DevATA.cpp@ 46243

Last change on this file since 46243 was 45974, checked in by vboxsync, 12 years ago
DevATA: Return no data for status register if no device on channel present.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 289.1 KB

Line
1	/* $Id: DevATA.cpp 45974 2013-05-09 22:18:45Z vboxsync $ */
2	/** @file
3	* VBox storage devices: ATA/ATAPI controller device (disk and cdrom).
4	*/
5
6	/*
7	* Copyright (C) 2006-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/*******************************************************************************
19	* Defined Constants And Macros *
20	*******************************************************************************/
21	/** Temporary instrumentation for tracking down potential virtual disk
22	* write performance issues. */
23	#undef VBOX_INSTRUMENT_DMA_WRITES
24
25	/** @name The SSM saved state versions.
26	* @{
27	*/
28	/** The current saved state version. */
29	#define ATA_SAVED_STATE_VERSION 20
30	/** The saved state version used by VirtualBox 3.0.
31	* This lacks the config part and has the type at the and. */
32	#define ATA_SAVED_STATE_VERSION_VBOX_30 19
33	#define ATA_SAVED_STATE_VERSION_WITH_BOOL_TYPE 18
34	#define ATA_SAVED_STATE_VERSION_WITHOUT_FULL_SENSE 16
35	#define ATA_SAVED_STATE_VERSION_WITHOUT_EVENT_STATUS 17
36	/** @} */
37
38	/*******************************************************************************
39	* Header Files *
40	*******************************************************************************/
41	#define LOG_GROUP LOG_GROUP_DEV_IDE
42	#include <VBox/vmm/pdmdev.h>
43	#include <iprt/assert.h>
44	#include <iprt/string.h>
45	#ifdef IN_RING3
46	# include <iprt/uuid.h>
47	# include <iprt/semaphore.h>
48	# include <iprt/thread.h>
49	# include <iprt/time.h>
50	# include <iprt/alloc.h>
51	#endif /* IN_RING3 */
52	#include <iprt/critsect.h>
53	#include <iprt/asm.h>
54	#include <VBox/vmm/stam.h>
55	#include <VBox/vmm/mm.h>
56	#include <VBox/vmm/pgm.h>
57
58	#include <VBox/scsi.h>
59
60	#include "PIIX3ATABmDma.h"
61	#include "ide.h"
62	#include "ATAPIPassthrough.h"
63	#include "VBoxDD.h"
64
65	/*******************************************************************************
66	* Defined Constants And Macros *
67	*******************************************************************************/
68	/**
69	* Maximum number of sectors to transfer in a READ/WRITE MULTIPLE request.
70	* Set to 1 to disable multi-sector read support. According to the ATA
71	* specification this must be a power of 2 and it must fit in an 8 bit
72	* value. Thus the only valid values are 1, 2, 4, 8, 16, 32, 64 and 128.
73	*/
74	#define ATA_MAX_MULT_SECTORS 128
75
76	/**
77	* Fastest PIO mode supported by the drive.
78	*/
79	#define ATA_PIO_MODE_MAX 4
80	/**
81	* Fastest MDMA mode supported by the drive.
82	*/
83	#define ATA_MDMA_MODE_MAX 2
84	/**
85	* Fastest UDMA mode supported by the drive.
86	*/
87	#define ATA_UDMA_MODE_MAX 6
88
89	/** ATAPI sense info size. */
90	#define ATAPI_SENSE_SIZE 64
91
92	/** The maximum number of release log entries per device. */
93	#define MAX_LOG_REL_ERRORS 1024
94
95	/* MediaEventStatus */
96	#define ATA_EVENT_STATUS_UNCHANGED 0 /*< medium event status not changed /
97	#define ATA_EVENT_STATUS_MEDIA_NEW 1 /*< new medium inserted /
98	#define ATA_EVENT_STATUS_MEDIA_REMOVED 2 /*< medium removed /
99	#define ATA_EVENT_STATUS_MEDIA_CHANGED 3 /*< medium was removed + new medium was inserted /
100	#define ATA_EVENT_STATUS_MEDIA_EJECT_REQUESTED 4 /*< medium eject requested (eject button pressed) /
101
102	/* Media track type */
103	#define ATA_MEDIA_TYPE_UNKNOWN 0 /*< unknown CD type /
104	#define ATA_MEDIA_NO_DISC 0x70 /*< Door closed, no medium /
105
106	/*******************************************************************************
107	* Structures and Typedefs *
108	*******************************************************************************/
109	/**
110	* The state of an ATA device.
111	*
112	* @implements PDMIBASE
113	* @implements PDMIBLOCKPORT
114	* @implements PDMIMOUNTNOTIFY
115	*/
116	typedef struct ATADevState
117	{
118	/** Flag indicating whether the current command uses LBA48 mode. */
119	bool fLBA48;
120	/** Flag indicating whether this drive implements the ATAPI command set. */
121	bool fATAPI;
122	/** Set if this interface has asserted the IRQ. */
123	bool fIrqPending;
124	/** Currently configured number of sectors in a multi-sector transfer. */
125	uint8_t cMultSectors;
126	/** PCHS disk geometry. */
127	PDMMEDIAGEOMETRY PCHSGeometry;
128	/** Total number of sectors on this disk. */
129	uint64_t cTotalSectors;
130	/** Number of sectors to transfer per IRQ. */
131	uint32_t cSectorsPerIRQ;
132
133	/** ATA/ATAPI register 1: feature (write-only). */
134	uint8_t uATARegFeature;
135	/** ATA/ATAPI register 1: feature, high order byte. */
136	uint8_t uATARegFeatureHOB;
137	/** ATA/ATAPI register 1: error (read-only). */
138	uint8_t uATARegError;
139	/** ATA/ATAPI register 2: sector count (read/write). */
140	uint8_t uATARegNSector;
141	/** ATA/ATAPI register 2: sector count, high order byte. */
142	uint8_t uATARegNSectorHOB;
143	/** ATA/ATAPI register 3: sector (read/write). */
144	uint8_t uATARegSector;
145	/** ATA/ATAPI register 3: sector, high order byte. */
146	uint8_t uATARegSectorHOB;
147	/** ATA/ATAPI register 4: cylinder low (read/write). */
148	uint8_t uATARegLCyl;
149	/** ATA/ATAPI register 4: cylinder low, high order byte. */
150	uint8_t uATARegLCylHOB;
151	/** ATA/ATAPI register 5: cylinder high (read/write). */
152	uint8_t uATARegHCyl;
153	/** ATA/ATAPI register 5: cylinder high, high order byte. */
154	uint8_t uATARegHCylHOB;
155	/** ATA/ATAPI register 6: select drive/head (read/write). */
156	uint8_t uATARegSelect;
157	/** ATA/ATAPI register 7: status (read-only). */
158	uint8_t uATARegStatus;
159	/** ATA/ATAPI register 7: command (write-only). */
160	uint8_t uATARegCommand;
161	/** ATA/ATAPI drive control register (write-only). */
162	uint8_t uATARegDevCtl;
163
164	/** Currently active transfer mode (MDMA/UDMA) and speed. */
165	uint8_t uATATransferMode;
166	/** Current transfer direction. */
167	uint8_t uTxDir;
168	/** Index of callback for begin transfer. */
169	uint8_t iBeginTransfer;
170	/** Index of callback for source/sink of data. */
171	uint8_t iSourceSink;
172	/** Flag indicating whether the current command transfers data in DMA mode. */
173	bool fDMA;
174	/** Set to indicate that ATAPI transfer semantics must be used. */
175	bool fATAPITransfer;
176
177	/** Total ATA/ATAPI transfer size, shared PIO/DMA. */
178	uint32_t cbTotalTransfer;
179	/** Elementary ATA/ATAPI transfer size, shared PIO/DMA. */
180	uint32_t cbElementaryTransfer;
181	/** Maximum ATAPI elementary transfer size, PIO only. */
182	uint32_t cbPIOTransferLimit;
183	/** Current read/write buffer position, shared PIO/DMA. */
184	uint32_t iIOBufferCur;
185	/** First element beyond end of valid buffer content, shared PIO/DMA. */
186	uint32_t iIOBufferEnd;
187
188	/** ATA/ATAPI current PIO read/write transfer position. Not shared with DMA for safety reasons. */
189	uint32_t iIOBufferPIODataStart;
190	/** ATA/ATAPI current PIO read/write transfer end. Not shared with DMA for safety reasons. */
191	uint32_t iIOBufferPIODataEnd;
192
193	/** ATAPI current LBA position. */
194	uint32_t iATAPILBA;
195	/** ATAPI current sector size. */
196	uint32_t cbATAPISector;
197	/** ATAPI current command. */
198	uint8_t aATAPICmd[ATAPI_PACKET_SIZE];
199	/** ATAPI sense data. */
200	uint8_t abATAPISense[ATAPI_SENSE_SIZE];
201	/** HACK: Countdown till we report a newly unmounted drive as mounted. */
202	uint8_t cNotifiedMediaChange;
203	/** The same for GET_EVENT_STATUS for mechanism */
204	volatile uint32_t MediaEventStatus;
205
206	/** Media type if known. */
207	volatile uint32_t MediaTrackType;
208
209	uint32_t Aligmnent0; /*< Padding to 8-byte boundary. /
210
211	/** The status LED state for this drive. */
212	PDMLED Led;
213
214	/** Size of I/O buffer. */
215	uint32_t cbIOBuffer;
216	/** Pointer to the I/O buffer. */
217	R3PTRTYPE(uint8_t *) pbIOBufferR3;
218	/** Pointer to the I/O buffer. */
219	R0PTRTYPE(uint8_t *) pbIOBufferR0;
220	/** Pointer to the I/O buffer. */
221	RCPTRTYPE(uint8_t *) pbIOBufferRC;
222
223	RTRCPTR Aligmnent1; /*< Align the statistics at an 8-byte boundary. /
224
225	/*
226	* No data that is part of the saved state after this point!!!!!
227	*/
228
229	/* Release statistics: number of ATA DMA commands. */
230	STAMCOUNTER StatATADMA;
231	/* Release statistics: number of ATA PIO commands. */
232	STAMCOUNTER StatATAPIO;
233	/* Release statistics: number of ATAPI PIO commands. */
234	STAMCOUNTER StatATAPIDMA;
235	/* Release statistics: number of ATAPI PIO commands. */
236	STAMCOUNTER StatATAPIPIO;
237	#ifdef VBOX_INSTRUMENT_DMA_WRITES
238	/* Release statistics: number of DMA sector writes and the time spent. */
239	STAMPROFILEADV StatInstrVDWrites;
240	#endif
241
242	/** Statistics: number of read operations and the time spent reading. */
243	STAMPROFILEADV StatReads;
244	/** Statistics: number of bytes read. */
245	STAMCOUNTER StatBytesRead;
246	/** Statistics: number of write operations and the time spent writing. */
247	STAMPROFILEADV StatWrites;
248	/** Statistics: number of bytes written. */
249	STAMCOUNTER StatBytesWritten;
250	/** Statistics: number of flush operations and the time spend flushing. */
251	STAMPROFILE StatFlushes;
252
253	/** Mark the drive as having a non-rotational medium (i.e. as a SSD). */
254	bool fNonRotational;
255	/** Enable passing through commands directly to the ATAPI drive. */
256	bool fATAPIPassthrough;
257	/** Flag whether to overwrite inquiry data in passthrough mode. */
258	bool fOverwriteInquiry;
259	/** Number of errors we've reported to the release log.
260	* This is to prevent flooding caused by something going horribly wrong.
261	* this value against MAX_LOG_REL_ERRORS in places likely to cause floods
262	* like the ones we currently seeing on the linux smoke tests (2006-11-10). */
263	uint32_t cErrors;
264	/** Timestamp of last started command. 0 if no command pending. */
265	uint64_t u64CmdTS;
266
267	/** Pointer to the attached driver's base interface. */
268	R3PTRTYPE(PPDMIBASE) pDrvBase;
269	/** Pointer to the attached driver's block interface. */
270	R3PTRTYPE(PPDMIBLOCK) pDrvBlock;
271	/** Pointer to the attached driver's block bios interface. */
272	R3PTRTYPE(PPDMIBLOCKBIOS) pDrvBlockBios;
273	/** Pointer to the attached driver's mount interface.
274	* This is NULL if the driver isn't a removable unit. */
275	R3PTRTYPE(PPDMIMOUNT) pDrvMount;
276	/** The base interface. */
277	PDMIBASE IBase;
278	/** The block port interface. */
279	PDMIBLOCKPORT IPort;
280	/** The mount notify interface. */
281	PDMIMOUNTNOTIFY IMountNotify;
282	/** The LUN #. */
283	RTUINT iLUN;
284	RTUINT Alignment2; /*< Align pDevInsR3 correctly. /
285	/** Pointer to device instance. */
286	PPDMDEVINSR3 pDevInsR3;
287	/** Pointer to controller instance. */
288	R3PTRTYPE(struct ATACONTROLLER *) pControllerR3;
289	/** Pointer to device instance. */
290	PPDMDEVINSR0 pDevInsR0;
291	/** Pointer to controller instance. */
292	R0PTRTYPE(struct ATACONTROLLER *) pControllerR0;
293	/** Pointer to device instance. */
294	PPDMDEVINSRC pDevInsRC;
295	/** Pointer to controller instance. */
296	RCPTRTYPE(struct ATACONTROLLER *) pControllerRC;
297
298	/** The serial number to use for IDENTIFY DEVICE commands. */
299	char szSerialNumber[ATA_SERIAL_NUMBER_LENGTH+1];
300	/** The firmware revision to use for IDENTIFY DEVICE commands. */
301	char szFirmwareRevision[ATA_FIRMWARE_REVISION_LENGTH+1];
302	/** The model number to use for IDENTIFY DEVICE commands. */
303	char szModelNumber[ATA_MODEL_NUMBER_LENGTH+1];
304	/** The vendor identification string for SCSI INQUIRY commands. */
305	char szInquiryVendorId[ATAPI_INQUIRY_VENDOR_ID_LENGTH+1];
306	/** The product identification string for SCSI INQUIRY commands. */
307	char szInquiryProductId[ATAPI_INQUIRY_PRODUCT_ID_LENGTH+1];
308	/** The revision string for SCSI INQUIRY commands. */
309	char szInquiryRevision[ATAPI_INQUIRY_REVISION_LENGTH+1];
310	/** The current tracklist of the loaded medium if passthrough is used. */
311	R3PTRTYPE(PTRACKLIST) pTrackList;
312
313	uint8_t abAlignment4[HC_ARCH_BITS == 64 ? 7 : 3];
314	} ATADevState;
315	AssertCompileMemberAlignment(ATADevState, cTotalSectors, 8);
316	AssertCompileMemberAlignment(ATADevState, StatATADMA, 8);
317	AssertCompileMemberAlignment(ATADevState, u64CmdTS, 8);
318	AssertCompileMemberAlignment(ATADevState, pDevInsR3, 8);
319	AssertCompileMemberAlignment(ATADevState, szSerialNumber, 8);
320	AssertCompileSizeAlignment(ATADevState, 8);
321
322
323	typedef struct ATATransferRequest
324	{
325	uint8_t iIf;
326	uint8_t iBeginTransfer;
327	uint8_t iSourceSink;
328	uint32_t cbTotalTransfer;
329	uint8_t uTxDir;
330	} ATATransferRequest;
331
332
333	typedef struct ATAAbortRequest
334	{
335	uint8_t iIf;
336	bool fResetDrive;
337	} ATAAbortRequest;
338
339
340	typedef enum
341	{
342	/** Begin a new transfer. */
343	ATA_AIO_NEW = 0,
344	/** Continue a DMA transfer. */
345	ATA_AIO_DMA,
346	/** Continue a PIO transfer. */
347	ATA_AIO_PIO,
348	/** Reset the drives on current controller, stop all transfer activity. */
349	ATA_AIO_RESET_ASSERTED,
350	/** Reset the drives on current controller, resume operation. */
351	ATA_AIO_RESET_CLEARED,
352	/** Abort the current transfer of a particular drive. */
353	ATA_AIO_ABORT
354	} ATAAIO;
355
356
357	typedef struct ATARequest
358	{
359	ATAAIO ReqType;
360	union
361	{
362	ATATransferRequest t;
363	ATAAbortRequest a;
364	} u;
365	} ATARequest;
366
367
368	typedef struct ATACONTROLLER
369	{
370	/** The base of the first I/O Port range. */
371	RTIOPORT IOPortBase1;
372	/** The base of the second I/O Port range. (0 if none) */
373	RTIOPORT IOPortBase2;
374	/** The assigned IRQ. */
375	RTUINT irq;
376	/** Access critical section */
377	PDMCRITSECT lock;
378
379	/** Selected drive. */
380	uint8_t iSelectedIf;
381	/** The interface on which to handle async I/O. */
382	uint8_t iAIOIf;
383	/** The state of the async I/O thread. */
384	uint8_t uAsyncIOState;
385	/** Flag indicating whether the next transfer is part of the current command. */
386	bool fChainedTransfer;
387	/** Set when the reset processing is currently active on this controller. */
388	bool fReset;
389	/** Flag whether the current transfer needs to be redone. */
390	bool fRedo;
391	/** Flag whether the redo suspend has been finished. */
392	bool fRedoIdle;
393	/** Flag whether the DMA operation to be redone is the final transfer. */
394	bool fRedoDMALastDesc;
395	/** The BusMaster DMA state. */
396	BMDMAState BmDma;
397	/** Pointer to first DMA descriptor. */
398	RTGCPHYS32 pFirstDMADesc;
399	/** Pointer to last DMA descriptor. */
400	RTGCPHYS32 pLastDMADesc;
401	/** Pointer to current DMA buffer (for redo operations). */
402	RTGCPHYS32 pRedoDMABuffer;
403	/** Size of current DMA buffer (for redo operations). */
404	uint32_t cbRedoDMABuffer;
405
406	/** The ATA/ATAPI interfaces of this controller. */
407	ATADevState aIfs[2];
408
409	/** Pointer to device instance. */
410	PPDMDEVINSR3 pDevInsR3;
411	/** Pointer to device instance. */
412	PPDMDEVINSR0 pDevInsR0;
413	/** Pointer to device instance. */
414	PPDMDEVINSRC pDevInsRC;
415
416	/** Set when the destroying the device instance and the thread must exit. */
417	uint32_t volatile fShutdown;
418	/** The async I/O thread handle. NIL_RTTHREAD if no thread. */
419	RTTHREAD AsyncIOThread;
420	/** The event semaphore the thread is waiting on for requests. */
421	RTSEMEVENT AsyncIOSem;
422	/** The request queue for the AIO thread. One element is always unused. */
423	ATARequest aAsyncIORequests[4];
424	/** The position at which to insert a new request for the AIO thread. */
425	volatile uint8_t AsyncIOReqHead;
426	/** The position at which to get a new request for the AIO thread. */
427	volatile uint8_t AsyncIOReqTail;
428	/** Whether to call PDMDevHlpAsyncNotificationCompleted when idle. */
429	bool volatile fSignalIdle;
430	uint8_t Alignment3[1]; /*< Explicit padding of the 1 byte gap. /
431	/** Magic delay before triggering interrupts in DMA mode. */
432	uint32_t DelayIRQMillies;
433	/** The mutex protecting the request queue. */
434	RTSEMMUTEX AsyncIORequestMutex;
435	/** The event semaphore the thread is waiting on during suspended I/O. */
436	RTSEMEVENT SuspendIOSem;
437	#if 0 /HC_ARCH_BITS == 32/
438	uint32_t Alignment0;
439	#endif
440
441	/** Timestamp we started the reset. */
442	uint64_t u64ResetTime;
443
444	/* Statistics */
445	STAMCOUNTER StatAsyncOps;
446	uint64_t StatAsyncMinWait;
447	uint64_t StatAsyncMaxWait;
448	STAMCOUNTER StatAsyncTimeUS;
449	STAMPROFILEADV StatAsyncTime;
450	STAMPROFILE StatLockWait;
451	} ATACONTROLLER, *PATACONTROLLER;
452	AssertCompileMemberAlignment(ATACONTROLLER, lock, 8);
453	AssertCompileMemberAlignment(ATACONTROLLER, aIfs, 8);
454	AssertCompileMemberAlignment(ATACONTROLLER, u64ResetTime, 8);
455	AssertCompileMemberAlignment(ATACONTROLLER, StatAsyncOps, 8);
456
457	typedef enum CHIPSET
458	{
459	/** PIIX3 chipset, must be 0 for saved state compatibility */
460	CHIPSET_PIIX3 = 0,
461	/** PIIX4 chipset, must be 1 for saved state compatibility */
462	CHIPSET_PIIX4 = 1,
463	/** ICH6 chipset */
464	CHIPSET_ICH6 = 2
465	} CHIPSET;
466
467	/**
468	* The state of the ATA PCI device.
469	*
470	* @extends PCIDEVICE
471	* @implements PDMILEDPORTS
472	*/
473	typedef struct PCIATAState
474	{
475	PCIDEVICE dev;
476	/** The controllers. */
477	ATACONTROLLER aCts[2];
478	/** Pointer to device instance. */
479	PPDMDEVINSR3 pDevIns;
480	/** Status LUN: Base interface. */
481	PDMIBASE IBase;
482	/** Status LUN: Leds interface. */
483	PDMILEDPORTS ILeds;
484	/** Status LUN: Partner of ILeds. */
485	R3PTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
486	/** Status LUN: Media Notify. */
487	R3PTRTYPE(PPDMIMEDIANOTIFY) pMediaNotify;
488	/** Flag whether GC is enabled. */
489	bool fGCEnabled;
490	/** Flag whether R0 is enabled. */
491	bool fR0Enabled;
492	/** Flag indicating chipset being emulated. */
493	uint8_t u8Type;
494	bool Alignment0[HC_ARCH_BITS == 64 ? 5 : 1 ]; /*< Align the struct size. /
495	} PCIATAState;
496
497	#define PDMIBASE_2_PCIATASTATE(pInterface) ( (PCIATAState *)((uintptr_t)(pInterface) - RT_OFFSETOF(PCIATAState, IBase)) )
498	#define PDMILEDPORTS_2_PCIATASTATE(pInterface) ( (PCIATAState *)((uintptr_t)(pInterface) - RT_OFFSETOF(PCIATAState, ILeds)) )
499	#define PDMIBLOCKPORT_2_ATASTATE(pInterface) ( (ATADevState *)((uintptr_t)(pInterface) - RT_OFFSETOF(ATADevState, IPort)) )
500	#define PDMIMOUNT_2_ATASTATE(pInterface) ( (ATADevState *)((uintptr_t)(pInterface) - RT_OFFSETOF(ATADevState, IMount)) )
501	#define PDMIMOUNTNOTIFY_2_ATASTATE(pInterface) ( (ATADevState *)((uintptr_t)(pInterface) - RT_OFFSETOF(ATADevState, IMountNotify)) )
502	#define PCIDEV_2_PCIATASTATE(pPciDev) ( (PCIATAState *)(pPciDev) )
503
504	#define ATACONTROLLER_IDX(pController) ( (pController) - PDMINS_2_DATA(CONTROLLER_2_DEVINS(pController), PCIATAState *)->aCts )
505
506	#define ATADEVSTATE_2_CONTROLLER(pIf) ( (pIf)->CTX_SUFF(pController) )
507	#define ATADEVSTATE_2_DEVINS(pIf) ( (pIf)->CTX_SUFF(pDevIns) )
508	#define CONTROLLER_2_DEVINS(pController) ( (pController)->CTX_SUFF(pDevIns) )
509	#define PDMIBASE_2_ATASTATE(pInterface) ( (ATADevState *)((uintptr_t)(pInterface) - RT_OFFSETOF(ATADevState, IBase)) )
510	#define PDMIBLOCKPORT_2_ATASTATE(pInterface) ( (ATADevState *)((uintptr_t)(pInterface) - RT_OFFSETOF(ATADevState, IPort)) )
511
512	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
513	/*******************************************************************************
514	* Internal Functions *
515	******************************************************************************/
516	RT_C_DECLS_BEGIN
517	PDMBOTHCBDECL(int) ataIOPortWrite1(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t u32, unsigned cb);
518	PDMBOTHCBDECL(int) ataIOPortRead1(PPDMDEVINS pDevIns, void pvUser, RTIOPORT Port, uint32_t u32, unsigned cb);
519	PDMBOTHCBDECL(int) ataIOPortWriteStr1(PPDMDEVINS pDevIns, void pvUser, RTIOPORT Port, RTGCPTR pGCPtrSrc, PRTGCUINTREG pcTransfer, unsigned cb);
520	PDMBOTHCBDECL(int) ataIOPortReadStr1(PPDMDEVINS pDevIns, void pvUser, RTIOPORT Port, RTGCPTR pGCPtrDst, PRTGCUINTREG pcTransfer, unsigned cb);
521	PDMBOTHCBDECL(int) ataIOPortWrite2(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t u32, unsigned cb);
522	PDMBOTHCBDECL(int) ataIOPortRead2(PPDMDEVINS pDevIns, void pvUser, RTIOPORT Port, uint32_t u32, unsigned cb);
523	PDMBOTHCBDECL(int) ataBMDMAIOPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t u32, unsigned cb);
524	PDMBOTHCBDECL(int) ataBMDMAIOPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT Port, uint32_t pu32, unsigned cb);
525	RT_C_DECLS_END
526
527
528
529	DECLINLINE(void) ataSetStatusValue(ATADevState *s, uint8_t stat)
530	{
531	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
532
533	/* Freeze status register contents while processing RESET. */
534	if (!pCtl->fReset)
535	{
536	s->uATARegStatus = stat;
537	Log2(("%s: LUN#%d status %#04x\n", __FUNCTION__, s->iLUN, s->uATARegStatus));
538	}
539	}
540
541
542	DECLINLINE(void) ataSetStatus(ATADevState *s, uint8_t stat)
543	{
544	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
545
546	/* Freeze status register contents while processing RESET. */
547	if (!pCtl->fReset)
548	{
549	s->uATARegStatus \|= stat;
550	Log2(("%s: LUN#%d status %#04x\n", __FUNCTION__, s->iLUN, s->uATARegStatus));
551	}
552	}
553
554
555	DECLINLINE(void) ataUnsetStatus(ATADevState *s, uint8_t stat)
556	{
557	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
558
559	/* Freeze status register contents while processing RESET. */
560	if (!pCtl->fReset)
561	{
562	s->uATARegStatus &= ~stat;
563	Log2(("%s: LUN#%d status %#04x\n", __FUNCTION__, s->iLUN, s->uATARegStatus));
564	}
565	}
566
567	#ifdef IN_RING3
568
569	typedef void (PBeginTransferFunc)(ATADevState );
570	typedef bool (PSourceSinkFunc)(ATADevState );
571
572	static void ataReadWriteSectorsBT(ATADevState *);
573	static void ataPacketBT(ATADevState *);
574	static void atapiCmdBT(ATADevState *);
575	static void atapiPassthroughCmdBT(ATADevState *);
576
577	static bool ataIdentifySS(ATADevState *);
578	static bool ataFlushSS(ATADevState *);
579	static bool ataReadSectorsSS(ATADevState *);
580	static bool ataWriteSectorsSS(ATADevState *);
581	static bool ataExecuteDeviceDiagnosticSS(ATADevState *);
582	static bool ataTrimSS(ATADevState *);
583	static bool ataPacketSS(ATADevState *);
584	static bool atapiGetConfigurationSS(ATADevState *);
585	static bool atapiGetEventStatusNotificationSS(ATADevState *);
586	static bool atapiIdentifySS(ATADevState *);
587	static bool atapiInquirySS(ATADevState *);
588	static bool atapiMechanismStatusSS(ATADevState *);
589	static bool atapiModeSenseErrorRecoverySS(ATADevState *);
590	static bool atapiModeSenseCDStatusSS(ATADevState *);
591	static bool atapiReadSS(ATADevState *);
592	static bool atapiReadCapacitySS(ATADevState *);
593	static bool atapiReadDiscInformationSS(ATADevState *);
594	static bool atapiReadTOCNormalSS(ATADevState *);
595	static bool atapiReadTOCMultiSS(ATADevState *);
596	static bool atapiReadTOCRawSS(ATADevState *);
597	static bool atapiReadTrackInformationSS(ATADevState *);
598	static bool atapiRequestSenseSS(ATADevState *);
599	static bool atapiPassthroughSS(ATADevState *);
600	static bool atapiReadDVDStructureSS(ATADevState *);
601
602	/**
603	* Begin of transfer function indexes for g_apfnBeginTransFuncs.
604	*/
605	typedef enum ATAFNBT
606	{
607	ATAFN_BT_NULL = 0,
608	ATAFN_BT_READ_WRITE_SECTORS,
609	ATAFN_BT_PACKET,
610	ATAFN_BT_ATAPI_CMD,
611	ATAFN_BT_ATAPI_PASSTHROUGH_CMD,
612	ATAFN_BT_MAX
613	} ATAFNBT;
614
615	/**
616	* Array of end transfer functions, the index is ATAFNET.
617	* Make sure ATAFNET and this array match!
618	*/
619	static const PBeginTransferFunc g_apfnBeginTransFuncs[ATAFN_BT_MAX] =
620	{
621	NULL,
622	ataReadWriteSectorsBT,
623	ataPacketBT,
624	atapiCmdBT,
625	atapiPassthroughCmdBT,
626	};
627
628	/**
629	* Source/sink function indexes for g_apfnSourceSinkFuncs.
630	*/
631	typedef enum ATAFNSS
632	{
633	ATAFN_SS_NULL = 0,
634	ATAFN_SS_IDENTIFY,
635	ATAFN_SS_FLUSH,
636	ATAFN_SS_READ_SECTORS,
637	ATAFN_SS_WRITE_SECTORS,
638	ATAFN_SS_EXECUTE_DEVICE_DIAGNOSTIC,
639	ATAFN_SS_TRIM,
640	ATAFN_SS_PACKET,
641	ATAFN_SS_ATAPI_GET_CONFIGURATION,
642	ATAFN_SS_ATAPI_GET_EVENT_STATUS_NOTIFICATION,
643	ATAFN_SS_ATAPI_IDENTIFY,
644	ATAFN_SS_ATAPI_INQUIRY,
645	ATAFN_SS_ATAPI_MECHANISM_STATUS,
646	ATAFN_SS_ATAPI_MODE_SENSE_ERROR_RECOVERY,
647	ATAFN_SS_ATAPI_MODE_SENSE_CD_STATUS,
648	ATAFN_SS_ATAPI_READ,
649	ATAFN_SS_ATAPI_READ_CAPACITY,
650	ATAFN_SS_ATAPI_READ_DISC_INFORMATION,
651	ATAFN_SS_ATAPI_READ_TOC_NORMAL,
652	ATAFN_SS_ATAPI_READ_TOC_MULTI,
653	ATAFN_SS_ATAPI_READ_TOC_RAW,
654	ATAFN_SS_ATAPI_READ_TRACK_INFORMATION,
655	ATAFN_SS_ATAPI_REQUEST_SENSE,
656	ATAFN_SS_ATAPI_PASSTHROUGH,
657	ATAFN_SS_ATAPI_READ_DVD_STRUCTURE,
658	ATAFN_SS_MAX
659	} ATAFNSS;
660
661	/**
662	* Array of source/sink functions, the index is ATAFNSS.
663	* Make sure ATAFNSS and this array match!
664	*/
665	static const PSourceSinkFunc g_apfnSourceSinkFuncs[ATAFN_SS_MAX] =
666	{
667	NULL,
668	ataIdentifySS,
669	ataFlushSS,
670	ataReadSectorsSS,
671	ataWriteSectorsSS,
672	ataExecuteDeviceDiagnosticSS,
673	ataTrimSS,
674	ataPacketSS,
675	atapiGetConfigurationSS,
676	atapiGetEventStatusNotificationSS,
677	atapiIdentifySS,
678	atapiInquirySS,
679	atapiMechanismStatusSS,
680	atapiModeSenseErrorRecoverySS,
681	atapiModeSenseCDStatusSS,
682	atapiReadSS,
683	atapiReadCapacitySS,
684	atapiReadDiscInformationSS,
685	atapiReadTOCNormalSS,
686	atapiReadTOCMultiSS,
687	atapiReadTOCRawSS,
688	atapiReadTrackInformationSS,
689	atapiRequestSenseSS,
690	atapiPassthroughSS,
691	atapiReadDVDStructureSS
692	};
693
694
695	static const ATARequest g_ataDMARequest = { ATA_AIO_DMA, { { 0, 0, 0, 0, 0 } } };
696	static const ATARequest g_ataPIORequest = { ATA_AIO_PIO, { { 0, 0, 0, 0, 0 } } };
697	static const ATARequest g_ataResetARequest = { ATA_AIO_RESET_ASSERTED, { { 0, 0, 0, 0, 0 } } };
698	static const ATARequest g_ataResetCRequest = { ATA_AIO_RESET_CLEARED, { { 0, 0, 0, 0, 0 } } };
699
700	static void ataAsyncIOClearRequests(PATACONTROLLER pCtl)
701	{
702	int rc;
703
704	rc = RTSemMutexRequest(pCtl->AsyncIORequestMutex, RT_INDEFINITE_WAIT);
705	AssertRC(rc);
706	pCtl->AsyncIOReqHead = 0;
707	pCtl->AsyncIOReqTail = 0;
708	rc = RTSemMutexRelease(pCtl->AsyncIORequestMutex);
709	AssertRC(rc);
710	}
711
712
713	static void ataAsyncIOPutRequest(PATACONTROLLER pCtl, const ATARequest *pReq)
714	{
715	int rc;
716
717	rc = RTSemMutexRequest(pCtl->AsyncIORequestMutex, RT_INDEFINITE_WAIT);
718	AssertRC(rc);
719	Assert((pCtl->AsyncIOReqHead + 1) % RT_ELEMENTS(pCtl->aAsyncIORequests) != pCtl->AsyncIOReqTail);
720	memcpy(&pCtl->aAsyncIORequests[pCtl->AsyncIOReqHead], pReq, sizeof(*pReq));
721	pCtl->AsyncIOReqHead++;
722	pCtl->AsyncIOReqHead %= RT_ELEMENTS(pCtl->aAsyncIORequests);
723	rc = RTSemMutexRelease(pCtl->AsyncIORequestMutex);
724	AssertRC(rc);
725	rc = PDMR3CritSectScheduleExitEvent(&pCtl->lock, pCtl->AsyncIOSem);
726	if (RT_FAILURE(rc))
727	{
728	rc = RTSemEventSignal(pCtl->AsyncIOSem);
729	AssertRC(rc);
730	}
731	}
732
733
734	static const ATARequest *ataAsyncIOGetCurrentRequest(PATACONTROLLER pCtl)
735	{
736	int rc;
737	const ATARequest *pReq;
738
739	rc = RTSemMutexRequest(pCtl->AsyncIORequestMutex, RT_INDEFINITE_WAIT);
740	AssertRC(rc);
741	if (pCtl->AsyncIOReqHead != pCtl->AsyncIOReqTail)
742	pReq = &pCtl->aAsyncIORequests[pCtl->AsyncIOReqTail];
743	else
744	pReq = NULL;
745	rc = RTSemMutexRelease(pCtl->AsyncIORequestMutex);
746	AssertRC(rc);
747	return pReq;
748	}
749
750
751	/**
752	* Remove the request with the given type, as it's finished. The request
753	* is not removed blindly, as this could mean a RESET request that is not
754	* yet processed (but has cleared the request queue) is lost.
755	*
756	* @param pCtl Controller for which to remove the request.
757	* @param ReqType Type of the request to remove.
758	*/
759	static void ataAsyncIORemoveCurrentRequest(PATACONTROLLER pCtl, ATAAIO ReqType)
760	{
761	int rc;
762
763	rc = RTSemMutexRequest(pCtl->AsyncIORequestMutex, RT_INDEFINITE_WAIT);
764	AssertRC(rc);
765	if (pCtl->AsyncIOReqHead != pCtl->AsyncIOReqTail && pCtl->aAsyncIORequests[pCtl->AsyncIOReqTail].ReqType == ReqType)
766	{
767	pCtl->AsyncIOReqTail++;
768	pCtl->AsyncIOReqTail %= RT_ELEMENTS(pCtl->aAsyncIORequests);
769	}
770	rc = RTSemMutexRelease(pCtl->AsyncIORequestMutex);
771	AssertRC(rc);
772	}
773
774
775	/**
776	* Dump the request queue for a particular controller. First dump the queue
777	* contents, then the already processed entries, as long as they haven't been
778	* overwritten.
779	*
780	* @param pCtl Controller for which to dump the queue.
781	*/
782	static void ataAsyncIODumpRequests(PATACONTROLLER pCtl)
783	{
784	int rc;
785	uint8_t curr;
786
787	rc = RTSemMutexRequest(pCtl->AsyncIORequestMutex, RT_INDEFINITE_WAIT);
788	AssertRC(rc);
789	LogRel(("PIIX3 ATA: Ctl#%d: request queue dump (topmost is current):\n", ATACONTROLLER_IDX(pCtl)));
790	curr = pCtl->AsyncIOReqTail;
791	do
792	{
793	if (curr == pCtl->AsyncIOReqHead)
794	LogRel(("PIIX3 ATA: Ctl#%d: processed requests (topmost is oldest):\n", ATACONTROLLER_IDX(pCtl)));
795	switch (pCtl->aAsyncIORequests[curr].ReqType)
796	{
797	case ATA_AIO_NEW:
798	LogRel(("new transfer request, iIf=%d iBeginTransfer=%d iSourceSink=%d cbTotalTransfer=%d uTxDir=%d\n", pCtl->aAsyncIORequests[curr].u.t.iIf, pCtl->aAsyncIORequests[curr].u.t.iBeginTransfer, pCtl->aAsyncIORequests[curr].u.t.iSourceSink, pCtl->aAsyncIORequests[curr].u.t.cbTotalTransfer, pCtl->aAsyncIORequests[curr].u.t.uTxDir));
799	break;
800	case ATA_AIO_DMA:
801	LogRel(("dma transfer continuation\n"));
802	break;
803	case ATA_AIO_PIO:
804	LogRel(("pio transfer continuation\n"));
805	break;
806	case ATA_AIO_RESET_ASSERTED:
807	LogRel(("reset asserted request\n"));
808	break;
809	case ATA_AIO_RESET_CLEARED:
810	LogRel(("reset cleared request\n"));
811	break;
812	case ATA_AIO_ABORT:
813	LogRel(("abort request, iIf=%d fResetDrive=%d\n", pCtl->aAsyncIORequests[curr].u.a.iIf, pCtl->aAsyncIORequests[curr].u.a.fResetDrive));
814	break;
815	default:
816	LogRel(("unknown request %d\n", pCtl->aAsyncIORequests[curr].ReqType));
817	}
818	curr = (curr + 1) % RT_ELEMENTS(pCtl->aAsyncIORequests);
819	} while (curr != pCtl->AsyncIOReqTail);
820	rc = RTSemMutexRelease(pCtl->AsyncIORequestMutex);
821	AssertRC(rc);
822	}
823
824
825	/**
826	* Checks whether the request queue for a particular controller is empty
827	* or whether a particular controller is idle.
828	*
829	* @param pCtl Controller for which to check the queue.
830	* @param fStrict If set then the controller is checked to be idle.
831	*/
832	static bool ataAsyncIOIsIdle(PATACONTROLLER pCtl, bool fStrict)
833	{
834	int rc;
835	bool fIdle;
836
837	rc = RTSemMutexRequest(pCtl->AsyncIORequestMutex, RT_INDEFINITE_WAIT);
838	AssertRC(rc);
839	fIdle = pCtl->fRedoIdle;
840	if (!fIdle)
841	fIdle = (pCtl->AsyncIOReqHead == pCtl->AsyncIOReqTail);
842	if (fStrict)
843	fIdle &= (pCtl->uAsyncIOState == ATA_AIO_NEW);
844	rc = RTSemMutexRelease(pCtl->AsyncIORequestMutex);
845	AssertRC(rc);
846	return fIdle;
847	}
848
849
850	/**
851	* Send a transfer request to the async I/O thread.
852	*
853	* @param s Pointer to the ATA device state data.
854	* @param cbTotalTransfer Data transfer size.
855	* @param uTxDir Data transfer direction.
856	* @param iBeginTransfer Index of BeginTransfer callback.
857	* @param iSourceSink Index of SourceSink callback.
858	* @param fChainedTransfer Whether this is a transfer that is part of the previous command/transfer.
859	*/
860	static void ataStartTransfer(ATADevState *s, uint32_t cbTotalTransfer, uint8_t uTxDir, ATAFNBT iBeginTransfer, ATAFNSS iSourceSink, bool fChainedTransfer)
861	{
862	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
863	ATARequest Req;
864
865	Assert(PDMCritSectIsOwner(&pCtl->lock));
866
867	/* Do not issue new requests while the RESET line is asserted. */
868	if (pCtl->fReset)
869	{
870	Log2(("%s: Ctl#%d: suppressed new request as RESET is active\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
871	return;
872	}
873
874	/* If the controller is already doing something else right now, ignore
875	* the command that is being submitted. Some broken guests issue commands
876	* twice (e.g. the Linux kernel that comes with Acronis True Image 8). */
877	if (!fChainedTransfer && !ataAsyncIOIsIdle(pCtl, true /fStrict/))
878	{
879	Log(("%s: Ctl#%d: ignored command %#04x, controller state %d\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl), s->uATARegCommand, pCtl->uAsyncIOState));
880	LogRel(("PIIX3 IDE: guest issued command %#04x while controller busy\n", s->uATARegCommand));
881	return;
882	}
883
884	Req.ReqType = ATA_AIO_NEW;
885	if (fChainedTransfer)
886	Req.u.t.iIf = pCtl->iAIOIf;
887	else
888	Req.u.t.iIf = pCtl->iSelectedIf;
889	Req.u.t.cbTotalTransfer = cbTotalTransfer;
890	Req.u.t.uTxDir = uTxDir;
891	Req.u.t.iBeginTransfer = iBeginTransfer;
892	Req.u.t.iSourceSink = iSourceSink;
893	ataSetStatusValue(s, ATA_STAT_BUSY);
894	pCtl->fChainedTransfer = fChainedTransfer;
895
896	/*
897	* Kick the worker thread into action.
898	*/
899	Log2(("%s: Ctl#%d: message to async I/O thread, new request\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
900	ataAsyncIOPutRequest(pCtl, &Req);
901	}
902
903
904	/**
905	* Send an abort command request to the async I/O thread.
906	*
907	* @param s Pointer to the ATA device state data.
908	* @param fResetDrive Whether to reset the drive or just abort a command.
909	*/
910	static void ataAbortCurrentCommand(ATADevState *s, bool fResetDrive)
911	{
912	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
913	ATARequest Req;
914
915	Assert(PDMCritSectIsOwner(&pCtl->lock));
916
917	/* Do not issue new requests while the RESET line is asserted. */
918	if (pCtl->fReset)
919	{
920	Log2(("%s: Ctl#%d: suppressed aborting command as RESET is active\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
921	return;
922	}
923
924	Req.ReqType = ATA_AIO_ABORT;
925	Req.u.a.iIf = pCtl->iSelectedIf;
926	Req.u.a.fResetDrive = fResetDrive;
927	ataSetStatus(s, ATA_STAT_BUSY);
928	Log2(("%s: Ctl#%d: message to async I/O thread, abort command on LUN#%d\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl), s->iLUN));
929	ataAsyncIOPutRequest(pCtl, &Req);
930	}
931
932
933	static void ataSetIRQ(ATADevState *s)
934	{
935	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
936	PPDMDEVINS pDevIns = ATADEVSTATE_2_DEVINS(s);
937
938	if (!(s->uATARegDevCtl & ATA_DEVCTL_DISABLE_IRQ))
939	{
940	Log2(("%s: LUN#%d asserting IRQ\n", __FUNCTION__, s->iLUN));
941	/* The BMDMA unit unconditionally sets BM_STATUS_INT if the interrupt
942	* line is asserted. It monitors the line for a rising edge. */
943	if (!s->fIrqPending)
944	pCtl->BmDma.u8Status \|= BM_STATUS_INT;
945	/* Only actually set the IRQ line if updating the currently selected drive. */
946	if (s == &pCtl->aIfs[pCtl->iSelectedIf])
947	{
948	/** @todo experiment with adaptive IRQ delivery: for reads it is
949	* better to wait for IRQ delivery, as it reduces latency. */
950	if (pCtl->irq == 16)
951	PDMDevHlpPCISetIrq(pDevIns, 0, 1);
952	else
953	PDMDevHlpISASetIrq(pDevIns, pCtl->irq, 1);
954	}
955	}
956	s->fIrqPending = true;
957	}
958
959	#endif /* IN_RING3 */
960
961	static void ataUnsetIRQ(ATADevState *s)
962	{
963	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
964	PPDMDEVINS pDevIns = ATADEVSTATE_2_DEVINS(s);
965
966	if (!(s->uATARegDevCtl & ATA_DEVCTL_DISABLE_IRQ))
967	{
968	Log2(("%s: LUN#%d deasserting IRQ\n", __FUNCTION__, s->iLUN));
969	/* Only actually unset the IRQ line if updating the currently selected drive. */
970	if (s == &pCtl->aIfs[pCtl->iSelectedIf])
971	{
972	if (pCtl->irq == 16)
973	PDMDevHlpPCISetIrq(pDevIns, 0, 0);
974	else
975	PDMDevHlpISASetIrq(pDevIns, pCtl->irq, 0);
976	}
977	}
978	s->fIrqPending = false;
979	}
980
981	#ifdef IN_RING3
982
983	static void ataPIOTransferStart(ATADevState *s, uint32_t start, uint32_t size)
984	{
985	Log2(("%s: LUN#%d start %d size %d\n", __FUNCTION__, s->iLUN, start, size));
986	s->iIOBufferPIODataStart = start;
987	s->iIOBufferPIODataEnd = start + size;
988	ataSetStatus(s, ATA_STAT_DRQ \| ATA_STAT_SEEK);
989	}
990
991
992	static void ataPIOTransferStop(ATADevState *s)
993	{
994	Log2(("%s: LUN#%d\n", __FUNCTION__, s->iLUN));
995	if (s->fATAPITransfer)
996	{
997	s->uATARegNSector = (s->uATARegNSector & ~7) \| ATAPI_INT_REASON_IO \| ATAPI_INT_REASON_CD;
998	Log2(("%s: interrupt reason %#04x\n", __FUNCTION__, s->uATARegNSector));
999	ataSetIRQ(s);
1000	s->fATAPITransfer = false;
1001	}
1002	s->cbTotalTransfer = 0;
1003	s->cbElementaryTransfer = 0;
1004	s->iIOBufferPIODataStart = 0;
1005	s->iIOBufferPIODataEnd = 0;
1006	s->iBeginTransfer = ATAFN_BT_NULL;
1007	s->iSourceSink = ATAFN_SS_NULL;
1008	}
1009
1010
1011	static void ataPIOTransferLimitATAPI(ATADevState *s)
1012	{
1013	uint32_t cbLimit, cbTransfer;
1014
1015	cbLimit = s->cbPIOTransferLimit;
1016	/* Use maximum transfer size if the guest requested 0. Avoids a hang. */
1017	if (cbLimit == 0)
1018	cbLimit = 0xfffe;
1019	Log2(("%s: byte count limit=%d\n", __FUNCTION__, cbLimit));
1020	if (cbLimit == 0xffff)
1021	cbLimit--;
1022	cbTransfer = RT_MIN(s->cbTotalTransfer, s->iIOBufferEnd - s->iIOBufferCur);
1023	if (cbTransfer > cbLimit)
1024	{
1025	/* Byte count limit for clipping must be even in this case */
1026	if (cbLimit & 1)
1027	cbLimit--;
1028	cbTransfer = cbLimit;
1029	}
1030	s->uATARegLCyl = cbTransfer;
1031	s->uATARegHCyl = cbTransfer >> 8;
1032	s->cbElementaryTransfer = cbTransfer;
1033	}
1034
1035
1036	static uint32_t ataGetNSectors(ATADevState *s)
1037	{
1038	/* 0 means either 256 (LBA28) or 65536 (LBA48) sectors. */
1039	if (s->fLBA48)
1040	{
1041	if (!s->uATARegNSector && !s->uATARegNSectorHOB)
1042	return 65536;
1043	else
1044	return s->uATARegNSectorHOB << 8 \| s->uATARegNSector;
1045	}
1046	else
1047	{
1048	if (!s->uATARegNSector)
1049	return 256;
1050	else
1051	return s->uATARegNSector;
1052	}
1053	}
1054
1055
1056	static void ataPadString(uint8_t pbDst, const char pbSrc, uint32_t cbSize)
1057	{
1058	for (uint32_t i = 0; i < cbSize; i++)
1059	{
1060	if (*pbSrc)
1061	pbDst[i ^ 1] = *pbSrc++;
1062	else
1063	pbDst[i ^ 1] = ' ';
1064	}
1065	}
1066
1067
1068	static void ataSCSIPadStr(uint8_t pbDst, const char pbSrc, uint32_t cbSize)
1069	{
1070	for (uint32_t i = 0; i < cbSize; i++)
1071	{
1072	if (*pbSrc)
1073	pbDst[i] = *pbSrc++;
1074	else
1075	pbDst[i] = ' ';
1076	}
1077	}
1078
1079
1080	DECLINLINE(void) ataH2BE_U16(uint8_t *pbBuf, uint16_t val)
1081	{
1082	pbBuf[0] = val >> 8;
1083	pbBuf[1] = val;
1084	}
1085
1086
1087	DECLINLINE(void) ataH2BE_U24(uint8_t *pbBuf, uint32_t val)
1088	{
1089	pbBuf[0] = val >> 16;
1090	pbBuf[1] = val >> 8;
1091	pbBuf[2] = val;
1092	}
1093
1094
1095	DECLINLINE(void) ataH2BE_U32(uint8_t *pbBuf, uint32_t val)
1096	{
1097	pbBuf[0] = val >> 24;
1098	pbBuf[1] = val >> 16;
1099	pbBuf[2] = val >> 8;
1100	pbBuf[3] = val;
1101	}
1102
1103
1104	DECLINLINE(uint16_t) ataBE2H_U16(const uint8_t *pbBuf)
1105	{
1106	return (pbBuf[0] << 8) \| pbBuf[1];
1107	}
1108
1109
1110	DECLINLINE(uint32_t) ataBE2H_U24(const uint8_t *pbBuf)
1111	{
1112	return (pbBuf[0] << 16) \| (pbBuf[1] << 8) \| pbBuf[2];
1113	}
1114
1115
1116	DECLINLINE(uint32_t) ataBE2H_U32(const uint8_t *pbBuf)
1117	{
1118	return (pbBuf[0] << 24) \| (pbBuf[1] << 16) \| (pbBuf[2] << 8) \| pbBuf[3];
1119	}
1120
1121
1122	DECLINLINE(void) ataLBA2MSF(uint8_t *pbBuf, uint32_t iATAPILBA)
1123	{
1124	iATAPILBA += 150;
1125	pbBuf[0] = (iATAPILBA / 75) / 60;
1126	pbBuf[1] = (iATAPILBA / 75) % 60;
1127	pbBuf[2] = iATAPILBA % 75;
1128	}
1129
1130
1131	DECLINLINE(uint32_t) ataMSF2LBA(const uint8_t *pbBuf)
1132	{
1133	return (pbBuf[0] * 60 + pbBuf[1]) * 75 + pbBuf[2];
1134	}
1135
1136	/**
1137	* Compares two MSF values.
1138	*
1139	* @returns 1 if the first value is greater than the second value.
1140	* 0 if both are equal
1141	* -1 if the first value is smaller than the second value.
1142	*/
1143	DECLINLINE(int) atapiCmpMSF(const uint8_t pbMSF1, const uint8_t pbMSF2)
1144	{
1145	int iRes = 0;
1146
1147	for (unsigned i = 0; i < 3; i++)
1148	{
1149	if (pbMSF1[i] < pbMSF2[i])
1150	{
1151	iRes = -1;
1152	break;
1153	}
1154	else if (pbMSF1[i] > pbMSF2[i])
1155	{
1156	iRes = 1;
1157	break;
1158	}
1159	}
1160
1161	return iRes;
1162	}
1163
1164	static void ataCmdOK(ATADevState *s, uint8_t status)
1165	{
1166	s->uATARegError = 0; /* Not needed by ATA spec, but cannot hurt. */
1167	ataSetStatusValue(s, ATA_STAT_READY \| status);
1168	}
1169
1170
1171	static void ataCmdError(ATADevState *s, uint8_t uErrorCode)
1172	{
1173	Log(("%s: code=%#x\n", __FUNCTION__, uErrorCode));
1174	Assert(uErrorCode);
1175	s->uATARegError = uErrorCode;
1176	ataSetStatusValue(s, ATA_STAT_READY \| ATA_STAT_ERR);
1177	s->cbTotalTransfer = 0;
1178	s->cbElementaryTransfer = 0;
1179	s->iIOBufferCur = 0;
1180	s->iIOBufferEnd = 0;
1181	s->uTxDir = PDMBLOCKTXDIR_NONE;
1182	s->iBeginTransfer = ATAFN_BT_NULL;
1183	s->iSourceSink = ATAFN_SS_NULL;
1184	}
1185
1186	static uint32_t ataChecksum(void* ptr, size_t count)
1187	{
1188	uint8_t u8Sum = 0xa5, p = (uint8_t)ptr;
1189	size_t i;
1190
1191	for (i = 0; i < count; i++)
1192	{
1193	u8Sum += *p++;
1194	}
1195
1196	return (uint8_t)-(int32_t)u8Sum;
1197	}
1198
1199	static bool ataIdentifySS(ATADevState *s)
1200	{
1201	uint16_t *p;
1202
1203	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
1204	Assert(s->cbElementaryTransfer == 512);
1205
1206	p = (uint16_t *)s->CTX_SUFF(pbIOBuffer);
1207	memset(p, 0, 512);
1208	p[0] = RT_H2LE_U16(0x0040);
1209	p[1] = RT_H2LE_U16(RT_MIN(s->PCHSGeometry.cCylinders, 16383));
1210	p[3] = RT_H2LE_U16(s->PCHSGeometry.cHeads);
1211	/* Block size; obsolete, but required for the BIOS. */
1212	p[5] = RT_H2LE_U16(512);
1213	p[6] = RT_H2LE_U16(s->PCHSGeometry.cSectors);
1214	ataPadString((uint8_t )(p + 10), s->szSerialNumber, ATA_SERIAL_NUMBER_LENGTH); / serial number */
1215	p[20] = RT_H2LE_U16(3); /* XXX: retired, cache type */
1216	p[21] = RT_H2LE_U16(512); /* XXX: retired, cache size in sectors */
1217	p[22] = RT_H2LE_U16(0); /* ECC bytes per sector */
1218	ataPadString((uint8_t )(p + 23), s->szFirmwareRevision, ATA_FIRMWARE_REVISION_LENGTH); / firmware version */
1219	ataPadString((uint8_t )(p + 27), s->szModelNumber, ATA_MODEL_NUMBER_LENGTH); / model */
1220	#if ATA_MAX_MULT_SECTORS > 1
1221	p[47] = RT_H2LE_U16(0x8000 \| ATA_MAX_MULT_SECTORS);
1222	#endif
1223	p[48] = RT_H2LE_U16(1); /* dword I/O, used by the BIOS */
1224	p[49] = RT_H2LE_U16(1 << 11 \| 1 << 9 \| 1 << 8); /* DMA and LBA supported */
1225	p[50] = RT_H2LE_U16(1 << 14); /* No drive specific standby timer minimum */
1226	p[51] = RT_H2LE_U16(240); /* PIO transfer cycle */
1227	p[52] = RT_H2LE_U16(240); /* DMA transfer cycle */
1228	p[53] = RT_H2LE_U16(1 \| 1 << 1 \| 1 << 2); /* words 54-58,64-70,88 valid */
1229	p[54] = RT_H2LE_U16(RT_MIN(s->PCHSGeometry.cCylinders, 16383));
1230	p[55] = RT_H2LE_U16(s->PCHSGeometry.cHeads);
1231	p[56] = RT_H2LE_U16(s->PCHSGeometry.cSectors);
1232	p[57] = RT_H2LE_U16( RT_MIN(s->PCHSGeometry.cCylinders, 16383)
1233	* s->PCHSGeometry.cHeads
1234	* s->PCHSGeometry.cSectors);
1235	p[58] = RT_H2LE_U16( RT_MIN(s->PCHSGeometry.cCylinders, 16383)
1236	* s->PCHSGeometry.cHeads
1237	* s->PCHSGeometry.cSectors >> 16);
1238	if (s->cMultSectors)
1239	p[59] = RT_H2LE_U16(0x100 \| s->cMultSectors);
1240	if (s->cTotalSectors <= (1 << 28) - 1)
1241	{
1242	p[60] = RT_H2LE_U16(s->cTotalSectors);
1243	p[61] = RT_H2LE_U16(s->cTotalSectors >> 16);
1244	}
1245	else
1246	{
1247	/* Report maximum number of sectors possible with LBA28 */
1248	p[60] = RT_H2LE_U16(((1 << 28) - 1) & 0xffff);
1249	p[61] = RT_H2LE_U16(((1 << 28) - 1) >> 16);
1250	}
1251	p[63] = RT_H2LE_U16(ATA_TRANSFER_ID(ATA_MODE_MDMA, ATA_MDMA_MODE_MAX, s->uATATransferMode)); /* MDMA modes supported / mode enabled */
1252	p[64] = RT_H2LE_U16(ATA_PIO_MODE_MAX > 2 ? (1 << (ATA_PIO_MODE_MAX - 2)) - 1 : 0); /* PIO modes beyond PIO2 supported */
1253	p[65] = RT_H2LE_U16(120); /* minimum DMA multiword tx cycle time */
1254	p[66] = RT_H2LE_U16(120); /* recommended DMA multiword tx cycle time */
1255	p[67] = RT_H2LE_U16(120); /* minimum PIO cycle time without flow control */
1256	p[68] = RT_H2LE_U16(120); /* minimum PIO cycle time with IORDY flow control */
1257	if (s->pDrvBlock->pfnDiscard)
1258	{
1259	p[80] = RT_H2LE_U16(0x1f0); /* support everything up to ATA/ATAPI-8 ACS */
1260	p[81] = RT_H2LE_U16(0x28); /* conforms to ATA/ATAPI-8 ACS */
1261	}
1262	else
1263	{
1264	p[80] = RT_H2LE_U16(0x7e); /* support everything up to ATA/ATAPI-6 */
1265	p[81] = RT_H2LE_U16(0x22); /* conforms to ATA/ATAPI-6 */
1266	}
1267	p[82] = RT_H2LE_U16(1 << 3 \| 1 << 5 \| 1 << 6); /* supports power management, write cache and look-ahead */
1268	if (s->cTotalSectors <= (1 << 28) - 1)
1269	p[83] = RT_H2LE_U16(1 << 14 \| 1 << 12); /* supports FLUSH CACHE */
1270	else
1271	p[83] = RT_H2LE_U16(1 << 14 \| 1 << 10 \| 1 << 12 \| 1 << 13); /* supports LBA48, FLUSH CACHE and FLUSH CACHE EXT */
1272	p[84] = RT_H2LE_U16(1 << 14);
1273	p[85] = RT_H2LE_U16(1 << 3 \| 1 << 5 \| 1 << 6); /* enabled power management, write cache and look-ahead */
1274	if (s->cTotalSectors <= (1 << 28) - 1)
1275	p[86] = RT_H2LE_U16(1 << 12); /* enabled FLUSH CACHE */
1276	else
1277	p[86] = RT_H2LE_U16(1 << 10 \| 1 << 12 \| 1 << 13); /* enabled LBA48, FLUSH CACHE and FLUSH CACHE EXT */
1278	p[87] = RT_H2LE_U16(1 << 14);
1279	p[88] = RT_H2LE_U16(ATA_TRANSFER_ID(ATA_MODE_UDMA, ATA_UDMA_MODE_MAX, s->uATATransferMode)); /* UDMA modes supported / mode enabled */
1280	p[93] = RT_H2LE_U16((1 \| 1 << 1) << ((s->iLUN & 1) == 0 ? 0 : 8) \| 1 << 13 \| 1 << 14);
1281	if (s->cTotalSectors > (1 << 28) - 1)
1282	{
1283	p[100] = RT_H2LE_U16(s->cTotalSectors);
1284	p[101] = RT_H2LE_U16(s->cTotalSectors >> 16);
1285	p[102] = RT_H2LE_U16(s->cTotalSectors >> 32);
1286	p[103] = RT_H2LE_U16(s->cTotalSectors >> 48);
1287	}
1288	if (s->pDrvBlock->pfnDiscard) /** @todo: Set bit 14 in word 69 too? (Deterministic read after TRIM). */
1289	p[169] = RT_H2LE_U16(1); /* DATA SET MANAGEMENT command supported. */
1290	if (s->fNonRotational)
1291	p[217] = RT_H2LE_U16(1); /* Non-rotational medium */
1292	uint32_t uCsum = ataChecksum(p, 510);
1293	p[255] = RT_H2LE_U16(0xa5 \| (uCsum << 8)); /* Integrity word */
1294	s->iSourceSink = ATAFN_SS_NULL;
1295	ataCmdOK(s, ATA_STAT_SEEK);
1296	return false;
1297	}
1298
1299
1300	static bool ataFlushSS(ATADevState *s)
1301	{
1302	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
1303	int rc;
1304
1305	Assert(s->uTxDir == PDMBLOCKTXDIR_NONE);
1306	Assert(!s->cbElementaryTransfer);
1307
1308	PDMCritSectLeave(&pCtl->lock);
1309
1310	STAM_PROFILE_START(&s->StatFlushes, f);
1311	rc = s->pDrvBlock->pfnFlush(s->pDrvBlock);
1312	AssertRC(rc);
1313	STAM_PROFILE_STOP(&s->StatFlushes, f);
1314
1315	STAM_PROFILE_START(&pCtl->StatLockWait, a);
1316	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
1317	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
1318	ataCmdOK(s, 0);
1319	return false;
1320	}
1321
1322	static bool atapiIdentifySS(ATADevState *s)
1323	{
1324	uint16_t *p;
1325
1326	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
1327	Assert(s->cbElementaryTransfer == 512);
1328
1329	p = (uint16_t *)s->CTX_SUFF(pbIOBuffer);
1330	memset(p, 0, 512);
1331	/* Removable CDROM, 50us response, 12 byte packets */
1332	p[0] = RT_H2LE_U16(2 << 14 \| 5 << 8 \| 1 << 7 \| 2 << 5 \| 0 << 0);
1333	ataPadString((uint8_t )(p + 10), s->szSerialNumber, ATA_SERIAL_NUMBER_LENGTH); / serial number */
1334	p[20] = RT_H2LE_U16(3); /* XXX: retired, cache type */
1335	p[21] = RT_H2LE_U16(512); /* XXX: retired, cache size in sectors */
1336	ataPadString((uint8_t )(p + 23), s->szFirmwareRevision, ATA_FIRMWARE_REVISION_LENGTH); / firmware version */
1337	ataPadString((uint8_t )(p + 27), s->szModelNumber, ATA_MODEL_NUMBER_LENGTH); / model */
1338	p[49] = RT_H2LE_U16(1 << 11 \| 1 << 9 \| 1 << 8); /* DMA and LBA supported */
1339	p[50] = RT_H2LE_U16(1 << 14); /* No drive specific standby timer minimum */
1340	p[51] = RT_H2LE_U16(240); /* PIO transfer cycle */
1341	p[52] = RT_H2LE_U16(240); /* DMA transfer cycle */
1342	p[53] = RT_H2LE_U16(1 << 1 \| 1 << 2); /* words 64-70,88 are valid */
1343	p[63] = RT_H2LE_U16(ATA_TRANSFER_ID(ATA_MODE_MDMA, ATA_MDMA_MODE_MAX, s->uATATransferMode)); /* MDMA modes supported / mode enabled */
1344	p[64] = RT_H2LE_U16(ATA_PIO_MODE_MAX > 2 ? (1 << (ATA_PIO_MODE_MAX - 2)) - 1 : 0); /* PIO modes beyond PIO2 supported */
1345	p[65] = RT_H2LE_U16(120); /* minimum DMA multiword tx cycle time */
1346	p[66] = RT_H2LE_U16(120); /* recommended DMA multiword tx cycle time */
1347	p[67] = RT_H2LE_U16(120); /* minimum PIO cycle time without flow control */
1348	p[68] = RT_H2LE_U16(120); /* minimum PIO cycle time with IORDY flow control */
1349	p[73] = RT_H2LE_U16(0x003e); /* ATAPI CDROM major */
1350	p[74] = RT_H2LE_U16(9); /* ATAPI CDROM minor */
1351	p[75] = RT_H2LE_U16(1); /* queue depth 1 */
1352	p[80] = RT_H2LE_U16(0x7e); /* support everything up to ATA/ATAPI-6 */
1353	p[81] = RT_H2LE_U16(0x22); /* conforms to ATA/ATAPI-6 */
1354	p[82] = RT_H2LE_U16(1 << 4 \| 1 << 9); /* supports packet command set and DEVICE RESET */
1355	p[83] = RT_H2LE_U16(1 << 14);
1356	p[84] = RT_H2LE_U16(1 << 14);
1357	p[85] = RT_H2LE_U16(1 << 4 \| 1 << 9); /* enabled packet command set and DEVICE RESET */
1358	p[86] = RT_H2LE_U16(0);
1359	p[87] = RT_H2LE_U16(1 << 14);
1360	p[88] = RT_H2LE_U16(ATA_TRANSFER_ID(ATA_MODE_UDMA, ATA_UDMA_MODE_MAX, s->uATATransferMode)); /* UDMA modes supported / mode enabled */
1361	p[93] = RT_H2LE_U16((1 \| 1 << 1) << ((s->iLUN & 1) == 0 ? 0 : 8) \| 1 << 13 \| 1 << 14);
1362	/* According to ATAPI-5 spec:
1363	*
1364	* The use of this word is optional.
1365	* If bits 7:0 of this word contain the signature A5h, bits 15:8
1366	* contain the data
1367	* structure checksum.
1368	* The data structure checksum is the twos complement of the sum of
1369	* all bytes in words 0 through 254 and the byte consisting of
1370	* bits 7:0 in word 255.
1371	* Each byte shall be added with unsigned arithmetic,
1372	* and overflow shall be ignored.
1373	* The sum of all 512 bytes is zero when the checksum is correct.
1374	*/
1375	uint32_t uCsum = ataChecksum(p, 510);
1376	p[255] = RT_H2LE_U16(0xa5 \| (uCsum << 8)); /* Integrity word */
1377
1378	s->iSourceSink = ATAFN_SS_NULL;
1379	ataCmdOK(s, ATA_STAT_SEEK);
1380	return false;
1381	}
1382
1383
1384	static void ataSetSignature(ATADevState *s)
1385	{
1386	s->uATARegSelect &= 0xf0; /* clear head */
1387	/* put signature */
1388	s->uATARegNSector = 1;
1389	s->uATARegSector = 1;
1390	if (s->fATAPI)
1391	{
1392	s->uATARegLCyl = 0x14;
1393	s->uATARegHCyl = 0xeb;
1394	}
1395	else if (s->pDrvBlock)
1396	{
1397	s->uATARegLCyl = 0;
1398	s->uATARegHCyl = 0;
1399	}
1400	else
1401	{
1402	s->uATARegLCyl = 0xff;
1403	s->uATARegHCyl = 0xff;
1404	}
1405	}
1406
1407
1408	static uint64_t ataGetSector(ATADevState *s)
1409	{
1410	uint64_t iLBA;
1411	if (s->uATARegSelect & 0x40)
1412	{
1413	/* any LBA variant */
1414	if (s->fLBA48)
1415	{
1416	/* LBA48 */
1417	iLBA = ((uint64_t)s->uATARegHCylHOB << 40) \|
1418	((uint64_t)s->uATARegLCylHOB << 32) \|
1419	((uint64_t)s->uATARegSectorHOB << 24) \|
1420	((uint64_t)s->uATARegHCyl << 16) \|
1421	((uint64_t)s->uATARegLCyl << 8) \|
1422	s->uATARegSector;
1423	}
1424	else
1425	{
1426	/* LBA */
1427	iLBA = ((s->uATARegSelect & 0x0f) << 24) \| (s->uATARegHCyl << 16) \|
1428	(s->uATARegLCyl << 8) \| s->uATARegSector;
1429	}
1430	}
1431	else
1432	{
1433	/* CHS */
1434	iLBA = ((s->uATARegHCyl << 8) \| s->uATARegLCyl) * s->PCHSGeometry.cHeads * s->PCHSGeometry.cSectors +
1435	(s->uATARegSelect & 0x0f) * s->PCHSGeometry.cSectors +
1436	(s->uATARegSector - 1);
1437	}
1438	return iLBA;
1439	}
1440
1441	static void ataSetSector(ATADevState *s, uint64_t iLBA)
1442	{
1443	uint32_t cyl, r;
1444	if (s->uATARegSelect & 0x40)
1445	{
1446	/* any LBA variant */
1447	if (s->fLBA48)
1448	{
1449	/* LBA48 */
1450	s->uATARegHCylHOB = iLBA >> 40;
1451	s->uATARegLCylHOB = iLBA >> 32;
1452	s->uATARegSectorHOB = iLBA >> 24;
1453	s->uATARegHCyl = iLBA >> 16;
1454	s->uATARegLCyl = iLBA >> 8;
1455	s->uATARegSector = iLBA;
1456	}
1457	else
1458	{
1459	/* LBA */
1460	s->uATARegSelect = (s->uATARegSelect & 0xf0) \| (iLBA >> 24);
1461	s->uATARegHCyl = (iLBA >> 16);
1462	s->uATARegLCyl = (iLBA >> 8);
1463	s->uATARegSector = (iLBA);
1464	}
1465	}
1466	else
1467	{
1468	/* CHS */
1469	cyl = iLBA / (s->PCHSGeometry.cHeads * s->PCHSGeometry.cSectors);
1470	r = iLBA % (s->PCHSGeometry.cHeads * s->PCHSGeometry.cSectors);
1471	s->uATARegHCyl = cyl >> 8;
1472	s->uATARegLCyl = cyl;
1473	s->uATARegSelect = (s->uATARegSelect & 0xf0) \| ((r / s->PCHSGeometry.cSectors) & 0x0f);
1474	s->uATARegSector = (r % s->PCHSGeometry.cSectors) + 1;
1475	}
1476	}
1477
1478
1479	static void ataWarningDiskFull(PPDMDEVINS pDevIns)
1480	{
1481	int rc;
1482	LogRel(("PIIX3 ATA: Host disk full\n"));
1483	rc = PDMDevHlpVMSetRuntimeError(pDevIns, VMSETRTERR_FLAGS_SUSPEND \| VMSETRTERR_FLAGS_NO_WAIT, "DevATA_DISKFULL",
1484	N_("Host system reported disk full. VM execution is suspended. You can resume after freeing some space"));
1485	AssertRC(rc);
1486	}
1487
1488	static void ataWarningFileTooBig(PPDMDEVINS pDevIns)
1489	{
1490	int rc;
1491	LogRel(("PIIX3 ATA: File too big\n"));
1492	rc = PDMDevHlpVMSetRuntimeError(pDevIns, VMSETRTERR_FLAGS_SUSPEND \| VMSETRTERR_FLAGS_NO_WAIT, "DevATA_FILETOOBIG",
1493	N_("Host system reported that the file size limit of the host file system has been exceeded. VM execution is suspended. You need to move your virtual hard disk to a filesystem which allows bigger files"));
1494	AssertRC(rc);
1495	}
1496
1497	static void ataWarningISCSI(PPDMDEVINS pDevIns)
1498	{
1499	int rc;
1500	LogRel(("PIIX3 ATA: iSCSI target unavailable\n"));
1501	rc = PDMDevHlpVMSetRuntimeError(pDevIns, VMSETRTERR_FLAGS_SUSPEND \| VMSETRTERR_FLAGS_NO_WAIT, "DevATA_ISCSIDOWN",
1502	N_("The iSCSI target has stopped responding. VM execution is suspended. You can resume when it is available again"));
1503	AssertRC(rc);
1504	}
1505
1506	static bool ataIsRedoSetWarning(ATADevState *s, int rc)
1507	{
1508	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
1509	Assert(!PDMCritSectIsOwner(&pCtl->lock));
1510	if (rc == VERR_DISK_FULL)
1511	{
1512	pCtl->fRedoIdle = true;
1513	ataWarningDiskFull(ATADEVSTATE_2_DEVINS(s));
1514	return true;
1515	}
1516	if (rc == VERR_FILE_TOO_BIG)
1517	{
1518	pCtl->fRedoIdle = true;
1519	ataWarningFileTooBig(ATADEVSTATE_2_DEVINS(s));
1520	return true;
1521	}
1522	if (rc == VERR_BROKEN_PIPE \|\| rc == VERR_NET_CONNECTION_REFUSED)
1523	{
1524	pCtl->fRedoIdle = true;
1525	/* iSCSI connection abort (first error) or failure to reestablish
1526	* connection (second error). Pause VM. On resume we'll retry. */
1527	ataWarningISCSI(ATADEVSTATE_2_DEVINS(s));
1528	return true;
1529	}
1530	return false;
1531	}
1532
1533
1534	static int ataReadSectors(ATADevState s, uint64_t u64Sector, void pvBuf,
1535	uint32_t cSectors, bool *pfRedo)
1536	{
1537	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
1538	int rc;
1539
1540	PDMCritSectLeave(&pCtl->lock);
1541
1542	STAM_PROFILE_ADV_START(&s->StatReads, r);
1543	s->Led.Asserted.s.fReading = s->Led.Actual.s.fReading = 1;
1544	rc = s->pDrvBlock->pfnRead(s->pDrvBlock, u64Sector * 512, pvBuf, cSectors * 512);
1545	s->Led.Actual.s.fReading = 0;
1546	STAM_PROFILE_ADV_STOP(&s->StatReads, r);
1547
1548	STAM_REL_COUNTER_ADD(&s->StatBytesRead, cSectors * 512);
1549
1550	if (RT_SUCCESS(rc))
1551	*pfRedo = false;
1552	else
1553	*pfRedo = ataIsRedoSetWarning(s, rc);
1554
1555	STAM_PROFILE_START(&pCtl->StatLockWait, a);
1556	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
1557	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
1558	return rc;
1559	}
1560
1561
1562	static int ataWriteSectors(ATADevState *s, uint64_t u64Sector,
1563	const void pvBuf, uint32_t cSectors, bool pfRedo)
1564	{
1565	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
1566	int rc;
1567
1568	PDMCritSectLeave(&pCtl->lock);
1569
1570	STAM_PROFILE_ADV_START(&s->StatWrites, w);
1571	s->Led.Asserted.s.fWriting = s->Led.Actual.s.fWriting = 1;
1572	#ifdef VBOX_INSTRUMENT_DMA_WRITES
1573	if (s->fDMA)
1574	STAM_PROFILE_ADV_START(&s->StatInstrVDWrites, vw);
1575	#endif
1576	rc = s->pDrvBlock->pfnWrite(s->pDrvBlock, u64Sector * 512, pvBuf, cSectors * 512);
1577	#ifdef VBOX_INSTRUMENT_DMA_WRITES
1578	if (s->fDMA)
1579	STAM_PROFILE_ADV_STOP(&s->StatInstrVDWrites, vw);
1580	#endif
1581	s->Led.Actual.s.fWriting = 0;
1582	STAM_PROFILE_ADV_STOP(&s->StatWrites, w);
1583
1584	STAM_REL_COUNTER_ADD(&s->StatBytesWritten, cSectors * 512);
1585
1586	if (RT_SUCCESS(rc))
1587	*pfRedo = false;
1588	else
1589	*pfRedo = ataIsRedoSetWarning(s, rc);
1590
1591	STAM_PROFILE_START(&pCtl->StatLockWait, a);
1592	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
1593	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
1594	return rc;
1595	}
1596
1597
1598	static void ataReadWriteSectorsBT(ATADevState *s)
1599	{
1600	uint32_t cSectors;
1601
1602	cSectors = s->cbTotalTransfer / 512;
1603	if (cSectors > s->cSectorsPerIRQ)
1604	s->cbElementaryTransfer = s->cSectorsPerIRQ * 512;
1605	else
1606	s->cbElementaryTransfer = cSectors * 512;
1607	if (s->uTxDir == PDMBLOCKTXDIR_TO_DEVICE)
1608	ataCmdOK(s, 0);
1609	}
1610
1611
1612	static bool ataReadSectorsSS(ATADevState *s)
1613	{
1614	int rc;
1615	uint32_t cSectors;
1616	uint64_t iLBA;
1617	bool fRedo;
1618
1619	cSectors = s->cbElementaryTransfer / 512;
1620	Assert(cSectors);
1621	iLBA = ataGetSector(s);
1622	Log(("%s: %d sectors at LBA %d\n", __FUNCTION__, cSectors, iLBA));
1623	rc = ataReadSectors(s, iLBA, s->CTX_SUFF(pbIOBuffer), cSectors, &fRedo);
1624	if (RT_SUCCESS(rc))
1625	{
1626	ataSetSector(s, iLBA + cSectors);
1627	if (s->cbElementaryTransfer == s->cbTotalTransfer)
1628	s->iSourceSink = ATAFN_SS_NULL;
1629	ataCmdOK(s, ATA_STAT_SEEK);
1630	}
1631	else
1632	{
1633	if (fRedo)
1634	return fRedo;
1635	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
1636	LogRel(("PIIX3 ATA: LUN#%d: disk read error (rc=%Rrc iSector=%#RX64 cSectors=%#RX32)\n",
1637	s->iLUN, rc, iLBA, cSectors));
1638
1639	/*
1640	* Check if we got interrupted. We don't need to set status variables
1641	* because the request was aborted.
1642	*/
1643	if (rc != VERR_INTERRUPTED)
1644	ataCmdError(s, ID_ERR);
1645	}
1646	return false;
1647	}
1648
1649
1650	static bool ataWriteSectorsSS(ATADevState *s)
1651	{
1652	int rc;
1653	uint32_t cSectors;
1654	uint64_t iLBA;
1655	bool fRedo;
1656
1657	cSectors = s->cbElementaryTransfer / 512;
1658	Assert(cSectors);
1659	iLBA = ataGetSector(s);
1660	Log(("%s: %d sectors at LBA %d\n", __FUNCTION__, cSectors, iLBA));
1661	rc = ataWriteSectors(s, iLBA, s->CTX_SUFF(pbIOBuffer), cSectors, &fRedo);
1662	if (RT_SUCCESS(rc))
1663	{
1664	ataSetSector(s, iLBA + cSectors);
1665	if (!s->cbTotalTransfer)
1666	s->iSourceSink = ATAFN_SS_NULL;
1667	ataCmdOK(s, ATA_STAT_SEEK);
1668	}
1669	else
1670	{
1671	if (fRedo)
1672	return fRedo;
1673	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
1674	LogRel(("PIIX3 ATA: LUN#%d: disk write error (rc=%Rrc iSector=%#RX64 cSectors=%#RX32)\n",
1675	s->iLUN, rc, iLBA, cSectors));
1676
1677	/*
1678	* Check if we got interrupted. We don't need to set status variables
1679	* because the request was aborted.
1680	*/
1681	if (rc != VERR_INTERRUPTED)
1682	ataCmdError(s, ID_ERR);
1683	}
1684	return false;
1685	}
1686
1687
1688	static void atapiCmdOK(ATADevState *s)
1689	{
1690	s->uATARegError = 0;
1691	ataSetStatusValue(s, ATA_STAT_READY);
1692	s->uATARegNSector = (s->uATARegNSector & ~7)
1693	\| ((s->uTxDir != PDMBLOCKTXDIR_TO_DEVICE) ? ATAPI_INT_REASON_IO : 0)
1694	\| (!s->cbTotalTransfer ? ATAPI_INT_REASON_CD : 0);
1695	Log2(("%s: interrupt reason %#04x\n", __FUNCTION__, s->uATARegNSector));
1696
1697	memset(s->abATAPISense, '\0', sizeof(s->abATAPISense));
1698	s->abATAPISense[0] = 0x70 \| (1 << 7);
1699	s->abATAPISense[7] = 10;
1700	}
1701
1702
1703	static void atapiCmdError(ATADevState s, const uint8_t pabATAPISense, size_t cbATAPISense)
1704	{
1705	Log(("%s: sense=%#x (%s) asc=%#x ascq=%#x (%s)\n", __FUNCTION__, pabATAPISense[2] & 0x0f, SCSISenseText(pabATAPISense[2] & 0x0f),
1706	pabATAPISense[12], pabATAPISense[13], SCSISenseExtText(pabATAPISense[12], pabATAPISense[13])));
1707	s->uATARegError = pabATAPISense[2] << 4;
1708	ataSetStatusValue(s, ATA_STAT_READY \| ATA_STAT_ERR);
1709	s->uATARegNSector = (s->uATARegNSector & ~7) \| ATAPI_INT_REASON_IO \| ATAPI_INT_REASON_CD;
1710	Log2(("%s: interrupt reason %#04x\n", __FUNCTION__, s->uATARegNSector));
1711	memset(s->abATAPISense, '\0', sizeof(s->abATAPISense));
1712	memcpy(s->abATAPISense, pabATAPISense, RT_MIN(cbATAPISense, sizeof(s->abATAPISense)));
1713	s->cbTotalTransfer = 0;
1714	s->cbElementaryTransfer = 0;
1715	s->iIOBufferCur = 0;
1716	s->iIOBufferEnd = 0;
1717	s->uTxDir = PDMBLOCKTXDIR_NONE;
1718	s->iBeginTransfer = ATAFN_BT_NULL;
1719	s->iSourceSink = ATAFN_SS_NULL;
1720	}
1721
1722
1723	/** @todo deprecated function - doesn't provide enough info. Replace by direct
1724	* calls to atapiCmdError() with full data. */
1725	static void atapiCmdErrorSimple(ATADevState *s, uint8_t uATAPISenseKey, uint8_t uATAPIASC)
1726	{
1727	uint8_t abATAPISense[ATAPI_SENSE_SIZE];
1728	memset(abATAPISense, '\0', sizeof(abATAPISense));
1729	abATAPISense[0] = 0x70 \| (1 << 7);
1730	abATAPISense[2] = uATAPISenseKey & 0x0f;
1731	abATAPISense[7] = 10;
1732	abATAPISense[12] = uATAPIASC;
1733	atapiCmdError(s, abATAPISense, sizeof(abATAPISense));
1734	}
1735
1736
1737	static void atapiCmdBT(ATADevState *s)
1738	{
1739	s->fATAPITransfer = true;
1740	s->cbElementaryTransfer = s->cbTotalTransfer;
1741	s->cbPIOTransferLimit = s->uATARegLCyl \| (s->uATARegHCyl << 8);
1742	if (s->uTxDir == PDMBLOCKTXDIR_TO_DEVICE)
1743	atapiCmdOK(s);
1744	}
1745
1746
1747	static void atapiPassthroughCmdBT(ATADevState *s)
1748	{
1749	/* @todo implement an algorithm for correctly determining the read and
1750	* write sector size without sending additional commands to the drive.
1751	* This should be doable by saving processing the configuration requests
1752	* and replies. */
1753	#if 0
1754	if (s->uTxDir == PDMBLOCKTXDIR_TO_DEVICE)
1755	{
1756	uint8_t cmd = s->aATAPICmd[0];
1757	if (cmd == SCSI_WRITE_10 \|\| cmd == SCSI_WRITE_12 \|\| cmd == SCSI_WRITE_AND_VERIFY_10)
1758	{
1759	uint8_t aModeSenseCmd[10];
1760	uint8_t aModeSenseResult[16];
1761	uint8_t uDummySense;
1762	uint32_t cbTransfer;
1763	int rc;
1764
1765	cbTransfer = sizeof(aModeSenseResult);
1766	aModeSenseCmd[0] = SCSI_MODE_SENSE_10;
1767	aModeSenseCmd[1] = 0x08; /* disable block descriptor = 1 */
1768	aModeSenseCmd[2] = (SCSI_PAGECONTROL_CURRENT << 6) \| SCSI_MODEPAGE_WRITE_PARAMETER;
1769	aModeSenseCmd[3] = 0; /* subpage code */
1770	aModeSenseCmd[4] = 0; /* reserved */
1771	aModeSenseCmd[5] = 0; /* reserved */
1772	aModeSenseCmd[6] = 0; /* reserved */
1773	aModeSenseCmd[7] = cbTransfer >> 8;
1774	aModeSenseCmd[8] = cbTransfer & 0xff;
1775	aModeSenseCmd[9] = 0; /* control */
1776	rc = s->pDrvBlock->pfnSendCmd(s->pDrvBlock, aModeSenseCmd, PDMBLOCKTXDIR_FROM_DEVICE, aModeSenseResult, &cbTransfer, &uDummySense, 500);
1777	if (RT_FAILURE(rc))
1778	{
1779	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_NONE);
1780	return;
1781	}
1782	/* Select sector size based on the current data block type. */
1783	switch (aModeSenseResult[12] & 0x0f)
1784	{
1785	case 0:
1786	s->cbATAPISector = 2352;
1787	break;
1788	case 1:
1789	s->cbATAPISector = 2368;
1790	break;
1791	case 2:
1792	case 3:
1793	s->cbATAPISector = 2448;
1794	break;
1795	case 8:
1796	case 10:
1797	s->cbATAPISector = 2048;
1798	break;
1799	case 9:
1800	s->cbATAPISector = 2336;
1801	break;
1802	case 11:
1803	s->cbATAPISector = 2056;
1804	break;
1805	case 12:
1806	s->cbATAPISector = 2324;
1807	break;
1808	case 13:
1809	s->cbATAPISector = 2332;
1810	break;
1811	default:
1812	s->cbATAPISector = 0;
1813	}
1814	Log2(("%s: sector size %d\n", __FUNCTION__, s->cbATAPISector));
1815	s->cbTotalTransfer *= s->cbATAPISector;
1816	if (s->cbTotalTransfer == 0)
1817	s->uTxDir = PDMBLOCKTXDIR_NONE;
1818	}
1819	}
1820	#endif
1821	atapiCmdBT(s);
1822	}
1823
1824
1825	static bool atapiReadSS(ATADevState *s)
1826	{
1827	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
1828	int rc = VINF_SUCCESS;
1829	uint32_t cbTransfer, cSectors;
1830
1831	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
1832	cbTransfer = RT_MIN(s->cbTotalTransfer, s->cbIOBuffer);
1833	cSectors = cbTransfer / s->cbATAPISector;
1834	Assert(cSectors * s->cbATAPISector <= cbTransfer);
1835	Log(("%s: %d sectors at LBA %d\n", __FUNCTION__, cSectors, s->iATAPILBA));
1836
1837	PDMCritSectLeave(&pCtl->lock);
1838
1839	STAM_PROFILE_ADV_START(&s->StatReads, r);
1840	s->Led.Asserted.s.fReading = s->Led.Actual.s.fReading = 1;
1841	switch (s->cbATAPISector)
1842	{
1843	case 2048:
1844	rc = s->pDrvBlock->pfnRead(s->pDrvBlock, (uint64_t)s->iATAPILBA * s->cbATAPISector, s->CTX_SUFF(pbIOBuffer), s->cbATAPISector * cSectors);
1845	break;
1846	case 2352:
1847	{
1848	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
1849
1850	for (uint32_t i = s->iATAPILBA; i < s->iATAPILBA + cSectors; i++)
1851	{
1852	/* Sync bytes, see 4.2.3.8 CD Main Channel Block Formats */
1853	*pbBuf++ = 0x00;
1854	memset(pbBuf, 0xff, 10);
1855	pbBuf += 10;
1856	*pbBuf++ = 0x00;
1857	/* MSF */
1858	ataLBA2MSF(pbBuf, i);
1859	pbBuf += 3;
1860	pbBuf++ = 0x01; / mode 1 data */
1861	/* data */
1862	rc = s->pDrvBlock->pfnRead(s->pDrvBlock, (uint64_t)i * 2048, pbBuf, 2048);
1863	if (RT_FAILURE(rc))
1864	break;
1865	pbBuf += 2048;
1866	/**
1867	* @todo: maybe compute ECC and parity, layout is:
1868	* 2072 4 EDC
1869	* 2076 172 P parity symbols
1870	* 2248 104 Q parity symbols
1871	*/
1872	memset(pbBuf, 0, 280);
1873	pbBuf += 280;
1874	}
1875	}
1876	break;
1877	default:
1878	break;
1879	}
1880	s->Led.Actual.s.fReading = 0;
1881	STAM_PROFILE_ADV_STOP(&s->StatReads, r);
1882
1883	STAM_PROFILE_START(&pCtl->StatLockWait, a);
1884	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
1885	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
1886
1887	if (RT_SUCCESS(rc))
1888	{
1889	STAM_REL_COUNTER_ADD(&s->StatBytesRead, s->cbATAPISector * cSectors);
1890
1891	/* The initial buffer end value has been set up based on the total
1892	* transfer size. But the I/O buffer size limits what can actually be
1893	* done in one transfer, so set the actual value of the buffer end. */
1894	s->cbElementaryTransfer = cbTransfer;
1895	if (cbTransfer >= s->cbTotalTransfer)
1896	s->iSourceSink = ATAFN_SS_NULL;
1897	atapiCmdOK(s);
1898	s->iATAPILBA += cSectors;
1899	}
1900	else
1901	{
1902	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
1903	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM read error, %d sectors at LBA %d\n", s->iLUN, cSectors, s->iATAPILBA));
1904
1905	/*
1906	* Check if we got interrupted. We don't need to set status variables
1907	* because the request was aborted.
1908	*/
1909	if (rc != VERR_INTERRUPTED)
1910	atapiCmdErrorSimple(s, SCSI_SENSE_MEDIUM_ERROR, SCSI_ASC_READ_ERROR);
1911	}
1912	return false;
1913	}
1914
1915	/**
1916	* Sets the given media track type.
1917	*/
1918	static uint32_t ataMediumTypeSet(ATADevState *s, uint32_t MediaTrackType)
1919	{
1920	return ASMAtomicXchgU32(&s->MediaTrackType, MediaTrackType);
1921	}
1922
1923	static bool atapiPassthroughSS(ATADevState *s)
1924	{
1925	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
1926	int rc = VINF_SUCCESS;
1927	uint8_t abATAPISense[ATAPI_SENSE_SIZE];
1928	uint32_t cbTransfer;
1929	PSTAMPROFILEADV pProf = NULL;
1930
1931	cbTransfer = RT_MIN(s->cbElementaryTransfer, s->cbIOBuffer);
1932
1933	if (s->uTxDir == PDMBLOCKTXDIR_TO_DEVICE)
1934	Log3(("ATAPI PT data write (%d): %.*Rhxs\n", cbTransfer, cbTransfer, s->CTX_SUFF(pbIOBuffer)));
1935
1936	/* Simple heuristics: if there is at least one sector of data
1937	* to transfer, it's worth updating the LEDs. */
1938	if (cbTransfer >= 2048)
1939	{
1940	if (s->uTxDir != PDMBLOCKTXDIR_TO_DEVICE)
1941	{
1942	s->Led.Asserted.s.fReading = s->Led.Actual.s.fReading = 1;
1943	pProf = &s->StatReads;
1944	}
1945	else
1946	{
1947	s->Led.Asserted.s.fWriting = s->Led.Actual.s.fWriting = 1;
1948	pProf = &s->StatWrites;
1949	}
1950	}
1951
1952	PDMCritSectLeave(&pCtl->lock);
1953
1954	#if defined(LOG_ENABLED)
1955	char szBuf[1024];
1956
1957	memset(szBuf, 0, sizeof(szBuf));
1958
1959	switch (s->aATAPICmd[0])
1960	{
1961	case SCSI_MODE_SELECT_10:
1962	{
1963	size_t cbBlkDescLength = ataBE2H_U16(&s->CTX_SUFF(pbIOBuffer)[6]);
1964
1965	SCSILogModePage(szBuf, sizeof(szBuf) - 1,
1966	s->CTX_SUFF(pbIOBuffer) + 8 + cbBlkDescLength,
1967	cbTransfer - 8 - cbBlkDescLength);
1968	break;
1969	}
1970	case SCSI_SEND_CUE_SHEET:
1971	{
1972	SCSILogCueSheet(szBuf, sizeof(szBuf) - 1,
1973	s->CTX_SUFF(pbIOBuffer), cbTransfer);
1974	break;
1975	}
1976	default:
1977	break;
1978	}
1979
1980	Log2(("%s\n", szBuf));
1981	#endif
1982
1983	if (pProf) { STAM_PROFILE_ADV_START(pProf, b); }
1984	if ( cbTransfer > SCSI_MAX_BUFFER_SIZE
1985	\|\| s->cbElementaryTransfer > s->cbIOBuffer)
1986	{
1987	/* Linux accepts commands with up to 100KB of data, but expects
1988	* us to handle commands with up to 128KB of data. The usual
1989	* imbalance of powers. */
1990	uint8_t aATAPICmd[ATAPI_PACKET_SIZE];
1991	uint32_t iATAPILBA, cSectors, cReqSectors, cbCurrTX;
1992	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
1993	uint32_t cSectorsMax; /*< Maximum amount of sectors to read without exceeding the I/O buffer. /
1994
1995	Assert(s->cbATAPISector);
1996	cSectorsMax = cbTransfer / s->cbATAPISector;
1997	Assert(cSectorsMax * s->cbATAPISector <= s->cbIOBuffer);
1998
1999	switch (s->aATAPICmd[0])
2000	{
2001	case SCSI_READ_10:
2002	case SCSI_WRITE_10:
2003	case SCSI_WRITE_AND_VERIFY_10:
2004	iATAPILBA = ataBE2H_U32(s->aATAPICmd + 2);
2005	cSectors = ataBE2H_U16(s->aATAPICmd + 7);
2006	break;
2007	case SCSI_READ_12:
2008	case SCSI_WRITE_12:
2009	iATAPILBA = ataBE2H_U32(s->aATAPICmd + 2);
2010	cSectors = ataBE2H_U32(s->aATAPICmd + 6);
2011	break;
2012	case SCSI_READ_CD:
2013	iATAPILBA = ataBE2H_U32(s->aATAPICmd + 2);
2014	cSectors = ataBE2H_U24(s->aATAPICmd + 6);
2015	break;
2016	case SCSI_READ_CD_MSF:
2017	iATAPILBA = ataMSF2LBA(s->aATAPICmd + 3);
2018	cSectors = ataMSF2LBA(s->aATAPICmd + 6) - iATAPILBA;
2019	break;
2020	default:
2021	AssertMsgFailed(("Don't know how to split command %#04x\n", s->aATAPICmd[0]));
2022	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
2023	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM passthrough split error\n", s->iLUN));
2024	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_ILLEGAL_OPCODE);
2025	{
2026	STAM_PROFILE_START(&pCtl->StatLockWait, a);
2027	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
2028	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
2029	}
2030	return false;
2031	}
2032	cSectorsMax = RT_MIN(cSectorsMax, cSectors);
2033	memcpy(aATAPICmd, s->aATAPICmd, ATAPI_PACKET_SIZE);
2034	cReqSectors = 0;
2035	for (uint32_t i = cSectorsMax; i > 0; i -= cReqSectors)
2036	{
2037	if (i * s->cbATAPISector > SCSI_MAX_BUFFER_SIZE)
2038	cReqSectors = SCSI_MAX_BUFFER_SIZE / s->cbATAPISector;
2039	else
2040	cReqSectors = i;
2041	cbCurrTX = s->cbATAPISector * cReqSectors;
2042	switch (s->aATAPICmd[0])
2043	{
2044	case SCSI_READ_10:
2045	case SCSI_WRITE_10:
2046	case SCSI_WRITE_AND_VERIFY_10:
2047	ataH2BE_U32(aATAPICmd + 2, iATAPILBA);
2048	ataH2BE_U16(aATAPICmd + 7, cReqSectors);
2049	break;
2050	case SCSI_READ_12:
2051	case SCSI_WRITE_12:
2052	ataH2BE_U32(aATAPICmd + 2, iATAPILBA);
2053	ataH2BE_U32(aATAPICmd + 6, cReqSectors);
2054	break;
2055	case SCSI_READ_CD:
2056	ataH2BE_U32(aATAPICmd + 2, iATAPILBA);
2057	ataH2BE_U24(aATAPICmd + 6, cReqSectors);
2058	break;
2059	case SCSI_READ_CD_MSF:
2060	ataLBA2MSF(aATAPICmd + 3, iATAPILBA);
2061	ataLBA2MSF(aATAPICmd + 6, iATAPILBA + cReqSectors);
2062	break;
2063	}
2064	rc = s->pDrvBlock->pfnSendCmd(s->pDrvBlock, aATAPICmd, (PDMBLOCKTXDIR)s->uTxDir, pbBuf, &cbCurrTX, abATAPISense, sizeof(abATAPISense), 30000 /*< @todo timeout /);
2065	if (rc != VINF_SUCCESS)
2066	break;
2067	iATAPILBA += cReqSectors;
2068	pbBuf += s->cbATAPISector * cReqSectors;
2069	}
2070
2071	if (RT_SUCCESS(rc))
2072	{
2073	/* Adjust ATAPI command for the next call. */
2074	switch (s->aATAPICmd[0])
2075	{
2076	case SCSI_READ_10:
2077	case SCSI_WRITE_10:
2078	case SCSI_WRITE_AND_VERIFY_10:
2079	ataH2BE_U32(s->aATAPICmd + 2, iATAPILBA);
2080	ataH2BE_U16(s->aATAPICmd + 7, cSectors - cSectorsMax);
2081	break;
2082	case SCSI_READ_12:
2083	case SCSI_WRITE_12:
2084	ataH2BE_U32(s->aATAPICmd + 2, iATAPILBA);
2085	ataH2BE_U32(s->aATAPICmd + 6, cSectors - cSectorsMax);
2086	break;
2087	case SCSI_READ_CD:
2088	ataH2BE_U32(s->aATAPICmd + 2, iATAPILBA);
2089	ataH2BE_U24(s->aATAPICmd + 6, cSectors - cSectorsMax);
2090	break;
2091	case SCSI_READ_CD_MSF:
2092	ataLBA2MSF(s->aATAPICmd + 3, iATAPILBA);
2093	ataLBA2MSF(s->aATAPICmd + 6, iATAPILBA + cSectors - cSectorsMax);
2094	break;
2095	default:
2096	AssertMsgFailed(("Don't know how to split command %#04x\n", s->aATAPICmd[0]));
2097	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
2098	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM passthrough split error\n", s->iLUN));
2099	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_ILLEGAL_OPCODE);
2100	return false;
2101	}
2102	}
2103	}
2104	else
2105	rc = s->pDrvBlock->pfnSendCmd(s->pDrvBlock, s->aATAPICmd, (PDMBLOCKTXDIR)s->uTxDir, s->CTX_SUFF(pbIOBuffer), &cbTransfer, abATAPISense, sizeof(abATAPISense), 30000 /*< @todo timeout /);
2106	if (pProf) { STAM_PROFILE_ADV_STOP(pProf, b); }
2107
2108	STAM_PROFILE_START(&pCtl->StatLockWait, a);
2109	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
2110	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
2111
2112	/* Update the LEDs and the read/write statistics. */
2113	if (cbTransfer >= 2048)
2114	{
2115	if (s->uTxDir != PDMBLOCKTXDIR_TO_DEVICE)
2116	{
2117	s->Led.Actual.s.fReading = 0;
2118	STAM_REL_COUNTER_ADD(&s->StatBytesRead, cbTransfer);
2119	}
2120	else
2121	{
2122	s->Led.Actual.s.fWriting = 0;
2123	STAM_REL_COUNTER_ADD(&s->StatBytesWritten, cbTransfer);
2124	}
2125	}
2126
2127	if (RT_SUCCESS(rc))
2128	{
2129	/* Do post processing for certain commands. */
2130	switch (s->aATAPICmd[0])
2131	{
2132	case SCSI_SEND_CUE_SHEET:
2133	case SCSI_READ_TOC_PMA_ATIP:
2134	{
2135	if (!s->pTrackList)
2136	rc = ATAPIPassthroughTrackListCreateEmpty(&s->pTrackList);
2137
2138	if (RT_SUCCESS(rc))
2139	rc = ATAPIPassthroughTrackListUpdate(s->pTrackList, s->aATAPICmd, s->CTX_SUFF(pbIOBuffer));
2140
2141	if ( RT_FAILURE(rc)
2142	&& s->cErrors++ < MAX_LOG_REL_ERRORS)
2143	LogRel(("ATA: Error (%Rrc) while updating the tracklist during %s, burning the disc might fail\n",
2144	rc, s->aATAPICmd[0] == SCSI_SEND_CUE_SHEET ? "SEND CUE SHEET" : "READ TOC/PMA/ATIP"));
2145	break;
2146	}
2147	case SCSI_SYNCHRONIZE_CACHE:
2148	{
2149	ATAPIPassthroughTrackListClear(s->pTrackList);
2150	break;
2151	}
2152	}
2153
2154	if (s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE)
2155	{
2156	Assert(cbTransfer <= s->cbTotalTransfer);
2157	/*
2158	* Reply with the same amount of data as the real drive
2159	* but only if the command wasn't splitted.
2160	*/
2161	if (s->cbElementaryTransfer < s->cbIOBuffer)
2162	s->cbTotalTransfer = cbTransfer;
2163
2164	if ( s->aATAPICmd[0] == SCSI_INQUIRY
2165	&& s->fOverwriteInquiry)
2166	{
2167	/* Make sure that the real drive cannot be identified.
2168	* Motivation: changing the VM configuration should be as
2169	* invisible as possible to the guest. */
2170	Log3(("ATAPI PT inquiry data before (%d): %.*Rhxs\n", cbTransfer, cbTransfer, s->CTX_SUFF(pbIOBuffer)));
2171	ataSCSIPadStr(s->CTX_SUFF(pbIOBuffer) + 8, "VBOX", 8);
2172	ataSCSIPadStr(s->CTX_SUFF(pbIOBuffer) + 16, "CD-ROM", 16);
2173	ataSCSIPadStr(s->CTX_SUFF(pbIOBuffer) + 32, "1.0", 4);
2174	}
2175
2176	if (cbTransfer)
2177	Log3(("ATAPI PT data read (%d): %.*Rhxs\n", cbTransfer, cbTransfer, s->CTX_SUFF(pbIOBuffer)));
2178	}
2179
2180	/* The initial buffer end value has been set up based on the total
2181	* transfer size. But the I/O buffer size limits what can actually be
2182	* done in one transfer, so set the actual value of the buffer end. */
2183	s->cbElementaryTransfer = cbTransfer;
2184	if (cbTransfer >= s->cbTotalTransfer)
2185	{
2186	s->iSourceSink = ATAFN_SS_NULL;
2187	atapiCmdOK(s);
2188	}
2189	}
2190	else
2191	{
2192	if (s->cErrors < MAX_LOG_REL_ERRORS)
2193	{
2194	uint8_t u8Cmd = s->aATAPICmd[0];
2195	do
2196	{
2197	/* don't log superfluous errors */
2198	if ( rc == VERR_DEV_IO_ERROR
2199	&& ( u8Cmd == SCSI_TEST_UNIT_READY
2200	\|\| u8Cmd == SCSI_READ_CAPACITY
2201	\|\| u8Cmd == SCSI_READ_DVD_STRUCTURE
2202	\|\| u8Cmd == SCSI_READ_TOC_PMA_ATIP))
2203	break;
2204	s->cErrors++;
2205	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM passthrough cmd=%#04x sense=%d ASC=%#02x ASCQ=%#02x %Rrc\n",
2206	s->iLUN, u8Cmd, abATAPISense[2] & 0x0f, abATAPISense[12], abATAPISense[13], rc));
2207	} while (0);
2208	}
2209	atapiCmdError(s, abATAPISense, sizeof(abATAPISense));
2210	}
2211	return false;
2212	}
2213
2214	/** @todo: Revise ASAP. */
2215	static bool atapiReadDVDStructureSS(ATADevState *s)
2216	{
2217	uint8_t *buf = s->CTX_SUFF(pbIOBuffer);
2218	int media = s->aATAPICmd[1];
2219	int format = s->aATAPICmd[7];
2220
2221	uint16_t max_len = ataBE2H_U16(&s->aATAPICmd[8]);
2222
2223	memset(buf, 0, max_len);
2224
2225	switch (format) {
2226	case 0x00:
2227	case 0x01:
2228	case 0x02:
2229	case 0x03:
2230	case 0x04:
2231	case 0x05:
2232	case 0x06:
2233	case 0x07:
2234	case 0x08:
2235	case 0x09:
2236	case 0x0a:
2237	case 0x0b:
2238	case 0x0c:
2239	case 0x0d:
2240	case 0x0e:
2241	case 0x0f:
2242	case 0x10:
2243	case 0x11:
2244	case 0x30:
2245	case 0x31:
2246	case 0xff:
2247	if (media == 0)
2248	{
2249	int uASC = SCSI_ASC_NONE;
2250
2251	switch (format)
2252	{
2253	case 0x0: /* Physical format information */
2254	{
2255	int layer = s->aATAPICmd[6];
2256	uint64_t total_sectors;
2257
2258	if (layer != 0)
2259	{
2260	uASC = -SCSI_ASC_INV_FIELD_IN_CMD_PACKET;
2261	break;
2262	}
2263
2264	total_sectors = s->cTotalSectors;
2265	total_sectors >>= 2;
2266	if (total_sectors == 0)
2267	{
2268	uASC = -SCSI_ASC_MEDIUM_NOT_PRESENT;
2269	break;
2270	}
2271
2272	buf[4] = 1; /* DVD-ROM, part version 1 */
2273	buf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
2274	buf[6] = 1; /* one layer, read-only (per MMC-2 spec) */
2275	buf[7] = 0; /* default densities */
2276
2277	/* FIXME: 0x30000 per spec? */
2278	ataH2BE_U32(buf + 8, 0); /* start sector */
2279	ataH2BE_U32(buf + 12, total_sectors - 1); /* end sector */
2280	ataH2BE_U32(buf + 16, total_sectors - 1); /* l0 end sector */
2281
2282	/* Size of buffer, not including 2 byte size field */
2283	ataH2BE_U32(&buf[0], 2048 + 2);
2284
2285	/* 2k data + 4 byte header */
2286	uASC = (2048 + 4);
2287	}
2288	break;
2289	case 0x01: /* DVD copyright information */
2290	buf[4] = 0; /* no copyright data */
2291	buf[5] = 0; /* no region restrictions */
2292
2293	/* Size of buffer, not including 2 byte size field */
2294	ataH2BE_U16(buf, 4 + 2);
2295
2296	/* 4 byte header + 4 byte data */
2297	uASC = (4 + 4);
2298
2299	case 0x03: /* BCA information - invalid field for no BCA info */
2300	uASC = -SCSI_ASC_INV_FIELD_IN_CMD_PACKET;
2301	break;
2302
2303	case 0x04: /* DVD disc manufacturing information */
2304	/* Size of buffer, not including 2 byte size field */
2305	ataH2BE_U16(buf, 2048 + 2);
2306
2307	/* 2k data + 4 byte header */
2308	uASC = (2048 + 4);
2309	break;
2310	case 0xff:
2311	/*
2312	* This lists all the command capabilities above. Add new ones
2313	* in order and update the length and buffer return values.
2314	*/
2315
2316	buf[4] = 0x00; /* Physical format */
2317	buf[5] = 0x40; /* Not writable, is readable */
2318	ataH2BE_U16((buf + 6), 2048 + 4);
2319
2320	buf[8] = 0x01; /* Copyright info */
2321	buf[9] = 0x40; /* Not writable, is readable */
2322	ataH2BE_U16((buf + 10), 4 + 4);
2323
2324	buf[12] = 0x03; /* BCA info */
2325	buf[13] = 0x40; /* Not writable, is readable */
2326	ataH2BE_U16((buf + 14), 188 + 4);
2327
2328	buf[16] = 0x04; /* Manufacturing info */
2329	buf[17] = 0x40; /* Not writable, is readable */
2330	ataH2BE_U16((buf + 18), 2048 + 4);
2331
2332	/* Size of buffer, not including 2 byte size field */
2333	ataH2BE_U16(buf, 16 + 2);
2334
2335	/* data written + 4 byte header */
2336	uASC = (16 + 4);
2337	break;
2338	default: /* TODO: formats beyond DVD-ROM requires */
2339	uASC = -SCSI_ASC_INV_FIELD_IN_CMD_PACKET;
2340	}
2341
2342	if (uASC < 0)
2343	{
2344	s->iSourceSink = ATAFN_SS_NULL;
2345	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, -uASC);
2346	return false;
2347	}
2348	break;
2349	}
2350	/* TODO: BD support, fall through for now */
2351
2352	/* Generic disk structures */
2353	case 0x80: /* TODO: AACS volume identifier */
2354	case 0x81: /* TODO: AACS media serial number */
2355	case 0x82: /* TODO: AACS media identifier */
2356	case 0x83: /* TODO: AACS media key block */
2357	case 0x90: /* TODO: List of recognized format layers */
2358	case 0xc0: /* TODO: Write protection status */
2359	default:
2360	s->iSourceSink = ATAFN_SS_NULL;
2361	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST,
2362	SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
2363	return false;
2364	}
2365
2366	s->iSourceSink = ATAFN_SS_NULL;
2367	atapiCmdOK(s);
2368	return false;
2369	}
2370
2371	static bool atapiReadSectors(ATADevState *s, uint32_t iATAPILBA, uint32_t cSectors, uint32_t cbSector)
2372	{
2373	Assert(cSectors > 0);
2374	s->iATAPILBA = iATAPILBA;
2375	s->cbATAPISector = cbSector;
2376	ataStartTransfer(s, cSectors * cbSector, PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ, true);
2377	return false;
2378	}
2379
2380
2381	static bool atapiReadCapacitySS(ATADevState *s)
2382	{
2383	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2384
2385	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2386	Assert(s->cbElementaryTransfer <= 8);
2387	ataH2BE_U32(pbBuf, s->cTotalSectors - 1);
2388	ataH2BE_U32(pbBuf + 4, 2048);
2389	s->iSourceSink = ATAFN_SS_NULL;
2390	atapiCmdOK(s);
2391	return false;
2392	}
2393
2394
2395	static bool atapiReadDiscInformationSS(ATADevState *s)
2396	{
2397	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2398
2399	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2400	Assert(s->cbElementaryTransfer <= 34);
2401	memset(pbBuf, '\0', 34);
2402	ataH2BE_U16(pbBuf, 32);
2403	pbBuf[2] = (0 << 4) \| (3 << 2) \| (2 << 0); /* not erasable, complete session, complete disc */
2404	pbBuf[3] = 1; /* number of first track */
2405	pbBuf[4] = 1; /* number of sessions (LSB) */
2406	pbBuf[5] = 1; /* first track number in last session (LSB) */
2407	pbBuf[6] = 1; /* last track number in last session (LSB) */
2408	pbBuf[7] = (0 << 7) \| (0 << 6) \| (1 << 5) \| (0 << 2) \| (0 << 0); /* disc id not valid, disc bar code not valid, unrestricted use, not dirty, not RW medium */
2409	pbBuf[8] = 0; /* disc type = CD-ROM */
2410	pbBuf[9] = 0; /* number of sessions (MSB) */
2411	pbBuf[10] = 0; /* number of sessions (MSB) */
2412	pbBuf[11] = 0; /* number of sessions (MSB) */
2413	ataH2BE_U32(pbBuf + 16, 0x00ffffff); /* last session lead-in start time is not available */
2414	ataH2BE_U32(pbBuf + 20, 0x00ffffff); /* last possible start time for lead-out is not available */
2415	s->iSourceSink = ATAFN_SS_NULL;
2416	atapiCmdOK(s);
2417	return false;
2418	}
2419
2420
2421	static bool atapiReadTrackInformationSS(ATADevState *s)
2422	{
2423	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2424
2425	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2426	Assert(s->cbElementaryTransfer <= 36);
2427	/* Accept address/number type of 1 only, and only track 1 exists. */
2428	if ((s->aATAPICmd[1] & 0x03) != 1 \|\| ataBE2H_U32(&s->aATAPICmd[2]) != 1)
2429	{
2430	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
2431	return false;
2432	}
2433	memset(pbBuf, '\0', 36);
2434	ataH2BE_U16(pbBuf, 34);
2435	pbBuf[2] = 1; /* track number (LSB) */
2436	pbBuf[3] = 1; /* session number (LSB) */
2437	pbBuf[5] = (0 << 5) \| (0 << 4) \| (4 << 0); /* not damaged, primary copy, data track */
2438	pbBuf[6] = (0 << 7) \| (0 << 6) \| (0 << 5) \| (0 << 6) \| (1 << 0); /* not reserved track, not blank, not packet writing, not fixed packet, data mode 1 */
2439	pbBuf[7] = (0 << 1) \| (0 << 0); /* last recorded address not valid, next recordable address not valid */
2440	ataH2BE_U32(pbBuf + 8, 0); /* track start address is 0 */
2441	ataH2BE_U32(pbBuf + 24, s->cTotalSectors); /* track size */
2442	pbBuf[32] = 0; /* track number (MSB) */
2443	pbBuf[33] = 0; /* session number (MSB) */
2444	s->iSourceSink = ATAFN_SS_NULL;
2445	atapiCmdOK(s);
2446	return false;
2447	}
2448
2449	static size_t atapiGetConfigurationFillFeatureListProfiles(ATADevState s, uint8_t pbBuf, size_t cbBuf)
2450	{
2451	if (cbBuf < 3*4)
2452	return 0;
2453
2454	ataH2BE_U16(pbBuf, 0x0); /* feature 0: list of profiles supported */
2455	pbBuf[2] = (0 << 2) \| (1 << 1) \| (1 \|\| 0); /* version 0, persistent, current */
2456	pbBuf[3] = 8; /* additional bytes for profiles */
2457	/* The MMC-3 spec says that DVD-ROM read capability should be reported
2458	* before CD-ROM read capability. */
2459	ataH2BE_U16(pbBuf + 4, 0x10); /* profile: read-only DVD */
2460	pbBuf[6] = (0 << 0); /* NOT current profile */
2461	ataH2BE_U16(pbBuf + 8, 0x08); /* profile: read only CD */
2462	pbBuf[10] = (1 << 0); /* current profile */
2463
2464	return 34; / Header + 2 profiles entries */
2465	}
2466
2467	static size_t atapiGetConfigurationFillFeatureCore(ATADevState s, uint8_t pbBuf, size_t cbBuf)
2468	{
2469	if (cbBuf < 12)
2470	return 0;
2471
2472	ataH2BE_U16(pbBuf, 0x1); /* feature 0001h: Core Feature */
2473	pbBuf[2] = (0x2 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2474	pbBuf[3] = 8; /* Additional length */
2475	ataH2BE_U16(pbBuf + 4, 0x00000002); /* Physical interface ATAPI. */
2476	pbBuf[8] = RT_BIT(0); /* DBE */
2477	/* Rest is reserved. */
2478
2479	return 12;
2480	}
2481
2482	static size_t atapiGetConfigurationFillFeatureMorphing(ATADevState s, uint8_t pbBuf, size_t cbBuf)
2483	{
2484	if (cbBuf < 8)
2485	return 0;
2486
2487	ataH2BE_U16(pbBuf, 0x2); /* feature 0002h: Morphing Feature */
2488	pbBuf[2] = (0x1 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2489	pbBuf[3] = 4; /* Additional length */
2490	pbBuf[4] = RT_BIT(1) \| 0x0; /* OCEvent \| !ASYNC */
2491	/* Rest is reserved. */
2492
2493	return 8;
2494	}
2495
2496	static size_t atapiGetConfigurationFillFeatureRemovableMedium(ATADevState s, uint8_t pbBuf, size_t cbBuf)
2497	{
2498	if (cbBuf < 8)
2499	return 0;
2500
2501	ataH2BE_U16(pbBuf, 0x3); /* feature 0003h: Removable Medium Feature */
2502	pbBuf[2] = (0x2 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2503	pbBuf[3] = 4; /* Additional length */
2504	/* Tray type loading \| Load \| Eject \| !Pvnt Jmpr \| !DBML \| Lock */
2505	pbBuf[4] = (0x2 << 5) \| RT_BIT(4) \| RT_BIT(3) \| (0x0 << 2) \| (0x0 << 1) \| RT_BIT(0);
2506	/* Rest is reserved. */
2507
2508	return 8;
2509	}
2510
2511	static size_t atapiGetConfigurationFillFeatureRandomReadable(ATADevState s, uint8_t pbBuf, size_t cbBuf)
2512	{
2513	if (cbBuf < 12)
2514	return 0;
2515
2516	ataH2BE_U16(pbBuf, 0x10); /* feature 0010h: Random Readable Feature */
2517	pbBuf[2] = (0x0 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2518	pbBuf[3] = 8; /* Additional length */
2519	ataH2BE_U32(pbBuf + 4, 2048); /* Logical block size. */
2520	ataH2BE_U16(pbBuf + 8, 0x10); /* Blocking (0x10 for DVD, CD is not defined). */
2521	pbBuf[10] = 0; /* PP not present */
2522	/* Rest is reserved. */
2523
2524	return 12;
2525	}
2526
2527	static size_t atapiGetConfigurationFillFeatureCDRead(ATADevState s, uint8_t pbBuf, size_t cbBuf)
2528	{
2529	if (cbBuf < 8)
2530	return 0;
2531
2532	ataH2BE_U16(pbBuf, 0x1e); /* feature 001Eh: CD Read Feature */
2533	pbBuf[2] = (0x2 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2534	pbBuf[3] = 0; /* Additional length */
2535	pbBuf[4] = (0x0 << 7) \| (0x0 << 1) \| 0x0; /* !DAP \| !C2-Flags \| !CD-Text. */
2536	/* Rest is reserved. */
2537
2538	return 8;
2539	}
2540
2541	static size_t atapiGetConfigurationFillFeaturePowerManagement(ATADevState s, uint8_t pbBuf, size_t cbBuf)
2542	{
2543	if (cbBuf < 4)
2544	return 0;
2545
2546	ataH2BE_U16(pbBuf, 0x100); /* feature 0100h: Power Management Feature */
2547	pbBuf[2] = (0x0 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2548	pbBuf[3] = 0; /* Additional length */
2549
2550	return 4;
2551	}
2552
2553	static size_t atapiGetConfigurationFillFeatureTimeout(ATADevState s, uint8_t pbBuf, size_t cbBuf)
2554	{
2555	if (cbBuf < 8)
2556	return 0;
2557
2558	ataH2BE_U16(pbBuf, 0x105); /* feature 0105h: Timeout Feature */
2559	pbBuf[2] = (0x0 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2560	pbBuf[3] = 4; /* Additional length */
2561	pbBuf[4] = 0x0; /* !Group3 */
2562
2563	return 8;
2564	}
2565
2566	static bool atapiGetConfigurationSS(ATADevState *s)
2567	{
2568	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2569	size_t cbBuf = s->cbIOBuffer;
2570	size_t cbCopied = 0;
2571	uint16_t u16Sfn = ataBE2H_U16(&s->aATAPICmd[2]);
2572
2573	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2574	Assert(s->cbElementaryTransfer <= 80);
2575	/* Accept valid request types only, and only starting feature 0. */
2576	if ((s->aATAPICmd[1] & 0x03) == 3 \|\| u16Sfn != 0)
2577	{
2578	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
2579	return false;
2580	}
2581	memset(pbBuf, '\0', cbBuf);
2582	/** @todo implement switching between CD-ROM and DVD-ROM profile (the only
2583	* way to differentiate them right now is based on the image size). */
2584	if (s->cTotalSectors)
2585	ataH2BE_U16(pbBuf + 6, 0x08); /* current profile: read-only CD */
2586	else
2587	ataH2BE_U16(pbBuf + 6, 0x00); /* current profile: none -> no media */
2588	cbBuf -= 8;
2589	pbBuf += 8;
2590
2591	cbCopied = atapiGetConfigurationFillFeatureListProfiles(s, pbBuf, cbBuf);
2592	cbBuf -= cbCopied;
2593	pbBuf += cbCopied;
2594
2595	cbCopied = atapiGetConfigurationFillFeatureCore(s, pbBuf, cbBuf);
2596	cbBuf -= cbCopied;
2597	pbBuf += cbCopied;
2598
2599	cbCopied = atapiGetConfigurationFillFeatureMorphing(s, pbBuf, cbBuf);
2600	cbBuf -= cbCopied;
2601	pbBuf += cbCopied;
2602
2603	cbCopied = atapiGetConfigurationFillFeatureRemovableMedium(s, pbBuf, cbBuf);
2604	cbBuf -= cbCopied;
2605	pbBuf += cbCopied;
2606
2607	cbCopied = atapiGetConfigurationFillFeatureRandomReadable(s, pbBuf, cbBuf);
2608	cbBuf -= cbCopied;
2609	pbBuf += cbCopied;
2610
2611	cbCopied = atapiGetConfigurationFillFeatureCDRead(s, pbBuf, cbBuf);
2612	cbBuf -= cbCopied;
2613	pbBuf += cbCopied;
2614
2615	cbCopied = atapiGetConfigurationFillFeaturePowerManagement(s, pbBuf, cbBuf);
2616	cbBuf -= cbCopied;
2617	pbBuf += cbCopied;
2618
2619	cbCopied = atapiGetConfigurationFillFeatureTimeout(s, pbBuf, cbBuf);
2620	cbBuf -= cbCopied;
2621	pbBuf += cbCopied;
2622
2623	/* Set data length now - the field is not included in the final length. */
2624	ataH2BE_U32(s->CTX_SUFF(pbIOBuffer), s->cbIOBuffer - cbBuf - 4);
2625
2626	/* Other profiles we might want to add in the future: 0x40 (BD-ROM) and 0x50 (HDDVD-ROM) */
2627	s->iSourceSink = ATAFN_SS_NULL;
2628	atapiCmdOK(s);
2629	return false;
2630	}
2631
2632
2633	static bool atapiGetEventStatusNotificationSS(ATADevState *s)
2634	{
2635	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2636
2637	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2638	Assert(s->cbElementaryTransfer <= 8);
2639
2640	if (!(s->aATAPICmd[1] & 1))
2641	{
2642	/* no asynchronous operation supported */
2643	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
2644	return false;
2645	}
2646
2647	uint32_t OldStatus, NewStatus;
2648	do
2649	{
2650	OldStatus = ASMAtomicReadU32(&s->MediaEventStatus);
2651	NewStatus = ATA_EVENT_STATUS_UNCHANGED;
2652	switch (OldStatus)
2653	{
2654	case ATA_EVENT_STATUS_MEDIA_NEW:
2655	/* mount */
2656	ataH2BE_U16(pbBuf + 0, 6);
2657	pbBuf[2] = 0x04; /* media */
2658	pbBuf[3] = 0x5e; /* supported = busy\|media\|external\|power\|operational */
2659	pbBuf[4] = 0x02; /* new medium */
2660	pbBuf[5] = 0x02; /* medium present / door closed */
2661	pbBuf[6] = 0x00;
2662	pbBuf[7] = 0x00;
2663	break;
2664
2665	case ATA_EVENT_STATUS_MEDIA_CHANGED:
2666	case ATA_EVENT_STATUS_MEDIA_REMOVED:
2667	/* umount */
2668	ataH2BE_U16(pbBuf + 0, 6);
2669	pbBuf[2] = 0x04; /* media */
2670	pbBuf[3] = 0x5e; /* supported = busy\|media\|external\|power\|operational */
2671	pbBuf[4] = 0x03; /* media removal */
2672	pbBuf[5] = 0x00; /* medium absent / door closed */
2673	pbBuf[6] = 0x00;
2674	pbBuf[7] = 0x00;
2675	if (OldStatus == ATA_EVENT_STATUS_MEDIA_CHANGED)
2676	NewStatus = ATA_EVENT_STATUS_MEDIA_NEW;
2677	break;
2678
2679	case ATA_EVENT_STATUS_MEDIA_EJECT_REQUESTED: /* currently unused */
2680	ataH2BE_U16(pbBuf + 0, 6);
2681	pbBuf[2] = 0x04; /* media */
2682	pbBuf[3] = 0x5e; /* supported = busy\|media\|external\|power\|operational */
2683	pbBuf[4] = 0x01; /* eject requested (eject button pressed) */
2684	pbBuf[5] = 0x02; /* medium present / door closed */
2685	pbBuf[6] = 0x00;
2686	pbBuf[7] = 0x00;
2687	break;
2688
2689	case ATA_EVENT_STATUS_UNCHANGED:
2690	default:
2691	ataH2BE_U16(pbBuf + 0, 6);
2692	pbBuf[2] = 0x01; /* operational change request / notification */
2693	pbBuf[3] = 0x5e; /* supported = busy\|media\|external\|power\|operational */
2694	pbBuf[4] = 0x00;
2695	pbBuf[5] = 0x00;
2696	pbBuf[6] = 0x00;
2697	pbBuf[7] = 0x00;
2698	break;
2699	}
2700	} while (!ASMAtomicCmpXchgU32(&s->MediaEventStatus, NewStatus, OldStatus));
2701
2702	s->iSourceSink = ATAFN_SS_NULL;
2703	atapiCmdOK(s);
2704	return false;
2705	}
2706
2707
2708	static bool atapiInquirySS(ATADevState *s)
2709	{
2710	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2711
2712	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2713	Assert(s->cbElementaryTransfer <= 36);
2714	pbBuf[0] = 0x05; /* CD-ROM */
2715	pbBuf[1] = 0x80; /* removable */
2716	#if 1/ndef VBOX/ /** @todo implement MESN + AENC. (async notification on removal and stuff.) */
2717	pbBuf[2] = 0x00; /* ISO */
2718	pbBuf[3] = 0x21; /* ATAPI-2 (XXX: put ATAPI-4 ?) */
2719	#else
2720	pbBuf[2] = 0x00; /* ISO */
2721	pbBuf[3] = 0x91; /* format 1, MESN=1, AENC=9 ??? */
2722	#endif
2723	pbBuf[4] = 31; /* additional length */
2724	pbBuf[5] = 0; /* reserved */
2725	pbBuf[6] = 0; /* reserved */
2726	pbBuf[7] = 0; /* reserved */
2727	ataSCSIPadStr(pbBuf + 8, s->szInquiryVendorId, 8);
2728	ataSCSIPadStr(pbBuf + 16, s->szInquiryProductId, 16);
2729	ataSCSIPadStr(pbBuf + 32, s->szInquiryRevision, 4);
2730	s->iSourceSink = ATAFN_SS_NULL;
2731	atapiCmdOK(s);
2732	return false;
2733	}
2734
2735
2736	static bool atapiModeSenseErrorRecoverySS(ATADevState *s)
2737	{
2738	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2739
2740	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2741	Assert(s->cbElementaryTransfer <= 16);
2742	ataH2BE_U16(&pbBuf[0], 16 + 6);
2743	pbBuf[2] = (uint8_t)s->MediaTrackType;
2744	pbBuf[3] = 0;
2745	pbBuf[4] = 0;
2746	pbBuf[5] = 0;
2747	pbBuf[6] = 0;
2748	pbBuf[7] = 0;
2749
2750	pbBuf[8] = 0x01;
2751	pbBuf[9] = 0x06;
2752	pbBuf[10] = 0x00; /* Maximum error recovery */
2753	pbBuf[11] = 0x05; /* 5 retries */
2754	pbBuf[12] = 0x00;
2755	pbBuf[13] = 0x00;
2756	pbBuf[14] = 0x00;
2757	pbBuf[15] = 0x00;
2758	s->iSourceSink = ATAFN_SS_NULL;
2759	atapiCmdOK(s);
2760	return false;
2761	}
2762
2763
2764	static bool atapiModeSenseCDStatusSS(ATADevState *s)
2765	{
2766	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2767
2768	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2769	Assert(s->cbElementaryTransfer <= 40);
2770	ataH2BE_U16(&pbBuf[0], 38);
2771	pbBuf[2] = (uint8_t)s->MediaTrackType;
2772	pbBuf[3] = 0;
2773	pbBuf[4] = 0;
2774	pbBuf[5] = 0;
2775	pbBuf[6] = 0;
2776	pbBuf[7] = 0;
2777
2778	pbBuf[8] = 0x2a;
2779	pbBuf[9] = 30; /* page length */
2780	pbBuf[10] = 0x08; /* DVD-ROM read support */
2781	pbBuf[11] = 0x00; /* no write support */
2782	/* The following claims we support audio play. This is obviously false,
2783	* but the Linux generic CDROM support makes many features depend on this
2784	* capability. If it's not set, this causes many things to be disabled. */
2785	pbBuf[12] = 0x71; /* multisession support, mode 2 form 1/2 support, audio play */
2786	pbBuf[13] = 0x00; /* no subchannel reads supported */
2787	pbBuf[14] = (1 << 0) \| (1 << 3) \| (1 << 5); /* lock supported, eject supported, tray type loading mechanism */
2788	if (s->pDrvMount->pfnIsLocked(s->pDrvMount))
2789	pbBuf[14] \|= 1 << 1; /* report lock state */
2790	pbBuf[15] = 0; /* no subchannel reads supported, no separate audio volume control, no changer etc. */
2791	ataH2BE_U16(&pbBuf[16], 5632); /* (obsolete) claim 32x speed support */
2792	ataH2BE_U16(&pbBuf[18], 2); /* number of audio volume levels */
2793	ataH2BE_U16(&pbBuf[20], s->cbIOBuffer / _1K); /* buffer size supported in Kbyte */
2794	ataH2BE_U16(&pbBuf[22], 5632); /* (obsolete) current read speed 32x */
2795	pbBuf[24] = 0; /* reserved */
2796	pbBuf[25] = 0; /* reserved for digital audio (see idx 15) */
2797	ataH2BE_U16(&pbBuf[26], 0); /* (obsolete) maximum write speed */
2798	ataH2BE_U16(&pbBuf[28], 0); /* (obsolete) current write speed */
2799	ataH2BE_U16(&pbBuf[30], 0); /* copy management revision supported 0=no CSS */
2800	pbBuf[32] = 0; /* reserved */
2801	pbBuf[33] = 0; /* reserved */
2802	pbBuf[34] = 0; /* reserved */
2803	pbBuf[35] = 1; /* rotation control CAV */
2804	ataH2BE_U16(&pbBuf[36], 0); /* current write speed */
2805	ataH2BE_U16(&pbBuf[38], 0); /* number of write speed performance descriptors */
2806	s->iSourceSink = ATAFN_SS_NULL;
2807	atapiCmdOK(s);
2808	return false;
2809	}
2810
2811
2812	static bool atapiRequestSenseSS(ATADevState *s)
2813	{
2814	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2815
2816	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2817	memset(pbBuf, '\0', s->cbElementaryTransfer);
2818	memcpy(pbBuf, s->abATAPISense, RT_MIN(s->cbElementaryTransfer, sizeof(s->abATAPISense)));
2819	s->iSourceSink = ATAFN_SS_NULL;
2820	atapiCmdOK(s);
2821	return false;
2822	}
2823
2824
2825	static bool atapiMechanismStatusSS(ATADevState *s)
2826	{
2827	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2828
2829	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2830	Assert(s->cbElementaryTransfer <= 8);
2831	ataH2BE_U16(pbBuf, 0);
2832	/* no current LBA */
2833	pbBuf[2] = 0;
2834	pbBuf[3] = 0;
2835	pbBuf[4] = 0;
2836	pbBuf[5] = 1;
2837	ataH2BE_U16(pbBuf + 6, 0);
2838	s->iSourceSink = ATAFN_SS_NULL;
2839	atapiCmdOK(s);
2840	return false;
2841	}
2842
2843
2844	static bool atapiReadTOCNormalSS(ATADevState *s)
2845	{
2846	uint8_t pbBuf = s->CTX_SUFF(pbIOBuffer), q, iStartTrack;
2847	bool fMSF;
2848	uint32_t cbSize;
2849
2850	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2851	fMSF = (s->aATAPICmd[1] >> 1) & 1;
2852	iStartTrack = s->aATAPICmd[6];
2853	if (iStartTrack > 1 && iStartTrack != 0xaa)
2854	{
2855	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
2856	return false;
2857	}
2858	q = pbBuf + 2;
2859	q++ = 1; / first session */
2860	q++ = 1; / last session */
2861	if (iStartTrack <= 1)
2862	{
2863	q++ = 0; / reserved */
2864	q++ = 0x14; / ADR, control */
2865	q++ = 1; / track number */
2866	q++ = 0; / reserved */
2867	if (fMSF)
2868	{
2869	q++ = 0; / reserved */
2870	ataLBA2MSF(q, 0);
2871	q += 3;
2872	}
2873	else
2874	{
2875	/* sector 0 */
2876	ataH2BE_U32(q, 0);
2877	q += 4;
2878	}
2879	}
2880	/* lead out track */
2881	q++ = 0; / reserved */
2882	q++ = 0x14; / ADR, control */
2883	q++ = 0xaa; / track number */
2884	q++ = 0; / reserved */
2885	if (fMSF)
2886	{
2887	q++ = 0; / reserved */
2888	ataLBA2MSF(q, s->cTotalSectors);
2889	q += 3;
2890	}
2891	else
2892	{
2893	ataH2BE_U32(q, s->cTotalSectors);
2894	q += 4;
2895	}
2896	cbSize = q - pbBuf;
2897	ataH2BE_U16(pbBuf, cbSize - 2);
2898	if (cbSize < s->cbTotalTransfer)
2899	s->cbTotalTransfer = cbSize;
2900	s->iSourceSink = ATAFN_SS_NULL;
2901	atapiCmdOK(s);
2902	return false;
2903	}
2904
2905
2906	static bool atapiReadTOCMultiSS(ATADevState *s)
2907	{
2908	uint8_t *pbBuf = s->CTX_SUFF(pbIOBuffer);
2909	bool fMSF;
2910
2911	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2912	Assert(s->cbElementaryTransfer <= 12);
2913	fMSF = (s->aATAPICmd[1] >> 1) & 1;
2914	/* multi session: only a single session defined */
2915	/** @todo double-check this stuff against what a real drive says for a CD-ROM (not a CD-R) with only a single data session. Maybe solve the problem with "cdrdao read-toc" not being able to figure out whether numbers are in BCD or hex. */
2916	memset(pbBuf, 0, 12);
2917	pbBuf[1] = 0x0a;
2918	pbBuf[2] = 0x01;
2919	pbBuf[3] = 0x01;
2920	pbBuf[5] = 0x14; /* ADR, control */
2921	pbBuf[6] = 1; /* first track in last complete session */
2922	if (fMSF)
2923	{
2924	pbBuf[8] = 0; /* reserved */
2925	ataLBA2MSF(&pbBuf[9], 0);
2926	}
2927	else
2928	{
2929	/* sector 0 */
2930	ataH2BE_U32(pbBuf + 8, 0);
2931	}
2932	s->iSourceSink = ATAFN_SS_NULL;
2933	atapiCmdOK(s);
2934	return false;
2935	}
2936
2937
2938	static bool atapiReadTOCRawSS(ATADevState *s)
2939	{
2940	uint8_t pbBuf = s->CTX_SUFF(pbIOBuffer), q, iStartTrack;
2941	bool fMSF;
2942	uint32_t cbSize;
2943
2944	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
2945	fMSF = (s->aATAPICmd[1] >> 1) & 1;
2946	iStartTrack = s->aATAPICmd[6];
2947
2948	q = pbBuf + 2;
2949	q++ = 1; / first session */
2950	q++ = 1; / last session */
2951
2952	q++ = 1; / session number */
2953	q++ = 0x14; / data track */
2954	q++ = 0; / track number */
2955	q++ = 0xa0; / first track in program area */
2956	q++ = 0; / min */
2957	q++ = 0; / sec */
2958	q++ = 0; / frame */
2959	*q++ = 0;
2960	q++ = 1; / first track */
2961	q++ = 0x00; / disk type CD-DA or CD data */
2962	*q++ = 0;
2963
2964	q++ = 1; / session number */
2965	q++ = 0x14; / data track */
2966	q++ = 0; / track number */
2967	q++ = 0xa1; / last track in program area */
2968	q++ = 0; / min */
2969	q++ = 0; / sec */
2970	q++ = 0; / frame */
2971	*q++ = 0;
2972	q++ = 1; / last track */
2973	*q++ = 0;
2974	*q++ = 0;
2975
2976	q++ = 1; / session number */
2977	q++ = 0x14; / data track */
2978	q++ = 0; / track number */
2979	q++ = 0xa2; / lead-out */
2980	q++ = 0; / min */
2981	q++ = 0; / sec */
2982	q++ = 0; / frame */
2983	if (fMSF)
2984	{
2985	q++ = 0; / reserved */
2986	ataLBA2MSF(q, s->cTotalSectors);
2987	q += 3;
2988	}
2989	else
2990	{
2991	ataH2BE_U32(q, s->cTotalSectors);
2992	q += 4;
2993	}
2994
2995	q++ = 1; / session number */
2996	q++ = 0x14; / ADR, control */
2997	q++ = 0; / track number */
2998	q++ = 1; / point */
2999	q++ = 0; / min */
3000	q++ = 0; / sec */
3001	q++ = 0; / frame */
3002	if (fMSF)
3003	{
3004	q++ = 0; / reserved */
3005	ataLBA2MSF(q, 0);
3006	q += 3;
3007	}
3008	else
3009	{
3010	/* sector 0 */
3011	ataH2BE_U32(q, 0);
3012	q += 4;
3013	}
3014
3015	cbSize = q - pbBuf;
3016	ataH2BE_U16(pbBuf, cbSize - 2);
3017	if (cbSize < s->cbTotalTransfer)
3018	s->cbTotalTransfer = cbSize;
3019	s->iSourceSink = ATAFN_SS_NULL;
3020	atapiCmdOK(s);
3021	return false;
3022	}
3023
3024
3025	static void atapiParseCmdVirtualATAPI(ATADevState *s)
3026	{
3027	const uint8_t *pbPacket;
3028	uint8_t *pbBuf;
3029	uint32_t cbMax;
3030
3031	pbPacket = s->aATAPICmd;
3032	pbBuf = s->CTX_SUFF(pbIOBuffer);
3033	switch (pbPacket[0])
3034	{
3035	case SCSI_TEST_UNIT_READY:
3036	if (s->cNotifiedMediaChange > 0)
3037	{
3038	if (s->cNotifiedMediaChange-- > 2)
3039	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3040	else
3041	atapiCmdErrorSimple(s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3042	}
3043	else if (s->pDrvMount->pfnIsMounted(s->pDrvMount))
3044	atapiCmdOK(s);
3045	else
3046	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3047	break;
3048	case SCSI_GET_EVENT_STATUS_NOTIFICATION:
3049	cbMax = ataBE2H_U16(pbPacket + 7);
3050	ataStartTransfer(s, RT_MIN(cbMax, 8), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_GET_EVENT_STATUS_NOTIFICATION, true);
3051	break;
3052	case SCSI_MODE_SENSE_10:
3053	{
3054	uint8_t uPageControl, uPageCode;
3055	cbMax = ataBE2H_U16(pbPacket + 7);
3056	uPageControl = pbPacket[2] >> 6;
3057	uPageCode = pbPacket[2] & 0x3f;
3058	switch (uPageControl)
3059	{
3060	case SCSI_PAGECONTROL_CURRENT:
3061	switch (uPageCode)
3062	{
3063	case SCSI_MODEPAGE_ERROR_RECOVERY:
3064	ataStartTransfer(s, RT_MIN(cbMax, 16), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_MODE_SENSE_ERROR_RECOVERY, true);
3065	break;
3066	case SCSI_MODEPAGE_CD_STATUS:
3067	ataStartTransfer(s, RT_MIN(cbMax, 40), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_MODE_SENSE_CD_STATUS, true);
3068	break;
3069	default:
3070	goto error_cmd;
3071	}
3072	break;
3073	case SCSI_PAGECONTROL_CHANGEABLE:
3074	goto error_cmd;
3075	case SCSI_PAGECONTROL_DEFAULT:
3076	goto error_cmd;
3077	default:
3078	case SCSI_PAGECONTROL_SAVED:
3079	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_SAVING_PARAMETERS_NOT_SUPPORTED);
3080	break;
3081	}
3082	}
3083	break;
3084	case SCSI_REQUEST_SENSE:
3085	cbMax = pbPacket[4];
3086	ataStartTransfer(s, RT_MIN(cbMax, 18), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_REQUEST_SENSE, true);
3087	break;
3088	case SCSI_PREVENT_ALLOW_MEDIUM_REMOVAL:
3089	if (s->pDrvMount->pfnIsMounted(s->pDrvMount))
3090	{
3091	if (pbPacket[4] & 1)
3092	s->pDrvMount->pfnLock(s->pDrvMount);
3093	else
3094	s->pDrvMount->pfnUnlock(s->pDrvMount);
3095	atapiCmdOK(s);
3096	}
3097	else
3098	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3099	break;
3100	case SCSI_READ_10:
3101	case SCSI_READ_12:
3102	{
3103	uint32_t cSectors, iATAPILBA;
3104
3105	if (s->cNotifiedMediaChange > 0)
3106	{
3107	s->cNotifiedMediaChange-- ;
3108	atapiCmdErrorSimple(s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3109	break;
3110	}
3111	else if (!s->pDrvMount->pfnIsMounted(s->pDrvMount))
3112	{
3113	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3114	break;
3115	}
3116	if (pbPacket[0] == SCSI_READ_10)
3117	cSectors = ataBE2H_U16(pbPacket + 7);
3118	else
3119	cSectors = ataBE2H_U32(pbPacket + 6);
3120	iATAPILBA = ataBE2H_U32(pbPacket + 2);
3121	if (cSectors == 0)
3122	{
3123	atapiCmdOK(s);
3124	break;
3125	}
3126	if ((uint64_t)iATAPILBA + cSectors > s->cTotalSectors)
3127	{
3128	/* Rate limited logging, one log line per second. For
3129	* guests that insist on reading from places outside the
3130	* valid area this often generates too many release log
3131	* entries otherwise. */
3132	static uint64_t uLastLogTS = 0;
3133	if (RTTimeMilliTS() >= uLastLogTS + 1000)
3134	{
3135	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM block number %Ld invalid (READ)\n", s->iLUN, (uint64_t)iATAPILBA + cSectors));
3136	uLastLogTS = RTTimeMilliTS();
3137	}
3138	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_LOGICAL_BLOCK_OOR);
3139	break;
3140	}
3141	atapiReadSectors(s, iATAPILBA, cSectors, 2048);
3142	}
3143	break;
3144	case SCSI_READ_CD:
3145	{
3146	uint32_t cSectors, iATAPILBA;
3147
3148	if (s->cNotifiedMediaChange > 0)
3149	{
3150	s->cNotifiedMediaChange-- ;
3151	atapiCmdErrorSimple(s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3152	break;
3153	}
3154	else if (!s->pDrvMount->pfnIsMounted(s->pDrvMount))
3155	{
3156	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3157	break;
3158	}
3159	cSectors = (pbPacket[6] << 16) \| (pbPacket[7] << 8) \| pbPacket[8];
3160	iATAPILBA = ataBE2H_U32(pbPacket + 2);
3161	if (cSectors == 0)
3162	{
3163	atapiCmdOK(s);
3164	break;
3165	}
3166	if ((uint64_t)iATAPILBA + cSectors > s->cTotalSectors)
3167	{
3168	/* Rate limited logging, one log line per second. For
3169	* guests that insist on reading from places outside the
3170	* valid area this often generates too many release log
3171	* entries otherwise. */
3172	static uint64_t uLastLogTS = 0;
3173	if (RTTimeMilliTS() >= uLastLogTS + 1000)
3174	{
3175	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM block number %Ld invalid (READ CD)\n", s->iLUN, (uint64_t)iATAPILBA + cSectors));
3176	uLastLogTS = RTTimeMilliTS();
3177	}
3178	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_LOGICAL_BLOCK_OOR);
3179	break;
3180	}
3181	switch (pbPacket[9] & 0xf8)
3182	{
3183	case 0x00:
3184	/* nothing */
3185	atapiCmdOK(s);
3186	break;
3187	case 0x10:
3188	/* normal read */
3189	atapiReadSectors(s, iATAPILBA, cSectors, 2048);
3190	break;
3191	case 0xf8:
3192	/* read all data */
3193	atapiReadSectors(s, iATAPILBA, cSectors, 2352);
3194	break;
3195	default:
3196	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM sector format not supported (%#x)\n", s->iLUN, pbPacket[9] & 0xf8));
3197	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
3198	break;
3199	}
3200	}
3201	break;
3202	case SCSI_SEEK_10:
3203	{
3204	uint32_t iATAPILBA;
3205	if (s->cNotifiedMediaChange > 0)
3206	{
3207	s->cNotifiedMediaChange-- ;
3208	atapiCmdErrorSimple(s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3209	break;
3210	}
3211	else if (!s->pDrvMount->pfnIsMounted(s->pDrvMount))
3212	{
3213	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3214	break;
3215	}
3216	iATAPILBA = ataBE2H_U32(pbPacket + 2);
3217	if (iATAPILBA > s->cTotalSectors)
3218	{
3219	/* Rate limited logging, one log line per second. For
3220	* guests that insist on seeking to places outside the
3221	* valid area this often generates too many release log
3222	* entries otherwise. */
3223	static uint64_t uLastLogTS = 0;
3224	if (RTTimeMilliTS() >= uLastLogTS + 1000)
3225	{
3226	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM block number %Ld invalid (SEEK)\n", s->iLUN, (uint64_t)iATAPILBA));
3227	uLastLogTS = RTTimeMilliTS();
3228	}
3229	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_LOGICAL_BLOCK_OOR);
3230	break;
3231	}
3232	atapiCmdOK(s);
3233	ataSetStatus(s, ATA_STAT_SEEK); /* Linux expects this. */
3234	}
3235	break;
3236	case SCSI_START_STOP_UNIT:
3237	{
3238	int rc = VINF_SUCCESS;
3239	switch (pbPacket[4] & 3)
3240	{
3241	case 0: /* 00 - Stop motor */
3242	case 1: /* 01 - Start motor */
3243	break;
3244	case 2: /* 10 - Eject media */
3245	{
3246	/* This must be done from EMT. */
3247	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
3248	PPDMDEVINS pDevIns = ATADEVSTATE_2_DEVINS(s);
3249	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
3250
3251	PDMCritSectLeave(&pCtl->lock);
3252	rc = VMR3ReqPriorityCallWait(PDMDevHlpGetVM(pDevIns), VMCPUID_ANY,
3253	(PFNRT)s->pDrvMount->pfnUnmount, 3,
3254	s->pDrvMount, false /=fForce/, true /=fEject/);
3255	Assert(RT_SUCCESS(rc) \|\| (rc == VERR_PDM_MEDIA_LOCKED) \|\| (rc = VERR_PDM_MEDIA_NOT_MOUNTED));
3256	if (RT_SUCCESS(rc) && pThis->pMediaNotify)
3257	{
3258	rc = VMR3ReqCallNoWait(PDMDevHlpGetVM(pDevIns), VMCPUID_ANY,
3259	(PFNRT)pThis->pMediaNotify->pfnEjected, 2,
3260	pThis->pMediaNotify, s->iLUN);
3261	AssertRC(rc);
3262	}
3263	{
3264	STAM_PROFILE_START(&pCtl->StatLockWait, a);
3265	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
3266	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
3267	}
3268	break;
3269	}
3270	case 3: /* 11 - Load media */
3271	/** @todo rc = s->pDrvMount->pfnLoadMedia(s->pDrvMount) */
3272	break;
3273	}
3274	if (RT_SUCCESS(rc))
3275	atapiCmdOK(s);
3276	else
3277	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIA_LOAD_OR_EJECT_FAILED);
3278	}
3279	break;
3280	case SCSI_MECHANISM_STATUS:
3281	{
3282	cbMax = ataBE2H_U16(pbPacket + 8);
3283	ataStartTransfer(s, RT_MIN(cbMax, 8), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_MECHANISM_STATUS, true);
3284	}
3285	break;
3286	case SCSI_READ_TOC_PMA_ATIP:
3287	{
3288	uint8_t format;
3289
3290	if (s->cNotifiedMediaChange > 0)
3291	{
3292	s->cNotifiedMediaChange-- ;
3293	atapiCmdErrorSimple(s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3294	break;
3295	}
3296	else if (!s->pDrvMount->pfnIsMounted(s->pDrvMount))
3297	{
3298	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3299	break;
3300	}
3301	cbMax = ataBE2H_U16(pbPacket + 7);
3302	/* SCSI MMC-3 spec says format is at offset 2 (lower 4 bits),
3303	* but Linux kernel uses offset 9 (topmost 2 bits). Hope that
3304	* the other field is clear... */
3305	format = (pbPacket[2] & 0xf) \| (pbPacket[9] >> 6);
3306	switch (format)
3307	{
3308	case 0:
3309	ataStartTransfer(s, cbMax, PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_TOC_NORMAL, true);
3310	break;
3311	case 1:
3312	ataStartTransfer(s, RT_MIN(cbMax, 12), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_TOC_MULTI, true);
3313	break;
3314	case 2:
3315	ataStartTransfer(s, cbMax, PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_TOC_RAW, true);
3316	break;
3317	default:
3318	error_cmd:
3319	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
3320	break;
3321	}
3322	}
3323	break;
3324	case SCSI_READ_CAPACITY:
3325	if (s->cNotifiedMediaChange > 0)
3326	{
3327	s->cNotifiedMediaChange-- ;
3328	atapiCmdErrorSimple(s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3329	break;
3330	}
3331	else if (!s->pDrvMount->pfnIsMounted(s->pDrvMount))
3332	{
3333	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3334	break;
3335	}
3336	ataStartTransfer(s, 8, PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_CAPACITY, true);
3337	break;
3338	case SCSI_READ_DISC_INFORMATION:
3339	if (s->cNotifiedMediaChange > 0)
3340	{
3341	s->cNotifiedMediaChange-- ;
3342	atapiCmdErrorSimple(s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3343	break;
3344	}
3345	else if (!s->pDrvMount->pfnIsMounted(s->pDrvMount))
3346	{
3347	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3348	break;
3349	}
3350	cbMax = ataBE2H_U16(pbPacket + 7);
3351	ataStartTransfer(s, RT_MIN(cbMax, 34), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_DISC_INFORMATION, true);
3352	break;
3353	case SCSI_READ_TRACK_INFORMATION:
3354	if (s->cNotifiedMediaChange > 0)
3355	{
3356	s->cNotifiedMediaChange-- ;
3357	atapiCmdErrorSimple(s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3358	break;
3359	}
3360	else if (!s->pDrvMount->pfnIsMounted(s->pDrvMount))
3361	{
3362	atapiCmdErrorSimple(s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3363	break;
3364	}
3365	cbMax = ataBE2H_U16(pbPacket + 7);
3366	ataStartTransfer(s, RT_MIN(cbMax, 36), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_TRACK_INFORMATION, true);
3367	break;
3368	case SCSI_GET_CONFIGURATION:
3369	/* No media change stuff here, it can confuse Linux guests. */
3370	cbMax = ataBE2H_U16(pbPacket + 7);
3371	ataStartTransfer(s, RT_MIN(cbMax, 80), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_GET_CONFIGURATION, true);
3372	break;
3373	case SCSI_INQUIRY:
3374	cbMax = ataBE2H_U16(pbPacket + 3);
3375	ataStartTransfer(s, RT_MIN(cbMax, 36), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_INQUIRY, true);
3376	break;
3377	case SCSI_READ_DVD_STRUCTURE:
3378	{
3379	cbMax = ataBE2H_U16(pbPacket + 8);
3380	ataStartTransfer(s, RT_MIN(cbMax, 4), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_DVD_STRUCTURE, true);
3381	break;
3382	}
3383	default:
3384	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_ILLEGAL_OPCODE);
3385	break;
3386	}
3387	}
3388
3389
3390	/*
3391	* Parse ATAPI commands, passing them directly to the CD/DVD drive.
3392	*/
3393	static void atapiParseCmdPassthrough(ATADevState *s)
3394	{
3395	const uint8_t *pbPacket;
3396	uint8_t *pbBuf;
3397	uint32_t cSectors, iATAPILBA;
3398	uint32_t cbTransfer = 0;
3399	PDMBLOCKTXDIR uTxDir = PDMBLOCKTXDIR_NONE;
3400
3401	pbPacket = s->aATAPICmd;
3402	pbBuf = s->CTX_SUFF(pbIOBuffer);
3403	switch (pbPacket[0])
3404	{
3405	case SCSI_BLANK:
3406	goto sendcmd;
3407	case SCSI_CLOSE_TRACK_SESSION:
3408	goto sendcmd;
3409	case SCSI_ERASE_10:
3410	iATAPILBA = ataBE2H_U32(pbPacket + 2);
3411	cbTransfer = ataBE2H_U16(pbPacket + 7);
3412	Log2(("ATAPI PT: lba %d\n", iATAPILBA));
3413	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3414	goto sendcmd;
3415	case SCSI_FORMAT_UNIT:
3416	cbTransfer = s->uATARegLCyl \| (s->uATARegHCyl << 8); /* use ATAPI transfer length */
3417	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3418	goto sendcmd;
3419	case SCSI_GET_CONFIGURATION:
3420	cbTransfer = ataBE2H_U16(pbPacket + 7);
3421	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3422	goto sendcmd;
3423	case SCSI_GET_EVENT_STATUS_NOTIFICATION:
3424	cbTransfer = ataBE2H_U16(pbPacket + 7);
3425	if (ASMAtomicReadU32(&s->MediaEventStatus) != ATA_EVENT_STATUS_UNCHANGED)
3426	{
3427	ataStartTransfer(s, RT_MIN(cbTransfer, 8), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_GET_EVENT_STATUS_NOTIFICATION, true);
3428	break;
3429	}
3430	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3431	goto sendcmd;
3432	case SCSI_GET_PERFORMANCE:
3433	cbTransfer = s->uATARegLCyl \| (s->uATARegHCyl << 8); /* use ATAPI transfer length */
3434	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3435	goto sendcmd;
3436	case SCSI_INQUIRY:
3437	cbTransfer = ataBE2H_U16(pbPacket + 3);
3438	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3439	goto sendcmd;
3440	case SCSI_LOAD_UNLOAD_MEDIUM:
3441	goto sendcmd;
3442	case SCSI_MECHANISM_STATUS:
3443	cbTransfer = ataBE2H_U16(pbPacket + 8);
3444	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3445	goto sendcmd;
3446	case SCSI_MODE_SELECT_10:
3447	cbTransfer = ataBE2H_U16(pbPacket + 7);
3448	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3449	goto sendcmd;
3450	case SCSI_MODE_SENSE_10:
3451	cbTransfer = ataBE2H_U16(pbPacket + 7);
3452	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3453	goto sendcmd;
3454	case SCSI_PAUSE_RESUME:
3455	goto sendcmd;
3456	case SCSI_PLAY_AUDIO_10:
3457	goto sendcmd;
3458	case SCSI_PLAY_AUDIO_12:
3459	goto sendcmd;
3460	case SCSI_PLAY_AUDIO_MSF:
3461	goto sendcmd;
3462	case SCSI_PREVENT_ALLOW_MEDIUM_REMOVAL:
3463	/** @todo do not forget to unlock when a VM is shut down */
3464	goto sendcmd;
3465	case SCSI_READ_10:
3466	iATAPILBA = ataBE2H_U32(pbPacket + 2);
3467	cSectors = ataBE2H_U16(pbPacket + 7);
3468	Log2(("ATAPI PT: lba %d sectors %d\n", iATAPILBA, cSectors));
3469	s->cbATAPISector = 2048;
3470	cbTransfer = cSectors * s->cbATAPISector;
3471	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3472	goto sendcmd;
3473	case SCSI_READ_12:
3474	iATAPILBA = ataBE2H_U32(pbPacket + 2);
3475	cSectors = ataBE2H_U32(pbPacket + 6);
3476	Log2(("ATAPI PT: lba %d sectors %d\n", iATAPILBA, cSectors));
3477	s->cbATAPISector = 2048;
3478	cbTransfer = cSectors * s->cbATAPISector;
3479	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3480	goto sendcmd;
3481	case SCSI_READ_BUFFER:
3482	cbTransfer = ataBE2H_U24(pbPacket + 6);
3483	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3484	goto sendcmd;
3485	case SCSI_READ_BUFFER_CAPACITY:
3486	cbTransfer = ataBE2H_U16(pbPacket + 7);
3487	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3488	goto sendcmd;
3489	case SCSI_READ_CAPACITY:
3490	cbTransfer = 8;
3491	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3492	goto sendcmd;
3493	case SCSI_READ_CD:
3494	case SCSI_READ_CD_MSF:
3495	{
3496	/* Get sector size based on the expected sector type field. */
3497	switch ((pbPacket[1] >> 2) & 0x7)
3498	{
3499	case 0x0: /* All types. */
3500	{
3501	uint32_t iLbaStart;
3502
3503	if (pbPacket[0] == SCSI_READ_CD)
3504	iLbaStart = ataBE2H_U32(&pbPacket[2]);
3505	else
3506	iLbaStart = ataMSF2LBA(&pbPacket[3]);
3507
3508	if (s->pTrackList)
3509	s->cbATAPISector = ATAPIPassthroughTrackListGetSectorSizeFromLba(s->pTrackList, iLbaStart);
3510	else
3511	s->cbATAPISector = 2048; /* Might be incorrect if we couldn't determine the type. */
3512	break;
3513	}
3514	case 0x1: /* CD-DA */
3515	s->cbATAPISector = 2352;
3516	break;
3517	case 0x2: /* Mode 1 */
3518	s->cbATAPISector = 2048;
3519	break;
3520	case 0x3: /* Mode 2 formless */
3521	s->cbATAPISector = 2336;
3522	break;
3523	case 0x4: /* Mode 2 form 1 */
3524	s->cbATAPISector = 2048;
3525	break;
3526	case 0x5: /* Mode 2 form 2 */
3527	s->cbATAPISector = 2324;
3528	break;
3529	default: /* Reserved */
3530	AssertMsgFailed(("Unknown sector type\n"));
3531	s->cbATAPISector = 0; /** @todo we should probably fail the command here already. */
3532	}
3533
3534	if (pbPacket[0] == SCSI_READ_CD)
3535	cbTransfer = ataBE2H_U24(pbPacket + 6) * s->cbATAPISector;
3536	else /* SCSI_READ_MSF */
3537	{
3538	cSectors = ataMSF2LBA(pbPacket + 6) - ataMSF2LBA(pbPacket + 3);
3539	if (cSectors > 32)
3540	cSectors = 32; /* Limit transfer size to 64~74K. Safety first. In any case this can only harm software doing CDDA extraction. */
3541	cbTransfer = cSectors * s->cbATAPISector;
3542	}
3543	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3544	goto sendcmd;
3545	}
3546	case SCSI_READ_DISC_INFORMATION:
3547	cbTransfer = ataBE2H_U16(pbPacket + 7);
3548	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3549	goto sendcmd;
3550	case SCSI_READ_DVD_STRUCTURE:
3551	cbTransfer = ataBE2H_U16(pbPacket + 8);
3552	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3553	goto sendcmd;
3554	case SCSI_READ_FORMAT_CAPACITIES:
3555	cbTransfer = ataBE2H_U16(pbPacket + 7);
3556	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3557	goto sendcmd;
3558	case SCSI_READ_SUBCHANNEL:
3559	cbTransfer = ataBE2H_U16(pbPacket + 7);
3560	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3561	goto sendcmd;
3562	case SCSI_READ_TOC_PMA_ATIP:
3563	cbTransfer = ataBE2H_U16(pbPacket + 7);
3564	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3565	goto sendcmd;
3566	case SCSI_READ_TRACK_INFORMATION:
3567	cbTransfer = ataBE2H_U16(pbPacket + 7);
3568	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3569	goto sendcmd;
3570	case SCSI_REPAIR_TRACK:
3571	goto sendcmd;
3572	case SCSI_REPORT_KEY:
3573	cbTransfer = ataBE2H_U16(pbPacket + 8);
3574	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3575	goto sendcmd;
3576	case SCSI_REQUEST_SENSE:
3577	cbTransfer = pbPacket[4];
3578	if ((s->abATAPISense[2] & 0x0f) != SCSI_SENSE_NONE)
3579	{
3580	ataStartTransfer(s, RT_MIN(cbTransfer, 18), PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_REQUEST_SENSE, true);
3581	break;
3582	}
3583	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3584	goto sendcmd;
3585	case SCSI_RESERVE_TRACK:
3586	goto sendcmd;
3587	case SCSI_SCAN:
3588	goto sendcmd;
3589	case SCSI_SEEK_10:
3590	goto sendcmd;
3591	case SCSI_SEND_CUE_SHEET:
3592	cbTransfer = ataBE2H_U24(pbPacket + 6);
3593	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3594	goto sendcmd;
3595	case SCSI_SEND_DVD_STRUCTURE:
3596	cbTransfer = ataBE2H_U16(pbPacket + 8);
3597	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3598	goto sendcmd;
3599	case SCSI_SEND_EVENT:
3600	cbTransfer = ataBE2H_U16(pbPacket + 8);
3601	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3602	goto sendcmd;
3603	case SCSI_SEND_KEY:
3604	cbTransfer = ataBE2H_U16(pbPacket + 8);
3605	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3606	goto sendcmd;
3607	case SCSI_SEND_OPC_INFORMATION:
3608	cbTransfer = ataBE2H_U16(pbPacket + 7);
3609	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3610	goto sendcmd;
3611	case SCSI_SET_CD_SPEED:
3612	goto sendcmd;
3613	case SCSI_SET_READ_AHEAD:
3614	goto sendcmd;
3615	case SCSI_SET_STREAMING:
3616	cbTransfer = ataBE2H_U16(pbPacket + 9);
3617	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3618	goto sendcmd;
3619	case SCSI_START_STOP_UNIT:
3620	goto sendcmd;
3621	case SCSI_STOP_PLAY_SCAN:
3622	goto sendcmd;
3623	case SCSI_SYNCHRONIZE_CACHE:
3624	goto sendcmd;
3625	case SCSI_TEST_UNIT_READY:
3626	goto sendcmd;
3627	case SCSI_VERIFY_10:
3628	goto sendcmd;
3629	case SCSI_WRITE_10:
3630	case SCSI_WRITE_AND_VERIFY_10:
3631	iATAPILBA = ataBE2H_U32(pbPacket + 2);
3632	cSectors = ataBE2H_U16(pbPacket + 7);
3633	if (s->pTrackList)
3634	s->cbATAPISector = ATAPIPassthroughTrackListGetSectorSizeFromLba(s->pTrackList, iATAPILBA);
3635	else
3636	s->cbATAPISector = 2048;
3637	Log2(("ATAPI PT: lba %d sectors %d sector size %d\n", iATAPILBA, cSectors, s->cbATAPISector));
3638	cbTransfer = cSectors * s->cbATAPISector;
3639	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3640	goto sendcmd;
3641	case SCSI_WRITE_12:
3642	iATAPILBA = ataBE2H_U32(pbPacket + 2);
3643	cSectors = ataBE2H_U32(pbPacket + 6);
3644	if (s->pTrackList)
3645	s->cbATAPISector = ATAPIPassthroughTrackListGetSectorSizeFromLba(s->pTrackList, iATAPILBA);
3646	else
3647	s->cbATAPISector = 2048;
3648	Log2(("ATAPI PT: lba %d sectors %d sector size %d\n", iATAPILBA, cSectors, s->cbATAPISector));
3649	cbTransfer = cSectors * s->cbATAPISector;
3650	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3651	goto sendcmd;
3652	case SCSI_WRITE_BUFFER:
3653	switch (pbPacket[1] & 0x1f)
3654	{
3655	case 0x04: /* download microcode */
3656	case 0x05: /* download microcode and save */
3657	case 0x06: /* download microcode with offsets */
3658	case 0x07: /* download microcode with offsets and save */
3659	case 0x0e: /* download microcode with offsets and defer activation */
3660	case 0x0f: /* activate deferred microcode */
3661	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM passthrough command attempted to update firmware, blocked\n", s->iLUN));
3662	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
3663	break;
3664	default:
3665	cbTransfer = ataBE2H_U16(pbPacket + 6);
3666	uTxDir = PDMBLOCKTXDIR_TO_DEVICE;
3667	goto sendcmd;
3668	}
3669	break;
3670	case SCSI_REPORT_LUNS: /* Not part of MMC-3, but used by Windows. */
3671	cbTransfer = ataBE2H_U32(pbPacket + 6);
3672	uTxDir = PDMBLOCKTXDIR_FROM_DEVICE;
3673	goto sendcmd;
3674	case SCSI_REZERO_UNIT:
3675	/* Obsolete command used by cdrecord. What else would one expect?
3676	* This command is not sent to the drive, it is handled internally,
3677	* as the Linux kernel doesn't like it (message "scsi: unknown
3678	* opcode 0x01" in syslog) and replies with a sense code of 0,
3679	* which sends cdrecord to an endless loop. */
3680	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_ILLEGAL_OPCODE);
3681	break;
3682	default:
3683	LogRel(("PIIX3 ATA: LUN#%d: passthrough unimplemented for command %#x\n", s->iLUN, pbPacket[0]));
3684	atapiCmdErrorSimple(s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_ILLEGAL_OPCODE);
3685	break;
3686	sendcmd:
3687	/*
3688	* Send a command to the drive, passing data in/out as required.
3689	* Commands which exceed the I/O buffer size are splitted below
3690	* or aborted if splitting is not implemented.
3691	*/
3692	Log2(("ATAPI PT: max size %d\n", cbTransfer));
3693	if (cbTransfer == 0)
3694	uTxDir = PDMBLOCKTXDIR_NONE;
3695	ataStartTransfer(s, cbTransfer, uTxDir, ATAFN_BT_ATAPI_PASSTHROUGH_CMD, ATAFN_SS_ATAPI_PASSTHROUGH, true);
3696	}
3697	}
3698
3699
3700	static void atapiParseCmd(ATADevState *s)
3701	{
3702	const uint8_t *pbPacket;
3703
3704	pbPacket = s->aATAPICmd;
3705	#ifdef DEBUG
3706	Log(("%s: LUN#%d DMA=%d CMD=%#04x \"%s\"\n", __FUNCTION__, s->iLUN, s->fDMA, pbPacket[0], SCSICmdText(pbPacket[0])));
3707	#else /* !DEBUG */
3708	Log(("%s: LUN#%d DMA=%d CMD=%#04x\n", __FUNCTION__, s->iLUN, s->fDMA, pbPacket[0]));
3709	#endif /* !DEBUG */
3710	Log2(("%s: limit=%#x packet: %.*Rhxs\n", __FUNCTION__, s->uATARegLCyl \| (s->uATARegHCyl << 8), ATAPI_PACKET_SIZE, pbPacket));
3711
3712	if (s->fATAPIPassthrough)
3713	atapiParseCmdPassthrough(s);
3714	else
3715	atapiParseCmdVirtualATAPI(s);
3716	}
3717
3718
3719	static bool ataPacketSS(ATADevState *s)
3720	{
3721	s->fDMA = !!(s->uATARegFeature & 1);
3722	memcpy(s->aATAPICmd, s->CTX_SUFF(pbIOBuffer), ATAPI_PACKET_SIZE);
3723	s->uTxDir = PDMBLOCKTXDIR_NONE;
3724	s->cbTotalTransfer = 0;
3725	s->cbElementaryTransfer = 0;
3726	atapiParseCmd(s);
3727	return false;
3728	}
3729
3730
3731	/**
3732	* SCSI_GET_EVENT_STATUS_NOTIFICATION should return "medium removed" event
3733	* from now on, regardless if there was a medium inserted or not.
3734	*/
3735	static void ataMediumRemoved(ATADevState *s)
3736	{
3737	ASMAtomicWriteU32(&s->MediaEventStatus, ATA_EVENT_STATUS_MEDIA_REMOVED);
3738	}
3739
3740
3741	/**
3742	* SCSI_GET_EVENT_STATUS_NOTIFICATION should return "medium inserted". If
3743	* there was already a medium inserted, don't forget to send the "medium
3744	* removed" event first.
3745	*/
3746	static void ataMediumInserted(ATADevState *s)
3747	{
3748	uint32_t OldStatus, NewStatus;
3749	do
3750	{
3751	OldStatus = ASMAtomicReadU32(&s->MediaEventStatus);
3752	switch (OldStatus)
3753	{
3754	case ATA_EVENT_STATUS_MEDIA_CHANGED:
3755	case ATA_EVENT_STATUS_MEDIA_REMOVED:
3756	/* no change, we will send "medium removed" + "medium inserted" */
3757	NewStatus = ATA_EVENT_STATUS_MEDIA_CHANGED;
3758	break;
3759	default:
3760	NewStatus = ATA_EVENT_STATUS_MEDIA_NEW;
3761	break;
3762	}
3763	} while (!ASMAtomicCmpXchgU32(&s->MediaEventStatus, NewStatus, OldStatus));
3764	}
3765
3766	/**
3767	* Called when a media is mounted.
3768	*
3769	* @param pInterface Pointer to the interface structure containing the called function pointer.
3770	*/
3771	static DECLCALLBACK(void) ataMountNotify(PPDMIMOUNTNOTIFY pInterface)
3772	{
3773	ATADevState *pIf = PDMIMOUNTNOTIFY_2_ATASTATE(pInterface);
3774	Log(("%s: changing LUN#%d\n", __FUNCTION__, pIf->iLUN));
3775
3776	/* Ignore the call if we're called while being attached. */
3777	if (!pIf->pDrvBlock)
3778	return;
3779
3780	if (pIf->fATAPI)
3781	pIf->cTotalSectors = pIf->pDrvBlock->pfnGetSize(pIf->pDrvBlock) / 2048;
3782	else
3783	pIf->cTotalSectors = pIf->pDrvBlock->pfnGetSize(pIf->pDrvBlock) / 512;
3784
3785	LogRel(("PIIX3 ATA: LUN#%d: CD/DVD, total number of sectors %Ld, passthrough unchanged\n", pIf->iLUN, pIf->cTotalSectors));
3786
3787	/* Report media changed in TEST UNIT and other (probably incorrect) places. */
3788	if (pIf->cNotifiedMediaChange < 2)
3789	pIf->cNotifiedMediaChange = 1;
3790	ataMediumInserted(pIf);
3791	ataMediumTypeSet(pIf, ATA_MEDIA_TYPE_UNKNOWN);
3792	}
3793
3794	/**
3795	* Called when a media is unmounted
3796	* @param pInterface Pointer to the interface structure containing the called function pointer.
3797	*/
3798	static DECLCALLBACK(void) ataUnmountNotify(PPDMIMOUNTNOTIFY pInterface)
3799	{
3800	ATADevState *pIf = PDMIMOUNTNOTIFY_2_ATASTATE(pInterface);
3801	Log(("%s:\n", __FUNCTION__));
3802	pIf->cTotalSectors = 0;
3803
3804	/*
3805	* Whatever I do, XP will not use the GET MEDIA STATUS nor the EVENT stuff.
3806	* However, it will respond to TEST UNIT with a 0x6 0x28 (media changed) sense code.
3807	* So, we'll give it 4 TEST UNIT command to catch up, two which the media is not
3808	* present and 2 in which it is changed.
3809	*/
3810	pIf->cNotifiedMediaChange = 1;
3811	ataMediumRemoved(pIf);
3812	ataMediumTypeSet(pIf, ATA_MEDIA_NO_DISC);
3813	}
3814
3815	static void ataPacketBT(ATADevState *s)
3816	{
3817	s->cbElementaryTransfer = s->cbTotalTransfer;
3818	s->uATARegNSector = (s->uATARegNSector & ~7) \| ATAPI_INT_REASON_CD;
3819	Log2(("%s: interrupt reason %#04x\n", __FUNCTION__, s->uATARegNSector));
3820	ataSetStatusValue(s, ATA_STAT_READY);
3821	}
3822
3823
3824	static void ataResetDevice(ATADevState *s)
3825	{
3826	s->cMultSectors = ATA_MAX_MULT_SECTORS;
3827	s->cNotifiedMediaChange = 0;
3828	ASMAtomicWriteU32(&s->MediaEventStatus, ATA_EVENT_STATUS_UNCHANGED);
3829	ASMAtomicWriteU32(&s->MediaTrackType, ATA_MEDIA_TYPE_UNKNOWN);
3830	ataUnsetIRQ(s);
3831
3832	s->uATARegSelect = 0x20;
3833	ataSetStatusValue(s, ATA_STAT_READY);
3834	ataSetSignature(s);
3835	s->cbTotalTransfer = 0;
3836	s->cbElementaryTransfer = 0;
3837	s->iIOBufferPIODataStart = 0;
3838	s->iIOBufferPIODataEnd = 0;
3839	s->iBeginTransfer = ATAFN_BT_NULL;
3840	s->iSourceSink = ATAFN_SS_NULL;
3841	s->fDMA = false;
3842	s->fATAPITransfer = false;
3843	s->uATATransferMode = ATA_MODE_UDMA \| 2; /* PIIX3 supports only up to UDMA2 */
3844
3845	s->uATARegFeature = 0;
3846	}
3847
3848
3849	static bool ataExecuteDeviceDiagnosticSS(ATADevState *s)
3850	{
3851	ataSetSignature(s);
3852	if (s->fATAPI)
3853	ataSetStatusValue(s, 0); /* NOTE: READY is _not_ set */
3854	else
3855	ataSetStatusValue(s, ATA_STAT_READY \| ATA_STAT_SEEK);
3856	s->uATARegError = 0x01;
3857	return false;
3858	}
3859
3860
3861	static int ataTrimSectors(ATADevState *s, uint64_t u64Sector, uint32_t cSectors,
3862	bool *pfRedo)
3863	{
3864	RTRANGE TrimRange;
3865	PATACONTROLLER pCtl = ATADEVSTATE_2_CONTROLLER(s);
3866	int rc;
3867
3868	PDMCritSectLeave(&pCtl->lock);
3869
3870	TrimRange.offStart = u64Sector * 512;
3871	TrimRange.cbRange = cSectors * 512;
3872
3873	s->Led.Asserted.s.fWriting = s->Led.Actual.s.fWriting = 1;
3874	rc = s->pDrvBlock->pfnDiscard(s->pDrvBlock, &TrimRange, 1);
3875	s->Led.Actual.s.fWriting = 0;
3876
3877	if (RT_SUCCESS(rc))
3878	*pfRedo = false;
3879	else
3880	*pfRedo = ataIsRedoSetWarning(s, rc);
3881
3882	STAM_PROFILE_START(&pCtl->StatLockWait, a);
3883	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
3884	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
3885	return rc;
3886	}
3887
3888
3889	static bool ataTrimSS(ATADevState *s)
3890	{
3891	int rc = VERR_GENERAL_FAILURE;
3892	uint32_t cRangesMax;
3893	uint64_t pu64Range = (uint64_t )s->CTX_SUFF(pbIOBuffer);
3894	bool fRedo = false;
3895
3896	cRangesMax = s->cbElementaryTransfer / sizeof(uint64_t);
3897	Assert(cRangesMax);
3898
3899	while (cRangesMax-- > 0)
3900	{
3901	if (ATA_RANGE_LENGTH_GET(*pu64Range) == 0)
3902	break;
3903
3904	rc = ataTrimSectors(s, *pu64Range & ATA_RANGE_LBA_MASK,
3905	ATA_RANGE_LENGTH_GET(*pu64Range), &fRedo);
3906	if (RT_FAILURE(rc))
3907	break;
3908
3909	pu64Range++;
3910	}
3911
3912	if (RT_SUCCESS(rc))
3913	{
3914	s->iSourceSink = ATAFN_SS_NULL;
3915	ataCmdOK(s, ATA_STAT_SEEK);
3916	}
3917	else
3918	{
3919	if (fRedo)
3920	return fRedo;
3921	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
3922	LogRel(("PIIX3 ATA: LUN#%d: disk trim error (rc=%Rrc iSector=%#RX64 cSectors=%#RX32)\n",
3923	s->iLUN, rc, pu64Range & ATA_RANGE_LBA_MASK, ATA_RANGE_LENGTH_GET(pu64Range)));
3924
3925	/*
3926	* Check if we got interrupted. We don't need to set status variables
3927	* because the request was aborted.
3928	*/
3929	if (rc != VERR_INTERRUPTED)
3930	ataCmdError(s, ID_ERR);
3931	}
3932
3933	return false;
3934	}
3935
3936
3937	static void ataParseCmd(ATADevState *s, uint8_t cmd)
3938	{
3939	#ifdef DEBUG
3940	Log(("%s: LUN#%d CMD=%#04x \"%s\"\n", __FUNCTION__, s->iLUN, cmd, ATACmdText(cmd)));
3941	#else /* !DEBUG */
3942	Log(("%s: LUN#%d CMD=%#04x\n", __FUNCTION__, s->iLUN, cmd));
3943	#endif /* !DEBUG */
3944	s->fLBA48 = false;
3945	s->fDMA = false;
3946	if (cmd == ATA_IDLE_IMMEDIATE)
3947	{
3948	/* Detect Linux timeout recovery, first tries IDLE IMMEDIATE (which
3949	* would overwrite the failing command unfortunately), then RESET. */
3950	int32_t uCmdWait = -1;
3951	uint64_t uNow = RTTimeNanoTS();
3952	if (s->u64CmdTS)
3953	uCmdWait = (uNow - s->u64CmdTS) / 1000;
3954	LogRel(("PIIX3 ATA: LUN#%d: IDLE IMMEDIATE, CmdIf=%#04x (%d usec ago)\n",
3955	s->iLUN, s->uATARegCommand, uCmdWait));
3956	}
3957	s->uATARegCommand = cmd;
3958	switch (cmd)
3959	{
3960	case ATA_IDENTIFY_DEVICE:
3961	if (s->pDrvBlock && !s->fATAPI)
3962	ataStartTransfer(s, 512, PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_NULL, ATAFN_SS_IDENTIFY, false);
3963	else
3964	{
3965	if (s->fATAPI)
3966	ataSetSignature(s);
3967	ataCmdError(s, ABRT_ERR);
3968	ataUnsetStatus(s, ATA_STAT_READY);
3969	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
3970	}
3971	break;
3972	case ATA_RECALIBRATE:
3973	if (s->fATAPI)
3974	goto abort_cmd;
3975	/* fall through */
3976	case ATA_INITIALIZE_DEVICE_PARAMETERS:
3977	ataCmdOK(s, ATA_STAT_SEEK);
3978	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
3979	break;
3980	case ATA_SET_MULTIPLE_MODE:
3981	if ( s->uATARegNSector != 0
3982	&& ( s->uATARegNSector > ATA_MAX_MULT_SECTORS
3983	\|\| (s->uATARegNSector & (s->uATARegNSector - 1)) != 0))
3984	{
3985	ataCmdError(s, ABRT_ERR);
3986	}
3987	else
3988	{
3989	Log2(("%s: set multi sector count to %d\n", __FUNCTION__, s->uATARegNSector));
3990	s->cMultSectors = s->uATARegNSector;
3991	ataCmdOK(s, 0);
3992	}
3993	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
3994	break;
3995	case ATA_READ_VERIFY_SECTORS_EXT:
3996	s->fLBA48 = true;
3997	case ATA_READ_VERIFY_SECTORS:
3998	case ATA_READ_VERIFY_SECTORS_WITHOUT_RETRIES:
3999	/* do sector number check ? */
4000	ataCmdOK(s, ATA_STAT_SEEK);
4001	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4002	break;
4003	case ATA_READ_SECTORS_EXT:
4004	s->fLBA48 = true;
4005	case ATA_READ_SECTORS:
4006	case ATA_READ_SECTORS_WITHOUT_RETRIES:
4007	if (!s->pDrvBlock \|\| s->fATAPI)
4008	goto abort_cmd;
4009	s->cSectorsPerIRQ = 1;
4010	ataStartTransfer(s, ataGetNSectors(s) * 512, PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_READ_SECTORS, false);
4011	break;
4012	case ATA_WRITE_SECTORS_EXT:
4013	s->fLBA48 = true;
4014	case ATA_WRITE_SECTORS:
4015	case ATA_WRITE_SECTORS_WITHOUT_RETRIES:
4016	if (!s->pDrvBlock \|\| s->fATAPI)
4017	goto abort_cmd;
4018	s->cSectorsPerIRQ = 1;
4019	ataStartTransfer(s, ataGetNSectors(s) * 512, PDMBLOCKTXDIR_TO_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_WRITE_SECTORS, false);
4020	break;
4021	case ATA_READ_MULTIPLE_EXT:
4022	s->fLBA48 = true;
4023	case ATA_READ_MULTIPLE:
4024	if (!s->pDrvBlock \|\| !s->cMultSectors \|\| s->fATAPI)
4025	goto abort_cmd;
4026	s->cSectorsPerIRQ = s->cMultSectors;
4027	ataStartTransfer(s, ataGetNSectors(s) * 512, PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_READ_SECTORS, false);
4028	break;
4029	case ATA_WRITE_MULTIPLE_EXT:
4030	s->fLBA48 = true;
4031	case ATA_WRITE_MULTIPLE:
4032	if (!s->pDrvBlock \|\| !s->cMultSectors \|\| s->fATAPI)
4033	goto abort_cmd;
4034	s->cSectorsPerIRQ = s->cMultSectors;
4035	ataStartTransfer(s, ataGetNSectors(s) * 512, PDMBLOCKTXDIR_TO_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_WRITE_SECTORS, false);
4036	break;
4037	case ATA_READ_DMA_EXT:
4038	s->fLBA48 = true;
4039	case ATA_READ_DMA:
4040	case ATA_READ_DMA_WITHOUT_RETRIES:
4041	if (!s->pDrvBlock \|\| s->fATAPI)
4042	goto abort_cmd;
4043	s->cSectorsPerIRQ = ATA_MAX_MULT_SECTORS;
4044	s->fDMA = true;
4045	ataStartTransfer(s, ataGetNSectors(s) * 512, PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_READ_SECTORS, false);
4046	break;
4047	case ATA_WRITE_DMA_EXT:
4048	s->fLBA48 = true;
4049	case ATA_WRITE_DMA:
4050	case ATA_WRITE_DMA_WITHOUT_RETRIES:
4051	if (!s->pDrvBlock \|\| s->fATAPI)
4052	goto abort_cmd;
4053	s->cSectorsPerIRQ = ATA_MAX_MULT_SECTORS;
4054	s->fDMA = true;
4055	ataStartTransfer(s, ataGetNSectors(s) * 512, PDMBLOCKTXDIR_TO_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_WRITE_SECTORS, false);
4056	break;
4057	case ATA_READ_NATIVE_MAX_ADDRESS_EXT:
4058	s->fLBA48 = true;
4059	ataSetSector(s, s->cTotalSectors - 1);
4060	ataCmdOK(s, 0);
4061	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4062	break;
4063	case ATA_SEEK: /* Used by the SCO OpenServer. Command is marked as obsolete */
4064	ataCmdOK(s, 0);
4065	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4066	break;
4067	case ATA_READ_NATIVE_MAX_ADDRESS:
4068	ataSetSector(s, RT_MIN(s->cTotalSectors, 1 << 28) - 1);
4069	ataCmdOK(s, 0);
4070	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4071	break;
4072	case ATA_CHECK_POWER_MODE:
4073	s->uATARegNSector = 0xff; /* drive active or idle */
4074	ataCmdOK(s, 0);
4075	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4076	break;
4077	case ATA_SET_FEATURES:
4078	Log2(("%s: feature=%#x\n", __FUNCTION__, s->uATARegFeature));
4079	if (!s->pDrvBlock)
4080	goto abort_cmd;
4081	switch (s->uATARegFeature)
4082	{
4083	case 0x02: /* write cache enable */
4084	Log2(("%s: write cache enable\n", __FUNCTION__));
4085	ataCmdOK(s, ATA_STAT_SEEK);
4086	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4087	break;
4088	case 0xaa: /* read look-ahead enable */
4089	Log2(("%s: read look-ahead enable\n", __FUNCTION__));
4090	ataCmdOK(s, ATA_STAT_SEEK);
4091	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4092	break;
4093	case 0x55: /* read look-ahead disable */
4094	Log2(("%s: read look-ahead disable\n", __FUNCTION__));
4095	ataCmdOK(s, ATA_STAT_SEEK);
4096	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4097	break;
4098	case 0xcc: /* reverting to power-on defaults enable */
4099	Log2(("%s: revert to power-on defaults enable\n", __FUNCTION__));
4100	ataCmdOK(s, ATA_STAT_SEEK);
4101	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4102	break;
4103	case 0x66: /* reverting to power-on defaults disable */
4104	Log2(("%s: revert to power-on defaults disable\n", __FUNCTION__));
4105	ataCmdOK(s, ATA_STAT_SEEK);
4106	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4107	break;
4108	case 0x82: /* write cache disable */
4109	Log2(("%s: write cache disable\n", __FUNCTION__));
4110	/* As per the ATA/ATAPI-6 specs, a write cache disable
4111	* command MUST flush the write buffers to disc. */
4112	ataStartTransfer(s, 0, PDMBLOCKTXDIR_NONE, ATAFN_BT_NULL, ATAFN_SS_FLUSH, false);
4113	break;
4114	case 0x03: { /* set transfer mode */
4115	Log2(("%s: transfer mode %#04x\n", __FUNCTION__, s->uATARegNSector));
4116	switch (s->uATARegNSector & 0xf8)
4117	{
4118	case 0x00: /* PIO default */
4119	case 0x08: /* PIO mode */
4120	break;
4121	case ATA_MODE_MDMA: /* MDMA mode */
4122	s->uATATransferMode = (s->uATARegNSector & 0xf8) \| RT_MIN(s->uATARegNSector & 0x07, ATA_MDMA_MODE_MAX);
4123	break;
4124	case ATA_MODE_UDMA: /* UDMA mode */
4125	s->uATATransferMode = (s->uATARegNSector & 0xf8) \| RT_MIN(s->uATARegNSector & 0x07, ATA_UDMA_MODE_MAX);
4126	break;
4127	default:
4128	goto abort_cmd;
4129	}
4130	ataCmdOK(s, ATA_STAT_SEEK);
4131	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4132	break;
4133	}
4134	default:
4135	goto abort_cmd;
4136	}
4137	/*
4138	* OS/2 workarond:
4139	* The OS/2 IDE driver from MCP2 appears to rely on the feature register being
4140	* reset here. According to the specification, this is a driver bug as the register
4141	* contents are undefined after the call. This means we can just as well reset it.
4142	*/
4143	s->uATARegFeature = 0;
4144	break;
4145	case ATA_FLUSH_CACHE_EXT:
4146	case ATA_FLUSH_CACHE:
4147	if (!s->pDrvBlock \|\| s->fATAPI)
4148	goto abort_cmd;
4149	ataStartTransfer(s, 0, PDMBLOCKTXDIR_NONE, ATAFN_BT_NULL, ATAFN_SS_FLUSH, false);
4150	break;
4151	case ATA_STANDBY_IMMEDIATE:
4152	ataCmdOK(s, 0);
4153	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4154	break;
4155	case ATA_IDLE_IMMEDIATE:
4156	LogRel(("PIIX3 ATA: LUN#%d: aborting current command\n", s->iLUN));
4157	ataAbortCurrentCommand(s, false);
4158	break;
4159	case ATA_SLEEP:
4160	ataCmdOK(s, 0);
4161	ataSetIRQ(s);
4162	break;
4163	/* ATAPI commands */
4164	case ATA_IDENTIFY_PACKET_DEVICE:
4165	if (s->fATAPI)
4166	ataStartTransfer(s, 512, PDMBLOCKTXDIR_FROM_DEVICE, ATAFN_BT_NULL, ATAFN_SS_ATAPI_IDENTIFY, false);
4167	else
4168	{
4169	ataCmdError(s, ABRT_ERR);
4170	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4171	}
4172	break;
4173	case ATA_EXECUTE_DEVICE_DIAGNOSTIC:
4174	ataStartTransfer(s, 0, PDMBLOCKTXDIR_NONE, ATAFN_BT_NULL, ATAFN_SS_EXECUTE_DEVICE_DIAGNOSTIC, false);
4175	break;
4176	case ATA_DEVICE_RESET:
4177	if (!s->fATAPI)
4178	goto abort_cmd;
4179	LogRel(("PIIX3 ATA: LUN#%d: performing device RESET\n", s->iLUN));
4180	ataAbortCurrentCommand(s, true);
4181	break;
4182	case ATA_PACKET:
4183	if (!s->fATAPI)
4184	goto abort_cmd;
4185	/* overlapping commands not supported */
4186	if (s->uATARegFeature & 0x02)
4187	goto abort_cmd;
4188	ataStartTransfer(s, ATAPI_PACKET_SIZE, PDMBLOCKTXDIR_TO_DEVICE, ATAFN_BT_PACKET, ATAFN_SS_PACKET, false);
4189	break;
4190	case ATA_DATA_SET_MANAGEMENT:
4191	if (!s->pDrvBlock \|\| !s->pDrvBlock->pfnDiscard)
4192	goto abort_cmd;
4193	if ( !(s->uATARegFeature & UINT8_C(0x01))
4194	\|\| (s->uATARegFeature & ~UINT8_C(0x01)))
4195	goto abort_cmd;
4196	s->fDMA = true;
4197	ataStartTransfer(s, (s->uATARegNSectorHOB << 8 \| s->uATARegNSector) * 512, PDMBLOCKTXDIR_TO_DEVICE, ATAFN_BT_NULL, ATAFN_SS_TRIM, false);
4198	break;
4199	default:
4200	abort_cmd:
4201	ataCmdError(s, ABRT_ERR);
4202	if (s->fATAPI)
4203	ataUnsetStatus(s, ATA_STAT_READY);
4204	ataSetIRQ(s); /* Shortcut, do not use AIO thread. */
4205	break;
4206	}
4207	}
4208
4209	#endif /* IN_RING3 */
4210
4211	/*
4212	* Note: There are four distinct cases of port I/O handling depending on
4213	* which devices (if any) are attached to an IDE channel:
4214	*
4215	* 1) No device attached. No response to writes or reads (i.e. reads return
4216	* all bits set).
4217	*
4218	* 2) Both devices attached. Reads and writes are processed normally.
4219	*
4220	* 3) Device 0 only. If device 0 is selected, normal behavior applies. But
4221	* if Device 1 is selected, writes are still directed to Device 0 (except
4222	* commands are not executed), reads from control/command registers are
4223	* directed to Device 0, but status/alt status reads return 0. If Device 1
4224	* is a PACKET device, all reads return 0. See ATAPI-6 clause 9.16.1 and
4225	* Table 18 in clause 7.1.
4226	*
4227	* 4) Device 1 only - non-standard(!). Device 1 can't tell if Device 0 is
4228	* present or not and behaves the same. That means if Device 0 is selected,
4229	* Device 1 responds to writes (except commands are not executed) but does
4230	* not respond to reads. If Device 1 selected, normal behavior applies.
4231	* See ATAPI-6 clause 9.16.2 and Table 15 in clause 7.1.
4232	*/
4233
4234	static int ataIOPortWriteU8(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
4235	{
4236	Log2(("%s: LUN#%d write addr=%#x val=%#04x\n", __FUNCTION__, pCtl->aIfs[pCtl->iSelectedIf].iLUN, addr, val));
4237	addr &= 7;
4238	switch (addr)
4239	{
4240	case 0:
4241	break;
4242	case 1: /* feature register */
4243	/* NOTE: data is written to the two drives */
4244	pCtl->aIfs[0].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4245	pCtl->aIfs[1].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4246	pCtl->aIfs[0].uATARegFeatureHOB = pCtl->aIfs[0].uATARegFeature;
4247	pCtl->aIfs[1].uATARegFeatureHOB = pCtl->aIfs[1].uATARegFeature;
4248	pCtl->aIfs[0].uATARegFeature = val;
4249	pCtl->aIfs[1].uATARegFeature = val;
4250	break;
4251	case 2: /* sector count */
4252	pCtl->aIfs[0].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4253	pCtl->aIfs[1].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4254	pCtl->aIfs[0].uATARegNSectorHOB = pCtl->aIfs[0].uATARegNSector;
4255	pCtl->aIfs[1].uATARegNSectorHOB = pCtl->aIfs[1].uATARegNSector;
4256	pCtl->aIfs[0].uATARegNSector = val;
4257	pCtl->aIfs[1].uATARegNSector = val;
4258	break;
4259	case 3: /* sector number */
4260	pCtl->aIfs[0].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4261	pCtl->aIfs[1].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4262	pCtl->aIfs[0].uATARegSectorHOB = pCtl->aIfs[0].uATARegSector;
4263	pCtl->aIfs[1].uATARegSectorHOB = pCtl->aIfs[1].uATARegSector;
4264	pCtl->aIfs[0].uATARegSector = val;
4265	pCtl->aIfs[1].uATARegSector = val;
4266	break;
4267	case 4: /* cylinder low */
4268	pCtl->aIfs[0].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4269	pCtl->aIfs[1].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4270	pCtl->aIfs[0].uATARegLCylHOB = pCtl->aIfs[0].uATARegLCyl;
4271	pCtl->aIfs[1].uATARegLCylHOB = pCtl->aIfs[1].uATARegLCyl;
4272	pCtl->aIfs[0].uATARegLCyl = val;
4273	pCtl->aIfs[1].uATARegLCyl = val;
4274	break;
4275	case 5: /* cylinder high */
4276	pCtl->aIfs[0].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4277	pCtl->aIfs[1].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4278	pCtl->aIfs[0].uATARegHCylHOB = pCtl->aIfs[0].uATARegHCyl;
4279	pCtl->aIfs[1].uATARegHCylHOB = pCtl->aIfs[1].uATARegHCyl;
4280	pCtl->aIfs[0].uATARegHCyl = val;
4281	pCtl->aIfs[1].uATARegHCyl = val;
4282	break;
4283	case 6: /* drive/head */
4284	pCtl->aIfs[0].uATARegSelect = (val & ~0x10) \| 0xa0;
4285	pCtl->aIfs[1].uATARegSelect = (val \| 0x10) \| 0xa0;
4286	if (((val >> 4) & 1) != pCtl->iSelectedIf)
4287	{
4288	PPDMDEVINS pDevIns = CONTROLLER_2_DEVINS(pCtl);
4289
4290	/* select another drive */
4291	pCtl->iSelectedIf = (val >> 4) & 1;
4292	/* The IRQ line is multiplexed between the two drives, so
4293	* update the state when switching to another drive. Only need
4294	* to update interrupt line if it is enabled and there is a
4295	* state change. */
4296	if ( !(pCtl->aIfs[pCtl->iSelectedIf].uATARegDevCtl & ATA_DEVCTL_DISABLE_IRQ)
4297	&& ( pCtl->aIfs[pCtl->iSelectedIf].fIrqPending
4298	!= pCtl->aIfs[pCtl->iSelectedIf ^ 1].fIrqPending))
4299	{
4300	if (pCtl->aIfs[pCtl->iSelectedIf].fIrqPending)
4301	{
4302	Log2(("%s: LUN#%d asserting IRQ (drive select change)\n", __FUNCTION__, pCtl->aIfs[pCtl->iSelectedIf].iLUN));
4303	/* The BMDMA unit unconditionally sets BM_STATUS_INT if
4304	* the interrupt line is asserted. It monitors the line
4305	* for a rising edge. */
4306	pCtl->BmDma.u8Status \|= BM_STATUS_INT;
4307	if (pCtl->irq == 16)
4308	PDMDevHlpPCISetIrq(pDevIns, 0, 1);
4309	else
4310	PDMDevHlpISASetIrq(pDevIns, pCtl->irq, 1);
4311	}
4312	else
4313	{
4314	Log2(("%s: LUN#%d deasserting IRQ (drive select change)\n", __FUNCTION__, pCtl->aIfs[pCtl->iSelectedIf].iLUN));
4315	if (pCtl->irq == 16)
4316	PDMDevHlpPCISetIrq(pDevIns, 0, 0);
4317	else
4318	PDMDevHlpISASetIrq(pDevIns, pCtl->irq, 0);
4319	}
4320	}
4321	}
4322	break;
4323	default:
4324	case 7: /* command */
4325	/* ignore commands to non-existent device */
4326	if (pCtl->iSelectedIf && !pCtl->aIfs[pCtl->iSelectedIf].pDrvBlock)
4327	break;
4328	#ifndef IN_RING3
4329	/* Don't do anything complicated in GC */
4330	return VINF_IOM_R3_IOPORT_WRITE;
4331	#else /* IN_RING3 */
4332	ataParseCmd(&pCtl->aIfs[pCtl->iSelectedIf], val);
4333	#endif /* !IN_RING3 */
4334	}
4335	return VINF_SUCCESS;
4336	}
4337
4338
4339	static int ataIOPortReadU8(PATACONTROLLER pCtl, uint32_t addr, uint32_t *pu32)
4340	{
4341	ATADevState *s = &pCtl->aIfs[pCtl->iSelectedIf];
4342	uint32_t val;
4343	bool fHOB;
4344
4345	/* Check if the guest is reading from a non-existent device. */
4346	if (!s->pDrvBlock)
4347	{
4348	if (pCtl->iSelectedIf) /* Device 1 selected, Device 0 responding for it. */
4349	{
4350	if (!pCtl->aIfs[0].pDrvBlock) /* @todo: this case should never get here! */
4351	{
4352	Log2(("%s: addr=%#x: no device on channel\n", __FUNCTION__, addr));
4353	return VERR_IOM_IOPORT_UNUSED;
4354	}
4355	if (((addr & 7) != 1) && pCtl->aIfs[0].fATAPI) {
4356	Log2(("%s: addr=%#x, val=0: LUN#%d not attached/LUN#%d ATAPI\n", __FUNCTION__, addr,
4357	s->iLUN, pCtl->aIfs[0].iLUN));
4358	*pu32 = 0;
4359	return VINF_SUCCESS;
4360	}
4361	/* Else handle normally. */
4362	}
4363	else /* Device 0 selected (but not present). */
4364	{
4365	Log2(("%s: addr=%#x: LUN#%d not attached\n", __FUNCTION__, addr, s->iLUN));
4366	return VERR_IOM_IOPORT_UNUSED;
4367	}
4368	}
4369	fHOB = !!(s->uATARegDevCtl & (1 << 7));
4370	switch (addr & 7)
4371	{
4372	case 0: /* data register */
4373	val = 0xff;
4374	break;
4375	case 1: /* error register */
4376	/* The ATA specification is very terse when it comes to specifying
4377	* the precise effects of reading back the error/feature register.
4378	* The error register (read-only) shares the register number with
4379	* the feature register (write-only), so it seems that it's not
4380	* necessary to support the usual HOB readback here. */
4381	if (!s->pDrvBlock)
4382	val = 0;
4383	else
4384	val = s->uATARegError;
4385	break;
4386	case 2: /* sector count */
4387	if (fHOB)
4388	val = s->uATARegNSectorHOB;
4389	else
4390	val = s->uATARegNSector;
4391	break;
4392	case 3: /* sector number */
4393	if (fHOB)
4394	val = s->uATARegSectorHOB;
4395	else
4396	val = s->uATARegSector;
4397	break;
4398	case 4: /* cylinder low */
4399	if (fHOB)
4400	val = s->uATARegLCylHOB;
4401	else
4402	val = s->uATARegLCyl;
4403	break;
4404	case 5: /* cylinder high */
4405	if (fHOB)
4406	val = s->uATARegHCylHOB;
4407	else
4408	val = s->uATARegHCyl;
4409	break;
4410	case 6: /* drive/head */
4411	/* This register must always work as long as there is at least
4412	* one drive attached to the controller. It is common between
4413	* both drives anyway (completely identical content). */
4414	if (!pCtl->aIfs[0].pDrvBlock && !pCtl->aIfs[1].pDrvBlock)
4415	val = 0;
4416	else
4417	val = s->uATARegSelect;
4418	break;
4419	default:
4420	case 7: /* primary status */
4421	{
4422	/* Counter for number of busy status seen in GC in a row. */
4423	static unsigned cBusy = 0;
4424
4425	if (!s->pDrvBlock)
4426	val = 0;
4427	else
4428	val = s->uATARegStatus;
4429
4430	/* Give the async I/O thread an opportunity to make progress,
4431	* don't let it starve by guests polling frequently. EMT has a
4432	* lower priority than the async I/O thread, but sometimes the
4433	* host OS doesn't care. With some guests we are only allowed to
4434	* be busy for about 5 milliseconds in some situations. Note that
4435	* this is no guarantee for any other VBox thread getting
4436	* scheduled, so this just lowers the CPU load a bit when drives
4437	* are busy. It cannot help with timing problems. */
4438	if (val & ATA_STAT_BUSY)
4439	{
4440	#ifdef IN_RING3
4441	cBusy = 0;
4442	PDMCritSectLeave(&pCtl->lock);
4443
4444	#ifndef RT_OS_WINDOWS
4445	/*
4446	* The thread might be stuck in an I/O operation
4447	* due to a high I/O load on the host. (see @bugref{3301})
4448	* To perform the reset successfully
4449	* we interrupt the operation by sending a signal to the thread
4450	* if the thread didn't responded in 10ms.
4451	* This works only on POSIX hosts (Windows has a CancelSynchronousIo function which
4452	* does the same but it was introduced with Vista) but so far
4453	* this hang was only observed on Linux and Mac OS X.
4454	*
4455	* This is a workaround and needs to be solved properly.
4456	*/
4457	if (pCtl->fReset)
4458	{
4459	uint64_t u64ResetTimeStop = RTTimeMilliTS();
4460
4461	if ((u64ResetTimeStop - pCtl->u64ResetTime) >= 10)
4462	{
4463	LogRel(("PIIX3 ATA LUN#%d: Async I/O thread probably stuck in operation, interrupting\n", s->iLUN));
4464	pCtl->u64ResetTime = u64ResetTimeStop;
4465	RTThreadPoke(pCtl->AsyncIOThread);
4466	}
4467	}
4468	#endif
4469
4470	RTThreadYield();
4471
4472	{
4473	STAM_PROFILE_START(&pCtl->StatLockWait, a);
4474	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
4475	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
4476	}
4477
4478	val = s->uATARegStatus;
4479	#else /* !IN_RING3 */
4480	/* Cannot yield CPU in guest context. And switching to host
4481	* context for each and every busy status is too costly,
4482	* especially on SMP systems where we don't gain much by
4483	* yielding the CPU to someone else. */
4484	if (++cBusy >= 20)
4485	{
4486	cBusy = 0;
4487	return VINF_IOM_R3_IOPORT_READ;
4488	}
4489	#endif /* !IN_RING3 */
4490	}
4491	else
4492	cBusy = 0;
4493	ataUnsetIRQ(s);
4494	break;
4495	}
4496	}
4497	Log2(("%s: LUN#%d addr=%#x val=%#04x\n", __FUNCTION__, s->iLUN, addr, val));
4498	*pu32 = val;
4499	return VINF_SUCCESS;
4500	}
4501
4502
4503	static uint32_t ataStatusRead(PATACONTROLLER pCtl, uint32_t addr)
4504	{
4505	ATADevState *s = &pCtl->aIfs[pCtl->iSelectedIf];
4506	uint32_t val;
4507
4508	//@todo: The handler should not be even registered if there
4509	// is no device on an IDE channel.
4510	if (!pCtl->aIfs[0].pDrvBlock && !pCtl->aIfs[1].pDrvBlock)
4511	val = 0xff;
4512	else if (pCtl->iSelectedIf == 1 && !s->pDrvBlock)
4513	val = 0; /* Device 1 selected, Device 0 responding for it. */
4514	else
4515	val = s->uATARegStatus;
4516	Log2(("%s: addr=%#x val=%#04x\n", __FUNCTION__, addr, val));
4517	return val;
4518	}
4519
4520	static int ataControlWrite(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
4521	{
4522	#ifndef IN_RING3
4523	if ((val ^ pCtl->aIfs[0].uATARegDevCtl) & ATA_DEVCTL_RESET)
4524	return VINF_IOM_R3_IOPORT_WRITE; /* The RESET stuff is too complicated for GC. */
4525	#endif /* !IN_RING3 */
4526
4527	Log2(("%s: addr=%#x val=%#04x\n", __FUNCTION__, addr, val));
4528	/* RESET is common for both drives attached to a controller. */
4529	if (!(pCtl->aIfs[0].uATARegDevCtl & ATA_DEVCTL_RESET) &&
4530	(val & ATA_DEVCTL_RESET))
4531	{
4532	#ifdef IN_RING3
4533	/* Software RESET low to high */
4534	int32_t uCmdWait0 = -1, uCmdWait1 = -1;
4535	uint64_t uNow = RTTimeNanoTS();
4536	if (pCtl->aIfs[0].u64CmdTS)
4537	uCmdWait0 = (uNow - pCtl->aIfs[0].u64CmdTS) / 1000;
4538	if (pCtl->aIfs[1].u64CmdTS)
4539	uCmdWait1 = (uNow - pCtl->aIfs[1].u64CmdTS) / 1000;
4540	LogRel(("PIIX3 ATA: Ctl#%d: RESET, DevSel=%d AIOIf=%d CmdIf0=%#04x (%d usec ago) CmdIf1=%#04x (%d usec ago)\n",
4541	ATACONTROLLER_IDX(pCtl), pCtl->iSelectedIf, pCtl->iAIOIf,
4542	pCtl->aIfs[0].uATARegCommand, uCmdWait0,
4543	pCtl->aIfs[1].uATARegCommand, uCmdWait1));
4544	pCtl->fReset = true;
4545	/* Everything must be done after the reset flag is set, otherwise
4546	* there are unavoidable races with the currently executing request
4547	* (which might just finish in the mean time). */
4548	pCtl->fChainedTransfer = false;
4549	for (uint32_t i = 0; i < RT_ELEMENTS(pCtl->aIfs); i++)
4550	{
4551	ataResetDevice(&pCtl->aIfs[i]);
4552	/* The following cannot be done using ataSetStatusValue() since the
4553	* reset flag is already set, which suppresses all status changes. */
4554	pCtl->aIfs[i].uATARegStatus = ATA_STAT_BUSY \| ATA_STAT_SEEK;
4555	Log2(("%s: LUN#%d status %#04x\n", __FUNCTION__, pCtl->aIfs[i].iLUN, pCtl->aIfs[i].uATARegStatus));
4556	pCtl->aIfs[i].uATARegError = 0x01;
4557	}
4558	ataAsyncIOClearRequests(pCtl);
4559	Log2(("%s: Ctl#%d: message to async I/O thread, resetA\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
4560	if (val & ATA_DEVCTL_HOB)
4561	{
4562	val &= ~ATA_DEVCTL_HOB;
4563	Log2(("%s: ignored setting HOB\n", __FUNCTION__));
4564	}
4565
4566	/* Save the timestamp we started the reset. */
4567	pCtl->u64ResetTime = RTTimeMilliTS();
4568
4569	/* Issue the reset request now. */
4570	ataAsyncIOPutRequest(pCtl, &g_ataResetARequest);
4571	#else /* !IN_RING3 */
4572	AssertMsgFailed(("RESET handling is too complicated for GC\n"));
4573	#endif /* IN_RING3 */
4574	}
4575	else if ((pCtl->aIfs[0].uATARegDevCtl & ATA_DEVCTL_RESET) &&
4576	!(val & ATA_DEVCTL_RESET))
4577	{
4578	#ifdef IN_RING3
4579	/* Software RESET high to low */
4580	Log(("%s: deasserting RESET\n", __FUNCTION__));
4581	Log2(("%s: Ctl#%d: message to async I/O thread, resetC\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
4582	if (val & ATA_DEVCTL_HOB)
4583	{
4584	val &= ~ATA_DEVCTL_HOB;
4585	Log2(("%s: ignored setting HOB\n", __FUNCTION__));
4586	}
4587	ataAsyncIOPutRequest(pCtl, &g_ataResetCRequest);
4588	#else /* !IN_RING3 */
4589	AssertMsgFailed(("RESET handling is too complicated for GC\n"));
4590	#endif /* IN_RING3 */
4591	}
4592
4593	/* Change of interrupt disable flag. Update interrupt line if interrupt
4594	* is pending on the current interface. */
4595	if ((val ^ pCtl->aIfs[0].uATARegDevCtl) & ATA_DEVCTL_DISABLE_IRQ
4596	&& pCtl->aIfs[pCtl->iSelectedIf].fIrqPending)
4597	{
4598	if (!(val & ATA_DEVCTL_DISABLE_IRQ))
4599	{
4600	Log2(("%s: LUN#%d asserting IRQ (interrupt disable change)\n", __FUNCTION__, pCtl->aIfs[pCtl->iSelectedIf].iLUN));
4601	/* The BMDMA unit unconditionally sets BM_STATUS_INT if the
4602	* interrupt line is asserted. It monitors the line for a rising
4603	* edge. */
4604	pCtl->BmDma.u8Status \|= BM_STATUS_INT;
4605	if (pCtl->irq == 16)
4606	PDMDevHlpPCISetIrq(CONTROLLER_2_DEVINS(pCtl), 0, 1);
4607	else
4608	PDMDevHlpISASetIrq(CONTROLLER_2_DEVINS(pCtl), pCtl->irq, 1);
4609	}
4610	else
4611	{
4612	Log2(("%s: LUN#%d deasserting IRQ (interrupt disable change)\n", __FUNCTION__, pCtl->aIfs[pCtl->iSelectedIf].iLUN));
4613	if (pCtl->irq == 16)
4614	PDMDevHlpPCISetIrq(CONTROLLER_2_DEVINS(pCtl), 0, 0);
4615	else
4616	PDMDevHlpISASetIrq(CONTROLLER_2_DEVINS(pCtl), pCtl->irq, 0);
4617	}
4618	}
4619
4620	if (val & ATA_DEVCTL_HOB)
4621	Log2(("%s: set HOB\n", __FUNCTION__));
4622
4623	pCtl->aIfs[0].uATARegDevCtl = val;
4624	pCtl->aIfs[1].uATARegDevCtl = val;
4625
4626	return VINF_SUCCESS;
4627	}
4628
4629	#ifdef IN_RING3
4630
4631	static void ataPIOTransfer(PATACONTROLLER pCtl)
4632	{
4633	ATADevState *s;
4634
4635	s = &pCtl->aIfs[pCtl->iAIOIf];
4636	Log3(("%s: if=%p\n", __FUNCTION__, s));
4637
4638	if (s->cbTotalTransfer && s->iIOBufferCur > s->iIOBufferEnd)
4639	{
4640	LogRel(("PIIX3 ATA: LUN#%d: %s data in the middle of a PIO transfer - VERY SLOW\n", s->iLUN, s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE ? "loading" : "storing"));
4641	/* Any guest OS that triggers this case has a pathetic ATA driver.
4642	* In a real system it would block the CPU via IORDY, here we do it
4643	* very similarly by not continuing with the current instruction
4644	* until the transfer to/from the storage medium is completed. */
4645	if (s->iSourceSink != ATAFN_SS_NULL)
4646	{
4647	bool fRedo;
4648	uint8_t status = s->uATARegStatus;
4649	ataSetStatusValue(s, ATA_STAT_BUSY);
4650	Log2(("%s: calling source/sink function\n", __FUNCTION__));
4651	fRedo = g_apfnSourceSinkFuncs[s->iSourceSink](s);
4652	pCtl->fRedo = fRedo;
4653	if (RT_UNLIKELY(fRedo))
4654	return;
4655	ataSetStatusValue(s, status);
4656	s->iIOBufferCur = 0;
4657	s->iIOBufferEnd = s->cbElementaryTransfer;
4658	}
4659	}
4660	if (s->cbTotalTransfer)
4661	{
4662	if (s->fATAPITransfer)
4663	ataPIOTransferLimitATAPI(s);
4664
4665	if (s->uTxDir == PDMBLOCKTXDIR_TO_DEVICE && s->cbElementaryTransfer > s->cbTotalTransfer)
4666	s->cbElementaryTransfer = s->cbTotalTransfer;
4667
4668	Log2(("%s: %s tx_size=%d elem_tx_size=%d index=%d end=%d\n",
4669	__FUNCTION__, s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE ? "T2I" : "I2T",
4670	s->cbTotalTransfer, s->cbElementaryTransfer,
4671	s->iIOBufferCur, s->iIOBufferEnd));
4672	ataPIOTransferStart(s, s->iIOBufferCur, s->cbElementaryTransfer);
4673	s->cbTotalTransfer -= s->cbElementaryTransfer;
4674	s->iIOBufferCur += s->cbElementaryTransfer;
4675
4676	if (s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE && s->cbElementaryTransfer > s->cbTotalTransfer)
4677	s->cbElementaryTransfer = s->cbTotalTransfer;
4678	}
4679	else
4680	ataPIOTransferStop(s);
4681	}
4682
4683
4684	DECLINLINE(void) ataPIOTransferFinish(PATACONTROLLER pCtl, ATADevState *s)
4685	{
4686	/* Do not interfere with RESET processing if the PIO transfer finishes
4687	* while the RESET line is asserted. */
4688	if (pCtl->fReset)
4689	{
4690	Log2(("%s: Ctl#%d: suppressed continuing PIO transfer as RESET is active\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
4691	return;
4692	}
4693
4694	if ( s->uTxDir == PDMBLOCKTXDIR_TO_DEVICE
4695	\|\| ( s->iSourceSink != ATAFN_SS_NULL
4696	&& s->iIOBufferCur >= s->iIOBufferEnd))
4697	{
4698	/* Need to continue the transfer in the async I/O thread. This is
4699	* the case for write operations or generally for not yet finished
4700	* transfers (some data might need to be read). */
4701	ataUnsetStatus(s, ATA_STAT_READY \| ATA_STAT_DRQ);
4702	ataSetStatus(s, ATA_STAT_BUSY);
4703
4704	Log2(("%s: Ctl#%d: message to async I/O thread, continuing PIO transfer\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
4705	ataAsyncIOPutRequest(pCtl, &g_ataPIORequest);
4706	}
4707	else
4708	{
4709	/* Either everything finished (though some data might still be pending)
4710	* or some data is pending before the next read is due. */
4711
4712	/* Continue a previously started transfer. */
4713	ataUnsetStatus(s, ATA_STAT_DRQ);
4714	ataSetStatus(s, ATA_STAT_READY);
4715
4716	if (s->cbTotalTransfer)
4717	{
4718	/* There is more to transfer, happens usually for large ATAPI
4719	* reads - the protocol limits the chunk size to 65534 bytes. */
4720	ataPIOTransfer(pCtl);
4721	ataSetIRQ(s);
4722	}
4723	else
4724	{
4725	Log2(("%s: Ctl#%d: skipping message to async I/O thread, ending PIO transfer\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
4726	/* Finish PIO transfer. */
4727	ataPIOTransfer(pCtl);
4728	Assert(!pCtl->fRedo);
4729	}
4730	}
4731	}
4732
4733	#endif /* IN_RING3 */
4734
4735	static int ataDataWrite(PATACONTROLLER pCtl, uint32_t addr, uint32_t cbSize, const uint8_t *pbBuf)
4736	{
4737	ATADevState *s = &pCtl->aIfs[pCtl->iSelectedIf];
4738	uint8_t *p;
4739
4740	if (s->iIOBufferPIODataStart < s->iIOBufferPIODataEnd)
4741	{
4742	Assert(s->uTxDir == PDMBLOCKTXDIR_TO_DEVICE);
4743	p = s->CTX_SUFF(pbIOBuffer) + s->iIOBufferPIODataStart;
4744	#ifndef IN_RING3
4745	/* All but the last transfer unit is simple enough for GC, but
4746	* sending a request to the async IO thread is too complicated. */
4747	if (s->iIOBufferPIODataStart + cbSize < s->iIOBufferPIODataEnd)
4748	{
4749	memcpy(p, pbBuf, cbSize);
4750	s->iIOBufferPIODataStart += cbSize;
4751	}
4752	else
4753	return VINF_IOM_R3_IOPORT_WRITE;
4754	#else /* IN_RING3 */
4755	memcpy(p, pbBuf, cbSize);
4756	s->iIOBufferPIODataStart += cbSize;
4757	if (s->iIOBufferPIODataStart >= s->iIOBufferPIODataEnd)
4758	ataPIOTransferFinish(pCtl, s);
4759	#endif /* !IN_RING3 */
4760	}
4761	else
4762	Log2(("%s: DUMMY data\n", __FUNCTION__));
4763	Log3(("%s: addr=%#x val=%.*Rhxs\n", __FUNCTION__, addr, cbSize, pbBuf));
4764	return VINF_SUCCESS;
4765	}
4766
4767	static int ataDataRead(PATACONTROLLER pCtl, uint32_t addr, uint32_t cbSize, uint8_t *pbBuf)
4768	{
4769	ATADevState *s = &pCtl->aIfs[pCtl->iSelectedIf];
4770	uint8_t *p;
4771
4772	if (s->iIOBufferPIODataStart < s->iIOBufferPIODataEnd)
4773	{
4774	Assert(s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE);
4775	p = s->CTX_SUFF(pbIOBuffer) + s->iIOBufferPIODataStart;
4776	#ifndef IN_RING3
4777	/* All but the last transfer unit is simple enough for GC, but
4778	* sending a request to the async IO thread is too complicated. */
4779	if (s->iIOBufferPIODataStart + cbSize < s->iIOBufferPIODataEnd)
4780	{
4781	memcpy(pbBuf, p, cbSize);
4782	s->iIOBufferPIODataStart += cbSize;
4783	}
4784	else
4785	return VINF_IOM_R3_IOPORT_READ;
4786	#else /* IN_RING3 */
4787	memcpy(pbBuf, p, cbSize);
4788	s->iIOBufferPIODataStart += cbSize;
4789	if (s->iIOBufferPIODataStart >= s->iIOBufferPIODataEnd)
4790	ataPIOTransferFinish(pCtl, s);
4791	#endif /* !IN_RING3 */
4792	}
4793	else
4794	{
4795	Log2(("%s: DUMMY data\n", __FUNCTION__));
4796	memset(pbBuf, '\xff', cbSize);
4797	}
4798	Log3(("%s: addr=%#x val=%.*Rhxs\n", __FUNCTION__, addr, cbSize, pbBuf));
4799	return VINF_SUCCESS;
4800	}
4801
4802	#ifdef IN_RING3
4803
4804	static void ataDMATransferStop(ATADevState *s)
4805	{
4806	s->cbTotalTransfer = 0;
4807	s->cbElementaryTransfer = 0;
4808	s->iBeginTransfer = ATAFN_BT_NULL;
4809	s->iSourceSink = ATAFN_SS_NULL;
4810	}
4811
4812
4813	/**
4814	* Perform the entire DMA transfer in one go (unless a source/sink operation
4815	* has to be redone or a RESET comes in between). Unlike the PIO counterpart
4816	* this function cannot handle empty transfers.
4817	*
4818	* @param pCtl Controller for which to perform the transfer.
4819	*/
4820	static void ataDMATransfer(PATACONTROLLER pCtl)
4821	{
4822	PPDMDEVINS pDevIns = CONTROLLER_2_DEVINS(pCtl);
4823	ATADevState *s = &pCtl->aIfs[pCtl->iAIOIf];
4824	bool fRedo;
4825	RTGCPHYS32 pDesc;
4826	uint32_t cbTotalTransfer, cbElementaryTransfer;
4827	uint32_t iIOBufferCur, iIOBufferEnd;
4828	uint32_t dmalen;
4829	PDMBLOCKTXDIR uTxDir;
4830	bool fLastDesc = false;
4831
4832	Assert(sizeof(BMDMADesc) == 8);
4833
4834	fRedo = pCtl->fRedo;
4835	if (RT_LIKELY(!fRedo))
4836	Assert(s->cbTotalTransfer);
4837	uTxDir = (PDMBLOCKTXDIR)s->uTxDir;
4838	cbTotalTransfer = s->cbTotalTransfer;
4839	cbElementaryTransfer = s->cbElementaryTransfer;
4840	iIOBufferCur = s->iIOBufferCur;
4841	iIOBufferEnd = s->iIOBufferEnd;
4842
4843	/* The DMA loop is designed to hold the lock only when absolutely
4844	* necessary. This avoids long freezes should the guest access the
4845	* ATA registers etc. for some reason. */
4846	PDMCritSectLeave(&pCtl->lock);
4847
4848	Log2(("%s: %s tx_size=%d elem_tx_size=%d index=%d end=%d\n",
4849	__FUNCTION__, uTxDir == PDMBLOCKTXDIR_FROM_DEVICE ? "T2I" : "I2T",
4850	cbTotalTransfer, cbElementaryTransfer,
4851	iIOBufferCur, iIOBufferEnd));
4852	for (pDesc = pCtl->pFirstDMADesc; pDesc <= pCtl->pLastDMADesc; pDesc += sizeof(BMDMADesc))
4853	{
4854	BMDMADesc DMADesc;
4855	RTGCPHYS32 pBuffer;
4856	uint32_t cbBuffer;
4857
4858	if (RT_UNLIKELY(fRedo))
4859	{
4860	pBuffer = pCtl->pRedoDMABuffer;
4861	cbBuffer = pCtl->cbRedoDMABuffer;
4862	fLastDesc = pCtl->fRedoDMALastDesc;
4863	}
4864	else
4865	{
4866	PDMDevHlpPhysRead(pDevIns, pDesc, &DMADesc, sizeof(BMDMADesc));
4867	pBuffer = RT_LE2H_U32(DMADesc.pBuffer);
4868	cbBuffer = RT_LE2H_U32(DMADesc.cbBuffer);
4869	fLastDesc = !!(cbBuffer & 0x80000000);
4870	cbBuffer &= 0xfffe;
4871	if (cbBuffer == 0)
4872	cbBuffer = 0x10000;
4873	if (cbBuffer > cbTotalTransfer)
4874	cbBuffer = cbTotalTransfer;
4875	}
4876
4877	while (RT_UNLIKELY(fRedo) \|\| (cbBuffer && cbTotalTransfer))
4878	{
4879	if (RT_LIKELY(!fRedo))
4880	{
4881	dmalen = RT_MIN(cbBuffer, iIOBufferEnd - iIOBufferCur);
4882	Log2(("%s: DMA desc %#010x: addr=%#010x size=%#010x orig_size=%#010x\n", __FUNCTION__,
4883	(int)pDesc, pBuffer, cbBuffer, RT_LE2H_U32(DMADesc.cbBuffer) & 0xfffe));
4884
4885	PCIATAState pATAState = PDMINS_2_DATA(pDevIns, PCIATAState );
4886	AssertPtr(pATAState);
4887	if (uTxDir == PDMBLOCKTXDIR_FROM_DEVICE)
4888	PDMDevHlpPCIPhysWrite(pDevIns, pBuffer, s->CTX_SUFF(pbIOBuffer) + iIOBufferCur, dmalen);
4889	else
4890	PDMDevHlpPCIPhysRead(pDevIns, pBuffer, s->CTX_SUFF(pbIOBuffer) + iIOBufferCur, dmalen);
4891
4892	iIOBufferCur += dmalen;
4893	cbTotalTransfer -= dmalen;
4894	cbBuffer -= dmalen;
4895	pBuffer += dmalen;
4896	}
4897	if ( iIOBufferCur == iIOBufferEnd
4898	&& (uTxDir == PDMBLOCKTXDIR_TO_DEVICE \|\| cbTotalTransfer))
4899	{
4900	if (uTxDir == PDMBLOCKTXDIR_FROM_DEVICE && cbElementaryTransfer > cbTotalTransfer)
4901	cbElementaryTransfer = cbTotalTransfer;
4902
4903	{
4904	STAM_PROFILE_START(&pCtl->StatLockWait, a);
4905	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
4906	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
4907	}
4908
4909	/* The RESET handler could have cleared the DMA transfer
4910	* state (since we didn't hold the lock until just now
4911	* the guest can continue in parallel). If so, the state
4912	* is already set up so the loop is exited immediately. */
4913	if (s->iSourceSink != ATAFN_SS_NULL)
4914	{
4915	s->iIOBufferCur = iIOBufferCur;
4916	s->iIOBufferEnd = iIOBufferEnd;
4917	s->cbElementaryTransfer = cbElementaryTransfer;
4918	s->cbTotalTransfer = cbTotalTransfer;
4919	Log2(("%s: calling source/sink function\n", __FUNCTION__));
4920	fRedo = g_apfnSourceSinkFuncs[s->iSourceSink](s);
4921	if (RT_UNLIKELY(fRedo))
4922	{
4923	pCtl->pFirstDMADesc = pDesc;
4924	pCtl->pRedoDMABuffer = pBuffer;
4925	pCtl->cbRedoDMABuffer = cbBuffer;
4926	pCtl->fRedoDMALastDesc = fLastDesc;
4927	}
4928	else
4929	{
4930	cbTotalTransfer = s->cbTotalTransfer;
4931	cbElementaryTransfer = s->cbElementaryTransfer;
4932
4933	if (uTxDir == PDMBLOCKTXDIR_TO_DEVICE && cbElementaryTransfer > cbTotalTransfer)
4934	cbElementaryTransfer = cbTotalTransfer;
4935	iIOBufferCur = 0;
4936	iIOBufferEnd = cbElementaryTransfer;
4937	}
4938	pCtl->fRedo = fRedo;
4939	}
4940	else
4941	{
4942	/* This forces the loop to exit immediately. */
4943	pDesc = pCtl->pLastDMADesc + 1;
4944	}
4945
4946	PDMCritSectLeave(&pCtl->lock);
4947	if (RT_UNLIKELY(fRedo))
4948	break;
4949	}
4950	}
4951
4952	if (RT_UNLIKELY(fRedo))
4953	break;
4954
4955	/* end of transfer */
4956	if (!cbTotalTransfer \|\| fLastDesc)
4957	break;
4958
4959	{
4960	STAM_PROFILE_START(&pCtl->StatLockWait, a);
4961	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
4962	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
4963	}
4964
4965	if (!(pCtl->BmDma.u8Cmd & BM_CMD_START) \|\| pCtl->fReset)
4966	{
4967	LogRel(("PIIX3 ATA: Ctl#%d: ABORT DMA%s\n", ATACONTROLLER_IDX(pCtl), pCtl->fReset ? " due to RESET" : ""));
4968	if (!pCtl->fReset)
4969	ataDMATransferStop(s);
4970	/* This forces the loop to exit immediately. */
4971	pDesc = pCtl->pLastDMADesc + 1;
4972	}
4973
4974	PDMCritSectLeave(&pCtl->lock);
4975	}
4976
4977	{
4978	STAM_PROFILE_START(&pCtl->StatLockWait, a);
4979	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
4980	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
4981	}
4982
4983	if (RT_UNLIKELY(fRedo))
4984	return;
4985
4986	if (fLastDesc)
4987	pCtl->BmDma.u8Status &= ~BM_STATUS_DMAING;
4988	s->cbTotalTransfer = cbTotalTransfer;
4989	s->cbElementaryTransfer = cbElementaryTransfer;
4990	s->iIOBufferCur = iIOBufferCur;
4991	s->iIOBufferEnd = iIOBufferEnd;
4992	}
4993
4994	/**
4995	* Signal PDM that we're idle (if we actually are).
4996	*
4997	* @param pCtl The controller.
4998	*/
4999	static void ataR3AsyncSignalIdle(PATACONTROLLER pCtl)
5000	{
5001	/*
5002	* Take the mutex here and recheck the idle indicator to avoid
5003	* unnecessary work and racing ataR3WaitForAsyncIOIsIdle.
5004	*/
5005	int rc = RTSemMutexRequest(pCtl->AsyncIORequestMutex, RT_INDEFINITE_WAIT); AssertRC(rc);
5006
5007	if ( pCtl->fSignalIdle
5008	&& ataAsyncIOIsIdle(pCtl, false /fStrict/))
5009	{
5010	PDMDevHlpAsyncNotificationCompleted(pCtl->pDevInsR3);
5011	RTThreadUserSignal(pCtl->AsyncIOThread); /* for ataR3Construct/ataR3ResetCommon. */
5012	}
5013
5014	rc = RTSemMutexRelease(pCtl->AsyncIORequestMutex); AssertRC(rc);
5015	}
5016
5017	/** Async I/O thread for an interface. Once upon a time this was readable
5018	* code with several loops and a different semaphore for each purpose. But
5019	* then came the "how can one save the state in the middle of a PIO transfer"
5020	* question. The solution was to use an ASM, which is what's there now. */
5021	static DECLCALLBACK(int) ataAsyncIOLoop(RTTHREAD ThreadSelf, void *pvUser)
5022	{
5023	const ATARequest *pReq;
5024	uint64_t u64TS = 0; /* shut up gcc */
5025	uint64_t uWait;
5026	int rc = VINF_SUCCESS;
5027	PATACONTROLLER pCtl = (PATACONTROLLER)pvUser;
5028	ATADevState *s;
5029
5030	pReq = NULL;
5031	pCtl->fChainedTransfer = false;
5032	while (!pCtl->fShutdown)
5033	{
5034	/* Keep this thread from doing anything as long as EMT is suspended. */
5035	while (pCtl->fRedoIdle)
5036	{
5037	if (pCtl->fSignalIdle)
5038	ataR3AsyncSignalIdle(pCtl);
5039	rc = RTSemEventWait(pCtl->SuspendIOSem, RT_INDEFINITE_WAIT);
5040	/* Continue if we got a signal by RTThreadPoke().
5041	* We will get notified if there is a request to process.
5042	*/
5043	if (RT_UNLIKELY(rc == VERR_INTERRUPTED))
5044	continue;
5045	if (RT_FAILURE(rc) \|\| pCtl->fShutdown)
5046	break;
5047
5048	pCtl->fRedoIdle = false;
5049	}
5050
5051	/* Wait for work. */
5052	while (pReq == NULL)
5053	{
5054	if (pCtl->fSignalIdle)
5055	ataR3AsyncSignalIdle(pCtl);
5056	rc = RTSemEventWait(pCtl->AsyncIOSem, RT_INDEFINITE_WAIT);
5057	/* Continue if we got a signal by RTThreadPoke().
5058	* We will get notified if there is a request to process.
5059	*/
5060	if (RT_UNLIKELY(rc == VERR_INTERRUPTED))
5061	continue;
5062	if (RT_FAILURE(rc) \|\| RT_UNLIKELY(pCtl->fShutdown))
5063	break;
5064
5065	pReq = ataAsyncIOGetCurrentRequest(pCtl);
5066	}
5067
5068	if (RT_FAILURE(rc) \|\| pCtl->fShutdown)
5069	break;
5070
5071	if (pReq == NULL)
5072	continue;
5073
5074	ATAAIO ReqType = pReq->ReqType;
5075
5076	Log2(("%s: Ctl#%d: state=%d, req=%d\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl), pCtl->uAsyncIOState, ReqType));
5077	if (pCtl->uAsyncIOState != ReqType)
5078	{
5079	/* The new state is not the state that was expected by the normal
5080	* state changes. This is either a RESET/ABORT or there's something
5081	* really strange going on. */
5082	if ( (pCtl->uAsyncIOState == ATA_AIO_PIO \|\| pCtl->uAsyncIOState == ATA_AIO_DMA)
5083	&& (ReqType == ATA_AIO_PIO \|\| ReqType == ATA_AIO_DMA))
5084	{
5085	/* Incorrect sequence of PIO/DMA states. Dump request queue. */
5086	ataAsyncIODumpRequests(pCtl);
5087	}
5088	AssertReleaseMsg(ReqType == ATA_AIO_RESET_ASSERTED \|\| ReqType == ATA_AIO_RESET_CLEARED \|\| ReqType == ATA_AIO_ABORT \|\| pCtl->uAsyncIOState == ReqType, ("I/O state inconsistent: state=%d request=%d\n", pCtl->uAsyncIOState, ReqType));
5089	}
5090
5091	/* Do our work. */
5092	{
5093	STAM_PROFILE_START(&pCtl->StatLockWait, a);
5094	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
5095	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
5096	}
5097
5098	if (pCtl->uAsyncIOState == ATA_AIO_NEW && !pCtl->fChainedTransfer)
5099	{
5100	u64TS = RTTimeNanoTS();
5101	#if defined(DEBUG) \|\| defined(VBOX_WITH_STATISTICS)
5102	STAM_PROFILE_ADV_START(&pCtl->StatAsyncTime, a);
5103	#endif /* DEBUG \|\| VBOX_WITH_STATISTICS */
5104	}
5105
5106	switch (ReqType)
5107	{
5108	case ATA_AIO_NEW:
5109
5110	pCtl->iAIOIf = pReq->u.t.iIf;
5111	s = &pCtl->aIfs[pCtl->iAIOIf];
5112	s->cbTotalTransfer = pReq->u.t.cbTotalTransfer;
5113	s->uTxDir = pReq->u.t.uTxDir;
5114	s->iBeginTransfer = pReq->u.t.iBeginTransfer;
5115	s->iSourceSink = pReq->u.t.iSourceSink;
5116	s->iIOBufferEnd = 0;
5117	s->u64CmdTS = u64TS;
5118
5119	if (s->fATAPI)
5120	{
5121	if (pCtl->fChainedTransfer)
5122	{
5123	/* Only count the actual transfers, not the PIO
5124	* transfer of the ATAPI command bytes. */
5125	if (s->fDMA)
5126	STAM_REL_COUNTER_INC(&s->StatATAPIDMA);
5127	else
5128	STAM_REL_COUNTER_INC(&s->StatATAPIPIO);
5129	}
5130	}
5131	else
5132	{
5133	if (s->fDMA)
5134	STAM_REL_COUNTER_INC(&s->StatATADMA);
5135	else
5136	STAM_REL_COUNTER_INC(&s->StatATAPIO);
5137	}
5138
5139	pCtl->fChainedTransfer = false;
5140
5141	if (s->iBeginTransfer != ATAFN_BT_NULL)
5142	{
5143	Log2(("%s: Ctl#%d: calling begin transfer function\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
5144	g_apfnBeginTransFuncs[s->iBeginTransfer](s);
5145	s->iBeginTransfer = ATAFN_BT_NULL;
5146	if (s->uTxDir != PDMBLOCKTXDIR_FROM_DEVICE)
5147	s->iIOBufferEnd = s->cbElementaryTransfer;
5148	}
5149	else
5150	{
5151	s->cbElementaryTransfer = s->cbTotalTransfer;
5152	s->iIOBufferEnd = s->cbTotalTransfer;
5153	}
5154	s->iIOBufferCur = 0;
5155
5156	if (s->uTxDir != PDMBLOCKTXDIR_TO_DEVICE)
5157	{
5158	if (s->iSourceSink != ATAFN_SS_NULL)
5159	{
5160	bool fRedo;
5161	Log2(("%s: Ctl#%d: calling source/sink function\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
5162	fRedo = g_apfnSourceSinkFuncs[s->iSourceSink](s);
5163	pCtl->fRedo = fRedo;
5164	if (RT_UNLIKELY(fRedo && !pCtl->fReset))
5165	{
5166	/* Operation failed at the initial transfer, restart
5167	* everything from scratch by resending the current
5168	* request. Occurs very rarely, not worth optimizing. */
5169	LogRel(("%s: Ctl#%d: redo entire operation\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
5170	ataAsyncIOPutRequest(pCtl, pReq);
5171	break;
5172	}
5173	}
5174	else
5175	ataCmdOK(s, 0);
5176	s->iIOBufferEnd = s->cbElementaryTransfer;
5177
5178	}
5179
5180	/* Do not go into the transfer phase if RESET is asserted.
5181	* The CritSect is released while waiting for the host OS
5182	* to finish the I/O, thus RESET is possible here. Most
5183	* important: do not change uAsyncIOState. */
5184	if (pCtl->fReset)
5185	break;
5186
5187	if (s->fDMA)
5188	{
5189	if (s->cbTotalTransfer)
5190	{
5191	ataSetStatus(s, ATA_STAT_DRQ);
5192
5193	pCtl->uAsyncIOState = ATA_AIO_DMA;
5194	/* If BMDMA is already started, do the transfer now. */
5195	if (pCtl->BmDma.u8Cmd & BM_CMD_START)
5196	{
5197	Log2(("%s: Ctl#%d: message to async I/O thread, continuing DMA transfer immediately\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
5198	ataAsyncIOPutRequest(pCtl, &g_ataDMARequest);
5199	}
5200	}
5201	else
5202	{
5203	Assert(s->uTxDir == PDMBLOCKTXDIR_NONE); /* Any transfer which has an initial transfer size of 0 must be marked as such. */
5204	/* Finish DMA transfer. */
5205	ataDMATransferStop(s);
5206	ataSetIRQ(s);
5207	pCtl->uAsyncIOState = ATA_AIO_NEW;
5208	}
5209	}
5210	else
5211	{
5212	if (s->cbTotalTransfer)
5213	{
5214	ataPIOTransfer(pCtl);
5215	Assert(!pCtl->fRedo);
5216	if (s->fATAPITransfer \|\| s->uTxDir != PDMBLOCKTXDIR_TO_DEVICE)
5217	ataSetIRQ(s);
5218
5219	if (s->uTxDir == PDMBLOCKTXDIR_TO_DEVICE \|\| s->iSourceSink != ATAFN_SS_NULL)
5220	{
5221	/* Write operations and not yet finished transfers
5222	* must be completed in the async I/O thread. */
5223	pCtl->uAsyncIOState = ATA_AIO_PIO;
5224	}
5225	else
5226	{
5227	/* Finished read operation can be handled inline
5228	* in the end of PIO transfer handling code. Linux
5229	* depends on this, as it waits only briefly for
5230	* devices to become ready after incoming data
5231	* transfer. Cannot find anything in the ATA spec
5232	* that backs this assumption, but as all kernels
5233	* are affected (though most of the time it does
5234	* not cause any harm) this must work. */
5235	pCtl->uAsyncIOState = ATA_AIO_NEW;
5236	}
5237	}
5238	else
5239	{
5240	Assert(s->uTxDir == PDMBLOCKTXDIR_NONE); /* Any transfer which has an initial transfer size of 0 must be marked as such. */
5241	/* Finish PIO transfer. */
5242	ataPIOTransfer(pCtl);
5243	Assert(!pCtl->fRedo);
5244	if (!s->fATAPITransfer)
5245	ataSetIRQ(s);
5246	pCtl->uAsyncIOState = ATA_AIO_NEW;
5247	}
5248	}
5249	break;
5250
5251	case ATA_AIO_DMA:
5252	{
5253	BMDMAState *bm = &pCtl->BmDma;
5254	s = &pCtl->aIfs[pCtl->iAIOIf]; /* Do not remove or there's an instant crash after loading the saved state */
5255	ATAFNSS iOriginalSourceSink = (ATAFNSS)s->iSourceSink; /* Used by the hack below, but gets reset by then. */
5256
5257	if (s->uTxDir == PDMBLOCKTXDIR_FROM_DEVICE)
5258	AssertRelease(bm->u8Cmd & BM_CMD_WRITE);
5259	else
5260	AssertRelease(!(bm->u8Cmd & BM_CMD_WRITE));
5261
5262	if (RT_LIKELY(!pCtl->fRedo))
5263	{
5264	/* The specs say that the descriptor table must not cross a
5265	* 4K boundary. */
5266	pCtl->pFirstDMADesc = bm->pvAddr;
5267	pCtl->pLastDMADesc = RT_ALIGN_32(bm->pvAddr + 1, _4K) - sizeof(BMDMADesc);
5268	}
5269	ataDMATransfer(pCtl);
5270
5271	if (RT_UNLIKELY(pCtl->fRedo && !pCtl->fReset))
5272	{
5273	LogRel(("PIIX3 ATA: Ctl#%d: redo DMA operation\n", ATACONTROLLER_IDX(pCtl)));
5274	ataAsyncIOPutRequest(pCtl, &g_ataDMARequest);
5275	break;
5276	}
5277
5278	/* The infamous delay IRQ hack. */
5279	if ( iOriginalSourceSink == ATAFN_SS_WRITE_SECTORS
5280	&& s->cbTotalTransfer == 0
5281	&& pCtl->DelayIRQMillies)
5282	{
5283	/* Delay IRQ for writing. Required to get the Win2K
5284	* installation work reliably (otherwise it crashes,
5285	* usually during component install). So far no better
5286	* solution has been found. */
5287	Log(("%s: delay IRQ hack\n", __FUNCTION__));
5288	PDMCritSectLeave(&pCtl->lock);
5289	RTThreadSleep(pCtl->DelayIRQMillies);
5290	PDMCritSectEnter(&pCtl->lock, VINF_SUCCESS);
5291	}
5292
5293	ataUnsetStatus(s, ATA_STAT_DRQ);
5294	Assert(!pCtl->fChainedTransfer);
5295	Assert(s->iSourceSink == ATAFN_SS_NULL);
5296	if (s->fATAPITransfer)
5297	{
5298	s->uATARegNSector = (s->uATARegNSector & ~7) \| ATAPI_INT_REASON_IO \| ATAPI_INT_REASON_CD;
5299	Log2(("%s: Ctl#%d: interrupt reason %#04x\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl), s->uATARegNSector));
5300	s->fATAPITransfer = false;
5301	}
5302	ataSetIRQ(s);
5303	pCtl->uAsyncIOState = ATA_AIO_NEW;
5304	break;
5305	}
5306
5307	case ATA_AIO_PIO:
5308	s = &pCtl->aIfs[pCtl->iAIOIf]; /* Do not remove or there's an instant crash after loading the saved state */
5309
5310	if (s->iSourceSink != ATAFN_SS_NULL)
5311	{
5312	bool fRedo;
5313	Log2(("%s: Ctl#%d: calling source/sink function\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
5314	fRedo = g_apfnSourceSinkFuncs[s->iSourceSink](s);
5315	pCtl->fRedo = fRedo;
5316	if (RT_UNLIKELY(fRedo && !pCtl->fReset))
5317	{
5318	LogRel(("PIIX3 ATA: Ctl#%d: redo PIO operation\n", ATACONTROLLER_IDX(pCtl)));
5319	ataAsyncIOPutRequest(pCtl, &g_ataPIORequest);
5320	break;
5321	}
5322	s->iIOBufferCur = 0;
5323	s->iIOBufferEnd = s->cbElementaryTransfer;
5324	}
5325	else
5326	{
5327	/* Continue a previously started transfer. */
5328	ataUnsetStatus(s, ATA_STAT_BUSY);
5329	ataSetStatus(s, ATA_STAT_READY);
5330	}
5331
5332	/* It is possible that the drives on this controller get RESET
5333	* during the above call to the source/sink function. If that's
5334	* the case, don't restart the transfer and don't finish it the
5335	* usual way. RESET handling took care of all that already.
5336	* Most important: do not change uAsyncIOState. */
5337	if (pCtl->fReset)
5338	break;
5339
5340	if (s->cbTotalTransfer)
5341	{
5342	ataPIOTransfer(pCtl);
5343	ataSetIRQ(s);
5344
5345	if (s->uTxDir == PDMBLOCKTXDIR_TO_DEVICE \|\| s->iSourceSink != ATAFN_SS_NULL)
5346	{
5347	/* Write operations and not yet finished transfers
5348	* must be completed in the async I/O thread. */
5349	pCtl->uAsyncIOState = ATA_AIO_PIO;
5350	}
5351	else
5352	{
5353	/* Finished read operation can be handled inline
5354	* in the end of PIO transfer handling code. Linux
5355	* depends on this, as it waits only briefly for
5356	* devices to become ready after incoming data
5357	* transfer. Cannot find anything in the ATA spec
5358	* that backs this assumption, but as all kernels
5359	* are affected (though most of the time it does
5360	* not cause any harm) this must work. */
5361	pCtl->uAsyncIOState = ATA_AIO_NEW;
5362	}
5363	}
5364	else
5365	{
5366	/* Finish PIO transfer. */
5367	ataPIOTransfer(pCtl);
5368	if ( !pCtl->fChainedTransfer
5369	&& !s->fATAPITransfer
5370	&& s->uTxDir != PDMBLOCKTXDIR_FROM_DEVICE)
5371	{
5372	ataSetIRQ(s);
5373	}
5374	pCtl->uAsyncIOState = ATA_AIO_NEW;
5375	}
5376	break;
5377
5378	case ATA_AIO_RESET_ASSERTED:
5379	pCtl->uAsyncIOState = ATA_AIO_RESET_CLEARED;
5380	ataPIOTransferStop(&pCtl->aIfs[0]);
5381	ataPIOTransferStop(&pCtl->aIfs[1]);
5382	/* Do not change the DMA registers, they are not affected by the
5383	* ATA controller reset logic. It should be sufficient to issue a
5384	* new command, which is now possible as the state is cleared. */
5385	break;
5386
5387	case ATA_AIO_RESET_CLEARED:
5388	pCtl->uAsyncIOState = ATA_AIO_NEW;
5389	pCtl->fReset = false;
5390	/* Ensure that half-completed transfers are not redone. A reset
5391	* cancels the entire transfer, so continuing is wrong. */
5392	pCtl->fRedo = false;
5393	pCtl->fRedoDMALastDesc = false;
5394	LogRel(("PIIX3 ATA: Ctl#%d: finished processing RESET\n",
5395	ATACONTROLLER_IDX(pCtl)));
5396	for (uint32_t i = 0; i < RT_ELEMENTS(pCtl->aIfs); i++)
5397	{
5398	if (pCtl->aIfs[i].fATAPI)
5399	ataSetStatusValue(&pCtl->aIfs[i], 0); /* NOTE: READY is _not_ set */
5400	else
5401	ataSetStatusValue(&pCtl->aIfs[i], ATA_STAT_READY \| ATA_STAT_SEEK);
5402	ataSetSignature(&pCtl->aIfs[i]);
5403	}
5404	break;
5405
5406	case ATA_AIO_ABORT:
5407	/* Abort the current command no matter what. There cannot be
5408	* any command activity on the other drive otherwise using
5409	* one thread per controller wouldn't work at all. */
5410	s = &pCtl->aIfs[pReq->u.a.iIf];
5411
5412	pCtl->uAsyncIOState = ATA_AIO_NEW;
5413	/* Do not change the DMA registers, they are not affected by the
5414	* ATA controller reset logic. It should be sufficient to issue a
5415	* new command, which is now possible as the state is cleared. */
5416	if (pReq->u.a.fResetDrive)
5417	{
5418	ataResetDevice(s);
5419	ataExecuteDeviceDiagnosticSS(s);
5420	}
5421	else
5422	{
5423	/* Stop any pending DMA transfer. */
5424	s->fDMA = false;
5425	ataPIOTransferStop(s);
5426	ataUnsetStatus(s, ATA_STAT_BUSY \| ATA_STAT_DRQ \| ATA_STAT_SEEK \| ATA_STAT_ERR);
5427	ataSetStatus(s, ATA_STAT_READY);
5428	ataSetIRQ(s);
5429	}
5430	break;
5431
5432	default:
5433	AssertMsgFailed(("Undefined async I/O state %d\n", pCtl->uAsyncIOState));
5434	}
5435
5436	ataAsyncIORemoveCurrentRequest(pCtl, ReqType);
5437	pReq = ataAsyncIOGetCurrentRequest(pCtl);
5438
5439	if (pCtl->uAsyncIOState == ATA_AIO_NEW && !pCtl->fChainedTransfer)
5440	{
5441	#if defined(DEBUG) \|\| defined(VBOX_WITH_STATISTICS)
5442	STAM_PROFILE_ADV_STOP(&pCtl->StatAsyncTime, a);
5443	#endif /* DEBUG \|\| VBOX_WITH_STATISTICS */
5444
5445	u64TS = RTTimeNanoTS() - u64TS;
5446	uWait = u64TS / 1000;
5447	Log(("%s: Ctl#%d: LUN#%d finished I/O transaction in %d microseconds\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl), pCtl->aIfs[pCtl->iAIOIf].iLUN, (uint32_t)(uWait)));
5448	/* Mark command as finished. */
5449	pCtl->aIfs[pCtl->iAIOIf].u64CmdTS = 0;
5450
5451	/*
5452	* Release logging of command execution times depends on the
5453	* command type. ATAPI commands often take longer (due to CD/DVD
5454	* spin up time etc.) so the threshold is different.
5455	*/
5456	if (pCtl->aIfs[pCtl->iAIOIf].uATARegCommand != ATA_PACKET)
5457	{
5458	if (uWait > 8 * 1000 * 1000)
5459	{
5460	/*
5461	* Command took longer than 8 seconds. This is close
5462	* enough or over the guest's command timeout, so place
5463	* an entry in the release log to allow tracking such
5464	* timing errors (which are often caused by the host).
5465	*/
5466	LogRel(("PIIX3 ATA: execution time for ATA command %#04x was %d seconds\n", pCtl->aIfs[pCtl->iAIOIf].uATARegCommand, uWait / (1000 * 1000)));
5467	}
5468	}
5469	else
5470	{
5471	if (uWait > 20 * 1000 * 1000)
5472	{
5473	/*
5474	* Command took longer than 20 seconds. This is close
5475	* enough or over the guest's command timeout, so place
5476	* an entry in the release log to allow tracking such
5477	* timing errors (which are often caused by the host).
5478	*/
5479	LogRel(("PIIX3 ATA: execution time for ATAPI command %#04x was %d seconds\n", pCtl->aIfs[pCtl->iAIOIf].aATAPICmd[0], uWait / (1000 * 1000)));
5480	}
5481	}
5482
5483	#if defined(DEBUG) \|\| defined(VBOX_WITH_STATISTICS)
5484	if (uWait < pCtl->StatAsyncMinWait \|\| !pCtl->StatAsyncMinWait)
5485	pCtl->StatAsyncMinWait = uWait;
5486	if (uWait > pCtl->StatAsyncMaxWait)
5487	pCtl->StatAsyncMaxWait = uWait;
5488
5489	STAM_COUNTER_ADD(&pCtl->StatAsyncTimeUS, uWait);
5490	STAM_COUNTER_INC(&pCtl->StatAsyncOps);
5491	#endif /* DEBUG \|\| VBOX_WITH_STATISTICS */
5492	}
5493
5494	PDMCritSectLeave(&pCtl->lock);
5495	}
5496
5497	/* Signal the ultimate idleness. */
5498	RTThreadUserSignal(pCtl->AsyncIOThread);
5499	if (pCtl->fSignalIdle)
5500	PDMDevHlpAsyncNotificationCompleted(pCtl->pDevInsR3);
5501
5502	/* Cleanup the state. */
5503	/* Do not destroy request mutex yet, still needed for proper shutdown. */
5504	pCtl->fShutdown = false;
5505
5506	Log2(("%s: Ctl#%d: return %Rrc\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl), rc));
5507	return rc;
5508	}
5509
5510	#endif /* IN_RING3 */
5511
5512	static uint32_t ataBMDMACmdReadB(PATACONTROLLER pCtl, uint32_t addr)
5513	{
5514	uint32_t val = pCtl->BmDma.u8Cmd;
5515	Log2(("%s: addr=%#06x val=%#04x\n", __FUNCTION__, addr, val));
5516	return val;
5517	}
5518
5519
5520	static void ataBMDMACmdWriteB(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
5521	{
5522	Log2(("%s: addr=%#06x val=%#04x\n", __FUNCTION__, addr, val));
5523	if (!(val & BM_CMD_START))
5524	{
5525	pCtl->BmDma.u8Status &= ~BM_STATUS_DMAING;
5526	pCtl->BmDma.u8Cmd = val & (BM_CMD_START \| BM_CMD_WRITE);
5527	}
5528	else
5529	{
5530	#ifdef IN_RING3
5531	/* Check whether the guest OS wants to change DMA direction in
5532	* mid-flight. Not allowed, according to the PIIX3 specs. */
5533	Assert(!(pCtl->BmDma.u8Status & BM_STATUS_DMAING) \|\| !((val ^ pCtl->BmDma.u8Cmd) & 0x04));
5534	uint8_t uOldBmDmaStatus = pCtl->BmDma.u8Status;
5535	pCtl->BmDma.u8Status \|= BM_STATUS_DMAING;
5536	pCtl->BmDma.u8Cmd = val & (BM_CMD_START \| BM_CMD_WRITE);
5537
5538	/* Do not continue DMA transfers while the RESET line is asserted. */
5539	if (pCtl->fReset)
5540	{
5541	Log2(("%s: Ctl#%d: suppressed continuing DMA transfer as RESET is active\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
5542	return;
5543	}
5544
5545	/* Do not start DMA transfers if there's a PIO transfer going on,
5546	* or if there is already a transfer started on this controller. */
5547	if ( !pCtl->aIfs[pCtl->iSelectedIf].fDMA
5548	\|\| (uOldBmDmaStatus & BM_STATUS_DMAING))
5549	return;
5550
5551	if (pCtl->aIfs[pCtl->iAIOIf].uATARegStatus & ATA_STAT_DRQ)
5552	{
5553	Log2(("%s: Ctl#%d: message to async I/O thread, continuing DMA transfer\n", __FUNCTION__, ATACONTROLLER_IDX(pCtl)));
5554	ataAsyncIOPutRequest(pCtl, &g_ataDMARequest);
5555	}
5556	#else /* !IN_RING3 */
5557	AssertMsgFailed(("DMA START handling is too complicated for GC\n"));
5558	#endif /* IN_RING3 */
5559	}
5560	}
5561
5562	static uint32_t ataBMDMAStatusReadB(PATACONTROLLER pCtl, uint32_t addr)
5563	{
5564	uint32_t val = pCtl->BmDma.u8Status;
5565	Log2(("%s: addr=%#06x val=%#04x\n", __FUNCTION__, addr, val));
5566	return val;
5567	}
5568
5569	static void ataBMDMAStatusWriteB(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
5570	{
5571	Log2(("%s: addr=%#06x val=%#04x\n", __FUNCTION__, addr, val));
5572	pCtl->BmDma.u8Status = (val & (BM_STATUS_D0DMA \| BM_STATUS_D1DMA))
5573	\| (pCtl->BmDma.u8Status & BM_STATUS_DMAING)
5574	\| (pCtl->BmDma.u8Status & ~val & (BM_STATUS_ERROR \| BM_STATUS_INT));
5575	}
5576
5577	static uint32_t ataBMDMAAddrReadL(PATACONTROLLER pCtl, uint32_t addr)
5578	{
5579	uint32_t val = (uint32_t)pCtl->BmDma.pvAddr;
5580	Log2(("%s: addr=%#06x val=%#010x\n", __FUNCTION__, addr, val));
5581	return val;
5582	}
5583
5584	static void ataBMDMAAddrWriteL(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
5585	{
5586	Log2(("%s: addr=%#06x val=%#010x\n", __FUNCTION__, addr, val));
5587	pCtl->BmDma.pvAddr = val & ~3;
5588	}
5589
5590	static void ataBMDMAAddrWriteLowWord(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
5591	{
5592	Log2(("%s: addr=%#06x val=%#010x\n", __FUNCTION__, addr, val));
5593	pCtl->BmDma.pvAddr = (pCtl->BmDma.pvAddr & 0xFFFF0000) \| RT_LOWORD(val & ~3);
5594
5595	}
5596
5597	static void ataBMDMAAddrWriteHighWord(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
5598	{
5599	Log2(("%s: addr=%#06x val=%#010x\n", __FUNCTION__, addr, val));
5600	pCtl->BmDma.pvAddr = (RT_LOWORD(val) << 16) \| RT_LOWORD(pCtl->BmDma.pvAddr);
5601	}
5602
5603	#define VAL(port, size) ( ((port) & 7) \| ((size) << 3) )
5604
5605	/**
5606	* Port I/O Handler for bus master DMA IN operations.
5607	* @see FNIOMIOPORTIN for details.
5608	*/
5609	PDMBOTHCBDECL(int) ataBMDMAIOPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT Port, uint32_t pu32, unsigned cb)
5610	{
5611	uint32_t i = (uint32_t)(uintptr_t)pvUser;
5612	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
5613	PATACONTROLLER pCtl = &pThis->aCts[i];
5614
5615	int rc = PDMCritSectEnter(&pCtl->lock, VINF_IOM_R3_IOPORT_READ);
5616	if (rc != VINF_SUCCESS)
5617	return rc;
5618	switch (VAL(Port, cb))
5619	{
5620	case VAL(0, 1): *pu32 = ataBMDMACmdReadB(pCtl, Port); break;
5621	case VAL(0, 2): *pu32 = ataBMDMACmdReadB(pCtl, Port); break;
5622	case VAL(2, 1): *pu32 = ataBMDMAStatusReadB(pCtl, Port); break;
5623	case VAL(2, 2): *pu32 = ataBMDMAStatusReadB(pCtl, Port); break;
5624	case VAL(4, 4): *pu32 = ataBMDMAAddrReadL(pCtl, Port); break;
5625	case VAL(0, 4):
5626	/* The SCO OpenServer tries to read 4 bytes starting from offset 0. */
5627	*pu32 = ataBMDMACmdReadB(pCtl, Port) \| (ataBMDMAStatusReadB(pCtl, Port) << 16);
5628	break;
5629	default:
5630	AssertMsgFailed(("%s: Unsupported read from port %x size=%d\n", __FUNCTION__, Port, cb));
5631	PDMCritSectLeave(&pCtl->lock);
5632	return VERR_IOM_IOPORT_UNUSED;
5633	}
5634	PDMCritSectLeave(&pCtl->lock);
5635	return rc;
5636	}
5637
5638	/**
5639	* Port I/O Handler for bus master DMA OUT operations.
5640	* @see FNIOMIOPORTOUT for details.
5641	*/
5642	PDMBOTHCBDECL(int) ataBMDMAIOPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t u32, unsigned cb)
5643	{
5644	uint32_t i = (uint32_t)(uintptr_t)pvUser;
5645	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
5646	PATACONTROLLER pCtl = &pThis->aCts[i];
5647
5648	int rc = PDMCritSectEnter(&pCtl->lock, VINF_IOM_R3_IOPORT_WRITE);
5649	if (rc != VINF_SUCCESS)
5650	return rc;
5651	switch (VAL(Port, cb))
5652	{
5653	case VAL(0, 1):
5654	#ifndef IN_RING3
5655	if (u32 & BM_CMD_START)
5656	{
5657	rc = VINF_IOM_R3_IOPORT_WRITE;
5658	break;
5659	}
5660	#endif /* !IN_RING3 */
5661	ataBMDMACmdWriteB(pCtl, Port, u32);
5662	break;
5663	case VAL(2, 1): ataBMDMAStatusWriteB(pCtl, Port, u32); break;
5664	case VAL(4, 4): ataBMDMAAddrWriteL(pCtl, Port, u32); break;
5665	case VAL(4, 2): ataBMDMAAddrWriteLowWord(pCtl, Port, u32); break;
5666	case VAL(6, 2): ataBMDMAAddrWriteHighWord(pCtl, Port, u32); break;
5667	default: AssertMsgFailed(("%s: Unsupported write to port %x size=%d val=%x\n", __FUNCTION__, Port, cb, u32)); break;
5668	}
5669	PDMCritSectLeave(&pCtl->lock);
5670	return rc;
5671	}
5672
5673	#undef VAL
5674
5675	#ifdef IN_RING3
5676
5677	/**
5678	* Callback function for mapping an PCI I/O region.
5679	*
5680	* @return VBox status code.
5681	* @param pPciDev Pointer to PCI device. Use pPciDev->pDevIns to get the device instance.
5682	* @param iRegion The region number.
5683	* @param GCPhysAddress Physical address of the region. If iType is PCI_ADDRESS_SPACE_IO, this is an
5684	* I/O port, else it's a physical address.
5685	* This address is NOT relative to pci_mem_base like earlier!
5686	* @param enmType One of the PCI_ADDRESS_SPACE_* values.
5687	*/
5688	static DECLCALLBACK(int) ataBMDMAIORangeMap(PPCIDEVICE pPciDev, /unsigned/ int iRegion, RTGCPHYS GCPhysAddress, uint32_t cb, PCIADDRESSSPACE enmType)
5689	{
5690	PCIATAState *pThis = PCIDEV_2_PCIATASTATE(pPciDev);
5691	int rc = VINF_SUCCESS;
5692	Assert(enmType == PCI_ADDRESS_SPACE_IO);
5693	Assert(iRegion == 4);
5694	AssertMsg(RT_ALIGN(GCPhysAddress, 8) == GCPhysAddress, ("Expected 8 byte alignment. GCPhysAddress=%#x\n", GCPhysAddress));
5695
5696	/* Register the port range. */
5697	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
5698	{
5699	int rc2 = PDMDevHlpIOPortRegister(pPciDev->pDevIns, (RTIOPORT)GCPhysAddress + i * 8, 8,
5700	(RTHCPTR)(uintptr_t)i, ataBMDMAIOPortWrite, ataBMDMAIOPortRead, NULL, NULL, "ATA Bus Master DMA");
5701	AssertRC(rc2);
5702	if (rc2 < rc)
5703	rc = rc2;
5704
5705	if (pThis->fGCEnabled)
5706	{
5707	rc2 = PDMDevHlpIOPortRegisterRC(pPciDev->pDevIns, (RTIOPORT)GCPhysAddress + i * 8, 8,
5708	(RTGCPTR)i, "ataBMDMAIOPortWrite", "ataBMDMAIOPortRead", NULL, NULL, "ATA Bus Master DMA");
5709	AssertRC(rc2);
5710	if (rc2 < rc)
5711	rc = rc2;
5712	}
5713	if (pThis->fR0Enabled)
5714	{
5715	rc2 = PDMDevHlpIOPortRegisterR0(pPciDev->pDevIns, (RTIOPORT)GCPhysAddress + i * 8, 8,
5716	(RTR0PTR)i, "ataBMDMAIOPortWrite", "ataBMDMAIOPortRead", NULL, NULL, "ATA Bus Master DMA");
5717	AssertRC(rc2);
5718	if (rc2 < rc)
5719	rc = rc2;
5720	}
5721	}
5722	return rc;
5723	}
5724
5725
5726	/* -=-=-=-=-=- PCIATAState::IBase -=-=-=-=-=- */
5727
5728	/**
5729	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
5730	*/
5731	static DECLCALLBACK(void ) ataStatus_QueryInterface(PPDMIBASE pInterface, const char pszIID)
5732	{
5733	PCIATAState *pThis = PDMIBASE_2_PCIATASTATE(pInterface);
5734	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThis->IBase);
5735	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThis->ILeds);
5736	return NULL;
5737	}
5738
5739
5740	/* -=-=-=-=-=- PCIATAState::ILeds -=-=-=-=-=- */
5741
5742	/**
5743	* Gets the pointer to the status LED of a unit.
5744	*
5745	* @returns VBox status code.
5746	* @param pInterface Pointer to the interface structure containing the called function pointer.
5747	* @param iLUN The unit which status LED we desire.
5748	* @param ppLed Where to store the LED pointer.
5749	*/
5750	static DECLCALLBACK(int) ataStatus_QueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
5751	{
5752	PCIATAState *pThis = PDMILEDPORTS_2_PCIATASTATE(pInterface);
5753	if (iLUN < 4)
5754	{
5755	switch (iLUN)
5756	{
5757	case 0: *ppLed = &pThis->aCts[0].aIfs[0].Led; break;
5758	case 1: *ppLed = &pThis->aCts[0].aIfs[1].Led; break;
5759	case 2: *ppLed = &pThis->aCts[1].aIfs[0].Led; break;
5760	case 3: *ppLed = &pThis->aCts[1].aIfs[1].Led; break;
5761	}
5762	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
5763	return VINF_SUCCESS;
5764	}
5765	return VERR_PDM_LUN_NOT_FOUND;
5766	}
5767
5768
5769	/* -=-=-=-=-=- ATADevState::IBase -=-=-=-=-=- */
5770
5771	/**
5772	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
5773	*/
5774	static DECLCALLBACK(void ) ataQueryInterface(PPDMIBASE pInterface, const char pszIID)
5775	{
5776	ATADevState *pIf = PDMIBASE_2_ATASTATE(pInterface);
5777	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pIf->IBase);
5778	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBLOCKPORT, &pIf->IPort);
5779	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMOUNTNOTIFY, &pIf->IMountNotify);
5780	return NULL;
5781	}
5782
5783
5784	/* -=-=-=-=-=- ATADevState::IPort -=-=-=-=-=- */
5785
5786	/**
5787	* @interface_method_impl{PDMIBLOCKPORT,pfnQueryDeviceLocation}
5788	*/
5789	static DECLCALLBACK(int) ataR3QueryDeviceLocation(PPDMIBLOCKPORT pInterface, const char **ppcszController,
5790	uint32_t piInstance, uint32_t piLUN)
5791	{
5792	ATADevState *pIf = PDMIBLOCKPORT_2_ATASTATE(pInterface);
5793	PPDMDEVINS pDevIns = pIf->CTX_SUFF(pDevIns);
5794
5795	AssertPtrReturn(ppcszController, VERR_INVALID_POINTER);
5796	AssertPtrReturn(piInstance, VERR_INVALID_POINTER);
5797	AssertPtrReturn(piLUN, VERR_INVALID_POINTER);
5798
5799	*ppcszController = pDevIns->pReg->szName;
5800	*piInstance = pDevIns->iInstance;
5801	*piLUN = pIf->iLUN;
5802
5803	return VINF_SUCCESS;
5804	}
5805	#endif /* IN_RING3 */
5806
5807
5808	/* -=-=-=-=-=- Wrappers -=-=-=-=-=- */
5809
5810	/**
5811	* Port I/O Handler for primary port range OUT operations.
5812	* @see FNIOMIOPORTOUT for details.
5813	*/
5814	PDMBOTHCBDECL(int) ataIOPortWrite1(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t u32, unsigned cb)
5815	{
5816	uint32_t i = (uint32_t)(uintptr_t)pvUser;
5817	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
5818	PATACONTROLLER pCtl = &pThis->aCts[i];
5819	int rc = VINF_SUCCESS;
5820
5821	Assert(i < 2);
5822
5823	rc = PDMCritSectEnter(&pCtl->lock, VINF_IOM_R3_IOPORT_WRITE);
5824	if (rc != VINF_SUCCESS)
5825	return rc;
5826	if (Port == pCtl->IOPortBase1)
5827	{
5828	/* Writes to the data port may be 16-bit or 32-bit. */
5829	Assert(cb == 2 \|\| cb == 4);
5830	rc = ataDataWrite(pCtl, Port, cb, (const uint8_t *)&u32);
5831	}
5832	else
5833	{
5834	/* Writes to the other command block ports should be 8-bit only. If they
5835	* are not, the high bits are simply discarded. Undocumented, but observed
5836	* on a real PIIX4 system.
5837	*/
5838	if (cb > 1)
5839	Log(("ataIOPortWrite1: suspect write to port %x val=%x size=%d\n", Port, u32, cb));
5840
5841	rc = ataIOPortWriteU8(pCtl, Port, u32);
5842	}
5843	PDMCritSectLeave(&pCtl->lock);
5844	return rc;
5845	}
5846
5847
5848	/**
5849	* Port I/O Handler for primary port range IN operations.
5850	* @see FNIOMIOPORTIN for details.
5851	*/
5852	PDMBOTHCBDECL(int) ataIOPortRead1(PPDMDEVINS pDevIns, void pvUser, RTIOPORT Port, uint32_t pu32, unsigned cb)
5853	{
5854	uint32_t i = (uint32_t)(uintptr_t)pvUser;
5855	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
5856	PATACONTROLLER pCtl = &pThis->aCts[i];
5857	int rc = VINF_SUCCESS;
5858
5859	Assert(i < 2);
5860
5861	rc = PDMCritSectEnter(&pCtl->lock, VINF_IOM_R3_IOPORT_READ);
5862	if (rc != VINF_SUCCESS)
5863	return rc;
5864	if (Port == pCtl->IOPortBase1)
5865	{
5866	/* Reads from the data register may be 16-bit or 32-bit. */
5867	Assert(cb == 2 \|\| cb == 4);
5868	rc = ataDataRead(pCtl, Port, cb, (uint8_t *)pu32);
5869	if (cb == 2)
5870	*pu32 &= 0xffff;
5871	}
5872	else
5873	{
5874	/* Reads from the other command block registers should be 8-bit only.
5875	* If they are not, the low byte is propagated to the high bits.
5876	* Undocumented, but observed on a real PIIX4 system.
5877	*/
5878	rc = ataIOPortReadU8(pCtl, Port, pu32);
5879	if (cb > 1)
5880	{
5881	uint32_t pad;
5882
5883	/* Replicate the 8-bit result into the upper three bytes. */
5884	pad = *pu32 & 0xff;
5885	pad = pad \| (pad << 8);
5886	pad = pad \| (pad << 16);
5887	*pu32 = pad;
5888	Log(("ataIOPortRead1: suspect read from port %x size=%d\n", Port, cb));
5889	}
5890	}
5891	PDMCritSectLeave(&pCtl->lock);
5892	return rc;
5893	}
5894
5895	#ifndef IN_RING0 /** @todo do this in ring-0 as well. */
5896	/**
5897	* Port I/O Handler for primary port range IN string operations.
5898	* @see FNIOMIOPORTINSTRING for details.
5899	*/
5900	PDMBOTHCBDECL(int) ataIOPortReadStr1(PPDMDEVINS pDevIns, void pvUser, RTIOPORT Port, RTGCPTR pGCPtrDst, PRTGCUINTREG pcTransfer, unsigned cb)
5901	{
5902	uint32_t i = (uint32_t)(uintptr_t)pvUser;
5903	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
5904	PATACONTROLLER pCtl = &pThis->aCts[i];
5905	int rc = VINF_SUCCESS;
5906
5907	Assert(i < 2);
5908
5909	rc = PDMCritSectEnter(&pCtl->lock, VINF_IOM_R3_IOPORT_READ);
5910	if (rc != VINF_SUCCESS)
5911	return rc;
5912	if (Port == pCtl->IOPortBase1)
5913	{
5914	uint32_t cTransAvailable, cTransfer = *pcTransfer, cbTransfer;
5915	RTGCPTR GCDst = *pGCPtrDst;
5916	ATADevState *s = &pCtl->aIfs[pCtl->iSelectedIf];
5917	Assert(cb == 2 \|\| cb == 4);
5918
5919	cTransAvailable = (s->iIOBufferPIODataEnd - s->iIOBufferPIODataStart) / cb;
5920	#ifndef IN_RING3
5921	/* Deal with the unlikely case where no data (or not enough for the read length operation) is available; go back to ring 3. */
5922	if (!cTransAvailable)
5923	{
5924	PDMCritSectLeave(&pCtl->lock);
5925	return VINF_IOM_R3_IOPORT_READ;
5926	}
5927	/* The last transfer unit cannot be handled in GC, as it involves thread communication. */
5928	cTransAvailable--;
5929	#endif /* !IN_RING3 */
5930	/* Do not handle the dummy transfer stuff here, leave it to the single-word transfers.
5931	* They are not performance-critical and generally shouldn't occur at all. */
5932	if (cTransAvailable > cTransfer)
5933	cTransAvailable = cTransfer;
5934	cbTransfer = cTransAvailable * cb;
5935
5936	rc = PGMPhysSimpleDirtyWriteGCPtr(PDMDevHlpGetVMCPU(pDevIns), GCDst, s->CTX_SUFF(pbIOBuffer) + s->iIOBufferPIODataStart, cbTransfer);
5937	#ifndef IN_RING3
5938	/* Paranoia. */
5939	if (RT_FAILURE(rc))
5940	{
5941	PDMCritSectLeave(&pCtl->lock);
5942	AssertFailed();
5943	return VINF_IOM_R3_IOPORT_READ;
5944	}
5945	#else
5946	Assert(rc == VINF_SUCCESS);
5947	#endif
5948
5949	if (cbTransfer)
5950	Log3(("%s: addr=%#x val=%.*Rhxs\n", __FUNCTION__, Port, cbTransfer, s->CTX_SUFF(pbIOBuffer) + s->iIOBufferPIODataStart));
5951	s->iIOBufferPIODataStart += cbTransfer;
5952	*pGCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCDst + cbTransfer);
5953	*pcTransfer = cTransfer - cTransAvailable;
5954	#ifdef IN_RING3
5955	if (s->iIOBufferPIODataStart >= s->iIOBufferPIODataEnd)
5956	ataPIOTransferFinish(pCtl, s);
5957	#endif /* IN_RING3 */
5958	}
5959	PDMCritSectLeave(&pCtl->lock);
5960	return rc;
5961	}
5962
5963
5964	/**
5965	* Port I/O Handler for primary port range OUT string operations.
5966	* @see FNIOMIOPORTOUTSTRING for details.
5967	*/
5968	PDMBOTHCBDECL(int) ataIOPortWriteStr1(PPDMDEVINS pDevIns, void pvUser, RTIOPORT Port, RTGCPTR pGCPtrSrc, PRTGCUINTREG pcTransfer, unsigned cb)
5969	{
5970	uint32_t i = (uint32_t)(uintptr_t)pvUser;
5971	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
5972	PATACONTROLLER pCtl = &pThis->aCts[i];
5973	int rc;
5974
5975	Assert(i < 2);
5976
5977	rc = PDMCritSectEnter(&pCtl->lock, VINF_IOM_R3_IOPORT_WRITE);
5978	if (rc != VINF_SUCCESS)
5979	return rc;
5980	if (Port == pCtl->IOPortBase1)
5981	{
5982	uint32_t cTransAvailable, cTransfer = *pcTransfer, cbTransfer;
5983	RTGCPTR GCSrc = *pGCPtrSrc;
5984	ATADevState *s = &pCtl->aIfs[pCtl->iSelectedIf];
5985	Assert(cb == 2 \|\| cb == 4);
5986
5987	cTransAvailable = (s->iIOBufferPIODataEnd - s->iIOBufferPIODataStart) / cb;
5988	#ifndef IN_RING3
5989	/* Deal with the unlikely case where no data (or not enough for the read length operation) is available; go back to ring 3. */
5990	if (!cTransAvailable)
5991	{
5992	PDMCritSectLeave(&pCtl->lock);
5993	return VINF_IOM_R3_IOPORT_WRITE;
5994	}
5995	/* The last transfer unit cannot be handled in GC, as it involves thread communication. */
5996	cTransAvailable--;
5997	#endif /* !IN_RING3 */
5998	/* Do not handle the dummy transfer stuff here, leave it to the single-word transfers.
5999	* They are not performance-critical and generally shouldn't occur at all. */
6000	if (cTransAvailable > cTransfer)
6001	cTransAvailable = cTransfer;
6002	cbTransfer = cTransAvailable * cb;
6003
6004	rc = PGMPhysSimpleReadGCPtr(PDMDevHlpGetVMCPU(pDevIns), s->CTX_SUFF(pbIOBuffer) + s->iIOBufferPIODataStart, GCSrc, cbTransfer);
6005	#ifndef IN_RING3
6006	/* Paranoia. */
6007	if (RT_FAILURE(rc))
6008	{
6009	PDMCritSectLeave(&pCtl->lock);
6010	AssertFailed();
6011	return VINF_IOM_R3_IOPORT_WRITE;
6012	}
6013	#else
6014	Assert(rc == VINF_SUCCESS);
6015	#endif
6016
6017	if (cbTransfer)
6018	Log3(("%s: addr=%#x val=%.*Rhxs\n", __FUNCTION__, Port, cbTransfer, s->CTX_SUFF(pbIOBuffer) + s->iIOBufferPIODataStart));
6019	s->iIOBufferPIODataStart += cbTransfer;
6020	*pGCPtrSrc = (RTGCPTR)((RTGCUINTPTR)GCSrc + cbTransfer);
6021	*pcTransfer = cTransfer - cTransAvailable;
6022	#ifdef IN_RING3
6023	if (s->iIOBufferPIODataStart >= s->iIOBufferPIODataEnd)
6024	ataPIOTransferFinish(pCtl, s);
6025	#endif /* IN_RING3 */
6026	}
6027	PDMCritSectLeave(&pCtl->lock);
6028	return rc;
6029	}
6030	#endif /* !IN_RING0 */
6031
6032	/**
6033	* Port I/O Handler for secondary port range OUT operations.
6034	* @see FNIOMIOPORTOUT for details.
6035	*/
6036	PDMBOTHCBDECL(int) ataIOPortWrite2(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t u32, unsigned cb)
6037	{
6038	uint32_t i = (uint32_t)(uintptr_t)pvUser;
6039	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6040	PATACONTROLLER pCtl = &pThis->aCts[i];
6041	int rc;
6042
6043	Assert(i < 2);
6044
6045	if (cb != 1)
6046	return VINF_SUCCESS;
6047	rc = PDMCritSectEnter(&pCtl->lock, VINF_IOM_R3_IOPORT_WRITE);
6048	if (rc != VINF_SUCCESS)
6049	return rc;
6050	rc = ataControlWrite(pCtl, Port, u32);
6051	PDMCritSectLeave(&pCtl->lock);
6052	return rc;
6053	}
6054
6055
6056	/**
6057	* Port I/O Handler for secondary port range IN operations.
6058	* @see FNIOMIOPORTIN for details.
6059	*/
6060	PDMBOTHCBDECL(int) ataIOPortRead2(PPDMDEVINS pDevIns, void pvUser, RTIOPORT Port, uint32_t pu32, unsigned cb)
6061	{
6062	uint32_t i = (uint32_t)(uintptr_t)pvUser;
6063	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6064	PATACONTROLLER pCtl = &pThis->aCts[i];
6065	int rc;
6066
6067	Assert(i < 2);
6068
6069	if (cb != 1)
6070	return VERR_IOM_IOPORT_UNUSED;
6071
6072	rc = PDMCritSectEnter(&pCtl->lock, VINF_IOM_R3_IOPORT_READ);
6073	if (rc != VINF_SUCCESS)
6074	return rc;
6075	*pu32 = ataStatusRead(pCtl, Port);
6076	PDMCritSectLeave(&pCtl->lock);
6077	return VINF_SUCCESS;
6078	}
6079
6080	#ifdef IN_RING3
6081
6082
6083	DECLINLINE(void) ataRelocBuffer(PPDMDEVINS pDevIns, ATADevState *s)
6084	{
6085	if (s->pbIOBufferR3)
6086	s->pbIOBufferRC = MMHyperR3ToRC(PDMDevHlpGetVM(pDevIns), s->pbIOBufferR3);
6087	}
6088
6089
6090	/**
6091	* Detach notification.
6092	*
6093	* The DVD drive has been unplugged.
6094	*
6095	* @param pDevIns The device instance.
6096	* @param iLUN The logical unit which is being detached.
6097	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
6098	*/
6099	static DECLCALLBACK(void) ataR3Detach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
6100	{
6101	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6102	PATACONTROLLER pCtl;
6103	ATADevState *pIf;
6104	unsigned iController;
6105	unsigned iInterface;
6106
6107	AssertMsg(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
6108	("PIIX3IDE: Device does not support hotplugging\n"));
6109
6110	/*
6111	* Locate the controller and stuff.
6112	*/
6113	iController = iLUN / RT_ELEMENTS(pThis->aCts[0].aIfs);
6114	AssertReleaseMsg(iController < RT_ELEMENTS(pThis->aCts), ("iController=%d iLUN=%d\n", iController, iLUN));
6115	pCtl = &pThis->aCts[iController];
6116
6117	iInterface = iLUN % RT_ELEMENTS(pThis->aCts[0].aIfs);
6118	pIf = &pCtl->aIfs[iInterface];
6119
6120	/*
6121	* Zero some important members.
6122	*/
6123	pIf->pDrvBase = NULL;
6124	pIf->pDrvBlock = NULL;
6125	pIf->pDrvBlockBios = NULL;
6126	pIf->pDrvMount = NULL;
6127
6128	/*
6129	* In case there was a medium inserted.
6130	*/
6131	ataMediumRemoved(pIf);
6132	}
6133
6134
6135	/**
6136	* Configure a LUN.
6137	*
6138	* @returns VBox status code.
6139	* @param pDevIns The device instance.
6140	* @param pIf The ATA unit state.
6141	*/
6142	static int ataConfigLun(PPDMDEVINS pDevIns, ATADevState *pIf)
6143	{
6144	int rc = VINF_SUCCESS;
6145	PDMBLOCKTYPE enmType;
6146
6147	/*
6148	* Query Block, Bios and Mount interfaces.
6149	*/
6150	pIf->pDrvBlock = PDMIBASE_QUERY_INTERFACE(pIf->pDrvBase, PDMIBLOCK);
6151	if (!pIf->pDrvBlock)
6152	{
6153	AssertMsgFailed(("Configuration error: LUN#%d hasn't a block interface!\n", pIf->iLUN));
6154	return VERR_PDM_MISSING_INTERFACE;
6155	}
6156
6157	/** @todo implement the BIOS invisible code path. */
6158	pIf->pDrvBlockBios = PDMIBASE_QUERY_INTERFACE(pIf->pDrvBase, PDMIBLOCKBIOS);
6159	if (!pIf->pDrvBlockBios)
6160	{
6161	AssertMsgFailed(("Configuration error: LUN#%d hasn't a block BIOS interface!\n", pIf->iLUN));
6162	return VERR_PDM_MISSING_INTERFACE;
6163	}
6164	pIf->pDrvMount = PDMIBASE_QUERY_INTERFACE(pIf->pDrvBase, PDMIMOUNT);
6165
6166	/*
6167	* Validate type.
6168	*/
6169	enmType = pIf->pDrvBlock->pfnGetType(pIf->pDrvBlock);
6170	if ( enmType != PDMBLOCKTYPE_CDROM
6171	&& enmType != PDMBLOCKTYPE_DVD
6172	&& enmType != PDMBLOCKTYPE_HARD_DISK)
6173	{
6174	AssertMsgFailed(("Configuration error: LUN#%d isn't a disk or cd/dvd-rom. enmType=%d\n", pIf->iLUN, enmType));
6175	return VERR_PDM_UNSUPPORTED_BLOCK_TYPE;
6176	}
6177	if ( ( enmType == PDMBLOCKTYPE_DVD
6178	\|\| enmType == PDMBLOCKTYPE_CDROM)
6179	&& !pIf->pDrvMount)
6180	{
6181	AssertMsgFailed(("Internal error: cdrom without a mountable interface, WTF???!\n"));
6182	return VERR_INTERNAL_ERROR;
6183	}
6184	pIf->fATAPI = enmType == PDMBLOCKTYPE_DVD \|\| enmType == PDMBLOCKTYPE_CDROM;
6185	pIf->fATAPIPassthrough = pIf->fATAPI ? (pIf->pDrvBlock->pfnSendCmd != NULL) : false;
6186
6187	/*
6188	* Allocate I/O buffer.
6189	*/
6190	PVM pVM = PDMDevHlpGetVM(pDevIns);
6191	if (pIf->cbIOBuffer)
6192	{
6193	/* Buffer is (probably) already allocated. Validate the fields,
6194	* because memory corruption can also overwrite pIf->cbIOBuffer. */
6195	if (pIf->fATAPI)
6196	AssertRelease(pIf->cbIOBuffer == _128K);
6197	else
6198	AssertRelease(pIf->cbIOBuffer == ATA_MAX_MULT_SECTORS * 512);
6199	Assert(pIf->pbIOBufferR3);
6200	Assert(pIf->pbIOBufferR0 == MMHyperR3ToR0(pVM, pIf->pbIOBufferR3));
6201	Assert(pIf->pbIOBufferRC == MMHyperR3ToRC(pVM, pIf->pbIOBufferR3));
6202	}
6203	else
6204	{
6205	if (pIf->fATAPI)
6206	pIf->cbIOBuffer = _128K;
6207	else
6208	pIf->cbIOBuffer = ATA_MAX_MULT_SECTORS * 512;
6209	Assert(!pIf->pbIOBufferR3);
6210	rc = MMR3HyperAllocOnceNoRel(pVM, pIf->cbIOBuffer, 0, MM_TAG_PDM_DEVICE_USER, (void **)&pIf->pbIOBufferR3);
6211	if (RT_FAILURE(rc))
6212	return VERR_NO_MEMORY;
6213	pIf->pbIOBufferR0 = MMHyperR3ToR0(pVM, pIf->pbIOBufferR3);
6214	pIf->pbIOBufferRC = MMHyperR3ToRC(pVM, pIf->pbIOBufferR3);
6215	}
6216
6217	/*
6218	* Init geometry (only for non-CD/DVD media).
6219	*/
6220	if (pIf->fATAPI)
6221	{
6222	pIf->cTotalSectors = pIf->pDrvBlock->pfnGetSize(pIf->pDrvBlock) / 2048;
6223	pIf->PCHSGeometry.cCylinders = 0; /* dummy */
6224	pIf->PCHSGeometry.cHeads = 0; /* dummy */
6225	pIf->PCHSGeometry.cSectors = 0; /* dummy */
6226	LogRel(("PIIX3 ATA: LUN#%d: CD/DVD, total number of sectors %Ld, passthrough %s\n", pIf->iLUN, pIf->cTotalSectors, (pIf->fATAPIPassthrough ? "enabled" : "disabled")));
6227	}
6228	else
6229	{
6230	pIf->cTotalSectors = pIf->pDrvBlock->pfnGetSize(pIf->pDrvBlock) / 512;
6231	rc = pIf->pDrvBlockBios->pfnGetPCHSGeometry(pIf->pDrvBlockBios,
6232	&pIf->PCHSGeometry);
6233	if (rc == VERR_PDM_MEDIA_NOT_MOUNTED)
6234	{
6235	pIf->PCHSGeometry.cCylinders = 0;
6236	pIf->PCHSGeometry.cHeads = 16; /??/
6237	pIf->PCHSGeometry.cSectors = 63; /??/
6238	}
6239	else if (rc == VERR_PDM_GEOMETRY_NOT_SET)
6240	{
6241	pIf->PCHSGeometry.cCylinders = 0; /* autodetect marker */
6242	rc = VINF_SUCCESS;
6243	}
6244	AssertRC(rc);
6245
6246	if ( pIf->PCHSGeometry.cCylinders == 0
6247	\|\| pIf->PCHSGeometry.cHeads == 0
6248	\|\| pIf->PCHSGeometry.cSectors == 0
6249	)
6250	{
6251	uint64_t cCylinders = pIf->cTotalSectors / (16 * 63);
6252	pIf->PCHSGeometry.cCylinders = RT_MAX(RT_MIN(cCylinders, 16383), 1);
6253	pIf->PCHSGeometry.cHeads = 16;
6254	pIf->PCHSGeometry.cSectors = 63;
6255	/* Set the disk geometry information. Ignore errors. */
6256	pIf->pDrvBlockBios->pfnSetPCHSGeometry(pIf->pDrvBlockBios,
6257	&pIf->PCHSGeometry);
6258	rc = VINF_SUCCESS;
6259	}
6260	LogRel(("PIIX3 ATA: LUN#%d: disk, PCHS=%u/%u/%u, total number of sectors %Ld\n", pIf->iLUN, pIf->PCHSGeometry.cCylinders, pIf->PCHSGeometry.cHeads, pIf->PCHSGeometry.cSectors, pIf->cTotalSectors));
6261
6262	if (pIf->pDrvBlock->pfnDiscard)
6263	LogRel(("PIIX3 ATA: LUN#%d: TRIM enabled\n", pIf->iLUN));
6264	}
6265	return rc;
6266	}
6267
6268
6269	/**
6270	* Attach command.
6271	*
6272	* This is called when we change block driver for the DVD drive.
6273	*
6274	* @returns VBox status code.
6275	* @param pDevIns The device instance.
6276	* @param iLUN The logical unit which is being detached.
6277	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
6278	*/
6279	static DECLCALLBACK(int) ataR3Attach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
6280	{
6281	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6282	PATACONTROLLER pCtl;
6283	ATADevState *pIf;
6284	int rc;
6285	unsigned iController;
6286	unsigned iInterface;
6287
6288	AssertMsgReturn(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
6289	("PIIX3IDE: Device does not support hotplugging\n"),
6290	VERR_INVALID_PARAMETER);
6291
6292	/*
6293	* Locate the controller and stuff.
6294	*/
6295	iController = iLUN / RT_ELEMENTS(pThis->aCts[0].aIfs);
6296	AssertReleaseMsg(iController < RT_ELEMENTS(pThis->aCts), ("iController=%d iLUN=%d\n", iController, iLUN));
6297	pCtl = &pThis->aCts[iController];
6298
6299	iInterface = iLUN % RT_ELEMENTS(pThis->aCts[0].aIfs);
6300	pIf = &pCtl->aIfs[iInterface];
6301
6302	/* the usual paranoia */
6303	AssertRelease(!pIf->pDrvBase);
6304	AssertRelease(!pIf->pDrvBlock);
6305	Assert(ATADEVSTATE_2_CONTROLLER(pIf) == pCtl);
6306	Assert(pIf->iLUN == iLUN);
6307
6308	/*
6309	* Try attach the block device and get the interfaces,
6310	* required as well as optional.
6311	*/
6312	rc = PDMDevHlpDriverAttach(pDevIns, pIf->iLUN, &pIf->IBase, &pIf->pDrvBase, NULL);
6313	if (RT_SUCCESS(rc))
6314	{
6315	rc = ataConfigLun(pDevIns, pIf);
6316	/*
6317	* In case there is a medium inserted.
6318	*/
6319	ataMediumInserted(pIf);
6320	ataMediumTypeSet(pIf, ATA_MEDIA_TYPE_UNKNOWN);
6321	}
6322	else
6323	AssertMsgFailed(("Failed to attach LUN#%d. rc=%Rrc\n", pIf->iLUN, rc));
6324
6325	if (RT_FAILURE(rc))
6326	{
6327	pIf->pDrvBase = NULL;
6328	pIf->pDrvBlock = NULL;
6329	}
6330	return rc;
6331	}
6332
6333
6334	/**
6335	* Resume notification.
6336	*
6337	* @returns VBox status.
6338	* @param pDevIns The device instance data.
6339	*/
6340	static DECLCALLBACK(void) ataR3Resume(PPDMDEVINS pDevIns)
6341	{
6342	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6343	int rc;
6344
6345	Log(("%s:\n", __FUNCTION__));
6346	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6347	{
6348	if (pThis->aCts[i].fRedo && pThis->aCts[i].fRedoIdle)
6349	{
6350	rc = RTSemEventSignal(pThis->aCts[i].SuspendIOSem);
6351	AssertRC(rc);
6352	}
6353	}
6354	return;
6355	}
6356
6357
6358	/**
6359	* Checks if all (both) the async I/O threads have quiesced.
6360	*
6361	* @returns true on success.
6362	* @returns false when one or more threads is still processing.
6363	* @param pThis Pointer to the instance data.
6364	*/
6365	static bool ataR3AllAsyncIOIsIdle(PPDMDEVINS pDevIns)
6366	{
6367	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6368
6369	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6370	if (pThis->aCts[i].AsyncIOThread != NIL_RTTHREAD)
6371	{
6372	bool fRc = ataAsyncIOIsIdle(&pThis->aCts[i], false /fStrict/);
6373	if (!fRc)
6374	{
6375	/* Make it signal PDM & itself when its done */
6376	RTSemMutexRequest(pThis->aCts[i].AsyncIORequestMutex, RT_INDEFINITE_WAIT);
6377	ASMAtomicWriteBool(&pThis->aCts[i].fSignalIdle, true);
6378	RTSemMutexRelease(pThis->aCts[i].AsyncIORequestMutex);
6379	fRc = ataAsyncIOIsIdle(&pThis->aCts[i], false /fStrict/);
6380	if (!fRc)
6381	{
6382	#if 0 /** @todo Need to do some time tracking here... */
6383	LogRel(("PIIX3 ATA: Ctl#%u is still executing, DevSel=%d AIOIf=%d CmdIf0=%#04x CmdIf1=%#04x\n",
6384	i, pThis->aCts[i].iSelectedIf, pThis->aCts[i].iAIOIf,
6385	pThis->aCts[i].aIfs[0].uATARegCommand, pThis->aCts[i].aIfs[1].uATARegCommand));
6386	#endif
6387	return false;
6388	}
6389	}
6390	ASMAtomicWriteBool(&pThis->aCts[i].fSignalIdle, false);
6391	}
6392	return true;
6393	}
6394
6395	/**
6396	* Prepare state save and load operation.
6397	*
6398	* @returns VBox status code.
6399	* @param pDevIns Device instance of the device which registered the data unit.
6400	* @param pSSM SSM operation handle.
6401	*/
6402	static DECLCALLBACK(int) ataSaveLoadPrep(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
6403	{
6404	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6405
6406	/* sanity - the suspend notification will wait on the async stuff. */
6407	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6408	AssertLogRelMsgReturn(ataAsyncIOIsIdle(&pThis->aCts[i], false /fStrict/),
6409	("i=%u\n", i),
6410	VERR_SSM_IDE_ASYNC_TIMEOUT);
6411	return VINF_SUCCESS;
6412	}
6413
6414	/**
6415	* @copydoc FNSSMDEVLIVEEXEC
6416	*/
6417	static DECLCALLBACK(int) ataLiveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass)
6418	{
6419	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6420
6421	SSMR3PutU8(pSSM, pThis->u8Type);
6422	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6423	{
6424	SSMR3PutBool(pSSM, true); /* For controller enabled / disabled. */
6425	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
6426	{
6427	SSMR3PutBool(pSSM, pThis->aCts[i].aIfs[j].pDrvBase != NULL);
6428	SSMR3PutStrZ(pSSM, pThis->aCts[i].aIfs[j].szSerialNumber);
6429	SSMR3PutStrZ(pSSM, pThis->aCts[i].aIfs[j].szFirmwareRevision);
6430	SSMR3PutStrZ(pSSM, pThis->aCts[i].aIfs[j].szModelNumber);
6431	}
6432	}
6433
6434	return VINF_SSM_DONT_CALL_AGAIN;
6435	}
6436
6437	/**
6438	* @copydoc FNSSMDEVSAVEEXEC
6439	*/
6440	static DECLCALLBACK(int) ataSaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
6441	{
6442	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6443
6444	ataLiveExec(pDevIns, pSSM, SSM_PASS_FINAL);
6445
6446	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6447	{
6448	SSMR3PutU8(pSSM, pThis->aCts[i].iSelectedIf);
6449	SSMR3PutU8(pSSM, pThis->aCts[i].iAIOIf);
6450	SSMR3PutU8(pSSM, pThis->aCts[i].uAsyncIOState);
6451	SSMR3PutBool(pSSM, pThis->aCts[i].fChainedTransfer);
6452	SSMR3PutBool(pSSM, pThis->aCts[i].fReset);
6453	SSMR3PutBool(pSSM, pThis->aCts[i].fRedo);
6454	SSMR3PutBool(pSSM, pThis->aCts[i].fRedoIdle);
6455	SSMR3PutBool(pSSM, pThis->aCts[i].fRedoDMALastDesc);
6456	SSMR3PutMem(pSSM, &pThis->aCts[i].BmDma, sizeof(pThis->aCts[i].BmDma));
6457	SSMR3PutGCPhys32(pSSM, pThis->aCts[i].pFirstDMADesc);
6458	SSMR3PutGCPhys32(pSSM, pThis->aCts[i].pLastDMADesc);
6459	SSMR3PutGCPhys32(pSSM, pThis->aCts[i].pRedoDMABuffer);
6460	SSMR3PutU32(pSSM, pThis->aCts[i].cbRedoDMABuffer);
6461
6462	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
6463	{
6464	SSMR3PutBool(pSSM, pThis->aCts[i].aIfs[j].fLBA48);
6465	SSMR3PutBool(pSSM, pThis->aCts[i].aIfs[j].fATAPI);
6466	SSMR3PutBool(pSSM, pThis->aCts[i].aIfs[j].fIrqPending);
6467	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].cMultSectors);
6468	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].PCHSGeometry.cCylinders);
6469	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].PCHSGeometry.cHeads);
6470	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].PCHSGeometry.cSectors);
6471	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].cSectorsPerIRQ);
6472	SSMR3PutU64(pSSM, pThis->aCts[i].aIfs[j].cTotalSectors);
6473	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegFeature);
6474	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegFeatureHOB);
6475	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegError);
6476	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegNSector);
6477	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegNSectorHOB);
6478	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegSector);
6479	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegSectorHOB);
6480	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegLCyl);
6481	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegLCylHOB);
6482	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegHCyl);
6483	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegHCylHOB);
6484	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegSelect);
6485	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegStatus);
6486	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegCommand);
6487	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegDevCtl);
6488	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uATATransferMode);
6489	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].uTxDir);
6490	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].iBeginTransfer);
6491	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].iSourceSink);
6492	SSMR3PutBool(pSSM, pThis->aCts[i].aIfs[j].fDMA);
6493	SSMR3PutBool(pSSM, pThis->aCts[i].aIfs[j].fATAPITransfer);
6494	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].cbTotalTransfer);
6495	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].cbElementaryTransfer);
6496	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].iIOBufferCur);
6497	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].iIOBufferEnd);
6498	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].iIOBufferPIODataStart);
6499	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].iIOBufferPIODataEnd);
6500	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].iATAPILBA);
6501	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].cbATAPISector);
6502	SSMR3PutMem(pSSM, &pThis->aCts[i].aIfs[j].aATAPICmd, sizeof(pThis->aCts[i].aIfs[j].aATAPICmd));
6503	SSMR3PutMem(pSSM, &pThis->aCts[i].aIfs[j].abATAPISense, sizeof(pThis->aCts[i].aIfs[j].abATAPISense));
6504	SSMR3PutU8(pSSM, pThis->aCts[i].aIfs[j].cNotifiedMediaChange);
6505	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].MediaEventStatus);
6506	SSMR3PutMem(pSSM, &pThis->aCts[i].aIfs[j].Led, sizeof(pThis->aCts[i].aIfs[j].Led));
6507	SSMR3PutU32(pSSM, pThis->aCts[i].aIfs[j].cbIOBuffer);
6508	if (pThis->aCts[i].aIfs[j].cbIOBuffer)
6509	SSMR3PutMem(pSSM, pThis->aCts[i].aIfs[j].CTX_SUFF(pbIOBuffer), pThis->aCts[i].aIfs[j].cbIOBuffer);
6510	else
6511	Assert(pThis->aCts[i].aIfs[j].CTX_SUFF(pbIOBuffer) == NULL);
6512	}
6513	}
6514
6515	return SSMR3PutU32(pSSM, ~0); /* sanity/terminator */
6516	}
6517
6518	/**
6519	* Converts the LUN number into a message string.
6520	*/
6521	static const char *ataStringifyLun(unsigned iLun)
6522	{
6523	switch (iLun)
6524	{
6525	case 0: return "primary master";
6526	case 1: return "primary slave";
6527	case 2: return "secondary master";
6528	case 3: return "secondary slave";
6529	default: AssertFailedReturn("unknown lun");
6530	}
6531	}
6532
6533	/**
6534	* FNSSMDEVLOADEXEC
6535	*/
6536	static DECLCALLBACK(int) ataLoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
6537	{
6538	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6539	int rc;
6540	uint32_t u32;
6541
6542	if ( uVersion != ATA_SAVED_STATE_VERSION
6543	&& uVersion != ATA_SAVED_STATE_VERSION_VBOX_30
6544	&& uVersion != ATA_SAVED_STATE_VERSION_WITHOUT_FULL_SENSE
6545	&& uVersion != ATA_SAVED_STATE_VERSION_WITHOUT_EVENT_STATUS
6546	&& uVersion != ATA_SAVED_STATE_VERSION_WITH_BOOL_TYPE)
6547	{
6548	AssertMsgFailed(("uVersion=%d\n", uVersion));
6549	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
6550	}
6551
6552	/*
6553	* Verify the configuration.
6554	*/
6555	if (uVersion > ATA_SAVED_STATE_VERSION_VBOX_30)
6556	{
6557	uint8_t u8Type;
6558	rc = SSMR3GetU8(pSSM, &u8Type);
6559	AssertRCReturn(rc, rc);
6560	if (u8Type != pThis->u8Type)
6561	return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("Config mismatch: u8Type - saved=%u config=%u"), u8Type, pThis->u8Type);
6562
6563	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6564	{
6565	bool fEnabled;
6566	rc = SSMR3GetBool(pSSM, &fEnabled);
6567	AssertRCReturn(rc, rc);
6568	if (!fEnabled)
6569	return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("Ctr#%u onfig mismatch: fEnabled != true"), i);
6570
6571	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
6572	{
6573	ATADevState const *pIf = &pThis->aCts[i].aIfs[j];
6574
6575	bool fInUse;
6576	rc = SSMR3GetBool(pSSM, &fInUse);
6577	AssertRCReturn(rc, rc);
6578	if (fInUse != (pIf->pDrvBase != NULL))
6579	return SSMR3SetCfgError(pSSM, RT_SRC_POS,
6580	N_("The %s VM is missing a %s device. Please make sure the source and target VMs have compatible storage configurations"),
6581	fInUse ? "target" : "source", ataStringifyLun(pIf->iLUN) );
6582
6583	char szSerialNumber[ATA_SERIAL_NUMBER_LENGTH+1];
6584	rc = SSMR3GetStrZ(pSSM, szSerialNumber, sizeof(szSerialNumber));
6585	AssertRCReturn(rc, rc);
6586	if (strcmp(szSerialNumber, pIf->szSerialNumber))
6587	LogRel(("PIIX3 ATA: LUN#%u config mismatch: Serial number - saved='%s' config='%s'\n",
6588	pIf->iLUN, szSerialNumber, pIf->szSerialNumber));
6589
6590	char szFirmwareRevision[ATA_FIRMWARE_REVISION_LENGTH+1];
6591	rc = SSMR3GetStrZ(pSSM, szFirmwareRevision, sizeof(szFirmwareRevision));
6592	AssertRCReturn(rc, rc);
6593	if (strcmp(szFirmwareRevision, pIf->szFirmwareRevision))
6594	LogRel(("PIIX3 ATA: LUN#%u config mismatch: Firmware revision - saved='%s' config='%s'\n",
6595	pIf->iLUN, szFirmwareRevision, pIf->szFirmwareRevision));
6596
6597	char szModelNumber[ATA_MODEL_NUMBER_LENGTH+1];
6598	rc = SSMR3GetStrZ(pSSM, szModelNumber, sizeof(szModelNumber));
6599	AssertRCReturn(rc, rc);
6600	if (strcmp(szModelNumber, pIf->szModelNumber))
6601	LogRel(("PIIX3 ATA: LUN#%u config mismatch: Model number - saved='%s' config='%s'\n",
6602	pIf->iLUN, szModelNumber, pIf->szModelNumber));
6603	}
6604	}
6605	}
6606	if (uPass != SSM_PASS_FINAL)
6607	return VINF_SUCCESS;
6608
6609	/*
6610	* Restore valid parts of the PCIATAState structure
6611	*/
6612	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6613	{
6614	/* integrity check */
6615	if (!ataAsyncIOIsIdle(&pThis->aCts[i], false))
6616	{
6617	AssertMsgFailed(("Async I/O for controller %d is active\n", i));
6618	return VERR_INTERNAL_ERROR_4;
6619	}
6620
6621	SSMR3GetU8(pSSM, &pThis->aCts[i].iSelectedIf);
6622	SSMR3GetU8(pSSM, &pThis->aCts[i].iAIOIf);
6623	SSMR3GetU8(pSSM, &pThis->aCts[i].uAsyncIOState);
6624	SSMR3GetBool(pSSM, &pThis->aCts[i].fChainedTransfer);
6625	SSMR3GetBool(pSSM, (bool *)&pThis->aCts[i].fReset);
6626	SSMR3GetBool(pSSM, (bool *)&pThis->aCts[i].fRedo);
6627	SSMR3GetBool(pSSM, (bool *)&pThis->aCts[i].fRedoIdle);
6628	SSMR3GetBool(pSSM, (bool *)&pThis->aCts[i].fRedoDMALastDesc);
6629	SSMR3GetMem(pSSM, &pThis->aCts[i].BmDma, sizeof(pThis->aCts[i].BmDma));
6630	SSMR3GetGCPhys32(pSSM, &pThis->aCts[i].pFirstDMADesc);
6631	SSMR3GetGCPhys32(pSSM, &pThis->aCts[i].pLastDMADesc);
6632	SSMR3GetGCPhys32(pSSM, &pThis->aCts[i].pRedoDMABuffer);
6633	SSMR3GetU32(pSSM, &pThis->aCts[i].cbRedoDMABuffer);
6634
6635	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
6636	{
6637	SSMR3GetBool(pSSM, &pThis->aCts[i].aIfs[j].fLBA48);
6638	SSMR3GetBool(pSSM, &pThis->aCts[i].aIfs[j].fATAPI);
6639	SSMR3GetBool(pSSM, &pThis->aCts[i].aIfs[j].fIrqPending);
6640	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].cMultSectors);
6641	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].PCHSGeometry.cCylinders);
6642	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].PCHSGeometry.cHeads);
6643	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].PCHSGeometry.cSectors);
6644	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].cSectorsPerIRQ);
6645	SSMR3GetU64(pSSM, &pThis->aCts[i].aIfs[j].cTotalSectors);
6646	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegFeature);
6647	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegFeatureHOB);
6648	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegError);
6649	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegNSector);
6650	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegNSectorHOB);
6651	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegSector);
6652	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegSectorHOB);
6653	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegLCyl);
6654	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegLCylHOB);
6655	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegHCyl);
6656	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegHCylHOB);
6657	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegSelect);
6658	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegStatus);
6659	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegCommand);
6660	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegDevCtl);
6661	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uATATransferMode);
6662	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].uTxDir);
6663	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].iBeginTransfer);
6664	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].iSourceSink);
6665	SSMR3GetBool(pSSM, &pThis->aCts[i].aIfs[j].fDMA);
6666	SSMR3GetBool(pSSM, &pThis->aCts[i].aIfs[j].fATAPITransfer);
6667	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].cbTotalTransfer);
6668	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].cbElementaryTransfer);
6669	/* NB: cbPIOTransferLimit could be saved/restored but it's sufficient
6670	* to re-calculate it here, with a tiny risk that it could be
6671	* unnecessarily low for the current transfer only. Could be changed
6672	* when changing the saved state in the future.
6673	*/
6674	pThis->aCts[i].aIfs[j].cbPIOTransferLimit = (pThis->aCts[i].aIfs[j].uATARegHCyl << 8) \| pThis->aCts[i].aIfs[j].uATARegLCyl;
6675	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].iIOBufferCur);
6676	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].iIOBufferEnd);
6677	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].iIOBufferPIODataStart);
6678	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].iIOBufferPIODataEnd);
6679	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].iATAPILBA);
6680	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].cbATAPISector);
6681	SSMR3GetMem(pSSM, &pThis->aCts[i].aIfs[j].aATAPICmd, sizeof(pThis->aCts[i].aIfs[j].aATAPICmd));
6682	if (uVersion > ATA_SAVED_STATE_VERSION_WITHOUT_FULL_SENSE)
6683	{
6684	SSMR3GetMem(pSSM, pThis->aCts[i].aIfs[j].abATAPISense, sizeof(pThis->aCts[i].aIfs[j].abATAPISense));
6685	}
6686	else
6687	{
6688	uint8_t uATAPISenseKey, uATAPIASC;
6689	memset(pThis->aCts[i].aIfs[j].abATAPISense, '\0', sizeof(pThis->aCts[i].aIfs[j].abATAPISense));
6690	pThis->aCts[i].aIfs[j].abATAPISense[0] = 0x70 \| (1 << 7);
6691	pThis->aCts[i].aIfs[j].abATAPISense[7] = 10;
6692	SSMR3GetU8(pSSM, &uATAPISenseKey);
6693	SSMR3GetU8(pSSM, &uATAPIASC);
6694	pThis->aCts[i].aIfs[j].abATAPISense[2] = uATAPISenseKey & 0x0f;
6695	pThis->aCts[i].aIfs[j].abATAPISense[12] = uATAPIASC;
6696	}
6697	/** @todo triple-check this hack after passthrough is working */
6698	SSMR3GetU8(pSSM, &pThis->aCts[i].aIfs[j].cNotifiedMediaChange);
6699	if (uVersion > ATA_SAVED_STATE_VERSION_WITHOUT_EVENT_STATUS)
6700	SSMR3GetU32(pSSM, (uint32_t*)&pThis->aCts[i].aIfs[j].MediaEventStatus);
6701	else
6702	pThis->aCts[i].aIfs[j].MediaEventStatus = ATA_EVENT_STATUS_UNCHANGED;
6703	SSMR3GetMem(pSSM, &pThis->aCts[i].aIfs[j].Led, sizeof(pThis->aCts[i].aIfs[j].Led));
6704	SSMR3GetU32(pSSM, &pThis->aCts[i].aIfs[j].cbIOBuffer);
6705	if (pThis->aCts[i].aIfs[j].cbIOBuffer)
6706	{
6707	if (pThis->aCts[i].aIfs[j].CTX_SUFF(pbIOBuffer))
6708	SSMR3GetMem(pSSM, pThis->aCts[i].aIfs[j].CTX_SUFF(pbIOBuffer), pThis->aCts[i].aIfs[j].cbIOBuffer);
6709	else
6710	{
6711	LogRel(("ATA: No buffer for %d/%d\n", i, j));
6712	if (SSMR3HandleGetAfter(pSSM) != SSMAFTER_DEBUG_IT)
6713	return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("No buffer for %d/%d"), i, j);
6714
6715	/* skip the buffer if we're loading for the debugger / animator. */
6716	uint8_t u8Ignored;
6717	size_t cbLeft = pThis->aCts[i].aIfs[j].cbIOBuffer;
6718	while (cbLeft-- > 0)
6719	SSMR3GetU8(pSSM, &u8Ignored);
6720	}
6721	}
6722	else
6723	Assert(pThis->aCts[i].aIfs[j].CTX_SUFF(pbIOBuffer) == NULL);
6724	}
6725	}
6726	if (uVersion <= ATA_SAVED_STATE_VERSION_VBOX_30)
6727	SSMR3GetU8(pSSM, &pThis->u8Type);
6728
6729	rc = SSMR3GetU32(pSSM, &u32);
6730	if (RT_FAILURE(rc))
6731	return rc;
6732	if (u32 != ~0U)
6733	{
6734	AssertMsgFailed(("u32=%#x expected ~0\n", u32));
6735	rc = VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
6736	return rc;
6737	}
6738
6739	return VINF_SUCCESS;
6740	}
6741
6742
6743	/**
6744	* Callback employed by ataSuspend and ataR3PowerOff.
6745	*
6746	* @returns true if we've quiesced, false if we're still working.
6747	* @param pDevIns The device instance.
6748	*/
6749	static DECLCALLBACK(bool) ataR3IsAsyncSuspendOrPowerOffDone(PPDMDEVINS pDevIns)
6750	{
6751	return ataR3AllAsyncIOIsIdle(pDevIns);
6752	}
6753
6754
6755	/**
6756	* Common worker for ataSuspend and ataR3PowerOff.
6757	*/
6758	static void ataR3SuspendOrPowerOff(PPDMDEVINS pDevIns)
6759	{
6760	if (!ataR3AllAsyncIOIsIdle(pDevIns))
6761	PDMDevHlpSetAsyncNotification(pDevIns, ataR3IsAsyncSuspendOrPowerOffDone);
6762	}
6763
6764
6765	/**
6766	* Power Off notification.
6767	*
6768	* @returns VBox status.
6769	* @param pDevIns The device instance data.
6770	*/
6771	static DECLCALLBACK(void) ataR3PowerOff(PPDMDEVINS pDevIns)
6772	{
6773	Log(("%s:\n", __FUNCTION__));
6774	ataR3SuspendOrPowerOff(pDevIns);
6775	}
6776
6777
6778	/**
6779	* Suspend notification.
6780	*
6781	* @returns VBox status.
6782	* @param pDevIns The device instance data.
6783	*/
6784	static DECLCALLBACK(void) ataR3Suspend(PPDMDEVINS pDevIns)
6785	{
6786	Log(("%s:\n", __FUNCTION__));
6787	ataR3SuspendOrPowerOff(pDevIns);
6788	}
6789
6790
6791	/**
6792	* Callback employed by ataR3Reset.
6793	*
6794	* @returns true if we've quiesced, false if we're still working.
6795	* @param pDevIns The device instance.
6796	*/
6797	static DECLCALLBACK(bool) ataR3IsAsyncResetDone(PPDMDEVINS pDevIns)
6798	{
6799	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6800
6801	if (!ataR3AllAsyncIOIsIdle(pDevIns))
6802	return false;
6803
6804	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6805	{
6806	PDMCritSectEnter(&pThis->aCts[i].lock, VERR_INTERNAL_ERROR);
6807	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
6808	ataResetDevice(&pThis->aCts[i].aIfs[j]);
6809	PDMCritSectLeave(&pThis->aCts[i].lock);
6810	}
6811	return true;
6812	}
6813
6814
6815	/**
6816	* Common reset worker for ataR3Reset and ataR3Construct.
6817	*
6818	* @returns VBox status.
6819	* @param pDevIns The device instance data.
6820	* @param fConstruct Indicates who is calling.
6821	*/
6822	static int ataR3ResetCommon(PPDMDEVINS pDevIns, bool fConstruct)
6823	{
6824	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6825
6826	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6827	{
6828	PDMCritSectEnter(&pThis->aCts[i].lock, VERR_INTERNAL_ERROR);
6829
6830	pThis->aCts[i].iSelectedIf = 0;
6831	pThis->aCts[i].iAIOIf = 0;
6832	pThis->aCts[i].BmDma.u8Cmd = 0;
6833	/* Report that both drives present on the bus are in DMA mode. This
6834	* pretends that there is a BIOS that has set it up. Normal reset
6835	* default is 0x00. */
6836	pThis->aCts[i].BmDma.u8Status = (pThis->aCts[i].aIfs[0].pDrvBase != NULL ? BM_STATUS_D0DMA : 0)
6837	\| (pThis->aCts[i].aIfs[1].pDrvBase != NULL ? BM_STATUS_D1DMA : 0);
6838	pThis->aCts[i].BmDma.pvAddr = 0;
6839
6840	pThis->aCts[i].fReset = true;
6841	pThis->aCts[i].fRedo = false;
6842	pThis->aCts[i].fRedoIdle = false;
6843	ataAsyncIOClearRequests(&pThis->aCts[i]);
6844	Log2(("%s: Ctl#%d: message to async I/O thread, reset controller\n", __FUNCTION__, i));
6845	ataAsyncIOPutRequest(&pThis->aCts[i], &g_ataResetARequest);
6846	ataAsyncIOPutRequest(&pThis->aCts[i], &g_ataResetCRequest);
6847
6848	PDMCritSectLeave(&pThis->aCts[i].lock);
6849	}
6850
6851	int rcRet = VINF_SUCCESS;
6852	if (!fConstruct)
6853	{
6854	/*
6855	* Setup asynchronous notification completion if the requests haven't
6856	* completed yet.
6857	*/
6858	if (!ataR3IsAsyncResetDone(pDevIns))
6859	PDMDevHlpSetAsyncNotification(pDevIns, ataR3IsAsyncResetDone);
6860	}
6861	else
6862	{
6863	/*
6864	* Wait for the requests for complete.
6865	*
6866	* Would be real nice if we could do it all from EMT(0) and not
6867	* involve the worker threads, then we could dispense with all the
6868	* waiting and semaphore ping-pong here...
6869	*/
6870	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6871	{
6872	if (pThis->aCts[i].AsyncIOThread != NIL_RTTHREAD)
6873	{
6874	int rc = RTSemMutexRequest(pThis->aCts[i].AsyncIORequestMutex, RT_INDEFINITE_WAIT);
6875	AssertRC(rc);
6876
6877	ASMAtomicWriteBool(&pThis->aCts[i].fSignalIdle, true);
6878	rc = RTThreadUserReset(pThis->aCts[i].AsyncIOThread);
6879	AssertRC(rc);
6880
6881	rc = RTSemMutexRelease(pThis->aCts[i].AsyncIORequestMutex);
6882	AssertRC(rc);
6883
6884	if (!ataAsyncIOIsIdle(&pThis->aCts[i], false /fStrict/))
6885	{
6886	rc = RTThreadUserWait(pThis->aCts[i].AsyncIOThread, 301000 /ms*/);
6887	if (RT_FAILURE(rc))
6888	rc = RTThreadUserWait(pThis->aCts[i].AsyncIOThread, 1000 /ms/);
6889	if (RT_FAILURE(rc))
6890	{
6891	AssertRC(rc);
6892	rcRet = rc;
6893	}
6894	}
6895	}
6896	ASMAtomicWriteBool(&pThis->aCts[i].fSignalIdle, false);
6897	}
6898	if (RT_SUCCESS(rcRet))
6899	{
6900	rcRet = ataR3IsAsyncResetDone(pDevIns) ? VINF_SUCCESS : VERR_INTERNAL_ERROR;
6901	AssertRC(rcRet);
6902	}
6903	}
6904	return rcRet;
6905	}
6906
6907	/**
6908	* Reset notification.
6909	*
6910	* @param pDevIns The device instance data.
6911	*/
6912	static DECLCALLBACK(void) ataR3Reset(PPDMDEVINS pDevIns)
6913	{
6914	ataR3ResetCommon(pDevIns, false /fConstruct/);
6915	}
6916
6917	/**
6918	* @copydoc FNPDMDEVRELOCATE
6919	*/
6920	static DECLCALLBACK(void) ataR3Relocate(PPDMDEVINS pDevIns, RTGCINTPTR offDelta)
6921	{
6922	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6923
6924	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6925	{
6926	pThis->aCts[i].pDevInsRC += offDelta;
6927	pThis->aCts[i].aIfs[0].pDevInsRC += offDelta;
6928	pThis->aCts[i].aIfs[0].pControllerRC += offDelta;
6929	ataRelocBuffer(pDevIns, &pThis->aCts[i].aIfs[0]);
6930	pThis->aCts[i].aIfs[1].pDevInsRC += offDelta;
6931	pThis->aCts[i].aIfs[1].pControllerRC += offDelta;
6932	ataRelocBuffer(pDevIns, &pThis->aCts[i].aIfs[1]);
6933	}
6934	}
6935
6936	/**
6937	* Destroy a driver instance.
6938	*
6939	* Most VM resources are freed by the VM. This callback is provided so that any non-VM
6940	* resources can be freed correctly.
6941	*
6942	* @param pDevIns The device instance data.
6943	*/
6944	static DECLCALLBACK(int) ataR3Destruct(PPDMDEVINS pDevIns)
6945	{
6946	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
6947	int rc;
6948
6949	Log(("ataR3Destruct\n"));
6950	PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
6951
6952	/*
6953	* Tell the async I/O threads to terminate.
6954	*/
6955	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6956	{
6957	if (pThis->aCts[i].AsyncIOThread != NIL_RTTHREAD)
6958	{
6959	ASMAtomicWriteU32(&pThis->aCts[i].fShutdown, true);
6960	rc = RTSemEventSignal(pThis->aCts[i].AsyncIOSem);
6961	AssertRC(rc);
6962	rc = RTSemEventSignal(pThis->aCts[i].SuspendIOSem);
6963	AssertRC(rc);
6964	}
6965	}
6966
6967	/*
6968	* Wait for the threads to terminate before destroying their resources.
6969	*/
6970	for (unsigned i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6971	{
6972	if (pThis->aCts[i].AsyncIOThread != NIL_RTTHREAD)
6973	{
6974	rc = RTThreadWait(pThis->aCts[i].AsyncIOThread, 30000 /* 30 s*/, NULL);
6975	if (RT_SUCCESS(rc))
6976	pThis->aCts[i].AsyncIOThread = NIL_RTTHREAD;
6977	else
6978	LogRel(("PIIX3 ATA Dtor: Ctl#%u is still executing, DevSel=%d AIOIf=%d CmdIf0=%#04x CmdIf1=%#04x rc=%Rrc\n",
6979	i, pThis->aCts[i].iSelectedIf, pThis->aCts[i].iAIOIf,
6980	pThis->aCts[i].aIfs[0].uATARegCommand, pThis->aCts[i].aIfs[1].uATARegCommand, rc));
6981	}
6982	}
6983
6984	/*
6985	* Free resources.
6986	*/
6987	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
6988	{
6989	if (pThis->aCts[i].AsyncIORequestMutex != NIL_RTSEMMUTEX)
6990	{
6991	RTSemMutexDestroy(pThis->aCts[i].AsyncIORequestMutex);
6992	pThis->aCts[i].AsyncIORequestMutex = NIL_RTSEMMUTEX;
6993	}
6994	if (pThis->aCts[i].AsyncIOSem != NIL_RTSEMEVENT)
6995	{
6996	RTSemEventDestroy(pThis->aCts[i].AsyncIOSem);
6997	pThis->aCts[i].AsyncIOSem = NIL_RTSEMEVENT;
6998	}
6999	if (pThis->aCts[i].SuspendIOSem != NIL_RTSEMEVENT)
7000	{
7001	RTSemEventDestroy(pThis->aCts[i].SuspendIOSem);
7002	pThis->aCts[i].SuspendIOSem = NIL_RTSEMEVENT;
7003	}
7004
7005	/* try one final time */
7006	if (pThis->aCts[i].AsyncIOThread != NIL_RTTHREAD)
7007	{
7008	rc = RTThreadWait(pThis->aCts[i].AsyncIOThread, 1 /ms/, NULL);
7009	if (RT_SUCCESS(rc))
7010	{
7011	pThis->aCts[i].AsyncIOThread = NIL_RTTHREAD;
7012	LogRel(("PIIX3 ATA Dtor: Ctl#%u actually completed.\n", i));
7013	}
7014	}
7015
7016	for (uint32_t iIf = 0; iIf < RT_ELEMENTS(pThis->aCts[i].aIfs); iIf++)
7017	{
7018	if (pThis->aCts[i].aIfs[iIf].pTrackList)
7019	{
7020	ATAPIPassthroughTrackListDestroy(pThis->aCts[i].aIfs[iIf].pTrackList);
7021	pThis->aCts[i].aIfs[iIf].pTrackList = NULL;
7022	}
7023	}
7024	}
7025
7026	return VINF_SUCCESS;
7027	}
7028
7029	/**
7030	* Convert config value to DEVPCBIOSBOOT.
7031	*
7032	* @returns VBox status code.
7033	* @param pDevIns The device instance data.
7034	* @param pCfg Configuration handle.
7035	* @param penmChipset Where to store the chipset type.
7036	*/
7037	static int ataControllerFromCfg(PPDMDEVINS pDevIns, PCFGMNODE pCfg, CHIPSET *penmChipset)
7038	{
7039	char szType[20];
7040
7041	int rc = CFGMR3QueryStringDef(pCfg, "Type", &szType[0], sizeof(szType), "PIIX4");
7042	if (RT_FAILURE(rc))
7043	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
7044	N_("Configuration error: Querying \"Type\" as a string failed"));
7045	if (!strcmp(szType, "PIIX3"))
7046	*penmChipset = CHIPSET_PIIX3;
7047	else if (!strcmp(szType, "PIIX4"))
7048	*penmChipset = CHIPSET_PIIX4;
7049	else if (!strcmp(szType, "ICH6"))
7050	*penmChipset = CHIPSET_ICH6;
7051	else
7052	{
7053	PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
7054	N_("Configuration error: The \"Type\" value \"%s\" is unknown"),
7055	szType);
7056	rc = VERR_INTERNAL_ERROR;
7057	}
7058	return rc;
7059	}
7060
7061	/**
7062	* @interface_method_impl{PDMDEVREG,pfnConstruct}
7063	*/
7064	static DECLCALLBACK(int) ataR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
7065	{
7066	PCIATAState pThis = PDMINS_2_DATA(pDevIns, PCIATAState );
7067	PPDMIBASE pBase;
7068	int rc;
7069	bool fGCEnabled;
7070	bool fR0Enabled;
7071	uint32_t DelayIRQMillies;
7072
7073	Assert(iInstance == 0);
7074	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
7075
7076	/*
7077	* Initialize NIL handle values (for the destructor).
7078	*/
7079	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7080	{
7081	pThis->aCts[i].AsyncIOSem = NIL_RTSEMEVENT;
7082	pThis->aCts[i].SuspendIOSem = NIL_RTSEMEVENT;
7083	pThis->aCts[i].AsyncIORequestMutex = NIL_RTSEMMUTEX;
7084	pThis->aCts[i].AsyncIOThread = NIL_RTTHREAD;
7085	}
7086
7087	/*
7088	* Validate and read configuration.
7089	*/
7090	if (!CFGMR3AreValuesValid(pCfg,
7091	"GCEnabled\0"
7092	"R0Enabled\0"
7093	"IRQDelay\0"
7094	"Type\0")
7095	/** @todo \|\| invalid keys */)
7096	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
7097	N_("PIIX3 configuration error: unknown option specified"));
7098
7099	rc = CFGMR3QueryBoolDef(pCfg, "GCEnabled", &fGCEnabled, true);
7100	if (RT_FAILURE(rc))
7101	return PDMDEV_SET_ERROR(pDevIns, rc,
7102	N_("PIIX3 configuration error: failed to read GCEnabled as boolean"));
7103	Log(("%s: fGCEnabled=%d\n", __FUNCTION__, fGCEnabled));
7104
7105	rc = CFGMR3QueryBoolDef(pCfg, "R0Enabled", &fR0Enabled, true);
7106	if (RT_FAILURE(rc))
7107	return PDMDEV_SET_ERROR(pDevIns, rc,
7108	N_("PIIX3 configuration error: failed to read R0Enabled as boolean"));
7109	Log(("%s: fR0Enabled=%d\n", __FUNCTION__, fR0Enabled));
7110
7111	rc = CFGMR3QueryU32Def(pCfg, "IRQDelay", &DelayIRQMillies, 0);
7112	if (RT_FAILURE(rc))
7113	return PDMDEV_SET_ERROR(pDevIns, rc,
7114	N_("PIIX3 configuration error: failed to read IRQDelay as integer"));
7115	Log(("%s: DelayIRQMillies=%d\n", __FUNCTION__, DelayIRQMillies));
7116	Assert(DelayIRQMillies < 50);
7117
7118	CHIPSET enmChipset = CHIPSET_PIIX3;
7119	rc = ataControllerFromCfg(pDevIns, pCfg, &enmChipset);
7120	if (RT_FAILURE(rc))
7121	return rc;
7122	pThis->u8Type = (uint8_t)enmChipset;
7123
7124	/*
7125	* Initialize data (most of it anyway).
7126	*/
7127	/* Status LUN. */
7128	pThis->IBase.pfnQueryInterface = ataStatus_QueryInterface;
7129	pThis->ILeds.pfnQueryStatusLed = ataStatus_QueryStatusLed;
7130
7131	/* PCI configuration space. */
7132	PCIDevSetVendorId(&pThis->dev, 0x8086); /* Intel */
7133
7134	/*
7135	* When adding more IDE chipsets, don't forget to update pci_bios_init_device()
7136	* as it explicitly checks for PCI id for IDE controllers.
7137	*/
7138	switch (pThis->u8Type)
7139	{
7140	case CHIPSET_ICH6:
7141	PCIDevSetDeviceId(&pThis->dev, 0x269e); /* ICH6 IDE */
7142	/** @todo: do we need it? Do we need anything else? */
7143	pThis->dev.config[0x48] = 0x00; /* UDMACTL */
7144	pThis->dev.config[0x4A] = 0x00; /* UDMATIM */
7145	pThis->dev.config[0x4B] = 0x00;
7146	{
7147	/*
7148	* See www.intel.com/Assets/PDF/manual/298600.pdf p. 30
7149	* Report
7150	* WR_Ping-Pong_EN: must be set
7151	* PCR0, PCR1: 80-pin primary cable reporting for both disks
7152	* SCR0, SCR1: 80-pin secondary cable reporting for both disks
7153	*/
7154	uint16_t u16Config = (1<<10) \| (1<<7) \| (1<<6) \| (1<<5) \| (1<<4) ;
7155	pThis->dev.config[0x54] = u16Config & 0xff;
7156	pThis->dev.config[0x55] = u16Config >> 8;
7157	}
7158	break;
7159	case CHIPSET_PIIX4:
7160	PCIDevSetDeviceId(&pThis->dev, 0x7111); /* PIIX4 IDE */
7161	PCIDevSetRevisionId(&pThis->dev, 0x01); /* PIIX4E */
7162	pThis->dev.config[0x48] = 0x00; /* UDMACTL */
7163	pThis->dev.config[0x4A] = 0x00; /* UDMATIM */
7164	pThis->dev.config[0x4B] = 0x00;
7165	break;
7166	case CHIPSET_PIIX3:
7167	PCIDevSetDeviceId(&pThis->dev, 0x7010); /* PIIX3 IDE */
7168	break;
7169	default:
7170	AssertMsgFailed(("Unsupported IDE chipset type: %d\n", pThis->u8Type));
7171	}
7172
7173	PCIDevSetCommand( &pThis->dev, PCI_COMMAND_IOACCESS \| PCI_COMMAND_MEMACCESS \| PCI_COMMAND_BUSMASTER);
7174	PCIDevSetClassProg( &pThis->dev, 0x8a); /* programming interface = PCI_IDE bus master is supported */
7175	PCIDevSetClassSub( &pThis->dev, 0x01); /* class_sub = PCI_IDE */
7176	PCIDevSetClassBase( &pThis->dev, 0x01); /* class_base = PCI_mass_storage */
7177	PCIDevSetHeaderType(&pThis->dev, 0x00);
7178
7179	pThis->pDevIns = pDevIns;
7180	pThis->fGCEnabled = fGCEnabled;
7181	pThis->fR0Enabled = fR0Enabled;
7182	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7183	{
7184	pThis->aCts[i].pDevInsR3 = pDevIns;
7185	pThis->aCts[i].pDevInsR0 = PDMDEVINS_2_R0PTR(pDevIns);
7186	pThis->aCts[i].pDevInsRC = PDMDEVINS_2_RCPTR(pDevIns);
7187	pThis->aCts[i].DelayIRQMillies = (uint32_t)DelayIRQMillies;
7188	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
7189	{
7190	ATADevState *pIf = &pThis->aCts[i].aIfs[j];
7191
7192	pIf->iLUN = i * RT_ELEMENTS(pThis->aCts) + j;
7193	pIf->pDevInsR3 = pDevIns;
7194	pIf->pDevInsR0 = PDMDEVINS_2_R0PTR(pDevIns);
7195	pIf->pDevInsRC = PDMDEVINS_2_RCPTR(pDevIns);
7196	pIf->pControllerR3 = &pThis->aCts[i];
7197	pIf->pControllerR0 = MMHyperR3ToR0(PDMDevHlpGetVM(pDevIns), &pThis->aCts[i]);
7198	pIf->pControllerRC = MMHyperR3ToRC(PDMDevHlpGetVM(pDevIns), &pThis->aCts[i]);
7199	pIf->IBase.pfnQueryInterface = ataQueryInterface;
7200	pIf->IMountNotify.pfnMountNotify = ataMountNotify;
7201	pIf->IMountNotify.pfnUnmountNotify = ataUnmountNotify;
7202	pIf->IPort.pfnQueryDeviceLocation = ataR3QueryDeviceLocation;
7203	pIf->Led.u32Magic = PDMLED_MAGIC;
7204	}
7205	}
7206
7207	Assert(RT_ELEMENTS(pThis->aCts) == 2);
7208	pThis->aCts[0].irq = 14;
7209	pThis->aCts[0].IOPortBase1 = 0x1f0;
7210	pThis->aCts[0].IOPortBase2 = 0x3f6;
7211	pThis->aCts[1].irq = 15;
7212	pThis->aCts[1].IOPortBase1 = 0x170;
7213	pThis->aCts[1].IOPortBase2 = 0x376;
7214
7215	/*
7216	* Set the default critical section to NOP as we lock on controller level.
7217	*/
7218	rc = PDMDevHlpSetDeviceCritSect(pDevIns, PDMDevHlpCritSectGetNop(pDevIns));
7219	AssertRCReturn(rc, rc);
7220
7221	/*
7222	* Register the PCI device.
7223	* N.B. There's a hack in the PIIX3 PCI bridge device to assign this
7224	* device the slot next to itself.
7225	*/
7226	rc = PDMDevHlpPCIRegister(pDevIns, &pThis->dev);
7227	if (RT_FAILURE(rc))
7228	return PDMDEV_SET_ERROR(pDevIns, rc,
7229	N_("PIIX3 cannot register PCI device"));
7230	//AssertMsg(pThis->dev.devfn == 9 \|\| iInstance != 0, ("pThis->dev.devfn=%d\n", pThis->dev.devfn));
7231	rc = PDMDevHlpPCIIORegionRegister(pDevIns, 4, 0x10, PCI_ADDRESS_SPACE_IO, ataBMDMAIORangeMap);
7232	if (RT_FAILURE(rc))
7233	return PDMDEV_SET_ERROR(pDevIns, rc,
7234	N_("PIIX3 cannot register PCI I/O region for BMDMA"));
7235
7236	/*
7237	* Register the I/O ports.
7238	* The ports are all hardcoded and enforced by the PIIX3 host bridge controller.
7239	*/
7240	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7241	{
7242	rc = PDMDevHlpIOPortRegister(pDevIns, pThis->aCts[i].IOPortBase1, 8, (RTHCPTR)(uintptr_t)i,
7243	ataIOPortWrite1, ataIOPortRead1, ataIOPortWriteStr1, ataIOPortReadStr1, "ATA I/O Base 1");
7244	if (RT_FAILURE(rc))
7245	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot register I/O handlers"));
7246
7247	if (fGCEnabled)
7248	{
7249	rc = PDMDevHlpIOPortRegisterRC(pDevIns, pThis->aCts[i].IOPortBase1, 8, (RTGCPTR)i,
7250	"ataIOPortWrite1", "ataIOPortRead1", "ataIOPortWriteStr1", "ataIOPortReadStr1", "ATA I/O Base 1");
7251	if (RT_FAILURE(rc))
7252	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot register I/O handlers (GC)"));
7253	}
7254
7255	if (fR0Enabled)
7256	{
7257	#if 1
7258	rc = PDMDevHlpIOPortRegisterR0(pDevIns, pThis->aCts[i].IOPortBase1, 8, (RTR0PTR)i,
7259	"ataIOPortWrite1", "ataIOPortRead1", NULL, NULL, "ATA I/O Base 1");
7260	#else
7261	rc = PDMDevHlpIOPortRegisterR0(pDevIns, pThis->aCts[i].IOPortBase1, 8, (RTR0PTR)i,
7262	"ataIOPortWrite1", "ataIOPortRead1", "ataIOPortWriteStr1", "ataIOPortReadStr1", "ATA I/O Base 1");
7263	#endif
7264	if (RT_FAILURE(rc))
7265	return PDMDEV_SET_ERROR(pDevIns, rc, "PIIX3 cannot register I/O handlers (R0).");
7266	}
7267
7268	rc = PDMDevHlpIOPortRegister(pDevIns, pThis->aCts[i].IOPortBase2, 1, (RTHCPTR)(uintptr_t)i,
7269	ataIOPortWrite2, ataIOPortRead2, NULL, NULL, "ATA I/O Base 2");
7270	if (RT_FAILURE(rc))
7271	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot register base2 I/O handlers"));
7272
7273	if (fGCEnabled)
7274	{
7275	rc = PDMDevHlpIOPortRegisterRC(pDevIns, pThis->aCts[i].IOPortBase2, 1, (RTGCPTR)i,
7276	"ataIOPortWrite2", "ataIOPortRead2", NULL, NULL, "ATA I/O Base 2");
7277	if (RT_FAILURE(rc))
7278	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot register base2 I/O handlers (GC)"));
7279	}
7280	if (fR0Enabled)
7281	{
7282	rc = PDMDevHlpIOPortRegisterR0(pDevIns, pThis->aCts[i].IOPortBase2, 1, (RTR0PTR)i,
7283	"ataIOPortWrite2", "ataIOPortRead2", NULL, NULL, "ATA I/O Base 2");
7284	if (RT_FAILURE(rc))
7285	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot register base2 I/O handlers (R0)"));
7286	}
7287
7288	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
7289	{
7290	ATADevState *pIf = &pThis->aCts[i].aIfs[j];
7291	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatATADMA, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES,
7292	"Number of ATA DMA transfers.", "/Devices/IDE%d/ATA%d/Unit%d/DMA", iInstance, i, j);
7293	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatATAPIO, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES,
7294	"Number of ATA PIO transfers.", "/Devices/IDE%d/ATA%d/Unit%d/PIO", iInstance, i, j);
7295	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatATAPIDMA, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES,
7296	"Number of ATAPI DMA transfers.", "/Devices/IDE%d/ATA%d/Unit%d/AtapiDMA", iInstance, i, j);
7297	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatATAPIPIO, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES,
7298	"Number of ATAPI PIO transfers.", "/Devices/IDE%d/ATA%d/Unit%d/AtapiPIO", iInstance, i, j);
7299	#ifdef VBOX_WITH_STATISTICS /** @todo release too. */
7300	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatReads, STAMTYPE_PROFILE_ADV, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
7301	"Profiling of the read operations.", "/Devices/IDE%d/ATA%d/Unit%d/Reads", iInstance, i, j);
7302	#endif
7303	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatBytesRead, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES,
7304	"Amount of data read.", "/Devices/IDE%d/ATA%d/Unit%d/ReadBytes", iInstance, i, j);
7305	#ifdef VBOX_INSTRUMENT_DMA_WRITES
7306	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatInstrVDWrites,STAMTYPE_PROFILE_ADV, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
7307	"Profiling of the VD DMA write operations.", "/Devices/IDE%d/ATA%d/Unit%d/InstrVDWrites", iInstance, i, j);
7308	#endif
7309	#ifdef VBOX_WITH_STATISTICS
7310	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatWrites, STAMTYPE_PROFILE_ADV, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
7311	"Profiling of the write operations.", "/Devices/IDE%d/ATA%d/Unit%d/Writes", iInstance, i, j);
7312	#endif
7313	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatBytesWritten, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES,
7314	"Amount of data written.", "/Devices/IDE%d/ATA%d/Unit%d/WrittenBytes", iInstance, i, j);
7315	#ifdef VBOX_WITH_STATISTICS
7316	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatFlushes, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
7317	"Profiling of the flush operations.", "/Devices/IDE%d/ATA%d/Unit%d/Flushes", iInstance, i, j);
7318	#endif
7319	}
7320	#ifdef VBOX_WITH_STATISTICS /** @todo release too. */
7321	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatAsyncOps, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES,
7322	"The number of async operations.", "/Devices/IDE%d/ATA%d/Async/Operations", iInstance, i);
7323	/** @todo STAMUNIT_MICROSECS */
7324	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatAsyncMinWait, STAMTYPE_U64_RESET, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE,
7325	"Minimum wait in microseconds.", "/Devices/IDE%d/ATA%d/Async/MinWait", iInstance, i);
7326	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatAsyncMaxWait, STAMTYPE_U64_RESET, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE,
7327	"Maximum wait in microseconds.", "/Devices/IDE%d/ATA%d/Async/MaxWait", iInstance, i);
7328	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatAsyncTimeUS, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE,
7329	"Total time spent in microseconds.", "/Devices/IDE%d/ATA%d/Async/TotalTimeUS", iInstance, i);
7330	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatAsyncTime, STAMTYPE_PROFILE_ADV, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
7331	"Profiling of async operations.", "/Devices/IDE%d/ATA%d/Async/Time", iInstance, i);
7332	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatLockWait, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
7333	"Profiling of locks.", "/Devices/IDE%d/ATA%d/Async/LockWait", iInstance, i);
7334	#endif /* VBOX_WITH_STATISTICS */
7335
7336	/* Initialize per-controller critical section */
7337	rc = PDMDevHlpCritSectInit(pDevIns, &pThis->aCts[i].lock, RT_SRC_POS, "ATA#%u", i);
7338	if (RT_FAILURE(rc))
7339	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot initialize critical section"));
7340	}
7341
7342	/*
7343	* Attach status driver (optional).
7344	*/
7345	rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThis->IBase, &pBase, "Status Port");
7346	if (RT_SUCCESS(rc))
7347	{
7348	pThis->pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
7349	pThis->pMediaNotify = PDMIBASE_QUERY_INTERFACE(pBase, PDMIMEDIANOTIFY);
7350	}
7351	else if (rc != VERR_PDM_NO_ATTACHED_DRIVER)
7352	{
7353	AssertMsgFailed(("Failed to attach to status driver. rc=%Rrc\n", rc));
7354	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot attach to status driver"));
7355	}
7356
7357	/*
7358	* Attach the units.
7359	*/
7360	uint32_t cbTotalBuffer = 0;
7361	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7362	{
7363	PATACONTROLLER pCtl = &pThis->aCts[i];
7364
7365	/*
7366	* Start the worker thread.
7367	*/
7368	pCtl->uAsyncIOState = ATA_AIO_NEW;
7369	rc = RTSemEventCreate(&pCtl->AsyncIOSem);
7370	AssertLogRelRCReturn(rc, rc);
7371	rc = RTSemEventCreate(&pCtl->SuspendIOSem);
7372	AssertLogRelRCReturn(rc, rc);
7373	rc = RTSemMutexCreate(&pCtl->AsyncIORequestMutex);
7374	AssertLogRelRCReturn(rc, rc);
7375	ataAsyncIOClearRequests(pCtl);
7376	rc = RTThreadCreateF(&pCtl->AsyncIOThread, ataAsyncIOLoop, (void )pCtl, 1281024 /cbStack/,
7377	RTTHREADTYPE_IO, RTTHREADFLAGS_WAITABLE, "ATA-%u", i);
7378	AssertLogRelRCReturn(rc, rc);
7379	Assert(pCtl->AsyncIOThread != NIL_RTTHREAD && pCtl->AsyncIOSem != NIL_RTSEMEVENT && pCtl->SuspendIOSem != NIL_RTSEMEVENT && pCtl->AsyncIORequestMutex != NIL_RTSEMMUTEX);
7380	Log(("%s: controller %d AIO thread id %#x; sem %p susp_sem %p mutex %p\n", __FUNCTION__, i, pCtl->AsyncIOThread, pCtl->AsyncIOSem, pCtl->SuspendIOSem, pCtl->AsyncIORequestMutex));
7381
7382	for (uint32_t j = 0; j < RT_ELEMENTS(pCtl->aIfs); j++)
7383	{
7384	static const char *s_apszDescs[RT_ELEMENTS(pThis->aCts)][RT_ELEMENTS(pCtl->aIfs)] =
7385	{
7386	{ "Primary Master", "Primary Slave" },
7387	{ "Secondary Master", "Secondary Slave" }
7388	};
7389
7390	/*
7391	* Try attach the block device and get the interfaces,
7392	* required as well as optional.
7393	*/
7394	ATADevState *pIf = &pCtl->aIfs[j];
7395
7396	rc = PDMDevHlpDriverAttach(pDevIns, pIf->iLUN, &pIf->IBase, &pIf->pDrvBase, s_apszDescs[i][j]);
7397	if (RT_SUCCESS(rc))
7398	{
7399	rc = ataConfigLun(pDevIns, pIf);
7400	if (RT_SUCCESS(rc))
7401	{
7402	/*
7403	* Init vendor product data.
7404	*/
7405	static const char *s_apszCFGMKeys[RT_ELEMENTS(pThis->aCts)][RT_ELEMENTS(pCtl->aIfs)] =
7406	{
7407	{ "PrimaryMaster", "PrimarySlave" },
7408	{ "SecondaryMaster", "SecondarySlave" }
7409	};
7410
7411	/* Generate a default serial number. */
7412	char szSerial[ATA_SERIAL_NUMBER_LENGTH+1];
7413	RTUUID Uuid;
7414	if (pIf->pDrvBlock)
7415	rc = pIf->pDrvBlock->pfnGetUuid(pIf->pDrvBlock, &Uuid);
7416	else
7417	RTUuidClear(&Uuid);
7418
7419	if (RT_FAILURE(rc) \|\| RTUuidIsNull(&Uuid))
7420	{
7421	/* Generate a predictable serial for drives which don't have a UUID. */
7422	RTStrPrintf(szSerial, sizeof(szSerial), "VB%x-%04x%04x",
7423	pIf->iLUN + pDevIns->iInstance * 32,
7424	pThis->aCts[i].IOPortBase1, pThis->aCts[i].IOPortBase2);
7425	}
7426	else
7427	RTStrPrintf(szSerial, sizeof(szSerial), "VB%08x-%08x", Uuid.au32[0], Uuid.au32[3]);
7428
7429	/* Get user config if present using defaults otherwise. */
7430	PCFGMNODE pCfgNode = CFGMR3GetChild(pCfg, s_apszCFGMKeys[i][j]);
7431	rc = CFGMR3QueryStringDef(pCfgNode, "SerialNumber", pIf->szSerialNumber, sizeof(pIf->szSerialNumber),
7432	szSerial);
7433	if (RT_FAILURE(rc))
7434	{
7435	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
7436	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
7437	N_("PIIX3 configuration error: \"SerialNumber\" is longer than 20 bytes"));
7438	return PDMDEV_SET_ERROR(pDevIns, rc,
7439	N_("PIIX3 configuration error: failed to read \"SerialNumber\" as string"));
7440	}
7441
7442	rc = CFGMR3QueryStringDef(pCfgNode, "FirmwareRevision", pIf->szFirmwareRevision, sizeof(pIf->szFirmwareRevision),
7443	"1.0");
7444	if (RT_FAILURE(rc))
7445	{
7446	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
7447	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
7448	N_("PIIX3 configuration error: \"FirmwareRevision\" is longer than 8 bytes"));
7449	return PDMDEV_SET_ERROR(pDevIns, rc,
7450	N_("PIIX3 configuration error: failed to read \"FirmwareRevision\" as string"));
7451	}
7452
7453	rc = CFGMR3QueryStringDef(pCfgNode, "ModelNumber", pIf->szModelNumber, sizeof(pIf->szModelNumber),
7454	pIf->fATAPI ? "VBOX CD-ROM" : "VBOX HARDDISK");
7455	if (RT_FAILURE(rc))
7456	{
7457	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
7458	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
7459	N_("PIIX3 configuration error: \"ModelNumber\" is longer than 40 bytes"));
7460	return PDMDEV_SET_ERROR(pDevIns, rc,
7461	N_("PIIX3 configuration error: failed to read \"ModelNumber\" as string"));
7462	}
7463
7464	rc = CFGMR3QueryBoolDef(pCfgNode, "NonRotationalMedium", &pIf->fNonRotational, false);
7465	if (RT_FAILURE(rc))
7466	return PDMDEV_SET_ERROR(pDevIns, rc,
7467	N_("PIIX3 configuration error: failed to read \"NonRotationalMedium\" as boolean"));
7468
7469	/* There are three other identification strings for CD drives used for INQUIRY */
7470	if (pIf->fATAPI)
7471	{
7472	rc = CFGMR3QueryStringDef(pCfgNode, "ATAPIVendorId", pIf->szInquiryVendorId, sizeof(pIf->szInquiryVendorId),
7473	"VBOX");
7474	if (RT_FAILURE(rc))
7475	{
7476	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
7477	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
7478	N_("PIIX3 configuration error: \"ATAPIVendorId\" is longer than 16 bytes"));
7479	return PDMDEV_SET_ERROR(pDevIns, rc,
7480	N_("PIIX3 configuration error: failed to read \"ATAPIVendorId\" as string"));
7481	}
7482
7483	rc = CFGMR3QueryStringDef(pCfgNode, "ATAPIProductId", pIf->szInquiryProductId, sizeof(pIf->szInquiryProductId),
7484	"CD-ROM");
7485	if (RT_FAILURE(rc))
7486	{
7487	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
7488	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
7489	N_("PIIX3 configuration error: \"ATAPIProductId\" is longer than 16 bytes"));
7490	return PDMDEV_SET_ERROR(pDevIns, rc,
7491	N_("PIIX3 configuration error: failed to read \"ATAPIProductId\" as string"));
7492	}
7493
7494	rc = CFGMR3QueryStringDef(pCfgNode, "ATAPIRevision", pIf->szInquiryRevision, sizeof(pIf->szInquiryRevision),
7495	"1.0");
7496	if (RT_FAILURE(rc))
7497	{
7498	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
7499	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
7500	N_("PIIX3 configuration error: \"ATAPIRevision\" is longer than 4 bytes"));
7501	return PDMDEV_SET_ERROR(pDevIns, rc,
7502	N_("PIIX3 configuration error: failed to read \"ATAPIRevision\" as string"));
7503	}
7504
7505	rc = CFGMR3QueryBoolDef(pCfgNode, "OverwriteInquiry", &pIf->fOverwriteInquiry, true);
7506	if (RT_FAILURE(rc))
7507	return PDMDEV_SET_ERROR(pDevIns, rc,
7508	N_("PIIX3 configuration error: failed to read \"OverwriteInquiry\" as boolean"));
7509	}
7510	}
7511
7512	}
7513	else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
7514	{
7515	pIf->pDrvBase = NULL;
7516	pIf->pDrvBlock = NULL;
7517	pIf->cbIOBuffer = 0;
7518	pIf->pbIOBufferR3 = NULL;
7519	pIf->pbIOBufferR0 = NIL_RTR0PTR;
7520	pIf->pbIOBufferRC = NIL_RTGCPTR;
7521	LogRel(("PIIX3 ATA: LUN#%d: no unit\n", pIf->iLUN));
7522	}
7523	else
7524	{
7525	switch (rc)
7526	{
7527	case VERR_ACCESS_DENIED:
7528	/* Error already cached by DrvHostBase */
7529	return rc;
7530	default:
7531	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
7532	N_("PIIX3 cannot attach drive to the %s"),
7533	s_apszDescs[i][j]);
7534	}
7535	}
7536	cbTotalBuffer += pIf->cbIOBuffer;
7537	}
7538	}
7539
7540	rc = PDMDevHlpSSMRegisterEx(pDevIns, ATA_SAVED_STATE_VERSION, sizeof(*pThis) + cbTotalBuffer, NULL,
7541	NULL, ataLiveExec, NULL,
7542	ataSaveLoadPrep, ataSaveExec, NULL,
7543	ataSaveLoadPrep, ataLoadExec, NULL);
7544	if (RT_FAILURE(rc))
7545	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot register save state handlers"));
7546
7547	/*
7548	* Initialize the device state.
7549	*/
7550	return ataR3ResetCommon(pDevIns, true /fConstruct/);
7551	}
7552
7553
7554	/**
7555	* The device registration structure.
7556	*/
7557	const PDMDEVREG g_DevicePIIX3IDE =
7558	{
7559	/* u32Version */
7560	PDM_DEVREG_VERSION,
7561	/* szName */
7562	"piix3ide",
7563	/* szRCMod */
7564	"VBoxDDGC.gc",
7565	/* szR0Mod */
7566	"VBoxDDR0.r0",
7567	/* pszDescription */
7568	"Intel PIIX3 ATA controller.\n"
7569	" LUN #0 is primary master.\n"
7570	" LUN #1 is primary slave.\n"
7571	" LUN #2 is secondary master.\n"
7572	" LUN #3 is secondary slave.\n"
7573	" LUN #999 is the LED/Status connector.",
7574	/* fFlags */
7575	PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RC \| PDM_DEVREG_FLAGS_R0 \|
7576	PDM_DEVREG_FLAGS_FIRST_SUSPEND_NOTIFICATION \| PDM_DEVREG_FLAGS_FIRST_POWEROFF_NOTIFICATION \|
7577	PDM_DEVREG_FLAGS_FIRST_RESET_NOTIFICATION,
7578	/* fClass */
7579	PDM_DEVREG_CLASS_STORAGE,
7580	/* cMaxInstances */
7581	1,
7582	/* cbInstance */
7583	sizeof(PCIATAState),
7584	/* pfnConstruct */
7585	ataR3Construct,
7586	/* pfnDestruct */
7587	ataR3Destruct,
7588	/* pfnRelocate */
7589	ataR3Relocate,
7590	/* pfnMemSetup */
7591	NULL,
7592	/* pfnPowerOn */
7593	NULL,
7594	/* pfnReset */
7595	ataR3Reset,
7596	/* pfnSuspend */
7597	ataR3Suspend,
7598	/* pfnResume */
7599	ataR3Resume,
7600	/* pfnAttach */
7601	ataR3Attach,
7602	/* pfnDetach */
7603	ataR3Detach,
7604	/* pfnQueryInterface. */
7605	NULL,
7606	/* pfnInitComplete */
7607	NULL,
7608	/* pfnPowerOff */
7609	ataR3PowerOff,
7610	/* pfnSoftReset */
7611	NULL,
7612	/* u32VersionEnd */
7613	PDM_DEVREG_VERSION
7614	};
7615	#endif /* IN_RING3 */
7616	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Storage/DevATA.cpp@ 46243

Download in other formats: