DevBusLogic.cpp@ 81800

Last change on this file since 81800 was 81800, checked in by vboxsync, 5 years ago
DevBusLogic.cpp: Converting it to the new PDM device style... bugref:9218
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 177.9 KB

Line
1	/* $Id: DevBusLogic.cpp 81800 2019-11-12 12:59:38Z vboxsync $ */
2	/** @file
3	* VBox storage devices - BusLogic SCSI host adapter BT-958.
4	*
5	* Based on the Multi-Master Ultra SCSI Systems Technical Reference Manual.
6	*/
7
8	/*
9	* Copyright (C) 2006-2019 Oracle Corporation
10	*
11	* This file is part of VirtualBox Open Source Edition (OSE), as
12	* available from http://www.virtualbox.org. This file is free software;
13	* you can redistribute it and/or modify it under the terms of the GNU
14	* General Public License (GPL) as published by the Free Software
15	* Foundation, in version 2 as it comes in the "COPYING" file of the
16	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
17	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
18	*/
19
20
21	/*********************************************************************************************************************************
22	* Header Files *
23	*********************************************************************************************************************************/
24	#define LOG_GROUP LOG_GROUP_DEV_BUSLOGIC
25	#include <VBox/vmm/pdmdev.h>
26	#include <VBox/vmm/pdmstorageifs.h>
27	#include <VBox/vmm/pdmcritsect.h>
28	#include <VBox/scsi.h>
29	#include <iprt/asm.h>
30	#include <iprt/assert.h>
31	#include <iprt/string.h>
32	#include <iprt/log.h>
33	#ifdef IN_RING3
34	# include <iprt/alloc.h>
35	# include <iprt/memcache.h>
36	# include <iprt/param.h>
37	# include <iprt/uuid.h>
38	#endif
39
40	#include "VBoxSCSI.h"
41	#include "VBoxDD.h"
42
43
44	/*********************************************************************************************************************************
45	* Defined Constants And Macros *
46	*********************************************************************************************************************************/
47	/** Maximum number of attached devices the adapter can handle. */
48	#define BUSLOGIC_MAX_DEVICES 16
49
50	/** Maximum number of scatter gather elements this device can handle. */
51	#define BUSLOGIC_MAX_SCATTER_GATHER_LIST_SIZE 128
52
53	/** Size of the command buffer. */
54	#define BUSLOGIC_COMMAND_SIZE_MAX 53
55
56	/** Size of the reply buffer. */
57	#define BUSLOGIC_REPLY_SIZE_MAX 64
58
59	/** Custom fixed I/O ports for BIOS controller access.
60	* Note that these should not be in the ISA range (below 400h) to avoid
61	* conflicts with ISA device probing. Addresses in the 300h-340h range should be
62	* especially avoided.
63	*/
64	#define BUSLOGIC_BIOS_IO_PORT 0x430
65
66	/** State saved version. */
67	#define BUSLOGIC_SAVED_STATE_MINOR_VERSION 4
68
69	/** Saved state version before the suspend on error feature was implemented. */
70	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_ERROR_HANDLING 1
71	/** Saved state version before 24-bit mailbox support was implemented. */
72	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX 2
73	/** Saved state version before command buffer size was raised. */
74	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE 3
75
76	/** Command buffer size in old saved states. */
77	#define BUSLOGIC_COMMAND_SIZE_OLD 5
78
79	/** The duration of software-initiated reset (in nano seconds).
80	* Not documented, set to 50 ms. */
81	#define BUSLOGIC_RESET_DURATION_NS UINT64_C(50000000)
82
83
84	/*********************************************************************************************************************************
85	* Structures and Typedefs *
86	*********************************************************************************************************************************/
87	/**
88	* State of a device attached to the buslogic host adapter.
89	*
90	* @implements PDMIBASE
91	* @implements PDMISCSIPORT
92	* @implements PDMILEDPORTS
93	*/
94	typedef struct BUSLOGICDEVICE
95	{
96	/** Pointer to the owning buslogic device instance. - R3 pointer */
97	R3PTRTYPE(struct BUSLOGIC *) pBusLogicR3;
98	/** Pointer to the owning buslogic device instance. - R0 pointer */
99	R0PTRTYPE(struct BUSLOGIC *) pBusLogicR0;
100	/** Pointer to the owning buslogic device instance. - RC pointer */
101	RCPTRTYPE(struct BUSLOGIC *) pBusLogicRC;
102
103	/** LUN of the device. */
104	uint32_t iLUN;
105
106	/** Flag whether device is present. */
107	bool fPresent;
108	bool afAlignment[HC_ARCH_BITS == 64 ? 3 : 7];
109
110	/** Our base interface. */
111	PDMIBASE IBase;
112	/** Media port interface. */
113	PDMIMEDIAPORT IMediaPort;
114	/** Extended media port interface. */
115	PDMIMEDIAEXPORT IMediaExPort;
116	/** Led interface. */
117	PDMILEDPORTS ILed;
118	/** Pointer to the attached driver's base interface. */
119	R3PTRTYPE(PPDMIBASE) pDrvBase;
120	/** Pointer to the attached driver's media interface. */
121	R3PTRTYPE(PPDMIMEDIA) pDrvMedia;
122	/** Pointer to the attached driver's extended media interface. */
123	R3PTRTYPE(PPDMIMEDIAEX) pDrvMediaEx;
124	/** The status LED state for this device. */
125	PDMLED Led;
126
127	/** Number of outstanding tasks on the port. */
128	volatile uint32_t cOutstandingRequests;
129
130	#if HC_ARCH_BITS == 64
131	uint32_t u32Alignment1;
132	#endif
133	} BUSLOGICDEVICE, *PBUSLOGICDEVICE;
134
135	/**
136	* Commands the BusLogic adapter supports.
137	*/
138	enum BUSLOGICCOMMAND
139	{
140	BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT = 0x00,
141	BUSLOGICCOMMAND_INITIALIZE_MAILBOX = 0x01,
142	BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND = 0x02,
143	BUSLOGICCOMMAND_EXECUTE_BIOS_COMMAND = 0x03,
144	BUSLOGICCOMMAND_INQUIRE_BOARD_ID = 0x04,
145	BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT = 0x05,
146	BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT = 0x06,
147	BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS = 0x07,
148	BUSLOGICCOMMAND_SET_TIME_OFF_BUS = 0x08,
149	BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE = 0x09,
150	BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7 = 0x0a,
151	BUSLOGICCOMMAND_INQUIRE_CONFIGURATION = 0x0b,
152	BUSLOGICCOMMAND_ENABLE_TARGET_MODE = 0x0c,
153	BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION = 0x0d,
154	BUSLOGICCOMMAND_WRITE_ADAPTER_LOCAL_RAM = 0x1a,
155	BUSLOGICCOMMAND_READ_ADAPTER_LOCAL_RAM = 0x1b,
156	BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO = 0x1c,
157	BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO = 0x1d,
158	BUSLOGICCOMMAND_ECHO_COMMAND_DATA = 0x1f,
159	BUSLOGICCOMMAND_HOST_ADAPTER_DIAGNOSTIC = 0x20,
160	BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS = 0x21,
161	BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15 = 0x23,
162	BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES = 0x24,
163	BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT = 0x25,
164	BUSLOGICCOMMAND_EXT_BIOS_INFO = 0x28,
165	BUSLOGICCOMMAND_UNLOCK_MAILBOX = 0x29,
166	BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX = 0x81,
167	BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND = 0x83,
168	BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER = 0x84,
169	BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER = 0x85,
170	BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION = 0x86,
171	BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER = 0x8b,
172	BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD = 0x8c,
173	BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION = 0x8d,
174	BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE = 0x8f,
175	BUSLOGICCOMMAND_STORE_HOST_ADAPTER_LOCAL_RAM = 0x90,
176	BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM = 0x91,
177	BUSLOGICCOMMAND_STORE_LOCAL_DATA_IN_EEPROM = 0x92,
178	BUSLOGICCOMMAND_UPLOAD_AUTO_SCSI_CODE = 0x94,
179	BUSLOGICCOMMAND_MODIFY_IO_ADDRESS = 0x95,
180	BUSLOGICCOMMAND_SET_CCB_FORMAT = 0x96,
181	BUSLOGICCOMMAND_WRITE_INQUIRY_BUFFER = 0x9a,
182	BUSLOGICCOMMAND_READ_INQUIRY_BUFFER = 0x9b,
183	BUSLOGICCOMMAND_FLASH_ROM_UPLOAD_DOWNLOAD = 0xa7,
184	BUSLOGICCOMMAND_READ_SCAM_DATA = 0xa8,
185	BUSLOGICCOMMAND_WRITE_SCAM_DATA = 0xa9
186	} BUSLOGICCOMMAND;
187
188	#pragma pack(1)
189	/**
190	* Auto SCSI structure which is located
191	* in host adapter RAM and contains several
192	* configuration parameters.
193	*/
194	typedef struct AutoSCSIRam
195	{
196	uint8_t aInternalSignature[2];
197	uint8_t cbInformation;
198	uint8_t aHostAdaptertype[6];
199	uint8_t uReserved1;
200	bool fFloppyEnabled : 1;
201	bool fFloppySecondary : 1;
202	bool fLevelSensitiveInterrupt : 1;
203	unsigned char uReserved2 : 2;
204	unsigned char uSystemRAMAreForBIOS : 3;
205	unsigned char uDMAChannel : 7;
206	bool fDMAAutoConfiguration : 1;
207	unsigned char uIrqChannel : 7;
208	bool fIrqAutoConfiguration : 1;
209	uint8_t uDMATransferRate;
210	uint8_t uSCSIId;
211	bool fLowByteTerminated : 1;
212	bool fParityCheckingEnabled : 1;
213	bool fHighByteTerminated : 1;
214	bool fNoisyCablingEnvironment : 1;
215	bool fFastSynchronousNeogtiation : 1;
216	bool fBusResetEnabled : 1;
217	bool fReserved3 : 1;
218	bool fActiveNegotiationEnabled : 1;
219	uint8_t uBusOnDelay;
220	uint8_t uBusOffDelay;
221	bool fHostAdapterBIOSEnabled : 1;
222	bool fBIOSRedirectionOfInt19 : 1;
223	bool fExtendedTranslation : 1;
224	bool fMapRemovableAsFixed : 1;
225	bool fReserved4 : 1;
226	bool fBIOSSupportsMoreThan2Drives : 1;
227	bool fBIOSInterruptMode : 1;
228	bool fFlopticalSupport : 1;
229	uint16_t u16DeviceEnabledMask;
230	uint16_t u16WidePermittedMask;
231	uint16_t u16FastPermittedMask;
232	uint16_t u16SynchronousPermittedMask;
233	uint16_t u16DisconnectPermittedMask;
234	uint16_t u16SendStartUnitCommandMask;
235	uint16_t u16IgnoreInBIOSScanMask;
236	unsigned char uPCIInterruptPin : 2;
237	unsigned char uHostAdapterIoPortAddress : 2;
238	bool fStrictRoundRobinMode : 1;
239	bool fVesaBusSpeedGreaterThan33MHz : 1;
240	bool fVesaBurstWrite : 1;
241	bool fVesaBurstRead : 1;
242	uint16_t u16UltraPermittedMask;
243	uint32_t uReserved5;
244	uint8_t uReserved6;
245	uint8_t uAutoSCSIMaximumLUN;
246	bool fReserved7 : 1;
247	bool fSCAMDominant : 1;
248	bool fSCAMenabled : 1;
249	bool fSCAMLevel2 : 1;
250	unsigned char uReserved8 : 4;
251	bool fInt13Extension : 1;
252	bool fReserved9 : 1;
253	bool fCDROMBoot : 1;
254	unsigned char uReserved10 : 5;
255	unsigned char uBootTargetId : 4;
256	unsigned char uBootChannel : 4;
257	bool fForceBusDeviceScanningOrder : 1;
258	unsigned char uReserved11 : 7;
259	uint16_t u16NonTaggedToAlternateLunPermittedMask;
260	uint16_t u16RenegotiateSyncAfterCheckConditionMask;
261	uint8_t aReserved12[10];
262	uint8_t aManufacturingDiagnostic[2];
263	uint16_t u16Checksum;
264	} AutoSCSIRam, *PAutoSCSIRam;
265	AssertCompileSize(AutoSCSIRam, 64);
266	#pragma pack()
267
268	/**
269	* The local Ram.
270	*/
271	typedef union HostAdapterLocalRam
272	{
273	/** Byte view. */
274	uint8_t u8View[256];
275	/** Structured view. */
276	struct
277	{
278	/** Offset 0 - 63 is for BIOS. */
279	uint8_t u8Bios[64];
280	/** Auto SCSI structure. */
281	AutoSCSIRam autoSCSIData;
282	} structured;
283	} HostAdapterLocalRam, *PHostAdapterLocalRam;
284	AssertCompileSize(HostAdapterLocalRam, 256);
285
286
287	/** Ugly 24-bit big-endian addressing. */
288	typedef struct
289	{
290	uint8_t hi;
291	uint8_t mid;
292	uint8_t lo;
293	} Addr24, Len24;
294	AssertCompileSize(Addr24, 3);
295
296	#define ADDR_TO_U32(x) (((x).hi << 16) \| ((x).mid << 8) \| (x).lo)
297	#define LEN_TO_U32 ADDR_TO_U32
298	#define U32_TO_ADDR(a, x) do {(a).hi = (x) >> 16; (a).mid = (x) >> 8; (a).lo = (x);} while(0)
299	#define U32_TO_LEN U32_TO_ADDR
300
301	/** @name Compatible ISA base I/O port addresses. Disabled if zero.
302	* @{ */
303	#define NUM_ISA_BASES 8
304	#define MAX_ISA_BASE (NUM_ISA_BASES - 1)
305	#define ISA_BASE_DISABLED 6
306
307	#ifdef IN_RING3
308	static uint16_t const g_aISABases[NUM_ISA_BASES] =
309	{
310	0x330, 0x334, 0x230, 0x234, 0x130, 0x134, 0, 0
311	};
312	#endif
313	/** @} */
314
315	/**
316	* Emulated device types.
317	*/
318	enum BL_DEVICE_TYPE
319	{
320	DEV_BT_958D = 0, /* BusLogic BT-958D, PCI. */
321	DEV_BT_545C = 1, /* BusLogic BT-545C, ISA. */
322	DEV_AHA_1540B = 2 /* Adaptec AHA-1540B, ISA. */
323	};
324
325	/** Pointer to a task state structure. */
326	typedef struct BUSLOGICREQ *PBUSLOGICREQ;
327
328	/**
329	* The shared BusLogic device emulation state.
330	*
331	* @implements PDMILEDPORTS
332	*/
333	typedef struct BUSLOGIC
334	{
335	/** Pointer to the device instance - HC ptr */
336	PPDMDEVINSR3 pDevInsR3;
337	/** Pointer to the device instance - R0 ptr */
338	PPDMDEVINSR0 pDevInsR0;
339	/** Pointer to the device instance - RC ptr. */
340	PPDMDEVINSRC pDevInsRC;
341
342	/** Whether R0 is enabled. */
343	bool fR0Enabled;
344	/** Whether RC is enabled. */
345	bool fGCEnabled;
346	/** Base address of the I/O ports. */
347	RTIOPORT IOPortBase;
348
349	/** Base address of the memory mapping. */
350	RTGCPHYS MMIOBase;
351
352	/** Status register - Readonly. */
353	volatile uint8_t regStatus;
354	/** Interrupt register - Readonly. */
355	volatile uint8_t regInterrupt;
356	/** Geometry register - Readonly. */
357	volatile uint8_t regGeometry;
358	/** Pending (delayed) interrupt. */
359	uint8_t uPendingIntr;
360
361	/** Local RAM for the fetch hostadapter local RAM request.
362	* I don't know how big the buffer really is but the maximum
363	* seems to be 256 bytes because the offset and count field in the command request
364	* are only one byte big.
365	*/
366	HostAdapterLocalRam LocalRam;
367
368	/** Command code the guest issued. */
369	uint8_t uOperationCode;
370	/** Buffer for the command parameters the adapter is currently receiving from the guest.
371	* Size of the largest command which is possible.
372	*/
373	uint8_t aCommandBuffer[BUSLOGIC_COMMAND_SIZE_MAX]; /* Size of the biggest request. */
374	/** Current position in the command buffer. */
375	uint8_t iParameter;
376	/** Parameters left until the command is complete. */
377	uint8_t cbCommandParametersLeft;
378
379	/** Whether we are using the RAM or reply buffer. */
380	bool fUseLocalRam;
381	/** Buffer to store reply data from the controller to the guest. */
382	uint8_t aReplyBuffer[BUSLOGIC_REPLY_SIZE_MAX]; /* Size of the biggest reply. */
383	/** Position in the buffer we are reading next. */
384	uint8_t iReply;
385	/** Bytes left until the reply buffer is empty. */
386	uint8_t cbReplyParametersLeft;
387
388	/** Flag whether IRQs are enabled. */
389	bool fIRQEnabled;
390	/** Flag whether 24-bit mailboxes are in use (default is 32-bit). */
391	bool fMbxIs24Bit;
392	/** ISA I/O port base (encoded in FW-compatible format). */
393	uint8_t uISABaseCode;
394	/** ISA IRQ, non-zero if in ISA mode. */
395	uint8_t uIsaIrq;
396
397	/** ISA I/O port base (disabled if zero). */
398	RTIOPORT IOISABase;
399	/** Default ISA I/O port base in FW-compatible format. */
400	uint8_t uDefaultISABaseCode;
401	/** Emulated device type. */
402	uint8_t uDevType;
403
404	/** Signature index for Adaptec models. */
405	uint8_t uAhaSigIdx;
406	uint8_t Alignment[7];
407
408	/** Number of mailboxes the guest set up. */
409	uint32_t cMailbox;
410
411	#if HC_ARCH_BITS == 64
412	uint32_t Alignment0;
413	#endif
414
415	/** Time when HBA reset was last initiated. / /< @todo does this need to be saved? /
416	uint64_t u64ResetTime;
417	/** Physical base address of the outgoing mailboxes. */
418	RTGCPHYS GCPhysAddrMailboxOutgoingBase;
419	/** Current outgoing mailbox position. */
420	uint32_t uMailboxOutgoingPositionCurrent;
421	/** Number of mailboxes ready. */
422	volatile uint32_t cMailboxesReady;
423	/** Whether a notification to R3 was sent. */
424	volatile bool fNotificationSent;
425
426	#if HC_ARCH_BITS == 64
427	uint32_t Alignment1;
428	#endif
429
430	/** Physical base address of the incoming mailboxes. */
431	RTGCPHYS GCPhysAddrMailboxIncomingBase;
432	/** Current incoming mailbox position. */
433	uint32_t uMailboxIncomingPositionCurrent;
434
435	/** Whether strict round robin is enabled. */
436	bool fStrictRoundRobinMode;
437	/** Whether the extended LUN CCB format is enabled for 32 possible logical units. */
438	bool fExtendedLunCCBFormat;
439
440	/** Queue to send tasks to R3. - HC ptr */
441	R3PTRTYPE(PPDMQUEUE) pNotifierQueueR3;
442	/** Queue to send tasks to R3. - HC ptr */
443	R0PTRTYPE(PPDMQUEUE) pNotifierQueueR0;
444	/** Queue to send tasks to R3. - RC ptr */
445	RCPTRTYPE(PPDMQUEUE) pNotifierQueueRC;
446
447	uint32_t Alignment2;
448
449	/** Critical section protecting access to the interrupt status register. */
450	PDMCRITSECT CritSectIntr;
451
452	/** Device state for BIOS access. */
453	VBOXSCSI VBoxSCSI;
454
455	/** BusLogic device states. */
456	BUSLOGICDEVICE aDeviceStates[BUSLOGIC_MAX_DEVICES];
457
458	/** The base interface.
459	* @todo use PDMDEVINS::IBase */
460	PDMIBASE IBase;
461	/** Status Port - Leds interface. */
462	PDMILEDPORTS ILeds;
463	/** Partner of ILeds. */
464	R3PTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
465	/** Status LUN: Media Notifys. */
466	R3PTRTYPE(PPDMIMEDIANOTIFY) pMediaNotify;
467
468	#if HC_ARCH_BITS == 64
469	uint32_t Alignment3;
470	#endif
471
472	/** Indicates that PDMDevHlpAsyncNotificationCompleted should be called when
473	* a port is entering the idle state. */
474	bool volatile fSignalIdle;
475	/** Flag whether the worker thread is sleeping. */
476	volatile bool fWrkThreadSleeping;
477	/** Flag whether a request from the BIOS is pending which the
478	* worker thread needs to process. */
479	volatile bool fBiosReqPending;
480
481	/** The support driver session handle. */
482	R3R0PTRTYPE(PSUPDRVSESSION) pSupDrvSession;
483	/** Worker thread. */
484	R3PTRTYPE(PPDMTHREAD) pThreadWrk;
485	/** The event semaphore the processing thread waits on. */
486	SUPSEMEVENT hEvtProcess;
487
488	/** Pointer to the array of addresses to redo. */
489	R3PTRTYPE(PRTGCPHYS) paGCPhysAddrCCBRedo;
490	/** Number of addresses the redo array holds. */
491	uint32_t cReqsRedo;
492
493	#ifdef LOG_ENABLED
494	volatile uint32_t cInMailboxesReady;
495	#else
496	# if HC_ARCH_BITS == 64
497	uint32_t Alignment4;
498	# endif
499	#endif
500
501	} BUSLOGIC;
502	/** Pointer to the shared BusLogic device emulation state. */
503	typedef BUSLOGIC *PBUSLOGIC;
504
505
506	/** Register offsets in the I/O port space. */
507	#define BUSLOGIC_REGISTER_CONTROL 0 /*< Writeonly /
508	/** Fields for the control register. */
509	# define BL_CTRL_RSBUS RT_BIT(4) /* Reset SCSI Bus. */
510	# define BL_CTRL_RINT RT_BIT(5) /* Reset Interrupt. */
511	# define BL_CTRL_RSOFT RT_BIT(6) /* Soft Reset. */
512	# define BL_CTRL_RHARD RT_BIT(7) /* Hard Reset. */
513
514	#define BUSLOGIC_REGISTER_STATUS 0 /*< Readonly /
515	/** Fields for the status register. */
516	# define BL_STAT_CMDINV RT_BIT(0) /* Command Invalid. */
517	# define BL_STAT_DIRRDY RT_BIT(2) /* Data In Register Ready. */
518	# define BL_STAT_CPRBSY RT_BIT(3) /* Command/Parameter Out Register Busy. */
519	# define BL_STAT_HARDY RT_BIT(4) /* Host Adapter Ready. */
520	# define BL_STAT_INREQ RT_BIT(5) /* Initialization Required. */
521	# define BL_STAT_DFAIL RT_BIT(6) /* Diagnostic Failure. */
522	# define BL_STAT_DACT RT_BIT(7) /* Diagnistic Active. */
523
524	#define BUSLOGIC_REGISTER_COMMAND 1 /*< Writeonly /
525	#define BUSLOGIC_REGISTER_DATAIN 1 /*< Readonly /
526	#define BUSLOGIC_REGISTER_INTERRUPT 2 /*< Readonly /
527	/** Fields for the interrupt register. */
528	# define BL_INTR_IMBL RT_BIT(0) /* Incoming Mailbox Loaded. */
529	# define BL_INTR_OMBR RT_BIT(1) /* Outgoing Mailbox Available. */
530	# define BL_INTR_CMDC RT_BIT(2) /* Command Complete. */
531	# define BL_INTR_RSTS RT_BIT(3) /* SCSI Bus Reset State. */
532	# define BL_INTR_INTV RT_BIT(7) /* Interrupt Valid. */
533
534	#define BUSLOGIC_REGISTER_GEOMETRY 3 /* Readonly */
535	# define BL_GEOM_XLATEN RT_BIT(7) /* Extended geometry translation enabled. */
536
537	/** Structure for the INQUIRE_PCI_HOST_ADAPTER_INFORMATION reply. */
538	typedef struct ReplyInquirePCIHostAdapterInformation
539	{
540	uint8_t IsaIOPort;
541	uint8_t IRQ;
542	unsigned char LowByteTerminated : 1;
543	unsigned char HighByteTerminated : 1;
544	unsigned char uReserved : 2; /* Reserved. */
545	unsigned char JP1 : 1; /* Whatever that means. */
546	unsigned char JP2 : 1; /* Whatever that means. */
547	unsigned char JP3 : 1; /* Whatever that means. */
548	/** Whether the provided info is valid. */
549	unsigned char InformationIsValid: 1;
550	uint8_t uReserved2; /* Reserved. */
551	} ReplyInquirePCIHostAdapterInformation, *PReplyInquirePCIHostAdapterInformation;
552	AssertCompileSize(ReplyInquirePCIHostAdapterInformation, 4);
553
554	/** Structure for the INQUIRE_CONFIGURATION reply. */
555	typedef struct ReplyInquireConfiguration
556	{
557	unsigned char uReserved1 : 5;
558	bool fDmaChannel5 : 1;
559	bool fDmaChannel6 : 1;
560	bool fDmaChannel7 : 1;
561	bool fIrqChannel9 : 1;
562	bool fIrqChannel10 : 1;
563	bool fIrqChannel11 : 1;
564	bool fIrqChannel12 : 1;
565	unsigned char uReserved2 : 1;
566	bool fIrqChannel14 : 1;
567	bool fIrqChannel15 : 1;
568	unsigned char uReserved3 : 1;
569	unsigned char uHostAdapterId : 4;
570	unsigned char uReserved4 : 4;
571	} ReplyInquireConfiguration, *PReplyInquireConfiguration;
572	AssertCompileSize(ReplyInquireConfiguration, 3);
573
574	/** Structure for the INQUIRE_SETUP_INFORMATION reply. */
575	typedef struct ReplyInquireSetupInformationSynchronousValue
576	{
577	unsigned char uOffset : 4;
578	unsigned char uTransferPeriod : 3;
579	bool fSynchronous : 1;
580	}ReplyInquireSetupInformationSynchronousValue, *PReplyInquireSetupInformationSynchronousValue;
581	AssertCompileSize(ReplyInquireSetupInformationSynchronousValue, 1);
582
583	typedef struct ReplyInquireSetupInformation
584	{
585	bool fSynchronousInitiationEnabled : 1;
586	bool fParityCheckingEnabled : 1;
587	unsigned char uReserved1 : 6;
588	uint8_t uBusTransferRate;
589	uint8_t uPreemptTimeOnBus;
590	uint8_t uTimeOffBus;
591	uint8_t cMailbox;
592	Addr24 MailboxAddress;
593	ReplyInquireSetupInformationSynchronousValue SynchronousValuesId0To7[8];
594	uint8_t uDisconnectPermittedId0To7;
595	uint8_t uSignature;
596	uint8_t uCharacterD;
597	uint8_t uHostBusType;
598	uint8_t uWideTransferPermittedId0To7;
599	uint8_t uWideTransfersActiveId0To7;
600	ReplyInquireSetupInformationSynchronousValue SynchronousValuesId8To15[8];
601	uint8_t uDisconnectPermittedId8To15;
602	uint8_t uReserved2;
603	uint8_t uWideTransferPermittedId8To15;
604	uint8_t uWideTransfersActiveId8To15;
605	} ReplyInquireSetupInformation, *PReplyInquireSetupInformation;
606	AssertCompileSize(ReplyInquireSetupInformation, 34);
607
608	/** Structure for the INQUIRE_EXTENDED_SETUP_INFORMATION. */
609	#pragma pack(1)
610	typedef struct ReplyInquireExtendedSetupInformation
611	{
612	uint8_t uBusType;
613	uint8_t uBiosAddress;
614	uint16_t u16ScatterGatherLimit;
615	uint8_t cMailbox;
616	uint32_t uMailboxAddressBase;
617	unsigned char uReserved1 : 2;
618	bool fFastEISA : 1;
619	unsigned char uReserved2 : 3;
620	bool fLevelSensitiveInterrupt : 1;
621	unsigned char uReserved3 : 1;
622	unsigned char aFirmwareRevision[3];
623	bool fHostWideSCSI : 1;
624	bool fHostDifferentialSCSI : 1;
625	bool fHostSupportsSCAM : 1;
626	bool fHostUltraSCSI : 1;
627	bool fHostSmartTermination : 1;
628	unsigned char uReserved4 : 3;
629	} ReplyInquireExtendedSetupInformation, *PReplyInquireExtendedSetupInformation;
630	AssertCompileSize(ReplyInquireExtendedSetupInformation, 14);
631	#pragma pack()
632
633	/** Structure for the INITIALIZE EXTENDED MAILBOX request. */
634	#pragma pack(1)
635	typedef struct RequestInitializeExtendedMailbox
636	{
637	/** Number of mailboxes in guest memory. */
638	uint8_t cMailbox;
639	/** Physical address of the first mailbox. */
640	uint32_t uMailboxBaseAddress;
641	} RequestInitializeExtendedMailbox, *PRequestInitializeExtendedMailbox;
642	AssertCompileSize(RequestInitializeExtendedMailbox, 5);
643	#pragma pack()
644
645	/** Structure for the INITIALIZE MAILBOX request. */
646	typedef struct
647	{
648	/** Number of mailboxes to set up. */
649	uint8_t cMailbox;
650	/** Physical address of the first mailbox. */
651	Addr24 aMailboxBaseAddr;
652	} RequestInitMbx, *PRequestInitMbx;
653	AssertCompileSize(RequestInitMbx, 4);
654
655	/**
656	* Structure of a mailbox in guest memory.
657	* The incoming and outgoing mailbox have the same size
658	* but the incoming one has some more fields defined which
659	* are marked as reserved in the outgoing one.
660	* The last field is also different from the type.
661	* For outgoing mailboxes it is the action and
662	* for incoming ones the completion status code for the task.
663	* We use one structure for both types.
664	*/
665	typedef struct Mailbox32
666	{
667	/** Physical address of the CCB structure in the guest memory. */
668	uint32_t u32PhysAddrCCB;
669	/** Type specific data. */
670	union
671	{
672	/** For outgoing mailboxes. */
673	struct
674	{
675	/** Reserved */
676	uint8_t uReserved[3];
677	/** Action code. */
678	uint8_t uActionCode;
679	} out;
680	/** For incoming mailboxes. */
681	struct
682	{
683	/** The host adapter status after finishing the request. */
684	uint8_t uHostAdapterStatus;
685	/** The status of the device which executed the request after executing it. */
686	uint8_t uTargetDeviceStatus;
687	/** Reserved. */
688	uint8_t uReserved;
689	/** The completion status code of the request. */
690	uint8_t uCompletionCode;
691	} in;
692	} u;
693	} Mailbox32, *PMailbox32;
694	AssertCompileSize(Mailbox32, 8);
695
696	/** Old style 24-bit mailbox entry. */
697	typedef struct Mailbox24
698	{
699	/** Mailbox command (incoming) or state (outgoing). */
700	uint8_t uCmdState;
701	/** Physical address of the CCB structure in the guest memory. */
702	Addr24 aPhysAddrCCB;
703	} Mailbox24, *PMailbox24;
704	AssertCompileSize(Mailbox24, 4);
705
706	/**
707	* Action codes for outgoing mailboxes.
708	*/
709	enum BUSLOGIC_MAILBOX_OUTGOING_ACTION
710	{
711	BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE = 0x00,
712	BUSLOGIC_MAILBOX_OUTGOING_ACTION_START_COMMAND = 0x01,
713	BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND = 0x02
714	};
715
716	/**
717	* Completion codes for incoming mailboxes.
718	*/
719	enum BUSLOGIC_MAILBOX_INCOMING_COMPLETION
720	{
721	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_FREE = 0x00,
722	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITHOUT_ERROR = 0x01,
723	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED = 0x02,
724	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND = 0x03,
725	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR = 0x04,
726	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_INVALID_CCB = 0x05
727	};
728
729	/**
730	* Host adapter status for incoming mailboxes.
731	*/
732	enum BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS
733	{
734	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED = 0x00,
735	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CMD_COMPLETED = 0x0a,
736	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CMD_COMPLETED_WITH_FLAG = 0x0b,
737	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_DATA_UNDERUN = 0x0c,
738	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT = 0x11,
739	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_DATA_OVERRUN = 0x12,
740	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_UNEXPECTED_BUS_FREE = 0x13,
741	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_BUS_PHASE_REQUESTED = 0x14,
742	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_OUTGOING_MAILBOX_ACTION_CODE = 0x15,
743	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_OPERATION_CODE = 0x16,
744	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CCB_HAS_INVALID_LUN = 0x17,
745	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER = 0x1a,
746	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_AUTO_REQUEST_SENSE_FAILED = 0x1b,
747	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TAGGED_QUEUING_MESSAGE_REJECTED = 0x1c,
748	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_UNSUPPORTED_MESSAGE_RECEIVED = 0x1d,
749	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_HARDWARE_FAILED = 0x20,
750	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TARGET_FAILED_RESPONSE_TO_ATN = 0x21,
751	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_ASSERTED_RST = 0x22,
752	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_OTHER_DEVICE_ASSERTED_RST = 0x23,
753	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TARGET_DEVICE_RECONNECTED_IMPROPERLY = 0x24,
754	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_ASSERTED_BUS_DEVICE_RESET = 0x25,
755	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED = 0x26,
756	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_SOFTWARE_ERROR = 0x27,
757	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_HARDWARE_TIMEOUT_ERROR = 0x30,
758	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_PARITY_ERROR_DETECTED = 0x34
759	};
760
761	/**
762	* Device status codes for incoming mailboxes.
763	*/
764	enum BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS
765	{
766	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD = 0x00,
767	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_CHECK_CONDITION = 0x02,
768	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_DEVICE_BUSY = 0x08
769	};
770
771	/**
772	* Opcode types for CCB.
773	*/
774	enum BUSLOGIC_CCB_OPCODE
775	{
776	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB = 0x00,
777	BUSLOGIC_CCB_OPCODE_TARGET_CCB = 0x01,
778	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER = 0x02,
779	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH = 0x03,
780	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER = 0x04,
781	BUSLOGIC_CCB_OPCODE_BUS_DEVICE_RESET = 0x81
782	};
783
784	/**
785	* Data transfer direction.
786	*/
787	enum BUSLOGIC_CCB_DIRECTION
788	{
789	BUSLOGIC_CCB_DIRECTION_UNKNOWN = 0x00,
790	BUSLOGIC_CCB_DIRECTION_IN = 0x01,
791	BUSLOGIC_CCB_DIRECTION_OUT = 0x02,
792	BUSLOGIC_CCB_DIRECTION_NO_DATA = 0x03
793	};
794
795	/**
796	* The command control block for a SCSI request.
797	*/
798	typedef struct CCB32
799	{
800	/** Opcode. */
801	uint8_t uOpcode;
802	/** Reserved */
803	unsigned char uReserved1 : 3;
804	/** Data direction for the request. */
805	unsigned char uDataDirection : 2;
806	/** Whether the request is tag queued. */
807	bool fTagQueued : 1;
808	/** Queue tag mode. */
809	unsigned char uQueueTag : 2;
810	/** Length of the SCSI CDB. */
811	uint8_t cbCDB;
812	/** Sense data length. */
813	uint8_t cbSenseData;
814	/** Data length. */
815	uint32_t cbData;
816	/** Data pointer.
817	* This points to the data region or a scatter gather list based on the opcode.
818	*/
819	uint32_t u32PhysAddrData;
820	/** Reserved. */
821	uint8_t uReserved2[2];
822	/** Host adapter status. */
823	uint8_t uHostAdapterStatus;
824	/** Device adapter status. */
825	uint8_t uDeviceStatus;
826	/** The device the request is sent to. */
827	uint8_t uTargetId;
828	/*The LUN in the device. /
829	unsigned char uLogicalUnit : 5;
830	/** Legacy tag. */
831	bool fLegacyTagEnable : 1;
832	/** Legacy queue tag. */
833	unsigned char uLegacyQueueTag : 2;
834	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
835	uint8_t abCDB[12];
836	/** Reserved. */
837	uint8_t uReserved3[6];
838	/** Sense data pointer. */
839	uint32_t u32PhysAddrSenseData;
840	} CCB32, *PCCB32;
841	AssertCompileSize(CCB32, 40);
842
843
844	/**
845	* The 24-bit command control block.
846	*/
847	typedef struct CCB24
848	{
849	/** Opcode. */
850	uint8_t uOpcode;
851	/** The LUN in the device. */
852	unsigned char uLogicalUnit : 3;
853	/** Data direction for the request. */
854	unsigned char uDataDirection : 2;
855	/** The target device ID. */
856	unsigned char uTargetId : 3;
857	/** Length of the SCSI CDB. */
858	uint8_t cbCDB;
859	/** Sense data length. */
860	uint8_t cbSenseData;
861	/** Data length. */
862	Len24 acbData;
863	/** Data pointer.
864	* This points to the data region or a scatter gather list based on the opc
865	*/
866	Addr24 aPhysAddrData;
867	/** Pointer to next CCB for linked commands. */
868	Addr24 aPhysAddrLink;
869	/** Command linking identifier. */
870	uint8_t uLinkId;
871	/** Host adapter status. */
872	uint8_t uHostAdapterStatus;
873	/** Device adapter status. */
874	uint8_t uDeviceStatus;
875	/** Two unused bytes. */
876	uint8_t aReserved[2];
877	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
878	uint8_t abCDB[12];
879	} CCB24, *PCCB24;
880	AssertCompileSize(CCB24, 30);
881
882	/**
883	* The common 24-bit/32-bit command control block. The 32-bit CCB is laid out
884	* such that many fields are in the same location as in the older 24-bit CCB.
885	*/
886	typedef struct CCBC
887	{
888	/** Opcode. */
889	uint8_t uOpcode;
890	/** The LUN in the device. */
891	unsigned char uPad1 : 3;
892	/** Data direction for the request. */
893	unsigned char uDataDirection : 2;
894	/** The target device ID. */
895	unsigned char uPad2 : 3;
896	/** Length of the SCSI CDB. */
897	uint8_t cbCDB;
898	/** Sense data length. */
899	uint8_t cbSenseData;
900	uint8_t aPad1[10];
901	/** Host adapter status. */
902	uint8_t uHostAdapterStatus;
903	/** Device adapter status. */
904	uint8_t uDeviceStatus;
905	uint8_t aPad2[2];
906	/** The SCSI CDB (up to 12 bytes). */
907	uint8_t abCDB[12];
908	} CCBC, *PCCBC;
909	AssertCompileSize(CCBC, 30);
910
911	/* Make sure that the 24-bit/32-bit/common CCB offsets match. */
912	AssertCompileMemberOffset(CCBC, cbCDB, 2);
913	AssertCompileMemberOffset(CCB24, cbCDB, 2);
914	AssertCompileMemberOffset(CCB32, cbCDB, 2);
915	AssertCompileMemberOffset(CCBC, uHostAdapterStatus, 14);
916	AssertCompileMemberOffset(CCB24, uHostAdapterStatus, 14);
917	AssertCompileMemberOffset(CCB32, uHostAdapterStatus, 14);
918	AssertCompileMemberOffset(CCBC, abCDB, 18);
919	AssertCompileMemberOffset(CCB24, abCDB, 18);
920	AssertCompileMemberOffset(CCB32, abCDB, 18);
921
922	/** A union of all CCB types (24-bit/32-bit/common). */
923	typedef union CCBU
924	{
925	CCB32 n; /*< New 32-bit CCB. /
926	CCB24 o; /*< Old 24-bit CCB. /
927	CCBC c; /*< Common CCB subset. /
928	} CCBU, *PCCBU;
929
930	/** 32-bit scatter-gather list entry. */
931	typedef struct SGE32
932	{
933	uint32_t cbSegment;
934	uint32_t u32PhysAddrSegmentBase;
935	} SGE32, *PSGE32;
936	AssertCompileSize(SGE32, 8);
937
938	/** 24-bit scatter-gather list entry. */
939	typedef struct SGE24
940	{
941	Len24 acbSegment;
942	Addr24 aPhysAddrSegmentBase;
943	} SGE24, *PSGE24;
944	AssertCompileSize(SGE24, 6);
945
946	/**
947	* The structure for the "Execute SCSI Command" command.
948	*/
949	typedef struct ESCMD
950	{
951	/** Data length. */
952	uint32_t cbData;
953	/** Data pointer. */
954	uint32_t u32PhysAddrData;
955	/** The device the request is sent to. */
956	uint8_t uTargetId;
957	/** The LUN in the device. */
958	uint8_t uLogicalUnit;
959	/** Reserved */
960	unsigned char uReserved1 : 3;
961	/** Data direction for the request. */
962	unsigned char uDataDirection : 2;
963	/** Reserved */
964	unsigned char uReserved2 : 3;
965	/** Length of the SCSI CDB. */
966	uint8_t cbCDB;
967	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
968	uint8_t abCDB[12];
969	} ESCMD, *PESCMD;
970	AssertCompileSize(ESCMD, 24);
971
972	/**
973	* Task state for a CCB request.
974	*/
975	typedef struct BUSLOGICREQ
976	{
977	/** PDM extended media interface I/O request hande. */
978	PDMMEDIAEXIOREQ hIoReq;
979	/** Device this task is assigned to. */
980	PBUSLOGICDEVICE pTargetDevice;
981	/** The command control block from the guest. */
982	CCBU CCBGuest;
983	/** Guest physical address of th CCB. */
984	RTGCPHYS GCPhysAddrCCB;
985	/** Pointer to the R3 sense buffer. */
986	uint8_t *pbSenseBuffer;
987	/** Flag whether this is a request from the BIOS. */
988	bool fBIOS;
989	/** 24-bit request flag (default is 32-bit). */
990	bool fIs24Bit;
991	/** SCSI status code. */
992	uint8_t u8ScsiSts;
993	} BUSLOGICREQ;
994
995	#ifdef IN_RING3
996	/**
997	* Memory buffer callback.
998	*
999	* @returns nothing.
1000	* @param pThis The BusLogic controller instance.
1001	* @param GCPhys The guest physical address of the memory buffer.
1002	* @param pSgBuf The pointer to the host R3 S/G buffer.
1003	* @param cbCopy How many bytes to copy between the two buffers.
1004	* @param pcbSkip Initially contains the amount of bytes to skip
1005	* starting from the guest physical address before
1006	* accessing the S/G buffer and start copying data.
1007	* On return this contains the remaining amount if
1008	* cbCopy < *pcbSkip or 0 otherwise.
1009	*/
1010	typedef DECLCALLBACK(void) BUSLOGICR3MEMCOPYCALLBACK(PBUSLOGIC pThis, RTGCPHYS GCPhys, PRTSGBUF pSgBuf, size_t cbCopy,
1011	size_t *pcbSkip);
1012	/** Pointer to a memory copy buffer callback. */
1013	typedef BUSLOGICR3MEMCOPYCALLBACK *PBUSLOGICR3MEMCOPYCALLBACK;
1014	#endif
1015
1016	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
1017
1018
1019	/*********************************************************************************************************************************
1020	* Internal Functions *
1021	*********************************************************************************************************************************/
1022	#ifdef IN_RING3
1023	static int buslogicR3RegisterISARange(PBUSLOGIC pBusLogic, uint8_t uBaseCode);
1024	#endif
1025
1026
1027	/**
1028	* Assert IRQ line of the BusLogic adapter.
1029	*
1030	* @returns nothing.
1031	* @param pBusLogic Pointer to the BusLogic device instance.
1032	* @param fSuppressIrq Flag to suppress IRQ generation regardless of fIRQEnabled
1033	* @param uIrqType Type of interrupt being generated.
1034	*/
1035	static void buslogicSetInterrupt(PBUSLOGIC pBusLogic, bool fSuppressIrq, uint8_t uIrqType)
1036	{
1037	LogFlowFunc(("pBusLogic=%#p\n", pBusLogic));
1038
1039	/* The CMDC interrupt has priority over IMBL and OMBR. */
1040	if (uIrqType & (BL_INTR_IMBL \| BL_INTR_OMBR))
1041	{
1042	if (!(pBusLogic->regInterrupt & BL_INTR_CMDC))
1043	pBusLogic->regInterrupt \|= uIrqType; /* Report now. */
1044	else
1045	pBusLogic->uPendingIntr \|= uIrqType; /* Report later. */
1046	}
1047	else if (uIrqType & BL_INTR_CMDC)
1048	{
1049	AssertMsg(pBusLogic->regInterrupt == 0 \|\| pBusLogic->regInterrupt == (BL_INTR_INTV \| BL_INTR_CMDC),
1050	("regInterrupt=%02X\n", pBusLogic->regInterrupt));
1051	pBusLogic->regInterrupt \|= uIrqType;
1052	}
1053	else
1054	AssertMsgFailed(("Invalid interrupt state!\n"));
1055
1056	pBusLogic->regInterrupt \|= BL_INTR_INTV;
1057	if (pBusLogic->fIRQEnabled && !fSuppressIrq)
1058	{
1059	if (!pBusLogic->uIsaIrq)
1060	PDMDevHlpPCISetIrq(pBusLogic->CTX_SUFF(pDevIns), 0, 1);
1061	else
1062	PDMDevHlpISASetIrq(pBusLogic->CTX_SUFF(pDevIns), pBusLogic->uIsaIrq, 1);
1063	}
1064	}
1065
1066	/**
1067	* Deasserts the interrupt line of the BusLogic adapter.
1068	*
1069	* @returns nothing.
1070	* @param pBusLogic Pointer to the BusLogic device instance.
1071	*/
1072	static void buslogicClearInterrupt(PBUSLOGIC pBusLogic)
1073	{
1074	LogFlowFunc(("pBusLogic=%#p, clearing %#02x (pending %#02x)\n",
1075	pBusLogic, pBusLogic->regInterrupt, pBusLogic->uPendingIntr));
1076	pBusLogic->regInterrupt = 0;
1077	pBusLogic->regStatus &= ~BL_STAT_CMDINV;
1078	if (!pBusLogic->uIsaIrq)
1079	PDMDevHlpPCISetIrq(pBusLogic->CTX_SUFF(pDevIns), 0, 0);
1080	else
1081	PDMDevHlpISASetIrq(pBusLogic->CTX_SUFF(pDevIns), pBusLogic->uIsaIrq, 0);
1082	/* If there's another pending interrupt, report it now. */
1083	if (pBusLogic->uPendingIntr)
1084	{
1085	buslogicSetInterrupt(pBusLogic, false, pBusLogic->uPendingIntr);
1086	pBusLogic->uPendingIntr = 0;
1087	}
1088	}
1089
1090	#if defined(IN_RING3)
1091
1092	/**
1093	* Advances the mailbox pointer to the next slot.
1094	*
1095	* @returns nothing.
1096	* @param pBusLogic The BusLogic controller instance.
1097	*/
1098	DECLINLINE(void) buslogicR3OutgoingMailboxAdvance(PBUSLOGIC pBusLogic)
1099	{
1100	pBusLogic->uMailboxOutgoingPositionCurrent = (pBusLogic->uMailboxOutgoingPositionCurrent + 1) % pBusLogic->cMailbox;
1101	}
1102
1103	/**
1104	* Initialize local RAM of host adapter with default values.
1105	*
1106	* @returns nothing.
1107	* @param pBusLogic The BusLogic controller instance.
1108	*/
1109	static void buslogicR3InitializeLocalRam(PBUSLOGIC pBusLogic)
1110	{
1111	/*
1112	* These values are mostly from what I think is right
1113	* looking at the dmesg output from a Linux guest inside
1114	* a VMware server VM.
1115	*
1116	* So they don't have to be right :)
1117	*/
1118	memset(pBusLogic->LocalRam.u8View, 0, sizeof(HostAdapterLocalRam));
1119	pBusLogic->LocalRam.structured.autoSCSIData.fLevelSensitiveInterrupt = true;
1120	pBusLogic->LocalRam.structured.autoSCSIData.fParityCheckingEnabled = true;
1121	pBusLogic->LocalRam.structured.autoSCSIData.fExtendedTranslation = true; /* Same as in geometry register. */
1122	pBusLogic->LocalRam.structured.autoSCSIData.u16DeviceEnabledMask = UINT16_MAX; /* All enabled. Maybe mask out non present devices? */
1123	pBusLogic->LocalRam.structured.autoSCSIData.u16WidePermittedMask = UINT16_MAX;
1124	pBusLogic->LocalRam.structured.autoSCSIData.u16FastPermittedMask = UINT16_MAX;
1125	pBusLogic->LocalRam.structured.autoSCSIData.u16SynchronousPermittedMask = UINT16_MAX;
1126	pBusLogic->LocalRam.structured.autoSCSIData.u16DisconnectPermittedMask = UINT16_MAX;
1127	pBusLogic->LocalRam.structured.autoSCSIData.fStrictRoundRobinMode = pBusLogic->fStrictRoundRobinMode;
1128	pBusLogic->LocalRam.structured.autoSCSIData.u16UltraPermittedMask = UINT16_MAX;
1129	/** @todo calculate checksum? */
1130	}
1131
1132	/**
1133	* Do a hardware reset of the buslogic adapter.
1134	*
1135	* @returns VBox status code.
1136	* @param pBusLogic Pointer to the BusLogic device instance.
1137	* @param fResetIO Flag determining whether ISA I/O should be reset.
1138	*/
1139	static int buslogicR3HwReset(PBUSLOGIC pBusLogic, bool fResetIO)
1140	{
1141	LogFlowFunc(("pBusLogic=%#p\n", pBusLogic));
1142
1143	/* Reset registers to default values. */
1144	pBusLogic->regStatus = BL_STAT_HARDY \| BL_STAT_INREQ;
1145	pBusLogic->regGeometry = BL_GEOM_XLATEN;
1146	pBusLogic->uOperationCode = 0xff; /* No command executing. */
1147	pBusLogic->iParameter = 0;
1148	pBusLogic->cbCommandParametersLeft = 0;
1149	pBusLogic->fIRQEnabled = true;
1150	pBusLogic->fStrictRoundRobinMode = false;
1151	pBusLogic->fExtendedLunCCBFormat = false;
1152	pBusLogic->uMailboxOutgoingPositionCurrent = 0;
1153	pBusLogic->uMailboxIncomingPositionCurrent = 0;
1154	pBusLogic->uAhaSigIdx = 0;
1155
1156	/* Clear any active/pending interrupts. */
1157	pBusLogic->uPendingIntr = 0;
1158	buslogicClearInterrupt(pBusLogic);
1159
1160	/* Guest-initiated HBA reset does not affect ISA port I/O. */
1161	if (fResetIO)
1162	{
1163	buslogicR3RegisterISARange(pBusLogic, pBusLogic->uDefaultISABaseCode);
1164	}
1165	buslogicR3InitializeLocalRam(pBusLogic);
1166	vboxscsiInitialize(&pBusLogic->VBoxSCSI);
1167
1168	return VINF_SUCCESS;
1169	}
1170
1171	#endif /* IN_RING3 */
1172
1173	/**
1174	* Resets the command state machine for the next command and notifies the guest.
1175	*
1176	* @returns nothing.
1177	* @param pBusLogic Pointer to the BusLogic device instance
1178	* @param fSuppressIrq Flag to suppress IRQ generation regardless of current state
1179	*/
1180	static void buslogicCommandComplete(PBUSLOGIC pBusLogic, bool fSuppressIrq)
1181	{
1182	LogFlowFunc(("pBusLogic=%#p\n", pBusLogic));
1183	Assert(pBusLogic->uOperationCode != BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND);
1184
1185	pBusLogic->fUseLocalRam = false;
1186	pBusLogic->regStatus \|= BL_STAT_HARDY;
1187	pBusLogic->iReply = 0;
1188
1189	/* The Enable OMBR command does not set CMDC when successful. */
1190	if (pBusLogic->uOperationCode != BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT)
1191	{
1192	/* Notify that the command is complete. */
1193	pBusLogic->regStatus &= ~BL_STAT_DIRRDY;
1194	buslogicSetInterrupt(pBusLogic, fSuppressIrq, BL_INTR_CMDC);
1195	}
1196
1197	pBusLogic->uOperationCode = 0xff;
1198	pBusLogic->iParameter = 0;
1199	}
1200
1201	/**
1202	* Memory write helper to handle PCI/ISA differences.
1203	*
1204	* @returns nothing.
1205	* @param pThis Pointer to the BusLogic device instance
1206	* @param GCPhys Guest physical memory address
1207	* @param pvBuf Host side buffer address
1208	* @param cbWrite Number of bytes to write
1209	*/
1210	static void blPhysWrite(PBUSLOGIC pThis, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
1211	{
1212	if (!pThis->uIsaIrq)
1213	PDMDevHlpPCIPhysWrite(pThis->CTX_SUFF(pDevIns), GCPhys, pvBuf, cbWrite);
1214	else
1215	PDMDevHlpPhysWrite(pThis->CTX_SUFF(pDevIns), GCPhys, pvBuf, cbWrite);
1216	}
1217
1218	#if defined(IN_RING3)
1219
1220	/**
1221	* Initiates a hard reset which was issued from the guest.
1222	*
1223	* @returns nothing
1224	* @param pBusLogic Pointer to the BusLogic device instance.
1225	* @param fHardReset Flag initiating a hard (vs. soft) reset.
1226	*/
1227	static void buslogicR3InitiateReset(PBUSLOGIC pBusLogic, bool fHardReset)
1228	{
1229	LogFlowFunc(("pBusLogic=%#p fHardReset=%d\n", pBusLogic, fHardReset));
1230
1231	buslogicR3HwReset(pBusLogic, false);
1232
1233	if (fHardReset)
1234	{
1235	/* Set the diagnostic active bit in the status register and clear the ready state. */
1236	pBusLogic->regStatus \|= BL_STAT_DACT;
1237	pBusLogic->regStatus &= ~BL_STAT_HARDY;
1238
1239	/* Remember when the guest initiated a reset (after we're done resetting). */
1240	pBusLogic->u64ResetTime = PDMDevHlpTMTimeVirtGetNano(pBusLogic->CTX_SUFF(pDevIns));
1241	}
1242	}
1243
1244
1245	/**
1246	* Send a mailbox with set status codes to the guest.
1247	*
1248	* @returns nothing.
1249	* @param pBusLogic Pointer to the BusLogic device instance.
1250	* @param GCPhysAddrCCB The physical guest address of the CCB the mailbox is for.
1251	* @param pCCBGuest The command control block.
1252	* @param uHostAdapterStatus The host adapter status code to set.
1253	* @param uDeviceStatus The target device status to set.
1254	* @param uMailboxCompletionCode Completion status code to set in the mailbox.
1255	*/
1256	static void buslogicR3SendIncomingMailbox(PBUSLOGIC pBusLogic, RTGCPHYS GCPhysAddrCCB,
1257	PCCBU pCCBGuest, uint8_t uHostAdapterStatus,
1258	uint8_t uDeviceStatus, uint8_t uMailboxCompletionCode)
1259	{
1260	Mailbox32 MbxIn;
1261
1262	MbxIn.u32PhysAddrCCB = (uint32_t)GCPhysAddrCCB;
1263	MbxIn.u.in.uHostAdapterStatus = uHostAdapterStatus;
1264	MbxIn.u.in.uTargetDeviceStatus = uDeviceStatus;
1265	MbxIn.u.in.uCompletionCode = uMailboxCompletionCode;
1266
1267	int rc = PDMCritSectEnter(&pBusLogic->CritSectIntr, VINF_SUCCESS);
1268	AssertRC(rc);
1269
1270	RTGCPHYS GCPhysAddrMailboxIncoming = pBusLogic->GCPhysAddrMailboxIncomingBase
1271	+ ( pBusLogic->uMailboxIncomingPositionCurrent
1272	* (pBusLogic->fMbxIs24Bit ? sizeof(Mailbox24) : sizeof(Mailbox32)) );
1273
1274	if (uMailboxCompletionCode != BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND)
1275	{
1276	LogFlowFunc(("Completing CCB %RGp hstat=%u, dstat=%u, outgoing mailbox at %RGp\n", GCPhysAddrCCB,
1277	uHostAdapterStatus, uDeviceStatus, GCPhysAddrMailboxIncoming));
1278
1279	/* Update CCB. */
1280	pCCBGuest->c.uHostAdapterStatus = uHostAdapterStatus;
1281	pCCBGuest->c.uDeviceStatus = uDeviceStatus;
1282	/* Rewrite CCB up to the CDB; perhaps more than necessary. */
1283	blPhysWrite(pBusLogic, GCPhysAddrCCB, pCCBGuest, RT_UOFFSETOF(CCBC, abCDB));
1284	}
1285
1286	# ifdef RT_STRICT
1287	uint8_t uCode;
1288	unsigned uCodeOffs = pBusLogic->fMbxIs24Bit ? RT_OFFSETOF(Mailbox24, uCmdState) : RT_OFFSETOF(Mailbox32, u.out.uActionCode);
1289	PDMDevHlpPhysRead(pBusLogic->CTX_SUFF(pDevIns), GCPhysAddrMailboxIncoming + uCodeOffs, &uCode, sizeof(uCode));
1290	Assert(uCode == BUSLOGIC_MAILBOX_INCOMING_COMPLETION_FREE);
1291	# endif
1292
1293	/* Update mailbox. */
1294	if (pBusLogic->fMbxIs24Bit)
1295	{
1296	Mailbox24 Mbx24;
1297
1298	Mbx24.uCmdState = MbxIn.u.in.uCompletionCode;
1299	U32_TO_ADDR(Mbx24.aPhysAddrCCB, MbxIn.u32PhysAddrCCB);
1300	Log(("24-bit mailbox: completion code=%u, CCB at %RGp\n", Mbx24.uCmdState, (RTGCPHYS)ADDR_TO_U32(Mbx24.aPhysAddrCCB)));
1301	blPhysWrite(pBusLogic, GCPhysAddrMailboxIncoming, &Mbx24, sizeof(Mailbox24));
1302	}
1303	else
1304	{
1305	Log(("32-bit mailbox: completion code=%u, CCB at %RGp\n", MbxIn.u.in.uCompletionCode, GCPhysAddrCCB));
1306	blPhysWrite(pBusLogic, GCPhysAddrMailboxIncoming, &MbxIn, sizeof(Mailbox32));
1307	}
1308
1309	/* Advance to next mailbox position. */
1310	pBusLogic->uMailboxIncomingPositionCurrent++;
1311	if (pBusLogic->uMailboxIncomingPositionCurrent >= pBusLogic->cMailbox)
1312	pBusLogic->uMailboxIncomingPositionCurrent = 0;
1313
1314	# ifdef LOG_ENABLED
1315	ASMAtomicIncU32(&pBusLogic->cInMailboxesReady);
1316	# endif
1317
1318	buslogicSetInterrupt(pBusLogic, false, BL_INTR_IMBL);
1319
1320	PDMCritSectLeave(&pBusLogic->CritSectIntr);
1321	}
1322
1323	# ifdef LOG_ENABLED
1324
1325	/**
1326	* Dumps the content of a mailbox for debugging purposes.
1327	*
1328	* @return nothing
1329	* @param pMailbox The mailbox to dump.
1330	* @param fOutgoing true if dumping the outgoing state.
1331	* false if dumping the incoming state.
1332	*/
1333	static void buslogicR3DumpMailboxInfo(PMailbox32 pMailbox, bool fOutgoing)
1334	{
1335	Log(("%s: Dump for %s mailbox:\n", __FUNCTION__, fOutgoing ? "outgoing" : "incoming"));
1336	Log(("%s: u32PhysAddrCCB=%#x\n", __FUNCTION__, pMailbox->u32PhysAddrCCB));
1337	if (fOutgoing)
1338	{
1339	Log(("%s: uActionCode=%u\n", __FUNCTION__, pMailbox->u.out.uActionCode));
1340	}
1341	else
1342	{
1343	Log(("%s: uHostAdapterStatus=%u\n", __FUNCTION__, pMailbox->u.in.uHostAdapterStatus));
1344	Log(("%s: uTargetDeviceStatus=%u\n", __FUNCTION__, pMailbox->u.in.uTargetDeviceStatus));
1345	Log(("%s: uCompletionCode=%u\n", __FUNCTION__, pMailbox->u.in.uCompletionCode));
1346	}
1347	}
1348
1349	/**
1350	* Dumps the content of a command control block for debugging purposes.
1351	*
1352	* @returns nothing.
1353	* @param pCCB Pointer to the command control block to dump.
1354	* @param fIs24BitCCB Flag to determine CCB format.
1355	*/
1356	static void buslogicR3DumpCCBInfo(PCCBU pCCB, bool fIs24BitCCB)
1357	{
1358	Log(("%s: Dump for %s Command Control Block:\n", __FUNCTION__, fIs24BitCCB ? "24-bit" : "32-bit"));
1359	Log(("%s: uOpCode=%#x\n", __FUNCTION__, pCCB->c.uOpcode));
1360	Log(("%s: uDataDirection=%u\n", __FUNCTION__, pCCB->c.uDataDirection));
1361	Log(("%s: cbCDB=%u\n", __FUNCTION__, pCCB->c.cbCDB));
1362	Log(("%s: cbSenseData=%u\n", __FUNCTION__, pCCB->c.cbSenseData));
1363	Log(("%s: uHostAdapterStatus=%u\n", __FUNCTION__, pCCB->c.uHostAdapterStatus));
1364	Log(("%s: uDeviceStatus=%u\n", __FUNCTION__, pCCB->c.uDeviceStatus));
1365	if (fIs24BitCCB)
1366	{
1367	Log(("%s: cbData=%u\n", __FUNCTION__, LEN_TO_U32(pCCB->o.acbData)));
1368	Log(("%s: PhysAddrData=%#x\n", __FUNCTION__, ADDR_TO_U32(pCCB->o.aPhysAddrData)));
1369	Log(("%s: uTargetId=%u\n", __FUNCTION__, pCCB->o.uTargetId));
1370	Log(("%s: uLogicalUnit=%u\n", __FUNCTION__, pCCB->o.uLogicalUnit));
1371	}
1372	else
1373	{
1374	Log(("%s: cbData=%u\n", __FUNCTION__, pCCB->n.cbData));
1375	Log(("%s: PhysAddrData=%#x\n", __FUNCTION__, pCCB->n.u32PhysAddrData));
1376	Log(("%s: uTargetId=%u\n", __FUNCTION__, pCCB->n.uTargetId));
1377	Log(("%s: uLogicalUnit=%u\n", __FUNCTION__, pCCB->n.uLogicalUnit));
1378	Log(("%s: fTagQueued=%d\n", __FUNCTION__, pCCB->n.fTagQueued));
1379	Log(("%s: uQueueTag=%u\n", __FUNCTION__, pCCB->n.uQueueTag));
1380	Log(("%s: fLegacyTagEnable=%u\n", __FUNCTION__, pCCB->n.fLegacyTagEnable));
1381	Log(("%s: uLegacyQueueTag=%u\n", __FUNCTION__, pCCB->n.uLegacyQueueTag));
1382	Log(("%s: PhysAddrSenseData=%#x\n", __FUNCTION__, pCCB->n.u32PhysAddrSenseData));
1383	}
1384	Log(("%s: uCDB[0]=%#x\n", __FUNCTION__, pCCB->c.abCDB[0]));
1385	for (int i = 1; i < pCCB->c.cbCDB; i++)
1386	Log(("%s: uCDB[%d]=%u\n", __FUNCTION__, i, pCCB->c.abCDB[i]));
1387	}
1388
1389	# endif /* LOG_ENABLED */
1390
1391	/**
1392	* Allocate data buffer.
1393	*
1394	* @param pDevIns PDM device instance.
1395	* @param fIs24Bit Flag whether the 24bit SG format is used.
1396	* @param GCSGList Guest physical address of S/G list.
1397	* @param cEntries Number of list entries to read.
1398	* @param pSGEList Pointer to 32-bit S/G list storage.
1399	*/
1400	static void buslogicR3ReadSGEntries(PPDMDEVINS pDevIns, bool fIs24Bit, RTGCPHYS GCSGList,
1401	uint32_t cEntries, SGE32 *pSGEList)
1402	{
1403	/* Read the S/G entries. Convert 24-bit entries to 32-bit format. */
1404	if (fIs24Bit)
1405	{
1406	SGE24 aSGE24[32];
1407	Assert(cEntries <= RT_ELEMENTS(aSGE24));
1408
1409	Log2(("Converting %u 24-bit S/G entries to 32-bit\n", cEntries));
1410	PDMDevHlpPhysRead(pDevIns, GCSGList, &aSGE24, cEntries * sizeof(SGE24));
1411	for (uint32_t i = 0; i < cEntries; ++i)
1412	{
1413	pSGEList[i].cbSegment = LEN_TO_U32(aSGE24[i].acbSegment);
1414	pSGEList[i].u32PhysAddrSegmentBase = ADDR_TO_U32(aSGE24[i].aPhysAddrSegmentBase);
1415	}
1416	}
1417	else
1418	PDMDevHlpPhysRead(pDevIns, GCSGList, pSGEList, cEntries * sizeof(SGE32));
1419	}
1420
1421	/**
1422	* Determines the size of th guest data buffer.
1423	*
1424	* @returns VBox status code.
1425	* @param pDevIns PDM device instance.
1426	* @param pCCBGuest The CCB of the guest.
1427	* @param fIs24Bit Flag whether the 24bit SG format is used.
1428	* @param pcbBuf Where to store the size of the guest data buffer on success.
1429	*/
1430	static int buslogicR3QueryDataBufferSize(PPDMDEVINS pDevIns, PCCBU pCCBGuest, bool fIs24Bit, size_t *pcbBuf)
1431	{
1432	int rc = VINF_SUCCESS;
1433	uint32_t cbDataCCB;
1434	uint32_t u32PhysAddrCCB;
1435	size_t cbBuf = 0;
1436
1437	/* Extract the data length and physical address from the CCB. */
1438	if (fIs24Bit)
1439	{
1440	u32PhysAddrCCB = ADDR_TO_U32(pCCBGuest->o.aPhysAddrData);
1441	cbDataCCB = LEN_TO_U32(pCCBGuest->o.acbData);
1442	}
1443	else
1444	{
1445	u32PhysAddrCCB = pCCBGuest->n.u32PhysAddrData;
1446	cbDataCCB = pCCBGuest->n.cbData;
1447	}
1448
1449	#if 1
1450	/* Hack for NT 10/91: A CCB describes a 2K buffer, but TEST UNIT READY is executed. This command
1451	* returns no data, hence the buffer must be left alone!
1452	*/
1453	if (pCCBGuest->c.abCDB[0] == 0)
1454	cbDataCCB = 0;
1455	#endif
1456
1457	if ( (pCCBGuest->c.uDataDirection != BUSLOGIC_CCB_DIRECTION_NO_DATA)
1458	&& cbDataCCB)
1459	{
1460	/*
1461	* The BusLogic adapter can handle two different data buffer formats.
1462	* The first one is that the data pointer entry in the CCB points to
1463	* the buffer directly. In second mode the data pointer points to a
1464	* scatter gather list which describes the buffer.
1465	*/
1466	if ( (pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER)
1467	\|\| (pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
1468	{
1469	uint32_t cScatterGatherGCRead;
1470	uint32_t iScatterGatherEntry;
1471	SGE32 aScatterGatherReadGC[32]; /* A buffer for scatter gather list entries read from guest memory. */
1472	uint32_t cScatterGatherGCLeft = cbDataCCB / (fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1473	RTGCPHYS GCPhysAddrScatterGatherCurrent = u32PhysAddrCCB;
1474
1475	/* Count number of bytes to transfer. */
1476	do
1477	{
1478	cScatterGatherGCRead = (cScatterGatherGCLeft < RT_ELEMENTS(aScatterGatherReadGC))
1479	? cScatterGatherGCLeft
1480	: RT_ELEMENTS(aScatterGatherReadGC);
1481	cScatterGatherGCLeft -= cScatterGatherGCRead;
1482
1483	buslogicR3ReadSGEntries(pDevIns, fIs24Bit, GCPhysAddrScatterGatherCurrent, cScatterGatherGCRead, aScatterGatherReadGC);
1484
1485	for (iScatterGatherEntry = 0; iScatterGatherEntry < cScatterGatherGCRead; iScatterGatherEntry++)
1486	cbBuf += aScatterGatherReadGC[iScatterGatherEntry].cbSegment;
1487
1488	/* Set address to the next entries to read. */
1489	GCPhysAddrScatterGatherCurrent += cScatterGatherGCRead * (fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1490	} while (cScatterGatherGCLeft > 0);
1491
1492	Log(("%s: cbBuf=%d\n", __FUNCTION__, cbBuf));
1493	}
1494	else if ( pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB
1495	\|\| pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
1496	cbBuf = cbDataCCB;
1497	}
1498
1499	if (RT_SUCCESS(rc))
1500	*pcbBuf = cbBuf;
1501
1502	return rc;
1503	}
1504
1505	/**
1506	* Copy from guest to host memory worker.
1507	*
1508	* @copydoc BUSLOGICR3MEMCOPYCALLBACK
1509	*/
1510	static DECLCALLBACK(void) buslogicR3CopyBufferFromGuestWorker(PBUSLOGIC pThis, RTGCPHYS GCPhys, PRTSGBUF pSgBuf,
1511	size_t cbCopy, size_t *pcbSkip)
1512	{
1513	size_t cbSkipped = RT_MIN(cbCopy, *pcbSkip);
1514	cbCopy -= cbSkipped;
1515	GCPhys += cbSkipped;
1516	*pcbSkip -= cbSkipped;
1517
1518	while (cbCopy)
1519	{
1520	size_t cbSeg = cbCopy;
1521	void *pvSeg = RTSgBufGetNextSegment(pSgBuf, &cbSeg);
1522
1523	AssertPtr(pvSeg);
1524	PDMDevHlpPhysRead(pThis->CTX_SUFF(pDevIns), GCPhys, pvSeg, cbSeg);
1525	GCPhys += cbSeg;
1526	cbCopy -= cbSeg;
1527	}
1528	}
1529
1530	/**
1531	* Copy from host to guest memory worker.
1532	*
1533	* @copydoc BUSLOGICR3MEMCOPYCALLBACK
1534	*/
1535	static DECLCALLBACK(void) buslogicR3CopyBufferToGuestWorker(PBUSLOGIC pThis, RTGCPHYS GCPhys, PRTSGBUF pSgBuf,
1536	size_t cbCopy, size_t *pcbSkip)
1537	{
1538	size_t cbSkipped = RT_MIN(cbCopy, *pcbSkip);
1539	cbCopy -= cbSkipped;
1540	GCPhys += cbSkipped;
1541	*pcbSkip -= cbSkipped;
1542
1543	while (cbCopy)
1544	{
1545	size_t cbSeg = cbCopy;
1546	void *pvSeg = RTSgBufGetNextSegment(pSgBuf, &cbSeg);
1547
1548	AssertPtr(pvSeg);
1549	blPhysWrite(pThis, GCPhys, pvSeg, cbSeg);
1550	GCPhys += cbSeg;
1551	cbCopy -= cbSeg;
1552	}
1553	}
1554
1555	/**
1556	* Walks the guest S/G buffer calling the given copy worker for every buffer.
1557	*
1558	* @returns The amout of bytes actually copied.
1559	* @param pThis Pointer to the Buslogic device state.
1560	* @param pReq Pointe to the request state.
1561	* @param pfnCopyWorker The copy method to apply for each guest buffer.
1562	* @param pSgBuf The host S/G buffer.
1563	* @param cbSkip How many bytes to skip in advance before starting to copy.
1564	* @param cbCopy How many bytes to copy.
1565	*/
1566	static size_t buslogicR3SgBufWalker(PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1567	PBUSLOGICR3MEMCOPYCALLBACK pfnCopyWorker,
1568	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1569	{
1570	PPDMDEVINS pDevIns = pThis->CTX_SUFF(pDevIns);
1571	uint32_t cbDataCCB;
1572	uint32_t u32PhysAddrCCB;
1573	size_t cbCopied = 0;
1574
1575	/*
1576	* Add the amount to skip to the host buffer size to avoid a
1577	* few conditionals later on.
1578	*/
1579	cbCopy += cbSkip;
1580
1581	/* Extract the data length and physical address from the CCB. */
1582	if (pReq->fIs24Bit)
1583	{
1584	u32PhysAddrCCB = ADDR_TO_U32(pReq->CCBGuest.o.aPhysAddrData);
1585	cbDataCCB = LEN_TO_U32(pReq->CCBGuest.o.acbData);
1586	}
1587	else
1588	{
1589	u32PhysAddrCCB = pReq->CCBGuest.n.u32PhysAddrData;
1590	cbDataCCB = pReq->CCBGuest.n.cbData;
1591	}
1592
1593	#if 1
1594	/* Hack for NT 10/91: A CCB describes a 2K buffer, but TEST UNIT READY is executed. This command
1595	* returns no data, hence the buffer must be left alone!
1596	*/
1597	if (pReq->CCBGuest.c.abCDB[0] == 0)
1598	cbDataCCB = 0;
1599	#endif
1600
1601	LogFlowFunc(("pReq=%#p cbDataCCB=%u direction=%u cbCopy=%zu\n", pReq, cbDataCCB,
1602	pReq->CCBGuest.c.uDataDirection, cbCopy));
1603
1604	if ( (cbDataCCB > 0)
1605	&& ( pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_IN
1606	\|\| pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_OUT
1607	\|\| pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_UNKNOWN))
1608	{
1609	if ( (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER)
1610	\|\| (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
1611	{
1612	uint32_t cScatterGatherGCRead;
1613	uint32_t iScatterGatherEntry;
1614	SGE32 aScatterGatherReadGC[32]; /* Number of scatter gather list entries read from guest memory. */
1615	uint32_t cScatterGatherGCLeft = cbDataCCB / (pReq->fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1616	RTGCPHYS GCPhysAddrScatterGatherCurrent = u32PhysAddrCCB;
1617
1618	do
1619	{
1620	cScatterGatherGCRead = (cScatterGatherGCLeft < RT_ELEMENTS(aScatterGatherReadGC))
1621	? cScatterGatherGCLeft
1622	: RT_ELEMENTS(aScatterGatherReadGC);
1623	cScatterGatherGCLeft -= cScatterGatherGCRead;
1624
1625	buslogicR3ReadSGEntries(pDevIns, pReq->fIs24Bit, GCPhysAddrScatterGatherCurrent,
1626	cScatterGatherGCRead, aScatterGatherReadGC);
1627
1628	for (iScatterGatherEntry = 0; iScatterGatherEntry < cScatterGatherGCRead && cbCopy > 0; iScatterGatherEntry++)
1629	{
1630	RTGCPHYS GCPhysAddrDataBase;
1631	size_t cbCopyThis;
1632
1633	Log(("%s: iScatterGatherEntry=%u\n", __FUNCTION__, iScatterGatherEntry));
1634
1635	GCPhysAddrDataBase = (RTGCPHYS)aScatterGatherReadGC[iScatterGatherEntry].u32PhysAddrSegmentBase;
1636	cbCopyThis = RT_MIN(cbCopy, aScatterGatherReadGC[iScatterGatherEntry].cbSegment);
1637
1638	Log(("%s: GCPhysAddrDataBase=%RGp cbCopyThis=%zu\n", __FUNCTION__, GCPhysAddrDataBase, cbCopyThis));
1639
1640	pfnCopyWorker(pThis, GCPhysAddrDataBase, pSgBuf, cbCopyThis, &cbSkip);
1641	cbCopied += cbCopyThis;
1642	cbCopy -= cbCopyThis;
1643	}
1644
1645	/* Set address to the next entries to read. */
1646	GCPhysAddrScatterGatherCurrent += cScatterGatherGCRead * (pReq->fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1647	} while ( cScatterGatherGCLeft > 0
1648	&& cbCopy > 0);
1649
1650	}
1651	else if ( pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB
1652	\|\| pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
1653	{
1654	/* The buffer is not scattered. */
1655	RTGCPHYS GCPhysAddrDataBase = u32PhysAddrCCB;
1656
1657	AssertMsg(GCPhysAddrDataBase != 0, ("Physical address is 0\n"));
1658
1659	Log(("Non-scattered buffer:\n"));
1660	Log(("u32PhysAddrData=%#x\n", u32PhysAddrCCB));
1661	Log(("cbData=%u\n", cbDataCCB));
1662	Log(("GCPhysAddrDataBase=0x%RGp\n", GCPhysAddrDataBase));
1663
1664	/* Copy the data into the guest memory. */
1665	pfnCopyWorker(pThis, GCPhysAddrDataBase, pSgBuf, RT_MIN(cbDataCCB, cbCopy), &cbSkip);
1666	cbCopied += RT_MIN(cbDataCCB, cbCopy);
1667	}
1668	}
1669
1670	return cbCopied - RT_MIN(cbSkip, cbCopied);
1671	}
1672
1673	/**
1674	* Copies a data buffer into the S/G buffer set up by the guest.
1675	*
1676	* @returns Amount of bytes copied to the guest.
1677	* @param pThis The BusLogic controller device instance.
1678	* @param pReq Request structure.
1679	* @param pSgBuf The S/G buffer to copy from.
1680	* @param cbSkip How many bytes to skip in advance before starting to copy.
1681	* @param cbCopy How many bytes to copy.
1682	*/
1683	static size_t buslogicR3CopySgBufToGuest(PBUSLOGIC pThis, PBUSLOGICREQ pReq, PRTSGBUF pSgBuf,
1684	size_t cbSkip, size_t cbCopy)
1685	{
1686	return buslogicR3SgBufWalker(pThis, pReq, buslogicR3CopyBufferToGuestWorker,
1687	pSgBuf, cbSkip, cbCopy);
1688	}
1689
1690	/**
1691	* Copies the guest S/G buffer into a host data buffer.
1692	*
1693	* @returns Amount of bytes copied from the guest.
1694	* @param pThis The BusLogic controller device instance.
1695	* @param pReq Request structure.
1696	* @param pSgBuf The S/G buffer to copy into.
1697	* @param cbSkip How many bytes to skip in advance before starting to copy.
1698	* @param cbCopy How many bytes to copy.
1699	*/
1700	static size_t buslogicR3CopySgBufFromGuest(PBUSLOGIC pThis, PBUSLOGICREQ pReq, PRTSGBUF pSgBuf,
1701	size_t cbSkip, size_t cbCopy)
1702	{
1703	return buslogicR3SgBufWalker(pThis, pReq, buslogicR3CopyBufferFromGuestWorker,
1704	pSgBuf, cbSkip, cbCopy);
1705	}
1706
1707	/** Convert sense buffer length taking into account shortcut values. */
1708	static uint32_t buslogicR3ConvertSenseBufferLength(uint32_t cbSense)
1709	{
1710	/* Convert special sense buffer length values. */
1711	if (cbSense == 0)
1712	cbSense = 14; /* 0 means standard 14-byte buffer. */
1713	else if (cbSense == 1)
1714	cbSense = 0; /* 1 means no sense data. */
1715	else if (cbSense < 8)
1716	AssertMsgFailed(("Reserved cbSense value of %d used!\n", cbSense));
1717
1718	return cbSense;
1719	}
1720
1721	/**
1722	* Free the sense buffer.
1723	*
1724	* @returns nothing.
1725	* @param pReq Pointer to the request state.
1726	* @param fCopy If sense data should be copied to guest memory.
1727	*/
1728	static void buslogicR3SenseBufferFree(PBUSLOGICREQ pReq, bool fCopy)
1729	{
1730	uint32_t cbSenseBuffer;
1731
1732	cbSenseBuffer = buslogicR3ConvertSenseBufferLength(pReq->CCBGuest.c.cbSenseData);
1733
1734	/* Copy the sense buffer into guest memory if requested. */
1735	if (fCopy && cbSenseBuffer)
1736	{
1737	PBUSLOGIC pThis = pReq->pTargetDevice->CTX_SUFF(pBusLogic);
1738	RTGCPHYS GCPhysAddrSenseBuffer;
1739
1740	/* With 32-bit CCBs, the (optional) sense buffer physical address is provided separately.
1741	* On the other hand, with 24-bit CCBs, the sense buffer is simply located at the end of
1742	* the CCB, right after the variable-length CDB.
1743	*/
1744	if (pReq->fIs24Bit)
1745	{
1746	GCPhysAddrSenseBuffer = pReq->GCPhysAddrCCB;
1747	GCPhysAddrSenseBuffer += pReq->CCBGuest.c.cbCDB + RT_OFFSETOF(CCB24, abCDB);
1748	}
1749	else
1750	GCPhysAddrSenseBuffer = pReq->CCBGuest.n.u32PhysAddrSenseData;
1751
1752	Log3(("%s: sense buffer: %.*Rhxs\n", __FUNCTION__, cbSenseBuffer, pReq->pbSenseBuffer));
1753	blPhysWrite(pThis, GCPhysAddrSenseBuffer, pReq->pbSenseBuffer, cbSenseBuffer);
1754	}
1755
1756	RTMemFree(pReq->pbSenseBuffer);
1757	pReq->pbSenseBuffer = NULL;
1758	}
1759
1760	/**
1761	* Alloc the sense buffer.
1762	*
1763	* @returns VBox status code.
1764	* @param pReq Pointer to the task state.
1765	*/
1766	static int buslogicR3SenseBufferAlloc(PBUSLOGICREQ pReq)
1767	{
1768	pReq->pbSenseBuffer = NULL;
1769
1770	uint32_t cbSenseBuffer = buslogicR3ConvertSenseBufferLength(pReq->CCBGuest.c.cbSenseData);
1771	if (cbSenseBuffer)
1772	{
1773	pReq->pbSenseBuffer = (uint8_t *)RTMemAllocZ(cbSenseBuffer);
1774	if (!pReq->pbSenseBuffer)
1775	return VERR_NO_MEMORY;
1776	}
1777
1778	return VINF_SUCCESS;
1779	}
1780
1781	#endif /* IN_RING3 */
1782
1783	/**
1784	* Parses the command buffer and executes it.
1785	*
1786	* @returns VBox status code.
1787	* @param pDevIns The PDM device instance.
1788	* @param pBusLogic Pointer to the BusLogic device instance.
1789	*/
1790	static int buslogicProcessCommand(PPDMDEVINS pDevIns, PBUSLOGIC pBusLogic)
1791	{
1792	int rc = VINF_SUCCESS;
1793	bool fSuppressIrq = false;
1794
1795	LogFlowFunc(("pBusLogic=%#p\n", pBusLogic));
1796	AssertMsg(pBusLogic->uOperationCode != 0xff, ("There is no command to execute\n"));
1797
1798	switch (pBusLogic->uOperationCode)
1799	{
1800	case BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT:
1801	/* Valid command, no reply. */
1802	pBusLogic->cbReplyParametersLeft = 0;
1803	break;
1804	case BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION:
1805	{
1806	PReplyInquirePCIHostAdapterInformation pReply = (PReplyInquirePCIHostAdapterInformation)pBusLogic->aReplyBuffer;
1807	memset(pReply, 0, sizeof(ReplyInquirePCIHostAdapterInformation));
1808
1809	/* It seems VMware does not provide valid information here too, lets do the same :) */
1810	pReply->InformationIsValid = 0;
1811	pReply->IsaIOPort = pBusLogic->uISABaseCode;
1812	pReply->IRQ = PCIDevGetInterruptLine(pDevIns->apPciDevs[0]);
1813	pBusLogic->cbReplyParametersLeft = sizeof(ReplyInquirePCIHostAdapterInformation);
1814	break;
1815	}
1816	case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
1817	{
1818	/* no-op */
1819	pBusLogic->cbReplyParametersLeft = 0;
1820	break;
1821	}
1822	case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
1823	{
1824	/* Modify the ISA-compatible I/O port base. Note that this technically
1825	* violates the PCI spec, as this address is not reported through PCI.
1826	* However, it is required for compatibility with old drivers.
1827	*/
1828	#ifdef IN_RING3
1829	Log(("ISA I/O for PCI (code %x)\n", pBusLogic->aCommandBuffer[0]));
1830	buslogicR3RegisterISARange(pBusLogic, pBusLogic->aCommandBuffer[0]);
1831	pBusLogic->cbReplyParametersLeft = 0;
1832	fSuppressIrq = true;
1833	break;
1834	#else
1835	AssertMsgFailed(("Must never get here!\n"));
1836	break;
1837	#endif
1838	}
1839	case BUSLOGICCOMMAND_INQUIRE_BOARD_ID:
1840	{
1841	/* The special option byte is important: If it is '0' or 'B', Windows NT drivers
1842	* for Adaptec AHA-154x may claim the adapter. The BusLogic drivers will claim
1843	* the adapter only when the byte is not '0' or 'B'.
1844	*/
1845	if (pBusLogic->uDevType == DEV_AHA_1540B)
1846	{
1847	pBusLogic->aReplyBuffer[0] = 'A'; /* Firmware option bytes */
1848	pBusLogic->aReplyBuffer[1] = '0'; /* Special option byte */
1849	}
1850	else
1851	{
1852	pBusLogic->aReplyBuffer[0] = 'A'; /* Firmware option bytes */
1853	pBusLogic->aReplyBuffer[1] = 'A'; /* Special option byte */
1854	}
1855
1856	/* We report version 5.07B. This reply will provide the first two digits. */
1857	pBusLogic->aReplyBuffer[2] = '5'; /* Major version 5 */
1858	pBusLogic->aReplyBuffer[3] = '0'; /* Minor version 0 */
1859	pBusLogic->cbReplyParametersLeft = 4; /* Reply is 4 bytes long */
1860	break;
1861	}
1862	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER:
1863	{
1864	if (pBusLogic->uDevType == DEV_AHA_1540B)
1865	{
1866	/* Newer ASPI4DOS.SYS versions expect this command to fail. */
1867	Log(("Command %#x not valid for this adapter\n", pBusLogic->uOperationCode));
1868	pBusLogic->cbReplyParametersLeft = 0;
1869	pBusLogic->regStatus \|= BL_STAT_CMDINV;
1870	break;
1871	}
1872
1873	pBusLogic->aReplyBuffer[0] = '7';
1874	pBusLogic->cbReplyParametersLeft = 1;
1875	break;
1876	}
1877	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER:
1878	{
1879	pBusLogic->aReplyBuffer[0] = 'B';
1880	pBusLogic->cbReplyParametersLeft = 1;
1881	break;
1882	}
1883	case BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS:
1884	/* The parameter list length is determined by the first byte of the command buffer. */
1885	if (pBusLogic->iParameter == 1)
1886	{
1887	/* First pass - set the number of following parameter bytes. */
1888	pBusLogic->cbCommandParametersLeft = pBusLogic->aCommandBuffer[0];
1889	Log(("Set HA options: %u bytes follow\n", pBusLogic->cbCommandParametersLeft));
1890	}
1891	else
1892	{
1893	/* Second pass - process received data. */
1894	Log(("Set HA options: received %u bytes\n", pBusLogic->aCommandBuffer[0]));
1895	/* We ignore the data - it only concerns the SCSI hardware protocol. */
1896	}
1897	pBusLogic->cbReplyParametersLeft = 0;
1898	break;
1899
1900	case BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND:
1901	/* The parameter list length is at least 12 bytes; the 12th byte determines
1902	* the number of additional CDB bytes that will follow.
1903	*/
1904	if (pBusLogic->iParameter == 12)
1905	{
1906	/* First pass - set the number of following CDB bytes. */
1907	pBusLogic->cbCommandParametersLeft = pBusLogic->aCommandBuffer[11];
1908	Log(("Execute SCSI cmd: %u more bytes follow\n", pBusLogic->cbCommandParametersLeft));
1909	}
1910	else
1911	{
1912	PESCMD pCmd;
1913
1914	/* Second pass - process received data. */
1915	Log(("Execute SCSI cmd: received %u bytes\n", pBusLogic->aCommandBuffer[0]));
1916
1917	pCmd = (PESCMD)pBusLogic->aCommandBuffer;
1918	Log(("Addr %08X, cbData %08X, cbCDB=%u\n", pCmd->u32PhysAddrData, pCmd->cbData, pCmd->cbCDB));
1919	}
1920	// This is currently a dummy - just fails every command.
1921	pBusLogic->cbReplyParametersLeft = 4;
1922	pBusLogic->aReplyBuffer[0] = pBusLogic->aReplyBuffer[1] = 0;
1923	pBusLogic->aReplyBuffer[2] = 0x11; /* HBA status (timeout). */
1924	pBusLogic->aReplyBuffer[3] = 0; /* Device status. */
1925	break;
1926
1927	case BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER:
1928	{
1929	/* Not supported on AHA-154x. */
1930	if (pBusLogic->uDevType == DEV_AHA_1540B)
1931	{
1932	Log(("Command %#x not valid for this adapter\n", pBusLogic->uOperationCode));
1933	pBusLogic->cbReplyParametersLeft = 0;
1934	pBusLogic->regStatus \|= BL_STAT_CMDINV;
1935	break;
1936	}
1937
1938	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
1939	if (pBusLogic->aCommandBuffer[0] > sizeof(pBusLogic->aReplyBuffer))
1940	{
1941	Log(("Requested too much adapter model number data (%u)!\n", pBusLogic->aCommandBuffer[0]));
1942	pBusLogic->regStatus \|= BL_STAT_CMDINV;
1943	break;
1944	}
1945	pBusLogic->cbReplyParametersLeft = pBusLogic->aCommandBuffer[0];
1946	memset(pBusLogic->aReplyBuffer, 0, sizeof(pBusLogic->aReplyBuffer));
1947	const char aModelName[] = "958D "; /* Trailing \0 is fine, that's the filler anyway. */
1948	int cCharsToTransfer = pBusLogic->cbReplyParametersLeft <= sizeof(aModelName)
1949	? pBusLogic->cbReplyParametersLeft
1950	: sizeof(aModelName);
1951
1952	for (int i = 0; i < cCharsToTransfer; i++)
1953	pBusLogic->aReplyBuffer[i] = aModelName[i];
1954
1955	break;
1956	}
1957	case BUSLOGICCOMMAND_INQUIRE_CONFIGURATION:
1958	{
1959	uint8_t uIrq;
1960
1961	if (pBusLogic->uIsaIrq)
1962	uIrq = pBusLogic->uIsaIrq;
1963	else
1964	uIrq = PCIDevGetInterruptLine(pDevIns->apPciDevs[0]);
1965
1966	pBusLogic->cbReplyParametersLeft = sizeof(ReplyInquireConfiguration);
1967	PReplyInquireConfiguration pReply = (PReplyInquireConfiguration)pBusLogic->aReplyBuffer;
1968	memset(pReply, 0, sizeof(ReplyInquireConfiguration));
1969
1970	pReply->uHostAdapterId = 7; /* The controller has always 7 as ID. */
1971	pReply->fDmaChannel6 = 1; /* DMA channel 6 is a good default. */
1972
1973	/* The PCI IRQ is not necessarily representable in this structure.
1974	* If that is the case, the guest likely won't function correctly,
1975	* therefore we log a warning. Note that for ISA configurations, we
1976	* can only allow IRQs that can be supported; for PCI, the HBA
1977	* has no control over IRQ assignment.
1978	*/
1979	switch (uIrq)
1980	{
1981	case 9: pReply->fIrqChannel9 = 1; break;
1982	case 10: pReply->fIrqChannel10 = 1; break;
1983	case 11: pReply->fIrqChannel11 = 1; break;
1984	case 12: pReply->fIrqChannel12 = 1; break;
1985	case 14: pReply->fIrqChannel14 = 1; break;
1986	case 15: pReply->fIrqChannel15 = 1; break;
1987	default:
1988	LogRel(("Warning: PCI IRQ %d cannot be represented as ISA!\n", uIrq));
1989	break;
1990	}
1991	break;
1992	}
1993	case BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION:
1994	{
1995	/* Some Adaptec AHA-154x drivers (e.g. OS/2) execute this command and expect
1996	* it to fail. If it succeeds, the drivers refuse to load. However, some newer
1997	* Adaptec 154x models supposedly support it too??
1998	*/
1999	if (pBusLogic->uDevType == DEV_AHA_1540B)
2000	{
2001	Log(("Command %#x not valid for this adapter\n", pBusLogic->uOperationCode));
2002	pBusLogic->cbReplyParametersLeft = 0;
2003	pBusLogic->regStatus \|= BL_STAT_CMDINV;
2004	break;
2005	}
2006
2007	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2008	pBusLogic->cbReplyParametersLeft = pBusLogic->aCommandBuffer[0];
2009	PReplyInquireExtendedSetupInformation pReply = (PReplyInquireExtendedSetupInformation)pBusLogic->aReplyBuffer;
2010	memset(pReply, 0, sizeof(ReplyInquireExtendedSetupInformation));
2011
2012	/** @todo should this reflect the RAM contents (AutoSCSIRam)? */
2013	pReply->uBusType = 'E'; /* EISA style */
2014	pReply->u16ScatterGatherLimit = 8192;
2015	pReply->cMailbox = pBusLogic->cMailbox;
2016	pReply->uMailboxAddressBase = (uint32_t)pBusLogic->GCPhysAddrMailboxOutgoingBase;
2017	pReply->fLevelSensitiveInterrupt = true;
2018	pReply->fHostWideSCSI = true;
2019	pReply->fHostUltraSCSI = true;
2020	memcpy(pReply->aFirmwareRevision, "07B", sizeof(pReply->aFirmwareRevision));
2021
2022	break;
2023	}
2024	case BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION:
2025	{
2026	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2027	pBusLogic->cbReplyParametersLeft = pBusLogic->aCommandBuffer[0];
2028	PReplyInquireSetupInformation pReply = (PReplyInquireSetupInformation)pBusLogic->aReplyBuffer;
2029	memset(pReply, 0, sizeof(ReplyInquireSetupInformation));
2030	pReply->fSynchronousInitiationEnabled = true;
2031	pReply->fParityCheckingEnabled = true;
2032	pReply->cMailbox = pBusLogic->cMailbox;
2033	U32_TO_ADDR(pReply->MailboxAddress, pBusLogic->GCPhysAddrMailboxOutgoingBase);
2034	/* The 'D' signature (actually 'SD' for Storage Dimensions, and 'BD' for BusLogic)
2035	* prevents Adaptec's OS/2 drivers from getting too friendly with BusLogic hardware
2036	* and upsetting the HBA state.
2037	*/
2038	if (pBusLogic->uDevType == DEV_AHA_1540B)
2039	{
2040	pReply->uSignature = 0; /* Zeros for Adaptec. */
2041	pReply->uCharacterD = 0;
2042	}
2043	else
2044	{
2045	pReply->uSignature = 'B';
2046	pReply->uCharacterD = 'D'; /* BusLogic model. */
2047	}
2048	pReply->uHostBusType = 'F'; /* PCI bus. */
2049	break;
2050	}
2051	case BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM:
2052	{
2053	/*
2054	* First element in the command buffer contains start offset to read from
2055	* and second one the number of bytes to read.
2056	*/
2057	uint8_t uOffset = pBusLogic->aCommandBuffer[0];
2058	pBusLogic->cbReplyParametersLeft = pBusLogic->aCommandBuffer[1];
2059
2060	pBusLogic->fUseLocalRam = true;
2061	pBusLogic->iReply = uOffset;
2062	break;
2063	}
2064	case BUSLOGICCOMMAND_INITIALIZE_MAILBOX:
2065	{
2066	PRequestInitMbx pRequest = (PRequestInitMbx)pBusLogic->aCommandBuffer;
2067
2068	pBusLogic->cbReplyParametersLeft = 0;
2069	if (!pRequest->cMailbox)
2070	{
2071	Log(("cMailboxes=%u (24-bit mode), fail!\n", pBusLogic->cMailbox));
2072	pBusLogic->regStatus \|= BL_STAT_CMDINV;
2073	break;
2074	}
2075	pBusLogic->fMbxIs24Bit = true;
2076	pBusLogic->cMailbox = pRequest->cMailbox;
2077	pBusLogic->GCPhysAddrMailboxOutgoingBase = (RTGCPHYS)ADDR_TO_U32(pRequest->aMailboxBaseAddr);
2078	/* The area for incoming mailboxes is right after the last entry of outgoing mailboxes. */
2079	pBusLogic->GCPhysAddrMailboxIncomingBase = pBusLogic->GCPhysAddrMailboxOutgoingBase + (pBusLogic->cMailbox * sizeof(Mailbox24));
2080
2081	Log(("GCPhysAddrMailboxOutgoingBase=%RGp\n", pBusLogic->GCPhysAddrMailboxOutgoingBase));
2082	Log(("GCPhysAddrMailboxIncomingBase=%RGp\n", pBusLogic->GCPhysAddrMailboxIncomingBase));
2083	Log(("cMailboxes=%u (24-bit mode)\n", pBusLogic->cMailbox));
2084	LogRel(("Initialized 24-bit mailbox, %d entries at %08x\n", pRequest->cMailbox, ADDR_TO_U32(pRequest->aMailboxBaseAddr)));
2085
2086	pBusLogic->regStatus &= ~BL_STAT_INREQ;
2087	break;
2088	}
2089	case BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX:
2090	{
2091	if (pBusLogic->uDevType == DEV_AHA_1540B)
2092	{
2093	Log(("Command %#x not valid for this adapter\n", pBusLogic->uOperationCode));
2094	pBusLogic->cbReplyParametersLeft = 0;
2095	pBusLogic->regStatus \|= BL_STAT_CMDINV;
2096	break;
2097	}
2098
2099	PRequestInitializeExtendedMailbox pRequest = (PRequestInitializeExtendedMailbox)pBusLogic->aCommandBuffer;
2100
2101	pBusLogic->cbReplyParametersLeft = 0;
2102	if (!pRequest->cMailbox)
2103	{
2104	Log(("cMailboxes=%u (32-bit mode), fail!\n", pBusLogic->cMailbox));
2105	pBusLogic->regStatus \|= BL_STAT_CMDINV;
2106	break;
2107	}
2108	pBusLogic->fMbxIs24Bit = false;
2109	pBusLogic->cMailbox = pRequest->cMailbox;
2110	pBusLogic->GCPhysAddrMailboxOutgoingBase = (RTGCPHYS)pRequest->uMailboxBaseAddress;
2111	/* The area for incoming mailboxes is right after the last entry of outgoing mailboxes. */
2112	pBusLogic->GCPhysAddrMailboxIncomingBase = (RTGCPHYS)pRequest->uMailboxBaseAddress + (pBusLogic->cMailbox * sizeof(Mailbox32));
2113
2114	Log(("GCPhysAddrMailboxOutgoingBase=%RGp\n", pBusLogic->GCPhysAddrMailboxOutgoingBase));
2115	Log(("GCPhysAddrMailboxIncomingBase=%RGp\n", pBusLogic->GCPhysAddrMailboxIncomingBase));
2116	Log(("cMailboxes=%u (32-bit mode)\n", pBusLogic->cMailbox));
2117	LogRel(("Initialized 32-bit mailbox, %d entries at %08x\n", pRequest->cMailbox, pRequest->uMailboxBaseAddress));
2118
2119	pBusLogic->regStatus &= ~BL_STAT_INREQ;
2120	break;
2121	}
2122	case BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE:
2123	{
2124	if (pBusLogic->aCommandBuffer[0] == 0)
2125	pBusLogic->fStrictRoundRobinMode = false;
2126	else if (pBusLogic->aCommandBuffer[0] == 1)
2127	pBusLogic->fStrictRoundRobinMode = true;
2128	else
2129	AssertMsgFailed(("Invalid round robin mode %d\n", pBusLogic->aCommandBuffer[0]));
2130
2131	pBusLogic->cbReplyParametersLeft = 0;
2132	break;
2133	}
2134	case BUSLOGICCOMMAND_SET_CCB_FORMAT:
2135	{
2136	if (pBusLogic->aCommandBuffer[0] == 0)
2137	pBusLogic->fExtendedLunCCBFormat = false;
2138	else if (pBusLogic->aCommandBuffer[0] == 1)
2139	pBusLogic->fExtendedLunCCBFormat = true;
2140	else
2141	AssertMsgFailed(("Invalid CCB format %d\n", pBusLogic->aCommandBuffer[0]));
2142
2143	pBusLogic->cbReplyParametersLeft = 0;
2144	break;
2145	}
2146	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7:
2147	/* This is supposed to send TEST UNIT READY to each target/LUN.
2148	* We cheat and skip that, since we already know what's attached
2149	*/
2150	memset(pBusLogic->aReplyBuffer, 0, 8);
2151	for (int i = 0; i < 8; ++i)
2152	{
2153	if (pBusLogic->aDeviceStates[i].fPresent)
2154	pBusLogic->aReplyBuffer[i] = 1;
2155	}
2156	pBusLogic->aReplyBuffer[7] = 0; /* HA hardcoded at ID 7. */
2157	pBusLogic->cbReplyParametersLeft = 8;
2158	break;
2159	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15:
2160	/* See note about cheating above. */
2161	memset(pBusLogic->aReplyBuffer, 0, 8);
2162	for (int i = 0; i < 8; ++i)
2163	{
2164	if (pBusLogic->aDeviceStates[i + 8].fPresent)
2165	pBusLogic->aReplyBuffer[i] = 1;
2166	}
2167	pBusLogic->cbReplyParametersLeft = 8;
2168	break;
2169	case BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES:
2170	{
2171	/* Each bit which is set in the 16bit wide variable means a present device. */
2172	uint16_t u16TargetsPresentMask = 0;
2173
2174	for (uint8_t i = 0; i < RT_ELEMENTS(pBusLogic->aDeviceStates); i++)
2175	{
2176	if (pBusLogic->aDeviceStates[i].fPresent)
2177	u16TargetsPresentMask \|= (1 << i);
2178	}
2179	pBusLogic->aReplyBuffer[0] = (uint8_t)u16TargetsPresentMask;
2180	pBusLogic->aReplyBuffer[1] = (uint8_t)(u16TargetsPresentMask >> 8);
2181	pBusLogic->cbReplyParametersLeft = 2;
2182	break;
2183	}
2184	case BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD:
2185	{
2186	if (pBusLogic->aCommandBuffer[0] > sizeof(pBusLogic->aReplyBuffer))
2187	{
2188	Log(("Requested too much synch period inquiry (%u)!\n", pBusLogic->aCommandBuffer[0]));
2189	pBusLogic->regStatus \|= BL_STAT_CMDINV;
2190	break;
2191	}
2192	pBusLogic->cbReplyParametersLeft = pBusLogic->aCommandBuffer[0];
2193	for (uint8_t i = 0; i < pBusLogic->cbReplyParametersLeft; i++)
2194	pBusLogic->aReplyBuffer[i] = 0; /** @todo Figure if we need something other here. It's not needed for the linux driver */
2195
2196	break;
2197	}
2198	case BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT:
2199	{
2200	/* Not supported on AHA-154x HBAs. */
2201	if (pBusLogic->uDevType == DEV_AHA_1540B)
2202	{
2203	Log(("Command %#x not valid for this adapter\n", pBusLogic->uOperationCode));
2204	pBusLogic->cbReplyParametersLeft = 0;
2205	pBusLogic->regStatus \|= BL_STAT_CMDINV;
2206	break;
2207	}
2208
2209	pBusLogic->cbReplyParametersLeft = 0;
2210	if (pBusLogic->aCommandBuffer[0] == 0)
2211	pBusLogic->fIRQEnabled = false;
2212	else
2213	pBusLogic->fIRQEnabled = true;
2214	/* No interrupt signaled regardless of enable/disable. */
2215	fSuppressIrq = true;
2216	break;
2217	}
2218	case BUSLOGICCOMMAND_ECHO_COMMAND_DATA:
2219	{
2220	pBusLogic->aReplyBuffer[0] = pBusLogic->aCommandBuffer[0];
2221	pBusLogic->cbReplyParametersLeft = 1;
2222	break;
2223	}
2224	case BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT:
2225	{
2226	uint8_t uEnable = pBusLogic->aCommandBuffer[0];
2227
2228	pBusLogic->cbReplyParametersLeft = 0;
2229	Log(("Enable OMBR: %u\n", uEnable));
2230	/* Only 0/1 are accepted. */
2231	if (uEnable > 1)
2232	pBusLogic->regStatus \|= BL_STAT_CMDINV;
2233	else
2234	{
2235	pBusLogic->LocalRam.structured.autoSCSIData.uReserved6 = uEnable;
2236	fSuppressIrq = true;
2237	}
2238	break;
2239	}
2240	case BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS:
2241	{
2242	pBusLogic->cbReplyParametersLeft = 0;
2243	pBusLogic->LocalRam.structured.autoSCSIData.uBusOnDelay = pBusLogic->aCommandBuffer[0];
2244	Log(("Bus-on time: %d\n", pBusLogic->aCommandBuffer[0]));
2245	break;
2246	}
2247	case BUSLOGICCOMMAND_SET_TIME_OFF_BUS:
2248	{
2249	pBusLogic->cbReplyParametersLeft = 0;
2250	pBusLogic->LocalRam.structured.autoSCSIData.uBusOffDelay = pBusLogic->aCommandBuffer[0];
2251	Log(("Bus-off time: %d\n", pBusLogic->aCommandBuffer[0]));
2252	break;
2253	}
2254	case BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE:
2255	{
2256	pBusLogic->cbReplyParametersLeft = 0;
2257	pBusLogic->LocalRam.structured.autoSCSIData.uDMATransferRate = pBusLogic->aCommandBuffer[0];
2258	Log(("Bus transfer rate: %02X\n", pBusLogic->aCommandBuffer[0]));
2259	break;
2260	}
2261	case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
2262	{
2263	RTGCPHYS GCPhysFifoBuf;
2264	Addr24 addr;
2265
2266	pBusLogic->cbReplyParametersLeft = 0;
2267	addr.hi = pBusLogic->aCommandBuffer[0];
2268	addr.mid = pBusLogic->aCommandBuffer[1];
2269	addr.lo = pBusLogic->aCommandBuffer[2];
2270	GCPhysFifoBuf = (RTGCPHYS)ADDR_TO_U32(addr);
2271	Log(("Write busmaster FIFO at: %04X\n", ADDR_TO_U32(addr)));
2272	PDMDevHlpPhysRead(pBusLogic->CTX_SUFF(pDevIns), GCPhysFifoBuf,
2273	&pBusLogic->LocalRam.u8View[64], 64);
2274	break;
2275	}
2276	case BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO:
2277	{
2278	RTGCPHYS GCPhysFifoBuf;
2279	Addr24 addr;
2280
2281	pBusLogic->cbReplyParametersLeft = 0;
2282	addr.hi = pBusLogic->aCommandBuffer[0];
2283	addr.mid = pBusLogic->aCommandBuffer[1];
2284	addr.lo = pBusLogic->aCommandBuffer[2];
2285	GCPhysFifoBuf = (RTGCPHYS)ADDR_TO_U32(addr);
2286	Log(("Read busmaster FIFO at: %04X\n", ADDR_TO_U32(addr)));
2287	blPhysWrite(pBusLogic, GCPhysFifoBuf, &pBusLogic->LocalRam.u8View[64], 64);
2288	break;
2289	}
2290	default:
2291	AssertMsgFailed(("Invalid command %#x\n", pBusLogic->uOperationCode));
2292	RT_FALL_THRU();
2293	case BUSLOGICCOMMAND_EXT_BIOS_INFO:
2294	case BUSLOGICCOMMAND_UNLOCK_MAILBOX:
2295	/* Commands valid for Adaptec 154xC which we don't handle since
2296	* we pretend being 154xB compatible. Just mark the command as invalid.
2297	*/
2298	Log(("Command %#x not valid for this adapter\n", pBusLogic->uOperationCode));
2299	pBusLogic->cbReplyParametersLeft = 0;
2300	pBusLogic->regStatus \|= BL_STAT_CMDINV;
2301	break;
2302	case BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND: /* Should be handled already. */
2303	AssertMsgFailed(("Invalid mailbox execute state!\n"));
2304	}
2305
2306	Log(("uOperationCode=%#x, cbReplyParametersLeft=%d\n", pBusLogic->uOperationCode, pBusLogic->cbReplyParametersLeft));
2307
2308	/* Fail command if too much parameter data requested. */
2309	if ((pBusLogic->cbCommandParametersLeft + pBusLogic->iParameter) > sizeof(pBusLogic->aCommandBuffer))
2310	{
2311	Log(("Invalid command parameter length (%u)\n", pBusLogic->cbCommandParametersLeft));
2312	pBusLogic->cbReplyParametersLeft = 0;
2313	pBusLogic->cbCommandParametersLeft = 0;
2314	pBusLogic->regStatus \|= BL_STAT_CMDINV;
2315	}
2316
2317	/* Set the data in ready bit in the status register in case the command has a reply. */
2318	if (pBusLogic->cbReplyParametersLeft)
2319	pBusLogic->regStatus \|= BL_STAT_DIRRDY;
2320	else if (!pBusLogic->cbCommandParametersLeft)
2321	buslogicCommandComplete(pBusLogic, fSuppressIrq);
2322
2323	return rc;
2324	}
2325
2326	/**
2327	* Read a register from the BusLogic adapter.
2328	*
2329	* @returns VBox status code.
2330	* @param pBusLogic Pointer to the BusLogic instance data.
2331	* @param iRegister The index of the register to read.
2332	* @param pu32 Where to store the register content.
2333	*/
2334	static int buslogicRegisterRead(PBUSLOGIC pBusLogic, unsigned iRegister, uint32_t *pu32)
2335	{
2336	static const char achAhaSig[] = "ADAP";
2337	int rc = VINF_SUCCESS;
2338
2339	switch (iRegister)
2340	{
2341	case BUSLOGIC_REGISTER_STATUS:
2342	{
2343	*pu32 = pBusLogic->regStatus;
2344
2345	/* If the diagnostic active bit is set, we are in a guest-initiated
2346	* hard reset. If the guest reads the status register and waits for
2347	* the host adapter ready bit to be set, we terminate the reset right
2348	* away. However, guests may also expect the reset condition to clear
2349	* automatically after a period of time, in which case we can't show
2350	* the DIAG bit at all.
2351	*/
2352	if (pBusLogic->regStatus & BL_STAT_DACT)
2353	{
2354	uint64_t u64AccessTime = PDMDevHlpTMTimeVirtGetNano(pBusLogic->CTX_SUFF(pDevIns));
2355
2356	pBusLogic->regStatus &= ~BL_STAT_DACT;
2357	pBusLogic->regStatus \|= BL_STAT_HARDY;
2358
2359	if (u64AccessTime - pBusLogic->u64ResetTime > BUSLOGIC_RESET_DURATION_NS)
2360	{
2361	/* If reset already expired, let the guest see that right away. */
2362	*pu32 = pBusLogic->regStatus;
2363	pBusLogic->u64ResetTime = 0;
2364	}
2365	}
2366	break;
2367	}
2368	case BUSLOGIC_REGISTER_DATAIN:
2369	{
2370	if (pBusLogic->fUseLocalRam)
2371	*pu32 = pBusLogic->LocalRam.u8View[pBusLogic->iReply];
2372	else
2373	*pu32 = pBusLogic->aReplyBuffer[pBusLogic->iReply];
2374
2375	/* Careful about underflow - guest can read data register even if
2376	* no data is available.
2377	*/
2378	if (pBusLogic->cbReplyParametersLeft)
2379	{
2380	pBusLogic->iReply++;
2381	pBusLogic->cbReplyParametersLeft--;
2382	if (!pBusLogic->cbReplyParametersLeft)
2383	{
2384	/*
2385	* Reply finished, set command complete bit, unset data-in ready bit and
2386	* interrupt the guest if enabled.
2387	* NB: Some commands do not set the CMDC bit / raise completion interrupt.
2388	*/
2389	if (pBusLogic->uOperationCode == BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM)
2390	buslogicCommandComplete(pBusLogic, true /* fSuppressIrq */);
2391	else
2392	buslogicCommandComplete(pBusLogic, false);
2393	}
2394	}
2395	LogFlowFunc(("data=%02x, iReply=%d, cbReplyParametersLeft=%u\n", *pu32,
2396	pBusLogic->iReply, pBusLogic->cbReplyParametersLeft));
2397	break;
2398	}
2399	case BUSLOGIC_REGISTER_INTERRUPT:
2400	{
2401	*pu32 = pBusLogic->regInterrupt;
2402	break;
2403	}
2404	case BUSLOGIC_REGISTER_GEOMETRY:
2405	{
2406	if (pBusLogic->uDevType == DEV_AHA_1540B)
2407	{
2408	*pu32 = achAhaSig[pBusLogic->uAhaSigIdx];
2409	pBusLogic->uAhaSigIdx = (pBusLogic->uAhaSigIdx + 1) & 3;
2410	}
2411	else
2412	*pu32 = pBusLogic->regGeometry;
2413	break;
2414	}
2415	default:
2416	*pu32 = UINT32_C(0xffffffff);
2417	}
2418
2419	Log2(("%s: pu32=%p:{%.*Rhxs} iRegister=%d rc=%Rrc\n",
2420	__FUNCTION__, pu32, 1, pu32, iRegister, rc));
2421
2422	return rc;
2423	}
2424
2425	/**
2426	* Write a value to a register.
2427	*
2428	* @returns VBox status code.
2429	* @param pDevIns The PDM device instance.
2430	* @param pBusLogic Pointer to the BusLogic instance data.
2431	* @param iRegister The index of the register to read.
2432	* @param uVal The value to write.
2433	*/
2434	static int buslogicRegisterWrite(PPDMDEVINS pDevIns, PBUSLOGIC pBusLogic, unsigned iRegister, uint8_t uVal)
2435	{
2436	int rc = VINF_SUCCESS;
2437
2438	switch (iRegister)
2439	{
2440	case BUSLOGIC_REGISTER_CONTROL:
2441	{
2442	if ((uVal & BL_CTRL_RHARD) \|\| (uVal & BL_CTRL_RSOFT))
2443	{
2444	#ifdef IN_RING3
2445	bool fHardReset = !!(uVal & BL_CTRL_RHARD);
2446
2447	LogRel(("BusLogic: %s reset\n", fHardReset ? "hard" : "soft"));
2448	buslogicR3InitiateReset(pBusLogic, fHardReset);
2449	#else
2450	rc = VINF_IOM_R3_IOPORT_WRITE;
2451	#endif
2452	break;
2453	}
2454
2455	rc = PDMCritSectEnter(&pBusLogic->CritSectIntr, VINF_IOM_R3_IOPORT_WRITE);
2456	if (rc != VINF_SUCCESS)
2457	return rc;
2458
2459	#ifdef LOG_ENABLED
2460	uint32_t cMailboxesReady = ASMAtomicXchgU32(&pBusLogic->cInMailboxesReady, 0);
2461	Log(("%u incoming mailboxes were ready when this interrupt was cleared\n", cMailboxesReady));
2462	#endif
2463
2464	if (uVal & BL_CTRL_RINT)
2465	buslogicClearInterrupt(pBusLogic);
2466
2467	PDMCritSectLeave(&pBusLogic->CritSectIntr);
2468
2469	break;
2470	}
2471	case BUSLOGIC_REGISTER_COMMAND:
2472	{
2473	/* Fast path for mailbox execution command. */
2474	if ((uVal == BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND) && (pBusLogic->uOperationCode == 0xff))
2475	{
2476	/// @todo Should fail if BL_STAT_INREQ is set
2477	/* If there are no mailboxes configured, don't even try to do anything. */
2478	if (pBusLogic->cMailbox)
2479	{
2480	ASMAtomicIncU32(&pBusLogic->cMailboxesReady);
2481	if (!ASMAtomicXchgBool(&pBusLogic->fNotificationSent, true))
2482	{
2483	/* Send new notification to the queue. */
2484	PPDMQUEUEITEMCORE pItem = PDMQueueAlloc(pBusLogic->CTX_SUFF(pNotifierQueue));
2485	AssertMsg(pItem, ("Allocating item for queue failed\n"));
2486	PDMQueueInsert(pBusLogic->CTX_SUFF(pNotifierQueue), (PPDMQUEUEITEMCORE)pItem);
2487	}
2488	}
2489
2490	return rc;
2491	}
2492
2493	/*
2494	* Check if we are already fetch command parameters from the guest.
2495	* If not we initialize executing a new command.
2496	*/
2497	if (pBusLogic->uOperationCode == 0xff)
2498	{
2499	pBusLogic->uOperationCode = uVal;
2500	pBusLogic->iParameter = 0;
2501
2502	/* Mark host adapter as busy and clear the invalid status bit. */
2503	pBusLogic->regStatus &= ~(BL_STAT_HARDY \| BL_STAT_CMDINV);
2504
2505	/* Get the number of bytes for parameters from the command code. */
2506	switch (pBusLogic->uOperationCode)
2507	{
2508	case BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT:
2509	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER:
2510	case BUSLOGICCOMMAND_INQUIRE_BOARD_ID:
2511	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER:
2512	case BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION:
2513	case BUSLOGICCOMMAND_INQUIRE_CONFIGURATION:
2514	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7:
2515	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15:
2516	case BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES:
2517	pBusLogic->cbCommandParametersLeft = 0;
2518	break;
2519	case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
2520	case BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION:
2521	case BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT:
2522	case BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER:
2523	/* These commands are not on AHA-154x, some Adaptec drivers (ASPI4DOS.SYS) test them. */
2524	if (pBusLogic->uDevType == DEV_AHA_1540B)
2525	{
2526	pBusLogic->cbCommandParametersLeft = 0;
2527	break;
2528	}
2529	RT_FALL_THRU();
2530	case BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION:
2531	case BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE:
2532	case BUSLOGICCOMMAND_SET_CCB_FORMAT:
2533	case BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD:
2534	case BUSLOGICCOMMAND_ECHO_COMMAND_DATA:
2535	case BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT:
2536	case BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS:
2537	case BUSLOGICCOMMAND_SET_TIME_OFF_BUS:
2538	case BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE:
2539	pBusLogic->cbCommandParametersLeft = 1;
2540	break;
2541	case BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM:
2542	pBusLogic->cbCommandParametersLeft = 2;
2543	break;
2544	case BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO:
2545	case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
2546	pBusLogic->cbCommandParametersLeft = 3;
2547	break;
2548	case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
2549	pBusLogic->cbCommandParametersLeft = 4;
2550	break;
2551	case BUSLOGICCOMMAND_INITIALIZE_MAILBOX:
2552	pBusLogic->cbCommandParametersLeft = sizeof(RequestInitMbx);
2553	break;
2554	case BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX:
2555	/* Some Adaptec drivers (ASPI4DOS.SYS) test this command. */
2556	if (pBusLogic->uDevType == DEV_AHA_1540B)
2557	{
2558	pBusLogic->cbCommandParametersLeft = 0;
2559	break;
2560	}
2561	pBusLogic->cbCommandParametersLeft = sizeof(RequestInitializeExtendedMailbox);
2562	break;
2563	case BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS:
2564	/* There must be at least one byte following this command. */
2565	pBusLogic->cbCommandParametersLeft = 1;
2566	break;
2567	case BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND:
2568	/* 12 bytes + variable-length CDB. */
2569	pBusLogic->cbCommandParametersLeft = 12;
2570	break;
2571	case BUSLOGICCOMMAND_EXT_BIOS_INFO:
2572	case BUSLOGICCOMMAND_UNLOCK_MAILBOX:
2573	/* Invalid commands. */
2574	pBusLogic->cbCommandParametersLeft = 0;
2575	break;
2576	case BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND: /* Should not come here anymore. */
2577	default:
2578	AssertMsgFailed(("Invalid operation code %#x\n", uVal));
2579	}
2580	}
2581	else
2582	{
2583	#ifndef IN_RING3
2584	/* This command must be executed in R3 as it rehooks the ISA I/O port. */
2585	if (pBusLogic->uOperationCode == BUSLOGICCOMMAND_MODIFY_IO_ADDRESS)
2586	{
2587	rc = VINF_IOM_R3_IOPORT_WRITE;
2588	break;
2589	}
2590	#endif
2591	/*
2592	* The real adapter would set the Command register busy bit in the status register.
2593	* The guest has to wait until it is unset.
2594	* We don't need to do it because the guest does not continue execution while we are in this
2595	* function.
2596	*/
2597	pBusLogic->aCommandBuffer[pBusLogic->iParameter] = uVal;
2598	pBusLogic->iParameter++;
2599	pBusLogic->cbCommandParametersLeft--;
2600	}
2601
2602	/* Start execution of command if there are no parameters left. */
2603	if (!pBusLogic->cbCommandParametersLeft)
2604	{
2605	rc = buslogicProcessCommand(pDevIns, pBusLogic);
2606	AssertMsgRC(rc, ("Processing command failed rc=%Rrc\n", rc));
2607	}
2608	break;
2609	}
2610
2611	/* On BusLogic adapters, the interrupt and geometry registers are R/W.
2612	* That is different from Adaptec 154x where those are read only.
2613	*/
2614	case BUSLOGIC_REGISTER_INTERRUPT:
2615	if (pBusLogic->uDevType == DEV_AHA_1540B)
2616	break;
2617	pBusLogic->regInterrupt = uVal;
2618	break;
2619
2620	case BUSLOGIC_REGISTER_GEOMETRY:
2621	if (pBusLogic->uDevType == DEV_AHA_1540B)
2622	break;
2623	pBusLogic->regGeometry = uVal;
2624	break;
2625
2626	default:
2627	AssertMsgFailed(("Register not available\n"));
2628	rc = VERR_IOM_IOPORT_UNUSED;
2629	}
2630
2631	return rc;
2632	}
2633
2634	/**
2635	* Memory mapped I/O Handler for read operations.
2636	*
2637	* @returns VBox status code.
2638	*
2639	* @param pDevIns The device instance.
2640	* @param pvUser User argument.
2641	* @param GCPhysAddr Physical address (in GC) where the read starts.
2642	* @param pv Where to store the result.
2643	* @param cb Number of bytes read.
2644	*/
2645	PDMBOTHCBDECL(int) buslogicMMIORead(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS GCPhysAddr, void pv, unsigned cb)
2646	{
2647	RT_NOREF_PV(pDevIns); RT_NOREF_PV(pvUser); RT_NOREF_PV(GCPhysAddr); RT_NOREF_PV(pv); RT_NOREF_PV(cb);
2648
2649	/* the linux driver does not make use of the MMIO area. */
2650	AssertMsgFailed(("MMIO Read\n"));
2651	return VINF_SUCCESS;
2652	}
2653
2654	/**
2655	* Memory mapped I/O Handler for write operations.
2656	*
2657	* @returns VBox status code.
2658	*
2659	* @param pDevIns The device instance.
2660	* @param pvUser User argument.
2661	* @param GCPhysAddr Physical address (in GC) where the read starts.
2662	* @param pv Where to fetch the result.
2663	* @param cb Number of bytes to write.
2664	*/
2665	PDMBOTHCBDECL(int) buslogicMMIOWrite(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS GCPhysAddr, void const pv, unsigned cb)
2666	{
2667	RT_NOREF_PV(pDevIns); RT_NOREF_PV(pvUser); RT_NOREF_PV(GCPhysAddr); RT_NOREF_PV(pv); RT_NOREF_PV(cb);
2668
2669	/* the linux driver does not make use of the MMIO area. */
2670	AssertMsgFailed(("MMIO Write\n"));
2671	return VINF_SUCCESS;
2672	}
2673
2674	/**
2675	* Port I/O Handler for IN operations.
2676	*
2677	* @returns VBox status code.
2678	*
2679	* @param pDevIns The device instance.
2680	* @param pvUser User argument.
2681	* @param uPort Port number used for the IN operation.
2682	* @param pu32 Where to store the result.
2683	* @param cb Number of bytes read.
2684	*/
2685	PDMBOTHCBDECL(int) buslogicIOPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT uPort, uint32_t pu32, unsigned cb)
2686	{
2687	PBUSLOGIC pBusLogic = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2688	unsigned iRegister = uPort % 4;
2689	RT_NOREF_PV(pvUser); RT_NOREF_PV(cb);
2690
2691	Assert(cb == 1);
2692
2693	return buslogicRegisterRead(pBusLogic, iRegister, pu32);
2694	}
2695
2696	/**
2697	* Port I/O Handler for OUT operations.
2698	*
2699	* @returns VBox status code.
2700	*
2701	* @param pDevIns The device instance.
2702	* @param pvUser User argument.
2703	* @param uPort Port number used for the IN operation.
2704	* @param u32 The value to output.
2705	* @param cb The value size in bytes.
2706	*/
2707	PDMBOTHCBDECL(int) buslogicIOPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT uPort, uint32_t u32, unsigned cb)
2708	{
2709	PBUSLOGIC pBusLogic = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2710	unsigned iRegister = uPort % 4;
2711	uint8_t uVal = (uint8_t)u32;
2712	RT_NOREF2(pvUser, cb);
2713
2714	Assert(cb == 1);
2715
2716	int rc = buslogicRegisterWrite(pDevIns, pBusLogic, iRegister, (uint8_t)uVal);
2717
2718	Log2(("#%d %s: pvUser=%#p cb=%d u32=%#x uPort=%#x rc=%Rrc\n",
2719	pDevIns->iInstance, __FUNCTION__, pvUser, cb, u32, uPort, rc));
2720
2721	return rc;
2722	}
2723
2724	#ifdef IN_RING3
2725
2726	static int buslogicR3PrepareBIOSSCSIRequest(PBUSLOGIC pThis)
2727	{
2728	uint32_t uTargetDevice;
2729	uint32_t uLun;
2730	uint8_t *pbCdb;
2731	size_t cbCdb;
2732	size_t cbBuf;
2733
2734	int rc = vboxscsiSetupRequest(&pThis->VBoxSCSI, &uLun, &pbCdb, &cbCdb, &cbBuf, &uTargetDevice);
2735	AssertMsgRCReturn(rc, ("Setting up SCSI request failed rc=%Rrc\n", rc), rc);
2736
2737	if ( uTargetDevice < RT_ELEMENTS(pThis->aDeviceStates)
2738	&& pThis->aDeviceStates[uTargetDevice].pDrvBase)
2739	{
2740	PBUSLOGICDEVICE pTgtDev = &pThis->aDeviceStates[uTargetDevice];
2741	PDMMEDIAEXIOREQ hIoReq;
2742	PBUSLOGICREQ pReq;
2743
2744	rc = pTgtDev->pDrvMediaEx->pfnIoReqAlloc(pTgtDev->pDrvMediaEx, &hIoReq, (void **)&pReq,
2745	0, PDMIMEDIAEX_F_SUSPEND_ON_RECOVERABLE_ERR);
2746	AssertMsgRCReturn(rc, ("Getting task from cache failed rc=%Rrc\n", rc), rc);
2747
2748	pReq->fBIOS = true;
2749	pReq->hIoReq = hIoReq;
2750	pReq->pTargetDevice = pTgtDev;
2751
2752	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
2753
2754	rc = pTgtDev->pDrvMediaEx->pfnIoReqSendScsiCmd(pTgtDev->pDrvMediaEx, pReq->hIoReq, uLun,
2755	pbCdb, cbCdb, PDMMEDIAEXIOREQSCSITXDIR_UNKNOWN, NULL,
2756	cbBuf, NULL, 0, NULL, &pReq->u8ScsiSts, 30 * RT_MS_1SEC);
2757	if (rc == VINF_SUCCESS \|\| rc != VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
2758	{
2759	uint8_t u8ScsiSts = pReq->u8ScsiSts;
2760	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
2761	rc = vboxscsiRequestFinished(&pThis->VBoxSCSI, u8ScsiSts);
2762	}
2763	else if (rc == VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
2764	rc = VINF_SUCCESS;
2765
2766	return rc;
2767	}
2768
2769	/* Device is not present. */
2770	AssertMsg(pbCdb[0] == SCSI_INQUIRY,
2771	("Device is not present but command is not inquiry\n"));
2772
2773	SCSIINQUIRYDATA ScsiInquiryData;
2774
2775	memset(&ScsiInquiryData, 0, sizeof(SCSIINQUIRYDATA));
2776	ScsiInquiryData.u5PeripheralDeviceType = SCSI_INQUIRY_DATA_PERIPHERAL_DEVICE_TYPE_UNKNOWN;
2777	ScsiInquiryData.u3PeripheralQualifier = SCSI_INQUIRY_DATA_PERIPHERAL_QUALIFIER_NOT_CONNECTED_NOT_SUPPORTED;
2778
2779	memcpy(pThis->VBoxSCSI.pbBuf, &ScsiInquiryData, 5);
2780
2781	rc = vboxscsiRequestFinished(&pThis->VBoxSCSI, SCSI_STATUS_OK);
2782	AssertMsgRCReturn(rc, ("Finishing BIOS SCSI request failed rc=%Rrc\n", rc), rc);
2783
2784	return rc;
2785	}
2786
2787
2788	/**
2789	* Port I/O Handler for IN operations - BIOS port.
2790	*
2791	* @returns VBox status code.
2792	*
2793	* @param pDevIns The device instance.
2794	* @param pvUser User argument.
2795	* @param uPort Port number used for the IN operation.
2796	* @param pu32 Where to store the result.
2797	* @param cb Number of bytes read.
2798	*/
2799	static DECLCALLBACK(int) buslogicR3BiosIoPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT uPort, uint32_t pu32, unsigned cb)
2800	{
2801	RT_NOREF(pvUser, cb);
2802	PBUSLOGIC pBusLogic = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2803
2804	Assert(cb == 1);
2805
2806	int rc = vboxscsiReadRegister(&pBusLogic->VBoxSCSI, (uPort - BUSLOGIC_BIOS_IO_PORT), pu32);
2807
2808	//Log2(("%s: pu32=%p:{%.*Rhxs} iRegister=%d rc=%Rrc\n",
2809	// __FUNCTION__, pu32, 1, pu32, (uPort - BUSLOGIC_BIOS_IO_PORT), rc));
2810
2811	return rc;
2812	}
2813
2814	/**
2815	* Port I/O Handler for OUT operations - BIOS port.
2816	*
2817	* @returns VBox status code.
2818	*
2819	* @param pDevIns The device instance.
2820	* @param pvUser User argument.
2821	* @param uPort Port number used for the IN operation.
2822	* @param u32 The value to output.
2823	* @param cb The value size in bytes.
2824	*/
2825	static DECLCALLBACK(int) buslogicR3BiosIoPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT uPort, uint32_t u32, unsigned cb)
2826	{
2827	RT_NOREF(pvUser, cb);
2828	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2829	Log2(("#%d %s: pvUser=%#p cb=%d u32=%#x uPort=%#x\n", pDevIns->iInstance, __FUNCTION__, pvUser, cb, u32, uPort));
2830
2831	/*
2832	* If there is already a request form the BIOS pending ignore this write
2833	* because it should not happen.
2834	*/
2835	if (ASMAtomicReadBool(&pThis->fBiosReqPending))
2836	return VINF_SUCCESS;
2837
2838	Assert(cb == 1);
2839
2840	int rc = vboxscsiWriteRegister(&pThis->VBoxSCSI, (uPort - BUSLOGIC_BIOS_IO_PORT), (uint8_t)u32);
2841	if (rc == VERR_MORE_DATA)
2842	{
2843	ASMAtomicXchgBool(&pThis->fBiosReqPending, true);
2844	/* Send a notifier to the PDM queue that there are pending requests. */
2845	PPDMQUEUEITEMCORE pItem = PDMQueueAlloc(pThis->CTX_SUFF(pNotifierQueue));
2846	AssertMsg(pItem, ("Allocating item for queue failed\n"));
2847	PDMQueueInsert(pThis->CTX_SUFF(pNotifierQueue), (PPDMQUEUEITEMCORE)pItem);
2848	rc = VINF_SUCCESS;
2849	}
2850	else if (RT_FAILURE(rc))
2851	AssertMsgFailed(("Writing BIOS register failed %Rrc\n", rc));
2852
2853	return VINF_SUCCESS;
2854	}
2855
2856	/**
2857	* Port I/O Handler for primary port range OUT string operations.
2858	* @see FNIOMIOPORTOUTSTRING for details.
2859	*/
2860	static DECLCALLBACK(int) buslogicR3BiosIoPortWriteStr(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port,
2861	uint8_t const pbSrc, uint32_t pcTransfers, unsigned cb)
2862	{
2863	RT_NOREF(pvUser);
2864	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2865	Log2(("#%d %s: pvUser=%#p cb=%d Port=%#x\n", pDevIns->iInstance, __FUNCTION__, pvUser, cb, Port));
2866
2867	/*
2868	* If there is already a request form the BIOS pending ignore this write
2869	* because it should not happen.
2870	*/
2871	if (ASMAtomicReadBool(&pThis->fBiosReqPending))
2872	return VINF_SUCCESS;
2873
2874	int rc = vboxscsiWriteString(pDevIns, &pThis->VBoxSCSI, (Port - BUSLOGIC_BIOS_IO_PORT), pbSrc, pcTransfers, cb);
2875	if (rc == VERR_MORE_DATA)
2876	{
2877	ASMAtomicXchgBool(&pThis->fBiosReqPending, true);
2878	/* Send a notifier to the PDM queue that there are pending requests. */
2879	PPDMQUEUEITEMCORE pItem = PDMQueueAlloc(pThis->CTX_SUFF(pNotifierQueue));
2880	AssertMsg(pItem, ("Allocating item for queue failed\n"));
2881	PDMQueueInsert(pThis->CTX_SUFF(pNotifierQueue), (PPDMQUEUEITEMCORE)pItem);
2882	}
2883	else if (RT_FAILURE(rc))
2884	AssertMsgFailed(("Writing BIOS register failed %Rrc\n", rc));
2885
2886	return VINF_SUCCESS;
2887	}
2888
2889	/**
2890	* Port I/O Handler for primary port range IN string operations.
2891	* @see FNIOMIOPORTINSTRING for details.
2892	*/
2893	static DECLCALLBACK(int) buslogicR3BiosIoPortReadStr(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port,
2894	uint8_t pbDst, uint32_t pcTransfers, unsigned cb)
2895	{
2896	RT_NOREF(pvUser);
2897	PBUSLOGIC pBusLogic = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2898	LogFlowFunc(("#%d %s: pvUser=%#p cb=%d Port=%#x\n", pDevIns->iInstance, __FUNCTION__, pvUser, cb, Port));
2899
2900	return vboxscsiReadString(pDevIns, &pBusLogic->VBoxSCSI, (Port - BUSLOGIC_BIOS_IO_PORT),
2901	pbDst, pcTransfers, cb);
2902	}
2903
2904	/**
2905	* Update the ISA I/O range.
2906	*
2907	* @returns nothing.
2908	* @param pBusLogic Pointer to the BusLogic device instance.
2909	* @param uBaseCode Encoded ISA I/O base; only low 3 bits are used.
2910	*/
2911	static int buslogicR3RegisterISARange(PBUSLOGIC pBusLogic, uint8_t uBaseCode)
2912	{
2913	uint8_t uCode = uBaseCode & MAX_ISA_BASE;
2914	uint16_t uNewBase = g_aISABases[uCode];
2915	int rc = VINF_SUCCESS;
2916
2917	LogFlowFunc(("ISA I/O code %02X, new base %X\n", uBaseCode, uNewBase));
2918
2919	/* Check if the same port range is already registered. */
2920	if (uNewBase != pBusLogic->IOISABase)
2921	{
2922	/* Unregister the old range, if any. */
2923	if (pBusLogic->IOISABase)
2924	rc = PDMDevHlpIOPortDeregister(pBusLogic->CTX_SUFF(pDevIns), pBusLogic->IOISABase, 4);
2925
2926	if (RT_SUCCESS(rc))
2927	{
2928	pBusLogic->IOISABase = 0; /* First mark as unregistered. */
2929	pBusLogic->uISABaseCode = ISA_BASE_DISABLED;
2930
2931	if (uNewBase)
2932	{
2933	/* Register the new range if requested. */
2934	rc = PDMDevHlpIOPortRegister(pBusLogic->CTX_SUFF(pDevIns), uNewBase, 4, NULL,
2935	buslogicIOPortWrite, buslogicIOPortRead,
2936	NULL, NULL,
2937	"BusLogic ISA");
2938	if (RT_SUCCESS(rc))
2939	{
2940	pBusLogic->IOISABase = uNewBase;
2941	pBusLogic->uISABaseCode = uCode;
2942	}
2943	}
2944	}
2945	if (RT_SUCCESS(rc))
2946	{
2947	if (uNewBase)
2948	{
2949	Log(("ISA I/O base: %x\n", uNewBase));
2950	LogRel(("BusLogic: ISA I/O base: %x\n", uNewBase));
2951	}
2952	else
2953	{
2954	Log(("Disabling ISA I/O ports.\n"));
2955	LogRel(("BusLogic: ISA I/O disabled\n"));
2956	}
2957	}
2958
2959	}
2960	return rc;
2961	}
2962
2963
2964	/**
2965	* @callback_method_impl{FNPCIIOREGIONMAP}
2966	*/
2967	static DECLCALLBACK(int) buslogicR3MmioMap(PPDMDEVINS pDevIns, PPDMPCIDEV pPciDev, uint32_t iRegion,
2968	RTGCPHYS GCPhysAddress, RTGCPHYS cb, PCIADDRESSSPACE enmType)
2969	{
2970	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2971	int rc = VINF_SUCCESS;
2972	RT_NOREF(pPciDev, iRegion);
2973
2974	Log2(("%s: registering MMIO area at GCPhysAddr=%RGp cb=%RGp\n", __FUNCTION__, GCPhysAddress, cb));
2975
2976	Assert(cb >= 32);
2977	Assert(pPciDev == pDevIns->apPciDevs[0]);
2978
2979	if (enmType == PCI_ADDRESS_SPACE_MEM)
2980	{
2981	/* We use the assigned size here, because we currently only support page aligned MMIO ranges. */
2982	rc = PDMDevHlpMMIORegister(pDevIns, GCPhysAddress, cb, NULL /pvUser/,
2983	IOMMMIO_FLAGS_READ_PASSTHRU \| IOMMMIO_FLAGS_WRITE_PASSTHRU,
2984	buslogicMMIOWrite, buslogicMMIORead, "BusLogic MMIO");
2985	if (RT_FAILURE(rc))
2986	return rc;
2987
2988	if (pThis->fR0Enabled)
2989	{
2990	rc = PDMDevHlpMMIORegisterR0(pDevIns, GCPhysAddress, cb, NIL_RTR0PTR /pvUser/,
2991	"buslogicMMIOWrite", "buslogicMMIORead");
2992	if (RT_FAILURE(rc))
2993	return rc;
2994	}
2995
2996	if (pThis->fGCEnabled)
2997	{
2998	rc = PDMDevHlpMMIORegisterRC(pDevIns, GCPhysAddress, cb, NIL_RTRCPTR /pvUser/,
2999	"buslogicMMIOWrite", "buslogicMMIORead");
3000	if (RT_FAILURE(rc))
3001	return rc;
3002	}
3003
3004	pThis->MMIOBase = GCPhysAddress;
3005	}
3006	else if (enmType == PCI_ADDRESS_SPACE_IO)
3007	{
3008	rc = PDMDevHlpIOPortRegister(pDevIns, (RTIOPORT)GCPhysAddress, 32,
3009	NULL, buslogicIOPortWrite, buslogicIOPortRead, NULL, NULL, "BusLogic PCI");
3010	if (RT_FAILURE(rc))
3011	return rc;
3012
3013	if (pThis->fR0Enabled)
3014	{
3015	rc = PDMDevHlpIOPortRegisterR0(pDevIns, (RTIOPORT)GCPhysAddress, 32,
3016	0, "buslogicIOPortWrite", "buslogicIOPortRead", NULL, NULL, "BusLogic PCI");
3017	if (RT_FAILURE(rc))
3018	return rc;
3019	}
3020
3021	if (pThis->fGCEnabled)
3022	{
3023	rc = PDMDevHlpIOPortRegisterRC(pDevIns, (RTIOPORT)GCPhysAddress, 32,
3024	0, "buslogicIOPortWrite", "buslogicIOPortRead", NULL, NULL, "BusLogic PCI");
3025	if (RT_FAILURE(rc))
3026	return rc;
3027	}
3028
3029	pThis->IOPortBase = (RTIOPORT)GCPhysAddress;
3030	}
3031	else
3032	AssertMsgFailed(("Invalid enmType=%d\n", enmType));
3033
3034	return rc;
3035	}
3036
3037	static int buslogicR3ReqComplete(PBUSLOGIC pThis, PBUSLOGICREQ pReq, int rcReq)
3038	{
3039	RT_NOREF(rcReq);
3040	PBUSLOGICDEVICE pTgtDev = pReq->pTargetDevice;
3041
3042	LogFlowFunc(("before decrement %u\n", pTgtDev->cOutstandingRequests));
3043	ASMAtomicDecU32(&pTgtDev->cOutstandingRequests);
3044	LogFlowFunc(("after decrement %u\n", pTgtDev->cOutstandingRequests));
3045
3046	if (pReq->fBIOS)
3047	{
3048	uint8_t u8ScsiSts = pReq->u8ScsiSts;
3049	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
3050	int rc = vboxscsiRequestFinished(&pThis->VBoxSCSI, u8ScsiSts);
3051	AssertMsgRC(rc, ("Finishing BIOS SCSI request failed rc=%Rrc\n", rc));
3052	}
3053	else
3054	{
3055	if (pReq->pbSenseBuffer)
3056	buslogicR3SenseBufferFree(pReq, (pReq->u8ScsiSts != SCSI_STATUS_OK));
3057
3058	/* Update residual data length. */
3059	if ( (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
3060	\|\| (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
3061	{
3062	size_t cbResidual = 0;
3063	int rc = pTgtDev->pDrvMediaEx->pfnIoReqQueryResidual(pTgtDev->pDrvMediaEx, pReq->hIoReq, &cbResidual);
3064	AssertRC(rc); Assert(cbResidual == (uint32_t)cbResidual);
3065
3066	if (pReq->fIs24Bit)
3067	U32_TO_LEN(pReq->CCBGuest.o.acbData, (uint32_t)cbResidual);
3068	else
3069	pReq->CCBGuest.n.cbData = (uint32_t)cbResidual;
3070	}
3071
3072	/*
3073	* Save vital things from the request and free it before posting completion
3074	* to avoid that the guest submits a new request with the same ID as the still
3075	* allocated one.
3076	*/
3077	#ifdef LOG_ENABLED
3078	bool fIs24Bit = pReq->fIs24Bit;
3079	#endif
3080	uint8_t u8ScsiSts = pReq->u8ScsiSts;
3081	RTGCPHYS GCPhysAddrCCB = pReq->GCPhysAddrCCB;
3082	CCBU CCBGuest;
3083	memcpy(&CCBGuest, &pReq->CCBGuest, sizeof(CCBU));
3084
3085	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
3086	if (u8ScsiSts == SCSI_STATUS_OK)
3087	buslogicR3SendIncomingMailbox(pThis, GCPhysAddrCCB, &CCBGuest,
3088	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED,
3089	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3090	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITHOUT_ERROR);
3091	else if (u8ScsiSts == SCSI_STATUS_CHECK_CONDITION)
3092	buslogicR3SendIncomingMailbox(pThis, GCPhysAddrCCB, &CCBGuest,
3093	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED,
3094	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_CHECK_CONDITION,
3095	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3096	else
3097	AssertMsgFailed(("invalid completion status %u\n", u8ScsiSts));
3098
3099	#ifdef LOG_ENABLED
3100	buslogicR3DumpCCBInfo(&CCBGuest, fIs24Bit);
3101	#endif
3102	}
3103
3104	if (pTgtDev->cOutstandingRequests == 0 && pThis->fSignalIdle)
3105	PDMDevHlpAsyncNotificationCompleted(pThis->pDevInsR3);
3106
3107	return VINF_SUCCESS;
3108	}
3109
3110	static DECLCALLBACK(int) buslogicR3QueryDeviceLocation(PPDMIMEDIAPORT pInterface, const char **ppcszController,
3111	uint32_t piInstance, uint32_t piLUN)
3112	{
3113	PBUSLOGICDEVICE pBusLogicDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaPort);
3114	PPDMDEVINS pDevIns = pBusLogicDevice->CTX_SUFF(pBusLogic)->CTX_SUFF(pDevIns);
3115
3116	AssertPtrReturn(ppcszController, VERR_INVALID_POINTER);
3117	AssertPtrReturn(piInstance, VERR_INVALID_POINTER);
3118	AssertPtrReturn(piLUN, VERR_INVALID_POINTER);
3119
3120	*ppcszController = pDevIns->pReg->szName;
3121	*piInstance = pDevIns->iInstance;
3122	*piLUN = pBusLogicDevice->iLUN;
3123
3124	return VINF_SUCCESS;
3125	}
3126
3127	/**
3128	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCopyFromBuf}
3129	*/
3130	static DECLCALLBACK(int) buslogicR3IoReqCopyFromBuf(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3131	void *pvIoReqAlloc, uint32_t offDst, PRTSGBUF pSgBuf,
3132	size_t cbCopy)
3133	{
3134	RT_NOREF1(hIoReq);
3135	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3136	PBUSLOGICREQ pReq = (PBUSLOGICREQ)pvIoReqAlloc;
3137
3138	size_t cbCopied = 0;
3139	if (RT_UNLIKELY(pReq->fBIOS))
3140	cbCopied = vboxscsiCopyToBuf(&pTgtDev->CTX_SUFF(pBusLogic)->VBoxSCSI, pSgBuf, offDst, cbCopy);
3141	else
3142	cbCopied = buslogicR3CopySgBufToGuest(pTgtDev->CTX_SUFF(pBusLogic), pReq, pSgBuf, offDst, cbCopy);
3143	return cbCopied == cbCopy ? VINF_SUCCESS : VERR_PDM_MEDIAEX_IOBUF_OVERFLOW;
3144	}
3145
3146	/**
3147	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCopyToBuf}
3148	*/
3149	static DECLCALLBACK(int) buslogicR3IoReqCopyToBuf(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3150	void *pvIoReqAlloc, uint32_t offSrc, PRTSGBUF pSgBuf,
3151	size_t cbCopy)
3152	{
3153	RT_NOREF1(hIoReq);
3154	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3155	PBUSLOGICREQ pReq = (PBUSLOGICREQ)pvIoReqAlloc;
3156
3157	size_t cbCopied = 0;
3158	if (RT_UNLIKELY(pReq->fBIOS))
3159	cbCopied = vboxscsiCopyFromBuf(&pTgtDev->CTX_SUFF(pBusLogic)->VBoxSCSI, pSgBuf, offSrc, cbCopy);
3160	else
3161	cbCopied = buslogicR3CopySgBufFromGuest(pTgtDev->CTX_SUFF(pBusLogic), pReq, pSgBuf, offSrc, cbCopy);
3162	return cbCopied == cbCopy ? VINF_SUCCESS : VERR_PDM_MEDIAEX_IOBUF_UNDERRUN;
3163	}
3164
3165	/**
3166	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCompleteNotify}
3167	*/
3168	static DECLCALLBACK(int) buslogicR3IoReqCompleteNotify(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3169	void *pvIoReqAlloc, int rcReq)
3170	{
3171	RT_NOREF(hIoReq);
3172	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3173	buslogicR3ReqComplete(pTgtDev->CTX_SUFF(pBusLogic), (PBUSLOGICREQ)pvIoReqAlloc, rcReq);
3174	return VINF_SUCCESS;
3175	}
3176
3177	/**
3178	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqStateChanged}
3179	*/
3180	static DECLCALLBACK(void) buslogicR3IoReqStateChanged(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3181	void *pvIoReqAlloc, PDMMEDIAEXIOREQSTATE enmState)
3182	{
3183	RT_NOREF3(hIoReq, pvIoReqAlloc, enmState);
3184	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3185
3186	switch (enmState)
3187	{
3188	case PDMMEDIAEXIOREQSTATE_SUSPENDED:
3189	{
3190	/* Make sure the request is not accounted for so the VM can suspend successfully. */
3191	uint32_t cTasksActive = ASMAtomicDecU32(&pTgtDev->cOutstandingRequests);
3192	if (!cTasksActive && pTgtDev->CTX_SUFF(pBusLogic)->fSignalIdle)
3193	PDMDevHlpAsyncNotificationCompleted(pTgtDev->CTX_SUFF(pBusLogic)->pDevInsR3);
3194	break;
3195	}
3196	case PDMMEDIAEXIOREQSTATE_ACTIVE:
3197	/* Make sure the request is accounted for so the VM suspends only when the request is complete. */
3198	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3199	break;
3200	default:
3201	AssertMsgFailed(("Invalid request state given %u\n", enmState));
3202	}
3203	}
3204
3205	/**
3206	* @interface_method_impl{PDMIMEDIAEXPORT,pfnMediumEjected}
3207	*/
3208	static DECLCALLBACK(void) buslogicR3MediumEjected(PPDMIMEDIAEXPORT pInterface)
3209	{
3210	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3211	PBUSLOGIC pThis = pTgtDev->CTX_SUFF(pBusLogic);
3212
3213	if (pThis->pMediaNotify)
3214	{
3215	int rc = VMR3ReqCallNoWait(PDMDevHlpGetVM(pThis->CTX_SUFF(pDevIns)), VMCPUID_ANY,
3216	(PFNRT)pThis->pMediaNotify->pfnEjected, 2,
3217	pThis->pMediaNotify, pTgtDev->iLUN);
3218	AssertRC(rc);
3219	}
3220	}
3221
3222	static int buslogicR3DeviceSCSIRequestSetup(PBUSLOGIC pBusLogic, RTGCPHYS GCPhysAddrCCB)
3223	{
3224	int rc = VINF_SUCCESS;
3225	uint8_t uTargetIdCCB;
3226	CCBU CCBGuest;
3227
3228	/* Fetch the CCB from guest memory. */
3229	/** @todo How much do we really have to read? */
3230	PDMDevHlpPhysRead(pBusLogic->CTX_SUFF(pDevIns), GCPhysAddrCCB,
3231	&CCBGuest, sizeof(CCB32));
3232
3233	uTargetIdCCB = pBusLogic->fMbxIs24Bit ? CCBGuest.o.uTargetId : CCBGuest.n.uTargetId;
3234	if (RT_LIKELY(uTargetIdCCB < RT_ELEMENTS(pBusLogic->aDeviceStates)))
3235	{
3236	PBUSLOGICDEVICE pTgtDev = &pBusLogic->aDeviceStates[uTargetIdCCB];
3237
3238	#ifdef LOG_ENABLED
3239	buslogicR3DumpCCBInfo(&CCBGuest, pBusLogic->fMbxIs24Bit);
3240	#endif
3241
3242	/* Check if device is present on bus. If not return error immediately and don't process this further. */
3243	if (RT_LIKELY(pTgtDev->fPresent))
3244	{
3245	PDMMEDIAEXIOREQ hIoReq;
3246	PBUSLOGICREQ pReq;
3247	rc = pTgtDev->pDrvMediaEx->pfnIoReqAlloc(pTgtDev->pDrvMediaEx, &hIoReq, (void **)&pReq,
3248	GCPhysAddrCCB, PDMIMEDIAEX_F_SUSPEND_ON_RECOVERABLE_ERR);
3249	if (RT_SUCCESS(rc))
3250	{
3251	pReq->pTargetDevice = pTgtDev;
3252	pReq->GCPhysAddrCCB = GCPhysAddrCCB;
3253	pReq->fBIOS = false;
3254	pReq->hIoReq = hIoReq;
3255	pReq->fIs24Bit = pBusLogic->fMbxIs24Bit;
3256
3257	/* Make a copy of the CCB */
3258	memcpy(&pReq->CCBGuest, &CCBGuest, sizeof(CCBGuest));
3259
3260	/* Alloc required buffers. */
3261	rc = buslogicR3SenseBufferAlloc(pReq);
3262	AssertMsgRC(rc, ("Mapping sense buffer failed rc=%Rrc\n", rc));
3263
3264	size_t cbBuf = 0;
3265	rc = buslogicR3QueryDataBufferSize(pBusLogic->CTX_SUFF(pDevIns), &pReq->CCBGuest, pReq->fIs24Bit, &cbBuf);
3266	AssertRC(rc);
3267
3268	uint32_t uLun = pReq->fIs24Bit ? pReq->CCBGuest.o.uLogicalUnit
3269	: pReq->CCBGuest.n.uLogicalUnit;
3270
3271	PDMMEDIAEXIOREQSCSITXDIR enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_UNKNOWN;
3272	size_t cbSense = buslogicR3ConvertSenseBufferLength(CCBGuest.c.cbSenseData);
3273
3274	if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_NO_DATA)
3275	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_NONE;
3276	else if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_OUT)
3277	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_TO_DEVICE;
3278	else if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_IN)
3279	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_FROM_DEVICE;
3280
3281	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3282	rc = pTgtDev->pDrvMediaEx->pfnIoReqSendScsiCmd(pTgtDev->pDrvMediaEx, pReq->hIoReq, uLun,
3283	&pReq->CCBGuest.c.abCDB[0], pReq->CCBGuest.c.cbCDB,
3284	enmXferDir, NULL, cbBuf, pReq->pbSenseBuffer, cbSense, NULL,
3285	&pReq->u8ScsiSts, 30 * RT_MS_1SEC);
3286	if (rc != VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
3287	buslogicR3ReqComplete(pBusLogic, pReq, rc);
3288	}
3289	else
3290	buslogicR3SendIncomingMailbox(pBusLogic, GCPhysAddrCCB, &CCBGuest,
3291	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT,
3292	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3293	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3294	}
3295	else
3296	buslogicR3SendIncomingMailbox(pBusLogic, GCPhysAddrCCB, &CCBGuest,
3297	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT,
3298	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3299	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3300	}
3301	else
3302	buslogicR3SendIncomingMailbox(pBusLogic, GCPhysAddrCCB, &CCBGuest,
3303	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER,
3304	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3305	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3306
3307	return rc;
3308	}
3309
3310	static int buslogicR3DeviceSCSIRequestAbort(PBUSLOGIC pBusLogic, RTGCPHYS GCPhysAddrCCB)
3311	{
3312	int rc = VINF_SUCCESS;
3313	uint8_t uTargetIdCCB;
3314	CCBU CCBGuest;
3315
3316	PDMDevHlpPhysRead(pBusLogic->CTX_SUFF(pDevIns), GCPhysAddrCCB,
3317	&CCBGuest, sizeof(CCB32));
3318
3319	uTargetIdCCB = pBusLogic->fMbxIs24Bit ? CCBGuest.o.uTargetId : CCBGuest.n.uTargetId;
3320	if (RT_LIKELY(uTargetIdCCB < RT_ELEMENTS(pBusLogic->aDeviceStates)))
3321	buslogicR3SendIncomingMailbox(pBusLogic, GCPhysAddrCCB, &CCBGuest,
3322	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED,
3323	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3324	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND);
3325	else
3326	buslogicR3SendIncomingMailbox(pBusLogic, GCPhysAddrCCB, &CCBGuest,
3327	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER,
3328	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3329	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3330
3331	return rc;
3332	}
3333
3334	/**
3335	* Read a mailbox from guest memory. Convert 24-bit mailboxes to
3336	* 32-bit format.
3337	*
3338	* @returns Mailbox guest physical address.
3339	* @param pBusLogic Pointer to the BusLogic instance data.
3340	* @param pMbx Pointer to the mailbox to read into.
3341	*/
3342	static RTGCPHYS buslogicR3ReadOutgoingMailbox(PBUSLOGIC pBusLogic, PMailbox32 pMbx)
3343	{
3344	RTGCPHYS GCMailbox;
3345
3346	if (pBusLogic->fMbxIs24Bit)
3347	{
3348	Mailbox24 Mbx24;
3349
3350	GCMailbox = pBusLogic->GCPhysAddrMailboxOutgoingBase + (pBusLogic->uMailboxOutgoingPositionCurrent * sizeof(Mailbox24));
3351	PDMDevHlpPhysRead(pBusLogic->CTX_SUFF(pDevIns), GCMailbox, &Mbx24, sizeof(Mailbox24));
3352	pMbx->u32PhysAddrCCB = ADDR_TO_U32(Mbx24.aPhysAddrCCB);
3353	pMbx->u.out.uActionCode = Mbx24.uCmdState;
3354	}
3355	else
3356	{
3357	GCMailbox = pBusLogic->GCPhysAddrMailboxOutgoingBase + (pBusLogic->uMailboxOutgoingPositionCurrent * sizeof(Mailbox32));
3358	PDMDevHlpPhysRead(pBusLogic->CTX_SUFF(pDevIns), GCMailbox, pMbx, sizeof(Mailbox32));
3359	}
3360
3361	return GCMailbox;
3362	}
3363
3364	/**
3365	* Read mailbox from the guest and execute command.
3366	*
3367	* @returns VBox status code.
3368	* @param pBusLogic Pointer to the BusLogic instance data.
3369	*/
3370	static int buslogicR3ProcessMailboxNext(PBUSLOGIC pBusLogic)
3371	{
3372	RTGCPHYS GCPhysAddrMailboxCurrent;
3373	Mailbox32 MailboxGuest;
3374	int rc = VINF_SUCCESS;
3375
3376	if (!pBusLogic->fStrictRoundRobinMode)
3377	{
3378	/* Search for a filled mailbox - stop if we have scanned all mailboxes. */
3379	uint8_t uMailboxPosCur = pBusLogic->uMailboxOutgoingPositionCurrent;
3380
3381	do
3382	{
3383	/* Fetch mailbox from guest memory. */
3384	GCPhysAddrMailboxCurrent = buslogicR3ReadOutgoingMailbox(pBusLogic, &MailboxGuest);
3385
3386	/* Check the next mailbox. */
3387	buslogicR3OutgoingMailboxAdvance(pBusLogic);
3388	} while ( MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE
3389	&& uMailboxPosCur != pBusLogic->uMailboxOutgoingPositionCurrent);
3390	}
3391	else
3392	{
3393	/* Fetch mailbox from guest memory. */
3394	GCPhysAddrMailboxCurrent = buslogicR3ReadOutgoingMailbox(pBusLogic, &MailboxGuest);
3395	}
3396
3397	/*
3398	* Check if the mailbox is actually loaded.
3399	* It might be possible that the guest notified us without
3400	* a loaded mailbox. Do nothing in that case but leave a
3401	* log entry.
3402	*/
3403	if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE)
3404	{
3405	Log(("No loaded mailbox left\n"));
3406	return VERR_NO_DATA;
3407	}
3408
3409	LogFlow(("Got loaded mailbox at slot %u, CCB phys %RGp\n", pBusLogic->uMailboxOutgoingPositionCurrent, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB));
3410	#ifdef LOG_ENABLED
3411	buslogicR3DumpMailboxInfo(&MailboxGuest, true);
3412	#endif
3413
3414	/* We got the mailbox, mark it as free in the guest. */
3415	uint8_t uActionCode = BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE;
3416	unsigned uCodeOffs = pBusLogic->fMbxIs24Bit ? RT_OFFSETOF(Mailbox24, uCmdState) : RT_OFFSETOF(Mailbox32, u.out.uActionCode);
3417	blPhysWrite(pBusLogic, GCPhysAddrMailboxCurrent + uCodeOffs, &uActionCode, sizeof(uActionCode));
3418
3419	if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_START_COMMAND)
3420	rc = buslogicR3DeviceSCSIRequestSetup(pBusLogic, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB);
3421	else if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND)
3422	{
3423	LogFlow(("Aborting mailbox\n"));
3424	rc = buslogicR3DeviceSCSIRequestAbort(pBusLogic, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB);
3425	}
3426	else
3427	AssertMsgFailed(("Invalid outgoing mailbox action code %u\n", MailboxGuest.u.out.uActionCode));
3428
3429	AssertRC(rc);
3430
3431	/* Advance to the next mailbox. */
3432	if (pBusLogic->fStrictRoundRobinMode)
3433	buslogicR3OutgoingMailboxAdvance(pBusLogic);
3434
3435	return rc;
3436	}
3437
3438	/**
3439	* Transmit queue consumer
3440	* Queue a new async task.
3441	*
3442	* @returns Success indicator.
3443	* If false the item will not be removed and the flushing will stop.
3444	* @param pDevIns The device instance.
3445	* @param pItem The item to consume. Upon return this item will be freed.
3446	*/
3447	static DECLCALLBACK(bool) buslogicR3NotifyQueueConsumer(PPDMDEVINS pDevIns, PPDMQUEUEITEMCORE pItem)
3448	{
3449	RT_NOREF(pItem);
3450	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3451
3452	int rc = SUPSemEventSignal(pThis->pSupDrvSession, pThis->hEvtProcess);
3453	AssertRC(rc);
3454
3455	return true;
3456	}
3457
3458	/** @callback_method_impl{FNSSMDEVLIVEEXEC} */
3459	static DECLCALLBACK(int) buslogicR3LiveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass)
3460	{
3461	RT_NOREF(uPass);
3462	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3463
3464	/* Save the device config. */
3465	for (unsigned i = 0; i < RT_ELEMENTS(pThis->aDeviceStates); i++)
3466	SSMR3PutBool(pSSM, pThis->aDeviceStates[i].fPresent);
3467
3468	return VINF_SSM_DONT_CALL_AGAIN;
3469	}
3470
3471	/** @callback_method_impl{FNSSMDEVSAVEEXEC} */
3472	static DECLCALLBACK(int) buslogicR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3473	{
3474	PBUSLOGIC pBusLogic = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3475	uint32_t cReqsSuspended = 0;
3476
3477	/* Every device first. */
3478	for (unsigned i = 0; i < RT_ELEMENTS(pBusLogic->aDeviceStates); i++)
3479	{
3480	PBUSLOGICDEVICE pDevice = &pBusLogic->aDeviceStates[i];
3481
3482	AssertMsg(!pDevice->cOutstandingRequests,
3483	("There are still outstanding requests on this device\n"));
3484	SSMR3PutBool(pSSM, pDevice->fPresent);
3485	SSMR3PutU32(pSSM, pDevice->cOutstandingRequests);
3486
3487	if (pDevice->fPresent)
3488	cReqsSuspended += pDevice->pDrvMediaEx->pfnIoReqGetSuspendedCount(pDevice->pDrvMediaEx);
3489	}
3490	/* Now the main device state. */
3491	SSMR3PutU8 (pSSM, pBusLogic->regStatus);
3492	SSMR3PutU8 (pSSM, pBusLogic->regInterrupt);
3493	SSMR3PutU8 (pSSM, pBusLogic->regGeometry);
3494	SSMR3PutMem (pSSM, &pBusLogic->LocalRam, sizeof(pBusLogic->LocalRam));
3495	SSMR3PutU8 (pSSM, pBusLogic->uOperationCode);
3496	SSMR3PutMem (pSSM, &pBusLogic->aCommandBuffer, sizeof(pBusLogic->aCommandBuffer));
3497	SSMR3PutU8 (pSSM, pBusLogic->iParameter);
3498	SSMR3PutU8 (pSSM, pBusLogic->cbCommandParametersLeft);
3499	SSMR3PutBool (pSSM, pBusLogic->fUseLocalRam);
3500	SSMR3PutMem (pSSM, pBusLogic->aReplyBuffer, sizeof(pBusLogic->aReplyBuffer));
3501	SSMR3PutU8 (pSSM, pBusLogic->iReply);
3502	SSMR3PutU8 (pSSM, pBusLogic->cbReplyParametersLeft);
3503	SSMR3PutBool (pSSM, pBusLogic->fIRQEnabled);
3504	SSMR3PutU8 (pSSM, pBusLogic->uISABaseCode);
3505	SSMR3PutU32 (pSSM, pBusLogic->cMailbox);
3506	SSMR3PutBool (pSSM, pBusLogic->fMbxIs24Bit);
3507	SSMR3PutGCPhys(pSSM, pBusLogic->GCPhysAddrMailboxOutgoingBase);
3508	SSMR3PutU32 (pSSM, pBusLogic->uMailboxOutgoingPositionCurrent);
3509	SSMR3PutU32 (pSSM, pBusLogic->cMailboxesReady);
3510	SSMR3PutBool (pSSM, pBusLogic->fNotificationSent);
3511	SSMR3PutGCPhys(pSSM, pBusLogic->GCPhysAddrMailboxIncomingBase);
3512	SSMR3PutU32 (pSSM, pBusLogic->uMailboxIncomingPositionCurrent);
3513	SSMR3PutBool (pSSM, pBusLogic->fStrictRoundRobinMode);
3514	SSMR3PutBool (pSSM, pBusLogic->fExtendedLunCCBFormat);
3515
3516	vboxscsiR3SaveExec(pDevIns->pHlpR3, &pBusLogic->VBoxSCSI, pSSM);
3517
3518	SSMR3PutU32(pSSM, cReqsSuspended);
3519
3520	/* Save the physical CCB address of all suspended requests. */
3521	for (unsigned i = 0; i < RT_ELEMENTS(pBusLogic->aDeviceStates) && cReqsSuspended; i++)
3522	{
3523	PBUSLOGICDEVICE pDevice = &pBusLogic->aDeviceStates[i];
3524	if (pDevice->fPresent)
3525	{
3526	uint32_t cThisReqsSuspended = pDevice->pDrvMediaEx->pfnIoReqGetSuspendedCount(pDevice->pDrvMediaEx);
3527
3528	cReqsSuspended -= cThisReqsSuspended;
3529	if (cThisReqsSuspended)
3530	{
3531	PDMMEDIAEXIOREQ hIoReq;
3532	PBUSLOGICREQ pReq;
3533	int rc = pDevice->pDrvMediaEx->pfnIoReqQuerySuspendedStart(pDevice->pDrvMediaEx, &hIoReq,
3534	(void **)&pReq);
3535	AssertRCBreak(rc);
3536
3537	for (;;)
3538	{
3539	SSMR3PutU32(pSSM, (uint32_t)pReq->GCPhysAddrCCB);
3540
3541	cThisReqsSuspended--;
3542	if (!cThisReqsSuspended)
3543	break;
3544
3545	rc = pDevice->pDrvMediaEx->pfnIoReqQuerySuspendedNext(pDevice->pDrvMediaEx, hIoReq,
3546	&hIoReq, (void **)&pReq);
3547	AssertRCBreak(rc);
3548	}
3549	}
3550	}
3551	}
3552
3553	return SSMR3PutU32(pSSM, UINT32_MAX);
3554	}
3555
3556	/** @callback_method_impl{FNSSMDEVLOADDONE} */
3557	static DECLCALLBACK(int) buslogicR3LoadDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3558	{
3559	RT_NOREF(pSSM);
3560	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3561
3562	buslogicR3RegisterISARange(pThis, pThis->uISABaseCode);
3563
3564	/* Kick of any requests we might need to redo. */
3565	if (pThis->VBoxSCSI.fBusy)
3566	{
3567
3568	/* The BIOS had a request active when we got suspended. Resume it. */
3569	int rc = buslogicR3PrepareBIOSSCSIRequest(pThis);
3570	AssertRC(rc);
3571	}
3572	else if (pThis->cReqsRedo)
3573	{
3574	for (unsigned i = 0; i < pThis->cReqsRedo; i++)
3575	{
3576	int rc = buslogicR3DeviceSCSIRequestSetup(pThis, pThis->paGCPhysAddrCCBRedo[i]);
3577	AssertRC(rc);
3578	}
3579
3580	RTMemFree(pThis->paGCPhysAddrCCBRedo);
3581	pThis->paGCPhysAddrCCBRedo = NULL;
3582	pThis->cReqsRedo = 0;
3583	}
3584
3585	return VINF_SUCCESS;
3586	}
3587
3588	/** @callback_method_impl{FNSSMDEVLOADEXEC} */
3589	static DECLCALLBACK(int) buslogicR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
3590	{
3591	PBUSLOGIC pBusLogic = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3592	int rc = VINF_SUCCESS;
3593
3594	/* We support saved states only from this and older versions. */
3595	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_VERSION)
3596	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
3597
3598	/* Every device first. */
3599	for (unsigned i = 0; i < RT_ELEMENTS(pBusLogic->aDeviceStates); i++)
3600	{
3601	PBUSLOGICDEVICE pDevice = &pBusLogic->aDeviceStates[i];
3602
3603	AssertMsg(!pDevice->cOutstandingRequests,
3604	("There are still outstanding requests on this device\n"));
3605	bool fPresent;
3606	rc = SSMR3GetBool(pSSM, &fPresent);
3607	AssertRCReturn(rc, rc);
3608	if (pDevice->fPresent != fPresent)
3609	return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("Target %u config mismatch: config=%RTbool state=%RTbool"), i, pDevice->fPresent, fPresent);
3610
3611	if (uPass == SSM_PASS_FINAL)
3612	SSMR3GetU32V(pSSM, &pDevice->cOutstandingRequests);
3613	}
3614
3615	if (uPass != SSM_PASS_FINAL)
3616	return VINF_SUCCESS;
3617
3618	/* Now the main device state. */
3619	SSMR3GetU8V (pSSM, &pBusLogic->regStatus);
3620	SSMR3GetU8V (pSSM, &pBusLogic->regInterrupt);
3621	SSMR3GetU8V (pSSM, &pBusLogic->regGeometry);
3622	SSMR3GetMem (pSSM, &pBusLogic->LocalRam, sizeof(pBusLogic->LocalRam));
3623	SSMR3GetU8 (pSSM, &pBusLogic->uOperationCode);
3624	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE)
3625	SSMR3GetMem (pSSM, &pBusLogic->aCommandBuffer, sizeof(pBusLogic->aCommandBuffer));
3626	else
3627	SSMR3GetMem (pSSM, &pBusLogic->aCommandBuffer, BUSLOGIC_COMMAND_SIZE_OLD);
3628	SSMR3GetU8 (pSSM, &pBusLogic->iParameter);
3629	SSMR3GetU8 (pSSM, &pBusLogic->cbCommandParametersLeft);
3630	SSMR3GetBool (pSSM, &pBusLogic->fUseLocalRam);
3631	SSMR3GetMem (pSSM, pBusLogic->aReplyBuffer, sizeof(pBusLogic->aReplyBuffer));
3632	SSMR3GetU8 (pSSM, &pBusLogic->iReply);
3633	SSMR3GetU8 (pSSM, &pBusLogic->cbReplyParametersLeft);
3634	SSMR3GetBool (pSSM, &pBusLogic->fIRQEnabled);
3635	SSMR3GetU8 (pSSM, &pBusLogic->uISABaseCode);
3636	SSMR3GetU32 (pSSM, &pBusLogic->cMailbox);
3637	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX)
3638	SSMR3GetBool (pSSM, &pBusLogic->fMbxIs24Bit);
3639	SSMR3GetGCPhys(pSSM, &pBusLogic->GCPhysAddrMailboxOutgoingBase);
3640	SSMR3GetU32 (pSSM, &pBusLogic->uMailboxOutgoingPositionCurrent);
3641	SSMR3GetU32V (pSSM, &pBusLogic->cMailboxesReady);
3642	SSMR3GetBoolV (pSSM, &pBusLogic->fNotificationSent);
3643	SSMR3GetGCPhys(pSSM, &pBusLogic->GCPhysAddrMailboxIncomingBase);
3644	SSMR3GetU32 (pSSM, &pBusLogic->uMailboxIncomingPositionCurrent);
3645	SSMR3GetBool (pSSM, &pBusLogic->fStrictRoundRobinMode);
3646	SSMR3GetBool (pSSM, &pBusLogic->fExtendedLunCCBFormat);
3647
3648	rc = vboxscsiR3LoadExec(pDevIns->pHlpR3, &pBusLogic->VBoxSCSI, pSSM);
3649	if (RT_FAILURE(rc))
3650	{
3651	LogRel(("BusLogic: Failed to restore BIOS state: %Rrc.\n", rc));
3652	return PDMDEV_SET_ERROR(pDevIns, rc,
3653	N_("BusLogic: Failed to restore BIOS state\n"));
3654	}
3655
3656	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_ERROR_HANDLING)
3657	{
3658	/* Check if there are pending tasks saved. */
3659	uint32_t cTasks = 0;
3660
3661	SSMR3GetU32(pSSM, &cTasks);
3662
3663	if (cTasks)
3664	{
3665	pBusLogic->paGCPhysAddrCCBRedo = (PRTGCPHYS)RTMemAllocZ(cTasks * sizeof(RTGCPHYS));
3666	if (RT_LIKELY(pBusLogic->paGCPhysAddrCCBRedo))
3667	{
3668	pBusLogic->cReqsRedo = cTasks;
3669
3670	for (uint32_t i = 0; i < cTasks; i++)
3671	{
3672	uint32_t u32PhysAddrCCB;
3673
3674	rc = SSMR3GetU32(pSSM, &u32PhysAddrCCB);
3675	if (RT_FAILURE(rc))
3676	break;
3677
3678	pBusLogic->paGCPhysAddrCCBRedo[i] = u32PhysAddrCCB;
3679	}
3680	}
3681	else
3682	rc = VERR_NO_MEMORY;
3683	}
3684	}
3685
3686	if (RT_SUCCESS(rc))
3687	{
3688	uint32_t u32;
3689	rc = SSMR3GetU32(pSSM, &u32);
3690	if (RT_SUCCESS(rc))
3691	AssertMsgReturn(u32 == UINT32_MAX, ("%#x\n", u32), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
3692	}
3693
3694	return rc;
3695	}
3696
3697	/**
3698	* Gets the pointer to the status LED of a device - called from the SCSI driver.
3699	*
3700	* @returns VBox status code.
3701	* @param pInterface Pointer to the interface structure containing the called function pointer.
3702	* @param iLUN The unit which status LED we desire. Always 0 here as the driver
3703	* doesn't know about other LUN's.
3704	* @param ppLed Where to store the LED pointer.
3705	*/
3706	static DECLCALLBACK(int) buslogicR3DeviceQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3707	{
3708	PBUSLOGICDEVICE pDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, ILed);
3709	if (iLUN == 0)
3710	{
3711	*ppLed = &pDevice->Led;
3712	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
3713	return VINF_SUCCESS;
3714	}
3715	return VERR_PDM_LUN_NOT_FOUND;
3716	}
3717
3718	/**
3719	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
3720	*/
3721	static DECLCALLBACK(void ) buslogicR3DeviceQueryInterface(PPDMIBASE pInterface, const char pszIID)
3722	{
3723	PBUSLOGICDEVICE pDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IBase);
3724	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pDevice->IBase);
3725	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAPORT, &pDevice->IMediaPort);
3726	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAEXPORT, &pDevice->IMediaExPort);
3727	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pDevice->ILed);
3728	return NULL;
3729	}
3730
3731	/**
3732	* Gets the pointer to the status LED of a unit.
3733	*
3734	* @returns VBox status code.
3735	* @param pInterface Pointer to the interface structure containing the called function pointer.
3736	* @param iLUN The unit which status LED we desire.
3737	* @param ppLed Where to store the LED pointer.
3738	*/
3739	static DECLCALLBACK(int) buslogicR3StatusQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3740	{
3741	PBUSLOGIC pBusLogic = RT_FROM_MEMBER(pInterface, BUSLOGIC, ILeds);
3742	if (iLUN < BUSLOGIC_MAX_DEVICES)
3743	{
3744	*ppLed = &pBusLogic->aDeviceStates[iLUN].Led;
3745	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
3746	return VINF_SUCCESS;
3747	}
3748	return VERR_PDM_LUN_NOT_FOUND;
3749	}
3750
3751	/**
3752	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
3753	*/
3754	static DECLCALLBACK(void ) buslogicR3StatusQueryInterface(PPDMIBASE pInterface, const char pszIID)
3755	{
3756	PBUSLOGIC pThis = RT_FROM_MEMBER(pInterface, BUSLOGIC, IBase);
3757	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThis->IBase);
3758	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThis->ILeds);
3759	return NULL;
3760	}
3761
3762	/**
3763	* The worker thread processing requests from the guest.
3764	*
3765	* @returns VBox status code.
3766	* @param pDevIns The device instance.
3767	* @param pThread The thread structure.
3768	*/
3769	static DECLCALLBACK(int) buslogicR3Worker(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3770	{
3771	RT_NOREF(pDevIns);
3772	PBUSLOGIC pThis = (PBUSLOGIC)pThread->pvUser;
3773	int rc = VINF_SUCCESS;
3774
3775	if (pThread->enmState == PDMTHREADSTATE_INITIALIZING)
3776	return VINF_SUCCESS;
3777
3778	while (pThread->enmState == PDMTHREADSTATE_RUNNING)
3779	{
3780	ASMAtomicWriteBool(&pThis->fWrkThreadSleeping, true);
3781	bool fNotificationSent = ASMAtomicXchgBool(&pThis->fNotificationSent, false);
3782	if (!fNotificationSent)
3783	{
3784	Assert(ASMAtomicReadBool(&pThis->fWrkThreadSleeping));
3785	rc = SUPSemEventWaitNoResume(pThis->pSupDrvSession, pThis->hEvtProcess, RT_INDEFINITE_WAIT);
3786	AssertLogRelMsgReturn(RT_SUCCESS(rc) \|\| rc == VERR_INTERRUPTED, ("%Rrc\n", rc), rc);
3787	if (RT_UNLIKELY(pThread->enmState != PDMTHREADSTATE_RUNNING))
3788	break;
3789	LogFlowFunc(("Woken up with rc=%Rrc\n", rc));
3790	ASMAtomicWriteBool(&pThis->fNotificationSent, false);
3791	}
3792
3793	ASMAtomicWriteBool(&pThis->fWrkThreadSleeping, false);
3794
3795	/* Check whether there is a BIOS request pending and process it first. */
3796	if (ASMAtomicReadBool(&pThis->fBiosReqPending))
3797	{
3798	rc = buslogicR3PrepareBIOSSCSIRequest(pThis);
3799	AssertRC(rc);
3800	ASMAtomicXchgBool(&pThis->fBiosReqPending, false);
3801	}
3802	else
3803	{
3804	ASMAtomicXchgU32(&pThis->cMailboxesReady, 0); /** @todo Actually not required anymore but to stay compatible with older saved states. */
3805
3806	/* Process mailboxes. */
3807	do
3808	{
3809	rc = buslogicR3ProcessMailboxNext(pThis);
3810	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_NO_DATA, ("Processing mailbox failed rc=%Rrc\n", rc));
3811	} while (RT_SUCCESS(rc));
3812	}
3813	} /* While running */
3814
3815	return VINF_SUCCESS;
3816	}
3817
3818
3819	/**
3820	* Unblock the worker thread so it can respond to a state change.
3821	*
3822	* @returns VBox status code.
3823	* @param pDevIns The device instance.
3824	* @param pThread The send thread.
3825	*/
3826	static DECLCALLBACK(int) buslogicR3WorkerWakeUp(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3827	{
3828	RT_NOREF(pThread);
3829	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3830	return SUPSemEventSignal(pThis->pSupDrvSession, pThis->hEvtProcess);
3831	}
3832
3833	/**
3834	* BusLogic debugger info callback.
3835	*
3836	* @param pDevIns The device instance.
3837	* @param pHlp The output helpers.
3838	* @param pszArgs The arguments.
3839	*/
3840	static DECLCALLBACK(void) buslogicR3Info(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
3841	{
3842	static const char *apszModels[] = { "BusLogic BT-958D", "BusLogic BT-545C", "Adaptec AHA-1540B" };
3843	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3844	unsigned i;
3845	bool fVerbose = false;
3846
3847	/* Parse arguments. */
3848	if (pszArgs)
3849	fVerbose = strstr(pszArgs, "verbose") != NULL;
3850
3851	/* Show basic information. */
3852	pHlp->pfnPrintf(pHlp, "%s#%d: %s ",
3853	pDevIns->pReg->szName,
3854	pDevIns->iInstance,
3855	pThis->uDevType >= RT_ELEMENTS(apszModels) ? "Uknown model" : apszModels[pThis->uDevType]);
3856	if (pThis->uIsaIrq)
3857	pHlp->pfnPrintf(pHlp, "ISA I/O=%RTiop IRQ=%u ",
3858	pThis->IOISABase,
3859	pThis->uIsaIrq);
3860	else
3861	pHlp->pfnPrintf(pHlp, "PCI I/O=%RTiop ISA I/O=%RTiop MMIO=%RGp IRQ=%u ",
3862	pThis->IOPortBase, pThis->IOISABase, pThis->MMIOBase,
3863	PCIDevGetInterruptLine(pDevIns->apPciDevs[0]));
3864	pHlp->pfnPrintf(pHlp, "GC=%RTbool R0=%RTbool\n",
3865	!!pThis->fGCEnabled, !!pThis->fR0Enabled);
3866
3867	/* Print mailbox state. */
3868	if (pThis->regStatus & BL_STAT_INREQ)
3869	pHlp->pfnPrintf(pHlp, "Mailbox not initialized\n");
3870	else
3871	pHlp->pfnPrintf(pHlp, "%u-bit mailbox with %u entries at %RGp (%d LUN CCBs)\n",
3872	pThis->fMbxIs24Bit ? 24 : 32, pThis->cMailbox,
3873	pThis->GCPhysAddrMailboxOutgoingBase,
3874	pThis->fMbxIs24Bit ? 8 : pThis->fExtendedLunCCBFormat ? 64 : 8);
3875
3876	/* Print register contents. */
3877	pHlp->pfnPrintf(pHlp, "Registers: STAT=%02x INTR=%02x GEOM=%02x\n",
3878	pThis->regStatus, pThis->regInterrupt, pThis->regGeometry);
3879
3880	/* Print miscellaneous state. */
3881	pHlp->pfnPrintf(pHlp, "HAC interrupts: %s\n",
3882	pThis->fIRQEnabled ? "on" : "off");
3883
3884	/* Print the current command, if any. */
3885	if (pThis->uOperationCode != 0xff )
3886	pHlp->pfnPrintf(pHlp, "Current command: %02X\n", pThis->uOperationCode);
3887
3888	if (fVerbose && (pThis->regStatus & BL_STAT_INREQ) == 0)
3889	{
3890	RTGCPHYS GCMailbox;
3891
3892	/* Dump the mailbox contents. */
3893	if (pThis->fMbxIs24Bit)
3894	{
3895	Mailbox24 Mbx24;
3896
3897	/* Outgoing mailbox, 24-bit format. */
3898	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase;
3899	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (24-bit) at %06X:\n", GCMailbox);
3900	for (i = 0; i < pThis->cMailbox; ++i)
3901	{
3902	PDMDevHlpPhysRead(pThis->CTX_SUFF(pDevIns), GCMailbox, &Mbx24, sizeof(Mailbox24));
3903	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %06X action code %02X", i, ADDR_TO_U32(Mbx24.aPhysAddrCCB), Mbx24.uCmdState);
3904	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3905	GCMailbox += sizeof(Mailbox24);
3906	}
3907
3908	/* Incoming mailbox, 24-bit format. */
3909	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox24));
3910	pHlp->pfnPrintf(pHlp, " Incoming mailbox entries (24-bit) at %06X:\n", GCMailbox);
3911	for (i = 0; i < pThis->cMailbox; ++i)
3912	{
3913	PDMDevHlpPhysRead(pThis->CTX_SUFF(pDevIns), GCMailbox, &Mbx24, sizeof(Mailbox24));
3914	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %06X completion code %02X", i, ADDR_TO_U32(Mbx24.aPhysAddrCCB), Mbx24.uCmdState);
3915	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxIncomingPositionCurrent == i ? " *" : "");
3916	GCMailbox += sizeof(Mailbox24);
3917	}
3918
3919	}
3920	else
3921	{
3922	Mailbox32 Mbx32;
3923
3924	/* Outgoing mailbox, 32-bit format. */
3925	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase;
3926	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (32-bit) at %08X:\n", (uint32_t)GCMailbox);
3927	for (i = 0; i < pThis->cMailbox; ++i)
3928	{
3929	PDMDevHlpPhysRead(pThis->CTX_SUFF(pDevIns), GCMailbox, &Mbx32, sizeof(Mailbox32));
3930	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %08X action code %02X", i, Mbx32.u32PhysAddrCCB, Mbx32.u.out.uActionCode);
3931	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3932	GCMailbox += sizeof(Mailbox32);
3933	}
3934
3935	/* Incoming mailbox, 32-bit format. */
3936	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox32));
3937	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (32-bit) at %08X:\n", (uint32_t)GCMailbox);
3938	for (i = 0; i < pThis->cMailbox; ++i)
3939	{
3940	PDMDevHlpPhysRead(pThis->CTX_SUFF(pDevIns), GCMailbox, &Mbx32, sizeof(Mailbox32));
3941	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %08X completion code %02X BTSTAT %02X SDSTAT %02X", i,
3942	Mbx32.u32PhysAddrCCB, Mbx32.u.in.uCompletionCode, Mbx32.u.in.uHostAdapterStatus, Mbx32.u.in.uTargetDeviceStatus);
3943	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3944	GCMailbox += sizeof(Mailbox32);
3945	}
3946
3947	}
3948	}
3949	}
3950
3951	/* -=-=-=-=- Helper -=-=-=-=- */
3952
3953	/**
3954	* Checks if all asynchronous I/O is finished.
3955	*
3956	* Used by buslogicR3Reset, buslogicR3Suspend and buslogicR3PowerOff.
3957	*
3958	* @returns true if quiesced, false if busy.
3959	* @param pDevIns The device instance.
3960	*/
3961	static bool buslogicR3AllAsyncIOIsFinished(PPDMDEVINS pDevIns)
3962	{
3963	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3964
3965	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aDeviceStates); i++)
3966	{
3967	PBUSLOGICDEVICE pThisDevice = &pThis->aDeviceStates[i];
3968	if (pThisDevice->pDrvBase)
3969	{
3970	if (pThisDevice->cOutstandingRequests != 0)
3971	return false;
3972	}
3973	}
3974
3975	return true;
3976	}
3977
3978	/**
3979	* Callback employed by buslogicR3Suspend and buslogicR3PowerOff.
3980	*
3981	* @returns true if we've quiesced, false if we're still working.
3982	* @param pDevIns The device instance.
3983	*/
3984	static DECLCALLBACK(bool) buslogicR3IsAsyncSuspendOrPowerOffDone(PPDMDEVINS pDevIns)
3985	{
3986	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
3987	return false;
3988
3989	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3990	ASMAtomicWriteBool(&pThis->fSignalIdle, false);
3991	return true;
3992	}
3993
3994	/**
3995	* Common worker for buslogicR3Suspend and buslogicR3PowerOff.
3996	*/
3997	static void buslogicR3SuspendOrPowerOff(PPDMDEVINS pDevIns)
3998	{
3999	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4000
4001	ASMAtomicWriteBool(&pThis->fSignalIdle, true);
4002	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4003	PDMDevHlpSetAsyncNotification(pDevIns, buslogicR3IsAsyncSuspendOrPowerOffDone);
4004	else
4005	{
4006	ASMAtomicWriteBool(&pThis->fSignalIdle, false);
4007	AssertMsg(!pThis->fNotificationSent, ("The PDM Queue should be empty at this point\n"));
4008	}
4009
4010	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aDeviceStates); i++)
4011	{
4012	PBUSLOGICDEVICE pThisDevice = &pThis->aDeviceStates[i];
4013	if (pThisDevice->pDrvMediaEx)
4014	pThisDevice->pDrvMediaEx->pfnNotifySuspend(pThisDevice->pDrvMediaEx);
4015	}
4016	}
4017
4018	/**
4019	* Suspend notification.
4020	*
4021	* @param pDevIns The device instance data.
4022	*/
4023	static DECLCALLBACK(void) buslogicR3Suspend(PPDMDEVINS pDevIns)
4024	{
4025	Log(("buslogicR3Suspend\n"));
4026	buslogicR3SuspendOrPowerOff(pDevIns);
4027	}
4028
4029	/**
4030	* Detach notification.
4031	*
4032	* One harddisk at one port has been unplugged.
4033	* The VM is suspended at this point.
4034	*
4035	* @param pDevIns The device instance.
4036	* @param iLUN The logical unit which is being detached.
4037	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
4038	*/
4039	static DECLCALLBACK(void) buslogicR3Detach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
4040	{
4041	RT_NOREF(fFlags);
4042	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4043	PBUSLOGICDEVICE pDevice = &pThis->aDeviceStates[iLUN];
4044
4045	Log(("%s:\n", __FUNCTION__));
4046
4047	AssertMsg(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
4048	("BusLogic: Device does not support hotplugging\n"));
4049
4050	/*
4051	* Zero some important members.
4052	*/
4053	pDevice->fPresent = false;
4054	pDevice->pDrvBase = NULL;
4055	pDevice->pDrvMedia = NULL;
4056	pDevice->pDrvMediaEx = NULL;
4057	}
4058
4059	/**
4060	* Attach command.
4061	*
4062	* This is called when we change block driver.
4063	*
4064	* @returns VBox status code.
4065	* @param pDevIns The device instance.
4066	* @param iLUN The logical unit which is being detached.
4067	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
4068	*/
4069	static DECLCALLBACK(int) buslogicR3Attach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
4070	{
4071	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4072	PBUSLOGICDEVICE pDevice = &pThis->aDeviceStates[iLUN];
4073	int rc;
4074
4075	AssertMsgReturn(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
4076	("BusLogic: Device does not support hotplugging\n"),
4077	VERR_INVALID_PARAMETER);
4078
4079	/* the usual paranoia */
4080	AssertRelease(!pDevice->pDrvBase);
4081	AssertRelease(!pDevice->pDrvMedia);
4082	AssertRelease(!pDevice->pDrvMediaEx);
4083	Assert(pDevice->iLUN == iLUN);
4084
4085	/*
4086	* Try attach the SCSI driver and get the interfaces,
4087	* required as well as optional.
4088	*/
4089	rc = PDMDevHlpDriverAttach(pDevIns, pDevice->iLUN, &pDevice->IBase, &pDevice->pDrvBase, NULL);
4090	if (RT_SUCCESS(rc))
4091	{
4092	/* Query the media interface. */
4093	pDevice->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIA);
4094	AssertMsgReturn(VALID_PTR(pDevice->pDrvMedia),
4095	("BusLogic configuration error: LUN#%d misses the basic media interface!\n", pDevice->iLUN),
4096	VERR_PDM_MISSING_INTERFACE);
4097
4098	/* Get the extended media interface. */
4099	pDevice->pDrvMediaEx = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIAEX);
4100	AssertMsgReturn(VALID_PTR(pDevice->pDrvMediaEx),
4101	("BusLogic configuration error: LUN#%d misses the extended media interface!\n", pDevice->iLUN),
4102	VERR_PDM_MISSING_INTERFACE);
4103
4104	rc = pDevice->pDrvMediaEx->pfnIoReqAllocSizeSet(pDevice->pDrvMediaEx, sizeof(BUSLOGICREQ));
4105	AssertMsgRCReturn(rc, ("BusLogic configuration error: LUN#%u: Failed to set I/O request size!", pDevice->iLUN),
4106	rc);
4107
4108	pDevice->fPresent = true;
4109	}
4110	else
4111	AssertMsgFailed(("Failed to attach LUN#%d. rc=%Rrc\n", pDevice->iLUN, rc));
4112
4113	if (RT_FAILURE(rc))
4114	{
4115	pDevice->fPresent = false;
4116	pDevice->pDrvBase = NULL;
4117	pDevice->pDrvMedia = NULL;
4118	pDevice->pDrvMediaEx = NULL;
4119	}
4120	return rc;
4121	}
4122
4123	/**
4124	* Callback employed by buslogicR3Reset.
4125	*
4126	* @returns true if we've quiesced, false if we're still working.
4127	* @param pDevIns The device instance.
4128	*/
4129	static DECLCALLBACK(bool) buslogicR3IsAsyncResetDone(PPDMDEVINS pDevIns)
4130	{
4131	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4132
4133	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4134	return false;
4135	ASMAtomicWriteBool(&pThis->fSignalIdle, false);
4136
4137	buslogicR3HwReset(pThis, true);
4138	return true;
4139	}
4140
4141	/**
4142	* @copydoc FNPDMDEVRESET
4143	*/
4144	static DECLCALLBACK(void) buslogicR3Reset(PPDMDEVINS pDevIns)
4145	{
4146	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4147
4148	ASMAtomicWriteBool(&pThis->fSignalIdle, true);
4149	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4150	PDMDevHlpSetAsyncNotification(pDevIns, buslogicR3IsAsyncResetDone);
4151	else
4152	{
4153	ASMAtomicWriteBool(&pThis->fSignalIdle, false);
4154	buslogicR3HwReset(pThis, true);
4155	}
4156	}
4157
4158	static DECLCALLBACK(void) buslogicR3Relocate(PPDMDEVINS pDevIns, RTGCINTPTR offDelta)
4159	{
4160	RT_NOREF(offDelta);
4161	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4162
4163	pThis->pDevInsRC = PDMDEVINS_2_RCPTR(pDevIns);
4164	pThis->pNotifierQueueRC = PDMQueueRCPtr(pThis->pNotifierQueueR3);
4165
4166	for (uint32_t i = 0; i < BUSLOGIC_MAX_DEVICES; i++)
4167	{
4168	PBUSLOGICDEVICE pDevice = &pThis->aDeviceStates[i];
4169
4170	pDevice->pBusLogicRC = PDMINS_2_DATA_RCPTR(pDevIns);
4171	}
4172
4173	}
4174
4175	/**
4176	* Poweroff notification.
4177	*
4178	* @param pDevIns Pointer to the device instance
4179	*/
4180	static DECLCALLBACK(void) buslogicR3PowerOff(PPDMDEVINS pDevIns)
4181	{
4182	Log(("buslogicR3PowerOff\n"));
4183	buslogicR3SuspendOrPowerOff(pDevIns);
4184	}
4185
4186	/**
4187	* Destroy a driver instance.
4188	*
4189	* Most VM resources are freed by the VM. This callback is provided so that any non-VM
4190	* resources can be freed correctly.
4191	*
4192	* @param pDevIns The device instance data.
4193	*/
4194	static DECLCALLBACK(int) buslogicR3Destruct(PPDMDEVINS pDevIns)
4195	{
4196	PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
4197	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4198
4199	PDMR3CritSectDelete(&pThis->CritSectIntr);
4200
4201	if (pThis->hEvtProcess != NIL_SUPSEMEVENT)
4202	{
4203	SUPSemEventClose(pThis->pSupDrvSession, pThis->hEvtProcess);
4204	pThis->hEvtProcess = NIL_SUPSEMEVENT;
4205	}
4206
4207	return VINF_SUCCESS;
4208	}
4209
4210	/**
4211	* @interface_method_impl{PDMDEVREG,pfnConstruct}
4212	*/
4213	static DECLCALLBACK(int) buslogicR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
4214	{
4215	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
4216	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4217	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
4218	int rc = VINF_SUCCESS;
4219	char szCfgStr[16];
4220
4221	/*
4222	* Init instance data (do early because of constructor).
4223	*/
4224	pThis->pDevInsR3 = pDevIns;
4225	pThis->pDevInsR0 = PDMDEVINS_2_R0PTR(pDevIns);
4226	pThis->pDevInsRC = PDMDEVINS_2_RCPTR(pDevIns);
4227	pThis->IBase.pfnQueryInterface = buslogicR3StatusQueryInterface;
4228	pThis->ILeds.pfnQueryStatusLed = buslogicR3StatusQueryStatusLed;
4229
4230	PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
4231	PDMPCIDEV_ASSERT_VALID(pDevIns, pPciDev);
4232
4233	PDMPciDevSetVendorId(pPciDev, 0x104b); /* BusLogic */
4234	PDMPciDevSetDeviceId(pPciDev, 0x1040); /* BT-958 */
4235	PDMPciDevSetCommand(pPciDev, PCI_COMMAND_IOACCESS \| PCI_COMMAND_MEMACCESS);
4236	PDMPciDevSetRevisionId(pPciDev, 0x01);
4237	PDMPciDevSetClassProg(pPciDev, 0x00); /* SCSI */
4238	PDMPciDevSetClassSub(pPciDev, 0x00); /* SCSI */
4239	PDMPciDevSetClassBase(pPciDev, 0x01); /* Mass storage */
4240	PDMPciDevSetBaseAddress(pPciDev, 0, true /IO/, false /Pref/, false /64-bit/, 0x00000000);
4241	PDMPciDevSetBaseAddress(pPciDev, 1, false /IO/, false /Pref/, false /64-bit/, 0x00000000);
4242	PDMPciDevSetSubSystemVendorId(pPciDev, 0x104b);
4243	PDMPciDevSetSubSystemId(pPciDev, 0x1040);
4244	PDMPciDevSetInterruptLine(pPciDev, 0x00);
4245	PDMPciDevSetInterruptPin(pPciDev, 0x01);
4246
4247	/*
4248	* Validate and read configuration.
4249	*/
4250	PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns, "Bootable\|AdapterType\|ISACompat", "");
4251
4252	pThis->fGCEnabled = pDevIns->fRCEnabled;
4253	pThis->fR0Enabled = pDevIns->fR0Enabled;
4254
4255	bool fBootable = true;
4256	rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "Bootable", &fBootable, true);
4257	if (RT_FAILURE(rc))
4258	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read Bootable as boolean"));
4259	Log(("%s: fBootable=%RTbool\n", __FUNCTION__, fBootable));
4260
4261	/* Figure out the emulated device type. */
4262	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "AdapterType", szCfgStr, sizeof(szCfgStr), "BT-958D");
4263	if (RT_FAILURE(rc))
4264	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read AdapterType as string"));
4265	Log(("%s: AdapterType=%s\n", __FUNCTION__, szCfgStr));
4266
4267	/* Grok the AdapterType setting. */
4268	if (!strcmp(szCfgStr, "BT-958D")) /* Default PCI device, 32-bit and 24-bit addressing. */
4269	{
4270	pThis->uDevType = DEV_BT_958D;
4271	pThis->uDefaultISABaseCode = ISA_BASE_DISABLED;
4272	}
4273	else if (!strcmp(szCfgStr, "BT-545C")) /* ISA device, 24-bit addressing only. */
4274	{
4275	pThis->uDevType = DEV_BT_545C;
4276	pThis->uIsaIrq = 11;
4277	}
4278	else if (!strcmp(szCfgStr, "AHA-1540B")) /* Competitor ISA device. */
4279	{
4280	pThis->uDevType = DEV_AHA_1540B;
4281	pThis->uIsaIrq = 11;
4282	}
4283	else
4284	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
4285	N_("BusLogic configuration error: invalid AdapterType setting"));
4286
4287	/* Only the first instance defaults to having the ISA compatibility ports enabled. */
4288	if (iInstance == 0)
4289	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "ISACompat", szCfgStr, sizeof(szCfgStr), "Alternate");
4290	else
4291	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "ISACompat", szCfgStr, sizeof(szCfgStr), "Disabled");
4292	if (RT_FAILURE(rc))
4293	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read ISACompat as string"));
4294	Log(("%s: ISACompat=%s\n", __FUNCTION__, szCfgStr));
4295
4296	/* Grok the ISACompat setting. */
4297	if (!strcmp(szCfgStr, "Disabled"))
4298	pThis->uDefaultISABaseCode = ISA_BASE_DISABLED;
4299	else if (!strcmp(szCfgStr, "Primary"))
4300	pThis->uDefaultISABaseCode = 0; /* I/O base at 330h. */
4301	else if (!strcmp(szCfgStr, "Alternate"))
4302	pThis->uDefaultISABaseCode = 1; /* I/O base at 334h. */
4303	else
4304	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
4305	N_("BusLogic configuration error: invalid ISACompat setting"));
4306
4307	/*
4308	* Register the PCI device and its I/O regions if applicable.
4309	*/
4310	if (!pThis->uIsaIrq)
4311	{
4312	rc = PDMDevHlpPCIRegister(pDevIns, pPciDev);
4313	if (RT_FAILURE(rc))
4314	return rc;
4315
4316	rc = PDMDevHlpPCIIORegionRegister(pDevIns, 0, 32, PCI_ADDRESS_SPACE_IO, buslogicR3MmioMap);
4317	if (RT_FAILURE(rc))
4318	return rc;
4319
4320	rc = PDMDevHlpPCIIORegionRegister(pDevIns, 1, 32, PCI_ADDRESS_SPACE_MEM, buslogicR3MmioMap);
4321	if (RT_FAILURE(rc))
4322	return rc;
4323	}
4324
4325	if (fBootable)
4326	{
4327	/* Register I/O port space for BIOS access. */
4328	rc = PDMDevHlpIOPortRegister(pDevIns, BUSLOGIC_BIOS_IO_PORT, 4, NULL,
4329	buslogicR3BiosIoPortWrite, buslogicR3BiosIoPortRead,
4330	buslogicR3BiosIoPortWriteStr, buslogicR3BiosIoPortReadStr,
4331	"BusLogic BIOS");
4332	if (RT_FAILURE(rc))
4333	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register BIOS I/O handlers"));
4334	}
4335
4336	/* Set up the compatibility I/O range. */
4337	rc = buslogicR3RegisterISARange(pThis, pThis->uDefaultISABaseCode);
4338	if (RT_FAILURE(rc))
4339	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register ISA I/O handlers"));
4340
4341	/* Initialize task queue. */
4342	rc = PDMDevHlpQueueCreate(pDevIns, sizeof(PDMQUEUEITEMCORE), 5, 0,
4343	buslogicR3NotifyQueueConsumer, true, "BusLogicTask", &pThis->pNotifierQueueR3);
4344	if (RT_FAILURE(rc))
4345	return rc;
4346	pThis->pNotifierQueueR0 = PDMQueueR0Ptr(pThis->pNotifierQueueR3);
4347	pThis->pNotifierQueueRC = PDMQueueRCPtr(pThis->pNotifierQueueR3);
4348
4349	rc = PDMDevHlpCritSectInit(pDevIns, &pThis->CritSectIntr, RT_SRC_POS, "BusLogic-Intr#%u", pDevIns->iInstance);
4350	if (RT_FAILURE(rc))
4351	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic: cannot create critical section"));
4352
4353	/*
4354	* Create event semaphore and worker thread.
4355	*/
4356	rc = SUPSemEventCreate(pThis->pSupDrvSession, &pThis->hEvtProcess);
4357	if (RT_FAILURE(rc))
4358	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4359	N_("BusLogic: Failed to create SUP event semaphore"));
4360
4361	char szDevTag[20];
4362	RTStrPrintf(szDevTag, sizeof(szDevTag), "BUSLOGIC-%u", iInstance);
4363
4364	rc = PDMDevHlpThreadCreate(pDevIns, &pThis->pThreadWrk, pThis, buslogicR3Worker,
4365	buslogicR3WorkerWakeUp, 0, RTTHREADTYPE_IO, szDevTag);
4366	if (RT_FAILURE(rc))
4367	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4368	N_("BusLogic: Failed to create worker thread %s"), szDevTag);
4369
4370	/* Initialize per device state. */
4371	for (unsigned i = 0; i < RT_ELEMENTS(pThis->aDeviceStates); i++)
4372	{
4373	char szName[24];
4374	PBUSLOGICDEVICE pDevice = &pThis->aDeviceStates[i];
4375
4376	char *pszName;
4377	if (RTStrAPrintf(&pszName, "Device%u", i) < 0)
4378	AssertLogRelFailedReturn(VERR_NO_MEMORY);
4379
4380	/* Initialize static parts of the device. */
4381	pDevice->iLUN = i;
4382	pDevice->pBusLogicR3 = pThis;
4383	pDevice->pBusLogicR0 = PDMINS_2_DATA_R0PTR(pDevIns);
4384	pDevice->pBusLogicRC = PDMINS_2_DATA_RCPTR(pDevIns);
4385	pDevice->Led.u32Magic = PDMLED_MAGIC;
4386	pDevice->IBase.pfnQueryInterface = buslogicR3DeviceQueryInterface;
4387	pDevice->IMediaPort.pfnQueryDeviceLocation = buslogicR3QueryDeviceLocation;
4388	pDevice->IMediaExPort.pfnIoReqCompleteNotify = buslogicR3IoReqCompleteNotify;
4389	pDevice->IMediaExPort.pfnIoReqCopyFromBuf = buslogicR3IoReqCopyFromBuf;
4390	pDevice->IMediaExPort.pfnIoReqCopyToBuf = buslogicR3IoReqCopyToBuf;
4391	pDevice->IMediaExPort.pfnIoReqQueryBuf = NULL;
4392	pDevice->IMediaExPort.pfnIoReqQueryDiscardRanges = NULL;
4393	pDevice->IMediaExPort.pfnIoReqStateChanged = buslogicR3IoReqStateChanged;
4394	pDevice->IMediaExPort.pfnMediumEjected = buslogicR3MediumEjected;
4395	pDevice->ILed.pfnQueryStatusLed = buslogicR3DeviceQueryStatusLed;
4396
4397	/* Attach SCSI driver. */
4398	rc = PDMDevHlpDriverAttach(pDevIns, pDevice->iLUN, &pDevice->IBase, &pDevice->pDrvBase, pszName);
4399	if (RT_SUCCESS(rc))
4400	{
4401	/* Query the media interface. */
4402	pDevice->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIA);
4403	AssertMsgReturn(VALID_PTR(pDevice->pDrvMedia),
4404	("Buslogic configuration error: LUN#%d misses the basic media interface!\n", pDevice->iLUN),
4405	VERR_PDM_MISSING_INTERFACE);
4406
4407	/* Get the extended media interface. */
4408	pDevice->pDrvMediaEx = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIAEX);
4409	AssertMsgReturn(VALID_PTR(pDevice->pDrvMediaEx),
4410	("Buslogic configuration error: LUN#%d misses the extended media interface!\n", pDevice->iLUN),
4411	VERR_PDM_MISSING_INTERFACE);
4412
4413	rc = pDevice->pDrvMediaEx->pfnIoReqAllocSizeSet(pDevice->pDrvMediaEx, sizeof(BUSLOGICREQ));
4414	if (RT_FAILURE(rc))
4415	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4416	N_("Buslogic configuration error: LUN#%u: Failed to set I/O request size!"),
4417	pDevice->iLUN);
4418
4419	pDevice->fPresent = true;
4420	}
4421	else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
4422	{
4423	pDevice->fPresent = false;
4424	pDevice->pDrvBase = NULL;
4425	pDevice->pDrvMedia = NULL;
4426	pDevice->pDrvMediaEx = NULL;
4427	rc = VINF_SUCCESS;
4428	Log(("BusLogic: no driver attached to device %s\n", szName));
4429	}
4430	else
4431	{
4432	AssertLogRelMsgFailed(("BusLogic: Failed to attach %s\n", szName));
4433	return rc;
4434	}
4435	}
4436
4437	/*
4438	* Attach status driver (optional).
4439	*/
4440	PPDMIBASE pBase;
4441	rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThis->IBase, &pBase, "Status Port");
4442	if (RT_SUCCESS(rc))
4443	{
4444	pThis->pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
4445	pThis->pMediaNotify = PDMIBASE_QUERY_INTERFACE(pBase, PDMIMEDIANOTIFY);
4446	}
4447	else if (rc != VERR_PDM_NO_ATTACHED_DRIVER)
4448	{
4449	AssertMsgFailed(("Failed to attach to status driver. rc=%Rrc\n", rc));
4450	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot attach to status driver"));
4451	}
4452
4453	rc = PDMDevHlpSSMRegisterEx(pDevIns, BUSLOGIC_SAVED_STATE_MINOR_VERSION, sizeof(*pThis), NULL,
4454	NULL, buslogicR3LiveExec, NULL,
4455	NULL, buslogicR3SaveExec, NULL,
4456	NULL, buslogicR3LoadExec, buslogicR3LoadDone);
4457	if (RT_FAILURE(rc))
4458	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register save state handlers"));
4459
4460	/*
4461	* Register the debugger info callback.
4462	*/
4463	char szTmp[128];
4464	RTStrPrintf(szTmp, sizeof(szTmp), "%s%d", pDevIns->pReg->szName, pDevIns->iInstance);
4465	PDMDevHlpDBGFInfoRegister(pDevIns, szTmp, "BusLogic HBA info", buslogicR3Info);
4466
4467	rc = buslogicR3HwReset(pThis, true);
4468	AssertMsgRC(rc, ("hardware reset of BusLogic host adapter failed rc=%Rrc\n", rc));
4469
4470	return rc;
4471	}
4472
4473	#endif /* IN_RING3 */
4474
4475	/**
4476	* The device registration structure.
4477	*/
4478	const PDMDEVREG g_DeviceBusLogic =
4479	{
4480	/* .u32Version = */ PDM_DEVREG_VERSION,
4481	/* .uReserved0 = */ 0,
4482	/* .szName = */ "buslogic",
4483	/* .fFlags = */ PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RZ \|
4484	PDM_DEVREG_FLAGS_FIRST_SUSPEND_NOTIFICATION \| PDM_DEVREG_FLAGS_FIRST_POWEROFF_NOTIFICATION \|
4485	PDM_DEVREG_FLAGS_FIRST_RESET_NOTIFICATION,
4486	/* .fClass = */ PDM_DEVREG_CLASS_STORAGE,
4487	/* .cMaxInstances = */ ~0U,
4488	/* .uSharedVersion = */ 42,
4489	/* .cbInstanceShared = */ sizeof(BUSLOGIC),
4490	/* .cbInstanceCC = */ 0,
4491	/* .cbInstanceRC = */ 0,
4492	/* .cMaxPciDevices = */ 1,
4493	/* .cMaxMsixVectors = */ 0,
4494	/* .pszDescription = */ "BusLogic BT-958 SCSI host adapter.\n",
4495	#if defined(IN_RING3)
4496	/* .pszRCMod = */ "VBoxDDRC.rc",
4497	/* .pszR0Mod = */ "VBoxDDR0.r0",
4498	/* .pfnConstruct = */ buslogicR3Construct,
4499	/* .pfnDestruct = */ buslogicR3Destruct,
4500	/* .pfnRelocate = */ buslogicR3Relocate,
4501	/* .pfnMemSetup = */ NULL,
4502	/* .pfnPowerOn = */ NULL,
4503	/* .pfnReset = */ buslogicR3Reset,
4504	/* .pfnSuspend = */ buslogicR3Suspend,
4505	/* .pfnResume = */ NULL,
4506	/* .pfnAttach = */ buslogicR3Attach,
4507	/* .pfnDetach = */ buslogicR3Detach,
4508	/* .pfnQueryInterface = */ NULL,
4509	/* .pfnInitComplete = */ NULL,
4510	/* .pfnPowerOff = */ buslogicR3PowerOff,
4511	/* .pfnSoftReset = */ NULL,
4512	/* .pfnReserved0 = */ NULL,
4513	/* .pfnReserved1 = */ NULL,
4514	/* .pfnReserved2 = */ NULL,
4515	/* .pfnReserved3 = */ NULL,
4516	/* .pfnReserved4 = */ NULL,
4517	/* .pfnReserved5 = */ NULL,
4518	/* .pfnReserved6 = */ NULL,
4519	/* .pfnReserved7 = */ NULL,
4520	#elif defined(IN_RING0)
4521	/* .pfnEarlyConstruct = */ NULL,
4522	/* .pfnConstruct = */ NULL,
4523	/* .pfnDestruct = */ NULL,
4524	/* .pfnFinalDestruct = */ NULL,
4525	/* .pfnRequest = */ NULL,
4526	/* .pfnReserved0 = */ NULL,
4527	/* .pfnReserved1 = */ NULL,
4528	/* .pfnReserved2 = */ NULL,
4529	/* .pfnReserved3 = */ NULL,
4530	/* .pfnReserved4 = */ NULL,
4531	/* .pfnReserved5 = */ NULL,
4532	/* .pfnReserved6 = */ NULL,
4533	/* .pfnReserved7 = */ NULL,
4534	#elif defined(IN_RC)
4535	/* .pfnConstruct = */ NULL,
4536	/* .pfnReserved0 = */ NULL,
4537	/* .pfnReserved1 = */ NULL,
4538	/* .pfnReserved2 = */ NULL,
4539	/* .pfnReserved3 = */ NULL,
4540	/* .pfnReserved4 = */ NULL,
4541	/* .pfnReserved5 = */ NULL,
4542	/* .pfnReserved6 = */ NULL,
4543	/* .pfnReserved7 = */ NULL,
4544	#else
4545	# error "Not in IN_RING3, IN_RING0 or IN_RC!"
4546	#endif
4547	/* .u32VersionEnd = */ PDM_DEVREG_VERSION
4548	};
4549
4550	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Storage/DevBusLogic.cpp@ 81800

Download in other formats: