DevIommuIntel.cpp@ 89454

Last change on this file since 89454 was 89454, checked in by vboxsync, 4 years ago
Intel IOMMU: bugref:9967 Address translation, WIP.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 177.3 KB

Line
1	/* $Id: DevIommuIntel.cpp 89454 2021-06-02 08:00:30Z vboxsync $ */
2	/** @file
3	* IOMMU - Input/Output Memory Management Unit - Intel implementation.
4	*/
5
6	/*
7	* Copyright (C) 2021 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DEV_IOMMU
23	#include "VBoxDD.h"
24	#include "DevIommuIntel.h"
25
26	#include <iprt/mem.h>
27	#include <iprt/string.h>
28
29
30	/*********************************************************************************************************************************
31	* Defined Constants And Macros *
32	*********************************************************************************************************************************/
33	/** Gets the low uint32_t of a uint64_t or something equivalent.
34	*
35	* This is suitable for casting constants outside code (since RT_LO_U32 can't be
36	* used as it asserts for correctness when compiling on certain compilers). */
37	#define DMAR_LO_U32(a) (uint32_t)(UINT32_MAX & (a))
38
39	/** Gets the high uint32_t of a uint64_t or something equivalent.
40	*
41	* This is suitable for casting constants outside code (since RT_HI_U32 can't be
42	* used as it asserts for correctness when compiling on certain compilers). */
43	#define DMAR_HI_U32(a) (uint32_t)((a) >> 32)
44
45	/** Asserts MMIO access' offset and size are valid or returns appropriate error
46	* code suitable for returning from MMIO access handlers. */
47	#define DMAR_ASSERT_MMIO_ACCESS_RET(a_off, a_cb) \
48	do { \
49	AssertReturn((a_cb) == 4 \|\| (a_cb) == 8, VINF_IOM_MMIO_UNUSED_FF); \
50	AssertReturn(!((a_off) & ((a_cb) - 1)), VINF_IOM_MMIO_UNUSED_FF); \
51	} while (0)
52
53	/** Checks if the MMIO offset is valid. */
54	#define DMAR_IS_MMIO_OFF_VALID(a_off) ( (a_off) < DMAR_MMIO_GROUP_0_OFF_END \
55	\|\| (a_off) - DMAR_MMIO_GROUP_1_OFF_FIRST < DMAR_MMIO_GROUP_1_SIZE)
56
57	/** Gets the page offset mask given the number of bits to shift. */
58	#define DMAR_GET_PAGE_OFF_MASK(a_cShift) (~(UINT64_C(0xffffffffffffffff) << (a_cShift)))
59
60	/** Acquires the DMAR lock but returns with the given busy error code on failure. */
61	#define DMAR_LOCK_RET(a_pDevIns, a_pThisCC, a_rcBusy) \
62	do { \
63	if ((a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnLock((a_pDevIns), (a_rcBusy)) == VINF_SUCCESS) \
64	{ /* likely */ } \
65	else \
66	return (a_rcBusy); \
67	} while (0)
68
69	/** Acquires the DMAR lock (not expected to fail). */
70	#ifdef IN_RING3
71	# define DMAR_LOCK(a_pDevIns, a_pThisCC) (a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnLock((a_pDevIns), VERR_IGNORED)
72	#else
73	# define DMAR_LOCK(a_pDevIns, a_pThisCC) \
74	do { \
75	int const rcLock = (a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnLock((a_pDevIns), VINF_SUCCESS); \
76	AssertRC(rcLock); \
77	} while (0)
78	#endif
79
80	/** Release the DMAR lock. */
81	#define DMAR_UNLOCK(a_pDevIns, a_pThisCC) (a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnUnlock(a_pDevIns)
82
83	/** Asserts that the calling thread owns the DMAR lock. */
84	#define DMAR_ASSERT_LOCK_IS_OWNER(a_pDevIns, a_pThisCC) \
85	do { \
86	Assert((a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnLockIsOwner(a_pDevIns)); \
87	RT_NOREF1(a_pThisCC); \
88	} while (0)
89
90	/** Asserts that the calling thread does not own the DMAR lock. */
91	#define DMAR_ASSERT_LOCK_IS_NOT_OWNER(a_pDevIns, a_pThisCC) \
92	do { \
93	Assert((a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnLockIsOwner(a_pDevIns) == false); \
94	RT_NOREF1(a_pThisCC); \
95	} while (0)
96
97	/** The number of fault recording registers our implementation supports.
98	* Normal guest operation shouldn't trigger faults anyway, so we only support the
99	* minimum number of registers (which is 1).
100	*
101	* See Intel VT-d spec. 10.4.2 "Capability Register" (CAP_REG.NFR). */
102	#define DMAR_FRCD_REG_COUNT UINT32_C(1)
103
104	/** Offset of first register in group 0. */
105	#define DMAR_MMIO_GROUP_0_OFF_FIRST VTD_MMIO_OFF_VER_REG
106	/** Offset of last register in group 0 (inclusive). */
107	#define DMAR_MMIO_GROUP_0_OFF_LAST VTD_MMIO_OFF_MTRR_PHYSMASK9_REG
108	/** Last valid offset in group 0 (exclusive). */
109	#define DMAR_MMIO_GROUP_0_OFF_END (DMAR_MMIO_GROUP_0_OFF_LAST + 8 /* sizeof MTRR_PHYSMASK9_REG */)
110	/** Size of the group 0 (in bytes). */
111	#define DMAR_MMIO_GROUP_0_SIZE (DMAR_MMIO_GROUP_0_OFF_END - DMAR_MMIO_GROUP_0_OFF_FIRST)
112	/*< Implementation-specific MMIO offset of IVA_REG. /
113	#define DMAR_MMIO_OFF_IVA_REG 0xe50
114	/*< Implementation-specific MMIO offset of IOTLB_REG. /
115	#define DMAR_MMIO_OFF_IOTLB_REG 0xe58
116	/*< Implementation-specific MMIO offset of FRCD_LO_REG. /
117	#define DMAR_MMIO_OFF_FRCD_LO_REG 0xe70
118	/*< Implementation-specific MMIO offset of FRCD_HI_REG. /
119	#define DMAR_MMIO_OFF_FRCD_HI_REG 0xe78
120	AssertCompile(!(DMAR_MMIO_OFF_FRCD_LO_REG & 0xf));
121
122	/** Offset of first register in group 1. */
123	#define DMAR_MMIO_GROUP_1_OFF_FIRST VTD_MMIO_OFF_VCCAP_REG
124	/** Offset of last register in group 1 (inclusive). */
125	#define DMAR_MMIO_GROUP_1_OFF_LAST (DMAR_MMIO_OFF_FRCD_LO_REG + 8) * DMAR_FRCD_REG_COUNT
126	/** Last valid offset in group 1 (exclusive). */
127	#define DMAR_MMIO_GROUP_1_OFF_END (DMAR_MMIO_GROUP_1_OFF_LAST + 8 /* sizeof FRCD_HI_REG */)
128	/** Size of the group 1 (in bytes). */
129	#define DMAR_MMIO_GROUP_1_SIZE (DMAR_MMIO_GROUP_1_OFF_END - DMAR_MMIO_GROUP_1_OFF_FIRST)
130
131	/** DMAR implementation's major version number (exposed to software).
132	* We report 6 as the major version since we support queued-invalidations as
133	* software may make assumptions based on that.
134	*
135	* See Intel VT-d spec. 10.4.7 "Context Command Register" (CCMD_REG.CAIG). */
136	#define DMAR_VER_MAJOR 6
137	/** DMAR implementation's minor version number (exposed to software). */
138	#define DMAR_VER_MINOR 0
139
140	/** Number of domain supported (0=16, 1=64, 2=256, 3=1K, 4=4K, 5=16K, 6=64K,
141	* 7=Reserved). */
142	#define DMAR_ND 6
143
144	/** @name DMAR_PERM_XXX: DMA request permissions.
145	* The order of R, W, X bits is important as it corresponds to those bits in
146	* page-table entries.
147	*
148	* @{ */
149	/** DMA request permission: Read. */
150	#define DMAR_PERM_READ RT_BIT(0)
151	/** DMA request permission: Write. */
152	#define DMAR_PERM_WRITE RT_BIT(1)
153	/** DMA request permission: Execute (ER). */
154	#define DMAR_PERM_EXE RT_BIT(2)
155	/** DMA request permission: Supervisor privilege (PR). */
156	#define DMAR_PERM_PRIV RT_BIT(3)
157	/** DMA request permissions: All. */
158	#define DMAR_PERM_ALL (DMAR_PERM_READ \| DMAR_PERM_WRITE \| DMAR_PERM_EXE \| DMAR_PERM_PRIV)
159	/** @} */
160
161	/** Release log prefix string. */
162	#define DMAR_LOG_PFX "Intel-IOMMU"
163	/** The current saved state version. */
164	#define DMAR_SAVED_STATE_VERSION 1
165
166
167	/*********************************************************************************************************************************
168	* Structures and Typedefs *
169	*********************************************************************************************************************************/
170	/**
171	* DMAR error diagnostics.
172	* Sorted alphabetically so it's easier to add and locate items, no other reason.
173	*
174	* @note Members of this enum are used as array indices, so no gaps in enum
175	* values are not allowed. Update g_apszDmarDiagDesc when you modify
176	* fields in this enum.
177	*/
178	typedef enum
179	{
180	/* No error, this must be zero! */
181	kDmarDiag_None = 0,
182
183	/* Address Translation Faults. */
184	kDmarDiag_Atf_Lct_1,
185	kDmarDiag_Atf_Lct_2,
186	kDmarDiag_Atf_Lct_3,
187	kDmarDiag_Atf_Lct_4_1,
188	kDmarDiag_Atf_Lct_4_2,
189	kDmarDiag_Atf_Lct_4_3,
190	kDmarDiag_Atf_Lct_5,
191	kDmarDiag_Atf_Lgn_1_1,
192	kDmarDiag_Atf_Lgn_1_2,
193	kDmarDiag_Atf_Lgn_1_3,
194	kDmarDiag_Atf_Lgn_4,
195	kDmarDiag_Atf_Lrt_1,
196	kDmarDiag_Atf_Lrt_2,
197	kDmarDiag_Atf_Lrt_3,
198	kDmarDiag_Atf_Lsl_1,
199	kDmarDiag_Atf_Lsl_2,
200	kDmarDiag_Atf_Lsl_2_LargePage,
201	kDmarDiag_Atf_Rta_1_1,
202	kDmarDiag_Atf_Rta_1_2,
203	kDmarDiag_Atf_Rta_1_3,
204	kDmarDiag_Atf_Sgn_5,
205	kDmarDiag_Atf_Sgn_8,
206	kDmarDiag_Atf_Ssl_1,
207	kDmarDiag_Atf_Ssl_2,
208	kDmarDiag_Atf_Ssl_3,
209	kDmarDiag_Atf_Ssl_3_LargePage,
210
211	/* CCMD_REG faults. */
212	kDmarDiag_CcmdReg_NotSupported,
213	kDmarDiag_CcmdReg_Qi_Enabled,
214	kDmarDiag_CcmdReg_Ttm_Invalid,
215
216	/* IQA_REG faults. */
217	kDmarDiag_IqaReg_Dsc_Fetch_Error,
218	kDmarDiag_IqaReg_Dw_128_Invalid,
219	kDmarDiag_IqaReg_Dw_256_Invalid,
220
221	/* Invalidation Queue Error Info. */
222	kDmarDiag_Iqei_Dsc_Type_Invalid,
223	kDmarDiag_Iqei_Inv_Wait_Dsc_0_1_Rsvd,
224	kDmarDiag_Iqei_Inv_Wait_Dsc_2_3_Rsvd,
225	kDmarDiag_Iqei_Inv_Wait_Dsc_Invalid,
226	kDmarDiag_Iqei_Ttm_Rsvd,
227
228	/* IQT_REG faults. */
229	kDmarDiag_IqtReg_Qt_Invalid,
230	kDmarDiag_IqtReg_Qt_NotAligned,
231
232	/* Compatibility Format Interrupt Faults. */
233	kDmarDiag_Ir_Cfi_Blocked,
234
235	/* Remappable Format Interrupt Faults. */
236	kDmarDiag_Ir_Rfi_Intr_Index_Invalid,
237	kDmarDiag_Ir_Rfi_Irte_Mode_Invalid,
238	kDmarDiag_Ir_Rfi_Irte_Not_Present,
239	kDmarDiag_Ir_Rfi_Irte_Read_Failed,
240	kDmarDiag_Ir_Rfi_Irte_Rsvd,
241	kDmarDiag_Ir_Rfi_Irte_Svt_Bus,
242	kDmarDiag_Ir_Rfi_Irte_Svt_Masked,
243	kDmarDiag_Ir_Rfi_Irte_Svt_Rsvd,
244	kDmarDiag_Ir_Rfi_Rsvd,
245
246	/* Member for determining array index limit. */
247	kDmarDiag_End,
248
249	/* Usual 32-bit type size hack. */
250	kDmarDiag_32Bit_Hack = 0x7fffffff
251	} DMARDIAG;
252	AssertCompileSize(DMARDIAG, 4);
253
254	/** DMAR diagnostic enum description expansion.
255	* The below construct ensures typos in the input to this macro are caught
256	* during compile time. */
257	#define DMARDIAG_DESC(a_Name) RT_CONCAT(kDmarDiag_, a_Name) < kDmarDiag_End ? RT_STR(a_Name) : "Ignored"
258
259	/** DMAR diagnostics description for members in DMARDIAG. */
260	static const char *const g_apszDmarDiagDesc[] =
261	{
262	DMARDIAG_DESC(None ),
263	DMARDIAG_DESC(Atf_Lct_1 ),
264	DMARDIAG_DESC(Atf_Lct_2 ),
265	DMARDIAG_DESC(Atf_Lct_3 ),
266	DMARDIAG_DESC(Atf_Lct_4_1 ),
267	DMARDIAG_DESC(Atf_Lct_4_2 ),
268	DMARDIAG_DESC(Atf_Lct_4_3 ),
269	DMARDIAG_DESC(Atf_Lct_5 ),
270	DMARDIAG_DESC(Atf_Lgn_1_1 ),
271	DMARDIAG_DESC(Atf_Lgn_1_2 ),
272	DMARDIAG_DESC(Atf_Lgn_1_3 ),
273	DMARDIAG_DESC(Atf_Lgn_4 ),
274	DMARDIAG_DESC(Atf_Lrt_1 ),
275	DMARDIAG_DESC(Atf_Lrt_2 ),
276	DMARDIAG_DESC(Atf_Lrt_3 ),
277	DMARDIAG_DESC(Atf_Lsl_1 ),
278	DMARDIAG_DESC(Atf_Lsl_2 ),
279	DMARDIAG_DESC(Atf_Lsl_2_LargePage ),
280	DMARDIAG_DESC(Atf_Rta_1_1 ),
281	DMARDIAG_DESC(Atf_Rta_1_2 ),
282	DMARDIAG_DESC(Atf_Rta_1_3 ),
283	DMARDIAG_DESC(Atf_Sgn_5 ),
284	DMARDIAG_DESC(Atf_Sgn_8 ),
285	DMARDIAG_DESC(Atf_Ssl_1 ),
286	DMARDIAG_DESC(Atf_Ssl_2 ),
287	DMARDIAG_DESC(Atf_Ssl_3 ),
288	DMARDIAG_DESC(Atf_Ssl_3_LargePage ),
289	DMARDIAG_DESC(CcmdReg_NotSupported ),
290	DMARDIAG_DESC(CcmdReg_Qi_Enabled ),
291	DMARDIAG_DESC(CcmdReg_Ttm_Invalid ),
292	DMARDIAG_DESC(IqaReg_Dsc_Fetch_Error ),
293	DMARDIAG_DESC(IqaReg_Dw_128_Invalid ),
294	DMARDIAG_DESC(IqaReg_Dw_256_Invalid ),
295	DMARDIAG_DESC(Iqei_Dsc_Type_Invalid ),
296	DMARDIAG_DESC(Iqei_Inv_Wait_Dsc_0_1_Rsvd),
297	DMARDIAG_DESC(Iqei_Inv_Wait_Dsc_2_3_Rsvd),
298	DMARDIAG_DESC(Iqei_Inv_Wait_Dsc_Invalid ),
299	DMARDIAG_DESC(Iqei_Ttm_Rsvd ),
300	DMARDIAG_DESC(IqtReg_Qt_Invalid ),
301	DMARDIAG_DESC(IqtReg_Qt_NotAligned ),
302	DMARDIAG_DESC(Ir_Cfi_Blocked ),
303	DMARDIAG_DESC(Ir_Rfi_Intr_Index_Invalid ),
304	DMARDIAG_DESC(Ir_Rfi_Irte_Mode_Invalid ),
305	DMARDIAG_DESC(Ir_Rfi_Irte_Not_Present ),
306	DMARDIAG_DESC(Ir_Rfi_Irte_Read_Failed ),
307	DMARDIAG_DESC(Ir_Rfi_Irte_Rsvd ),
308	DMARDIAG_DESC(Ir_Rfi_Irte_Svt_Bus ),
309	DMARDIAG_DESC(Ir_Rfi_Irte_Svt_Masked ),
310	DMARDIAG_DESC(Ir_Rfi_Irte_Svt_Rsvd ),
311	DMARDIAG_DESC(Ir_Rfi_Rsvd ),
312	/* kDmarDiag_End */
313	};
314	AssertCompile(RT_ELEMENTS(g_apszDmarDiagDesc) == kDmarDiag_End);
315	#undef DMARDIAG_DESC
316
317	/**
318	* The shared DMAR device state.
319	*/
320	typedef struct DMAR
321	{
322	/** IOMMU device index. */
323	uint32_t idxIommu;
324	/** DMAR magic. */
325	uint32_t u32Magic;
326
327	/** Registers (group 0). */
328	uint8_t abRegs0[DMAR_MMIO_GROUP_0_SIZE];
329	/** Registers (group 1). */
330	uint8_t abRegs1[DMAR_MMIO_GROUP_1_SIZE];
331
332	/** @name Lazily activated registers.
333	* These are the active values for lazily activated registers. Software is free to
334	* modify the actual register values while remapping/translation is enabled but they
335	* take effect only when explicitly signaled by software, hence we need to hold the
336	* active values separately.
337	* @{ */
338	/** Currently active IRTA_REG. */
339	uint64_t uIrtaReg;
340	/** Currently active RTADDR_REG. */
341	uint64_t uRtaddrReg;
342	/** @} */
343
344	/** @name Register copies for a tiny bit faster and more convenient access.
345	* @{ */
346	/** Copy of VER_REG. */
347	uint8_t uVerReg;
348	/** Alignment. */
349	uint8_t abPadding[7];
350	/** Copy of CAP_REG. */
351	uint64_t fCapReg;
352	/** Copy of ECAP_REG. */
353	uint64_t fExtCapReg;
354	/** @} */
355
356	/** Host-address width (HAW) base address mask. */
357	uint64_t fHawBaseMask;
358	/** Maximum guest-address width (MGAW) invalid address mask. */
359	uint64_t fInvMgawMask;
360	/** Maximum supported paging level (3, 4 or 5). */
361	uint8_t cMaxPagingLevel;
362	/** DMA request valid permissions mask. */
363	uint8_t fPermValidMask;
364
365	/** The event semaphore the invalidation-queue thread waits on. */
366	SUPSEMEVENT hEvtInvQueue;
367	/** Padding. */
368	uint32_t uPadding0;
369	/** Error diagnostic. */
370	DMARDIAG enmDiag;
371	/** The MMIO handle. */
372	IOMMMIOHANDLE hMmio;
373
374	#ifdef VBOX_WITH_STATISTICS
375	STAMCOUNTER StatMmioReadR3; /*< Number of MMIO reads in R3. /
376	STAMCOUNTER StatMmioReadRZ; /*< Number of MMIO reads in RZ. /
377	STAMCOUNTER StatMmioWriteR3; /*< Number of MMIO writes in R3. /
378	STAMCOUNTER StatMmioWriteRZ; /*< Number of MMIO writes in RZ. /
379
380	STAMCOUNTER StatMsiRemapCfiR3; /*< Number of compatibility-format interrupts remap requests in R3. /
381	STAMCOUNTER StatMsiRemapCfiRZ; /*< Number of compatibility-format interrupts remap requests in RZ. /
382	STAMCOUNTER StatMsiRemapRfiR3; /*< Number of remappable-format interrupts remap requests in R3. /
383	STAMCOUNTER StatMsiRemapRfiRZ; /*< Number of remappable-format interrupts remap requests in RZ. /
384
385	STAMCOUNTER StatMemReadR3; /*< Number of memory read translation requests in R3. /
386	STAMCOUNTER StatMemReadRZ; /*< Number of memory read translation requests in RZ. /
387	STAMCOUNTER StatMemWriteR3; /*< Number of memory write translation requests in R3. /
388	STAMCOUNTER StatMemWriteRZ; /*< Number of memory write translation requests in RZ. /
389
390	STAMCOUNTER StatMemBulkReadR3; /*< Number of memory read bulk translation requests in R3. /
391	STAMCOUNTER StatMemBulkReadRZ; /*< Number of memory read bulk translation requests in RZ. /
392	STAMCOUNTER StatMemBulkWriteR3; /*< Number of memory write bulk translation requests in R3. /
393	STAMCOUNTER StatMemBulkWriteRZ; /*< Number of memory write bulk translation requests in RZ. /
394
395	STAMCOUNTER StatCcInvDsc; /*< Number of Context-cache descriptors processed. /
396	STAMCOUNTER StatIotlbInvDsc; /*< Number of IOTLB descriptors processed. /
397	STAMCOUNTER StatDevtlbInvDsc; /*< Number of Device-TLB descriptors processed. /
398	STAMCOUNTER StatIecInvDsc; /*< Number of Interrupt-Entry cache descriptors processed. /
399	STAMCOUNTER StatInvWaitDsc; /*< Number of Invalidation wait descriptors processed. /
400	STAMCOUNTER StatPasidIotlbInvDsc; /*< Number of PASID-based IOTLB descriptors processed. /
401	STAMCOUNTER StatPasidCacheInvDsc; /*< Number of PASID-cache descriptors processed. /
402	STAMCOUNTER StatPasidDevtlbInvDsc; /*< Number of PASID-based device-TLB descriptors processed. /
403	#endif
404	} DMAR;
405	/** Pointer to the DMAR device state. */
406	typedef DMAR *PDMAR;
407	/** Pointer to the const DMAR device state. */
408	typedef DMAR const *PCDMAR;
409	AssertCompileMemberAlignment(DMAR, abRegs0, 8);
410	AssertCompileMemberAlignment(DMAR, abRegs1, 8);
411
412	/**
413	* The ring-3 DMAR device state.
414	*/
415	typedef struct DMARR3
416	{
417	/** Device instance. */
418	PPDMDEVINSR3 pDevInsR3;
419	/** The IOMMU helper. */
420	R3PTRTYPE(PCPDMIOMMUHLPR3) pIommuHlpR3;
421	/** The invalidation-queue thread. */
422	R3PTRTYPE(PPDMTHREAD) pInvQueueThread;
423	} DMARR3;
424	/** Pointer to the ring-3 DMAR device state. */
425	typedef DMARR3 *PDMARR3;
426	/** Pointer to the const ring-3 DMAR device state. */
427	typedef DMARR3 const *PCDMARR3;
428
429	/**
430	* The ring-0 DMAR device state.
431	*/
432	typedef struct DMARR0
433	{
434	/** Device instance. */
435	PPDMDEVINSR0 pDevInsR0;
436	/** The IOMMU helper. */
437	R0PTRTYPE(PCPDMIOMMUHLPR0) pIommuHlpR0;
438	} DMARR0;
439	/** Pointer to the ring-0 IOMMU device state. */
440	typedef DMARR0 *PDMARR0;
441	/** Pointer to the const ring-0 IOMMU device state. */
442	typedef DMARR0 const *PCDMARR0;
443
444	/**
445	* The raw-mode DMAR device state.
446	*/
447	typedef struct DMARRC
448	{
449	/** Device instance. */
450	PPDMDEVINSRC pDevInsRC;
451	/** The IOMMU helper. */
452	RCPTRTYPE(PCPDMIOMMUHLPRC) pIommuHlpRC;
453	} DMARRC;
454	/** Pointer to the raw-mode DMAR device state. */
455	typedef DMARRC *PDMARRC;
456	/** Pointer to the const raw-mode DMAR device state. */
457	typedef DMARRC const *PCIDMARRC;
458
459	/** The DMAR device state for the current context. */
460	typedef CTX_SUFF(DMAR) DMARCC;
461	/** Pointer to the DMAR device state for the current context. */
462	typedef CTX_SUFF(PDMAR) PDMARCC;
463	/** Pointer to the const DMAR device state for the current context. */
464	typedef CTX_SUFF(PDMAR) const PCDMARCC;
465
466	/**
467	* DMAR originated events that generate interrupts.
468	*/
469	typedef enum DMAREVENTTYPE
470	{
471	/** Invalidation completion event. */
472	DMAREVENTTYPE_INV_COMPLETE = 0,
473	/** Fault event. */
474	DMAREVENTTYPE_FAULT
475	} DMAREVENTTYPE;
476
477	/**
478	* I/O TLB entry.
479	*/
480	typedef struct DMARIOTLBE
481	{
482	/** The system-physical base address of the translation. */
483	RTGCPHYS GCPhysBase;
484	/** The domain ID of the translated region. */
485	uint16_t idDomain;
486	/** The permissions granted. */
487	uint8_t fPerm;
488	/** The page shift of the translation. */
489	uint8_t cShift;
490	} DMARIOTLBE;
491	/** Pointer to an IOTLB entry. */
492	typedef DMARIOTLBE *PDMARIOTLBE;
493	/** Pointer to a const IOTLB entry. */
494	typedef DMARIOTLBE const *PCDMARIOTLBE;
495	AssertCompileSizeAlignment(DMARIOTLBE, 4);
496
497	/**
498	* DMA Memory Request.
499	*/
500	typedef struct DMARMEMREQ
501	{
502	/** The address being accessed. */
503	uint64_t uDmaAddr;
504	/** The size of the access (in bytes). */
505	size_t cbDma;
506	/** The requested permissions (DMAR_PERM_XXX). */
507	uint8_t fReqPerm;
508	/** The source device ID (bus, device, function). */
509	uint16_t idDevice;
510	/** The PASID if present (can be NIL_PCIPASID). */
511	PCIPASID Pasid;
512	/* The address translation type. */
513	PCIADDRTYPE enmAddrType;
514	/** The request type. */
515	VTDREQTYPE enmReqType;
516	} DMARMEMREQ;
517	/** Pointer to a DMA memory request. */
518	typedef DMARMEMREQ *PDMARMEMREQ;
519	/** Pointer to a const DMA memory request. */
520	typedef DMARMEMREQ const *PCDMARMEMREQ;
521
522	/**
523	* DMA Memory Request Remapping Information.
524	*/
525	typedef struct DMARMEMREQREMAP
526	{
527	/* The DMA memory request. */
528	DMARMEMREQ Req;
529	/** The table translation mode (VTD_TTM_XXX). */
530	uint8_t fTtm;
531	/** The fault processing disabled (FPD) bit. */
532	uint8_t fFpd;
533
534	/** The IOTLBE result for this remapping. */
535	DMARIOTLBE Iotlbe;
536	/** The size of the contiguous translated region (in bytes). */
537	size_t cbContiguous;
538	} DMARMEMREQREMAP;
539	/** Pointer to a DMA remap info. */
540	typedef DMARMEMREQREMAP *PDMARMEMREQREMAP;
541	/** Pointer to a const DMA remap info. */
542	typedef DMARMEMREQREMAP const *PCDMARMEMREQREMAP;
543
544
545	/*********************************************************************************************************************************
546	* Global Variables *
547	*********************************************************************************************************************************/
548	/**
549	* Read-write masks for DMAR registers (group 0).
550	*/
551	static uint32_t const g_au32RwMasks0[] =
552	{
553	/* Offset Register Low High */
554	/* 0x000 VER_REG */ VTD_VER_REG_RW_MASK,
555	/* 0x004 Reserved */ 0,
556	/* 0x008 CAP_REG */ DMAR_LO_U32(VTD_CAP_REG_RW_MASK), DMAR_HI_U32(VTD_CAP_REG_RW_MASK),
557	/* 0x010 ECAP_REG */ DMAR_LO_U32(VTD_ECAP_REG_RW_MASK), DMAR_HI_U32(VTD_ECAP_REG_RW_MASK),
558	/* 0x018 GCMD_REG */ VTD_GCMD_REG_RW_MASK,
559	/* 0x01c GSTS_REG */ VTD_GSTS_REG_RW_MASK,
560	/* 0x020 RTADDR_REG */ DMAR_LO_U32(VTD_RTADDR_REG_RW_MASK), DMAR_HI_U32(VTD_RTADDR_REG_RW_MASK),
561	/* 0x028 CCMD_REG */ DMAR_LO_U32(VTD_CCMD_REG_RW_MASK), DMAR_HI_U32(VTD_CCMD_REG_RW_MASK),
562	/* 0x030 Reserved */ 0,
563	/* 0x034 FSTS_REG */ VTD_FSTS_REG_RW_MASK,
564	/* 0x038 FECTL_REG */ VTD_FECTL_REG_RW_MASK,
565	/* 0x03c FEDATA_REG */ VTD_FEDATA_REG_RW_MASK,
566	/* 0x040 FEADDR_REG */ VTD_FEADDR_REG_RW_MASK,
567	/* 0x044 FEUADDR_REG */ VTD_FEUADDR_REG_RW_MASK,
568	/* 0x048 Reserved */ 0, 0,
569	/* 0x050 Reserved */ 0, 0,
570	/* 0x058 AFLOG_REG */ DMAR_LO_U32(VTD_AFLOG_REG_RW_MASK), DMAR_HI_U32(VTD_AFLOG_REG_RW_MASK),
571	/* 0x060 Reserved */ 0,
572	/* 0x064 PMEN_REG / 0, / RO as we don't support PLMR and PHMR. */
573	/* 0x068 PLMBASE_REG / 0, / RO as we don't support PLMR. */
574	/* 0x06c PLMLIMIT_REG / 0, / RO as we don't support PLMR. */
575	/* 0x070 PHMBASE_REG / 0, 0, / RO as we don't support PHMR. */
576	/* 0x078 PHMLIMIT_REG / 0, 0, / RO as we don't support PHMR. */
577	/* 0x080 IQH_REG */ DMAR_LO_U32(VTD_IQH_REG_RW_MASK), DMAR_HI_U32(VTD_IQH_REG_RW_MASK),
578	/* 0x088 IQT_REG */ DMAR_LO_U32(VTD_IQT_REG_RW_MASK), DMAR_HI_U32(VTD_IQT_REG_RW_MASK),
579	/* 0x090 IQA_REG */ DMAR_LO_U32(VTD_IQA_REG_RW_MASK), DMAR_HI_U32(VTD_IQA_REG_RW_MASK),
580	/* 0x098 Reserved */ 0,
581	/* 0x09c ICS_REG */ VTD_ICS_REG_RW_MASK,
582	/* 0x0a0 IECTL_REG */ VTD_IECTL_REG_RW_MASK,
583	/* 0x0a4 IEDATA_REG */ VTD_IEDATA_REG_RW_MASK,
584	/* 0x0a8 IEADDR_REG */ VTD_IEADDR_REG_RW_MASK,
585	/* 0x0ac IEUADDR_REG */ VTD_IEUADDR_REG_RW_MASK,
586	/* 0x0b0 IQERCD_REG */ DMAR_LO_U32(VTD_IQERCD_REG_RW_MASK), DMAR_HI_U32(VTD_IQERCD_REG_RW_MASK),
587	/* 0x0b8 IRTA_REG */ DMAR_LO_U32(VTD_IRTA_REG_RW_MASK), DMAR_HI_U32(VTD_IRTA_REG_RW_MASK),
588	/* 0x0c0 PQH_REG */ DMAR_LO_U32(VTD_PQH_REG_RW_MASK), DMAR_HI_U32(VTD_PQH_REG_RW_MASK),
589	/* 0x0c8 PQT_REG */ DMAR_LO_U32(VTD_PQT_REG_RW_MASK), DMAR_HI_U32(VTD_PQT_REG_RW_MASK),
590	/* 0x0d0 PQA_REG */ DMAR_LO_U32(VTD_PQA_REG_RW_MASK), DMAR_HI_U32(VTD_PQA_REG_RW_MASK),
591	/* 0x0d8 Reserved */ 0,
592	/* 0x0dc PRS_REG */ VTD_PRS_REG_RW_MASK,
593	/* 0x0e0 PECTL_REG */ VTD_PECTL_REG_RW_MASK,
594	/* 0x0e4 PEDATA_REG */ VTD_PEDATA_REG_RW_MASK,
595	/* 0x0e8 PEADDR_REG */ VTD_PEADDR_REG_RW_MASK,
596	/* 0x0ec PEUADDR_REG */ VTD_PEUADDR_REG_RW_MASK,
597	/* 0x0f0 Reserved */ 0, 0,
598	/* 0x0f8 Reserved */ 0, 0,
599	/* 0x100 MTRRCAP_REG */ DMAR_LO_U32(VTD_MTRRCAP_REG_RW_MASK), DMAR_HI_U32(VTD_MTRRCAP_REG_RW_MASK),
600	/* 0x108 MTRRDEF_REG / 0, 0, / RO as we don't support MTS. */
601	/* 0x110 Reserved */ 0, 0,
602	/* 0x118 Reserved */ 0, 0,
603	/* 0x120 MTRR_FIX64_00000_REG / 0, 0, / RO as we don't support MTS. */
604	/* 0x128 MTRR_FIX16K_80000_REG */ 0, 0,
605	/* 0x130 MTRR_FIX16K_A0000_REG */ 0, 0,
606	/* 0x138 MTRR_FIX4K_C0000_REG */ 0, 0,
607	/* 0x140 MTRR_FIX4K_C8000_REG */ 0, 0,
608	/* 0x148 MTRR_FIX4K_D0000_REG */ 0, 0,
609	/* 0x150 MTRR_FIX4K_D8000_REG */ 0, 0,
610	/* 0x158 MTRR_FIX4K_E0000_REG */ 0, 0,
611	/* 0x160 MTRR_FIX4K_E8000_REG */ 0, 0,
612	/* 0x168 MTRR_FIX4K_F0000_REG */ 0, 0,
613	/* 0x170 MTRR_FIX4K_F8000_REG */ 0, 0,
614	/* 0x178 Reserved */ 0, 0,
615	/* 0x180 MTRR_PHYSBASE0_REG / 0, 0, / RO as we don't support MTS. */
616	/* 0x188 MTRR_PHYSMASK0_REG */ 0, 0,
617	/* 0x190 MTRR_PHYSBASE1_REG */ 0, 0,
618	/* 0x198 MTRR_PHYSMASK1_REG */ 0, 0,
619	/* 0x1a0 MTRR_PHYSBASE2_REG */ 0, 0,
620	/* 0x1a8 MTRR_PHYSMASK2_REG */ 0, 0,
621	/* 0x1b0 MTRR_PHYSBASE3_REG */ 0, 0,
622	/* 0x1b8 MTRR_PHYSMASK3_REG */ 0, 0,
623	/* 0x1c0 MTRR_PHYSBASE4_REG */ 0, 0,
624	/* 0x1c8 MTRR_PHYSMASK4_REG */ 0, 0,
625	/* 0x1d0 MTRR_PHYSBASE5_REG */ 0, 0,
626	/* 0x1d8 MTRR_PHYSMASK5_REG */ 0, 0,
627	/* 0x1e0 MTRR_PHYSBASE6_REG */ 0, 0,
628	/* 0x1e8 MTRR_PHYSMASK6_REG */ 0, 0,
629	/* 0x1f0 MTRR_PHYSBASE7_REG */ 0, 0,
630	/* 0x1f8 MTRR_PHYSMASK7_REG */ 0, 0,
631	/* 0x200 MTRR_PHYSBASE8_REG */ 0, 0,
632	/* 0x208 MTRR_PHYSMASK8_REG */ 0, 0,
633	/* 0x210 MTRR_PHYSBASE9_REG */ 0, 0,
634	/* 0x218 MTRR_PHYSMASK9_REG */ 0, 0,
635	};
636	AssertCompile(sizeof(g_au32RwMasks0) == DMAR_MMIO_GROUP_0_SIZE);
637
638	/**
639	* Read-only Status, Write-1-to-clear masks for DMAR registers (group 0).
640	*/
641	static uint32_t const g_au32Rw1cMasks0[] =
642	{
643	/* Offset Register Low High */
644	/* 0x000 VER_REG */ 0,
645	/* 0x004 Reserved */ 0,
646	/* 0x008 CAP_REG */ 0, 0,
647	/* 0x010 ECAP_REG */ 0, 0,
648	/* 0x018 GCMD_REG */ 0,
649	/* 0x01c GSTS_REG */ 0,
650	/* 0x020 RTADDR_REG */ 0, 0,
651	/* 0x028 CCMD_REG */ 0, 0,
652	/* 0x030 Reserved */ 0,
653	/* 0x034 FSTS_REG */ VTD_FSTS_REG_RW1C_MASK,
654	/* 0x038 FECTL_REG */ 0,
655	/* 0x03c FEDATA_REG */ 0,
656	/* 0x040 FEADDR_REG */ 0,
657	/* 0x044 FEUADDR_REG */ 0,
658	/* 0x048 Reserved */ 0, 0,
659	/* 0x050 Reserved */ 0, 0,
660	/* 0x058 AFLOG_REG */ 0, 0,
661	/* 0x060 Reserved */ 0,
662	/* 0x064 PMEN_REG */ 0,
663	/* 0x068 PLMBASE_REG */ 0,
664	/* 0x06c PLMLIMIT_REG */ 0,
665	/* 0x070 PHMBASE_REG */ 0, 0,
666	/* 0x078 PHMLIMIT_REG */ 0, 0,
667	/* 0x080 IQH_REG */ 0, 0,
668	/* 0x088 IQT_REG */ 0, 0,
669	/* 0x090 IQA_REG */ 0, 0,
670	/* 0x098 Reserved */ 0,
671	/* 0x09c ICS_REG */ VTD_ICS_REG_RW1C_MASK,
672	/* 0x0a0 IECTL_REG */ 0,
673	/* 0x0a4 IEDATA_REG */ 0,
674	/* 0x0a8 IEADDR_REG */ 0,
675	/* 0x0ac IEUADDR_REG */ 0,
676	/* 0x0b0 IQERCD_REG */ 0, 0,
677	/* 0x0b8 IRTA_REG */ 0, 0,
678	/* 0x0c0 PQH_REG */ 0, 0,
679	/* 0x0c8 PQT_REG */ 0, 0,
680	/* 0x0d0 PQA_REG */ 0, 0,
681	/* 0x0d8 Reserved */ 0,
682	/* 0x0dc PRS_REG */ 0,
683	/* 0x0e0 PECTL_REG */ 0,
684	/* 0x0e4 PEDATA_REG */ 0,
685	/* 0x0e8 PEADDR_REG */ 0,
686	/* 0x0ec PEUADDR_REG */ 0,
687	/* 0x0f0 Reserved */ 0, 0,
688	/* 0x0f8 Reserved */ 0, 0,
689	/* 0x100 MTRRCAP_REG */ 0, 0,
690	/* 0x108 MTRRDEF_REG */ 0, 0,
691	/* 0x110 Reserved */ 0, 0,
692	/* 0x118 Reserved */ 0, 0,
693	/* 0x120 MTRR_FIX64_00000_REG */ 0, 0,
694	/* 0x128 MTRR_FIX16K_80000_REG */ 0, 0,
695	/* 0x130 MTRR_FIX16K_A0000_REG */ 0, 0,
696	/* 0x138 MTRR_FIX4K_C0000_REG */ 0, 0,
697	/* 0x140 MTRR_FIX4K_C8000_REG */ 0, 0,
698	/* 0x148 MTRR_FIX4K_D0000_REG */ 0, 0,
699	/* 0x150 MTRR_FIX4K_D8000_REG */ 0, 0,
700	/* 0x158 MTRR_FIX4K_E0000_REG */ 0, 0,
701	/* 0x160 MTRR_FIX4K_E8000_REG */ 0, 0,
702	/* 0x168 MTRR_FIX4K_F0000_REG */ 0, 0,
703	/* 0x170 MTRR_FIX4K_F8000_REG */ 0, 0,
704	/* 0x178 Reserved */ 0, 0,
705	/* 0x180 MTRR_PHYSBASE0_REG */ 0, 0,
706	/* 0x188 MTRR_PHYSMASK0_REG */ 0, 0,
707	/* 0x190 MTRR_PHYSBASE1_REG */ 0, 0,
708	/* 0x198 MTRR_PHYSMASK1_REG */ 0, 0,
709	/* 0x1a0 MTRR_PHYSBASE2_REG */ 0, 0,
710	/* 0x1a8 MTRR_PHYSMASK2_REG */ 0, 0,
711	/* 0x1b0 MTRR_PHYSBASE3_REG */ 0, 0,
712	/* 0x1b8 MTRR_PHYSMASK3_REG */ 0, 0,
713	/* 0x1c0 MTRR_PHYSBASE4_REG */ 0, 0,
714	/* 0x1c8 MTRR_PHYSMASK4_REG */ 0, 0,
715	/* 0x1d0 MTRR_PHYSBASE5_REG */ 0, 0,
716	/* 0x1d8 MTRR_PHYSMASK5_REG */ 0, 0,
717	/* 0x1e0 MTRR_PHYSBASE6_REG */ 0, 0,
718	/* 0x1e8 MTRR_PHYSMASK6_REG */ 0, 0,
719	/* 0x1f0 MTRR_PHYSBASE7_REG */ 0, 0,
720	/* 0x1f8 MTRR_PHYSMASK7_REG */ 0, 0,
721	/* 0x200 MTRR_PHYSBASE8_REG */ 0, 0,
722	/* 0x208 MTRR_PHYSMASK8_REG */ 0, 0,
723	/* 0x210 MTRR_PHYSBASE9_REG */ 0, 0,
724	/* 0x218 MTRR_PHYSMASK9_REG */ 0, 0,
725	};
726	AssertCompile(sizeof(g_au32Rw1cMasks0) == DMAR_MMIO_GROUP_0_SIZE);
727
728	/**
729	* Read-write masks for DMAR registers (group 1).
730	*/
731	static uint32_t const g_au32RwMasks1[] =
732	{
733	/* Offset Register Low High */
734	/* 0xe00 VCCAP_REG */ DMAR_LO_U32(VTD_VCCAP_REG_RW_MASK), DMAR_HI_U32(VTD_VCCAP_REG_RW_MASK),
735	/* 0xe08 VCMD_EO_REG */ DMAR_LO_U32(VTD_VCMD_EO_REG_RW_MASK), DMAR_HI_U32(VTD_VCMD_EO_REG_RW_MASK),
736	/* 0xe10 VCMD_REG / 0, 0, / RO: VCS not supported. */
737	/* 0xe18 VCMDRSVD_REG */ 0, 0,
738	/* 0xe20 VCRSP_REG / 0, 0, / RO: VCS not supported. */
739	/* 0xe28 VCRSPRSVD_REG */ 0, 0,
740	/* 0xe30 Reserved */ 0, 0,
741	/* 0xe38 Reserved */ 0, 0,
742	/* 0xe40 Reserved */ 0, 0,
743	/* 0xe48 Reserved */ 0, 0,
744	/* 0xe50 IVA_REG */ DMAR_LO_U32(VTD_IVA_REG_RW_MASK), DMAR_HI_U32(VTD_IVA_REG_RW_MASK),
745	/* 0xe58 IOTLB_REG */ DMAR_LO_U32(VTD_IOTLB_REG_RW_MASK), DMAR_HI_U32(VTD_IOTLB_REG_RW_MASK),
746	/* 0xe60 Reserved */ 0, 0,
747	/* 0xe68 Reserved */ 0, 0,
748	/* 0xe70 FRCD_REG_LO */ DMAR_LO_U32(VTD_FRCD_REG_LO_RW_MASK), DMAR_HI_U32(VTD_FRCD_REG_LO_RW_MASK),
749	/* 0xe78 FRCD_REG_HI */ DMAR_LO_U32(VTD_FRCD_REG_HI_RW_MASK), DMAR_HI_U32(VTD_FRCD_REG_HI_RW_MASK),
750	};
751	AssertCompile(sizeof(g_au32RwMasks1) == DMAR_MMIO_GROUP_1_SIZE);
752	AssertCompile((DMAR_MMIO_OFF_FRCD_LO_REG - DMAR_MMIO_GROUP_1_OFF_FIRST) + DMAR_FRCD_REG_COUNT * 2 * sizeof(uint64_t) );
753
754	/**
755	* Read-only Status, Write-1-to-clear masks for DMAR registers (group 1).
756	*/
757	static uint32_t const g_au32Rw1cMasks1[] =
758	{
759	/* Offset Register Low High */
760	/* 0xe00 VCCAP_REG */ 0, 0,
761	/* 0xe08 VCMD_EO_REG */ 0, 0,
762	/* 0xe10 VCMD_REG */ 0, 0,
763	/* 0xe18 VCMDRSVD_REG */ 0, 0,
764	/* 0xe20 VCRSP_REG */ 0, 0,
765	/* 0xe28 VCRSPRSVD_REG */ 0, 0,
766	/* 0xe30 Reserved */ 0, 0,
767	/* 0xe38 Reserved */ 0, 0,
768	/* 0xe40 Reserved */ 0, 0,
769	/* 0xe48 Reserved */ 0, 0,
770	/* 0xe50 IVA_REG */ 0, 0,
771	/* 0xe58 IOTLB_REG */ 0, 0,
772	/* 0xe60 Reserved */ 0, 0,
773	/* 0xe68 Reserved */ 0, 0,
774	/* 0xe70 FRCD_REG_LO */ DMAR_LO_U32(VTD_FRCD_REG_LO_RW1C_MASK), DMAR_HI_U32(VTD_FRCD_REG_LO_RW1C_MASK),
775	/* 0xe78 FRCD_REG_HI */ DMAR_LO_U32(VTD_FRCD_REG_HI_RW1C_MASK), DMAR_HI_U32(VTD_FRCD_REG_HI_RW1C_MASK),
776	};
777	AssertCompile(sizeof(g_au32Rw1cMasks1) == DMAR_MMIO_GROUP_1_SIZE);
778
779	/** Array of RW masks for each register group. */
780	static uint8_t const g_apbRwMasks[] = { (uint8_t )&g_au32RwMasks0[0], (uint8_t *)&g_au32RwMasks1[0] };
781
782	/** Array of RW1C masks for each register group. */
783	static uint8_t const g_apbRw1cMasks[] = { (uint8_t )&g_au32Rw1cMasks0[0], (uint8_t *)&g_au32Rw1cMasks1[0] };
784
785	/* Masks arrays must be identical in size (even bounds checking code assumes this). */
786	AssertCompile(sizeof(g_apbRw1cMasks) == sizeof(g_apbRwMasks));
787
788	/** Array of valid domain-ID bits. */
789	static uint16_t const g_auNdMask[] = { 0xf, 0x3f, 0xff, 0x3ff, 0xfff, 0x3fff, 0xffff, 0 };
790	AssertCompile(RT_ELEMENTS(g_auNdMask) >= DMAR_ND);
791
792
793	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
794	/** @todo Add IOMMU struct size/alignment verification, see
795	* Devices/testcase/Makefile.kmk and
796	* Devices/testcase/tstDeviceStructSize[RC].cpp */
797
798	/**
799	* Returns the supported adjusted guest-address width (SAGAW) given the maximum
800	* guest address width (MGAW).
801	*
802	* @returns The CAP_REG.SAGAW value.
803	* @param uMgaw The CAP_REG.MGAW value.
804	*/
805	static uint8_t vtdCapRegGetSagaw(uint8_t uMgaw)
806	{
807	/*
808	* It doesn't make sense to me that a CPU (or IOMMU hardware) will ever support
809	* 5-level paging but not 4 or 3-level paging. So smaller page-table levels
810	* are always OR'ed in below.
811	*
812	* The bit values below (57, 48, 39 bits) represents the levels of page-table walks
813	* for 4KB base page size (5-level, 4-level and 3-level paging respectively).
814	*
815	* See Intel VT-d spec. 10.4.2 "Capability Register".
816	*/
817	++uMgaw;
818	uint8_t const fSagaw = uMgaw >= 57 ? RT_BIT(3) \| RT_BIT(2) \| RT_BIT(1)
819	: uMgaw >= 48 ? RT_BIT(2) \| RT_BIT(1)
820	: uMgaw >= 39 ? RT_BIT(1)
821	: 0;
822	return fSagaw;
823	}
824
825
826	/**
827	* Returns the maximum supported paging level given the supported adjusted
828	* guest-address width (SAGAW) field.
829	*
830	* @returns The highest paging level supported, 0 if invalid.
831	* @param fSagaw The CAP_REG.SAGAW value.
832	*/
833	static uint8_t vtdCapRegGetMaxPagingLevel(uint8_t fSagaw)
834	{
835	uint8_t const cMaxPagingLevel = fSagaw & RT_BIT(3) ? 5
836	: fSagaw & RT_BIT(2) ? 4
837	: fSagaw & RT_BIT(1) ? 3
838	: 0;
839	return cMaxPagingLevel;
840	}
841
842
843	/**
844	* Returns whether the interrupt remapping (IR) fault is qualified or not.
845	*
846	* @returns @c true if qualified, @c false otherwise.
847	* @param enmIrFault The interrupt remapping fault condition.
848	*/
849	static bool vtdIrFaultIsQualified(VTDIRFAULT enmIrFault)
850	{
851	switch (enmIrFault)
852	{
853	case VTDIRFAULT_IRTE_NOT_PRESENT:
854	case VTDIRFAULT_IRTE_PRESENT_RSVD:
855	case VTDIRFAULT_IRTE_PRESENT_INVALID:
856	case VTDIRFAULT_PID_READ_FAILED:
857	case VTDIRFAULT_PID_RSVD:
858	return true;
859	default:
860	return false;
861	}
862	}
863
864
865	/**
866	* Returns table translation mode's descriptive name.
867	*
868	* @returns The descriptive name.
869	* @param uTtm The RTADDR_REG.TTM value.
870	*/
871	static const char* vtdRtaddrRegGetTtmDesc(uint8_t uTtm)
872	{
873	Assert(!(uTtm & 3));
874	static const char* s_apszTtmNames[] =
875	{
876	"Legacy Mode",
877	"Scalable Mode",
878	"Reserved",
879	"Abort-DMA Mode"
880	};
881	return s_apszTtmNames[uTtm & (RT_ELEMENTS(s_apszTtmNames) - 1)];
882	}
883
884
885	/**
886	* Gets the index of the group the register belongs to given its MMIO offset.
887	*
888	* @returns The group index.
889	* @param offReg The MMIO offset of the register.
890	* @param cbReg The size of the access being made (for bounds checking on
891	* debug builds).
892	*/
893	DECLINLINE(uint8_t) dmarRegGetGroupIndex(uint16_t offReg, uint8_t cbReg)
894	{
895	uint16_t const offLast = offReg + cbReg - 1;
896	AssertCompile(DMAR_MMIO_GROUP_0_OFF_FIRST == 0);
897	AssertMsg(DMAR_IS_MMIO_OFF_VALID(offLast), ("off=%#x cb=%u\n", offReg, cbReg));
898	return !(offLast < DMAR_MMIO_GROUP_0_OFF_END);
899	}
900
901
902	/**
903	* Gets the group the register belongs to given its MMIO offset.
904	*
905	* @returns Pointer to the first element of the register group.
906	* @param pThis The shared DMAR device state.
907	* @param offReg The MMIO offset of the register.
908	* @param cbReg The size of the access being made (for bounds checking on
909	* debug builds).
910	* @param pIdxGroup Where to store the index of the register group the register
911	* belongs to.
912	*/
913	DECLINLINE(uint8_t ) dmarRegGetGroup(PDMAR pThis, uint16_t offReg, uint8_t cbReg, uint8_t pIdxGroup)
914	{
915	*pIdxGroup = dmarRegGetGroupIndex(offReg, cbReg);
916	uint8_t *apbRegs[] = { &pThis->abRegs0[0], &pThis->abRegs1[0] };
917	return apbRegs[*pIdxGroup];
918	}
919
920
921	/**
922	* Const/read-only version of dmarRegGetGroup.
923	*
924	* @copydoc dmarRegGetGroup
925	*/
926	DECLINLINE(uint8_t const) dmarRegGetGroupRo(PCDMAR pThis, uint16_t offReg, uint8_t cbReg, uint8_t pIdxGroup)
927	{
928	*pIdxGroup = dmarRegGetGroupIndex(offReg, cbReg);
929	uint8_t const *apbRegs[] = { &pThis->abRegs0[0], &pThis->abRegs1[0] };
930	return apbRegs[*pIdxGroup];
931	}
932
933
934	/**
935	* Writes a 32-bit register with the exactly the supplied value.
936	*
937	* @param pThis The shared DMAR device state.
938	* @param offReg The MMIO offset of the register.
939	* @param uReg The 32-bit value to write.
940	*/
941	static void dmarRegWriteRaw32(PDMAR pThis, uint16_t offReg, uint32_t uReg)
942	{
943	uint8_t idxGroup;
944	uint8_t *pabRegs = dmarRegGetGroup(pThis, offReg, sizeof(uint32_t), &idxGroup);
945	NOREF(idxGroup);
946	(uint32_t )(pabRegs + offReg) = uReg;
947	}
948
949
950	/**
951	* Writes a 64-bit register with the exactly the supplied value.
952	*
953	* @param pThis The shared DMAR device state.
954	* @param offReg The MMIO offset of the register.
955	* @param uReg The 64-bit value to write.
956	*/
957	static void dmarRegWriteRaw64(PDMAR pThis, uint16_t offReg, uint64_t uReg)
958	{
959	uint8_t idxGroup;
960	uint8_t *pabRegs = dmarRegGetGroup(pThis, offReg, sizeof(uint64_t), &idxGroup);
961	NOREF(idxGroup);
962	(uint64_t )(pabRegs + offReg) = uReg;
963	}
964
965
966	/**
967	* Reads a 32-bit register with exactly the value it contains.
968	*
969	* @returns The raw register value.
970	* @param pThis The shared DMAR device state.
971	* @param offReg The MMIO offset of the register.
972	*/
973	static uint32_t dmarRegReadRaw32(PCDMAR pThis, uint16_t offReg)
974	{
975	uint8_t idxGroup;
976	uint8_t const *pabRegs = dmarRegGetGroupRo(pThis, offReg, sizeof(uint32_t), &idxGroup);
977	NOREF(idxGroup);
978	return (uint32_t )(pabRegs + offReg);
979	}
980
981
982	/**
983	* Reads a 64-bit register with exactly the value it contains.
984	*
985	* @returns The raw register value.
986	* @param pThis The shared DMAR device state.
987	* @param offReg The MMIO offset of the register.
988	*/
989	static uint64_t dmarRegReadRaw64(PCDMAR pThis, uint16_t offReg)
990	{
991	uint8_t idxGroup;
992	uint8_t const *pabRegs = dmarRegGetGroupRo(pThis, offReg, sizeof(uint64_t), &idxGroup);
993	NOREF(idxGroup);
994	return (uint64_t )(pabRegs + offReg);
995	}
996
997
998	/**
999	* Reads a 32-bit register with exactly the value it contains along with their
1000	* corresponding masks
1001	*
1002	* @param pThis The shared DMAR device state.
1003	* @param offReg The MMIO offset of the register.
1004	* @param puReg Where to store the raw 32-bit register value.
1005	* @param pfRwMask Where to store the RW mask corresponding to this register.
1006	* @param pfRw1cMask Where to store the RW1C mask corresponding to this register.
1007	*/
1008	static void dmarRegReadRaw32Ex(PCDMAR pThis, uint16_t offReg, uint32_t puReg, uint32_t pfRwMask, uint32_t *pfRw1cMask)
1009	{
1010	uint8_t idxGroup;
1011	uint8_t const *pabRegs = dmarRegGetGroupRo(pThis, offReg, sizeof(uint32_t), &idxGroup);
1012	Assert(idxGroup < RT_ELEMENTS(g_apbRwMasks));
1013	uint8_t const *pabRwMasks = g_apbRwMasks[idxGroup];
1014	uint8_t const *pabRw1cMasks = g_apbRw1cMasks[idxGroup];
1015	puReg = (uint32_t *)(pabRegs + offReg);
1016	pfRwMask = (uint32_t *)(pabRwMasks + offReg);
1017	pfRw1cMask = (uint32_t *)(pabRw1cMasks + offReg);
1018	}
1019
1020
1021	/**
1022	* Reads a 64-bit register with exactly the value it contains along with their
1023	* corresponding masks.
1024	*
1025	* @param pThis The shared DMAR device state.
1026	* @param offReg The MMIO offset of the register.
1027	* @param puReg Where to store the raw 64-bit register value.
1028	* @param pfRwMask Where to store the RW mask corresponding to this register.
1029	* @param pfRw1cMask Where to store the RW1C mask corresponding to this register.
1030	*/
1031	static void dmarRegReadRaw64Ex(PCDMAR pThis, uint16_t offReg, uint64_t puReg, uint64_t pfRwMask, uint64_t *pfRw1cMask)
1032	{
1033	uint8_t idxGroup;
1034	uint8_t const *pabRegs = dmarRegGetGroupRo(pThis, offReg, sizeof(uint64_t), &idxGroup);
1035	Assert(idxGroup < RT_ELEMENTS(g_apbRwMasks));
1036	uint8_t const *pabRwMasks = g_apbRwMasks[idxGroup];
1037	uint8_t const *pabRw1cMasks = g_apbRw1cMasks[idxGroup];
1038	puReg = (uint64_t *)(pabRegs + offReg);
1039	pfRwMask = (uint64_t *)(pabRwMasks + offReg);
1040	pfRw1cMask = (uint64_t *)(pabRw1cMasks + offReg);
1041	}
1042
1043
1044	/**
1045	* Writes a 32-bit register as it would be when written by software.
1046	* This will preserve read-only bits, mask off reserved bits and clear RW1C bits.
1047	*
1048	* @returns The value that's actually written to the register.
1049	* @param pThis The shared DMAR device state.
1050	* @param offReg The MMIO offset of the register.
1051	* @param uReg The 32-bit value to write.
1052	* @param puPrev Where to store the register value prior to writing.
1053	*/
1054	static uint32_t dmarRegWrite32(PDMAR pThis, uint16_t offReg, uint32_t uReg, uint32_t *puPrev)
1055	{
1056	/* Read current value from the 32-bit register. */
1057	uint32_t uCurReg;
1058	uint32_t fRwMask;
1059	uint32_t fRw1cMask;
1060	dmarRegReadRaw32Ex(pThis, offReg, &uCurReg, &fRwMask, &fRw1cMask);
1061	*puPrev = uCurReg;
1062
1063	uint32_t const fRoBits = uCurReg & ~fRwMask; /* Preserve current read-only and reserved bits. */
1064	uint32_t const fRwBits = uReg & fRwMask; /* Merge newly written read/write bits. */
1065	uint32_t const fRw1cBits = uReg & fRw1cMask; /* Clear 1s written to RW1C bits. */
1066	uint32_t const uNewReg = (fRoBits \| fRwBits) & ~fRw1cBits;
1067
1068	/* Write new value to the 32-bit register. */
1069	dmarRegWriteRaw32(pThis, offReg, uNewReg);
1070	return uNewReg;
1071	}
1072
1073
1074	/**
1075	* Writes a 64-bit register as it would be when written by software.
1076	* This will preserve read-only bits, mask off reserved bits and clear RW1C bits.
1077	*
1078	* @returns The value that's actually written to the register.
1079	* @param pThis The shared DMAR device state.
1080	* @param offReg The MMIO offset of the register.
1081	* @param uReg The 64-bit value to write.
1082	* @param puPrev Where to store the register value prior to writing.
1083	*/
1084	static uint64_t dmarRegWrite64(PDMAR pThis, uint16_t offReg, uint64_t uReg, uint64_t *puPrev)
1085	{
1086	/* Read current value from the 64-bit register. */
1087	uint64_t uCurReg;
1088	uint64_t fRwMask;
1089	uint64_t fRw1cMask;
1090	dmarRegReadRaw64Ex(pThis, offReg, &uCurReg, &fRwMask, &fRw1cMask);
1091	*puPrev = uCurReg;
1092
1093	uint64_t const fRoBits = uCurReg & ~fRwMask; /* Preserve current read-only and reserved bits. */
1094	uint64_t const fRwBits = uReg & fRwMask; /* Merge newly written read/write bits. */
1095	uint64_t const fRw1cBits = uReg & fRw1cMask; /* Clear 1s written to RW1C bits. */
1096	uint64_t const uNewReg = (fRoBits \| fRwBits) & ~fRw1cBits;
1097
1098	/* Write new value to the 64-bit register. */
1099	dmarRegWriteRaw64(pThis, offReg, uNewReg);
1100	return uNewReg;
1101	}
1102
1103
1104	/**
1105	* Reads a 32-bit register as it would be when read by software.
1106	*
1107	* @returns The register value.
1108	* @param pThis The shared DMAR device state.
1109	* @param offReg The MMIO offset of the register.
1110	*/
1111	static uint32_t dmarRegRead32(PCDMAR pThis, uint16_t offReg)
1112	{
1113	return dmarRegReadRaw32(pThis, offReg);
1114	}
1115
1116
1117	/**
1118	* Reads a 64-bit register as it would be when read by software.
1119	*
1120	* @returns The register value.
1121	* @param pThis The shared DMAR device state.
1122	* @param offReg The MMIO offset of the register.
1123	*/
1124	static uint64_t dmarRegRead64(PCDMAR pThis, uint16_t offReg)
1125	{
1126	return dmarRegReadRaw64(pThis, offReg);
1127	}
1128
1129
1130	/**
1131	* Modifies a 32-bit register.
1132	*
1133	* @param pThis The shared DMAR device state.
1134	* @param offReg The MMIO offset of the register.
1135	* @param fAndMask The AND mask (applied first).
1136	* @param fOrMask The OR mask.
1137	* @remarks This does NOT apply RO or RW1C masks while modifying the
1138	* register.
1139	*/
1140	static void dmarRegChangeRaw32(PDMAR pThis, uint16_t offReg, uint32_t fAndMask, uint32_t fOrMask)
1141	{
1142	uint32_t uReg = dmarRegReadRaw32(pThis, offReg);
1143	uReg = (uReg & fAndMask) \| fOrMask;
1144	dmarRegWriteRaw32(pThis, offReg, uReg);
1145	}
1146
1147
1148	/**
1149	* Modifies a 64-bit register.
1150	*
1151	* @param pThis The shared DMAR device state.
1152	* @param offReg The MMIO offset of the register.
1153	* @param fAndMask The AND mask (applied first).
1154	* @param fOrMask The OR mask.
1155	* @remarks This does NOT apply RO or RW1C masks while modifying the
1156	* register.
1157	*/
1158	static void dmarRegChangeRaw64(PDMAR pThis, uint16_t offReg, uint64_t fAndMask, uint64_t fOrMask)
1159	{
1160	uint64_t uReg = dmarRegReadRaw64(pThis, offReg);
1161	uReg = (uReg & fAndMask) \| fOrMask;
1162	dmarRegWriteRaw64(pThis, offReg, uReg);
1163	}
1164
1165
1166	/**
1167	* Checks if the invalidation-queue is empty.
1168	*
1169	* Extended version which optionally returns the current queue head and tail
1170	* offsets.
1171	*
1172	* @returns @c true if empty, @c false otherwise.
1173	* @param pThis The shared DMAR device state.
1174	* @param poffQh Where to store the queue head offset. Optional, can be NULL.
1175	* @param poffQt Where to store the queue tail offset. Optional, can be NULL.
1176	*/
1177	static bool dmarInvQueueIsEmptyEx(PCDMAR pThis, uint32_t poffQh, uint32_t poffQt)
1178	{
1179	/* Read only the low-32 bits of the queue head and queue tail as high bits are all RsvdZ.*/
1180	uint32_t const uIqtReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IQT_REG);
1181	uint32_t const uIqhReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IQH_REG);
1182
1183	/* Don't bother masking QT, QH since other bits are RsvdZ. */
1184	Assert(!(uIqtReg & ~VTD_BF_IQT_REG_QT_MASK));
1185	Assert(!(uIqhReg & ~VTD_BF_IQH_REG_QH_MASK));
1186	if (poffQh)
1187	*poffQh = uIqhReg;
1188	if (poffQt)
1189	*poffQt = uIqtReg;
1190	return uIqtReg == uIqhReg;
1191	}
1192
1193
1194	/**
1195	* Checks if the invalidation-queue is empty.
1196	*
1197	* @returns @c true if empty, @c false otherwise.
1198	* @param pThis The shared DMAR device state.
1199	*/
1200	static bool dmarInvQueueIsEmpty(PCDMAR pThis)
1201	{
1202	return dmarInvQueueIsEmptyEx(pThis, NULL /* poffQh /, NULL / poffQt */);
1203	}
1204
1205
1206	/**
1207	* Checks if the invalidation-queue is capable of processing requests.
1208	*
1209	* @returns @c true if the invalidation-queue can process requests, @c false
1210	* otherwise.
1211	* @param pThis The shared DMAR device state.
1212	*/
1213	static bool dmarInvQueueCanProcessRequests(PCDMAR pThis)
1214	{
1215	/* Check if queued-invalidation is enabled. */
1216	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
1217	if (uGstsReg & VTD_BF_GSTS_REG_QIES_MASK)
1218	{
1219	/* Check if there are no invalidation-queue or timeout errors. */
1220	uint32_t const uFstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FSTS_REG);
1221	if (!(uFstsReg & (VTD_BF_FSTS_REG_IQE_MASK \| VTD_BF_FSTS_REG_ITE_MASK)))
1222	return true;
1223	}
1224	return false;
1225	}
1226
1227
1228	/**
1229	* Wakes up the invalidation-queue thread if there are requests to be processed.
1230	*
1231	* @param pDevIns The IOMMU device instance.
1232	*/
1233	static void dmarInvQueueThreadWakeUpIfNeeded(PPDMDEVINS pDevIns)
1234	{
1235	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1236	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1237	Log4Func(("\n"));
1238
1239	DMAR_ASSERT_LOCK_IS_OWNER(pDevIns, pThisCC);
1240
1241	if ( dmarInvQueueCanProcessRequests(pThis)
1242	&& !dmarInvQueueIsEmpty(pThis))
1243	{
1244	Log4Func(("Signaling the invalidation-queue thread\n"));
1245	PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtInvQueue);
1246	}
1247	}
1248
1249
1250	/**
1251	* Raises an event on behalf of the DMAR.
1252	*
1253	* These are events that are generated by the DMAR itself (like faults and
1254	* invalidation completion notifications).
1255	*
1256	* @param pDevIns The IOMMU device instance.
1257	* @param enmEventType The DMAR event type.
1258	*
1259	* @remarks The DMAR lock must be held while calling this function.
1260	*/
1261	static void dmarEventRaiseInterrupt(PPDMDEVINS pDevIns, DMAREVENTTYPE enmEventType)
1262	{
1263	uint16_t offCtlReg;
1264	uint32_t fIntrMaskedMask;
1265	uint32_t fIntrPendingMask;
1266	uint16_t offMsiAddrLoReg;
1267	uint16_t offMsiAddrHiReg;
1268	uint16_t offMsiDataReg;
1269	switch (enmEventType)
1270	{
1271	case DMAREVENTTYPE_INV_COMPLETE:
1272	{
1273	offCtlReg = VTD_MMIO_OFF_IECTL_REG;
1274	fIntrMaskedMask = VTD_BF_IECTL_REG_IM_MASK;
1275	fIntrPendingMask = VTD_BF_IECTL_REG_IP_MASK;
1276	offMsiAddrLoReg = VTD_MMIO_OFF_IEADDR_REG;
1277	offMsiAddrHiReg = VTD_MMIO_OFF_IEUADDR_REG;
1278	offMsiDataReg = VTD_MMIO_OFF_IEDATA_REG;
1279	break;
1280	}
1281
1282	case DMAREVENTTYPE_FAULT:
1283	{
1284	offCtlReg = VTD_MMIO_OFF_FECTL_REG;
1285	fIntrMaskedMask = VTD_BF_FECTL_REG_IM_MASK;
1286	fIntrPendingMask = VTD_BF_FECTL_REG_IP_MASK;
1287	offMsiAddrLoReg = VTD_MMIO_OFF_FEADDR_REG;
1288	offMsiAddrHiReg = VTD_MMIO_OFF_FEUADDR_REG;
1289	offMsiDataReg = VTD_MMIO_OFF_FEDATA_REG;
1290	break;
1291	}
1292
1293	default:
1294	{
1295	/* Shouldn't ever happen. */
1296	AssertMsgFailedReturnVoid(("DMAR event type %#x unknown!\n", enmEventType));
1297	}
1298	}
1299
1300	/* Check if software has masked the interrupt. */
1301	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1302	uint32_t uCtlReg = dmarRegReadRaw32(pThis, offCtlReg);
1303	if (!(uCtlReg & fIntrMaskedMask))
1304	{
1305	/*
1306	* Interrupt is unmasked, raise it.
1307	* Interrupts generated by the DMAR have trigger mode and level as 0.
1308	* See Intel spec. 5.1.6 "Remapping Hardware Event Interrupt Programming".
1309	*/
1310	MSIMSG Msi;
1311	Msi.Addr.au32[0] = dmarRegReadRaw32(pThis, offMsiAddrLoReg);
1312	Msi.Addr.au32[1] = (pThis->fExtCapReg & VTD_BF_ECAP_REG_EIM_MASK) ? dmarRegReadRaw32(pThis, offMsiAddrHiReg) : 0;
1313	Msi.Data.u32 = dmarRegReadRaw32(pThis, offMsiDataReg);
1314	Assert(Msi.Data.n.u1Level == 0);
1315	Assert(Msi.Data.n.u1TriggerMode == 0);
1316
1317	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1318	pThisCC->CTX_SUFF(pIommuHlp)->pfnSendMsi(pDevIns, &Msi, 0 /* uTagSrc */);
1319
1320	/* Clear interrupt pending bit. */
1321	uCtlReg &= ~fIntrPendingMask;
1322	dmarRegWriteRaw32(pThis, offCtlReg, uCtlReg);
1323	}
1324	else
1325	{
1326	/* Interrupt is masked, set the interrupt pending bit. */
1327	uCtlReg \|= fIntrPendingMask;
1328	dmarRegWriteRaw32(pThis, offCtlReg, uCtlReg);
1329	}
1330	}
1331
1332
1333	/**
1334	* Raises an interrupt in response to a fault event.
1335	*
1336	* @param pDevIns The IOMMU device instance.
1337	*
1338	* @remarks This assumes the caller has already set the required status bits in the
1339	* FSTS_REG (namely one or more of PPF, PFO, IQE, ICE or ITE bits).
1340	*/
1341	static void dmarFaultEventRaiseInterrupt(PPDMDEVINS pDevIns)
1342	{
1343	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1344	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1345	DMAR_ASSERT_LOCK_IS_OWNER(pDevIns, pThisCC);
1346
1347	#ifdef RT_STRICT
1348	{
1349	uint32_t const uFstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FSTS_REG);
1350	uint32_t const fFaultMask = VTD_BF_FSTS_REG_PPF_MASK \| VTD_BF_FSTS_REG_PFO_MASK
1351	/* \| VTD_BF_FSTS_REG_APF_MASK \| VTD_BF_FSTS_REG_AFO_MASK / / AFL not supported */
1352	/* \| VTD_BF_FSTS_REG_ICE_MASK \| VTD_BF_FSTS_REG_ITE_MASK / / Device-TLBs not supported */
1353	\| VTD_BF_FSTS_REG_IQE_MASK;
1354	Assert(uFstsReg & fFaultMask);
1355	}
1356	#endif
1357	dmarEventRaiseInterrupt(pDevIns, DMAREVENTTYPE_FAULT);
1358	}
1359
1360
1361	#ifdef IN_RING3
1362	/**
1363	* Raises an interrupt in response to an invalidation (complete) event.
1364	*
1365	* @param pDevIns The IOMMU device instance.
1366	*/
1367	static void dmarR3InvEventRaiseInterrupt(PPDMDEVINS pDevIns)
1368	{
1369	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1370	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1371	DMAR_ASSERT_LOCK_IS_OWNER(pDevIns, pThisCC);
1372
1373	uint32_t const uIcsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_ICS_REG);
1374	if (!(uIcsReg & VTD_BF_ICS_REG_IWC_MASK))
1375	{
1376	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_ICS_REG, UINT32_MAX, VTD_BF_ICS_REG_IWC_MASK);
1377	dmarEventRaiseInterrupt(pDevIns, DMAREVENTTYPE_INV_COMPLETE);
1378	}
1379	}
1380	#endif /* IN_RING3 */
1381
1382
1383	/**
1384	* Checks if a primary fault can be recorded.
1385	*
1386	* @returns @c true if the fault can be recorded, @c false otherwise.
1387	* @param pDevIns The IOMMU device instance.
1388	* @param pThis The shared DMAR device state.
1389	*
1390	* @remarks Warning: This function has side-effects wrt the DMAR register state. Do
1391	* NOT call it unless there is a fault condition!
1392	*/
1393	static bool dmarPrimaryFaultCanRecord(PPDMDEVINS pDevIns, PDMAR pThis)
1394	{
1395	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1396	DMAR_ASSERT_LOCK_IS_OWNER(pDevIns, pThisCC);
1397
1398	uint32_t uFstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FSTS_REG);
1399	if (uFstsReg & VTD_BF_FSTS_REG_PFO_MASK)
1400	return false;
1401
1402	/*
1403	* If we add more FRCD registers, we'll have to loop through them here.
1404	* Since we support only one FRCD_REG, we don't support "compression of multiple faults",
1405	* nor do we need to increment FRI.
1406	*
1407	* See Intel VT-d spec. 7.2.1 "Primary Fault Logging".
1408	*/
1409	AssertCompile(DMAR_FRCD_REG_COUNT == 1);
1410	uint64_t const uFrcdRegHi = dmarRegReadRaw64(pThis, DMAR_MMIO_OFF_FRCD_HI_REG);
1411	if (uFrcdRegHi & VTD_BF_1_FRCD_REG_F_MASK)
1412	{
1413	uFstsReg \|= VTD_BF_FSTS_REG_PFO_MASK;
1414	dmarRegWriteRaw32(pThis, VTD_MMIO_OFF_FSTS_REG, uFstsReg);
1415	return false;
1416	}
1417
1418	return true;
1419	}
1420
1421
1422	/**
1423	* Records a primary fault.
1424	*
1425	* @param pDevIns The IOMMU device instance.
1426	* @param enmDiag The diagnostic reason.
1427	* @param uFrcdHi The FRCD_HI_REG value for this fault.
1428	* @param uFrcdLo The FRCD_LO_REG value for this fault.
1429	*/
1430	static void dmarPrimaryFaultRecord(PPDMDEVINS pDevIns, DMARDIAG enmDiag, uint64_t uFrcdHi, uint64_t uFrcdLo)
1431	{
1432	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1433	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1434
1435	DMAR_LOCK(pDevIns, pThisCC);
1436
1437	/* Update the diagnostic reason. */
1438	pThis->enmDiag = enmDiag;
1439
1440	/* We don't support advance fault logging. */
1441	Assert(!(dmarRegRead32(pThis, VTD_MMIO_OFF_GSTS_REG) & VTD_BF_GSTS_REG_AFLS_MASK));
1442
1443	if (dmarPrimaryFaultCanRecord(pDevIns, pThis))
1444	{
1445	/* Update the fault recording registers with the fault information. */
1446	dmarRegWriteRaw64(pThis, DMAR_MMIO_OFF_FRCD_HI_REG, uFrcdHi);
1447	dmarRegWriteRaw64(pThis, DMAR_MMIO_OFF_FRCD_LO_REG, uFrcdLo);
1448
1449	/* Set the Pending Primary Fault (PPF) field in the status register. */
1450	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_FSTS_REG, UINT32_MAX, VTD_BF_FSTS_REG_PPF_MASK);
1451
1452	/* Raise interrupt if necessary. */
1453	dmarFaultEventRaiseInterrupt(pDevIns);
1454	}
1455
1456	DMAR_UNLOCK(pDevIns, pThisCC);
1457	}
1458
1459
1460	/**
1461	* Records an interrupt request fault.
1462	*
1463	* @param pDevIns The IOMMU device instance.
1464	* @param enmDiag The diagnostic reason.
1465	* @param enmIrFault The interrupt fault reason.
1466	* @param idDevice The device ID (bus, device, function).
1467	* @param idxIntr The interrupt index.
1468	*/
1469	static void dmarIrFaultRecord(PPDMDEVINS pDevIns, DMARDIAG enmDiag, VTDIRFAULT enmIrFault, uint16_t idDevice, uint16_t idxIntr)
1470	{
1471	uint64_t const uFrcdHi = RT_BF_MAKE(VTD_BF_1_FRCD_REG_SID, idDevice)
1472	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_FR, enmIrFault)
1473	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_F, 1);
1474	uint64_t const uFrcdLo = (uint64_t)idxIntr << 48;
1475	dmarPrimaryFaultRecord(pDevIns, enmDiag, uFrcdHi, uFrcdLo);
1476	}
1477
1478
1479	/**
1480	* Records a qualified interrupt request fault.
1481	*
1482	* Qualified faults are those that can be suppressed by software using the FPD bit
1483	* in the IRTE.
1484	*
1485	* @param pDevIns The IOMMU device instance.
1486	* @param enmDiag The diagnostic reason.
1487	* @param enmIrFault The interrupt fault reason.
1488	* @param idDevice The device ID (bus, device, function).
1489	* @param idxIntr The interrupt index.
1490	* @param pIrte The IRTE that caused this fault.
1491	*/
1492	static void dmarIrFaultRecordQualified(PPDMDEVINS pDevIns, DMARDIAG enmDiag, VTDIRFAULT enmIrFault, uint16_t idDevice,
1493	uint16_t idxIntr, PCVTD_IRTE_T pIrte)
1494	{
1495	Assert(vtdIrFaultIsQualified(enmIrFault));
1496	Assert(pIrte);
1497	if (!(pIrte->au64[0] & VTD_BF_0_IRTE_FPD_MASK))
1498	return dmarIrFaultRecord(pDevIns, enmDiag, enmIrFault, idDevice, idxIntr);
1499	}
1500
1501
1502	/**
1503	* Records an address translation fault.
1504	*
1505	* @param pDevIns The IOMMU device instance.
1506	* @param enmDiag The diagnostic reason.
1507	* @param enmAtFault The address translation fault reason.
1508	* @param pMemReqRemap The DMA memory request remapping info.
1509	*/
1510	static void dmarAtFaultRecord(PPDMDEVINS pDevIns, DMARDIAG enmDiag, VTDATFAULT enmAtFault, PCDMARMEMREQREMAP pMemReqRemap)
1511	{
1512	/*
1513	* Qualified faults are those that can be suppressed by software using the FPD bit
1514	* in the contex entry, scalable-mode context entry etc.
1515	*/
1516	if (!pMemReqRemap->fFpd)
1517	{
1518	uint16_t const idDevice = pMemReqRemap->Req.idDevice;
1519	uint8_t const fType1 = pMemReqRemap->Req.enmReqType & RT_BIT(1);
1520	uint8_t const fType2 = pMemReqRemap->Req.enmReqType & RT_BIT(0);
1521	uint8_t const fExec = pMemReqRemap->Req.fReqPerm & DMAR_PERM_EXE;
1522	uint8_t const fPriv = pMemReqRemap->Req.fReqPerm & DMAR_PERM_PRIV;
1523	bool const fHasPasid = PCIPASID_IS_VALID(pMemReqRemap->Req.Pasid);
1524	uint32_t const uPasid = PCIPASID_VAL(pMemReqRemap->Req.Pasid);
1525	PCIADDRTYPE const enmAt = pMemReqRemap->Req.enmAddrType;
1526
1527	uint64_t const uFrcdHi = RT_BF_MAKE(VTD_BF_1_FRCD_REG_SID, idDevice)
1528	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_T2, fType2)
1529	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_PP, fHasPasid)
1530	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_EXE, fExec)
1531	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_PRIV, fPriv)
1532	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_FR, enmAtFault)
1533	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_PV, uPasid)
1534	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_AT, enmAt)
1535	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_T1, fType1)
1536	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_F, 1);
1537	uint64_t const uFrcdLo = pMemReqRemap->Req.uDmaAddr & X86_PAGE_BASE_MASK;
1538	dmarPrimaryFaultRecord(pDevIns, enmDiag, uFrcdHi, uFrcdLo);
1539	}
1540	}
1541
1542
1543	/**
1544	* Records an IQE fault.
1545	*
1546	* @param pDevIns The IOMMU device instance.
1547	* @param enmIqei The IQE information.
1548	* @param enmDiag The diagnostic reason.
1549	*/
1550	static void dmarIqeFaultRecord(PPDMDEVINS pDevIns, DMARDIAG enmDiag, VTDIQEI enmIqei)
1551	{
1552	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1553	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1554
1555	DMAR_LOCK(pDevIns, pThisCC);
1556
1557	/* Update the diagnostic reason. */
1558	pThis->enmDiag = enmDiag;
1559
1560	/* Set the error bit. */
1561	uint32_t const fIqe = RT_BF_MAKE(VTD_BF_FSTS_REG_IQE, 1);
1562	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_FSTS_REG, UINT32_MAX, fIqe);
1563
1564	/* Set the error information. */
1565	uint64_t const fIqei = RT_BF_MAKE(VTD_BF_IQERCD_REG_IQEI, enmIqei);
1566	dmarRegChangeRaw64(pThis, VTD_MMIO_OFF_IQERCD_REG, UINT64_MAX, fIqei);
1567
1568	dmarFaultEventRaiseInterrupt(pDevIns);
1569
1570	DMAR_UNLOCK(pDevIns, pThisCC);
1571	}
1572
1573
1574	/**
1575	* Handles writes to GCMD_REG.
1576	*
1577	* @returns Strict VBox status code.
1578	* @param pDevIns The IOMMU device instance.
1579	* @param uGcmdReg The value written to GCMD_REG.
1580	*/
1581	static VBOXSTRICTRC dmarGcmdRegWrite(PPDMDEVINS pDevIns, uint32_t uGcmdReg)
1582	{
1583	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1584	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
1585	uint32_t const fChanged = uGstsReg ^ uGcmdReg;
1586	uint64_t const fExtCapReg = pThis->fExtCapReg;
1587
1588	/* Queued-invalidation. */
1589	if ( (fExtCapReg & VTD_BF_ECAP_REG_QI_MASK)
1590	&& (fChanged & VTD_BF_GCMD_REG_QIE_MASK))
1591	{
1592	if (uGcmdReg & VTD_BF_GCMD_REG_QIE_MASK)
1593	{
1594	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_QIES_MASK);
1595	dmarInvQueueThreadWakeUpIfNeeded(pDevIns);
1596	}
1597	else
1598	{
1599	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, ~VTD_BF_GSTS_REG_QIES_MASK, 0 /* fOrMask */);
1600	dmarRegWriteRaw32(pThis, VTD_MMIO_OFF_IQH_REG, 0);
1601	}
1602	}
1603
1604	if (fExtCapReg & VTD_BF_ECAP_REG_IR_MASK)
1605	{
1606	/* Set Interrupt Remapping Table Pointer (SIRTP). */
1607	if (uGcmdReg & VTD_BF_GCMD_REG_SIRTP_MASK)
1608	{
1609	/** @todo Perform global invalidation of all interrupt-entry cache when ESIRTPS is
1610	* supported. */
1611	pThis->uIrtaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IRTA_REG);
1612	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_IRTPS_MASK);
1613	}
1614
1615	/* Interrupt remapping. */
1616	if (fChanged & VTD_BF_GCMD_REG_IRE_MASK)
1617	{
1618	if (uGcmdReg & VTD_BF_GCMD_REG_IRE_MASK)
1619	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_IRES_MASK);
1620	else
1621	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, ~VTD_BF_GSTS_REG_IRES_MASK, 0 /* fOrMask */);
1622	}
1623
1624	/* Compatibility format interrupts. */
1625	if (fChanged & VTD_BF_GCMD_REG_CFI_MASK)
1626	{
1627	if (uGcmdReg & VTD_BF_GCMD_REG_CFI_MASK)
1628	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_CFIS_MASK);
1629	else
1630	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, ~VTD_BF_GSTS_REG_CFIS_MASK, 0 /* fOrMask */);
1631	}
1632	}
1633
1634	/* Set Root Table Pointer (SRTP). */
1635	if (uGcmdReg & VTD_BF_GCMD_REG_SRTP_MASK)
1636	{
1637	/** @todo Perform global invalidation of all remapping translation caches when
1638	* ESRTPS is supported. */
1639	pThis->uRtaddrReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_RTADDR_REG);
1640	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_RTPS_MASK);
1641	}
1642
1643	/* Translation (DMA remapping). */
1644	if (fChanged & VTD_BF_GCMD_REG_TE_MASK)
1645	{
1646	if (uGcmdReg & VTD_BF_GCMD_REG_TE_MASK)
1647	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_TES_MASK);
1648	else
1649	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, ~VTD_BF_GSTS_REG_TES_MASK, 0 /* fOrMask */);
1650	}
1651
1652	return VINF_SUCCESS;
1653	}
1654
1655
1656	/**
1657	* Handles writes to CCMD_REG.
1658	*
1659	* @returns Strict VBox status code.
1660	* @param pDevIns The IOMMU device instance.
1661	* @param offReg The MMIO register offset.
1662	* @param cbReg The size of the MMIO access (in bytes).
1663	* @param uCcmdReg The value written to CCMD_REG.
1664	*/
1665	static VBOXSTRICTRC dmarCcmdRegWrite(PPDMDEVINS pDevIns, uint16_t offReg, uint8_t cbReg, uint64_t uCcmdReg)
1666	{
1667	/* At present, we only care about responding to high 32-bits writes, low 32-bits are data. */
1668	if (offReg + cbReg > VTD_MMIO_OFF_CCMD_REG + 4)
1669	{
1670	/* Check if we need to invalidate the context-context. */
1671	bool const fIcc = RT_BF_GET(uCcmdReg, VTD_BF_CCMD_REG_ICC);
1672	if (fIcc)
1673	{
1674	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1675	uint8_t const uMajorVersion = RT_BF_GET(pThis->uVerReg, VTD_BF_VER_REG_MAX);
1676	if (uMajorVersion < 6)
1677	{
1678	/* Register-based invalidation can only be used when queued-invalidations are not enabled. */
1679	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
1680	if (!(uGstsReg & VTD_BF_GSTS_REG_QIES_MASK))
1681	{
1682	/* Verify table translation mode is legacy. */
1683	uint8_t const fTtm = RT_BF_GET(pThis->uRtaddrReg, VTD_BF_RTADDR_REG_TTM);
1684	if (fTtm == VTD_TTM_LEGACY_MODE)
1685	{
1686	/** @todo Invalidate. */
1687	return VINF_SUCCESS;
1688	}
1689	pThis->enmDiag = kDmarDiag_CcmdReg_Ttm_Invalid;
1690	}
1691	else
1692	pThis->enmDiag = kDmarDiag_CcmdReg_Qi_Enabled;
1693	}
1694	else
1695	pThis->enmDiag = kDmarDiag_CcmdReg_NotSupported;
1696	dmarRegChangeRaw64(pThis, VTD_MMIO_OFF_GSTS_REG, ~VTD_BF_CCMD_REG_CAIG_MASK, 0 /* fOrMask */);
1697	}
1698	}
1699	return VINF_SUCCESS;
1700	}
1701
1702
1703	/**
1704	* Handles writes to FECTL_REG.
1705	*
1706	* @returns Strict VBox status code.
1707	* @param pDevIns The IOMMU device instance.
1708	* @param uFectlReg The value written to FECTL_REG.
1709	*/
1710	static VBOXSTRICTRC dmarFectlRegWrite(PPDMDEVINS pDevIns, uint32_t uFectlReg)
1711	{
1712	/*
1713	* If software unmasks the interrupt when the interrupt is pending, we must raise
1714	* the interrupt now (which will consequently clear the interrupt pending (IP) bit).
1715	*/
1716	if ( (uFectlReg & VTD_BF_FECTL_REG_IP_MASK)
1717	&& ~(uFectlReg & VTD_BF_FECTL_REG_IM_MASK))
1718	dmarEventRaiseInterrupt(pDevIns, DMAREVENTTYPE_FAULT);
1719	return VINF_SUCCESS;
1720	}
1721
1722
1723	/**
1724	* Handles writes to FSTS_REG.
1725	*
1726	* @returns Strict VBox status code.
1727	* @param pDevIns The IOMMU device instance.
1728	* @param uFstsReg The value written to FSTS_REG.
1729	* @param uPrev The value in FSTS_REG prior to writing it.
1730	*/
1731	static VBOXSTRICTRC dmarFstsRegWrite(PPDMDEVINS pDevIns, uint32_t uFstsReg, uint32_t uPrev)
1732	{
1733	/*
1734	* If software clears other status bits in FSTS_REG (pertaining to primary fault logging),
1735	* the interrupt pending (IP) bit must be cleared.
1736	*
1737	* See Intel VT-d spec. 10.4.10 "Fault Event Control Register".
1738	*/
1739	uint32_t const fChanged = uPrev ^ uFstsReg;
1740	if (fChanged & ( VTD_BF_FSTS_REG_ICE_MASK \| VTD_BF_FSTS_REG_ITE_MASK
1741	\| VTD_BF_FSTS_REG_IQE_MASK \| VTD_BF_FSTS_REG_PFO_MASK))
1742	{
1743	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1744	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_FECTL_REG, ~VTD_BF_FECTL_REG_IP_MASK, 0 /* fOrMask */);
1745	}
1746	return VINF_SUCCESS;
1747	}
1748
1749
1750	/**
1751	* Handles writes to IQT_REG.
1752	*
1753	* @returns Strict VBox status code.
1754	* @param pDevIns The IOMMU device instance.
1755	* @param offReg The MMIO register offset.
1756	* @param uIqtReg The value written to IQT_REG.
1757	*/
1758	static VBOXSTRICTRC dmarIqtRegWrite(PPDMDEVINS pDevIns, uint16_t offReg, uint64_t uIqtReg)
1759	{
1760	/* We only care about the low 32-bits, high 32-bits are reserved. */
1761	Assert(offReg == VTD_MMIO_OFF_IQT_REG);
1762	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1763
1764	/* Paranoia. */
1765	Assert(!(uIqtReg & ~VTD_BF_IQT_REG_QT_MASK));
1766
1767	uint32_t const offQt = uIqtReg;
1768	uint64_t const uIqaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQA_REG);
1769	uint8_t const fDw = RT_BF_GET(uIqaReg, VTD_BF_IQA_REG_DW);
1770
1771	/* If the descriptor width is 256-bits, the queue tail offset must be aligned accordingly. */
1772	if ( fDw != VTD_IQA_REG_DW_256_BIT
1773	\|\| !(offQt & RT_BIT(4)))
1774	dmarInvQueueThreadWakeUpIfNeeded(pDevIns);
1775	else
1776	{
1777	/* Hardware treats bit 4 as RsvdZ in this situation, so clear it. */
1778	dmarRegChangeRaw32(pThis, offReg, ~RT_BIT(4), 0 /* fOrMask */);
1779	dmarIqeFaultRecord(pDevIns, kDmarDiag_IqtReg_Qt_NotAligned, VTDIQEI_QUEUE_TAIL_MISALIGNED);
1780	}
1781	return VINF_SUCCESS;
1782	}
1783
1784
1785	/**
1786	* Handles writes to IQA_REG.
1787	*
1788	* @returns Strict VBox status code.
1789	* @param pDevIns The IOMMU device instance.
1790	* @param offReg The MMIO register offset.
1791	* @param uIqaReg The value written to IQA_REG.
1792	*/
1793	static VBOXSTRICTRC dmarIqaRegWrite(PPDMDEVINS pDevIns, uint16_t offReg, uint64_t uIqaReg)
1794	{
1795	/* At present, we only care about the low 32-bits, high 32-bits are data. */
1796	Assert(offReg == VTD_MMIO_OFF_IQA_REG); NOREF(offReg);
1797
1798	/** @todo What happens if IQA_REG is written when dmarInvQueueCanProcessRequests
1799	* returns true? The Intel VT-d spec. doesn't state anywhere that it
1800	* cannot happen or that it's ignored when it does happen. */
1801
1802	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1803	uint8_t const fDw = RT_BF_GET(uIqaReg, VTD_BF_IQA_REG_DW);
1804	if (fDw == VTD_IQA_REG_DW_256_BIT)
1805	{
1806	bool const fSupports256BitDw = (pThis->fExtCapReg & (VTD_BF_ECAP_REG_SMTS_MASK \| VTD_BF_ECAP_REG_ADMS_MASK));
1807	if (fSupports256BitDw)
1808	{ /* likely */ }
1809	else
1810	dmarIqeFaultRecord(pDevIns, kDmarDiag_IqaReg_Dw_256_Invalid, VTDIQEI_INVALID_DESCRIPTOR_WIDTH);
1811	}
1812	/* else: 128-bit descriptor width is validated lazily, see explanation in dmarR3InvQueueProcessRequests. */
1813
1814	return VINF_SUCCESS;
1815	}
1816
1817
1818	/**
1819	* Handles writes to ICS_REG.
1820	*
1821	* @returns Strict VBox status code.
1822	* @param pDevIns The IOMMU device instance.
1823	* @param uIcsReg The value written to ICS_REG.
1824	*/
1825	static VBOXSTRICTRC dmarIcsRegWrite(PPDMDEVINS pDevIns, uint32_t uIcsReg)
1826	{
1827	/*
1828	* If the IP field is set when software services the interrupt condition,
1829	* (by clearing the IWC field), the IP field must be cleared.
1830	*/
1831	if (!(uIcsReg & VTD_BF_ICS_REG_IWC_MASK))
1832	{
1833	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1834	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_IECTL_REG, ~VTD_BF_IECTL_REG_IP_MASK, 0 /* fOrMask */);
1835	}
1836	return VINF_SUCCESS;
1837	}
1838
1839
1840	/**
1841	* Handles writes to IECTL_REG.
1842	*
1843	* @returns Strict VBox status code.
1844	* @param pDevIns The IOMMU device instance.
1845	* @param uIectlReg The value written to IECTL_REG.
1846	*/
1847	static VBOXSTRICTRC dmarIectlRegWrite(PPDMDEVINS pDevIns, uint32_t uIectlReg)
1848	{
1849	/*
1850	* If software unmasks the interrupt when the interrupt is pending, we must raise
1851	* the interrupt now (which will consequently clear the interrupt pending (IP) bit).
1852	*/
1853	if ( (uIectlReg & VTD_BF_IECTL_REG_IP_MASK)
1854	&& ~(uIectlReg & VTD_BF_IECTL_REG_IM_MASK))
1855	dmarEventRaiseInterrupt(pDevIns, DMAREVENTTYPE_INV_COMPLETE);
1856	return VINF_SUCCESS;
1857	}
1858
1859
1860	/**
1861	* Handles writes to FRCD_REG (High 64-bits).
1862	*
1863	* @returns Strict VBox status code.
1864	* @param pDevIns The IOMMU device instance.
1865	* @param offReg The MMIO register offset.
1866	* @param cbReg The size of the MMIO access (in bytes).
1867	* @param uFrcdHiReg The value written to FRCD_REG.
1868	* @param uPrev The value in FRCD_REG prior to writing it.
1869	*/
1870	static VBOXSTRICTRC dmarFrcdHiRegWrite(PPDMDEVINS pDevIns, uint16_t offReg, uint8_t cbReg, uint64_t uFrcdHiReg, uint64_t uPrev)
1871	{
1872	/* We only care about responding to high 32-bits, low 32-bits are read-only. */
1873	if (offReg + cbReg > DMAR_MMIO_OFF_FRCD_HI_REG + 4)
1874	{
1875	/*
1876	* If software cleared the RW1C F (fault) bit in all FRCD_REGs, hardware clears the
1877	* Primary Pending Fault (PPF) and the interrupt pending (IP) bits. Our implementation
1878	* has only 1 FRCD register.
1879	*
1880	* See Intel VT-d spec. 10.4.10 "Fault Event Control Register".
1881	*/
1882	AssertCompile(DMAR_FRCD_REG_COUNT == 1);
1883	uint64_t const fChanged = uPrev ^ uFrcdHiReg;
1884	if (fChanged & VTD_BF_1_FRCD_REG_F_MASK)
1885	{
1886	Assert(!(uFrcdHiReg & VTD_BF_1_FRCD_REG_F_MASK)); /* Software should only ever be able to clear this bit. */
1887	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1888	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_FSTS_REG, ~VTD_BF_FSTS_REG_PPF_MASK, 0 /* fOrMask */);
1889	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_FECTL_REG, ~VTD_BF_FECTL_REG_IP_MASK, 0 /* fOrMask */);
1890	}
1891	}
1892	return VINF_SUCCESS;
1893	}
1894
1895
1896	/**
1897	* Performs a PCI target abort for a DMA remapping (DR) operation.
1898	*
1899	* @param pDevIns The IOMMU device instance.
1900	*/
1901	static void dmarDrTargetAbort(PPDMDEVINS pDevIns)
1902	{
1903	/** @todo r=ramshankar: I don't know for sure if a PCI target abort is caused or not
1904	* as the Intel VT-d spec. is vague. Wording seems to suggest it does, but
1905	* who knows. */
1906	PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
1907	uint16_t const u16Status = PDMPciDevGetStatus(pPciDev) \| VBOX_PCI_STATUS_SIG_TARGET_ABORT;
1908	PDMPciDevSetStatus(pPciDev, u16Status);
1909	}
1910
1911
1912	/**
1913	* Checks whether the address width (AW) is supported by our hardware
1914	* implementation for legacy mode address translation.
1915	*
1916	* @returns @c true if it's supported, @c false otherwise.
1917	* @param pThis The shared DMAR device state.
1918	* @param pCtxEntry The context entry.
1919	* @param pcPagingLevel Where to store the paging level. Optional, can be NULL.
1920	*/
1921	static bool dmarDrLegacyModeIsAwValid(PCDMAR pThis, PCVTD_CONTEXT_ENTRY_T pCtxEntry, uint8_t *pcPagingLevel)
1922	{
1923	uint8_t const fTt = RT_BF_GET(pCtxEntry->au64[0], VTD_BF_0_CONTEXT_ENTRY_TT);
1924	uint8_t const fAw = RT_BF_GET(pCtxEntry->au64[1], VTD_BF_1_CONTEXT_ENTRY_AW);
1925	uint8_t const fAwMask = RT_BIT(fAw);
1926	uint8_t const fSagaw = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_SAGAW);
1927	Assert(!(fSagaw & ~(RT_BIT(1) \| RT_BIT(2) \| RT_BIT(3))));
1928
1929	uint8_t const cPagingLevel = fAw + 2;
1930	if (pcPagingLevel)
1931	*pcPagingLevel = cPagingLevel;
1932
1933	/* With pass-through, the address width must be the largest AGAW supported by hardware. */
1934	if (fTt == VTD_TT_UNTRANSLATED_PT)
1935	{
1936	Assert(pThis->cMaxPagingLevel >= 3 && pThis->cMaxPagingLevel <= 5); /* Paranoia. */
1937	return cPagingLevel == pThis->cMaxPagingLevel;
1938	}
1939
1940	/* The address width must be any of the ones supported by hardware. */
1941	if (fAw < 4)
1942	return (fSagaw & fAwMask) != 0;
1943
1944	return false;
1945	}
1946
1947
1948	/**
1949	* Reads a root entry from guest memory.
1950	*
1951	* @returns VBox status code.
1952	* @param pDevIns The IOMMU device instance.
1953	* @param uRtaddrReg The current RTADDR_REG value.
1954	* @param idxRootEntry The index of the root entry to read.
1955	* @param pRootEntry Where to store the read root entry.
1956	*/
1957	static int dmarDrReadRootEntry(PPDMDEVINS pDevIns, uint64_t uRtaddrReg, uint8_t idxRootEntry, PVTD_ROOT_ENTRY_T pRootEntry)
1958	{
1959	size_t const cbRootEntry = sizeof(*pRootEntry);
1960	RTGCPHYS const GCPhysRootEntry = (uRtaddrReg & VTD_BF_RTADDR_REG_RTA_MASK) + (idxRootEntry * cbRootEntry);
1961	return PDMDevHlpPhysReadMeta(pDevIns, GCPhysRootEntry, pRootEntry, cbRootEntry);
1962	}
1963
1964
1965	/**
1966	* Reads a context entry from guest memory.
1967	*
1968	* @returns VBox status code.
1969	* @param pDevIns The IOMMU device instance.
1970	* @param GCPhysCtxTable The physical address of the context table.
1971	* @param idxCtxEntry The index of the context entry to read.
1972	* @param pCtxEntry Where to store the read context entry.
1973	*/
1974	static int dmarDrReadCtxEntry(PPDMDEVINS pDevIns, RTGCPHYS GCPhysCtxTable, uint8_t idxCtxEntry, PVTD_CONTEXT_ENTRY_T pCtxEntry)
1975	{
1976	/* We don't verify bits 63:HAW of GCPhysCtxTable is 0 since reading from such an address should fail anyway. */
1977	size_t const cbCtxEntry = sizeof(*pCtxEntry);
1978	RTGCPHYS const GCPhysCtxEntry = GCPhysCtxTable + (idxCtxEntry * cbCtxEntry);
1979	return PDMDevHlpPhysReadMeta(pDevIns, GCPhysCtxEntry, pCtxEntry, cbCtxEntry);
1980	}
1981
1982
1983	/**
1984	* Reads a second-level paging entry from guest memory.
1985	*
1986	* @returns VBox status code.
1987	* @param pDevIns The IOMMU device instance.
1988	* @param GCPhysSlptPtr The physical address of the SLPTPTR.
1989	* @param pSlpEntry Where to store the read SLPTPTR.
1990	*/
1991	static int dmarDrReadSlpPtr(PPDMDEVINS pDevIns, RTGCPHYS GCPhysSlptPtr, PVTD_SLP_ENTRY_T pSlpEntry)
1992	{
1993	/* We don't verify bits 63:HAW of GCPhysSlptPtr is 0 since reading from such an address should fail anyway. */
1994	return PDMDevHlpPhysReadMeta(pDevIns, GCPhysSlptPtr, pSlpEntry, sizeof(*pSlpEntry));
1995	}
1996
1997
1998	/**
1999	* Validates the output address of a translation and updates the IOTLB entry for the
2000	* given memory request remapping.
2001	*
2002	* @returns VBox status code.
2003	* @param pDevIns The IOMMU device instance.
2004	* @param GCPhysBase The output address of the translation.
2005	* @param cShift The page shift of the translation.
2006	* @param fPerm The permissions granted for the translated.
2007	* @param idDomain The domain ID of the translated region.
2008	* @param pMemReqRemap The DMA memory request remapping info.
2009	*/
2010	static int dmarDrValidateAndUpdateIotlbe(PPDMDEVINS pDevIns, RTGCPHYS GCPhysBase, uint8_t cShift, uint8_t fPerm,
2011	uint16_t idDomain, PDMARMEMREQREMAP pMemReqRemap)
2012	{
2013	Assert( pMemReqRemap->fTtm == VTD_TTM_LEGACY_MODE
2014	\|\| pMemReqRemap->fTtm == VTD_TTM_SCALABLE_MODE);
2015	Assert(!(GCPhysBase & X86_PAGE_4K_OFFSET_MASK));
2016
2017	/* Ensure the output address is not in the interrupt address range. */
2018	if (GCPhysBase - VBOX_MSI_ADDR_BASE >= VBOX_MSI_ADDR_SIZE)
2019	{
2020	pMemReqRemap->Iotlbe.GCPhysBase = GCPhysBase;
2021	pMemReqRemap->Iotlbe.cShift = cShift;
2022	pMemReqRemap->Iotlbe.fPerm = fPerm;
2023	pMemReqRemap->Iotlbe.idDomain = idDomain;
2024	return VINF_SUCCESS;
2025	}
2026
2027	if (pMemReqRemap->fTtm == VTD_TTM_LEGACY_MODE)
2028	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lgn_4, VTDATFAULT_LGN_4, pMemReqRemap);
2029	else
2030	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Sgn_8, VTDATFAULT_SGN_8, pMemReqRemap);
2031	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2032	}
2033
2034
2035	/**
2036	* Performs second level translation.
2037	*
2038	* @returns VBox status code.
2039	* @param pDevIns The IOMMU device instance.
2040	* @param SlpEntry The second-level paging entry.
2041	* @param cPagingLevel The paging level.
2042	* @param idDomain The domain ID for the translation.
2043	* @param pMemReqRemap The DMA memory request remapping info.
2044	*/
2045	static int dmarDrSecondLevelTranslate(PPDMDEVINS pDevIns, VTD_SLP_ENTRY_T SlpEntry, uint8_t cPagingLevel, uint16_t idDomain,
2046	PDMARMEMREQREMAP pMemReqRemap)
2047	{
2048	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PCDMAR);
2049
2050	/* Mask of valid paging entry bits. */
2051	static uint64_t const s_auPtEntityRsvd[] = { VTD_SL_PTE_VALID_MASK,
2052	VTD_SL_PDE_VALID_MASK,
2053	VTD_SL_PDPE_VALID_MASK,
2054	VTD_SL_PML4E_VALID_MASK,
2055	VTD_SL_PML5E_VALID_MASK };
2056
2057	/* Mask of valid large-page (1GB, 2MB) paging entries. */
2058	static uint64_t const s_auLargePageRsvd[] = { 0,
2059	VTD_SL_PDE2M_VALID_MASK,
2060	VTD_SL_PDPE1G_VALID_MASK,
2061	0,
2062	0 };
2063
2064	/* Paranoia. */
2065	Assert(cPagingLevel >= 3 && cPagingLevel <= 5);
2066	AssertCompile(RT_ELEMENTS(s_auPtEntityRsvd) == RT_ELEMENTS(s_auLargePageRsvd));
2067	AssertCompile(RT_ELEMENTS(s_auPtEntityRsvd) == 5);
2068
2069	/* Second-level translations restricts input address to an implementation-specific MGAW. */
2070	uint64_t const uDmaAddr = pMemReqRemap->Req.uDmaAddr;
2071	if (!(uDmaAddr & pThis->fInvMgawMask))
2072	{ /* likely */ }
2073	else
2074	{
2075	if (pMemReqRemap->fTtm == VTD_TTM_LEGACY_MODE)
2076	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lgn_1_1, VTDATFAULT_LGN_1_1, pMemReqRemap);
2077	else
2078	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Sgn_5, VTDATFAULT_SGN_5, pMemReqRemap);
2079	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2080	}
2081
2082	/*
2083	* Traverse the I/O page table starting with the SLPTPTR (second-level page table pointer).
2084	* Unlike AMD IOMMU paging, here there is no feature for "skipping" levels.
2085	*/
2086	uint64_t uPtEntity = SlpEntry;
2087	for (int8_t iLevel = cPagingLevel - 1; iLevel >= 0; iLevel--)
2088	{
2089	/*
2090	* Read the paging entry for the current level.
2091	*/
2092	uint8_t const cLevelShift = 12 + ((iLevel - 1) * 9);
2093	{
2094	uint16_t const idxPte = (uDmaAddr >> cLevelShift) & UINT64_C(0x1ff);
2095	uint64_t const offPte = idxPte << 3;
2096	RTGCPHYS const GCPhysPtEntity = uPtEntity \| offPte;
2097	int const rc = PDMDevHlpPhysReadMeta(pDevIns, GCPhysPtEntity, &uPtEntity, sizeof(uPtEntity));
2098	if (RT_SUCCESS(rc))
2099	{ /* likely */ }
2100	else
2101	{
2102	if (pMemReqRemap->fTtm == VTD_TTM_LEGACY_MODE)
2103	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lsl_1, VTDATFAULT_LSL_1, pMemReqRemap);
2104	else
2105	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Ssl_1, VTDATFAULT_SSL_1, pMemReqRemap);
2106	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2107	}
2108	}
2109
2110	/*
2111	* Check I/O permissions.
2112	* This must be done prior to check reserved bits for properly reporting errors SSL.2 and SSL.3.
2113	*
2114	* See Intel spec. 7.1.3 "Fault conditions and Remapping hardware behavior for various request".
2115	*/
2116	uint8_t const fReqPerm = pMemReqRemap->Req.fReqPerm & pThis->fPermValidMask;
2117	uint8_t const fPtPerm = uPtEntity & pThis->fPermValidMask;
2118	if ((fPtPerm & fReqPerm) == fReqPerm)
2119	{ /* likely */ }
2120	else
2121	{
2122	if (pMemReqRemap->fTtm == VTD_TTM_LEGACY_MODE)
2123	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lsl_2, VTDATFAULT_LSL_2, pMemReqRemap);
2124	else
2125	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Ssl_2, VTDATFAULT_SSL_2, pMemReqRemap);
2126	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2127	}
2128
2129	/*
2130	* Validate reserved bits of the current paging entry.
2131	*/
2132	if (!(uPtEntity & ~s_auPtEntityRsvd[iLevel]))
2133	{ /* likely */ }
2134	else
2135	{
2136	if (pMemReqRemap->fTtm == VTD_TTM_LEGACY_MODE)
2137	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lsl_2, VTDATFAULT_LSL_2, pMemReqRemap);
2138	else
2139	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Ssl_3, VTDATFAULT_SSL_3, pMemReqRemap);
2140	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2141	}
2142
2143	/*
2144	* Check if this is a 1GB page or a 2MB page.
2145	*/
2146	AssertCompile(VTD_BF_SL_PDE_PS_MASK == VTD_BF_SL_PDPE_PS_MASK);
2147	uint8_t const fLargePage = RT_BF_GET(uPtEntity, VTD_BF_SL_PDE_PS);
2148	if (fLargePage && iLevel > 0)
2149	{
2150	Assert(iLevel == 1 \|\| iLevel == 2);
2151	uint8_t const fSllpsMask = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_SLLPS);
2152	if (fSllpsMask & RT_BIT(iLevel - 1))
2153	{
2154	RTGCPHYS const GCPhysBase = uPtEntity & ~(RT_BIT_64(cLevelShift) - 1);
2155	return dmarDrValidateAndUpdateIotlbe(pDevIns, GCPhysBase, cLevelShift, fPtPerm, idDomain, pMemReqRemap);
2156	}
2157
2158	if (pMemReqRemap->fTtm == VTD_TTM_LEGACY_MODE)
2159	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lsl_2_LargePage, VTDATFAULT_LSL_2, pMemReqRemap);
2160	else
2161	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Ssl_3_LargePage, VTDATFAULT_SSL_3, pMemReqRemap);
2162	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2163	}
2164
2165	/*
2166	* If this is the final PTE, compute the translation address and we're done.
2167	*/
2168	if (iLevel == 0)
2169	{
2170	RTGCPHYS const GCPhysBase = uPtEntity & ~(RT_BIT_64(cLevelShift) - 1);
2171	return dmarDrValidateAndUpdateIotlbe(pDevIns, GCPhysBase, cLevelShift, fPtPerm, idDomain, pMemReqRemap);
2172	}
2173	}
2174
2175	/* Shouldn't ever reach here. */
2176	return VERR_IOMMU_IPE_0;
2177	}
2178
2179
2180	/**
2181	* Handles remapping of DMA address requests in legacy mode.
2182	*
2183	* @returns VBox status code.
2184	* @param pDevIns The IOMMU device instance.
2185	* @param uRtaddrReg The current RTADDR_REG value.
2186	* @param pMemReqRemap The DMA memory request remapping info.
2187	*/
2188	static int dmarDrLegacyModeRemapAddr(PPDMDEVINS pDevIns, uint64_t uRtaddrReg, PDMARMEMREQREMAP pMemReqRemap)
2189	{
2190	Assert(pMemReqRemap->fTtm == VTD_TTM_LEGACY_MODE); /* Paranoia. */
2191
2192	/* Read the root-entry from guest memory. */
2193	uint8_t const idxRootEntry = RT_HI_U8(pMemReqRemap->Req.idDevice);
2194	VTD_ROOT_ENTRY_T RootEntry;
2195	int rc = dmarDrReadRootEntry(pDevIns, uRtaddrReg, idxRootEntry, &RootEntry);
2196	if (RT_SUCCESS(rc))
2197	{
2198	/* Check if the root entry is present (must be done before validating reserved bits). */
2199	uint64_t const uRootEntryQword0 = RootEntry.au64[0];
2200	uint64_t const uRootEntryQword1 = RootEntry.au64[1];
2201	bool const fRootEntryPresent = RT_BF_GET(uRootEntryQword0, VTD_BF_0_ROOT_ENTRY_P);
2202	if (fRootEntryPresent)
2203	{
2204	/* Validate reserved bits in the root entry. */
2205	if ( !(uRootEntryQword0 & ~VTD_ROOT_ENTRY_0_VALID_MASK)
2206	&& !(uRootEntryQword1 & ~VTD_ROOT_ENTRY_1_VALID_MASK))
2207	{
2208	/* Read the context-entry from guest memory. */
2209	RTGCPHYS const GCPhysCtxTable = RT_BF_GET(uRootEntryQword0, VTD_BF_0_ROOT_ENTRY_CTP);
2210	uint8_t const idxCtxEntry = RT_LO_U8(pMemReqRemap->Req.idDevice);
2211	VTD_CONTEXT_ENTRY_T CtxEntry;
2212	rc = dmarDrReadCtxEntry(pDevIns, GCPhysCtxTable, idxCtxEntry, &CtxEntry);
2213	if (RT_SUCCESS(rc))
2214	{
2215	uint64_t const uCtxEntryQword0 = CtxEntry.au64[0];
2216	uint64_t const uCtxEntryQword1 = CtxEntry.au64[1];
2217
2218	/* Note the FPD bit which software can use to supress translation faults from here on in. */
2219	pMemReqRemap->fFpd = RT_BF_GET(uCtxEntryQword0, VTD_BF_0_CONTEXT_ENTRY_FPD);
2220
2221	/* Check if the context-entry is present (must be done before validating reserved bits). */
2222	bool const fCtxEntryPresent = RT_BF_GET(uCtxEntryQword0, VTD_BF_0_CONTEXT_ENTRY_P);
2223	if (fCtxEntryPresent)
2224	{
2225	/* Validate reserved bits in the context-entry. */
2226	if ( !(uCtxEntryQword0 & ~VTD_CONTEXT_ENTRY_0_VALID_MASK)
2227	&& !(uCtxEntryQword1 & ~VTD_CONTEXT_ENTRY_1_VALID_MASK))
2228	{
2229	/* Get the domain ID for this mapping. */
2230	uint16_t const idDomain = RT_BF_GET(uCtxEntryQword1, VTD_BF_1_CONTEXT_ENTRY_DID);
2231
2232	/* Validate the translation type (TT). */
2233	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PCDMAR);
2234	uint8_t const fTt = RT_BF_GET(uCtxEntryQword0, VTD_BF_0_CONTEXT_ENTRY_TT);
2235	switch (fTt)
2236	{
2237	case VTD_TT_UNTRANSLATED_SLP:
2238	{
2239	/*
2240	* Untranslated requests are translated using second-level paging structures referenced
2241	* through SLPTPTR. Translated requests and Translation Requests are blocked.
2242	*/
2243	if (pMemReqRemap->Req.enmAddrType == PCIADDRTYPE_UNTRANSLATED)
2244	{
2245	/* Validate the address width and get the paging level. */
2246	uint8_t cPagingLevel;
2247	if (dmarDrLegacyModeIsAwValid(pThis, &CtxEntry, &cPagingLevel))
2248	{
2249	/* Read the SLPTPTR from guest memory. */
2250	RTGCPHYS const GCPhysSlptPtr = uCtxEntryQword0 & VTD_BF_0_CONTEXT_ENTRY_SLPTPTR_MASK;
2251	VTD_SLP_ENTRY_T SlpEntry;
2252	rc = dmarDrReadSlpPtr(pDevIns, GCPhysSlptPtr, &SlpEntry);
2253	if (RT_SUCCESS(rc))
2254	{
2255	/* Finally... perform second-level translation. */
2256	return dmarDrSecondLevelTranslate(pDevIns, SlpEntry, cPagingLevel, idDomain,
2257	pMemReqRemap);
2258	}
2259	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lct_4_3, VTDATFAULT_LCT_4_3, pMemReqRemap);
2260	}
2261	else
2262	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lct_4_1, VTDATFAULT_LCT_4_1, pMemReqRemap);
2263	}
2264	else
2265	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lct_5, VTDATFAULT_LCT_5, pMemReqRemap);
2266	break;
2267	}
2268
2269	case VTD_TT_UNTRANSLATED_PT:
2270	{
2271	/*
2272	* Untranslated requests are processed as pass-through (PT) if PT is supported.
2273	* Translated and translation requests are blocked. If PT isn't supported this TT value
2274	* is reserved which I assume raises a fault (hence fallthru below).
2275	*/
2276	if (pThis->fExtCapReg & VTD_BF_ECAP_REG_PT_MASK)
2277	{
2278	if (pMemReqRemap->Req.enmAddrType == PCIADDRTYPE_UNTRANSLATED)
2279	{
2280	if (dmarDrLegacyModeIsAwValid(pThis, &CtxEntry, NULL /* pcPagingLevel */))
2281	{
2282	pMemReqRemap->Iotlbe.GCPhysBase = pMemReqRemap->Req.uDmaAddr & X86_PAGE_4K_BASE_MASK;
2283	pMemReqRemap->Iotlbe.cShift = X86_PAGE_4K_SHIFT;
2284	pMemReqRemap->Iotlbe.fPerm = DMAR_PERM_ALL;
2285	pMemReqRemap->Iotlbe.idDomain = idDomain;
2286	pMemReqRemap->cbContiguous = pMemReqRemap->Req.cbDma;
2287	return VINF_SUCCESS;
2288	}
2289	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lgn_1_3, VTDATFAULT_LGN_1_3, pMemReqRemap);
2290	}
2291	else
2292	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lct_5, VTDATFAULT_LCT_5, pMemReqRemap);
2293	break;
2294	}
2295	RT_FALL_THRU();
2296	}
2297
2298	case VTD_TT_UNTRANSLATED_DEV_TLB:
2299	{
2300	/*
2301	* Untranslated, translated and translation requests are supported but requires
2302	* device-TLB support. We don't support device-TLBs, so it's treated as reserved.
2303	*/
2304	Assert(!(pThis->fExtCapReg & VTD_BF_ECAP_REG_DT_MASK));
2305	RT_FALL_THRU();
2306	}
2307
2308	default:
2309	{
2310	/* Any other TT value is reserved. */
2311	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lct_4_2, VTDATFAULT_LCT_4_2, pMemReqRemap);
2312	break;
2313	}
2314	}
2315	}
2316	else
2317	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lct_3, VTDATFAULT_LCT_3, pMemReqRemap);
2318	}
2319	else
2320	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lct_2, VTDATFAULT_LCT_2, pMemReqRemap);
2321	}
2322	else
2323	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lct_1, VTDATFAULT_LCT_1, pMemReqRemap);
2324	}
2325	else
2326	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lrt_3, VTDATFAULT_LRT_3, pMemReqRemap);
2327	}
2328	else
2329	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lrt_2, VTDATFAULT_LRT_2, pMemReqRemap);
2330	}
2331	else
2332	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Lrt_1, VTDATFAULT_LRT_1, pMemReqRemap);
2333	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2334	}
2335
2336
2337	/**
2338	* Handles remapping of DMA address requests in scalable mode.
2339	*
2340	* @returns VBox status code.
2341	* @param pDevIns The IOMMU device instance.
2342	* @param uRtaddrReg The current RTADDR_REG value.
2343	* @param pMemReqRemap The DMA memory request remapping info.
2344	*/
2345	static int dmarDrScalableModeRemapAddr(PPDMDEVINS pDevIns, uint64_t uRtaddrReg, PDMARMEMREQREMAP pMemReqRemap)
2346	{
2347	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
2348	if (pThis->fExtCapReg & VTD_BF_ECAP_REG_SMTS_MASK)
2349	{
2350	RT_NOREF1(uRtaddrReg);
2351	return VERR_NOT_IMPLEMENTED;
2352	}
2353
2354	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Rta_1_3, VTDATFAULT_RTA_1_3, pMemReqRemap);
2355	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2356	}
2357
2358
2359	/**
2360	* Memory access bulk (one or more 4K pages) request from a device.
2361	*
2362	* @returns VBox status code.
2363	* @param pDevIns The IOMMU device instance.
2364	* @param idDevice The device ID (bus, device, function).
2365	* @param cIovas The number of addresses being accessed.
2366	* @param pauIovas The I/O virtual addresses for each page being accessed.
2367	* @param fFlags The access flags, see PDMIOMMU_MEM_F_XXX.
2368	* @param paGCPhysSpa Where to store the translated physical addresses.
2369	*
2370	* @thread Any.
2371	*/
2372	static DECLCALLBACK(int) iommuIntelMemBulkAccess(PPDMDEVINS pDevIns, uint16_t idDevice, size_t cIovas, uint64_t const *pauIovas,
2373	uint32_t fFlags, PRTGCPHYS paGCPhysSpa)
2374	{
2375	RT_NOREF6(pDevIns, idDevice, cIovas, pauIovas, fFlags, paGCPhysSpa);
2376	return VERR_NOT_IMPLEMENTED;
2377	}
2378
2379
2380	/**
2381	* Memory access transaction from a device.
2382	*
2383	* @returns VBox status code.
2384	* @param pDevIns The IOMMU device instance.
2385	* @param idDevice The device ID (bus, device, function).
2386	* @param uIova The I/O virtual address being accessed.
2387	* @param cbIova The size of the access.
2388	* @param fFlags The access flags, see PDMIOMMU_MEM_F_XXX.
2389	* @param pGCPhysSpa Where to store the translated system physical address.
2390	* @param pcbContiguous Where to store the number of contiguous bytes translated
2391	* and permission-checked.
2392	*
2393	* @thread Any.
2394	*/
2395	static DECLCALLBACK(int) iommuIntelMemAccess(PPDMDEVINS pDevIns, uint16_t idDevice, uint64_t uIova, size_t cbIova,
2396	uint32_t fFlags, PRTGCPHYS pGCPhysSpa, size_t *pcbContiguous)
2397	{
2398	/* Validate. */
2399	AssertPtr(pDevIns);
2400	AssertPtr(pGCPhysSpa);
2401	AssertPtr(pcbContiguous);
2402	Assert(cbIova > 0); /** @todo Are we going to support ZLR (zero-length reads to write-only pages)? */
2403	Assert(!(fFlags & ~PDMIOMMU_MEM_F_VALID_MASK));
2404
2405	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
2406	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
2407
2408	DMAR_LOCK(pDevIns, pThisCC);
2409	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
2410	uint64_t const uRtaddrReg = pThis->uRtaddrReg;
2411	DMAR_UNLOCK(pDevIns, pThisCC);
2412
2413	if (uGstsReg & VTD_BF_GSTS_REG_TES_MASK)
2414	{
2415	VTDREQTYPE enmReqType;
2416	uint8_t fReqPerm;
2417	if (fFlags & PDMIOMMU_MEM_F_READ)
2418	{
2419	enmReqType = VTDREQTYPE_READ;
2420	fReqPerm = DMAR_PERM_READ;
2421	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMemRead));
2422	}
2423	else
2424	{
2425	enmReqType = VTDREQTYPE_WRITE;
2426	fReqPerm = DMAR_PERM_WRITE;
2427	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMemWrite));
2428	}
2429
2430	uint8_t const fTtm = RT_BF_GET(uRtaddrReg, VTD_BF_RTADDR_REG_TTM);
2431	DMARMEMREQREMAP MemReqRemap;
2432	RT_ZERO(MemReqRemap);
2433	MemReqRemap.Req.uDmaAddr = uIova;
2434	MemReqRemap.Req.cbDma = cbIova;
2435	MemReqRemap.Req.fReqPerm = fReqPerm;
2436	MemReqRemap.Req.idDevice = idDevice;
2437	MemReqRemap.Req.Pasid = NIL_PCIPASID;
2438	MemReqRemap.Req.enmAddrType = PCIADDRTYPE_UNTRANSLATED;
2439	MemReqRemap.Req.enmReqType = enmReqType;
2440	MemReqRemap.fTtm = fTtm;
2441	MemReqRemap.Iotlbe.GCPhysBase = NIL_RTGCPHYS;
2442
2443	int rc;
2444	switch (fTtm)
2445	{
2446	case VTD_TTM_LEGACY_MODE:
2447	{
2448	rc = dmarDrLegacyModeRemapAddr(pDevIns, uRtaddrReg, &MemReqRemap);
2449	break;
2450	}
2451
2452	case VTD_TTM_SCALABLE_MODE:
2453	{
2454	rc = dmarDrScalableModeRemapAddr(pDevIns, uRtaddrReg, &MemReqRemap);
2455	break;
2456	}
2457
2458	case VTD_TTM_ABORT_DMA_MODE:
2459	{
2460	rc = VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2461	if (pThis->fExtCapReg & VTD_BF_ECAP_REG_ADMS_MASK)
2462	dmarDrTargetAbort(pDevIns);
2463	else
2464	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Rta_1_1, VTDATFAULT_RTA_1_1, &MemReqRemap);
2465	break;
2466	}
2467
2468	default:
2469	{
2470	rc = VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2471	dmarAtFaultRecord(pDevIns, kDmarDiag_Atf_Rta_1_2, VTDATFAULT_RTA_1_2, &MemReqRemap);
2472	break;
2473	}
2474	}
2475
2476	*pcbContiguous = MemReqRemap.cbContiguous;
2477	*pGCPhysSpa = MemReqRemap.Iotlbe.GCPhysBase \| DMAR_GET_PAGE_OFF_MASK(MemReqRemap.Iotlbe.cShift);
2478	return rc;
2479	}
2480
2481	*pGCPhysSpa = uIova;
2482	*pcbContiguous = cbIova;
2483	return VINF_SUCCESS;
2484	}
2485
2486
2487	/**
2488	* Reads an IRTE from guest memory.
2489	*
2490	* @returns VBox status code.
2491	* @param pDevIns The IOMMU device instance.
2492	* @param uIrtaReg The IRTA_REG.
2493	* @param idxIntr The interrupt index.
2494	* @param pIrte Where to store the read IRTE.
2495	*/
2496	static int dmarIrReadIrte(PPDMDEVINS pDevIns, uint64_t uIrtaReg, uint16_t idxIntr, PVTD_IRTE_T pIrte)
2497	{
2498	Assert(idxIntr < VTD_IRTA_REG_GET_ENTRY_COUNT(uIrtaReg));
2499
2500	size_t const cbIrte = sizeof(*pIrte);
2501	RTGCPHYS const GCPhysIrte = (uIrtaReg & VTD_BF_IRTA_REG_IRTA_MASK) + (idxIntr * cbIrte);
2502	return PDMDevHlpPhysReadMeta(pDevIns, GCPhysIrte, pIrte, cbIrte);
2503	}
2504
2505
2506	/**
2507	* Remaps the source MSI to the destination MSI given the IRTE.
2508	*
2509	* @param fExtIntrMode Whether extended interrupt mode is enabled (i.e
2510	* IRTA_REG.EIME).
2511	* @param pIrte The IRTE used for the remapping.
2512	* @param pMsiIn The source MSI (currently unused).
2513	* @param pMsiOut Where to store the remapped MSI.
2514	*/
2515	static void dmarIrRemapFromIrte(bool fExtIntrMode, PCVTD_IRTE_T pIrte, PCMSIMSG pMsiIn, PMSIMSG pMsiOut)
2516	{
2517	NOREF(pMsiIn);
2518	uint64_t const uIrteQword0 = pIrte->au64[0];
2519
2520	/*
2521	* Let's start with a clean slate and preserve unspecified bits if the need arises.
2522	* For instance, address bits 1:0 is supposed to be "ignored" by remapping hardware,
2523	* but it's not clear if hardware zeroes out these bits in the remapped MSI or if
2524	* it copies it from the source MSI.
2525	*/
2526	RT_ZERO(*pMsiOut);
2527	pMsiOut->Addr.n.u1DestMode = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_DM);
2528	pMsiOut->Addr.n.u1RedirHint = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_RH);
2529	pMsiOut->Addr.n.u12Addr = VBOX_MSI_ADDR_BASE >> VBOX_MSI_ADDR_SHIFT;
2530	if (fExtIntrMode)
2531	{
2532	/*
2533	* Apparently the DMAR stuffs the high 24-bits of the destination ID into the
2534	* high 24-bits of the upper 32-bits of the message address, see @bugref{9967#c22}.
2535	*/
2536	uint32_t const idDest = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_DST);
2537	pMsiOut->Addr.n.u8DestId = idDest;
2538	pMsiOut->Addr.n.u32Rsvd0 = idDest & UINT32_C(0xffffff00);
2539	}
2540	else
2541	pMsiOut->Addr.n.u8DestId = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_DST_XAPIC);
2542
2543	pMsiOut->Data.n.u8Vector = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_V);
2544	pMsiOut->Data.n.u3DeliveryMode = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_DLM);
2545	pMsiOut->Data.n.u1Level = 1;
2546	pMsiOut->Data.n.u1TriggerMode = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_TM);
2547	}
2548
2549
2550	/**
2551	* Handles remapping of interrupts in remappable interrupt format.
2552	*
2553	* @returns VBox status code.
2554	* @param pDevIns The IOMMU device instance.
2555	* @param uIrtaReg The IRTA_REG.
2556	* @param idDevice The device ID (bus, device, function).
2557	* @param pMsiIn The source MSI.
2558	* @param pMsiOut Where to store the remapped MSI.
2559	*/
2560	static int dmarIrRemapIntr(PPDMDEVINS pDevIns, uint64_t uIrtaReg, uint16_t idDevice, PCMSIMSG pMsiIn, PMSIMSG pMsiOut)
2561	{
2562	Assert(pMsiIn->Addr.dmar_remap.fIntrFormat == VTD_INTR_FORMAT_REMAPPABLE);
2563
2564	/* Validate reserved bits in the interrupt request. */
2565	AssertCompile(VTD_REMAPPABLE_MSI_ADDR_VALID_MASK == UINT32_MAX);
2566	if (!(pMsiIn->Data.u32 & ~VTD_REMAPPABLE_MSI_DATA_VALID_MASK))
2567	{
2568	/* Compute the index into the interrupt remap table. */
2569	uint16_t const uHandleHi = RT_BF_GET(pMsiIn->Addr.au32[0], VTD_BF_REMAPPABLE_MSI_ADDR_HANDLE_HI);
2570	uint16_t const uHandleLo = RT_BF_GET(pMsiIn->Addr.au32[0], VTD_BF_REMAPPABLE_MSI_ADDR_HANDLE_LO);
2571	uint16_t const uHandle = uHandleLo \| (uHandleHi << 15);
2572	bool const fSubHandleValid = RT_BF_GET(pMsiIn->Addr.au32[0], VTD_BF_REMAPPABLE_MSI_ADDR_SHV);
2573	uint16_t const idxIntr = fSubHandleValid
2574	? uHandle + RT_BF_GET(pMsiIn->Data.u32, VTD_BF_REMAPPABLE_MSI_DATA_SUBHANDLE)
2575	: uHandle;
2576
2577	/* Validate the index. */
2578	uint32_t const cEntries = VTD_IRTA_REG_GET_ENTRY_COUNT(uIrtaReg);
2579	if (idxIntr < cEntries)
2580	{
2581	/** @todo Implement and read IRTE from interrupt-entry cache here. */
2582
2583	/* Read the interrupt remap table entry (IRTE) at the index. */
2584	VTD_IRTE_T Irte;
2585	int rc = dmarIrReadIrte(pDevIns, uIrtaReg, idxIntr, &Irte);
2586	if (RT_SUCCESS(rc))
2587	{
2588	/* Check if the IRTE is present (this must be done -before- checking reserved bits). */
2589	uint64_t const uIrteQword0 = Irte.au64[0];
2590	uint64_t const uIrteQword1 = Irte.au64[1];
2591	bool const fPresent = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_P);
2592	if (fPresent)
2593	{
2594	/* Validate reserved bits in the IRTE. */
2595	bool const fExtIntrMode = RT_BF_GET(uIrtaReg, VTD_BF_IRTA_REG_EIME);
2596	uint64_t const fQw0ValidMask = fExtIntrMode ? VTD_IRTE_0_X2APIC_VALID_MASK : VTD_IRTE_0_XAPIC_VALID_MASK;
2597	if ( !(uIrteQword0 & ~fQw0ValidMask)
2598	&& !(uIrteQword1 & ~VTD_IRTE_1_VALID_MASK))
2599	{
2600	/* Validate requester id (the device ID) as configured in the IRTE. */
2601	bool fSrcValid;
2602	DMARDIAG enmIrDiag;
2603	uint8_t const fSvt = RT_BF_GET(uIrteQword1, VTD_BF_1_IRTE_SVT);
2604	switch (fSvt)
2605	{
2606	case VTD_IRTE_SVT_NONE:
2607	{
2608	fSrcValid = true;
2609	enmIrDiag = kDmarDiag_None;
2610	break;
2611	}
2612
2613	case VTD_IRTE_SVT_VALIDATE_MASK:
2614	{
2615	static uint16_t const s_afValidMasks[] = { 0xffff, 0xfffb, 0xfff9, 0xfff8 };
2616	uint8_t const idxMask = RT_BF_GET(uIrteQword1, VTD_BF_1_IRTE_SQ) & 3;
2617	uint16_t const fValidMask = s_afValidMasks[idxMask];
2618	uint16_t const idSource = RT_BF_GET(uIrteQword1, VTD_BF_1_IRTE_SID);
2619	fSrcValid = (idDevice & fValidMask) == (idSource & fValidMask);
2620	enmIrDiag = kDmarDiag_Ir_Rfi_Irte_Svt_Masked;
2621	break;
2622	}
2623
2624	case VTD_IRTE_SVT_VALIDATE_BUS_RANGE:
2625	{
2626	uint16_t const idSource = RT_BF_GET(uIrteQword1, VTD_BF_1_IRTE_SID);
2627	uint8_t const uBusFirst = RT_HI_U8(idSource);
2628	uint8_t const uBusLast = RT_LO_U8(idSource);
2629	uint8_t const idDeviceBus = idDevice >> VBOX_PCI_BUS_SHIFT;
2630	fSrcValid = (idDeviceBus >= uBusFirst && idDeviceBus <= uBusLast);
2631	enmIrDiag = kDmarDiag_Ir_Rfi_Irte_Svt_Bus;
2632	break;
2633	}
2634
2635	default:
2636	{
2637	fSrcValid = false;
2638	enmIrDiag = kDmarDiag_Ir_Rfi_Irte_Svt_Bus;
2639	break;
2640	}
2641	}
2642
2643	if (fSrcValid)
2644	{
2645	uint8_t const fPostedMode = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_IM);
2646	if (!fPostedMode)
2647	{
2648	dmarIrRemapFromIrte(fExtIntrMode, &Irte, pMsiIn, pMsiOut);
2649	return VINF_SUCCESS;
2650	}
2651	dmarIrFaultRecordQualified(pDevIns, kDmarDiag_Ir_Rfi_Irte_Mode_Invalid,
2652	VTDIRFAULT_IRTE_PRESENT_RSVD, idDevice, idxIntr, &Irte);
2653	}
2654	else
2655	dmarIrFaultRecordQualified(pDevIns, enmIrDiag, VTDIRFAULT_IRTE_PRESENT_RSVD, idDevice, idxIntr,
2656	&Irte);
2657	}
2658	else
2659	dmarIrFaultRecordQualified(pDevIns, kDmarDiag_Ir_Rfi_Irte_Rsvd, VTDIRFAULT_IRTE_PRESENT_RSVD,
2660	idDevice, idxIntr, &Irte);
2661	}
2662	else
2663	dmarIrFaultRecordQualified(pDevIns, kDmarDiag_Ir_Rfi_Irte_Not_Present, VTDIRFAULT_IRTE_NOT_PRESENT,
2664	idDevice, idxIntr, &Irte);
2665	}
2666	else
2667	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Rfi_Irte_Read_Failed, VTDIRFAULT_IRTE_READ_FAILED, idDevice, idxIntr);
2668	}
2669	else
2670	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Rfi_Intr_Index_Invalid, VTDIRFAULT_INTR_INDEX_INVALID, idDevice, idxIntr);
2671	}
2672	else
2673	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Rfi_Rsvd, VTDIRFAULT_REMAPPABLE_INTR_RSVD, idDevice, 0 /* idxIntr */);
2674	return VERR_IOMMU_INTR_REMAP_DENIED;
2675	}
2676
2677
2678	/**
2679	* Interrupt remap request from a device.
2680	*
2681	* @returns VBox status code.
2682	* @param pDevIns The IOMMU device instance.
2683	* @param idDevice The device ID (bus, device, function).
2684	* @param pMsiIn The source MSI.
2685	* @param pMsiOut Where to store the remapped MSI.
2686	*/
2687	static DECLCALLBACK(int) iommuIntelMsiRemap(PPDMDEVINS pDevIns, uint16_t idDevice, PCMSIMSG pMsiIn, PMSIMSG pMsiOut)
2688	{
2689	/* Validate. */
2690	Assert(pDevIns);
2691	Assert(pMsiIn);
2692	Assert(pMsiOut);
2693	RT_NOREF1(idDevice);
2694
2695	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
2696	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
2697
2698	/* Lock and read all registers required for interrupt remapping up-front. */
2699	DMAR_LOCK(pDevIns, pThisCC);
2700	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
2701	uint64_t const uIrtaReg = pThis->uIrtaReg;
2702	DMAR_UNLOCK(pDevIns, pThisCC);
2703
2704	/* Check if interrupt remapping is enabled. */
2705	if (uGstsReg & VTD_BF_GSTS_REG_IRES_MASK)
2706	{
2707	bool const fIsRemappable = RT_BF_GET(pMsiIn->Addr.au32[0], VTD_BF_REMAPPABLE_MSI_ADDR_INTR_FMT);
2708	if (!fIsRemappable)
2709	{
2710	/* Handle compatibility format interrupts. */
2711	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMsiRemapCfi));
2712
2713	/* If EIME is enabled or CFIs are disabled, block the interrupt. */
2714	if ( (uIrtaReg & VTD_BF_IRTA_REG_EIME_MASK)
2715	\|\| !(uGstsReg & VTD_BF_GSTS_REG_CFIS_MASK))
2716	{
2717	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Cfi_Blocked, VTDIRFAULT_CFI_BLOCKED, idDevice, 0 /* idxIntr */);
2718	return VERR_IOMMU_INTR_REMAP_DENIED;
2719	}
2720
2721	/* Interrupt isn't subject to remapping, pass-through the interrupt. */
2722	pMsiOut = pMsiIn;
2723	return VINF_SUCCESS;
2724	}
2725
2726	/* Handle remappable format interrupts. */
2727	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMsiRemapRfi));
2728	return dmarIrRemapIntr(pDevIns, uIrtaReg, idDevice, pMsiIn, pMsiOut);
2729	}
2730
2731	/* Interrupt-remapping isn't enabled, all interrupts are pass-through. */
2732	pMsiOut = pMsiIn;
2733	return VINF_SUCCESS;
2734	}
2735
2736
2737	/**
2738	* @callback_method_impl{FNIOMMMIONEWWRITE}
2739	*/
2740	static DECLCALLBACK(VBOXSTRICTRC) dmarMmioWrite(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void const pv, unsigned cb)
2741	{
2742	RT_NOREF1(pvUser);
2743	DMAR_ASSERT_MMIO_ACCESS_RET(off, cb);
2744
2745	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
2746	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMmioWrite));
2747
2748	uint16_t const offReg = off;
2749	uint16_t const offLast = offReg + cb - 1;
2750	if (DMAR_IS_MMIO_OFF_VALID(offLast))
2751	{
2752	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
2753	DMAR_LOCK_RET(pDevIns, pThisCC, VINF_IOM_R3_MMIO_WRITE);
2754
2755	uint64_t uPrev = 0;
2756	uint64_t const uRegWritten = cb == 8 ? dmarRegWrite64(pThis, offReg, (uint64_t )pv, &uPrev)
2757	: dmarRegWrite32(pThis, offReg, (uint32_t )pv, (uint32_t *)&uPrev);
2758	VBOXSTRICTRC rcStrict = VINF_SUCCESS;
2759	switch (off)
2760	{
2761	case VTD_MMIO_OFF_GCMD_REG: /* 32-bit */
2762	{
2763	rcStrict = dmarGcmdRegWrite(pDevIns, uRegWritten);
2764	break;
2765	}
2766
2767	case VTD_MMIO_OFF_CCMD_REG: /* 64-bit */
2768	case VTD_MMIO_OFF_CCMD_REG + 4:
2769	{
2770	rcStrict = dmarCcmdRegWrite(pDevIns, offReg, cb, uRegWritten);
2771	break;
2772	}
2773
2774	case VTD_MMIO_OFF_FSTS_REG: /* 32-bit */
2775	{
2776	rcStrict = dmarFstsRegWrite(pDevIns, uRegWritten, uPrev);
2777	break;
2778	}
2779
2780	case VTD_MMIO_OFF_FECTL_REG: /* 32-bit */
2781	{
2782	rcStrict = dmarFectlRegWrite(pDevIns, uRegWritten);
2783	break;
2784	}
2785
2786	case VTD_MMIO_OFF_IQT_REG: /* 64-bit */
2787	/* VTD_MMIO_OFF_IQT_REG + 4: / / High 32-bits reserved. */
2788	{
2789	rcStrict = dmarIqtRegWrite(pDevIns, offReg, uRegWritten);
2790	break;
2791	}
2792
2793	case VTD_MMIO_OFF_IQA_REG: /* 64-bit */
2794	/* VTD_MMIO_OFF_IQA_REG + 4: / / High 32-bits data. */
2795	{
2796	rcStrict = dmarIqaRegWrite(pDevIns, offReg, uRegWritten);
2797	break;
2798	}
2799
2800	case VTD_MMIO_OFF_ICS_REG: /* 32-bit */
2801	{
2802	rcStrict = dmarIcsRegWrite(pDevIns, uRegWritten);
2803	break;
2804	}
2805
2806	case VTD_MMIO_OFF_IECTL_REG: /* 32-bit */
2807	{
2808	rcStrict = dmarIectlRegWrite(pDevIns, uRegWritten);
2809	break;
2810	}
2811
2812	case DMAR_MMIO_OFF_FRCD_HI_REG: /* 64-bit */
2813	case DMAR_MMIO_OFF_FRCD_HI_REG + 4:
2814	{
2815	rcStrict = dmarFrcdHiRegWrite(pDevIns, offReg, cb, uRegWritten, uPrev);
2816	break;
2817	}
2818	}
2819
2820	DMAR_UNLOCK(pDevIns, pThisCC);
2821	LogFlowFunc(("offReg=%#x uRegWritten=%#RX64 rc=%Rrc\n", offReg, uRegWritten, VBOXSTRICTRC_VAL(rcStrict)));
2822	return rcStrict;
2823	}
2824
2825	return VINF_IOM_MMIO_UNUSED_FF;
2826	}
2827
2828
2829	/**
2830	* @callback_method_impl{FNIOMMMIONEWREAD}
2831	*/
2832	static DECLCALLBACK(VBOXSTRICTRC) dmarMmioRead(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void pv, unsigned cb)
2833	{
2834	RT_NOREF1(pvUser);
2835	DMAR_ASSERT_MMIO_ACCESS_RET(off, cb);
2836
2837	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
2838	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMmioRead));
2839
2840	uint16_t const offReg = off;
2841	uint16_t const offLast = offReg + cb - 1;
2842	if (DMAR_IS_MMIO_OFF_VALID(offLast))
2843	{
2844	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
2845	DMAR_LOCK_RET(pDevIns, pThisCC, VINF_IOM_R3_MMIO_READ);
2846
2847	if (cb == 8)
2848	{
2849	(uint64_t )pv = dmarRegRead64(pThis, offReg);
2850	LogFlowFunc(("offReg=%#x pv=%#RX64\n", offReg, (uint64_t )pv));
2851	}
2852	else
2853	{
2854	(uint32_t )pv = dmarRegRead32(pThis, offReg);
2855	LogFlowFunc(("offReg=%#x pv=%#RX32\n", offReg, (uint32_t )pv));
2856	}
2857
2858	DMAR_UNLOCK(pDevIns, pThisCC);
2859	return VINF_SUCCESS;
2860	}
2861
2862	return VINF_IOM_MMIO_UNUSED_FF;
2863	}
2864
2865
2866	#ifdef IN_RING3
2867	/**
2868	* Process requests in the invalidation queue.
2869	*
2870	* @param pDevIns The IOMMU device instance.
2871	* @param pvRequests The requests to process.
2872	* @param cbRequests The size of all requests (in bytes).
2873	* @param fDw The descriptor width (VTD_IQA_REG_DW_128_BIT or
2874	* VTD_IQA_REG_DW_256_BIT).
2875	* @param fTtm The table translation mode. Must not be VTD_TTM_RSVD.
2876	*/
2877	static void dmarR3InvQueueProcessRequests(PPDMDEVINS pDevIns, void const *pvRequests, uint32_t cbRequests, uint8_t fDw,
2878	uint8_t fTtm)
2879	{
2880	#define DMAR_IQE_FAULT_RECORD_RET(a_enmDiag, a_enmIqei) \
2881	do \
2882	{ \
2883	dmarIqeFaultRecord(pDevIns, (a_enmDiag), (a_enmIqei)); \
2884	return; \
2885	} while (0)
2886
2887	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
2888	PCDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARR3);
2889
2890	DMAR_ASSERT_LOCK_IS_NOT_OWNER(pDevIns, pThisR3);
2891	Assert(fTtm != VTD_TTM_RSVD); /* Should've beeen handled by caller. */
2892
2893	/*
2894	* The below check is redundant since we check both TTM and DW for each
2895	* descriptor type we process. However, the error reported by hardware
2896	* may differ hence this is kept commented out but not removed from the code
2897	* if we need to change this in the future.
2898	*
2899	* In our implementation, we would report the descriptor type as invalid,
2900	* while on real hardware it may report descriptor width as invalid.
2901	* The Intel VT-d spec. is not clear which error takes preceedence.
2902	*/
2903	#if 0
2904	/*
2905	* Verify that 128-bit descriptors are not used when operating in scalable mode.
2906	* We don't check this while software writes IQA_REG but defer it until now because
2907	* RTADDR_REG can be updated lazily (via GCMD_REG.SRTP). The 256-bit descriptor check
2908	* -IS- performed when software writes IQA_REG since it only requires checking against
2909	* immutable hardware features.
2910	*/
2911	if ( fTtm != VTD_TTM_SCALABLE_MODE
2912	\|\| fDw != VTD_IQA_REG_DW_128_BIT)
2913	{ /* likely */ }
2914	else
2915	DMAR_IQE_FAULT_RECORD_RET(kDmarDiag_IqaReg_Dw_128_Invalid, VTDIQEI_INVALID_DESCRIPTOR_WIDTH);
2916	#endif
2917
2918	/*
2919	* Process requests in FIFO order.
2920	*/
2921	uint8_t const cbDsc = fDw == VTD_IQA_REG_DW_256_BIT ? 32 : 16;
2922	for (uint32_t offDsc = 0; offDsc < cbRequests; offDsc += cbDsc)
2923	{
2924	uint64_t const puDscQwords = (uint64_t const )((uintptr_t)pvRequests + offDsc);
2925	uint64_t const uQword0 = puDscQwords[0];
2926	uint64_t const uQword1 = puDscQwords[1];
2927	uint8_t const fDscType = VTD_GENERIC_INV_DSC_GET_TYPE(uQword0);
2928	switch (fDscType)
2929	{
2930	case VTD_INV_WAIT_DSC_TYPE:
2931	{
2932	/* Validate descriptor type. */
2933	if ( fTtm == VTD_TTM_LEGACY_MODE
2934	\|\| fDw == VTD_IQA_REG_DW_256_BIT)
2935	{ /* likely */ }
2936	else
2937	DMAR_IQE_FAULT_RECORD_RET(kDmarDiag_Iqei_Inv_Wait_Dsc_Invalid, VTDIQEI_INVALID_DESCRIPTOR_TYPE);
2938
2939	/* Validate reserved bits. */
2940	uint64_t const fValidMask0 = !(pThis->fExtCapReg & VTD_BF_ECAP_REG_PDS_MASK)
2941	? VTD_INV_WAIT_DSC_0_VALID_MASK & ~VTD_BF_0_INV_WAIT_DSC_PD_MASK
2942	: VTD_INV_WAIT_DSC_0_VALID_MASK;
2943	if ( !(uQword0 & ~fValidMask0)
2944	&& !(uQword1 & ~VTD_INV_WAIT_DSC_1_VALID_MASK))
2945	{ /* likely */ }
2946	else
2947	DMAR_IQE_FAULT_RECORD_RET(kDmarDiag_Iqei_Inv_Wait_Dsc_0_1_Rsvd, VTDIQEI_RSVD_FIELD_VIOLATION);
2948
2949	if (fDw == VTD_IQA_REG_DW_256_BIT)
2950	{
2951	if ( !puDscQwords[2]
2952	&& !puDscQwords[3])
2953	{ /* likely */ }
2954	else
2955	DMAR_IQE_FAULT_RECORD_RET(kDmarDiag_Iqei_Inv_Wait_Dsc_2_3_Rsvd, VTDIQEI_RSVD_FIELD_VIOLATION);
2956	}
2957
2958	/* Perform status write (this must be done prior to generating the completion interrupt). */
2959	bool const fSw = RT_BF_GET(uQword0, VTD_BF_0_INV_WAIT_DSC_SW);
2960	if (fSw)
2961	{
2962	uint32_t const uStatus = RT_BF_GET(uQword0, VTD_BF_0_INV_WAIT_DSC_STDATA);
2963	RTGCPHYS const GCPhysStatus = uQword1 & VTD_BF_1_INV_WAIT_DSC_STADDR_MASK;
2964	int const rc = PDMDevHlpPhysWrite(pDevIns, GCPhysStatus, (void const*)&uStatus, sizeof(uStatus));
2965	AssertRC(rc);
2966	}
2967
2968	/* Generate invalidation event interrupt. */
2969	bool const fIf = RT_BF_GET(uQword0, VTD_BF_0_INV_WAIT_DSC_IF);
2970	if (fIf)
2971	{
2972	DMAR_LOCK(pDevIns, pThisR3);
2973	dmarR3InvEventRaiseInterrupt(pDevIns);
2974	DMAR_UNLOCK(pDevIns, pThisR3);
2975	}
2976
2977	STAM_COUNTER_INC(&pThis->StatInvWaitDsc);
2978	break;
2979	}
2980
2981	case VTD_CC_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatCcInvDsc); break;
2982	case VTD_IOTLB_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatIotlbInvDsc); break;
2983	case VTD_DEV_TLB_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatDevtlbInvDsc); break;
2984	case VTD_IEC_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatIecInvDsc); break;
2985	case VTD_P_IOTLB_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatPasidIotlbInvDsc); break;
2986	case VTD_PC_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatPasidCacheInvDsc); break;
2987	case VTD_P_DEV_TLB_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatPasidDevtlbInvDsc); break;
2988	default:
2989	{
2990	/* Stop processing further requests. */
2991	LogFunc(("Invalid descriptor type: %#x\n", fDscType));
2992	DMAR_IQE_FAULT_RECORD_RET(kDmarDiag_Iqei_Dsc_Type_Invalid, VTDIQEI_INVALID_DESCRIPTOR_TYPE);
2993	}
2994	}
2995	}
2996	#undef DMAR_IQE_FAULT_RECORD_RET
2997	}
2998
2999
3000	/**
3001	* The invalidation-queue thread.
3002	*
3003	* @returns VBox status code.
3004	* @param pDevIns The IOMMU device instance.
3005	* @param pThread The command thread.
3006	*/
3007	static DECLCALLBACK(int) dmarR3InvQueueThread(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3008	{
3009	NOREF(pThread);
3010	LogFlowFunc(("\n"));
3011
3012	if (pThread->enmState == PDMTHREADSTATE_INITIALIZING)
3013	return VINF_SUCCESS;
3014
3015	/*
3016	* Pre-allocate the maximum size of the invalidation queue allowed by the spec.
3017	* This prevents trashing the heap as well as deal with out-of-memory situations
3018	* up-front while starting the VM. It also simplifies the code from having to
3019	* dynamically grow/shrink the allocation based on how software sizes the queue.
3020	* Guests normally don't alter the queue size all the time, but that's not an
3021	* assumption we can make.
3022	*/
3023	uint8_t const cMaxPages = 1 << VTD_BF_IQA_REG_QS_MASK;
3024	size_t const cbMaxQs = cMaxPages << X86_PAGE_SHIFT;
3025	void *pvRequests = RTMemAllocZ(cbMaxQs);
3026	AssertPtrReturn(pvRequests, VERR_NO_MEMORY);
3027
3028	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3029	PCDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARR3);
3030
3031	while (pThread->enmState == PDMTHREADSTATE_RUNNING)
3032	{
3033	/*
3034	* Sleep until we are woken up.
3035	*/
3036	{
3037	int const rc = PDMDevHlpSUPSemEventWaitNoResume(pDevIns, pThis->hEvtInvQueue, RT_INDEFINITE_WAIT);
3038	AssertLogRelMsgReturn(RT_SUCCESS(rc) \|\| rc == VERR_INTERRUPTED, ("%Rrc\n", rc), rc);
3039	if (RT_UNLIKELY(pThread->enmState != PDMTHREADSTATE_RUNNING))
3040	break;
3041	}
3042
3043	DMAR_LOCK(pDevIns, pThisR3);
3044	if (dmarInvQueueCanProcessRequests(pThis))
3045	{
3046	uint32_t offQueueHead;
3047	uint32_t offQueueTail;
3048	bool const fIsEmpty = dmarInvQueueIsEmptyEx(pThis, &offQueueHead, &offQueueTail);
3049	if (!fIsEmpty)
3050	{
3051	/*
3052	* Get the current queue size, descriptor width, queue base address and the
3053	* table translation mode while the lock is still held.
3054	*/
3055	uint64_t const uIqaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQA_REG);
3056	uint8_t const cQueuePages = 1 << (uIqaReg & VTD_BF_IQA_REG_QS_MASK);
3057	uint32_t const cbQueue = cQueuePages << X86_PAGE_SHIFT;
3058	uint8_t const fDw = RT_BF_GET(uIqaReg, VTD_BF_IQA_REG_DW);
3059	uint8_t const fTtm = RT_BF_GET(pThis->uRtaddrReg, VTD_BF_RTADDR_REG_TTM);
3060	RTGCPHYS const GCPhysRequests = (uIqaReg & VTD_BF_IQA_REG_IQA_MASK) + offQueueHead;
3061
3062	/* Paranoia. */
3063	Assert(cbQueue <= cbMaxQs);
3064	Assert(!(offQueueTail & ~VTD_BF_IQT_REG_QT_MASK));
3065	Assert(!(offQueueHead & ~VTD_BF_IQH_REG_QH_MASK));
3066	Assert(fDw != VTD_IQA_REG_DW_256_BIT \|\| !(offQueueTail & RT_BIT(4)));
3067	Assert(fDw != VTD_IQA_REG_DW_256_BIT \|\| !(offQueueHead & RT_BIT(4)));
3068	Assert(offQueueHead < cbQueue);
3069
3070	/*
3071	* A table translation mode of "reserved" isn't valid for any descriptor type.
3072	* However, RTADDR_REG can be modified in parallel to invalidation-queue processing,
3073	* but if ESRTPS is support, we will perform a global invalidation when software
3074	* changes RTADDR_REG, or it's the responsibility of software to do it explicitly.
3075	* So caching TTM while reading all descriptors should not be a problem.
3076	*
3077	* Also, validate the queue tail offset as it's mutable by software.
3078	*/
3079	if ( fTtm != VTD_TTM_RSVD
3080	&& offQueueTail < cbQueue)
3081	{
3082	/* Don't hold the lock while reading (a potentially large amount of) requests */
3083	DMAR_UNLOCK(pDevIns, pThisR3);
3084
3085	int rc;
3086	uint32_t cbRequests;
3087	if (offQueueTail > offQueueHead)
3088	{
3089	/* The requests have not wrapped around, read them in one go. */
3090	cbRequests = offQueueTail - offQueueHead;
3091	rc = PDMDevHlpPhysReadMeta(pDevIns, GCPhysRequests, pvRequests, cbRequests);
3092	}
3093	else
3094	{
3095	/* The requests have wrapped around, read forward and wrapped-around. */
3096	uint32_t const cbForward = cbQueue - offQueueHead;
3097	rc = PDMDevHlpPhysReadMeta(pDevIns, GCPhysRequests, pvRequests, cbForward);
3098
3099	uint32_t const cbWrapped = offQueueTail;
3100	if ( RT_SUCCESS(rc)
3101	&& cbWrapped > 0)
3102	{
3103	rc = PDMDevHlpPhysReadMeta(pDevIns, GCPhysRequests + cbForward,
3104	(void *)((uintptr_t)pvRequests + cbForward), cbWrapped);
3105	}
3106	cbRequests = cbForward + cbWrapped;
3107	}
3108
3109	/* Re-acquire the lock since we need to update device state. */
3110	DMAR_LOCK(pDevIns, pThisR3);
3111
3112	if (RT_SUCCESS(rc))
3113	{
3114	/* Indicate to software we've fetched all requests. */
3115	dmarRegWriteRaw64(pThis, VTD_MMIO_OFF_IQH_REG, offQueueTail);
3116
3117	/* Don't hold the lock while processing requests. */
3118	DMAR_UNLOCK(pDevIns, pThisR3);
3119
3120	/* Process all requests. */
3121	Assert(cbRequests <= cbQueue);
3122	dmarR3InvQueueProcessRequests(pDevIns, pvRequests, cbRequests, fDw, fTtm);
3123
3124	/*
3125	* We've processed all requests and the lock shouldn't be held at this point.
3126	* Using 'continue' here allows us to skip re-acquiring the lock just to release
3127	* it again before going back to the thread loop. It's a bit ugly but it certainly
3128	* helps with performance.
3129	*/
3130	DMAR_ASSERT_LOCK_IS_NOT_OWNER(pDevIns, pThisR3);
3131	continue;
3132	}
3133	else
3134	dmarIqeFaultRecord(pDevIns, kDmarDiag_IqaReg_Dsc_Fetch_Error, VTDIQEI_FETCH_DESCRIPTOR_ERR);
3135	}
3136	else
3137	{
3138	if (fTtm == VTD_TTM_RSVD)
3139	dmarIqeFaultRecord(pDevIns, kDmarDiag_Iqei_Ttm_Rsvd, VTDIQEI_INVALID_TTM);
3140	else
3141	{
3142	Assert(offQueueTail >= cbQueue);
3143	dmarIqeFaultRecord(pDevIns, kDmarDiag_IqtReg_Qt_Invalid, VTDIQEI_INVALID_TAIL_PTR);
3144	}
3145	}
3146	}
3147	}
3148	DMAR_UNLOCK(pDevIns, pThisR3);
3149	}
3150
3151	RTMemFree(pvRequests);
3152	pvRequests = NULL;
3153
3154	LogFlowFunc(("Invalidation-queue thread terminating\n"));
3155	return VINF_SUCCESS;
3156	}
3157
3158
3159	/**
3160	* Wakes up the invalidation-queue thread so it can respond to a state
3161	* change.
3162	*
3163	* @returns VBox status code.
3164	* @param pDevIns The IOMMU device instance.
3165	* @param pThread The invalidation-queue thread.
3166	*
3167	* @thread EMT.
3168	*/
3169	static DECLCALLBACK(int) dmarR3InvQueueThreadWakeUp(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3170	{
3171	RT_NOREF(pThread);
3172	LogFlowFunc(("\n"));
3173	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3174	return PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtInvQueue);
3175	}
3176
3177
3178	/**
3179	* @callback_method_impl{FNDBGFHANDLERDEV}
3180	*/
3181	static DECLCALLBACK(void) dmarR3DbgInfo(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
3182	{
3183	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3184	PCDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARR3);
3185	bool const fVerbose = RTStrCmp(pszArgs, "verbose") == 0;
3186
3187	/*
3188	* We lock the device to get a consistent register state as it is
3189	* ASSUMED pHlp->pfnPrintf is expensive, so we copy the registers (the
3190	* ones we care about here) into temporaries and release the lock ASAP.
3191	*
3192	* Order of register being read and outputted is in accordance with the
3193	* spec. for no particular reason.
3194	* See Intel VT-d spec. 10.4 "Register Descriptions".
3195	*/
3196	DMAR_LOCK(pDevIns, pThisR3);
3197
3198	DMARDIAG const enmDiag = pThis->enmDiag;
3199	uint32_t const uVerReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_VER_REG);
3200	uint64_t const uCapReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_CAP_REG);
3201	uint64_t const uEcapReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_ECAP_REG);
3202	uint32_t const uGcmdReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GCMD_REG);
3203	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
3204	uint64_t const uRtaddrReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_RTADDR_REG);
3205	uint64_t const uCcmdReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_CCMD_REG);
3206	uint32_t const uFstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FSTS_REG);
3207	uint32_t const uFectlReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FECTL_REG);
3208	uint32_t const uFedataReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FEDATA_REG);
3209	uint32_t const uFeaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FEADDR_REG);
3210	uint32_t const uFeuaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FEUADDR_REG);
3211	uint64_t const uAflogReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_AFLOG_REG);
3212	uint32_t const uPmenReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PMEN_REG);
3213	uint32_t const uPlmbaseReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PLMBASE_REG);
3214	uint32_t const uPlmlimitReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PLMLIMIT_REG);
3215	uint64_t const uPhmbaseReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_PHMBASE_REG);
3216	uint64_t const uPhmlimitReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_PHMLIMIT_REG);
3217	uint64_t const uIqhReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQH_REG);
3218	uint64_t const uIqtReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQT_REG);
3219	uint64_t const uIqaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQA_REG);
3220	uint32_t const uIcsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_ICS_REG);
3221	uint32_t const uIectlReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IECTL_REG);
3222	uint32_t const uIedataReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IEDATA_REG);
3223	uint32_t const uIeaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IEADDR_REG);
3224	uint32_t const uIeuaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IEUADDR_REG);
3225	uint64_t const uIqercdReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQERCD_REG);
3226	uint64_t const uIrtaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IRTA_REG);
3227	uint64_t const uPqhReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_PQH_REG);
3228	uint64_t const uPqtReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_PQT_REG);
3229	uint64_t const uPqaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_PQA_REG);
3230	uint32_t const uPrsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PRS_REG);
3231	uint32_t const uPectlReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PECTL_REG);
3232	uint32_t const uPedataReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PEDATA_REG);
3233	uint32_t const uPeaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PEADDR_REG);
3234	uint32_t const uPeuaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PEUADDR_REG);
3235	uint64_t const uMtrrcapReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_MTRRCAP_REG);
3236	uint64_t const uMtrrdefReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_MTRRDEF_REG);
3237
3238	DMAR_UNLOCK(pDevIns, pThisR3);
3239
3240	const char *const pszDiag = enmDiag < RT_ELEMENTS(g_apszDmarDiagDesc) ? g_apszDmarDiagDesc[enmDiag] : "(Unknown)";
3241	pHlp->pfnPrintf(pHlp, "Intel-IOMMU:\n");
3242	pHlp->pfnPrintf(pHlp, " Diag = %s\n", pszDiag);
3243
3244	/*
3245	* Non-verbose output.
3246	*/
3247	if (!fVerbose)
3248	{
3249	pHlp->pfnPrintf(pHlp, " VER_REG = %#RX32\n", uVerReg);
3250	pHlp->pfnPrintf(pHlp, " CAP_REG = %#RX64\n", uCapReg);
3251	pHlp->pfnPrintf(pHlp, " ECAP_REG = %#RX64\n", uEcapReg);
3252	pHlp->pfnPrintf(pHlp, " GCMD_REG = %#RX32\n", uGcmdReg);
3253	pHlp->pfnPrintf(pHlp, " GSTS_REG = %#RX32\n", uGstsReg);
3254	pHlp->pfnPrintf(pHlp, " RTADDR_REG = %#RX64\n", uRtaddrReg);
3255	pHlp->pfnPrintf(pHlp, " CCMD_REG = %#RX64\n", uCcmdReg);
3256	pHlp->pfnPrintf(pHlp, " FSTS_REG = %#RX32\n", uFstsReg);
3257	pHlp->pfnPrintf(pHlp, " FECTL_REG = %#RX32\n", uFectlReg);
3258	pHlp->pfnPrintf(pHlp, " FEDATA_REG = %#RX32\n", uFedataReg);
3259	pHlp->pfnPrintf(pHlp, " FEADDR_REG = %#RX32\n", uFeaddrReg);
3260	pHlp->pfnPrintf(pHlp, " FEUADDR_REG = %#RX32\n", uFeuaddrReg);
3261	pHlp->pfnPrintf(pHlp, " AFLOG_REG = %#RX64\n", uAflogReg);
3262	pHlp->pfnPrintf(pHlp, " PMEN_REG = %#RX32\n", uPmenReg);
3263	pHlp->pfnPrintf(pHlp, " PLMBASE_REG = %#RX32\n", uPlmbaseReg);
3264	pHlp->pfnPrintf(pHlp, " PLMLIMIT_REG = %#RX32\n", uPlmlimitReg);
3265	pHlp->pfnPrintf(pHlp, " PHMBASE_REG = %#RX64\n", uPhmbaseReg);
3266	pHlp->pfnPrintf(pHlp, " PHMLIMIT_REG = %#RX64\n", uPhmlimitReg);
3267	pHlp->pfnPrintf(pHlp, " IQH_REG = %#RX64\n", uIqhReg);
3268	pHlp->pfnPrintf(pHlp, " IQT_REG = %#RX64\n", uIqtReg);
3269	pHlp->pfnPrintf(pHlp, " IQA_REG = %#RX64\n", uIqaReg);
3270	pHlp->pfnPrintf(pHlp, " ICS_REG = %#RX32\n", uIcsReg);
3271	pHlp->pfnPrintf(pHlp, " IECTL_REG = %#RX32\n", uIectlReg);
3272	pHlp->pfnPrintf(pHlp, " IEDATA_REG = %#RX32\n", uIedataReg);
3273	pHlp->pfnPrintf(pHlp, " IEADDR_REG = %#RX32\n", uIeaddrReg);
3274	pHlp->pfnPrintf(pHlp, " IEUADDR_REG = %#RX32\n", uIeuaddrReg);
3275	pHlp->pfnPrintf(pHlp, " IQERCD_REG = %#RX64\n", uIqercdReg);
3276	pHlp->pfnPrintf(pHlp, " IRTA_REG = %#RX64\n", uIrtaReg);
3277	pHlp->pfnPrintf(pHlp, " PQH_REG = %#RX64\n", uPqhReg);
3278	pHlp->pfnPrintf(pHlp, " PQT_REG = %#RX64\n", uPqtReg);
3279	pHlp->pfnPrintf(pHlp, " PQA_REG = %#RX64\n", uPqaReg);
3280	pHlp->pfnPrintf(pHlp, " PRS_REG = %#RX32\n", uPrsReg);
3281	pHlp->pfnPrintf(pHlp, " PECTL_REG = %#RX32\n", uPectlReg);
3282	pHlp->pfnPrintf(pHlp, " PEDATA_REG = %#RX32\n", uPedataReg);
3283	pHlp->pfnPrintf(pHlp, " PEADDR_REG = %#RX32\n", uPeaddrReg);
3284	pHlp->pfnPrintf(pHlp, " PEUADDR_REG = %#RX32\n", uPeuaddrReg);
3285	pHlp->pfnPrintf(pHlp, " MTRRCAP_REG = %#RX64\n", uMtrrcapReg);
3286	pHlp->pfnPrintf(pHlp, " MTRRDEF_REG = %#RX64\n", uMtrrdefReg);
3287	pHlp->pfnPrintf(pHlp, "\n");
3288	return;
3289	}
3290
3291	/*
3292	* Verbose output.
3293	*/
3294	pHlp->pfnPrintf(pHlp, " VER_REG = %#RX32\n", uVerReg);
3295	{
3296	pHlp->pfnPrintf(pHlp, " MAJ = %#x\n", RT_BF_GET(uVerReg, VTD_BF_VER_REG_MAX));
3297	pHlp->pfnPrintf(pHlp, " MIN = %#x\n", RT_BF_GET(uVerReg, VTD_BF_VER_REG_MIN));
3298	}
3299	pHlp->pfnPrintf(pHlp, " CAP_REG = %#RX64\n", uCapReg);
3300	{
3301	uint8_t const uMgaw = RT_BF_GET(uCapReg, VTD_BF_CAP_REG_MGAW);
3302	uint8_t const uNfr = RT_BF_GET(uCapReg, VTD_BF_CAP_REG_NFR);
3303	pHlp->pfnPrintf(pHlp, " ND = %u\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_ND));
3304	pHlp->pfnPrintf(pHlp, " AFL = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_AFL));
3305	pHlp->pfnPrintf(pHlp, " RWBF = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_RWBF));
3306	pHlp->pfnPrintf(pHlp, " PLMR = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_PLMR));
3307	pHlp->pfnPrintf(pHlp, " PHMR = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_PHMR));
3308	pHlp->pfnPrintf(pHlp, " CM = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_CM));
3309	pHlp->pfnPrintf(pHlp, " SAGAW = %#x\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_SAGAW));
3310	pHlp->pfnPrintf(pHlp, " MGAW = %#x (%u bits)\n", uMgaw, uMgaw + 1);
3311	pHlp->pfnPrintf(pHlp, " ZLR = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_ZLR));
3312	pHlp->pfnPrintf(pHlp, " FRO = %#x bytes\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_FRO));
3313	pHlp->pfnPrintf(pHlp, " SLLPS = %#x\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_SLLPS));
3314	pHlp->pfnPrintf(pHlp, " PSI = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_PSI));
3315	pHlp->pfnPrintf(pHlp, " NFR = %u (%u FRCD register%s)\n", uNfr, uNfr + 1, uNfr > 0 ? "s" : "");
3316	pHlp->pfnPrintf(pHlp, " MAMV = %#x\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_MAMV));
3317	pHlp->pfnPrintf(pHlp, " DWD = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_DWD));
3318	pHlp->pfnPrintf(pHlp, " DRD = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_DRD));
3319	pHlp->pfnPrintf(pHlp, " FL1GP = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_FL1GP));
3320	pHlp->pfnPrintf(pHlp, " PI = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_PI));
3321	pHlp->pfnPrintf(pHlp, " FL5LP = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_FL5LP));
3322	pHlp->pfnPrintf(pHlp, " ESIRTPS = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_ESIRTPS));
3323	pHlp->pfnPrintf(pHlp, " ESRTPS = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_ESRTPS));
3324	}
3325	pHlp->pfnPrintf(pHlp, " ECAP_REG = %#RX64\n", uEcapReg);
3326	{
3327	uint8_t const uPss = RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_PSS);
3328	pHlp->pfnPrintf(pHlp, " C = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_C));
3329	pHlp->pfnPrintf(pHlp, " QI = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_QI));
3330	pHlp->pfnPrintf(pHlp, " DT = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_DT));
3331	pHlp->pfnPrintf(pHlp, " IR = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_IR));
3332	pHlp->pfnPrintf(pHlp, " EIM = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_EIM));
3333	pHlp->pfnPrintf(pHlp, " PT = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_PT));
3334	pHlp->pfnPrintf(pHlp, " SC = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SC));
3335	pHlp->pfnPrintf(pHlp, " IRO = %#x bytes\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_IRO));
3336	pHlp->pfnPrintf(pHlp, " MHMV = %#x\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_MHMV));
3337	pHlp->pfnPrintf(pHlp, " MTS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_MTS));
3338	pHlp->pfnPrintf(pHlp, " NEST = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_NEST));
3339	pHlp->pfnPrintf(pHlp, " PRS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_PRS));
3340	pHlp->pfnPrintf(pHlp, " ERS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_ERS));
3341	pHlp->pfnPrintf(pHlp, " SRS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SRS));
3342	pHlp->pfnPrintf(pHlp, " NWFS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_NWFS));
3343	pHlp->pfnPrintf(pHlp, " EAFS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_EAFS));
3344	pHlp->pfnPrintf(pHlp, " PSS = %u (%u bits)\n", uPss, uPss > 0 ? uPss + 1 : 0);
3345	pHlp->pfnPrintf(pHlp, " PASID = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_PASID));
3346	pHlp->pfnPrintf(pHlp, " DIT = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_DIT));
3347	pHlp->pfnPrintf(pHlp, " PDS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_PDS));
3348	pHlp->pfnPrintf(pHlp, " SMTS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SMTS));
3349	pHlp->pfnPrintf(pHlp, " VCS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_VCS));
3350	pHlp->pfnPrintf(pHlp, " SLADS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SLADS));
3351	pHlp->pfnPrintf(pHlp, " SLTS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SLTS));
3352	pHlp->pfnPrintf(pHlp, " FLTS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_FLTS));
3353	pHlp->pfnPrintf(pHlp, " SMPWCS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SMPWCS));
3354	pHlp->pfnPrintf(pHlp, " RPS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_RPS));
3355	pHlp->pfnPrintf(pHlp, " ADMS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_ADMS));
3356	pHlp->pfnPrintf(pHlp, " RPRIVS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_RPRIVS));
3357	}
3358	pHlp->pfnPrintf(pHlp, " GCMD_REG = %#RX32\n", uGcmdReg);
3359	{
3360	uint8_t const fCfi = RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_CFI);
3361	pHlp->pfnPrintf(pHlp, " CFI = %u (%s)\n", fCfi, fCfi ? "Passthrough" : "Blocked");
3362	pHlp->pfnPrintf(pHlp, " SIRTP = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_SIRTP));
3363	pHlp->pfnPrintf(pHlp, " IRE = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_IRE));
3364	pHlp->pfnPrintf(pHlp, " QIE = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_QIE));
3365	pHlp->pfnPrintf(pHlp, " WBF = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_WBF));
3366	pHlp->pfnPrintf(pHlp, " EAFL = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_SFL));
3367	pHlp->pfnPrintf(pHlp, " SFL = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_SFL));
3368	pHlp->pfnPrintf(pHlp, " SRTP = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_SRTP));
3369	pHlp->pfnPrintf(pHlp, " TE = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_TE));
3370	}
3371	pHlp->pfnPrintf(pHlp, " GSTS_REG = %#RX32\n", uGstsReg);
3372	{
3373	uint8_t const fCfis = RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_CFIS);
3374	pHlp->pfnPrintf(pHlp, " CFIS = %u (%s)\n", fCfis, fCfis ? "Passthrough" : "Blocked");
3375	pHlp->pfnPrintf(pHlp, " IRTPS = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_IRTPS));
3376	pHlp->pfnPrintf(pHlp, " IRES = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_IRES));
3377	pHlp->pfnPrintf(pHlp, " QIES = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_QIES));
3378	pHlp->pfnPrintf(pHlp, " WBFS = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_WBFS));
3379	pHlp->pfnPrintf(pHlp, " AFLS = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_AFLS));
3380	pHlp->pfnPrintf(pHlp, " FLS = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_FLS));
3381	pHlp->pfnPrintf(pHlp, " RTPS = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_RTPS));
3382	pHlp->pfnPrintf(pHlp, " TES = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_TES));
3383	}
3384	pHlp->pfnPrintf(pHlp, " RTADDR_REG = %#RX64\n", uRtaddrReg);
3385	{
3386	uint8_t const uTtm = RT_BF_GET(uRtaddrReg, VTD_BF_RTADDR_REG_TTM);
3387	pHlp->pfnPrintf(pHlp, " RTA = %#RX64\n", uRtaddrReg & VTD_BF_RTADDR_REG_RTA_MASK);
3388	pHlp->pfnPrintf(pHlp, " TTM = %u (%s)\n", uTtm, vtdRtaddrRegGetTtmDesc(uTtm));
3389	}
3390	pHlp->pfnPrintf(pHlp, " CCMD_REG = %#RX64\n", uCcmdReg);
3391	pHlp->pfnPrintf(pHlp, " FSTS_REG = %#RX32\n", uFstsReg);
3392	{
3393	pHlp->pfnPrintf(pHlp, " PFO = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_PFO));
3394	pHlp->pfnPrintf(pHlp, " PPF = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_PPF));
3395	pHlp->pfnPrintf(pHlp, " AFO = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_AFO));
3396	pHlp->pfnPrintf(pHlp, " APF = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_APF));
3397	pHlp->pfnPrintf(pHlp, " IQE = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_IQE));
3398	pHlp->pfnPrintf(pHlp, " ICS = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_ICE));
3399	pHlp->pfnPrintf(pHlp, " ITE = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_ITE));
3400	pHlp->pfnPrintf(pHlp, " FRI = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_FRI));
3401	}
3402	pHlp->pfnPrintf(pHlp, " FECTL_REG = %#RX32\n", uFectlReg);
3403	{
3404	pHlp->pfnPrintf(pHlp, " IM = %RTbool\n", RT_BF_GET(uFectlReg, VTD_BF_FECTL_REG_IM));
3405	pHlp->pfnPrintf(pHlp, " IP = %RTbool\n", RT_BF_GET(uFectlReg, VTD_BF_FECTL_REG_IP));
3406	}
3407	pHlp->pfnPrintf(pHlp, " FEDATA_REG = %#RX32\n", uFedataReg);
3408	pHlp->pfnPrintf(pHlp, " FEADDR_REG = %#RX32\n", uFeaddrReg);
3409	pHlp->pfnPrintf(pHlp, " FEUADDR_REG = %#RX32\n", uFeuaddrReg);
3410	pHlp->pfnPrintf(pHlp, " AFLOG_REG = %#RX64\n", uAflogReg);
3411	pHlp->pfnPrintf(pHlp, " PMEN_REG = %#RX32\n", uPmenReg);
3412	pHlp->pfnPrintf(pHlp, " PLMBASE_REG = %#RX32\n", uPlmbaseReg);
3413	pHlp->pfnPrintf(pHlp, " PLMLIMIT_REG = %#RX32\n", uPlmlimitReg);
3414	pHlp->pfnPrintf(pHlp, " PHMBASE_REG = %#RX64\n", uPhmbaseReg);
3415	pHlp->pfnPrintf(pHlp, " PHMLIMIT_REG = %#RX64\n", uPhmlimitReg);
3416	pHlp->pfnPrintf(pHlp, " IQH_REG = %#RX64\n", uIqhReg);
3417	pHlp->pfnPrintf(pHlp, " IQT_REG = %#RX64\n", uIqtReg);
3418	pHlp->pfnPrintf(pHlp, " IQA_REG = %#RX64\n", uIqaReg);
3419	{
3420	uint8_t const fDw = RT_BF_GET(uIqaReg, VTD_BF_IQA_REG_DW);
3421	uint8_t const fQs = RT_BF_GET(uIqaReg, VTD_BF_IQA_REG_QS);
3422	uint8_t const cQueuePages = 1 << fQs;
3423	pHlp->pfnPrintf(pHlp, " DW = %u (%s)\n", fDw, fDw == VTD_IQA_REG_DW_128_BIT ? "128-bit" : "256-bit");
3424	pHlp->pfnPrintf(pHlp, " QS = %u (%u page%s)\n", fQs, cQueuePages, cQueuePages > 1 ? "s" : "");
3425	}
3426	pHlp->pfnPrintf(pHlp, " ICS_REG = %#RX32\n", uIcsReg);
3427	{
3428	pHlp->pfnPrintf(pHlp, " IWC = %u\n", RT_BF_GET(uIcsReg, VTD_BF_ICS_REG_IWC));
3429	}
3430	pHlp->pfnPrintf(pHlp, " IECTL_REG = %#RX32\n", uIectlReg);
3431	{
3432	pHlp->pfnPrintf(pHlp, " IM = %RTbool\n", RT_BF_GET(uIectlReg, VTD_BF_IECTL_REG_IM));
3433	pHlp->pfnPrintf(pHlp, " IP = %RTbool\n", RT_BF_GET(uIectlReg, VTD_BF_IECTL_REG_IP));
3434	}
3435	pHlp->pfnPrintf(pHlp, " IEDATA_REG = %#RX32\n", uIedataReg);
3436	pHlp->pfnPrintf(pHlp, " IEADDR_REG = %#RX32\n", uIeaddrReg);
3437	pHlp->pfnPrintf(pHlp, " IEUADDR_REG = %#RX32\n", uIeuaddrReg);
3438	pHlp->pfnPrintf(pHlp, " IQERCD_REG = %#RX64\n", uIqercdReg);
3439	{
3440	pHlp->pfnPrintf(pHlp, " ICESID = %#RX32\n", RT_BF_GET(uIqercdReg, VTD_BF_IQERCD_REG_ICESID));
3441	pHlp->pfnPrintf(pHlp, " ITESID = %#RX32\n", RT_BF_GET(uIqercdReg, VTD_BF_IQERCD_REG_ITESID));
3442	pHlp->pfnPrintf(pHlp, " IQEI = %#RX32\n", RT_BF_GET(uIqercdReg, VTD_BF_IQERCD_REG_IQEI));
3443	}
3444	pHlp->pfnPrintf(pHlp, " IRTA_REG = %#RX64\n", uIrtaReg);
3445	{
3446	uint32_t const cIrtEntries = VTD_IRTA_REG_GET_ENTRY_COUNT(uIrtaReg);
3447	uint32_t const cbIrt = sizeof(VTD_IRTE_T) * cIrtEntries;
3448	pHlp->pfnPrintf(pHlp, " IRTA = %#RX64\n", uIrtaReg & VTD_BF_IRTA_REG_IRTA_MASK);
3449	pHlp->pfnPrintf(pHlp, " EIME = %RTbool\n", RT_BF_GET(uIrtaReg, VTD_BF_IRTA_REG_EIME));
3450	pHlp->pfnPrintf(pHlp, " S = %u entries (%u bytes)\n", cIrtEntries, cbIrt);
3451	}
3452	pHlp->pfnPrintf(pHlp, " PQH_REG = %#RX64\n", uPqhReg);
3453	pHlp->pfnPrintf(pHlp, " PQT_REG = %#RX64\n", uPqtReg);
3454	pHlp->pfnPrintf(pHlp, " PQA_REG = %#RX64\n", uPqaReg);
3455	pHlp->pfnPrintf(pHlp, " PRS_REG = %#RX32\n", uPrsReg);
3456	pHlp->pfnPrintf(pHlp, " PECTL_REG = %#RX32\n", uPectlReg);
3457	pHlp->pfnPrintf(pHlp, " PEDATA_REG = %#RX32\n", uPedataReg);
3458	pHlp->pfnPrintf(pHlp, " PEADDR_REG = %#RX32\n", uPeaddrReg);
3459	pHlp->pfnPrintf(pHlp, " PEUADDR_REG = %#RX32\n", uPeuaddrReg);
3460	pHlp->pfnPrintf(pHlp, " MTRRCAP_REG = %#RX64\n", uMtrrcapReg);
3461	pHlp->pfnPrintf(pHlp, " MTRRDEF_REG = %#RX64\n", uMtrrdefReg);
3462	pHlp->pfnPrintf(pHlp, "\n");
3463	}
3464
3465
3466	/**
3467	* Initializes all registers in the DMAR unit.
3468	*
3469	* @param pDevIns The IOMMU device instance.
3470	*/
3471	static void dmarR3RegsInit(PPDMDEVINS pDevIns)
3472	{
3473	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3474
3475	/*
3476	* Wipe all registers (required on reset).
3477	*/
3478	RT_ZERO(pThis->abRegs0);
3479	RT_ZERO(pThis->abRegs1);
3480
3481	/*
3482	* Initialize registers not mutable by software prior to initializing other registers.
3483	*/
3484	/* VER_REG */
3485	{
3486	pThis->uVerReg = RT_BF_MAKE(VTD_BF_VER_REG_MIN, DMAR_VER_MINOR)
3487	\| RT_BF_MAKE(VTD_BF_VER_REG_MAX, DMAR_VER_MAJOR);
3488	dmarRegWriteRaw64(pThis, VTD_MMIO_OFF_VER_REG, pThis->uVerReg);
3489	}
3490
3491	uint8_t const fFlts = 1; /* First-level translation support. */
3492	uint8_t const fSlts = 1; /* Second-level translation support. */
3493	uint8_t const fPt = 1; /* Pass-Through support. */
3494	uint8_t const fSmts = fFlts & fSlts & fPt; /* Scalable mode translation support.*/
3495	uint8_t const fNest = 0; /* Nested translation support. */
3496
3497	/* CAP_REG */
3498	{
3499	uint8_t cGstPhysAddrBits;
3500	uint8_t cGstLinearAddrBits;
3501	PDMDevHlpCpuGetGuestAddrWidths(pDevIns, &cGstPhysAddrBits, &cGstLinearAddrBits);
3502
3503	uint8_t const fFl1gp = 1; /* First-level 1GB pages support. */
3504	uint8_t const fFl5lp = 1; /* First-level 5-level paging support (PML5E). */
3505	uint8_t const fSl2mp = 1; /* Second-level 2MB pages support. */
3506	uint8_t const fSl2gp = fSl2mp & 1; /* Second-level 1GB pages support. */
3507	uint8_t const fSllps = fSl2mp \| (fSl2gp << 1); /* Second-level large page support. */
3508	uint8_t const fMamv = (fSl2gp ? X86_PAGE_1G_SHIFT /* Maximum address mask value (for 2nd-level invalidations). */
3509	: X86_PAGE_2M_SHIFT)
3510	- X86_PAGE_4K_SHIFT;
3511	uint8_t const fNd = DMAR_ND; /* Number of domains supported. */
3512	uint8_t const fPsi = 1; /* Page selective invalidation. */
3513	uint8_t const uMgaw = cGstPhysAddrBits - 1; /* Maximum guest address width. */
3514	uint8_t const fSagaw = vtdCapRegGetSagaw(uMgaw); /* Supported adjust guest address width. */
3515	uint16_t const offFro = DMAR_MMIO_OFF_FRCD_LO_REG >> 4; /* MMIO offset of FRCD registers. */
3516	uint8_t const fEsrtps = 1; /* Enhanced SRTPS (auto invalidate cache on SRTP). */
3517	uint8_t const fEsirtps = 1; /* Enhanced SIRTPS (auto invalidate cache on SIRTP). */
3518	AssertCompile(DMAR_ND <= 6);
3519
3520	pThis->fCapReg = RT_BF_MAKE(VTD_BF_CAP_REG_ND, fNd)
3521	\| RT_BF_MAKE(VTD_BF_CAP_REG_AFL, 0) /* Advanced fault logging not supported. */
3522	\| RT_BF_MAKE(VTD_BF_CAP_REG_RWBF, 0) /* Software need not flush write-buffers. */
3523	\| RT_BF_MAKE(VTD_BF_CAP_REG_PLMR, 0) /* Protected Low-Memory Region not supported. */
3524	\| RT_BF_MAKE(VTD_BF_CAP_REG_PHMR, 0) /* Protected High-Memory Region not supported. */
3525	\| RT_BF_MAKE(VTD_BF_CAP_REG_CM, 1) /* Software should invalidate on mapping structure changes. */
3526	\| RT_BF_MAKE(VTD_BF_CAP_REG_SAGAW, fSlts & fSagaw)
3527	\| RT_BF_MAKE(VTD_BF_CAP_REG_MGAW, uMgaw)
3528	\| RT_BF_MAKE(VTD_BF_CAP_REG_ZLR, 1) /** @todo Figure out if/how to support zero-length reads. */
3529	\| RT_BF_MAKE(VTD_BF_CAP_REG_FRO, offFro)
3530	\| RT_BF_MAKE(VTD_BF_CAP_REG_SLLPS, fSlts & fSllps)
3531	\| RT_BF_MAKE(VTD_BF_CAP_REG_PSI, fPsi)
3532	\| RT_BF_MAKE(VTD_BF_CAP_REG_NFR, DMAR_FRCD_REG_COUNT - 1)
3533	\| RT_BF_MAKE(VTD_BF_CAP_REG_MAMV, fPsi & fMamv)
3534	\| RT_BF_MAKE(VTD_BF_CAP_REG_DWD, 1)
3535	\| RT_BF_MAKE(VTD_BF_CAP_REG_DRD, 1)
3536	\| RT_BF_MAKE(VTD_BF_CAP_REG_FL1GP, fFlts & fFl1gp)
3537	\| RT_BF_MAKE(VTD_BF_CAP_REG_PI, 0) /* Posted Interrupts not supported. */
3538	\| RT_BF_MAKE(VTD_BF_CAP_REG_FL5LP, fFlts & fFl5lp)
3539	\| RT_BF_MAKE(VTD_BF_CAP_REG_ESIRTPS, fEsirtps)
3540	\| RT_BF_MAKE(VTD_BF_CAP_REG_ESRTPS, fEsrtps);
3541	dmarRegWriteRaw64(pThis, VTD_MMIO_OFF_CAP_REG, pThis->fCapReg);
3542
3543	pThis->fHawBaseMask = ~(UINT64_MAX << cGstPhysAddrBits) & X86_PAGE_4K_BASE_MASK;
3544	pThis->fInvMgawMask = UINT64_MAX << cGstPhysAddrBits;
3545	pThis->cMaxPagingLevel = vtdCapRegGetMaxPagingLevel(fSagaw);
3546	}
3547
3548	/* ECAP_REG */
3549	{
3550	uint8_t const fQi = 1; /* Queued-invalidations. */
3551	uint8_t const fIr = !!(DMAR_ACPI_DMAR_FLAGS & ACPI_DMAR_F_INTR_REMAP); /* Interrupt remapping support. */
3552	uint8_t const fMhmv = 0xf; /* Maximum handle mask value. */
3553	uint16_t const offIro = DMAR_MMIO_OFF_IVA_REG >> 4; /* MMIO offset of IOTLB registers. */
3554	uint8_t const fEim = 1; /* Extended interrupt mode.*/
3555	uint8_t const fAdms = 1; /* Abort DMA mode support. */
3556	uint8_t const fErs = 0; /* Execute Request (not supported). */
3557
3558	pThis->fExtCapReg = RT_BF_MAKE(VTD_BF_ECAP_REG_C, 0) /* Accesses don't snoop CPU cache. */
3559	\| RT_BF_MAKE(VTD_BF_ECAP_REG_QI, fQi)
3560	\| RT_BF_MAKE(VTD_BF_ECAP_REG_DT, 0) /* Device-TLBs not supported. */
3561	\| RT_BF_MAKE(VTD_BF_ECAP_REG_IR, fQi & fIr)
3562	\| RT_BF_MAKE(VTD_BF_ECAP_REG_EIM, fIr & fEim)
3563	\| RT_BF_MAKE(VTD_BF_ECAP_REG_PT, fPt)
3564	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SC, 0) /* Snoop control not supported. */
3565	\| RT_BF_MAKE(VTD_BF_ECAP_REG_IRO, offIro)
3566	\| RT_BF_MAKE(VTD_BF_ECAP_REG_MHMV, fIr & fMhmv)
3567	\| RT_BF_MAKE(VTD_BF_ECAP_REG_MTS, 0) /* Memory type not supported. */
3568	\| RT_BF_MAKE(VTD_BF_ECAP_REG_NEST, fNest)
3569	\| RT_BF_MAKE(VTD_BF_ECAP_REG_PRS, 0) /* 0 as DT not supported. */
3570	\| RT_BF_MAKE(VTD_BF_ECAP_REG_ERS, fErs)
3571	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SRS, 0) /* Supervisor request not supported. */
3572	\| RT_BF_MAKE(VTD_BF_ECAP_REG_NWFS, 0) /* 0 as DT not supported. */
3573	\| RT_BF_MAKE(VTD_BF_ECAP_REG_EAFS, 0) /** @todo figure out if EAFS is required? */
3574	\| RT_BF_MAKE(VTD_BF_ECAP_REG_PSS, 0) /* 0 as PASID not supported. */
3575	\| RT_BF_MAKE(VTD_BF_ECAP_REG_PASID, 0) /* PASID support. */
3576	\| RT_BF_MAKE(VTD_BF_ECAP_REG_DIT, 0) /* 0 as DT not supported. */
3577	\| RT_BF_MAKE(VTD_BF_ECAP_REG_PDS, 0) /* 0 as DT not supported. */
3578	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SMTS, fSmts)
3579	\| RT_BF_MAKE(VTD_BF_ECAP_REG_VCS, 0) /* 0 as PASID not supported (commands seem PASID specific). */
3580	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SLADS, 0) /* Second-level accessed/dirty not supported. */
3581	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SLTS, fSlts)
3582	\| RT_BF_MAKE(VTD_BF_ECAP_REG_FLTS, fFlts)
3583	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SMPWCS, 0) /* 0 as PASID not supported. */
3584	\| RT_BF_MAKE(VTD_BF_ECAP_REG_RPS, 0) /* We don't support RID_PASID field in SM context entry. */
3585	\| RT_BF_MAKE(VTD_BF_ECAP_REG_ADMS, fAdms)
3586	\| RT_BF_MAKE(VTD_BF_ECAP_REG_RPRIVS, 0); /* 0 as SRS not supported. */
3587	dmarRegWriteRaw64(pThis, VTD_MMIO_OFF_ECAP_REG, pThis->fExtCapReg);
3588
3589	pThis->fPermValidMask = DMAR_PERM_READ \| DMAR_PERM_WRITE;
3590	if (fErs)
3591	pThis->fPermValidMask = DMAR_PERM_EXE;
3592	}
3593
3594	/*
3595	* Initialize registers mutable by software.
3596	*/
3597	/* FECTL_REG */
3598	{
3599	uint32_t const uCtl = RT_BF_MAKE(VTD_BF_FECTL_REG_IM, 1);
3600	dmarRegWriteRaw32(pThis, VTD_MMIO_OFF_FECTL_REG, uCtl);
3601	}
3602
3603	/* ICETL_REG */
3604	{
3605	uint32_t const uCtl = RT_BF_MAKE(VTD_BF_IECTL_REG_IM, 1);
3606	dmarRegWriteRaw32(pThis, VTD_MMIO_OFF_IECTL_REG, uCtl);
3607	}
3608
3609	#ifdef VBOX_STRICT
3610	Assert(!RT_BF_GET(pThis->fExtCapReg, VTD_BF_ECAP_REG_PRS)); /* PECTL_REG - Reserved if don't support PRS. */
3611	Assert(!RT_BF_GET(pThis->fExtCapReg, VTD_BF_ECAP_REG_MTS)); /* MTRRCAP_REG - Reserved if we don't support MTS. */
3612	#endif
3613	}
3614
3615
3616	/**
3617	* @interface_method_impl{PDMDEVREG,pfnReset}
3618	*/
3619	static DECLCALLBACK(void) iommuIntelR3Reset(PPDMDEVINS pDevIns)
3620	{
3621	PCDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARR3);
3622	LogFlowFunc(("\n"));
3623
3624	DMAR_LOCK(pDevIns, pThisR3);
3625	dmarR3RegsInit(pDevIns);
3626	DMAR_UNLOCK(pDevIns, pThisR3);
3627	}
3628
3629
3630	/**
3631	* @interface_method_impl{PDMDEVREG,pfnDestruct}
3632	*/
3633	static DECLCALLBACK(int) iommuIntelR3Destruct(PPDMDEVINS pDevIns)
3634	{
3635	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3636	PCDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARR3);
3637	LogFlowFunc(("\n"));
3638
3639	DMAR_LOCK(pDevIns, pThisR3);
3640
3641	if (pThis->hEvtInvQueue != NIL_SUPSEMEVENT)
3642	{
3643	PDMDevHlpSUPSemEventClose(pDevIns, pThis->hEvtInvQueue);
3644	pThis->hEvtInvQueue = NIL_SUPSEMEVENT;
3645	}
3646
3647	DMAR_UNLOCK(pDevIns, pThisR3);
3648	return VINF_SUCCESS;
3649	}
3650
3651
3652	/**
3653	* @interface_method_impl{PDMDEVREG,pfnConstruct}
3654	*/
3655	static DECLCALLBACK(int) iommuIntelR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
3656	{
3657	RT_NOREF(pCfg);
3658
3659	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3660	PDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PDMARR3);
3661	pThisR3->pDevInsR3 = pDevIns;
3662
3663	LogFlowFunc(("iInstance=%d\n", iInstance));
3664	NOREF(iInstance);
3665
3666	/*
3667	* Register the IOMMU with PDM.
3668	*/
3669	PDMIOMMUREGR3 IommuReg;
3670	RT_ZERO(IommuReg);
3671	IommuReg.u32Version = PDM_IOMMUREGCC_VERSION;
3672	IommuReg.pfnMemAccess = iommuIntelMemAccess;
3673	IommuReg.pfnMemBulkAccess = iommuIntelMemBulkAccess;
3674	IommuReg.pfnMsiRemap = iommuIntelMsiRemap;
3675	IommuReg.u32TheEnd = PDM_IOMMUREGCC_VERSION;
3676	int rc = PDMDevHlpIommuRegister(pDevIns, &IommuReg, &pThisR3->CTX_SUFF(pIommuHlp), &pThis->idxIommu);
3677	if (RT_FAILURE(rc))
3678	return PDMDEV_SET_ERROR(pDevIns, rc, N_("Failed to register ourselves as an IOMMU device"));
3679	if (pThisR3->CTX_SUFF(pIommuHlp)->u32Version != PDM_IOMMUHLPR3_VERSION)
3680	return PDMDevHlpVMSetError(pDevIns, VERR_VERSION_MISMATCH, RT_SRC_POS,
3681	N_("IOMMU helper version mismatch; got %#x expected %#x"),
3682	pThisR3->CTX_SUFF(pIommuHlp)->u32Version, PDM_IOMMUHLPR3_VERSION);
3683	if (pThisR3->CTX_SUFF(pIommuHlp)->u32TheEnd != PDM_IOMMUHLPR3_VERSION)
3684	return PDMDevHlpVMSetError(pDevIns, VERR_VERSION_MISMATCH, RT_SRC_POS,
3685	N_("IOMMU helper end-version mismatch; got %#x expected %#x"),
3686	pThisR3->CTX_SUFF(pIommuHlp)->u32TheEnd, PDM_IOMMUHLPR3_VERSION);
3687	AssertPtr(pThisR3->pIommuHlpR3->pfnLock);
3688	AssertPtr(pThisR3->pIommuHlpR3->pfnUnlock);
3689	AssertPtr(pThisR3->pIommuHlpR3->pfnLockIsOwner);
3690	AssertPtr(pThisR3->pIommuHlpR3->pfnSendMsi);
3691
3692	/*
3693	* Use PDM's critical section (via helpers) for the IOMMU device.
3694	*/
3695	rc = PDMDevHlpSetDeviceCritSect(pDevIns, PDMDevHlpCritSectGetNop(pDevIns));
3696	AssertRCReturn(rc, rc);
3697
3698	/*
3699	* Initialize PCI configuration registers.
3700	*/
3701	PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
3702	PDMPCIDEV_ASSERT_VALID(pDevIns, pPciDev);
3703
3704	/* Header. */
3705	PDMPciDevSetVendorId(pPciDev, DMAR_PCI_VENDOR_ID); /* Intel */
3706	PDMPciDevSetDeviceId(pPciDev, DMAR_PCI_DEVICE_ID); /* VirtualBox DMAR device */
3707	PDMPciDevSetRevisionId(pPciDev, DMAR_PCI_REVISION_ID); /* VirtualBox specific device implementation revision */
3708	PDMPciDevSetClassBase(pPciDev, VBOX_PCI_CLASS_SYSTEM); /* System Base Peripheral */
3709	PDMPciDevSetClassSub(pPciDev, VBOX_PCI_SUB_SYSTEM_OTHER); /* Other */
3710	PDMPciDevSetHeaderType(pPciDev, 0); /* Single function, type 0 */
3711	PDMPciDevSetSubSystemId(pPciDev, DMAR_PCI_DEVICE_ID); /* VirtualBox DMAR device */
3712	PDMPciDevSetSubSystemVendorId(pPciDev, DMAR_PCI_VENDOR_ID); /* Intel */
3713
3714	/** @todo Chipset spec says PCI Express Capability Id. Relevant for us? */
3715	PDMPciDevSetStatus(pPciDev, 0);
3716	PDMPciDevSetCapabilityList(pPciDev, 0);
3717
3718	/** @todo VTBAR at 0x180? */
3719
3720	/*
3721	* Register the PCI function with PDM.
3722	*/
3723	rc = PDMDevHlpPCIRegister(pDevIns, pPciDev);
3724	AssertLogRelRCReturn(rc, rc);
3725
3726	/** @todo Register MSI but what's the MSI capability offset? */
3727	#if 0
3728	/*
3729	* Register MSI support for the PCI device.
3730	* This must be done -after- registering it as a PCI device!
3731	*/
3732	#endif
3733
3734	/*
3735	* Register MMIO region.
3736	*/
3737	AssertCompile(!(DMAR_MMIO_BASE_PHYSADDR & X86_PAGE_4K_OFFSET_MASK));
3738	rc = PDMDevHlpMmioCreateAndMap(pDevIns, DMAR_MMIO_BASE_PHYSADDR, DMAR_MMIO_SIZE, dmarMmioWrite, dmarMmioRead,
3739	IOMMMIO_FLAGS_READ_DWORD_QWORD \| IOMMMIO_FLAGS_WRITE_DWORD_QWORD_ZEROED, "Intel-IOMMU",
3740	&pThis->hMmio);
3741	AssertLogRelRCReturn(rc, rc);
3742
3743	/*
3744	* Register debugger info items.
3745	*/
3746	rc = PDMDevHlpDBGFInfoRegister(pDevIns, "iommu", "Display IOMMU state.", dmarR3DbgInfo);
3747	AssertLogRelRCReturn(rc, rc);
3748
3749	#ifdef VBOX_WITH_STATISTICS
3750	/*
3751	* Statistics.
3752	*/
3753	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMmioReadR3, STAMTYPE_COUNTER, "R3/MmioRead", STAMUNIT_OCCURENCES, "Number of MMIO reads in R3");
3754	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMmioReadRZ, STAMTYPE_COUNTER, "RZ/MmioRead", STAMUNIT_OCCURENCES, "Number of MMIO reads in RZ.");
3755
3756	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMmioWriteR3, STAMTYPE_COUNTER, "R3/MmioWrite", STAMUNIT_OCCURENCES, "Number of MMIO writes in R3.");
3757	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMmioWriteRZ, STAMTYPE_COUNTER, "RZ/MmioWrite", STAMUNIT_OCCURENCES, "Number of MMIO writes in RZ.");
3758
3759	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMsiRemapCfiR3, STAMTYPE_COUNTER, "R3/MsiRemapCfi", STAMUNIT_OCCURENCES, "Number of compatibility-format interrupt remap requests in R3.");
3760	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMsiRemapCfiRZ, STAMTYPE_COUNTER, "RZ/MsiRemapCfi", STAMUNIT_OCCURENCES, "Number of compatibility-format interrupt remap requests in RZ.");
3761	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMsiRemapRfiR3, STAMTYPE_COUNTER, "R3/MsiRemapRfi", STAMUNIT_OCCURENCES, "Number of remappable-format interrupt remap requests in R3.");
3762	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMsiRemapRfiRZ, STAMTYPE_COUNTER, "RZ/MsiRemapRfi", STAMUNIT_OCCURENCES, "Number of remappable-format interrupt remap requests in RZ.");
3763
3764	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemReadR3, STAMTYPE_COUNTER, "R3/MemRead", STAMUNIT_OCCURENCES, "Number of memory read translation requests in R3.");
3765	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemReadRZ, STAMTYPE_COUNTER, "RZ/MemRead", STAMUNIT_OCCURENCES, "Number of memory read translation requests in RZ.");
3766
3767	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemWriteR3, STAMTYPE_COUNTER, "R3/MemWrite", STAMUNIT_OCCURENCES, "Number of memory write translation requests in R3.");
3768	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemWriteRZ, STAMTYPE_COUNTER, "RZ/MemWrite", STAMUNIT_OCCURENCES, "Number of memory write translation requests in RZ.");
3769
3770	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemBulkReadR3, STAMTYPE_COUNTER, "R3/MemBulkRead", STAMUNIT_OCCURENCES, "Number of memory bulk read translation requests in R3.");
3771	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemBulkReadRZ, STAMTYPE_COUNTER, "RZ/MemBulkRead", STAMUNIT_OCCURENCES, "Number of memory bulk read translation requests in RZ.");
3772
3773	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemBulkWriteR3, STAMTYPE_COUNTER, "R3/MemBulkWrite", STAMUNIT_OCCURENCES, "Number of memory bulk write translation requests in R3.");
3774	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemBulkWriteRZ, STAMTYPE_COUNTER, "RZ/MemBulkWrite", STAMUNIT_OCCURENCES, "Number of memory bulk write translation requests in RZ.");
3775
3776	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatCcInvDsc, STAMTYPE_COUNTER, "R3/QI/CcInv", STAMUNIT_OCCURENCES, "Number of cc_inv_dsc processed.");
3777	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatIotlbInvDsc, STAMTYPE_COUNTER, "R3/QI/IotlbInv", STAMUNIT_OCCURENCES, "Number of iotlb_inv_dsc processed.");
3778	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatDevtlbInvDsc, STAMTYPE_COUNTER, "R3/QI/DevtlbInv", STAMUNIT_OCCURENCES, "Number of dev_tlb_inv_dsc processed.");
3779	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatIecInvDsc, STAMTYPE_COUNTER, "R3/QI/IecInv", STAMUNIT_OCCURENCES, "Number of iec_inv processed.");
3780	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatInvWaitDsc, STAMTYPE_COUNTER, "R3/QI/InvWait", STAMUNIT_OCCURENCES, "Number of inv_wait_dsc processed.");
3781	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatPasidIotlbInvDsc, STAMTYPE_COUNTER, "R3/QI/PasidIotlbInv", STAMUNIT_OCCURENCES, "Number of p_iotlb_inv_dsc processed.");
3782	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatPasidCacheInvDsc, STAMTYPE_COUNTER, "R3/QI/PasidCacheInv", STAMUNIT_OCCURENCES, "Number of pc_inv_dsc pprocessed.");
3783	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatPasidDevtlbInvDsc, STAMTYPE_COUNTER, "R3/QI/PasidDevtlbInv", STAMUNIT_OCCURENCES, "Number of p_dev_tlb_inv_dsc processed.");
3784	#endif
3785
3786	/*
3787	* Initialize registers.
3788	*/
3789	dmarR3RegsInit(pDevIns);
3790
3791	/*
3792	* Create invalidation-queue thread and semaphore.
3793	*/
3794	char szInvQueueThread[32];
3795	RT_ZERO(szInvQueueThread);
3796	RTStrPrintf(szInvQueueThread, sizeof(szInvQueueThread), "IOMMU-QI-%u", iInstance);
3797	rc = PDMDevHlpThreadCreate(pDevIns, &pThisR3->pInvQueueThread, pThis, dmarR3InvQueueThread, dmarR3InvQueueThreadWakeUp,
3798	0 /* cbStack */, RTTHREADTYPE_IO, szInvQueueThread);
3799	AssertLogRelRCReturn(rc, rc);
3800
3801	rc = PDMDevHlpSUPSemEventCreate(pDevIns, &pThis->hEvtInvQueue);
3802	AssertLogRelRCReturn(rc, rc);
3803
3804	/*
3805	* Log some of the features exposed to software.
3806	*/
3807	uint32_t const uVerReg = pThis->uVerReg;
3808	uint8_t const cMgawBits = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_MGAW) + 1;
3809	uint8_t const fSagaw = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_SAGAW);
3810	uint16_t const offFrcd = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_FRO);
3811	uint16_t const offIva = RT_BF_GET(pThis->fExtCapReg, VTD_BF_ECAP_REG_IRO);
3812	LogRel(("%s: VER=%u.%u CAP=%#RX64 ECAP=%#RX64 (MGAW=%u bits, SAGAW=%#x HAW_Base=%#RX64 MGAW_Inv=%#RX64 FRO=%#x IRO=%#x) mapped at %#RGp\n",
3813	DMAR_LOG_PFX, RT_BF_GET(uVerReg, VTD_BF_VER_REG_MAX), RT_BF_GET(uVerReg, VTD_BF_VER_REG_MIN),
3814	pThis->fCapReg, pThis->fExtCapReg, cMgawBits, fSagaw, pThis->fHawBaseMask, pThis->fInvMgawMask, offFrcd, offIva,
3815	DMAR_MMIO_BASE_PHYSADDR));
3816
3817	return VINF_SUCCESS;
3818	}
3819
3820	#else
3821
3822	/**
3823	* @callback_method_impl{PDMDEVREGR0,pfnConstruct}
3824	*/
3825	static DECLCALLBACK(int) iommuIntelRZConstruct(PPDMDEVINS pDevIns)
3826	{
3827	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
3828	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3829	PDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PDMARCC);
3830	pThisCC->CTX_SUFF(pDevIns) = pDevIns;
3831
3832	/* We will use PDM's critical section (via helpers) for the IOMMU device. */
3833	int rc = PDMDevHlpSetDeviceCritSect(pDevIns, PDMDevHlpCritSectGetNop(pDevIns));
3834	AssertRCReturn(rc, rc);
3835
3836	/* Set up the MMIO RZ handlers. */
3837	rc = PDMDevHlpMmioSetUpContext(pDevIns, pThis->hMmio, dmarMmioWrite, dmarMmioRead, NULL /* pvUser */);
3838	AssertRCReturn(rc, rc);
3839
3840	/* Set up the IOMMU RZ callbacks. */
3841	PDMIOMMUREGCC IommuReg;
3842	RT_ZERO(IommuReg);
3843	IommuReg.u32Version = PDM_IOMMUREGCC_VERSION;
3844	IommuReg.idxIommu = pThis->idxIommu;
3845	IommuReg.pfnMemAccess = iommuIntelMemAccess;
3846	IommuReg.pfnMemBulkAccess = iommuIntelMemBulkAccess;
3847	IommuReg.pfnMsiRemap = iommuIntelMsiRemap;
3848	IommuReg.u32TheEnd = PDM_IOMMUREGCC_VERSION;
3849
3850	rc = PDMDevHlpIommuSetUpContext(pDevIns, &IommuReg, &pThisCC->CTX_SUFF(pIommuHlp));
3851	AssertRCReturn(rc, rc);
3852	AssertPtrReturn(pThisCC->CTX_SUFF(pIommuHlp), VERR_IOMMU_IPE_1);
3853	AssertReturn(pThisCC->CTX_SUFF(pIommuHlp)->u32Version == CTX_MID(PDM_IOMMUHLP,_VERSION), VERR_VERSION_MISMATCH);
3854	AssertReturn(pThisCC->CTX_SUFF(pIommuHlp)->u32TheEnd == CTX_MID(PDM_IOMMUHLP,_VERSION), VERR_VERSION_MISMATCH);
3855	AssertPtr(pThisCC->CTX_SUFF(pIommuHlp)->pfnLock);
3856	AssertPtr(pThisCC->CTX_SUFF(pIommuHlp)->pfnUnlock);
3857	AssertPtr(pThisCC->CTX_SUFF(pIommuHlp)->pfnLockIsOwner);
3858	AssertPtr(pThisCC->CTX_SUFF(pIommuHlp)->pfnSendMsi);
3859
3860	return VINF_SUCCESS;
3861	}
3862
3863	#endif
3864
3865
3866	/**
3867	* The device registration structure.
3868	*/
3869	PDMDEVREG const g_DeviceIommuIntel =
3870	{
3871	/* .u32Version = */ PDM_DEVREG_VERSION,
3872	/* .uReserved0 = */ 0,
3873	/* .szName = */ "iommu-intel",
3874	/* .fFlags = */ PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RZ \| PDM_DEVREG_FLAGS_NEW_STYLE,
3875	/* .fClass = */ PDM_DEVREG_CLASS_PCI_BUILTIN,
3876	/* .cMaxInstances = */ 1,
3877	/* .uSharedVersion = */ 42,
3878	/* .cbInstanceShared = */ sizeof(DMAR),
3879	/* .cbInstanceCC = */ sizeof(DMARCC),
3880	/* .cbInstanceRC = */ sizeof(DMARRC),
3881	/* .cMaxPciDevices = */ 1,
3882	/* .cMaxMsixVectors = */ 0,
3883	/* .pszDescription = */ "IOMMU (Intel)",
3884	#if defined(IN_RING3)
3885	/* .pszRCMod = */ "VBoxDDRC.rc",
3886	/* .pszR0Mod = */ "VBoxDDR0.r0",
3887	/* .pfnConstruct = */ iommuIntelR3Construct,
3888	/* .pfnDestruct = */ iommuIntelR3Destruct,
3889	/* .pfnRelocate = */ NULL,
3890	/* .pfnMemSetup = */ NULL,
3891	/* .pfnPowerOn = */ NULL,
3892	/* .pfnReset = */ iommuIntelR3Reset,
3893	/* .pfnSuspend = */ NULL,
3894	/* .pfnResume = */ NULL,
3895	/* .pfnAttach = */ NULL,
3896	/* .pfnDetach = */ NULL,
3897	/* .pfnQueryInterface = */ NULL,
3898	/* .pfnInitComplete = */ NULL,
3899	/* .pfnPowerOff = */ NULL,
3900	/* .pfnSoftReset = */ NULL,
3901	/* .pfnReserved0 = */ NULL,
3902	/* .pfnReserved1 = */ NULL,
3903	/* .pfnReserved2 = */ NULL,
3904	/* .pfnReserved3 = */ NULL,
3905	/* .pfnReserved4 = */ NULL,
3906	/* .pfnReserved5 = */ NULL,
3907	/* .pfnReserved6 = */ NULL,
3908	/* .pfnReserved7 = */ NULL,
3909	#elif defined(IN_RING0)
3910	/* .pfnEarlyConstruct = */ NULL,
3911	/* .pfnConstruct = */ iommuIntelRZConstruct,
3912	/* .pfnDestruct = */ NULL,
3913	/* .pfnFinalDestruct = */ NULL,
3914	/* .pfnRequest = */ NULL,
3915	/* .pfnReserved0 = */ NULL,
3916	/* .pfnReserved1 = */ NULL,
3917	/* .pfnReserved2 = */ NULL,
3918	/* .pfnReserved3 = */ NULL,
3919	/* .pfnReserved4 = */ NULL,
3920	/* .pfnReserved5 = */ NULL,
3921	/* .pfnReserved6 = */ NULL,
3922	/* .pfnReserved7 = */ NULL,
3923	#elif defined(IN_RC)
3924	/* .pfnConstruct = */ iommuIntelRZConstruct,
3925	/* .pfnReserved0 = */ NULL,
3926	/* .pfnReserved1 = */ NULL,
3927	/* .pfnReserved2 = */ NULL,
3928	/* .pfnReserved3 = */ NULL,
3929	/* .pfnReserved4 = */ NULL,
3930	/* .pfnReserved5 = */ NULL,
3931	/* .pfnReserved6 = */ NULL,
3932	/* .pfnReserved7 = */ NULL,
3933	#else
3934	# error "Not in IN_RING3, IN_RING0 or IN_RC!"
3935	#endif
3936	/* .u32VersionEnd = */ PDM_DEVREG_VERSION
3937	};
3938
3939	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */
3940

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Bus/DevIommuIntel.cpp@ 89454

Download in other formats: