aml_name_decl("_UID", aml_int(1)));
> +    aml_append(dev, aml_name_decl("_STA", aml_int(0xF)));
> 
>       Aml *crs = aml_resource_template();
>       aml_append(crs,
> @@ -248,6 +249,12 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms)
>                                     (uint32_t)memory_region_size(sbdev_mr),
>                                     AML_READ_WRITE));
>       aml_append(dev, aml_name_decl("_CRS", crs));
> +
> +    hwaddr ppi_base = platform_bus_get_mmio_addr(pbus, sbdev, 1);
> +    if (ppi_base != -1) {
> +        ppi_base += pbus_base;
> +        tpm_build_ppi_acpi(TPM_IF(sbdev), dev, ppi_base);
> +    }
>       aml_append(scope, dev);
>   }
>   #endif
> diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
> index e9372e7316305fe1a4d415a712ab516e0fd5f073..f8b63dd4607cacb319e27ea83e421ec5bdc1cb0f 100644
> --- a/hw/tpm/tpm_tis_sysbus.c
> +++ b/hw/tpm/tpm_tis_sysbus.c
> @@ -30,6 +30,7 @@
>   #include "hw/core/sysbus.h"
>   #include "tpm_tis.h"
>   #include "qom/object.h"
> +#include "qemu/memalign.h"
> 
>   struct TPMStateSysBus {
>       /*< private >*/
> @@ -93,12 +94,14 @@ static void tpm_tis_sysbus_reset(DeviceState *dev)
>   static const Property tpm_tis_sysbus_properties[] = {
>       DEFINE_PROP_UINT32("irq", TPMStateSysBus, state.irq_num, TPM_TIS_IRQ),
>       DEFINE_PROP_TPMBE("tpmdev", TPMStateSysBus, state.be_driver),
> +    DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, true),
>   };
> 
>   static void tpm_tis_sysbus_initfn(Object *obj)
>   {
>       TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(obj);
>       TPMState *s = &sbdev->state;
> +    size_t host_page_size = qemu_real_host_page_size();
> 
>       memory_region_init_io(&s->mmio, obj, &tpm_tis_memory_ops,
>                             s, "tpm-tis-mmio",
> @@ -106,6 +109,12 @@ static void tpm_tis_sysbus_initfn(Object *obj)
> 
>       sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
>       sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
> +
> +    s->ppi.buf = qemu_memalign(host_page_size,
> +                                ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
> +    memory_region_init_ram_device_ptr(&s->ppi.ram, obj, "tpm-ppi",
> +                                      TPM_PPI_ADDR_SIZE, s->ppi.buf);
> +    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->ppi.ram);
>   }
> 
>   static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
> @@ -122,6 +131,8 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
>           error_setg(errp, "'tpmdev' property is required");
>           return;
>       }
> +
> +    vmstate_register_ram(&s->ppi.ram, dev);
>   }
> 
>   static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data)
> 

Aside from the documentation part:

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>