Index: trunk/src/VBox/Devices/Storage/DevBusLogic.cpp
===================================================================
--- trunk/src/VBox/Devices/Storage/DevBusLogic.cpp	(revision 48189)
+++ trunk/src/VBox/Devices/Storage/DevBusLogic.cpp	(revision 48190)
@@ -52,5 +52,5 @@
 
 /** Size of the command buffer. */
-#define BUSLOGIC_COMMAND_SIZE_MAX 5
+#define BUSLOGIC_COMMAND_SIZE_MAX 64
 
 /** Size of the reply buffer. */
@@ -65,5 +65,5 @@
 
 /** State saved version. */
-#define BUSLOGIC_SAVED_STATE_MINOR_VERSION 3
+#define BUSLOGIC_SAVED_STATE_MINOR_VERSION 4
 
 /** Saved state version before the suspend on error feature was implemented. */
@@ -71,4 +71,9 @@
 /** Saved state version before 24-bit mailbox support was implemented. */
 #define BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX     2
+/** Saved state version before command buffer size was raised. */
+#define BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE  3
+
+/** Command buffer size in old saved states. */
+#define BUSLOGIC_COMMAND_SIZE_OLD 5
 
 /** The duration of software-initiated reset (in nano seconds).
@@ -1180,17 +1185,22 @@
     int rc = PDMCritSectEnter(&pBusLogic->CritSectIntr, VINF_SUCCESS);
     AssertRC(rc);
-    RTGCPHYS GCPhysAddrCCB = pTaskState->MailboxGuest.u32PhysAddrCCB;
+
     RTGCPHYS GCPhysAddrMailboxIncoming = pBusLogic->GCPhysAddrMailboxIncomingBase
                                        + (   pBusLogic->uMailboxIncomingPositionCurrent
                                           * (pTaskState->fIs24Bit ? sizeof(Mailbox24) : sizeof(Mailbox32)) );
-    LogFlowFunc(("Completing CCB %RGp hstat=%u, dstat=%u, outgoing mailbox at %RGp\n", GCPhysAddrCCB, 
-                 uHostAdapterStatus, uDeviceStatus, GCPhysAddrMailboxIncoming));
-
-    /* Update CCB. */
-    pTaskState->CommandControlBlockGuest.c.uHostAdapterStatus = uHostAdapterStatus;
-    pTaskState->CommandControlBlockGuest.c.uDeviceStatus      = uDeviceStatus;
-    /* Rewrite CCB up to the CDB; perhaps more than necessary. */
-    PDMDevHlpPCIPhysWrite(pBusLogic->CTX_SUFF(pDevIns), GCPhysAddrCCB,
-                          &pTaskState->CommandControlBlockGuest, RT_OFFSETOF(CCBC, abCDB));
+
+    if (uMailboxCompletionCode != BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND)
+    {
+        RTGCPHYS GCPhysAddrCCB = pTaskState->MailboxGuest.u32PhysAddrCCB;
+        LogFlowFunc(("Completing CCB %RGp hstat=%u, dstat=%u, outgoing mailbox at %RGp\n", GCPhysAddrCCB, 
+                     uHostAdapterStatus, uDeviceStatus, GCPhysAddrMailboxIncoming));
+
+        /* Update CCB. */
+        pTaskState->CommandControlBlockGuest.c.uHostAdapterStatus = uHostAdapterStatus;
+        pTaskState->CommandControlBlockGuest.c.uDeviceStatus      = uDeviceStatus;
+        /* Rewrite CCB up to the CDB; perhaps more than necessary. */
+        PDMDevHlpPCIPhysWrite(pBusLogic->CTX_SUFF(pDevIns), GCPhysAddrCCB,
+                              &pTaskState->CommandControlBlockGuest, RT_OFFSETOF(CCBC, abCDB));
+    }
 
 # ifdef RT_STRICT
@@ -2926,4 +2936,28 @@
 }
 
+static int buslogicR3DeviceSCSIRequestAbort(PBUSLOGIC pBusLogic, PBUSLOGICTASKSTATE pTaskState)
+{
+    int             rc = VINF_SUCCESS;
+    uint8_t         uTargetIdCCB;
+    PBUSLOGICDEVICE pTargetDevice;
+    RTGCPHYS        GCPhysAddrCCB = (RTGCPHYS)pTaskState->MailboxGuest.u32PhysAddrCCB;
+
+    PDMDevHlpPhysRead(pBusLogic->CTX_SUFF(pDevIns), GCPhysAddrCCB,
+                      &pTaskState->CommandControlBlockGuest, sizeof(CCB32));
+
+    uTargetIdCCB = pTaskState->fIs24Bit ? pTaskState->CommandControlBlockGuest.o.uTargetId : pTaskState->CommandControlBlockGuest.n.uTargetId;
+    pTargetDevice = &pBusLogic->aDeviceStates[uTargetIdCCB];
+    pTaskState->CTX_SUFF(pTargetDevice) = pTargetDevice;
+
+    buslogicR3SendIncomingMailbox(pBusLogic, pTaskState,
+                                  BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED,
+                                  BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
+                                  BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND);
+
+    RTMemCacheFree(pBusLogic->hTaskCache, pTaskState);
+
+    return rc;
+}
+
 /**
  * Read a mailbox from guest memory. Convert 24-bit mailboxes to
@@ -3023,5 +3057,6 @@
     else if (pTaskState->MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND)
     {
-        AssertMsgFailed(("Not implemented yet\n"));
+        LogFlow(("Aborting mailbox\n"));
+        rc = buslogicR3DeviceSCSIRequestAbort(pBusLogic, pTaskState);
     }
     else
@@ -3247,5 +3282,8 @@
     SSMR3GetMem   (pSSM, &pBusLogic->LocalRam, sizeof(pBusLogic->LocalRam));
     SSMR3GetU8    (pSSM, &pBusLogic->uOperationCode);
-    SSMR3GetMem   (pSSM, &pBusLogic->aCommandBuffer, sizeof(pBusLogic->aCommandBuffer));
+    if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE)
+        SSMR3GetMem   (pSSM, &pBusLogic->aCommandBuffer, sizeof(pBusLogic->aCommandBuffer));
+    else
+        SSMR3GetMem   (pSSM, &pBusLogic->aCommandBuffer, BUSLOGIC_COMMAND_SIZE_OLD);
     SSMR3GetU8    (pSSM, &pBusLogic->iParameter);
     SSMR3GetU8    (pSSM, &pBusLogic->cbCommandParametersLeft);
