DevIommuIntel.cpp@ 94993

Last change on this file since 94993 was 93115, checked in by vboxsync, 3 years ago
scm --update-copyright-year
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 198.6 KB

Line
1	/* $Id: DevIommuIntel.cpp 93115 2022-01-01 11:31:46Z vboxsync $ */
2	/** @file
3	* IOMMU - Input/Output Memory Management Unit - Intel implementation.
4	*/
5
6	/*
7	* Copyright (C) 2021-2022 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DEV_IOMMU
23	#include "VBoxDD.h"
24	#include "DevIommuIntel.h"
25
26	#include <VBox/iommu-intel.h>
27	#include <iprt/mem.h>
28	#include <iprt/string.h>
29
30
31	/*********************************************************************************************************************************
32	* Defined Constants And Macros *
33	*********************************************************************************************************************************/
34	/** Gets the low uint32_t of a uint64_t or something equivalent.
35	*
36	* This is suitable for casting constants outside code (since RT_LO_U32 can't be
37	* used as it asserts for correctness when compiling on certain compilers). */
38	#define DMAR_LO_U32(a) (uint32_t)(UINT32_MAX & (a))
39
40	/** Gets the high uint32_t of a uint64_t or something equivalent.
41	*
42	* This is suitable for casting constants outside code (since RT_HI_U32 can't be
43	* used as it asserts for correctness when compiling on certain compilers). */
44	#define DMAR_HI_U32(a) (uint32_t)((a) >> 32)
45
46	/** Asserts MMIO access' offset and size are valid or returns appropriate error
47	* code suitable for returning from MMIO access handlers. */
48	#define DMAR_ASSERT_MMIO_ACCESS_RET(a_off, a_cb) \
49	do { \
50	AssertReturn((a_cb) == 4 \|\| (a_cb) == 8, VINF_IOM_MMIO_UNUSED_FF); \
51	AssertReturn(!((a_off) & ((a_cb) - 1)), VINF_IOM_MMIO_UNUSED_FF); \
52	} while (0)
53
54	/** Checks if the MMIO offset is valid. */
55	#define DMAR_IS_MMIO_OFF_VALID(a_off) ( (a_off) < DMAR_MMIO_GROUP_0_OFF_END \
56	\|\| (a_off) - (uint16_t)DMAR_MMIO_GROUP_1_OFF_FIRST < (uint16_t)DMAR_MMIO_GROUP_1_SIZE)
57
58	/** Acquires the DMAR lock but returns with the given busy error code on failure. */
59	#define DMAR_LOCK_RET(a_pDevIns, a_pThisCC, a_rcBusy) \
60	do { \
61	int const rcLock = (a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnLock((a_pDevIns), (a_rcBusy)); \
62	if (RT_LIKELY(rcLock == VINF_SUCCESS)) \
63	{ /* likely */ } \
64	else \
65	return rcLock; \
66	} while (0)
67
68	/** Acquires the DMAR lock (can fail under extraordinary circumstance in ring-0). */
69	#define DMAR_LOCK(a_pDevIns, a_pThisCC) \
70	do { \
71	int const rcLock = (a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnLock((a_pDevIns), VINF_SUCCESS); \
72	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV((a_pDevIns), NULL, rcLock); \
73	} while (0)
74
75	/** Release the DMAR lock. */
76	#define DMAR_UNLOCK(a_pDevIns, a_pThisCC) (a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnUnlock(a_pDevIns)
77
78	/** Asserts that the calling thread owns the DMAR lock. */
79	#define DMAR_ASSERT_LOCK_IS_OWNER(a_pDevIns, a_pThisCC) \
80	do { \
81	Assert((a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnLockIsOwner(a_pDevIns)); \
82	RT_NOREF1(a_pThisCC); \
83	} while (0)
84
85	/** Asserts that the calling thread does not own the DMAR lock. */
86	#define DMAR_ASSERT_LOCK_IS_NOT_OWNER(a_pDevIns, a_pThisCC) \
87	do { \
88	Assert((a_pThisCC)->CTX_SUFF(pIommuHlp)->pfnLockIsOwner(a_pDevIns) == false); \
89	RT_NOREF1(a_pThisCC); \
90	} while (0)
91
92	/** The number of fault recording registers our implementation supports.
93	* Normal guest operation shouldn't trigger faults anyway, so we only support the
94	* minimum number of registers (which is 1).
95	*
96	* See Intel VT-d spec. 10.4.2 "Capability Register" (CAP_REG.NFR). */
97	#define DMAR_FRCD_REG_COUNT UINT32_C(1)
98
99	/** Number of register groups (used in saved states). */
100	#define DMAR_MMIO_GROUP_COUNT 2
101	/** Offset of first register in group 0. */
102	#define DMAR_MMIO_GROUP_0_OFF_FIRST VTD_MMIO_OFF_VER_REG
103	/** Offset of last register in group 0 (inclusive). */
104	#define DMAR_MMIO_GROUP_0_OFF_LAST VTD_MMIO_OFF_MTRR_PHYSMASK9_REG
105	/** Last valid offset in group 0 (exclusive). */
106	#define DMAR_MMIO_GROUP_0_OFF_END (DMAR_MMIO_GROUP_0_OFF_LAST + 8 /* sizeof MTRR_PHYSMASK9_REG */)
107	/** Size of the group 0 (in bytes). */
108	#define DMAR_MMIO_GROUP_0_SIZE (DMAR_MMIO_GROUP_0_OFF_END - DMAR_MMIO_GROUP_0_OFF_FIRST)
109	/** Number of implementation-defined MMIO register offsets - IVA_REG and
110	* FRCD_LO_REG (used in saved state). IOTLB_REG and FRCD_HI_REG are derived from
111	* IVA_REG and FRCD_LO_REG respectively */
112	#define DMAR_MMIO_OFF_IMPL_COUNT 2
113	/** Implementation-specific MMIO offset of IVA_REG (used in saved state). */
114	#define DMAR_MMIO_OFF_IVA_REG 0xe50
115	/** Implementation-specific MMIO offset of IOTLB_REG. */
116	#define DMAR_MMIO_OFF_IOTLB_REG 0xe58
117	/** Implementation-specific MMIO offset of FRCD_LO_REG (used in saved state). */
118	#define DMAR_MMIO_OFF_FRCD_LO_REG 0xe70
119	/** Implementation-specific MMIO offset of FRCD_HI_REG. */
120	#define DMAR_MMIO_OFF_FRCD_HI_REG 0xe78
121	AssertCompile(!(DMAR_MMIO_OFF_FRCD_LO_REG & 0xf));
122	AssertCompile(DMAR_MMIO_OFF_IOTLB_REG == DMAR_MMIO_OFF_IVA_REG + 8);
123	AssertCompile(DMAR_MMIO_OFF_FRCD_HI_REG == DMAR_MMIO_OFF_FRCD_LO_REG + 8);
124
125	/** Offset of first register in group 1. */
126	#define DMAR_MMIO_GROUP_1_OFF_FIRST VTD_MMIO_OFF_VCCAP_REG
127	/** Offset of last register in group 1 (inclusive). */
128	#define DMAR_MMIO_GROUP_1_OFF_LAST (DMAR_MMIO_OFF_FRCD_LO_REG + 8) * DMAR_FRCD_REG_COUNT
129	/** Last valid offset in group 1 (exclusive). */
130	#define DMAR_MMIO_GROUP_1_OFF_END (DMAR_MMIO_GROUP_1_OFF_LAST + 8 /* sizeof FRCD_HI_REG */)
131	/** Size of the group 1 (in bytes). */
132	#define DMAR_MMIO_GROUP_1_SIZE (DMAR_MMIO_GROUP_1_OFF_END - DMAR_MMIO_GROUP_1_OFF_FIRST)
133
134	/** DMAR implementation's major version number (exposed to software).
135	* We report 6 as the major version since we support queued-invalidations as
136	* software may make assumptions based on that.
137	*
138	* See Intel VT-d spec. 10.4.7 "Context Command Register" (CCMD_REG.CAIG). */
139	#define DMAR_VER_MAJOR 6
140	/** DMAR implementation's minor version number (exposed to software). */
141	#define DMAR_VER_MINOR 0
142
143	/** Number of domain supported (0=16, 1=64, 2=256, 3=1K, 4=4K, 5=16K, 6=64K,
144	* 7=Reserved). */
145	#define DMAR_ND 6
146
147	/** @name DMAR_PERM_XXX: DMA request permissions.
148	* The order of R, W, X bits is important as it corresponds to those bits in
149	* page-table entries.
150	*
151	* @{ */
152	/** DMA request permission: Read. */
153	#define DMAR_PERM_READ RT_BIT(0)
154	/** DMA request permission: Write. */
155	#define DMAR_PERM_WRITE RT_BIT(1)
156	/** DMA request permission: Execute (ER). */
157	#define DMAR_PERM_EXE RT_BIT(2)
158	/** DMA request permission: Supervisor privilege (PR). */
159	#define DMAR_PERM_PRIV RT_BIT(3)
160	/** DMA request permissions: All. */
161	#define DMAR_PERM_ALL (DMAR_PERM_READ \| DMAR_PERM_WRITE \| DMAR_PERM_EXE \| DMAR_PERM_PRIV)
162	/** @} */
163
164	/** Release log prefix string. */
165	#define DMAR_LOG_PFX "Intel-IOMMU"
166	/** The current saved state version. */
167	#define DMAR_SAVED_STATE_VERSION 1
168
169
170	/*********************************************************************************************************************************
171	* Structures and Typedefs *
172	*********************************************************************************************************************************/
173	/**
174	* DMAR error diagnostics.
175	* Sorted alphabetically so it's easier to add and locate items, no other reason.
176	*
177	* @note Members of this enum are used as array indices, so no gaps in enum
178	* values are not allowed. Update g_apszDmarDiagDesc when you modify
179	* fields in this enum.
180	*/
181	typedef enum
182	{
183	/* No error, this must be zero! */
184	kDmarDiag_None = 0,
185
186	/* Address Translation Faults. */
187	kDmarDiag_At_Lm_CtxEntry_Not_Present,
188	kDmarDiag_At_Lm_CtxEntry_Read_Failed,
189	kDmarDiag_At_Lm_CtxEntry_Rsvd,
190	kDmarDiag_At_Lm_Pt_At_Block,
191	kDmarDiag_At_Lm_Pt_Aw_Invalid,
192	kDmarDiag_At_Lm_RootEntry_Not_Present,
193	kDmarDiag_At_Lm_RootEntry_Read_Failed,
194	kDmarDiag_At_Lm_RootEntry_Rsvd,
195	kDmarDiag_At_Lm_Tt_Invalid,
196	kDmarDiag_At_Lm_Ut_At_Block,
197	kDmarDiag_At_Lm_Ut_Aw_Invalid,
198	kDmarDiag_At_Rta_Adms_Not_Supported,
199	kDmarDiag_At_Rta_Rsvd,
200	kDmarDiag_At_Rta_Smts_Not_Supported,
201	kDmarDiag_At_Xm_AddrIn_Invalid,
202	kDmarDiag_At_Xm_AddrOut_Invalid,
203	kDmarDiag_At_Xm_Perm_Read_Denied,
204	kDmarDiag_At_Xm_Perm_Write_Denied,
205	kDmarDiag_At_Xm_Pte_Not_Present,
206	kDmarDiag_At_Xm_Pte_Rsvd,
207	kDmarDiag_At_Xm_Pte_Sllps_Invalid,
208	kDmarDiag_At_Xm_Read_Pte_Failed,
209	kDmarDiag_At_Xm_Slpptr_Read_Failed,
210
211	/* CCMD_REG faults. */
212	kDmarDiag_CcmdReg_Not_Supported,
213	kDmarDiag_CcmdReg_Qi_Enabled,
214	kDmarDiag_CcmdReg_Ttm_Invalid,
215
216	/* IQA_REG faults. */
217	kDmarDiag_IqaReg_Dsc_Fetch_Error,
218	kDmarDiag_IqaReg_Dw_128_Invalid,
219	kDmarDiag_IqaReg_Dw_256_Invalid,
220
221	/* Invalidation Queue Error Info. */
222	kDmarDiag_Iqei_Dsc_Type_Invalid,
223	kDmarDiag_Iqei_Inv_Wait_Dsc_0_1_Rsvd,
224	kDmarDiag_Iqei_Inv_Wait_Dsc_2_3_Rsvd,
225	kDmarDiag_Iqei_Inv_Wait_Dsc_Invalid,
226	kDmarDiag_Iqei_Ttm_Rsvd,
227
228	/* IQT_REG faults. */
229	kDmarDiag_IqtReg_Qt_Invalid,
230	kDmarDiag_IqtReg_Qt_Not_Aligned,
231
232	/* Interrupt Remapping Faults. */
233	kDmarDiag_Ir_Cfi_Blocked,
234	kDmarDiag_Ir_Rfi_Intr_Index_Invalid,
235	kDmarDiag_Ir_Rfi_Irte_Mode_Invalid,
236	kDmarDiag_Ir_Rfi_Irte_Not_Present,
237	kDmarDiag_Ir_Rfi_Irte_Read_Failed,
238	kDmarDiag_Ir_Rfi_Irte_Rsvd,
239	kDmarDiag_Ir_Rfi_Irte_Svt_Bus,
240	kDmarDiag_Ir_Rfi_Irte_Svt_Masked,
241	kDmarDiag_Ir_Rfi_Irte_Svt_Rsvd,
242	kDmarDiag_Ir_Rfi_Rsvd,
243
244	/* Member for determining array index limit. */
245	kDmarDiag_End,
246
247	/* Usual 32-bit type size hack. */
248	kDmarDiag_32Bit_Hack = 0x7fffffff
249	} DMARDIAG;
250	AssertCompileSize(DMARDIAG, 4);
251
252	#ifdef IN_RING3
253	/** DMAR diagnostic enum description expansion.
254	* The below construct ensures typos in the input to this macro are caught
255	* during compile time. */
256	# define DMARDIAG_DESC(a_Name) RT_CONCAT(kDmarDiag_, a_Name) < kDmarDiag_End ? RT_STR(a_Name) : "Ignored"
257
258	/** DMAR diagnostics description for members in DMARDIAG. */
259	static const char *const g_apszDmarDiagDesc[] =
260	{
261	DMARDIAG_DESC(None ),
262
263	/* Address Translation Faults. */
264	DMARDIAG_DESC(At_Lm_CtxEntry_Not_Present ),
265	DMARDIAG_DESC(At_Lm_CtxEntry_Read_Failed ),
266	DMARDIAG_DESC(At_Lm_CtxEntry_Rsvd ),
267	DMARDIAG_DESC(At_Lm_Pt_At_Block ),
268	DMARDIAG_DESC(At_Lm_Pt_Aw_Invalid ),
269	DMARDIAG_DESC(At_Lm_RootEntry_Not_Present),
270	DMARDIAG_DESC(At_Lm_RootEntry_Read_Failed),
271	DMARDIAG_DESC(At_Lm_RootEntry_Rsvd ),
272	DMARDIAG_DESC(At_Lm_Tt_Invalid ),
273	DMARDIAG_DESC(At_Lm_Ut_At_Block ),
274	DMARDIAG_DESC(At_Lm_Ut_Aw_Invalid ),
275	DMARDIAG_DESC(At_Rta_Adms_Not_Supported ),
276	DMARDIAG_DESC(At_Rta_Rsvd ),
277	DMARDIAG_DESC(At_Rta_Smts_Not_Supported ),
278	DMARDIAG_DESC(At_Xm_AddrIn_Invalid ),
279	DMARDIAG_DESC(At_Xm_AddrOut_Invalid ),
280	DMARDIAG_DESC(At_Xm_Perm_Read_Denied ),
281	DMARDIAG_DESC(At_Xm_Perm_Write_Denied ),
282	DMARDIAG_DESC(At_Xm_Pte_Not_Present ),
283	DMARDIAG_DESC(At_Xm_Pte_Rsvd ),
284	DMARDIAG_DESC(At_Xm_Pte_Sllps_Invalid ),
285	DMARDIAG_DESC(At_Xm_Read_Pte_Failed ),
286	DMARDIAG_DESC(At_Xm_Slpptr_Read_Failed ),
287
288	/* CCMD_REG faults. */
289	DMARDIAG_DESC(CcmdReg_Not_Supported ),
290	DMARDIAG_DESC(CcmdReg_Qi_Enabled ),
291	DMARDIAG_DESC(CcmdReg_Ttm_Invalid ),
292
293	/* IQA_REG faults. */
294	DMARDIAG_DESC(IqaReg_Dsc_Fetch_Error ),
295	DMARDIAG_DESC(IqaReg_Dw_128_Invalid ),
296	DMARDIAG_DESC(IqaReg_Dw_256_Invalid ),
297
298	/* Invalidation Queue Error Info. */
299	DMARDIAG_DESC(Iqei_Dsc_Type_Invalid ),
300	DMARDIAG_DESC(Iqei_Inv_Wait_Dsc_0_1_Rsvd ),
301	DMARDIAG_DESC(Iqei_Inv_Wait_Dsc_2_3_Rsvd ),
302	DMARDIAG_DESC(Iqei_Inv_Wait_Dsc_Invalid ),
303	DMARDIAG_DESC(Iqei_Ttm_Rsvd ),
304
305	/* IQT_REG faults. */
306	DMARDIAG_DESC(IqtReg_Qt_Invalid ),
307	DMARDIAG_DESC(IqtReg_Qt_Not_Aligned ),
308
309	/* Interrupt remapping faults. */
310	DMARDIAG_DESC(Ir_Cfi_Blocked ),
311	DMARDIAG_DESC(Ir_Rfi_Intr_Index_Invalid ),
312	DMARDIAG_DESC(Ir_Rfi_Irte_Mode_Invalid ),
313	DMARDIAG_DESC(Ir_Rfi_Irte_Not_Present ),
314	DMARDIAG_DESC(Ir_Rfi_Irte_Read_Failed ),
315	DMARDIAG_DESC(Ir_Rfi_Irte_Rsvd ),
316	DMARDIAG_DESC(Ir_Rfi_Irte_Svt_Bus ),
317	DMARDIAG_DESC(Ir_Rfi_Irte_Svt_Masked ),
318	DMARDIAG_DESC(Ir_Rfi_Irte_Svt_Rsvd ),
319	DMARDIAG_DESC(Ir_Rfi_Rsvd ),
320	/* kDmarDiag_End */
321	};
322	AssertCompile(RT_ELEMENTS(g_apszDmarDiagDesc) == kDmarDiag_End);
323	# undef DMARDIAG_DESC
324	#endif /* IN_RING3 */
325
326	/**
327	* The shared DMAR device state.
328	*/
329	typedef struct DMAR
330	{
331	/** IOMMU device index. */
332	uint32_t idxIommu;
333	/** Padding. */
334	uint32_t u32Padding0;
335
336	/** Registers (group 0). */
337	uint8_t abRegs0[DMAR_MMIO_GROUP_0_SIZE];
338	/** Registers (group 1). */
339	uint8_t abRegs1[DMAR_MMIO_GROUP_1_SIZE];
340
341	/** @name Lazily activated registers.
342	* These are the active values for lazily activated registers. Software is free to
343	* modify the actual register values while remapping/translation is enabled but they
344	* take effect only when explicitly signaled by software, hence we need to hold the
345	* active values separately.
346	* @{ */
347	/** Currently active IRTA_REG. */
348	uint64_t uIrtaReg;
349	/** Currently active RTADDR_REG. */
350	uint64_t uRtaddrReg;
351	/** @} */
352
353	/** @name Register copies for a tiny bit faster and more convenient access.
354	* @{ */
355	/** Copy of VER_REG. */
356	uint8_t uVerReg;
357	/** Alignment. */
358	uint8_t abPadding0[7];
359	/** Copy of CAP_REG. */
360	uint64_t fCapReg;
361	/** Copy of ECAP_REG. */
362	uint64_t fExtCapReg;
363	/** @} */
364
365	/** Host-address width (HAW) base address mask. */
366	uint64_t fHawBaseMask;
367	/** Maximum guest-address width (MGAW) invalid address mask. */
368	uint64_t fMgawInvMask;
369	/** Context-entry qword-1 valid mask. */
370	uint64_t fCtxEntryQw1ValidMask;
371	/** Maximum supported paging level (3, 4 or 5). */
372	uint8_t cMaxPagingLevel;
373	/** DMA request valid permissions mask. */
374	uint8_t fPermValidMask;
375	/** Alignment. */
376	uint8_t abPadding1[6];
377
378	/** The event semaphore the invalidation-queue thread waits on. */
379	SUPSEMEVENT hEvtInvQueue;
380	/** Error diagnostic. */
381	DMARDIAG enmDiag;
382	/** Padding. */
383	uint32_t uPadding0;
384	/** The MMIO handle. */
385	IOMMMIOHANDLE hMmio;
386
387	#ifdef VBOX_WITH_STATISTICS
388	STAMCOUNTER StatMmioReadR3; /*< Number of MMIO reads in R3. /
389	STAMCOUNTER StatMmioReadRZ; /*< Number of MMIO reads in RZ. /
390	STAMCOUNTER StatMmioWriteR3; /*< Number of MMIO writes in R3. /
391	STAMCOUNTER StatMmioWriteRZ; /*< Number of MMIO writes in RZ. /
392
393	STAMCOUNTER StatMsiRemapCfiR3; /*< Number of compatibility-format interrupts remap requests in R3. /
394	STAMCOUNTER StatMsiRemapCfiRZ; /*< Number of compatibility-format interrupts remap requests in RZ. /
395	STAMCOUNTER StatMsiRemapRfiR3; /*< Number of remappable-format interrupts remap requests in R3. /
396	STAMCOUNTER StatMsiRemapRfiRZ; /*< Number of remappable-format interrupts remap requests in RZ. /
397
398	STAMCOUNTER StatMemReadR3; /*< Number of memory read translation requests in R3. /
399	STAMCOUNTER StatMemReadRZ; /*< Number of memory read translation requests in RZ. /
400	STAMCOUNTER StatMemWriteR3; /*< Number of memory write translation requests in R3. /
401	STAMCOUNTER StatMemWriteRZ; /*< Number of memory write translation requests in RZ. /
402
403	STAMCOUNTER StatMemBulkReadR3; /*< Number of memory read bulk translation requests in R3. /
404	STAMCOUNTER StatMemBulkReadRZ; /*< Number of memory read bulk translation requests in RZ. /
405	STAMCOUNTER StatMemBulkWriteR3; /*< Number of memory write bulk translation requests in R3. /
406	STAMCOUNTER StatMemBulkWriteRZ; /*< Number of memory write bulk translation requests in RZ. /
407
408	STAMCOUNTER StatCcInvDsc; /*< Number of Context-cache descriptors processed. /
409	STAMCOUNTER StatIotlbInvDsc; /*< Number of IOTLB descriptors processed. /
410	STAMCOUNTER StatDevtlbInvDsc; /*< Number of Device-TLB descriptors processed. /
411	STAMCOUNTER StatIecInvDsc; /*< Number of Interrupt-Entry cache descriptors processed. /
412	STAMCOUNTER StatInvWaitDsc; /*< Number of Invalidation wait descriptors processed. /
413	STAMCOUNTER StatPasidIotlbInvDsc; /*< Number of PASID-based IOTLB descriptors processed. /
414	STAMCOUNTER StatPasidCacheInvDsc; /*< Number of PASID-cache descriptors processed. /
415	STAMCOUNTER StatPasidDevtlbInvDsc; /*< Number of PASID-based device-TLB descriptors processed. /
416	#endif
417	} DMAR;
418	/** Pointer to the DMAR device state. */
419	typedef DMAR *PDMAR;
420	/** Pointer to the const DMAR device state. */
421	typedef DMAR const *PCDMAR;
422	AssertCompileMemberAlignment(DMAR, abRegs0, 8);
423	AssertCompileMemberAlignment(DMAR, abRegs1, 8);
424
425	/**
426	* The ring-3 DMAR device state.
427	*/
428	typedef struct DMARR3
429	{
430	/** Device instance. */
431	PPDMDEVINSR3 pDevInsR3;
432	/** The IOMMU helper. */
433	R3PTRTYPE(PCPDMIOMMUHLPR3) pIommuHlpR3;
434	/** The invalidation-queue thread. */
435	R3PTRTYPE(PPDMTHREAD) pInvQueueThread;
436	} DMARR3;
437	/** Pointer to the ring-3 DMAR device state. */
438	typedef DMARR3 *PDMARR3;
439	/** Pointer to the const ring-3 DMAR device state. */
440	typedef DMARR3 const *PCDMARR3;
441
442	/**
443	* The ring-0 DMAR device state.
444	*/
445	typedef struct DMARR0
446	{
447	/** Device instance. */
448	PPDMDEVINSR0 pDevInsR0;
449	/** The IOMMU helper. */
450	R0PTRTYPE(PCPDMIOMMUHLPR0) pIommuHlpR0;
451	} DMARR0;
452	/** Pointer to the ring-0 IOMMU device state. */
453	typedef DMARR0 *PDMARR0;
454	/** Pointer to the const ring-0 IOMMU device state. */
455	typedef DMARR0 const *PCDMARR0;
456
457	/**
458	* The raw-mode DMAR device state.
459	*/
460	typedef struct DMARRC
461	{
462	/** Device instance. */
463	PPDMDEVINSRC pDevInsRC;
464	/** The IOMMU helper. */
465	RCPTRTYPE(PCPDMIOMMUHLPRC) pIommuHlpRC;
466	} DMARRC;
467	/** Pointer to the raw-mode DMAR device state. */
468	typedef DMARRC *PDMARRC;
469	/** Pointer to the const raw-mode DMAR device state. */
470	typedef DMARRC const *PCIDMARRC;
471
472	/** The DMAR device state for the current context. */
473	typedef CTX_SUFF(DMAR) DMARCC;
474	/** Pointer to the DMAR device state for the current context. */
475	typedef CTX_SUFF(PDMAR) PDMARCC;
476	/** Pointer to the const DMAR device state for the current context. */
477	typedef CTX_SUFF(PDMAR) const PCDMARCC;
478
479	/**
480	* DMAR originated events that generate interrupts.
481	*/
482	typedef enum DMAREVENTTYPE
483	{
484	/** Invalidation completion event. */
485	DMAREVENTTYPE_INV_COMPLETE = 0,
486	/** Fault event. */
487	DMAREVENTTYPE_FAULT
488	} DMAREVENTTYPE;
489
490	/**
491	* I/O Page.
492	*/
493	typedef struct DMARIOPAGE
494	{
495	/** The base DMA address of a page. */
496	RTGCPHYS GCPhysBase;
497	/** The page shift. */
498	uint8_t cShift;
499	/** The permissions of this page (DMAR_PERM_XXX). */
500	uint8_t fPerm;
501	} DMARIOPAGE;
502	/** Pointer to an I/O page. */
503	typedef DMARIOPAGE *PDMARIOPAGE;
504	/** Pointer to a const I/O address range. */
505	typedef DMARIOPAGE const *PCDMARIOPAGE;
506
507	/**
508	* I/O Address Range.
509	*/
510	typedef struct DMARIOADDRRANGE
511	{
512	/** The starting DMA address of this range. */
513	uint64_t uAddr;
514	/** The size of the range (in bytes). */
515	size_t cb;
516	/** The permissions of this range (DMAR_PERM_XXX). */
517	uint8_t fPerm;
518	} DMARIOADDRRANGE;
519	/** Pointer to an I/O address range. */
520	typedef DMARIOADDRRANGE *PDMARIOADDRRANGE;
521	/** Pointer to a const I/O address range. */
522	typedef DMARIOADDRRANGE const *PCDMARIOADDRRANGE;
523
524	/**
525	* DMA Memory Request (Input).
526	*/
527	typedef struct DMARMEMREQIN
528	{
529	/** The address range being accessed. */
530	DMARIOADDRRANGE AddrRange;
531	/** The source device ID (bus, device, function). */
532	uint16_t idDevice;
533	/** The PASID if present (can be NIL_PCIPASID). */
534	PCIPASID Pasid;
535	/* The address translation type. */
536	PCIADDRTYPE enmAddrType;
537	/** The request type. */
538	VTDREQTYPE enmReqType;
539	} DMARMEMREQIN;
540	/** Pointer to a DMA memory request input. */
541	typedef DMARMEMREQIN *PDMARMEMREQIN;
542	/** Pointer to a const DMA memory input. */
543	typedef DMARMEMREQIN const *PCDMARMEMREQIN;
544
545	/**
546	* DMA Memory Request (Output).
547	*/
548	typedef struct DMARMEMREQOUT
549	{
550	/** The address range of the translated region. */
551	DMARIOADDRRANGE AddrRange;
552	/** The domain ID of the translated region. */
553	uint16_t idDomain;
554	} DMARMEMREQOUT;
555	/** Pointer to a DMA memory request output. */
556	typedef DMARMEMREQOUT *PDMARMEMREQOUT;
557	/** Pointer to a const DMA memory request output. */
558	typedef DMARMEMREQOUT const *PCDMARMEMREQOUT;
559
560	/**
561	* DMA Memory Request (Auxiliary Info).
562	* These get updated and used as part of the translation process.
563	*/
564	typedef struct DMARMEMREQAUX
565	{
566	/** The table translation mode (VTD_TTM_XXX). */
567	uint8_t fTtm;
568	/** The fault processing disabled (FPD) bit. */
569	uint8_t fFpd;
570	/** The paging level of the translation. */
571	uint8_t cPagingLevel;
572	uint8_t abPadding[5];
573	/** The address of the first-level page-table. */
574	uint64_t GCPhysFlPt;
575	/** The address of second-level page-table. */
576	uint64_t GCPhysSlPt;
577	} DMARMEMREQAUX;
578	/** Pointer to a DMA memory request output. */
579	typedef DMARMEMREQAUX *PDMARMEMREQAUX;
580	/** Pointer to a const DMA memory request output. */
581	typedef DMARMEMREQAUX const *PCDMARMEMREQAUX;
582
583	/**
584	* DMA Memory Request Remapping Information.
585	*/
586	typedef struct DMARMEMREQREMAP
587	{
588	/** The DMA memory request input. */
589	DMARMEMREQIN In;
590	/** DMA memory request auxiliary information. */
591	DMARMEMREQAUX Aux;
592	/** The DMA memory request output. */
593	DMARMEMREQOUT Out;
594	} DMARMEMREQREMAP;
595	/** Pointer to a DMA remap info. */
596	typedef DMARMEMREQREMAP *PDMARMEMREQREMAP;
597	/** Pointer to a const DMA remap info. */
598	typedef DMARMEMREQREMAP const *PCDMARMEMREQREMAP;
599
600	/**
601	* Callback function to lookup a DMA address.
602	*
603	* @returns VBox status code.
604	* @param pDevIns The IOMMU device instance.
605	* @param pMemReqIn The DMA memory request input.
606	* @param pMemReqAux The DMA memory request auxiliary info.
607	* @param pIoPageOut Where to store the output of the lookup.
608	*/
609	typedef DECLCALLBACKTYPE(int, FNDMADDRLOOKUP,(PPDMDEVINS pDevIns, PCDMARMEMREQIN pMemReqIn, PCDMARMEMREQAUX pMemReqAux,
610	PDMARIOPAGE pIoPageOut));
611	/** Pointer to a DMA address-lookup function. */
612	typedef FNDMADDRLOOKUP *PFNDMADDRLOOKUP;
613
614
615	/*********************************************************************************************************************************
616	* Global Variables *
617	*********************************************************************************************************************************/
618	/**
619	* Read-write masks for DMAR registers (group 0).
620	*/
621	static uint32_t const g_au32RwMasks0[] =
622	{
623	/* Offset Register Low High */
624	/* 0x000 VER_REG */ VTD_VER_REG_RW_MASK,
625	/* 0x004 Reserved */ 0,
626	/* 0x008 CAP_REG */ DMAR_LO_U32(VTD_CAP_REG_RW_MASK), DMAR_HI_U32(VTD_CAP_REG_RW_MASK),
627	/* 0x010 ECAP_REG */ DMAR_LO_U32(VTD_ECAP_REG_RW_MASK), DMAR_HI_U32(VTD_ECAP_REG_RW_MASK),
628	/* 0x018 GCMD_REG */ VTD_GCMD_REG_RW_MASK,
629	/* 0x01c GSTS_REG */ VTD_GSTS_REG_RW_MASK,
630	/* 0x020 RTADDR_REG */ DMAR_LO_U32(VTD_RTADDR_REG_RW_MASK), DMAR_HI_U32(VTD_RTADDR_REG_RW_MASK),
631	/* 0x028 CCMD_REG */ DMAR_LO_U32(VTD_CCMD_REG_RW_MASK), DMAR_HI_U32(VTD_CCMD_REG_RW_MASK),
632	/* 0x030 Reserved */ 0,
633	/* 0x034 FSTS_REG */ VTD_FSTS_REG_RW_MASK,
634	/* 0x038 FECTL_REG */ VTD_FECTL_REG_RW_MASK,
635	/* 0x03c FEDATA_REG */ VTD_FEDATA_REG_RW_MASK,
636	/* 0x040 FEADDR_REG */ VTD_FEADDR_REG_RW_MASK,
637	/* 0x044 FEUADDR_REG */ VTD_FEUADDR_REG_RW_MASK,
638	/* 0x048 Reserved */ 0, 0,
639	/* 0x050 Reserved */ 0, 0,
640	/* 0x058 AFLOG_REG */ DMAR_LO_U32(VTD_AFLOG_REG_RW_MASK), DMAR_HI_U32(VTD_AFLOG_REG_RW_MASK),
641	/* 0x060 Reserved */ 0,
642	/* 0x064 PMEN_REG / 0, / RO as we don't support PLMR and PHMR. */
643	/* 0x068 PLMBASE_REG / 0, / RO as we don't support PLMR. */
644	/* 0x06c PLMLIMIT_REG / 0, / RO as we don't support PLMR. */
645	/* 0x070 PHMBASE_REG / 0, 0, / RO as we don't support PHMR. */
646	/* 0x078 PHMLIMIT_REG / 0, 0, / RO as we don't support PHMR. */
647	/* 0x080 IQH_REG */ DMAR_LO_U32(VTD_IQH_REG_RW_MASK), DMAR_HI_U32(VTD_IQH_REG_RW_MASK),
648	/* 0x088 IQT_REG */ DMAR_LO_U32(VTD_IQT_REG_RW_MASK), DMAR_HI_U32(VTD_IQT_REG_RW_MASK),
649	/* 0x090 IQA_REG */ DMAR_LO_U32(VTD_IQA_REG_RW_MASK), DMAR_HI_U32(VTD_IQA_REG_RW_MASK),
650	/* 0x098 Reserved */ 0,
651	/* 0x09c ICS_REG */ VTD_ICS_REG_RW_MASK,
652	/* 0x0a0 IECTL_REG */ VTD_IECTL_REG_RW_MASK,
653	/* 0x0a4 IEDATA_REG */ VTD_IEDATA_REG_RW_MASK,
654	/* 0x0a8 IEADDR_REG */ VTD_IEADDR_REG_RW_MASK,
655	/* 0x0ac IEUADDR_REG */ VTD_IEUADDR_REG_RW_MASK,
656	/* 0x0b0 IQERCD_REG */ DMAR_LO_U32(VTD_IQERCD_REG_RW_MASK), DMAR_HI_U32(VTD_IQERCD_REG_RW_MASK),
657	/* 0x0b8 IRTA_REG */ DMAR_LO_U32(VTD_IRTA_REG_RW_MASK), DMAR_HI_U32(VTD_IRTA_REG_RW_MASK),
658	/* 0x0c0 PQH_REG */ DMAR_LO_U32(VTD_PQH_REG_RW_MASK), DMAR_HI_U32(VTD_PQH_REG_RW_MASK),
659	/* 0x0c8 PQT_REG */ DMAR_LO_U32(VTD_PQT_REG_RW_MASK), DMAR_HI_U32(VTD_PQT_REG_RW_MASK),
660	/* 0x0d0 PQA_REG */ DMAR_LO_U32(VTD_PQA_REG_RW_MASK), DMAR_HI_U32(VTD_PQA_REG_RW_MASK),
661	/* 0x0d8 Reserved */ 0,
662	/* 0x0dc PRS_REG */ VTD_PRS_REG_RW_MASK,
663	/* 0x0e0 PECTL_REG */ VTD_PECTL_REG_RW_MASK,
664	/* 0x0e4 PEDATA_REG */ VTD_PEDATA_REG_RW_MASK,
665	/* 0x0e8 PEADDR_REG */ VTD_PEADDR_REG_RW_MASK,
666	/* 0x0ec PEUADDR_REG */ VTD_PEUADDR_REG_RW_MASK,
667	/* 0x0f0 Reserved */ 0, 0,
668	/* 0x0f8 Reserved */ 0, 0,
669	/* 0x100 MTRRCAP_REG */ DMAR_LO_U32(VTD_MTRRCAP_REG_RW_MASK), DMAR_HI_U32(VTD_MTRRCAP_REG_RW_MASK),
670	/* 0x108 MTRRDEF_REG / 0, 0, / RO as we don't support MTS. */
671	/* 0x110 Reserved */ 0, 0,
672	/* 0x118 Reserved */ 0, 0,
673	/* 0x120 MTRR_FIX64_00000_REG / 0, 0, / RO as we don't support MTS. */
674	/* 0x128 MTRR_FIX16K_80000_REG */ 0, 0,
675	/* 0x130 MTRR_FIX16K_A0000_REG */ 0, 0,
676	/* 0x138 MTRR_FIX4K_C0000_REG */ 0, 0,
677	/* 0x140 MTRR_FIX4K_C8000_REG */ 0, 0,
678	/* 0x148 MTRR_FIX4K_D0000_REG */ 0, 0,
679	/* 0x150 MTRR_FIX4K_D8000_REG */ 0, 0,
680	/* 0x158 MTRR_FIX4K_E0000_REG */ 0, 0,
681	/* 0x160 MTRR_FIX4K_E8000_REG */ 0, 0,
682	/* 0x168 MTRR_FIX4K_F0000_REG */ 0, 0,
683	/* 0x170 MTRR_FIX4K_F8000_REG */ 0, 0,
684	/* 0x178 Reserved */ 0, 0,
685	/* 0x180 MTRR_PHYSBASE0_REG / 0, 0, / RO as we don't support MTS. */
686	/* 0x188 MTRR_PHYSMASK0_REG */ 0, 0,
687	/* 0x190 MTRR_PHYSBASE1_REG */ 0, 0,
688	/* 0x198 MTRR_PHYSMASK1_REG */ 0, 0,
689	/* 0x1a0 MTRR_PHYSBASE2_REG */ 0, 0,
690	/* 0x1a8 MTRR_PHYSMASK2_REG */ 0, 0,
691	/* 0x1b0 MTRR_PHYSBASE3_REG */ 0, 0,
692	/* 0x1b8 MTRR_PHYSMASK3_REG */ 0, 0,
693	/* 0x1c0 MTRR_PHYSBASE4_REG */ 0, 0,
694	/* 0x1c8 MTRR_PHYSMASK4_REG */ 0, 0,
695	/* 0x1d0 MTRR_PHYSBASE5_REG */ 0, 0,
696	/* 0x1d8 MTRR_PHYSMASK5_REG */ 0, 0,
697	/* 0x1e0 MTRR_PHYSBASE6_REG */ 0, 0,
698	/* 0x1e8 MTRR_PHYSMASK6_REG */ 0, 0,
699	/* 0x1f0 MTRR_PHYSBASE7_REG */ 0, 0,
700	/* 0x1f8 MTRR_PHYSMASK7_REG */ 0, 0,
701	/* 0x200 MTRR_PHYSBASE8_REG */ 0, 0,
702	/* 0x208 MTRR_PHYSMASK8_REG */ 0, 0,
703	/* 0x210 MTRR_PHYSBASE9_REG */ 0, 0,
704	/* 0x218 MTRR_PHYSMASK9_REG */ 0, 0,
705	};
706	AssertCompile(sizeof(g_au32RwMasks0) == DMAR_MMIO_GROUP_0_SIZE);
707
708	/**
709	* Read-only Status, Write-1-to-clear masks for DMAR registers (group 0).
710	*/
711	static uint32_t const g_au32Rw1cMasks0[] =
712	{
713	/* Offset Register Low High */
714	/* 0x000 VER_REG */ 0,
715	/* 0x004 Reserved */ 0,
716	/* 0x008 CAP_REG */ 0, 0,
717	/* 0x010 ECAP_REG */ 0, 0,
718	/* 0x018 GCMD_REG */ 0,
719	/* 0x01c GSTS_REG */ 0,
720	/* 0x020 RTADDR_REG */ 0, 0,
721	/* 0x028 CCMD_REG */ 0, 0,
722	/* 0x030 Reserved */ 0,
723	/* 0x034 FSTS_REG */ VTD_FSTS_REG_RW1C_MASK,
724	/* 0x038 FECTL_REG */ 0,
725	/* 0x03c FEDATA_REG */ 0,
726	/* 0x040 FEADDR_REG */ 0,
727	/* 0x044 FEUADDR_REG */ 0,
728	/* 0x048 Reserved */ 0, 0,
729	/* 0x050 Reserved */ 0, 0,
730	/* 0x058 AFLOG_REG */ 0, 0,
731	/* 0x060 Reserved */ 0,
732	/* 0x064 PMEN_REG */ 0,
733	/* 0x068 PLMBASE_REG */ 0,
734	/* 0x06c PLMLIMIT_REG */ 0,
735	/* 0x070 PHMBASE_REG */ 0, 0,
736	/* 0x078 PHMLIMIT_REG */ 0, 0,
737	/* 0x080 IQH_REG */ 0, 0,
738	/* 0x088 IQT_REG */ 0, 0,
739	/* 0x090 IQA_REG */ 0, 0,
740	/* 0x098 Reserved */ 0,
741	/* 0x09c ICS_REG */ VTD_ICS_REG_RW1C_MASK,
742	/* 0x0a0 IECTL_REG */ 0,
743	/* 0x0a4 IEDATA_REG */ 0,
744	/* 0x0a8 IEADDR_REG */ 0,
745	/* 0x0ac IEUADDR_REG */ 0,
746	/* 0x0b0 IQERCD_REG */ 0, 0,
747	/* 0x0b8 IRTA_REG */ 0, 0,
748	/* 0x0c0 PQH_REG */ 0, 0,
749	/* 0x0c8 PQT_REG */ 0, 0,
750	/* 0x0d0 PQA_REG */ 0, 0,
751	/* 0x0d8 Reserved */ 0,
752	/* 0x0dc PRS_REG */ 0,
753	/* 0x0e0 PECTL_REG */ 0,
754	/* 0x0e4 PEDATA_REG */ 0,
755	/* 0x0e8 PEADDR_REG */ 0,
756	/* 0x0ec PEUADDR_REG */ 0,
757	/* 0x0f0 Reserved */ 0, 0,
758	/* 0x0f8 Reserved */ 0, 0,
759	/* 0x100 MTRRCAP_REG */ 0, 0,
760	/* 0x108 MTRRDEF_REG */ 0, 0,
761	/* 0x110 Reserved */ 0, 0,
762	/* 0x118 Reserved */ 0, 0,
763	/* 0x120 MTRR_FIX64_00000_REG */ 0, 0,
764	/* 0x128 MTRR_FIX16K_80000_REG */ 0, 0,
765	/* 0x130 MTRR_FIX16K_A0000_REG */ 0, 0,
766	/* 0x138 MTRR_FIX4K_C0000_REG */ 0, 0,
767	/* 0x140 MTRR_FIX4K_C8000_REG */ 0, 0,
768	/* 0x148 MTRR_FIX4K_D0000_REG */ 0, 0,
769	/* 0x150 MTRR_FIX4K_D8000_REG */ 0, 0,
770	/* 0x158 MTRR_FIX4K_E0000_REG */ 0, 0,
771	/* 0x160 MTRR_FIX4K_E8000_REG */ 0, 0,
772	/* 0x168 MTRR_FIX4K_F0000_REG */ 0, 0,
773	/* 0x170 MTRR_FIX4K_F8000_REG */ 0, 0,
774	/* 0x178 Reserved */ 0, 0,
775	/* 0x180 MTRR_PHYSBASE0_REG */ 0, 0,
776	/* 0x188 MTRR_PHYSMASK0_REG */ 0, 0,
777	/* 0x190 MTRR_PHYSBASE1_REG */ 0, 0,
778	/* 0x198 MTRR_PHYSMASK1_REG */ 0, 0,
779	/* 0x1a0 MTRR_PHYSBASE2_REG */ 0, 0,
780	/* 0x1a8 MTRR_PHYSMASK2_REG */ 0, 0,
781	/* 0x1b0 MTRR_PHYSBASE3_REG */ 0, 0,
782	/* 0x1b8 MTRR_PHYSMASK3_REG */ 0, 0,
783	/* 0x1c0 MTRR_PHYSBASE4_REG */ 0, 0,
784	/* 0x1c8 MTRR_PHYSMASK4_REG */ 0, 0,
785	/* 0x1d0 MTRR_PHYSBASE5_REG */ 0, 0,
786	/* 0x1d8 MTRR_PHYSMASK5_REG */ 0, 0,
787	/* 0x1e0 MTRR_PHYSBASE6_REG */ 0, 0,
788	/* 0x1e8 MTRR_PHYSMASK6_REG */ 0, 0,
789	/* 0x1f0 MTRR_PHYSBASE7_REG */ 0, 0,
790	/* 0x1f8 MTRR_PHYSMASK7_REG */ 0, 0,
791	/* 0x200 MTRR_PHYSBASE8_REG */ 0, 0,
792	/* 0x208 MTRR_PHYSMASK8_REG */ 0, 0,
793	/* 0x210 MTRR_PHYSBASE9_REG */ 0, 0,
794	/* 0x218 MTRR_PHYSMASK9_REG */ 0, 0,
795	};
796	AssertCompile(sizeof(g_au32Rw1cMasks0) == DMAR_MMIO_GROUP_0_SIZE);
797
798	/**
799	* Read-write masks for DMAR registers (group 1).
800	*/
801	static uint32_t const g_au32RwMasks1[] =
802	{
803	/* Offset Register Low High */
804	/* 0xe00 VCCAP_REG */ DMAR_LO_U32(VTD_VCCAP_REG_RW_MASK), DMAR_HI_U32(VTD_VCCAP_REG_RW_MASK),
805	/* 0xe08 VCMD_EO_REG */ DMAR_LO_U32(VTD_VCMD_EO_REG_RW_MASK), DMAR_HI_U32(VTD_VCMD_EO_REG_RW_MASK),
806	/* 0xe10 VCMD_REG / 0, 0, / RO: VCS not supported. */
807	/* 0xe18 VCMDRSVD_REG */ 0, 0,
808	/* 0xe20 VCRSP_REG / 0, 0, / RO: VCS not supported. */
809	/* 0xe28 VCRSPRSVD_REG */ 0, 0,
810	/* 0xe30 Reserved */ 0, 0,
811	/* 0xe38 Reserved */ 0, 0,
812	/* 0xe40 Reserved */ 0, 0,
813	/* 0xe48 Reserved */ 0, 0,
814	/* 0xe50 IVA_REG */ DMAR_LO_U32(VTD_IVA_REG_RW_MASK), DMAR_HI_U32(VTD_IVA_REG_RW_MASK),
815	/* 0xe58 IOTLB_REG */ DMAR_LO_U32(VTD_IOTLB_REG_RW_MASK), DMAR_HI_U32(VTD_IOTLB_REG_RW_MASK),
816	/* 0xe60 Reserved */ 0, 0,
817	/* 0xe68 Reserved */ 0, 0,
818	/* 0xe70 FRCD_REG_LO */ DMAR_LO_U32(VTD_FRCD_REG_LO_RW_MASK), DMAR_HI_U32(VTD_FRCD_REG_LO_RW_MASK),
819	/* 0xe78 FRCD_REG_HI */ DMAR_LO_U32(VTD_FRCD_REG_HI_RW_MASK), DMAR_HI_U32(VTD_FRCD_REG_HI_RW_MASK),
820	};
821	AssertCompile(sizeof(g_au32RwMasks1) == DMAR_MMIO_GROUP_1_SIZE);
822	AssertCompile((DMAR_MMIO_OFF_FRCD_LO_REG - DMAR_MMIO_GROUP_1_OFF_FIRST) + DMAR_FRCD_REG_COUNT * 2 * sizeof(uint64_t) );
823
824	/**
825	* Read-only Status, Write-1-to-clear masks for DMAR registers (group 1).
826	*/
827	static uint32_t const g_au32Rw1cMasks1[] =
828	{
829	/* Offset Register Low High */
830	/* 0xe00 VCCAP_REG */ 0, 0,
831	/* 0xe08 VCMD_EO_REG */ 0, 0,
832	/* 0xe10 VCMD_REG */ 0, 0,
833	/* 0xe18 VCMDRSVD_REG */ 0, 0,
834	/* 0xe20 VCRSP_REG */ 0, 0,
835	/* 0xe28 VCRSPRSVD_REG */ 0, 0,
836	/* 0xe30 Reserved */ 0, 0,
837	/* 0xe38 Reserved */ 0, 0,
838	/* 0xe40 Reserved */ 0, 0,
839	/* 0xe48 Reserved */ 0, 0,
840	/* 0xe50 IVA_REG */ 0, 0,
841	/* 0xe58 IOTLB_REG */ 0, 0,
842	/* 0xe60 Reserved */ 0, 0,
843	/* 0xe68 Reserved */ 0, 0,
844	/* 0xe70 FRCD_REG_LO */ DMAR_LO_U32(VTD_FRCD_REG_LO_RW1C_MASK), DMAR_HI_U32(VTD_FRCD_REG_LO_RW1C_MASK),
845	/* 0xe78 FRCD_REG_HI */ DMAR_LO_U32(VTD_FRCD_REG_HI_RW1C_MASK), DMAR_HI_U32(VTD_FRCD_REG_HI_RW1C_MASK),
846	};
847	AssertCompile(sizeof(g_au32Rw1cMasks1) == DMAR_MMIO_GROUP_1_SIZE);
848
849	/** Array of RW masks for each register group. */
850	static uint8_t const g_apbRwMasks[] = { (uint8_t )&g_au32RwMasks0[0], (uint8_t *)&g_au32RwMasks1[0] };
851
852	/** Array of RW1C masks for each register group. */
853	static uint8_t const g_apbRw1cMasks[] = { (uint8_t )&g_au32Rw1cMasks0[0], (uint8_t *)&g_au32Rw1cMasks1[0] };
854
855	/* Masks arrays must be identical in size (even bounds checking code assumes this). */
856	AssertCompile(sizeof(g_apbRw1cMasks) == sizeof(g_apbRwMasks));
857
858	#ifdef IN_RING3
859	/** Array of valid domain-ID bits. */
860	static uint16_t const g_auNdMask[] = { 0xf, 0x3f, 0xff, 0x3ff, 0xfff, 0x3fff, 0xffff, 0 };
861	AssertCompile(RT_ELEMENTS(g_auNdMask) >= DMAR_ND);
862	#endif
863
864
865	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
866	#ifdef IN_RING3
867	/**
868	* Returns the supported adjusted guest-address width (SAGAW) given the maximum
869	* guest address width (MGAW).
870	*
871	* @returns The CAP_REG.SAGAW value.
872	* @param uMgaw The CAP_REG.MGAW value.
873	*/
874	static uint8_t vtdCapRegGetSagaw(uint8_t uMgaw)
875	{
876	/*
877	* It doesn't make sense to me that a CPU (or IOMMU hardware) will ever support
878	* 5-level paging but not 4 or 3-level paging. So smaller page-table levels
879	* are always OR'ed in below.
880	*
881	* The bit values below (57, 48, 39 bits) represents the levels of page-table walks
882	* for 4KB base page size (5-level, 4-level and 3-level paging respectively).
883	*
884	* See Intel VT-d spec. 10.4.2 "Capability Register".
885	*/
886	++uMgaw;
887	uint8_t const fSagaw = uMgaw >= 57 ? RT_BIT(3) \| RT_BIT(2) \| RT_BIT(1)
888	: uMgaw >= 48 ? RT_BIT(2) \| RT_BIT(1)
889	: uMgaw >= 39 ? RT_BIT(1)
890	: 0;
891	return fSagaw;
892	}
893
894
895	/**
896	* Returns the maximum supported paging level given the supported adjusted
897	* guest-address width (SAGAW) field.
898	*
899	* @returns The highest paging level supported, 0 if invalid.
900	* @param fSagaw The CAP_REG.SAGAW value.
901	*/
902	static uint8_t vtdCapRegGetMaxPagingLevel(uint8_t fSagaw)
903	{
904	uint8_t const cMaxPagingLevel = fSagaw & RT_BIT(3) ? 5
905	: fSagaw & RT_BIT(2) ? 4
906	: fSagaw & RT_BIT(1) ? 3
907	: 0;
908	return cMaxPagingLevel;
909	}
910
911
912	/**
913	* Returns table translation mode's descriptive name.
914	*
915	* @returns The descriptive name.
916	* @param uTtm The RTADDR_REG.TTM value.
917	*/
918	static const char* vtdRtaddrRegGetTtmDesc(uint8_t uTtm)
919	{
920	Assert(!(uTtm & 3));
921	static const char* s_apszTtmNames[] =
922	{
923	"Legacy Mode",
924	"Scalable Mode",
925	"Reserved",
926	"Abort-DMA Mode"
927	};
928	return s_apszTtmNames[uTtm & (RT_ELEMENTS(s_apszTtmNames) - 1)];
929	}
930	#endif /* IN_RING3 */
931
932
933	/**
934	* Returns whether the interrupt remapping (IR) fault is qualified or not.
935	*
936	* @returns @c true if qualified, @c false otherwise.
937	* @param enmIrFault The interrupt remapping fault condition.
938	*/
939	static bool vtdIrFaultIsQualified(VTDIRFAULT enmIrFault)
940	{
941	switch (enmIrFault)
942	{
943	case VTDIRFAULT_IRTE_NOT_PRESENT:
944	case VTDIRFAULT_IRTE_PRESENT_RSVD:
945	case VTDIRFAULT_IRTE_PRESENT_INVALID:
946	case VTDIRFAULT_PID_READ_FAILED:
947	case VTDIRFAULT_PID_RSVD:
948	return true;
949	default:
950	return false;
951	}
952	}
953
954
955	/**
956	* Gets the index of the group the register belongs to given its MMIO offset.
957	*
958	* @returns The group index.
959	* @param offReg The MMIO offset of the register.
960	* @param cbReg The size of the access being made (for bounds checking on
961	* debug builds).
962	*/
963	DECLINLINE(uint8_t) dmarRegGetGroupIndex(uint16_t offReg, uint8_t cbReg)
964	{
965	uint16_t const offLast = offReg + cbReg - 1;
966	AssertCompile(DMAR_MMIO_GROUP_0_OFF_FIRST == 0);
967	AssertMsg(DMAR_IS_MMIO_OFF_VALID(offLast), ("off=%#x cb=%u\n", offReg, cbReg));
968	return !(offLast < DMAR_MMIO_GROUP_0_OFF_END);
969	}
970
971
972	/**
973	* Gets the group the register belongs to given its MMIO offset.
974	*
975	* @returns Pointer to the first element of the register group.
976	* @param pThis The shared DMAR device state.
977	* @param offReg The MMIO offset of the register.
978	* @param cbReg The size of the access being made (for bounds checking on
979	* debug builds).
980	* @param pIdxGroup Where to store the index of the register group the register
981	* belongs to.
982	*/
983	DECLINLINE(uint8_t ) dmarRegGetGroup(PDMAR pThis, uint16_t offReg, uint8_t cbReg, uint8_t pIdxGroup)
984	{
985	*pIdxGroup = dmarRegGetGroupIndex(offReg, cbReg);
986	uint8_t *apbRegs[] = { &pThis->abRegs0[0], &pThis->abRegs1[0] };
987	return apbRegs[*pIdxGroup];
988	}
989
990
991	/**
992	* Const/read-only version of dmarRegGetGroup.
993	*
994	* @copydoc dmarRegGetGroup
995	*/
996	DECLINLINE(uint8_t const) dmarRegGetGroupRo(PCDMAR pThis, uint16_t offReg, uint8_t cbReg, uint8_t pIdxGroup)
997	{
998	*pIdxGroup = dmarRegGetGroupIndex(offReg, cbReg);
999	uint8_t const *apbRegs[] = { &pThis->abRegs0[0], &pThis->abRegs1[0] };
1000	return apbRegs[*pIdxGroup];
1001	}
1002
1003
1004	/**
1005	* Writes a 32-bit register with the exactly the supplied value.
1006	*
1007	* @param pThis The shared DMAR device state.
1008	* @param offReg The MMIO offset of the register.
1009	* @param uReg The 32-bit value to write.
1010	*/
1011	static void dmarRegWriteRaw32(PDMAR pThis, uint16_t offReg, uint32_t uReg)
1012	{
1013	uint8_t idxGroup;
1014	uint8_t *pabRegs = dmarRegGetGroup(pThis, offReg, sizeof(uint32_t), &idxGroup);
1015	NOREF(idxGroup);
1016	(uint32_t )(pabRegs + offReg) = uReg;
1017	}
1018
1019
1020	/**
1021	* Writes a 64-bit register with the exactly the supplied value.
1022	*
1023	* @param pThis The shared DMAR device state.
1024	* @param offReg The MMIO offset of the register.
1025	* @param uReg The 64-bit value to write.
1026	*/
1027	static void dmarRegWriteRaw64(PDMAR pThis, uint16_t offReg, uint64_t uReg)
1028	{
1029	uint8_t idxGroup;
1030	uint8_t *pabRegs = dmarRegGetGroup(pThis, offReg, sizeof(uint64_t), &idxGroup);
1031	NOREF(idxGroup);
1032	(uint64_t )(pabRegs + offReg) = uReg;
1033	}
1034
1035
1036	/**
1037	* Reads a 32-bit register with exactly the value it contains.
1038	*
1039	* @returns The raw register value.
1040	* @param pThis The shared DMAR device state.
1041	* @param offReg The MMIO offset of the register.
1042	*/
1043	static uint32_t dmarRegReadRaw32(PCDMAR pThis, uint16_t offReg)
1044	{
1045	uint8_t idxGroup;
1046	uint8_t const *pabRegs = dmarRegGetGroupRo(pThis, offReg, sizeof(uint32_t), &idxGroup);
1047	NOREF(idxGroup);
1048	return (uint32_t )(pabRegs + offReg);
1049	}
1050
1051
1052	/**
1053	* Reads a 64-bit register with exactly the value it contains.
1054	*
1055	* @returns The raw register value.
1056	* @param pThis The shared DMAR device state.
1057	* @param offReg The MMIO offset of the register.
1058	*/
1059	static uint64_t dmarRegReadRaw64(PCDMAR pThis, uint16_t offReg)
1060	{
1061	uint8_t idxGroup;
1062	uint8_t const *pabRegs = dmarRegGetGroupRo(pThis, offReg, sizeof(uint64_t), &idxGroup);
1063	NOREF(idxGroup);
1064	return (uint64_t )(pabRegs + offReg);
1065	}
1066
1067
1068	/**
1069	* Reads a 32-bit register with exactly the value it contains along with their
1070	* corresponding masks
1071	*
1072	* @param pThis The shared DMAR device state.
1073	* @param offReg The MMIO offset of the register.
1074	* @param puReg Where to store the raw 32-bit register value.
1075	* @param pfRwMask Where to store the RW mask corresponding to this register.
1076	* @param pfRw1cMask Where to store the RW1C mask corresponding to this register.
1077	*/
1078	static void dmarRegReadRaw32Ex(PCDMAR pThis, uint16_t offReg, uint32_t puReg, uint32_t pfRwMask, uint32_t *pfRw1cMask)
1079	{
1080	uint8_t idxGroup;
1081	uint8_t const *pabRegs = dmarRegGetGroupRo(pThis, offReg, sizeof(uint32_t), &idxGroup);
1082	Assert(idxGroup < RT_ELEMENTS(g_apbRwMasks));
1083	uint8_t const *pabRwMasks = g_apbRwMasks[idxGroup];
1084	uint8_t const *pabRw1cMasks = g_apbRw1cMasks[idxGroup];
1085	puReg = (uint32_t *)(pabRegs + offReg);
1086	pfRwMask = (uint32_t *)(pabRwMasks + offReg);
1087	pfRw1cMask = (uint32_t *)(pabRw1cMasks + offReg);
1088	}
1089
1090
1091	/**
1092	* Reads a 64-bit register with exactly the value it contains along with their
1093	* corresponding masks.
1094	*
1095	* @param pThis The shared DMAR device state.
1096	* @param offReg The MMIO offset of the register.
1097	* @param puReg Where to store the raw 64-bit register value.
1098	* @param pfRwMask Where to store the RW mask corresponding to this register.
1099	* @param pfRw1cMask Where to store the RW1C mask corresponding to this register.
1100	*/
1101	static void dmarRegReadRaw64Ex(PCDMAR pThis, uint16_t offReg, uint64_t puReg, uint64_t pfRwMask, uint64_t *pfRw1cMask)
1102	{
1103	uint8_t idxGroup;
1104	uint8_t const *pabRegs = dmarRegGetGroupRo(pThis, offReg, sizeof(uint64_t), &idxGroup);
1105	Assert(idxGroup < RT_ELEMENTS(g_apbRwMasks));
1106	uint8_t const *pabRwMasks = g_apbRwMasks[idxGroup];
1107	uint8_t const *pabRw1cMasks = g_apbRw1cMasks[idxGroup];
1108	puReg = (uint64_t *)(pabRegs + offReg);
1109	pfRwMask = (uint64_t *)(pabRwMasks + offReg);
1110	pfRw1cMask = (uint64_t *)(pabRw1cMasks + offReg);
1111	}
1112
1113
1114	/**
1115	* Writes a 32-bit register as it would be when written by software.
1116	* This will preserve read-only bits, mask off reserved bits and clear RW1C bits.
1117	*
1118	* @returns The value that's actually written to the register.
1119	* @param pThis The shared DMAR device state.
1120	* @param offReg The MMIO offset of the register.
1121	* @param uReg The 32-bit value to write.
1122	* @param puPrev Where to store the register value prior to writing.
1123	*/
1124	static uint32_t dmarRegWrite32(PDMAR pThis, uint16_t offReg, uint32_t uReg, uint32_t *puPrev)
1125	{
1126	/* Read current value from the 32-bit register. */
1127	uint32_t uCurReg;
1128	uint32_t fRwMask;
1129	uint32_t fRw1cMask;
1130	dmarRegReadRaw32Ex(pThis, offReg, &uCurReg, &fRwMask, &fRw1cMask);
1131	*puPrev = uCurReg;
1132
1133	uint32_t const fRoBits = uCurReg & ~fRwMask; /* Preserve current read-only and reserved bits. */
1134	uint32_t const fRwBits = uReg & fRwMask; /* Merge newly written read/write bits. */
1135	uint32_t const fRw1cBits = uReg & fRw1cMask; /* Clear 1s written to RW1C bits. */
1136	uint32_t const uNewReg = (fRoBits \| fRwBits) & ~fRw1cBits;
1137
1138	/* Write new value to the 32-bit register. */
1139	dmarRegWriteRaw32(pThis, offReg, uNewReg);
1140	return uNewReg;
1141	}
1142
1143
1144	/**
1145	* Writes a 64-bit register as it would be when written by software.
1146	* This will preserve read-only bits, mask off reserved bits and clear RW1C bits.
1147	*
1148	* @returns The value that's actually written to the register.
1149	* @param pThis The shared DMAR device state.
1150	* @param offReg The MMIO offset of the register.
1151	* @param uReg The 64-bit value to write.
1152	* @param puPrev Where to store the register value prior to writing.
1153	*/
1154	static uint64_t dmarRegWrite64(PDMAR pThis, uint16_t offReg, uint64_t uReg, uint64_t *puPrev)
1155	{
1156	/* Read current value from the 64-bit register. */
1157	uint64_t uCurReg;
1158	uint64_t fRwMask;
1159	uint64_t fRw1cMask;
1160	dmarRegReadRaw64Ex(pThis, offReg, &uCurReg, &fRwMask, &fRw1cMask);
1161	*puPrev = uCurReg;
1162
1163	uint64_t const fRoBits = uCurReg & ~fRwMask; /* Preserve current read-only and reserved bits. */
1164	uint64_t const fRwBits = uReg & fRwMask; /* Merge newly written read/write bits. */
1165	uint64_t const fRw1cBits = uReg & fRw1cMask; /* Clear 1s written to RW1C bits. */
1166	uint64_t const uNewReg = (fRoBits \| fRwBits) & ~fRw1cBits;
1167
1168	/* Write new value to the 64-bit register. */
1169	dmarRegWriteRaw64(pThis, offReg, uNewReg);
1170	return uNewReg;
1171	}
1172
1173
1174	/**
1175	* Reads a 32-bit register as it would be when read by software.
1176	*
1177	* @returns The register value.
1178	* @param pThis The shared DMAR device state.
1179	* @param offReg The MMIO offset of the register.
1180	*/
1181	static uint32_t dmarRegRead32(PCDMAR pThis, uint16_t offReg)
1182	{
1183	return dmarRegReadRaw32(pThis, offReg);
1184	}
1185
1186
1187	/**
1188	* Reads a 64-bit register as it would be when read by software.
1189	*
1190	* @returns The register value.
1191	* @param pThis The shared DMAR device state.
1192	* @param offReg The MMIO offset of the register.
1193	*/
1194	static uint64_t dmarRegRead64(PCDMAR pThis, uint16_t offReg)
1195	{
1196	return dmarRegReadRaw64(pThis, offReg);
1197	}
1198
1199
1200	/**
1201	* Modifies a 32-bit register.
1202	*
1203	* @param pThis The shared DMAR device state.
1204	* @param offReg The MMIO offset of the register.
1205	* @param fAndMask The AND mask (applied first).
1206	* @param fOrMask The OR mask.
1207	* @remarks This does NOT apply RO or RW1C masks while modifying the
1208	* register.
1209	*/
1210	static void dmarRegChangeRaw32(PDMAR pThis, uint16_t offReg, uint32_t fAndMask, uint32_t fOrMask)
1211	{
1212	uint32_t uReg = dmarRegReadRaw32(pThis, offReg);
1213	uReg = (uReg & fAndMask) \| fOrMask;
1214	dmarRegWriteRaw32(pThis, offReg, uReg);
1215	}
1216
1217
1218	/**
1219	* Modifies a 64-bit register.
1220	*
1221	* @param pThis The shared DMAR device state.
1222	* @param offReg The MMIO offset of the register.
1223	* @param fAndMask The AND mask (applied first).
1224	* @param fOrMask The OR mask.
1225	* @remarks This does NOT apply RO or RW1C masks while modifying the
1226	* register.
1227	*/
1228	static void dmarRegChangeRaw64(PDMAR pThis, uint16_t offReg, uint64_t fAndMask, uint64_t fOrMask)
1229	{
1230	uint64_t uReg = dmarRegReadRaw64(pThis, offReg);
1231	uReg = (uReg & fAndMask) \| fOrMask;
1232	dmarRegWriteRaw64(pThis, offReg, uReg);
1233	}
1234
1235
1236	/**
1237	* Checks if the invalidation-queue is empty.
1238	*
1239	* Extended version which optionally returns the current queue head and tail
1240	* offsets.
1241	*
1242	* @returns @c true if empty, @c false otherwise.
1243	* @param pThis The shared DMAR device state.
1244	* @param poffQh Where to store the queue head offset. Optional, can be NULL.
1245	* @param poffQt Where to store the queue tail offset. Optional, can be NULL.
1246	*/
1247	static bool dmarInvQueueIsEmptyEx(PCDMAR pThis, uint32_t poffQh, uint32_t poffQt)
1248	{
1249	/* Read only the low-32 bits of the queue head and queue tail as high bits are all RsvdZ.*/
1250	uint32_t const uIqtReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IQT_REG);
1251	uint32_t const uIqhReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IQH_REG);
1252
1253	/* Don't bother masking QT, QH since other bits are RsvdZ. */
1254	Assert(!(uIqtReg & ~VTD_BF_IQT_REG_QT_MASK));
1255	Assert(!(uIqhReg & ~VTD_BF_IQH_REG_QH_MASK));
1256	if (poffQh)
1257	*poffQh = uIqhReg;
1258	if (poffQt)
1259	*poffQt = uIqtReg;
1260	return uIqtReg == uIqhReg;
1261	}
1262
1263
1264	/**
1265	* Checks if the invalidation-queue is empty.
1266	*
1267	* @returns @c true if empty, @c false otherwise.
1268	* @param pThis The shared DMAR device state.
1269	*/
1270	static bool dmarInvQueueIsEmpty(PCDMAR pThis)
1271	{
1272	return dmarInvQueueIsEmptyEx(pThis, NULL /* poffQh /, NULL / poffQt */);
1273	}
1274
1275
1276	/**
1277	* Checks if the invalidation-queue is capable of processing requests.
1278	*
1279	* @returns @c true if the invalidation-queue can process requests, @c false
1280	* otherwise.
1281	* @param pThis The shared DMAR device state.
1282	*/
1283	static bool dmarInvQueueCanProcessRequests(PCDMAR pThis)
1284	{
1285	/* Check if queued-invalidation is enabled. */
1286	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
1287	if (uGstsReg & VTD_BF_GSTS_REG_QIES_MASK)
1288	{
1289	/* Check if there are no invalidation-queue or timeout errors. */
1290	uint32_t const uFstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FSTS_REG);
1291	if (!(uFstsReg & (VTD_BF_FSTS_REG_IQE_MASK \| VTD_BF_FSTS_REG_ITE_MASK)))
1292	return true;
1293	}
1294	return false;
1295	}
1296
1297
1298	/**
1299	* Wakes up the invalidation-queue thread if there are requests to be processed.
1300	*
1301	* @param pDevIns The IOMMU device instance.
1302	*/
1303	static void dmarInvQueueThreadWakeUpIfNeeded(PPDMDEVINS pDevIns)
1304	{
1305	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1306	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1307	LogFlowFunc(("\n"));
1308
1309	DMAR_ASSERT_LOCK_IS_OWNER(pDevIns, pThisCC);
1310
1311	if ( dmarInvQueueCanProcessRequests(pThis)
1312	&& !dmarInvQueueIsEmpty(pThis))
1313	{
1314	Log4Func(("Signaling the invalidation-queue thread\n"));
1315	PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtInvQueue);
1316	}
1317	}
1318
1319
1320	/**
1321	* Raises an event on behalf of the DMAR.
1322	*
1323	* These are events that are generated by the DMAR itself (like faults and
1324	* invalidation completion notifications).
1325	*
1326	* @param pDevIns The IOMMU device instance.
1327	* @param enmEventType The DMAR event type.
1328	*
1329	* @remarks The DMAR lock must be held while calling this function.
1330	*/
1331	static void dmarEventRaiseInterrupt(PPDMDEVINS pDevIns, DMAREVENTTYPE enmEventType)
1332	{
1333	uint16_t offCtlReg;
1334	uint32_t fIntrMaskedMask;
1335	uint32_t fIntrPendingMask;
1336	uint16_t offMsiAddrLoReg;
1337	uint16_t offMsiAddrHiReg;
1338	uint16_t offMsiDataReg;
1339	switch (enmEventType)
1340	{
1341	case DMAREVENTTYPE_INV_COMPLETE:
1342	{
1343	offCtlReg = VTD_MMIO_OFF_IECTL_REG;
1344	fIntrMaskedMask = VTD_BF_IECTL_REG_IM_MASK;
1345	fIntrPendingMask = VTD_BF_IECTL_REG_IP_MASK;
1346	offMsiAddrLoReg = VTD_MMIO_OFF_IEADDR_REG;
1347	offMsiAddrHiReg = VTD_MMIO_OFF_IEUADDR_REG;
1348	offMsiDataReg = VTD_MMIO_OFF_IEDATA_REG;
1349	break;
1350	}
1351
1352	case DMAREVENTTYPE_FAULT:
1353	{
1354	offCtlReg = VTD_MMIO_OFF_FECTL_REG;
1355	fIntrMaskedMask = VTD_BF_FECTL_REG_IM_MASK;
1356	fIntrPendingMask = VTD_BF_FECTL_REG_IP_MASK;
1357	offMsiAddrLoReg = VTD_MMIO_OFF_FEADDR_REG;
1358	offMsiAddrHiReg = VTD_MMIO_OFF_FEUADDR_REG;
1359	offMsiDataReg = VTD_MMIO_OFF_FEDATA_REG;
1360	break;
1361	}
1362
1363	default:
1364	{
1365	/* Shouldn't ever happen. */
1366	AssertMsgFailedReturnVoid(("DMAR event type %#x unknown!\n", enmEventType));
1367	}
1368	}
1369
1370	/* Check if software has masked the interrupt. */
1371	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1372	uint32_t uCtlReg = dmarRegReadRaw32(pThis, offCtlReg);
1373	if (!(uCtlReg & fIntrMaskedMask))
1374	{
1375	/*
1376	* Interrupt is unmasked, raise it.
1377	* Interrupts generated by the DMAR have trigger mode and level as 0.
1378	* See Intel spec. 5.1.6 "Remapping Hardware Event Interrupt Programming".
1379	*/
1380	MSIMSG Msi;
1381	Msi.Addr.au32[0] = dmarRegReadRaw32(pThis, offMsiAddrLoReg);
1382	Msi.Addr.au32[1] = (pThis->fExtCapReg & VTD_BF_ECAP_REG_EIM_MASK) ? dmarRegReadRaw32(pThis, offMsiAddrHiReg) : 0;
1383	Msi.Data.u32 = dmarRegReadRaw32(pThis, offMsiDataReg);
1384	Assert(Msi.Data.n.u1Level == 0);
1385	Assert(Msi.Data.n.u1TriggerMode == 0);
1386
1387	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1388	pThisCC->CTX_SUFF(pIommuHlp)->pfnSendMsi(pDevIns, &Msi, 0 /* uTagSrc */);
1389
1390	/* Clear interrupt pending bit. */
1391	uCtlReg &= ~fIntrPendingMask;
1392	dmarRegWriteRaw32(pThis, offCtlReg, uCtlReg);
1393	}
1394	else
1395	{
1396	/* Interrupt is masked, set the interrupt pending bit. */
1397	uCtlReg \|= fIntrPendingMask;
1398	dmarRegWriteRaw32(pThis, offCtlReg, uCtlReg);
1399	}
1400	}
1401
1402
1403	/**
1404	* Raises an interrupt in response to a fault event.
1405	*
1406	* @param pDevIns The IOMMU device instance.
1407	*
1408	* @remarks This assumes the caller has already set the required status bits in the
1409	* FSTS_REG (namely one or more of PPF, PFO, IQE, ICE or ITE bits).
1410	*/
1411	static void dmarFaultEventRaiseInterrupt(PPDMDEVINS pDevIns)
1412	{
1413	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1414	DMAR_ASSERT_LOCK_IS_OWNER(pDevIns, pThisCC);
1415
1416	#ifdef RT_STRICT
1417	{
1418	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PCDMAR);
1419	uint32_t const uFstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FSTS_REG);
1420	uint32_t const fFaultMask = VTD_BF_FSTS_REG_PPF_MASK \| VTD_BF_FSTS_REG_PFO_MASK
1421	/* \| VTD_BF_FSTS_REG_APF_MASK \| VTD_BF_FSTS_REG_AFO_MASK / / AFL not supported */
1422	/* \| VTD_BF_FSTS_REG_ICE_MASK \| VTD_BF_FSTS_REG_ITE_MASK / / Device-TLBs not supported */
1423	\| VTD_BF_FSTS_REG_IQE_MASK;
1424	Assert(uFstsReg & fFaultMask);
1425	}
1426	#endif
1427	dmarEventRaiseInterrupt(pDevIns, DMAREVENTTYPE_FAULT);
1428	}
1429
1430
1431	#ifdef IN_RING3
1432	/**
1433	* Raises an interrupt in response to an invalidation (complete) event.
1434	*
1435	* @param pDevIns The IOMMU device instance.
1436	*/
1437	static void dmarR3InvEventRaiseInterrupt(PPDMDEVINS pDevIns)
1438	{
1439	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1440	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1441	DMAR_ASSERT_LOCK_IS_OWNER(pDevIns, pThisCC);
1442
1443	uint32_t const uIcsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_ICS_REG);
1444	if (!(uIcsReg & VTD_BF_ICS_REG_IWC_MASK))
1445	{
1446	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_ICS_REG, UINT32_MAX, VTD_BF_ICS_REG_IWC_MASK);
1447	dmarEventRaiseInterrupt(pDevIns, DMAREVENTTYPE_INV_COMPLETE);
1448	}
1449	}
1450	#endif /* IN_RING3 */
1451
1452
1453	/**
1454	* Checks if a primary fault can be recorded.
1455	*
1456	* @returns @c true if the fault can be recorded, @c false otherwise.
1457	* @param pDevIns The IOMMU device instance.
1458	* @param pThis The shared DMAR device state.
1459	*
1460	* @remarks Warning: This function has side-effects wrt the DMAR register state. Do
1461	* NOT call it unless there is a fault condition!
1462	*/
1463	static bool dmarPrimaryFaultCanRecord(PPDMDEVINS pDevIns, PDMAR pThis)
1464	{
1465	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1466	DMAR_ASSERT_LOCK_IS_OWNER(pDevIns, pThisCC);
1467
1468	uint32_t uFstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FSTS_REG);
1469	if (uFstsReg & VTD_BF_FSTS_REG_PFO_MASK)
1470	return false;
1471
1472	/*
1473	* If we add more FRCD registers, we'll have to loop through them here.
1474	* Since we support only one FRCD_REG, we don't support "compression of multiple faults",
1475	* nor do we need to increment FRI.
1476	*
1477	* See Intel VT-d spec. 7.2.1 "Primary Fault Logging".
1478	*/
1479	AssertCompile(DMAR_FRCD_REG_COUNT == 1);
1480	uint64_t const uFrcdRegHi = dmarRegReadRaw64(pThis, DMAR_MMIO_OFF_FRCD_HI_REG);
1481	if (uFrcdRegHi & VTD_BF_1_FRCD_REG_F_MASK)
1482	{
1483	uFstsReg \|= VTD_BF_FSTS_REG_PFO_MASK;
1484	dmarRegWriteRaw32(pThis, VTD_MMIO_OFF_FSTS_REG, uFstsReg);
1485	return false;
1486	}
1487
1488	return true;
1489	}
1490
1491
1492	/**
1493	* Records a primary fault.
1494	*
1495	* @param pDevIns The IOMMU device instance.
1496	* @param uFrcdHi The FRCD_HI_REG value for this fault.
1497	* @param uFrcdLo The FRCD_LO_REG value for this fault.
1498	*/
1499	static void dmarPrimaryFaultRecord(PPDMDEVINS pDevIns, uint64_t uFrcdHi, uint64_t uFrcdLo)
1500	{
1501	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1502	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1503
1504	DMAR_LOCK(pDevIns, pThisCC);
1505
1506	/* We don't support advance fault logging. */
1507	Assert(!(dmarRegRead32(pThis, VTD_MMIO_OFF_GSTS_REG) & VTD_BF_GSTS_REG_AFLS_MASK));
1508
1509	if (dmarPrimaryFaultCanRecord(pDevIns, pThis))
1510	{
1511	/* Update the fault recording registers with the fault information. */
1512	dmarRegWriteRaw64(pThis, DMAR_MMIO_OFF_FRCD_HI_REG, uFrcdHi);
1513	dmarRegWriteRaw64(pThis, DMAR_MMIO_OFF_FRCD_LO_REG, uFrcdLo);
1514
1515	/* Set the Pending Primary Fault (PPF) field in the status register. */
1516	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_FSTS_REG, UINT32_MAX, VTD_BF_FSTS_REG_PPF_MASK);
1517
1518	/* Raise interrupt if necessary. */
1519	dmarFaultEventRaiseInterrupt(pDevIns);
1520	}
1521
1522	DMAR_UNLOCK(pDevIns, pThisCC);
1523	}
1524
1525
1526	/**
1527	* Records an interrupt request fault.
1528	*
1529	* @param pDevIns The IOMMU device instance.
1530	* @param enmDiag The diagnostic reason.
1531	* @param idDevice The device ID (bus, device, function).
1532	* @param idxIntr The interrupt index.
1533	* @param pIrte The IRTE that caused this fault. Can be NULL if the fault is
1534	* not qualified.
1535	*/
1536	static void dmarIrFaultRecord(PPDMDEVINS pDevIns, DMARDIAG enmDiag, uint16_t idDevice, uint16_t idxIntr, PCVTD_IRTE_T pIrte)
1537	{
1538	/*
1539	* Update the diagnostic reason (even if software wants to supress faults).
1540	*/
1541	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1542	pThis->enmDiag = enmDiag;
1543
1544	/*
1545	* Figure out the fault reason to report to software from our diagnostic code.
1546	* The case labels below are sorted alphabetically for convenience.
1547	*/
1548	VTDIRFAULT enmIrFault;
1549	switch (enmDiag)
1550	{
1551	case kDmarDiag_Ir_Cfi_Blocked: enmIrFault = VTDIRFAULT_CFI_BLOCKED; break;
1552	case kDmarDiag_Ir_Rfi_Intr_Index_Invalid: enmIrFault = VTDIRFAULT_INTR_INDEX_INVALID; break;
1553	case kDmarDiag_Ir_Rfi_Irte_Mode_Invalid: enmIrFault = VTDIRFAULT_IRTE_PRESENT_RSVD; break;
1554	case kDmarDiag_Ir_Rfi_Irte_Not_Present: enmIrFault = VTDIRFAULT_IRTE_NOT_PRESENT; break;
1555	case kDmarDiag_Ir_Rfi_Irte_Read_Failed: enmIrFault = VTDIRFAULT_IRTE_READ_FAILED; break;
1556	case kDmarDiag_Ir_Rfi_Irte_Rsvd:
1557	case kDmarDiag_Ir_Rfi_Irte_Svt_Bus:
1558	case kDmarDiag_Ir_Rfi_Irte_Svt_Masked:
1559	case kDmarDiag_Ir_Rfi_Irte_Svt_Rsvd: enmIrFault = VTDIRFAULT_IRTE_PRESENT_RSVD; break;
1560	case kDmarDiag_Ir_Rfi_Rsvd: enmIrFault = VTDIRFAULT_REMAPPABLE_INTR_RSVD; break;
1561
1562	/* Shouldn't ever happen. */
1563	default:
1564	{
1565	AssertLogRelMsgFailedReturnVoid(("%s: Invalid interrupt remapping fault diagnostic code %#x\n", DMAR_LOG_PFX,
1566	enmDiag));
1567	}
1568	}
1569
1570	/*
1571	* Qualified faults are those that can be suppressed by software using the FPD bit
1572	* in the interrupt-remapping table entry.
1573	*/
1574	bool fFpd;
1575	bool const fQualifiedFault = vtdIrFaultIsQualified(enmIrFault);
1576	if (fQualifiedFault)
1577	{
1578	AssertReturnVoid(pIrte);
1579	fFpd = RT_BOOL(pIrte->au64[0] & VTD_BF_0_IRTE_FPD_MASK);
1580	}
1581	else
1582	fFpd = false;
1583
1584	if (!fFpd)
1585	{
1586	/* Construct and record the error. */
1587	uint64_t const uFrcdHi = RT_BF_MAKE(VTD_BF_1_FRCD_REG_SID, idDevice)
1588	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_FR, enmIrFault)
1589	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_F, 1);
1590	uint64_t const uFrcdLo = (uint64_t)idxIntr << 48;
1591	dmarPrimaryFaultRecord(pDevIns, uFrcdHi, uFrcdLo);
1592	}
1593	}
1594
1595
1596	/**
1597	* Records an address translation fault.
1598	*
1599	* @param pDevIns The IOMMU device instance.
1600	* @param enmDiag The diagnostic reason.
1601	* @param pMemReqIn The DMA memory request input.
1602	* @param pMemReqAux The DMA memory request auxiliary info.
1603	*/
1604	static void dmarAtFaultRecord(PPDMDEVINS pDevIns, DMARDIAG enmDiag, PCDMARMEMREQIN pMemReqIn, PCDMARMEMREQAUX pMemReqAux)
1605	{
1606	/*
1607	* Update the diagnostic reason (even if software wants to supress faults).
1608	*/
1609	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1610	pThis->enmDiag = enmDiag;
1611
1612	/*
1613	* Qualified faults are those that can be suppressed by software using the FPD bit
1614	* in the context entry, scalable-mode context entry etc.
1615	*/
1616	if (!pMemReqAux->fFpd)
1617	{
1618	/*
1619	* Figure out the fault reason to report to software from our diagnostic code.
1620	* The case labels below are sorted alphabetically for convenience.
1621	*/
1622	VTDATFAULT enmAtFault;
1623	bool const fLm = pMemReqAux->fTtm == VTD_TTM_LEGACY_MODE;
1624	switch (enmDiag)
1625	{
1626	/* LM (Legacy Mode) faults. */
1627	case kDmarDiag_At_Lm_CtxEntry_Not_Present: enmAtFault = VTDATFAULT_LCT_2; break;
1628	case kDmarDiag_At_Lm_CtxEntry_Read_Failed: enmAtFault = VTDATFAULT_LCT_1; break;
1629	case kDmarDiag_At_Lm_CtxEntry_Rsvd: enmAtFault = VTDATFAULT_LCT_3; break;
1630	case kDmarDiag_At_Lm_Pt_At_Block: enmAtFault = VTDATFAULT_LCT_5; break;
1631	case kDmarDiag_At_Lm_Pt_Aw_Invalid: enmAtFault = VTDATFAULT_LGN_1_3; break;
1632	case kDmarDiag_At_Lm_RootEntry_Not_Present: enmAtFault = VTDATFAULT_LRT_2; break;
1633	case kDmarDiag_At_Lm_RootEntry_Read_Failed: enmAtFault = VTDATFAULT_LRT_1; break;
1634	case kDmarDiag_At_Lm_RootEntry_Rsvd: enmAtFault = VTDATFAULT_LRT_3; break;
1635	case kDmarDiag_At_Lm_Tt_Invalid: enmAtFault = VTDATFAULT_LCT_4_2; break;
1636	case kDmarDiag_At_Lm_Ut_At_Block: enmAtFault = VTDATFAULT_LCT_5; break;
1637	case kDmarDiag_At_Lm_Ut_Aw_Invalid: enmAtFault = VTDATFAULT_LCT_4_1; break;
1638
1639	/* RTA (Root Table Address) faults. */
1640	case kDmarDiag_At_Rta_Adms_Not_Supported: enmAtFault = VTDATFAULT_RTA_1_1; break;
1641	case kDmarDiag_At_Rta_Rsvd: enmAtFault = VTDATFAULT_RTA_1_2; break;
1642	case kDmarDiag_At_Rta_Smts_Not_Supported: enmAtFault = VTDATFAULT_RTA_1_3; break;
1643
1644	/* XM (Legacy mode or Scalable Mode) faults. */
1645	case kDmarDiag_At_Xm_AddrIn_Invalid: enmAtFault = fLm ? VTDATFAULT_LGN_1_1 : VTDATFAULT_SGN_5; break;
1646	case kDmarDiag_At_Xm_AddrOut_Invalid: enmAtFault = fLm ? VTDATFAULT_LGN_4 : VTDATFAULT_SGN_8; break;
1647	case kDmarDiag_At_Xm_Perm_Read_Denied: enmAtFault = fLm ? VTDATFAULT_LGN_3 : VTDATFAULT_SGN_7; break;
1648	case kDmarDiag_At_Xm_Perm_Write_Denied: enmAtFault = fLm ? VTDATFAULT_LGN_2 : VTDATFAULT_SGN_6; break;
1649	case kDmarDiag_At_Xm_Pte_Not_Present:
1650	case kDmarDiag_At_Xm_Pte_Rsvd: enmAtFault = fLm ? VTDATFAULT_LSL_2 : VTDATFAULT_SSL_2; break;
1651	case kDmarDiag_At_Xm_Pte_Sllps_Invalid: enmAtFault = fLm ? VTDATFAULT_LSL_2 : VTDATFAULT_SSL_3; break;
1652	case kDmarDiag_At_Xm_Read_Pte_Failed: enmAtFault = fLm ? VTDATFAULT_LSL_1 : VTDATFAULT_SSL_1; break;
1653	case kDmarDiag_At_Xm_Slpptr_Read_Failed: enmAtFault = fLm ? VTDATFAULT_LCT_4_3 : VTDATFAULT_SSL_4; break;
1654
1655	/* Shouldn't ever happen. */
1656	default:
1657	{
1658	AssertLogRelMsgFailedReturnVoid(("%s: Invalid address translation fault diagnostic code %#x\n",
1659	DMAR_LOG_PFX, enmDiag));
1660	}
1661	}
1662
1663	/* Construct and record the error. */
1664	uint16_t const idDevice = pMemReqIn->idDevice;
1665	uint8_t const fType1 = pMemReqIn->enmReqType & RT_BIT(1);
1666	uint8_t const fType2 = pMemReqIn->enmReqType & RT_BIT(0);
1667	uint8_t const fExec = pMemReqIn->AddrRange.fPerm & DMAR_PERM_EXE;
1668	uint8_t const fPriv = pMemReqIn->AddrRange.fPerm & DMAR_PERM_PRIV;
1669	bool const fHasPasid = PCIPASID_IS_VALID(pMemReqIn->Pasid);
1670	uint32_t const uPasid = PCIPASID_VAL(pMemReqIn->Pasid);
1671	PCIADDRTYPE const enmAt = pMemReqIn->enmAddrType;
1672
1673	uint64_t const uFrcdHi = RT_BF_MAKE(VTD_BF_1_FRCD_REG_SID, idDevice)
1674	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_T2, fType2)
1675	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_PP, fHasPasid)
1676	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_EXE, fExec)
1677	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_PRIV, fPriv)
1678	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_FR, enmAtFault)
1679	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_PV, uPasid)
1680	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_AT, enmAt)
1681	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_T1, fType1)
1682	\| RT_BF_MAKE(VTD_BF_1_FRCD_REG_F, 1);
1683	uint64_t const uFrcdLo = pMemReqIn->AddrRange.uAddr & X86_PAGE_BASE_MASK;
1684	dmarPrimaryFaultRecord(pDevIns, uFrcdHi, uFrcdLo);
1685	}
1686	}
1687
1688
1689	/**
1690	* Records an IQE fault.
1691	*
1692	* @param pDevIns The IOMMU device instance.
1693	* @param enmIqei The IQE information.
1694	* @param enmDiag The diagnostic reason.
1695	*/
1696	static void dmarIqeFaultRecord(PPDMDEVINS pDevIns, DMARDIAG enmDiag, VTDIQEI enmIqei)
1697	{
1698	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1699	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
1700
1701	DMAR_LOCK(pDevIns, pThisCC);
1702
1703	/* Update the diagnostic reason. */
1704	pThis->enmDiag = enmDiag;
1705
1706	/* Set the error bit. */
1707	uint32_t const fIqe = RT_BF_MAKE(VTD_BF_FSTS_REG_IQE, 1);
1708	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_FSTS_REG, UINT32_MAX, fIqe);
1709
1710	/* Set the error information. */
1711	uint64_t const fIqei = RT_BF_MAKE(VTD_BF_IQERCD_REG_IQEI, enmIqei);
1712	dmarRegChangeRaw64(pThis, VTD_MMIO_OFF_IQERCD_REG, UINT64_MAX, fIqei);
1713
1714	dmarFaultEventRaiseInterrupt(pDevIns);
1715
1716	DMAR_UNLOCK(pDevIns, pThisCC);
1717	}
1718
1719
1720	/**
1721	* Handles writes to GCMD_REG.
1722	*
1723	* @returns Strict VBox status code.
1724	* @param pDevIns The IOMMU device instance.
1725	* @param uGcmdReg The value written to GCMD_REG.
1726	*/
1727	static VBOXSTRICTRC dmarGcmdRegWrite(PPDMDEVINS pDevIns, uint32_t uGcmdReg)
1728	{
1729	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1730	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
1731	uint32_t const fChanged = uGstsReg ^ uGcmdReg;
1732	uint64_t const fExtCapReg = pThis->fExtCapReg;
1733
1734	/* Queued-invalidation. */
1735	if ( (fExtCapReg & VTD_BF_ECAP_REG_QI_MASK)
1736	&& (fChanged & VTD_BF_GCMD_REG_QIE_MASK))
1737	{
1738	if (uGcmdReg & VTD_BF_GCMD_REG_QIE_MASK)
1739	{
1740	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_QIES_MASK);
1741	dmarInvQueueThreadWakeUpIfNeeded(pDevIns);
1742	}
1743	else
1744	{
1745	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, ~VTD_BF_GSTS_REG_QIES_MASK, 0 /* fOrMask */);
1746	dmarRegWriteRaw32(pThis, VTD_MMIO_OFF_IQH_REG, 0);
1747	}
1748	}
1749
1750	if (fExtCapReg & VTD_BF_ECAP_REG_IR_MASK)
1751	{
1752	/* Set Interrupt Remapping Table Pointer (SIRTP). */
1753	if (uGcmdReg & VTD_BF_GCMD_REG_SIRTP_MASK)
1754	{
1755	/** @todo Perform global invalidation of all interrupt-entry cache when ESIRTPS is
1756	* supported. */
1757	pThis->uIrtaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IRTA_REG);
1758	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_IRTPS_MASK);
1759	}
1760
1761	/* Interrupt remapping. */
1762	if (fChanged & VTD_BF_GCMD_REG_IRE_MASK)
1763	{
1764	if (uGcmdReg & VTD_BF_GCMD_REG_IRE_MASK)
1765	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_IRES_MASK);
1766	else
1767	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, ~VTD_BF_GSTS_REG_IRES_MASK, 0 /* fOrMask */);
1768	}
1769
1770	/* Compatibility format interrupts. */
1771	if (fChanged & VTD_BF_GCMD_REG_CFI_MASK)
1772	{
1773	if (uGcmdReg & VTD_BF_GCMD_REG_CFI_MASK)
1774	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_CFIS_MASK);
1775	else
1776	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, ~VTD_BF_GSTS_REG_CFIS_MASK, 0 /* fOrMask */);
1777	}
1778	}
1779
1780	/* Set Root Table Pointer (SRTP). */
1781	if (uGcmdReg & VTD_BF_GCMD_REG_SRTP_MASK)
1782	{
1783	/** @todo Perform global invalidation of all remapping translation caches when
1784	* ESRTPS is supported. */
1785	pThis->uRtaddrReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_RTADDR_REG);
1786	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_RTPS_MASK);
1787	}
1788
1789	/* Translation (DMA remapping). */
1790	if (fChanged & VTD_BF_GCMD_REG_TE_MASK)
1791	{
1792	if (uGcmdReg & VTD_BF_GCMD_REG_TE_MASK)
1793	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, UINT32_MAX, VTD_BF_GSTS_REG_TES_MASK);
1794	else
1795	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_GSTS_REG, ~VTD_BF_GSTS_REG_TES_MASK, 0 /* fOrMask */);
1796	}
1797
1798	return VINF_SUCCESS;
1799	}
1800
1801
1802	/**
1803	* Handles writes to CCMD_REG.
1804	*
1805	* @returns Strict VBox status code.
1806	* @param pDevIns The IOMMU device instance.
1807	* @param offReg The MMIO register offset.
1808	* @param cbReg The size of the MMIO access (in bytes).
1809	* @param uCcmdReg The value written to CCMD_REG.
1810	*/
1811	static VBOXSTRICTRC dmarCcmdRegWrite(PPDMDEVINS pDevIns, uint16_t offReg, uint8_t cbReg, uint64_t uCcmdReg)
1812	{
1813	/* At present, we only care about responding to high 32-bits writes, low 32-bits are data. */
1814	if (offReg + cbReg > VTD_MMIO_OFF_CCMD_REG + 4)
1815	{
1816	/* Check if we need to invalidate the context-context. */
1817	bool const fIcc = RT_BF_GET(uCcmdReg, VTD_BF_CCMD_REG_ICC);
1818	if (fIcc)
1819	{
1820	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1821	uint8_t const uMajorVersion = RT_BF_GET(pThis->uVerReg, VTD_BF_VER_REG_MAX);
1822	if (uMajorVersion < 6)
1823	{
1824	/* Register-based invalidation can only be used when queued-invalidations are not enabled. */
1825	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
1826	if (!(uGstsReg & VTD_BF_GSTS_REG_QIES_MASK))
1827	{
1828	/* Verify table translation mode is legacy. */
1829	uint8_t const fTtm = RT_BF_GET(pThis->uRtaddrReg, VTD_BF_RTADDR_REG_TTM);
1830	if (fTtm == VTD_TTM_LEGACY_MODE)
1831	{
1832	/** @todo Invalidate. */
1833	return VINF_SUCCESS;
1834	}
1835	pThis->enmDiag = kDmarDiag_CcmdReg_Ttm_Invalid;
1836	}
1837	else
1838	pThis->enmDiag = kDmarDiag_CcmdReg_Qi_Enabled;
1839	}
1840	else
1841	pThis->enmDiag = kDmarDiag_CcmdReg_Not_Supported;
1842	dmarRegChangeRaw64(pThis, VTD_MMIO_OFF_GSTS_REG, ~VTD_BF_CCMD_REG_CAIG_MASK, 0 /* fOrMask */);
1843	}
1844	}
1845	return VINF_SUCCESS;
1846	}
1847
1848
1849	/**
1850	* Handles writes to FECTL_REG.
1851	*
1852	* @returns Strict VBox status code.
1853	* @param pDevIns The IOMMU device instance.
1854	* @param uFectlReg The value written to FECTL_REG.
1855	*/
1856	static VBOXSTRICTRC dmarFectlRegWrite(PPDMDEVINS pDevIns, uint32_t uFectlReg)
1857	{
1858	/*
1859	* If software unmasks the interrupt when the interrupt is pending, we must raise
1860	* the interrupt now (which will consequently clear the interrupt pending (IP) bit).
1861	*/
1862	if ( (uFectlReg & VTD_BF_FECTL_REG_IP_MASK)
1863	&& ~(uFectlReg & VTD_BF_FECTL_REG_IM_MASK))
1864	dmarEventRaiseInterrupt(pDevIns, DMAREVENTTYPE_FAULT);
1865	return VINF_SUCCESS;
1866	}
1867
1868
1869	/**
1870	* Handles writes to FSTS_REG.
1871	*
1872	* @returns Strict VBox status code.
1873	* @param pDevIns The IOMMU device instance.
1874	* @param uFstsReg The value written to FSTS_REG.
1875	* @param uPrev The value in FSTS_REG prior to writing it.
1876	*/
1877	static VBOXSTRICTRC dmarFstsRegWrite(PPDMDEVINS pDevIns, uint32_t uFstsReg, uint32_t uPrev)
1878	{
1879	/*
1880	* If software clears other status bits in FSTS_REG (pertaining to primary fault logging),
1881	* the interrupt pending (IP) bit must be cleared.
1882	*
1883	* See Intel VT-d spec. 10.4.10 "Fault Event Control Register".
1884	*/
1885	uint32_t const fChanged = uPrev ^ uFstsReg;
1886	if (fChanged & ( VTD_BF_FSTS_REG_ICE_MASK \| VTD_BF_FSTS_REG_ITE_MASK
1887	\| VTD_BF_FSTS_REG_IQE_MASK \| VTD_BF_FSTS_REG_PFO_MASK))
1888	{
1889	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1890	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_FECTL_REG, ~VTD_BF_FECTL_REG_IP_MASK, 0 /* fOrMask */);
1891	}
1892	return VINF_SUCCESS;
1893	}
1894
1895
1896	/**
1897	* Handles writes to IQT_REG.
1898	*
1899	* @returns Strict VBox status code.
1900	* @param pDevIns The IOMMU device instance.
1901	* @param offReg The MMIO register offset.
1902	* @param uIqtReg The value written to IQT_REG.
1903	*/
1904	static VBOXSTRICTRC dmarIqtRegWrite(PPDMDEVINS pDevIns, uint16_t offReg, uint64_t uIqtReg)
1905	{
1906	/* We only care about the low 32-bits, high 32-bits are reserved. */
1907	Assert(offReg == VTD_MMIO_OFF_IQT_REG);
1908	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1909
1910	/* Paranoia. */
1911	Assert(!(uIqtReg & ~VTD_BF_IQT_REG_QT_MASK));
1912
1913	uint32_t const offQt = uIqtReg;
1914	uint64_t const uIqaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQA_REG);
1915	uint8_t const fDw = RT_BF_GET(uIqaReg, VTD_BF_IQA_REG_DW);
1916
1917	/* If the descriptor width is 256-bits, the queue tail offset must be aligned accordingly. */
1918	if ( fDw != VTD_IQA_REG_DW_256_BIT
1919	\|\| !(offQt & RT_BIT(4)))
1920	dmarInvQueueThreadWakeUpIfNeeded(pDevIns);
1921	else
1922	{
1923	/* Hardware treats bit 4 as RsvdZ in this situation, so clear it. */
1924	dmarRegChangeRaw32(pThis, offReg, ~RT_BIT(4), 0 /* fOrMask */);
1925	dmarIqeFaultRecord(pDevIns, kDmarDiag_IqtReg_Qt_Not_Aligned, VTDIQEI_QUEUE_TAIL_MISALIGNED);
1926	}
1927	return VINF_SUCCESS;
1928	}
1929
1930
1931	/**
1932	* Handles writes to IQA_REG.
1933	*
1934	* @returns Strict VBox status code.
1935	* @param pDevIns The IOMMU device instance.
1936	* @param offReg The MMIO register offset.
1937	* @param uIqaReg The value written to IQA_REG.
1938	*/
1939	static VBOXSTRICTRC dmarIqaRegWrite(PPDMDEVINS pDevIns, uint16_t offReg, uint64_t uIqaReg)
1940	{
1941	/* At present, we only care about the low 32-bits, high 32-bits are data. */
1942	Assert(offReg == VTD_MMIO_OFF_IQA_REG); NOREF(offReg);
1943
1944	/** @todo What happens if IQA_REG is written when dmarInvQueueCanProcessRequests
1945	* returns true? The Intel VT-d spec. doesn't state anywhere that it
1946	* cannot happen or that it's ignored when it does happen. */
1947
1948	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1949	uint8_t const fDw = RT_BF_GET(uIqaReg, VTD_BF_IQA_REG_DW);
1950	if (fDw == VTD_IQA_REG_DW_256_BIT)
1951	{
1952	bool const fSupports256BitDw = (pThis->fExtCapReg & (VTD_BF_ECAP_REG_SMTS_MASK \| VTD_BF_ECAP_REG_ADMS_MASK));
1953	if (fSupports256BitDw)
1954	{ /* likely */ }
1955	else
1956	dmarIqeFaultRecord(pDevIns, kDmarDiag_IqaReg_Dw_256_Invalid, VTDIQEI_INVALID_DESCRIPTOR_WIDTH);
1957	}
1958	/* else: 128-bit descriptor width is validated lazily, see explanation in dmarR3InvQueueProcessRequests. */
1959
1960	return VINF_SUCCESS;
1961	}
1962
1963
1964	/**
1965	* Handles writes to ICS_REG.
1966	*
1967	* @returns Strict VBox status code.
1968	* @param pDevIns The IOMMU device instance.
1969	* @param uIcsReg The value written to ICS_REG.
1970	*/
1971	static VBOXSTRICTRC dmarIcsRegWrite(PPDMDEVINS pDevIns, uint32_t uIcsReg)
1972	{
1973	/*
1974	* If the IP field is set when software services the interrupt condition,
1975	* (by clearing the IWC field), the IP field must be cleared.
1976	*/
1977	if (!(uIcsReg & VTD_BF_ICS_REG_IWC_MASK))
1978	{
1979	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
1980	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_IECTL_REG, ~VTD_BF_IECTL_REG_IP_MASK, 0 /* fOrMask */);
1981	}
1982	return VINF_SUCCESS;
1983	}
1984
1985
1986	/**
1987	* Handles writes to IECTL_REG.
1988	*
1989	* @returns Strict VBox status code.
1990	* @param pDevIns The IOMMU device instance.
1991	* @param uIectlReg The value written to IECTL_REG.
1992	*/
1993	static VBOXSTRICTRC dmarIectlRegWrite(PPDMDEVINS pDevIns, uint32_t uIectlReg)
1994	{
1995	/*
1996	* If software unmasks the interrupt when the interrupt is pending, we must raise
1997	* the interrupt now (which will consequently clear the interrupt pending (IP) bit).
1998	*/
1999	if ( (uIectlReg & VTD_BF_IECTL_REG_IP_MASK)
2000	&& ~(uIectlReg & VTD_BF_IECTL_REG_IM_MASK))
2001	dmarEventRaiseInterrupt(pDevIns, DMAREVENTTYPE_INV_COMPLETE);
2002	return VINF_SUCCESS;
2003	}
2004
2005
2006	/**
2007	* Handles writes to FRCD_REG (High 64-bits).
2008	*
2009	* @returns Strict VBox status code.
2010	* @param pDevIns The IOMMU device instance.
2011	* @param offReg The MMIO register offset.
2012	* @param cbReg The size of the MMIO access (in bytes).
2013	* @param uFrcdHiReg The value written to FRCD_REG.
2014	* @param uPrev The value in FRCD_REG prior to writing it.
2015	*/
2016	static VBOXSTRICTRC dmarFrcdHiRegWrite(PPDMDEVINS pDevIns, uint16_t offReg, uint8_t cbReg, uint64_t uFrcdHiReg, uint64_t uPrev)
2017	{
2018	/* We only care about responding to high 32-bits, low 32-bits are read-only. */
2019	if (offReg + cbReg > DMAR_MMIO_OFF_FRCD_HI_REG + 4)
2020	{
2021	/*
2022	* If software cleared the RW1C F (fault) bit in all FRCD_REGs, hardware clears the
2023	* Primary Pending Fault (PPF) and the interrupt pending (IP) bits. Our implementation
2024	* has only 1 FRCD register.
2025	*
2026	* See Intel VT-d spec. 10.4.10 "Fault Event Control Register".
2027	*/
2028	AssertCompile(DMAR_FRCD_REG_COUNT == 1);
2029	uint64_t const fChanged = uPrev ^ uFrcdHiReg;
2030	if (fChanged & VTD_BF_1_FRCD_REG_F_MASK)
2031	{
2032	Assert(!(uFrcdHiReg & VTD_BF_1_FRCD_REG_F_MASK)); /* Software should only ever be able to clear this bit. */
2033	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
2034	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_FSTS_REG, ~VTD_BF_FSTS_REG_PPF_MASK, 0 /* fOrMask */);
2035	dmarRegChangeRaw32(pThis, VTD_MMIO_OFF_FECTL_REG, ~VTD_BF_FECTL_REG_IP_MASK, 0 /* fOrMask */);
2036	}
2037	}
2038	return VINF_SUCCESS;
2039	}
2040
2041
2042	/**
2043	* Performs a PCI target abort for a DMA remapping (DR) operation.
2044	*
2045	* @param pDevIns The IOMMU device instance.
2046	*/
2047	static void dmarDrTargetAbort(PPDMDEVINS pDevIns)
2048	{
2049	/** @todo r=ramshankar: I don't know for sure if a PCI target abort is caused or not
2050	* as the Intel VT-d spec. is vague. Wording seems to suggest it does, but
2051	* who knows. */
2052	PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
2053	uint16_t const u16Status = PDMPciDevGetStatus(pPciDev) \| VBOX_PCI_STATUS_SIG_TARGET_ABORT;
2054	PDMPciDevSetStatus(pPciDev, u16Status);
2055	}
2056
2057
2058	/**
2059	* Checks whether the address width (AW) is supported by our hardware
2060	* implementation for legacy mode address translation.
2061	*
2062	* @returns @c true if it's supported, @c false otherwise.
2063	* @param pThis The shared DMAR device state.
2064	* @param pCtxEntry The context entry.
2065	* @param pcPagingLevel Where to store the paging level. Optional, can be NULL.
2066	*/
2067	static bool dmarDrLegacyModeIsAwValid(PCDMAR pThis, PCVTD_CONTEXT_ENTRY_T pCtxEntry, uint8_t *pcPagingLevel)
2068	{
2069	uint8_t const fTt = RT_BF_GET(pCtxEntry->au64[0], VTD_BF_0_CONTEXT_ENTRY_TT);
2070	uint8_t const fAw = RT_BF_GET(pCtxEntry->au64[1], VTD_BF_1_CONTEXT_ENTRY_AW);
2071	uint8_t const fAwMask = RT_BIT(fAw);
2072	uint8_t const fSagaw = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_SAGAW);
2073	Assert(!(fSagaw & ~(RT_BIT(1) \| RT_BIT(2) \| RT_BIT(3))));
2074
2075	uint8_t const cPagingLevel = fAw + 2;
2076	if (pcPagingLevel)
2077	*pcPagingLevel = cPagingLevel;
2078
2079	/* With pass-through, the address width must be the largest AGAW supported by hardware. */
2080	if (fTt == VTD_TT_UNTRANSLATED_PT)
2081	{
2082	Assert(pThis->cMaxPagingLevel >= 3 && pThis->cMaxPagingLevel <= 5); /* Paranoia. */
2083	return cPagingLevel == pThis->cMaxPagingLevel;
2084	}
2085
2086	/* The address width must be any of the ones supported by hardware. */
2087	if (fAw < 4)
2088	return (fSagaw & fAwMask) != 0;
2089
2090	return false;
2091	}
2092
2093
2094	/**
2095	* Reads a root entry from guest memory.
2096	*
2097	* @returns VBox status code.
2098	* @param pDevIns The IOMMU device instance.
2099	* @param uRtaddrReg The current RTADDR_REG value.
2100	* @param idxRootEntry The index of the root entry to read.
2101	* @param pRootEntry Where to store the read root entry.
2102	*/
2103	static int dmarDrReadRootEntry(PPDMDEVINS pDevIns, uint64_t uRtaddrReg, uint8_t idxRootEntry, PVTD_ROOT_ENTRY_T pRootEntry)
2104	{
2105	size_t const cbRootEntry = sizeof(*pRootEntry);
2106	RTGCPHYS const GCPhysRootEntry = (uRtaddrReg & VTD_BF_RTADDR_REG_RTA_MASK) + (idxRootEntry * cbRootEntry);
2107	return PDMDevHlpPhysReadMeta(pDevIns, GCPhysRootEntry, pRootEntry, cbRootEntry);
2108	}
2109
2110
2111	/**
2112	* Reads a context entry from guest memory.
2113	*
2114	* @returns VBox status code.
2115	* @param pDevIns The IOMMU device instance.
2116	* @param GCPhysCtxTable The physical address of the context table.
2117	* @param idxCtxEntry The index of the context entry to read.
2118	* @param pCtxEntry Where to store the read context entry.
2119	*/
2120	static int dmarDrReadCtxEntry(PPDMDEVINS pDevIns, RTGCPHYS GCPhysCtxTable, uint8_t idxCtxEntry, PVTD_CONTEXT_ENTRY_T pCtxEntry)
2121	{
2122	/* We don't verify bits 63:HAW of GCPhysCtxTable is 0 since reading from such an address should fail anyway. */
2123	size_t const cbCtxEntry = sizeof(*pCtxEntry);
2124	RTGCPHYS const GCPhysCtxEntry = GCPhysCtxTable + (idxCtxEntry * cbCtxEntry);
2125	return PDMDevHlpPhysReadMeta(pDevIns, GCPhysCtxEntry, pCtxEntry, cbCtxEntry);
2126	}
2127
2128
2129	/**
2130	* Validates and updates the output I/O page of a translation.
2131	*
2132	* @returns VBox status code.
2133	* @param pDevIns The IOMMU device instance.
2134	* @param GCPhysBase The output address of the translation.
2135	* @param cShift The page shift of the translated address.
2136	* @param fPerm The permissions granted for the translated region.
2137	* @param pMemReqIn The DMA memory request input.
2138	* @param pMemReqAux The DMA memory request auxiliary info.
2139	* @param pIoPageOut Where to store the output of the translation.
2140	*/
2141	static int dmarDrUpdateIoPageOut(PPDMDEVINS pDevIns, RTGCPHYS GCPhysBase, uint8_t cShift, uint8_t fPerm,
2142	PCDMARMEMREQIN pMemReqIn, PCDMARMEMREQAUX pMemReqAux, PDMARIOPAGE pIoPageOut)
2143	{
2144	Assert(!(GCPhysBase & X86_PAGE_4K_OFFSET_MASK));
2145
2146	/* Ensure the output address is not in the interrupt address range. */
2147	if (GCPhysBase - VBOX_MSI_ADDR_BASE >= VBOX_MSI_ADDR_SIZE)
2148	{
2149	pIoPageOut->GCPhysBase = GCPhysBase;
2150	pIoPageOut->cShift = cShift;
2151	pIoPageOut->fPerm = fPerm;
2152	return VINF_SUCCESS;
2153	}
2154
2155	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_AddrOut_Invalid, pMemReqIn, pMemReqAux);
2156	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2157	}
2158
2159
2160	/**
2161	* Performs second level translation by walking the I/O page tables.
2162	*
2163	* This is a DMA address-lookup callback function which performs the translation
2164	* (and access control) as part of the lookup.
2165	*
2166	* @returns VBox status code.
2167	* @param pDevIns The IOMMU device instance.
2168	* @param pMemReqIn The DMA memory request input.
2169	* @param pMemReqAux The DMA memory request auxiliary info.
2170	* @param pIoPageOut Where to store the output of the translation.
2171	*/
2172	static DECLCALLBACK(int) dmarDrSecondLevelTranslate(PPDMDEVINS pDevIns, PCDMARMEMREQIN pMemReqIn, PCDMARMEMREQAUX pMemReqAux,
2173	PDMARIOPAGE pIoPageOut)
2174	{
2175	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PCDMAR);
2176
2177	/* Sanity. */
2178	Assert(pIoPageOut);
2179	Assert(pMemReqIn->AddrRange.fPerm & (DMAR_PERM_READ \| DMAR_PERM_WRITE));
2180	Assert( pMemReqAux->fTtm == VTD_TTM_LEGACY_MODE
2181	\|\| pMemReqAux->fTtm == VTD_TTM_SCALABLE_MODE);
2182	Assert(!(pMemReqAux->GCPhysSlPt & X86_PAGE_4K_OFFSET_MASK));
2183
2184	/* Mask of reserved paging entry bits. */
2185	static uint64_t const s_auPtEntityInvMasks[] = { ~VTD_SL_PTE_VALID_MASK,
2186	~VTD_SL_PDE_VALID_MASK,
2187	~VTD_SL_PDPE_VALID_MASK,
2188	~VTD_SL_PML4E_VALID_MASK,
2189	~VTD_SL_PML5E_VALID_MASK };
2190
2191	/* Paranoia. */
2192	Assert(pMemReqAux->cPagingLevel >= 3 && pMemReqAux->cPagingLevel <= 5);
2193	AssertCompile(RT_ELEMENTS(s_auPtEntityInvMasks) == 5);
2194
2195	/* Second-level translations restricts input address to an implementation-specific MGAW. */
2196	uint64_t const uAddrIn = pMemReqIn->AddrRange.uAddr;
2197	if (!(uAddrIn & pThis->fMgawInvMask))
2198	{ /* likely */ }
2199	else
2200	{
2201	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_AddrIn_Invalid, pMemReqIn, pMemReqAux);
2202	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2203	}
2204
2205	/*
2206	* Traverse the I/O page table starting with the SLPTPTR (second-level page table pointer).
2207	* Unlike AMD IOMMU paging, here there is no feature for "skipping" levels.
2208	*/
2209	uint64_t uPtEntity = pMemReqAux->GCPhysSlPt;
2210	for (int8_t idxLevel = pMemReqAux->cPagingLevel - 1; idxLevel >= 0; idxLevel--)
2211	{
2212	/*
2213	* Read the paging entry for the current level.
2214	*/
2215	uint8_t const cLevelShift = X86_PAGE_4K_SHIFT + (idxLevel * 9);
2216	{
2217	uint16_t const idxPte = (uAddrIn >> cLevelShift) & UINT64_C(0x1ff);
2218	uint16_t const offPte = idxPte << 3;
2219	RTGCPHYS const GCPhysPtEntity = (uPtEntity & X86_PAGE_4K_BASE_MASK) \| offPte;
2220	int const rc = PDMDevHlpPhysReadMeta(pDevIns, GCPhysPtEntity, &uPtEntity, sizeof(uPtEntity));
2221	if (RT_SUCCESS(rc))
2222	{ /* likely */ }
2223	else
2224	{
2225	if ((GCPhysPtEntity & X86_PAGE_BASE_MASK) == pMemReqAux->GCPhysSlPt)
2226	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_Slpptr_Read_Failed, pMemReqIn, pMemReqAux);
2227	else
2228	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_Read_Pte_Failed, pMemReqIn, pMemReqAux);
2229	break;
2230	}
2231	}
2232
2233	/*
2234	* Check I/O permissions.
2235	* This must be done prior to check reserved bits for properly reporting errors SSL.2 and SSL.3.
2236	* See Intel spec. 7.1.3 "Fault conditions and Remapping hardware behavior for various request".
2237	*/
2238	uint8_t const fReqPerm = pMemReqIn->AddrRange.fPerm & pThis->fPermValidMask;
2239	uint8_t const fPtPerm = uPtEntity & pThis->fPermValidMask;
2240	Assert(!(fReqPerm & DMAR_PERM_EXE)); /* No Execute-requests support yet. */
2241	Assert(!(pThis->fExtCapReg & VTD_BF_ECAP_REG_SLADS_MASK)); /* No Second-level access/dirty support. */
2242	if ((fPtPerm & fReqPerm) == fReqPerm)
2243	{ /* likely */ }
2244	else
2245	{
2246	if ((fPtPerm & (VTD_BF_SL_PTE_R_MASK \| VTD_BF_SL_PTE_W_MASK)) == 0)
2247	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_Pte_Not_Present, pMemReqIn, pMemReqAux);
2248	else if ((pMemReqIn->AddrRange.fPerm & DMAR_PERM_READ) != (fPtPerm & VTD_BF_SL_PTE_R_MASK))
2249	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_Perm_Read_Denied, pMemReqIn, pMemReqAux);
2250	else
2251	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_Perm_Write_Denied, pMemReqIn, pMemReqAux);
2252	break;
2253	}
2254
2255	/*
2256	* Validate reserved bits of the current paging entry.
2257	*/
2258	if (!(uPtEntity & s_auPtEntityInvMasks[idxLevel]))
2259	{ /* likely */ }
2260	else
2261	{
2262	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_Pte_Rsvd, pMemReqIn, pMemReqAux);
2263	break;
2264	}
2265
2266	/*
2267	* Check if this is a 1GB page or a 2MB page.
2268	*/
2269	AssertCompile(VTD_BF_SL_PDE_PS_MASK == VTD_BF_SL_PDPE_PS_MASK);
2270	uint8_t const fLargePage = RT_BF_GET(uPtEntity, VTD_BF_SL_PDE_PS);
2271	if (fLargePage && idxLevel > 0)
2272	{
2273	Assert(idxLevel == 1 \|\| idxLevel == 2); /* Is guaranteed by the reserved bits check above. */
2274	uint8_t const fSllpsMask = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_SLLPS);
2275	if (fSllpsMask & RT_BIT(idxLevel - 1))
2276	{
2277	/*
2278	* We don't support MTS (asserted below), hence IPAT and EMT fields of the paging entity are ignored.
2279	* All other reserved bits are identical to the regular page-size paging entity which we've already
2280	* checked above.
2281	*/
2282	Assert(!(pThis->fExtCapReg & VTD_BF_ECAP_REG_MTS_MASK));
2283
2284	RTGCPHYS const GCPhysBase = uPtEntity & X86_GET_PAGE_BASE_MASK(cLevelShift);
2285	return dmarDrUpdateIoPageOut(pDevIns, GCPhysBase, cLevelShift, fPtPerm, pMemReqIn, pMemReqAux, pIoPageOut);
2286	}
2287
2288	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Xm_Pte_Sllps_Invalid, pMemReqIn, pMemReqAux);
2289	break;
2290	}
2291
2292	/*
2293	* If this is the final PTE, compute the translation address and we're done.
2294	*/
2295	if (idxLevel == 0)
2296	{
2297	RTGCPHYS const GCPhysBase = uPtEntity & X86_GET_PAGE_BASE_MASK(cLevelShift);
2298	return dmarDrUpdateIoPageOut(pDevIns, GCPhysBase, cLevelShift, fPtPerm, pMemReqIn, pMemReqAux, pIoPageOut);
2299	}
2300	}
2301
2302	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2303	}
2304
2305
2306	/**
2307	* Looks up the range of addresses for a DMA memory request remapping.
2308	*
2309	* @returns VBox status code.
2310	* @param pDevIns The IOMMU device instance.
2311	* @param pfnLookup The DMA address lookup function.
2312	* @param pMemReqRemap The DMA memory request remapping info.
2313	*/
2314	static int dmarDrMemRangeLookup(PPDMDEVINS pDevIns, PFNDMADDRLOOKUP pfnLookup, PDMARMEMREQREMAP pMemReqRemap)
2315	{
2316	AssertPtr(pfnLookup);
2317
2318	RTGCPHYS GCPhysAddrOut = NIL_RTGCPHYS;
2319	DMARMEMREQIN MemReqIn = pMemReqRemap->In;
2320	uint64_t const uAddrIn = MemReqIn.AddrRange.uAddr;
2321	size_t const cbAddrIn = MemReqIn.AddrRange.cb;
2322	uint64_t uAddrInBase = MemReqIn.AddrRange.uAddr & X86_PAGE_4K_BASE_MASK;
2323	uint64_t offAddrIn = MemReqIn.AddrRange.uAddr & X86_PAGE_4K_OFFSET_MASK;
2324	size_t cbRemaining = cbAddrIn;
2325	size_t const cbPage = X86_PAGE_4K_SIZE;
2326
2327	int rc;
2328	DMARIOPAGE IoPagePrev;
2329	RT_ZERO(IoPagePrev);
2330	for (;;)
2331	{
2332	/* Update the input memory request with the next address in our range that needs translation. */
2333	MemReqIn.AddrRange.uAddr = uAddrInBase;
2334	MemReqIn.AddrRange.cb = cbRemaining; /* Not currently accessed by pfnLookup, but keep things consistent. */
2335
2336	/* Lookup the physical page corresponding to the DMA virtual address. */
2337	DMARIOPAGE IoPage;
2338	rc = pfnLookup(pDevIns, &MemReqIn, &pMemReqRemap->Aux, &IoPage);
2339	if (RT_SUCCESS(rc))
2340	{
2341	/* Validate results of the translation. */
2342	Assert(IoPage.cShift >= X86_PAGE_4K_SHIFT && IoPage.cShift <= X86_PAGE_1G_SHIFT);
2343	Assert(!(IoPage.GCPhysBase & X86_GET_PAGE_OFFSET_MASK(IoPage.cShift)));
2344	Assert((IoPage.fPerm & MemReqIn.AddrRange.fPerm) == MemReqIn.AddrRange.fPerm);
2345
2346	/* Store the translated address and permissions before continuing to access more pages. */
2347	if (cbRemaining == cbAddrIn)
2348	{
2349	uint64_t const offAddrOut = uAddrIn & X86_GET_PAGE_OFFSET_MASK(IoPage.cShift);
2350	GCPhysAddrOut = IoPage.GCPhysBase \| offAddrOut;
2351	}
2352	/* Check if addresses translated so far result in a physically contiguous region. */
2353	/** @todo Ensure permissions are identical as well if we implementing IOTLB caching
2354	* that relies on it being so. */
2355	else if (IoPagePrev.GCPhysBase + cbPage == IoPage.GCPhysBase)
2356	{ /* likely */ }
2357	else
2358	{
2359	rc = VERR_OUT_OF_RANGE;
2360	break;
2361	}
2362
2363	/* Store the I/O page lookup from the first/previous access. */
2364	IoPagePrev = IoPage;
2365
2366	/* Check if we need to access more pages. */
2367	if (cbRemaining > cbPage - offAddrIn)
2368	{
2369	cbRemaining -= (cbPage - offAddrIn); /* Calculate how much more we need to access. */
2370	uAddrInBase += cbPage; /* Update address of the next access. */
2371	offAddrIn = 0; /* After the first page, remaining pages are accessed from offset 0. */
2372	}
2373	else
2374	{
2375	/* Caller (PDM) doesn't expect more data accessed than what was requested. */
2376	cbRemaining = 0;
2377	break;
2378	}
2379	}
2380	else
2381	break;
2382	}
2383
2384	pMemReqRemap->Out.AddrRange.uAddr = GCPhysAddrOut;
2385	pMemReqRemap->Out.AddrRange.cb = cbAddrIn - cbRemaining;
2386	pMemReqRemap->Out.AddrRange.fPerm = IoPagePrev.fPerm;
2387	return rc;
2388	}
2389
2390
2391	/**
2392	* Handles legacy mode DMA address remapping.
2393	*
2394	* @returns VBox status code.
2395	* @param pDevIns The IOMMU device instance.
2396	* @param uRtaddrReg The current RTADDR_REG value.
2397	* @param pMemReqRemap The DMA memory request remapping info.
2398	*/
2399	static int dmarDrLegacyModeRemapAddr(PPDMDEVINS pDevIns, uint64_t uRtaddrReg, PDMARMEMREQREMAP pMemReqRemap)
2400	{
2401	PCDMARMEMREQIN pMemReqIn = &pMemReqRemap->In;
2402	PDMARMEMREQAUX pMemReqAux = &pMemReqRemap->Aux;
2403	PDMARMEMREQOUT pMemReqOut = &pMemReqRemap->Out;
2404	Assert(pMemReqAux->fTtm == VTD_TTM_LEGACY_MODE); /* Paranoia. */
2405
2406	/* Read the root-entry from guest memory. */
2407	uint8_t const idxRootEntry = RT_HI_U8(pMemReqIn->idDevice);
2408	VTD_ROOT_ENTRY_T RootEntry;
2409	int rc = dmarDrReadRootEntry(pDevIns, uRtaddrReg, idxRootEntry, &RootEntry);
2410	if (RT_SUCCESS(rc))
2411	{
2412	/* Check if the root entry is present (must be done before validating reserved bits). */
2413	uint64_t const uRootEntryQword0 = RootEntry.au64[0];
2414	uint64_t const uRootEntryQword1 = RootEntry.au64[1];
2415	bool const fRootEntryPresent = RT_BF_GET(uRootEntryQword0, VTD_BF_0_ROOT_ENTRY_P);
2416	if (fRootEntryPresent)
2417	{
2418	/* Validate reserved bits in the root entry. */
2419	if ( !(uRootEntryQword0 & ~VTD_ROOT_ENTRY_0_VALID_MASK)
2420	&& !(uRootEntryQword1 & ~VTD_ROOT_ENTRY_1_VALID_MASK))
2421	{
2422	/* Read the context-entry from guest memory. */
2423	RTGCPHYS const GCPhysCtxTable = uRootEntryQword0 & VTD_BF_0_ROOT_ENTRY_CTP_MASK;
2424	uint8_t const idxCtxEntry = RT_LO_U8(pMemReqIn->idDevice);
2425	VTD_CONTEXT_ENTRY_T CtxEntry;
2426	rc = dmarDrReadCtxEntry(pDevIns, GCPhysCtxTable, idxCtxEntry, &CtxEntry);
2427	if (RT_SUCCESS(rc))
2428	{
2429	uint64_t const uCtxEntryQword0 = CtxEntry.au64[0];
2430	uint64_t const uCtxEntryQword1 = CtxEntry.au64[1];
2431
2432	/* Note the FPD bit which software can use to supress translation faults from here on in. */
2433	pMemReqAux->fFpd = RT_BF_GET(uCtxEntryQword0, VTD_BF_0_CONTEXT_ENTRY_FPD);
2434
2435	/* Check if the context-entry is present (must be done before validating reserved bits). */
2436	bool const fCtxEntryPresent = RT_BF_GET(uCtxEntryQword0, VTD_BF_0_CONTEXT_ENTRY_P);
2437	if (fCtxEntryPresent)
2438	{
2439	/* Validate reserved bits in the context-entry. */
2440	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PCDMAR);
2441	if ( !(uCtxEntryQword0 & ~VTD_CONTEXT_ENTRY_0_VALID_MASK)
2442	&& !(uCtxEntryQword1 & ~pThis->fCtxEntryQw1ValidMask))
2443	{
2444	/* Get the domain ID for this mapping. */
2445	pMemReqOut->idDomain = RT_BF_GET(uCtxEntryQword1, VTD_BF_1_CONTEXT_ENTRY_DID);
2446
2447	/* Validate the translation type (TT). */
2448	uint8_t const fTt = RT_BF_GET(uCtxEntryQword0, VTD_BF_0_CONTEXT_ENTRY_TT);
2449	switch (fTt)
2450	{
2451	case VTD_TT_UNTRANSLATED_SLP:
2452	{
2453	/*
2454	* Untranslated requests are translated using second-level paging structures referenced
2455	* through SLPTPTR. Translated requests and Translation Requests are blocked.
2456	*/
2457	if (pMemReqIn->enmAddrType == PCIADDRTYPE_UNTRANSLATED)
2458	{
2459	/* Validate the address width and get the paging level. */
2460	uint8_t cPagingLevel;
2461	if (dmarDrLegacyModeIsAwValid(pThis, &CtxEntry, &cPagingLevel))
2462	{
2463	/*
2464	* The second-level page table is located at the physical address specified
2465	* in the context entry with which we can finally perform second-level translation.
2466	*/
2467	pMemReqAux->cPagingLevel = cPagingLevel;
2468	pMemReqAux->GCPhysSlPt = uCtxEntryQword0 & VTD_BF_0_CONTEXT_ENTRY_SLPTPTR_MASK;
2469	rc = dmarDrMemRangeLookup(pDevIns, dmarDrSecondLevelTranslate, pMemReqRemap);
2470	if (rc == VERR_OUT_OF_RANGE)
2471	rc = VINF_SUCCESS;
2472	return rc;
2473	}
2474	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_Ut_Aw_Invalid, pMemReqIn, pMemReqAux);
2475	}
2476	else
2477	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_Ut_At_Block, pMemReqIn, pMemReqAux);
2478	break;
2479	}
2480
2481	case VTD_TT_UNTRANSLATED_PT:
2482	{
2483	/*
2484	* Untranslated requests are processed as pass-through (PT) if PT is supported.
2485	* Translated and translation requests are blocked. If PT isn't supported this TT value
2486	* is reserved which I assume raises a fault (hence fallthru below).
2487	*/
2488	if (pThis->fExtCapReg & VTD_BF_ECAP_REG_PT_MASK)
2489	{
2490	if (pMemReqRemap->In.enmAddrType == PCIADDRTYPE_UNTRANSLATED)
2491	{
2492	if (dmarDrLegacyModeIsAwValid(pThis, &CtxEntry, NULL /* pcPagingLevel */))
2493	{
2494	PDMARMEMREQOUT pOut = &pMemReqRemap->Out;
2495	PCDMARMEMREQIN pIn = &pMemReqRemap->In;
2496	pOut->AddrRange.uAddr = pIn->AddrRange.uAddr;
2497	pOut->AddrRange.cb = pIn->AddrRange.cb;
2498	pOut->AddrRange.fPerm = DMAR_PERM_ALL;
2499	return VINF_SUCCESS;
2500	}
2501	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_Pt_Aw_Invalid, pMemReqIn, pMemReqAux);
2502	}
2503	else
2504	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_Pt_At_Block, pMemReqIn, pMemReqAux);
2505	break;
2506	}
2507	RT_FALL_THRU();
2508	}
2509
2510	case VTD_TT_UNTRANSLATED_DEV_TLB:
2511	{
2512	/*
2513	* Untranslated, translated and translation requests are supported but requires
2514	* device-TLB support. We don't support device-TLBs, so it's treated as reserved.
2515	*/
2516	Assert(!(pThis->fExtCapReg & VTD_BF_ECAP_REG_DT_MASK));
2517	RT_FALL_THRU();
2518	}
2519
2520	default:
2521	{
2522	/* Any other TT value is reserved. */
2523	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_Tt_Invalid, pMemReqIn, pMemReqAux);
2524	break;
2525	}
2526	}
2527	}
2528	else
2529	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_CtxEntry_Rsvd, pMemReqIn, pMemReqAux);
2530	}
2531	else
2532	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_CtxEntry_Not_Present, pMemReqIn, pMemReqAux);
2533	}
2534	else
2535	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_CtxEntry_Read_Failed, pMemReqIn, pMemReqAux);
2536	}
2537	else
2538	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_RootEntry_Rsvd, pMemReqIn, pMemReqAux);
2539	}
2540	else
2541	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_RootEntry_Not_Present, pMemReqIn, pMemReqAux);
2542	}
2543	else
2544	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Lm_RootEntry_Read_Failed, pMemReqIn, pMemReqAux);
2545	return VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2546	}
2547
2548
2549	/**
2550	* Handles remapping of DMA address requests in scalable mode.
2551	*
2552	* @returns VBox status code.
2553	* @param pDevIns The IOMMU device instance.
2554	* @param uRtaddrReg The current RTADDR_REG value.
2555	* @param pMemReqRemap The DMA memory request remapping info.
2556	*/
2557	static int dmarDrScalableModeRemapAddr(PPDMDEVINS pDevIns, uint64_t uRtaddrReg, PDMARMEMREQREMAP pMemReqRemap)
2558	{
2559	RT_NOREF3(pDevIns, uRtaddrReg, pMemReqRemap);
2560	return VERR_NOT_IMPLEMENTED;
2561	}
2562
2563
2564	/**
2565	* Gets the DMA access permissions and the address-translation request
2566	* type given the PDM IOMMU memory access flags.
2567	*
2568	* @param pDevIns The IOMMU device instance.
2569	* @param fFlags The access flags, see PDMIOMMU_MEM_F_XXX.
2570	* @param fBulk Whether this is a bulk memory access (used for
2571	* statistics).
2572	* @param penmReqType Where to store the address-translation request type.
2573	* @param pfReqPerm Where to store the DMA access permissions.
2574	*/
2575	static void dmarDrGetPermAndReqType(PPDMDEVINS pDevIns, uint32_t fFlags, bool fBulk, PVTDREQTYPE penmReqType, uint8_t *pfReqPerm)
2576	{
2577	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
2578	if (fFlags & PDMIOMMU_MEM_F_READ)
2579	{
2580	*penmReqType = VTDREQTYPE_READ;
2581	*pfReqPerm = DMAR_PERM_READ;
2582	#ifdef VBOX_WITH_STATISTICS
2583	if (!fBulk)
2584	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMemRead));
2585	else
2586	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMemBulkRead));
2587	#else
2588	RT_NOREF2(pThis, fBulk);
2589	#endif
2590	}
2591	else
2592	{
2593	*penmReqType = VTDREQTYPE_WRITE;
2594	*pfReqPerm = DMAR_PERM_WRITE;
2595	#ifdef VBOX_WITH_STATISTICS
2596	if (!fBulk)
2597	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMemWrite));
2598	else
2599	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMemBulkWrite));
2600	#else
2601	RT_NOREF2(pThis, fBulk);
2602	#endif
2603	}
2604	}
2605
2606
2607	/**
2608	* Handles DMA remapping based on the table translation mode (TTM).
2609	*
2610	* @returns VBox status code.
2611	* @param pDevIns The IOMMU device instance.
2612	* @param uRtaddrReg The current RTADDR_REG value.
2613	* @param pMemReqRemap The DMA memory request remapping info.
2614	*/
2615	static int dmarDrMemReqRemap(PPDMDEVINS pDevIns, uint64_t uRtaddrReg, PDMARMEMREQREMAP pMemReqRemap)
2616	{
2617	int rc;
2618	switch (pMemReqRemap->Aux.fTtm)
2619	{
2620	case VTD_TTM_LEGACY_MODE:
2621	{
2622	rc = dmarDrLegacyModeRemapAddr(pDevIns, uRtaddrReg, pMemReqRemap);
2623	break;
2624	}
2625
2626	case VTD_TTM_SCALABLE_MODE:
2627	{
2628	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PCDMAR);
2629	if (pThis->fExtCapReg & VTD_BF_ECAP_REG_SMTS_MASK)
2630	rc = dmarDrScalableModeRemapAddr(pDevIns, uRtaddrReg, pMemReqRemap);
2631	else
2632	{
2633	rc = VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2634	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Rta_Smts_Not_Supported, &pMemReqRemap->In, &pMemReqRemap->Aux);
2635	}
2636	break;
2637	}
2638
2639	case VTD_TTM_ABORT_DMA_MODE:
2640	{
2641	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PCDMAR);
2642	if (pThis->fExtCapReg & VTD_BF_ECAP_REG_ADMS_MASK)
2643	dmarDrTargetAbort(pDevIns);
2644	else
2645	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Rta_Adms_Not_Supported, &pMemReqRemap->In, &pMemReqRemap->Aux);
2646	rc = VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2647	break;
2648	}
2649
2650	default:
2651	{
2652	rc = VERR_IOMMU_ADDR_TRANSLATION_FAILED;
2653	dmarAtFaultRecord(pDevIns, kDmarDiag_At_Rta_Rsvd, &pMemReqRemap->In, &pMemReqRemap->Aux);
2654	break;
2655	}
2656	}
2657	return rc;
2658	}
2659
2660
2661	/**
2662	* Memory access bulk (one or more 4K pages) request from a device.
2663	*
2664	* @returns VBox status code.
2665	* @param pDevIns The IOMMU device instance.
2666	* @param idDevice The device ID (bus, device, function).
2667	* @param cIovas The number of addresses being accessed.
2668	* @param pauIovas The I/O virtual addresses for each page being accessed.
2669	* @param fFlags The access flags, see PDMIOMMU_MEM_F_XXX.
2670	* @param paGCPhysSpa Where to store the translated physical addresses.
2671	*
2672	* @thread Any.
2673	*/
2674	static DECLCALLBACK(int) iommuIntelMemBulkAccess(PPDMDEVINS pDevIns, uint16_t idDevice, size_t cIovas, uint64_t const *pauIovas,
2675	uint32_t fFlags, PRTGCPHYS paGCPhysSpa)
2676	{
2677	/* Validate. */
2678	AssertPtr(pDevIns);
2679	Assert(cIovas > 0);
2680	AssertPtr(pauIovas);
2681	AssertPtr(paGCPhysSpa);
2682	Assert(!(fFlags & ~PDMIOMMU_MEM_F_VALID_MASK));
2683
2684	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
2685	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
2686
2687	DMAR_LOCK(pDevIns, pThisCC);
2688	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
2689	uint64_t const uRtaddrReg = pThis->uRtaddrReg;
2690	DMAR_UNLOCK(pDevIns, pThisCC);
2691
2692	if (uGstsReg & VTD_BF_GSTS_REG_TES_MASK)
2693	{
2694	VTDREQTYPE enmReqType;
2695	uint8_t fReqPerm;
2696	dmarDrGetPermAndReqType(pDevIns, fFlags, true /* fBulk */, &enmReqType, &fReqPerm);
2697
2698	DMARMEMREQREMAP MemReqRemap;
2699	RT_ZERO(MemReqRemap);
2700	MemReqRemap.In.AddrRange.cb = X86_PAGE_SIZE;
2701	MemReqRemap.In.AddrRange.fPerm = fReqPerm;
2702	MemReqRemap.In.idDevice = idDevice;
2703	MemReqRemap.In.Pasid = NIL_PCIPASID;
2704	MemReqRemap.In.enmAddrType = PCIADDRTYPE_UNTRANSLATED;
2705	MemReqRemap.In.enmReqType = enmReqType;
2706	MemReqRemap.Aux.fTtm = RT_BF_GET(uRtaddrReg, VTD_BF_RTADDR_REG_TTM);
2707	MemReqRemap.Out.AddrRange.uAddr = NIL_RTGCPHYS;
2708
2709	for (size_t i = 0; i < cIovas; i++)
2710	{
2711	MemReqRemap.In.AddrRange.uAddr = pauIovas[i] & X86_PAGE_BASE_MASK;
2712	int const rc = dmarDrMemReqRemap(pDevIns, uRtaddrReg, &MemReqRemap);
2713	if (RT_SUCCESS(rc))
2714	{
2715	paGCPhysSpa[i] = MemReqRemap.Out.AddrRange.uAddr \| (pauIovas[i] & X86_PAGE_OFFSET_MASK);
2716	Assert(MemReqRemap.Out.AddrRange.cb == MemReqRemap.In.AddrRange.cb);
2717	}
2718	else
2719	{
2720	LogFlowFunc(("idDevice=%#x uIova=%#RX64 fPerm=%#x rc=%Rrc\n", idDevice, pauIovas[i], fReqPerm, rc));
2721	return rc;
2722	}
2723	}
2724	}
2725	else
2726	{
2727	/* Addresses are forwarded without translation when the translation is disabled. */
2728	for (size_t i = 0; i < cIovas; i++)
2729	paGCPhysSpa[i] = pauIovas[i];
2730	}
2731
2732	return VINF_SUCCESS;
2733	}
2734
2735
2736	/**
2737	* Memory access transaction from a device.
2738	*
2739	* @returns VBox status code.
2740	* @param pDevIns The IOMMU device instance.
2741	* @param idDevice The device ID (bus, device, function).
2742	* @param uIova The I/O virtual address being accessed.
2743	* @param cbIova The size of the access.
2744	* @param fFlags The access flags, see PDMIOMMU_MEM_F_XXX.
2745	* @param pGCPhysSpa Where to store the translated system physical address.
2746	* @param pcbContiguous Where to store the number of contiguous bytes translated
2747	* and permission-checked.
2748	*
2749	* @thread Any.
2750	*/
2751	static DECLCALLBACK(int) iommuIntelMemAccess(PPDMDEVINS pDevIns, uint16_t idDevice, uint64_t uIova, size_t cbIova,
2752	uint32_t fFlags, PRTGCPHYS pGCPhysSpa, size_t *pcbContiguous)
2753	{
2754	/* Validate. */
2755	AssertPtr(pDevIns);
2756	AssertPtr(pGCPhysSpa);
2757	AssertPtr(pcbContiguous);
2758	Assert(cbIova > 0); /** @todo Are we going to support ZLR (zero-length reads to write-only pages)? */
2759	Assert(!(fFlags & ~PDMIOMMU_MEM_F_VALID_MASK));
2760
2761	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
2762	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
2763
2764	DMAR_LOCK(pDevIns, pThisCC);
2765	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
2766	uint64_t const uRtaddrReg = pThis->uRtaddrReg;
2767	DMAR_UNLOCK(pDevIns, pThisCC);
2768
2769	if (uGstsReg & VTD_BF_GSTS_REG_TES_MASK)
2770	{
2771	VTDREQTYPE enmReqType;
2772	uint8_t fReqPerm;
2773	dmarDrGetPermAndReqType(pDevIns, fFlags, false /* fBulk */, &enmReqType, &fReqPerm);
2774
2775	DMARMEMREQREMAP MemReqRemap;
2776	RT_ZERO(MemReqRemap);
2777	MemReqRemap.In.AddrRange.uAddr = uIova;
2778	MemReqRemap.In.AddrRange.cb = cbIova;
2779	MemReqRemap.In.AddrRange.fPerm = fReqPerm;
2780	MemReqRemap.In.idDevice = idDevice;
2781	MemReqRemap.In.Pasid = NIL_PCIPASID;
2782	MemReqRemap.In.enmAddrType = PCIADDRTYPE_UNTRANSLATED;
2783	MemReqRemap.In.enmReqType = enmReqType;
2784	MemReqRemap.Aux.fTtm = RT_BF_GET(uRtaddrReg, VTD_BF_RTADDR_REG_TTM);
2785	MemReqRemap.Out.AddrRange.uAddr = NIL_RTGCPHYS;
2786
2787	int const rc = dmarDrMemReqRemap(pDevIns, uRtaddrReg, &MemReqRemap);
2788	*pGCPhysSpa = MemReqRemap.Out.AddrRange.uAddr;
2789	*pcbContiguous = MemReqRemap.Out.AddrRange.cb;
2790	return rc;
2791	}
2792
2793	*pGCPhysSpa = uIova;
2794	*pcbContiguous = cbIova;
2795	return VINF_SUCCESS;
2796	}
2797
2798
2799	/**
2800	* Reads an IRTE from guest memory.
2801	*
2802	* @returns VBox status code.
2803	* @param pDevIns The IOMMU device instance.
2804	* @param uIrtaReg The IRTA_REG.
2805	* @param idxIntr The interrupt index.
2806	* @param pIrte Where to store the read IRTE.
2807	*/
2808	static int dmarIrReadIrte(PPDMDEVINS pDevIns, uint64_t uIrtaReg, uint16_t idxIntr, PVTD_IRTE_T pIrte)
2809	{
2810	Assert(idxIntr < VTD_IRTA_REG_GET_ENTRY_COUNT(uIrtaReg));
2811
2812	size_t const cbIrte = sizeof(*pIrte);
2813	RTGCPHYS const GCPhysIrte = (uIrtaReg & VTD_BF_IRTA_REG_IRTA_MASK) + (idxIntr * cbIrte);
2814	return PDMDevHlpPhysReadMeta(pDevIns, GCPhysIrte, pIrte, cbIrte);
2815	}
2816
2817
2818	/**
2819	* Remaps the source MSI to the destination MSI given the IRTE.
2820	*
2821	* @param fExtIntrMode Whether extended interrupt mode is enabled (i.e
2822	* IRTA_REG.EIME).
2823	* @param pIrte The IRTE used for the remapping.
2824	* @param pMsiIn The source MSI (currently unused).
2825	* @param pMsiOut Where to store the remapped MSI.
2826	*/
2827	static void dmarIrRemapFromIrte(bool fExtIntrMode, PCVTD_IRTE_T pIrte, PCMSIMSG pMsiIn, PMSIMSG pMsiOut)
2828	{
2829	NOREF(pMsiIn);
2830	uint64_t const uIrteQword0 = pIrte->au64[0];
2831
2832	/*
2833	* Let's start with a clean slate and preserve unspecified bits if the need arises.
2834	* For instance, address bits 1:0 is supposed to be "ignored" by remapping hardware,
2835	* but it's not clear if hardware zeroes out these bits in the remapped MSI or if
2836	* it copies it from the source MSI.
2837	*/
2838	RT_ZERO(*pMsiOut);
2839	pMsiOut->Addr.n.u1DestMode = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_DM);
2840	pMsiOut->Addr.n.u1RedirHint = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_RH);
2841	pMsiOut->Addr.n.u12Addr = VBOX_MSI_ADDR_BASE >> VBOX_MSI_ADDR_SHIFT;
2842	if (fExtIntrMode)
2843	{
2844	/*
2845	* Apparently the DMAR stuffs the high 24-bits of the destination ID into the
2846	* high 24-bits of the upper 32-bits of the message address, see @bugref{9967#c22}.
2847	*/
2848	uint32_t const idDest = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_DST);
2849	pMsiOut->Addr.n.u8DestId = idDest;
2850	pMsiOut->Addr.n.u32Rsvd0 = idDest & UINT32_C(0xffffff00);
2851	}
2852	else
2853	pMsiOut->Addr.n.u8DestId = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_DST_XAPIC);
2854
2855	pMsiOut->Data.n.u8Vector = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_V);
2856	pMsiOut->Data.n.u3DeliveryMode = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_DLM);
2857	pMsiOut->Data.n.u1Level = 1;
2858	pMsiOut->Data.n.u1TriggerMode = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_TM);
2859	}
2860
2861
2862	/**
2863	* Handles remapping of interrupts in remappable interrupt format.
2864	*
2865	* @returns VBox status code.
2866	* @param pDevIns The IOMMU device instance.
2867	* @param uIrtaReg The IRTA_REG.
2868	* @param idDevice The device ID (bus, device, function).
2869	* @param pMsiIn The source MSI.
2870	* @param pMsiOut Where to store the remapped MSI.
2871	*/
2872	static int dmarIrRemapIntr(PPDMDEVINS pDevIns, uint64_t uIrtaReg, uint16_t idDevice, PCMSIMSG pMsiIn, PMSIMSG pMsiOut)
2873	{
2874	Assert(pMsiIn->Addr.dmar_remap.fIntrFormat == VTD_INTR_FORMAT_REMAPPABLE);
2875
2876	/* Validate reserved bits in the interrupt request. */
2877	AssertCompile(VTD_REMAPPABLE_MSI_ADDR_VALID_MASK == UINT32_MAX);
2878	if (!(pMsiIn->Data.u32 & ~VTD_REMAPPABLE_MSI_DATA_VALID_MASK))
2879	{
2880	/* Compute the index into the interrupt remap table. */
2881	uint16_t const uHandleHi = RT_BF_GET(pMsiIn->Addr.au32[0], VTD_BF_REMAPPABLE_MSI_ADDR_HANDLE_HI);
2882	uint16_t const uHandleLo = RT_BF_GET(pMsiIn->Addr.au32[0], VTD_BF_REMAPPABLE_MSI_ADDR_HANDLE_LO);
2883	uint16_t const uHandle = uHandleLo \| (uHandleHi << 15);
2884	bool const fSubHandleValid = RT_BF_GET(pMsiIn->Addr.au32[0], VTD_BF_REMAPPABLE_MSI_ADDR_SHV);
2885	uint16_t const idxIntr = fSubHandleValid
2886	? uHandle + RT_BF_GET(pMsiIn->Data.u32, VTD_BF_REMAPPABLE_MSI_DATA_SUBHANDLE)
2887	: uHandle;
2888
2889	/* Validate the index. */
2890	uint32_t const cEntries = VTD_IRTA_REG_GET_ENTRY_COUNT(uIrtaReg);
2891	if (idxIntr < cEntries)
2892	{
2893	/** @todo Implement and read IRTE from interrupt-entry cache here. */
2894
2895	/* Read the interrupt remap table entry (IRTE) at the index. */
2896	VTD_IRTE_T Irte;
2897	int rc = dmarIrReadIrte(pDevIns, uIrtaReg, idxIntr, &Irte);
2898	if (RT_SUCCESS(rc))
2899	{
2900	/* Check if the IRTE is present (this must be done -before- checking reserved bits). */
2901	uint64_t const uIrteQword0 = Irte.au64[0];
2902	uint64_t const uIrteQword1 = Irte.au64[1];
2903	bool const fPresent = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_P);
2904	if (fPresent)
2905	{
2906	/* Validate reserved bits in the IRTE. */
2907	bool const fExtIntrMode = RT_BF_GET(uIrtaReg, VTD_BF_IRTA_REG_EIME);
2908	uint64_t const fQw0ValidMask = fExtIntrMode ? VTD_IRTE_0_X2APIC_VALID_MASK : VTD_IRTE_0_XAPIC_VALID_MASK;
2909	if ( !(uIrteQword0 & ~fQw0ValidMask)
2910	&& !(uIrteQword1 & ~VTD_IRTE_1_VALID_MASK))
2911	{
2912	/* Validate requester id (the device ID) as configured in the IRTE. */
2913	bool fSrcValid;
2914	DMARDIAG enmIrDiag;
2915	uint8_t const fSvt = RT_BF_GET(uIrteQword1, VTD_BF_1_IRTE_SVT);
2916	switch (fSvt)
2917	{
2918	case VTD_IRTE_SVT_NONE:
2919	{
2920	fSrcValid = true;
2921	enmIrDiag = kDmarDiag_None;
2922	break;
2923	}
2924
2925	case VTD_IRTE_SVT_VALIDATE_MASK:
2926	{
2927	static uint16_t const s_afValidMasks[] = { 0xffff, 0xfffb, 0xfff9, 0xfff8 };
2928	uint8_t const idxMask = RT_BF_GET(uIrteQword1, VTD_BF_1_IRTE_SQ) & 3;
2929	uint16_t const fValidMask = s_afValidMasks[idxMask];
2930	uint16_t const idSource = RT_BF_GET(uIrteQword1, VTD_BF_1_IRTE_SID);
2931	fSrcValid = (idDevice & fValidMask) == (idSource & fValidMask);
2932	enmIrDiag = kDmarDiag_Ir_Rfi_Irte_Svt_Masked;
2933	break;
2934	}
2935
2936	case VTD_IRTE_SVT_VALIDATE_BUS_RANGE:
2937	{
2938	uint16_t const idSource = RT_BF_GET(uIrteQword1, VTD_BF_1_IRTE_SID);
2939	uint8_t const uBusFirst = RT_HI_U8(idSource);
2940	uint8_t const uBusLast = RT_LO_U8(idSource);
2941	uint8_t const idDeviceBus = idDevice >> VBOX_PCI_BUS_SHIFT;
2942	fSrcValid = (idDeviceBus >= uBusFirst && idDeviceBus <= uBusLast);
2943	enmIrDiag = kDmarDiag_Ir_Rfi_Irte_Svt_Bus;
2944	break;
2945	}
2946
2947	default:
2948	{
2949	fSrcValid = false;
2950	enmIrDiag = kDmarDiag_Ir_Rfi_Irte_Svt_Rsvd;
2951	break;
2952	}
2953	}
2954
2955	if (fSrcValid)
2956	{
2957	uint8_t const fPostedMode = RT_BF_GET(uIrteQword0, VTD_BF_0_IRTE_IM);
2958	if (!fPostedMode)
2959	{
2960	dmarIrRemapFromIrte(fExtIntrMode, &Irte, pMsiIn, pMsiOut);
2961	return VINF_SUCCESS;
2962	}
2963	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Rfi_Irte_Mode_Invalid, idDevice, idxIntr, &Irte);
2964	}
2965	else
2966	dmarIrFaultRecord(pDevIns, enmIrDiag, idDevice, idxIntr, &Irte);
2967	}
2968	else
2969	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Rfi_Irte_Rsvd, idDevice, idxIntr, &Irte);
2970	}
2971	else
2972	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Rfi_Irte_Not_Present, idDevice, idxIntr, &Irte);
2973	}
2974	else
2975	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Rfi_Irte_Read_Failed, idDevice, idxIntr, NULL /* pIrte */);
2976	}
2977	else
2978	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Rfi_Intr_Index_Invalid, idDevice, idxIntr, NULL /* pIrte */);
2979	}
2980	else
2981	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Rfi_Rsvd, idDevice, 0 /* idxIntr /, NULL / pIrte */);
2982	return VERR_IOMMU_INTR_REMAP_DENIED;
2983	}
2984
2985
2986	/**
2987	* Interrupt remap request from a device.
2988	*
2989	* @returns VBox status code.
2990	* @param pDevIns The IOMMU device instance.
2991	* @param idDevice The device ID (bus, device, function).
2992	* @param pMsiIn The source MSI.
2993	* @param pMsiOut Where to store the remapped MSI.
2994	*/
2995	static DECLCALLBACK(int) iommuIntelMsiRemap(PPDMDEVINS pDevIns, uint16_t idDevice, PCMSIMSG pMsiIn, PMSIMSG pMsiOut)
2996	{
2997	/* Validate. */
2998	Assert(pDevIns);
2999	Assert(pMsiIn);
3000	Assert(pMsiOut);
3001	RT_NOREF1(idDevice);
3002
3003	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3004	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
3005
3006	/* Lock and read all registers required for interrupt remapping up-front. */
3007	DMAR_LOCK(pDevIns, pThisCC);
3008	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
3009	uint64_t const uIrtaReg = pThis->uIrtaReg;
3010	DMAR_UNLOCK(pDevIns, pThisCC);
3011
3012	/* Check if interrupt remapping is enabled. */
3013	if (uGstsReg & VTD_BF_GSTS_REG_IRES_MASK)
3014	{
3015	bool const fIsRemappable = RT_BF_GET(pMsiIn->Addr.au32[0], VTD_BF_REMAPPABLE_MSI_ADDR_INTR_FMT);
3016	if (!fIsRemappable)
3017	{
3018	/* Handle compatibility format interrupts. */
3019	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMsiRemapCfi));
3020
3021	/* If EIME is enabled or CFIs are disabled, block the interrupt. */
3022	if ( (uIrtaReg & VTD_BF_IRTA_REG_EIME_MASK)
3023	\|\| !(uGstsReg & VTD_BF_GSTS_REG_CFIS_MASK))
3024	{
3025	dmarIrFaultRecord(pDevIns, kDmarDiag_Ir_Cfi_Blocked, VTDIRFAULT_CFI_BLOCKED, idDevice, 0 /* idxIntr */);
3026	return VERR_IOMMU_INTR_REMAP_DENIED;
3027	}
3028
3029	/* Interrupt isn't subject to remapping, pass-through the interrupt. */
3030	pMsiOut = pMsiIn;
3031	return VINF_SUCCESS;
3032	}
3033
3034	/* Handle remappable format interrupts. */
3035	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMsiRemapRfi));
3036	return dmarIrRemapIntr(pDevIns, uIrtaReg, idDevice, pMsiIn, pMsiOut);
3037	}
3038
3039	/* Interrupt-remapping isn't enabled, all interrupts are pass-through. */
3040	pMsiOut = pMsiIn;
3041	return VINF_SUCCESS;
3042	}
3043
3044
3045	/**
3046	* @callback_method_impl{FNIOMMMIONEWWRITE}
3047	*/
3048	static DECLCALLBACK(VBOXSTRICTRC) dmarMmioWrite(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void const pv, unsigned cb)
3049	{
3050	RT_NOREF1(pvUser);
3051	DMAR_ASSERT_MMIO_ACCESS_RET(off, cb);
3052
3053	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3054	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMmioWrite));
3055
3056	uint16_t const offReg = off;
3057	uint16_t const offLast = offReg + cb - 1;
3058	if (DMAR_IS_MMIO_OFF_VALID(offLast))
3059	{
3060	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
3061	DMAR_LOCK_RET(pDevIns, pThisCC, VINF_IOM_R3_MMIO_WRITE);
3062
3063	uint64_t uPrev = 0;
3064	uint64_t const uRegWritten = cb == 8 ? dmarRegWrite64(pThis, offReg, (uint64_t )pv, &uPrev)
3065	: dmarRegWrite32(pThis, offReg, (uint32_t )pv, (uint32_t *)&uPrev);
3066	VBOXSTRICTRC rcStrict = VINF_SUCCESS;
3067	switch (off)
3068	{
3069	case VTD_MMIO_OFF_GCMD_REG: /* 32-bit */
3070	{
3071	rcStrict = dmarGcmdRegWrite(pDevIns, uRegWritten);
3072	break;
3073	}
3074
3075	case VTD_MMIO_OFF_CCMD_REG: /* 64-bit */
3076	case VTD_MMIO_OFF_CCMD_REG + 4:
3077	{
3078	rcStrict = dmarCcmdRegWrite(pDevIns, offReg, cb, uRegWritten);
3079	break;
3080	}
3081
3082	case VTD_MMIO_OFF_FSTS_REG: /* 32-bit */
3083	{
3084	rcStrict = dmarFstsRegWrite(pDevIns, uRegWritten, uPrev);
3085	break;
3086	}
3087
3088	case VTD_MMIO_OFF_FECTL_REG: /* 32-bit */
3089	{
3090	rcStrict = dmarFectlRegWrite(pDevIns, uRegWritten);
3091	break;
3092	}
3093
3094	case VTD_MMIO_OFF_IQT_REG: /* 64-bit */
3095	/* VTD_MMIO_OFF_IQT_REG + 4: / / High 32-bits reserved. */
3096	{
3097	rcStrict = dmarIqtRegWrite(pDevIns, offReg, uRegWritten);
3098	break;
3099	}
3100
3101	case VTD_MMIO_OFF_IQA_REG: /* 64-bit */
3102	/* VTD_MMIO_OFF_IQA_REG + 4: / / High 32-bits data. */
3103	{
3104	rcStrict = dmarIqaRegWrite(pDevIns, offReg, uRegWritten);
3105	break;
3106	}
3107
3108	case VTD_MMIO_OFF_ICS_REG: /* 32-bit */
3109	{
3110	rcStrict = dmarIcsRegWrite(pDevIns, uRegWritten);
3111	break;
3112	}
3113
3114	case VTD_MMIO_OFF_IECTL_REG: /* 32-bit */
3115	{
3116	rcStrict = dmarIectlRegWrite(pDevIns, uRegWritten);
3117	break;
3118	}
3119
3120	case DMAR_MMIO_OFF_FRCD_HI_REG: /* 64-bit */
3121	case DMAR_MMIO_OFF_FRCD_HI_REG + 4:
3122	{
3123	rcStrict = dmarFrcdHiRegWrite(pDevIns, offReg, cb, uRegWritten, uPrev);
3124	break;
3125	}
3126	}
3127
3128	DMAR_UNLOCK(pDevIns, pThisCC);
3129	LogFlowFunc(("offReg=%#x uRegWritten=%#RX64 rc=%Rrc\n", offReg, uRegWritten, VBOXSTRICTRC_VAL(rcStrict)));
3130	return rcStrict;
3131	}
3132
3133	return VINF_IOM_MMIO_UNUSED_FF;
3134	}
3135
3136
3137	/**
3138	* @callback_method_impl{FNIOMMMIONEWREAD}
3139	*/
3140	static DECLCALLBACK(VBOXSTRICTRC) dmarMmioRead(PPDMDEVINS pDevIns, void pvUser, RTGCPHYS off, void pv, unsigned cb)
3141	{
3142	RT_NOREF1(pvUser);
3143	DMAR_ASSERT_MMIO_ACCESS_RET(off, cb);
3144
3145	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3146	STAM_COUNTER_INC(&pThis->CTX_SUFF_Z(StatMmioRead));
3147
3148	uint16_t const offReg = off;
3149	uint16_t const offLast = offReg + cb - 1;
3150	if (DMAR_IS_MMIO_OFF_VALID(offLast))
3151	{
3152	PCDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARCC);
3153	DMAR_LOCK_RET(pDevIns, pThisCC, VINF_IOM_R3_MMIO_READ);
3154
3155	if (cb == 8)
3156	{
3157	(uint64_t )pv = dmarRegRead64(pThis, offReg);
3158	LogFlowFunc(("offReg=%#x pv=%#RX64\n", offReg, (uint64_t )pv));
3159	}
3160	else
3161	{
3162	(uint32_t )pv = dmarRegRead32(pThis, offReg);
3163	LogFlowFunc(("offReg=%#x pv=%#RX32\n", offReg, (uint32_t )pv));
3164	}
3165
3166	DMAR_UNLOCK(pDevIns, pThisCC);
3167	return VINF_SUCCESS;
3168	}
3169
3170	return VINF_IOM_MMIO_UNUSED_FF;
3171	}
3172
3173
3174	#ifdef IN_RING3
3175	/**
3176	* Process requests in the invalidation queue.
3177	*
3178	* @param pDevIns The IOMMU device instance.
3179	* @param pvRequests The requests to process.
3180	* @param cbRequests The size of all requests (in bytes).
3181	* @param fDw The descriptor width (VTD_IQA_REG_DW_128_BIT or
3182	* VTD_IQA_REG_DW_256_BIT).
3183	* @param fTtm The table translation mode. Must not be VTD_TTM_RSVD.
3184	*/
3185	static void dmarR3InvQueueProcessRequests(PPDMDEVINS pDevIns, void const *pvRequests, uint32_t cbRequests, uint8_t fDw,
3186	uint8_t fTtm)
3187	{
3188	#define DMAR_IQE_FAULT_RECORD_RET(a_enmDiag, a_enmIqei) \
3189	do \
3190	{ \
3191	dmarIqeFaultRecord(pDevIns, (a_enmDiag), (a_enmIqei)); \
3192	return; \
3193	} while (0)
3194
3195	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3196	PCDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARR3);
3197
3198	DMAR_ASSERT_LOCK_IS_NOT_OWNER(pDevIns, pThisR3);
3199	Assert(fTtm != VTD_TTM_RSVD); /* Should've beeen handled by caller. */
3200
3201	/*
3202	* The below check is redundant since we check both TTM and DW for each
3203	* descriptor type we process. However, the order of errors reported by hardware
3204	* may differ hence this is kept commented out but not removed if we need to
3205	* change this in the future.
3206	*
3207	* In our implementation, we would report the descriptor type as invalid,
3208	* while on real hardware it may report descriptor width as invalid.
3209	* The Intel VT-d spec. is not clear which error takes preceedence.
3210	*/
3211	#if 0
3212	/*
3213	* Verify that 128-bit descriptors are not used when operating in scalable mode.
3214	* We don't check this while software writes IQA_REG but defer it until now because
3215	* RTADDR_REG can be updated lazily (via GCMD_REG.SRTP). The 256-bit descriptor check
3216	* -IS- performed when software writes IQA_REG since it only requires checking against
3217	* immutable hardware features.
3218	*/
3219	if ( fTtm != VTD_TTM_SCALABLE_MODE
3220	\|\| fDw != VTD_IQA_REG_DW_128_BIT)
3221	{ /* likely */ }
3222	else
3223	DMAR_IQE_FAULT_RECORD_RET(kDmarDiag_IqaReg_Dw_128_Invalid, VTDIQEI_INVALID_DESCRIPTOR_WIDTH);
3224	#endif
3225
3226	/*
3227	* Process requests in FIFO order.
3228	*/
3229	uint8_t const cbDsc = fDw == VTD_IQA_REG_DW_256_BIT ? 32 : 16;
3230	for (uint32_t offDsc = 0; offDsc < cbRequests; offDsc += cbDsc)
3231	{
3232	uint64_t const puDscQwords = (uint64_t const )((uintptr_t)pvRequests + offDsc);
3233	uint64_t const uQword0 = puDscQwords[0];
3234	uint64_t const uQword1 = puDscQwords[1];
3235	uint8_t const fDscType = VTD_GENERIC_INV_DSC_GET_TYPE(uQword0);
3236	switch (fDscType)
3237	{
3238	case VTD_INV_WAIT_DSC_TYPE:
3239	{
3240	/* Validate descriptor type. */
3241	if ( fTtm == VTD_TTM_LEGACY_MODE
3242	\|\| fDw == VTD_IQA_REG_DW_256_BIT)
3243	{ /* likely */ }
3244	else
3245	DMAR_IQE_FAULT_RECORD_RET(kDmarDiag_Iqei_Inv_Wait_Dsc_Invalid, VTDIQEI_INVALID_DESCRIPTOR_TYPE);
3246
3247	/* Validate reserved bits. */
3248	uint64_t const fValidMask0 = !(pThis->fExtCapReg & VTD_BF_ECAP_REG_PDS_MASK)
3249	? VTD_INV_WAIT_DSC_0_VALID_MASK & ~VTD_BF_0_INV_WAIT_DSC_PD_MASK
3250	: VTD_INV_WAIT_DSC_0_VALID_MASK;
3251	if ( !(uQword0 & ~fValidMask0)
3252	&& !(uQword1 & ~VTD_INV_WAIT_DSC_1_VALID_MASK))
3253	{ /* likely */ }
3254	else
3255	DMAR_IQE_FAULT_RECORD_RET(kDmarDiag_Iqei_Inv_Wait_Dsc_0_1_Rsvd, VTDIQEI_RSVD_FIELD_VIOLATION);
3256
3257	if (fDw == VTD_IQA_REG_DW_256_BIT)
3258	{
3259	if ( !puDscQwords[2]
3260	&& !puDscQwords[3])
3261	{ /* likely */ }
3262	else
3263	DMAR_IQE_FAULT_RECORD_RET(kDmarDiag_Iqei_Inv_Wait_Dsc_2_3_Rsvd, VTDIQEI_RSVD_FIELD_VIOLATION);
3264	}
3265
3266	/* Perform status write (this must be done prior to generating the completion interrupt). */
3267	bool const fSw = RT_BF_GET(uQword0, VTD_BF_0_INV_WAIT_DSC_SW);
3268	if (fSw)
3269	{
3270	uint32_t const uStatus = RT_BF_GET(uQword0, VTD_BF_0_INV_WAIT_DSC_STDATA);
3271	RTGCPHYS const GCPhysStatus = uQword1 & VTD_BF_1_INV_WAIT_DSC_STADDR_MASK;
3272	int const rc = PDMDevHlpPhysWrite(pDevIns, GCPhysStatus, (void const*)&uStatus, sizeof(uStatus));
3273	AssertRC(rc);
3274	}
3275
3276	/* Generate invalidation event interrupt. */
3277	bool const fIf = RT_BF_GET(uQword0, VTD_BF_0_INV_WAIT_DSC_IF);
3278	if (fIf)
3279	{
3280	DMAR_LOCK(pDevIns, pThisR3);
3281	dmarR3InvEventRaiseInterrupt(pDevIns);
3282	DMAR_UNLOCK(pDevIns, pThisR3);
3283	}
3284
3285	STAM_COUNTER_INC(&pThis->StatInvWaitDsc);
3286	break;
3287	}
3288
3289	case VTD_CC_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatCcInvDsc); break;
3290	case VTD_IOTLB_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatIotlbInvDsc); break;
3291	case VTD_DEV_TLB_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatDevtlbInvDsc); break;
3292	case VTD_IEC_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatIecInvDsc); break;
3293	case VTD_P_IOTLB_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatPasidIotlbInvDsc); break;
3294	case VTD_PC_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatPasidCacheInvDsc); break;
3295	case VTD_P_DEV_TLB_INV_DSC_TYPE: STAM_COUNTER_INC(&pThis->StatPasidDevtlbInvDsc); break;
3296	default:
3297	{
3298	/* Stop processing further requests. */
3299	LogFunc(("Invalid descriptor type: %#x\n", fDscType));
3300	DMAR_IQE_FAULT_RECORD_RET(kDmarDiag_Iqei_Dsc_Type_Invalid, VTDIQEI_INVALID_DESCRIPTOR_TYPE);
3301	}
3302	}
3303	}
3304	#undef DMAR_IQE_FAULT_RECORD_RET
3305	}
3306
3307
3308	/**
3309	* The invalidation-queue thread.
3310	*
3311	* @returns VBox status code.
3312	* @param pDevIns The IOMMU device instance.
3313	* @param pThread The command thread.
3314	*/
3315	static DECLCALLBACK(int) dmarR3InvQueueThread(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3316	{
3317	NOREF(pThread);
3318	LogFlowFunc(("\n"));
3319
3320	if (pThread->enmState == PDMTHREADSTATE_INITIALIZING)
3321	return VINF_SUCCESS;
3322
3323	/*
3324	* Pre-allocate the maximum size of the invalidation queue allowed by the spec.
3325	* This prevents trashing the heap as well as deal with out-of-memory situations
3326	* up-front while starting the VM. It also simplifies the code from having to
3327	* dynamically grow/shrink the allocation based on how software sizes the queue.
3328	* Guests normally don't alter the queue size all the time, but that's not an
3329	* assumption we can make.
3330	*/
3331	uint8_t const cMaxPages = 1 << VTD_BF_IQA_REG_QS_MASK;
3332	size_t const cbMaxQs = cMaxPages << X86_PAGE_SHIFT;
3333	void *pvRequests = RTMemAllocZ(cbMaxQs);
3334	AssertPtrReturn(pvRequests, VERR_NO_MEMORY);
3335
3336	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3337	PCDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARR3);
3338
3339	while (pThread->enmState == PDMTHREADSTATE_RUNNING)
3340	{
3341	/*
3342	* Sleep until we are woken up.
3343	*/
3344	{
3345	int const rc = PDMDevHlpSUPSemEventWaitNoResume(pDevIns, pThis->hEvtInvQueue, RT_INDEFINITE_WAIT);
3346	AssertLogRelMsgReturn(RT_SUCCESS(rc) \|\| rc == VERR_INTERRUPTED, ("%Rrc\n", rc), rc);
3347	if (RT_UNLIKELY(pThread->enmState != PDMTHREADSTATE_RUNNING))
3348	break;
3349	}
3350
3351	DMAR_LOCK(pDevIns, pThisR3);
3352	if (dmarInvQueueCanProcessRequests(pThis))
3353	{
3354	uint32_t offQueueHead;
3355	uint32_t offQueueTail;
3356	bool const fIsEmpty = dmarInvQueueIsEmptyEx(pThis, &offQueueHead, &offQueueTail);
3357	if (!fIsEmpty)
3358	{
3359	/*
3360	* Get the current queue size, descriptor width, queue base address and the
3361	* table translation mode while the lock is still held.
3362	*/
3363	uint64_t const uIqaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQA_REG);
3364	uint8_t const cQueuePages = 1 << (uIqaReg & VTD_BF_IQA_REG_QS_MASK);
3365	uint32_t const cbQueue = cQueuePages << X86_PAGE_SHIFT;
3366	uint8_t const fDw = RT_BF_GET(uIqaReg, VTD_BF_IQA_REG_DW);
3367	uint8_t const fTtm = RT_BF_GET(pThis->uRtaddrReg, VTD_BF_RTADDR_REG_TTM);
3368	RTGCPHYS const GCPhysRequests = (uIqaReg & VTD_BF_IQA_REG_IQA_MASK) + offQueueHead;
3369
3370	/* Paranoia. */
3371	Assert(cbQueue <= cbMaxQs);
3372	Assert(!(offQueueTail & ~VTD_BF_IQT_REG_QT_MASK));
3373	Assert(!(offQueueHead & ~VTD_BF_IQH_REG_QH_MASK));
3374	Assert(fDw != VTD_IQA_REG_DW_256_BIT \|\| !(offQueueTail & RT_BIT(4)));
3375	Assert(fDw != VTD_IQA_REG_DW_256_BIT \|\| !(offQueueHead & RT_BIT(4)));
3376	Assert(offQueueHead < cbQueue);
3377
3378	/*
3379	* A table translation mode of "reserved" isn't valid for any descriptor type.
3380	* However, RTADDR_REG can be modified in parallel to invalidation-queue processing,
3381	* but if ESRTPS is support, we will perform a global invalidation when software
3382	* changes RTADDR_REG, or it's the responsibility of software to do it explicitly.
3383	* So caching TTM while reading all descriptors should not be a problem.
3384	*
3385	* Also, validate the queue tail offset as it's mutable by software.
3386	*/
3387	if ( fTtm != VTD_TTM_RSVD
3388	&& offQueueTail < cbQueue)
3389	{
3390	/* Don't hold the lock while reading (a potentially large amount of) requests */
3391	DMAR_UNLOCK(pDevIns, pThisR3);
3392
3393	int rc;
3394	uint32_t cbRequests;
3395	if (offQueueTail > offQueueHead)
3396	{
3397	/* The requests have not wrapped around, read them in one go. */
3398	cbRequests = offQueueTail - offQueueHead;
3399	rc = PDMDevHlpPhysReadMeta(pDevIns, GCPhysRequests, pvRequests, cbRequests);
3400	}
3401	else
3402	{
3403	/* The requests have wrapped around, read forward and wrapped-around. */
3404	uint32_t const cbForward = cbQueue - offQueueHead;
3405	rc = PDMDevHlpPhysReadMeta(pDevIns, GCPhysRequests, pvRequests, cbForward);
3406
3407	uint32_t const cbWrapped = offQueueTail;
3408	if ( RT_SUCCESS(rc)
3409	&& cbWrapped > 0)
3410	{
3411	rc = PDMDevHlpPhysReadMeta(pDevIns, GCPhysRequests + cbForward,
3412	(void *)((uintptr_t)pvRequests + cbForward), cbWrapped);
3413	}
3414	cbRequests = cbForward + cbWrapped;
3415	}
3416
3417	/* Re-acquire the lock since we need to update device state. */
3418	DMAR_LOCK(pDevIns, pThisR3);
3419
3420	if (RT_SUCCESS(rc))
3421	{
3422	/* Indicate to software we've fetched all requests. */
3423	dmarRegWriteRaw64(pThis, VTD_MMIO_OFF_IQH_REG, offQueueTail);
3424
3425	/* Don't hold the lock while processing requests. */
3426	DMAR_UNLOCK(pDevIns, pThisR3);
3427
3428	/* Process all requests. */
3429	Assert(cbRequests <= cbQueue);
3430	dmarR3InvQueueProcessRequests(pDevIns, pvRequests, cbRequests, fDw, fTtm);
3431
3432	/*
3433	* We've processed all requests and the lock shouldn't be held at this point.
3434	* Using 'continue' here allows us to skip re-acquiring the lock just to release
3435	* it again before going back to the thread loop. It's a bit ugly but it certainly
3436	* helps with performance.
3437	*/
3438	DMAR_ASSERT_LOCK_IS_NOT_OWNER(pDevIns, pThisR3);
3439	continue;
3440	}
3441	else
3442	dmarIqeFaultRecord(pDevIns, kDmarDiag_IqaReg_Dsc_Fetch_Error, VTDIQEI_FETCH_DESCRIPTOR_ERR);
3443	}
3444	else
3445	{
3446	if (fTtm == VTD_TTM_RSVD)
3447	dmarIqeFaultRecord(pDevIns, kDmarDiag_Iqei_Ttm_Rsvd, VTDIQEI_INVALID_TTM);
3448	else
3449	{
3450	Assert(offQueueTail >= cbQueue);
3451	dmarIqeFaultRecord(pDevIns, kDmarDiag_IqtReg_Qt_Invalid, VTDIQEI_INVALID_TAIL_PTR);
3452	}
3453	}
3454	}
3455	}
3456	DMAR_UNLOCK(pDevIns, pThisR3);
3457	}
3458
3459	RTMemFree(pvRequests);
3460	pvRequests = NULL;
3461
3462	LogFlowFunc(("Invalidation-queue thread terminating\n"));
3463	return VINF_SUCCESS;
3464	}
3465
3466
3467	/**
3468	* Wakes up the invalidation-queue thread so it can respond to a state
3469	* change.
3470	*
3471	* @returns VBox status code.
3472	* @param pDevIns The IOMMU device instance.
3473	* @param pThread The invalidation-queue thread.
3474	*
3475	* @thread EMT.
3476	*/
3477	static DECLCALLBACK(int) dmarR3InvQueueThreadWakeUp(PPDMDEVINS pDevIns, PPDMTHREAD pThread)
3478	{
3479	RT_NOREF(pThread);
3480	LogFlowFunc(("\n"));
3481	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3482	return PDMDevHlpSUPSemEventSignal(pDevIns, pThis->hEvtInvQueue);
3483	}
3484
3485
3486	/**
3487	* @callback_method_impl{FNDBGFHANDLERDEV}
3488	*/
3489	static DECLCALLBACK(void) dmarR3DbgInfo(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
3490	{
3491	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3492	PCDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARR3);
3493	bool const fVerbose = RTStrCmp(pszArgs, "verbose") == 0;
3494
3495	/*
3496	* We lock the device to get a consistent register state as it is
3497	* ASSUMED pHlp->pfnPrintf is expensive, so we copy the registers (the
3498	* ones we care about here) into temporaries and release the lock ASAP.
3499	*
3500	* Order of register being read and outputted is in accordance with the
3501	* spec. for no particular reason.
3502	* See Intel VT-d spec. 10.4 "Register Descriptions".
3503	*/
3504	DMAR_LOCK(pDevIns, pThisR3);
3505
3506	DMARDIAG const enmDiag = pThis->enmDiag;
3507	uint32_t const uVerReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_VER_REG);
3508	uint64_t const uCapReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_CAP_REG);
3509	uint64_t const uEcapReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_ECAP_REG);
3510	uint32_t const uGcmdReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GCMD_REG);
3511	uint32_t const uGstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_GSTS_REG);
3512	uint64_t const uRtaddrReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_RTADDR_REG);
3513	uint64_t const uCcmdReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_CCMD_REG);
3514	uint32_t const uFstsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FSTS_REG);
3515	uint32_t const uFectlReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FECTL_REG);
3516	uint32_t const uFedataReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FEDATA_REG);
3517	uint32_t const uFeaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FEADDR_REG);
3518	uint32_t const uFeuaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_FEUADDR_REG);
3519	uint64_t const uAflogReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_AFLOG_REG);
3520	uint32_t const uPmenReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PMEN_REG);
3521	uint32_t const uPlmbaseReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PLMBASE_REG);
3522	uint32_t const uPlmlimitReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PLMLIMIT_REG);
3523	uint64_t const uPhmbaseReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_PHMBASE_REG);
3524	uint64_t const uPhmlimitReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_PHMLIMIT_REG);
3525	uint64_t const uIqhReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQH_REG);
3526	uint64_t const uIqtReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQT_REG);
3527	uint64_t const uIqaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQA_REG);
3528	uint32_t const uIcsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_ICS_REG);
3529	uint32_t const uIectlReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IECTL_REG);
3530	uint32_t const uIedataReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IEDATA_REG);
3531	uint32_t const uIeaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IEADDR_REG);
3532	uint32_t const uIeuaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_IEUADDR_REG);
3533	uint64_t const uIqercdReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IQERCD_REG);
3534	uint64_t const uIrtaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_IRTA_REG);
3535	uint64_t const uPqhReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_PQH_REG);
3536	uint64_t const uPqtReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_PQT_REG);
3537	uint64_t const uPqaReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_PQA_REG);
3538	uint32_t const uPrsReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PRS_REG);
3539	uint32_t const uPectlReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PECTL_REG);
3540	uint32_t const uPedataReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PEDATA_REG);
3541	uint32_t const uPeaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PEADDR_REG);
3542	uint32_t const uPeuaddrReg = dmarRegReadRaw32(pThis, VTD_MMIO_OFF_PEUADDR_REG);
3543	uint64_t const uMtrrcapReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_MTRRCAP_REG);
3544	uint64_t const uMtrrdefReg = dmarRegReadRaw64(pThis, VTD_MMIO_OFF_MTRRDEF_REG);
3545
3546	DMAR_UNLOCK(pDevIns, pThisR3);
3547
3548	const char *const pszDiag = enmDiag < RT_ELEMENTS(g_apszDmarDiagDesc) ? g_apszDmarDiagDesc[enmDiag] : "(Unknown)";
3549	pHlp->pfnPrintf(pHlp, "Intel-IOMMU:\n");
3550	pHlp->pfnPrintf(pHlp, " Diag = %s\n", pszDiag);
3551
3552	/*
3553	* Non-verbose output.
3554	*/
3555	if (!fVerbose)
3556	{
3557	pHlp->pfnPrintf(pHlp, " VER_REG = %#RX32\n", uVerReg);
3558	pHlp->pfnPrintf(pHlp, " CAP_REG = %#RX64\n", uCapReg);
3559	pHlp->pfnPrintf(pHlp, " ECAP_REG = %#RX64\n", uEcapReg);
3560	pHlp->pfnPrintf(pHlp, " GCMD_REG = %#RX32\n", uGcmdReg);
3561	pHlp->pfnPrintf(pHlp, " GSTS_REG = %#RX32\n", uGstsReg);
3562	pHlp->pfnPrintf(pHlp, " RTADDR_REG = %#RX64\n", uRtaddrReg);
3563	pHlp->pfnPrintf(pHlp, " CCMD_REG = %#RX64\n", uCcmdReg);
3564	pHlp->pfnPrintf(pHlp, " FSTS_REG = %#RX32\n", uFstsReg);
3565	pHlp->pfnPrintf(pHlp, " FECTL_REG = %#RX32\n", uFectlReg);
3566	pHlp->pfnPrintf(pHlp, " FEDATA_REG = %#RX32\n", uFedataReg);
3567	pHlp->pfnPrintf(pHlp, " FEADDR_REG = %#RX32\n", uFeaddrReg);
3568	pHlp->pfnPrintf(pHlp, " FEUADDR_REG = %#RX32\n", uFeuaddrReg);
3569	pHlp->pfnPrintf(pHlp, " AFLOG_REG = %#RX64\n", uAflogReg);
3570	pHlp->pfnPrintf(pHlp, " PMEN_REG = %#RX32\n", uPmenReg);
3571	pHlp->pfnPrintf(pHlp, " PLMBASE_REG = %#RX32\n", uPlmbaseReg);
3572	pHlp->pfnPrintf(pHlp, " PLMLIMIT_REG = %#RX32\n", uPlmlimitReg);
3573	pHlp->pfnPrintf(pHlp, " PHMBASE_REG = %#RX64\n", uPhmbaseReg);
3574	pHlp->pfnPrintf(pHlp, " PHMLIMIT_REG = %#RX64\n", uPhmlimitReg);
3575	pHlp->pfnPrintf(pHlp, " IQH_REG = %#RX64\n", uIqhReg);
3576	pHlp->pfnPrintf(pHlp, " IQT_REG = %#RX64\n", uIqtReg);
3577	pHlp->pfnPrintf(pHlp, " IQA_REG = %#RX64\n", uIqaReg);
3578	pHlp->pfnPrintf(pHlp, " ICS_REG = %#RX32\n", uIcsReg);
3579	pHlp->pfnPrintf(pHlp, " IECTL_REG = %#RX32\n", uIectlReg);
3580	pHlp->pfnPrintf(pHlp, " IEDATA_REG = %#RX32\n", uIedataReg);
3581	pHlp->pfnPrintf(pHlp, " IEADDR_REG = %#RX32\n", uIeaddrReg);
3582	pHlp->pfnPrintf(pHlp, " IEUADDR_REG = %#RX32\n", uIeuaddrReg);
3583	pHlp->pfnPrintf(pHlp, " IQERCD_REG = %#RX64\n", uIqercdReg);
3584	pHlp->pfnPrintf(pHlp, " IRTA_REG = %#RX64\n", uIrtaReg);
3585	pHlp->pfnPrintf(pHlp, " PQH_REG = %#RX64\n", uPqhReg);
3586	pHlp->pfnPrintf(pHlp, " PQT_REG = %#RX64\n", uPqtReg);
3587	pHlp->pfnPrintf(pHlp, " PQA_REG = %#RX64\n", uPqaReg);
3588	pHlp->pfnPrintf(pHlp, " PRS_REG = %#RX32\n", uPrsReg);
3589	pHlp->pfnPrintf(pHlp, " PECTL_REG = %#RX32\n", uPectlReg);
3590	pHlp->pfnPrintf(pHlp, " PEDATA_REG = %#RX32\n", uPedataReg);
3591	pHlp->pfnPrintf(pHlp, " PEADDR_REG = %#RX32\n", uPeaddrReg);
3592	pHlp->pfnPrintf(pHlp, " PEUADDR_REG = %#RX32\n", uPeuaddrReg);
3593	pHlp->pfnPrintf(pHlp, " MTRRCAP_REG = %#RX64\n", uMtrrcapReg);
3594	pHlp->pfnPrintf(pHlp, " MTRRDEF_REG = %#RX64\n", uMtrrdefReg);
3595	pHlp->pfnPrintf(pHlp, "\n");
3596	return;
3597	}
3598
3599	/*
3600	* Verbose output.
3601	*/
3602	pHlp->pfnPrintf(pHlp, " VER_REG = %#RX32\n", uVerReg);
3603	{
3604	pHlp->pfnPrintf(pHlp, " MAJ = %#x\n", RT_BF_GET(uVerReg, VTD_BF_VER_REG_MAX));
3605	pHlp->pfnPrintf(pHlp, " MIN = %#x\n", RT_BF_GET(uVerReg, VTD_BF_VER_REG_MIN));
3606	}
3607	pHlp->pfnPrintf(pHlp, " CAP_REG = %#RX64\n", uCapReg);
3608	{
3609	uint8_t const uMgaw = RT_BF_GET(uCapReg, VTD_BF_CAP_REG_MGAW);
3610	uint8_t const uNfr = RT_BF_GET(uCapReg, VTD_BF_CAP_REG_NFR);
3611	pHlp->pfnPrintf(pHlp, " ND = %u\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_ND));
3612	pHlp->pfnPrintf(pHlp, " AFL = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_AFL));
3613	pHlp->pfnPrintf(pHlp, " RWBF = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_RWBF));
3614	pHlp->pfnPrintf(pHlp, " PLMR = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_PLMR));
3615	pHlp->pfnPrintf(pHlp, " PHMR = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_PHMR));
3616	pHlp->pfnPrintf(pHlp, " CM = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_CM));
3617	pHlp->pfnPrintf(pHlp, " SAGAW = %#x\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_SAGAW));
3618	pHlp->pfnPrintf(pHlp, " MGAW = %#x (%u bits)\n", uMgaw, uMgaw + 1);
3619	pHlp->pfnPrintf(pHlp, " ZLR = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_ZLR));
3620	pHlp->pfnPrintf(pHlp, " FRO = %#x bytes\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_FRO));
3621	pHlp->pfnPrintf(pHlp, " SLLPS = %#x\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_SLLPS));
3622	pHlp->pfnPrintf(pHlp, " PSI = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_PSI));
3623	pHlp->pfnPrintf(pHlp, " NFR = %u (%u FRCD register%s)\n", uNfr, uNfr + 1, uNfr > 0 ? "s" : "");
3624	pHlp->pfnPrintf(pHlp, " MAMV = %#x\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_MAMV));
3625	pHlp->pfnPrintf(pHlp, " DWD = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_DWD));
3626	pHlp->pfnPrintf(pHlp, " DRD = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_DRD));
3627	pHlp->pfnPrintf(pHlp, " FL1GP = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_FL1GP));
3628	pHlp->pfnPrintf(pHlp, " PI = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_PI));
3629	pHlp->pfnPrintf(pHlp, " FL5LP = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_FL5LP));
3630	pHlp->pfnPrintf(pHlp, " ESIRTPS = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_ESIRTPS));
3631	pHlp->pfnPrintf(pHlp, " ESRTPS = %RTbool\n", RT_BF_GET(uCapReg, VTD_BF_CAP_REG_ESRTPS));
3632	}
3633	pHlp->pfnPrintf(pHlp, " ECAP_REG = %#RX64\n", uEcapReg);
3634	{
3635	uint8_t const uPss = RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_PSS);
3636	pHlp->pfnPrintf(pHlp, " C = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_C));
3637	pHlp->pfnPrintf(pHlp, " QI = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_QI));
3638	pHlp->pfnPrintf(pHlp, " DT = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_DT));
3639	pHlp->pfnPrintf(pHlp, " IR = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_IR));
3640	pHlp->pfnPrintf(pHlp, " EIM = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_EIM));
3641	pHlp->pfnPrintf(pHlp, " PT = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_PT));
3642	pHlp->pfnPrintf(pHlp, " SC = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SC));
3643	pHlp->pfnPrintf(pHlp, " IRO = %#x bytes\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_IRO));
3644	pHlp->pfnPrintf(pHlp, " MHMV = %#x\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_MHMV));
3645	pHlp->pfnPrintf(pHlp, " MTS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_MTS));
3646	pHlp->pfnPrintf(pHlp, " NEST = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_NEST));
3647	pHlp->pfnPrintf(pHlp, " PRS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_PRS));
3648	pHlp->pfnPrintf(pHlp, " ERS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_ERS));
3649	pHlp->pfnPrintf(pHlp, " SRS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SRS));
3650	pHlp->pfnPrintf(pHlp, " NWFS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_NWFS));
3651	pHlp->pfnPrintf(pHlp, " EAFS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_EAFS));
3652	pHlp->pfnPrintf(pHlp, " PSS = %u (%u bits)\n", uPss, uPss > 0 ? uPss + 1 : 0);
3653	pHlp->pfnPrintf(pHlp, " PASID = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_PASID));
3654	pHlp->pfnPrintf(pHlp, " DIT = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_DIT));
3655	pHlp->pfnPrintf(pHlp, " PDS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_PDS));
3656	pHlp->pfnPrintf(pHlp, " SMTS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SMTS));
3657	pHlp->pfnPrintf(pHlp, " VCS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_VCS));
3658	pHlp->pfnPrintf(pHlp, " SLADS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SLADS));
3659	pHlp->pfnPrintf(pHlp, " SLTS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SLTS));
3660	pHlp->pfnPrintf(pHlp, " FLTS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_FLTS));
3661	pHlp->pfnPrintf(pHlp, " SMPWCS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_SMPWCS));
3662	pHlp->pfnPrintf(pHlp, " RPS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_RPS));
3663	pHlp->pfnPrintf(pHlp, " ADMS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_ADMS));
3664	pHlp->pfnPrintf(pHlp, " RPRIVS = %RTbool\n", RT_BF_GET(uEcapReg, VTD_BF_ECAP_REG_RPRIVS));
3665	}
3666	pHlp->pfnPrintf(pHlp, " GCMD_REG = %#RX32\n", uGcmdReg);
3667	{
3668	uint8_t const fCfi = RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_CFI);
3669	pHlp->pfnPrintf(pHlp, " CFI = %u (%s)\n", fCfi, fCfi ? "Passthrough" : "Blocked");
3670	pHlp->pfnPrintf(pHlp, " SIRTP = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_SIRTP));
3671	pHlp->pfnPrintf(pHlp, " IRE = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_IRE));
3672	pHlp->pfnPrintf(pHlp, " QIE = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_QIE));
3673	pHlp->pfnPrintf(pHlp, " WBF = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_WBF));
3674	pHlp->pfnPrintf(pHlp, " EAFL = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_SFL));
3675	pHlp->pfnPrintf(pHlp, " SFL = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_SFL));
3676	pHlp->pfnPrintf(pHlp, " SRTP = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_SRTP));
3677	pHlp->pfnPrintf(pHlp, " TE = %u\n", RT_BF_GET(uGcmdReg, VTD_BF_GCMD_REG_TE));
3678	}
3679	pHlp->pfnPrintf(pHlp, " GSTS_REG = %#RX32\n", uGstsReg);
3680	{
3681	uint8_t const fCfis = RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_CFIS);
3682	pHlp->pfnPrintf(pHlp, " CFIS = %u (%s)\n", fCfis, fCfis ? "Passthrough" : "Blocked");
3683	pHlp->pfnPrintf(pHlp, " IRTPS = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_IRTPS));
3684	pHlp->pfnPrintf(pHlp, " IRES = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_IRES));
3685	pHlp->pfnPrintf(pHlp, " QIES = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_QIES));
3686	pHlp->pfnPrintf(pHlp, " WBFS = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_WBFS));
3687	pHlp->pfnPrintf(pHlp, " AFLS = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_AFLS));
3688	pHlp->pfnPrintf(pHlp, " FLS = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_FLS));
3689	pHlp->pfnPrintf(pHlp, " RTPS = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_RTPS));
3690	pHlp->pfnPrintf(pHlp, " TES = %u\n", RT_BF_GET(uGstsReg, VTD_BF_GSTS_REG_TES));
3691	}
3692	pHlp->pfnPrintf(pHlp, " RTADDR_REG = %#RX64\n", uRtaddrReg);
3693	{
3694	uint8_t const uTtm = RT_BF_GET(uRtaddrReg, VTD_BF_RTADDR_REG_TTM);
3695	pHlp->pfnPrintf(pHlp, " RTA = %#RX64\n", uRtaddrReg & VTD_BF_RTADDR_REG_RTA_MASK);
3696	pHlp->pfnPrintf(pHlp, " TTM = %u (%s)\n", uTtm, vtdRtaddrRegGetTtmDesc(uTtm));
3697	}
3698	pHlp->pfnPrintf(pHlp, " CCMD_REG = %#RX64\n", uCcmdReg);
3699	pHlp->pfnPrintf(pHlp, " FSTS_REG = %#RX32\n", uFstsReg);
3700	{
3701	pHlp->pfnPrintf(pHlp, " PFO = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_PFO));
3702	pHlp->pfnPrintf(pHlp, " PPF = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_PPF));
3703	pHlp->pfnPrintf(pHlp, " AFO = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_AFO));
3704	pHlp->pfnPrintf(pHlp, " APF = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_APF));
3705	pHlp->pfnPrintf(pHlp, " IQE = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_IQE));
3706	pHlp->pfnPrintf(pHlp, " ICS = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_ICE));
3707	pHlp->pfnPrintf(pHlp, " ITE = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_ITE));
3708	pHlp->pfnPrintf(pHlp, " FRI = %u\n", RT_BF_GET(uFstsReg, VTD_BF_FSTS_REG_FRI));
3709	}
3710	pHlp->pfnPrintf(pHlp, " FECTL_REG = %#RX32\n", uFectlReg);
3711	{
3712	pHlp->pfnPrintf(pHlp, " IM = %RTbool\n", RT_BF_GET(uFectlReg, VTD_BF_FECTL_REG_IM));
3713	pHlp->pfnPrintf(pHlp, " IP = %RTbool\n", RT_BF_GET(uFectlReg, VTD_BF_FECTL_REG_IP));
3714	}
3715	pHlp->pfnPrintf(pHlp, " FEDATA_REG = %#RX32\n", uFedataReg);
3716	pHlp->pfnPrintf(pHlp, " FEADDR_REG = %#RX32\n", uFeaddrReg);
3717	pHlp->pfnPrintf(pHlp, " FEUADDR_REG = %#RX32\n", uFeuaddrReg);
3718	pHlp->pfnPrintf(pHlp, " AFLOG_REG = %#RX64\n", uAflogReg);
3719	pHlp->pfnPrintf(pHlp, " PMEN_REG = %#RX32\n", uPmenReg);
3720	pHlp->pfnPrintf(pHlp, " PLMBASE_REG = %#RX32\n", uPlmbaseReg);
3721	pHlp->pfnPrintf(pHlp, " PLMLIMIT_REG = %#RX32\n", uPlmlimitReg);
3722	pHlp->pfnPrintf(pHlp, " PHMBASE_REG = %#RX64\n", uPhmbaseReg);
3723	pHlp->pfnPrintf(pHlp, " PHMLIMIT_REG = %#RX64\n", uPhmlimitReg);
3724	pHlp->pfnPrintf(pHlp, " IQH_REG = %#RX64\n", uIqhReg);
3725	pHlp->pfnPrintf(pHlp, " IQT_REG = %#RX64\n", uIqtReg);
3726	pHlp->pfnPrintf(pHlp, " IQA_REG = %#RX64\n", uIqaReg);
3727	{
3728	uint8_t const fDw = RT_BF_GET(uIqaReg, VTD_BF_IQA_REG_DW);
3729	uint8_t const fQs = RT_BF_GET(uIqaReg, VTD_BF_IQA_REG_QS);
3730	uint8_t const cQueuePages = 1 << fQs;
3731	pHlp->pfnPrintf(pHlp, " DW = %u (%s)\n", fDw, fDw == VTD_IQA_REG_DW_128_BIT ? "128-bit" : "256-bit");
3732	pHlp->pfnPrintf(pHlp, " QS = %u (%u page%s)\n", fQs, cQueuePages, cQueuePages > 1 ? "s" : "");
3733	}
3734	pHlp->pfnPrintf(pHlp, " ICS_REG = %#RX32\n", uIcsReg);
3735	{
3736	pHlp->pfnPrintf(pHlp, " IWC = %u\n", RT_BF_GET(uIcsReg, VTD_BF_ICS_REG_IWC));
3737	}
3738	pHlp->pfnPrintf(pHlp, " IECTL_REG = %#RX32\n", uIectlReg);
3739	{
3740	pHlp->pfnPrintf(pHlp, " IM = %RTbool\n", RT_BF_GET(uIectlReg, VTD_BF_IECTL_REG_IM));
3741	pHlp->pfnPrintf(pHlp, " IP = %RTbool\n", RT_BF_GET(uIectlReg, VTD_BF_IECTL_REG_IP));
3742	}
3743	pHlp->pfnPrintf(pHlp, " IEDATA_REG = %#RX32\n", uIedataReg);
3744	pHlp->pfnPrintf(pHlp, " IEADDR_REG = %#RX32\n", uIeaddrReg);
3745	pHlp->pfnPrintf(pHlp, " IEUADDR_REG = %#RX32\n", uIeuaddrReg);
3746	pHlp->pfnPrintf(pHlp, " IQERCD_REG = %#RX64\n", uIqercdReg);
3747	{
3748	pHlp->pfnPrintf(pHlp, " ICESID = %#RX32\n", RT_BF_GET(uIqercdReg, VTD_BF_IQERCD_REG_ICESID));
3749	pHlp->pfnPrintf(pHlp, " ITESID = %#RX32\n", RT_BF_GET(uIqercdReg, VTD_BF_IQERCD_REG_ITESID));
3750	pHlp->pfnPrintf(pHlp, " IQEI = %#RX32\n", RT_BF_GET(uIqercdReg, VTD_BF_IQERCD_REG_IQEI));
3751	}
3752	pHlp->pfnPrintf(pHlp, " IRTA_REG = %#RX64\n", uIrtaReg);
3753	{
3754	uint32_t const cIrtEntries = VTD_IRTA_REG_GET_ENTRY_COUNT(uIrtaReg);
3755	uint32_t const cbIrt = sizeof(VTD_IRTE_T) * cIrtEntries;
3756	pHlp->pfnPrintf(pHlp, " IRTA = %#RX64\n", uIrtaReg & VTD_BF_IRTA_REG_IRTA_MASK);
3757	pHlp->pfnPrintf(pHlp, " EIME = %RTbool\n", RT_BF_GET(uIrtaReg, VTD_BF_IRTA_REG_EIME));
3758	pHlp->pfnPrintf(pHlp, " S = %u entries (%u bytes)\n", cIrtEntries, cbIrt);
3759	}
3760	pHlp->pfnPrintf(pHlp, " PQH_REG = %#RX64\n", uPqhReg);
3761	pHlp->pfnPrintf(pHlp, " PQT_REG = %#RX64\n", uPqtReg);
3762	pHlp->pfnPrintf(pHlp, " PQA_REG = %#RX64\n", uPqaReg);
3763	pHlp->pfnPrintf(pHlp, " PRS_REG = %#RX32\n", uPrsReg);
3764	pHlp->pfnPrintf(pHlp, " PECTL_REG = %#RX32\n", uPectlReg);
3765	pHlp->pfnPrintf(pHlp, " PEDATA_REG = %#RX32\n", uPedataReg);
3766	pHlp->pfnPrintf(pHlp, " PEADDR_REG = %#RX32\n", uPeaddrReg);
3767	pHlp->pfnPrintf(pHlp, " PEUADDR_REG = %#RX32\n", uPeuaddrReg);
3768	pHlp->pfnPrintf(pHlp, " MTRRCAP_REG = %#RX64\n", uMtrrcapReg);
3769	pHlp->pfnPrintf(pHlp, " MTRRDEF_REG = %#RX64\n", uMtrrdefReg);
3770	pHlp->pfnPrintf(pHlp, "\n");
3771	}
3772
3773
3774	/**
3775	* Initializes all registers in the DMAR unit.
3776	*
3777	* @param pDevIns The IOMMU device instance.
3778	*/
3779	static void dmarR3RegsInit(PPDMDEVINS pDevIns)
3780	{
3781	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3782	LogFlowFunc(("\n"));
3783
3784	/*
3785	* Wipe all registers (required on reset).
3786	*/
3787	RT_ZERO(pThis->abRegs0);
3788	RT_ZERO(pThis->abRegs1);
3789
3790	/*
3791	* Initialize registers not mutable by software prior to initializing other registers.
3792	*/
3793	/* VER_REG */
3794	{
3795	pThis->uVerReg = RT_BF_MAKE(VTD_BF_VER_REG_MIN, DMAR_VER_MINOR)
3796	\| RT_BF_MAKE(VTD_BF_VER_REG_MAX, DMAR_VER_MAJOR);
3797	dmarRegWriteRaw64(pThis, VTD_MMIO_OFF_VER_REG, pThis->uVerReg);
3798	}
3799
3800	uint8_t const fFlts = 0; /* First-level translation support. */
3801	uint8_t const fSlts = 1; /* Second-level translation support. */
3802	uint8_t const fPt = 1; /* Pass-Through support. */
3803	uint8_t const fSmts = fFlts & fSlts & fPt; /* Scalable mode translation support.*/
3804	uint8_t const fNest = 0; /* Nested translation support. */
3805
3806	/* CAP_REG */
3807	{
3808	uint8_t cGstPhysAddrBits;
3809	uint8_t cGstLinearAddrBits;
3810	PDMDevHlpCpuGetGuestAddrWidths(pDevIns, &cGstPhysAddrBits, &cGstLinearAddrBits);
3811
3812	uint8_t const fFl1gp = 1; /* First-level 1GB pages support. */
3813	uint8_t const fFl5lp = 1; /* First-level 5-level paging support (PML5E). */
3814	uint8_t const fSl2mp = 1; /* Second-level 2MB pages support. */
3815	uint8_t const fSl2gp = fSl2mp & 1; /* Second-level 1GB pages support. */
3816	uint8_t const fSllps = fSl2mp \| (fSl2gp << 1); /* Second-level large page support. */
3817	uint8_t const fMamv = (fSl2gp ? X86_PAGE_1G_SHIFT /* Maximum address mask value (for 2nd-level invalidations). */
3818	: X86_PAGE_2M_SHIFT)
3819	- X86_PAGE_4K_SHIFT;
3820	uint8_t const fNd = DMAR_ND; /* Number of domains supported. */
3821	uint8_t const fPsi = 1; /* Page selective invalidation. */
3822	uint8_t const uMgaw = cGstPhysAddrBits - 1; /* Maximum guest address width. */
3823	uint8_t const fSagaw = vtdCapRegGetSagaw(uMgaw); /* Supported adjust guest address width. */
3824	uint16_t const offFro = DMAR_MMIO_OFF_FRCD_LO_REG >> 4; /* MMIO offset of FRCD registers. */
3825	uint8_t const fEsrtps = 1; /* Enhanced SRTPS (auto invalidate cache on SRTP). */
3826	uint8_t const fEsirtps = 1; /* Enhanced SIRTPS (auto invalidate cache on SIRTP). */
3827
3828	pThis->fCapReg = RT_BF_MAKE(VTD_BF_CAP_REG_ND, fNd)
3829	\| RT_BF_MAKE(VTD_BF_CAP_REG_AFL, 0) /* Advanced fault logging not supported. */
3830	\| RT_BF_MAKE(VTD_BF_CAP_REG_RWBF, 0) /* Software need not flush write-buffers. */
3831	\| RT_BF_MAKE(VTD_BF_CAP_REG_PLMR, 0) /* Protected Low-Memory Region not supported. */
3832	\| RT_BF_MAKE(VTD_BF_CAP_REG_PHMR, 0) /* Protected High-Memory Region not supported. */
3833	\| RT_BF_MAKE(VTD_BF_CAP_REG_CM, 1) /* Software should invalidate on mapping structure changes. */
3834	\| RT_BF_MAKE(VTD_BF_CAP_REG_SAGAW, fSlts ? fSagaw : 0)
3835	\| RT_BF_MAKE(VTD_BF_CAP_REG_MGAW, uMgaw)
3836	\| RT_BF_MAKE(VTD_BF_CAP_REG_ZLR, 1) /** @todo Figure out if/how to support zero-length reads. */
3837	\| RT_BF_MAKE(VTD_BF_CAP_REG_FRO, offFro)
3838	\| RT_BF_MAKE(VTD_BF_CAP_REG_SLLPS, fSlts & fSllps)
3839	\| RT_BF_MAKE(VTD_BF_CAP_REG_PSI, fPsi)
3840	\| RT_BF_MAKE(VTD_BF_CAP_REG_NFR, DMAR_FRCD_REG_COUNT - 1)
3841	\| RT_BF_MAKE(VTD_BF_CAP_REG_MAMV, fPsi & fMamv)
3842	\| RT_BF_MAKE(VTD_BF_CAP_REG_DWD, 1)
3843	\| RT_BF_MAKE(VTD_BF_CAP_REG_DRD, 1)
3844	\| RT_BF_MAKE(VTD_BF_CAP_REG_FL1GP, fFlts & fFl1gp)
3845	\| RT_BF_MAKE(VTD_BF_CAP_REG_PI, 0) /* Posted Interrupts not supported. */
3846	\| RT_BF_MAKE(VTD_BF_CAP_REG_FL5LP, fFlts & fFl5lp)
3847	\| RT_BF_MAKE(VTD_BF_CAP_REG_ESIRTPS, fEsirtps)
3848	\| RT_BF_MAKE(VTD_BF_CAP_REG_ESRTPS, fEsrtps);
3849	dmarRegWriteRaw64(pThis, VTD_MMIO_OFF_CAP_REG, pThis->fCapReg);
3850
3851	AssertCompile(fNd <= RT_ELEMENTS(g_auNdMask));
3852	pThis->fHawBaseMask = ~(UINT64_MAX << cGstPhysAddrBits) & X86_PAGE_4K_BASE_MASK;
3853	pThis->fMgawInvMask = UINT64_MAX << cGstPhysAddrBits;
3854	pThis->cMaxPagingLevel = vtdCapRegGetMaxPagingLevel(fSagaw);
3855	pThis->fCtxEntryQw1ValidMask = VTD_BF_1_CONTEXT_ENTRY_AW_MASK
3856	\| VTD_BF_1_CONTEXT_ENTRY_IGN_6_3_MASK
3857	\| RT_BF_MAKE(VTD_BF_1_CONTEXT_ENTRY_DID, g_auNdMask[fNd]);
3858	}
3859
3860	/* ECAP_REG */
3861	{
3862	uint8_t const fQi = 1; /* Queued-invalidations. */
3863	uint8_t const fIr = !!(DMAR_ACPI_DMAR_FLAGS & ACPI_DMAR_F_INTR_REMAP); /* Interrupt remapping support. */
3864	uint8_t const fMhmv = 0xf; /* Maximum handle mask value. */
3865	uint16_t const offIro = DMAR_MMIO_OFF_IVA_REG >> 4; /* MMIO offset of IOTLB registers. */
3866	uint8_t const fEim = 1; /* Extended interrupt mode.*/
3867	uint8_t const fAdms = 1; /* Abort DMA mode support. */
3868	uint8_t const fErs = 0; /* Execute Request (not supported). */
3869
3870	pThis->fExtCapReg = RT_BF_MAKE(VTD_BF_ECAP_REG_C, 0) /* Accesses don't snoop CPU cache. */
3871	\| RT_BF_MAKE(VTD_BF_ECAP_REG_QI, fQi)
3872	\| RT_BF_MAKE(VTD_BF_ECAP_REG_DT, 0) /* Device-TLBs not supported. */
3873	\| RT_BF_MAKE(VTD_BF_ECAP_REG_IR, fQi & fIr)
3874	\| RT_BF_MAKE(VTD_BF_ECAP_REG_EIM, fIr & fEim)
3875	\| RT_BF_MAKE(VTD_BF_ECAP_REG_PT, fPt)
3876	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SC, 0) /* Snoop control not supported. */
3877	\| RT_BF_MAKE(VTD_BF_ECAP_REG_IRO, offIro)
3878	\| RT_BF_MAKE(VTD_BF_ECAP_REG_MHMV, fIr & fMhmv)
3879	\| RT_BF_MAKE(VTD_BF_ECAP_REG_MTS, 0) /* Memory type not supported. */
3880	\| RT_BF_MAKE(VTD_BF_ECAP_REG_NEST, fNest)
3881	\| RT_BF_MAKE(VTD_BF_ECAP_REG_PRS, 0) /* 0 as DT not supported. */
3882	\| RT_BF_MAKE(VTD_BF_ECAP_REG_ERS, fErs)
3883	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SRS, 0) /* Supervisor request not supported. */
3884	\| RT_BF_MAKE(VTD_BF_ECAP_REG_NWFS, 0) /* 0 as DT not supported. */
3885	\| RT_BF_MAKE(VTD_BF_ECAP_REG_EAFS, 0) /* 0 as SMPWCS not supported. */
3886	\| RT_BF_MAKE(VTD_BF_ECAP_REG_PSS, 0) /* 0 as PASID not supported. */
3887	\| RT_BF_MAKE(VTD_BF_ECAP_REG_PASID, 0) /* PASID not supported. */
3888	\| RT_BF_MAKE(VTD_BF_ECAP_REG_DIT, 0) /* 0 as DT not supported. */
3889	\| RT_BF_MAKE(VTD_BF_ECAP_REG_PDS, 0) /* 0 as DT not supported. */
3890	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SMTS, fSmts)
3891	\| RT_BF_MAKE(VTD_BF_ECAP_REG_VCS, 0) /* 0 as PASID not supported (commands seem PASID specific). */
3892	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SLADS, 0) /* Second-level accessed/dirty not supported. */
3893	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SLTS, fSlts)
3894	\| RT_BF_MAKE(VTD_BF_ECAP_REG_FLTS, fFlts)
3895	\| RT_BF_MAKE(VTD_BF_ECAP_REG_SMPWCS, 0) /* 0 as PASID not supported. */
3896	\| RT_BF_MAKE(VTD_BF_ECAP_REG_RPS, 0) /* We don't support RID_PASID field in SM context entry. */
3897	\| RT_BF_MAKE(VTD_BF_ECAP_REG_ADMS, fAdms)
3898	\| RT_BF_MAKE(VTD_BF_ECAP_REG_RPRIVS, 0); /* 0 as SRS not supported. */
3899	dmarRegWriteRaw64(pThis, VTD_MMIO_OFF_ECAP_REG, pThis->fExtCapReg);
3900
3901	pThis->fPermValidMask = DMAR_PERM_READ \| DMAR_PERM_WRITE;
3902	if (fErs)
3903	pThis->fPermValidMask = DMAR_PERM_EXE;
3904	}
3905
3906	/*
3907	* Initialize registers mutable by software.
3908	*/
3909	/* FECTL_REG */
3910	{
3911	uint32_t const uCtl = RT_BF_MAKE(VTD_BF_FECTL_REG_IM, 1);
3912	dmarRegWriteRaw32(pThis, VTD_MMIO_OFF_FECTL_REG, uCtl);
3913	}
3914
3915	/* ICETL_REG */
3916	{
3917	uint32_t const uCtl = RT_BF_MAKE(VTD_BF_IECTL_REG_IM, 1);
3918	dmarRegWriteRaw32(pThis, VTD_MMIO_OFF_IECTL_REG, uCtl);
3919	}
3920
3921	#ifdef VBOX_STRICT
3922	Assert(!RT_BF_GET(pThis->fExtCapReg, VTD_BF_ECAP_REG_PRS)); /* PECTL_REG - Reserved if don't support PRS. */
3923	Assert(!RT_BF_GET(pThis->fExtCapReg, VTD_BF_ECAP_REG_MTS)); /* MTRRCAP_REG - Reserved if we don't support MTS. */
3924	#endif
3925	}
3926
3927
3928	/**
3929	* @callback_method_impl{FNSSMDEVSAVEEXEC}
3930	*/
3931	static DECLCALLBACK(int) dmarR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
3932	{
3933	PCDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PCDMAR);
3934	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3935	LogFlowFunc(("\n"));
3936
3937	/* First, save software-immutable registers that we validate on state load. */
3938	pHlp->pfnSSMPutU32(pSSM, pThis->uVerReg);
3939	pHlp->pfnSSMPutU64(pSSM, pThis->fCapReg);
3940	pHlp->pfnSSMPutU64(pSSM, pThis->fExtCapReg);
3941
3942	/* Save MMIO registers. */
3943	pHlp->pfnSSMPutU32(pSSM, DMAR_MMIO_GROUP_COUNT);
3944	pHlp->pfnSSMPutU32(pSSM, sizeof(pThis->abRegs0));
3945	pHlp->pfnSSMPutMem(pSSM, &pThis->abRegs0[0], sizeof(pThis->abRegs0));
3946	pHlp->pfnSSMPutU32(pSSM, sizeof(pThis->abRegs1));
3947	pHlp->pfnSSMPutMem(pSSM, &pThis->abRegs1[0], sizeof(pThis->abRegs1));
3948
3949	/*
3950	* Save our implemention-defined MMIO registers offsets.
3951	* The register themselves are currently all part of group 1 (saved above).
3952	* We save these to ensure they're located where the code expects them while loading state.
3953	*/
3954	pHlp->pfnSSMPutU16(pSSM, DMAR_MMIO_OFF_IMPL_COUNT);
3955	AssertCompile(DMAR_MMIO_OFF_IMPL_COUNT == 2);
3956	pHlp->pfnSSMPutU16(pSSM, DMAR_MMIO_OFF_IVA_REG);
3957	pHlp->pfnSSMPutU16(pSSM, DMAR_MMIO_OFF_FRCD_LO_REG);
3958
3959	/* Save lazily activated registers. */
3960	pHlp->pfnSSMPutU64(pSSM, pThis->uIrtaReg);
3961	pHlp->pfnSSMPutU64(pSSM, pThis->uRtaddrReg);
3962
3963	/* Save terminator marker and return status. */
3964	return pHlp->pfnSSMPutU32(pSSM, UINT32_MAX);
3965	}
3966
3967
3968	/**
3969	* @callback_method_impl{FNSSMDEVLOADEXEC}
3970	*/
3971	static DECLCALLBACK(int) dmarR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
3972	{
3973	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
3974	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
3975	int const rcDataErr = VERR_SSM_UNEXPECTED_DATA;
3976	int const rcFmtErr = VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
3977	LogFlowFunc(("\n"));
3978
3979	/*
3980	* Validate saved-state version.
3981	*/
3982	AssertReturn(uPass == SSM_PASS_FINAL, VERR_WRONG_ORDER);
3983	if (uVersion != DMAR_SAVED_STATE_VERSION)
3984	{
3985	LogRel(("%s: Invalid saved-state version %#x\n", DMAR_LOG_PFX, uVersion));
3986	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
3987	}
3988
3989	/*
3990	* Load and validate software-immutable registers.
3991	* The features we had exposed to the guest (in the saved state) must be identical
3992	* to what is currently emulated.
3993	*/
3994	{
3995	/* VER_REG */
3996	uint32_t uVerReg = 0;
3997	int rc = pHlp->pfnSSMGetU32(pSSM, &uVerReg);
3998	AssertRCReturn(rc, rc);
3999	AssertLogRelMsgReturn(uVerReg == pThis->uVerReg,
4000	("%s: VER_REG mismatch (expected %#RX32 got %#RX32)\n", DMAR_LOG_PFX, pThis->uVerReg, uVerReg),
4001	rcDataErr);
4002	/* CAP_REG */
4003	uint64_t fCapReg = 0;
4004	pHlp->pfnSSMGetU64(pSSM, &fCapReg);
4005	AssertLogRelMsgReturn(fCapReg == pThis->fCapReg,
4006	("%s: CAP_REG mismatch (expected %#RX64 got %#RX64)\n", DMAR_LOG_PFX, pThis->fCapReg, fCapReg),
4007	rcDataErr);
4008	/* ECAP_REG */
4009	uint64_t fExtCapReg = 0;
4010	pHlp->pfnSSMGetU64(pSSM, &fExtCapReg);
4011	AssertLogRelMsgReturn(fExtCapReg == pThis->fExtCapReg,
4012	("%s: ECAP_REG mismatch (expected %#RX64 got %#RX64)\n", DMAR_LOG_PFX, pThis->fExtCapReg,
4013	fExtCapReg), rcDataErr);
4014	}
4015
4016	/*
4017	* Load MMIO registers.
4018	*/
4019	{
4020	/* Group count. */
4021	uint32_t cRegGroups = 0;
4022	pHlp->pfnSSMGetU32(pSSM, &cRegGroups);
4023	AssertLogRelMsgReturn(cRegGroups == DMAR_MMIO_GROUP_COUNT,
4024	("%s: MMIO group count mismatch (expected %u got %u)\n", DMAR_LOG_PFX, DMAR_MMIO_GROUP_COUNT,
4025	cRegGroups), rcFmtErr);
4026	/* Group 0. */
4027	uint32_t cbRegs0 = 0;
4028	pHlp->pfnSSMGetU32(pSSM, &cbRegs0);
4029	AssertLogRelMsgReturn(cbRegs0 == sizeof(pThis->abRegs0),
4030	("%s: MMIO group 0 size mismatch (expected %u got %u)\n", DMAR_LOG_PFX, sizeof(pThis->abRegs0),
4031	cbRegs0), rcFmtErr);
4032	pHlp->pfnSSMGetMem(pSSM, &pThis->abRegs0[0], cbRegs0);
4033	/* Group 1. */
4034	uint32_t cbRegs1 = 0;
4035	pHlp->pfnSSMGetU32(pSSM, &cbRegs1);
4036	AssertLogRelMsgReturn(cbRegs1 == sizeof(pThis->abRegs1),
4037	("%s: MMIO group 1 size mismatch (expected %u got %u)\n", DMAR_LOG_PFX, sizeof(pThis->abRegs1),
4038	cbRegs1), rcFmtErr);
4039	pHlp->pfnSSMGetMem(pSSM, &pThis->abRegs1[0], cbRegs1);
4040	}
4041
4042	/*
4043	* Validate implementation-defined MMIO register offsets.
4044	*/
4045	{
4046	/* Offset count. */
4047	uint16_t cOffsets = 0;
4048	pHlp->pfnSSMGetU16(pSSM, &cOffsets);
4049	AssertLogRelMsgReturn(cOffsets == DMAR_MMIO_OFF_IMPL_COUNT,
4050	("%s: MMIO offset count mismatch (expected %u got %u)\n", DMAR_LOG_PFX, DMAR_MMIO_OFF_IMPL_COUNT,
4051	cOffsets), rcFmtErr);
4052	/* IVA_REG. */
4053	uint16_t offReg = 0;
4054	pHlp->pfnSSMGetU16(pSSM, &offReg);
4055	AssertLogRelMsgReturn(offReg == DMAR_MMIO_OFF_IVA_REG,
4056	("%s: IVA_REG offset mismatch (expected %u got %u)\n", DMAR_LOG_PFX, DMAR_MMIO_OFF_IVA_REG,
4057	offReg), rcFmtErr);
4058	/* IOTLB_REG. */
4059	AssertLogRelMsgReturn(offReg + 8 == DMAR_MMIO_OFF_IOTLB_REG,
4060	("%s: IOTLB_REG offset mismatch (expected %u got %u)\n", DMAR_LOG_PFX, DMAR_MMIO_OFF_IOTLB_REG,
4061	offReg), rcFmtErr);
4062	/* FRCD_LO_REG. */
4063	pHlp->pfnSSMGetU16(pSSM, &offReg);
4064	AssertLogRelMsgReturn(offReg == DMAR_MMIO_OFF_FRCD_LO_REG,
4065	("%s: FRCD_LO_REG offset mismatch (expected %u got %u)\n", DMAR_LOG_PFX, DMAR_MMIO_OFF_FRCD_LO_REG,
4066	offReg), rcFmtErr);
4067	/* FRCD_HI_REG. */
4068	AssertLogRelMsgReturn(offReg + 8 == DMAR_MMIO_OFF_FRCD_HI_REG,
4069	("%s: FRCD_HI_REG offset mismatch (expected %u got %u)\n", DMAR_LOG_PFX, DMAR_MMIO_OFF_FRCD_HI_REG,
4070	offReg), rcFmtErr);
4071	}
4072
4073	/*
4074	* Load lazily activated registers.
4075	*/
4076	{
4077	/* Active IRTA_REG. */
4078	pHlp->pfnSSMGetU64(pSSM, &pThis->uIrtaReg);
4079	AssertLogRelMsgReturn(!(pThis->uIrtaReg & ~VTD_IRTA_REG_RW_MASK),
4080	("%s: IRTA_REG reserved bits set %#RX64\n", DMAR_LOG_PFX, pThis->uIrtaReg), rcDataErr);
4081	/* Active RTADDR_REG. */
4082	pHlp->pfnSSMGetU64(pSSM, &pThis->uRtaddrReg);
4083	AssertLogRelMsgReturn(!(pThis->uRtaddrReg & ~VTD_RTADDR_REG_RW_MASK),
4084	("%s: RTADDR_REG reserved bits set %#RX64\n", DMAR_LOG_PFX, pThis->uRtaddrReg), rcDataErr);
4085	}
4086
4087	/*
4088	* Verify terminator marker.
4089	*/
4090	{
4091	uint32_t uEndMarker = 0;
4092	int const rc = pHlp->pfnSSMGetU32(pSSM, &uEndMarker);
4093	AssertRCReturn(rc, rc);
4094	AssertLogRelMsgReturn(uEndMarker == UINT32_MAX,
4095	("%s: End marker mismatch (expected %#RX32 got %#RX32)\n", DMAR_LOG_PFX, UINT32_MAX, uEndMarker),
4096	rcFmtErr);
4097	}
4098	return VINF_SUCCESS;
4099	}
4100
4101
4102	/**
4103	* @callback_method_impl{FNSSMDEVLOADDONE}
4104	*/
4105	static DECLCALLBACK(int) dmarR3LoadDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
4106	{
4107	PDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PDMARR3);
4108	LogFlowFunc(("\n"));
4109	RT_NOREF(pSSM);
4110	AssertPtrReturn(pThisR3, VERR_INVALID_POINTER);
4111
4112	DMAR_LOCK(pDevIns, pThisR3);
4113	dmarInvQueueThreadWakeUpIfNeeded(pDevIns);
4114	DMAR_UNLOCK(pDevIns, pThisR3);
4115	return VINF_SUCCESS;
4116	}
4117
4118
4119	/**
4120	* @interface_method_impl{PDMDEVREG,pfnReset}
4121	*/
4122	static DECLCALLBACK(void) iommuIntelR3Reset(PPDMDEVINS pDevIns)
4123	{
4124	PCDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARR3);
4125	LogFlowFunc(("\n"));
4126
4127	DMAR_LOCK(pDevIns, pThisR3);
4128	dmarR3RegsInit(pDevIns);
4129	DMAR_UNLOCK(pDevIns, pThisR3);
4130	}
4131
4132
4133	/**
4134	* @interface_method_impl{PDMDEVREG,pfnDestruct}
4135	*/
4136	static DECLCALLBACK(int) iommuIntelR3Destruct(PPDMDEVINS pDevIns)
4137	{
4138	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
4139	PCDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PCDMARR3);
4140	LogFlowFunc(("\n"));
4141
4142	DMAR_LOCK(pDevIns, pThisR3);
4143
4144	if (pThis->hEvtInvQueue != NIL_SUPSEMEVENT)
4145	{
4146	PDMDevHlpSUPSemEventClose(pDevIns, pThis->hEvtInvQueue);
4147	pThis->hEvtInvQueue = NIL_SUPSEMEVENT;
4148	}
4149
4150	DMAR_UNLOCK(pDevIns, pThisR3);
4151	return VINF_SUCCESS;
4152	}
4153
4154
4155	/**
4156	* @interface_method_impl{PDMDEVREG,pfnConstruct}
4157	*/
4158	static DECLCALLBACK(int) iommuIntelR3Construct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
4159	{
4160	RT_NOREF(pCfg);
4161
4162	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
4163	PDMARR3 pThisR3 = PDMDEVINS_2_DATA_CC(pDevIns, PDMARR3);
4164	pThisR3->pDevInsR3 = pDevIns;
4165
4166	LogFlowFunc(("iInstance=%d\n", iInstance));
4167	NOREF(iInstance);
4168
4169	/*
4170	* Register the IOMMU with PDM.
4171	*/
4172	PDMIOMMUREGR3 IommuReg;
4173	RT_ZERO(IommuReg);
4174	IommuReg.u32Version = PDM_IOMMUREGCC_VERSION;
4175	IommuReg.pfnMemAccess = iommuIntelMemAccess;
4176	IommuReg.pfnMemBulkAccess = iommuIntelMemBulkAccess;
4177	IommuReg.pfnMsiRemap = iommuIntelMsiRemap;
4178	IommuReg.u32TheEnd = PDM_IOMMUREGCC_VERSION;
4179	int rc = PDMDevHlpIommuRegister(pDevIns, &IommuReg, &pThisR3->CTX_SUFF(pIommuHlp), &pThis->idxIommu);
4180	if (RT_FAILURE(rc))
4181	return PDMDEV_SET_ERROR(pDevIns, rc, N_("Failed to register ourselves as an IOMMU device"));
4182	if (pThisR3->CTX_SUFF(pIommuHlp)->u32Version != PDM_IOMMUHLPR3_VERSION)
4183	return PDMDevHlpVMSetError(pDevIns, VERR_VERSION_MISMATCH, RT_SRC_POS,
4184	N_("IOMMU helper version mismatch; got %#x expected %#x"),
4185	pThisR3->CTX_SUFF(pIommuHlp)->u32Version, PDM_IOMMUHLPR3_VERSION);
4186	if (pThisR3->CTX_SUFF(pIommuHlp)->u32TheEnd != PDM_IOMMUHLPR3_VERSION)
4187	return PDMDevHlpVMSetError(pDevIns, VERR_VERSION_MISMATCH, RT_SRC_POS,
4188	N_("IOMMU helper end-version mismatch; got %#x expected %#x"),
4189	pThisR3->CTX_SUFF(pIommuHlp)->u32TheEnd, PDM_IOMMUHLPR3_VERSION);
4190	AssertPtr(pThisR3->pIommuHlpR3->pfnLock);
4191	AssertPtr(pThisR3->pIommuHlpR3->pfnUnlock);
4192	AssertPtr(pThisR3->pIommuHlpR3->pfnLockIsOwner);
4193	AssertPtr(pThisR3->pIommuHlpR3->pfnSendMsi);
4194
4195	/*
4196	* Use PDM's critical section (via helpers) for the IOMMU device.
4197	*/
4198	rc = PDMDevHlpSetDeviceCritSect(pDevIns, PDMDevHlpCritSectGetNop(pDevIns));
4199	AssertRCReturn(rc, rc);
4200
4201	/*
4202	* Initialize PCI configuration registers.
4203	*/
4204	PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
4205	PDMPCIDEV_ASSERT_VALID(pDevIns, pPciDev);
4206
4207	/* Header. */
4208	PDMPciDevSetVendorId(pPciDev, DMAR_PCI_VENDOR_ID); /* Intel */
4209	PDMPciDevSetDeviceId(pPciDev, DMAR_PCI_DEVICE_ID); /* VirtualBox DMAR device */
4210	PDMPciDevSetRevisionId(pPciDev, DMAR_PCI_REVISION_ID); /* VirtualBox specific device implementation revision */
4211	PDMPciDevSetClassBase(pPciDev, VBOX_PCI_CLASS_SYSTEM); /* System Base Peripheral */
4212	PDMPciDevSetClassSub(pPciDev, VBOX_PCI_SUB_SYSTEM_OTHER); /* Other */
4213	PDMPciDevSetHeaderType(pPciDev, 0); /* Single function, type 0 */
4214	PDMPciDevSetSubSystemId(pPciDev, DMAR_PCI_DEVICE_ID); /* VirtualBox DMAR device */
4215	PDMPciDevSetSubSystemVendorId(pPciDev, DMAR_PCI_VENDOR_ID); /* Intel */
4216
4217	/** @todo Chipset spec says PCI Express Capability Id. Relevant for us? */
4218	PDMPciDevSetStatus(pPciDev, 0);
4219	PDMPciDevSetCapabilityList(pPciDev, 0);
4220	/** @todo VTBAR at 0x180? */
4221
4222	/*
4223	* Register the PCI function with PDM.
4224	*/
4225	rc = PDMDevHlpPCIRegister(pDevIns, pPciDev);
4226	AssertLogRelRCReturn(rc, rc);
4227
4228	/*
4229	* Register MMIO region.
4230	*/
4231	AssertCompile(!(DMAR_MMIO_BASE_PHYSADDR & X86_PAGE_4K_OFFSET_MASK));
4232	rc = PDMDevHlpMmioCreateAndMap(pDevIns, DMAR_MMIO_BASE_PHYSADDR, DMAR_MMIO_SIZE, dmarMmioWrite, dmarMmioRead,
4233	IOMMMIO_FLAGS_READ_DWORD_QWORD \| IOMMMIO_FLAGS_WRITE_DWORD_QWORD_ZEROED, "Intel-IOMMU",
4234	&pThis->hMmio);
4235	AssertLogRelRCReturn(rc, rc);
4236
4237	/*
4238	* Register saved state handlers.
4239	*/
4240	rc = PDMDevHlpSSMRegisterEx(pDevIns, DMAR_SAVED_STATE_VERSION, sizeof(DMAR), NULL /* pszBefore */,
4241	NULL /* pfnLivePrep /, NULL / pfnLiveExec /, NULL / pfnLiveVote */,
4242	NULL /* pfnSavePrep /, dmarR3SaveExec, NULL / pfnSaveDone */,
4243	NULL /* pfnLoadPrep */, dmarR3LoadExec, dmarR3LoadDone);
4244	AssertLogRelRCReturn(rc, rc);
4245
4246	/*
4247	* Register debugger info items.
4248	*/
4249	rc = PDMDevHlpDBGFInfoRegister(pDevIns, "iommu", "Display IOMMU state.", dmarR3DbgInfo);
4250	AssertLogRelRCReturn(rc, rc);
4251
4252	#ifdef VBOX_WITH_STATISTICS
4253	/*
4254	* Statistics.
4255	*/
4256	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMmioReadR3, STAMTYPE_COUNTER, "R3/MmioRead", STAMUNIT_OCCURENCES, "Number of MMIO reads in R3");
4257	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMmioReadRZ, STAMTYPE_COUNTER, "RZ/MmioRead", STAMUNIT_OCCURENCES, "Number of MMIO reads in RZ.");
4258
4259	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMmioWriteR3, STAMTYPE_COUNTER, "R3/MmioWrite", STAMUNIT_OCCURENCES, "Number of MMIO writes in R3.");
4260	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMmioWriteRZ, STAMTYPE_COUNTER, "RZ/MmioWrite", STAMUNIT_OCCURENCES, "Number of MMIO writes in RZ.");
4261
4262	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMsiRemapCfiR3, STAMTYPE_COUNTER, "R3/MsiRemapCfi", STAMUNIT_OCCURENCES, "Number of compatibility-format interrupt remap requests in R3.");
4263	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMsiRemapCfiRZ, STAMTYPE_COUNTER, "RZ/MsiRemapCfi", STAMUNIT_OCCURENCES, "Number of compatibility-format interrupt remap requests in RZ.");
4264	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMsiRemapRfiR3, STAMTYPE_COUNTER, "R3/MsiRemapRfi", STAMUNIT_OCCURENCES, "Number of remappable-format interrupt remap requests in R3.");
4265	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMsiRemapRfiRZ, STAMTYPE_COUNTER, "RZ/MsiRemapRfi", STAMUNIT_OCCURENCES, "Number of remappable-format interrupt remap requests in RZ.");
4266
4267	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemReadR3, STAMTYPE_COUNTER, "R3/MemRead", STAMUNIT_OCCURENCES, "Number of memory read translation requests in R3.");
4268	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemReadRZ, STAMTYPE_COUNTER, "RZ/MemRead", STAMUNIT_OCCURENCES, "Number of memory read translation requests in RZ.");
4269
4270	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemWriteR3, STAMTYPE_COUNTER, "R3/MemWrite", STAMUNIT_OCCURENCES, "Number of memory write translation requests in R3.");
4271	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemWriteRZ, STAMTYPE_COUNTER, "RZ/MemWrite", STAMUNIT_OCCURENCES, "Number of memory write translation requests in RZ.");
4272
4273	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemBulkReadR3, STAMTYPE_COUNTER, "R3/MemBulkRead", STAMUNIT_OCCURENCES, "Number of memory bulk read translation requests in R3.");
4274	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemBulkReadRZ, STAMTYPE_COUNTER, "RZ/MemBulkRead", STAMUNIT_OCCURENCES, "Number of memory bulk read translation requests in RZ.");
4275
4276	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemBulkWriteR3, STAMTYPE_COUNTER, "R3/MemBulkWrite", STAMUNIT_OCCURENCES, "Number of memory bulk write translation requests in R3.");
4277	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatMemBulkWriteRZ, STAMTYPE_COUNTER, "RZ/MemBulkWrite", STAMUNIT_OCCURENCES, "Number of memory bulk write translation requests in RZ.");
4278
4279	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatCcInvDsc, STAMTYPE_COUNTER, "R3/QI/CcInv", STAMUNIT_OCCURENCES, "Number of cc_inv_dsc processed.");
4280	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatIotlbInvDsc, STAMTYPE_COUNTER, "R3/QI/IotlbInv", STAMUNIT_OCCURENCES, "Number of iotlb_inv_dsc processed.");
4281	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatDevtlbInvDsc, STAMTYPE_COUNTER, "R3/QI/DevtlbInv", STAMUNIT_OCCURENCES, "Number of dev_tlb_inv_dsc processed.");
4282	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatIecInvDsc, STAMTYPE_COUNTER, "R3/QI/IecInv", STAMUNIT_OCCURENCES, "Number of iec_inv processed.");
4283	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatInvWaitDsc, STAMTYPE_COUNTER, "R3/QI/InvWait", STAMUNIT_OCCURENCES, "Number of inv_wait_dsc processed.");
4284	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatPasidIotlbInvDsc, STAMTYPE_COUNTER, "R3/QI/PasidIotlbInv", STAMUNIT_OCCURENCES, "Number of p_iotlb_inv_dsc processed.");
4285	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatPasidCacheInvDsc, STAMTYPE_COUNTER, "R3/QI/PasidCacheInv", STAMUNIT_OCCURENCES, "Number of pc_inv_dsc pprocessed.");
4286	PDMDevHlpSTAMRegister(pDevIns, &pThis->StatPasidDevtlbInvDsc, STAMTYPE_COUNTER, "R3/QI/PasidDevtlbInv", STAMUNIT_OCCURENCES, "Number of p_dev_tlb_inv_dsc processed.");
4287	#endif
4288
4289	/*
4290	* Initialize registers.
4291	*/
4292	dmarR3RegsInit(pDevIns);
4293
4294	/*
4295	* Create invalidation-queue thread and semaphore.
4296	*/
4297	char szInvQueueThread[32];
4298	RT_ZERO(szInvQueueThread);
4299	RTStrPrintf(szInvQueueThread, sizeof(szInvQueueThread), "IOMMU-QI-%u", iInstance);
4300	rc = PDMDevHlpThreadCreate(pDevIns, &pThisR3->pInvQueueThread, pThis, dmarR3InvQueueThread, dmarR3InvQueueThreadWakeUp,
4301	0 /* cbStack */, RTTHREADTYPE_IO, szInvQueueThread);
4302	AssertLogRelRCReturn(rc, rc);
4303
4304	rc = PDMDevHlpSUPSemEventCreate(pDevIns, &pThis->hEvtInvQueue);
4305	AssertLogRelRCReturn(rc, rc);
4306
4307	/*
4308	* Log some of the features exposed to software.
4309	*/
4310	uint8_t const uVerMax = RT_BF_GET(pThis->uVerReg, VTD_BF_VER_REG_MAX);
4311	uint8_t const uVerMin = RT_BF_GET(pThis->uVerReg, VTD_BF_VER_REG_MIN);
4312	uint8_t const cMgawBits = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_MGAW) + 1;
4313	uint8_t const fSagaw = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_SAGAW);
4314	uint16_t const offFrcd = RT_BF_GET(pThis->fCapReg, VTD_BF_CAP_REG_FRO);
4315	uint16_t const offIva = RT_BF_GET(pThis->fExtCapReg, VTD_BF_ECAP_REG_IRO);
4316	LogRel(("%s: Mapped at %#RGp (%u-level page-table supported)\n",
4317	DMAR_LOG_PFX, DMAR_MMIO_BASE_PHYSADDR, pThis->cMaxPagingLevel));
4318	LogRel(("%s: Version=%u.%u Cap=%#RX64 ExtCap=%#RX64 Mgaw=%u bits Sagaw=%#x HawBaseMask=%#RX64 MgawInvMask=%#RX64 FRO=%#x IRO=%#x\n",
4319	DMAR_LOG_PFX, uVerMax, uVerMin, pThis->fCapReg, pThis->fExtCapReg, cMgawBits, fSagaw, pThis->fHawBaseMask,
4320	pThis->fMgawInvMask, offFrcd, offIva));
4321	return VINF_SUCCESS;
4322	}
4323
4324	#else
4325
4326	/**
4327	* @callback_method_impl{PDMDEVREGR0,pfnConstruct}
4328	*/
4329	static DECLCALLBACK(int) iommuIntelRZConstruct(PPDMDEVINS pDevIns)
4330	{
4331	PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
4332	PDMAR pThis = PDMDEVINS_2_DATA(pDevIns, PDMAR);
4333	PDMARCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PDMARCC);
4334	pThisCC->CTX_SUFF(pDevIns) = pDevIns;
4335
4336	/* We will use PDM's critical section (via helpers) for the IOMMU device. */
4337	int rc = PDMDevHlpSetDeviceCritSect(pDevIns, PDMDevHlpCritSectGetNop(pDevIns));
4338	AssertRCReturn(rc, rc);
4339
4340	/* Set up the MMIO RZ handlers. */
4341	rc = PDMDevHlpMmioSetUpContext(pDevIns, pThis->hMmio, dmarMmioWrite, dmarMmioRead, NULL /* pvUser */);
4342	AssertRCReturn(rc, rc);
4343
4344	/* Set up the IOMMU RZ callbacks. */
4345	PDMIOMMUREGCC IommuReg;
4346	RT_ZERO(IommuReg);
4347	IommuReg.u32Version = PDM_IOMMUREGCC_VERSION;
4348	IommuReg.idxIommu = pThis->idxIommu;
4349	IommuReg.pfnMemAccess = iommuIntelMemAccess;
4350	IommuReg.pfnMemBulkAccess = iommuIntelMemBulkAccess;
4351	IommuReg.pfnMsiRemap = iommuIntelMsiRemap;
4352	IommuReg.u32TheEnd = PDM_IOMMUREGCC_VERSION;
4353
4354	rc = PDMDevHlpIommuSetUpContext(pDevIns, &IommuReg, &pThisCC->CTX_SUFF(pIommuHlp));
4355	AssertRCReturn(rc, rc);
4356	AssertPtrReturn(pThisCC->CTX_SUFF(pIommuHlp), VERR_IOMMU_IPE_1);
4357	AssertReturn(pThisCC->CTX_SUFF(pIommuHlp)->u32Version == CTX_MID(PDM_IOMMUHLP,_VERSION), VERR_VERSION_MISMATCH);
4358	AssertReturn(pThisCC->CTX_SUFF(pIommuHlp)->u32TheEnd == CTX_MID(PDM_IOMMUHLP,_VERSION), VERR_VERSION_MISMATCH);
4359	AssertPtr(pThisCC->CTX_SUFF(pIommuHlp)->pfnLock);
4360	AssertPtr(pThisCC->CTX_SUFF(pIommuHlp)->pfnUnlock);
4361	AssertPtr(pThisCC->CTX_SUFF(pIommuHlp)->pfnLockIsOwner);
4362	AssertPtr(pThisCC->CTX_SUFF(pIommuHlp)->pfnSendMsi);
4363
4364	return VINF_SUCCESS;
4365	}
4366
4367	#endif
4368
4369
4370	/**
4371	* The device registration structure.
4372	*/
4373	PDMDEVREG const g_DeviceIommuIntel =
4374	{
4375	/* .u32Version = */ PDM_DEVREG_VERSION,
4376	/* .uReserved0 = */ 0,
4377	/* .szName = */ "iommu-intel",
4378	/* .fFlags = */ PDM_DEVREG_FLAGS_DEFAULT_BITS \| PDM_DEVREG_FLAGS_RZ \| PDM_DEVREG_FLAGS_NEW_STYLE,
4379	/* .fClass = */ PDM_DEVREG_CLASS_PCI_BUILTIN,
4380	/* .cMaxInstances = */ 1,
4381	/* .uSharedVersion = */ 42,
4382	/* .cbInstanceShared = */ sizeof(DMAR),
4383	/* .cbInstanceCC = */ sizeof(DMARCC),
4384	/* .cbInstanceRC = */ sizeof(DMARRC),
4385	/* .cMaxPciDevices = */ 1,
4386	/* .cMaxMsixVectors = */ 0,
4387	/* .pszDescription = */ "IOMMU (Intel)",
4388	#if defined(IN_RING3)
4389	/* .pszRCMod = */ "VBoxDDRC.rc",
4390	/* .pszR0Mod = */ "VBoxDDR0.r0",
4391	/* .pfnConstruct = */ iommuIntelR3Construct,
4392	/* .pfnDestruct = */ iommuIntelR3Destruct,
4393	/* .pfnRelocate = */ NULL,
4394	/* .pfnMemSetup = */ NULL,
4395	/* .pfnPowerOn = */ NULL,
4396	/* .pfnReset = */ iommuIntelR3Reset,
4397	/* .pfnSuspend = */ NULL,
4398	/* .pfnResume = */ NULL,
4399	/* .pfnAttach = */ NULL,
4400	/* .pfnDetach = */ NULL,
4401	/* .pfnQueryInterface = */ NULL,
4402	/* .pfnInitComplete = */ NULL,
4403	/* .pfnPowerOff = */ NULL,
4404	/* .pfnSoftReset = */ NULL,
4405	/* .pfnReserved0 = */ NULL,
4406	/* .pfnReserved1 = */ NULL,
4407	/* .pfnReserved2 = */ NULL,
4408	/* .pfnReserved3 = */ NULL,
4409	/* .pfnReserved4 = */ NULL,
4410	/* .pfnReserved5 = */ NULL,
4411	/* .pfnReserved6 = */ NULL,
4412	/* .pfnReserved7 = */ NULL,
4413	#elif defined(IN_RING0)
4414	/* .pfnEarlyConstruct = */ NULL,
4415	/* .pfnConstruct = */ iommuIntelRZConstruct,
4416	/* .pfnDestruct = */ NULL,
4417	/* .pfnFinalDestruct = */ NULL,
4418	/* .pfnRequest = */ NULL,
4419	/* .pfnReserved0 = */ NULL,
4420	/* .pfnReserved1 = */ NULL,
4421	/* .pfnReserved2 = */ NULL,
4422	/* .pfnReserved3 = */ NULL,
4423	/* .pfnReserved4 = */ NULL,
4424	/* .pfnReserved5 = */ NULL,
4425	/* .pfnReserved6 = */ NULL,
4426	/* .pfnReserved7 = */ NULL,
4427	#elif defined(IN_RC)
4428	/* .pfnConstruct = */ iommuIntelRZConstruct,
4429	/* .pfnReserved0 = */ NULL,
4430	/* .pfnReserved1 = */ NULL,
4431	/* .pfnReserved2 = */ NULL,
4432	/* .pfnReserved3 = */ NULL,
4433	/* .pfnReserved4 = */ NULL,
4434	/* .pfnReserved5 = */ NULL,
4435	/* .pfnReserved6 = */ NULL,
4436	/* .pfnReserved7 = */ NULL,
4437	#else
4438	# error "Not in IN_RING3, IN_RING0 or IN_RC!"
4439	#endif
4440	/* .u32VersionEnd = */ PDM_DEVREG_VERSION
4441	};
4442
4443	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */
4444

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Bus/DevIommuIntel.cpp@ 94993

Download in other formats: