DevATA.cpp@ 96450

Last change on this file since 96450 was 96407, checked in by vboxsync, 3 years ago
scm copyright and license note update
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 333.3 KB

Line
1	/* $Id: DevATA.cpp 96407 2022-08-22 17:43:14Z vboxsync $ */
2	/** @file
3	* VBox storage devices: ATA/ATAPI controller device (disk and cdrom).
4	*/
5
6	/*
7	* Copyright (C) 2006-2022 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#define LOG_GROUP LOG_GROUP_DEV_IDE
33	#include <VBox/vmm/pdmdev.h>
34	#include <VBox/vmm/pdmstorageifs.h>
35	#include <iprt/assert.h>
36	#include <iprt/string.h>
37	#ifdef IN_RING3
38	# include <iprt/mem.h>
39	# include <iprt/mp.h>
40	# include <iprt/semaphore.h>
41	# include <iprt/thread.h>
42	# include <iprt/time.h>
43	# include <iprt/uuid.h>
44	#endif /* IN_RING3 */
45	#include <iprt/critsect.h>
46	#include <iprt/asm.h>
47	#include <VBox/vmm/stam.h>
48	#include <VBox/vmm/mm.h>
49	#include <VBox/vmm/pgm.h>
50
51	#include <VBox/sup.h>
52	#include <VBox/AssertGuest.h>
53	#include <VBox/scsi.h>
54	#include <VBox/scsiinline.h>
55	#include <VBox/ata.h>
56
57	#include "ATAPIPassthrough.h"
58	#include "VBoxDD.h"
59
60
61	/*********************************************************************************************************************************
62	* Defined Constants And Macros *
63	*********************************************************************************************************************************/
64	/** Temporary instrumentation for tracking down potential virtual disk
65	* write performance issues. */
66	#undef VBOX_INSTRUMENT_DMA_WRITES
67
68	/** @name The SSM saved state versions.
69	* @{
70	*/
71	/** The current saved state version. */
72	#define ATA_SAVED_STATE_VERSION 21
73	/** Saved state version without iCurLBA for ATA commands. */
74	#define ATA_SAVED_STATE_VERSION_WITHOUT_ATA_ILBA 20
75	/** The saved state version used by VirtualBox 3.0.
76	* This lacks the config part and has the type at the and. */
77	#define ATA_SAVED_STATE_VERSION_VBOX_30 19
78	#define ATA_SAVED_STATE_VERSION_WITH_BOOL_TYPE 18
79	#define ATA_SAVED_STATE_VERSION_WITHOUT_FULL_SENSE 16
80	#define ATA_SAVED_STATE_VERSION_WITHOUT_EVENT_STATUS 17
81	/** @} */
82
83	/** Values read from an empty (with no devices attached) ATA bus. */
84	#define ATA_EMPTY_BUS_DATA 0x7F
85	#define ATA_EMPTY_BUS_DATA_32 0x7F7F7F7F
86
87	/**
88	* Maximum number of sectors to transfer in a READ/WRITE MULTIPLE request.
89	* Set to 1 to disable multi-sector read support. According to the ATA
90	* specification this must be a power of 2 and it must fit in an 8 bit
91	* value. Thus the only valid values are 1, 2, 4, 8, 16, 32, 64 and 128.
92	*/
93	#define ATA_MAX_MULT_SECTORS 128
94
95	/** The maxium I/O buffer size (for sanity). */
96	#define ATA_MAX_SECTOR_SIZE _4K
97	/** The maxium I/O buffer size (for sanity). */
98	#define ATA_MAX_IO_BUFFER_SIZE (ATA_MAX_MULT_SECTORS * ATA_MAX_SECTOR_SIZE)
99
100	/** Mask to be applied to all indexing into ATACONTROLLER::aIfs. */
101	#define ATA_SELECTED_IF_MASK 1
102
103	/**
104	* Fastest PIO mode supported by the drive.
105	*/
106	#define ATA_PIO_MODE_MAX 4
107	/**
108	* Fastest MDMA mode supported by the drive.
109	*/
110	#define ATA_MDMA_MODE_MAX 2
111	/**
112	* Fastest UDMA mode supported by the drive.
113	*/
114	#define ATA_UDMA_MODE_MAX 6
115
116	/** ATAPI sense info size. */
117	#define ATAPI_SENSE_SIZE 64
118
119	/** The maximum number of release log entries per device. */
120	#define MAX_LOG_REL_ERRORS 1024
121
122	/* MediaEventStatus */
123	#define ATA_EVENT_STATUS_UNCHANGED 0 /*< medium event status not changed /
124	#define ATA_EVENT_STATUS_MEDIA_EJECT_REQUESTED 1 /*< medium eject requested (eject button pressed) /
125	#define ATA_EVENT_STATUS_MEDIA_NEW 2 /*< new medium inserted /
126	#define ATA_EVENT_STATUS_MEDIA_REMOVED 3 /*< medium removed /
127	#define ATA_EVENT_STATUS_MEDIA_CHANGED 4 /*< medium was removed + new medium was inserted /
128
129	/* Media track type */
130	#define ATA_MEDIA_TYPE_UNKNOWN 0 /*< unknown CD type /
131	#define ATA_MEDIA_NO_DISC 0x70 /*< Door closed, no medium /
132
133	/** @defgroup grp_piix3atabmdma PIIX3 ATA Bus Master DMA
134	* @{
135	*/
136
137	/** @name BM_STATUS
138	* @{
139	*/
140	/** Currently performing a DMA operation. */
141	#define BM_STATUS_DMAING 0x01
142	/** An error occurred during the DMA operation. */
143	#define BM_STATUS_ERROR 0x02
144	/** The DMA unit has raised the IDE interrupt line. */
145	#define BM_STATUS_INT 0x04
146	/** User-defined bit 0, commonly used to signal that drive 0 supports DMA. */
147	#define BM_STATUS_D0DMA 0x20
148	/** User-defined bit 1, commonly used to signal that drive 1 supports DMA. */
149	#define BM_STATUS_D1DMA 0x40
150	/** @} */
151
152	/** @name BM_CMD
153	* @{
154	*/
155	/** Start the DMA operation. */
156	#define BM_CMD_START 0x01
157	/** Data transfer direction: from device to memory if set. */
158	#define BM_CMD_WRITE 0x08
159	/** @} */
160
161	/** Number of I/O ports per bus-master DMA controller. */
162	#define BM_DMA_CTL_IOPORTS 8
163	/** Mask corresponding to BM_DMA_CTL_IOPORTS. */
164	#define BM_DMA_CTL_IOPORTS_MASK 7
165	/** Shift count corresponding to BM_DMA_CTL_IOPORTS. */
166	#define BM_DMA_CTL_IOPORTS_SHIFT 3
167
168	/** @} */
169
170	#define ATADEVSTATE_2_DEVINS(pIf) ( (pIf)->CTX_SUFF(pDevIns) )
171	#define CONTROLLER_2_DEVINS(pController) ( (pController)->CTX_SUFF(pDevIns) )
172
173
174	/*********************************************************************************************************************************
175	* Structures and Typedefs *
176	*********************************************************************************************************************************/
177	/** @defgroup grp_piix3atabmdma PIIX3 ATA Bus Master DMA
178	* @{
179	*/
180	/** PIIX3 Bus Master DMA unit state. */
181	typedef struct BMDMAState
182	{
183	/** Command register. */
184	uint8_t u8Cmd;
185	/** Status register. */
186	uint8_t u8Status;
187	/** Explicit alignment padding. */
188	uint8_t abAlignment[2];
189	/** Address of the MMIO region in the guest's memory space. */
190	RTGCPHYS32 GCPhysAddr;
191	} BMDMAState;
192
193	/** PIIX3 Bus Master DMA descriptor entry. */
194	typedef struct BMDMADesc
195	{
196	/** Address of the DMA source/target buffer. */
197	RTGCPHYS32 GCPhysBuffer;
198	/** Size of the DMA source/target buffer. */
199	uint32_t cbBuffer;
200	} BMDMADesc;
201	/** @} */
202
203
204	/**
205	* The shared state of an ATA device.
206	*/
207	typedef struct ATADEVSTATE
208	{
209	/** The I/O buffer.
210	* @note Page aligned in case it helps. */
211	uint8_t abIOBuffer[ATA_MAX_IO_BUFFER_SIZE];
212
213	/** Flag indicating whether the current command uses LBA48 mode. */
214	bool fLBA48;
215	/** Flag indicating whether this drive implements the ATAPI command set. */
216	bool fATAPI;
217	/** Set if this interface has asserted the IRQ. */
218	bool fIrqPending;
219	/** Currently configured number of sectors in a multi-sector transfer. */
220	uint8_t cMultSectors;
221	/** Physical CHS disk geometry (static). */
222	PDMMEDIAGEOMETRY PCHSGeometry;
223	/** Translated CHS disk geometry (variable). */
224	PDMMEDIAGEOMETRY XCHSGeometry;
225	/** Total number of sectors on this disk. */
226	uint64_t cTotalSectors;
227	/** Sector size of the medium. */
228	uint32_t cbSector;
229	/** Number of sectors to transfer per IRQ. */
230	uint32_t cSectorsPerIRQ;
231
232	/** ATA/ATAPI register 1: feature (write-only). */
233	uint8_t uATARegFeature;
234	/** ATA/ATAPI register 1: feature, high order byte. */
235	uint8_t uATARegFeatureHOB;
236	/** ATA/ATAPI register 1: error (read-only). */
237	uint8_t uATARegError;
238	/** ATA/ATAPI register 2: sector count (read/write). */
239	uint8_t uATARegNSector;
240	/** ATA/ATAPI register 2: sector count, high order byte. */
241	uint8_t uATARegNSectorHOB;
242	/** ATA/ATAPI register 3: sector (read/write). */
243	uint8_t uATARegSector;
244	/** ATA/ATAPI register 3: sector, high order byte. */
245	uint8_t uATARegSectorHOB;
246	/** ATA/ATAPI register 4: cylinder low (read/write). */
247	uint8_t uATARegLCyl;
248	/** ATA/ATAPI register 4: cylinder low, high order byte. */
249	uint8_t uATARegLCylHOB;
250	/** ATA/ATAPI register 5: cylinder high (read/write). */
251	uint8_t uATARegHCyl;
252	/** ATA/ATAPI register 5: cylinder high, high order byte. */
253	uint8_t uATARegHCylHOB;
254	/** ATA/ATAPI register 6: select drive/head (read/write). */
255	uint8_t uATARegSelect;
256	/** ATA/ATAPI register 7: status (read-only). */
257	uint8_t uATARegStatus;
258	/** ATA/ATAPI register 7: command (write-only). */
259	uint8_t uATARegCommand;
260	/** ATA/ATAPI drive control register (write-only). */
261	uint8_t uATARegDevCtl;
262
263	/** Currently active transfer mode (MDMA/UDMA) and speed. */
264	uint8_t uATATransferMode;
265	/** Current transfer direction. */
266	uint8_t uTxDir;
267	/** Index of callback for begin transfer. */
268	uint8_t iBeginTransfer;
269	/** Index of callback for source/sink of data. */
270	uint8_t iSourceSink;
271	/** Flag indicating whether the current command transfers data in DMA mode. */
272	bool fDMA;
273	/** Set to indicate that ATAPI transfer semantics must be used. */
274	bool fATAPITransfer;
275
276	/** Total ATA/ATAPI transfer size, shared PIO/DMA. */
277	uint32_t cbTotalTransfer;
278	/** Elementary ATA/ATAPI transfer size, shared PIO/DMA. */
279	uint32_t cbElementaryTransfer;
280	/** Maximum ATAPI elementary transfer size, PIO only. */
281	uint32_t cbPIOTransferLimit;
282	/** ATAPI passthrough transfer size, shared PIO/DMA */
283	uint32_t cbAtapiPassthroughTransfer;
284	/** Current read/write buffer position, shared PIO/DMA. */
285	uint32_t iIOBufferCur;
286	/** First element beyond end of valid buffer content, shared PIO/DMA. */
287	uint32_t iIOBufferEnd;
288	/** Align the following fields correctly. */
289	uint32_t Alignment0;
290
291	/** ATA/ATAPI current PIO read/write transfer position. Not shared with DMA for safety reasons. */
292	uint32_t iIOBufferPIODataStart;
293	/** ATA/ATAPI current PIO read/write transfer end. Not shared with DMA for safety reasons. */
294	uint32_t iIOBufferPIODataEnd;
295
296	/** Current LBA position (both ATA/ATAPI). */
297	uint32_t iCurLBA;
298	/** ATAPI current sector size. */
299	uint32_t cbATAPISector;
300	/** ATAPI current command. */
301	uint8_t abATAPICmd[ATAPI_PACKET_SIZE];
302	/** ATAPI sense data. */
303	uint8_t abATAPISense[ATAPI_SENSE_SIZE];
304	/** HACK: Countdown till we report a newly unmounted drive as mounted. */
305	uint8_t cNotifiedMediaChange;
306	/** The same for GET_EVENT_STATUS for mechanism */
307	volatile uint32_t MediaEventStatus;
308
309	/** Media type if known. */
310	volatile uint32_t MediaTrackType;
311
312	/** The status LED state for this drive. */
313	PDMLED Led;
314
315	/** Size of I/O buffer. */
316	uint32_t cbIOBuffer;
317
318	/*
319	* No data that is part of the saved state after this point!!!!!
320	*/
321
322	/** Counter for number of busy status seen in R3 in a row. */
323	uint8_t cBusyStatusHackR3;
324	/** Counter for number of busy status seen in GC/R0 in a row. */
325	uint8_t cBusyStatusHackRZ;
326	/** Defines the R3 yield rate by a mask (power of 2 minus one).
327	* Lower is more agressive. */
328	uint8_t cBusyStatusHackR3Rate;
329	/** Defines the R0/RC yield rate by a mask (power of 2 minus one).
330	* Lower is more agressive. */
331	uint8_t cBusyStatusHackRZRate;
332
333	/** Release statistics: number of ATA DMA commands. */
334	STAMCOUNTER StatATADMA;
335	/** Release statistics: number of ATA PIO commands. */
336	STAMCOUNTER StatATAPIO;
337	/** Release statistics: number of ATAPI PIO commands. */
338	STAMCOUNTER StatATAPIDMA;
339	/** Release statistics: number of ATAPI PIO commands. */
340	STAMCOUNTER StatATAPIPIO;
341	#ifdef VBOX_INSTRUMENT_DMA_WRITES
342	/** Release statistics: number of DMA sector writes and the time spent. */
343	STAMPROFILEADV StatInstrVDWrites;
344	#endif
345	/** Release statistics: Profiling RTThreadYield calls during status polling. */
346	STAMPROFILEADV StatStatusYields;
347
348	/** Statistics: number of read operations and the time spent reading. */
349	STAMPROFILEADV StatReads;
350	/** Statistics: number of bytes read. */
351	STAMCOUNTER StatBytesRead;
352	/** Statistics: number of write operations and the time spent writing. */
353	STAMPROFILEADV StatWrites;
354	/** Statistics: number of bytes written. */
355	STAMCOUNTER StatBytesWritten;
356	/** Statistics: number of flush operations and the time spend flushing. */
357	STAMPROFILE StatFlushes;
358
359	/** Enable passing through commands directly to the ATAPI drive. */
360	bool fATAPIPassthrough;
361	/** Flag whether to overwrite inquiry data in passthrough mode. */
362	bool fOverwriteInquiry;
363	/** Number of errors we've reported to the release log.
364	* This is to prevent flooding caused by something going horribly wrong.
365	* this value against MAX_LOG_REL_ERRORS in places likely to cause floods
366	* like the ones we currently seeing on the linux smoke tests (2006-11-10). */
367	uint32_t cErrors;
368	/** Timestamp of last started command. 0 if no command pending. */
369	uint64_t u64CmdTS;
370
371	/** The LUN number. */
372	uint32_t iLUN;
373	/** The controller number. */
374	uint8_t iCtl;
375	/** The device number. */
376	uint8_t iDev;
377	/** Set if the device is present. */
378	bool fPresent;
379	/** Explicit alignment. */
380	uint8_t bAlignment2;
381
382	/** The serial number to use for IDENTIFY DEVICE commands. */
383	char szSerialNumber[ATA_SERIAL_NUMBER_LENGTH+1];
384	/** The firmware revision to use for IDENTIFY DEVICE commands. */
385	char szFirmwareRevision[ATA_FIRMWARE_REVISION_LENGTH+1];
386	/** The model number to use for IDENTIFY DEVICE commands. */
387	char szModelNumber[ATA_MODEL_NUMBER_LENGTH+1];
388	/** The vendor identification string for SCSI INQUIRY commands. */
389	char szInquiryVendorId[SCSI_INQUIRY_VENDOR_ID_LENGTH+1];
390	/** The product identification string for SCSI INQUIRY commands. */
391	char szInquiryProductId[SCSI_INQUIRY_PRODUCT_ID_LENGTH+1];
392	/** The revision string for SCSI INQUIRY commands. */
393	char szInquiryRevision[SCSI_INQUIRY_REVISION_LENGTH+1];
394
395	/** Padding the structure to a multiple of 4096 for better I/O buffer alignment. */
396	uint8_t abAlignment4[7 + 3528];
397	} ATADEVSTATE;
398	AssertCompileMemberAlignment(ATADEVSTATE, cTotalSectors, 8);
399	AssertCompileMemberAlignment(ATADEVSTATE, StatATADMA, 8);
400	AssertCompileMemberAlignment(ATADEVSTATE, u64CmdTS, 8);
401	AssertCompileMemberAlignment(ATADEVSTATE, szSerialNumber, 8);
402	AssertCompileSizeAlignment(ATADEVSTATE, 4096); /* To align the buffer on a page boundrary. */
403	/** Pointer to the shared state of an ATA device. */
404	typedef ATADEVSTATE *PATADEVSTATE;
405
406
407	/**
408	* The ring-3 state of an ATA device.
409	*
410	* @implements PDMIBASE
411	* @implements PDMIBLOCKPORT
412	* @implements PDMIMOUNTNOTIFY
413	*/
414	typedef struct ATADEVSTATER3
415	{
416	/** Pointer to the attached driver's base interface. */
417	R3PTRTYPE(PPDMIBASE) pDrvBase;
418	/** Pointer to the attached driver's block interface. */
419	R3PTRTYPE(PPDMIMEDIA) pDrvMedia;
420	/** Pointer to the attached driver's mount interface.
421	* This is NULL if the driver isn't a removable unit. */
422	R3PTRTYPE(PPDMIMOUNT) pDrvMount;
423	/** The base interface. */
424	PDMIBASE IBase;
425	/** The block port interface. */
426	PDMIMEDIAPORT IPort;
427	/** The mount notify interface. */
428	PDMIMOUNTNOTIFY IMountNotify;
429
430	/** The LUN number. */
431	uint32_t iLUN;
432	/** The controller number. */
433	uint8_t iCtl;
434	/** The device number. */
435	uint8_t iDev;
436	/** Explicit alignment. */
437	uint8_t abAlignment2[2];
438	/** The device instance so we can get our bearings from an interface method. */
439	PPDMDEVINSR3 pDevIns;
440
441	/** The current tracklist of the loaded medium if passthrough is used. */
442	R3PTRTYPE(PTRACKLIST) pTrackList;
443	} ATADEVSTATER3;
444	/** Pointer to the ring-3 state of an ATA device. */
445	typedef ATADEVSTATER3 *PATADEVSTATER3;
446
447
448	/**
449	* Transfer request forwarded to the async I/O thread.
450	*/
451	typedef struct ATATransferRequest
452	{
453	/** The interface index the request is for. */
454	uint8_t iIf;
455	/** The index of the begin transfer callback to call. */
456	uint8_t iBeginTransfer;
457	/** The index of the source sink callback to call for doing the transfer. */
458	uint8_t iSourceSink;
459	/** Transfer direction. */
460	uint8_t uTxDir;
461	/** How many bytes to transfer. */
462	uint32_t cbTotalTransfer;
463	} ATATransferRequest;
464
465
466	/**
467	* Abort request forwarded to the async I/O thread.
468	*/
469	typedef struct ATAAbortRequest
470	{
471	/** The interface index the request is for. */
472	uint8_t iIf;
473	/** Flag whether to reset the drive. */
474	bool fResetDrive;
475	} ATAAbortRequest;
476
477
478	/**
479	* Request type indicator.
480	*/
481	typedef enum
482	{
483	/** Begin a new transfer. */
484	ATA_AIO_NEW = 0,
485	/** Continue a DMA transfer. */
486	ATA_AIO_DMA,
487	/** Continue a PIO transfer. */
488	ATA_AIO_PIO,
489	/** Reset the drives on current controller, stop all transfer activity. */
490	ATA_AIO_RESET_ASSERTED,
491	/** Reset the drives on current controller, resume operation. */
492	ATA_AIO_RESET_CLEARED,
493	/** Abort the current transfer of a particular drive. */
494	ATA_AIO_ABORT
495	} ATAAIO;
496
497
498	/**
499	* Combining structure for an ATA request to the async I/O thread
500	* started with the request type insicator.
501	*/
502	typedef struct ATARequest
503	{
504	/** Request type. */
505	ATAAIO ReqType;
506	/** Request type dependent data. */
507	union
508	{
509	/** Transfer request specific data. */
510	ATATransferRequest t;
511	/** Abort request specific data. */
512	ATAAbortRequest a;
513	} u;
514	} ATARequest;
515
516
517	/**
518	* The shared state of an ATA controller.
519	*
520	* Has two devices, the master (0) and the slave (1).
521	*/
522	typedef struct ATACONTROLLER
523	{
524	/** The ATA/ATAPI interfaces of this controller. */
525	ATADEVSTATE aIfs[2];
526
527	/** The base of the first I/O Port range. */
528	RTIOPORT IOPortBase1;
529	/** The base of the second I/O Port range. (0 if none) */
530	RTIOPORT IOPortBase2;
531	/** The assigned IRQ. */
532	uint32_t irq;
533	/** Access critical section */
534	PDMCRITSECT lock;
535
536	/** Selected drive. */
537	uint8_t iSelectedIf;
538	/** The interface on which to handle async I/O. */
539	uint8_t iAIOIf;
540	/** The state of the async I/O thread. */
541	uint8_t uAsyncIOState;
542	/** Flag indicating whether the next transfer is part of the current command. */
543	bool fChainedTransfer;
544	/** Set when the reset processing is currently active on this controller. */
545	bool fReset;
546	/** Flag whether the current transfer needs to be redone. */
547	bool fRedo;
548	/** Flag whether the redo suspend has been finished. */
549	bool fRedoIdle;
550	/** Flag whether the DMA operation to be redone is the final transfer. */
551	bool fRedoDMALastDesc;
552	/** The BusMaster DMA state. */
553	BMDMAState BmDma;
554	/** Pointer to first DMA descriptor. */
555	RTGCPHYS32 GCPhysFirstDMADesc;
556	/** Pointer to last DMA descriptor. */
557	RTGCPHYS32 GCPhysLastDMADesc;
558	/** Pointer to current DMA buffer (for redo operations). */
559	RTGCPHYS32 GCPhysRedoDMABuffer;
560	/** Size of current DMA buffer (for redo operations). */
561	uint32_t cbRedoDMABuffer;
562
563	/** The event semaphore the thread is waiting on for requests. */
564	SUPSEMEVENT hAsyncIOSem;
565	/** The request queue for the AIO thread. One element is always unused. */
566	ATARequest aAsyncIORequests[4];
567	/** The position at which to insert a new request for the AIO thread. */
568	volatile uint8_t AsyncIOReqHead;
569	/** The position at which to get a new request for the AIO thread. */
570	volatile uint8_t AsyncIOReqTail;
571	/** The controller number. */
572	uint8_t iCtl;
573	/** Magic delay before triggering interrupts in DMA mode. */
574	uint32_t msDelayIRQ;
575	/** The lock protecting the request queue. */
576	PDMCRITSECT AsyncIORequestLock;
577
578	/** Timestamp we started the reset. */
579	uint64_t u64ResetTime;
580
581	/** The first port in the first I/O port range, regular operation. */
582	IOMIOPORTHANDLE hIoPorts1First;
583	/** The other ports in the first I/O port range, regular operation. */
584	IOMIOPORTHANDLE hIoPorts1Other;
585	/** The second I/O port range, regular operation. */
586	IOMIOPORTHANDLE hIoPorts2;
587	/** The first I/O port range, empty controller operation. */
588	IOMIOPORTHANDLE hIoPortsEmpty1;
589	/** The second I/O port range, empty controller operation. */
590	IOMIOPORTHANDLE hIoPortsEmpty2;
591
592	/* Statistics */
593	STAMCOUNTER StatAsyncOps;
594	uint64_t StatAsyncMinWait;
595	uint64_t StatAsyncMaxWait;
596	STAMCOUNTER StatAsyncTimeUS;
597	STAMPROFILEADV StatAsyncTime;
598	STAMPROFILE StatLockWait;
599	uint8_t abAlignment4[3328];
600	} ATACONTROLLER;
601	AssertCompileMemberAlignment(ATACONTROLLER, lock, 8);
602	AssertCompileMemberAlignment(ATACONTROLLER, aIfs, 8);
603	AssertCompileMemberAlignment(ATACONTROLLER, u64ResetTime, 8);
604	AssertCompileMemberAlignment(ATACONTROLLER, StatAsyncOps, 8);
605	AssertCompileMemberAlignment(ATACONTROLLER, AsyncIORequestLock, 8);
606	AssertCompileSizeAlignment(ATACONTROLLER, 4096); /* To align the controllers, devices and I/O buffers on page boundaries. */
607	/** Pointer to the shared state of an ATA controller. */
608	typedef ATACONTROLLER *PATACONTROLLER;
609
610
611	/**
612	* The ring-3 state of an ATA controller.
613	*/
614	typedef struct ATACONTROLLERR3
615	{
616	/** The ATA/ATAPI interfaces of this controller. */
617	ATADEVSTATER3 aIfs[2];
618
619	/** Pointer to device instance. */
620	PPDMDEVINSR3 pDevIns;
621
622	/** The async I/O thread handle. NIL_RTTHREAD if no thread. */
623	RTTHREAD hAsyncIOThread;
624	/** The event semaphore the thread is waiting on during suspended I/O. */
625	RTSEMEVENT hSuspendIOSem;
626	/** Set when the destroying the device instance and the thread must exit. */
627	uint32_t volatile fShutdown;
628	/** Whether to call PDMDevHlpAsyncNotificationCompleted when idle. */
629	bool volatile fSignalIdle;
630
631	/** The controller number. */
632	uint8_t iCtl;
633
634	uint8_t abAlignment[3];
635	} ATACONTROLLERR3;
636	/** Pointer to the ring-3 state of an ATA controller. */
637	typedef ATACONTROLLERR3 *PATACONTROLLERR3;
638
639
640	/** ATA chipset type. */
641	typedef enum CHIPSET
642	{
643	/** PIIX3 chipset, must be 0 for saved state compatibility */
644	CHIPSET_PIIX3 = 0,
645	/** PIIX4 chipset, must be 1 for saved state compatibility */
646	CHIPSET_PIIX4,
647	/** ICH6 chipset */
648	CHIPSET_ICH6,
649	CHIPSET_32BIT_HACK=0x7fffffff
650	} CHIPSET;
651	AssertCompileSize(CHIPSET, 4);
652
653	/**
654	* The shared state of a ATA PCI device.
655	*/
656	typedef struct ATASTATE
657	{
658	/** The controllers. */
659	ATACONTROLLER aCts[2];
660	/** Flag indicating chipset being emulated. */
661	CHIPSET enmChipset;
662	/** Explicit alignment padding. */
663	uint8_t abAlignment1[7];
664	/** PCI region \#4: Bus-master DMA I/O ports. */
665	IOMIOPORTHANDLE hIoPortsBmDma;
666	} ATASTATE;
667	/** Pointer to the shared state of an ATA PCI device. */
668	typedef ATASTATE *PATASTATE;
669
670
671	/**
672	* The ring-3 state of a ATA PCI device.
673	*
674	* @implements PDMILEDPORTS
675	*/
676	typedef struct ATASTATER3
677	{
678	/** The controllers. */
679	ATACONTROLLERR3 aCts[2];
680	/** Status LUN: Base interface. */
681	PDMIBASE IBase;
682	/** Status LUN: Leds interface. */
683	PDMILEDPORTS ILeds;
684	/** Status LUN: Partner of ILeds. */
685	R3PTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
686	/** Status LUN: Media Notify. */
687	R3PTRTYPE(PPDMIMEDIANOTIFY) pMediaNotify;
688	/** Pointer to device instance (for getting our bearings in interface methods). */
689	PPDMDEVINSR3 pDevIns;
690	} ATASTATER3;
691	/** Pointer to the ring-3 state of an ATA PCI device. */
692	typedef ATASTATER3 *PATASTATER3;
693
694
695	/**
696	* The ring-0 state of the ATA PCI device.
697	*/
698	typedef struct ATASTATER0
699	{
700	uint64_t uUnused;
701	} ATASTATER0;
702	/** Pointer to the ring-0 state of an ATA PCI device. */
703	typedef ATASTATER0 *PATASTATER0;
704
705
706	/**
707	* The raw-mode state of the ATA PCI device.
708	*/
709	typedef struct ATASTATERC
710	{
711	uint64_t uUnused;
712	} ATASTATERC;
713	/** Pointer to the raw-mode state of an ATA PCI device. */
714	typedef ATASTATERC *PATASTATERC;
715
716
717	/** The current context state of an ATA PCI device. */
718	typedef CTX_SUFF(ATASTATE) ATASTATECC;
719	/** Pointer to the current context state of an ATA PCI device. */
720	typedef CTX_SUFF(PATASTATE) PATASTATECC;
721
722
723	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
724
725
726	#ifdef IN_RING3
727	DECLINLINE(void) ataSetStatusValue(PATACONTROLLER pCtl, PATADEVSTATE s, uint8_t stat)
728	{
729	/* Freeze status register contents while processing RESET. */
730	if (!pCtl->fReset)
731	{
732	s->uATARegStatus = stat;
733	Log2(("%s: LUN#%d status %#04x\n", __FUNCTION__, s->iLUN, s->uATARegStatus));
734	}
735	}
736	#endif /* IN_RING3 */
737
738
739	DECLINLINE(void) ataSetStatus(PATACONTROLLER pCtl, PATADEVSTATE s, uint8_t stat)
740	{
741	/* Freeze status register contents while processing RESET. */
742	if (!pCtl->fReset)
743	{
744	s->uATARegStatus \|= stat;
745	Log2(("%s: LUN#%d status %#04x\n", __FUNCTION__, s->iLUN, s->uATARegStatus));
746	}
747	}
748
749
750	DECLINLINE(void) ataUnsetStatus(PATACONTROLLER pCtl, PATADEVSTATE s, uint8_t stat)
751	{
752	/* Freeze status register contents while processing RESET. */
753	if (!pCtl->fReset)
754	{
755	s->uATARegStatus &= ~stat;
756	Log2(("%s: LUN#%d status %#04x\n", __FUNCTION__, s->iLUN, s->uATARegStatus));
757	}
758	}
759
760	#if defined(IN_RING3) \|\| defined(IN_RING0)
761
762	# ifdef IN_RING3
763	typedef void FNBEGINTRANSFER(PATACONTROLLER pCtl, PATADEVSTATE s);
764	typedef FNBEGINTRANSFER *PFNBEGINTRANSFER;
765	typedef bool FNSOURCESINK(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3);
766	typedef FNSOURCESINK *PFNSOURCESINK;
767
768	static FNBEGINTRANSFER ataR3ReadWriteSectorsBT;
769	static FNBEGINTRANSFER ataR3PacketBT;
770	static FNBEGINTRANSFER atapiR3CmdBT;
771	static FNBEGINTRANSFER atapiR3PassthroughCmdBT;
772
773	static FNSOURCESINK ataR3IdentifySS;
774	static FNSOURCESINK ataR3FlushSS;
775	static FNSOURCESINK ataR3ReadSectorsSS;
776	static FNSOURCESINK ataR3WriteSectorsSS;
777	static FNSOURCESINK ataR3ExecuteDeviceDiagnosticSS;
778	static FNSOURCESINK ataR3TrimSS;
779	static FNSOURCESINK ataR3PacketSS;
780	static FNSOURCESINK ataR3InitDevParmSS;
781	static FNSOURCESINK ataR3RecalibrateSS;
782	static FNSOURCESINK atapiR3GetConfigurationSS;
783	static FNSOURCESINK atapiR3GetEventStatusNotificationSS;
784	static FNSOURCESINK atapiR3IdentifySS;
785	static FNSOURCESINK atapiR3InquirySS;
786	static FNSOURCESINK atapiR3MechanismStatusSS;
787	static FNSOURCESINK atapiR3ModeSenseErrorRecoverySS;
788	static FNSOURCESINK atapiR3ModeSenseCDStatusSS;
789	static FNSOURCESINK atapiR3ReadSS;
790	static FNSOURCESINK atapiR3ReadCapacitySS;
791	static FNSOURCESINK atapiR3ReadDiscInformationSS;
792	static FNSOURCESINK atapiR3ReadTOCNormalSS;
793	static FNSOURCESINK atapiR3ReadTOCMultiSS;
794	static FNSOURCESINK atapiR3ReadTOCRawSS;
795	static FNSOURCESINK atapiR3ReadTrackInformationSS;
796	static FNSOURCESINK atapiR3RequestSenseSS;
797	static FNSOURCESINK atapiR3PassthroughSS;
798	static FNSOURCESINK atapiR3ReadDVDStructureSS;
799	# endif /* IN_RING3 */
800
801	/**
802	* Begin of transfer function indexes for g_apfnBeginTransFuncs.
803	*/
804	typedef enum ATAFNBT
805	{
806	ATAFN_BT_NULL = 0,
807	ATAFN_BT_READ_WRITE_SECTORS,
808	ATAFN_BT_PACKET,
809	ATAFN_BT_ATAPI_CMD,
810	ATAFN_BT_ATAPI_PASSTHROUGH_CMD,
811	ATAFN_BT_MAX
812	} ATAFNBT;
813
814	# ifdef IN_RING3
815	/**
816	* Array of end transfer functions, the index is ATAFNET.
817	* Make sure ATAFNET and this array match!
818	*/
819	static const PFNBEGINTRANSFER g_apfnBeginTransFuncs[ATAFN_BT_MAX] =
820	{
821	NULL,
822	ataR3ReadWriteSectorsBT,
823	ataR3PacketBT,
824	atapiR3CmdBT,
825	atapiR3PassthroughCmdBT,
826	};
827	# endif /* IN_RING3 */
828
829	/**
830	* Source/sink function indexes for g_apfnSourceSinkFuncs.
831	*/
832	typedef enum ATAFNSS
833	{
834	ATAFN_SS_NULL = 0,
835	ATAFN_SS_IDENTIFY,
836	ATAFN_SS_FLUSH,
837	ATAFN_SS_READ_SECTORS,
838	ATAFN_SS_WRITE_SECTORS,
839	ATAFN_SS_EXECUTE_DEVICE_DIAGNOSTIC,
840	ATAFN_SS_TRIM,
841	ATAFN_SS_PACKET,
842	ATAFN_SS_INITIALIZE_DEVICE_PARAMETERS,
843	ATAFN_SS_RECALIBRATE,
844	ATAFN_SS_ATAPI_GET_CONFIGURATION,
845	ATAFN_SS_ATAPI_GET_EVENT_STATUS_NOTIFICATION,
846	ATAFN_SS_ATAPI_IDENTIFY,
847	ATAFN_SS_ATAPI_INQUIRY,
848	ATAFN_SS_ATAPI_MECHANISM_STATUS,
849	ATAFN_SS_ATAPI_MODE_SENSE_ERROR_RECOVERY,
850	ATAFN_SS_ATAPI_MODE_SENSE_CD_STATUS,
851	ATAFN_SS_ATAPI_READ,
852	ATAFN_SS_ATAPI_READ_CAPACITY,
853	ATAFN_SS_ATAPI_READ_DISC_INFORMATION,
854	ATAFN_SS_ATAPI_READ_TOC_NORMAL,
855	ATAFN_SS_ATAPI_READ_TOC_MULTI,
856	ATAFN_SS_ATAPI_READ_TOC_RAW,
857	ATAFN_SS_ATAPI_READ_TRACK_INFORMATION,
858	ATAFN_SS_ATAPI_REQUEST_SENSE,
859	ATAFN_SS_ATAPI_PASSTHROUGH,
860	ATAFN_SS_ATAPI_READ_DVD_STRUCTURE,
861	ATAFN_SS_MAX
862	} ATAFNSS;
863
864	# ifdef IN_RING3
865	/**
866	* Array of source/sink functions, the index is ATAFNSS.
867	* Make sure ATAFNSS and this array match!
868	*/
869	static const PFNSOURCESINK g_apfnSourceSinkFuncs[ATAFN_SS_MAX] =
870	{
871	NULL,
872	ataR3IdentifySS,
873	ataR3FlushSS,
874	ataR3ReadSectorsSS,
875	ataR3WriteSectorsSS,
876	ataR3ExecuteDeviceDiagnosticSS,
877	ataR3TrimSS,
878	ataR3PacketSS,
879	ataR3InitDevParmSS,
880	ataR3RecalibrateSS,
881	atapiR3GetConfigurationSS,
882	atapiR3GetEventStatusNotificationSS,
883	atapiR3IdentifySS,
884	atapiR3InquirySS,
885	atapiR3MechanismStatusSS,
886	atapiR3ModeSenseErrorRecoverySS,
887	atapiR3ModeSenseCDStatusSS,
888	atapiR3ReadSS,
889	atapiR3ReadCapacitySS,
890	atapiR3ReadDiscInformationSS,
891	atapiR3ReadTOCNormalSS,
892	atapiR3ReadTOCMultiSS,
893	atapiR3ReadTOCRawSS,
894	atapiR3ReadTrackInformationSS,
895	atapiR3RequestSenseSS,
896	atapiR3PassthroughSS,
897	atapiR3ReadDVDStructureSS
898	};
899	# endif /* IN_RING3 */
900
901
902	static const ATARequest g_ataDMARequest = { ATA_AIO_DMA, { { 0, 0, 0, 0, 0 } } };
903	static const ATARequest g_ataPIORequest = { ATA_AIO_PIO, { { 0, 0, 0, 0, 0 } } };
904	# ifdef IN_RING3
905	static const ATARequest g_ataResetARequest = { ATA_AIO_RESET_ASSERTED, { { 0, 0, 0, 0, 0 } } };
906	static const ATARequest g_ataResetCRequest = { ATA_AIO_RESET_CLEARED, { { 0, 0, 0, 0, 0 } } };
907	# endif
908
909	# ifdef IN_RING3
910	static void ataR3AsyncIOClearRequests(PPDMDEVINS pDevIns, PATACONTROLLER pCtl)
911	{
912	int rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->AsyncIORequestLock, VINF_SUCCESS);
913	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pCtl->AsyncIORequestLock, rc);
914
915	pCtl->AsyncIOReqHead = 0;
916	pCtl->AsyncIOReqTail = 0;
917
918	rc = PDMDevHlpCritSectLeave(pDevIns, &pCtl->AsyncIORequestLock);
919	AssertRC(rc);
920	}
921	# endif /* IN_RING3 */
922
923	static void ataHCAsyncIOPutRequest(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, const ATARequest *pReq)
924	{
925	int rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->AsyncIORequestLock, VINF_SUCCESS);
926	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pCtl->AsyncIORequestLock, rc);
927
928	uint8_t const iAsyncIORequest = pCtl->AsyncIOReqHead % RT_ELEMENTS(pCtl->aAsyncIORequests);
929	Assert((iAsyncIORequest + 1) % RT_ELEMENTS(pCtl->aAsyncIORequests) != pCtl->AsyncIOReqTail);
930	memcpy(&pCtl->aAsyncIORequests[iAsyncIORequest], pReq, sizeof(*pReq));
931	pCtl->AsyncIOReqHead = (iAsyncIORequest + 1) % RT_ELEMENTS(pCtl->aAsyncIORequests);
932
933	rc = PDMDevHlpCritSectLeave(pDevIns, &pCtl->AsyncIORequestLock);
934	AssertRC(rc);
935
936	rc = PDMDevHlpCritSectScheduleExitEvent(pDevIns, &pCtl->lock, pCtl->hAsyncIOSem);
937	if (RT_FAILURE(rc))
938	{
939	rc = PDMDevHlpSUPSemEventSignal(pDevIns, pCtl->hAsyncIOSem);
940	AssertRC(rc);
941	}
942	}
943
944	# ifdef IN_RING3
945
946	static const ATARequest *ataR3AsyncIOGetCurrentRequest(PPDMDEVINS pDevIns, PATACONTROLLER pCtl)
947	{
948	const ATARequest *pReq;
949
950	int rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->AsyncIORequestLock, VINF_SUCCESS);
951	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pCtl->AsyncIORequestLock, rc);
952
953	if (pCtl->AsyncIOReqHead != pCtl->AsyncIOReqTail)
954	pReq = &pCtl->aAsyncIORequests[pCtl->AsyncIOReqTail];
955	else
956	pReq = NULL;
957
958	rc = PDMDevHlpCritSectLeave(pDevIns, &pCtl->AsyncIORequestLock);
959	AssertRC(rc);
960	return pReq;
961	}
962
963
964	/**
965	* Remove the request with the given type, as it's finished. The request
966	* is not removed blindly, as this could mean a RESET request that is not
967	* yet processed (but has cleared the request queue) is lost.
968	*
969	* @param pDevIns The device instance.
970	* @param pCtl Controller for which to remove the request.
971	* @param ReqType Type of the request to remove.
972	*/
973	static void ataR3AsyncIORemoveCurrentRequest(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, ATAAIO ReqType)
974	{
975	int rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->AsyncIORequestLock, VINF_SUCCESS);
976	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pCtl->AsyncIORequestLock, rc);
977
978	if (pCtl->AsyncIOReqHead != pCtl->AsyncIOReqTail && pCtl->aAsyncIORequests[pCtl->AsyncIOReqTail].ReqType == ReqType)
979	{
980	pCtl->AsyncIOReqTail++;
981	pCtl->AsyncIOReqTail %= RT_ELEMENTS(pCtl->aAsyncIORequests);
982	}
983
984	rc = PDMDevHlpCritSectLeave(pDevIns, &pCtl->AsyncIORequestLock);
985	AssertRC(rc);
986	}
987
988
989	/**
990	* Dump the request queue for a particular controller. First dump the queue
991	* contents, then the already processed entries, as long as they haven't been
992	* overwritten.
993	*
994	* @param pDevIns The device instance.
995	* @param pCtl Controller for which to dump the queue.
996	*/
997	static void ataR3AsyncIODumpRequests(PPDMDEVINS pDevIns, PATACONTROLLER pCtl)
998	{
999	int rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->AsyncIORequestLock, VINF_SUCCESS);
1000	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pCtl->AsyncIORequestLock, rc);
1001
1002	LogRel(("PIIX3 ATA: Ctl#%d: request queue dump (topmost is current):\n", pCtl->iCtl));
1003	uint8_t curr = pCtl->AsyncIOReqTail;
1004	do
1005	{
1006	if (curr == pCtl->AsyncIOReqHead)
1007	LogRel(("PIIX3 ATA: Ctl#%d: processed requests (topmost is oldest):\n", pCtl->iCtl));
1008	switch (pCtl->aAsyncIORequests[curr].ReqType)
1009	{
1010	case ATA_AIO_NEW:
1011	LogRel(("new transfer request, iIf=%d iBeginTransfer=%d iSourceSink=%d cbTotalTransfer=%d uTxDir=%d\n",
1012	pCtl->aAsyncIORequests[curr].u.t.iIf, pCtl->aAsyncIORequests[curr].u.t.iBeginTransfer,
1013	pCtl->aAsyncIORequests[curr].u.t.iSourceSink, pCtl->aAsyncIORequests[curr].u.t.cbTotalTransfer,
1014	pCtl->aAsyncIORequests[curr].u.t.uTxDir));
1015	break;
1016	case ATA_AIO_DMA:
1017	LogRel(("dma transfer continuation\n"));
1018	break;
1019	case ATA_AIO_PIO:
1020	LogRel(("pio transfer continuation\n"));
1021	break;
1022	case ATA_AIO_RESET_ASSERTED:
1023	LogRel(("reset asserted request\n"));
1024	break;
1025	case ATA_AIO_RESET_CLEARED:
1026	LogRel(("reset cleared request\n"));
1027	break;
1028	case ATA_AIO_ABORT:
1029	LogRel(("abort request, iIf=%d fResetDrive=%d\n", pCtl->aAsyncIORequests[curr].u.a.iIf,
1030	pCtl->aAsyncIORequests[curr].u.a.fResetDrive));
1031	break;
1032	default:
1033	LogRel(("unknown request %d\n", pCtl->aAsyncIORequests[curr].ReqType));
1034	}
1035	curr = (curr + 1) % RT_ELEMENTS(pCtl->aAsyncIORequests);
1036	} while (curr != pCtl->AsyncIOReqTail);
1037
1038	rc = PDMDevHlpCritSectLeave(pDevIns, &pCtl->AsyncIORequestLock);
1039	AssertRC(rc);
1040	}
1041
1042
1043	/**
1044	* Checks whether the request queue for a particular controller is empty
1045	* or whether a particular controller is idle.
1046	*
1047	* @param pDevIns The device instance.
1048	* @param pCtl Controller for which to check the queue.
1049	* @param fStrict If set then the controller is checked to be idle.
1050	*/
1051	static bool ataR3AsyncIOIsIdle(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, bool fStrict)
1052	{
1053	int rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->AsyncIORequestLock, VINF_SUCCESS);
1054	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pCtl->AsyncIORequestLock, rc);
1055
1056	bool fIdle = pCtl->fRedoIdle;
1057	if (!fIdle)
1058	fIdle = (pCtl->AsyncIOReqHead == pCtl->AsyncIOReqTail);
1059	if (fStrict)
1060	fIdle &= (pCtl->uAsyncIOState == ATA_AIO_NEW);
1061
1062	rc = PDMDevHlpCritSectLeave(pDevIns, &pCtl->AsyncIORequestLock);
1063	AssertRC(rc);
1064	return fIdle;
1065	}
1066
1067
1068	/**
1069	* Send a transfer request to the async I/O thread.
1070	*
1071	* @param pDevIns The device instance.
1072	* @param pCtl The ATA controller.
1073	* @param s Pointer to the ATA device state data.
1074	* @param cbTotalTransfer Data transfer size.
1075	* @param uTxDir Data transfer direction.
1076	* @param iBeginTransfer Index of BeginTransfer callback.
1077	* @param iSourceSink Index of SourceSink callback.
1078	* @param fChainedTransfer Whether this is a transfer that is part of the previous command/transfer.
1079	*/
1080	static void ataR3StartTransfer(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s,
1081	uint32_t cbTotalTransfer, uint8_t uTxDir, ATAFNBT iBeginTransfer,
1082	ATAFNSS iSourceSink, bool fChainedTransfer)
1083	{
1084	ATARequest Req;
1085
1086	Assert(PDMDevHlpCritSectIsOwner(pDevIns, &pCtl->lock));
1087
1088	/* Do not issue new requests while the RESET line is asserted. */
1089	if (pCtl->fReset)
1090	{
1091	Log2(("%s: Ctl#%d: suppressed new request as RESET is active\n", __FUNCTION__, pCtl->iCtl));
1092	return;
1093	}
1094
1095	/* If the controller is already doing something else right now, ignore
1096	* the command that is being submitted. Some broken guests issue commands
1097	* twice (e.g. the Linux kernel that comes with Acronis True Image 8). */
1098	if (!fChainedTransfer && !ataR3AsyncIOIsIdle(pDevIns, pCtl, true /fStrict/))
1099	{
1100	Log(("%s: Ctl#%d: ignored command %#04x, controller state %d\n", __FUNCTION__, pCtl->iCtl, s->uATARegCommand, pCtl->uAsyncIOState));
1101	LogRel(("PIIX3 IDE: guest issued command %#04x while controller busy\n", s->uATARegCommand));
1102	return;
1103	}
1104
1105	Req.ReqType = ATA_AIO_NEW;
1106	if (fChainedTransfer)
1107	Req.u.t.iIf = pCtl->iAIOIf;
1108	else
1109	Req.u.t.iIf = pCtl->iSelectedIf;
1110	Req.u.t.cbTotalTransfer = cbTotalTransfer;
1111	Req.u.t.uTxDir = uTxDir;
1112	Req.u.t.iBeginTransfer = iBeginTransfer;
1113	Req.u.t.iSourceSink = iSourceSink;
1114	ataSetStatusValue(pCtl, s, ATA_STAT_BUSY);
1115	pCtl->fChainedTransfer = fChainedTransfer;
1116
1117	/*
1118	* Kick the worker thread into action.
1119	*/
1120	Log2(("%s: Ctl#%d: message to async I/O thread, new request\n", __FUNCTION__, pCtl->iCtl));
1121	ataHCAsyncIOPutRequest(pDevIns, pCtl, &Req);
1122	}
1123
1124
1125	/**
1126	* Send an abort command request to the async I/O thread.
1127	*
1128	* @param pDevIns The device instance.
1129	* @param pCtl The ATA controller.
1130	* @param s Pointer to the ATA device state data.
1131	* @param fResetDrive Whether to reset the drive or just abort a command.
1132	*/
1133	static void ataR3AbortCurrentCommand(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, bool fResetDrive)
1134	{
1135	ATARequest Req;
1136
1137	Assert(PDMDevHlpCritSectIsOwner(pDevIns, &pCtl->lock));
1138
1139	/* Do not issue new requests while the RESET line is asserted. */
1140	if (pCtl->fReset)
1141	{
1142	Log2(("%s: Ctl#%d: suppressed aborting command as RESET is active\n", __FUNCTION__, pCtl->iCtl));
1143	return;
1144	}
1145
1146	Req.ReqType = ATA_AIO_ABORT;
1147	Req.u.a.iIf = pCtl->iSelectedIf;
1148	Req.u.a.fResetDrive = fResetDrive;
1149	ataSetStatus(pCtl, s, ATA_STAT_BUSY);
1150	Log2(("%s: Ctl#%d: message to async I/O thread, abort command on LUN#%d\n", __FUNCTION__, pCtl->iCtl, s->iLUN));
1151	ataHCAsyncIOPutRequest(pDevIns, pCtl, &Req);
1152	}
1153
1154	# endif /* IN_RING3 */
1155
1156	/**
1157	* Set the internal interrupt pending status, update INTREQ as appropriate.
1158	*
1159	* @param pDevIns The device instance.
1160	* @param pCtl The ATA controller.
1161	* @param s Pointer to the ATA device state data.
1162	*/
1163	static void ataHCSetIRQ(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s)
1164	{
1165	if (!s->fIrqPending)
1166	{
1167	if (!(s->uATARegDevCtl & ATA_DEVCTL_DISABLE_IRQ))
1168	{
1169	Log2(("%s: LUN#%d asserting IRQ\n", __FUNCTION__, s->iLUN));
1170	/* The BMDMA unit unconditionally sets BM_STATUS_INT if the interrupt
1171	* line is asserted. It monitors the line for a rising edge. */
1172	pCtl->BmDma.u8Status \|= BM_STATUS_INT;
1173	/* Only actually set the IRQ line if updating the currently selected drive. */
1174	if (s == &pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK])
1175	{
1176	/** @todo experiment with adaptive IRQ delivery: for reads it is
1177	* better to wait for IRQ delivery, as it reduces latency. */
1178	if (pCtl->irq == 16)
1179	PDMDevHlpPCISetIrq(pDevIns, 0, 1);
1180	else
1181	PDMDevHlpISASetIrq(pDevIns, pCtl->irq, 1);
1182	}
1183	}
1184	s->fIrqPending = true;
1185	}
1186	}
1187
1188	#endif /* IN_RING0 \|\| IN_RING3 */
1189
1190	/**
1191	* Clear the internal interrupt pending status, update INTREQ as appropriate.
1192	*
1193	* @param pDevIns The device instance.
1194	* @param pCtl The ATA controller.
1195	* @param s Pointer to the ATA device state data.
1196	*/
1197	static void ataUnsetIRQ(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s)
1198	{
1199	if (s->fIrqPending)
1200	{
1201	if (!(s->uATARegDevCtl & ATA_DEVCTL_DISABLE_IRQ))
1202	{
1203	Log2(("%s: LUN#%d deasserting IRQ\n", __FUNCTION__, s->iLUN));
1204	/* Only actually unset the IRQ line if updating the currently selected drive. */
1205	if (s == &pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK])
1206	{
1207	if (pCtl->irq == 16)
1208	PDMDevHlpPCISetIrq(pDevIns, 0, 0);
1209	else
1210	PDMDevHlpISASetIrq(pDevIns, pCtl->irq, 0);
1211	}
1212	}
1213	s->fIrqPending = false;
1214	}
1215	}
1216
1217	#if defined(IN_RING0) \|\| defined(IN_RING3)
1218
1219	static void ataHCPIOTransferStart(PATACONTROLLER pCtl, PATADEVSTATE s, uint32_t start, uint32_t size)
1220	{
1221	Log2(("%s: LUN#%d start %d size %d\n", __FUNCTION__, s->iLUN, start, size));
1222	s->iIOBufferPIODataStart = start;
1223	s->iIOBufferPIODataEnd = start + size;
1224	ataSetStatus(pCtl, s, ATA_STAT_DRQ \| ATA_STAT_SEEK);
1225	ataUnsetStatus(pCtl, s, ATA_STAT_BUSY);
1226	}
1227
1228
1229	static void ataHCPIOTransferStop(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s)
1230	{
1231	Log2(("%s: LUN#%d\n", __FUNCTION__, s->iLUN));
1232	if (s->fATAPITransfer)
1233	{
1234	s->uATARegNSector = (s->uATARegNSector & ~7) \| ATAPI_INT_REASON_IO \| ATAPI_INT_REASON_CD;
1235	Log2(("%s: interrupt reason %#04x\n", __FUNCTION__, s->uATARegNSector));
1236	ataHCSetIRQ(pDevIns, pCtl, s);
1237	s->fATAPITransfer = false;
1238	}
1239	s->cbTotalTransfer = 0;
1240	s->cbElementaryTransfer = 0;
1241	s->iIOBufferPIODataStart = 0;
1242	s->iIOBufferPIODataEnd = 0;
1243	s->iBeginTransfer = ATAFN_BT_NULL;
1244	s->iSourceSink = ATAFN_SS_NULL;
1245	}
1246
1247
1248	static void ataHCPIOTransferLimitATAPI(PATADEVSTATE s)
1249	{
1250	uint32_t cbLimit, cbTransfer;
1251
1252	cbLimit = s->cbPIOTransferLimit;
1253	/* Use maximum transfer size if the guest requested 0. Avoids a hang. */
1254	if (cbLimit == 0)
1255	cbLimit = 0xfffe;
1256	Log2(("%s: byte count limit=%d\n", __FUNCTION__, cbLimit));
1257	if (cbLimit == 0xffff)
1258	cbLimit--;
1259	cbTransfer = RT_MIN(s->cbTotalTransfer, s->iIOBufferEnd - s->iIOBufferCur);
1260	if (cbTransfer > cbLimit)
1261	{
1262	/* Byte count limit for clipping must be even in this case */
1263	if (cbLimit & 1)
1264	cbLimit--;
1265	cbTransfer = cbLimit;
1266	}
1267	s->uATARegLCyl = cbTransfer;
1268	s->uATARegHCyl = cbTransfer >> 8;
1269	s->cbElementaryTransfer = cbTransfer;
1270	}
1271
1272	# ifdef IN_RING3
1273
1274	/**
1275	* Enters the lock protecting the controller data against concurrent access.
1276	*
1277	* @returns nothing.
1278	* @param pDevIns The device instance.
1279	* @param pCtl The controller to lock.
1280	*/
1281	DECLINLINE(void) ataR3LockEnter(PPDMDEVINS pDevIns, PATACONTROLLER pCtl)
1282	{
1283	STAM_PROFILE_START(&pCtl->StatLockWait, a);
1284	int const rcLock = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_SUCCESS);
1285	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pCtl->lock, rcLock);
1286	STAM_PROFILE_STOP(&pCtl->StatLockWait, a);
1287	}
1288
1289	/**
1290	* Leaves the lock protecting the controller against concurrent data access.
1291	*
1292	* @returns nothing.
1293	* @param pDevIns The device instance.
1294	* @param pCtl The controller to unlock.
1295	*/
1296	DECLINLINE(void) ataR3LockLeave(PPDMDEVINS pDevIns, PATACONTROLLER pCtl)
1297	{
1298	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
1299	}
1300
1301	static uint32_t ataR3GetNSectors(PATADEVSTATE s)
1302	{
1303	/* 0 means either 256 (LBA28) or 65536 (LBA48) sectors. */
1304	if (s->fLBA48)
1305	{
1306	if (!s->uATARegNSector && !s->uATARegNSectorHOB)
1307	return 65536;
1308	else
1309	return s->uATARegNSectorHOB << 8 \| s->uATARegNSector;
1310	}
1311	else
1312	{
1313	if (!s->uATARegNSector)
1314	return 256;
1315	else
1316	return s->uATARegNSector;
1317	}
1318	}
1319
1320
1321	static void ataR3PadString(uint8_t pbDst, const char pbSrc, uint32_t cbSize)
1322	{
1323	for (uint32_t i = 0; i < cbSize; i++)
1324	{
1325	if (*pbSrc)
1326	pbDst[i ^ 1] = *pbSrc++;
1327	else
1328	pbDst[i ^ 1] = ' ';
1329	}
1330	}
1331
1332
1333	#if 0 /* unused */
1334	/**
1335	* Compares two MSF values.
1336	*
1337	* @returns 1 if the first value is greater than the second value.
1338	* 0 if both are equal
1339	* -1 if the first value is smaller than the second value.
1340	*/
1341	DECLINLINE(int) atapiCmpMSF(const uint8_t pbMSF1, const uint8_t pbMSF2)
1342	{
1343	int iRes = 0;
1344
1345	for (unsigned i = 0; i < 3; i++)
1346	{
1347	if (pbMSF1[i] < pbMSF2[i])
1348	{
1349	iRes = -1;
1350	break;
1351	}
1352	else if (pbMSF1[i] > pbMSF2[i])
1353	{
1354	iRes = 1;
1355	break;
1356	}
1357	}
1358
1359	return iRes;
1360	}
1361	#endif /* unused */
1362
1363	static void ataR3CmdOK(PATACONTROLLER pCtl, PATADEVSTATE s, uint8_t status)
1364	{
1365	s->uATARegError = 0; /* Not needed by ATA spec, but cannot hurt. */
1366	ataSetStatusValue(pCtl, s, ATA_STAT_READY \| status);
1367	}
1368
1369
1370	static void ataR3CmdError(PATACONTROLLER pCtl, PATADEVSTATE s, uint8_t uErrorCode)
1371	{
1372	Log(("%s: code=%#x\n", __FUNCTION__, uErrorCode));
1373	Assert(uErrorCode);
1374	s->uATARegError = uErrorCode;
1375	ataSetStatusValue(pCtl, s, ATA_STAT_READY \| ATA_STAT_SEEK \| ATA_STAT_ERR);
1376	s->cbTotalTransfer = 0;
1377	s->cbElementaryTransfer = 0;
1378	s->iIOBufferCur = 0;
1379	s->iIOBufferEnd = 0;
1380	s->uTxDir = PDMMEDIATXDIR_NONE;
1381	s->iBeginTransfer = ATAFN_BT_NULL;
1382	s->iSourceSink = ATAFN_SS_NULL;
1383	}
1384
1385	static uint32_t ataR3Checksum(void* ptr, size_t count)
1386	{
1387	uint8_t u8Sum = 0xa5, p = (uint8_t)ptr;
1388	size_t i;
1389
1390	for (i = 0; i < count; i++)
1391	{
1392	u8Sum += *p++;
1393	}
1394
1395	return (uint8_t)-(int32_t)u8Sum;
1396	}
1397
1398	/**
1399	* Sink/Source: IDENTIFY
1400	*/
1401	static bool ataR3IdentifySS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
1402	{
1403	uint16_t *p;
1404	RT_NOREF(pDevIns);
1405
1406	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
1407	Assert(s->cbElementaryTransfer == 512);
1408
1409	p = (uint16_t *)&s->abIOBuffer[0];
1410	memset(p, 0, 512);
1411	p[0] = RT_H2LE_U16(0x0040);
1412	p[1] = RT_H2LE_U16(RT_MIN(s->PCHSGeometry.cCylinders, 16383));
1413	p[3] = RT_H2LE_U16(s->PCHSGeometry.cHeads);
1414	/* Block size; obsolete, but required for the BIOS. */
1415	p[5] = RT_H2LE_U16(s->cbSector);
1416	p[6] = RT_H2LE_U16(s->PCHSGeometry.cSectors);
1417	ataR3PadString((uint8_t )(p + 10), s->szSerialNumber, ATA_SERIAL_NUMBER_LENGTH); / serial number */
1418	p[20] = RT_H2LE_U16(3); /* XXX: retired, cache type */
1419	p[21] = RT_H2LE_U16(512); /* XXX: retired, cache size in sectors */
1420	p[22] = RT_H2LE_U16(0); /* ECC bytes per sector */
1421	ataR3PadString((uint8_t )(p + 23), s->szFirmwareRevision, ATA_FIRMWARE_REVISION_LENGTH); / firmware version */
1422	ataR3PadString((uint8_t )(p + 27), s->szModelNumber, ATA_MODEL_NUMBER_LENGTH); / model */
1423	# if ATA_MAX_MULT_SECTORS > 1
1424	p[47] = RT_H2LE_U16(0x8000 \| ATA_MAX_MULT_SECTORS);
1425	# endif
1426	p[48] = RT_H2LE_U16(1); /* dword I/O, used by the BIOS */
1427	p[49] = RT_H2LE_U16(1 << 11 \| 1 << 9 \| 1 << 8); /* DMA and LBA supported */
1428	p[50] = RT_H2LE_U16(1 << 14); /* No drive specific standby timer minimum */
1429	p[51] = RT_H2LE_U16(240); /* PIO transfer cycle */
1430	p[52] = RT_H2LE_U16(240); /* DMA transfer cycle */
1431	p[53] = RT_H2LE_U16(1 \| 1 << 1 \| 1 << 2); /* words 54-58,64-70,88 valid */
1432	p[54] = RT_H2LE_U16(RT_MIN(s->XCHSGeometry.cCylinders, 16383));
1433	p[55] = RT_H2LE_U16(s->XCHSGeometry.cHeads);
1434	p[56] = RT_H2LE_U16(s->XCHSGeometry.cSectors);
1435	p[57] = RT_H2LE_U16( RT_MIN(s->XCHSGeometry.cCylinders, 16383)
1436	* s->XCHSGeometry.cHeads
1437	* s->XCHSGeometry.cSectors);
1438	p[58] = RT_H2LE_U16( RT_MIN(s->XCHSGeometry.cCylinders, 16383)
1439	* s->XCHSGeometry.cHeads
1440	* s->XCHSGeometry.cSectors >> 16);
1441	if (s->cMultSectors)
1442	p[59] = RT_H2LE_U16(0x100 \| s->cMultSectors);
1443	if (s->cTotalSectors <= (1 << 28) - 1)
1444	{
1445	p[60] = RT_H2LE_U16(s->cTotalSectors);
1446	p[61] = RT_H2LE_U16(s->cTotalSectors >> 16);
1447	}
1448	else
1449	{
1450	/* Report maximum number of sectors possible with LBA28 */
1451	p[60] = RT_H2LE_U16(((1 << 28) - 1) & 0xffff);
1452	p[61] = RT_H2LE_U16(((1 << 28) - 1) >> 16);
1453	}
1454	p[63] = RT_H2LE_U16(ATA_TRANSFER_ID(ATA_MODE_MDMA, ATA_MDMA_MODE_MAX, s->uATATransferMode)); /* MDMA modes supported / mode enabled */
1455	p[64] = RT_H2LE_U16(ATA_PIO_MODE_MAX > 2 ? (1 << (ATA_PIO_MODE_MAX - 2)) - 1 : 0); /* PIO modes beyond PIO2 supported */
1456	p[65] = RT_H2LE_U16(120); /* minimum DMA multiword tx cycle time */
1457	p[66] = RT_H2LE_U16(120); /* recommended DMA multiword tx cycle time */
1458	p[67] = RT_H2LE_U16(120); /* minimum PIO cycle time without flow control */
1459	p[68] = RT_H2LE_U16(120); /* minimum PIO cycle time with IORDY flow control */
1460	if ( pDevR3->pDrvMedia->pfnDiscard
1461	\|\| s->cbSector != 512
1462	\|\| pDevR3->pDrvMedia->pfnIsNonRotational(pDevR3->pDrvMedia))
1463	{
1464	p[80] = RT_H2LE_U16(0x1f0); /* support everything up to ATA/ATAPI-8 ACS */
1465	p[81] = RT_H2LE_U16(0x28); /* conforms to ATA/ATAPI-8 ACS */
1466	}
1467	else
1468	{
1469	p[80] = RT_H2LE_U16(0x7e); /* support everything up to ATA/ATAPI-6 */
1470	p[81] = RT_H2LE_U16(0x22); /* conforms to ATA/ATAPI-6 */
1471	}
1472	p[82] = RT_H2LE_U16(1 << 3 \| 1 << 5 \| 1 << 6); /* supports power management, write cache and look-ahead */
1473	if (s->cTotalSectors <= (1 << 28) - 1)
1474	p[83] = RT_H2LE_U16(1 << 14 \| 1 << 12); /* supports FLUSH CACHE */
1475	else
1476	p[83] = RT_H2LE_U16(1 << 14 \| 1 << 10 \| 1 << 12 \| 1 << 13); /* supports LBA48, FLUSH CACHE and FLUSH CACHE EXT */
1477	p[84] = RT_H2LE_U16(1 << 14);
1478	p[85] = RT_H2LE_U16(1 << 3 \| 1 << 5 \| 1 << 6); /* enabled power management, write cache and look-ahead */
1479	if (s->cTotalSectors <= (1 << 28) - 1)
1480	p[86] = RT_H2LE_U16(1 << 12); /* enabled FLUSH CACHE */
1481	else
1482	p[86] = RT_H2LE_U16(1 << 10 \| 1 << 12 \| 1 << 13); /* enabled LBA48, FLUSH CACHE and FLUSH CACHE EXT */
1483	p[87] = RT_H2LE_U16(1 << 14);
1484	p[88] = RT_H2LE_U16(ATA_TRANSFER_ID(ATA_MODE_UDMA, ATA_UDMA_MODE_MAX, s->uATATransferMode)); /* UDMA modes supported / mode enabled */
1485	p[93] = RT_H2LE_U16((1 \| 1 << 1) << ((s->iLUN & 1) == 0 ? 0 : 8) \| 1 << 13 \| 1 << 14);
1486	if (s->cTotalSectors > (1 << 28) - 1)
1487	{
1488	p[100] = RT_H2LE_U16(s->cTotalSectors);
1489	p[101] = RT_H2LE_U16(s->cTotalSectors >> 16);
1490	p[102] = RT_H2LE_U16(s->cTotalSectors >> 32);
1491	p[103] = RT_H2LE_U16(s->cTotalSectors >> 48);
1492	}
1493
1494	if (s->cbSector != 512)
1495	{
1496	uint32_t cSectorSizeInWords = s->cbSector / sizeof(uint16_t);
1497	/* Enable reporting of logical sector size. */
1498	p[106] \|= RT_H2LE_U16(RT_BIT(12) \| RT_BIT(14));
1499	p[117] = RT_H2LE_U16(cSectorSizeInWords);
1500	p[118] = RT_H2LE_U16(cSectorSizeInWords >> 16);
1501	}
1502
1503	if (pDevR3->pDrvMedia->pfnDiscard) /** @todo Set bit 14 in word 69 too? (Deterministic read after TRIM). */
1504	p[169] = RT_H2LE_U16(1); /* DATA SET MANAGEMENT command supported. */
1505	if (pDevR3->pDrvMedia->pfnIsNonRotational(pDevR3->pDrvMedia))
1506	p[217] = RT_H2LE_U16(1); /* Non-rotational medium */
1507	uint32_t uCsum = ataR3Checksum(p, 510);
1508	p[255] = RT_H2LE_U16(0xa5 \| (uCsum << 8)); /* Integrity word */
1509	s->iSourceSink = ATAFN_SS_NULL;
1510	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
1511	return false;
1512	}
1513
1514
1515	/**
1516	* Sink/Source: FLUSH
1517	*/
1518	static bool ataR3FlushSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
1519	{
1520	int rc;
1521
1522	Assert(s->uTxDir == PDMMEDIATXDIR_NONE);
1523	Assert(!s->cbElementaryTransfer);
1524
1525	ataR3LockLeave(pDevIns, pCtl);
1526
1527	STAM_PROFILE_START(&s->StatFlushes, f);
1528	rc = pDevR3->pDrvMedia->pfnFlush(pDevR3->pDrvMedia);
1529	AssertRC(rc);
1530	STAM_PROFILE_STOP(&s->StatFlushes, f);
1531
1532	ataR3LockEnter(pDevIns, pCtl);
1533	ataR3CmdOK(pCtl, s, 0);
1534	return false;
1535	}
1536
1537	/**
1538	* Sink/Source: ATAPI IDENTIFY
1539	*/
1540	static bool atapiR3IdentifySS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
1541	{
1542	uint16_t *p;
1543	RT_NOREF(pDevIns, pDevR3);
1544
1545	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
1546	Assert(s->cbElementaryTransfer == 512);
1547
1548	p = (uint16_t *)&s->abIOBuffer[0];
1549	memset(p, 0, 512);
1550	/* Removable CDROM, 3ms response, 12 byte packets */
1551	p[0] = RT_H2LE_U16(2 << 14 \| 5 << 8 \| 1 << 7 \| 0 << 5 \| 0 << 0);
1552	ataR3PadString((uint8_t )(p + 10), s->szSerialNumber, ATA_SERIAL_NUMBER_LENGTH); / serial number */
1553	p[20] = RT_H2LE_U16(3); /* XXX: retired, cache type */
1554	p[21] = RT_H2LE_U16(512); /* XXX: retired, cache size in sectors */
1555	ataR3PadString((uint8_t )(p + 23), s->szFirmwareRevision, ATA_FIRMWARE_REVISION_LENGTH); / firmware version */
1556	ataR3PadString((uint8_t )(p + 27), s->szModelNumber, ATA_MODEL_NUMBER_LENGTH); / model */
1557	p[49] = RT_H2LE_U16(1 << 11 \| 1 << 9 \| 1 << 8); /* DMA and LBA supported */
1558	p[50] = RT_H2LE_U16(1 << 14); /* No drive specific standby timer minimum */
1559	p[51] = RT_H2LE_U16(240); /* PIO transfer cycle */
1560	p[52] = RT_H2LE_U16(240); /* DMA transfer cycle */
1561	p[53] = RT_H2LE_U16(1 << 1 \| 1 << 2); /* words 64-70,88 are valid */
1562	p[63] = RT_H2LE_U16(ATA_TRANSFER_ID(ATA_MODE_MDMA, ATA_MDMA_MODE_MAX, s->uATATransferMode)); /* MDMA modes supported / mode enabled */
1563	p[64] = RT_H2LE_U16(ATA_PIO_MODE_MAX > 2 ? (1 << (ATA_PIO_MODE_MAX - 2)) - 1 : 0); /* PIO modes beyond PIO2 supported */
1564	p[65] = RT_H2LE_U16(120); /* minimum DMA multiword tx cycle time */
1565	p[66] = RT_H2LE_U16(120); /* recommended DMA multiword tx cycle time */
1566	p[67] = RT_H2LE_U16(120); /* minimum PIO cycle time without flow control */
1567	p[68] = RT_H2LE_U16(120); /* minimum PIO cycle time with IORDY flow control */
1568	p[73] = RT_H2LE_U16(0x003e); /* ATAPI CDROM major */
1569	p[74] = RT_H2LE_U16(9); /* ATAPI CDROM minor */
1570	p[75] = RT_H2LE_U16(1); /* queue depth 1 */
1571	p[80] = RT_H2LE_U16(0x7e); /* support everything up to ATA/ATAPI-6 */
1572	p[81] = RT_H2LE_U16(0x22); /* conforms to ATA/ATAPI-6 */
1573	p[82] = RT_H2LE_U16(1 << 4 \| 1 << 9); /* supports packet command set and DEVICE RESET */
1574	p[83] = RT_H2LE_U16(1 << 14);
1575	p[84] = RT_H2LE_U16(1 << 14);
1576	p[85] = RT_H2LE_U16(1 << 4 \| 1 << 9); /* enabled packet command set and DEVICE RESET */
1577	p[86] = RT_H2LE_U16(0);
1578	p[87] = RT_H2LE_U16(1 << 14);
1579	p[88] = RT_H2LE_U16(ATA_TRANSFER_ID(ATA_MODE_UDMA, ATA_UDMA_MODE_MAX, s->uATATransferMode)); /* UDMA modes supported / mode enabled */
1580	p[93] = RT_H2LE_U16((1 \| 1 << 1) << ((s->iLUN & 1) == 0 ? 0 : 8) \| 1 << 13 \| 1 << 14);
1581	/* According to ATAPI-5 spec:
1582	*
1583	* The use of this word is optional.
1584	* If bits 7:0 of this word contain the signature A5h, bits 15:8
1585	* contain the data
1586	* structure checksum.
1587	* The data structure checksum is the twos complement of the sum of
1588	* all bytes in words 0 through 254 and the byte consisting of
1589	* bits 7:0 in word 255.
1590	* Each byte shall be added with unsigned arithmetic,
1591	* and overflow shall be ignored.
1592	* The sum of all 512 bytes is zero when the checksum is correct.
1593	*/
1594	uint32_t uCsum = ataR3Checksum(p, 510);
1595	p[255] = RT_H2LE_U16(0xa5 \| (uCsum << 8)); /* Integrity word */
1596
1597	s->iSourceSink = ATAFN_SS_NULL;
1598	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
1599	return false;
1600	}
1601
1602
1603	static void ataR3SetSignature(PATADEVSTATE s)
1604	{
1605	s->uATARegSelect &= 0xf0; /* clear head */
1606	/* put signature */
1607	s->uATARegNSector = 1;
1608	s->uATARegSector = 1;
1609	if (s->fATAPI)
1610	{
1611	s->uATARegLCyl = 0x14;
1612	s->uATARegHCyl = 0xeb;
1613	}
1614	else
1615	{
1616	s->uATARegLCyl = 0;
1617	s->uATARegHCyl = 0;
1618	}
1619	}
1620
1621
1622	static uint64_t ataR3GetSector(PATADEVSTATE s)
1623	{
1624	uint64_t iLBA;
1625	if (s->uATARegSelect & 0x40)
1626	{
1627	/* any LBA variant */
1628	if (s->fLBA48)
1629	{
1630	/* LBA48 */
1631	iLBA = ((uint64_t)s->uATARegHCylHOB << 40)
1632	\| ((uint64_t)s->uATARegLCylHOB << 32)
1633	\| ((uint64_t)s->uATARegSectorHOB << 24)
1634	\| ((uint64_t)s->uATARegHCyl << 16)
1635	\| ((uint64_t)s->uATARegLCyl << 8)
1636	\| s->uATARegSector;
1637	}
1638	else
1639	{
1640	/* LBA */
1641	iLBA = ((uint32_t)(s->uATARegSelect & 0x0f) << 24)
1642	\| ((uint32_t)s->uATARegHCyl << 16)
1643	\| ((uint32_t)s->uATARegLCyl << 8)
1644	\| s->uATARegSector;
1645	}
1646	}
1647	else
1648	{
1649	/* CHS */
1650	iLBA = (((uint32_t)s->uATARegHCyl << 8) \| s->uATARegLCyl) * s->XCHSGeometry.cHeads * s->XCHSGeometry.cSectors
1651	+ (s->uATARegSelect & 0x0f) * s->XCHSGeometry.cSectors
1652	+ (s->uATARegSector - 1);
1653	LogFlowFunc(("CHS %u/%u/%u -> LBA %llu\n", ((uint32_t)s->uATARegHCyl << 8) \| s->uATARegLCyl, s->uATARegSelect & 0x0f, s->uATARegSector, iLBA));
1654	}
1655	return iLBA;
1656	}
1657
1658	static void ataR3SetSector(PATADEVSTATE s, uint64_t iLBA)
1659	{
1660	uint32_t cyl, r;
1661	if (s->uATARegSelect & 0x40)
1662	{
1663	/* any LBA variant */
1664	if (s->fLBA48)
1665	{
1666	/* LBA48 */
1667	s->uATARegHCylHOB = iLBA >> 40;
1668	s->uATARegLCylHOB = iLBA >> 32;
1669	s->uATARegSectorHOB = iLBA >> 24;
1670	s->uATARegHCyl = iLBA >> 16;
1671	s->uATARegLCyl = iLBA >> 8;
1672	s->uATARegSector = iLBA;
1673	}
1674	else
1675	{
1676	/* LBA */
1677	s->uATARegSelect = (s->uATARegSelect & 0xf0) \| (iLBA >> 24);
1678	s->uATARegHCyl = (iLBA >> 16);
1679	s->uATARegLCyl = (iLBA >> 8);
1680	s->uATARegSector = (iLBA);
1681	}
1682	}
1683	else
1684	{
1685	/* CHS */
1686	AssertMsgReturnVoid(s->XCHSGeometry.cHeads && s->XCHSGeometry.cSectors, ("Device geometry not set!\n"));
1687	cyl = iLBA / (s->XCHSGeometry.cHeads * s->XCHSGeometry.cSectors);
1688	r = iLBA % (s->XCHSGeometry.cHeads * s->XCHSGeometry.cSectors);
1689	s->uATARegHCyl = cyl >> 8;
1690	s->uATARegLCyl = cyl;
1691	s->uATARegSelect = (s->uATARegSelect & 0xf0) \| ((r / s->XCHSGeometry.cSectors) & 0x0f);
1692	s->uATARegSector = (r % s->XCHSGeometry.cSectors) + 1;
1693	LogFlowFunc(("LBA %llu -> CHS %u/%u/%u\n", iLBA, cyl, s->uATARegSelect & 0x0f, s->uATARegSector));
1694	}
1695	}
1696
1697
1698	static void ataR3WarningDiskFull(PPDMDEVINS pDevIns)
1699	{
1700	int rc;
1701	LogRel(("PIIX3 ATA: Host disk full\n"));
1702	rc = PDMDevHlpVMSetRuntimeError(pDevIns, VMSETRTERR_FLAGS_SUSPEND \| VMSETRTERR_FLAGS_NO_WAIT, "DevATA_DISKFULL",
1703	N_("Host system reported disk full. VM execution is suspended. You can resume after freeing some space"));
1704	AssertRC(rc);
1705	}
1706
1707	static void ataR3WarningFileTooBig(PPDMDEVINS pDevIns)
1708	{
1709	int rc;
1710	LogRel(("PIIX3 ATA: File too big\n"));
1711	rc = PDMDevHlpVMSetRuntimeError(pDevIns, VMSETRTERR_FLAGS_SUSPEND \| VMSETRTERR_FLAGS_NO_WAIT, "DevATA_FILETOOBIG",
1712	N_("Host system reported that the file size limit of the host file system has been exceeded. VM execution is suspended. You need to move your virtual hard disk to a filesystem which allows bigger files"));
1713	AssertRC(rc);
1714	}
1715
1716	static void ataR3WarningISCSI(PPDMDEVINS pDevIns)
1717	{
1718	int rc;
1719	LogRel(("PIIX3 ATA: iSCSI target unavailable\n"));
1720	rc = PDMDevHlpVMSetRuntimeError(pDevIns, VMSETRTERR_FLAGS_SUSPEND \| VMSETRTERR_FLAGS_NO_WAIT, "DevATA_ISCSIDOWN",
1721	N_("The iSCSI target has stopped responding. VM execution is suspended. You can resume when it is available again"));
1722	AssertRC(rc);
1723	}
1724
1725	static bool ataR3IsRedoSetWarning(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, int rc)
1726	{
1727	Assert(!PDMDevHlpCritSectIsOwner(pDevIns, &pCtl->lock));
1728	if (rc == VERR_DISK_FULL)
1729	{
1730	pCtl->fRedoIdle = true;
1731	ataR3WarningDiskFull(pDevIns);
1732	return true;
1733	}
1734	if (rc == VERR_FILE_TOO_BIG)
1735	{
1736	pCtl->fRedoIdle = true;
1737	ataR3WarningFileTooBig(pDevIns);
1738	return true;
1739	}
1740	if (rc == VERR_BROKEN_PIPE \|\| rc == VERR_NET_CONNECTION_REFUSED)
1741	{
1742	pCtl->fRedoIdle = true;
1743	/* iSCSI connection abort (first error) or failure to reestablish
1744	* connection (second error). Pause VM. On resume we'll retry. */
1745	ataR3WarningISCSI(pDevIns);
1746	return true;
1747	}
1748	if (rc == VERR_VD_DEK_MISSING)
1749	{
1750	/* Error message already set. */
1751	pCtl->fRedoIdle = true;
1752	return true;
1753	}
1754
1755	return false;
1756	}
1757
1758
1759	static int ataR3ReadSectors(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3,
1760	uint64_t u64Sector, void pvBuf, uint32_t cSectors, bool pfRedo)
1761	{
1762	int rc;
1763	uint32_t const cbSector = s->cbSector;
1764	uint32_t cbToRead = cSectors * cbSector;
1765	Assert(pvBuf == &s->abIOBuffer[0]);
1766	AssertReturnStmt(cbToRead <= sizeof(s->abIOBuffer), *pfRedo = false, VERR_BUFFER_OVERFLOW);
1767
1768	ataR3LockLeave(pDevIns, pCtl);
1769
1770	STAM_PROFILE_ADV_START(&s->StatReads, r);
1771	s->Led.Asserted.s.fReading = s->Led.Actual.s.fReading = 1;
1772	rc = pDevR3->pDrvMedia->pfnRead(pDevR3->pDrvMedia, u64Sector * cbSector, pvBuf, cbToRead);
1773	s->Led.Actual.s.fReading = 0;
1774	STAM_PROFILE_ADV_STOP(&s->StatReads, r);
1775	Log4(("ataR3ReadSectors: rc=%Rrc cSectors=%#x u64Sector=%llu\n%.*Rhxd\n",
1776	rc, cSectors, u64Sector, cbToRead, pvBuf));
1777
1778	STAM_REL_COUNTER_ADD(&s->StatBytesRead, cbToRead);
1779
1780	if (RT_SUCCESS(rc))
1781	*pfRedo = false;
1782	else
1783	*pfRedo = ataR3IsRedoSetWarning(pDevIns, pCtl, rc);
1784
1785	ataR3LockEnter(pDevIns, pCtl);
1786	return rc;
1787	}
1788
1789
1790	static int ataR3WriteSectors(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3,
1791	uint64_t u64Sector, const void pvBuf, uint32_t cSectors, bool pfRedo)
1792	{
1793	int rc;
1794	uint32_t const cbSector = s->cbSector;
1795	uint32_t cbToWrite = cSectors * cbSector;
1796	Assert(pvBuf == &s->abIOBuffer[0]);
1797	AssertReturnStmt(cbToWrite <= sizeof(s->abIOBuffer), *pfRedo = false, VERR_BUFFER_OVERFLOW);
1798
1799	ataR3LockLeave(pDevIns, pCtl);
1800
1801	STAM_PROFILE_ADV_START(&s->StatWrites, w);
1802	s->Led.Asserted.s.fWriting = s->Led.Actual.s.fWriting = 1;
1803	# ifdef VBOX_INSTRUMENT_DMA_WRITES
1804	if (s->fDMA)
1805	STAM_PROFILE_ADV_START(&s->StatInstrVDWrites, vw);
1806	# endif
1807	rc = pDevR3->pDrvMedia->pfnWrite(pDevR3->pDrvMedia, u64Sector * cbSector, pvBuf, cbToWrite);
1808	# ifdef VBOX_INSTRUMENT_DMA_WRITES
1809	if (s->fDMA)
1810	STAM_PROFILE_ADV_STOP(&s->StatInstrVDWrites, vw);
1811	# endif
1812	s->Led.Actual.s.fWriting = 0;
1813	STAM_PROFILE_ADV_STOP(&s->StatWrites, w);
1814	Log4(("ataR3WriteSectors: rc=%Rrc cSectors=%#x u64Sector=%llu\n%.*Rhxd\n",
1815	rc, cSectors, u64Sector, cbToWrite, pvBuf));
1816
1817	STAM_REL_COUNTER_ADD(&s->StatBytesWritten, cbToWrite);
1818
1819	if (RT_SUCCESS(rc))
1820	*pfRedo = false;
1821	else
1822	*pfRedo = ataR3IsRedoSetWarning(pDevIns, pCtl, rc);
1823
1824	ataR3LockEnter(pDevIns, pCtl);
1825	return rc;
1826	}
1827
1828
1829	/**
1830	* Begin Transfer: READ/WRITE SECTORS
1831	*/
1832	static void ataR3ReadWriteSectorsBT(PATACONTROLLER pCtl, PATADEVSTATE s)
1833	{
1834	uint32_t const cbSector = RT_MAX(s->cbSector, 1);
1835	uint32_t cSectors;
1836
1837	cSectors = s->cbTotalTransfer / cbSector;
1838	if (cSectors > s->cSectorsPerIRQ)
1839	s->cbElementaryTransfer = s->cSectorsPerIRQ * cbSector;
1840	else
1841	s->cbElementaryTransfer = cSectors * cbSector;
1842	if (s->uTxDir == PDMMEDIATXDIR_TO_DEVICE)
1843	ataR3CmdOK(pCtl, s, 0);
1844	}
1845
1846
1847	/**
1848	* Sink/Source: READ SECTORS
1849	*/
1850	static bool ataR3ReadSectorsSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
1851	{
1852	uint32_t const cbSector = RT_MAX(s->cbSector, 1);
1853	uint32_t cSectors;
1854	uint64_t iLBA;
1855	bool fRedo;
1856	int rc;
1857
1858	cSectors = s->cbElementaryTransfer / cbSector;
1859	Assert(cSectors);
1860	iLBA = s->iCurLBA;
1861	Log(("%s: %d sectors at LBA %d\n", __FUNCTION__, cSectors, iLBA));
1862	rc = ataR3ReadSectors(pDevIns, pCtl, s, pDevR3, iLBA, s->abIOBuffer, cSectors, &fRedo);
1863	if (RT_SUCCESS(rc))
1864	{
1865	/* When READ SECTORS etc. finishes, the address in the task
1866	* file register points at the last sector read, not at the next
1867	* sector that would be read. This ensures the registers always
1868	* contain a valid sector address.
1869	*/
1870	if (s->cbElementaryTransfer == s->cbTotalTransfer)
1871	{
1872	s->iSourceSink = ATAFN_SS_NULL;
1873	ataR3SetSector(s, iLBA + cSectors - 1);
1874	}
1875	else
1876	ataR3SetSector(s, iLBA + cSectors);
1877	s->uATARegNSector -= cSectors;
1878	s->iCurLBA += cSectors;
1879	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
1880	}
1881	else
1882	{
1883	if (fRedo)
1884	return fRedo;
1885	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
1886	LogRel(("PIIX3 ATA: LUN#%d: disk read error (rc=%Rrc iSector=%#RX64 cSectors=%#RX32)\n",
1887	s->iLUN, rc, iLBA, cSectors));
1888
1889	/*
1890	* Check if we got interrupted. We don't need to set status variables
1891	* because the request was aborted.
1892	*/
1893	if (rc != VERR_INTERRUPTED)
1894	ataR3CmdError(pCtl, s, ID_ERR);
1895	}
1896	return false;
1897	}
1898
1899
1900	/**
1901	* Sink/Source: WRITE SECTOR
1902	*/
1903	static bool ataR3WriteSectorsSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
1904	{
1905	uint32_t const cbSector = RT_MAX(s->cbSector, 1);
1906	uint64_t iLBA;
1907	uint32_t cSectors;
1908	bool fRedo;
1909	int rc;
1910
1911	cSectors = s->cbElementaryTransfer / cbSector;
1912	Assert(cSectors);
1913	iLBA = s->iCurLBA;
1914	Log(("%s: %d sectors at LBA %d\n", __FUNCTION__, cSectors, iLBA));
1915	rc = ataR3WriteSectors(pDevIns, pCtl, s, pDevR3, iLBA, s->abIOBuffer, cSectors, &fRedo);
1916	if (RT_SUCCESS(rc))
1917	{
1918	ataR3SetSector(s, iLBA + cSectors);
1919	s->iCurLBA = iLBA + cSectors;
1920	if (!s->cbTotalTransfer)
1921	s->iSourceSink = ATAFN_SS_NULL;
1922	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
1923	}
1924	else
1925	{
1926	if (fRedo)
1927	return fRedo;
1928	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
1929	LogRel(("PIIX3 ATA: LUN#%d: disk write error (rc=%Rrc iSector=%#RX64 cSectors=%#RX32)\n",
1930	s->iLUN, rc, iLBA, cSectors));
1931
1932	/*
1933	* Check if we got interrupted. We don't need to set status variables
1934	* because the request was aborted.
1935	*/
1936	if (rc != VERR_INTERRUPTED)
1937	ataR3CmdError(pCtl, s, ID_ERR);
1938	}
1939	return false;
1940	}
1941
1942
1943	static void atapiR3CmdOK(PATACONTROLLER pCtl, PATADEVSTATE s)
1944	{
1945	s->uATARegError = 0;
1946	ataSetStatusValue(pCtl, s, ATA_STAT_READY);
1947	s->uATARegNSector = (s->uATARegNSector & ~7)
1948	\| ((s->uTxDir != PDMMEDIATXDIR_TO_DEVICE) ? ATAPI_INT_REASON_IO : 0)
1949	\| (!s->cbTotalTransfer ? ATAPI_INT_REASON_CD : 0);
1950	Log2(("%s: interrupt reason %#04x\n", __FUNCTION__, s->uATARegNSector));
1951
1952	memset(s->abATAPISense, '\0', sizeof(s->abATAPISense));
1953	s->abATAPISense[0] = 0x70 \| (1 << 7);
1954	s->abATAPISense[7] = 10;
1955	}
1956
1957
1958	static void atapiR3CmdError(PATACONTROLLER pCtl, PATADEVSTATE s, const uint8_t *pabATAPISense, size_t cbATAPISense)
1959	{
1960	Log(("%s: sense=%#x (%s) asc=%#x ascq=%#x (%s)\n", __FUNCTION__, pabATAPISense[2] & 0x0f, SCSISenseText(pabATAPISense[2] & 0x0f),
1961	pabATAPISense[12], pabATAPISense[13], SCSISenseExtText(pabATAPISense[12], pabATAPISense[13])));
1962	s->uATARegError = pabATAPISense[2] << 4;
1963	ataSetStatusValue(pCtl, s, ATA_STAT_READY \| ATA_STAT_ERR);
1964	s->uATARegNSector = (s->uATARegNSector & ~7) \| ATAPI_INT_REASON_IO \| ATAPI_INT_REASON_CD;
1965	Log2(("%s: interrupt reason %#04x\n", __FUNCTION__, s->uATARegNSector));
1966	memset(s->abATAPISense, '\0', sizeof(s->abATAPISense));
1967	memcpy(s->abATAPISense, pabATAPISense, RT_MIN(cbATAPISense, sizeof(s->abATAPISense)));
1968	s->cbTotalTransfer = 0;
1969	s->cbElementaryTransfer = 0;
1970	s->cbAtapiPassthroughTransfer = 0;
1971	s->iIOBufferCur = 0;
1972	s->iIOBufferEnd = 0;
1973	s->uTxDir = PDMMEDIATXDIR_NONE;
1974	s->iBeginTransfer = ATAFN_BT_NULL;
1975	s->iSourceSink = ATAFN_SS_NULL;
1976	}
1977
1978
1979	/** @todo deprecated function - doesn't provide enough info. Replace by direct
1980	* calls to atapiR3CmdError() with full data. */
1981	static void atapiR3CmdErrorSimple(PATACONTROLLER pCtl, PATADEVSTATE s, uint8_t uATAPISenseKey, uint8_t uATAPIASC)
1982	{
1983	uint8_t abATAPISense[ATAPI_SENSE_SIZE];
1984	memset(abATAPISense, '\0', sizeof(abATAPISense));
1985	abATAPISense[0] = 0x70 \| (1 << 7);
1986	abATAPISense[2] = uATAPISenseKey & 0x0f;
1987	abATAPISense[7] = 10;
1988	abATAPISense[12] = uATAPIASC;
1989	atapiR3CmdError(pCtl, s, abATAPISense, sizeof(abATAPISense));
1990	}
1991
1992
1993	/**
1994	* Begin Transfer: ATAPI command
1995	*/
1996	static void atapiR3CmdBT(PATACONTROLLER pCtl, PATADEVSTATE s)
1997	{
1998	s->fATAPITransfer = true;
1999	s->cbElementaryTransfer = s->cbTotalTransfer;
2000	s->cbAtapiPassthroughTransfer = s->cbTotalTransfer;
2001	s->cbPIOTransferLimit = s->uATARegLCyl \| (s->uATARegHCyl << 8);
2002	if (s->uTxDir == PDMMEDIATXDIR_TO_DEVICE)
2003	atapiR3CmdOK(pCtl, s);
2004	}
2005
2006
2007	/**
2008	* Begin Transfer: ATAPI Passthrough command
2009	*/
2010	static void atapiR3PassthroughCmdBT(PATACONTROLLER pCtl, PATADEVSTATE s)
2011	{
2012	atapiR3CmdBT(pCtl, s);
2013	}
2014
2015
2016	/**
2017	* Sink/Source: READ
2018	*/
2019	static bool atapiR3ReadSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
2020	{
2021	int rc;
2022	uint64_t cbBlockRegion = 0;
2023	VDREGIONDATAFORM enmDataForm;
2024
2025	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
2026	uint32_t const iATAPILBA = s->iCurLBA;
2027	uint32_t const cbTransfer = RT_MIN(s->cbTotalTransfer, RT_MIN(s->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE));
2028	uint32_t const cbATAPISector = s->cbATAPISector;
2029	uint32_t const cSectors = cbTransfer / cbATAPISector;
2030	Assert(cSectors * cbATAPISector <= cbTransfer);
2031	Log(("%s: %d sectors at LBA %d\n", __FUNCTION__, cSectors, iATAPILBA));
2032	AssertLogRelReturn(cSectors * cbATAPISector <= sizeof(s->abIOBuffer), false);
2033
2034	ataR3LockLeave(pDevIns, pCtl);
2035
2036	rc = pDevR3->pDrvMedia->pfnQueryRegionPropertiesForLba(pDevR3->pDrvMedia, iATAPILBA, NULL, NULL,
2037	&cbBlockRegion, &enmDataForm);
2038	if (RT_SUCCESS(rc))
2039	{
2040	STAM_PROFILE_ADV_START(&s->StatReads, r);
2041	s->Led.Asserted.s.fReading = s->Led.Actual.s.fReading = 1;
2042
2043	/* If the region block size and requested sector matches we can just pass the request through. */
2044	if (cbBlockRegion == cbATAPISector)
2045	rc = pDevR3->pDrvMedia->pfnRead(pDevR3->pDrvMedia, (uint64_t)iATAPILBA * cbATAPISector,
2046	s->abIOBuffer, cbATAPISector * cSectors);
2047	else
2048	{
2049	uint32_t const iEndSector = iATAPILBA + cSectors;
2050	ASSERT_GUEST(iEndSector >= iATAPILBA);
2051	if (cbBlockRegion == 2048 && cbATAPISector == 2352)
2052	{
2053	/* Generate the sync bytes. */
2054	uint8_t *pbBuf = s->abIOBuffer;
2055
2056	for (uint32_t i = iATAPILBA; i < iEndSector; i++)
2057	{
2058	/* Sync bytes, see 4.2.3.8 CD Main Channel Block Formats */
2059	*pbBuf++ = 0x00;
2060	memset(pbBuf, 0xff, 10);
2061	pbBuf += 10;
2062	*pbBuf++ = 0x00;
2063	/* MSF */
2064	scsiLBA2MSF(pbBuf, i);
2065	pbBuf += 3;
2066	pbBuf++ = 0x01; / mode 1 data */
2067	/* data */
2068	rc = pDevR3->pDrvMedia->pfnRead(pDevR3->pDrvMedia, (uint64_t)i * 2048, pbBuf, 2048);
2069	if (RT_FAILURE(rc))
2070	break;
2071	pbBuf += 2048;
2072	/**
2073	* @todo maybe compute ECC and parity, layout is:
2074	* 2072 4 EDC
2075	* 2076 172 P parity symbols
2076	* 2248 104 Q parity symbols
2077	*/
2078	memset(pbBuf, 0, 280);
2079	pbBuf += 280;
2080	}
2081	}
2082	else if (cbBlockRegion == 2352 && cbATAPISector == 2048)
2083	{
2084	/* Read only the user data portion. */
2085	uint8_t *pbBuf = s->abIOBuffer;
2086
2087	for (uint32_t i = iATAPILBA; i < iEndSector; i++)
2088	{
2089	uint8_t abTmp[2352];
2090	uint8_t cbSkip;
2091
2092	rc = pDevR3->pDrvMedia->pfnRead(pDevR3->pDrvMedia, (uint64_t)i * 2352, &abTmp[0], 2352);
2093	if (RT_FAILURE(rc))
2094	break;
2095
2096	/* Mode 2 has an additional subheader before user data; we need to
2097	* skip 16 bytes for Mode 1 (sync + header) and 20 bytes for Mode 2 +
2098	* (sync + header + subheader).
2099	*/
2100	switch (enmDataForm) {
2101	case VDREGIONDATAFORM_MODE2_2352:
2102	case VDREGIONDATAFORM_XA_2352:
2103	cbSkip = 24;
2104	break;
2105	case VDREGIONDATAFORM_MODE1_2352:
2106	cbSkip = 16;
2107	break;
2108	default:
2109	AssertMsgFailed(("Unexpected region form (%#u), using default skip value\n", enmDataForm));
2110	cbSkip = 16;
2111	}
2112	memcpy(pbBuf, &abTmp[cbSkip], 2048);
2113	pbBuf += 2048;
2114	}
2115	}
2116	else
2117	ASSERT_GUEST_MSG_FAILED(("Unsupported: cbBlockRegion=%u cbATAPISector=%u\n", cbBlockRegion, cbATAPISector));
2118	}
2119	s->Led.Actual.s.fReading = 0;
2120	STAM_PROFILE_ADV_STOP(&s->StatReads, r);
2121	}
2122
2123	ataR3LockEnter(pDevIns, pCtl);
2124
2125	if (RT_SUCCESS(rc))
2126	{
2127	STAM_REL_COUNTER_ADD(&s->StatBytesRead, cbATAPISector * cSectors);
2128
2129	/* The initial buffer end value has been set up based on the total
2130	* transfer size. But the I/O buffer size limits what can actually be
2131	* done in one transfer, so set the actual value of the buffer end. */
2132	s->cbElementaryTransfer = cbTransfer;
2133	if (cbTransfer >= s->cbTotalTransfer)
2134	s->iSourceSink = ATAFN_SS_NULL;
2135	atapiR3CmdOK(pCtl, s);
2136	s->iCurLBA = iATAPILBA + cSectors;
2137	}
2138	else
2139	{
2140	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
2141	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM read error, %d sectors at LBA %d\n", s->iLUN, cSectors, iATAPILBA));
2142
2143	/*
2144	* Check if we got interrupted. We don't need to set status variables
2145	* because the request was aborted.
2146	*/
2147	if (rc != VERR_INTERRUPTED)
2148	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_MEDIUM_ERROR, SCSI_ASC_READ_ERROR);
2149	}
2150	return false;
2151	}
2152
2153	/**
2154	* Sets the given media track type.
2155	*/
2156	static uint32_t ataR3MediumTypeSet(PATADEVSTATE s, uint32_t MediaTrackType)
2157	{
2158	return ASMAtomicXchgU32(&s->MediaTrackType, MediaTrackType);
2159	}
2160
2161
2162	/**
2163	* Sink/Source: Passthrough
2164	*/
2165	static bool atapiR3PassthroughSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
2166	{
2167	int rc = VINF_SUCCESS;
2168	uint8_t abATAPISense[ATAPI_SENSE_SIZE];
2169	uint32_t cbTransfer;
2170	PSTAMPROFILEADV pProf = NULL;
2171
2172	cbTransfer = RT_MIN(s->cbAtapiPassthroughTransfer, RT_MIN(s->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE));
2173
2174	if (s->uTxDir == PDMMEDIATXDIR_TO_DEVICE)
2175	Log3(("ATAPI PT data write (%d): %.*Rhxs\n", cbTransfer, cbTransfer, s->abIOBuffer));
2176
2177	/* Simple heuristics: if there is at least one sector of data
2178	* to transfer, it's worth updating the LEDs. */
2179	if (cbTransfer >= 2048)
2180	{
2181	if (s->uTxDir != PDMMEDIATXDIR_TO_DEVICE)
2182	{
2183	s->Led.Asserted.s.fReading = s->Led.Actual.s.fReading = 1;
2184	pProf = &s->StatReads;
2185	}
2186	else
2187	{
2188	s->Led.Asserted.s.fWriting = s->Led.Actual.s.fWriting = 1;
2189	pProf = &s->StatWrites;
2190	}
2191	}
2192
2193	ataR3LockLeave(pDevIns, pCtl);
2194
2195	# if defined(LOG_ENABLED)
2196	char szBuf[1024];
2197
2198	memset(szBuf, 0, sizeof(szBuf));
2199
2200	switch (s->abATAPICmd[0])
2201	{
2202	case SCSI_MODE_SELECT_10:
2203	{
2204	size_t cbBlkDescLength = scsiBE2H_U16(&s->abIOBuffer[6]);
2205
2206	SCSILogModePage(szBuf, sizeof(szBuf) - 1,
2207	s->abIOBuffer + 8 + cbBlkDescLength,
2208	cbTransfer - 8 - cbBlkDescLength);
2209	break;
2210	}
2211	case SCSI_SEND_CUE_SHEET:
2212	{
2213	SCSILogCueSheet(szBuf, sizeof(szBuf) - 1,
2214	s->abIOBuffer, cbTransfer);
2215	break;
2216	}
2217	default:
2218	break;
2219	}
2220
2221	Log2(("%s\n", szBuf));
2222	# endif
2223
2224	if (pProf) { STAM_PROFILE_ADV_START(pProf, b); }
2225
2226	Assert(s->cbATAPISector);
2227	const uint32_t cbATAPISector = RT_MAX(s->cbATAPISector, 1); /* paranoia */
2228	const uint32_t cbIOBuffer = RT_MIN(s->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE); /* ditto */
2229
2230	if ( cbTransfer > SCSI_MAX_BUFFER_SIZE
2231	\|\| s->cbElementaryTransfer > cbIOBuffer)
2232	{
2233	/* Linux accepts commands with up to 100KB of data, but expects
2234	* us to handle commands with up to 128KB of data. The usual
2235	* imbalance of powers. */
2236	uint8_t abATAPICmd[ATAPI_PACKET_SIZE];
2237	uint32_t iATAPILBA, cSectors, cReqSectors, cbCurrTX;
2238	uint8_t *pbBuf = s->abIOBuffer;
2239	uint32_t cSectorsMax; /*< Maximum amount of sectors to read without exceeding the I/O buffer. /
2240
2241	cSectorsMax = cbTransfer / cbATAPISector;
2242	AssertStmt(cSectorsMax * s->cbATAPISector <= cbIOBuffer, cSectorsMax = cbIOBuffer / cbATAPISector);
2243
2244	switch (s->abATAPICmd[0])
2245	{
2246	case SCSI_READ_10:
2247	case SCSI_WRITE_10:
2248	case SCSI_WRITE_AND_VERIFY_10:
2249	iATAPILBA = scsiBE2H_U32(s->abATAPICmd + 2);
2250	cSectors = scsiBE2H_U16(s->abATAPICmd + 7);
2251	break;
2252	case SCSI_READ_12:
2253	case SCSI_WRITE_12:
2254	iATAPILBA = scsiBE2H_U32(s->abATAPICmd + 2);
2255	cSectors = scsiBE2H_U32(s->abATAPICmd + 6);
2256	break;
2257	case SCSI_READ_CD:
2258	iATAPILBA = scsiBE2H_U32(s->abATAPICmd + 2);
2259	cSectors = scsiBE2H_U24(s->abATAPICmd + 6);
2260	break;
2261	case SCSI_READ_CD_MSF:
2262	iATAPILBA = scsiMSF2LBA(s->abATAPICmd + 3);
2263	cSectors = scsiMSF2LBA(s->abATAPICmd + 6) - iATAPILBA;
2264	break;
2265	default:
2266	AssertMsgFailed(("Don't know how to split command %#04x\n", s->abATAPICmd[0]));
2267	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
2268	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM passthrough split error\n", s->iLUN));
2269	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_ILLEGAL_OPCODE);
2270	ataR3LockEnter(pDevIns, pCtl);
2271	return false;
2272	}
2273	cSectorsMax = RT_MIN(cSectorsMax, cSectors);
2274	memcpy(abATAPICmd, s->abATAPICmd, ATAPI_PACKET_SIZE);
2275	cReqSectors = 0;
2276	for (uint32_t i = cSectorsMax; i > 0; i -= cReqSectors)
2277	{
2278	if (i * cbATAPISector > SCSI_MAX_BUFFER_SIZE)
2279	cReqSectors = SCSI_MAX_BUFFER_SIZE / cbATAPISector;
2280	else
2281	cReqSectors = i;
2282	cbCurrTX = cbATAPISector * cReqSectors;
2283	switch (s->abATAPICmd[0])
2284	{
2285	case SCSI_READ_10:
2286	case SCSI_WRITE_10:
2287	case SCSI_WRITE_AND_VERIFY_10:
2288	scsiH2BE_U32(abATAPICmd + 2, iATAPILBA);
2289	scsiH2BE_U16(abATAPICmd + 7, cReqSectors);
2290	break;
2291	case SCSI_READ_12:
2292	case SCSI_WRITE_12:
2293	scsiH2BE_U32(abATAPICmd + 2, iATAPILBA);
2294	scsiH2BE_U32(abATAPICmd + 6, cReqSectors);
2295	break;
2296	case SCSI_READ_CD:
2297	scsiH2BE_U32(abATAPICmd + 2, iATAPILBA);
2298	scsiH2BE_U24(abATAPICmd + 6, cReqSectors);
2299	break;
2300	case SCSI_READ_CD_MSF:
2301	scsiLBA2MSF(abATAPICmd + 3, iATAPILBA);
2302	scsiLBA2MSF(abATAPICmd + 6, iATAPILBA + cReqSectors);
2303	break;
2304	}
2305	AssertLogRelReturn((uintptr_t)(pbBuf - &s->abIOBuffer[0]) + cbCurrTX <= sizeof(s->abIOBuffer), false);
2306	rc = pDevR3->pDrvMedia->pfnSendCmd(pDevR3->pDrvMedia, abATAPICmd, ATAPI_PACKET_SIZE, (PDMMEDIATXDIR)s->uTxDir,
2307	pbBuf, &cbCurrTX, abATAPISense, sizeof(abATAPISense), 30000 /*< @todo timeout /);
2308	if (rc != VINF_SUCCESS)
2309	break;
2310	iATAPILBA += cReqSectors;
2311	pbBuf += cbATAPISector * cReqSectors;
2312	}
2313
2314	if (RT_SUCCESS(rc))
2315	{
2316	/* Adjust ATAPI command for the next call. */
2317	switch (s->abATAPICmd[0])
2318	{
2319	case SCSI_READ_10:
2320	case SCSI_WRITE_10:
2321	case SCSI_WRITE_AND_VERIFY_10:
2322	scsiH2BE_U32(s->abATAPICmd + 2, iATAPILBA);
2323	scsiH2BE_U16(s->abATAPICmd + 7, cSectors - cSectorsMax);
2324	break;
2325	case SCSI_READ_12:
2326	case SCSI_WRITE_12:
2327	scsiH2BE_U32(s->abATAPICmd + 2, iATAPILBA);
2328	scsiH2BE_U32(s->abATAPICmd + 6, cSectors - cSectorsMax);
2329	break;
2330	case SCSI_READ_CD:
2331	scsiH2BE_U32(s->abATAPICmd + 2, iATAPILBA);
2332	scsiH2BE_U24(s->abATAPICmd + 6, cSectors - cSectorsMax);
2333	break;
2334	case SCSI_READ_CD_MSF:
2335	scsiLBA2MSF(s->abATAPICmd + 3, iATAPILBA);
2336	scsiLBA2MSF(s->abATAPICmd + 6, iATAPILBA + cSectors - cSectorsMax);
2337	break;
2338	default:
2339	AssertMsgFailed(("Don't know how to split command %#04x\n", s->abATAPICmd[0]));
2340	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
2341	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM passthrough split error\n", s->iLUN));
2342	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_ILLEGAL_OPCODE);
2343	return false;
2344	}
2345	}
2346	}
2347	else
2348	{
2349	AssertLogRelReturn(cbTransfer <= sizeof(s->abIOBuffer), false);
2350	rc = pDevR3->pDrvMedia->pfnSendCmd(pDevR3->pDrvMedia, s->abATAPICmd, ATAPI_PACKET_SIZE, (PDMMEDIATXDIR)s->uTxDir,
2351	s->abIOBuffer, &cbTransfer, abATAPISense, sizeof(abATAPISense), 30000 /*< @todo timeout /);
2352	}
2353	if (pProf) { STAM_PROFILE_ADV_STOP(pProf, b); }
2354
2355	ataR3LockEnter(pDevIns, pCtl);
2356
2357	/* Update the LEDs and the read/write statistics. */
2358	if (cbTransfer >= 2048)
2359	{
2360	if (s->uTxDir != PDMMEDIATXDIR_TO_DEVICE)
2361	{
2362	s->Led.Actual.s.fReading = 0;
2363	STAM_REL_COUNTER_ADD(&s->StatBytesRead, cbTransfer);
2364	}
2365	else
2366	{
2367	s->Led.Actual.s.fWriting = 0;
2368	STAM_REL_COUNTER_ADD(&s->StatBytesWritten, cbTransfer);
2369	}
2370	}
2371
2372	if (RT_SUCCESS(rc))
2373	{
2374	/* Do post processing for certain commands. */
2375	switch (s->abATAPICmd[0])
2376	{
2377	case SCSI_SEND_CUE_SHEET:
2378	case SCSI_READ_TOC_PMA_ATIP:
2379	{
2380	if (!pDevR3->pTrackList)
2381	rc = ATAPIPassthroughTrackListCreateEmpty(&pDevR3->pTrackList);
2382
2383	if (RT_SUCCESS(rc))
2384	rc = ATAPIPassthroughTrackListUpdate(pDevR3->pTrackList, s->abATAPICmd, s->abIOBuffer, sizeof(s->abIOBuffer));
2385
2386	if ( RT_FAILURE(rc)
2387	&& s->cErrors++ < MAX_LOG_REL_ERRORS)
2388	LogRel(("ATA: Error (%Rrc) while updating the tracklist during %s, burning the disc might fail\n",
2389	rc, s->abATAPICmd[0] == SCSI_SEND_CUE_SHEET ? "SEND CUE SHEET" : "READ TOC/PMA/ATIP"));
2390	break;
2391	}
2392	case SCSI_SYNCHRONIZE_CACHE:
2393	{
2394	if (pDevR3->pTrackList)
2395	ATAPIPassthroughTrackListClear(pDevR3->pTrackList);
2396	break;
2397	}
2398	}
2399
2400	if (s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE)
2401	{
2402	/*
2403	* Reply with the same amount of data as the real drive
2404	* but only if the command wasn't split.
2405	*/
2406	if (s->cbAtapiPassthroughTransfer < cbIOBuffer)
2407	s->cbTotalTransfer = cbTransfer;
2408
2409	if ( s->abATAPICmd[0] == SCSI_INQUIRY
2410	&& s->fOverwriteInquiry)
2411	{
2412	/* Make sure that the real drive cannot be identified.
2413	* Motivation: changing the VM configuration should be as
2414	* invisible as possible to the guest. */
2415	Log3(("ATAPI PT inquiry data before (%d): %.*Rhxs\n", cbTransfer, cbTransfer, s->abIOBuffer));
2416	scsiPadStr(&s->abIOBuffer[8], "VBOX", 8);
2417	scsiPadStr(&s->abIOBuffer[16], "CD-ROM", 16);
2418	scsiPadStr(&s->abIOBuffer[32], "1.0", 4);
2419	}
2420
2421	if (cbTransfer)
2422	Log3(("ATAPI PT data read (%d):\n%.*Rhxd\n", cbTransfer, cbTransfer, s->abIOBuffer));
2423	}
2424
2425	/* The initial buffer end value has been set up based on the total
2426	* transfer size. But the I/O buffer size limits what can actually be
2427	* done in one transfer, so set the actual value of the buffer end. */
2428	Assert(cbTransfer <= s->cbAtapiPassthroughTransfer);
2429	s->cbElementaryTransfer = cbTransfer;
2430	s->cbAtapiPassthroughTransfer -= cbTransfer;
2431	if (!s->cbAtapiPassthroughTransfer)
2432	{
2433	s->iSourceSink = ATAFN_SS_NULL;
2434	atapiR3CmdOK(pCtl, s);
2435	}
2436	}
2437	else
2438	{
2439	if (s->cErrors < MAX_LOG_REL_ERRORS)
2440	{
2441	uint8_t u8Cmd = s->abATAPICmd[0];
2442	do
2443	{
2444	/* don't log superfluous errors */
2445	if ( rc == VERR_DEV_IO_ERROR
2446	&& ( u8Cmd == SCSI_TEST_UNIT_READY
2447	\|\| u8Cmd == SCSI_READ_CAPACITY
2448	\|\| u8Cmd == SCSI_READ_DVD_STRUCTURE
2449	\|\| u8Cmd == SCSI_READ_TOC_PMA_ATIP))
2450	break;
2451	s->cErrors++;
2452	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM passthrough cmd=%#04x sense=%d ASC=%#02x ASCQ=%#02x %Rrc\n",
2453	s->iLUN, u8Cmd, abATAPISense[2] & 0x0f, abATAPISense[12], abATAPISense[13], rc));
2454	} while (0);
2455	}
2456	atapiR3CmdError(pCtl, s, abATAPISense, sizeof(abATAPISense));
2457	}
2458	return false;
2459	}
2460
2461
2462	/**
2463	* Begin Transfer: Read DVD structures
2464	*/
2465	static bool atapiR3ReadDVDStructureSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
2466	{
2467	uint8_t *buf = s->abIOBuffer;
2468	int media = s->abATAPICmd[1];
2469	int format = s->abATAPICmd[7];
2470	RT_NOREF(pDevIns, pDevR3);
2471
2472	AssertCompile(sizeof(s->abIOBuffer) > UINT16_MAX /* want a RT_MIN() below, but clang takes offence at always false stuff */);
2473	uint16_t max_len = scsiBE2H_U16(&s->abATAPICmd[8]);
2474	memset(buf, 0, max_len);
2475
2476	switch (format) {
2477	case 0x00:
2478	case 0x01:
2479	case 0x02:
2480	case 0x03:
2481	case 0x04:
2482	case 0x05:
2483	case 0x06:
2484	case 0x07:
2485	case 0x08:
2486	case 0x09:
2487	case 0x0a:
2488	case 0x0b:
2489	case 0x0c:
2490	case 0x0d:
2491	case 0x0e:
2492	case 0x0f:
2493	case 0x10:
2494	case 0x11:
2495	case 0x30:
2496	case 0x31:
2497	case 0xff:
2498	if (media == 0)
2499	{
2500	int uASC = SCSI_ASC_NONE;
2501
2502	switch (format)
2503	{
2504	case 0x0: /* Physical format information */
2505	{
2506	int layer = s->abATAPICmd[6];
2507	uint64_t total_sectors;
2508
2509	if (layer != 0)
2510	{
2511	uASC = -SCSI_ASC_INV_FIELD_IN_CMD_PACKET;
2512	break;
2513	}
2514
2515	total_sectors = s->cTotalSectors;
2516	total_sectors >>= 2;
2517	if (total_sectors == 0)
2518	{
2519	uASC = -SCSI_ASC_MEDIUM_NOT_PRESENT;
2520	break;
2521	}
2522
2523	buf[4] = 1; /* DVD-ROM, part version 1 */
2524	buf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
2525	buf[6] = 1; /* one layer, read-only (per MMC-2 spec) */
2526	buf[7] = 0; /* default densities */
2527
2528	/* FIXME: 0x30000 per spec? */
2529	scsiH2BE_U32(buf + 8, 0); /* start sector */
2530	scsiH2BE_U32(buf + 12, total_sectors - 1); /* end sector */
2531	scsiH2BE_U32(buf + 16, total_sectors - 1); /* l0 end sector */
2532
2533	/* Size of buffer, not including 2 byte size field */
2534	scsiH2BE_U32(&buf[0], 2048 + 2);
2535
2536	/* 2k data + 4 byte header */
2537	uASC = (2048 + 4);
2538	break;
2539	}
2540	case 0x01: /* DVD copyright information */
2541	buf[4] = 0; /* no copyright data */
2542	buf[5] = 0; /* no region restrictions */
2543
2544	/* Size of buffer, not including 2 byte size field */
2545	scsiH2BE_U16(buf, 4 + 2);
2546
2547	/* 4 byte header + 4 byte data */
2548	uASC = (4 + 4);
2549	break;
2550
2551	case 0x03: /* BCA information - invalid field for no BCA info */
2552	uASC = -SCSI_ASC_INV_FIELD_IN_CMD_PACKET;
2553	break;
2554
2555	case 0x04: /* DVD disc manufacturing information */
2556	/* Size of buffer, not including 2 byte size field */
2557	scsiH2BE_U16(buf, 2048 + 2);
2558
2559	/* 2k data + 4 byte header */
2560	uASC = (2048 + 4);
2561	break;
2562	case 0xff:
2563	/*
2564	* This lists all the command capabilities above. Add new ones
2565	* in order and update the length and buffer return values.
2566	*/
2567
2568	buf[4] = 0x00; /* Physical format */
2569	buf[5] = 0x40; /* Not writable, is readable */
2570	scsiH2BE_U16((buf + 6), 2048 + 4);
2571
2572	buf[8] = 0x01; /* Copyright info */
2573	buf[9] = 0x40; /* Not writable, is readable */
2574	scsiH2BE_U16((buf + 10), 4 + 4);
2575
2576	buf[12] = 0x03; /* BCA info */
2577	buf[13] = 0x40; /* Not writable, is readable */
2578	scsiH2BE_U16((buf + 14), 188 + 4);
2579
2580	buf[16] = 0x04; /* Manufacturing info */
2581	buf[17] = 0x40; /* Not writable, is readable */
2582	scsiH2BE_U16((buf + 18), 2048 + 4);
2583
2584	/* Size of buffer, not including 2 byte size field */
2585	scsiH2BE_U16(buf, 16 + 2);
2586
2587	/* data written + 4 byte header */
2588	uASC = (16 + 4);
2589	break;
2590	default: /** @todo formats beyond DVD-ROM requires */
2591	uASC = -SCSI_ASC_INV_FIELD_IN_CMD_PACKET;
2592	}
2593
2594	if (uASC < 0)
2595	{
2596	s->iSourceSink = ATAFN_SS_NULL;
2597	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, -uASC);
2598	return false;
2599	}
2600	break;
2601	}
2602	/** @todo BD support, fall through for now */
2603	RT_FALL_THRU();
2604
2605	/* Generic disk structures */
2606	case 0x80: /** @todo AACS volume identifier */
2607	case 0x81: /** @todo AACS media serial number */
2608	case 0x82: /** @todo AACS media identifier */
2609	case 0x83: /** @todo AACS media key block */
2610	case 0x90: /** @todo List of recognized format layers */
2611	case 0xc0: /** @todo Write protection status */
2612	default:
2613	s->iSourceSink = ATAFN_SS_NULL;
2614	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
2615	return false;
2616	}
2617
2618	s->iSourceSink = ATAFN_SS_NULL;
2619	atapiR3CmdOK(pCtl, s);
2620	return false;
2621	}
2622
2623
2624	static bool atapiR3ReadSectors(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s,
2625	uint32_t iATAPILBA, uint32_t cSectors, uint32_t cbSector)
2626	{
2627	Assert(cSectors > 0);
2628	s->iCurLBA = iATAPILBA;
2629	s->cbATAPISector = cbSector;
2630	ataR3StartTransfer(pDevIns, pCtl, s, cSectors * cbSector,
2631	PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ, true);
2632	return false;
2633	}
2634
2635
2636	/**
2637	* Sink/Source: ATAPI READ CAPACITY
2638	*/
2639	static bool atapiR3ReadCapacitySS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
2640	{
2641	uint8_t *pbBuf = s->abIOBuffer;
2642	RT_NOREF(pDevIns, pDevR3);
2643
2644	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
2645	Assert(s->cbElementaryTransfer <= 8);
2646	scsiH2BE_U32(pbBuf, s->cTotalSectors - 1);
2647	scsiH2BE_U32(pbBuf + 4, 2048);
2648	s->iSourceSink = ATAFN_SS_NULL;
2649	atapiR3CmdOK(pCtl, s);
2650	return false;
2651	}
2652
2653
2654	/**
2655	* Sink/Source: ATAPI READ DISCK INFORMATION
2656	*/
2657	static bool atapiR3ReadDiscInformationSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
2658	{
2659	uint8_t *pbBuf = s->abIOBuffer;
2660	RT_NOREF(pDevIns, pDevR3);
2661
2662	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
2663	Assert(s->cbElementaryTransfer <= 34);
2664	memset(pbBuf, '\0', 34);
2665	scsiH2BE_U16(pbBuf, 32);
2666	pbBuf[2] = (0 << 4) \| (3 << 2) \| (2 << 0); /* not erasable, complete session, complete disc */
2667	pbBuf[3] = 1; /* number of first track */
2668	pbBuf[4] = 1; /* number of sessions (LSB) */
2669	pbBuf[5] = 1; /* first track number in last session (LSB) */
2670	pbBuf[6] = (uint8_t)pDevR3->pDrvMedia->pfnGetRegionCount(pDevR3->pDrvMedia); /* last track number in last session (LSB) */
2671	pbBuf[7] = (0 << 7) \| (0 << 6) \| (1 << 5) \| (0 << 2) \| (0 << 0); /* disc id not valid, disc bar code not valid, unrestricted use, not dirty, not RW medium */
2672	pbBuf[8] = 0; /* disc type = CD-ROM */
2673	pbBuf[9] = 0; /* number of sessions (MSB) */
2674	pbBuf[10] = 0; /* number of sessions (MSB) */
2675	pbBuf[11] = 0; /* number of sessions (MSB) */
2676	scsiH2BE_U32(pbBuf + 16, 0xffffffff); /* last session lead-in start time is not available */
2677	scsiH2BE_U32(pbBuf + 20, 0xffffffff); /* last possible start time for lead-out is not available */
2678	s->iSourceSink = ATAFN_SS_NULL;
2679	atapiR3CmdOK(pCtl, s);
2680	return false;
2681	}
2682
2683
2684	/**
2685	* Sink/Source: ATAPI READ TRACK INFORMATION
2686	*/
2687	static bool atapiR3ReadTrackInformationSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
2688	{
2689	uint8_t *pbBuf = s->abIOBuffer;
2690	uint32_t u32LogAddr = scsiBE2H_U32(&s->abATAPICmd[2]);
2691	uint8_t u8LogAddrType = s->abATAPICmd[1] & 0x03;
2692	RT_NOREF(pDevIns);
2693
2694	int rc;
2695	uint64_t u64LbaStart = 0;
2696	uint32_t uRegion = 0;
2697	uint64_t cBlocks = 0;
2698	uint64_t cbBlock = 0;
2699	uint8_t u8DataMode = 0xf; /* Unknown data mode. */
2700	uint8_t u8TrackMode = 0;
2701	VDREGIONDATAFORM enmDataForm = VDREGIONDATAFORM_INVALID;
2702
2703	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
2704	Assert(s->cbElementaryTransfer <= 36);
2705
2706	switch (u8LogAddrType)
2707	{
2708	case 0x00:
2709	rc = pDevR3->pDrvMedia->pfnQueryRegionPropertiesForLba(pDevR3->pDrvMedia, u32LogAddr, &uRegion,
2710	NULL, NULL, NULL);
2711	if (RT_SUCCESS(rc))
2712	rc = pDevR3->pDrvMedia->pfnQueryRegionProperties(pDevR3->pDrvMedia, uRegion, &u64LbaStart,
2713	&cBlocks, &cbBlock, &enmDataForm);
2714	break;
2715	case 0x01:
2716	{
2717	if (u32LogAddr >= 1)
2718	{
2719	uRegion = u32LogAddr - 1;
2720	rc = pDevR3->pDrvMedia->pfnQueryRegionProperties(pDevR3->pDrvMedia, uRegion, &u64LbaStart,
2721	&cBlocks, &cbBlock, &enmDataForm);
2722	}
2723	else
2724	rc = VERR_NOT_FOUND; /** @todo Return lead-in information. */
2725	break;
2726	}
2727	case 0x02:
2728	default:
2729	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
2730	return false;
2731	}
2732
2733	if (RT_FAILURE(rc))
2734	{
2735	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
2736	return false;
2737	}
2738
2739	switch (enmDataForm)
2740	{
2741	case VDREGIONDATAFORM_MODE1_2048:
2742	case VDREGIONDATAFORM_MODE1_2352:
2743	case VDREGIONDATAFORM_MODE1_0:
2744	u8DataMode = 1;
2745	break;
2746	case VDREGIONDATAFORM_XA_2336:
2747	case VDREGIONDATAFORM_XA_2352:
2748	case VDREGIONDATAFORM_XA_0:
2749	case VDREGIONDATAFORM_MODE2_2336:
2750	case VDREGIONDATAFORM_MODE2_2352:
2751	case VDREGIONDATAFORM_MODE2_0:
2752	u8DataMode = 2;
2753	break;
2754	default:
2755	u8DataMode = 0xf;
2756	}
2757
2758	if (enmDataForm == VDREGIONDATAFORM_CDDA)
2759	u8TrackMode = 0x0;
2760	else
2761	u8TrackMode = 0x4;
2762
2763	memset(pbBuf, '\0', 36);
2764	scsiH2BE_U16(pbBuf, 34);
2765	pbBuf[2] = uRegion + 1; /* track number (LSB) */
2766	pbBuf[3] = 1; /* session number (LSB) */
2767	pbBuf[5] = (0 << 5) \| (0 << 4) \| u8TrackMode; /* not damaged, primary copy, data track */
2768	pbBuf[6] = (0 << 7) \| (0 << 6) \| (0 << 5) \| (0 << 6) \| u8DataMode; /* not reserved track, not blank, not packet writing, not fixed packet */
2769	pbBuf[7] = (0 << 1) \| (0 << 0); /* last recorded address not valid, next recordable address not valid */
2770	scsiH2BE_U32(pbBuf + 8, (uint32_t)u64LbaStart); /* track start address is 0 */
2771	scsiH2BE_U32(pbBuf + 24, (uint32_t)cBlocks); /* track size */
2772	pbBuf[32] = 0; /* track number (MSB) */
2773	pbBuf[33] = 0; /* session number (MSB) */
2774	s->iSourceSink = ATAFN_SS_NULL;
2775	atapiR3CmdOK(pCtl, s);
2776	return false;
2777	}
2778
2779	static DECLCALLBACK(uint32_t) atapiR3GetConfigurationFillFeatureListProfiles(PATADEVSTATE s, uint8_t *pbBuf, size_t cbBuf)
2780	{
2781	RT_NOREF(s);
2782	if (cbBuf < 3*4)
2783	return 0;
2784
2785	scsiH2BE_U16(pbBuf, 0x0); /* feature 0: list of profiles supported */
2786	pbBuf[2] = (0 << 2) \| (1 << 1) \| (1 << 0); /* version 0, persistent, current */
2787	pbBuf[3] = 8; /* additional bytes for profiles */
2788	/* The MMC-3 spec says that DVD-ROM read capability should be reported
2789	* before CD-ROM read capability. */
2790	scsiH2BE_U16(pbBuf + 4, 0x10); /* profile: read-only DVD */
2791	pbBuf[6] = (0 << 0); /* NOT current profile */
2792	scsiH2BE_U16(pbBuf + 8, 0x08); /* profile: read only CD */
2793	pbBuf[10] = (1 << 0); /* current profile */
2794
2795	return 34; / Header + 2 profiles entries */
2796	}
2797
2798	static DECLCALLBACK(uint32_t) atapiR3GetConfigurationFillFeatureCore(PATADEVSTATE s, uint8_t *pbBuf, size_t cbBuf)
2799	{
2800	RT_NOREF(s);
2801	if (cbBuf < 12)
2802	return 0;
2803
2804	scsiH2BE_U16(pbBuf, 0x1); /* feature 0001h: Core Feature */
2805	pbBuf[2] = (0x2 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2806	pbBuf[3] = 8; /* Additional length */
2807	scsiH2BE_U16(pbBuf + 4, 0x00000002); /* Physical interface ATAPI. */
2808	pbBuf[8] = RT_BIT(0); /* DBE */
2809	/* Rest is reserved. */
2810
2811	return 12;
2812	}
2813
2814	static DECLCALLBACK(uint32_t) atapiR3GetConfigurationFillFeatureMorphing(PATADEVSTATE s, uint8_t *pbBuf, size_t cbBuf)
2815	{
2816	RT_NOREF(s);
2817	if (cbBuf < 8)
2818	return 0;
2819
2820	scsiH2BE_U16(pbBuf, 0x2); /* feature 0002h: Morphing Feature */
2821	pbBuf[2] = (0x1 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2822	pbBuf[3] = 4; /* Additional length */
2823	pbBuf[4] = RT_BIT(1) \| 0x0; /* OCEvent \| !ASYNC */
2824	/* Rest is reserved. */
2825
2826	return 8;
2827	}
2828
2829	static DECLCALLBACK(uint32_t) atapiR3GetConfigurationFillFeatureRemovableMedium(PATADEVSTATE s, uint8_t *pbBuf, size_t cbBuf)
2830	{
2831	RT_NOREF(s);
2832	if (cbBuf < 8)
2833	return 0;
2834
2835	scsiH2BE_U16(pbBuf, 0x3); /* feature 0003h: Removable Medium Feature */
2836	pbBuf[2] = (0x2 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2837	pbBuf[3] = 4; /* Additional length */
2838	/* Tray type loading \| Load \| Eject \| !Pvnt Jmpr \| !DBML \| Lock */
2839	pbBuf[4] = (0x2 << 5) \| RT_BIT(4) \| RT_BIT(3) \| (0x0 << 2) \| (0x0 << 1) \| RT_BIT(0);
2840	/* Rest is reserved. */
2841
2842	return 8;
2843	}
2844
2845	static DECLCALLBACK(uint32_t) atapiR3GetConfigurationFillFeatureRandomReadable (PATADEVSTATE s, uint8_t *pbBuf, size_t cbBuf)
2846	{
2847	RT_NOREF(s);
2848	if (cbBuf < 12)
2849	return 0;
2850
2851	scsiH2BE_U16(pbBuf, 0x10); /* feature 0010h: Random Readable Feature */
2852	pbBuf[2] = (0x0 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2853	pbBuf[3] = 8; /* Additional length */
2854	scsiH2BE_U32(pbBuf + 4, 2048); /* Logical block size. */
2855	scsiH2BE_U16(pbBuf + 8, 0x10); /* Blocking (0x10 for DVD, CD is not defined). */
2856	pbBuf[10] = 0; /* PP not present */
2857	/* Rest is reserved. */
2858
2859	return 12;
2860	}
2861
2862	static DECLCALLBACK(uint32_t) atapiR3GetConfigurationFillFeatureCDRead(PATADEVSTATE s, uint8_t *pbBuf, size_t cbBuf)
2863	{
2864	RT_NOREF(s);
2865	if (cbBuf < 8)
2866	return 0;
2867
2868	scsiH2BE_U16(pbBuf, 0x1e); /* feature 001Eh: CD Read Feature */
2869	pbBuf[2] = (0x2 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2870	pbBuf[3] = 0; /* Additional length */
2871	pbBuf[4] = (0x0 << 7) \| (0x0 << 1) \| 0x0; /* !DAP \| !C2-Flags \| !CD-Text. */
2872	/* Rest is reserved. */
2873
2874	return 8;
2875	}
2876
2877	static DECLCALLBACK(uint32_t) atapiR3GetConfigurationFillFeaturePowerManagement(PATADEVSTATE s, uint8_t *pbBuf, size_t cbBuf)
2878	{
2879	RT_NOREF(s);
2880	if (cbBuf < 4)
2881	return 0;
2882
2883	scsiH2BE_U16(pbBuf, 0x100); /* feature 0100h: Power Management Feature */
2884	pbBuf[2] = (0x0 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2885	pbBuf[3] = 0; /* Additional length */
2886
2887	return 4;
2888	}
2889
2890	static DECLCALLBACK(uint32_t) atapiR3GetConfigurationFillFeatureTimeout(PATADEVSTATE s, uint8_t *pbBuf, size_t cbBuf)
2891	{
2892	RT_NOREF(s);
2893	if (cbBuf < 8)
2894	return 0;
2895
2896	scsiH2BE_U16(pbBuf, 0x105); /* feature 0105h: Timeout Feature */
2897	pbBuf[2] = (0x0 << 2) \| RT_BIT(1) \| RT_BIT(0); /* Version \| Persistent \| Current */
2898	pbBuf[3] = 4; /* Additional length */
2899	pbBuf[4] = 0x0; /* !Group3 */
2900
2901	return 8;
2902	}
2903
2904	/**
2905	* Callback to fill in the correct data for a feature.
2906	*
2907	* @returns Number of bytes written into the buffer.
2908	* @param s The ATA device state.
2909	* @param pbBuf The buffer to fill the data with.
2910	* @param cbBuf Size of the buffer.
2911	*/
2912	typedef DECLCALLBACKTYPE(uint32_t, FNATAPIR3FEATUREFILL,(PATADEVSTATE s, uint8_t *pbBuf, size_t cbBuf));
2913	/** Pointer to a feature fill callback. */
2914	typedef FNATAPIR3FEATUREFILL *PFNATAPIR3FEATUREFILL;
2915
2916	/**
2917	* ATAPI feature descriptor.
2918	*/
2919	typedef struct ATAPIR3FEATDESC
2920	{
2921	/** The feature number. */
2922	uint16_t u16Feat;
2923	/** The callback to fill in the correct data. */
2924	PFNATAPIR3FEATUREFILL pfnFeatureFill;
2925	} ATAPIR3FEATDESC;
2926
2927	/**
2928	* Array of known ATAPI feature descriptors.
2929	*/
2930	static const ATAPIR3FEATDESC s_aAtapiR3Features[] =
2931	{
2932	{ 0x0000, atapiR3GetConfigurationFillFeatureListProfiles},
2933	{ 0x0001, atapiR3GetConfigurationFillFeatureCore},
2934	{ 0x0002, atapiR3GetConfigurationFillFeatureMorphing},
2935	{ 0x0003, atapiR3GetConfigurationFillFeatureRemovableMedium},
2936	{ 0x0010, atapiR3GetConfigurationFillFeatureRandomReadable},
2937	{ 0x001e, atapiR3GetConfigurationFillFeatureCDRead},
2938	{ 0x0100, atapiR3GetConfigurationFillFeaturePowerManagement},
2939	{ 0x0105, atapiR3GetConfigurationFillFeatureTimeout}
2940	};
2941
2942	/**
2943	* Sink/Source: ATAPI GET CONFIGURATION
2944	*/
2945	static bool atapiR3GetConfigurationSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
2946	{
2947	uint32_t const cbIOBuffer = RT_MIN(s->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE);
2948	uint8_t *pbBuf = s->abIOBuffer;
2949	uint32_t cbBuf = cbIOBuffer;
2950	uint32_t cbCopied = 0;
2951	uint16_t u16Sfn = scsiBE2H_U16(&s->abATAPICmd[2]);
2952	uint8_t u8Rt = s->abATAPICmd[1] & 0x03;
2953	RT_NOREF(pDevIns, pDevR3);
2954
2955	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
2956	Assert(s->cbElementaryTransfer <= 80);
2957	/* Accept valid request types only. */
2958	if (u8Rt == 3)
2959	{
2960	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
2961	return false;
2962	}
2963	memset(pbBuf, '\0', cbBuf);
2964	/** @todo implement switching between CD-ROM and DVD-ROM profile (the only
2965	* way to differentiate them right now is based on the image size). */
2966	if (s->cTotalSectors)
2967	scsiH2BE_U16(pbBuf + 6, 0x08); /* current profile: read-only CD */
2968	else
2969	scsiH2BE_U16(pbBuf + 6, 0x00); /* current profile: none -> no media */
2970	cbBuf -= 8;
2971	pbBuf += 8;
2972
2973	if (u8Rt == 0x2)
2974	{
2975	for (uint32_t i = 0; i < RT_ELEMENTS(s_aAtapiR3Features); i++)
2976	{
2977	if (s_aAtapiR3Features[i].u16Feat == u16Sfn)
2978	{
2979	cbCopied = s_aAtapiR3Features[i].pfnFeatureFill(s, pbBuf, cbBuf);
2980	cbBuf -= cbCopied;
2981	pbBuf += cbCopied;
2982	break;
2983	}
2984	}
2985	}
2986	else
2987	{
2988	for (uint32_t i = 0; i < RT_ELEMENTS(s_aAtapiR3Features); i++)
2989	{
2990	if (s_aAtapiR3Features[i].u16Feat > u16Sfn)
2991	{
2992	cbCopied = s_aAtapiR3Features[i].pfnFeatureFill(s, pbBuf, cbBuf);
2993	cbBuf -= cbCopied;
2994	pbBuf += cbCopied;
2995	}
2996	}
2997	}
2998
2999	/* Set data length now - the field is not included in the final length. */
3000	scsiH2BE_U32(s->abIOBuffer, cbIOBuffer - cbBuf - 4);
3001
3002	/* Other profiles we might want to add in the future: 0x40 (BD-ROM) and 0x50 (HDDVD-ROM) */
3003	s->iSourceSink = ATAFN_SS_NULL;
3004	atapiR3CmdOK(pCtl, s);
3005	return false;
3006	}
3007
3008
3009	/**
3010	* Sink/Source: ATAPI GET EVENT STATUS NOTIFICATION
3011	*/
3012	static bool atapiR3GetEventStatusNotificationSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3013	{
3014	uint8_t *pbBuf = s->abIOBuffer;
3015	RT_NOREF(pDevIns, pDevR3);
3016
3017	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
3018	Assert(s->cbElementaryTransfer <= 8);
3019
3020	if (!(s->abATAPICmd[1] & 1))
3021	{
3022	/* no asynchronous operation supported */
3023	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
3024	return false;
3025	}
3026
3027	uint32_t OldStatus, NewStatus;
3028	do
3029	{
3030	OldStatus = ASMAtomicReadU32(&s->MediaEventStatus);
3031	NewStatus = ATA_EVENT_STATUS_UNCHANGED;
3032	switch (OldStatus)
3033	{
3034	case ATA_EVENT_STATUS_MEDIA_NEW:
3035	/* mount */
3036	scsiH2BE_U16(pbBuf + 0, 6);
3037	pbBuf[2] = 0x04; /* media */
3038	pbBuf[3] = 0x5e; /* supported = busy\|media\|external\|power\|operational */
3039	pbBuf[4] = 0x02; /* new medium */
3040	pbBuf[5] = 0x02; /* medium present / door closed */
3041	pbBuf[6] = 0x00;
3042	pbBuf[7] = 0x00;
3043	break;
3044
3045	case ATA_EVENT_STATUS_MEDIA_CHANGED:
3046	case ATA_EVENT_STATUS_MEDIA_REMOVED:
3047	/* umount */
3048	scsiH2BE_U16(pbBuf + 0, 6);
3049	pbBuf[2] = 0x04; /* media */
3050	pbBuf[3] = 0x5e; /* supported = busy\|media\|external\|power\|operational */
3051	pbBuf[4] = OldStatus == ATA_EVENT_STATUS_MEDIA_CHANGED ? 0x04 /* media changed / : 0x03; / media removed */
3052	pbBuf[5] = 0x00; /* medium absent / door closed */
3053	pbBuf[6] = 0x00;
3054	pbBuf[7] = 0x00;
3055	if (OldStatus == ATA_EVENT_STATUS_MEDIA_CHANGED)
3056	NewStatus = ATA_EVENT_STATUS_MEDIA_NEW;
3057	break;
3058
3059	case ATA_EVENT_STATUS_MEDIA_EJECT_REQUESTED: /* currently unused */
3060	scsiH2BE_U16(pbBuf + 0, 6);
3061	pbBuf[2] = 0x04; /* media */
3062	pbBuf[3] = 0x5e; /* supported = busy\|media\|external\|power\|operational */
3063	pbBuf[4] = 0x01; /* eject requested (eject button pressed) */
3064	pbBuf[5] = 0x02; /* medium present / door closed */
3065	pbBuf[6] = 0x00;
3066	pbBuf[7] = 0x00;
3067	break;
3068
3069	case ATA_EVENT_STATUS_UNCHANGED:
3070	default:
3071	scsiH2BE_U16(pbBuf + 0, 6);
3072	pbBuf[2] = 0x01; /* operational change request / notification */
3073	pbBuf[3] = 0x5e; /* supported = busy\|media\|external\|power\|operational */
3074	pbBuf[4] = 0x00;
3075	pbBuf[5] = 0x00;
3076	pbBuf[6] = 0x00;
3077	pbBuf[7] = 0x00;
3078	break;
3079	}
3080	} while (!ASMAtomicCmpXchgU32(&s->MediaEventStatus, NewStatus, OldStatus));
3081
3082	s->iSourceSink = ATAFN_SS_NULL;
3083	atapiR3CmdOK(pCtl, s);
3084	return false;
3085	}
3086
3087
3088	/**
3089	* Sink/Source: ATAPI INQUIRY
3090	*/
3091	static bool atapiR3InquirySS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3092	{
3093	uint8_t *pbBuf = s->abIOBuffer;
3094	RT_NOREF(pDevIns, pDevR3);
3095
3096	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
3097	Assert(s->cbElementaryTransfer <= 36);
3098	pbBuf[0] = 0x05; /* CD-ROM */
3099	pbBuf[1] = 0x80; /* removable */
3100	# if 1/ndef VBOX/ /** @todo implement MESN + AENC. (async notification on removal and stuff.) */
3101	pbBuf[2] = 0x00; /* ISO */
3102	pbBuf[3] = 0x21; /* ATAPI-2 (XXX: put ATAPI-4 ?) */
3103	# else
3104	pbBuf[2] = 0x00; /* ISO */
3105	pbBuf[3] = 0x91; /* format 1, MESN=1, AENC=9 ??? */
3106	# endif
3107	pbBuf[4] = 31; /* additional length */
3108	pbBuf[5] = 0; /* reserved */
3109	pbBuf[6] = 0; /* reserved */
3110	pbBuf[7] = 0; /* reserved */
3111	scsiPadStr(pbBuf + 8, s->szInquiryVendorId, 8);
3112	scsiPadStr(pbBuf + 16, s->szInquiryProductId, 16);
3113	scsiPadStr(pbBuf + 32, s->szInquiryRevision, 4);
3114	s->iSourceSink = ATAFN_SS_NULL;
3115	atapiR3CmdOK(pCtl, s);
3116	return false;
3117	}
3118
3119
3120	/**
3121	* Sink/Source: ATAPI MODE SENSE ERROR RECOVERY
3122	*/
3123	static bool atapiR3ModeSenseErrorRecoverySS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3124	{
3125	uint8_t *pbBuf = s->abIOBuffer;
3126	RT_NOREF(pDevIns, pDevR3);
3127
3128	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
3129	Assert(s->cbElementaryTransfer <= 16);
3130	scsiH2BE_U16(&pbBuf[0], 16 + 6);
3131	pbBuf[2] = (uint8_t)s->MediaTrackType;
3132	pbBuf[3] = 0;
3133	pbBuf[4] = 0;
3134	pbBuf[5] = 0;
3135	pbBuf[6] = 0;
3136	pbBuf[7] = 0;
3137
3138	pbBuf[8] = 0x01;
3139	pbBuf[9] = 0x06;
3140	pbBuf[10] = 0x00; /* Maximum error recovery */
3141	pbBuf[11] = 0x05; /* 5 retries */
3142	pbBuf[12] = 0x00;
3143	pbBuf[13] = 0x00;
3144	pbBuf[14] = 0x00;
3145	pbBuf[15] = 0x00;
3146	s->iSourceSink = ATAFN_SS_NULL;
3147	atapiR3CmdOK(pCtl, s);
3148	return false;
3149	}
3150
3151
3152	/**
3153	* Sink/Source: ATAPI MODE SENSE CD STATUS
3154	*/
3155	static bool atapiR3ModeSenseCDStatusSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3156	{
3157	uint8_t *pbBuf = s->abIOBuffer;
3158	RT_NOREF(pDevIns);
3159
3160	/* 28 bytes of total returned data corresponds to ATAPI 2.6. Note that at least some versions
3161	* of NEC_IDE.SYS DOS driver (possibly other Oak Technology OTI-011 drivers) do not correctly
3162	* handle cases where more than 28 bytes are returned due to bugs. See @bugref{5869}.
3163	*/
3164	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
3165	Assert(s->cbElementaryTransfer <= 28);
3166	scsiH2BE_U16(&pbBuf[0], 26);
3167	pbBuf[2] = (uint8_t)s->MediaTrackType;
3168	pbBuf[3] = 0;
3169	pbBuf[4] = 0;
3170	pbBuf[5] = 0;
3171	pbBuf[6] = 0;
3172	pbBuf[7] = 0;
3173
3174	pbBuf[8] = 0x2a;
3175	pbBuf[9] = 18; /* page length */
3176	pbBuf[10] = 0x08; /* DVD-ROM read support */
3177	pbBuf[11] = 0x00; /* no write support */
3178	/* The following claims we support audio play. This is obviously false,
3179	* but the Linux generic CDROM support makes many features depend on this
3180	* capability. If it's not set, this causes many things to be disabled. */
3181	pbBuf[12] = 0x71; /* multisession support, mode 2 form 1/2 support, audio play */
3182	pbBuf[13] = 0x00; /* no subchannel reads supported */
3183	pbBuf[14] = (1 << 0) \| (1 << 3) \| (1 << 5); /* lock supported, eject supported, tray type loading mechanism */
3184	if (pDevR3->pDrvMount->pfnIsLocked(pDevR3->pDrvMount))
3185	pbBuf[14] \|= 1 << 1; /* report lock state */
3186	pbBuf[15] = 0; /* no subchannel reads supported, no separate audio volume control, no changer etc. */
3187	scsiH2BE_U16(&pbBuf[16], 5632); /* (obsolete) claim 32x speed support */
3188	scsiH2BE_U16(&pbBuf[18], 2); /* number of audio volume levels */
3189	scsiH2BE_U16(&pbBuf[20], RT_MIN(s->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE) / _1K); /* buffer size supported in Kbyte */
3190	scsiH2BE_U16(&pbBuf[22], 5632); /* (obsolete) current read speed 32x */
3191	pbBuf[24] = 0; /* reserved */
3192	pbBuf[25] = 0; /* reserved for digital audio (see idx 15) */
3193	pbBuf[26] = 0; /* reserved */
3194	pbBuf[27] = 0; /* reserved */
3195	s->iSourceSink = ATAFN_SS_NULL;
3196	atapiR3CmdOK(pCtl, s);
3197	return false;
3198	}
3199
3200
3201	/**
3202	* Sink/Source: ATAPI REQUEST SENSE
3203	*/
3204	static bool atapiR3RequestSenseSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3205	{
3206	uint8_t *pbBuf = s->abIOBuffer;
3207	RT_NOREF(pDevIns, pDevR3);
3208
3209	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
3210	memset(pbBuf, '\0', RT_MIN(s->cbElementaryTransfer, sizeof(s->abIOBuffer)));
3211	AssertCompile(sizeof(s->abIOBuffer) >= sizeof(s->abATAPISense));
3212	memcpy(pbBuf, s->abATAPISense, RT_MIN(s->cbElementaryTransfer, sizeof(s->abATAPISense)));
3213	s->iSourceSink = ATAFN_SS_NULL;
3214	atapiR3CmdOK(pCtl, s);
3215	return false;
3216	}
3217
3218
3219	/**
3220	* Sink/Source: ATAPI MECHANISM STATUS
3221	*/
3222	static bool atapiR3MechanismStatusSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3223	{
3224	uint8_t *pbBuf = s->abIOBuffer;
3225	RT_NOREF(pDevIns, pDevR3);
3226
3227	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
3228	Assert(s->cbElementaryTransfer <= 8);
3229	scsiH2BE_U16(pbBuf, 0);
3230	/* no current LBA */
3231	pbBuf[2] = 0;
3232	pbBuf[3] = 0;
3233	pbBuf[4] = 0;
3234	pbBuf[5] = 1;
3235	scsiH2BE_U16(pbBuf + 6, 0);
3236	s->iSourceSink = ATAFN_SS_NULL;
3237	atapiR3CmdOK(pCtl, s);
3238	return false;
3239	}
3240
3241
3242	/**
3243	* Sink/Source: ATAPI READ TOC NORMAL
3244	*/
3245	static bool atapiR3ReadTOCNormalSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3246	{
3247	uint8_t *pbBuf = s->abIOBuffer;
3248	uint8_t *q;
3249	uint8_t iStartTrack;
3250	bool fMSF;
3251	uint32_t cbSize;
3252	RT_NOREF(pDevIns);
3253
3254	/* Track fields are 8-bit and 1-based, so cut the track count at 255,
3255	avoiding any potential buffer overflow issues below. */
3256	uint32_t cTracks = pDevR3->pDrvMedia->pfnGetRegionCount(pDevR3->pDrvMedia);
3257	AssertStmt(cTracks <= UINT8_MAX, cTracks = UINT8_MAX);
3258	AssertCompile(sizeof(s->abIOBuffer) >= 2 + 256 + 8);
3259
3260	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
3261	fMSF = (s->abATAPICmd[1] >> 1) & 1;
3262	iStartTrack = s->abATAPICmd[6];
3263	if (iStartTrack == 0)
3264	iStartTrack = 1;
3265
3266	if (iStartTrack > cTracks && iStartTrack != 0xaa)
3267	{
3268	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
3269	return false;
3270	}
3271	q = pbBuf + 2;
3272	q++ = iStartTrack; / first track number */
3273	q++ = cTracks; / last track number */
3274	for (uint32_t iTrack = iStartTrack; iTrack <= cTracks; iTrack++)
3275	{
3276	uint64_t uLbaStart = 0;
3277	VDREGIONDATAFORM enmDataForm = VDREGIONDATAFORM_MODE1_2048;
3278
3279	int rc = pDevR3->pDrvMedia->pfnQueryRegionProperties(pDevR3->pDrvMedia, iTrack - 1, &uLbaStart,
3280	NULL, NULL, &enmDataForm);
3281	AssertRC(rc);
3282
3283	q++ = 0; / reserved */
3284
3285	if (enmDataForm == VDREGIONDATAFORM_CDDA)
3286	q++ = 0x10; / ADR, control */
3287	else
3288	q++ = 0x14; / ADR, control */
3289
3290	q++ = (uint8_t)iTrack; / track number */
3291	q++ = 0; / reserved */
3292	if (fMSF)
3293	{
3294	q++ = 0; / reserved */
3295	scsiLBA2MSF(q, (uint32_t)uLbaStart);
3296	q += 3;
3297	}
3298	else
3299	{
3300	/* sector 0 */
3301	scsiH2BE_U32(q, (uint32_t)uLbaStart);
3302	q += 4;
3303	}
3304	}
3305	/* lead out track */
3306	q++ = 0; / reserved */
3307	q++ = 0x14; / ADR, control */
3308	q++ = 0xaa; / track number */
3309	q++ = 0; / reserved */
3310
3311	/* Query start and length of last track to get the start of the lead out track. */
3312	uint64_t uLbaStart = 0;
3313	uint64_t cBlocks = 0;
3314
3315	int rc = pDevR3->pDrvMedia->pfnQueryRegionProperties(pDevR3->pDrvMedia, cTracks - 1, &uLbaStart,
3316	&cBlocks, NULL, NULL);
3317	AssertRC(rc);
3318
3319	uLbaStart += cBlocks;
3320	if (fMSF)
3321	{
3322	q++ = 0; / reserved */
3323	scsiLBA2MSF(q, (uint32_t)uLbaStart);
3324	q += 3;
3325	}
3326	else
3327	{
3328	scsiH2BE_U32(q, (uint32_t)uLbaStart);
3329	q += 4;
3330	}
3331	cbSize = q - pbBuf;
3332	scsiH2BE_U16(pbBuf, cbSize - 2);
3333	if (cbSize < s->cbTotalTransfer)
3334	s->cbTotalTransfer = cbSize;
3335	s->iSourceSink = ATAFN_SS_NULL;
3336	atapiR3CmdOK(pCtl, s);
3337	return false;
3338	}
3339
3340
3341	/**
3342	* Sink/Source: ATAPI READ TOC MULTI
3343	*/
3344	static bool atapiR3ReadTOCMultiSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3345	{
3346	uint8_t *pbBuf = s->abIOBuffer;
3347	bool fMSF;
3348	RT_NOREF(pDevIns);
3349
3350	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
3351	Assert(s->cbElementaryTransfer <= 12);
3352	fMSF = (s->abATAPICmd[1] >> 1) & 1;
3353	/* multi session: only a single session defined */
3354	/** @todo double-check this stuff against what a real drive says for a CD-ROM (not a CD-R)
3355	* with only a single data session. Maybe solve the problem with "cdrdao read-toc" not being
3356	* able to figure out whether numbers are in BCD or hex. */
3357	memset(pbBuf, 0, 12);
3358	pbBuf[1] = 0x0a;
3359	pbBuf[2] = 0x01;
3360	pbBuf[3] = 0x01;
3361
3362	VDREGIONDATAFORM enmDataForm = VDREGIONDATAFORM_MODE1_2048;
3363	int rc = pDevR3->pDrvMedia->pfnQueryRegionProperties(pDevR3->pDrvMedia, 0, NULL, NULL, NULL, &enmDataForm);
3364	AssertRC(rc);
3365
3366	if (enmDataForm == VDREGIONDATAFORM_CDDA)
3367	pbBuf[5] = 0x10; /* ADR, control */
3368	else
3369	pbBuf[5] = 0x14; /* ADR, control */
3370
3371	pbBuf[6] = 1; /* first track in last complete session */
3372	if (fMSF)
3373	{
3374	pbBuf[8] = 0; /* reserved */
3375	scsiLBA2MSF(&pbBuf[9], 0);
3376	}
3377	else
3378	{
3379	/* sector 0 */
3380	scsiH2BE_U32(pbBuf + 8, 0);
3381	}
3382	s->iSourceSink = ATAFN_SS_NULL;
3383	atapiR3CmdOK(pCtl, s);
3384	return false;
3385	}
3386
3387
3388	/**
3389	* Sink/Source: ATAPI READ TOC RAW
3390	*/
3391	static bool atapiR3ReadTOCRawSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3392	{
3393	uint8_t *pbBuf = s->abIOBuffer;
3394	uint8_t *q;
3395	uint8_t iStartTrack;
3396	bool fMSF;
3397	uint32_t cbSize;
3398	RT_NOREF(pDevIns, pDevR3);
3399
3400	Assert(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE);
3401	fMSF = (s->abATAPICmd[1] >> 1) & 1;
3402	iStartTrack = s->abATAPICmd[6];
3403
3404	q = pbBuf + 2;
3405	q++ = 1; / first session */
3406	q++ = 1; / last session */
3407
3408	q++ = 1; / session number */
3409	q++ = 0x14; / data track */
3410	q++ = 0; / track number */
3411	q++ = 0xa0; / first track in program area */
3412	q++ = 0; / min */
3413	q++ = 0; / sec */
3414	q++ = 0; / frame */
3415	*q++ = 0;
3416	q++ = 1; / first track */
3417	q++ = 0x00; / disk type CD-DA or CD data */
3418	*q++ = 0;
3419
3420	q++ = 1; / session number */
3421	q++ = 0x14; / data track */
3422	q++ = 0; / track number */
3423	q++ = 0xa1; / last track in program area */
3424	q++ = 0; / min */
3425	q++ = 0; / sec */
3426	q++ = 0; / frame */
3427	*q++ = 0;
3428	q++ = 1; / last track */
3429	*q++ = 0;
3430	*q++ = 0;
3431
3432	q++ = 1; / session number */
3433	q++ = 0x14; / data track */
3434	q++ = 0; / track number */
3435	q++ = 0xa2; / lead-out */
3436	q++ = 0; / min */
3437	q++ = 0; / sec */
3438	q++ = 0; / frame */
3439	if (fMSF)
3440	{
3441	q++ = 0; / reserved */
3442	scsiLBA2MSF(q, s->cTotalSectors);
3443	q += 3;
3444	}
3445	else
3446	{
3447	scsiH2BE_U32(q, s->cTotalSectors);
3448	q += 4;
3449	}
3450
3451	q++ = 1; / session number */
3452	q++ = 0x14; / ADR, control */
3453	q++ = 0; / track number */
3454	q++ = 1; / point */
3455	q++ = 0; / min */
3456	q++ = 0; / sec */
3457	q++ = 0; / frame */
3458	if (fMSF)
3459	{
3460	q++ = 0; / reserved */
3461	scsiLBA2MSF(q, 0);
3462	q += 3;
3463	}
3464	else
3465	{
3466	/* sector 0 */
3467	scsiH2BE_U32(q, 0);
3468	q += 4;
3469	}
3470
3471	cbSize = q - pbBuf;
3472	scsiH2BE_U16(pbBuf, cbSize - 2);
3473	if (cbSize < s->cbTotalTransfer)
3474	s->cbTotalTransfer = cbSize;
3475	s->iSourceSink = ATAFN_SS_NULL;
3476	atapiR3CmdOK(pCtl, s);
3477	return false;
3478	}
3479
3480
3481	static void atapiR3ParseCmdVirtualATAPI(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3482	{
3483	const uint8_t *pbPacket = s->abATAPICmd;
3484	uint32_t cbMax;
3485	uint32_t cSectors, iATAPILBA;
3486
3487	switch (pbPacket[0])
3488	{
3489	case SCSI_TEST_UNIT_READY:
3490	if (s->cNotifiedMediaChange > 0)
3491	{
3492	if (s->cNotifiedMediaChange-- > 2)
3493	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3494	else
3495	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3496	}
3497	else if (pDevR3->pDrvMount->pfnIsMounted(pDevR3->pDrvMount))
3498	atapiR3CmdOK(pCtl, s);
3499	else
3500	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3501	break;
3502	case SCSI_GET_EVENT_STATUS_NOTIFICATION:
3503	cbMax = scsiBE2H_U16(pbPacket + 7);
3504	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 8), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_GET_EVENT_STATUS_NOTIFICATION, true);
3505	break;
3506	case SCSI_MODE_SENSE_10:
3507	{
3508	uint8_t uPageControl, uPageCode;
3509	cbMax = scsiBE2H_U16(pbPacket + 7);
3510	uPageControl = pbPacket[2] >> 6;
3511	uPageCode = pbPacket[2] & 0x3f;
3512	switch (uPageControl)
3513	{
3514	case SCSI_PAGECONTROL_CURRENT:
3515	switch (uPageCode)
3516	{
3517	case SCSI_MODEPAGE_ERROR_RECOVERY:
3518	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 16), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_MODE_SENSE_ERROR_RECOVERY, true);
3519	break;
3520	case SCSI_MODEPAGE_CD_STATUS:
3521	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 28), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_MODE_SENSE_CD_STATUS, true);
3522	break;
3523	default:
3524	goto error_cmd;
3525	}
3526	break;
3527	case SCSI_PAGECONTROL_CHANGEABLE:
3528	goto error_cmd;
3529	case SCSI_PAGECONTROL_DEFAULT:
3530	goto error_cmd;
3531	default:
3532	case SCSI_PAGECONTROL_SAVED:
3533	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_SAVING_PARAMETERS_NOT_SUPPORTED);
3534	break;
3535	}
3536	break;
3537	}
3538	case SCSI_REQUEST_SENSE:
3539	cbMax = pbPacket[4];
3540	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 18), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_REQUEST_SENSE, true);
3541	break;
3542	case SCSI_PREVENT_ALLOW_MEDIUM_REMOVAL:
3543	if (pDevR3->pDrvMount->pfnIsMounted(pDevR3->pDrvMount))
3544	{
3545	if (pbPacket[4] & 1)
3546	pDevR3->pDrvMount->pfnLock(pDevR3->pDrvMount);
3547	else
3548	pDevR3->pDrvMount->pfnUnlock(pDevR3->pDrvMount);
3549	atapiR3CmdOK(pCtl, s);
3550	}
3551	else
3552	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3553	break;
3554	case SCSI_READ_10:
3555	case SCSI_READ_12:
3556	{
3557	if (s->cNotifiedMediaChange > 0)
3558	{
3559	s->cNotifiedMediaChange-- ;
3560	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3561	break;
3562	}
3563	else if (!pDevR3->pDrvMount->pfnIsMounted(pDevR3->pDrvMount))
3564	{
3565	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3566	break;
3567	}
3568	if (pbPacket[0] == SCSI_READ_10)
3569	cSectors = scsiBE2H_U16(pbPacket + 7);
3570	else
3571	cSectors = scsiBE2H_U32(pbPacket + 6);
3572	iATAPILBA = scsiBE2H_U32(pbPacket + 2);
3573
3574	if (cSectors == 0)
3575	{
3576	atapiR3CmdOK(pCtl, s);
3577	break;
3578	}
3579
3580	/* Check that the sector size is valid. */
3581	VDREGIONDATAFORM enmDataForm = VDREGIONDATAFORM_INVALID;
3582	int rc = pDevR3->pDrvMedia->pfnQueryRegionPropertiesForLba(pDevR3->pDrvMedia, iATAPILBA,
3583	NULL, NULL, NULL, &enmDataForm);
3584	if (RT_UNLIKELY( rc == VERR_NOT_FOUND
3585	\|\| ((uint64_t)iATAPILBA + cSectors > s->cTotalSectors)))
3586	{
3587	/* Rate limited logging, one log line per second. For
3588	* guests that insist on reading from places outside the
3589	* valid area this often generates too many release log
3590	* entries otherwise. */
3591	static uint64_t uLastLogTS = 0;
3592	if (RTTimeMilliTS() >= uLastLogTS + 1000)
3593	{
3594	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM block number %Ld invalid (READ)\n", s->iLUN, (uint64_t)iATAPILBA + cSectors));
3595	uLastLogTS = RTTimeMilliTS();
3596	}
3597	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_LOGICAL_BLOCK_OOR);
3598	break;
3599	}
3600	else if ( enmDataForm != VDREGIONDATAFORM_MODE1_2048
3601	&& enmDataForm != VDREGIONDATAFORM_MODE1_2352
3602	&& enmDataForm != VDREGIONDATAFORM_MODE2_2336
3603	&& enmDataForm != VDREGIONDATAFORM_MODE2_2352
3604	&& enmDataForm != VDREGIONDATAFORM_RAW)
3605	{
3606	uint8_t abATAPISense[ATAPI_SENSE_SIZE];
3607	RT_ZERO(abATAPISense);
3608
3609	abATAPISense[0] = 0x70 \| (1 << 7);
3610	abATAPISense[2] = (SCSI_SENSE_ILLEGAL_REQUEST & 0x0f) \| SCSI_SENSE_FLAG_ILI;
3611	scsiH2BE_U32(&abATAPISense[3], iATAPILBA);
3612	abATAPISense[7] = 10;
3613	abATAPISense[12] = SCSI_ASC_ILLEGAL_MODE_FOR_THIS_TRACK;
3614	atapiR3CmdError(pCtl, s, &abATAPISense[0], sizeof(abATAPISense));
3615	break;
3616	}
3617	atapiR3ReadSectors(pDevIns, pCtl, s, iATAPILBA, cSectors, 2048);
3618	break;
3619	}
3620	case SCSI_READ_CD_MSF:
3621	case SCSI_READ_CD:
3622	{
3623	if (s->cNotifiedMediaChange > 0)
3624	{
3625	s->cNotifiedMediaChange-- ;
3626	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3627	break;
3628	}
3629	else if (!pDevR3->pDrvMount->pfnIsMounted(pDevR3->pDrvMount))
3630	{
3631	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3632	break;
3633	}
3634	if ((pbPacket[10] & 0x7) != 0)
3635	{
3636	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
3637	break;
3638	}
3639	if (pbPacket[0] == SCSI_READ_CD)
3640	{
3641	cSectors = (pbPacket[6] << 16) \| (pbPacket[7] << 8) \| pbPacket[8];
3642	iATAPILBA = scsiBE2H_U32(pbPacket + 2);
3643	}
3644	else /* READ CD MSF */
3645	{
3646	iATAPILBA = scsiMSF2LBA(pbPacket + 3);
3647	if (iATAPILBA > scsiMSF2LBA(pbPacket + 6))
3648	{
3649	Log2(("Start MSF %02u:%02u:%02u > end MSF %02u:%02u:%02u!\n", (pbPacket + 3), (pbPacket + 4), *(pbPacket + 5),
3650	(pbPacket + 6), (pbPacket + 7), *(pbPacket + 8)));
3651	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
3652	break;
3653	}
3654	cSectors = scsiMSF2LBA(pbPacket + 6) - iATAPILBA;
3655	Log2(("Start MSF %02u:%02u:%02u -> LBA %u\n", (pbPacket + 3), (pbPacket + 4), *(pbPacket + 5), iATAPILBA));
3656	Log2(("End MSF %02u:%02u:%02u -> %u sectors\n", (pbPacket + 6), (pbPacket + 7), *(pbPacket + 8), cSectors));
3657	}
3658	if (cSectors == 0)
3659	{
3660	atapiR3CmdOK(pCtl, s);
3661	break;
3662	}
3663	if ((uint64_t)iATAPILBA + cSectors > s->cTotalSectors)
3664	{
3665	/* Rate limited logging, one log line per second. For
3666	* guests that insist on reading from places outside the
3667	* valid area this often generates too many release log
3668	* entries otherwise. */
3669	static uint64_t uLastLogTS = 0;
3670	if (RTTimeMilliTS() >= uLastLogTS + 1000)
3671	{
3672	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM block number %Ld invalid (READ CD)\n", s->iLUN, (uint64_t)iATAPILBA + cSectors));
3673	uLastLogTS = RTTimeMilliTS();
3674	}
3675	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_LOGICAL_BLOCK_OOR);
3676	break;
3677	}
3678	/*
3679	* If the LBA is in an audio track we are required to ignore pretty much all
3680	* of the channel selection values (except 0x00) and map everything to 0x10
3681	* which means read user data with a sector size of 2352 bytes.
3682	*
3683	* (MMC-6 chapter 6.19.2.6)
3684	*/
3685	uint8_t uChnSel = pbPacket[9] & 0xf8;
3686	VDREGIONDATAFORM enmDataForm;
3687	int rc = pDevR3->pDrvMedia->pfnQueryRegionPropertiesForLba(pDevR3->pDrvMedia, iATAPILBA,
3688	NULL, NULL, NULL, &enmDataForm);
3689	AssertRC(rc);
3690
3691	if (enmDataForm == VDREGIONDATAFORM_CDDA)
3692	{
3693	if (uChnSel == 0)
3694	{
3695	/* nothing */
3696	atapiR3CmdOK(pCtl, s);
3697	}
3698	else
3699	atapiR3ReadSectors(pDevIns, pCtl, s, iATAPILBA, cSectors, 2352);
3700	}
3701	else
3702	{
3703	switch (uChnSel)
3704	{
3705	case 0x00:
3706	/* nothing */
3707	atapiR3CmdOK(pCtl, s);
3708	break;
3709	case 0x10:
3710	/* normal read */
3711	atapiR3ReadSectors(pDevIns, pCtl, s, iATAPILBA, cSectors, 2048);
3712	break;
3713	case 0xf8:
3714	/* read all data */
3715	atapiR3ReadSectors(pDevIns, pCtl, s, iATAPILBA, cSectors, 2352);
3716	break;
3717	default:
3718	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM sector format not supported (%#x)\n", s->iLUN, pbPacket[9] & 0xf8));
3719	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
3720	break;
3721	}
3722	}
3723	break;
3724	}
3725	case SCSI_SEEK_10:
3726	{
3727	if (s->cNotifiedMediaChange > 0)
3728	{
3729	s->cNotifiedMediaChange-- ;
3730	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3731	break;
3732	}
3733	else if (!pDevR3->pDrvMount->pfnIsMounted(pDevR3->pDrvMount))
3734	{
3735	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3736	break;
3737	}
3738	iATAPILBA = scsiBE2H_U32(pbPacket + 2);
3739	if (iATAPILBA > s->cTotalSectors)
3740	{
3741	/* Rate limited logging, one log line per second. For
3742	* guests that insist on seeking to places outside the
3743	* valid area this often generates too many release log
3744	* entries otherwise. */
3745	static uint64_t uLastLogTS = 0;
3746	if (RTTimeMilliTS() >= uLastLogTS + 1000)
3747	{
3748	LogRel(("PIIX3 ATA: LUN#%d: CD-ROM block number %Ld invalid (SEEK)\n", s->iLUN, (uint64_t)iATAPILBA));
3749	uLastLogTS = RTTimeMilliTS();
3750	}
3751	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_LOGICAL_BLOCK_OOR);
3752	break;
3753	}
3754	atapiR3CmdOK(pCtl, s);
3755	ataSetStatus(pCtl, s, ATA_STAT_SEEK); /* Linux expects this. Required by ATAPI 2.x when seek completes. */
3756	break;
3757	}
3758	case SCSI_START_STOP_UNIT:
3759	{
3760	int rc = VINF_SUCCESS;
3761	switch (pbPacket[4] & 3)
3762	{
3763	case 0: /* 00 - Stop motor */
3764	case 1: /* 01 - Start motor */
3765	break;
3766	case 2: /* 10 - Eject media */
3767	{
3768	/* This must be done from EMT. */
3769	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATER3);
3770
3771	ataR3LockLeave(pDevIns, pCtl);
3772	rc = PDMDevHlpVMReqPriorityCallWait(pDevIns, VMCPUID_ANY,
3773	(PFNRT)pDevR3->pDrvMount->pfnUnmount, 3,
3774	pDevR3->pDrvMount, false /=fForce/, true /=fEject/);
3775	Assert(RT_SUCCESS(rc) \|\| rc == VERR_PDM_MEDIA_LOCKED \|\| rc == VERR_PDM_MEDIA_NOT_MOUNTED);
3776	if (RT_SUCCESS(rc) && pThisCC->pMediaNotify)
3777	{
3778	rc = PDMDevHlpVMReqCallNoWait(pDevIns, VMCPUID_ANY,
3779	(PFNRT)pThisCC->pMediaNotify->pfnEjected, 2,
3780	pThisCC->pMediaNotify, s->iLUN);
3781	AssertRC(rc);
3782	}
3783
3784	ataR3LockEnter(pDevIns, pCtl);
3785	break;
3786	}
3787	case 3: /* 11 - Load media */
3788	/** @todo rc = pDevR3->pDrvMount->pfnLoadMedia(pDevR3->pDrvMount) */
3789	break;
3790	}
3791	if (RT_SUCCESS(rc))
3792	{
3793	atapiR3CmdOK(pCtl, s);
3794	ataSetStatus(pCtl, s, ATA_STAT_SEEK); /* Needed by NT 3.51/4.0, see @bugref{5869}. */
3795	}
3796	else
3797	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIA_LOAD_OR_EJECT_FAILED);
3798	break;
3799	}
3800	case SCSI_MECHANISM_STATUS:
3801	{
3802	cbMax = scsiBE2H_U16(pbPacket + 8);
3803	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 8), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_MECHANISM_STATUS, true);
3804	break;
3805	}
3806	case SCSI_READ_TOC_PMA_ATIP:
3807	{
3808	uint8_t format;
3809
3810	if (s->cNotifiedMediaChange > 0)
3811	{
3812	s->cNotifiedMediaChange-- ;
3813	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3814	break;
3815	}
3816	else if (!pDevR3->pDrvMount->pfnIsMounted(pDevR3->pDrvMount))
3817	{
3818	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3819	break;
3820	}
3821	cbMax = scsiBE2H_U16(pbPacket + 7);
3822	/* SCSI MMC-3 spec says format is at offset 2 (lower 4 bits),
3823	* but Linux kernel uses offset 9 (topmost 2 bits). Hope that
3824	* the other field is clear... */
3825	format = (pbPacket[2] & 0xf) \| (pbPacket[9] >> 6);
3826	switch (format)
3827	{
3828	case 0:
3829	ataR3StartTransfer(pDevIns, pCtl, s, cbMax, PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_TOC_NORMAL, true);
3830	break;
3831	case 1:
3832	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 12), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_TOC_MULTI, true);
3833	break;
3834	case 2:
3835	ataR3StartTransfer(pDevIns, pCtl, s, cbMax, PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_TOC_RAW, true);
3836	break;
3837	default:
3838	error_cmd:
3839	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_INV_FIELD_IN_CMD_PACKET);
3840	break;
3841	}
3842	break;
3843	}
3844	case SCSI_READ_CAPACITY:
3845	if (s->cNotifiedMediaChange > 0)
3846	{
3847	s->cNotifiedMediaChange-- ;
3848	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3849	break;
3850	}
3851	else if (!pDevR3->pDrvMount->pfnIsMounted(pDevR3->pDrvMount))
3852	{
3853	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3854	break;
3855	}
3856	ataR3StartTransfer(pDevIns, pCtl, s, 8, PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_CAPACITY, true);
3857	break;
3858	case SCSI_READ_DISC_INFORMATION:
3859	if (s->cNotifiedMediaChange > 0)
3860	{
3861	s->cNotifiedMediaChange-- ;
3862	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3863	break;
3864	}
3865	else if (!pDevR3->pDrvMount->pfnIsMounted(pDevR3->pDrvMount))
3866	{
3867	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3868	break;
3869	}
3870	cbMax = scsiBE2H_U16(pbPacket + 7);
3871	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 34), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_DISC_INFORMATION, true);
3872	break;
3873	case SCSI_READ_TRACK_INFORMATION:
3874	if (s->cNotifiedMediaChange > 0)
3875	{
3876	s->cNotifiedMediaChange-- ;
3877	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_UNIT_ATTENTION, SCSI_ASC_MEDIUM_MAY_HAVE_CHANGED); /* media changed */
3878	break;
3879	}
3880	else if (!pDevR3->pDrvMount->pfnIsMounted(pDevR3->pDrvMount))
3881	{
3882	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_NOT_READY, SCSI_ASC_MEDIUM_NOT_PRESENT);
3883	break;
3884	}
3885	cbMax = scsiBE2H_U16(pbPacket + 7);
3886	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 36), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_TRACK_INFORMATION, true);
3887	break;
3888	case SCSI_GET_CONFIGURATION:
3889	/* No media change stuff here, it can confuse Linux guests. */
3890	cbMax = scsiBE2H_U16(pbPacket + 7);
3891	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 80), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_GET_CONFIGURATION, true);
3892	break;
3893	case SCSI_INQUIRY:
3894	cbMax = scsiBE2H_U16(pbPacket + 3);
3895	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 36), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_INQUIRY, true);
3896	break;
3897	case SCSI_READ_DVD_STRUCTURE:
3898	{
3899	cbMax = scsiBE2H_U16(pbPacket + 8);
3900	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbMax, 4), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_READ_DVD_STRUCTURE, true);
3901	break;
3902	}
3903	default:
3904	atapiR3CmdErrorSimple(pCtl, s, SCSI_SENSE_ILLEGAL_REQUEST, SCSI_ASC_ILLEGAL_OPCODE);
3905	break;
3906	}
3907	}
3908
3909
3910	/*
3911	* Parse ATAPI commands, passing them directly to the CD/DVD drive.
3912	*/
3913	static void atapiR3ParseCmdPassthrough(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3914	{
3915	const uint8_t *pbPacket = &s->abATAPICmd[0];
3916
3917	/* Some cases we have to handle here. */
3918	if ( pbPacket[0] == SCSI_GET_EVENT_STATUS_NOTIFICATION
3919	&& ASMAtomicReadU32(&s->MediaEventStatus) != ATA_EVENT_STATUS_UNCHANGED)
3920	{
3921	uint32_t cbTransfer = scsiBE2H_U16(pbPacket + 7);
3922	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(cbTransfer, 8), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_GET_EVENT_STATUS_NOTIFICATION, true);
3923	}
3924	else if ( pbPacket[0] == SCSI_REQUEST_SENSE
3925	&& (s->abATAPISense[2] & 0x0f) != SCSI_SENSE_NONE)
3926	ataR3StartTransfer(pDevIns, pCtl, s, RT_MIN(pbPacket[4], 18), PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_ATAPI_CMD, ATAFN_SS_ATAPI_REQUEST_SENSE, true);
3927	else
3928	{
3929	size_t cbBuf = 0;
3930	size_t cbATAPISector = 0;
3931	size_t cbTransfer = 0;
3932	PDMMEDIATXDIR uTxDir = PDMMEDIATXDIR_NONE;
3933	uint8_t u8ScsiSts = SCSI_STATUS_OK;
3934
3935	if (pbPacket[0] == SCSI_FORMAT_UNIT \|\| pbPacket[0] == SCSI_GET_PERFORMANCE)
3936	cbBuf = s->uATARegLCyl \| (s->uATARegHCyl << 8); /* use ATAPI transfer length */
3937
3938	bool fPassthrough = ATAPIPassthroughParseCdb(pbPacket, sizeof(s->abATAPICmd), cbBuf, pDevR3->pTrackList,
3939	&s->abATAPISense[0], sizeof(s->abATAPISense), &uTxDir, &cbTransfer,
3940	&cbATAPISector, &u8ScsiSts);
3941	if (fPassthrough)
3942	{
3943	s->cbATAPISector = (uint32_t)cbATAPISector;
3944	Assert(s->cbATAPISector == (uint32_t)cbATAPISector);
3945	Assert(cbTransfer == (uint32_t)cbTransfer);
3946
3947	/*
3948	* Send a command to the drive, passing data in/out as required.
3949	* Commands which exceed the I/O buffer size are split below
3950	* or aborted if splitting is not implemented.
3951	*/
3952	Log2(("ATAPI PT: max size %d\n", cbTransfer));
3953	if (cbTransfer == 0)
3954	uTxDir = PDMMEDIATXDIR_NONE;
3955	ataR3StartTransfer(pDevIns, pCtl, s, (uint32_t)cbTransfer, uTxDir, ATAFN_BT_ATAPI_PASSTHROUGH_CMD, ATAFN_SS_ATAPI_PASSTHROUGH, true);
3956	}
3957	else if (u8ScsiSts == SCSI_STATUS_CHECK_CONDITION)
3958	{
3959	/* Sense data is already set, end the request and notify the guest. */
3960	Log(("%s: sense=%#x (%s) asc=%#x ascq=%#x (%s)\n", __FUNCTION__, s->abATAPISense[2] & 0x0f, SCSISenseText(s->abATAPISense[2] & 0x0f),
3961	s->abATAPISense[12], s->abATAPISense[13], SCSISenseExtText(s->abATAPISense[12], s->abATAPISense[13])));
3962	s->uATARegError = s->abATAPISense[2] << 4;
3963	ataSetStatusValue(pCtl, s, ATA_STAT_READY \| ATA_STAT_ERR);
3964	s->uATARegNSector = (s->uATARegNSector & ~7) \| ATAPI_INT_REASON_IO \| ATAPI_INT_REASON_CD;
3965	Log2(("%s: interrupt reason %#04x\n", __FUNCTION__, s->uATARegNSector));
3966	s->cbTotalTransfer = 0;
3967	s->cbElementaryTransfer = 0;
3968	s->cbAtapiPassthroughTransfer = 0;
3969	s->iIOBufferCur = 0;
3970	s->iIOBufferEnd = 0;
3971	s->uTxDir = PDMMEDIATXDIR_NONE;
3972	s->iBeginTransfer = ATAFN_BT_NULL;
3973	s->iSourceSink = ATAFN_SS_NULL;
3974	}
3975	else if (u8ScsiSts == SCSI_STATUS_OK)
3976	atapiR3CmdOK(pCtl, s);
3977	}
3978	}
3979
3980
3981	static void atapiR3ParseCmd(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
3982	{
3983	const uint8_t *pbPacket;
3984
3985	pbPacket = s->abATAPICmd;
3986	# ifdef DEBUG
3987	Log(("%s: LUN#%d DMA=%d CMD=%#04x \"%s\"\n", __FUNCTION__, s->iLUN, s->fDMA, pbPacket[0], SCSICmdText(pbPacket[0])));
3988	# else /* !DEBUG */
3989	Log(("%s: LUN#%d DMA=%d CMD=%#04x\n", __FUNCTION__, s->iLUN, s->fDMA, pbPacket[0]));
3990	# endif /* !DEBUG */
3991	Log2(("%s: limit=%#x packet: %.*Rhxs\n", __FUNCTION__, s->uATARegLCyl \| (s->uATARegHCyl << 8), ATAPI_PACKET_SIZE, pbPacket));
3992
3993	if (s->fATAPIPassthrough)
3994	atapiR3ParseCmdPassthrough(pDevIns, pCtl, s, pDevR3);
3995	else
3996	atapiR3ParseCmdVirtualATAPI(pDevIns, pCtl, s, pDevR3);
3997	}
3998
3999
4000	/**
4001	* Sink/Source: PACKET
4002	*/
4003	static bool ataR3PacketSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
4004	{
4005	s->fDMA = !!(s->uATARegFeature & 1);
4006	memcpy(s->abATAPICmd, s->abIOBuffer, ATAPI_PACKET_SIZE);
4007	s->uTxDir = PDMMEDIATXDIR_NONE;
4008	s->cbTotalTransfer = 0;
4009	s->cbElementaryTransfer = 0;
4010	s->cbAtapiPassthroughTransfer = 0;
4011	atapiR3ParseCmd(pDevIns, pCtl, s, pDevR3);
4012	return false;
4013	}
4014
4015
4016	/**
4017	* SCSI_GET_EVENT_STATUS_NOTIFICATION should return "medium removed" event
4018	* from now on, regardless if there was a medium inserted or not.
4019	*/
4020	static void ataR3MediumRemoved(PATADEVSTATE s)
4021	{
4022	ASMAtomicWriteU32(&s->MediaEventStatus, ATA_EVENT_STATUS_MEDIA_REMOVED);
4023	}
4024
4025
4026	/**
4027	* SCSI_GET_EVENT_STATUS_NOTIFICATION should return "medium inserted". If
4028	* there was already a medium inserted, don't forget to send the "medium
4029	* removed" event first.
4030	*/
4031	static void ataR3MediumInserted(PATADEVSTATE s)
4032	{
4033	uint32_t OldStatus, NewStatus;
4034	do
4035	{
4036	OldStatus = ASMAtomicReadU32(&s->MediaEventStatus);
4037	switch (OldStatus)
4038	{
4039	case ATA_EVENT_STATUS_MEDIA_CHANGED:
4040	case ATA_EVENT_STATUS_MEDIA_REMOVED:
4041	/* no change, we will send "medium removed" + "medium inserted" */
4042	NewStatus = ATA_EVENT_STATUS_MEDIA_CHANGED;
4043	break;
4044	default:
4045	NewStatus = ATA_EVENT_STATUS_MEDIA_NEW;
4046	break;
4047	}
4048	} while (!ASMAtomicCmpXchgU32(&s->MediaEventStatus, NewStatus, OldStatus));
4049	}
4050
4051
4052	/**
4053	* @interface_method_impl{PDMIMOUNTNOTIFY,pfnMountNotify}
4054	*/
4055	static DECLCALLBACK(void) ataR3MountNotify(PPDMIMOUNTNOTIFY pInterface)
4056	{
4057	PATADEVSTATER3 pIfR3 = RT_FROM_MEMBER(pInterface, ATADEVSTATER3, IMountNotify);
4058	PATASTATE pThis = PDMDEVINS_2_DATA(pIfR3->pDevIns, PATASTATE);
4059	PATADEVSTATE pIf = &RT_SAFE_SUBSCRIPT(RT_SAFE_SUBSCRIPT(pThis->aCts, pIfR3->iCtl).aIfs, pIfR3->iDev);
4060	Log(("%s: changing LUN#%d\n", __FUNCTION__, pIfR3->iLUN));
4061
4062	/* Ignore the call if we're called while being attached. */
4063	if (!pIfR3->pDrvMedia)
4064	return;
4065
4066	uint32_t cRegions = pIfR3->pDrvMedia->pfnGetRegionCount(pIfR3->pDrvMedia);
4067	for (uint32_t i = 0; i < cRegions; i++)
4068	{
4069	uint64_t cBlocks = 0;
4070	int rc = pIfR3->pDrvMedia->pfnQueryRegionProperties(pIfR3->pDrvMedia, i, NULL, &cBlocks,
4071	NULL, NULL);
4072	AssertRC(rc);
4073	pIf->cTotalSectors += cBlocks;
4074	}
4075
4076	LogRel(("PIIX3 ATA: LUN#%d: CD/DVD, total number of sectors %Ld, passthrough unchanged\n", pIf->iLUN, pIf->cTotalSectors));
4077
4078	/* Report media changed in TEST UNIT and other (probably incorrect) places. */
4079	if (pIf->cNotifiedMediaChange < 2)
4080	pIf->cNotifiedMediaChange = 1;
4081	ataR3MediumInserted(pIf);
4082	ataR3MediumTypeSet(pIf, ATA_MEDIA_TYPE_UNKNOWN);
4083	}
4084
4085	/**
4086	* @interface_method_impl{PDMIMOUNTNOTIFY,pfnUnmountNotify}
4087	*/
4088	static DECLCALLBACK(void) ataR3UnmountNotify(PPDMIMOUNTNOTIFY pInterface)
4089	{
4090	PATADEVSTATER3 pIfR3 = RT_FROM_MEMBER(pInterface, ATADEVSTATER3, IMountNotify);
4091	PATASTATE pThis = PDMDEVINS_2_DATA(pIfR3->pDevIns, PATASTATE);
4092	PATADEVSTATE pIf = &RT_SAFE_SUBSCRIPT(RT_SAFE_SUBSCRIPT(pThis->aCts, pIfR3->iCtl).aIfs, pIfR3->iDev);
4093	Log(("%s:\n", __FUNCTION__));
4094	pIf->cTotalSectors = 0;
4095
4096	/*
4097	* Whatever I do, XP will not use the GET MEDIA STATUS nor the EVENT stuff.
4098	* However, it will respond to TEST UNIT with a 0x6 0x28 (media changed) sense code.
4099	* So, we'll give it 4 TEST UNIT command to catch up, two which the media is not
4100	* present and 2 in which it is changed.
4101	*/
4102	pIf->cNotifiedMediaChange = 1;
4103	ataR3MediumRemoved(pIf);
4104	ataR3MediumTypeSet(pIf, ATA_MEDIA_NO_DISC);
4105	}
4106
4107	/**
4108	* Begin Transfer: PACKET
4109	*/
4110	static void ataR3PacketBT(PATACONTROLLER pCtl, PATADEVSTATE s)
4111	{
4112	s->cbElementaryTransfer = s->cbTotalTransfer;
4113	s->cbAtapiPassthroughTransfer = s->cbTotalTransfer;
4114	s->uATARegNSector = (s->uATARegNSector & ~7) \| ATAPI_INT_REASON_CD;
4115	Log2(("%s: interrupt reason %#04x\n", __FUNCTION__, s->uATARegNSector));
4116	ataSetStatusValue(pCtl, s, ATA_STAT_READY);
4117	}
4118
4119
4120	static void ataR3ResetDevice(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s)
4121	{
4122	LogFlowFunc(("\n"));
4123	s->cMultSectors = ATA_MAX_MULT_SECTORS;
4124	s->cNotifiedMediaChange = 0;
4125	ASMAtomicWriteU32(&s->MediaEventStatus, ATA_EVENT_STATUS_UNCHANGED);
4126	ASMAtomicWriteU32(&s->MediaTrackType, ATA_MEDIA_TYPE_UNKNOWN);
4127	ataUnsetIRQ(pDevIns, pCtl, s);
4128
4129	s->uATARegSelect = 0x20;
4130	ataSetStatusValue(pCtl, s, ATA_STAT_READY \| ATA_STAT_SEEK);
4131	ataR3SetSignature(s);
4132	s->cbTotalTransfer = 0;
4133	s->cbElementaryTransfer = 0;
4134	s->cbAtapiPassthroughTransfer = 0;
4135	s->iIOBufferPIODataStart = 0;
4136	s->iIOBufferPIODataEnd = 0;
4137	s->iBeginTransfer = ATAFN_BT_NULL;
4138	s->iSourceSink = ATAFN_SS_NULL;
4139	s->fDMA = false;
4140	s->fATAPITransfer = false;
4141	s->uATATransferMode = ATA_MODE_UDMA \| 2; /* PIIX3 supports only up to UDMA2 */
4142
4143	s->XCHSGeometry = s->PCHSGeometry; /* Restore default CHS translation. */
4144
4145	s->uATARegFeature = 0;
4146	}
4147
4148
4149	static void ataR3DeviceDiag(PATACONTROLLER pCtl, PATADEVSTATE s)
4150	{
4151	ataR3SetSignature(s);
4152	if (s->fATAPI)
4153	ataSetStatusValue(pCtl, s, 0); /* NOTE: READY is _not_ set */
4154	else
4155	ataSetStatusValue(pCtl, s, ATA_STAT_READY \| ATA_STAT_SEEK);
4156	s->uATARegError = 0x01;
4157	}
4158
4159
4160	/**
4161	* Sink/Source: EXECUTE DEVICE DIAGNOTIC
4162	*/
4163	static bool ataR3ExecuteDeviceDiagnosticSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
4164	{
4165	RT_NOREF(pDevIns, s, pDevR3);
4166
4167	/* EXECUTE DEVICE DIAGNOSTIC is a very special command which always
4168	* gets executed, regardless of which device is selected. As a side
4169	* effect, it always completes with device 0 selected.
4170	*/
4171	for (uint32_t i = 0; i < RT_ELEMENTS(pCtl->aIfs); i++)
4172	ataR3DeviceDiag(pCtl, &pCtl->aIfs[i]);
4173
4174	LogRel(("ATA: LUN#%d: EXECUTE DEVICE DIAGNOSTIC, status %02X\n", s->iLUN, s->uATARegStatus));
4175	pCtl->iSelectedIf = 0;
4176
4177	return false;
4178	}
4179
4180
4181	/**
4182	* Sink/Source: INITIALIZE DEVICE PARAMETERS
4183	*/
4184	static bool ataR3InitDevParmSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
4185	{
4186	RT_NOREF(pDevR3);
4187	LogFlowFunc(("\n"));
4188
4189	/* Technical Note:
4190	* On ST506 type drives with a separate controller, the INITIALIZE DRIVE PARAMETERS command was
4191	* required to inform the controller of drive geometry. The controller needed to know the
4192	* number of heads and sectors per track so that it could correctly advance to the next track
4193	* or cylinder when executing multi-sector commands. Setting a geometry that didn't match the
4194	* drive made very little sense because sectors had fixed CHS addresses. It was at best
4195	* possible to reduce the drive's capacity by limiting the number of heads and/or sectors
4196	* per track.
4197	*
4198	* IDE drives inherently have to know their true geometry, but most of them also support
4199	* programmable translation that can be set through the INITIALIZE DEVICE PARAMETERS command.
4200	* In fact most older IDE drives typically weren't operated using their default (native) geometry,
4201	* and with newer IDE drives that's not even an option.
4202	*
4203	* Up to and including ATA-5, the standard defined a CHS to LBA translation (since ATA-6, CHS
4204	* support is optional):
4205	*
4206	* LBA = (((cyl_num * heads_per_cyl) + head_num) * sectors_per_track) + sector_num - 1
4207	*
4208	* The INITIALIZE DEVICE PARAMETERS command sets the heads_per_cyl and sectors_per_track
4209	* values used in the above formula.
4210	*
4211	* Drives must obviously support an INITIALIZE DRIVE PARAMETERS command matching the drive's
4212	* default CHS translation. Everything else is optional.
4213	*
4214	* We support any geometry with non-zero sectors per track because there's no reason not to;
4215	* this behavior is common in many if not most IDE drives.
4216	*/
4217
4218	PDMMEDIAGEOMETRY Geom = { 0 };
4219
4220	Geom.cHeads = (s->uATARegSelect & 0x0f) + 1; /* Effective range 1-16. */
4221	Geom.cSectors = s->uATARegNSector; /* Range 0-255, zero is not valid. */
4222
4223	if (Geom.cSectors)
4224	{
4225	uint64_t cCylinders = s->cTotalSectors / (Geom.cHeads * Geom.cSectors);
4226	Geom.cCylinders = RT_MAX(RT_MIN(cCylinders, 16383), 1);
4227
4228	s->XCHSGeometry = Geom;
4229
4230	ataR3LockLeave(pDevIns, pCtl);
4231	LogRel(("ATA: LUN#%d: INITIALIZE DEVICE PARAMETERS: %u sectors per track, %u heads\n",
4232	s->iLUN, s->uATARegNSector, (s->uATARegSelect & 0x0f) + 1));
4233	RTThreadSleep(pCtl->msDelayIRQ);
4234	ataR3LockEnter(pDevIns, pCtl);
4235	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4236	}
4237	else
4238	{
4239	ataR3LockLeave(pDevIns, pCtl);
4240	LogRel(("ATA: LUN#%d: INITIALIZE DEVICE PARAMETERS error (zero sectors per track)!\n", s->iLUN));
4241	RTThreadSleep(pCtl->msDelayIRQ);
4242	ataR3LockEnter(pDevIns, pCtl);
4243	ataR3CmdError(pCtl, s, ABRT_ERR);
4244	}
4245	return false;
4246	}
4247
4248
4249	/**
4250	* Sink/Source: RECALIBRATE
4251	*/
4252	static bool ataR3RecalibrateSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
4253	{
4254	RT_NOREF(pDevR3);
4255	LogFlowFunc(("\n"));
4256	ataR3LockLeave(pDevIns, pCtl);
4257	RTThreadSleep(pCtl->msDelayIRQ);
4258	ataR3LockEnter(pDevIns, pCtl);
4259	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4260	return false;
4261	}
4262
4263
4264	static int ataR3TrimSectors(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3,
4265	uint64_t u64Sector, uint32_t cSectors, bool *pfRedo)
4266	{
4267	RTRANGE TrimRange;
4268	int rc;
4269
4270	ataR3LockLeave(pDevIns, pCtl);
4271
4272	TrimRange.offStart = u64Sector * s->cbSector;
4273	TrimRange.cbRange = cSectors * s->cbSector;
4274
4275	s->Led.Asserted.s.fWriting = s->Led.Actual.s.fWriting = 1;
4276	rc = pDevR3->pDrvMedia->pfnDiscard(pDevR3->pDrvMedia, &TrimRange, 1);
4277	s->Led.Actual.s.fWriting = 0;
4278
4279	if (RT_SUCCESS(rc))
4280	*pfRedo = false;
4281	else
4282	*pfRedo = ataR3IsRedoSetWarning(pDevIns, pCtl, rc);
4283
4284	ataR3LockEnter(pDevIns, pCtl);
4285	return rc;
4286	}
4287
4288
4289	/**
4290	* Sink/Source: TRIM
4291	*/
4292	static bool ataR3TrimSS(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3)
4293	{
4294	int rc = VERR_GENERAL_FAILURE;
4295	uint32_t cRangesMax;
4296	uint64_t pu64Range = (uint64_t )&s->abIOBuffer[0];
4297	bool fRedo = false;
4298
4299	cRangesMax = RT_MIN(s->cbElementaryTransfer, sizeof(s->abIOBuffer)) / sizeof(uint64_t);
4300	Assert(cRangesMax);
4301
4302	while (cRangesMax-- > 0)
4303	{
4304	if (ATA_RANGE_LENGTH_GET(*pu64Range) == 0)
4305	break;
4306
4307	rc = ataR3TrimSectors(pDevIns, pCtl, s, pDevR3, *pu64Range & ATA_RANGE_LBA_MASK,
4308	ATA_RANGE_LENGTH_GET(*pu64Range), &fRedo);
4309	if (RT_FAILURE(rc))
4310	break;
4311
4312	pu64Range++;
4313	}
4314
4315	if (RT_SUCCESS(rc))
4316	{
4317	s->iSourceSink = ATAFN_SS_NULL;
4318	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4319	}
4320	else
4321	{
4322	if (fRedo)
4323	return fRedo;
4324	if (s->cErrors++ < MAX_LOG_REL_ERRORS)
4325	LogRel(("PIIX3 ATA: LUN#%d: disk trim error (rc=%Rrc iSector=%#RX64 cSectors=%#RX32)\n",
4326	s->iLUN, rc, pu64Range & ATA_RANGE_LBA_MASK, ATA_RANGE_LENGTH_GET(pu64Range)));
4327
4328	/*
4329	* Check if we got interrupted. We don't need to set status variables
4330	* because the request was aborted.
4331	*/
4332	if (rc != VERR_INTERRUPTED)
4333	ataR3CmdError(pCtl, s, ID_ERR);
4334	}
4335
4336	return false;
4337	}
4338
4339
4340	static void ataR3ParseCmd(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s, PATADEVSTATER3 pDevR3, uint8_t cmd)
4341	{
4342	# ifdef DEBUG
4343	Log(("%s: LUN#%d CMD=%#04x \"%s\"\n", __FUNCTION__, s->iLUN, cmd, ATACmdText(cmd)));
4344	# else /* !DEBUG */
4345	Log(("%s: LUN#%d CMD=%#04x\n", __FUNCTION__, s->iLUN, cmd));
4346	# endif /* !DEBUG */
4347	s->fLBA48 = false;
4348	s->fDMA = false;
4349	if (cmd == ATA_IDLE_IMMEDIATE)
4350	{
4351	/* Detect Linux timeout recovery, first tries IDLE IMMEDIATE (which
4352	* would overwrite the failing command unfortunately), then RESET. */
4353	int32_t uCmdWait = -1;
4354	uint64_t uNow = RTTimeNanoTS();
4355	if (s->u64CmdTS)
4356	uCmdWait = (uNow - s->u64CmdTS) / 1000;
4357	LogRel(("PIIX3 ATA: LUN#%d: IDLE IMMEDIATE, CmdIf=%#04x (%d usec ago)\n",
4358	s->iLUN, s->uATARegCommand, uCmdWait));
4359	}
4360	s->uATARegCommand = cmd;
4361	switch (cmd)
4362	{
4363	case ATA_IDENTIFY_DEVICE:
4364	if (pDevR3->pDrvMedia && !s->fATAPI)
4365	ataR3StartTransfer(pDevIns, pCtl, s, 512, PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_NULL, ATAFN_SS_IDENTIFY, false);
4366	else
4367	{
4368	if (s->fATAPI)
4369	ataR3SetSignature(s);
4370	ataR3CmdError(pCtl, s, ABRT_ERR);
4371	ataUnsetStatus(pCtl, s, ATA_STAT_READY);
4372	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4373	}
4374	break;
4375	case ATA_RECALIBRATE:
4376	if (s->fATAPI)
4377	goto abort_cmd;
4378	ataR3StartTransfer(pDevIns, pCtl, s, 0, PDMMEDIATXDIR_NONE, ATAFN_BT_NULL, ATAFN_SS_RECALIBRATE, false);
4379	break;
4380	case ATA_INITIALIZE_DEVICE_PARAMETERS:
4381	if (s->fATAPI)
4382	goto abort_cmd;
4383	ataR3StartTransfer(pDevIns, pCtl, s, 0, PDMMEDIATXDIR_NONE, ATAFN_BT_NULL, ATAFN_SS_INITIALIZE_DEVICE_PARAMETERS, false);
4384	break;
4385	case ATA_SET_MULTIPLE_MODE:
4386	if ( s->uATARegNSector != 0
4387	&& ( s->uATARegNSector > ATA_MAX_MULT_SECTORS
4388	\|\| (s->uATARegNSector & (s->uATARegNSector - 1)) != 0))
4389	{
4390	ataR3CmdError(pCtl, s, ABRT_ERR);
4391	}
4392	else
4393	{
4394	Log2(("%s: set multi sector count to %d\n", __FUNCTION__, s->uATARegNSector));
4395	s->cMultSectors = s->uATARegNSector;
4396	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4397	}
4398	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4399	break;
4400	case ATA_READ_VERIFY_SECTORS_EXT:
4401	s->fLBA48 = true;
4402	RT_FALL_THRU();
4403	case ATA_READ_VERIFY_SECTORS:
4404	case ATA_READ_VERIFY_SECTORS_WITHOUT_RETRIES:
4405	/* do sector number check ? */
4406	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4407	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4408	break;
4409	case ATA_READ_SECTORS_EXT:
4410	s->fLBA48 = true;
4411	RT_FALL_THRU();
4412	case ATA_READ_SECTORS:
4413	case ATA_READ_SECTORS_WITHOUT_RETRIES:
4414	if (!pDevR3->pDrvMedia \|\| s->fATAPI)
4415	goto abort_cmd;
4416	s->cSectorsPerIRQ = 1;
4417	s->iCurLBA = ataR3GetSector(s);
4418	ataR3StartTransfer(pDevIns, pCtl, s, ataR3GetNSectors(s) * s->cbSector, PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_READ_SECTORS, false);
4419	break;
4420	case ATA_WRITE_SECTORS_EXT:
4421	s->fLBA48 = true;
4422	RT_FALL_THRU();
4423	case ATA_WRITE_SECTORS:
4424	case ATA_WRITE_SECTORS_WITHOUT_RETRIES:
4425	if (!pDevR3->pDrvMedia \|\| s->fATAPI)
4426	goto abort_cmd;
4427	s->cSectorsPerIRQ = 1;
4428	s->iCurLBA = ataR3GetSector(s);
4429	ataR3StartTransfer(pDevIns, pCtl, s, ataR3GetNSectors(s) * s->cbSector, PDMMEDIATXDIR_TO_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_WRITE_SECTORS, false);
4430	break;
4431	case ATA_READ_MULTIPLE_EXT:
4432	s->fLBA48 = true;
4433	RT_FALL_THRU();
4434	case ATA_READ_MULTIPLE:
4435	if (!pDevR3->pDrvMedia \|\| !s->cMultSectors \|\| s->fATAPI)
4436	goto abort_cmd;
4437	s->cSectorsPerIRQ = s->cMultSectors;
4438	s->iCurLBA = ataR3GetSector(s);
4439	ataR3StartTransfer(pDevIns, pCtl, s, ataR3GetNSectors(s) * s->cbSector, PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_READ_SECTORS, false);
4440	break;
4441	case ATA_WRITE_MULTIPLE_EXT:
4442	s->fLBA48 = true;
4443	RT_FALL_THRU();
4444	case ATA_WRITE_MULTIPLE:
4445	if (!pDevR3->pDrvMedia \|\| !s->cMultSectors \|\| s->fATAPI)
4446	goto abort_cmd;
4447	s->cSectorsPerIRQ = s->cMultSectors;
4448	s->iCurLBA = ataR3GetSector(s);
4449	ataR3StartTransfer(pDevIns, pCtl, s, ataR3GetNSectors(s) * s->cbSector, PDMMEDIATXDIR_TO_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_WRITE_SECTORS, false);
4450	break;
4451	case ATA_READ_DMA_EXT:
4452	s->fLBA48 = true;
4453	RT_FALL_THRU();
4454	case ATA_READ_DMA:
4455	case ATA_READ_DMA_WITHOUT_RETRIES:
4456	if (!pDevR3->pDrvMedia \|\| s->fATAPI)
4457	goto abort_cmd;
4458	s->cSectorsPerIRQ = ATA_MAX_MULT_SECTORS;
4459	s->iCurLBA = ataR3GetSector(s);
4460	s->fDMA = true;
4461	ataR3StartTransfer(pDevIns, pCtl, s, ataR3GetNSectors(s) * s->cbSector, PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_READ_SECTORS, false);
4462	break;
4463	case ATA_WRITE_DMA_EXT:
4464	s->fLBA48 = true;
4465	RT_FALL_THRU();
4466	case ATA_WRITE_DMA:
4467	case ATA_WRITE_DMA_WITHOUT_RETRIES:
4468	if (!pDevR3->pDrvMedia \|\| s->fATAPI)
4469	goto abort_cmd;
4470	s->cSectorsPerIRQ = ATA_MAX_MULT_SECTORS;
4471	s->iCurLBA = ataR3GetSector(s);
4472	s->fDMA = true;
4473	ataR3StartTransfer(pDevIns, pCtl, s, ataR3GetNSectors(s) * s->cbSector, PDMMEDIATXDIR_TO_DEVICE, ATAFN_BT_READ_WRITE_SECTORS, ATAFN_SS_WRITE_SECTORS, false);
4474	break;
4475	case ATA_READ_NATIVE_MAX_ADDRESS_EXT:
4476	if (!pDevR3->pDrvMedia \|\| s->fATAPI)
4477	goto abort_cmd;
4478	s->fLBA48 = true;
4479	ataR3SetSector(s, s->cTotalSectors - 1);
4480	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4481	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4482	break;
4483	case ATA_SEEK: /* Used by the SCO OpenServer. Command is marked as obsolete */
4484	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4485	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4486	break;
4487	case ATA_READ_NATIVE_MAX_ADDRESS:
4488	if (!pDevR3->pDrvMedia \|\| s->fATAPI)
4489	goto abort_cmd;
4490	ataR3SetSector(s, RT_MIN(s->cTotalSectors, 1 << 28) - 1);
4491	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4492	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4493	break;
4494	case ATA_CHECK_POWER_MODE:
4495	s->uATARegNSector = 0xff; /* drive active or idle */
4496	ataR3CmdOK(pCtl, s, 0);
4497	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4498	break;
4499	case ATA_SET_FEATURES:
4500	Log2(("%s: feature=%#x\n", __FUNCTION__, s->uATARegFeature));
4501	if (!pDevR3->pDrvMedia)
4502	goto abort_cmd;
4503	switch (s->uATARegFeature)
4504	{
4505	case 0x02: /* write cache enable */
4506	Log2(("%s: write cache enable\n", __FUNCTION__));
4507	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4508	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4509	break;
4510	case 0xaa: /* read look-ahead enable */
4511	Log2(("%s: read look-ahead enable\n", __FUNCTION__));
4512	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4513	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4514	break;
4515	case 0x55: /* read look-ahead disable */
4516	Log2(("%s: read look-ahead disable\n", __FUNCTION__));
4517	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4518	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4519	break;
4520	case 0xcc: /* reverting to power-on defaults enable */
4521	Log2(("%s: revert to power-on defaults enable\n", __FUNCTION__));
4522	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4523	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4524	break;
4525	case 0x66: /* reverting to power-on defaults disable */
4526	Log2(("%s: revert to power-on defaults disable\n", __FUNCTION__));
4527	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4528	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4529	break;
4530	case 0x82: /* write cache disable */
4531	Log2(("%s: write cache disable\n", __FUNCTION__));
4532	/* As per the ATA/ATAPI-6 specs, a write cache disable
4533	* command MUST flush the write buffers to disc. */
4534	ataR3StartTransfer(pDevIns, pCtl, s, 0, PDMMEDIATXDIR_NONE, ATAFN_BT_NULL, ATAFN_SS_FLUSH, false);
4535	break;
4536	case 0x03: { /* set transfer mode */
4537	Log2(("%s: transfer mode %#04x\n", __FUNCTION__, s->uATARegNSector));
4538	switch (s->uATARegNSector & 0xf8)
4539	{
4540	case 0x00: /* PIO default */
4541	case 0x08: /* PIO mode */
4542	break;
4543	case ATA_MODE_MDMA: /* MDMA mode */
4544	s->uATATransferMode = (s->uATARegNSector & 0xf8) \| RT_MIN(s->uATARegNSector & 0x07, ATA_MDMA_MODE_MAX);
4545	break;
4546	case ATA_MODE_UDMA: /* UDMA mode */
4547	s->uATATransferMode = (s->uATARegNSector & 0xf8) \| RT_MIN(s->uATARegNSector & 0x07, ATA_UDMA_MODE_MAX);
4548	break;
4549	default:
4550	goto abort_cmd;
4551	}
4552	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
4553	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4554	break;
4555	}
4556	default:
4557	goto abort_cmd;
4558	}
4559	/*
4560	* OS/2 workarond:
4561	* The OS/2 IDE driver from MCP2 appears to rely on the feature register being
4562	* reset here. According to the specification, this is a driver bug as the register
4563	* contents are undefined after the call. This means we can just as well reset it.
4564	*/
4565	s->uATARegFeature = 0;
4566	break;
4567	case ATA_FLUSH_CACHE_EXT:
4568	case ATA_FLUSH_CACHE:
4569	if (!pDevR3->pDrvMedia \|\| s->fATAPI)
4570	goto abort_cmd;
4571	ataR3StartTransfer(pDevIns, pCtl, s, 0, PDMMEDIATXDIR_NONE, ATAFN_BT_NULL, ATAFN_SS_FLUSH, false);
4572	break;
4573	case ATA_STANDBY_IMMEDIATE:
4574	ataR3CmdOK(pCtl, s, 0);
4575	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4576	break;
4577	case ATA_IDLE_IMMEDIATE:
4578	LogRel(("PIIX3 ATA: LUN#%d: aborting current command\n", s->iLUN));
4579	ataR3AbortCurrentCommand(pDevIns, pCtl, s, false);
4580	break;
4581	case ATA_SLEEP:
4582	ataR3CmdOK(pCtl, s, 0);
4583	ataHCSetIRQ(pDevIns, pCtl, s);
4584	break;
4585	/* ATAPI commands */
4586	case ATA_IDENTIFY_PACKET_DEVICE:
4587	if (s->fATAPI)
4588	ataR3StartTransfer(pDevIns, pCtl, s, 512, PDMMEDIATXDIR_FROM_DEVICE, ATAFN_BT_NULL, ATAFN_SS_ATAPI_IDENTIFY, false);
4589	else
4590	{
4591	ataR3CmdError(pCtl, s, ABRT_ERR);
4592	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4593	}
4594	break;
4595	case ATA_EXECUTE_DEVICE_DIAGNOSTIC:
4596	ataR3StartTransfer(pDevIns, pCtl, s, 0, PDMMEDIATXDIR_NONE, ATAFN_BT_NULL, ATAFN_SS_EXECUTE_DEVICE_DIAGNOSTIC, false);
4597	break;
4598	case ATA_DEVICE_RESET:
4599	if (!s->fATAPI)
4600	goto abort_cmd;
4601	LogRel(("PIIX3 ATA: LUN#%d: performing device RESET\n", s->iLUN));
4602	ataR3AbortCurrentCommand(pDevIns, pCtl, s, true);
4603	break;
4604	case ATA_PACKET:
4605	if (!s->fATAPI)
4606	goto abort_cmd;
4607	/* overlapping commands not supported */
4608	if (s->uATARegFeature & 0x02)
4609	goto abort_cmd;
4610	ataR3StartTransfer(pDevIns, pCtl, s, ATAPI_PACKET_SIZE, PDMMEDIATXDIR_TO_DEVICE, ATAFN_BT_PACKET, ATAFN_SS_PACKET, false);
4611	break;
4612	case ATA_DATA_SET_MANAGEMENT:
4613	if (!pDevR3->pDrvMedia \|\| !pDevR3->pDrvMedia->pfnDiscard)
4614	goto abort_cmd;
4615	if ( !(s->uATARegFeature & UINT8_C(0x01))
4616	\|\| (s->uATARegFeature & ~UINT8_C(0x01)))
4617	goto abort_cmd;
4618	s->fDMA = true;
4619	ataR3StartTransfer(pDevIns, pCtl, s, (s->uATARegNSectorHOB << 8 \| s->uATARegNSector) * s->cbSector, PDMMEDIATXDIR_TO_DEVICE, ATAFN_BT_NULL, ATAFN_SS_TRIM, false);
4620	break;
4621	default:
4622	abort_cmd:
4623	ataR3CmdError(pCtl, s, ABRT_ERR);
4624	if (s->fATAPI)
4625	ataUnsetStatus(pCtl, s, ATA_STAT_READY);
4626	ataHCSetIRQ(pDevIns, pCtl, s); /* Shortcut, do not use AIO thread. */
4627	break;
4628	}
4629	}
4630
4631	# endif /* IN_RING3 */
4632	#endif /* IN_RING0 \|\| IN_RING3 */
4633
4634	/*
4635	* Note: There are four distinct cases of port I/O handling depending on
4636	* which devices (if any) are attached to an IDE channel:
4637	*
4638	* 1) No device attached. No response to writes or reads (i.e. reads return
4639	* all bits set).
4640	*
4641	* 2) Both devices attached. Reads and writes are processed normally.
4642	*
4643	* 3) Device 0 only. If device 0 is selected, normal behavior applies. But
4644	* if Device 1 is selected, writes are still directed to Device 0 (except
4645	* commands are not executed), reads from control/command registers are
4646	* directed to Device 0, but status/alt status reads return 0. If Device 1
4647	* is a PACKET device, all reads return 0. See ATAPI-6 clause 9.16.1 and
4648	* Table 18 in clause 7.1.
4649	*
4650	* 4) Device 1 only - non-standard(!). Device 1 can't tell if Device 0 is
4651	* present or not and behaves the same. That means if Device 0 is selected,
4652	* Device 1 responds to writes (except commands are not executed) but does
4653	* not respond to reads. If Device 1 selected, normal behavior applies.
4654	* See ATAPI-6 clause 9.16.2 and Table 15 in clause 7.1.
4655	*/
4656
4657	static VBOXSTRICTRC ataIOPortWriteU8(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, uint32_t addr, uint32_t val, uintptr_t iCtl)
4658	{
4659	RT_NOREF(iCtl);
4660	Log2(("%s: LUN#%d write addr=%#x val=%#04x\n", __FUNCTION__, pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK].iLUN, addr, val));
4661	addr &= 7;
4662	switch (addr)
4663	{
4664	case 0:
4665	break;
4666	case 1: /* feature register */
4667	/* NOTE: data is written to the two drives */
4668	pCtl->aIfs[0].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4669	pCtl->aIfs[1].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4670	pCtl->aIfs[0].uATARegFeatureHOB = pCtl->aIfs[0].uATARegFeature;
4671	pCtl->aIfs[1].uATARegFeatureHOB = pCtl->aIfs[1].uATARegFeature;
4672	pCtl->aIfs[0].uATARegFeature = val;
4673	pCtl->aIfs[1].uATARegFeature = val;
4674	break;
4675	case 2: /* sector count */
4676	pCtl->aIfs[0].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4677	pCtl->aIfs[1].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4678	pCtl->aIfs[0].uATARegNSectorHOB = pCtl->aIfs[0].uATARegNSector;
4679	pCtl->aIfs[1].uATARegNSectorHOB = pCtl->aIfs[1].uATARegNSector;
4680	pCtl->aIfs[0].uATARegNSector = val;
4681	pCtl->aIfs[1].uATARegNSector = val;
4682	break;
4683	case 3: /* sector number */
4684	pCtl->aIfs[0].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4685	pCtl->aIfs[1].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4686	pCtl->aIfs[0].uATARegSectorHOB = pCtl->aIfs[0].uATARegSector;
4687	pCtl->aIfs[1].uATARegSectorHOB = pCtl->aIfs[1].uATARegSector;
4688	pCtl->aIfs[0].uATARegSector = val;
4689	pCtl->aIfs[1].uATARegSector = val;
4690	break;
4691	case 4: /* cylinder low */
4692	pCtl->aIfs[0].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4693	pCtl->aIfs[1].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4694	pCtl->aIfs[0].uATARegLCylHOB = pCtl->aIfs[0].uATARegLCyl;
4695	pCtl->aIfs[1].uATARegLCylHOB = pCtl->aIfs[1].uATARegLCyl;
4696	pCtl->aIfs[0].uATARegLCyl = val;
4697	pCtl->aIfs[1].uATARegLCyl = val;
4698	break;
4699	case 5: /* cylinder high */
4700	pCtl->aIfs[0].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4701	pCtl->aIfs[1].uATARegDevCtl &= ~ATA_DEVCTL_HOB;
4702	pCtl->aIfs[0].uATARegHCylHOB = pCtl->aIfs[0].uATARegHCyl;
4703	pCtl->aIfs[1].uATARegHCylHOB = pCtl->aIfs[1].uATARegHCyl;
4704	pCtl->aIfs[0].uATARegHCyl = val;
4705	pCtl->aIfs[1].uATARegHCyl = val;
4706	break;
4707	case 6: /* drive/head */
4708	pCtl->aIfs[0].uATARegSelect = (val & ~0x10) \| 0xa0;
4709	pCtl->aIfs[1].uATARegSelect = (val \| 0x10) \| 0xa0;
4710	if (((val >> 4) & ATA_SELECTED_IF_MASK) != pCtl->iSelectedIf)
4711	{
4712	/* select another drive */
4713	uintptr_t const iSelectedIf = (val >> 4) & ATA_SELECTED_IF_MASK;
4714	pCtl->iSelectedIf = (uint8_t)iSelectedIf;
4715	/* The IRQ line is multiplexed between the two drives, so
4716	* update the state when switching to another drive. Only need
4717	* to update interrupt line if it is enabled and there is a
4718	* state change. */
4719	if ( !(pCtl->aIfs[iSelectedIf].uATARegDevCtl & ATA_DEVCTL_DISABLE_IRQ)
4720	&& pCtl->aIfs[iSelectedIf].fIrqPending != pCtl->aIfs[iSelectedIf ^ 1].fIrqPending)
4721	{
4722	if (pCtl->aIfs[iSelectedIf].fIrqPending)
4723	{
4724	Log2(("%s: LUN#%d asserting IRQ (drive select change)\n", __FUNCTION__, pCtl->aIfs[iSelectedIf].iLUN));
4725	/* The BMDMA unit unconditionally sets BM_STATUS_INT if
4726	* the interrupt line is asserted. It monitors the line
4727	* for a rising edge. */
4728	pCtl->BmDma.u8Status \|= BM_STATUS_INT;
4729	if (pCtl->irq == 16)
4730	PDMDevHlpPCISetIrq(pDevIns, 0, 1);
4731	else
4732	PDMDevHlpISASetIrq(pDevIns, pCtl->irq, 1);
4733	}
4734	else
4735	{
4736	Log2(("%s: LUN#%d deasserting IRQ (drive select change)\n", __FUNCTION__, pCtl->aIfs[iSelectedIf].iLUN));
4737	if (pCtl->irq == 16)
4738	PDMDevHlpPCISetIrq(pDevIns, 0, 0);
4739	else
4740	PDMDevHlpISASetIrq(pDevIns, pCtl->irq, 0);
4741	}
4742	}
4743	}
4744	break;
4745	default:
4746	case 7: /* command */
4747	{
4748	/* ignore commands to non-existent device */
4749	uintptr_t iSelectedIf = pCtl->iSelectedIf & ATA_SELECTED_IF_MASK;
4750	PATADEVSTATE pDev = &pCtl->aIfs[iSelectedIf];
4751	if (iSelectedIf && !pDev->fPresent) /** @todo r=bird the iSelectedIf test here looks bogus... explain. */
4752	break;
4753	#ifndef IN_RING3
4754	/* Don't do anything complicated in GC */
4755	return VINF_IOM_R3_IOPORT_WRITE;
4756	#else /* IN_RING3 */
4757	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATER3);
4758	ataUnsetIRQ(pDevIns, pCtl, &pCtl->aIfs[iSelectedIf]);
4759	ataR3ParseCmd(pDevIns, pCtl, &pCtl->aIfs[iSelectedIf], &pThisCC->aCts[iCtl].aIfs[iSelectedIf], val);
4760	break;
4761	#endif /* !IN_RING3 */
4762	}
4763	}
4764	return VINF_SUCCESS;
4765	}
4766
4767
4768	static VBOXSTRICTRC ataIOPortReadU8(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, uint32_t addr, uint32_t *pu32)
4769	{
4770	PATADEVSTATE s = &pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK];
4771	uint32_t val;
4772	bool fHOB;
4773
4774	/* Check if the guest is reading from a non-existent device. */
4775	if (RT_LIKELY(s->fPresent))
4776	{ /* likely */ }
4777	else
4778	{
4779	if (pCtl->iSelectedIf) /* Device 1 selected, Device 0 responding for it. */
4780	{
4781	Assert(pCtl->aIfs[0].fPresent);
4782
4783	/* When an ATAPI device 0 responds for non-present device 1, it generally
4784	* returns zeros on reads. The Error register is an exception. See clause 7.1,
4785	* table 16 in ATA-6 specification.
4786	*/
4787	if (((addr & 7) != 1) && pCtl->aIfs[0].fATAPI)
4788	{
4789	Log2(("%s: addr=%#x, val=0: LUN#%d not attached/LUN#%d ATAPI\n", __FUNCTION__, addr, s->iLUN, pCtl->aIfs[0].iLUN));
4790	*pu32 = 0;
4791	return VINF_SUCCESS;
4792	}
4793	/* Else handle normally. */
4794	}
4795	else /* Device 0 selected (but not present). */
4796	{
4797	/* Because device 1 has no way to tell if there is device 0, the behavior is the same
4798	* as for an empty bus; see comments in ataIOPortReadEmptyBus(). Note that EFI (TianoCore)
4799	* relies on this behavior when detecting devices.
4800	*/
4801	*pu32 = ATA_EMPTY_BUS_DATA;
4802	Log2(("%s: addr=%#x: LUN#%d not attached, val=%#02x\n", __FUNCTION__, addr, s->iLUN, *pu32));
4803	return VINF_SUCCESS;
4804	}
4805	}
4806
4807	fHOB = !!(s->uATARegDevCtl & (1 << 7));
4808	switch (addr & 7)
4809	{
4810	case 0: /* data register */
4811	val = 0xff;
4812	break;
4813	case 1: /* error register */
4814	/* The ATA specification is very terse when it comes to specifying
4815	* the precise effects of reading back the error/feature register.
4816	* The error register (read-only) shares the register number with
4817	* the feature register (write-only), so it seems that it's not
4818	* necessary to support the usual HOB readback here. */
4819	if (!s->fPresent)
4820	val = 0;
4821	else
4822	val = s->uATARegError;
4823	break;
4824	case 2: /* sector count */
4825	if (fHOB)
4826	val = s->uATARegNSectorHOB;
4827	else
4828	val = s->uATARegNSector;
4829	break;
4830	case 3: /* sector number */
4831	if (fHOB)
4832	val = s->uATARegSectorHOB;
4833	else
4834	val = s->uATARegSector;
4835	break;
4836	case 4: /* cylinder low */
4837	if (fHOB)
4838	val = s->uATARegLCylHOB;
4839	else
4840	val = s->uATARegLCyl;
4841	break;
4842	case 5: /* cylinder high */
4843	if (fHOB)
4844	val = s->uATARegHCylHOB;
4845	else
4846	val = s->uATARegHCyl;
4847	break;
4848	case 6: /* drive/head */
4849	/* This register must always work as long as there is at least
4850	* one drive attached to the controller. It is common between
4851	* both drives anyway (completely identical content). */
4852	if (!pCtl->aIfs[0].fPresent && !pCtl->aIfs[1].fPresent)
4853	val = 0;
4854	else
4855	val = s->uATARegSelect;
4856	break;
4857	default:
4858	case 7: /* primary status */
4859	{
4860	if (!s->fPresent)
4861	val = 0;
4862	else
4863	val = s->uATARegStatus;
4864
4865	/* Give the async I/O thread an opportunity to make progress,
4866	* don't let it starve by guests polling frequently. EMT has a
4867	* lower priority than the async I/O thread, but sometimes the
4868	* host OS doesn't care. With some guests we are only allowed to
4869	* be busy for about 5 milliseconds in some situations. Note that
4870	* this is no guarantee for any other VBox thread getting
4871	* scheduled, so this just lowers the CPU load a bit when drives
4872	* are busy. It cannot help with timing problems. */
4873	if (val & ATA_STAT_BUSY)
4874	{
4875	#ifdef IN_RING3
4876	/* @bugref{1960}: Don't yield all the time, unless it's a reset (can be tricky). */
4877	bool fYield = (s->cBusyStatusHackR3++ & s->cBusyStatusHackR3Rate) == 0
4878	\|\| pCtl->fReset;
4879
4880	ataR3LockLeave(pDevIns, pCtl);
4881
4882	/*
4883	* The thread might be stuck in an I/O operation due to a high I/O
4884	* load on the host (see @bugref{3301}). To perform the reset
4885	* successfully we interrupt the operation by sending a signal to
4886	* the thread if the thread didn't responded in 10ms.
4887	*
4888	* This works only on POSIX hosts (Windows has a CancelSynchronousIo
4889	* function which does the same but it was introduced with Vista) but
4890	* so far this hang was only observed on Linux and Mac OS X.
4891	*
4892	* This is a workaround and needs to be solved properly.
4893	*/
4894	if (pCtl->fReset)
4895	{
4896	uint64_t u64ResetTimeStop = RTTimeMilliTS();
4897	if (u64ResetTimeStop - pCtl->u64ResetTime >= 10)
4898	{
4899	LogRel(("PIIX3 ATA LUN#%d: Async I/O thread probably stuck in operation, interrupting\n", s->iLUN));
4900	pCtl->u64ResetTime = u64ResetTimeStop;
4901	# ifndef RT_OS_WINDOWS /* We've got this API on windows, but it doesn't necessarily interrupt I/O. */
4902	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATER3);
4903	PATACONTROLLERR3 pCtlR3 = &RT_SAFE_SUBSCRIPT(pThisCC->aCts, pCtl->iCtl);
4904	RTThreadPoke(pCtlR3->hAsyncIOThread);
4905	# endif
4906	Assert(fYield);
4907	}
4908	}
4909
4910	if (fYield)
4911	{
4912	STAM_REL_PROFILE_ADV_START(&s->StatStatusYields, a);
4913	RTThreadYield();
4914	STAM_REL_PROFILE_ADV_STOP(&s->StatStatusYields, a);
4915	}
4916	ASMNopPause();
4917
4918	ataR3LockEnter(pDevIns, pCtl);
4919
4920	val = s->uATARegStatus;
4921	#else /* !IN_RING3 */
4922	/* Cannot yield CPU in raw-mode and ring-0 context. And switching
4923	* to host context for each and every busy status is too costly,
4924	* especially on SMP systems where we don't gain much by
4925	* yielding the CPU to someone else. */
4926	if ((s->cBusyStatusHackRZ++ & s->cBusyStatusHackRZRate) == 1)
4927	{
4928	s->cBusyStatusHackR3 = 0; /* Forces a yield. */
4929	return VINF_IOM_R3_IOPORT_READ;
4930	}
4931	#endif /* !IN_RING3 */
4932	}
4933	else
4934	{
4935	s->cBusyStatusHackRZ = 0;
4936	s->cBusyStatusHackR3 = 0;
4937	}
4938	ataUnsetIRQ(pDevIns, pCtl, s);
4939	break;
4940	}
4941	}
4942	Log2(("%s: LUN#%d addr=%#x val=%#04x\n", __FUNCTION__, s->iLUN, addr, val));
4943	*pu32 = val;
4944	return VINF_SUCCESS;
4945	}
4946
4947
4948	/*
4949	* Read the Alternate status register. Does not affect interrupts.
4950	*/
4951	static uint32_t ataStatusRead(PATACONTROLLER pCtl, uint32_t uIoPortForLog)
4952	{
4953	PATADEVSTATE s = &pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK];
4954	uint32_t val;
4955	RT_NOREF(uIoPortForLog);
4956
4957	Assert(pCtl->aIfs[0].fPresent \|\| pCtl->aIfs[1].fPresent); /* Channel must not be empty. */
4958	if (pCtl->iSelectedIf == 1 && !s->fPresent)
4959	val = 0; /* Device 1 selected, Device 0 responding for it. */
4960	else
4961	val = s->uATARegStatus;
4962	Log2(("%s: LUN#%d read addr=%#x val=%#04x\n", __FUNCTION__, pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK].iLUN, uIoPortForLog, val));
4963	return val;
4964	}
4965
4966	static int ataControlWrite(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, uint32_t val, uint32_t uIoPortForLog)
4967	{
4968	RT_NOREF(uIoPortForLog);
4969	#ifndef IN_RING3
4970	if ((val ^ pCtl->aIfs[0].uATARegDevCtl) & ATA_DEVCTL_RESET)
4971	return VINF_IOM_R3_IOPORT_WRITE; /* The RESET stuff is too complicated for RC+R0. */
4972	#endif /* !IN_RING3 */
4973
4974	Log2(("%s: LUN#%d write addr=%#x val=%#04x\n", __FUNCTION__, pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK].iLUN, uIoPortForLog, val));
4975	/* RESET is common for both drives attached to a controller. */
4976	if ( !(pCtl->aIfs[0].uATARegDevCtl & ATA_DEVCTL_RESET)
4977	&& (val & ATA_DEVCTL_RESET))
4978	{
4979	#ifdef IN_RING3
4980	/* Software RESET low to high */
4981	int32_t uCmdWait0 = -1;
4982	int32_t uCmdWait1 = -1;
4983	uint64_t uNow = RTTimeNanoTS();
4984	if (pCtl->aIfs[0].u64CmdTS)
4985	uCmdWait0 = (uNow - pCtl->aIfs[0].u64CmdTS) / 1000;
4986	if (pCtl->aIfs[1].u64CmdTS)
4987	uCmdWait1 = (uNow - pCtl->aIfs[1].u64CmdTS) / 1000;
4988	LogRel(("PIIX3 ATA: Ctl#%d: RESET, DevSel=%d AIOIf=%d CmdIf0=%#04x (%d usec ago) CmdIf1=%#04x (%d usec ago)\n",
4989	pCtl->iCtl, pCtl->iSelectedIf, pCtl->iAIOIf,
4990	pCtl->aIfs[0].uATARegCommand, uCmdWait0,
4991	pCtl->aIfs[1].uATARegCommand, uCmdWait1));
4992	pCtl->fReset = true;
4993	/* Everything must be done after the reset flag is set, otherwise
4994	* there are unavoidable races with the currently executing request
4995	* (which might just finish in the mean time). */
4996	pCtl->fChainedTransfer = false;
4997	for (uint32_t i = 0; i < RT_ELEMENTS(pCtl->aIfs); i++)
4998	{
4999	ataR3ResetDevice(pDevIns, pCtl, &pCtl->aIfs[i]);
5000	/* The following cannot be done using ataSetStatusValue() since the
5001	* reset flag is already set, which suppresses all status changes. */
5002	pCtl->aIfs[i].uATARegStatus = ATA_STAT_BUSY \| ATA_STAT_SEEK;
5003	Log2(("%s: LUN#%d status %#04x\n", __FUNCTION__, pCtl->aIfs[i].iLUN, pCtl->aIfs[i].uATARegStatus));
5004	pCtl->aIfs[i].uATARegError = 0x01;
5005	}
5006	pCtl->iSelectedIf = 0;
5007	ataR3AsyncIOClearRequests(pDevIns, pCtl);
5008	Log2(("%s: Ctl#%d: message to async I/O thread, resetA\n", __FUNCTION__, pCtl->iCtl));
5009	if (val & ATA_DEVCTL_HOB)
5010	{
5011	val &= ~ATA_DEVCTL_HOB;
5012	Log2(("%s: ignored setting HOB\n", __FUNCTION__));
5013	}
5014
5015	/* Save the timestamp we started the reset. */
5016	pCtl->u64ResetTime = RTTimeMilliTS();
5017
5018	/* Issue the reset request now. */
5019	ataHCAsyncIOPutRequest(pDevIns, pCtl, &g_ataResetARequest);
5020	#else /* !IN_RING3 */
5021	AssertMsgFailed(("RESET handling is too complicated for GC\n"));
5022	#endif /* IN_RING3 */
5023	}
5024	else if ( (pCtl->aIfs[0].uATARegDevCtl & ATA_DEVCTL_RESET)
5025	&& !(val & ATA_DEVCTL_RESET))
5026	{
5027	#ifdef IN_RING3
5028	/* Software RESET high to low */
5029	Log(("%s: deasserting RESET\n", __FUNCTION__));
5030	Log2(("%s: Ctl#%d: message to async I/O thread, resetC\n", __FUNCTION__, pCtl->iCtl));
5031	if (val & ATA_DEVCTL_HOB)
5032	{
5033	val &= ~ATA_DEVCTL_HOB;
5034	Log2(("%s: ignored setting HOB\n", __FUNCTION__));
5035	}
5036	ataHCAsyncIOPutRequest(pDevIns, pCtl, &g_ataResetCRequest);
5037	#else /* !IN_RING3 */
5038	AssertMsgFailed(("RESET handling is too complicated for GC\n"));
5039	#endif /* IN_RING3 */
5040	}
5041
5042	/* Change of interrupt disable flag. Update interrupt line if interrupt
5043	* is pending on the current interface. */
5044	if ( ((val ^ pCtl->aIfs[0].uATARegDevCtl) & ATA_DEVCTL_DISABLE_IRQ)
5045	&& pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK].fIrqPending)
5046	{
5047	if (!(val & ATA_DEVCTL_DISABLE_IRQ))
5048	{
5049	Log2(("%s: LUN#%d asserting IRQ (interrupt disable change)\n", __FUNCTION__, pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK].iLUN));
5050	/* The BMDMA unit unconditionally sets BM_STATUS_INT if the
5051	* interrupt line is asserted. It monitors the line for a rising
5052	* edge. */
5053	pCtl->BmDma.u8Status \|= BM_STATUS_INT;
5054	if (pCtl->irq == 16)
5055	PDMDevHlpPCISetIrq(pDevIns, 0, 1);
5056	else
5057	PDMDevHlpISASetIrq(pDevIns, pCtl->irq, 1);
5058	}
5059	else
5060	{
5061	Log2(("%s: LUN#%d deasserting IRQ (interrupt disable change)\n", __FUNCTION__, pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK].iLUN));
5062	if (pCtl->irq == 16)
5063	PDMDevHlpPCISetIrq(pDevIns, 0, 0);
5064	else
5065	PDMDevHlpISASetIrq(pDevIns, pCtl->irq, 0);
5066	}
5067	}
5068
5069	if (val & ATA_DEVCTL_HOB)
5070	Log2(("%s: set HOB\n", __FUNCTION__));
5071
5072	pCtl->aIfs[0].uATARegDevCtl = val;
5073	pCtl->aIfs[1].uATARegDevCtl = val;
5074
5075	return VINF_SUCCESS;
5076	}
5077
5078	#if defined(IN_RING0) \|\| defined(IN_RING3)
5079
5080	static void ataHCPIOTransfer(PPDMDEVINS pDevIns, PATACONTROLLER pCtl)
5081	{
5082	PATADEVSTATE s;
5083
5084	s = &pCtl->aIfs[pCtl->iAIOIf & ATA_SELECTED_IF_MASK];
5085	Log3(("%s: if=%p\n", __FUNCTION__, s));
5086
5087	if (s->cbTotalTransfer && s->iIOBufferCur > s->iIOBufferEnd)
5088	{
5089	# ifdef IN_RING3
5090	LogRel(("PIIX3 ATA: LUN#%d: %s data in the middle of a PIO transfer - VERY SLOW\n",
5091	s->iLUN, s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE ? "loading" : "storing"));
5092	/* Any guest OS that triggers this case has a pathetic ATA driver.
5093	* In a real system it would block the CPU via IORDY, here we do it
5094	* very similarly by not continuing with the current instruction
5095	* until the transfer to/from the storage medium is completed. */
5096	uint8_t const iSourceSink = s->iSourceSink;
5097	if ( iSourceSink != ATAFN_SS_NULL
5098	&& iSourceSink < RT_ELEMENTS(g_apfnSourceSinkFuncs))
5099	{
5100	bool fRedo;
5101	uint8_t status = s->uATARegStatus;
5102	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATER3);
5103	PATADEVSTATER3 pDevR3 = &RT_SAFE_SUBSCRIPT(RT_SAFE_SUBSCRIPT(pThisCC->aCts, pCtl->iCtl).aIfs, s->iDev);
5104
5105	ataSetStatusValue(pCtl, s, ATA_STAT_BUSY);
5106	Log2(("%s: calling source/sink function\n", __FUNCTION__));
5107	fRedo = g_apfnSourceSinkFuncs[iSourceSink](pDevIns, pCtl, s, pDevR3);
5108	pCtl->fRedo = fRedo;
5109	if (RT_UNLIKELY(fRedo))
5110	return;
5111	ataSetStatusValue(pCtl, s, status);
5112	s->iIOBufferCur = 0;
5113	s->iIOBufferEnd = s->cbElementaryTransfer;
5114	}
5115	else
5116	Assert(iSourceSink == ATAFN_SS_NULL);
5117	# else
5118	AssertReleaseFailed();
5119	# endif
5120	}
5121	if (s->cbTotalTransfer)
5122	{
5123	if (s->fATAPITransfer)
5124	ataHCPIOTransferLimitATAPI(s);
5125
5126	if (s->uTxDir == PDMMEDIATXDIR_TO_DEVICE && s->cbElementaryTransfer > s->cbTotalTransfer)
5127	s->cbElementaryTransfer = s->cbTotalTransfer;
5128
5129	Log2(("%s: %s tx_size=%d elem_tx_size=%d index=%d end=%d\n",
5130	__FUNCTION__, s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE ? "T2I" : "I2T",
5131	s->cbTotalTransfer, s->cbElementaryTransfer,
5132	s->iIOBufferCur, s->iIOBufferEnd));
5133	ataHCPIOTransferStart(pCtl, s, s->iIOBufferCur, s->cbElementaryTransfer);
5134	s->cbTotalTransfer -= s->cbElementaryTransfer;
5135	s->iIOBufferCur += s->cbElementaryTransfer;
5136
5137	if (s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE && s->cbElementaryTransfer > s->cbTotalTransfer)
5138	s->cbElementaryTransfer = s->cbTotalTransfer;
5139	}
5140	else
5141	ataHCPIOTransferStop(pDevIns, pCtl, s);
5142	}
5143
5144
5145	DECLINLINE(void) ataHCPIOTransferFinish(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATADEVSTATE s)
5146	{
5147	/* Do not interfere with RESET processing if the PIO transfer finishes
5148	* while the RESET line is asserted. */
5149	if (pCtl->fReset)
5150	{
5151	Log2(("%s: Ctl#%d: suppressed continuing PIO transfer as RESET is active\n", __FUNCTION__, pCtl->iCtl));
5152	return;
5153	}
5154
5155	if ( s->uTxDir == PDMMEDIATXDIR_TO_DEVICE
5156	\|\| ( s->iSourceSink != ATAFN_SS_NULL
5157	&& s->iIOBufferCur >= s->iIOBufferEnd))
5158	{
5159	/* Need to continue the transfer in the async I/O thread. This is
5160	* the case for write operations or generally for not yet finished
5161	* transfers (some data might need to be read). */
5162	ataSetStatus(pCtl, s, ATA_STAT_BUSY);
5163	ataUnsetStatus(pCtl, s, ATA_STAT_READY \| ATA_STAT_DRQ);
5164
5165	Log2(("%s: Ctl#%d: message to async I/O thread, continuing PIO transfer\n", __FUNCTION__, pCtl->iCtl));
5166	ataHCAsyncIOPutRequest(pDevIns, pCtl, &g_ataPIORequest);
5167	}
5168	else
5169	{
5170	/* Either everything finished (though some data might still be pending)
5171	* or some data is pending before the next read is due. */
5172
5173	/* Continue a previously started transfer. */
5174	ataUnsetStatus(pCtl, s, ATA_STAT_DRQ);
5175	ataSetStatus(pCtl, s, ATA_STAT_READY);
5176
5177	if (s->cbTotalTransfer)
5178	{
5179	/* There is more to transfer, happens usually for large ATAPI
5180	* reads - the protocol limits the chunk size to 65534 bytes. */
5181	ataHCPIOTransfer(pDevIns, pCtl);
5182	ataHCSetIRQ(pDevIns, pCtl, s);
5183	}
5184	else
5185	{
5186	Log2(("%s: Ctl#%d: skipping message to async I/O thread, ending PIO transfer\n", __FUNCTION__, pCtl->iCtl));
5187	/* Finish PIO transfer. */
5188	ataHCPIOTransfer(pDevIns, pCtl);
5189	Assert(!pCtl->fRedo);
5190	}
5191	}
5192	}
5193
5194	#endif /* IN_RING0 \|\| IN_RING3 */
5195
5196	/**
5197	* Fallback for ataCopyPioData124 that handles unaligned and out of bounds cases.
5198	*
5199	* @param pIf The device interface to work with.
5200	* @param pbDst The destination buffer.
5201	* @param pbSrc The source buffer.
5202	* @param offStart The start offset (iIOBufferPIODataStart).
5203	* @param cbCopy The number of bytes to copy, either 1, 2 or 4 bytes.
5204	*/
5205	DECL_NO_INLINE(static, void) ataCopyPioData124Slow(PATADEVSTATE pIf, uint8_t pbDst, const uint8_t pbSrc,
5206	uint32_t offStart, uint32_t cbCopy)
5207	{
5208	uint32_t const offNext = offStart + cbCopy;
5209	uint32_t const cbIOBuffer = RT_MIN(pIf->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE);
5210
5211	if (offStart + cbCopy > cbIOBuffer)
5212	{
5213	Log(("%s: cbCopy=%#x offStart=%#x cbIOBuffer=%#x offNext=%#x (iIOBufferPIODataEnd=%#x)\n",
5214	__FUNCTION__, cbCopy, offStart, cbIOBuffer, offNext, pIf->iIOBufferPIODataEnd));
5215	if (offStart < cbIOBuffer)
5216	cbCopy = cbIOBuffer - offStart;
5217	else
5218	cbCopy = 0;
5219	}
5220
5221	switch (cbCopy)
5222	{
5223	case 4: pbDst[3] = pbSrc[3]; RT_FALL_THRU();
5224	case 3: pbDst[2] = pbSrc[2]; RT_FALL_THRU();
5225	case 2: pbDst[1] = pbSrc[1]; RT_FALL_THRU();
5226	case 1: pbDst[0] = pbSrc[0]; RT_FALL_THRU();
5227	case 0: break;
5228	default: AssertFailed(); /* impossible */
5229	}
5230
5231	pIf->iIOBufferPIODataStart = offNext;
5232
5233	}
5234
5235
5236	/**
5237	* Work for ataDataWrite & ataDataRead that copies data without using memcpy.
5238	*
5239	* This also updates pIf->iIOBufferPIODataStart.
5240	*
5241	* The two buffers are either stack (32-bit aligned) or somewhere within
5242	* pIf->abIOBuffer.
5243	*
5244	* @param pIf The device interface to work with.
5245	* @param pbDst The destination buffer.
5246	* @param pbSrc The source buffer.
5247	* @param offStart The start offset (iIOBufferPIODataStart).
5248	* @param cbCopy The number of bytes to copy, either 1, 2 or 4 bytes.
5249	*/
5250	DECLINLINE(void) ataCopyPioData124(PATADEVSTATE pIf, uint8_t pbDst, const uint8_t pbSrc, uint32_t offStart, uint32_t cbCopy)
5251	{
5252	/*
5253	* Quick bounds checking can be done by checking that the abIOBuffer offset
5254	* (iIOBufferPIODataStart) is aligned at the transfer size (which is ASSUMED
5255	* to be 1, 2 or 4). However, since we're paranoid and don't currently
5256	* trust iIOBufferPIODataEnd to be within bounds, we current check against the
5257	* IO buffer size too.
5258	*/
5259	Assert(cbCopy == 1 \|\| cbCopy == 2 \|\| cbCopy == 4);
5260	if (RT_LIKELY( !(offStart & (cbCopy - 1))
5261	&& offStart + cbCopy <= RT_MIN(pIf->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE)))
5262	{
5263	switch (cbCopy)
5264	{
5265	case 4: (uint32_t )pbDst = (uint32_t const )pbSrc; break;
5266	case 2: (uint16_t )pbDst = (uint16_t const )pbSrc; break;
5267	case 1: pbDst = pbSrc; break;
5268	}
5269	pIf->iIOBufferPIODataStart = offStart + cbCopy;
5270	}
5271	else
5272	ataCopyPioData124Slow(pIf, pbDst, pbSrc, offStart, cbCopy);
5273	}
5274
5275
5276	/**
5277	* @callback_method_impl{FNIOMIOPORTNEWOUT,
5278	* Port I/O Handler for primary port range OUT operations.}
5279	* @note offPort is an absolute port number!
5280	*/
5281	static DECLCALLBACK(VBOXSTRICTRC)
5282	ataIOPortWrite1Data(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
5283	{
5284	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
5285	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (uintptr_t)pvUser);
5286	RT_NOREF(offPort);
5287
5288	Assert((uintptr_t)pvUser < 2);
5289	Assert(offPort == pCtl->IOPortBase1);
5290	Assert(cb == 2 \|\| cb == 4); /* Writes to the data port may be 16-bit or 32-bit. */
5291
5292	VBOXSTRICTRC rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_IOM_R3_IOPORT_WRITE);
5293	if (rc == VINF_SUCCESS)
5294	{
5295	PATADEVSTATE s = &pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK];
5296	uint32_t const iIOBufferPIODataStart = RT_MIN(s->iIOBufferPIODataStart, sizeof(s->abIOBuffer));
5297	uint32_t const iIOBufferPIODataEnd = RT_MIN(s->iIOBufferPIODataEnd, sizeof(s->abIOBuffer));
5298
5299	if (iIOBufferPIODataStart < iIOBufferPIODataEnd)
5300	{
5301	Assert(s->uTxDir == PDMMEDIATXDIR_TO_DEVICE);
5302	uint8_t *pbDst = &s->abIOBuffer[iIOBufferPIODataStart];
5303	uint8_t const pbSrc = (uint8_t const )&u32;
5304
5305	#ifdef IN_RC
5306	/* Raw-mode: The ataHCPIOTransfer following the last transfer unit
5307	requires I/O thread signalling, we must go to ring-3 for that. */
5308	if (iIOBufferPIODataStart + cb < iIOBufferPIODataEnd)
5309	ataCopyPioData124(s, pbDst, pbSrc, iIOBufferPIODataStart, cb);
5310	else
5311	rc = VINF_IOM_R3_IOPORT_WRITE;
5312
5313	#elif defined(IN_RING0)
5314	/* Ring-0: We can do I/O thread signalling here, however for paranoid reasons
5315	triggered by a special case in ataHCPIOTransferFinish, we take extra care here. */
5316	if (iIOBufferPIODataStart + cb < iIOBufferPIODataEnd)
5317	ataCopyPioData124(s, pbDst, pbSrc, iIOBufferPIODataStart, cb);
5318	else if (s->uTxDir == PDMMEDIATXDIR_TO_DEVICE) /* paranoia */
5319	{
5320	ataCopyPioData124(s, pbDst, pbSrc, iIOBufferPIODataStart, cb);
5321	ataHCPIOTransferFinish(pDevIns, pCtl, s);
5322	}
5323	else
5324	{
5325	Log(("%s: Unexpected\n", __FUNCTION__));
5326	rc = VINF_IOM_R3_IOPORT_WRITE;
5327	}
5328
5329	#else /* IN_RING 3*/
5330	ataCopyPioData124(s, pbDst, pbSrc, iIOBufferPIODataStart, cb);
5331	if (s->iIOBufferPIODataStart >= iIOBufferPIODataEnd)
5332	ataHCPIOTransferFinish(pDevIns, pCtl, s);
5333	#endif /* IN_RING 3*/
5334	}
5335	else
5336	Log2(("%s: DUMMY data\n", __FUNCTION__));
5337
5338	Log3(("%s: addr=%#x val=%.*Rhxs rc=%d\n", __FUNCTION__, offPort, cb, &u32, VBOXSTRICTRC_VAL(rc)));
5339	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
5340	}
5341	else
5342	Log3(("%s: addr=%#x -> %d\n", __FUNCTION__, offPort, VBOXSTRICTRC_VAL(rc)));
5343	return rc;
5344	}
5345
5346
5347	/**
5348	* @callback_method_impl{FNIOMIOPORTNEWIN,
5349	* Port I/O Handler for primary port range IN operations.}
5350	* @note offPort is an absolute port number!
5351	*/
5352	static DECLCALLBACK(VBOXSTRICTRC)
5353	ataIOPortRead1Data(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
5354	{
5355	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
5356	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (uintptr_t)pvUser);
5357	RT_NOREF(offPort);
5358
5359	Assert((uintptr_t)pvUser < 2);
5360	Assert(offPort == pCtl->IOPortBase1);
5361
5362	/* Reads from the data register may be 16-bit or 32-bit. Byte accesses are
5363	upgraded to word. */
5364	Assert(cb == 1 \|\| cb == 2 \|\| cb == 4);
5365	uint32_t cbActual = cb != 1 ? cb : 2;
5366	*pu32 = 0;
5367
5368	VBOXSTRICTRC rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_IOM_R3_IOPORT_READ);
5369	if (rc == VINF_SUCCESS)
5370	{
5371	PATADEVSTATE s = &pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK];
5372
5373	if (s->iIOBufferPIODataStart < s->iIOBufferPIODataEnd)
5374	{
5375	AssertMsg(s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE, ("%#x\n", s->uTxDir));
5376	uint32_t const iIOBufferPIODataStart = RT_MIN(s->iIOBufferPIODataStart, sizeof(s->abIOBuffer));
5377	uint32_t const iIOBufferPIODataEnd = RT_MIN(s->iIOBufferPIODataEnd, sizeof(s->abIOBuffer));
5378	uint8_t const *pbSrc = &s->abIOBuffer[iIOBufferPIODataStart];
5379	uint8_t pbDst = (uint8_t )pu32;
5380
5381	#ifdef IN_RC
5382	/* All but the last transfer unit is simple enough for RC, but
5383	* sending a request to the async IO thread is too complicated. */
5384	if (iIOBufferPIODataStart + cbActual < iIOBufferPIODataEnd)
5385	ataCopyPioData124(s, pbDst, pbSrc, iIOBufferPIODataStart, cbActual);
5386	else
5387	rc = VINF_IOM_R3_IOPORT_READ;
5388
5389	#elif defined(IN_RING0)
5390	/* Ring-0: We can do I/O thread signalling here. However there is one
5391	case in ataHCPIOTransfer that does a LogRel and would (but not from
5392	here) call directly into the driver code. We detect that odd case
5393	here cand return to ring-3 to handle it. */
5394	if (iIOBufferPIODataStart + cbActual < iIOBufferPIODataEnd)
5395	ataCopyPioData124(s, pbDst, pbSrc, iIOBufferPIODataStart, cbActual);
5396	else if ( s->cbTotalTransfer == 0
5397	\|\| s->iSourceSink != ATAFN_SS_NULL
5398	\|\| s->iIOBufferCur <= s->iIOBufferEnd)
5399	{
5400	ataCopyPioData124(s, pbDst, pbSrc, iIOBufferPIODataStart, cbActual);
5401	ataHCPIOTransferFinish(pDevIns, pCtl, s);
5402	}
5403	else
5404	{
5405	Log(("%s: Unexpected\n",__FUNCTION__));
5406	rc = VINF_IOM_R3_IOPORT_READ;
5407	}
5408
5409	#else /* IN_RING3 */
5410	ataCopyPioData124(s, pbDst, pbSrc, iIOBufferPIODataStart, cbActual);
5411	if (s->iIOBufferPIODataStart >= iIOBufferPIODataEnd)
5412	ataHCPIOTransferFinish(pDevIns, pCtl, s);
5413	#endif /* IN_RING3 */
5414
5415	/* Just to be on the safe side (caller takes care of this, really). */
5416	if (cb == 1)
5417	*pu32 &= 0xff;
5418	}
5419	else
5420	{
5421	Log2(("%s: DUMMY data\n", __FUNCTION__));
5422	memset(pu32, 0xff, cb);
5423	}
5424	Log3(("%s: addr=%#x val=%.*Rhxs rc=%d\n", __FUNCTION__, offPort, cb, pu32, VBOXSTRICTRC_VAL(rc)));
5425
5426	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
5427	}
5428	else
5429	Log3(("%s: addr=%#x -> %d\n", __FUNCTION__, offPort, VBOXSTRICTRC_VAL(rc)));
5430
5431	return rc;
5432	}
5433
5434
5435	/**
5436	* @callback_method_impl{FNIOMIOPORTNEWINSTRING,
5437	* Port I/O Handler for primary port range IN string operations.}
5438	* @note offPort is an absolute port number!
5439	*/
5440	static DECLCALLBACK(VBOXSTRICTRC)
5441	ataIOPortReadStr1Data(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint8_t pbDst, uint32_t *pcTransfers, unsigned cb)
5442	{
5443	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
5444	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (uintptr_t)pvUser);
5445	RT_NOREF(offPort);
5446
5447	Assert((uintptr_t)pvUser < 2);
5448	Assert(offPort == pCtl->IOPortBase1);
5449	Assert(*pcTransfers > 0);
5450
5451	VBOXSTRICTRC rc;
5452	if (cb == 2 \|\| cb == 4)
5453	{
5454	rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_IOM_R3_IOPORT_READ);
5455	if (rc == VINF_SUCCESS)
5456	{
5457	PATADEVSTATE s = &pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK];
5458
5459	uint32_t const offStart = s->iIOBufferPIODataStart;
5460	uint32_t const offEnd = s->iIOBufferPIODataEnd;
5461	if (offStart < offEnd)
5462	{
5463	/*
5464	* Figure how much we can copy. Usually it's the same as the request.
5465	* The last transfer unit cannot be handled in RC, as it involves
5466	* thread communication. In R0 we let the non-string callback handle it,
5467	* and ditto for overflows/dummy data.
5468	*/
5469	uint32_t cAvailable = (offEnd - offStart) / cb;
5470	#ifndef IN_RING3
5471	if (cAvailable > 0)
5472	cAvailable--;
5473	#endif
5474	uint32_t const cRequested = *pcTransfers;
5475	if (cAvailable > cRequested)
5476	cAvailable = cRequested;
5477	uint32_t const cbTransfer = cAvailable * cb;
5478	uint32_t const offEndThisXfer = offStart + cbTransfer;
5479	if ( offEndThisXfer <= RT_MIN(s->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE)
5480	&& offStart < RT_MIN(s->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE) /* paranoia */
5481	&& cbTransfer > 0)
5482	{
5483	/*
5484	* Do the transfer.
5485	*/
5486	uint8_t const *pbSrc = &s->abIOBuffer[offStart];
5487	memcpy(pbDst, pbSrc, cbTransfer);
5488	Log3(("%s: addr=%#x cb=%#x cbTransfer=%#x val=%.*Rhxd\n", __FUNCTION__, offPort, cb, cbTransfer, cbTransfer, pbSrc));
5489	s->iIOBufferPIODataStart = offEndThisXfer;
5490	#ifdef IN_RING3
5491	if (offEndThisXfer >= offEnd)
5492	ataHCPIOTransferFinish(pDevIns, pCtl, s);
5493	#endif
5494	*pcTransfers = cRequested - cAvailable;
5495	}
5496	else
5497	Log2(("ataIOPortReadStr1Data: DUMMY/Overflow!\n"));
5498	}
5499	else
5500	{
5501	/*
5502	* Dummy read (shouldn't happen) return 0xff like the non-string handler.
5503	*/
5504	Log2(("ataIOPortReadStr1Data: DUMMY data (%#x bytes)\n", pcTransfers cb));
5505	memset(pbDst, 0xff, pcTransfers cb);
5506	*pcTransfers = 0;
5507	}
5508
5509	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
5510	}
5511	}
5512	/*
5513	* Let the non-string I/O callback handle 1 byte reads.
5514	*/
5515	else
5516	{
5517	Log2(("ataIOPortReadStr1Data: 1 byte read (%#x transfers)\n", *pcTransfers));
5518	AssertFailed();
5519	rc = VINF_SUCCESS;
5520	}
5521	return rc;
5522	}
5523
5524
5525	/**
5526	* @callback_method_impl{FNIOMIOPORTNEWOUTSTRING,
5527	* Port I/O Handler for primary port range OUT string operations.}
5528	* @note offPort is an absolute port number!
5529	*/
5530	static DECLCALLBACK(VBOXSTRICTRC)
5531	ataIOPortWriteStr1Data(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint8_t const pbSrc, uint32_t *pcTransfers, unsigned cb)
5532	{
5533	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
5534	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (uintptr_t)pvUser);
5535	RT_NOREF(offPort);
5536
5537	Assert((uintptr_t)pvUser < 2);
5538	Assert(offPort == pCtl->IOPortBase1);
5539	Assert(*pcTransfers > 0);
5540
5541	VBOXSTRICTRC rc;
5542	if (cb == 2 \|\| cb == 4)
5543	{
5544	rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_IOM_R3_IOPORT_WRITE);
5545	if (rc == VINF_SUCCESS)
5546	{
5547	PATADEVSTATE s = &pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK];
5548
5549	uint32_t const offStart = s->iIOBufferPIODataStart;
5550	uint32_t const offEnd = s->iIOBufferPIODataEnd;
5551	Log3Func(("offStart=%#x offEnd=%#x pcTransfers=%d cb=%d\n", offStart, offEnd, pcTransfers, cb));
5552	if (offStart < offEnd)
5553	{
5554	/*
5555	* Figure how much we can copy. Usually it's the same as the request.
5556	* The last transfer unit cannot be handled in RC, as it involves
5557	* thread communication. In R0 we let the non-string callback handle it,
5558	* and ditto for overflows/dummy data.
5559	*/
5560	uint32_t cAvailable = (offEnd - offStart) / cb;
5561	#ifndef IN_RING3
5562	if (cAvailable)
5563	cAvailable--;
5564	#endif
5565	uint32_t const cRequested = *pcTransfers;
5566	if (cAvailable > cRequested)
5567	cAvailable = cRequested;
5568	uint32_t const cbTransfer = cAvailable * cb;
5569	uint32_t const offEndThisXfer = offStart + cbTransfer;
5570	if ( offEndThisXfer <= RT_MIN(s->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE)
5571	&& offStart < RT_MIN(s->cbIOBuffer, ATA_MAX_IO_BUFFER_SIZE) /* paranoia */
5572	&& cbTransfer > 0)
5573	{
5574	/*
5575	* Do the transfer.
5576	*/
5577	void *pvDst = &s->abIOBuffer[offStart];
5578	memcpy(pvDst, pbSrc, cbTransfer);
5579	Log3(("%s: addr=%#x val=%.*Rhxs\n", __FUNCTION__, offPort, cbTransfer, pvDst));
5580	s->iIOBufferPIODataStart = offEndThisXfer;
5581	#ifdef IN_RING3
5582	if (offEndThisXfer >= offEnd)
5583	ataHCPIOTransferFinish(pDevIns, pCtl, s);
5584	#endif
5585	*pcTransfers = cRequested - cAvailable;
5586	}
5587	else
5588	Log2(("ataIOPortWriteStr1Data: DUMMY/Overflow!\n"));
5589	}
5590	else
5591	{
5592	Log2(("ataIOPortWriteStr1Data: DUMMY data (%#x bytes)\n", pcTransfers cb));
5593	*pcTransfers = 0;
5594	}
5595
5596	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
5597	}
5598	}
5599	/*
5600	* Let the non-string I/O callback handle 1 byte reads.
5601	*/
5602	else
5603	{
5604	Log2(("ataIOPortWriteStr1Data: 1 byte write (%#x transfers)\n", *pcTransfers));
5605	AssertFailed();
5606	rc = VINF_SUCCESS;
5607	}
5608
5609	return rc;
5610	}
5611
5612
5613	#ifdef IN_RING3
5614
5615	static void ataR3DMATransferStop(PATADEVSTATE s)
5616	{
5617	s->cbTotalTransfer = 0;
5618	s->cbElementaryTransfer = 0;
5619	s->iBeginTransfer = ATAFN_BT_NULL;
5620	s->iSourceSink = ATAFN_SS_NULL;
5621	}
5622
5623
5624	/**
5625	* Perform the entire DMA transfer in one go (unless a source/sink operation
5626	* has to be redone or a RESET comes in between). Unlike the PIO counterpart
5627	* this function cannot handle empty transfers.
5628	*
5629	* @param pDevIns The device instance.
5630	* @param pCtl Controller for which to perform the transfer, shared bits.
5631	* @param pCtlR3 The ring-3 controller state.
5632	*/
5633	static void ataR3DMATransfer(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATACONTROLLERR3 pCtlR3)
5634	{
5635	uint8_t const iAIOIf = pCtl->iAIOIf & ATA_SELECTED_IF_MASK;
5636	PATADEVSTATE s = &pCtl->aIfs[iAIOIf];
5637	PATADEVSTATER3 pDevR3 = &pCtlR3->aIfs[iAIOIf];
5638	bool fRedo;
5639	RTGCPHYS32 GCPhysDesc;
5640	uint32_t cbTotalTransfer, cbElementaryTransfer;
5641	uint32_t iIOBufferCur, iIOBufferEnd;
5642	PDMMEDIATXDIR uTxDir;
5643	bool fLastDesc = false;
5644
5645	Assert(sizeof(BMDMADesc) == 8);
5646
5647	fRedo = pCtl->fRedo;
5648	if (RT_LIKELY(!fRedo))
5649	Assert(s->cbTotalTransfer);
5650	uTxDir = (PDMMEDIATXDIR)s->uTxDir;
5651	cbTotalTransfer = s->cbTotalTransfer;
5652	cbElementaryTransfer = RT_MIN(s->cbElementaryTransfer, sizeof(s->abIOBuffer));
5653	iIOBufferEnd = RT_MIN(s->iIOBufferEnd, sizeof(s->abIOBuffer));
5654	iIOBufferCur = RT_MIN(RT_MIN(s->iIOBufferCur, sizeof(s->abIOBuffer)), iIOBufferEnd);
5655
5656	/* The DMA loop is designed to hold the lock only when absolutely
5657	* necessary. This avoids long freezes should the guest access the
5658	* ATA registers etc. for some reason. */
5659	ataR3LockLeave(pDevIns, pCtl);
5660
5661	Log2(("%s: %s tx_size=%d elem_tx_size=%d index=%d end=%d\n",
5662	__FUNCTION__, uTxDir == PDMMEDIATXDIR_FROM_DEVICE ? "T2I" : "I2T",
5663	cbTotalTransfer, cbElementaryTransfer,
5664	iIOBufferCur, iIOBufferEnd));
5665	for (GCPhysDesc = pCtl->GCPhysFirstDMADesc;
5666	GCPhysDesc <= pCtl->GCPhysLastDMADesc;
5667	GCPhysDesc += sizeof(BMDMADesc))
5668	{
5669	BMDMADesc DMADesc;
5670	RTGCPHYS32 GCPhysBuffer;
5671	uint32_t cbBuffer;
5672
5673	if (RT_UNLIKELY(fRedo))
5674	{
5675	GCPhysBuffer = pCtl->GCPhysRedoDMABuffer;
5676	cbBuffer = pCtl->cbRedoDMABuffer;
5677	fLastDesc = pCtl->fRedoDMALastDesc;
5678	DMADesc.GCPhysBuffer = DMADesc.cbBuffer = 0; /* Shut up MSC. */
5679	}
5680	else
5681	{
5682	PDMDevHlpPCIPhysReadMeta(pDevIns, GCPhysDesc, &DMADesc, sizeof(BMDMADesc));
5683	GCPhysBuffer = RT_LE2H_U32(DMADesc.GCPhysBuffer);
5684	cbBuffer = RT_LE2H_U32(DMADesc.cbBuffer);
5685	fLastDesc = RT_BOOL(cbBuffer & UINT32_C(0x80000000));
5686	cbBuffer &= 0xfffe;
5687	if (cbBuffer == 0)
5688	cbBuffer = 0x10000;
5689	if (cbBuffer > cbTotalTransfer)
5690	cbBuffer = cbTotalTransfer;
5691	}
5692
5693	while (RT_UNLIKELY(fRedo) \|\| (cbBuffer && cbTotalTransfer))
5694	{
5695	if (RT_LIKELY(!fRedo))
5696	{
5697	uint32_t cbXfer = RT_MIN(RT_MIN(cbBuffer, iIOBufferEnd - iIOBufferCur),
5698	sizeof(s->abIOBuffer) - RT_MIN(iIOBufferCur, sizeof(s->abIOBuffer)));
5699	Log2(("%s: DMA desc %#010x: addr=%#010x size=%#010x orig_size=%#010x\n", __FUNCTION__,
5700	(int)GCPhysDesc, GCPhysBuffer, cbBuffer, RT_LE2H_U32(DMADesc.cbBuffer) & 0xfffe));
5701
5702	if (uTxDir == PDMMEDIATXDIR_FROM_DEVICE)
5703	PDMDevHlpPCIPhysWriteUser(pDevIns, GCPhysBuffer, &s->abIOBuffer[iIOBufferCur], cbXfer);
5704	else
5705	PDMDevHlpPCIPhysReadUser(pDevIns, GCPhysBuffer, &s->abIOBuffer[iIOBufferCur], cbXfer);
5706
5707	iIOBufferCur += cbXfer;
5708	cbTotalTransfer -= cbXfer;
5709	cbBuffer -= cbXfer;
5710	GCPhysBuffer += cbXfer;
5711	}
5712	if ( iIOBufferCur == iIOBufferEnd
5713	&& (uTxDir == PDMMEDIATXDIR_TO_DEVICE \|\| cbTotalTransfer))
5714	{
5715	if (uTxDir == PDMMEDIATXDIR_FROM_DEVICE && cbElementaryTransfer > cbTotalTransfer)
5716	cbElementaryTransfer = cbTotalTransfer;
5717
5718	ataR3LockEnter(pDevIns, pCtl);
5719
5720	/* The RESET handler could have cleared the DMA transfer
5721	* state (since we didn't hold the lock until just now
5722	* the guest can continue in parallel). If so, the state
5723	* is already set up so the loop is exited immediately. */
5724	uint8_t const iSourceSink = s->iSourceSink;
5725	if ( iSourceSink != ATAFN_SS_NULL
5726	&& iSourceSink < RT_ELEMENTS(g_apfnSourceSinkFuncs))
5727	{
5728	s->iIOBufferCur = iIOBufferCur;
5729	s->iIOBufferEnd = iIOBufferEnd;
5730	s->cbElementaryTransfer = cbElementaryTransfer;
5731	s->cbTotalTransfer = cbTotalTransfer;
5732	Log2(("%s: calling source/sink function\n", __FUNCTION__));
5733	fRedo = g_apfnSourceSinkFuncs[iSourceSink](pDevIns, pCtl, s, pDevR3);
5734	if (RT_UNLIKELY(fRedo))
5735	{
5736	pCtl->GCPhysFirstDMADesc = GCPhysDesc;
5737	pCtl->GCPhysRedoDMABuffer = GCPhysBuffer;
5738	pCtl->cbRedoDMABuffer = cbBuffer;
5739	pCtl->fRedoDMALastDesc = fLastDesc;
5740	}
5741	else
5742	{
5743	cbTotalTransfer = s->cbTotalTransfer;
5744	cbElementaryTransfer = s->cbElementaryTransfer;
5745
5746	if (uTxDir == PDMMEDIATXDIR_TO_DEVICE && cbElementaryTransfer > cbTotalTransfer)
5747	cbElementaryTransfer = cbTotalTransfer;
5748	iIOBufferCur = 0;
5749	iIOBufferEnd = RT_MIN(cbElementaryTransfer, sizeof(s->abIOBuffer));
5750	}
5751	pCtl->fRedo = fRedo;
5752	}
5753	else
5754	{
5755	/* This forces the loop to exit immediately. */
5756	Assert(iSourceSink == ATAFN_SS_NULL);
5757	GCPhysDesc = pCtl->GCPhysLastDMADesc + 1;
5758	}
5759
5760	ataR3LockLeave(pDevIns, pCtl);
5761	if (RT_UNLIKELY(fRedo))
5762	break;
5763	}
5764	}
5765
5766	if (RT_UNLIKELY(fRedo))
5767	break;
5768
5769	/* end of transfer */
5770	if (!cbTotalTransfer \|\| fLastDesc)
5771	break;
5772
5773	ataR3LockEnter(pDevIns, pCtl);
5774
5775	if (!(pCtl->BmDma.u8Cmd & BM_CMD_START) \|\| pCtl->fReset)
5776	{
5777	LogRel(("PIIX3 ATA: Ctl#%d: ABORT DMA%s\n", pCtl->iCtl, pCtl->fReset ? " due to RESET" : ""));
5778	if (!pCtl->fReset)
5779	ataR3DMATransferStop(s);
5780	/* This forces the loop to exit immediately. */
5781	GCPhysDesc = pCtl->GCPhysLastDMADesc + 1;
5782	}
5783
5784	ataR3LockLeave(pDevIns, pCtl);
5785	}
5786
5787	ataR3LockEnter(pDevIns, pCtl);
5788	if (RT_UNLIKELY(fRedo))
5789	return;
5790
5791	if (fLastDesc)
5792	pCtl->BmDma.u8Status &= ~BM_STATUS_DMAING;
5793	s->cbTotalTransfer = cbTotalTransfer;
5794	s->cbElementaryTransfer = cbElementaryTransfer;
5795	s->iIOBufferCur = iIOBufferCur;
5796	s->iIOBufferEnd = iIOBufferEnd;
5797	}
5798
5799	/**
5800	* Signal PDM that we're idle (if we actually are).
5801	*
5802	* @param pDevIns The device instance.
5803	* @param pCtl The shared controller state.
5804	* @param pCtlR3 The ring-3 controller state.
5805	*/
5806	static void ataR3AsyncSignalIdle(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, PATACONTROLLERR3 pCtlR3)
5807	{
5808	/*
5809	* Take the lock here and recheck the idle indicator to avoid
5810	* unnecessary work and racing ataR3WaitForAsyncIOIsIdle.
5811	*/
5812	int rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->AsyncIORequestLock, VINF_SUCCESS);
5813	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pCtl->AsyncIORequestLock, rc);
5814
5815	if ( pCtlR3->fSignalIdle
5816	&& ataR3AsyncIOIsIdle(pDevIns, pCtl, false /fStrict/))
5817	{
5818	PDMDevHlpAsyncNotificationCompleted(pDevIns);
5819	RTThreadUserSignal(pCtlR3->hAsyncIOThread); /* for ataR3Construct/ataR3ResetCommon. */
5820	}
5821
5822	rc = PDMDevHlpCritSectLeave(pDevIns, &pCtl->AsyncIORequestLock);
5823	AssertRC(rc);
5824	}
5825
5826	/**
5827	* Async I/O thread for an interface.
5828	*
5829	* Once upon a time this was readable code with several loops and a different
5830	* semaphore for each purpose. But then came the "how can one save the state in
5831	* the middle of a PIO transfer" question. The solution was to use an ASM,
5832	* which is what's there now.
5833	*/
5834	static DECLCALLBACK(int) ataR3AsyncIOThread(RTTHREAD hThreadSelf, void *pvUser)
5835	{
5836	PATACONTROLLERR3 const pCtlR3 = (PATACONTROLLERR3)pvUser;
5837	PPDMDEVINSR3 const pDevIns = pCtlR3->pDevIns;
5838	PATASTATE const pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
5839	PATASTATER3 const pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATER3);
5840	uintptr_t const iCtl = pCtlR3 - &pThisCC->aCts[0];
5841	PATACONTROLLER const pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, iCtl);
5842	int rc = VINF_SUCCESS;
5843	uint64_t u64TS = 0; /* shut up gcc */
5844	uint64_t uWait;
5845	const ATARequest *pReq;
5846	RT_NOREF(hThreadSelf);
5847	Assert(pCtl->iCtl == pCtlR3->iCtl);
5848
5849	pReq = NULL;
5850	pCtl->fChainedTransfer = false;
5851	while (!pCtlR3->fShutdown)
5852	{
5853	/* Keep this thread from doing anything as long as EMT is suspended. */
5854	while (pCtl->fRedoIdle)
5855	{
5856	if (pCtlR3->fSignalIdle)
5857	ataR3AsyncSignalIdle(pDevIns, pCtl, pCtlR3);
5858	rc = RTSemEventWait(pCtlR3->hSuspendIOSem, RT_INDEFINITE_WAIT);
5859	/* Continue if we got a signal by RTThreadPoke().
5860	* We will get notified if there is a request to process.
5861	*/
5862	if (RT_UNLIKELY(rc == VERR_INTERRUPTED))
5863	continue;
5864	if (RT_FAILURE(rc) \|\| pCtlR3->fShutdown)
5865	break;
5866
5867	pCtl->fRedoIdle = false;
5868	}
5869
5870	/* Wait for work. */
5871	while (pReq == NULL)
5872	{
5873	if (pCtlR3->fSignalIdle)
5874	ataR3AsyncSignalIdle(pDevIns, pCtl, pCtlR3);
5875	rc = PDMDevHlpSUPSemEventWaitNoResume(pDevIns, pCtl->hAsyncIOSem, RT_INDEFINITE_WAIT);
5876	/* Continue if we got a signal by RTThreadPoke().
5877	* We will get notified if there is a request to process.
5878	*/
5879	if (RT_UNLIKELY(rc == VERR_INTERRUPTED))
5880	continue;
5881	if (RT_FAILURE(rc) \|\| RT_UNLIKELY(pCtlR3->fShutdown))
5882	break;
5883
5884	pReq = ataR3AsyncIOGetCurrentRequest(pDevIns, pCtl);
5885	}
5886
5887	if (RT_FAILURE(rc) \|\| pCtlR3->fShutdown)
5888	break;
5889
5890	if (pReq == NULL)
5891	continue;
5892
5893	ATAAIO ReqType = pReq->ReqType;
5894
5895	Log2(("%s: Ctl#%d: state=%d, req=%d\n", __FUNCTION__, pCtl->iCtl, pCtl->uAsyncIOState, ReqType));
5896	if (pCtl->uAsyncIOState != ReqType)
5897	{
5898	/* The new state is not the state that was expected by the normal
5899	* state changes. This is either a RESET/ABORT or there's something
5900	* really strange going on. */
5901	if ( (pCtl->uAsyncIOState == ATA_AIO_PIO \|\| pCtl->uAsyncIOState == ATA_AIO_DMA)
5902	&& (ReqType == ATA_AIO_PIO \|\| ReqType == ATA_AIO_DMA))
5903	{
5904	/* Incorrect sequence of PIO/DMA states. Dump request queue. */
5905	ataR3AsyncIODumpRequests(pDevIns, pCtl);
5906	}
5907	AssertReleaseMsg( ReqType == ATA_AIO_RESET_ASSERTED
5908	\|\| ReqType == ATA_AIO_RESET_CLEARED
5909	\|\| ReqType == ATA_AIO_ABORT
5910	\|\| pCtl->uAsyncIOState == ReqType,
5911	("I/O state inconsistent: state=%d request=%d\n", pCtl->uAsyncIOState, ReqType));
5912	}
5913
5914	/* Do our work. */
5915	ataR3LockEnter(pDevIns, pCtl);
5916
5917	if (pCtl->uAsyncIOState == ATA_AIO_NEW && !pCtl->fChainedTransfer)
5918	{
5919	u64TS = RTTimeNanoTS();
5920	#if defined(DEBUG) \|\| defined(VBOX_WITH_STATISTICS)
5921	STAM_PROFILE_ADV_START(&pCtl->StatAsyncTime, a);
5922	#endif
5923	}
5924
5925	switch (ReqType)
5926	{
5927	case ATA_AIO_NEW:
5928	{
5929	uint8_t const iIf = pReq->u.t.iIf & ATA_SELECTED_IF_MASK;
5930	pCtl->iAIOIf = iIf;
5931	PATADEVSTATE s = &pCtl->aIfs[iIf];
5932	PATADEVSTATER3 pDevR3 = &pCtlR3->aIfs[iIf];
5933
5934	s->cbTotalTransfer = pReq->u.t.cbTotalTransfer;
5935	s->uTxDir = pReq->u.t.uTxDir;
5936	s->iBeginTransfer = pReq->u.t.iBeginTransfer;
5937	s->iSourceSink = pReq->u.t.iSourceSink;
5938	s->iIOBufferEnd = 0;
5939	s->u64CmdTS = u64TS;
5940
5941	if (s->fATAPI)
5942	{
5943	if (pCtl->fChainedTransfer)
5944	{
5945	/* Only count the actual transfers, not the PIO
5946	* transfer of the ATAPI command bytes. */
5947	if (s->fDMA)
5948	STAM_REL_COUNTER_INC(&s->StatATAPIDMA);
5949	else
5950	STAM_REL_COUNTER_INC(&s->StatATAPIPIO);
5951	}
5952	}
5953	else
5954	{
5955	if (s->fDMA)
5956	STAM_REL_COUNTER_INC(&s->StatATADMA);
5957	else
5958	STAM_REL_COUNTER_INC(&s->StatATAPIO);
5959	}
5960
5961	pCtl->fChainedTransfer = false;
5962
5963	uint8_t const iBeginTransfer = s->iBeginTransfer;
5964	if ( iBeginTransfer != ATAFN_BT_NULL
5965	&& iBeginTransfer < RT_ELEMENTS(g_apfnBeginTransFuncs))
5966	{
5967	Log2(("%s: Ctl#%d: calling begin transfer function\n", __FUNCTION__, pCtl->iCtl));
5968	g_apfnBeginTransFuncs[iBeginTransfer](pCtl, s);
5969	s->iBeginTransfer = ATAFN_BT_NULL;
5970	if (s->uTxDir != PDMMEDIATXDIR_FROM_DEVICE)
5971	s->iIOBufferEnd = s->cbElementaryTransfer;
5972	}
5973	else
5974	{
5975	Assert(iBeginTransfer == ATAFN_BT_NULL);
5976	s->cbElementaryTransfer = s->cbTotalTransfer;
5977	s->iIOBufferEnd = s->cbTotalTransfer;
5978	}
5979	s->iIOBufferCur = 0;
5980
5981	if (s->uTxDir != PDMMEDIATXDIR_TO_DEVICE)
5982	{
5983	uint8_t const iSourceSink = s->iSourceSink;
5984	if ( iSourceSink != ATAFN_SS_NULL
5985	&& iSourceSink < RT_ELEMENTS(g_apfnSourceSinkFuncs))
5986	{
5987	bool fRedo;
5988	Log2(("%s: Ctl#%d: calling source/sink function\n", __FUNCTION__, pCtl->iCtl));
5989	fRedo = g_apfnSourceSinkFuncs[iSourceSink](pDevIns, pCtl, s, pDevR3);
5990	pCtl->fRedo = fRedo;
5991	if (RT_UNLIKELY(fRedo && !pCtl->fReset))
5992	{
5993	/* Operation failed at the initial transfer, restart
5994	* everything from scratch by resending the current
5995	* request. Occurs very rarely, not worth optimizing. */
5996	LogRel(("%s: Ctl#%d: redo entire operation\n", __FUNCTION__, pCtl->iCtl));
5997	ataHCAsyncIOPutRequest(pDevIns, pCtl, pReq);
5998	break;
5999	}
6000	}
6001	else
6002	{
6003	Assert(iSourceSink == ATAFN_SS_NULL);
6004	ataR3CmdOK(pCtl, s, ATA_STAT_SEEK);
6005	}
6006	s->iIOBufferEnd = s->cbElementaryTransfer;
6007
6008	}
6009
6010	/* Do not go into the transfer phase if RESET is asserted.
6011	* The CritSect is released while waiting for the host OS
6012	* to finish the I/O, thus RESET is possible here. Most
6013	* important: do not change uAsyncIOState. */
6014	if (pCtl->fReset)
6015	break;
6016
6017	if (s->fDMA)
6018	{
6019	if (s->cbTotalTransfer)
6020	{
6021	ataSetStatus(pCtl, s, ATA_STAT_DRQ);
6022
6023	pCtl->uAsyncIOState = ATA_AIO_DMA;
6024	/* If BMDMA is already started, do the transfer now. */
6025	if (pCtl->BmDma.u8Cmd & BM_CMD_START)
6026	{
6027	Log2(("%s: Ctl#%d: message to async I/O thread, continuing DMA transfer immediately\n", __FUNCTION__, pCtl->iCtl));
6028	ataHCAsyncIOPutRequest(pDevIns, pCtl, &g_ataDMARequest);
6029	}
6030	}
6031	else
6032	{
6033	Assert(s->uTxDir == PDMMEDIATXDIR_NONE); /* Any transfer which has an initial transfer size of 0 must be marked as such. */
6034	/* Finish DMA transfer. */
6035	ataR3DMATransferStop(s);
6036	ataHCSetIRQ(pDevIns, pCtl, s);
6037	pCtl->uAsyncIOState = ATA_AIO_NEW;
6038	}
6039	}
6040	else
6041	{
6042	if (s->cbTotalTransfer)
6043	{
6044	ataHCPIOTransfer(pDevIns, pCtl);
6045	Assert(!pCtl->fRedo);
6046	if (s->fATAPITransfer \|\| s->uTxDir != PDMMEDIATXDIR_TO_DEVICE)
6047	ataHCSetIRQ(pDevIns, pCtl, s);
6048
6049	if (s->uTxDir == PDMMEDIATXDIR_TO_DEVICE \|\| s->iSourceSink != ATAFN_SS_NULL)
6050	{
6051	/* Write operations and not yet finished transfers
6052	* must be completed in the async I/O thread. */
6053	pCtl->uAsyncIOState = ATA_AIO_PIO;
6054	}
6055	else
6056	{
6057	/* Finished read operation can be handled inline
6058	* in the end of PIO transfer handling code. Linux
6059	* depends on this, as it waits only briefly for
6060	* devices to become ready after incoming data
6061	* transfer. Cannot find anything in the ATA spec
6062	* that backs this assumption, but as all kernels
6063	* are affected (though most of the time it does
6064	* not cause any harm) this must work. */
6065	pCtl->uAsyncIOState = ATA_AIO_NEW;
6066	}
6067	}
6068	else
6069	{
6070	Assert(s->uTxDir == PDMMEDIATXDIR_NONE); /* Any transfer which has an initial transfer size of 0 must be marked as such. */
6071	/* Finish PIO transfer. */
6072	ataHCPIOTransfer(pDevIns, pCtl);
6073	Assert(!pCtl->fRedo);
6074	if (!s->fATAPITransfer)
6075	ataHCSetIRQ(pDevIns, pCtl, s);
6076	pCtl->uAsyncIOState = ATA_AIO_NEW;
6077	}
6078	}
6079	break;
6080	}
6081
6082	case ATA_AIO_DMA:
6083	{
6084	BMDMAState *bm = &pCtl->BmDma;
6085	PATADEVSTATE s = &pCtl->aIfs[pCtl->iAIOIf & ATA_SELECTED_IF_MASK];
6086	ATAFNSS iOriginalSourceSink = (ATAFNSS)s->iSourceSink; /* Used by the hack below, but gets reset by then. */
6087
6088	if (s->uTxDir == PDMMEDIATXDIR_FROM_DEVICE)
6089	AssertRelease(bm->u8Cmd & BM_CMD_WRITE);
6090	else
6091	AssertRelease(!(bm->u8Cmd & BM_CMD_WRITE));
6092
6093	if (RT_LIKELY(!pCtl->fRedo))
6094	{
6095	/* The specs say that the descriptor table must not cross a
6096	* 4K boundary. */
6097	pCtl->GCPhysFirstDMADesc = bm->GCPhysAddr;
6098	pCtl->GCPhysLastDMADesc = RT_ALIGN_32(bm->GCPhysAddr + 1, _4K) - sizeof(BMDMADesc);
6099	}
6100	ataR3DMATransfer(pDevIns, pCtl, pCtlR3);
6101
6102	if (RT_UNLIKELY(pCtl->fRedo && !pCtl->fReset))
6103	{
6104	LogRel(("PIIX3 ATA: Ctl#%d: redo DMA operation\n", pCtl->iCtl));
6105	ataHCAsyncIOPutRequest(pDevIns, pCtl, &g_ataDMARequest);
6106	break;
6107	}
6108
6109	/* The infamous delay IRQ hack. */
6110	if ( iOriginalSourceSink == ATAFN_SS_WRITE_SECTORS
6111	&& s->cbTotalTransfer == 0
6112	&& pCtl->msDelayIRQ)
6113	{
6114	/* Delay IRQ for writing. Required to get the Win2K
6115	* installation work reliably (otherwise it crashes,
6116	* usually during component install). So far no better
6117	* solution has been found. */
6118	Log(("%s: delay IRQ hack\n", __FUNCTION__));
6119	ataR3LockLeave(pDevIns, pCtl);
6120	RTThreadSleep(pCtl->msDelayIRQ);
6121	ataR3LockEnter(pDevIns, pCtl);
6122	}
6123
6124	ataUnsetStatus(pCtl, s, ATA_STAT_DRQ);
6125	Assert(!pCtl->fChainedTransfer);
6126	Assert(s->iSourceSink == ATAFN_SS_NULL);
6127	if (s->fATAPITransfer)
6128	{
6129	s->uATARegNSector = (s->uATARegNSector & ~7) \| ATAPI_INT_REASON_IO \| ATAPI_INT_REASON_CD;
6130	Log2(("%s: Ctl#%d: interrupt reason %#04x\n", __FUNCTION__, pCtl->iCtl, s->uATARegNSector));
6131	s->fATAPITransfer = false;
6132	}
6133	ataHCSetIRQ(pDevIns, pCtl, s);
6134	pCtl->uAsyncIOState = ATA_AIO_NEW;
6135	break;
6136	}
6137
6138	case ATA_AIO_PIO:
6139	{
6140	uint8_t const iIf = pCtl->iAIOIf & ATA_SELECTED_IF_MASK;
6141	pCtl->iAIOIf = iIf;
6142	PATADEVSTATE s = &pCtl->aIfs[iIf];
6143	PATADEVSTATER3 pDevR3 = &pCtlR3->aIfs[iIf];
6144
6145	uint8_t const iSourceSink = s->iSourceSink;
6146	if ( iSourceSink != ATAFN_SS_NULL
6147	&& iSourceSink < RT_ELEMENTS(g_apfnSourceSinkFuncs))
6148	{
6149	bool fRedo;
6150	Log2(("%s: Ctl#%d: calling source/sink function\n", __FUNCTION__, pCtl->iCtl));
6151	fRedo = g_apfnSourceSinkFuncs[iSourceSink](pDevIns, pCtl, s, pDevR3);
6152	pCtl->fRedo = fRedo;
6153	if (RT_UNLIKELY(fRedo && !pCtl->fReset))
6154	{
6155	LogRel(("PIIX3 ATA: Ctl#%d: redo PIO operation\n", pCtl->iCtl));
6156	ataHCAsyncIOPutRequest(pDevIns, pCtl, &g_ataPIORequest);
6157	break;
6158	}
6159	s->iIOBufferCur = 0;
6160	s->iIOBufferEnd = s->cbElementaryTransfer;
6161	}
6162	else
6163	{
6164	/* Continue a previously started transfer. */
6165	Assert(iSourceSink == ATAFN_SS_NULL);
6166	ataUnsetStatus(pCtl, s, ATA_STAT_BUSY);
6167	ataSetStatus(pCtl, s, ATA_STAT_READY);
6168	}
6169
6170	/* It is possible that the drives on this controller get RESET
6171	* during the above call to the source/sink function. If that's
6172	* the case, don't restart the transfer and don't finish it the
6173	* usual way. RESET handling took care of all that already.
6174	* Most important: do not change uAsyncIOState. */
6175	if (pCtl->fReset)
6176	break;
6177
6178	if (s->cbTotalTransfer)
6179	{
6180	ataHCPIOTransfer(pDevIns, pCtl);
6181	ataHCSetIRQ(pDevIns, pCtl, s);
6182
6183	if (s->uTxDir == PDMMEDIATXDIR_TO_DEVICE \|\| s->iSourceSink != ATAFN_SS_NULL)
6184	{
6185	/* Write operations and not yet finished transfers
6186	* must be completed in the async I/O thread. */
6187	pCtl->uAsyncIOState = ATA_AIO_PIO;
6188	}
6189	else
6190	{
6191	/* Finished read operation can be handled inline
6192	* in the end of PIO transfer handling code. Linux
6193	* depends on this, as it waits only briefly for
6194	* devices to become ready after incoming data
6195	* transfer. Cannot find anything in the ATA spec
6196	* that backs this assumption, but as all kernels
6197	* are affected (though most of the time it does
6198	* not cause any harm) this must work. */
6199	pCtl->uAsyncIOState = ATA_AIO_NEW;
6200	}
6201	}
6202	else
6203	{
6204	/* The infamous delay IRQ hack. */
6205	if (RT_UNLIKELY(pCtl->msDelayIRQ))
6206	{
6207	/* Various antique guests have buggy disk drivers silently
6208	* assuming that disk operations take a relatively long time.
6209	* Work around such bugs by holding off interrupts a bit.
6210	*/
6211	Log(("%s: delay IRQ hack (PIO)\n", __FUNCTION__));
6212	ataR3LockLeave(pDevIns, pCtl);
6213	RTThreadSleep(pCtl->msDelayIRQ);
6214	ataR3LockEnter(pDevIns, pCtl);
6215	}
6216
6217	/* Finish PIO transfer. */
6218	ataHCPIOTransfer(pDevIns, pCtl);
6219	if ( !pCtl->fChainedTransfer
6220	&& !s->fATAPITransfer
6221	&& s->uTxDir != PDMMEDIATXDIR_FROM_DEVICE)
6222	{
6223	ataHCSetIRQ(pDevIns, pCtl, s);
6224	}
6225	pCtl->uAsyncIOState = ATA_AIO_NEW;
6226	}
6227	break;
6228	}
6229
6230	case ATA_AIO_RESET_ASSERTED:
6231	pCtl->uAsyncIOState = ATA_AIO_RESET_CLEARED;
6232	ataHCPIOTransferStop(pDevIns, pCtl, &pCtl->aIfs[0]);
6233	ataHCPIOTransferStop(pDevIns, pCtl, &pCtl->aIfs[1]);
6234	/* Do not change the DMA registers, they are not affected by the
6235	* ATA controller reset logic. It should be sufficient to issue a
6236	* new command, which is now possible as the state is cleared. */
6237	break;
6238
6239	case ATA_AIO_RESET_CLEARED:
6240	pCtl->uAsyncIOState = ATA_AIO_NEW;
6241	pCtl->fReset = false;
6242	/* Ensure that half-completed transfers are not redone. A reset
6243	* cancels the entire transfer, so continuing is wrong. */
6244	pCtl->fRedo = false;
6245	pCtl->fRedoDMALastDesc = false;
6246	LogRel(("PIIX3 ATA: Ctl#%d: finished processing RESET\n", pCtl->iCtl));
6247	for (uint32_t i = 0; i < RT_ELEMENTS(pCtl->aIfs); i++)
6248	{
6249	ataR3SetSignature(&pCtl->aIfs[i]);
6250	if (pCtl->aIfs[i].fATAPI)
6251	ataSetStatusValue(pCtl, &pCtl->aIfs[i], 0); /* NOTE: READY is _not_ set */
6252	else
6253	ataSetStatusValue(pCtl, &pCtl->aIfs[i], ATA_STAT_READY \| ATA_STAT_SEEK);
6254	}
6255	break;
6256
6257	case ATA_AIO_ABORT:
6258	{
6259	/* Abort the current command no matter what. There cannot be
6260	* any command activity on the other drive otherwise using
6261	* one thread per controller wouldn't work at all. */
6262	PATADEVSTATE s = &pCtl->aIfs[pReq->u.a.iIf & ATA_SELECTED_IF_MASK];
6263
6264	pCtl->uAsyncIOState = ATA_AIO_NEW;
6265	/* Do not change the DMA registers, they are not affected by the
6266	* ATA controller reset logic. It should be sufficient to issue a
6267	* new command, which is now possible as the state is cleared. */
6268	if (pReq->u.a.fResetDrive)
6269	{
6270	ataR3ResetDevice(pDevIns, pCtl, s);
6271	ataR3DeviceDiag(pCtl, s);
6272	}
6273	else
6274	{
6275	/* Stop any pending DMA transfer. */
6276	s->fDMA = false;
6277	ataHCPIOTransferStop(pDevIns, pCtl, s);
6278	ataUnsetStatus(pCtl, s, ATA_STAT_BUSY \| ATA_STAT_DRQ \| ATA_STAT_SEEK \| ATA_STAT_ERR);
6279	ataSetStatus(pCtl, s, ATA_STAT_READY);
6280	ataHCSetIRQ(pDevIns, pCtl, s);
6281	}
6282	break;
6283	}
6284
6285	default:
6286	AssertMsgFailed(("Undefined async I/O state %d\n", pCtl->uAsyncIOState));
6287	}
6288
6289	ataR3AsyncIORemoveCurrentRequest(pDevIns, pCtl, ReqType);
6290	pReq = ataR3AsyncIOGetCurrentRequest(pDevIns, pCtl);
6291
6292	if (pCtl->uAsyncIOState == ATA_AIO_NEW && !pCtl->fChainedTransfer)
6293	{
6294	# if defined(DEBUG) \|\| defined(VBOX_WITH_STATISTICS)
6295	STAM_PROFILE_ADV_STOP(&pCtl->StatAsyncTime, a);
6296	# endif
6297
6298	u64TS = RTTimeNanoTS() - u64TS;
6299	uWait = u64TS / 1000;
6300	uintptr_t const iAIOIf = pCtl->iAIOIf & ATA_SELECTED_IF_MASK;
6301	Log(("%s: Ctl#%d: LUN#%d finished I/O transaction in %d microseconds\n",
6302	__FUNCTION__, pCtl->iCtl, pCtl->aIfs[iAIOIf].iLUN, (uint32_t)(uWait)));
6303	/* Mark command as finished. */
6304	pCtl->aIfs[iAIOIf].u64CmdTS = 0;
6305
6306	/*
6307	* Release logging of command execution times depends on the
6308	* command type. ATAPI commands often take longer (due to CD/DVD
6309	* spin up time etc.) so the threshold is different.
6310	*/
6311	if (pCtl->aIfs[iAIOIf].uATARegCommand != ATA_PACKET)
6312	{
6313	if (uWait > 8 * 1000 * 1000)
6314	{
6315	/*
6316	* Command took longer than 8 seconds. This is close
6317	* enough or over the guest's command timeout, so place
6318	* an entry in the release log to allow tracking such
6319	* timing errors (which are often caused by the host).
6320	*/
6321	LogRel(("PIIX3 ATA: execution time for ATA command %#04x was %d seconds\n",
6322	pCtl->aIfs[iAIOIf].uATARegCommand, uWait / (1000 * 1000)));
6323	}
6324	}
6325	else
6326	{
6327	if (uWait > 20 * 1000 * 1000)
6328	{
6329	/*
6330	* Command took longer than 20 seconds. This is close
6331	* enough or over the guest's command timeout, so place
6332	* an entry in the release log to allow tracking such
6333	* timing errors (which are often caused by the host).
6334	*/
6335	LogRel(("PIIX3 ATA: execution time for ATAPI command %#04x was %d seconds\n",
6336	pCtl->aIfs[iAIOIf].abATAPICmd[0], uWait / (1000 * 1000)));
6337	}
6338	}
6339
6340	# if defined(DEBUG) \|\| defined(VBOX_WITH_STATISTICS)
6341	if (uWait < pCtl->StatAsyncMinWait \|\| !pCtl->StatAsyncMinWait)
6342	pCtl->StatAsyncMinWait = uWait;
6343	if (uWait > pCtl->StatAsyncMaxWait)
6344	pCtl->StatAsyncMaxWait = uWait;
6345
6346	STAM_COUNTER_ADD(&pCtl->StatAsyncTimeUS, uWait);
6347	STAM_COUNTER_INC(&pCtl->StatAsyncOps);
6348	# endif /* DEBUG \|\| VBOX_WITH_STATISTICS */
6349	}
6350
6351	ataR3LockLeave(pDevIns, pCtl);
6352	}
6353
6354	/* Signal the ultimate idleness. */
6355	RTThreadUserSignal(pCtlR3->hAsyncIOThread);
6356	if (pCtlR3->fSignalIdle)
6357	PDMDevHlpAsyncNotificationCompleted(pDevIns);
6358
6359	/* Cleanup the state. */
6360	/* Do not destroy request lock yet, still needed for proper shutdown. */
6361	pCtlR3->fShutdown = false;
6362
6363	Log2(("%s: Ctl#%d: return %Rrc\n", __FUNCTION__, pCtl->iCtl, rc));
6364	return rc;
6365	}
6366
6367	#endif /* IN_RING3 */
6368
6369	static uint32_t ataBMDMACmdReadB(PATACONTROLLER pCtl, uint32_t addr)
6370	{
6371	uint32_t val = pCtl->BmDma.u8Cmd;
6372	RT_NOREF(addr);
6373	Log2(("%s: addr=%#06x val=%#04x\n", __FUNCTION__, addr, val));
6374	return val;
6375	}
6376
6377
6378	static void ataBMDMACmdWriteB(PPDMDEVINS pDevIns, PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
6379	{
6380	RT_NOREF(pDevIns, addr);
6381	Log2(("%s: addr=%#06x val=%#04x\n", __FUNCTION__, addr, val));
6382	if (!(val & BM_CMD_START))
6383	{
6384	pCtl->BmDma.u8Status &= ~BM_STATUS_DMAING;
6385	pCtl->BmDma.u8Cmd = val & (BM_CMD_START \| BM_CMD_WRITE);
6386	}
6387	else
6388	{
6389	#ifndef IN_RC
6390	/* Check whether the guest OS wants to change DMA direction in
6391	* mid-flight. Not allowed, according to the PIIX3 specs. */
6392	Assert(!(pCtl->BmDma.u8Status & BM_STATUS_DMAING) \|\| !((val ^ pCtl->BmDma.u8Cmd) & 0x04));
6393	uint8_t uOldBmDmaStatus = pCtl->BmDma.u8Status;
6394	pCtl->BmDma.u8Status \|= BM_STATUS_DMAING;
6395	pCtl->BmDma.u8Cmd = val & (BM_CMD_START \| BM_CMD_WRITE);
6396
6397	/* Do not continue DMA transfers while the RESET line is asserted. */
6398	if (pCtl->fReset)
6399	{
6400	Log2(("%s: Ctl#%d: suppressed continuing DMA transfer as RESET is active\n", __FUNCTION__, pCtl->iCtl));
6401	return;
6402	}
6403
6404	/* Do not start DMA transfers if there's a PIO transfer going on,
6405	* or if there is already a transfer started on this controller. */
6406	if ( !pCtl->aIfs[pCtl->iSelectedIf & ATA_SELECTED_IF_MASK].fDMA
6407	\|\| (uOldBmDmaStatus & BM_STATUS_DMAING))
6408	return;
6409
6410	if (pCtl->aIfs[pCtl->iAIOIf & ATA_SELECTED_IF_MASK].uATARegStatus & ATA_STAT_DRQ)
6411	{
6412	Log2(("%s: Ctl#%d: message to async I/O thread, continuing DMA transfer\n", __FUNCTION__, pCtl->iCtl));
6413	ataHCAsyncIOPutRequest(pDevIns, pCtl, &g_ataDMARequest);
6414	}
6415	#else /* !IN_RING3 */
6416	AssertMsgFailed(("DMA START handling is too complicated for RC\n"));
6417	#endif /* IN_RING3 */
6418	}
6419	}
6420
6421	static uint32_t ataBMDMAStatusReadB(PATACONTROLLER pCtl, uint32_t addr)
6422	{
6423	uint32_t val = pCtl->BmDma.u8Status;
6424	RT_NOREF(addr);
6425	Log2(("%s: addr=%#06x val=%#04x\n", __FUNCTION__, addr, val));
6426	return val;
6427	}
6428
6429	static void ataBMDMAStatusWriteB(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
6430	{
6431	RT_NOREF(addr);
6432	Log2(("%s: addr=%#06x val=%#04x\n", __FUNCTION__, addr, val));
6433	pCtl->BmDma.u8Status = (val & (BM_STATUS_D0DMA \| BM_STATUS_D1DMA))
6434	\| (pCtl->BmDma.u8Status & BM_STATUS_DMAING)
6435	\| (pCtl->BmDma.u8Status & ~val & (BM_STATUS_ERROR \| BM_STATUS_INT));
6436	}
6437
6438	static uint32_t ataBMDMAAddrReadL(PATACONTROLLER pCtl, uint32_t addr)
6439	{
6440	uint32_t val = (uint32_t)pCtl->BmDma.GCPhysAddr;
6441	RT_NOREF(addr);
6442	Log2(("%s: addr=%#06x val=%#010x\n", __FUNCTION__, addr, val));
6443	return val;
6444	}
6445
6446	static void ataBMDMAAddrWriteL(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
6447	{
6448	RT_NOREF(addr);
6449	Log2(("%s: addr=%#06x val=%#010x\n", __FUNCTION__, addr, val));
6450	pCtl->BmDma.GCPhysAddr = val & ~3;
6451	}
6452
6453	static void ataBMDMAAddrWriteLowWord(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
6454	{
6455	RT_NOREF(addr);
6456	Log2(("%s: addr=%#06x val=%#010x\n", __FUNCTION__, addr, val));
6457	pCtl->BmDma.GCPhysAddr = (pCtl->BmDma.GCPhysAddr & 0xFFFF0000) \| RT_LOWORD(val & ~3);
6458
6459	}
6460
6461	static void ataBMDMAAddrWriteHighWord(PATACONTROLLER pCtl, uint32_t addr, uint32_t val)
6462	{
6463	Log2(("%s: addr=%#06x val=%#010x\n", __FUNCTION__, addr, val));
6464	RT_NOREF(addr);
6465	pCtl->BmDma.GCPhysAddr = (RT_LOWORD(val) << 16) \| RT_LOWORD(pCtl->BmDma.GCPhysAddr);
6466	}
6467
6468	/** Helper for ataBMDMAIOPortRead and ataBMDMAIOPortWrite. */
6469	#define VAL(port, size) ( ((port) & BM_DMA_CTL_IOPORTS_MASK) \| ((size) << BM_DMA_CTL_IOPORTS_SHIFT) )
6470
6471	/**
6472	* @callback_method_impl{FNIOMIOPORTNEWOUT,
6473	* Port I/O Handler for bus-master DMA IN operations - both controllers.}
6474	*/
6475	static DECLCALLBACK(VBOXSTRICTRC)
6476	ataBMDMAIOPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
6477	{
6478	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
6479	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (offPort >> BM_DMA_CTL_IOPORTS_SHIFT));
6480	RT_NOREF(pvUser);
6481
6482	VBOXSTRICTRC rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_IOM_R3_IOPORT_READ);
6483	if (rc == VINF_SUCCESS)
6484	{
6485	switch (VAL(offPort, cb))
6486	{
6487	case VAL(0, 1): *pu32 = ataBMDMACmdReadB(pCtl, offPort); break;
6488	case VAL(0, 2): *pu32 = ataBMDMACmdReadB(pCtl, offPort); break;
6489	case VAL(2, 1): *pu32 = ataBMDMAStatusReadB(pCtl, offPort); break;
6490	case VAL(2, 2): *pu32 = ataBMDMAStatusReadB(pCtl, offPort); break;
6491	case VAL(4, 4): *pu32 = ataBMDMAAddrReadL(pCtl, offPort); break;
6492	case VAL(0, 4):
6493	/* The SCO OpenServer tries to read 4 bytes starting from offset 0. */
6494	*pu32 = ataBMDMACmdReadB(pCtl, offPort) \| (ataBMDMAStatusReadB(pCtl, offPort) << 16);
6495	break;
6496	default:
6497	ASSERT_GUEST_MSG_FAILED(("Unsupported read from port %x size=%d\n", offPort, cb));
6498	rc = VERR_IOM_IOPORT_UNUSED;
6499	break;
6500	}
6501	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
6502	}
6503	return rc;
6504	}
6505
6506	/**
6507	* @callback_method_impl{FNIOMIOPORTNEWOUT,
6508	* Port I/O Handler for bus-master DMA OUT operations - both controllers.}
6509	*/
6510	static DECLCALLBACK(VBOXSTRICTRC)
6511	ataBMDMAIOPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
6512	{
6513	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
6514	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (offPort >> BM_DMA_CTL_IOPORTS_SHIFT));
6515	RT_NOREF(pvUser);
6516
6517	VBOXSTRICTRC rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_IOM_R3_IOPORT_WRITE);
6518	if (rc == VINF_SUCCESS)
6519	{
6520	switch (VAL(offPort, cb))
6521	{
6522	case VAL(0, 1):
6523	#ifdef IN_RC
6524	if (u32 & BM_CMD_START)
6525	{
6526	rc = VINF_IOM_R3_IOPORT_WRITE;
6527	break;
6528	}
6529	#endif
6530	ataBMDMACmdWriteB(pDevIns, pCtl, offPort, u32);
6531	break;
6532	case VAL(2, 1): ataBMDMAStatusWriteB(pCtl, offPort, u32); break;
6533	case VAL(4, 4): ataBMDMAAddrWriteL(pCtl, offPort, u32); break;
6534	case VAL(4, 2): ataBMDMAAddrWriteLowWord(pCtl, offPort, u32); break;
6535	case VAL(6, 2): ataBMDMAAddrWriteHighWord(pCtl, offPort, u32); break;
6536	default:
6537	ASSERT_GUEST_MSG_FAILED(("Unsupported write to port %x size=%d val=%x\n", offPort, cb, u32));
6538	break;
6539	}
6540	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
6541	}
6542	return rc;
6543	}
6544
6545	#undef VAL
6546
6547	#ifdef IN_RING3
6548
6549	/* -=-=-=-=-=- ATASTATE::IBase -=-=-=-=-=- */
6550
6551	/**
6552	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
6553	*/
6554	static DECLCALLBACK(void ) ataR3Status_QueryInterface(PPDMIBASE pInterface, const char pszIID)
6555	{
6556	PATASTATER3 pThisCC = RT_FROM_MEMBER(pInterface, ATASTATER3, IBase);
6557	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThisCC->IBase);
6558	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThisCC->ILeds);
6559	return NULL;
6560	}
6561
6562
6563	/* -=-=-=-=-=- ATASTATE::ILeds -=-=-=-=-=- */
6564
6565	/**
6566	* Gets the pointer to the status LED of a unit.
6567	*
6568	* @returns VBox status code.
6569	* @param pInterface Pointer to the interface structure containing the called function pointer.
6570	* @param iLUN The unit which status LED we desire.
6571	* @param ppLed Where to store the LED pointer.
6572	*/
6573	static DECLCALLBACK(int) ataR3Status_QueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
6574	{
6575	if (iLUN < 4)
6576	{
6577	PATASTATER3 pThisCC = RT_FROM_MEMBER(pInterface, ATASTATER3, ILeds);
6578	PATASTATE pThis = PDMDEVINS_2_DATA(pThisCC->pDevIns, PATASTATE);
6579	switch (iLUN)
6580	{
6581	case 0: *ppLed = &pThis->aCts[0].aIfs[0].Led; break;
6582	case 1: *ppLed = &pThis->aCts[0].aIfs[1].Led; break;
6583	case 2: *ppLed = &pThis->aCts[1].aIfs[0].Led; break;
6584	case 3: *ppLed = &pThis->aCts[1].aIfs[1].Led; break;
6585	}
6586	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
6587	return VINF_SUCCESS;
6588	}
6589	return VERR_PDM_LUN_NOT_FOUND;
6590	}
6591
6592
6593	/* -=-=-=-=-=- ATADEVSTATE::IBase -=-=-=-=-=- */
6594
6595	/**
6596	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
6597	*/
6598	static DECLCALLBACK(void ) ataR3QueryInterface(PPDMIBASE pInterface, const char pszIID)
6599	{
6600	PATADEVSTATER3 pIfR3 = RT_FROM_MEMBER(pInterface, ATADEVSTATER3, IBase);
6601	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pIfR3->IBase);
6602	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAPORT, &pIfR3->IPort);
6603	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMOUNTNOTIFY, &pIfR3->IMountNotify);
6604	return NULL;
6605	}
6606
6607
6608	/* -=-=-=-=-=- ATADEVSTATE::IPort -=-=-=-=-=- */
6609
6610	/**
6611	* @interface_method_impl{PDMIMEDIAPORT,pfnQueryDeviceLocation}
6612	*/
6613	static DECLCALLBACK(int) ataR3QueryDeviceLocation(PPDMIMEDIAPORT pInterface, const char **ppcszController,
6614	uint32_t piInstance, uint32_t piLUN)
6615	{
6616	PATADEVSTATER3 pIfR3 = RT_FROM_MEMBER(pInterface, ATADEVSTATER3, IPort);
6617	PPDMDEVINS pDevIns = pIfR3->pDevIns;
6618
6619	AssertPtrReturn(ppcszController, VERR_INVALID_POINTER);
6620	AssertPtrReturn(piInstance, VERR_INVALID_POINTER);
6621	AssertPtrReturn(piLUN, VERR_INVALID_POINTER);
6622
6623	*ppcszController = pDevIns->pReg->szName;
6624	*piInstance = pDevIns->iInstance;
6625	*piLUN = pIfR3->iLUN;
6626
6627	return VINF_SUCCESS;
6628	}
6629
6630	#endif /* IN_RING3 */
6631
6632	/* -=-=-=-=-=- Wrappers -=-=-=-=-=- */
6633
6634
6635	/**
6636	* @callback_method_impl{FNIOMIOPORTNEWOUT,
6637	* Port I/O Handler for OUT operations on unpopulated IDE channels.}
6638	* @note offPort is an absolute port number!
6639	*/
6640	static DECLCALLBACK(VBOXSTRICTRC)
6641	ataIOPortWriteEmptyBus(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
6642	{
6643	RT_NOREF(pDevIns, pvUser, offPort, u32, cb);
6644
6645	#ifdef VBOX_STRICT
6646	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
6647	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (uintptr_t)pvUser);
6648	Assert((uintptr_t)pvUser < 2);
6649	Assert(!pCtl->aIfs[0].fPresent && !pCtl->aIfs[1].fPresent);
6650	#endif
6651
6652	/* This is simply a black hole, writes on unpopulated IDE channels elicit no response. */
6653	LogFunc(("Empty bus: Ignoring write to port %x val=%x size=%d\n", offPort, u32, cb));
6654	return VINF_SUCCESS;
6655	}
6656
6657
6658	/**
6659	* @callback_method_impl{FNIOMIOPORTNEWIN,
6660	* Port I/O Handler for IN operations on unpopulated IDE channels.}
6661	* @note offPort is an absolute port number!
6662	*/
6663	static DECLCALLBACK(VBOXSTRICTRC)
6664	ataIOPortReadEmptyBus(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
6665	{
6666	RT_NOREF(pDevIns, offPort, pvUser);
6667
6668	#ifdef VBOX_STRICT
6669	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
6670	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (uintptr_t)pvUser);
6671	Assert((uintptr_t)pvUser < 2);
6672	Assert(cb <= 4);
6673	Assert(!pCtl->aIfs[0].fPresent && !pCtl->aIfs[1].fPresent);
6674	#endif
6675
6676	/*
6677	* Reads on unpopulated IDE channels behave in a unique way. Newer ATA specifications
6678	* mandate that the host must have a pull-down resistor on signal DD7. As a consequence,
6679	* bit 7 is always read as zero. This greatly aids in ATA device detection because
6680	* the empty bus does not look to the host like a permanently busy drive, and no long
6681	* timeouts (on the order of 30 seconds) are needed.
6682	*
6683	* The response is entirely static and does not require any locking or other fancy
6684	* stuff. Breaking it out simplifies the I/O handling for non-empty IDE channels which
6685	* is quite complicated enough already.
6686	*/
6687	pu32 = ATA_EMPTY_BUS_DATA_32 >> ((4 - cb) 8);
6688	LogFunc(("Empty bus: port %x val=%x size=%d\n", offPort, *pu32, cb));
6689	return VINF_SUCCESS;
6690	}
6691
6692
6693	/**
6694	* @callback_method_impl{FNIOMIOPORTNEWOUT,
6695	* Port I/O Handler for primary port range OUT operations.}
6696	* @note offPort is an absolute port number!
6697	*/
6698	static DECLCALLBACK(VBOXSTRICTRC)
6699	ataIOPortWrite1Other(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
6700	{
6701	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
6702	uintptr_t iCtl = (uintptr_t)pvUser % RT_ELEMENTS(pThis->aCts);
6703	PATACONTROLLER pCtl = &pThis->aCts[iCtl];
6704
6705	Assert((uintptr_t)pvUser < 2);
6706
6707	VBOXSTRICTRC rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_IOM_R3_IOPORT_WRITE);
6708	if (rc == VINF_SUCCESS)
6709	{
6710	/* Writes to the other command block ports should be 8-bit only. If they
6711	* are not, the high bits are simply discarded. Undocumented, but observed
6712	* on a real PIIX4 system.
6713	*/
6714	if (cb > 1)
6715	Log(("ataIOPortWrite1: suspect write to port %x val=%x size=%d\n", offPort, u32, cb));
6716
6717	rc = ataIOPortWriteU8(pDevIns, pCtl, offPort, u32, iCtl);
6718
6719	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
6720	}
6721	return rc;
6722	}
6723
6724
6725	/**
6726	* @callback_method_impl{FNIOMIOPORTNEWIN,
6727	* Port I/O Handler for primary port range IN operations.}
6728	* @note offPort is an absolute port number!
6729	*/
6730	static DECLCALLBACK(VBOXSTRICTRC)
6731	ataIOPortRead1Other(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
6732	{
6733	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
6734	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (uintptr_t)pvUser);
6735
6736	Assert((uintptr_t)pvUser < 2);
6737
6738	VBOXSTRICTRC rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_IOM_R3_IOPORT_READ);
6739	if (rc == VINF_SUCCESS)
6740	{
6741	/* Reads from the other command block registers should be 8-bit only.
6742	* If they are not, the low byte is propagated to the high bits.
6743	* Undocumented, but observed on a real PIIX4 system.
6744	*/
6745	rc = ataIOPortReadU8(pDevIns, pCtl, offPort, pu32);
6746	if (cb > 1)
6747	{
6748	uint32_t pad;
6749
6750	/* Replicate the 8-bit result into the upper three bytes. */
6751	pad = *pu32 & 0xff;
6752	pad = pad \| (pad << 8);
6753	pad = pad \| (pad << 16);
6754	*pu32 = pad;
6755	Log(("ataIOPortRead1: suspect read from port %x size=%d\n", offPort, cb));
6756	}
6757	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
6758	}
6759	return rc;
6760	}
6761
6762
6763	/**
6764	* @callback_method_impl{FNIOMIOPORTNEWOUT,
6765	* Port I/O Handler for secondary port range OUT operations.}
6766	* @note offPort is an absolute port number!
6767	*/
6768	static DECLCALLBACK(VBOXSTRICTRC)
6769	ataIOPortWrite2(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
6770	{
6771	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
6772	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (uintptr_t)pvUser);
6773	int rc;
6774
6775	Assert((uintptr_t)pvUser < 2);
6776
6777	if (cb == 1)
6778	{
6779	rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_IOM_R3_IOPORT_WRITE);
6780	if (rc == VINF_SUCCESS)
6781	{
6782	rc = ataControlWrite(pDevIns, pCtl, u32, offPort);
6783	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
6784	}
6785	}
6786	else
6787	{
6788	Log(("ataIOPortWrite2: ignoring write to port %x+%x size=%d!\n", offPort, pCtl->IOPortBase2, cb));
6789	rc = VINF_SUCCESS;
6790	}
6791	return rc;
6792	}
6793
6794
6795	/**
6796	* @callback_method_impl{FNIOMIOPORTNEWIN,
6797	* Port I/O Handler for secondary port range IN operations.}
6798	* @note offPort is an absolute port number!
6799	*/
6800	static DECLCALLBACK(VBOXSTRICTRC)
6801	ataIOPortRead2(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
6802	{
6803	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
6804	PATACONTROLLER pCtl = &RT_SAFE_SUBSCRIPT(pThis->aCts, (uintptr_t)pvUser);
6805	int rc;
6806
6807	Assert((uintptr_t)pvUser < 2);
6808
6809	if (cb == 1)
6810	{
6811	rc = PDMDevHlpCritSectEnter(pDevIns, &pCtl->lock, VINF_IOM_R3_IOPORT_READ);
6812	if (rc == VINF_SUCCESS)
6813	{
6814	*pu32 = ataStatusRead(pCtl, offPort);
6815	PDMDevHlpCritSectLeave(pDevIns, &pCtl->lock);
6816	}
6817	}
6818	else
6819	{
6820	Log(("ataIOPortRead2: ignoring read from port %x+%x size=%d!\n", offPort, pCtl->IOPortBase2, cb));
6821	rc = VERR_IOM_IOPORT_UNUSED;
6822	}
6823	return rc;
6824	}
6825
6826	#ifdef IN_RING3
6827
6828	/**
6829	* Detach notification.
6830	*
6831	* The DVD drive has been unplugged.
6832	*
6833	* @param pDevIns The device instance.
6834	* @param iLUN The logical unit which is being detached.
6835	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
6836	*/
6837	static DECLCALLBACK(void) ataR3Detach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
6838	{
6839	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
6840	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATECC);
6841	AssertMsg(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
6842	("PIIX3IDE: Device does not support hotplugging\n")); RT_NOREF(fFlags);
6843
6844	/*
6845	* Locate the controller and stuff.
6846	*/
6847	unsigned iController = iLUN / RT_ELEMENTS(pThis->aCts[0].aIfs);
6848	AssertReleaseMsg(iController < RT_ELEMENTS(pThis->aCts), ("iController=%d iLUN=%d\n", iController, iLUN));
6849	PATACONTROLLER pCtl = &pThis->aCts[iController];
6850	PATACONTROLLERR3 pCtlR3 = &pThisCC->aCts[iController];
6851
6852	unsigned iInterface = iLUN % RT_ELEMENTS(pThis->aCts[0].aIfs);
6853	PATADEVSTATE pIf = &pCtl->aIfs[iInterface];
6854	PATADEVSTATER3 pIfR3 = &pCtlR3->aIfs[iInterface];
6855
6856	/*
6857	* Zero some important members.
6858	*/
6859	pIfR3->pDrvBase = NULL;
6860	pIfR3->pDrvMedia = NULL;
6861	pIfR3->pDrvMount = NULL;
6862	pIf->fPresent = false;
6863
6864	/*
6865	* In case there was a medium inserted.
6866	*/
6867	ataR3MediumRemoved(pIf);
6868	}
6869
6870
6871	/**
6872	* Configure a LUN.
6873	*
6874	* @returns VBox status code.
6875	* @param pIf The ATA unit state, shared bits.
6876	* @param pIfR3 The ATA unit state, ring-3 bits.
6877	*/
6878	static int ataR3ConfigLun(PATADEVSTATE pIf, PATADEVSTATER3 pIfR3)
6879	{
6880	/*
6881	* Query Block, Bios and Mount interfaces.
6882	*/
6883	pIfR3->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pIfR3->pDrvBase, PDMIMEDIA);
6884	if (!pIfR3->pDrvMedia)
6885	{
6886	AssertMsgFailed(("Configuration error: LUN#%d hasn't a block interface!\n", pIf->iLUN));
6887	return VERR_PDM_MISSING_INTERFACE;
6888	}
6889
6890	pIfR3->pDrvMount = PDMIBASE_QUERY_INTERFACE(pIfR3->pDrvBase, PDMIMOUNT);
6891	pIf->fPresent = true;
6892
6893	/*
6894	* Validate type.
6895	*/
6896	PDMMEDIATYPE enmType = pIfR3->pDrvMedia->pfnGetType(pIfR3->pDrvMedia);
6897	if ( enmType != PDMMEDIATYPE_CDROM
6898	&& enmType != PDMMEDIATYPE_DVD
6899	&& enmType != PDMMEDIATYPE_HARD_DISK)
6900	{
6901	AssertMsgFailed(("Configuration error: LUN#%d isn't a disk or cd/dvd-rom. enmType=%d\n", pIf->iLUN, enmType));
6902	return VERR_PDM_UNSUPPORTED_BLOCK_TYPE;
6903	}
6904	if ( ( enmType == PDMMEDIATYPE_DVD
6905	\|\| enmType == PDMMEDIATYPE_CDROM)
6906	&& !pIfR3->pDrvMount)
6907	{
6908	AssertMsgFailed(("Internal error: cdrom without a mountable interface, WTF???!\n"));
6909	return VERR_INTERNAL_ERROR;
6910	}
6911	pIf->fATAPI = enmType == PDMMEDIATYPE_DVD \|\| enmType == PDMMEDIATYPE_CDROM;
6912	pIf->fATAPIPassthrough = pIf->fATAPI && pIfR3->pDrvMedia->pfnSendCmd != NULL;
6913
6914	/*
6915	* Allocate I/O buffer.
6916	*/
6917	if (pIf->fATAPI)
6918	pIf->cbSector = 2048; /* Not required for ATAPI, one medium can have multiple sector sizes. */
6919	else
6920	{
6921	pIf->cbSector = pIfR3->pDrvMedia->pfnGetSectorSize(pIfR3->pDrvMedia);
6922	AssertLogRelMsgReturn(pIf->cbSector > 0 && pIf->cbSector <= ATA_MAX_SECTOR_SIZE,
6923	("Unsupported sector size on LUN#%u: %#x (%d)\n", pIf->iLUN, pIf->cbSector, pIf->cbSector),
6924	VERR_OUT_OF_RANGE);
6925	}
6926
6927	if (pIf->cbIOBuffer)
6928	{
6929	/* Buffer is (probably) already allocated. Validate the fields,
6930	* because memory corruption can also overwrite pIf->cbIOBuffer. */
6931	if (pIf->fATAPI)
6932	AssertLogRelReturn(pIf->cbIOBuffer == _128K, VERR_BUFFER_OVERFLOW);
6933	else
6934	AssertLogRelReturn(pIf->cbIOBuffer == ATA_MAX_MULT_SECTORS * pIf->cbSector, VERR_BUFFER_OVERFLOW);
6935	}
6936	else
6937	{
6938	if (pIf->fATAPI)
6939	pIf->cbIOBuffer = _128K;
6940	else
6941	pIf->cbIOBuffer = ATA_MAX_MULT_SECTORS * pIf->cbSector;
6942	}
6943	AssertCompile(_128K <= ATA_MAX_IO_BUFFER_SIZE);
6944	AssertCompileSize(pIf->abIOBuffer, ATA_MAX_IO_BUFFER_SIZE);
6945	AssertLogRelMsgReturn(pIf->cbIOBuffer <= ATA_MAX_IO_BUFFER_SIZE,
6946	("LUN#%u: cbIOBuffer=%#x (%u)\n", pIf->iLUN, pIf->cbIOBuffer, pIf->cbIOBuffer),
6947	VERR_BUFFER_OVERFLOW);
6948
6949	/*
6950	* Init geometry (only for non-CD/DVD media).
6951	*/
6952	int rc = VINF_SUCCESS;
6953	uint32_t cRegions = pIfR3->pDrvMedia->pfnGetRegionCount(pIfR3->pDrvMedia);
6954	pIf->cTotalSectors = 0;
6955	for (uint32_t i = 0; i < cRegions; i++)
6956	{
6957	uint64_t cBlocks = 0;
6958	rc = pIfR3->pDrvMedia->pfnQueryRegionProperties(pIfR3->pDrvMedia, i, NULL, &cBlocks, NULL, NULL);
6959	AssertRC(rc);
6960	pIf->cTotalSectors += cBlocks;
6961	}
6962
6963	if (pIf->fATAPI)
6964	{
6965	pIf->PCHSGeometry.cCylinders = 0; /* dummy */
6966	pIf->PCHSGeometry.cHeads = 0; /* dummy */
6967	pIf->PCHSGeometry.cSectors = 0; /* dummy */
6968	LogRel(("PIIX3 ATA: LUN#%d: CD/DVD, total number of sectors %Ld, passthrough %s\n",
6969	pIf->iLUN, pIf->cTotalSectors, (pIf->fATAPIPassthrough ? "enabled" : "disabled")));
6970	}
6971	else
6972	{
6973	rc = pIfR3->pDrvMedia->pfnBiosGetPCHSGeometry(pIfR3->pDrvMedia, &pIf->PCHSGeometry);
6974	if (rc == VERR_PDM_MEDIA_NOT_MOUNTED)
6975	{
6976	pIf->PCHSGeometry.cCylinders = 0;
6977	pIf->PCHSGeometry.cHeads = 16; /??/
6978	pIf->PCHSGeometry.cSectors = 63; /??/
6979	}
6980	else if (rc == VERR_PDM_GEOMETRY_NOT_SET)
6981	{
6982	pIf->PCHSGeometry.cCylinders = 0; /* autodetect marker */
6983	rc = VINF_SUCCESS;
6984	}
6985	AssertRC(rc);
6986
6987	if ( pIf->PCHSGeometry.cCylinders == 0
6988	\|\| pIf->PCHSGeometry.cHeads == 0
6989	\|\| pIf->PCHSGeometry.cSectors == 0
6990	)
6991	{
6992	uint64_t cCylinders = pIf->cTotalSectors / (16 * 63);
6993	pIf->PCHSGeometry.cCylinders = RT_MAX(RT_MIN(cCylinders, 16383), 1);
6994	pIf->PCHSGeometry.cHeads = 16;
6995	pIf->PCHSGeometry.cSectors = 63;
6996	/* Set the disk geometry information. Ignore errors. */
6997	pIfR3->pDrvMedia->pfnBiosSetPCHSGeometry(pIfR3->pDrvMedia, &pIf->PCHSGeometry);
6998	rc = VINF_SUCCESS;
6999	}
7000	LogRel(("PIIX3 ATA: LUN#%d: disk, PCHS=%u/%u/%u, total number of sectors %Ld\n",
7001	pIf->iLUN, pIf->PCHSGeometry.cCylinders, pIf->PCHSGeometry.cHeads, pIf->PCHSGeometry.cSectors,
7002	pIf->cTotalSectors));
7003
7004	if (pIfR3->pDrvMedia->pfnDiscard)
7005	LogRel(("PIIX3 ATA: LUN#%d: TRIM enabled\n", pIf->iLUN));
7006	}
7007	/* Initialize the translated geometry. */
7008	pIf->XCHSGeometry = pIf->PCHSGeometry;
7009
7010	/*
7011	* Check if SMP system to adjust the agressiveness of the busy yield hack (@bugref{1960}).
7012	*
7013	* The hack is an ancient (2006?) one for dealing with UNI CPU systems where EMT
7014	* would potentially monopolise the CPU and starve I/O threads. It causes the EMT to
7015	* yield it's timeslice if the guest polls the status register during I/O. On modern
7016	* multicore and multithreaded systems, yielding EMT too often may have adverse
7017	* effects (slow grub) so we aim at avoiding repeating the yield there too often.
7018	*/
7019	RTCPUID cCpus = RTMpGetOnlineCount();
7020	if (cCpus <= 1)
7021	{
7022	pIf->cBusyStatusHackR3Rate = 1;
7023	pIf->cBusyStatusHackRZRate = 7;
7024	}
7025	else if (cCpus <= 2)
7026	{
7027	pIf->cBusyStatusHackR3Rate = 3;
7028	pIf->cBusyStatusHackRZRate = 15;
7029	}
7030	else if (cCpus <= 4)
7031	{
7032	pIf->cBusyStatusHackR3Rate = 15;
7033	pIf->cBusyStatusHackRZRate = 31;
7034	}
7035	else
7036	{
7037	pIf->cBusyStatusHackR3Rate = 127;
7038	pIf->cBusyStatusHackRZRate = 127;
7039	}
7040
7041	return rc;
7042	}
7043
7044
7045	/**
7046	* Attach command.
7047	*
7048	* This is called when we change block driver for the DVD drive.
7049	*
7050	* @returns VBox status code.
7051	* @param pDevIns The device instance.
7052	* @param iLUN The logical unit which is being detached.
7053	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
7054	*/
7055	static DECLCALLBACK(int) ataR3Attach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
7056	{
7057	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7058	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATECC);
7059
7060	AssertMsgReturn(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
7061	("PIIX3IDE: Device does not support hotplugging\n"),
7062	VERR_INVALID_PARAMETER);
7063
7064	/*
7065	* Locate the controller and stuff.
7066	*/
7067	unsigned const iController = iLUN / RT_ELEMENTS(pThis->aCts[0].aIfs);
7068	AssertReleaseMsg(iController < RT_ELEMENTS(pThis->aCts), ("iController=%d iLUN=%d\n", iController, iLUN));
7069	PATACONTROLLER pCtl = &pThis->aCts[iController];
7070	PATACONTROLLERR3 pCtlR3 = &pThisCC->aCts[iController];
7071
7072	unsigned const iInterface = iLUN % RT_ELEMENTS(pThis->aCts[0].aIfs);
7073	PATADEVSTATE pIf = &pCtl->aIfs[iInterface];
7074	PATADEVSTATER3 pIfR3 = &pCtlR3->aIfs[iInterface];
7075
7076	/* the usual paranoia */
7077	AssertRelease(!pIfR3->pDrvBase);
7078	AssertRelease(!pIfR3->pDrvMedia);
7079	Assert(pIf->iLUN == iLUN);
7080
7081	/*
7082	* Try attach the block device and get the interfaces,
7083	* required as well as optional.
7084	*/
7085	int rc = PDMDevHlpDriverAttach(pDevIns, pIf->iLUN, &pIfR3->IBase, &pIfR3->pDrvBase, NULL);
7086	if (RT_SUCCESS(rc))
7087	{
7088	rc = ataR3ConfigLun(pIf, pIfR3);
7089	/*
7090	* In case there is a medium inserted.
7091	*/
7092	ataR3MediumInserted(pIf);
7093	ataR3MediumTypeSet(pIf, ATA_MEDIA_TYPE_UNKNOWN);
7094	}
7095	else
7096	AssertMsgFailed(("Failed to attach LUN#%d. rc=%Rrc\n", pIf->iLUN, rc));
7097
7098	if (RT_FAILURE(rc))
7099	{
7100	pIfR3->pDrvBase = NULL;
7101	pIfR3->pDrvMedia = NULL;
7102	pIfR3->pDrvMount = NULL;
7103	pIf->fPresent = false;
7104	}
7105	return rc;
7106	}
7107
7108
7109	/**
7110	* Resume notification.
7111	*
7112	* @returns VBox status code.
7113	* @param pDevIns The device instance data.
7114	*/
7115	static DECLCALLBACK(void) ataR3Resume(PPDMDEVINS pDevIns)
7116	{
7117	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7118	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATECC);
7119
7120	Log(("%s:\n", __FUNCTION__));
7121	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7122	{
7123	if (pThis->aCts[i].fRedo && pThis->aCts[i].fRedoIdle)
7124	{
7125	int rc = RTSemEventSignal(pThisCC->aCts[i].hSuspendIOSem);
7126	AssertRC(rc);
7127	}
7128	}
7129	return;
7130	}
7131
7132
7133	/**
7134	* Checks if all (both) the async I/O threads have quiesced.
7135	*
7136	* @returns true on success.
7137	* @returns false when one or more threads is still processing.
7138	* @param pDevIns Pointer to the PDM device instance.
7139	*/
7140	static bool ataR3AllAsyncIOIsIdle(PPDMDEVINS pDevIns)
7141	{
7142	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7143	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATECC);
7144
7145	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7146	if (pThisCC->aCts[i].hAsyncIOThread != NIL_RTTHREAD)
7147	{
7148	bool fRc = ataR3AsyncIOIsIdle(pDevIns, &pThis->aCts[i], false /fStrict/);
7149	if (!fRc)
7150	{
7151	/* Make it signal PDM & itself when its done */
7152	int const rcLock = PDMDevHlpCritSectEnter(pDevIns, &pThis->aCts[i].AsyncIORequestLock, VERR_IGNORED);
7153	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pThis->aCts[i].AsyncIORequestLock, rcLock);
7154
7155	ASMAtomicWriteBool(&pThisCC->aCts[i].fSignalIdle, true);
7156
7157	PDMDevHlpCritSectLeave(pDevIns, &pThis->aCts[i].AsyncIORequestLock);
7158
7159	fRc = ataR3AsyncIOIsIdle(pDevIns, &pThis->aCts[i], false /fStrict/);
7160	if (!fRc)
7161	{
7162	#if 0 /** @todo Need to do some time tracking here... */
7163	LogRel(("PIIX3 ATA: Ctl#%u is still executing, DevSel=%d AIOIf=%d CmdIf0=%#04x CmdIf1=%#04x\n",
7164	i, pThis->aCts[i].iSelectedIf, pThis->aCts[i].iAIOIf,
7165	pThis->aCts[i].aIfs[0].uATARegCommand, pThis->aCts[i].aIfs[1].uATARegCommand));
7166	#endif
7167	return false;
7168	}
7169	}
7170	ASMAtomicWriteBool(&pThisCC->aCts[i].fSignalIdle, false);
7171	}
7172	return true;
7173	}
7174
7175	/**
7176	* Prepare state save and load operation.
7177	*
7178	* @returns VBox status code.
7179	* @param pDevIns Device instance of the device which registered the data unit.
7180	* @param pSSM SSM operation handle.
7181	*/
7182	static DECLCALLBACK(int) ataR3SaveLoadPrep(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
7183	{
7184	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7185	RT_NOREF(pSSM);
7186
7187	/* sanity - the suspend notification will wait on the async stuff. */
7188	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7189	AssertLogRelMsgReturn(ataR3AsyncIOIsIdle(pDevIns, &pThis->aCts[i], false /fStrict/),
7190	("i=%u\n", i),
7191	VERR_SSM_IDE_ASYNC_TIMEOUT);
7192	return VINF_SUCCESS;
7193	}
7194
7195	/**
7196	* @copydoc FNSSMDEVLIVEEXEC
7197	*/
7198	static DECLCALLBACK(int) ataR3LiveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass)
7199	{
7200	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7201	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATECC);
7202	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
7203	RT_NOREF(uPass);
7204
7205	pHlp->pfnSSMPutU8(pSSM, (uint8_t)pThis->enmChipset);
7206	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7207	{
7208	pHlp->pfnSSMPutBool(pSSM, true); /* For controller enabled / disabled. */
7209	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
7210	{
7211	pHlp->pfnSSMPutBool(pSSM, pThisCC->aCts[i].aIfs[j].pDrvBase != NULL);
7212	pHlp->pfnSSMPutStrZ(pSSM, pThis->aCts[i].aIfs[j].szSerialNumber);
7213	pHlp->pfnSSMPutStrZ(pSSM, pThis->aCts[i].aIfs[j].szFirmwareRevision);
7214	pHlp->pfnSSMPutStrZ(pSSM, pThis->aCts[i].aIfs[j].szModelNumber);
7215	}
7216	}
7217
7218	return VINF_SSM_DONT_CALL_AGAIN;
7219	}
7220
7221	/**
7222	* @copydoc FNSSMDEVSAVEEXEC
7223	*/
7224	static DECLCALLBACK(int) ataR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
7225	{
7226	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7227	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
7228
7229	ataR3LiveExec(pDevIns, pSSM, SSM_PASS_FINAL);
7230
7231	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7232	{
7233	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].iSelectedIf);
7234	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].iAIOIf);
7235	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].uAsyncIOState);
7236	pHlp->pfnSSMPutBool(pSSM, pThis->aCts[i].fChainedTransfer);
7237	pHlp->pfnSSMPutBool(pSSM, pThis->aCts[i].fReset);
7238	pHlp->pfnSSMPutBool(pSSM, pThis->aCts[i].fRedo);
7239	pHlp->pfnSSMPutBool(pSSM, pThis->aCts[i].fRedoIdle);
7240	pHlp->pfnSSMPutBool(pSSM, pThis->aCts[i].fRedoDMALastDesc);
7241	pHlp->pfnSSMPutMem(pSSM, &pThis->aCts[i].BmDma, sizeof(pThis->aCts[i].BmDma));
7242	pHlp->pfnSSMPutGCPhys32(pSSM, pThis->aCts[i].GCPhysFirstDMADesc);
7243	pHlp->pfnSSMPutGCPhys32(pSSM, pThis->aCts[i].GCPhysLastDMADesc);
7244	pHlp->pfnSSMPutGCPhys32(pSSM, pThis->aCts[i].GCPhysRedoDMABuffer);
7245	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].cbRedoDMABuffer);
7246
7247	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
7248	{
7249	pHlp->pfnSSMPutBool(pSSM, pThis->aCts[i].aIfs[j].fLBA48);
7250	pHlp->pfnSSMPutBool(pSSM, pThis->aCts[i].aIfs[j].fATAPI);
7251	pHlp->pfnSSMPutBool(pSSM, pThis->aCts[i].aIfs[j].fIrqPending);
7252	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].cMultSectors);
7253	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].XCHSGeometry.cCylinders);
7254	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].XCHSGeometry.cHeads);
7255	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].XCHSGeometry.cSectors);
7256	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].cSectorsPerIRQ);
7257	pHlp->pfnSSMPutU64(pSSM, pThis->aCts[i].aIfs[j].cTotalSectors);
7258	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegFeature);
7259	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegFeatureHOB);
7260	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegError);
7261	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegNSector);
7262	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegNSectorHOB);
7263	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegSector);
7264	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegSectorHOB);
7265	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegLCyl);
7266	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegLCylHOB);
7267	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegHCyl);
7268	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegHCylHOB);
7269	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegSelect);
7270	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegStatus);
7271	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegCommand);
7272	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATARegDevCtl);
7273	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uATATransferMode);
7274	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].uTxDir);
7275	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].iBeginTransfer);
7276	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].iSourceSink);
7277	pHlp->pfnSSMPutBool(pSSM, pThis->aCts[i].aIfs[j].fDMA);
7278	pHlp->pfnSSMPutBool(pSSM, pThis->aCts[i].aIfs[j].fATAPITransfer);
7279	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].cbTotalTransfer);
7280	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].cbElementaryTransfer);
7281	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].iIOBufferCur);
7282	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].iIOBufferEnd);
7283	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].iIOBufferPIODataStart);
7284	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].iIOBufferPIODataEnd);
7285	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].iCurLBA);
7286	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].cbATAPISector);
7287	pHlp->pfnSSMPutMem(pSSM, &pThis->aCts[i].aIfs[j].abATAPICmd, sizeof(pThis->aCts[i].aIfs[j].abATAPICmd));
7288	pHlp->pfnSSMPutMem(pSSM, &pThis->aCts[i].aIfs[j].abATAPISense, sizeof(pThis->aCts[i].aIfs[j].abATAPISense));
7289	pHlp->pfnSSMPutU8(pSSM, pThis->aCts[i].aIfs[j].cNotifiedMediaChange);
7290	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].MediaEventStatus);
7291	pHlp->pfnSSMPutMem(pSSM, &pThis->aCts[i].aIfs[j].Led, sizeof(pThis->aCts[i].aIfs[j].Led));
7292	pHlp->pfnSSMPutU32(pSSM, pThis->aCts[i].aIfs[j].cbIOBuffer);
7293	if (pThis->aCts[i].aIfs[j].cbIOBuffer)
7294	pHlp->pfnSSMPutMem(pSSM, pThis->aCts[i].aIfs[j].abIOBuffer, pThis->aCts[i].aIfs[j].cbIOBuffer);
7295	}
7296	}
7297
7298	return pHlp->pfnSSMPutU32(pSSM, UINT32_MAX); /* sanity/terminator */
7299	}
7300
7301	/**
7302	* Converts the LUN number into a message string.
7303	*/
7304	static const char *ataR3StringifyLun(unsigned iLun)
7305	{
7306	switch (iLun)
7307	{
7308	case 0: return "primary master";
7309	case 1: return "primary slave";
7310	case 2: return "secondary master";
7311	case 3: return "secondary slave";
7312	default: AssertFailedReturn("unknown lun");
7313	}
7314	}
7315
7316	/**
7317	* FNSSMDEVLOADEXEC
7318	*/
7319	static DECLCALLBACK(int) ataR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
7320	{
7321	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7322	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATECC);
7323	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
7324	int rc;
7325	uint32_t u32;
7326
7327	if ( uVersion != ATA_SAVED_STATE_VERSION
7328	&& uVersion != ATA_SAVED_STATE_VERSION_WITHOUT_ATA_ILBA
7329	&& uVersion != ATA_SAVED_STATE_VERSION_VBOX_30
7330	&& uVersion != ATA_SAVED_STATE_VERSION_WITHOUT_FULL_SENSE
7331	&& uVersion != ATA_SAVED_STATE_VERSION_WITHOUT_EVENT_STATUS
7332	&& uVersion != ATA_SAVED_STATE_VERSION_WITH_BOOL_TYPE)
7333	{
7334	AssertMsgFailed(("uVersion=%d\n", uVersion));
7335	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
7336	}
7337
7338	/*
7339	* Verify the configuration.
7340	*/
7341	if (uVersion > ATA_SAVED_STATE_VERSION_VBOX_30)
7342	{
7343	uint8_t u8Type;
7344	rc = pHlp->pfnSSMGetU8(pSSM, &u8Type);
7345	AssertRCReturn(rc, rc);
7346	if ((CHIPSET)u8Type != pThis->enmChipset)
7347	return pHlp->pfnSSMSetCfgError(pSSM, RT_SRC_POS, N_("Config mismatch: enmChipset - saved=%u config=%u"), u8Type, pThis->enmChipset);
7348
7349	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7350	{
7351	bool fEnabled;
7352	rc = pHlp->pfnSSMGetBool(pSSM, &fEnabled);
7353	AssertRCReturn(rc, rc);
7354	if (!fEnabled)
7355	return pHlp->pfnSSMSetCfgError(pSSM, RT_SRC_POS, N_("Ctr#%u onfig mismatch: fEnabled != true"), i);
7356
7357	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
7358	{
7359	ATADEVSTATE const *pIf = &pThis->aCts[i].aIfs[j];
7360	ATADEVSTATER3 const *pIfR3 = &pThisCC->aCts[i].aIfs[j];
7361
7362	bool fInUse;
7363	rc = pHlp->pfnSSMGetBool(pSSM, &fInUse);
7364	AssertRCReturn(rc, rc);
7365	if (fInUse != (pIfR3->pDrvBase != NULL))
7366	return pHlp->pfnSSMSetCfgError(pSSM, RT_SRC_POS,
7367	N_("The %s VM is missing a %s device. Please make sure the source and target VMs have compatible storage configurations"),
7368	fInUse ? "target" : "source", ataR3StringifyLun(pIf->iLUN) );
7369
7370	char szSerialNumber[ATA_SERIAL_NUMBER_LENGTH+1];
7371	rc = pHlp->pfnSSMGetStrZ(pSSM, szSerialNumber, sizeof(szSerialNumber));
7372	AssertRCReturn(rc, rc);
7373	if (strcmp(szSerialNumber, pIf->szSerialNumber))
7374	LogRel(("PIIX3 ATA: LUN#%u config mismatch: Serial number - saved='%s' config='%s'\n",
7375	pIf->iLUN, szSerialNumber, pIf->szSerialNumber));
7376
7377	char szFirmwareRevision[ATA_FIRMWARE_REVISION_LENGTH+1];
7378	rc = pHlp->pfnSSMGetStrZ(pSSM, szFirmwareRevision, sizeof(szFirmwareRevision));
7379	AssertRCReturn(rc, rc);
7380	if (strcmp(szFirmwareRevision, pIf->szFirmwareRevision))
7381	LogRel(("PIIX3 ATA: LUN#%u config mismatch: Firmware revision - saved='%s' config='%s'\n",
7382	pIf->iLUN, szFirmwareRevision, pIf->szFirmwareRevision));
7383
7384	char szModelNumber[ATA_MODEL_NUMBER_LENGTH+1];
7385	rc = pHlp->pfnSSMGetStrZ(pSSM, szModelNumber, sizeof(szModelNumber));
7386	AssertRCReturn(rc, rc);
7387	if (strcmp(szModelNumber, pIf->szModelNumber))
7388	LogRel(("PIIX3 ATA: LUN#%u config mismatch: Model number - saved='%s' config='%s'\n",
7389	pIf->iLUN, szModelNumber, pIf->szModelNumber));
7390	}
7391	}
7392	}
7393	if (uPass != SSM_PASS_FINAL)
7394	return VINF_SUCCESS;
7395
7396	/*
7397	* Restore valid parts of the ATASTATE structure
7398	*/
7399	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7400	{
7401	/* integrity check */
7402	if (!ataR3AsyncIOIsIdle(pDevIns, &pThis->aCts[i], false))
7403	{
7404	AssertMsgFailed(("Async I/O for controller %d is active\n", i));
7405	return VERR_INTERNAL_ERROR_4;
7406	}
7407
7408	rc = pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].iSelectedIf);
7409	AssertRCReturn(rc, rc);
7410	AssertLogRelMsgStmt(pThis->aCts[i].iSelectedIf == (pThis->aCts[i].iSelectedIf & ATA_SELECTED_IF_MASK),
7411	("iSelectedIf = %d\n", pThis->aCts[i].iSelectedIf),
7412	pThis->aCts[i].iSelectedIf &= ATA_SELECTED_IF_MASK);
7413	rc = pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].iAIOIf);
7414	AssertRCReturn(rc, rc);
7415	AssertLogRelMsgStmt(pThis->aCts[i].iAIOIf == (pThis->aCts[i].iAIOIf & ATA_SELECTED_IF_MASK),
7416	("iAIOIf = %d\n", pThis->aCts[i].iAIOIf),
7417	pThis->aCts[i].iAIOIf &= ATA_SELECTED_IF_MASK);
7418	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].uAsyncIOState);
7419	pHlp->pfnSSMGetBool(pSSM, &pThis->aCts[i].fChainedTransfer);
7420	pHlp->pfnSSMGetBool(pSSM, &pThis->aCts[i].fReset);
7421	pHlp->pfnSSMGetBool(pSSM, &pThis->aCts[i].fRedo);
7422	pHlp->pfnSSMGetBool(pSSM, &pThis->aCts[i].fRedoIdle);
7423	pHlp->pfnSSMGetBool(pSSM, &pThis->aCts[i].fRedoDMALastDesc);
7424	pHlp->pfnSSMGetMem(pSSM, &pThis->aCts[i].BmDma, sizeof(pThis->aCts[i].BmDma));
7425	pHlp->pfnSSMGetGCPhys32(pSSM, &pThis->aCts[i].GCPhysFirstDMADesc);
7426	pHlp->pfnSSMGetGCPhys32(pSSM, &pThis->aCts[i].GCPhysLastDMADesc);
7427	pHlp->pfnSSMGetGCPhys32(pSSM, &pThis->aCts[i].GCPhysRedoDMABuffer);
7428	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].cbRedoDMABuffer);
7429
7430	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
7431	{
7432	pHlp->pfnSSMGetBool(pSSM, &pThis->aCts[i].aIfs[j].fLBA48);
7433	pHlp->pfnSSMGetBool(pSSM, &pThis->aCts[i].aIfs[j].fATAPI);
7434	pHlp->pfnSSMGetBool(pSSM, &pThis->aCts[i].aIfs[j].fIrqPending);
7435	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].cMultSectors);
7436	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].XCHSGeometry.cCylinders);
7437	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].XCHSGeometry.cHeads);
7438	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].XCHSGeometry.cSectors);
7439	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].cSectorsPerIRQ);
7440	pHlp->pfnSSMGetU64(pSSM, &pThis->aCts[i].aIfs[j].cTotalSectors);
7441	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegFeature);
7442	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegFeatureHOB);
7443	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegError);
7444	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegNSector);
7445	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegNSectorHOB);
7446	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegSector);
7447	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegSectorHOB);
7448	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegLCyl);
7449	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegLCylHOB);
7450	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegHCyl);
7451	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegHCylHOB);
7452	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegSelect);
7453	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegStatus);
7454	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegCommand);
7455	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATARegDevCtl);
7456	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uATATransferMode);
7457	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].uTxDir);
7458	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].iBeginTransfer);
7459	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].iSourceSink);
7460	pHlp->pfnSSMGetBool(pSSM, &pThis->aCts[i].aIfs[j].fDMA);
7461	pHlp->pfnSSMGetBool(pSSM, &pThis->aCts[i].aIfs[j].fATAPITransfer);
7462	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].cbTotalTransfer);
7463	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].cbElementaryTransfer);
7464	/* NB: cbPIOTransferLimit could be saved/restored but it's sufficient
7465	* to re-calculate it here, with a tiny risk that it could be
7466	* unnecessarily low for the current transfer only. Could be changed
7467	* when changing the saved state in the future.
7468	*/
7469	pThis->aCts[i].aIfs[j].cbPIOTransferLimit = (pThis->aCts[i].aIfs[j].uATARegHCyl << 8) \| pThis->aCts[i].aIfs[j].uATARegLCyl;
7470	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].iIOBufferCur);
7471	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].iIOBufferEnd);
7472	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].iIOBufferPIODataStart);
7473	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].iIOBufferPIODataEnd);
7474	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].iCurLBA);
7475	pHlp->pfnSSMGetU32(pSSM, &pThis->aCts[i].aIfs[j].cbATAPISector);
7476	pHlp->pfnSSMGetMem(pSSM, &pThis->aCts[i].aIfs[j].abATAPICmd, sizeof(pThis->aCts[i].aIfs[j].abATAPICmd));
7477	if (uVersion > ATA_SAVED_STATE_VERSION_WITHOUT_FULL_SENSE)
7478	pHlp->pfnSSMGetMem(pSSM, pThis->aCts[i].aIfs[j].abATAPISense, sizeof(pThis->aCts[i].aIfs[j].abATAPISense));
7479	else
7480	{
7481	uint8_t uATAPISenseKey, uATAPIASC;
7482	memset(pThis->aCts[i].aIfs[j].abATAPISense, '\0', sizeof(pThis->aCts[i].aIfs[j].abATAPISense));
7483	pThis->aCts[i].aIfs[j].abATAPISense[0] = 0x70 \| (1 << 7);
7484	pThis->aCts[i].aIfs[j].abATAPISense[7] = 10;
7485	pHlp->pfnSSMGetU8(pSSM, &uATAPISenseKey);
7486	pHlp->pfnSSMGetU8(pSSM, &uATAPIASC);
7487	pThis->aCts[i].aIfs[j].abATAPISense[2] = uATAPISenseKey & 0x0f;
7488	pThis->aCts[i].aIfs[j].abATAPISense[12] = uATAPIASC;
7489	}
7490	/** @todo triple-check this hack after passthrough is working */
7491	pHlp->pfnSSMGetU8(pSSM, &pThis->aCts[i].aIfs[j].cNotifiedMediaChange);
7492	if (uVersion > ATA_SAVED_STATE_VERSION_WITHOUT_EVENT_STATUS)
7493	pHlp->pfnSSMGetU32V(pSSM, &pThis->aCts[i].aIfs[j].MediaEventStatus);
7494	else
7495	pThis->aCts[i].aIfs[j].MediaEventStatus = ATA_EVENT_STATUS_UNCHANGED;
7496	pHlp->pfnSSMGetMem(pSSM, &pThis->aCts[i].aIfs[j].Led, sizeof(pThis->aCts[i].aIfs[j].Led));
7497
7498	uint32_t cbIOBuffer = 0;
7499	rc = pHlp->pfnSSMGetU32(pSSM, &cbIOBuffer);
7500	AssertRCReturn(rc, rc);
7501
7502	if ( (uVersion <= ATA_SAVED_STATE_VERSION_WITHOUT_ATA_ILBA)
7503	&& !pThis->aCts[i].aIfs[j].fATAPI)
7504	{
7505	pThis->aCts[i].aIfs[j].iCurLBA = ataR3GetSector(&pThis->aCts[i].aIfs[j]);
7506	}
7507
7508	if (cbIOBuffer)
7509	{
7510	if (cbIOBuffer <= sizeof(pThis->aCts[i].aIfs[j].abIOBuffer))
7511	{
7512	if (pThis->aCts[i].aIfs[j].cbIOBuffer != cbIOBuffer)
7513	LogRel(("ATA: %u/%u: Restoring cbIOBuffer=%u; constructor set up %u!\n", i, j, cbIOBuffer, pThis->aCts[i].aIfs[j].cbIOBuffer));
7514	pThis->aCts[i].aIfs[j].cbIOBuffer = cbIOBuffer;
7515	pHlp->pfnSSMGetMem(pSSM, pThis->aCts[i].aIfs[j].abIOBuffer, cbIOBuffer);
7516	}
7517	else
7518	{
7519	LogRel(("ATA: %u/%u: Restoring cbIOBuffer=%u, only prepared %u!\n", i, j, cbIOBuffer, pThis->aCts[i].aIfs[j].cbIOBuffer));
7520	if (pHlp->pfnSSMHandleGetAfter(pSSM) != SSMAFTER_DEBUG_IT)
7521	return pHlp->pfnSSMSetCfgError(pSSM, RT_SRC_POS,
7522	N_("ATA: %u/%u: Restoring cbIOBuffer=%u, only prepared %u"),
7523	i, j, cbIOBuffer, pThis->aCts[i].aIfs[j].cbIOBuffer);
7524
7525	/* skip the buffer if we're loading for the debugger / animator. */
7526	pHlp->pfnSSMSkip(pSSM, cbIOBuffer);
7527	}
7528	}
7529	else
7530	AssertLogRelMsgStmt(pThis->aCts[i].aIfs[j].cbIOBuffer == 0,
7531	("ATA: %u/%u: cbIOBuffer=%u restoring zero!\n", i, j, pThis->aCts[i].aIfs[j].cbIOBuffer),
7532	pThis->aCts[i].aIfs[j].cbIOBuffer = 0);
7533	}
7534	}
7535	if (uVersion <= ATA_SAVED_STATE_VERSION_VBOX_30)
7536	PDMDEVHLP_SSM_GET_ENUM8_RET(pHlp, pSSM, pThis->enmChipset, CHIPSET);
7537
7538	rc = pHlp->pfnSSMGetU32(pSSM, &u32);
7539	if (RT_FAILURE(rc))
7540	return rc;
7541	if (u32 != ~0U)
7542	{
7543	AssertMsgFailed(("u32=%#x expected ~0\n", u32));
7544	rc = VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
7545	return rc;
7546	}
7547
7548	return VINF_SUCCESS;
7549	}
7550
7551
7552	/**
7553	* Callback employed by ataSuspend and ataR3PowerOff.
7554	*
7555	* @returns true if we've quiesced, false if we're still working.
7556	* @param pDevIns The device instance.
7557	*/
7558	static DECLCALLBACK(bool) ataR3IsAsyncSuspendOrPowerOffDone(PPDMDEVINS pDevIns)
7559	{
7560	return ataR3AllAsyncIOIsIdle(pDevIns);
7561	}
7562
7563
7564	/**
7565	* Common worker for ataSuspend and ataR3PowerOff.
7566	*/
7567	static void ataR3SuspendOrPowerOff(PPDMDEVINS pDevIns)
7568	{
7569	if (!ataR3AllAsyncIOIsIdle(pDevIns))
7570	PDMDevHlpSetAsyncNotification(pDevIns, ataR3IsAsyncSuspendOrPowerOffDone);
7571	}
7572
7573
7574	/**
7575	* Power Off notification.
7576	*
7577	* @returns VBox status code.
7578	* @param pDevIns The device instance data.
7579	*/
7580	static DECLCALLBACK(void) ataR3PowerOff(PPDMDEVINS pDevIns)
7581	{
7582	Log(("%s:\n", __FUNCTION__));
7583	ataR3SuspendOrPowerOff(pDevIns);
7584	}
7585
7586
7587	/**
7588	* Suspend notification.
7589	*
7590	* @returns VBox status code.
7591	* @param pDevIns The device instance data.
7592	*/
7593	static DECLCALLBACK(void) ataR3Suspend(PPDMDEVINS pDevIns)
7594	{
7595	Log(("%s:\n", __FUNCTION__));
7596	ataR3SuspendOrPowerOff(pDevIns);
7597	}
7598
7599
7600	/**
7601	* Callback employed by ataR3Reset.
7602	*
7603	* @returns true if we've quiesced, false if we're still working.
7604	* @param pDevIns The device instance.
7605	*/
7606	static DECLCALLBACK(bool) ataR3IsAsyncResetDone(PPDMDEVINS pDevIns)
7607	{
7608	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7609
7610	if (!ataR3AllAsyncIOIsIdle(pDevIns))
7611	return false;
7612
7613	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7614	{
7615	int const rcLock = PDMDevHlpCritSectEnter(pDevIns, &pThis->aCts[i].lock, VERR_INTERNAL_ERROR);
7616	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pThis->aCts[i].lock, rcLock);
7617
7618	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
7619	ataR3ResetDevice(pDevIns, &pThis->aCts[i], &pThis->aCts[i].aIfs[j]);
7620
7621	PDMDevHlpCritSectLeave(pDevIns, &pThis->aCts[i].lock);
7622	}
7623	return true;
7624	}
7625
7626
7627	/**
7628	* Common reset worker for ataR3Reset and ataR3Construct.
7629	*
7630	* @returns VBox status code.
7631	* @param pDevIns The device instance data.
7632	* @param fConstruct Indicates who is calling.
7633	*/
7634	static int ataR3ResetCommon(PPDMDEVINS pDevIns, bool fConstruct)
7635	{
7636	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7637	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATECC);
7638
7639	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7640	{
7641	int const rcLock = PDMDevHlpCritSectEnter(pDevIns, &pThis->aCts[i].lock, VERR_INTERNAL_ERROR);
7642	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pThis->aCts[i].lock, rcLock);
7643
7644	pThis->aCts[i].iSelectedIf = 0;
7645	pThis->aCts[i].iAIOIf = 0;
7646	pThis->aCts[i].BmDma.u8Cmd = 0;
7647	/* Report that both drives present on the bus are in DMA mode. This
7648	* pretends that there is a BIOS that has set it up. Normal reset
7649	* default is 0x00. */
7650	pThis->aCts[i].BmDma.u8Status = (pThisCC->aCts[i].aIfs[0].pDrvBase != NULL ? BM_STATUS_D0DMA : 0)
7651	\| (pThisCC->aCts[i].aIfs[1].pDrvBase != NULL ? BM_STATUS_D1DMA : 0);
7652	pThis->aCts[i].BmDma.GCPhysAddr = 0;
7653
7654	pThis->aCts[i].fReset = true;
7655	pThis->aCts[i].fRedo = false;
7656	pThis->aCts[i].fRedoIdle = false;
7657	ataR3AsyncIOClearRequests(pDevIns, &pThis->aCts[i]);
7658	Log2(("%s: Ctl#%d: message to async I/O thread, reset controller\n", __FUNCTION__, i));
7659	ataHCAsyncIOPutRequest(pDevIns, &pThis->aCts[i], &g_ataResetARequest);
7660	ataHCAsyncIOPutRequest(pDevIns, &pThis->aCts[i], &g_ataResetCRequest);
7661
7662	PDMDevHlpCritSectLeave(pDevIns, &pThis->aCts[i].lock);
7663	}
7664
7665	int rcRet = VINF_SUCCESS;
7666	if (!fConstruct)
7667	{
7668	/*
7669	* Setup asynchronous notification completion if the requests haven't
7670	* completed yet.
7671	*/
7672	if (!ataR3IsAsyncResetDone(pDevIns))
7673	PDMDevHlpSetAsyncNotification(pDevIns, ataR3IsAsyncResetDone);
7674	}
7675	else
7676	{
7677	/*
7678	* Wait for the requests for complete.
7679	*
7680	* Would be real nice if we could do it all from EMT(0) and not
7681	* involve the worker threads, then we could dispense with all the
7682	* waiting and semaphore ping-pong here...
7683	*/
7684	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7685	{
7686	if (pThisCC->aCts[i].hAsyncIOThread != NIL_RTTHREAD)
7687	{
7688	int rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->aCts[i].AsyncIORequestLock, VERR_IGNORED);
7689	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pThis->aCts[i].AsyncIORequestLock, rc);
7690
7691	ASMAtomicWriteBool(&pThisCC->aCts[i].fSignalIdle, true);
7692	rc = RTThreadUserReset(pThisCC->aCts[i].hAsyncIOThread);
7693	AssertRC(rc);
7694
7695	rc = PDMDevHlpCritSectLeave(pDevIns, &pThis->aCts[i].AsyncIORequestLock);
7696	AssertRC(rc);
7697
7698	if (!ataR3AsyncIOIsIdle(pDevIns, &pThis->aCts[i], false /fStrict/))
7699	{
7700	rc = RTThreadUserWait(pThisCC->aCts[i].hAsyncIOThread, 301000 /ms*/);
7701	if (RT_FAILURE(rc))
7702	rc = RTThreadUserWait(pThisCC->aCts[i].hAsyncIOThread, 1000 /ms/);
7703	if (RT_FAILURE(rc))
7704	{
7705	AssertRC(rc);
7706	rcRet = rc;
7707	}
7708	}
7709	}
7710	ASMAtomicWriteBool(&pThisCC->aCts[i].fSignalIdle, false);
7711	}
7712	if (RT_SUCCESS(rcRet))
7713	{
7714	rcRet = ataR3IsAsyncResetDone(pDevIns) ? VINF_SUCCESS : VERR_INTERNAL_ERROR;
7715	AssertRC(rcRet);
7716	}
7717	}
7718	return rcRet;
7719	}
7720
7721	/**
7722	* Reset notification.
7723	*
7724	* @param pDevIns The device instance data.
7725	*/
7726	static DECLCALLBACK(void) ataR3Reset(PPDMDEVINS pDevIns)
7727	{
7728	ataR3ResetCommon(pDevIns, false /fConstruct/);
7729	}
7730
7731	/**
7732	* Destroy a driver instance.
7733	*
7734	* Most VM resources are freed by the VM. This callback is provided so that any non-VM
7735	* resources can be freed correctly.
7736	*
7737	* @param pDevIns The device instance data.
7738	*/
7739	static DECLCALLBACK(int) ataR3Destruct(PPDMDEVINS pDevIns)
7740	{
7741	PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
7742	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7743	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATECC);
7744	int rc;
7745
7746	Log(("ataR3Destruct\n"));
7747
7748	/*
7749	* Tell the async I/O threads to terminate.
7750	*/
7751	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7752	{
7753	if (pThisCC->aCts[i].hAsyncIOThread != NIL_RTTHREAD)
7754	{
7755	ASMAtomicWriteU32(&pThisCC->aCts[i].fShutdown, true);
7756	rc = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->aCts[i].hAsyncIOSem);
7757	AssertRC(rc);
7758	rc = RTSemEventSignal(pThisCC->aCts[i].hSuspendIOSem);
7759	AssertRC(rc);
7760	}
7761	}
7762
7763	/*
7764	* Wait for the threads to terminate before destroying their resources.
7765	*/
7766	for (unsigned i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7767	{
7768	if (pThisCC->aCts[i].hAsyncIOThread != NIL_RTTHREAD)
7769	{
7770	rc = RTThreadWait(pThisCC->aCts[i].hAsyncIOThread, 30000 /* 30 s*/, NULL);
7771	if (RT_SUCCESS(rc))
7772	pThisCC->aCts[i].hAsyncIOThread = NIL_RTTHREAD;
7773	else
7774	LogRel(("PIIX3 ATA Dtor: Ctl#%u is still executing, DevSel=%d AIOIf=%d CmdIf0=%#04x CmdIf1=%#04x rc=%Rrc\n",
7775	i, pThis->aCts[i].iSelectedIf, pThis->aCts[i].iAIOIf,
7776	pThis->aCts[i].aIfs[0].uATARegCommand, pThis->aCts[i].aIfs[1].uATARegCommand, rc));
7777	}
7778	}
7779
7780	/*
7781	* Free resources.
7782	*/
7783	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7784	{
7785	if (PDMDevHlpCritSectIsInitialized(pDevIns, &pThis->aCts[i].AsyncIORequestLock))
7786	PDMDevHlpCritSectDelete(pDevIns, &pThis->aCts[i].AsyncIORequestLock);
7787	if (pThis->aCts[i].hAsyncIOSem != NIL_SUPSEMEVENT)
7788	{
7789	PDMDevHlpSUPSemEventClose(pDevIns, pThis->aCts[i].hAsyncIOSem);
7790	pThis->aCts[i].hAsyncIOSem = NIL_SUPSEMEVENT;
7791	}
7792	if (pThisCC->aCts[i].hSuspendIOSem != NIL_RTSEMEVENT)
7793	{
7794	RTSemEventDestroy(pThisCC->aCts[i].hSuspendIOSem);
7795	pThisCC->aCts[i].hSuspendIOSem = NIL_RTSEMEVENT;
7796	}
7797
7798	/* try one final time */
7799	if (pThisCC->aCts[i].hAsyncIOThread != NIL_RTTHREAD)
7800	{
7801	rc = RTThreadWait(pThisCC->aCts[i].hAsyncIOThread, 1 /ms/, NULL);
7802	if (RT_SUCCESS(rc))
7803	{
7804	pThisCC->aCts[i].hAsyncIOThread = NIL_RTTHREAD;
7805	LogRel(("PIIX3 ATA Dtor: Ctl#%u actually completed.\n", i));
7806	}
7807	}
7808
7809	for (uint32_t iIf = 0; iIf < RT_ELEMENTS(pThis->aCts[i].aIfs); iIf++)
7810	{
7811	if (pThisCC->aCts[i].aIfs[iIf].pTrackList)
7812	{
7813	ATAPIPassthroughTrackListDestroy(pThisCC->aCts[i].aIfs[iIf].pTrackList);
7814	pThisCC->aCts[i].aIfs[iIf].pTrackList = NULL;
7815	}
7816	}
7817	}
7818
7819	return VINF_SUCCESS;
7820	}
7821
7822	/**
7823	* Convert config value to DEVPCBIOSBOOT.
7824	*
7825	* @returns VBox status code.
7826	* @param pDevIns The device instance data.
7827	* @param pCfg Configuration handle.
7828	* @param penmChipset Where to store the chipset type.
7829	*/
7830	static int ataR3ControllerFromCfg(PPDMDEVINS pDevIns, PCFGMNODE pCfg, CHIPSET *penmChipset)
7831	{
7832	char szType[20];
7833
7834	int rc = pDevIns->pHlpR3->pfnCFGMQueryStringDef(pCfg, "Type", &szType[0], sizeof(szType), "PIIX4");
7835	if (RT_FAILURE(rc))
7836	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
7837	N_("Configuration error: Querying \"Type\" as a string failed"));
7838	if (!strcmp(szType, "PIIX3"))
7839	*penmChipset = CHIPSET_PIIX3;
7840	else if (!strcmp(szType, "PIIX4"))
7841	*penmChipset = CHIPSET_PIIX4;
7842	else if (!strcmp(szType, "ICH6"))
7843	*penmChipset = CHIPSET_ICH6;
7844	else
7845	{
7846	PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
7847	N_("Configuration error: The \"Type\" value \"%s\" is unknown"),
7848	szType);
7849	rc = VERR_INTERNAL_ERROR;
7850	}
7851	return rc;
7852	}
7853
7854	/**
7855	* @interface_method_impl{PDMDEVREG,pfnConstruct}
7856	*/
7857	static DECLCALLBACK(int) ataR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
7858	{
7859	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
7860	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
7861	PATASTATER3 pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PATASTATER3);
7862	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
7863	PPDMIBASE pBase;
7864	int rc;
7865	uint32_t msDelayIRQ;
7866
7867	Assert(iInstance == 0);
7868
7869	/*
7870	* Initialize NIL handle values (for the destructor).
7871	*/
7872	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7873	{
7874	pThis->aCts[i].iCtl = i;
7875	pThis->aCts[i].hAsyncIOSem = NIL_SUPSEMEVENT;
7876	pThis->aCts[i].hIoPorts1First = NIL_IOMIOPORTHANDLE;
7877	pThis->aCts[i].hIoPorts1Other = NIL_IOMIOPORTHANDLE;
7878	pThis->aCts[i].hIoPorts2 = NIL_IOMIOPORTHANDLE;
7879	pThis->aCts[i].hIoPortsEmpty1 = NIL_IOMIOPORTHANDLE;
7880	pThis->aCts[i].hIoPortsEmpty2 = NIL_IOMIOPORTHANDLE;
7881
7882	pThisCC->aCts[i].iCtl = i;
7883	pThisCC->aCts[i].hSuspendIOSem = NIL_RTSEMEVENT;
7884	pThisCC->aCts[i].hAsyncIOThread = NIL_RTTHREAD;
7885	}
7886
7887	/*
7888	* Validate and read configuration.
7889	*/
7890	PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns, "IRQDelay\|Type", "PrimaryMaster\|PrimarySlave\|SecondaryMaster\|SecondarySlave");
7891
7892	rc = pHlp->pfnCFGMQueryU32Def(pCfg, "IRQDelay", &msDelayIRQ, 0);
7893	if (RT_FAILURE(rc))
7894	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 configuration error: failed to read IRQDelay as integer"));
7895	Log(("%s: msDelayIRQ=%d\n", __FUNCTION__, msDelayIRQ));
7896	Assert(msDelayIRQ < 50);
7897
7898	CHIPSET enmChipset = CHIPSET_PIIX3;
7899	rc = ataR3ControllerFromCfg(pDevIns, pCfg, &enmChipset);
7900	if (RT_FAILURE(rc))
7901	return rc;
7902	pThis->enmChipset = enmChipset;
7903
7904	/*
7905	* Initialize data (most of it anyway).
7906	*/
7907	/* Status LUN. */
7908	pThisCC->IBase.pfnQueryInterface = ataR3Status_QueryInterface;
7909	pThisCC->ILeds.pfnQueryStatusLed = ataR3Status_QueryStatusLed;
7910
7911	/* PCI configuration space. */
7912	PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
7913	PDMPCIDEV_ASSERT_VALID(pDevIns, pPciDev);
7914	PDMPciDevSetVendorId(pPciDev, 0x8086); /* Intel */
7915
7916	/*
7917	* When adding more IDE chipsets, don't forget to update pci_bios_init_device()
7918	* as it explicitly checks for PCI id for IDE controllers.
7919	*/
7920	switch (enmChipset)
7921	{
7922	case CHIPSET_ICH6:
7923	PDMPciDevSetDeviceId(pPciDev, 0x269e); /* ICH6 IDE */
7924	/** @todo do we need it? Do we need anything else? */
7925	PDMPciDevSetByte(pPciDev, 0x48, 0x00); /* UDMACTL */
7926	PDMPciDevSetByte(pPciDev, 0x4A, 0x00); /* UDMATIM */
7927	PDMPciDevSetByte(pPciDev, 0x4B, 0x00);
7928	{
7929	/*
7930	* See www.intel.com/Assets/PDF/manual/298600.pdf p. 30
7931	* Report
7932	* WR_Ping-Pong_EN: must be set
7933	* PCR0, PCR1: 80-pin primary cable reporting for both disks
7934	* SCR0, SCR1: 80-pin secondary cable reporting for both disks
7935	*/
7936	uint16_t u16Config = (1<<10) \| (1<<7) \| (1<<6) \| (1<<5) \| (1<<4);
7937	PDMPciDevSetByte(pPciDev, 0x54, u16Config & 0xff);
7938	PDMPciDevSetByte(pPciDev, 0x55, u16Config >> 8);
7939	}
7940	break;
7941	case CHIPSET_PIIX4:
7942	PDMPciDevSetDeviceId(pPciDev, 0x7111); /* PIIX4 IDE */
7943	PDMPciDevSetRevisionId(pPciDev, 0x01); /* PIIX4E */
7944	PDMPciDevSetByte(pPciDev, 0x48, 0x00); /* UDMACTL */
7945	PDMPciDevSetByte(pPciDev, 0x4A, 0x00); /* UDMATIM */
7946	PDMPciDevSetByte(pPciDev, 0x4B, 0x00);
7947	break;
7948	case CHIPSET_PIIX3:
7949	PDMPciDevSetDeviceId(pPciDev, 0x7010); /* PIIX3 IDE */
7950	break;
7951	default:
7952	AssertMsgFailed(("Unsupported IDE chipset type: %d\n", enmChipset));
7953	}
7954
7955	/** @todo
7956	* This is the job of the BIOS / EFI!
7957	*
7958	* The same is done in DevPCI.cpp / pci_bios_init_device() but there is no
7959	* corresponding function in DevPciIch9.cpp. The EFI has corresponding code
7960	* in OvmfPkg/Library/PlatformBdsLib/BdsPlatform.c: NotifyDev() but this
7961	* function assumes that the IDE controller is located at PCI 00:01.1 which
7962	* is not true if the ICH9 chipset is used.
7963	*/
7964	PDMPciDevSetWord(pPciDev, 0x40, 0x8000); /* enable IDE0 */
7965	PDMPciDevSetWord(pPciDev, 0x42, 0x8000); /* enable IDE1 */
7966
7967	PDMPciDevSetCommand( pPciDev, PCI_COMMAND_IOACCESS \| PCI_COMMAND_MEMACCESS \| PCI_COMMAND_BUSMASTER);
7968	PDMPciDevSetClassProg( pPciDev, 0x8a); /* programming interface = PCI_IDE bus-master is supported */
7969	PDMPciDevSetClassSub( pPciDev, 0x01); /* class_sub = PCI_IDE */
7970	PDMPciDevSetClassBase( pPciDev, 0x01); /* class_base = PCI_mass_storage */
7971	PDMPciDevSetHeaderType(pPciDev, 0x00);
7972
7973	pThisCC->pDevIns = pDevIns;
7974	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
7975	{
7976	pThisCC->aCts[i].pDevIns = pDevIns;
7977	pThisCC->aCts[i].iCtl = i;
7978	pThis->aCts[i].iCtl = i;
7979	pThis->aCts[i].msDelayIRQ = msDelayIRQ;
7980	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
7981	{
7982	PATADEVSTATE pIf = &pThis->aCts[i].aIfs[j];
7983	PATADEVSTATER3 pIfR3 = &pThisCC->aCts[i].aIfs[j];
7984
7985	pIfR3->iLUN = pIf->iLUN = i * RT_ELEMENTS(pThis->aCts) + j;
7986	pIfR3->iCtl = pIf->iCtl = i;
7987	pIfR3->iDev = pIf->iDev = j;
7988	pIfR3->pDevIns = pDevIns;
7989	pIfR3->IBase.pfnQueryInterface = ataR3QueryInterface;
7990	pIfR3->IMountNotify.pfnMountNotify = ataR3MountNotify;
7991	pIfR3->IMountNotify.pfnUnmountNotify = ataR3UnmountNotify;
7992	pIfR3->IPort.pfnQueryDeviceLocation = ataR3QueryDeviceLocation;
7993	pIf->Led.u32Magic = PDMLED_MAGIC;
7994	}
7995	}
7996
7997	Assert(RT_ELEMENTS(pThis->aCts) == 2);
7998	pThis->aCts[0].irq = 14;
7999	pThis->aCts[0].IOPortBase1 = 0x1f0;
8000	pThis->aCts[0].IOPortBase2 = 0x3f6;
8001	pThis->aCts[1].irq = 15;
8002	pThis->aCts[1].IOPortBase1 = 0x170;
8003	pThis->aCts[1].IOPortBase2 = 0x376;
8004
8005	/*
8006	* Set the default critical section to NOP as we lock on controller level.
8007	*/
8008	rc = PDMDevHlpSetDeviceCritSect(pDevIns, PDMDevHlpCritSectGetNop(pDevIns));
8009	AssertRCReturn(rc, rc);
8010
8011	/*
8012	* Register the PCI device.
8013	*/
8014	rc = PDMDevHlpPCIRegisterEx(pDevIns, pPciDev, PDMPCIDEVREG_F_NOT_MANDATORY_NO, 1 /uPciDevNo/, 1 /uPciDevFn/, "piix3ide");
8015	if (RT_FAILURE(rc))
8016	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot register PCI device"));
8017
8018	/* Region #4: I/O ports for the two bus-master DMA controllers. */
8019	rc = PDMDevHlpPCIIORegionCreateIo(pDevIns, 4 /iPciRegion/, 0x10 /cPorts/,
8020	ataBMDMAIOPortWrite, ataBMDMAIOPortRead, NULL /pvUser/, "ATA Bus Master DMA",
8021	NULL /paExtDescs/, &pThis->hIoPortsBmDma);
8022	AssertRCReturn(rc, rc);
8023
8024	/*
8025	* Register stats, create critical sections.
8026	*/
8027	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
8028	{
8029	for (uint32_t j = 0; j < RT_ELEMENTS(pThis->aCts[i].aIfs); j++)
8030	{
8031	PATADEVSTATE pIf = &pThis->aCts[i].aIfs[j];
8032	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatATADMA, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES,
8033	"Number of ATA DMA transfers.", "/Devices/IDE%d/ATA%d/Unit%d/DMA", iInstance, i, j);
8034	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatATAPIO, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES,
8035	"Number of ATA PIO transfers.", "/Devices/IDE%d/ATA%d/Unit%d/PIO", iInstance, i, j);
8036	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatATAPIDMA, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES,
8037	"Number of ATAPI DMA transfers.", "/Devices/IDE%d/ATA%d/Unit%d/AtapiDMA", iInstance, i, j);
8038	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatATAPIPIO, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES,
8039	"Number of ATAPI PIO transfers.", "/Devices/IDE%d/ATA%d/Unit%d/AtapiPIO", iInstance, i, j);
8040	#ifdef VBOX_WITH_STATISTICS /** @todo release too. */
8041	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatReads, STAMTYPE_PROFILE_ADV, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
8042	"Profiling of the read operations.", "/Devices/IDE%d/ATA%d/Unit%d/Reads", iInstance, i, j);
8043	#endif
8044	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatBytesRead, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES,
8045	"Amount of data read.", "/Devices/IDE%d/ATA%d/Unit%d/ReadBytes", iInstance, i, j);
8046	#ifdef VBOX_INSTRUMENT_DMA_WRITES
8047	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatInstrVDWrites,STAMTYPE_PROFILE_ADV, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
8048	"Profiling of the VD DMA write operations.", "/Devices/IDE%d/ATA%d/Unit%d/InstrVDWrites", iInstance, i, j);
8049	#endif
8050	#ifdef VBOX_WITH_STATISTICS
8051	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatWrites, STAMTYPE_PROFILE_ADV, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
8052	"Profiling of the write operations.", "/Devices/IDE%d/ATA%d/Unit%d/Writes", iInstance, i, j);
8053	#endif
8054	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatBytesWritten, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES,
8055	"Amount of data written.", "/Devices/IDE%d/ATA%d/Unit%d/WrittenBytes", iInstance, i, j);
8056	#ifdef VBOX_WITH_STATISTICS
8057	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatFlushes, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
8058	"Profiling of the flush operations.", "/Devices/IDE%d/ATA%d/Unit%d/Flushes", iInstance, i, j);
8059	#endif
8060	PDMDevHlpSTAMRegisterF(pDevIns, &pIf->StatStatusYields, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
8061	"Profiling of status polling yields.", "/Devices/IDE%d/ATA%d/Unit%d/StatusYields", iInstance, i, j);
8062	}
8063	#ifdef VBOX_WITH_STATISTICS /** @todo release too. */
8064	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatAsyncOps, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES,
8065	"The number of async operations.", "/Devices/IDE%d/ATA%d/Async/Operations", iInstance, i);
8066	/** @todo STAMUNIT_MICROSECS */
8067	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatAsyncMinWait, STAMTYPE_U64_RESET, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE,
8068	"Minimum wait in microseconds.", "/Devices/IDE%d/ATA%d/Async/MinWait", iInstance, i);
8069	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatAsyncMaxWait, STAMTYPE_U64_RESET, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE,
8070	"Maximum wait in microseconds.", "/Devices/IDE%d/ATA%d/Async/MaxWait", iInstance, i);
8071	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatAsyncTimeUS, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE,
8072	"Total time spent in microseconds.", "/Devices/IDE%d/ATA%d/Async/TotalTimeUS", iInstance, i);
8073	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatAsyncTime, STAMTYPE_PROFILE_ADV, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
8074	"Profiling of async operations.", "/Devices/IDE%d/ATA%d/Async/Time", iInstance, i);
8075	PDMDevHlpSTAMRegisterF(pDevIns, &pThis->aCts[i].StatLockWait, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
8076	"Profiling of locks.", "/Devices/IDE%d/ATA%d/Async/LockWait", iInstance, i);
8077	#endif /* VBOX_WITH_STATISTICS */
8078
8079	/* Initialize per-controller critical section. */
8080	rc = PDMDevHlpCritSectInit(pDevIns, &pThis->aCts[i].lock, RT_SRC_POS, "ATA#%u-Ctl", i);
8081	AssertLogRelRCReturn(rc, rc);
8082
8083	/* Initialize per-controller async I/O request critical section. */
8084	rc = PDMDevHlpCritSectInit(pDevIns, &pThis->aCts[i].AsyncIORequestLock, RT_SRC_POS, "ATA#%u-Req", i);
8085	AssertLogRelRCReturn(rc, rc);
8086	}
8087
8088	/*
8089	* Attach status driver (optional).
8090	*/
8091	rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThisCC->IBase, &pBase, "Status Port");
8092	if (RT_SUCCESS(rc))
8093	{
8094	pThisCC->pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
8095	pThisCC->pMediaNotify = PDMIBASE_QUERY_INTERFACE(pBase, PDMIMEDIANOTIFY);
8096	}
8097	else if (rc != VERR_PDM_NO_ATTACHED_DRIVER)
8098	{
8099	AssertMsgFailed(("Failed to attach to status driver. rc=%Rrc\n", rc));
8100	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot attach to status driver"));
8101	}
8102
8103	/*
8104	* Attach the units.
8105	*/
8106	uint32_t cbTotalBuffer = 0;
8107	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
8108	{
8109	PATACONTROLLER pCtl = &pThis->aCts[i];
8110	PATACONTROLLERR3 pCtlR3 = &pThisCC->aCts[i];
8111
8112	/*
8113	* Start the worker thread.
8114	*/
8115	pCtl->uAsyncIOState = ATA_AIO_NEW;
8116	rc = PDMDevHlpSUPSemEventCreate(pDevIns, &pCtl->hAsyncIOSem);
8117	AssertLogRelRCReturn(rc, rc);
8118	rc = RTSemEventCreate(&pCtlR3->hSuspendIOSem);
8119	AssertLogRelRCReturn(rc, rc);
8120
8121	ataR3AsyncIOClearRequests(pDevIns, pCtl);
8122	rc = RTThreadCreateF(&pCtlR3->hAsyncIOThread, ataR3AsyncIOThread, pCtlR3, 0,
8123	RTTHREADTYPE_IO, RTTHREADFLAGS_WAITABLE, "ATA-%u", i);
8124	AssertLogRelRCReturn(rc, rc);
8125	Assert( pCtlR3->hAsyncIOThread != NIL_RTTHREAD && pCtl->hAsyncIOSem != NIL_SUPSEMEVENT
8126	&& pCtlR3->hSuspendIOSem != NIL_RTSEMEVENT && PDMDevHlpCritSectIsInitialized(pDevIns, &pCtl->AsyncIORequestLock));
8127	Log(("%s: controller %d AIO thread id %#x; sem %p susp_sem %p\n", __FUNCTION__, i, pCtlR3->hAsyncIOThread, pCtl->hAsyncIOSem, pCtlR3->hSuspendIOSem));
8128
8129	for (uint32_t j = 0; j < RT_ELEMENTS(pCtl->aIfs); j++)
8130	{
8131	static const char *s_apszDescs[RT_ELEMENTS(pThis->aCts)][RT_ELEMENTS(pCtl->aIfs)] =
8132	{
8133	{ "Primary Master", "Primary Slave" },
8134	{ "Secondary Master", "Secondary Slave" }
8135	};
8136
8137	/*
8138	* Try attach the block device and get the interfaces,
8139	* required as well as optional.
8140	*/
8141	PATADEVSTATE pIf = &pCtl->aIfs[j];
8142	PATADEVSTATER3 pIfR3 = &pCtlR3->aIfs[j];
8143
8144	rc = PDMDevHlpDriverAttach(pDevIns, pIf->iLUN, &pIfR3->IBase, &pIfR3->pDrvBase, s_apszDescs[i][j]);
8145	if (RT_SUCCESS(rc))
8146	{
8147	rc = ataR3ConfigLun(pIf, pIfR3);
8148	if (RT_SUCCESS(rc))
8149	{
8150	/*
8151	* Init vendor product data.
8152	*/
8153	static const char *s_apszCFGMKeys[RT_ELEMENTS(pThis->aCts)][RT_ELEMENTS(pCtl->aIfs)] =
8154	{
8155	{ "PrimaryMaster", "PrimarySlave" },
8156	{ "SecondaryMaster", "SecondarySlave" }
8157	};
8158
8159	/* Generate a default serial number. */
8160	char szSerial[ATA_SERIAL_NUMBER_LENGTH+1];
8161	RTUUID Uuid;
8162	if (pIfR3->pDrvMedia)
8163	rc = pIfR3->pDrvMedia->pfnGetUuid(pIfR3->pDrvMedia, &Uuid);
8164	else
8165	RTUuidClear(&Uuid);
8166
8167	if (RT_FAILURE(rc) \|\| RTUuidIsNull(&Uuid))
8168	{
8169	/* Generate a predictable serial for drives which don't have a UUID. */
8170	RTStrPrintf(szSerial, sizeof(szSerial), "VB%x-%04x%04x",
8171	pIf->iLUN + pDevIns->iInstance * 32,
8172	pThis->aCts[i].IOPortBase1, pThis->aCts[i].IOPortBase2);
8173	}
8174	else
8175	RTStrPrintf(szSerial, sizeof(szSerial), "VB%08x-%08x", Uuid.au32[0], Uuid.au32[3]);
8176
8177	/* Get user config if present using defaults otherwise. */
8178	PCFGMNODE pCfgNode = pHlp->pfnCFGMGetChild(pCfg, s_apszCFGMKeys[i][j]);
8179	rc = pHlp->pfnCFGMQueryStringDef(pCfgNode, "SerialNumber", pIf->szSerialNumber, sizeof(pIf->szSerialNumber),
8180	szSerial);
8181	if (RT_FAILURE(rc))
8182	{
8183	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
8184	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
8185	N_("PIIX3 configuration error: \"SerialNumber\" is longer than 20 bytes"));
8186	return PDMDEV_SET_ERROR(pDevIns, rc,
8187	N_("PIIX3 configuration error: failed to read \"SerialNumber\" as string"));
8188	}
8189
8190	rc = pHlp->pfnCFGMQueryStringDef(pCfgNode, "FirmwareRevision", pIf->szFirmwareRevision,
8191	sizeof(pIf->szFirmwareRevision), "1.0");
8192	if (RT_FAILURE(rc))
8193	{
8194	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
8195	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
8196	N_("PIIX3 configuration error: \"FirmwareRevision\" is longer than 8 bytes"));
8197	return PDMDEV_SET_ERROR(pDevIns, rc,
8198	N_("PIIX3 configuration error: failed to read \"FirmwareRevision\" as string"));
8199	}
8200
8201	rc = pHlp->pfnCFGMQueryStringDef(pCfgNode, "ModelNumber", pIf->szModelNumber, sizeof(pIf->szModelNumber),
8202	pIf->fATAPI ? "VBOX CD-ROM" : "VBOX HARDDISK");
8203	if (RT_FAILURE(rc))
8204	{
8205	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
8206	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
8207	N_("PIIX3 configuration error: \"ModelNumber\" is longer than 40 bytes"));
8208	return PDMDEV_SET_ERROR(pDevIns, rc,
8209	N_("PIIX3 configuration error: failed to read \"ModelNumber\" as string"));
8210	}
8211
8212	/* There are three other identification strings for CD drives used for INQUIRY */
8213	if (pIf->fATAPI)
8214	{
8215	rc = pHlp->pfnCFGMQueryStringDef(pCfgNode, "ATAPIVendorId", pIf->szInquiryVendorId,
8216	sizeof(pIf->szInquiryVendorId), "VBOX");
8217	if (RT_FAILURE(rc))
8218	{
8219	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
8220	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
8221	N_("PIIX3 configuration error: \"ATAPIVendorId\" is longer than 16 bytes"));
8222	return PDMDEV_SET_ERROR(pDevIns, rc,
8223	N_("PIIX3 configuration error: failed to read \"ATAPIVendorId\" as string"));
8224	}
8225
8226	rc = pHlp->pfnCFGMQueryStringDef(pCfgNode, "ATAPIProductId", pIf->szInquiryProductId,
8227	sizeof(pIf->szInquiryProductId), "CD-ROM");
8228	if (RT_FAILURE(rc))
8229	{
8230	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
8231	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
8232	N_("PIIX3 configuration error: \"ATAPIProductId\" is longer than 16 bytes"));
8233	return PDMDEV_SET_ERROR(pDevIns, rc,
8234	N_("PIIX3 configuration error: failed to read \"ATAPIProductId\" as string"));
8235	}
8236
8237	rc = pHlp->pfnCFGMQueryStringDef(pCfgNode, "ATAPIRevision", pIf->szInquiryRevision,
8238	sizeof(pIf->szInquiryRevision), "1.0");
8239	if (RT_FAILURE(rc))
8240	{
8241	if (rc == VERR_CFGM_NOT_ENOUGH_SPACE)
8242	return PDMDEV_SET_ERROR(pDevIns, VERR_INVALID_PARAMETER,
8243	N_("PIIX3 configuration error: \"ATAPIRevision\" is longer than 4 bytes"));
8244	return PDMDEV_SET_ERROR(pDevIns, rc,
8245	N_("PIIX3 configuration error: failed to read \"ATAPIRevision\" as string"));
8246	}
8247
8248	rc = pHlp->pfnCFGMQueryBoolDef(pCfgNode, "OverwriteInquiry", &pIf->fOverwriteInquiry, true);
8249	if (RT_FAILURE(rc))
8250	return PDMDEV_SET_ERROR(pDevIns, rc,
8251	N_("PIIX3 configuration error: failed to read \"OverwriteInquiry\" as boolean"));
8252	}
8253	}
8254	}
8255	else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
8256	{
8257	pIfR3->pDrvBase = NULL;
8258	pIfR3->pDrvMedia = NULL;
8259	pIf->cbIOBuffer = 0;
8260	pIf->fPresent = false;
8261	LogRel(("PIIX3 ATA: LUN#%d: no unit\n", pIf->iLUN));
8262	}
8263	else
8264	{
8265	switch (rc)
8266	{
8267	case VERR_ACCESS_DENIED:
8268	/* Error already cached by DrvHostBase */
8269	return rc;
8270	default:
8271	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
8272	N_("PIIX3 cannot attach drive to the %s"),
8273	s_apszDescs[i][j]);
8274	}
8275	}
8276	cbTotalBuffer += pIf->cbIOBuffer;
8277	}
8278	}
8279
8280	/*
8281	* Register the I/O ports.
8282	* The ports are all hardcoded and enforced by the PIIX3 host bridge controller.
8283	*/
8284	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
8285	{
8286	Assert(pThis->aCts[i].aIfs[0].fPresent == (pThisCC->aCts[i].aIfs[0].pDrvMedia != NULL));
8287	Assert(pThis->aCts[i].aIfs[1].fPresent == (pThisCC->aCts[i].aIfs[1].pDrvMedia != NULL));
8288
8289	if (!pThisCC->aCts[i].aIfs[0].pDrvMedia && !pThisCC->aCts[i].aIfs[1].pDrvMedia)
8290	{
8291	/* No device present on this ATA bus; requires special handling. */
8292	rc = PDMDevHlpIoPortCreateExAndMap(pDevIns, pThis->aCts[i].IOPortBase1, 8 /cPorts/, IOM_IOPORT_F_ABS,
8293	ataIOPortWriteEmptyBus, ataIOPortReadEmptyBus, NULL, NULL, (RTHCPTR)(uintptr_t)i,
8294	"ATA I/O Base 1 - Empty Bus", NULL /paExtDescs/, &pThis->aCts[i].hIoPortsEmpty1);
8295	AssertLogRelRCReturn(rc, rc);
8296	rc = PDMDevHlpIoPortCreateExAndMap(pDevIns, pThis->aCts[i].IOPortBase2, 1 /cPorts/, IOM_IOPORT_F_ABS,
8297	ataIOPortWriteEmptyBus, ataIOPortReadEmptyBus, NULL, NULL, (RTHCPTR)(uintptr_t)i,
8298	"ATA I/O Base 2 - Empty Bus", NULL /paExtDescs/, &pThis->aCts[i].hIoPortsEmpty2);
8299	AssertLogRelRCReturn(rc, rc);
8300	}
8301	else
8302	{
8303	/* At least one device present, register regular handlers. */
8304	rc = PDMDevHlpIoPortCreateExAndMap(pDevIns, pThis->aCts[i].IOPortBase1, 1 /cPorts/, IOM_IOPORT_F_ABS,
8305	ataIOPortWrite1Data, ataIOPortRead1Data,
8306	ataIOPortWriteStr1Data, ataIOPortReadStr1Data, (RTHCPTR)(uintptr_t)i,
8307	"ATA I/O Base 1 - Data", NULL /paExtDescs/, &pThis->aCts[i].hIoPorts1First);
8308	AssertLogRelRCReturn(rc, rc);
8309	rc = PDMDevHlpIoPortCreateExAndMap(pDevIns, pThis->aCts[i].IOPortBase1 + 1, 7 /cPorts/, IOM_IOPORT_F_ABS,
8310	ataIOPortWrite1Other, ataIOPortRead1Other, NULL, NULL, (RTHCPTR)(uintptr_t)i,
8311	"ATA I/O Base 1 - Other", NULL /paExtDescs/, &pThis->aCts[i].hIoPorts1Other);
8312	AssertLogRelRCReturn(rc, rc);
8313
8314
8315	rc = PDMDevHlpIoPortCreateExAndMap(pDevIns, pThis->aCts[i].IOPortBase2, 1 /cPorts/, IOM_IOPORT_F_ABS,
8316	ataIOPortWrite2, ataIOPortRead2, NULL, NULL, (RTHCPTR)(uintptr_t)i,
8317	"ATA I/O Base 2", NULL /paExtDescs/, &pThis->aCts[i].hIoPorts2);
8318	AssertLogRelRCReturn(rc, rc);
8319	}
8320	}
8321
8322	rc = PDMDevHlpSSMRegisterEx(pDevIns, ATA_SAVED_STATE_VERSION, sizeof(*pThis) + cbTotalBuffer, NULL,
8323	NULL, ataR3LiveExec, NULL,
8324	ataR3SaveLoadPrep, ataR3SaveExec, NULL,
8325	ataR3SaveLoadPrep, ataR3LoadExec, NULL);
8326	if (RT_FAILURE(rc))
8327	return PDMDEV_SET_ERROR(pDevIns, rc, N_("PIIX3 cannot register save state handlers"));
8328
8329	/*
8330	* Initialize the device state.
8331	*/
8332	return ataR3ResetCommon(pDevIns, true /fConstruct/);
8333	}
8334
8335	#else /* !IN_RING3 */
8336
8337	/**
8338	* @callback_method_impl{PDMDEVREGR0,pfnConstruct}
8339	*/
8340	static DECLCALLBACK(int) ataRZConstruct(PPDMDEVINS pDevIns)
8341	{
8342	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
8343	PATASTATE pThis = PDMDEVINS_2_DATA(pDevIns, PATASTATE);
8344
8345	int rc = PDMDevHlpSetDeviceCritSect(pDevIns, PDMDevHlpCritSectGetNop(pDevIns));
8346	AssertRCReturn(rc, rc);
8347
8348	rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortsBmDma, ataBMDMAIOPortWrite, ataBMDMAIOPortRead, NULL /pvUser/);
8349	AssertRCReturn(rc, rc);
8350
8351	for (uint32_t i = 0; i < RT_ELEMENTS(pThis->aCts); i++)
8352	{
8353	if (pThis->aCts[i].hIoPorts1First != NIL_IOMIOPORTHANDLE)
8354	{
8355	rc = PDMDevHlpIoPortSetUpContextEx(pDevIns, pThis->aCts[i].hIoPorts1First,
8356	ataIOPortWrite1Data, ataIOPortRead1Data,
8357	ataIOPortWriteStr1Data, ataIOPortReadStr1Data, (RTHCPTR)(uintptr_t)i);
8358	AssertLogRelRCReturn(rc, rc);
8359	rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->aCts[i].hIoPorts1Other,
8360	ataIOPortWrite1Other, ataIOPortRead1Other, (RTHCPTR)(uintptr_t)i);
8361	AssertLogRelRCReturn(rc, rc);
8362	rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->aCts[i].hIoPorts2,
8363	ataIOPortWrite2, ataIOPortRead2, (RTHCPTR)(uintptr_t)i);
8364	AssertLogRelRCReturn(rc, rc);
8365	}
8366	else
8367	{
8368	rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->aCts[i].hIoPortsEmpty1,
8369	ataIOPortWriteEmptyBus, ataIOPortReadEmptyBus, (void )(uintptr_t)i /pvUser*/);
8370	AssertRCReturn(rc, rc);
8371
8372	rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->aCts[i].hIoPortsEmpty2,
8373	ataIOPortWriteEmptyBus, ataIOPortReadEmptyBus, (void )(uintptr_t)i /pvUser*/);
8374	AssertRCReturn(rc, rc);
8375	}
8376	}
8377
8378	return VINF_SUCCESS;
8379	}
8380
8381
8382	#endif /* !IN_RING3 */
8383
8384	/**
8385	* The device registration structure.
8386	*/
8387	const PDMDEVREG g_DevicePIIX3IDE =
8388	{
8389	/* .u32Version = */ PDM_DEVREG_VERSION,
8390	/* .uReserved0 = */ 0,
8391	/* .szName = */ "piix3ide",
8392	/* .fFlags = */ PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RZ \| PDM_DEVREG_FLAGS_NEW_STYLE
8393	\| PDM_DEVREG_FLAGS_FIRST_SUSPEND_NOTIFICATION \| PDM_DEVREG_FLAGS_FIRST_POWEROFF_NOTIFICATION
8394	\| PDM_DEVREG_FLAGS_FIRST_RESET_NOTIFICATION,
8395	/* .fClass = */ PDM_DEVREG_CLASS_STORAGE,
8396	/* .cMaxInstances = */ 1,
8397	/* .uSharedVersion = */ 42,
8398	/* .cbInstanceShared = */ sizeof(ATASTATE),
8399	/* .cbInstanceCC = */ sizeof(ATASTATECC),
8400	/* .cbInstanceRC = */ sizeof(ATASTATERC),
8401	/* .cMaxPciDevices = */ 1,
8402	/* .cMaxMsixVectors = */ 0,
8403	/* .pszDescription = */ "Intel PIIX3 ATA controller.\n"
8404	" LUN #0 is primary master.\n"
8405	" LUN #1 is primary slave.\n"
8406	" LUN #2 is secondary master.\n"
8407	" LUN #3 is secondary slave.\n"
8408	" LUN #999 is the LED/Status connector.",
8409	#if defined(IN_RING3)
8410	/* .pszRCMod = */ "VBoxDDRC.rc",
8411	/* .pszR0Mod = */ "VBoxDDR0.r0",
8412	/* .pfnConstruct = */ ataR3Construct,
8413	/* .pfnDestruct = */ ataR3Destruct,
8414	/* .pfnRelocate = */ NULL,
8415	/* .pfnMemSetup = */ NULL,
8416	/* .pfnPowerOn = */ NULL,
8417	/* .pfnReset = */ ataR3Reset,
8418	/* .pfnSuspend = */ ataR3Suspend,
8419	/* .pfnResume = */ ataR3Resume,
8420	/* .pfnAttach = */ ataR3Attach,
8421	/* .pfnDetach = */ ataR3Detach,
8422	/* .pfnQueryInterface = */ NULL,
8423	/* .pfnInitComplete = */ NULL,
8424	/* .pfnPowerOff = */ ataR3PowerOff,
8425	/* .pfnSoftReset = */ NULL,
8426	/* .pfnReserved0 = */ NULL,
8427	/* .pfnReserved1 = */ NULL,
8428	/* .pfnReserved2 = */ NULL,
8429	/* .pfnReserved3 = */ NULL,
8430	/* .pfnReserved4 = */ NULL,
8431	/* .pfnReserved5 = */ NULL,
8432	/* .pfnReserved6 = */ NULL,
8433	/* .pfnReserved7 = */ NULL,
8434	#elif defined(IN_RING0)
8435	/* .pfnEarlyConstruct = */ NULL,
8436	/* .pfnConstruct = */ ataRZConstruct,
8437	/* .pfnDestruct = */ NULL,
8438	/* .pfnFinalDestruct = */ NULL,
8439	/* .pfnRequest = */ NULL,
8440	/* .pfnReserved0 = */ NULL,
8441	/* .pfnReserved1 = */ NULL,
8442	/* .pfnReserved2 = */ NULL,
8443	/* .pfnReserved3 = */ NULL,
8444	/* .pfnReserved4 = */ NULL,
8445	/* .pfnReserved5 = */ NULL,
8446	/* .pfnReserved6 = */ NULL,
8447	/* .pfnReserved7 = */ NULL,
8448	#elif defined(IN_RC)
8449	/* .pfnConstruct = */ ataRZConstruct,
8450	/* .pfnReserved0 = */ NULL,
8451	/* .pfnReserved1 = */ NULL,
8452	/* .pfnReserved2 = */ NULL,
8453	/* .pfnReserved3 = */ NULL,
8454	/* .pfnReserved4 = */ NULL,
8455	/* .pfnReserved5 = */ NULL,
8456	/* .pfnReserved6 = */ NULL,
8457	/* .pfnReserved7 = */ NULL,
8458	#else
8459	# error "Not in IN_RING3, IN_RING0 or IN_RC!"
8460	#endif
8461	/* .u32VersionEnd = */ PDM_DEVREG_VERSION
8462	};
8463	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Storage/DevATA.cpp@ 96450

Download in other formats: