DevBusLogic.cpp@ 84357

Last change on this file since 84357 was 83141, checked in by vboxsync, 5 years ago
DevBusLogic: Improved interrupt reporting logic to match real hardware. Fixed a problem with FETCH HOST ADAPTER LOCAL RAM not resetting the DIRRDY bit (broke Linux driver). See bugref:5112.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 177.2 KB

Line
1	/* $Id: DevBusLogic.cpp 83141 2020-02-24 17:50:34Z vboxsync $ */
2	/** @file
3	* VBox storage devices - BusLogic SCSI host adapter BT-958.
4	*
5	* Based on the Multi-Master Ultra SCSI Systems Technical Reference Manual.
6	*/
7
8	/*
9	* Copyright (C) 2006-2020 Oracle Corporation
10	*
11	* This file is part of VirtualBox Open Source Edition (OSE), as
12	* available from http://www.virtualbox.org. This file is free software;
13	* you can redistribute it and/or modify it under the terms of the GNU
14	* General Public License (GPL) as published by the Free Software
15	* Foundation, in version 2 as it comes in the "COPYING" file of the
16	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
17	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
18	*/
19
20
21	/*********************************************************************************************************************************
22	* Header Files *
23	*********************************************************************************************************************************/
24	#define LOG_GROUP LOG_GROUP_DEV_BUSLOGIC
25	#include <VBox/vmm/pdmdev.h>
26	#include <VBox/vmm/pdmstorageifs.h>
27	#include <VBox/vmm/pdmcritsect.h>
28	#include <VBox/AssertGuest.h>
29	#include <VBox/scsi.h>
30	#include <iprt/asm.h>
31	#include <iprt/assert.h>
32	#include <iprt/string.h>
33	#include <iprt/log.h>
34	#ifdef IN_RING3
35	# include <iprt/alloc.h>
36	# include <iprt/memcache.h>
37	# include <iprt/param.h>
38	# include <iprt/uuid.h>
39	#endif
40
41	#include "VBoxSCSI.h"
42	#include "VBoxDD.h"
43
44
45	/*********************************************************************************************************************************
46	* Defined Constants And Macros *
47	*********************************************************************************************************************************/
48	/** Maximum number of attached devices the adapter can handle. */
49	#define BUSLOGIC_MAX_DEVICES 16
50
51	/** Maximum number of scatter gather elements this device can handle. */
52	#define BUSLOGIC_MAX_SCATTER_GATHER_LIST_SIZE 128
53
54	/** Size of the command buffer. */
55	#define BUSLOGIC_COMMAND_SIZE_MAX 53
56
57	/** Size of the reply buffer. */
58	#define BUSLOGIC_REPLY_SIZE_MAX 64
59
60	/** Custom fixed I/O ports for BIOS controller access.
61	* Note that these should not be in the ISA range (below 400h) to avoid
62	* conflicts with ISA device probing. Addresses in the 300h-340h range should be
63	* especially avoided.
64	*/
65	#define BUSLOGIC_BIOS_IO_PORT 0x430
66
67	/** State saved version. */
68	#define BUSLOGIC_SAVED_STATE_MINOR_VERSION 4
69
70	/** Saved state version before the suspend on error feature was implemented. */
71	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_ERROR_HANDLING 1
72	/** Saved state version before 24-bit mailbox support was implemented. */
73	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX 2
74	/** Saved state version before command buffer size was raised. */
75	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE 3
76
77	/** Command buffer size in old saved states. */
78	#define BUSLOGIC_COMMAND_SIZE_OLD 5
79
80	/** The duration of software-initiated reset (in nano seconds).
81	* Not documented, set to 50 ms. */
82	#define BUSLOGIC_RESET_DURATION_NS UINT64_C(50000000)
83
84
85	/*********************************************************************************************************************************
86	* Structures and Typedefs *
87	*********************************************************************************************************************************/
88	/**
89	* State of a device attached to the buslogic host adapter.
90	*
91	* @implements PDMIBASE
92	* @implements PDMISCSIPORT
93	* @implements PDMILEDPORTS
94	*/
95	typedef struct BUSLOGICDEVICE
96	{
97	/** The ring-3 device instance (for getting our bearings when arriving in an
98	* interface method). */
99	PPDMDEVINSR3 pDevIns;
100
101	/** LUN of the device. */
102	uint32_t iLUN;
103
104	/** Flag whether device is present.
105	* @note This is mirrored in BUSLOGIC::afDevicePresent. */
106	bool fPresent;
107	bool afAlignment[3];
108
109	/** Our base interface. */
110	PDMIBASE IBase;
111	/** Media port interface. */
112	PDMIMEDIAPORT IMediaPort;
113	/** Extended media port interface. */
114	PDMIMEDIAEXPORT IMediaExPort;
115	/** Led interface. */
116	PDMILEDPORTS ILed;
117	/** Pointer to the attached driver's base interface. */
118	R3PTRTYPE(PPDMIBASE) pDrvBase;
119	/** Pointer to the attached driver's media interface. */
120	R3PTRTYPE(PPDMIMEDIA) pDrvMedia;
121	/** Pointer to the attached driver's extended media interface. */
122	R3PTRTYPE(PPDMIMEDIAEX) pDrvMediaEx;
123	/** The status LED state for this device. */
124	PDMLED Led;
125
126	/** Number of outstanding tasks on the port. */
127	volatile uint32_t cOutstandingRequests;
128	/** The device name. */
129	char szName[12];
130	} BUSLOGICDEVICE, *PBUSLOGICDEVICE;
131
132	/**
133	* Commands the BusLogic adapter supports.
134	*/
135	enum BUSLOGICCOMMAND
136	{
137	BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT = 0x00,
138	BUSLOGICCOMMAND_INITIALIZE_MAILBOX = 0x01,
139	BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND = 0x02,
140	BUSLOGICCOMMAND_EXECUTE_BIOS_COMMAND = 0x03,
141	BUSLOGICCOMMAND_INQUIRE_BOARD_ID = 0x04,
142	BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT = 0x05,
143	BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT = 0x06,
144	BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS = 0x07,
145	BUSLOGICCOMMAND_SET_TIME_OFF_BUS = 0x08,
146	BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE = 0x09,
147	BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7 = 0x0a,
148	BUSLOGICCOMMAND_INQUIRE_CONFIGURATION = 0x0b,
149	BUSLOGICCOMMAND_ENABLE_TARGET_MODE = 0x0c,
150	BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION = 0x0d,
151	BUSLOGICCOMMAND_WRITE_ADAPTER_LOCAL_RAM = 0x1a,
152	BUSLOGICCOMMAND_READ_ADAPTER_LOCAL_RAM = 0x1b,
153	BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO = 0x1c,
154	BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO = 0x1d,
155	BUSLOGICCOMMAND_ECHO_COMMAND_DATA = 0x1f,
156	BUSLOGICCOMMAND_HOST_ADAPTER_DIAGNOSTIC = 0x20,
157	BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS = 0x21,
158	BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15 = 0x23,
159	BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES = 0x24,
160	BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT = 0x25,
161	BUSLOGICCOMMAND_EXT_BIOS_INFO = 0x28,
162	BUSLOGICCOMMAND_UNLOCK_MAILBOX = 0x29,
163	BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX = 0x81,
164	BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND = 0x83,
165	BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER = 0x84,
166	BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER = 0x85,
167	BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION = 0x86,
168	BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER = 0x8b,
169	BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD = 0x8c,
170	BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION = 0x8d,
171	BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE = 0x8f,
172	BUSLOGICCOMMAND_STORE_HOST_ADAPTER_LOCAL_RAM = 0x90,
173	BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM = 0x91,
174	BUSLOGICCOMMAND_STORE_LOCAL_DATA_IN_EEPROM = 0x92,
175	BUSLOGICCOMMAND_UPLOAD_AUTO_SCSI_CODE = 0x94,
176	BUSLOGICCOMMAND_MODIFY_IO_ADDRESS = 0x95,
177	BUSLOGICCOMMAND_SET_CCB_FORMAT = 0x96,
178	BUSLOGICCOMMAND_WRITE_INQUIRY_BUFFER = 0x9a,
179	BUSLOGICCOMMAND_READ_INQUIRY_BUFFER = 0x9b,
180	BUSLOGICCOMMAND_FLASH_ROM_UPLOAD_DOWNLOAD = 0xa7,
181	BUSLOGICCOMMAND_READ_SCAM_DATA = 0xa8,
182	BUSLOGICCOMMAND_WRITE_SCAM_DATA = 0xa9
183	} BUSLOGICCOMMAND;
184
185	#pragma pack(1)
186	/**
187	* Auto SCSI structure which is located
188	* in host adapter RAM and contains several
189	* configuration parameters.
190	*/
191	typedef struct AutoSCSIRam
192	{
193	uint8_t aInternalSignature[2];
194	uint8_t cbInformation;
195	uint8_t aHostAdaptertype[6];
196	uint8_t uReserved1;
197	bool fFloppyEnabled : 1;
198	bool fFloppySecondary : 1;
199	bool fLevelSensitiveInterrupt : 1;
200	unsigned char uReserved2 : 2;
201	unsigned char uSystemRAMAreForBIOS : 3;
202	unsigned char uDMAChannel : 7;
203	bool fDMAAutoConfiguration : 1;
204	unsigned char uIrqChannel : 7;
205	bool fIrqAutoConfiguration : 1;
206	uint8_t uDMATransferRate;
207	uint8_t uSCSIId;
208	bool fLowByteTerminated : 1;
209	bool fParityCheckingEnabled : 1;
210	bool fHighByteTerminated : 1;
211	bool fNoisyCablingEnvironment : 1;
212	bool fFastSynchronousNeogtiation : 1;
213	bool fBusResetEnabled : 1;
214	bool fReserved3 : 1;
215	bool fActiveNegotiationEnabled : 1;
216	uint8_t uBusOnDelay;
217	uint8_t uBusOffDelay;
218	bool fHostAdapterBIOSEnabled : 1;
219	bool fBIOSRedirectionOfInt19 : 1;
220	bool fExtendedTranslation : 1;
221	bool fMapRemovableAsFixed : 1;
222	bool fReserved4 : 1;
223	bool fBIOSSupportsMoreThan2Drives : 1;
224	bool fBIOSInterruptMode : 1;
225	bool fFlopticalSupport : 1;
226	uint16_t u16DeviceEnabledMask;
227	uint16_t u16WidePermittedMask;
228	uint16_t u16FastPermittedMask;
229	uint16_t u16SynchronousPermittedMask;
230	uint16_t u16DisconnectPermittedMask;
231	uint16_t u16SendStartUnitCommandMask;
232	uint16_t u16IgnoreInBIOSScanMask;
233	unsigned char uPCIInterruptPin : 2;
234	unsigned char uHostAdapterIoPortAddress : 2;
235	bool fStrictRoundRobinMode : 1;
236	bool fVesaBusSpeedGreaterThan33MHz : 1;
237	bool fVesaBurstWrite : 1;
238	bool fVesaBurstRead : 1;
239	uint16_t u16UltraPermittedMask;
240	uint32_t uReserved5;
241	uint8_t uReserved6;
242	uint8_t uAutoSCSIMaximumLUN;
243	bool fReserved7 : 1;
244	bool fSCAMDominant : 1;
245	bool fSCAMenabled : 1;
246	bool fSCAMLevel2 : 1;
247	unsigned char uReserved8 : 4;
248	bool fInt13Extension : 1;
249	bool fReserved9 : 1;
250	bool fCDROMBoot : 1;
251	unsigned char uReserved10 : 5;
252	unsigned char uBootTargetId : 4;
253	unsigned char uBootChannel : 4;
254	bool fForceBusDeviceScanningOrder : 1;
255	unsigned char uReserved11 : 7;
256	uint16_t u16NonTaggedToAlternateLunPermittedMask;
257	uint16_t u16RenegotiateSyncAfterCheckConditionMask;
258	uint8_t aReserved12[10];
259	uint8_t aManufacturingDiagnostic[2];
260	uint16_t u16Checksum;
261	} AutoSCSIRam, *PAutoSCSIRam;
262	AssertCompileSize(AutoSCSIRam, 64);
263	#pragma pack()
264
265	/**
266	* The local Ram.
267	*/
268	typedef union HostAdapterLocalRam
269	{
270	/** Byte view. */
271	uint8_t u8View[256];
272	/** Structured view. */
273	struct
274	{
275	/** Offset 0 - 63 is for BIOS. */
276	uint8_t u8Bios[64];
277	/** Auto SCSI structure. */
278	AutoSCSIRam autoSCSIData;
279	} structured;
280	} HostAdapterLocalRam, *PHostAdapterLocalRam;
281	AssertCompileSize(HostAdapterLocalRam, 256);
282
283
284	/** Ugly 24-bit big-endian addressing. */
285	typedef struct
286	{
287	uint8_t hi;
288	uint8_t mid;
289	uint8_t lo;
290	} Addr24, Len24;
291	AssertCompileSize(Addr24, 3);
292
293	#define ADDR_TO_U32(x) (((x).hi << 16) \| ((x).mid << 8) \| (x).lo)
294	#define LEN_TO_U32 ADDR_TO_U32
295	#define U32_TO_ADDR(a, x) do {(a).hi = (x) >> 16; (a).mid = (x) >> 8; (a).lo = (x);} while(0)
296	#define U32_TO_LEN U32_TO_ADDR
297
298	/** @name Compatible ISA base I/O port addresses. Disabled if zero.
299	* @{ */
300	#define NUM_ISA_BASES 8
301	#define MAX_ISA_BASE (NUM_ISA_BASES - 1)
302	#define ISA_BASE_DISABLED 6
303
304	#ifdef IN_RING3
305	static uint16_t const g_aISABases[NUM_ISA_BASES] =
306	{
307	0x330, 0x334, 0x230, 0x234, 0x130, 0x134, 0, 0
308	};
309	#endif
310	/** @} */
311
312	/**
313	* Emulated device types.
314	*/
315	enum BL_DEVICE_TYPE
316	{
317	DEV_BT_958D = 0, /* BusLogic BT-958D, PCI. */
318	DEV_BT_545C = 1, /* BusLogic BT-545C, ISA. */
319	DEV_AHA_1540B = 2 /* Adaptec AHA-1540B, ISA. */
320	};
321
322	/** Pointer to a task state structure. */
323	typedef struct BUSLOGICREQ *PBUSLOGICREQ;
324
325	/**
326	* The shared BusLogic device emulation state.
327	*/
328	typedef struct BUSLOGIC
329	{
330	/** Status register - Readonly. */
331	volatile uint8_t regStatus;
332	/** Interrupt register - Readonly. */
333	volatile uint8_t regInterrupt;
334	/** Geometry register - Readonly. */
335	volatile uint8_t regGeometry;
336	/** Pending (delayed) interrupt. */
337	uint8_t uPendingIntr;
338
339	/** Command code the guest issued. */
340	uint8_t uOperationCode;
341	/** Current position in the command buffer. */
342	uint8_t iParameter;
343	/** Parameters left until the command is complete. */
344	uint8_t cbCommandParametersLeft;
345	/** Buffer for the command parameters the adapter is currently receiving from the guest.
346	* Size of the largest command which is possible. */
347	uint8_t aCommandBuffer[BUSLOGIC_COMMAND_SIZE_MAX]; /* Size of the biggest request. */
348
349	/** Only for LOG_ENABLED builds! */
350	volatile uint32_t cInMailboxesReadyIfLogEnabled;
351
352	/** Position in the buffer we are reading next.
353	* @note aligned on 64 byte boundrary for cache-line mojo. Means IOISABase
354	* is at offset 130. */
355	uint8_t iReply;
356	/** Bytes left until the reply buffer is empty. */
357	uint8_t cbReplyParametersLeft;
358	/** Buffer to store reply data from the controller to the guest. */
359	uint8_t aReplyBuffer[BUSLOGIC_REPLY_SIZE_MAX]; /* Size of the biggest reply. */
360
361	/** ISA I/O port base (disabled if zero). */
362	RTIOPORT IOISABase;
363	/** Default ISA I/O port base in FW-compatible format. */
364	uint8_t uDefaultISABaseCode;
365	/** Emulated device type. */
366	uint8_t uDevType;
367
368	/** Signature index for Adaptec models. */
369	uint8_t uAhaSigIdx;
370
371	/** Whether we are using the RAM or reply buffer. */
372	bool fUseLocalRam;
373
374	/** Flag whether IRQs are enabled. */
375	bool fIRQEnabled;
376	/** Flag whether 24-bit mailboxes are in use (default is 32-bit). */
377	bool fMbxIs24Bit;
378	/** ISA I/O port base (encoded in FW-compatible format). */
379	uint8_t uISABaseCode;
380	/** ISA IRQ, non-zero if in ISA mode. */
381	uint8_t uIsaIrq;
382
383	/** Number of mailboxes the guest set up. */
384	uint32_t cMailbox;
385
386	/** Time when HBA reset was last initiated. */
387	uint64_t u64ResetTime; /*< @todo does this need to be saved? /
388	/** Physical base address of the outgoing mailboxes. */
389	RTGCPHYS GCPhysAddrMailboxOutgoingBase;
390	/** Current outgoing mailbox position. */
391	uint32_t uMailboxOutgoingPositionCurrent;
392	/** Number of mailboxes ready. */
393	volatile uint32_t cMailboxesReady;
394	/** Whether a notification to R3 was sent. */
395	volatile bool fNotificationSent;
396
397	/** Whether strict round robin is enabled. */
398	bool fStrictRoundRobinMode;
399	/** Whether the extended LUN CCB format is enabled for 32 possible logical units. */
400	bool fExtendedLunCCBFormat;
401	bool fAlignment2;
402
403	/** Current incoming mailbox position. */
404	uint32_t uMailboxIncomingPositionCurrent;
405	/** Physical base address of the incoming mailboxes. */
406	RTGCPHYS GCPhysAddrMailboxIncomingBase;
407
408	/** Critical section protecting access to the interrupt status register. */
409	PDMCRITSECT CritSectIntr;
410
411	/** Device presence indicators.
412	* @note Copy of BUSLOGICDEVICE::fPresent accessible from ring-0. */
413	bool afDevicePresent[BUSLOGIC_MAX_DEVICES];
414
415	/** The event semaphore the processing thread waits on. */
416	SUPSEMEVENT hEvtProcess;
417
418	/** ISA compatibility I/O ports. */
419	IOMIOPORTHANDLE hIoPortsIsa;
420	/** BIOS I/O ports for booting, optional. */
421	IOMIOPORTHANDLE hIoPortsBios;
422	/** PCI Region \#0: I/O ports. */
423	IOMIOPORTHANDLE hIoPortsPci;
424	/** PCI Region \#1: MMIO (32 bytes, but probably rounded up to 4KB). */
425	IOMMMIOHANDLE hMmio;
426
427	/** Local RAM for the fetch hostadapter local RAM request.
428	* I don't know how big the buffer really is but the maximum
429	* seems to be 256 bytes because the offset and count field in the command request
430	* are only one byte big.
431	*/
432	HostAdapterLocalRam LocalRam;
433	} BUSLOGIC;
434	/** Pointer to the shared BusLogic device emulation state. */
435	typedef BUSLOGIC *PBUSLOGIC;
436
437
438	/**
439	* The ring-3 BusLogic device emulation state.
440	*
441	* @implements PDMILEDPORTS
442	*/
443	typedef struct BUSLOGICR3
444	{
445	/** The device instance - only for getting our bearings in interface methods. */
446	PPDMDEVINSR3 pDevIns;
447
448	/** Device state for BIOS access. */
449	VBOXSCSI VBoxSCSI;
450
451	/** BusLogic device states. */
452	BUSLOGICDEVICE aDeviceStates[BUSLOGIC_MAX_DEVICES];
453
454	/** The base interface.
455	* @todo use PDMDEVINS::IBase */
456	PDMIBASE IBase;
457	/** Status Port - Leds interface. */
458	PDMILEDPORTS ILeds;
459	/** Partner of ILeds. */
460	R3PTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
461	/** Status LUN: Media Notifys. */
462	R3PTRTYPE(PPDMIMEDIANOTIFY) pMediaNotify;
463
464	/** Indicates that PDMDevHlpAsyncNotificationCompleted should be called when
465	* a port is entering the idle state. */
466	bool volatile fSignalIdle;
467	/** Flag whether the worker thread is sleeping. */
468	volatile bool fWrkThreadSleeping;
469	/** Flag whether a request from the BIOS is pending which the
470	* worker thread needs to process. */
471	volatile bool fBiosReqPending;
472
473	/** Worker thread. */
474	R3PTRTYPE(PPDMTHREAD) pThreadWrk;
475
476	/** Pointer to the array of addresses to redo. */
477	R3PTRTYPE(PRTGCPHYS) paGCPhysAddrCCBRedo;
478	/** Number of addresses the redo array holds. */
479	uint32_t cReqsRedo;
480	} BUSLOGICR3;
481	/** Pointer to the ring-3 BusLogic device emulation state. */
482	typedef BUSLOGICR3 *PBUSLOGICR3;
483
484
485	/**
486	* The ring-0 BusLogic device emulation state.
487	*/
488	typedef struct BUSLOGICR0
489	{
490	uint64_t uUnused;
491	} BUSLOGICR0;
492	/** Pointer to the ring-0 BusLogic device emulation state. */
493	typedef BUSLOGICR0 *PBUSLOGICR0;
494
495
496	/**
497	* The raw-mode BusLogic device emulation state.
498	*/
499	typedef struct BUSLOGICRC
500	{
501	uint64_t uUnused;
502	} BUSLOGICRC;
503	/** Pointer to the raw-mode BusLogic device emulation state. */
504	typedef BUSLOGICRC *PBUSLOGICRC;
505
506
507	/** The current context BusLogic device emulation state. */
508	typedef CTX_SUFF(BUSLOGIC) BUSLOGICCC;
509	/** Pointer to the current context BusLogic device emulation state. */
510	typedef CTX_SUFF(PBUSLOGIC) PBUSLOGICCC;
511
512
513	/** Register offsets in the I/O port space. */
514	#define BUSLOGIC_REGISTER_CONTROL 0 /*< Writeonly /
515	/** Fields for the control register. */
516	# define BL_CTRL_RSBUS RT_BIT(4) /* Reset SCSI Bus. */
517	# define BL_CTRL_RINT RT_BIT(5) /* Reset Interrupt. */
518	# define BL_CTRL_RSOFT RT_BIT(6) /* Soft Reset. */
519	# define BL_CTRL_RHARD RT_BIT(7) /* Hard Reset. */
520
521	#define BUSLOGIC_REGISTER_STATUS 0 /*< Readonly /
522	/** Fields for the status register. */
523	# define BL_STAT_CMDINV RT_BIT(0) /* Command Invalid. */
524	# define BL_STAT_DIRRDY RT_BIT(2) /* Data In Register Ready. */
525	# define BL_STAT_CPRBSY RT_BIT(3) /* Command/Parameter Out Register Busy. */
526	# define BL_STAT_HARDY RT_BIT(4) /* Host Adapter Ready. */
527	# define BL_STAT_INREQ RT_BIT(5) /* Initialization Required. */
528	# define BL_STAT_DFAIL RT_BIT(6) /* Diagnostic Failure. */
529	# define BL_STAT_DACT RT_BIT(7) /* Diagnistic Active. */
530
531	#define BUSLOGIC_REGISTER_COMMAND 1 /*< Writeonly /
532	#define BUSLOGIC_REGISTER_DATAIN 1 /*< Readonly /
533	#define BUSLOGIC_REGISTER_INTERRUPT 2 /*< Readonly /
534	/** Fields for the interrupt register. */
535	# define BL_INTR_IMBL RT_BIT(0) /* Incoming Mailbox Loaded. */
536	# define BL_INTR_OMBR RT_BIT(1) /* Outgoing Mailbox Available. */
537	# define BL_INTR_CMDC RT_BIT(2) /* Command Complete. */
538	# define BL_INTR_RSTS RT_BIT(3) /* SCSI Bus Reset State. */
539	# define BL_INTR_INTV RT_BIT(7) /* Interrupt Valid. */
540
541	#define BUSLOGIC_REGISTER_GEOMETRY 3 /* Readonly */
542	# define BL_GEOM_XLATEN RT_BIT(7) /* Extended geometry translation enabled. */
543
544	/** Structure for the INQUIRE_PCI_HOST_ADAPTER_INFORMATION reply. */
545	typedef struct ReplyInquirePCIHostAdapterInformation
546	{
547	uint8_t IsaIOPort;
548	uint8_t IRQ;
549	unsigned char LowByteTerminated : 1;
550	unsigned char HighByteTerminated : 1;
551	unsigned char uReserved : 2; /* Reserved. */
552	unsigned char JP1 : 1; /* Whatever that means. */
553	unsigned char JP2 : 1; /* Whatever that means. */
554	unsigned char JP3 : 1; /* Whatever that means. */
555	/** Whether the provided info is valid. */
556	unsigned char InformationIsValid: 1;
557	uint8_t uReserved2; /* Reserved. */
558	} ReplyInquirePCIHostAdapterInformation, *PReplyInquirePCIHostAdapterInformation;
559	AssertCompileSize(ReplyInquirePCIHostAdapterInformation, 4);
560
561	/** Structure for the INQUIRE_CONFIGURATION reply. */
562	typedef struct ReplyInquireConfiguration
563	{
564	unsigned char uReserved1 : 5;
565	bool fDmaChannel5 : 1;
566	bool fDmaChannel6 : 1;
567	bool fDmaChannel7 : 1;
568	bool fIrqChannel9 : 1;
569	bool fIrqChannel10 : 1;
570	bool fIrqChannel11 : 1;
571	bool fIrqChannel12 : 1;
572	unsigned char uReserved2 : 1;
573	bool fIrqChannel14 : 1;
574	bool fIrqChannel15 : 1;
575	unsigned char uReserved3 : 1;
576	unsigned char uHostAdapterId : 4;
577	unsigned char uReserved4 : 4;
578	} ReplyInquireConfiguration, *PReplyInquireConfiguration;
579	AssertCompileSize(ReplyInquireConfiguration, 3);
580
581	/** Structure for the INQUIRE_SETUP_INFORMATION reply. */
582	typedef struct ReplyInquireSetupInformationSynchronousValue
583	{
584	unsigned char uOffset : 4;
585	unsigned char uTransferPeriod : 3;
586	bool fSynchronous : 1;
587	}ReplyInquireSetupInformationSynchronousValue, *PReplyInquireSetupInformationSynchronousValue;
588	AssertCompileSize(ReplyInquireSetupInformationSynchronousValue, 1);
589
590	typedef struct ReplyInquireSetupInformation
591	{
592	bool fSynchronousInitiationEnabled : 1;
593	bool fParityCheckingEnabled : 1;
594	unsigned char uReserved1 : 6;
595	uint8_t uBusTransferRate;
596	uint8_t uPreemptTimeOnBus;
597	uint8_t uTimeOffBus;
598	uint8_t cMailbox;
599	Addr24 MailboxAddress;
600	ReplyInquireSetupInformationSynchronousValue SynchronousValuesId0To7[8];
601	uint8_t uDisconnectPermittedId0To7;
602	uint8_t uSignature;
603	uint8_t uCharacterD;
604	uint8_t uHostBusType;
605	uint8_t uWideTransferPermittedId0To7;
606	uint8_t uWideTransfersActiveId0To7;
607	ReplyInquireSetupInformationSynchronousValue SynchronousValuesId8To15[8];
608	uint8_t uDisconnectPermittedId8To15;
609	uint8_t uReserved2;
610	uint8_t uWideTransferPermittedId8To15;
611	uint8_t uWideTransfersActiveId8To15;
612	} ReplyInquireSetupInformation, *PReplyInquireSetupInformation;
613	AssertCompileSize(ReplyInquireSetupInformation, 34);
614
615	/** Structure for the INQUIRE_EXTENDED_SETUP_INFORMATION. */
616	#pragma pack(1)
617	typedef struct ReplyInquireExtendedSetupInformation
618	{
619	uint8_t uBusType;
620	uint8_t uBiosAddress;
621	uint16_t u16ScatterGatherLimit;
622	uint8_t cMailbox;
623	uint32_t uMailboxAddressBase;
624	unsigned char uReserved1 : 2;
625	bool fFastEISA : 1;
626	unsigned char uReserved2 : 3;
627	bool fLevelSensitiveInterrupt : 1;
628	unsigned char uReserved3 : 1;
629	unsigned char aFirmwareRevision[3];
630	bool fHostWideSCSI : 1;
631	bool fHostDifferentialSCSI : 1;
632	bool fHostSupportsSCAM : 1;
633	bool fHostUltraSCSI : 1;
634	bool fHostSmartTermination : 1;
635	unsigned char uReserved4 : 3;
636	} ReplyInquireExtendedSetupInformation, *PReplyInquireExtendedSetupInformation;
637	AssertCompileSize(ReplyInquireExtendedSetupInformation, 14);
638	#pragma pack()
639
640	/** Structure for the INITIALIZE EXTENDED MAILBOX request. */
641	#pragma pack(1)
642	typedef struct RequestInitializeExtendedMailbox
643	{
644	/** Number of mailboxes in guest memory. */
645	uint8_t cMailbox;
646	/** Physical address of the first mailbox. */
647	uint32_t uMailboxBaseAddress;
648	} RequestInitializeExtendedMailbox, *PRequestInitializeExtendedMailbox;
649	AssertCompileSize(RequestInitializeExtendedMailbox, 5);
650	#pragma pack()
651
652	/** Structure for the INITIALIZE MAILBOX request. */
653	typedef struct
654	{
655	/** Number of mailboxes to set up. */
656	uint8_t cMailbox;
657	/** Physical address of the first mailbox. */
658	Addr24 aMailboxBaseAddr;
659	} RequestInitMbx, *PRequestInitMbx;
660	AssertCompileSize(RequestInitMbx, 4);
661
662	/**
663	* Structure of a mailbox in guest memory.
664	* The incoming and outgoing mailbox have the same size
665	* but the incoming one has some more fields defined which
666	* are marked as reserved in the outgoing one.
667	* The last field is also different from the type.
668	* For outgoing mailboxes it is the action and
669	* for incoming ones the completion status code for the task.
670	* We use one structure for both types.
671	*/
672	typedef struct Mailbox32
673	{
674	/** Physical address of the CCB structure in the guest memory. */
675	uint32_t u32PhysAddrCCB;
676	/** Type specific data. */
677	union
678	{
679	/** For outgoing mailboxes. */
680	struct
681	{
682	/** Reserved */
683	uint8_t uReserved[3];
684	/** Action code. */
685	uint8_t uActionCode;
686	} out;
687	/** For incoming mailboxes. */
688	struct
689	{
690	/** The host adapter status after finishing the request. */
691	uint8_t uHostAdapterStatus;
692	/** The status of the device which executed the request after executing it. */
693	uint8_t uTargetDeviceStatus;
694	/** Reserved. */
695	uint8_t uReserved;
696	/** The completion status code of the request. */
697	uint8_t uCompletionCode;
698	} in;
699	} u;
700	} Mailbox32, *PMailbox32;
701	AssertCompileSize(Mailbox32, 8);
702
703	/** Old style 24-bit mailbox entry. */
704	typedef struct Mailbox24
705	{
706	/** Mailbox command (incoming) or state (outgoing). */
707	uint8_t uCmdState;
708	/** Physical address of the CCB structure in the guest memory. */
709	Addr24 aPhysAddrCCB;
710	} Mailbox24, *PMailbox24;
711	AssertCompileSize(Mailbox24, 4);
712
713	/**
714	* Action codes for outgoing mailboxes.
715	*/
716	enum BUSLOGIC_MAILBOX_OUTGOING_ACTION
717	{
718	BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE = 0x00,
719	BUSLOGIC_MAILBOX_OUTGOING_ACTION_START_COMMAND = 0x01,
720	BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND = 0x02
721	};
722
723	/**
724	* Completion codes for incoming mailboxes.
725	*/
726	enum BUSLOGIC_MAILBOX_INCOMING_COMPLETION
727	{
728	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_FREE = 0x00,
729	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITHOUT_ERROR = 0x01,
730	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED = 0x02,
731	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND = 0x03,
732	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR = 0x04,
733	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_INVALID_CCB = 0x05
734	};
735
736	/**
737	* Host adapter status for incoming mailboxes.
738	*/
739	enum BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS
740	{
741	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED = 0x00,
742	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CMD_COMPLETED = 0x0a,
743	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CMD_COMPLETED_WITH_FLAG = 0x0b,
744	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_DATA_UNDERUN = 0x0c,
745	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT = 0x11,
746	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_DATA_OVERRUN = 0x12,
747	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_UNEXPECTED_BUS_FREE = 0x13,
748	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_BUS_PHASE_REQUESTED = 0x14,
749	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_OUTGOING_MAILBOX_ACTION_CODE = 0x15,
750	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_OPERATION_CODE = 0x16,
751	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CCB_HAS_INVALID_LUN = 0x17,
752	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER = 0x1a,
753	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_AUTO_REQUEST_SENSE_FAILED = 0x1b,
754	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TAGGED_QUEUING_MESSAGE_REJECTED = 0x1c,
755	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_UNSUPPORTED_MESSAGE_RECEIVED = 0x1d,
756	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_HARDWARE_FAILED = 0x20,
757	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TARGET_FAILED_RESPONSE_TO_ATN = 0x21,
758	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_ASSERTED_RST = 0x22,
759	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_OTHER_DEVICE_ASSERTED_RST = 0x23,
760	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TARGET_DEVICE_RECONNECTED_IMPROPERLY = 0x24,
761	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_ASSERTED_BUS_DEVICE_RESET = 0x25,
762	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED = 0x26,
763	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_SOFTWARE_ERROR = 0x27,
764	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_HARDWARE_TIMEOUT_ERROR = 0x30,
765	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_PARITY_ERROR_DETECTED = 0x34
766	};
767
768	/**
769	* Device status codes for incoming mailboxes.
770	*/
771	enum BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS
772	{
773	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD = 0x00,
774	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_CHECK_CONDITION = 0x02,
775	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_DEVICE_BUSY = 0x08
776	};
777
778	/**
779	* Opcode types for CCB.
780	*/
781	enum BUSLOGIC_CCB_OPCODE
782	{
783	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB = 0x00,
784	BUSLOGIC_CCB_OPCODE_TARGET_CCB = 0x01,
785	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER = 0x02,
786	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH = 0x03,
787	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER = 0x04,
788	BUSLOGIC_CCB_OPCODE_BUS_DEVICE_RESET = 0x81
789	};
790
791	/**
792	* Data transfer direction.
793	*/
794	enum BUSLOGIC_CCB_DIRECTION
795	{
796	BUSLOGIC_CCB_DIRECTION_UNKNOWN = 0x00,
797	BUSLOGIC_CCB_DIRECTION_IN = 0x01,
798	BUSLOGIC_CCB_DIRECTION_OUT = 0x02,
799	BUSLOGIC_CCB_DIRECTION_NO_DATA = 0x03
800	};
801
802	/**
803	* The command control block for a SCSI request.
804	*/
805	typedef struct CCB32
806	{
807	/** Opcode. */
808	uint8_t uOpcode;
809	/** Reserved */
810	unsigned char uReserved1 : 3;
811	/** Data direction for the request. */
812	unsigned char uDataDirection : 2;
813	/** Whether the request is tag queued. */
814	bool fTagQueued : 1;
815	/** Queue tag mode. */
816	unsigned char uQueueTag : 2;
817	/** Length of the SCSI CDB. */
818	uint8_t cbCDB;
819	/** Sense data length. */
820	uint8_t cbSenseData;
821	/** Data length. */
822	uint32_t cbData;
823	/** Data pointer.
824	* This points to the data region or a scatter gather list based on the opcode.
825	*/
826	uint32_t u32PhysAddrData;
827	/** Reserved. */
828	uint8_t uReserved2[2];
829	/** Host adapter status. */
830	uint8_t uHostAdapterStatus;
831	/** Device adapter status. */
832	uint8_t uDeviceStatus;
833	/** The device the request is sent to. */
834	uint8_t uTargetId;
835	/*The LUN in the device. /
836	unsigned char uLogicalUnit : 5;
837	/** Legacy tag. */
838	bool fLegacyTagEnable : 1;
839	/** Legacy queue tag. */
840	unsigned char uLegacyQueueTag : 2;
841	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
842	uint8_t abCDB[12];
843	/** Reserved. */
844	uint8_t uReserved3[6];
845	/** Sense data pointer. */
846	uint32_t u32PhysAddrSenseData;
847	} CCB32, *PCCB32;
848	AssertCompileSize(CCB32, 40);
849
850
851	/**
852	* The 24-bit command control block.
853	*/
854	typedef struct CCB24
855	{
856	/** Opcode. */
857	uint8_t uOpcode;
858	/** The LUN in the device. */
859	unsigned char uLogicalUnit : 3;
860	/** Data direction for the request. */
861	unsigned char uDataDirection : 2;
862	/** The target device ID. */
863	unsigned char uTargetId : 3;
864	/** Length of the SCSI CDB. */
865	uint8_t cbCDB;
866	/** Sense data length. */
867	uint8_t cbSenseData;
868	/** Data length. */
869	Len24 acbData;
870	/** Data pointer.
871	* This points to the data region or a scatter gather list based on the opc
872	*/
873	Addr24 aPhysAddrData;
874	/** Pointer to next CCB for linked commands. */
875	Addr24 aPhysAddrLink;
876	/** Command linking identifier. */
877	uint8_t uLinkId;
878	/** Host adapter status. */
879	uint8_t uHostAdapterStatus;
880	/** Device adapter status. */
881	uint8_t uDeviceStatus;
882	/** Two unused bytes. */
883	uint8_t aReserved[2];
884	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
885	uint8_t abCDB[12];
886	} CCB24, *PCCB24;
887	AssertCompileSize(CCB24, 30);
888
889	/**
890	* The common 24-bit/32-bit command control block. The 32-bit CCB is laid out
891	* such that many fields are in the same location as in the older 24-bit CCB.
892	*/
893	typedef struct CCBC
894	{
895	/** Opcode. */
896	uint8_t uOpcode;
897	/** The LUN in the device. */
898	unsigned char uPad1 : 3;
899	/** Data direction for the request. */
900	unsigned char uDataDirection : 2;
901	/** The target device ID. */
902	unsigned char uPad2 : 3;
903	/** Length of the SCSI CDB. */
904	uint8_t cbCDB;
905	/** Sense data length. */
906	uint8_t cbSenseData;
907	uint8_t aPad1[10];
908	/** Host adapter status. */
909	uint8_t uHostAdapterStatus;
910	/** Device adapter status. */
911	uint8_t uDeviceStatus;
912	uint8_t aPad2[2];
913	/** The SCSI CDB (up to 12 bytes). */
914	uint8_t abCDB[12];
915	} CCBC, *PCCBC;
916	AssertCompileSize(CCBC, 30);
917
918	/* Make sure that the 24-bit/32-bit/common CCB offsets match. */
919	AssertCompileMemberOffset(CCBC, cbCDB, 2);
920	AssertCompileMemberOffset(CCB24, cbCDB, 2);
921	AssertCompileMemberOffset(CCB32, cbCDB, 2);
922	AssertCompileMemberOffset(CCBC, uHostAdapterStatus, 14);
923	AssertCompileMemberOffset(CCB24, uHostAdapterStatus, 14);
924	AssertCompileMemberOffset(CCB32, uHostAdapterStatus, 14);
925	AssertCompileMemberOffset(CCBC, abCDB, 18);
926	AssertCompileMemberOffset(CCB24, abCDB, 18);
927	AssertCompileMemberOffset(CCB32, abCDB, 18);
928
929	/** A union of all CCB types (24-bit/32-bit/common). */
930	typedef union CCBU
931	{
932	CCB32 n; /*< New 32-bit CCB. /
933	CCB24 o; /*< Old 24-bit CCB. /
934	CCBC c; /*< Common CCB subset. /
935	} CCBU, *PCCBU;
936
937	/** 32-bit scatter-gather list entry. */
938	typedef struct SGE32
939	{
940	uint32_t cbSegment;
941	uint32_t u32PhysAddrSegmentBase;
942	} SGE32, *PSGE32;
943	AssertCompileSize(SGE32, 8);
944
945	/** 24-bit scatter-gather list entry. */
946	typedef struct SGE24
947	{
948	Len24 acbSegment;
949	Addr24 aPhysAddrSegmentBase;
950	} SGE24, *PSGE24;
951	AssertCompileSize(SGE24, 6);
952
953	/**
954	* The structure for the "Execute SCSI Command" command.
955	*/
956	typedef struct ESCMD
957	{
958	/** Data length. */
959	uint32_t cbData;
960	/** Data pointer. */
961	uint32_t u32PhysAddrData;
962	/** The device the request is sent to. */
963	uint8_t uTargetId;
964	/** The LUN in the device. */
965	uint8_t uLogicalUnit;
966	/** Reserved */
967	unsigned char uReserved1 : 3;
968	/** Data direction for the request. */
969	unsigned char uDataDirection : 2;
970	/** Reserved */
971	unsigned char uReserved2 : 3;
972	/** Length of the SCSI CDB. */
973	uint8_t cbCDB;
974	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
975	uint8_t abCDB[12];
976	} ESCMD, *PESCMD;
977	AssertCompileSize(ESCMD, 24);
978
979	/**
980	* Task state for a CCB request.
981	*/
982	typedef struct BUSLOGICREQ
983	{
984	/** PDM extended media interface I/O request hande. */
985	PDMMEDIAEXIOREQ hIoReq;
986	/** Device this task is assigned to. */
987	PBUSLOGICDEVICE pTargetDevice;
988	/** The command control block from the guest. */
989	CCBU CCBGuest;
990	/** Guest physical address of th CCB. */
991	RTGCPHYS GCPhysAddrCCB;
992	/** Pointer to the R3 sense buffer. */
993	uint8_t *pbSenseBuffer;
994	/** Flag whether this is a request from the BIOS. */
995	bool fBIOS;
996	/** 24-bit request flag (default is 32-bit). */
997	bool fIs24Bit;
998	/** SCSI status code. */
999	uint8_t u8ScsiSts;
1000	} BUSLOGICREQ;
1001
1002	#ifdef IN_RING3
1003	/**
1004	* Memory buffer callback.
1005	*
1006	* @returns nothing.
1007	* @param pDevIns The device instance.
1008	* @param pThis Pointer to the shared BusLogic instance data.
1009	* @param GCPhys The guest physical address of the memory buffer.
1010	* @param pSgBuf The pointer to the host R3 S/G buffer.
1011	* @param cbCopy How many bytes to copy between the two buffers.
1012	* @param pcbSkip Initially contains the amount of bytes to skip
1013	* starting from the guest physical address before
1014	* accessing the S/G buffer and start copying data.
1015	* On return this contains the remaining amount if
1016	* cbCopy < *pcbSkip or 0 otherwise.
1017	*/
1018	typedef DECLCALLBACK(void) FNBUSLOGICR3MEMCOPYCALLBACK(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1019	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip);
1020	/** Pointer to a memory copy buffer callback. */
1021	typedef FNBUSLOGICR3MEMCOPYCALLBACK *PFNBUSLOGICR3MEMCOPYCALLBACK;
1022	#endif
1023
1024	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
1025
1026
1027	/*********************************************************************************************************************************
1028	* Internal Functions *
1029	*********************************************************************************************************************************/
1030	#ifdef IN_RING3
1031	static int buslogicR3RegisterISARange(PPDMDEVINS pDevIns, PBUSLOGIC pThis, uint8_t uBaseCode);
1032	#endif
1033
1034
1035	/**
1036	* Assert IRQ line of the BusLogic adapter. Rather than using
1037	* the more modern method of the guest explicitly only clearing
1038	* the interrupt causes it handled, BusLogic never reports all
1039	* interrupts at once. Instead, new interrupts are postponed if
1040	* an interrupt of a different type is still pending.
1041	*
1042	* @returns nothing.
1043	* @param pDevIns The device instance.
1044	* @param pThis Pointer to the shared BusLogic instance data.
1045	* @param fSuppressIrq Flag to suppress IRQ generation regardless of fIRQEnabled
1046	* @param uIrqType Type of interrupt being generated.
1047	*/
1048	static void buslogicSetInterrupt(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fSuppressIrq, uint8_t uIrqType)
1049	{
1050	LogFlowFunc(("pThis=%#p, setting %#02x (current %#02x, pending %#02x)\n",
1051	pThis, uIrqType, pThis->regInterrupt, pThis->uPendingIntr));
1052
1053	/* A CMDC interrupt overrides other pending interrupts. The documentation may claim
1054	* otherwise, but a real BT-958 replaces a pending IMBL with a CMDC; the IMBL simply
1055	* vanishes. However, if there's a CMDC already active, another CMDC is latched and
1056	* reported once the first CMDC is cleared.
1057	*/
1058	if (uIrqType & BL_INTR_CMDC)
1059	{
1060	Assert(uIrqType == BL_INTR_CMDC);
1061	if ((pThis->regInterrupt & BL_INTR_INTV) && !(pThis->regInterrupt & BL_INTR_CMDC))
1062	Log(("CMDC overriding pending interrupt! (was %02x)\n", pThis->regInterrupt));
1063	if (!(pThis->regInterrupt & BL_INTR_CMDC))
1064	pThis->regInterrupt \|= uIrqType \| BL_INTR_INTV; /* Report now. */
1065	else
1066	pThis->uPendingIntr \|= uIrqType; /* Report later. */
1067	}
1068	else if (uIrqType & (BL_INTR_IMBL \| BL_INTR_OMBR))
1069	{
1070	/* If the CMDC interrupt is pending, store IMBL/OMBR for later. Note that IMBL
1071	* and OMBR can be reported together even if an interrupt of the other type is
1072	* already pending.
1073	*/
1074	if (!(pThis->regInterrupt & BL_INTR_CMDC))
1075	pThis->regInterrupt \|= uIrqType \| BL_INTR_INTV; /* Report now. */
1076	else
1077	pThis->uPendingIntr \|= uIrqType; /* Report later. */
1078	}
1079	else /* We do not expect to see BL_INTR_RSTS at this point. */
1080	AssertMsgFailed(("Invalid interrupt state (unknown interrupt cause)!\n"));
1081	AssertMsg(pThis->regInterrupt, ("Invalid interrupt state (interrupt not set)!\n"));
1082	AssertMsg(pThis->regInterrupt != BL_INTR_INTV, ("Invalid interrupt state (set but no cause)!\n"));
1083
1084	if (pThis->fIRQEnabled && !fSuppressIrq)
1085	{
1086	if (!pThis->uIsaIrq)
1087	PDMDevHlpPCISetIrq(pDevIns, 0, 1);
1088	else
1089	PDMDevHlpISASetIrq(pDevIns, pThis->uIsaIrq, 1);
1090	}
1091	}
1092
1093	/**
1094	* Deasserts the interrupt line of the BusLogic adapter.
1095	*
1096	* @returns nothing.
1097	* @param pDevIns The device instance.
1098	* @param pThis Pointer to the shared BusLogic instance data.
1099	*/
1100	static void buslogicClearInterrupt(PPDMDEVINS pDevIns, PBUSLOGIC pThis)
1101	{
1102	LogFlowFunc(("pThis=%#p, clearing %#02x (pending %#02x)\n",
1103	pThis, pThis->regInterrupt, pThis->uPendingIntr));
1104	pThis->regInterrupt = 0;
1105	pThis->regStatus &= ~BL_STAT_CMDINV;
1106	if (!pThis->uIsaIrq)
1107	PDMDevHlpPCISetIrq(pDevIns, 0, 0);
1108	else
1109	PDMDevHlpISASetIrq(pDevIns, pThis->uIsaIrq, 0);
1110	/* If there's another pending interrupt, report it now. */
1111	if (pThis->uPendingIntr)
1112	{
1113	buslogicSetInterrupt(pDevIns, pThis, false, pThis->uPendingIntr);
1114	pThis->uPendingIntr = 0;
1115	}
1116	}
1117
1118	#if defined(IN_RING3)
1119
1120	/**
1121	* Advances the mailbox pointer to the next slot.
1122	*
1123	* @returns nothing.
1124	* @param pThis Pointer to the shared BusLogic instance data.
1125	*/
1126	DECLINLINE(void) buslogicR3OutgoingMailboxAdvance(PBUSLOGIC pThis)
1127	{
1128	pThis->uMailboxOutgoingPositionCurrent = (pThis->uMailboxOutgoingPositionCurrent + 1) % pThis->cMailbox;
1129	}
1130
1131	/**
1132	* Initialize local RAM of host adapter with default values.
1133	*
1134	* @returns nothing.
1135	* @param pThis Pointer to the shared BusLogic instance data.
1136	*/
1137	static void buslogicR3InitializeLocalRam(PBUSLOGIC pThis)
1138	{
1139	/*
1140	* These values are mostly from what I think is right
1141	* looking at the dmesg output from a Linux guest inside
1142	* a VMware server VM.
1143	*
1144	* So they don't have to be right :)
1145	*/
1146	memset(pThis->LocalRam.u8View, 0, sizeof(HostAdapterLocalRam));
1147	pThis->LocalRam.structured.autoSCSIData.fLevelSensitiveInterrupt = true;
1148	pThis->LocalRam.structured.autoSCSIData.fParityCheckingEnabled = true;
1149	pThis->LocalRam.structured.autoSCSIData.fExtendedTranslation = true; /* Same as in geometry register. */
1150	pThis->LocalRam.structured.autoSCSIData.u16DeviceEnabledMask = UINT16_MAX; /* All enabled. Maybe mask out non present devices? */
1151	pThis->LocalRam.structured.autoSCSIData.u16WidePermittedMask = UINT16_MAX;
1152	pThis->LocalRam.structured.autoSCSIData.u16FastPermittedMask = UINT16_MAX;
1153	pThis->LocalRam.structured.autoSCSIData.u16SynchronousPermittedMask = UINT16_MAX;
1154	pThis->LocalRam.structured.autoSCSIData.u16DisconnectPermittedMask = UINT16_MAX;
1155	pThis->LocalRam.structured.autoSCSIData.fStrictRoundRobinMode = pThis->fStrictRoundRobinMode;
1156	pThis->LocalRam.structured.autoSCSIData.u16UltraPermittedMask = UINT16_MAX;
1157	pThis->LocalRam.structured.autoSCSIData.uSCSIId = 7;
1158	pThis->LocalRam.structured.autoSCSIData.uHostAdapterIoPortAddress = pThis->uDefaultISABaseCode == ISA_BASE_DISABLED ? 2 : pThis->uDefaultISABaseCode;
1159	/** @todo calculate checksum? */
1160	}
1161
1162	/**
1163	* Do a hardware reset of the buslogic adapter.
1164	*
1165	* @returns VBox status code.
1166	* @param pDevIns The device instance.
1167	* @param pThis Pointer to the shared BusLogic instance data.
1168	* @param pThisCC Pointer to the ring-3 BusLogic instance data.
1169	* @param fResetIO Flag determining whether ISA I/O should be reset.
1170	*/
1171	static int buslogicR3HwReset(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, bool fResetIO)
1172	{
1173	LogFlowFunc(("pThis=%#p\n", pThis));
1174
1175	/* Reset registers to default values. */
1176	pThis->regStatus = BL_STAT_HARDY \| BL_STAT_INREQ;
1177	pThis->regGeometry = BL_GEOM_XLATEN;
1178	pThis->uOperationCode = 0xff; /* No command executing. */
1179	pThis->iParameter = 0;
1180	pThis->cbCommandParametersLeft = 0;
1181	pThis->fIRQEnabled = true;
1182	pThis->fStrictRoundRobinMode = false;
1183	pThis->fExtendedLunCCBFormat = false;
1184	pThis->uMailboxOutgoingPositionCurrent = 0;
1185	pThis->uMailboxIncomingPositionCurrent = 0;
1186	pThis->uAhaSigIdx = 0;
1187
1188	/* Clear any active/pending interrupts. */
1189	pThis->uPendingIntr = 0;
1190	buslogicClearInterrupt(pDevIns, pThis);
1191
1192	/* Guest-initiated HBA reset does not affect ISA port I/O. */
1193	if (fResetIO)
1194	buslogicR3RegisterISARange(pDevIns, pThis, pThis->uDefaultISABaseCode);
1195	buslogicR3InitializeLocalRam(pThis);
1196	vboxscsiHwReset(&pThisCC->VBoxSCSI);
1197
1198	return VINF_SUCCESS;
1199	}
1200
1201	#endif /* IN_RING3 */
1202
1203	/**
1204	* Resets the command state machine for the next command and notifies the guest.
1205	* Note that suppressing CMDC also suppresses the interrupt, but not vice versa.
1206	*
1207	* @returns nothing.
1208	* @param pDevIns The device instance.
1209	* @param pThis Pointer to the shared BusLogic instance data.
1210	* @param fSuppressIrq Flag to suppress IRQ generation regardless of current state
1211	* @param fSuppressCMDC Flag to suppress command completion status as well
1212	*/
1213	static void buslogicCommandComplete(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fSuppressIrq, bool fSuppressCMDC)
1214	{
1215	LogFlowFunc(("pThis=%#p\n", pThis));
1216	Assert(pThis->uOperationCode != BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND);
1217
1218	pThis->fUseLocalRam = false;
1219	pThis->regStatus \|= BL_STAT_HARDY;
1220	pThis->regStatus &= ~BL_STAT_DIRRDY;
1221	pThis->iReply = 0;
1222
1223	/* Some commands do not set CMDC when successful. */
1224	if (!fSuppressCMDC)
1225	{
1226	/* Notify that the command is complete. */
1227	buslogicSetInterrupt(pDevIns, pThis, fSuppressIrq, BL_INTR_CMDC);
1228	}
1229
1230	pThis->uOperationCode = 0xff;
1231	pThis->iParameter = 0;
1232	}
1233
1234	/**
1235	* Memory write helper to handle PCI/ISA differences.
1236	*
1237	* @returns nothing.
1238	* @param pDevIns The device instance.
1239	* @param pThis Pointer to the shared BusLogic instance data.
1240	* @param GCPhys Guest physical memory address
1241	* @param pvBuf Host side buffer address
1242	* @param cbWrite Number of bytes to write
1243	*/
1244	static void blPhysWrite(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
1245	{
1246	if (!pThis->uIsaIrq)
1247	PDMDevHlpPCIPhysWrite(pDevIns, GCPhys, pvBuf, cbWrite);
1248	else
1249	PDMDevHlpPhysWrite(pDevIns, GCPhys, pvBuf, cbWrite);
1250	}
1251
1252	#if defined(IN_RING3)
1253
1254	/**
1255	* Initiates a hard reset which was issued from the guest.
1256	*
1257	* @returns nothing
1258	* @param pDevIns The device instance.
1259	* @param pThis Pointer to the shared BusLogic instance data.
1260	* @param pThisCC Pointer to the ring-3 BusLogic instance data.
1261	* @param fHardReset Flag initiating a hard (vs. soft) reset.
1262	*/
1263	static void buslogicR3InitiateReset(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, bool fHardReset)
1264	{
1265	LogFlowFunc(("pThis=%#p fHardReset=%d\n", pThis, fHardReset));
1266
1267	buslogicR3HwReset(pDevIns, pThis, pThisCC, false);
1268
1269	if (fHardReset)
1270	{
1271	/* Set the diagnostic active bit in the status register and clear the ready state. */
1272	pThis->regStatus \|= BL_STAT_DACT;
1273	pThis->regStatus &= ~BL_STAT_HARDY;
1274
1275	/* Remember when the guest initiated a reset (after we're done resetting). */
1276	pThis->u64ResetTime = PDMDevHlpTMTimeVirtGetNano(pDevIns);
1277	}
1278	}
1279
1280
1281	/**
1282	* Send a mailbox with set status codes to the guest.
1283	*
1284	* @returns nothing.
1285	* @param pDevIns The device instance.
1286	* @param pThis Pointer to the shared BusLogic instance data.
1287	* @param GCPhysAddrCCB The physical guest address of the CCB the mailbox is for.
1288	* @param pCCBGuest The command control block.
1289	* @param uHostAdapterStatus The host adapter status code to set.
1290	* @param uDeviceStatus The target device status to set.
1291	* @param uMailboxCompletionCode Completion status code to set in the mailbox.
1292	*/
1293	static void buslogicR3SendIncomingMailbox(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhysAddrCCB,
1294	PCCBU pCCBGuest, uint8_t uHostAdapterStatus,
1295	uint8_t uDeviceStatus, uint8_t uMailboxCompletionCode)
1296	{
1297	Mailbox32 MbxIn;
1298
1299	MbxIn.u32PhysAddrCCB = (uint32_t)GCPhysAddrCCB;
1300	MbxIn.u.in.uHostAdapterStatus = uHostAdapterStatus;
1301	MbxIn.u.in.uTargetDeviceStatus = uDeviceStatus;
1302	MbxIn.u.in.uCompletionCode = uMailboxCompletionCode;
1303
1304	int rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSectIntr, VINF_SUCCESS);
1305	AssertRC(rc);
1306
1307	RTGCPHYS GCPhysAddrMailboxIncoming = pThis->GCPhysAddrMailboxIncomingBase
1308	+ ( pThis->uMailboxIncomingPositionCurrent
1309	* (pThis->fMbxIs24Bit ? sizeof(Mailbox24) : sizeof(Mailbox32)) );
1310
1311	if (uMailboxCompletionCode != BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND)
1312	{
1313	LogFlowFunc(("Completing CCB %RGp hstat=%u, dstat=%u, outgoing mailbox at %RGp\n", GCPhysAddrCCB,
1314	uHostAdapterStatus, uDeviceStatus, GCPhysAddrMailboxIncoming));
1315
1316	/* Update CCB. */
1317	pCCBGuest->c.uHostAdapterStatus = uHostAdapterStatus;
1318	pCCBGuest->c.uDeviceStatus = uDeviceStatus;
1319	/* Rewrite CCB up to the CDB; perhaps more than necessary. */
1320	blPhysWrite(pDevIns, pThis, GCPhysAddrCCB, pCCBGuest, RT_UOFFSETOF(CCBC, abCDB));
1321	}
1322
1323	# ifdef RT_STRICT
1324	uint8_t uCode;
1325	unsigned uCodeOffs = pThis->fMbxIs24Bit ? RT_OFFSETOF(Mailbox24, uCmdState) : RT_OFFSETOF(Mailbox32, u.out.uActionCode);
1326	PDMDevHlpPhysRead(pDevIns, GCPhysAddrMailboxIncoming + uCodeOffs, &uCode, sizeof(uCode));
1327	Assert(uCode == BUSLOGIC_MAILBOX_INCOMING_COMPLETION_FREE);
1328	# endif
1329
1330	/* Update mailbox. */
1331	if (pThis->fMbxIs24Bit)
1332	{
1333	Mailbox24 Mbx24;
1334
1335	Mbx24.uCmdState = MbxIn.u.in.uCompletionCode;
1336	U32_TO_ADDR(Mbx24.aPhysAddrCCB, MbxIn.u32PhysAddrCCB);
1337	Log(("24-bit mailbox: completion code=%u, CCB at %RGp\n", Mbx24.uCmdState, (RTGCPHYS)ADDR_TO_U32(Mbx24.aPhysAddrCCB)));
1338	blPhysWrite(pDevIns, pThis, GCPhysAddrMailboxIncoming, &Mbx24, sizeof(Mailbox24));
1339	}
1340	else
1341	{
1342	Log(("32-bit mailbox: completion code=%u, CCB at %RGp\n", MbxIn.u.in.uCompletionCode, GCPhysAddrCCB));
1343	blPhysWrite(pDevIns, pThis, GCPhysAddrMailboxIncoming, &MbxIn, sizeof(Mailbox32));
1344	}
1345
1346	/* Advance to next mailbox position. */
1347	pThis->uMailboxIncomingPositionCurrent++;
1348	if (pThis->uMailboxIncomingPositionCurrent >= pThis->cMailbox)
1349	pThis->uMailboxIncomingPositionCurrent = 0;
1350
1351	# ifdef LOG_ENABLED
1352	ASMAtomicIncU32(&pThis->cInMailboxesReadyIfLogEnabled);
1353	# endif
1354
1355	buslogicSetInterrupt(pDevIns, pThis, false, BL_INTR_IMBL);
1356
1357	PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSectIntr);
1358	}
1359
1360	# ifdef LOG_ENABLED
1361
1362	/**
1363	* Dumps the content of a mailbox for debugging purposes.
1364	*
1365	* @return nothing
1366	* @param pMailbox The mailbox to dump.
1367	* @param fOutgoing true if dumping the outgoing state.
1368	* false if dumping the incoming state.
1369	*/
1370	static void buslogicR3DumpMailboxInfo(PMailbox32 pMailbox, bool fOutgoing)
1371	{
1372	Log(("%s: Dump for %s mailbox:\n", __FUNCTION__, fOutgoing ? "outgoing" : "incoming"));
1373	Log(("%s: u32PhysAddrCCB=%#x\n", __FUNCTION__, pMailbox->u32PhysAddrCCB));
1374	if (fOutgoing)
1375	{
1376	Log(("%s: uActionCode=%u\n", __FUNCTION__, pMailbox->u.out.uActionCode));
1377	}
1378	else
1379	{
1380	Log(("%s: uHostAdapterStatus=%u\n", __FUNCTION__, pMailbox->u.in.uHostAdapterStatus));
1381	Log(("%s: uTargetDeviceStatus=%u\n", __FUNCTION__, pMailbox->u.in.uTargetDeviceStatus));
1382	Log(("%s: uCompletionCode=%u\n", __FUNCTION__, pMailbox->u.in.uCompletionCode));
1383	}
1384	}
1385
1386	/**
1387	* Dumps the content of a command control block for debugging purposes.
1388	*
1389	* @returns nothing.
1390	* @param pCCB Pointer to the command control block to dump.
1391	* @param fIs24BitCCB Flag to determine CCB format.
1392	*/
1393	static void buslogicR3DumpCCBInfo(PCCBU pCCB, bool fIs24BitCCB)
1394	{
1395	Log(("%s: Dump for %s Command Control Block:\n", __FUNCTION__, fIs24BitCCB ? "24-bit" : "32-bit"));
1396	Log(("%s: uOpCode=%#x\n", __FUNCTION__, pCCB->c.uOpcode));
1397	Log(("%s: uDataDirection=%u\n", __FUNCTION__, pCCB->c.uDataDirection));
1398	Log(("%s: cbCDB=%u\n", __FUNCTION__, pCCB->c.cbCDB));
1399	Log(("%s: cbSenseData=%u\n", __FUNCTION__, pCCB->c.cbSenseData));
1400	Log(("%s: uHostAdapterStatus=%u\n", __FUNCTION__, pCCB->c.uHostAdapterStatus));
1401	Log(("%s: uDeviceStatus=%u\n", __FUNCTION__, pCCB->c.uDeviceStatus));
1402	if (fIs24BitCCB)
1403	{
1404	Log(("%s: cbData=%u\n", __FUNCTION__, LEN_TO_U32(pCCB->o.acbData)));
1405	Log(("%s: PhysAddrData=%#x\n", __FUNCTION__, ADDR_TO_U32(pCCB->o.aPhysAddrData)));
1406	Log(("%s: uTargetId=%u\n", __FUNCTION__, pCCB->o.uTargetId));
1407	Log(("%s: uLogicalUnit=%u\n", __FUNCTION__, pCCB->o.uLogicalUnit));
1408	}
1409	else
1410	{
1411	Log(("%s: cbData=%u\n", __FUNCTION__, pCCB->n.cbData));
1412	Log(("%s: PhysAddrData=%#x\n", __FUNCTION__, pCCB->n.u32PhysAddrData));
1413	Log(("%s: uTargetId=%u\n", __FUNCTION__, pCCB->n.uTargetId));
1414	Log(("%s: uLogicalUnit=%u\n", __FUNCTION__, pCCB->n.uLogicalUnit));
1415	Log(("%s: fTagQueued=%d\n", __FUNCTION__, pCCB->n.fTagQueued));
1416	Log(("%s: uQueueTag=%u\n", __FUNCTION__, pCCB->n.uQueueTag));
1417	Log(("%s: fLegacyTagEnable=%u\n", __FUNCTION__, pCCB->n.fLegacyTagEnable));
1418	Log(("%s: uLegacyQueueTag=%u\n", __FUNCTION__, pCCB->n.uLegacyQueueTag));
1419	Log(("%s: PhysAddrSenseData=%#x\n", __FUNCTION__, pCCB->n.u32PhysAddrSenseData));
1420	}
1421	Log(("%s: uCDB[0]=%#x\n", __FUNCTION__, pCCB->c.abCDB[0]));
1422	for (int i = 1; i < pCCB->c.cbCDB; i++)
1423	Log(("%s: uCDB[%d]=%u\n", __FUNCTION__, i, pCCB->c.abCDB[i]));
1424	}
1425
1426	# endif /* LOG_ENABLED */
1427
1428	/**
1429	* Allocate data buffer.
1430	*
1431	* @param pDevIns PDM device instance.
1432	* @param fIs24Bit Flag whether the 24bit SG format is used.
1433	* @param GCSGList Guest physical address of S/G list.
1434	* @param cEntries Number of list entries to read.
1435	* @param pSGEList Pointer to 32-bit S/G list storage.
1436	*/
1437	static void buslogicR3ReadSGEntries(PPDMDEVINS pDevIns, bool fIs24Bit, RTGCPHYS GCSGList,
1438	uint32_t cEntries, SGE32 *pSGEList)
1439	{
1440	/* Read the S/G entries. Convert 24-bit entries to 32-bit format. */
1441	if (fIs24Bit)
1442	{
1443	SGE24 aSGE24[32];
1444	Assert(cEntries <= RT_ELEMENTS(aSGE24));
1445
1446	Log2(("Converting %u 24-bit S/G entries to 32-bit\n", cEntries));
1447	PDMDevHlpPhysRead(pDevIns, GCSGList, &aSGE24, cEntries * sizeof(SGE24));
1448	for (uint32_t i = 0; i < cEntries; ++i)
1449	{
1450	pSGEList[i].cbSegment = LEN_TO_U32(aSGE24[i].acbSegment);
1451	pSGEList[i].u32PhysAddrSegmentBase = ADDR_TO_U32(aSGE24[i].aPhysAddrSegmentBase);
1452	}
1453	}
1454	else
1455	PDMDevHlpPhysRead(pDevIns, GCSGList, pSGEList, cEntries * sizeof(SGE32));
1456	}
1457
1458	/**
1459	* Determines the size of th guest data buffer.
1460	*
1461	* @returns VBox status code.
1462	* @param pDevIns PDM device instance.
1463	* @param pCCBGuest The CCB of the guest.
1464	* @param fIs24Bit Flag whether the 24bit SG format is used.
1465	* @param pcbBuf Where to store the size of the guest data buffer on success.
1466	*/
1467	static int buslogicR3QueryDataBufferSize(PPDMDEVINS pDevIns, PCCBU pCCBGuest, bool fIs24Bit, size_t *pcbBuf)
1468	{
1469	int rc = VINF_SUCCESS;
1470	uint32_t cbDataCCB;
1471	uint32_t u32PhysAddrCCB;
1472	size_t cbBuf = 0;
1473
1474	/* Extract the data length and physical address from the CCB. */
1475	if (fIs24Bit)
1476	{
1477	u32PhysAddrCCB = ADDR_TO_U32(pCCBGuest->o.aPhysAddrData);
1478	cbDataCCB = LEN_TO_U32(pCCBGuest->o.acbData);
1479	}
1480	else
1481	{
1482	u32PhysAddrCCB = pCCBGuest->n.u32PhysAddrData;
1483	cbDataCCB = pCCBGuest->n.cbData;
1484	}
1485
1486	#if 1
1487	/* Hack for NT 10/91: A CCB describes a 2K buffer, but TEST UNIT READY is executed. This command
1488	* returns no data, hence the buffer must be left alone!
1489	*/
1490	if (pCCBGuest->c.abCDB[0] == 0)
1491	cbDataCCB = 0;
1492	#endif
1493
1494	if ( (pCCBGuest->c.uDataDirection != BUSLOGIC_CCB_DIRECTION_NO_DATA)
1495	&& cbDataCCB)
1496	{
1497	/*
1498	* The BusLogic adapter can handle two different data buffer formats.
1499	* The first one is that the data pointer entry in the CCB points to
1500	* the buffer directly. In second mode the data pointer points to a
1501	* scatter gather list which describes the buffer.
1502	*/
1503	if ( (pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER)
1504	\|\| (pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
1505	{
1506	uint32_t cScatterGatherGCRead;
1507	uint32_t iScatterGatherEntry;
1508	SGE32 aScatterGatherReadGC[32]; /* A buffer for scatter gather list entries read from guest memory. */
1509	uint32_t cScatterGatherGCLeft = cbDataCCB / (fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1510	RTGCPHYS GCPhysAddrScatterGatherCurrent = u32PhysAddrCCB;
1511
1512	/* Count number of bytes to transfer. */
1513	do
1514	{
1515	cScatterGatherGCRead = (cScatterGatherGCLeft < RT_ELEMENTS(aScatterGatherReadGC))
1516	? cScatterGatherGCLeft
1517	: RT_ELEMENTS(aScatterGatherReadGC);
1518	cScatterGatherGCLeft -= cScatterGatherGCRead;
1519
1520	buslogicR3ReadSGEntries(pDevIns, fIs24Bit, GCPhysAddrScatterGatherCurrent, cScatterGatherGCRead, aScatterGatherReadGC);
1521
1522	for (iScatterGatherEntry = 0; iScatterGatherEntry < cScatterGatherGCRead; iScatterGatherEntry++)
1523	cbBuf += aScatterGatherReadGC[iScatterGatherEntry].cbSegment;
1524
1525	/* Set address to the next entries to read. */
1526	GCPhysAddrScatterGatherCurrent += cScatterGatherGCRead * (fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1527	} while (cScatterGatherGCLeft > 0);
1528
1529	Log(("%s: cbBuf=%d\n", __FUNCTION__, cbBuf));
1530	}
1531	else if ( pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB
1532	\|\| pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
1533	cbBuf = cbDataCCB;
1534	}
1535
1536	if (RT_SUCCESS(rc))
1537	*pcbBuf = cbBuf;
1538
1539	return rc;
1540	}
1541
1542	/**
1543	* Copy from guest to host memory worker.
1544	*
1545	* @copydoc FNBUSLOGICR3MEMCOPYCALLBACK
1546	*/
1547	static DECLCALLBACK(void) buslogicR3CopyBufferFromGuestWorker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1548	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip)
1549	{
1550	RT_NOREF(pThis);
1551
1552	size_t cbSkipped = RT_MIN(cbCopy, *pcbSkip);
1553	cbCopy -= cbSkipped;
1554	GCPhys += cbSkipped;
1555	*pcbSkip -= cbSkipped;
1556
1557	while (cbCopy)
1558	{
1559	size_t cbSeg = cbCopy;
1560	void *pvSeg = RTSgBufGetNextSegment(pSgBuf, &cbSeg);
1561
1562	AssertPtr(pvSeg);
1563	PDMDevHlpPhysRead(pDevIns, GCPhys, pvSeg, cbSeg);
1564	GCPhys += cbSeg;
1565	cbCopy -= cbSeg;
1566	}
1567	}
1568
1569	/**
1570	* Copy from host to guest memory worker.
1571	*
1572	* @copydoc FNBUSLOGICR3MEMCOPYCALLBACK
1573	*/
1574	static DECLCALLBACK(void) buslogicR3CopyBufferToGuestWorker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1575	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip)
1576	{
1577	size_t cbSkipped = RT_MIN(cbCopy, *pcbSkip);
1578	cbCopy -= cbSkipped;
1579	GCPhys += cbSkipped;
1580	*pcbSkip -= cbSkipped;
1581
1582	while (cbCopy)
1583	{
1584	size_t cbSeg = cbCopy;
1585	void *pvSeg = RTSgBufGetNextSegment(pSgBuf, &cbSeg);
1586
1587	AssertPtr(pvSeg);
1588	blPhysWrite(pDevIns, pThis, GCPhys, pvSeg, cbSeg);
1589	GCPhys += cbSeg;
1590	cbCopy -= cbSeg;
1591	}
1592	}
1593
1594	/**
1595	* Walks the guest S/G buffer calling the given copy worker for every buffer.
1596	*
1597	* @returns The amout of bytes actually copied.
1598	* @param pDevIns The device instance.
1599	* @param pThis Pointer to the Buslogic device state.
1600	* @param pReq Pointer to the request state.
1601	* @param pfnCopyWorker The copy method to apply for each guest buffer.
1602	* @param pSgBuf The host S/G buffer.
1603	* @param cbSkip How many bytes to skip in advance before starting to copy.
1604	* @param cbCopy How many bytes to copy.
1605	*/
1606	static size_t buslogicR3SgBufWalker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1607	PFNBUSLOGICR3MEMCOPYCALLBACK pfnCopyWorker,
1608	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1609	{
1610	uint32_t cbDataCCB;
1611	uint32_t u32PhysAddrCCB;
1612	size_t cbCopied = 0;
1613
1614	/*
1615	* Add the amount to skip to the host buffer size to avoid a
1616	* few conditionals later on.
1617	*/
1618	cbCopy += cbSkip;
1619
1620	/* Extract the data length and physical address from the CCB. */
1621	if (pReq->fIs24Bit)
1622	{
1623	u32PhysAddrCCB = ADDR_TO_U32(pReq->CCBGuest.o.aPhysAddrData);
1624	cbDataCCB = LEN_TO_U32(pReq->CCBGuest.o.acbData);
1625	}
1626	else
1627	{
1628	u32PhysAddrCCB = pReq->CCBGuest.n.u32PhysAddrData;
1629	cbDataCCB = pReq->CCBGuest.n.cbData;
1630	}
1631
1632	#if 1
1633	/* Hack for NT 10/91: A CCB describes a 2K buffer, but TEST UNIT READY is executed. This command
1634	* returns no data, hence the buffer must be left alone!
1635	*/
1636	if (pReq->CCBGuest.c.abCDB[0] == 0)
1637	cbDataCCB = 0;
1638	#endif
1639
1640	LogFlowFunc(("pReq=%#p cbDataCCB=%u direction=%u cbCopy=%zu\n", pReq, cbDataCCB,
1641	pReq->CCBGuest.c.uDataDirection, cbCopy));
1642
1643	if ( (cbDataCCB > 0)
1644	&& ( pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_IN
1645	\|\| pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_OUT
1646	\|\| pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_UNKNOWN))
1647	{
1648	if ( (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER)
1649	\|\| (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
1650	{
1651	uint32_t cScatterGatherGCRead;
1652	uint32_t iScatterGatherEntry;
1653	SGE32 aScatterGatherReadGC[32]; /* Number of scatter gather list entries read from guest memory. */
1654	uint32_t cScatterGatherGCLeft = cbDataCCB / (pReq->fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1655	RTGCPHYS GCPhysAddrScatterGatherCurrent = u32PhysAddrCCB;
1656
1657	do
1658	{
1659	cScatterGatherGCRead = (cScatterGatherGCLeft < RT_ELEMENTS(aScatterGatherReadGC))
1660	? cScatterGatherGCLeft
1661	: RT_ELEMENTS(aScatterGatherReadGC);
1662	cScatterGatherGCLeft -= cScatterGatherGCRead;
1663
1664	buslogicR3ReadSGEntries(pDevIns, pReq->fIs24Bit, GCPhysAddrScatterGatherCurrent,
1665	cScatterGatherGCRead, aScatterGatherReadGC);
1666
1667	for (iScatterGatherEntry = 0; iScatterGatherEntry < cScatterGatherGCRead && cbCopy > 0; iScatterGatherEntry++)
1668	{
1669	RTGCPHYS GCPhysAddrDataBase;
1670	size_t cbCopyThis;
1671
1672	Log(("%s: iScatterGatherEntry=%u\n", __FUNCTION__, iScatterGatherEntry));
1673
1674	GCPhysAddrDataBase = (RTGCPHYS)aScatterGatherReadGC[iScatterGatherEntry].u32PhysAddrSegmentBase;
1675	cbCopyThis = RT_MIN(cbCopy, aScatterGatherReadGC[iScatterGatherEntry].cbSegment);
1676
1677	Log(("%s: GCPhysAddrDataBase=%RGp cbCopyThis=%zu\n", __FUNCTION__, GCPhysAddrDataBase, cbCopyThis));
1678
1679	pfnCopyWorker(pDevIns, pThis, GCPhysAddrDataBase, pSgBuf, cbCopyThis, &cbSkip);
1680	cbCopied += cbCopyThis;
1681	cbCopy -= cbCopyThis;
1682	}
1683
1684	/* Set address to the next entries to read. */
1685	GCPhysAddrScatterGatherCurrent += cScatterGatherGCRead * (pReq->fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1686	} while ( cScatterGatherGCLeft > 0
1687	&& cbCopy > 0);
1688
1689	}
1690	else if ( pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB
1691	\|\| pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
1692	{
1693	/* The buffer is not scattered. */
1694	RTGCPHYS GCPhysAddrDataBase = u32PhysAddrCCB;
1695
1696	AssertMsg(GCPhysAddrDataBase != 0, ("Physical address is 0\n"));
1697
1698	Log(("Non-scattered buffer:\n"));
1699	Log(("u32PhysAddrData=%#x\n", u32PhysAddrCCB));
1700	Log(("cbData=%u\n", cbDataCCB));
1701	Log(("GCPhysAddrDataBase=0x%RGp\n", GCPhysAddrDataBase));
1702
1703	/* Copy the data into the guest memory. */
1704	pfnCopyWorker(pDevIns, pThis, GCPhysAddrDataBase, pSgBuf, RT_MIN(cbDataCCB, cbCopy), &cbSkip);
1705	cbCopied += RT_MIN(cbDataCCB, cbCopy);
1706	}
1707	}
1708
1709	return cbCopied - RT_MIN(cbSkip, cbCopied);
1710	}
1711
1712	/**
1713	* Copies a data buffer into the S/G buffer set up by the guest.
1714	*
1715	* @returns Amount of bytes copied to the guest.
1716	* @param pDevIns The device instance.
1717	* @param pThis Pointer to the shared BusLogic instance data.
1718	* @param pReq Request structure.
1719	* @param pSgBuf The S/G buffer to copy from.
1720	* @param cbSkip How many bytes to skip in advance before starting to copy.
1721	* @param cbCopy How many bytes to copy.
1722	*/
1723	static size_t buslogicR3CopySgBufToGuest(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1724	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1725	{
1726	return buslogicR3SgBufWalker(pDevIns, pThis, pReq, buslogicR3CopyBufferToGuestWorker, pSgBuf, cbSkip, cbCopy);
1727	}
1728
1729	/**
1730	* Copies the guest S/G buffer into a host data buffer.
1731	*
1732	* @returns Amount of bytes copied from the guest.
1733	* @param pDevIns The device instance.
1734	* @param pThis Pointer to the shared BusLogic instance data.
1735	* @param pReq Request structure.
1736	* @param pSgBuf The S/G buffer to copy into.
1737	* @param cbSkip How many bytes to skip in advance before starting to copy.
1738	* @param cbCopy How many bytes to copy.
1739	*/
1740	static size_t buslogicR3CopySgBufFromGuest(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1741	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1742	{
1743	return buslogicR3SgBufWalker(pDevIns, pThis, pReq, buslogicR3CopyBufferFromGuestWorker, pSgBuf, cbSkip, cbCopy);
1744	}
1745
1746	/** Convert sense buffer length taking into account shortcut values. */
1747	static uint32_t buslogicR3ConvertSenseBufferLength(uint32_t cbSense)
1748	{
1749	/* Convert special sense buffer length values. */
1750	if (cbSense == 0)
1751	cbSense = 14; /* 0 means standard 14-byte buffer. */
1752	else if (cbSense == 1)
1753	cbSense = 0; /* 1 means no sense data. */
1754	else if (cbSense < 8)
1755	AssertMsgFailed(("Reserved cbSense value of %d used!\n", cbSense));
1756
1757	return cbSense;
1758	}
1759
1760	/**
1761	* Free the sense buffer.
1762	*
1763	* @returns nothing.
1764	* @param pReq Pointer to the request state.
1765	* @param fCopy If sense data should be copied to guest memory.
1766	*/
1767	static void buslogicR3SenseBufferFree(PBUSLOGICREQ pReq, bool fCopy)
1768	{
1769	uint32_t cbSenseBuffer;
1770
1771	cbSenseBuffer = buslogicR3ConvertSenseBufferLength(pReq->CCBGuest.c.cbSenseData);
1772
1773	/* Copy the sense buffer into guest memory if requested. */
1774	if (fCopy && cbSenseBuffer)
1775	{
1776	PPDMDEVINS pDevIns = pReq->pTargetDevice->pDevIns;
1777	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
1778	RTGCPHYS GCPhysAddrSenseBuffer;
1779
1780	/* With 32-bit CCBs, the (optional) sense buffer physical address is provided separately.
1781	* On the other hand, with 24-bit CCBs, the sense buffer is simply located at the end of
1782	* the CCB, right after the variable-length CDB.
1783	*/
1784	if (pReq->fIs24Bit)
1785	{
1786	GCPhysAddrSenseBuffer = pReq->GCPhysAddrCCB;
1787	GCPhysAddrSenseBuffer += pReq->CCBGuest.c.cbCDB + RT_OFFSETOF(CCB24, abCDB);
1788	}
1789	else
1790	GCPhysAddrSenseBuffer = pReq->CCBGuest.n.u32PhysAddrSenseData;
1791
1792	Log3(("%s: sense buffer: %.*Rhxs\n", __FUNCTION__, cbSenseBuffer, pReq->pbSenseBuffer));
1793	blPhysWrite(pDevIns, pThis, GCPhysAddrSenseBuffer, pReq->pbSenseBuffer, cbSenseBuffer);
1794	}
1795
1796	RTMemFree(pReq->pbSenseBuffer);
1797	pReq->pbSenseBuffer = NULL;
1798	}
1799
1800	/**
1801	* Alloc the sense buffer.
1802	*
1803	* @returns VBox status code.
1804	* @param pReq Pointer to the task state.
1805	*/
1806	static int buslogicR3SenseBufferAlloc(PBUSLOGICREQ pReq)
1807	{
1808	pReq->pbSenseBuffer = NULL;
1809
1810	uint32_t cbSenseBuffer = buslogicR3ConvertSenseBufferLength(pReq->CCBGuest.c.cbSenseData);
1811	if (cbSenseBuffer)
1812	{
1813	pReq->pbSenseBuffer = (uint8_t *)RTMemAllocZ(cbSenseBuffer);
1814	if (!pReq->pbSenseBuffer)
1815	return VERR_NO_MEMORY;
1816	}
1817
1818	return VINF_SUCCESS;
1819	}
1820
1821	#endif /* IN_RING3 */
1822
1823	/**
1824	* Parses the command buffer and executes it.
1825	*
1826	* @returns VBox status code.
1827	* @param pDevIns The PDM device instance.
1828	* @param pThis Pointer to the shared BusLogic instance data.
1829	*/
1830	static int buslogicProcessCommand(PPDMDEVINS pDevIns, PBUSLOGIC pThis)
1831	{
1832	int rc = VINF_SUCCESS;
1833	bool fSuppressIrq = false;
1834	bool fSuppressCMDC = false;
1835
1836	LogFlowFunc(("pThis=%#p\n", pThis));
1837	AssertMsg(pThis->uOperationCode != 0xff, ("There is no command to execute\n"));
1838
1839	switch (pThis->uOperationCode)
1840	{
1841	case BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT:
1842	/* Valid command, no reply. */
1843	pThis->cbReplyParametersLeft = 0;
1844	break;
1845	case BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION:
1846	{
1847	PReplyInquirePCIHostAdapterInformation pReply = (PReplyInquirePCIHostAdapterInformation)pThis->aReplyBuffer;
1848	memset(pReply, 0, sizeof(ReplyInquirePCIHostAdapterInformation));
1849
1850	/* Modeled after a real BT-958(D) */
1851	pReply->HighByteTerminated = 1;
1852	pReply->LowByteTerminated = 1;
1853	pReply->JP1 = 1; /* Closed; "Factory configured - do not alter" */
1854	pReply->InformationIsValid = 1;
1855	pReply->IsaIOPort = pThis->uISABaseCode;
1856	pReply->IRQ = PCIDevGetInterruptLine(pDevIns->apPciDevs[0]);
1857	pThis->cbReplyParametersLeft = sizeof(ReplyInquirePCIHostAdapterInformation);
1858	break;
1859	}
1860	case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
1861	{
1862	/* no-op */
1863	pThis->cbReplyParametersLeft = 0;
1864	break;
1865	}
1866	case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
1867	{
1868	/* Modify the ISA-compatible I/O port base. Note that this technically
1869	* violates the PCI spec, as this address is not reported through PCI.
1870	* However, it is required for compatibility with old drivers.
1871	*/
1872	#ifdef IN_RING3 /* We can do this from ring-0 now, but we'd like to see the LogRel, so we keep going back to ring-3 anyway. */
1873	Log(("ISA I/O for PCI (code %x)\n", pThis->aCommandBuffer[0]));
1874	buslogicR3RegisterISARange(pDevIns, pThis, pThis->aCommandBuffer[0]);
1875	pThis->cbReplyParametersLeft = 0;
1876	fSuppressIrq = true;
1877	fSuppressCMDC = true;
1878	break;
1879	#else
1880	AssertMsgFailed(("Must never get here!\n"));
1881	break;
1882	#endif
1883	}
1884	case BUSLOGICCOMMAND_INQUIRE_BOARD_ID:
1885	{
1886	/* The special option byte is important: If it is '0' or 'B', Windows NT drivers
1887	* for Adaptec AHA-154x may claim the adapter. The BusLogic drivers will claim
1888	* the adapter only when the byte is not '0' or 'B'.
1889	*/
1890	if (pThis->uDevType == DEV_AHA_1540B)
1891	{
1892	pThis->aReplyBuffer[0] = 'A'; /* Firmware option bytes */
1893	pThis->aReplyBuffer[1] = '0'; /* Special option byte */
1894	}
1895	else
1896	{
1897	pThis->aReplyBuffer[0] = 'A'; /* Firmware option bytes */
1898	pThis->aReplyBuffer[1] = 'A'; /* Special option byte */
1899	}
1900
1901	/* We report version 5.07B. This reply will provide the first two digits. */
1902	pThis->aReplyBuffer[2] = '5'; /* Major version 5 */
1903	pThis->aReplyBuffer[3] = '0'; /* Minor version 0 */
1904	pThis->cbReplyParametersLeft = 4; /* Reply is 4 bytes long */
1905	break;
1906	}
1907	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER:
1908	{
1909	if (pThis->uDevType == DEV_AHA_1540B)
1910	{
1911	/* Newer ASPI4DOS.SYS versions expect this command to fail. */
1912	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
1913	pThis->cbReplyParametersLeft = 0;
1914	pThis->regStatus \|= BL_STAT_CMDINV;
1915	break;
1916	}
1917
1918	pThis->aReplyBuffer[0] = '7';
1919	pThis->cbReplyParametersLeft = 1;
1920	break;
1921	}
1922	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER:
1923	{
1924	pThis->aReplyBuffer[0] = 'B';
1925	pThis->cbReplyParametersLeft = 1;
1926	break;
1927	}
1928	case BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS:
1929	/* The parameter list length is determined by the first byte of the command buffer. */
1930	if (pThis->iParameter == 1)
1931	{
1932	/* First pass - set the number of following parameter bytes. */
1933	pThis->cbCommandParametersLeft = pThis->aCommandBuffer[0];
1934	Log(("Set HA options: %u bytes follow\n", pThis->cbCommandParametersLeft));
1935	}
1936	else
1937	{
1938	/* Second pass - process received data. */
1939	Log(("Set HA options: received %u bytes\n", pThis->aCommandBuffer[0]));
1940	/* We ignore the data - it only concerns the SCSI hardware protocol. */
1941	}
1942	pThis->cbReplyParametersLeft = 0;
1943	break;
1944
1945	case BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND:
1946	/* The parameter list length is at least 12 bytes; the 12th byte determines
1947	* the number of additional CDB bytes that will follow.
1948	*/
1949	if (pThis->iParameter == 12)
1950	{
1951	/* First pass - set the number of following CDB bytes. */
1952	pThis->cbCommandParametersLeft = pThis->aCommandBuffer[11];
1953	Log(("Execute SCSI cmd: %u more bytes follow\n", pThis->cbCommandParametersLeft));
1954	}
1955	else
1956	{
1957	PESCMD pCmd;
1958
1959	/* Second pass - process received data. */
1960	Log(("Execute SCSI cmd: received %u bytes\n", pThis->aCommandBuffer[0]));
1961
1962	pCmd = (PESCMD)pThis->aCommandBuffer;
1963	Log(("Addr %08X, cbData %08X, cbCDB=%u\n", pCmd->u32PhysAddrData, pCmd->cbData, pCmd->cbCDB));
1964	}
1965	// This is currently a dummy - just fails every command.
1966	pThis->cbReplyParametersLeft = 4;
1967	pThis->aReplyBuffer[0] = pThis->aReplyBuffer[1] = 0;
1968	pThis->aReplyBuffer[2] = 0x11; /* HBA status (timeout). */
1969	pThis->aReplyBuffer[3] = 0; /* Device status. */
1970	break;
1971
1972	case BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER:
1973	{
1974	/* Not supported on AHA-154x. */
1975	if (pThis->uDevType == DEV_AHA_1540B)
1976	{
1977	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
1978	pThis->cbReplyParametersLeft = 0;
1979	pThis->regStatus \|= BL_STAT_CMDINV;
1980	break;
1981	}
1982
1983	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
1984	if (pThis->aCommandBuffer[0] > sizeof(pThis->aReplyBuffer))
1985	{
1986	Log(("Requested too much adapter model number data (%u)!\n", pThis->aCommandBuffer[0]));
1987	pThis->regStatus \|= BL_STAT_CMDINV;
1988	break;
1989	}
1990	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
1991	memset(pThis->aReplyBuffer, 0, sizeof(pThis->aReplyBuffer));
1992	const char aModelName[] = "958D "; /* Trailing \0 is fine, that's the filler anyway. */
1993	int cCharsToTransfer = pThis->cbReplyParametersLeft <= sizeof(aModelName)
1994	? pThis->cbReplyParametersLeft
1995	: sizeof(aModelName);
1996
1997	for (int i = 0; i < cCharsToTransfer; i++)
1998	pThis->aReplyBuffer[i] = aModelName[i];
1999
2000	break;
2001	}
2002	case BUSLOGICCOMMAND_INQUIRE_CONFIGURATION:
2003	{
2004	uint8_t uIrq;
2005
2006	if (pThis->uIsaIrq)
2007	uIrq = pThis->uIsaIrq;
2008	else
2009	uIrq = PCIDevGetInterruptLine(pDevIns->apPciDevs[0]);
2010
2011	pThis->cbReplyParametersLeft = sizeof(ReplyInquireConfiguration);
2012	PReplyInquireConfiguration pReply = (PReplyInquireConfiguration)pThis->aReplyBuffer;
2013	memset(pReply, 0, sizeof(ReplyInquireConfiguration));
2014
2015	pReply->uHostAdapterId = 7; /* The controller has always 7 as ID. */
2016	pReply->fDmaChannel6 = 1; /* DMA channel 6 is a good default. */
2017
2018	/* The PCI IRQ is not necessarily representable in this structure.
2019	* If that is the case, the guest likely won't function correctly,
2020	* therefore we log a warning. Note that for ISA configurations, we
2021	* can only allow IRQs that can be supported; for PCI, the HBA
2022	* has no control over IRQ assignment.
2023	*/
2024	switch (uIrq)
2025	{
2026	case 9: pReply->fIrqChannel9 = 1; break;
2027	case 10: pReply->fIrqChannel10 = 1; break;
2028	case 11: pReply->fIrqChannel11 = 1; break;
2029	case 12: pReply->fIrqChannel12 = 1; break;
2030	case 14: pReply->fIrqChannel14 = 1; break;
2031	case 15: pReply->fIrqChannel15 = 1; break;
2032	default:
2033	LogRel(("Warning: PCI IRQ %d cannot be represented as ISA!\n", uIrq));
2034	break;
2035	}
2036	break;
2037	}
2038	case BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION:
2039	{
2040	/* Some Adaptec AHA-154x drivers (e.g. OS/2) execute this command and expect
2041	* it to fail. If it succeeds, the drivers refuse to load. However, some newer
2042	* Adaptec 154x models supposedly support it too??
2043	*/
2044	if (pThis->uDevType == DEV_AHA_1540B)
2045	{
2046	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2047	pThis->cbReplyParametersLeft = 0;
2048	pThis->regStatus \|= BL_STAT_CMDINV;
2049	break;
2050	}
2051
2052	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2053	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2054	PReplyInquireExtendedSetupInformation pReply = (PReplyInquireExtendedSetupInformation)pThis->aReplyBuffer;
2055	memset(pReply, 0, sizeof(ReplyInquireExtendedSetupInformation));
2056
2057	/** @todo should this reflect the RAM contents (AutoSCSIRam)? */
2058	pReply->uBusType = 'E'; /* EISA style */
2059	pReply->u16ScatterGatherLimit = 8192;
2060	pReply->cMailbox = pThis->cMailbox;
2061	pReply->uMailboxAddressBase = (uint32_t)pThis->GCPhysAddrMailboxOutgoingBase;
2062	pReply->fLevelSensitiveInterrupt = true;
2063	pReply->fHostWideSCSI = true;
2064	pReply->fHostUltraSCSI = true;
2065	memcpy(pReply->aFirmwareRevision, "07B", sizeof(pReply->aFirmwareRevision));
2066
2067	break;
2068	}
2069	case BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION:
2070	{
2071	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2072	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2073	PReplyInquireSetupInformation pReply = (PReplyInquireSetupInformation)pThis->aReplyBuffer;
2074	memset(pReply, 0, sizeof(ReplyInquireSetupInformation));
2075	pReply->fSynchronousInitiationEnabled = true;
2076	pReply->fParityCheckingEnabled = true;
2077	pReply->cMailbox = pThis->cMailbox;
2078	U32_TO_ADDR(pReply->MailboxAddress, pThis->GCPhysAddrMailboxOutgoingBase);
2079	/* The 'D' signature (actually 'SD' for Storage Dimensions, and 'BD' for BusLogic)
2080	* prevents Adaptec's OS/2 drivers from getting too friendly with BusLogic hardware
2081	* and upsetting the HBA state.
2082	*/
2083	if (pThis->uDevType == DEV_AHA_1540B)
2084	{
2085	pReply->uSignature = 0; /* Zeros for Adaptec. */
2086	pReply->uCharacterD = 0;
2087	}
2088	else
2089	{
2090	pReply->uSignature = 'B';
2091	pReply->uCharacterD = 'D'; /* BusLogic model. */
2092	}
2093	pReply->uHostBusType = 'F'; /* PCI bus. */
2094	break;
2095	}
2096	case BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM:
2097	{
2098	/*
2099	* First element in the command buffer contains start offset to read from
2100	* and second one the number of bytes to read.
2101	*/
2102	uint8_t uOffset = pThis->aCommandBuffer[0];
2103	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[1];
2104
2105	pThis->fUseLocalRam = true;
2106	pThis->iReply = uOffset;
2107	break;
2108	}
2109	case BUSLOGICCOMMAND_INITIALIZE_MAILBOX:
2110	{
2111	PRequestInitMbx pRequest = (PRequestInitMbx)pThis->aCommandBuffer;
2112
2113	pThis->cbReplyParametersLeft = 0;
2114	if (!pRequest->cMailbox)
2115	{
2116	Log(("cMailboxes=%u (24-bit mode), fail!\n", pThis->cMailbox));
2117	pThis->regStatus \|= BL_STAT_CMDINV;
2118	break;
2119	}
2120	pThis->fMbxIs24Bit = true;
2121	pThis->cMailbox = pRequest->cMailbox;
2122	pThis->uMailboxOutgoingPositionCurrent = pThis->uMailboxIncomingPositionCurrent = 0;
2123	pThis->GCPhysAddrMailboxOutgoingBase = (RTGCPHYS)ADDR_TO_U32(pRequest->aMailboxBaseAddr);
2124	/* The area for incoming mailboxes is right after the last entry of outgoing mailboxes. */
2125	pThis->GCPhysAddrMailboxIncomingBase = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox24));
2126
2127	Log(("GCPhysAddrMailboxOutgoingBase=%RGp\n", pThis->GCPhysAddrMailboxOutgoingBase));
2128	Log(("GCPhysAddrMailboxIncomingBase=%RGp\n", pThis->GCPhysAddrMailboxIncomingBase));
2129	Log(("cMailboxes=%u (24-bit mode)\n", pThis->cMailbox));
2130	LogRel(("Initialized 24-bit mailbox, %d entries at %08x\n", pRequest->cMailbox, ADDR_TO_U32(pRequest->aMailboxBaseAddr)));
2131
2132	pThis->regStatus &= ~BL_STAT_INREQ;
2133	break;
2134	}
2135	case BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX:
2136	{
2137	if (pThis->uDevType == DEV_AHA_1540B)
2138	{
2139	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2140	pThis->cbReplyParametersLeft = 0;
2141	pThis->regStatus \|= BL_STAT_CMDINV;
2142	break;
2143	}
2144
2145	PRequestInitializeExtendedMailbox pRequest = (PRequestInitializeExtendedMailbox)pThis->aCommandBuffer;
2146
2147	pThis->cbReplyParametersLeft = 0;
2148	if (!pRequest->cMailbox)
2149	{
2150	Log(("cMailboxes=%u (32-bit mode), fail!\n", pThis->cMailbox));
2151	pThis->regStatus \|= BL_STAT_CMDINV;
2152	break;
2153	}
2154	pThis->fMbxIs24Bit = false;
2155	pThis->cMailbox = pRequest->cMailbox;
2156	pThis->uMailboxOutgoingPositionCurrent = pThis->uMailboxIncomingPositionCurrent = 0;
2157	pThis->GCPhysAddrMailboxOutgoingBase = (RTGCPHYS)pRequest->uMailboxBaseAddress;
2158	/* The area for incoming mailboxes is right after the last entry of outgoing mailboxes. */
2159	pThis->GCPhysAddrMailboxIncomingBase = (RTGCPHYS)pRequest->uMailboxBaseAddress + (pThis->cMailbox * sizeof(Mailbox32));
2160
2161	Log(("GCPhysAddrMailboxOutgoingBase=%RGp\n", pThis->GCPhysAddrMailboxOutgoingBase));
2162	Log(("GCPhysAddrMailboxIncomingBase=%RGp\n", pThis->GCPhysAddrMailboxIncomingBase));
2163	Log(("cMailboxes=%u (32-bit mode)\n", pThis->cMailbox));
2164	LogRel(("Initialized 32-bit mailbox, %d entries at %08x\n", pRequest->cMailbox, pRequest->uMailboxBaseAddress));
2165
2166	pThis->regStatus &= ~BL_STAT_INREQ;
2167	break;
2168	}
2169	case BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE:
2170	{
2171	if (pThis->aCommandBuffer[0] == 0)
2172	pThis->fStrictRoundRobinMode = false;
2173	else if (pThis->aCommandBuffer[0] == 1)
2174	pThis->fStrictRoundRobinMode = true;
2175	else
2176	AssertMsgFailed(("Invalid round robin mode %d\n", pThis->aCommandBuffer[0]));
2177
2178	pThis->cbReplyParametersLeft = 0;
2179	break;
2180	}
2181	case BUSLOGICCOMMAND_SET_CCB_FORMAT:
2182	{
2183	if (pThis->aCommandBuffer[0] == 0)
2184	pThis->fExtendedLunCCBFormat = false;
2185	else if (pThis->aCommandBuffer[0] == 1)
2186	pThis->fExtendedLunCCBFormat = true;
2187	else
2188	AssertMsgFailed(("Invalid CCB format %d\n", pThis->aCommandBuffer[0]));
2189
2190	pThis->cbReplyParametersLeft = 0;
2191	break;
2192	}
2193	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7:
2194	/* This is supposed to send TEST UNIT READY to each target/LUN.
2195	* We cheat and skip that, since we already know what's attached
2196	*/
2197	memset(pThis->aReplyBuffer, 0, 8);
2198	for (int i = 0; i < 8; ++i)
2199	{
2200	if (pThis->afDevicePresent[i])
2201	pThis->aReplyBuffer[i] = 1;
2202	}
2203	pThis->aReplyBuffer[7] = 0; /* HA hardcoded at ID 7. */
2204	pThis->cbReplyParametersLeft = 8;
2205	break;
2206	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15:
2207	/* See note about cheating above. */
2208	memset(pThis->aReplyBuffer, 0, 8);
2209	for (int i = 0; i < 8; ++i)
2210	{
2211	if (pThis->afDevicePresent[i + 8])
2212	pThis->aReplyBuffer[i] = 1;
2213	}
2214	pThis->cbReplyParametersLeft = 8;
2215	break;
2216	case BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES:
2217	{
2218	/* Each bit which is set in the 16bit wide variable means a present device. */
2219	uint16_t u16TargetsPresentMask = 0;
2220
2221	for (uint8_t i = 0; i < RT_ELEMENTS(pThis->afDevicePresent); i++)
2222	{
2223	if (pThis->afDevicePresent[i])
2224	u16TargetsPresentMask \|= (1 << i);
2225	}
2226	pThis->aReplyBuffer[0] = (uint8_t)u16TargetsPresentMask;
2227	pThis->aReplyBuffer[1] = (uint8_t)(u16TargetsPresentMask >> 8);
2228	pThis->cbReplyParametersLeft = 2;
2229	break;
2230	}
2231	case BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD:
2232	{
2233	if (pThis->aCommandBuffer[0] > sizeof(pThis->aReplyBuffer))
2234	{
2235	Log(("Requested too much synch period inquiry (%u)!\n", pThis->aCommandBuffer[0]));
2236	pThis->regStatus \|= BL_STAT_CMDINV;
2237	break;
2238	}
2239	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2240	for (uint8_t i = 0; i < pThis->cbReplyParametersLeft; i++)
2241	pThis->aReplyBuffer[i] = 0; /** @todo Figure if we need something other here. It's not needed for the linux driver */
2242
2243	break;
2244	}
2245	case BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT:
2246	{
2247	/* Not supported on AHA-154x HBAs. */
2248	if (pThis->uDevType == DEV_AHA_1540B)
2249	{
2250	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2251	pThis->cbReplyParametersLeft = 0;
2252	pThis->regStatus \|= BL_STAT_CMDINV;
2253	break;
2254	}
2255
2256	pThis->cbReplyParametersLeft = 0;
2257	if (pThis->aCommandBuffer[0] == 0)
2258	pThis->fIRQEnabled = false;
2259	else
2260	pThis->fIRQEnabled = true;
2261	/* No interrupt signaled regardless of enable/disable. NB: CMDC is still signaled! */
2262	fSuppressIrq = true;
2263	break;
2264	}
2265	case BUSLOGICCOMMAND_ECHO_COMMAND_DATA:
2266	{
2267	pThis->aReplyBuffer[0] = pThis->aCommandBuffer[0];
2268	pThis->cbReplyParametersLeft = 1;
2269	break;
2270	}
2271	case BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT:
2272	{
2273	uint8_t uEnable = pThis->aCommandBuffer[0];
2274
2275	pThis->cbReplyParametersLeft = 0;
2276	Log(("Enable OMBR: %u\n", uEnable));
2277	/* Only 0/1 are accepted. */
2278	if (uEnable > 1)
2279	pThis->regStatus \|= BL_STAT_CMDINV;
2280	else
2281	{
2282	pThis->LocalRam.structured.autoSCSIData.uReserved6 = uEnable;
2283	fSuppressIrq = true;
2284	fSuppressCMDC = true;
2285	}
2286	break;
2287	}
2288	case BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS:
2289	{
2290	pThis->cbReplyParametersLeft = 0;
2291	pThis->LocalRam.structured.autoSCSIData.uBusOnDelay = pThis->aCommandBuffer[0];
2292	Log(("Bus-on time: %d\n", pThis->aCommandBuffer[0]));
2293	break;
2294	}
2295	case BUSLOGICCOMMAND_SET_TIME_OFF_BUS:
2296	{
2297	pThis->cbReplyParametersLeft = 0;
2298	pThis->LocalRam.structured.autoSCSIData.uBusOffDelay = pThis->aCommandBuffer[0];
2299	Log(("Bus-off time: %d\n", pThis->aCommandBuffer[0]));
2300	break;
2301	}
2302	case BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE:
2303	{
2304	pThis->cbReplyParametersLeft = 0;
2305	pThis->LocalRam.structured.autoSCSIData.uDMATransferRate = pThis->aCommandBuffer[0];
2306	Log(("Bus transfer rate: %02X\n", pThis->aCommandBuffer[0]));
2307	break;
2308	}
2309	case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
2310	{
2311	RTGCPHYS GCPhysFifoBuf;
2312	Addr24 addr;
2313
2314	pThis->cbReplyParametersLeft = 0;
2315	addr.hi = pThis->aCommandBuffer[0];
2316	addr.mid = pThis->aCommandBuffer[1];
2317	addr.lo = pThis->aCommandBuffer[2];
2318	GCPhysFifoBuf = (RTGCPHYS)ADDR_TO_U32(addr);
2319	Log(("Write busmaster FIFO at: %04X\n", ADDR_TO_U32(addr)));
2320	PDMDevHlpPhysRead(pDevIns, GCPhysFifoBuf,
2321	&pThis->LocalRam.u8View[64], 64);
2322	break;
2323	}
2324	case BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO:
2325	{
2326	RTGCPHYS GCPhysFifoBuf;
2327	Addr24 addr;
2328
2329	pThis->cbReplyParametersLeft = 0;
2330	addr.hi = pThis->aCommandBuffer[0];
2331	addr.mid = pThis->aCommandBuffer[1];
2332	addr.lo = pThis->aCommandBuffer[2];
2333	GCPhysFifoBuf = (RTGCPHYS)ADDR_TO_U32(addr);
2334	Log(("Read busmaster FIFO at: %04X\n", ADDR_TO_U32(addr)));
2335	blPhysWrite(pDevIns, pThis, GCPhysFifoBuf, &pThis->LocalRam.u8View[64], 64);
2336	break;
2337	}
2338	default:
2339	AssertMsgFailed(("Invalid command %#x\n", pThis->uOperationCode));
2340	RT_FALL_THRU();
2341	case BUSLOGICCOMMAND_EXT_BIOS_INFO:
2342	case BUSLOGICCOMMAND_UNLOCK_MAILBOX:
2343	/* Commands valid for Adaptec 154xC which we don't handle since
2344	* we pretend being 154xB compatible. Just mark the command as invalid.
2345	*/
2346	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2347	pThis->cbReplyParametersLeft = 0;
2348	pThis->regStatus \|= BL_STAT_CMDINV;
2349	break;
2350	case BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND: /* Should be handled already. */
2351	AssertMsgFailed(("Invalid mailbox execute state!\n"));
2352	}
2353
2354	Log(("uOperationCode=%#x, cbReplyParametersLeft=%d\n", pThis->uOperationCode, pThis->cbReplyParametersLeft));
2355
2356	/* Fail command if too much parameter data requested. */
2357	if ((pThis->cbCommandParametersLeft + pThis->iParameter) > sizeof(pThis->aCommandBuffer))
2358	{
2359	Log(("Invalid command parameter length (%u)\n", pThis->cbCommandParametersLeft));
2360	pThis->cbReplyParametersLeft = 0;
2361	pThis->cbCommandParametersLeft = 0;
2362	pThis->regStatus \|= BL_STAT_CMDINV;
2363	}
2364
2365	/* Set the data in ready bit in the status register in case the command has a reply. */
2366	if (pThis->cbReplyParametersLeft)
2367	pThis->regStatus \|= BL_STAT_DIRRDY;
2368	else if (!pThis->cbCommandParametersLeft)
2369	buslogicCommandComplete(pDevIns, pThis, fSuppressIrq, fSuppressCMDC);
2370
2371	return rc;
2372	}
2373
2374	/**
2375	* Read a register from the BusLogic adapter.
2376	*
2377	* @returns VBox status code.
2378	* @param pDevIns The device instance.
2379	* @param pThis Pointer to the shared BusLogic instance data.
2380	* @param iRegister The index of the register to read.
2381	* @param pu32 Where to store the register content.
2382	*/
2383	static int buslogicRegisterRead(PPDMDEVINS pDevIns, PBUSLOGIC pThis, unsigned iRegister, uint32_t *pu32)
2384	{
2385	static const char s_szAhaSig[] = "ADAP";
2386	int rc = VINF_SUCCESS;
2387
2388	switch (iRegister)
2389	{
2390	case BUSLOGIC_REGISTER_STATUS:
2391	{
2392	*pu32 = pThis->regStatus;
2393
2394	/* If the diagnostic active bit is set, we are in a guest-initiated
2395	* hard reset. If the guest reads the status register and waits for
2396	* the host adapter ready bit to be set, we terminate the reset right
2397	* away. However, guests may also expect the reset condition to clear
2398	* automatically after a period of time, in which case we can't show
2399	* the DIAG bit at all.
2400	*/
2401	if (pThis->regStatus & BL_STAT_DACT)
2402	{
2403	uint64_t u64AccessTime = PDMDevHlpTMTimeVirtGetNano(pDevIns);
2404
2405	pThis->regStatus &= ~BL_STAT_DACT;
2406	pThis->regStatus \|= BL_STAT_HARDY;
2407
2408	if (u64AccessTime - pThis->u64ResetTime > BUSLOGIC_RESET_DURATION_NS)
2409	{
2410	/* If reset already expired, let the guest see that right away. */
2411	*pu32 = pThis->regStatus;
2412	pThis->u64ResetTime = 0;
2413	}
2414	}
2415	break;
2416	}
2417	case BUSLOGIC_REGISTER_DATAIN:
2418	{
2419	if (pThis->fUseLocalRam)
2420	*pu32 = pThis->LocalRam.u8View[pThis->iReply];
2421	else
2422	*pu32 = pThis->aReplyBuffer[pThis->iReply];
2423
2424	/* Careful about underflow - guest can read data register even if
2425	* no data is available.
2426	*/
2427	if (pThis->cbReplyParametersLeft)
2428	{
2429	pThis->iReply++;
2430	pThis->cbReplyParametersLeft--;
2431	if (!pThis->cbReplyParametersLeft)
2432	{
2433	/*
2434	* Reply finished, set command complete bit, unset data-in ready bit and
2435	* interrupt the guest if enabled.
2436	* NB: Some commands do not set the CMDC bit / raise completion interrupt.
2437	*/
2438	if (pThis->uOperationCode == BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM)
2439	buslogicCommandComplete(pDevIns, pThis, true /* fSuppressIrq /, true / fSuppressCMDC */);
2440	else
2441	buslogicCommandComplete(pDevIns, pThis, false, false);
2442	}
2443	}
2444	LogFlowFunc(("data=%02x, iReply=%d, cbReplyParametersLeft=%u\n", *pu32,
2445	pThis->iReply, pThis->cbReplyParametersLeft));
2446	break;
2447	}
2448	case BUSLOGIC_REGISTER_INTERRUPT:
2449	{
2450	*pu32 = pThis->regInterrupt;
2451	break;
2452	}
2453	case BUSLOGIC_REGISTER_GEOMETRY:
2454	{
2455	if (pThis->uDevType == DEV_AHA_1540B)
2456	{
2457	uint8_t off = pThis->uAhaSigIdx & 3;
2458	*pu32 = s_szAhaSig[off];
2459	pThis->uAhaSigIdx = (off + 1) & 3;
2460	}
2461	else
2462	*pu32 = pThis->regGeometry;
2463	break;
2464	}
2465	default:
2466	*pu32 = UINT32_C(0xffffffff);
2467	}
2468
2469	Log2(("%s: pu32=%p:{%.*Rhxs} iRegister=%d rc=%Rrc\n",
2470	__FUNCTION__, pu32, 1, pu32, iRegister, rc));
2471
2472	return rc;
2473	}
2474
2475	/**
2476	* Write a value to a register.
2477	*
2478	* @returns VBox status code.
2479	* @param pDevIns The PDM device instance.
2480	* @param pThis Pointer to the shared BusLogic instance data.
2481	* @param iRegister The index of the register to read.
2482	* @param uVal The value to write.
2483	*/
2484	static int buslogicRegisterWrite(PPDMDEVINS pDevIns, PBUSLOGIC pThis, unsigned iRegister, uint8_t uVal)
2485	{
2486	int rc = VINF_SUCCESS;
2487
2488	switch (iRegister)
2489	{
2490	case BUSLOGIC_REGISTER_CONTROL:
2491	{
2492	if ((uVal & BL_CTRL_RHARD) \|\| (uVal & BL_CTRL_RSOFT))
2493	{
2494	#ifdef IN_RING3
2495	bool fHardReset = !!(uVal & BL_CTRL_RHARD);
2496
2497	LogRel(("BusLogic: %s reset\n", fHardReset ? "hard" : "soft"));
2498	buslogicR3InitiateReset(pDevIns, pThis, PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC), fHardReset);
2499	#else
2500	rc = VINF_IOM_R3_IOPORT_WRITE;
2501	#endif
2502	break;
2503	}
2504
2505	rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSectIntr, VINF_IOM_R3_IOPORT_WRITE);
2506	if (rc != VINF_SUCCESS)
2507	return rc;
2508
2509	#ifdef LOG_ENABLED
2510	uint32_t cMailboxesReady = ASMAtomicXchgU32(&pThis->cInMailboxesReadyIfLogEnabled, 0);
2511	Log(("%u incoming mailboxes were ready when this interrupt was cleared\n", cMailboxesReady));
2512	#endif
2513
2514	if (uVal & BL_CTRL_RINT)
2515	buslogicClearInterrupt(pDevIns, pThis);
2516
2517	PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSectIntr);
2518
2519	break;
2520	}
2521	case BUSLOGIC_REGISTER_COMMAND:
2522	{
2523	/* Fast path for mailbox execution command. */
2524	if ((uVal == BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND) && (pThis->uOperationCode == 0xff))
2525	{
2526	/// @todo Should fail if BL_STAT_INREQ is set
2527	/* If there are no mailboxes configured, don't even try to do anything. */
2528	if (pThis->cMailbox)
2529	{
2530	ASMAtomicIncU32(&pThis->cMailboxesReady);
2531	if (!ASMAtomicXchgBool(&pThis->fNotificationSent, true))
2532	{
2533	/* Wake up the worker thread. */
2534	int rc2 = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
2535	AssertRC(rc2);
2536	}
2537	}
2538
2539	return rc;
2540	}
2541
2542	/*
2543	* Check if we are already fetch command parameters from the guest.
2544	* If not we initialize executing a new command.
2545	*/
2546	if (pThis->uOperationCode == 0xff)
2547	{
2548	pThis->uOperationCode = uVal;
2549	pThis->iParameter = 0;
2550
2551	/* Mark host adapter as busy and clear the invalid status bit. */
2552	pThis->regStatus &= ~(BL_STAT_HARDY \| BL_STAT_CMDINV);
2553
2554	/* Get the number of bytes for parameters from the command code. */
2555	switch (pThis->uOperationCode)
2556	{
2557	case BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT:
2558	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER:
2559	case BUSLOGICCOMMAND_INQUIRE_BOARD_ID:
2560	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER:
2561	case BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION:
2562	case BUSLOGICCOMMAND_INQUIRE_CONFIGURATION:
2563	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7:
2564	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15:
2565	case BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES:
2566	pThis->cbCommandParametersLeft = 0;
2567	break;
2568	case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
2569	case BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION:
2570	case BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT:
2571	case BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER:
2572	/* These commands are not on AHA-154x, some Adaptec drivers (ASPI4DOS.SYS) test them. */
2573	if (pThis->uDevType == DEV_AHA_1540B)
2574	{
2575	pThis->cbCommandParametersLeft = 0;
2576	break;
2577	}
2578	RT_FALL_THRU();
2579	case BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION:
2580	case BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE:
2581	case BUSLOGICCOMMAND_SET_CCB_FORMAT:
2582	case BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD:
2583	case BUSLOGICCOMMAND_ECHO_COMMAND_DATA:
2584	case BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT:
2585	case BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS:
2586	case BUSLOGICCOMMAND_SET_TIME_OFF_BUS:
2587	case BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE:
2588	pThis->cbCommandParametersLeft = 1;
2589	break;
2590	case BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM:
2591	pThis->cbCommandParametersLeft = 2;
2592	break;
2593	case BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO:
2594	case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
2595	pThis->cbCommandParametersLeft = 3;
2596	break;
2597	case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
2598	pThis->cbCommandParametersLeft = 4;
2599	break;
2600	case BUSLOGICCOMMAND_INITIALIZE_MAILBOX:
2601	pThis->cbCommandParametersLeft = sizeof(RequestInitMbx);
2602	break;
2603	case BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX:
2604	/* Some Adaptec drivers (ASPI4DOS.SYS) test this command. */
2605	if (pThis->uDevType == DEV_AHA_1540B)
2606	{
2607	pThis->cbCommandParametersLeft = 0;
2608	break;
2609	}
2610	pThis->cbCommandParametersLeft = sizeof(RequestInitializeExtendedMailbox);
2611	break;
2612	case BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS:
2613	/* There must be at least one byte following this command. */
2614	pThis->cbCommandParametersLeft = 1;
2615	break;
2616	case BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND:
2617	/* 12 bytes + variable-length CDB. */
2618	pThis->cbCommandParametersLeft = 12;
2619	break;
2620	case BUSLOGICCOMMAND_EXT_BIOS_INFO:
2621	case BUSLOGICCOMMAND_UNLOCK_MAILBOX:
2622	/* Invalid commands. */
2623	pThis->cbCommandParametersLeft = 0;
2624	break;
2625	case BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND: /* Should not come here anymore. */
2626	default:
2627	AssertMsgFailed(("Invalid operation code %#x\n", uVal));
2628	}
2629	}
2630	else
2631	{
2632	#ifndef IN_RING3
2633	/* This command must be executed in R3 as it rehooks the ISA I/O port. */
2634	if (pThis->uOperationCode == BUSLOGICCOMMAND_MODIFY_IO_ADDRESS)
2635	{
2636	rc = VINF_IOM_R3_IOPORT_WRITE;
2637	break;
2638	}
2639	#endif
2640	/*
2641	* The real adapter would set the Command register busy bit in the status register.
2642	* The guest has to wait until it is unset.
2643	* We don't need to do it because the guest does not continue execution while we are in this
2644	* function.
2645	*/
2646	pThis->aCommandBuffer[pThis->iParameter] = uVal;
2647	pThis->iParameter++;
2648	pThis->cbCommandParametersLeft--;
2649	}
2650
2651	/* Start execution of command if there are no parameters left. */
2652	if (!pThis->cbCommandParametersLeft)
2653	{
2654	rc = buslogicProcessCommand(pDevIns, pThis);
2655	AssertMsgRC(rc, ("Processing command failed rc=%Rrc\n", rc));
2656	}
2657	break;
2658	}
2659
2660	/* On BusLogic adapters, the interrupt and geometry registers are R/W.
2661	* That is different from Adaptec 154x where those are read only.
2662	*/
2663	case BUSLOGIC_REGISTER_INTERRUPT:
2664	if (pThis->uDevType == DEV_AHA_1540B)
2665	break;
2666	pThis->regInterrupt = uVal;
2667	break;
2668
2669	case BUSLOGIC_REGISTER_GEOMETRY:
2670	if (pThis->uDevType == DEV_AHA_1540B)
2671	break;
2672	pThis->regGeometry = uVal;
2673	break;
2674
2675	default:
2676	AssertMsgFailed(("Register not available\n"));
2677	rc = VERR_IOM_IOPORT_UNUSED;
2678	}
2679
2680	return rc;
2681	}
2682
2683	/**
2684	* @callback_method_impl{FNIOMMMIONEWREAD}
2685	*/
2686	static DECLCALLBACK(VBOXSTRICTRC) buslogicMMIORead(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void pv, unsigned cb)
2687	{
2688	RT_NOREF(pDevIns, pvUser, off, pv, cb);
2689
2690	/* the linux driver does not make use of the MMIO area. */
2691	ASSERT_GUEST_MSG_FAILED(("MMIO Read: %RGp LB %u\n", off, cb));
2692	return VINF_SUCCESS;
2693	}
2694
2695	/**
2696	* @callback_method_impl{FNIOMMMIONEWWRITE}
2697	*/
2698	static DECLCALLBACK(VBOXSTRICTRC) buslogicMMIOWrite(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void const pv, unsigned cb)
2699	{
2700	RT_NOREF(pDevIns, pvUser, off, pv, cb);
2701
2702	/* the linux driver does not make use of the MMIO area. */
2703	ASSERT_GUEST_MSG_FAILED(("MMIO Write: %RGp LB %u: %.*Rhxs\n", off, cb, cb, pv));
2704	return VINF_SUCCESS;
2705	}
2706
2707	/**
2708	* @callback_method_impl{FNIOMIOPORTNEWIN}
2709	*/
2710	static DECLCALLBACK(VBOXSTRICTRC)
2711	buslogicIOPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
2712	{
2713	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2714	unsigned iRegister = offPort % 4;
2715	RT_NOREF(pvUser, cb);
2716
2717	ASSERT_GUEST(cb == 1);
2718
2719	return buslogicRegisterRead(pDevIns, pThis, iRegister, pu32);
2720	}
2721
2722	/**
2723	* @callback_method_impl{FNIOMIOPORTNEWOUT}
2724	*/
2725	static DECLCALLBACK(VBOXSTRICTRC)
2726	buslogicIOPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
2727	{
2728	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2729	unsigned iRegister = offPort % 4;
2730	RT_NOREF(pvUser, cb);
2731
2732	ASSERT_GUEST(cb == 1);
2733
2734	int rc = buslogicRegisterWrite(pDevIns, pThis, iRegister, (uint8_t)u32);
2735
2736	Log2(("#%d %s: pvUser=%#p cb=%d u32=%#x offPort=%#x rc=%Rrc\n",
2737	pDevIns->iInstance, __FUNCTION__, pvUser, cb, u32, offPort, rc));
2738
2739	return rc;
2740	}
2741
2742	#ifdef IN_RING3
2743
2744	static int buslogicR3PrepareBIOSSCSIRequest(PBUSLOGICCC pThisCC)
2745	{
2746	uint32_t uTargetDevice;
2747	uint32_t uLun;
2748	uint8_t *pbCdb;
2749	size_t cbCdb;
2750	size_t cbBuf;
2751
2752	int rc = vboxscsiSetupRequest(&pThisCC->VBoxSCSI, &uLun, &pbCdb, &cbCdb, &cbBuf, &uTargetDevice);
2753	AssertMsgRCReturn(rc, ("Setting up SCSI request failed rc=%Rrc\n", rc), rc);
2754
2755	if ( uTargetDevice < RT_ELEMENTS(pThisCC->aDeviceStates)
2756	&& pThisCC->aDeviceStates[uTargetDevice].pDrvBase)
2757	{
2758	PBUSLOGICDEVICE pTgtDev = &pThisCC->aDeviceStates[uTargetDevice];
2759	PDMMEDIAEXIOREQ hIoReq;
2760	PBUSLOGICREQ pReq;
2761
2762	rc = pTgtDev->pDrvMediaEx->pfnIoReqAlloc(pTgtDev->pDrvMediaEx, &hIoReq, (void **)&pReq,
2763	0, PDMIMEDIAEX_F_SUSPEND_ON_RECOVERABLE_ERR);
2764	AssertMsgRCReturn(rc, ("Getting task from cache failed rc=%Rrc\n", rc), rc);
2765
2766	pReq->fBIOS = true;
2767	pReq->hIoReq = hIoReq;
2768	pReq->pTargetDevice = pTgtDev;
2769
2770	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
2771
2772	rc = pTgtDev->pDrvMediaEx->pfnIoReqSendScsiCmd(pTgtDev->pDrvMediaEx, pReq->hIoReq, uLun,
2773	pbCdb, cbCdb, PDMMEDIAEXIOREQSCSITXDIR_UNKNOWN, NULL,
2774	cbBuf, NULL, 0, NULL, &pReq->u8ScsiSts, 30 * RT_MS_1SEC);
2775	if (rc == VINF_SUCCESS \|\| rc != VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
2776	{
2777	uint8_t u8ScsiSts = pReq->u8ScsiSts;
2778	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
2779	rc = vboxscsiRequestFinished(&pThisCC->VBoxSCSI, u8ScsiSts);
2780	}
2781	else if (rc == VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
2782	rc = VINF_SUCCESS;
2783
2784	return rc;
2785	}
2786
2787	/* Device is not present. */
2788	AssertMsg(pbCdb[0] == SCSI_INQUIRY,
2789	("Device is not present but command is not inquiry\n"));
2790
2791	SCSIINQUIRYDATA ScsiInquiryData;
2792
2793	memset(&ScsiInquiryData, 0, sizeof(SCSIINQUIRYDATA));
2794	ScsiInquiryData.u5PeripheralDeviceType = SCSI_INQUIRY_DATA_PERIPHERAL_DEVICE_TYPE_UNKNOWN;
2795	ScsiInquiryData.u3PeripheralQualifier = SCSI_INQUIRY_DATA_PERIPHERAL_QUALIFIER_NOT_CONNECTED_NOT_SUPPORTED;
2796
2797	memcpy(pThisCC->VBoxSCSI.pbBuf, &ScsiInquiryData, 5);
2798
2799	rc = vboxscsiRequestFinished(&pThisCC->VBoxSCSI, SCSI_STATUS_OK);
2800	AssertMsgRCReturn(rc, ("Finishing BIOS SCSI request failed rc=%Rrc\n", rc), rc);
2801
2802	return rc;
2803	}
2804
2805
2806	/**
2807	* @callback_method_impl{FNIOMIOPORTNEWIN, BIOS port.}
2808	*/
2809	static DECLCALLBACK(VBOXSTRICTRC)
2810	buslogicR3BiosIoPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
2811	{
2812	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
2813	RT_NOREF(pvUser, cb);
2814
2815	ASSERT_GUEST(cb == 1);
2816
2817	int rc = vboxscsiReadRegister(&pThisCC->VBoxSCSI, offPort, pu32);
2818
2819	//Log2(("%s: pu32=%p:{%.*Rhxs} iRegister=%d rc=%Rrc\n", __FUNCTION__, pu32, 1, pu32, offPort, rc));
2820
2821	return rc;
2822	}
2823
2824	/**
2825	* @callback_method_impl{FNIOMIOPORTNEWOUT, BIOS port.}
2826	*/
2827	static DECLCALLBACK(VBOXSTRICTRC)
2828	buslogicR3BiosIoPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
2829	{
2830	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2831	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
2832	Log2(("#%d %s: pvUser=%#p cb=%d u32=%#x offPort=%#x\n", pDevIns->iInstance, __FUNCTION__, pvUser, cb, u32, offPort));
2833	RT_NOREF(pvUser, cb);
2834
2835	/*
2836	* If there is already a request form the BIOS pending ignore this write
2837	* because it should not happen.
2838	*/
2839	if (ASMAtomicReadBool(&pThisCC->fBiosReqPending))
2840	return VINF_SUCCESS;
2841
2842	ASSERT_GUEST(cb == 1);
2843
2844	int rc = vboxscsiWriteRegister(&pThisCC->VBoxSCSI, offPort, (uint8_t)u32);
2845	if (rc == VERR_MORE_DATA)
2846	{
2847	ASMAtomicXchgBool(&pThisCC->fBiosReqPending, true);
2848	/* Wake up the worker thread now that there are pending requests. */
2849	int rc2 = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
2850	AssertRC(rc2);
2851	rc = VINF_SUCCESS;
2852	}
2853	else if (RT_FAILURE(rc))
2854	AssertMsgFailed(("Writing BIOS register failed %Rrc\n", rc));
2855
2856	return VINF_SUCCESS;
2857	}
2858
2859	/**
2860	* @callback_method_impl{FNIOMIOPORTNEWOUTSTRING, BIOS port.}
2861	*/
2862	static DECLCALLBACK(VBOXSTRICTRC) buslogicR3BiosIoPortWriteStr(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort,
2863	uint8_t const pbSrc, uint32_t pcTransfers, unsigned cb)
2864	{
2865	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2866	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
2867	Log2(("#%d %s: pvUser=%#p cb=%d offPort=%#x\n", pDevIns->iInstance, __FUNCTION__, pvUser, cb, offPort));
2868	RT_NOREF(pvUser);
2869
2870	/*
2871	* If there is already a request form the BIOS pending ignore this write
2872	* because it should not happen.
2873	*/
2874	if (ASMAtomicReadBool(&pThisCC->fBiosReqPending))
2875	return VINF_SUCCESS;
2876
2877	int rc = vboxscsiWriteString(pDevIns, &pThisCC->VBoxSCSI, offPort, pbSrc, pcTransfers, cb);
2878	if (rc == VERR_MORE_DATA)
2879	{
2880	ASMAtomicXchgBool(&pThisCC->fBiosReqPending, true);
2881	/* Wake up the worker thread now taht there are pending requests. */
2882	int rc2 = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
2883	AssertRC(rc2);
2884	}
2885	else if (RT_FAILURE(rc))
2886	AssertMsgFailed(("Writing BIOS register failed %Rrc\n", rc));
2887
2888	return VINF_SUCCESS;
2889	}
2890
2891	/**
2892	* @callback_method_impl{FNIOMIOPORTNEWINSTRING, BIOS port.}
2893	*/
2894	static DECLCALLBACK(VBOXSTRICTRC) buslogicR3BiosIoPortReadStr(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort,
2895	uint8_t pbDst, uint32_t pcTransfers, unsigned cb)
2896	{
2897	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
2898	LogFlowFunc(("#%d %s: pvUser=%#p cb=%d offPort=%#x\n", pDevIns->iInstance, __FUNCTION__, pvUser, cb, offPort));
2899	RT_NOREF(pvUser);
2900
2901	return vboxscsiReadString(pDevIns, &pThisCC->VBoxSCSI, offPort, pbDst, pcTransfers, cb);
2902	}
2903
2904	/**
2905	* Update the ISA I/O range.
2906	*
2907	* @returns nothing.
2908	* @param pDevIns The device instance.
2909	* @param pThis Pointer to the shared BusLogic instance data.
2910	* @param uBaseCode Encoded ISA I/O base; only low 3 bits are used.
2911	*/
2912	static int buslogicR3RegisterISARange(PPDMDEVINS pDevIns, PBUSLOGIC pThis, uint8_t uBaseCode)
2913	{
2914	uint8_t uCode = uBaseCode & MAX_ISA_BASE;
2915	uint16_t uNewBase = g_aISABases[uCode];
2916	int rc = VINF_SUCCESS;
2917
2918	LogFlowFunc(("ISA I/O code %02X, new base %X\n", uBaseCode, uNewBase));
2919
2920	/* Check if the same port range actually changed. */
2921	if (uNewBase != pThis->IOISABase)
2922	{
2923	/* Unmap the old range, if necessary. */
2924	if (pThis->IOISABase)
2925	{
2926	rc = PDMDevHlpIoPortUnmap(pDevIns, pThis->hIoPortsIsa);
2927	AssertRC(rc);
2928	}
2929	if (RT_SUCCESS(rc))
2930	{
2931	pThis->IOISABase = 0; /* First mark as unregistered. */
2932	pThis->uISABaseCode = ISA_BASE_DISABLED;
2933
2934	if (uNewBase)
2935	{
2936	/* Register the new range if requested. */
2937	rc = PDMDevHlpIoPortMap(pDevIns, pThis->hIoPortsIsa, uNewBase);
2938	if (RT_SUCCESS(rc))
2939	{
2940	pThis->IOISABase = uNewBase;
2941	pThis->uISABaseCode = uCode;
2942	}
2943	}
2944	}
2945	if (RT_SUCCESS(rc))
2946	{
2947	if (uNewBase)
2948	{
2949	Log(("ISA I/O base: %x\n", uNewBase));
2950	LogRel(("BusLogic: ISA I/O base: %x\n", uNewBase));
2951	}
2952	else
2953	{
2954	Log(("Disabling ISA I/O ports.\n"));
2955	LogRel(("BusLogic: ISA I/O disabled\n"));
2956	}
2957	}
2958
2959	}
2960	return rc;
2961	}
2962
2963
2964	static int buslogicR3ReqComplete(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, PBUSLOGICREQ pReq, int rcReq)
2965	{
2966	RT_NOREF(rcReq);
2967	PBUSLOGICDEVICE pTgtDev = pReq->pTargetDevice;
2968
2969	LogFlowFunc(("before decrement %u\n", pTgtDev->cOutstandingRequests));
2970	ASMAtomicDecU32(&pTgtDev->cOutstandingRequests);
2971	LogFlowFunc(("after decrement %u\n", pTgtDev->cOutstandingRequests));
2972
2973	if (pReq->fBIOS)
2974	{
2975	uint8_t u8ScsiSts = pReq->u8ScsiSts;
2976	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
2977	int rc = vboxscsiRequestFinished(&pThisCC->VBoxSCSI, u8ScsiSts);
2978	AssertMsgRC(rc, ("Finishing BIOS SCSI request failed rc=%Rrc\n", rc));
2979	}
2980	else
2981	{
2982	if (pReq->pbSenseBuffer)
2983	buslogicR3SenseBufferFree(pReq, (pReq->u8ScsiSts != SCSI_STATUS_OK));
2984
2985	/* Update residual data length. */
2986	if ( (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
2987	\|\| (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
2988	{
2989	size_t cbResidual = 0;
2990	int rc = pTgtDev->pDrvMediaEx->pfnIoReqQueryResidual(pTgtDev->pDrvMediaEx, pReq->hIoReq, &cbResidual);
2991	AssertRC(rc); Assert(cbResidual == (uint32_t)cbResidual);
2992
2993	if (pReq->fIs24Bit)
2994	U32_TO_LEN(pReq->CCBGuest.o.acbData, (uint32_t)cbResidual);
2995	else
2996	pReq->CCBGuest.n.cbData = (uint32_t)cbResidual;
2997	}
2998
2999	/*
3000	* Save vital things from the request and free it before posting completion
3001	* to avoid that the guest submits a new request with the same ID as the still
3002	* allocated one.
3003	*/
3004	#ifdef LOG_ENABLED
3005	bool fIs24Bit = pReq->fIs24Bit;
3006	#endif
3007	uint8_t u8ScsiSts = pReq->u8ScsiSts;
3008	RTGCPHYS GCPhysAddrCCB = pReq->GCPhysAddrCCB;
3009	CCBU CCBGuest;
3010	memcpy(&CCBGuest, &pReq->CCBGuest, sizeof(CCBU));
3011
3012	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
3013	if (u8ScsiSts == SCSI_STATUS_OK)
3014	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3015	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED,
3016	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3017	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITHOUT_ERROR);
3018	else if (u8ScsiSts == SCSI_STATUS_CHECK_CONDITION)
3019	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3020	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED,
3021	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_CHECK_CONDITION,
3022	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3023	else
3024	AssertMsgFailed(("invalid completion status %u\n", u8ScsiSts));
3025
3026	#ifdef LOG_ENABLED
3027	buslogicR3DumpCCBInfo(&CCBGuest, fIs24Bit);
3028	#endif
3029	}
3030
3031	if (pTgtDev->cOutstandingRequests == 0 && pThisCC->fSignalIdle)
3032	PDMDevHlpAsyncNotificationCompleted(pDevIns);
3033
3034	return VINF_SUCCESS;
3035	}
3036
3037	/**
3038	* @interface_method_impl{PDMIMEDIAPORT,pfnQueryDeviceLocation}
3039	*/
3040	static DECLCALLBACK(int) buslogicR3QueryDeviceLocation(PPDMIMEDIAPORT pInterface, const char **ppcszController,
3041	uint32_t piInstance, uint32_t piLUN)
3042	{
3043	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaPort);
3044	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3045
3046	AssertPtrReturn(ppcszController, VERR_INVALID_POINTER);
3047	AssertPtrReturn(piInstance, VERR_INVALID_POINTER);
3048	AssertPtrReturn(piLUN, VERR_INVALID_POINTER);
3049
3050	*ppcszController = pDevIns->pReg->szName;
3051	*piInstance = pDevIns->iInstance;
3052	*piLUN = pTgtDev->iLUN;
3053
3054	return VINF_SUCCESS;
3055	}
3056
3057	/**
3058	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCopyFromBuf}
3059	*/
3060	static DECLCALLBACK(int) buslogicR3IoReqCopyFromBuf(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3061	void *pvIoReqAlloc, uint32_t offDst, PRTSGBUF pSgBuf,
3062	size_t cbCopy)
3063	{
3064	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3065	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3066	PBUSLOGICREQ pReq = (PBUSLOGICREQ)pvIoReqAlloc;
3067	RT_NOREF(hIoReq);
3068
3069	size_t cbCopied = 0;
3070	if (RT_LIKELY(!pReq->fBIOS))
3071	cbCopied = buslogicR3CopySgBufToGuest(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), pReq, pSgBuf, offDst, cbCopy);
3072	else
3073	{
3074	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3075	cbCopied = vboxscsiCopyToBuf(&pThisCC->VBoxSCSI, pSgBuf, offDst, cbCopy);
3076	}
3077	return cbCopied == cbCopy ? VINF_SUCCESS : VERR_PDM_MEDIAEX_IOBUF_OVERFLOW;
3078	}
3079
3080	/**
3081	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCopyToBuf}
3082	*/
3083	static DECLCALLBACK(int) buslogicR3IoReqCopyToBuf(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3084	void *pvIoReqAlloc, uint32_t offSrc, PRTSGBUF pSgBuf,
3085	size_t cbCopy)
3086	{
3087	RT_NOREF(hIoReq);
3088	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3089	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3090	PBUSLOGICREQ pReq = (PBUSLOGICREQ)pvIoReqAlloc;
3091
3092	size_t cbCopied = 0;
3093	if (RT_LIKELY(!pReq->fBIOS))
3094	cbCopied = buslogicR3CopySgBufFromGuest(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), pReq, pSgBuf, offSrc, cbCopy);
3095	else
3096	{
3097	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3098	cbCopied = vboxscsiCopyFromBuf(&pThisCC->VBoxSCSI, pSgBuf, offSrc, cbCopy);
3099	}
3100	return cbCopied == cbCopy ? VINF_SUCCESS : VERR_PDM_MEDIAEX_IOBUF_UNDERRUN;
3101	}
3102
3103	/**
3104	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCompleteNotify}
3105	*/
3106	static DECLCALLBACK(int) buslogicR3IoReqCompleteNotify(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3107	void *pvIoReqAlloc, int rcReq)
3108	{
3109	RT_NOREF(hIoReq);
3110	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3111	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3112	buslogicR3ReqComplete(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC),
3113	(PBUSLOGICREQ)pvIoReqAlloc, rcReq);
3114	return VINF_SUCCESS;
3115	}
3116
3117	/**
3118	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqStateChanged}
3119	*/
3120	static DECLCALLBACK(void) buslogicR3IoReqStateChanged(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3121	void *pvIoReqAlloc, PDMMEDIAEXIOREQSTATE enmState)
3122	{
3123	RT_NOREF(hIoReq, pvIoReqAlloc, enmState);
3124	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3125
3126	switch (enmState)
3127	{
3128	case PDMMEDIAEXIOREQSTATE_SUSPENDED:
3129	{
3130	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3131	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3132
3133	/* Make sure the request is not accounted for so the VM can suspend successfully. */
3134	uint32_t cTasksActive = ASMAtomicDecU32(&pTgtDev->cOutstandingRequests);
3135	if (!cTasksActive && pThisCC->fSignalIdle)
3136	PDMDevHlpAsyncNotificationCompleted(pDevIns);
3137	break;
3138	}
3139	case PDMMEDIAEXIOREQSTATE_ACTIVE:
3140	/* Make sure the request is accounted for so the VM suspends only when the request is complete. */
3141	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3142	break;
3143	default:
3144	AssertMsgFailed(("Invalid request state given %u\n", enmState));
3145	}
3146	}
3147
3148	/**
3149	* @interface_method_impl{PDMIMEDIAEXPORT,pfnMediumEjected}
3150	*/
3151	static DECLCALLBACK(void) buslogicR3MediumEjected(PPDMIMEDIAEXPORT pInterface)
3152	{
3153	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3154	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3155	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3156
3157	if (pThisCC->pMediaNotify)
3158	{
3159	int rc = VMR3ReqCallNoWait(PDMDevHlpGetVM(pDevIns), VMCPUID_ANY,
3160	(PFNRT)pThisCC->pMediaNotify->pfnEjected, 2,
3161	pThisCC->pMediaNotify, pTgtDev->iLUN);
3162	AssertRC(rc);
3163	}
3164	}
3165
3166	static int buslogicR3DeviceSCSIRequestSetup(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, RTGCPHYS GCPhysAddrCCB)
3167	{
3168	int rc = VINF_SUCCESS;
3169	uint8_t uTargetIdCCB;
3170	CCBU CCBGuest;
3171
3172	/* Fetch the CCB from guest memory. */
3173	/** @todo How much do we really have to read? */
3174	PDMDevHlpPhysRead(pDevIns, GCPhysAddrCCB,
3175	&CCBGuest, sizeof(CCB32));
3176
3177	uTargetIdCCB = pThis->fMbxIs24Bit ? CCBGuest.o.uTargetId : CCBGuest.n.uTargetId;
3178	if (RT_LIKELY(uTargetIdCCB < RT_ELEMENTS(pThisCC->aDeviceStates)))
3179	{
3180	PBUSLOGICDEVICE pTgtDev = &pThisCC->aDeviceStates[uTargetIdCCB];
3181
3182	#ifdef LOG_ENABLED
3183	buslogicR3DumpCCBInfo(&CCBGuest, pThis->fMbxIs24Bit);
3184	#endif
3185
3186	/* Check if device is present on bus. If not return error immediately and don't process this further. */
3187	if (RT_LIKELY(pTgtDev->fPresent))
3188	{
3189	PDMMEDIAEXIOREQ hIoReq;
3190	PBUSLOGICREQ pReq;
3191	rc = pTgtDev->pDrvMediaEx->pfnIoReqAlloc(pTgtDev->pDrvMediaEx, &hIoReq, (void **)&pReq,
3192	GCPhysAddrCCB, PDMIMEDIAEX_F_SUSPEND_ON_RECOVERABLE_ERR);
3193	if (RT_SUCCESS(rc))
3194	{
3195	pReq->pTargetDevice = pTgtDev;
3196	pReq->GCPhysAddrCCB = GCPhysAddrCCB;
3197	pReq->fBIOS = false;
3198	pReq->hIoReq = hIoReq;
3199	pReq->fIs24Bit = pThis->fMbxIs24Bit;
3200
3201	/* Make a copy of the CCB */
3202	memcpy(&pReq->CCBGuest, &CCBGuest, sizeof(CCBGuest));
3203
3204	/* Alloc required buffers. */
3205	rc = buslogicR3SenseBufferAlloc(pReq);
3206	AssertMsgRC(rc, ("Mapping sense buffer failed rc=%Rrc\n", rc));
3207
3208	size_t cbBuf = 0;
3209	rc = buslogicR3QueryDataBufferSize(pDevIns, &pReq->CCBGuest, pReq->fIs24Bit, &cbBuf);
3210	AssertRC(rc);
3211
3212	uint32_t uLun = pReq->fIs24Bit ? pReq->CCBGuest.o.uLogicalUnit
3213	: pReq->CCBGuest.n.uLogicalUnit;
3214
3215	PDMMEDIAEXIOREQSCSITXDIR enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_UNKNOWN;
3216	size_t cbSense = buslogicR3ConvertSenseBufferLength(CCBGuest.c.cbSenseData);
3217
3218	if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_NO_DATA)
3219	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_NONE;
3220	else if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_OUT)
3221	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_TO_DEVICE;
3222	else if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_IN)
3223	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_FROM_DEVICE;
3224
3225	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3226	rc = pTgtDev->pDrvMediaEx->pfnIoReqSendScsiCmd(pTgtDev->pDrvMediaEx, pReq->hIoReq, uLun,
3227	&pReq->CCBGuest.c.abCDB[0], pReq->CCBGuest.c.cbCDB,
3228	enmXferDir, NULL, cbBuf, pReq->pbSenseBuffer, cbSense, NULL,
3229	&pReq->u8ScsiSts, 30 * RT_MS_1SEC);
3230	if (rc != VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
3231	buslogicR3ReqComplete(pDevIns, pThis, pThisCC, pReq, rc);
3232	}
3233	else
3234	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3235	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT,
3236	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3237	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3238	}
3239	else
3240	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3241	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT,
3242	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3243	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3244	}
3245	else
3246	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3247	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER,
3248	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3249	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3250
3251	return rc;
3252	}
3253
3254	static int buslogicR3DeviceSCSIRequestAbort(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhysAddrCCB)
3255	{
3256	uint8_t uTargetIdCCB;
3257	CCBU CCBGuest;
3258
3259	PDMDevHlpPhysRead(pDevIns, GCPhysAddrCCB,
3260	&CCBGuest, sizeof(CCB32));
3261
3262	uTargetIdCCB = pThis->fMbxIs24Bit ? CCBGuest.o.uTargetId : CCBGuest.n.uTargetId;
3263	if (RT_LIKELY(uTargetIdCCB < RT_ELEMENTS(pThis->afDevicePresent)))
3264	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3265	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED,
3266	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3267	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND);
3268	else
3269	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3270	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER,
3271	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3272	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3273
3274	return VINF_SUCCESS;
3275	}
3276
3277	/**
3278	* Read a mailbox from guest memory. Convert 24-bit mailboxes to
3279	* 32-bit format.
3280	*
3281	* @returns Mailbox guest physical address.
3282	* @param pDevIns The device instance.
3283	* @param pThis Pointer to the shared BusLogic instance data.
3284	* @param pMbx Pointer to the mailbox to read into.
3285	*/
3286	static RTGCPHYS buslogicR3ReadOutgoingMailbox(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PMailbox32 pMbx)
3287	{
3288	RTGCPHYS GCMailbox;
3289
3290	if (pThis->fMbxIs24Bit)
3291	{
3292	Mailbox24 Mbx24;
3293
3294	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->uMailboxOutgoingPositionCurrent * sizeof(Mailbox24));
3295	PDMDevHlpPhysRead(pDevIns, GCMailbox, &Mbx24, sizeof(Mailbox24));
3296	pMbx->u32PhysAddrCCB = ADDR_TO_U32(Mbx24.aPhysAddrCCB);
3297	pMbx->u.out.uActionCode = Mbx24.uCmdState;
3298	}
3299	else
3300	{
3301	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->uMailboxOutgoingPositionCurrent * sizeof(Mailbox32));
3302	PDMDevHlpPhysRead(pDevIns, GCMailbox, pMbx, sizeof(Mailbox32));
3303	}
3304
3305	return GCMailbox;
3306	}
3307
3308	/**
3309	* Read mailbox from the guest and execute command.
3310	*
3311	* @returns VBox status code.
3312	* @param pDevIns The device instance.
3313	* @param pThis Pointer to the shared BusLogic instance data.
3314	* @param pThisCC Pointer to the ring-3 BusLogic instance data.
3315	*/
3316	static int buslogicR3ProcessMailboxNext(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC)
3317	{
3318	RTGCPHYS GCPhysAddrMailboxCurrent;
3319	Mailbox32 MailboxGuest;
3320	int rc = VINF_SUCCESS;
3321
3322	if (!pThis->fStrictRoundRobinMode)
3323	{
3324	/* Search for a filled mailbox - stop if we have scanned all mailboxes. */
3325	uint8_t uMailboxPosCur = pThis->uMailboxOutgoingPositionCurrent;
3326
3327	do
3328	{
3329	/* Fetch mailbox from guest memory. */
3330	GCPhysAddrMailboxCurrent = buslogicR3ReadOutgoingMailbox(pDevIns, pThis, &MailboxGuest);
3331
3332	/* Check the next mailbox. */
3333	buslogicR3OutgoingMailboxAdvance(pThis);
3334	} while ( MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE
3335	&& uMailboxPosCur != pThis->uMailboxOutgoingPositionCurrent);
3336	}
3337	else
3338	{
3339	/* Fetch mailbox from guest memory. */
3340	GCPhysAddrMailboxCurrent = buslogicR3ReadOutgoingMailbox(pDevIns, pThis, &MailboxGuest);
3341	}
3342
3343	/*
3344	* Check if the mailbox is actually loaded.
3345	* It might be possible that the guest notified us without
3346	* a loaded mailbox. Do nothing in that case but leave a
3347	* log entry.
3348	*/
3349	if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE)
3350	{
3351	Log(("No loaded mailbox left\n"));
3352	return VERR_NO_DATA;
3353	}
3354
3355	LogFlow(("Got loaded mailbox at slot %u, CCB phys %RGp\n", pThis->uMailboxOutgoingPositionCurrent, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB));
3356	#ifdef LOG_ENABLED
3357	buslogicR3DumpMailboxInfo(&MailboxGuest, true);
3358	#endif
3359
3360	/* We got the mailbox, mark it as free in the guest. */
3361	uint8_t uActionCode = BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE;
3362	unsigned uCodeOffs = pThis->fMbxIs24Bit ? RT_OFFSETOF(Mailbox24, uCmdState) : RT_OFFSETOF(Mailbox32, u.out.uActionCode);
3363	blPhysWrite(pDevIns, pThis, GCPhysAddrMailboxCurrent + uCodeOffs, &uActionCode, sizeof(uActionCode));
3364
3365	if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_START_COMMAND)
3366	rc = buslogicR3DeviceSCSIRequestSetup(pDevIns, pThis, pThisCC, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB);
3367	else if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND)
3368	{
3369	LogFlow(("Aborting mailbox\n"));
3370	rc = buslogicR3DeviceSCSIRequestAbort(pDevIns, pThis, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB);
3371	}
3372	else
3373	AssertMsgFailed(("Invalid outgoing mailbox action code %u\n", MailboxGuest.u.out.uActionCode));
3374
3375	AssertRC(rc);
3376
3377	/* Advance to the next mailbox. */
3378	if (pThis->fStrictRoundRobinMode)
3379	buslogicR3OutgoingMailboxAdvance(pThis);
3380
3381	return rc;
3382	}
3383
3384	/** @callback_method_impl{FNSSMDEVLIVEEXEC} */
3385	static DECLCALLBACK(int) buslogicR3LiveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass)
3386	{
3387	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3388	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3389	RT_NOREF(uPass);
3390
3391	/* Save the device config. */
3392	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3393	pHlp->pfnSSMPutBool(pSSM, pThisCC->aDeviceStates[i].fPresent);
3394
3395	return VINF_SSM_DONT_CALL_AGAIN;
3396	}
3397
3398	/** @callback_method_impl{FNSSMDEVSAVEEXEC} */
3399	static DECLCALLBACK(int) buslogicR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3400	{
3401	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3402	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3403	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3404	uint32_t cReqsSuspended = 0;
3405
3406	/* Every device first. */
3407	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3408	{
3409	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3410
3411	AssertMsg(!pDevice->cOutstandingRequests,
3412	("There are still outstanding requests on this device\n"));
3413	pHlp->pfnSSMPutBool(pSSM, pDevice->fPresent);
3414	pHlp->pfnSSMPutU32(pSSM, pDevice->cOutstandingRequests);
3415
3416	if (pDevice->fPresent)
3417	cReqsSuspended += pDevice->pDrvMediaEx->pfnIoReqGetSuspendedCount(pDevice->pDrvMediaEx);
3418	}
3419	/* Now the main device state. */
3420	pHlp->pfnSSMPutU8 (pSSM, pThis->regStatus);
3421	pHlp->pfnSSMPutU8 (pSSM, pThis->regInterrupt);
3422	pHlp->pfnSSMPutU8 (pSSM, pThis->regGeometry);
3423	pHlp->pfnSSMPutMem (pSSM, &pThis->LocalRam, sizeof(pThis->LocalRam));
3424	pHlp->pfnSSMPutU8 (pSSM, pThis->uOperationCode);
3425	pHlp->pfnSSMPutMem (pSSM, &pThis->aCommandBuffer, sizeof(pThis->aCommandBuffer));
3426	pHlp->pfnSSMPutU8 (pSSM, pThis->iParameter);
3427	pHlp->pfnSSMPutU8 (pSSM, pThis->cbCommandParametersLeft);
3428	pHlp->pfnSSMPutBool (pSSM, pThis->fUseLocalRam);
3429	pHlp->pfnSSMPutMem (pSSM, pThis->aReplyBuffer, sizeof(pThis->aReplyBuffer));
3430	pHlp->pfnSSMPutU8 (pSSM, pThis->iReply);
3431	pHlp->pfnSSMPutU8 (pSSM, pThis->cbReplyParametersLeft);
3432	pHlp->pfnSSMPutBool (pSSM, pThis->fIRQEnabled);
3433	pHlp->pfnSSMPutU8 (pSSM, pThis->uISABaseCode);
3434	pHlp->pfnSSMPutU32 (pSSM, pThis->cMailbox);
3435	pHlp->pfnSSMPutBool (pSSM, pThis->fMbxIs24Bit);
3436	pHlp->pfnSSMPutGCPhys(pSSM, pThis->GCPhysAddrMailboxOutgoingBase);
3437	pHlp->pfnSSMPutU32 (pSSM, pThis->uMailboxOutgoingPositionCurrent);
3438	pHlp->pfnSSMPutU32 (pSSM, pThis->cMailboxesReady);
3439	pHlp->pfnSSMPutBool (pSSM, pThis->fNotificationSent);
3440	pHlp->pfnSSMPutGCPhys(pSSM, pThis->GCPhysAddrMailboxIncomingBase);
3441	pHlp->pfnSSMPutU32 (pSSM, pThis->uMailboxIncomingPositionCurrent);
3442	pHlp->pfnSSMPutBool (pSSM, pThis->fStrictRoundRobinMode);
3443	pHlp->pfnSSMPutBool (pSSM, pThis->fExtendedLunCCBFormat);
3444
3445	vboxscsiR3SaveExec(pDevIns->pHlpR3, &pThisCC->VBoxSCSI, pSSM);
3446
3447	pHlp->pfnSSMPutU32(pSSM, cReqsSuspended);
3448
3449	/* Save the physical CCB address of all suspended requests. */
3450	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates) && cReqsSuspended; i++)
3451	{
3452	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3453	if (pDevice->fPresent)
3454	{
3455	uint32_t cThisReqsSuspended = pDevice->pDrvMediaEx->pfnIoReqGetSuspendedCount(pDevice->pDrvMediaEx);
3456
3457	cReqsSuspended -= cThisReqsSuspended;
3458	if (cThisReqsSuspended)
3459	{
3460	PDMMEDIAEXIOREQ hIoReq;
3461	PBUSLOGICREQ pReq;
3462	int rc = pDevice->pDrvMediaEx->pfnIoReqQuerySuspendedStart(pDevice->pDrvMediaEx, &hIoReq,
3463	(void **)&pReq);
3464	AssertRCBreak(rc);
3465
3466	for (;;)
3467	{
3468	pHlp->pfnSSMPutU32(pSSM, (uint32_t)pReq->GCPhysAddrCCB);
3469
3470	cThisReqsSuspended--;
3471	if (!cThisReqsSuspended)
3472	break;
3473
3474	rc = pDevice->pDrvMediaEx->pfnIoReqQuerySuspendedNext(pDevice->pDrvMediaEx, hIoReq,
3475	&hIoReq, (void **)&pReq);
3476	AssertRCBreak(rc);
3477	}
3478	}
3479	}
3480	}
3481
3482	return pHlp->pfnSSMPutU32(pSSM, UINT32_MAX);
3483	}
3484
3485	/** @callback_method_impl{FNSSMDEVLOADDONE} */
3486	static DECLCALLBACK(int) buslogicR3LoadDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3487	{
3488	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3489	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3490	RT_NOREF(pSSM);
3491
3492	buslogicR3RegisterISARange(pDevIns, pThis, pThis->uISABaseCode);
3493
3494	/* Kick of any requests we might need to redo. */
3495	if (pThisCC->VBoxSCSI.fBusy)
3496	{
3497
3498	/* The BIOS had a request active when we got suspended. Resume it. */
3499	int rc = buslogicR3PrepareBIOSSCSIRequest(pThisCC);
3500	AssertRC(rc);
3501	}
3502	else if (pThisCC->cReqsRedo)
3503	{
3504	for (unsigned i = 0; i < pThisCC->cReqsRedo; i++)
3505	{
3506	int rc = buslogicR3DeviceSCSIRequestSetup(pDevIns, pThis, pThisCC, pThisCC->paGCPhysAddrCCBRedo[i]);
3507	AssertRC(rc);
3508	}
3509
3510	RTMemFree(pThisCC->paGCPhysAddrCCBRedo);
3511	pThisCC->paGCPhysAddrCCBRedo = NULL;
3512	pThisCC->cReqsRedo = 0;
3513	}
3514
3515	return VINF_SUCCESS;
3516	}
3517
3518	/** @callback_method_impl{FNSSMDEVLOADEXEC} */
3519	static DECLCALLBACK(int) buslogicR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
3520	{
3521	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3522	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3523	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3524	int rc = VINF_SUCCESS;
3525
3526	/* We support saved states only from this and older versions. */
3527	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_VERSION)
3528	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
3529
3530	/* Every device first. */
3531	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3532	{
3533	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3534
3535	AssertMsg(!pDevice->cOutstandingRequests,
3536	("There are still outstanding requests on this device\n"));
3537	bool fPresent;
3538	rc = pHlp->pfnSSMGetBool(pSSM, &fPresent);
3539	AssertRCReturn(rc, rc);
3540	if (pDevice->fPresent != fPresent)
3541	return pHlp->pfnSSMSetCfgError(pSSM, RT_SRC_POS, N_("Target %u config mismatch: config=%RTbool state=%RTbool"), i, pDevice->fPresent, fPresent);
3542
3543	if (uPass == SSM_PASS_FINAL)
3544	pHlp->pfnSSMGetU32V(pSSM, &pDevice->cOutstandingRequests);
3545	}
3546
3547	if (uPass != SSM_PASS_FINAL)
3548	return VINF_SUCCESS;
3549
3550	/* Now the main device state. */
3551	pHlp->pfnSSMGetU8V (pSSM, &pThis->regStatus);
3552	pHlp->pfnSSMGetU8V (pSSM, &pThis->regInterrupt);
3553	pHlp->pfnSSMGetU8V (pSSM, &pThis->regGeometry);
3554	pHlp->pfnSSMGetMem (pSSM, &pThis->LocalRam, sizeof(pThis->LocalRam));
3555	pHlp->pfnSSMGetU8 (pSSM, &pThis->uOperationCode);
3556	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE)
3557	pHlp->pfnSSMGetMem(pSSM, &pThis->aCommandBuffer, sizeof(pThis->aCommandBuffer));
3558	else
3559	pHlp->pfnSSMGetMem(pSSM, &pThis->aCommandBuffer, BUSLOGIC_COMMAND_SIZE_OLD);
3560	pHlp->pfnSSMGetU8 (pSSM, &pThis->iParameter);
3561	pHlp->pfnSSMGetU8 (pSSM, &pThis->cbCommandParametersLeft);
3562	pHlp->pfnSSMGetBool (pSSM, &pThis->fUseLocalRam);
3563	pHlp->pfnSSMGetMem (pSSM, pThis->aReplyBuffer, sizeof(pThis->aReplyBuffer));
3564	pHlp->pfnSSMGetU8 (pSSM, &pThis->iReply);
3565	pHlp->pfnSSMGetU8 (pSSM, &pThis->cbReplyParametersLeft);
3566	pHlp->pfnSSMGetBool (pSSM, &pThis->fIRQEnabled);
3567	pHlp->pfnSSMGetU8 (pSSM, &pThis->uISABaseCode);
3568	pHlp->pfnSSMGetU32 (pSSM, &pThis->cMailbox);
3569	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX)
3570	pHlp->pfnSSMGetBool(pSSM, &pThis->fMbxIs24Bit);
3571	pHlp->pfnSSMGetGCPhys(pSSM, &pThis->GCPhysAddrMailboxOutgoingBase);
3572	pHlp->pfnSSMGetU32 (pSSM, &pThis->uMailboxOutgoingPositionCurrent);
3573	pHlp->pfnSSMGetU32V (pSSM, &pThis->cMailboxesReady);
3574	pHlp->pfnSSMGetBoolV (pSSM, &pThis->fNotificationSent);
3575	pHlp->pfnSSMGetGCPhys(pSSM, &pThis->GCPhysAddrMailboxIncomingBase);
3576	pHlp->pfnSSMGetU32 (pSSM, &pThis->uMailboxIncomingPositionCurrent);
3577	pHlp->pfnSSMGetBool (pSSM, &pThis->fStrictRoundRobinMode);
3578	pHlp->pfnSSMGetBool (pSSM, &pThis->fExtendedLunCCBFormat);
3579
3580	rc = vboxscsiR3LoadExec(pDevIns->pHlpR3, &pThisCC->VBoxSCSI, pSSM);
3581	if (RT_FAILURE(rc))
3582	{
3583	LogRel(("BusLogic: Failed to restore BIOS state: %Rrc.\n", rc));
3584	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic: Failed to restore BIOS state\n"));
3585	}
3586
3587	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_ERROR_HANDLING)
3588	{
3589	/* Check if there are pending tasks saved. */
3590	uint32_t cTasks = 0;
3591
3592	pHlp->pfnSSMGetU32(pSSM, &cTasks);
3593
3594	if (cTasks)
3595	{
3596	pThisCC->paGCPhysAddrCCBRedo = (PRTGCPHYS)RTMemAllocZ(cTasks * sizeof(RTGCPHYS));
3597	if (RT_LIKELY(pThisCC->paGCPhysAddrCCBRedo))
3598	{
3599	pThisCC->cReqsRedo = cTasks;
3600
3601	for (uint32_t i = 0; i < cTasks; i++)
3602	{
3603	uint32_t u32PhysAddrCCB;
3604
3605	rc = pHlp->pfnSSMGetU32(pSSM, &u32PhysAddrCCB);
3606	AssertRCBreak(rc);
3607
3608	pThisCC->paGCPhysAddrCCBRedo[i] = u32PhysAddrCCB;
3609	}
3610	}
3611	else
3612	rc = VERR_NO_MEMORY;
3613	}
3614	}
3615
3616	if (RT_SUCCESS(rc))
3617	{
3618	uint32_t u32;
3619	rc = pHlp->pfnSSMGetU32(pSSM, &u32);
3620	if (RT_SUCCESS(rc))
3621	AssertMsgReturn(u32 == UINT32_MAX, ("%#x\n", u32), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
3622	}
3623
3624	return rc;
3625	}
3626
3627	/**
3628	* Gets the pointer to the status LED of a device - called from the SCSI driver.
3629	*
3630	* @returns VBox status code.
3631	* @param pInterface Pointer to the interface structure containing the called function pointer.
3632	* @param iLUN The unit which status LED we desire. Always 0 here as the driver
3633	* doesn't know about other LUN's.
3634	* @param ppLed Where to store the LED pointer.
3635	*/
3636	static DECLCALLBACK(int) buslogicR3DeviceQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3637	{
3638	PBUSLOGICDEVICE pDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, ILed);
3639	if (iLUN == 0)
3640	{
3641	*ppLed = &pDevice->Led;
3642	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
3643	return VINF_SUCCESS;
3644	}
3645	return VERR_PDM_LUN_NOT_FOUND;
3646	}
3647
3648	/**
3649	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
3650	*/
3651	static DECLCALLBACK(void ) buslogicR3DeviceQueryInterface(PPDMIBASE pInterface, const char pszIID)
3652	{
3653	PBUSLOGICDEVICE pDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IBase);
3654	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pDevice->IBase);
3655	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAPORT, &pDevice->IMediaPort);
3656	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAEXPORT, &pDevice->IMediaExPort);
3657	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pDevice->ILed);
3658	return NULL;
3659	}
3660
3661	/**
3662	* Gets the pointer to the status LED of a unit.
3663	*
3664	* @returns VBox status code.
3665	* @param pInterface Pointer to the interface structure containing the called function pointer.
3666	* @param iLUN The unit which status LED we desire.
3667	* @param ppLed Where to store the LED pointer.
3668	*/
3669	static DECLCALLBACK(int) buslogicR3StatusQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3670	{
3671	PBUSLOGICCC pThisCC = RT_FROM_MEMBER(pInterface, BUSLOGICCC, ILeds);
3672	if (iLUN < BUSLOGIC_MAX_DEVICES)
3673	{
3674	*ppLed = &pThisCC->aDeviceStates[iLUN].Led;
3675	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
3676	return VINF_SUCCESS;
3677	}
3678	return VERR_PDM_LUN_NOT_FOUND;
3679	}
3680
3681	/**
3682	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
3683	*/
3684	static DECLCALLBACK(void ) buslogicR3StatusQueryInterface(PPDMIBASE pInterface, const char pszIID)
3685	{
3686	PBUSLOGICCC pThisCC = RT_FROM_MEMBER(pInterface, BUSLOGICCC, IBase);
3687	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThisCC->IBase);
3688	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThisCC->ILeds);
3689	return NULL;
3690	}
3691
3692	/**
3693	* @callback_method_impl{FNPDMTHREADWAKEUPDEV}
3694	*/
3695	static DECLCALLBACK(int) buslogicR3Worker(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3696	{
3697	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3698	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3699
3700	if (pThread->enmState == PDMTHREADSTATE_INITIALIZING)
3701	return VINF_SUCCESS;
3702
3703	while (pThread->enmState == PDMTHREADSTATE_RUNNING)
3704	{
3705	int rc;
3706
3707	ASMAtomicWriteBool(&pThisCC->fWrkThreadSleeping, true);
3708	bool fNotificationSent = ASMAtomicXchgBool(&pThis->fNotificationSent, false);
3709	if (!fNotificationSent)
3710	{
3711	Assert(ASMAtomicReadBool(&pThisCC->fWrkThreadSleeping));
3712	rc = PDMDevHlpSUPSemEventWaitNoResume(pDevIns, pThis->hEvtProcess, RT_INDEFINITE_WAIT);
3713	AssertLogRelMsgReturn(RT_SUCCESS(rc) \|\| rc == VERR_INTERRUPTED, ("%Rrc\n", rc), rc);
3714	if (RT_UNLIKELY(pThread->enmState != PDMTHREADSTATE_RUNNING))
3715	break;
3716	LogFlowFunc(("Woken up with rc=%Rrc\n", rc));
3717	ASMAtomicWriteBool(&pThis->fNotificationSent, false);
3718	}
3719
3720	ASMAtomicWriteBool(&pThisCC->fWrkThreadSleeping, false);
3721
3722	/* Check whether there is a BIOS request pending and process it first. */
3723	if (ASMAtomicReadBool(&pThisCC->fBiosReqPending))
3724	{
3725	rc = buslogicR3PrepareBIOSSCSIRequest(pThisCC);
3726	AssertRC(rc);
3727	ASMAtomicXchgBool(&pThisCC->fBiosReqPending, false);
3728	}
3729	else
3730	{
3731	ASMAtomicXchgU32(&pThis->cMailboxesReady, 0); /** @todo Actually not required anymore but to stay compatible with older saved states. */
3732
3733	/* Process mailboxes. */
3734	do
3735	{
3736	rc = buslogicR3ProcessMailboxNext(pDevIns, pThis, pThisCC);
3737	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_NO_DATA, ("Processing mailbox failed rc=%Rrc\n", rc));
3738	} while (RT_SUCCESS(rc));
3739	}
3740	} /* While running */
3741
3742	return VINF_SUCCESS;
3743	}
3744
3745
3746	/**
3747	* @callback_method_impl{FNPDMTHREADWAKEUPDEV}
3748	*/
3749	static DECLCALLBACK(int) buslogicR3WorkerWakeUp(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3750	{
3751	RT_NOREF(pThread);
3752	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3753	return PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
3754	}
3755
3756	/**
3757	* BusLogic debugger info callback.
3758	*
3759	* @param pDevIns The device instance.
3760	* @param pHlp The output helpers.
3761	* @param pszArgs The arguments.
3762	*/
3763	static DECLCALLBACK(void) buslogicR3Info(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
3764	{
3765	static const char *apszModels[] = { "BusLogic BT-958D", "BusLogic BT-545C", "Adaptec AHA-1540B" };
3766	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3767	unsigned i;
3768	bool fVerbose = false;
3769
3770	/* Parse arguments. */
3771	if (pszArgs)
3772	fVerbose = strstr(pszArgs, "verbose") != NULL;
3773
3774	/* Show basic information. */
3775	pHlp->pfnPrintf(pHlp, "%s#%d: %s ",
3776	pDevIns->pReg->szName,
3777	pDevIns->iInstance,
3778	pThis->uDevType >= RT_ELEMENTS(apszModels) ? "Uknown model" : apszModels[pThis->uDevType]);
3779	if (pThis->uIsaIrq)
3780	pHlp->pfnPrintf(pHlp, "ISA I/O=%RTiop IRQ=%u ",
3781	pThis->IOISABase,
3782	pThis->uIsaIrq);
3783	else
3784	pHlp->pfnPrintf(pHlp, "PCI I/O=%04x ISA I/O=%RTiop MMIO=%RGp IRQ=%u ",
3785	PDMDevHlpIoPortGetMappingAddress(pDevIns, pThis->hIoPortsPci), pThis->IOISABase,
3786	PDMDevHlpMmioGetMappingAddress(pDevIns, pThis->hMmio),
3787	PCIDevGetInterruptLine(pDevIns->apPciDevs[0]));
3788	pHlp->pfnPrintf(pHlp, "RC=%RTbool R0=%RTbool\n", pDevIns->fRCEnabled, pDevIns->fR0Enabled);
3789
3790	/* Print mailbox state. */
3791	if (pThis->regStatus & BL_STAT_INREQ)
3792	pHlp->pfnPrintf(pHlp, "Mailbox not initialized\n");
3793	else
3794	pHlp->pfnPrintf(pHlp, "%u-bit mailbox with %u entries at %RGp (%d LUN CCBs)\n",
3795	pThis->fMbxIs24Bit ? 24 : 32, pThis->cMailbox,
3796	pThis->GCPhysAddrMailboxOutgoingBase,
3797	pThis->fMbxIs24Bit ? 8 : pThis->fExtendedLunCCBFormat ? 64 : 8);
3798
3799	/* Print register contents. */
3800	pHlp->pfnPrintf(pHlp, "Registers: STAT=%02x INTR=%02x GEOM=%02x\n",
3801	pThis->regStatus, pThis->regInterrupt, pThis->regGeometry);
3802
3803	/* Print miscellaneous state. */
3804	pHlp->pfnPrintf(pHlp, "HAC interrupts: %s\n",
3805	pThis->fIRQEnabled ? "on" : "off");
3806
3807	/* Print the current command, if any. */
3808	if (pThis->uOperationCode != 0xff )
3809	pHlp->pfnPrintf(pHlp, "Current command: %02X\n", pThis->uOperationCode);
3810
3811	if (fVerbose && (pThis->regStatus & BL_STAT_INREQ) == 0)
3812	{
3813	RTGCPHYS GCMailbox;
3814
3815	/* Dump the mailbox contents. */
3816	if (pThis->fMbxIs24Bit)
3817	{
3818	Mailbox24 Mbx24;
3819
3820	/* Outgoing mailbox, 24-bit format. */
3821	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase;
3822	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (24-bit) at %06X:\n", GCMailbox);
3823	for (i = 0; i < pThis->cMailbox; ++i)
3824	{
3825	PDMDevHlpPhysRead(pDevIns, GCMailbox, &Mbx24, sizeof(Mailbox24));
3826	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %06X action code %02X", i, ADDR_TO_U32(Mbx24.aPhysAddrCCB), Mbx24.uCmdState);
3827	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3828	GCMailbox += sizeof(Mailbox24);
3829	}
3830
3831	/* Incoming mailbox, 24-bit format. */
3832	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox24));
3833	pHlp->pfnPrintf(pHlp, " Incoming mailbox entries (24-bit) at %06X:\n", GCMailbox);
3834	for (i = 0; i < pThis->cMailbox; ++i)
3835	{
3836	PDMDevHlpPhysRead(pDevIns, GCMailbox, &Mbx24, sizeof(Mailbox24));
3837	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %06X completion code %02X", i, ADDR_TO_U32(Mbx24.aPhysAddrCCB), Mbx24.uCmdState);
3838	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxIncomingPositionCurrent == i ? " *" : "");
3839	GCMailbox += sizeof(Mailbox24);
3840	}
3841
3842	}
3843	else
3844	{
3845	Mailbox32 Mbx32;
3846
3847	/* Outgoing mailbox, 32-bit format. */
3848	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase;
3849	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (32-bit) at %08X:\n", (uint32_t)GCMailbox);
3850	for (i = 0; i < pThis->cMailbox; ++i)
3851	{
3852	PDMDevHlpPhysRead(pDevIns, GCMailbox, &Mbx32, sizeof(Mailbox32));
3853	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %08X action code %02X", i, Mbx32.u32PhysAddrCCB, Mbx32.u.out.uActionCode);
3854	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3855	GCMailbox += sizeof(Mailbox32);
3856	}
3857
3858	/* Incoming mailbox, 32-bit format. */
3859	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox32));
3860	pHlp->pfnPrintf(pHlp, " Incoming mailbox entries (32-bit) at %08X:\n", (uint32_t)GCMailbox);
3861	for (i = 0; i < pThis->cMailbox; ++i)
3862	{
3863	PDMDevHlpPhysRead(pDevIns, GCMailbox, &Mbx32, sizeof(Mailbox32));
3864	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %08X completion code %02X BTSTAT %02X SDSTAT %02X", i,
3865	Mbx32.u32PhysAddrCCB, Mbx32.u.in.uCompletionCode, Mbx32.u.in.uHostAdapterStatus, Mbx32.u.in.uTargetDeviceStatus);
3866	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxIncomingPositionCurrent == i ? " *" : "");
3867	GCMailbox += sizeof(Mailbox32);
3868	}
3869
3870	}
3871	}
3872	}
3873
3874	/* -=-=-=-=- Helper -=-=-=-=- */
3875
3876	/**
3877	* Checks if all asynchronous I/O is finished.
3878	*
3879	* Used by buslogicR3Reset, buslogicR3Suspend and buslogicR3PowerOff.
3880	*
3881	* @returns true if quiesced, false if busy.
3882	* @param pDevIns The device instance.
3883	*/
3884	static bool buslogicR3AllAsyncIOIsFinished(PPDMDEVINS pDevIns)
3885	{
3886	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3887
3888	for (uint32_t i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3889	{
3890	PBUSLOGICDEVICE pThisDevice = &pThisCC->aDeviceStates[i];
3891	if (pThisDevice->pDrvBase)
3892	{
3893	if (pThisDevice->cOutstandingRequests != 0)
3894	return false;
3895	}
3896	}
3897
3898	return true;
3899	}
3900
3901	/**
3902	* Callback employed by buslogicR3Suspend and buslogicR3PowerOff.
3903	*
3904	* @returns true if we've quiesced, false if we're still working.
3905	* @param pDevIns The device instance.
3906	*/
3907	static DECLCALLBACK(bool) buslogicR3IsAsyncSuspendOrPowerOffDone(PPDMDEVINS pDevIns)
3908	{
3909	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
3910	return false;
3911
3912	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3913	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
3914	return true;
3915	}
3916
3917	/**
3918	* Common worker for buslogicR3Suspend and buslogicR3PowerOff.
3919	*/
3920	static void buslogicR3SuspendOrPowerOff(PPDMDEVINS pDevIns)
3921	{
3922	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3923	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3924
3925	ASMAtomicWriteBool(&pThisCC->fSignalIdle, true);
3926	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
3927	PDMDevHlpSetAsyncNotification(pDevIns, buslogicR3IsAsyncSuspendOrPowerOffDone);
3928	else
3929	{
3930	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
3931	AssertMsg(!pThis->fNotificationSent, ("The PDM Queue should be empty at this point\n"));
3932	RT_NOREF(pThis);
3933	}
3934
3935	for (uint32_t i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3936	{
3937	PBUSLOGICDEVICE pThisDevice = &pThisCC->aDeviceStates[i];
3938	if (pThisDevice->pDrvMediaEx)
3939	pThisDevice->pDrvMediaEx->pfnNotifySuspend(pThisDevice->pDrvMediaEx);
3940	}
3941	}
3942
3943	/**
3944	* Suspend notification.
3945	*
3946	* @param pDevIns The device instance data.
3947	*/
3948	static DECLCALLBACK(void) buslogicR3Suspend(PPDMDEVINS pDevIns)
3949	{
3950	Log(("buslogicR3Suspend\n"));
3951	buslogicR3SuspendOrPowerOff(pDevIns);
3952	}
3953
3954	/**
3955	* Detach notification.
3956	*
3957	* One harddisk at one port has been unplugged.
3958	* The VM is suspended at this point.
3959	*
3960	* @param pDevIns The device instance.
3961	* @param iLUN The logical unit which is being detached.
3962	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
3963	*/
3964	static DECLCALLBACK(void) buslogicR3Detach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
3965	{
3966	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3967	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3968	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[iLUN];
3969	Log(("%s:\n", __FUNCTION__));
3970	RT_NOREF(fFlags);
3971
3972
3973	AssertMsg(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
3974	("BusLogic: Device does not support hotplugging\n"));
3975
3976	/*
3977	* Zero some important members.
3978	*/
3979	pThis->afDevicePresent[iLUN] = false;
3980	pDevice->fPresent = false;
3981	pDevice->pDrvBase = NULL;
3982	pDevice->pDrvMedia = NULL;
3983	pDevice->pDrvMediaEx = NULL;
3984	}
3985
3986	/**
3987	* Attach command.
3988	*
3989	* This is called when we change block driver.
3990	*
3991	* @returns VBox status code.
3992	* @param pDevIns The device instance.
3993	* @param iLUN The logical unit which is being detached.
3994	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
3995	*/
3996	static DECLCALLBACK(int) buslogicR3Attach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
3997	{
3998	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3999	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4000	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[iLUN];
4001	int rc;
4002
4003	AssertMsgReturn(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
4004	("BusLogic: Device does not support hotplugging\n"),
4005	VERR_INVALID_PARAMETER);
4006
4007	/* the usual paranoia */
4008	AssertRelease(!pDevice->pDrvBase);
4009	AssertRelease(!pDevice->pDrvMedia);
4010	AssertRelease(!pDevice->pDrvMediaEx);
4011	Assert(pDevice->iLUN == iLUN);
4012
4013	/*
4014	* Try attach the SCSI driver and get the interfaces,
4015	* required as well as optional.
4016	*/
4017	rc = PDMDevHlpDriverAttach(pDevIns, pDevice->iLUN, &pDevice->IBase, &pDevice->pDrvBase, NULL);
4018	if (RT_SUCCESS(rc))
4019	{
4020	/* Query the media interface. */
4021	pDevice->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIA);
4022	AssertMsgReturn(VALID_PTR(pDevice->pDrvMedia),
4023	("BusLogic configuration error: LUN#%d misses the basic media interface!\n", pDevice->iLUN),
4024	VERR_PDM_MISSING_INTERFACE);
4025
4026	/* Get the extended media interface. */
4027	pDevice->pDrvMediaEx = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIAEX);
4028	AssertMsgReturn(VALID_PTR(pDevice->pDrvMediaEx),
4029	("BusLogic configuration error: LUN#%d misses the extended media interface!\n", pDevice->iLUN),
4030	VERR_PDM_MISSING_INTERFACE);
4031
4032	rc = pDevice->pDrvMediaEx->pfnIoReqAllocSizeSet(pDevice->pDrvMediaEx, sizeof(BUSLOGICREQ));
4033	AssertMsgRCReturn(rc, ("BusLogic configuration error: LUN#%u: Failed to set I/O request size!", pDevice->iLUN),
4034	rc);
4035
4036	pThis->afDevicePresent[iLUN] = true;
4037	pDevice->fPresent = true;
4038	}
4039	else
4040	AssertMsgFailed(("Failed to attach LUN#%d. rc=%Rrc\n", pDevice->iLUN, rc));
4041
4042	if (RT_FAILURE(rc))
4043	{
4044	pThis->afDevicePresent[iLUN] = false;
4045	pDevice->fPresent = false;
4046	pDevice->pDrvBase = NULL;
4047	pDevice->pDrvMedia = NULL;
4048	pDevice->pDrvMediaEx = NULL;
4049	}
4050	return rc;
4051	}
4052
4053	/**
4054	* Callback employed by buslogicR3Reset.
4055	*
4056	* @returns true if we've quiesced, false if we're still working.
4057	* @param pDevIns The device instance.
4058	*/
4059	static DECLCALLBACK(bool) buslogicR3IsAsyncResetDone(PPDMDEVINS pDevIns)
4060	{
4061	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4062	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4063
4064	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4065	return false;
4066	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
4067
4068	buslogicR3HwReset(pDevIns, pThis, pThisCC, true);
4069	return true;
4070	}
4071
4072	/**
4073	* @copydoc FNPDMDEVRESET
4074	*/
4075	static DECLCALLBACK(void) buslogicR3Reset(PPDMDEVINS pDevIns)
4076	{
4077	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4078	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4079
4080	ASMAtomicWriteBool(&pThisCC->fSignalIdle, true);
4081	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4082	PDMDevHlpSetAsyncNotification(pDevIns, buslogicR3IsAsyncResetDone);
4083	else
4084	{
4085	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
4086	buslogicR3HwReset(pDevIns, pThis, pThisCC, true);
4087	}
4088	}
4089
4090	/**
4091	* Poweroff notification.
4092	*
4093	* @param pDevIns Pointer to the device instance
4094	*/
4095	static DECLCALLBACK(void) buslogicR3PowerOff(PPDMDEVINS pDevIns)
4096	{
4097	Log(("buslogicR3PowerOff\n"));
4098	buslogicR3SuspendOrPowerOff(pDevIns);
4099	}
4100
4101	/**
4102	* Destroy a driver instance.
4103	*
4104	* Most VM resources are freed by the VM. This callback is provided so that any non-VM
4105	* resources can be freed correctly.
4106	*
4107	* @param pDevIns The device instance data.
4108	*/
4109	static DECLCALLBACK(int) buslogicR3Destruct(PPDMDEVINS pDevIns)
4110	{
4111	PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
4112	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4113	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4114
4115	PDMDevHlpCritSectDelete(pDevIns, &pThis->CritSectIntr);
4116
4117	if (pThis->hEvtProcess != NIL_SUPSEMEVENT)
4118	{
4119	PDMDevHlpSUPSemEventClose(pDevIns, pThis->hEvtProcess);
4120	pThis->hEvtProcess = NIL_SUPSEMEVENT;
4121	}
4122
4123	vboxscsiDestroy(&pThisCC->VBoxSCSI);
4124
4125	return VINF_SUCCESS;
4126	}
4127
4128	/**
4129	* @interface_method_impl{PDMDEVREG,pfnConstruct}
4130	*/
4131	static DECLCALLBACK(int) buslogicR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
4132	{
4133	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
4134	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4135	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4136	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
4137
4138	/*
4139	* Init instance data (do early because of constructor).
4140	*/
4141	pThis->hMmio = NIL_IOMMMIOHANDLE;
4142	pThis->hIoPortsIsa = NIL_IOMIOPORTHANDLE;
4143	pThis->hIoPortsPci = NIL_IOMIOPORTHANDLE;
4144	pThisCC->pDevIns = pDevIns;
4145	pThisCC->IBase.pfnQueryInterface = buslogicR3StatusQueryInterface;
4146	pThisCC->ILeds.pfnQueryStatusLed = buslogicR3StatusQueryStatusLed;
4147
4148	PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
4149	PDMPCIDEV_ASSERT_VALID(pDevIns, pPciDev);
4150
4151	PDMPciDevSetVendorId(pPciDev, 0x104b); /* BusLogic */
4152	PDMPciDevSetDeviceId(pPciDev, 0x1040); /* BT-958 */
4153	PDMPciDevSetCommand(pPciDev, PCI_COMMAND_IOACCESS \| PCI_COMMAND_MEMACCESS);
4154	PDMPciDevSetRevisionId(pPciDev, 0x01);
4155	PDMPciDevSetClassProg(pPciDev, 0x00); /* SCSI */
4156	PDMPciDevSetClassSub(pPciDev, 0x00); /* SCSI */
4157	PDMPciDevSetClassBase(pPciDev, 0x01); /* Mass storage */
4158	PDMPciDevSetBaseAddress(pPciDev, 0, true /IO/, false /Pref/, false /64-bit/, 0x00000000);
4159	PDMPciDevSetBaseAddress(pPciDev, 1, false /IO/, false /Pref/, false /64-bit/, 0x00000000);
4160	PDMPciDevSetSubSystemVendorId(pPciDev, 0x104b);
4161	PDMPciDevSetSubSystemId(pPciDev, 0x1040);
4162	PDMPciDevSetInterruptLine(pPciDev, 0x00);
4163	PDMPciDevSetInterruptPin(pPciDev, 0x01);
4164
4165	/*
4166	* Validate and read configuration.
4167	*/
4168	PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns, "Bootable\|AdapterType\|ISACompat", "");
4169
4170	bool fBootable = true;
4171	int rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "Bootable", &fBootable, true);
4172	if (RT_FAILURE(rc))
4173	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read Bootable as boolean"));
4174	Log(("%s: fBootable=%RTbool\n", __FUNCTION__, fBootable));
4175
4176	/* Figure out the emulated device type. */
4177	char szCfgStr[16];
4178	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "AdapterType", szCfgStr, sizeof(szCfgStr), "BT-958D");
4179	if (RT_FAILURE(rc))
4180	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read AdapterType as string"));
4181	Log(("%s: AdapterType=%s\n", __FUNCTION__, szCfgStr));
4182
4183	/* Grok the AdapterType setting. */
4184	if (!strcmp(szCfgStr, "BT-958D")) /* Default PCI device, 32-bit and 24-bit addressing. */
4185	{
4186	pThis->uDevType = DEV_BT_958D;
4187	pThis->uDefaultISABaseCode = ISA_BASE_DISABLED;
4188	}
4189	else if (!strcmp(szCfgStr, "BT-545C")) /* ISA device, 24-bit addressing only. */
4190	{
4191	pThis->uDevType = DEV_BT_545C;
4192	pThis->uIsaIrq = 11;
4193	}
4194	else if (!strcmp(szCfgStr, "AHA-1540B")) /* Competitor ISA device. */
4195	{
4196	pThis->uDevType = DEV_AHA_1540B;
4197	pThis->uIsaIrq = 11;
4198	}
4199	else
4200	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
4201	N_("BusLogic configuration error: invalid AdapterType setting"));
4202
4203	/* Only the first instance defaults to having the ISA compatibility ports enabled. */
4204	if (iInstance == 0)
4205	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "ISACompat", szCfgStr, sizeof(szCfgStr), "Alternate");
4206	else
4207	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "ISACompat", szCfgStr, sizeof(szCfgStr), "Disabled");
4208	if (RT_FAILURE(rc))
4209	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read ISACompat as string"));
4210	Log(("%s: ISACompat=%s\n", __FUNCTION__, szCfgStr));
4211
4212	/* Grok the ISACompat setting. */
4213	if (!strcmp(szCfgStr, "Disabled"))
4214	pThis->uDefaultISABaseCode = ISA_BASE_DISABLED;
4215	else if (!strcmp(szCfgStr, "Primary"))
4216	pThis->uDefaultISABaseCode = 0; /* I/O base at 330h. */
4217	else if (!strcmp(szCfgStr, "Alternate"))
4218	pThis->uDefaultISABaseCode = 1; /* I/O base at 334h. */
4219	else
4220	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
4221	N_("BusLogic configuration error: invalid ISACompat setting"));
4222
4223	/*
4224	* Register the PCI device and its I/O regions if applicable.
4225	*/
4226	if (!pThis->uIsaIrq)
4227	{
4228	rc = PDMDevHlpPCIRegister(pDevIns, pPciDev);
4229	AssertRCReturn(rc, rc);
4230
4231	rc = PDMDevHlpPCIIORegionCreateIo(pDevIns, 0 /iPciRegion/, 32 /cPorts/,
4232	buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/,
4233	"BusLogic PCI", NULL /paExtDescs/, &pThis->hIoPortsPci);
4234	AssertRCReturn(rc, rc);
4235
4236	rc = PDMDevHlpPCIIORegionCreateMmio(pDevIns, 1 /iPciRegion/, 32 /cbRegion/, PCI_ADDRESS_SPACE_MEM,
4237	buslogicMMIOWrite, buslogicMMIORead, NULL /pvUser/,
4238	IOMMMIO_FLAGS_READ_PASSTHRU \| IOMMMIO_FLAGS_WRITE_PASSTHRU,
4239	"BusLogic MMIO", &pThis->hMmio);
4240	AssertRCReturn(rc, rc);
4241	}
4242
4243	/* Initialize the SCSI emulation for the BIOS. */
4244	rc = vboxscsiInitialize(&pThisCC->VBoxSCSI);
4245	if (RT_FAILURE(rc))
4246	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic failed to initialize BIOS SCSI interface"));
4247
4248	if (fBootable)
4249	{
4250	/* Register I/O port space for BIOS access. */
4251	rc = PDMDevHlpIoPortCreateExAndMap(pDevIns, BUSLOGIC_BIOS_IO_PORT, 4 /cPorts/, 0 /fFlags/,
4252	buslogicR3BiosIoPortWrite, buslogicR3BiosIoPortRead,
4253	buslogicR3BiosIoPortWriteStr, buslogicR3BiosIoPortReadStr, NULL /pvUser/,
4254	"BusLogic BIOS" , NULL /paExtDesc/, &pThis->hIoPortsBios);
4255	if (RT_FAILURE(rc))
4256	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register BIOS I/O handlers"));
4257	}
4258
4259	/* Set up the compatibility I/O range. */
4260	rc = PDMDevHlpIoPortCreate(pDevIns, 4 /cPorts/, NULL /pPciDev/, UINT32_MAX /iPciRegion/,
4261	buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/,
4262	"BusLogic ISA", NULL /paExtDescs/, &pThis->hIoPortsIsa);
4263	AssertRCReturn(rc, rc);
4264
4265	rc = buslogicR3RegisterISARange(pDevIns, pThis, pThis->uDefaultISABaseCode);
4266	if (RT_FAILURE(rc))
4267	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register ISA I/O handlers"));
4268
4269
4270	/* Init the interrupt critsect. */
4271	rc = PDMDevHlpCritSectInit(pDevIns, &pThis->CritSectIntr, RT_SRC_POS, "BusLogic-Intr#%u", pDevIns->iInstance);
4272	if (RT_FAILURE(rc))
4273	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic: cannot create critical section"));
4274
4275	/*
4276	* Create event semaphore and worker thread.
4277	*/
4278	rc = PDMDevHlpSUPSemEventCreate(pDevIns, &pThis->hEvtProcess);
4279	if (RT_FAILURE(rc))
4280	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4281	N_("BusLogic: Failed to create SUP event semaphore"));
4282
4283	char szDevTag[20];
4284	RTStrPrintf(szDevTag, sizeof(szDevTag), "BUSLOGIC-%u", iInstance);
4285
4286	rc = PDMDevHlpThreadCreate(pDevIns, &pThisCC->pThreadWrk, pThis, buslogicR3Worker,
4287	buslogicR3WorkerWakeUp, 0, RTTHREADTYPE_IO, szDevTag);
4288	if (RT_FAILURE(rc))
4289	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4290	N_("BusLogic: Failed to create worker thread %s"), szDevTag);
4291
4292	/* Initialize per device state. */
4293	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
4294	{
4295	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
4296
4297	/* Initialize static parts of the device. */
4298	pDevice->iLUN = i;
4299	pDevice->pDevIns = pDevIns;
4300	pDevice->Led.u32Magic = PDMLED_MAGIC;
4301	pDevice->IBase.pfnQueryInterface = buslogicR3DeviceQueryInterface;
4302	pDevice->IMediaPort.pfnQueryDeviceLocation = buslogicR3QueryDeviceLocation;
4303	pDevice->IMediaExPort.pfnIoReqCompleteNotify = buslogicR3IoReqCompleteNotify;
4304	pDevice->IMediaExPort.pfnIoReqCopyFromBuf = buslogicR3IoReqCopyFromBuf;
4305	pDevice->IMediaExPort.pfnIoReqCopyToBuf = buslogicR3IoReqCopyToBuf;
4306	pDevice->IMediaExPort.pfnIoReqQueryBuf = NULL;
4307	pDevice->IMediaExPort.pfnIoReqQueryDiscardRanges = NULL;
4308	pDevice->IMediaExPort.pfnIoReqStateChanged = buslogicR3IoReqStateChanged;
4309	pDevice->IMediaExPort.pfnMediumEjected = buslogicR3MediumEjected;
4310	pDevice->ILed.pfnQueryStatusLed = buslogicR3DeviceQueryStatusLed;
4311	RTStrPrintf(pDevice->szName, sizeof(pDevice->szName), "Device%u", i);
4312
4313	/* Attach SCSI driver. */
4314	rc = PDMDevHlpDriverAttach(pDevIns, pDevice->iLUN, &pDevice->IBase, &pDevice->pDrvBase, pDevice->szName);
4315	if (RT_SUCCESS(rc))
4316	{
4317	/* Query the media interface. */
4318	pDevice->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIA);
4319	AssertMsgReturn(VALID_PTR(pDevice->pDrvMedia),
4320	("Buslogic configuration error: LUN#%d misses the basic media interface!\n", pDevice->iLUN),
4321	VERR_PDM_MISSING_INTERFACE);
4322
4323	/* Get the extended media interface. */
4324	pDevice->pDrvMediaEx = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIAEX);
4325	AssertMsgReturn(VALID_PTR(pDevice->pDrvMediaEx),
4326	("Buslogic configuration error: LUN#%d misses the extended media interface!\n", pDevice->iLUN),
4327	VERR_PDM_MISSING_INTERFACE);
4328
4329	rc = pDevice->pDrvMediaEx->pfnIoReqAllocSizeSet(pDevice->pDrvMediaEx, sizeof(BUSLOGICREQ));
4330	if (RT_FAILURE(rc))
4331	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4332	N_("Buslogic configuration error: LUN#%u: Failed to set I/O request size!"),
4333	pDevice->iLUN);
4334
4335	pThis->afDevicePresent[i] = true;
4336	pDevice->fPresent = true;
4337	}
4338	else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
4339	{
4340	pThis->afDevicePresent[i] = false;
4341	pDevice->fPresent = false;
4342	pDevice->pDrvBase = NULL;
4343	pDevice->pDrvMedia = NULL;
4344	pDevice->pDrvMediaEx = NULL;
4345	rc = VINF_SUCCESS;
4346	Log(("BusLogic: no driver attached to device %s\n", pDevice->szName));
4347	}
4348	else
4349	{
4350	AssertLogRelMsgFailed(("BusLogic: Failed to attach %s\n", pDevice->szName));
4351	return rc;
4352	}
4353	}
4354
4355	/*
4356	* Attach status driver (optional).
4357	*/
4358	PPDMIBASE pBase;
4359	rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThisCC->IBase, &pBase, "Status Port");
4360	if (RT_SUCCESS(rc))
4361	{
4362	pThisCC->pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
4363	pThisCC->pMediaNotify = PDMIBASE_QUERY_INTERFACE(pBase, PDMIMEDIANOTIFY);
4364	}
4365	else
4366	AssertMsgReturn(rc == VERR_PDM_NO_ATTACHED_DRIVER, ("Failed to attach to status driver. rc=%Rrc\n", rc),
4367	PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot attach to status driver")));
4368
4369	rc = PDMDevHlpSSMRegisterEx(pDevIns, BUSLOGIC_SAVED_STATE_MINOR_VERSION, sizeof(*pThis), NULL,
4370	NULL, buslogicR3LiveExec, NULL,
4371	NULL, buslogicR3SaveExec, NULL,
4372	NULL, buslogicR3LoadExec, buslogicR3LoadDone);
4373	if (RT_FAILURE(rc))
4374	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register save state handlers"));
4375
4376	/*
4377	* Register the debugger info callback.
4378	*/
4379	char szTmp[128];
4380	RTStrPrintf(szTmp, sizeof(szTmp), "%s%d", pDevIns->pReg->szName, pDevIns->iInstance);
4381	PDMDevHlpDBGFInfoRegister(pDevIns, szTmp, "BusLogic HBA info", buslogicR3Info);
4382
4383	rc = buslogicR3HwReset(pDevIns, pThis, pThisCC, true);
4384	AssertMsgRC(rc, ("hardware reset of BusLogic host adapter failed rc=%Rrc\n", rc));
4385
4386	return rc;
4387	}
4388
4389	#else /* !IN_RING3 */
4390
4391	/**
4392	* @callback_method_impl{PDMDEVREGR0,pfnConstruct}
4393	*/
4394	static DECLCALLBACK(int) buslogicRZConstruct(PPDMDEVINS pDevIns)
4395	{
4396	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
4397	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4398
4399	if (!pThis->uIsaIrq)
4400	{
4401	int rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortsPci, buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/);
4402	AssertRCReturn(rc, rc);
4403
4404	rc = PDMDevHlpMmioSetUpContext(pDevIns, pThis->hMmio, buslogicMMIOWrite, buslogicMMIORead, NULL /pvUser/);
4405	AssertRCReturn(rc, rc);
4406	}
4407
4408	int rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortsIsa, buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/);
4409	AssertRCReturn(rc, rc);
4410
4411	return VINF_SUCCESS;
4412	}
4413
4414
4415	#endif /* !IN_RING3 */
4416
4417	/**
4418	* The device registration structure.
4419	*/
4420	const PDMDEVREG g_DeviceBusLogic =
4421	{
4422	/* .u32Version = */ PDM_DEVREG_VERSION,
4423	/* .uReserved0 = */ 0,
4424	/* .szName = */ "buslogic",
4425	/* .fFlags = */ PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RZ \| PDM_DEVREG_FLAGS_NEW_STYLE
4426	\| PDM_DEVREG_FLAGS_FIRST_SUSPEND_NOTIFICATION \| PDM_DEVREG_FLAGS_FIRST_POWEROFF_NOTIFICATION
4427	\| PDM_DEVREG_FLAGS_FIRST_RESET_NOTIFICATION,
4428	/* .fClass = */ PDM_DEVREG_CLASS_STORAGE,
4429	/* .cMaxInstances = */ ~0U,
4430	/* .uSharedVersion = */ 42,
4431	/* .cbInstanceShared = */ sizeof(BUSLOGIC),
4432	/* .cbInstanceCC = */ sizeof(BUSLOGICCC),
4433	/* .cbInstanceRC = */ sizeof(BUSLOGICRC),
4434	/* .cMaxPciDevices = */ 1,
4435	/* .cMaxMsixVectors = */ 0,
4436	/* .pszDescription = */ "BusLogic BT-958 SCSI host adapter.\n",
4437	#if defined(IN_RING3)
4438	/* .pszRCMod = */ "VBoxDDRC.rc",
4439	/* .pszR0Mod = */ "VBoxDDR0.r0",
4440	/* .pfnConstruct = */ buslogicR3Construct,
4441	/* .pfnDestruct = */ buslogicR3Destruct,
4442	/* .pfnRelocate = */ NULL,
4443	/* .pfnMemSetup = */ NULL,
4444	/* .pfnPowerOn = */ NULL,
4445	/* .pfnReset = */ buslogicR3Reset,
4446	/* .pfnSuspend = */ buslogicR3Suspend,
4447	/* .pfnResume = */ NULL,
4448	/* .pfnAttach = */ buslogicR3Attach,
4449	/* .pfnDetach = */ buslogicR3Detach,
4450	/* .pfnQueryInterface = */ NULL,
4451	/* .pfnInitComplete = */ NULL,
4452	/* .pfnPowerOff = */ buslogicR3PowerOff,
4453	/* .pfnSoftReset = */ NULL,
4454	/* .pfnReserved0 = */ NULL,
4455	/* .pfnReserved1 = */ NULL,
4456	/* .pfnReserved2 = */ NULL,
4457	/* .pfnReserved3 = */ NULL,
4458	/* .pfnReserved4 = */ NULL,
4459	/* .pfnReserved5 = */ NULL,
4460	/* .pfnReserved6 = */ NULL,
4461	/* .pfnReserved7 = */ NULL,
4462	#elif defined(IN_RING0)
4463	/* .pfnEarlyConstruct = */ NULL,
4464	/* .pfnConstruct = */ buslogicRZConstruct,
4465	/* .pfnDestruct = */ NULL,
4466	/* .pfnFinalDestruct = */ NULL,
4467	/* .pfnRequest = */ NULL,
4468	/* .pfnReserved0 = */ NULL,
4469	/* .pfnReserved1 = */ NULL,
4470	/* .pfnReserved2 = */ NULL,
4471	/* .pfnReserved3 = */ NULL,
4472	/* .pfnReserved4 = */ NULL,
4473	/* .pfnReserved5 = */ NULL,
4474	/* .pfnReserved6 = */ NULL,
4475	/* .pfnReserved7 = */ NULL,
4476	#elif defined(IN_RC)
4477	/* .pfnConstruct = */ buslogicRZConstruct,
4478	/* .pfnReserved0 = */ NULL,
4479	/* .pfnReserved1 = */ NULL,
4480	/* .pfnReserved2 = */ NULL,
4481	/* .pfnReserved3 = */ NULL,
4482	/* .pfnReserved4 = */ NULL,
4483	/* .pfnReserved5 = */ NULL,
4484	/* .pfnReserved6 = */ NULL,
4485	/* .pfnReserved7 = */ NULL,
4486	#else
4487	# error "Not in IN_RING3, IN_RING0 or IN_RC!"
4488	#endif
4489	/* .u32VersionEnd = */ PDM_DEVREG_VERSION
4490	};
4491
4492	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Storage/DevBusLogic.cpp@ 84357

Download in other formats: