Commit 7be175e65f for qemu.org

commit 7be175e65f07bdf93f5f576d1dbb5f993c97cd5c
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Fri Mar 27 21:46:54 2026 +0100

    hpet: lower HPET_MAX_TIMERS to 24

    Each timer block occupies 32 bytes, but they only start at
    offset 256 of the 1024-byte MMIO register space.  Therefore
    the correct limit for HPET_MAX_TIMERS is 24, not 32.

    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/include/hw/timer/hpet.h b/include/hw/timer/hpet.h
index c2656f7f0b..84be4c3529 100644
--- a/include/hw/timer/hpet.h
+++ b/include/hw/timer/hpet.h
@@ -22,7 +22,7 @@

 #define FS_PER_NS 1000000       /* 1000000 femtoseconds == 1 ns */
 #define HPET_MIN_TIMERS         3
-#define HPET_MAX_TIMERS         32
+#define HPET_MAX_TIMERS         24

 #define HPET_NUM_IRQ_ROUTES     32

diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 0a5c131819..ec0bca4496 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -32,7 +32,7 @@
 /// Minimum recommended hardware implementation.
 const HPET_MIN_TIMERS: usize = 3;
 /// Maximum timers in each timer block.
-const HPET_MAX_TIMERS: usize = 32;
+const HPET_MAX_TIMERS: usize = 24;

 /// Flags that HPETState.flags supports.
 const HPET_FLAG_MSI_SUPPORT_SHIFT: usize = 0;