Artyom Tarasenko's blog

rebased my old AIX branch to the current QEMU master

2026-03-11T18:50:00.000+01:00

At first I planned to use an LLM-agent to rebase my 7-year-old branch to the current QEMU, but it turned out to be a trivial exercise, so I did it manually.

Since people keep PMing me about AIX, I guess it may be still of use. So, please check the 40p-20260308-aix-boots branch, and if it works for you I'll update the how-to.

The branch still has the 10 year old S3 Trio emulation from Hervé, I'm not sure if there is a newer version of this. Checked that at least AIX maintenance mode starts with S3 Trio VGA and serial, but haven't tested anything beyond that.

I don't plan upstreaming the S3 Trio stuff, it's mostly there for those who like it running with the proprietary firmware (it has a nice animation). Nevertheless OFW can use it too.

rebased cgfourteen patches from Bob Breuer

2025-04-20T18:47:00.002+02:00

Have rebased Bob's patches for cg14, so it's possible to compile it with recent QEMU versions with with recent tooling.

The patch can be found here: https://github.com/artyom-tarasenko/qemu/commit/1b1d8b87619e613b059766e6e54687b027fb6e3f .

reset is necessary to continue

For some reason OBP doesn't detect a DBRI stub in the SBus slot E. So for now, just exclude it from the probe list:

setenv sbus-probe-list f0123

Also, unless you have a rarp/bootp server set up, you probably want to turn auto-boot off:

setenv auto-boot? false
reset

Otherwise, the QEMU monitor has to be used to send a Stop-A combination

sendkey stop-a

After reset it's possbile to boot Solaris kernel with

boot cdrom -vsb

As it turned out, Bob did a great job gathering the available infos for cg14/SX:

https://github.com/breuerr/qemu/wiki/SX

Now I finally know what does "SPAM" mean. It's Sun Pixel Arithmetic Memory.

I found the article "Pixel Processing in a Memory Controller" from Walt Donovan et all referenced by Bob. Very interesting from the historic point of view. Looks like Sun invented the built-in in chipset graphic card some years before it appeared in the x86 World.

For instance, transpose would look like this:

-- Read in a block 12 pixels
-- by 8 pixels.
ldld(src-addr, Rblock, 12)
... seven more loads ...
-- Gather each row and store into
-- memory at dst.
gath(Rblock, 8, Rrow, 8)
stld(dst-addr, Rrow, 8)
gath(Rblock+l2, 8, Rrow, 8)
stld(dst-addr, Rrow, 8)
... ten more gath/stld ...

Of course there are no instruction codes in the article, but I think they can be deducted from the Solaris driver.

The article has also a list of acknowledgments. These people are the pioneers in the single chip MMU graphic:

"The basic conception of the SX originated with Tim Van Hook. Van Hook, Vicki Woolf, and Ray Roth were major contributors in developing the SX chip architecture and the SX instruction set. Andy Bechtolsheim identified
the market opportunity for a low-cost pixel processor.

We would like to thank the rest of the SX hardware and software team-Miriam Blatt, Gloria Chen, Huimei Chen, Larry Fiedler, David Gibbs, Kevin Hayes, Don
Hejna, Samuel Ho, Brad Hoffert, Jens Horstmann, Steve Howell, Alan Hsu, Steve Huang, Rick Iwamoto, Amandeep Jabbi, John Johnson, Ashvin Kamaraju,
Byung Kim, Tayfun Kocaoglu, Mark Loomis, Barry Medoff, Conan Mishler, Jamshy Mostoufi, Jasvinder Nijjar, Greg Onufer, Bill Radke, John Recker, Jean Sheu,
Shawn Storm, Richard Tom, Haiduong Vo, John Watkins, Jung Wu, and David Yen-for their efforts in designing and implementing the SX and the target workstation".

Self-hosting OpenSolaris under qemu-system-sparc -M niagara

2025-01-25T17:48:00.000+01:00

Back to the Niagara target which I haven't touched since 2017. Back then I was playing with the Machine Description files, but afair OpenSolaris and Debian had different expectations. Unfortunately I haven't described my experiments, so I don't remember how exactly I created these machine definitions. Actually they are documented in the FWARC 2005/115. But it's something which takes time to understand, in some chapters it looks like unidirectional Directed Acyclic Graph, in other chapter there are references to "fwd" and "back". Anyway I've uploaded whatever I produced to my GitHub. At least it's possible to have 1GiB RAM.

Having 1 GiB allows QEMU booting various OpenSolaris/Illumos distributions, for instance the last dilos release for sun4v (dilos-net-1.3.7.136-sparc64.iso), but let’s start with OpenSolaris ramdisk.snv-b77-nd.no-boot-time-network.gz which was released as a part of OpenSparc T1. It is optimized to the Niagara machine QEMU emulates. Particularly it has the hsimd driver for a RAM-Disk. The other illumos distributions don’t seem to have it, although it’s released under GPLv2, so it should be possible to build it anywhere.

The v9os and Tribblix distributions use bootarchive and have much more features, which makes them too heavy for QEMU with its current performance. Booting Tribblix takes ~1 Hour on my laptop. The sun4v emulation can definitely be significantly optimized, will get back to this topic later.

As the name suggests, the image has no network support. So, let’s add it. Not having a network card seems to be a challenge, but then again back in the nineties I haven’t had a network card either. There is a serial line, and this is enough to start hacking. At my University we phoned a UNIX console, executed slirp and then started pppd.

Chapter 1. Experimenting with networking

The gunziped snv_77 image can be mounted for instance on qemu sun4m emulation, or any physical machine. Maybe it can even be read/write mounted under Linux, but RHEL9/OL9 doesn’t have the ufs.ko driver out of the box, so I haven’t tried it.

Initially I planned to use the authentic slirp.10c.sol24sparc binary, but alas, it wasn’t archived, and my google-fu was not strong enough to find it anywhere. So, I used a Solaris 9 machine to compile the binary myself. It wanted to have some crypt libraries which are different between my Solaris 9 installation and OpenSolaris snv_77. I don’t need any encryption performing communication as long as I stay on localhost, so I simply did

sed -e 's#crypt#nocrypt#g' configure > configure-nocrypt &&  chmod +x .configure-nocrypt && ./configure-nocrypt && make

Let's see if it's ok for snv77:

# /usr/local/bin/slirp -P
Slirp v1.0.16 (BETA) 

Copyright (c) 1995,1996 Danny Gasparovski and others. 
All rights reserved. 
This program is copyrighted, free software. 
Please read the file COPYRIGHT that came with the Slirp 
package for the terms and conditions of the copyright. 

IP address of Slirp host: 192.168.186.100 
[none found] 
Your address is 10.0.2.15 
(or anything else you want) 

Type five zeroes (0) to exit. 

[talking PPP, 115200 baud] 

SLiRP Ready ...

Nice! At this point I killed the user socat session, and used socat for creating a virtual serial.

socat pty,link=/dev/snv77,raw UNIX:/tmp/snv77.sock

Then started a pppd and I swear I could hear a phantom modem connect sound. The “anything else” message brought me to an idea to specify a different address (I already have 10.0.2.15 on another interface), but el9 pppd failed to negotiate it with slirp. So, I kept 10.0.2.15 for the moment. (Later I changed it to be 10.0.5.15) Let’s see it the machine is reachable.

$ telnet 192.168.186.100 
Trying 192.168.186.100...

And nothing happens. And actually, where is this 192.168.186.100 coming from? Oh, it’s defined in /etc/hosts. The physical FPGA machine for this image would have this address on its network card. But I don’t have a network card. The only one out there is the loopback with 127.0.0.1, which cannot be used for obvious routing reasons. No problem, another loopback to the rescue:

# ifconfig lo0:1 plumb 
# ifconfig lo0:1 192.168.186.100 up

Is it reachable now?

# ifconfig lo0:1 plumb 
$ telnet 192.168.186.100 
Trying 192.168.186.100... 
Connected to 192.168.186.100. 
Escape character is '^]'. 
login: root 
Last login: Tue Jan 19 06:46:15 on console 
Sun Microsystems Inc.   SunOS 5.11      snv_77  October 2007 
#

Good. Telnet is nice, but is extremely inconvenient for transferring files. And since I’m on nineties trip, let’s use rsh for the authenticity. Luckily I still have OpenSolaris b77 dvd with rsh and all the necessary libraries. So I added rshd.in from the SUNWrcmdr package and /usr/lib/libcmd.so.1 from SUNWcsl.

$ rsh 192.168.186.100 
::ffff:192.168.186.100: Connection refused

What? Why? Actually this happens because rsh without command works like rlogin. Which talks to a totally different daemon on a different port (513 instead of 514). I think this is a violation of the main UNIX principle: one program should do just one thing. So, rsh went against the rules and where is it now?

rsh -l root 192.168.186.100 ls -l

This one just hangs.

In my previous post I was wondering if anyone used rsh to execute commands on remote hosts back in nineties. I was sure I had used to do it, but found no success reports on the Net.

I even thought that this was another evidence of the Mandela Effect: the only reference I could find was stating that sending commands over rsh did not work.

I’ve looked at the code and found that internally slirp acts as a proxy, executing another rsh and piping the data back to the client. So I simply removed the support for rsh,

$  git diff
diff --git a/src/ctl.h b/src/ctl.h
index 4a8576d..3518fb3 100644
--- a/src/ctl.h
+++ b/src/ctl.h
@@ -3,5 +3,5 @@
 #define CTL_ALIAS      2
 #define CTL_DNS                3
 
-#define CTL_SPECIAL    "10.0.2.0"
-#define CTL_LOCAL      "10.0.2.15"
+#define CTL_SPECIAL    "10.0.5.0"
+#define CTL_LOCAL      "10.0.5.15"
diff --git a/src/tcp_subr.c b/src/tcp_subr.c
index c14755a..0049778 100644
--- a/src/tcp_subr.c
+++ b/src/tcp_subr.c
@@ -563,7 +563,7 @@ struct tos_t tcptos[] = {
          {0, 23, IPTOS_LOWDELAY, 0},   /* telnet */
          {0, 80, IPTOS_THROUGHPUT, 0}, /* WWW */
          {0, 513, IPTOS_LOWDELAY, EMU_RLOGIN|EMU_NOCONNECT},   /* rlogin */
-         {0, 514, IPTOS_LOWDELAY, EMU_RSH|EMU_NOCONNECT},      /* shell */
+/* don't         {0, 514, IPTOS_LOWDELAY, EMU_RSH|EMU_NOCONNECT},       shell */
          {0, 544, IPTOS_LOWDELAY, EMU_KSH},            /* kshell */
          {0, 543, IPTOS_LOWDELAY, 0},  /* klogin */
          {0, 6667, IPTOS_THROUGHPUT, EMU_IRC}, /* IRC */

and added the rsh ports to port-forward. This way, Solaris rshd.in immediately complained that

 Jan 19 14:22:11 t1-fpga-00 rsh[270]: [ID 521673 daemon.notice] connection from 192.168.186.100 (192.168.186.100) - bad port

Makes sense. Slirp is usually started as normal used, so it communicates from unprivileged ports, whereas rshd expects the port to be in range: 513-1023:

 bad_port = (port >= IPPORT_RESERVED ||
		port < (uint_t)(IPPORT_RESERVED/2));

Fine, let’s hack rshd.in and remove this check:

 ./gdb-sparc64-solaris  --write -q in.rshd 
Reading symbols from /home/tyom/snv77/prep-rsh/usr/sbin/in.rshd...(no debugging symbols found)...done. 
(gdb) set *(int *) 0x000139c4=0x01000000 
(gdb) quit

And after that I'm back to where I started. rshd.in doesn’t complain, “rsh -l ls” waits for something. Then it occurred to me that I recently my laptop to OL9. I checked iptables settings immediately after first encountering the hanging rsh process, and the ports were open. But you know what? RHEL9/OL9 use firewalld by default. And there indeed communication to the ports 513-1023 is not permitted by default, which totally makes sense.

But since I don’t expect to be hacked from my own VM, I’ve permitted these connections. And now

$ rsh -lroot 192.168.186.100 "uname -a" 
SunOS t1-fpga-00 5.11 snv_77 sun4v sparc sun4v

Woo-hoo! We’ve got a networked sparc64 OpenSolaris image which can be used in self-hosting mode. You can put there whatever files you want with

  cat filename | rsh -lroot 192.168.186.100 "cat >filename"

Then shut it down,

#  init 5

And finally in the qemu monitor,

 (qemu) pmemsave 0x1f40000000 83886080 vdisk.ram

Where 83886080 is the current size of the virtual disk in bytes (can be checked with ls -l). The next time you boot with the vdisk.ram, you’ll find the changes done to the FS before "init 5" and "pmemsave". Indeed I don’t encourage anyone to use rsh, this was done just for fun. If you want to try it yourself, the next chapter describes how to use the image created by experiments described above.

Chapter 2. Using the snv-with-slirp image

The image for the experiments below, currenly resides here. Unpack it first.

Launching it can be done with 6 terminals, 5 run with user privileges and 1 with root:

qemu-system-sparc64 -M niagara:
```
 ./qemu-system-sparc64 -M niagara -L ../1GiB-snv_77/ -m 1
024 -nographic -serial unix:/tmp/snv77.sock,server -drive if=pflash,readonly=on,file=../sparc-disks/snv-with-slirp
```
At the end of the session the (qemu) prompt it can be optionally used to save RAM disc contents into a file (qemu) pmemsave 0x1f40000000 83886080 vdisk.ram

socat

 socat STDIO,raw,echo=0 UNIX:/tmp/snv77.sock

This one is used as a temporary helper to submit the boot command, login, configure the IP address alias and start the slirp process

 boot -vV

As soon as the login prompt appears

SunOS Release 5.11 Version snv_77 64-bit
Copyright 1983-2007 Sun Microsystems, Inc.  All rights reserved.
Use is subject to license terms.
os-io Ethernet address = 0:80:3:de:ad:3
Using default device instance data
mem = 1048576K (0x40000000)
avail mem = 945700864
root nexus = Sun Fire T2000
pseudo0 at root
pseudo0 is /pseudo
scsi_vhci0 at root
scsi_vhci0 is /scsi_vhci
virtual-device: hsimd0
hsimd0 is /virtual-devices@100/disk@0
root on /virtual-devices@100/disk@0:a fstype ufs
pseudo-device: dld0
dld0 is /pseudo/dld@0
cpu0: UltraSPARC-T1 (cpuid 0 clock 5 MHz)
pseudo-device: devinfo0
devinfo0 is /pseudo/devinfo@0
Hostname: t1-fpga-00

t1-fpga-00 console login:

ifconfig lo0:1 plumb
ifconfig lo0:1 192.168.186.100 up
echo + >/etc/hosts.equiv
/usr/local/bin/slirp-1.0.16-no-rsh-emu -P "redir 1023 1023" "redir 1022 1022" "redir 1021 1021"

After slirp is started, kill the temporary socat
```
killall socat
```
(beware that it would also kill your other socat processes of the user. If you have any, you should use something more clever than killall. I don’t, so it works for me)

As root:

 socat pty,link=/dev/snv77,raw UNIX:/tmp/snv77.sock & pppd local -detach /dev/snv77

This socat connects the unix socket to pty, which is used by pppd.

Optionally start telnet session. It is handy to see what is available out there.
This one is used to execute rsh commands on the Solaris guest. This one can be used for scripting and file transfer.

Indeed it’s possible to do with much less than 6 terminals. QEMU can be connected directly to pty and booting/starting slirp can be done for instance by a pppd expect script, or by changing the guest init sequence. Having the 6 terminals just helps to have more control and makes it easier to debug if something breaks.

/Happy hacking

rsh and slirp

2025-01-21T14:01:00.001+01:00

Hey! I'm back with a maybe strange question for those who are in age 35+ (ahem, well primariliy to those a little more older then that). Have you used slirp on real machines to connect the Internet via pppd?

And if yes, did you for instance do something like the following?

 tar cf - myfiles* | rsh somehost tar xf -

Am I the only one who remembers doing this? Or did you immediately start with ssh, and never used rsh because of the well known reasons? Or were you the lucky ones who didn't have to use slirp because you had the network access from your home? :-)

Last week I started kinda neozeed style experiment, and hope to have something to share soon.

/Stay tuned

Running AIX with 2 GiB of RAM and beyond

2020-06-14T14:00:00.000+02:00

Trying to find out how much RAM can be given to a PPC PReP machine. In the IBM 40p the PCI host controller is sitting at 0x80000000, which means that in theory 2 GiB can be easily given:

QEMU PReP/40p, Serial #0, 2 GiB memory installed
Open Firmware, built  June 14, 2020 13:25:09
Copyright (c) 1995-2000, FirmWorks.
Copyright (c) 2014,2017,2019,2020 Artyom Tarasenko.

Rebooting with command: boot /pci/scsi@1/disk@0,0:1
Boot device: /pci/scsi@1/disk@0,0:1  Arguments: 

Saving Base Customize Data to boot disk
Starting the sync daemon
Starting the error daemon
System initialization completed.
Starting Multi-user Initialization
 Performing auto-varyon of Volume Groups 
 Activating all paging spaces 
0517-075 swapon: Paging device /dev/hd6 is already active.

And it even is recognized by AIX 5.1:

AIX Version 5
(C) Copyrights by IBM and by others 1982, 2000.
Console login: root
*******************************************************************************
*                                                                             *
*                                                                             *
*  Welcome to AIX Version 5.1!                                                *
*                                                                             *
*                                                                             *
*  Please see the README file in /usr/lpp/bos for information pertinent to    *
*  this release of the AIX Operating System.                                  *
*                                                                             *
*                                                                             *
*******************************************************************************

#  lsattr -El mem0 
size     2048 Total amount of physical memory in Mbytes  False
goodsize 2048 Amount of usable physical memory in Mbytes False
#

Now I wonder, there were some 32 bit RS/6000 machines with 3 GiB RAM, where there any PReP machines among them?

Playing with z/OS on Hercules

2020-04-17T20:25:00.000+02:00

My new toy. Initially one of the data sets were damaged, but after all I managed to get the networking, including FTP and SSH work.

TSO login, that's easy

L CICS. Now what?

The 3270 terminals work out of the box. The networing had to be set up.

System log. Finally no red lines.

For some reason ssh is only allowed for the webadm user, but it's possible to su - ibmuser.

and since OMVS is working, I can ssh

Maybe it's time to learn Cobol now :-)

PReP/40p updates

2019-04-13T10:18:00.002+02:00

Sent the qemu patches for the upstream review. Also fixed a couple of issues in OFW: clock rush and interrupt routing for the PCNet (it still used interrupt 13, which was correct in 2017, but has been changed meanwhile).

Will update the links in the how-to shortly.

/Stay tuned

The next How-To

2019-04-06T20:18:00.004+02:00

Nearly 10 years after writing Solaris/SPARC under QEMU How-To, now it’s time for the AIX/PReP under QEMU How-To.

Back then my strategy was using the Power-On Self Tests and other tests from the original firmware to verify and improve qemu-system-sparc.

This time I took a different approach as some tests are synthetic and check some typical hardware-specific problems like broken and shorted wires or faulty memory chips. The result of IBM firmware diagnostics is something like “replace your motherboard” – which is not exactly helpful to find out for instance whether there is a problem with the interrupt or DMA emulation. And yeah, there are some problems with the DMA emulation, that’s why qemu-system-ppc -M 40p can not use IDE CD-ROMs under AIX, and probably some other DMA devices like sound card (haven't tried it yet).

The approach this time was making the emulation good enough and describe it the way that it

matches to the hardware implemented in QEMU good enough
has a driver in AIX

The later was tricky, as AIX does support only a very limited amount of hardware. It checks exactly that your IDE controller is from Winbond (does anyone still remember them?) and checks the exact chip model. It doesn’t care if your chip is compatible, it wants the exact match.

As result we have a -M 40p model in QEMU which is not perfectly matching the physical IBM PPS 6015, and a firmware which describes it the way AIX 5.1 can see the onboard devices.

But anyways, it was fun 10 years ago and it's still fun.

AIX/PReP under QEMU How-To

2019-04-06T20:06:00.000+02:00

AIX/PReP under QEMU How-To

Fetch the 40p-20190406-aix-boots branch and compile qemu-system-ppc:

configure --target-list=ppc-softmmu

download the OFW image q40pofw-serial.rom configured for the serial line.

create an empty hard disk image:

qemu-img create -f qcow2 aix-hdd.qcow2 8G

Concerning the VGA graphics: OFW can utilize the S3-Trio emulation done by Hervé, but AIX 5.1 can’t use it yet. For now, the serial line rules, but if you feel adventurous you can try using it omitting the -vga none -nongraphic part.

qemu-system-ppc -M 40p -bios q40pofw-serial.rom -serial telnet::4441,server -hda aix-hdd.qcow2 -cdrom
/path/to/aix-5.1-cd1.iso  -vga none -nographic

Then in another terminal window:

telnet localhost 4441

The following text will appear:

QEMU PReP/40p, Serial #0, 128 MiB memory installed
Open Firmware, built  April 06, 2019 17:47:55
Copyright (c) 1995-2000, FirmWorks.
Copyright (c) 2014,2017,2019 Artyom Tarasenko.

Type any key to interrupt automatic startup
Boot device: /pci/ethernet  Arguments: 
The DHCP server did not specify a boot server

Boot load failed

ok

Once you see the “ok” prompt, type

ok boot cdrom:2

Then be patient, it takes some minutes till the first greeting appears and then some more before the installer starts.

Then answerer the installer questions. On my machine the copy process takes nearly one hour. At 93% it stalls after installing “mtools” for something like 10 Minutes, and then for another 10 minutes after “FAILURES” section, but don’t panic, eventually it will continue.

Once the install is done the emulated machine reboots to the “ok” prompt again. Type

ok boot disk

Supported AIX versions

I tested it with AIX 5.1 only. In theory it might work with 4.3.3 – 5.1 (a smoke test shows that at least the installer does start with AIX 4.3.3), let me know if you tested it. The 6015 support was officially discontinued in AIX 5.2, and probably the corresponding drivers were removed. I haven’t looked it up, as I don’t have a 5.2 media.

Networking in AIX 4.3.3 - 5.1 under QEMU

It looks like the PCNet driver (aka kent) is broken in AIX. I think the "busio" value used to look different in the previous versions. The networking can still be set up though. After performing the install, login as root and do the following (^D and ^C are Control-D and Control-C respectively):

# cat > lance-chg.asc
CuAt:
        name = "ent0"
        attribute = "busio"
        value = "0x01000000"
        type = "O"
        generic = "D"
        rep = "nr"
        nls_index = 3
^D
# odmchange -o CuAt -q "name=ent0 and attribute=busio" lance-chg.asc
# rmdev -l ent0
# mkdev -l ent0
# ifconfig en0 10.0.2.15
# ping 10.0.2.2
PING 10.0.2.2: (10.0.2.2): 56 data bytes
64 bytes from 10.0.2.2: icmp_seq=0 ttl=255 time=4 ms
64 bytes from 10.0.2.2: icmp_seq=1 ttl=255 time=3 ms
^C
#

If you try it with adifferent AIX version, before changing the busio, check first whether you have to modify it:

odmget -q "name=ent0 and attribute=busio" CuAt

In case you get

value = "0x01000000"

you don't have to change it.

Your feedback is welcome!

Last updated on 2020.02.07

Cleaning up the PReP patches for AIX

2019-03-31T21:28:00.000+02:00

I've got surprisingly many requests on booting AIX under the QEMU 40p target. I've looked at the changes which need to be done both to QEMU and to OpenFirmWare, and it turned out it there was more than I thought.

In 2017 I used some original work from the OFW done by Mitch Bradley. After a brief discussion he kindly published this file today. So now I'm good to publish my changes.

At the moment I'm cleaning the code, then I'll publish it on GitHub, and hopefully the patches will make it upstream. Except maybe for OFW, since it has been decided that the official firmware is going to be OpenBIOS. But for the users it should not matter, it's just one additional file to download.

/ Stay tuned ;-)

BLITing overlaping regions...

2018-12-23T16:56:00.000+01:00

... may be tricky. The following screen shot illustrates why the memmove() system call was introduced as a safe replacement for the good old memcopy() back in the days.

Overlapping BLIT

The splash screen is done, next level

2018-12-09T21:47:00.000+01:00

After some improvements to the cgsix emulation the boot splash screen is finally looking good:

cgsix under sun4m

On the screen above there is only one thing missing: the cursor. Unlike cgthree, the cgsix graphic adapter has hardware cursor, which I haven't implemented yet.

Well, the hardware cursor is not the only thing which is not yet implemented in general. The next screen is not as good:

The freedom statue is looking at Solaris install process

/stay tuned

Meanwhiile in sun4m

2018-12-02T21:10:00.000+01:00

Debugging when a program does something unexpected is easy. You just have to find the place where it starts doing it and find out the reason.

In my case though, the problem is that Solaris doesn't change the color map. But where and when is it supposed to update it? Tricky.

And then I thought: why don't I try it under sun4m? And tell you what. I've got a good and a bad news. The good news is that the RAMDAC emulation does work ok:

cg6 under sun4m

The bad news is that the reason why it doesn't perform somewhere near it when running on a sun4u is still to be found. My current educated guess is that it has to do with the interrupt processing...

Don't know yet what I'm going to attack next: fix the interrupts under sun4u, or improve some missing graphic features under sun4m. The latter has an advantage of producing some nice or ugly screen shots, and everyone likes screen shots. :-)

The colors...

2018-11-25T22:10:00.000+01:00

... are still not quite right:

Let's add some colors

The moment you see the endianess is wrong

2018-11-18T19:48:00.000+01:00

Think I fixed one bug, but this way I loose the half tones. And the endianness is definitely wrong:

The endianness is wrong

Above I treat the bytes as pixels. The endianness is definitely wrong. Fixing the endianness the picture gets better:

The endianness is correct

Not sure if the bit order in the byte is correct. And no idea why it's so contrast and monochrome. Treating the bits as pixels with the proper endianness the picture looks more interesting:

As if a bit were a pixel

The result must be somewhere in between the two above... But I'm think I'm done for this weekend.

The moment you see you used bits instead of bytes

2018-11-17T19:24:00.000+01:00

Trying to find out how the cg6 registers work I get some funny pictures.

When the bytes are treated as bits

Here it interprets bytes as bits. Plus some more bugs indeed...

Fixed the cgsix colormap

2018-11-11T19:07:00.001+01:00

Looks like the cgsix DAC is slightly different from the one used in cgthree. Fixed it and now the image doesn’t look so psychedelic anymore:

cgsix in the DFB mode

Now, that was the easy part. Making it work under OpenWindows is going to be trickier. There is virtually no documentation on the GPU. I guess this manual is really lost: as Sun tried to open the specs back in 2008, they failed with “Unable to locate (15-July-08)” message.

Does anyone by any chance have the book “TurboGX Reference Card” (p/n 800-5112) or any other document which describes how to program the TEC and FBC units of the TGX chip?

The first experiments with cgsix emulation

2018-11-10T23:46:00.000+01:00

Okay, I’ve got the first picture with a virtual cgsix under QEMU. The colors are slightly distorted, but at least the image is there:

cgsix in red

a few more words on cgfourteen

2018-10-21T19:44:00.001+02:00

A customer asked me if he’ll ever gets a chance to watch HD movies on an emulated SPARC machine. At first, I was going to say never ever, but then I looked at the specs of some ancient adapters and got surprised. The SGI machines were commonly known for good graphics, but it never occurred to me that Sun machines were really powerful as well.

The cgfourteen (cg14) adapter could show Full-HD (1920x1080) pictures back in 1993!

Since the manufacturers sometimes claim just the theoretic abilities of the chipset, I wanted to check that the software has been really aware of such graphic modes in early nineties.

So, I gave a spin to the old cgfourteen patch from Bob Breuer. And here we go.

SPARCstation 20 OBP supports 1920x1080

Overall the cgfourteen adapter was really powerful. Michael Lorenz who added the hardware acceleration support for cgfourteen to NetBSD, wrote “SX has plenty of registers (128 - eight of them have special functions, the rest is free for all) and every instruction takes a count to operate on several subsequent registers or memory locations (ALU ops can use up to 16, memory accesses up to 32). SX supports some parallelism too - the ALUs can do up to two 16bit multiplications and two other arithmetic or logical ops per clock cycle (32bit multiplications use both ALUs).

The bad news is that Bob’s patch doesn’t implement the SX rendering engine. Also, the Solaris (or rather OpenWindows) driver is very much bound to sun4m SRMMU, so it won’t work on sun4u machines.

Would really like to have the emulation of a graphic card which would be better than cgthree, and ideally would work on both sun4m and sun4u machines, but it’s not easy.

Right now, I’m choosing between cgsix and creator ffb, but none of them has public documentation.

P.S. A funny fact about the Solaris SX driver: there are lots of symbols which have the word “SPAM” in a name. It can spamify and unspamify. It’s really hard to google what it could mean back in nineties. “M” is probably for “Memory”.

Back to SPARC

2018-09-15T11:43:00.001+02:00

Man proposes, God disposes.

I planned to finish the work on the 40p emulation, but due to some turbulences had absolutely no chance to work on QEMU since last December. But it looks like I may have some time for QEMU again.

Now, while running AIX under QEMU has been a nice brain and finger exercise, looking at my mail box and the comments of this blog, I think the people are more interested in Solaris than in AIX, so I plan to dig out my Ultra-1 sun4u prototype from 2012, adapt it to the current QEMU object model and make it public (no ETA though).

/ Stay tuned

AIX 5.1 boots under QEMU

2017-12-02T22:47:00.000+01:00

Yoo-Hoo! I did it again. Now it’s the second achievement in the emulation of the proprietary (aka real) UNIX systems. The Solaris/SPARC run first in December 2009, and now 8 years later, AIX 5.1 boots under QEMU. And even the S3-Trio framebuffer works, thanks to Hervé. Looks pretty cool. Once I have the X-Window running I’ll make a screencast. For now, just a teaser:

AIX5.1 under qemu-system-ppc -M 40p

QEMU PReP, Serial #0, 128 MiB memory installed
Open Firmware , Built  December 01, 2017 16:41:00
Copyright (c) 1995-2000, FirmWorks.
Copyright (c) 2014,2017, Artyom Tarasenko.

Rebooting with command: boot /pci/scsi@1/disk@0,0
Boot device: /pci/scsi@1/disk@0,0  Arguments: 

Saving Base Customize Data to boot disk
Starting the sync daemon
Starting the error daemon
System initialization completed.
Starting Multi-user Initialization
 Performing auto-varyon of Volume Groups 
 Activating all paging spaces 
0517-075 swapon: Paging device /dev/hd6 is already active.
/dev/rhd1 (/home): ** Unmounted cleanly - Check suppressed
/dev/rhd10opt (/opt): ** Unmounted cleanly - Check suppressed
 Performing all automatic mounts 
Multi-user initialization completed
Checking for srcmstr active...complete
Starting tcpip daemons:
0513-059 The syslogd Subsystem has been started. Subsystem PID is 4408.
0513-059 The sendmail Subsystem has been started. Subsystem PID is 3402.
0513-059 The portmap Subsystem has been started. Subsystem PID is 4646.
0513-059 The inetd Subsystem has been started. Subsystem PID is 5160.
0513-059 The snmpd Subsystem has been started. Subsystem PID is 4904.
0513-059 The hostmibd Subsystem has been started. Subsystem PID is 5936.
Finished starting tcpip daemons.
Starting NFS services:
0513-059 The biod Subsystem has been started. Subsystem PID is 8000.
0513-059 The rpc.lockd Subsystem has been started. Subsystem PID is 7494.
Completed NFS services.
...
AIX Version 5
(C) Copyrights by IBM and by others 1982, 2000.
Console login: root
*******************************************************************************
*                                                                             *
*                                                                             *
*  Welcome to AIX Version 5.1!                                                *
*                                                                             *
*                                                                             *
*  Please see the README file in /usr/lpp/bos for information pertinent to    *
*  this release of the AIX Operating System.                                  *
*                                                                             *
*                                                                             *
*******************************************************************************
Last login: Wed Dec 31 18:45:33 CST 1969 on /dev/tty0

#  who -r
   .        run-level 2 Dec 31 18:05       2    0    S                  
# uname -a
AIX localhost 1 5 000000004C00
#

What's the time?

2017-09-24T08:37:00.000+02:00

Previously in this blog: ...two ways from here: either fix the floppy emulation, or make OFW for 40p with no floppy...

... or skip the call. You know, I have an armed debugger here and am not afraid to use it. So just turn the fatal call:

/usr/lib/methods/cfgfda_isa -2 -l fda0

into something harmless, like:

/bin/echo -2 -l fda0

by using

set *(int *) 0x200c11a8 = 0x2f62696e
set *(int *) 0x200c11ac = 0x2f656368
set *(int *) 0x200c11b0 = 0x6f000000

Well actually it probably should have been "/usr/bin/echo", there is no "/bin/echo" in the system. But obviously the attempt above was good enough for AIX, as it doesn't really need the floppy disk adapter (nor mouse & keyboard which I had to hack in a similar way at the second attempt). This brings AIX here:

Completed method for: fda0, Elapsed time = 0
Return code = 127
*** no stdout ****
***** stderr *****
sh: /usr/lib/methods/cfgfda_isa:  not found

Method error (/usr/lib/methods/cfgfda_isa -2 -l fda0 ):
        0514-068 Cause not known.
...
exec(/../usr/sbin/lqueryvg,-phdisk0,-L)
exec(/../usr/bin/grep,00000000000000000000000000000000)
exec(/usr/bin/dosread,-S,/preload,/preload)
exec(/usr/lpp/bosinst/datadaemon)
exec(/../usr/bin/sleep,1)

Where it hangs forever. And now the problem is sort of obvious. Yesterday I wrote that the boot log hadn't had shown any hint. But it did:

Time: 0 LEDS: 0x539
...
Time: 0 LEDS: 0x78a
...
Completed method for: bus0, Elapsed time = 0
...
Time: 0 LEDS: 0x539
...
Time: 0 LEDS: 0x868
...
Completed method for: scsi0, Elapsed time = 0
...

See? The clock is not ticking (it's probably caused by a QEMU bug, that "loadvm" command sometimes doesn't restore one of the machine timers. And I used the command a lot during the yesterdays session).

So basically there are two scenarios:
- the clock is ticking - in this case AIX doesn't start any methods after spawning the init process
- the clock is stopped - in this case it starts the methods up to the point where the timeouts are important. Probably if the clock had worked properly the boot process wouldn't had stopped at the floppy detection method.

Which means that debug process is getting real complicated. Now I have to debug the kernel scheduler, which is tricky. And obviously is different from AIX 4.2 which doesn't hang at that point.

The KDB from 5.1 has some features to see the scheduled timers, but I'm not sure it can be used to debug the interrupt handling. At least Solaris kadb was not good for debugging the interrupts, as it made a lot of side effects, and mostly hanged the system right after setting the breakpoint.

So, the good news: the most of the QEMU's 40p model devices are working properly. The bad news: finding a black sheep in a dark room is pretty hard.

Some experiments with AIX 5.1

2017-09-23T03:43:00.000+02:00

Since I could not find the AIX 4.2 install for Motorola, I gave AIX 5.1 under qemu-system-ppc a shot. The feelings are mixed, on one hand I've got no reference machine to check things, on the other hand the KDB debugger in AIX 5.1 is much more powerful than in 4.2. The initialization process of 5.1 is close to 4.2, so I can recognize some structures. Which is good: the version 4.2 is quite different from 4.1.4 which I tried first. So I was afraid they made an equal leap in 4.x->5.x transition. Well, partially they did. Although the function names are more or less the same, the debugger made a great leap forward.

This stack trace looked like a flashback.

[01DE1BCC]init_pcicfg+000000 (2FF3A910 [??])
[01DE1380]config_pal+000030 (??)
[01DE12F8]config_planar_pal+0001D8 (??, ??)
[004832AC]config_kmod+000184 (??, ??, ??)
[004836E4]sysconfig+000104 (??, ??, ??)
[00003A94].sys_call+000000 ()
[10002668]cfgpal_rspc+0003E8 ()
[100016C0]main+000110 (??, ??, ??)
[10000188]__start+000088 ()

Under 4.2 it was like this:

(gdb) bt
#0  0x018d2b7c in ?? () -- pci_rw
#1  0x00088114 in ?? ()
#2  0x00088114 in ?? ()
#3  0x018d1db0 in ?? () -- init_crashdump 0x018d1d70
#4  0x018cf410 in ?? () -- config_pal  0x018cf35c
#5  0x018cf30c in ?? () -- config_planar_pal 0x018cf100
#6  0x000f9b3c in ?? () -- config_kmod 0x000f9a5c, 2 params, size 0x118
#7  0x000f9eb8 in ?? ()
#8  0x000037a8 in ?? ()

See the formatting differences and gaps? That's because under 4.2 I had to make the trace manually. Did I mention that the 4.2 debugger is eighties style? So, now I'm really enjoying the luxury of having a modern tool.

Also there is a possibility to make the output verbose:

KDB(0)> mw enter_dbg
enter_dbg+000000:  00000000  = 42
n_core+000000:  00000032  = .
KDB(0)>

But then there are also some bad news. There are still bugs (or missing features) in qemu. Even worse, there is at least one Heisenbug. Some times it gets to the PCI initialization and sometimes not. And in the cases where it doesn't get to PCI init it's really unclear why: it just sits in the idle loop, interrupts are enabled, and it receives the interrupts from the timer. Just for some reason it thinks there is nothing to do. Debugging such cases is a real nightmare.
So, I thought maybe go as far it can in case where it does reach PCI init and see any clues in the log.
No obvious clues, but here goes a pretty long log:

Time: 0 LEDS: 0x539
Number of running methods: 0
 cfgmgr LED{539}
----------------
Attempting to configure device 'bus0'
 cfgmgr LED{78A}
Time: 0 LEDS: 0x78a
Invoking /usr/lib/methods/cfgbus_pci -1 -l bus0
exec(/bin/sh,-c,/usr/lib/methods/cfgbus_pci -1 -l bus0)
Number of running methods: 1
exec(/usr/lib/methods/cfgbus_pci,-1,-l,bus0)
Breakpoint
.bus_register+000000     mflr    r0                  <01DEADA0>
KDB(0)> g
exec(/bin/sh,-c,/usr/lib/methods/define_rspc -c bus -s pci -t isa -p bus0 -w 88 -L 04-A0 -d)
exec(/usr/lib/methods/define_rspc,-c,bus,-s,pci,-t,isa,-p,bus0,-w,88,-L,04-A0,-d)
exec(/bin/sh,-c,/usr/lib/methods/cfgbus_isa -1 -l bus1)
exec(/usr/lib/methods/cfgbus_isa,-1,-l,bus1)
Breakpoint
.bus_register+000000     mflr    r0                  <01DF8FF0>
KDB(0)> g
exec(/bin/sh,-c,/usr/lib/methods/define_rspc -d -c adapter -s isa_sio -t fda -p bus1 -w PNP0700ffffffff -L 01-B0)
exec(/usr/lib/methods/define_rspc,-d,-c,adapter,-s,isa_sio,-t,fda,-p,bus1,-w,PNP0700ffffffff,-L,01-B0)
exec(/bin/sh,-c,/usr/lib/methods/define_rspc -d -c adapter -s isa_sio -t isa_keyboard -p bus1 -w PNP0303ffffffff -L 01-D0)
exec(/usr/lib/methods/define_rspc,-d,-c,adapter,-s,isa_sio,-t,isa_keyboard,-p,bus1,-w,PNP0303ffffffff,-L,01-D0)
exec(/bin/sh,-c,/usr/lib/methods/define_rspc -d -c adapter -s isa_sio -t isa_mouse -p bus1 -w PNP0F03ffffffff -L 01-E0)
exec(/usr/lib/methods/define_rspc,-d,-c,adapter,-s,isa_sio,-t,isa_mouse,-p,bus1,-w,PNP0F03ffffffff,-L,01-E0)
exec(/bin/sh,-c,/usr/lib/methods/define_rspc -d -c adapter -s isa_sio -t s1a -p bus1 -w PNP05011 -L 01-F0)
exec(/usr/lib/methods/define_rspc,-d,-c,adapter,-s,isa_sio,-t,s1a,-p,bus1,-w,PNP05011,-L,01-F0)
exec(/bin/sh,-c,/usr/lib/methods/define_rspc -c adapter -s pci -t ncr810 -p bus0 -w 96 -L 04-B0 -d)
exec(/usr/lib/methods/define_rspc,-c,adapter,-s,pci,-t,ncr810,-p,bus0,-w,96,-L,04-B0,-d)
----------------
Completed method for: bus0, Elapsed time = 0
Return code = 0
***** stdout *****
:devices.isa_sio.IBM000E :devices.isa_sio.PNP0400 :devices.pci.22100020
fda0,sioka0,sioma0,sa0,scsi0

*** no stderr ****
----------------
Time: 0 LEDS: 0x539
Number of running methods: 0
 cfgmgr LED{539}
----------------
Attempting to configure device 'fda0'
Method: /usr/lib/methods/cfgfda_isa not in boot image, configure in phase 2
----------------
Attempting to configure device 'sioka0'
Method: /usr/lib/methods/cfgkm_isa not in boot image, configure in phase 2
----------------
Attempting to configure device 'scsi0'
 cfgmgr LED{868}
Time: 0 LEDS: 0x868
Invoking /usr/lib/methods/cfgncr_scsi -1 -l scsi0
exec(/bin/sh,-c,/usr/lib/methods/cfgncr_scsi -1 -l scsi0)
exec(/usr/lib/methods/cfgncr_scsi,-1,-l,scsi0)
exec(/bin/sh,-c,/etc/methods/define -c disk -s scsi -t osdisk -p scsi0 -w 0,0)
exec(/etc/methods/define,-c,disk,-s,scsi,-t,osdisk,-p,scsi0,-w,0,0)
exec(/bin/sh,-c,/etc/methods/define -c cdrom -s scsi -t oscd -p scsi0 -w 2,0)
exec(/etc/methods/define,-c,cdrom,-s,scsi,-t,oscd,-p,scsi0,-w,2,0)
Number of running methods: 1
----------------
Completed method for: scsi0, Elapsed time = 0
Return code = 0
***** stdout *****
hdisk0 cd0
*** no stderr ****
----------------
Time: 0 LEDS: 0x539
Number of running methods: 0
 cfgmgr LED{539}
----------------
Attempting to configure device 'hdisk0'
Method: /etc/methods/cfgscdisk not in boot image, configure in phase 2
----------------
Attempting to configure device 'cd0'
 cfgmgr LED{723}
Time: 0 LEDS: 0x723
Invoking /etc/methods/cfgsccd -1 -l cd0
exec(/bin/sh,-c,/etc/methods/cfgsccd -1 -l cd0)
exec(/etc/methods/cfgsccd,-1,-l,cd0)
Number of running methods: 1
----------------
Completed method for: cd0, Elapsed time = 0
Return code = 0
*** no stdout ****
*** no stderr ****
----------------
Time: 0 LEDS: 0x539
Number of running methods: 0
 cfgmgr LED{539}
----------------
Time: 0 LEDS: 0x538
Invoking top level program -- "/usr/lib/methods/deflvm"
 cfgmgr LED{538}
exec(/bin/sh,-c,/usr/lib/methods/deflvm )
 cfgmgr LED{539}
Time: 0 LEDS: 0x539
Return code = 127
*** no stdout ****
***** stderr *****
sh: /usr/lib/methods/deflvm:  not found

Method error (/usr/lib/methods/deflvm):
        0514-068 Cause not known.
sh: /usr/lib/methods/deflvm:  not found

----------------
Time: 0 LEDS: 0x538
Invoking top level program -- "/usr/lib/methods/fdarcfgrule"
 cfgmgr LED{538}
exec(/bin/sh,-c,/usr/lib/methods/fdarcfgrule )
 cfgmgr LED{539}
Time: 0 LEDS: 0x539
Return code = 127
*** no stdout ****
***** stderr *****
sh: /usr/lib/methods/fdarcfgrule:  not found

Method error (/usr/lib/methods/fdarcfgrule):
        0514-068 Cause not known.
sh: /usr/lib/methods/fdarcfgrule:  not found

----------------
Time: 0 LEDS: 0x538
Invoking top level program -- "/usr/lib/methods/defssar"
 cfgmgr LED{538}
exec(/bin/sh,-c,/usr/lib/methods/defssar )
 cfgmgr LED{539}
Time: 0 LEDS: 0x539
Return code = 127
*** no stdout ****
***** stderr *****
sh: /usr/lib/methods/defssar:  not found

Method error (/usr/lib/methods/defssar):
        0514-068 Cause not known.
sh: /usr/lib/methods/defssar:  not found

 cfgmgr LED{FFF}
Configuration time: 0 seconds
+ 1> /etc/filesystems
+ /usr/lib/methods/showled 0x517
exec(/usr/lib/methods/showled,0x517)
 showled LED{517}
+ bootinfo -b
exec(/usr/sbin/bootinfo,-b)
exec(/usr/lib/boot/bin/bootinfo_rspc,-b)
+ mount -v cdrfs -o ro /dev/cd0 /SPOT
exec(/usr/sbin/mount,-v,cdrfs,-o,ro,/dev/cd0,/SPOT)
exec(/usr/bin/sh,-c,/usr/sbin/wlmcntrl -u -d "" > /dev/null 2>&1)
+ [ 0 -ne 0 ]
+ /usr/lib/methods/showled 0x512
exec(/usr/lib/methods/showled,0x512)
 showled LED{512}
+ /SPOT/usr/bin/rm -r /etc/init /usr/bin /usr/lib/boot /usr/lib/drivers/ataide /usr/lib/drivers/ataidepin /usr/lib/drivers/cfs.ext /usr/lib/drivers/idecdrom /usr/lib/drivers/idecdrompin /usr/lib/drivers/isa /usr/lib/drivers/pci /usr/lib/drivers/planar_pal_rspc /usr/lib/drivers/scdisk /usr/lib/drivers/scdiskpin /usr/lib/methods/cfgataide /usr/lib/methods/cfgbus_isa /usr/lib/methods/cfgbus_pci /usr/lib/methods/cfgidecdrom /usr/lib/methods/cfgncr_scsi /usr/lib/methods/cfgsccd /usr/lib/methods/cfgsys_rspc /usr/lib/methods/chggen /usr/lib/methods/chggen_rspc /usr/lib/methods/define /usr/lib/methods/define_rspc /usr/lib/methods/defsys /usr/lib/methods/showled /usr/lib/methods/ucfgdevice /usr/sbin
exec(/SPOT/usr/bin/rm,-r,/etc/init,/usr/bin,/usr/lib/boot,/usr/lib/drivers/ataide,/usr/lib/drivers/ataidepin,/usr/lib/drivers/cfs.ext,/usr/lib/drivers/idecdrom,/usr/lib/drivers/idecdrompin,/usr/lib/drivers/isa,/usr/lib/drivers/pci,/usr/lib/drivers/planar_pal_rspc,/usr/lib/drivers/scdisk,/usr/lib/drivers/scdiskpin,/usr/lib/methods/cfgataide,/usr/lib/methods/cfgbus_isa,/usr/lib/methods/cfgbus_pci,/usr/lib/methods/cfgidecdrom,/usr/lib/methods/cfgncr_scsi,/usr/lib/methods/cfgsccd,/usr/lib/methods/cfgsys_rspc,/usr/lib/methods/chggen,/usr/lib/methods/chggen_rspc,/usr/lib/methods/define,/usr/lib/methods/define_rspc,/usr/lib/methods/defsys,/usr/lib/methods/showled,/usr/lib/methods/ucfgdevice,/usr/sbin)
...
Attempting to configure device 'fda0'
 cfgmgr LED{828}
Time: 0 LEDS: 0x828
Invoking /usr/lib/methods/cfgfda_isa -2 -l fda0
exec(/bin/sh,-c,/usr/lib/methods/cfgfda_isa -2 -l fda0)
Number of running methods: 1
exec(/usr/lib/methods/cfgfda_isa,-2,-l,fda0)

Now it hangs on the floppy disk adapter init. Looks like there is no timeout. Strange.
There are two ways from here: either fix the floppy emulation, or make OFW for 40p with no floppy...

AIX under QEMU boots up to NFS

2017-09-16T14:55:00.001+02:00

Launching a proprietary OS under QEMU is never boring because every next problem has to do with yet another component. A few weeks ago I was mostly doing Forth to make a bootable firmware, then I fought with the missing residual data, at which point it was mostly debugging ODM database using the PPC assembly, then extracted the mock residual data from the live system, then spent some time with NCR/LSI script, and now after fixing the PCI layout it gets to the point of starting the NIS and NFS services. It works much slower than the real machine, and also much slower than Linux/PPC, but still:

MOT PowerStack2 (e0), Serial #0, 62 MiB memory installed
Open Firmware , Built  September 01, 2017 16:11:38
Copyright (c) 1995-2000, FirmWorks.
Copyright (c) 2014,2017, Artyom Tarasenko.

Rebooting with command: boot /pci/scsi@2/disk@0,0
Boot device: /pci/scsi@2/disk@0,0  Arguments:

+ swcons -c

Saving Base Customize Data to boot disk
Starting the sync daemon
Starting the error daemon
System initialization completed.
Starting Multi-user Initialization
 Performing auto-varyon of Volume Groups
 Activating all paging spaces
swapon: Paging device /dev/hd6 activated.
 Performing all automatic mounts
mount: 1831-010 server axxxxs01 not responding:
RPC: 1832-018 Port mapper failure - RPC: 1832-006 Unable to send
mount: backgrounding
axxxxs01:/home
Multi-user initialization completed
Checking for srcmstr active...complete
Starting tcpip daemons:
0513-056 Timeout waiting for command response.
0513-056 Timeout waiting for command response.
vmtune:  current values:
  -p       -P        -r          -R         -f       -F       -N        -W
minperm  maxperm  minpgahead maxpgahead  minfree  maxfree  pd_npages maxrandwrt
   2968    11872       2          8        115      123     524288        0

  -M       -w       -k       -c         -b          -B          -u
maxpin   npswarn  npskill  numclust  numfsbufs   hd_pbuf_cnt  lvm_bufcnt
  12692     1536      384        0       93           64           9

number of valid memory pages = 15864    maxperm=74.8% of real memory
maximum pinable=80.0% of real memory    minperm=18.7% of real memory
number of file memory pages = 1443      numperm=9.1% of real memory

vmtune:  new values:
  -p       -P        -r          -R         -f       -F       -N        -W
minperm  maxperm  minpgahead maxpgahead  minfree  maxfree  pd_npages maxrandwrt
   2968    11872       2          8        115      123     524288       64

  -M       -w       -k       -c         -b          -B          -u
maxpin   npswarn  npskill  numclust  numfsbufs   hd_pbuf_cnt  lvm_bufcnt
  12692     1536      384        1       93           64           9

number of valid memory pages = 15864    maxperm=74.8% of real memory
maximum pinable=80.0% of real memory    minperm=18.7% of real memory
number of file memory pages = 1444      numperm=9.1% of real memory

Starting NIS services:
Starting NFS services:

0513-056 Timeout waiting for command response.
NIS: server not responding for domain "axxxxs01"; still trying.
NIS: server not responding for domain "axxxxs01"; still trying.
0513-056 Timeout waiting for command response.
NIS: server not responding for domain "axxxxs01"; still trying.
NIS: server not responding for domain "axxxxs01"; still trying.
NIS: server not responding for domain "axxxxs01"; still trying.

Woo-hoo! I could be proud that I made the second proprietary OS boot under QEMU. Or even the third one, because Solaris/sun4m is quite different from Solaris/sun4v, so probably each one counts for one.

But now I'm puzzled. Initially I planned to build a throw-away prototype for Powestack II Utah, fix the QEMU bugs preventing booting AIX with the existing machines, and dispose the prototype. The Motorola AIX I've got seems to expect the machine to be called "MOT PowerStack2 (e0)". Not sure if pushing such a model upstream wouldn't cause any copyright/trademark issues.

Now it boots to the same point as on the physical machine, but except for the PCI layout problems, I haven't found any bugs. And the PCI layout can not be the reason of AIX failing on the 40p machine, because it fails much earlier.

So obviously it's time to change the plan. And here is where things are going to slow down. I don't have the install media for the Motorola AIX 4.2, so I can not make my disk usable - it waits for NFS/NIS servers forever. I can not share the HDD image because it may contain the private data, so publishing the Powerstack II Utah target for QEMU makes a little sense for now. So, either I find the Motorola AIX 4.2 install CD (and probably a physical UW-SCSI drive if it won't work at the first attempt under QEMU), or the work has to be done again for the 40p target. Yes, now I have some know-how about the AIX boot process, but still at the moment I don't feel like starting again from scratch with the 40p target.

The good news is that AIX can definitely be booted under qemu-system-ppc.

From SCSI to PCI

2017-09-09T16:21:00.000+02:00

20 years ago SCSI devices ruled the world. Reading the NCR53c810 manual, I see that it was basically a computer in a computer. It can be programmed to transfer data from/to/between the disks without using the CPU at all.

Trying to understand what happens in the NCR/LSI script:

lsi_scsi: Select LUN 0
lsi_scsi: Extended message 0x1 (len 3)
lsi_scsi: SDTR (ignored)
lsi_scsi: SCRIPTS dsp=81c3b924 opcode 80080000 arg 81c3b9a4
lsi_scsi: Jump to 0x81c3b9a4
lsi_scsi: SCRIPTS dsp=81c3b9a4 opcode 870b0000 arg 81c3b9c4
lsi_scsi: Compare phase 2 == 7
lsi_scsi: Control condition failed
lsi_scsi: SCRIPTS dsp=81c3b9ac opcode 860a0000 arg 81c3b94c
lsi_scsi: Compare phase 2 == 6
lsi_scsi: Control condition failed
lsi_scsi: SCRIPTS dsp=81c3b9b4 opcode 98080000 arg 00000022
lsi_scsi: Interrupt 0x00000022
...
lsi_scsi: SCRIPTS dsp=81c3bb6c opcode 0e000002 arg 81c3bdb4
lsi_scsi: MSG out len=2
lsi_scsi: Select LUN 0
lsi_scsi: MSG: ABORT tag=0x0
lsi_scsi: SCRIPTS dsp=81c3bb74 opcode 80080000 arg 81c3bbbc
lsi_scsi: Jump to 0x81c3bbbc
lsi_scsi: SCRIPTS dsp=81c3bbbc opcode 60000008 arg 00000000
lsi_scsi: Clear ATN

Looks like it aborts if the selected SCSI target doesn't change phase to MSG_OUT or MSG_IN. So I implemented a hack for SDTR reply and it doesn't abort here. But indeed it's a red herring. AIX can also work with the devices which do not support the synchronous or wide transfers.

The actual problem happens later:

lsi_scsi: SCRIPTS dsp=81c43444 opcode c0000004 arg 010000dc
lsi_scsi: memcpy dest 0x81c435fc src 0x010000dc count 4

Or, with a bit more enhanced logging:

lsi_scsi: memcpy dest 0x81c475fc (Mem) src 0x010000dc (IO) count 4
lsi_mem_read, address_space_read status 2
lsi_scsi: the first 4 bytes: 00 00 00 00

It tries to read the port 0x10000dc and save it. QEMU doesn't have anything at the port 0x10000dc, so no wonder the NCR script fails. But what is supposed to be there? The Motorola Ultra 603/Ultra 603e/Ultra 604 Programmer’s Reference Guide suggests it must be the PCI I/O space.

So looks like I've learned enough of NCR/LSI script. Time to see how the PCI bus mastering is supposed to work on this machine.