zorro_device: let bus-master DMA reach motherboard and accelerator RAM

[codewiz]

Problem

The A4091 (and any Zorro III bus master) could no longer scan its SCSI bus on
the A4000 profile: the autoboot ROM and driver run, but no units are found.

This regressed after v0.12.0, when two commits added the motherboard fast-RAM
bank (mb_ram, ending at $08000000) and the CPU-slot accelerator bank
(accel_ram, starting at $08000000). The A4000 profile fits its stock
motherboard RAM by default, and exec adds it as high-priority LOCAL|FAST, so
the guest allocates the driver's DMA structures there.

Root cause

Zorro bus-master DMA goes through DeviceHost::dma_read/dma_write, whose
address decode only handled chip RAM, slow RAM, and Zorro-board RAM. A Zorro III
master drives full 32-bit addresses, but the two new banks were not in the
decode, so reads of them returned the 0xFF unmapped sentinel and writes were
dropped. The driver's SELECT then read a garbage target ID out of motherboard
RAM and the scan came up empty. (A Zorro II master like the A2091 only drives
the low 24 bits and never reaches these banks, so it is unaffected.)

Fix

Decode mb_ram and accel_ram in all four dma_read/dma_write byte and word
helpers, next to the existing slow-RAM arm. New unit test
dma_round_trips_motherboard_and_accelerator_ram; cargo fmt/clippy clean.

Verified end to end: with the fix, the A4091's SCSI drives scan and mount on
boot; without it, none appear.

[Copilot]

Pull request overview

Fixes a regression where Zorro III bus-master DMA (e.g. the A4091 on the A4000 profile) could not access the 32-bit motherboard and CPU-slot accelerator RAM banks, causing DMA reads to return unmapped 0xFF and DMA writes to be dropped.

Changes:

• Extend DeviceHost DMA address decoding to include mb_ram and accel_ram for both word and byte DMA helpers.
• Add a unit test covering DMA round-trips through the motherboard and accelerator RAM banks.

Comments suppressed due to low confidence (1)

src/zorro_device.rs:76

• The new motherboard/accelerator word-write bounds checks use a + 1 < base + len, which can overflow for large DMA addresses and lead to out-of-bounds panics. Prefer computing a wrapping offset and checking off + 1 < len on that offset.

    let mb = mem.mb_ram_base() as usize;
    if a >= mb && a + 1 < mb + mem.mb_ram.len() {
        let o = a - mb;
        mem.mb_ram[o] = (w >> 8) as u8;
        mem.mb_ram[o + 1] = w as u8;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[LinuxJedi]

Good catch. Many thanks!