[PULL 0/6] Hppa fixes for v11 patches

[PULL 0/6] Hppa fixes for v11 patches

[Helge Deller]

From: Helge Deller <deller@gmx.de>

The following changes since commit 559919ce54927d59b215a4665eda7ab6118a48aa:

  Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2026-03-16 13:07:33 +0000)

are available in the Git repository at:

  https://github.com/hdeller/qemu-hppa.git tags/hppa-fixes-for-v11-pull-request

for you to fetch changes up to fa2d5d84e023d79d1ad35b952c0f9a3aa8f442e9:

  target/hppa: Update SeaBIOS-hppa to version 23 (2026-03-19 22:06:49 +0100)

----------------------------------------------------------------
HPPA fixes for v11

Some late fixes for QEMU-v11

Various fixes in SeaBIOS-hppa and qemu code, most importantly
this fixes boot of the C3700, which broke while we added
support for CPUs with 40 and 44 bits physical address space.

----------------------------------------------------------------

Helge Deller (6):
  hw/hppa: Fix description of the HP A400-44 server
  hw/hppa: Adjust physical addresses of Astro and Elroy
  target/hppa: Always map 64-bit firmware at 0xfffffff0f0000000
  hw/pci-host/astro: Use proper region names
  hw/hppa: Fix crash of 64-bit HP-UX 11 while flushing caches
  target/hppa: Update SeaBIOS-hppa to version 23

 hw/hppa/hppa_hardware.h     |   4 ++--
 hw/hppa/machine.c           |  22 +++++++++++++++++++++-
 hw/pci-host/astro.c         |   6 ++++--
 pc-bios/hppa-firmware.img   | Bin 632048 -> 631968 bytes
 pc-bios/hppa-firmware64.img | Bin 713608 -> 714440 bytes
 roms/seabios-hppa           |   2 +-
 target/hppa/mem_helper.c    |  10 ++++++----
 7 files changed, 34 insertions(+), 10 deletions(-)

-- 
2.53.0

[PULL 1/6] hw/hppa: Fix description of the HP A400-44 server

[Helge Deller]

From: Helge Deller <deller@gmx.de>

The HP A400-44 machine has a height of 2U and is a noisy server machine
which was usually running in the datacenter.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Anton Johansson <anjo@rev.ng>
---
 hw/hppa/machine.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index ec63dc1297..e72dda2a68 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -840,7 +840,7 @@ static void HP_A400_machine_init_class_init(ObjectClass *oc, const void *data)
     };
     MachineClass *mc = MACHINE_CLASS(oc);
 
-    mc->desc = "HP A400-44 workstation";
+    mc->desc = "HP A400-44 server";
     mc->default_cpu_type = TYPE_HPPA_CPU_PA_8500;
     mc->valid_cpu_types = valid_cpu_types;
     mc->init = machine_HP_A400_init;
-- 
2.53.0

[PULL 2/6] hw/hppa: Adjust physical addresses of Astro and Elroy

[Helge Deller]

From: Helge Deller <deller@gmx.de>

Adjust the addresses of the Astro and Elroy PCI chips to a
44-bit physical address space when running a PA8700 CPU.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Anton Johansson <anjo@rev.ng>
---
 hw/hppa/hppa_hardware.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/hppa/hppa_hardware.h b/hw/hppa/hppa_hardware.h
index 0a89c3ed52..006aae63b9 100644
--- a/hw/hppa/hppa_hardware.h
+++ b/hw/hppa/hppa_hardware.h
@@ -61,8 +61,8 @@
 #define ASTRO_BUS_MODULE        0x0a            /* C3700: 0x0a, others maybe 0 ? */
 
 /* ASTRO Memory and I/O regions */
-#define ASTRO_BASE_HPA            0xfffed00000
-#define ELROY0_BASE_HPA           0xfffed30000  /* ELROY0_HPA */
+#define ASTRO_BASE_HPA            0xffffed00000
+#define ELROY0_BASE_HPA           0xffffed30000  /* ELROY0_HPA */
 
 #define ROPES_PER_IOC           8       /* per Ike half or Pluto/Astro */
 
-- 
2.53.0

[PULL 3/6] target/hppa: Always map 64-bit firmware at 0xfffffff0f0000000

[Helge Deller]

From: Helge Deller <deller@gmx.de>

I checked on a physical A500, C3700 and C8000 machine and all load their
64-bit PDC (Firmware) at 0xfffffff0f0000000, independed if the CPU uses
40 or 44 physical address bits.
For qemu we will do the same and load the 64-bit SeaBIOS-hppa at the
same address for our emulated machines.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Anton Johansson <anjo@rev.ng>
---
 target/hppa/mem_helper.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index a4b382069d..ffbad8acfd 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -27,6 +27,7 @@
 #include "exec/target_page.h"
 #include "exec/helper-proto.h"
 #include "hw/core/cpu.h"
+#include "hw/hppa/hppa_hardware.h"
 #include "trace.h"
 
 hwaddr hppa_abs_to_phys_pa1x(uint8_t phys_addr_bits, vaddr addr)
@@ -66,12 +67,13 @@ hwaddr hppa_abs_to_phys_pa2_w0(uint8_t phys_addr_bits, vaddr addr)
         /*
          * PDC address space:
          * Figures H-10 and H-11 of the parisc2.0 spec do not specify
-         * where to map into the 64-bit PDC address space.
-         * We map with an offset which equals the 32-bit address, which
-         * is what can be seen on physical machines too.
+         * where to map into the 64-bit PDC address space, but verification
+         * on physical A500, C3700 and C8000 machines show that PDC is always
+         * mapped at 0xfffffff0f0000000, independed if the CPU has 40 or 44
+         * physical bits.
          */
         addr = (uint32_t)addr;
-        addr |= -1ull << (phys_addr_bits - 4);
+        addr |= ((uint64_t) FIRMWARE_HIGH) << 32;
     }
     return addr;
 }
-- 
2.53.0

[PULL 4/6] hw/pci-host/astro: Use proper region names

[Helge Deller]

From: Helge Deller <deller@gmx.de>

All 64-bit hppa machines have at least 4 Elroy PCI busses in the system.
Make sure to use proper names in the qemu device tree, e.g. "elroy0" or
"elroy2-pci-mmio", to be able to distinguish between the various chips.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/astro.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/pci-host/astro.c b/hw/pci-host/astro.c
index 626aa9ce22..6cc0b35070 100644
--- a/hw/pci-host/astro.c
+++ b/hw/pci-host/astro.c
@@ -430,10 +430,11 @@ static void elroy_pcihost_realize(DeviceState *dev, Error **errp)
     PCIHostState *phb = PCI_HOST_BRIDGE(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     Object *obj = OBJECT(s);
+    g_autofree char *elroy_mmio_name = NULL;
 
     /* Elroy config access from CPU.  */
     memory_region_init_io(&s->this_mem, obj, &elroy_chip_ops,
-                          s, "elroy", 0x2000);
+                          s, dev->id, 0x2000);
 
     /* Elroy PCI config. */
     memory_region_init_io(&phb->conf_mem, obj,
@@ -448,7 +449,8 @@ static void elroy_pcihost_realize(DeviceState *dev, Error **errp)
                                 &phb->data_mem);
 
     /* Elroy PCI bus memory.  */
-    memory_region_init(&s->pci_mmio, obj, "pci-mmio", UINT64_MAX);
+    elroy_mmio_name = g_strdup_printf("%s-pci-mmio", dev->id);
+    memory_region_init(&s->pci_mmio, obj, elroy_mmio_name, UINT64_MAX);
     memory_region_init_io(&s->pci_io, obj, &unassigned_io_ops, obj,
                             "pci-isa-mmio",
                             ((uint32_t) IOS_DIST_BASE_SIZE) / ROPES_PER_IOC);
-- 
2.53.0

[PULL 5/6] hw/hppa: Fix crash of 64-bit HP-UX 11 while flushing caches

[Helge Deller]

From: Helge Deller <deller@gmx.de>

HP-UX 11 64-bit reads at bootup a word from address CPU_HPA + 0x500
while flushing the the cache of a T600.
Add a memory handler to avoid crashing while reading this word.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Anton Johansson <anjo@rev.ng>
---
 hw/hppa/machine.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index e72dda2a68..318ebfeee4 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -306,6 +306,8 @@ static TranslateFn *machine_HP_common_init_cpus(MachineState *machine)
 
     for (unsigned int i = 0; i < smp_cpus; i++) {
         g_autofree char *name = g_strdup_printf("cpu%u-io-eir", i);
+        g_autofree char *cflush_name = NULL;
+        MemoryRegion *cflush;
 
         cpu_region = g_new(MemoryRegion, 1);
         memory_region_init_io(cpu_region, OBJECT(cpu[i]), &hppa_io_eir_ops,
@@ -313,6 +315,24 @@ static TranslateFn *machine_HP_common_init_cpus(MachineState *machine)
         memory_region_add_subregion(addr_space,
                                     translate(NULL, CPU_HPA + i * 0x1000),
                                     cpu_region);
+
+        if (!hppa_is_pa20(&cpu[0]->env)) {
+            continue;
+        }
+
+        /*
+         * HP-UX 11 64-bit reads a word from address CPU_HPA + 0x500
+         * while flushing the cache of a T600, which was the first
+         * server with a 64-bit PA-RISC 2.0 CPU.
+         * We return 0, since the value isn't used anyway.
+         */
+        cflush_name = g_strdup_printf("cpu%u-T600-cacheflush", i);
+        cflush = g_new(MemoryRegion, 1);
+        memory_region_init_io(cflush, NULL, &hppa_pci_ignore_ops,
+                              NULL, cflush_name, 4);
+        memory_region_add_subregion(addr_space,
+                              translate(NULL, CPU_HPA + i * 0x1000 + 0x500),
+                              cflush);
     }
 
     /* RTC and DebugOutputPort on CPU #0 */
-- 
2.53.0

Re: [PULL 0/6] Hppa fixes for v11 patches

[Peter Maydell]

On Thu, 19 Mar 2026 at 21:14, Helge Deller <deller@kernel.org> wrote:
>
> From: Helge Deller <deller@gmx.de>
>
> The following changes since commit 559919ce54927d59b215a4665eda7ab6118a48aa:
>
>   Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2026-03-16 13:07:33 +0000)
>
> are available in the Git repository at:
>
>   https://github.com/hdeller/qemu-hppa.git tags/hppa-fixes-for-v11-pull-request
>
> for you to fetch changes up to fa2d5d84e023d79d1ad35b952c0f9a3aa8f442e9:
>
>   target/hppa: Update SeaBIOS-hppa to version 23 (2026-03-19 22:06:49 +0100)
>
> ----------------------------------------------------------------
> HPPA fixes for v11
>
> Some late fixes for QEMU-v11
>
> Various fixes in SeaBIOS-hppa and qemu code, most importantly
> this fixes boot of the C3700, which broke while we added
> support for CPUs with 40 and 44 bits physical address space.
>
> ----------------------------------------------------------------



Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.0
for any user-visible changes.

-- PMM