[PATCH v3 0/3] hw/tpm: fix tpm-tis-device backward migration on aarch64

Mohammadfaiz Bawa posted 3 patches 1 month, 1 week ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260619093140.832136-1-mbawa@redhat.com
Maintainers: "Philippe Mathieu-Daudé" <philmd@mailo.com>, Zhao Liu <zhao1.liu@intel.com>, Stefan Berger <stefanb@linux.vnet.ibm.com>
hw/core/machine.c       |  1 +
hw/core/platform-bus.c  |  3 +--
hw/tpm/tpm_tis.h        |  1 +
hw/tpm/tpm_tis_sysbus.c | 18 +++++++++++-------
4 files changed, 14 insertions(+), 9 deletions(-)
[PATCH v3 0/3] hw/tpm: fix tpm-tis-device backward migration on aarch64
Posted by Mohammadfaiz Bawa 1 month, 1 week ago
46cd2c1050f0 ("hw/tpm: add PPI support to tpm-tis-device for ARM64
virt") unconditionally registers a "tpm-ppi" RAMBlock when the TPM
TIS sysbus device is realized.  This breaks backward migration: a
QEMU with PPI support cannot migrate to an older QEMU without it:

  Unknown ramblock "tpm-ppi", cannot accept migration

The failure is 100% reproducible on any aarch64 guest that uses
tpm-tis-device when migrating to a host whose QEMU predates the PPI
commit.

Fix by gating the PPI memory region behind a new "ppi" device
property, and disabling it via hw_compat_11_0[] for machine types
<= virt-11.0.  Also move the sysbus_init_mmio() calls from
instance_init to realizefn so the memory regions are properly
initialized before being registered (Peter).

Not exposing the 2nd MMIO slot when ppi=off triggers a NULL
dereference in platform_bus_get_mmio_addr(), so patch 1 adds a
guard first.

Changes in v3:
- Reordered: platform-bus NULL guard is now patch 1 (Peter)

Changes in v2:
- Dropped zero-size memory region hack (Peter)
- Moved sysbus_init_mmio() from initfn to realizefn (Peter)
- Only expose PPI MMIO region when ppi=on (Peter)
- Added NULL guard in platform_bus_get_mmio_addr() (found via testing)
- v1: https://lore.kernel.org/qemu-devel/20260618123317.633869-1-mbawa@redhat.com
- v2: https://lore.kernel.org/qemu-devel/20260619053623.756021-1-mbawa@redhat.com

Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>

Mohammadfaiz Bawa (3):
  hw/core/platform-bus: guard platform_bus_get_mmio_addr() against NULL
  hw/tpm: gate PPI support on tpm-tis-device behind a device property
  hw/core/machine: disable tpm-tis-device PPI for machine type <= 11.0

 hw/core/machine.c       |  1 +
 hw/core/platform-bus.c  |  3 +--
 hw/tpm/tpm_tis.h        |  1 +
 hw/tpm/tpm_tis_sysbus.c | 18 +++++++++++-------
 4 files changed, 14 insertions(+), 9 deletions(-)

-- 
2.54.0
Re: [PATCH v3 0/3] hw/tpm: fix tpm-tis-device backward migration on aarch64
Posted by Mohammadfaiz Bawa 3 weeks, 6 days ago
On Fri, Jun 19, 2026 at 3:01 PM Mohammadfaiz Bawa <mbawa@redhat.com> wrote:
>
> 46cd2c1050f0 ("hw/tpm: add PPI support to tpm-tis-device for ARM64
> virt") unconditionally registers a "tpm-ppi" RAMBlock when the TPM
> TIS sysbus device is realized.  This breaks backward migration: a
> QEMU with PPI support cannot migrate to an older QEMU without it:
>
>   Unknown ramblock "tpm-ppi", cannot accept migration
>
> The failure is 100% reproducible on any aarch64 guest that uses
> tpm-tis-device when migrating to a host whose QEMU predates the PPI
> commit.
>
> Fix by gating the PPI memory region behind a new "ppi" device
> property, and disabling it via hw_compat_11_0[] for machine types
> <= virt-11.0.  Also move the sysbus_init_mmio() calls from
> instance_init to realizefn so the memory regions are properly
> initialized before being registered (Peter).
>
> Not exposing the 2nd MMIO slot when ppi=off triggers a NULL
> dereference in platform_bus_get_mmio_addr(), so patch 1 adds a
> guard first.
>
> Changes in v3:
> - Reordered: platform-bus NULL guard is now patch 1 (Peter)
>
> Changes in v2:
> - Dropped zero-size memory region hack (Peter)
> - Moved sysbus_init_mmio() from initfn to realizefn (Peter)
> - Only expose PPI MMIO region when ppi=on (Peter)
> - Added NULL guard in platform_bus_get_mmio_addr() (found via testing)
> - v1: https://lore.kernel.org/qemu-devel/20260618123317.633869-1-mbawa@redhat.com
> - v2: https://lore.kernel.org/qemu-devel/20260619053623.756021-1-mbawa@redhat.com
>
> Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
>
> Mohammadfaiz Bawa (3):
>   hw/core/platform-bus: guard platform_bus_get_mmio_addr() against NULL
>   hw/tpm: gate PPI support on tpm-tis-device behind a device property
>   hw/core/machine: disable tpm-tis-device PPI for machine type <= 11.0
>
>  hw/core/machine.c       |  1 +
>  hw/core/platform-bus.c  |  3 +--
>  hw/tpm/tpm_tis.h        |  1 +
>  hw/tpm/tpm_tis_sysbus.c | 18 +++++++++++-------
>  4 files changed, 14 insertions(+), 9 deletions(-)
>
> --
> 2.54.0
>
Gentle ping.
Patch 1/3 has Peter's Reviewed-by. Looking for review on the other two.

Thanks,
Faiz