[Qemu-devel] Third shot at adding IPMI to qemu

[Qemu-devel] Third shot at adding IPMI to qemu

[minyard]

Ok, everything passes through checkpatch without an error now.  I have
added some tests to verify basic operation of the device, and I've
hacked in some documentation, though I'm not sure if it's in the proper
location, as I never got a response to my questions about it.

I would have liked to add tests for the watchdog timer, but there
doesn't appear to be a way to intercept resets or NMIs in the test
framework.

-corey

[Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[minyard]

From: Corey Minyard <cminyard@mvista.com>

There was no way to directly add a table entry to the SMBIOS table,
even though the BIOS supports this.  So add a function to do this.
This is in preparation for the IPMI handler adding it's SMBIOS table
entry.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 hw/smbios.c |   27 +++++++++++++++++++++++++++
 hw/smbios.h |   15 ++++++++-------
 2 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/hw/smbios.c b/hw/smbios.c
index c57237d..c0c1be1 100644
--- a/hw/smbios.c
+++ b/hw/smbios.c
@@ -178,6 +178,33 @@ static void smbios_build_type_1_fields(const char *t)
                          strlen(buf) + 1, buf);
 }
 
+int smbios_table_entry_add(struct smbios_structure_header *entry)
+{
+    struct smbios_table *table;
+    struct smbios_structure_header *header;
+    unsigned int size = entry->length;
+
+    if (!smbios_entries) {
+        smbios_entries_len = sizeof(uint16_t);
+        smbios_entries = g_malloc0(smbios_entries_len);
+    }
+    smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
+                               sizeof(*table) + size);
+    table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
+    table->header.type = SMBIOS_TABLE_ENTRY;
+    table->header.length = cpu_to_le16(sizeof(*table) + size);
+
+    header = (struct smbios_structure_header *)(table->data);
+    memcpy(header, entry, size);
+
+    smbios_check_collision(header->type, SMBIOS_TABLE_ENTRY);
+
+    smbios_entries_len += sizeof(*table) + size;
+    (*(uint16_t *)smbios_entries) =
+        cpu_to_le16(le16_to_cpu(*(uint16_t *)smbios_entries) + 1);
+    return 0;
+}
+
 int smbios_entry_add(const char *t)
 {
     char buf[1024];
diff --git a/hw/smbios.h b/hw/smbios.h
index 94e3641..6431a15 100644
--- a/hw/smbios.h
+++ b/hw/smbios.h
@@ -13,21 +13,22 @@
  *
  */
 
+/* This goes at the beginning of every SMBIOS structure. */
+struct smbios_structure_header {
+    uint8_t type;
+    uint8_t length;
+    uint16_t handle;
+} QEMU_PACKED;
+
 int smbios_entry_add(const char *t);
 void smbios_add_field(int type, int offset, int len, void *data);
 uint8_t *smbios_get_table(size_t *length);
+int smbios_table_entry_add(struct smbios_structure_header *entry);
 
 /*
  * SMBIOS spec defined tables
  */
 
-/* This goes at the beginning of every SMBIOS structure. */
-struct smbios_structure_header {
-    uint8_t type;
-    uint8_t length;
-    uint16_t handle;
-} QEMU_PACKED;
-
 /* SMBIOS type 0 - BIOS Information */
 struct smbios_type_0 {
     struct smbios_structure_header header;
-- 
1.7.4.1

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Anthony Liguori]

minyard@acm.org writes:

> From: Corey Minyard <cminyard@mvista.com>
>
> There was no way to directly add a table entry to the SMBIOS table,
> even though the BIOS supports this.  So add a function to do this.
> This is in preparation for the IPMI handler adding it's SMBIOS table
> entry.
>
> Signed-off-by: Corey Minyard <cminyard@mvista.com>

I don't expect that hardware ever adds SMBIOS entries.  Rather, the BIOS
adds the entries by probing the hardware.

So I think you should solve this in SeaBIOS, instead of trying to do it
in QEMU.  I think that also solves the problem you have with
pre-firmware init.

Regards,

Anthony Liguori

> ---
>  hw/smbios.c |   27 +++++++++++++++++++++++++++
>  hw/smbios.h |   15 ++++++++-------
>  2 files changed, 35 insertions(+), 7 deletions(-)
>
> diff --git a/hw/smbios.c b/hw/smbios.c
> index c57237d..c0c1be1 100644
> --- a/hw/smbios.c
> +++ b/hw/smbios.c
> @@ -178,6 +178,33 @@ static void smbios_build_type_1_fields(const char *t)
>                           strlen(buf) + 1, buf);
>  }
>  
> +int smbios_table_entry_add(struct smbios_structure_header *entry)
> +{
> +    struct smbios_table *table;
> +    struct smbios_structure_header *header;
> +    unsigned int size = entry->length;
> +
> +    if (!smbios_entries) {
> +        smbios_entries_len = sizeof(uint16_t);
> +        smbios_entries = g_malloc0(smbios_entries_len);
> +    }
> +    smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
> +                               sizeof(*table) + size);
> +    table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
> +    table->header.type = SMBIOS_TABLE_ENTRY;
> +    table->header.length = cpu_to_le16(sizeof(*table) + size);
> +
> +    header = (struct smbios_structure_header *)(table->data);
> +    memcpy(header, entry, size);
> +
> +    smbios_check_collision(header->type, SMBIOS_TABLE_ENTRY);
> +
> +    smbios_entries_len += sizeof(*table) + size;
> +    (*(uint16_t *)smbios_entries) =
> +        cpu_to_le16(le16_to_cpu(*(uint16_t *)smbios_entries) + 1);
> +    return 0;
> +}
> +
>  int smbios_entry_add(const char *t)
>  {
>      char buf[1024];
> diff --git a/hw/smbios.h b/hw/smbios.h
> index 94e3641..6431a15 100644
> --- a/hw/smbios.h
> +++ b/hw/smbios.h
> @@ -13,21 +13,22 @@
>   *
>   */
>  
> +/* This goes at the beginning of every SMBIOS structure. */
> +struct smbios_structure_header {
> +    uint8_t type;
> +    uint8_t length;
> +    uint16_t handle;
> +} QEMU_PACKED;
> +
>  int smbios_entry_add(const char *t);
>  void smbios_add_field(int type, int offset, int len, void *data);
>  uint8_t *smbios_get_table(size_t *length);
> +int smbios_table_entry_add(struct smbios_structure_header *entry);
>  
>  /*
>   * SMBIOS spec defined tables
>   */
>  
> -/* This goes at the beginning of every SMBIOS structure. */
> -struct smbios_structure_header {
> -    uint8_t type;
> -    uint8_t length;
> -    uint16_t handle;
> -} QEMU_PACKED;
> -
>  /* SMBIOS type 0 - BIOS Information */
>  struct smbios_type_0 {
>      struct smbios_structure_header header;
> -- 
> 1.7.4.1

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Corey Minyard]

On 07/30/2012 10:37 AM, Anthony Liguori wrote:
> minyard@acm.org writes:
>
>> From: Corey Minyard <cminyard@mvista.com>
>>
>> There was no way to directly add a table entry to the SMBIOS table,
>> even though the BIOS supports this.  So add a function to do this.
>> This is in preparation for the IPMI handler adding it's SMBIOS table
>> entry.
>>
>> Signed-off-by: Corey Minyard <cminyard@mvista.com>
> I don't expect that hardware ever adds SMBIOS entries.  Rather, the BIOS
> adds the entries by probing the hardware.

Well, memory entries are added by QEMU, why not let the BIOS probe for 
that?  Plus, I really doubt that BIOSes on real systems probe for this.  
I'd guess they are hard-coded.

>
> So I think you should solve this in SeaBIOS, instead of trying to do it
> in QEMU.  I think that also solves the problem you have with
> pre-firmware init.

The user can pass the I/O base and IRQ values in on the QEMU command 
line, and they can be arbitrary values.  The BIOS is not going to be 
able to probe for those.

-corey

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Anthony Liguori]

Corey Minyard <cminyard@mvista.com> writes:

> On 07/30/2012 10:37 AM, Anthony Liguori wrote:
>> minyard@acm.org writes:
>>
>>> From: Corey Minyard <cminyard@mvista.com>
>>>
>>> There was no way to directly add a table entry to the SMBIOS table,
>>> even though the BIOS supports this.  So add a function to do this.
>>> This is in preparation for the IPMI handler adding it's SMBIOS table
>>> entry.
>>>
>>> Signed-off-by: Corey Minyard <cminyard@mvista.com>
>> I don't expect that hardware ever adds SMBIOS entries.  Rather, the BIOS
>> adds the entries by probing the hardware.
>
> Well, memory entries are added by QEMU, why not let the BIOS probe for 
> that?

QEMU doesn't add any entries by default.  SeaBIOS owns SMBIOS.  QEMU
uses a backchannel to hand SeaBIOS tables that SeaBIOS can then expose.
The reason we use a table based interface is because type 0 and type 1
tables can have vendor extensions that are in a vendor specific format.

But SeaBIOS unquestionably owns SMBIOS generation.

>  Plus, I really doubt that BIOSes on real systems probe for this.  
> I'd guess they are hard-coded.

I think you'd be surprised how little is hard coded on modern BIOSes.

>> So I think you should solve this in SeaBIOS, instead of trying to do it
>> in QEMU.  I think that also solves the problem you have with
>> pre-firmware init.
>
> The user can pass the I/O base and IRQ values in on the QEMU command 
> line, and they can be arbitrary values.  The BIOS is not going to be 
> able to probe for those.

Then pass the information that the BIOS needs through fw_cfg.  That's
what it's there for.

Regards,

Anthony Liguoi

>
> -corey

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Corey Minyard]

On 07/30/2012 12:25 PM, Anthony Liguori wrote:
> Corey Minyard <cminyard@mvista.com> writes:
>
>> On 07/30/2012 10:37 AM, Anthony Liguori wrote:
>>> minyard@acm.org writes:
>>>
>>>> From: Corey Minyard <cminyard@mvista.com>
>>>>
>>>> There was no way to directly add a table entry to the SMBIOS table,
>>>> even though the BIOS supports this.  So add a function to do this.
>>>> This is in preparation for the IPMI handler adding it's SMBIOS table
>>>> entry.
>>>>
>>>> Signed-off-by: Corey Minyard <cminyard@mvista.com>
>>> I don't expect that hardware ever adds SMBIOS entries.  Rather, the BIOS
>>> adds the entries by probing the hardware.
>> Well, memory entries are added by QEMU, why not let the BIOS probe for
>> that?
> QEMU doesn't add any entries by default.  SeaBIOS owns SMBIOS.  QEMU
> uses a backchannel to hand SeaBIOS tables that SeaBIOS can then expose.
> The reason we use a table based interface is because type 0 and type 1
> tables can have vendor extensions that are in a vendor specific format.
>
> But SeaBIOS unquestionably owns SMBIOS generation.
>
>>   Plus, I really doubt that BIOSes on real systems probe for this.
>> I'd guess they are hard-coded.
> I think you'd be surprised how little is hard coded on modern BIOSes.
>
>>> So I think you should solve this in SeaBIOS, instead of trying to do it
>>> in QEMU.  I think that also solves the problem you have with
>>> pre-firmware init.
>> The user can pass the I/O base and IRQ values in on the QEMU command
>> line, and they can be arbitrary values.  The BIOS is not going to be
>> able to probe for those.
> Then pass the information that the BIOS needs through fw_cfg.  That's
> what it's there for.

Ok, I understand.  Thanks, I'll look at doing it this way.

-corey

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Kevin O'Connor]

On Mon, Jul 30, 2012 at 12:25:16PM -0500, Anthony Liguori wrote:
> Corey Minyard <cminyard@mvista.com> writes:
> > On 07/30/2012 10:37 AM, Anthony Liguori wrote:
> >> minyard@acm.org writes:
> >>> There was no way to directly add a table entry to the SMBIOS table,
> >>> even though the BIOS supports this.  So add a function to do this.
> >>> This is in preparation for the IPMI handler adding it's SMBIOS table
> >>> entry.
> >> I don't expect that hardware ever adds SMBIOS entries.  Rather, the BIOS
> >> adds the entries by probing the hardware.
> >
> > Well, memory entries are added by QEMU, why not let the BIOS probe for 
> > that?
> QEMU doesn't add any entries by default.  SeaBIOS owns SMBIOS.  QEMU
> uses a backchannel to hand SeaBIOS tables that SeaBIOS can then expose.
> The reason we use a table based interface is because type 0 and type 1
> tables can have vendor extensions that are in a vendor specific format.
> 
> But SeaBIOS unquestionably owns SMBIOS generation.
[...]
> >> So I think you should solve this in SeaBIOS, instead of trying to do it
> >> in QEMU.  I think that also solves the problem you have with
> >> pre-firmware init.
> > The user can pass the I/O base and IRQ values in on the QEMU command 
> > line, and they can be arbitrary values.  The BIOS is not going to be 
> > able to probe for those.
> 
> Then pass the information that the BIOS needs through fw_cfg.  That's
> what it's there for.

This approach, unfortunately, leads to extra code and "double
handling" of infomation.

The ultimate consumer of the data wants a binary struct which looks
like:

struct smbios_type_38 {
    struct smbios_structure_header header;
    u8 interface_type;
    u8 ipmi_version;
    u8 i2c_slave_addr;
    u8 nv_storage_dev_addr;
    u64 base_addr;
    u8 base_addr_mod_and_irq_info;
    u8 interrupt_number;
};

The proposed solution is to put the info in a binary struct which
looks like:

struct ipmi_info {
    u8 str_version;
    u8 interface;
    u8 reg_space;
    u8 reg_spacing;
    u8 slave_addr;
    u8 irq;
    u8 version;
    u8 reserved1;
    u64 base_addr;
} PACKED;

and then have SeaBIOS translate the latter binary struct into the
former.  However, there's no compelling reason to introduce a new
binary struct instead of using the industry standard binary struct.

I'd prefer QEMU to just pass the SMBIOS struct and let SeaBIOS pass it
through to the OS.  I also think the existing fw_cfg mechanism for
passing SMBIOS tables should be used.  I understand that this causes
some contortions due to the current SMBIOS fw_cfg impementation in
QEMU, but it seems wrong to introduce a new fw_cfg port that
accomplishes the same goal as an existing fw_cfg port.

-Kevin

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Corey Minyard]

On 08/01/2012 08:15 PM, Kevin O'Connor wrote:
>
> This approach, unfortunately, leads to extra code and "double
> handling" of infomation.
>
> The ultimate consumer of the data wants a binary struct which looks
> like:
>
> struct smbios_type_38 {
>      struct smbios_structure_header header;
>      u8 interface_type;
>      u8 ipmi_version;
>      u8 i2c_slave_addr;
>      u8 nv_storage_dev_addr;
>      u64 base_addr;
>      u8 base_addr_mod_and_irq_info;
>      u8 interrupt_number;
> };
>
> The proposed solution is to put the info in a binary struct which
> looks like:
>
> struct ipmi_info {
>      u8 str_version;
>      u8 interface;
>      u8 reg_space;
>      u8 reg_spacing;
>      u8 slave_addr;
>      u8 irq;
>      u8 version;
>      u8 reserved1;
>      u64 base_addr;
> } PACKED;
>
> and then have SeaBIOS translate the latter binary struct into the
> former.  However, there's no compelling reason to introduce a new
> binary struct instead of using the industry standard binary struct.
>
> I'd prefer QEMU to just pass the SMBIOS struct and let SeaBIOS pass it
> through to the OS.  I also think the existing fw_cfg mechanism for
> passing SMBIOS tables should be used.  I understand that this causes
> some contortions due to the current SMBIOS fw_cfg impementation in
> QEMU, but it seems wrong to introduce a new fw_cfg port that
> accomplishes the same goal as an existing fw_cfg port.

Well, I should also probably add the ACPI name space definition for this 
information, too, and the SMBIOS information is not capable of passing 
all the information required for this (though the above structure can).

I've been studying this, but I don't see an obvious way to dynamically 
add something to the ACPI name space.  At least an easy way.

-corey

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Anthony Liguori]

Corey Minyard <cminyard@mvista.com> writes:

> On 08/01/2012 08:15 PM, Kevin O'Connor wrote:
>>
>> This approach, unfortunately, leads to extra code and "double
>> handling" of infomation.
>>
>> The ultimate consumer of the data wants a binary struct which looks
>> like:
>>
>> struct smbios_type_38 {
>>      struct smbios_structure_header header;
>>      u8 interface_type;
>>      u8 ipmi_version;
>>      u8 i2c_slave_addr;
>>      u8 nv_storage_dev_addr;
>>      u64 base_addr;
>>      u8 base_addr_mod_and_irq_info;
>>      u8 interrupt_number;
>> };
>>
>> The proposed solution is to put the info in a binary struct which
>> looks like:
>>
>> struct ipmi_info {
>>      u8 str_version;
>>      u8 interface;
>>      u8 reg_space;
>>      u8 reg_spacing;
>>      u8 slave_addr;
>>      u8 irq;
>>      u8 version;
>>      u8 reserved1;
>>      u64 base_addr;
>> } PACKED;
>>
>> and then have SeaBIOS translate the latter binary struct into the
>> former.  However, there's no compelling reason to introduce a new
>> binary struct instead of using the industry standard binary struct.
>>
>> I'd prefer QEMU to just pass the SMBIOS struct and let SeaBIOS pass it
>> through to the OS.  I also think the existing fw_cfg mechanism for
>> passing SMBIOS tables should be used.  I understand that this causes
>> some contortions due to the current SMBIOS fw_cfg impementation in
>> QEMU, but it seems wrong to introduce a new fw_cfg port that
>> accomplishes the same goal as an existing fw_cfg port.
>
> Well, I should also probably add the ACPI name space definition for this 
> information, too, and the SMBIOS information is not capable of passing 
> all the information required for this (though the above structure can).
>
> I've been studying this, but I don't see an obvious way to dynamically 
> add something to the ACPI name space.  At least an easy way.

Okay, I was actually going to ask if there was an ACPI table for this.

Maybe this argues in favor of doing a fw_cfg interface?

Another question--is it really necessary for all of this to be user
specified?  Can't we just use a static SMBIOS/ACPI entry?  Then SeaBIOS
only needs to be concerned with whether or not an IPMI device exists.

Regards,

Anthony Liguori

>
> -corey

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Corey Minyard]

On 08/01/2012 09:40 PM, Anthony Liguori wrote:
> Corey Minyard <cminyard@mvista.com> writes:
>
>> On 08/01/2012 08:15 PM, Kevin O'Connor wrote:
>> Well, I should also probably add the ACPI name space definition for this
>> information, too, and the SMBIOS information is not capable of passing
>> all the information required for this (though the above structure can).
>>
>> I've been studying this, but I don't see an obvious way to dynamically
>> add something to the ACPI name space.  At least an easy way.
> Okay, I was actually going to ask if there was an ACPI table for this.
>
> Maybe this argues in favor of doing a fw_cfg interface?
>
> Another question--is it really necessary for all of this to be user
> specified?  Can't we just use a static SMBIOS/ACPI entry?  Then SeaBIOS
> only needs to be concerned with whether or not an IPMI device exists.

That's a good question At least the interrupt is important for the user 
to be able to specify.  The specific interface type may also be 
important if the user is trying to accomplish some specific emulation.  
Two other standard emulations exist, too, one in memory and one over 
I2C.  I'd eventually like to add those, if for nothing else my ability 
to test the interfaces.

If the user is trying to emulate some specific machine, setting the 
address is also important, and I need to add the ability to specify 
register spacing and the address space.  This will become more important 
for non-x86 machines.

-corey

> Regards,
>
> Anthony Liguori
>
>> -corey

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Anthony Liguori]

Corey Minyard <tcminyard@gmail.com> writes:

> On 08/01/2012 09:40 PM, Anthony Liguori wrote:
>> Corey Minyard <cminyard@mvista.com> writes:
>>
>>> On 08/01/2012 08:15 PM, Kevin O'Connor wrote:
>>> Well, I should also probably add the ACPI name space definition for this
>>> information, too, and the SMBIOS information is not capable of passing
>>> all the information required for this (though the above structure can).
>>>
>>> I've been studying this, but I don't see an obvious way to dynamically
>>> add something to the ACPI name space.  At least an easy way.
>> Okay, I was actually going to ask if there was an ACPI table for this.
>>
>> Maybe this argues in favor of doing a fw_cfg interface?
>>
>> Another question--is it really necessary for all of this to be user
>> specified?  Can't we just use a static SMBIOS/ACPI entry?  Then SeaBIOS
>> only needs to be concerned with whether or not an IPMI device exists.
>
> That's a good question At least the interrupt is important for the user 
> to be able to specify.  The specific interface type may also be 
> important if the user is trying to accomplish some specific emulation.  

Why is it important to specify the interrupt?  Is this important for a
typical user, or important for the IPMI maintainer who needs to test a
bunch of different scenarios? :-)

If it's the later, we can probably express the interrupt number as a
#define in SeaBIOS, but still make it configurable in QEMU.  Then you
could build multiple copies of SeaBIOS and then just point QEMU at the
right version.

> Two other standard emulations exist, too, one in memory and one over 
> I2C.  I'd eventually like to add those, if for nothing else my ability 
> to test the interfaces.

Right, see above.  It may be easier to just build multiple copies of the
BIOS then to try and make this all dynamic.

Regards,

Anthony Liguori

>
> If the user is trying to emulate some specific machine, setting the 
> address is also important, and I need to add the ability to specify 
> register spacing and the address space.  This will become more important 
> for non-x86 machines.
>
> -corey
>
>> Regards,
>>
>> Anthony Liguori
>>
>>> -corey

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Corey Minyard]

On 08/02/2012 01:32 PM, Anthony Liguori wrote:
> Corey Minyard <tcminyard@gmail.com> writes:
>
>> On 08/01/2012 09:40 PM, Anthony Liguori wrote:
>>> Corey Minyard <cminyard@mvista.com> writes:
>>>
>>>> On 08/01/2012 08:15 PM, Kevin O'Connor wrote:
>>>> Well, I should also probably add the ACPI name space definition for this
>>>> information, too, and the SMBIOS information is not capable of passing
>>>> all the information required for this (though the above structure can).
>>>>
>>>> I've been studying this, but I don't see an obvious way to dynamically
>>>> add something to the ACPI name space.  At least an easy way.
>>> Okay, I was actually going to ask if there was an ACPI table for this.
>>>
>>> Maybe this argues in favor of doing a fw_cfg interface?
>>>
>>> Another question--is it really necessary for all of this to be user
>>> specified?  Can't we just use a static SMBIOS/ACPI entry?  Then SeaBIOS
>>> only needs to be concerned with whether or not an IPMI device exists.
>> That's a good question At least the interrupt is important for the user
>> to be able to specify.  The specific interface type may also be
>> important if the user is trying to accomplish some specific emulation.
> Why is it important to specify the interrupt?  Is this important for a
> typical user, or important for the IPMI maintainer who needs to test a
> bunch of different scenarios? :-)

I'm not too worried about the IPMI maintainer, he can hack in what he 
likes :).

I would be worried about conflicts on interrupts with other devices.  I 
really don't know how people use qemu out in the wild, though.  If they 
are trying to get close to some specific machine, or if nobody really 
cares about stuff like that.

I also don't know if people will be wanting this on other 
architectures.  IPMI is certainly available on ia64.  In fact it's quite 
common there.  I've seen it on practically everything else, though it's 
not so common.  It's in the PPC device trees for sure, and in some uboot 
device trees on other arches.

> If it's the later, we can probably express the interrupt number as a
> #define in SeaBIOS, but still make it configurable in QEMU.  Then you
> could build multiple copies of SeaBIOS and then just point QEMU at the
> right version.

That philosophy sounds like a recipe for version overload.  I'd prefer 
to avoid that.

>
>> Two other standard emulations exist, too, one in memory and one over
>> I2C.  I'd eventually like to add those, if for nothing else my ability
>> to test the interfaces.
> Right, see above.  It may be easier to just build multiple copies of the
> BIOS then to try and make this all dynamic.
In my experience, if you need the flexibility and don't make it dynamic, 
you make things harder in the long run.  But adding unnecessary 
flexibility is extra work without value.

IMHO, we should either have a single IPMI interface type at a fixed 
location with a fixed interrupt, or we should make it flexible. Even if 
we make it fixed, the BIOS will have to be told if the device is present 
and will have to dynamically chose to add the SMBIOS table and ACPI name 
space entries.

Thanks,

-corey

> Regards,
>
> Anthony Liguori
>
>> If the user is trying to emulate some specific machine, setting the
>> address is also important, and I need to add the ability to specify
>> register spacing and the address space.  This will become more important
>> for non-x86 machines.
>>
>> -corey
>>
>>> Regards,
>>>
>>> Anthony Liguori
>>>
>>>> -corey

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Anthony Liguori]

Corey Minyard <cminyard@mvista.com> writes:

> On 08/02/2012 01:32 PM, Anthony Liguori wrote:
>> Corey Minyard <tcminyard@gmail.com> writes:
>>
>>> On 08/01/2012 09:40 PM, Anthony Liguori wrote:
>>>> Corey Minyard <cminyard@mvista.com> writes:
>>>>
>>>>> On 08/01/2012 08:15 PM, Kevin O'Connor wrote:
>>>>> Well, I should also probably add the ACPI name space definition for this
>>>>> information, too, and the SMBIOS information is not capable of passing
>>>>> all the information required for this (though the above structure can).
>>>>>
>>>>> I've been studying this, but I don't see an obvious way to dynamically
>>>>> add something to the ACPI name space.  At least an easy way.
>>>> Okay, I was actually going to ask if there was an ACPI table for this.
>>>>
>>>> Maybe this argues in favor of doing a fw_cfg interface?
>>>>
>>>> Another question--is it really necessary for all of this to be user
>>>> specified?  Can't we just use a static SMBIOS/ACPI entry?  Then SeaBIOS
>>>> only needs to be concerned with whether or not an IPMI device exists.
>>> That's a good question At least the interrupt is important for the user
>>> to be able to specify.  The specific interface type may also be
>>> important if the user is trying to accomplish some specific emulation.
>> Why is it important to specify the interrupt?  Is this important for a
>> typical user, or important for the IPMI maintainer who needs to test a
>> bunch of different scenarios? :-)
>
> I'm not too worried about the IPMI maintainer, he can hack in what he 
> likes :).
>
> I would be worried about conflicts on interrupts with other devices.  I 
> really don't know how people use qemu out in the wild, though.  If they 
> are trying to get close to some specific machine, or if nobody really 
> cares about stuff like that.

It's an LPC device?  Ther aren't going to be many of those device types
that would be user controllable (basically TPM and IPMI) so I don't
think interrupt conflicts are a real likely issue.

> I also don't know if people will be wanting this on other 
> architectures.  IPMI is certainly available on ia64.

I doubt QEMU will ever support ia64 since noone seems to care about it anymore.

> In fact it's quite 
> common there.  I've seen it on practically everything else, though it's 
> not so common.  It's in the PPC device trees for sure, and in some uboot 
> device trees on other arches.

Right, but this is specifically about SMBIOS/ACPI support which won't be
on other architectures.

>
>> If it's the later, we can probably express the interrupt number as a
>> #define in SeaBIOS, but still make it configurable in QEMU.  Then you
>> could build multiple copies of SeaBIOS and then just point QEMU at the
>> right version.
>
> That philosophy sounds like a recipe for version overload.  I'd prefer 
> to avoid that.
>
>>
>>> Two other standard emulations exist, too, one in memory and one over
>>> I2C.  I'd eventually like to add those, if for nothing else my ability
>>> to test the interfaces.
>> Right, see above.  It may be easier to just build multiple copies of the
>> BIOS then to try and make this all dynamic.
> In my experience, if you need the flexibility and don't make it dynamic, 
> you make things harder in the long run.  But adding unnecessary 
> flexibility is extra work without value.

Exactly.

> IMHO, we should either have a single IPMI interface type at a fixed 
> location with a fixed interrupt, or we should make it flexible.

I think fixed interrupt is what makes the most sense now.  If there's a
 pressing need in the future to do otherwise, we can revisit.

Regards,

Anthony Liguori

> Even if 
> we make it fixed, the BIOS will have to be told if the device is present 
> and will have to dynamically chose to add the SMBIOS table and ACPI name 
> space entries.
>
> Thanks,
>
> -corey
>
>> Regards,
>>
>> Anthony Liguori
>>
>>> If the user is trying to emulate some specific machine, setting the
>>> address is also important, and I need to add the ability to specify
>>> register spacing and the address space.  This will become more important
>>> for non-x86 machines.
>>>
>>> -corey
>>>
>>>> Regards,
>>>>
>>>> Anthony Liguori
>>>>
>>>>> -corey

Re: [Qemu-devel] [PATCH 01/18] smbios: Add a function to directly add an entry

[Corey Minyard]

On 08/02/2012 04:05 PM, Anthony Liguori wrote:
> Corey Minyard <cminyard@mvista.com> writes:
>
>> On 08/02/2012 01:32 PM, Anthony Liguori wrote:
>>> Corey Minyard <tcminyard@gmail.com> writes:
>>>
>>>> On 08/01/2012 09:40 PM, Anthony Liguori wrote:
>>>>> Corey Minyard <cminyard@mvista.com> writes:
>>>>>
>>>>>> On 08/01/2012 08:15 PM, Kevin O'Connor wrote:
>>>>>> Well, I should also probably add the ACPI name space definition for this
>>>>>> information, too, and the SMBIOS information is not capable of passing
>>>>>> all the information required for this (though the above structure can).
>>>>>>
>>>>>> I've been studying this, but I don't see an obvious way to dynamically
>>>>>> add something to the ACPI name space.  At least an easy way.
>>>>> Okay, I was actually going to ask if there was an ACPI table for this.
>>>>>
>>>>> Maybe this argues in favor of doing a fw_cfg interface?
>>>>>
>>>>> Another question--is it really necessary for all of this to be user
>>>>> specified?  Can't we just use a static SMBIOS/ACPI entry?  Then SeaBIOS
>>>>> only needs to be concerned with whether or not an IPMI device exists.
>>>> That's a good question At least the interrupt is important for the user
>>>> to be able to specify.  The specific interface type may also be
>>>> important if the user is trying to accomplish some specific emulation.
>>> Why is it important to specify the interrupt?  Is this important for a
>>> typical user, or important for the IPMI maintainer who needs to test a
>>> bunch of different scenarios? :-)
>> I'm not too worried about the IPMI maintainer, he can hack in what he
>> likes :).
>>
>> I would be worried about conflicts on interrupts with other devices.  I
>> really don't know how people use qemu out in the wild, though.  If they
>> are trying to get close to some specific machine, or if nobody really
>> cares about stuff like that.
> It's an LPC device?  Ther aren't going to be many of those device types
> that would be user controllable (basically TPM and IPMI) so I don't
> think interrupt conflicts are a real likely issue.
>

The implementation depends.  But for SMBIOS concerns, you are probably 
correct.

> Right, but this is specifically about SMBIOS/ACPI support which won't be
> on other architectures.

No, it's not.  This is about passing information to the firmware. At 
least PPC and SPARC use the same mechanisms.

>
>>> If it's the later, we can probably express the interrupt number as a
>>> #define in SeaBIOS, but still make it configurable in QEMU.  Then you
>>> could build multiple copies of SeaBIOS and then just point QEMU at the
>>> right version.
>> That philosophy sounds like a recipe for version overload.  I'd prefer
>> to avoid that.
>>
>>>> Two other standard emulations exist, too, one in memory and one over
>>>> I2C.  I'd eventually like to add those, if for nothing else my ability
>>>> to test the interfaces.
>>> Right, see above.  It may be easier to just build multiple copies of the
>>> BIOS then to try and make this all dynamic.
>> In my experience, if you need the flexibility and don't make it dynamic,
>> you make things harder in the long run.  But adding unnecessary
>> flexibility is extra work without value.
> Exactly.
>
>> IMHO, we should either have a single IPMI interface type at a fixed
>> location with a fixed interrupt, or we should make it flexible.
> I think fixed interrupt is what makes the most sense now.  If there's a
>   pressing need in the future to do otherwise, we can revisit.

I wanted to think about this a bit, and in my mind if you have to pass 
anything, you might as well pass everything.  It's not that big a 
difference.  Since you are going to have to pass something along, the 
difference between passing a flag saying "IPMI is available" and passing 
a structure with the information doesn't seem to be that much.  The main 
difference is the firmware is going to pull the data out of a passed in 
structure verses setting it to fixed values. Passing the structure gives 
the user the ability to specify anything and have it just work.

Thanks,

-corey

>
> Regards,
>
> Anthony Liguori
>
>> Even if
>> we make it fixed, the BIOS will have to be told if the device is present
>> and will have to dynamically chose to add the SMBIOS table and ACPI name
>> space entries.
>>
>> Thanks,
>>
>> -corey
>>
>>> Regards,
>>>
>>> Anthony Liguori
>>>
>>>> If the user is trying to emulate some specific machine, setting the
>>>> address is also important, and I need to add the ability to specify
>>>> register spacing and the address space.  This will become more important
>>>> for non-x86 machines.
>>>>
>>>> -corey
>>>>
>>>>> Regards,
>>>>>
>>>>> Anthony Liguori
>>>>>
>>>>>> -corey

[Qemu-devel] [PATCH 02/18] pc: move SMBIOS setup to after device init

[minyard]

From: Corey Minyard <cminyard@mvista.com>

Setting up the firmware interface for the SMBIOS table needs to
be done later in the process, after device initialization, so that
devices can add entries to the table.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 hw/pc.c      |   24 ++++++++++++++----------
 hw/pc.h      |   11 ++++++-----
 hw/pc_piix.c |   12 ++++++++----
 3 files changed, 28 insertions(+), 19 deletions(-)

diff --git a/hw/pc.c b/hw/pc.c
index fb1ad5b..bedd5be 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -970,21 +970,13 @@ void pc_cpus_init(const char *cpu_model)
     }
 }
 
-void *pc_memory_init(MemoryRegion *system_memory,
-                    const char *kernel_filename,
-                    const char *kernel_cmdline,
-                    const char *initrd_filename,
+void pc_memory_init(MemoryRegion *system_memory,
                     ram_addr_t below_4g_mem_size,
                     ram_addr_t above_4g_mem_size,
-                    MemoryRegion *rom_memory,
                     MemoryRegion **ram_memory)
 {
-    int linux_boot, i;
-    MemoryRegion *ram, *option_rom_mr;
+    MemoryRegion *ram;
     MemoryRegion *ram_below_4g, *ram_above_4g;
-    void *fw_cfg;
-
-    linux_boot = (kernel_filename != NULL);
 
     /* Allocate RAM.  We allocate it as a single memory region and use
      * aliases to address portions of it, mostly for backwards compatibility
@@ -1006,7 +998,17 @@ void *pc_memory_init(MemoryRegion *system_memory,
         memory_region_add_subregion(system_memory, 0x100000000ULL,
                                     ram_above_4g);
     }
+}
 
+void *pc_bios_init(const char *kernel_filename,
+                   const char *kernel_cmdline,
+                   const char *initrd_filename,
+                   ram_addr_t below_4g_mem_size,
+                   MemoryRegion *rom_memory)
+{
+    MemoryRegion *option_rom_mr;
+    void *fw_cfg;
+    int linux_boot, i;
 
     /* Initialize PC system firmware */
     pc_system_firmware_init(rom_memory);
@@ -1019,6 +1021,8 @@ void *pc_memory_init(MemoryRegion *system_memory,
                                         option_rom_mr,
                                         1);
 
+    linux_boot = (kernel_filename != NULL);
+
     fw_cfg = bochs_bios_init();
     rom_set_fw(fw_cfg);
 
diff --git a/hw/pc.h b/hw/pc.h
index a662090..28c938e 100644
--- a/hw/pc.h
+++ b/hw/pc.h
@@ -106,14 +106,15 @@ void pc_register_ferr_irq(qemu_irq irq);
 void pc_acpi_smi_interrupt(void *opaque, int irq, int level);
 
 void pc_cpus_init(const char *cpu_model);
-void *pc_memory_init(MemoryRegion *system_memory,
-                    const char *kernel_filename,
-                    const char *kernel_cmdline,
-                    const char *initrd_filename,
+void pc_memory_init(MemoryRegion *system_memory,
                     ram_addr_t below_4g_mem_size,
                     ram_addr_t above_4g_mem_size,
-                    MemoryRegion *rom_memory,
                     MemoryRegion **ram_memory);
+void *pc_bios_init(const char *kernel_filename,
+                   const char *kernel_cmdline,
+                   const char *initrd_filename,
+                   ram_addr_t below_4g_mem_size,
+                   MemoryRegion *rom_memory);
 qemu_irq *pc_allocate_cpu_irq(void);
 DeviceState *pc_vga_init(ISABus *isa_bus, PCIBus *pci_bus);
 void pc_basic_device_init(ISABus *isa_bus, qemu_irq *gsi,
diff --git a/hw/pc_piix.c b/hw/pc_piix.c
index 98a06fa..4b4ee3d 100644
--- a/hw/pc_piix.c
+++ b/hw/pc_piix.c
@@ -178,10 +178,8 @@ static void pc_init1(MemoryRegion *system_memory,
 
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
-        fw_cfg = pc_memory_init(system_memory,
-                       kernel_filename, kernel_cmdline, initrd_filename,
-                       below_4g_mem_size, above_4g_mem_size,
-                       pci_enabled ? rom_memory : system_memory, &ram_memory);
+        pc_memory_init(system_memory, below_4g_mem_size,
+                       above_4g_mem_size, &ram_memory);
     }
 
     gsi_state = g_malloc0(sizeof(*gsi_state));
@@ -275,6 +273,12 @@ static void pc_init1(MemoryRegion *system_memory,
         pci_create_simple(pci_bus, piix3_devfn + 2, "piix3-usb-uhci");
     }
 
+    if (!xen_enabled()) {
+        fw_cfg = pc_bios_init(kernel_filename, kernel_cmdline,
+                              initrd_filename, below_4g_mem_size,
+                              pci_enabled ? rom_memory : system_memory);
+    }
+
     if (pci_enabled && acpi_enabled) {
         i2c_bus *smbus;
 
-- 
1.7.4.1

[Qemu-devel] [PATCH 03/18] vl: Move init_timer_alarm() earlier

[minyard]

From: Corey Minyard <cminyard@mvista.com>

The timers may be used in initialization, so move them earlier so they
are ready.  A reconnect options will be added to qemu-char, and it uses
a timer, but the timer alarm wasn't initialized yet.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 vl.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/vl.c b/vl.c
index 52b6588..0f0bcd9 100644
--- a/vl.c
+++ b/vl.c
@@ -3245,6 +3245,11 @@ int main(int argc, char **argv, char **envp)
         qemu_set_version(machine->hw_version);
     }
 
+    if (init_timer_alarm() < 0) {
+        fprintf(stderr, "could not initialize alarm timer\n");
+        exit(1);
+    }
+
     /* Init CPU def lists, based on config
      * - Must be called after all the qemu_read_config_file() calls
      * - Must be called before list_cpus()
@@ -3422,11 +3427,6 @@ int main(int argc, char **argv, char **envp)
 
     os_set_line_buffering();
 
-    if (init_timer_alarm() < 0) {
-        fprintf(stderr, "could not initialize alarm timer\n");
-        exit(1);
-    }
-
 #ifdef CONFIG_SPICE
     /* spice needs the timers to be initialized by this point */
     qemu_spice_init();
-- 
1.7.4.1

[Qemu-devel] [PATCH 04/18] qemu-char: Allocate CharDriverState in qemu_chr_new_from_opts

[minyard]

From: Corey Minyard <cminyard@mvista.com>

This allocates the CharDriverState structure in a more logical place.
It reduces code size and it allows a coming option to automatically
attempt to reconnect a chardev if the connection fails.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 console.c         |    6 +---
 console.h         |    2 +-
 hw/baum.c         |    6 +--
 hw/baum.h         |    2 +-
 hw/msmouse.c      |    5 +--
 hw/msmouse.h      |    2 +-
 qemu-char.c       |   93 +++++++++++++++++++++-------------------------------
 spice-qemu-char.c |    4 +--
 ui/qemu-spice.h   |    2 +-
 9 files changed, 47 insertions(+), 75 deletions(-)

diff --git a/console.c b/console.c
index 6a463f5..9a6538e 100644
--- a/console.c
+++ b/console.c
@@ -1513,15 +1513,12 @@ static void text_console_do_init(CharDriverState *chr, DisplayState *ds)
         chr->init(chr);
 }
 
-CharDriverState *text_console_init(QemuOpts *opts)
+CharDriverState *text_console_init(CharDriverState *chr, QemuOpts *opts)
 {
-    CharDriverState *chr;
     TextConsole *s;
     unsigned width;
     unsigned height;
 
-    chr = g_malloc0(sizeof(CharDriverState));
-
     width = qemu_opt_get_number(opts, "width", 0);
     if (width == 0)
         width = qemu_opt_get_number(opts, "cols", 0) * FONT_WIDTH;
@@ -1537,7 +1534,6 @@ CharDriverState *text_console_init(QemuOpts *opts)
     }
 
     if (!s) {
-        g_free(chr);
         return NULL;
     }
 
diff --git a/console.h b/console.h
index 4334db5..d4b930d 100644
--- a/console.h
+++ b/console.h
@@ -359,7 +359,7 @@ void vga_hw_text_update(console_ch_t *chardata);
 
 int is_graphic_console(void);
 int is_fixedsize_console(void);
-CharDriverState *text_console_init(QemuOpts *opts);
+CharDriverState *text_console_init(CharDriverState *chr, QemuOpts *opts);
 void text_consoles_set_display(DisplayState *ds);
 void console_select(unsigned int index);
 void console_color_init(DisplayState *ds);
diff --git a/hw/baum.c b/hw/baum.c
index 3e94f84..b5df8a6 100644
--- a/hw/baum.c
+++ b/hw/baum.c
@@ -562,10 +562,9 @@ static void baum_close(struct CharDriverState *chr)
     g_free(baum);
 }
 
-CharDriverState *chr_baum_init(QemuOpts *opts)
+CharDriverState *chr_baum_init(CharDriverState *chr, QemuOpts *opts)
 {
     BaumDriverState *baum;
-    CharDriverState *chr;
     brlapi_handle_t *handle;
 #ifdef CONFIG_SDL
     SDL_SysWMinfo info;
@@ -573,7 +572,7 @@ CharDriverState *chr_baum_init(QemuOpts *opts)
     int tty;
 
     baum = g_malloc0(sizeof(BaumDriverState));
-    baum->chr = chr = g_malloc0(sizeof(CharDriverState));
+    baum->chr = chr;
 
     chr->opaque = baum;
     chr->chr_write = baum_write;
@@ -621,7 +620,6 @@ fail:
     brlapi__closeConnection(handle);
 fail_handle:
     g_free(handle);
-    g_free(chr);
     g_free(baum);
     return NULL;
 }
diff --git a/hw/baum.h b/hw/baum.h
index 8af710f..599d48b 100644
--- a/hw/baum.h
+++ b/hw/baum.h
@@ -23,4 +23,4 @@
  */
 
 /* char device */
-CharDriverState *chr_baum_init(QemuOpts *opts);
+CharDriverState *chr_baum_init(CharDriverState *chr, QemuOpts *opts);
diff --git a/hw/msmouse.c b/hw/msmouse.c
index 9c492a4..8a8a1d3 100644
--- a/hw/msmouse.c
+++ b/hw/msmouse.c
@@ -64,11 +64,8 @@ static void msmouse_chr_close (struct CharDriverState *chr)
     g_free (chr);
 }
 
-CharDriverState *qemu_chr_open_msmouse(QemuOpts *opts)
+CharDriverState *qemu_chr_open_msmouse(CharDriverState *chr, QemuOpts *opts)
 {
-    CharDriverState *chr;
-
-    chr = g_malloc0(sizeof(CharDriverState));
     chr->chr_write = msmouse_chr_write;
     chr->chr_close = msmouse_chr_close;
 
diff --git a/hw/msmouse.h b/hw/msmouse.h
index 456cb21..925af1a 100644
--- a/hw/msmouse.h
+++ b/hw/msmouse.h
@@ -1,2 +1,2 @@
 /* msmouse.c */
-CharDriverState *qemu_chr_open_msmouse(QemuOpts *opts);
+CharDriverState *qemu_chr_open_msmouse(CharDriverState *chr, QemuOpts *opts);
diff --git a/qemu-char.c b/qemu-char.c
index c2aaaee..ce3c05d 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -221,11 +221,8 @@ static int null_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
     return len;
 }
 
-static CharDriverState *qemu_chr_open_null(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_null(CharDriverState *chr, QemuOpts *opts)
 {
-    CharDriverState *chr;
-
-    chr = g_malloc0(sizeof(CharDriverState));
     chr->chr_write = null_chr_write;
     return chr;
 }
@@ -618,12 +615,11 @@ static void fd_chr_close(struct CharDriverState *chr)
 }
 
 /* open a character device to a unix fd */
-static CharDriverState *qemu_chr_open_fd(int fd_in, int fd_out)
+static CharDriverState *qemu_chr_open_fd(CharDriverState *chr,
+                                         int fd_in, int fd_out)
 {
-    CharDriverState *chr;
     FDCharDriver *s;
 
-    chr = g_malloc0(sizeof(CharDriverState));
     s = g_malloc0(sizeof(FDCharDriver));
     s->fd_in = fd_in;
     s->fd_out = fd_out;
@@ -637,7 +633,8 @@ static CharDriverState *qemu_chr_open_fd(int fd_in, int fd_out)
     return chr;
 }
 
-static CharDriverState *qemu_chr_open_file_out(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_file_out(CharDriverState *chr,
+                                               QemuOpts *opts)
 {
     int fd_out;
 
@@ -646,10 +643,10 @@ static CharDriverState *qemu_chr_open_file_out(QemuOpts *opts)
     if (fd_out < 0) {
         return NULL;
     }
-    return qemu_chr_open_fd(-1, fd_out);
+    return qemu_chr_open_fd(chr, -1, fd_out);
 }
 
-static CharDriverState *qemu_chr_open_pipe(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_pipe(CharDriverState *chr, QemuOpts *opts)
 {
     int fd_in, fd_out;
     char filename_in[256], filename_out[256];
@@ -674,7 +671,7 @@ static CharDriverState *qemu_chr_open_pipe(QemuOpts *opts)
             return NULL;
         }
     }
-    return qemu_chr_open_fd(fd_in, fd_out);
+    return qemu_chr_open_fd(chr, fd_in, fd_out);
 }
 
 
@@ -765,10 +762,9 @@ static void qemu_chr_close_stdio(struct CharDriverState *chr)
     fd_chr_close(chr);
 }
 
-static CharDriverState *qemu_chr_open_stdio(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_stdio(CharDriverState *chr,
+                                            QemuOpts *opts)
 {
-    CharDriverState *chr;
-
     if (stdio_nb_clients >= STDIO_MAX_CLIENTS) {
         return NULL;
     }
@@ -779,7 +775,7 @@ static CharDriverState *qemu_chr_open_stdio(QemuOpts *opts)
         atexit(term_exit);
     }
 
-    chr = qemu_chr_open_fd(0, 1);
+    qemu_chr_open_fd(chr, 0, 1);
     chr->chr_close = qemu_chr_close_stdio;
     chr->chr_set_echo = qemu_chr_set_echo_stdio;
     qemu_set_fd_handler2(0, stdio_read_poll, stdio_read, NULL, chr);
@@ -975,9 +971,8 @@ static void pty_chr_close(struct CharDriverState *chr)
     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
 }
 
-static CharDriverState *qemu_chr_open_pty(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_pty(CharDriverState *chr, QemuOpts *opts)
 {
-    CharDriverState *chr;
     PtyCharDriver *s;
     struct termios tty;
     int master_fd, slave_fd, len;
@@ -999,8 +994,6 @@ static CharDriverState *qemu_chr_open_pty(QemuOpts *opts)
     tcsetattr(slave_fd, TCSAFLUSH, &tty);
     close(slave_fd);
 
-    chr = g_malloc0(sizeof(CharDriverState));
-
     len = strlen(q_ptsname(master_fd)) + 5;
     chr->filename = g_malloc(len);
     snprintf(chr->filename, len, "pty:%s", q_ptsname(master_fd));
@@ -1217,10 +1210,9 @@ static void qemu_chr_close_tty(CharDriverState *chr)
     }
 }
 
-static CharDriverState *qemu_chr_open_tty(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_tty(CharDriverState *chr, QemuOpts *opts)
 {
     const char *filename = qemu_opt_get(opts, "path");
-    CharDriverState *chr;
     int fd;
 
     TFR(fd = qemu_open(filename, O_RDWR | O_NONBLOCK));
@@ -1228,7 +1220,7 @@ static CharDriverState *qemu_chr_open_tty(QemuOpts *opts)
         return NULL;
     }
     tty_serial_init(fd, 115200, 'N', 8, 1);
-    chr = qemu_chr_open_fd(fd, fd);
+    qemu_chr_open_fd(chr, fd, fd);
     chr->chr_ioctl = tty_serial_ioctl;
     chr->chr_close = qemu_chr_close_tty;
     return chr;
@@ -1350,10 +1342,9 @@ static void pp_close(CharDriverState *chr)
     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
 }
 
-static CharDriverState *qemu_chr_open_pp(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_pp(CharDriverState *chr, QemuOpts *opts)
 {
     const char *filename = qemu_opt_get(opts, "path");
-    CharDriverState *chr;
     ParallelCharDriver *drv;
     int fd;
 
@@ -1371,7 +1362,6 @@ static CharDriverState *qemu_chr_open_pp(QemuOpts *opts)
     drv->fd = fd;
     drv->mode = IEEE1284_MODE_COMPAT;
 
-    chr = g_malloc0(sizeof(CharDriverState));
     chr->chr_write = null_chr_write;
     chr->chr_ioctl = pp_ioctl;
     chr->chr_close = pp_close;
@@ -1652,13 +1642,12 @@ static int win_chr_poll(void *opaque)
     return 0;
 }
 
-static CharDriverState *qemu_chr_open_win(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_win(CharDriverState *chr,
+                                          QemuOpts *opts)
 {
     const char *filename = qemu_opt_get(opts, "path");
-    CharDriverState *chr;
     WinCharState *s;
 
-    chr = g_malloc0(sizeof(CharDriverState));
     s = g_malloc0(sizeof(WinCharState));
     chr->opaque = s;
     chr->chr_write = win_chr_write;
@@ -1666,7 +1655,6 @@ static CharDriverState *qemu_chr_open_win(QemuOpts *opts)
 
     if (win_chr_init(chr, filename) < 0) {
         g_free(s);
-        g_free(chr);
         return NULL;
     }
     qemu_chr_generic_open(chr);
@@ -1752,13 +1740,12 @@ static int win_chr_pipe_init(CharDriverState *chr, const char *filename)
 }
 
 
-static CharDriverState *qemu_chr_open_win_pipe(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_win_pipe(CharDriverState *chr,
+                                               QemuOpts *opts)
 {
     const char *filename = qemu_opt_get(opts, "path");
-    CharDriverState *chr;
     WinCharState *s;
 
-    chr = g_malloc0(sizeof(CharDriverState));
     s = g_malloc0(sizeof(WinCharState));
     chr->opaque = s;
     chr->chr_write = win_chr_write;
@@ -1766,19 +1753,17 @@ static CharDriverState *qemu_chr_open_win_pipe(QemuOpts *opts)
 
     if (win_chr_pipe_init(chr, filename) < 0) {
         g_free(s);
-        g_free(chr);
         return NULL;
     }
     qemu_chr_generic_open(chr);
     return chr;
 }
 
-static CharDriverState *qemu_chr_open_win_file(HANDLE fd_out)
+static CharDriverState *qemu_chr_open_win_file(CharDriverState *chr,
+                                               HANDLE fd_out)
 {
-    CharDriverState *chr;
     WinCharState *s;
 
-    chr = g_malloc0(sizeof(CharDriverState));
     s = g_malloc0(sizeof(WinCharState));
     s->hcom = fd_out;
     chr->opaque = s;
@@ -1787,12 +1772,14 @@ static CharDriverState *qemu_chr_open_win_file(HANDLE fd_out)
     return chr;
 }
 
-static CharDriverState *qemu_chr_open_win_con(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_win_con(CharDriverState *chr,
+                                              QemuOpts *opts)
 {
-    return qemu_chr_open_win_file(GetStdHandle(STD_OUTPUT_HANDLE));
+    return qemu_chr_open_win_file(chr, GetStdHandle(STD_OUTPUT_HANDLE));
 }
 
-static CharDriverState *qemu_chr_open_win_file_out(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_win_file_out(CharDriverState *chr,
+                                                   QemuOpts *opts)
 {
     const char *file_out = qemu_opt_get(opts, "path");
     HANDLE fd_out;
@@ -1803,7 +1790,7 @@ static CharDriverState *qemu_chr_open_win_file_out(QemuOpts *opts)
         return NULL;
     }
 
-    return qemu_chr_open_win_file(fd_out);
+    return qemu_chr_open_win_file(chr, fd_out);
 }
 
 static int win_stdio_write(CharDriverState *chr, const uint8_t *buf, int len)
@@ -1944,9 +1931,9 @@ static void win_stdio_close(CharDriverState *chr)
     stdio_nb_clients--;
 }
 
-static CharDriverState *qemu_chr_open_win_stdio(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_win_stdio(CharDriverState   *chr,
+                                                QemuOpts *opts)
 {
-    CharDriverState   *chr;
     WinStdioCharState *stdio;
     DWORD              dwMode;
     int                is_console = 0;
@@ -1956,7 +1943,6 @@ static CharDriverState *qemu_chr_open_win_stdio(QemuOpts *opts)
         return NULL;
     }
 
-    chr   = g_malloc0(sizeof(CharDriverState));
     stdio = g_malloc0(sizeof(WinStdioCharState));
 
     stdio->hStdIn = GetStdHandle(STD_INPUT_HANDLE);
@@ -2093,13 +2079,11 @@ static void udp_chr_close(CharDriverState *chr)
     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
 }
 
-static CharDriverState *qemu_chr_open_udp(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_udp(CharDriverState *chr, QemuOpts *opts)
 {
-    CharDriverState *chr = NULL;
     NetCharDriver *s = NULL;
     int fd = -1;
 
-    chr = g_malloc0(sizeof(CharDriverState));
     s = g_malloc0(sizeof(NetCharDriver));
 
     fd = inet_dgram_opts(opts);
@@ -2118,7 +2102,6 @@ static CharDriverState *qemu_chr_open_udp(QemuOpts *opts)
     return chr;
 
 return_err:
-    g_free(chr);
     g_free(s);
     if (fd >= 0) {
         closesocket(fd);
@@ -2311,7 +2294,8 @@ static void tcp_chr_read(void *opaque)
 #ifndef _WIN32
 CharDriverState *qemu_chr_open_eventfd(int eventfd)
 {
-    return qemu_chr_open_fd(eventfd, eventfd);
+    CharDriverState *chr = g_malloc0(sizeof(CharDriverState));
+    return qemu_chr_open_fd(chr, eventfd, eventfd);
 }
 #endif
 
@@ -2414,9 +2398,9 @@ static void tcp_chr_close(CharDriverState *chr)
     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
 }
 
-static CharDriverState *qemu_chr_open_socket(QemuOpts *opts)
+static CharDriverState *qemu_chr_open_socket(CharDriverState *chr,
+                                             QemuOpts *opts)
 {
-    CharDriverState *chr = NULL;
     TCPCharDriver *s = NULL;
     int fd = -1;
     int is_listen;
@@ -2433,7 +2417,6 @@ static CharDriverState *qemu_chr_open_socket(QemuOpts *opts)
     if (!is_listen)
         is_waitconnect = 0;
 
-    chr = g_malloc0(sizeof(CharDriverState));
     s = g_malloc0(sizeof(TCPCharDriver));
 
     if (is_unix) {
@@ -2510,7 +2493,6 @@ static CharDriverState *qemu_chr_open_socket(QemuOpts *opts)
     if (fd >= 0)
         closesocket(fd);
     g_free(s);
-    g_free(chr);
     return NULL;
 }
 
@@ -2708,7 +2690,7 @@ fail:
 
 static const struct {
     const char *name;
-    CharDriverState *(*open)(QemuOpts *opts);
+  CharDriverState *(*open)(CharDriverState *chr, QemuOpts *opts);
 } backend_table[] = {
     { .name = "null",      .open = qemu_chr_open_null },
     { .name = "socket",    .open = qemu_chr_open_socket },
@@ -2770,8 +2752,9 @@ CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
         return NULL;
     }
 
-    chr = backend_table[i].open(opts);
-    if (!chr) {
+    chr = g_malloc0(sizeof(CharDriverState));
+    if (!backend_table[i].open(chr, opts)) {
+        g_free(chr);
         fprintf(stderr, "chardev: opening backend \"%s\" failed\n",
                 qemu_opt_get(opts, "backend"));
         return NULL;
diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 09aa22d..2fb8a10 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -188,9 +188,8 @@ static void print_allowed_subtypes(void)
     fprintf(stderr, "\n");
 }
 
-CharDriverState *qemu_chr_open_spice(QemuOpts *opts)
+CharDriverState *qemu_chr_open_spice(CharDriverState *chr, QemuOpts *opts)
 {
-    CharDriverState *chr;
     SpiceCharDriver *s;
     const char* name = qemu_opt_get(opts, "name");
     uint32_t debug = qemu_opt_get_number(opts, "debug", 0);
@@ -214,7 +213,6 @@ CharDriverState *qemu_chr_open_spice(QemuOpts *opts)
         return NULL;
     }
 
-    chr = g_malloc0(sizeof(CharDriverState));
     s = g_malloc0(sizeof(SpiceCharDriver));
     s->chr = chr;
     s->debug = debug;
diff --git a/ui/qemu-spice.h b/ui/qemu-spice.h
index 3299da8..fb582c5 100644
--- a/ui/qemu-spice.h
+++ b/ui/qemu-spice.h
@@ -45,7 +45,7 @@ int qemu_spice_migrate_info(const char *hostname, int port, int tls_port,
 void do_info_spice_print(Monitor *mon, const QObject *data);
 void do_info_spice(Monitor *mon, QObject **ret_data);
 
-CharDriverState *qemu_chr_open_spice(QemuOpts *opts);
+CharDriverState *qemu_chr_open_spice(CharDriverState *chr, QemuOpts *opts);
 
 #else  /* CONFIG_SPICE */
 #include "monitor.h"
-- 
1.7.4.1

[Qemu-devel] [PATCH 05/18] qemu-char: Allow a chardev to reconnect if disconnected

[minyard]

From: Corey Minyard <cminyard@mvista.com>

Allow a socket that connects to reconnect on a periodic basis if it
fails to connect at startup or if the connection drops while in use.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 qemu-char.c     |   62 ++++++++++++++++++++++++++++++++++++++++++++++++++----
 qemu-char.h     |    4 +++
 qemu-config.c   |    3 ++
 qemu-options.hx |   11 +++++++--
 4 files changed, 72 insertions(+), 8 deletions(-)

diff --git a/qemu-char.c b/qemu-char.c
index ce3c05d..43277d0 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -111,9 +111,17 @@ void qemu_chr_be_event(CharDriverState *s, int event)
     /* Keep track if the char device is open */
     switch (event) {
         case CHR_EVENT_OPENED:
+            if (s->recon_timer) {
+                qemu_del_timer(s->recon_timer);
+            }
             s->opened = 1;
             break;
         case CHR_EVENT_CLOSED:
+            if (s->recon_timer) {
+                qemu_mod_timer(s->recon_timer,
+                               (qemu_get_clock_ns(vm_clock) +
+                                (s->recon_time * 1000000000ULL)));
+            }
             s->opened = 0;
             break;
     }
@@ -2726,6 +2734,20 @@ static const struct {
 #endif
 };
 
+static void recon_timeout(void *opaque)
+{
+    CharDriverState *chr = opaque;
+
+    if (chr->opened) {
+        return;
+    }
+
+    qemu_mod_timer(chr->recon_timer,
+                   (qemu_get_clock_ns(vm_clock) +
+                    (chr->recon_time * 1000000000ULL)));
+    backend_table[chr->backend].open(chr, chr->opts);
+}
+
 CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
                                     void (*init)(struct CharDriverState *s))
 {
@@ -2753,11 +2775,37 @@ CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
     }
 
     chr = g_malloc0(sizeof(CharDriverState));
+
+    chr->backend = i;
+    chr->recon_time = qemu_opt_get_number(opts, "reconnect", 0);
+    if (chr->recon_time) {
+        if (strcmp(qemu_opt_get(opts, "backend"), "socket") != 0) {
+            g_free(chr);
+            fprintf(stderr, "chardev: reconnect only supported on sockets\n");
+            return NULL;
+        }
+        if (qemu_opt_get_bool(opts, "server", 0)) {
+            g_free(chr);
+            fprintf(stderr, "chardev: server device cannot reconnect\n");
+            return NULL;
+        }
+        chr->opts = opts;
+        chr->recon_timer = qemu_new_timer_ns(vm_clock, recon_timeout, chr);
+
+        /* Make sure it connects in time. */
+        qemu_mod_timer(chr->recon_timer,
+                       (qemu_get_clock_ns(vm_clock) +
+                        (chr->recon_time * 1000000000ULL)));
+    }
+
     if (!backend_table[i].open(chr, opts)) {
-        g_free(chr);
-        fprintf(stderr, "chardev: opening backend \"%s\" failed\n",
-                qemu_opt_get(opts, "backend"));
-        return NULL;
+        if (!chr->recon_time) {
+            /* Reconnect is not enabled, give up */
+            g_free(chr);
+            fprintf(stderr, "chardev: opening backend \"%s\" failed\n",
+                    qemu_opt_get(opts, "backend"));
+            return NULL;
+        }
     }
 
     if (!chr->filename)
@@ -2827,8 +2875,12 @@ void qemu_chr_fe_close(struct CharDriverState *chr)
 void qemu_chr_delete(CharDriverState *chr)
 {
     QTAILQ_REMOVE(&chardevs, chr, next);
-    if (chr->chr_close)
+    if (chr->chr_close) {
         chr->chr_close(chr);
+    }
+    if (chr->recon_timer) {
+        qemu_free_timer(chr->recon_timer);
+    }
     g_free(chr->filename);
     g_free(chr->label);
     g_free(chr);
diff --git a/qemu-char.h b/qemu-char.h
index 486644b..d21ae39 100644
--- a/qemu-char.h
+++ b/qemu-char.h
@@ -75,6 +75,10 @@ struct CharDriverState {
     int opened;
     int avail_connections;
     QTAILQ_ENTRY(CharDriverState) next;
+    int backend;
+    QemuOpts *opts;
+    QEMUTimer *recon_timer;
+    uint64_t recon_time;
 };
 
 /**
diff --git a/qemu-config.c b/qemu-config.c
index 54694cc..9ebe432 100644
--- a/qemu-config.c
+++ b/qemu-config.c
@@ -209,6 +209,9 @@ static QemuOptsList qemu_chardev_opts = {
             .name = "mux",
             .type = QEMU_OPT_BOOL,
         },{
+            .name = "reconnect",
+            .type = QEMU_OPT_NUMBER,
+        },{
             .name = "signal",
             .type = QEMU_OPT_BOOL,
         },{
diff --git a/qemu-options.hx b/qemu-options.hx
index 72aace6..c5f592c 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1620,8 +1620,9 @@ DEFHEADING(Character device options:)
 DEF("chardev", HAS_ARG, QEMU_OPTION_chardev,
     "-chardev null,id=id[,mux=on|off]\n"
     "-chardev socket,id=id[,host=host],port=host[,to=to][,ipv4][,ipv6][,nodelay]\n"
-    "         [,server][,nowait][,telnet][,mux=on|off] (tcp)\n"
-    "-chardev socket,id=id,path=path[,server][,nowait][,telnet],[mux=on|off] (unix)\n"
+    "         [,server][,nowait][,telnet][,mux=on|off][,reconnect=seconds] (tcp)\n"
+    "-chardev socket,id=id,path=path[,server][,nowait][,telnet][,mux=on|off]\n"
+    "         [,reconnect=seconds] (unix)\n"
     "-chardev udp,id=id[,host=host],port=port[,localaddr=localaddr]\n"
     "         [,localport=localport][,ipv4][,ipv6][,mux=on|off]\n"
     "-chardev msmouse,id=id[,mux=on|off]\n"
@@ -1690,7 +1691,7 @@ Options to each backend are described below.
 A void device. This device will not emit any data, and will drop any data it
 receives. The null backend does not take any options.
 
-@item -chardev socket ,id=@var{id} [@var{TCP options} or @var{unix options}] [,server] [,nowait] [,telnet]
+@item -chardev socket ,id=@var{id} [@var{TCP options} or @var{unix options}] [,server] [,nowait] [,telnet] [,reconnect=@var{seconds}]
 
 Create a two-way stream socket, which can be either a TCP or a unix socket. A
 unix socket will be created if @option{path} is specified. Behaviour is
@@ -1704,6 +1705,10 @@ connect to a listening socket.
 @option{telnet} specifies that traffic on the socket should interpret telnet
 escape sequences.
 
+@option{reconnect} specifies that if the socket does not come up at startup,
+or if the socket is closed for some reason (like the other end exited),
+wait the given number of seconds and attempt to reconnect.
+
 TCP and unix socket options are given below:
 
 @table @option
-- 
1.7.4.1

[Qemu-devel] [PATCH 06/18] qemu-char: Fix a race reporting opens and closes

[minyard]

From: Corey Minyard <cminyard@mvista.com>

When an open event is reported, it is done through a bh.  But close
events are reported immediately.  So if an open event is in the bh
and a close occurs, an extraneous open happens, which can confuse a
user.

To fix this, this patch sets the "opened" flag immediately instead
of in the bh handler and checks to make sure the opened flag is
set before reporting an open event.

This also modifies the spice code to call qemu_chr_generic_open
to report an open, to keep things consistent.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 qemu-char.c       |   18 ++++++++++++++++--
 spice-qemu-char.c |    7 +++++--
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/qemu-char.c b/qemu-char.c
index 43277d0..d363319 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -111,10 +111,13 @@ void qemu_chr_be_event(CharDriverState *s, int event)
     /* Keep track if the char device is open */
     switch (event) {
         case CHR_EVENT_OPENED:
+            /*
+             * See the comment in qemu_chr_generic_open_bh() for why
+             * 's->opened = 1' is not here.
+             */
             if (s->recon_timer) {
                 qemu_del_timer(s->recon_timer);
             }
-            s->opened = 1;
             break;
         case CHR_EVENT_CLOSED:
             if (s->recon_timer) {
@@ -134,13 +137,24 @@ void qemu_chr_be_event(CharDriverState *s, int event)
 static void qemu_chr_generic_open_bh(void *opaque)
 {
     CharDriverState *s = opaque;
-    qemu_chr_be_event(s, CHR_EVENT_OPENED);
+    /*
+     * Since the "close" event doesn't go through a bh, there is a
+     * possible race condition if a close comes in after an open, but
+     * the open is in the bh queue.  So we double-check here, and we
+     * set opened in qemu_chr_generic_open() instead of
+     * qemu_chr_be_event().
+     */
+    if (s->opened) {
+        qemu_chr_be_event(s, CHR_EVENT_OPENED);
+    }
     qemu_bh_delete(s->bh);
     s->bh = NULL;
 }
 
 void qemu_chr_generic_open(CharDriverState *s)
 {
+    /* See the comment in qemu_chr_generic_open_bh() for why this is here */
+    s->opened = 1;
     if (s->bh == NULL) {
 	s->bh = qemu_bh_new(qemu_chr_generic_open_bh, s);
 	qemu_bh_schedule(s->bh);
diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 2fb8a10..d7516bd 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -93,8 +93,11 @@ static void vmc_state(SpiceCharDeviceInstance *sin, int connected)
         return;
     }
 
-    qemu_chr_be_event(scd->chr,
-                      connected ? CHR_EVENT_OPENED : CHR_EVENT_CLOSED);
+    if (connected) {
+        qemu_chr_generic_open(scd->chr);
+    } else {
+        qemu_chr_be_event(scd->chr, CHR_EVENT_CLOSED);
+    }
 }
 
 static SpiceCharDeviceInterface vmc_interface = {
-- 
1.7.4.1

[Qemu-devel] [PATCH 07/18] qemu-char: remove free of chr from win_stdio_close

[minyard]

From: Corey Minyard <cminyard@mvista.com>

This will result in a double free on close, because it's freed
in qemu_chr_delete() right after calling the close function.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 qemu-char.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)

diff --git a/qemu-char.c b/qemu-char.c
index d363319..6c3e61e 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -1949,7 +1949,6 @@ static void win_stdio_close(CharDriverState *chr)
     }
 
     g_free(chr->opaque);
-    g_free(chr);
     stdio_nb_clients--;
 }
 
-- 
1.7.4.1

[Qemu-devel] [PATCH 08/18] qemu-char: Close fd at end of file

[minyard]

From: Corey Minyard <cminyard@mvista.com>

The chardev backends that used qemu_chr_open_fd did not get their
file descriptors closed at end of file or when the chardev was closed.
This could result in a file descriptor leak.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 qemu-char.c |   31 +++++++++++++++++++++++++------
 1 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/qemu-char.c b/qemu-char.c
index 6c3e61e..dac319c 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -566,6 +566,7 @@ static int stdio_nb_clients;
 typedef struct {
     int fd_in, fd_out;
     int max_size;
+    int close_fds_on_close;
 } FDCharDriver;
 
 
@@ -584,6 +585,20 @@ static int fd_chr_read_poll(void *opaque)
     return s->max_size;
 }
 
+static void fd_close_fds(FDCharDriver *s)
+{
+    if (!s->close_fds_on_close) {
+        return;
+    }
+
+    if ((s->fd_out != s->fd_in) && (s->fd_out != -1)) {
+        close(s->fd_out);
+    }
+    s->fd_out = -1;
+    close(s->fd_in);
+    s->fd_in = -1;
+}
+
 static void fd_chr_read(void *opaque)
 {
     CharDriverState *chr = opaque;
@@ -600,6 +615,7 @@ static void fd_chr_read(void *opaque)
     if (size == 0) {
         /* FD has been closed. Remove it from the active list.  */
         qemu_set_fd_handler2(s->fd_in, NULL, NULL, NULL, NULL);
+        fd_close_fds(s);
         qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
         return;
     }
@@ -629,6 +645,7 @@ static void fd_chr_close(struct CharDriverState *chr)
         if (display_type == DT_NOGRAPHIC && s->fd_in == 0) {
         } else {
             qemu_set_fd_handler2(s->fd_in, NULL, NULL, NULL, NULL);
+            fd_close_fds(s);
         }
     }
 
@@ -638,13 +655,15 @@ static void fd_chr_close(struct CharDriverState *chr)
 
 /* open a character device to a unix fd */
 static CharDriverState *qemu_chr_open_fd(CharDriverState *chr,
-                                         int fd_in, int fd_out)
+                                         int fd_in, int fd_out,
+                                         int close_fds_on_close)
 {
     FDCharDriver *s;
 
     s = g_malloc0(sizeof(FDCharDriver));
     s->fd_in = fd_in;
     s->fd_out = fd_out;
+    s->close_fds_on_close = close_fds_on_close;
     chr->opaque = s;
     chr->chr_write = fd_chr_write;
     chr->chr_update_read_handler = fd_chr_update_read_handler;
@@ -665,7 +684,7 @@ static CharDriverState *qemu_chr_open_file_out(CharDriverState *chr,
     if (fd_out < 0) {
         return NULL;
     }
-    return qemu_chr_open_fd(chr, -1, fd_out);
+    return qemu_chr_open_fd(chr, -1, fd_out, 1);
 }
 
 static CharDriverState *qemu_chr_open_pipe(CharDriverState *chr, QemuOpts *opts)
@@ -693,7 +712,7 @@ static CharDriverState *qemu_chr_open_pipe(CharDriverState *chr, QemuOpts *opts)
             return NULL;
         }
     }
-    return qemu_chr_open_fd(chr, fd_in, fd_out);
+    return qemu_chr_open_fd(chr, fd_in, fd_out, 1);
 }
 
 
@@ -797,7 +816,7 @@ static CharDriverState *qemu_chr_open_stdio(CharDriverState *chr,
         atexit(term_exit);
     }
 
-    qemu_chr_open_fd(chr, 0, 1);
+    qemu_chr_open_fd(chr, 0, 1, 0);
     chr->chr_close = qemu_chr_close_stdio;
     chr->chr_set_echo = qemu_chr_set_echo_stdio;
     qemu_set_fd_handler2(0, stdio_read_poll, stdio_read, NULL, chr);
@@ -1242,7 +1261,7 @@ static CharDriverState *qemu_chr_open_tty(CharDriverState *chr, QemuOpts *opts)
         return NULL;
     }
     tty_serial_init(fd, 115200, 'N', 8, 1);
-    qemu_chr_open_fd(chr, fd, fd);
+    qemu_chr_open_fd(chr, fd, fd, 1);
     chr->chr_ioctl = tty_serial_ioctl;
     chr->chr_close = qemu_chr_close_tty;
     return chr;
@@ -2316,7 +2335,7 @@ static void tcp_chr_read(void *opaque)
 CharDriverState *qemu_chr_open_eventfd(int eventfd)
 {
     CharDriverState *chr = g_malloc0(sizeof(CharDriverState));
-    return qemu_chr_open_fd(chr, eventfd, eventfd);
+    return qemu_chr_open_fd(chr, eventfd, eventfd, 0);
 }
 #endif
 
-- 
1.7.4.1

[Qemu-devel] [PATCH 09/18] qdev: Add a pre-firmware init capability

[minyard]

From: Corey Minyard <cminyard@mvista.com>

Some devices may need to do some firmware-type initialization before
the firmware itself is initialized.  For instance, any device that
adds SMBIOS table entries (like IPMI) will need to do that before
the BIOS is initialized.

So add a list of devices that get initialized before the firmware
initialization.  Since those devices get removed from the list so
they don't get initialized twice, convert the qemu_opt_foreach() to
use the safe list traversal.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 hw/pc.c           |    2 ++
 hw/qdev-monitor.c |   52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 hw/qdev.h         |    3 +++
 qemu-option.c     |    4 ++--
 4 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/hw/pc.c b/hw/pc.c
index bedd5be..811d99c 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -1010,6 +1010,8 @@ void *pc_bios_init(const char *kernel_filename,
     void *fw_cfg;
     int linux_boot, i;
 
+    qdev_prefw_init_check();
+
     /* Initialize PC system firmware */
     pc_system_firmware_init(rom_memory);
 
diff --git a/hw/qdev-monitor.c b/hw/qdev-monitor.c
index 7915b45..bb8e955 100644
--- a/hw/qdev-monitor.c
+++ b/hw/qdev-monitor.c
@@ -486,6 +486,58 @@ DeviceState *qdev_device_add(QemuOpts *opts)
     return qdev;
 }
 
+/*
+ * Some devices may need to be initialized before the firmware is
+ * initialized, so they may add information to the firmware
+ * structures.
+ */
+typedef struct prefw_list {
+    const char *name;
+    struct prefw_list *next;
+} prefw_list;
+
+prefw_list *prefw_init;
+
+void qdev_add_prefw_init(const char *name)
+{
+    prefw_list *e = g_malloc(sizeof(*e));
+    e->name = name;
+    e->next = prefw_init;
+    prefw_init = e;
+}
+
+static int prefw_check_func(QemuOpts *opts, void *opaque)
+{
+    DeviceState *dev;
+    const char *driver;
+    prefw_list *e;
+
+    driver = qemu_opt_get(opts, "driver");
+    if (!driver) {
+        return 0;
+    }
+
+    for (e = prefw_init; e; e = e->next) {
+        if (strcmp(driver, e->name) == 0) {
+            dev = qdev_device_add(opts);
+            if (!dev) {
+                return -1;
+            }
+            qemu_opts_del(opts);
+            break;
+        }
+    }
+    return 0;
+}
+
+void qdev_prefw_init_check(void)
+{
+    /* init generic devices */
+    if (qemu_opts_foreach(qemu_find_opts("device"),
+                          prefw_check_func, NULL, 1) != 0) {
+        exit(1);
+    }
+}
 
 #define qdev_printf(fmt, ...) monitor_printf(mon, "%*s" fmt, indent, "", ## __VA_ARGS__)
 static void qbus_print(Monitor *mon, BusState *bus, int indent);
diff --git a/hw/qdev.h b/hw/qdev.h
index f4683dc..2be4c95 100644
--- a/hw/qdev.h
+++ b/hw/qdev.h
@@ -167,6 +167,9 @@ int qdev_simple_unplug_cb(DeviceState *dev);
 void qdev_machine_creation_done(void);
 bool qdev_machine_modified(void);
 
+void qdev_add_prefw_init(const char *name);
+void qdev_prefw_init_check(void);
+
 qemu_irq qdev_get_gpio_in(DeviceState *dev, int n);
 void qdev_connect_gpio_out(DeviceState *dev, int n, qemu_irq pin);
 
diff --git a/qemu-option.c b/qemu-option.c
index bb3886c..1d000f8 100644
--- a/qemu-option.c
+++ b/qemu-option.c
@@ -709,10 +709,10 @@ int qemu_opt_set_bool(QemuOpts *opts, const char *name, bool val)
 int qemu_opt_foreach(QemuOpts *opts, qemu_opt_loopfunc func, void *opaque,
                      int abort_on_failure)
 {
-    QemuOpt *opt;
+    QemuOpt *opt, *next_opt;
     int rc = 0;
 
-    QTAILQ_FOREACH(opt, &opts->head, next) {
+    QTAILQ_FOREACH_SAFE(opt, &opts->head, next, next_opt) {
         rc = func(opt->name, opt->str, opaque);
         if (abort_on_failure  &&  rc != 0)
             break;
-- 
1.7.4.1

Re: [Qemu-devel] [PATCH 09/18] qdev: Add a pre-firmware init capability

[Andreas Färber]

Am 19.07.2012 20:53, schrieb minyard@acm.org:
> From: Corey Minyard <cminyard@mvista.com>
> 
> Some devices may need to do some firmware-type initialization before
> the firmware itself is initialized.  For instance, any device that
> adds SMBIOS table entries (like IPMI) will need to do that before
> the BIOS is initialized.
> 
> So add a list of devices that get initialized before the firmware
> initialization.  Since those devices get removed from the list so
> they don't get initialized twice, convert the qemu_opt_foreach() to
> use the safe list traversal.
> 
> Signed-off-by: Corey Minyard <cminyard@mvista.com>

I'm not so thrilled by this interface...

This doesn't seem to have anything to do with the monitor, and
prefw_list doesn't really indicate it's a list of type names either, nor
does qdev_add_prefw_init() precisely indicate what it's doing.

Then, your implementation of qdev_prefw_init_check() is based on
re-iterating over -device options. That's not safe since there's other
ways to create a device - object_new() et al. and soon a qom_create QMP
command.

So what exactly is the problem you are trying to solve here? What needs
to happen before this step and until when does this need to happen? For
example, is this an ordering problem between device creation and
MemoryRegion setup in the machine?

My thinking is that if this is a generic problem unrelated to QOM
realize / DeviceState::init we could provide a new
DeviceState::init_firmware hook for that purpose and call it recursively
on all devices. If however this is just some PC quirk, we should not
model this at qdev level but locally in hw/pc.c, then you have more
degrees of freedom in designing some PC-internal API.

Regards,
Andreas

> ---
>  hw/pc.c           |    2 ++
>  hw/qdev-monitor.c |   52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
>  hw/qdev.h         |    3 +++
>  qemu-option.c     |    4 ++--
>  4 files changed, 59 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/pc.c b/hw/pc.c
> index bedd5be..811d99c 100644
> --- a/hw/pc.c
> +++ b/hw/pc.c
> @@ -1010,6 +1010,8 @@ void *pc_bios_init(const char *kernel_filename,
>      void *fw_cfg;
>      int linux_boot, i;
>  
> +    qdev_prefw_init_check();
> +
>      /* Initialize PC system firmware */
>      pc_system_firmware_init(rom_memory);
>  
> diff --git a/hw/qdev-monitor.c b/hw/qdev-monitor.c
> index 7915b45..bb8e955 100644
> --- a/hw/qdev-monitor.c
> +++ b/hw/qdev-monitor.c
> @@ -486,6 +486,58 @@ DeviceState *qdev_device_add(QemuOpts *opts)
>      return qdev;
>  }
>  
> +/*
> + * Some devices may need to be initialized before the firmware is
> + * initialized, so they may add information to the firmware
> + * structures.
> + */
> +typedef struct prefw_list {
> +    const char *name;
> +    struct prefw_list *next;
> +} prefw_list;
> +
> +prefw_list *prefw_init;
> +
> +void qdev_add_prefw_init(const char *name)
> +{
> +    prefw_list *e = g_malloc(sizeof(*e));
> +    e->name = name;
> +    e->next = prefw_init;
> +    prefw_init = e;
> +}
> +
> +static int prefw_check_func(QemuOpts *opts, void *opaque)
> +{
> +    DeviceState *dev;
> +    const char *driver;
> +    prefw_list *e;
> +
> +    driver = qemu_opt_get(opts, "driver");
> +    if (!driver) {
> +        return 0;
> +    }
> +
> +    for (e = prefw_init; e; e = e->next) {
> +        if (strcmp(driver, e->name) == 0) {
> +            dev = qdev_device_add(opts);
> +            if (!dev) {
> +                return -1;
> +            }
> +            qemu_opts_del(opts);
> +            break;
> +        }
> +    }
> +    return 0;
> +}
> +
> +void qdev_prefw_init_check(void)
> +{
> +    /* init generic devices */
> +    if (qemu_opts_foreach(qemu_find_opts("device"),
> +                          prefw_check_func, NULL, 1) != 0) {
> +        exit(1);
> +    }
> +}
>  
>  #define qdev_printf(fmt, ...) monitor_printf(mon, "%*s" fmt, indent, "", ## __VA_ARGS__)
>  static void qbus_print(Monitor *mon, BusState *bus, int indent);
> diff --git a/hw/qdev.h b/hw/qdev.h
> index f4683dc..2be4c95 100644
> --- a/hw/qdev.h
> +++ b/hw/qdev.h
> @@ -167,6 +167,9 @@ int qdev_simple_unplug_cb(DeviceState *dev);
>  void qdev_machine_creation_done(void);
>  bool qdev_machine_modified(void);
>  
> +void qdev_add_prefw_init(const char *name);
> +void qdev_prefw_init_check(void);
> +
>  qemu_irq qdev_get_gpio_in(DeviceState *dev, int n);
>  void qdev_connect_gpio_out(DeviceState *dev, int n, qemu_irq pin);
>  
> diff --git a/qemu-option.c b/qemu-option.c
> index bb3886c..1d000f8 100644
> --- a/qemu-option.c
> +++ b/qemu-option.c
> @@ -709,10 +709,10 @@ int qemu_opt_set_bool(QemuOpts *opts, const char *name, bool val)
>  int qemu_opt_foreach(QemuOpts *opts, qemu_opt_loopfunc func, void *opaque,
>                       int abort_on_failure)
>  {
> -    QemuOpt *opt;
> +    QemuOpt *opt, *next_opt;
>      int rc = 0;
>  
> -    QTAILQ_FOREACH(opt, &opts->head, next) {
> +    QTAILQ_FOREACH_SAFE(opt, &opts->head, next, next_opt) {
>          rc = func(opt->name, opt->str, opaque);
>          if (abort_on_failure  &&  rc != 0)
>              break;
> 


-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH 09/18] qdev: Add a pre-firmware init capability

[Corey Minyard]

On 07/30/2012 09:36 AM, Andreas Färber wrote:
> Am 19.07.2012 20:53, schrieb minyard@acm.org:
>> From: Corey Minyard <cminyard@mvista.com>
>>
>> Some devices may need to do some firmware-type initialization before
>> the firmware itself is initialized.  For instance, any device that
>> adds SMBIOS table entries (like IPMI) will need to do that before
>> the BIOS is initialized.
>>
>> So add a list of devices that get initialized before the firmware
>> initialization.  Since those devices get removed from the list so
>> they don't get initialized twice, convert the qemu_opt_foreach() to
>> use the safe list traversal.
>>
>> Signed-off-by: Corey Minyard <cminyard@mvista.com>
> I'm not so thrilled by this interface...

Actually, I'm not terribly thrilled by it, either, but I need something 
like it.

>
> This doesn't seem to have anything to do with the monitor, and
> prefw_list doesn't really indicate it's a list of type names either, nor
> does qdev_add_prefw_init() precisely indicate what it's doing.
>
> Then, your implementation of qdev_prefw_init_check() is based on
> re-iterating over -device options. That's not safe since there's other
> ways to create a device - object_new() et al. and soon a qom_create QMP
> command.
>
> So what exactly is the problem you are trying to solve here? What needs
> to happen before this step and until when does this need to happen? For
> example, is this an ordering problem between device creation and
> MemoryRegion setup in the machine?
>
> My thinking is that if this is a generic problem unrelated to QOM
> realize / DeviceState::init we could provide a new
> DeviceState::init_firmware hook for that purpose and call it recursively
> on all devices. If however this is just some PC quirk, we should not
> model this at qdev level but locally in hw/pc.c, then you have more
> degrees of freedom in designing some PC-internal API.

The basic problem is that I need to do some level of initialization on 
the device, at least to determine the interface address, interrupt, 
etc., so the SMBIOS tables can be populated.  I assume something similar 
will be required for OF if powerpc is ported, and perhaps for uboot type 
interfaces if those are ever ported.

The basic problem, I guess, is that the SMBIOS tables are fixed very 
early, before devices have initialized.  If that could be moved later, 
or device initialization moved earlier, the problem would go away.  But 
with the current design, I couldn't see an easy way to delay setting the 
SMBIOS tables that far.  I delayed it as long as I could see to do it 
reasonably and then put the firmware init right before that.

Thanks,

-corey
>
> Regards,
> Andreas
>
>> ---
>>   hw/pc.c           |    2 ++
>>   hw/qdev-monitor.c |   52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
>>   hw/qdev.h         |    3 +++
>>   qemu-option.c     |    4 ++--
>>   4 files changed, 59 insertions(+), 2 deletions(-)
>>
>> diff --git a/hw/pc.c b/hw/pc.c
>> index bedd5be..811d99c 100644
>> --- a/hw/pc.c
>> +++ b/hw/pc.c
>> @@ -1010,6 +1010,8 @@ void *pc_bios_init(const char *kernel_filename,
>>       void *fw_cfg;
>>       int linux_boot, i;
>>   
>> +    qdev_prefw_init_check();
>> +
>>       /* Initialize PC system firmware */
>>       pc_system_firmware_init(rom_memory);
>>   
>> diff --git a/hw/qdev-monitor.c b/hw/qdev-monitor.c
>> index 7915b45..bb8e955 100644
>> --- a/hw/qdev-monitor.c
>> +++ b/hw/qdev-monitor.c
>> @@ -486,6 +486,58 @@ DeviceState *qdev_device_add(QemuOpts *opts)
>>       return qdev;
>>   }
>>   
>> +/*
>> + * Some devices may need to be initialized before the firmware is
>> + * initialized, so they may add information to the firmware
>> + * structures.
>> + */
>> +typedef struct prefw_list {
>> +    const char *name;
>> +    struct prefw_list *next;
>> +} prefw_list;
>> +
>> +prefw_list *prefw_init;
>> +
>> +void qdev_add_prefw_init(const char *name)
>> +{
>> +    prefw_list *e = g_malloc(sizeof(*e));
>> +    e->name = name;
>> +    e->next = prefw_init;
>> +    prefw_init = e;
>> +}
>> +
>> +static int prefw_check_func(QemuOpts *opts, void *opaque)
>> +{
>> +    DeviceState *dev;
>> +    const char *driver;
>> +    prefw_list *e;
>> +
>> +    driver = qemu_opt_get(opts, "driver");
>> +    if (!driver) {
>> +        return 0;
>> +    }
>> +
>> +    for (e = prefw_init; e; e = e->next) {
>> +        if (strcmp(driver, e->name) == 0) {
>> +            dev = qdev_device_add(opts);
>> +            if (!dev) {
>> +                return -1;
>> +            }
>> +            qemu_opts_del(opts);
>> +            break;
>> +        }
>> +    }
>> +    return 0;
>> +}
>> +
>> +void qdev_prefw_init_check(void)
>> +{
>> +    /* init generic devices */
>> +    if (qemu_opts_foreach(qemu_find_opts("device"),
>> +                          prefw_check_func, NULL, 1) != 0) {
>> +        exit(1);
>> +    }
>> +}
>>   
>>   #define qdev_printf(fmt, ...) monitor_printf(mon, "%*s" fmt, indent, "", ## __VA_ARGS__)
>>   static void qbus_print(Monitor *mon, BusState *bus, int indent);
>> diff --git a/hw/qdev.h b/hw/qdev.h
>> index f4683dc..2be4c95 100644
>> --- a/hw/qdev.h
>> +++ b/hw/qdev.h
>> @@ -167,6 +167,9 @@ int qdev_simple_unplug_cb(DeviceState *dev);
>>   void qdev_machine_creation_done(void);
>>   bool qdev_machine_modified(void);
>>   
>> +void qdev_add_prefw_init(const char *name);
>> +void qdev_prefw_init_check(void);
>> +
>>   qemu_irq qdev_get_gpio_in(DeviceState *dev, int n);
>>   void qdev_connect_gpio_out(DeviceState *dev, int n, qemu_irq pin);
>>   
>> diff --git a/qemu-option.c b/qemu-option.c
>> index bb3886c..1d000f8 100644
>> --- a/qemu-option.c
>> +++ b/qemu-option.c
>> @@ -709,10 +709,10 @@ int qemu_opt_set_bool(QemuOpts *opts, const char *name, bool val)
>>   int qemu_opt_foreach(QemuOpts *opts, qemu_opt_loopfunc func, void *opaque,
>>                        int abort_on_failure)
>>   {
>> -    QemuOpt *opt;
>> +    QemuOpt *opt, *next_opt;
>>       int rc = 0;
>>   
>> -    QTAILQ_FOREACH(opt, &opts->head, next) {
>> +    QTAILQ_FOREACH_SAFE(opt, &opts->head, next, next_opt) {
>>           rc = func(opt->name, opt->str, opaque);
>>           if (abort_on_failure  &&  rc != 0)
>>               break;
>>
>

Re: [Qemu-devel] [PATCH 09/18] qdev: Add a pre-firmware init capability

[Anthony Liguori]

minyard@acm.org writes:

> From: Corey Minyard <cminyard@mvista.com>
>
> Some devices may need to do some firmware-type initialization before
> the firmware itself is initialized.  For instance, any device that
> adds SMBIOS table entries (like IPMI) will need to do that before
> the BIOS is initialized.
>
> So add a list of devices that get initialized before the firmware
> initialization.  Since those devices get removed from the list so
> they don't get initialized twice, convert the qemu_opt_foreach() to
> use the safe list traversal.
>
> Signed-off-by: Corey Minyard <cminyard@mvista.com>

This should go away if you move the SMBIOS changes to BIOS.

Regards,

Anthony Liguori

> ---
>  hw/pc.c           |    2 ++
>  hw/qdev-monitor.c |   52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
>  hw/qdev.h         |    3 +++
>  qemu-option.c     |    4 ++--
>  4 files changed, 59 insertions(+), 2 deletions(-)
>
> diff --git a/hw/pc.c b/hw/pc.c
> index bedd5be..811d99c 100644
> --- a/hw/pc.c
> +++ b/hw/pc.c
> @@ -1010,6 +1010,8 @@ void *pc_bios_init(const char *kernel_filename,
>      void *fw_cfg;
>      int linux_boot, i;
>  
> +    qdev_prefw_init_check();
> +
>      /* Initialize PC system firmware */
>      pc_system_firmware_init(rom_memory);
>  
> diff --git a/hw/qdev-monitor.c b/hw/qdev-monitor.c
> index 7915b45..bb8e955 100644
> --- a/hw/qdev-monitor.c
> +++ b/hw/qdev-monitor.c
> @@ -486,6 +486,58 @@ DeviceState *qdev_device_add(QemuOpts *opts)
>      return qdev;
>  }
>  
> +/*
> + * Some devices may need to be initialized before the firmware is
> + * initialized, so they may add information to the firmware
> + * structures.
> + */
> +typedef struct prefw_list {
> +    const char *name;
> +    struct prefw_list *next;
> +} prefw_list;
> +
> +prefw_list *prefw_init;
> +
> +void qdev_add_prefw_init(const char *name)
> +{
> +    prefw_list *e = g_malloc(sizeof(*e));
> +    e->name = name;
> +    e->next = prefw_init;
> +    prefw_init = e;
> +}
> +
> +static int prefw_check_func(QemuOpts *opts, void *opaque)
> +{
> +    DeviceState *dev;
> +    const char *driver;
> +    prefw_list *e;
> +
> +    driver = qemu_opt_get(opts, "driver");
> +    if (!driver) {
> +        return 0;
> +    }
> +
> +    for (e = prefw_init; e; e = e->next) {
> +        if (strcmp(driver, e->name) == 0) {
> +            dev = qdev_device_add(opts);
> +            if (!dev) {
> +                return -1;
> +            }
> +            qemu_opts_del(opts);
> +            break;
> +        }
> +    }
> +    return 0;
> +}
> +
> +void qdev_prefw_init_check(void)
> +{
> +    /* init generic devices */
> +    if (qemu_opts_foreach(qemu_find_opts("device"),
> +                          prefw_check_func, NULL, 1) != 0) {
> +        exit(1);
> +    }
> +}
>  
>  #define qdev_printf(fmt, ...) monitor_printf(mon, "%*s" fmt, indent, "", ## __VA_ARGS__)
>  static void qbus_print(Monitor *mon, BusState *bus, int indent);
> diff --git a/hw/qdev.h b/hw/qdev.h
> index f4683dc..2be4c95 100644
> --- a/hw/qdev.h
> +++ b/hw/qdev.h
> @@ -167,6 +167,9 @@ int qdev_simple_unplug_cb(DeviceState *dev);
>  void qdev_machine_creation_done(void);
>  bool qdev_machine_modified(void);
>  
> +void qdev_add_prefw_init(const char *name);
> +void qdev_prefw_init_check(void);
> +
>  qemu_irq qdev_get_gpio_in(DeviceState *dev, int n);
>  void qdev_connect_gpio_out(DeviceState *dev, int n, qemu_irq pin);
>  
> diff --git a/qemu-option.c b/qemu-option.c
> index bb3886c..1d000f8 100644
> --- a/qemu-option.c
> +++ b/qemu-option.c
> @@ -709,10 +709,10 @@ int qemu_opt_set_bool(QemuOpts *opts, const char *name, bool val)
>  int qemu_opt_foreach(QemuOpts *opts, qemu_opt_loopfunc func, void *opaque,
>                       int abort_on_failure)
>  {
> -    QemuOpt *opt;
> +    QemuOpt *opt, *next_opt;
>      int rc = 0;
>  
> -    QTAILQ_FOREACH(opt, &opts->head, next) {
> +    QTAILQ_FOREACH_SAFE(opt, &opts->head, next, next_opt) {
>          rc = func(opt->name, opt->str, opaque);
>          if (abort_on_failure  &&  rc != 0)
>              break;
> -- 
> 1.7.4.1

[Qemu-devel] [PATCH 10/18] qom: release previous object when setting

[minyard]

From: Corey Minyard <cminyard@mvista.com>

When setting an object, if you don't release the previous object
that was there, it may become unusable.  This change allows a
chardev to be removed from one object's properties and added to
another's.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qom/object.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/qom/object.c b/qom/object.c
index 00bb3b0..f0ff9cc 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -731,6 +731,9 @@ void object_property_set(Object *obj, Visitor *v, const char *name,
     if (!prop->set) {
         error_set(errp, QERR_PERMISSION_DENIED);
     } else {
+        if (prop->release) {
+            prop->release(obj, name, prop->opaque);
+        }
         prop->set(obj, v, prop->opaque, name, errp);
     }
 }
-- 
1.7.4.1

Re: [Qemu-devel] [PATCH 10/18] qom: release previous object when setting

[Andreas Färber]

Am 19.07.2012 20:53, schrieb minyard@acm.org:
> From: Corey Minyard <cminyard@mvista.com>
> 
> When setting an object, if you don't release the previous object
> that was there, it may become unusable.  This change allows a
> chardev to be removed from one object's properties and added to
> another's.
> 
> Signed-off-by: Corey Minyard <cminyard@mvista.com>
> Acked-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Andreas Färber <afaerber@suse.de>

Anthony, this looks like a valid and generic QOM memory leak fix to me.
Suggesting to cherry-pick this patch to master and stable-1.1.

Andreas

> ---
>  qom/object.c |    3 +++
>  1 files changed, 3 insertions(+), 0 deletions(-)
> 
> diff --git a/qom/object.c b/qom/object.c
> index 00bb3b0..f0ff9cc 100644
> --- a/qom/object.c
> +++ b/qom/object.c
> @@ -731,6 +731,9 @@ void object_property_set(Object *obj, Visitor *v, const char *name,
>      if (!prop->set) {
>          error_set(errp, QERR_PERMISSION_DENIED);
>      } else {
> +        if (prop->release) {
> +            prop->release(obj, name, prop->opaque);
> +        }
>          prop->set(obj, v, prop->opaque, name, errp);
>      }
>  }
> 


-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH 10/18] qom: release previous object when setting

[Andreas Färber]

Am 30.07.2012 15:51, schrieb Andreas Färber:
> Am 19.07.2012 20:53, schrieb minyard@acm.org:
>> From: Corey Minyard <cminyard@mvista.com>
>>
>> When setting an object, if you don't release the previous object
>> that was there, it may become unusable.  This change allows a
>> chardev to be removed from one object's properties and added to
>> another's.
>>
>> Signed-off-by: Corey Minyard <cminyard@mvista.com>
>> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
> 
> Reviewed-by: Andreas Färber <afaerber@suse.de>
> 
> Anthony, this looks like a valid and generic QOM memory leak fix to me.
> Suggesting to cherry-pick this patch to master and stable-1.1.

Ping?

> 
> Andreas
> 
>> ---
>>  qom/object.c |    3 +++
>>  1 files changed, 3 insertions(+), 0 deletions(-)
>>
>> diff --git a/qom/object.c b/qom/object.c
>> index 00bb3b0..f0ff9cc 100644
>> --- a/qom/object.c
>> +++ b/qom/object.c
>> @@ -731,6 +731,9 @@ void object_property_set(Object *obj, Visitor *v, const char *name,
>>      if (!prop->set) {
>>          error_set(errp, QERR_PERMISSION_DENIED);
>>      } else {
>> +        if (prop->release) {
>> +            prop->release(obj, name, prop->opaque);
>> +        }
>>          prop->set(obj, v, prop->opaque, name, errp);
>>      }
>>  }
>>
> 
> 


-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

[Qemu-devel] [PATCH 11/18] Add a base IPMI interface

[minyard]

From: Corey Minyard <cminyard@mvista.com>

Add the basic IPMI types and infrastructure to QEMU.  Low-level
interfaces and simulation interfaces will register with this; it's
kind of the go-between to tie them together.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 default-configs/i386-softmmu.mak   |    1 +
 default-configs/x86_64-softmmu.mak |    1 +
 hw/Makefile.objs                   |    2 +
 hw/ipmi.c                          |  167 +++++++++++++++++++++++++
 hw/ipmi.h                          |  236 ++++++++++++++++++++++++++++++++++++
 qemu-doc.texi                      |    2 +
 6 files changed, 409 insertions(+), 0 deletions(-)
 create mode 100644 hw/ipmi.c
 create mode 100644 hw/ipmi.h

diff --git a/default-configs/i386-softmmu.mak b/default-configs/i386-softmmu.mak
index 2c78175..eb17afc 100644
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -7,6 +7,7 @@ CONFIG_VGA_ISA=y
 CONFIG_VGA_CIRRUS=y
 CONFIG_VMWARE_VGA=y
 CONFIG_VMMOUSE=y
+CONFIG_IPMI=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/default-configs/x86_64-softmmu.mak b/default-configs/x86_64-softmmu.mak
index 233a856..e4e3e4f 100644
--- a/default-configs/x86_64-softmmu.mak
+++ b/default-configs/x86_64-softmmu.mak
@@ -7,6 +7,7 @@ CONFIG_VGA_ISA=y
 CONFIG_VGA_CIRRUS=y
 CONFIG_VMWARE_VGA=y
 CONFIG_VMMOUSE=y
+CONFIG_IPMI=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/hw/Makefile.objs b/hw/Makefile.objs
index 27e362a..256cfae 100644
--- a/hw/Makefile.objs
+++ b/hw/Makefile.objs
@@ -20,6 +20,8 @@ hw-obj-$(CONFIG_M48T59) += m48t59.o
 hw-obj-$(CONFIG_ESCC) += escc.o
 hw-obj-$(CONFIG_EMPTY_SLOT) += empty_slot.o
 
+hw-obj-$(CONFIG_IPMI) += ipmi.o
+
 hw-obj-$(CONFIG_SERIAL) += serial.o
 hw-obj-$(CONFIG_PARALLEL) += parallel.o
 hw-obj-$(CONFIG_I8254) += i8254_common.o i8254.o
diff --git a/hw/ipmi.c b/hw/ipmi.c
new file mode 100644
index 0000000..252eab0
--- /dev/null
+++ b/hw/ipmi.c
@@ -0,0 +1,167 @@
+/*
+ * QEMU IPMI emulation
+ *
+ * Copyright (c) 2012 Corey Minyard, MontaVista Software, LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "hw.h"
+#include "ipmi.h"
+#include "sysemu.h"
+#include "qmp-commands.h"
+
+#ifdef DO_IPMI_THREAD
+static void *ipmi_thread(void *opaque)
+{
+    IPMIInterface *s = opaque;
+    int64_t wait_until;
+
+    ipmi_lock(s);
+    for (;;) {
+        qemu_cond_wait(&s->waker, &s->lock);
+        wait_until = 0;
+        while (s->do_wake) {
+            s->do_wake = 0;
+            s->handle_if_event(s);
+        }
+    }
+    ipmi_unlock(s);
+    return NULL;
+}
+#endif
+
+static int ipmi_do_hw_op(IPMIInterface *s, enum ipmi_op op, int checkonly)
+{
+    switch (op) {
+    case IPMI_RESET_CHASSIS:
+        if (checkonly) {
+            return 0;
+        }
+        qemu_system_reset_request();
+        return 0;
+
+    case IPMI_POWEROFF_CHASSIS:
+        if (checkonly) {
+            return 0;
+        }
+        qemu_system_powerdown_request();
+        return 0;
+
+    case IPMI_SEND_NMI:
+        if (checkonly) {
+            return 0;
+        }
+        qemu_mutex_lock_iothread();
+        qmp_inject_nmi(NULL);
+        qemu_mutex_unlock_iothread();
+        return 0;
+
+    case IPMI_POWERCYCLE_CHASSIS:
+    case IPMI_PULSE_DIAG_IRQ:
+    case IPMI_SHUTDOWN_VIA_ACPI_OVERTEMP:
+    case IPMI_POWERON_CHASSIS:
+    default:
+        return IPMI_CC_COMMAND_NOT_SUPPORTED;
+    }
+}
+
+static void ipmi_set_irq_enable(IPMIInterface *s, int val)
+{
+    s->irqs_enabled = val;
+}
+
+void ipmi_interface_reset(IPMIInterface *s)
+{
+    IPMIBmcClass *bk = IPMI_BMC_GET_CLASS(s->bmc);
+
+    if (bk->handle_reset) {
+        bk->handle_reset(s->bmc);
+    }
+}
+
+int ipmi_interface_init(IPMIInterface *s)
+{
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+
+    if (k->init) {
+        int rc = k->init(s);
+        if (rc) {
+            return rc;
+        }
+    }
+
+    if (!s->slave_addr) {
+        s->slave_addr = 0x20;
+    }
+
+#ifdef DO_IPMI_THREAD
+    qemu_mutex_init(&s->lock);
+    qemu_cond_init(&s->waker);
+    qemu_thread_create(&s->thread, ipmi_thread, s, 0);
+#endif
+
+    return 0;
+}
+
+static void ipmi_interface_class_init(ObjectClass *class, void *data)
+{
+    IPMIInterfaceClass *ik = IPMI_INTERFACE_CLASS(class);
+
+    ik->do_hw_op = ipmi_do_hw_op;
+    ik->set_irq_enable = ipmi_set_irq_enable;
+}
+
+static TypeInfo ipmi_interface_type_info = {
+    .name = TYPE_IPMI_INTERFACE,
+    .parent = TYPE_OBJECT,
+    .instance_size = sizeof(IPMIInterface),
+    .abstract = true,
+    .class_size = sizeof(IPMIInterfaceClass),
+    .class_init = ipmi_interface_class_init,
+};
+
+int ipmi_bmc_init(IPMIBmc *s)
+{
+    IPMIBmcClass *k = IPMI_BMC_GET_CLASS(s);
+
+    if (k->init) {
+        int rc = k->init(s);
+        if (rc) {
+            return rc;
+        }
+    }
+    return 0;
+}
+
+static TypeInfo ipmi_bmc_type_info = {
+    .name = TYPE_IPMI_BMC,
+    .parent = TYPE_OBJECT,
+    .instance_size = sizeof(IPMIBmc),
+    .abstract = true,
+    .class_size = sizeof(IPMIBmcClass),
+};
+
+static void ipmi_register_types(void)
+{
+    type_register_static(&ipmi_interface_type_info);
+    type_register_static(&ipmi_bmc_type_info);
+}
+
+type_init(ipmi_register_types)
diff --git a/hw/ipmi.h b/hw/ipmi.h
new file mode 100644
index 0000000..66077de
--- /dev/null
+++ b/hw/ipmi.h
@@ -0,0 +1,236 @@
+/*
+ * IPMI base class
+ *
+ * Copyright (c) 2012 Corey Minyard, MontaVista Software, LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_IPMI_H
+#define HW_IPMI_H
+
+#include "memory.h"
+#include "qemu-common.h"
+#include "qdev.h"
+
+/*
+ * Create a separate thread for the IPMI interface itself.  This is a
+ * better simulation and lets the IPMI interface do things asynchronously
+ * if necessary.
+ */
+/* #define DO_IPMI_THREAD */
+
+#ifdef DO_IPMI_THREAD
+#include "qemu-thread.h"
+
+#define ipmi_lock(s) qemu_mutex_lock(&(s)->lock)
+#define ipmi_unlock(s) qemu_mutex_unlock(&(s)->lock)
+#define ipmi_signal(s) \
+do {                                                                          \
+    (s)->do_wake = 1;                                                         \
+    qemu_cond_signal(&(s)->waker);                                            \
+} while (0)
+
+#else
+#define ipmi_lock(s) ((s)->lockcount++)
+#define ipmi_unlock(s) ((s)->lockcount--)
+#define ipmi_signal(s)                                                       \
+do {                                                                         \
+    (s)->do_wake = 1;                                                        \
+    while ((s)->do_wake) {                                                   \
+        (s)->do_wake = 0;                                                    \
+        (IPMI_INTERFACE_GET_CLASS(s))->handle_if_event(s);                   \
+    }                                                                        \
+} while (0)
+#endif
+
+#define MAX_IPMI_MSG_SIZE 300
+
+enum ipmi_op {
+    IPMI_RESET_CHASSIS,
+    IPMI_POWEROFF_CHASSIS,
+    IPMI_POWERON_CHASSIS,
+    IPMI_POWERCYCLE_CHASSIS,
+    IPMI_PULSE_DIAG_IRQ,
+    IPMI_SHUTDOWN_VIA_ACPI_OVERTEMP,
+    IPMI_SEND_NMI
+};
+
+#define IPMI_CC_INVALID_CMD                                0xc1
+#define IPMI_CC_COMMAND_INVALID_FOR_LUN                        0xc2
+#define IPMI_CC_TIMEOUT                                        0xc3
+#define IPMI_CC_OUT_OF_SPACE                                0xc4
+#define IPMI_CC_INVALID_RESERVATION                        0xc5
+#define IPMI_CC_REQUEST_DATA_TRUNCATED                        0xc6
+#define IPMI_CC_REQUEST_DATA_LENGTH_INVALID                0xc7
+#define IPMI_CC_PARM_OUT_OF_RANGE                        0xc9
+#define IPMI_CC_CANNOT_RETURN_REQ_NUM_BYTES                0xca
+#define IPMI_CC_REQ_ENTRY_NOT_PRESENT                        0xcb
+#define IPMI_CC_INVALID_DATA_FIELD                        0xcc
+#define IPMI_CC_BMC_INIT_IN_PROGRESS                        0xd2
+#define IPMI_CC_COMMAND_NOT_SUPPORTED                        0xd5
+
+#define IPMI_NETFN_APP                0x06
+
+#define IPMI_DEBUG 1
+
+/* Specified in the SMBIOS spec. */
+#define IPMI_SMBIOS_KCS                0x01
+#define IPMI_SMBIOS_SMIC        0x02
+#define IPMI_SMBIOS_BT                0x03
+#define IPMI_SMBIOS_SSIF        0x04
+
+typedef struct IPMIBmc IPMIBmc;
+
+/*
+ * An IPMI Interface, the interface for talking between the target
+ * and the BMC.
+ */
+#define TYPE_IPMI_INTERFACE "ipmi-interface"
+#define IPMI_INTERFACE(obj) \
+     OBJECT_CHECK(IPMIInterface, (obj), TYPE_IPMI_INTERFACE)
+#define IPMI_INTERFACE_CLASS(klass) \
+     OBJECT_CLASS_CHECK(IPMIInterfaceClass, (klass), TYPE_IPMI_INTERFACE)
+#define IPMI_INTERFACE_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(IPMIInterfaceClass, (obj), TYPE_IPMI_INTERFACE)
+
+typedef struct IPMIInterface {
+    Object parent_obj;
+
+    void *bmc; /* Really IPMIBmc */
+
+#ifdef DO_IPMI_THREAD
+    QemuThread thread;
+    QemuCond waker;
+    QemuMutex lock;
+#else
+    int lockcount;
+#endif
+    int do_wake;
+
+    int obf_irq_set;
+    int atn_irq_set;
+    qemu_irq irq;
+    int use_irq;
+    int irqs_enabled;
+
+    unsigned long io_base;
+    unsigned long io_length;
+
+    MemoryRegion io;
+
+    uint8_t outmsg[MAX_IPMI_MSG_SIZE];
+    unsigned int outpos;
+    unsigned int outlen;
+
+    uint8_t inmsg[MAX_IPMI_MSG_SIZE];
+    unsigned int inlen;
+    int write_end;
+
+    unsigned char slave_addr;
+} IPMIInterface;
+
+typedef struct IPMIInterfaceClass {
+    ObjectClass parent_class;
+
+    unsigned int smbios_type;
+
+    int (*init)(struct IPMIInterface *s);
+
+    /*
+     * Perform various operations on the hardware.  If checkonly is
+     * true, it will return if the operation can be performed, but it
+     * will not do the operation.
+     */
+    int (*do_hw_op)(struct IPMIInterface *s, enum ipmi_op op, int checkonly);
+
+    /*
+     * Enable/disable irqs on the interface when the BMC requests this.
+     */
+    void (*set_irq_enable)(struct IPMIInterface *s, int val);
+
+    /*
+     * Handle an event that occurred on the interface, generally the.
+     * target writing to a register.
+     */
+    void (*handle_if_event)(struct IPMIInterface *s);
+
+    /*
+     * The interfaces use this to perform certain ops
+     */
+    void (*set_atn)(struct IPMIInterface *s, int val, int irq);
+
+    /*
+     * Handle a response from the bmc.  Must be called with ipmi_lock
+     * held.
+     */
+    void (*handle_rsp)(struct IPMIInterface *s, uint8_t msg_id,
+                       unsigned char *rsp, unsigned int rsp_len);
+
+} IPMIInterfaceClass;
+
+int ipmi_interface_init(IPMIInterface *s);
+void ipmi_interface_reset(IPMIInterface *s);
+
+/*
+ * Define a BMC simulator (or perhaps a connection to a real BMC)
+ */
+#define TYPE_IPMI_BMC "ipmi-bmc"
+#define IPMI_BMC(obj) \
+     OBJECT_CHECK(IPMIBmc, (obj), TYPE_IPMI_BMC)
+#define IPMI_BMC_CLASS(klass) \
+     OBJECT_CLASS_CHECK(IPMIBmcClass, (klass), TYPE_IPMI_BMC)
+#define IPMI_BMC_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(IPMIBmcClass, (obj), TYPE_IPMI_BMC)
+
+struct IPMIBmc {
+    Object parent_obj;
+
+    IPMIInterface *intf;
+    CharDriverState *chr;
+};
+
+typedef struct IPMIBmcClass {
+    ObjectClass parent_class;
+
+    int (*init)(IPMIBmc *s);
+
+    /* Called when the system resets to report to the bmc. */
+    void (*handle_reset)(struct IPMIBmc *s);
+
+    /*
+     * Handle a command to the bmc.  Must be called with ipmi_lock
+     * held.
+     */
+    void (*handle_command)(struct IPMIBmc *s,
+                           uint8_t *cmd, unsigned int cmd_len,
+                           unsigned int max_cmd_len,
+                           uint8_t msg_id);
+} IPMIBmcClass;
+
+int ipmi_bmc_init(IPMIBmc *s);
+
+#ifdef IPMI_DEBUG
+#define ipmi_debug(fs, ...) \
+    fprintf(stderr, "IPMI (%s): " fs, __func__, ##__VA_ARGS__)
+#else
+#define ipmi_debug(fs, ...)
+#endif
+
+#endif
diff --git a/qemu-doc.texi b/qemu-doc.texi
index 0af0ff4..effa2da 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -195,6 +195,8 @@ PCI and ISA network adapters
 @item
 Serial ports
 @item
+IPMI BMC, either and internal or external one
+@item
 Creative SoundBlaster 16 sound card
 @item
 ENSONIQ AudioPCI ES1370 sound card
-- 
1.7.4.1

[Qemu-devel] [PATCH 12/18] IPMI: Add a PC ISA type structure

[minyard]

From: Corey Minyard <cminyard@mvista.com>

This provides the base infrastructure to tie IPMI low-level
interfaces into a PC ISA bus.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 default-configs/i386-softmmu.mak   |    1 +
 default-configs/x86_64-softmmu.mak |    1 +
 hw/Makefile.objs                   |    1 +
 hw/isa_ipmi.c                      |  181 ++++++++++++++++++++++++++++++++++++
 hw/smbios.h                        |   12 +++
 5 files changed, 196 insertions(+), 0 deletions(-)
 create mode 100644 hw/isa_ipmi.c

diff --git a/default-configs/i386-softmmu.mak b/default-configs/i386-softmmu.mak
index eb17afc..c0aff0d 100644
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -8,6 +8,7 @@ CONFIG_VGA_CIRRUS=y
 CONFIG_VMWARE_VGA=y
 CONFIG_VMMOUSE=y
 CONFIG_IPMI=y
+CONFIG_ISA_IPMI=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/default-configs/x86_64-softmmu.mak b/default-configs/x86_64-softmmu.mak
index e4e3e4f..615e4f2 100644
--- a/default-configs/x86_64-softmmu.mak
+++ b/default-configs/x86_64-softmmu.mak
@@ -8,6 +8,7 @@ CONFIG_VGA_CIRRUS=y
 CONFIG_VMWARE_VGA=y
 CONFIG_VMMOUSE=y
 CONFIG_IPMI=y
+CONFIG_ISA_IPMI=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/hw/Makefile.objs b/hw/Makefile.objs
index 256cfae..928870b 100644
--- a/hw/Makefile.objs
+++ b/hw/Makefile.objs
@@ -21,6 +21,7 @@ hw-obj-$(CONFIG_ESCC) += escc.o
 hw-obj-$(CONFIG_EMPTY_SLOT) += empty_slot.o
 
 hw-obj-$(CONFIG_IPMI) += ipmi.o
+hw-obj-$(CONFIG_ISA_IPMI) += isa_ipmi.o
 
 hw-obj-$(CONFIG_SERIAL) += serial.o
 hw-obj-$(CONFIG_PARALLEL) += parallel.o
diff --git a/hw/isa_ipmi.c b/hw/isa_ipmi.c
new file mode 100644
index 0000000..c15ca22
--- /dev/null
+++ b/hw/isa_ipmi.c
@@ -0,0 +1,181 @@
+/*
+ * QEMU ISA IPMI KCS emulation
+ *
+ * Copyright (c) 2012 Corey Minyard, MontaVista Software, LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw.h"
+#include "isa.h"
+#include "pc.h"
+#include "qemu-timer.h"
+#include "qemu-char.h"
+#include "sysemu.h"
+#include "smbios.h"
+#include "ipmi.h"
+
+
+typedef struct ISAIPMIDevice {
+    ISADevice dev;
+    char *interface;
+    uint32_t iobase;
+    uint32_t isairq;
+    uint8_t slave_addr;
+    CharDriverState *chr;
+    IPMIInterface *intf;
+} ISAIPMIDevice;
+
+static int ipmi_isa_initfn(ISADevice *dev)
+{
+    ISAIPMIDevice *isa = DO_UPCAST(ISAIPMIDevice, dev, dev);
+    struct smbios_type_38 smb38;
+    char typename[20];
+    Object *intfobj;
+    IPMIInterface *intf;
+    IPMIInterfaceClass *intfk;
+    Object *bmcobj;
+    IPMIBmc *bmc;
+    int rc;
+    Error *errp = NULL;
+
+    if (!isa->interface) {
+        isa->interface = g_strdup("kcs");
+    }
+
+    if (isa->chr) {
+        bmcobj = object_new("ipmi-bmc-extern");
+    } else {
+        bmcobj = object_new("ipmi-bmc-sim");
+    }
+    bmc = DO_UPCAST(IPMIBmc, parent_obj, bmcobj);
+    bmc->chr = isa->chr;
+    snprintf(typename, sizeof(typename), "ipmi-interface-%s", isa->interface);
+    intfobj = object_new(typename);
+    intf = DO_UPCAST(IPMIInterface, parent_obj, intfobj);
+    bmc->intf = intf;
+    intf->bmc = bmc;
+    intf->io_base = isa->iobase;
+    intf->slave_addr = isa->slave_addr;
+    rc = ipmi_interface_init(intf);
+    if (rc) {
+        return rc;
+    }
+    rc = ipmi_bmc_init(bmc);
+    if (rc) {
+        return rc;
+    }
+
+    /* These may be set by the interface. */
+    isa->iobase = intf->io_base;
+    isa->slave_addr = intf->slave_addr;
+
+    if (isa->isairq != 0) {
+        isa_init_irq(dev, &intf->irq, isa->isairq);
+        intf->use_irq = 1;
+    }
+
+    isa->intf = intf;
+    object_property_add_child(OBJECT(isa), "intf", OBJECT(intf), &errp);
+    if (error_is_set(&errp)) {
+        fprintf(stderr, "%s\n", error_get_pretty(errp));
+        return 1;
+    }
+    object_property_add_child(OBJECT(isa), "bmc", OBJECT(bmc), &errp);
+    if (error_is_set(&errp)) {
+        fprintf(stderr, "%s\n", error_get_pretty(errp));
+        return 1;
+    }
+
+    qdev_set_legacy_instance_id(&dev->qdev, intf->io_base, intf->io_length);
+
+    isa_register_ioport(dev, &intf->io, intf->io_base);
+
+    intfk = IPMI_INTERFACE_GET_CLASS(intf);
+
+    smb38.header.type = 38;
+    smb38.header.length = sizeof(smb38);
+    smb38.header.handle = 0x3000;
+    smb38.interface_type = intfk->smbios_type;
+    smb38.ipmi_version = 0x20;
+    smb38.i2c_slave_addr = intf->slave_addr;
+    smb38.nv_storage_dev_addr = 0;
+
+    /* or 1 to set it to I/O space */
+    smb38.base_addr = intf->io_base | 1;
+
+     /* 1-byte boundaries, addr bit0=0, level triggered irq */
+    smb38.base_addr_mod_and_irq_info = 1;
+    smb38.interrupt_number = isa->isairq;
+    smbios_table_entry_add((struct smbios_structure_header *) &smb38);
+
+    return 0;
+}
+
+static void ipmi_isa_reset(DeviceState *qdev)
+{
+    ISAIPMIDevice *isa = DO_UPCAST(ISAIPMIDevice, dev.qdev, qdev);
+
+    ipmi_interface_reset(isa->intf);
+}
+
+static Property ipmi_isa_properties[] = {
+    DEFINE_PROP_STRING("interface", ISAIPMIDevice, interface),
+    DEFINE_PROP_HEX32("iobase", ISAIPMIDevice, iobase,  0),
+    DEFINE_PROP_UINT32("irq",   ISAIPMIDevice, isairq,  5),
+    DEFINE_PROP_UINT8("slave_addr", ISAIPMIDevice, slave_addr,  0),
+    DEFINE_PROP_CHR("chardev",  ISAIPMIDevice, chr),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+#if 0 /* FIXME */
+static const VMStateDescription vmstate_isa_ipmi = {
+    .name = "isa-ipmi",
+    .version_id = 3,
+    .minimum_version_id = 3,
+    .fields      = (VMStateField[]) {
+        /* FIXME - fill this in */
+        VMSTATE_END_OF_LIST()
+    }
+};
+#endif
+
+static void ipmi_isa_class_initfn(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ISADeviceClass *ic = ISA_DEVICE_CLASS(klass);
+    ic->init = ipmi_isa_initfn;
+    dc->reset = ipmi_isa_reset;
+    /* dc->vmsd = &vmstate_isa_ipmi; FIXME */
+    dc->props = ipmi_isa_properties;
+}
+
+static TypeInfo ipmi_isa_info = {
+    .name          = "isa-ipmi",
+    .parent        = TYPE_ISA_DEVICE,
+    .instance_size = sizeof(ISAIPMIDevice),
+    .class_init    = ipmi_isa_class_initfn,
+};
+
+static void ipmi_register_types(void)
+{
+    type_register_static(&ipmi_isa_info);
+    qdev_add_prefw_init("isa-ipmi");
+}
+
+type_init(ipmi_register_types)
diff --git a/hw/smbios.h b/hw/smbios.h
index 6431a15..b9e4a61 100644
--- a/hw/smbios.h
+++ b/hw/smbios.h
@@ -155,6 +155,18 @@ struct smbios_type_32 {
     uint8_t boot_status;
 } QEMU_PACKED;
 
+/* SMBIOS type 38 - IPMI Device Information */
+struct smbios_type_38 {
+    struct smbios_structure_header header;
+    uint8_t interface_type;
+    uint8_t ipmi_version;
+    uint8_t i2c_slave_addr;
+    uint8_t nv_storage_dev_addr;
+    uint64_t base_addr;
+    uint8_t base_addr_mod_and_irq_info;
+    uint8_t interrupt_number;
+} QEMU_PACKED;
+
 /* SMBIOS type 127 -- End-of-table */
 struct smbios_type_127 {
     struct smbios_structure_header header;
-- 
1.7.4.1

Re: [Qemu-devel] [PATCH 12/18] IPMI: Add a PC ISA type structure

[Andreas Färber]

Am 19.07.2012 20:53, schrieb minyard@acm.org:
> From: Corey Minyard <cminyard@mvista.com>
> 
> This provides the base infrastructure to tie IPMI low-level
> interfaces into a PC ISA bus.
> 
> Signed-off-by: Corey Minyard <cminyard@mvista.com>
> ---
>  default-configs/i386-softmmu.mak   |    1 +
>  default-configs/x86_64-softmmu.mak |    1 +
>  hw/Makefile.objs                   |    1 +
>  hw/isa_ipmi.c                      |  181 ++++++++++++++++++++++++++++++++++++
>  hw/smbios.h                        |   12 +++
>  5 files changed, 196 insertions(+), 0 deletions(-)
>  create mode 100644 hw/isa_ipmi.c
> 
> diff --git a/default-configs/i386-softmmu.mak b/default-configs/i386-softmmu.mak
> index eb17afc..c0aff0d 100644
> --- a/default-configs/i386-softmmu.mak
> +++ b/default-configs/i386-softmmu.mak
> @@ -8,6 +8,7 @@ CONFIG_VGA_CIRRUS=y
>  CONFIG_VMWARE_VGA=y
>  CONFIG_VMMOUSE=y
>  CONFIG_IPMI=y
> +CONFIG_ISA_IPMI=y
>  CONFIG_SERIAL=y
>  CONFIG_PARALLEL=y
>  CONFIG_I8254=y
> diff --git a/default-configs/x86_64-softmmu.mak b/default-configs/x86_64-softmmu.mak
> index e4e3e4f..615e4f2 100644
> --- a/default-configs/x86_64-softmmu.mak
> +++ b/default-configs/x86_64-softmmu.mak
> @@ -8,6 +8,7 @@ CONFIG_VGA_CIRRUS=y
>  CONFIG_VMWARE_VGA=y
>  CONFIG_VMMOUSE=y
>  CONFIG_IPMI=y
> +CONFIG_ISA_IPMI=y
>  CONFIG_SERIAL=y
>  CONFIG_PARALLEL=y
>  CONFIG_I8254=y
> diff --git a/hw/Makefile.objs b/hw/Makefile.objs
> index 256cfae..928870b 100644
> --- a/hw/Makefile.objs
> +++ b/hw/Makefile.objs
> @@ -21,6 +21,7 @@ hw-obj-$(CONFIG_ESCC) += escc.o
>  hw-obj-$(CONFIG_EMPTY_SLOT) += empty_slot.o
>  
>  hw-obj-$(CONFIG_IPMI) += ipmi.o
> +hw-obj-$(CONFIG_ISA_IPMI) += isa_ipmi.o
>  
>  hw-obj-$(CONFIG_SERIAL) += serial.o
>  hw-obj-$(CONFIG_PARALLEL) += parallel.o
> diff --git a/hw/isa_ipmi.c b/hw/isa_ipmi.c
> new file mode 100644
> index 0000000..c15ca22
> --- /dev/null
> +++ b/hw/isa_ipmi.c
> @@ -0,0 +1,181 @@
> +/*
> + * QEMU ISA IPMI KCS emulation
> + *
> + * Copyright (c) 2012 Corey Minyard, MontaVista Software, LLC
> + *
> + * Permission is hereby granted, free of charge, to any person obtaining a copy
> + * of this software and associated documentation files (the "Software"), to deal
> + * in the Software without restriction, including without limitation the rights
> + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
> + * copies of the Software, and to permit persons to whom the Software is
> + * furnished to do so, subject to the following conditions:
> + *
> + * The above copyright notice and this permission notice shall be included in
> + * all copies or substantial portions of the Software.
> + *
> + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
> + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
> + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
> + * THE SOFTWARE.
> + */
> +#include "hw.h"
> +#include "isa.h"
> +#include "pc.h"
> +#include "qemu-timer.h"
> +#include "qemu-char.h"
> +#include "sysemu.h"
> +#include "smbios.h"
> +#include "ipmi.h"
> +
> +
> +typedef struct ISAIPMIDevice {
> +    ISADevice dev;
> +    char *interface;
> +    uint32_t iobase;
> +    uint32_t isairq;
> +    uint8_t slave_addr;
> +    CharDriverState *chr;
> +    IPMIInterface *intf;
> +} ISAIPMIDevice;
> +
> +static int ipmi_isa_initfn(ISADevice *dev)
> +{
> +    ISAIPMIDevice *isa = DO_UPCAST(ISAIPMIDevice, dev, dev);
> +    struct smbios_type_38 smb38;
> +    char typename[20];
> +    Object *intfobj;
> +    IPMIInterface *intf;
> +    IPMIInterfaceClass *intfk;
> +    Object *bmcobj;
> +    IPMIBmc *bmc;
> +    int rc;
> +    Error *errp = NULL;
> +
> +    if (!isa->interface) {
> +        isa->interface = g_strdup("kcs");
> +    }
> +
> +    if (isa->chr) {
> +        bmcobj = object_new("ipmi-bmc-extern");
> +    } else {
> +        bmcobj = object_new("ipmi-bmc-sim");
> +    }

Please use TYPE_ constants instead of hardcoding strings.

> +    bmc = DO_UPCAST(IPMIBmc, parent_obj, bmcobj);

Please use QOM cast macros rather than qdev's DO_UPCAST().

> +    bmc->chr = isa->chr;
> +    snprintf(typename, sizeof(typename), "ipmi-interface-%s", isa->interface);
> +    intfobj = object_new(typename);
> +    intf = DO_UPCAST(IPMIInterface, parent_obj, intfobj);
> +    bmc->intf = intf;
> +    intf->bmc = bmc;
> +    intf->io_base = isa->iobase;
> +    intf->slave_addr = isa->slave_addr;
> +    rc = ipmi_interface_init(intf);
> +    if (rc) {
> +        return rc;
> +    }
> +    rc = ipmi_bmc_init(bmc);
> +    if (rc) {
> +        return rc;
> +    }
> +
> +    /* These may be set by the interface. */
> +    isa->iobase = intf->io_base;
> +    isa->slave_addr = intf->slave_addr;
> +
> +    if (isa->isairq != 0) {
> +        isa_init_irq(dev, &intf->irq, isa->isairq);
> +        intf->use_irq = 1;
> +    }
> +
> +    isa->intf = intf;
> +    object_property_add_child(OBJECT(isa), "intf", OBJECT(intf), &errp);
> +    if (error_is_set(&errp)) {
> +        fprintf(stderr, "%s\n", error_get_pretty(errp));
> +        return 1;
> +    }
> +    object_property_add_child(OBJECT(isa), "bmc", OBJECT(bmc), &errp);
> +    if (error_is_set(&errp)) {
> +        fprintf(stderr, "%s\n", error_get_pretty(errp));
> +        return 1;
> +    }
> +
> +    qdev_set_legacy_instance_id(&dev->qdev, intf->io_base, intf->io_length);
> +
> +    isa_register_ioport(dev, &intf->io, intf->io_base);
> +
> +    intfk = IPMI_INTERFACE_GET_CLASS(intf);
> +
> +    smb38.header.type = 38;
> +    smb38.header.length = sizeof(smb38);
> +    smb38.header.handle = 0x3000;
> +    smb38.interface_type = intfk->smbios_type;
> +    smb38.ipmi_version = 0x20;
> +    smb38.i2c_slave_addr = intf->slave_addr;
> +    smb38.nv_storage_dev_addr = 0;
> +
> +    /* or 1 to set it to I/O space */
> +    smb38.base_addr = intf->io_base | 1;
> +
> +     /* 1-byte boundaries, addr bit0=0, level triggered irq */
> +    smb38.base_addr_mod_and_irq_info = 1;
> +    smb38.interrupt_number = isa->isairq;
> +    smbios_table_entry_add((struct smbios_structure_header *) &smb38);
> +
> +    return 0;
> +}
> +
> +static void ipmi_isa_reset(DeviceState *qdev)
> +{
> +    ISAIPMIDevice *isa = DO_UPCAST(ISAIPMIDevice, dev.qdev, qdev);
> +
> +    ipmi_interface_reset(isa->intf);
> +}
> +
> +static Property ipmi_isa_properties[] = {
> +    DEFINE_PROP_STRING("interface", ISAIPMIDevice, interface),
> +    DEFINE_PROP_HEX32("iobase", ISAIPMIDevice, iobase,  0),
> +    DEFINE_PROP_UINT32("irq",   ISAIPMIDevice, isairq,  5),
> +    DEFINE_PROP_UINT8("slave_addr", ISAIPMIDevice, slave_addr,  0),
> +    DEFINE_PROP_CHR("chardev",  ISAIPMIDevice, chr),
> +    DEFINE_PROP_END_OF_LIST(),
> +};
> +
> +#if 0 /* FIXME */

Fix this? x86 machines should definitely remain migratable.

> +static const VMStateDescription vmstate_isa_ipmi = {
> +    .name = "isa-ipmi",
> +    .version_id = 3,
> +    .minimum_version_id = 3,
> +    .fields      = (VMStateField[]) {
> +        /* FIXME - fill this in */
> +        VMSTATE_END_OF_LIST()
> +    }
> +};
> +#endif
> +
> +static void ipmi_isa_class_initfn(ObjectClass *klass, void *data)
> +{
> +    DeviceClass *dc = DEVICE_CLASS(klass);
> +    ISADeviceClass *ic = ISA_DEVICE_CLASS(klass);
> +    ic->init = ipmi_isa_initfn;
> +    dc->reset = ipmi_isa_reset;
> +    /* dc->vmsd = &vmstate_isa_ipmi; FIXME */
> +    dc->props = ipmi_isa_properties;
> +}
> +
> +static TypeInfo ipmi_isa_info = {

static const please.

> +    .name          = "isa-ipmi",

Where is this used? Should probably be TYPE_..., too.

Andreas

> +    .parent        = TYPE_ISA_DEVICE,
> +    .instance_size = sizeof(ISAIPMIDevice),
> +    .class_init    = ipmi_isa_class_initfn,
> +};
> +
> +static void ipmi_register_types(void)
> +{
> +    type_register_static(&ipmi_isa_info);
> +    qdev_add_prefw_init("isa-ipmi");
> +}
> +
> +type_init(ipmi_register_types)
> diff --git a/hw/smbios.h b/hw/smbios.h
> index 6431a15..b9e4a61 100644
> --- a/hw/smbios.h
> +++ b/hw/smbios.h
> @@ -155,6 +155,18 @@ struct smbios_type_32 {
>      uint8_t boot_status;
>  } QEMU_PACKED;
>  
> +/* SMBIOS type 38 - IPMI Device Information */
> +struct smbios_type_38 {
> +    struct smbios_structure_header header;
> +    uint8_t interface_type;
> +    uint8_t ipmi_version;
> +    uint8_t i2c_slave_addr;
> +    uint8_t nv_storage_dev_addr;
> +    uint64_t base_addr;
> +    uint8_t base_addr_mod_and_irq_info;
> +    uint8_t interrupt_number;
> +} QEMU_PACKED;
> +
>  /* SMBIOS type 127 -- End-of-table */
>  struct smbios_type_127 {
>      struct smbios_structure_header header;
> 


-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH 12/18] IPMI: Add a PC ISA type structure

[Corey Minyard]

On 07/30/2012 08:45 AM, Andreas Färber wrote:
> Am 19.07.2012 20:53, schrieb minyard@acm.org:
>> From: Corey Minyard <cminyard@mvista.com>
>>
>> +
>> +static Property ipmi_isa_properties[] = {
>> +    DEFINE_PROP_STRING("interface", ISAIPMIDevice, interface),
>> +    DEFINE_PROP_HEX32("iobase", ISAIPMIDevice, iobase,  0),
>> +    DEFINE_PROP_UINT32("irq",   ISAIPMIDevice, isairq,  5),
>> +    DEFINE_PROP_UINT8("slave_addr", ISAIPMIDevice, slave_addr,  0),
>> +    DEFINE_PROP_CHR("chardev",  ISAIPMIDevice, chr),
>> +    DEFINE_PROP_END_OF_LIST(),
>> +};
>> +
>> +#if 0 /* FIXME */
> Fix this? x86 machines should definitely remain migratable.

Yeah, I need to fix that so it works.  I'll definitely get that in 
before the next iteration.

>> +static const VMStateDescription vmstate_isa_ipmi = {
>> +    .name = "isa-ipmi",
>> +    .version_id = 3,
>> +    .minimum_version_id = 3,
>> +    .fields      = (VMStateField[]) {
>> +        /* FIXME - fill this in */
>> +        VMSTATE_END_OF_LIST()
>> +    }
>> +};
>> +#endif
>> +
>> +static void ipmi_isa_class_initfn(ObjectClass *klass, void *data)
>> +{
>> +    DeviceClass *dc = DEVICE_CLASS(klass);
>> +    ISADeviceClass *ic = ISA_DEVICE_CLASS(klass);
>> +    ic->init = ipmi_isa_initfn;
>> +    dc->reset = ipmi_isa_reset;
>> +    /* dc->vmsd = &vmstate_isa_ipmi; FIXME */
>> +    dc->props = ipmi_isa_properties;
>> +}
>> +
>> +static TypeInfo ipmi_isa_info = {
> static const please.
>
>> +    .name          = "isa-ipmi",
> Where is this used? Should probably be TYPE_..., too.

That's what the user specified on the -device line.  Does it need to be 
referenced someplace else?

Thanks,

-corey

[Qemu-devel] [PATCH 13/18] IPMI: Add a KCS low-level interface

[minyard]

From: Corey Minyard <cminyard@mvista.com>

This provides the simulation of the KCS hardware interface.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 default-configs/i386-softmmu.mak   |    1 +
 default-configs/x86_64-softmmu.mak |    1 +
 hw/Makefile.objs                   |    1 +
 hw/ipmi_kcs.c                      |  337 ++++++++++++++++++++++++++++++++++++
 4 files changed, 340 insertions(+), 0 deletions(-)
 create mode 100644 hw/ipmi_kcs.c

diff --git a/default-configs/i386-softmmu.mak b/default-configs/i386-softmmu.mak
index c0aff0d..b549389 100644
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -9,6 +9,7 @@ CONFIG_VMWARE_VGA=y
 CONFIG_VMMOUSE=y
 CONFIG_IPMI=y
 CONFIG_ISA_IPMI=y
+CONFIG_IPMI_KCS=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/default-configs/x86_64-softmmu.mak b/default-configs/x86_64-softmmu.mak
index 615e4f2..af7d2a9 100644
--- a/default-configs/x86_64-softmmu.mak
+++ b/default-configs/x86_64-softmmu.mak
@@ -9,6 +9,7 @@ CONFIG_VMWARE_VGA=y
 CONFIG_VMMOUSE=y
 CONFIG_IPMI=y
 CONFIG_ISA_IPMI=y
+CONFIG_IPMI_KCS=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/hw/Makefile.objs b/hw/Makefile.objs
index 928870b..12cc9a2 100644
--- a/hw/Makefile.objs
+++ b/hw/Makefile.objs
@@ -22,6 +22,7 @@ hw-obj-$(CONFIG_EMPTY_SLOT) += empty_slot.o
 
 hw-obj-$(CONFIG_IPMI) += ipmi.o
 hw-obj-$(CONFIG_ISA_IPMI) += isa_ipmi.o
+hw-obj-$(CONFIG_IPMI_KCS) += ipmi_kcs.o
 
 hw-obj-$(CONFIG_SERIAL) += serial.o
 hw-obj-$(CONFIG_PARALLEL) += parallel.o
diff --git a/hw/ipmi_kcs.c b/hw/ipmi_kcs.c
new file mode 100644
index 0000000..a6a208a
--- /dev/null
+++ b/hw/ipmi_kcs.c
@@ -0,0 +1,337 @@
+/*
+ * QEMU IPMI KCS emulation
+ *
+ * Copyright (c) 2012 Corey Minyard, MontaVista Software, LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw.h"
+#include "ipmi.h"
+
+#define IPMI_KCS_OBF_BIT        0
+#define IPMI_KCS_IBF_BIT        1
+#define IPMI_KCS_SMS_ATN_BIT    2
+#define IPMI_KCS_CD_BIT         3
+
+#define IPMI_KCS_OBF_MASK          (1 << IPMI_KCS_OBF_BIT)
+#define IPMI_KCS_GET_OBF(d)        (((d) >> IPMI_KCS_OBF_BIT) & 0x1)
+#define IPMI_KCS_SET_OBF(d, v)     (d) = (((d) & ~IPMI_KCS_OBF_MASK) | \
+                                       (((v) & 1) << IPMI_KCS_OBF_BIT))
+#define IPMI_KCS_IBF_MASK          (1 << IPMI_KCS_IBF_BIT)
+#define IPMI_KCS_GET_IBF(d)        (((d) >> IPMI_KCS_IBF_BIT) & 0x1)
+#define IPMI_KCS_SET_IBF(d, v)     (d) = (((d) & ~IPMI_KCS_IBF_MASK) | \
+                                       (((v) & 1) << IPMI_KCS_IBF_BIT))
+#define IPMI_KCS_SMS_ATN_MASK      (1 << IPMI_KCS_SMS_ATN_BIT)
+#define IPMI_KCS_GET_SMS_ATN(d)    (((d) >> IPMI_KCS_SMS_ATN_BIT) & 0x1)
+#define IPMI_KCS_SET_SMS_ATN(d, v) (d) = (((d) & ~IPMI_KCS_SMS_ATN_MASK) | \
+                                       (((v) & 1) << IPMI_KCS_SMS_ATN_BIT))
+#define IPMI_KCS_CD_MASK           (1 << IPMI_KCS_CD_BIT)
+#define IPMI_KCS_GET_CD(d)         (((d) >> IPMI_KCS_CD_BIT) & 0x1)
+#define IPMI_KCS_SET_CD(d, v)      (d) = (((d) & ~IPMI_KCS_CD_MASK) | \
+                                       (((v) & 1) << IPMI_KCS_CD_BIT))
+
+#define IPMI_KCS_IDLE_STATE        0
+#define IPMI_KCS_READ_STATE        1
+#define IPMI_KCS_WRITE_STATE       2
+#define IPMI_KCS_ERROR_STATE       3
+
+#define IPMI_KCS_GET_STATE(d)    (((d) >> 6) & 0x3)
+#define IPMI_KCS_SET_STATE(d, v) ((d) = ((d) & ~0xc0) | (((v) & 0x3) << 6))
+
+#define IPMI_KCS_ABORT_STATUS_CMD       0x60
+#define IPMI_KCS_WRITE_START_CMD        0x61
+#define IPMI_KCS_WRITE_END_CMD          0x62
+#define IPMI_KCS_READ_CMD               0x68
+
+#define IPMI_KCS_STATUS_NO_ERR          0x00
+#define IPMI_KCS_STATUS_ABORTED_ERR     0x01
+#define IPMI_KCS_STATUS_BAD_CC_ERR      0x02
+#define IPMI_KCS_STATUS_LENGTH_ERR      0x06
+
+typedef struct IPMIKcsInterface {
+    IPMIInterface intf;
+
+    uint8_t status_reg;
+    uint8_t data_out_reg;
+
+    int data_in_reg; /* -1 means not written */
+    int cmd_reg;
+
+    /*
+     * This is a response number that we send with the command to make
+     * sure that the response matches the command.
+     */
+    uint8_t waiting_rsp;
+} IPMIKcsInterface;
+
+#define SET_OBF() \
+    do {                                                                      \
+        IPMI_KCS_SET_OBF(kcs->status_reg, 1);                                 \
+        if (s->use_irq && s->irqs_enabled && !s->obf_irq_set) {               \
+            s->obf_irq_set = 1;                                               \
+            if (!s->atn_irq_set) {                                            \
+                qemu_irq_raise(s->irq);                                       \
+            }                                                                 \
+        }                                                                     \
+    } while (0)
+
+static void ipmi_kcs_handle_event(IPMIInterface *s)
+{
+    IPMIKcsInterface *kcs = DO_UPCAST(IPMIKcsInterface, intf, s);
+
+    if (kcs->cmd_reg == IPMI_KCS_ABORT_STATUS_CMD) {
+        if (IPMI_KCS_GET_STATE(kcs->status_reg) != IPMI_KCS_ERROR_STATE) {
+            kcs->waiting_rsp++; /* Invalidate the message */
+            s->outmsg[0] = IPMI_KCS_STATUS_ABORTED_ERR;
+            s->outlen = 1;
+            s->outpos = 0;
+            IPMI_KCS_SET_STATE(kcs->status_reg, IPMI_KCS_ERROR_STATE);
+            SET_OBF();
+        }
+        goto out;
+    }
+
+    switch (IPMI_KCS_GET_STATE(kcs->status_reg)) {
+    case IPMI_KCS_IDLE_STATE:
+        if (kcs->cmd_reg == IPMI_KCS_WRITE_START_CMD) {
+            IPMI_KCS_SET_STATE(kcs->status_reg, IPMI_KCS_WRITE_STATE);
+            kcs->cmd_reg = -1;
+            s->write_end = 0;
+            s->inlen = 0;
+            SET_OBF();
+        }
+        break;
+
+    case IPMI_KCS_READ_STATE:
+    handle_read:
+        if (s->outpos >= s->outlen) {
+            IPMI_KCS_SET_STATE(kcs->status_reg, IPMI_KCS_IDLE_STATE);
+            SET_OBF();
+        } else if (kcs->data_in_reg == IPMI_KCS_READ_CMD) {
+            kcs->data_out_reg = s->outmsg[s->outpos];
+            s->outpos++;
+            SET_OBF();
+        } else {
+            s->outmsg[0] = IPMI_KCS_STATUS_BAD_CC_ERR;
+            s->outlen = 1;
+            s->outpos = 0;
+            IPMI_KCS_SET_STATE(kcs->status_reg, IPMI_KCS_ERROR_STATE);
+            SET_OBF();
+            goto out;
+        }
+        break;
+
+    case IPMI_KCS_WRITE_STATE:
+        if (kcs->data_in_reg != -1) {
+            /*
+             * Don't worry about input overrun here, that will be
+             * handled in the BMC.
+             */
+            if (s->inlen < sizeof(s->inmsg)) {
+                s->inmsg[s->inlen] = kcs->data_in_reg;
+            }
+            s->inlen++;
+        }
+        if (s->write_end) {
+            IPMIBmcClass *bk = IPMI_BMC_GET_CLASS(s->bmc);
+            s->outlen = 0;
+            s->write_end = 0;
+            s->outpos = 0;
+            bk->handle_command(s->bmc, s->inmsg, s->inlen, sizeof(s->inmsg),
+                               kcs->waiting_rsp);
+            goto out_noibf;
+        } else if (kcs->cmd_reg == IPMI_KCS_WRITE_END_CMD) {
+            kcs->cmd_reg = -1;
+            s->write_end = 1;
+        }
+        SET_OBF();
+        break;
+
+    case IPMI_KCS_ERROR_STATE:
+        if (kcs->data_in_reg != -1) {
+            IPMI_KCS_SET_STATE(kcs->status_reg, IPMI_KCS_READ_STATE);
+            kcs->data_in_reg = IPMI_KCS_READ_CMD;
+            goto handle_read;
+        }
+        break;
+    }
+
+    if (kcs->cmd_reg != -1) {
+        /* Got an invalid command */
+        s->outmsg[0] = IPMI_KCS_STATUS_BAD_CC_ERR;
+        s->outlen = 1;
+        s->outpos = 0;
+        IPMI_KCS_SET_STATE(kcs->status_reg, IPMI_KCS_ERROR_STATE);
+    }
+
+ out:
+    kcs->cmd_reg = -1;
+    kcs->data_in_reg = -1;
+    IPMI_KCS_SET_IBF(kcs->status_reg, 0);
+ out_noibf:
+    return;
+}
+
+static void ipmi_kcs_handle_rsp(IPMIInterface *s, uint8_t msg_id,
+                                unsigned char *rsp, unsigned int rsp_len)
+{
+    IPMIKcsInterface *kcs = DO_UPCAST(IPMIKcsInterface, intf, s);
+
+    /* ipmi_lock is already claimed. */
+    if (kcs->waiting_rsp == msg_id) {
+        kcs->waiting_rsp++;
+        if (rsp_len > sizeof(s->outmsg)) {
+            s->outmsg[0] = rsp[0];
+            s->outmsg[1] = rsp[1];
+            s->outmsg[2] = IPMI_CC_CANNOT_RETURN_REQ_NUM_BYTES;
+            s->outlen = 3;
+        } else {
+            memcpy(s->outmsg, rsp, rsp_len);
+            s->outlen = rsp_len;
+        }
+        IPMI_KCS_SET_STATE(kcs->status_reg, IPMI_KCS_READ_STATE);
+        kcs->data_in_reg = IPMI_KCS_READ_CMD;
+        ipmi_signal(&kcs->intf);
+    }
+}
+
+
+static uint32_t ipmi_kcs_ioport_read(void *opaque, uint32_t addr)
+{
+    IPMIKcsInterface *kcs = opaque;
+    uint32_t ret;
+
+    ipmi_lock(&kcs->intf);
+    switch (addr & 1) {
+    case 0:
+        ret = kcs->data_out_reg;
+        IPMI_KCS_SET_OBF(kcs->status_reg, 0);
+        if (kcs->intf.obf_irq_set) {
+            kcs->intf.obf_irq_set = 0;
+            if (!kcs->intf.atn_irq_set) {
+                qemu_irq_lower(kcs->intf.irq);
+            }
+        }
+        break;
+    case 1:
+        ret = kcs->status_reg;
+        if (kcs->intf.atn_irq_set) {
+            kcs->intf.atn_irq_set = 0;
+            if (!kcs->intf.obf_irq_set) {
+                qemu_irq_lower(kcs->intf.irq);
+            }
+        }
+        break;
+    }
+    ipmi_unlock(&kcs->intf);
+    return ret;
+}
+
+static void ipmi_kcs_ioport_write(void *opaque, uint32_t addr, uint32_t val)
+{
+    IPMIKcsInterface *kcs = opaque;
+    IPMIInterface *s = &kcs->intf;
+
+    if (IPMI_KCS_GET_IBF(kcs->status_reg)) {
+        return;
+    }
+
+    ipmi_lock(s);
+    switch (addr & 1) {
+    case 0:
+        kcs->data_in_reg = val;
+        break;
+
+    case 1:
+        kcs->cmd_reg = val;
+        break;
+    }
+    IPMI_KCS_SET_IBF(kcs->status_reg, 1);
+    ipmi_signal(s);
+    ipmi_unlock(s);
+}
+
+static const MemoryRegionPortio ipmi_kcs_portio[] = {
+    { 0, 2, 1, .read = ipmi_kcs_ioport_read, .write = ipmi_kcs_ioport_write },
+    PORTIO_END_OF_LIST()
+};
+
+static const MemoryRegionOps ipmi_kcs_io_ops = {
+    .old_portio = ipmi_kcs_portio
+};
+
+static void ipmi_kcs_set_atn(IPMIInterface *s, int val, int irq)
+{
+    IPMIKcsInterface *kcs = DO_UPCAST(IPMIKcsInterface, intf, s);
+
+    IPMI_KCS_SET_SMS_ATN(kcs->status_reg, val);
+    if (val) {
+        if (irq && !s->atn_irq_set && s->use_irq && s->irqs_enabled) {
+            s->atn_irq_set = 1;
+            if (!s->obf_irq_set) {
+                qemu_irq_raise(s->irq);
+            }
+        }
+    } else {
+        if (s->atn_irq_set) {
+            s->atn_irq_set = 0;
+            if (!s->obf_irq_set) {
+                qemu_irq_lower(s->irq);
+            }
+        }
+    }
+}
+
+static int ipmi_kcs_init(IPMIInterface *s)
+{
+    if (!s->io_base) {
+        s->io_base = 0xca0;
+    }
+    s->io_length = 2;
+
+    memory_region_init_io(&s->io, &ipmi_kcs_io_ops,
+                          DO_UPCAST(IPMIKcsInterface, intf, s), "ipmi-kcs", 2);
+
+    return 0;
+}
+
+static void ipmi_kcs_class_init(ObjectClass *class, void *data)
+{
+    IPMIInterfaceClass *k = IPMI_INTERFACE_CLASS(class);
+
+    k->init = ipmi_kcs_init;
+    k->smbios_type = IPMI_SMBIOS_KCS;
+    k->set_atn = ipmi_kcs_set_atn;
+    k->handle_rsp = ipmi_kcs_handle_rsp;
+    k->handle_if_event = ipmi_kcs_handle_event;
+}
+
+static TypeInfo ipmi_kcs_type = {
+    .name          = "ipmi-interface-kcs",
+    .parent        = TYPE_IPMI_INTERFACE,
+    .instance_size = sizeof(IPMIKcsInterface),
+    .class_init    = ipmi_kcs_class_init,
+};
+
+static void ipmi_kcs_register_types(void)
+{
+    type_register_static(&ipmi_kcs_type);
+}
+
+type_init(ipmi_kcs_register_types)
-- 
1.7.4.1

[Qemu-devel] [PATCH 14/18] IPMI: Add a BT low-level interface

[minyard]

From: Corey Minyard <cminyard@mvista.com>

This provides the simulation of the BT hardware interface for
IPMI.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 default-configs/i386-softmmu.mak   |    1 +
 default-configs/x86_64-softmmu.mak |    1 +
 hw/Makefile.objs                   |    1 +
 hw/ipmi_bt.c                       |  360 ++++++++++++++++++++++++++++++++++++
 4 files changed, 363 insertions(+), 0 deletions(-)
 create mode 100644 hw/ipmi_bt.c

diff --git a/default-configs/i386-softmmu.mak b/default-configs/i386-softmmu.mak
index b549389..f8f8e6d 100644
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -10,6 +10,7 @@ CONFIG_VMMOUSE=y
 CONFIG_IPMI=y
 CONFIG_ISA_IPMI=y
 CONFIG_IPMI_KCS=y
+CONFIG_IPMI_BT=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/default-configs/x86_64-softmmu.mak b/default-configs/x86_64-softmmu.mak
index af7d2a9..8c1177d 100644
--- a/default-configs/x86_64-softmmu.mak
+++ b/default-configs/x86_64-softmmu.mak
@@ -10,6 +10,7 @@ CONFIG_VMMOUSE=y
 CONFIG_IPMI=y
 CONFIG_ISA_IPMI=y
 CONFIG_IPMI_KCS=y
+CONFIG_IPMI_BT=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/hw/Makefile.objs b/hw/Makefile.objs
index 12cc9a2..c6f54fb 100644
--- a/hw/Makefile.objs
+++ b/hw/Makefile.objs
@@ -23,6 +23,7 @@ hw-obj-$(CONFIG_EMPTY_SLOT) += empty_slot.o
 hw-obj-$(CONFIG_IPMI) += ipmi.o
 hw-obj-$(CONFIG_ISA_IPMI) += isa_ipmi.o
 hw-obj-$(CONFIG_IPMI_KCS) += ipmi_kcs.o
+hw-obj-$(CONFIG_IPMI_BT) += ipmi_bt.o
 
 hw-obj-$(CONFIG_SERIAL) += serial.o
 hw-obj-$(CONFIG_PARALLEL) += parallel.o
diff --git a/hw/ipmi_bt.c b/hw/ipmi_bt.c
new file mode 100644
index 0000000..530d2ae
--- /dev/null
+++ b/hw/ipmi_bt.c
@@ -0,0 +1,360 @@
+/*
+ * QEMU IPMI BT emulation
+ *
+ * Copyright (c) 2012 Corey Minyard, MontaVista Software, LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "hw.h"
+
+#include "ipmi.h"
+
+/* Control register */
+#define IPMI_BT_CLR_WR_BIT        0
+#define IPMI_BT_CLR_RD_BIT        1
+#define IPMI_BT_H2B_ATN_BIT        2
+#define IPMI_BT_B2H_ATN_BIT        3
+#define IPMI_BT_SMS_ATN_BIT        4
+#define IPMI_BT_HBUSY_BIT        6
+#define IPMI_BT_BBUSY_BIT        7
+
+#define IPMI_BT_CLR_WR_MASK        (1 << IPMI_BT_CLR_WR_BIT)
+#define IPMI_BT_GET_CLR_WR(d)      (((d) >> IPMI_BT_CLR_WR_BIT) & 0x1)
+#define IPMI_BT_SET_CLR_WR(d, v)   (d) = (((d) & ~IPMI_BT_CLR_WR_MASK) | \
+                                       (((v & 1) << IPMI_BT_CLR_WR_BIT)))
+
+#define IPMI_BT_CLR_RD_MASK        (1 << IPMI_BT_CLR_RD_BIT)
+#define IPMI_BT_GET_CLR_RD(d)      (((d) >> IPMI_BT_CLR_RD_BIT) & 0x1)
+#define IPMI_BT_SET_CLR_RD(d, v)   (d) = (((d) & ~IPMI_BT_CLR_RD_MASK) | \
+                                       (((v & 1) << IPMI_BT_CLR_RD_BIT)))
+
+#define IPMI_BT_H2B_ATN_MASK       (1 << IPMI_BT_H2B_ATN_BIT)
+#define IPMI_BT_GET_H2B_ATN(d)     (((d) >> IPMI_BT_H2B_ATN_BIT) & 0x1)
+#define IPMI_BT_SET_H2B_ATN(d, v)  (d) = (((d) & ~IPMI_BT_H2B_ATN_MASK) | \
+                                        (((v & 1) << IPMI_BT_H2B_ATN_BIT)))
+
+#define IPMI_BT_B2H_ATN_MASK       (1 << IPMI_BT_B2H_ATN_BIT)
+#define IPMI_BT_GET_B2H_ATN(d)     (((d) >> IPMI_BT_B2H_ATN_BIT) & 0x1)
+#define IPMI_BT_SET_B2H_ATN(d, v)  (d) = (((d) & ~IPMI_BT_B2H_ATN_MASK) | \
+                                        (((v & 1) << IPMI_BT_B2H_ATN_BIT)))
+
+#define IPMI_BT_SMS_ATN_MASK       (1 << IPMI_BT_SMS_ATN_BIT)
+#define IPMI_BT_GET_SMS_ATN(d)     (((d) >> IPMI_BT_SMS_ATN_BIT) & 0x1)
+#define IPMI_BT_SET_SMS_ATN(d, v)  (d) = (((d) & ~IPMI_BT_SMS_ATN_MASK) | \
+                                        (((v & 1) << IPMI_BT_SMS_ATN_BIT)))
+
+#define IPMI_BT_HBUSY_MASK         (1 << IPMI_BT_HBUSY_BIT)
+#define IPMI_BT_GET_HBUSY(d)       (((d) >> IPMI_BT_HBUSY_BIT) & 0x1)
+#define IPMI_BT_SET_HBUSY(d, v)    (d) = (((d) & ~IPMI_BT_HBUSY_MASK) | \
+                                       (((v & 1) << IPMI_BT_HBUSY_BIT)))
+
+#define IPMI_BT_BBUSY_MASK         (1 << IPMI_BT_BBUSY_BIT)
+#define IPMI_BT_GET_BBUSY(d)       (((d) >> IPMI_BT_BBUSY_BIT) & 0x1)
+#define IPMI_BT_SET_BBUSY(d, v)    (d) = (((d) & ~IPMI_BT_BBUSY_MASK) | \
+                                       (((v & 1) << IPMI_BT_BBUSY_BIT)))
+
+
+/* Mask register */
+#define IPMI_BT_B2H_IRQ_EN_BIT     0
+#define IPMI_BT_B2H_IRQ_BIT        1
+
+#define IPMI_BT_B2H_IRQ_EN_MASK      (1 << IPMI_BT_B2H_IRQ_EN_BIT)
+#define IPMI_BT_GET_B2H_IRQ_EN(d)    (((d) >> IPMI_BT_B2H_IRQ_EN_BIT) & 0x1)
+#define IPMI_BT_SET_B2H_IRQ_EN(d, v) (d) = (((d) & ~IPMI_BT_B2H_IRQ_EN_MASK) | \
+                                        (((v & 1) << IPMI_BT_B2H_IRQ_EN_BIT)))
+
+#define IPMI_BT_B2H_IRQ_MASK         (1 << IPMI_BT_B2H_IRQ_BIT)
+#define IPMI_BT_GET_B2H_IRQ(d)       (((d) >> IPMI_BT_B2H_IRQ_BIT) & 0x1)
+#define IPMI_BT_SET_B2H_IRQ(d, v)    (d) = (((d) & ~IPMI_BT_B2H_IRQ_MASK) | \
+                                        (((v & 1) << IPMI_BT_B2H_IRQ_BIT)))
+
+typedef struct IPMIBtInterface {
+    IPMIInterface intf;
+    uint8_t control_reg;
+    uint8_t mask_reg;
+
+    /*
+     * This is a response number that we send with the command to make
+     * sure that the response matches the command.
+     */
+    uint8_t waiting_rsp;
+    uint8_t waiting_seq;
+} IPMIBtInterface;
+
+#define IPMI_CMD_GET_BT_INTF_CAP        0x36
+
+static void ipmi_bt_handle_event(IPMIInterface *s)
+{
+    IPMIBtInterface *bt = DO_UPCAST(IPMIBtInterface, intf, s);
+
+    ipmi_lock(s);
+    if (s->inlen < 4) {
+        goto out;
+    }
+    /* Note that overruns are handled by handle_command */
+    if (s->inmsg[0] != (s->inlen - 1)) {
+        /* Length mismatch, just ignore. */
+        IPMI_BT_SET_BBUSY(bt->control_reg, 1);
+        s->inlen = 0;
+        goto out;
+    }
+    if ((s->inmsg[1] == (IPMI_NETFN_APP << 2)) &&
+                        (s->inmsg[3] == IPMI_CMD_GET_BT_INTF_CAP)) {
+        /* We handle this one ourselves. */
+        s->outmsg[0] = 9;
+        s->outmsg[1] = s->inmsg[1] | 0x04;
+        s->outmsg[2] = s->inmsg[2];
+        s->outmsg[3] = s->inmsg[3];
+        s->outmsg[4] = 0;
+        s->outmsg[5] = 1; /* Only support 1 outstanding request. */
+        if (sizeof(s->inmsg) > 0xff) { /* Input buffer size */
+            s->outmsg[6] = 0xff;
+        } else {
+            s->outmsg[6] = (unsigned char) sizeof(s->inmsg);
+        }
+        if (sizeof(s->outmsg) > 0xff) { /* Output buffer size */
+            s->outmsg[7] = 0xff;
+        } else {
+            s->outmsg[7] = (unsigned char) sizeof(s->outmsg);
+        }
+        s->outmsg[8] = 10; /* Max request to response time */
+        s->outmsg[9] = 0; /* Don't recommend retries */
+        s->outlen = 10;
+        IPMI_BT_SET_BBUSY(bt->control_reg, 0);
+        IPMI_BT_SET_B2H_ATN(bt->control_reg, 1);
+        if (s->use_irq && s->irqs_enabled &&
+                !IPMI_BT_GET_B2H_IRQ(bt->mask_reg) &&
+                IPMI_BT_GET_B2H_IRQ_EN(bt->mask_reg)) {
+            IPMI_BT_SET_B2H_IRQ(bt->mask_reg, 1);
+            qemu_irq_raise(s->irq);
+        }
+        goto out;
+    }
+    bt->waiting_seq = s->inmsg[2];
+    s->inmsg[2] = s->inmsg[1];
+    {
+        IPMIBmcClass *bk = IPMI_BMC_GET_CLASS(s->bmc);
+        bk->handle_command(s->bmc, s->inmsg + 2, s->inlen - 2, sizeof(s->inmsg),
+                           bt->waiting_rsp);
+    }
+ out:
+    ipmi_unlock(s);
+}
+
+static void ipmi_bt_handle_rsp(IPMIInterface *s, uint8_t msg_id,
+                                unsigned char *rsp, unsigned int rsp_len)
+{
+    IPMIBtInterface *bt = DO_UPCAST(IPMIBtInterface, intf, s);
+
+    /* ipmi_lock is already claimed. */
+    if (bt->waiting_rsp == msg_id) {
+        bt->waiting_rsp++;
+        if (rsp_len > (sizeof(s->outmsg) - 2)) {
+            s->outmsg[0] = 4;
+            s->outmsg[1] = rsp[0];
+            s->outmsg[2] = bt->waiting_seq;
+            s->outmsg[3] = rsp[1];
+            s->outmsg[4] = IPMI_CC_CANNOT_RETURN_REQ_NUM_BYTES;
+            s->outlen = 5;
+        } else {
+            s->outmsg[0] = rsp_len + 1;
+            s->outmsg[1] = rsp[0];
+            s->outmsg[2] = bt->waiting_seq;
+            memcpy(s->outmsg + 3, rsp + 1, rsp_len - 1);
+            s->outlen = rsp_len + 2;
+        }
+        IPMI_BT_SET_BBUSY(bt->control_reg, 0);
+        IPMI_BT_SET_B2H_ATN(bt->control_reg, 1);
+        if (s->use_irq && s->irqs_enabled &&
+                !IPMI_BT_GET_B2H_IRQ(bt->mask_reg) &&
+                IPMI_BT_GET_B2H_IRQ_EN(bt->mask_reg)) {
+            IPMI_BT_SET_B2H_IRQ(bt->mask_reg, 1);
+            qemu_irq_raise(s->irq);
+        }
+    }
+}
+
+
+static uint32_t ipmi_bt_ioport_read(void *opaque, uint32_t addr)
+{
+    IPMIBtInterface *bt = opaque;
+    IPMIInterface *s = &bt->intf;
+    uint32_t ret = 0xff;
+
+    ipmi_lock(s);
+    switch (addr & 3) {
+    case 0:
+        ret = bt->control_reg;
+        break;
+    case 1:
+        if (s->outpos < s->outlen) {
+            ret = s->outmsg[s->outpos];
+            s->outpos++;
+            if (s->outpos == s->outlen) {
+                s->outpos = 0;
+                s->outlen = 0;
+            }
+        } else {
+            ret = 0xff;
+        }
+        break;
+    case 2:
+        ret = bt->mask_reg;
+        break;
+    }
+    ipmi_unlock(s);
+    return ret;
+}
+
+static void ipmi_bt_ioport_write(void *opaque, uint32_t addr, uint32_t val)
+{
+    IPMIBtInterface *bt = opaque;
+    IPMIInterface *s = &bt->intf;
+
+    ipmi_lock(s);
+    switch (addr & 3) {
+    case 0:
+        if (IPMI_BT_GET_CLR_WR(val)) {
+            s->inlen = 0;
+        }
+        if (IPMI_BT_GET_CLR_RD(val)) {
+            s->outpos = 0;
+        }
+        if (IPMI_BT_GET_B2H_ATN(val)) {
+            IPMI_BT_SET_B2H_ATN(bt->control_reg, 0);
+        }
+        if (IPMI_BT_GET_SMS_ATN(val)) {
+            IPMI_BT_SET_SMS_ATN(bt->control_reg, 0);
+        }
+        if (IPMI_BT_GET_HBUSY(val)) {
+            /* Toggle */
+            IPMI_BT_SET_HBUSY(bt->control_reg,
+                              !IPMI_BT_GET_HBUSY(bt->control_reg));
+        }
+        if (IPMI_BT_GET_H2B_ATN(val)) {
+            IPMI_BT_SET_BBUSY(bt->control_reg, 1);
+            ipmi_signal(s);
+        }
+        break;
+
+    case 1:
+        if (s->inlen < sizeof(s->inmsg)) {
+            s->inmsg[s->inlen] = val;
+        }
+        s->inlen++;
+        break;
+
+    case 2:
+        if (IPMI_BT_GET_B2H_IRQ_EN(val) !=
+                        IPMI_BT_GET_B2H_IRQ_EN(bt->mask_reg)) {
+            if (IPMI_BT_GET_B2H_IRQ_EN(val)) {
+                if (IPMI_BT_GET_B2H_ATN(bt->control_reg) ||
+                        IPMI_BT_GET_SMS_ATN(bt->control_reg)) {
+                    IPMI_BT_SET_B2H_IRQ(bt->mask_reg, 1);
+                    qemu_irq_raise(s->irq);
+                }
+                IPMI_BT_SET_B2H_IRQ_EN(bt->mask_reg, 1);
+            } else {
+                if (IPMI_BT_GET_B2H_IRQ(bt->mask_reg)) {
+                    IPMI_BT_SET_B2H_IRQ(bt->mask_reg, 0);
+                    qemu_irq_lower(s->irq);
+                }
+                IPMI_BT_SET_B2H_IRQ_EN(bt->mask_reg, 0);
+            }
+        }
+        if (IPMI_BT_GET_B2H_IRQ(val) && IPMI_BT_GET_B2H_IRQ(bt->mask_reg)) {
+            IPMI_BT_SET_B2H_IRQ(bt->mask_reg, 0);
+            qemu_irq_lower(s->irq);
+        }
+        break;
+    }
+    ipmi_unlock(s);
+}
+
+static const MemoryRegionPortio ipmi_bt_portio[] = {
+    { 0, 3, 1, .read = ipmi_bt_ioport_read, .write = ipmi_bt_ioport_write },
+    PORTIO_END_OF_LIST()
+};
+
+static const MemoryRegionOps ipmi_bt_io_ops = {
+    .old_portio = ipmi_bt_portio
+};
+
+static void ipmi_bt_set_atn(IPMIInterface *s, int val, int irq)
+{
+    IPMIBtInterface *bt = DO_UPCAST(IPMIBtInterface, intf, s);
+
+    if (!!val == IPMI_BT_GET_SMS_ATN(bt->control_reg)) {
+        return;
+    }
+
+    IPMI_BT_SET_SMS_ATN(bt->control_reg, val);
+    if (val) {
+        if (irq && s->use_irq && s->irqs_enabled &&
+                !IPMI_BT_GET_B2H_ATN(bt->control_reg) &&
+                IPMI_BT_GET_B2H_IRQ_EN(bt->mask_reg)) {
+            IPMI_BT_SET_B2H_IRQ(bt->mask_reg, 1);
+            qemu_irq_raise(s->irq);
+        }
+    } else {
+        if (!IPMI_BT_GET_B2H_ATN(bt->control_reg) &&
+                IPMI_BT_GET_B2H_IRQ(bt->mask_reg)) {
+            IPMI_BT_SET_B2H_IRQ(bt->mask_reg, 0);
+            qemu_irq_lower(s->irq);
+        }
+    }
+}
+
+static int ipmi_bt_init(IPMIInterface *s)
+{
+    if (!s->io_base) {
+        s->io_base = 0xe4;
+    }
+    s->io_length = 3;
+
+    memory_region_init_io(&s->io, &ipmi_bt_io_ops,
+                          DO_UPCAST(IPMIBtInterface, intf, s), "ipmi-bt", 3);
+
+    return 0;
+}
+
+static void ipmi_bt_class_init(ObjectClass *klass, void *data)
+{
+    IPMIInterfaceClass *k = IPMI_INTERFACE_CLASS(klass);
+
+    k->init = ipmi_bt_init;
+    k->smbios_type = IPMI_SMBIOS_BT;
+    k->set_atn = ipmi_bt_set_atn;
+    k->handle_rsp = ipmi_bt_handle_rsp;
+    k->handle_if_event = ipmi_bt_handle_event;
+}
+
+static TypeInfo ipmi_bt_type = {
+    .name          = "ipmi-interface-bt",
+    .parent        = TYPE_IPMI_INTERFACE,
+    .instance_size = sizeof(IPMIBtInterface),
+    .class_init    = ipmi_bt_class_init,
+};
+
+static void ipmi_bt_register_types(void)
+{
+    type_register_static(&ipmi_bt_type);
+}
+
+type_init(ipmi_bt_register_types)
-- 
1.7.4.1

[Qemu-devel] [PATCH 15/18] IPMI: Add a local BMC simulation

[minyard]

From: Corey Minyard <cminyard@mvista.com>

This provides a minimal local BMC, basically enough to comply with the
spec and provide a complete watchdog timer (including a sensor, SDR,
and event).

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 default-configs/i386-softmmu.mak   |    1 +
 default-configs/x86_64-softmmu.mak |    1 +
 hw/Makefile.objs                   |    1 +
 hw/ipmi_sim.c                      | 1547 ++++++++++++++++++++++++++++++++++++
 4 files changed, 1550 insertions(+), 0 deletions(-)
 create mode 100644 hw/ipmi_sim.c

diff --git a/default-configs/i386-softmmu.mak b/default-configs/i386-softmmu.mak
index f8f8e6d..8c99d5d 100644
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -11,6 +11,7 @@ CONFIG_IPMI=y
 CONFIG_ISA_IPMI=y
 CONFIG_IPMI_KCS=y
 CONFIG_IPMI_BT=y
+CONFIG_IPMI_LOCAL=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/default-configs/x86_64-softmmu.mak b/default-configs/x86_64-softmmu.mak
index 8c1177d..4d01883 100644
--- a/default-configs/x86_64-softmmu.mak
+++ b/default-configs/x86_64-softmmu.mak
@@ -11,6 +11,7 @@ CONFIG_IPMI=y
 CONFIG_ISA_IPMI=y
 CONFIG_IPMI_KCS=y
 CONFIG_IPMI_BT=y
+CONFIG_IPMI_LOCAL=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/hw/Makefile.objs b/hw/Makefile.objs
index c6f54fb..1b707d7 100644
--- a/hw/Makefile.objs
+++ b/hw/Makefile.objs
@@ -24,6 +24,7 @@ hw-obj-$(CONFIG_IPMI) += ipmi.o
 hw-obj-$(CONFIG_ISA_IPMI) += isa_ipmi.o
 hw-obj-$(CONFIG_IPMI_KCS) += ipmi_kcs.o
 hw-obj-$(CONFIG_IPMI_BT) += ipmi_bt.o
+hw-obj-$(CONFIG_IPMI_LOCAL) += ipmi_sim.o
 
 hw-obj-$(CONFIG_SERIAL) += serial.o
 hw-obj-$(CONFIG_PARALLEL) += parallel.o
diff --git a/hw/ipmi_sim.c b/hw/ipmi_sim.c
new file mode 100644
index 0000000..480d93c
--- /dev/null
+++ b/hw/ipmi_sim.c
@@ -0,0 +1,1547 @@
+/*
+ * IPMI BMC emulation
+ *
+ * Copyright (c) 2012 Corey Minyard, MontaVista Software, LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdint.h>
+#include "qemu-timer.h"
+#include "ipmi.h"
+
+#define IPMI_NETFN_CHASSIS        0x00
+#define IPMI_NETFN_CHASSIS_MAXCMD        0x03
+
+#define IPMI_CMD_GET_CHASSIS_CAPABILITIES        0x00
+#define IPMI_CMD_GET_CHASSIS_STATUS                0x01
+#define IPMI_CMD_CHASSIS_CONTROL                0x02
+
+#define IPMI_NETFN_SENSOR_EVENT        0x04
+#define IPMI_NETFN_SENSOR_EVENT_MAXCMD        0x2e
+
+#define IPMI_CMD_SET_SENSOR_EVT_ENABLE        0x28
+#define IPMI_CMD_GET_SENSOR_EVT_ENABLE        0x29
+#define IPMI_CMD_REARM_SENSOR_EVTS        0x2a
+#define IPMI_CMD_GET_SENSOR_EVT_STATUS        0x2b
+#define IPMI_CMD_GET_SENSOR_READING        0x2d
+
+/* #define IPMI_NETFN_APP                0x06 In ipmi.h */
+#define IPMI_NETFN_APP_MAXCMD                0x36
+
+#define IPMI_CMD_GET_DEVICE_ID                0x01
+#define IPMI_CMD_RESET_WATCHDOG_TIMER        0x22
+#define IPMI_CMD_SET_WATCHDOG_TIMER        0x24
+#define IPMI_CMD_GET_WATCHDOG_TIMER        0x25
+#define IPMI_CMD_SET_BMC_GLOBAL_ENABLES        0x2e
+#define IPMI_CMD_GET_BMC_GLOBAL_ENABLES        0x2f
+#define IPMI_CMD_CLR_MSG_FLAGS                0x30
+#define IPMI_CMD_GET_MSG_FLAGS                0x31
+#define IPMI_CMD_READ_EVT_MSG_BUF        0x35
+
+#define IPMI_NETFN_STORAGE        0x0a
+#define IPMI_NETFN_STORAGE_MAXCMD        0x4a
+
+#define IPMI_CMD_GET_SDR_REP_INFO        0x20
+#define IPMI_CMD_GET_SDR_REP_ALLOC_INFO        0x21
+#define IPMI_CMD_RESERVE_SDR_REP        0x22
+#define IPMI_CMD_GET_SDR                0x23
+#define IPMI_CMD_ADD_SDR                0x24
+#define IPMI_CMD_PARTIAL_ADD_SDR        0x25
+#define IPMI_CMD_DELETE_SDR                0x26
+#define IPMI_CMD_CLEAR_SDR_REP                0x27
+#define IPMI_CMD_GET_SDR_REP_TIME        0x28
+#define IPMI_CMD_SET_SDR_REP_TIME        0x29
+#define IPMI_CMD_ENTER_SDR_REP_UPD_MODE        0x2A
+#define IPMI_CMD_EXIT_SDR_REP_UPD_MODE        0x2B
+#define IPMI_CMD_RUN_INIT_AGENT                0x2C
+#define IPMI_CMD_GET_SEL_INFO                0x40
+#define IPMI_CMD_GET_SEL_ALLOC_INFO        0x41
+#define IPMI_CMD_RESERVE_SEL                0x42
+#define IPMI_CMD_GET_SEL_ENTRY                0x43
+#define IPMI_CMD_ADD_SEL_ENTRY                0x44
+#define IPMI_CMD_PARTIAL_ADD_SEL_ENTRY        0x45
+#define IPMI_CMD_DELETE_SEL_ENTRY        0x46
+#define IPMI_CMD_CLEAR_SEL                0x47
+#define IPMI_CMD_GET_SEL_TIME                0x48
+#define IPMI_CMD_SET_SEL_TIME                0x49
+
+
+/* Same as a timespec struct. */
+struct ipmi_time {
+    long tv_sec;
+    long tv_nsec;
+};
+
+#define MAX_SEL_SIZE 128
+
+typedef struct IPMISel {
+    uint8_t sel[MAX_SEL_SIZE][16];
+    unsigned int next_free;
+    long time_offset;
+    uint16_t reservation;
+    uint8_t last_addition[4];
+    uint8_t last_clear[4];
+    uint8_t overflow;
+} IPMISel;
+
+#define MAX_SDR_SIZE 16384
+
+typedef struct IPMISdr {
+    uint8_t sdr[MAX_SDR_SIZE];
+    unsigned int next_free;
+    uint16_t next_rec_id;
+    uint16_t reservation;
+    uint8_t last_addition[4];
+    uint8_t last_clear[4];
+    uint8_t overflow;
+} IPMISdr;
+
+typedef struct IPMISensor {
+    uint8_t status;
+    uint8_t reading;
+    uint16_t states_suppt;
+    uint16_t assert_suppt;
+    uint16_t deassert_suppt;
+    uint16_t states;
+    uint16_t assert_states;
+    uint16_t deassert_states;
+    uint16_t assert_enable;
+    uint16_t deassert_enable;
+    uint8_t  sensor_type;
+    uint8_t  evt_reading_type_code;
+} IPMISensor;
+#define IPMI_SENSOR_GET_PRESENT(s)       ((s)->status & 0x01)
+#define IPMI_SENSOR_SET_PRESENT(s, v)    ((s)->status = (s->status & ~0x01) | \
+                                             !!(v))
+#define IPMI_SENSOR_GET_SCAN_ON(s)       ((s)->status & 0x40)
+#define IPMI_SENSOR_SET_SCAN_ON(s, v)    ((s)->status = (s->status & ~0x40) | \
+                                             ((!!(v)) << 6))
+#define IPMI_SENSOR_GET_EVENTS_ON(s)     ((s)->status & 0x80)
+#define IPMI_SENSOR_SET_EVENTS_ON(s, v)  ((s)->status = (s->status & ~0x80) | \
+                                             ((!!(v)) << 7))
+#define IPMI_SENSOR_GET_RET_STATUS(s)    ((s)->status & 0xc0)
+#define IPMI_SENSOR_SET_RET_STATUS(s, v) ((s)->status = (s->status & ~0xc0) | \
+                                             (v & 0xc0))
+#define IPMI_SENSOR_IS_DISCRETE(s) ((s)->evt_reading_type_code != 1)
+
+#define MAX_SENSORS 20
+#define IPMI_WATCHDOG_SENSOR 0
+
+typedef struct IPMISimBmc IPMISimBmc;
+
+#define MAX_NETFNS 64
+typedef void (*IPMICmdHandler)(IPMISimBmc *s,
+                               uint8_t *cmd, unsigned int cmd_len,
+                               uint8_t *rsp, unsigned int *rsp_len,
+                               unsigned int max_rsp_len);
+typedef struct IPMINetfn {
+    unsigned int cmd_nums;
+    IPMICmdHandler *cmd_handlers;
+} IPMINetfn;
+
+struct IPMISimBmc {
+    IPMIBmc parent;
+
+    QEMUTimer *timer;
+
+    uint8_t bmc_global_enables;
+    uint8_t msg_flags;
+
+    int8_t   watchdog_initialized;
+    uint8_t  watchdog_use;
+    uint8_t  watchdog_action;
+    uint8_t  watchdog_pretimeout; /* In seconds */
+    uint8_t  watchdog_expired;
+    uint16_t watchdog_timeout; /* in 100's of milliseconds */
+
+    int8_t   watchdog_running;
+    int8_t   watchdog_preaction_ran;
+    int64_t  watchdog_expiry;
+
+    uint8_t device_id;
+    uint8_t ipmi_version;
+    uint8_t device_rev;
+    uint8_t fwrev1;
+    uint8_t fwrev2;
+    uint8_t mfg_id[3];
+    uint8_t product_id[2];
+
+    IPMISel sel;
+    IPMISdr sdr;
+    IPMISensor sensors[MAX_SENSORS];
+
+    /* Odd netfns are for responses, so we only need the even ones. */
+    IPMINetfn * netfns[MAX_NETFNS / 2];
+
+    /* We allow one event in the buffer */
+    uint8_t evtbuf[16];
+};
+
+#define IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK        (1 << 3)
+#define IPMI_BMC_MSG_FLAG_EVT_BUF_FULL                 (1 << 1)
+#define IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE                (1 << 0)
+#define IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK_SET(s) \
+    (IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK & (s)->msg_flags)
+#define IPMI_BMC_MSG_FLAG_EVT_BUF_FULL_SET(s) \
+    (IPMI_BMC_MSG_FLAG_EVT_BUF_FULL & (s)->msg_flags)
+#define IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE_SET(s) \
+    (IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE & (s)->msg_flags)
+
+#define IPMI_BMC_RCV_MSG_QUEUE_INT_BIT        0
+#define IPMI_BMC_EVBUF_FULL_INT_BIT        1
+#define IPMI_BMC_EVENT_MSG_BUF_BIT        2
+#define IPMI_BMC_EVENT_LOG_BIT                3
+#define IPMI_BMC_MSG_INTS_ON(s) ((s)->bmc_global_enables & \
+                                 (1 << IPMI_BMC_RCV_MSG_QUEUE_INT_BIT))
+#define IPMI_BMC_EVBUF_FULL_INT_ENABLED(s) ((s)->bmc_global_enables & \
+                                        (1 << IPMI_BMC_EVBUF_FULL_INT_BIT))
+#define IPMI_BMC_EVENT_LOG_ENABLED(s) ((s)->bmc_global_enables & \
+                                       (1 << IPMI_BMC_EVENT_LOG_BIT))
+#define IPMI_BMC_EVENT_MSG_BUF_ENABLED(s) ((s)->bmc_global_enables & \
+                                           (1 << IPMI_BMC_EVENT_MSG_BUF_BIT))
+
+#define IPMI_BMC_WATCHDOG_USE_MASK 0xc7
+#define IPMI_BMC_WATCHDOG_ACTION_MASK 0x77
+#define IPMI_BMC_WATCHDOG_GET_USE(s) ((s)->watchdog_use & 0x7)
+#define IPMI_BMC_WATCHDOG_GET_DONT_LOG(s) (((s)->watchdog_use >> 7) & 0x1)
+#define IPMI_BMC_WATCHDOG_GET_DONT_STOP(s) (((s)->watchdog_use >> 6) & 0x1)
+#define IPMI_BMC_WATCHDOG_GET_PRE_ACTION(s) (((s)->watchdog_action >> 4) & 0x7)
+#define IPMI_BMC_WATCHDOG_PRE_NONE               0
+#define IPMI_BMC_WATCHDOG_PRE_SMI                1
+#define IPMI_BMC_WATCHDOG_PRE_NMI                2
+#define IPMI_BMC_WATCHDOG_PRE_MSG_INT            3
+#define IPMI_BMC_WATCHDOG_GET_ACTION(s) ((s)->watchdog_action & 0x7)
+#define IPMI_BMC_WATCHDOG_ACTION_NONE            0
+#define IPMI_BMC_WATCHDOG_ACTION_RESET           1
+#define IPMI_BMC_WATCHDOG_ACTION_POWER_DOWN      2
+#define IPMI_BMC_WATCHDOG_ACTION_POWER_CYCLE     3
+
+
+/* Add a byte to the response. */
+#define IPMI_ADD_RSP_DATA(b) \
+    do {                                                   \
+        if (*rsp_len >= max_rsp_len) {                     \
+            rsp[2] = IPMI_CC_REQUEST_DATA_TRUNCATED;       \
+            goto out;                                      \
+        }                                                  \
+        rsp[(*rsp_len)++] = (b);                           \
+    } while (0)
+
+/* Verify that the received command is a certain length. */
+#define IPMI_CHECK_CMD_LEN(l) \
+    if (cmd_len < l) {                                     \
+        rsp[2] = IPMI_CC_REQUEST_DATA_LENGTH_INVALID;      \
+        goto out; \
+    }
+
+/* Check that the reservation in the command is valid. */
+#define IPMI_CHECK_RESERVATION(off, r) \
+    do {                                                   \
+        if ((cmd[off] | (cmd[off + 1] << 8)) != r) {       \
+            rsp[2] = IPMI_CC_INVALID_RESERVATION;          \
+            goto out;                                      \
+        }                                                  \
+    } while (0)
+
+
+static void ipmi_sim_handle_timeout(IPMISimBmc *ss);
+
+static void ipmi_gettime(struct ipmi_time *time)
+{
+    int64_t stime;
+
+    stime = get_clock_realtime();
+    time->tv_sec = stime / 1000000000LL;
+    time->tv_nsec = stime % 1000000000LL;
+}
+
+static int64_t ipmi_getmonotime(void)
+{
+    return qemu_get_clock_ns(vm_clock);
+}
+
+static void ipmi_timeout(void *opaque)
+{
+    IPMISimBmc *ss = opaque;
+
+    ipmi_sim_handle_timeout(ss);
+}
+
+static void set_timestamp(IPMISimBmc *ss, uint8_t *ts)
+{
+    unsigned int val;
+    struct ipmi_time now;
+
+    ipmi_gettime(&now);
+    val = now.tv_sec + ss->sel.time_offset;
+    ts[0] = val & 0xff;
+    ts[1] = (val >> 8) & 0xff;
+    ts[2] = (val >> 16) & 0xff;
+    ts[3] = (val >> 24) & 0xff;
+}
+
+static void sdr_inc_reservation(IPMISdr *sdr)
+{
+    sdr->reservation++;
+    if (sdr->reservation == 0) {
+        sdr->reservation = 1;
+    }
+}
+
+static int sdr_add_entry(IPMISimBmc *ss, const uint8_t *entry,
+                         unsigned int len, uint16_t *recid)
+{
+    if ((len < 5) || (len > 255)) {
+        return 1;
+    }
+
+    if (entry[ss->sdr.next_free + 4] != len) {
+        return 1;
+    }
+
+    if (ss->sdr.next_free + len > MAX_SDR_SIZE) {
+        ss->sdr.overflow = 1;
+        return 1;
+    }
+
+    memcpy(ss->sdr.sdr + ss->sdr.next_free, entry, len);
+    ss->sdr.sdr[ss->sdr.next_free] = ss->sdr.next_rec_id & 0xff;
+    ss->sdr.sdr[ss->sdr.next_free+1] = (ss->sdr.next_rec_id >> 8) & 0xff;
+    ss->sdr.sdr[ss->sdr.next_free+2] = 0x51; /* Conform to IPMI 1.5 spec */
+
+    if (recid) {
+        *recid = ss->sdr.next_rec_id;
+    }
+    ss->sdr.next_rec_id++;
+    set_timestamp(ss, ss->sdr.last_addition);
+    ss->sdr.next_free += len;
+    sdr_inc_reservation(&ss->sdr);
+    return 0;
+}
+
+static int sdr_find_entry(IPMISdr *sdr, uint16_t recid,
+                          unsigned int *retpos, uint16_t *nextrec)
+{
+    unsigned int pos = *retpos;
+
+    while (pos < sdr->next_free) {
+        uint16_t trec = sdr->sdr[pos] | (sdr->sdr[pos + 1] << 8);
+        unsigned int nextpos = pos + sdr->sdr[pos + 4];
+
+        if (trec == recid) {
+            if (nextrec) {
+                if (nextpos >= sdr->next_free) {
+                    *nextrec = 0xffff;
+                } else {
+                    *nextrec = (sdr->sdr[nextpos] |
+                                (sdr->sdr[nextpos + 1] << 8));
+                }
+            }
+            *retpos = pos;
+            return 0;
+        }
+        pos = nextpos;
+    }
+    return 1;
+}
+
+static void sel_inc_reservation(IPMISel *sel)
+{
+    sel->reservation++;
+    if (sel->reservation == 0) {
+        sel->reservation = 1;
+    }
+}
+
+/* Returns 1 if the SEL is full and can't hold the event. */
+static int sel_add_event(IPMISimBmc *ss, uint8_t *event)
+{
+    event[0] = 0xff;
+    event[1] = 0xff;
+    set_timestamp(ss, event + 3);
+    if (ss->sel.next_free == MAX_SEL_SIZE) {
+        ss->sel.overflow = 1;
+        return 1;
+    }
+    event[0] = ss->sel.next_free & 0xff;
+    event[1] = (ss->sel.next_free >> 8) & 0xff;
+    memcpy(ss->sel.last_addition, event + 3, 4);
+    memcpy(ss->sel.sel[ss->sel.next_free], event, 16);
+    ss->sel.next_free++;
+    sel_inc_reservation(&ss->sel);
+    return 0;
+}
+
+static int attn_irq_enabled(IPMISimBmc *s)
+{
+    return (IPMI_BMC_MSG_INTS_ON(s) && IPMI_BMC_MSG_FLAG_RCV_MSG_QUEUE_SET(s))
+        || (IPMI_BMC_EVBUF_FULL_INT_ENABLED(s) &&
+            IPMI_BMC_MSG_FLAG_EVT_BUF_FULL_SET(s));
+}
+
+static void gen_event(IPMISimBmc *ss, unsigned int sens_num, uint8_t deassert,
+                      uint8_t evd1, uint8_t evd2, uint8_t evd3)
+{
+    IPMIInterface *s = ss->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+    uint8_t evt[16];
+    IPMISensor *sens = ss->sensors + sens_num;
+
+    if (!IPMI_BMC_EVENT_MSG_BUF_ENABLED(ss)) {
+        return;
+    }
+    if (!IPMI_SENSOR_GET_EVENTS_ON(sens)) {
+        return;
+    }
+
+    evt[2] = 0x2; /* System event record */
+    evt[7] = s->slave_addr;
+    evt[8] = 0;
+    evt[9] = 0x04; /* Format version */
+    evt[10] = sens->sensor_type;
+    evt[11] = sens_num;
+    evt[12] = sens->evt_reading_type_code | (!!deassert << 7);
+    evt[13] = evd1;
+    evt[14] = evd2;
+    evt[15] = evd3;
+
+    if (IPMI_BMC_EVENT_LOG_ENABLED(ss)) {
+        sel_add_event(ss, evt);
+    }
+
+    if (ss->msg_flags & IPMI_BMC_MSG_FLAG_EVT_BUF_FULL) {
+        goto out;
+    }
+
+    ss->msg_flags |= IPMI_BMC_MSG_FLAG_EVT_BUF_FULL;
+    memcpy(ss->evtbuf, evt, 16);
+    if (k->set_atn &&
+            ~(ss->msg_flags & IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK)) {
+        k->set_atn(s, 1, attn_irq_enabled(ss));
+    }
+ out:
+    return;
+}
+
+static void sensor_set_discrete_bit(IPMISimBmc *ss, unsigned int sensor,
+                                    unsigned int bit, unsigned int val,
+                                    uint8_t evd1, uint8_t evd2, uint8_t evd3)
+{
+    IPMISensor *sens;
+    uint16_t mask;
+
+    if (sensor >= MAX_SENSORS) {
+        return;
+    }
+    if (bit >= 16) {
+        return;
+    }
+
+    mask = (1 << bit);
+    sens = ss->sensors + sensor;
+    if (val) {
+        sens->states |= mask & sens->states_suppt;
+        if (sens->assert_states & mask) {
+            return; /* Already asserted */
+        }
+        sens->assert_states |= mask & sens->assert_suppt;
+        if (sens->assert_enable & mask & sens->assert_states) {
+            /* Send an event on assert */
+            gen_event(ss, sensor, 0, evd1, evd2, evd3);
+        }
+    } else {
+        sens->states &= ~(mask & sens->states_suppt);
+        if (sens->deassert_states & mask) {
+            return; /* Already deasserted */
+        }
+        sens->deassert_states |= mask & sens->deassert_suppt;
+        if (sens->deassert_enable & mask & sens->deassert_states) {
+            /* Send an event on deassert */
+            gen_event(ss, sensor, 1, evd1, evd2, evd3);
+        }
+    }
+}
+
+static void ipmi_init_sensors_from_sdrs(IPMISimBmc *s)
+{
+    unsigned int i, pos;
+    IPMISensor *sens;
+
+    for (i = 0; i < MAX_SENSORS; i++) {
+        memset(s->sensors + i, 0, sizeof(*sens));
+    }
+
+    pos = 0;
+    for (i = 0; !sdr_find_entry(&s->sdr, i, &pos, NULL); i++) {
+        uint8_t *sdr = s->sdr.sdr + pos;
+        unsigned int len = sdr[4];
+
+        if (len < 20) {
+            continue;
+        }
+        if ((sdr[3] < 1) || (sdr[3] > 2)) {
+            continue; /* Not a sensor SDR we set from */
+        }
+
+        if (sdr[7] > MAX_SENSORS) {
+            continue;
+        }
+        sens = s->sensors + sdr[7];
+
+        IPMI_SENSOR_SET_PRESENT(sens, 1);
+        IPMI_SENSOR_SET_SCAN_ON(sens, (sdr[10] >> 6) & 1);
+        IPMI_SENSOR_SET_EVENTS_ON(sens, (sdr[10] >> 5) & 1);
+        sens->assert_suppt = sdr[14] | (sdr[15] << 8);
+        sens->deassert_suppt = sdr[16] | (sdr[17] << 8);
+        sens->states_suppt = sdr[18] | (sdr[19] << 8);
+        sens->sensor_type = sdr[12];
+        sens->evt_reading_type_code = sdr[13] & 0x7f;
+
+        /* Enable all the events that are supported. */
+        sens->assert_enable = sens->assert_suppt;
+        sens->deassert_enable = sens->deassert_suppt;
+    }
+}
+
+static int ipmi_register_netfn(IPMISimBmc *s, unsigned int netfn,
+                               IPMINetfn *netfnd)
+{
+    if ((netfn & 1) || (netfn > MAX_NETFNS) || (s->netfns[netfn / 2])) {
+        return -1;
+    }
+    s->netfns[netfn / 2] = netfnd;
+    return 0;
+}
+
+static void next_timeout(IPMISimBmc *ss)
+{
+    int64_t next;
+    if (ss->watchdog_running) {
+        next = ss->watchdog_expiry;
+    } else {
+        /* Wait a minute */
+        next = ipmi_getmonotime() + 60 * 1000000000LL;
+    }
+    qemu_mod_timer_ns(ss->timer, next);
+}
+
+static void ipmi_sim_handle_command(IPMIBmc *b,
+                                    uint8_t *cmd, unsigned int cmd_len,
+                                    unsigned int max_cmd_len,
+                                    uint8_t msg_id)
+{
+    IPMISimBmc *ss = DO_UPCAST(IPMISimBmc, parent, b);
+    IPMIInterface *s = ss->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+    unsigned int netfn;
+    uint8_t rsp[MAX_IPMI_MSG_SIZE];
+    unsigned int rsp_len_holder = 0;
+    unsigned int *rsp_len = &rsp_len_holder;
+    unsigned int max_rsp_len = sizeof(rsp);
+
+    /* Set up the response, set the low bit of NETFN. */
+    /* Note that max_rsp_len must be at least 3 */
+    IPMI_ADD_RSP_DATA(cmd[0] | 0x04);
+    IPMI_ADD_RSP_DATA(cmd[1]);
+    IPMI_ADD_RSP_DATA(0); /* Assume success */
+
+    /* If it's too short or it was truncated, return an error. */
+    if (cmd_len < 2) {
+        rsp[2] = IPMI_CC_REQUEST_DATA_LENGTH_INVALID;
+        goto out;
+    }
+    if (cmd_len > max_cmd_len) {
+        rsp[2] = IPMI_CC_REQUEST_DATA_TRUNCATED;
+        goto out;
+    }
+
+    if ((cmd[0] & 0x03) != 0) {
+        /* Only have stuff on LUN 0 */
+        rsp[2] = IPMI_CC_COMMAND_INVALID_FOR_LUN;
+        goto out;
+    }
+
+    netfn = cmd[0] >> 2;
+
+    /* Odd netfns are not valid, make sure the command is registered */
+    if ((netfn & 1) || !ss->netfns[netfn / 2] ||
+                        (cmd[1] >= ss->netfns[netfn / 2]->cmd_nums) ||
+                        (!ss->netfns[netfn / 2]->cmd_handlers[cmd[1]])) {
+        rsp[2] = IPMI_CC_INVALID_CMD;
+        goto out;
+    }
+
+    ss->netfns[netfn / 2]->cmd_handlers[cmd[1]](ss, cmd, cmd_len, rsp, rsp_len,
+                                                max_rsp_len);
+
+ out:
+    k->handle_rsp(s, msg_id, rsp, *rsp_len);
+
+    next_timeout(ss);
+}
+
+static void ipmi_sim_handle_timeout(IPMISimBmc *ss)
+{
+    IPMIInterface *s = ss->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+
+    if (!ss->watchdog_running) {
+        goto out;
+    }
+
+    if (!ss->watchdog_preaction_ran) {
+        switch (IPMI_BMC_WATCHDOG_GET_PRE_ACTION(ss)) {
+        case IPMI_BMC_WATCHDOG_PRE_NMI:
+            ss->msg_flags |= IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK;
+            k->do_hw_op(s, IPMI_SEND_NMI, 0);
+            sensor_set_discrete_bit(ss, IPMI_WATCHDOG_SENSOR, 8, 1,
+                                    0xc8, (2 << 4) | 0xf, 0xff);
+            break;
+
+        case IPMI_BMC_WATCHDOG_PRE_MSG_INT:
+            ss->msg_flags |= IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK;
+            if (k->set_atn &&
+                    !(ss->msg_flags & IPMI_BMC_MSG_FLAG_EVT_BUF_FULL)) {
+                k->set_atn(s, 1, attn_irq_enabled(ss));
+            }
+            sensor_set_discrete_bit(ss, IPMI_WATCHDOG_SENSOR, 8, 1,
+                                    0xc8, (3 << 4) | 0xf, 0xff);
+            break;
+
+        default:
+            goto do_full_expiry;
+        }
+
+        ss->watchdog_preaction_ran = 1;
+        /* Issued the pretimeout, do the rest of the timeout now. */
+        ss->watchdog_expiry = ipmi_getmonotime();
+        ss->watchdog_expiry += ss->watchdog_pretimeout * 1000000000LL;
+        goto out;
+    }
+
+ do_full_expiry:
+    ss->watchdog_running = 0; /* Stop the watchdog on a timeout */
+    ss->watchdog_expired |= (1 << IPMI_BMC_WATCHDOG_GET_USE(ss));
+    switch (IPMI_BMC_WATCHDOG_GET_ACTION(ss)) {
+    case IPMI_BMC_WATCHDOG_ACTION_NONE:
+        sensor_set_discrete_bit(ss, IPMI_WATCHDOG_SENSOR, 0, 1,
+                                0xc0, ss->watchdog_use & 0xf, 0xff);
+        break;
+
+    case IPMI_BMC_WATCHDOG_ACTION_RESET:
+        sensor_set_discrete_bit(ss, IPMI_WATCHDOG_SENSOR, 1, 1,
+                                0xc1, ss->watchdog_use & 0xf, 0xff);
+        k->do_hw_op(s, IPMI_RESET_CHASSIS, 0);
+        break;
+
+    case IPMI_BMC_WATCHDOG_ACTION_POWER_DOWN:
+        sensor_set_discrete_bit(ss, IPMI_WATCHDOG_SENSOR, 2, 1,
+                                0xc2, ss->watchdog_use & 0xf, 0xff);
+        k->do_hw_op(s, IPMI_POWEROFF_CHASSIS, 0);
+        break;
+
+    case IPMI_BMC_WATCHDOG_ACTION_POWER_CYCLE:
+        sensor_set_discrete_bit(ss, IPMI_WATCHDOG_SENSOR, 2, 1,
+                                0xc3, ss->watchdog_use & 0xf, 0xff);
+        k->do_hw_op(s, IPMI_POWERCYCLE_CHASSIS, 0);
+        break;
+    }
+
+ out:
+    next_timeout(ss);
+}
+
+static void chassis_capabilities(IPMISimBmc *ss,
+                                 uint8_t *cmd, unsigned int cmd_len,
+                                 uint8_t *rsp, unsigned int *rsp_len,
+                                 unsigned int max_rsp_len)
+{
+    IPMIInterface *s = ss->parent.intf;
+
+    IPMI_ADD_RSP_DATA(0);
+    IPMI_ADD_RSP_DATA(s->slave_addr);
+    IPMI_ADD_RSP_DATA(s->slave_addr);
+    IPMI_ADD_RSP_DATA(s->slave_addr);
+    IPMI_ADD_RSP_DATA(s->slave_addr);
+ out:
+    return;
+}
+
+static void chassis_status(IPMISimBmc *ss,
+                           uint8_t *cmd, unsigned int cmd_len,
+                           uint8_t *rsp, unsigned int *rsp_len,
+                           unsigned int max_rsp_len)
+{
+    IPMI_ADD_RSP_DATA(0x61); /* Unknown power restore, power is on */
+    IPMI_ADD_RSP_DATA(0);
+    IPMI_ADD_RSP_DATA(0);
+    IPMI_ADD_RSP_DATA(0);
+ out:
+    return;
+}
+
+static void chassis_control(IPMISimBmc *ss,
+                            uint8_t *cmd, unsigned int cmd_len,
+                            uint8_t *rsp, unsigned int *rsp_len,
+                            unsigned int max_rsp_len)
+{
+    IPMIInterface *s = ss->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+
+    IPMI_CHECK_CMD_LEN(3);
+    switch (cmd[2] & 0xf) {
+    case 0: /* power down */
+        rsp[2] = k->do_hw_op(s, IPMI_POWEROFF_CHASSIS, 0);
+        break;
+    case 1: /* power up */
+        rsp[2] = k->do_hw_op(s, IPMI_POWERON_CHASSIS, 0);
+        break;
+    case 2: /* power cycle */
+        rsp[2] = k->do_hw_op(s, IPMI_POWERCYCLE_CHASSIS, 0);
+        break;
+    case 3: /* hard reset */
+        rsp[2] = k->do_hw_op(s, IPMI_RESET_CHASSIS, 0);
+        break;
+    case 4: /* pulse diagnostic interrupt */
+        rsp[2] = k->do_hw_op(s, IPMI_PULSE_DIAG_IRQ, 0);
+        break;
+    case 5: /* soft shutdown via ACPI by overtemp emulation */
+        rsp[2] = k->do_hw_op(s,
+                             IPMI_SHUTDOWN_VIA_ACPI_OVERTEMP, 0);
+        break;
+    default:
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+ out:
+    return;
+}
+
+static void get_device_id(IPMISimBmc *ss,
+                          uint8_t *cmd, unsigned int cmd_len,
+                          uint8_t *rsp, unsigned int *rsp_len,
+                          unsigned int max_rsp_len)
+{
+    IPMI_ADD_RSP_DATA(ss->device_id);
+    IPMI_ADD_RSP_DATA(ss->device_rev & 0xf);
+    IPMI_ADD_RSP_DATA(ss->fwrev1 & 0x7f);
+    IPMI_ADD_RSP_DATA(ss->fwrev2);
+    IPMI_ADD_RSP_DATA(ss->ipmi_version);
+    IPMI_ADD_RSP_DATA(0x07); /* sensor, SDR, and SEL. */
+    IPMI_ADD_RSP_DATA(ss->mfg_id[0]);
+    IPMI_ADD_RSP_DATA(ss->mfg_id[1]);
+    IPMI_ADD_RSP_DATA(ss->mfg_id[2]);
+    IPMI_ADD_RSP_DATA(ss->product_id[0]);
+    IPMI_ADD_RSP_DATA(ss->product_id[1]);
+ out:
+    return;
+}
+
+static void set_bmc_global_enables(IPMISimBmc *ss,
+                                   uint8_t *cmd, unsigned int cmd_len,
+                                   uint8_t *rsp, unsigned int *rsp_len,
+                                   unsigned int max_rsp_len)
+{
+    IPMIInterface *s = ss->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+    uint8_t old_val = ss->bmc_global_enables;
+
+    IPMI_CHECK_CMD_LEN(3);
+    ss->bmc_global_enables = cmd[2];
+    if ((old_val & (1 << IPMI_BMC_RCV_MSG_QUEUE_INT_BIT))
+        != (cmd[2] & (1 << IPMI_BMC_RCV_MSG_QUEUE_INT_BIT))) {
+        k->set_irq_enable(s,
+                          !!(cmd[2] & (1 << IPMI_BMC_RCV_MSG_QUEUE_INT_BIT)));
+    }
+ out:
+    return;
+}
+
+static void get_bmc_global_enables(IPMISimBmc *ss,
+                                   uint8_t *cmd, unsigned int cmd_len,
+                                   uint8_t *rsp, unsigned int *rsp_len,
+                                   unsigned int max_rsp_len)
+{
+    IPMI_ADD_RSP_DATA(ss->bmc_global_enables);
+ out:
+    return;
+}
+
+static void clr_msg_flags(IPMISimBmc *ss,
+                          uint8_t *cmd, unsigned int cmd_len,
+                          uint8_t *rsp, unsigned int *rsp_len,
+                          unsigned int max_rsp_len)
+{
+    IPMIInterface *s = ss->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+
+    IPMI_CHECK_CMD_LEN(3);
+    if (cmd[2] & IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK) {
+        if (k->set_atn &&
+                !(ss->msg_flags & IPMI_BMC_MSG_FLAG_EVT_BUF_FULL)) {
+            k->set_atn(s, 0, attn_irq_enabled(ss));
+        }
+    }
+    ss->msg_flags &= ~cmd[2];
+ out:
+    return;
+}
+
+static void get_msg_flags(IPMISimBmc *ss,
+                          uint8_t *cmd, unsigned int cmd_len,
+                          uint8_t *rsp, unsigned int *rsp_len,
+                          unsigned int max_rsp_len)
+{
+    IPMI_ADD_RSP_DATA(ss->msg_flags);
+ out:
+    return;
+}
+
+static void read_evt_msg_buf(IPMISimBmc *ss,
+                             uint8_t *cmd, unsigned int cmd_len,
+                             uint8_t *rsp, unsigned int *rsp_len,
+                            unsigned int max_rsp_len)
+{
+    IPMIInterface *s = ss->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+    unsigned int i;
+
+    if (!(ss->msg_flags & IPMI_BMC_MSG_FLAG_EVT_BUF_FULL)) {
+        rsp[2] = 0x80;
+        goto out;
+    }
+    for (i = 0; i < 16; i++) {
+        IPMI_ADD_RSP_DATA(ss->evtbuf[i]);
+    }
+    ss->msg_flags &= ~IPMI_BMC_MSG_FLAG_EVT_BUF_FULL;
+    if (k->set_atn &&
+            ~(ss->msg_flags & IPMI_BMC_MSG_FLAG_WATCHDOG_TIMEOUT_MASK)) {
+        k->set_atn(s, 0, attn_irq_enabled(ss));
+    }
+ out:
+    return;
+}
+
+static void do_watchdog_reset(IPMISimBmc *ss)
+{
+    if (IPMI_BMC_WATCHDOG_GET_ACTION(ss) ==
+        IPMI_BMC_WATCHDOG_ACTION_NONE) {
+        ss->watchdog_running = 0;
+        return;
+    }
+    ss->watchdog_preaction_ran = 0;
+
+
+    /* Timeout is in tenths of a second, offset is in seconds */
+    ss->watchdog_expiry = ipmi_getmonotime();
+    ss->watchdog_expiry += ss->watchdog_timeout * 100000000LL;
+    if (IPMI_BMC_WATCHDOG_GET_PRE_ACTION(ss) != IPMI_BMC_WATCHDOG_PRE_NONE) {
+        ss->watchdog_expiry -= ss->watchdog_pretimeout * 1000000000LL;
+    }
+    ss->watchdog_running = 1;
+}
+
+static void reset_watchdog_timer(IPMISimBmc *ss,
+                                 uint8_t *cmd, unsigned int cmd_len,
+                                 uint8_t *rsp, unsigned int *rsp_len,
+                                 unsigned int max_rsp_len)
+{
+    if (!ss->watchdog_initialized) {
+        rsp[2] = 0x80;
+        goto out;
+    }
+    do_watchdog_reset(ss);
+ out:
+    return;
+}
+
+static void set_watchdog_timer(IPMISimBmc *ss,
+                               uint8_t *cmd, unsigned int cmd_len,
+                               uint8_t *rsp, unsigned int *rsp_len,
+                               unsigned int max_rsp_len)
+{
+    IPMIInterface *s = ss->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+    unsigned int val;
+
+    IPMI_CHECK_CMD_LEN(8);
+    val = cmd[2] & 0x7; /* Validate use */
+    if (val == 0 || val > 5) {
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+    val = cmd[3] & 0x7; /* Validate action */
+    switch (val) {
+    case IPMI_BMC_WATCHDOG_ACTION_NONE:
+        break;
+
+    case IPMI_BMC_WATCHDOG_ACTION_RESET:
+        rsp[2] = k->do_hw_op(s, IPMI_RESET_CHASSIS, 1);
+        break;
+
+    case IPMI_BMC_WATCHDOG_ACTION_POWER_DOWN:
+        rsp[2] = k->do_hw_op(s, IPMI_POWEROFF_CHASSIS, 1);
+        break;
+
+    case IPMI_BMC_WATCHDOG_ACTION_POWER_CYCLE:
+        rsp[2] = k->do_hw_op(s, IPMI_POWERCYCLE_CHASSIS, 1);
+        break;
+
+    default:
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+    }
+    if (rsp[2]) {
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+
+    val = (cmd[3] >> 4) & 0x7; /* Validate preaction */
+    switch (val) {
+    case IPMI_BMC_WATCHDOG_PRE_MSG_INT:
+    case IPMI_BMC_WATCHDOG_PRE_NONE:
+        break;
+
+    case IPMI_BMC_WATCHDOG_PRE_NMI:
+        if (!k->do_hw_op(s, IPMI_SEND_NMI, 1)) {
+            /* NMI not supported. */
+            rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+            goto out;
+        }
+    default:
+        /* We don't support PRE_SMI */
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+
+    ss->watchdog_initialized = 1;
+    ss->watchdog_use = cmd[2] & IPMI_BMC_WATCHDOG_USE_MASK;
+    ss->watchdog_action = cmd[3] & IPMI_BMC_WATCHDOG_ACTION_MASK;
+    ss->watchdog_pretimeout = cmd[4];
+    ss->watchdog_expired &= ~cmd[5];
+    ss->watchdog_timeout = cmd[6] | (((uint16_t) cmd[7]) << 8);
+    if (ss->watchdog_running & IPMI_BMC_WATCHDOG_GET_DONT_STOP(ss)) {
+        do_watchdog_reset(ss);
+    } else {
+        ss->watchdog_running = 0;
+    }
+ out:
+    return;
+}
+
+static void get_watchdog_timer(IPMISimBmc *ss,
+                               uint8_t *cmd, unsigned int cmd_len,
+                               uint8_t *rsp, unsigned int *rsp_len,
+                               unsigned int max_rsp_len)
+{
+    IPMI_ADD_RSP_DATA(ss->watchdog_use);
+    IPMI_ADD_RSP_DATA(ss->watchdog_action);
+    IPMI_ADD_RSP_DATA(ss->watchdog_pretimeout);
+    IPMI_ADD_RSP_DATA(ss->watchdog_expired);
+    if (ss->watchdog_running) {
+        long timeout;
+        timeout = ((ss->watchdog_expiry - ipmi_getmonotime() + 50000000)
+                   / 100000000);
+        IPMI_ADD_RSP_DATA(timeout & 0xff);
+        IPMI_ADD_RSP_DATA((timeout >> 8) & 0xff);
+    } else {
+        IPMI_ADD_RSP_DATA(0);
+        IPMI_ADD_RSP_DATA(0);
+    }
+ out:
+    return;
+}
+
+static void get_sdr_rep_info(IPMISimBmc *ss,
+                             uint8_t *cmd, unsigned int cmd_len,
+                             uint8_t *rsp, unsigned int *rsp_len,
+                             unsigned int max_rsp_len)
+{
+    unsigned int i;
+
+    IPMI_ADD_RSP_DATA(0x51); /* Conform to IPMI 1.5 spec */
+    IPMI_ADD_RSP_DATA(ss->sdr.next_rec_id & 0xff);
+    IPMI_ADD_RSP_DATA((ss->sdr.next_rec_id >> 8) & 0xff);
+    IPMI_ADD_RSP_DATA((MAX_SDR_SIZE - ss->sdr.next_free) & 0xff);
+    IPMI_ADD_RSP_DATA(((MAX_SDR_SIZE - ss->sdr.next_free) >> 8) & 0xff);
+    for (i = 0; i < 4; i++) {
+        IPMI_ADD_RSP_DATA(ss->sdr.last_addition[i]);
+    }
+    for (i = 0; i < 4; i++) {
+        IPMI_ADD_RSP_DATA(ss->sdr.last_clear[i]);
+    }
+    /* Only modal support, reserve supported */
+    IPMI_ADD_RSP_DATA((ss->sdr.overflow << 7) | 0x22);
+ out:
+    return;
+}
+
+static void reserve_sdr_rep(IPMISimBmc *ss,
+                            uint8_t *cmd, unsigned int cmd_len,
+                            uint8_t *rsp, unsigned int *rsp_len,
+                            unsigned int max_rsp_len)
+{
+    IPMI_ADD_RSP_DATA(ss->sdr.reservation & 0xff);
+    IPMI_ADD_RSP_DATA((ss->sdr.reservation >> 8) & 0xff);
+ out:
+    return;
+}
+
+static void get_sdr(IPMISimBmc *ss,
+                    uint8_t *cmd, unsigned int cmd_len,
+                    uint8_t *rsp, unsigned int *rsp_len,
+                    unsigned int max_rsp_len)
+{
+    unsigned int pos;
+    uint16_t nextrec;
+
+    IPMI_CHECK_CMD_LEN(8);
+    if (cmd[6]) {
+        IPMI_CHECK_RESERVATION(2, ss->sdr.reservation);
+    }
+    pos = 0;
+    if (sdr_find_entry(&ss->sdr, cmd[4] | (cmd[5] << 8),
+                       &pos, &nextrec)) {
+        rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
+        goto out;
+    }
+    if (cmd[6] > (ss->sdr.sdr[pos + 4])) {
+        rsp[2] = IPMI_CC_PARM_OUT_OF_RANGE;
+        goto out;
+    }
+
+    IPMI_ADD_RSP_DATA(nextrec & 0xff);
+    IPMI_ADD_RSP_DATA((nextrec >> 8) & 0xff);
+
+    if (cmd[7] == 0xff) {
+        cmd[7] = ss->sdr.sdr[pos + 4] - cmd[6];
+    }
+
+    if ((cmd[7] + *rsp_len) > max_rsp_len) {
+        rsp[2] = IPMI_CC_CANNOT_RETURN_REQ_NUM_BYTES;
+        goto out;
+    }
+    memcpy(rsp + *rsp_len, ss->sdr.sdr + pos + cmd[6], cmd[7]);
+    *rsp_len += cmd[7];
+ out:
+    return;
+}
+
+static void add_sdr(IPMISimBmc *ss,
+                    uint8_t *cmd, unsigned int cmd_len,
+                    uint8_t *rsp, unsigned int *rsp_len,
+                    unsigned int max_rsp_len)
+{
+    uint16_t recid;
+
+    if (sdr_add_entry(ss, cmd + 2, cmd_len - 2, &recid)) {
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+    IPMI_ADD_RSP_DATA(recid & 0xff);
+    IPMI_ADD_RSP_DATA((recid >> 8) & 0xff);
+ out:
+    return;
+}
+
+static void clear_sdr_rep(IPMISimBmc *ss,
+                          uint8_t *cmd, unsigned int cmd_len,
+                          uint8_t *rsp, unsigned int *rsp_len,
+                          unsigned int max_rsp_len)
+{
+    IPMI_CHECK_CMD_LEN(8);
+    IPMI_CHECK_RESERVATION(2, ss->sdr.reservation);
+    if (cmd[4] != 'C' || cmd[5] != 'L' || cmd[6] != 'R') {
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+    if (cmd[7] == 0xaa) {
+        ss->sdr.next_free = 0;
+        ss->sdr.overflow = 0;
+        set_timestamp(ss, ss->sdr.last_clear);
+        IPMI_ADD_RSP_DATA(1); /* Erasure complete */
+        sdr_inc_reservation(&ss->sdr);
+    } else if (cmd[7] == 0) {
+        IPMI_ADD_RSP_DATA(1); /* Erasure complete */
+    } else {
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+ out:
+    return;
+}
+
+static void get_sel_info(IPMISimBmc *ss,
+                         uint8_t *cmd, unsigned int cmd_len,
+                         uint8_t *rsp, unsigned int *rsp_len,
+                         unsigned int max_rsp_len)
+{
+    unsigned int i, val;
+
+    IPMI_ADD_RSP_DATA(0x51); /* Conform to IPMI 1.5 */
+    IPMI_ADD_RSP_DATA(ss->sel.next_free & 0xff);
+    IPMI_ADD_RSP_DATA((ss->sel.next_free >> 8) & 0xff);
+    val = (MAX_SEL_SIZE - ss->sel.next_free) * 16;
+    IPMI_ADD_RSP_DATA(val & 0xff);
+    IPMI_ADD_RSP_DATA((val >> 8) & 0xff);
+    for (i = 0; i < 4; i++) {
+        IPMI_ADD_RSP_DATA(ss->sel.last_addition[i]);
+    }
+    for (i = 0; i < 4; i++) {
+        IPMI_ADD_RSP_DATA(ss->sel.last_clear[i]);
+    }
+    /* Only support Reserve SEL */
+    IPMI_ADD_RSP_DATA((ss->sel.overflow << 7) | 0x02);
+ out:
+    return;
+}
+
+static void reserve_sel(IPMISimBmc *ss,
+                        uint8_t *cmd, unsigned int cmd_len,
+                        uint8_t *rsp, unsigned int *rsp_len,
+                        unsigned int max_rsp_len)
+{
+    IPMI_ADD_RSP_DATA(ss->sel.reservation & 0xff);
+    IPMI_ADD_RSP_DATA((ss->sel.reservation >> 8) & 0xff);
+ out:
+    return;
+}
+
+static void get_sel_entry(IPMISimBmc *ss,
+                          uint8_t *cmd, unsigned int cmd_len,
+                          uint8_t *rsp, unsigned int *rsp_len,
+                          unsigned int max_rsp_len)
+{
+    unsigned int val;
+
+    IPMI_CHECK_CMD_LEN(8);
+    if (cmd[6]) {
+        IPMI_CHECK_RESERVATION(2, ss->sel.reservation);
+    }
+    if (ss->sel.next_free == 0) {
+        rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
+        goto out;
+    }
+    if (cmd[6] > 15) {
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+    if (cmd[7] == 0xff) {
+        cmd[7] = 16;
+    } else if ((cmd[7] + cmd[6]) > 16) {
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    } else {
+        cmd[7] += cmd[6];
+    }
+
+    val = cmd[4] | (cmd[5] << 8);
+    if (val == 0xffff) {
+        val = ss->sel.next_free - 1;
+    } else if (val >= ss->sel.next_free) {
+        rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
+        goto out;
+    }
+    if ((val + 1) == ss->sel.next_free) {
+        IPMI_ADD_RSP_DATA(0xff);
+        IPMI_ADD_RSP_DATA(0xff);
+    } else {
+        IPMI_ADD_RSP_DATA((val + 1) & 0xff);
+        IPMI_ADD_RSP_DATA(((val + 1) >> 8) & 0xff);
+    }
+    for (; cmd[6] < cmd[7]; cmd[6]++) {
+        IPMI_ADD_RSP_DATA(ss->sel.sel[val][cmd[6]]);
+    }
+ out:
+    return;
+}
+
+static void add_sel_entry(IPMISimBmc *ss,
+                          uint8_t *cmd, unsigned int cmd_len,
+                          uint8_t *rsp, unsigned int *rsp_len,
+                          unsigned int max_rsp_len)
+{
+    IPMI_CHECK_CMD_LEN(18);
+    if (sel_add_event(ss, cmd + 2)) {
+        rsp[2] = IPMI_CC_OUT_OF_SPACE;
+        goto out;
+    }
+    /* sel_add_event fills in the record number. */
+    IPMI_ADD_RSP_DATA(cmd[2]);
+    IPMI_ADD_RSP_DATA(cmd[3]);
+ out:
+    return;
+}
+
+static void clear_sel(IPMISimBmc *ss,
+                      uint8_t *cmd, unsigned int cmd_len,
+                      uint8_t *rsp, unsigned int *rsp_len,
+                      unsigned int max_rsp_len)
+{
+    IPMI_CHECK_CMD_LEN(8);
+    IPMI_CHECK_RESERVATION(2, ss->sel.reservation);
+    if (cmd[4] != 'C' || cmd[5] != 'L' || cmd[6] != 'R') {
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+    if (cmd[7] == 0xaa) {
+        ss->sel.next_free = 0;
+        ss->sel.overflow = 0;
+        set_timestamp(ss, ss->sdr.last_clear);
+        IPMI_ADD_RSP_DATA(1); /* Erasure complete */
+        sel_inc_reservation(&ss->sel);
+    } else if (cmd[7] == 0) {
+        IPMI_ADD_RSP_DATA(1); /* Erasure complete */
+    } else {
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+ out:
+    return;
+}
+
+static void get_sel_time(IPMISimBmc *ss,
+                         uint8_t *cmd, unsigned int cmd_len,
+                         uint8_t *rsp, unsigned int *rsp_len,
+                         unsigned int max_rsp_len)
+{
+    uint32_t val;
+    struct ipmi_time now;
+
+    ipmi_gettime(&now);
+    val = now.tv_sec + ss->sel.time_offset;
+    IPMI_ADD_RSP_DATA(val & 0xff);
+    IPMI_ADD_RSP_DATA((val >> 8) & 0xff);
+    IPMI_ADD_RSP_DATA((val >> 16) & 0xff);
+    IPMI_ADD_RSP_DATA((val >> 24) & 0xff);
+ out:
+    return;
+}
+
+static void set_sel_time(IPMISimBmc *ss,
+                         uint8_t *cmd, unsigned int cmd_len,
+                         uint8_t *rsp, unsigned int *rsp_len,
+                         unsigned int max_rsp_len)
+{
+    uint32_t val;
+    struct ipmi_time now;
+
+    IPMI_CHECK_CMD_LEN(6);
+    val = cmd[2] | (cmd[3] << 8) | (cmd[4] << 16) | (cmd[5] << 24);
+    ipmi_gettime(&now);
+    ss->sel.time_offset = now.tv_sec - ((long) val);
+ out:
+    return;
+}
+
+static void set_sensor_evt_enable(IPMISimBmc *ss,
+                                  uint8_t *cmd, unsigned int cmd_len,
+                                  uint8_t *rsp, unsigned int *rsp_len,
+                                  unsigned int max_rsp_len)
+{
+    IPMISensor *sens;
+
+    IPMI_CHECK_CMD_LEN(4);
+    if ((cmd[2] > MAX_SENSORS) ||
+            !IPMI_SENSOR_GET_PRESENT(ss->sensors + cmd[2])) {
+        rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
+        goto out;
+    }
+    sens = ss->sensors + cmd[2];
+    switch ((cmd[3] >> 4) & 0x3) {
+    case 0: /* Do not change */
+        break;
+    case 1: /* Enable bits */
+        if (cmd_len > 4) {
+            sens->assert_enable |= cmd[4];
+        }
+        if (cmd_len > 5) {
+            sens->assert_enable |= cmd[5] << 8;
+        }
+        if (cmd_len > 6) {
+            sens->deassert_enable |= cmd[6];
+        }
+        if (cmd_len > 7) {
+            sens->deassert_enable |= cmd[7] << 8;
+        }
+        break;
+    case 2: /* Disable bits */
+        if (cmd_len > 4) {
+            sens->assert_enable &= ~cmd[4];
+        }
+        if (cmd_len > 5) {
+            sens->assert_enable &= ~(cmd[5] << 8);
+        }
+        if (cmd_len > 6) {
+            sens->deassert_enable &= ~cmd[6];
+        }
+        if (cmd_len > 7) {
+            sens->deassert_enable &= ~(cmd[7] << 8);
+        }
+        break;
+    case 3:
+        rsp[2] = IPMI_CC_INVALID_DATA_FIELD;
+        goto out;
+    }
+    IPMI_SENSOR_SET_RET_STATUS(sens, cmd[3]);
+ out:
+    return;
+}
+
+static void get_sensor_evt_enable(IPMISimBmc *ss,
+                                  uint8_t *cmd, unsigned int cmd_len,
+                                  uint8_t *rsp, unsigned int *rsp_len,
+                                  unsigned int max_rsp_len)
+{
+    IPMISensor *sens;
+
+    IPMI_CHECK_CMD_LEN(3);
+    if ((cmd[2] > MAX_SENSORS) ||
+        !IPMI_SENSOR_GET_PRESENT(ss->sensors + cmd[2])) {
+        rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
+        goto out;
+    }
+    sens = ss->sensors + cmd[2];
+    IPMI_ADD_RSP_DATA(IPMI_SENSOR_GET_RET_STATUS(sens));
+    IPMI_ADD_RSP_DATA(sens->assert_enable & 0xff);
+    IPMI_ADD_RSP_DATA((sens->assert_enable >> 8) & 0xff);
+    IPMI_ADD_RSP_DATA(sens->deassert_enable & 0xff);
+    IPMI_ADD_RSP_DATA((sens->deassert_enable >> 8) & 0xff);
+ out:
+    return;
+}
+
+static void rearm_sensor_evts(IPMISimBmc *ss,
+                              uint8_t *cmd, unsigned int cmd_len,
+                              uint8_t *rsp, unsigned int *rsp_len,
+                              unsigned int max_rsp_len)
+{
+    IPMISensor *sens;
+
+    IPMI_CHECK_CMD_LEN(4);
+    if ((cmd[2] > MAX_SENSORS) ||
+        !IPMI_SENSOR_GET_PRESENT(ss->sensors + cmd[2])) {
+        rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
+        goto out;
+    }
+    sens = ss->sensors + cmd[2];
+
+    if ((cmd[3] & 0x80) == 0) {
+        /* Just clear everything */
+        sens->states = 0;
+        goto out;
+    }
+ out:
+    return;
+}
+
+static void get_sensor_evt_status(IPMISimBmc *ss,
+                                  uint8_t *cmd, unsigned int cmd_len,
+                                  uint8_t *rsp, unsigned int *rsp_len,
+                                  unsigned int max_rsp_len)
+{
+    IPMISensor *sens;
+
+    IPMI_CHECK_CMD_LEN(3);
+    if ((cmd[2] > MAX_SENSORS) ||
+        !IPMI_SENSOR_GET_PRESENT(ss->sensors + cmd[2])) {
+        rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
+        goto out;
+    }
+    sens = ss->sensors + cmd[2];
+    IPMI_ADD_RSP_DATA(sens->reading);
+    IPMI_ADD_RSP_DATA(IPMI_SENSOR_GET_RET_STATUS(sens));
+    IPMI_ADD_RSP_DATA(sens->assert_states & 0xff);
+    IPMI_ADD_RSP_DATA((sens->assert_states >> 8) & 0xff);
+    IPMI_ADD_RSP_DATA(sens->deassert_states & 0xff);
+    IPMI_ADD_RSP_DATA((sens->deassert_states >> 8) & 0xff);
+ out:
+    return;
+}
+
+static void get_sensor_reading(IPMISimBmc *ss,
+                               uint8_t *cmd, unsigned int cmd_len,
+                               uint8_t *rsp, unsigned int *rsp_len,
+                               unsigned int max_rsp_len)
+{
+    IPMISensor *sens;
+
+    IPMI_CHECK_CMD_LEN(3);
+    if ((cmd[2] > MAX_SENSORS) ||
+            !IPMI_SENSOR_GET_PRESENT(ss->sensors + cmd[2])) {
+        rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;
+        goto out;
+    }
+    sens = ss->sensors + cmd[2];
+    IPMI_ADD_RSP_DATA(sens->reading);
+    IPMI_ADD_RSP_DATA(IPMI_SENSOR_GET_RET_STATUS(sens));
+    IPMI_ADD_RSP_DATA(sens->states & 0xff);
+    if (IPMI_SENSOR_IS_DISCRETE(sens)) {
+        IPMI_ADD_RSP_DATA((sens->states >> 8) & 0xff);
+    }
+ out:
+    return;
+}
+
+static IPMICmdHandler chassis_cmds[IPMI_NETFN_CHASSIS_MAXCMD] = {
+    [IPMI_CMD_GET_CHASSIS_CAPABILITIES] = chassis_capabilities,
+    [IPMI_CMD_GET_CHASSIS_STATUS] = chassis_status,
+    [IPMI_CMD_CHASSIS_CONTROL] = chassis_control
+};
+static IPMINetfn chassis_netfn = {
+    .cmd_nums = IPMI_NETFN_CHASSIS_MAXCMD,
+    .cmd_handlers = chassis_cmds
+};
+
+static IPMICmdHandler sensor_event_cmds[IPMI_NETFN_SENSOR_EVENT_MAXCMD] = {
+    [IPMI_CMD_SET_SENSOR_EVT_ENABLE] = set_sensor_evt_enable,
+    [IPMI_CMD_GET_SENSOR_EVT_ENABLE] = get_sensor_evt_enable,
+    [IPMI_CMD_REARM_SENSOR_EVTS] = rearm_sensor_evts,
+    [IPMI_CMD_GET_SENSOR_EVT_STATUS] = get_sensor_evt_status,
+    [IPMI_CMD_GET_SENSOR_READING] = get_sensor_reading
+};
+static IPMINetfn sensor_event_netfn = {
+    .cmd_nums = IPMI_NETFN_SENSOR_EVENT_MAXCMD,
+    .cmd_handlers = sensor_event_cmds
+};
+
+static IPMICmdHandler app_cmds[IPMI_NETFN_APP_MAXCMD] = {
+    [IPMI_CMD_GET_DEVICE_ID] = get_device_id,
+    [IPMI_CMD_SET_BMC_GLOBAL_ENABLES] = set_bmc_global_enables,
+    [IPMI_CMD_GET_BMC_GLOBAL_ENABLES] = get_bmc_global_enables,
+    [IPMI_CMD_CLR_MSG_FLAGS] = clr_msg_flags,
+    [IPMI_CMD_GET_MSG_FLAGS] = get_msg_flags,
+    [IPMI_CMD_READ_EVT_MSG_BUF] = read_evt_msg_buf,
+    [IPMI_CMD_RESET_WATCHDOG_TIMER] = reset_watchdog_timer,
+    [IPMI_CMD_SET_WATCHDOG_TIMER] = set_watchdog_timer,
+    [IPMI_CMD_GET_WATCHDOG_TIMER] = get_watchdog_timer,
+};
+static IPMINetfn app_netfn = {
+    .cmd_nums = IPMI_NETFN_APP_MAXCMD,
+    .cmd_handlers = app_cmds
+};
+
+static IPMICmdHandler storage_cmds[IPMI_NETFN_STORAGE_MAXCMD] = {
+    [IPMI_CMD_GET_SDR_REP_INFO] = get_sdr_rep_info,
+    [IPMI_CMD_RESERVE_SDR_REP] = reserve_sdr_rep,
+    [IPMI_CMD_GET_SDR] = get_sdr,
+    [IPMI_CMD_ADD_SDR] = add_sdr,
+    [IPMI_CMD_CLEAR_SDR_REP] = clear_sdr_rep,
+    [IPMI_CMD_GET_SEL_INFO] = get_sel_info,
+    [IPMI_CMD_RESERVE_SEL] = reserve_sel,
+    [IPMI_CMD_GET_SEL_ENTRY] = get_sel_entry,
+    [IPMI_CMD_ADD_SEL_ENTRY] = add_sel_entry,
+    [IPMI_CMD_CLEAR_SEL] = clear_sel,
+    [IPMI_CMD_GET_SEL_TIME] = get_sel_time,
+    [IPMI_CMD_SET_SEL_TIME] = set_sel_time,
+};
+static IPMINetfn storage_netfn = {
+    .cmd_nums = IPMI_NETFN_STORAGE_MAXCMD,
+    .cmd_handlers = storage_cmds
+};
+
+static void register_cmds(IPMISimBmc *s)
+{
+    ipmi_register_netfn(s, IPMI_NETFN_CHASSIS, &chassis_netfn);
+    ipmi_register_netfn(s, IPMI_NETFN_SENSOR_EVENT, &sensor_event_netfn);
+    ipmi_register_netfn(s, IPMI_NETFN_APP, &app_netfn);
+    ipmi_register_netfn(s, IPMI_NETFN_STORAGE, &storage_netfn);
+}
+
+static const uint8_t init_sdrs[] = {
+    /* Watchdog device */
+    0x00, 0x00, 0x51, 0x02,   40, 0x20, 0x00, 0x00,
+    0x23, 0x01, 0x63, 0x00, 0x23, 0x6f, 0x0f, 0x01,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc8,
+    'W',  'a',  't',  'c',  'h',  'd',  'o',  'g',
+    /* End */
+    0xff, 0xff, 0x00, 0x00, 0x00
+};
+
+static int ipmi_sim_init(IPMIBmc *b)
+{
+    unsigned int i;
+    unsigned int next_recid, recid;
+    IPMISimBmc *ss = DO_UPCAST(IPMISimBmc, parent, b);
+
+    ss->bmc_global_enables = (1 << IPMI_BMC_EVENT_LOG_BIT);
+    ss->device_id = 0x20;
+    ss->ipmi_version = 0x02; /* IPMI 2.0 */
+    for (i = 0; i < 4; i++) {
+        ss->sel.last_addition[i] = 0xff;
+        ss->sel.last_clear[i] = 0xff;
+        ss->sdr.last_addition[i] = 0xff;
+        ss->sdr.last_clear[i] = 0xff;
+    }
+
+    next_recid = 0;
+    for (i = 0;;) {
+        int len;
+        if ((i + 5) > sizeof(init_sdrs)) {
+            ipmi_debug("Problem with recid 0x%4.4x\n", i);
+            return 1;
+        }
+        len = init_sdrs[i + 4];
+        recid = init_sdrs[i] | (init_sdrs[i + 1] << 8);
+        if (recid == 0xffff) {
+            break;
+        }
+        if ((i + len) > sizeof(init_sdrs)) {
+            ipmi_debug("Problem with recid 0x%4.4x\n", i);
+            return 1;
+        }
+        if (recid != next_recid) {
+            ipmi_debug("Problem with recid 0x%4.4x\n", i);
+            return 1;
+        }
+        sdr_add_entry(ss, init_sdrs + i, len, NULL);
+        i += len;
+    }
+
+    ipmi_init_sensors_from_sdrs(ss);
+    register_cmds(ss);
+
+    ss->timer = qemu_new_timer_ns(vm_clock, ipmi_timeout, ss);
+    return 0;
+}
+
+static void ipmi_sim_class_init(ObjectClass *klass, void *data)
+{
+    IPMIBmcClass *bk = IPMI_BMC_CLASS(klass);
+
+    bk->init = ipmi_sim_init;
+    bk->handle_command = ipmi_sim_handle_command;
+}
+
+static TypeInfo ipmi_sim_type = {
+    .name          = "ipmi-bmc-sim",
+    .parent        = TYPE_IPMI_BMC,
+    .instance_size = sizeof(IPMISimBmc),
+    .class_init    = ipmi_sim_class_init,
+};
+
+static void ipmi_sim_register_types(void)
+{
+    type_register_static(&ipmi_sim_type);
+}
+
+type_init(ipmi_sim_register_types)
-- 
1.7.4.1

[Qemu-devel] [PATCH 16/18] IPMI: Add an external connection simulation interface

[minyard]

From: Corey Minyard <cminyard@mvista.com>

This adds an interface for IPMI that connects to a remote
BMC over a chardev (generally a TCP socket).  The OpenIPMI
lanserv simulator describes this interface, see that for
interface details.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 default-configs/i386-softmmu.mak   |    1 +
 default-configs/x86_64-softmmu.mak |    1 +
 hw/Makefile.objs                   |    1 +
 hw/ipmi_extern.c                   |  473 ++++++++++++++++++++++++++++++++++++
 4 files changed, 476 insertions(+), 0 deletions(-)
 create mode 100644 hw/ipmi_extern.c

diff --git a/default-configs/i386-softmmu.mak b/default-configs/i386-softmmu.mak
index 8c99d5d..325f92e 100644
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -12,6 +12,7 @@ CONFIG_ISA_IPMI=y
 CONFIG_IPMI_KCS=y
 CONFIG_IPMI_BT=y
 CONFIG_IPMI_LOCAL=y
+CONFIG_IPMI_EXTERN=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/default-configs/x86_64-softmmu.mak b/default-configs/x86_64-softmmu.mak
index 4d01883..2ac9177 100644
--- a/default-configs/x86_64-softmmu.mak
+++ b/default-configs/x86_64-softmmu.mak
@@ -12,6 +12,7 @@ CONFIG_ISA_IPMI=y
 CONFIG_IPMI_KCS=y
 CONFIG_IPMI_BT=y
 CONFIG_IPMI_LOCAL=y
+CONFIG_IPMI_EXTERN=y
 CONFIG_SERIAL=y
 CONFIG_PARALLEL=y
 CONFIG_I8254=y
diff --git a/hw/Makefile.objs b/hw/Makefile.objs
index 1b707d7..b87de2c 100644
--- a/hw/Makefile.objs
+++ b/hw/Makefile.objs
@@ -25,6 +25,7 @@ hw-obj-$(CONFIG_ISA_IPMI) += isa_ipmi.o
 hw-obj-$(CONFIG_IPMI_KCS) += ipmi_kcs.o
 hw-obj-$(CONFIG_IPMI_BT) += ipmi_bt.o
 hw-obj-$(CONFIG_IPMI_LOCAL) += ipmi_sim.o
+hw-obj-$(CONFIG_IPMI_EXTERN) += ipmi_extern.o
 
 hw-obj-$(CONFIG_SERIAL) += serial.o
 hw-obj-$(CONFIG_PARALLEL) += parallel.o
diff --git a/hw/ipmi_extern.c b/hw/ipmi_extern.c
new file mode 100644
index 0000000..7761278
--- /dev/null
+++ b/hw/ipmi_extern.c
@@ -0,0 +1,473 @@
+/*
+ * IPMI BMC external connection
+ *
+ * Copyright (c) 2012 Corey Minyard, MontaVista Software, LLC
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+/*
+ * This is designed to connect with OpenIPMI's lanserv serial interface
+ * using the "VM" connection type.  See that for details.
+ */
+
+#include <stdint.h>
+#include "qemu-timer.h"
+#include "qemu-char.h"
+#include "ipmi.h"
+
+#define VM_MSG_CHAR        0xA0 /* Marks end of message */
+#define VM_CMD_CHAR        0xA1 /* Marks end of a command */
+#define VM_ESCAPE_CHAR     0xAA /* Set bit 4 from the next byte to 0 */
+
+#define VM_PROTOCOL_VERSION        1
+#define VM_CMD_VERSION             0xff /* A version number byte follows */
+#define VM_CMD_NOATTN              0x00
+#define VM_CMD_ATTN                0x01
+#define VM_CMD_ATTN_IRQ            0x02
+#define VM_CMD_POWEROFF            0x03
+#define VM_CMD_RESET               0x04
+#define VM_CMD_ENABLE_IRQ          0x05 /* Enable/disable the messaging irq */
+#define VM_CMD_DISABLE_IRQ         0x06
+#define VM_CMD_SEND_NMI            0x07
+#define VM_CMD_CAPABILITIES        0x08
+#define   VM_CAPABILITIES_POWER    0x01
+#define   VM_CAPABILITIES_RESET    0x02
+#define   VM_CAPABILITIES_IRQ      0x04
+#define   VM_CAPABILITIES_NMI      0x08
+#define   VM_CAPABILITIES_ATTN     0x10
+
+typedef struct IPMIExternBmc {
+    IPMIBmc parent;
+
+    int connected;
+    int is_listen;
+
+    unsigned char inbuf[MAX_IPMI_MSG_SIZE + 2];
+    unsigned int inpos;
+    int in_escape;
+    int in_too_many;
+    int waiting_rsp;
+    int sending_cmd;
+
+    unsigned char outbuf[(MAX_IPMI_MSG_SIZE + 2) * 2 + 1];
+    unsigned int outpos;
+    unsigned int outlen;
+
+    struct QEMUTimer *extern_timer;
+
+    /* A reset event is pending to be sent upstream. */
+    int send_reset;
+} IPMIExternBmc;
+
+static int can_receive(void *opaque);
+static void receive(void *opaque, const uint8_t *buf, int size);
+static void chr_event(void *opaque, int event);
+
+static unsigned char
+ipmb_checksum(const unsigned char *data, int size, unsigned char start)
+{
+        unsigned char csum = start;
+
+        for (; size > 0; size--, data++) {
+                csum += *data;
+        }
+        return csum;
+}
+
+static void continue_send(IPMIExternBmc *es)
+{
+    if (es->outlen == 0) {
+        goto check_reset;
+    }
+ send:
+    es->outpos += qemu_chr_fe_write(es->parent.chr, es->outbuf + es->outpos,
+                                    es->outlen - es->outpos);
+    if (es->outpos < es->outlen) {
+        /* Not fully transmitted, try again in a 10ms */
+        qemu_mod_timer(es->extern_timer,
+                       qemu_get_clock_ns(vm_clock) + 10000000);
+    } else {
+        /* Sent */
+        es->outlen = 0;
+        es->outpos = 0;
+        if (!es->sending_cmd) {
+            es->waiting_rsp = 1;
+        } else {
+            es->sending_cmd = 0;
+        }
+    check_reset:
+        if (es->send_reset) {
+            /* Send the reset */
+            es->outbuf[0] = VM_CMD_RESET;
+            es->outbuf[1] = VM_CMD_CHAR;
+            es->outlen = 2;
+            es->outpos = 0;
+            es->send_reset = 0;
+            es->sending_cmd = 1;
+            goto send;
+        }
+
+        if (es->waiting_rsp) {
+            /* Make sure we get a response within 4 seconds. */
+            qemu_mod_timer(es->extern_timer,
+                           qemu_get_clock_ns(vm_clock) + 4000000000ULL);
+        }
+    }
+    return;
+}
+
+static void extern_timeout(void *opaque)
+{
+    IPMIExternBmc *es = opaque;
+    IPMIInterface *s = es->parent.intf;
+
+    ipmi_lock(s);
+    if (es->connected) {
+        if (es->waiting_rsp && (es->outlen == 0)) {
+            IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+            /* The message response timed out, return an error. */
+            es->waiting_rsp = 0;
+            es->inbuf[1] = es->outbuf[1] | 0x04;
+            es->inbuf[2] = es->outbuf[2];
+            es->inbuf[3] = IPMI_CC_TIMEOUT;
+            k->handle_rsp(s, es->outbuf[0], es->inbuf + 1, 3);
+        } else {
+            continue_send(es);
+        }
+    }
+    ipmi_unlock(s);
+}
+
+static void addchar(IPMIExternBmc *es, unsigned char ch)
+{
+    switch (ch) {
+    case VM_MSG_CHAR:
+    case VM_CMD_CHAR:
+    case VM_ESCAPE_CHAR:
+        es->outbuf[es->outlen] = VM_ESCAPE_CHAR;
+        es->outlen++;
+        ch |= 0x10;
+        /* No break */
+
+    default:
+        es->outbuf[es->outlen] = ch;
+        es->outlen++;
+    }
+}
+
+static void ipmi_extern_handle_command(IPMIBmc *b,
+                                       uint8_t *cmd, unsigned int cmd_len,
+                                       unsigned int max_cmd_len,
+                                       uint8_t msg_id)
+{
+    IPMIExternBmc *es = DO_UPCAST(IPMIExternBmc, parent, b);
+    IPMIInterface *s = es->parent.intf;
+    uint8_t err = 0, csum;
+    unsigned int i;
+
+    ipmi_lock(s);
+    if (es->outlen) {
+        /* We already have a command queued.  Shouldn't ever happen. */
+        fprintf(stderr, "IPMI KCS: Got command when not finished with the"
+                " previous commmand\n");
+        abort();
+    }
+
+    /* If it's too short or it was truncated, return an error. */
+    if (cmd_len < 2) {
+        err = IPMI_CC_REQUEST_DATA_LENGTH_INVALID;
+    } else if ((cmd_len > max_cmd_len) || (cmd_len > MAX_IPMI_MSG_SIZE)) {
+        err = IPMI_CC_REQUEST_DATA_TRUNCATED;
+    } else if (!es->connected) {
+        err = IPMI_CC_BMC_INIT_IN_PROGRESS;
+    }
+    if (err) {
+        IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+        unsigned char rsp[3];
+        rsp[0] = cmd[0] | 0x04;
+        rsp[1] = cmd[1];
+        rsp[2] = err;
+        es->waiting_rsp = 0;
+        k->handle_rsp(s, msg_id, rsp, 3);
+        goto out;
+    }
+
+    addchar(es, msg_id);
+    for (i = 0; i < cmd_len; i++) {
+        addchar(es, cmd[i]);
+    }
+    csum = ipmb_checksum(&msg_id, 1, 0);
+    addchar(es, -ipmb_checksum(cmd, cmd_len, csum));
+
+    es->outbuf[es->outlen] = VM_MSG_CHAR;
+    es->outlen++;
+
+    /* Start the transmit */
+    continue_send(es);
+
+ out:
+    ipmi_unlock(s);
+    return;
+}
+
+static void handle_hw_op(IPMIExternBmc *es, unsigned char hw_op)
+{
+    IPMIInterface *s = es->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+
+    switch (hw_op) {
+    case VM_CMD_VERSION:
+        /* We only support one version at this time. */
+        break;
+
+    case VM_CMD_NOATTN:
+        k->set_atn(s, 0, 0);
+        break;
+
+    case VM_CMD_ATTN:
+        k->set_atn(s, 1, 0);
+        break;
+
+    case VM_CMD_ATTN_IRQ:
+        k->set_atn(s, 1, 1);
+        break;
+
+    case VM_CMD_POWEROFF:
+        k->do_hw_op(s, IPMI_POWEROFF_CHASSIS, 0);
+        break;
+
+    case VM_CMD_RESET:
+        k->do_hw_op(s, IPMI_RESET_CHASSIS, 0);
+        break;
+
+    case VM_CMD_ENABLE_IRQ:
+        k->set_irq_enable(s, 1);
+        break;
+
+    case VM_CMD_DISABLE_IRQ:
+        k->set_irq_enable(s, 0);
+        break;
+
+    case VM_CMD_SEND_NMI:
+        k->do_hw_op(s, IPMI_SEND_NMI, 0);
+        break;
+    }
+}
+
+static void handle_msg(IPMIExternBmc *es)
+{
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(es->parent.intf);
+
+    if (es->in_escape) {
+        ipmi_debug("msg escape not ended\n");
+        return;
+    }
+    if (es->inpos < 5) {
+        ipmi_debug("msg too short\n");
+        return;
+    }
+    if (es->in_too_many) {
+        es->inbuf[3] = IPMI_CC_REQUEST_DATA_TRUNCATED;
+        es->inpos = 4;
+    } else if (ipmb_checksum(es->inbuf, es->inpos, 0) != 0) {
+        ipmi_debug("msg checksum failure\n");
+        return;
+    } else {
+        es->inpos--; /* Remove checkum */
+    }
+
+    qemu_del_timer(es->extern_timer);
+    es->waiting_rsp = 0;
+    k->handle_rsp(es->parent.intf, es->inbuf[0], es->inbuf + 1, es->inpos - 1);
+}
+
+static int can_receive(void *opaque)
+{
+    return 1;
+}
+
+static void receive(void *opaque, const uint8_t *buf, int size)
+{
+    IPMIExternBmc *es = opaque;
+    IPMIInterface *s = es->parent.intf;
+    int i;
+    unsigned char hw_op;
+
+    ipmi_lock(s);
+    for (i = 0; i < size; i++) {
+        unsigned char ch = buf[i];
+
+        switch (ch) {
+        case VM_MSG_CHAR:
+            handle_msg(es);
+            es->in_too_many = 0;
+            es->inpos = 0;
+            break;
+
+        case VM_CMD_CHAR:
+            if (es->in_too_many) {
+                ipmi_debug("cmd in too many\n");
+                es->in_too_many = 0;
+                es->inpos = 0;
+                break;
+            }
+            if (es->in_escape) {
+                ipmi_debug("cmd in escape\n");
+                es->in_too_many = 0;
+                es->inpos = 0;
+                es->in_escape = 0;
+                break;
+            }
+            es->in_too_many = 0;
+            if (es->inpos < 1) {
+                break;
+            }
+            hw_op = es->inbuf[0];
+            es->inpos = 0;
+            goto out_hw_op;
+            break;
+
+        case VM_ESCAPE_CHAR:
+            es->in_escape = 1;
+            break;
+
+        default:
+            if (es->in_escape) {
+                ch &= ~0x10;
+                es->in_escape = 0;
+            }
+            if (es->in_too_many) {
+                break;
+            }
+            if (es->inpos >= sizeof(es->inbuf)) {
+                es->in_too_many = 1;
+                break;
+            }
+            es->inbuf[es->inpos] = ch;
+            es->inpos++;
+            break;
+        }
+    }
+    ipmi_unlock(s);
+    return;
+
+ out_hw_op:
+    ipmi_unlock(s);
+    /*
+     * We don't want to handle hardware operations while holding the
+     * lock, that may call back into this code to report a reset.
+     */
+    handle_hw_op(es, hw_op);
+}
+
+static void chr_event(void *opaque, int event)
+{
+    IPMIExternBmc *es = opaque;
+    IPMIInterface *s = es->parent.intf;
+    IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);
+    unsigned char v;
+
+    ipmi_lock(s);
+    switch (event) {
+    case CHR_EVENT_OPENED:
+        es->connected = 1;
+        es->outpos = 0;
+        es->outlen = 0;
+        addchar(es, VM_CMD_VERSION);
+        addchar(es, VM_PROTOCOL_VERSION);
+        es->outbuf[es->outlen] = VM_CMD_CHAR;
+        es->outlen++;
+        addchar(es, VM_CMD_CAPABILITIES);
+        v = VM_CAPABILITIES_IRQ | VM_CAPABILITIES_ATTN;
+        if (k->do_hw_op(es->parent.intf, IPMI_POWEROFF_CHASSIS, 1) == 0) {
+            v |= VM_CAPABILITIES_POWER;
+        }
+        if (k->do_hw_op(es->parent.intf, IPMI_RESET_CHASSIS, 1) == 0) {
+            v |= VM_CAPABILITIES_RESET;
+        }
+        if (k->do_hw_op(es->parent.intf, IPMI_SEND_NMI, 1) == 0) {
+            v |= VM_CAPABILITIES_NMI;
+        }
+        addchar(es, v);
+        es->outbuf[es->outlen] = VM_CMD_CHAR;
+        es->outlen++;
+        es->sending_cmd = 0;
+        continue_send(es);
+        break;
+
+    case CHR_EVENT_CLOSED:
+        if (!es->connected) {
+            return;
+        }
+        es->connected = 0;
+        if (es->waiting_rsp) {
+            es->waiting_rsp = 0;
+            es->inbuf[1] = es->outbuf[1] | 0x04;
+            es->inbuf[2] = es->outbuf[2];
+            es->inbuf[3] = IPMI_CC_BMC_INIT_IN_PROGRESS;
+            k->handle_rsp(s, es->outbuf[0], es->inbuf + 1, 3);
+        }
+        break;
+    }
+    ipmi_unlock(s);
+}
+
+static void ipmi_extern_handle_reset(IPMIBmc *b)
+{
+    IPMIExternBmc *es = DO_UPCAST(IPMIExternBmc, parent, b);
+    IPMIInterface *s = es->parent.intf;
+
+    ipmi_lock(s);
+    es->send_reset = 1;
+    continue_send(es);
+    ipmi_unlock(s);
+}
+
+static int ipmi_extern_init(IPMIBmc *b)
+{
+    IPMIExternBmc *es = DO_UPCAST(IPMIExternBmc, parent, b);
+
+    es->extern_timer = qemu_new_timer_ns(vm_clock, extern_timeout, es);
+    qemu_chr_add_handlers(es->parent.chr, can_receive, receive, chr_event, es);
+    return 0;
+}
+
+static void ipmi_extern_class_init(ObjectClass *klass, void *data)
+{
+    IPMIBmcClass *bk = IPMI_BMC_CLASS(klass);
+
+    bk->init = ipmi_extern_init;
+    bk->handle_command = ipmi_extern_handle_command;
+    bk->handle_reset = ipmi_extern_handle_reset;
+}
+
+static TypeInfo ipmi_extern_type = {
+    .name          = "ipmi-bmc-extern",
+    .parent        = TYPE_IPMI_BMC,
+    .instance_size = sizeof(IPMIExternBmc),
+    .class_init    = ipmi_extern_class_init,
+};
+
+static void ipmi_extern_register_types(void)
+{
+    type_register_static(&ipmi_extern_type);
+}
+
+type_init(ipmi_extern_register_types)
-- 
1.7.4.1

[Qemu-devel] [PATCH 17/18] IPMI: Add tests

[minyard]

From: Corey Minyard <cminyard@mvista.com>

Test the KCS interface with a local BMC and a BT interface with an
external BMC.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 tests/Makefile        |    4 +
 tests/ipmi-test-bt.c  |  440 +++++++++++++++++++++++++++++++++++++++++++++++++
 tests/ipmi-test-kcs.c |  295 +++++++++++++++++++++++++++++++++
 3 files changed, 739 insertions(+), 0 deletions(-)
 create mode 100644 tests/ipmi-test-bt.c
 create mode 100644 tests/ipmi-test-kcs.c

diff --git a/tests/Makefile b/tests/Makefile
index d687ecc..3356b62 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -22,6 +22,8 @@ check-block-$(CONFIG_POSIX) += tests/qemu-iotests-quick.sh
 # really in libqtest, not in the testcases themselves.
 check-qtest-i386-y = tests/fdc-test$(EXESUF)
 check-qtest-i386-y += tests/rtc-test$(EXESUF)
+check-qtest-i386-y += tests/ipmi-test-kcs$(EXESUF)
+check-qtest-i386-y += tests/ipmi-test-bt$(EXESUF)
 check-qtest-x86_64-y = $(check-qtest-i386-y)
 check-qtest-sparc-y = tests/m48t59-test$(EXESUF)
 check-qtest-sparc64-y = tests/m48t59-test$(EXESUF)
@@ -70,6 +72,8 @@ tests/test-qmp-commands$(EXESUF): tests/test-qmp-commands.o tests/test-qmp-marsh
 tests/test-visitor-serialization$(EXESUF): tests/test-visitor-serialization.o $(test-qapi-obj-y)
 
 tests/rtc-test$(EXESUF): tests/rtc-test.o $(trace-obj-y)
+tests/ipmi-test-kcs$(EXESUF): tests/ipmi-test-kcs.o $(trace-obj-y)
+tests/ipmi-test-bt$(EXESUF): tests/ipmi-test-bt.o $(trace-obj-y)
 tests/m48t59-test$(EXESUF): tests/m48t59-test.o $(trace-obj-y)
 tests/fdc-test$(EXESUF): tests/fdc-test.o tests/libqtest.o $(trace-obj-y)
 
diff --git a/tests/ipmi-test-bt.c b/tests/ipmi-test-bt.c
new file mode 100644
index 0000000..c1da325
--- /dev/null
+++ b/tests/ipmi-test-bt.c
@@ -0,0 +1,440 @@
+/*
+ * IPMI BT test cases, using the external interface for checking
+ *
+ * Copyright (c) 2012 Corey Minyard <cminyard@mvista.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include <sys/types.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <netinet/tcp.h>
+
+#include <glib.h>
+
+#include "libqtest.h"
+#include "qemu-common.h"
+
+#define IPMI_IRQ        5
+
+#define IPMI_BT_BASE    0xe4
+
+#define IPMI_BT_CTLREG_CLR_WR_PTR  0
+#define IPMI_BT_CTLREG_CLR_RD_PTR  1
+#define IPMI_BT_CTLREG_H2B_ATN     2
+#define IPMI_BT_CTLREG_B2H_ATN     3
+#define IPMI_BT_CTLREG_SMS_ATN     4
+#define IPMI_BT_CTLREG_H_BUSY      6
+#define IPMI_BT_CTLREG_B_BUSY      7
+
+#define IPMI_BT_CTLREG_GET(b) ((bt_get_ctrlreg() >> (b)) & 1)
+#define IPMI_BT_CTLREG_GET_H2B_ATN() IPMI_BT_CTLREG_GET(IPMI_BT_CTLREG_H2B_ATN)
+#define IPMI_BT_CTLREG_GET_B2H_ATN() IPMI_BT_CTLREG_GET(IPMI_BT_CTLREG_B2H_ATN)
+#define IPMI_BT_CTLREG_GET_SMS_ATN() IPMI_BT_CTLREG_GET(IPMI_BT_CTLREG_SMS_ATN)
+#define IPMI_BT_CTLREG_GET_H_BUSY()  IPMI_BT_CTLREG_GET(IPMI_BT_CTLREG_H_BUSY)
+#define IPMI_BT_CTLREG_GET_B_BUSY()  IPMI_BT_CTLREG_GET(IPMI_BT_CTLREG_B_BUSY)
+
+#define IPMI_BT_CTLREG_SET(b) bt_write_ctrlreg(1 << (b))
+#define IPMI_BT_CTLREG_SET_CLR_WR_PTR() IPMI_BT_CTLREG_SET( \
+                                                IPMI_BT_CTLREG_CLR_WR_PTR)
+#define IPMI_BT_CTLREG_SET_CLR_RD_PTR() IPMI_BT_CTLREG_SET( \
+                                                IPMI_BT_CTLREG_CLR_RD_PTR)
+#define IPMI_BT_CTLREG_SET_H2B_ATN()  IPMI_BT_CTLREG_SET(IPMI_BT_CTLREG_H2B_ATN)
+#define IPMI_BT_CTLREG_SET_B2H_ATN()  IPMI_BT_CTLREG_SET(IPMI_BT_CTLREG_B2H_ATN)
+#define IPMI_BT_CTLREG_SET_SMS_ATN()  IPMI_BT_CTLREG_SET(IPMI_BT_CTLREG_SMS_ATN)
+#define IPMI_BT_CTLREG_SET_H_BUSY()   IPMI_BT_CTLREG_SET(IPMI_BT_CTLREG_H_BUSY)
+
+static int bt_ints_enabled;
+
+static uint8_t bt_get_ctrlreg(void)
+{
+    return inb(IPMI_BT_BASE);
+}
+
+static void bt_write_ctrlreg(uint8_t val)
+{
+    outb(IPMI_BT_BASE, val);
+}
+
+static uint8_t bt_get_buf(void)
+{
+    return inb(IPMI_BT_BASE + 1);
+}
+
+static void bt_write_buf(uint8_t val)
+{
+    outb(IPMI_BT_BASE + 1, val);
+}
+
+static uint8_t bt_get_irqreg(void)
+{
+    return inb(IPMI_BT_BASE + 2);
+}
+
+static void bt_write_irqreg(uint8_t val)
+{
+    outb(IPMI_BT_BASE + 2, val);
+}
+
+static void bt_wait_b_busy(void)
+{
+    unsigned int count = 1000;
+    while (IPMI_BT_CTLREG_GET_B_BUSY() != 0) {
+        g_assert(--count != 0);
+    }
+}
+
+static void bt_wait_b2h_atn(void)
+{
+    unsigned int count = 1000;
+    while (IPMI_BT_CTLREG_GET_B2H_ATN() == 0) {
+        g_assert(--count != 0);
+    }
+}
+
+
+static int emu_lfd;
+static int emu_fd;
+static in_port_t emu_port;
+static uint8_t inbuf[100];
+static unsigned int inbuf_len;
+static unsigned int inbuf_pos;
+static int last_was_aa;
+
+static void read_emu_data(void)
+{
+    fd_set readfds;
+    int rv;
+    struct timeval tv;
+
+    FD_ZERO(&readfds);
+    FD_SET(emu_fd, &readfds);
+    tv.tv_sec = 10;
+    tv.tv_usec = 0;
+    rv = select(emu_fd + 1, &readfds, NULL, NULL, &tv);
+    if (rv == -1) {
+        perror("select");
+    }
+    g_assert(rv == 1);
+    rv = read(emu_fd, inbuf, sizeof(inbuf));
+    if (rv == -1) {
+        perror("read");
+    }
+    g_assert(rv > 0);
+    inbuf_len = rv;
+    inbuf_pos = 0;
+}
+
+static void write_emu_msg(uint8_t *msg, unsigned int len)
+{
+    int rv;
+
+#ifdef DEBUG_TEST
+    {
+        unsigned int i;
+        printf("sending:");
+        for (i = 0; i < len; i++) {
+            printf(" %2.2x", msg[i]);
+        }
+        printf("\n");
+    }
+#endif
+    rv = write(emu_fd, msg, len);
+    g_assert(rv == len);
+}
+
+static void get_emu_msg(uint8_t *msg, unsigned int *len)
+{
+    unsigned int outpos = 0;
+
+    for (;;) {
+        while (inbuf_pos < inbuf_len) {
+            uint8_t ch = inbuf[inbuf_pos++];
+
+            g_assert(outpos < *len);
+            if (last_was_aa) {
+                assert(ch & 0x10);
+                msg[outpos++] = ch & ~0x10;
+                last_was_aa = 0;
+            } else if (ch == 0xaa) {
+                last_was_aa = 1;
+            } else {
+                msg[outpos++] = ch;
+                if ((ch == 0xa0) || (ch == 0xa1)) {
+                    /* Message complete */
+                    *len = outpos;
+                    goto done;
+                }
+            }
+        }
+        read_emu_data();
+    }
+ done:
+#ifdef DEBUG_TEST
+    {
+        unsigned int i;
+        printf("Msg:");
+        for (i = 0; i < outpos; i++) {
+            printf(" %2.2x", msg[i]);
+        }
+        printf("\n");
+    }
+#endif
+    return;
+}
+
+static uint8_t
+ipmb_checksum(const unsigned char *data, int size, unsigned char start)
+{
+        unsigned char csum = start;
+
+        for (; size > 0; size--, data++) {
+                csum += *data;
+        }
+        return csum;
+}
+
+static uint8_t get_dev_id_cmd[] = { 0x18, 0x01 };
+static uint8_t get_dev_id_rsp[] = { 0x1c, 0x01, 0x00, 0x20, 0x00, 0x00, 0x00,
+                                    0x02, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+static uint8_t set_bmc_globals_cmd[] = { 0x18, 0x2e, 0x0f };
+static uint8_t set_bmc_globals_rsp[] = { 0x1c, 0x2e, 0x00 };
+static uint8_t enable_irq_cmd[] = { 0x05, 0xa1 };
+
+static void emu_msg_handler(void)
+{
+    uint8_t msg[100];
+    unsigned int msg_len = sizeof(msg);
+
+    get_emu_msg(msg, &msg_len);
+    g_assert(msg_len >= 5);
+    g_assert(msg[msg_len - 1] == 0xa0);
+    msg_len--;
+    g_assert(ipmb_checksum(msg, msg_len, 0) == 0);
+    msg_len--;
+    if ((msg[1] == get_dev_id_cmd[0]) && (msg[2] == get_dev_id_cmd[1])) {
+        memcpy(msg + 1, get_dev_id_rsp, sizeof(get_dev_id_rsp));
+        msg_len = sizeof(get_dev_id_rsp) + 1;
+        msg[msg_len] = -ipmb_checksum(msg, msg_len, 0);
+        msg_len++;
+        msg[msg_len++] = 0xa0;
+        write_emu_msg(msg, msg_len);
+    } else if ((msg[1] == set_bmc_globals_cmd[0]) &&
+               (msg[2] == set_bmc_globals_cmd[1])) {
+        memcpy(msg + 1, set_bmc_globals_rsp, sizeof(set_bmc_globals_rsp));
+        msg_len = sizeof(set_bmc_globals_rsp) + 1;
+        msg[msg_len] = -ipmb_checksum(msg, msg_len, 0);
+        msg_len++;
+        msg[msg_len++] = 0xa0;
+        write_emu_msg(msg, msg_len);
+        write_emu_msg(enable_irq_cmd, sizeof(enable_irq_cmd));
+    } else {
+        g_assert(0);
+    }
+}
+
+static void bt_cmd(uint8_t *cmd, unsigned int cmd_len,
+                    uint8_t *rsp, unsigned int *rsp_len)
+{
+    unsigned int i, len, j = 0;
+    uint8_t seq = 5;
+
+    /* Should be idle */
+    g_assert(bt_get_ctrlreg() == 0);
+
+    bt_wait_b_busy();
+    IPMI_BT_CTLREG_SET_CLR_WR_PTR();
+    bt_write_buf(cmd_len + 1);
+    bt_write_buf(cmd[0]);
+    bt_write_buf(seq);
+    for (i = 1; i < cmd_len; i++) {
+        bt_write_buf(cmd[i]);
+    }
+    IPMI_BT_CTLREG_SET_H2B_ATN();
+
+    emu_msg_handler(); /* We should get a message on the socket here. */
+
+    bt_wait_b2h_atn();
+    if (bt_ints_enabled) {
+        g_assert((bt_get_irqreg() & 0x02) == 0x02);
+        g_assert(get_irq(IPMI_IRQ));
+        bt_write_irqreg(0x03);
+    } else {
+        g_assert(!get_irq(IPMI_IRQ));
+    }
+    IPMI_BT_CTLREG_SET_H_BUSY();
+    IPMI_BT_CTLREG_SET_B2H_ATN();
+    IPMI_BT_CTLREG_SET_CLR_RD_PTR();
+    len = bt_get_buf();
+    g_assert(len >= 4);
+    rsp[0] = bt_get_buf();
+    assert(bt_get_buf() == seq);
+    len--;
+    for (j = 1; j < len; j++) {
+        rsp[j] = bt_get_buf();
+    }
+    IPMI_BT_CTLREG_SET_H_BUSY();
+    *rsp_len = j;
+}
+
+
+/*
+ * We should get a connect request and a short message with capabilities.
+ */
+static void test_connect(void)
+{
+    fd_set readfds;
+    int rv;
+    int val;
+    struct timeval tv;
+    uint8_t msg[100];
+    unsigned int msglen;
+    static uint8_t exp1[] = { 0xff, 0x01, 0xa1 }; /* A protocol version */
+    static uint8_t exp2[] = { 0x08, 0x1f, 0xa1 }; /* A capabilities cmd */
+    static uint8_t exp3[] = { 0x04, 0xa1 }; /* A reset is reported */
+
+    FD_ZERO(&readfds);
+    FD_SET(emu_lfd, &readfds);
+    tv.tv_sec = 10;
+    tv.tv_usec = 0;
+    rv = select(emu_lfd + 1, &readfds, NULL, NULL, &tv);
+    g_assert(rv == 1);
+    emu_fd = accept(emu_lfd, NULL, 0);
+    if (emu_fd < 0) {
+        perror("accept");
+    }
+    g_assert(emu_fd >= 0);
+
+    val = 1;
+    rv = setsockopt(emu_fd, IPPROTO_TCP, TCP_NODELAY, &val, sizeof(val));
+    g_assert(rv != -1);
+
+    /* Report our version */
+    write_emu_msg(exp1, sizeof(exp1));
+
+    /* Validate that we get the info we expect. */
+    msglen = sizeof(msg);
+    get_emu_msg(msg, &msglen);
+    g_assert(msglen == sizeof(exp1));
+    g_assert(memcmp(msg, exp1, msglen) == 0);
+    msglen = sizeof(msg);
+    get_emu_msg(msg, &msglen);
+    g_assert(msglen == sizeof(exp2));
+    g_assert(memcmp(msg, exp2, msglen) == 0);
+    msglen = sizeof(msg);
+    get_emu_msg(msg, &msglen);
+    g_assert(msglen == sizeof(exp3));
+    g_assert(memcmp(msg, exp3, msglen) == 0);
+}
+
+/*
+ * Send a get_device_id to do a basic test.
+ */
+static void test_bt_base(void)
+{
+    uint8_t rsp[20];
+    unsigned int rsplen = sizeof(rsp);
+
+    bt_cmd(get_dev_id_cmd, sizeof(get_dev_id_cmd), rsp, &rsplen);
+    g_assert(rsplen == sizeof(get_dev_id_rsp));
+    g_assert(memcmp(get_dev_id_rsp, rsp, rsplen) == 0);
+}
+
+/*
+ * Enable IRQs for the interface.
+ */
+static void test_enable_irq(void)
+{
+    uint8_t rsp[20];
+    unsigned int rsplen = sizeof(rsp);
+
+    bt_cmd(set_bmc_globals_cmd, sizeof(set_bmc_globals_cmd), rsp, &rsplen);
+    g_assert(rsplen == sizeof(set_bmc_globals_rsp));
+    g_assert(memcmp(set_bmc_globals_rsp, rsp, rsplen) == 0);
+    bt_write_irqreg(0x01);
+    bt_ints_enabled = 1;
+}
+
+/*
+ * Create a local TCP socket with any port, then save off the port we got.
+ */
+static void open_socket(void)
+{
+    struct sockaddr_in myaddr;
+    socklen_t addrlen;
+
+    myaddr.sin_family = AF_INET;
+    myaddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    myaddr.sin_port = 0;
+    emu_lfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+    if (emu_lfd == -1) {
+        perror("socket");
+        exit(1);
+    }
+    if (bind(emu_lfd, (struct sockaddr *) &myaddr, sizeof(myaddr)) == -1) {
+        perror("bind");
+        exit(1);
+    }
+    addrlen = sizeof(myaddr);
+    if (getsockname(emu_lfd, (struct sockaddr *) &myaddr , &addrlen) == -1) {
+        perror("getsockname");
+        exit(1);
+    }
+    emu_port = ntohs(myaddr.sin_port);
+    assert(listen(emu_lfd, 1) != -1);
+}
+
+int main(int argc, char **argv)
+{
+    const char *arch = qtest_get_arch();
+    char *cmdline;
+    int ret;
+
+    /* Check architecture */
+    if (strcmp(arch, "i386") && strcmp(arch, "x86_64")) {
+        g_test_message("Skipping test for non-x86\n");
+        return 0;
+    }
+
+    open_socket();
+
+    /* Run the tests */
+    g_test_init(&argc, &argv, NULL);
+
+    cmdline = g_strdup_printf("-vnc none"
+          " -chardev socket,id=ipmi0,host=localhost,port=%d,reconnect=10"
+          " -device isa-ipmi,interface=bt,chardev=ipmi0", emu_port);
+    qtest_start(cmdline);
+    qtest_irq_intercept_in(global_qtest, "ioapic");
+    qtest_add_func("/ipmi/extern/connect", test_connect);
+    qtest_add_func("/ipmi/extern/bt_base", test_bt_base);
+    qtest_add_func("/ipmi/extern/bt_enable_irq", test_enable_irq);
+    qtest_add_func("/ipmi/extern/bt_base_irq", test_bt_base);
+    ret = g_test_run();
+    qtest_quit(global_qtest);
+
+    return ret;
+}
diff --git a/tests/ipmi-test-kcs.c b/tests/ipmi-test-kcs.c
new file mode 100644
index 0000000..9613705
--- /dev/null
+++ b/tests/ipmi-test-kcs.c
@@ -0,0 +1,295 @@
+/*
+ * IPMI KCS test cases, using the local interface.
+ *
+ * Copyright (c) 2012 Corey Minyard <cminyard@mvista.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+
+#include <glib.h>
+
+#include "libqtest.h"
+#include "qemu-common.h"
+
+#define IPMI_IRQ        5
+
+#define IPMI_KCS_BASE   0xca0
+
+#define IPMI_KCS_STATUS_ABORT           0x60
+#define IPMI_KCS_CMD_WRITE_START        0x61
+#define IPMI_KCS_CMD_WRITE_END          0x62
+#define IPMI_KCS_CMD_READ               0x68
+
+#define IPMI_KCS_ABORTED_BY_CMD         0x01
+
+#define IPMI_KCS_CMDREG_GET_STATE() ((kcs_get_cmdreg() >> 6) & 3)
+#define IPMI_KCS_STATE_IDLE     0
+#define IPMI_KCS_STATE_READ     1
+#define IPMI_KCS_STATE_WRITE    2
+#define IPMI_KCS_STATE_ERROR    3
+#define IPMI_KCS_CMDREG_GET_CD()    ((kcs_get_cmdreg() >> 3) & 1)
+#define IPMI_KCS_CMDREG_GET_ATN()   ((kcs_get_cmdreg() >> 2) & 1)
+#define IPMI_KCS_CMDREG_GET_IBF()   ((kcs_get_cmdreg() >> 1) & 1)
+#define IPMI_KCS_CMDREG_GET_OBF()   ((kcs_get_cmdreg() >> 0) & 1)
+
+static int kcs_ints_enabled;
+
+static uint8_t kcs_get_cmdreg(void)
+{
+    return inb(IPMI_KCS_BASE + 1);
+}
+
+static void kcs_write_cmdreg(uint8_t val)
+{
+    outb(IPMI_KCS_BASE + 1, val);
+}
+
+static uint8_t kcs_get_datareg(void)
+{
+    return inb(IPMI_KCS_BASE);
+}
+
+static void kcs_write_datareg(uint8_t val)
+{
+    outb(IPMI_KCS_BASE, val);
+}
+
+static void kcs_wait_ibf(void)
+{
+    unsigned int count = 1000;
+    while (IPMI_KCS_CMDREG_GET_IBF() != 0) {
+        g_assert(--count != 0);
+    }
+}
+
+static void kcs_wait_obf(void)
+{
+    unsigned int count = 1000;
+    while (IPMI_KCS_CMDREG_GET_OBF() == 0) {
+        g_assert(--count != 0);
+    }
+}
+
+static void kcs_clear_obf(void)
+{
+    if (kcs_ints_enabled) {
+        g_assert(get_irq(IPMI_IRQ));
+    } else {
+        g_assert(!get_irq(IPMI_IRQ));
+    }
+    g_assert(IPMI_KCS_CMDREG_GET_OBF() == 1);
+    kcs_get_datareg();
+    g_assert(IPMI_KCS_CMDREG_GET_OBF() == 0);
+    g_assert(!get_irq(IPMI_IRQ));
+}
+
+static void kcs_check_state(uint8_t state)
+{
+    g_assert(IPMI_KCS_CMDREG_GET_STATE() == state);
+}
+
+static void kcs_cmd(uint8_t *cmd, unsigned int cmd_len,
+                    uint8_t *rsp, unsigned int *rsp_len)
+{
+    unsigned int i, j = 0;
+
+    /* Should be idle */
+    g_assert(kcs_get_cmdreg() == 0);
+
+    kcs_write_cmdreg(IPMI_KCS_CMD_WRITE_START);
+    kcs_wait_ibf();
+    kcs_check_state(IPMI_KCS_STATE_WRITE);
+    kcs_clear_obf();
+    for (i = 0; i < cmd_len; i++) {
+        kcs_write_datareg(cmd[i]);
+        kcs_wait_ibf();
+        kcs_check_state(IPMI_KCS_STATE_WRITE);
+        kcs_clear_obf();
+    }
+    kcs_write_cmdreg(IPMI_KCS_CMD_WRITE_END);
+    kcs_wait_ibf();
+    kcs_check_state(IPMI_KCS_STATE_WRITE);
+    kcs_clear_obf();
+    kcs_write_datareg(0);
+ next_read_byte:
+    kcs_wait_ibf();
+    switch (IPMI_KCS_CMDREG_GET_STATE()) {
+    case IPMI_KCS_STATE_READ:
+        kcs_wait_obf();
+        g_assert(j < *rsp_len);
+        rsp[j++] = kcs_get_datareg();
+        kcs_write_datareg(IPMI_KCS_CMD_READ);
+        goto next_read_byte;
+        break;
+
+    case IPMI_KCS_STATE_IDLE:
+        kcs_wait_obf();
+        kcs_get_datareg();
+        break;
+
+    default:
+        g_assert(0);
+    }
+    *rsp_len = j;
+}
+
+static void kcs_abort(uint8_t *cmd, unsigned int cmd_len,
+                      uint8_t *rsp, unsigned int *rsp_len)
+{
+    unsigned int i, j = 0;
+    unsigned int retries = 4;
+
+    /* Should be idle */
+    g_assert(kcs_get_cmdreg() == 0);
+
+    kcs_write_cmdreg(IPMI_KCS_CMD_WRITE_START);
+    kcs_wait_ibf();
+    kcs_check_state(IPMI_KCS_STATE_WRITE);
+    kcs_clear_obf();
+    for (i = 0; i < cmd_len; i++) {
+        kcs_write_datareg(cmd[i]);
+        kcs_wait_ibf();
+        kcs_check_state(IPMI_KCS_STATE_WRITE);
+        kcs_clear_obf();
+    }
+    kcs_write_cmdreg(IPMI_KCS_CMD_WRITE_END);
+    kcs_wait_ibf();
+    kcs_check_state(IPMI_KCS_STATE_WRITE);
+    kcs_clear_obf();
+    kcs_write_datareg(0);
+    kcs_wait_ibf();
+    switch (IPMI_KCS_CMDREG_GET_STATE()) {
+    case IPMI_KCS_STATE_READ:
+        kcs_wait_obf();
+        g_assert(j < *rsp_len);
+        rsp[j++] = kcs_get_datareg();
+        kcs_write_datareg(IPMI_KCS_CMD_READ);
+        break;
+
+    default:
+        g_assert(0);
+    }
+
+    /* Start the abort here */
+ retry_abort:
+    g_assert(retries > 0);
+
+    kcs_wait_ibf();
+    kcs_write_cmdreg(IPMI_KCS_STATUS_ABORT);
+    kcs_wait_ibf();
+    kcs_clear_obf();
+    kcs_write_datareg(0);
+    kcs_wait_ibf();
+    if (IPMI_KCS_CMDREG_GET_STATE() != IPMI_KCS_STATE_READ) {
+        retries--;
+        goto retry_abort;
+    }
+    kcs_wait_obf();
+    rsp[0] = kcs_get_datareg();
+    kcs_write_datareg(IPMI_KCS_CMD_READ);
+    kcs_wait_ibf();
+    if (IPMI_KCS_CMDREG_GET_STATE() != IPMI_KCS_STATE_IDLE) {
+        retries--;
+        goto retry_abort;
+    }
+    kcs_wait_obf();
+    kcs_clear_obf();
+
+    *rsp_len = j;
+}
+
+
+static uint8_t get_dev_id_cmd[] = { 0x18, 0x01 };
+static uint8_t get_dev_id_rsp[] = { 0x1c, 0x01, 0x00, 0x20, 0x00, 0x00, 0x00,
+                                    0x02, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+/*
+ * Send a get_device_id to do a basic test.
+ */
+static void test_kcs_base(void)
+{
+    uint8_t rsp[20];
+    unsigned int rsplen = sizeof(rsp);
+
+    kcs_cmd(get_dev_id_cmd, sizeof(get_dev_id_cmd), rsp, &rsplen);
+    g_assert(rsplen == sizeof(get_dev_id_rsp));
+    g_assert(memcmp(get_dev_id_rsp, rsp, rsplen) == 0);
+}
+
+/*
+ * Abort a kcs operation while reading
+ */
+static void test_kcs_abort(void)
+{
+    uint8_t rsp[20];
+    unsigned int rsplen = sizeof(rsp);
+
+    kcs_abort(get_dev_id_cmd, sizeof(get_dev_id_cmd), rsp, &rsplen);
+    g_assert(rsp[0] == IPMI_KCS_ABORTED_BY_CMD);
+}
+
+static uint8_t set_bmc_globals_cmd[] = { 0x18, 0x2e, 0x0f };
+static uint8_t set_bmc_globals_rsp[] = { 0x1c, 0x2e, 0x00 };
+
+/*
+ * Enable interrupts
+ */
+static void test_enable_irq(void)
+{
+    uint8_t rsp[20];
+    unsigned int rsplen = sizeof(rsp);
+
+    kcs_cmd(set_bmc_globals_cmd, sizeof(set_bmc_globals_cmd), rsp, &rsplen);
+    g_assert(rsplen == sizeof(set_bmc_globals_rsp));
+    g_assert(memcmp(set_bmc_globals_rsp, rsp, rsplen) == 0);
+    kcs_ints_enabled = 1;
+}
+
+int main(int argc, char **argv)
+{
+    const char *arch = qtest_get_arch();
+    char *cmdline;
+    int ret;
+
+    /* Check architecture */
+    if (strcmp(arch, "i386") && strcmp(arch, "x86_64")) {
+        g_test_message("Skipping test for non-x86\n");
+        return 0;
+    }
+
+    /* Run the tests */
+    g_test_init(&argc, &argv, NULL);
+
+    cmdline = g_strdup_printf("-vnc none -device isa-ipmi");
+    qtest_start(cmdline);
+    qtest_irq_intercept_in(global_qtest, "ioapic");
+    qtest_add_func("/ipmi/local/kcs_base", test_kcs_base);
+    qtest_add_func("/ipmi/local/kcs_abort", test_kcs_abort);
+    qtest_add_func("/ipmi/local/kcs_enable_irq", test_enable_irq);
+    qtest_add_func("/ipmi/local/kcs_base_irq", test_kcs_base);
+    qtest_add_func("/ipmi/local/kcs_abort_irq", test_kcs_abort);
+    ret = g_test_run();
+    qtest_quit(global_qtest);
+
+    return ret;
+}
-- 
1.7.4.1

[Qemu-devel] [PATCH 18/18] IPMI: Add documentation.

[minyard]

From: Corey Minyard <cminyard@mvista.com>

Add some basic documentation for the IPMI device.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
 qemu-options.hx |   35 +++++++++++++++++++++++++++++++++++
 1 files changed, 35 insertions(+), 0 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index c5f592c..598b3d3 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -558,6 +558,41 @@ Add device @var{driver}.  @var{prop}=@var{value} sets driver
 properties.  Valid properties depend on the driver.  To get help on
 possible drivers and properties, use @code{-device ?} and
 @code{-device @var{driver},?}.
+
+Some drivers are:
+@item -device isa-ipmi[,interface=kcs|bt][,iobase=@var{val}][,irq=@var{val}][,slave_addr=@var{val}][,chardev=name]
+
+Add an IPMI device.  This also adds a corresponding SMBIOS entry to the
+SMBIOS tables for x86.  The following options are handled:
+@table @option
+@item interface=kcs|bt
+Define the interface type to use.  Currently the IPMI-defined KCS and
+BT interfaces are handled.  The default is KCS.
+@item iobase=@var{val}
+Define the I/O address of the interface.  The default is 0xca0 for KCS
+and 0xe4 for BT.
+@item irq=@var{val}
+Define the interrupt to use.  The default is 5.  To disable interrupts,
+set this to 0.
+@item slave_addr=@var{val}
+The IPMI slave address to use for the BMC.  The default is 0x20.
+@item chardev=name
+If a chardev is not specified, the IPMI driver uses a built-in baseboard
+management controller (BMC) simulator.  It provides a basic BMC with a
+watchdog timer and associated sensor.
+
+If a chardev is specified, A connection is made to an external BMC
+simulator.  If you do this, it is strongly recommended that you use
+the "reconnect=" chardev option to reconnect to the simulator if the
+connection is lost.  Note that if this is not used carefully, it can
+be a security issue, as the interface has the ability to send resets,
+NMIs, and power off the VM.  It's best if QEMU makes a connection to
+an external simulator running on a secure port on localhost, so
+neither the simulator nor QEMU is exposed to any outside network.
+
+See the "lanserv/README.vm" file in the OpenIPMI library for more
+details on the external interface.
+@end table
 ETEXI
 
 DEFHEADING()
-- 
1.7.4.1

Re: [Qemu-devel] Third shot at adding IPMI to qemu

[Paolo Bonzini]

Il 19/07/2012 20:53, minyard@acm.org ha scritto:
> Ok, everything passes through checkpatch without an error now.  I have
> added some tests to verify basic operation of the device, and I've
> hacked in some documentation, though I'm not sure if it's in the proper
> location, as I never got a response to my questions about it.
> 
> I would have liked to add tests for the watchdog timer, but there
> doesn't appear to be a way to intercept resets or NMIs in the test
> framework.

I reviewed the basic QOM plumbing and it looks ok.

Paolo

Re: [Qemu-devel] Third shot at adding IPMI to qemu

[Corey Minyard]

I haven't heard anything on this.  Any comments or movement on this set 
of patches?

Thanks,

-corey

On 07/19/2012 01:53 PM, minyard@acm.org wrote:
> Ok, everything passes through checkpatch without an error now.  I have
> added some tests to verify basic operation of the device, and I've
> hacked in some documentation, though I'm not sure if it's in the proper
> location, as I never got a response to my questions about it.
>
> I would have liked to add tests for the watchdog timer, but there
> doesn't appear to be a way to intercept resets or NMIs in the test
> framework.
>
> -corey
>
>

Re: [Qemu-devel] Third shot at adding IPMI to qemu

[Andreas Färber]

Am 30.07.2012 15:34, schrieb Corey Minyard:
> I haven't heard anything on this.

FWIW you did hear from Paolo. :)

> Any comments or movement on this set
> of patches?

For a third shot, you should've used --subject-prefix="PATCH v3" so that
each patch becomes distinguishable on Patchwork, in inbox searches, etc.

http://wiki.qemu.org/Contribute/SubmitAPatch

I've started commenting on some non-functional code issues that you
should review throughout the series. It seems in lack of how-tos you
have oriented yourself on some "old-style" devices, would be nice to
update that for v4 as anti-typo measure and to increase chances of
people copying a modern device. ;)

Regards,
Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] Third shot at adding IPMI to qemu

[Corey Minyard]

On 07/30/2012 09:05 AM, Andreas Färber wrote:
> Am 30.07.2012 15:34, schrieb Corey Minyard:
>> I haven't heard anything on this.
> FWIW you did hear from Paolo. :)

Yes, I did, I apologize.  I think I meant to say "recently".

>> Any comments or movement on this set
>> of patches?
> For a third shot, you should've used --subject-prefix="PATCH v3" so that
> each patch becomes distinguishable on Patchwork, in inbox searches, etc.
>
> http://wiki.qemu.org/Contribute/SubmitAPatch

Ok.

>
> I've started commenting on some non-functional code issues that you
> should review throughout the series. It seems in lack of how-tos you
> have oriented yourself on some "old-style" devices, would be nice to
> update that for v4 as anti-typo measure and to increase chances of
> people copying a modern device. ;)

Yes, I copied the serial driver, mostly, which has probably been around 
a while.

Thank you,

-corey

Re: [Qemu-devel] Third shot at adding IPMI to qemu

[Andreas Färber]

Am 19.07.2012 20:53, schrieb minyard@acm.org:
> Ok, everything passes through checkpatch without an error now.  I have
> added some tests to verify basic operation of the device, and I've
> hacked in some documentation, though I'm not sure if it's in the proper
> location, as I never got a response to my questions about it.
> 
> I would have liked to add tests for the watchdog timer, but there
> doesn't appear to be a way to intercept resets or NMIs in the test
> framework.

Corey, the v1.3 merge window is open now, do you have a v4 of this
series already?

Regards,
Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] Third shot at adding IPMI to qemu

[Corey Minyard]

On 09/10/2012 09:48 AM, Andreas Färber wrote:
> Am 19.07.2012 20:53, schrieb minyard@acm.org:
>> Ok, everything passes through checkpatch without an error now.  I have
>> added some tests to verify basic operation of the device, and I've
>> hacked in some documentation, though I'm not sure if it's in the proper
>> location, as I never got a response to my questions about it.
>>
>> I would have liked to add tests for the watchdog timer, but there
>> doesn't appear to be a way to intercept resets or NMIs in the test
>> framework.
> Corey, the v1.3 merge window is open now, do you have a v4 of this
> series already?

I'm waiting for the SeaBIOS decisions to be made.

-corey

> Regards,
> Andreas
>