diff mbox series

[RFC,v2,4/8] ppc/spapr: add VTY backend support to OF read/write/open services

Message ID 20261002052605.605858-5-uverma@linux.ibm.com
State New
Headers show
Series ppc/spapr: VOF disk image (qcow2) boot support | expand

Commit Message

Utkarsh Verma Oct. 2, 2026, 5:25 a.m. UTC
From: Utkarsh Verma <uverma@linux.ibm.com>

Extend the VOF client interface to support console I/O through the sPAPR VTY
device, which is needed by bootloaders such as GRUB during disk boot.

Add vof_read() to implement the OpenFirmware "read" client service, which was
previously missing.

Route the OF read and write services backed by vty_getchars() and vty_putchars()

Make vty_getchars() public similar to vty_putchars().

AI-used-for: code
Signed-off-by: Utkarsh Verma <uverma@linux.ibm.com>
---
 hw/char/spapr_vty.c        |  2 +-
 hw/ppc/spapr_vof.c         |  2 +
 hw/ppc/trace-events        |  2 +
 hw/ppc/vof.c               | 84 ++++++++++++++++++++++++++++++++++++++
 include/hw/ppc/spapr_vio.h |  1 +
 5 files changed, 90 insertions(+), 1 deletion(-)

Comments

BALATON Zoltan Oct. 7, 2026, 2:35 p.m. UTC | #1
On Fri, 2 Oct 2026, uverma@linux.ibm.com wrote:
> From: Utkarsh Verma <uverma@linux.ibm.com>
>
> Extend the VOF client interface to support console I/O through the sPAPR VTY
> device, which is needed by bootloaders such as GRUB during disk boot.
>
> Add vof_read() to implement the OpenFirmware "read" client service, which was
> previously missing.
>
> Route the OF read and write services backed by vty_getchars() and vty_putchars()
>
> Make vty_getchars() public similar to vty_putchars().
>
> AI-used-for: code
> Signed-off-by: Utkarsh Verma <uverma@linux.ibm.com>
> ---
> hw/char/spapr_vty.c        |  2 +-
> hw/ppc/spapr_vof.c         |  2 +
> hw/ppc/trace-events        |  2 +
> hw/ppc/vof.c               | 84 ++++++++++++++++++++++++++++++++++++++
> include/hw/ppc/spapr_vio.h |  1 +
> 5 files changed, 90 insertions(+), 1 deletion(-)
>
> diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
> index 1dd9fb155c..2c97e0e027 100644
> --- a/hw/char/spapr_vty.c
> +++ b/hw/char/spapr_vty.c
> @@ -52,7 +52,7 @@ static void vty_receive(void *opaque, const uint8_t *buf, int size)
>     }
> }
>
> -static int vty_getchars(SpaprVioDevice *sdev, uint8_t *buf, int max)
> +int vty_getchars(SpaprVioDevice *sdev, uint8_t *buf, int max)
> {
>     SpaprVioVty *dev = VIO_SPAPR_VTY_DEVICE(sdev);
>     int n = 0;
> diff --git a/hw/ppc/spapr_vof.c b/hw/ppc/spapr_vof.c
> index 78d5b7d5b5..3195c859a4 100644
> --- a/hw/ppc/spapr_vof.c
> +++ b/hw/ppc/spapr_vof.c
> @@ -76,6 +76,8 @@ void spapr_vof_client_dt_finalize(SpaprMachineState *spapr, void *fdt)
>     if (stdout_path) {
>         _FDT(vof_client_open_store(fdt, spapr->vof, "/chosen", "stdout",
>                                    stdout_path));
> +        _FDT(vof_client_open_store(fdt, spapr->vof, "/chosen", "stdin",
> +                                   stdout_path));
>     }
> }
>
> diff --git a/hw/ppc/trace-events b/hw/ppc/trace-events
> index 1f125ce841..dbdcfada26 100644
> --- a/hw/ppc/trace-events
> +++ b/hw/ppc/trace-events
> @@ -79,6 +79,7 @@ vof_error_unknown_method(const char *method) "\"%s\""
> vof_error_unknown_ihandle_close(uint32_t ih) "ih=0x%x"
> vof_error_unknown_path(const char *path) "\"%s\""
> vof_error_write(uint32_t ih) "ih=0x%x"
> +vof_error_read(uint32_t ih) "ih=0x%x"
> vof_finddevice(const char *path, uint32_t ph) "\"%s\" => ph=0x%x"
> vof_claim(uint32_t virt, uint32_t size, uint32_t align, uint32_t ret) "virt=0x%x size=0x%x align=0x%x => 0x%x"
> vof_release(uint32_t virt, uint32_t size, uint32_t ret) "virt=0x%x size=0x%x => 0x%x"
> @@ -92,6 +93,7 @@ vof_package_to_path(uint32_t ph, const char *tmp, int ret) "ph=0x%x => %s len=%d
> vof_instance_to_path(uint32_t ih, uint32_t ph, const char *tmp, int ret) "ih=0x%x ph=0x%x => %s len=%d"
> vof_instance_to_package(uint32_t ih, uint32_t ph) "ih=0x%x => ph=0x%x"
> vof_write(uint32_t ih, unsigned cb, const char *msg) "ih=0x%x [%u] \"%s\""
> +vof_read(uint32_t ih, unsigned cb, const char *msg) "ih=0x%x [%u] \"%s\""
> vof_avail(uint64_t start, uint64_t end, uint64_t size) "0x%"PRIx64"..0x%"PRIx64" size=0x%"PRIx64
> vof_claimed(uint64_t start, uint64_t end, uint64_t size) "0x%"PRIx64"..0x%"PRIx64" size=0x%"PRIx64
>
> diff --git a/hw/ppc/vof.c b/hw/ppc/vof.c
> index 9ad1aa7626..6f6d424347 100644
> --- a/hw/ppc/vof.c
> +++ b/hw/ppc/vof.c
> @@ -9,6 +9,7 @@
>  * SPDX-License-Identifier: GPL-2.0-or-later
>  */
>
> +#include CONFIG_DEVICES /* CONFIG_PSERIES */
> #include "qemu/osdep.h"
> #include "qemu/ctype.h"
> #include "qemu/timer.h"
> @@ -23,6 +24,7 @@
> #include "qom/qom-qobject.h"
> #include "trace.h"
>
> +#include "hw/ppc/spapr_vio.h"
> #include <libfdt.h>
>
> /*
> @@ -45,6 +47,7 @@ typedef struct {
> typedef struct {
>     char *path; /* the path used to open the instance */
>     uint32_t phandle;
> +    void *vty;
> } OfInstance;
>
> static int readstr(hwaddr pa, char *buf, int size)
> @@ -459,6 +462,28 @@ static uint32_t vof_do_open(void *fdt, Vof *vof, int offset, const char *path)
>     ++vof->of_instance_last;
>
>     inst->path = g_strdup(path);
> +    inst->vty = NULL;
> +
> +#ifdef CONFIG_PSERIES
> +    const char *node_name = fdt_get_name(fdt, offset, NULL);
> +    if (node_name && strncmp(node_name, "vty", 3) == 0) {
> +        uint8_t discard_buf[VOF_VTY_BUF_SIZE];
> +        MachineState *ms = MACHINE(qdev_get_machine());
> +        SpaprMachineState *spapr = SPAPR_MACHINE(ms);
> +
> +        if (spapr && spapr->vio_bus) {
> +            inst->vty = spapr_vty_get_default(spapr->vio_bus);
> +            if (inst->vty) {
> +                /* Flush any stale data from the VTY input buffer */
> +                while (vty_getchars(inst->vty, discard_buf,
> +                                    sizeof(discard_buf)) > 0) {
> +                    /* discard */
> +                }
> +            }
> +        }
> +    }
> +#endif
> +
>     g_hash_table_insert(vof->of_instances,
>                         GINT_TO_POINTER(vof->of_instance_last),
>                         inst);
> @@ -577,6 +602,23 @@ static uint32_t vof_write(Vof *vof, uint32_t ihandle, uint32_t buf,
>         return PROM_ERROR;
>     }
>
> +#ifdef CONFIG_PSERIES
> +    if (inst->vty) {
> +        uint32_t total_written = 0;
> +
> +        for ( ; len > 0; len -= cb) {
> +            cb = MIN(len, sizeof(tmp));
> +            if (VOF_MEM_READ(buf, tmp, cb) != MEMTX_OK) {
> +                return PROM_ERROR;
> +            }
> +            vty_putchars(inst->vty, (uint8_t *)tmp, cb);
> +            buf += cb;
> +            total_written += cb;
> +        }
> +        return total_written;
> +    }
> +#endif
> +

Instead of adding #ifdefs in this file could these be implemented as some 
functions exported by spapr_vof.c and called here without needing #ifdefs? 
Maybe it could be part of VofMachineIfClass similar to setprop.

Regards,
BALATON Zoltan

>     for ( ; len > 0; len -= cb) {
>         cb = MIN(len, sizeof(tmp) - 1);
>         if (VOF_MEM_READ(buf, tmp, cb) != MEMTX_OK) {
> @@ -594,6 +636,46 @@ static uint32_t vof_write(Vof *vof, uint32_t ihandle, uint32_t buf,
>     return len;
> }
>
> +static uint32_t vof_read(Vof *vof, uint32_t ihandle, uint32_t buf,
> +                         uint32_t len)
> +{
> +    OfInstance *inst = (OfInstance *)
> +        g_hash_table_lookup(vof->of_instances, GINT_TO_POINTER(ihandle));
> +
> +    if (!inst) {
> +        trace_vof_error_read(ihandle);
> +        return PROM_ERROR;
> +    }
> +
> +#ifdef CONFIG_PSERIES
> +    if (inst->vty) {
> +        uint8_t tmp[VOF_VTY_BUF_SIZE];
> +        unsigned cb = MIN(len, sizeof(tmp));
> +        uint32_t bytes_read = vty_getchars(inst->vty, tmp, cb);
> +        if (bytes_read > 0) {
> +            if (VOF_MEM_WRITE(buf, tmp, bytes_read) != MEMTX_OK) {
> +                trace_vof_error_read(ihandle);
> +                return PROM_ERROR;
> +            }
> +        }
> +        if (trace_event_get_state(TRACE_VOF_READ) &&
> +            qemu_loglevel_mask(LOG_TRACE)) {
> +            char trace_buf[VOF_VTY_BUF_SIZE + 1];
> +            memcpy(trace_buf, tmp, bytes_read);
> +            trace_buf[bytes_read] = '\0';
> +            trace_vof_read(ihandle, bytes_read, trace_buf);
> +        }
> +        return bytes_read;
> +    }
> +#endif
> +
> +    /*
> +     * For other devices, return 0 to indicate no data available.
> +     * This allows GRUB to continue without blocking on input.
> +     */
> +    return 0;
> +}
> +
> static void vof_claimed_dump(GArray *claimed)
> {
>     int i;
> @@ -906,6 +988,8 @@ static uint32_t vof_client_handle(MachineState *ms, void *fdt, Vof *vof,
>         ret = vof_instance_to_path(fdt, vof, args[0], args[1], args[2]);
>     } else if (cmpserv("write", 3, 1)) {
>         ret = vof_write(vof, args[0], args[1], args[2]);
> +    } else if (cmpserv("read", 3, 1)) {
> +        ret = vof_read(vof, args[0], args[1], args[2]);
>     } else if (cmpserv("claim", 3, 1)) {
>         uint64_t ret64 = vof_claim(vof, args[0], args[1], args[2]);
>
> diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
> index 0ea0dbae8b..81e7c0b91b 100644
> --- a/include/hw/ppc/spapr_vio.h
> +++ b/include/hw/ppc/spapr_vio.h
> @@ -136,6 +136,7 @@ static inline int spapr_vio_dma_set(SpaprVioDevice *dev, uint64_t taddr,
> int spapr_vio_send_crq(SpaprVioDevice *dev, uint8_t *crq);
>
> SpaprVioDevice *vty_lookup(SpaprMachineState *spapr, target_ulong reg);
> +int vty_getchars(SpaprVioDevice *sdev, uint8_t *buf, int max);
> void vty_putchars(SpaprVioDevice *sdev, uint8_t *buf, int len);
> void spapr_vty_create(SpaprVioBus *bus, Chardev *chardev);
> void spapr_vlan_create(SpaprVioBus *bus, NICInfo *nd);
>
Utkarsh Verma Oct. 8, 2026, 9:17 a.m. UTC | #2
Hi Balaton,
Thank you for the review.

On 10/7/26 8:05 PM, BALATON Zoltan wrote:
> On Fri, 2 Oct 2026, uverma@linux.ibm.com wrote:
>> From: Utkarsh Verma <uverma@linux.ibm.com>
>>
>> Extend the VOF client interface to support console I/O through the 
>> sPAPR VTY
>> device, which is needed by bootloaders such as GRUB during disk boot.
>>
>> Add vof_read() to implement the OpenFirmware "read" client service, 
>> which was
>> previously missing.
>>
>> Route the OF read and write services backed by vty_getchars() and 
>> vty_putchars()
>>
>> Make vty_getchars() public similar to vty_putchars().
>>
>> AI-used-for: code
>> Signed-off-by: Utkarsh Verma <uverma@linux.ibm.com>
>> ---
>> hw/char/spapr_vty.c        |  2 +-
>> hw/ppc/spapr_vof.c         |  2 +
>> hw/ppc/trace-events        |  2 +
>> hw/ppc/vof.c               | 84 ++++++++++++++++++++++++++++++++++++++
>> include/hw/ppc/spapr_vio.h |  1 +
>> 5 files changed, 90 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
>> index 1dd9fb155c..2c97e0e027 100644
>> --- a/hw/char/spapr_vty.c
>> +++ b/hw/char/spapr_vty.c
>> @@ -52,7 +52,7 @@ static void vty_receive(void *opaque, const uint8_t 
>> *buf, int size)
>>     }
>> }
>>
>> -static int vty_getchars(SpaprVioDevice *sdev, uint8_t *buf, int max)
>> +int vty_getchars(SpaprVioDevice *sdev, uint8_t *buf, int max)
>> {
>>     SpaprVioVty *dev = VIO_SPAPR_VTY_DEVICE(sdev);
>>     int n = 0;
>> diff --git a/hw/ppc/spapr_vof.c b/hw/ppc/spapr_vof.c
>> index 78d5b7d5b5..3195c859a4 100644
>> --- a/hw/ppc/spapr_vof.c
>> +++ b/hw/ppc/spapr_vof.c
>> @@ -76,6 +76,8 @@ void spapr_vof_client_dt_finalize(SpaprMachineState 
>> *spapr, void *fdt)
>>     if (stdout_path) {
>>         _FDT(vof_client_open_store(fdt, spapr->vof, "/chosen", "stdout",
>>                                    stdout_path));
>> +        _FDT(vof_client_open_store(fdt, spapr->vof, "/chosen", "stdin",
>> +                                   stdout_path));
>>     }
>> }
>>
>> diff --git a/hw/ppc/trace-events b/hw/ppc/trace-events
>> index 1f125ce841..dbdcfada26 100644
>> --- a/hw/ppc/trace-events
>> +++ b/hw/ppc/trace-events
>> @@ -79,6 +79,7 @@ vof_error_unknown_method(const char *method) "\"%s\""
>> vof_error_unknown_ihandle_close(uint32_t ih) "ih=0x%x"
>> vof_error_unknown_path(const char *path) "\"%s\""
>> vof_error_write(uint32_t ih) "ih=0x%x"
>> +vof_error_read(uint32_t ih) "ih=0x%x"
>> vof_finddevice(const char *path, uint32_t ph) "\"%s\" => ph=0x%x"
>> vof_claim(uint32_t virt, uint32_t size, uint32_t align, uint32_t ret) 
>> "virt=0x%x size=0x%x align=0x%x => 0x%x"
>> vof_release(uint32_t virt, uint32_t size, uint32_t ret) "virt=0x%x 
>> size=0x%x => 0x%x"
>> @@ -92,6 +93,7 @@ vof_package_to_path(uint32_t ph, const char *tmp, 
>> int ret) "ph=0x%x => %s len=%d
>> vof_instance_to_path(uint32_t ih, uint32_t ph, const char *tmp, int 
>> ret) "ih=0x%x ph=0x%x => %s len=%d"
>> vof_instance_to_package(uint32_t ih, uint32_t ph) "ih=0x%x => ph=0x%x"
>> vof_write(uint32_t ih, unsigned cb, const char *msg) "ih=0x%x [%u] 
>> \"%s\""
>> +vof_read(uint32_t ih, unsigned cb, const char *msg) "ih=0x%x [%u] 
>> \"%s\""
>> vof_avail(uint64_t start, uint64_t end, uint64_t size) 
>> "0x%"PRIx64"..0x%"PRIx64" size=0x%"PRIx64
>> vof_claimed(uint64_t start, uint64_t end, uint64_t size) 
>> "0x%"PRIx64"..0x%"PRIx64" size=0x%"PRIx64
>>
>> diff --git a/hw/ppc/vof.c b/hw/ppc/vof.c
>> index 9ad1aa7626..6f6d424347 100644
>> --- a/hw/ppc/vof.c
>> +++ b/hw/ppc/vof.c
>> @@ -9,6 +9,7 @@
>>  * SPDX-License-Identifier: GPL-2.0-or-later
>>  */
>>
>> +#include CONFIG_DEVICES /* CONFIG_PSERIES */
>> #include "qemu/osdep.h"
>> #include "qemu/ctype.h"
>> #include "qemu/timer.h"
>> @@ -23,6 +24,7 @@
>> #include "qom/qom-qobject.h"
>> #include "trace.h"
>>
>> +#include "hw/ppc/spapr_vio.h"
>> #include <libfdt.h>
>>
>> /*
>> @@ -45,6 +47,7 @@ typedef struct {
>> typedef struct {
>>     char *path; /* the path used to open the instance */
>>     uint32_t phandle;
>> +    void *vty;
>> } OfInstance;
>>
>> static int readstr(hwaddr pa, char *buf, int size)
>> @@ -459,6 +462,28 @@ static uint32_t vof_do_open(void *fdt, Vof *vof, 
>> int offset, const char *path)
>>     ++vof->of_instance_last;
>>
>>     inst->path = g_strdup(path);
>> +    inst->vty = NULL;
>> +
>> +#ifdef CONFIG_PSERIES
>> +    const char *node_name = fdt_get_name(fdt, offset, NULL);
>> +    if (node_name && strncmp(node_name, "vty", 3) == 0) {
>> +        uint8_t discard_buf[VOF_VTY_BUF_SIZE];
>> +        MachineState *ms = MACHINE(qdev_get_machine());
>> +        SpaprMachineState *spapr = SPAPR_MACHINE(ms);
>> +
>> +        if (spapr && spapr->vio_bus) {
>> +            inst->vty = spapr_vty_get_default(spapr->vio_bus);
>> +            if (inst->vty) {
>> +                /* Flush any stale data from the VTY input buffer */
>> +                while (vty_getchars(inst->vty, discard_buf,
>> +                                    sizeof(discard_buf)) > 0) {
>> +                    /* discard */
>> +                }
>> +            }
>> +        }
>> +    }
>> +#endif
>> +
>>     g_hash_table_insert(vof->of_instances,
>>                         GINT_TO_POINTER(vof->of_instance_last),
>>                         inst);
>> @@ -577,6 +602,23 @@ static uint32_t vof_write(Vof *vof, uint32_t 
>> ihandle, uint32_t buf,
>>         return PROM_ERROR;
>>     }
>>
>> +#ifdef CONFIG_PSERIES
>> +    if (inst->vty) {
>> +        uint32_t total_written = 0;
>> +
>> +        for ( ; len > 0; len -= cb) {
>> +            cb = MIN(len, sizeof(tmp));
>> +            if (VOF_MEM_READ(buf, tmp, cb) != MEMTX_OK) {
>> +                return PROM_ERROR;
>> +            }
>> +            vty_putchars(inst->vty, (uint8_t *)tmp, cb);
>> +            buf += cb;
>> +            total_written += cb;
>> +        }
>> +        return total_written;
>> +    }
>> +#endif
>> +
> 
> Instead of adding #ifdefs in this file could these be implemented as 
> some functions exported by spapr_vof.c and called here without needing 
> #ifdefs? Maybe it could be part of VofMachineIfClass similar to setprop.
> 
Agreed. In v3 I will add new callbacks in VofMachineIfClass for 
vty_open, vty_read and vty_write and implement all those in spapr_vof.c 
and just call the hook from here without needing any ifdefs.

> Regards,
> BALATON Zoltan
> 
>>     for ( ; len > 0; len -= cb) {
>>         cb = MIN(len, sizeof(tmp) - 1);
>>         if (VOF_MEM_READ(buf, tmp, cb) != MEMTX_OK) {
>> @@ -594,6 +636,46 @@ static uint32_t vof_write(Vof *vof, uint32_t 
>> ihandle, uint32_t buf,
>>     return len;
>> }
>>
>> +static uint32_t vof_read(Vof *vof, uint32_t ihandle, uint32_t buf,
>> +                         uint32_t len)
>> +{
>> +    OfInstance *inst = (OfInstance *)
>> +        g_hash_table_lookup(vof->of_instances, 
>> GINT_TO_POINTER(ihandle));
>> +
>> +    if (!inst) {
>> +        trace_vof_error_read(ihandle);
>> +        return PROM_ERROR;
>> +    }
>> +
>> +#ifdef CONFIG_PSERIES
>> +    if (inst->vty) {
>> +        uint8_t tmp[VOF_VTY_BUF_SIZE];
>> +        unsigned cb = MIN(len, sizeof(tmp));
>> +        uint32_t bytes_read = vty_getchars(inst->vty, tmp, cb);
>> +        if (bytes_read > 0) {
>> +            if (VOF_MEM_WRITE(buf, tmp, bytes_read) != MEMTX_OK) {
>> +                trace_vof_error_read(ihandle);
>> +                return PROM_ERROR;
>> +            }
>> +        }
>> +        if (trace_event_get_state(TRACE_VOF_READ) &&
>> +            qemu_loglevel_mask(LOG_TRACE)) {
>> +            char trace_buf[VOF_VTY_BUF_SIZE + 1];
>> +            memcpy(trace_buf, tmp, bytes_read);
>> +            trace_buf[bytes_read] = '\0';
>> +            trace_vof_read(ihandle, bytes_read, trace_buf);
>> +        }
>> +        return bytes_read;
>> +    }
>> +#endif
>> +
>> +    /*
>> +     * For other devices, return 0 to indicate no data available.
>> +     * This allows GRUB to continue without blocking on input.
>> +     */
>> +    return 0;
>> +}
>> +
>> static void vof_claimed_dump(GArray *claimed)
>> {
>>     int i;
>> @@ -906,6 +988,8 @@ static uint32_t vof_client_handle(MachineState 
>> *ms, void *fdt, Vof *vof,
>>         ret = vof_instance_to_path(fdt, vof, args[0], args[1], args[2]);
>>     } else if (cmpserv("write", 3, 1)) {
>>         ret = vof_write(vof, args[0], args[1], args[2]);
>> +    } else if (cmpserv("read", 3, 1)) {
>> +        ret = vof_read(vof, args[0], args[1], args[2]);
>>     } else if (cmpserv("claim", 3, 1)) {
>>         uint64_t ret64 = vof_claim(vof, args[0], args[1], args[2]);
>>
>> diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
>> index 0ea0dbae8b..81e7c0b91b 100644
>> --- a/include/hw/ppc/spapr_vio.h
>> +++ b/include/hw/ppc/spapr_vio.h
>> @@ -136,6 +136,7 @@ static inline int spapr_vio_dma_set(SpaprVioDevice 
>> *dev, uint64_t taddr,
>> int spapr_vio_send_crq(SpaprVioDevice *dev, uint8_t *crq);
>>
>> SpaprVioDevice *vty_lookup(SpaprMachineState *spapr, target_ulong reg);
>> +int vty_getchars(SpaprVioDevice *sdev, uint8_t *buf, int max);
>> void vty_putchars(SpaprVioDevice *sdev, uint8_t *buf, int len);
>> void spapr_vty_create(SpaprVioBus *bus, Chardev *chardev);
>> void spapr_vlan_create(SpaprVioBus *bus, NICInfo *nd);
>>
> 

Regards,
Utkarsh
diff mbox series

Patch

diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 1dd9fb155c..2c97e0e027 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -52,7 +52,7 @@  static void vty_receive(void *opaque, const uint8_t *buf, int size)
     }
 }
 
-static int vty_getchars(SpaprVioDevice *sdev, uint8_t *buf, int max)
+int vty_getchars(SpaprVioDevice *sdev, uint8_t *buf, int max)
 {
     SpaprVioVty *dev = VIO_SPAPR_VTY_DEVICE(sdev);
     int n = 0;
diff --git a/hw/ppc/spapr_vof.c b/hw/ppc/spapr_vof.c
index 78d5b7d5b5..3195c859a4 100644
--- a/hw/ppc/spapr_vof.c
+++ b/hw/ppc/spapr_vof.c
@@ -76,6 +76,8 @@  void spapr_vof_client_dt_finalize(SpaprMachineState *spapr, void *fdt)
     if (stdout_path) {
         _FDT(vof_client_open_store(fdt, spapr->vof, "/chosen", "stdout",
                                    stdout_path));
+        _FDT(vof_client_open_store(fdt, spapr->vof, "/chosen", "stdin",
+                                   stdout_path));
     }
 }
 
diff --git a/hw/ppc/trace-events b/hw/ppc/trace-events
index 1f125ce841..dbdcfada26 100644
--- a/hw/ppc/trace-events
+++ b/hw/ppc/trace-events
@@ -79,6 +79,7 @@  vof_error_unknown_method(const char *method) "\"%s\""
 vof_error_unknown_ihandle_close(uint32_t ih) "ih=0x%x"
 vof_error_unknown_path(const char *path) "\"%s\""
 vof_error_write(uint32_t ih) "ih=0x%x"
+vof_error_read(uint32_t ih) "ih=0x%x"
 vof_finddevice(const char *path, uint32_t ph) "\"%s\" => ph=0x%x"
 vof_claim(uint32_t virt, uint32_t size, uint32_t align, uint32_t ret) "virt=0x%x size=0x%x align=0x%x => 0x%x"
 vof_release(uint32_t virt, uint32_t size, uint32_t ret) "virt=0x%x size=0x%x => 0x%x"
@@ -92,6 +93,7 @@  vof_package_to_path(uint32_t ph, const char *tmp, int ret) "ph=0x%x => %s len=%d
 vof_instance_to_path(uint32_t ih, uint32_t ph, const char *tmp, int ret) "ih=0x%x ph=0x%x => %s len=%d"
 vof_instance_to_package(uint32_t ih, uint32_t ph) "ih=0x%x => ph=0x%x"
 vof_write(uint32_t ih, unsigned cb, const char *msg) "ih=0x%x [%u] \"%s\""
+vof_read(uint32_t ih, unsigned cb, const char *msg) "ih=0x%x [%u] \"%s\""
 vof_avail(uint64_t start, uint64_t end, uint64_t size) "0x%"PRIx64"..0x%"PRIx64" size=0x%"PRIx64
 vof_claimed(uint64_t start, uint64_t end, uint64_t size) "0x%"PRIx64"..0x%"PRIx64" size=0x%"PRIx64
 
diff --git a/hw/ppc/vof.c b/hw/ppc/vof.c
index 9ad1aa7626..6f6d424347 100644
--- a/hw/ppc/vof.c
+++ b/hw/ppc/vof.c
@@ -9,6 +9,7 @@ 
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
+#include CONFIG_DEVICES /* CONFIG_PSERIES */
 #include "qemu/osdep.h"
 #include "qemu/ctype.h"
 #include "qemu/timer.h"
@@ -23,6 +24,7 @@ 
 #include "qom/qom-qobject.h"
 #include "trace.h"
 
+#include "hw/ppc/spapr_vio.h"
 #include <libfdt.h>
 
 /*
@@ -45,6 +47,7 @@  typedef struct {
 typedef struct {
     char *path; /* the path used to open the instance */
     uint32_t phandle;
+    void *vty;
 } OfInstance;
 
 static int readstr(hwaddr pa, char *buf, int size)
@@ -459,6 +462,28 @@  static uint32_t vof_do_open(void *fdt, Vof *vof, int offset, const char *path)
     ++vof->of_instance_last;
 
     inst->path = g_strdup(path);
+    inst->vty = NULL;
+
+#ifdef CONFIG_PSERIES
+    const char *node_name = fdt_get_name(fdt, offset, NULL);
+    if (node_name && strncmp(node_name, "vty", 3) == 0) {
+        uint8_t discard_buf[VOF_VTY_BUF_SIZE];
+        MachineState *ms = MACHINE(qdev_get_machine());
+        SpaprMachineState *spapr = SPAPR_MACHINE(ms);
+
+        if (spapr && spapr->vio_bus) {
+            inst->vty = spapr_vty_get_default(spapr->vio_bus);
+            if (inst->vty) {
+                /* Flush any stale data from the VTY input buffer */
+                while (vty_getchars(inst->vty, discard_buf,
+                                    sizeof(discard_buf)) > 0) {
+                    /* discard */
+                }
+            }
+        }
+    }
+#endif
+
     g_hash_table_insert(vof->of_instances,
                         GINT_TO_POINTER(vof->of_instance_last),
                         inst);
@@ -577,6 +602,23 @@  static uint32_t vof_write(Vof *vof, uint32_t ihandle, uint32_t buf,
         return PROM_ERROR;
     }
 
+#ifdef CONFIG_PSERIES
+    if (inst->vty) {
+        uint32_t total_written = 0;
+
+        for ( ; len > 0; len -= cb) {
+            cb = MIN(len, sizeof(tmp));
+            if (VOF_MEM_READ(buf, tmp, cb) != MEMTX_OK) {
+                return PROM_ERROR;
+            }
+            vty_putchars(inst->vty, (uint8_t *)tmp, cb);
+            buf += cb;
+            total_written += cb;
+        }
+        return total_written;
+    }
+#endif
+
     for ( ; len > 0; len -= cb) {
         cb = MIN(len, sizeof(tmp) - 1);
         if (VOF_MEM_READ(buf, tmp, cb) != MEMTX_OK) {
@@ -594,6 +636,46 @@  static uint32_t vof_write(Vof *vof, uint32_t ihandle, uint32_t buf,
     return len;
 }
 
+static uint32_t vof_read(Vof *vof, uint32_t ihandle, uint32_t buf,
+                         uint32_t len)
+{
+    OfInstance *inst = (OfInstance *)
+        g_hash_table_lookup(vof->of_instances, GINT_TO_POINTER(ihandle));
+
+    if (!inst) {
+        trace_vof_error_read(ihandle);
+        return PROM_ERROR;
+    }
+
+#ifdef CONFIG_PSERIES
+    if (inst->vty) {
+        uint8_t tmp[VOF_VTY_BUF_SIZE];
+        unsigned cb = MIN(len, sizeof(tmp));
+        uint32_t bytes_read = vty_getchars(inst->vty, tmp, cb);
+        if (bytes_read > 0) {
+            if (VOF_MEM_WRITE(buf, tmp, bytes_read) != MEMTX_OK) {
+                trace_vof_error_read(ihandle);
+                return PROM_ERROR;
+            }
+        }
+        if (trace_event_get_state(TRACE_VOF_READ) &&
+            qemu_loglevel_mask(LOG_TRACE)) {
+            char trace_buf[VOF_VTY_BUF_SIZE + 1];
+            memcpy(trace_buf, tmp, bytes_read);
+            trace_buf[bytes_read] = '\0';
+            trace_vof_read(ihandle, bytes_read, trace_buf);
+        }
+        return bytes_read;
+    }
+#endif
+
+    /*
+     * For other devices, return 0 to indicate no data available.
+     * This allows GRUB to continue without blocking on input.
+     */
+    return 0;
+}
+
 static void vof_claimed_dump(GArray *claimed)
 {
     int i;
@@ -906,6 +988,8 @@  static uint32_t vof_client_handle(MachineState *ms, void *fdt, Vof *vof,
         ret = vof_instance_to_path(fdt, vof, args[0], args[1], args[2]);
     } else if (cmpserv("write", 3, 1)) {
         ret = vof_write(vof, args[0], args[1], args[2]);
+    } else if (cmpserv("read", 3, 1)) {
+        ret = vof_read(vof, args[0], args[1], args[2]);
     } else if (cmpserv("claim", 3, 1)) {
         uint64_t ret64 = vof_claim(vof, args[0], args[1], args[2]);
 
diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index 0ea0dbae8b..81e7c0b91b 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -136,6 +136,7 @@  static inline int spapr_vio_dma_set(SpaprVioDevice *dev, uint64_t taddr,
 int spapr_vio_send_crq(SpaprVioDevice *dev, uint8_t *crq);
 
 SpaprVioDevice *vty_lookup(SpaprMachineState *spapr, target_ulong reg);
+int vty_getchars(SpaprVioDevice *sdev, uint8_t *buf, int max);
 void vty_putchars(SpaprVioDevice *sdev, uint8_t *buf, int len);
 void spapr_vty_create(SpaprVioBus *bus, Chardev *chardev);
 void spapr_vlan_create(SpaprVioBus *bus, NICInfo *nd);