46cd2c1050f0 ("hw/tpm: add PPI support to tpm-tis-device for ARM64
virt") unconditionally registers a "tpm-ppi" RAMBlock when the TPM
TIS sysbus device is realized.  This breaks backward migration: a
QEMU with PPI support cannot migrate to an older QEMU without it:

  Unknown ramblock "tpm-ppi", cannot accept migration

The failure is 100% reproducible on any aarch64 guest that uses
tpm-tis-device when migrating to a host whose QEMU predates the PPI
commit.

Fix by gating the PPI memory region behind a new "ppi" device
property, and disabling it via hw_compat_11_0[] for machine types
<= virt-11.0.  Also move the sysbus_init_mmio() calls from
instance_init to realizefn so the memory regions are properly
initialized before being registered (Peter).

While testing I also found that not exposing the 2nd MMIO slot causes
platform_bus_get_mmio_addr() to crash: sysbus_mmio_get_region()
returns NULL for the unregistered slot, and the function passes
it to memory_region_is_mapped() without a NULL check.  Patch 3
adds a one-line guard so callers get -1 instead of a SIGSEGV.

Changes in v2:
- Dropped zero-size memory region hack (Peter)
- Moved sysbus_init_mmio() from initfn to realizefn (Peter)
- Only expose PPI MMIO region when ppi=on (Peter)
- Added NULL guard in platform_bus_get_mmio_addr()
- v1: https://lore.kernel.org/qemu-devel/20260618123317.633869-1-mbawa@redhat.com

Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>

Mohammadfaiz Bawa (3):
  hw/tpm: gate PPI support on tpm-tis-device behind a device property
  hw/core/machine: disable tpm-tis-device PPI for machine type <= 11.0
  hw/core/platform-bus: guard platform_bus_get_mmio_addr() against NULL

 hw/core/machine.c       |  1 +
 hw/core/platform-bus.c  |  3 +--
 hw/tpm/tpm_tis.h        |  1 +
 hw/tpm/tpm_tis_sysbus.c | 18 +++++++++++-------
 4 files changed, 14 insertions(+), 9 deletions(-)

-- 
2.54.0