[PULL 0/4] HPPA A400 updates

[PULL 0/4] HPPA A400 updates

[Helge Deller]

From: Helge Deller <deller@gmx.de>

The following changes since commit efa3b9d5ac8024078225e1ab434411fdfe53b457:

  Merge tag 'pbouvier/pr/tcg-tests-20260925' of https://gitlab.com/p-b-o/qemu into staging (2026-09-25 11:52:47 -0700)

are available in the Git repository at:

  https://github.com/hdeller/qemu-hppa.git tags/hppa-a400-updates-pull-request

for you to fetch changes up to 1f22bd961e7a512a59fb289daf218298e19ddf50:

  hw/hppa: Place the CPU at HPA 0xfffa0000 and fw_cfg at 0xfffb0000 (2026-10-02 23:39:28 +0200)

----------------------------------------------------------------
HPPA updates for A400 and new SeaBIOS

A new SeaBIOS-hppa version 26 with many fixes, and some updates
regarding the A400 machine. Main goal is still to get MPE
functional on the A400 machines.

Signed-off-by: Helge Deller <deller@gmx.de>

----------------------------------------------------------------

Craig Lalley (3):
  hw/hppa: Rotate Elroy PCI interrupts by pin on the A400
  hw/hppa: Place the second Elroy of the A400 on rope 2
  hw/hppa: Place the CPU at HPA 0xfffa0000 and fw_cfg at 0xfffb0000

Helge Deller (1):
  target/hppa: Update SeaBIOS-hppa to version 26

 hw/hppa/hppa_hardware.h     |   5 +++--
 hw/hppa/machine.c           |  14 +++++++++-----
 hw/pci-host/astro.c         |  32 ++++++++++++++++++++++++++++----
 include/hw/pci-host/astro.h |   2 ++
 pc-bios/hppa-firmware.img   | Bin 633992 -> 641484 bytes
 pc-bios/hppa-firmware64.img | Bin 666392 -> 682800 bytes
 roms/seabios-hppa           |   2 +-
 7 files changed, 43 insertions(+), 12 deletions(-)

-- 
2.54.0

[PULL 1/4] hw/hppa: Rotate Elroy PCI interrupts by pin on the A400

[Helge Deller]

From: Craig Lalley <mr_lalley@yahoo.com>

elroy_pci_map_irq() routes all four interrupt pins of a PCI slot to the
same IOSAPIC input, so on a multi-function device all functions share
one line.

Add an Astro property "rotate-pci-pins" and set it for the A400: INTA
of slot n then goes to IOSAPIC input n, INTB to n+1, and so on (modulo
ELROY_IRQS).  The C3700 is unchanged.

The firmware describes the routing to the OS in the interrupt routing
table, so this needs the matching SeaBIOS-hppa change "parisc: Rotate
IRT interrupt lines by PCI pin on the A400".  With only one side
applied, functions using INTB..INTD on an A400 are described with an
IOSAPIC input which never fires.

Signed-off-by: Craig Lalley <mr_lalley@yahoo.com>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/hppa/machine.c           | 10 ++++++----
 hw/pci-host/astro.c         |  6 ++++++
 include/hw/pci-host/astro.h |  1 +
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index 96133f09ba..df25877cb1 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -730,7 +730,7 @@ static void machine_HP_B160L_init(MachineState *machine)
     machine_HP_common_init_tail(machine, pci_bus, translate, false);
 }
 
-static AstroState *astro_init(void)
+static AstroState *astro_init(bool is_a400)
 {
     DeviceState *dev;
 
@@ -738,6 +738,8 @@ static AstroState *astro_init(void)
     object_property_set_int(OBJECT(dev), "phys-addr-bits",
                             hppa_phys_addr_bits(&cpu[0]->env),
                             &error_abort);
+    object_property_set_bool(OBJECT(dev), "rotate-pci-pins", is_a400,
+                             &error_abort);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     return ASTRO_CHIP(dev);
@@ -753,6 +755,8 @@ static void machine_HP_C3700_init(MachineState *machine)
     DeviceState *astro_dev;
     MemoryRegion *addr_space = get_system_memory();
     TranslateFn *translate;
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+    bool is_C3700 = strcmp(mc->name, "C3700") == 0;
 
     /* Create CPUs and RAM.  */
     translate = machine_HP_common_init_cpus(machine);
@@ -764,7 +768,7 @@ static void machine_HP_C3700_init(MachineState *machine)
     }
 
     /* Init Astro and the Elroys (PCI host bus chips).  */
-    astro = astro_init();
+    astro = astro_init(!is_C3700);
     astro_dev = DEVICE(astro);
     memory_region_add_subregion(addr_space, translate(NULL, ASTRO_HPA),
                                 sysbus_mmio_get_region(
@@ -773,8 +777,6 @@ static void machine_HP_C3700_init(MachineState *machine)
     assert(pci_bus);
 
     /* The C3700 has a SuperIO chip, while the A400 hasn't. */
-    MachineClass *mc = MACHINE_GET_CLASS(machine);
-    bool is_C3700 = strcmp(mc->name, "C3700") == 0;
     if (is_C3700)  {
         PCIDevice *ide_pdev = pci_create_simple(pci_bus, PCI_DEVFN(2, 0),
                                                 "pc87560-ide");
diff --git a/hw/pci-host/astro.c b/hw/pci-host/astro.c
index fc07608da7..c024dab858 100644
--- a/hw/pci-host/astro.c
+++ b/hw/pci-host/astro.c
@@ -406,9 +406,14 @@ static void elroy_set_irq(void *opaque, int irq, int level)
 
 static int elroy_pci_map_irq(PCIDevice *d, int irq_num)
 {
+    ElroyState *s = pci_get_bus(d)->irq_opaque;
     int slot = PCI_SLOT(d->devfn);
 
     assert(irq_num >= 0 && irq_num < ELROY_IRQS);
+    /* INTB..INTD of a slot may be rotated to the following inputs */
+    if (s->astro && s->astro->rotate_pci_pins) {
+        return (slot + irq_num) & (ELROY_IRQS - 1);
+    }
     return slot & (ELROY_IRQS - 1);
 }
 
@@ -1064,6 +1069,7 @@ static void astro_realize(DeviceState *obj, Error **errp)
 
 static const Property astro_props[] = {
     DEFINE_PROP_UINT8("phys-addr-bits", AstroState, phys_addr_bits, 32),
+    DEFINE_PROP_BOOL("rotate-pci-pins", AstroState, rotate_pci_pins, false),
 };
 
 static void astro_class_init(ObjectClass *klass, const void *data)
diff --git a/include/hw/pci-host/astro.h b/include/hw/pci-host/astro.h
index 0cd384bceb..3297cd2e62 100644
--- a/include/hw/pci-host/astro.h
+++ b/include/hw/pci-host/astro.h
@@ -84,6 +84,7 @@ struct AstroState {
     uint64_t tlb_pdir_base;
 
     uint8_t phys_addr_bits;
+    bool rotate_pci_pins;       /* PCI INTx pin rotation (A400) */
 
     struct ElroyState *elroy[ELROY_NUM];
 
-- 
2.54.0

[PULL 2/4] hw/hppa: Place the second Elroy of the A400 on rope 2

[Helge Deller]

From: Craig Lalley <mr_lalley@yahoo.com>

On the A400 (and A500) the second Elroy PCI host bridge is connected
to Astro rope 2 at HPA 0xfed34000 (hardware path [0:2]), not to rope 1
at 0xfed32000 as on the C3700.

Add an Astro property "elroy1-on-rope2" which places the second Elroy
at 0xfed34000 on rope 2, including its LMMIO and GMMIO windows, and
set it for the A400.  The C3700 is unchanged.

This pairs with the SeaBIOS-hppa change "parisc/a400: Second Elroy is
at 0xfed34000 on rope 2", which reports the Elroy at that address.  No
PCI devices are attached behind the second Elroy by default.

Signed-off-by: Craig Lalley <mr_lalley@yahoo.com>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/hppa/hppa_hardware.h     |  1 +
 hw/hppa/machine.c           |  2 ++
 hw/pci-host/astro.c         | 26 ++++++++++++++++++++++----
 include/hw/pci-host/astro.h |  1 +
 4 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/hw/hppa/hppa_hardware.h b/hw/hppa/hppa_hardware.h
index e2b2faa4a3..615b422865 100644
--- a/hw/hppa/hppa_hardware.h
+++ b/hw/hppa/hppa_hardware.h
@@ -31,6 +31,7 @@
 #define ASTRO_HPA       0xfed00000
 #define ELROY0_HPA      0xfed30000
 #define ELROY2_HPA      0xfed32000
+#define ELROY4_HPA      0xfed34000      /* second Elroy on A400/A500, rope 2 */
 #define ELROY8_HPA      0xfed38000
 #define ELROYc_HPA      0xfed3c000
 #define ASTRO_MEMORY_HPA 0xfed10200
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index df25877cb1..fb3ef25f04 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -740,6 +740,8 @@ static AstroState *astro_init(bool is_a400)
                             &error_abort);
     object_property_set_bool(OBJECT(dev), "rotate-pci-pins", is_a400,
                              &error_abort);
+    object_property_set_bool(OBJECT(dev), "elroy1-on-rope2", is_a400,
+                             &error_abort);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     return ASTRO_CHIP(dev);
diff --git a/hw/pci-host/astro.c b/hw/pci-host/astro.c
index c024dab858..c688418ded 100644
--- a/hw/pci-host/astro.c
+++ b/hw/pci-host/astro.c
@@ -41,6 +41,23 @@ static const int elroy_hpa_offsets[ELROY_NUM] = {
 static const char elroy_rope_nr[ELROY_NUM] = {
             0, 1, 4, 6 }; /* busnum path, e.g. [10:6] */
 
+/* On the A400 the second Elroy is connected to rope 2 */
+static int astro_elroy_hpa_offset(AstroState *s, int i)
+{
+    if (i == 1 && s->elroy1_on_rope2) {
+        return ELROY4_HPA - ASTRO_HPA;
+    }
+    return elroy_hpa_offsets[i];
+}
+
+static int astro_elroy_rope_nr(AstroState *s, int i)
+{
+    if (i == 1 && s->elroy1_on_rope2) {
+        return 2;
+    }
+    return elroy_rope_nr[i];
+}
+
 /* Astro version numbers */
 enum { ID_ASTRO_1_0 = 0, ID_ASTRO_2_1 = 9, ID_ASTRO_3_0 = 2 };
 
@@ -589,7 +606,7 @@ static void adjust_LMMIO_mapping(AstroState *s)
 
         elroy = s->elroy[i];
         alias = &elroy->lmmio_alias;
-        rope = elroy_rope_nr[i];
+        rope = astro_elroy_rope_nr(s, i);
         if (alias->enabled) {
             memory_region_set_enabled(alias, false);
         }
@@ -715,7 +732,7 @@ static void adjust_GMMIO_mapping(AstroState *s)
 
         elroy = s->elroy[i];
         alias = &elroy->gmmio_alias;
-        rope = elroy_rope_nr[i];
+        rope = astro_elroy_rope_nr(s, i);
         if (alias->enabled) {
             memory_region_set_enabled(alias, false);
         }
@@ -1017,8 +1034,8 @@ static void astro_realize(DeviceState *obj, Error **errp)
         uint64_t map_size;
         int rope;
 
-        addr_offset = elroy_hpa_offsets[i];
-        rope = elroy_rope_nr[i];
+        addr_offset = astro_elroy_hpa_offset(s, i);
+        rope = astro_elroy_rope_nr(s, i);
 
         elroy = elroy_init(i);
         s->elroy[i] = elroy;
@@ -1070,6 +1087,7 @@ static void astro_realize(DeviceState *obj, Error **errp)
 static const Property astro_props[] = {
     DEFINE_PROP_UINT8("phys-addr-bits", AstroState, phys_addr_bits, 32),
     DEFINE_PROP_BOOL("rotate-pci-pins", AstroState, rotate_pci_pins, false),
+    DEFINE_PROP_BOOL("elroy1-on-rope2", AstroState, elroy1_on_rope2, false),
 };
 
 static void astro_class_init(ObjectClass *klass, const void *data)
diff --git a/include/hw/pci-host/astro.h b/include/hw/pci-host/astro.h
index 3297cd2e62..30d7a0b332 100644
--- a/include/hw/pci-host/astro.h
+++ b/include/hw/pci-host/astro.h
@@ -85,6 +85,7 @@ struct AstroState {
 
     uint8_t phys_addr_bits;
     bool rotate_pci_pins;       /* PCI INTx pin rotation (A400) */
+    bool elroy1_on_rope2;       /* second Elroy on rope 2 (A400) */
 
     struct ElroyState *elroy[ELROY_NUM];
 
-- 
2.54.0

[PULL 4/4] hw/hppa: Place the CPU at HPA 0xfffa0000 and fw_cfg at 0xfffb0000

[Helge Deller]

From: Craig Lalley <mr_lalley@yahoo.com>

On real Astro based machines (C3700, A400, A500) the first CPU is at
HPA 0xfffa0000.  QEMU puts it one page higher at 0xfffb0000 and uses
0xfffa0000 for the fw_cfg interface, which does not exist on real
hardware.  Swap both, so that the OS sees the CPU at its real address.

Please note:

- CPU_HPA is shared with the 32-bit machines, so the CPU of the B160L
  and the 715 moves as well.  On the B160L this also changes the CPU
  module number, which the firmware derives from the HPA, from 48 to
  32.  The real B160L has its CPU at 0xfff10000, so neither value is
  the real one there.

- MIN_SEABIOS_HPPA_VERSION is raised to 26. Starting with this version
  the firmware is able to cope with any CPU_HPA address which is
  provided by QEMU.

Signed-off-by: Craig Lalley <mr_lalley@yahoo.com>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/hppa/hppa_hardware.h | 4 ++--
 hw/hppa/machine.c       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/hppa/hppa_hardware.h b/hw/hppa/hppa_hardware.h
index 615b422865..c7ac6bdb85 100644
--- a/hw/hppa/hppa_hardware.h
+++ b/hw/hppa/hppa_hardware.h
@@ -24,7 +24,7 @@
 #define LASI_HPA        0xffd00000
 #define LASI_GFX_HPA    0xf8000000
 #define ARTIST_FB_ADDR  0xf9000000
-#define CPU_HPA         0xfffb0000
+#define CPU_HPA         0xfffa0000      /* as on real Astro based machines */
 #define MEMORY_HPA      0xfffff000
 
 #define IDE_HPA         0xf9000000      /* Boot disc controller */
@@ -48,7 +48,7 @@
 #define PORT_PCI_CMD    hppa_port_pci_cmd
 #define PORT_PCI_DATA   hppa_port_pci_data
 
-#define FW_CFG_IO_BASE  0xfffa0000
+#define FW_CFG_IO_BASE  0xfffb0000
 
 #define PORT_SERIAL1    (LASI_UART_HPA + 0x800)
 #define PORT_SERIAL2    (DINO_UART_HPA + 0x800)
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index fb3ef25f04..0b0a8047ed 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -48,7 +48,7 @@ struct HppaMachineState {
     uint64_t memsplit_addr;
 };
 
-#define MIN_SEABIOS_HPPA_VERSION 22 /* require at least this fw version */
+#define MIN_SEABIOS_HPPA_VERSION 26 /* require at least this fw version */
 
 #define HPA_POWER_BUTTON        (FIRMWARE_END - 0x10)
 static hwaddr soft_power_reg;
-- 
2.54.0

Re: [PULL 0/4] HPPA A400 updates

[Richard Henderson]

On 10/2/26 23:50, Helge Deller wrote:
> From: Helge Deller<deller@gmx.de>
> 
> The following changes since commit efa3b9d5ac8024078225e1ab434411fdfe53b457:
> 
>    Merge tag 'pbouvier/pr/tcg-tests-20260925' ofhttps://gitlab.com/p-b-o/qemu into staging (2026-09-25 11:52:47 -0700)
> 
> are available in the Git repository at:
> 
>    https://github.com/hdeller/qemu-hppa.git tags/hppa-a400-updates-pull-request
> 
> for you to fetch changes up to 1f22bd961e7a512a59fb289daf218298e19ddf50:
> 
>    hw/hppa: Place the CPU at HPA 0xfffa0000 and fw_cfg at 0xfffb0000 (2026-10-02 23:39:28 +0200)
> 
> ----------------------------------------------------------------
> HPPA updates for A400 and new SeaBIOS
> 
> A new SeaBIOS-hppa version 26 with many fixes, and some updates
> regarding the A400 machine. Main goal is still to get MPE
> functional on the A400 machines.

Applied, thanks.

r~