[PULL 0/4] Hppa fixes for v11.1 patches

[PULL 0/4] Hppa fixes for v11.1 patches

[Helge Deller]

From: Helge Deller <deller@gmx.de>

The following changes since commit 7f2007d1924565c7a38b2c6ba01ebc1a85db0a49:

  Merge tag 'pull-qobject-2026-07-02' of https://repo.or.cz/qemu/armbru into staging (2026-07-03 07:42:51 +0200)

are available in the Git repository at:

  https://github.com/hdeller/qemu-hppa.git tags/hppa-fixes-for-v11.1-pull-request

for you to fetch changes up to 90ce9a41508d4368d16334f7d1d8a9ed9bfa3747:

  target/hppa: Update SeaBIOS-hppa to version 25 (2026-07-05 17:42:14 +0200)

----------------------------------------------------------------
Updates for hppa architecture for qemu v11.1

A few patches to fix TLB for HP-UX 9, and a lasi irq fix,
as well as a new SeaBIOS-hppa v25 firmware.

----------------------------------------------------------------

Helge Deller (3):
  target/hppa: Work-around for Fast TLB insert instruction on HP-UX 9
  target/hppa: Delay MMU update until TLB protection bits were set
  target/hppa: Update SeaBIOS-hppa to version 25

Keith Monahan (1):
  hw/misc/lasi: derive IRR from pending and unmasked requests

 hw/misc/lasi.c              |  25 +++++++++++++++++++------
 pc-bios/hppa-firmware.img   | Bin 632780 -> 633992 bytes
 pc-bios/hppa-firmware64.img | Bin 665208 -> 666392 bytes
 roms/seabios-hppa           |   2 +-
 target/hppa/insns.decode    |   2 ++
 target/hppa/translate.c     |   4 ++--
 6 files changed, 24 insertions(+), 9 deletions(-)

-- 
2.54.0

[PULL 1/4] target/hppa: Work-around for Fast TLB insert instruction on HP-UX 9

[Helge Deller]

From: Helge Deller <deller@gmx.de>

The HP-UX 9 kernel uses two TLB insert instructions (0x05315440 and
0x05385400), which seem to be wrongly encoded fast TLB instructions, but
similiar to the non-fast instructions idtlba r17,(r9) and
idtlbp r24,(r9).

It's not clear, if those undocumented instructions were used by mistake,
or intentionally. Either way, this patch allows qemu to handle those
instructions, so that a HP-UX 9 boot-CD can now boot somewhat further (but
still crashes due to other reasons afterwards).

Signed-off-by: Helge Deller <deller@gmx.de>
Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hppa/insns.decode | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/hppa/insns.decode b/target/hppa/insns.decode
index 13c6a55bf2..f700fe472e 100644
--- a/target/hppa/insns.decode
+++ b/target/hppa/insns.decode
@@ -164,6 +164,8 @@ ixtlbx          000001 b:5 r:5 ... 000000 addr:1 0 00000        \
 
 # pcxl and pcxl2 Fast TLB Insert instructions
 ixtlbxf         000001 00000 r:5 00 0 data:1 01000 addr:1 0 00000
+# workaround for non-standard encoding as used in HP-UX 9
+ixtlbxf         000001 01001 r:5 01 0 data:1 01000 addr:1 0 00000
 
 # pa2.0 tlb insert idtlbt and iitlbt instructions
 ixtlbt          000001 r2:5 r1:5 000 data:1 100000 0 00000    # idtlbt
-- 
2.54.0

[PULL 2/4] target/hppa: Delay MMU update until TLB protection bits were set

[Helge Deller]

From: Helge Deller <deller@gmx.de>

On a 32-bit HPPA CPU, the TLB update for a data translation happens with
two consecutive instructions: IDTLBA and IDTLBP. The former sets the
target page address, while the second sets the protection bits.
There is no need to update the MMU after setting the address bits only,
so delay the final update of the MMU until after the execution of the
second instruction when the protection bits are known too.

Signed-off-by: Helge Deller <deller@gmx.de>
---
 target/hppa/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 4e34822565..002189ddfb 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -2570,7 +2570,7 @@ static bool trans_ixtlbx(DisasContext *ctx, arg_ixtlbx *a)
     }
 
     /* Exit TB for TLB change if mmu is enabled.  */
-    if (ctx->tb_flags & PSW_C) {
+    if (ctx->tb_flags & PSW_C && !a->addr) {
         ctx->base.is_jmp = DISAS_IAQ_N_STALE;
     }
     return nullify_end(ctx);
@@ -2687,7 +2687,7 @@ static bool trans_ixtlbxf(DisasContext *ctx, arg_ixtlbxf *a)
     }
 
     /* Exit TB for TLB change if mmu is enabled.  */
-    if (ctx->tb_flags & PSW_C) {
+    if (ctx->tb_flags & PSW_C && !a->addr) {
         ctx->base.is_jmp = DISAS_IAQ_N_STALE;
     }
     return nullify_end(ctx);
-- 
2.54.0

[PULL 3/4] hw/misc/lasi: derive IRR from pending and unmasked requests

[Helge Deller]

From: Keith Monahan <keith@techtravels.org>

The LASI interrupt request register (IRR) was latched: set when a source
asserted and then never cleared or re-evaluated against the mask, so a
masked or dropped request stayed set forever. The parisc core I/O
dispatcher reads IRR to find its interrupt source, so the stuck bit was
returned on every later interrupt as an "unexpected core I/O interrupt".
On an installed HP-UX system an unacknowledged i82596 LAN interrupt
latched this way and the flood wedged the boot.

Derive IRR as (pending & unmasked) with IPR tracking each source's level,
matching the hardware and the in-tree parisc gsc/lasi driver.

Signed-off-by: Keith Monahan <keith@techtravels.org>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/misc/lasi.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/hw/misc/lasi.c b/hw/misc/lasi.c
index e8e1578b75..f0dfd78b4d 100644
--- a/hw/misc/lasi.c
+++ b/hw/misc/lasi.c
@@ -62,7 +62,15 @@ static MemTxResult lasi_chip_read_with_attrs(void *opaque, hwaddr addr,
 
     switch (addr) {
     case LASI_IRR:
-        val = s->irr;
+        /*
+         * The interrupt request register reports the interrupts that are both
+         * pending and unmasked, derived live from IPR and IMR rather than
+         * latched, so masking or deasserting a source removes it immediately.
+         * The parisc core I/O interrupt dispatcher reads IRR; a latched bit
+         * that never cleared would be redelivered forever as a phantom
+         * "unexpected" interrupt.
+         */
+        val = s->ipr & s->imr;
         break;
     case LASI_IMR:
         val = s->imr;
@@ -234,13 +242,18 @@ static void lasi_set_irq(void *opaque, int irq, int level)
 
     if (level) {
         s->ipr |= bit;
-        if (bit & s->imr) {
+        if ((bit & s->imr) && (s->icr & ICR_BUS_ERROR_BIT) == 0) {
             uint32_t iar = s->iar;
-            s->irr |= bit;
-            if ((s->icr & ICR_BUS_ERROR_BIT) == 0) {
-                stl_be_phys(&address_space_memory, iar & -32, iar & 31);
-            }
+            stl_be_phys(&address_space_memory, iar & -32, iar & 31);
         }
+    } else {
+        /*
+         * The interrupt sources are level triggered, so a source that drops
+         * its request must clear its pending bit.  Otherwise the bit stays set
+         * in IPR (and hence IRR) and is redelivered as a phantom "unexpected"
+         * core I/O interrupt on every later interrupt.
+         */
+        s->ipr &= ~bit;
     }
 }
 
-- 
2.54.0