DevBusLogic.cpp@ 86482

Last change on this file since 86482 was 86482, checked in by vboxsync, 4 years ago
AMD IOMMU: bugref:9654 BusLogic: Use PCI interfaces while reading/writing guest physical memory.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 179.8 KB

Line
1	/* $Id: DevBusLogic.cpp 86482 2020-10-08 06:53:02Z vboxsync $ */
2	/** @file
3	* VBox storage devices - BusLogic SCSI host adapter BT-958.
4	*
5	* Based on the Multi-Master Ultra SCSI Systems Technical Reference Manual.
6	*/
7
8	/*
9	* Copyright (C) 2006-2020 Oracle Corporation
10	*
11	* This file is part of VirtualBox Open Source Edition (OSE), as
12	* available from http://www.virtualbox.org. This file is free software;
13	* you can redistribute it and/or modify it under the terms of the GNU
14	* General Public License (GPL) as published by the Free Software
15	* Foundation, in version 2 as it comes in the "COPYING" file of the
16	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
17	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
18	*/
19
20
21	/*********************************************************************************************************************************
22	* Header Files *
23	*********************************************************************************************************************************/
24	#define LOG_GROUP LOG_GROUP_DEV_BUSLOGIC
25	#include <VBox/vmm/pdmdev.h>
26	#include <VBox/vmm/pdmstorageifs.h>
27	#include <VBox/vmm/pdmcritsect.h>
28	#include <VBox/AssertGuest.h>
29	#include <VBox/scsi.h>
30	#include <iprt/asm.h>
31	#include <iprt/assert.h>
32	#include <iprt/string.h>
33	#include <iprt/log.h>
34	#ifdef IN_RING3
35	# include <iprt/alloc.h>
36	# include <iprt/memcache.h>
37	# include <iprt/param.h>
38	# include <iprt/uuid.h>
39	#endif
40
41	#include "VBoxSCSI.h"
42	#include "VBoxDD.h"
43
44
45	/*********************************************************************************************************************************
46	* Defined Constants And Macros *
47	*********************************************************************************************************************************/
48	/** Maximum number of attached devices the adapter can handle. */
49	#define BUSLOGIC_MAX_DEVICES 16
50
51	/** Maximum number of scatter gather elements this device can handle. */
52	#define BUSLOGIC_MAX_SCATTER_GATHER_LIST_SIZE 128
53
54	/** Size of the command buffer. */
55	#define BUSLOGIC_COMMAND_SIZE_MAX 53
56
57	/** Size of the reply buffer. */
58	#define BUSLOGIC_REPLY_SIZE_MAX 64
59
60	/** Custom fixed I/O ports for BIOS controller access.
61	* Note that these should not be in the ISA range (below 400h) to avoid
62	* conflicts with ISA device probing. Addresses in the 300h-340h range should be
63	* especially avoided.
64	*/
65	#define BUSLOGIC_BIOS_IO_PORT 0x430
66
67	/** State saved version. */
68	#define BUSLOGIC_SAVED_STATE_MINOR_VERSION 4
69
70	/** Saved state version before the suspend on error feature was implemented. */
71	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_ERROR_HANDLING 1
72	/** Saved state version before 24-bit mailbox support was implemented. */
73	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX 2
74	/** Saved state version before command buffer size was raised. */
75	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE 3
76
77	/** Command buffer size in old saved states. */
78	#define BUSLOGIC_COMMAND_SIZE_OLD 5
79
80	/** The duration of software-initiated reset (in nano seconds).
81	* Not documented, set to 50 ms. */
82	#define BUSLOGIC_RESET_DURATION_NS UINT64_C(50000000)
83
84
85	/*********************************************************************************************************************************
86	* Structures and Typedefs *
87	*********************************************************************************************************************************/
88	/**
89	* State of a device attached to the buslogic host adapter.
90	*
91	* @implements PDMIBASE
92	* @implements PDMISCSIPORT
93	* @implements PDMILEDPORTS
94	*/
95	typedef struct BUSLOGICDEVICE
96	{
97	/** The ring-3 device instance (for getting our bearings when arriving in an
98	* interface method). */
99	PPDMDEVINSR3 pDevIns;
100
101	/** LUN of the device. */
102	uint32_t iLUN;
103
104	/** Flag whether device is present.
105	* @note This is mirrored in BUSLOGIC::afDevicePresent. */
106	bool fPresent;
107	bool afAlignment[3];
108
109	/** Our base interface. */
110	PDMIBASE IBase;
111	/** Media port interface. */
112	PDMIMEDIAPORT IMediaPort;
113	/** Extended media port interface. */
114	PDMIMEDIAEXPORT IMediaExPort;
115	/** Led interface. */
116	PDMILEDPORTS ILed;
117	/** Pointer to the attached driver's base interface. */
118	R3PTRTYPE(PPDMIBASE) pDrvBase;
119	/** Pointer to the attached driver's media interface. */
120	R3PTRTYPE(PPDMIMEDIA) pDrvMedia;
121	/** Pointer to the attached driver's extended media interface. */
122	R3PTRTYPE(PPDMIMEDIAEX) pDrvMediaEx;
123	/** The status LED state for this device. */
124	PDMLED Led;
125
126	/** Number of outstanding tasks on the port. */
127	volatile uint32_t cOutstandingRequests;
128	/** The device name. */
129	char szName[12];
130	} BUSLOGICDEVICE, *PBUSLOGICDEVICE;
131
132	/**
133	* Commands the BusLogic adapter supports.
134	*/
135	enum BUSLOGICCOMMAND
136	{
137	BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT = 0x00,
138	BUSLOGICCOMMAND_INITIALIZE_MAILBOX = 0x01,
139	BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND = 0x02,
140	BUSLOGICCOMMAND_EXECUTE_BIOS_COMMAND = 0x03,
141	BUSLOGICCOMMAND_INQUIRE_BOARD_ID = 0x04,
142	BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT = 0x05,
143	BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT = 0x06,
144	BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS = 0x07,
145	BUSLOGICCOMMAND_SET_TIME_OFF_BUS = 0x08,
146	BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE = 0x09,
147	BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7 = 0x0a,
148	BUSLOGICCOMMAND_INQUIRE_CONFIGURATION = 0x0b,
149	BUSLOGICCOMMAND_ENABLE_TARGET_MODE = 0x0c,
150	BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION = 0x0d,
151	BUSLOGICCOMMAND_WRITE_ADAPTER_LOCAL_RAM = 0x1a,
152	BUSLOGICCOMMAND_READ_ADAPTER_LOCAL_RAM = 0x1b,
153	BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO = 0x1c,
154	BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO = 0x1d,
155	BUSLOGICCOMMAND_ECHO_COMMAND_DATA = 0x1f,
156	BUSLOGICCOMMAND_HOST_ADAPTER_DIAGNOSTIC = 0x20,
157	BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS = 0x21,
158	BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15 = 0x23,
159	BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES = 0x24,
160	BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT = 0x25,
161	BUSLOGICCOMMAND_EXT_BIOS_INFO = 0x28,
162	BUSLOGICCOMMAND_UNLOCK_MAILBOX = 0x29,
163	BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX = 0x81,
164	BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND = 0x83,
165	BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER = 0x84,
166	BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER = 0x85,
167	BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION = 0x86,
168	BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER = 0x8b,
169	BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD = 0x8c,
170	BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION = 0x8d,
171	BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE = 0x8f,
172	BUSLOGICCOMMAND_STORE_HOST_ADAPTER_LOCAL_RAM = 0x90,
173	BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM = 0x91,
174	BUSLOGICCOMMAND_STORE_LOCAL_DATA_IN_EEPROM = 0x92,
175	BUSLOGICCOMMAND_UPLOAD_AUTO_SCSI_CODE = 0x94,
176	BUSLOGICCOMMAND_MODIFY_IO_ADDRESS = 0x95,
177	BUSLOGICCOMMAND_SET_CCB_FORMAT = 0x96,
178	BUSLOGICCOMMAND_WRITE_INQUIRY_BUFFER = 0x9a,
179	BUSLOGICCOMMAND_READ_INQUIRY_BUFFER = 0x9b,
180	BUSLOGICCOMMAND_FLASH_ROM_UPLOAD_DOWNLOAD = 0xa7,
181	BUSLOGICCOMMAND_READ_SCAM_DATA = 0xa8,
182	BUSLOGICCOMMAND_WRITE_SCAM_DATA = 0xa9
183	} BUSLOGICCOMMAND;
184
185	#pragma pack(1)
186	/**
187	* Auto SCSI structure which is located
188	* in host adapter RAM and contains several
189	* configuration parameters.
190	*/
191	typedef struct AutoSCSIRam
192	{
193	uint8_t aInternalSignature[2];
194	uint8_t cbInformation;
195	uint8_t aHostAdaptertype[6];
196	uint8_t uReserved1;
197	bool fFloppyEnabled : 1;
198	bool fFloppySecondary : 1;
199	bool fLevelSensitiveInterrupt : 1;
200	unsigned char uReserved2 : 2;
201	unsigned char uSystemRAMAreForBIOS : 3;
202	unsigned char uDMAChannel : 7;
203	bool fDMAAutoConfiguration : 1;
204	unsigned char uIrqChannel : 7;
205	bool fIrqAutoConfiguration : 1;
206	uint8_t uDMATransferRate;
207	uint8_t uSCSIId;
208	bool fLowByteTerminated : 1;
209	bool fParityCheckingEnabled : 1;
210	bool fHighByteTerminated : 1;
211	bool fNoisyCablingEnvironment : 1;
212	bool fFastSynchronousNeogtiation : 1;
213	bool fBusResetEnabled : 1;
214	bool fReserved3 : 1;
215	bool fActiveNegotiationEnabled : 1;
216	uint8_t uBusOnDelay;
217	uint8_t uBusOffDelay;
218	bool fHostAdapterBIOSEnabled : 1;
219	bool fBIOSRedirectionOfInt19 : 1;
220	bool fExtendedTranslation : 1;
221	bool fMapRemovableAsFixed : 1;
222	bool fReserved4 : 1;
223	bool fBIOSSupportsMoreThan2Drives : 1;
224	bool fBIOSInterruptMode : 1;
225	bool fFlopticalSupport : 1;
226	uint16_t u16DeviceEnabledMask;
227	uint16_t u16WidePermittedMask;
228	uint16_t u16FastPermittedMask;
229	uint16_t u16SynchronousPermittedMask;
230	uint16_t u16DisconnectPermittedMask;
231	uint16_t u16SendStartUnitCommandMask;
232	uint16_t u16IgnoreInBIOSScanMask;
233	unsigned char uPCIInterruptPin : 2;
234	unsigned char uHostAdapterIoPortAddress : 2;
235	bool fStrictRoundRobinMode : 1;
236	bool fVesaBusSpeedGreaterThan33MHz : 1;
237	bool fVesaBurstWrite : 1;
238	bool fVesaBurstRead : 1;
239	uint16_t u16UltraPermittedMask;
240	uint32_t uReserved5;
241	uint8_t uReserved6;
242	uint8_t uAutoSCSIMaximumLUN;
243	bool fReserved7 : 1;
244	bool fSCAMDominant : 1;
245	bool fSCAMenabled : 1;
246	bool fSCAMLevel2 : 1;
247	unsigned char uReserved8 : 4;
248	bool fInt13Extension : 1;
249	bool fReserved9 : 1;
250	bool fCDROMBoot : 1;
251	unsigned char uReserved10 : 5;
252	unsigned char uBootTargetId : 4;
253	unsigned char uBootChannel : 4;
254	bool fForceBusDeviceScanningOrder : 1;
255	unsigned char uReserved11 : 7;
256	uint16_t u16NonTaggedToAlternateLunPermittedMask;
257	uint16_t u16RenegotiateSyncAfterCheckConditionMask;
258	uint8_t aReserved12[10];
259	uint8_t aManufacturingDiagnostic[2];
260	uint16_t u16Checksum;
261	} AutoSCSIRam, *PAutoSCSIRam;
262	AssertCompileSize(AutoSCSIRam, 64);
263	#pragma pack()
264
265	/**
266	* The local Ram.
267	*/
268	typedef union HostAdapterLocalRam
269	{
270	/** Byte view. */
271	uint8_t u8View[256];
272	/** Structured view. */
273	struct
274	{
275	/** Offset 0 - 63 is for BIOS. */
276	uint8_t u8Bios[64];
277	/** Auto SCSI structure. */
278	AutoSCSIRam autoSCSIData;
279	} structured;
280	} HostAdapterLocalRam, *PHostAdapterLocalRam;
281	AssertCompileSize(HostAdapterLocalRam, 256);
282
283
284	/** Ugly 24-bit big-endian addressing. */
285	typedef struct
286	{
287	uint8_t hi;
288	uint8_t mid;
289	uint8_t lo;
290	} Addr24, Len24;
291	AssertCompileSize(Addr24, 3);
292
293	#define ADDR_TO_U32(x) (((x).hi << 16) \| ((x).mid << 8) \| (x).lo)
294	#define LEN_TO_U32 ADDR_TO_U32
295	#define U32_TO_ADDR(a, x) do {(a).hi = (x) >> 16; (a).mid = (x) >> 8; (a).lo = (x);} while(0)
296	#define U32_TO_LEN U32_TO_ADDR
297
298	/** @name Compatible ISA base I/O port addresses. Disabled if zero.
299	* @{ */
300	#define NUM_ISA_BASES 8
301	#define MAX_ISA_BASE (NUM_ISA_BASES - 1)
302	#define ISA_BASE_DISABLED 6
303
304	#ifdef IN_RING3
305	static uint16_t const g_aISABases[NUM_ISA_BASES] =
306	{
307	0x330, 0x334, 0x230, 0x234, 0x130, 0x134, 0, 0
308	};
309	#endif
310	/** @} */
311
312	/**
313	* Emulated device types.
314	*/
315	enum BL_DEVICE_TYPE
316	{
317	DEV_BT_958D = 0, /* BusLogic BT-958D, PCI. */
318	DEV_BT_545C = 1, /* BusLogic BT-545C, ISA. */
319	DEV_AHA_1540B = 2 /* Adaptec AHA-1540B, ISA. */
320	};
321
322	/** Pointer to a task state structure. */
323	typedef struct BUSLOGICREQ *PBUSLOGICREQ;
324
325	/**
326	* The shared BusLogic device emulation state.
327	*/
328	typedef struct BUSLOGIC
329	{
330	/** Status register - Readonly. */
331	volatile uint8_t regStatus;
332	/** Interrupt register - Readonly. */
333	volatile uint8_t regInterrupt;
334	/** Geometry register - Readonly. */
335	volatile uint8_t regGeometry;
336	/** Pending (delayed) interrupt. */
337	uint8_t uPendingIntr;
338
339	/** Command code the guest issued. */
340	uint8_t uOperationCode;
341	/** Current position in the command buffer. */
342	uint8_t iParameter;
343	/** Parameters left until the command is complete. */
344	uint8_t cbCommandParametersLeft;
345	/** Buffer for the command parameters the adapter is currently receiving from the guest.
346	* Size of the largest command which is possible. */
347	uint8_t aCommandBuffer[BUSLOGIC_COMMAND_SIZE_MAX]; /* Size of the biggest request. */
348
349	/** Only for LOG_ENABLED builds! */
350	volatile uint32_t cInMailboxesReadyIfLogEnabled;
351
352	/** Position in the buffer we are reading next.
353	* @note aligned on 64 byte boundrary for cache-line mojo. Means IOISABase
354	* is at offset 130. */
355	uint8_t iReply;
356	/** Bytes left until the reply buffer is empty. */
357	uint8_t cbReplyParametersLeft;
358	/** Buffer to store reply data from the controller to the guest. */
359	uint8_t aReplyBuffer[BUSLOGIC_REPLY_SIZE_MAX]; /* Size of the biggest reply. */
360
361	/** ISA I/O port base (disabled if zero). */
362	RTIOPORT IOISABase;
363	/** Default ISA I/O port base in FW-compatible format. */
364	uint8_t uDefaultISABaseCode;
365	/** Emulated device type. */
366	uint8_t uDevType;
367
368	/** Signature index for Adaptec models. */
369	uint8_t uAhaSigIdx;
370
371	/** Whether we are using the RAM or reply buffer. */
372	bool fUseLocalRam;
373
374	/** Flag whether IRQs are enabled. */
375	bool fIRQEnabled;
376	/** Flag whether 24-bit mailboxes are in use (default is 32-bit). */
377	bool fMbxIs24Bit;
378	/** ISA I/O port base (encoded in FW-compatible format). */
379	uint8_t uISABaseCode;
380	/** ISA IRQ, non-zero if in ISA mode. */
381	uint8_t uIsaIrq;
382
383	/** Number of mailboxes the guest set up. */
384	uint32_t cMailbox;
385
386	/** Time when HBA reset was last initiated. */
387	uint64_t u64ResetTime; /*< @todo does this need to be saved? /
388	/** Physical base address of the outgoing mailboxes. */
389	RTGCPHYS GCPhysAddrMailboxOutgoingBase;
390	/** Current outgoing mailbox position. */
391	uint32_t uMailboxOutgoingPositionCurrent;
392	/** Number of mailboxes ready. */
393	volatile uint32_t cMailboxesReady;
394	/** Whether a notification to R3 was sent. */
395	volatile bool fNotificationSent;
396
397	/** Whether strict round robin is enabled. */
398	bool fStrictRoundRobinMode;
399	/** Whether the extended LUN CCB format is enabled for 32 possible logical units. */
400	bool fExtendedLunCCBFormat;
401	bool fAlignment2;
402
403	/** Current incoming mailbox position. */
404	uint32_t uMailboxIncomingPositionCurrent;
405	/** Physical base address of the incoming mailboxes. */
406	RTGCPHYS GCPhysAddrMailboxIncomingBase;
407
408	/** Critical section protecting access to the interrupt status register. */
409	PDMCRITSECT CritSectIntr;
410
411	/** Device presence indicators.
412	* @note Copy of BUSLOGICDEVICE::fPresent accessible from ring-0. */
413	bool afDevicePresent[BUSLOGIC_MAX_DEVICES];
414
415	/** The event semaphore the processing thread waits on. */
416	SUPSEMEVENT hEvtProcess;
417
418	/** ISA compatibility I/O ports. */
419	IOMIOPORTHANDLE hIoPortsIsa;
420	/** BIOS I/O ports for booting, optional. */
421	IOMIOPORTHANDLE hIoPortsBios;
422	/** PCI Region \#0: I/O ports. */
423	IOMIOPORTHANDLE hIoPortsPci;
424	/** PCI Region \#1: MMIO (32 bytes, but probably rounded up to 4KB). */
425	IOMMMIOHANDLE hMmio;
426
427	/** Local RAM for the fetch hostadapter local RAM request.
428	* I don't know how big the buffer really is but the maximum
429	* seems to be 256 bytes because the offset and count field in the command request
430	* are only one byte big.
431	*/
432	HostAdapterLocalRam LocalRam;
433	} BUSLOGIC;
434	/** Pointer to the shared BusLogic device emulation state. */
435	typedef BUSLOGIC *PBUSLOGIC;
436
437
438	/**
439	* The ring-3 BusLogic device emulation state.
440	*
441	* @implements PDMILEDPORTS
442	*/
443	typedef struct BUSLOGICR3
444	{
445	/** The device instance - only for getting our bearings in interface methods. */
446	PPDMDEVINSR3 pDevIns;
447
448	/** Device state for BIOS access. */
449	VBOXSCSI VBoxSCSI;
450
451	/** BusLogic device states. */
452	BUSLOGICDEVICE aDeviceStates[BUSLOGIC_MAX_DEVICES];
453
454	/** The base interface.
455	* @todo use PDMDEVINS::IBase */
456	PDMIBASE IBase;
457	/** Status Port - Leds interface. */
458	PDMILEDPORTS ILeds;
459	/** Partner of ILeds. */
460	R3PTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
461	/** Status LUN: Media Notifys. */
462	R3PTRTYPE(PPDMIMEDIANOTIFY) pMediaNotify;
463
464	/** Indicates that PDMDevHlpAsyncNotificationCompleted should be called when
465	* a port is entering the idle state. */
466	bool volatile fSignalIdle;
467	/** Flag whether the worker thread is sleeping. */
468	volatile bool fWrkThreadSleeping;
469	/** Flag whether a request from the BIOS is pending which the
470	* worker thread needs to process. */
471	volatile bool fBiosReqPending;
472
473	/** Worker thread. */
474	R3PTRTYPE(PPDMTHREAD) pThreadWrk;
475
476	/** Pointer to the array of addresses to redo. */
477	R3PTRTYPE(PRTGCPHYS) paGCPhysAddrCCBRedo;
478	/** Number of addresses the redo array holds. */
479	uint32_t cReqsRedo;
480	} BUSLOGICR3;
481	/** Pointer to the ring-3 BusLogic device emulation state. */
482	typedef BUSLOGICR3 *PBUSLOGICR3;
483
484
485	/**
486	* The ring-0 BusLogic device emulation state.
487	*/
488	typedef struct BUSLOGICR0
489	{
490	uint64_t uUnused;
491	} BUSLOGICR0;
492	/** Pointer to the ring-0 BusLogic device emulation state. */
493	typedef BUSLOGICR0 *PBUSLOGICR0;
494
495
496	/**
497	* The raw-mode BusLogic device emulation state.
498	*/
499	typedef struct BUSLOGICRC
500	{
501	uint64_t uUnused;
502	} BUSLOGICRC;
503	/** Pointer to the raw-mode BusLogic device emulation state. */
504	typedef BUSLOGICRC *PBUSLOGICRC;
505
506
507	/** The current context BusLogic device emulation state. */
508	typedef CTX_SUFF(BUSLOGIC) BUSLOGICCC;
509	/** Pointer to the current context BusLogic device emulation state. */
510	typedef CTX_SUFF(PBUSLOGIC) PBUSLOGICCC;
511
512
513	/** Register offsets in the I/O port space. */
514	#define BUSLOGIC_REGISTER_CONTROL 0 /*< Writeonly /
515	/** Fields for the control register. */
516	# define BL_CTRL_RSBUS RT_BIT(4) /* Reset SCSI Bus. */
517	# define BL_CTRL_RINT RT_BIT(5) /* Reset Interrupt. */
518	# define BL_CTRL_RSOFT RT_BIT(6) /* Soft Reset. */
519	# define BL_CTRL_RHARD RT_BIT(7) /* Hard Reset. */
520
521	#define BUSLOGIC_REGISTER_STATUS 0 /*< Readonly /
522	/** Fields for the status register. */
523	# define BL_STAT_CMDINV RT_BIT(0) /* Command Invalid. */
524	# define BL_STAT_DIRRDY RT_BIT(2) /* Data In Register Ready. */
525	# define BL_STAT_CPRBSY RT_BIT(3) /* Command/Parameter Out Register Busy. */
526	# define BL_STAT_HARDY RT_BIT(4) /* Host Adapter Ready. */
527	# define BL_STAT_INREQ RT_BIT(5) /* Initialization Required. */
528	# define BL_STAT_DFAIL RT_BIT(6) /* Diagnostic Failure. */
529	# define BL_STAT_DACT RT_BIT(7) /* Diagnistic Active. */
530
531	#define BUSLOGIC_REGISTER_COMMAND 1 /*< Writeonly /
532	#define BUSLOGIC_REGISTER_DATAIN 1 /*< Readonly /
533	#define BUSLOGIC_REGISTER_INTERRUPT 2 /*< Readonly /
534	/** Fields for the interrupt register. */
535	# define BL_INTR_IMBL RT_BIT(0) /* Incoming Mailbox Loaded. */
536	# define BL_INTR_OMBR RT_BIT(1) /* Outgoing Mailbox Available. */
537	# define BL_INTR_CMDC RT_BIT(2) /* Command Complete. */
538	# define BL_INTR_RSTS RT_BIT(3) /* SCSI Bus Reset State. */
539	# define BL_INTR_INTV RT_BIT(7) /* Interrupt Valid. */
540
541	#define BUSLOGIC_REGISTER_GEOMETRY 3 /* Readonly */
542	# define BL_GEOM_XLATEN RT_BIT(7) /* Extended geometry translation enabled. */
543
544	/** Structure for the INQUIRE_PCI_HOST_ADAPTER_INFORMATION reply. */
545	typedef struct ReplyInquirePCIHostAdapterInformation
546	{
547	uint8_t IsaIOPort;
548	uint8_t IRQ;
549	unsigned char LowByteTerminated : 1;
550	unsigned char HighByteTerminated : 1;
551	unsigned char uReserved : 2; /* Reserved. */
552	unsigned char JP1 : 1; /* Whatever that means. */
553	unsigned char JP2 : 1; /* Whatever that means. */
554	unsigned char JP3 : 1; /* Whatever that means. */
555	/** Whether the provided info is valid. */
556	unsigned char InformationIsValid: 1;
557	uint8_t uReserved2; /* Reserved. */
558	} ReplyInquirePCIHostAdapterInformation, *PReplyInquirePCIHostAdapterInformation;
559	AssertCompileSize(ReplyInquirePCIHostAdapterInformation, 4);
560
561	/** Structure for the INQUIRE_CONFIGURATION reply. */
562	typedef struct ReplyInquireConfiguration
563	{
564	unsigned char uReserved1 : 5;
565	bool fDmaChannel5 : 1;
566	bool fDmaChannel6 : 1;
567	bool fDmaChannel7 : 1;
568	bool fIrqChannel9 : 1;
569	bool fIrqChannel10 : 1;
570	bool fIrqChannel11 : 1;
571	bool fIrqChannel12 : 1;
572	unsigned char uReserved2 : 1;
573	bool fIrqChannel14 : 1;
574	bool fIrqChannel15 : 1;
575	unsigned char uReserved3 : 1;
576	unsigned char uHostAdapterId : 4;
577	unsigned char uReserved4 : 4;
578	} ReplyInquireConfiguration, *PReplyInquireConfiguration;
579	AssertCompileSize(ReplyInquireConfiguration, 3);
580
581	/** Structure for the INQUIRE_SETUP_INFORMATION reply. */
582	typedef struct ReplyInquireSetupInformationSynchronousValue
583	{
584	unsigned char uOffset : 4;
585	unsigned char uTransferPeriod : 3;
586	bool fSynchronous : 1;
587	}ReplyInquireSetupInformationSynchronousValue, *PReplyInquireSetupInformationSynchronousValue;
588	AssertCompileSize(ReplyInquireSetupInformationSynchronousValue, 1);
589
590	typedef struct ReplyInquireSetupInformation
591	{
592	bool fSynchronousInitiationEnabled : 1;
593	bool fParityCheckingEnabled : 1;
594	unsigned char uReserved1 : 6;
595	uint8_t uBusTransferRate;
596	uint8_t uPreemptTimeOnBus;
597	uint8_t uTimeOffBus;
598	uint8_t cMailbox;
599	Addr24 MailboxAddress;
600	ReplyInquireSetupInformationSynchronousValue SynchronousValuesId0To7[8];
601	uint8_t uDisconnectPermittedId0To7;
602	uint8_t uSignature;
603	uint8_t uCharacterD;
604	uint8_t uHostBusType;
605	uint8_t uWideTransferPermittedId0To7;
606	uint8_t uWideTransfersActiveId0To7;
607	ReplyInquireSetupInformationSynchronousValue SynchronousValuesId8To15[8];
608	uint8_t uDisconnectPermittedId8To15;
609	uint8_t uReserved2;
610	uint8_t uWideTransferPermittedId8To15;
611	uint8_t uWideTransfersActiveId8To15;
612	} ReplyInquireSetupInformation, *PReplyInquireSetupInformation;
613	AssertCompileSize(ReplyInquireSetupInformation, 34);
614
615	/** Structure for the INQUIRE_EXTENDED_SETUP_INFORMATION. */
616	#pragma pack(1)
617	typedef struct ReplyInquireExtendedSetupInformation
618	{
619	uint8_t uBusType;
620	uint8_t uBiosAddress;
621	uint16_t u16ScatterGatherLimit;
622	uint8_t cMailbox;
623	uint32_t uMailboxAddressBase;
624	unsigned char uReserved1 : 2;
625	bool fFastEISA : 1;
626	unsigned char uReserved2 : 3;
627	bool fLevelSensitiveInterrupt : 1;
628	unsigned char uReserved3 : 1;
629	unsigned char aFirmwareRevision[3];
630	bool fHostWideSCSI : 1;
631	bool fHostDifferentialSCSI : 1;
632	bool fHostSupportsSCAM : 1;
633	bool fHostUltraSCSI : 1;
634	bool fHostSmartTermination : 1;
635	unsigned char uReserved4 : 3;
636	} ReplyInquireExtendedSetupInformation, *PReplyInquireExtendedSetupInformation;
637	AssertCompileSize(ReplyInquireExtendedSetupInformation, 14);
638	#pragma pack()
639
640	/** Structure for the INITIALIZE EXTENDED MAILBOX request. */
641	#pragma pack(1)
642	typedef struct RequestInitializeExtendedMailbox
643	{
644	/** Number of mailboxes in guest memory. */
645	uint8_t cMailbox;
646	/** Physical address of the first mailbox. */
647	uint32_t uMailboxBaseAddress;
648	} RequestInitializeExtendedMailbox, *PRequestInitializeExtendedMailbox;
649	AssertCompileSize(RequestInitializeExtendedMailbox, 5);
650	#pragma pack()
651
652	/** Structure for the INITIALIZE MAILBOX request. */
653	typedef struct
654	{
655	/** Number of mailboxes to set up. */
656	uint8_t cMailbox;
657	/** Physical address of the first mailbox. */
658	Addr24 aMailboxBaseAddr;
659	} RequestInitMbx, *PRequestInitMbx;
660	AssertCompileSize(RequestInitMbx, 4);
661
662	/**
663	* Structure of a mailbox in guest memory.
664	* The incoming and outgoing mailbox have the same size
665	* but the incoming one has some more fields defined which
666	* are marked as reserved in the outgoing one.
667	* The last field is also different from the type.
668	* For outgoing mailboxes it is the action and
669	* for incoming ones the completion status code for the task.
670	* We use one structure for both types.
671	*/
672	typedef struct Mailbox32
673	{
674	/** Physical address of the CCB structure in the guest memory. */
675	uint32_t u32PhysAddrCCB;
676	/** Type specific data. */
677	union
678	{
679	/** For outgoing mailboxes. */
680	struct
681	{
682	/** Reserved */
683	uint8_t uReserved[3];
684	/** Action code. */
685	uint8_t uActionCode;
686	} out;
687	/** For incoming mailboxes. */
688	struct
689	{
690	/** The host adapter status after finishing the request. */
691	uint8_t uHostAdapterStatus;
692	/** The status of the device which executed the request after executing it. */
693	uint8_t uTargetDeviceStatus;
694	/** Reserved. */
695	uint8_t uReserved;
696	/** The completion status code of the request. */
697	uint8_t uCompletionCode;
698	} in;
699	} u;
700	} Mailbox32, *PMailbox32;
701	AssertCompileSize(Mailbox32, 8);
702
703	/** Old style 24-bit mailbox entry. */
704	typedef struct Mailbox24
705	{
706	/** Mailbox command (incoming) or state (outgoing). */
707	uint8_t uCmdState;
708	/** Physical address of the CCB structure in the guest memory. */
709	Addr24 aPhysAddrCCB;
710	} Mailbox24, *PMailbox24;
711	AssertCompileSize(Mailbox24, 4);
712
713	/**
714	* Action codes for outgoing mailboxes.
715	*/
716	enum BUSLOGIC_MAILBOX_OUTGOING_ACTION
717	{
718	BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE = 0x00,
719	BUSLOGIC_MAILBOX_OUTGOING_ACTION_START_COMMAND = 0x01,
720	BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND = 0x02
721	};
722
723	/**
724	* Completion codes for incoming mailboxes.
725	*/
726	enum BUSLOGIC_MAILBOX_INCOMING_COMPLETION
727	{
728	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_FREE = 0x00,
729	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITHOUT_ERROR = 0x01,
730	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED = 0x02,
731	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND = 0x03,
732	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR = 0x04,
733	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_INVALID_CCB = 0x05
734	};
735
736	/**
737	* Host adapter status for incoming mailboxes.
738	*/
739	enum BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS
740	{
741	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED = 0x00,
742	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CMD_COMPLETED = 0x0a,
743	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CMD_COMPLETED_WITH_FLAG = 0x0b,
744	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_DATA_UNDERUN = 0x0c,
745	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT = 0x11,
746	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_DATA_OVERRUN = 0x12,
747	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_UNEXPECTED_BUS_FREE = 0x13,
748	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_BUS_PHASE_REQUESTED = 0x14,
749	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_OUTGOING_MAILBOX_ACTION_CODE = 0x15,
750	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_OPERATION_CODE = 0x16,
751	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CCB_HAS_INVALID_LUN = 0x17,
752	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER = 0x1a,
753	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_AUTO_REQUEST_SENSE_FAILED = 0x1b,
754	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TAGGED_QUEUING_MESSAGE_REJECTED = 0x1c,
755	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_UNSUPPORTED_MESSAGE_RECEIVED = 0x1d,
756	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_HARDWARE_FAILED = 0x20,
757	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TARGET_FAILED_RESPONSE_TO_ATN = 0x21,
758	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_ASSERTED_RST = 0x22,
759	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_OTHER_DEVICE_ASSERTED_RST = 0x23,
760	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TARGET_DEVICE_RECONNECTED_IMPROPERLY = 0x24,
761	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_ASSERTED_BUS_DEVICE_RESET = 0x25,
762	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED = 0x26,
763	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_SOFTWARE_ERROR = 0x27,
764	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_HARDWARE_TIMEOUT_ERROR = 0x30,
765	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_PARITY_ERROR_DETECTED = 0x34
766	};
767
768	/**
769	* Device status codes for incoming mailboxes.
770	*/
771	enum BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS
772	{
773	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD = 0x00,
774	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_CHECK_CONDITION = 0x02,
775	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_DEVICE_BUSY = 0x08
776	};
777
778	/**
779	* Opcode types for CCB.
780	*/
781	enum BUSLOGIC_CCB_OPCODE
782	{
783	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB = 0x00,
784	BUSLOGIC_CCB_OPCODE_TARGET_CCB = 0x01,
785	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER = 0x02,
786	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH = 0x03,
787	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER = 0x04,
788	BUSLOGIC_CCB_OPCODE_BUS_DEVICE_RESET = 0x81
789	};
790
791	/**
792	* Data transfer direction.
793	*/
794	enum BUSLOGIC_CCB_DIRECTION
795	{
796	BUSLOGIC_CCB_DIRECTION_UNKNOWN = 0x00,
797	BUSLOGIC_CCB_DIRECTION_IN = 0x01,
798	BUSLOGIC_CCB_DIRECTION_OUT = 0x02,
799	BUSLOGIC_CCB_DIRECTION_NO_DATA = 0x03
800	};
801
802	/**
803	* The command control block for a SCSI request.
804	*/
805	typedef struct CCB32
806	{
807	/** Opcode. */
808	uint8_t uOpcode;
809	/** Reserved */
810	unsigned char uReserved1 : 3;
811	/** Data direction for the request. */
812	unsigned char uDataDirection : 2;
813	/** Whether the request is tag queued. */
814	bool fTagQueued : 1;
815	/** Queue tag mode. */
816	unsigned char uQueueTag : 2;
817	/** Length of the SCSI CDB. */
818	uint8_t cbCDB;
819	/** Sense data length. */
820	uint8_t cbSenseData;
821	/** Data length. */
822	uint32_t cbData;
823	/** Data pointer.
824	* This points to the data region or a scatter gather list based on the opcode.
825	*/
826	uint32_t u32PhysAddrData;
827	/** Reserved. */
828	uint8_t uReserved2[2];
829	/** Host adapter status. */
830	uint8_t uHostAdapterStatus;
831	/** Device adapter status. */
832	uint8_t uDeviceStatus;
833	/** The device the request is sent to. */
834	uint8_t uTargetId;
835	/*The LUN in the device. /
836	unsigned char uLogicalUnit : 5;
837	/** Legacy tag. */
838	bool fLegacyTagEnable : 1;
839	/** Legacy queue tag. */
840	unsigned char uLegacyQueueTag : 2;
841	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
842	uint8_t abCDB[12];
843	/** Reserved. */
844	uint8_t uReserved3[6];
845	/** Sense data pointer. */
846	uint32_t u32PhysAddrSenseData;
847	} CCB32, *PCCB32;
848	AssertCompileSize(CCB32, 40);
849
850
851	/**
852	* The 24-bit command control block.
853	*/
854	typedef struct CCB24
855	{
856	/** Opcode. */
857	uint8_t uOpcode;
858	/** The LUN in the device. */
859	unsigned char uLogicalUnit : 3;
860	/** Data direction for the request. */
861	unsigned char uDataDirection : 2;
862	/** The target device ID. */
863	unsigned char uTargetId : 3;
864	/** Length of the SCSI CDB. */
865	uint8_t cbCDB;
866	/** Sense data length. */
867	uint8_t cbSenseData;
868	/** Data length. */
869	Len24 acbData;
870	/** Data pointer.
871	* This points to the data region or a scatter gather list based on the opc
872	*/
873	Addr24 aPhysAddrData;
874	/** Pointer to next CCB for linked commands. */
875	Addr24 aPhysAddrLink;
876	/** Command linking identifier. */
877	uint8_t uLinkId;
878	/** Host adapter status. */
879	uint8_t uHostAdapterStatus;
880	/** Device adapter status. */
881	uint8_t uDeviceStatus;
882	/** Two unused bytes. */
883	uint8_t aReserved[2];
884	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
885	uint8_t abCDB[12];
886	} CCB24, *PCCB24;
887	AssertCompileSize(CCB24, 30);
888
889	/**
890	* The common 24-bit/32-bit command control block. The 32-bit CCB is laid out
891	* such that many fields are in the same location as in the older 24-bit CCB.
892	*/
893	typedef struct CCBC
894	{
895	/** Opcode. */
896	uint8_t uOpcode;
897	/** The LUN in the device. */
898	unsigned char uPad1 : 3;
899	/** Data direction for the request. */
900	unsigned char uDataDirection : 2;
901	/** The target device ID. */
902	unsigned char uPad2 : 3;
903	/** Length of the SCSI CDB. */
904	uint8_t cbCDB;
905	/** Sense data length. */
906	uint8_t cbSenseData;
907	uint8_t aPad1[10];
908	/** Host adapter status. */
909	uint8_t uHostAdapterStatus;
910	/** Device adapter status. */
911	uint8_t uDeviceStatus;
912	uint8_t aPad2[2];
913	/** The SCSI CDB (up to 12 bytes). */
914	uint8_t abCDB[12];
915	} CCBC, *PCCBC;
916	AssertCompileSize(CCBC, 30);
917
918	/* Make sure that the 24-bit/32-bit/common CCB offsets match. */
919	AssertCompileMemberOffset(CCBC, cbCDB, 2);
920	AssertCompileMemberOffset(CCB24, cbCDB, 2);
921	AssertCompileMemberOffset(CCB32, cbCDB, 2);
922	AssertCompileMemberOffset(CCBC, uHostAdapterStatus, 14);
923	AssertCompileMemberOffset(CCB24, uHostAdapterStatus, 14);
924	AssertCompileMemberOffset(CCB32, uHostAdapterStatus, 14);
925	AssertCompileMemberOffset(CCBC, abCDB, 18);
926	AssertCompileMemberOffset(CCB24, abCDB, 18);
927	AssertCompileMemberOffset(CCB32, abCDB, 18);
928
929	/** A union of all CCB types (24-bit/32-bit/common). */
930	typedef union CCBU
931	{
932	CCB32 n; /*< New 32-bit CCB. /
933	CCB24 o; /*< Old 24-bit CCB. /
934	CCBC c; /*< Common CCB subset. /
935	} CCBU, *PCCBU;
936
937	/** 32-bit scatter-gather list entry. */
938	typedef struct SGE32
939	{
940	uint32_t cbSegment;
941	uint32_t u32PhysAddrSegmentBase;
942	} SGE32, *PSGE32;
943	AssertCompileSize(SGE32, 8);
944
945	/** 24-bit scatter-gather list entry. */
946	typedef struct SGE24
947	{
948	Len24 acbSegment;
949	Addr24 aPhysAddrSegmentBase;
950	} SGE24, *PSGE24;
951	AssertCompileSize(SGE24, 6);
952
953	/**
954	* The structure for the "Execute SCSI Command" command.
955	*/
956	typedef struct ESCMD
957	{
958	/** Data length. */
959	uint32_t cbData;
960	/** Data pointer. */
961	uint32_t u32PhysAddrData;
962	/** The device the request is sent to. */
963	uint8_t uTargetId;
964	/** The LUN in the device. */
965	uint8_t uLogicalUnit;
966	/** Reserved */
967	unsigned char uReserved1 : 3;
968	/** Data direction for the request. */
969	unsigned char uDataDirection : 2;
970	/** Reserved */
971	unsigned char uReserved2 : 3;
972	/** Length of the SCSI CDB. */
973	uint8_t cbCDB;
974	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
975	uint8_t abCDB[12];
976	} ESCMD, *PESCMD;
977	AssertCompileSize(ESCMD, 24);
978
979	/**
980	* Task state for a CCB request.
981	*/
982	typedef struct BUSLOGICREQ
983	{
984	/** PDM extended media interface I/O request hande. */
985	PDMMEDIAEXIOREQ hIoReq;
986	/** Device this task is assigned to. */
987	PBUSLOGICDEVICE pTargetDevice;
988	/** The command control block from the guest. */
989	CCBU CCBGuest;
990	/** Guest physical address of th CCB. */
991	RTGCPHYS GCPhysAddrCCB;
992	/** Pointer to the R3 sense buffer. */
993	uint8_t *pbSenseBuffer;
994	/** Flag whether this is a request from the BIOS. */
995	bool fBIOS;
996	/** 24-bit request flag (default is 32-bit). */
997	bool fIs24Bit;
998	/** SCSI status code. */
999	uint8_t u8ScsiSts;
1000	} BUSLOGICREQ;
1001
1002	#ifdef IN_RING3
1003	/**
1004	* Memory buffer callback.
1005	*
1006	* @returns nothing.
1007	* @param pDevIns The device instance.
1008	* @param pThis Pointer to the shared BusLogic instance data.
1009	* @param GCPhys The guest physical address of the memory buffer.
1010	* @param pSgBuf The pointer to the host R3 S/G buffer.
1011	* @param cbCopy How many bytes to copy between the two buffers.
1012	* @param pcbSkip Initially contains the amount of bytes to skip
1013	* starting from the guest physical address before
1014	* accessing the S/G buffer and start copying data.
1015	* On return this contains the remaining amount if
1016	* cbCopy < *pcbSkip or 0 otherwise.
1017	*/
1018	typedef DECLCALLBACKTYPE(void, FNBUSLOGICR3MEMCOPYCALLBACK,(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1019	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip));
1020	/** Pointer to a memory copy buffer callback. */
1021	typedef FNBUSLOGICR3MEMCOPYCALLBACK *PFNBUSLOGICR3MEMCOPYCALLBACK;
1022	#endif
1023
1024	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
1025
1026
1027	/*********************************************************************************************************************************
1028	* Internal Functions *
1029	*********************************************************************************************************************************/
1030	#ifdef IN_RING3
1031	static int buslogicR3RegisterISARange(PPDMDEVINS pDevIns, PBUSLOGIC pThis, uint8_t uBaseCode);
1032	#endif
1033
1034
1035	/**
1036	* Assert IRQ line of the BusLogic adapter. Rather than using
1037	* the more modern method of the guest explicitly only clearing
1038	* the interrupt causes it handled, BusLogic never reports all
1039	* interrupts at once. Instead, new interrupts are postponed if
1040	* an interrupt of a different type is still pending.
1041	*
1042	* @returns nothing.
1043	* @param pDevIns The device instance.
1044	* @param pThis Pointer to the shared BusLogic instance data.
1045	* @param fSuppressIrq Flag to suppress IRQ generation regardless of fIRQEnabled
1046	* @param uIrqType Type of interrupt being generated.
1047	*/
1048	static void buslogicSetInterrupt(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fSuppressIrq, uint8_t uIrqType)
1049	{
1050	LogFlowFunc(("pThis=%#p, setting %#02x (current %#02x, pending %#02x)\n",
1051	pThis, uIrqType, pThis->regInterrupt, pThis->uPendingIntr));
1052
1053	/* A CMDC interrupt overrides other pending interrupts. The documentation may claim
1054	* otherwise, but a real BT-958 replaces a pending IMBL with a CMDC; the IMBL simply
1055	* vanishes. However, if there's a CMDC already active, another CMDC is latched and
1056	* reported once the first CMDC is cleared.
1057	*/
1058	if (uIrqType & BL_INTR_CMDC)
1059	{
1060	Assert(uIrqType == BL_INTR_CMDC);
1061	if ((pThis->regInterrupt & BL_INTR_INTV) && !(pThis->regInterrupt & BL_INTR_CMDC))
1062	Log(("CMDC overriding pending interrupt! (was %02x)\n", pThis->regInterrupt));
1063	if (!(pThis->regInterrupt & BL_INTR_CMDC))
1064	pThis->regInterrupt \|= uIrqType \| BL_INTR_INTV; /* Report now. */
1065	else
1066	pThis->uPendingIntr \|= uIrqType; /* Report later. */
1067	}
1068	else if (uIrqType & (BL_INTR_IMBL \| BL_INTR_OMBR))
1069	{
1070	/* If the CMDC interrupt is pending, store IMBL/OMBR for later. Note that IMBL
1071	* and OMBR can be reported together even if an interrupt of the other type is
1072	* already pending.
1073	*/
1074	if (!(pThis->regInterrupt & BL_INTR_CMDC))
1075	pThis->regInterrupt \|= uIrqType \| BL_INTR_INTV; /* Report now. */
1076	else
1077	pThis->uPendingIntr \|= uIrqType; /* Report later. */
1078	}
1079	else /* We do not expect to see BL_INTR_RSTS at this point. */
1080	AssertMsgFailed(("Invalid interrupt state (unknown interrupt cause)!\n"));
1081	AssertMsg(pThis->regInterrupt, ("Invalid interrupt state (interrupt not set)!\n"));
1082	AssertMsg(pThis->regInterrupt != BL_INTR_INTV, ("Invalid interrupt state (set but no cause)!\n"));
1083
1084	if (pThis->fIRQEnabled && !fSuppressIrq)
1085	{
1086	if (!pThis->uIsaIrq)
1087	PDMDevHlpPCISetIrq(pDevIns, 0, 1);
1088	else
1089	PDMDevHlpISASetIrq(pDevIns, pThis->uIsaIrq, 1);
1090	}
1091	}
1092
1093	/**
1094	* Deasserts the interrupt line of the BusLogic adapter.
1095	*
1096	* @returns nothing.
1097	* @param pDevIns The device instance.
1098	* @param pThis Pointer to the shared BusLogic instance data.
1099	*/
1100	static void buslogicClearInterrupt(PPDMDEVINS pDevIns, PBUSLOGIC pThis)
1101	{
1102	LogFlowFunc(("pThis=%#p, clearing %#02x (pending %#02x)\n",
1103	pThis, pThis->regInterrupt, pThis->uPendingIntr));
1104	pThis->regInterrupt = 0;
1105	pThis->regStatus &= ~BL_STAT_CMDINV;
1106	if (!pThis->uIsaIrq)
1107	PDMDevHlpPCISetIrq(pDevIns, 0, 0);
1108	else
1109	PDMDevHlpISASetIrq(pDevIns, pThis->uIsaIrq, 0);
1110	/* If there's another pending interrupt, report it now. */
1111	if (pThis->uPendingIntr)
1112	{
1113	buslogicSetInterrupt(pDevIns, pThis, false, pThis->uPendingIntr);
1114	pThis->uPendingIntr = 0;
1115	}
1116	}
1117
1118	#if defined(IN_RING3)
1119
1120	/**
1121	* Advances the mailbox pointer to the next slot.
1122	*
1123	* @returns nothing.
1124	* @param pThis Pointer to the shared BusLogic instance data.
1125	*/
1126	DECLINLINE(void) buslogicR3OutgoingMailboxAdvance(PBUSLOGIC pThis)
1127	{
1128	pThis->uMailboxOutgoingPositionCurrent = (pThis->uMailboxOutgoingPositionCurrent + 1) % pThis->cMailbox;
1129	}
1130
1131	/**
1132	* Initialize local RAM of host adapter with default values.
1133	*
1134	* @returns nothing.
1135	* @param pThis Pointer to the shared BusLogic instance data.
1136	*/
1137	static void buslogicR3InitializeLocalRam(PBUSLOGIC pThis)
1138	{
1139	/*
1140	* These values are mostly from what I think is right
1141	* looking at the dmesg output from a Linux guest inside
1142	* a VMware server VM.
1143	*
1144	* So they don't have to be right :)
1145	*/
1146	memset(pThis->LocalRam.u8View, 0, sizeof(HostAdapterLocalRam));
1147	pThis->LocalRam.structured.autoSCSIData.fLevelSensitiveInterrupt = true;
1148	pThis->LocalRam.structured.autoSCSIData.fParityCheckingEnabled = true;
1149	pThis->LocalRam.structured.autoSCSIData.fExtendedTranslation = true; /* Same as in geometry register. */
1150	pThis->LocalRam.structured.autoSCSIData.u16DeviceEnabledMask = UINT16_MAX; /* All enabled. Maybe mask out non present devices? */
1151	pThis->LocalRam.structured.autoSCSIData.u16WidePermittedMask = UINT16_MAX;
1152	pThis->LocalRam.structured.autoSCSIData.u16FastPermittedMask = UINT16_MAX;
1153	pThis->LocalRam.structured.autoSCSIData.u16SynchronousPermittedMask = UINT16_MAX;
1154	pThis->LocalRam.structured.autoSCSIData.u16DisconnectPermittedMask = UINT16_MAX;
1155	pThis->LocalRam.structured.autoSCSIData.fStrictRoundRobinMode = pThis->fStrictRoundRobinMode;
1156	pThis->LocalRam.structured.autoSCSIData.u16UltraPermittedMask = UINT16_MAX;
1157	pThis->LocalRam.structured.autoSCSIData.uSCSIId = 7;
1158	pThis->LocalRam.structured.autoSCSIData.uHostAdapterIoPortAddress = pThis->uDefaultISABaseCode == ISA_BASE_DISABLED ? 2 : pThis->uDefaultISABaseCode;
1159	/** @todo calculate checksum? */
1160	}
1161
1162	/**
1163	* Do a hardware reset of the buslogic adapter.
1164	*
1165	* @returns VBox status code.
1166	* @param pDevIns The device instance.
1167	* @param pThis Pointer to the shared BusLogic instance data.
1168	* @param pThisCC Pointer to the ring-3 BusLogic instance data.
1169	* @param fResetIO Flag determining whether ISA I/O should be reset.
1170	*/
1171	static int buslogicR3HwReset(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, bool fResetIO)
1172	{
1173	LogFlowFunc(("pThis=%#p\n", pThis));
1174
1175	/* Reset registers to default values. */
1176	pThis->regStatus = BL_STAT_HARDY \| BL_STAT_INREQ;
1177	pThis->regGeometry = BL_GEOM_XLATEN;
1178	pThis->uOperationCode = 0xff; /* No command executing. */
1179	pThis->iParameter = 0;
1180	pThis->cbCommandParametersLeft = 0;
1181	pThis->fIRQEnabled = true;
1182	pThis->fStrictRoundRobinMode = false;
1183	pThis->fExtendedLunCCBFormat = false;
1184	pThis->uMailboxOutgoingPositionCurrent = 0;
1185	pThis->uMailboxIncomingPositionCurrent = 0;
1186	pThis->uAhaSigIdx = 0;
1187
1188	/* Clear any active/pending interrupts. */
1189	pThis->uPendingIntr = 0;
1190	buslogicClearInterrupt(pDevIns, pThis);
1191
1192	/* Guest-initiated HBA reset does not affect ISA port I/O. */
1193	if (fResetIO)
1194	buslogicR3RegisterISARange(pDevIns, pThis, pThis->uDefaultISABaseCode);
1195	buslogicR3InitializeLocalRam(pThis);
1196	vboxscsiHwReset(&pThisCC->VBoxSCSI);
1197
1198	return VINF_SUCCESS;
1199	}
1200
1201	#endif /* IN_RING3 */
1202
1203	/**
1204	* Resets the command state machine for the next command and notifies the guest.
1205	* Note that suppressing CMDC also suppresses the interrupt, but not vice versa.
1206	*
1207	* @returns nothing.
1208	* @param pDevIns The device instance.
1209	* @param pThis Pointer to the shared BusLogic instance data.
1210	* @param fSuppressIrq Flag to suppress IRQ generation regardless of current state
1211	* @param fSuppressCMDC Flag to suppress command completion status as well
1212	*/
1213	static void buslogicCommandComplete(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fSuppressIrq, bool fSuppressCMDC)
1214	{
1215	LogFlowFunc(("pThis=%#p\n", pThis));
1216	Assert(pThis->uOperationCode != BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND);
1217
1218	pThis->fUseLocalRam = false;
1219	pThis->regStatus \|= BL_STAT_HARDY;
1220	pThis->regStatus &= ~BL_STAT_DIRRDY;
1221	pThis->iReply = 0;
1222
1223	/* Some commands do not set CMDC when successful. */
1224	if (!fSuppressCMDC)
1225	{
1226	/* Notify that the command is complete. */
1227	buslogicSetInterrupt(pDevIns, pThis, fSuppressIrq, BL_INTR_CMDC);
1228	}
1229
1230	pThis->uOperationCode = 0xff;
1231	pThis->iParameter = 0;
1232	}
1233
1234	/**
1235	* Memory write helper to handle PCI/ISA differences - metadata writes.
1236	*
1237	* @returns nothing.
1238	* @param pDevIns The device instance.
1239	* @param pThis Pointer to the shared BusLogic instance data.
1240	* @param GCPhys Guest physical memory address
1241	* @param pvBuf Host side buffer address
1242	* @param cbWrite Number of bytes to write
1243	*/
1244	static void blPhysWriteMeta(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
1245	{
1246	if (!pThis->uIsaIrq)
1247	PDMDevHlpPCIPhysWriteMeta(pDevIns, GCPhys, pvBuf, cbWrite);
1248	else
1249	PDMDevHlpPhysWriteMeta(pDevIns, GCPhys, pvBuf, cbWrite);
1250	}
1251
1252	/**
1253	* Memory read helper to handle PCI/ISA differences - metadata reads.
1254	*
1255	* @returns nothing.
1256	* @param pDevIns The device instance.
1257	* @param pThis Pointer to the shared BusLogic instance data.
1258	* @param GCPhys Guest physical memory address.
1259	* @param pvBuf Host side buffer address.
1260	* @param cbRead Number of bytes to read.
1261	*/
1262	static void blPhysReadMeta(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
1263	{
1264	if (!pThis->uIsaIrq)
1265	PDMDevHlpPCIPhysReadMeta(pDevIns, GCPhys, pvBuf, cbRead);
1266	else
1267	PDMDevHlpPhysReadMeta(pDevIns, GCPhys, pvBuf, cbRead);
1268	}
1269
1270	#if defined(IN_RING3)
1271
1272	/**
1273	* Memory write helper to handle PCI/ISA differences - userdata writes.
1274	*
1275	* @returns nothing.
1276	* @param pDevIns The device instance.
1277	* @param pThis Pointer to the shared BusLogic instance data.
1278	* @param GCPhys Guest physical memory address
1279	* @param pvBuf Host side buffer address
1280	* @param cbWrite Number of bytes to write
1281	*/
1282	static void blPhysWriteUser(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
1283	{
1284	if (!pThis->uIsaIrq)
1285	PDMDevHlpPCIPhysWriteUser(pDevIns, GCPhys, pvBuf, cbWrite);
1286	else
1287	PDMDevHlpPhysWriteUser(pDevIns, GCPhys, pvBuf, cbWrite);
1288	}
1289
1290	/**
1291	* Memory read helper to handle PCI/ISA differences - userdata reads.
1292	*
1293	* @returns nothing.
1294	* @param pDevIns The device instance.
1295	* @param pThis Pointer to the shared BusLogic instance data.
1296	* @param GCPhys Guest physical memory address.
1297	* @param pvBuf Host side buffer address.
1298	* @param cbRead Number of bytes to read.
1299	*/
1300	static void blPhysReadUser(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
1301	{
1302	if (!pThis->uIsaIrq)
1303	PDMDevHlpPCIPhysReadUser(pDevIns, GCPhys, pvBuf, cbRead);
1304	else
1305	PDMDevHlpPhysReadUser(pDevIns, GCPhys, pvBuf, cbRead);
1306	}
1307
1308	/**
1309	* Initiates a hard reset which was issued from the guest.
1310	*
1311	* @returns nothing
1312	* @param pDevIns The device instance.
1313	* @param pThis Pointer to the shared BusLogic instance data.
1314	* @param pThisCC Pointer to the ring-3 BusLogic instance data.
1315	* @param fHardReset Flag initiating a hard (vs. soft) reset.
1316	*/
1317	static void buslogicR3InitiateReset(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, bool fHardReset)
1318	{
1319	LogFlowFunc(("pThis=%#p fHardReset=%d\n", pThis, fHardReset));
1320
1321	buslogicR3HwReset(pDevIns, pThis, pThisCC, false);
1322
1323	if (fHardReset)
1324	{
1325	/* Set the diagnostic active bit in the status register and clear the ready state. */
1326	pThis->regStatus \|= BL_STAT_DACT;
1327	pThis->regStatus &= ~BL_STAT_HARDY;
1328
1329	/* Remember when the guest initiated a reset (after we're done resetting). */
1330	pThis->u64ResetTime = PDMDevHlpTMTimeVirtGetNano(pDevIns);
1331	}
1332	}
1333
1334
1335	/**
1336	* Send a mailbox with set status codes to the guest.
1337	*
1338	* @returns nothing.
1339	* @param pDevIns The device instance.
1340	* @param pThis Pointer to the shared BusLogic instance data.
1341	* @param GCPhysAddrCCB The physical guest address of the CCB the mailbox is for.
1342	* @param pCCBGuest The command control block.
1343	* @param uHostAdapterStatus The host adapter status code to set.
1344	* @param uDeviceStatus The target device status to set.
1345	* @param uMailboxCompletionCode Completion status code to set in the mailbox.
1346	*/
1347	static void buslogicR3SendIncomingMailbox(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhysAddrCCB,
1348	PCCBU pCCBGuest, uint8_t uHostAdapterStatus,
1349	uint8_t uDeviceStatus, uint8_t uMailboxCompletionCode)
1350	{
1351	Mailbox32 MbxIn;
1352
1353	MbxIn.u32PhysAddrCCB = (uint32_t)GCPhysAddrCCB;
1354	MbxIn.u.in.uHostAdapterStatus = uHostAdapterStatus;
1355	MbxIn.u.in.uTargetDeviceStatus = uDeviceStatus;
1356	MbxIn.u.in.uReserved = 0;
1357	MbxIn.u.in.uCompletionCode = uMailboxCompletionCode;
1358
1359	int rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSectIntr, VINF_SUCCESS);
1360	AssertRC(rc);
1361
1362	RTGCPHYS GCPhysAddrMailboxIncoming = pThis->GCPhysAddrMailboxIncomingBase
1363	+ ( pThis->uMailboxIncomingPositionCurrent
1364	* (pThis->fMbxIs24Bit ? sizeof(Mailbox24) : sizeof(Mailbox32)) );
1365
1366	if (uMailboxCompletionCode != BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND)
1367	{
1368	LogFlowFunc(("Completing CCB %RGp hstat=%u, dstat=%u, outgoing mailbox at %RGp\n", GCPhysAddrCCB,
1369	uHostAdapterStatus, uDeviceStatus, GCPhysAddrMailboxIncoming));
1370
1371	/* Update CCB. */
1372	pCCBGuest->c.uHostAdapterStatus = uHostAdapterStatus;
1373	pCCBGuest->c.uDeviceStatus = uDeviceStatus;
1374	/* Rewrite CCB up to the CDB; perhaps more than necessary. */
1375	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrCCB, pCCBGuest, RT_UOFFSETOF(CCBC, abCDB));
1376	}
1377
1378	# ifdef RT_STRICT
1379	uint8_t uCode;
1380	unsigned uCodeOffs = pThis->fMbxIs24Bit ? RT_OFFSETOF(Mailbox24, uCmdState) : RT_OFFSETOF(Mailbox32, u.out.uActionCode);
1381	blPhysReadMeta(pDevIns, pThis, GCPhysAddrMailboxIncoming + uCodeOffs, &uCode, sizeof(uCode));
1382	Assert(uCode == BUSLOGIC_MAILBOX_INCOMING_COMPLETION_FREE);
1383	# endif
1384
1385	/* Update mailbox. */
1386	if (pThis->fMbxIs24Bit)
1387	{
1388	Mailbox24 Mbx24;
1389
1390	Mbx24.uCmdState = MbxIn.u.in.uCompletionCode;
1391	U32_TO_ADDR(Mbx24.aPhysAddrCCB, MbxIn.u32PhysAddrCCB);
1392	Log(("24-bit mailbox: completion code=%u, CCB at %RGp\n", Mbx24.uCmdState, (RTGCPHYS)ADDR_TO_U32(Mbx24.aPhysAddrCCB)));
1393	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrMailboxIncoming, &Mbx24, sizeof(Mailbox24));
1394	}
1395	else
1396	{
1397	Log(("32-bit mailbox: completion code=%u, CCB at %RGp\n", MbxIn.u.in.uCompletionCode, GCPhysAddrCCB));
1398	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrMailboxIncoming, &MbxIn, sizeof(Mailbox32));
1399	}
1400
1401	/* Advance to next mailbox position. */
1402	pThis->uMailboxIncomingPositionCurrent++;
1403	if (pThis->uMailboxIncomingPositionCurrent >= pThis->cMailbox)
1404	pThis->uMailboxIncomingPositionCurrent = 0;
1405
1406	# ifdef LOG_ENABLED
1407	ASMAtomicIncU32(&pThis->cInMailboxesReadyIfLogEnabled);
1408	# endif
1409
1410	buslogicSetInterrupt(pDevIns, pThis, false, BL_INTR_IMBL);
1411
1412	PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSectIntr);
1413	}
1414
1415	# ifdef LOG_ENABLED
1416
1417	/**
1418	* Dumps the content of a mailbox for debugging purposes.
1419	*
1420	* @return nothing
1421	* @param pMailbox The mailbox to dump.
1422	* @param fOutgoing true if dumping the outgoing state.
1423	* false if dumping the incoming state.
1424	*/
1425	static void buslogicR3DumpMailboxInfo(PMailbox32 pMailbox, bool fOutgoing)
1426	{
1427	Log(("%s: Dump for %s mailbox:\n", __FUNCTION__, fOutgoing ? "outgoing" : "incoming"));
1428	Log(("%s: u32PhysAddrCCB=%#x\n", __FUNCTION__, pMailbox->u32PhysAddrCCB));
1429	if (fOutgoing)
1430	{
1431	Log(("%s: uActionCode=%u\n", __FUNCTION__, pMailbox->u.out.uActionCode));
1432	}
1433	else
1434	{
1435	Log(("%s: uHostAdapterStatus=%u\n", __FUNCTION__, pMailbox->u.in.uHostAdapterStatus));
1436	Log(("%s: uTargetDeviceStatus=%u\n", __FUNCTION__, pMailbox->u.in.uTargetDeviceStatus));
1437	Log(("%s: uCompletionCode=%u\n", __FUNCTION__, pMailbox->u.in.uCompletionCode));
1438	}
1439	}
1440
1441	/**
1442	* Dumps the content of a command control block for debugging purposes.
1443	*
1444	* @returns nothing.
1445	* @param pCCB Pointer to the command control block to dump.
1446	* @param fIs24BitCCB Flag to determine CCB format.
1447	*/
1448	static void buslogicR3DumpCCBInfo(PCCBU pCCB, bool fIs24BitCCB)
1449	{
1450	Log(("%s: Dump for %s Command Control Block:\n", __FUNCTION__, fIs24BitCCB ? "24-bit" : "32-bit"));
1451	Log(("%s: uOpCode=%#x\n", __FUNCTION__, pCCB->c.uOpcode));
1452	Log(("%s: uDataDirection=%u\n", __FUNCTION__, pCCB->c.uDataDirection));
1453	Log(("%s: cbCDB=%u\n", __FUNCTION__, pCCB->c.cbCDB));
1454	Log(("%s: cbSenseData=%u\n", __FUNCTION__, pCCB->c.cbSenseData));
1455	Log(("%s: uHostAdapterStatus=%u\n", __FUNCTION__, pCCB->c.uHostAdapterStatus));
1456	Log(("%s: uDeviceStatus=%u\n", __FUNCTION__, pCCB->c.uDeviceStatus));
1457	if (fIs24BitCCB)
1458	{
1459	Log(("%s: cbData=%u\n", __FUNCTION__, LEN_TO_U32(pCCB->o.acbData)));
1460	Log(("%s: PhysAddrData=%#x\n", __FUNCTION__, ADDR_TO_U32(pCCB->o.aPhysAddrData)));
1461	Log(("%s: uTargetId=%u\n", __FUNCTION__, pCCB->o.uTargetId));
1462	Log(("%s: uLogicalUnit=%u\n", __FUNCTION__, pCCB->o.uLogicalUnit));
1463	}
1464	else
1465	{
1466	Log(("%s: cbData=%u\n", __FUNCTION__, pCCB->n.cbData));
1467	Log(("%s: PhysAddrData=%#x\n", __FUNCTION__, pCCB->n.u32PhysAddrData));
1468	Log(("%s: uTargetId=%u\n", __FUNCTION__, pCCB->n.uTargetId));
1469	Log(("%s: uLogicalUnit=%u\n", __FUNCTION__, pCCB->n.uLogicalUnit));
1470	Log(("%s: fTagQueued=%d\n", __FUNCTION__, pCCB->n.fTagQueued));
1471	Log(("%s: uQueueTag=%u\n", __FUNCTION__, pCCB->n.uQueueTag));
1472	Log(("%s: fLegacyTagEnable=%u\n", __FUNCTION__, pCCB->n.fLegacyTagEnable));
1473	Log(("%s: uLegacyQueueTag=%u\n", __FUNCTION__, pCCB->n.uLegacyQueueTag));
1474	Log(("%s: PhysAddrSenseData=%#x\n", __FUNCTION__, pCCB->n.u32PhysAddrSenseData));
1475	}
1476	Log(("%s: uCDB[0]=%#x\n", __FUNCTION__, pCCB->c.abCDB[0]));
1477	for (int i = 1; i < pCCB->c.cbCDB; i++)
1478	Log(("%s: uCDB[%d]=%u\n", __FUNCTION__, i, pCCB->c.abCDB[i]));
1479	}
1480
1481	# endif /* LOG_ENABLED */
1482
1483	/**
1484	* Allocate data buffer.
1485	*
1486	* @param pDevIns PDM device instance.
1487	* @param fIs24Bit Flag whether the 24bit SG format is used.
1488	* @param GCSGList Guest physical address of S/G list.
1489	* @param cEntries Number of list entries to read.
1490	* @param pSGEList Pointer to 32-bit S/G list storage.
1491	*/
1492	static void buslogicR3ReadSGEntries(PPDMDEVINS pDevIns, bool fIs24Bit, RTGCPHYS GCSGList,
1493	uint32_t cEntries, SGE32 *pSGEList)
1494	{
1495	/* Read the S/G entries. Convert 24-bit entries to 32-bit format. */
1496	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
1497	if (fIs24Bit)
1498	{
1499	SGE24 aSGE24[32];
1500	Assert(cEntries <= RT_ELEMENTS(aSGE24));
1501
1502	Log2(("Converting %u 24-bit S/G entries to 32-bit\n", cEntries));
1503	blPhysReadMeta(pDevIns, pThis, GCSGList, &aSGE24, cEntries * sizeof(SGE24));
1504	for (uint32_t i = 0; i < cEntries; ++i)
1505	{
1506	pSGEList[i].cbSegment = LEN_TO_U32(aSGE24[i].acbSegment);
1507	pSGEList[i].u32PhysAddrSegmentBase = ADDR_TO_U32(aSGE24[i].aPhysAddrSegmentBase);
1508	}
1509	}
1510	else
1511	blPhysReadMeta(pDevIns, pThis, GCSGList, pSGEList, cEntries * sizeof(SGE32));
1512	}
1513
1514	/**
1515	* Determines the size of th guest data buffer.
1516	*
1517	* @returns VBox status code.
1518	* @param pDevIns PDM device instance.
1519	* @param pCCBGuest The CCB of the guest.
1520	* @param fIs24Bit Flag whether the 24bit SG format is used.
1521	* @param pcbBuf Where to store the size of the guest data buffer on success.
1522	*/
1523	static int buslogicR3QueryDataBufferSize(PPDMDEVINS pDevIns, PCCBU pCCBGuest, bool fIs24Bit, size_t *pcbBuf)
1524	{
1525	int rc = VINF_SUCCESS;
1526	uint32_t cbDataCCB;
1527	uint32_t u32PhysAddrCCB;
1528	size_t cbBuf = 0;
1529
1530	/* Extract the data length and physical address from the CCB. */
1531	if (fIs24Bit)
1532	{
1533	u32PhysAddrCCB = ADDR_TO_U32(pCCBGuest->o.aPhysAddrData);
1534	cbDataCCB = LEN_TO_U32(pCCBGuest->o.acbData);
1535	}
1536	else
1537	{
1538	u32PhysAddrCCB = pCCBGuest->n.u32PhysAddrData;
1539	cbDataCCB = pCCBGuest->n.cbData;
1540	}
1541
1542	#if 1
1543	/* Hack for NT 10/91: A CCB describes a 2K buffer, but TEST UNIT READY is executed. This command
1544	* returns no data, hence the buffer must be left alone!
1545	*/
1546	if (pCCBGuest->c.abCDB[0] == 0)
1547	cbDataCCB = 0;
1548	#endif
1549
1550	if ( (pCCBGuest->c.uDataDirection != BUSLOGIC_CCB_DIRECTION_NO_DATA)
1551	&& cbDataCCB)
1552	{
1553	/*
1554	* The BusLogic adapter can handle two different data buffer formats.
1555	* The first one is that the data pointer entry in the CCB points to
1556	* the buffer directly. In second mode the data pointer points to a
1557	* scatter gather list which describes the buffer.
1558	*/
1559	if ( (pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER)
1560	\|\| (pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
1561	{
1562	uint32_t cScatterGatherGCRead;
1563	uint32_t iScatterGatherEntry;
1564	SGE32 aScatterGatherReadGC[32]; /* A buffer for scatter gather list entries read from guest memory. */
1565	uint32_t cScatterGatherGCLeft = cbDataCCB / (fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1566	RTGCPHYS GCPhysAddrScatterGatherCurrent = u32PhysAddrCCB;
1567
1568	/* Count number of bytes to transfer. */
1569	do
1570	{
1571	cScatterGatherGCRead = (cScatterGatherGCLeft < RT_ELEMENTS(aScatterGatherReadGC))
1572	? cScatterGatherGCLeft
1573	: RT_ELEMENTS(aScatterGatherReadGC);
1574	cScatterGatherGCLeft -= cScatterGatherGCRead;
1575
1576	buslogicR3ReadSGEntries(pDevIns, fIs24Bit, GCPhysAddrScatterGatherCurrent, cScatterGatherGCRead, aScatterGatherReadGC);
1577
1578	for (iScatterGatherEntry = 0; iScatterGatherEntry < cScatterGatherGCRead; iScatterGatherEntry++)
1579	cbBuf += aScatterGatherReadGC[iScatterGatherEntry].cbSegment;
1580
1581	/* Set address to the next entries to read. */
1582	GCPhysAddrScatterGatherCurrent += cScatterGatherGCRead * (fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1583	} while (cScatterGatherGCLeft > 0);
1584
1585	Log(("%s: cbBuf=%d\n", __FUNCTION__, cbBuf));
1586	}
1587	else if ( pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB
1588	\|\| pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
1589	cbBuf = cbDataCCB;
1590	}
1591
1592	if (RT_SUCCESS(rc))
1593	*pcbBuf = cbBuf;
1594
1595	return rc;
1596	}
1597
1598	/**
1599	* Copy from guest to host memory worker.
1600	*
1601	* @copydoc FNBUSLOGICR3MEMCOPYCALLBACK
1602	*/
1603	static DECLCALLBACK(void) buslogicR3CopyBufferFromGuestWorker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1604	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip)
1605	{
1606	size_t cbSkipped = RT_MIN(cbCopy, *pcbSkip);
1607	cbCopy -= cbSkipped;
1608	GCPhys += cbSkipped;
1609	*pcbSkip -= cbSkipped;
1610
1611	while (cbCopy)
1612	{
1613	size_t cbSeg = cbCopy;
1614	void *pvSeg = RTSgBufGetNextSegment(pSgBuf, &cbSeg);
1615
1616	AssertPtr(pvSeg);
1617	blPhysReadUser(pDevIns, pThis, GCPhys, pvSeg, cbSeg);
1618	GCPhys += cbSeg;
1619	cbCopy -= cbSeg;
1620	}
1621	}
1622
1623	/**
1624	* Copy from host to guest memory worker.
1625	*
1626	* @copydoc FNBUSLOGICR3MEMCOPYCALLBACK
1627	*/
1628	static DECLCALLBACK(void) buslogicR3CopyBufferToGuestWorker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1629	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip)
1630	{
1631	size_t cbSkipped = RT_MIN(cbCopy, *pcbSkip);
1632	cbCopy -= cbSkipped;
1633	GCPhys += cbSkipped;
1634	*pcbSkip -= cbSkipped;
1635
1636	while (cbCopy)
1637	{
1638	size_t cbSeg = cbCopy;
1639	void *pvSeg = RTSgBufGetNextSegment(pSgBuf, &cbSeg);
1640
1641	AssertPtr(pvSeg);
1642	blPhysWriteUser(pDevIns, pThis, GCPhys, pvSeg, cbSeg);
1643	GCPhys += cbSeg;
1644	cbCopy -= cbSeg;
1645	}
1646	}
1647
1648	/**
1649	* Walks the guest S/G buffer calling the given copy worker for every buffer.
1650	*
1651	* @returns The amout of bytes actually copied.
1652	* @param pDevIns The device instance.
1653	* @param pThis Pointer to the Buslogic device state.
1654	* @param pReq Pointer to the request state.
1655	* @param pfnCopyWorker The copy method to apply for each guest buffer.
1656	* @param pSgBuf The host S/G buffer.
1657	* @param cbSkip How many bytes to skip in advance before starting to copy.
1658	* @param cbCopy How many bytes to copy.
1659	*/
1660	static size_t buslogicR3SgBufWalker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1661	PFNBUSLOGICR3MEMCOPYCALLBACK pfnCopyWorker,
1662	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1663	{
1664	uint32_t cbDataCCB;
1665	uint32_t u32PhysAddrCCB;
1666	size_t cbCopied = 0;
1667
1668	/*
1669	* Add the amount to skip to the host buffer size to avoid a
1670	* few conditionals later on.
1671	*/
1672	cbCopy += cbSkip;
1673
1674	/* Extract the data length and physical address from the CCB. */
1675	if (pReq->fIs24Bit)
1676	{
1677	u32PhysAddrCCB = ADDR_TO_U32(pReq->CCBGuest.o.aPhysAddrData);
1678	cbDataCCB = LEN_TO_U32(pReq->CCBGuest.o.acbData);
1679	}
1680	else
1681	{
1682	u32PhysAddrCCB = pReq->CCBGuest.n.u32PhysAddrData;
1683	cbDataCCB = pReq->CCBGuest.n.cbData;
1684	}
1685
1686	#if 1
1687	/* Hack for NT 10/91: A CCB describes a 2K buffer, but TEST UNIT READY is executed. This command
1688	* returns no data, hence the buffer must be left alone!
1689	*/
1690	if (pReq->CCBGuest.c.abCDB[0] == 0)
1691	cbDataCCB = 0;
1692	#endif
1693
1694	LogFlowFunc(("pReq=%#p cbDataCCB=%u direction=%u cbCopy=%zu\n", pReq, cbDataCCB,
1695	pReq->CCBGuest.c.uDataDirection, cbCopy));
1696
1697	if ( (cbDataCCB > 0)
1698	&& ( pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_IN
1699	\|\| pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_OUT
1700	\|\| pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_UNKNOWN))
1701	{
1702	if ( (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER)
1703	\|\| (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
1704	{
1705	uint32_t cScatterGatherGCRead;
1706	uint32_t iScatterGatherEntry;
1707	SGE32 aScatterGatherReadGC[32]; /* Number of scatter gather list entries read from guest memory. */
1708	uint32_t cScatterGatherGCLeft = cbDataCCB / (pReq->fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1709	RTGCPHYS GCPhysAddrScatterGatherCurrent = u32PhysAddrCCB;
1710
1711	do
1712	{
1713	cScatterGatherGCRead = (cScatterGatherGCLeft < RT_ELEMENTS(aScatterGatherReadGC))
1714	? cScatterGatherGCLeft
1715	: RT_ELEMENTS(aScatterGatherReadGC);
1716	cScatterGatherGCLeft -= cScatterGatherGCRead;
1717
1718	buslogicR3ReadSGEntries(pDevIns, pReq->fIs24Bit, GCPhysAddrScatterGatherCurrent,
1719	cScatterGatherGCRead, aScatterGatherReadGC);
1720
1721	for (iScatterGatherEntry = 0; iScatterGatherEntry < cScatterGatherGCRead && cbCopy > 0; iScatterGatherEntry++)
1722	{
1723	RTGCPHYS GCPhysAddrDataBase;
1724	size_t cbCopyThis;
1725
1726	Log(("%s: iScatterGatherEntry=%u\n", __FUNCTION__, iScatterGatherEntry));
1727
1728	GCPhysAddrDataBase = (RTGCPHYS)aScatterGatherReadGC[iScatterGatherEntry].u32PhysAddrSegmentBase;
1729	cbCopyThis = RT_MIN(cbCopy, aScatterGatherReadGC[iScatterGatherEntry].cbSegment);
1730
1731	Log(("%s: GCPhysAddrDataBase=%RGp cbCopyThis=%zu\n", __FUNCTION__, GCPhysAddrDataBase, cbCopyThis));
1732
1733	pfnCopyWorker(pDevIns, pThis, GCPhysAddrDataBase, pSgBuf, cbCopyThis, &cbSkip);
1734	cbCopied += cbCopyThis;
1735	cbCopy -= cbCopyThis;
1736	}
1737
1738	/* Set address to the next entries to read. */
1739	GCPhysAddrScatterGatherCurrent += cScatterGatherGCRead * (pReq->fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1740	} while ( cScatterGatherGCLeft > 0
1741	&& cbCopy > 0);
1742
1743	}
1744	else if ( pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB
1745	\|\| pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
1746	{
1747	/* The buffer is not scattered. */
1748	RTGCPHYS GCPhysAddrDataBase = u32PhysAddrCCB;
1749
1750	AssertMsg(GCPhysAddrDataBase != 0, ("Physical address is 0\n"));
1751
1752	Log(("Non-scattered buffer:\n"));
1753	Log(("u32PhysAddrData=%#x\n", u32PhysAddrCCB));
1754	Log(("cbData=%u\n", cbDataCCB));
1755	Log(("GCPhysAddrDataBase=0x%RGp\n", GCPhysAddrDataBase));
1756
1757	/* Copy the data into the guest memory. */
1758	pfnCopyWorker(pDevIns, pThis, GCPhysAddrDataBase, pSgBuf, RT_MIN(cbDataCCB, cbCopy), &cbSkip);
1759	cbCopied += RT_MIN(cbDataCCB, cbCopy);
1760	}
1761	}
1762
1763	return cbCopied - RT_MIN(cbSkip, cbCopied);
1764	}
1765
1766	/**
1767	* Copies a data buffer into the S/G buffer set up by the guest.
1768	*
1769	* @returns Amount of bytes copied to the guest.
1770	* @param pDevIns The device instance.
1771	* @param pThis Pointer to the shared BusLogic instance data.
1772	* @param pReq Request structure.
1773	* @param pSgBuf The S/G buffer to copy from.
1774	* @param cbSkip How many bytes to skip in advance before starting to copy.
1775	* @param cbCopy How many bytes to copy.
1776	*/
1777	static size_t buslogicR3CopySgBufToGuest(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1778	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1779	{
1780	return buslogicR3SgBufWalker(pDevIns, pThis, pReq, buslogicR3CopyBufferToGuestWorker, pSgBuf, cbSkip, cbCopy);
1781	}
1782
1783	/**
1784	* Copies the guest S/G buffer into a host data buffer.
1785	*
1786	* @returns Amount of bytes copied from the guest.
1787	* @param pDevIns The device instance.
1788	* @param pThis Pointer to the shared BusLogic instance data.
1789	* @param pReq Request structure.
1790	* @param pSgBuf The S/G buffer to copy into.
1791	* @param cbSkip How many bytes to skip in advance before starting to copy.
1792	* @param cbCopy How many bytes to copy.
1793	*/
1794	static size_t buslogicR3CopySgBufFromGuest(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1795	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1796	{
1797	return buslogicR3SgBufWalker(pDevIns, pThis, pReq, buslogicR3CopyBufferFromGuestWorker, pSgBuf, cbSkip, cbCopy);
1798	}
1799
1800	/** Convert sense buffer length taking into account shortcut values. */
1801	static uint32_t buslogicR3ConvertSenseBufferLength(uint32_t cbSense)
1802	{
1803	/* Convert special sense buffer length values. */
1804	if (cbSense == 0)
1805	cbSense = 14; /* 0 means standard 14-byte buffer. */
1806	else if (cbSense == 1)
1807	cbSense = 0; /* 1 means no sense data. */
1808	else if (cbSense < 8)
1809	AssertMsgFailed(("Reserved cbSense value of %d used!\n", cbSense));
1810
1811	return cbSense;
1812	}
1813
1814	/**
1815	* Free the sense buffer.
1816	*
1817	* @returns nothing.
1818	* @param pReq Pointer to the request state.
1819	* @param fCopy If sense data should be copied to guest memory.
1820	*/
1821	static void buslogicR3SenseBufferFree(PBUSLOGICREQ pReq, bool fCopy)
1822	{
1823	uint32_t cbSenseBuffer;
1824
1825	cbSenseBuffer = buslogicR3ConvertSenseBufferLength(pReq->CCBGuest.c.cbSenseData);
1826
1827	/* Copy the sense buffer into guest memory if requested. */
1828	if (fCopy && cbSenseBuffer)
1829	{
1830	PPDMDEVINS pDevIns = pReq->pTargetDevice->pDevIns;
1831	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
1832	RTGCPHYS GCPhysAddrSenseBuffer;
1833
1834	/* With 32-bit CCBs, the (optional) sense buffer physical address is provided separately.
1835	* On the other hand, with 24-bit CCBs, the sense buffer is simply located at the end of
1836	* the CCB, right after the variable-length CDB.
1837	*/
1838	if (pReq->fIs24Bit)
1839	{
1840	GCPhysAddrSenseBuffer = pReq->GCPhysAddrCCB;
1841	GCPhysAddrSenseBuffer += pReq->CCBGuest.c.cbCDB + RT_OFFSETOF(CCB24, abCDB);
1842	}
1843	else
1844	GCPhysAddrSenseBuffer = pReq->CCBGuest.n.u32PhysAddrSenseData;
1845
1846	Log3(("%s: sense buffer: %.*Rhxs\n", __FUNCTION__, cbSenseBuffer, pReq->pbSenseBuffer));
1847	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrSenseBuffer, pReq->pbSenseBuffer, cbSenseBuffer);
1848	}
1849
1850	RTMemFree(pReq->pbSenseBuffer);
1851	pReq->pbSenseBuffer = NULL;
1852	}
1853
1854	/**
1855	* Alloc the sense buffer.
1856	*
1857	* @returns VBox status code.
1858	* @param pReq Pointer to the task state.
1859	*/
1860	static int buslogicR3SenseBufferAlloc(PBUSLOGICREQ pReq)
1861	{
1862	pReq->pbSenseBuffer = NULL;
1863
1864	uint32_t cbSenseBuffer = buslogicR3ConvertSenseBufferLength(pReq->CCBGuest.c.cbSenseData);
1865	if (cbSenseBuffer)
1866	{
1867	pReq->pbSenseBuffer = (uint8_t *)RTMemAllocZ(cbSenseBuffer);
1868	if (!pReq->pbSenseBuffer)
1869	return VERR_NO_MEMORY;
1870	}
1871
1872	return VINF_SUCCESS;
1873	}
1874
1875	#endif /* IN_RING3 */
1876
1877	/**
1878	* Parses the command buffer and executes it.
1879	*
1880	* @returns VBox status code.
1881	* @param pDevIns The PDM device instance.
1882	* @param pThis Pointer to the shared BusLogic instance data.
1883	*/
1884	static int buslogicProcessCommand(PPDMDEVINS pDevIns, PBUSLOGIC pThis)
1885	{
1886	int rc = VINF_SUCCESS;
1887	bool fSuppressIrq = false;
1888	bool fSuppressCMDC = false;
1889
1890	LogFlowFunc(("pThis=%#p\n", pThis));
1891	AssertMsg(pThis->uOperationCode != 0xff, ("There is no command to execute\n"));
1892
1893	switch (pThis->uOperationCode)
1894	{
1895	case BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT:
1896	/* Valid command, no reply. */
1897	pThis->cbReplyParametersLeft = 0;
1898	break;
1899	case BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION:
1900	{
1901	PReplyInquirePCIHostAdapterInformation pReply = (PReplyInquirePCIHostAdapterInformation)pThis->aReplyBuffer;
1902	memset(pReply, 0, sizeof(ReplyInquirePCIHostAdapterInformation));
1903
1904	/* Modeled after a real BT-958(D) */
1905	pReply->HighByteTerminated = 1;
1906	pReply->LowByteTerminated = 1;
1907	pReply->JP1 = 1; /* Closed; "Factory configured - do not alter" */
1908	pReply->InformationIsValid = 1;
1909	pReply->IsaIOPort = pThis->uISABaseCode;
1910	pReply->IRQ = PCIDevGetInterruptLine(pDevIns->apPciDevs[0]);
1911	pThis->cbReplyParametersLeft = sizeof(ReplyInquirePCIHostAdapterInformation);
1912	break;
1913	}
1914	case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
1915	{
1916	/* no-op */
1917	pThis->cbReplyParametersLeft = 0;
1918	break;
1919	}
1920	case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
1921	{
1922	/* Modify the ISA-compatible I/O port base. Note that this technically
1923	* violates the PCI spec, as this address is not reported through PCI.
1924	* However, it is required for compatibility with old drivers.
1925	*/
1926	#ifdef IN_RING3 /* We can do this from ring-0 now, but we'd like to see the LogRel, so we keep going back to ring-3 anyway. */
1927	Log(("ISA I/O for PCI (code %x)\n", pThis->aCommandBuffer[0]));
1928	buslogicR3RegisterISARange(pDevIns, pThis, pThis->aCommandBuffer[0]);
1929	pThis->cbReplyParametersLeft = 0;
1930	fSuppressIrq = true;
1931	fSuppressCMDC = true;
1932	break;
1933	#else
1934	AssertMsgFailed(("Must never get here!\n"));
1935	break;
1936	#endif
1937	}
1938	case BUSLOGICCOMMAND_INQUIRE_BOARD_ID:
1939	{
1940	/* The special option byte is important: If it is '0' or 'B', Windows NT drivers
1941	* for Adaptec AHA-154x may claim the adapter. The BusLogic drivers will claim
1942	* the adapter only when the byte is not '0' or 'B'.
1943	*/
1944	if (pThis->uDevType == DEV_AHA_1540B)
1945	{
1946	pThis->aReplyBuffer[0] = 'A'; /* Firmware option bytes */
1947	pThis->aReplyBuffer[1] = '0'; /* Special option byte */
1948	}
1949	else
1950	{
1951	pThis->aReplyBuffer[0] = 'A'; /* Firmware option bytes */
1952	pThis->aReplyBuffer[1] = 'A'; /* Special option byte */
1953	}
1954
1955	/* We report version 5.07B. This reply will provide the first two digits. */
1956	pThis->aReplyBuffer[2] = '5'; /* Major version 5 */
1957	pThis->aReplyBuffer[3] = '0'; /* Minor version 0 */
1958	pThis->cbReplyParametersLeft = 4; /* Reply is 4 bytes long */
1959	break;
1960	}
1961	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER:
1962	{
1963	if (pThis->uDevType == DEV_AHA_1540B)
1964	{
1965	/* Newer ASPI4DOS.SYS versions expect this command to fail. */
1966	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
1967	pThis->cbReplyParametersLeft = 0;
1968	pThis->regStatus \|= BL_STAT_CMDINV;
1969	break;
1970	}
1971
1972	pThis->aReplyBuffer[0] = '7';
1973	pThis->cbReplyParametersLeft = 1;
1974	break;
1975	}
1976	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER:
1977	{
1978	pThis->aReplyBuffer[0] = 'B';
1979	pThis->cbReplyParametersLeft = 1;
1980	break;
1981	}
1982	case BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS:
1983	/* The parameter list length is determined by the first byte of the command buffer. */
1984	if (pThis->iParameter == 1)
1985	{
1986	/* First pass - set the number of following parameter bytes. */
1987	pThis->cbCommandParametersLeft = pThis->aCommandBuffer[0];
1988	Log(("Set HA options: %u bytes follow\n", pThis->cbCommandParametersLeft));
1989	}
1990	else
1991	{
1992	/* Second pass - process received data. */
1993	Log(("Set HA options: received %u bytes\n", pThis->aCommandBuffer[0]));
1994	/* We ignore the data - it only concerns the SCSI hardware protocol. */
1995	}
1996	pThis->cbReplyParametersLeft = 0;
1997	break;
1998
1999	case BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND:
2000	/* The parameter list length is at least 12 bytes; the 12th byte determines
2001	* the number of additional CDB bytes that will follow.
2002	*/
2003	if (pThis->iParameter == 12)
2004	{
2005	/* First pass - set the number of following CDB bytes. */
2006	pThis->cbCommandParametersLeft = pThis->aCommandBuffer[11];
2007	Log(("Execute SCSI cmd: %u more bytes follow\n", pThis->cbCommandParametersLeft));
2008	}
2009	else
2010	{
2011	PESCMD pCmd;
2012
2013	/* Second pass - process received data. */
2014	Log(("Execute SCSI cmd: received %u bytes\n", pThis->aCommandBuffer[0]));
2015
2016	pCmd = (PESCMD)pThis->aCommandBuffer;
2017	Log(("Addr %08X, cbData %08X, cbCDB=%u\n", pCmd->u32PhysAddrData, pCmd->cbData, pCmd->cbCDB));
2018	}
2019	// This is currently a dummy - just fails every command.
2020	pThis->cbReplyParametersLeft = 4;
2021	pThis->aReplyBuffer[0] = pThis->aReplyBuffer[1] = 0;
2022	pThis->aReplyBuffer[2] = 0x11; /* HBA status (timeout). */
2023	pThis->aReplyBuffer[3] = 0; /* Device status. */
2024	break;
2025
2026	case BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER:
2027	{
2028	/* Not supported on AHA-154x. */
2029	if (pThis->uDevType == DEV_AHA_1540B)
2030	{
2031	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2032	pThis->cbReplyParametersLeft = 0;
2033	pThis->regStatus \|= BL_STAT_CMDINV;
2034	break;
2035	}
2036
2037	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2038	if (pThis->aCommandBuffer[0] > sizeof(pThis->aReplyBuffer))
2039	{
2040	Log(("Requested too much adapter model number data (%u)!\n", pThis->aCommandBuffer[0]));
2041	pThis->regStatus \|= BL_STAT_CMDINV;
2042	break;
2043	}
2044	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2045	memset(pThis->aReplyBuffer, 0, sizeof(pThis->aReplyBuffer));
2046	const char aModelName[] = "958D "; /* Trailing \0 is fine, that's the filler anyway. */
2047	int cCharsToTransfer = pThis->cbReplyParametersLeft <= sizeof(aModelName)
2048	? pThis->cbReplyParametersLeft
2049	: sizeof(aModelName);
2050
2051	for (int i = 0; i < cCharsToTransfer; i++)
2052	pThis->aReplyBuffer[i] = aModelName[i];
2053
2054	break;
2055	}
2056	case BUSLOGICCOMMAND_INQUIRE_CONFIGURATION:
2057	{
2058	uint8_t uIrq;
2059
2060	if (pThis->uIsaIrq)
2061	uIrq = pThis->uIsaIrq;
2062	else
2063	uIrq = PCIDevGetInterruptLine(pDevIns->apPciDevs[0]);
2064
2065	pThis->cbReplyParametersLeft = sizeof(ReplyInquireConfiguration);
2066	PReplyInquireConfiguration pReply = (PReplyInquireConfiguration)pThis->aReplyBuffer;
2067	memset(pReply, 0, sizeof(ReplyInquireConfiguration));
2068
2069	pReply->uHostAdapterId = 7; /* The controller has always 7 as ID. */
2070	pReply->fDmaChannel6 = 1; /* DMA channel 6 is a good default. */
2071
2072	/* The PCI IRQ is not necessarily representable in this structure.
2073	* If that is the case, the guest likely won't function correctly,
2074	* therefore we log a warning. Note that for ISA configurations, we
2075	* can only allow IRQs that can be supported; for PCI, the HBA
2076	* has no control over IRQ assignment.
2077	*/
2078	switch (uIrq)
2079	{
2080	case 9: pReply->fIrqChannel9 = 1; break;
2081	case 10: pReply->fIrqChannel10 = 1; break;
2082	case 11: pReply->fIrqChannel11 = 1; break;
2083	case 12: pReply->fIrqChannel12 = 1; break;
2084	case 14: pReply->fIrqChannel14 = 1; break;
2085	case 15: pReply->fIrqChannel15 = 1; break;
2086	default:
2087	LogRel(("Warning: PCI IRQ %d cannot be represented as ISA!\n", uIrq));
2088	break;
2089	}
2090	break;
2091	}
2092	case BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION:
2093	{
2094	/* Some Adaptec AHA-154x drivers (e.g. OS/2) execute this command and expect
2095	* it to fail. If it succeeds, the drivers refuse to load. However, some newer
2096	* Adaptec 154x models supposedly support it too??
2097	*/
2098	if (pThis->uDevType == DEV_AHA_1540B)
2099	{
2100	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2101	pThis->cbReplyParametersLeft = 0;
2102	pThis->regStatus \|= BL_STAT_CMDINV;
2103	break;
2104	}
2105
2106	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2107	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2108	PReplyInquireExtendedSetupInformation pReply = (PReplyInquireExtendedSetupInformation)pThis->aReplyBuffer;
2109	memset(pReply, 0, sizeof(ReplyInquireExtendedSetupInformation));
2110
2111	/** @todo should this reflect the RAM contents (AutoSCSIRam)? */
2112	pReply->uBusType = 'E'; /* EISA style */
2113	pReply->u16ScatterGatherLimit = 8192;
2114	pReply->cMailbox = pThis->cMailbox;
2115	pReply->uMailboxAddressBase = (uint32_t)pThis->GCPhysAddrMailboxOutgoingBase;
2116	pReply->fLevelSensitiveInterrupt = true;
2117	pReply->fHostWideSCSI = true;
2118	pReply->fHostUltraSCSI = true;
2119	memcpy(pReply->aFirmwareRevision, "07B", sizeof(pReply->aFirmwareRevision));
2120
2121	break;
2122	}
2123	case BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION:
2124	{
2125	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2126	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2127	PReplyInquireSetupInformation pReply = (PReplyInquireSetupInformation)pThis->aReplyBuffer;
2128	memset(pReply, 0, sizeof(ReplyInquireSetupInformation));
2129	pReply->fSynchronousInitiationEnabled = true;
2130	pReply->fParityCheckingEnabled = true;
2131	pReply->cMailbox = pThis->cMailbox;
2132	U32_TO_ADDR(pReply->MailboxAddress, pThis->GCPhysAddrMailboxOutgoingBase);
2133	/* The 'D' signature (actually 'SD' for Storage Dimensions, and 'BD' for BusLogic)
2134	* prevents Adaptec's OS/2 drivers from getting too friendly with BusLogic hardware
2135	* and upsetting the HBA state.
2136	*/
2137	if (pThis->uDevType == DEV_AHA_1540B)
2138	{
2139	pReply->uSignature = 0; /* Zeros for Adaptec. */
2140	pReply->uCharacterD = 0;
2141	}
2142	else
2143	{
2144	pReply->uSignature = 'B';
2145	pReply->uCharacterD = 'D'; /* BusLogic model. */
2146	}
2147	pReply->uHostBusType = 'F'; /* PCI bus. */
2148	break;
2149	}
2150	case BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM:
2151	{
2152	/*
2153	* First element in the command buffer contains start offset to read from
2154	* and second one the number of bytes to read.
2155	*/
2156	uint8_t uOffset = pThis->aCommandBuffer[0];
2157	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[1];
2158
2159	pThis->fUseLocalRam = true;
2160	pThis->iReply = uOffset;
2161	break;
2162	}
2163	case BUSLOGICCOMMAND_INITIALIZE_MAILBOX:
2164	{
2165	PRequestInitMbx pRequest = (PRequestInitMbx)pThis->aCommandBuffer;
2166
2167	pThis->cbReplyParametersLeft = 0;
2168	if (!pRequest->cMailbox)
2169	{
2170	Log(("cMailboxes=%u (24-bit mode), fail!\n", pThis->cMailbox));
2171	pThis->regStatus \|= BL_STAT_CMDINV;
2172	break;
2173	}
2174	pThis->fMbxIs24Bit = true;
2175	pThis->cMailbox = pRequest->cMailbox;
2176	pThis->uMailboxOutgoingPositionCurrent = pThis->uMailboxIncomingPositionCurrent = 0;
2177	pThis->GCPhysAddrMailboxOutgoingBase = (RTGCPHYS)ADDR_TO_U32(pRequest->aMailboxBaseAddr);
2178	/* The area for incoming mailboxes is right after the last entry of outgoing mailboxes. */
2179	pThis->GCPhysAddrMailboxIncomingBase = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox24));
2180
2181	Log(("GCPhysAddrMailboxOutgoingBase=%RGp\n", pThis->GCPhysAddrMailboxOutgoingBase));
2182	Log(("GCPhysAddrMailboxIncomingBase=%RGp\n", pThis->GCPhysAddrMailboxIncomingBase));
2183	Log(("cMailboxes=%u (24-bit mode)\n", pThis->cMailbox));
2184	LogRel(("Initialized 24-bit mailbox, %d entries at %08x\n", pRequest->cMailbox, ADDR_TO_U32(pRequest->aMailboxBaseAddr)));
2185
2186	pThis->regStatus &= ~BL_STAT_INREQ;
2187	break;
2188	}
2189	case BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX:
2190	{
2191	if (pThis->uDevType == DEV_AHA_1540B)
2192	{
2193	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2194	pThis->cbReplyParametersLeft = 0;
2195	pThis->regStatus \|= BL_STAT_CMDINV;
2196	break;
2197	}
2198
2199	PRequestInitializeExtendedMailbox pRequest = (PRequestInitializeExtendedMailbox)pThis->aCommandBuffer;
2200
2201	pThis->cbReplyParametersLeft = 0;
2202	if (!pRequest->cMailbox)
2203	{
2204	Log(("cMailboxes=%u (32-bit mode), fail!\n", pThis->cMailbox));
2205	pThis->regStatus \|= BL_STAT_CMDINV;
2206	break;
2207	}
2208	pThis->fMbxIs24Bit = false;
2209	pThis->cMailbox = pRequest->cMailbox;
2210	pThis->uMailboxOutgoingPositionCurrent = pThis->uMailboxIncomingPositionCurrent = 0;
2211	pThis->GCPhysAddrMailboxOutgoingBase = (RTGCPHYS)pRequest->uMailboxBaseAddress;
2212	/* The area for incoming mailboxes is right after the last entry of outgoing mailboxes. */
2213	pThis->GCPhysAddrMailboxIncomingBase = (RTGCPHYS)pRequest->uMailboxBaseAddress + (pThis->cMailbox * sizeof(Mailbox32));
2214
2215	Log(("GCPhysAddrMailboxOutgoingBase=%RGp\n", pThis->GCPhysAddrMailboxOutgoingBase));
2216	Log(("GCPhysAddrMailboxIncomingBase=%RGp\n", pThis->GCPhysAddrMailboxIncomingBase));
2217	Log(("cMailboxes=%u (32-bit mode)\n", pThis->cMailbox));
2218	LogRel(("Initialized 32-bit mailbox, %d entries at %08x\n", pRequest->cMailbox, pRequest->uMailboxBaseAddress));
2219
2220	pThis->regStatus &= ~BL_STAT_INREQ;
2221	break;
2222	}
2223	case BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE:
2224	{
2225	if (pThis->aCommandBuffer[0] == 0)
2226	pThis->fStrictRoundRobinMode = false;
2227	else if (pThis->aCommandBuffer[0] == 1)
2228	pThis->fStrictRoundRobinMode = true;
2229	else
2230	AssertMsgFailed(("Invalid round robin mode %d\n", pThis->aCommandBuffer[0]));
2231
2232	pThis->cbReplyParametersLeft = 0;
2233	break;
2234	}
2235	case BUSLOGICCOMMAND_SET_CCB_FORMAT:
2236	{
2237	if (pThis->aCommandBuffer[0] == 0)
2238	pThis->fExtendedLunCCBFormat = false;
2239	else if (pThis->aCommandBuffer[0] == 1)
2240	pThis->fExtendedLunCCBFormat = true;
2241	else
2242	AssertMsgFailed(("Invalid CCB format %d\n", pThis->aCommandBuffer[0]));
2243
2244	pThis->cbReplyParametersLeft = 0;
2245	break;
2246	}
2247	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7:
2248	/* This is supposed to send TEST UNIT READY to each target/LUN.
2249	* We cheat and skip that, since we already know what's attached
2250	*/
2251	memset(pThis->aReplyBuffer, 0, 8);
2252	for (int i = 0; i < 8; ++i)
2253	{
2254	if (pThis->afDevicePresent[i])
2255	pThis->aReplyBuffer[i] = 1;
2256	}
2257	pThis->aReplyBuffer[7] = 0; /* HA hardcoded at ID 7. */
2258	pThis->cbReplyParametersLeft = 8;
2259	break;
2260	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15:
2261	/* See note about cheating above. */
2262	memset(pThis->aReplyBuffer, 0, 8);
2263	for (int i = 0; i < 8; ++i)
2264	{
2265	if (pThis->afDevicePresent[i + 8])
2266	pThis->aReplyBuffer[i] = 1;
2267	}
2268	pThis->cbReplyParametersLeft = 8;
2269	break;
2270	case BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES:
2271	{
2272	/* Each bit which is set in the 16bit wide variable means a present device. */
2273	uint16_t u16TargetsPresentMask = 0;
2274
2275	for (uint8_t i = 0; i < RT_ELEMENTS(pThis->afDevicePresent); i++)
2276	{
2277	if (pThis->afDevicePresent[i])
2278	u16TargetsPresentMask \|= (1 << i);
2279	}
2280	pThis->aReplyBuffer[0] = (uint8_t)u16TargetsPresentMask;
2281	pThis->aReplyBuffer[1] = (uint8_t)(u16TargetsPresentMask >> 8);
2282	pThis->cbReplyParametersLeft = 2;
2283	break;
2284	}
2285	case BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD:
2286	{
2287	if (pThis->aCommandBuffer[0] > sizeof(pThis->aReplyBuffer))
2288	{
2289	Log(("Requested too much synch period inquiry (%u)!\n", pThis->aCommandBuffer[0]));
2290	pThis->regStatus \|= BL_STAT_CMDINV;
2291	break;
2292	}
2293	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2294	for (uint8_t i = 0; i < pThis->cbReplyParametersLeft; i++)
2295	pThis->aReplyBuffer[i] = 0; /** @todo Figure if we need something other here. It's not needed for the linux driver */
2296
2297	break;
2298	}
2299	case BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT:
2300	{
2301	/* Not supported on AHA-154x HBAs. */
2302	if (pThis->uDevType == DEV_AHA_1540B)
2303	{
2304	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2305	pThis->cbReplyParametersLeft = 0;
2306	pThis->regStatus \|= BL_STAT_CMDINV;
2307	break;
2308	}
2309
2310	pThis->cbReplyParametersLeft = 0;
2311	if (pThis->aCommandBuffer[0] == 0)
2312	pThis->fIRQEnabled = false;
2313	else
2314	pThis->fIRQEnabled = true;
2315	/* No interrupt signaled regardless of enable/disable. NB: CMDC is still signaled! */
2316	fSuppressIrq = true;
2317	break;
2318	}
2319	case BUSLOGICCOMMAND_ECHO_COMMAND_DATA:
2320	{
2321	pThis->aReplyBuffer[0] = pThis->aCommandBuffer[0];
2322	pThis->cbReplyParametersLeft = 1;
2323	break;
2324	}
2325	case BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT:
2326	{
2327	uint8_t uEnable = pThis->aCommandBuffer[0];
2328
2329	pThis->cbReplyParametersLeft = 0;
2330	Log(("Enable OMBR: %u\n", uEnable));
2331	/* Only 0/1 are accepted. */
2332	if (uEnable > 1)
2333	pThis->regStatus \|= BL_STAT_CMDINV;
2334	else
2335	{
2336	pThis->LocalRam.structured.autoSCSIData.uReserved6 = uEnable;
2337	fSuppressIrq = true;
2338	fSuppressCMDC = true;
2339	}
2340	break;
2341	}
2342	case BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS:
2343	{
2344	pThis->cbReplyParametersLeft = 0;
2345	pThis->LocalRam.structured.autoSCSIData.uBusOnDelay = pThis->aCommandBuffer[0];
2346	Log(("Bus-on time: %d\n", pThis->aCommandBuffer[0]));
2347	break;
2348	}
2349	case BUSLOGICCOMMAND_SET_TIME_OFF_BUS:
2350	{
2351	pThis->cbReplyParametersLeft = 0;
2352	pThis->LocalRam.structured.autoSCSIData.uBusOffDelay = pThis->aCommandBuffer[0];
2353	Log(("Bus-off time: %d\n", pThis->aCommandBuffer[0]));
2354	break;
2355	}
2356	case BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE:
2357	{
2358	pThis->cbReplyParametersLeft = 0;
2359	pThis->LocalRam.structured.autoSCSIData.uDMATransferRate = pThis->aCommandBuffer[0];
2360	Log(("Bus transfer rate: %02X\n", pThis->aCommandBuffer[0]));
2361	break;
2362	}
2363	case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
2364	{
2365	RTGCPHYS GCPhysFifoBuf;
2366	Addr24 addr;
2367
2368	pThis->cbReplyParametersLeft = 0;
2369	addr.hi = pThis->aCommandBuffer[0];
2370	addr.mid = pThis->aCommandBuffer[1];
2371	addr.lo = pThis->aCommandBuffer[2];
2372	GCPhysFifoBuf = (RTGCPHYS)ADDR_TO_U32(addr);
2373	Log(("Write busmaster FIFO at: %04X\n", ADDR_TO_U32(addr)));
2374	blPhysReadMeta(pDevIns, pThis, GCPhysFifoBuf, &pThis->LocalRam.u8View[64], 64);
2375	break;
2376	}
2377	case BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO:
2378	{
2379	RTGCPHYS GCPhysFifoBuf;
2380	Addr24 addr;
2381
2382	pThis->cbReplyParametersLeft = 0;
2383	addr.hi = pThis->aCommandBuffer[0];
2384	addr.mid = pThis->aCommandBuffer[1];
2385	addr.lo = pThis->aCommandBuffer[2];
2386	GCPhysFifoBuf = (RTGCPHYS)ADDR_TO_U32(addr);
2387	Log(("Read busmaster FIFO at: %04X\n", ADDR_TO_U32(addr)));
2388	blPhysWriteMeta(pDevIns, pThis, GCPhysFifoBuf, &pThis->LocalRam.u8View[64], 64);
2389	break;
2390	}
2391	default:
2392	AssertMsgFailed(("Invalid command %#x\n", pThis->uOperationCode));
2393	RT_FALL_THRU();
2394	case BUSLOGICCOMMAND_EXT_BIOS_INFO:
2395	case BUSLOGICCOMMAND_UNLOCK_MAILBOX:
2396	/* Commands valid for Adaptec 154xC which we don't handle since
2397	* we pretend being 154xB compatible. Just mark the command as invalid.
2398	*/
2399	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2400	pThis->cbReplyParametersLeft = 0;
2401	pThis->regStatus \|= BL_STAT_CMDINV;
2402	break;
2403	case BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND: /* Should be handled already. */
2404	AssertMsgFailed(("Invalid mailbox execute state!\n"));
2405	}
2406
2407	Log(("uOperationCode=%#x, cbReplyParametersLeft=%d\n", pThis->uOperationCode, pThis->cbReplyParametersLeft));
2408
2409	/* Fail command if too much parameter data requested. */
2410	if ((pThis->cbCommandParametersLeft + pThis->iParameter) > sizeof(pThis->aCommandBuffer))
2411	{
2412	Log(("Invalid command parameter length (%u)\n", pThis->cbCommandParametersLeft));
2413	pThis->cbReplyParametersLeft = 0;
2414	pThis->cbCommandParametersLeft = 0;
2415	pThis->regStatus \|= BL_STAT_CMDINV;
2416	}
2417
2418	/* Set the data in ready bit in the status register in case the command has a reply. */
2419	if (pThis->cbReplyParametersLeft)
2420	pThis->regStatus \|= BL_STAT_DIRRDY;
2421	else if (!pThis->cbCommandParametersLeft)
2422	buslogicCommandComplete(pDevIns, pThis, fSuppressIrq, fSuppressCMDC);
2423
2424	return rc;
2425	}
2426
2427	/**
2428	* Read a register from the BusLogic adapter.
2429	*
2430	* @returns VBox status code.
2431	* @param pDevIns The device instance.
2432	* @param pThis Pointer to the shared BusLogic instance data.
2433	* @param iRegister The index of the register to read.
2434	* @param pu32 Where to store the register content.
2435	*/
2436	static int buslogicRegisterRead(PPDMDEVINS pDevIns, PBUSLOGIC pThis, unsigned iRegister, uint32_t *pu32)
2437	{
2438	static const char s_szAhaSig[] = "ADAP";
2439	int rc = VINF_SUCCESS;
2440
2441	switch (iRegister)
2442	{
2443	case BUSLOGIC_REGISTER_STATUS:
2444	{
2445	*pu32 = pThis->regStatus;
2446
2447	/* If the diagnostic active bit is set, we are in a guest-initiated
2448	* hard reset. If the guest reads the status register and waits for
2449	* the host adapter ready bit to be set, we terminate the reset right
2450	* away. However, guests may also expect the reset condition to clear
2451	* automatically after a period of time, in which case we can't show
2452	* the DIAG bit at all.
2453	*/
2454	if (pThis->regStatus & BL_STAT_DACT)
2455	{
2456	uint64_t u64AccessTime = PDMDevHlpTMTimeVirtGetNano(pDevIns);
2457
2458	pThis->regStatus &= ~BL_STAT_DACT;
2459	pThis->regStatus \|= BL_STAT_HARDY;
2460
2461	if (u64AccessTime - pThis->u64ResetTime > BUSLOGIC_RESET_DURATION_NS)
2462	{
2463	/* If reset already expired, let the guest see that right away. */
2464	*pu32 = pThis->regStatus;
2465	pThis->u64ResetTime = 0;
2466	}
2467	}
2468	break;
2469	}
2470	case BUSLOGIC_REGISTER_DATAIN:
2471	{
2472	AssertCompileSize(pThis->LocalRam, 256);
2473	AssertCompileSize(pThis->iReply, sizeof(uint8_t));
2474	AssertCompileSize(pThis->cbReplyParametersLeft, sizeof(uint8_t));
2475
2476	if (pThis->fUseLocalRam)
2477	*pu32 = pThis->LocalRam.u8View[pThis->iReply];
2478	else
2479	{
2480	/*
2481	* Real adapters seem to pad the reply with zeroes and allow up to 255 bytes even
2482	* if the real reply is shorter.
2483	*/
2484	if (pThis->iReply >= sizeof(pThis->aReplyBuffer))
2485	*pu32 = 0;
2486	else
2487	*pu32 = pThis->aReplyBuffer[pThis->iReply];
2488	}
2489
2490	/* Careful about underflow - guest can read data register even if
2491	* no data is available.
2492	*/
2493	if (pThis->cbReplyParametersLeft)
2494	{
2495	pThis->iReply++;
2496	pThis->cbReplyParametersLeft--;
2497	if (!pThis->cbReplyParametersLeft)
2498	{
2499	/*
2500	* Reply finished, set command complete bit, unset data-in ready bit and
2501	* interrupt the guest if enabled.
2502	* NB: Some commands do not set the CMDC bit / raise completion interrupt.
2503	*/
2504	if (pThis->uOperationCode == BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM)
2505	buslogicCommandComplete(pDevIns, pThis, true /* fSuppressIrq /, true / fSuppressCMDC */);
2506	else
2507	buslogicCommandComplete(pDevIns, pThis, false, false);
2508	}
2509	}
2510	LogFlowFunc(("data=%02x, iReply=%d, cbReplyParametersLeft=%u\n", *pu32,
2511	pThis->iReply, pThis->cbReplyParametersLeft));
2512	break;
2513	}
2514	case BUSLOGIC_REGISTER_INTERRUPT:
2515	{
2516	*pu32 = pThis->regInterrupt;
2517	break;
2518	}
2519	case BUSLOGIC_REGISTER_GEOMETRY:
2520	{
2521	if (pThis->uDevType == DEV_AHA_1540B)
2522	{
2523	uint8_t off = pThis->uAhaSigIdx & 3;
2524	*pu32 = s_szAhaSig[off];
2525	pThis->uAhaSigIdx = (off + 1) & 3;
2526	}
2527	else
2528	*pu32 = pThis->regGeometry;
2529	break;
2530	}
2531	default:
2532	*pu32 = UINT32_C(0xffffffff);
2533	}
2534
2535	Log2(("%s: pu32=%p:{%.*Rhxs} iRegister=%d rc=%Rrc\n",
2536	__FUNCTION__, pu32, 1, pu32, iRegister, rc));
2537
2538	return rc;
2539	}
2540
2541	/**
2542	* Write a value to a register.
2543	*
2544	* @returns VBox status code.
2545	* @param pDevIns The PDM device instance.
2546	* @param pThis Pointer to the shared BusLogic instance data.
2547	* @param iRegister The index of the register to read.
2548	* @param uVal The value to write.
2549	*/
2550	static int buslogicRegisterWrite(PPDMDEVINS pDevIns, PBUSLOGIC pThis, unsigned iRegister, uint8_t uVal)
2551	{
2552	int rc = VINF_SUCCESS;
2553
2554	switch (iRegister)
2555	{
2556	case BUSLOGIC_REGISTER_CONTROL:
2557	{
2558	if ((uVal & BL_CTRL_RHARD) \|\| (uVal & BL_CTRL_RSOFT))
2559	{
2560	#ifdef IN_RING3
2561	bool fHardReset = !!(uVal & BL_CTRL_RHARD);
2562
2563	LogRel(("BusLogic: %s reset\n", fHardReset ? "hard" : "soft"));
2564	buslogicR3InitiateReset(pDevIns, pThis, PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC), fHardReset);
2565	#else
2566	rc = VINF_IOM_R3_IOPORT_WRITE;
2567	#endif
2568	break;
2569	}
2570
2571	rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSectIntr, VINF_IOM_R3_IOPORT_WRITE);
2572	if (rc != VINF_SUCCESS)
2573	return rc;
2574
2575	#ifdef LOG_ENABLED
2576	uint32_t cMailboxesReady = ASMAtomicXchgU32(&pThis->cInMailboxesReadyIfLogEnabled, 0);
2577	Log(("%u incoming mailboxes were ready when this interrupt was cleared\n", cMailboxesReady));
2578	#endif
2579
2580	if (uVal & BL_CTRL_RINT)
2581	buslogicClearInterrupt(pDevIns, pThis);
2582
2583	PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSectIntr);
2584
2585	break;
2586	}
2587	case BUSLOGIC_REGISTER_COMMAND:
2588	{
2589	/* Fast path for mailbox execution command. */
2590	if ((uVal == BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND) && (pThis->uOperationCode == 0xff))
2591	{
2592	/// @todo Should fail if BL_STAT_INREQ is set
2593	/* If there are no mailboxes configured, don't even try to do anything. */
2594	if (pThis->cMailbox)
2595	{
2596	ASMAtomicIncU32(&pThis->cMailboxesReady);
2597	if (!ASMAtomicXchgBool(&pThis->fNotificationSent, true))
2598	{
2599	/* Wake up the worker thread. */
2600	int rc2 = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
2601	AssertRC(rc2);
2602	}
2603	}
2604
2605	return rc;
2606	}
2607
2608	/*
2609	* Check if we are already fetch command parameters from the guest.
2610	* If not we initialize executing a new command.
2611	*/
2612	if (pThis->uOperationCode == 0xff)
2613	{
2614	pThis->uOperationCode = uVal;
2615	pThis->iParameter = 0;
2616
2617	/* Mark host adapter as busy and clear the invalid status bit. */
2618	pThis->regStatus &= ~(BL_STAT_HARDY \| BL_STAT_CMDINV);
2619
2620	/* Get the number of bytes for parameters from the command code. */
2621	switch (pThis->uOperationCode)
2622	{
2623	case BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT:
2624	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER:
2625	case BUSLOGICCOMMAND_INQUIRE_BOARD_ID:
2626	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER:
2627	case BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION:
2628	case BUSLOGICCOMMAND_INQUIRE_CONFIGURATION:
2629	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7:
2630	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15:
2631	case BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES:
2632	pThis->cbCommandParametersLeft = 0;
2633	break;
2634	case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
2635	case BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION:
2636	case BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT:
2637	case BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER:
2638	/* These commands are not on AHA-154x, some Adaptec drivers (ASPI4DOS.SYS) test them. */
2639	if (pThis->uDevType == DEV_AHA_1540B)
2640	{
2641	pThis->cbCommandParametersLeft = 0;
2642	break;
2643	}
2644	RT_FALL_THRU();
2645	case BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION:
2646	case BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE:
2647	case BUSLOGICCOMMAND_SET_CCB_FORMAT:
2648	case BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD:
2649	case BUSLOGICCOMMAND_ECHO_COMMAND_DATA:
2650	case BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT:
2651	case BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS:
2652	case BUSLOGICCOMMAND_SET_TIME_OFF_BUS:
2653	case BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE:
2654	pThis->cbCommandParametersLeft = 1;
2655	break;
2656	case BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM:
2657	pThis->cbCommandParametersLeft = 2;
2658	break;
2659	case BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO:
2660	case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
2661	pThis->cbCommandParametersLeft = 3;
2662	break;
2663	case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
2664	pThis->cbCommandParametersLeft = 4;
2665	break;
2666	case BUSLOGICCOMMAND_INITIALIZE_MAILBOX:
2667	pThis->cbCommandParametersLeft = sizeof(RequestInitMbx);
2668	break;
2669	case BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX:
2670	/* Some Adaptec drivers (ASPI4DOS.SYS) test this command. */
2671	if (pThis->uDevType == DEV_AHA_1540B)
2672	{
2673	pThis->cbCommandParametersLeft = 0;
2674	break;
2675	}
2676	pThis->cbCommandParametersLeft = sizeof(RequestInitializeExtendedMailbox);
2677	break;
2678	case BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS:
2679	/* There must be at least one byte following this command. */
2680	pThis->cbCommandParametersLeft = 1;
2681	break;
2682	case BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND:
2683	/* 12 bytes + variable-length CDB. */
2684	pThis->cbCommandParametersLeft = 12;
2685	break;
2686	case BUSLOGICCOMMAND_EXT_BIOS_INFO:
2687	case BUSLOGICCOMMAND_UNLOCK_MAILBOX:
2688	/* Invalid commands. */
2689	pThis->cbCommandParametersLeft = 0;
2690	break;
2691	case BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND: /* Should not come here anymore. */
2692	default:
2693	AssertMsgFailed(("Invalid operation code %#x\n", uVal));
2694	}
2695	}
2696	else
2697	{
2698	#ifndef IN_RING3
2699	/* This command must be executed in R3 as it rehooks the ISA I/O port. */
2700	if (pThis->uOperationCode == BUSLOGICCOMMAND_MODIFY_IO_ADDRESS)
2701	{
2702	rc = VINF_IOM_R3_IOPORT_WRITE;
2703	break;
2704	}
2705	#endif
2706	/*
2707	* The real adapter would set the Command register busy bit in the status register.
2708	* The guest has to wait until it is unset.
2709	* We don't need to do it because the guest does not continue execution while we are in this
2710	* function.
2711	*/
2712	pThis->aCommandBuffer[pThis->iParameter] = uVal;
2713	pThis->iParameter++;
2714	pThis->cbCommandParametersLeft--;
2715	}
2716
2717	/* Start execution of command if there are no parameters left. */
2718	if (!pThis->cbCommandParametersLeft)
2719	{
2720	rc = buslogicProcessCommand(pDevIns, pThis);
2721	AssertMsgRC(rc, ("Processing command failed rc=%Rrc\n", rc));
2722	}
2723	break;
2724	}
2725
2726	/* On BusLogic adapters, the interrupt and geometry registers are R/W.
2727	* That is different from Adaptec 154x where those are read only.
2728	*/
2729	case BUSLOGIC_REGISTER_INTERRUPT:
2730	if (pThis->uDevType == DEV_AHA_1540B)
2731	break;
2732	pThis->regInterrupt = uVal;
2733	break;
2734
2735	case BUSLOGIC_REGISTER_GEOMETRY:
2736	if (pThis->uDevType == DEV_AHA_1540B)
2737	break;
2738	pThis->regGeometry = uVal;
2739	break;
2740
2741	default:
2742	AssertMsgFailed(("Register not available\n"));
2743	rc = VERR_IOM_IOPORT_UNUSED;
2744	}
2745
2746	return rc;
2747	}
2748
2749	/**
2750	* @callback_method_impl{FNIOMMMIONEWREAD}
2751	*/
2752	static DECLCALLBACK(VBOXSTRICTRC) buslogicMMIORead(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void pv, unsigned cb)
2753	{
2754	RT_NOREF(pDevIns, pvUser, off, pv, cb);
2755
2756	/* the linux driver does not make use of the MMIO area. */
2757	ASSERT_GUEST_MSG_FAILED(("MMIO Read: %RGp LB %u\n", off, cb));
2758	return VINF_SUCCESS;
2759	}
2760
2761	/**
2762	* @callback_method_impl{FNIOMMMIONEWWRITE}
2763	*/
2764	static DECLCALLBACK(VBOXSTRICTRC) buslogicMMIOWrite(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void const pv, unsigned cb)
2765	{
2766	RT_NOREF(pDevIns, pvUser, off, pv, cb);
2767
2768	/* the linux driver does not make use of the MMIO area. */
2769	ASSERT_GUEST_MSG_FAILED(("MMIO Write: %RGp LB %u: %.*Rhxs\n", off, cb, cb, pv));
2770	return VINF_SUCCESS;
2771	}
2772
2773	/**
2774	* @callback_method_impl{FNIOMIOPORTNEWIN}
2775	*/
2776	static DECLCALLBACK(VBOXSTRICTRC)
2777	buslogicIOPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
2778	{
2779	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2780	unsigned iRegister = offPort % 4;
2781	RT_NOREF(pvUser, cb);
2782
2783	ASSERT_GUEST(cb == 1);
2784
2785	return buslogicRegisterRead(pDevIns, pThis, iRegister, pu32);
2786	}
2787
2788	/**
2789	* @callback_method_impl{FNIOMIOPORTNEWOUT}
2790	*/
2791	static DECLCALLBACK(VBOXSTRICTRC)
2792	buslogicIOPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
2793	{
2794	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2795	unsigned iRegister = offPort % 4;
2796	RT_NOREF(pvUser, cb);
2797
2798	ASSERT_GUEST(cb == 1);
2799
2800	int rc = buslogicRegisterWrite(pDevIns, pThis, iRegister, (uint8_t)u32);
2801
2802	Log2(("#%d %s: pvUser=%#p cb=%d u32=%#x offPort=%#x rc=%Rrc\n",
2803	pDevIns->iInstance, __FUNCTION__, pvUser, cb, u32, offPort, rc));
2804
2805	return rc;
2806	}
2807
2808	#ifdef IN_RING3
2809
2810	static int buslogicR3PrepareBIOSSCSIRequest(PBUSLOGICCC pThisCC)
2811	{
2812	uint32_t uTargetDevice;
2813	uint32_t uLun;
2814	uint8_t *pbCdb;
2815	size_t cbCdb;
2816	size_t cbBuf;
2817
2818	int rc = vboxscsiSetupRequest(&pThisCC->VBoxSCSI, &uLun, &pbCdb, &cbCdb, &cbBuf, &uTargetDevice);
2819	AssertMsgRCReturn(rc, ("Setting up SCSI request failed rc=%Rrc\n", rc), rc);
2820
2821	if ( uTargetDevice < RT_ELEMENTS(pThisCC->aDeviceStates)
2822	&& pThisCC->aDeviceStates[uTargetDevice].pDrvBase)
2823	{
2824	PBUSLOGICDEVICE pTgtDev = &pThisCC->aDeviceStates[uTargetDevice];
2825	PDMMEDIAEXIOREQ hIoReq;
2826	PBUSLOGICREQ pReq;
2827
2828	rc = pTgtDev->pDrvMediaEx->pfnIoReqAlloc(pTgtDev->pDrvMediaEx, &hIoReq, (void **)&pReq,
2829	0, PDMIMEDIAEX_F_SUSPEND_ON_RECOVERABLE_ERR);
2830	AssertMsgRCReturn(rc, ("Getting task from cache failed rc=%Rrc\n", rc), rc);
2831
2832	pReq->fBIOS = true;
2833	pReq->hIoReq = hIoReq;
2834	pReq->pTargetDevice = pTgtDev;
2835
2836	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
2837
2838	rc = pTgtDev->pDrvMediaEx->pfnIoReqSendScsiCmd(pTgtDev->pDrvMediaEx, pReq->hIoReq, uLun,
2839	pbCdb, cbCdb, PDMMEDIAEXIOREQSCSITXDIR_UNKNOWN, NULL,
2840	cbBuf, NULL, 0, NULL, &pReq->u8ScsiSts, 30 * RT_MS_1SEC);
2841	if (rc == VINF_SUCCESS \|\| rc != VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
2842	{
2843	uint8_t u8ScsiSts = pReq->u8ScsiSts;
2844	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
2845	rc = vboxscsiRequestFinished(&pThisCC->VBoxSCSI, u8ScsiSts);
2846	}
2847	else if (rc == VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
2848	rc = VINF_SUCCESS;
2849
2850	return rc;
2851	}
2852
2853	/* Device is not present. */
2854	AssertMsg(pbCdb[0] == SCSI_INQUIRY,
2855	("Device is not present but command is not inquiry\n"));
2856
2857	SCSIINQUIRYDATA ScsiInquiryData;
2858
2859	memset(&ScsiInquiryData, 0, sizeof(SCSIINQUIRYDATA));
2860	ScsiInquiryData.u5PeripheralDeviceType = SCSI_INQUIRY_DATA_PERIPHERAL_DEVICE_TYPE_UNKNOWN;
2861	ScsiInquiryData.u3PeripheralQualifier = SCSI_INQUIRY_DATA_PERIPHERAL_QUALIFIER_NOT_CONNECTED_NOT_SUPPORTED;
2862
2863	memcpy(pThisCC->VBoxSCSI.pbBuf, &ScsiInquiryData, 5);
2864
2865	rc = vboxscsiRequestFinished(&pThisCC->VBoxSCSI, SCSI_STATUS_OK);
2866	AssertMsgRCReturn(rc, ("Finishing BIOS SCSI request failed rc=%Rrc\n", rc), rc);
2867
2868	return rc;
2869	}
2870
2871
2872	/**
2873	* @callback_method_impl{FNIOMIOPORTNEWIN, BIOS port.}
2874	*/
2875	static DECLCALLBACK(VBOXSTRICTRC)
2876	buslogicR3BiosIoPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
2877	{
2878	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
2879	RT_NOREF(pvUser, cb);
2880
2881	ASSERT_GUEST(cb == 1);
2882
2883	int rc = vboxscsiReadRegister(&pThisCC->VBoxSCSI, offPort, pu32);
2884
2885	//Log2(("%s: pu32=%p:{%.*Rhxs} iRegister=%d rc=%Rrc\n", __FUNCTION__, pu32, 1, pu32, offPort, rc));
2886
2887	return rc;
2888	}
2889
2890	/**
2891	* @callback_method_impl{FNIOMIOPORTNEWOUT, BIOS port.}
2892	*/
2893	static DECLCALLBACK(VBOXSTRICTRC)
2894	buslogicR3BiosIoPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
2895	{
2896	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2897	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
2898	Log2(("#%d %s: pvUser=%#p cb=%d u32=%#x offPort=%#x\n", pDevIns->iInstance, __FUNCTION__, pvUser, cb, u32, offPort));
2899	RT_NOREF(pvUser, cb);
2900
2901	/*
2902	* If there is already a request form the BIOS pending ignore this write
2903	* because it should not happen.
2904	*/
2905	if (ASMAtomicReadBool(&pThisCC->fBiosReqPending))
2906	return VINF_SUCCESS;
2907
2908	ASSERT_GUEST(cb == 1);
2909
2910	int rc = vboxscsiWriteRegister(&pThisCC->VBoxSCSI, offPort, (uint8_t)u32);
2911	if (rc == VERR_MORE_DATA)
2912	{
2913	ASMAtomicXchgBool(&pThisCC->fBiosReqPending, true);
2914	/* Wake up the worker thread now that there are pending requests. */
2915	int rc2 = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
2916	AssertRC(rc2);
2917	rc = VINF_SUCCESS;
2918	}
2919	else if (RT_FAILURE(rc))
2920	AssertMsgFailed(("Writing BIOS register failed %Rrc\n", rc));
2921
2922	return VINF_SUCCESS;
2923	}
2924
2925	/**
2926	* @callback_method_impl{FNIOMIOPORTNEWOUTSTRING, BIOS port.}
2927	*/
2928	static DECLCALLBACK(VBOXSTRICTRC) buslogicR3BiosIoPortWriteStr(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort,
2929	uint8_t const pbSrc, uint32_t pcTransfers, unsigned cb)
2930	{
2931	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2932	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
2933	Log2(("#%d %s: pvUser=%#p cb=%d offPort=%#x\n", pDevIns->iInstance, __FUNCTION__, pvUser, cb, offPort));
2934	RT_NOREF(pvUser);
2935
2936	/*
2937	* If there is already a request form the BIOS pending ignore this write
2938	* because it should not happen.
2939	*/
2940	if (ASMAtomicReadBool(&pThisCC->fBiosReqPending))
2941	return VINF_SUCCESS;
2942
2943	int rc = vboxscsiWriteString(pDevIns, &pThisCC->VBoxSCSI, offPort, pbSrc, pcTransfers, cb);
2944	if (rc == VERR_MORE_DATA)
2945	{
2946	ASMAtomicXchgBool(&pThisCC->fBiosReqPending, true);
2947	/* Wake up the worker thread now taht there are pending requests. */
2948	int rc2 = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
2949	AssertRC(rc2);
2950	}
2951	else if (RT_FAILURE(rc))
2952	AssertMsgFailed(("Writing BIOS register failed %Rrc\n", rc));
2953
2954	return VINF_SUCCESS;
2955	}
2956
2957	/**
2958	* @callback_method_impl{FNIOMIOPORTNEWINSTRING, BIOS port.}
2959	*/
2960	static DECLCALLBACK(VBOXSTRICTRC) buslogicR3BiosIoPortReadStr(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort,
2961	uint8_t pbDst, uint32_t pcTransfers, unsigned cb)
2962	{
2963	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
2964	LogFlowFunc(("#%d %s: pvUser=%#p cb=%d offPort=%#x\n", pDevIns->iInstance, __FUNCTION__, pvUser, cb, offPort));
2965	RT_NOREF(pvUser);
2966
2967	return vboxscsiReadString(pDevIns, &pThisCC->VBoxSCSI, offPort, pbDst, pcTransfers, cb);
2968	}
2969
2970	/**
2971	* Update the ISA I/O range.
2972	*
2973	* @returns nothing.
2974	* @param pDevIns The device instance.
2975	* @param pThis Pointer to the shared BusLogic instance data.
2976	* @param uBaseCode Encoded ISA I/O base; only low 3 bits are used.
2977	*/
2978	static int buslogicR3RegisterISARange(PPDMDEVINS pDevIns, PBUSLOGIC pThis, uint8_t uBaseCode)
2979	{
2980	uint8_t uCode = uBaseCode & MAX_ISA_BASE;
2981	uint16_t uNewBase = g_aISABases[uCode];
2982	int rc = VINF_SUCCESS;
2983
2984	LogFlowFunc(("ISA I/O code %02X, new base %X\n", uBaseCode, uNewBase));
2985
2986	/* Check if the same port range actually changed. */
2987	if (uNewBase != pThis->IOISABase)
2988	{
2989	/* Unmap the old range, if necessary. */
2990	if (pThis->IOISABase)
2991	{
2992	rc = PDMDevHlpIoPortUnmap(pDevIns, pThis->hIoPortsIsa);
2993	AssertRC(rc);
2994	}
2995	if (RT_SUCCESS(rc))
2996	{
2997	pThis->IOISABase = 0; /* First mark as unregistered. */
2998	pThis->uISABaseCode = ISA_BASE_DISABLED;
2999
3000	if (uNewBase)
3001	{
3002	/* Register the new range if requested. */
3003	rc = PDMDevHlpIoPortMap(pDevIns, pThis->hIoPortsIsa, uNewBase);
3004	if (RT_SUCCESS(rc))
3005	{
3006	pThis->IOISABase = uNewBase;
3007	pThis->uISABaseCode = uCode;
3008	}
3009	}
3010	}
3011	if (RT_SUCCESS(rc))
3012	{
3013	if (uNewBase)
3014	{
3015	Log(("ISA I/O base: %x\n", uNewBase));
3016	LogRel(("BusLogic: ISA I/O base: %x\n", uNewBase));
3017	}
3018	else
3019	{
3020	Log(("Disabling ISA I/O ports.\n"));
3021	LogRel(("BusLogic: ISA I/O disabled\n"));
3022	}
3023	}
3024
3025	}
3026	return rc;
3027	}
3028
3029
3030	static int buslogicR3ReqComplete(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, PBUSLOGICREQ pReq, int rcReq)
3031	{
3032	RT_NOREF(rcReq);
3033	PBUSLOGICDEVICE pTgtDev = pReq->pTargetDevice;
3034
3035	LogFlowFunc(("before decrement %u\n", pTgtDev->cOutstandingRequests));
3036	ASMAtomicDecU32(&pTgtDev->cOutstandingRequests);
3037	LogFlowFunc(("after decrement %u\n", pTgtDev->cOutstandingRequests));
3038
3039	if (pReq->fBIOS)
3040	{
3041	uint8_t u8ScsiSts = pReq->u8ScsiSts;
3042	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
3043	int rc = vboxscsiRequestFinished(&pThisCC->VBoxSCSI, u8ScsiSts);
3044	AssertMsgRC(rc, ("Finishing BIOS SCSI request failed rc=%Rrc\n", rc));
3045	}
3046	else
3047	{
3048	if (pReq->pbSenseBuffer)
3049	buslogicR3SenseBufferFree(pReq, (pReq->u8ScsiSts != SCSI_STATUS_OK));
3050
3051	/* Update residual data length. */
3052	if ( (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
3053	\|\| (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
3054	{
3055	size_t cbResidual = 0;
3056	int rc = pTgtDev->pDrvMediaEx->pfnIoReqQueryResidual(pTgtDev->pDrvMediaEx, pReq->hIoReq, &cbResidual);
3057	AssertRC(rc); Assert(cbResidual == (uint32_t)cbResidual);
3058
3059	if (pReq->fIs24Bit)
3060	U32_TO_LEN(pReq->CCBGuest.o.acbData, (uint32_t)cbResidual);
3061	else
3062	pReq->CCBGuest.n.cbData = (uint32_t)cbResidual;
3063	}
3064
3065	/*
3066	* Save vital things from the request and free it before posting completion
3067	* to avoid that the guest submits a new request with the same ID as the still
3068	* allocated one.
3069	*/
3070	#ifdef LOG_ENABLED
3071	bool fIs24Bit = pReq->fIs24Bit;
3072	#endif
3073	uint8_t u8ScsiSts = pReq->u8ScsiSts;
3074	RTGCPHYS GCPhysAddrCCB = pReq->GCPhysAddrCCB;
3075	CCBU CCBGuest;
3076	memcpy(&CCBGuest, &pReq->CCBGuest, sizeof(CCBU));
3077
3078	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
3079	if (u8ScsiSts == SCSI_STATUS_OK)
3080	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3081	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED,
3082	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3083	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITHOUT_ERROR);
3084	else if (u8ScsiSts == SCSI_STATUS_CHECK_CONDITION)
3085	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3086	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED,
3087	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_CHECK_CONDITION,
3088	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3089	else
3090	AssertMsgFailed(("invalid completion status %u\n", u8ScsiSts));
3091
3092	#ifdef LOG_ENABLED
3093	buslogicR3DumpCCBInfo(&CCBGuest, fIs24Bit);
3094	#endif
3095	}
3096
3097	if (pTgtDev->cOutstandingRequests == 0 && pThisCC->fSignalIdle)
3098	PDMDevHlpAsyncNotificationCompleted(pDevIns);
3099
3100	return VINF_SUCCESS;
3101	}
3102
3103	/**
3104	* @interface_method_impl{PDMIMEDIAPORT,pfnQueryDeviceLocation}
3105	*/
3106	static DECLCALLBACK(int) buslogicR3QueryDeviceLocation(PPDMIMEDIAPORT pInterface, const char **ppcszController,
3107	uint32_t piInstance, uint32_t piLUN)
3108	{
3109	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaPort);
3110	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3111
3112	AssertPtrReturn(ppcszController, VERR_INVALID_POINTER);
3113	AssertPtrReturn(piInstance, VERR_INVALID_POINTER);
3114	AssertPtrReturn(piLUN, VERR_INVALID_POINTER);
3115
3116	*ppcszController = pDevIns->pReg->szName;
3117	*piInstance = pDevIns->iInstance;
3118	*piLUN = pTgtDev->iLUN;
3119
3120	return VINF_SUCCESS;
3121	}
3122
3123	/**
3124	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCopyFromBuf}
3125	*/
3126	static DECLCALLBACK(int) buslogicR3IoReqCopyFromBuf(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3127	void *pvIoReqAlloc, uint32_t offDst, PRTSGBUF pSgBuf,
3128	size_t cbCopy)
3129	{
3130	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3131	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3132	PBUSLOGICREQ pReq = (PBUSLOGICREQ)pvIoReqAlloc;
3133	RT_NOREF(hIoReq);
3134
3135	size_t cbCopied = 0;
3136	if (RT_LIKELY(!pReq->fBIOS))
3137	cbCopied = buslogicR3CopySgBufToGuest(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), pReq, pSgBuf, offDst, cbCopy);
3138	else
3139	{
3140	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3141	cbCopied = vboxscsiCopyToBuf(&pThisCC->VBoxSCSI, pSgBuf, offDst, cbCopy);
3142	}
3143	return cbCopied == cbCopy ? VINF_SUCCESS : VERR_PDM_MEDIAEX_IOBUF_OVERFLOW;
3144	}
3145
3146	/**
3147	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCopyToBuf}
3148	*/
3149	static DECLCALLBACK(int) buslogicR3IoReqCopyToBuf(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3150	void *pvIoReqAlloc, uint32_t offSrc, PRTSGBUF pSgBuf,
3151	size_t cbCopy)
3152	{
3153	RT_NOREF(hIoReq);
3154	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3155	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3156	PBUSLOGICREQ pReq = (PBUSLOGICREQ)pvIoReqAlloc;
3157
3158	size_t cbCopied = 0;
3159	if (RT_LIKELY(!pReq->fBIOS))
3160	cbCopied = buslogicR3CopySgBufFromGuest(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), pReq, pSgBuf, offSrc, cbCopy);
3161	else
3162	{
3163	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3164	cbCopied = vboxscsiCopyFromBuf(&pThisCC->VBoxSCSI, pSgBuf, offSrc, cbCopy);
3165	}
3166	return cbCopied == cbCopy ? VINF_SUCCESS : VERR_PDM_MEDIAEX_IOBUF_UNDERRUN;
3167	}
3168
3169	/**
3170	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCompleteNotify}
3171	*/
3172	static DECLCALLBACK(int) buslogicR3IoReqCompleteNotify(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3173	void *pvIoReqAlloc, int rcReq)
3174	{
3175	RT_NOREF(hIoReq);
3176	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3177	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3178	buslogicR3ReqComplete(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC),
3179	(PBUSLOGICREQ)pvIoReqAlloc, rcReq);
3180	return VINF_SUCCESS;
3181	}
3182
3183	/**
3184	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqStateChanged}
3185	*/
3186	static DECLCALLBACK(void) buslogicR3IoReqStateChanged(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3187	void *pvIoReqAlloc, PDMMEDIAEXIOREQSTATE enmState)
3188	{
3189	RT_NOREF(hIoReq, pvIoReqAlloc, enmState);
3190	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3191
3192	switch (enmState)
3193	{
3194	case PDMMEDIAEXIOREQSTATE_SUSPENDED:
3195	{
3196	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3197	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3198
3199	/* Make sure the request is not accounted for so the VM can suspend successfully. */
3200	uint32_t cTasksActive = ASMAtomicDecU32(&pTgtDev->cOutstandingRequests);
3201	if (!cTasksActive && pThisCC->fSignalIdle)
3202	PDMDevHlpAsyncNotificationCompleted(pDevIns);
3203	break;
3204	}
3205	case PDMMEDIAEXIOREQSTATE_ACTIVE:
3206	/* Make sure the request is accounted for so the VM suspends only when the request is complete. */
3207	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3208	break;
3209	default:
3210	AssertMsgFailed(("Invalid request state given %u\n", enmState));
3211	}
3212	}
3213
3214	/**
3215	* @interface_method_impl{PDMIMEDIAEXPORT,pfnMediumEjected}
3216	*/
3217	static DECLCALLBACK(void) buslogicR3MediumEjected(PPDMIMEDIAEXPORT pInterface)
3218	{
3219	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3220	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3221	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3222
3223	if (pThisCC->pMediaNotify)
3224	{
3225	int rc = VMR3ReqCallNoWait(PDMDevHlpGetVM(pDevIns), VMCPUID_ANY,
3226	(PFNRT)pThisCC->pMediaNotify->pfnEjected, 2,
3227	pThisCC->pMediaNotify, pTgtDev->iLUN);
3228	AssertRC(rc);
3229	}
3230	}
3231
3232	static int buslogicR3DeviceSCSIRequestSetup(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, RTGCPHYS GCPhysAddrCCB)
3233	{
3234	int rc = VINF_SUCCESS;
3235	uint8_t uTargetIdCCB;
3236	CCBU CCBGuest;
3237
3238	/* Fetch the CCB from guest memory. */
3239	/** @todo How much do we really have to read? */
3240	blPhysReadMeta(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest, sizeof(CCB32));
3241
3242	uTargetIdCCB = pThis->fMbxIs24Bit ? CCBGuest.o.uTargetId : CCBGuest.n.uTargetId;
3243	if (RT_LIKELY(uTargetIdCCB < RT_ELEMENTS(pThisCC->aDeviceStates)))
3244	{
3245	PBUSLOGICDEVICE pTgtDev = &pThisCC->aDeviceStates[uTargetIdCCB];
3246
3247	#ifdef LOG_ENABLED
3248	buslogicR3DumpCCBInfo(&CCBGuest, pThis->fMbxIs24Bit);
3249	#endif
3250
3251	/* Check if device is present on bus. If not return error immediately and don't process this further. */
3252	if (RT_LIKELY(pTgtDev->fPresent))
3253	{
3254	PDMMEDIAEXIOREQ hIoReq;
3255	PBUSLOGICREQ pReq;
3256	rc = pTgtDev->pDrvMediaEx->pfnIoReqAlloc(pTgtDev->pDrvMediaEx, &hIoReq, (void **)&pReq,
3257	GCPhysAddrCCB, PDMIMEDIAEX_F_SUSPEND_ON_RECOVERABLE_ERR);
3258	if (RT_SUCCESS(rc))
3259	{
3260	pReq->pTargetDevice = pTgtDev;
3261	pReq->GCPhysAddrCCB = GCPhysAddrCCB;
3262	pReq->fBIOS = false;
3263	pReq->hIoReq = hIoReq;
3264	pReq->fIs24Bit = pThis->fMbxIs24Bit;
3265
3266	/* Make a copy of the CCB */
3267	memcpy(&pReq->CCBGuest, &CCBGuest, sizeof(CCBGuest));
3268
3269	/* Alloc required buffers. */
3270	rc = buslogicR3SenseBufferAlloc(pReq);
3271	AssertMsgRC(rc, ("Mapping sense buffer failed rc=%Rrc\n", rc));
3272
3273	size_t cbBuf = 0;
3274	rc = buslogicR3QueryDataBufferSize(pDevIns, &pReq->CCBGuest, pReq->fIs24Bit, &cbBuf);
3275	AssertRC(rc);
3276
3277	uint32_t uLun = pReq->fIs24Bit ? pReq->CCBGuest.o.uLogicalUnit
3278	: pReq->CCBGuest.n.uLogicalUnit;
3279
3280	PDMMEDIAEXIOREQSCSITXDIR enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_UNKNOWN;
3281	size_t cbSense = buslogicR3ConvertSenseBufferLength(CCBGuest.c.cbSenseData);
3282
3283	if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_NO_DATA)
3284	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_NONE;
3285	else if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_OUT)
3286	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_TO_DEVICE;
3287	else if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_IN)
3288	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_FROM_DEVICE;
3289
3290	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3291	rc = pTgtDev->pDrvMediaEx->pfnIoReqSendScsiCmd(pTgtDev->pDrvMediaEx, pReq->hIoReq, uLun,
3292	&pReq->CCBGuest.c.abCDB[0], pReq->CCBGuest.c.cbCDB,
3293	enmXferDir, NULL, cbBuf, pReq->pbSenseBuffer, cbSense, NULL,
3294	&pReq->u8ScsiSts, 30 * RT_MS_1SEC);
3295	if (rc != VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
3296	buslogicR3ReqComplete(pDevIns, pThis, pThisCC, pReq, rc);
3297	}
3298	else
3299	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3300	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT,
3301	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3302	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3303	}
3304	else
3305	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3306	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT,
3307	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3308	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3309	}
3310	else
3311	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3312	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER,
3313	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3314	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3315
3316	return rc;
3317	}
3318
3319	static int buslogicR3DeviceSCSIRequestAbort(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhysAddrCCB)
3320	{
3321	uint8_t uTargetIdCCB;
3322	CCBU CCBGuest;
3323
3324	blPhysReadMeta(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest, sizeof(CCB32));
3325
3326	uTargetIdCCB = pThis->fMbxIs24Bit ? CCBGuest.o.uTargetId : CCBGuest.n.uTargetId;
3327	if (RT_LIKELY(uTargetIdCCB < RT_ELEMENTS(pThis->afDevicePresent)))
3328	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3329	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED,
3330	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3331	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND);
3332	else
3333	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3334	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER,
3335	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3336	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3337
3338	return VINF_SUCCESS;
3339	}
3340
3341	/**
3342	* Read a mailbox from guest memory. Convert 24-bit mailboxes to
3343	* 32-bit format.
3344	*
3345	* @returns Mailbox guest physical address.
3346	* @param pDevIns The device instance.
3347	* @param pThis Pointer to the shared BusLogic instance data.
3348	* @param pMbx Pointer to the mailbox to read into.
3349	*/
3350	static RTGCPHYS buslogicR3ReadOutgoingMailbox(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PMailbox32 pMbx)
3351	{
3352	RTGCPHYS GCMailbox;
3353
3354	if (pThis->fMbxIs24Bit)
3355	{
3356	Mailbox24 Mbx24;
3357
3358	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->uMailboxOutgoingPositionCurrent * sizeof(Mailbox24));
3359	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx24, sizeof(Mailbox24));
3360	pMbx->u32PhysAddrCCB = ADDR_TO_U32(Mbx24.aPhysAddrCCB);
3361	pMbx->u.out.uActionCode = Mbx24.uCmdState;
3362	}
3363	else
3364	{
3365	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->uMailboxOutgoingPositionCurrent * sizeof(Mailbox32));
3366	blPhysReadMeta(pDevIns, pThis, GCMailbox, pMbx, sizeof(Mailbox32));
3367	}
3368
3369	return GCMailbox;
3370	}
3371
3372	/**
3373	* Read mailbox from the guest and execute command.
3374	*
3375	* @returns VBox status code.
3376	* @param pDevIns The device instance.
3377	* @param pThis Pointer to the shared BusLogic instance data.
3378	* @param pThisCC Pointer to the ring-3 BusLogic instance data.
3379	*/
3380	static int buslogicR3ProcessMailboxNext(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC)
3381	{
3382	RTGCPHYS GCPhysAddrMailboxCurrent;
3383	Mailbox32 MailboxGuest;
3384	int rc = VINF_SUCCESS;
3385
3386	if (!pThis->fStrictRoundRobinMode)
3387	{
3388	/* Search for a filled mailbox - stop if we have scanned all mailboxes. */
3389	uint8_t uMailboxPosCur = pThis->uMailboxOutgoingPositionCurrent;
3390
3391	do
3392	{
3393	/* Fetch mailbox from guest memory. */
3394	GCPhysAddrMailboxCurrent = buslogicR3ReadOutgoingMailbox(pDevIns, pThis, &MailboxGuest);
3395
3396	/* Check the next mailbox. */
3397	buslogicR3OutgoingMailboxAdvance(pThis);
3398	} while ( MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE
3399	&& uMailboxPosCur != pThis->uMailboxOutgoingPositionCurrent);
3400	}
3401	else
3402	{
3403	/* Fetch mailbox from guest memory. */
3404	GCPhysAddrMailboxCurrent = buslogicR3ReadOutgoingMailbox(pDevIns, pThis, &MailboxGuest);
3405	}
3406
3407	/*
3408	* Check if the mailbox is actually loaded.
3409	* It might be possible that the guest notified us without
3410	* a loaded mailbox. Do nothing in that case but leave a
3411	* log entry.
3412	*/
3413	if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE)
3414	{
3415	Log(("No loaded mailbox left\n"));
3416	return VERR_NO_DATA;
3417	}
3418
3419	LogFlow(("Got loaded mailbox at slot %u, CCB phys %RGp\n", pThis->uMailboxOutgoingPositionCurrent, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB));
3420	#ifdef LOG_ENABLED
3421	buslogicR3DumpMailboxInfo(&MailboxGuest, true);
3422	#endif
3423
3424	/* We got the mailbox, mark it as free in the guest. */
3425	uint8_t uActionCode = BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE;
3426	unsigned uCodeOffs = pThis->fMbxIs24Bit ? RT_OFFSETOF(Mailbox24, uCmdState) : RT_OFFSETOF(Mailbox32, u.out.uActionCode);
3427	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrMailboxCurrent + uCodeOffs, &uActionCode, sizeof(uActionCode));
3428
3429	if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_START_COMMAND)
3430	rc = buslogicR3DeviceSCSIRequestSetup(pDevIns, pThis, pThisCC, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB);
3431	else if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND)
3432	{
3433	LogFlow(("Aborting mailbox\n"));
3434	rc = buslogicR3DeviceSCSIRequestAbort(pDevIns, pThis, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB);
3435	}
3436	else
3437	AssertMsgFailed(("Invalid outgoing mailbox action code %u\n", MailboxGuest.u.out.uActionCode));
3438
3439	AssertRC(rc);
3440
3441	/* Advance to the next mailbox. */
3442	if (pThis->fStrictRoundRobinMode)
3443	buslogicR3OutgoingMailboxAdvance(pThis);
3444
3445	return rc;
3446	}
3447
3448	/** @callback_method_impl{FNSSMDEVLIVEEXEC} */
3449	static DECLCALLBACK(int) buslogicR3LiveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass)
3450	{
3451	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3452	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3453	RT_NOREF(uPass);
3454
3455	/* Save the device config. */
3456	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3457	pHlp->pfnSSMPutBool(pSSM, pThisCC->aDeviceStates[i].fPresent);
3458
3459	return VINF_SSM_DONT_CALL_AGAIN;
3460	}
3461
3462	/** @callback_method_impl{FNSSMDEVSAVEEXEC} */
3463	static DECLCALLBACK(int) buslogicR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3464	{
3465	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3466	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3467	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3468	uint32_t cReqsSuspended = 0;
3469
3470	/* Every device first. */
3471	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3472	{
3473	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3474
3475	AssertMsg(!pDevice->cOutstandingRequests,
3476	("There are still outstanding requests on this device\n"));
3477	pHlp->pfnSSMPutBool(pSSM, pDevice->fPresent);
3478	pHlp->pfnSSMPutU32(pSSM, pDevice->cOutstandingRequests);
3479
3480	if (pDevice->fPresent)
3481	cReqsSuspended += pDevice->pDrvMediaEx->pfnIoReqGetSuspendedCount(pDevice->pDrvMediaEx);
3482	}
3483	/* Now the main device state. */
3484	pHlp->pfnSSMPutU8 (pSSM, pThis->regStatus);
3485	pHlp->pfnSSMPutU8 (pSSM, pThis->regInterrupt);
3486	pHlp->pfnSSMPutU8 (pSSM, pThis->regGeometry);
3487	pHlp->pfnSSMPutMem (pSSM, &pThis->LocalRam, sizeof(pThis->LocalRam));
3488	pHlp->pfnSSMPutU8 (pSSM, pThis->uOperationCode);
3489	pHlp->pfnSSMPutMem (pSSM, &pThis->aCommandBuffer, sizeof(pThis->aCommandBuffer));
3490	pHlp->pfnSSMPutU8 (pSSM, pThis->iParameter);
3491	pHlp->pfnSSMPutU8 (pSSM, pThis->cbCommandParametersLeft);
3492	pHlp->pfnSSMPutBool (pSSM, pThis->fUseLocalRam);
3493	pHlp->pfnSSMPutMem (pSSM, pThis->aReplyBuffer, sizeof(pThis->aReplyBuffer));
3494	pHlp->pfnSSMPutU8 (pSSM, pThis->iReply);
3495	pHlp->pfnSSMPutU8 (pSSM, pThis->cbReplyParametersLeft);
3496	pHlp->pfnSSMPutBool (pSSM, pThis->fIRQEnabled);
3497	pHlp->pfnSSMPutU8 (pSSM, pThis->uISABaseCode);
3498	pHlp->pfnSSMPutU32 (pSSM, pThis->cMailbox);
3499	pHlp->pfnSSMPutBool (pSSM, pThis->fMbxIs24Bit);
3500	pHlp->pfnSSMPutGCPhys(pSSM, pThis->GCPhysAddrMailboxOutgoingBase);
3501	pHlp->pfnSSMPutU32 (pSSM, pThis->uMailboxOutgoingPositionCurrent);
3502	pHlp->pfnSSMPutU32 (pSSM, pThis->cMailboxesReady);
3503	pHlp->pfnSSMPutBool (pSSM, pThis->fNotificationSent);
3504	pHlp->pfnSSMPutGCPhys(pSSM, pThis->GCPhysAddrMailboxIncomingBase);
3505	pHlp->pfnSSMPutU32 (pSSM, pThis->uMailboxIncomingPositionCurrent);
3506	pHlp->pfnSSMPutBool (pSSM, pThis->fStrictRoundRobinMode);
3507	pHlp->pfnSSMPutBool (pSSM, pThis->fExtendedLunCCBFormat);
3508
3509	vboxscsiR3SaveExec(pDevIns->pHlpR3, &pThisCC->VBoxSCSI, pSSM);
3510
3511	pHlp->pfnSSMPutU32(pSSM, cReqsSuspended);
3512
3513	/* Save the physical CCB address of all suspended requests. */
3514	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates) && cReqsSuspended; i++)
3515	{
3516	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3517	if (pDevice->fPresent)
3518	{
3519	uint32_t cThisReqsSuspended = pDevice->pDrvMediaEx->pfnIoReqGetSuspendedCount(pDevice->pDrvMediaEx);
3520
3521	cReqsSuspended -= cThisReqsSuspended;
3522	if (cThisReqsSuspended)
3523	{
3524	PDMMEDIAEXIOREQ hIoReq;
3525	PBUSLOGICREQ pReq;
3526	int rc = pDevice->pDrvMediaEx->pfnIoReqQuerySuspendedStart(pDevice->pDrvMediaEx, &hIoReq,
3527	(void **)&pReq);
3528	AssertRCBreak(rc);
3529
3530	for (;;)
3531	{
3532	pHlp->pfnSSMPutU32(pSSM, (uint32_t)pReq->GCPhysAddrCCB);
3533
3534	cThisReqsSuspended--;
3535	if (!cThisReqsSuspended)
3536	break;
3537
3538	rc = pDevice->pDrvMediaEx->pfnIoReqQuerySuspendedNext(pDevice->pDrvMediaEx, hIoReq,
3539	&hIoReq, (void **)&pReq);
3540	AssertRCBreak(rc);
3541	}
3542	}
3543	}
3544	}
3545
3546	return pHlp->pfnSSMPutU32(pSSM, UINT32_MAX);
3547	}
3548
3549	/** @callback_method_impl{FNSSMDEVLOADDONE} */
3550	static DECLCALLBACK(int) buslogicR3LoadDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3551	{
3552	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3553	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3554	RT_NOREF(pSSM);
3555
3556	buslogicR3RegisterISARange(pDevIns, pThis, pThis->uISABaseCode);
3557
3558	/* Kick of any requests we might need to redo. */
3559	if (pThisCC->VBoxSCSI.fBusy)
3560	{
3561
3562	/* The BIOS had a request active when we got suspended. Resume it. */
3563	int rc = buslogicR3PrepareBIOSSCSIRequest(pThisCC);
3564	AssertRC(rc);
3565	}
3566	else if (pThisCC->cReqsRedo)
3567	{
3568	for (unsigned i = 0; i < pThisCC->cReqsRedo; i++)
3569	{
3570	int rc = buslogicR3DeviceSCSIRequestSetup(pDevIns, pThis, pThisCC, pThisCC->paGCPhysAddrCCBRedo[i]);
3571	AssertRC(rc);
3572	}
3573
3574	RTMemFree(pThisCC->paGCPhysAddrCCBRedo);
3575	pThisCC->paGCPhysAddrCCBRedo = NULL;
3576	pThisCC->cReqsRedo = 0;
3577	}
3578
3579	return VINF_SUCCESS;
3580	}
3581
3582	/** @callback_method_impl{FNSSMDEVLOADEXEC} */
3583	static DECLCALLBACK(int) buslogicR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
3584	{
3585	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3586	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3587	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3588	int rc = VINF_SUCCESS;
3589
3590	/* We support saved states only from this and older versions. */
3591	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_VERSION)
3592	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
3593
3594	/* Every device first. */
3595	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3596	{
3597	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3598
3599	AssertMsg(!pDevice->cOutstandingRequests,
3600	("There are still outstanding requests on this device\n"));
3601	bool fPresent;
3602	rc = pHlp->pfnSSMGetBool(pSSM, &fPresent);
3603	AssertRCReturn(rc, rc);
3604	if (pDevice->fPresent != fPresent)
3605	return pHlp->pfnSSMSetCfgError(pSSM, RT_SRC_POS, N_("Target %u config mismatch: config=%RTbool state=%RTbool"), i, pDevice->fPresent, fPresent);
3606
3607	if (uPass == SSM_PASS_FINAL)
3608	pHlp->pfnSSMGetU32V(pSSM, &pDevice->cOutstandingRequests);
3609	}
3610
3611	if (uPass != SSM_PASS_FINAL)
3612	return VINF_SUCCESS;
3613
3614	/* Now the main device state. */
3615	pHlp->pfnSSMGetU8V (pSSM, &pThis->regStatus);
3616	pHlp->pfnSSMGetU8V (pSSM, &pThis->regInterrupt);
3617	pHlp->pfnSSMGetU8V (pSSM, &pThis->regGeometry);
3618	pHlp->pfnSSMGetMem (pSSM, &pThis->LocalRam, sizeof(pThis->LocalRam));
3619	pHlp->pfnSSMGetU8 (pSSM, &pThis->uOperationCode);
3620	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE)
3621	pHlp->pfnSSMGetMem(pSSM, &pThis->aCommandBuffer, sizeof(pThis->aCommandBuffer));
3622	else
3623	pHlp->pfnSSMGetMem(pSSM, &pThis->aCommandBuffer, BUSLOGIC_COMMAND_SIZE_OLD);
3624	pHlp->pfnSSMGetU8 (pSSM, &pThis->iParameter);
3625	pHlp->pfnSSMGetU8 (pSSM, &pThis->cbCommandParametersLeft);
3626	pHlp->pfnSSMGetBool (pSSM, &pThis->fUseLocalRam);
3627	pHlp->pfnSSMGetMem (pSSM, pThis->aReplyBuffer, sizeof(pThis->aReplyBuffer));
3628	pHlp->pfnSSMGetU8 (pSSM, &pThis->iReply);
3629	pHlp->pfnSSMGetU8 (pSSM, &pThis->cbReplyParametersLeft);
3630	pHlp->pfnSSMGetBool (pSSM, &pThis->fIRQEnabled);
3631	pHlp->pfnSSMGetU8 (pSSM, &pThis->uISABaseCode);
3632	pHlp->pfnSSMGetU32 (pSSM, &pThis->cMailbox);
3633	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX)
3634	pHlp->pfnSSMGetBool(pSSM, &pThis->fMbxIs24Bit);
3635	pHlp->pfnSSMGetGCPhys(pSSM, &pThis->GCPhysAddrMailboxOutgoingBase);
3636	pHlp->pfnSSMGetU32 (pSSM, &pThis->uMailboxOutgoingPositionCurrent);
3637	pHlp->pfnSSMGetU32V (pSSM, &pThis->cMailboxesReady);
3638	pHlp->pfnSSMGetBoolV (pSSM, &pThis->fNotificationSent);
3639	pHlp->pfnSSMGetGCPhys(pSSM, &pThis->GCPhysAddrMailboxIncomingBase);
3640	pHlp->pfnSSMGetU32 (pSSM, &pThis->uMailboxIncomingPositionCurrent);
3641	pHlp->pfnSSMGetBool (pSSM, &pThis->fStrictRoundRobinMode);
3642	pHlp->pfnSSMGetBool (pSSM, &pThis->fExtendedLunCCBFormat);
3643
3644	rc = vboxscsiR3LoadExec(pDevIns->pHlpR3, &pThisCC->VBoxSCSI, pSSM);
3645	if (RT_FAILURE(rc))
3646	{
3647	LogRel(("BusLogic: Failed to restore BIOS state: %Rrc.\n", rc));
3648	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic: Failed to restore BIOS state\n"));
3649	}
3650
3651	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_ERROR_HANDLING)
3652	{
3653	/* Check if there are pending tasks saved. */
3654	uint32_t cTasks = 0;
3655
3656	pHlp->pfnSSMGetU32(pSSM, &cTasks);
3657
3658	if (cTasks)
3659	{
3660	pThisCC->paGCPhysAddrCCBRedo = (PRTGCPHYS)RTMemAllocZ(cTasks * sizeof(RTGCPHYS));
3661	if (RT_LIKELY(pThisCC->paGCPhysAddrCCBRedo))
3662	{
3663	pThisCC->cReqsRedo = cTasks;
3664
3665	for (uint32_t i = 0; i < cTasks; i++)
3666	{
3667	uint32_t u32PhysAddrCCB;
3668
3669	rc = pHlp->pfnSSMGetU32(pSSM, &u32PhysAddrCCB);
3670	AssertRCBreak(rc);
3671
3672	pThisCC->paGCPhysAddrCCBRedo[i] = u32PhysAddrCCB;
3673	}
3674	}
3675	else
3676	rc = VERR_NO_MEMORY;
3677	}
3678	}
3679
3680	if (RT_SUCCESS(rc))
3681	{
3682	uint32_t u32;
3683	rc = pHlp->pfnSSMGetU32(pSSM, &u32);
3684	if (RT_SUCCESS(rc))
3685	AssertMsgReturn(u32 == UINT32_MAX, ("%#x\n", u32), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
3686	}
3687
3688	return rc;
3689	}
3690
3691	/**
3692	* Gets the pointer to the status LED of a device - called from the SCSI driver.
3693	*
3694	* @returns VBox status code.
3695	* @param pInterface Pointer to the interface structure containing the called function pointer.
3696	* @param iLUN The unit which status LED we desire. Always 0 here as the driver
3697	* doesn't know about other LUN's.
3698	* @param ppLed Where to store the LED pointer.
3699	*/
3700	static DECLCALLBACK(int) buslogicR3DeviceQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3701	{
3702	PBUSLOGICDEVICE pDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, ILed);
3703	if (iLUN == 0)
3704	{
3705	*ppLed = &pDevice->Led;
3706	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
3707	return VINF_SUCCESS;
3708	}
3709	return VERR_PDM_LUN_NOT_FOUND;
3710	}
3711
3712	/**
3713	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
3714	*/
3715	static DECLCALLBACK(void ) buslogicR3DeviceQueryInterface(PPDMIBASE pInterface, const char pszIID)
3716	{
3717	PBUSLOGICDEVICE pDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IBase);
3718	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pDevice->IBase);
3719	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAPORT, &pDevice->IMediaPort);
3720	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAEXPORT, &pDevice->IMediaExPort);
3721	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pDevice->ILed);
3722	return NULL;
3723	}
3724
3725	/**
3726	* Gets the pointer to the status LED of a unit.
3727	*
3728	* @returns VBox status code.
3729	* @param pInterface Pointer to the interface structure containing the called function pointer.
3730	* @param iLUN The unit which status LED we desire.
3731	* @param ppLed Where to store the LED pointer.
3732	*/
3733	static DECLCALLBACK(int) buslogicR3StatusQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3734	{
3735	PBUSLOGICCC pThisCC = RT_FROM_MEMBER(pInterface, BUSLOGICCC, ILeds);
3736	if (iLUN < BUSLOGIC_MAX_DEVICES)
3737	{
3738	*ppLed = &pThisCC->aDeviceStates[iLUN].Led;
3739	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
3740	return VINF_SUCCESS;
3741	}
3742	return VERR_PDM_LUN_NOT_FOUND;
3743	}
3744
3745	/**
3746	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
3747	*/
3748	static DECLCALLBACK(void ) buslogicR3StatusQueryInterface(PPDMIBASE pInterface, const char pszIID)
3749	{
3750	PBUSLOGICCC pThisCC = RT_FROM_MEMBER(pInterface, BUSLOGICCC, IBase);
3751	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThisCC->IBase);
3752	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThisCC->ILeds);
3753	return NULL;
3754	}
3755
3756	/**
3757	* @callback_method_impl{FNPDMTHREADWAKEUPDEV}
3758	*/
3759	static DECLCALLBACK(int) buslogicR3Worker(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3760	{
3761	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3762	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3763
3764	if (pThread->enmState == PDMTHREADSTATE_INITIALIZING)
3765	return VINF_SUCCESS;
3766
3767	while (pThread->enmState == PDMTHREADSTATE_RUNNING)
3768	{
3769	int rc;
3770
3771	ASMAtomicWriteBool(&pThisCC->fWrkThreadSleeping, true);
3772	bool fNotificationSent = ASMAtomicXchgBool(&pThis->fNotificationSent, false);
3773	if (!fNotificationSent)
3774	{
3775	Assert(ASMAtomicReadBool(&pThisCC->fWrkThreadSleeping));
3776	rc = PDMDevHlpSUPSemEventWaitNoResume(pDevIns, pThis->hEvtProcess, RT_INDEFINITE_WAIT);
3777	AssertLogRelMsgReturn(RT_SUCCESS(rc) \|\| rc == VERR_INTERRUPTED, ("%Rrc\n", rc), rc);
3778	if (RT_UNLIKELY(pThread->enmState != PDMTHREADSTATE_RUNNING))
3779	break;
3780	LogFlowFunc(("Woken up with rc=%Rrc\n", rc));
3781	ASMAtomicWriteBool(&pThis->fNotificationSent, false);
3782	}
3783
3784	ASMAtomicWriteBool(&pThisCC->fWrkThreadSleeping, false);
3785
3786	/* Check whether there is a BIOS request pending and process it first. */
3787	if (ASMAtomicReadBool(&pThisCC->fBiosReqPending))
3788	{
3789	rc = buslogicR3PrepareBIOSSCSIRequest(pThisCC);
3790	AssertRC(rc);
3791	ASMAtomicXchgBool(&pThisCC->fBiosReqPending, false);
3792	}
3793	else
3794	{
3795	ASMAtomicXchgU32(&pThis->cMailboxesReady, 0); /** @todo Actually not required anymore but to stay compatible with older saved states. */
3796
3797	/* Process mailboxes. */
3798	do
3799	{
3800	rc = buslogicR3ProcessMailboxNext(pDevIns, pThis, pThisCC);
3801	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_NO_DATA, ("Processing mailbox failed rc=%Rrc\n", rc));
3802	} while (RT_SUCCESS(rc));
3803	}
3804	} /* While running */
3805
3806	return VINF_SUCCESS;
3807	}
3808
3809
3810	/**
3811	* @callback_method_impl{FNPDMTHREADWAKEUPDEV}
3812	*/
3813	static DECLCALLBACK(int) buslogicR3WorkerWakeUp(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3814	{
3815	RT_NOREF(pThread);
3816	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3817	return PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
3818	}
3819
3820	/**
3821	* BusLogic debugger info callback.
3822	*
3823	* @param pDevIns The device instance.
3824	* @param pHlp The output helpers.
3825	* @param pszArgs The arguments.
3826	*/
3827	static DECLCALLBACK(void) buslogicR3Info(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
3828	{
3829	static const char *apszModels[] = { "BusLogic BT-958D", "BusLogic BT-545C", "Adaptec AHA-1540B" };
3830	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3831	unsigned i;
3832	bool fVerbose = false;
3833
3834	/* Parse arguments. */
3835	if (pszArgs)
3836	fVerbose = strstr(pszArgs, "verbose") != NULL;
3837
3838	/* Show basic information. */
3839	pHlp->pfnPrintf(pHlp, "%s#%d: %s ",
3840	pDevIns->pReg->szName,
3841	pDevIns->iInstance,
3842	pThis->uDevType >= RT_ELEMENTS(apszModels) ? "Uknown model" : apszModels[pThis->uDevType]);
3843	if (pThis->uIsaIrq)
3844	pHlp->pfnPrintf(pHlp, "ISA I/O=%RTiop IRQ=%u ",
3845	pThis->IOISABase,
3846	pThis->uIsaIrq);
3847	else
3848	pHlp->pfnPrintf(pHlp, "PCI I/O=%04x ISA I/O=%RTiop MMIO=%RGp IRQ=%u ",
3849	PDMDevHlpIoPortGetMappingAddress(pDevIns, pThis->hIoPortsPci), pThis->IOISABase,
3850	PDMDevHlpMmioGetMappingAddress(pDevIns, pThis->hMmio),
3851	PCIDevGetInterruptLine(pDevIns->apPciDevs[0]));
3852	pHlp->pfnPrintf(pHlp, "RC=%RTbool R0=%RTbool\n", pDevIns->fRCEnabled, pDevIns->fR0Enabled);
3853
3854	/* Print mailbox state. */
3855	if (pThis->regStatus & BL_STAT_INREQ)
3856	pHlp->pfnPrintf(pHlp, "Mailbox not initialized\n");
3857	else
3858	pHlp->pfnPrintf(pHlp, "%u-bit mailbox with %u entries at %RGp (%d LUN CCBs)\n",
3859	pThis->fMbxIs24Bit ? 24 : 32, pThis->cMailbox,
3860	pThis->GCPhysAddrMailboxOutgoingBase,
3861	pThis->fMbxIs24Bit ? 8 : pThis->fExtendedLunCCBFormat ? 64 : 8);
3862
3863	/* Print register contents. */
3864	pHlp->pfnPrintf(pHlp, "Registers: STAT=%02x INTR=%02x GEOM=%02x\n",
3865	pThis->regStatus, pThis->regInterrupt, pThis->regGeometry);
3866
3867	/* Print miscellaneous state. */
3868	pHlp->pfnPrintf(pHlp, "HAC interrupts: %s\n",
3869	pThis->fIRQEnabled ? "on" : "off");
3870
3871	/* Print the current command, if any. */
3872	if (pThis->uOperationCode != 0xff )
3873	pHlp->pfnPrintf(pHlp, "Current command: %02X\n", pThis->uOperationCode);
3874
3875	if (fVerbose && (pThis->regStatus & BL_STAT_INREQ) == 0)
3876	{
3877	RTGCPHYS GCMailbox;
3878
3879	/* Dump the mailbox contents. */
3880	if (pThis->fMbxIs24Bit)
3881	{
3882	Mailbox24 Mbx24;
3883
3884	/* Outgoing mailbox, 24-bit format. */
3885	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase;
3886	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (24-bit) at %06X:\n", GCMailbox);
3887	for (i = 0; i < pThis->cMailbox; ++i)
3888	{
3889	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx24, sizeof(Mailbox24));
3890	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %06X action code %02X", i, ADDR_TO_U32(Mbx24.aPhysAddrCCB), Mbx24.uCmdState);
3891	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3892	GCMailbox += sizeof(Mailbox24);
3893	}
3894
3895	/* Incoming mailbox, 24-bit format. */
3896	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox24));
3897	pHlp->pfnPrintf(pHlp, " Incoming mailbox entries (24-bit) at %06X:\n", GCMailbox);
3898	for (i = 0; i < pThis->cMailbox; ++i)
3899	{
3900	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx24, sizeof(Mailbox24));
3901	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %06X completion code %02X", i, ADDR_TO_U32(Mbx24.aPhysAddrCCB), Mbx24.uCmdState);
3902	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxIncomingPositionCurrent == i ? " *" : "");
3903	GCMailbox += sizeof(Mailbox24);
3904	}
3905
3906	}
3907	else
3908	{
3909	Mailbox32 Mbx32;
3910
3911	/* Outgoing mailbox, 32-bit format. */
3912	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase;
3913	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (32-bit) at %08X:\n", (uint32_t)GCMailbox);
3914	for (i = 0; i < pThis->cMailbox; ++i)
3915	{
3916	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx32, sizeof(Mailbox32));
3917	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %08X action code %02X", i, Mbx32.u32PhysAddrCCB, Mbx32.u.out.uActionCode);
3918	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3919	GCMailbox += sizeof(Mailbox32);
3920	}
3921
3922	/* Incoming mailbox, 32-bit format. */
3923	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox32));
3924	pHlp->pfnPrintf(pHlp, " Incoming mailbox entries (32-bit) at %08X:\n", (uint32_t)GCMailbox);
3925	for (i = 0; i < pThis->cMailbox; ++i)
3926	{
3927	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx32, sizeof(Mailbox32));
3928	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %08X completion code %02X BTSTAT %02X SDSTAT %02X", i,
3929	Mbx32.u32PhysAddrCCB, Mbx32.u.in.uCompletionCode, Mbx32.u.in.uHostAdapterStatus, Mbx32.u.in.uTargetDeviceStatus);
3930	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxIncomingPositionCurrent == i ? " *" : "");
3931	GCMailbox += sizeof(Mailbox32);
3932	}
3933
3934	}
3935	}
3936	}
3937
3938	/* -=-=-=-=- Helper -=-=-=-=- */
3939
3940	/**
3941	* Checks if all asynchronous I/O is finished.
3942	*
3943	* Used by buslogicR3Reset, buslogicR3Suspend and buslogicR3PowerOff.
3944	*
3945	* @returns true if quiesced, false if busy.
3946	* @param pDevIns The device instance.
3947	*/
3948	static bool buslogicR3AllAsyncIOIsFinished(PPDMDEVINS pDevIns)
3949	{
3950	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3951
3952	for (uint32_t i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3953	{
3954	PBUSLOGICDEVICE pThisDevice = &pThisCC->aDeviceStates[i];
3955	if (pThisDevice->pDrvBase)
3956	{
3957	if (pThisDevice->cOutstandingRequests != 0)
3958	return false;
3959	}
3960	}
3961
3962	return true;
3963	}
3964
3965	/**
3966	* Callback employed by buslogicR3Suspend and buslogicR3PowerOff.
3967	*
3968	* @returns true if we've quiesced, false if we're still working.
3969	* @param pDevIns The device instance.
3970	*/
3971	static DECLCALLBACK(bool) buslogicR3IsAsyncSuspendOrPowerOffDone(PPDMDEVINS pDevIns)
3972	{
3973	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
3974	return false;
3975
3976	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3977	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
3978	return true;
3979	}
3980
3981	/**
3982	* Common worker for buslogicR3Suspend and buslogicR3PowerOff.
3983	*/
3984	static void buslogicR3SuspendOrPowerOff(PPDMDEVINS pDevIns)
3985	{
3986	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3987	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3988
3989	ASMAtomicWriteBool(&pThisCC->fSignalIdle, true);
3990	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
3991	PDMDevHlpSetAsyncNotification(pDevIns, buslogicR3IsAsyncSuspendOrPowerOffDone);
3992	else
3993	{
3994	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
3995	AssertMsg(!pThis->fNotificationSent, ("The PDM Queue should be empty at this point\n"));
3996	RT_NOREF(pThis);
3997	}
3998
3999	for (uint32_t i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
4000	{
4001	PBUSLOGICDEVICE pThisDevice = &pThisCC->aDeviceStates[i];
4002	if (pThisDevice->pDrvMediaEx)
4003	pThisDevice->pDrvMediaEx->pfnNotifySuspend(pThisDevice->pDrvMediaEx);
4004	}
4005	}
4006
4007	/**
4008	* Suspend notification.
4009	*
4010	* @param pDevIns The device instance data.
4011	*/
4012	static DECLCALLBACK(void) buslogicR3Suspend(PPDMDEVINS pDevIns)
4013	{
4014	Log(("buslogicR3Suspend\n"));
4015	buslogicR3SuspendOrPowerOff(pDevIns);
4016	}
4017
4018	/**
4019	* Detach notification.
4020	*
4021	* One harddisk at one port has been unplugged.
4022	* The VM is suspended at this point.
4023	*
4024	* @param pDevIns The device instance.
4025	* @param iLUN The logical unit which is being detached.
4026	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
4027	*/
4028	static DECLCALLBACK(void) buslogicR3Detach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
4029	{
4030	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4031	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4032	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[iLUN];
4033	Log(("%s:\n", __FUNCTION__));
4034	RT_NOREF(fFlags);
4035
4036
4037	AssertMsg(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
4038	("BusLogic: Device does not support hotplugging\n"));
4039
4040	/*
4041	* Zero some important members.
4042	*/
4043	pThis->afDevicePresent[iLUN] = false;
4044	pDevice->fPresent = false;
4045	pDevice->pDrvBase = NULL;
4046	pDevice->pDrvMedia = NULL;
4047	pDevice->pDrvMediaEx = NULL;
4048	}
4049
4050	/**
4051	* Attach command.
4052	*
4053	* This is called when we change block driver.
4054	*
4055	* @returns VBox status code.
4056	* @param pDevIns The device instance.
4057	* @param iLUN The logical unit which is being detached.
4058	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
4059	*/
4060	static DECLCALLBACK(int) buslogicR3Attach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
4061	{
4062	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4063	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4064	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[iLUN];
4065	int rc;
4066
4067	AssertMsgReturn(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
4068	("BusLogic: Device does not support hotplugging\n"),
4069	VERR_INVALID_PARAMETER);
4070
4071	/* the usual paranoia */
4072	AssertRelease(!pDevice->pDrvBase);
4073	AssertRelease(!pDevice->pDrvMedia);
4074	AssertRelease(!pDevice->pDrvMediaEx);
4075	Assert(pDevice->iLUN == iLUN);
4076
4077	/*
4078	* Try attach the SCSI driver and get the interfaces,
4079	* required as well as optional.
4080	*/
4081	rc = PDMDevHlpDriverAttach(pDevIns, pDevice->iLUN, &pDevice->IBase, &pDevice->pDrvBase, NULL);
4082	if (RT_SUCCESS(rc))
4083	{
4084	/* Query the media interface. */
4085	pDevice->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIA);
4086	AssertMsgReturn(VALID_PTR(pDevice->pDrvMedia),
4087	("BusLogic configuration error: LUN#%d misses the basic media interface!\n", pDevice->iLUN),
4088	VERR_PDM_MISSING_INTERFACE);
4089
4090	/* Get the extended media interface. */
4091	pDevice->pDrvMediaEx = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIAEX);
4092	AssertMsgReturn(VALID_PTR(pDevice->pDrvMediaEx),
4093	("BusLogic configuration error: LUN#%d misses the extended media interface!\n", pDevice->iLUN),
4094	VERR_PDM_MISSING_INTERFACE);
4095
4096	rc = pDevice->pDrvMediaEx->pfnIoReqAllocSizeSet(pDevice->pDrvMediaEx, sizeof(BUSLOGICREQ));
4097	AssertMsgRCReturn(rc, ("BusLogic configuration error: LUN#%u: Failed to set I/O request size!", pDevice->iLUN),
4098	rc);
4099
4100	pThis->afDevicePresent[iLUN] = true;
4101	pDevice->fPresent = true;
4102	}
4103	else
4104	AssertMsgFailed(("Failed to attach LUN#%d. rc=%Rrc\n", pDevice->iLUN, rc));
4105
4106	if (RT_FAILURE(rc))
4107	{
4108	pThis->afDevicePresent[iLUN] = false;
4109	pDevice->fPresent = false;
4110	pDevice->pDrvBase = NULL;
4111	pDevice->pDrvMedia = NULL;
4112	pDevice->pDrvMediaEx = NULL;
4113	}
4114	return rc;
4115	}
4116
4117	/**
4118	* Callback employed by buslogicR3Reset.
4119	*
4120	* @returns true if we've quiesced, false if we're still working.
4121	* @param pDevIns The device instance.
4122	*/
4123	static DECLCALLBACK(bool) buslogicR3IsAsyncResetDone(PPDMDEVINS pDevIns)
4124	{
4125	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4126	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4127
4128	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4129	return false;
4130	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
4131
4132	buslogicR3HwReset(pDevIns, pThis, pThisCC, true);
4133	return true;
4134	}
4135
4136	/**
4137	* @copydoc FNPDMDEVRESET
4138	*/
4139	static DECLCALLBACK(void) buslogicR3Reset(PPDMDEVINS pDevIns)
4140	{
4141	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4142	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4143
4144	ASMAtomicWriteBool(&pThisCC->fSignalIdle, true);
4145	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4146	PDMDevHlpSetAsyncNotification(pDevIns, buslogicR3IsAsyncResetDone);
4147	else
4148	{
4149	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
4150	buslogicR3HwReset(pDevIns, pThis, pThisCC, true);
4151	}
4152	}
4153
4154	/**
4155	* Poweroff notification.
4156	*
4157	* @param pDevIns Pointer to the device instance
4158	*/
4159	static DECLCALLBACK(void) buslogicR3PowerOff(PPDMDEVINS pDevIns)
4160	{
4161	Log(("buslogicR3PowerOff\n"));
4162	buslogicR3SuspendOrPowerOff(pDevIns);
4163	}
4164
4165	/**
4166	* Destroy a driver instance.
4167	*
4168	* Most VM resources are freed by the VM. This callback is provided so that any non-VM
4169	* resources can be freed correctly.
4170	*
4171	* @param pDevIns The device instance data.
4172	*/
4173	static DECLCALLBACK(int) buslogicR3Destruct(PPDMDEVINS pDevIns)
4174	{
4175	PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
4176	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4177	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4178
4179	PDMDevHlpCritSectDelete(pDevIns, &pThis->CritSectIntr);
4180
4181	if (pThis->hEvtProcess != NIL_SUPSEMEVENT)
4182	{
4183	PDMDevHlpSUPSemEventClose(pDevIns, pThis->hEvtProcess);
4184	pThis->hEvtProcess = NIL_SUPSEMEVENT;
4185	}
4186
4187	vboxscsiDestroy(&pThisCC->VBoxSCSI);
4188
4189	return VINF_SUCCESS;
4190	}
4191
4192	/**
4193	* @interface_method_impl{PDMDEVREG,pfnConstruct}
4194	*/
4195	static DECLCALLBACK(int) buslogicR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
4196	{
4197	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
4198	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4199	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4200	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
4201
4202	/*
4203	* Init instance data (do early because of constructor).
4204	*/
4205	pThis->hMmio = NIL_IOMMMIOHANDLE;
4206	pThis->hIoPortsIsa = NIL_IOMIOPORTHANDLE;
4207	pThis->hIoPortsPci = NIL_IOMIOPORTHANDLE;
4208	pThisCC->pDevIns = pDevIns;
4209	pThisCC->IBase.pfnQueryInterface = buslogicR3StatusQueryInterface;
4210	pThisCC->ILeds.pfnQueryStatusLed = buslogicR3StatusQueryStatusLed;
4211
4212	PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
4213	PDMPCIDEV_ASSERT_VALID(pDevIns, pPciDev);
4214
4215	PDMPciDevSetVendorId(pPciDev, 0x104b); /* BusLogic */
4216	PDMPciDevSetDeviceId(pPciDev, 0x1040); /* BT-958 */
4217	PDMPciDevSetCommand(pPciDev, PCI_COMMAND_IOACCESS \| PCI_COMMAND_MEMACCESS);
4218	PDMPciDevSetRevisionId(pPciDev, 0x01);
4219	PDMPciDevSetClassProg(pPciDev, 0x00); /* SCSI */
4220	PDMPciDevSetClassSub(pPciDev, 0x00); /* SCSI */
4221	PDMPciDevSetClassBase(pPciDev, 0x01); /* Mass storage */
4222	PDMPciDevSetBaseAddress(pPciDev, 0, true /IO/, false /Pref/, false /64-bit/, 0x00000000);
4223	PDMPciDevSetBaseAddress(pPciDev, 1, false /IO/, false /Pref/, false /64-bit/, 0x00000000);
4224	PDMPciDevSetSubSystemVendorId(pPciDev, 0x104b);
4225	PDMPciDevSetSubSystemId(pPciDev, 0x1040);
4226	PDMPciDevSetInterruptLine(pPciDev, 0x00);
4227	PDMPciDevSetInterruptPin(pPciDev, 0x01);
4228
4229	/*
4230	* Validate and read configuration.
4231	*/
4232	PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns, "Bootable\|AdapterType\|ISACompat", "");
4233
4234	bool fBootable = true;
4235	int rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "Bootable", &fBootable, true);
4236	if (RT_FAILURE(rc))
4237	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read Bootable as boolean"));
4238	Log(("%s: fBootable=%RTbool\n", __FUNCTION__, fBootable));
4239
4240	/* Figure out the emulated device type. */
4241	char szCfgStr[16];
4242	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "AdapterType", szCfgStr, sizeof(szCfgStr), "BT-958D");
4243	if (RT_FAILURE(rc))
4244	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read AdapterType as string"));
4245	Log(("%s: AdapterType=%s\n", __FUNCTION__, szCfgStr));
4246
4247	/* Grok the AdapterType setting. */
4248	if (!strcmp(szCfgStr, "BT-958D")) /* Default PCI device, 32-bit and 24-bit addressing. */
4249	{
4250	pThis->uDevType = DEV_BT_958D;
4251	pThis->uDefaultISABaseCode = ISA_BASE_DISABLED;
4252	}
4253	else if (!strcmp(szCfgStr, "BT-545C")) /* ISA device, 24-bit addressing only. */
4254	{
4255	pThis->uDevType = DEV_BT_545C;
4256	pThis->uIsaIrq = 11;
4257	}
4258	else if (!strcmp(szCfgStr, "AHA-1540B")) /* Competitor ISA device. */
4259	{
4260	pThis->uDevType = DEV_AHA_1540B;
4261	pThis->uIsaIrq = 11;
4262	}
4263	else
4264	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
4265	N_("BusLogic configuration error: invalid AdapterType setting"));
4266
4267	/* Only the first instance defaults to having the ISA compatibility ports enabled. */
4268	if (iInstance == 0)
4269	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "ISACompat", szCfgStr, sizeof(szCfgStr), "Alternate");
4270	else
4271	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "ISACompat", szCfgStr, sizeof(szCfgStr), "Disabled");
4272	if (RT_FAILURE(rc))
4273	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read ISACompat as string"));
4274	Log(("%s: ISACompat=%s\n", __FUNCTION__, szCfgStr));
4275
4276	/* Grok the ISACompat setting. */
4277	if (!strcmp(szCfgStr, "Disabled"))
4278	pThis->uDefaultISABaseCode = ISA_BASE_DISABLED;
4279	else if (!strcmp(szCfgStr, "Primary"))
4280	pThis->uDefaultISABaseCode = 0; /* I/O base at 330h. */
4281	else if (!strcmp(szCfgStr, "Alternate"))
4282	pThis->uDefaultISABaseCode = 1; /* I/O base at 334h. */
4283	else
4284	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
4285	N_("BusLogic configuration error: invalid ISACompat setting"));
4286
4287	/*
4288	* Register the PCI device and its I/O regions if applicable.
4289	*/
4290	if (!pThis->uIsaIrq)
4291	{
4292	rc = PDMDevHlpPCIRegister(pDevIns, pPciDev);
4293	AssertRCReturn(rc, rc);
4294
4295	rc = PDMDevHlpPCIIORegionCreateIo(pDevIns, 0 /iPciRegion/, 32 /cPorts/,
4296	buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/,
4297	"BusLogic PCI", NULL /paExtDescs/, &pThis->hIoPortsPci);
4298	AssertRCReturn(rc, rc);
4299
4300	rc = PDMDevHlpPCIIORegionCreateMmio(pDevIns, 1 /iPciRegion/, 32 /cbRegion/, PCI_ADDRESS_SPACE_MEM,
4301	buslogicMMIOWrite, buslogicMMIORead, NULL /pvUser/,
4302	IOMMMIO_FLAGS_READ_PASSTHRU \| IOMMMIO_FLAGS_WRITE_PASSTHRU,
4303	"BusLogic MMIO", &pThis->hMmio);
4304	AssertRCReturn(rc, rc);
4305	}
4306
4307	/* Initialize the SCSI emulation for the BIOS. */
4308	rc = vboxscsiInitialize(&pThisCC->VBoxSCSI);
4309	if (RT_FAILURE(rc))
4310	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic failed to initialize BIOS SCSI interface"));
4311
4312	if (fBootable)
4313	{
4314	/* Register I/O port space for BIOS access. */
4315	rc = PDMDevHlpIoPortCreateExAndMap(pDevIns, BUSLOGIC_BIOS_IO_PORT, 4 /cPorts/, 0 /fFlags/,
4316	buslogicR3BiosIoPortWrite, buslogicR3BiosIoPortRead,
4317	buslogicR3BiosIoPortWriteStr, buslogicR3BiosIoPortReadStr, NULL /pvUser/,
4318	"BusLogic BIOS" , NULL /paExtDesc/, &pThis->hIoPortsBios);
4319	if (RT_FAILURE(rc))
4320	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register BIOS I/O handlers"));
4321	}
4322
4323	/* Set up the compatibility I/O range. */
4324	rc = PDMDevHlpIoPortCreate(pDevIns, 4 /cPorts/, NULL /pPciDev/, UINT32_MAX /iPciRegion/,
4325	buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/,
4326	"BusLogic ISA", NULL /paExtDescs/, &pThis->hIoPortsIsa);
4327	AssertRCReturn(rc, rc);
4328
4329	rc = buslogicR3RegisterISARange(pDevIns, pThis, pThis->uDefaultISABaseCode);
4330	if (RT_FAILURE(rc))
4331	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register ISA I/O handlers"));
4332
4333
4334	/* Init the interrupt critsect. */
4335	rc = PDMDevHlpCritSectInit(pDevIns, &pThis->CritSectIntr, RT_SRC_POS, "BusLogic-Intr#%u", pDevIns->iInstance);
4336	if (RT_FAILURE(rc))
4337	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic: cannot create critical section"));
4338
4339	/*
4340	* Create event semaphore and worker thread.
4341	*/
4342	rc = PDMDevHlpSUPSemEventCreate(pDevIns, &pThis->hEvtProcess);
4343	if (RT_FAILURE(rc))
4344	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4345	N_("BusLogic: Failed to create SUP event semaphore"));
4346
4347	char szDevTag[20];
4348	RTStrPrintf(szDevTag, sizeof(szDevTag), "BUSLOGIC-%u", iInstance);
4349
4350	rc = PDMDevHlpThreadCreate(pDevIns, &pThisCC->pThreadWrk, pThis, buslogicR3Worker,
4351	buslogicR3WorkerWakeUp, 0, RTTHREADTYPE_IO, szDevTag);
4352	if (RT_FAILURE(rc))
4353	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4354	N_("BusLogic: Failed to create worker thread %s"), szDevTag);
4355
4356	/* Initialize per device state. */
4357	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
4358	{
4359	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
4360
4361	/* Initialize static parts of the device. */
4362	pDevice->iLUN = i;
4363	pDevice->pDevIns = pDevIns;
4364	pDevice->Led.u32Magic = PDMLED_MAGIC;
4365	pDevice->IBase.pfnQueryInterface = buslogicR3DeviceQueryInterface;
4366	pDevice->IMediaPort.pfnQueryDeviceLocation = buslogicR3QueryDeviceLocation;
4367	pDevice->IMediaExPort.pfnIoReqCompleteNotify = buslogicR3IoReqCompleteNotify;
4368	pDevice->IMediaExPort.pfnIoReqCopyFromBuf = buslogicR3IoReqCopyFromBuf;
4369	pDevice->IMediaExPort.pfnIoReqCopyToBuf = buslogicR3IoReqCopyToBuf;
4370	pDevice->IMediaExPort.pfnIoReqQueryBuf = NULL;
4371	pDevice->IMediaExPort.pfnIoReqQueryDiscardRanges = NULL;
4372	pDevice->IMediaExPort.pfnIoReqStateChanged = buslogicR3IoReqStateChanged;
4373	pDevice->IMediaExPort.pfnMediumEjected = buslogicR3MediumEjected;
4374	pDevice->ILed.pfnQueryStatusLed = buslogicR3DeviceQueryStatusLed;
4375	RTStrPrintf(pDevice->szName, sizeof(pDevice->szName), "Device%u", i);
4376
4377	/* Attach SCSI driver. */
4378	rc = PDMDevHlpDriverAttach(pDevIns, pDevice->iLUN, &pDevice->IBase, &pDevice->pDrvBase, pDevice->szName);
4379	if (RT_SUCCESS(rc))
4380	{
4381	/* Query the media interface. */
4382	pDevice->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIA);
4383	AssertMsgReturn(VALID_PTR(pDevice->pDrvMedia),
4384	("Buslogic configuration error: LUN#%d misses the basic media interface!\n", pDevice->iLUN),
4385	VERR_PDM_MISSING_INTERFACE);
4386
4387	/* Get the extended media interface. */
4388	pDevice->pDrvMediaEx = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIAEX);
4389	AssertMsgReturn(VALID_PTR(pDevice->pDrvMediaEx),
4390	("Buslogic configuration error: LUN#%d misses the extended media interface!\n", pDevice->iLUN),
4391	VERR_PDM_MISSING_INTERFACE);
4392
4393	rc = pDevice->pDrvMediaEx->pfnIoReqAllocSizeSet(pDevice->pDrvMediaEx, sizeof(BUSLOGICREQ));
4394	if (RT_FAILURE(rc))
4395	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4396	N_("Buslogic configuration error: LUN#%u: Failed to set I/O request size!"),
4397	pDevice->iLUN);
4398
4399	pThis->afDevicePresent[i] = true;
4400	pDevice->fPresent = true;
4401	}
4402	else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
4403	{
4404	pThis->afDevicePresent[i] = false;
4405	pDevice->fPresent = false;
4406	pDevice->pDrvBase = NULL;
4407	pDevice->pDrvMedia = NULL;
4408	pDevice->pDrvMediaEx = NULL;
4409	rc = VINF_SUCCESS;
4410	Log(("BusLogic: no driver attached to device %s\n", pDevice->szName));
4411	}
4412	else
4413	{
4414	AssertLogRelMsgFailed(("BusLogic: Failed to attach %s\n", pDevice->szName));
4415	return rc;
4416	}
4417	}
4418
4419	/*
4420	* Attach status driver (optional).
4421	*/
4422	PPDMIBASE pBase;
4423	rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThisCC->IBase, &pBase, "Status Port");
4424	if (RT_SUCCESS(rc))
4425	{
4426	pThisCC->pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
4427	pThisCC->pMediaNotify = PDMIBASE_QUERY_INTERFACE(pBase, PDMIMEDIANOTIFY);
4428	}
4429	else
4430	AssertMsgReturn(rc == VERR_PDM_NO_ATTACHED_DRIVER, ("Failed to attach to status driver. rc=%Rrc\n", rc),
4431	PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot attach to status driver")));
4432
4433	rc = PDMDevHlpSSMRegisterEx(pDevIns, BUSLOGIC_SAVED_STATE_MINOR_VERSION, sizeof(*pThis), NULL,
4434	NULL, buslogicR3LiveExec, NULL,
4435	NULL, buslogicR3SaveExec, NULL,
4436	NULL, buslogicR3LoadExec, buslogicR3LoadDone);
4437	if (RT_FAILURE(rc))
4438	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register save state handlers"));
4439
4440	/*
4441	* Register the debugger info callback.
4442	*/
4443	char szTmp[128];
4444	RTStrPrintf(szTmp, sizeof(szTmp), "%s%d", pDevIns->pReg->szName, pDevIns->iInstance);
4445	PDMDevHlpDBGFInfoRegister(pDevIns, szTmp, "BusLogic HBA info", buslogicR3Info);
4446
4447	rc = buslogicR3HwReset(pDevIns, pThis, pThisCC, true);
4448	AssertMsgRC(rc, ("hardware reset of BusLogic host adapter failed rc=%Rrc\n", rc));
4449
4450	return rc;
4451	}
4452
4453	#else /* !IN_RING3 */
4454
4455	/**
4456	* @callback_method_impl{PDMDEVREGR0,pfnConstruct}
4457	*/
4458	static DECLCALLBACK(int) buslogicRZConstruct(PPDMDEVINS pDevIns)
4459	{
4460	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
4461	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4462
4463	if (!pThis->uIsaIrq)
4464	{
4465	int rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortsPci, buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/);
4466	AssertRCReturn(rc, rc);
4467
4468	rc = PDMDevHlpMmioSetUpContext(pDevIns, pThis->hMmio, buslogicMMIOWrite, buslogicMMIORead, NULL /pvUser/);
4469	AssertRCReturn(rc, rc);
4470	}
4471
4472	int rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortsIsa, buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/);
4473	AssertRCReturn(rc, rc);
4474
4475	return VINF_SUCCESS;
4476	}
4477
4478
4479	#endif /* !IN_RING3 */
4480
4481	/**
4482	* The device registration structure.
4483	*/
4484	const PDMDEVREG g_DeviceBusLogic =
4485	{
4486	/* .u32Version = */ PDM_DEVREG_VERSION,
4487	/* .uReserved0 = */ 0,
4488	/* .szName = */ "buslogic",
4489	/* .fFlags = */ PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RZ \| PDM_DEVREG_FLAGS_NEW_STYLE
4490	\| PDM_DEVREG_FLAGS_FIRST_SUSPEND_NOTIFICATION \| PDM_DEVREG_FLAGS_FIRST_POWEROFF_NOTIFICATION
4491	\| PDM_DEVREG_FLAGS_FIRST_RESET_NOTIFICATION,
4492	/* .fClass = */ PDM_DEVREG_CLASS_STORAGE,
4493	/* .cMaxInstances = */ ~0U,
4494	/* .uSharedVersion = */ 42,
4495	/* .cbInstanceShared = */ sizeof(BUSLOGIC),
4496	/* .cbInstanceCC = */ sizeof(BUSLOGICCC),
4497	/* .cbInstanceRC = */ sizeof(BUSLOGICRC),
4498	/* .cMaxPciDevices = */ 1,
4499	/* .cMaxMsixVectors = */ 0,
4500	/* .pszDescription = */ "BusLogic BT-958 SCSI host adapter.\n",
4501	#if defined(IN_RING3)
4502	/* .pszRCMod = */ "VBoxDDRC.rc",
4503	/* .pszR0Mod = */ "VBoxDDR0.r0",
4504	/* .pfnConstruct = */ buslogicR3Construct,
4505	/* .pfnDestruct = */ buslogicR3Destruct,
4506	/* .pfnRelocate = */ NULL,
4507	/* .pfnMemSetup = */ NULL,
4508	/* .pfnPowerOn = */ NULL,
4509	/* .pfnReset = */ buslogicR3Reset,
4510	/* .pfnSuspend = */ buslogicR3Suspend,
4511	/* .pfnResume = */ NULL,
4512	/* .pfnAttach = */ buslogicR3Attach,
4513	/* .pfnDetach = */ buslogicR3Detach,
4514	/* .pfnQueryInterface = */ NULL,
4515	/* .pfnInitComplete = */ NULL,
4516	/* .pfnPowerOff = */ buslogicR3PowerOff,
4517	/* .pfnSoftReset = */ NULL,
4518	/* .pfnReserved0 = */ NULL,
4519	/* .pfnReserved1 = */ NULL,
4520	/* .pfnReserved2 = */ NULL,
4521	/* .pfnReserved3 = */ NULL,
4522	/* .pfnReserved4 = */ NULL,
4523	/* .pfnReserved5 = */ NULL,
4524	/* .pfnReserved6 = */ NULL,
4525	/* .pfnReserved7 = */ NULL,
4526	#elif defined(IN_RING0)
4527	/* .pfnEarlyConstruct = */ NULL,
4528	/* .pfnConstruct = */ buslogicRZConstruct,
4529	/* .pfnDestruct = */ NULL,
4530	/* .pfnFinalDestruct = */ NULL,
4531	/* .pfnRequest = */ NULL,
4532	/* .pfnReserved0 = */ NULL,
4533	/* .pfnReserved1 = */ NULL,
4534	/* .pfnReserved2 = */ NULL,
4535	/* .pfnReserved3 = */ NULL,
4536	/* .pfnReserved4 = */ NULL,
4537	/* .pfnReserved5 = */ NULL,
4538	/* .pfnReserved6 = */ NULL,
4539	/* .pfnReserved7 = */ NULL,
4540	#elif defined(IN_RC)
4541	/* .pfnConstruct = */ buslogicRZConstruct,
4542	/* .pfnReserved0 = */ NULL,
4543	/* .pfnReserved1 = */ NULL,
4544	/* .pfnReserved2 = */ NULL,
4545	/* .pfnReserved3 = */ NULL,
4546	/* .pfnReserved4 = */ NULL,
4547	/* .pfnReserved5 = */ NULL,
4548	/* .pfnReserved6 = */ NULL,
4549	/* .pfnReserved7 = */ NULL,
4550	#else
4551	# error "Not in IN_RING3, IN_RING0 or IN_RC!"
4552	#endif
4553	/* .u32VersionEnd = */ PDM_DEVREG_VERSION
4554	};
4555
4556	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Storage/DevBusLogic.cpp@ 86482

Download in other formats: