DevBusLogic.cpp@ 91487

Last change on this file since 91487 was 90791, checked in by vboxsync, 3 years ago
Devices: More VALID_PTR -> RT_VALID_PTR/AssertPtr.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 177.9 KB

Line
1	/* $Id: DevBusLogic.cpp 90791 2021-08-23 10:28:24Z vboxsync $ */
2	/** @file
3	* VBox storage devices - BusLogic SCSI host adapter BT-958.
4	*
5	* Based on the Multi-Master Ultra SCSI Systems Technical Reference Manual.
6	*/
7
8	/*
9	* Copyright (C) 2006-2020 Oracle Corporation
10	*
11	* This file is part of VirtualBox Open Source Edition (OSE), as
12	* available from http://www.virtualbox.org. This file is free software;
13	* you can redistribute it and/or modify it under the terms of the GNU
14	* General Public License (GPL) as published by the Free Software
15	* Foundation, in version 2 as it comes in the "COPYING" file of the
16	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
17	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
18	*/
19
20
21	/*********************************************************************************************************************************
22	* Header Files *
23	*********************************************************************************************************************************/
24	#define LOG_GROUP LOG_GROUP_DEV_BUSLOGIC
25	#include <VBox/vmm/pdmdev.h>
26	#include <VBox/vmm/pdmstorageifs.h>
27	#include <VBox/vmm/pdmcritsect.h>
28	#include <VBox/AssertGuest.h>
29	#include <VBox/scsi.h>
30	#include <iprt/asm.h>
31	#include <iprt/assert.h>
32	#include <iprt/string.h>
33	#include <iprt/log.h>
34	#ifdef IN_RING3
35	# include <iprt/alloc.h>
36	# include <iprt/memcache.h>
37	# include <iprt/param.h>
38	# include <iprt/uuid.h>
39	#endif
40
41	#include "VBoxSCSI.h"
42	#include "VBoxDD.h"
43
44
45	/*********************************************************************************************************************************
46	* Defined Constants And Macros *
47	*********************************************************************************************************************************/
48	/** Maximum number of attached devices the adapter can handle. */
49	#define BUSLOGIC_MAX_DEVICES 16
50
51	/** Maximum number of scatter gather elements this device can handle. */
52	#define BUSLOGIC_MAX_SCATTER_GATHER_LIST_SIZE 128
53
54	/** Size of the command buffer. */
55	#define BUSLOGIC_COMMAND_SIZE_MAX 53
56
57	/** Size of the reply buffer. */
58	#define BUSLOGIC_REPLY_SIZE_MAX 64
59
60	/** Custom fixed I/O ports for BIOS controller access.
61	* Note that these should not be in the ISA range (below 400h) to avoid
62	* conflicts with ISA device probing. Addresses in the 300h-340h range should be
63	* especially avoided.
64	*/
65	#define BUSLOGIC_BIOS_IO_PORT 0x430
66
67	/** State saved version. */
68	#define BUSLOGIC_SAVED_STATE_MINOR_VERSION 5
69	/** Saved state version before VBoxSCSI got removed. */
70	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_VBOXSCSI_REMOVAL 4
71	/** Saved state version before command buffer size was raised. */
72	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE 3
73	/** Saved state version before 24-bit mailbox support was implemented. */
74	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX 2
75	/** Saved state version before the suspend on error feature was implemented. */
76	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_ERROR_HANDLING 1
77
78	/** Command buffer size in old saved states. */
79	#define BUSLOGIC_COMMAND_SIZE_OLD 5
80
81	/** The duration of software-initiated reset (in nano seconds).
82	* Not documented, set to 50 ms. */
83	#define BUSLOGIC_RESET_DURATION_NS UINT64_C(50000000)
84
85
86	/*********************************************************************************************************************************
87	* Structures and Typedefs *
88	*********************************************************************************************************************************/
89	/**
90	* State of a device attached to the buslogic host adapter.
91	*
92	* @implements PDMIBASE
93	* @implements PDMISCSIPORT
94	* @implements PDMILEDPORTS
95	*/
96	typedef struct BUSLOGICDEVICE
97	{
98	/** The ring-3 device instance (for getting our bearings when arriving in an
99	* interface method). */
100	PPDMDEVINSR3 pDevIns;
101
102	/** LUN of the device. */
103	uint32_t iLUN;
104
105	/** Flag whether device is present.
106	* @note This is mirrored in BUSLOGIC::afDevicePresent. */
107	bool fPresent;
108	bool afAlignment[3];
109
110	/** Our base interface. */
111	PDMIBASE IBase;
112	/** Media port interface. */
113	PDMIMEDIAPORT IMediaPort;
114	/** Extended media port interface. */
115	PDMIMEDIAEXPORT IMediaExPort;
116	/** Led interface. */
117	PDMILEDPORTS ILed;
118	/** Pointer to the attached driver's base interface. */
119	R3PTRTYPE(PPDMIBASE) pDrvBase;
120	/** Pointer to the attached driver's media interface. */
121	R3PTRTYPE(PPDMIMEDIA) pDrvMedia;
122	/** Pointer to the attached driver's extended media interface. */
123	R3PTRTYPE(PPDMIMEDIAEX) pDrvMediaEx;
124	/** The status LED state for this device. */
125	PDMLED Led;
126
127	/** Number of outstanding tasks on the port. */
128	volatile uint32_t cOutstandingRequests;
129	/** The device name. */
130	char szName[12];
131	} BUSLOGICDEVICE, *PBUSLOGICDEVICE;
132
133	/**
134	* Commands the BusLogic adapter supports.
135	*/
136	enum BUSLOGICCOMMAND
137	{
138	BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT = 0x00,
139	BUSLOGICCOMMAND_INITIALIZE_MAILBOX = 0x01,
140	BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND = 0x02,
141	BUSLOGICCOMMAND_EXECUTE_BIOS_COMMAND = 0x03,
142	BUSLOGICCOMMAND_INQUIRE_BOARD_ID = 0x04,
143	BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT = 0x05,
144	BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT = 0x06,
145	BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS = 0x07,
146	BUSLOGICCOMMAND_SET_TIME_OFF_BUS = 0x08,
147	BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE = 0x09,
148	BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7 = 0x0a,
149	BUSLOGICCOMMAND_INQUIRE_CONFIGURATION = 0x0b,
150	BUSLOGICCOMMAND_ENABLE_TARGET_MODE = 0x0c,
151	BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION = 0x0d,
152	BUSLOGICCOMMAND_WRITE_ADAPTER_LOCAL_RAM = 0x1a,
153	BUSLOGICCOMMAND_READ_ADAPTER_LOCAL_RAM = 0x1b,
154	BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO = 0x1c,
155	BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO = 0x1d,
156	BUSLOGICCOMMAND_ECHO_COMMAND_DATA = 0x1f,
157	BUSLOGICCOMMAND_HOST_ADAPTER_DIAGNOSTIC = 0x20,
158	BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS = 0x21,
159	BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15 = 0x23,
160	BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES = 0x24,
161	BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT = 0x25,
162	BUSLOGICCOMMAND_EXT_BIOS_INFO = 0x28,
163	BUSLOGICCOMMAND_UNLOCK_MAILBOX = 0x29,
164	BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX = 0x81,
165	BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND = 0x83,
166	BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER = 0x84,
167	BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER = 0x85,
168	BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION = 0x86,
169	BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER = 0x8b,
170	BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD = 0x8c,
171	BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION = 0x8d,
172	BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE = 0x8f,
173	BUSLOGICCOMMAND_STORE_HOST_ADAPTER_LOCAL_RAM = 0x90,
174	BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM = 0x91,
175	BUSLOGICCOMMAND_STORE_LOCAL_DATA_IN_EEPROM = 0x92,
176	BUSLOGICCOMMAND_UPLOAD_AUTO_SCSI_CODE = 0x94,
177	BUSLOGICCOMMAND_MODIFY_IO_ADDRESS = 0x95,
178	BUSLOGICCOMMAND_SET_CCB_FORMAT = 0x96,
179	BUSLOGICCOMMAND_WRITE_INQUIRY_BUFFER = 0x9a,
180	BUSLOGICCOMMAND_READ_INQUIRY_BUFFER = 0x9b,
181	BUSLOGICCOMMAND_FLASH_ROM_UPLOAD_DOWNLOAD = 0xa7,
182	BUSLOGICCOMMAND_READ_SCAM_DATA = 0xa8,
183	BUSLOGICCOMMAND_WRITE_SCAM_DATA = 0xa9
184	} BUSLOGICCOMMAND;
185
186	#pragma pack(1)
187	/**
188	* Auto SCSI structure which is located
189	* in host adapter RAM and contains several
190	* configuration parameters.
191	*/
192	typedef struct AutoSCSIRam
193	{
194	uint8_t aInternalSignature[2];
195	uint8_t cbInformation;
196	uint8_t aHostAdaptertype[6];
197	uint8_t uReserved1;
198	bool fFloppyEnabled : 1;
199	bool fFloppySecondary : 1;
200	bool fLevelSensitiveInterrupt : 1;
201	unsigned char uReserved2 : 2;
202	unsigned char uSystemRAMAreForBIOS : 3;
203	unsigned char uDMAChannel : 7;
204	bool fDMAAutoConfiguration : 1;
205	unsigned char uIrqChannel : 7;
206	bool fIrqAutoConfiguration : 1;
207	uint8_t uDMATransferRate;
208	uint8_t uSCSIId;
209	bool fLowByteTerminated : 1;
210	bool fParityCheckingEnabled : 1;
211	bool fHighByteTerminated : 1;
212	bool fNoisyCablingEnvironment : 1;
213	bool fFastSynchronousNeogtiation : 1;
214	bool fBusResetEnabled : 1;
215	bool fReserved3 : 1;
216	bool fActiveNegotiationEnabled : 1;
217	uint8_t uBusOnDelay;
218	uint8_t uBusOffDelay;
219	bool fHostAdapterBIOSEnabled : 1;
220	bool fBIOSRedirectionOfInt19 : 1;
221	bool fExtendedTranslation : 1;
222	bool fMapRemovableAsFixed : 1;
223	bool fReserved4 : 1;
224	bool fBIOSSupportsMoreThan2Drives : 1;
225	bool fBIOSInterruptMode : 1;
226	bool fFlopticalSupport : 1;
227	uint16_t u16DeviceEnabledMask;
228	uint16_t u16WidePermittedMask;
229	uint16_t u16FastPermittedMask;
230	uint16_t u16SynchronousPermittedMask;
231	uint16_t u16DisconnectPermittedMask;
232	uint16_t u16SendStartUnitCommandMask;
233	uint16_t u16IgnoreInBIOSScanMask;
234	unsigned char uPCIInterruptPin : 2;
235	unsigned char uHostAdapterIoPortAddress : 2;
236	bool fStrictRoundRobinMode : 1;
237	bool fVesaBusSpeedGreaterThan33MHz : 1;
238	bool fVesaBurstWrite : 1;
239	bool fVesaBurstRead : 1;
240	uint16_t u16UltraPermittedMask;
241	uint32_t uReserved5;
242	uint8_t uReserved6;
243	uint8_t uAutoSCSIMaximumLUN;
244	bool fReserved7 : 1;
245	bool fSCAMDominant : 1;
246	bool fSCAMenabled : 1;
247	bool fSCAMLevel2 : 1;
248	unsigned char uReserved8 : 4;
249	bool fInt13Extension : 1;
250	bool fReserved9 : 1;
251	bool fCDROMBoot : 1;
252	unsigned char uReserved10 : 5;
253	unsigned char uBootTargetId : 4;
254	unsigned char uBootChannel : 4;
255	bool fForceBusDeviceScanningOrder : 1;
256	unsigned char uReserved11 : 7;
257	uint16_t u16NonTaggedToAlternateLunPermittedMask;
258	uint16_t u16RenegotiateSyncAfterCheckConditionMask;
259	uint8_t aReserved12[10];
260	uint8_t aManufacturingDiagnostic[2];
261	uint16_t u16Checksum;
262	} AutoSCSIRam, *PAutoSCSIRam;
263	AssertCompileSize(AutoSCSIRam, 64);
264	#pragma pack()
265
266	/**
267	* The local Ram.
268	*/
269	typedef union HostAdapterLocalRam
270	{
271	/** Byte view. */
272	uint8_t u8View[256];
273	/** Structured view. */
274	struct
275	{
276	/** Offset 0 - 63 is for BIOS. */
277	uint8_t u8Bios[64];
278	/** Auto SCSI structure. */
279	AutoSCSIRam autoSCSIData;
280	} structured;
281	} HostAdapterLocalRam, *PHostAdapterLocalRam;
282	AssertCompileSize(HostAdapterLocalRam, 256);
283
284
285	/** Ugly 24-bit big-endian addressing. */
286	typedef struct
287	{
288	uint8_t hi;
289	uint8_t mid;
290	uint8_t lo;
291	} Addr24, Len24;
292	AssertCompileSize(Addr24, 3);
293
294	#define ADDR_TO_U32(x) (((x).hi << 16) \| ((x).mid << 8) \| (x).lo)
295	#define LEN_TO_U32 ADDR_TO_U32
296	#define U32_TO_ADDR(a, x) do {(a).hi = (x) >> 16; (a).mid = (x) >> 8; (a).lo = (x);} while(0)
297	#define U32_TO_LEN U32_TO_ADDR
298
299	/** @name Compatible ISA base I/O port addresses. Disabled if zero.
300	* @{ */
301	#define NUM_ISA_BASES 8
302	#define MAX_ISA_BASE (NUM_ISA_BASES - 1)
303	#define ISA_BASE_DISABLED 6
304
305	#ifdef IN_RING3
306	static uint16_t const g_aISABases[NUM_ISA_BASES] =
307	{
308	0x330, 0x334, 0x230, 0x234, 0x130, 0x134, 0, 0
309	};
310	#endif
311	/** @} */
312
313	/**
314	* Emulated device types.
315	*/
316	enum BL_DEVICE_TYPE
317	{
318	DEV_BT_958D = 0, /* BusLogic BT-958D, PCI. */
319	DEV_BT_545C = 1, /* BusLogic BT-545C, ISA. */
320	DEV_AHA_1540B = 2 /* Adaptec AHA-1540B, ISA. */
321	};
322
323	/** Pointer to a task state structure. */
324	typedef struct BUSLOGICREQ *PBUSLOGICREQ;
325
326	/**
327	* The shared BusLogic device emulation state.
328	*/
329	typedef struct BUSLOGIC
330	{
331	/** Status register - Readonly. */
332	volatile uint8_t regStatus;
333	/** Interrupt register - Readonly. */
334	volatile uint8_t regInterrupt;
335	/** Geometry register - Readonly. */
336	volatile uint8_t regGeometry;
337	/** Pending (delayed) interrupt. */
338	volatile uint8_t uPendingIntr;
339
340	/** Command code the guest issued. */
341	uint8_t uOperationCode;
342	/** Current position in the command buffer. */
343	uint8_t iParameter;
344	/** Parameters left until the command is complete. */
345	uint8_t cbCommandParametersLeft;
346	/** Buffer for the command parameters the adapter is currently receiving from the guest.
347	* Size of the largest command which is possible. */
348	uint8_t aCommandBuffer[BUSLOGIC_COMMAND_SIZE_MAX]; /* Size of the biggest request. */
349
350	/** Only for LOG_ENABLED builds! */
351	volatile uint32_t cInMailboxesReadyIfLogEnabled;
352
353	/** Position in the buffer we are reading next.
354	* @note aligned on 64 byte boundrary for cache-line mojo. Means IOISABase
355	* is at offset 130. */
356	uint8_t iReply;
357	/** Bytes left until the reply buffer is empty. */
358	uint8_t cbReplyParametersLeft;
359	/** Buffer to store reply data from the controller to the guest. */
360	uint8_t aReplyBuffer[BUSLOGIC_REPLY_SIZE_MAX]; /* Size of the biggest reply. */
361
362	/** ISA I/O port base (disabled if zero). */
363	RTIOPORT IOISABase;
364	/** Default ISA I/O port base in FW-compatible format. */
365	uint8_t uDefaultISABaseCode;
366	/** Emulated device type. */
367	uint8_t uDevType;
368
369	/** Signature index for Adaptec models. */
370	uint8_t uAhaSigIdx;
371
372	/** Whether we are using the RAM or reply buffer. */
373	bool fUseLocalRam;
374
375	/** Flag whether IRQs are enabled. */
376	bool fIRQEnabled;
377	/** Flag whether 24-bit mailboxes are in use (default is 32-bit). */
378	bool fMbxIs24Bit;
379	/** ISA I/O port base (encoded in FW-compatible format). */
380	uint8_t uISABaseCode;
381	/** ISA IRQ, non-zero if in ISA mode. */
382	uint8_t uIsaIrq;
383
384	/** Number of mailboxes the guest set up. */
385	uint32_t cMailbox;
386
387	/** Time when HBA reset was last initiated. */
388	uint64_t u64ResetTime; /*< @todo does this need to be saved? /
389	/** Physical base address of the outgoing mailboxes. */
390	RTGCPHYS GCPhysAddrMailboxOutgoingBase;
391	/** Current outgoing mailbox position. */
392	uint32_t uMailboxOutgoingPositionCurrent;
393	/** Number of mailboxes ready. */
394	volatile uint32_t cMailboxesReady;
395	/** Whether a notification to R3 was sent. */
396	volatile bool fNotificationSent;
397	/** Flag whether a BIOS request is pending. */
398	volatile bool fBiosReqPending;
399
400	/** Whether strict round robin is enabled. */
401	bool fStrictRoundRobinMode;
402	/** Whether the extended LUN CCB format is enabled for 32 possible logical units. */
403	bool fExtendedLunCCBFormat;
404	/** Last completed command, for debugging. */
405	uint8_t uPrevCmd;
406
407	/** Current incoming mailbox position. */
408	uint32_t uMailboxIncomingPositionCurrent;
409	/** Physical base address of the incoming mailboxes. */
410	RTGCPHYS GCPhysAddrMailboxIncomingBase;
411
412	/** Critical section protecting access to the interrupt status register. */
413	PDMCRITSECT CritSectIntr;
414
415	/** Device presence indicators.
416	* @note Copy of BUSLOGICDEVICE::fPresent accessible from ring-0. */
417	bool afDevicePresent[BUSLOGIC_MAX_DEVICES];
418
419	/** The event semaphore the processing thread waits on. */
420	SUPSEMEVENT hEvtProcess;
421
422	/** ISA compatibility I/O ports. */
423	IOMIOPORTHANDLE hIoPortsIsa;
424	/** BIOS I/O ports for booting, optional. */
425	IOMIOPORTHANDLE hIoPortsBios;
426	/** PCI Region \#0: I/O ports. */
427	IOMIOPORTHANDLE hIoPortsPci;
428	/** PCI Region \#1: MMIO (32 bytes, but probably rounded up to 4KB). */
429	IOMMMIOHANDLE hMmio;
430
431	/** Local RAM for the fetch hostadapter local RAM request.
432	* I don't know how big the buffer really is but the maximum
433	* seems to be 256 bytes because the offset and count field in the command request
434	* are only one byte big.
435	*/
436	HostAdapterLocalRam LocalRam;
437	} BUSLOGIC;
438	/** Pointer to the shared BusLogic device emulation state. */
439	typedef BUSLOGIC *PBUSLOGIC;
440
441
442	/**
443	* The ring-3 BusLogic device emulation state.
444	*
445	* @implements PDMILEDPORTS
446	*/
447	typedef struct BUSLOGICR3
448	{
449	/** The device instance - only for getting our bearings in interface methods. */
450	PPDMDEVINSR3 pDevIns;
451
452	/** BusLogic device states. */
453	BUSLOGICDEVICE aDeviceStates[BUSLOGIC_MAX_DEVICES];
454
455	/** The base interface.
456	* @todo use PDMDEVINS::IBase */
457	PDMIBASE IBase;
458	/** Status Port - Leds interface. */
459	PDMILEDPORTS ILeds;
460	/** Partner of ILeds. */
461	R3PTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
462	/** Status LUN: Media Notifys. */
463	R3PTRTYPE(PPDMIMEDIANOTIFY) pMediaNotify;
464
465	/** Indicates that PDMDevHlpAsyncNotificationCompleted should be called when
466	* a port is entering the idle state. */
467	bool volatile fSignalIdle;
468	/** Flag whether the worker thread is sleeping. */
469	volatile bool fWrkThreadSleeping;
470
471	/** Worker thread. */
472	R3PTRTYPE(PPDMTHREAD) pThreadWrk;
473
474	/** Pointer to the array of addresses to redo. */
475	R3PTRTYPE(PRTGCPHYS) paGCPhysAddrCCBRedo;
476	/** Number of addresses the redo array holds. */
477	uint32_t cReqsRedo;
478	} BUSLOGICR3;
479	/** Pointer to the ring-3 BusLogic device emulation state. */
480	typedef BUSLOGICR3 *PBUSLOGICR3;
481
482
483	/**
484	* The ring-0 BusLogic device emulation state.
485	*/
486	typedef struct BUSLOGICR0
487	{
488	uint64_t uUnused;
489	} BUSLOGICR0;
490	/** Pointer to the ring-0 BusLogic device emulation state. */
491	typedef BUSLOGICR0 *PBUSLOGICR0;
492
493
494	/**
495	* The raw-mode BusLogic device emulation state.
496	*/
497	typedef struct BUSLOGICRC
498	{
499	uint64_t uUnused;
500	} BUSLOGICRC;
501	/** Pointer to the raw-mode BusLogic device emulation state. */
502	typedef BUSLOGICRC *PBUSLOGICRC;
503
504
505	/** The current context BusLogic device emulation state. */
506	typedef CTX_SUFF(BUSLOGIC) BUSLOGICCC;
507	/** Pointer to the current context BusLogic device emulation state. */
508	typedef CTX_SUFF(PBUSLOGIC) PBUSLOGICCC;
509
510
511	/** Register offsets in the I/O port space. */
512	#define BUSLOGIC_REGISTER_CONTROL 0 /*< Writeonly /
513	/** Fields for the control register. */
514	# define BL_CTRL_RSBUS RT_BIT(4) /* Reset SCSI Bus. */
515	# define BL_CTRL_RINT RT_BIT(5) /* Reset Interrupt. */
516	# define BL_CTRL_RSOFT RT_BIT(6) /* Soft Reset. */
517	# define BL_CTRL_RHARD RT_BIT(7) /* Hard Reset. */
518
519	#define BUSLOGIC_REGISTER_STATUS 0 /*< Readonly /
520	/** Fields for the status register. */
521	# define BL_STAT_CMDINV RT_BIT(0) /* Command Invalid. */
522	# define BL_STAT_DIRRDY RT_BIT(2) /* Data In Register Ready. */
523	# define BL_STAT_CPRBSY RT_BIT(3) /* Command/Parameter Out Register Busy. */
524	# define BL_STAT_HARDY RT_BIT(4) /* Host Adapter Ready. */
525	# define BL_STAT_INREQ RT_BIT(5) /* Initialization Required. */
526	# define BL_STAT_DFAIL RT_BIT(6) /* Diagnostic Failure. */
527	# define BL_STAT_DACT RT_BIT(7) /* Diagnistic Active. */
528
529	#define BUSLOGIC_REGISTER_COMMAND 1 /*< Writeonly /
530	#define BUSLOGIC_REGISTER_DATAIN 1 /*< Readonly /
531	#define BUSLOGIC_REGISTER_INTERRUPT 2 /*< Readonly /
532	/** Fields for the interrupt register. */
533	# define BL_INTR_IMBL RT_BIT(0) /* Incoming Mailbox Loaded. */
534	# define BL_INTR_OMBR RT_BIT(1) /* Outgoing Mailbox Available. */
535	# define BL_INTR_CMDC RT_BIT(2) /* Command Complete. */
536	# define BL_INTR_RSTS RT_BIT(3) /* SCSI Bus Reset State. */
537	# define BL_INTR_INTV RT_BIT(7) /* Interrupt Valid. */
538
539	#define BUSLOGIC_REGISTER_GEOMETRY 3 /* Readonly */
540	# define BL_GEOM_XLATEN RT_BIT(7) /* Extended geometry translation enabled. */
541
542	/** Structure for the INQUIRE_PCI_HOST_ADAPTER_INFORMATION reply. */
543	typedef struct ReplyInquirePCIHostAdapterInformation
544	{
545	uint8_t IsaIOPort;
546	uint8_t IRQ;
547	unsigned char LowByteTerminated : 1;
548	unsigned char HighByteTerminated : 1;
549	unsigned char uReserved : 2; /* Reserved. */
550	unsigned char JP1 : 1; /* Whatever that means. */
551	unsigned char JP2 : 1; /* Whatever that means. */
552	unsigned char JP3 : 1; /* Whatever that means. */
553	/** Whether the provided info is valid. */
554	unsigned char InformationIsValid: 1;
555	uint8_t uReserved2; /* Reserved. */
556	} ReplyInquirePCIHostAdapterInformation, *PReplyInquirePCIHostAdapterInformation;
557	AssertCompileSize(ReplyInquirePCIHostAdapterInformation, 4);
558
559	/** Structure for the INQUIRE_CONFIGURATION reply. */
560	typedef struct ReplyInquireConfiguration
561	{
562	unsigned char uReserved1 : 5;
563	bool fDmaChannel5 : 1;
564	bool fDmaChannel6 : 1;
565	bool fDmaChannel7 : 1;
566	bool fIrqChannel9 : 1;
567	bool fIrqChannel10 : 1;
568	bool fIrqChannel11 : 1;
569	bool fIrqChannel12 : 1;
570	unsigned char uReserved2 : 1;
571	bool fIrqChannel14 : 1;
572	bool fIrqChannel15 : 1;
573	unsigned char uReserved3 : 1;
574	unsigned char uHostAdapterId : 4;
575	unsigned char uReserved4 : 4;
576	} ReplyInquireConfiguration, *PReplyInquireConfiguration;
577	AssertCompileSize(ReplyInquireConfiguration, 3);
578
579	/** Structure for the INQUIRE_SETUP_INFORMATION reply. */
580	typedef struct ReplyInquireSetupInformationSynchronousValue
581	{
582	unsigned char uOffset : 4;
583	unsigned char uTransferPeriod : 3;
584	bool fSynchronous : 1;
585	}ReplyInquireSetupInformationSynchronousValue, *PReplyInquireSetupInformationSynchronousValue;
586	AssertCompileSize(ReplyInquireSetupInformationSynchronousValue, 1);
587
588	typedef struct ReplyInquireSetupInformation
589	{
590	bool fSynchronousInitiationEnabled : 1;
591	bool fParityCheckingEnabled : 1;
592	unsigned char uReserved1 : 6;
593	uint8_t uBusTransferRate;
594	uint8_t uPreemptTimeOnBus;
595	uint8_t uTimeOffBus;
596	uint8_t cMailbox;
597	Addr24 MailboxAddress;
598	ReplyInquireSetupInformationSynchronousValue SynchronousValuesId0To7[8];
599	uint8_t uDisconnectPermittedId0To7;
600	uint8_t uSignature;
601	uint8_t uCharacterD;
602	uint8_t uHostBusType;
603	uint8_t uWideTransferPermittedId0To7;
604	uint8_t uWideTransfersActiveId0To7;
605	ReplyInquireSetupInformationSynchronousValue SynchronousValuesId8To15[8];
606	uint8_t uDisconnectPermittedId8To15;
607	uint8_t uReserved2;
608	uint8_t uWideTransferPermittedId8To15;
609	uint8_t uWideTransfersActiveId8To15;
610	} ReplyInquireSetupInformation, *PReplyInquireSetupInformation;
611	AssertCompileSize(ReplyInquireSetupInformation, 34);
612
613	/** Structure for the INQUIRE_EXTENDED_SETUP_INFORMATION. */
614	#pragma pack(1)
615	typedef struct ReplyInquireExtendedSetupInformation
616	{
617	uint8_t uBusType;
618	uint8_t uBiosAddress;
619	uint16_t u16ScatterGatherLimit;
620	uint8_t cMailbox;
621	uint32_t uMailboxAddressBase;
622	unsigned char uReserved1 : 2;
623	bool fFastEISA : 1;
624	unsigned char uReserved2 : 3;
625	bool fLevelSensitiveInterrupt : 1;
626	unsigned char uReserved3 : 1;
627	unsigned char aFirmwareRevision[3];
628	bool fHostWideSCSI : 1;
629	bool fHostDifferentialSCSI : 1;
630	bool fHostSupportsSCAM : 1;
631	bool fHostUltraSCSI : 1;
632	bool fHostSmartTermination : 1;
633	unsigned char uReserved4 : 3;
634	} ReplyInquireExtendedSetupInformation, *PReplyInquireExtendedSetupInformation;
635	AssertCompileSize(ReplyInquireExtendedSetupInformation, 14);
636	#pragma pack()
637
638	/** Structure for the INITIALIZE EXTENDED MAILBOX request. */
639	#pragma pack(1)
640	typedef struct RequestInitializeExtendedMailbox
641	{
642	/** Number of mailboxes in guest memory. */
643	uint8_t cMailbox;
644	/** Physical address of the first mailbox. */
645	uint32_t uMailboxBaseAddress;
646	} RequestInitializeExtendedMailbox, *PRequestInitializeExtendedMailbox;
647	AssertCompileSize(RequestInitializeExtendedMailbox, 5);
648	#pragma pack()
649
650	/** Structure for the INITIALIZE MAILBOX request. */
651	typedef struct
652	{
653	/** Number of mailboxes to set up. */
654	uint8_t cMailbox;
655	/** Physical address of the first mailbox. */
656	Addr24 aMailboxBaseAddr;
657	} RequestInitMbx, *PRequestInitMbx;
658	AssertCompileSize(RequestInitMbx, 4);
659
660	/**
661	* Structure of a mailbox in guest memory.
662	* The incoming and outgoing mailbox have the same size
663	* but the incoming one has some more fields defined which
664	* are marked as reserved in the outgoing one.
665	* The last field is also different from the type.
666	* For outgoing mailboxes it is the action and
667	* for incoming ones the completion status code for the task.
668	* We use one structure for both types.
669	*/
670	typedef struct Mailbox32
671	{
672	/** Physical address of the CCB structure in the guest memory. */
673	uint32_t u32PhysAddrCCB;
674	/** Type specific data. */
675	union
676	{
677	/** For outgoing mailboxes. */
678	struct
679	{
680	/** Reserved */
681	uint8_t uReserved[3];
682	/** Action code. */
683	uint8_t uActionCode;
684	} out;
685	/** For incoming mailboxes. */
686	struct
687	{
688	/** The host adapter status after finishing the request. */
689	uint8_t uHostAdapterStatus;
690	/** The status of the device which executed the request after executing it. */
691	uint8_t uTargetDeviceStatus;
692	/** Reserved. */
693	uint8_t uReserved;
694	/** The completion status code of the request. */
695	uint8_t uCompletionCode;
696	} in;
697	} u;
698	} Mailbox32, *PMailbox32;
699	AssertCompileSize(Mailbox32, 8);
700
701	/** Old style 24-bit mailbox entry. */
702	typedef struct Mailbox24
703	{
704	/** Mailbox command (incoming) or state (outgoing). */
705	uint8_t uCmdState;
706	/** Physical address of the CCB structure in the guest memory. */
707	Addr24 aPhysAddrCCB;
708	} Mailbox24, *PMailbox24;
709	AssertCompileSize(Mailbox24, 4);
710
711	/**
712	* Action codes for outgoing mailboxes.
713	*/
714	enum BUSLOGIC_MAILBOX_OUTGOING_ACTION
715	{
716	BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE = 0x00,
717	BUSLOGIC_MAILBOX_OUTGOING_ACTION_START_COMMAND = 0x01,
718	BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND = 0x02
719	};
720
721	/**
722	* Completion codes for incoming mailboxes.
723	*/
724	enum BUSLOGIC_MAILBOX_INCOMING_COMPLETION
725	{
726	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_FREE = 0x00,
727	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITHOUT_ERROR = 0x01,
728	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED = 0x02,
729	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND = 0x03,
730	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR = 0x04,
731	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_INVALID_CCB = 0x05
732	};
733
734	/**
735	* Host adapter status for incoming mailboxes.
736	*/
737	enum BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS
738	{
739	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED = 0x00,
740	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CMD_COMPLETED = 0x0a,
741	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CMD_COMPLETED_WITH_FLAG = 0x0b,
742	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_DATA_UNDERUN = 0x0c,
743	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT = 0x11,
744	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_DATA_OVERRUN = 0x12,
745	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_UNEXPECTED_BUS_FREE = 0x13,
746	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_BUS_PHASE_REQUESTED = 0x14,
747	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_OUTGOING_MAILBOX_ACTION_CODE = 0x15,
748	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_OPERATION_CODE = 0x16,
749	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CCB_HAS_INVALID_LUN = 0x17,
750	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER = 0x1a,
751	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_AUTO_REQUEST_SENSE_FAILED = 0x1b,
752	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TAGGED_QUEUING_MESSAGE_REJECTED = 0x1c,
753	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_UNSUPPORTED_MESSAGE_RECEIVED = 0x1d,
754	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_HARDWARE_FAILED = 0x20,
755	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TARGET_FAILED_RESPONSE_TO_ATN = 0x21,
756	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_ASSERTED_RST = 0x22,
757	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_OTHER_DEVICE_ASSERTED_RST = 0x23,
758	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TARGET_DEVICE_RECONNECTED_IMPROPERLY = 0x24,
759	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_ASSERTED_BUS_DEVICE_RESET = 0x25,
760	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED = 0x26,
761	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_SOFTWARE_ERROR = 0x27,
762	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_HARDWARE_TIMEOUT_ERROR = 0x30,
763	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_PARITY_ERROR_DETECTED = 0x34
764	};
765
766	/**
767	* Device status codes for incoming mailboxes.
768	*/
769	enum BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS
770	{
771	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD = 0x00,
772	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_CHECK_CONDITION = 0x02,
773	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_DEVICE_BUSY = 0x08
774	};
775
776	/**
777	* Opcode types for CCB.
778	*/
779	enum BUSLOGIC_CCB_OPCODE
780	{
781	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB = 0x00,
782	BUSLOGIC_CCB_OPCODE_TARGET_CCB = 0x01,
783	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER = 0x02,
784	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH = 0x03,
785	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER = 0x04,
786	BUSLOGIC_CCB_OPCODE_BUS_DEVICE_RESET = 0x81
787	};
788
789	/**
790	* Data transfer direction.
791	*/
792	enum BUSLOGIC_CCB_DIRECTION
793	{
794	BUSLOGIC_CCB_DIRECTION_UNKNOWN = 0x00,
795	BUSLOGIC_CCB_DIRECTION_IN = 0x01,
796	BUSLOGIC_CCB_DIRECTION_OUT = 0x02,
797	BUSLOGIC_CCB_DIRECTION_NO_DATA = 0x03
798	};
799
800	/**
801	* The command control block for a SCSI request.
802	*/
803	typedef struct CCB32
804	{
805	/** Opcode. */
806	uint8_t uOpcode;
807	/** Reserved */
808	unsigned char uReserved1 : 3;
809	/** Data direction for the request. */
810	unsigned char uDataDirection : 2;
811	/** Whether the request is tag queued. */
812	bool fTagQueued : 1;
813	/** Queue tag mode. */
814	unsigned char uQueueTag : 2;
815	/** Length of the SCSI CDB. */
816	uint8_t cbCDB;
817	/** Sense data length. */
818	uint8_t cbSenseData;
819	/** Data length. */
820	uint32_t cbData;
821	/** Data pointer.
822	* This points to the data region or a scatter gather list based on the opcode.
823	*/
824	uint32_t u32PhysAddrData;
825	/** Reserved. */
826	uint8_t uReserved2[2];
827	/** Host adapter status. */
828	uint8_t uHostAdapterStatus;
829	/** Device adapter status. */
830	uint8_t uDeviceStatus;
831	/** The device the request is sent to. */
832	uint8_t uTargetId;
833	/*The LUN in the device. /
834	unsigned char uLogicalUnit : 5;
835	/** Legacy tag. */
836	bool fLegacyTagEnable : 1;
837	/** Legacy queue tag. */
838	unsigned char uLegacyQueueTag : 2;
839	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
840	uint8_t abCDB[12];
841	/** Reserved. */
842	uint8_t uReserved3[6];
843	/** Sense data pointer. */
844	uint32_t u32PhysAddrSenseData;
845	} CCB32, *PCCB32;
846	AssertCompileSize(CCB32, 40);
847
848
849	/**
850	* The 24-bit command control block.
851	*/
852	typedef struct CCB24
853	{
854	/** Opcode. */
855	uint8_t uOpcode;
856	/** The LUN in the device. */
857	unsigned char uLogicalUnit : 3;
858	/** Data direction for the request. */
859	unsigned char uDataDirection : 2;
860	/** The target device ID. */
861	unsigned char uTargetId : 3;
862	/** Length of the SCSI CDB. */
863	uint8_t cbCDB;
864	/** Sense data length. */
865	uint8_t cbSenseData;
866	/** Data length. */
867	Len24 acbData;
868	/** Data pointer.
869	* This points to the data region or a scatter gather list based on the opc
870	*/
871	Addr24 aPhysAddrData;
872	/** Pointer to next CCB for linked commands. */
873	Addr24 aPhysAddrLink;
874	/** Command linking identifier. */
875	uint8_t uLinkId;
876	/** Host adapter status. */
877	uint8_t uHostAdapterStatus;
878	/** Device adapter status. */
879	uint8_t uDeviceStatus;
880	/** Two unused bytes. */
881	uint8_t aReserved[2];
882	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
883	uint8_t abCDB[12];
884	} CCB24, *PCCB24;
885	AssertCompileSize(CCB24, 30);
886
887	/**
888	* The common 24-bit/32-bit command control block. The 32-bit CCB is laid out
889	* such that many fields are in the same location as in the older 24-bit CCB.
890	*/
891	typedef struct CCBC
892	{
893	/** Opcode. */
894	uint8_t uOpcode;
895	/** The LUN in the device. */
896	unsigned char uPad1 : 3;
897	/** Data direction for the request. */
898	unsigned char uDataDirection : 2;
899	/** The target device ID. */
900	unsigned char uPad2 : 3;
901	/** Length of the SCSI CDB. */
902	uint8_t cbCDB;
903	/** Sense data length. */
904	uint8_t cbSenseData;
905	uint8_t aPad1[10];
906	/** Host adapter status. */
907	uint8_t uHostAdapterStatus;
908	/** Device adapter status. */
909	uint8_t uDeviceStatus;
910	uint8_t aPad2[2];
911	/** The SCSI CDB (up to 12 bytes). */
912	uint8_t abCDB[12];
913	} CCBC, *PCCBC;
914	AssertCompileSize(CCBC, 30);
915
916	/* Make sure that the 24-bit/32-bit/common CCB offsets match. */
917	AssertCompileMemberOffset(CCBC, cbCDB, 2);
918	AssertCompileMemberOffset(CCB24, cbCDB, 2);
919	AssertCompileMemberOffset(CCB32, cbCDB, 2);
920	AssertCompileMemberOffset(CCBC, uHostAdapterStatus, 14);
921	AssertCompileMemberOffset(CCB24, uHostAdapterStatus, 14);
922	AssertCompileMemberOffset(CCB32, uHostAdapterStatus, 14);
923	AssertCompileMemberOffset(CCBC, abCDB, 18);
924	AssertCompileMemberOffset(CCB24, abCDB, 18);
925	AssertCompileMemberOffset(CCB32, abCDB, 18);
926
927	/** A union of all CCB types (24-bit/32-bit/common). */
928	typedef union CCBU
929	{
930	CCB32 n; /*< New 32-bit CCB. /
931	CCB24 o; /*< Old 24-bit CCB. /
932	CCBC c; /*< Common CCB subset. /
933	} CCBU, *PCCBU;
934
935	/** 32-bit scatter-gather list entry. */
936	typedef struct SGE32
937	{
938	uint32_t cbSegment;
939	uint32_t u32PhysAddrSegmentBase;
940	} SGE32, *PSGE32;
941	AssertCompileSize(SGE32, 8);
942
943	/** 24-bit scatter-gather list entry. */
944	typedef struct SGE24
945	{
946	Len24 acbSegment;
947	Addr24 aPhysAddrSegmentBase;
948	} SGE24, *PSGE24;
949	AssertCompileSize(SGE24, 6);
950
951	/**
952	* The structure for the "Execute SCSI Command" command.
953	*/
954	typedef struct ESCMD
955	{
956	/** Data length. */
957	uint32_t cbData;
958	/** Data pointer. */
959	uint32_t u32PhysAddrData;
960	/** The device the request is sent to. */
961	uint8_t uTargetId;
962	/** The LUN in the device. */
963	uint8_t uLogicalUnit;
964	/** Reserved */
965	unsigned char uReserved1 : 3;
966	/** Data direction for the request. */
967	unsigned char uDataDirection : 2;
968	/** Reserved */
969	unsigned char uReserved2 : 3;
970	/** Length of the SCSI CDB. */
971	uint8_t cbCDB;
972	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
973	uint8_t abCDB[12];
974	} ESCMD, *PESCMD;
975	AssertCompileSize(ESCMD, 24);
976
977	/**
978	* Task state for a CCB request.
979	*/
980	typedef struct BUSLOGICREQ
981	{
982	/** PDM extended media interface I/O request hande. */
983	PDMMEDIAEXIOREQ hIoReq;
984	/** Device this task is assigned to. */
985	PBUSLOGICDEVICE pTargetDevice;
986	/** The command control block from the guest. */
987	CCBU CCBGuest;
988	/** Guest physical address of th CCB. */
989	RTGCPHYS GCPhysAddrCCB;
990	/** Pointer to the R3 sense buffer. */
991	uint8_t *pbSenseBuffer;
992	/** Flag whether this is a request from the BIOS. */
993	bool fBIOS;
994	/** 24-bit request flag (default is 32-bit). */
995	bool fIs24Bit;
996	/** SCSI status code. */
997	uint8_t u8ScsiSts;
998	} BUSLOGICREQ;
999
1000	/**
1001	* S/G buffer copy arguments.
1002	*/
1003	typedef struct BUSLOGICCOPYARGS
1004	{
1005	/** Pointer to the shared BusLogic instance data. */
1006	PBUSLOGIC pThis;
1007	/** Pointer to the device instance data. */
1008	PPDMDEVINS pDevIns;
1009	/** Pointer to the SCSI command buffer. */
1010	PESCMD pCmd;
1011	/** Number of bytes copied already. */
1012	size_t cbCopied;
1013	} BUSLOGICCOPYARGS;
1014	/** Pointer to BUSLOGICCOPYARGS. */
1015	typedef BUSLOGICCOPYARGS *PBUSLOGICCOPYARGS;
1016
1017	#ifdef IN_RING3
1018	/**
1019	* Memory buffer callback.
1020	*
1021	* @returns nothing.
1022	* @param pDevIns The device instance.
1023	* @param pThis Pointer to the shared BusLogic instance data.
1024	* @param GCPhys The guest physical address of the memory buffer.
1025	* @param pSgBuf The pointer to the host R3 S/G buffer.
1026	* @param cbCopy How many bytes to copy between the two buffers.
1027	* @param pcbSkip Initially contains the amount of bytes to skip
1028	* starting from the guest physical address before
1029	* accessing the S/G buffer and start copying data.
1030	* On return this contains the remaining amount if
1031	* cbCopy < *pcbSkip or 0 otherwise.
1032	*/
1033	typedef DECLCALLBACKTYPE(void, FNBUSLOGICR3MEMCOPYCALLBACK,(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1034	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip));
1035	/** Pointer to a memory copy buffer callback. */
1036	typedef FNBUSLOGICR3MEMCOPYCALLBACK *PFNBUSLOGICR3MEMCOPYCALLBACK;
1037	#endif
1038
1039	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
1040
1041
1042	/*********************************************************************************************************************************
1043	* Internal Functions *
1044	*********************************************************************************************************************************/
1045	#ifdef IN_RING3
1046	static int buslogicR3RegisterISARange(PPDMDEVINS pDevIns, PBUSLOGIC pThis, uint8_t uBaseCode);
1047	#endif
1048
1049
1050	/**
1051	* Assert IRQ line of the BusLogic adapter. Rather than using
1052	* the more modern method of the guest explicitly only clearing
1053	* the interrupt causes it handled, BusLogic never reports all
1054	* interrupts at once. Instead, new interrupts are postponed if
1055	* an interrupt of a different type is still pending.
1056	*
1057	* @returns nothing.
1058	* @param pDevIns The device instance.
1059	* @param pThis Pointer to the shared BusLogic instance data.
1060	* @param fSuppressIrq Flag to suppress IRQ generation regardless of fIRQEnabled
1061	* @param uIrqType Type of interrupt being generated.
1062	*/
1063	static void buslogicSetInterrupt(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fSuppressIrq, uint8_t uIrqType)
1064	{
1065	LogFlowFunc(("pThis=%#p, setting %#02x (current %#02x, pending %#02x)\n",
1066	pThis, uIrqType, pThis->regInterrupt, pThis->uPendingIntr));
1067
1068	/* A CMDC interrupt overrides other pending interrupts. The documentation may claim
1069	* otherwise, but a real BT-958 replaces a pending IMBL with a CMDC; the IMBL simply
1070	* vanishes. However, if there's a CMDC already active, another CMDC is latched and
1071	* reported once the first CMDC is cleared.
1072	*/
1073	if (uIrqType & BL_INTR_CMDC)
1074	{
1075	Assert(uIrqType == BL_INTR_CMDC);
1076	if ((pThis->regInterrupt & BL_INTR_INTV) && !(pThis->regInterrupt & BL_INTR_CMDC))
1077	Log(("CMDC overriding pending interrupt! (was %02x)\n", pThis->regInterrupt));
1078	if (!(pThis->regInterrupt & BL_INTR_CMDC))
1079	pThis->regInterrupt \|= uIrqType \| BL_INTR_INTV; /* Report now. */
1080	else
1081	pThis->uPendingIntr \|= uIrqType; /* Report later. */
1082	}
1083	else if (uIrqType & (BL_INTR_IMBL \| BL_INTR_OMBR))
1084	{
1085	/* If the CMDC interrupt is pending, store IMBL/OMBR for later. Note that IMBL
1086	* and OMBR can be reported together even if an interrupt of the other type is
1087	* already pending.
1088	*/
1089	if (!(pThis->regInterrupt & BL_INTR_CMDC))
1090	pThis->regInterrupt \|= uIrqType \| BL_INTR_INTV; /* Report now. */
1091	else
1092	pThis->uPendingIntr \|= uIrqType; /* Report later. */
1093	}
1094	else /* We do not expect to see BL_INTR_RSTS at this point. */
1095	AssertMsgFailed(("Invalid interrupt state (unknown interrupt cause)!\n"));
1096	AssertMsg(pThis->regInterrupt, ("Invalid interrupt state (interrupt not set)!\n"));
1097	AssertMsg(pThis->regInterrupt != BL_INTR_INTV, ("Invalid interrupt state (set but no cause)!\n"));
1098
1099	if (pThis->fIRQEnabled && !fSuppressIrq)
1100	{
1101	if (!pThis->uIsaIrq)
1102	PDMDevHlpPCISetIrq(pDevIns, 0, 1);
1103	else
1104	PDMDevHlpISASetIrq(pDevIns, pThis->uIsaIrq, 1);
1105	}
1106	}
1107
1108	/**
1109	* Deasserts the interrupt line of the BusLogic adapter.
1110	*
1111	* @returns nothing.
1112	* @param pDevIns The device instance.
1113	* @param pThis Pointer to the shared BusLogic instance data.
1114	*/
1115	static void buslogicClearInterrupt(PPDMDEVINS pDevIns, PBUSLOGIC pThis)
1116	{
1117	LogFlowFunc(("pThis=%#p, clearing %#02x (pending %#02x)\n",
1118	pThis, pThis->regInterrupt, pThis->uPendingIntr));
1119	pThis->regInterrupt = 0;
1120	pThis->regStatus &= ~BL_STAT_CMDINV;
1121	if (!pThis->uIsaIrq)
1122	PDMDevHlpPCISetIrq(pDevIns, 0, 0);
1123	else
1124	PDMDevHlpISASetIrq(pDevIns, pThis->uIsaIrq, 0);
1125	/* If there's another pending interrupt, report it now. */
1126	if (pThis->uPendingIntr)
1127	{
1128	buslogicSetInterrupt(pDevIns, pThis, false, pThis->uPendingIntr);
1129	pThis->uPendingIntr = 0;
1130	}
1131	}
1132
1133	#if defined(IN_RING3)
1134
1135	/**
1136	* Advances the mailbox pointer to the next slot.
1137	*
1138	* @returns nothing.
1139	* @param pThis Pointer to the shared BusLogic instance data.
1140	*/
1141	DECLINLINE(void) buslogicR3OutgoingMailboxAdvance(PBUSLOGIC pThis)
1142	{
1143	pThis->uMailboxOutgoingPositionCurrent = (pThis->uMailboxOutgoingPositionCurrent + 1) % pThis->cMailbox;
1144	}
1145
1146	/**
1147	* Initialize local RAM of host adapter with default values.
1148	*
1149	* @returns nothing.
1150	* @param pThis Pointer to the shared BusLogic instance data.
1151	*/
1152	static void buslogicR3InitializeLocalRam(PBUSLOGIC pThis)
1153	{
1154	/*
1155	* These values are mostly from what I think is right
1156	* looking at the dmesg output from a Linux guest inside
1157	* a VMware server VM.
1158	*
1159	* So they don't have to be right :)
1160	*/
1161	memset(pThis->LocalRam.u8View, 0, sizeof(HostAdapterLocalRam));
1162	pThis->LocalRam.structured.autoSCSIData.fLevelSensitiveInterrupt = true;
1163	pThis->LocalRam.structured.autoSCSIData.fParityCheckingEnabled = true;
1164	pThis->LocalRam.structured.autoSCSIData.fExtendedTranslation = true; /* Same as in geometry register. */
1165	pThis->LocalRam.structured.autoSCSIData.u16DeviceEnabledMask = UINT16_MAX; /* All enabled. Maybe mask out non present devices? */
1166	pThis->LocalRam.structured.autoSCSIData.u16WidePermittedMask = UINT16_MAX;
1167	pThis->LocalRam.structured.autoSCSIData.u16FastPermittedMask = UINT16_MAX;
1168	pThis->LocalRam.structured.autoSCSIData.u16SynchronousPermittedMask = UINT16_MAX;
1169	pThis->LocalRam.structured.autoSCSIData.u16DisconnectPermittedMask = UINT16_MAX;
1170	pThis->LocalRam.structured.autoSCSIData.fStrictRoundRobinMode = pThis->fStrictRoundRobinMode;
1171	pThis->LocalRam.structured.autoSCSIData.u16UltraPermittedMask = UINT16_MAX;
1172	pThis->LocalRam.structured.autoSCSIData.uSCSIId = 7;
1173	pThis->LocalRam.structured.autoSCSIData.uHostAdapterIoPortAddress = pThis->uDefaultISABaseCode == ISA_BASE_DISABLED ? 2 : pThis->uDefaultISABaseCode;
1174	/** @todo calculate checksum? */
1175	}
1176
1177	/**
1178	* Do a hardware reset of the buslogic adapter.
1179	*
1180	* @returns VBox status code.
1181	* @param pDevIns The device instance.
1182	* @param pThis Pointer to the shared BusLogic instance data.
1183	* @param fResetIO Flag determining whether ISA I/O should be reset.
1184	*/
1185	static int buslogicR3HwReset(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fResetIO)
1186	{
1187	LogFlowFunc(("pThis=%#p\n", pThis));
1188
1189	/* Reset registers to default values. */
1190	pThis->regStatus = BL_STAT_HARDY \| BL_STAT_INREQ;
1191	pThis->regGeometry = BL_GEOM_XLATEN;
1192	pThis->uOperationCode = 0xff; /* No command executing. */
1193	pThis->uPrevCmd = 0xff;
1194	pThis->iParameter = 0;
1195	pThis->cbCommandParametersLeft = 0;
1196	pThis->fIRQEnabled = true;
1197	pThis->fStrictRoundRobinMode = false;
1198	pThis->fExtendedLunCCBFormat = false;
1199	pThis->uMailboxOutgoingPositionCurrent = 0;
1200	pThis->uMailboxIncomingPositionCurrent = 0;
1201	pThis->uAhaSigIdx = 0;
1202	pThis->cMailbox = 0;
1203	pThis->GCPhysAddrMailboxIncomingBase = 0;
1204	pThis->GCPhysAddrMailboxOutgoingBase = 0;
1205
1206	/* Clear any active/pending interrupts. */
1207	pThis->uPendingIntr = 0;
1208	buslogicClearInterrupt(pDevIns, pThis);
1209
1210	/* Guest-initiated HBA reset does not affect ISA port I/O. */
1211	if (fResetIO)
1212	buslogicR3RegisterISARange(pDevIns, pThis, pThis->uDefaultISABaseCode);
1213	buslogicR3InitializeLocalRam(pThis);
1214
1215	return VINF_SUCCESS;
1216	}
1217
1218	#endif /* IN_RING3 */
1219
1220	/**
1221	* Resets the command state machine for the next command and notifies the guest.
1222	* Note that suppressing CMDC also suppresses the interrupt, but not vice versa.
1223	*
1224	* @returns nothing.
1225	* @param pDevIns The device instance.
1226	* @param pThis Pointer to the shared BusLogic instance data.
1227	* @param fSuppressIrq Flag to suppress IRQ generation regardless of current state
1228	* @param fSuppressCMDC Flag to suppress command completion status as well
1229	*/
1230	static void buslogicCommandComplete(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fSuppressIrq, bool fSuppressCMDC)
1231	{
1232	LogFlowFunc(("pThis=%#p\n", pThis));
1233	Assert(pThis->uOperationCode != BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND);
1234
1235	pThis->fUseLocalRam = false;
1236	pThis->regStatus \|= BL_STAT_HARDY;
1237	pThis->regStatus &= ~BL_STAT_DIRRDY;
1238	pThis->iReply = 0;
1239
1240	/* Some commands do not set CMDC when successful. */
1241	if (!fSuppressCMDC)
1242	{
1243	/* Notify that the command is complete. */
1244	buslogicSetInterrupt(pDevIns, pThis, fSuppressIrq, BL_INTR_CMDC);
1245	}
1246
1247	pThis->uPrevCmd = pThis->uOperationCode;
1248	pThis->uOperationCode = 0xff;
1249	pThis->iParameter = 0;
1250	}
1251
1252	/**
1253	* Memory write helper to handle PCI/ISA differences - metadata writes.
1254	*
1255	* @returns nothing.
1256	* @param pDevIns The device instance.
1257	* @param pThis Pointer to the shared BusLogic instance data.
1258	* @param GCPhys Guest physical memory address
1259	* @param pvBuf Host side buffer address
1260	* @param cbWrite Number of bytes to write
1261	*/
1262	static void blPhysWriteMeta(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
1263	{
1264	if (!pThis->uIsaIrq)
1265	PDMDevHlpPCIPhysWriteMeta(pDevIns, GCPhys, pvBuf, cbWrite);
1266	else
1267	PDMDevHlpPhysWriteMeta(pDevIns, GCPhys, pvBuf, cbWrite);
1268	}
1269
1270	/**
1271	* Memory read helper to handle PCI/ISA differences - metadata reads.
1272	*
1273	* @returns nothing.
1274	* @param pDevIns The device instance.
1275	* @param pThis Pointer to the shared BusLogic instance data.
1276	* @param GCPhys Guest physical memory address.
1277	* @param pvBuf Host side buffer address.
1278	* @param cbRead Number of bytes to read.
1279	*/
1280	static void blPhysReadMeta(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
1281	{
1282	if (!pThis->uIsaIrq)
1283	PDMDevHlpPCIPhysReadMeta(pDevIns, GCPhys, pvBuf, cbRead);
1284	else
1285	PDMDevHlpPhysReadMeta(pDevIns, GCPhys, pvBuf, cbRead);
1286	}
1287
1288	#if defined(IN_RING3)
1289
1290	/**
1291	* Memory write helper to handle PCI/ISA differences - userdata writes.
1292	*
1293	* @returns nothing.
1294	* @param pDevIns The device instance.
1295	* @param pThis Pointer to the shared BusLogic instance data.
1296	* @param GCPhys Guest physical memory address
1297	* @param pvBuf Host side buffer address
1298	* @param cbWrite Number of bytes to write
1299	*/
1300	static void blPhysWriteUser(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
1301	{
1302	if (!pThis->uIsaIrq)
1303	PDMDevHlpPCIPhysWriteUser(pDevIns, GCPhys, pvBuf, cbWrite);
1304	else
1305	PDMDevHlpPhysWriteUser(pDevIns, GCPhys, pvBuf, cbWrite);
1306	}
1307
1308	/**
1309	* Memory read helper to handle PCI/ISA differences - userdata reads.
1310	*
1311	* @returns nothing.
1312	* @param pDevIns The device instance.
1313	* @param pThis Pointer to the shared BusLogic instance data.
1314	* @param GCPhys Guest physical memory address.
1315	* @param pvBuf Host side buffer address.
1316	* @param cbRead Number of bytes to read.
1317	*/
1318	static void blPhysReadUser(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
1319	{
1320	if (!pThis->uIsaIrq)
1321	PDMDevHlpPCIPhysReadUser(pDevIns, GCPhys, pvBuf, cbRead);
1322	else
1323	PDMDevHlpPhysReadUser(pDevIns, GCPhys, pvBuf, cbRead);
1324	}
1325
1326	/**
1327	* Initiates a hard reset which was issued from the guest.
1328	*
1329	* @returns nothing
1330	* @param pDevIns The device instance.
1331	* @param pThis Pointer to the shared BusLogic instance data.
1332	* @param fHardReset Flag initiating a hard (vs. soft) reset.
1333	*/
1334	static void buslogicR3InitiateReset(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fHardReset)
1335	{
1336	LogFlowFunc(("pThis=%#p fHardReset=%d\n", pThis, fHardReset));
1337
1338	buslogicR3HwReset(pDevIns, pThis, false);
1339
1340	if (fHardReset)
1341	{
1342	/* Set the diagnostic active bit in the status register and clear the ready state. */
1343	pThis->regStatus \|= BL_STAT_DACT;
1344	pThis->regStatus &= ~BL_STAT_HARDY;
1345
1346	/* Remember when the guest initiated a reset (after we're done resetting). */
1347	pThis->u64ResetTime = PDMDevHlpTMTimeVirtGetNano(pDevIns);
1348	}
1349	}
1350
1351
1352	/**
1353	* Send a mailbox with set status codes to the guest.
1354	*
1355	* @returns nothing.
1356	* @param pDevIns The device instance.
1357	* @param pThis Pointer to the shared BusLogic instance data.
1358	* @param GCPhysAddrCCB The physical guest address of the CCB the mailbox is for.
1359	* @param pCCBGuest The command control block.
1360	* @param uHostAdapterStatus The host adapter status code to set.
1361	* @param uDeviceStatus The target device status to set.
1362	* @param uMailboxCompletionCode Completion status code to set in the mailbox.
1363	*/
1364	static void buslogicR3SendIncomingMailbox(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhysAddrCCB,
1365	PCCBU pCCBGuest, uint8_t uHostAdapterStatus,
1366	uint8_t uDeviceStatus, uint8_t uMailboxCompletionCode)
1367	{
1368	Mailbox32 MbxIn;
1369
1370	MbxIn.u32PhysAddrCCB = (uint32_t)GCPhysAddrCCB;
1371	MbxIn.u.in.uHostAdapterStatus = uHostAdapterStatus;
1372	MbxIn.u.in.uTargetDeviceStatus = uDeviceStatus;
1373	MbxIn.u.in.uReserved = 0;
1374	MbxIn.u.in.uCompletionCode = uMailboxCompletionCode;
1375
1376	int rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSectIntr, VINF_SUCCESS);
1377	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pThis->CritSectIntr, rc);
1378
1379	RTGCPHYS GCPhysAddrMailboxIncoming = pThis->GCPhysAddrMailboxIncomingBase
1380	+ ( pThis->uMailboxIncomingPositionCurrent
1381	* (pThis->fMbxIs24Bit ? sizeof(Mailbox24) : sizeof(Mailbox32)) );
1382
1383	if (uMailboxCompletionCode != BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND)
1384	{
1385	LogFlowFunc(("Completing CCB %RGp hstat=%u, dstat=%u, outgoing mailbox at %RGp\n", GCPhysAddrCCB,
1386	uHostAdapterStatus, uDeviceStatus, GCPhysAddrMailboxIncoming));
1387
1388	/* Update CCB. */
1389	pCCBGuest->c.uHostAdapterStatus = uHostAdapterStatus;
1390	pCCBGuest->c.uDeviceStatus = uDeviceStatus;
1391	/* Rewrite CCB up to the CDB; perhaps more than necessary. */
1392	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrCCB, pCCBGuest, RT_UOFFSETOF(CCBC, abCDB));
1393	}
1394
1395	# ifdef RT_STRICT
1396	uint8_t uCode;
1397	unsigned uCodeOffs = pThis->fMbxIs24Bit ? RT_OFFSETOF(Mailbox24, uCmdState) : RT_OFFSETOF(Mailbox32, u.out.uActionCode);
1398	blPhysReadMeta(pDevIns, pThis, GCPhysAddrMailboxIncoming + uCodeOffs, &uCode, sizeof(uCode));
1399	Assert(uCode == BUSLOGIC_MAILBOX_INCOMING_COMPLETION_FREE);
1400	# endif
1401
1402	/* Update mailbox. */
1403	if (pThis->fMbxIs24Bit)
1404	{
1405	Mailbox24 Mbx24;
1406
1407	Mbx24.uCmdState = MbxIn.u.in.uCompletionCode;
1408	U32_TO_ADDR(Mbx24.aPhysAddrCCB, MbxIn.u32PhysAddrCCB);
1409	Log(("24-bit mailbox: completion code=%u, CCB at %RGp\n", Mbx24.uCmdState, (RTGCPHYS)ADDR_TO_U32(Mbx24.aPhysAddrCCB)));
1410	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrMailboxIncoming, &Mbx24, sizeof(Mailbox24));
1411	}
1412	else
1413	{
1414	Log(("32-bit mailbox: completion code=%u, CCB at %RGp\n", MbxIn.u.in.uCompletionCode, GCPhysAddrCCB));
1415	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrMailboxIncoming, &MbxIn, sizeof(Mailbox32));
1416	}
1417
1418	/* Advance to next mailbox position. */
1419	pThis->uMailboxIncomingPositionCurrent++;
1420	if (pThis->uMailboxIncomingPositionCurrent >= pThis->cMailbox)
1421	pThis->uMailboxIncomingPositionCurrent = 0;
1422
1423	# ifdef LOG_ENABLED
1424	ASMAtomicIncU32(&pThis->cInMailboxesReadyIfLogEnabled);
1425	# endif
1426
1427	buslogicSetInterrupt(pDevIns, pThis, false, BL_INTR_IMBL);
1428
1429	PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSectIntr);
1430	}
1431
1432	# ifdef LOG_ENABLED
1433
1434	/**
1435	* Dumps the content of a mailbox for debugging purposes.
1436	*
1437	* @return nothing
1438	* @param pMailbox The mailbox to dump.
1439	* @param fOutgoing true if dumping the outgoing state.
1440	* false if dumping the incoming state.
1441	*/
1442	static void buslogicR3DumpMailboxInfo(PMailbox32 pMailbox, bool fOutgoing)
1443	{
1444	Log(("%s: Dump for %s mailbox:\n", __FUNCTION__, fOutgoing ? "outgoing" : "incoming"));
1445	Log(("%s: u32PhysAddrCCB=%#x\n", __FUNCTION__, pMailbox->u32PhysAddrCCB));
1446	if (fOutgoing)
1447	{
1448	Log(("%s: uActionCode=%u\n", __FUNCTION__, pMailbox->u.out.uActionCode));
1449	}
1450	else
1451	{
1452	Log(("%s: uHostAdapterStatus=%u\n", __FUNCTION__, pMailbox->u.in.uHostAdapterStatus));
1453	Log(("%s: uTargetDeviceStatus=%u\n", __FUNCTION__, pMailbox->u.in.uTargetDeviceStatus));
1454	Log(("%s: uCompletionCode=%u\n", __FUNCTION__, pMailbox->u.in.uCompletionCode));
1455	}
1456	}
1457
1458	/**
1459	* Dumps the content of a command control block for debugging purposes.
1460	*
1461	* @returns nothing.
1462	* @param pCCB Pointer to the command control block to dump.
1463	* @param fIs24BitCCB Flag to determine CCB format.
1464	*/
1465	static void buslogicR3DumpCCBInfo(PCCBU pCCB, bool fIs24BitCCB)
1466	{
1467	Log(("%s: Dump for %s Command Control Block:\n", __FUNCTION__, fIs24BitCCB ? "24-bit" : "32-bit"));
1468	Log(("%s: uOpCode=%#x\n", __FUNCTION__, pCCB->c.uOpcode));
1469	Log(("%s: uDataDirection=%u\n", __FUNCTION__, pCCB->c.uDataDirection));
1470	Log(("%s: cbCDB=%u\n", __FUNCTION__, pCCB->c.cbCDB));
1471	Log(("%s: cbSenseData=%u\n", __FUNCTION__, pCCB->c.cbSenseData));
1472	Log(("%s: uHostAdapterStatus=%u\n", __FUNCTION__, pCCB->c.uHostAdapterStatus));
1473	Log(("%s: uDeviceStatus=%u\n", __FUNCTION__, pCCB->c.uDeviceStatus));
1474	if (fIs24BitCCB)
1475	{
1476	Log(("%s: cbData=%u\n", __FUNCTION__, LEN_TO_U32(pCCB->o.acbData)));
1477	Log(("%s: PhysAddrData=%#x\n", __FUNCTION__, ADDR_TO_U32(pCCB->o.aPhysAddrData)));
1478	Log(("%s: uTargetId=%u\n", __FUNCTION__, pCCB->o.uTargetId));
1479	Log(("%s: uLogicalUnit=%u\n", __FUNCTION__, pCCB->o.uLogicalUnit));
1480	}
1481	else
1482	{
1483	Log(("%s: cbData=%u\n", __FUNCTION__, pCCB->n.cbData));
1484	Log(("%s: PhysAddrData=%#x\n", __FUNCTION__, pCCB->n.u32PhysAddrData));
1485	Log(("%s: uTargetId=%u\n", __FUNCTION__, pCCB->n.uTargetId));
1486	Log(("%s: uLogicalUnit=%u\n", __FUNCTION__, pCCB->n.uLogicalUnit));
1487	Log(("%s: fTagQueued=%d\n", __FUNCTION__, pCCB->n.fTagQueued));
1488	Log(("%s: uQueueTag=%u\n", __FUNCTION__, pCCB->n.uQueueTag));
1489	Log(("%s: fLegacyTagEnable=%u\n", __FUNCTION__, pCCB->n.fLegacyTagEnable));
1490	Log(("%s: uLegacyQueueTag=%u\n", __FUNCTION__, pCCB->n.uLegacyQueueTag));
1491	Log(("%s: PhysAddrSenseData=%#x\n", __FUNCTION__, pCCB->n.u32PhysAddrSenseData));
1492	}
1493	Log(("%s: uCDB[0]=%#x\n", __FUNCTION__, pCCB->c.abCDB[0]));
1494	for (int i = 1; i < pCCB->c.cbCDB; i++)
1495	Log(("%s: uCDB[%d]=%u\n", __FUNCTION__, i, pCCB->c.abCDB[i]));
1496	}
1497
1498	# endif /* LOG_ENABLED */
1499
1500	/**
1501	* Allocate data buffer.
1502	*
1503	* @param pDevIns PDM device instance.
1504	* @param fIs24Bit Flag whether the 24bit SG format is used.
1505	* @param GCSGList Guest physical address of S/G list.
1506	* @param cEntries Number of list entries to read.
1507	* @param pSGEList Pointer to 32-bit S/G list storage.
1508	*/
1509	static void buslogicR3ReadSGEntries(PPDMDEVINS pDevIns, bool fIs24Bit, RTGCPHYS GCSGList,
1510	uint32_t cEntries, SGE32 *pSGEList)
1511	{
1512	/* Read the S/G entries. Convert 24-bit entries to 32-bit format. */
1513	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
1514	if (fIs24Bit)
1515	{
1516	SGE24 aSGE24[32];
1517	Assert(cEntries <= RT_ELEMENTS(aSGE24));
1518
1519	Log2(("Converting %u 24-bit S/G entries to 32-bit\n", cEntries));
1520	blPhysReadMeta(pDevIns, pThis, GCSGList, &aSGE24, cEntries * sizeof(SGE24));
1521	for (uint32_t i = 0; i < cEntries; ++i)
1522	{
1523	pSGEList[i].cbSegment = LEN_TO_U32(aSGE24[i].acbSegment);
1524	pSGEList[i].u32PhysAddrSegmentBase = ADDR_TO_U32(aSGE24[i].aPhysAddrSegmentBase);
1525	}
1526	}
1527	else
1528	blPhysReadMeta(pDevIns, pThis, GCSGList, pSGEList, cEntries * sizeof(SGE32));
1529	}
1530
1531	/**
1532	* Determines the size of th guest data buffer.
1533	*
1534	* @returns VBox status code.
1535	* @param pDevIns PDM device instance.
1536	* @param pCCBGuest The CCB of the guest.
1537	* @param fIs24Bit Flag whether the 24bit SG format is used.
1538	* @param pcbBuf Where to store the size of the guest data buffer on success.
1539	*/
1540	static int buslogicR3QueryDataBufferSize(PPDMDEVINS pDevIns, PCCBU pCCBGuest, bool fIs24Bit, size_t *pcbBuf)
1541	{
1542	int rc = VINF_SUCCESS;
1543	uint32_t cbDataCCB;
1544	uint32_t u32PhysAddrCCB;
1545	size_t cbBuf = 0;
1546
1547	/* Extract the data length and physical address from the CCB. */
1548	if (fIs24Bit)
1549	{
1550	u32PhysAddrCCB = ADDR_TO_U32(pCCBGuest->o.aPhysAddrData);
1551	cbDataCCB = LEN_TO_U32(pCCBGuest->o.acbData);
1552	}
1553	else
1554	{
1555	u32PhysAddrCCB = pCCBGuest->n.u32PhysAddrData;
1556	cbDataCCB = pCCBGuest->n.cbData;
1557	}
1558
1559	#if 1
1560	/* Hack for NT 10/91: A CCB describes a 2K buffer, but TEST UNIT READY is executed. This command
1561	* returns no data, hence the buffer must be left alone!
1562	*/
1563	if (pCCBGuest->c.abCDB[0] == 0)
1564	cbDataCCB = 0;
1565	#endif
1566
1567	if ( (pCCBGuest->c.uDataDirection != BUSLOGIC_CCB_DIRECTION_NO_DATA)
1568	&& cbDataCCB)
1569	{
1570	/*
1571	* The BusLogic adapter can handle two different data buffer formats.
1572	* The first one is that the data pointer entry in the CCB points to
1573	* the buffer directly. In second mode the data pointer points to a
1574	* scatter gather list which describes the buffer.
1575	*/
1576	if ( (pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER)
1577	\|\| (pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
1578	{
1579	uint32_t cScatterGatherGCRead;
1580	uint32_t iScatterGatherEntry;
1581	SGE32 aScatterGatherReadGC[32]; /* A buffer for scatter gather list entries read from guest memory. */
1582	uint32_t cScatterGatherGCLeft = cbDataCCB / (fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1583	RTGCPHYS GCPhysAddrScatterGatherCurrent = u32PhysAddrCCB;
1584
1585	/* Count number of bytes to transfer. */
1586	do
1587	{
1588	cScatterGatherGCRead = (cScatterGatherGCLeft < RT_ELEMENTS(aScatterGatherReadGC))
1589	? cScatterGatherGCLeft
1590	: RT_ELEMENTS(aScatterGatherReadGC);
1591	cScatterGatherGCLeft -= cScatterGatherGCRead;
1592
1593	buslogicR3ReadSGEntries(pDevIns, fIs24Bit, GCPhysAddrScatterGatherCurrent, cScatterGatherGCRead, aScatterGatherReadGC);
1594
1595	for (iScatterGatherEntry = 0; iScatterGatherEntry < cScatterGatherGCRead; iScatterGatherEntry++)
1596	cbBuf += aScatterGatherReadGC[iScatterGatherEntry].cbSegment;
1597
1598	/* Set address to the next entries to read. */
1599	GCPhysAddrScatterGatherCurrent += cScatterGatherGCRead * (fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1600	} while (cScatterGatherGCLeft > 0);
1601
1602	Log(("%s: cbBuf=%d\n", __FUNCTION__, cbBuf));
1603	}
1604	else if ( pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB
1605	\|\| pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
1606	cbBuf = cbDataCCB;
1607	}
1608
1609	if (RT_SUCCESS(rc))
1610	*pcbBuf = cbBuf;
1611
1612	return rc;
1613	}
1614
1615	/**
1616	* Copy from guest to host memory worker.
1617	*
1618	* @copydoc FNBUSLOGICR3MEMCOPYCALLBACK
1619	*/
1620	static DECLCALLBACK(void) buslogicR3CopyBufferFromGuestWorker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1621	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip)
1622	{
1623	size_t cbSkipped = RT_MIN(cbCopy, *pcbSkip);
1624	cbCopy -= cbSkipped;
1625	GCPhys += cbSkipped;
1626	*pcbSkip -= cbSkipped;
1627
1628	while (cbCopy)
1629	{
1630	size_t cbSeg = cbCopy;
1631	void *pvSeg = RTSgBufGetNextSegment(pSgBuf, &cbSeg);
1632
1633	AssertPtr(pvSeg);
1634	blPhysReadUser(pDevIns, pThis, GCPhys, pvSeg, cbSeg);
1635	GCPhys += cbSeg;
1636	cbCopy -= cbSeg;
1637	}
1638	}
1639
1640	/**
1641	* Copy from host to guest memory worker.
1642	*
1643	* @copydoc FNBUSLOGICR3MEMCOPYCALLBACK
1644	*/
1645	static DECLCALLBACK(void) buslogicR3CopyBufferToGuestWorker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1646	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip)
1647	{
1648	size_t cbSkipped = RT_MIN(cbCopy, *pcbSkip);
1649	cbCopy -= cbSkipped;
1650	GCPhys += cbSkipped;
1651	*pcbSkip -= cbSkipped;
1652
1653	while (cbCopy)
1654	{
1655	size_t cbSeg = cbCopy;
1656	void *pvSeg = RTSgBufGetNextSegment(pSgBuf, &cbSeg);
1657
1658	AssertPtr(pvSeg);
1659	blPhysWriteUser(pDevIns, pThis, GCPhys, pvSeg, cbSeg);
1660	GCPhys += cbSeg;
1661	cbCopy -= cbSeg;
1662	}
1663	}
1664
1665	/**
1666	* Walks the guest S/G buffer calling the given copy worker for every buffer.
1667	*
1668	* @returns The amout of bytes actually copied.
1669	* @param pDevIns The device instance.
1670	* @param pThis Pointer to the Buslogic device state.
1671	* @param pReq Pointer to the request state.
1672	* @param pfnCopyWorker The copy method to apply for each guest buffer.
1673	* @param pSgBuf The host S/G buffer.
1674	* @param cbSkip How many bytes to skip in advance before starting to copy.
1675	* @param cbCopy How many bytes to copy.
1676	*/
1677	static size_t buslogicR3SgBufWalker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1678	PFNBUSLOGICR3MEMCOPYCALLBACK pfnCopyWorker,
1679	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1680	{
1681	uint32_t cbDataCCB;
1682	uint32_t u32PhysAddrCCB;
1683	size_t cbCopied = 0;
1684
1685	/*
1686	* Add the amount to skip to the host buffer size to avoid a
1687	* few conditionals later on.
1688	*/
1689	cbCopy += cbSkip;
1690
1691	/* Extract the data length and physical address from the CCB. */
1692	if (pReq->fIs24Bit)
1693	{
1694	u32PhysAddrCCB = ADDR_TO_U32(pReq->CCBGuest.o.aPhysAddrData);
1695	cbDataCCB = LEN_TO_U32(pReq->CCBGuest.o.acbData);
1696	}
1697	else
1698	{
1699	u32PhysAddrCCB = pReq->CCBGuest.n.u32PhysAddrData;
1700	cbDataCCB = pReq->CCBGuest.n.cbData;
1701	}
1702
1703	#if 1
1704	/* Hack for NT 10/91: A CCB describes a 2K buffer, but TEST UNIT READY is executed. This command
1705	* returns no data, hence the buffer must be left alone!
1706	*/
1707	if (pReq->CCBGuest.c.abCDB[0] == 0)
1708	cbDataCCB = 0;
1709	#endif
1710
1711	LogFlowFunc(("pReq=%#p cbDataCCB=%u direction=%u cbCopy=%zu\n", pReq, cbDataCCB,
1712	pReq->CCBGuest.c.uDataDirection, cbCopy));
1713
1714	if ( (cbDataCCB > 0)
1715	&& ( pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_IN
1716	\|\| pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_OUT
1717	\|\| pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_UNKNOWN))
1718	{
1719	if ( (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER)
1720	\|\| (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
1721	{
1722	uint32_t cScatterGatherGCRead;
1723	uint32_t iScatterGatherEntry;
1724	SGE32 aScatterGatherReadGC[32]; /* Number of scatter gather list entries read from guest memory. */
1725	uint32_t cScatterGatherGCLeft = cbDataCCB / (pReq->fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1726	RTGCPHYS GCPhysAddrScatterGatherCurrent = u32PhysAddrCCB;
1727
1728	do
1729	{
1730	cScatterGatherGCRead = (cScatterGatherGCLeft < RT_ELEMENTS(aScatterGatherReadGC))
1731	? cScatterGatherGCLeft
1732	: RT_ELEMENTS(aScatterGatherReadGC);
1733	cScatterGatherGCLeft -= cScatterGatherGCRead;
1734
1735	buslogicR3ReadSGEntries(pDevIns, pReq->fIs24Bit, GCPhysAddrScatterGatherCurrent,
1736	cScatterGatherGCRead, aScatterGatherReadGC);
1737
1738	for (iScatterGatherEntry = 0; iScatterGatherEntry < cScatterGatherGCRead && cbCopy > 0; iScatterGatherEntry++)
1739	{
1740	RTGCPHYS GCPhysAddrDataBase;
1741	size_t cbCopyThis;
1742
1743	Log(("%s: iScatterGatherEntry=%u\n", __FUNCTION__, iScatterGatherEntry));
1744
1745	GCPhysAddrDataBase = (RTGCPHYS)aScatterGatherReadGC[iScatterGatherEntry].u32PhysAddrSegmentBase;
1746	cbCopyThis = RT_MIN(cbCopy, aScatterGatherReadGC[iScatterGatherEntry].cbSegment);
1747
1748	Log(("%s: GCPhysAddrDataBase=%RGp cbCopyThis=%zu\n", __FUNCTION__, GCPhysAddrDataBase, cbCopyThis));
1749
1750	pfnCopyWorker(pDevIns, pThis, GCPhysAddrDataBase, pSgBuf, cbCopyThis, &cbSkip);
1751	cbCopied += cbCopyThis;
1752	cbCopy -= cbCopyThis;
1753	}
1754
1755	/* Set address to the next entries to read. */
1756	GCPhysAddrScatterGatherCurrent += cScatterGatherGCRead * (pReq->fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1757	} while ( cScatterGatherGCLeft > 0
1758	&& cbCopy > 0);
1759
1760	}
1761	else if ( pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB
1762	\|\| pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
1763	{
1764	/* The buffer is not scattered. */
1765	RTGCPHYS GCPhysAddrDataBase = u32PhysAddrCCB;
1766
1767	AssertMsg(GCPhysAddrDataBase != 0, ("Physical address is 0\n"));
1768
1769	Log(("Non-scattered buffer:\n"));
1770	Log(("u32PhysAddrData=%#x\n", u32PhysAddrCCB));
1771	Log(("cbData=%u\n", cbDataCCB));
1772	Log(("GCPhysAddrDataBase=0x%RGp\n", GCPhysAddrDataBase));
1773
1774	/* Copy the data into the guest memory. */
1775	pfnCopyWorker(pDevIns, pThis, GCPhysAddrDataBase, pSgBuf, RT_MIN(cbDataCCB, cbCopy), &cbSkip);
1776	cbCopied += RT_MIN(cbDataCCB, cbCopy);
1777	}
1778	}
1779
1780	return cbCopied - RT_MIN(cbSkip, cbCopied);
1781	}
1782
1783	/**
1784	* Copies a data buffer into the S/G buffer set up by the guest.
1785	*
1786	* @returns Amount of bytes copied to the guest.
1787	* @param pDevIns The device instance.
1788	* @param pThis Pointer to the shared BusLogic instance data.
1789	* @param pReq Request structure.
1790	* @param pSgBuf The S/G buffer to copy from.
1791	* @param cbSkip How many bytes to skip in advance before starting to copy.
1792	* @param cbCopy How many bytes to copy.
1793	*/
1794	static size_t buslogicR3CopySgBufToGuest(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1795	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1796	{
1797	return buslogicR3SgBufWalker(pDevIns, pThis, pReq, buslogicR3CopyBufferToGuestWorker, pSgBuf, cbSkip, cbCopy);
1798	}
1799
1800	/**
1801	* Copies the guest S/G buffer into a host data buffer.
1802	*
1803	* @returns Amount of bytes copied from the guest.
1804	* @param pDevIns The device instance.
1805	* @param pThis Pointer to the shared BusLogic instance data.
1806	* @param pReq Request structure.
1807	* @param pSgBuf The S/G buffer to copy into.
1808	* @param cbSkip How many bytes to skip in advance before starting to copy.
1809	* @param cbCopy How many bytes to copy.
1810	*/
1811	static size_t buslogicR3CopySgBufFromGuest(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1812	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1813	{
1814	return buslogicR3SgBufWalker(pDevIns, pThis, pReq, buslogicR3CopyBufferFromGuestWorker, pSgBuf, cbSkip, cbCopy);
1815	}
1816
1817	/** Convert sense buffer length taking into account shortcut values. */
1818	static uint32_t buslogicR3ConvertSenseBufferLength(uint32_t cbSense)
1819	{
1820	/* Convert special sense buffer length values. */
1821	if (cbSense == 0)
1822	cbSense = 14; /* 0 means standard 14-byte buffer. */
1823	else if (cbSense == 1)
1824	cbSense = 0; /* 1 means no sense data. */
1825	else if (cbSense < 8)
1826	AssertMsgFailed(("Reserved cbSense value of %d used!\n", cbSense));
1827
1828	return cbSense;
1829	}
1830
1831	/**
1832	* Free the sense buffer.
1833	*
1834	* @returns nothing.
1835	* @param pReq Pointer to the request state.
1836	* @param fCopy If sense data should be copied to guest memory.
1837	*/
1838	static void buslogicR3SenseBufferFree(PBUSLOGICREQ pReq, bool fCopy)
1839	{
1840	uint32_t cbSenseBuffer;
1841
1842	cbSenseBuffer = buslogicR3ConvertSenseBufferLength(pReq->CCBGuest.c.cbSenseData);
1843
1844	/* Copy the sense buffer into guest memory if requested. */
1845	if (fCopy && cbSenseBuffer)
1846	{
1847	PPDMDEVINS pDevIns = pReq->pTargetDevice->pDevIns;
1848	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
1849	RTGCPHYS GCPhysAddrSenseBuffer;
1850
1851	/* With 32-bit CCBs, the (optional) sense buffer physical address is provided separately.
1852	* On the other hand, with 24-bit CCBs, the sense buffer is simply located at the end of
1853	* the CCB, right after the variable-length CDB.
1854	*/
1855	if (pReq->fIs24Bit)
1856	{
1857	GCPhysAddrSenseBuffer = pReq->GCPhysAddrCCB;
1858	GCPhysAddrSenseBuffer += pReq->CCBGuest.c.cbCDB + RT_OFFSETOF(CCB24, abCDB);
1859	}
1860	else
1861	GCPhysAddrSenseBuffer = pReq->CCBGuest.n.u32PhysAddrSenseData;
1862
1863	Log3(("%s: sense buffer: %.*Rhxs\n", __FUNCTION__, cbSenseBuffer, pReq->pbSenseBuffer));
1864	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrSenseBuffer, pReq->pbSenseBuffer, cbSenseBuffer);
1865	}
1866
1867	RTMemFree(pReq->pbSenseBuffer);
1868	pReq->pbSenseBuffer = NULL;
1869	}
1870
1871	/**
1872	* Alloc the sense buffer.
1873	*
1874	* @returns VBox status code.
1875	* @param pReq Pointer to the task state.
1876	*/
1877	static int buslogicR3SenseBufferAlloc(PBUSLOGICREQ pReq)
1878	{
1879	pReq->pbSenseBuffer = NULL;
1880
1881	uint32_t cbSenseBuffer = buslogicR3ConvertSenseBufferLength(pReq->CCBGuest.c.cbSenseData);
1882	if (cbSenseBuffer)
1883	{
1884	pReq->pbSenseBuffer = (uint8_t *)RTMemAllocZ(cbSenseBuffer);
1885	if (!pReq->pbSenseBuffer)
1886	return VERR_NO_MEMORY;
1887	}
1888
1889	return VINF_SUCCESS;
1890	}
1891
1892	#endif /* IN_RING3 */
1893
1894	/**
1895	* Parses the command buffer and executes it.
1896	*
1897	* @returns VBox status code.
1898	* @param pDevIns The PDM device instance.
1899	* @param pThis Pointer to the shared BusLogic instance data.
1900	*/
1901	static int buslogicProcessCommand(PPDMDEVINS pDevIns, PBUSLOGIC pThis)
1902	{
1903	int rc = VINF_SUCCESS;
1904	bool fSuppressIrq = false;
1905	bool fSuppressCMDC = false;
1906	bool fCmdComplete = true;
1907
1908	LogFlowFunc(("pThis=%#p\n", pThis));
1909	AssertMsg(pThis->uOperationCode != 0xff, ("There is no command to execute\n"));
1910
1911	switch (pThis->uOperationCode)
1912	{
1913	case BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT:
1914	/* Valid command, no reply. */
1915	pThis->cbReplyParametersLeft = 0;
1916	break;
1917	case BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION:
1918	{
1919	PReplyInquirePCIHostAdapterInformation pReply = (PReplyInquirePCIHostAdapterInformation)pThis->aReplyBuffer;
1920	memset(pReply, 0, sizeof(ReplyInquirePCIHostAdapterInformation));
1921
1922	/* Modeled after a real BT-958(D) */
1923	pReply->HighByteTerminated = 1;
1924	pReply->LowByteTerminated = 1;
1925	pReply->JP1 = 1; /* Closed; "Factory configured - do not alter" */
1926	pReply->InformationIsValid = 1;
1927	pReply->IsaIOPort = pThis->uISABaseCode < 6 ? pThis->uISABaseCode : 0xff;
1928	pReply->IRQ = PCIDevGetInterruptLine(pDevIns->apPciDevs[0]);
1929	pThis->cbReplyParametersLeft = sizeof(ReplyInquirePCIHostAdapterInformation);
1930	break;
1931	}
1932	case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
1933	{
1934	/* no-op */
1935	pThis->cbReplyParametersLeft = 0;
1936	break;
1937	}
1938	case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
1939	{
1940
1941	/* Modify the ISA-compatible I/O port base. Note that this technically
1942	* violates the PCI spec, as this address is not reported through PCI.
1943	* However, it is required for compatibility with old drivers.
1944	*/
1945	#ifdef IN_RING3 /* We can do this from ring-0 now, but we'd like to see the LogRel, so we keep going back to ring-3 anyway. */
1946	uint8_t baseCode = pThis->aCommandBuffer[0];
1947
1948	Log(("ISA I/O for PCI (code %x)\n", baseCode));
1949	pThis->cbReplyParametersLeft = 0;
1950	if (baseCode < 8) {
1951	buslogicR3RegisterISARange(pDevIns, pThis, baseCode);
1952	fSuppressIrq = true;
1953	fSuppressCMDC = true;
1954	}
1955	else
1956	{
1957	Log(("ISA base %#x not valid for this adapter\n", baseCode));
1958	pThis->regStatus \|= BL_STAT_CMDINV;
1959	}
1960	break;
1961	#else
1962	AssertMsgFailed(("Must never get here!\n"));
1963	break;
1964	#endif
1965	}
1966	case BUSLOGICCOMMAND_INQUIRE_BOARD_ID:
1967	{
1968	/* The special option byte is important: If it is '0' or 'B', Windows NT drivers
1969	* for Adaptec AHA-154x may claim the adapter. The BusLogic drivers will claim
1970	* the adapter only when the byte is not '0' or 'B'.
1971	*/
1972	if (pThis->uDevType == DEV_AHA_1540B)
1973	{
1974	pThis->aReplyBuffer[0] = 'A'; /* Firmware option bytes */
1975	pThis->aReplyBuffer[1] = '0'; /* Special option byte */
1976	}
1977	else
1978	{
1979	pThis->aReplyBuffer[0] = 'A'; /* Firmware option bytes */
1980	pThis->aReplyBuffer[1] = 'A'; /* Special option byte */
1981	}
1982
1983	/* We report version 5.07B. This reply will provide the first two digits. */
1984	pThis->aReplyBuffer[2] = '5'; /* Major version 5 */
1985	pThis->aReplyBuffer[3] = '0'; /* Minor version 0 */
1986	pThis->cbReplyParametersLeft = 4; /* Reply is 4 bytes long */
1987	break;
1988	}
1989	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER:
1990	{
1991	if (pThis->uDevType == DEV_AHA_1540B)
1992	{
1993	/* Newer ASPI4DOS.SYS versions expect this command to fail. */
1994	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
1995	pThis->cbReplyParametersLeft = 0;
1996	pThis->regStatus \|= BL_STAT_CMDINV;
1997	break;
1998	}
1999
2000	pThis->aReplyBuffer[0] = '7';
2001	pThis->cbReplyParametersLeft = 1;
2002	break;
2003	}
2004	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER:
2005	{
2006	pThis->aReplyBuffer[0] = 'B';
2007	pThis->cbReplyParametersLeft = 1;
2008	break;
2009	}
2010	case BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS:
2011	/* The parameter list length is determined by the first byte of the command buffer. */
2012	if (pThis->iParameter == 1)
2013	{
2014	/* First pass - set the number of following parameter bytes. */
2015	pThis->cbCommandParametersLeft = RT_MIN(pThis->aCommandBuffer[0], sizeof(pThis->aCommandBuffer) - 1);
2016	Log(("Set HA options: %u bytes follow\n", pThis->cbCommandParametersLeft));
2017	}
2018	else
2019	{
2020	/* Second pass - process received data. */
2021	Log(("Set HA options: received %u bytes\n", pThis->aCommandBuffer[0]));
2022	/* We ignore the data - it only concerns the SCSI hardware protocol. */
2023	}
2024	pThis->cbReplyParametersLeft = 0;
2025	break;
2026
2027	case BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND:
2028	/* The parameter list length is at least 12 bytes; the 12th byte determines
2029	* the number of additional CDB bytes that will follow.
2030	*/
2031	if (pThis->iParameter == 12)
2032	{
2033	/* First pass - set the number of following CDB bytes. */
2034	pThis->cbCommandParametersLeft = RT_MIN(pThis->aCommandBuffer[11], sizeof(pThis->aCommandBuffer) - 12);
2035	Log(("Execute SCSI cmd: %u more bytes follow\n", pThis->cbCommandParametersLeft));
2036	}
2037	else
2038	{
2039	PESCMD pCmd;
2040
2041	/* Second pass - process received data. */
2042	Log(("Execute SCSI cmd: received %u bytes\n", pThis->aCommandBuffer[0]));
2043	pCmd = (PESCMD)pThis->aCommandBuffer;
2044	Log(("Addr %08X, cbData %08X, cbCDB=%u\n", pCmd->u32PhysAddrData, pCmd->cbData, pCmd->cbCDB));
2045
2046	if (!ASMAtomicXchgBool(&pThis->fBiosReqPending, true))
2047	{
2048	/* Wake up the worker thread. */
2049	int rc2 = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
2050	AssertRC(rc2);
2051	}
2052
2053	fCmdComplete = false;
2054	}
2055	break;
2056
2057	case BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER:
2058	{
2059	/* Not supported on AHA-154x. */
2060	if (pThis->uDevType == DEV_AHA_1540B)
2061	{
2062	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2063	pThis->cbReplyParametersLeft = 0;
2064	pThis->regStatus \|= BL_STAT_CMDINV;
2065	break;
2066	}
2067
2068	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2069	if (pThis->aCommandBuffer[0] > sizeof(pThis->aReplyBuffer))
2070	{
2071	Log(("Requested too much adapter model number data (%u)!\n", pThis->aCommandBuffer[0]));
2072	pThis->regStatus \|= BL_STAT_CMDINV;
2073	break;
2074	}
2075	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2076	memset(pThis->aReplyBuffer, 0, sizeof(pThis->aReplyBuffer));
2077	const char aModelName[] = "958D "; /* Trailing \0 is fine, that's the filler anyway. */
2078	int cCharsToTransfer = pThis->cbReplyParametersLeft <= sizeof(aModelName)
2079	? pThis->cbReplyParametersLeft
2080	: sizeof(aModelName);
2081
2082	for (int i = 0; i < cCharsToTransfer; i++)
2083	pThis->aReplyBuffer[i] = aModelName[i];
2084
2085	break;
2086	}
2087	case BUSLOGICCOMMAND_INQUIRE_CONFIGURATION:
2088	{
2089	uint8_t uIrq;
2090
2091	if (pThis->uIsaIrq)
2092	uIrq = pThis->uIsaIrq;
2093	else
2094	uIrq = PCIDevGetInterruptLine(pDevIns->apPciDevs[0]);
2095
2096	pThis->cbReplyParametersLeft = sizeof(ReplyInquireConfiguration);
2097	PReplyInquireConfiguration pReply = (PReplyInquireConfiguration)pThis->aReplyBuffer;
2098	memset(pReply, 0, sizeof(ReplyInquireConfiguration));
2099
2100	pReply->uHostAdapterId = 7; /* The controller has always 7 as ID. */
2101	pReply->fDmaChannel6 = 1; /* DMA channel 6 is a good default. */
2102
2103	/* The PCI IRQ is not necessarily representable in this structure.
2104	* If that is the case, the guest likely won't function correctly,
2105	* therefore we log a warning. Note that for ISA configurations, we
2106	* can only allow IRQs that can be supported; for PCI, the HBA
2107	* has no control over IRQ assignment.
2108	*/
2109	switch (uIrq)
2110	{
2111	case 9: pReply->fIrqChannel9 = 1; break;
2112	case 10: pReply->fIrqChannel10 = 1; break;
2113	case 11: pReply->fIrqChannel11 = 1; break;
2114	case 12: pReply->fIrqChannel12 = 1; break;
2115	case 14: pReply->fIrqChannel14 = 1; break;
2116	case 15: pReply->fIrqChannel15 = 1; break;
2117	default:
2118	LogRel(("Warning: PCI IRQ %d cannot be represented as ISA!\n", uIrq));
2119	break;
2120	}
2121	break;
2122	}
2123	case BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION:
2124	{
2125	/* Some Adaptec AHA-154x drivers (e.g. OS/2) execute this command and expect
2126	* it to fail. If it succeeds, the drivers refuse to load. However, some newer
2127	* Adaptec 154x models supposedly support it too??
2128	*/
2129	if (pThis->uDevType == DEV_AHA_1540B)
2130	{
2131	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2132	pThis->cbReplyParametersLeft = 0;
2133	pThis->regStatus \|= BL_STAT_CMDINV;
2134	break;
2135	}
2136
2137	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2138	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2139	PReplyInquireExtendedSetupInformation pReply = (PReplyInquireExtendedSetupInformation)pThis->aReplyBuffer;
2140	memset(pReply, 0, sizeof(ReplyInquireExtendedSetupInformation));
2141
2142	/** @todo should this reflect the RAM contents (AutoSCSIRam)? */
2143	pReply->uBusType = 'E'; /* EISA style */
2144	pReply->u16ScatterGatherLimit = 8192;
2145	pReply->cMailbox = pThis->cMailbox;
2146	pReply->uMailboxAddressBase = (uint32_t)pThis->GCPhysAddrMailboxOutgoingBase;
2147	pReply->fLevelSensitiveInterrupt = true;
2148	pReply->fHostWideSCSI = true;
2149	pReply->fHostUltraSCSI = true;
2150	memcpy(pReply->aFirmwareRevision, "07B", sizeof(pReply->aFirmwareRevision));
2151
2152	break;
2153	}
2154	case BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION:
2155	{
2156	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2157	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2158	PReplyInquireSetupInformation pReply = (PReplyInquireSetupInformation)pThis->aReplyBuffer;
2159	memset(pReply, 0, sizeof(ReplyInquireSetupInformation));
2160	pReply->fSynchronousInitiationEnabled = true;
2161	pReply->fParityCheckingEnabled = true;
2162	pReply->cMailbox = pThis->cMailbox;
2163	U32_TO_ADDR(pReply->MailboxAddress, pThis->GCPhysAddrMailboxOutgoingBase);
2164	/* The 'D' signature (actually 'SD' for Storage Dimensions, and 'BD' for BusLogic)
2165	* prevents Adaptec's OS/2 drivers from getting too friendly with BusLogic hardware
2166	* and upsetting the HBA state.
2167	*/
2168	if (pThis->uDevType == DEV_AHA_1540B)
2169	{
2170	pReply->uSignature = 0; /* Zeros for Adaptec. */
2171	pReply->uCharacterD = 0;
2172	}
2173	else
2174	{
2175	pReply->uSignature = 'B';
2176	pReply->uCharacterD = 'D'; /* BusLogic model. */
2177	}
2178	pReply->uHostBusType = 'F'; /* PCI bus. */
2179	break;
2180	}
2181	case BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM:
2182	{
2183	/*
2184	* First element in the command buffer contains start offset to read from
2185	* and second one the number of bytes to read.
2186	*/
2187	uint8_t uOffset = pThis->aCommandBuffer[0];
2188	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[1];
2189
2190	pThis->fUseLocalRam = true;
2191	pThis->iReply = uOffset;
2192	break;
2193	}
2194	case BUSLOGICCOMMAND_INITIALIZE_MAILBOX:
2195	{
2196	PRequestInitMbx pRequest = (PRequestInitMbx)pThis->aCommandBuffer;
2197
2198	pThis->cbReplyParametersLeft = 0;
2199	if (!pRequest->cMailbox)
2200	{
2201	Log(("cMailboxes=%u (24-bit mode), fail!\n", pThis->cMailbox));
2202	pThis->regStatus \|= BL_STAT_CMDINV;
2203	break;
2204	}
2205	pThis->fMbxIs24Bit = true;
2206	pThis->cMailbox = pRequest->cMailbox;
2207	pThis->uMailboxOutgoingPositionCurrent = pThis->uMailboxIncomingPositionCurrent = 0;
2208	pThis->GCPhysAddrMailboxOutgoingBase = (RTGCPHYS)ADDR_TO_U32(pRequest->aMailboxBaseAddr);
2209	/* The area for incoming mailboxes is right after the last entry of outgoing mailboxes. */
2210	pThis->GCPhysAddrMailboxIncomingBase = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox24));
2211
2212	Log(("GCPhysAddrMailboxOutgoingBase=%RGp\n", pThis->GCPhysAddrMailboxOutgoingBase));
2213	Log(("GCPhysAddrMailboxIncomingBase=%RGp\n", pThis->GCPhysAddrMailboxIncomingBase));
2214	Log(("cMailboxes=%u (24-bit mode)\n", pThis->cMailbox));
2215	LogRel(("Initialized 24-bit mailbox, %d entries at %08x\n", pRequest->cMailbox, ADDR_TO_U32(pRequest->aMailboxBaseAddr)));
2216
2217	pThis->regStatus &= ~BL_STAT_INREQ;
2218	break;
2219	}
2220	case BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX:
2221	{
2222	if (pThis->uDevType == DEV_AHA_1540B)
2223	{
2224	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2225	pThis->cbReplyParametersLeft = 0;
2226	pThis->regStatus \|= BL_STAT_CMDINV;
2227	break;
2228	}
2229
2230	PRequestInitializeExtendedMailbox pRequest = (PRequestInitializeExtendedMailbox)pThis->aCommandBuffer;
2231
2232	pThis->cbReplyParametersLeft = 0;
2233	if (!pRequest->cMailbox)
2234	{
2235	Log(("cMailboxes=%u (32-bit mode), fail!\n", pThis->cMailbox));
2236	pThis->regStatus \|= BL_STAT_CMDINV;
2237	break;
2238	}
2239	pThis->fMbxIs24Bit = false;
2240	pThis->cMailbox = pRequest->cMailbox;
2241	pThis->uMailboxOutgoingPositionCurrent = pThis->uMailboxIncomingPositionCurrent = 0;
2242	pThis->GCPhysAddrMailboxOutgoingBase = (RTGCPHYS)pRequest->uMailboxBaseAddress;
2243	/* The area for incoming mailboxes is right after the last entry of outgoing mailboxes. */
2244	pThis->GCPhysAddrMailboxIncomingBase = (RTGCPHYS)pRequest->uMailboxBaseAddress + (pThis->cMailbox * sizeof(Mailbox32));
2245
2246	Log(("GCPhysAddrMailboxOutgoingBase=%RGp\n", pThis->GCPhysAddrMailboxOutgoingBase));
2247	Log(("GCPhysAddrMailboxIncomingBase=%RGp\n", pThis->GCPhysAddrMailboxIncomingBase));
2248	Log(("cMailboxes=%u (32-bit mode)\n", pThis->cMailbox));
2249	LogRel(("Initialized 32-bit mailbox, %d entries at %08x\n", pRequest->cMailbox, pRequest->uMailboxBaseAddress));
2250
2251	pThis->regStatus &= ~BL_STAT_INREQ;
2252	break;
2253	}
2254	case BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE:
2255	{
2256	if (pThis->aCommandBuffer[0] == 0)
2257	pThis->fStrictRoundRobinMode = false;
2258	else if (pThis->aCommandBuffer[0] == 1)
2259	pThis->fStrictRoundRobinMode = true;
2260	else
2261	AssertMsgFailed(("Invalid round robin mode %d\n", pThis->aCommandBuffer[0]));
2262
2263	pThis->cbReplyParametersLeft = 0;
2264	break;
2265	}
2266	case BUSLOGICCOMMAND_SET_CCB_FORMAT:
2267	{
2268	if (pThis->aCommandBuffer[0] == 0)
2269	pThis->fExtendedLunCCBFormat = false;
2270	else if (pThis->aCommandBuffer[0] == 1)
2271	pThis->fExtendedLunCCBFormat = true;
2272	else
2273	AssertMsgFailed(("Invalid CCB format %d\n", pThis->aCommandBuffer[0]));
2274
2275	pThis->cbReplyParametersLeft = 0;
2276	break;
2277	}
2278	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7:
2279	/* This is supposed to send TEST UNIT READY to each target/LUN.
2280	* We cheat and skip that, since we already know what's attached
2281	*/
2282	memset(pThis->aReplyBuffer, 0, 8);
2283	for (int i = 0; i < 8; ++i)
2284	{
2285	if (pThis->afDevicePresent[i])
2286	pThis->aReplyBuffer[i] = 1;
2287	}
2288	pThis->aReplyBuffer[7] = 0; /* HA hardcoded at ID 7. */
2289	pThis->cbReplyParametersLeft = 8;
2290	break;
2291	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15:
2292	/* See note about cheating above. */
2293	memset(pThis->aReplyBuffer, 0, 8);
2294	for (int i = 0; i < 8; ++i)
2295	{
2296	if (pThis->afDevicePresent[i + 8])
2297	pThis->aReplyBuffer[i] = 1;
2298	}
2299	pThis->cbReplyParametersLeft = 8;
2300	break;
2301	case BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES:
2302	{
2303	/* Each bit which is set in the 16bit wide variable means a present device. */
2304	uint16_t u16TargetsPresentMask = 0;
2305
2306	for (uint8_t i = 0; i < RT_ELEMENTS(pThis->afDevicePresent); i++)
2307	{
2308	if (pThis->afDevicePresent[i])
2309	u16TargetsPresentMask \|= (1 << i);
2310	}
2311	pThis->aReplyBuffer[0] = (uint8_t)u16TargetsPresentMask;
2312	pThis->aReplyBuffer[1] = (uint8_t)(u16TargetsPresentMask >> 8);
2313	pThis->cbReplyParametersLeft = 2;
2314	break;
2315	}
2316	case BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD:
2317	{
2318	if (pThis->aCommandBuffer[0] > sizeof(pThis->aReplyBuffer))
2319	{
2320	Log(("Requested too much synch period inquiry (%u)!\n", pThis->aCommandBuffer[0]));
2321	pThis->regStatus \|= BL_STAT_CMDINV;
2322	break;
2323	}
2324	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2325	for (uint8_t i = 0; i < pThis->cbReplyParametersLeft; i++)
2326	pThis->aReplyBuffer[i] = 0; /** @todo Figure if we need something other here. It's not needed for the linux driver */
2327
2328	break;
2329	}
2330	case BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT:
2331	{
2332	/* Not supported on AHA-154x HBAs. */
2333	if (pThis->uDevType == DEV_AHA_1540B)
2334	{
2335	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2336	pThis->cbReplyParametersLeft = 0;
2337	pThis->regStatus \|= BL_STAT_CMDINV;
2338	break;
2339	}
2340
2341	pThis->cbReplyParametersLeft = 0;
2342	if (pThis->aCommandBuffer[0] == 0)
2343	pThis->fIRQEnabled = false;
2344	else
2345	pThis->fIRQEnabled = true;
2346	/* No interrupt signaled regardless of enable/disable. NB: CMDC is still signaled! */
2347	fSuppressIrq = true;
2348	break;
2349	}
2350	case BUSLOGICCOMMAND_ECHO_COMMAND_DATA:
2351	{
2352	pThis->aReplyBuffer[0] = pThis->aCommandBuffer[0];
2353	pThis->cbReplyParametersLeft = 1;
2354	break;
2355	}
2356	case BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT:
2357	{
2358	uint8_t uEnable = pThis->aCommandBuffer[0];
2359
2360	pThis->cbReplyParametersLeft = 0;
2361	Log(("Enable OMBR: %u\n", uEnable));
2362	/* Only 0/1 are accepted. */
2363	if (uEnable > 1)
2364	pThis->regStatus \|= BL_STAT_CMDINV;
2365	else
2366	{
2367	pThis->LocalRam.structured.autoSCSIData.uReserved6 = uEnable;
2368	fSuppressIrq = true;
2369	fSuppressCMDC = true;
2370	}
2371	break;
2372	}
2373	case BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS:
2374	{
2375	pThis->cbReplyParametersLeft = 0;
2376	pThis->LocalRam.structured.autoSCSIData.uBusOnDelay = pThis->aCommandBuffer[0];
2377	Log(("Bus-on time: %d\n", pThis->aCommandBuffer[0]));
2378	break;
2379	}
2380	case BUSLOGICCOMMAND_SET_TIME_OFF_BUS:
2381	{
2382	pThis->cbReplyParametersLeft = 0;
2383	pThis->LocalRam.structured.autoSCSIData.uBusOffDelay = pThis->aCommandBuffer[0];
2384	Log(("Bus-off time: %d\n", pThis->aCommandBuffer[0]));
2385	break;
2386	}
2387	case BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE:
2388	{
2389	pThis->cbReplyParametersLeft = 0;
2390	pThis->LocalRam.structured.autoSCSIData.uDMATransferRate = pThis->aCommandBuffer[0];
2391	Log(("Bus transfer rate: %02X\n", pThis->aCommandBuffer[0]));
2392	break;
2393	}
2394	case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
2395	{
2396	RTGCPHYS GCPhysFifoBuf;
2397	Addr24 addr;
2398
2399	pThis->cbReplyParametersLeft = 0;
2400	addr.hi = pThis->aCommandBuffer[0];
2401	addr.mid = pThis->aCommandBuffer[1];
2402	addr.lo = pThis->aCommandBuffer[2];
2403	GCPhysFifoBuf = (RTGCPHYS)ADDR_TO_U32(addr);
2404	Log(("Write busmaster FIFO at: %04X\n", ADDR_TO_U32(addr)));
2405	blPhysReadMeta(pDevIns, pThis, GCPhysFifoBuf, &pThis->LocalRam.u8View[64], 64);
2406	break;
2407	}
2408	case BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO:
2409	{
2410	RTGCPHYS GCPhysFifoBuf;
2411	Addr24 addr;
2412
2413	pThis->cbReplyParametersLeft = 0;
2414	addr.hi = pThis->aCommandBuffer[0];
2415	addr.mid = pThis->aCommandBuffer[1];
2416	addr.lo = pThis->aCommandBuffer[2];
2417	GCPhysFifoBuf = (RTGCPHYS)ADDR_TO_U32(addr);
2418	Log(("Read busmaster FIFO at: %04X\n", ADDR_TO_U32(addr)));
2419	blPhysWriteMeta(pDevIns, pThis, GCPhysFifoBuf, &pThis->LocalRam.u8View[64], 64);
2420	break;
2421	}
2422	default:
2423	AssertMsgFailed(("Invalid command %#x\n", pThis->uOperationCode));
2424	RT_FALL_THRU();
2425	case BUSLOGICCOMMAND_EXT_BIOS_INFO:
2426	case BUSLOGICCOMMAND_UNLOCK_MAILBOX:
2427	/* Commands valid for Adaptec 154xC which we don't handle since
2428	* we pretend being 154xB compatible. Just mark the command as invalid.
2429	*/
2430	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2431	pThis->cbReplyParametersLeft = 0;
2432	pThis->regStatus \|= BL_STAT_CMDINV;
2433	break;
2434	case BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND: /* Should be handled already. */
2435	AssertMsgFailed(("Invalid mailbox execute state!\n"));
2436	}
2437
2438	Log(("uOperationCode=%#x, cbReplyParametersLeft=%d\n", pThis->uOperationCode, pThis->cbReplyParametersLeft));
2439
2440	/* Fail command if too much parameter data requested. */
2441	if ((pThis->cbCommandParametersLeft + pThis->iParameter) > sizeof(pThis->aCommandBuffer))
2442	{
2443	Log(("Invalid command parameter length (%u)\n", pThis->cbCommandParametersLeft));
2444	pThis->cbReplyParametersLeft = 0;
2445	pThis->cbCommandParametersLeft = 0;
2446	pThis->regStatus \|= BL_STAT_CMDINV;
2447	}
2448
2449	if (fCmdComplete)
2450	{
2451	/* Set the data in ready bit in the status register in case the command has a reply. */
2452	if (pThis->cbReplyParametersLeft)
2453	pThis->regStatus \|= BL_STAT_DIRRDY;
2454	else if (!pThis->cbCommandParametersLeft)
2455	buslogicCommandComplete(pDevIns, pThis, fSuppressIrq, fSuppressCMDC);
2456	}
2457
2458	return rc;
2459	}
2460
2461	/**
2462	* Read a register from the BusLogic adapter.
2463	*
2464	* @returns VBox status code.
2465	* @param pDevIns The device instance.
2466	* @param pThis Pointer to the shared BusLogic instance data.
2467	* @param iRegister The index of the register to read.
2468	* @param pu32 Where to store the register content.
2469	*/
2470	static int buslogicRegisterRead(PPDMDEVINS pDevIns, PBUSLOGIC pThis, unsigned iRegister, uint32_t *pu32)
2471	{
2472	static const char s_szAhaSig[] = "ADAP";
2473	int rc = VINF_SUCCESS;
2474
2475	switch (iRegister)
2476	{
2477	case BUSLOGIC_REGISTER_STATUS:
2478	{
2479	*pu32 = pThis->regStatus;
2480
2481	/* If the diagnostic active bit is set, we are in a guest-initiated
2482	* hard reset. If the guest reads the status register and waits for
2483	* the host adapter ready bit to be set, we terminate the reset right
2484	* away. However, guests may also expect the reset condition to clear
2485	* automatically after a period of time, in which case we can't show
2486	* the DIAG bit at all.
2487	*/
2488	if (pThis->regStatus & BL_STAT_DACT)
2489	{
2490	uint64_t u64AccessTime = PDMDevHlpTMTimeVirtGetNano(pDevIns);
2491
2492	pThis->regStatus &= ~BL_STAT_DACT;
2493	pThis->regStatus \|= BL_STAT_HARDY;
2494
2495	if (u64AccessTime - pThis->u64ResetTime > BUSLOGIC_RESET_DURATION_NS)
2496	{
2497	/* If reset already expired, let the guest see that right away. */
2498	*pu32 = pThis->regStatus;
2499	pThis->u64ResetTime = 0;
2500	}
2501	}
2502	break;
2503	}
2504	case BUSLOGIC_REGISTER_DATAIN:
2505	{
2506	AssertCompileSize(pThis->LocalRam, 256);
2507	AssertCompileSize(pThis->iReply, sizeof(uint8_t));
2508	AssertCompileSize(pThis->cbReplyParametersLeft, sizeof(uint8_t));
2509
2510	if (pThis->fUseLocalRam)
2511	*pu32 = pThis->LocalRam.u8View[pThis->iReply];
2512	else
2513	{
2514	/*
2515	* Real adapters seem to pad the reply with zeroes and allow up to 255 bytes even
2516	* if the real reply is shorter.
2517	*/
2518	if (pThis->iReply >= sizeof(pThis->aReplyBuffer))
2519	*pu32 = 0;
2520	else
2521	*pu32 = pThis->aReplyBuffer[pThis->iReply];
2522	}
2523
2524	/* Careful about underflow - guest can read data register even if
2525	* no data is available.
2526	*/
2527	if (pThis->cbReplyParametersLeft)
2528	{
2529	pThis->iReply++;
2530	pThis->cbReplyParametersLeft--;
2531	if (!pThis->cbReplyParametersLeft)
2532	{
2533	/*
2534	* Reply finished, set command complete bit, unset data-in ready bit and
2535	* interrupt the guest if enabled.
2536	* NB: Some commands do not set the CMDC bit / raise completion interrupt.
2537	*/
2538	if (pThis->uOperationCode == BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM)
2539	buslogicCommandComplete(pDevIns, pThis, true /* fSuppressIrq /, true / fSuppressCMDC */);
2540	else
2541	buslogicCommandComplete(pDevIns, pThis, false, false);
2542	}
2543	}
2544	LogFlowFunc(("data=%02x, iReply=%d, cbReplyParametersLeft=%u\n", *pu32,
2545	pThis->iReply, pThis->cbReplyParametersLeft));
2546	break;
2547	}
2548	case BUSLOGIC_REGISTER_INTERRUPT:
2549	{
2550	*pu32 = pThis->regInterrupt;
2551	break;
2552	}
2553	case BUSLOGIC_REGISTER_GEOMETRY:
2554	{
2555	if (pThis->uDevType == DEV_AHA_1540B)
2556	{
2557	uint8_t off = pThis->uAhaSigIdx & 3;
2558	*pu32 = s_szAhaSig[off];
2559	pThis->uAhaSigIdx = (off + 1) & 3;
2560	}
2561	else
2562	*pu32 = pThis->regGeometry;
2563	break;
2564	}
2565	default:
2566	*pu32 = UINT32_C(0xffffffff);
2567	}
2568
2569	Log2(("%s: pu32=%p:{%.*Rhxs} iRegister=%d rc=%Rrc\n",
2570	__FUNCTION__, pu32, 1, pu32, iRegister, rc));
2571
2572	return rc;
2573	}
2574
2575	/**
2576	* Write a value to a register.
2577	*
2578	* @returns VBox status code.
2579	* @param pDevIns The PDM device instance.
2580	* @param pThis Pointer to the shared BusLogic instance data.
2581	* @param iRegister The index of the register to read.
2582	* @param uVal The value to write.
2583	*/
2584	static int buslogicRegisterWrite(PPDMDEVINS pDevIns, PBUSLOGIC pThis, unsigned iRegister, uint8_t uVal)
2585	{
2586	int rc = VINF_SUCCESS;
2587
2588	switch (iRegister)
2589	{
2590	case BUSLOGIC_REGISTER_CONTROL:
2591	{
2592	if ((uVal & BL_CTRL_RHARD) \|\| (uVal & BL_CTRL_RSOFT))
2593	{
2594	#ifdef IN_RING3
2595	bool fHardReset = !!(uVal & BL_CTRL_RHARD);
2596
2597	LogRel(("BusLogic: %s reset\n", fHardReset ? "hard" : "soft"));
2598	buslogicR3InitiateReset(pDevIns, pThis, fHardReset);
2599	#else
2600	rc = VINF_IOM_R3_IOPORT_WRITE;
2601	#endif
2602	break;
2603	}
2604
2605	rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSectIntr, VINF_IOM_R3_IOPORT_WRITE);
2606	if (rc != VINF_SUCCESS)
2607	return rc;
2608
2609	#ifdef LOG_ENABLED
2610	uint32_t cMailboxesReady = ASMAtomicXchgU32(&pThis->cInMailboxesReadyIfLogEnabled, 0);
2611	Log(("%u incoming mailboxes were ready when this interrupt was cleared\n", cMailboxesReady));
2612	#endif
2613
2614	if (uVal & BL_CTRL_RINT)
2615	buslogicClearInterrupt(pDevIns, pThis);
2616
2617	PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSectIntr);
2618
2619	break;
2620	}
2621	case BUSLOGIC_REGISTER_COMMAND:
2622	{
2623	/* Fast path for mailbox execution command. */
2624	if ((uVal == BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND) && (pThis->uOperationCode == 0xff))
2625	{
2626	/// @todo Should fail if BL_STAT_INREQ is set
2627	/* If there are no mailboxes configured, don't even try to do anything. */
2628	if (pThis->cMailbox)
2629	{
2630	ASMAtomicIncU32(&pThis->cMailboxesReady);
2631	if (!ASMAtomicXchgBool(&pThis->fNotificationSent, true))
2632	{
2633	/* Wake up the worker thread. */
2634	int rc2 = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
2635	AssertRC(rc2);
2636	}
2637	}
2638
2639	return rc;
2640	}
2641
2642	/*
2643	* Check if we are already fetch command parameters from the guest.
2644	* If not we initialize executing a new command.
2645	*/
2646	if (pThis->uOperationCode == 0xff)
2647	{
2648	pThis->uOperationCode = uVal;
2649	pThis->iParameter = 0;
2650
2651	/* Mark host adapter as busy and clear the invalid status bit. */
2652	pThis->regStatus &= ~(BL_STAT_HARDY \| BL_STAT_CMDINV);
2653
2654	/* Get the number of bytes for parameters from the command code. */
2655	switch (pThis->uOperationCode)
2656	{
2657	case BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT:
2658	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER:
2659	case BUSLOGICCOMMAND_INQUIRE_BOARD_ID:
2660	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER:
2661	case BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION:
2662	case BUSLOGICCOMMAND_INQUIRE_CONFIGURATION:
2663	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7:
2664	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15:
2665	case BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES:
2666	pThis->cbCommandParametersLeft = 0;
2667	break;
2668	case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
2669	case BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION:
2670	case BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT:
2671	case BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER:
2672	/* These commands are not on AHA-154x, some Adaptec drivers (ASPI4DOS.SYS) test them. */
2673	if (pThis->uDevType == DEV_AHA_1540B)
2674	{
2675	pThis->cbCommandParametersLeft = 0;
2676	break;
2677	}
2678	RT_FALL_THRU();
2679	case BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION:
2680	case BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE:
2681	case BUSLOGICCOMMAND_SET_CCB_FORMAT:
2682	case BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD:
2683	case BUSLOGICCOMMAND_ECHO_COMMAND_DATA:
2684	case BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT:
2685	case BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS:
2686	case BUSLOGICCOMMAND_SET_TIME_OFF_BUS:
2687	case BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE:
2688	pThis->cbCommandParametersLeft = 1;
2689	break;
2690	case BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM:
2691	pThis->cbCommandParametersLeft = 2;
2692	break;
2693	case BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO:
2694	case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
2695	pThis->cbCommandParametersLeft = 3;
2696	break;
2697	case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
2698	pThis->cbCommandParametersLeft = 4;
2699	break;
2700	case BUSLOGICCOMMAND_INITIALIZE_MAILBOX:
2701	pThis->cbCommandParametersLeft = sizeof(RequestInitMbx);
2702	break;
2703	case BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX:
2704	/* Some Adaptec drivers (ASPI4DOS.SYS) test this command. */
2705	if (pThis->uDevType == DEV_AHA_1540B)
2706	{
2707	pThis->cbCommandParametersLeft = 0;
2708	break;
2709	}
2710	pThis->cbCommandParametersLeft = sizeof(RequestInitializeExtendedMailbox);
2711	break;
2712	case BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS:
2713	/* There must be at least one byte following this command. */
2714	pThis->cbCommandParametersLeft = 1;
2715	break;
2716	case BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND:
2717	/* 12 bytes + variable-length CDB. */
2718	pThis->cbCommandParametersLeft = 12;
2719	break;
2720	case BUSLOGICCOMMAND_EXT_BIOS_INFO:
2721	case BUSLOGICCOMMAND_UNLOCK_MAILBOX:
2722	/* Invalid commands. */
2723	pThis->cbCommandParametersLeft = 0;
2724	break;
2725	case BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND: /* Should not come here anymore. */
2726	default:
2727	AssertMsgFailed(("Invalid operation code %#x\n", uVal));
2728	}
2729	}
2730	else if (pThis->cbCommandParametersLeft)
2731	{
2732	#ifndef IN_RING3
2733	/* This command must be executed in R3 as it rehooks the ISA I/O port. */
2734	if (pThis->uOperationCode == BUSLOGICCOMMAND_MODIFY_IO_ADDRESS)
2735	{
2736	rc = VINF_IOM_R3_IOPORT_WRITE;
2737	break;
2738	}
2739	#endif
2740	/*
2741	* The real adapter would set the Command register busy bit in the status register.
2742	* The guest has to wait until it is unset.
2743	* We don't need to do it because the guest does not continue execution while we are in this
2744	* function.
2745	*/
2746	pThis->aCommandBuffer[pThis->iParameter] = uVal;
2747	pThis->iParameter++;
2748	pThis->cbCommandParametersLeft--;
2749	}
2750
2751	/* Start execution of command if there are no parameters left. */
2752	if (!pThis->cbCommandParametersLeft)
2753	{
2754	rc = buslogicProcessCommand(pDevIns, pThis);
2755	AssertMsgRC(rc, ("Processing command failed rc=%Rrc\n", rc));
2756	}
2757	break;
2758	}
2759
2760	/* On BusLogic adapters, the interrupt and geometry registers are R/W.
2761	* That is different from Adaptec 154x where those are read only.
2762	*/
2763	case BUSLOGIC_REGISTER_INTERRUPT:
2764	if (pThis->uDevType == DEV_AHA_1540B)
2765	break;
2766	pThis->regInterrupt = uVal;
2767	break;
2768
2769	case BUSLOGIC_REGISTER_GEOMETRY:
2770	if (pThis->uDevType == DEV_AHA_1540B)
2771	break;
2772	pThis->regGeometry = uVal;
2773	break;
2774
2775	default:
2776	AssertMsgFailed(("Register not available\n"));
2777	rc = VERR_IOM_IOPORT_UNUSED;
2778	}
2779
2780	return rc;
2781	}
2782
2783	/**
2784	* @callback_method_impl{FNIOMMMIONEWREAD}
2785	*/
2786	static DECLCALLBACK(VBOXSTRICTRC) buslogicMMIORead(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void pv, unsigned cb)
2787	{
2788	RT_NOREF(pDevIns, pvUser, off, pv, cb);
2789
2790	/* the linux driver does not make use of the MMIO area. */
2791	ASSERT_GUEST_MSG_FAILED(("MMIO Read: %RGp LB %u\n", off, cb));
2792	return VINF_SUCCESS;
2793	}
2794
2795	/**
2796	* @callback_method_impl{FNIOMMMIONEWWRITE}
2797	*/
2798	static DECLCALLBACK(VBOXSTRICTRC) buslogicMMIOWrite(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void const pv, unsigned cb)
2799	{
2800	RT_NOREF(pDevIns, pvUser, off, pv, cb);
2801
2802	/* the linux driver does not make use of the MMIO area. */
2803	ASSERT_GUEST_MSG_FAILED(("MMIO Write: %RGp LB %u: %.*Rhxs\n", off, cb, cb, pv));
2804	return VINF_SUCCESS;
2805	}
2806
2807	/**
2808	* @callback_method_impl{FNIOMIOPORTNEWIN}
2809	*/
2810	static DECLCALLBACK(VBOXSTRICTRC)
2811	buslogicIOPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
2812	{
2813	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2814	unsigned iRegister = offPort % 4;
2815	RT_NOREF(pvUser, cb);
2816
2817	ASSERT_GUEST(cb == 1);
2818
2819	return buslogicRegisterRead(pDevIns, pThis, iRegister, pu32);
2820	}
2821
2822	/**
2823	* @callback_method_impl{FNIOMIOPORTNEWOUT}
2824	*/
2825	static DECLCALLBACK(VBOXSTRICTRC)
2826	buslogicIOPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
2827	{
2828	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2829	unsigned iRegister = offPort % 4;
2830	RT_NOREF(pvUser, cb);
2831
2832	ASSERT_GUEST(cb == 1);
2833
2834	int rc = buslogicRegisterWrite(pDevIns, pThis, iRegister, (uint8_t)u32);
2835
2836	Log2(("#%d %s: pvUser=%#p cb=%d u32=%#x offPort=%#x rc=%Rrc\n",
2837	pDevIns->iInstance, __FUNCTION__, pvUser, cb, u32, offPort, rc));
2838
2839	return rc;
2840	}
2841
2842	#ifdef IN_RING3
2843
2844	/**
2845	* Update the ISA I/O range.
2846	*
2847	* @returns nothing.
2848	* @param pDevIns The device instance.
2849	* @param pThis Pointer to the shared BusLogic instance data.
2850	* @param uBaseCode Encoded ISA I/O base; only low 3 bits are used.
2851	*/
2852	static int buslogicR3RegisterISARange(PPDMDEVINS pDevIns, PBUSLOGIC pThis, uint8_t uBaseCode)
2853	{
2854	uint8_t uCode = uBaseCode & MAX_ISA_BASE;
2855	uint16_t uNewBase = g_aISABases[uCode];
2856	int rc = VINF_SUCCESS;
2857
2858	LogFlowFunc(("ISA I/O code %02X, new base %X\n", uBaseCode, uNewBase));
2859
2860	/* Check if the same port range actually changed. */
2861	if (uNewBase != pThis->IOISABase)
2862	{
2863	/* Unmap the old range, if necessary. */
2864	if (pThis->IOISABase)
2865	{
2866	rc = PDMDevHlpIoPortUnmap(pDevIns, pThis->hIoPortsIsa);
2867	AssertRC(rc);
2868	}
2869	if (RT_SUCCESS(rc))
2870	{
2871	pThis->IOISABase = 0; /* First mark as unregistered. */
2872	pThis->uISABaseCode = ISA_BASE_DISABLED;
2873
2874	if (uNewBase)
2875	{
2876	/* Register the new range if requested. */
2877	rc = PDMDevHlpIoPortMap(pDevIns, pThis->hIoPortsIsa, uNewBase);
2878	if (RT_SUCCESS(rc))
2879	{
2880	pThis->IOISABase = uNewBase;
2881	pThis->uISABaseCode = uCode;
2882	}
2883	}
2884	}
2885	if (RT_SUCCESS(rc))
2886	{
2887	if (uNewBase)
2888	{
2889	Log(("ISA I/O base: %x\n", uNewBase));
2890	LogRel(("BusLogic: ISA I/O base: %x\n", uNewBase));
2891	}
2892	else
2893	{
2894	Log(("Disabling ISA I/O ports.\n"));
2895	LogRel(("BusLogic: ISA I/O disabled\n"));
2896	}
2897	}
2898
2899	}
2900	return rc;
2901	}
2902
2903	/**
2904	* Completes a request initiated by the BIOS through the BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND command.
2905	*
2906	* @returns nothing.
2907	* @param pThis Pointer to the shared BusLogic instance data.
2908	* @param u8ScsiSts The SCSI status code.
2909	*/
2910	static void buslogicR3ReqCompleteBios(PBUSLOGIC pThis, uint8_t u8ScsiSts)
2911	{
2912	pThis->cbReplyParametersLeft = 4;
2913	pThis->aReplyBuffer[0] = pThis->aReplyBuffer[1] = 0;
2914	pThis->aReplyBuffer[2] = u8ScsiSts;
2915	pThis->aReplyBuffer[3] = 0;
2916
2917	pThis->regStatus \|= BL_STAT_DIRRDY;
2918	}
2919
2920	static int buslogicR3ReqComplete(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, PBUSLOGICREQ pReq, int rcReq)
2921	{
2922	RT_NOREF(rcReq);
2923	PBUSLOGICDEVICE pTgtDev = pReq->pTargetDevice;
2924
2925	LogFlowFunc(("before decrement %u\n", pTgtDev->cOutstandingRequests));
2926	ASMAtomicDecU32(&pTgtDev->cOutstandingRequests);
2927	LogFlowFunc(("after decrement %u\n", pTgtDev->cOutstandingRequests));
2928
2929	if (pReq->fBIOS)
2930	{
2931	uint8_t u8ScsiSts = pReq->u8ScsiSts;
2932	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
2933	buslogicR3ReqCompleteBios(pThis, u8ScsiSts);
2934	}
2935	else
2936	{
2937	if (pReq->pbSenseBuffer)
2938	buslogicR3SenseBufferFree(pReq, (pReq->u8ScsiSts != SCSI_STATUS_OK));
2939
2940	/* Update residual data length. */
2941	if ( (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
2942	\|\| (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
2943	{
2944	size_t cbResidual = 0;
2945	int rc = pTgtDev->pDrvMediaEx->pfnIoReqQueryResidual(pTgtDev->pDrvMediaEx, pReq->hIoReq, &cbResidual);
2946	AssertRC(rc); Assert(cbResidual == (uint32_t)cbResidual);
2947
2948	if (pReq->fIs24Bit)
2949	U32_TO_LEN(pReq->CCBGuest.o.acbData, (uint32_t)cbResidual);
2950	else
2951	pReq->CCBGuest.n.cbData = (uint32_t)cbResidual;
2952	}
2953
2954	/*
2955	* Save vital things from the request and free it before posting completion
2956	* to avoid that the guest submits a new request with the same ID as the still
2957	* allocated one.
2958	*/
2959	#ifdef LOG_ENABLED
2960	bool fIs24Bit = pReq->fIs24Bit;
2961	#endif
2962	uint8_t u8ScsiSts = pReq->u8ScsiSts;
2963	RTGCPHYS GCPhysAddrCCB = pReq->GCPhysAddrCCB;
2964	CCBU CCBGuest;
2965	memcpy(&CCBGuest, &pReq->CCBGuest, sizeof(CCBU));
2966
2967	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
2968	if (u8ScsiSts == SCSI_STATUS_OK)
2969	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
2970	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED,
2971	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
2972	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITHOUT_ERROR);
2973	else if (u8ScsiSts == SCSI_STATUS_CHECK_CONDITION)
2974	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
2975	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED,
2976	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_CHECK_CONDITION,
2977	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
2978	else
2979	AssertMsgFailed(("invalid completion status %u\n", u8ScsiSts));
2980
2981	#ifdef LOG_ENABLED
2982	buslogicR3DumpCCBInfo(&CCBGuest, fIs24Bit);
2983	#endif
2984	}
2985
2986	if (pTgtDev->cOutstandingRequests == 0 && pThisCC->fSignalIdle)
2987	PDMDevHlpAsyncNotificationCompleted(pDevIns);
2988
2989	return VINF_SUCCESS;
2990	}
2991
2992	/**
2993	* @interface_method_impl{PDMIMEDIAPORT,pfnQueryDeviceLocation}
2994	*/
2995	static DECLCALLBACK(int) buslogicR3QueryDeviceLocation(PPDMIMEDIAPORT pInterface, const char **ppcszController,
2996	uint32_t piInstance, uint32_t piLUN)
2997	{
2998	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaPort);
2999	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3000
3001	AssertPtrReturn(ppcszController, VERR_INVALID_POINTER);
3002	AssertPtrReturn(piInstance, VERR_INVALID_POINTER);
3003	AssertPtrReturn(piLUN, VERR_INVALID_POINTER);
3004
3005	*ppcszController = pDevIns->pReg->szName;
3006	*piInstance = pDevIns->iInstance;
3007	*piLUN = pTgtDev->iLUN;
3008
3009	return VINF_SUCCESS;
3010	}
3011
3012	static DECLCALLBACK(size_t) buslogicR3CopySgToGuestBios(PCRTSGBUF pSgBuf, const void pvSrc, size_t cbSrc, void pvUser)
3013	{
3014	PBUSLOGICCOPYARGS pArgs = (PBUSLOGICCOPYARGS)pvUser;
3015	size_t cbThisCopy = RT_MIN(cbSrc, pArgs->pCmd->cbData - pArgs->cbCopied);
3016	RT_NOREF(pSgBuf);
3017
3018	blPhysWriteUser(pArgs->pDevIns, pArgs->pThis, pArgs->pCmd->u32PhysAddrData + pArgs->cbCopied, pvSrc, cbThisCopy);
3019	pArgs->cbCopied += cbThisCopy;
3020	return cbThisCopy;
3021	}
3022
3023	/**
3024	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCopyFromBuf}
3025	*/
3026	static DECLCALLBACK(int) buslogicR3IoReqCopyFromBuf(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3027	void *pvIoReqAlloc, uint32_t offDst, PRTSGBUF pSgBuf,
3028	size_t cbCopy)
3029	{
3030	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3031	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3032	PBUSLOGICREQ pReq = (PBUSLOGICREQ)pvIoReqAlloc;
3033	RT_NOREF(hIoReq);
3034
3035	size_t cbCopied = 0;
3036	if (RT_LIKELY(!pReq->fBIOS))
3037	cbCopied = buslogicR3CopySgBufToGuest(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), pReq, pSgBuf, offDst, cbCopy);
3038	else
3039	{
3040	BUSLOGICCOPYARGS Args;
3041	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3042	PESCMD pCmd = (PESCMD)pThis->aCommandBuffer;
3043
3044	Args.pCmd = pCmd;
3045	Args.pThis = pThis;
3046	Args.pDevIns = pDevIns;
3047	Args.cbCopied = 0;
3048	cbCopied = RTSgBufCopyToFn(pSgBuf, RT_MIN(pCmd->cbData, cbCopy), buslogicR3CopySgToGuestBios, &Args);
3049	}
3050	return cbCopied == cbCopy ? VINF_SUCCESS : VERR_PDM_MEDIAEX_IOBUF_OVERFLOW;
3051	}
3052
3053	static DECLCALLBACK(size_t) buslogicR3CopySgFromGuestBios(PCRTSGBUF pSgBuf, void pvDst, size_t cbDst, void pvUser)
3054	{
3055	PBUSLOGICCOPYARGS pArgs = (PBUSLOGICCOPYARGS)pvUser;
3056	size_t cbThisCopy = RT_MIN(cbDst, pArgs->pCmd->cbData - pArgs->cbCopied);
3057	RT_NOREF(pSgBuf);
3058
3059	blPhysReadUser(pArgs->pDevIns, pArgs->pThis, pArgs->pCmd->u32PhysAddrData + pArgs->cbCopied, pvDst, cbThisCopy);
3060	pArgs->cbCopied += cbThisCopy;
3061	return cbThisCopy;
3062	}
3063
3064	/**
3065	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCopyToBuf}
3066	*/
3067	static DECLCALLBACK(int) buslogicR3IoReqCopyToBuf(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3068	void *pvIoReqAlloc, uint32_t offSrc, PRTSGBUF pSgBuf,
3069	size_t cbCopy)
3070	{
3071	RT_NOREF(hIoReq);
3072	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3073	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3074	PBUSLOGICREQ pReq = (PBUSLOGICREQ)pvIoReqAlloc;
3075
3076	size_t cbCopied = 0;
3077	if (RT_LIKELY(!pReq->fBIOS))
3078	cbCopied = buslogicR3CopySgBufFromGuest(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), pReq, pSgBuf, offSrc, cbCopy);
3079	else
3080	{
3081	BUSLOGICCOPYARGS Args;
3082	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3083	PESCMD pCmd = (PESCMD)pThis->aCommandBuffer;
3084
3085	Args.pCmd = pCmd;
3086	Args.pThis = pThis;
3087	Args.pDevIns = pDevIns;
3088	Args.cbCopied = 0;
3089	cbCopied = RTSgBufCopyFromFn(pSgBuf, RT_MIN(pCmd->cbData, cbCopy), buslogicR3CopySgFromGuestBios, &Args);
3090	}
3091
3092	return cbCopied == cbCopy ? VINF_SUCCESS : VERR_PDM_MEDIAEX_IOBUF_UNDERRUN;
3093	}
3094
3095	/**
3096	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCompleteNotify}
3097	*/
3098	static DECLCALLBACK(int) buslogicR3IoReqCompleteNotify(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3099	void *pvIoReqAlloc, int rcReq)
3100	{
3101	RT_NOREF(hIoReq);
3102	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3103	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3104	buslogicR3ReqComplete(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC),
3105	(PBUSLOGICREQ)pvIoReqAlloc, rcReq);
3106	return VINF_SUCCESS;
3107	}
3108
3109	/**
3110	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqStateChanged}
3111	*/
3112	static DECLCALLBACK(void) buslogicR3IoReqStateChanged(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3113	void *pvIoReqAlloc, PDMMEDIAEXIOREQSTATE enmState)
3114	{
3115	RT_NOREF(hIoReq, pvIoReqAlloc, enmState);
3116	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3117
3118	switch (enmState)
3119	{
3120	case PDMMEDIAEXIOREQSTATE_SUSPENDED:
3121	{
3122	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3123	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3124
3125	/* Make sure the request is not accounted for so the VM can suspend successfully. */
3126	uint32_t cTasksActive = ASMAtomicDecU32(&pTgtDev->cOutstandingRequests);
3127	if (!cTasksActive && pThisCC->fSignalIdle)
3128	PDMDevHlpAsyncNotificationCompleted(pDevIns);
3129	break;
3130	}
3131	case PDMMEDIAEXIOREQSTATE_ACTIVE:
3132	/* Make sure the request is accounted for so the VM suspends only when the request is complete. */
3133	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3134	break;
3135	default:
3136	AssertMsgFailed(("Invalid request state given %u\n", enmState));
3137	}
3138	}
3139
3140	/**
3141	* @interface_method_impl{PDMIMEDIAEXPORT,pfnMediumEjected}
3142	*/
3143	static DECLCALLBACK(void) buslogicR3MediumEjected(PPDMIMEDIAEXPORT pInterface)
3144	{
3145	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3146	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3147	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3148
3149	if (pThisCC->pMediaNotify)
3150	{
3151	int rc = VMR3ReqCallNoWait(PDMDevHlpGetVM(pDevIns), VMCPUID_ANY,
3152	(PFNRT)pThisCC->pMediaNotify->pfnEjected, 2,
3153	pThisCC->pMediaNotify, pTgtDev->iLUN);
3154	AssertRC(rc);
3155	}
3156	}
3157
3158	static int buslogicR3DeviceSCSIRequestSetup(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, RTGCPHYS GCPhysAddrCCB)
3159	{
3160	int rc = VINF_SUCCESS;
3161	uint8_t uTargetIdCCB;
3162	CCBU CCBGuest;
3163
3164	/* Fetch the CCB from guest memory. */
3165	/** @todo How much do we really have to read? */
3166	blPhysReadMeta(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest, sizeof(CCB32));
3167
3168	uTargetIdCCB = pThis->fMbxIs24Bit ? CCBGuest.o.uTargetId : CCBGuest.n.uTargetId;
3169	if (RT_LIKELY(uTargetIdCCB < RT_ELEMENTS(pThisCC->aDeviceStates)))
3170	{
3171	PBUSLOGICDEVICE pTgtDev = &pThisCC->aDeviceStates[uTargetIdCCB];
3172
3173	#ifdef LOG_ENABLED
3174	buslogicR3DumpCCBInfo(&CCBGuest, pThis->fMbxIs24Bit);
3175	#endif
3176
3177	/* Check if device is present on bus. If not return error immediately and don't process this further. */
3178	if (RT_LIKELY(pTgtDev->fPresent))
3179	{
3180	PDMMEDIAEXIOREQ hIoReq;
3181	PBUSLOGICREQ pReq;
3182	rc = pTgtDev->pDrvMediaEx->pfnIoReqAlloc(pTgtDev->pDrvMediaEx, &hIoReq, (void **)&pReq,
3183	GCPhysAddrCCB, PDMIMEDIAEX_F_SUSPEND_ON_RECOVERABLE_ERR);
3184	if (RT_SUCCESS(rc))
3185	{
3186	pReq->pTargetDevice = pTgtDev;
3187	pReq->GCPhysAddrCCB = GCPhysAddrCCB;
3188	pReq->fBIOS = false;
3189	pReq->hIoReq = hIoReq;
3190	pReq->fIs24Bit = pThis->fMbxIs24Bit;
3191
3192	/* Make a copy of the CCB */
3193	memcpy(&pReq->CCBGuest, &CCBGuest, sizeof(CCBGuest));
3194
3195	/* Alloc required buffers. */
3196	rc = buslogicR3SenseBufferAlloc(pReq);
3197	AssertMsgRC(rc, ("Mapping sense buffer failed rc=%Rrc\n", rc));
3198
3199	size_t cbBuf = 0;
3200	rc = buslogicR3QueryDataBufferSize(pDevIns, &pReq->CCBGuest, pReq->fIs24Bit, &cbBuf);
3201	AssertRC(rc);
3202
3203	uint32_t uLun = pReq->fIs24Bit ? pReq->CCBGuest.o.uLogicalUnit
3204	: pReq->CCBGuest.n.uLogicalUnit;
3205
3206	PDMMEDIAEXIOREQSCSITXDIR enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_UNKNOWN;
3207	size_t cbSense = buslogicR3ConvertSenseBufferLength(CCBGuest.c.cbSenseData);
3208
3209	if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_NO_DATA)
3210	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_NONE;
3211	else if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_OUT)
3212	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_TO_DEVICE;
3213	else if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_IN)
3214	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_FROM_DEVICE;
3215
3216	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3217	rc = pTgtDev->pDrvMediaEx->pfnIoReqSendScsiCmd(pTgtDev->pDrvMediaEx, pReq->hIoReq, uLun,
3218	&pReq->CCBGuest.c.abCDB[0], pReq->CCBGuest.c.cbCDB,
3219	enmXferDir, NULL, cbBuf, pReq->pbSenseBuffer, cbSense, NULL,
3220	&pReq->u8ScsiSts, 30 * RT_MS_1SEC);
3221	if (rc != VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
3222	buslogicR3ReqComplete(pDevIns, pThis, pThisCC, pReq, rc);
3223	}
3224	else
3225	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3226	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT,
3227	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3228	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3229	}
3230	else
3231	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3232	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT,
3233	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3234	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3235	}
3236	else
3237	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3238	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER,
3239	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3240	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3241
3242	return rc;
3243	}
3244
3245	static int buslogicR3DeviceSCSIRequestAbort(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhysAddrCCB)
3246	{
3247	uint8_t uTargetIdCCB;
3248	CCBU CCBGuest;
3249
3250	blPhysReadMeta(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest, sizeof(CCB32));
3251
3252	uTargetIdCCB = pThis->fMbxIs24Bit ? CCBGuest.o.uTargetId : CCBGuest.n.uTargetId;
3253	if (RT_LIKELY(uTargetIdCCB < RT_ELEMENTS(pThis->afDevicePresent)))
3254	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3255	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED,
3256	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3257	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND);
3258	else
3259	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3260	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER,
3261	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3262	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3263
3264	return VINF_SUCCESS;
3265	}
3266
3267	/**
3268	* Read a mailbox from guest memory. Convert 24-bit mailboxes to
3269	* 32-bit format.
3270	*
3271	* @returns Mailbox guest physical address.
3272	* @param pDevIns The device instance.
3273	* @param pThis Pointer to the shared BusLogic instance data.
3274	* @param pMbx Pointer to the mailbox to read into.
3275	*/
3276	static RTGCPHYS buslogicR3ReadOutgoingMailbox(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PMailbox32 pMbx)
3277	{
3278	RTGCPHYS GCMailbox;
3279
3280	if (pThis->fMbxIs24Bit)
3281	{
3282	Mailbox24 Mbx24;
3283
3284	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->uMailboxOutgoingPositionCurrent * sizeof(Mailbox24));
3285	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx24, sizeof(Mailbox24));
3286	pMbx->u32PhysAddrCCB = ADDR_TO_U32(Mbx24.aPhysAddrCCB);
3287	pMbx->u.out.uActionCode = Mbx24.uCmdState;
3288	}
3289	else
3290	{
3291	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->uMailboxOutgoingPositionCurrent * sizeof(Mailbox32));
3292	blPhysReadMeta(pDevIns, pThis, GCMailbox, pMbx, sizeof(Mailbox32));
3293	}
3294
3295	return GCMailbox;
3296	}
3297
3298	/**
3299	* Read mailbox from the guest and execute command.
3300	*
3301	* @returns VBox status code.
3302	* @param pDevIns The device instance.
3303	* @param pThis Pointer to the shared BusLogic instance data.
3304	* @param pThisCC Pointer to the ring-3 BusLogic instance data.
3305	*/
3306	static int buslogicR3ProcessMailboxNext(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC)
3307	{
3308	RTGCPHYS GCPhysAddrMailboxCurrent;
3309	Mailbox32 MailboxGuest;
3310	int rc = VINF_SUCCESS;
3311
3312	if (!pThis->fStrictRoundRobinMode)
3313	{
3314	/* Search for a filled mailbox - stop if we have scanned all mailboxes. */
3315	uint8_t uMailboxPosCur = pThis->uMailboxOutgoingPositionCurrent;
3316
3317	do
3318	{
3319	/* Fetch mailbox from guest memory. */
3320	GCPhysAddrMailboxCurrent = buslogicR3ReadOutgoingMailbox(pDevIns, pThis, &MailboxGuest);
3321
3322	/* Check the next mailbox. */
3323	buslogicR3OutgoingMailboxAdvance(pThis);
3324	} while ( MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE
3325	&& uMailboxPosCur != pThis->uMailboxOutgoingPositionCurrent);
3326	}
3327	else
3328	{
3329	/* Fetch mailbox from guest memory. */
3330	GCPhysAddrMailboxCurrent = buslogicR3ReadOutgoingMailbox(pDevIns, pThis, &MailboxGuest);
3331	}
3332
3333	/*
3334	* Check if the mailbox is actually loaded.
3335	* It might be possible that the guest notified us without
3336	* a loaded mailbox. Do nothing in that case but leave a
3337	* log entry.
3338	*/
3339	if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE)
3340	{
3341	Log(("No loaded mailbox left\n"));
3342	return VERR_NO_DATA;
3343	}
3344
3345	LogFlow(("Got loaded mailbox at slot %u, CCB phys %RGp\n", pThis->uMailboxOutgoingPositionCurrent, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB));
3346	#ifdef LOG_ENABLED
3347	buslogicR3DumpMailboxInfo(&MailboxGuest, true);
3348	#endif
3349
3350	/* We got the mailbox, mark it as free in the guest. */
3351	uint8_t uActionCode = BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE;
3352	unsigned uCodeOffs = pThis->fMbxIs24Bit ? RT_OFFSETOF(Mailbox24, uCmdState) : RT_OFFSETOF(Mailbox32, u.out.uActionCode);
3353	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrMailboxCurrent + uCodeOffs, &uActionCode, sizeof(uActionCode));
3354
3355	if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_START_COMMAND)
3356	rc = buslogicR3DeviceSCSIRequestSetup(pDevIns, pThis, pThisCC, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB);
3357	else if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND)
3358	{
3359	LogFlow(("Aborting mailbox\n"));
3360	rc = buslogicR3DeviceSCSIRequestAbort(pDevIns, pThis, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB);
3361	}
3362	else
3363	AssertMsgFailed(("Invalid outgoing mailbox action code %u\n", MailboxGuest.u.out.uActionCode));
3364
3365	AssertRC(rc);
3366
3367	/* Advance to the next mailbox. */
3368	if (pThis->fStrictRoundRobinMode)
3369	buslogicR3OutgoingMailboxAdvance(pThis);
3370
3371	return rc;
3372	}
3373
3374	/**
3375	* Processes a SCSI request issued by the BIOS with the BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND command.
3376	*
3377	* @returns nothing.
3378	* @param pDevIns The device instance.
3379	* @param pThis Pointer to the shared BusLogic instance data.
3380	* @param pThisCC Pointer to the ring-3 BusLogic instance data.
3381	*/
3382	static void buslogicR3ProcessBiosReq(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC)
3383	{
3384	PESCMD pCmd = (PESCMD)pThis->aCommandBuffer;
3385
3386	if (RT_LIKELY( pCmd->uTargetId < RT_ELEMENTS(pThisCC->aDeviceStates)
3387	&& pCmd->cbCDB <= 16))
3388	{
3389	PBUSLOGICDEVICE pTgtDev = &pThisCC->aDeviceStates[pCmd->uTargetId];
3390
3391	/* Check if device is present on bus. If not return error immediately and don't process this further. */
3392	if (RT_LIKELY(pTgtDev->fPresent))
3393	{
3394	PDMMEDIAEXIOREQ hIoReq;
3395	PBUSLOGICREQ pReq;
3396	int rc = pTgtDev->pDrvMediaEx->pfnIoReqAlloc(pTgtDev->pDrvMediaEx, &hIoReq, (void **)&pReq,
3397	0, PDMIMEDIAEX_F_SUSPEND_ON_RECOVERABLE_ERR);
3398	if (RT_SUCCESS(rc))
3399	{
3400	pReq->pTargetDevice = pTgtDev;
3401	pReq->GCPhysAddrCCB = 0;
3402	pReq->fBIOS = true;
3403	pReq->hIoReq = hIoReq;
3404	pReq->fIs24Bit = false;
3405
3406	uint32_t uLun = pCmd->uLogicalUnit;
3407
3408	PDMMEDIAEXIOREQSCSITXDIR enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_UNKNOWN;
3409
3410	if (pCmd->uDataDirection == 2)
3411	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_TO_DEVICE;
3412	else if (pCmd->uDataDirection == 1)
3413	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_FROM_DEVICE;
3414
3415	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3416	rc = pTgtDev->pDrvMediaEx->pfnIoReqSendScsiCmd(pTgtDev->pDrvMediaEx, pReq->hIoReq, uLun,
3417	&pCmd->abCDB[0], pCmd->cbCDB,
3418	enmXferDir, NULL, pCmd->cbData, NULL, 0 /cbSense/, NULL,
3419	&pReq->u8ScsiSts, 30 * RT_MS_1SEC);
3420	if (rc != VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
3421	buslogicR3ReqComplete(pDevIns, pThis, pThisCC, pReq, rc);
3422	}
3423	else
3424	buslogicR3ReqCompleteBios(pThis, SCSI_STATUS_CHECK_CONDITION);
3425	}
3426	else
3427	buslogicR3ReqCompleteBios(pThis, SCSI_STATUS_CHECK_CONDITION);
3428	}
3429	else
3430	buslogicR3ReqCompleteBios(pThis, SCSI_STATUS_CHECK_CONDITION);
3431	}
3432
3433
3434	/** @callback_method_impl{FNSSMDEVLIVEEXEC} */
3435	static DECLCALLBACK(int) buslogicR3LiveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass)
3436	{
3437	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3438	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3439	RT_NOREF(uPass);
3440
3441	/* Save the device config. */
3442	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3443	pHlp->pfnSSMPutBool(pSSM, pThisCC->aDeviceStates[i].fPresent);
3444
3445	return VINF_SSM_DONT_CALL_AGAIN;
3446	}
3447
3448	/** @callback_method_impl{FNSSMDEVSAVEEXEC} */
3449	static DECLCALLBACK(int) buslogicR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3450	{
3451	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3452	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3453	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3454	uint32_t cReqsSuspended = 0;
3455
3456	/* Every device first. */
3457	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3458	{
3459	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3460
3461	AssertMsg(!pDevice->cOutstandingRequests,
3462	("There are still outstanding requests on this device\n"));
3463	pHlp->pfnSSMPutBool(pSSM, pDevice->fPresent);
3464	pHlp->pfnSSMPutU32(pSSM, pDevice->cOutstandingRequests);
3465
3466	if (pDevice->fPresent)
3467	cReqsSuspended += pDevice->pDrvMediaEx->pfnIoReqGetSuspendedCount(pDevice->pDrvMediaEx);
3468	}
3469	/* Now the main device state. */
3470	pHlp->pfnSSMPutU8 (pSSM, pThis->regStatus);
3471	pHlp->pfnSSMPutU8 (pSSM, pThis->regInterrupt);
3472	pHlp->pfnSSMPutU8 (pSSM, pThis->regGeometry);
3473	pHlp->pfnSSMPutMem (pSSM, &pThis->LocalRam, sizeof(pThis->LocalRam));
3474	pHlp->pfnSSMPutU8 (pSSM, pThis->uOperationCode);
3475	pHlp->pfnSSMPutMem (pSSM, &pThis->aCommandBuffer, sizeof(pThis->aCommandBuffer));
3476	pHlp->pfnSSMPutU8 (pSSM, pThis->iParameter);
3477	pHlp->pfnSSMPutU8 (pSSM, pThis->cbCommandParametersLeft);
3478	pHlp->pfnSSMPutBool (pSSM, pThis->fUseLocalRam);
3479	pHlp->pfnSSMPutMem (pSSM, pThis->aReplyBuffer, sizeof(pThis->aReplyBuffer));
3480	pHlp->pfnSSMPutU8 (pSSM, pThis->iReply);
3481	pHlp->pfnSSMPutU8 (pSSM, pThis->cbReplyParametersLeft);
3482	pHlp->pfnSSMPutBool (pSSM, pThis->fIRQEnabled);
3483	pHlp->pfnSSMPutU8 (pSSM, pThis->uISABaseCode);
3484	pHlp->pfnSSMPutU32 (pSSM, pThis->cMailbox);
3485	pHlp->pfnSSMPutBool (pSSM, pThis->fMbxIs24Bit);
3486	pHlp->pfnSSMPutGCPhys(pSSM, pThis->GCPhysAddrMailboxOutgoingBase);
3487	pHlp->pfnSSMPutU32 (pSSM, pThis->uMailboxOutgoingPositionCurrent);
3488	pHlp->pfnSSMPutU32 (pSSM, pThis->cMailboxesReady);
3489	pHlp->pfnSSMPutBool (pSSM, pThis->fNotificationSent);
3490	pHlp->pfnSSMPutGCPhys(pSSM, pThis->GCPhysAddrMailboxIncomingBase);
3491	pHlp->pfnSSMPutU32 (pSSM, pThis->uMailboxIncomingPositionCurrent);
3492	pHlp->pfnSSMPutBool (pSSM, pThis->fStrictRoundRobinMode);
3493	pHlp->pfnSSMPutBool (pSSM, pThis->fExtendedLunCCBFormat);
3494
3495	pHlp->pfnSSMPutU32(pSSM, cReqsSuspended);
3496
3497	/* Save the physical CCB address of all suspended requests. */
3498	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates) && cReqsSuspended; i++)
3499	{
3500	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3501	if (pDevice->fPresent)
3502	{
3503	uint32_t cThisReqsSuspended = pDevice->pDrvMediaEx->pfnIoReqGetSuspendedCount(pDevice->pDrvMediaEx);
3504
3505	cReqsSuspended -= cThisReqsSuspended;
3506	if (cThisReqsSuspended)
3507	{
3508	PDMMEDIAEXIOREQ hIoReq;
3509	PBUSLOGICREQ pReq;
3510	int rc = pDevice->pDrvMediaEx->pfnIoReqQuerySuspendedStart(pDevice->pDrvMediaEx, &hIoReq,
3511	(void **)&pReq);
3512	AssertRCBreak(rc);
3513
3514	for (;;)
3515	{
3516	pHlp->pfnSSMPutU32(pSSM, (uint32_t)pReq->GCPhysAddrCCB);
3517
3518	cThisReqsSuspended--;
3519	if (!cThisReqsSuspended)
3520	break;
3521
3522	rc = pDevice->pDrvMediaEx->pfnIoReqQuerySuspendedNext(pDevice->pDrvMediaEx, hIoReq,
3523	&hIoReq, (void **)&pReq);
3524	AssertRCBreak(rc);
3525	}
3526	}
3527	}
3528	}
3529
3530	return pHlp->pfnSSMPutU32(pSSM, UINT32_MAX);
3531	}
3532
3533	/** @callback_method_impl{FNSSMDEVLOADDONE} */
3534	static DECLCALLBACK(int) buslogicR3LoadDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3535	{
3536	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3537	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3538	RT_NOREF(pSSM);
3539
3540	buslogicR3RegisterISARange(pDevIns, pThis, pThis->uISABaseCode);
3541
3542	/* Kick of any requests we might need to redo. */
3543	if (pThisCC->cReqsRedo)
3544	{
3545	for (unsigned i = 0; i < pThisCC->cReqsRedo; i++)
3546	{
3547	int rc = buslogicR3DeviceSCSIRequestSetup(pDevIns, pThis, pThisCC, pThisCC->paGCPhysAddrCCBRedo[i]);
3548	AssertRC(rc);
3549	}
3550
3551	RTMemFree(pThisCC->paGCPhysAddrCCBRedo);
3552	pThisCC->paGCPhysAddrCCBRedo = NULL;
3553	pThisCC->cReqsRedo = 0;
3554	}
3555
3556	return VINF_SUCCESS;
3557	}
3558
3559	/** @callback_method_impl{FNSSMDEVLOADEXEC} */
3560	static DECLCALLBACK(int) buslogicR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
3561	{
3562	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3563	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3564	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3565	int rc = VINF_SUCCESS;
3566
3567	/* We support saved states only from this and older versions. */
3568	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_VERSION)
3569	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
3570
3571	/* Every device first. */
3572	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3573	{
3574	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3575
3576	AssertMsg(!pDevice->cOutstandingRequests,
3577	("There are still outstanding requests on this device\n"));
3578	bool fPresent;
3579	rc = pHlp->pfnSSMGetBool(pSSM, &fPresent);
3580	AssertRCReturn(rc, rc);
3581	if (pDevice->fPresent != fPresent)
3582	return pHlp->pfnSSMSetCfgError(pSSM, RT_SRC_POS, N_("Target %u config mismatch: config=%RTbool state=%RTbool"), i, pDevice->fPresent, fPresent);
3583
3584	if (uPass == SSM_PASS_FINAL)
3585	pHlp->pfnSSMGetU32V(pSSM, &pDevice->cOutstandingRequests);
3586	}
3587
3588	if (uPass != SSM_PASS_FINAL)
3589	return VINF_SUCCESS;
3590
3591	/* Now the main device state. */
3592	pHlp->pfnSSMGetU8V (pSSM, &pThis->regStatus);
3593	pHlp->pfnSSMGetU8V (pSSM, &pThis->regInterrupt);
3594	pHlp->pfnSSMGetU8V (pSSM, &pThis->regGeometry);
3595	pHlp->pfnSSMGetMem (pSSM, &pThis->LocalRam, sizeof(pThis->LocalRam));
3596	pHlp->pfnSSMGetU8 (pSSM, &pThis->uOperationCode);
3597	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE)
3598	pHlp->pfnSSMGetMem(pSSM, &pThis->aCommandBuffer, sizeof(pThis->aCommandBuffer));
3599	else
3600	pHlp->pfnSSMGetMem(pSSM, &pThis->aCommandBuffer, BUSLOGIC_COMMAND_SIZE_OLD);
3601	pHlp->pfnSSMGetU8 (pSSM, &pThis->iParameter);
3602	pHlp->pfnSSMGetU8 (pSSM, &pThis->cbCommandParametersLeft);
3603	pHlp->pfnSSMGetBool (pSSM, &pThis->fUseLocalRam);
3604	pHlp->pfnSSMGetMem (pSSM, pThis->aReplyBuffer, sizeof(pThis->aReplyBuffer));
3605	pHlp->pfnSSMGetU8 (pSSM, &pThis->iReply);
3606	pHlp->pfnSSMGetU8 (pSSM, &pThis->cbReplyParametersLeft);
3607	pHlp->pfnSSMGetBool (pSSM, &pThis->fIRQEnabled);
3608	pHlp->pfnSSMGetU8 (pSSM, &pThis->uISABaseCode);
3609	pHlp->pfnSSMGetU32 (pSSM, &pThis->cMailbox);
3610	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX)
3611	pHlp->pfnSSMGetBool(pSSM, &pThis->fMbxIs24Bit);
3612	pHlp->pfnSSMGetGCPhys(pSSM, &pThis->GCPhysAddrMailboxOutgoingBase);
3613	pHlp->pfnSSMGetU32 (pSSM, &pThis->uMailboxOutgoingPositionCurrent);
3614	pHlp->pfnSSMGetU32V (pSSM, &pThis->cMailboxesReady);
3615	pHlp->pfnSSMGetBoolV (pSSM, &pThis->fNotificationSent);
3616	pHlp->pfnSSMGetGCPhys(pSSM, &pThis->GCPhysAddrMailboxIncomingBase);
3617	pHlp->pfnSSMGetU32 (pSSM, &pThis->uMailboxIncomingPositionCurrent);
3618	pHlp->pfnSSMGetBool (pSSM, &pThis->fStrictRoundRobinMode);
3619	pHlp->pfnSSMGetBool (pSSM, &pThis->fExtendedLunCCBFormat);
3620
3621	if (uVersion <= BUSLOGIC_SAVED_STATE_MINOR_PRE_VBOXSCSI_REMOVAL)
3622	{
3623	rc = vboxscsiR3LoadExecLegacy(pDevIns->pHlpR3, pSSM);
3624	if (RT_FAILURE(rc))
3625	{
3626	LogRel(("BusLogic: Failed to restore BIOS state: %Rrc.\n", rc));
3627	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic: Failed to restore BIOS state\n"));
3628	}
3629	}
3630
3631	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_ERROR_HANDLING)
3632	{
3633	/* Check if there are pending tasks saved. */
3634	uint32_t cTasks = 0;
3635
3636	pHlp->pfnSSMGetU32(pSSM, &cTasks);
3637
3638	if (cTasks)
3639	{
3640	pThisCC->paGCPhysAddrCCBRedo = (PRTGCPHYS)RTMemAllocZ(cTasks * sizeof(RTGCPHYS));
3641	if (RT_LIKELY(pThisCC->paGCPhysAddrCCBRedo))
3642	{
3643	pThisCC->cReqsRedo = cTasks;
3644
3645	for (uint32_t i = 0; i < cTasks; i++)
3646	{
3647	uint32_t u32PhysAddrCCB;
3648
3649	rc = pHlp->pfnSSMGetU32(pSSM, &u32PhysAddrCCB);
3650	AssertRCBreak(rc);
3651
3652	pThisCC->paGCPhysAddrCCBRedo[i] = u32PhysAddrCCB;
3653	}
3654	}
3655	else
3656	rc = VERR_NO_MEMORY;
3657	}
3658	}
3659
3660	if (RT_SUCCESS(rc))
3661	{
3662	uint32_t u32;
3663	rc = pHlp->pfnSSMGetU32(pSSM, &u32);
3664	if (RT_SUCCESS(rc))
3665	AssertMsgReturn(u32 == UINT32_MAX, ("%#x\n", u32), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
3666	}
3667
3668	return rc;
3669	}
3670
3671	/**
3672	* Gets the pointer to the status LED of a device - called from the SCSI driver.
3673	*
3674	* @returns VBox status code.
3675	* @param pInterface Pointer to the interface structure containing the called function pointer.
3676	* @param iLUN The unit which status LED we desire. Always 0 here as the driver
3677	* doesn't know about other LUN's.
3678	* @param ppLed Where to store the LED pointer.
3679	*/
3680	static DECLCALLBACK(int) buslogicR3DeviceQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3681	{
3682	PBUSLOGICDEVICE pDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, ILed);
3683	if (iLUN == 0)
3684	{
3685	*ppLed = &pDevice->Led;
3686	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
3687	return VINF_SUCCESS;
3688	}
3689	return VERR_PDM_LUN_NOT_FOUND;
3690	}
3691
3692	/**
3693	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
3694	*/
3695	static DECLCALLBACK(void ) buslogicR3DeviceQueryInterface(PPDMIBASE pInterface, const char pszIID)
3696	{
3697	PBUSLOGICDEVICE pDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IBase);
3698	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pDevice->IBase);
3699	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAPORT, &pDevice->IMediaPort);
3700	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAEXPORT, &pDevice->IMediaExPort);
3701	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pDevice->ILed);
3702	return NULL;
3703	}
3704
3705	/**
3706	* Gets the pointer to the status LED of a unit.
3707	*
3708	* @returns VBox status code.
3709	* @param pInterface Pointer to the interface structure containing the called function pointer.
3710	* @param iLUN The unit which status LED we desire.
3711	* @param ppLed Where to store the LED pointer.
3712	*/
3713	static DECLCALLBACK(int) buslogicR3StatusQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3714	{
3715	PBUSLOGICCC pThisCC = RT_FROM_MEMBER(pInterface, BUSLOGICCC, ILeds);
3716	if (iLUN < BUSLOGIC_MAX_DEVICES)
3717	{
3718	*ppLed = &pThisCC->aDeviceStates[iLUN].Led;
3719	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
3720	return VINF_SUCCESS;
3721	}
3722	return VERR_PDM_LUN_NOT_FOUND;
3723	}
3724
3725	/**
3726	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
3727	*/
3728	static DECLCALLBACK(void ) buslogicR3StatusQueryInterface(PPDMIBASE pInterface, const char pszIID)
3729	{
3730	PBUSLOGICCC pThisCC = RT_FROM_MEMBER(pInterface, BUSLOGICCC, IBase);
3731	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThisCC->IBase);
3732	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThisCC->ILeds);
3733	return NULL;
3734	}
3735
3736	/**
3737	* @callback_method_impl{FNPDMTHREADWAKEUPDEV}
3738	*/
3739	static DECLCALLBACK(int) buslogicR3Worker(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3740	{
3741	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3742	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3743
3744	if (pThread->enmState == PDMTHREADSTATE_INITIALIZING)
3745	return VINF_SUCCESS;
3746
3747	while (pThread->enmState == PDMTHREADSTATE_RUNNING)
3748	{
3749	int rc;
3750
3751	ASMAtomicWriteBool(&pThisCC->fWrkThreadSleeping, true);
3752	bool fNotificationSent = ASMAtomicXchgBool(&pThis->fNotificationSent, false);
3753	if (!fNotificationSent)
3754	{
3755	Assert(ASMAtomicReadBool(&pThisCC->fWrkThreadSleeping));
3756	rc = PDMDevHlpSUPSemEventWaitNoResume(pDevIns, pThis->hEvtProcess, RT_INDEFINITE_WAIT);
3757	AssertLogRelMsgReturn(RT_SUCCESS(rc) \|\| rc == VERR_INTERRUPTED, ("%Rrc\n", rc), rc);
3758	if (RT_UNLIKELY(pThread->enmState != PDMTHREADSTATE_RUNNING))
3759	break;
3760	LogFlowFunc(("Woken up with rc=%Rrc\n", rc));
3761	ASMAtomicWriteBool(&pThis->fNotificationSent, false);
3762	}
3763
3764	ASMAtomicWriteBool(&pThisCC->fWrkThreadSleeping, false);
3765
3766	if (ASMAtomicXchgBool(&pThis->fBiosReqPending, false))
3767	buslogicR3ProcessBiosReq(pDevIns, pThis, pThisCC);
3768
3769	if (ASMAtomicXchgU32(&pThis->cMailboxesReady, 0))
3770	{
3771	/* Process mailboxes. */
3772	do
3773	{
3774	rc = buslogicR3ProcessMailboxNext(pDevIns, pThis, pThisCC);
3775	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_NO_DATA, ("Processing mailbox failed rc=%Rrc\n", rc));
3776	} while (RT_SUCCESS(rc));
3777	}
3778	} /* While running */
3779
3780	return VINF_SUCCESS;
3781	}
3782
3783
3784	/**
3785	* @callback_method_impl{FNPDMTHREADWAKEUPDEV}
3786	*/
3787	static DECLCALLBACK(int) buslogicR3WorkerWakeUp(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3788	{
3789	RT_NOREF(pThread);
3790	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3791	return PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
3792	}
3793
3794	/**
3795	* BusLogic debugger info callback.
3796	*
3797	* @param pDevIns The device instance.
3798	* @param pHlp The output helpers.
3799	* @param pszArgs The arguments.
3800	*/
3801	static DECLCALLBACK(void) buslogicR3Info(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
3802	{
3803	static const char *apszModels[] = { "BusLogic BT-958D", "BusLogic BT-545C", "Adaptec AHA-1540B" };
3804	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3805	unsigned i;
3806	bool fVerbose = false;
3807
3808	/* Parse arguments. */
3809	if (pszArgs)
3810	fVerbose = strstr(pszArgs, "verbose") != NULL;
3811
3812	/* Show basic information. */
3813	pHlp->pfnPrintf(pHlp, "%s#%d: %s ",
3814	pDevIns->pReg->szName,
3815	pDevIns->iInstance,
3816	pThis->uDevType >= RT_ELEMENTS(apszModels) ? "Unknown model" : apszModels[pThis->uDevType]);
3817	if (pThis->uIsaIrq)
3818	pHlp->pfnPrintf(pHlp, "ISA I/O=%RTiop IRQ=%u ",
3819	pThis->IOISABase,
3820	pThis->uIsaIrq);
3821	else
3822	pHlp->pfnPrintf(pHlp, "PCI I/O=%04x ISA I/O=%RTiop MMIO=%RGp IRQ=%u ",
3823	PDMDevHlpIoPortGetMappingAddress(pDevIns, pThis->hIoPortsPci), pThis->IOISABase,
3824	PDMDevHlpMmioGetMappingAddress(pDevIns, pThis->hMmio),
3825	PCIDevGetInterruptLine(pDevIns->apPciDevs[0]));
3826	pHlp->pfnPrintf(pHlp, "RC=%RTbool R0=%RTbool\n", pDevIns->fRCEnabled, pDevIns->fR0Enabled);
3827
3828	/* Print mailbox state. */
3829	if (pThis->regStatus & BL_STAT_INREQ)
3830	pHlp->pfnPrintf(pHlp, "Mailbox not initialized\n");
3831	else
3832	pHlp->pfnPrintf(pHlp, "%u-bit mailbox with %u entries at %RGp (%d LUN CCBs)\n",
3833	pThis->fMbxIs24Bit ? 24 : 32, pThis->cMailbox,
3834	pThis->GCPhysAddrMailboxOutgoingBase,
3835	pThis->fMbxIs24Bit ? 8 : pThis->fExtendedLunCCBFormat ? 64 : 8);
3836
3837	/* Print register contents. */
3838	pHlp->pfnPrintf(pHlp, "Registers: STAT=%02x INTR=%02x GEOM=%02x\n",
3839	pThis->regStatus, pThis->regInterrupt, pThis->regGeometry);
3840
3841	/* Print miscellaneous state. */
3842	pHlp->pfnPrintf(pHlp, "HAC interrupts: %s\n",
3843	pThis->fIRQEnabled ? "on" : "off");
3844
3845	/* Print the current command, if any. */
3846	if (pThis->uOperationCode != 0xff )
3847	pHlp->pfnPrintf(pHlp, "Current command: %02X\n", pThis->uOperationCode);
3848
3849	/* Print the previous command, if any. */
3850	if (pThis->uPrevCmd != 0xff )
3851	pHlp->pfnPrintf(pHlp, "Last completed command: %02X\n", pThis->uPrevCmd);
3852
3853	if (fVerbose && (pThis->regStatus & BL_STAT_INREQ) == 0)
3854	{
3855	RTGCPHYS GCMailbox;
3856
3857	/* Dump the mailbox contents. */
3858	if (pThis->fMbxIs24Bit)
3859	{
3860	Mailbox24 Mbx24;
3861
3862	/* Outgoing mailbox, 24-bit format. */
3863	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase;
3864	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (24-bit) at %06X:\n", GCMailbox);
3865	for (i = 0; i < pThis->cMailbox; ++i)
3866	{
3867	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx24, sizeof(Mailbox24));
3868	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %06X action code %02X", i, ADDR_TO_U32(Mbx24.aPhysAddrCCB), Mbx24.uCmdState);
3869	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3870	GCMailbox += sizeof(Mailbox24);
3871	}
3872
3873	/* Incoming mailbox, 24-bit format. */
3874	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox24));
3875	pHlp->pfnPrintf(pHlp, " Incoming mailbox entries (24-bit) at %06X:\n", GCMailbox);
3876	for (i = 0; i < pThis->cMailbox; ++i)
3877	{
3878	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx24, sizeof(Mailbox24));
3879	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %06X completion code %02X", i, ADDR_TO_U32(Mbx24.aPhysAddrCCB), Mbx24.uCmdState);
3880	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxIncomingPositionCurrent == i ? " *" : "");
3881	GCMailbox += sizeof(Mailbox24);
3882	}
3883
3884	}
3885	else
3886	{
3887	Mailbox32 Mbx32;
3888
3889	/* Outgoing mailbox, 32-bit format. */
3890	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase;
3891	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (32-bit) at %08X:\n", (uint32_t)GCMailbox);
3892	for (i = 0; i < pThis->cMailbox; ++i)
3893	{
3894	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx32, sizeof(Mailbox32));
3895	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %08X action code %02X", i, Mbx32.u32PhysAddrCCB, Mbx32.u.out.uActionCode);
3896	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3897	GCMailbox += sizeof(Mailbox32);
3898	}
3899
3900	/* Incoming mailbox, 32-bit format. */
3901	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox32));
3902	pHlp->pfnPrintf(pHlp, " Incoming mailbox entries (32-bit) at %08X:\n", (uint32_t)GCMailbox);
3903	for (i = 0; i < pThis->cMailbox; ++i)
3904	{
3905	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx32, sizeof(Mailbox32));
3906	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %08X completion code %02X BTSTAT %02X SDSTAT %02X", i,
3907	Mbx32.u32PhysAddrCCB, Mbx32.u.in.uCompletionCode, Mbx32.u.in.uHostAdapterStatus, Mbx32.u.in.uTargetDeviceStatus);
3908	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxIncomingPositionCurrent == i ? " *" : "");
3909	GCMailbox += sizeof(Mailbox32);
3910	}
3911
3912	}
3913	}
3914	}
3915
3916	/* -=-=-=-=- Helper -=-=-=-=- */
3917
3918	/**
3919	* Checks if all asynchronous I/O is finished.
3920	*
3921	* Used by buslogicR3Reset, buslogicR3Suspend and buslogicR3PowerOff.
3922	*
3923	* @returns true if quiesced, false if busy.
3924	* @param pDevIns The device instance.
3925	*/
3926	static bool buslogicR3AllAsyncIOIsFinished(PPDMDEVINS pDevIns)
3927	{
3928	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3929
3930	for (uint32_t i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3931	{
3932	PBUSLOGICDEVICE pThisDevice = &pThisCC->aDeviceStates[i];
3933	if (pThisDevice->pDrvBase)
3934	{
3935	if (pThisDevice->cOutstandingRequests != 0)
3936	return false;
3937	}
3938	}
3939
3940	return true;
3941	}
3942
3943	/**
3944	* Callback employed by buslogicR3Suspend and buslogicR3PowerOff.
3945	*
3946	* @returns true if we've quiesced, false if we're still working.
3947	* @param pDevIns The device instance.
3948	*/
3949	static DECLCALLBACK(bool) buslogicR3IsAsyncSuspendOrPowerOffDone(PPDMDEVINS pDevIns)
3950	{
3951	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
3952	return false;
3953
3954	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3955	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
3956	return true;
3957	}
3958
3959	/**
3960	* Common worker for buslogicR3Suspend and buslogicR3PowerOff.
3961	*/
3962	static void buslogicR3SuspendOrPowerOff(PPDMDEVINS pDevIns)
3963	{
3964	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3965	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3966
3967	ASMAtomicWriteBool(&pThisCC->fSignalIdle, true);
3968	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
3969	PDMDevHlpSetAsyncNotification(pDevIns, buslogicR3IsAsyncSuspendOrPowerOffDone);
3970	else
3971	{
3972	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
3973	AssertMsg(!pThis->fNotificationSent, ("The PDM Queue should be empty at this point\n"));
3974	RT_NOREF(pThis);
3975	}
3976
3977	for (uint32_t i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3978	{
3979	PBUSLOGICDEVICE pThisDevice = &pThisCC->aDeviceStates[i];
3980	if (pThisDevice->pDrvMediaEx)
3981	pThisDevice->pDrvMediaEx->pfnNotifySuspend(pThisDevice->pDrvMediaEx);
3982	}
3983	}
3984
3985	/**
3986	* Suspend notification.
3987	*
3988	* @param pDevIns The device instance data.
3989	*/
3990	static DECLCALLBACK(void) buslogicR3Suspend(PPDMDEVINS pDevIns)
3991	{
3992	Log(("buslogicR3Suspend\n"));
3993	buslogicR3SuspendOrPowerOff(pDevIns);
3994	}
3995
3996	/**
3997	* Detach notification.
3998	*
3999	* One harddisk at one port has been unplugged.
4000	* The VM is suspended at this point.
4001	*
4002	* @param pDevIns The device instance.
4003	* @param iLUN The logical unit which is being detached.
4004	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
4005	*/
4006	static DECLCALLBACK(void) buslogicR3Detach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
4007	{
4008	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4009	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4010	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[iLUN];
4011	Log(("%s:\n", __FUNCTION__));
4012	RT_NOREF(fFlags);
4013
4014
4015	AssertMsg(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
4016	("BusLogic: Device does not support hotplugging\n"));
4017
4018	/*
4019	* Zero some important members.
4020	*/
4021	pThis->afDevicePresent[iLUN] = false;
4022	pDevice->fPresent = false;
4023	pDevice->pDrvBase = NULL;
4024	pDevice->pDrvMedia = NULL;
4025	pDevice->pDrvMediaEx = NULL;
4026	}
4027
4028	/**
4029	* Attach command.
4030	*
4031	* This is called when we change block driver.
4032	*
4033	* @returns VBox status code.
4034	* @param pDevIns The device instance.
4035	* @param iLUN The logical unit which is being detached.
4036	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
4037	*/
4038	static DECLCALLBACK(int) buslogicR3Attach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
4039	{
4040	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4041	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4042	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[iLUN];
4043	int rc;
4044
4045	AssertMsgReturn(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
4046	("BusLogic: Device does not support hotplugging\n"),
4047	VERR_INVALID_PARAMETER);
4048
4049	/* the usual paranoia */
4050	AssertRelease(!pDevice->pDrvBase);
4051	AssertRelease(!pDevice->pDrvMedia);
4052	AssertRelease(!pDevice->pDrvMediaEx);
4053	Assert(pDevice->iLUN == iLUN);
4054
4055	/*
4056	* Try attach the SCSI driver and get the interfaces,
4057	* required as well as optional.
4058	*/
4059	rc = PDMDevHlpDriverAttach(pDevIns, pDevice->iLUN, &pDevice->IBase, &pDevice->pDrvBase, NULL);
4060	if (RT_SUCCESS(rc))
4061	{
4062	/* Query the media interface. */
4063	pDevice->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIA);
4064	AssertMsgReturn(RT_VALID_PTR(pDevice->pDrvMedia),
4065	("BusLogic configuration error: LUN#%d misses the basic media interface!\n", pDevice->iLUN),
4066	VERR_PDM_MISSING_INTERFACE);
4067
4068	/* Get the extended media interface. */
4069	pDevice->pDrvMediaEx = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIAEX);
4070	AssertMsgReturn(RT_VALID_PTR(pDevice->pDrvMediaEx),
4071	("BusLogic configuration error: LUN#%d misses the extended media interface!\n", pDevice->iLUN),
4072	VERR_PDM_MISSING_INTERFACE);
4073
4074	rc = pDevice->pDrvMediaEx->pfnIoReqAllocSizeSet(pDevice->pDrvMediaEx, sizeof(BUSLOGICREQ));
4075	AssertMsgRCReturn(rc, ("BusLogic configuration error: LUN#%u: Failed to set I/O request size!", pDevice->iLUN),
4076	rc);
4077
4078	pThis->afDevicePresent[iLUN] = true;
4079	pDevice->fPresent = true;
4080	}
4081	else
4082	AssertMsgFailed(("Failed to attach LUN#%d. rc=%Rrc\n", pDevice->iLUN, rc));
4083
4084	if (RT_FAILURE(rc))
4085	{
4086	pThis->afDevicePresent[iLUN] = false;
4087	pDevice->fPresent = false;
4088	pDevice->pDrvBase = NULL;
4089	pDevice->pDrvMedia = NULL;
4090	pDevice->pDrvMediaEx = NULL;
4091	}
4092	return rc;
4093	}
4094
4095	/**
4096	* Callback employed by buslogicR3Reset.
4097	*
4098	* @returns true if we've quiesced, false if we're still working.
4099	* @param pDevIns The device instance.
4100	*/
4101	static DECLCALLBACK(bool) buslogicR3IsAsyncResetDone(PPDMDEVINS pDevIns)
4102	{
4103	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4104	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4105
4106	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4107	return false;
4108	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
4109
4110	buslogicR3HwReset(pDevIns, pThis, true);
4111	return true;
4112	}
4113
4114	/**
4115	* @copydoc FNPDMDEVRESET
4116	*/
4117	static DECLCALLBACK(void) buslogicR3Reset(PPDMDEVINS pDevIns)
4118	{
4119	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4120	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4121
4122	ASMAtomicWriteBool(&pThisCC->fSignalIdle, true);
4123	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4124	PDMDevHlpSetAsyncNotification(pDevIns, buslogicR3IsAsyncResetDone);
4125	else
4126	{
4127	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
4128	buslogicR3HwReset(pDevIns, pThis, true);
4129	}
4130	}
4131
4132	/**
4133	* Poweroff notification.
4134	*
4135	* @param pDevIns Pointer to the device instance
4136	*/
4137	static DECLCALLBACK(void) buslogicR3PowerOff(PPDMDEVINS pDevIns)
4138	{
4139	Log(("buslogicR3PowerOff\n"));
4140	buslogicR3SuspendOrPowerOff(pDevIns);
4141	}
4142
4143	/**
4144	* Destroy a driver instance.
4145	*
4146	* Most VM resources are freed by the VM. This callback is provided so that any non-VM
4147	* resources can be freed correctly.
4148	*
4149	* @param pDevIns The device instance data.
4150	*/
4151	static DECLCALLBACK(int) buslogicR3Destruct(PPDMDEVINS pDevIns)
4152	{
4153	PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
4154	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4155
4156	PDMDevHlpCritSectDelete(pDevIns, &pThis->CritSectIntr);
4157
4158	if (pThis->hEvtProcess != NIL_SUPSEMEVENT)
4159	{
4160	PDMDevHlpSUPSemEventClose(pDevIns, pThis->hEvtProcess);
4161	pThis->hEvtProcess = NIL_SUPSEMEVENT;
4162	}
4163
4164	return VINF_SUCCESS;
4165	}
4166
4167	/**
4168	* @interface_method_impl{PDMDEVREG,pfnConstruct}
4169	*/
4170	static DECLCALLBACK(int) buslogicR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
4171	{
4172	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
4173	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4174	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4175	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
4176
4177	/*
4178	* Init instance data (do early because of constructor).
4179	*/
4180	pThis->hMmio = NIL_IOMMMIOHANDLE;
4181	pThis->hIoPortsIsa = NIL_IOMIOPORTHANDLE;
4182	pThis->hIoPortsPci = NIL_IOMIOPORTHANDLE;
4183	pThisCC->pDevIns = pDevIns;
4184	pThisCC->IBase.pfnQueryInterface = buslogicR3StatusQueryInterface;
4185	pThisCC->ILeds.pfnQueryStatusLed = buslogicR3StatusQueryStatusLed;
4186
4187	PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
4188	PDMPCIDEV_ASSERT_VALID(pDevIns, pPciDev);
4189
4190	PDMPciDevSetVendorId(pPciDev, 0x104b); /* BusLogic */
4191	PDMPciDevSetDeviceId(pPciDev, 0x1040); /* BT-958 */
4192	PDMPciDevSetCommand(pPciDev, PCI_COMMAND_IOACCESS \| PCI_COMMAND_MEMACCESS);
4193	PDMPciDevSetRevisionId(pPciDev, 0x01);
4194	PDMPciDevSetClassProg(pPciDev, 0x00); /* SCSI */
4195	PDMPciDevSetClassSub(pPciDev, 0x00); /* SCSI */
4196	PDMPciDevSetClassBase(pPciDev, 0x01); /* Mass storage */
4197	PDMPciDevSetBaseAddress(pPciDev, 0, true /IO/, false /Pref/, false /64-bit/, 0x00000000);
4198	PDMPciDevSetBaseAddress(pPciDev, 1, false /IO/, false /Pref/, false /64-bit/, 0x00000000);
4199	PDMPciDevSetSubSystemVendorId(pPciDev, 0x104b);
4200	PDMPciDevSetSubSystemId(pPciDev, 0x1040);
4201	PDMPciDevSetInterruptLine(pPciDev, 0x00);
4202	PDMPciDevSetInterruptPin(pPciDev, 0x01);
4203
4204	/*
4205	* Validate and read configuration.
4206	*/
4207	PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns, "Bootable\|" /* Keep it for legacy configs, even though it doesn't do anything anymore, see @bugref{4841}. */
4208	"AdapterType\|"
4209	"ISACompat",
4210	"");
4211
4212	/* Figure out the emulated device type. */
4213	char szCfgStr[16];
4214	int rc = pHlp->pfnCFGMQueryStringDef(pCfg, "AdapterType", szCfgStr, sizeof(szCfgStr), "BT-958D");
4215	if (RT_FAILURE(rc))
4216	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read AdapterType as string"));
4217	Log(("%s: AdapterType=%s\n", __FUNCTION__, szCfgStr));
4218
4219	/* Grok the AdapterType setting. */
4220	if (!strcmp(szCfgStr, "BT-958D")) /* Default PCI device, 32-bit and 24-bit addressing. */
4221	{
4222	pThis->uDevType = DEV_BT_958D;
4223	pThis->uDefaultISABaseCode = ISA_BASE_DISABLED;
4224	}
4225	else if (!strcmp(szCfgStr, "BT-545C")) /* ISA device, 24-bit addressing only. */
4226	{
4227	pThis->uDevType = DEV_BT_545C;
4228	pThis->uIsaIrq = 11;
4229	}
4230	else if (!strcmp(szCfgStr, "AHA-1540B")) /* Competitor ISA device. */
4231	{
4232	pThis->uDevType = DEV_AHA_1540B;
4233	pThis->uIsaIrq = 11;
4234	}
4235	else
4236	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
4237	N_("BusLogic configuration error: invalid AdapterType setting"));
4238
4239	/* Only the first instance defaults to having the ISA compatibility ports enabled. */
4240	if (iInstance == 0)
4241	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "ISACompat", szCfgStr, sizeof(szCfgStr), "Alternate");
4242	else
4243	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "ISACompat", szCfgStr, sizeof(szCfgStr), "Disabled");
4244	if (RT_FAILURE(rc))
4245	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read ISACompat as string"));
4246	Log(("%s: ISACompat=%s\n", __FUNCTION__, szCfgStr));
4247
4248	/* Grok the ISACompat setting. */
4249	if (!strcmp(szCfgStr, "Disabled"))
4250	pThis->uDefaultISABaseCode = ISA_BASE_DISABLED;
4251	else if (!strcmp(szCfgStr, "Primary"))
4252	pThis->uDefaultISABaseCode = 0; /* I/O base at 330h. */
4253	else if (!strcmp(szCfgStr, "Alternate"))
4254	pThis->uDefaultISABaseCode = 1; /* I/O base at 334h. */
4255	else
4256	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
4257	N_("BusLogic configuration error: invalid ISACompat setting"));
4258
4259	/*
4260	* Register the PCI device and its I/O regions if applicable.
4261	*/
4262	if (!pThis->uIsaIrq)
4263	{
4264	rc = PDMDevHlpPCIRegister(pDevIns, pPciDev);
4265	AssertRCReturn(rc, rc);
4266
4267	rc = PDMDevHlpPCIIORegionCreateIo(pDevIns, 0 /iPciRegion/, 32 /cPorts/,
4268	buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/,
4269	"BusLogic PCI", NULL /paExtDescs/, &pThis->hIoPortsPci);
4270	AssertRCReturn(rc, rc);
4271
4272	rc = PDMDevHlpPCIIORegionCreateMmio(pDevIns, 1 /iPciRegion/, 32 /cbRegion/, PCI_ADDRESS_SPACE_MEM,
4273	buslogicMMIOWrite, buslogicMMIORead, NULL /pvUser/,
4274	IOMMMIO_FLAGS_READ_PASSTHRU \| IOMMMIO_FLAGS_WRITE_PASSTHRU,
4275	"BusLogic MMIO", &pThis->hMmio);
4276	AssertRCReturn(rc, rc);
4277	}
4278
4279	/* Set up the compatibility I/O range. */
4280	rc = PDMDevHlpIoPortCreate(pDevIns, 4 /cPorts/, NULL /pPciDev/, UINT32_MAX /iPciRegion/,
4281	buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/,
4282	"BusLogic ISA", NULL /paExtDescs/, &pThis->hIoPortsIsa);
4283	AssertRCReturn(rc, rc);
4284
4285	rc = buslogicR3RegisterISARange(pDevIns, pThis, pThis->uDefaultISABaseCode);
4286	if (RT_FAILURE(rc))
4287	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register ISA I/O handlers"));
4288
4289
4290	/* Init the interrupt critsect. */
4291	rc = PDMDevHlpCritSectInit(pDevIns, &pThis->CritSectIntr, RT_SRC_POS, "BusLogic-Intr#%u", pDevIns->iInstance);
4292	if (RT_FAILURE(rc))
4293	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic: cannot create critical section"));
4294
4295	/*
4296	* Create event semaphore and worker thread.
4297	*/
4298	rc = PDMDevHlpSUPSemEventCreate(pDevIns, &pThis->hEvtProcess);
4299	if (RT_FAILURE(rc))
4300	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4301	N_("BusLogic: Failed to create SUP event semaphore"));
4302
4303	char szDevTag[20];
4304	RTStrPrintf(szDevTag, sizeof(szDevTag), "BUSLOGIC-%u", iInstance);
4305
4306	rc = PDMDevHlpThreadCreate(pDevIns, &pThisCC->pThreadWrk, pThis, buslogicR3Worker,
4307	buslogicR3WorkerWakeUp, 0, RTTHREADTYPE_IO, szDevTag);
4308	if (RT_FAILURE(rc))
4309	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4310	N_("BusLogic: Failed to create worker thread %s"), szDevTag);
4311
4312	/* Initialize per device state. */
4313	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
4314	{
4315	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
4316
4317	/* Initialize static parts of the device. */
4318	pDevice->iLUN = i;
4319	pDevice->pDevIns = pDevIns;
4320	pDevice->Led.u32Magic = PDMLED_MAGIC;
4321	pDevice->IBase.pfnQueryInterface = buslogicR3DeviceQueryInterface;
4322	pDevice->IMediaPort.pfnQueryDeviceLocation = buslogicR3QueryDeviceLocation;
4323	pDevice->IMediaExPort.pfnIoReqCompleteNotify = buslogicR3IoReqCompleteNotify;
4324	pDevice->IMediaExPort.pfnIoReqCopyFromBuf = buslogicR3IoReqCopyFromBuf;
4325	pDevice->IMediaExPort.pfnIoReqCopyToBuf = buslogicR3IoReqCopyToBuf;
4326	pDevice->IMediaExPort.pfnIoReqQueryBuf = NULL;
4327	pDevice->IMediaExPort.pfnIoReqQueryDiscardRanges = NULL;
4328	pDevice->IMediaExPort.pfnIoReqStateChanged = buslogicR3IoReqStateChanged;
4329	pDevice->IMediaExPort.pfnMediumEjected = buslogicR3MediumEjected;
4330	pDevice->ILed.pfnQueryStatusLed = buslogicR3DeviceQueryStatusLed;
4331	RTStrPrintf(pDevice->szName, sizeof(pDevice->szName), "Device%u", i);
4332
4333	/* Attach SCSI driver. */
4334	rc = PDMDevHlpDriverAttach(pDevIns, pDevice->iLUN, &pDevice->IBase, &pDevice->pDrvBase, pDevice->szName);
4335	if (RT_SUCCESS(rc))
4336	{
4337	/* Query the media interface. */
4338	pDevice->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIA);
4339	AssertMsgReturn(RT_VALID_PTR(pDevice->pDrvMedia),
4340	("Buslogic configuration error: LUN#%d misses the basic media interface!\n", pDevice->iLUN),
4341	VERR_PDM_MISSING_INTERFACE);
4342
4343	/* Get the extended media interface. */
4344	pDevice->pDrvMediaEx = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIAEX);
4345	AssertMsgReturn(RT_VALID_PTR(pDevice->pDrvMediaEx),
4346	("Buslogic configuration error: LUN#%d misses the extended media interface!\n", pDevice->iLUN),
4347	VERR_PDM_MISSING_INTERFACE);
4348
4349	rc = pDevice->pDrvMediaEx->pfnIoReqAllocSizeSet(pDevice->pDrvMediaEx, sizeof(BUSLOGICREQ));
4350	if (RT_FAILURE(rc))
4351	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4352	N_("Buslogic configuration error: LUN#%u: Failed to set I/O request size!"),
4353	pDevice->iLUN);
4354
4355	pThis->afDevicePresent[i] = true;
4356	pDevice->fPresent = true;
4357	}
4358	else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
4359	{
4360	pThis->afDevicePresent[i] = false;
4361	pDevice->fPresent = false;
4362	pDevice->pDrvBase = NULL;
4363	pDevice->pDrvMedia = NULL;
4364	pDevice->pDrvMediaEx = NULL;
4365	rc = VINF_SUCCESS;
4366	Log(("BusLogic: no driver attached to device %s\n", pDevice->szName));
4367	}
4368	else
4369	{
4370	AssertLogRelMsgFailed(("BusLogic: Failed to attach %s\n", pDevice->szName));
4371	return rc;
4372	}
4373	}
4374
4375	/*
4376	* Attach status driver (optional).
4377	*/
4378	PPDMIBASE pBase;
4379	rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThisCC->IBase, &pBase, "Status Port");
4380	if (RT_SUCCESS(rc))
4381	{
4382	pThisCC->pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
4383	pThisCC->pMediaNotify = PDMIBASE_QUERY_INTERFACE(pBase, PDMIMEDIANOTIFY);
4384	}
4385	else
4386	AssertMsgReturn(rc == VERR_PDM_NO_ATTACHED_DRIVER, ("Failed to attach to status driver. rc=%Rrc\n", rc),
4387	PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot attach to status driver")));
4388
4389	rc = PDMDevHlpSSMRegisterEx(pDevIns, BUSLOGIC_SAVED_STATE_MINOR_VERSION, sizeof(*pThis), NULL,
4390	NULL, buslogicR3LiveExec, NULL,
4391	NULL, buslogicR3SaveExec, NULL,
4392	NULL, buslogicR3LoadExec, buslogicR3LoadDone);
4393	if (RT_FAILURE(rc))
4394	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register save state handlers"));
4395
4396	/*
4397	* Register the debugger info callback.
4398	*/
4399	char szTmp[128];
4400	RTStrPrintf(szTmp, sizeof(szTmp), "%s%d", pDevIns->pReg->szName, pDevIns->iInstance);
4401	PDMDevHlpDBGFInfoRegister(pDevIns, szTmp, "BusLogic HBA info", buslogicR3Info);
4402
4403	rc = buslogicR3HwReset(pDevIns, pThis, true);
4404	AssertMsgRC(rc, ("hardware reset of BusLogic host adapter failed rc=%Rrc\n", rc));
4405
4406	return rc;
4407	}
4408
4409	#else /* !IN_RING3 */
4410
4411	/**
4412	* @callback_method_impl{PDMDEVREGR0,pfnConstruct}
4413	*/
4414	static DECLCALLBACK(int) buslogicRZConstruct(PPDMDEVINS pDevIns)
4415	{
4416	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
4417	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4418
4419	if (!pThis->uIsaIrq)
4420	{
4421	int rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortsPci, buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/);
4422	AssertRCReturn(rc, rc);
4423
4424	rc = PDMDevHlpMmioSetUpContext(pDevIns, pThis->hMmio, buslogicMMIOWrite, buslogicMMIORead, NULL /pvUser/);
4425	AssertRCReturn(rc, rc);
4426	}
4427
4428	int rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortsIsa, buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/);
4429	AssertRCReturn(rc, rc);
4430
4431	return VINF_SUCCESS;
4432	}
4433
4434
4435	#endif /* !IN_RING3 */
4436
4437	/**
4438	* The device registration structure.
4439	*/
4440	const PDMDEVREG g_DeviceBusLogic =
4441	{
4442	/* .u32Version = */ PDM_DEVREG_VERSION,
4443	/* .uReserved0 = */ 0,
4444	/* .szName = */ "buslogic",
4445	/* .fFlags = */ PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RZ \| PDM_DEVREG_FLAGS_NEW_STYLE
4446	\| PDM_DEVREG_FLAGS_FIRST_SUSPEND_NOTIFICATION \| PDM_DEVREG_FLAGS_FIRST_POWEROFF_NOTIFICATION
4447	\| PDM_DEVREG_FLAGS_FIRST_RESET_NOTIFICATION,
4448	/* .fClass = */ PDM_DEVREG_CLASS_STORAGE,
4449	/* .cMaxInstances = */ ~0U,
4450	/* .uSharedVersion = */ 42,
4451	/* .cbInstanceShared = */ sizeof(BUSLOGIC),
4452	/* .cbInstanceCC = */ sizeof(BUSLOGICCC),
4453	/* .cbInstanceRC = */ sizeof(BUSLOGICRC),
4454	/* .cMaxPciDevices = */ 1,
4455	/* .cMaxMsixVectors = */ 0,
4456	/* .pszDescription = */ "BusLogic BT-958 SCSI host adapter.\n",
4457	#if defined(IN_RING3)
4458	/* .pszRCMod = */ "VBoxDDRC.rc",
4459	/* .pszR0Mod = */ "VBoxDDR0.r0",
4460	/* .pfnConstruct = */ buslogicR3Construct,
4461	/* .pfnDestruct = */ buslogicR3Destruct,
4462	/* .pfnRelocate = */ NULL,
4463	/* .pfnMemSetup = */ NULL,
4464	/* .pfnPowerOn = */ NULL,
4465	/* .pfnReset = */ buslogicR3Reset,
4466	/* .pfnSuspend = */ buslogicR3Suspend,
4467	/* .pfnResume = */ NULL,
4468	/* .pfnAttach = */ buslogicR3Attach,
4469	/* .pfnDetach = */ buslogicR3Detach,
4470	/* .pfnQueryInterface = */ NULL,
4471	/* .pfnInitComplete = */ NULL,
4472	/* .pfnPowerOff = */ buslogicR3PowerOff,
4473	/* .pfnSoftReset = */ NULL,
4474	/* .pfnReserved0 = */ NULL,
4475	/* .pfnReserved1 = */ NULL,
4476	/* .pfnReserved2 = */ NULL,
4477	/* .pfnReserved3 = */ NULL,
4478	/* .pfnReserved4 = */ NULL,
4479	/* .pfnReserved5 = */ NULL,
4480	/* .pfnReserved6 = */ NULL,
4481	/* .pfnReserved7 = */ NULL,
4482	#elif defined(IN_RING0)
4483	/* .pfnEarlyConstruct = */ NULL,
4484	/* .pfnConstruct = */ buslogicRZConstruct,
4485	/* .pfnDestruct = */ NULL,
4486	/* .pfnFinalDestruct = */ NULL,
4487	/* .pfnRequest = */ NULL,
4488	/* .pfnReserved0 = */ NULL,
4489	/* .pfnReserved1 = */ NULL,
4490	/* .pfnReserved2 = */ NULL,
4491	/* .pfnReserved3 = */ NULL,
4492	/* .pfnReserved4 = */ NULL,
4493	/* .pfnReserved5 = */ NULL,
4494	/* .pfnReserved6 = */ NULL,
4495	/* .pfnReserved7 = */ NULL,
4496	#elif defined(IN_RC)
4497	/* .pfnConstruct = */ buslogicRZConstruct,
4498	/* .pfnReserved0 = */ NULL,
4499	/* .pfnReserved1 = */ NULL,
4500	/* .pfnReserved2 = */ NULL,
4501	/* .pfnReserved3 = */ NULL,
4502	/* .pfnReserved4 = */ NULL,
4503	/* .pfnReserved5 = */ NULL,
4504	/* .pfnReserved6 = */ NULL,
4505	/* .pfnReserved7 = */ NULL,
4506	#else
4507	# error "Not in IN_RING3, IN_RING0 or IN_RC!"
4508	#endif
4509	/* .u32VersionEnd = */ PDM_DEVREG_VERSION
4510	};
4511
4512	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Storage/DevBusLogic.cpp@ 91487

Download in other formats: