DevBusLogic.cpp@ 98110

Last change on this file since 98110 was 98103, checked in by vboxsync, 23 months ago
Copyright year updates by scm.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 178.2 KB

Line
1	/* $Id: DevBusLogic.cpp 98103 2023-01-17 14:15:46Z vboxsync $ */
2	/** @file
3	* VBox storage devices - BusLogic SCSI host adapter BT-958.
4	*
5	* Based on the Multi-Master Ultra SCSI Systems Technical Reference Manual.
6	*/
7
8	/*
9	* Copyright (C) 2006-2023 Oracle and/or its affiliates.
10	*
11	* This file is part of VirtualBox base platform packages, as
12	* available from https://www.virtualbox.org.
13	*
14	* This program is free software; you can redistribute it and/or
15	* modify it under the terms of the GNU General Public License
16	* as published by the Free Software Foundation, in version 3 of the
17	* License.
18	*
19	* This program is distributed in the hope that it will be useful, but
20	* WITHOUT ANY WARRANTY; without even the implied warranty of
21	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
22	* General Public License for more details.
23	*
24	* You should have received a copy of the GNU General Public License
25	* along with this program; if not, see <https://www.gnu.org/licenses>.
26	*
27	* SPDX-License-Identifier: GPL-3.0-only
28	*/
29
30
31	/*********************************************************************************************************************************
32	* Header Files *
33	*********************************************************************************************************************************/
34	#define LOG_GROUP LOG_GROUP_DEV_BUSLOGIC
35	#include <VBox/vmm/pdmdev.h>
36	#include <VBox/vmm/pdmstorageifs.h>
37	#include <VBox/vmm/pdmcritsect.h>
38	#include <VBox/AssertGuest.h>
39	#include <VBox/scsi.h>
40	#include <iprt/asm.h>
41	#include <iprt/assert.h>
42	#include <iprt/string.h>
43	#include <iprt/log.h>
44	#ifdef IN_RING3
45	# include <iprt/alloc.h>
46	# include <iprt/memcache.h>
47	# include <iprt/param.h>
48	# include <iprt/uuid.h>
49	#endif
50
51	#include "VBoxSCSI.h"
52	#include "VBoxDD.h"
53
54
55	/*********************************************************************************************************************************
56	* Defined Constants And Macros *
57	*********************************************************************************************************************************/
58	/** Maximum number of attached devices the adapter can handle. */
59	#define BUSLOGIC_MAX_DEVICES 16
60
61	/** Maximum number of scatter gather elements this device can handle. */
62	#define BUSLOGIC_MAX_SCATTER_GATHER_LIST_SIZE 128
63
64	/** Size of the command buffer. */
65	#define BUSLOGIC_COMMAND_SIZE_MAX 53
66
67	/** Size of the reply buffer. */
68	#define BUSLOGIC_REPLY_SIZE_MAX 64
69
70	/** Custom fixed I/O ports for BIOS controller access.
71	* Note that these should not be in the ISA range (below 400h) to avoid
72	* conflicts with ISA device probing. Addresses in the 300h-340h range should be
73	* especially avoided.
74	*/
75	#define BUSLOGIC_BIOS_IO_PORT 0x430
76
77	/** State saved version. */
78	#define BUSLOGIC_SAVED_STATE_MINOR_VERSION 5
79	/** Saved state version before VBoxSCSI got removed. */
80	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_VBOXSCSI_REMOVAL 4
81	/** Saved state version before command buffer size was raised. */
82	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE 3
83	/** Saved state version before 24-bit mailbox support was implemented. */
84	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX 2
85	/** Saved state version before the suspend on error feature was implemented. */
86	#define BUSLOGIC_SAVED_STATE_MINOR_PRE_ERROR_HANDLING 1
87
88	/** Command buffer size in old saved states. */
89	#define BUSLOGIC_COMMAND_SIZE_OLD 5
90
91	/** The duration of software-initiated reset (in nano seconds).
92	* Not documented, set to 50 ms. */
93	#define BUSLOGIC_RESET_DURATION_NS UINT64_C(50000000)
94
95
96	/*********************************************************************************************************************************
97	* Structures and Typedefs *
98	*********************************************************************************************************************************/
99	/**
100	* State of a device attached to the buslogic host adapter.
101	*
102	* @implements PDMIBASE
103	* @implements PDMISCSIPORT
104	* @implements PDMILEDPORTS
105	*/
106	typedef struct BUSLOGICDEVICE
107	{
108	/** The ring-3 device instance (for getting our bearings when arriving in an
109	* interface method). */
110	PPDMDEVINSR3 pDevIns;
111
112	/** LUN of the device. */
113	uint32_t iLUN;
114
115	/** Flag whether device is present.
116	* @note This is mirrored in BUSLOGIC::afDevicePresent. */
117	bool fPresent;
118	bool afAlignment[3];
119
120	/** Our base interface. */
121	PDMIBASE IBase;
122	/** Media port interface. */
123	PDMIMEDIAPORT IMediaPort;
124	/** Extended media port interface. */
125	PDMIMEDIAEXPORT IMediaExPort;
126	/** Led interface. */
127	PDMILEDPORTS ILed;
128	/** Pointer to the attached driver's base interface. */
129	R3PTRTYPE(PPDMIBASE) pDrvBase;
130	/** Pointer to the attached driver's media interface. */
131	R3PTRTYPE(PPDMIMEDIA) pDrvMedia;
132	/** Pointer to the attached driver's extended media interface. */
133	R3PTRTYPE(PPDMIMEDIAEX) pDrvMediaEx;
134	/** The status LED state for this device. */
135	PDMLED Led;
136
137	/** Number of outstanding tasks on the port. */
138	volatile uint32_t cOutstandingRequests;
139	/** The device name. */
140	char szName[12];
141	} BUSLOGICDEVICE, *PBUSLOGICDEVICE;
142
143	/**
144	* Commands the BusLogic adapter supports.
145	*/
146	enum BUSLOGICCOMMAND
147	{
148	BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT = 0x00,
149	BUSLOGICCOMMAND_INITIALIZE_MAILBOX = 0x01,
150	BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND = 0x02,
151	BUSLOGICCOMMAND_EXECUTE_BIOS_COMMAND = 0x03,
152	BUSLOGICCOMMAND_INQUIRE_BOARD_ID = 0x04,
153	BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT = 0x05,
154	BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT = 0x06,
155	BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS = 0x07,
156	BUSLOGICCOMMAND_SET_TIME_OFF_BUS = 0x08,
157	BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE = 0x09,
158	BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7 = 0x0a,
159	BUSLOGICCOMMAND_INQUIRE_CONFIGURATION = 0x0b,
160	BUSLOGICCOMMAND_ENABLE_TARGET_MODE = 0x0c,
161	BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION = 0x0d,
162	BUSLOGICCOMMAND_WRITE_ADAPTER_LOCAL_RAM = 0x1a,
163	BUSLOGICCOMMAND_READ_ADAPTER_LOCAL_RAM = 0x1b,
164	BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO = 0x1c,
165	BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO = 0x1d,
166	BUSLOGICCOMMAND_ECHO_COMMAND_DATA = 0x1f,
167	BUSLOGICCOMMAND_HOST_ADAPTER_DIAGNOSTIC = 0x20,
168	BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS = 0x21,
169	BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15 = 0x23,
170	BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES = 0x24,
171	BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT = 0x25,
172	BUSLOGICCOMMAND_EXT_BIOS_INFO = 0x28,
173	BUSLOGICCOMMAND_UNLOCK_MAILBOX = 0x29,
174	BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX = 0x81,
175	BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND = 0x83,
176	BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER = 0x84,
177	BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER = 0x85,
178	BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION = 0x86,
179	BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER = 0x8b,
180	BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD = 0x8c,
181	BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION = 0x8d,
182	BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE = 0x8f,
183	BUSLOGICCOMMAND_STORE_HOST_ADAPTER_LOCAL_RAM = 0x90,
184	BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM = 0x91,
185	BUSLOGICCOMMAND_STORE_LOCAL_DATA_IN_EEPROM = 0x92,
186	BUSLOGICCOMMAND_UPLOAD_AUTO_SCSI_CODE = 0x94,
187	BUSLOGICCOMMAND_MODIFY_IO_ADDRESS = 0x95,
188	BUSLOGICCOMMAND_SET_CCB_FORMAT = 0x96,
189	BUSLOGICCOMMAND_WRITE_INQUIRY_BUFFER = 0x9a,
190	BUSLOGICCOMMAND_READ_INQUIRY_BUFFER = 0x9b,
191	BUSLOGICCOMMAND_FLASH_ROM_UPLOAD_DOWNLOAD = 0xa7,
192	BUSLOGICCOMMAND_READ_SCAM_DATA = 0xa8,
193	BUSLOGICCOMMAND_WRITE_SCAM_DATA = 0xa9
194	} BUSLOGICCOMMAND;
195
196	#pragma pack(1)
197	/**
198	* Auto SCSI structure which is located
199	* in host adapter RAM and contains several
200	* configuration parameters.
201	*/
202	typedef struct AutoSCSIRam
203	{
204	uint8_t aInternalSignature[2];
205	uint8_t cbInformation;
206	uint8_t aHostAdaptertype[6];
207	uint8_t uReserved1;
208	bool fFloppyEnabled : 1;
209	bool fFloppySecondary : 1;
210	bool fLevelSensitiveInterrupt : 1;
211	unsigned char uReserved2 : 2;
212	unsigned char uSystemRAMAreForBIOS : 3;
213	unsigned char uDMAChannel : 7;
214	bool fDMAAutoConfiguration : 1;
215	unsigned char uIrqChannel : 7;
216	bool fIrqAutoConfiguration : 1;
217	uint8_t uDMATransferRate;
218	uint8_t uSCSIId;
219	bool fLowByteTerminated : 1;
220	bool fParityCheckingEnabled : 1;
221	bool fHighByteTerminated : 1;
222	bool fNoisyCablingEnvironment : 1;
223	bool fFastSynchronousNeogtiation : 1;
224	bool fBusResetEnabled : 1;
225	bool fReserved3 : 1;
226	bool fActiveNegotiationEnabled : 1;
227	uint8_t uBusOnDelay;
228	uint8_t uBusOffDelay;
229	bool fHostAdapterBIOSEnabled : 1;
230	bool fBIOSRedirectionOfInt19 : 1;
231	bool fExtendedTranslation : 1;
232	bool fMapRemovableAsFixed : 1;
233	bool fReserved4 : 1;
234	bool fBIOSSupportsMoreThan2Drives : 1;
235	bool fBIOSInterruptMode : 1;
236	bool fFlopticalSupport : 1;
237	uint16_t u16DeviceEnabledMask;
238	uint16_t u16WidePermittedMask;
239	uint16_t u16FastPermittedMask;
240	uint16_t u16SynchronousPermittedMask;
241	uint16_t u16DisconnectPermittedMask;
242	uint16_t u16SendStartUnitCommandMask;
243	uint16_t u16IgnoreInBIOSScanMask;
244	unsigned char uPCIInterruptPin : 2;
245	unsigned char uHostAdapterIoPortAddress : 2;
246	bool fStrictRoundRobinMode : 1;
247	bool fVesaBusSpeedGreaterThan33MHz : 1;
248	bool fVesaBurstWrite : 1;
249	bool fVesaBurstRead : 1;
250	uint16_t u16UltraPermittedMask;
251	uint32_t uReserved5;
252	uint8_t uReserved6;
253	uint8_t uAutoSCSIMaximumLUN;
254	bool fReserved7 : 1;
255	bool fSCAMDominant : 1;
256	bool fSCAMenabled : 1;
257	bool fSCAMLevel2 : 1;
258	unsigned char uReserved8 : 4;
259	bool fInt13Extension : 1;
260	bool fReserved9 : 1;
261	bool fCDROMBoot : 1;
262	unsigned char uReserved10 : 5;
263	unsigned char uBootTargetId : 4;
264	unsigned char uBootChannel : 4;
265	bool fForceBusDeviceScanningOrder : 1;
266	unsigned char uReserved11 : 7;
267	uint16_t u16NonTaggedToAlternateLunPermittedMask;
268	uint16_t u16RenegotiateSyncAfterCheckConditionMask;
269	uint8_t aReserved12[10];
270	uint8_t aManufacturingDiagnostic[2];
271	uint16_t u16Checksum;
272	} AutoSCSIRam, *PAutoSCSIRam;
273	AssertCompileSize(AutoSCSIRam, 64);
274	#pragma pack()
275
276	/**
277	* The local Ram.
278	*/
279	typedef union HostAdapterLocalRam
280	{
281	/** Byte view. */
282	uint8_t u8View[256];
283	/** Structured view. */
284	struct
285	{
286	/** Offset 0 - 63 is for BIOS. */
287	uint8_t u8Bios[64];
288	/** Auto SCSI structure. */
289	AutoSCSIRam autoSCSIData;
290	} structured;
291	} HostAdapterLocalRam, *PHostAdapterLocalRam;
292	AssertCompileSize(HostAdapterLocalRam, 256);
293
294
295	/** Ugly 24-bit big-endian addressing. */
296	typedef struct
297	{
298	uint8_t hi;
299	uint8_t mid;
300	uint8_t lo;
301	} Addr24, Len24;
302	AssertCompileSize(Addr24, 3);
303
304	#define ADDR_TO_U32(x) (((x).hi << 16) \| ((x).mid << 8) \| (x).lo)
305	#define LEN_TO_U32 ADDR_TO_U32
306	#define U32_TO_ADDR(a, x) do {(a).hi = (x) >> 16; (a).mid = (x) >> 8; (a).lo = (x);} while(0)
307	#define U32_TO_LEN U32_TO_ADDR
308
309	/** @name Compatible ISA base I/O port addresses. Disabled if zero.
310	* @{ */
311	#define NUM_ISA_BASES 8
312	#define MAX_ISA_BASE (NUM_ISA_BASES - 1)
313	#define ISA_BASE_DISABLED 6
314
315	#ifdef IN_RING3
316	static uint16_t const g_aISABases[NUM_ISA_BASES] =
317	{
318	0x330, 0x334, 0x230, 0x234, 0x130, 0x134, 0, 0
319	};
320	#endif
321	/** @} */
322
323	/**
324	* Emulated device types.
325	*/
326	enum BL_DEVICE_TYPE
327	{
328	DEV_BT_958D = 0, /* BusLogic BT-958D, PCI. */
329	DEV_BT_545C = 1, /* BusLogic BT-545C, ISA. */
330	DEV_AHA_1540B = 2 /* Adaptec AHA-1540B, ISA. */
331	};
332
333	/** Pointer to a task state structure. */
334	typedef struct BUSLOGICREQ *PBUSLOGICREQ;
335
336	/**
337	* The shared BusLogic device emulation state.
338	*/
339	typedef struct BUSLOGIC
340	{
341	/** Status register - Readonly. */
342	volatile uint8_t regStatus;
343	/** Interrupt register - Readonly. */
344	volatile uint8_t regInterrupt;
345	/** Geometry register - Readonly. */
346	volatile uint8_t regGeometry;
347	/** Pending (delayed) interrupt. */
348	volatile uint8_t uPendingIntr;
349
350	/** Command code the guest issued. */
351	uint8_t uOperationCode;
352	/** Current position in the command buffer. */
353	uint8_t iParameter;
354	/** Parameters left until the command is complete. */
355	uint8_t cbCommandParametersLeft;
356	/** Buffer for the command parameters the adapter is currently receiving from the guest.
357	* Size of the largest command which is possible. */
358	uint8_t aCommandBuffer[BUSLOGIC_COMMAND_SIZE_MAX]; /* Size of the biggest request. */
359
360	/** Only for LOG_ENABLED builds! */
361	volatile uint32_t cInMailboxesReadyIfLogEnabled;
362
363	/** Position in the buffer we are reading next.
364	* @note aligned on 64 byte boundrary for cache-line mojo. Means IOISABase
365	* is at offset 130. */
366	uint8_t iReply;
367	/** Bytes left until the reply buffer is empty. */
368	uint8_t cbReplyParametersLeft;
369	/** Buffer to store reply data from the controller to the guest. */
370	uint8_t aReplyBuffer[BUSLOGIC_REPLY_SIZE_MAX]; /* Size of the biggest reply. */
371
372	/** ISA I/O port base (disabled if zero). */
373	RTIOPORT IOISABase;
374	/** Default ISA I/O port base in FW-compatible format. */
375	uint8_t uDefaultISABaseCode;
376	/** Emulated device type. */
377	uint8_t uDevType;
378
379	/** Signature index for Adaptec models. */
380	uint8_t uAhaSigIdx;
381
382	/** Whether we are using the RAM or reply buffer. */
383	bool fUseLocalRam;
384
385	/** Flag whether IRQs are enabled. */
386	bool fIRQEnabled;
387	/** Flag whether 24-bit mailboxes are in use (default is 32-bit). */
388	bool fMbxIs24Bit;
389	/** ISA I/O port base (encoded in FW-compatible format). */
390	uint8_t uISABaseCode;
391	/** ISA IRQ, non-zero if in ISA mode. */
392	uint8_t uIsaIrq;
393
394	/** Number of mailboxes the guest set up. */
395	uint32_t cMailbox;
396
397	/** Time when HBA reset was last initiated. */
398	uint64_t u64ResetTime; /*< @todo does this need to be saved? /
399	/** Physical base address of the outgoing mailboxes. */
400	RTGCPHYS GCPhysAddrMailboxOutgoingBase;
401	/** Current outgoing mailbox position. */
402	uint32_t uMailboxOutgoingPositionCurrent;
403	/** Number of mailboxes ready. */
404	volatile uint32_t cMailboxesReady;
405	/** Whether a notification to R3 was sent. */
406	volatile bool fNotificationSent;
407	/** Flag whether a BIOS request is pending. */
408	volatile bool fBiosReqPending;
409
410	/** Whether strict round robin is enabled. */
411	bool fStrictRoundRobinMode;
412	/** Whether the extended LUN CCB format is enabled for 32 possible logical units. */
413	bool fExtendedLunCCBFormat;
414	/** Last completed command, for debugging. */
415	uint8_t uPrevCmd;
416
417	/** Current incoming mailbox position. */
418	uint32_t uMailboxIncomingPositionCurrent;
419	/** Physical base address of the incoming mailboxes. */
420	RTGCPHYS GCPhysAddrMailboxIncomingBase;
421
422	/** Critical section protecting access to the interrupt status register. */
423	PDMCRITSECT CritSectIntr;
424
425	/** Device presence indicators.
426	* @note Copy of BUSLOGICDEVICE::fPresent accessible from ring-0. */
427	bool afDevicePresent[BUSLOGIC_MAX_DEVICES];
428
429	/** The event semaphore the processing thread waits on. */
430	SUPSEMEVENT hEvtProcess;
431
432	/** ISA compatibility I/O ports. */
433	IOMIOPORTHANDLE hIoPortsIsa;
434	/** BIOS I/O ports for booting, optional. */
435	IOMIOPORTHANDLE hIoPortsBios;
436	/** PCI Region \#0: I/O ports. */
437	IOMIOPORTHANDLE hIoPortsPci;
438	/** PCI Region \#1: MMIO (32 bytes, but probably rounded up to 4KB). */
439	IOMMMIOHANDLE hMmio;
440
441	/** Local RAM for the fetch hostadapter local RAM request.
442	* I don't know how big the buffer really is but the maximum
443	* seems to be 256 bytes because the offset and count field in the command request
444	* are only one byte big.
445	*/
446	HostAdapterLocalRam LocalRam;
447	} BUSLOGIC;
448	/** Pointer to the shared BusLogic device emulation state. */
449	typedef BUSLOGIC *PBUSLOGIC;
450
451
452	/**
453	* The ring-3 BusLogic device emulation state.
454	*
455	* @implements PDMILEDPORTS
456	*/
457	typedef struct BUSLOGICR3
458	{
459	/** The device instance - only for getting our bearings in interface methods. */
460	PPDMDEVINSR3 pDevIns;
461
462	/** BusLogic device states. */
463	BUSLOGICDEVICE aDeviceStates[BUSLOGIC_MAX_DEVICES];
464
465	/** The base interface.
466	* @todo use PDMDEVINS::IBase */
467	PDMIBASE IBase;
468	/** Status Port - Leds interface. */
469	PDMILEDPORTS ILeds;
470	/** Partner of ILeds. */
471	R3PTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
472	/** Status LUN: Media Notifys. */
473	R3PTRTYPE(PPDMIMEDIANOTIFY) pMediaNotify;
474
475	/** Indicates that PDMDevHlpAsyncNotificationCompleted should be called when
476	* a port is entering the idle state. */
477	bool volatile fSignalIdle;
478	/** Flag whether the worker thread is sleeping. */
479	volatile bool fWrkThreadSleeping;
480
481	/** Worker thread. */
482	R3PTRTYPE(PPDMTHREAD) pThreadWrk;
483
484	/** Pointer to the array of addresses to redo. */
485	R3PTRTYPE(PRTGCPHYS) paGCPhysAddrCCBRedo;
486	/** Number of addresses the redo array holds. */
487	uint32_t cReqsRedo;
488	} BUSLOGICR3;
489	/** Pointer to the ring-3 BusLogic device emulation state. */
490	typedef BUSLOGICR3 *PBUSLOGICR3;
491
492
493	/**
494	* The ring-0 BusLogic device emulation state.
495	*/
496	typedef struct BUSLOGICR0
497	{
498	uint64_t uUnused;
499	} BUSLOGICR0;
500	/** Pointer to the ring-0 BusLogic device emulation state. */
501	typedef BUSLOGICR0 *PBUSLOGICR0;
502
503
504	/**
505	* The raw-mode BusLogic device emulation state.
506	*/
507	typedef struct BUSLOGICRC
508	{
509	uint64_t uUnused;
510	} BUSLOGICRC;
511	/** Pointer to the raw-mode BusLogic device emulation state. */
512	typedef BUSLOGICRC *PBUSLOGICRC;
513
514
515	/** The current context BusLogic device emulation state. */
516	typedef CTX_SUFF(BUSLOGIC) BUSLOGICCC;
517	/** Pointer to the current context BusLogic device emulation state. */
518	typedef CTX_SUFF(PBUSLOGIC) PBUSLOGICCC;
519
520
521	/** Register offsets in the I/O port space. */
522	#define BUSLOGIC_REGISTER_CONTROL 0 /*< Writeonly /
523	/** Fields for the control register. */
524	# define BL_CTRL_RSBUS RT_BIT(4) /* Reset SCSI Bus. */
525	# define BL_CTRL_RINT RT_BIT(5) /* Reset Interrupt. */
526	# define BL_CTRL_RSOFT RT_BIT(6) /* Soft Reset. */
527	# define BL_CTRL_RHARD RT_BIT(7) /* Hard Reset. */
528
529	#define BUSLOGIC_REGISTER_STATUS 0 /*< Readonly /
530	/** Fields for the status register. */
531	# define BL_STAT_CMDINV RT_BIT(0) /* Command Invalid. */
532	# define BL_STAT_DIRRDY RT_BIT(2) /* Data In Register Ready. */
533	# define BL_STAT_CPRBSY RT_BIT(3) /* Command/Parameter Out Register Busy. */
534	# define BL_STAT_HARDY RT_BIT(4) /* Host Adapter Ready. */
535	# define BL_STAT_INREQ RT_BIT(5) /* Initialization Required. */
536	# define BL_STAT_DFAIL RT_BIT(6) /* Diagnostic Failure. */
537	# define BL_STAT_DACT RT_BIT(7) /* Diagnistic Active. */
538
539	#define BUSLOGIC_REGISTER_COMMAND 1 /*< Writeonly /
540	#define BUSLOGIC_REGISTER_DATAIN 1 /*< Readonly /
541	#define BUSLOGIC_REGISTER_INTERRUPT 2 /*< Readonly /
542	/** Fields for the interrupt register. */
543	# define BL_INTR_IMBL RT_BIT(0) /* Incoming Mailbox Loaded. */
544	# define BL_INTR_OMBR RT_BIT(1) /* Outgoing Mailbox Available. */
545	# define BL_INTR_CMDC RT_BIT(2) /* Command Complete. */
546	# define BL_INTR_RSTS RT_BIT(3) /* SCSI Bus Reset State. */
547	# define BL_INTR_INTV RT_BIT(7) /* Interrupt Valid. */
548
549	#define BUSLOGIC_REGISTER_GEOMETRY 3 /* Readonly */
550	# define BL_GEOM_XLATEN RT_BIT(7) /* Extended geometry translation enabled. */
551
552	/** Structure for the INQUIRE_PCI_HOST_ADAPTER_INFORMATION reply. */
553	typedef struct ReplyInquirePCIHostAdapterInformation
554	{
555	uint8_t IsaIOPort;
556	uint8_t IRQ;
557	unsigned char LowByteTerminated : 1;
558	unsigned char HighByteTerminated : 1;
559	unsigned char uReserved : 2; /* Reserved. */
560	unsigned char JP1 : 1; /* Whatever that means. */
561	unsigned char JP2 : 1; /* Whatever that means. */
562	unsigned char JP3 : 1; /* Whatever that means. */
563	/** Whether the provided info is valid. */
564	unsigned char InformationIsValid: 1;
565	uint8_t uReserved2; /* Reserved. */
566	} ReplyInquirePCIHostAdapterInformation, *PReplyInquirePCIHostAdapterInformation;
567	AssertCompileSize(ReplyInquirePCIHostAdapterInformation, 4);
568
569	/** Structure for the INQUIRE_CONFIGURATION reply. */
570	typedef struct ReplyInquireConfiguration
571	{
572	unsigned char uReserved1 : 5;
573	bool fDmaChannel5 : 1;
574	bool fDmaChannel6 : 1;
575	bool fDmaChannel7 : 1;
576	bool fIrqChannel9 : 1;
577	bool fIrqChannel10 : 1;
578	bool fIrqChannel11 : 1;
579	bool fIrqChannel12 : 1;
580	unsigned char uReserved2 : 1;
581	bool fIrqChannel14 : 1;
582	bool fIrqChannel15 : 1;
583	unsigned char uReserved3 : 1;
584	unsigned char uHostAdapterId : 4;
585	unsigned char uReserved4 : 4;
586	} ReplyInquireConfiguration, *PReplyInquireConfiguration;
587	AssertCompileSize(ReplyInquireConfiguration, 3);
588
589	/** Structure for the INQUIRE_SETUP_INFORMATION reply. */
590	typedef struct ReplyInquireSetupInformationSynchronousValue
591	{
592	unsigned char uOffset : 4;
593	unsigned char uTransferPeriod : 3;
594	bool fSynchronous : 1;
595	}ReplyInquireSetupInformationSynchronousValue, *PReplyInquireSetupInformationSynchronousValue;
596	AssertCompileSize(ReplyInquireSetupInformationSynchronousValue, 1);
597
598	typedef struct ReplyInquireSetupInformation
599	{
600	bool fSynchronousInitiationEnabled : 1;
601	bool fParityCheckingEnabled : 1;
602	unsigned char uReserved1 : 6;
603	uint8_t uBusTransferRate;
604	uint8_t uPreemptTimeOnBus;
605	uint8_t uTimeOffBus;
606	uint8_t cMailbox;
607	Addr24 MailboxAddress;
608	ReplyInquireSetupInformationSynchronousValue SynchronousValuesId0To7[8];
609	uint8_t uDisconnectPermittedId0To7;
610	uint8_t uSignature;
611	uint8_t uCharacterD;
612	uint8_t uHostBusType;
613	uint8_t uWideTransferPermittedId0To7;
614	uint8_t uWideTransfersActiveId0To7;
615	ReplyInquireSetupInformationSynchronousValue SynchronousValuesId8To15[8];
616	uint8_t uDisconnectPermittedId8To15;
617	uint8_t uReserved2;
618	uint8_t uWideTransferPermittedId8To15;
619	uint8_t uWideTransfersActiveId8To15;
620	} ReplyInquireSetupInformation, *PReplyInquireSetupInformation;
621	AssertCompileSize(ReplyInquireSetupInformation, 34);
622
623	/** Structure for the INQUIRE_EXTENDED_SETUP_INFORMATION. */
624	#pragma pack(1)
625	typedef struct ReplyInquireExtendedSetupInformation
626	{
627	uint8_t uBusType;
628	uint8_t uBiosAddress;
629	uint16_t u16ScatterGatherLimit;
630	uint8_t cMailbox;
631	uint32_t uMailboxAddressBase;
632	unsigned char uReserved1 : 2;
633	bool fFastEISA : 1;
634	unsigned char uReserved2 : 3;
635	bool fLevelSensitiveInterrupt : 1;
636	unsigned char uReserved3 : 1;
637	unsigned char aFirmwareRevision[3];
638	bool fHostWideSCSI : 1;
639	bool fHostDifferentialSCSI : 1;
640	bool fHostSupportsSCAM : 1;
641	bool fHostUltraSCSI : 1;
642	bool fHostSmartTermination : 1;
643	unsigned char uReserved4 : 3;
644	} ReplyInquireExtendedSetupInformation, *PReplyInquireExtendedSetupInformation;
645	AssertCompileSize(ReplyInquireExtendedSetupInformation, 14);
646	#pragma pack()
647
648	/** Structure for the INITIALIZE EXTENDED MAILBOX request. */
649	#pragma pack(1)
650	typedef struct RequestInitializeExtendedMailbox
651	{
652	/** Number of mailboxes in guest memory. */
653	uint8_t cMailbox;
654	/** Physical address of the first mailbox. */
655	uint32_t uMailboxBaseAddress;
656	} RequestInitializeExtendedMailbox, *PRequestInitializeExtendedMailbox;
657	AssertCompileSize(RequestInitializeExtendedMailbox, 5);
658	#pragma pack()
659
660	/** Structure for the INITIALIZE MAILBOX request. */
661	typedef struct
662	{
663	/** Number of mailboxes to set up. */
664	uint8_t cMailbox;
665	/** Physical address of the first mailbox. */
666	Addr24 aMailboxBaseAddr;
667	} RequestInitMbx, *PRequestInitMbx;
668	AssertCompileSize(RequestInitMbx, 4);
669
670	/**
671	* Structure of a mailbox in guest memory.
672	* The incoming and outgoing mailbox have the same size
673	* but the incoming one has some more fields defined which
674	* are marked as reserved in the outgoing one.
675	* The last field is also different from the type.
676	* For outgoing mailboxes it is the action and
677	* for incoming ones the completion status code for the task.
678	* We use one structure for both types.
679	*/
680	typedef struct Mailbox32
681	{
682	/** Physical address of the CCB structure in the guest memory. */
683	uint32_t u32PhysAddrCCB;
684	/** Type specific data. */
685	union
686	{
687	/** For outgoing mailboxes. */
688	struct
689	{
690	/** Reserved */
691	uint8_t uReserved[3];
692	/** Action code. */
693	uint8_t uActionCode;
694	} out;
695	/** For incoming mailboxes. */
696	struct
697	{
698	/** The host adapter status after finishing the request. */
699	uint8_t uHostAdapterStatus;
700	/** The status of the device which executed the request after executing it. */
701	uint8_t uTargetDeviceStatus;
702	/** Reserved. */
703	uint8_t uReserved;
704	/** The completion status code of the request. */
705	uint8_t uCompletionCode;
706	} in;
707	} u;
708	} Mailbox32, *PMailbox32;
709	AssertCompileSize(Mailbox32, 8);
710
711	/** Old style 24-bit mailbox entry. */
712	typedef struct Mailbox24
713	{
714	/** Mailbox command (incoming) or state (outgoing). */
715	uint8_t uCmdState;
716	/** Physical address of the CCB structure in the guest memory. */
717	Addr24 aPhysAddrCCB;
718	} Mailbox24, *PMailbox24;
719	AssertCompileSize(Mailbox24, 4);
720
721	/**
722	* Action codes for outgoing mailboxes.
723	*/
724	enum BUSLOGIC_MAILBOX_OUTGOING_ACTION
725	{
726	BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE = 0x00,
727	BUSLOGIC_MAILBOX_OUTGOING_ACTION_START_COMMAND = 0x01,
728	BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND = 0x02
729	};
730
731	/**
732	* Completion codes for incoming mailboxes.
733	*/
734	enum BUSLOGIC_MAILBOX_INCOMING_COMPLETION
735	{
736	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_FREE = 0x00,
737	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITHOUT_ERROR = 0x01,
738	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED = 0x02,
739	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND = 0x03,
740	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR = 0x04,
741	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_INVALID_CCB = 0x05
742	};
743
744	/**
745	* Host adapter status for incoming mailboxes.
746	*/
747	enum BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS
748	{
749	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED = 0x00,
750	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CMD_COMPLETED = 0x0a,
751	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CMD_COMPLETED_WITH_FLAG = 0x0b,
752	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_DATA_UNDERUN = 0x0c,
753	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT = 0x11,
754	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_DATA_OVERRUN = 0x12,
755	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_UNEXPECTED_BUS_FREE = 0x13,
756	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_BUS_PHASE_REQUESTED = 0x14,
757	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_OUTGOING_MAILBOX_ACTION_CODE = 0x15,
758	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_OPERATION_CODE = 0x16,
759	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_LINKED_CCB_HAS_INVALID_LUN = 0x17,
760	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER = 0x1a,
761	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_AUTO_REQUEST_SENSE_FAILED = 0x1b,
762	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TAGGED_QUEUING_MESSAGE_REJECTED = 0x1c,
763	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_UNSUPPORTED_MESSAGE_RECEIVED = 0x1d,
764	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_HARDWARE_FAILED = 0x20,
765	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TARGET_FAILED_RESPONSE_TO_ATN = 0x21,
766	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_ASSERTED_RST = 0x22,
767	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_OTHER_DEVICE_ASSERTED_RST = 0x23,
768	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_TARGET_DEVICE_RECONNECTED_IMPROPERLY = 0x24,
769	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_ASSERTED_BUS_DEVICE_RESET = 0x25,
770	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED = 0x26,
771	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_SOFTWARE_ERROR = 0x27,
772	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_HOST_ADAPTER_HARDWARE_TIMEOUT_ERROR = 0x30,
773	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_PARITY_ERROR_DETECTED = 0x34
774	};
775
776	/**
777	* Device status codes for incoming mailboxes.
778	*/
779	enum BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS
780	{
781	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD = 0x00,
782	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_CHECK_CONDITION = 0x02,
783	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_DEVICE_BUSY = 0x08
784	};
785
786	/**
787	* Opcode types for CCB.
788	*/
789	enum BUSLOGIC_CCB_OPCODE
790	{
791	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB = 0x00,
792	BUSLOGIC_CCB_OPCODE_TARGET_CCB = 0x01,
793	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER = 0x02,
794	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH = 0x03,
795	BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER = 0x04,
796	BUSLOGIC_CCB_OPCODE_BUS_DEVICE_RESET = 0x81
797	};
798
799	/**
800	* Data transfer direction.
801	*/
802	enum BUSLOGIC_CCB_DIRECTION
803	{
804	BUSLOGIC_CCB_DIRECTION_UNKNOWN = 0x00,
805	BUSLOGIC_CCB_DIRECTION_IN = 0x01,
806	BUSLOGIC_CCB_DIRECTION_OUT = 0x02,
807	BUSLOGIC_CCB_DIRECTION_NO_DATA = 0x03
808	};
809
810	/**
811	* The command control block for a SCSI request.
812	*/
813	typedef struct CCB32
814	{
815	/** Opcode. */
816	uint8_t uOpcode;
817	/** Reserved */
818	unsigned char uReserved1 : 3;
819	/** Data direction for the request. */
820	unsigned char uDataDirection : 2;
821	/** Whether the request is tag queued. */
822	bool fTagQueued : 1;
823	/** Queue tag mode. */
824	unsigned char uQueueTag : 2;
825	/** Length of the SCSI CDB. */
826	uint8_t cbCDB;
827	/** Sense data length. */
828	uint8_t cbSenseData;
829	/** Data length. */
830	uint32_t cbData;
831	/** Data pointer.
832	* This points to the data region or a scatter gather list based on the opcode.
833	*/
834	uint32_t u32PhysAddrData;
835	/** Reserved. */
836	uint8_t uReserved2[2];
837	/** Host adapter status. */
838	uint8_t uHostAdapterStatus;
839	/** Device adapter status. */
840	uint8_t uDeviceStatus;
841	/** The device the request is sent to. */
842	uint8_t uTargetId;
843	/*The LUN in the device. /
844	unsigned char uLogicalUnit : 5;
845	/** Legacy tag. */
846	bool fLegacyTagEnable : 1;
847	/** Legacy queue tag. */
848	unsigned char uLegacyQueueTag : 2;
849	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
850	uint8_t abCDB[12];
851	/** Reserved. */
852	uint8_t uReserved3[6];
853	/** Sense data pointer. */
854	uint32_t u32PhysAddrSenseData;
855	} CCB32, *PCCB32;
856	AssertCompileSize(CCB32, 40);
857
858
859	/**
860	* The 24-bit command control block.
861	*/
862	typedef struct CCB24
863	{
864	/** Opcode. */
865	uint8_t uOpcode;
866	/** The LUN in the device. */
867	unsigned char uLogicalUnit : 3;
868	/** Data direction for the request. */
869	unsigned char uDataDirection : 2;
870	/** The target device ID. */
871	unsigned char uTargetId : 3;
872	/** Length of the SCSI CDB. */
873	uint8_t cbCDB;
874	/** Sense data length. */
875	uint8_t cbSenseData;
876	/** Data length. */
877	Len24 acbData;
878	/** Data pointer.
879	* This points to the data region or a scatter gather list based on the opc
880	*/
881	Addr24 aPhysAddrData;
882	/** Pointer to next CCB for linked commands. */
883	Addr24 aPhysAddrLink;
884	/** Command linking identifier. */
885	uint8_t uLinkId;
886	/** Host adapter status. */
887	uint8_t uHostAdapterStatus;
888	/** Device adapter status. */
889	uint8_t uDeviceStatus;
890	/** Two unused bytes. */
891	uint8_t aReserved[2];
892	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
893	uint8_t abCDB[12];
894	} CCB24, *PCCB24;
895	AssertCompileSize(CCB24, 30);
896
897	/**
898	* The common 24-bit/32-bit command control block. The 32-bit CCB is laid out
899	* such that many fields are in the same location as in the older 24-bit CCB.
900	*/
901	typedef struct CCBC
902	{
903	/** Opcode. */
904	uint8_t uOpcode;
905	/** The LUN in the device. */
906	unsigned char uPad1 : 3;
907	/** Data direction for the request. */
908	unsigned char uDataDirection : 2;
909	/** The target device ID. */
910	unsigned char uPad2 : 3;
911	/** Length of the SCSI CDB. */
912	uint8_t cbCDB;
913	/** Sense data length. */
914	uint8_t cbSenseData;
915	uint8_t aPad1[10];
916	/** Host adapter status. */
917	uint8_t uHostAdapterStatus;
918	/** Device adapter status. */
919	uint8_t uDeviceStatus;
920	uint8_t aPad2[2];
921	/** The SCSI CDB (up to 12 bytes). */
922	uint8_t abCDB[12];
923	} CCBC, *PCCBC;
924	AssertCompileSize(CCBC, 30);
925
926	/* Make sure that the 24-bit/32-bit/common CCB offsets match. */
927	AssertCompileMemberOffset(CCBC, cbCDB, 2);
928	AssertCompileMemberOffset(CCB24, cbCDB, 2);
929	AssertCompileMemberOffset(CCB32, cbCDB, 2);
930	AssertCompileMemberOffset(CCBC, uHostAdapterStatus, 14);
931	AssertCompileMemberOffset(CCB24, uHostAdapterStatus, 14);
932	AssertCompileMemberOffset(CCB32, uHostAdapterStatus, 14);
933	AssertCompileMemberOffset(CCBC, abCDB, 18);
934	AssertCompileMemberOffset(CCB24, abCDB, 18);
935	AssertCompileMemberOffset(CCB32, abCDB, 18);
936
937	/** A union of all CCB types (24-bit/32-bit/common). */
938	typedef union CCBU
939	{
940	CCB32 n; /*< New 32-bit CCB. /
941	CCB24 o; /*< Old 24-bit CCB. /
942	CCBC c; /*< Common CCB subset. /
943	} CCBU, *PCCBU;
944
945	/** 32-bit scatter-gather list entry. */
946	typedef struct SGE32
947	{
948	uint32_t cbSegment;
949	uint32_t u32PhysAddrSegmentBase;
950	} SGE32, *PSGE32;
951	AssertCompileSize(SGE32, 8);
952
953	/** 24-bit scatter-gather list entry. */
954	typedef struct SGE24
955	{
956	Len24 acbSegment;
957	Addr24 aPhysAddrSegmentBase;
958	} SGE24, *PSGE24;
959	AssertCompileSize(SGE24, 6);
960
961	/**
962	* The structure for the "Execute SCSI Command" command.
963	*/
964	typedef struct ESCMD
965	{
966	/** Data length. */
967	uint32_t cbData;
968	/** Data pointer. */
969	uint32_t u32PhysAddrData;
970	/** The device the request is sent to. */
971	uint8_t uTargetId;
972	/** The LUN in the device. */
973	uint8_t uLogicalUnit;
974	/** Reserved */
975	unsigned char uReserved1 : 3;
976	/** Data direction for the request. */
977	unsigned char uDataDirection : 2;
978	/** Reserved */
979	unsigned char uReserved2 : 3;
980	/** Length of the SCSI CDB. */
981	uint8_t cbCDB;
982	/** The SCSI CDB. (A CDB can be 12 bytes long.) */
983	uint8_t abCDB[12];
984	} ESCMD, *PESCMD;
985	AssertCompileSize(ESCMD, 24);
986
987	/**
988	* Task state for a CCB request.
989	*/
990	typedef struct BUSLOGICREQ
991	{
992	/** PDM extended media interface I/O request hande. */
993	PDMMEDIAEXIOREQ hIoReq;
994	/** Device this task is assigned to. */
995	PBUSLOGICDEVICE pTargetDevice;
996	/** The command control block from the guest. */
997	CCBU CCBGuest;
998	/** Guest physical address of th CCB. */
999	RTGCPHYS GCPhysAddrCCB;
1000	/** Pointer to the R3 sense buffer. */
1001	uint8_t *pbSenseBuffer;
1002	/** Flag whether this is a request from the BIOS. */
1003	bool fBIOS;
1004	/** 24-bit request flag (default is 32-bit). */
1005	bool fIs24Bit;
1006	/** SCSI status code. */
1007	uint8_t u8ScsiSts;
1008	} BUSLOGICREQ;
1009
1010	/**
1011	* S/G buffer copy arguments.
1012	*/
1013	typedef struct BUSLOGICCOPYARGS
1014	{
1015	/** Pointer to the shared BusLogic instance data. */
1016	PBUSLOGIC pThis;
1017	/** Pointer to the device instance data. */
1018	PPDMDEVINS pDevIns;
1019	/** Pointer to the SCSI command buffer. */
1020	PESCMD pCmd;
1021	/** Number of bytes copied already. */
1022	size_t cbCopied;
1023	} BUSLOGICCOPYARGS;
1024	/** Pointer to BUSLOGICCOPYARGS. */
1025	typedef BUSLOGICCOPYARGS *PBUSLOGICCOPYARGS;
1026
1027	#ifdef IN_RING3
1028	/**
1029	* Memory buffer callback.
1030	*
1031	* @returns nothing.
1032	* @param pDevIns The device instance.
1033	* @param pThis Pointer to the shared BusLogic instance data.
1034	* @param GCPhys The guest physical address of the memory buffer.
1035	* @param pSgBuf The pointer to the host R3 S/G buffer.
1036	* @param cbCopy How many bytes to copy between the two buffers.
1037	* @param pcbSkip Initially contains the amount of bytes to skip
1038	* starting from the guest physical address before
1039	* accessing the S/G buffer and start copying data.
1040	* On return this contains the remaining amount if
1041	* cbCopy < *pcbSkip or 0 otherwise.
1042	*/
1043	typedef DECLCALLBACKTYPE(void, FNBUSLOGICR3MEMCOPYCALLBACK,(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1044	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip));
1045	/** Pointer to a memory copy buffer callback. */
1046	typedef FNBUSLOGICR3MEMCOPYCALLBACK *PFNBUSLOGICR3MEMCOPYCALLBACK;
1047	#endif
1048
1049	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
1050
1051
1052	/*********************************************************************************************************************************
1053	* Internal Functions *
1054	*********************************************************************************************************************************/
1055	#ifdef IN_RING3
1056	static int buslogicR3RegisterISARange(PPDMDEVINS pDevIns, PBUSLOGIC pThis, uint8_t uBaseCode);
1057	#endif
1058
1059
1060	/**
1061	* Assert IRQ line of the BusLogic adapter. Rather than using
1062	* the more modern method of the guest explicitly only clearing
1063	* the interrupt causes it handled, BusLogic never reports all
1064	* interrupts at once. Instead, new interrupts are postponed if
1065	* an interrupt of a different type is still pending.
1066	*
1067	* @returns nothing.
1068	* @param pDevIns The device instance.
1069	* @param pThis Pointer to the shared BusLogic instance data.
1070	* @param fSuppressIrq Flag to suppress IRQ generation regardless of fIRQEnabled
1071	* @param uIrqType Type of interrupt being generated.
1072	*/
1073	static void buslogicSetInterrupt(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fSuppressIrq, uint8_t uIrqType)
1074	{
1075	LogFlowFunc(("pThis=%#p, setting %#02x (current %#02x, pending %#02x)\n",
1076	pThis, uIrqType, pThis->regInterrupt, pThis->uPendingIntr));
1077
1078	/* A CMDC interrupt overrides other pending interrupts. The documentation may claim
1079	* otherwise, but a real BT-958 replaces a pending IMBL with a CMDC; the IMBL simply
1080	* vanishes. However, if there's a CMDC already active, another CMDC is latched and
1081	* reported once the first CMDC is cleared.
1082	*/
1083	if (uIrqType & BL_INTR_CMDC)
1084	{
1085	Assert(uIrqType == BL_INTR_CMDC);
1086	if ((pThis->regInterrupt & BL_INTR_INTV) && !(pThis->regInterrupt & BL_INTR_CMDC))
1087	Log(("CMDC overriding pending interrupt! (was %02x)\n", pThis->regInterrupt));
1088	if (!(pThis->regInterrupt & BL_INTR_CMDC))
1089	pThis->regInterrupt \|= uIrqType \| BL_INTR_INTV; /* Report now. */
1090	else
1091	pThis->uPendingIntr \|= uIrqType; /* Report later. */
1092	}
1093	else if (uIrqType & (BL_INTR_IMBL \| BL_INTR_OMBR))
1094	{
1095	/* If the CMDC interrupt is pending, store IMBL/OMBR for later. Note that IMBL
1096	* and OMBR can be reported together even if an interrupt of the other type is
1097	* already pending.
1098	*/
1099	if (!(pThis->regInterrupt & BL_INTR_CMDC))
1100	pThis->regInterrupt \|= uIrqType \| BL_INTR_INTV; /* Report now. */
1101	else
1102	pThis->uPendingIntr \|= uIrqType; /* Report later. */
1103	}
1104	else /* We do not expect to see BL_INTR_RSTS at this point. */
1105	AssertMsgFailed(("Invalid interrupt state (unknown interrupt cause)!\n"));
1106	AssertMsg(pThis->regInterrupt, ("Invalid interrupt state (interrupt not set)!\n"));
1107	AssertMsg(pThis->regInterrupt != BL_INTR_INTV, ("Invalid interrupt state (set but no cause)!\n"));
1108
1109	if (pThis->fIRQEnabled && !fSuppressIrq)
1110	{
1111	if (!pThis->uIsaIrq)
1112	PDMDevHlpPCISetIrq(pDevIns, 0, 1);
1113	else
1114	PDMDevHlpISASetIrq(pDevIns, pThis->uIsaIrq, 1);
1115	}
1116	}
1117
1118	/**
1119	* Deasserts the interrupt line of the BusLogic adapter.
1120	*
1121	* @returns nothing.
1122	* @param pDevIns The device instance.
1123	* @param pThis Pointer to the shared BusLogic instance data.
1124	*/
1125	static void buslogicClearInterrupt(PPDMDEVINS pDevIns, PBUSLOGIC pThis)
1126	{
1127	LogFlowFunc(("pThis=%#p, clearing %#02x (pending %#02x)\n",
1128	pThis, pThis->regInterrupt, pThis->uPendingIntr));
1129	pThis->regInterrupt = 0;
1130	pThis->regStatus &= ~BL_STAT_CMDINV;
1131	if (!pThis->uIsaIrq)
1132	PDMDevHlpPCISetIrq(pDevIns, 0, 0);
1133	else
1134	PDMDevHlpISASetIrq(pDevIns, pThis->uIsaIrq, 0);
1135	/* If there's another pending interrupt, report it now. */
1136	if (pThis->uPendingIntr)
1137	{
1138	buslogicSetInterrupt(pDevIns, pThis, false, pThis->uPendingIntr);
1139	pThis->uPendingIntr = 0;
1140	}
1141	}
1142
1143	#if defined(IN_RING3)
1144
1145	/**
1146	* Advances the mailbox pointer to the next slot.
1147	*
1148	* @returns nothing.
1149	* @param pThis Pointer to the shared BusLogic instance data.
1150	*/
1151	DECLINLINE(void) buslogicR3OutgoingMailboxAdvance(PBUSLOGIC pThis)
1152	{
1153	pThis->uMailboxOutgoingPositionCurrent = (pThis->uMailboxOutgoingPositionCurrent + 1) % pThis->cMailbox;
1154	}
1155
1156	/**
1157	* Initialize local RAM of host adapter with default values.
1158	*
1159	* @returns nothing.
1160	* @param pThis Pointer to the shared BusLogic instance data.
1161	*/
1162	static void buslogicR3InitializeLocalRam(PBUSLOGIC pThis)
1163	{
1164	/*
1165	* These values are mostly from what I think is right
1166	* looking at the dmesg output from a Linux guest inside
1167	* a VMware server VM.
1168	*
1169	* So they don't have to be right :)
1170	*/
1171	memset(pThis->LocalRam.u8View, 0, sizeof(HostAdapterLocalRam));
1172	pThis->LocalRam.structured.autoSCSIData.fLevelSensitiveInterrupt = true;
1173	pThis->LocalRam.structured.autoSCSIData.fParityCheckingEnabled = true;
1174	pThis->LocalRam.structured.autoSCSIData.fExtendedTranslation = true; /* Same as in geometry register. */
1175	pThis->LocalRam.structured.autoSCSIData.u16DeviceEnabledMask = UINT16_MAX; /* All enabled. Maybe mask out non present devices? */
1176	pThis->LocalRam.structured.autoSCSIData.u16WidePermittedMask = UINT16_MAX;
1177	pThis->LocalRam.structured.autoSCSIData.u16FastPermittedMask = UINT16_MAX;
1178	pThis->LocalRam.structured.autoSCSIData.u16SynchronousPermittedMask = UINT16_MAX;
1179	pThis->LocalRam.structured.autoSCSIData.u16DisconnectPermittedMask = UINT16_MAX;
1180	pThis->LocalRam.structured.autoSCSIData.fStrictRoundRobinMode = pThis->fStrictRoundRobinMode;
1181	pThis->LocalRam.structured.autoSCSIData.u16UltraPermittedMask = UINT16_MAX;
1182	pThis->LocalRam.structured.autoSCSIData.uSCSIId = 7;
1183	pThis->LocalRam.structured.autoSCSIData.uHostAdapterIoPortAddress = pThis->uDefaultISABaseCode == ISA_BASE_DISABLED ? 2 : pThis->uDefaultISABaseCode;
1184	/** @todo calculate checksum? */
1185	}
1186
1187	/**
1188	* Do a hardware reset of the buslogic adapter.
1189	*
1190	* @returns VBox status code.
1191	* @param pDevIns The device instance.
1192	* @param pThis Pointer to the shared BusLogic instance data.
1193	* @param fResetIO Flag determining whether ISA I/O should be reset.
1194	*/
1195	static int buslogicR3HwReset(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fResetIO)
1196	{
1197	LogFlowFunc(("pThis=%#p\n", pThis));
1198
1199	/* Reset registers to default values. */
1200	pThis->regStatus = BL_STAT_HARDY \| BL_STAT_INREQ;
1201	pThis->regGeometry = BL_GEOM_XLATEN;
1202	pThis->uOperationCode = 0xff; /* No command executing. */
1203	pThis->uPrevCmd = 0xff;
1204	pThis->iParameter = 0;
1205	pThis->cbCommandParametersLeft = 0;
1206	pThis->fIRQEnabled = true;
1207	pThis->fStrictRoundRobinMode = false;
1208	pThis->fExtendedLunCCBFormat = false;
1209	pThis->uMailboxOutgoingPositionCurrent = 0;
1210	pThis->uMailboxIncomingPositionCurrent = 0;
1211	pThis->uAhaSigIdx = 0;
1212	pThis->cMailbox = 0;
1213	pThis->GCPhysAddrMailboxIncomingBase = 0;
1214	pThis->GCPhysAddrMailboxOutgoingBase = 0;
1215
1216	/* Clear any active/pending interrupts. */
1217	pThis->uPendingIntr = 0;
1218	buslogicClearInterrupt(pDevIns, pThis);
1219
1220	/* Guest-initiated HBA reset does not affect ISA port I/O. */
1221	if (fResetIO)
1222	buslogicR3RegisterISARange(pDevIns, pThis, pThis->uDefaultISABaseCode);
1223	buslogicR3InitializeLocalRam(pThis);
1224
1225	return VINF_SUCCESS;
1226	}
1227
1228	#endif /* IN_RING3 */
1229
1230	/**
1231	* Resets the command state machine for the next command and notifies the guest.
1232	* Note that suppressing CMDC also suppresses the interrupt, but not vice versa.
1233	*
1234	* @returns nothing.
1235	* @param pDevIns The device instance.
1236	* @param pThis Pointer to the shared BusLogic instance data.
1237	* @param fSuppressIrq Flag to suppress IRQ generation regardless of current state
1238	* @param fSuppressCMDC Flag to suppress command completion status as well
1239	*/
1240	static void buslogicCommandComplete(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fSuppressIrq, bool fSuppressCMDC)
1241	{
1242	LogFlowFunc(("pThis=%#p\n", pThis));
1243	Assert(pThis->uOperationCode != BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND);
1244
1245	pThis->fUseLocalRam = false;
1246	pThis->regStatus \|= BL_STAT_HARDY;
1247	pThis->regStatus &= ~BL_STAT_DIRRDY;
1248	pThis->iReply = 0;
1249
1250	/* Some commands do not set CMDC when successful. */
1251	if (!fSuppressCMDC)
1252	{
1253	/* Notify that the command is complete. */
1254	buslogicSetInterrupt(pDevIns, pThis, fSuppressIrq, BL_INTR_CMDC);
1255	}
1256
1257	pThis->uPrevCmd = pThis->uOperationCode;
1258	pThis->uOperationCode = 0xff;
1259	pThis->iParameter = 0;
1260	}
1261
1262	/**
1263	* Memory write helper to handle PCI/ISA differences - metadata writes.
1264	*
1265	* @returns nothing.
1266	* @param pDevIns The device instance.
1267	* @param pThis Pointer to the shared BusLogic instance data.
1268	* @param GCPhys Guest physical memory address
1269	* @param pvBuf Host side buffer address
1270	* @param cbWrite Number of bytes to write
1271	*/
1272	static void blPhysWriteMeta(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
1273	{
1274	if (!pThis->uIsaIrq)
1275	PDMDevHlpPCIPhysWriteMeta(pDevIns, GCPhys, pvBuf, cbWrite);
1276	else
1277	PDMDevHlpPhysWriteMeta(pDevIns, GCPhys, pvBuf, cbWrite);
1278	}
1279
1280	/**
1281	* Memory read helper to handle PCI/ISA differences - metadata reads.
1282	*
1283	* @returns nothing.
1284	* @param pDevIns The device instance.
1285	* @param pThis Pointer to the shared BusLogic instance data.
1286	* @param GCPhys Guest physical memory address.
1287	* @param pvBuf Host side buffer address.
1288	* @param cbRead Number of bytes to read.
1289	*/
1290	static void blPhysReadMeta(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
1291	{
1292	if (!pThis->uIsaIrq)
1293	PDMDevHlpPCIPhysReadMeta(pDevIns, GCPhys, pvBuf, cbRead);
1294	else
1295	PDMDevHlpPhysReadMeta(pDevIns, GCPhys, pvBuf, cbRead);
1296	}
1297
1298	#if defined(IN_RING3)
1299
1300	/**
1301	* Memory write helper to handle PCI/ISA differences - userdata writes.
1302	*
1303	* @returns nothing.
1304	* @param pDevIns The device instance.
1305	* @param pThis Pointer to the shared BusLogic instance data.
1306	* @param GCPhys Guest physical memory address
1307	* @param pvBuf Host side buffer address
1308	* @param cbWrite Number of bytes to write
1309	*/
1310	static void blPhysWriteUser(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
1311	{
1312	if (!pThis->uIsaIrq)
1313	PDMDevHlpPCIPhysWriteUser(pDevIns, GCPhys, pvBuf, cbWrite);
1314	else
1315	PDMDevHlpPhysWriteUser(pDevIns, GCPhys, pvBuf, cbWrite);
1316	}
1317
1318	/**
1319	* Memory read helper to handle PCI/ISA differences - userdata reads.
1320	*
1321	* @returns nothing.
1322	* @param pDevIns The device instance.
1323	* @param pThis Pointer to the shared BusLogic instance data.
1324	* @param GCPhys Guest physical memory address.
1325	* @param pvBuf Host side buffer address.
1326	* @param cbRead Number of bytes to read.
1327	*/
1328	static void blPhysReadUser(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
1329	{
1330	if (!pThis->uIsaIrq)
1331	PDMDevHlpPCIPhysReadUser(pDevIns, GCPhys, pvBuf, cbRead);
1332	else
1333	PDMDevHlpPhysReadUser(pDevIns, GCPhys, pvBuf, cbRead);
1334	}
1335
1336	/**
1337	* Initiates a hard reset which was issued from the guest.
1338	*
1339	* @returns nothing
1340	* @param pDevIns The device instance.
1341	* @param pThis Pointer to the shared BusLogic instance data.
1342	* @param fHardReset Flag initiating a hard (vs. soft) reset.
1343	*/
1344	static void buslogicR3InitiateReset(PPDMDEVINS pDevIns, PBUSLOGIC pThis, bool fHardReset)
1345	{
1346	LogFlowFunc(("pThis=%#p fHardReset=%d\n", pThis, fHardReset));
1347
1348	buslogicR3HwReset(pDevIns, pThis, false);
1349
1350	if (fHardReset)
1351	{
1352	/* Set the diagnostic active bit in the status register and clear the ready state. */
1353	pThis->regStatus \|= BL_STAT_DACT;
1354	pThis->regStatus &= ~BL_STAT_HARDY;
1355
1356	/* Remember when the guest initiated a reset (after we're done resetting). */
1357	pThis->u64ResetTime = PDMDevHlpTMTimeVirtGetNano(pDevIns);
1358	}
1359	}
1360
1361
1362	/**
1363	* Send a mailbox with set status codes to the guest.
1364	*
1365	* @returns nothing.
1366	* @param pDevIns The device instance.
1367	* @param pThis Pointer to the shared BusLogic instance data.
1368	* @param GCPhysAddrCCB The physical guest address of the CCB the mailbox is for.
1369	* @param pCCBGuest The command control block.
1370	* @param uHostAdapterStatus The host adapter status code to set.
1371	* @param uDeviceStatus The target device status to set.
1372	* @param uMailboxCompletionCode Completion status code to set in the mailbox.
1373	*/
1374	static void buslogicR3SendIncomingMailbox(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhysAddrCCB,
1375	PCCBU pCCBGuest, uint8_t uHostAdapterStatus,
1376	uint8_t uDeviceStatus, uint8_t uMailboxCompletionCode)
1377	{
1378	Mailbox32 MbxIn;
1379
1380	MbxIn.u32PhysAddrCCB = (uint32_t)GCPhysAddrCCB;
1381	MbxIn.u.in.uHostAdapterStatus = uHostAdapterStatus;
1382	MbxIn.u.in.uTargetDeviceStatus = uDeviceStatus;
1383	MbxIn.u.in.uReserved = 0;
1384	MbxIn.u.in.uCompletionCode = uMailboxCompletionCode;
1385
1386	int rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSectIntr, VINF_SUCCESS);
1387	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pThis->CritSectIntr, rc);
1388
1389	RTGCPHYS GCPhysAddrMailboxIncoming = pThis->GCPhysAddrMailboxIncomingBase
1390	+ ( pThis->uMailboxIncomingPositionCurrent
1391	* (pThis->fMbxIs24Bit ? sizeof(Mailbox24) : sizeof(Mailbox32)) );
1392
1393	if (uMailboxCompletionCode != BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND)
1394	{
1395	LogFlowFunc(("Completing CCB %RGp hstat=%u, dstat=%u, outgoing mailbox at %RGp\n", GCPhysAddrCCB,
1396	uHostAdapterStatus, uDeviceStatus, GCPhysAddrMailboxIncoming));
1397
1398	/* Update CCB. */
1399	pCCBGuest->c.uHostAdapterStatus = uHostAdapterStatus;
1400	pCCBGuest->c.uDeviceStatus = uDeviceStatus;
1401	/* Rewrite CCB up to the CDB; perhaps more than necessary. */
1402	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrCCB, pCCBGuest, RT_UOFFSETOF(CCBC, abCDB));
1403	}
1404
1405	# ifdef RT_STRICT
1406	uint8_t uCode;
1407	unsigned uCodeOffs = pThis->fMbxIs24Bit ? RT_OFFSETOF(Mailbox24, uCmdState) : RT_OFFSETOF(Mailbox32, u.out.uActionCode);
1408	blPhysReadMeta(pDevIns, pThis, GCPhysAddrMailboxIncoming + uCodeOffs, &uCode, sizeof(uCode));
1409	Assert(uCode == BUSLOGIC_MAILBOX_INCOMING_COMPLETION_FREE);
1410	# endif
1411
1412	/* Update mailbox. */
1413	if (pThis->fMbxIs24Bit)
1414	{
1415	Mailbox24 Mbx24;
1416
1417	Mbx24.uCmdState = MbxIn.u.in.uCompletionCode;
1418	U32_TO_ADDR(Mbx24.aPhysAddrCCB, MbxIn.u32PhysAddrCCB);
1419	Log(("24-bit mailbox: completion code=%u, CCB at %RGp\n", Mbx24.uCmdState, (RTGCPHYS)ADDR_TO_U32(Mbx24.aPhysAddrCCB)));
1420	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrMailboxIncoming, &Mbx24, sizeof(Mailbox24));
1421	}
1422	else
1423	{
1424	Log(("32-bit mailbox: completion code=%u, CCB at %RGp\n", MbxIn.u.in.uCompletionCode, GCPhysAddrCCB));
1425	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrMailboxIncoming, &MbxIn, sizeof(Mailbox32));
1426	}
1427
1428	/* Advance to next mailbox position. */
1429	pThis->uMailboxIncomingPositionCurrent++;
1430	if (pThis->uMailboxIncomingPositionCurrent >= pThis->cMailbox)
1431	pThis->uMailboxIncomingPositionCurrent = 0;
1432
1433	# ifdef LOG_ENABLED
1434	ASMAtomicIncU32(&pThis->cInMailboxesReadyIfLogEnabled);
1435	# endif
1436
1437	buslogicSetInterrupt(pDevIns, pThis, false, BL_INTR_IMBL);
1438
1439	PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSectIntr);
1440	}
1441
1442	# ifdef LOG_ENABLED
1443
1444	/**
1445	* Dumps the content of a mailbox for debugging purposes.
1446	*
1447	* @return nothing
1448	* @param pMailbox The mailbox to dump.
1449	* @param fOutgoing true if dumping the outgoing state.
1450	* false if dumping the incoming state.
1451	*/
1452	static void buslogicR3DumpMailboxInfo(PMailbox32 pMailbox, bool fOutgoing)
1453	{
1454	Log(("%s: Dump for %s mailbox:\n", __FUNCTION__, fOutgoing ? "outgoing" : "incoming"));
1455	Log(("%s: u32PhysAddrCCB=%#x\n", __FUNCTION__, pMailbox->u32PhysAddrCCB));
1456	if (fOutgoing)
1457	{
1458	Log(("%s: uActionCode=%u\n", __FUNCTION__, pMailbox->u.out.uActionCode));
1459	}
1460	else
1461	{
1462	Log(("%s: uHostAdapterStatus=%u\n", __FUNCTION__, pMailbox->u.in.uHostAdapterStatus));
1463	Log(("%s: uTargetDeviceStatus=%u\n", __FUNCTION__, pMailbox->u.in.uTargetDeviceStatus));
1464	Log(("%s: uCompletionCode=%u\n", __FUNCTION__, pMailbox->u.in.uCompletionCode));
1465	}
1466	}
1467
1468	/**
1469	* Dumps the content of a command control block for debugging purposes.
1470	*
1471	* @returns nothing.
1472	* @param pCCB Pointer to the command control block to dump.
1473	* @param fIs24BitCCB Flag to determine CCB format.
1474	*/
1475	static void buslogicR3DumpCCBInfo(PCCBU pCCB, bool fIs24BitCCB)
1476	{
1477	Log(("%s: Dump for %s Command Control Block:\n", __FUNCTION__, fIs24BitCCB ? "24-bit" : "32-bit"));
1478	Log(("%s: uOpCode=%#x\n", __FUNCTION__, pCCB->c.uOpcode));
1479	Log(("%s: uDataDirection=%u\n", __FUNCTION__, pCCB->c.uDataDirection));
1480	Log(("%s: cbCDB=%u\n", __FUNCTION__, pCCB->c.cbCDB));
1481	Log(("%s: cbSenseData=%u\n", __FUNCTION__, pCCB->c.cbSenseData));
1482	Log(("%s: uHostAdapterStatus=%u\n", __FUNCTION__, pCCB->c.uHostAdapterStatus));
1483	Log(("%s: uDeviceStatus=%u\n", __FUNCTION__, pCCB->c.uDeviceStatus));
1484	if (fIs24BitCCB)
1485	{
1486	Log(("%s: cbData=%u\n", __FUNCTION__, LEN_TO_U32(pCCB->o.acbData)));
1487	Log(("%s: PhysAddrData=%#x\n", __FUNCTION__, ADDR_TO_U32(pCCB->o.aPhysAddrData)));
1488	Log(("%s: uTargetId=%u\n", __FUNCTION__, pCCB->o.uTargetId));
1489	Log(("%s: uLogicalUnit=%u\n", __FUNCTION__, pCCB->o.uLogicalUnit));
1490	}
1491	else
1492	{
1493	Log(("%s: cbData=%u\n", __FUNCTION__, pCCB->n.cbData));
1494	Log(("%s: PhysAddrData=%#x\n", __FUNCTION__, pCCB->n.u32PhysAddrData));
1495	Log(("%s: uTargetId=%u\n", __FUNCTION__, pCCB->n.uTargetId));
1496	Log(("%s: uLogicalUnit=%u\n", __FUNCTION__, pCCB->n.uLogicalUnit));
1497	Log(("%s: fTagQueued=%d\n", __FUNCTION__, pCCB->n.fTagQueued));
1498	Log(("%s: uQueueTag=%u\n", __FUNCTION__, pCCB->n.uQueueTag));
1499	Log(("%s: fLegacyTagEnable=%u\n", __FUNCTION__, pCCB->n.fLegacyTagEnable));
1500	Log(("%s: uLegacyQueueTag=%u\n", __FUNCTION__, pCCB->n.uLegacyQueueTag));
1501	Log(("%s: PhysAddrSenseData=%#x\n", __FUNCTION__, pCCB->n.u32PhysAddrSenseData));
1502	}
1503	Log(("%s: uCDB[0]=%#x\n", __FUNCTION__, pCCB->c.abCDB[0]));
1504	for (int i = 1; i < pCCB->c.cbCDB; i++)
1505	Log(("%s: uCDB[%d]=%u\n", __FUNCTION__, i, pCCB->c.abCDB[i]));
1506	}
1507
1508	# endif /* LOG_ENABLED */
1509
1510	/**
1511	* Allocate data buffer.
1512	*
1513	* @param pDevIns PDM device instance.
1514	* @param fIs24Bit Flag whether the 24bit SG format is used.
1515	* @param GCSGList Guest physical address of S/G list.
1516	* @param cEntries Number of list entries to read.
1517	* @param pSGEList Pointer to 32-bit S/G list storage.
1518	*/
1519	static void buslogicR3ReadSGEntries(PPDMDEVINS pDevIns, bool fIs24Bit, RTGCPHYS GCSGList,
1520	uint32_t cEntries, SGE32 *pSGEList)
1521	{
1522	/* Read the S/G entries. Convert 24-bit entries to 32-bit format. */
1523	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
1524	if (fIs24Bit)
1525	{
1526	SGE24 aSGE24[32];
1527	Assert(cEntries <= RT_ELEMENTS(aSGE24));
1528
1529	Log2(("Converting %u 24-bit S/G entries to 32-bit\n", cEntries));
1530	blPhysReadMeta(pDevIns, pThis, GCSGList, &aSGE24, cEntries * sizeof(SGE24));
1531	for (uint32_t i = 0; i < cEntries; ++i)
1532	{
1533	pSGEList[i].cbSegment = LEN_TO_U32(aSGE24[i].acbSegment);
1534	pSGEList[i].u32PhysAddrSegmentBase = ADDR_TO_U32(aSGE24[i].aPhysAddrSegmentBase);
1535	}
1536	}
1537	else
1538	blPhysReadMeta(pDevIns, pThis, GCSGList, pSGEList, cEntries * sizeof(SGE32));
1539	}
1540
1541	/**
1542	* Determines the size of th guest data buffer.
1543	*
1544	* @returns VBox status code.
1545	* @param pDevIns PDM device instance.
1546	* @param pCCBGuest The CCB of the guest.
1547	* @param fIs24Bit Flag whether the 24bit SG format is used.
1548	* @param pcbBuf Where to store the size of the guest data buffer on success.
1549	*/
1550	static int buslogicR3QueryDataBufferSize(PPDMDEVINS pDevIns, PCCBU pCCBGuest, bool fIs24Bit, size_t *pcbBuf)
1551	{
1552	int rc = VINF_SUCCESS;
1553	uint32_t cbDataCCB;
1554	uint32_t u32PhysAddrCCB;
1555	size_t cbBuf = 0;
1556
1557	/* Extract the data length and physical address from the CCB. */
1558	if (fIs24Bit)
1559	{
1560	u32PhysAddrCCB = ADDR_TO_U32(pCCBGuest->o.aPhysAddrData);
1561	cbDataCCB = LEN_TO_U32(pCCBGuest->o.acbData);
1562	}
1563	else
1564	{
1565	u32PhysAddrCCB = pCCBGuest->n.u32PhysAddrData;
1566	cbDataCCB = pCCBGuest->n.cbData;
1567	}
1568
1569	#if 1
1570	/* Hack for NT 10/91: A CCB describes a 2K buffer, but TEST UNIT READY is executed. This command
1571	* returns no data, hence the buffer must be left alone!
1572	*/
1573	if (pCCBGuest->c.abCDB[0] == 0)
1574	cbDataCCB = 0;
1575	#endif
1576
1577	if ( (pCCBGuest->c.uDataDirection != BUSLOGIC_CCB_DIRECTION_NO_DATA)
1578	&& cbDataCCB)
1579	{
1580	/*
1581	* The BusLogic adapter can handle two different data buffer formats.
1582	* The first one is that the data pointer entry in the CCB points to
1583	* the buffer directly. In second mode the data pointer points to a
1584	* scatter gather list which describes the buffer.
1585	*/
1586	if ( (pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER)
1587	\|\| (pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
1588	{
1589	uint32_t cScatterGatherGCRead;
1590	uint32_t iScatterGatherEntry;
1591	SGE32 aScatterGatherReadGC[32]; /* A buffer for scatter gather list entries read from guest memory. */
1592	uint32_t cScatterGatherGCLeft = cbDataCCB / (fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1593	RTGCPHYS GCPhysAddrScatterGatherCurrent = u32PhysAddrCCB;
1594
1595	/* Count number of bytes to transfer. */
1596	do
1597	{
1598	cScatterGatherGCRead = (cScatterGatherGCLeft < RT_ELEMENTS(aScatterGatherReadGC))
1599	? cScatterGatherGCLeft
1600	: RT_ELEMENTS(aScatterGatherReadGC);
1601	cScatterGatherGCLeft -= cScatterGatherGCRead;
1602
1603	buslogicR3ReadSGEntries(pDevIns, fIs24Bit, GCPhysAddrScatterGatherCurrent, cScatterGatherGCRead, aScatterGatherReadGC);
1604
1605	for (iScatterGatherEntry = 0; iScatterGatherEntry < cScatterGatherGCRead; iScatterGatherEntry++)
1606	cbBuf += aScatterGatherReadGC[iScatterGatherEntry].cbSegment;
1607
1608	/* Set address to the next entries to read. */
1609	GCPhysAddrScatterGatherCurrent += cScatterGatherGCRead * (fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1610	} while (cScatterGatherGCLeft > 0);
1611
1612	Log(("%s: cbBuf=%d\n", __FUNCTION__, cbBuf));
1613	}
1614	else if ( pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB
1615	\|\| pCCBGuest->c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
1616	cbBuf = cbDataCCB;
1617	}
1618
1619	if (RT_SUCCESS(rc))
1620	*pcbBuf = cbBuf;
1621
1622	return rc;
1623	}
1624
1625	/**
1626	* Copy from guest to host memory worker.
1627	*
1628	* @copydoc FNBUSLOGICR3MEMCOPYCALLBACK
1629	*/
1630	static DECLCALLBACK(void) buslogicR3CopyBufferFromGuestWorker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1631	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip)
1632	{
1633	size_t cbSkipped = RT_MIN(cbCopy, *pcbSkip);
1634	cbCopy -= cbSkipped;
1635	GCPhys += cbSkipped;
1636	*pcbSkip -= cbSkipped;
1637
1638	while (cbCopy)
1639	{
1640	size_t cbSeg = cbCopy;
1641	void *pvSeg = RTSgBufGetNextSegment(pSgBuf, &cbSeg);
1642
1643	AssertPtr(pvSeg);
1644	blPhysReadUser(pDevIns, pThis, GCPhys, pvSeg, cbSeg);
1645	GCPhys += cbSeg;
1646	cbCopy -= cbSeg;
1647	}
1648	}
1649
1650	/**
1651	* Copy from host to guest memory worker.
1652	*
1653	* @copydoc FNBUSLOGICR3MEMCOPYCALLBACK
1654	*/
1655	static DECLCALLBACK(void) buslogicR3CopyBufferToGuestWorker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhys,
1656	PRTSGBUF pSgBuf, size_t cbCopy, size_t *pcbSkip)
1657	{
1658	size_t cbSkipped = RT_MIN(cbCopy, *pcbSkip);
1659	cbCopy -= cbSkipped;
1660	GCPhys += cbSkipped;
1661	*pcbSkip -= cbSkipped;
1662
1663	while (cbCopy)
1664	{
1665	size_t cbSeg = cbCopy;
1666	void *pvSeg = RTSgBufGetNextSegment(pSgBuf, &cbSeg);
1667
1668	AssertPtr(pvSeg);
1669	blPhysWriteUser(pDevIns, pThis, GCPhys, pvSeg, cbSeg);
1670	GCPhys += cbSeg;
1671	cbCopy -= cbSeg;
1672	}
1673	}
1674
1675	/**
1676	* Walks the guest S/G buffer calling the given copy worker for every buffer.
1677	*
1678	* @returns The amout of bytes actually copied.
1679	* @param pDevIns The device instance.
1680	* @param pThis Pointer to the Buslogic device state.
1681	* @param pReq Pointer to the request state.
1682	* @param pfnCopyWorker The copy method to apply for each guest buffer.
1683	* @param pSgBuf The host S/G buffer.
1684	* @param cbSkip How many bytes to skip in advance before starting to copy.
1685	* @param cbCopy How many bytes to copy.
1686	*/
1687	static size_t buslogicR3SgBufWalker(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1688	PFNBUSLOGICR3MEMCOPYCALLBACK pfnCopyWorker,
1689	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1690	{
1691	uint32_t cbDataCCB;
1692	uint32_t u32PhysAddrCCB;
1693	size_t cbCopied = 0;
1694
1695	/*
1696	* Add the amount to skip to the host buffer size to avoid a
1697	* few conditionals later on.
1698	*/
1699	cbCopy += cbSkip;
1700
1701	/* Extract the data length and physical address from the CCB. */
1702	if (pReq->fIs24Bit)
1703	{
1704	u32PhysAddrCCB = ADDR_TO_U32(pReq->CCBGuest.o.aPhysAddrData);
1705	cbDataCCB = LEN_TO_U32(pReq->CCBGuest.o.acbData);
1706	}
1707	else
1708	{
1709	u32PhysAddrCCB = pReq->CCBGuest.n.u32PhysAddrData;
1710	cbDataCCB = pReq->CCBGuest.n.cbData;
1711	}
1712
1713	#if 1
1714	/* Hack for NT 10/91: A CCB describes a 2K buffer, but TEST UNIT READY is executed. This command
1715	* returns no data, hence the buffer must be left alone!
1716	*/
1717	if (pReq->CCBGuest.c.abCDB[0] == 0)
1718	cbDataCCB = 0;
1719	#endif
1720
1721	LogFlowFunc(("pReq=%#p cbDataCCB=%u direction=%u cbCopy=%zu\n", pReq, cbDataCCB,
1722	pReq->CCBGuest.c.uDataDirection, cbCopy));
1723
1724	if ( (cbDataCCB > 0)
1725	&& ( pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_IN
1726	\|\| pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_OUT
1727	\|\| pReq->CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_UNKNOWN))
1728	{
1729	if ( (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_SCATTER_GATHER)
1730	\|\| (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
1731	{
1732	uint32_t cScatterGatherGCRead;
1733	uint32_t iScatterGatherEntry;
1734	SGE32 aScatterGatherReadGC[32]; /* Number of scatter gather list entries read from guest memory. */
1735	uint32_t cScatterGatherGCLeft = cbDataCCB / (pReq->fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1736	RTGCPHYS GCPhysAddrScatterGatherCurrent = u32PhysAddrCCB;
1737
1738	do
1739	{
1740	cScatterGatherGCRead = (cScatterGatherGCLeft < RT_ELEMENTS(aScatterGatherReadGC))
1741	? cScatterGatherGCLeft
1742	: RT_ELEMENTS(aScatterGatherReadGC);
1743	cScatterGatherGCLeft -= cScatterGatherGCRead;
1744
1745	buslogicR3ReadSGEntries(pDevIns, pReq->fIs24Bit, GCPhysAddrScatterGatherCurrent,
1746	cScatterGatherGCRead, aScatterGatherReadGC);
1747
1748	for (iScatterGatherEntry = 0; iScatterGatherEntry < cScatterGatherGCRead && cbCopy > 0; iScatterGatherEntry++)
1749	{
1750	RTGCPHYS GCPhysAddrDataBase;
1751	size_t cbCopyThis;
1752
1753	Log(("%s: iScatterGatherEntry=%u\n", __FUNCTION__, iScatterGatherEntry));
1754
1755	GCPhysAddrDataBase = (RTGCPHYS)aScatterGatherReadGC[iScatterGatherEntry].u32PhysAddrSegmentBase;
1756	cbCopyThis = RT_MIN(cbCopy, aScatterGatherReadGC[iScatterGatherEntry].cbSegment);
1757
1758	Log(("%s: GCPhysAddrDataBase=%RGp cbCopyThis=%zu\n", __FUNCTION__, GCPhysAddrDataBase, cbCopyThis));
1759
1760	pfnCopyWorker(pDevIns, pThis, GCPhysAddrDataBase, pSgBuf, cbCopyThis, &cbSkip);
1761	cbCopied += cbCopyThis;
1762	cbCopy -= cbCopyThis;
1763	}
1764
1765	/* Set address to the next entries to read. */
1766	GCPhysAddrScatterGatherCurrent += cScatterGatherGCRead * (pReq->fIs24Bit ? sizeof(SGE24) : sizeof(SGE32));
1767	} while ( cScatterGatherGCLeft > 0
1768	&& cbCopy > 0);
1769
1770	}
1771	else if ( pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB
1772	\|\| pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
1773	{
1774	/* The buffer is not scattered. */
1775	RTGCPHYS GCPhysAddrDataBase = u32PhysAddrCCB;
1776
1777	AssertMsg(GCPhysAddrDataBase != 0, ("Physical address is 0\n"));
1778
1779	Log(("Non-scattered buffer:\n"));
1780	Log(("u32PhysAddrData=%#x\n", u32PhysAddrCCB));
1781	Log(("cbData=%u\n", cbDataCCB));
1782	Log(("GCPhysAddrDataBase=0x%RGp\n", GCPhysAddrDataBase));
1783
1784	/* Copy the data into the guest memory. */
1785	pfnCopyWorker(pDevIns, pThis, GCPhysAddrDataBase, pSgBuf, RT_MIN(cbDataCCB, cbCopy), &cbSkip);
1786	cbCopied += RT_MIN(cbDataCCB, cbCopy);
1787	}
1788	}
1789
1790	return cbCopied - RT_MIN(cbSkip, cbCopied);
1791	}
1792
1793	/**
1794	* Copies a data buffer into the S/G buffer set up by the guest.
1795	*
1796	* @returns Amount of bytes copied to the guest.
1797	* @param pDevIns The device instance.
1798	* @param pThis Pointer to the shared BusLogic instance data.
1799	* @param pReq Request structure.
1800	* @param pSgBuf The S/G buffer to copy from.
1801	* @param cbSkip How many bytes to skip in advance before starting to copy.
1802	* @param cbCopy How many bytes to copy.
1803	*/
1804	static size_t buslogicR3CopySgBufToGuest(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1805	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1806	{
1807	return buslogicR3SgBufWalker(pDevIns, pThis, pReq, buslogicR3CopyBufferToGuestWorker, pSgBuf, cbSkip, cbCopy);
1808	}
1809
1810	/**
1811	* Copies the guest S/G buffer into a host data buffer.
1812	*
1813	* @returns Amount of bytes copied from the guest.
1814	* @param pDevIns The device instance.
1815	* @param pThis Pointer to the shared BusLogic instance data.
1816	* @param pReq Request structure.
1817	* @param pSgBuf The S/G buffer to copy into.
1818	* @param cbSkip How many bytes to skip in advance before starting to copy.
1819	* @param cbCopy How many bytes to copy.
1820	*/
1821	static size_t buslogicR3CopySgBufFromGuest(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICREQ pReq,
1822	PRTSGBUF pSgBuf, size_t cbSkip, size_t cbCopy)
1823	{
1824	return buslogicR3SgBufWalker(pDevIns, pThis, pReq, buslogicR3CopyBufferFromGuestWorker, pSgBuf, cbSkip, cbCopy);
1825	}
1826
1827	/** Convert sense buffer length taking into account shortcut values. */
1828	static uint32_t buslogicR3ConvertSenseBufferLength(uint32_t cbSense)
1829	{
1830	/* Convert special sense buffer length values. */
1831	if (cbSense == 0)
1832	cbSense = 14; /* 0 means standard 14-byte buffer. */
1833	else if (cbSense == 1)
1834	cbSense = 0; /* 1 means no sense data. */
1835	else if (cbSense < 8)
1836	AssertMsgFailed(("Reserved cbSense value of %d used!\n", cbSense));
1837
1838	return cbSense;
1839	}
1840
1841	/**
1842	* Free the sense buffer.
1843	*
1844	* @returns nothing.
1845	* @param pReq Pointer to the request state.
1846	* @param fCopy If sense data should be copied to guest memory.
1847	*/
1848	static void buslogicR3SenseBufferFree(PBUSLOGICREQ pReq, bool fCopy)
1849	{
1850	uint32_t cbSenseBuffer;
1851
1852	cbSenseBuffer = buslogicR3ConvertSenseBufferLength(pReq->CCBGuest.c.cbSenseData);
1853
1854	/* Copy the sense buffer into guest memory if requested. */
1855	if (fCopy && cbSenseBuffer)
1856	{
1857	PPDMDEVINS pDevIns = pReq->pTargetDevice->pDevIns;
1858	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
1859	RTGCPHYS GCPhysAddrSenseBuffer;
1860
1861	/* With 32-bit CCBs, the (optional) sense buffer physical address is provided separately.
1862	* On the other hand, with 24-bit CCBs, the sense buffer is simply located at the end of
1863	* the CCB, right after the variable-length CDB.
1864	*/
1865	if (pReq->fIs24Bit)
1866	{
1867	GCPhysAddrSenseBuffer = pReq->GCPhysAddrCCB;
1868	GCPhysAddrSenseBuffer += pReq->CCBGuest.c.cbCDB + RT_OFFSETOF(CCB24, abCDB);
1869	}
1870	else
1871	GCPhysAddrSenseBuffer = pReq->CCBGuest.n.u32PhysAddrSenseData;
1872
1873	Log3(("%s: sense buffer: %.*Rhxs\n", __FUNCTION__, cbSenseBuffer, pReq->pbSenseBuffer));
1874	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrSenseBuffer, pReq->pbSenseBuffer, cbSenseBuffer);
1875	}
1876
1877	RTMemFree(pReq->pbSenseBuffer);
1878	pReq->pbSenseBuffer = NULL;
1879	}
1880
1881	/**
1882	* Alloc the sense buffer.
1883	*
1884	* @returns VBox status code.
1885	* @param pReq Pointer to the task state.
1886	*/
1887	static int buslogicR3SenseBufferAlloc(PBUSLOGICREQ pReq)
1888	{
1889	pReq->pbSenseBuffer = NULL;
1890
1891	uint32_t cbSenseBuffer = buslogicR3ConvertSenseBufferLength(pReq->CCBGuest.c.cbSenseData);
1892	if (cbSenseBuffer)
1893	{
1894	pReq->pbSenseBuffer = (uint8_t *)RTMemAllocZ(cbSenseBuffer);
1895	if (!pReq->pbSenseBuffer)
1896	return VERR_NO_MEMORY;
1897	}
1898
1899	return VINF_SUCCESS;
1900	}
1901
1902	#endif /* IN_RING3 */
1903
1904	/**
1905	* Parses the command buffer and executes it.
1906	*
1907	* @returns VBox status code.
1908	* @param pDevIns The PDM device instance.
1909	* @param pThis Pointer to the shared BusLogic instance data.
1910	*/
1911	static int buslogicProcessCommand(PPDMDEVINS pDevIns, PBUSLOGIC pThis)
1912	{
1913	int rc = VINF_SUCCESS;
1914	bool fSuppressIrq = false;
1915	bool fSuppressCMDC = false;
1916	bool fCmdComplete = true;
1917
1918	LogFlowFunc(("pThis=%#p\n", pThis));
1919	AssertMsg(pThis->uOperationCode != 0xff, ("There is no command to execute\n"));
1920
1921	switch (pThis->uOperationCode)
1922	{
1923	case BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT:
1924	/* Valid command, no reply. */
1925	pThis->cbReplyParametersLeft = 0;
1926	break;
1927	case BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION:
1928	{
1929	PReplyInquirePCIHostAdapterInformation pReply = (PReplyInquirePCIHostAdapterInformation)pThis->aReplyBuffer;
1930	memset(pReply, 0, sizeof(ReplyInquirePCIHostAdapterInformation));
1931
1932	/* Modeled after a real BT-958(D) */
1933	pReply->HighByteTerminated = 1;
1934	pReply->LowByteTerminated = 1;
1935	pReply->JP1 = 1; /* Closed; "Factory configured - do not alter" */
1936	pReply->InformationIsValid = 1;
1937	pReply->IsaIOPort = pThis->uISABaseCode < 6 ? pThis->uISABaseCode : 0xff;
1938	pReply->IRQ = PCIDevGetInterruptLine(pDevIns->apPciDevs[0]);
1939	pThis->cbReplyParametersLeft = sizeof(ReplyInquirePCIHostAdapterInformation);
1940	break;
1941	}
1942	case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
1943	{
1944	/* no-op */
1945	pThis->cbReplyParametersLeft = 0;
1946	break;
1947	}
1948	case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
1949	{
1950
1951	/* Modify the ISA-compatible I/O port base. Note that this technically
1952	* violates the PCI spec, as this address is not reported through PCI.
1953	* However, it is required for compatibility with old drivers.
1954	*/
1955	#ifdef IN_RING3 /* We can do this from ring-0 now, but we'd like to see the LogRel, so we keep going back to ring-3 anyway. */
1956	uint8_t baseCode = pThis->aCommandBuffer[0];
1957
1958	Log(("ISA I/O for PCI (code %x)\n", baseCode));
1959	pThis->cbReplyParametersLeft = 0;
1960	if (baseCode < 8) {
1961	buslogicR3RegisterISARange(pDevIns, pThis, baseCode);
1962	fSuppressIrq = true;
1963	fSuppressCMDC = true;
1964	}
1965	else
1966	{
1967	Log(("ISA base %#x not valid for this adapter\n", baseCode));
1968	pThis->regStatus \|= BL_STAT_CMDINV;
1969	}
1970	break;
1971	#else
1972	AssertMsgFailed(("Must never get here!\n"));
1973	break;
1974	#endif
1975	}
1976	case BUSLOGICCOMMAND_INQUIRE_BOARD_ID:
1977	{
1978	/* The special option byte is important: If it is '0' or 'B', Windows NT drivers
1979	* for Adaptec AHA-154x may claim the adapter. The BusLogic drivers will claim
1980	* the adapter only when the byte is not '0' or 'B'.
1981	*/
1982	if (pThis->uDevType == DEV_AHA_1540B)
1983	{
1984	pThis->aReplyBuffer[0] = 'A'; /* Firmware option bytes */
1985	pThis->aReplyBuffer[1] = '0'; /* Special option byte */
1986	}
1987	else
1988	{
1989	pThis->aReplyBuffer[0] = 'A'; /* Firmware option bytes */
1990	pThis->aReplyBuffer[1] = 'A'; /* Special option byte */
1991	}
1992
1993	/* We report version 5.07B. This reply will provide the first two digits. */
1994	pThis->aReplyBuffer[2] = '5'; /* Major version 5 */
1995	pThis->aReplyBuffer[3] = '0'; /* Minor version 0 */
1996	pThis->cbReplyParametersLeft = 4; /* Reply is 4 bytes long */
1997	break;
1998	}
1999	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER:
2000	{
2001	if (pThis->uDevType == DEV_AHA_1540B)
2002	{
2003	/* Newer ASPI4DOS.SYS versions expect this command to fail. */
2004	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2005	pThis->cbReplyParametersLeft = 0;
2006	pThis->regStatus \|= BL_STAT_CMDINV;
2007	break;
2008	}
2009
2010	pThis->aReplyBuffer[0] = '7';
2011	pThis->cbReplyParametersLeft = 1;
2012	break;
2013	}
2014	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER:
2015	{
2016	pThis->aReplyBuffer[0] = 'B';
2017	pThis->cbReplyParametersLeft = 1;
2018	break;
2019	}
2020	case BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS:
2021	/* The parameter list length is determined by the first byte of the command buffer. */
2022	if (pThis->iParameter == 1)
2023	{
2024	/* First pass - set the number of following parameter bytes. */
2025	pThis->cbCommandParametersLeft = RT_MIN(pThis->aCommandBuffer[0], sizeof(pThis->aCommandBuffer) - 1);
2026	Log(("Set HA options: %u bytes follow\n", pThis->cbCommandParametersLeft));
2027	}
2028	else
2029	{
2030	/* Second pass - process received data. */
2031	Log(("Set HA options: received %u bytes\n", pThis->aCommandBuffer[0]));
2032	/* We ignore the data - it only concerns the SCSI hardware protocol. */
2033	}
2034	pThis->cbReplyParametersLeft = 0;
2035	break;
2036
2037	case BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND:
2038	/* The parameter list length is at least 12 bytes; the 12th byte determines
2039	* the number of additional CDB bytes that will follow.
2040	*/
2041	if (pThis->iParameter == 12)
2042	{
2043	/* First pass - set the number of following CDB bytes. */
2044	pThis->cbCommandParametersLeft = RT_MIN(pThis->aCommandBuffer[11], sizeof(pThis->aCommandBuffer) - 12);
2045	Log(("Execute SCSI cmd: %u more bytes follow\n", pThis->cbCommandParametersLeft));
2046	}
2047	else
2048	{
2049	PESCMD pCmd;
2050
2051	/* Second pass - process received data. */
2052	Log(("Execute SCSI cmd: received %u bytes\n", pThis->aCommandBuffer[0]));
2053	pCmd = (PESCMD)pThis->aCommandBuffer;
2054	Log(("Addr %08X, cbData %08X, cbCDB=%u\n", pCmd->u32PhysAddrData, pCmd->cbData, pCmd->cbCDB));
2055
2056	if (!ASMAtomicXchgBool(&pThis->fBiosReqPending, true))
2057	{
2058	/* Wake up the worker thread. */
2059	int rc2 = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
2060	AssertRC(rc2);
2061	}
2062
2063	fCmdComplete = false;
2064	}
2065	break;
2066
2067	case BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER:
2068	{
2069	/* Not supported on AHA-154x. */
2070	if (pThis->uDevType == DEV_AHA_1540B)
2071	{
2072	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2073	pThis->cbReplyParametersLeft = 0;
2074	pThis->regStatus \|= BL_STAT_CMDINV;
2075	break;
2076	}
2077
2078	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2079	if (pThis->aCommandBuffer[0] > sizeof(pThis->aReplyBuffer))
2080	{
2081	Log(("Requested too much adapter model number data (%u)!\n", pThis->aCommandBuffer[0]));
2082	pThis->regStatus \|= BL_STAT_CMDINV;
2083	break;
2084	}
2085	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2086	memset(pThis->aReplyBuffer, 0, sizeof(pThis->aReplyBuffer));
2087	const char aModelName[] = "958D "; /* Trailing \0 is fine, that's the filler anyway. */
2088	int cCharsToTransfer = pThis->cbReplyParametersLeft <= sizeof(aModelName)
2089	? pThis->cbReplyParametersLeft
2090	: sizeof(aModelName);
2091
2092	for (int i = 0; i < cCharsToTransfer; i++)
2093	pThis->aReplyBuffer[i] = aModelName[i];
2094
2095	break;
2096	}
2097	case BUSLOGICCOMMAND_INQUIRE_CONFIGURATION:
2098	{
2099	uint8_t uIrq;
2100
2101	if (pThis->uIsaIrq)
2102	uIrq = pThis->uIsaIrq;
2103	else
2104	uIrq = PCIDevGetInterruptLine(pDevIns->apPciDevs[0]);
2105
2106	pThis->cbReplyParametersLeft = sizeof(ReplyInquireConfiguration);
2107	PReplyInquireConfiguration pReply = (PReplyInquireConfiguration)pThis->aReplyBuffer;
2108	memset(pReply, 0, sizeof(ReplyInquireConfiguration));
2109
2110	pReply->uHostAdapterId = 7; /* The controller has always 7 as ID. */
2111	pReply->fDmaChannel6 = 1; /* DMA channel 6 is a good default. */
2112
2113	/* The PCI IRQ is not necessarily representable in this structure.
2114	* If that is the case, the guest likely won't function correctly,
2115	* therefore we log a warning. Note that for ISA configurations, we
2116	* can only allow IRQs that can be supported; for PCI, the HBA
2117	* has no control over IRQ assignment.
2118	*/
2119	switch (uIrq)
2120	{
2121	case 9: pReply->fIrqChannel9 = 1; break;
2122	case 10: pReply->fIrqChannel10 = 1; break;
2123	case 11: pReply->fIrqChannel11 = 1; break;
2124	case 12: pReply->fIrqChannel12 = 1; break;
2125	case 14: pReply->fIrqChannel14 = 1; break;
2126	case 15: pReply->fIrqChannel15 = 1; break;
2127	default:
2128	LogRel(("Warning: PCI IRQ %d cannot be represented as ISA!\n", uIrq));
2129	break;
2130	}
2131	break;
2132	}
2133	case BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION:
2134	{
2135	/* Some Adaptec AHA-154x drivers (e.g. OS/2) execute this command and expect
2136	* it to fail. If it succeeds, the drivers refuse to load. However, some newer
2137	* Adaptec 154x models supposedly support it too??
2138	*/
2139	if (pThis->uDevType == DEV_AHA_1540B)
2140	{
2141	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2142	pThis->cbReplyParametersLeft = 0;
2143	pThis->regStatus \|= BL_STAT_CMDINV;
2144	break;
2145	}
2146
2147	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2148	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2149	PReplyInquireExtendedSetupInformation pReply = (PReplyInquireExtendedSetupInformation)pThis->aReplyBuffer;
2150	memset(pReply, 0, sizeof(ReplyInquireExtendedSetupInformation));
2151
2152	/** @todo should this reflect the RAM contents (AutoSCSIRam)? */
2153	pReply->uBusType = 'E'; /* EISA style */
2154	pReply->u16ScatterGatherLimit = 8192;
2155	pReply->cMailbox = pThis->cMailbox;
2156	pReply->uMailboxAddressBase = (uint32_t)pThis->GCPhysAddrMailboxOutgoingBase;
2157	pReply->fLevelSensitiveInterrupt = true;
2158	pReply->fHostWideSCSI = true;
2159	pReply->fHostUltraSCSI = true;
2160	memcpy(pReply->aFirmwareRevision, "07B", sizeof(pReply->aFirmwareRevision));
2161
2162	break;
2163	}
2164	case BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION:
2165	{
2166	/* The reply length is set by the guest and is found in the first byte of the command buffer. */
2167	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2168	PReplyInquireSetupInformation pReply = (PReplyInquireSetupInformation)pThis->aReplyBuffer;
2169	memset(pReply, 0, sizeof(ReplyInquireSetupInformation));
2170	pReply->fSynchronousInitiationEnabled = true;
2171	pReply->fParityCheckingEnabled = true;
2172	pReply->cMailbox = pThis->cMailbox;
2173	U32_TO_ADDR(pReply->MailboxAddress, pThis->GCPhysAddrMailboxOutgoingBase);
2174	/* The 'D' signature (actually 'SD' for Storage Dimensions, and 'BD' for BusLogic)
2175	* prevents Adaptec's OS/2 drivers from getting too friendly with BusLogic hardware
2176	* and upsetting the HBA state.
2177	*/
2178	if (pThis->uDevType == DEV_AHA_1540B)
2179	{
2180	pReply->uSignature = 0; /* Zeros for Adaptec. */
2181	pReply->uCharacterD = 0;
2182	}
2183	else
2184	{
2185	pReply->uSignature = 'B';
2186	pReply->uCharacterD = 'D'; /* BusLogic model. */
2187	}
2188	pReply->uHostBusType = 'F'; /* PCI bus. */
2189	break;
2190	}
2191	case BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM:
2192	{
2193	/*
2194	* First element in the command buffer contains start offset to read from
2195	* and second one the number of bytes to read.
2196	*/
2197	uint8_t uOffset = pThis->aCommandBuffer[0];
2198	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[1];
2199
2200	pThis->fUseLocalRam = true;
2201	pThis->iReply = uOffset;
2202	break;
2203	}
2204	case BUSLOGICCOMMAND_INITIALIZE_MAILBOX:
2205	{
2206	PRequestInitMbx pRequest = (PRequestInitMbx)pThis->aCommandBuffer;
2207
2208	pThis->cbReplyParametersLeft = 0;
2209	if (!pRequest->cMailbox)
2210	{
2211	Log(("cMailboxes=%u (24-bit mode), fail!\n", pThis->cMailbox));
2212	pThis->regStatus \|= BL_STAT_CMDINV;
2213	break;
2214	}
2215	pThis->fMbxIs24Bit = true;
2216	pThis->cMailbox = pRequest->cMailbox;
2217	pThis->uMailboxOutgoingPositionCurrent = pThis->uMailboxIncomingPositionCurrent = 0;
2218	pThis->GCPhysAddrMailboxOutgoingBase = (RTGCPHYS)ADDR_TO_U32(pRequest->aMailboxBaseAddr);
2219	/* The area for incoming mailboxes is right after the last entry of outgoing mailboxes. */
2220	pThis->GCPhysAddrMailboxIncomingBase = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox24));
2221
2222	Log(("GCPhysAddrMailboxOutgoingBase=%RGp\n", pThis->GCPhysAddrMailboxOutgoingBase));
2223	Log(("GCPhysAddrMailboxIncomingBase=%RGp\n", pThis->GCPhysAddrMailboxIncomingBase));
2224	Log(("cMailboxes=%u (24-bit mode)\n", pThis->cMailbox));
2225	LogRel(("Initialized 24-bit mailbox, %d entries at %08x\n", pRequest->cMailbox, ADDR_TO_U32(pRequest->aMailboxBaseAddr)));
2226
2227	pThis->regStatus &= ~BL_STAT_INREQ;
2228	break;
2229	}
2230	case BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX:
2231	{
2232	if (pThis->uDevType == DEV_AHA_1540B)
2233	{
2234	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2235	pThis->cbReplyParametersLeft = 0;
2236	pThis->regStatus \|= BL_STAT_CMDINV;
2237	break;
2238	}
2239
2240	PRequestInitializeExtendedMailbox pRequest = (PRequestInitializeExtendedMailbox)pThis->aCommandBuffer;
2241
2242	pThis->cbReplyParametersLeft = 0;
2243	if (!pRequest->cMailbox)
2244	{
2245	Log(("cMailboxes=%u (32-bit mode), fail!\n", pThis->cMailbox));
2246	pThis->regStatus \|= BL_STAT_CMDINV;
2247	break;
2248	}
2249	pThis->fMbxIs24Bit = false;
2250	pThis->cMailbox = pRequest->cMailbox;
2251	pThis->uMailboxOutgoingPositionCurrent = pThis->uMailboxIncomingPositionCurrent = 0;
2252	pThis->GCPhysAddrMailboxOutgoingBase = (RTGCPHYS)pRequest->uMailboxBaseAddress;
2253	/* The area for incoming mailboxes is right after the last entry of outgoing mailboxes. */
2254	pThis->GCPhysAddrMailboxIncomingBase = (RTGCPHYS)pRequest->uMailboxBaseAddress + (pThis->cMailbox * sizeof(Mailbox32));
2255
2256	Log(("GCPhysAddrMailboxOutgoingBase=%RGp\n", pThis->GCPhysAddrMailboxOutgoingBase));
2257	Log(("GCPhysAddrMailboxIncomingBase=%RGp\n", pThis->GCPhysAddrMailboxIncomingBase));
2258	Log(("cMailboxes=%u (32-bit mode)\n", pThis->cMailbox));
2259	LogRel(("Initialized 32-bit mailbox, %d entries at %08x\n", pRequest->cMailbox, pRequest->uMailboxBaseAddress));
2260
2261	pThis->regStatus &= ~BL_STAT_INREQ;
2262	break;
2263	}
2264	case BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE:
2265	{
2266	if (pThis->aCommandBuffer[0] == 0)
2267	pThis->fStrictRoundRobinMode = false;
2268	else if (pThis->aCommandBuffer[0] == 1)
2269	pThis->fStrictRoundRobinMode = true;
2270	else
2271	AssertMsgFailed(("Invalid round robin mode %d\n", pThis->aCommandBuffer[0]));
2272
2273	pThis->cbReplyParametersLeft = 0;
2274	break;
2275	}
2276	case BUSLOGICCOMMAND_SET_CCB_FORMAT:
2277	{
2278	if (pThis->aCommandBuffer[0] == 0)
2279	pThis->fExtendedLunCCBFormat = false;
2280	else if (pThis->aCommandBuffer[0] == 1)
2281	pThis->fExtendedLunCCBFormat = true;
2282	else
2283	AssertMsgFailed(("Invalid CCB format %d\n", pThis->aCommandBuffer[0]));
2284
2285	pThis->cbReplyParametersLeft = 0;
2286	break;
2287	}
2288	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7:
2289	/* This is supposed to send TEST UNIT READY to each target/LUN.
2290	* We cheat and skip that, since we already know what's attached
2291	*/
2292	memset(pThis->aReplyBuffer, 0, 8);
2293	for (int i = 0; i < 8; ++i)
2294	{
2295	if (pThis->afDevicePresent[i])
2296	pThis->aReplyBuffer[i] = 1;
2297	}
2298	pThis->aReplyBuffer[7] = 0; /* HA hardcoded at ID 7. */
2299	pThis->cbReplyParametersLeft = 8;
2300	break;
2301	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15:
2302	/* See note about cheating above. */
2303	memset(pThis->aReplyBuffer, 0, 8);
2304	for (int i = 0; i < 8; ++i)
2305	{
2306	if (pThis->afDevicePresent[i + 8])
2307	pThis->aReplyBuffer[i] = 1;
2308	}
2309	pThis->cbReplyParametersLeft = 8;
2310	break;
2311	case BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES:
2312	{
2313	/* Each bit which is set in the 16bit wide variable means a present device. */
2314	uint16_t u16TargetsPresentMask = 0;
2315
2316	for (uint8_t i = 0; i < RT_ELEMENTS(pThis->afDevicePresent); i++)
2317	{
2318	if (pThis->afDevicePresent[i])
2319	u16TargetsPresentMask \|= (1 << i);
2320	}
2321	pThis->aReplyBuffer[0] = (uint8_t)u16TargetsPresentMask;
2322	pThis->aReplyBuffer[1] = (uint8_t)(u16TargetsPresentMask >> 8);
2323	pThis->cbReplyParametersLeft = 2;
2324	break;
2325	}
2326	case BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD:
2327	{
2328	if (pThis->aCommandBuffer[0] > sizeof(pThis->aReplyBuffer))
2329	{
2330	Log(("Requested too much synch period inquiry (%u)!\n", pThis->aCommandBuffer[0]));
2331	pThis->regStatus \|= BL_STAT_CMDINV;
2332	break;
2333	}
2334	pThis->cbReplyParametersLeft = pThis->aCommandBuffer[0];
2335	for (uint8_t i = 0; i < pThis->cbReplyParametersLeft; i++)
2336	pThis->aReplyBuffer[i] = 0; /** @todo Figure if we need something other here. It's not needed for the linux driver */
2337
2338	break;
2339	}
2340	case BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT:
2341	{
2342	/* Not supported on AHA-154x HBAs. */
2343	if (pThis->uDevType == DEV_AHA_1540B)
2344	{
2345	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2346	pThis->cbReplyParametersLeft = 0;
2347	pThis->regStatus \|= BL_STAT_CMDINV;
2348	break;
2349	}
2350
2351	pThis->cbReplyParametersLeft = 0;
2352	if (pThis->aCommandBuffer[0] == 0)
2353	pThis->fIRQEnabled = false;
2354	else
2355	pThis->fIRQEnabled = true;
2356	/* No interrupt signaled regardless of enable/disable. NB: CMDC is still signaled! */
2357	fSuppressIrq = true;
2358	break;
2359	}
2360	case BUSLOGICCOMMAND_ECHO_COMMAND_DATA:
2361	{
2362	pThis->aReplyBuffer[0] = pThis->aCommandBuffer[0];
2363	pThis->cbReplyParametersLeft = 1;
2364	break;
2365	}
2366	case BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT:
2367	{
2368	uint8_t uEnable = pThis->aCommandBuffer[0];
2369
2370	pThis->cbReplyParametersLeft = 0;
2371	Log(("Enable OMBR: %u\n", uEnable));
2372	/* Only 0/1 are accepted. */
2373	if (uEnable > 1)
2374	pThis->regStatus \|= BL_STAT_CMDINV;
2375	else
2376	{
2377	pThis->LocalRam.structured.autoSCSIData.uReserved6 = uEnable;
2378	fSuppressIrq = true;
2379	fSuppressCMDC = true;
2380	}
2381	break;
2382	}
2383	case BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS:
2384	{
2385	pThis->cbReplyParametersLeft = 0;
2386	pThis->LocalRam.structured.autoSCSIData.uBusOnDelay = pThis->aCommandBuffer[0];
2387	Log(("Bus-on time: %d\n", pThis->aCommandBuffer[0]));
2388	break;
2389	}
2390	case BUSLOGICCOMMAND_SET_TIME_OFF_BUS:
2391	{
2392	pThis->cbReplyParametersLeft = 0;
2393	pThis->LocalRam.structured.autoSCSIData.uBusOffDelay = pThis->aCommandBuffer[0];
2394	Log(("Bus-off time: %d\n", pThis->aCommandBuffer[0]));
2395	break;
2396	}
2397	case BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE:
2398	{
2399	pThis->cbReplyParametersLeft = 0;
2400	pThis->LocalRam.structured.autoSCSIData.uDMATransferRate = pThis->aCommandBuffer[0];
2401	Log(("Bus transfer rate: %02X\n", pThis->aCommandBuffer[0]));
2402	break;
2403	}
2404	case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
2405	{
2406	RTGCPHYS GCPhysFifoBuf;
2407	Addr24 addr;
2408
2409	pThis->cbReplyParametersLeft = 0;
2410	addr.hi = pThis->aCommandBuffer[0];
2411	addr.mid = pThis->aCommandBuffer[1];
2412	addr.lo = pThis->aCommandBuffer[2];
2413	GCPhysFifoBuf = (RTGCPHYS)ADDR_TO_U32(addr);
2414	Log(("Write busmaster FIFO at: %04X\n", ADDR_TO_U32(addr)));
2415	blPhysReadMeta(pDevIns, pThis, GCPhysFifoBuf, &pThis->LocalRam.u8View[64], 64);
2416	break;
2417	}
2418	case BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO:
2419	{
2420	RTGCPHYS GCPhysFifoBuf;
2421	Addr24 addr;
2422
2423	pThis->cbReplyParametersLeft = 0;
2424	addr.hi = pThis->aCommandBuffer[0];
2425	addr.mid = pThis->aCommandBuffer[1];
2426	addr.lo = pThis->aCommandBuffer[2];
2427	GCPhysFifoBuf = (RTGCPHYS)ADDR_TO_U32(addr);
2428	Log(("Read busmaster FIFO at: %04X\n", ADDR_TO_U32(addr)));
2429	blPhysWriteMeta(pDevIns, pThis, GCPhysFifoBuf, &pThis->LocalRam.u8View[64], 64);
2430	break;
2431	}
2432	default:
2433	AssertMsgFailed(("Invalid command %#x\n", pThis->uOperationCode));
2434	RT_FALL_THRU();
2435	case BUSLOGICCOMMAND_EXT_BIOS_INFO:
2436	case BUSLOGICCOMMAND_UNLOCK_MAILBOX:
2437	/* Commands valid for Adaptec 154xC which we don't handle since
2438	* we pretend being 154xB compatible. Just mark the command as invalid.
2439	*/
2440	Log(("Command %#x not valid for this adapter\n", pThis->uOperationCode));
2441	pThis->cbReplyParametersLeft = 0;
2442	pThis->regStatus \|= BL_STAT_CMDINV;
2443	break;
2444	case BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND: /* Should be handled already. */
2445	AssertMsgFailed(("Invalid mailbox execute state!\n"));
2446	}
2447
2448	Log(("uOperationCode=%#x, cbReplyParametersLeft=%d\n", pThis->uOperationCode, pThis->cbReplyParametersLeft));
2449
2450	/* Fail command if too much parameter data requested. */
2451	if ((pThis->cbCommandParametersLeft + pThis->iParameter) > sizeof(pThis->aCommandBuffer))
2452	{
2453	Log(("Invalid command parameter length (%u)\n", pThis->cbCommandParametersLeft));
2454	pThis->cbReplyParametersLeft = 0;
2455	pThis->cbCommandParametersLeft = 0;
2456	pThis->regStatus \|= BL_STAT_CMDINV;
2457	}
2458
2459	if (fCmdComplete)
2460	{
2461	/* Set the data in ready bit in the status register in case the command has a reply. */
2462	if (pThis->cbReplyParametersLeft)
2463	pThis->regStatus \|= BL_STAT_DIRRDY;
2464	else if (!pThis->cbCommandParametersLeft)
2465	buslogicCommandComplete(pDevIns, pThis, fSuppressIrq, fSuppressCMDC);
2466	}
2467
2468	return rc;
2469	}
2470
2471	/**
2472	* Read a register from the BusLogic adapter.
2473	*
2474	* @returns VBox status code.
2475	* @param pDevIns The device instance.
2476	* @param pThis Pointer to the shared BusLogic instance data.
2477	* @param iRegister The index of the register to read.
2478	* @param pu32 Where to store the register content.
2479	*/
2480	static int buslogicRegisterRead(PPDMDEVINS pDevIns, PBUSLOGIC pThis, unsigned iRegister, uint32_t *pu32)
2481	{
2482	static const char s_szAhaSig[] = "ADAP";
2483	int rc = VINF_SUCCESS;
2484
2485	switch (iRegister)
2486	{
2487	case BUSLOGIC_REGISTER_STATUS:
2488	{
2489	*pu32 = pThis->regStatus;
2490
2491	/* If the diagnostic active bit is set, we are in a guest-initiated
2492	* hard reset. If the guest reads the status register and waits for
2493	* the host adapter ready bit to be set, we terminate the reset right
2494	* away. However, guests may also expect the reset condition to clear
2495	* automatically after a period of time, in which case we can't show
2496	* the DIAG bit at all.
2497	*/
2498	if (pThis->regStatus & BL_STAT_DACT)
2499	{
2500	uint64_t u64AccessTime = PDMDevHlpTMTimeVirtGetNano(pDevIns);
2501
2502	pThis->regStatus &= ~BL_STAT_DACT;
2503	pThis->regStatus \|= BL_STAT_HARDY;
2504
2505	if (u64AccessTime - pThis->u64ResetTime > BUSLOGIC_RESET_DURATION_NS)
2506	{
2507	/* If reset already expired, let the guest see that right away. */
2508	*pu32 = pThis->regStatus;
2509	pThis->u64ResetTime = 0;
2510	}
2511	}
2512	break;
2513	}
2514	case BUSLOGIC_REGISTER_DATAIN:
2515	{
2516	AssertCompileSize(pThis->LocalRam, 256);
2517	AssertCompileSize(pThis->iReply, sizeof(uint8_t));
2518	AssertCompileSize(pThis->cbReplyParametersLeft, sizeof(uint8_t));
2519
2520	if (pThis->fUseLocalRam)
2521	*pu32 = pThis->LocalRam.u8View[pThis->iReply];
2522	else
2523	{
2524	/*
2525	* Real adapters seem to pad the reply with zeroes and allow up to 255 bytes even
2526	* if the real reply is shorter.
2527	*/
2528	if (pThis->iReply >= sizeof(pThis->aReplyBuffer))
2529	*pu32 = 0;
2530	else
2531	*pu32 = pThis->aReplyBuffer[pThis->iReply];
2532	}
2533
2534	/* Careful about underflow - guest can read data register even if
2535	* no data is available.
2536	*/
2537	if (pThis->cbReplyParametersLeft)
2538	{
2539	pThis->iReply++;
2540	pThis->cbReplyParametersLeft--;
2541	if (!pThis->cbReplyParametersLeft)
2542	{
2543	/*
2544	* Reply finished, set command complete bit, unset data-in ready bit and
2545	* interrupt the guest if enabled.
2546	* NB: Some commands do not set the CMDC bit / raise completion interrupt.
2547	*/
2548	if (pThis->uOperationCode == BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM)
2549	buslogicCommandComplete(pDevIns, pThis, true /* fSuppressIrq /, true / fSuppressCMDC */);
2550	else
2551	buslogicCommandComplete(pDevIns, pThis, false, false);
2552	}
2553	}
2554	LogFlowFunc(("data=%02x, iReply=%d, cbReplyParametersLeft=%u\n", *pu32,
2555	pThis->iReply, pThis->cbReplyParametersLeft));
2556	break;
2557	}
2558	case BUSLOGIC_REGISTER_INTERRUPT:
2559	{
2560	*pu32 = pThis->regInterrupt;
2561	break;
2562	}
2563	case BUSLOGIC_REGISTER_GEOMETRY:
2564	{
2565	if (pThis->uDevType == DEV_AHA_1540B)
2566	{
2567	uint8_t off = pThis->uAhaSigIdx & 3;
2568	*pu32 = s_szAhaSig[off];
2569	pThis->uAhaSigIdx = (off + 1) & 3;
2570	}
2571	else
2572	*pu32 = pThis->regGeometry;
2573	break;
2574	}
2575	default:
2576	*pu32 = UINT32_C(0xffffffff);
2577	}
2578
2579	Log2(("%s: pu32=%p:{%.*Rhxs} iRegister=%d rc=%Rrc\n",
2580	__FUNCTION__, pu32, 1, pu32, iRegister, rc));
2581
2582	return rc;
2583	}
2584
2585	/**
2586	* Write a value to a register.
2587	*
2588	* @returns VBox status code.
2589	* @param pDevIns The PDM device instance.
2590	* @param pThis Pointer to the shared BusLogic instance data.
2591	* @param iRegister The index of the register to read.
2592	* @param uVal The value to write.
2593	*/
2594	static int buslogicRegisterWrite(PPDMDEVINS pDevIns, PBUSLOGIC pThis, unsigned iRegister, uint8_t uVal)
2595	{
2596	int rc = VINF_SUCCESS;
2597
2598	switch (iRegister)
2599	{
2600	case BUSLOGIC_REGISTER_CONTROL:
2601	{
2602	if ((uVal & BL_CTRL_RHARD) \|\| (uVal & BL_CTRL_RSOFT))
2603	{
2604	#ifdef IN_RING3
2605	bool fHardReset = !!(uVal & BL_CTRL_RHARD);
2606
2607	LogRel(("BusLogic: %s reset\n", fHardReset ? "hard" : "soft"));
2608	buslogicR3InitiateReset(pDevIns, pThis, fHardReset);
2609	#else
2610	rc = VINF_IOM_R3_IOPORT_WRITE;
2611	#endif
2612	break;
2613	}
2614
2615	rc = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSectIntr, VINF_IOM_R3_IOPORT_WRITE);
2616	if (rc != VINF_SUCCESS)
2617	return rc;
2618
2619	#ifdef LOG_ENABLED
2620	uint32_t cMailboxesReady = ASMAtomicXchgU32(&pThis->cInMailboxesReadyIfLogEnabled, 0);
2621	Log(("%u incoming mailboxes were ready when this interrupt was cleared\n", cMailboxesReady));
2622	#endif
2623
2624	if (uVal & BL_CTRL_RINT)
2625	buslogicClearInterrupt(pDevIns, pThis);
2626
2627	PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSectIntr);
2628
2629	break;
2630	}
2631	case BUSLOGIC_REGISTER_COMMAND:
2632	{
2633	/* Fast path for mailbox execution command. */
2634	if ((uVal == BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND) && (pThis->uOperationCode == 0xff))
2635	{
2636	/// @todo Should fail if BL_STAT_INREQ is set
2637	/* If there are no mailboxes configured, don't even try to do anything. */
2638	if (pThis->cMailbox)
2639	{
2640	ASMAtomicIncU32(&pThis->cMailboxesReady);
2641	if (!ASMAtomicXchgBool(&pThis->fNotificationSent, true))
2642	{
2643	/* Wake up the worker thread. */
2644	int rc2 = PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
2645	AssertRC(rc2);
2646	}
2647	}
2648
2649	return rc;
2650	}
2651
2652	/*
2653	* Check if we are already fetch command parameters from the guest.
2654	* If not we initialize executing a new command.
2655	*/
2656	if (pThis->uOperationCode == 0xff)
2657	{
2658	pThis->uOperationCode = uVal;
2659	pThis->iParameter = 0;
2660
2661	/* Mark host adapter as busy and clear the invalid status bit. */
2662	pThis->regStatus &= ~(BL_STAT_HARDY \| BL_STAT_CMDINV);
2663
2664	/* Get the number of bytes for parameters from the command code. */
2665	switch (pThis->uOperationCode)
2666	{
2667	case BUSLOGICCOMMAND_TEST_CMDC_INTERRUPT:
2668	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_LETTER:
2669	case BUSLOGICCOMMAND_INQUIRE_BOARD_ID:
2670	case BUSLOGICCOMMAND_INQUIRE_FIRMWARE_VERSION_3RD_LETTER:
2671	case BUSLOGICCOMMAND_INQUIRE_PCI_HOST_ADAPTER_INFORMATION:
2672	case BUSLOGICCOMMAND_INQUIRE_CONFIGURATION:
2673	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_0_TO_7:
2674	case BUSLOGICCOMMAND_INQUIRE_INSTALLED_DEVICES_ID_8_TO_15:
2675	case BUSLOGICCOMMAND_INQUIRE_TARGET_DEVICES:
2676	pThis->cbCommandParametersLeft = 0;
2677	break;
2678	case BUSLOGICCOMMAND_MODIFY_IO_ADDRESS:
2679	case BUSLOGICCOMMAND_INQUIRE_EXTENDED_SETUP_INFORMATION:
2680	case BUSLOGICCOMMAND_DISABLE_HOST_ADAPTER_INTERRUPT:
2681	case BUSLOGICCOMMAND_INQUIRE_HOST_ADAPTER_MODEL_NUMBER:
2682	/* These commands are not on AHA-154x, some Adaptec drivers (ASPI4DOS.SYS) test them. */
2683	if (pThis->uDevType == DEV_AHA_1540B)
2684	{
2685	pThis->cbCommandParametersLeft = 0;
2686	break;
2687	}
2688	RT_FALL_THRU();
2689	case BUSLOGICCOMMAND_INQUIRE_SETUP_INFORMATION:
2690	case BUSLOGICCOMMAND_ENABLE_STRICT_ROUND_ROBIN_MODE:
2691	case BUSLOGICCOMMAND_SET_CCB_FORMAT:
2692	case BUSLOGICCOMMAND_INQUIRE_SYNCHRONOUS_PERIOD:
2693	case BUSLOGICCOMMAND_ECHO_COMMAND_DATA:
2694	case BUSLOGICCOMMAND_ENABLE_OUTGOING_MAILBOX_AVAILABLE_INTERRUPT:
2695	case BUSLOGICCOMMAND_SET_PREEMPT_TIME_ON_BUS:
2696	case BUSLOGICCOMMAND_SET_TIME_OFF_BUS:
2697	case BUSLOGICCOMMAND_SET_BUS_TRANSFER_RATE:
2698	pThis->cbCommandParametersLeft = 1;
2699	break;
2700	case BUSLOGICCOMMAND_FETCH_HOST_ADAPTER_LOCAL_RAM:
2701	pThis->cbCommandParametersLeft = 2;
2702	break;
2703	case BUSLOGICCOMMAND_READ_BUSMASTER_CHIP_FIFO:
2704	case BUSLOGICCOMMAND_WRITE_BUSMASTER_CHIP_FIFO:
2705	pThis->cbCommandParametersLeft = 3;
2706	break;
2707	case BUSLOGICCOMMAND_SET_SCSI_SELECTION_TIMEOUT:
2708	pThis->cbCommandParametersLeft = 4;
2709	break;
2710	case BUSLOGICCOMMAND_INITIALIZE_MAILBOX:
2711	pThis->cbCommandParametersLeft = sizeof(RequestInitMbx);
2712	break;
2713	case BUSLOGICCOMMAND_INITIALIZE_EXTENDED_MAILBOX:
2714	/* Some Adaptec drivers (ASPI4DOS.SYS) test this command. */
2715	if (pThis->uDevType == DEV_AHA_1540B)
2716	{
2717	pThis->cbCommandParametersLeft = 0;
2718	break;
2719	}
2720	pThis->cbCommandParametersLeft = sizeof(RequestInitializeExtendedMailbox);
2721	break;
2722	case BUSLOGICCOMMAND_SET_ADAPTER_OPTIONS:
2723	/* There must be at least one byte following this command. */
2724	pThis->cbCommandParametersLeft = 1;
2725	break;
2726	case BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND:
2727	/* 12 bytes + variable-length CDB. */
2728	pThis->cbCommandParametersLeft = 12;
2729	break;
2730	case BUSLOGICCOMMAND_EXT_BIOS_INFO:
2731	case BUSLOGICCOMMAND_UNLOCK_MAILBOX:
2732	/* Invalid commands. */
2733	pThis->cbCommandParametersLeft = 0;
2734	break;
2735	case BUSLOGICCOMMAND_EXECUTE_MAILBOX_COMMAND: /* Should not come here anymore. */
2736	default:
2737	AssertMsgFailed(("Invalid operation code %#x\n", uVal));
2738	}
2739	}
2740	else if (pThis->cbCommandParametersLeft)
2741	{
2742	#ifndef IN_RING3
2743	/* This command must be executed in R3 as it rehooks the ISA I/O port. */
2744	if (pThis->uOperationCode == BUSLOGICCOMMAND_MODIFY_IO_ADDRESS)
2745	{
2746	rc = VINF_IOM_R3_IOPORT_WRITE;
2747	break;
2748	}
2749	#endif
2750	/*
2751	* The real adapter would set the Command register busy bit in the status register.
2752	* The guest has to wait until it is unset.
2753	* We don't need to do it because the guest does not continue execution while we are in this
2754	* function.
2755	*/
2756	pThis->aCommandBuffer[pThis->iParameter] = uVal;
2757	pThis->iParameter++;
2758	pThis->cbCommandParametersLeft--;
2759	}
2760
2761	/* Start execution of command if there are no parameters left. */
2762	if (!pThis->cbCommandParametersLeft)
2763	{
2764	rc = buslogicProcessCommand(pDevIns, pThis);
2765	AssertMsgRC(rc, ("Processing command failed rc=%Rrc\n", rc));
2766	}
2767	break;
2768	}
2769
2770	/* On BusLogic adapters, the interrupt and geometry registers are R/W.
2771	* That is different from Adaptec 154x where those are read only.
2772	*/
2773	case BUSLOGIC_REGISTER_INTERRUPT:
2774	if (pThis->uDevType == DEV_AHA_1540B)
2775	break;
2776	pThis->regInterrupt = uVal;
2777	break;
2778
2779	case BUSLOGIC_REGISTER_GEOMETRY:
2780	if (pThis->uDevType == DEV_AHA_1540B)
2781	break;
2782	pThis->regGeometry = uVal;
2783	break;
2784
2785	default:
2786	AssertMsgFailed(("Register not available\n"));
2787	rc = VERR_IOM_IOPORT_UNUSED;
2788	}
2789
2790	return rc;
2791	}
2792
2793	/**
2794	* @callback_method_impl{FNIOMMMIONEWREAD}
2795	*/
2796	static DECLCALLBACK(VBOXSTRICTRC) buslogicMMIORead(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void pv, unsigned cb)
2797	{
2798	RT_NOREF(pDevIns, pvUser, off, pv, cb);
2799
2800	/* the linux driver does not make use of the MMIO area. */
2801	ASSERT_GUEST_MSG_FAILED(("MMIO Read: %RGp LB %u\n", off, cb));
2802	return VINF_SUCCESS;
2803	}
2804
2805	/**
2806	* @callback_method_impl{FNIOMMMIONEWWRITE}
2807	*/
2808	static DECLCALLBACK(VBOXSTRICTRC) buslogicMMIOWrite(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void const pv, unsigned cb)
2809	{
2810	RT_NOREF(pDevIns, pvUser, off, pv, cb);
2811
2812	/* the linux driver does not make use of the MMIO area. */
2813	ASSERT_GUEST_MSG_FAILED(("MMIO Write: %RGp LB %u: %.*Rhxs\n", off, cb, cb, pv));
2814	return VINF_SUCCESS;
2815	}
2816
2817	/**
2818	* @callback_method_impl{FNIOMIOPORTNEWIN}
2819	*/
2820	static DECLCALLBACK(VBOXSTRICTRC)
2821	buslogicIOPortRead(PPDMDEVINS pDevIns, void pvUser, RTIOPORT offPort, uint32_t pu32, unsigned cb)
2822	{
2823	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2824	unsigned iRegister = offPort % 4;
2825	RT_NOREF(pvUser, cb);
2826
2827	ASSERT_GUEST(cb == 1);
2828
2829	return buslogicRegisterRead(pDevIns, pThis, iRegister, pu32);
2830	}
2831
2832	/**
2833	* @callback_method_impl{FNIOMIOPORTNEWOUT}
2834	*/
2835	static DECLCALLBACK(VBOXSTRICTRC)
2836	buslogicIOPortWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
2837	{
2838	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
2839	unsigned iRegister = offPort % 4;
2840	RT_NOREF(pvUser, cb);
2841
2842	ASSERT_GUEST(cb == 1);
2843
2844	int rc = buslogicRegisterWrite(pDevIns, pThis, iRegister, (uint8_t)u32);
2845
2846	Log2(("#%d %s: pvUser=%#p cb=%d u32=%#x offPort=%#x rc=%Rrc\n",
2847	pDevIns->iInstance, __FUNCTION__, pvUser, cb, u32, offPort, rc));
2848
2849	return rc;
2850	}
2851
2852	#ifdef IN_RING3
2853
2854	/**
2855	* Update the ISA I/O range.
2856	*
2857	* @returns nothing.
2858	* @param pDevIns The device instance.
2859	* @param pThis Pointer to the shared BusLogic instance data.
2860	* @param uBaseCode Encoded ISA I/O base; only low 3 bits are used.
2861	*/
2862	static int buslogicR3RegisterISARange(PPDMDEVINS pDevIns, PBUSLOGIC pThis, uint8_t uBaseCode)
2863	{
2864	uint8_t uCode = uBaseCode & MAX_ISA_BASE;
2865	uint16_t uNewBase = g_aISABases[uCode];
2866	int rc = VINF_SUCCESS;
2867
2868	LogFlowFunc(("ISA I/O code %02X, new base %X\n", uBaseCode, uNewBase));
2869
2870	/* Check if the same port range actually changed. */
2871	if (uNewBase != pThis->IOISABase)
2872	{
2873	/* Unmap the old range, if necessary. */
2874	if (pThis->IOISABase)
2875	{
2876	rc = PDMDevHlpIoPortUnmap(pDevIns, pThis->hIoPortsIsa);
2877	AssertRC(rc);
2878	}
2879	if (RT_SUCCESS(rc))
2880	{
2881	pThis->IOISABase = 0; /* First mark as unregistered. */
2882	pThis->uISABaseCode = ISA_BASE_DISABLED;
2883
2884	if (uNewBase)
2885	{
2886	/* Register the new range if requested. */
2887	rc = PDMDevHlpIoPortMap(pDevIns, pThis->hIoPortsIsa, uNewBase);
2888	if (RT_SUCCESS(rc))
2889	{
2890	pThis->IOISABase = uNewBase;
2891	pThis->uISABaseCode = uCode;
2892	}
2893	}
2894	}
2895	if (RT_SUCCESS(rc))
2896	{
2897	if (uNewBase)
2898	{
2899	Log(("ISA I/O base: %x\n", uNewBase));
2900	LogRel(("BusLogic: ISA I/O base: %x\n", uNewBase));
2901	}
2902	else
2903	{
2904	Log(("Disabling ISA I/O ports.\n"));
2905	LogRel(("BusLogic: ISA I/O disabled\n"));
2906	}
2907	}
2908
2909	}
2910	return rc;
2911	}
2912
2913	/**
2914	* Completes a request initiated by the BIOS through the BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND command.
2915	*
2916	* @returns nothing.
2917	* @param pThis Pointer to the shared BusLogic instance data.
2918	* @param u8ScsiSts The SCSI status code.
2919	*/
2920	static void buslogicR3ReqCompleteBios(PBUSLOGIC pThis, uint8_t u8ScsiSts)
2921	{
2922	pThis->cbReplyParametersLeft = 4;
2923	pThis->aReplyBuffer[0] = pThis->aReplyBuffer[1] = 0;
2924	pThis->aReplyBuffer[2] = u8ScsiSts;
2925	pThis->aReplyBuffer[3] = 0;
2926
2927	pThis->regStatus \|= BL_STAT_DIRRDY;
2928	}
2929
2930	static int buslogicR3ReqComplete(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, PBUSLOGICREQ pReq, int rcReq)
2931	{
2932	RT_NOREF(rcReq);
2933	PBUSLOGICDEVICE pTgtDev = pReq->pTargetDevice;
2934
2935	LogFlowFunc(("before decrement %u\n", pTgtDev->cOutstandingRequests));
2936	ASMAtomicDecU32(&pTgtDev->cOutstandingRequests);
2937	LogFlowFunc(("after decrement %u\n", pTgtDev->cOutstandingRequests));
2938
2939	if (pReq->fBIOS)
2940	{
2941	uint8_t u8ScsiSts = pReq->u8ScsiSts;
2942	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
2943	buslogicR3ReqCompleteBios(pThis, u8ScsiSts);
2944	}
2945	else
2946	{
2947	if (pReq->pbSenseBuffer)
2948	buslogicR3SenseBufferFree(pReq, (pReq->u8ScsiSts != SCSI_STATUS_OK));
2949
2950	/* Update residual data length. */
2951	if ( (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_DATA_LENGTH)
2952	\|\| (pReq->CCBGuest.c.uOpcode == BUSLOGIC_CCB_OPCODE_INITIATOR_CCB_RESIDUAL_SCATTER_GATHER))
2953	{
2954	size_t cbResidual = 0;
2955	int rc = pTgtDev->pDrvMediaEx->pfnIoReqQueryResidual(pTgtDev->pDrvMediaEx, pReq->hIoReq, &cbResidual);
2956	AssertRC(rc); Assert(cbResidual == (uint32_t)cbResidual);
2957
2958	if (pReq->fIs24Bit)
2959	U32_TO_LEN(pReq->CCBGuest.o.acbData, (uint32_t)cbResidual);
2960	else
2961	pReq->CCBGuest.n.cbData = (uint32_t)cbResidual;
2962	}
2963
2964	/*
2965	* Save vital things from the request and free it before posting completion
2966	* to avoid that the guest submits a new request with the same ID as the still
2967	* allocated one.
2968	*/
2969	#ifdef LOG_ENABLED
2970	bool fIs24Bit = pReq->fIs24Bit;
2971	#endif
2972	uint8_t u8ScsiSts = pReq->u8ScsiSts;
2973	RTGCPHYS GCPhysAddrCCB = pReq->GCPhysAddrCCB;
2974	CCBU CCBGuest;
2975	memcpy(&CCBGuest, &pReq->CCBGuest, sizeof(CCBU));
2976
2977	pTgtDev->pDrvMediaEx->pfnIoReqFree(pTgtDev->pDrvMediaEx, pReq->hIoReq);
2978	if (u8ScsiSts == SCSI_STATUS_OK)
2979	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
2980	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED,
2981	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
2982	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITHOUT_ERROR);
2983	else if (u8ScsiSts == SCSI_STATUS_CHECK_CONDITION)
2984	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
2985	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_CMD_COMPLETED,
2986	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_CHECK_CONDITION,
2987	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
2988	else
2989	AssertMsgFailed(("invalid completion status %u\n", u8ScsiSts));
2990
2991	#ifdef LOG_ENABLED
2992	buslogicR3DumpCCBInfo(&CCBGuest, fIs24Bit);
2993	#endif
2994	}
2995
2996	if (pTgtDev->cOutstandingRequests == 0 && pThisCC->fSignalIdle)
2997	PDMDevHlpAsyncNotificationCompleted(pDevIns);
2998
2999	return VINF_SUCCESS;
3000	}
3001
3002	/**
3003	* @interface_method_impl{PDMIMEDIAPORT,pfnQueryDeviceLocation}
3004	*/
3005	static DECLCALLBACK(int) buslogicR3QueryDeviceLocation(PPDMIMEDIAPORT pInterface, const char **ppcszController,
3006	uint32_t piInstance, uint32_t piLUN)
3007	{
3008	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaPort);
3009	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3010
3011	AssertPtrReturn(ppcszController, VERR_INVALID_POINTER);
3012	AssertPtrReturn(piInstance, VERR_INVALID_POINTER);
3013	AssertPtrReturn(piLUN, VERR_INVALID_POINTER);
3014
3015	*ppcszController = pDevIns->pReg->szName;
3016	*piInstance = pDevIns->iInstance;
3017	*piLUN = pTgtDev->iLUN;
3018
3019	return VINF_SUCCESS;
3020	}
3021
3022	static DECLCALLBACK(size_t) buslogicR3CopySgToGuestBios(PCRTSGBUF pSgBuf, const void pvSrc, size_t cbSrc, void pvUser)
3023	{
3024	PBUSLOGICCOPYARGS pArgs = (PBUSLOGICCOPYARGS)pvUser;
3025	size_t cbThisCopy = RT_MIN(cbSrc, pArgs->pCmd->cbData - pArgs->cbCopied);
3026	RT_NOREF(pSgBuf);
3027
3028	blPhysWriteUser(pArgs->pDevIns, pArgs->pThis, pArgs->pCmd->u32PhysAddrData + pArgs->cbCopied, pvSrc, cbThisCopy);
3029	pArgs->cbCopied += cbThisCopy;
3030	return cbThisCopy;
3031	}
3032
3033	/**
3034	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCopyFromBuf}
3035	*/
3036	static DECLCALLBACK(int) buslogicR3IoReqCopyFromBuf(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3037	void *pvIoReqAlloc, uint32_t offDst, PRTSGBUF pSgBuf,
3038	size_t cbCopy)
3039	{
3040	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3041	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3042	PBUSLOGICREQ pReq = (PBUSLOGICREQ)pvIoReqAlloc;
3043	RT_NOREF(hIoReq);
3044
3045	size_t cbCopied = 0;
3046	if (RT_LIKELY(!pReq->fBIOS))
3047	cbCopied = buslogicR3CopySgBufToGuest(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), pReq, pSgBuf, offDst, cbCopy);
3048	else
3049	{
3050	BUSLOGICCOPYARGS Args;
3051	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3052	PESCMD pCmd = (PESCMD)pThis->aCommandBuffer;
3053
3054	Args.pCmd = pCmd;
3055	Args.pThis = pThis;
3056	Args.pDevIns = pDevIns;
3057	Args.cbCopied = 0;
3058	cbCopied = RTSgBufCopyToFn(pSgBuf, RT_MIN(pCmd->cbData, cbCopy), buslogicR3CopySgToGuestBios, &Args);
3059	}
3060	return cbCopied == cbCopy ? VINF_SUCCESS : VERR_PDM_MEDIAEX_IOBUF_OVERFLOW;
3061	}
3062
3063	static DECLCALLBACK(size_t) buslogicR3CopySgFromGuestBios(PCRTSGBUF pSgBuf, void pvDst, size_t cbDst, void pvUser)
3064	{
3065	PBUSLOGICCOPYARGS pArgs = (PBUSLOGICCOPYARGS)pvUser;
3066	size_t cbThisCopy = RT_MIN(cbDst, pArgs->pCmd->cbData - pArgs->cbCopied);
3067	RT_NOREF(pSgBuf);
3068
3069	blPhysReadUser(pArgs->pDevIns, pArgs->pThis, pArgs->pCmd->u32PhysAddrData + pArgs->cbCopied, pvDst, cbThisCopy);
3070	pArgs->cbCopied += cbThisCopy;
3071	return cbThisCopy;
3072	}
3073
3074	/**
3075	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCopyToBuf}
3076	*/
3077	static DECLCALLBACK(int) buslogicR3IoReqCopyToBuf(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3078	void *pvIoReqAlloc, uint32_t offSrc, PRTSGBUF pSgBuf,
3079	size_t cbCopy)
3080	{
3081	RT_NOREF(hIoReq);
3082	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3083	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3084	PBUSLOGICREQ pReq = (PBUSLOGICREQ)pvIoReqAlloc;
3085
3086	size_t cbCopied = 0;
3087	if (RT_LIKELY(!pReq->fBIOS))
3088	cbCopied = buslogicR3CopySgBufFromGuest(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), pReq, pSgBuf, offSrc, cbCopy);
3089	else
3090	{
3091	BUSLOGICCOPYARGS Args;
3092	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3093	PESCMD pCmd = (PESCMD)pThis->aCommandBuffer;
3094
3095	Args.pCmd = pCmd;
3096	Args.pThis = pThis;
3097	Args.pDevIns = pDevIns;
3098	Args.cbCopied = 0;
3099	cbCopied = RTSgBufCopyFromFn(pSgBuf, RT_MIN(pCmd->cbData, cbCopy), buslogicR3CopySgFromGuestBios, &Args);
3100	}
3101
3102	return cbCopied == cbCopy ? VINF_SUCCESS : VERR_PDM_MEDIAEX_IOBUF_UNDERRUN;
3103	}
3104
3105	/**
3106	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqCompleteNotify}
3107	*/
3108	static DECLCALLBACK(int) buslogicR3IoReqCompleteNotify(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3109	void *pvIoReqAlloc, int rcReq)
3110	{
3111	RT_NOREF(hIoReq);
3112	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3113	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3114	buslogicR3ReqComplete(pDevIns, PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC), PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC),
3115	(PBUSLOGICREQ)pvIoReqAlloc, rcReq);
3116	return VINF_SUCCESS;
3117	}
3118
3119	/**
3120	* @interface_method_impl{PDMIMEDIAEXPORT,pfnIoReqStateChanged}
3121	*/
3122	static DECLCALLBACK(void) buslogicR3IoReqStateChanged(PPDMIMEDIAEXPORT pInterface, PDMMEDIAEXIOREQ hIoReq,
3123	void *pvIoReqAlloc, PDMMEDIAEXIOREQSTATE enmState)
3124	{
3125	RT_NOREF(hIoReq, pvIoReqAlloc, enmState);
3126	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3127
3128	switch (enmState)
3129	{
3130	case PDMMEDIAEXIOREQSTATE_SUSPENDED:
3131	{
3132	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3133	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3134
3135	/* Make sure the request is not accounted for so the VM can suspend successfully. */
3136	uint32_t cTasksActive = ASMAtomicDecU32(&pTgtDev->cOutstandingRequests);
3137	if (!cTasksActive && pThisCC->fSignalIdle)
3138	PDMDevHlpAsyncNotificationCompleted(pDevIns);
3139	break;
3140	}
3141	case PDMMEDIAEXIOREQSTATE_ACTIVE:
3142	/* Make sure the request is accounted for so the VM suspends only when the request is complete. */
3143	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3144	break;
3145	default:
3146	AssertMsgFailed(("Invalid request state given %u\n", enmState));
3147	}
3148	}
3149
3150	/**
3151	* @interface_method_impl{PDMIMEDIAEXPORT,pfnMediumEjected}
3152	*/
3153	static DECLCALLBACK(void) buslogicR3MediumEjected(PPDMIMEDIAEXPORT pInterface)
3154	{
3155	PBUSLOGICDEVICE pTgtDev = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IMediaExPort);
3156	PPDMDEVINS pDevIns = pTgtDev->pDevIns;
3157	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3158
3159	if (pThisCC->pMediaNotify)
3160	{
3161	int rc = PDMDevHlpVMReqCallNoWait(pDevIns, VMCPUID_ANY,
3162	(PFNRT)pThisCC->pMediaNotify->pfnEjected, 2,
3163	pThisCC->pMediaNotify, pTgtDev->iLUN);
3164	AssertRC(rc);
3165	}
3166	}
3167
3168	static int buslogicR3DeviceSCSIRequestSetup(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC, RTGCPHYS GCPhysAddrCCB)
3169	{
3170	int rc = VINF_SUCCESS;
3171	uint8_t uTargetIdCCB;
3172	CCBU CCBGuest;
3173
3174	/* Fetch the CCB from guest memory. */
3175	/** @todo How much do we really have to read? */
3176	blPhysReadMeta(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest, sizeof(CCB32));
3177
3178	uTargetIdCCB = pThis->fMbxIs24Bit ? CCBGuest.o.uTargetId : CCBGuest.n.uTargetId;
3179	if (RT_LIKELY(uTargetIdCCB < RT_ELEMENTS(pThisCC->aDeviceStates)))
3180	{
3181	PBUSLOGICDEVICE pTgtDev = &pThisCC->aDeviceStates[uTargetIdCCB];
3182
3183	#ifdef LOG_ENABLED
3184	buslogicR3DumpCCBInfo(&CCBGuest, pThis->fMbxIs24Bit);
3185	#endif
3186
3187	/* Check if device is present on bus. If not return error immediately and don't process this further. */
3188	if (RT_LIKELY(pTgtDev->fPresent))
3189	{
3190	PDMMEDIAEXIOREQ hIoReq;
3191	PBUSLOGICREQ pReq;
3192	rc = pTgtDev->pDrvMediaEx->pfnIoReqAlloc(pTgtDev->pDrvMediaEx, &hIoReq, (void **)&pReq,
3193	GCPhysAddrCCB, PDMIMEDIAEX_F_SUSPEND_ON_RECOVERABLE_ERR);
3194	if (RT_SUCCESS(rc))
3195	{
3196	pReq->pTargetDevice = pTgtDev;
3197	pReq->GCPhysAddrCCB = GCPhysAddrCCB;
3198	pReq->fBIOS = false;
3199	pReq->hIoReq = hIoReq;
3200	pReq->fIs24Bit = pThis->fMbxIs24Bit;
3201
3202	/* Make a copy of the CCB */
3203	memcpy(&pReq->CCBGuest, &CCBGuest, sizeof(CCBGuest));
3204
3205	/* Alloc required buffers. */
3206	rc = buslogicR3SenseBufferAlloc(pReq);
3207	AssertMsgRC(rc, ("Mapping sense buffer failed rc=%Rrc\n", rc));
3208
3209	size_t cbBuf = 0;
3210	rc = buslogicR3QueryDataBufferSize(pDevIns, &pReq->CCBGuest, pReq->fIs24Bit, &cbBuf);
3211	AssertRC(rc);
3212
3213	uint32_t uLun = pReq->fIs24Bit ? pReq->CCBGuest.o.uLogicalUnit
3214	: pReq->CCBGuest.n.uLogicalUnit;
3215
3216	PDMMEDIAEXIOREQSCSITXDIR enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_UNKNOWN;
3217	size_t cbSense = buslogicR3ConvertSenseBufferLength(CCBGuest.c.cbSenseData);
3218
3219	if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_NO_DATA)
3220	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_NONE;
3221	else if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_OUT)
3222	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_TO_DEVICE;
3223	else if (CCBGuest.c.uDataDirection == BUSLOGIC_CCB_DIRECTION_IN)
3224	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_FROM_DEVICE;
3225
3226	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3227	rc = pTgtDev->pDrvMediaEx->pfnIoReqSendScsiCmd(pTgtDev->pDrvMediaEx, pReq->hIoReq, uLun,
3228	&pReq->CCBGuest.c.abCDB[0], pReq->CCBGuest.c.cbCDB,
3229	enmXferDir, NULL, cbBuf, pReq->pbSenseBuffer, cbSense, NULL,
3230	&pReq->u8ScsiSts, 30 * RT_MS_1SEC);
3231	if (rc != VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
3232	buslogicR3ReqComplete(pDevIns, pThis, pThisCC, pReq, rc);
3233	}
3234	else
3235	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3236	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT,
3237	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3238	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3239	}
3240	else
3241	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3242	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_SCSI_SELECTION_TIMEOUT,
3243	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3244	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3245	}
3246	else
3247	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3248	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER,
3249	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3250	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3251
3252	return rc;
3253	}
3254
3255	static int buslogicR3DeviceSCSIRequestAbort(PPDMDEVINS pDevIns, PBUSLOGIC pThis, RTGCPHYS GCPhysAddrCCB)
3256	{
3257	uint8_t uTargetIdCCB;
3258	CCBU CCBGuest;
3259
3260	blPhysReadMeta(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest, sizeof(CCB32));
3261
3262	uTargetIdCCB = pThis->fMbxIs24Bit ? CCBGuest.o.uTargetId : CCBGuest.n.uTargetId;
3263	if (RT_LIKELY(uTargetIdCCB < RT_ELEMENTS(pThis->afDevicePresent)))
3264	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3265	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_ABORT_QUEUE_GENERATED,
3266	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3267	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_ABORTED_NOT_FOUND);
3268	else
3269	buslogicR3SendIncomingMailbox(pDevIns, pThis, GCPhysAddrCCB, &CCBGuest,
3270	BUSLOGIC_MAILBOX_INCOMING_ADAPTER_STATUS_INVALID_COMMAND_PARAMETER,
3271	BUSLOGIC_MAILBOX_INCOMING_DEVICE_STATUS_OPERATION_GOOD,
3272	BUSLOGIC_MAILBOX_INCOMING_COMPLETION_WITH_ERROR);
3273
3274	return VINF_SUCCESS;
3275	}
3276
3277	/**
3278	* Read a mailbox from guest memory. Convert 24-bit mailboxes to
3279	* 32-bit format.
3280	*
3281	* @returns Mailbox guest physical address.
3282	* @param pDevIns The device instance.
3283	* @param pThis Pointer to the shared BusLogic instance data.
3284	* @param pMbx Pointer to the mailbox to read into.
3285	*/
3286	static RTGCPHYS buslogicR3ReadOutgoingMailbox(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PMailbox32 pMbx)
3287	{
3288	RTGCPHYS GCMailbox;
3289
3290	if (pThis->fMbxIs24Bit)
3291	{
3292	Mailbox24 Mbx24;
3293
3294	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->uMailboxOutgoingPositionCurrent * sizeof(Mailbox24));
3295	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx24, sizeof(Mailbox24));
3296	pMbx->u32PhysAddrCCB = ADDR_TO_U32(Mbx24.aPhysAddrCCB);
3297	pMbx->u.out.uActionCode = Mbx24.uCmdState;
3298	}
3299	else
3300	{
3301	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->uMailboxOutgoingPositionCurrent * sizeof(Mailbox32));
3302	blPhysReadMeta(pDevIns, pThis, GCMailbox, pMbx, sizeof(Mailbox32));
3303	}
3304
3305	return GCMailbox;
3306	}
3307
3308	/**
3309	* Read mailbox from the guest and execute command.
3310	*
3311	* @returns VBox status code.
3312	* @param pDevIns The device instance.
3313	* @param pThis Pointer to the shared BusLogic instance data.
3314	* @param pThisCC Pointer to the ring-3 BusLogic instance data.
3315	*/
3316	static int buslogicR3ProcessMailboxNext(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC)
3317	{
3318	RTGCPHYS GCPhysAddrMailboxCurrent;
3319	Mailbox32 MailboxGuest;
3320	int rc = VINF_SUCCESS;
3321
3322	if (!pThis->fStrictRoundRobinMode)
3323	{
3324	/* Search for a filled mailbox - stop if we have scanned all mailboxes. */
3325	uint8_t uMailboxPosCur = pThis->uMailboxOutgoingPositionCurrent;
3326
3327	do
3328	{
3329	/* Fetch mailbox from guest memory. */
3330	GCPhysAddrMailboxCurrent = buslogicR3ReadOutgoingMailbox(pDevIns, pThis, &MailboxGuest);
3331
3332	/* Check the next mailbox. */
3333	buslogicR3OutgoingMailboxAdvance(pThis);
3334	} while ( MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE
3335	&& uMailboxPosCur != pThis->uMailboxOutgoingPositionCurrent);
3336	}
3337	else
3338	{
3339	/* Fetch mailbox from guest memory. */
3340	GCPhysAddrMailboxCurrent = buslogicR3ReadOutgoingMailbox(pDevIns, pThis, &MailboxGuest);
3341	}
3342
3343	/*
3344	* Check if the mailbox is actually loaded.
3345	* It might be possible that the guest notified us without
3346	* a loaded mailbox. Do nothing in that case but leave a
3347	* log entry.
3348	*/
3349	if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE)
3350	{
3351	Log(("No loaded mailbox left\n"));
3352	return VERR_NO_DATA;
3353	}
3354
3355	LogFlow(("Got loaded mailbox at slot %u, CCB phys %RGp\n", pThis->uMailboxOutgoingPositionCurrent, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB));
3356	#ifdef LOG_ENABLED
3357	buslogicR3DumpMailboxInfo(&MailboxGuest, true);
3358	#endif
3359
3360	/* We got the mailbox, mark it as free in the guest. */
3361	uint8_t uActionCode = BUSLOGIC_MAILBOX_OUTGOING_ACTION_FREE;
3362	unsigned uCodeOffs = pThis->fMbxIs24Bit ? RT_OFFSETOF(Mailbox24, uCmdState) : RT_OFFSETOF(Mailbox32, u.out.uActionCode);
3363	blPhysWriteMeta(pDevIns, pThis, GCPhysAddrMailboxCurrent + uCodeOffs, &uActionCode, sizeof(uActionCode));
3364
3365	if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_START_COMMAND)
3366	rc = buslogicR3DeviceSCSIRequestSetup(pDevIns, pThis, pThisCC, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB);
3367	else if (MailboxGuest.u.out.uActionCode == BUSLOGIC_MAILBOX_OUTGOING_ACTION_ABORT_COMMAND)
3368	{
3369	LogFlow(("Aborting mailbox\n"));
3370	rc = buslogicR3DeviceSCSIRequestAbort(pDevIns, pThis, (RTGCPHYS)MailboxGuest.u32PhysAddrCCB);
3371	}
3372	else
3373	AssertMsgFailed(("Invalid outgoing mailbox action code %u\n", MailboxGuest.u.out.uActionCode));
3374
3375	AssertRC(rc);
3376
3377	/* Advance to the next mailbox. */
3378	if (pThis->fStrictRoundRobinMode)
3379	buslogicR3OutgoingMailboxAdvance(pThis);
3380
3381	return rc;
3382	}
3383
3384	/**
3385	* Processes a SCSI request issued by the BIOS with the BUSLOGICCOMMAND_EXECUTE_SCSI_COMMAND command.
3386	*
3387	* @returns nothing.
3388	* @param pDevIns The device instance.
3389	* @param pThis Pointer to the shared BusLogic instance data.
3390	* @param pThisCC Pointer to the ring-3 BusLogic instance data.
3391	*/
3392	static void buslogicR3ProcessBiosReq(PPDMDEVINS pDevIns, PBUSLOGIC pThis, PBUSLOGICCC pThisCC)
3393	{
3394	PESCMD pCmd = (PESCMD)pThis->aCommandBuffer;
3395
3396	if (RT_LIKELY( pCmd->uTargetId < RT_ELEMENTS(pThisCC->aDeviceStates)
3397	&& pCmd->cbCDB <= 16))
3398	{
3399	PBUSLOGICDEVICE pTgtDev = &pThisCC->aDeviceStates[pCmd->uTargetId];
3400
3401	/* Check if device is present on bus. If not return error immediately and don't process this further. */
3402	if (RT_LIKELY(pTgtDev->fPresent))
3403	{
3404	PDMMEDIAEXIOREQ hIoReq;
3405	PBUSLOGICREQ pReq;
3406	int rc = pTgtDev->pDrvMediaEx->pfnIoReqAlloc(pTgtDev->pDrvMediaEx, &hIoReq, (void **)&pReq,
3407	0, PDMIMEDIAEX_F_SUSPEND_ON_RECOVERABLE_ERR);
3408	if (RT_SUCCESS(rc))
3409	{
3410	pReq->pTargetDevice = pTgtDev;
3411	pReq->GCPhysAddrCCB = 0;
3412	pReq->fBIOS = true;
3413	pReq->hIoReq = hIoReq;
3414	pReq->fIs24Bit = false;
3415
3416	uint32_t uLun = pCmd->uLogicalUnit;
3417
3418	PDMMEDIAEXIOREQSCSITXDIR enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_UNKNOWN;
3419
3420	if (pCmd->uDataDirection == 2)
3421	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_TO_DEVICE;
3422	else if (pCmd->uDataDirection == 1)
3423	enmXferDir = PDMMEDIAEXIOREQSCSITXDIR_FROM_DEVICE;
3424
3425	ASMAtomicIncU32(&pTgtDev->cOutstandingRequests);
3426	rc = pTgtDev->pDrvMediaEx->pfnIoReqSendScsiCmd(pTgtDev->pDrvMediaEx, pReq->hIoReq, uLun,
3427	&pCmd->abCDB[0], pCmd->cbCDB,
3428	enmXferDir, NULL, pCmd->cbData, NULL, 0 /cbSense/, NULL,
3429	&pReq->u8ScsiSts, 30 * RT_MS_1SEC);
3430	if (rc != VINF_PDM_MEDIAEX_IOREQ_IN_PROGRESS)
3431	buslogicR3ReqComplete(pDevIns, pThis, pThisCC, pReq, rc);
3432	}
3433	else
3434	buslogicR3ReqCompleteBios(pThis, SCSI_STATUS_CHECK_CONDITION);
3435	}
3436	else
3437	buslogicR3ReqCompleteBios(pThis, SCSI_STATUS_CHECK_CONDITION);
3438	}
3439	else
3440	buslogicR3ReqCompleteBios(pThis, SCSI_STATUS_CHECK_CONDITION);
3441	}
3442
3443
3444	/** @callback_method_impl{FNSSMDEVLIVEEXEC} */
3445	static DECLCALLBACK(int) buslogicR3LiveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass)
3446	{
3447	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3448	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3449	RT_NOREF(uPass);
3450
3451	/* Save the device config. */
3452	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3453	pHlp->pfnSSMPutBool(pSSM, pThisCC->aDeviceStates[i].fPresent);
3454
3455	return VINF_SSM_DONT_CALL_AGAIN;
3456	}
3457
3458	/** @callback_method_impl{FNSSMDEVSAVEEXEC} */
3459	static DECLCALLBACK(int) buslogicR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3460	{
3461	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3462	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3463	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3464	uint32_t cReqsSuspended = 0;
3465
3466	/* Every device first. */
3467	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3468	{
3469	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3470
3471	AssertMsg(!pDevice->cOutstandingRequests,
3472	("There are still outstanding requests on this device\n"));
3473	pHlp->pfnSSMPutBool(pSSM, pDevice->fPresent);
3474	pHlp->pfnSSMPutU32(pSSM, pDevice->cOutstandingRequests);
3475
3476	if (pDevice->fPresent)
3477	cReqsSuspended += pDevice->pDrvMediaEx->pfnIoReqGetSuspendedCount(pDevice->pDrvMediaEx);
3478	}
3479	/* Now the main device state. */
3480	pHlp->pfnSSMPutU8 (pSSM, pThis->regStatus);
3481	pHlp->pfnSSMPutU8 (pSSM, pThis->regInterrupt);
3482	pHlp->pfnSSMPutU8 (pSSM, pThis->regGeometry);
3483	pHlp->pfnSSMPutMem (pSSM, &pThis->LocalRam, sizeof(pThis->LocalRam));
3484	pHlp->pfnSSMPutU8 (pSSM, pThis->uOperationCode);
3485	pHlp->pfnSSMPutMem (pSSM, &pThis->aCommandBuffer, sizeof(pThis->aCommandBuffer));
3486	pHlp->pfnSSMPutU8 (pSSM, pThis->iParameter);
3487	pHlp->pfnSSMPutU8 (pSSM, pThis->cbCommandParametersLeft);
3488	pHlp->pfnSSMPutBool (pSSM, pThis->fUseLocalRam);
3489	pHlp->pfnSSMPutMem (pSSM, pThis->aReplyBuffer, sizeof(pThis->aReplyBuffer));
3490	pHlp->pfnSSMPutU8 (pSSM, pThis->iReply);
3491	pHlp->pfnSSMPutU8 (pSSM, pThis->cbReplyParametersLeft);
3492	pHlp->pfnSSMPutBool (pSSM, pThis->fIRQEnabled);
3493	pHlp->pfnSSMPutU8 (pSSM, pThis->uISABaseCode);
3494	pHlp->pfnSSMPutU32 (pSSM, pThis->cMailbox);
3495	pHlp->pfnSSMPutBool (pSSM, pThis->fMbxIs24Bit);
3496	pHlp->pfnSSMPutGCPhys(pSSM, pThis->GCPhysAddrMailboxOutgoingBase);
3497	pHlp->pfnSSMPutU32 (pSSM, pThis->uMailboxOutgoingPositionCurrent);
3498	pHlp->pfnSSMPutU32 (pSSM, pThis->cMailboxesReady);
3499	pHlp->pfnSSMPutBool (pSSM, pThis->fNotificationSent);
3500	pHlp->pfnSSMPutGCPhys(pSSM, pThis->GCPhysAddrMailboxIncomingBase);
3501	pHlp->pfnSSMPutU32 (pSSM, pThis->uMailboxIncomingPositionCurrent);
3502	pHlp->pfnSSMPutBool (pSSM, pThis->fStrictRoundRobinMode);
3503	pHlp->pfnSSMPutBool (pSSM, pThis->fExtendedLunCCBFormat);
3504
3505	pHlp->pfnSSMPutU32(pSSM, cReqsSuspended);
3506
3507	/* Save the physical CCB address of all suspended requests. */
3508	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates) && cReqsSuspended; i++)
3509	{
3510	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3511	if (pDevice->fPresent)
3512	{
3513	uint32_t cThisReqsSuspended = pDevice->pDrvMediaEx->pfnIoReqGetSuspendedCount(pDevice->pDrvMediaEx);
3514
3515	cReqsSuspended -= cThisReqsSuspended;
3516	if (cThisReqsSuspended)
3517	{
3518	PDMMEDIAEXIOREQ hIoReq;
3519	PBUSLOGICREQ pReq;
3520	int rc = pDevice->pDrvMediaEx->pfnIoReqQuerySuspendedStart(pDevice->pDrvMediaEx, &hIoReq,
3521	(void **)&pReq);
3522	AssertRCBreak(rc);
3523
3524	for (;;)
3525	{
3526	pHlp->pfnSSMPutU32(pSSM, (uint32_t)pReq->GCPhysAddrCCB);
3527
3528	cThisReqsSuspended--;
3529	if (!cThisReqsSuspended)
3530	break;
3531
3532	rc = pDevice->pDrvMediaEx->pfnIoReqQuerySuspendedNext(pDevice->pDrvMediaEx, hIoReq,
3533	&hIoReq, (void **)&pReq);
3534	AssertRCBreak(rc);
3535	}
3536	}
3537	}
3538	}
3539
3540	return pHlp->pfnSSMPutU32(pSSM, UINT32_MAX);
3541	}
3542
3543	/** @callback_method_impl{FNSSMDEVLOADDONE} */
3544	static DECLCALLBACK(int) buslogicR3LoadDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3545	{
3546	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3547	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3548	RT_NOREF(pSSM);
3549
3550	buslogicR3RegisterISARange(pDevIns, pThis, pThis->uISABaseCode);
3551
3552	/* Kick of any requests we might need to redo. */
3553	if (pThisCC->cReqsRedo)
3554	{
3555	for (unsigned i = 0; i < pThisCC->cReqsRedo; i++)
3556	{
3557	int rc = buslogicR3DeviceSCSIRequestSetup(pDevIns, pThis, pThisCC, pThisCC->paGCPhysAddrCCBRedo[i]);
3558	AssertRC(rc);
3559	}
3560
3561	RTMemFree(pThisCC->paGCPhysAddrCCBRedo);
3562	pThisCC->paGCPhysAddrCCBRedo = NULL;
3563	pThisCC->cReqsRedo = 0;
3564	}
3565
3566	return VINF_SUCCESS;
3567	}
3568
3569	/** @callback_method_impl{FNSSMDEVLOADEXEC} */
3570	static DECLCALLBACK(int) buslogicR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
3571	{
3572	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3573	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3574	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3575	int rc = VINF_SUCCESS;
3576
3577	/* We support saved states only from this and older versions. */
3578	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_VERSION)
3579	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
3580
3581	/* Every device first. */
3582	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3583	{
3584	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
3585
3586	AssertMsg(!pDevice->cOutstandingRequests,
3587	("There are still outstanding requests on this device\n"));
3588	bool fPresent;
3589	rc = pHlp->pfnSSMGetBool(pSSM, &fPresent);
3590	AssertRCReturn(rc, rc);
3591	if (pDevice->fPresent != fPresent)
3592	return pHlp->pfnSSMSetCfgError(pSSM, RT_SRC_POS, N_("Target %u config mismatch: config=%RTbool state=%RTbool"), i, pDevice->fPresent, fPresent);
3593
3594	if (uPass == SSM_PASS_FINAL)
3595	pHlp->pfnSSMGetU32V(pSSM, &pDevice->cOutstandingRequests);
3596	}
3597
3598	if (uPass != SSM_PASS_FINAL)
3599	return VINF_SUCCESS;
3600
3601	/* Now the main device state. */
3602	pHlp->pfnSSMGetU8V (pSSM, &pThis->regStatus);
3603	pHlp->pfnSSMGetU8V (pSSM, &pThis->regInterrupt);
3604	pHlp->pfnSSMGetU8V (pSSM, &pThis->regGeometry);
3605	pHlp->pfnSSMGetMem (pSSM, &pThis->LocalRam, sizeof(pThis->LocalRam));
3606	pHlp->pfnSSMGetU8 (pSSM, &pThis->uOperationCode);
3607	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_CMDBUF_RESIZE)
3608	pHlp->pfnSSMGetMem(pSSM, &pThis->aCommandBuffer, sizeof(pThis->aCommandBuffer));
3609	else
3610	pHlp->pfnSSMGetMem(pSSM, &pThis->aCommandBuffer, BUSLOGIC_COMMAND_SIZE_OLD);
3611	pHlp->pfnSSMGetU8 (pSSM, &pThis->iParameter);
3612	pHlp->pfnSSMGetU8 (pSSM, &pThis->cbCommandParametersLeft);
3613	pHlp->pfnSSMGetBool (pSSM, &pThis->fUseLocalRam);
3614	pHlp->pfnSSMGetMem (pSSM, pThis->aReplyBuffer, sizeof(pThis->aReplyBuffer));
3615	pHlp->pfnSSMGetU8 (pSSM, &pThis->iReply);
3616	pHlp->pfnSSMGetU8 (pSSM, &pThis->cbReplyParametersLeft);
3617	pHlp->pfnSSMGetBool (pSSM, &pThis->fIRQEnabled);
3618	pHlp->pfnSSMGetU8 (pSSM, &pThis->uISABaseCode);
3619	pHlp->pfnSSMGetU32 (pSSM, &pThis->cMailbox);
3620	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_24BIT_MBOX)
3621	pHlp->pfnSSMGetBool(pSSM, &pThis->fMbxIs24Bit);
3622	pHlp->pfnSSMGetGCPhys(pSSM, &pThis->GCPhysAddrMailboxOutgoingBase);
3623	pHlp->pfnSSMGetU32 (pSSM, &pThis->uMailboxOutgoingPositionCurrent);
3624	pHlp->pfnSSMGetU32V (pSSM, &pThis->cMailboxesReady);
3625	pHlp->pfnSSMGetBoolV (pSSM, &pThis->fNotificationSent);
3626	pHlp->pfnSSMGetGCPhys(pSSM, &pThis->GCPhysAddrMailboxIncomingBase);
3627	pHlp->pfnSSMGetU32 (pSSM, &pThis->uMailboxIncomingPositionCurrent);
3628	pHlp->pfnSSMGetBool (pSSM, &pThis->fStrictRoundRobinMode);
3629	pHlp->pfnSSMGetBool (pSSM, &pThis->fExtendedLunCCBFormat);
3630
3631	if (uVersion <= BUSLOGIC_SAVED_STATE_MINOR_PRE_VBOXSCSI_REMOVAL)
3632	{
3633	rc = vboxscsiR3LoadExecLegacy(pDevIns->pHlpR3, pSSM);
3634	if (RT_FAILURE(rc))
3635	{
3636	LogRel(("BusLogic: Failed to restore BIOS state: %Rrc.\n", rc));
3637	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic: Failed to restore BIOS state\n"));
3638	}
3639	}
3640
3641	if (uVersion > BUSLOGIC_SAVED_STATE_MINOR_PRE_ERROR_HANDLING)
3642	{
3643	/* Check if there are pending tasks saved. */
3644	uint32_t cTasks = 0;
3645
3646	pHlp->pfnSSMGetU32(pSSM, &cTasks);
3647
3648	if (cTasks)
3649	{
3650	pThisCC->paGCPhysAddrCCBRedo = (PRTGCPHYS)RTMemAllocZ(cTasks * sizeof(RTGCPHYS));
3651	if (RT_LIKELY(pThisCC->paGCPhysAddrCCBRedo))
3652	{
3653	pThisCC->cReqsRedo = cTasks;
3654
3655	for (uint32_t i = 0; i < cTasks; i++)
3656	{
3657	uint32_t u32PhysAddrCCB;
3658
3659	rc = pHlp->pfnSSMGetU32(pSSM, &u32PhysAddrCCB);
3660	AssertRCBreak(rc);
3661
3662	pThisCC->paGCPhysAddrCCBRedo[i] = u32PhysAddrCCB;
3663	}
3664	}
3665	else
3666	rc = VERR_NO_MEMORY;
3667	}
3668	}
3669
3670	if (RT_SUCCESS(rc))
3671	{
3672	uint32_t u32;
3673	rc = pHlp->pfnSSMGetU32(pSSM, &u32);
3674	if (RT_SUCCESS(rc))
3675	AssertMsgReturn(u32 == UINT32_MAX, ("%#x\n", u32), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
3676	}
3677
3678	return rc;
3679	}
3680
3681	/**
3682	* Gets the pointer to the status LED of a device - called from the SCSI driver.
3683	*
3684	* @returns VBox status code.
3685	* @param pInterface Pointer to the interface structure containing the called function pointer.
3686	* @param iLUN The unit which status LED we desire. Always 0 here as the driver
3687	* doesn't know about other LUN's.
3688	* @param ppLed Where to store the LED pointer.
3689	*/
3690	static DECLCALLBACK(int) buslogicR3DeviceQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3691	{
3692	PBUSLOGICDEVICE pDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, ILed);
3693	if (iLUN == 0)
3694	{
3695	*ppLed = &pDevice->Led;
3696	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
3697	return VINF_SUCCESS;
3698	}
3699	return VERR_PDM_LUN_NOT_FOUND;
3700	}
3701
3702	/**
3703	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
3704	*/
3705	static DECLCALLBACK(void ) buslogicR3DeviceQueryInterface(PPDMIBASE pInterface, const char pszIID)
3706	{
3707	PBUSLOGICDEVICE pDevice = RT_FROM_MEMBER(pInterface, BUSLOGICDEVICE, IBase);
3708	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pDevice->IBase);
3709	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAPORT, &pDevice->IMediaPort);
3710	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIMEDIAEXPORT, &pDevice->IMediaExPort);
3711	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pDevice->ILed);
3712	return NULL;
3713	}
3714
3715	/**
3716	* Gets the pointer to the status LED of a unit.
3717	*
3718	* @returns VBox status code.
3719	* @param pInterface Pointer to the interface structure containing the called function pointer.
3720	* @param iLUN The unit which status LED we desire.
3721	* @param ppLed Where to store the LED pointer.
3722	*/
3723	static DECLCALLBACK(int) buslogicR3StatusQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3724	{
3725	PBUSLOGICCC pThisCC = RT_FROM_MEMBER(pInterface, BUSLOGICCC, ILeds);
3726	if (iLUN < BUSLOGIC_MAX_DEVICES)
3727	{
3728	*ppLed = &pThisCC->aDeviceStates[iLUN].Led;
3729	Assert((*ppLed)->u32Magic == PDMLED_MAGIC);
3730	return VINF_SUCCESS;
3731	}
3732	return VERR_PDM_LUN_NOT_FOUND;
3733	}
3734
3735	/**
3736	* @interface_method_impl{PDMIBASE,pfnQueryInterface}
3737	*/
3738	static DECLCALLBACK(void ) buslogicR3StatusQueryInterface(PPDMIBASE pInterface, const char pszIID)
3739	{
3740	PBUSLOGICCC pThisCC = RT_FROM_MEMBER(pInterface, BUSLOGICCC, IBase);
3741	PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThisCC->IBase);
3742	PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThisCC->ILeds);
3743	return NULL;
3744	}
3745
3746	/**
3747	* @callback_method_impl{FNPDMTHREADWAKEUPDEV}
3748	*/
3749	static DECLCALLBACK(int) buslogicR3Worker(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3750	{
3751	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3752	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3753
3754	if (pThread->enmState == PDMTHREADSTATE_INITIALIZING)
3755	return VINF_SUCCESS;
3756
3757	while (pThread->enmState == PDMTHREADSTATE_RUNNING)
3758	{
3759	int rc;
3760
3761	ASMAtomicWriteBool(&pThisCC->fWrkThreadSleeping, true);
3762	bool fNotificationSent = ASMAtomicXchgBool(&pThis->fNotificationSent, false);
3763	if (!fNotificationSent)
3764	{
3765	Assert(ASMAtomicReadBool(&pThisCC->fWrkThreadSleeping));
3766	rc = PDMDevHlpSUPSemEventWaitNoResume(pDevIns, pThis->hEvtProcess, RT_INDEFINITE_WAIT);
3767	AssertLogRelMsgReturn(RT_SUCCESS(rc) \|\| rc == VERR_INTERRUPTED, ("%Rrc\n", rc), rc);
3768	if (RT_UNLIKELY(pThread->enmState != PDMTHREADSTATE_RUNNING))
3769	break;
3770	LogFlowFunc(("Woken up with rc=%Rrc\n", rc));
3771	ASMAtomicWriteBool(&pThis->fNotificationSent, false);
3772	}
3773
3774	ASMAtomicWriteBool(&pThisCC->fWrkThreadSleeping, false);
3775
3776	if (ASMAtomicXchgBool(&pThis->fBiosReqPending, false))
3777	buslogicR3ProcessBiosReq(pDevIns, pThis, pThisCC);
3778
3779	if (ASMAtomicXchgU32(&pThis->cMailboxesReady, 0))
3780	{
3781	/* Process mailboxes. */
3782	do
3783	{
3784	rc = buslogicR3ProcessMailboxNext(pDevIns, pThis, pThisCC);
3785	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_NO_DATA, ("Processing mailbox failed rc=%Rrc\n", rc));
3786	} while (RT_SUCCESS(rc));
3787	}
3788	} /* While running */
3789
3790	return VINF_SUCCESS;
3791	}
3792
3793
3794	/**
3795	* @callback_method_impl{FNPDMTHREADWAKEUPDEV}
3796	*/
3797	static DECLCALLBACK(int) buslogicR3WorkerWakeUp(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3798	{
3799	RT_NOREF(pThread);
3800	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3801	return PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtProcess);
3802	}
3803
3804	/**
3805	* BusLogic debugger info callback.
3806	*
3807	* @param pDevIns The device instance.
3808	* @param pHlp The output helpers.
3809	* @param pszArgs The arguments.
3810	*/
3811	static DECLCALLBACK(void) buslogicR3Info(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
3812	{
3813	static const char *apszModels[] = { "BusLogic BT-958D", "BusLogic BT-545C", "Adaptec AHA-1540B" };
3814	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3815	unsigned i;
3816	bool fVerbose = false;
3817
3818	/* Parse arguments. */
3819	if (pszArgs)
3820	fVerbose = strstr(pszArgs, "verbose") != NULL;
3821
3822	/* Show basic information. */
3823	pHlp->pfnPrintf(pHlp, "%s#%d: %s ",
3824	pDevIns->pReg->szName,
3825	pDevIns->iInstance,
3826	pThis->uDevType >= RT_ELEMENTS(apszModels) ? "Unknown model" : apszModels[pThis->uDevType]);
3827	if (pThis->uIsaIrq)
3828	pHlp->pfnPrintf(pHlp, "ISA I/O=%RTiop IRQ=%u ",
3829	pThis->IOISABase,
3830	pThis->uIsaIrq);
3831	else
3832	pHlp->pfnPrintf(pHlp, "PCI I/O=%04x ISA I/O=%RTiop MMIO=%RGp IRQ=%u ",
3833	PDMDevHlpIoPortGetMappingAddress(pDevIns, pThis->hIoPortsPci), pThis->IOISABase,
3834	PDMDevHlpMmioGetMappingAddress(pDevIns, pThis->hMmio),
3835	PCIDevGetInterruptLine(pDevIns->apPciDevs[0]));
3836	pHlp->pfnPrintf(pHlp, "RC=%RTbool R0=%RTbool\n", pDevIns->fRCEnabled, pDevIns->fR0Enabled);
3837
3838	/* Print mailbox state. */
3839	if (pThis->regStatus & BL_STAT_INREQ)
3840	pHlp->pfnPrintf(pHlp, "Mailbox not initialized\n");
3841	else
3842	pHlp->pfnPrintf(pHlp, "%u-bit mailbox with %u entries at %RGp (%d LUN CCBs)\n",
3843	pThis->fMbxIs24Bit ? 24 : 32, pThis->cMailbox,
3844	pThis->GCPhysAddrMailboxOutgoingBase,
3845	pThis->fMbxIs24Bit ? 8 : pThis->fExtendedLunCCBFormat ? 64 : 8);
3846
3847	/* Print register contents. */
3848	pHlp->pfnPrintf(pHlp, "Registers: STAT=%02x INTR=%02x GEOM=%02x\n",
3849	pThis->regStatus, pThis->regInterrupt, pThis->regGeometry);
3850
3851	/* Print miscellaneous state. */
3852	pHlp->pfnPrintf(pHlp, "HAC interrupts: %s\n",
3853	pThis->fIRQEnabled ? "on" : "off");
3854
3855	/* Print the current command, if any. */
3856	if (pThis->uOperationCode != 0xff )
3857	pHlp->pfnPrintf(pHlp, "Current command: %02X\n", pThis->uOperationCode);
3858
3859	/* Print the previous command, if any. */
3860	if (pThis->uPrevCmd != 0xff )
3861	pHlp->pfnPrintf(pHlp, "Last completed command: %02X\n", pThis->uPrevCmd);
3862
3863	if (fVerbose && (pThis->regStatus & BL_STAT_INREQ) == 0)
3864	{
3865	RTGCPHYS GCMailbox;
3866
3867	/* Dump the mailbox contents. */
3868	if (pThis->fMbxIs24Bit)
3869	{
3870	Mailbox24 Mbx24;
3871
3872	/* Outgoing mailbox, 24-bit format. */
3873	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase;
3874	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (24-bit) at %06X:\n", GCMailbox);
3875	for (i = 0; i < pThis->cMailbox; ++i)
3876	{
3877	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx24, sizeof(Mailbox24));
3878	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %06X action code %02X", i, ADDR_TO_U32(Mbx24.aPhysAddrCCB), Mbx24.uCmdState);
3879	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3880	GCMailbox += sizeof(Mailbox24);
3881	}
3882
3883	/* Incoming mailbox, 24-bit format. */
3884	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox24));
3885	pHlp->pfnPrintf(pHlp, " Incoming mailbox entries (24-bit) at %06X:\n", GCMailbox);
3886	for (i = 0; i < pThis->cMailbox; ++i)
3887	{
3888	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx24, sizeof(Mailbox24));
3889	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %06X completion code %02X", i, ADDR_TO_U32(Mbx24.aPhysAddrCCB), Mbx24.uCmdState);
3890	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxIncomingPositionCurrent == i ? " *" : "");
3891	GCMailbox += sizeof(Mailbox24);
3892	}
3893
3894	}
3895	else
3896	{
3897	Mailbox32 Mbx32;
3898
3899	/* Outgoing mailbox, 32-bit format. */
3900	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase;
3901	pHlp->pfnPrintf(pHlp, " Outgoing mailbox entries (32-bit) at %08X:\n", (uint32_t)GCMailbox);
3902	for (i = 0; i < pThis->cMailbox; ++i)
3903	{
3904	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx32, sizeof(Mailbox32));
3905	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %08X action code %02X", i, Mbx32.u32PhysAddrCCB, Mbx32.u.out.uActionCode);
3906	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxOutgoingPositionCurrent == i ? " *" : "");
3907	GCMailbox += sizeof(Mailbox32);
3908	}
3909
3910	/* Incoming mailbox, 32-bit format. */
3911	GCMailbox = pThis->GCPhysAddrMailboxOutgoingBase + (pThis->cMailbox * sizeof(Mailbox32));
3912	pHlp->pfnPrintf(pHlp, " Incoming mailbox entries (32-bit) at %08X:\n", (uint32_t)GCMailbox);
3913	for (i = 0; i < pThis->cMailbox; ++i)
3914	{
3915	blPhysReadMeta(pDevIns, pThis, GCMailbox, &Mbx32, sizeof(Mailbox32));
3916	pHlp->pfnPrintf(pHlp, " slot %03d: CCB at %08X completion code %02X BTSTAT %02X SDSTAT %02X", i,
3917	Mbx32.u32PhysAddrCCB, Mbx32.u.in.uCompletionCode, Mbx32.u.in.uHostAdapterStatus, Mbx32.u.in.uTargetDeviceStatus);
3918	pHlp->pfnPrintf(pHlp, "%s\n", pThis->uMailboxIncomingPositionCurrent == i ? " *" : "");
3919	GCMailbox += sizeof(Mailbox32);
3920	}
3921
3922	}
3923	}
3924	}
3925
3926	/* -=-=-=-=- Helper -=-=-=-=- */
3927
3928	/**
3929	* Checks if all asynchronous I/O is finished.
3930	*
3931	* Used by buslogicR3Reset, buslogicR3Suspend and buslogicR3PowerOff.
3932	*
3933	* @returns true if quiesced, false if busy.
3934	* @param pDevIns The device instance.
3935	*/
3936	static bool buslogicR3AllAsyncIOIsFinished(PPDMDEVINS pDevIns)
3937	{
3938	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3939
3940	for (uint32_t i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3941	{
3942	PBUSLOGICDEVICE pThisDevice = &pThisCC->aDeviceStates[i];
3943	if (pThisDevice->pDrvBase)
3944	{
3945	if (pThisDevice->cOutstandingRequests != 0)
3946	return false;
3947	}
3948	}
3949
3950	return true;
3951	}
3952
3953	/**
3954	* Callback employed by buslogicR3Suspend and buslogicR3PowerOff.
3955	*
3956	* @returns true if we've quiesced, false if we're still working.
3957	* @param pDevIns The device instance.
3958	*/
3959	static DECLCALLBACK(bool) buslogicR3IsAsyncSuspendOrPowerOffDone(PPDMDEVINS pDevIns)
3960	{
3961	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
3962	return false;
3963
3964	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3965	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
3966	return true;
3967	}
3968
3969	/**
3970	* Common worker for buslogicR3Suspend and buslogicR3PowerOff.
3971	*/
3972	static void buslogicR3SuspendOrPowerOff(PPDMDEVINS pDevIns)
3973	{
3974	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
3975	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
3976
3977	ASMAtomicWriteBool(&pThisCC->fSignalIdle, true);
3978	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
3979	PDMDevHlpSetAsyncNotification(pDevIns, buslogicR3IsAsyncSuspendOrPowerOffDone);
3980	else
3981	{
3982	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
3983	AssertMsg(!pThis->fNotificationSent, ("The PDM Queue should be empty at this point\n"));
3984	RT_NOREF(pThis);
3985	}
3986
3987	for (uint32_t i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
3988	{
3989	PBUSLOGICDEVICE pThisDevice = &pThisCC->aDeviceStates[i];
3990	if (pThisDevice->pDrvMediaEx)
3991	pThisDevice->pDrvMediaEx->pfnNotifySuspend(pThisDevice->pDrvMediaEx);
3992	}
3993	}
3994
3995	/**
3996	* Suspend notification.
3997	*
3998	* @param pDevIns The device instance data.
3999	*/
4000	static DECLCALLBACK(void) buslogicR3Suspend(PPDMDEVINS pDevIns)
4001	{
4002	Log(("buslogicR3Suspend\n"));
4003	buslogicR3SuspendOrPowerOff(pDevIns);
4004	}
4005
4006	/**
4007	* Detach notification.
4008	*
4009	* One harddisk at one port has been unplugged.
4010	* The VM is suspended at this point.
4011	*
4012	* @param pDevIns The device instance.
4013	* @param iLUN The logical unit which is being detached.
4014	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
4015	*/
4016	static DECLCALLBACK(void) buslogicR3Detach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
4017	{
4018	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4019	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4020	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[iLUN];
4021	Log(("%s:\n", __FUNCTION__));
4022	RT_NOREF(fFlags);
4023
4024
4025	AssertMsg(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
4026	("BusLogic: Device does not support hotplugging\n"));
4027
4028	/*
4029	* Zero some important members.
4030	*/
4031	pThis->afDevicePresent[iLUN] = false;
4032	pDevice->fPresent = false;
4033	pDevice->pDrvBase = NULL;
4034	pDevice->pDrvMedia = NULL;
4035	pDevice->pDrvMediaEx = NULL;
4036	}
4037
4038	/**
4039	* Attach command.
4040	*
4041	* This is called when we change block driver.
4042	*
4043	* @returns VBox status code.
4044	* @param pDevIns The device instance.
4045	* @param iLUN The logical unit which is being detached.
4046	* @param fFlags Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
4047	*/
4048	static DECLCALLBACK(int) buslogicR3Attach(PPDMDEVINS pDevIns, unsigned iLUN, uint32_t fFlags)
4049	{
4050	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4051	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4052	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[iLUN];
4053	int rc;
4054
4055	AssertMsgReturn(fFlags & PDM_TACH_FLAGS_NOT_HOT_PLUG,
4056	("BusLogic: Device does not support hotplugging\n"),
4057	VERR_INVALID_PARAMETER);
4058
4059	/* the usual paranoia */
4060	AssertRelease(!pDevice->pDrvBase);
4061	AssertRelease(!pDevice->pDrvMedia);
4062	AssertRelease(!pDevice->pDrvMediaEx);
4063	Assert(pDevice->iLUN == iLUN);
4064
4065	/*
4066	* Try attach the SCSI driver and get the interfaces,
4067	* required as well as optional.
4068	*/
4069	rc = PDMDevHlpDriverAttach(pDevIns, pDevice->iLUN, &pDevice->IBase, &pDevice->pDrvBase, NULL);
4070	if (RT_SUCCESS(rc))
4071	{
4072	/* Query the media interface. */
4073	pDevice->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIA);
4074	AssertMsgReturn(RT_VALID_PTR(pDevice->pDrvMedia),
4075	("BusLogic configuration error: LUN#%d misses the basic media interface!\n", pDevice->iLUN),
4076	VERR_PDM_MISSING_INTERFACE);
4077
4078	/* Get the extended media interface. */
4079	pDevice->pDrvMediaEx = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIAEX);
4080	AssertMsgReturn(RT_VALID_PTR(pDevice->pDrvMediaEx),
4081	("BusLogic configuration error: LUN#%d misses the extended media interface!\n", pDevice->iLUN),
4082	VERR_PDM_MISSING_INTERFACE);
4083
4084	rc = pDevice->pDrvMediaEx->pfnIoReqAllocSizeSet(pDevice->pDrvMediaEx, sizeof(BUSLOGICREQ));
4085	AssertMsgRCReturn(rc, ("BusLogic configuration error: LUN#%u: Failed to set I/O request size!", pDevice->iLUN),
4086	rc);
4087
4088	pThis->afDevicePresent[iLUN] = true;
4089	pDevice->fPresent = true;
4090	}
4091	else
4092	AssertMsgFailed(("Failed to attach LUN#%d. rc=%Rrc\n", pDevice->iLUN, rc));
4093
4094	if (RT_FAILURE(rc))
4095	{
4096	pThis->afDevicePresent[iLUN] = false;
4097	pDevice->fPresent = false;
4098	pDevice->pDrvBase = NULL;
4099	pDevice->pDrvMedia = NULL;
4100	pDevice->pDrvMediaEx = NULL;
4101	}
4102	return rc;
4103	}
4104
4105	/**
4106	* Callback employed by buslogicR3Reset.
4107	*
4108	* @returns true if we've quiesced, false if we're still working.
4109	* @param pDevIns The device instance.
4110	*/
4111	static DECLCALLBACK(bool) buslogicR3IsAsyncResetDone(PPDMDEVINS pDevIns)
4112	{
4113	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4114	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4115
4116	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4117	return false;
4118	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
4119
4120	buslogicR3HwReset(pDevIns, pThis, true);
4121	return true;
4122	}
4123
4124	/**
4125	* @copydoc FNPDMDEVRESET
4126	*/
4127	static DECLCALLBACK(void) buslogicR3Reset(PPDMDEVINS pDevIns)
4128	{
4129	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4130	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4131
4132	ASMAtomicWriteBool(&pThisCC->fSignalIdle, true);
4133	if (!buslogicR3AllAsyncIOIsFinished(pDevIns))
4134	PDMDevHlpSetAsyncNotification(pDevIns, buslogicR3IsAsyncResetDone);
4135	else
4136	{
4137	ASMAtomicWriteBool(&pThisCC->fSignalIdle, false);
4138	buslogicR3HwReset(pDevIns, pThis, true);
4139	}
4140	}
4141
4142	/**
4143	* Poweroff notification.
4144	*
4145	* @param pDevIns Pointer to the device instance
4146	*/
4147	static DECLCALLBACK(void) buslogicR3PowerOff(PPDMDEVINS pDevIns)
4148	{
4149	Log(("buslogicR3PowerOff\n"));
4150	buslogicR3SuspendOrPowerOff(pDevIns);
4151	}
4152
4153	/**
4154	* Destroy a driver instance.
4155	*
4156	* Most VM resources are freed by the VM. This callback is provided so that any non-VM
4157	* resources can be freed correctly.
4158	*
4159	* @param pDevIns The device instance data.
4160	*/
4161	static DECLCALLBACK(int) buslogicR3Destruct(PPDMDEVINS pDevIns)
4162	{
4163	PDMDEV_CHECK_VERSIONS_RETURN_QUIET(pDevIns);
4164	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4165
4166	PDMDevHlpCritSectDelete(pDevIns, &pThis->CritSectIntr);
4167
4168	if (pThis->hEvtProcess != NIL_SUPSEMEVENT)
4169	{
4170	PDMDevHlpSUPSemEventClose(pDevIns, pThis->hEvtProcess);
4171	pThis->hEvtProcess = NIL_SUPSEMEVENT;
4172	}
4173
4174	return VINF_SUCCESS;
4175	}
4176
4177	/**
4178	* @interface_method_impl{PDMDEVREG,pfnConstruct}
4179	*/
4180	static DECLCALLBACK(int) buslogicR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
4181	{
4182	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
4183	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4184	PBUSLOGICCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PBUSLOGICCC);
4185	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
4186
4187	/*
4188	* Init instance data (do early because of constructor).
4189	*/
4190	pThis->hMmio = NIL_IOMMMIOHANDLE;
4191	pThis->hIoPortsIsa = NIL_IOMIOPORTHANDLE;
4192	pThis->hIoPortsPci = NIL_IOMIOPORTHANDLE;
4193	pThisCC->pDevIns = pDevIns;
4194	pThisCC->IBase.pfnQueryInterface = buslogicR3StatusQueryInterface;
4195	pThisCC->ILeds.pfnQueryStatusLed = buslogicR3StatusQueryStatusLed;
4196
4197	PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
4198	PDMPCIDEV_ASSERT_VALID(pDevIns, pPciDev);
4199
4200	PDMPciDevSetVendorId(pPciDev, 0x104b); /* BusLogic */
4201	PDMPciDevSetDeviceId(pPciDev, 0x1040); /* BT-958 */
4202	PDMPciDevSetCommand(pPciDev, PCI_COMMAND_IOACCESS \| PCI_COMMAND_MEMACCESS);
4203	PDMPciDevSetRevisionId(pPciDev, 0x01);
4204	PDMPciDevSetClassProg(pPciDev, 0x00); /* SCSI */
4205	PDMPciDevSetClassSub(pPciDev, 0x00); /* SCSI */
4206	PDMPciDevSetClassBase(pPciDev, 0x01); /* Mass storage */
4207	PDMPciDevSetBaseAddress(pPciDev, 0, true /IO/, false /Pref/, false /64-bit/, 0x00000000);
4208	PDMPciDevSetBaseAddress(pPciDev, 1, false /IO/, false /Pref/, false /64-bit/, 0x00000000);
4209	PDMPciDevSetSubSystemVendorId(pPciDev, 0x104b);
4210	PDMPciDevSetSubSystemId(pPciDev, 0x1040);
4211	PDMPciDevSetInterruptLine(pPciDev, 0x00);
4212	PDMPciDevSetInterruptPin(pPciDev, 0x01);
4213
4214	/*
4215	* Validate and read configuration.
4216	*/
4217	PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns, "Bootable\|" /* Keep it for legacy configs, even though it doesn't do anything anymore, see @bugref{4841}. */
4218	"AdapterType\|"
4219	"ISACompat",
4220	"");
4221
4222	/* Figure out the emulated device type. */
4223	char szCfgStr[16];
4224	int rc = pHlp->pfnCFGMQueryStringDef(pCfg, "AdapterType", szCfgStr, sizeof(szCfgStr), "BT-958D");
4225	if (RT_FAILURE(rc))
4226	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read AdapterType as string"));
4227	Log(("%s: AdapterType=%s\n", __FUNCTION__, szCfgStr));
4228
4229	/* Grok the AdapterType setting. */
4230	if (!strcmp(szCfgStr, "BT-958D")) /* Default PCI device, 32-bit and 24-bit addressing. */
4231	{
4232	pThis->uDevType = DEV_BT_958D;
4233	pThis->uDefaultISABaseCode = ISA_BASE_DISABLED;
4234	}
4235	else if (!strcmp(szCfgStr, "BT-545C")) /* ISA device, 24-bit addressing only. */
4236	{
4237	pThis->uDevType = DEV_BT_545C;
4238	pThis->uIsaIrq = 11;
4239	}
4240	else if (!strcmp(szCfgStr, "AHA-1540B")) /* Competitor ISA device. */
4241	{
4242	pThis->uDevType = DEV_AHA_1540B;
4243	pThis->uIsaIrq = 11;
4244	}
4245	else
4246	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
4247	N_("BusLogic configuration error: invalid AdapterType setting"));
4248
4249	/* Only the first instance defaults to having the ISA compatibility ports enabled. */
4250	if (iInstance == 0)
4251	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "ISACompat", szCfgStr, sizeof(szCfgStr), "Alternate");
4252	else
4253	rc = pHlp->pfnCFGMQueryStringDef(pCfg, "ISACompat", szCfgStr, sizeof(szCfgStr), "Disabled");
4254	if (RT_FAILURE(rc))
4255	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic configuration error: failed to read ISACompat as string"));
4256	Log(("%s: ISACompat=%s\n", __FUNCTION__, szCfgStr));
4257
4258	/* Grok the ISACompat setting. */
4259	if (!strcmp(szCfgStr, "Disabled"))
4260	pThis->uDefaultISABaseCode = ISA_BASE_DISABLED;
4261	else if (!strcmp(szCfgStr, "Primary"))
4262	pThis->uDefaultISABaseCode = 0; /* I/O base at 330h. */
4263	else if (!strcmp(szCfgStr, "Alternate"))
4264	pThis->uDefaultISABaseCode = 1; /* I/O base at 334h. */
4265	else
4266	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
4267	N_("BusLogic configuration error: invalid ISACompat setting"));
4268
4269	/*
4270	* Register the PCI device and its I/O regions if applicable.
4271	*/
4272	if (!pThis->uIsaIrq)
4273	{
4274	rc = PDMDevHlpPCIRegister(pDevIns, pPciDev);
4275	AssertRCReturn(rc, rc);
4276
4277	rc = PDMDevHlpPCIIORegionCreateIo(pDevIns, 0 /iPciRegion/, 32 /cPorts/,
4278	buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/,
4279	"BusLogic PCI", NULL /paExtDescs/, &pThis->hIoPortsPci);
4280	AssertRCReturn(rc, rc);
4281
4282	rc = PDMDevHlpPCIIORegionCreateMmio(pDevIns, 1 /iPciRegion/, 32 /cbRegion/, PCI_ADDRESS_SPACE_MEM,
4283	buslogicMMIOWrite, buslogicMMIORead, NULL /pvUser/,
4284	IOMMMIO_FLAGS_READ_PASSTHRU \| IOMMMIO_FLAGS_WRITE_PASSTHRU,
4285	"BusLogic MMIO", &pThis->hMmio);
4286	AssertRCReturn(rc, rc);
4287	}
4288
4289	/* Set up the compatibility I/O range. */
4290	rc = PDMDevHlpIoPortCreate(pDevIns, 4 /cPorts/, NULL /pPciDev/, UINT32_MAX /iPciRegion/,
4291	buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/,
4292	"BusLogic ISA", NULL /paExtDescs/, &pThis->hIoPortsIsa);
4293	AssertRCReturn(rc, rc);
4294
4295	rc = buslogicR3RegisterISARange(pDevIns, pThis, pThis->uDefaultISABaseCode);
4296	if (RT_FAILURE(rc))
4297	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register ISA I/O handlers"));
4298
4299
4300	/* Init the interrupt critsect. */
4301	rc = PDMDevHlpCritSectInit(pDevIns, &pThis->CritSectIntr, RT_SRC_POS, "BusLogic-Intr#%u", pDevIns->iInstance);
4302	if (RT_FAILURE(rc))
4303	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic: cannot create critical section"));
4304
4305	/*
4306	* Create event semaphore and worker thread.
4307	*/
4308	rc = PDMDevHlpSUPSemEventCreate(pDevIns, &pThis->hEvtProcess);
4309	if (RT_FAILURE(rc))
4310	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4311	N_("BusLogic: Failed to create SUP event semaphore"));
4312
4313	char szDevTag[20];
4314	RTStrPrintf(szDevTag, sizeof(szDevTag), "BUSLOGIC-%u", iInstance);
4315
4316	rc = PDMDevHlpThreadCreate(pDevIns, &pThisCC->pThreadWrk, pThis, buslogicR3Worker,
4317	buslogicR3WorkerWakeUp, 0, RTTHREADTYPE_IO, szDevTag);
4318	if (RT_FAILURE(rc))
4319	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4320	N_("BusLogic: Failed to create worker thread %s"), szDevTag);
4321
4322	/* Initialize per device state. */
4323	for (unsigned i = 0; i < RT_ELEMENTS(pThisCC->aDeviceStates); i++)
4324	{
4325	PBUSLOGICDEVICE pDevice = &pThisCC->aDeviceStates[i];
4326
4327	/* Initialize static parts of the device. */
4328	pDevice->iLUN = i;
4329	pDevice->pDevIns = pDevIns;
4330	pDevice->Led.u32Magic = PDMLED_MAGIC;
4331	pDevice->IBase.pfnQueryInterface = buslogicR3DeviceQueryInterface;
4332	pDevice->IMediaPort.pfnQueryDeviceLocation = buslogicR3QueryDeviceLocation;
4333	pDevice->IMediaExPort.pfnIoReqCompleteNotify = buslogicR3IoReqCompleteNotify;
4334	pDevice->IMediaExPort.pfnIoReqCopyFromBuf = buslogicR3IoReqCopyFromBuf;
4335	pDevice->IMediaExPort.pfnIoReqCopyToBuf = buslogicR3IoReqCopyToBuf;
4336	pDevice->IMediaExPort.pfnIoReqQueryBuf = NULL;
4337	pDevice->IMediaExPort.pfnIoReqQueryDiscardRanges = NULL;
4338	pDevice->IMediaExPort.pfnIoReqStateChanged = buslogicR3IoReqStateChanged;
4339	pDevice->IMediaExPort.pfnMediumEjected = buslogicR3MediumEjected;
4340	pDevice->ILed.pfnQueryStatusLed = buslogicR3DeviceQueryStatusLed;
4341	RTStrPrintf(pDevice->szName, sizeof(pDevice->szName), "Device%u", i);
4342
4343	/* Attach SCSI driver. */
4344	rc = PDMDevHlpDriverAttach(pDevIns, pDevice->iLUN, &pDevice->IBase, &pDevice->pDrvBase, pDevice->szName);
4345	if (RT_SUCCESS(rc))
4346	{
4347	/* Query the media interface. */
4348	pDevice->pDrvMedia = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIA);
4349	AssertMsgReturn(RT_VALID_PTR(pDevice->pDrvMedia),
4350	("Buslogic configuration error: LUN#%d misses the basic media interface!\n", pDevice->iLUN),
4351	VERR_PDM_MISSING_INTERFACE);
4352
4353	/* Get the extended media interface. */
4354	pDevice->pDrvMediaEx = PDMIBASE_QUERY_INTERFACE(pDevice->pDrvBase, PDMIMEDIAEX);
4355	AssertMsgReturn(RT_VALID_PTR(pDevice->pDrvMediaEx),
4356	("Buslogic configuration error: LUN#%d misses the extended media interface!\n", pDevice->iLUN),
4357	VERR_PDM_MISSING_INTERFACE);
4358
4359	rc = pDevice->pDrvMediaEx->pfnIoReqAllocSizeSet(pDevice->pDrvMediaEx, sizeof(BUSLOGICREQ));
4360	if (RT_FAILURE(rc))
4361	return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
4362	N_("Buslogic configuration error: LUN#%u: Failed to set I/O request size!"),
4363	pDevice->iLUN);
4364
4365	pThis->afDevicePresent[i] = true;
4366	pDevice->fPresent = true;
4367	}
4368	else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
4369	{
4370	pThis->afDevicePresent[i] = false;
4371	pDevice->fPresent = false;
4372	pDevice->pDrvBase = NULL;
4373	pDevice->pDrvMedia = NULL;
4374	pDevice->pDrvMediaEx = NULL;
4375	rc = VINF_SUCCESS;
4376	Log(("BusLogic: no driver attached to device %s\n", pDevice->szName));
4377	}
4378	else
4379	{
4380	AssertLogRelMsgFailed(("BusLogic: Failed to attach %s\n", pDevice->szName));
4381	return rc;
4382	}
4383	}
4384
4385	/*
4386	* Attach status driver (optional).
4387	*/
4388	PPDMIBASE pBase;
4389	rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThisCC->IBase, &pBase, "Status Port");
4390	if (RT_SUCCESS(rc))
4391	{
4392	pThisCC->pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
4393	pThisCC->pMediaNotify = PDMIBASE_QUERY_INTERFACE(pBase, PDMIMEDIANOTIFY);
4394	}
4395	else
4396	AssertMsgReturn(rc == VERR_PDM_NO_ATTACHED_DRIVER, ("Failed to attach to status driver. rc=%Rrc\n", rc),
4397	PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot attach to status driver")));
4398
4399	rc = PDMDevHlpSSMRegisterEx(pDevIns, BUSLOGIC_SAVED_STATE_MINOR_VERSION, sizeof(*pThis), NULL,
4400	NULL, buslogicR3LiveExec, NULL,
4401	NULL, buslogicR3SaveExec, NULL,
4402	NULL, buslogicR3LoadExec, buslogicR3LoadDone);
4403	if (RT_FAILURE(rc))
4404	return PDMDEV_SET_ERROR(pDevIns, rc, N_("BusLogic cannot register save state handlers"));
4405
4406	/*
4407	* Register the debugger info callback.
4408	*/
4409	char szTmp[128];
4410	RTStrPrintf(szTmp, sizeof(szTmp), "%s%d", pDevIns->pReg->szName, pDevIns->iInstance);
4411	PDMDevHlpDBGFInfoRegister(pDevIns, szTmp, "BusLogic HBA info", buslogicR3Info);
4412
4413	rc = buslogicR3HwReset(pDevIns, pThis, true);
4414	AssertMsgRC(rc, ("hardware reset of BusLogic host adapter failed rc=%Rrc\n", rc));
4415
4416	return rc;
4417	}
4418
4419	#else /* !IN_RING3 */
4420
4421	/**
4422	* @callback_method_impl{PDMDEVREGR0,pfnConstruct}
4423	*/
4424	static DECLCALLBACK(int) buslogicRZConstruct(PPDMDEVINS pDevIns)
4425	{
4426	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
4427	PBUSLOGIC pThis = PDMDEVINS_2_DATA(pDevIns, PBUSLOGIC);
4428
4429	if (!pThis->uIsaIrq)
4430	{
4431	int rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortsPci, buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/);
4432	AssertRCReturn(rc, rc);
4433
4434	rc = PDMDevHlpMmioSetUpContext(pDevIns, pThis->hMmio, buslogicMMIOWrite, buslogicMMIORead, NULL /pvUser/);
4435	AssertRCReturn(rc, rc);
4436	}
4437
4438	int rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortsIsa, buslogicIOPortWrite, buslogicIOPortRead, NULL /pvUser/);
4439	AssertRCReturn(rc, rc);
4440
4441	return VINF_SUCCESS;
4442	}
4443
4444
4445	#endif /* !IN_RING3 */
4446
4447	/**
4448	* The device registration structure.
4449	*/
4450	const PDMDEVREG g_DeviceBusLogic =
4451	{
4452	/* .u32Version = */ PDM_DEVREG_VERSION,
4453	/* .uReserved0 = */ 0,
4454	/* .szName = */ "buslogic",
4455	/* .fFlags = */ PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RZ \| PDM_DEVREG_FLAGS_NEW_STYLE
4456	\| PDM_DEVREG_FLAGS_FIRST_SUSPEND_NOTIFICATION \| PDM_DEVREG_FLAGS_FIRST_POWEROFF_NOTIFICATION
4457	\| PDM_DEVREG_FLAGS_FIRST_RESET_NOTIFICATION,
4458	/* .fClass = */ PDM_DEVREG_CLASS_STORAGE,
4459	/* .cMaxInstances = */ ~0U,
4460	/* .uSharedVersion = */ 42,
4461	/* .cbInstanceShared = */ sizeof(BUSLOGIC),
4462	/* .cbInstanceCC = */ sizeof(BUSLOGICCC),
4463	/* .cbInstanceRC = */ sizeof(BUSLOGICRC),
4464	/* .cMaxPciDevices = */ 1,
4465	/* .cMaxMsixVectors = */ 0,
4466	/* .pszDescription = */ "BusLogic BT-958 SCSI host adapter.\n",
4467	#if defined(IN_RING3)
4468	/* .pszRCMod = */ "VBoxDDRC.rc",
4469	/* .pszR0Mod = */ "VBoxDDR0.r0",
4470	/* .pfnConstruct = */ buslogicR3Construct,
4471	/* .pfnDestruct = */ buslogicR3Destruct,
4472	/* .pfnRelocate = */ NULL,
4473	/* .pfnMemSetup = */ NULL,
4474	/* .pfnPowerOn = */ NULL,
4475	/* .pfnReset = */ buslogicR3Reset,
4476	/* .pfnSuspend = */ buslogicR3Suspend,
4477	/* .pfnResume = */ NULL,
4478	/* .pfnAttach = */ buslogicR3Attach,
4479	/* .pfnDetach = */ buslogicR3Detach,
4480	/* .pfnQueryInterface = */ NULL,
4481	/* .pfnInitComplete = */ NULL,
4482	/* .pfnPowerOff = */ buslogicR3PowerOff,
4483	/* .pfnSoftReset = */ NULL,
4484	/* .pfnReserved0 = */ NULL,
4485	/* .pfnReserved1 = */ NULL,
4486	/* .pfnReserved2 = */ NULL,
4487	/* .pfnReserved3 = */ NULL,
4488	/* .pfnReserved4 = */ NULL,
4489	/* .pfnReserved5 = */ NULL,
4490	/* .pfnReserved6 = */ NULL,
4491	/* .pfnReserved7 = */ NULL,
4492	#elif defined(IN_RING0)
4493	/* .pfnEarlyConstruct = */ NULL,
4494	/* .pfnConstruct = */ buslogicRZConstruct,
4495	/* .pfnDestruct = */ NULL,
4496	/* .pfnFinalDestruct = */ NULL,
4497	/* .pfnRequest = */ NULL,
4498	/* .pfnReserved0 = */ NULL,
4499	/* .pfnReserved1 = */ NULL,
4500	/* .pfnReserved2 = */ NULL,
4501	/* .pfnReserved3 = */ NULL,
4502	/* .pfnReserved4 = */ NULL,
4503	/* .pfnReserved5 = */ NULL,
4504	/* .pfnReserved6 = */ NULL,
4505	/* .pfnReserved7 = */ NULL,
4506	#elif defined(IN_RC)
4507	/* .pfnConstruct = */ buslogicRZConstruct,
4508	/* .pfnReserved0 = */ NULL,
4509	/* .pfnReserved1 = */ NULL,
4510	/* .pfnReserved2 = */ NULL,
4511	/* .pfnReserved3 = */ NULL,
4512	/* .pfnReserved4 = */ NULL,
4513	/* .pfnReserved5 = */ NULL,
4514	/* .pfnReserved6 = */ NULL,
4515	/* .pfnReserved7 = */ NULL,
4516	#else
4517	# error "Not in IN_RING3, IN_RING0 or IN_RC!"
4518	#endif
4519	/* .u32VersionEnd = */ PDM_DEVREG_VERSION
4520	};
4521
4522	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Storage/DevBusLogic.cpp@ 98110

Download in other formats: