Put virtio-serial on the O2

CHANGELOG.md

@@ -13,6 +13,33 @@ hashes are given where a change is easiest to understand by reading the commit.
 
 ## November 2026
 
+### O2 virtio-serial
+
+- `[virtio_serial]` now works on the O2: the paravirtual device is PCI device 4
+  on the MACE bus, INTA on CRIME input 11. It is not an add-in slot and does
+  not take the place of a card in device 3. Not yet run under a guest with a
+  driver for it.
+
+### O2 PCI add-in cards
+
+- The O2's one add-in slot (PCI device 3) takes a card from the configuration:
+  `[[pci]]` with `slot`, `card` and the card's options inline, or `--pci
+  [BUS:]SLOT=CARD[,KEY=VALUE]...`. Only a real add-in slot can be named; the
+  onboard AIC-7880s cannot. A mistake stops iris before it starts and the
+  message names the entry. The slot's INTA reaches CRIME input 10 and INTB to INTD
+  the shared inputs 13 to 15, as the BSDs and Linux route them.
+- Two cards: `aic7880` (the onboard Adaptec chip, one SCSI bus) and
+  `isp12160` (QLogic, two). A card's buses are the SCSI controllers after the
+  onboard two, for `[scsi.N]` (key 16×controller+id, ids 1–15). IRIX 6.5.30
+  drives the `aic7880` card and `hinv` lists it with its disk; it finds the
+  `isp12160` but has no driver for it.
+- The monitor's `pci slots` lists the bus's devices, onboard or add-in, with
+  what is fitted and where each interrupt pin goes.
+- Snapshots record the fitted cards and refuse a restore into a machine with
+  others. Snapshots without cards are unchanged.
+- The Octane's Bridge has a slot table with its four onboard devices and no
+  add-in slot: its PCI boards are not modelled.
+
 ### O2 graphics tracing
 
 - `re trace FILE [re,cpu,gbe,crime,irq|all]` (also `gbe trace`, `crime trace`,
@@ -203,6 +230,13 @@ hashes are given where a change is easiest to understand by reading the commit.
 - Memory past 4 GB is as fast as the rest: such a machine gets a 16 GB direct
   window, and the JIT compiles code anywhere in it.
 - A store-conditional on memory outside the window is now atomic with two CPUs.
+### PCI configuration
+
+- A PCI function can describe its own writable header fields and
+  write-one-to-clear status bits. Byte and halfword configuration writes
+  through a Bridge carry their byte enables, so such a function keeps the
+  status events a narrow write did not select. No Octane function has
+  write-one-to-clear status bits, so the Octane behaves as before.
 
 ### VNC, and screen and pointer commands
 

FEATURES.md

@@ -236,6 +236,21 @@ Omit `[nfs]` to disable the share; the default forward list is empty.
 | `port_forward[].guest_port` | `required` | Guest destination port. |
 | `port_forward[].bind` | `localhost` | localhost or any; any listens on all interfaces. |
 
+### [[pci]]
+
+PCI add-in cards, one table per card. Only a real add-in slot can be named: the onboard devices are fixed.
+Today that is the O2's one slot (PCI device 3, bus `pci`); the Octane's PCI boards are not modelled.
+The monitor's `pci slots` lists a machine's slots.
+
+| Key | Default | Values and behavior |
+|---|---|---|
+| `pci[].slot` | `required` | The PCI device number (`3`, a number, not text), or the label printed on the chassis as text (`"left"`) where the slot has one. Labels work in the configuration file only; `--pci` takes device numbers. The O2's slot has no label. |
+| `pci[].card` | `required` | `aic7880`: Adaptec AIC-7880 SCSI, one bus. `isp12160`: dual-channel QLogic ISP12160 SCSI, two buses. A card's buses are the SCSI controllers after the machine's own (2, then 3 on the O2; the next card's follow), for `[scsi.N]` keys 16×controller+id, ids 1–15. IRIX 6.5.30 on the O2 drives the `aic7880` card and lists its disks in `hinv`; it finds the `isp12160` on the bus but has no driver for it. |
+| `pci[].bus` | the machine's only bus | The PCI bus id (`pci` on the O2). Needed only where a machine has several. |
+| `pci[].<other>` | none | The card's own options, inline. `isp12160` takes none. |
+
+Several cards of one kind are allowed where there are slots for them. A mistake (an onboard device, an unknown slot, a slot used twice, an unknown card or option) stops iris before it starts, with a message naming the entry. A snapshot records the fitted cards and loads only into a machine with the same ones.
+
 ### [vino]
 
 | Key | Default | Values and behavior |
@@ -315,7 +330,7 @@ table adds a port, in order.
 
 | Key | Default | Values and behavior |
 |---|---|---|
-| `virtio_serial.enabled` | `false` | Present the device. On the Indy and Indigo2 it sits in a GIO expansion slot; on the Octane, on the PCI Bridge. Refused on the O2. |
+| `virtio_serial.enabled` | `false` | Present the device. On the Indy and Indigo2 it sits in a GIO expansion slot; on the Octane, on the PCI Bridge (slot 4); on the O2, at PCI device 4 with INTA on CRIME 11. |
 | `virtio_serial.slot` | `"exp1"` | `"exp0"` (`0x1F400000`, shared with `test_device` and Ultra64) or `"exp1"` (`0x1F600000`, shared with the second Newport head). Indy and Indigo2 only. |
 | `virtio_serial.port` | one console on TCP 8890 | Array of ports (at most 31). |
 | `port.name` | none | Name the guest sees (`/dev/virtio-ports/<name>` on Linux); unique. |
@@ -427,6 +442,7 @@ iris-gui does not parse this standalone option set; use its named-machine UI.
 | `--list-net-interfaces` | Print the host network interfaces libpcap can bridge onto, then exit. Requires a build with --features pcap. |
 | `--no-scsi-deferred-int` | Disable deferred SCSI status interrupts (default: enabled for OpenBSD/NetBSD compatibility). |
 | `--cpu` | Emulated CPU: `r4400` (default), `r5000`, or `r10000`. Overrides `[machine] cpu`.  |
+| `--pci` | Fit a PCI card: `[BUS:]SLOT=CARD[,KEY=VALUE]...`, for example `--pci 3=aic7880` on the O2. Repeatable; replaces a `[[pci]]` entry for the same slot. |
 | `--graphics` | Graphics board: `newport` (default), `xz`, `extreme`, `solidimpact`, `highimpact`, `maximpact` (or `impact:solid`, `impact:high`, `impact:max`), `v6`, `v8`, `v10`, `v12` (`vpro:v12` and so on, Octane only). |
 | `--gdb-port` | Enable GDB stub on the given TCP port (e.g. --gdb-port 1234). Connect with: target remote localhost:<port> |
 | `--monitor-port` | Monitor console port on 127.0.0.1 (default 8888). Give each iris running at once its own. |

HACKING.md

@@ -97,6 +97,12 @@ way: `scsi::attach_from_config` walks the `[scsi.N]` tables for every machine,
 where the key is a slot (controller × 16 + id, see `config::scsi_slot`), and
 the machine supplies only a route from controller number to bus.
 
+`ScsiTarget::bus_reset` defaults to no action. Disk targets record reset as
+unit attention. Only the ISP12160 calls it; the other controllers keep
+their earlier behaviour of not reporting resets to targets.
+The ISP12160 releases its controller state lock before walking either bus.
+Target callbacks run under that bus lock and must not reacquire it.
+
 ## 2. Data path and endianness
 
 **Word-transparent architecture.** Host `u32`/`u64` values are bit

HELP.md

@@ -656,6 +656,15 @@ path  = "cdrom4.iso"
 cdrom = true
 # discs = ["irix65.iso", "extras.iso", "patches.iso"]   # changer; "scsi eject 4" cycles
 
+# PCI add-in cards. The O2 has one slot, PCI device 3. An "aic7880" card adds one SCSI
+# bus, controller 2: [scsi.33] is id 1 on it. An "isp12160" adds two (controllers 2 and 3;
+# IRIX on the O2 has no driver for it). The monitor's `pci slots` lists the slots.
+# [[pci]]
+# slot = 3
+# card = "aic7880"
+# [scsi.33]
+# path = "card-disk.raw"
+
 # Scratch volume for file injection without networking (see README).
 # [scsi.2]
 # path    = "scratch.raw"
@@ -786,6 +795,7 @@ Configuration
   --nveeprom <FILE>           Indigo2 NVRAM EEPROM file (default: nveeprom.bin)
   --machine <NAME>            Machine to emulate (a [machine] profile name); `help` lists them
   --ip22                      Same as --machine indigo2_ip22
+  --pci <[BUS:]SLOT=CARD[,K=V]...>  Fit a PCI add-in card, e.g. 3=aic7880 on the O2 (repeatable)
   --graphics <BOARD>          newport, xz, extreme, solidimpact, highimpact, maximpact, v6, v8, v10, v12
   --cpu <MODEL>               r4400 (default), r5000, or r10000
   --bank0..--bank3 <MB>       RAM bank sizes (0/8/16/32/64/128; IP28: also 256/512)

README.md

@@ -149,7 +149,7 @@ Hardware, testing, and development references:
 | Area | Documentation |
 |---|---|
 | Machine profiles | [Indigo2 IP22](docs/indigo2-ip22.md), [Indigo2 IMPACT IP28](docs/indigo2-ip28.md), and [GR2 XZ/Extreme](docs/indy-xz-elan.md), the [SGI O2 (IP32)](docs/o2-ip32.md), and the [SGI Octane (IP30)](docs/octane-ip30.md) with its [address map](docs/Octane/ip30-address-map.md). |
-| Graphics and peripherals | [virtio-serial](docs/virtio-serial.md) (guest byte channels, Indy/Indigo2/Octane), [REX3](docs/Indy/rex3.md), [HAL2 audio](docs/Indy/hal2.md), [WD33C93A SCSI](docs/Indy/wd33c93a.md), [QLogic ISP1040 SCSI (Octane)](docs/Octane/qla1040.md), [IOC3 PS/2 keyboard and mouse (Octane)](docs/Octane/ioc3-ps2.md), [interrupt map](docs/interrupt_map.md), and [Ultra64](docs/Indy/ultra64.md) / [N64 GIO specifications](docs/Indy/n64_gio_specs.md). |
+| Graphics and peripherals | [virtio-serial](docs/virtio-serial.md) (guest byte channels, Indy/Indigo2/O2/Octane), [REX3](docs/Indy/rex3.md), [HAL2 audio](docs/Indy/hal2.md), [WD33C93A SCSI](docs/Indy/wd33c93a.md), [QLogic ISP1040 SCSI (Octane)](docs/Octane/qla1040.md), [IOC3 PS/2 keyboard and mouse (Octane)](docs/Octane/ioc3-ps2.md), [interrupt map](docs/interrupt_map.md), and [Ultra64](docs/Indy/ultra64.md) / [N64 GIO specifications](docs/Indy/n64_gio_specs.md). |
 | CPU test suite | [Suite README](cpu-tests/README.md), [current status](cpu-tests/docs/status.md), [findings](cpu-tests/docs/findings.md), [gotchas](cpu-tests/docs/gotchas.md), and [emulator support](docs/cpu-test-support.md). |
 | CPU test infrastructure | [Toolchain](cpu-tests/docs/toolchain.md), [memory map](cpu-tests/docs/memory-map.md), [oracle overview](cpu-tests/docs/oracle.md), [hardware oracle](cpu-tests/oracle/README.md), [R4600 notes](cpu-tests/docs/r4600.md), and [original test plan](cpu-tests/PLAN.md). |
 | Benchmarks and memory tests | [Benchmark suite](bench/README.md), [prebuilt assets](bench/prebuilt/README.md), [reference results](data/bench_reference.README.md), [GUI benchmark design](clanker/plans/gui-benchmark-plan.md), and [memory stress utility](test/memstress/README.md). |

debug.md

@@ -579,7 +579,7 @@ its SCSI controllers answer to `scsi`/`cow` and `scsi1`/`cow1` as described unde
 | `re dither [on\|off]` | Show or set whether the engine dithers, to compare renderings; on by default |
 | `gbe status` | GBE display engine: timing, frame buffer, tiles |
 | `isa status` | MACE ISA interrupts |
-| `pci status` / `pci config <slot>` | MACE PCI bridge / a function's configuration space |
+| `pci status` / `pci slots` / `pci config <slot>` | MACE PCI bridge / each device number the bus table knows, onboard or add-in, with what is in it and where its interrupt pins go / a function's configuration space |
 | `mec status` | MACE Ethernet: rings, receive buffers, frame counts |
 | `sdma status` | MACE serial DMA |
 | `maceps2 status` / `maceps2 traffic` | PS/2 ports / recent bytes each way |

docs/o2-ip32.md

@@ -107,14 +107,30 @@ overlay } ]`. That key is deprecated: iris folds it into `[scsi.N]` (with
 `controller = bus`) when it loads the file and says so; move the entries over
 to silence the note.
 
+## PCI add-in cards
+
+The O2 has one add-in slot, PCI device 3 on the MACE bus, and `[[pci]]` (or
+`--pci 3=aic7880`) fits a card in it ([FEATURES.md](../FEATURES.md#pci)). The
+slot's INTA reaches CRIME input 10 and INTB to INTD reach the shared inputs
+13 to 15, as the MACE specification has them (and Linux, OpenBSD and NetBSD route them); what the board's connector
+wires INTB to INTD to is not known. Devices 1 and 2 are the onboard AIC-7880s and cannot be replaced. The
+cards are the Adaptec AIC-7880 (`aic7880`, one SCSI bus) and the QLogic
+ISP12160 (`isp12160`, two). A card's buses are SCSI controllers 2 onwards: put
+disks on them with `[scsi.N]` keys 16×controller+id. IRIX 6.5.30 drives the
+`aic7880` card, and `hinv` lists "PCI SCSI controller 2" with its disk; it finds
+the `isp12160` on the bus ("PCI Adapter ID ... PCI slot 3" in `hinv -v`) but
+has no driver for it. A card's buses have no monitor `scsi` command yet; set
+disks in the configuration.
+`pci slots` in the monitor shows the slot and what is in it.
+
 ## Snapshots
 
 The monitor's `save NAME` and `load NAME`, and iris-ci's `save` and
 `restore`, keep the O2 in `saves/NAME/` as they do the other machines: the
 CPU, every device, all of memory (in the chunk store the snapshots share, so
 memory that did not change costs nothing), the flash, and the changes on
 `overlay` disks. A snapshot loads only into an O2 with the same CPU, memory,
-disks and build. Use `overlay` disks for snapshots you mean to go back to: a
+disks, PCI cards and build. Use `overlay` disks for snapshots you mean to go back to: a
 disk written in place keeps changing after the save, and the saved memory
 will not match it.
 

docs/virtio-serial.md

@@ -20,7 +20,7 @@ chooses a transport:
 | Indy (IP24) | virtio-mmio v2 | GIO expansion slot 1 (`0x1F600000`), or slot 0 (`0x1F400000`) | `GioExp1` / `GioExp0` (IOC local/mappable) |
 | Indigo2 (IP22), Indigo2 IMPACT (IP28) | virtio-mmio v2 | same two slots | the slot's EXT_IO fan-out line (`GioS1Graphics` / `GioS0Graphics`) |
 | Octane (IP30) | virtio-pci (modern) | Bridge slot 4 | INTA through the Bridge |
-| O2 (IP32) | virtio-pci (modern) | **not wired** | the MACE PCI router has no route for a spare slot |
+| O2 (IP32) | virtio-pci (modern) | PCI device 4 on the MACE bus | INTA to CRIME input 11 |
 
 The Indy and Indigo2 have no PCI bus, so they get the memory-mapped transport
 in a 64 KB window of an empty GIO expansion slot (an empty slot otherwise
@@ -29,10 +29,11 @@ default. Slot 0 is shared with `test_device` and the Ultra64 board; slot 1 is
 shared with the second Newport head (`graphics.heads = 2`). A clash is refused
 when the configuration is validated.
 
-The O2's transport is complete and tested but the machine does not use it: its
-bridge routes only the two SCSI slots' pins to CRIME inputs, and which CRIME
-input a third slot would drive is a hardware fact we do not have. `validate()`
-says so rather than silently ignoring the section.
+On the O2 the device is PCI device 4 on the MACE bus, which a stock board
+leaves empty; the MACE specification gives that device's INTA to CRIME input 11.
+It is iris's own device, not an add-in slot: `pci slots` does not list it and
+`[[pci]]` cannot name it, so it coexists with a card in the real slot (device
+3). A snapshot loads only into a machine that has the device if it was taken with it, and only into one without it if it was taken without; either mismatch is refused.
 
 ## Configuration
 
@@ -104,7 +105,7 @@ registers `0x030`..`0x0a4`, `InterruptStatus`/`ACK` `0x060`/`0x064`, `Status`
 - Rings are in guest RAM and are addressed by guest physical address (the
   address the CPU would use through KSEG0/KSEG1, with the top bits removed).
 
-### virtio-pci (Octane)
+### virtio-pci (Octane, O2)
 
 Vendor `0x1af4`, device `0x1043` (`0x1040 + 3`), class `0x078000`, BAR0 a
 16 KB memory BAR holding the four structures the vendor capabilities at