Commit dc6444b9c5 for qemu.org

commit dc6444b9c595dc40d7ead0837b930b83ec966e1f
Author: Mohammadfaiz Bawa <mbawa@redhat.com>
Date:   Thu May 28 15:01:23 2026 +0530

    hw/tpm/tpm_tis_sysbus: defer resource allocation to realize

    Calling memory_region_init_ram_device_ptr() and
    memory_region_init_io() from tpm_tis_sysbus_initfn() crashes
    when the device is introspected without being realized, because
    the memory subsystem has not been initialized at that point.

    So running:
      $ qemu-system-aarch64 -device tpm-tis-device,help

    triggers qdev_device_help() which creates the device object
    to list its properties, calling instance_init, but never
    realizefn. The memory region calls in instance_init then hit
    uninitialized subsystems:

    With CONFIG_DEBUG_TCG:
      Assertion 'target_page.decided' failed. (physmem.c:2524)

    Without CONFIG_DEBUG_TCG:
      Assertion 'mutex->initialized' failed. (qemu-thread-posix.c:107)

    Since realizefn is only called when the device is actually
    used in a running VM, moving resource allocation there avoids
    the crash without breaking introspection.

    This also fixes a memory leak that is reported by the address
    sanitizer during 'make check', because we currently allocate
    ppi.buf during instance_init and never free it. "Allocate in
    realize and never free" is less bad, because we don't currently
    support "unrealize and destroy a sysbus device".

    Fixes: 46cd2c1050f ("hw/tpm: add PPI support to tpm-tis-device for ARM64 virt")
    Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
    Message-ID: <20260528093123.55403-1-mbawa@redhat.com>
    Message-ID: <CAFEAcA8fEYODmPhbh1W=oPGvju-P=qWvN_dyWrPqAr-E9FK7UA@mail.gmail.com>
    [PMD: Amend Peter comment from previous mail in description]
    Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index 6bec30c36f..f9cd1c8b5c 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -100,19 +100,9 @@ static void tpm_tis_sysbus_initfn(Object *obj)
 {
     TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(obj);
     TPMState *s = &sbdev->state;
-    size_t host_page_size = qemu_real_host_page_size();
-
-    memory_region_init_io(&s->mmio, obj, &tpm_tis_memory_ops,
-                          s, "tpm-tis-mmio",
-                          TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);

     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
-    s->ppi.buf = qemu_memalign(host_page_size,
-                                ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
-    memory_region_init_ram_device_ptr(&s->ppi.ram, obj, "tpm-ppi",
-                                      TPM_PPI_ADDR_SIZE, s->ppi.buf);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->ppi.ram);
 }

@@ -120,6 +110,7 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
 {
     TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(dev);
     TPMState *s = &sbdev->state;
+    const size_t host_page_size = qemu_real_host_page_size();

     if (!tpm_find()) {
         error_setg(errp, "at most one TPM device is permitted");
@@ -131,6 +122,13 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
         return;
     }

+    s->ppi.buf = qemu_memalign(host_page_size,
+                               ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
+    memory_region_init_io(&s->mmio, OBJECT(dev), &tpm_tis_memory_ops,
+                          s, "tpm-tis-mmio",
+                          TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);
+    memory_region_init_ram_device_ptr(&s->ppi.ram, OBJECT(dev), "tpm-ppi",
+                                      TPM_PPI_ADDR_SIZE, s->ppi.buf);
     vmstate_register_ram(&s->ppi.ram, dev);
 }