Changeset 80219 in vbox for trunk/src/VBox/Devices/VirtIO

Timestamp:

Aug 12, 2019 7:23:05 AM (6 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

132668

Message:

storage/DevVirtioSCSI.cpp, major changes that flesh out most of the functionality of the VirtIO 1.0 implementation (not the Host SCSI dev specific implmentation). See #9440, Comment #45 for more information

Location:

trunk/src/VBox/Devices/VirtIO

Files:

• Virtio_1_0.cpp (modified) (48 diffs)
• Virtio_1_0.h (modified) (4 diffs)
• Virtio_1_0_impl.h (modified) (11 diffs)

trunk/src/VBox/Devices/VirtIO/Virtio_1_0.cpp

@@ -27 +27 @@
 #include <iprt/uuid.h>
 #include <iprt/mem.h>
+#include <iprt/assert.h>
 #include <VBox/vmm/pdmdev.h>
 #include "Virtio_1_0_impl.h"
 #include "Virtio_1_0.h"
 
-#define INSTANCE(pState) pState->szInstance
-#define IFACE_TO_STATE(pIface, ifaceName) ((VIRTIOSTATE *)((char*)(pIface) - RT_UOFFSETOF(VIRTIOSTATE, ifaceName)))
-
-#define H2P(hVirtio) ((PVIRTIOSTATE)(hVirtio))
+#define INSTANCE(pVirtio) pVirtio->szInstance
 
 #ifdef LOG_ENABLED
@@ -43 +41 @@
  * Formats the logging of a memory-mapped I/O input or output value
  *
- * @param   pszFunc     - To avoid displaying this function's name via __FUNCTION__ or LogFunc()
+ * @param   pszFunc     - To avoid displaying this function's name via __FUNCTION__ or Log2Func()
  * @param   pszMember   - Name of struct member
  * @param   pv          - pointer to value
@@ -52 +50 @@
  * @param   idx         - The index if fHasIndex
  */
-void virtioLogMappedIoValue(const char *pszFunc, const char *pszMember, const void *pv, uint32_t cb,
-                        uint32_t uOffset, bool fWrite, bool fHasIndex, uint32_t idx)
-{
-
-#define FMTHEX(fmtout, val, cNybs) \
-    fmtout[cNybs] = '\0'; \
-    for (uint8_t i = 0; i < cNybs; i++) \
-        fmtout[(cNybs - i) -1] = "0123456789abcdef"[(val >> (i * 4)) & 0xf];
+void virtioLogMappedIoValue(const char *pszFunc, const char *pszMember, size_t uMemberSize,
+                        const void *pv, uint32_t cb, uint32_t uOffset, bool fWrite,
+                        bool fHasIndex, uint32_t idx)
+{
+
+#define FMTHEX(fmtout, val, cNybbles) \
+    fmtout[cNybbles] = '\0'; \
+    for (uint8_t i = 0; i < cNybbles; i++) \
+        fmtout[(cNybbles - i) - 1] = "0123456789abcdef"[(val >> (i * 4)) & 0xf];
 
 #define MAX_STRING   64
@@ -73 +72 @@
         memcpy((char *)&val, pv, cb);
         FMTHEX(pszFormattedVal, val, cb * 2);
-        if (uOffset != 0) /* display bounds if partial member access */
+        if (uOffset != 0 || cb != uMemberSize) /* display bounds if partial member access */
             RTStrPrintf(pszDepiction, sizeof(pszDepiction), "%s%s[%d:%d]",
                         pszMember, pszIdx, uOffset, uOffset + cb - 1);
@@ -81 +80 @@
         uint32_t first = 0;
         for (uint8_t i = 0; i < sizeof(pszDepiction); i++)
-            if (pszDepiction[i] == ' ' && first++ != 0)
+            if (pszDepiction[i] == ' ' && first++)
                 pszDepiction[i] = '.';
         Log(("%s: Guest %s %s 0x%s\n", \
@@ -94 +93 @@
 }
 
-
-void virtQueueReadDesc(PVIRTIOSTATE pState, PVIRTQ pVirtQ, uint32_t idx, PVIRTQ_DESC_T pDesc)
-{
-    //Log(("%s virtQueueReadDesc: ring=%p idx=%u\n", INSTANCE(pState), pVirtQ, idx));
-    PDMDevHlpPhysRead(pState->CTX_SUFF(pDevIns),
-                      pVirtQ->pGcPhysVirtqDescriptors + sizeof(VIRTQ_DESC_T) * (idx % pVirtQ->cbQueue),
-                      pDesc, sizeof(VIRTQ_DESC_T));
-}
-
-uint16_t virtQueueReadAvail(PVIRTIOSTATE pState, PVIRTQ pVirtQ, uint32_t idx)
-{
-    uint16_t tmp;
-    PDMDevHlpPhysRead(pState->CTX_SUFF(pDevIns),
-                      pVirtQ->pGcPhysVirtqAvail + RT_UOFFSETOF_DYN(VIRTQ_AVAIL_T, auRing[idx % pVirtQ->cbQueue]),
-                      &tmp, sizeof(tmp));
-    return tmp;
-}
-
-uint16_t virtQueueReadAvailFlags(PVIRTIOSTATE pState, PVIRTQ pVirtQ)
-{
-    uint16_t tmp;
-    PDMDevHlpPhysRead(pState->CTX_SUFF(pDevIns),
-                      pVirtQ->pGcPhysVirtqAvail + RT_UOFFSETOF(VIRTQ_AVAIL_T, fFlags),
-                      &tmp, sizeof(tmp));
-    return tmp;
-}
-
-uint16_t virtQueueReadUsedIndex(PVIRTIOSTATE pState, PVIRTQ pVirtQ)
-{
-    uint16_t tmp;
-    PDMDevHlpPhysRead(pState->CTX_SUFF(pDevIns),
-                      pVirtQ->pGcPhysVirtqUsed + RT_UOFFSETOF(VIRTQ_USED_T, uIdx),
-                      &tmp, sizeof(tmp));
-    return tmp;
-}
-
-void virtQueueWriteUsedIndex(PVIRTIOSTATE pState, PVIRTQ pVirtQ, uint16_t u16Value)
-{
-    PDMDevHlpPCIPhysWrite(pState->CTX_SUFF(pDevIns),
-                          pVirtQ->pGcPhysVirtqAvail + RT_UOFFSETOF(VIRTQ_USED_T, uIdx),
-                          &u16Value, sizeof(u16Value));
-}
-
-void virtQueueWriteUsedElem(PVIRTIOSTATE pState, PVIRTQ pVirtQ, uint32_t idx, uint32_t id, uint32_t uLen)
-{
-
-    RT_NOREF5(pState, pVirtQ, idx, id, uLen);
-    /* PK TODO: Adapt to VirtIO 1.0
-    VIRTQ_USED_ELEM_T elem;
-
-    elem.id = id;
-    elem.uLen = uLen;
-    PDMDevHlpPCIPhysWrite(pState->CTX_SUFF(pDevIns),
-                          pVirtQ->pGcPhysVirtqUsed + RT_UOFFSETOF_DYN(VIRTQ_USED_T, ring[idx % pVirtQ->cbQueue]),
-                          &elem, sizeof(elem));
-    */
-}
-
-void virtQueueSetNotification(PVIRTIOSTATE pState, PVIRTQ pVirtQ, bool fEnabled)
-{
-    RT_NOREF3(pState, pVirtQ, fEnabled);
-
-/* PK TODO: Adapt to VirtIO 1.0
-    uint16_t tmp;
-
-    PDMDevHlpPhysRead(pState->CTX_SUFF(pDevIns),
-                      pVirtQ->pGcPhysVirtqAvail + RT_UOFFSETOF(VIRTQ_USED_T, uFlags),
-                      &tmp, sizeof(tmp));
-
-    if (fEnabled)
-        tmp &= ~ VIRTQ_USED_T_F_NO_NOTIFY;
-    else
-        tmp |= VIRTQ_USED_T_F_NO_NOTIFY;
-
-    PDMDevHlpPCIPhysWrite(pState->CTX_SUFF(pDevIns),
-                          pVirtQ->pGcPhysVirtqAvail + RT_UOFFSETOF(VIRTQ_USED_T, uFlags),
-                          &tmp, sizeof(tmp));
-*/
-}
-
-bool virtQueueSkip(PVIRTIOSTATE pState, PVQUEUE pQueue)
-{
-
-    RT_NOREF2(pState, pQueue);
-/* PK TODO Adapt to VirtIO 1.0
-    if (virtQueueIsEmpty(pState, pQueue))
+/**
+ * This is called when MMIO handler detects guest write to a virtq's notification address
+ */
+static void vqNotified(PVIRTIOSTATE pVirtio, uint16_t qIdx, uint16_t uNotifyIdx)
+{
+    Assert(uNotifyIdx == qIdx);
+    PVIRTQ_CONTEXT_T pQueueContext = &pVirtio->queueContext[qIdx];
+    Log2Func(("%s: %s notified\n", INSTANCE(pVirtio), pQueueContext->pcszName));
+
+    /** inform client */
+    pVirtio->virtioCallbacks.pfnVirtioQueueNotified((VIRTIOHANDLE)pVirtio, qIdx);
+}
+
+static void vqNotify(PVIRTIOSTATE pVirtio, uint16_t qIdx)
+{
+    PVIRTQ_CONTEXT_T pQueueContext = &pVirtio->queueContext[qIdx];
+
+    bool fEmpty = vqIsEmpty(pVirtio, qIdx);
+    bool fAvailFlags = vqReadAvailFlags(pVirtio, qIdx);
+
+    LogFlowFunc(("%s: %s availFlags=%x guestFeatures=%x virtioQueue is %sempty\n",
+        INSTANCE(pVirtio), pQueueContext->pcszName, fAvailFlags, pVirtio->uDriverFeatures, fEmpty ? "" : "not "));
+
+    if (!(fAvailFlags & VIRTQ_AVAIL_F_NO_INTERRUPT))
+    {
+        int rc = virtioRaiseInterrupt(pVirtio, VIRTIO_ISR_VIRTQ_INTERRUPT);
+        if (RT_FAILURE(rc))
+            Log(("%s virtioQueueNotify: Failed to raise an interrupt (%Rrc).\n", INSTANCE(pVirtio), rc));
+    }
+}
+
+bool virtioQueueInit(VIRTIOHANDLE hVirtio, uint16_t qIdx, const char *pcszName)
+{
+    PVIRTIOSTATE pVirtio = (PVIRTIOSTATE)hVirtio;
+    PVIRTQ_CONTEXT_T pVirtQ = &(pVirtio->queueContext[qIdx]);
+    if (pVirtio->uQueueEnable[qIdx])
+    {
+        Log2Func(("Queue name: %-16s\n", pcszName));
+        pVirtQ->uNextAvailIdx = 0;
+        pVirtQ->uNextUsedIdx  = 0;
+        RTStrCopy((char *)pVirtQ->pcszName, sizeof(pVirtQ->pcszName), pcszName);
+        return true;
+    }
+    return false;
+}
+
+const char *virtioQueueGetName(VIRTIOHANDLE hVirtio, uint16_t qIdx)
+{
+    return (const char *)((PVIRTIOSTATE)hVirtio)->queueContext[qIdx].pcszName;
+}
+
+int virtioGetNumQueues(VIRTIOHANDLE hVirtio)
+{
+    return ((PVIRTIOSTATE)(hVirtio))->uNumQueues;
+}
+
+bool virtioQueueSkip(VIRTIOHANDLE hVirtio, uint16_t qIdx)
+{
+    PVIRTIOSTATE pVirtio = (PVIRTIOSTATE)hVirtio;
+    PVIRTQ_CONTEXT_T pQueueContext = &pVirtio->queueContext[qIdx];
+
+    if (virtioQueueIsEmpty(pVirtio, qIdx))
         return false;
 
-    Log2(("%s virtQueueSkip: %s avail_idx=%u\n", INSTANCE(pState),
-          QUEUENAME(pState, pQueue), pQueue->uNextAvailIndex));
-    pQueue->uNextAvailIndex++;
-*/
+    Log2Func(("%s: %s avail_idx=%u\n", INSTANCE(pVirtio),
+          pQueueContext->pcszName, pQueueContext->uNextAvailIdx));
+    pQueueContext->uNextAvailIdx++;
     return true;
 }
 
-bool virtQueueGet(PVIRTIOSTATE pState, PVQUEUE pQueue, PVQUEUEELEM pElem, bool fRemove)
-{
-
-    RT_NOREF4(pState, pQueue, pElem, fRemove);
-
-/* PK TODO: Adapt to VirtIO 1.0
-    if (virtQueueIsEmpty(pState, pQueue))
+bool virtioQueueIsEmpty(VIRTIOHANDLE hVirtio, uint16_t qIdx)
+{
+    PVIRTIOSTATE pVirtio = (PVIRTIOSTATE)hVirtio;
+    return vqReadAvailDescIdx(pVirtio, qIdx) == pVirtio->queueContext->uNextAvailIdx;
+}
+
+bool virtioQueuePeek(VIRTIOHANDLE hVirtio, uint16_t qIdx, PVIRTQ_BUF_VECTOR_T pBufVec)
+{
+    return virtioQueueGet(hVirtio, qIdx, pBufVec, /* fRemove */ false);
+}
+
+bool virtioQueueGet(VIRTIOHANDLE hVirtio, uint16_t qIdx, PVIRTQ_BUF_VECTOR_T pBufVec, bool fRemove)
+{
+
+    PVIRTIOSTATE pVirtio = (PVIRTIOSTATE)hVirtio;
+    PVIRTQ_CONTEXT_T pQueueContext = &pVirtio->queueContext[qIdx];
+
+    if (vqIsEmpty(pVirtio, qIdx))
         return false;
 
-    pElem->nIn = pElem->nOut = 0;
-
-    Log2(("%s virtQueueGet: %s avail_idx=%u\n", INSTANCE(pState),
-          QUEUENAME(pState, pQueue), pQueue->uNextAvailIndex));
+    pBufVec->cSegsIn = pBufVec->cSegsOut = 0;
+
+    Log2Func(("%s avail_idx=%u\n", INSTANCE(pVirtio), pQueueContext->pcszName, pQueueContext->uNextAvailIdx));
+
+    uint16_t uDescIdx;
+    pBufVec->uDescIdx = uDescIdx = vqReadAvailRingDescIdx(pVirtio, qIdx, pQueueContext->uNextAvailIdx);
+
+    if (fRemove)
+        pQueueContext->uNextAvailIdx++;
 
     VIRTQ_DESC_T desc;
-    uint16_t  idx = virtQueueReadAvail(pState, &pQueue->VirtQ, pQueue->uNextAvailIndex);
-    if (fRemove)
-        pQueue->uNextAvailIndex++;
-    pElem->idx = idx;
     do
     {
-        VQUEUESEG *pSeg;
-
-        //
-        // Malicious guests may try to trick us into writing beyond aSegsIn or
-        // aSegsOut boundaries by linking several descriptors into a loop. We
-        // cannot possibly get a sequence of linked descriptors exceeding the
-        // total number of descriptors in the ring (see @bugref{8620}).
-        ///
-        if (pElem->nIn + pElem->nOut >= VIRTQ_MAX_SIZE)
+        VIRTQ_SEG_T *pSeg;
+
+        /**
+        * Malicious or inept guests may go beyond aSegsIn or aSegsOut boundaries by linking
+        * several descriptors into a loop. Since there is no legitimate way to get a sequences of
+        * linked descriptors exceeding the total number of descriptors in the ring (see @bugref{8620}),
+        * the following aborts I/O if breech and employs a simple log throttling algorithm to notify.
+        */
+        if (pBufVec->cSegsIn + pBufVec->cSegsOut >= VIRTQ_MAX_SIZE)
         {
             static volatile uint32_t s_cMessages  = 0;
@@ -224 +210 @@
             if (ASMAtomicIncU32(&s_cMessages) == ASMAtomicReadU32(&s_cThreshold))
             {
-                LogRel(("%s: too many linked descriptors; check if the guest arranges descriptors in a loop.\n",
-                        INSTANCE(pState)));
+                LogRel(("%s: too many linked descriptors; "
+                        "check if the guest arranges descriptors in a loop.\n",
+                           INSTANCE(pVirtio)));
                 if (ASMAtomicReadU32(&s_cMessages) != 1)
                     LogRel(("%s: (the above error has occured %u times so far)\n",
-                            INSTANCE(pState), ASMAtomicReadU32(&s_cMessages)));
+                            INSTANCE(pVirtio), ASMAtomicReadU32(&s_cMessages)));
                 ASMAtomicWriteU32(&s_cThreshold, ASMAtomicReadU32(&s_cThreshold) * 10);
             }
@@ -235 +222 @@
         RT_UNTRUSTED_VALIDATED_FENCE();
 
-        virtQueueReadDesc(pState, &pQueue->VirtQ, idx, &desc);
-        if (desc.u16Flags & VIRTQ_DESC_T_F_WRITE)
-        {
-            Log2(("%s virtQueueGet: %s IN  seg=%u desc_idx=%u addr=%p cb=%u\n", INSTANCE(pState),
-                  QUEUENAME(pState, pQueue), pElem->nIn, idx, desc.addr, desc.uLen));
-            pSeg = &pElem->aSegsIn[pElem->nIn++];
+        vqReadDesc(pVirtio, qIdx, uDescIdx, &desc);
+        if (desc.fFlags & VIRTQ_DESC_F_WRITE)
+        {
+            Log2Func(("%s: %s IN  seg=%u desc_idx=%u addr=%RTp cb=%u\n", INSTANCE(pVirtio),
+                  pQueueContext->pcszName, pBufVec->cSegsIn, uDescIdx, desc.pGcPhysBuf, desc.cb));
+            pSeg = &(pBufVec->aSegsIn[pBufVec->cSegsIn++]);
         }
         else
         {
-            Log2(("%s virtQueueGet: %s OUT seg=%u desc_idx=%u addr=%p cb=%u\n", INSTANCE(pState),
-                  QUEUENAME(pState, pQueue), pElem->nOut, idx, desc.addr, desc.uLen));
-            pSeg = &pElem->aSegsOut[pElem->nOut++];
-        }
-
-        pSeg->addr = desc.addr;
-        pSeg->cb   = desc.uLen;
+            Log2Func(("%s: %s IN  seg=%u desc_idx=%u addr=%RTp cb=%u\n", INSTANCE(pVirtio),
+                  pQueueContext->pcszName, pBufVec->cSegsOut, uDescIdx, desc.pGcPhysBuf, desc.cb));
+            pSeg = &(pBufVec->aSegsOut[pBufVec->cSegsOut++]);
+        }
+
+        pSeg->addr = (RTGCPHYS)desc.pGcPhysBuf;
+        pSeg->cb   = desc.cb;
         pSeg->pv   = NULL;
 
-        idx = desc.next;
-    } while (desc.u16Flags & VIRTQ_DESC_T_F_NEXT);
-
-    Log2(("%s virtQueueGet: %s head_desc_idx=%u nIn=%u nOut=%u\n", INSTANCE(pState),
-          QUEUENAME(pState, pQueue), pElem->idx, pElem->nIn, pElem->nOut));
-*/
+        uDescIdx = desc.uDescIdxNext;
+    } while (desc.fFlags & VIRTQ_DESC_F_NEXT);
+
+    Log2Func(("%s: %s head_desc_idx=%u nIn=%u nOut=%u\n", INSTANCE(pVirtio),
+          pQueueContext->pcszName, pBufVec->uDescIdx, pBufVec->cSegsIn, pBufVec->cSegsOut));
+
     return true;
 }
 
-
-
-void virtQueuePut(PVIRTIOSTATE pState, PVQUEUE pQueue,
-               PVQUEUEELEM pElem, uint32_t uTotalLen, uint32_t uReserved)
-{
-
-    RT_NOREF5(pState, pQueue, pElem, uTotalLen, uReserved);
-
-/* PK TODO Re-work this for VirtIO 1.0
-    Log2(("%s virtQueuePut: %s"
-          " desc_idx=%u acb=%u (%u)\n",
-          INSTANCE(pState), QUEUENAME(pState, pQueue),
-          pElem->idx, uTotalLen, uReserved));
-
-    Assert(uReserved < uTotalLen);
-
-    uint32_t cbLen = uTotalLen - uReserved;
-    uint32_t cbSkip = uReserved;
-
-    for (unsigned i = 0; i < pElem->nIn && cbLen > 0; ++i)
-    {
-        if (cbSkip >= pElem->aSegsIn[i].cb) // segment completely skipped?
-        {
-            cbSkip -= pElem->aSegsIn[i].cb;
-            continue;
-        }
-
-        uint32_t cbSegLen = pElem->aSegsIn[i].cb - cbSkip;
-        if (cbSegLen > cbLen)   // last segment only partially used?
-            cbSegLen = cbLen;
-
-        //
-        // XXX: We should assert pv != NULL, but we need to check and
-        // fix all callers first.
-        //
-        if (pElem->aSegsIn[i].pv != NULL)
-        {
-            Log2(("%s virtQueuePut: %s"
-                  " used_idx=%u seg=%u addr=%p pv=%p cb=%u acb=%u\n",
-                  INSTANCE(pState), QUEUENAME(pState, pQueue),
-                  pQueue->uNextUsedIndex, i,
-                  (void *)pElem->aSegsIn[i].addr, pElem->aSegsIn[i].pv,
-                  pElem->aSegsIn[i].cb, cbSegLen));
-
-            PDMDevHlpPCIPhysWrite(pState->CTX_SUFF(pDevIns),
-                                  pElem->aSegsIn[i].addr + cbSkip,
-                                  pElem->aSegsIn[i].pv,
-                                  cbSegLen);
-        }
-
-        cbSkip = 0;
-        cbLen -= cbSegLen;
-    }
-
-    Log2(("%s virtQueuePut: %s"
-          " used_idx=%u guest_used_idx=%u id=%u len=%u\n",
-          INSTANCE(pState), QUEUENAME(pState, pQueue),
-          pQueue->uNextUsedIndex, virtQueueReadUsedIndex(pState, &pQueue->VirtQ),
-          pElem->idx, uTotalLen));
-
-    virtQueueWriteUsedElem(pState, &pQueue->VirtQ,
-                       pQueue->uNextUsedIndex++,
-                       pElem->idx, uTotalLen);
-*/
-
-}
-
-
-void virtQueueNotify(PVIRTIOSTATE pState, PVQUEUE pQueue)
-{
-
-    RT_NOREF2(pState, pQueue);
-/* PK TODO Adapt to VirtIO 1.0
-    LogFlow(("%s virtQueueNotify: %s availFlags=%x guestFeatures=%x virtQueue is %sempty\n",
-             INSTANCE(pState), QUEUENAME(pState, pQueue),
-             virtQueueReadAvailFlags(pState, &pQueue->VirtQ),
-             pState->uGuestFeatures, virtQueueIsEmpty(pState, pQueue)?"":"not "));
-    if (!(virtQueueReadAvailFlags(pState, &pQueue->VirtQ) & VIRTQ_AVAIL_T_F_NO_INTERRUPT)
-        || ((pState->uGuestFeatures & VIRTIO_F_NOTIFY_ON_EMPTY) && virtQueueIsEmpty(pState, pQueue)))
-    {
-        int rc = virtioRaiseInterrupt(pState, VERR_INTERNAL_ERROR, VIRTIO_ISR_QUEUE);
-        if (RT_FAILURE(rc))
-            Log(("%s virtQueueNotify: Failed to raise an interrupt (%Rrc).\n", INSTANCE(pState), rc));
-    }
-*/
-}
-
-void virtQueueSync(PVIRTIOSTATE pState, PVQUEUE pQueue)
-{
-    RT_NOREF(pState, pQueue);
-/* PK TODO Adapt to VirtIO 1.0
-    Log2(("%s virtQueueSync: %s old_used_idx=%u new_used_idx=%u\n", INSTANCE(pState),
-          QUEUENAME(pState, pQueue), virtQueueReadUsedIndex(pState, &pQueue->VirtQ), pQueue->uNextUsedIndex));
-    virtQueueWriteUsedIndex(pState, &pQueue->VirtQ, pQueue->uNextUsedIndex);
-    virtQueueNotify(pState, pQueue);
-*/
-}
-
-
-
-/**
- * Raise interrupt.
- *
- * @param   pState      The device state structure.
- * @param   rcBusy      Status code to return when the critical section is busy.
- * @param   u8IntCause  Interrupt cause bit mask to set in PCI ISR port.
- */
-__attribute__((unused))
-int virtioRaiseInterrupt(VIRTIOSTATE *pState, int rcBusy, uint8_t u8IntCause)
-{
-    RT_NOREF2(pState, u8IntCause);
-    RT_NOREF_PV(rcBusy);
-    LogFlow(("%s virtioRaiseInterrupt: u8IntCause=%x\n",
-             INSTANCE(pState), u8IntCause));
-
-    pState->uISR |= u8IntCause;
-    PDMDevHlpPCISetIrq(pState->CTX_SUFF(pDevIns), 0, 1);
-    return VINF_SUCCESS;
-}
-
-/**
- * Lower interrupt.
- *
- * @param   pState      The device state structure.
- */
-__attribute__((unused))
-static void virtioLowerInterrupt(VIRTIOSTATE *pState)
-{
-    LogFlow(("%s virtioLowerInterrupt\n", INSTANCE(pState)));
-    PDMDevHlpPCISetIrq(pState->CTX_SUFF(pDevIns), 0, 0);
-}
-
-
-#ifdef IN_RING3
-/**
- * Saves the state of device.
- *
- * @returns VBox status code.
- * @param   pDevIns     The device instance.
- * @param   pSSM        The handle to the saved state.
- */
-int virtioSaveExec(PVIRTIOSTATE pVirtio, PSSMHANDLE pSSM)
-{
-    int rc = VINF_SUCCESS;
-    virtioDumpState(pVirtio, "virtioSaveExec");
-    RT_NOREF(pSSM);
-    /*
-     * PK TODO save guest features, queue selector, sttus ISR,
-     *              and per queue info (size, address, indicies)...
-     * using calls like SSMR3PutU8(), SSMR3PutU16(), SSMR3PutU16()...
-     * and AssertRCReturn(rc, rc)
-     */
-
-    return rc;
-}
-
-/**
- * Loads a saved device state.
- *
- * @returns VBox status code.
- * @param   pDevIns     The device instance.
- * @param   pSSM        The handle to the saved state.
- * @param   uVersion    The data unit version number.
- * @param   uPass       The data pass.
- */
-int virtioLoadExec(PVIRTIOSTATE pVirtio, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass, uint32_t uNumQueues)
-{
-    RT_NOREF5(pVirtio, pSSM, uVersion, uPass, uNumQueues);
-    int rc = VINF_SUCCESS;
-    virtioDumpState(pVirtio, "virtioLoadExec");
-
-    /*
-     * PK TODO, restore everything saved in virtioSaveExect, using
-     * using calls like SSMR3PutU8(), SSMR3PutU16(), SSMR3PutU16()...
-     * and AssertRCReturn(rc, rc)
-     */
-    if (uPass == SSM_PASS_FINAL)
-    {
-    }
-    return rc;
-}
-
-/**
+void virtioQueuePut(VIRTIOHANDLE hVirtio, uint16_t qIdx, PVIRTQ_BUF_VECTOR_T pBufVec, uint32_t cb)
+{
+    PVIRTIOSTATE pVirtio = (PVIRTIOSTATE)hVirtio;
+    PVIRTQ_CONTEXT_T pQueueContext = &pVirtio->queueContext[qIdx];
+
+    Log2Func(("%s: %s desc_idx=%u acb=%u\n",
+             INSTANCE(pVirtio), pQueueContext->pcszName, pBufVec->uDescIdx, cb));
+
+    uint32_t cbRemaining = cb;
+
+    for (uint32_t iSeg = 0; iSeg < pBufVec->cSegsIn && cbRemaining > 0; ++iSeg)
+    {
+        uint32_t cbSegLen = pBufVec->aSegsIn[iSeg].cb;
+        if (cbSegLen > cbRemaining)   // last segment only partially used?
+            cbSegLen = cbRemaining;
+
+        Assert(pBufVec->aSegsIn[iSeg].pv != NULL);
+
+        if (pBufVec->aSegsIn[iSeg].pv != NULL)
+        {
+            Log2Func(("%s: %s used_idx=%u seg=%u addr=%p pv=%p cb=%u acb=%u\n",
+                     INSTANCE(pVirtio), pQueueContext->pcszName,
+                     pQueueContext->uNextUsedIdx, iSeg,
+                     (void *)pBufVec->aSegsIn[iSeg].addr, pBufVec->aSegsIn[iSeg].pv,
+                     pBufVec->aSegsIn[iSeg].cb, cbSegLen));
+
+            PDMDevHlpPCIPhysWrite(pVirtio->CTX_SUFF(pDevIns),
+                 pBufVec->aSegsIn[iSeg].addr, pBufVec->aSegsIn[iSeg].pv, cbSegLen);
+        }
+        cbRemaining -= cbSegLen;
+    }
+
+    uint16_t uDescIdx = vqReadUsedDescIdx(pVirtio, qIdx);
+    Log2Func(("%s: %s used_idx=%u guest_used_idx=%u id=%u len=%u\n",
+          INSTANCE(pVirtio), pQueueContext->pcszName,
+          pQueueContext->uNextUsedIdx, uDescIdx, pBufVec->uDescIdx, cb));
+
+    vqWriteUsedElem(pVirtio, qIdx, pQueueContext->uNextUsedIdx, pBufVec->uDescIdx, cb);
+}
+
+void virtioQueueSync(VIRTIOHANDLE hVirtio, uint16_t qIdx)
+{
+    PVIRTIOSTATE pVirtio = (PVIRTIOSTATE)hVirtio;
+    PVIRTQ_CONTEXT_T pQueueContext = &pVirtio->queueContext[qIdx];
+
+    uint16_t uDescIdx = vqReadUsedDescIdx(pVirtio, qIdx);
+    Log2Func(("%s: %s old_used_idx=%u new_used_idx=%u\n", INSTANCE(pVirtio), pQueueContext->uNextUsedIdx, uDescIdx));
+    vqWriteUsedRingDescIdx(pVirtio, qIdx, pQueueContext->uNextUsedIdx);
+    vqNotify(pVirtio, qIdx);
+}
+
+/**
+ *
+ * NOTE: The consumer (PDM device) must call this function to 'forward' a relocation call.
+ *
  * Device relocation callback.
+ *
  *
  * When this callback is called the device instance data, and if the
@@ -464 +324 @@
     RT_NOREF(offDelta);
     PVIRTIOSTATE pVirtio = *PDMINS_2_DATA(pDevIns, PVIRTIOSTATE *);
-
+    LogFunc(("%s\n", INSTANCE(pVirtio)));
+
+    pVirtio->pDevInsR3 = pDevIns;
     pVirtio->pDevInsRC = PDMDEVINS_2_RCPTR(pDevIns);
-    // TBD
-}
-
-PVQUEUE virtioAddQueue(VIRTIOSTATE* pState, unsigned cbQueue, const char *pcszName)
-{
-
-    RT_NOREF3(pState, cbQueue, pcszName);
-/* PK TODO Adapt to VirtIO 1.0
-
-    PVQUEUE pQueue = NULL;
-    // Find an empty queue slot
-    for (unsigned i = 0; i < pState->uNumQueues; i++)
-    {
-        if (pState->Queues[i].VirtQ.cbQueue == 0)
-        {
-            pQueue = &pState->Queues[i];
-            break;
-        }
-    }
-
-    if (!pQueue)
-    {
-        Log(("%s Too many queues being added, no empty slots available!\n", INSTANCE(pState)));
-    }
-    else
-    {
-        pQueue->VirtQ.cbQueue = cbQueue;
-        pQueue->VirtQ.addrDescriptors = 0;
-        pQueue->uPageNumber = 0;
-        pQueue->pfnCallback = pfnCallback;
-        pQueue->pcszName    = pcszName;
-    }
-    return pQueue;
-*/
-    return NULL;// Temporary
-}
-
-
-
+    pVirtio->pDevInsR0 = PDMDEVINS_2_R0PTR(pDevIns);
+}
+
+/**
+ * Raise interrupt.
+ *
+ * @param   pVirtio         The device state structure.
+ * @param   uCause          Interrupt cause bit mask to set in PCI ISR port.
+ */
+static int virtioRaiseInterrupt(PVIRTIOSTATE pVirtio, uint8_t uCause)
+{
+   if (uCause == VIRTIO_ISR_VIRTQ_INTERRUPT)
+       LogFlowFunc(("%s: Cause: queue interrupt\n", INSTANCE(pVirtio)));
+   else
+   if (uCause == VIRTIO_ISR_DEVICE_CONFIG)
+       LogFlowFunc(("%s: Cause: device config\n", INSTANCE(pVirtio)));
+
+    pVirtio->uISR |= uCause;
+    PDMDevHlpPCISetIrq(pVirtio->CTX_SUFF(pDevIns), 0, 1);
+    return VINF_SUCCESS;
+}
+
+/**
+ * Lower interrupt.
+ *
+ * @param   pVirtio      The device state structure.
+ */
 __attribute__((unused))
-static void virtQueueInit(PVQUEUE pQueue, uint32_t uPageNumber)
-{
-    RT_NOREF2(pQueue, uPageNumber);
-
-/* PK TODO, re-work this for VirtIO 1.0
-    pQueue->VirtQ.addrDescriptors = (uint64_t)uPageNumber << PAGE_SHIFT;
-
-    pQueue->VirtQ.addrAvail = pQueue->VirtQ.addrDescriptors
-                                + sizeof(VIRTQ_DESC_T) * pQueue->VirtQ.cbQueue;
-
-    pQueue->VirtQ.addrUsed  = RT_ALIGN(pQueue->VirtQ.addrAvail
-            + RT_UOFFSETOF_DYN(VIRTQ_AVAIL_T, ring[pQueue->VirtQ.cbQueue])
-            + sizeof(uint16_t), // virtio 1.0 adds a 16-bit field following ring data
-              PAGE_SIZE); // The used ring must start from the next page.
-
-    pQueue->uNextAvailIndex       = 0;
-    pQueue->uNextUsedIndex        = 0;
-*/
-
-}
-
-
-__attribute__((unused))
-static void virtQueueReset(PVQUEUE pQueue)
-{
-    RT_NOREF(pQueue);
-/* PK TODO Adapt to VirtIO 1.0
-    pQueue->VirtQ.addrDescriptors = 0;
-    pQueue->VirtQ.addrAvail       = 0;
-    pQueue->VirtQ.addrUsed        = 0;
-    pQueue->uNextAvailIndex           = 0;
-    pQueue->uNextUsedIndex            = 0;
-    pQueue->uPageNumber               = 0;
-*/
+static void virtioLowerInterrupt(PVIRTIOSTATE pVirtio)
+{
+    LogFlowFunc(("%s\n", INSTANCE(pVirtio)));
+    PDMDevHlpPCISetIrq(pVirtio->CTX_SUFF(pDevIns), 0, 0);
 }
 
@@ -548 +368 @@
  * @param   fConfigChange       - True if cfg change notification else, queue notification
  */
-static void virtioNotifyDriver(VIRTIOHANDLE hVirtio, bool fConfigChange)
-{
-   RT_NOREF(hVirtio);
-   LogFunc(("fConfigChange = %d\n", fConfigChange));
-}
-
-
-int virtioReset(VIRTIOHANDLE hVirtio)  /* Part of our "custom API" */
-{
-    PVIRTIOSTATE pVirtio = H2P(hVirtio);
-
-    RT_NOREF(pVirtio);
-/* PK TODO Adapt to VirtIO 1.09
-    pState->uGuestFeatures = 0;
-    pState->uQueueSelector = 0;
-    pState->uStatus        = 0;
-    pState->uISR           = 0;
-
-    for (unsigned i = 0; i < pState->uNumQueues; i++)
-        virtQueueReset(&pState->Queues[i]);
-    virtioNotify(pVirtio);
-*/
-    return VINF_SUCCESS;
+__attribute__((unused))
+static void virtioNotifyDriver(PVIRTIOSTATE pVirtio, uint8_t uCause)
+{
+/**
+ * add criteria
+ */
+   RT_NOREF(pVirtio);
+   if (uCause == VIRTIO_ISR_VIRTQ_INTERRUPT)
+       Log2Func(("%s: Cause: queue interrupt\n", INSTANCE(pVirtio)));
+   else
+   if (uCause == VIRTIO_ISR_DEVICE_CONFIG)
+       Log2Func(("%s: Cause: device config\n", INSTANCE(pVirtio)));
 }
 
@@ -580 +389 @@
     {
         pVirtio->fGenUpdatePending = true;
-        virtioNotifyDriver(pVirtio, true);
-    }
-}
+        virtioNotifyDriver(pVirtio, VIRTIO_ISR_DEVICE_CONFIG);
+    }
+}
+
+static void vqReset(PVIRTIOSTATE pVirtio, uint16_t qIdx)
+{
+    PVIRTQ_CONTEXT_T pVirtQ = &pVirtio->queueContext[qIdx];
+    pVirtQ->uNextAvailIdx          = 0;
+    pVirtQ->uNextUsedIdx           = 0;
+    pVirtio->uQueueSize[qIdx]      = VIRTQ_MAX_SIZE;
+    pVirtio->uQueueNotifyOff[qIdx] = qIdx;
+}
+
 
 static void virtioResetDevice(PVIRTIOSTATE pVirtio)
 {
-
-    LogFunc(("\n"));
-    pVirtio->uDeviceStatus          = 0;
+    Log2Func(("\n"));
     pVirtio->uDeviceFeaturesSelect  = 0;
     pVirtio->uDriverFeaturesSelect  = 0;
     pVirtio->uConfigGeneration      = 0;
-    pVirtio->uNumQueues             = VIRTIO_MAX_QUEUES;
-
-    for (uint32_t i = 0; i < pVirtio->uNumQueues; i++)
-    {
-        pVirtio->uQueueSize[i]      = VIRTQ_MAX_SIZE;
-        pVirtio->uQueueNotifyOff[i] = i;
-//      virtqNotify();
-    }
+    pVirtio->uDeviceStatus          = 0;
+    pVirtio->uISR                   = 0;
+
+#ifndef MSIX_SUPPORT
+    /** This is required by VirtIO 1.0 specification, section 4.1.5.1.2 */
+    pVirtio->uMsixConfig = VIRTIO_MSI_NO_VECTOR;
+    for (int i = 0; i < VIRTQ_MAX_CNT; i++)
+        pVirtio->uQueueMsixVector[i] = VIRTIO_MSI_NO_VECTOR;
+#endif
+
+#if DISABLE_GUEST_DRIVER  /** Temporary debugging aid */
+    pVirtio->uNumQueues = 0;
+#else
+    pVirtio->uNumQueues = VIRTQ_MAX_CNT;
+#endif
+    for (uint16_t qIdx = 0; qIdx < pVirtio->uNumQueues; qIdx++)
+        vqReset(pVirtio, qIdx);
 }
 
@@ -616 +442 @@
     int rc = VINF_SUCCESS;
     uint64_t val;
-    if (COMMON_CFG(uDeviceFeatures))
+    if (MATCH_COMMON_CFG(uDeviceFeatures))
     {
         if (fWrite) /* Guest WRITE pCommonCfg>uDeviceFeatures */
@@ -622 +448 @@
         else /* Guest READ pCommonCfg->uDeviceFeatures */
         {
-            uint32_t uIntraOff = uOffset - RT_OFFSETOF(VIRTIO_PCI_COMMON_CFG_T, uDeviceFeatures);
+            uint32_t uIntraOff = uOffset - RT_UOFFSETOF(VIRTIO_PCI_COMMON_CFG_T, uDeviceFeatures);
             switch(pVirtio->uDeviceFeaturesSelect)
             {
@@ -628 +454 @@
                     val = pVirtio->uDeviceFeatures & 0xffffffff;
                     memcpy((void *)pv, (const void *)&val, cb);
-                    LOG_ACCESSOR(uDeviceFeatures);
+                    LOG_COMMON_CFG_ACCESS(uDeviceFeatures);
                     break;
                 case 1:
@@ -634 +460 @@
                     uIntraOff += 4;
                     memcpy((void *)pv, (const void *)&val, cb);
-                    LOG_ACCESSOR(uDeviceFeatures);
+                    LOG_COMMON_CFG_ACCESS(uDeviceFeatures);
                     break;
                 default:
-                    LogFunc(("Guest read uDeviceFeatures with out of range selector (%d), returning 0\n",
+                    Log2Func(("Guest read uDeviceFeatures with out of range selector (%d), returning 0\n",
                           pVirtio->uDeviceFeaturesSelect));
                     return VERR_ACCESS_DENIED;
@@ -643 +469 @@
         }
     }
-    else if (COMMON_CFG(uDriverFeatures))
+    else if (MATCH_COMMON_CFG(uDriverFeatures))
     {
         if (fWrite) /* Guest WRITE pCommonCfg->udriverFeatures */
         {
-            uint32_t uIntraOff = uOffset - RT_OFFSETOF(VIRTIO_PCI_COMMON_CFG_T, uDriverFeatures);
+            uint32_t uIntraOff = uOffset - RT_UOFFSETOF(VIRTIO_PCI_COMMON_CFG_T, uDriverFeatures);
             switch(pVirtio->uDriverFeaturesSelect)
             {
                 case 0:
                     memcpy(&pVirtio->uDriverFeatures, pv, cb);
-                    LOG_ACCESSOR(uDriverFeatures);
+                    LOG_COMMON_CFG_ACCESS(uDriverFeatures);
                     break;
                 case 1:
                     memcpy(((char *)&pVirtio->uDriverFeatures) + sizeof(uint32_t), pv, cb);
                     uIntraOff += 4;
-                    LOG_ACCESSOR(uDriverFeatures);
+                    LOG_COMMON_CFG_ACCESS(uDriverFeatures);
                     break;
                 default:
-                    LogFunc(("Guest wrote uDriverFeatures with out of range selector (%d), returning 0\n",
+                    Log2Func(("Guest wrote uDriverFeatures with out of range selector (%d), returning 0\n",
                          pVirtio->uDriverFeaturesSelect));
                     return VERR_ACCESS_DENIED;
@@ -667 +493 @@
         else /* Guest READ pCommonCfg->udriverFeatures */
         {
-            uint32_t uIntraOff = uOffset - RT_OFFSETOF(VIRTIO_PCI_COMMON_CFG_T, uDriverFeatures);
+            uint32_t uIntraOff = uOffset - RT_UOFFSETOF(VIRTIO_PCI_COMMON_CFG_T, uDriverFeatures);
             switch(pVirtio->uDriverFeaturesSelect)
             {
@@ -673 +499 @@
                     val = pVirtio->uDriverFeatures & 0xffffffff;
                     memcpy((void *)pv, (const void *)&val, cb);
-                    LOG_ACCESSOR(uDriverFeatures);
+                    LOG_COMMON_CFG_ACCESS(uDriverFeatures);
                     break;
                 case 1:
@@ -679 +505 @@
                     uIntraOff += 4;
                     memcpy((void *)pv, (const void *)&val, cb);
-                    LOG_ACCESSOR(uDriverFeatures);
+                    LOG_COMMON_CFG_ACCESS(uDriverFeatures);
                     break;
                 default:
-                    LogFunc(("Guest read uDriverFeatures with out of range selector (%d), returning 0\n",
+                    Log2Func(("Guest read uDriverFeatures with out of range selector (%d), returning 0\n",
                          pVirtio->uDriverFeaturesSelect));
                     return VERR_ACCESS_DENIED;
@@ -688 +514 @@
         }
     }
-    else if (COMMON_CFG(uNumQueues))
+    else if (MATCH_COMMON_CFG(uNumQueues))
     {
         if (fWrite)
         {
-            LogFunc(("Guest attempted to write readonly virtio_pci_common_cfg.num_queues\n"));
+            Log2Func(("Guest attempted to write readonly virtio_pci_common_cfg.num_queues\n"));
             return VERR_ACCESS_DENIED;
         }
@@ -698 +524 @@
         {
             uint32_t uIntraOff = 0;
-            *(uint16_t *)pv = VIRTIO_MAX_QUEUES;
-            LOG_ACCESSOR(uNumQueues);
-        }
-    }
-    else if (COMMON_CFG(uDeviceStatus))
+            *(uint16_t *)pv = VIRTQ_MAX_CNT;
+            LOG_COMMON_CFG_ACCESS(uNumQueues);
+        }
+    }
+    else if (MATCH_COMMON_CFG(uDeviceStatus))
     {
         if (fWrite) /* Guest WRITE pCommonCfg->uDeviceStatus */
         {
             pVirtio->uDeviceStatus = *(uint8_t *)pv;
-            LogFunc(("Guest wrote uDeviceStatus ................ ("));
+            Log2Func(("Guest wrote uDeviceStatus ................ ("));
             virtioLogDeviceStatus(pVirtio->uDeviceStatus);
             Log((")\n"));
             if (pVirtio->uDeviceStatus == 0)
                 virtioResetDevice(pVirtio);
+            pVirtio->virtioCallbacks.pfnVirtioStatusChanged(
+                    (VIRTIOHANDLE)pVirtio, pVirtio->uDeviceStatus & VIRTIO_STATUS_DRIVER_OK);
         }
         else /* Guest READ pCommonCfg->uDeviceStatus */
         {
-            LogFunc(("Guest read  uDeviceStatus ................ ("));
+            Log2Func(("Guest read  uDeviceStatus ................ ("));
             *(uint32_t *)pv = pVirtio->uDeviceStatus;
             virtioLogDeviceStatus(pVirtio->uDeviceStatus);
@@ -721 +549 @@
         }
     }
-    else if (COMMON_CFG(uMsixConfig))
-    {
-        ACCESSOR(uMsixConfig);
-    }
-    else if (COMMON_CFG(uDeviceFeaturesSelect))
-    {
-        ACCESSOR(uDeviceFeaturesSelect);
-    }
-    else if (COMMON_CFG(uDriverFeaturesSelect))
-    {
-        ACCESSOR(uDriverFeaturesSelect);
-    }
-    else if (COMMON_CFG(uConfigGeneration))
-    {
-        ACCESSOR_READONLY(uConfigGeneration);
-    }
-    else if (COMMON_CFG(uQueueSelect))
-    {
-        ACCESSOR(uQueueSelect);
-    }
-    else if (COMMON_CFG(uQueueSize))
-    {
-        ACCESSOR_WITH_IDX(uQueueSize, pVirtio->uQueueSelect);
-    }
-    else if (COMMON_CFG(uQueueMsixVector))
-    {
-        ACCESSOR_WITH_IDX(uQueueMsixVector, pVirtio->uQueueSelect);
-    }
-    else if (COMMON_CFG(uQueueEnable))
-    {
-        ACCESSOR_WITH_IDX(uQueueEnable, pVirtio->uQueueSelect);
-    }
-    else if (COMMON_CFG(uQueueNotifyOff))
-    {
-        ACCESSOR_READONLY_WITH_IDX(uQueueNotifyOff, pVirtio->uQueueSelect);
-    }
-    else if (COMMON_CFG(uQueueDesc))
-    {
-        ACCESSOR_WITH_IDX(uQueueDesc, pVirtio->uQueueSelect);
-    }
-    else if (COMMON_CFG(uQueueAvail))
-    {
-        ACCESSOR_WITH_IDX(uQueueAvail, pVirtio->uQueueSelect);
-    }
-    else if (COMMON_CFG(uQueueUsed))
-    {
-        ACCESSOR_WITH_IDX(uQueueUsed, pVirtio->uQueueSelect);
+    else if (MATCH_COMMON_CFG(uMsixConfig))
+    {
+        COMMON_CFG_ACCESSOR(uMsixConfig);
+    }
+    else if (MATCH_COMMON_CFG(uDeviceFeaturesSelect))
+    {
+        COMMON_CFG_ACCESSOR(uDeviceFeaturesSelect);
+    }
+    else if (MATCH_COMMON_CFG(uDriverFeaturesSelect))
+    {
+        COMMON_CFG_ACCESSOR(uDriverFeaturesSelect);
+    }
+    else if (MATCH_COMMON_CFG(uConfigGeneration))
+    {
+        COMMON_CFG_ACCESSOR_READONLY(uConfigGeneration);
+    }
+    else if (MATCH_COMMON_CFG(uQueueSelect))
+    {
+        COMMON_CFG_ACCESSOR(uQueueSelect);
+    }
+    else if (MATCH_COMMON_CFG(uQueueSize))
+    {
+        COMMON_CFG_ACCESSOR_INDEXED(uQueueSize, pVirtio->uQueueSelect);
+    }
+    else if (MATCH_COMMON_CFG(uQueueMsixVector))
+    {
+        COMMON_CFG_ACCESSOR_INDEXED(uQueueMsixVector, pVirtio->uQueueSelect);
+    }
+    else if (MATCH_COMMON_CFG(uQueueEnable))
+    {
+        COMMON_CFG_ACCESSOR_INDEXED(uQueueEnable, pVirtio->uQueueSelect);
+    }
+    else if (MATCH_COMMON_CFG(uQueueNotifyOff))
+    {
+        COMMON_CFG_ACCESSOR_INDEXED_READONLY(uQueueNotifyOff, pVirtio->uQueueSelect);
+    }
+    else if (MATCH_COMMON_CFG(pGcPhysQueueDesc))
+    {
+        COMMON_CFG_ACCESSOR_INDEXED(pGcPhysQueueDesc, pVirtio->uQueueSelect);
+    }
+    else if (MATCH_COMMON_CFG(pGcPhysQueueAvail))
+    {
+        COMMON_CFG_ACCESSOR_INDEXED(pGcPhysQueueAvail, pVirtio->uQueueSelect);
+    }
+    else if (MATCH_COMMON_CFG(pGcPhysQueueUsed))
+    {
+        COMMON_CFG_ACCESSOR_INDEXED(pGcPhysQueueUsed, pVirtio->uQueueSelect);
     }
     else
     {
-        LogFunc(("Bad guest %s access to virtio_pci_common_cfg: uOffset=%d, cb=%d\n",
+        Log2Func(("Bad guest %s access to virtio_pci_common_cfg: uOffset=%d, cb=%d\n",
             fWrite ? "write" : "read ", uOffset, cb));
         rc = VERR_ACCESS_DENIED;
@@ -794 +622 @@
     PVIRTIOSTATE pVirtio = *PDMINS_2_DATA(pDevIns, PVIRTIOSTATE *);
     int rc = VINF_SUCCESS;
-
-//#ifdef LOG_ENABLED
-//    LogFunc(("pVirtio=%#p GCPhysAddr=%RGp pv=%#p{%.*Rhxs} cb=%u\n", pVirtio, GCPhysAddr, pv, cb, pv, cb));
-//#endif
 
     MATCH_VIRTIO_CAP_STRUCT(pVirtio->pGcPhysDeviceCap, pVirtio->pDeviceCap,     fDevSpecific);
@@ -824 +648 @@
         {
             if (fDevSpecificFieldChanged)
-                LogFunc(("Dev specific config field changed since last read, gen++ = %d\n",
+                Log2Func(("Dev specific config field changed since last read, gen++ = %d\n",
                      pVirtio->uConfigGeneration));
             else
-                LogFunc(("Config generation pending flag set, gen++ = %d\n",
+                Log2Func(("Config generation pending flag set, gen++ = %d\n",
                      pVirtio->uConfigGeneration));
             ++pVirtio->uConfigGeneration;
@@ -842 +666 @@
     if (fIsrCap)
     {
-        *(uint8_t *)pv = pVirtio->fQueueInterrupt | pVirtio->fDeviceConfigInterrupt << 1;
-        LogFunc(("Read 0x%s from pIsrCap\n", *(uint8_t *)pv));
+        *(uint8_t *)pv = pVirtio->uISR;
+        Log2Func(("Read 0x%02x from uISR (virtq interrupt: %d, dev config interrupt: %d)\n",
+              pVirtio->uISR & 0xff,
+              pVirtio->uISR & VIRTIO_ISR_VIRTQ_INTERRUPT,
+              !!(pVirtio->uISR & VIRTIO_ISR_DEVICE_CONFIG)));
+        pVirtio->uISR = 0; /** VirtIO specification requires reads of ISR to clear it */
     }
     else {
 
-        AssertMsgFailed(("virtio: Read outside of capabilities region: GCPhysAddr=%RGp cb=%RGp\n", GCPhysAddr, cb));
+       Log2Func(("Bad read access to mapped capabilities region:\n"
+                "                  pVirtio=%#p GCPhysAddr=%RGp cb=%u\n",
+                pVirtio, GCPhysAddr, pv, cb, pv, cb));
     }
     return rc;
 }
-
 /**
  * Memory mapped I/O Handler for PCI Capabilities write operations.
@@ -869 +698 @@
     int rc = VINF_SUCCESS;
 
-//#ifdef LOG_ENABLED
-//    LogFunc(("pVirtio=%#p GCPhysAddr=%RGp pv=%#p{%.*Rhxs} cb=%u\n", pVirtio, GCPhysAddr, pv, cb, pv, cb));
-//#endif
-
     MATCH_VIRTIO_CAP_STRUCT(pVirtio->pGcPhysDeviceCap, pVirtio->pDeviceCap,     fDevSpecific);
     MATCH_VIRTIO_CAP_STRUCT(pVirtio->pGcPhysCommonCfg, pVirtio->pCommonCfgCap,  fCommonCfg);
     MATCH_VIRTIO_CAP_STRUCT(pVirtio->pGcPhysIsrCap,    pVirtio->pIsrCap,        fIsrCap);
+    MATCH_VIRTIO_CAP_STRUCT(pVirtio->pGcPhysNotifyCap, pVirtio->pNotifyCap,     fNotifyCap);
 
     if (fDevSpecific)
@@ -891 +717 @@
     if (fIsrCap)
     {
-        pVirtio->fQueueInterrupt = (*(uint8_t *)pv) & 1;
-        pVirtio->fDeviceConfigInterrupt = !!(*((uint8_t *)pv) & 2);
-        Log(("pIsrCap... setting fQueueInterrupt=%d fDeviceConfigInterrupt=%d\n",
-              pVirtio->fQueueInterrupt, pVirtio->fDeviceConfigInterrupt));
+        pVirtio->uISR = *(uint8_t *)pv;
+        Log2Func(("Setting uISR = 0x%02x (virtq interrupt: %d, dev confg innterrupt: %d)\n",
+              pVirtio->uISR & 0xff,
+              pVirtio->uISR & VIRTIO_ISR_VIRTQ_INTERRUPT,
+              !!(pVirtio->uISR & VIRTIO_ISR_DEVICE_CONFIG)));
     }
     else
-    {
-       LogFunc(("virtio: Write outside of capabilities region:\nGCPhysAddr=%RGp cb=%RGp,", GCPhysAddr, cb));
+    if (fNotifyCap && cb == 2)
+    {
+        uint32_t uNotifyBaseOffset = GCPhysAddr - pVirtio->pGcPhysNotifyCap;
+        uint16_t qIdx = uNotifyBaseOffset / VIRTIO_NOTIFY_OFFSET_MULTIPLIER;
+        uint16_t uNotifiedIdx = *(uint16_t *)pv;
+        vqNotified(pVirtio, qIdx, uNotifiedIdx);
+    }
+    else
+    {
+       Log2Func(("Bad write access to mapped capabilities region:\n"
+                "                  pVirtio=%#p GCPhysAddr=%RGp pv=%#p{%.*Rhxs} cb=%u\n",
+                pVirtio, GCPhysAddr, pv, cb, pv, cb));
     }
     return rc;
 }
-
 
 /**
@@ -926 +762 @@
         if (RT_FAILURE(rc))
         {
-            LogFunc(("virtio: PCI Capabilities failed to map GCPhysAddr=%RGp cb=%RGp, region=%d\n",
+            Log2Func(("virtio: PCI Capabilities failed to map GCPhysAddr=%RGp cb=%RGp, region=%d\n",
                     GCPhysAddress, cb, iRegion));
             return rc;
         }
-        LogFunc(("virtio: PCI Capabilities mapped at GCPhysAddr=%RGp cb=%RGp, region=%d\n",
+        Log2Func(("virtio: PCI Capabilities mapped at GCPhysAddr=%RGp cb=%RGp, region=%d\n",
                 GCPhysAddress, cb, iRegion));
-        pVirtio->GCPhysPciCapBase = GCPhysAddress;
-        pVirtio->pGcPhysCommonCfg = GCPhysAddress + pVirtio->pCommonCfgCap->uOffset;
-        pVirtio->pGcPhysNotifyCap = GCPhysAddress + pVirtio->pNotifyCap->pciCap.uOffset;
-        pVirtio->pGcPhysIsrCap    = GCPhysAddress + pVirtio->pIsrCap->uOffset;
+        pVirtio->pGcPhysPciCapBase = GCPhysAddress;
+        pVirtio->pGcPhysCommonCfg  = GCPhysAddress + pVirtio->pCommonCfgCap->uOffset;
+        pVirtio->pGcPhysNotifyCap  = GCPhysAddress + pVirtio->pNotifyCap->pciCap.uOffset;
+        pVirtio->pGcPhysIsrCap     = GCPhysAddress + pVirtio->pIsrCap->uOffset;
         if (pVirtio->pDevSpecificCap)
             pVirtio->pGcPhysDeviceCap = GCPhysAddress + pVirtio->pDeviceCap->uOffset;
@@ -958 +794 @@
                                        uint32_t uAddress, unsigned cb)
 {
-//    PVIRTIOSTATE pVirtio = PDMINS_2_DATA(pDevIns, PVIRTIOSTATE);
     PVIRTIOSTATE pVirtio = *PDMINS_2_DATA(pDevIns, PVIRTIOSTATE *);
 
@@ -971 +806 @@
         uint32_t pv = 0;
         if (uBar == pVirtio->uVirtioCapBar)
-            (void)virtioR3MmioRead(pDevIns, NULL, (RTGCPHYS)((uint32_t)pVirtio->GCPhysPciCapBase + uOffset),
+            (void)virtioR3MmioRead(pDevIns, NULL, (RTGCPHYS)((uint32_t)pVirtio->pGcPhysPciCapBase + uOffset),
                                     &pv, uLength);
         else
         {
-            LogFunc(("Guest read virtio_pci_cfg_cap.pci_cfg_data using unconfigured BAR. Ignoring"));
+            Log2Func(("Guest read virtio_pci_cfg_cap.pci_cfg_data using unconfigured BAR. Ignoring"));
             return 0;
         }
-        LogFunc(("virtio: Guest read  virtio_pci_cfg_cap.pci_cfg_data, bar=%d, offset=%d, length=%d, result=%d\n",
+        Log2Func(("virtio: Guest read  virtio_pci_cfg_cap.pci_cfg_data, bar=%d, offset=%d, length=%d, result=%d\n",
                 uBar, uOffset, uLength, pv));
         return pv;
@@ -1015 +850 @@
         uint8_t  uBar    = pVirtio->pPciCfgCap->pciCap.uBar;
         if (uBar == pVirtio->uVirtioCapBar)
-            (void)virtioR3MmioWrite(pDevIns, NULL, (RTGCPHYS)((uint32_t)pVirtio->GCPhysPciCapBase + uOffset),
+            (void)virtioR3MmioWrite(pDevIns, NULL, (RTGCPHYS)((uint32_t)pVirtio->pGcPhysPciCapBase + uOffset),
                                     (void *)&u32Value, uLength);
         else
         {
-            LogFunc(("Guest wrote virtio_pci_cfg_cap.pci_cfg_data using unconfigured BAR. Ignoring"));
+            Log2Func(("Guest wrote virtio_pci_cfg_cap.pci_cfg_data using unconfigured BAR. Ignoring"));
             return VINF_SUCCESS;
         }
-        LogFunc(("Guest wrote  virtio_pci_cfg_cap.pci_cfg_data, bar=%d, offset=%x, length=%x, value=%d\n",
+        Log2Func(("Guest wrote  virtio_pci_cfg_cap.pci_cfg_data, bar=%d, offset=%x, length=%x, value=%d\n",
                 uBar, uOffset, uLength, u32Value));
         return VINF_SUCCESS;
@@ -1030 +865 @@
 
 /**
- * @interface_method_impl{PDMIBASE,pfnQueryInterface}
- */
-void *virtioQueryInterface(PPDMIBASE pInterface, const char *pszIID)
-{
-    VIRTIOSTATE *pThis = IFACE_TO_STATE(pInterface, IBase);
-    Assert(&pThis->IBase == pInterface);
-
-    PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThis->IBase);
-    return NULL;
-}
-
-/**
  * Get VirtIO accepted host-side features
  *
@@ -1047 +870 @@
  *
  * @param   pState          Virtio state
- * @param   uSelect         Selects which 32-bit set of feature information to return
- */
-
-__attribute__((unused))
-static uint64_t virtioGetHostFeatures(PVIRTIOSTATE pVirtio)
+ */
+uint64_t virtioGetAcceptedFeatures(PVIRTIOSTATE pVirtio)
 {
     return pVirtio->uDriverFeatures;
-}
-
-/**
- *
- * Set VirtIO available host-side features
- *
- * @returns VBox status code
- *
- * @param   pState              Virtio state
- * @param   uDeviceFeatures    Feature bits (0-63) to set
- */
-
-
-void virtioSetHostFeatures(VIRTIOHANDLE hVirtio, uint64_t uDeviceFeatures)
-{
-    H2P(hVirtio)->uDeviceFeatures = VIRTIO_F_VERSION_1 | uDeviceFeatures;
 }
 
@@ -1080 +884 @@
  * @param   pState      The device state structure.
  */
-int virtioDestruct(VIRTIOSTATE* pState)
-{
-    Log(("%s Destroying PCI instance\n", INSTANCE(pState)));
+int virtioDestruct(PVIRTIOSTATE pVirtio)
+{
+    RT_NOREF(pVirtio);
+    Log(("%s Destroying PCI instance\n", INSTANCE(pVirtio)));
     return VINF_SUCCESS;
 }
 
-/** PK (temp note to self):
- *
- *  Device needs to negotiate capabilities,
- *  then get queue size address information from driver.
- *
- * Still need consumer to pass in:
- *
- *  num_queues
- *  config_generation
- *  Needs to manage feature negotiation
- *  That means consumer needs to pass in device-specific feature bits/values
- *  Device has to provie at least one notifier capability
- *
- *  ISR config value are set by the device (config interrupt vs. queue interrupt)
- *
- */
-
 /**
  * Setup PCI device controller and Virtio state
  *
- * @param   pDevIns               Device instance data
- * @param   pVirtio               Device State
- * @param   iInstance             Instance number
- * @param   pPciParams            Values to populate industry standard PCI Configuration Space data structure
- * @param   pcszNameFmt           Device instance name (format-specifier)
+ * @param   pDevIns                  Device instance data
+ * @param   pVirtio                  Device State
+ * @param   pPciParams               Values to populate industry standard PCI Configuration Space data structure
+ * @param   pcszInstance             Device instance name (format-specifier)
  * @param   uNumQueues               Number of Virtio Queues created by consumer (driver)
- * @param   uVirtioRegion         Region number to map for PCi Capabilities structs
- * @param   devCapReadCallback    Client function to call back to handle device specific capabilities
- * @param   devCapWriteCallback   Client function to call back to handle device specific capabilities
- * @param   cbDevSpecificCap      Size of device specific struct
- * @param   uNotifyOffMultiplier  See VirtIO 1.0 spec 4.1.4.4 re: virtio_pci_notify_cap
- */
-
-int   virtioConstruct(PPDMDEVINS pDevIns, PVIRTIOHANDLE phVirtio, int iInstance, PVIRTIOPCIPARAMS pPciParams,
-                    const char *pcszNameFmt, uint32_t uNumQueues, uint32_t uVirtioCapBar, uint64_t uDeviceFeatures,
-                    PFNVIRTIODEVCAPREAD devCapReadCallback, PFNVIRTIODEVCAPWRITE devCapWriteCallback,
-                    uint16_t cbDevSpecificCap, void *pDevSpecificCap,  uint32_t uNotifyOffMultiplier)
+ * @param   uVirtioCapBar            Region number to map for PCi Capabilities structs
+ * @param   uDevSpecificFeatures     VirtIO device-specific features offered by client
+ * @param   devCapReadCallback       Client handler to call upon guest read to device specific capabilities.
+ * @param   devCapWriteCallback      Client handler to call upon guest write to device specific capabilities.
+ * @param   devStatusChangedCallback Client handler to call for major device status changes
+ * @param   queueNotifiedCallback    Client handler for guest-to-host notifications that avail queue has ring data
+ * @param   ssmLiveExecCallback      Client handler for SSM live exec
+ * @param   ssmSaveExecCallback      Client handler for SSM save exec
+ * @param   ssmLoadExecCallback      Client handler for SSM load exec
+ * @param   ssmLoadDoneCallback      Client handler for SSM load done
+ * @param   cbDevSpecificCap         Size of virtio_pci_device_cap device-specific struct
+ */
+int   virtioConstruct(PPDMDEVINS             pDevIns,
+                      VIRTIOHANDLE          *phVirtio,
+                      PVIRTIOPCIPARAMS       pPciParams,
+                      const char             *pcszInstance,
+                      uint32_t               uNumQueues,
+                      uint32_t               uVirtioCapBar,
+                      uint64_t               uDevSpecificFeatures,
+                      PFNVIRTIODEVCAPREAD    devCapReadCallback,
+                      PFNVIRTIODEVCAPWRITE   devCapWriteCallback,
+                      PFNVIRTIOSTATUSCHANGED devStatusChangedCallback,
+                      PFNVIRTIOQUEUENOTIFIED queueNotifiedCallback,
+                      PFNSSMDEVLIVEEXEC      ssmLiveExecCallback,
+                      PFNSSMDEVSAVEEXEC      ssmSaveExecCallback,
+                      PFNSSMDEVLOADEXEC      ssmLoadExecCallback,
+                      PFNSSMDEVLOADDONE      ssmLoadDoneCallback,
+                      uint16_t               cbDevSpecificCap,
+                      void                  *pDevSpecificCap)
 {
 
@@ -1134 +939 @@
     }
 
-
     pVirtio->uNumQueues = uNumQueues;
-    pVirtio->uNotifyOffMultiplier = uNotifyOffMultiplier;
-    pVirtio->uDeviceFeatures = VIRTIO_F_VERSION_1 | uDeviceFeatures;
-
-    /* Init handles and log related stuff. */
-    RTStrPrintf(pVirtio->szInstance, sizeof(pVirtio->szInstance), pcszNameFmt, iInstance);
+
+    /**
+     * The host features offered include both device-specific features
+     * and reserved feature bits (device independent)
+     */
+    pVirtio->uDeviceFeatures = uDevSpecificFeatures
+                             | VIRTIO_F_VERSION_1
+                             | VIRTIO_F_RING_EVENT_IDX
+                             | VIRTIO_F_RING_INDIRECT_DESC;
+
+    RTStrCopy(pVirtio->szInstance, sizeof(pVirtio->szInstance), pcszInstance);
 
     pVirtio->pDevInsR3 = pDevIns;
@@ -1147 +957 @@
     pVirtio->uDeviceStatus = 0;
     pVirtio->cbDevSpecificCap = cbDevSpecificCap;
-    pVirtio->pDevSpecificCap = pDevSpecificCap;
-    /**
-     * Need to keep a history of this relatively small virtio device-specific
-     * configuration buffer, which is opaque to this encapsulation of the generic
-     * part virtio operations, to track config changes to fields, in order to
-     * update the configuration generation each change. (See VirtIO 1.0 section 4.1.4.3.1)
-     */
+    pVirtio->pDevSpecificCap  = pDevSpecificCap;
+
     pVirtio->pPrevDevSpecificCap = RTMemAlloc(cbDevSpecificCap);
     if (!pVirtio->pPrevDevSpecificCap)
@@ -1161 +966 @@
         return VERR_NO_MEMORY;
     }
+
     memcpy(pVirtio->pPrevDevSpecificCap, pVirtio->pDevSpecificCap, cbDevSpecificCap);
     pVirtio->uVirtioCapBar = uVirtioCapBar;
-    pVirtio->virtioCallbacks.pfnVirtioDevCapRead = devCapReadCallback;
-    pVirtio->virtioCallbacks.pfnVirtioDevCapWrite = devCapWriteCallback;
+    pVirtio->virtioCallbacks.pfnVirtioDevCapRead    = devCapReadCallback;
+    pVirtio->virtioCallbacks.pfnVirtioDevCapWrite   = devCapWriteCallback;
+    pVirtio->virtioCallbacks.pfnVirtioStatusChanged = devStatusChangedCallback;
+    pVirtio->virtioCallbacks.pfnVirtioQueueNotified = queueNotifiedCallback;
+    pVirtio->virtioCallbacks.pfnSSMDevLiveExec      = ssmLiveExecCallback;
+    pVirtio->virtioCallbacks.pfnSSMDevSaveExec      = ssmSaveExecCallback;
+    pVirtio->virtioCallbacks.pfnSSMDevLoadExec      = ssmLoadExecCallback;
+    pVirtio->virtioCallbacks.pfnSSMDevLoadDone      = ssmLoadDoneCallback;
+
 
     /* Set PCI config registers (assume 32-bit mode) */
@@ -1187 +1000 @@
     }
 
-    pVirtio->IBase = pDevIns->IBase;
+    rc = PDMDevHlpSSMRegisterEx(pDevIns, VIRTIO_SAVEDSTATE_VERSION, sizeof(*pVirtio), NULL,
+                                NULL, virtioR3LiveExec, NULL, NULL, virtioR3SaveExec, NULL,
+                                NULL, virtioR3LoadExec, virtioR3LoadDone);
+    if (RT_FAILURE(rc))
+    {
+        RTMemFree(pVirtio);
+        return PDMDEV_SET_ERROR(pDevIns, rc,
+            N_("virtio: cannot register SSM callbacks"));
+    }
 
     PDMDevHlpPCISetConfigCallbacks(pDevIns, &pVirtio->dev,
                 virtioPciConfigRead,  &pVirtio->pfnPciConfigReadOld,
                 virtioPciConfigWrite, &pVirtio->pfnPciConfigWriteOld);
+
 
     /** Construct & map PCI vendor-specific capabilities for virtio host negotiation with guest driver */
@@ -1201 +1023 @@
 #endif
 
-    /* The following capability mapped via VirtIO 1.0: struct virtio_pci_cfg_cap (VIRTIO_PCI_CFG_CAP_T)
+    /** The following capability mapped via VirtIO 1.0: struct virtio_pci_cfg_cap (VIRTIO_PCI_CFG_CAP_T)
      * as a mandatory but suboptimal alternative interface to host device capabilities, facilitating
      * access the memory of any BAR. If the guest uses it (the VirtIO driver on Linux doesn't),
@@ -1219 +1041 @@
     pCfg->uCapNext = CFGADDR2IDX(pCfg) + pCfg->uCapLen;
     pCfg->uBar     = uVirtioCapBar;
-    pCfg->uOffset  = 0;
+    pCfg->uOffset  = RT_ALIGN_32(0, 4); /* reminder, in case someone changes offset */
     pCfg->uLength  = sizeof(VIRTIO_PCI_COMMON_CFG_T);
     cbRegion += pCfg->uLength;
     pVirtio->pCommonCfgCap = pCfg;
 
-    /* Notify capability (VirtIO 1.0 spec, section 4.1.4.4). Note: uLength is based on assumption
+    /** Notify capability (VirtIO 1.0 spec, section 4.1.4.4). Note: uLength is based on assumption
      * that each queue's uQueueNotifyOff is set equal to uQueueSelect's ordinal
      * value of the queue */
@@ -1234 +1056 @@
     pCfg->uBar     = uVirtioCapBar;
     pCfg->uOffset  = pVirtio->pCommonCfgCap->uOffset + pVirtio->pCommonCfgCap->uLength;
-    pCfg->uLength  = VIRTIO_MAX_QUEUES * uNotifyOffMultiplier + 2;  /* will change in VirtIO 1.1 */
+    pCfg->uOffset  = RT_ALIGN_32(pCfg->uOffset, 2);
+    pCfg->uLength  = VIRTQ_MAX_CNT * VIRTIO_NOTIFY_OFFSET_MULTIPLIER + 2;  /* will change in VirtIO 1.1 */
     cbRegion += pCfg->uLength;
     pVirtio->pNotifyCap = (PVIRTIO_PCI_NOTIFY_CAP_T)pCfg;
-    pVirtio->pNotifyCap->uNotifyOffMultiplier = uNotifyOffMultiplier;
-
-    /* ISR capability (VirtIO 1.0 spec, section 4.1.4.5) */
+    pVirtio->pNotifyCap->uNotifyOffMultiplier = VIRTIO_NOTIFY_OFFSET_MULTIPLIER;
+
+    /** ISR capability (VirtIO 1.0 spec, section 4.1.4.5) */
     pCfg = (PVIRTIO_PCI_CAP_T)&pVirtio->dev.abConfig[pCfg->uCapNext];
     pCfg->uCfgType = VIRTIO_PCI_CAP_ISR_CFG;
@@ -1247 +1070 @@
     pCfg->uBar     = uVirtioCapBar;
     pCfg->uOffset  = pVirtio->pNotifyCap->pciCap.uOffset + pVirtio->pNotifyCap->pciCap.uLength;
-    pCfg->uLength  = sizeof(uint32_t);
+    pCfg->uLength  = sizeof(VIRTIO_PCI_ISR_CAP_T);
     cbRegion += pCfg->uLength;
     pVirtio->pIsrCap = pCfg;
 
-    /* PCI Cfg capability (VirtIO 1.0 spec, section 4.1.4.7) */
+    /** PCI Cfg capability (VirtIO 1.0 spec, section 4.1.4.7)
+     *  This capability doesn't get page-MMIO mapped. Instead uBar, uOffset and uLength are intercepted
+     *  by trapping PCI configuration I/O and get modulated by consumers to locate fetch and read/write
+     *  values from any region. NOTE: The linux driver not only doesn't use this feature, and will not
+     *  even list it as present if uLength isn't non-zero and 4-byte-aligned as the linux driver is initializing */
+
     pCfg = (PVIRTIO_PCI_CAP_T)&pVirtio->dev.abConfig[pCfg->uCapNext];
     pCfg->uCfgType = VIRTIO_PCI_CAP_PCI_CFG;
@@ -1257 +1085 @@
     pCfg->uCapLen  = sizeof(VIRTIO_PCI_CFG_CAP_T);
     pCfg->uCapNext = (fMsiSupport || pVirtio->pDevSpecificCap) ? CFGADDR2IDX(pCfg) + pCfg->uCapLen : 0;
-    pCfg->uBar     = uVirtioCapBar;
-    pCfg->uOffset  = pVirtio->pIsrCap->uOffset + pVirtio->pIsrCap->uLength;
-    pCfg->uLength  = 4;  /* Initialize a non-zero 4-byte aligned so Linux virtio_pci module recognizes this cap */
+    pCfg->uBar     = 0;
+    pCfg->uOffset  = 0;
+    pCfg->uLength  = 0;
     cbRegion += pCfg->uLength;
     pVirtio->pPciCfgCap = (PVIRTIO_PCI_CFG_CAP_T)pCfg;
@@ -1265 +1093 @@
     if (pVirtio->pDevSpecificCap)
     {
-        /* Following capability (via VirtIO 1.0, section 4.1.4.6). Client defines the
-         * device specific configuration struct and passes its params to this constructor */
+        /** Following capability (via VirtIO 1.0, section 4.1.4.6). Client defines the
+         *  device-specific config fields struct and passes size to this constructor */
         pCfg = (PVIRTIO_PCI_CAP_T)&pVirtio->dev.abConfig[pCfg->uCapNext];
         pCfg->uCfgType = VIRTIO_PCI_CAP_DEVICE_CFG;
@@ -1274 +1102 @@
         pCfg->uBar     = uVirtioCapBar;
         pCfg->uOffset  = pVirtio->pIsrCap->uOffset + pVirtio->pIsrCap->uLength;
+        pCfg->uOffset  = RT_ALIGN_32(pCfg->uOffset, 4);
         pCfg->uLength  = cbDevSpecificCap;
         cbRegion += pCfg->uLength;
@@ -1279 +1108 @@
     }
 
-    /* Set offset to first capability and enable PCI dev capabilities */
+    /** Set offset to first capability and enable PCI dev capabilities */
     PCIDevSetCapabilityList    (&pVirtio->dev, 0x40);
     PCIDevSetStatus            (&pVirtio->dev, VBOX_PCI_STATUS_CAP_LIST);
@@ -1293 +1122 @@
         rc = PDMDevHlpPCIRegisterMsi(pDevIns, &aMsiReg); /* see MsixR3init() */
         if (RT_FAILURE (rc))
-            /* PK TODO: The following is moot, we need to flag no MSI-X support */
+            /** The following is moot, we need to flag no MSI-X support */
             PCIDevSetCapabilityList(&pVirtio->dev, 0x40);
     }
 
-    Log(("cbRegion = %d (0x%x)\n", cbRegion, cbRegion));
-    rc = PDMDevHlpPCIIORegionRegister(pDevIns, uVirtioCapBar, cbRegion,
+    /** Linux drivers/virtio/virtio_pci_modern.c tries to map at least a page for the
+     * 'unknown' device-specific capability without querying the capability to figure
+     *  out size, so pad with an extra page */
+
+    rc = PDMDevHlpPCIIORegionRegister(pDevIns, uVirtioCapBar,  RT_ALIGN_32(cbRegion + 4096, 4096),
                                       PCI_ADDRESS_SPACE_MEM, virtioR3Map);
     if (RT_FAILURE(rc))
@@ -1307 +1139 @@
             N_("virtio: cannot register PCI Capabilities address space"));
     }
-    *phVirtio = (PVIRTIOHANDLE)pVirtio;
+    *phVirtio = (VIRTIOHANDLE)pVirtio;
     return rc;
 }
+
+#ifdef VBOX_DEVICE_STRUCT_TESTCASE
+#  define virtioDumpState(x, s)  do {} while (0)
+#else
+#  ifdef DEBUG
+
+        static void virtioDumpState(PVIRTIOSTATE pVirtio, const char *pcszCaller)
+        {
+            Log2Func(("(called from %s)\n"
+                      "  uDeviceFeatures          = 0x%08x\n"
+                      "  uDriverFeatures          = 0x%08x\n"
+                      "  uDeviceFeaturesSelect    = 0x%04x\n"
+                      "  uGuestFeaturesSelect     = 0x%04x\n"
+                      "  uDeviceStatus            = 0x%02x\n"
+                      "  uConfigGeneration        = 0x%02x\n"
+                      "  uQueueSelect             = 0x%04x\n"
+                      "  uNumQueues               = 0x%04x\n"
+                      "  uISR                     = 0x%02x\n"
+                      "  fGenUpdatePending        = 0x%02x\n"
+                      "  uVirtioCapBar            = 0x%02x\n"
+                      "  uPciCfgDataOff           = 0x%02x\n"
+                      "  pGcPhysPciCapBase        = %RGp\n"
+                      "  pGcPhysCommonCfg         = %RGp\n"
+                      "  pGcPhysNotifyCap         = %RGp\n"
+                      "  pGcPhysIsrCap            = %RGp\n"
+                      "  pGcPhysDeviceCap         = %RGp\n"
+                      "  pDevSpecificCap          = %p\n"
+                      "  cbDevSpecificCap         = 0x%04x\n"
+                      "  pfnVirtioStatusChanged   = %p\n"
+                      "  pfnVirtioDevCapRead      = %p\n"
+                      "  pfnVirtioDevCapWrite     = %p\n"
+                      "  pfnPciConfigReadOld      = %p\n"
+                      "  pfnPciConfigWriteOld     = %p\n",
+                            pcszCaller,
+                            pVirtio->uDeviceFeatures,
+                            pVirtio->uDriverFeatures,
+                            pVirtio->uDeviceFeaturesSelect,
+                            pVirtio->uDriverFeaturesSelect,
+                            pVirtio->uDeviceStatus,
+                            pVirtio->uConfigGeneration,
+                            pVirtio->uQueueSelect,
+                            pVirtio->uNumQueues,
+                            pVirtio->uISR,
+                            pVirtio->fGenUpdatePending,
+                            pVirtio->uVirtioCapBar,
+                            pVirtio->uPciCfgDataOff,
+                            pVirtio->pGcPhysPciCapBase,
+                            pVirtio->pGcPhysCommonCfg,
+                            pVirtio->pGcPhysNotifyCap,
+                            pVirtio->pGcPhysIsrCap,
+                            pVirtio->pGcPhysDeviceCap,
+                            pVirtio->pDevSpecificCap,
+                            pVirtio->cbDevSpecificCap,
+                            pVirtio->virtioCallbacks.pfnVirtioStatusChanged,
+                            pVirtio->virtioCallbacks.pfnVirtioDevCapRead,
+                            pVirtio->virtioCallbacks.pfnVirtioDevCapWrite,
+                            pVirtio->pfnPciConfigReadOld,
+                            pVirtio->pfnPciConfigWriteOld
+            ));
+
+            for (uint16_t i = 0; i < pVirtio->uNumQueues; i++)
+            {
+                Log2Func(("%s queue:\n",
+                          "  queueContext[%u].uNextAvailIdx   = %u\n"
+                          "  queueContext[%u].uNextUsedIdx    = %u\n"
+                          "  uQueueSize[%u]                   = %u\n"
+                          "  uQueueNotifyOff[%u]              = %04x\n"
+                          "  uQueueMsixVector[%u]             = %04x\n"
+                          "  uQueueEnable[%u]                 = %04x\n"
+                          "  pGcPhysQueueDesc[%u]             = %RGp\n"
+                          "  pGcPhysQueueAvail[%u]            = %RGp\n"
+                          "  pGcPhysQueueUsed[%u]             = %RGp\n",
+                                i, pVirtio->queueContext[i].pcszName,
+                                i, pVirtio->queueContext[i].uNextAvailIdx,
+                                i, pVirtio->queueContext[i].uNextUsedIdx,
+                                i, pVirtio->uQueueSize[i],
+                                i, pVirtio->uQueueNotifyOff[i],
+                                i, pVirtio->uQueueMsixVector[i],
+                                i, pVirtio->uQueueEnable[i],
+                                i, pVirtio->pGcPhysQueueDesc[i],
+                                i, pVirtio->pGcPhysQueueAvail[i],
+                                i, pVirtio->pGcPhysQueueUsed[i]
+                ));
+            }
+        }
+#  endif
+#endif
+
+#ifdef IN_RING3
+
+ /** @callback_method_impl{FNSSMDEVSAVEEXEC}  */
+static DECLCALLBACK(int) virtioR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
+{
+    PVIRTIOSTATE pVirtio = *PDMINS_2_DATA(pDevIns, PVIRTIOSTATE *);
+
+    int rc = VINF_SUCCESS;
+    virtioDumpState(pVirtio, "virtioSaveExec");
+
+    rc = SSMR3PutBool(pSSM,   pVirtio->fGenUpdatePending);
+    rc = SSMR3PutU8(pSSM,     pVirtio->uDeviceStatus);
+    rc = SSMR3PutU8(pSSM,     pVirtio->uConfigGeneration);
+    rc = SSMR3PutU8(pSSM,     pVirtio->uPciCfgDataOff);
+    rc = SSMR3PutU8(pSSM,     pVirtio->uVirtioCapBar);
+    rc = SSMR3PutU8(pSSM,     pVirtio->uISR);
+    rc = SSMR3PutU16(pSSM,    pVirtio->uQueueSelect);
+    rc = SSMR3PutU32(pSSM,    pVirtio->uDeviceFeaturesSelect);
+    rc = SSMR3PutU32(pSSM,    pVirtio->uDriverFeaturesSelect);
+    rc = SSMR3PutU32(pSSM,    pVirtio->uNumQueues);
+    rc = SSMR3PutU32(pSSM,    pVirtio->cbDevSpecificCap);
+    rc = SSMR3PutU64(pSSM,    pVirtio->uDeviceFeatures);
+    rc = SSMR3PutU64(pSSM,    pVirtio->uDeviceFeatures);
+    rc = SSMR3PutU64(pSSM,    (uint64_t)pVirtio->pDevSpecificCap);
+    rc = SSMR3PutU64(pSSM,    (uint64_t)pVirtio->virtioCallbacks.pfnVirtioStatusChanged);
+    rc = SSMR3PutU64(pSSM,    (uint64_t)pVirtio->virtioCallbacks.pfnVirtioDevCapRead);
+    rc = SSMR3PutU64(pSSM,    (uint64_t)pVirtio->virtioCallbacks.pfnVirtioDevCapWrite);
+    rc = SSMR3PutU64(pSSM,    (uint64_t)pVirtio->pfnPciConfigReadOld);
+    rc = SSMR3PutU64(pSSM,    (uint64_t)pVirtio->pfnPciConfigWriteOld);
+    rc = SSMR3PutGCPhys(pSSM, pVirtio->pGcPhysCommonCfg);
+    rc = SSMR3PutGCPhys(pSSM, pVirtio->pGcPhysNotifyCap);
+    rc = SSMR3PutGCPhys(pSSM, pVirtio->pGcPhysIsrCap);
+    rc = SSMR3PutGCPhys(pSSM, pVirtio->pGcPhysDeviceCap);
+    rc = SSMR3PutGCPhys(pSSM, pVirtio->pGcPhysPciCapBase);
+
+    for (uint16_t i = 0; i < pVirtio->uNumQueues; i++)
+    {
+        rc = SSMR3PutGCPhys64(pSSM, pVirtio->pGcPhysQueueDesc[i]);
+        rc = SSMR3PutGCPhys64(pSSM, pVirtio->pGcPhysQueueAvail[i]);
+        rc = SSMR3PutGCPhys64(pSSM, pVirtio->pGcPhysQueueUsed[i]);
+        rc = SSMR3PutU16(pSSM,      pVirtio->uQueueNotifyOff[i]);
+        rc = SSMR3PutU16(pSSM,      pVirtio->uQueueMsixVector[i]);
+        rc = SSMR3PutU16(pSSM,      pVirtio->uQueueEnable[i]);
+        rc = SSMR3PutU16(pSSM,      pVirtio->uQueueSize[i]);
+        rc = SSMR3PutU16(pSSM,      pVirtio->queueContext[i].uNextAvailIdx);
+        rc = SSMR3PutU16(pSSM,      pVirtio->queueContext[i].uNextUsedIdx);
+        rc = SSMR3PutMem(pSSM,      pVirtio->queueContext[i].pcszName, 32);
+    }
+
+    rc = pVirtio->virtioCallbacks.pfnSSMDevSaveExec(pDevIns, pSSM);
+    return rc;
+}
+
+ /** @callback_method_impl{FNSSMDEVLOADEXEC}  */
+static DECLCALLBACK(int) virtioR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
+{
+    RT_NOREF(uVersion);
+
+    PVIRTIOSTATE pVirtio = *PDMINS_2_DATA(pDevIns, PVIRTIOSTATE *);
+
+    int rc = VINF_SUCCESS;
+    virtioDumpState(pVirtio, "virtioLoadExec");
+
+    if (uPass == SSM_PASS_FINAL)
+    {
+        rc = SSMR3GetBool(pSSM,  &pVirtio->fGenUpdatePending);
+        rc = SSMR3GetU8(pSSM,    &pVirtio->uDeviceStatus);
+        rc = SSMR3GetU8(pSSM,    &pVirtio->uConfigGeneration);
+        rc = SSMR3GetU8(pSSM,    &pVirtio->uPciCfgDataOff);
+        rc = SSMR3GetU8(pSSM,    &pVirtio->uVirtioCapBar);
+        rc = SSMR3GetU8(pSSM,    &pVirtio->uISR);
+        rc = SSMR3GetU16(pSSM,   &pVirtio->uQueueSelect);
+        rc = SSMR3GetU32(pSSM,   &pVirtio->uDeviceFeaturesSelect);
+        rc = SSMR3GetU32(pSSM,   &pVirtio->uDriverFeaturesSelect);
+        rc = SSMR3GetU32(pSSM,   &pVirtio->uNumQueues);
+        rc = SSMR3GetU32(pSSM,   &pVirtio->cbDevSpecificCap);
+        rc = SSMR3GetU64(pSSM,   &pVirtio->uDeviceFeatures);
+        rc = SSMR3GetU64(pSSM,   &pVirtio->uDeviceFeatures);
+        rc = SSMR3GetU64(pSSM,   (uint64_t *)&pVirtio->pDevSpecificCap);
+        rc = SSMR3GetU64(pSSM,   (uint64_t *)&pVirtio->virtioCallbacks.pfnVirtioStatusChanged);
+        rc = SSMR3GetU64(pSSM,   (uint64_t *)&pVirtio->virtioCallbacks.pfnVirtioDevCapRead);
+        rc = SSMR3GetU64(pSSM,   (uint64_t *)&pVirtio->virtioCallbacks.pfnVirtioDevCapWrite);
+        rc = SSMR3GetU64(pSSM,   (uint64_t *)&pVirtio->pfnPciConfigReadOld);
+        rc = SSMR3GetU64(pSSM,   (uint64_t *)&pVirtio->pfnPciConfigWriteOld);
+        rc = SSMR3GetGCPhys(pSSM, &pVirtio->pGcPhysCommonCfg);
+        rc = SSMR3GetGCPhys(pSSM, &pVirtio->pGcPhysNotifyCap);
+        rc = SSMR3GetGCPhys(pSSM, &pVirtio->pGcPhysIsrCap);
+        rc = SSMR3GetGCPhys(pSSM, &pVirtio->pGcPhysDeviceCap);
+        rc = SSMR3GetGCPhys(pSSM, &pVirtio->pGcPhysPciCapBase);
+
+        for (uint16_t i = 0; i < pVirtio->uNumQueues; i++)
+        {
+            rc = SSMR3GetGCPhys64(pSSM, &pVirtio->pGcPhysQueueDesc[i]);
+            rc = SSMR3GetGCPhys64(pSSM, &pVirtio->pGcPhysQueueAvail[i]);
+            rc = SSMR3GetGCPhys64(pSSM, &pVirtio->pGcPhysQueueUsed[i]);
+            rc = SSMR3GetU16(pSSM,      &pVirtio->uQueueNotifyOff[i]);
+            rc = SSMR3GetU16(pSSM,      &pVirtio->uQueueMsixVector[i]);
+            rc = SSMR3GetU16(pSSM,      &pVirtio->uQueueEnable[i]);
+            rc = SSMR3GetU16(pSSM,      &pVirtio->uQueueSize[i]);
+            rc = SSMR3GetU16(pSSM,      &pVirtio->queueContext[i].uNextAvailIdx);
+            rc = SSMR3GetU16(pSSM,      &pVirtio->queueContext[i].uNextUsedIdx);
+            rc = SSMR3GetMem(pSSM,      pVirtio->queueContext[i].pcszName, 32);
+        }
+    }
+
+    rc = pVirtio->virtioCallbacks.pfnSSMDevLoadExec(pDevIns, pSSM, uVersion, uPass);
+
+    return rc;
+}
+
+/** @callback_method_impl{FNSSMDEVLOADDONE}  */
+static DECLCALLBACK(int) virtioR3LoadDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
+{
+    PVIRTIOSTATE pVirtio = *PDMINS_2_DATA(pDevIns, PVIRTIOSTATE *);
+
+    int rc = VINF_SUCCESS;
+    virtioDumpState(pVirtio, "virtioLoadDone");
+
+    rc = pVirtio->virtioCallbacks.pfnSSMDevLoadDone(pDevIns, pSSM);
+
+    return rc;
+}
+
+/** @callback_method_impl{FNSSMDEVLIVEEXEC}  */
+static DECLCALLBACK(int) virtioR3LiveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass)
+{
+    PVIRTIOSTATE pVirtio = *PDMINS_2_DATA(pDevIns, PVIRTIOSTATE *);
+
+    int rc = VINF_SUCCESS;
+    virtioDumpState(pVirtio, "virtioLiveExec");
+
+    rc = pVirtio->virtioCallbacks.pfnSSMDevLiveExec(pDevIns, pSSM, uPass);
+
+    return rc;
+
+}
+
+
 #endif /* IN_RING3 */
 

trunk/src/VBox/Devices/VirtIO/Virtio_1_0.h

@@ -24 +24 @@
 #include <iprt/ctype.h>
 
-#define VIRTQ_MAX_SIZE                      1024
-#define VIRTIO_MAX_QUEUES                   256     /** Max queues we allow guest to create      */
+typedef void * VIRTIOHANDLE;                                     /**< Opaque handle to the VirtIO framework */
+
+#define DISABLE_GUEST_DRIVER 0
+
+/**
+ * Important sizing and bounds params for this impl. of VirtIO 1.0 PCI device
+ */
+ /**** Temporary values for debugging */
+#define VIRTQ_MAX_SIZE                      16                  /**< Max size (# desc elements) of a virtq    */
+#define VIRTQ_MAX_CNT                       24                  /**< Max queues we allow guest to create      */
+#define VIRTIO_NOTIFY_OFFSET_MULTIPLIER     2                    /**< VirtIO Notify Cap. MMIO config param     */
 #define VIRTQ_DESC_MAX_SIZE                 (2 * 1024 * 1024)
 
-typedef void * VIRTIOHANDLE;                        /** opaque handle to the VirtIO framework */
-typedef VIRTIOHANDLE *PVIRTIOHANDLE;
-
-/** Reserved Feature Bits */
-#define VIRTIO_F_RING_INDIRECT_DESC         RT_BIT_64(28)
-#define VIRTIO_F_RING_IDX                   RT_BIT_64(29)
-#define VIRTIO_F_VERSION_1                  RT_BIT_64(32)
-
-#define VIRTIO_MSI_NO_VECTOR                0xffff  /* Vector value used to disable MSI for queue */
-
-/** Device Status field constants (from Virtio 1.0 spec) */
-#define VIRTIO_STATUS_ACKNOWLEDGE           0x01    /** Guest found this emulated PCI device     */
-#define VIRTIO_STATUS_DRIVER                0x02    /** Guest can drive this PCI device          */
-#define VIRTIO_STATUS_DRIVER_OK             0x04    /** Guest VirtIO driver setup and ready      */
-#define VIRTIO_STATUS_FEATURES_OK           0x08    /** Guest says feature negotiation complete  */
-#define VIRTIO_STATUS_FAILED                0x80    /** Fatal: Something wrong, guest gave up    */
-#define VIRTIO_STATUS_DEVICE_NEEDS_RESET    0x40    /** Device experienced unrecoverable error   */
-
-/** virtq related flags */
-#define VIRTQ_DESC_F_NEXT                   1       /** Indicates this descriptor chains to next */
-#define VIRTQ_DESC_F_WRITE                  2       /** Marks buffer as write-only (default ro)  */
-#define VIRTQ_DESC_F_INDIRECT               4       /** Buffer is list of buffer descriptors     */
-#define VIRTIO_F_INDIRECT_DESC              28      /** Using indirect descriptors               */
-#define VIRTIO_F_EVENT_IDX                  29      /** avail_event, used_event in play          */
-
-#define VIRTQ_USED_F_NO_NOTIFY              1       /** Optimization: Device advises driver (unreliably):
-                                                        Don't kick me when adding buffer */
-
-#define VIRTQ_AVAIL_F_NO_INTERRUPT          1       /** Optimization: Driver advises device (unreliably):
-                                                        Don't interrupt when buffer consumed */
-/**
- * virtq related structs
- *  (struct names follow VirtIO 1.0 spec, typedef use VBox style)
- */
-typedef struct virtq_desc
-{
-    uint64_t  pGcPhysBuf;                   /** addr        GC physical address of buffer   */
-    uint32_t  cbBuf;                        /** len         Buffer length                   */
-    uint16_t  fFlags;                       /** flags       Buffer specific flags           */
-    uint16_t  uNext;                        /** next        Chain idx if VIRTIO_DESC_F_NEXT */
-} VIRTQ_DESC_T, *PVIRTQ_DESC_T;
-
-typedef struct virtq_avail  /* VirtIO 1.0 specification formal name of this struct    */
-{
-    uint16_t  fFlags;                       /** flags       avail ring guest-to-host flags */
-    uint16_t  uIdx;                         /** idx         Index of next free ring slot    */
-    uint16_t  auRing[1];                    /** ring        Ring: avail guest-to-host bufs  */
-    uint16_t  uUsedEventIdx;                /** used_event  (if VIRTQ_USED_F_NO_NOTIFY)     */
-} VIRTQ_AVAIL_T, *PVIRTQ_AVAIL_T;
-
-typedef struct virtq_used_elem /* VirtIO 1.0 specification formal name of this struct */
-{
-    uint32_t  uIdx;                         /** idx         Start of used descriptor chain  */
-    uint32_t  cbElem;                       /** len         Total len of used desc chain    */
-} VIRTQ_USED_ELEM_T;
-
-typedef struct virt_used  /* VirtIO 1.0 specification formal name of this struct */
-{
-    uint16_t  fFlags;                       /** flags       used ring host-to-guest flags  */
-    uint16_t  uIdx;                         /** idx         Index of next ring slot        */
-    VIRTQ_USED_ELEM_T aRing[1];             /** ring        Ring: used host-to-guest bufs  */
-    uint16_t  uAvailEventIdx;               /** avail_event if (VIRTQ_USED_F_NO_NOTIFY)    */
-} VIRTQ_USED_T, *PVIRTQ_USED_T;
-
-
-typedef struct virtq
-{
-    uint16_t cbQueue;                       /** virtq size                                 */
-    uint16_t padding[3];                    /** 64-bit-align phys ptrs to start of struct  */
-    RTGCPHYS pGcPhysVirtqDescriptors;       /** (struct virtq_desc  *)                     */
-    RTGCPHYS pGcPhysVirtqAvail;             /** (struct virtq_avail *)                     */
-    RTGCPHYS pGcPhysVirtqUsed;              /** (struct virtq_used  *)                     */
-} VIRTQ, *PVIRTQ;
-
-typedef struct VQueue
-{
-    VIRTQ VirtQ;
-    uint16_t  uNextAvailIndex;
-    uint16_t  uNextUsedIndex;
-    uint32_t  uPageNumber;
-    R3PTRTYPE(const char *) pcszName;
-} VQUEUE;
-
-
-typedef VQUEUE *PVQUEUE;
-
-typedef struct VQueueElemSeg
-{
-    RTGCPHYS addr;
-    void    *pv;
-    uint32_t cb;
-} VQUEUESEG;
-
-typedef struct VQueueElem
-{
-    uint32_t  idx;
-    uint32_t  cSegsIn;
-    uint32_t  cSegsOut;
-    VQUEUESEG aSegsIn[VIRTQ_MAX_SIZE];
-    VQUEUESEG aSegsOut[VIRTQ_MAX_SIZE];
-} VQUEUEELEM;
-typedef VQUEUEELEM *PVQUEUEELEM;
+typedef struct VIRTQ_SEG                                         /**< Describes one segment of a buffer vector */
+{
+    RTGCPHYS addr;                                               /**< Physical addr. of this segment's buffer  */
+    void    *pv;                                                 /**< Buf to hold value to write or read       */
+    uint32_t cb;                                                 /**< Number of bytes to write or read         */
+} VIRTQ_SEG_T;
+
+typedef struct VIRTQ_BUF_VECTOR                                  /**< Scatter/gather buffer vector             */
+{
+    uint32_t    uDescIdx;                                        /**< Desc at head of this vector list         */
+    uint32_t    cSegsIn;                                         /**< Count of segments in aSegsIn[]           */
+    uint32_t    cSegsOut;                                        /**< Count of segments in aSegsOut[]          */
+    VIRTQ_SEG_T aSegsIn[VIRTQ_MAX_SIZE];                         /**< List of segments to write to guest       */
+    VIRTQ_SEG_T aSegsOut[VIRTQ_MAX_SIZE];                        /**< List of segments read from guest         */
+} VIRTQ_BUF_VECTOR_T, *PVIRTQ_BUF_VECTOR_T;
 
 /**
  * The following structure is used to pass the PCI parameters from the consumer
- * to this generic VirtIO framework
+ * to this generic VirtIO framework. This framework provides the Vendor ID as Virtio.
  */
 typedef struct VIRTIOPCIPARAMS
 {
-    uint16_t  uDeviceId;
-    uint16_t  uClassBase;
-    uint16_t  uClassSub;
-    uint16_t  uClassProg;
-    uint16_t  uSubsystemId;
-    uint16_t  uSubsystemVendorId;
-    uint16_t  uRevisionId;
-    uint16_t  uInterruptLine;
-    uint16_t  uInterruptPin;
+    uint16_t  uDeviceId;                                         /**< PCI Cfg Device ID                        */
+    uint16_t  uClassBase;                                        /**< PCI Cfg Base Class                       */
+    uint16_t  uClassSub;                                         /**< PCI Cfg Subclass                         */
+    uint16_t  uClassProg;                                        /**< PCI Cfg Programming Interface Class      */
+    uint16_t  uSubsystemId;                                      /**< PCI Cfg Card Manufacturer Vendor ID      */
+    uint16_t  uSubsystemVendorId;                                /**< PCI Cfg Chipset Manufacturer Vendor ID   */
+    uint16_t  uRevisionId;                                       /**< PCI Cfg Revision ID                      */
+    uint16_t  uInterruptLine;                                    /**< PCI Cfg Interrupt line                   */
+    uint16_t  uInterruptPin;                                     /**< PCI Cfg InterruptPin                     */
 } VIRTIOPCIPARAMS, *PVIRTIOPCIPARAMS;
 
+/**
+ * Implementation-specific client callback to notify client of significant device status
+ * changes.
+ *
+ * @param hVirtio       Handle to VirtIO framework
+ * @param fDriverOk     True if guest driver is okay (thus queues, etc... are valid)
+ */
+typedef DECLCALLBACK(void)   FNVIRTIOSTATUSCHANGED(VIRTIOHANDLE hVirtio, bool fDriverOk);
+typedef FNVIRTIOSTATUSCHANGED *PFNVIRTIOSTATUSCHANGED;
+
+/**
+ * When guest-to-host queue notifications are enabled, the guest driver notifies the host
+ * that the avail queue has buffers, and this callback informs the client.
+ *
+ * @param   hVirtio     Handle to the VirtIO framework
+ * @param   qIdx        Index of the notified queue
+ */
+typedef DECLCALLBACK(void)   FNVIRTIOQUEUENOTIFIED(VIRTIOHANDLE hVirtio, uint16_t qIdx);
+typedef FNVIRTIOQUEUENOTIFIED *PFNVIRTIOQUEUENOTIFIED;
+
  /**
- * VirtIO Device-specific capabilities read callback
+ * Implementation-specific client callback to access VirtIO Device-specific capabilities
  * (other VirtIO capabilities and features are handled in VirtIO implementation)
  *
@@ -161 +103 @@
 
 /**
- * VirtIO Device-specific capabilities read callback
+ * Implementation-specific client ballback to access VirtIO Device-specific capabilities
  * (other VirtIO capabilities and features are handled in VirtIO implementation)
  *
@@ -172 +114 @@
 typedef FNVIRTIODEVCAPREAD *PFNVIRTIODEVCAPREAD;
 
+
 /** @name VirtIO port I/O callbacks.
  * @{ */
 typedef struct VIRTIOCALLBACKS
 {
-     DECLCALLBACKMEMBER(int,      pfnVirtioDevCapRead)
-                                      (PPDMDEVINS pDevIns, uint32_t uOffset, const void *pvBuf, size_t cbRead);
-     DECLCALLBACKMEMBER(int,      pfnVirtioDevCapWrite)
-                                      (PPDMDEVINS pDevIns, uint32_t uOffset, const void *pvBuf, size_t cbWrite);
+     DECLCALLBACKMEMBER(void, pfnVirtioStatusChanged)
+                                  (VIRTIOHANDLE hVirtio, bool fDriverOk);
+     DECLCALLBACKMEMBER(void, pfnVirtioQueueNotified)
+                                  (VIRTIOHANDLE hVirtio, uint16_t qIdx);
+     DECLCALLBACKMEMBER(int,  pfnVirtioDevCapRead)
+                                  (PPDMDEVINS pDevIns, uint32_t uOffset, const void *pvBuf, size_t cbRead);
+     DECLCALLBACKMEMBER(int,  pfnVirtioDevCapWrite)
+                                  (PPDMDEVINS pDevIns, uint32_t uOffset, const void *pvBuf, size_t cbWrite);
+     DECLCALLBACKMEMBER(int,  pfnSSMDevLiveExec)
+                                  (PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass);
+     DECLCALLBACKMEMBER(int,  pfnSSMDevSaveExec)
+                                  (PPDMDEVINS pDevIns, PSSMHANDLE pSSM);
+     DECLCALLBACKMEMBER(int,  pfnSSMDevLoadExec)
+                                  (PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass);
+     DECLCALLBACKMEMBER(int,  pfnSSMDevLoadDone)
+                                  (PPDMDEVINS pDevIns, PSSMHANDLE pSSM);
+
 } VIRTIOCALLBACKS, *PVIRTIOCALLBACKS;
 /** @} */
 
-PVQUEUE virtioAddQueue(         VIRTIOHANDLE hVirtio, uint32_t uSize, const char *pcszName);
-int     virtioDestruct(         VIRTIOHANDLE hVirtio);
-int     virtioReset(            VIRTIOHANDLE hVirtio);
-void    virtioSetReadLed(       VIRTIOHANDLE hVirtio, bool fOn);
-void    virtioSetWriteLed(      VIRTIOHANDLE hVirtio, bool fOn);
-int     virtioRaiseInterrupt(   VIRTIOHANDLE hVirtio, int rcBusy, uint8_t uint8_tIntCause);
-//void    virtioNotifyDriver(     VIRTIOHANDLE hVirtio);
-void    virtioSetHostFeatures(  VIRTIOHANDLE hVirtio, uint64_t uDeviceFeatures);
-
-bool    virtQueueSkip(          VIRTIOHANDLE hVirtio, PVQUEUE pQueue);
-bool    virtQueueGet(           VIRTIOHANDLE hVirtio, PVQUEUE pQueue, PVQUEUEELEM pElem, bool fRemove = true);
-void    virtQueuePut(           VIRTIOHANDLE hVirtio, PVQUEUE pQueue, PVQUEUEELEM pElem, uint32_t len, uint32_t uReserved = 0);
-void    virtQueueNotify(        VIRTIOHANDLE hVirtio, PVQUEUE pQueue);
-void    virtQueueSync(          VIRTIOHANDLE hVirtio, PVQUEUE pQueue);
-void    vringSetNotification(   VIRTIOHANDLE hVirtio, PVIRTQ pVirtQ, bool fEnabled);
-
-/**
- * Formats the logging of a memory-mapped I/O input or output value
+int           virtioReset        (VIRTIOHANDLE hVirtio);
+bool          virtioQueueInit    (VIRTIOHANDLE hVirtio, uint16_t qIdx, const char *pcszName);
+const char *  virtioQueueGetName (VIRTIOHANDLE hVirtio, uint16_t qIdx);
+bool          virtioQueueGet     (VIRTIOHANDLE hVirtio, uint16_t qIdx, PVIRTQ_BUF_VECTOR_T pBufVec, bool fRemove);
+void          virtioQueuePut     (VIRTIOHANDLE hVirtio, uint16_t qIdx, PVIRTQ_BUF_VECTOR_T pBufVec, uint32_t cb);
+bool          virtioQueuePeek    (VIRTIOHANDLE hVirtio, uint16_t qIdx, PVIRTQ_BUF_VECTOR_T pBufVec);
+void          virtioQueueSync    (VIRTIOHANDLE hVirtio, uint16_t qIdx);
+bool          virtioQueueIsEmpty (VIRTIOHANDLE hVirtio, uint16_t qIdx);
+int           virtioGetNumQueues (VIRTIOHANDLE hVirtio);
+
+/** CLIENT MUST CALL ON RELOCATE CALLBACK! */
+void    virtioRelocate(         PPDMDEVINS pDevIns, RTGCINTPTR offDelta);
+
+/**
+ * Log memory-mapped I/O input or output value
  *
  * @param   pszFunc     - To avoid displaying this function's name via __FUNCTION__ or LogFunc()
@@ -211 +164 @@
  * @param   idx         - The index if fHasIndex
  */
-void virtioLogMappedIoValue(const char *pszFunc, const char *pszMember,
+void virtioLogMappedIoValue(const char *pszFunc, const char *pszMember, size_t uMemberSize,
                             const void *pv, uint32_t cb, uint32_t uOffset,
                             bool fWrite, bool fHasIndex, uint32_t idx);
 
-int     virtioConstruct(
-            PPDMDEVINS           pDevIns,
-            PVIRTIOHANDLE        phVirtio,
-            int                  iInstance,
-            PVIRTIOPCIPARAMS     pPciParams,
-            const char           *pcszNameFmt,
-            uint32_t             nQueues,
-            uint32_t             uVirtioCapBar,
-            uint64_t             uDeviceFeatures,
-            PFNVIRTIODEVCAPREAD  devCapReadCallback,
-            PFNVIRTIODEVCAPWRITE devCapWriteCallback,
-            uint16_t             cbDevSpecificCap,
-            void                 *pDevSpecificCap,
-            uint32_t             uNotifyOffMultiplier);
-
-//PCIDevGetCapabilityList
-//PCIDevSetCapabilityList
-//DECLINLINE(void) PDMPciDevSetCapabilityList(PPDMPCIDEV pPciDev, uint8_t u8Offset)
-//    PDMPciDevSetByte(pPciDev, VBOX_PCI_CAPABILITY_LIST, u8Offset);
-//DECLINLINE(uint8_t) PDMPciDevGetCapabilityList(PPDMPCIDEV pPciDev)
-//    return PDMPciDevGetByte(pPciDev, VBOX_PCI_CAPABILITY_LIST);
+/**
+ * Setup PCI device controller and Virtio state
+ *
+ * @param   pDevIns                  Device instance data
+ * @param   pVirtio                  Device State
+ * @param   pPciParams               Values to populate industry standard PCI Configuration Space data structure
+ * @param   pcszInstance             Device instance name
+ * @param   uNumQueues               Number of Virtio Queues created by consumer (driver)
+ * @param   uVirtioCapBar            Region number to map for PCi Capabilities structs
+ * @param   uDevSpecificFeatures     VirtIO device-specific features offered by client
+ * @param   devCapReadCallback       Client handler to call upon guest read to device specific capabilities.
+ * @param   devCapWriteCallback      Client handler to call upon guest write to device specific capabilities.
+ * @param   devStatusChangedCallback Client handler to call for major device status changes
+ * @param   queueNotifiedCallback    Client handler for guest-to-host notifications that avail queue has ring data
+ * @param   ssmLiveExecCallback      Client handler for SSM live exec
+ * @param   ssmSaveExecCallback      Client handler for SSM save exec
+ * @param   ssmLoadExecCallback      Client handler for SSM load exec
+ * @param   ssmLoadDoneCallback      Client handler for SSM load done
+ * @param   cbDevSpecificCap         Size of virtio_pci_device_cap device-specific struct
+ */
+int  virtioConstruct(PPDMDEVINS             pDevIns,
+                     VIRTIOHANDLE          *phVirtio,
+                     PVIRTIOPCIPARAMS       pPciParams,
+                     const char            *pcszInstance,
+                     uint32_t               nQueues,
+                     uint32_t               uVirtioCapBar,
+                     uint64_t               uDevSpecificFeatures,
+                     PFNVIRTIODEVCAPREAD    devCapReadCallback,
+                     PFNVIRTIODEVCAPWRITE   devCapWriteCallback,
+                     PFNVIRTIOSTATUSCHANGED devStatusChangedCallback,
+                     PFNVIRTIOQUEUENOTIFIED queueNotifiedCallback,
+                     PFNSSMDEVLIVEEXEC      ssmLiveExecCallback,
+                     PFNSSMDEVSAVEEXEC      ssmSaveExecCallback,
+                     PFNSSMDEVLOADEXEC      ssmLoadExecCallback,
+                     PFNSSMDEVLOADDONE      ssmLoadDoneCallback,
+                     uint16_t               cbDevSpecificCap,
+                     void                  *pDevSpecificCap);
 
 #endif /* !VBOX_INCLUDED_SRC_VirtIO_Virtio_1_0_h */

trunk/src/VBox/Devices/VirtIO/Virtio_1_0_impl.h

@@ -24 +24 @@
 #include "Virtio_1_0.h"
 
-
-
 /** @name Saved state versions.
  * The saved state version is changed if either common or any of specific
@@ -32 +30 @@
  * for example.
  */
-#define VIRTIO_SAVEDSTATE_VERSION_3_1_BETA1 1
-#define VIRTIO_SAVEDSTATE_VERSION           2
+#define VIRTIO_SAVEDSTATE_VERSION                       1
 /** @} */
 
-#define DEVICE_PCI_VENDOR_ID_VIRTIO         0x1AF4  /** Mandatory, so VirtIO driver can find this device */
-#define DEVICE_PCI_REVISION_ID_VIRTIO       1       /** Virtio spec suggests >= 1 for non-transitional drivers */
-
+#define VIRTIO_ISR_VIRTQ_INTERRUPT           RT_BIT_32(0)
+#define VIRTIO_ISR_DEVICE_CONFIG             RT_BIT_32(1)
+#define DEVICE_PCI_VENDOR_ID_VIRTIO                0x1AF4        /**< Required: VirtIO driver uses to find dev  */
+#define DEVICE_PCI_REVISION_ID_VIRTIO                   1        /**< VirtIO 1.0 non-transitional drivers >= 1  */
+
+/** Reserved (*negotiated*) Feature Bits (e.g. device independent features, VirtIO 1.0 spec,section 6) */
+
+#define VIRTIO_F_RING_INDIRECT_DESC         RT_BIT_64(28)        /**< Allow descs to point to list of descs     */
+#define VIRTIO_F_INDIRECT_DESC              RT_BIT_64(28)        /**< Doc bug: Bit has 2 names in VirtIO 1.0-04 */
+#define VIRTIO_F_RING_EVENT_IDX             RT_BIT_64(29)        /**< Allow notification disable for n elems    */
+#define VIRTIO_F_EVENT_IDX                  RT_BIT_64(29)        /**< Doc bug: Bit has 2 names in VirtIO 1.0-04 */
+#define VIRTIO_F_VERSION_1                  RT_BIT_64(32)
+
+#define VIRTIO_MSI_NO_VECTOR                       0xffff        /**< Vector value to disable MSI for queue     */
+
+/** Device Status field constants (from Virtio 1.0 spec) */
+#define VIRTIO_STATUS_ACKNOWLEDGE                   0x01         /**< Guest driver: Located this VirtIO device  */
+#define VIRTIO_STATUS_DRIVER                        0x02         /**< Guest driver: Can drive this VirtIO dev.  */
+#define VIRTIO_STATUS_DRIVER_OK                     0x04         /**< Guest driver: Driver set-up and ready     */
+#define VIRTIO_STATUS_FEATURES_OK                   0x08         /**< Guest driver: Feature negotiation done    */
+#define VIRTIO_STATUS_FAILED                        0x80         /**< Guest driver: Fatal error, gave up        */
+#define VIRTIO_STATUS_DEVICE_NEEDS_RESET            0x40         /**< Device experienced unrecoverable error    */
+
+/* @def Virtio Device PCI Capabilities type codes */
+#define VIRTIO_PCI_CAP_COMMON_CFG                     1          /**< Common configuration PCI capability ID    */
+#define VIRTIO_PCI_CAP_NOTIFY_CFG                     2          /**< Notification area PCI capability ID       */
+#define VIRTIO_PCI_CAP_ISR_CFG                        3          /**< ISR PCI capability id                     */
+#define VIRTIO_PCI_CAP_DEVICE_CFG                     4          /**< Device-specific PCI cfg capability ID     */
+#define VIRTIO_PCI_CAP_PCI_CFG                        5          /**< PCI CFG capability ID                     */
+
+#define VIRTIO_PCI_CAP_ID_VENDOR                   0x09          /**< Vendor-specific PCI CFG Device Cap. ID    */
 
 /**
  * The following is the PCI capability struct common to all VirtIO capability types
  */
-#define VIRTIO_PCI_CAP_ID_VENDOR       0x09 /** Vendor-specific PCI CFG Device Capability ID */
-
 typedef struct virtio_pci_cap
 {
     /* All little-endian */
-    uint8_t   uCapVndr;                     /** Generic PCI field: PCI_CAP_ID_VNDR          */
-    uint8_t   uCapNext;                     /** Generic PCI field: next ptr.                */
-    uint8_t   uCapLen;                      /** Generic PCI field: capability length        */
-    uint8_t   uCfgType;                     /** Identifies the structure.                   */
-    uint8_t   uBar;                         /** Where to find it.                           */
-    uint8_t   uPadding[3];                  /** Pad to full dword.                          */
-    uint32_t  uOffset;                      /** Offset within bar.  (L.E.)                  */
-    uint32_t  uLength;                      /** Length of struct, in bytes. (L.E.)          */
+    uint8_t   uCapVndr;                                          /**< Generic PCI field: PCI_CAP_ID_VNDR        */
+    uint8_t   uCapNext;                                          /**< Generic PCI field: next ptr.              */
+    uint8_t   uCapLen;                                           /**< Generic PCI field: capability length      */
+    uint8_t   uCfgType;                                          /**< Identifies the structure.                 */
+    uint8_t   uBar;                                              /**< Where to find it.                         */
+    uint8_t   uPadding[3];                                       /**< Pad to full dword.                        */
+    uint32_t  uOffset;                                           /**< Offset within bar.  (L.E.)                */
+    uint32_t  uLength;                                           /**< Length of struct, in bytes. (L.E.)        */
 }  VIRTIO_PCI_CAP_T, *PVIRTIO_PCI_CAP_T;
 
 /**
- * The following structs correspond to the VirtIO capability types and describe
- * fields accessed by MMIO via the relevant BAR. virtio_pci_dev_cap is not listed
- * here because it is device specific, thus the device specific implementation
- * consumer of this framework passes a ref/size in the constructor
+ * Local implementation's per-queue usage (e.g. not part of VirtIO specification)
+ */
+typedef struct VIRTQ_CONTEXT
+{
+    const char *pcszName[32];                                   /**< Dev-specific name of queue                */
+    uint16_t    uNextAvailIdx;                                  /**< Consumer's position in avail ring         */
+    uint16_t    uNextUsedIdx;                                   /**< Consumer's position in used ring          */
+} VIRTQ_CONTEXT_T, *PVIRTQ_CONTEXT_T;
+
+/**
+ * VirtIO 1.0 Capabilities' related MMIO-mapped structs:
  *
- */
-
-/* Virtio Device PCI Capabilities type codes */
-#define VIRTIO_PCI_CAP_COMMON_CFG      1    /** Common configuration PCI capability ID */
-#define VIRTIO_PCI_CAP_NOTIFY_CFG      2    /** Notification area PCI capability ID */
-#define VIRTIO_PCI_CAP_ISR_CFG         3    /** ISR PCI capability id */
-#define VIRTIO_PCI_CAP_DEVICE_CFG      4    /** Device specific configuration PCI capability ID */
-#define VIRTIO_PCI_CAP_PCI_CFG         5    /** PCI CFG capability ID */
-
-typedef struct virtio_pci_common_cfg /* VirtIO 1.0 specification name of this struct  */
+ * Note: virtio_pci_device_cap is dev-specific, implemented by client. Definition unknown here.
+ */
+typedef struct virtio_pci_common_cfg
 {
     /* Per device fields */
-    uint32_t  uDeviceFeaturesSelect;        /** RW (driver selects device features)         */
-    uint32_t  uDeviceFeatures;              /** RO (device reports features to driver)      */
-    uint32_t  uDriverFeaturesSelect;        /** RW (driver selects driver features)         */
-    uint32_t  uDriverFeatures;              /** RW (driver accepts device features)         */
-    uint16_t  uMsixConfig;                  /** RW (driver sets MSI-X config vector)        */
-    uint16_t  uNumQueues;                   /** RO (device specifies max queues)            */
-    uint8_t   uDeviceStatus;                /** RW (driver writes device status, 0 resets)  */
-    uint8_t   uConfigGeneration;            /** RO (device changes when changing configs)   */
+    uint32_t  uDeviceFeaturesSelect;                             /**< RW (driver selects device features)       */
+    uint32_t  uDeviceFeatures;                                   /**< RO (device reports features to driver)    */
+    uint32_t  uDriverFeaturesSelect;                             /**< RW (driver selects driver features)       */
+    uint32_t  uDriverFeatures;                                   /**< RW (driver accepts device features)       */
+    uint16_t  uMsixConfig;                                       /**< RW (driver sets MSI-X config vector)      */
+    uint16_t  uNumQueues;                                        /**< RO (device specifies max queues)          */
+    uint8_t   uDeviceStatus;                                     /**< RW (driver writes device status, 0 resets)*/
+    uint8_t   uConfigGeneration;                                 /**< RO (device changes when changing configs) */
 
     /* Per virtqueue fields (as determined by uQueueSelect) */
-    uint16_t  uQueueSelect;                 /** RW (selects queue focus for these fields)   */
-    uint16_t  uQueueSize;                   /** RW (queue size, 0 - 2^n)                    */
-    uint16_t  uQueueMsixVector;             /** RW (driver selects MSI-X queue vector)      */
-    uint16_t  uQueueEnable;                 /** RW (driver controls usability of queue)     */
-    uint16_t  uQueueNotifyOff;              /** RO (offset uto virtqueue; see spec)         */
-    uint64_t  uQueueDesc;                   /** RW (driver writes desc table phys addr)     */
-    uint64_t  uQueueAvail;                  /** RW (driver writes avail ring phys addr)     */
-    uint64_t  uQueueUsed;                   /** RW (driver writes used ring  phys addr)     */
+    uint16_t  uQueueSelect;                                      /**< RW (selects queue focus for these fields) */
+    uint16_t  uQueueSize;                                        /**< RW (queue size, 0 - 2^n)                  */
+    uint16_t  uQueueMsixVector;                                  /**< RW (driver selects MSI-X queue vector)    */
+    uint16_t  uQueueEnable;                                      /**< RW (driver controls usability of queue)   */
+    uint16_t  uQueueNotifyOff;                                   /**< RO (offset uto virtqueue; see spec)       */
+    uint64_t  pGcPhysQueueDesc;                                  /**< RW (driver writes desc table phys addr)   */
+    uint64_t  pGcPhysQueueAvail;                                 /**< RW (driver writes avail ring phys addr)   */
+    uint64_t  pGcPhysQueueUsed;                                  /**< RW (driver writes used ring  phys addr)   */
 } VIRTIO_PCI_COMMON_CFG_T, *PVIRTIO_PCI_COMMON_CFG_T;
 
 typedef struct virtio_pci_notify_cap
 {
-    struct virtio_pci_cap pciCap;
-    uint32_t uNotifyOffMultiplier;          /* notify_off_multiplier                       */
-} VIRTIO_PCI_NOTIFY_CAP_T, *PVIRTIO_PCI_NOTIFY_CAP_T;
+    struct virtio_pci_cap pciCap;                                /**< Notification MMIO mapping capability      */
+    uint32_t uNotifyOffMultiplier;                               /**< notify_off_multiplier                     */
+}  VIRTIO_PCI_NOTIFY_CAP_T,   *PVIRTIO_PCI_NOTIFY_CAP_T;
 
 typedef struct virtio_pci_cfg_cap
 {
-    struct virtio_pci_cap pciCap;
-    uint8_t uPciCfgData[4]; /* Data for BAR access. */
-} VIRTIO_PCI_CFG_CAP_T, *PVIRTIO_PCI_CFG_CAP_T;
+    struct virtio_pci_cap pciCap;                                /**< Cap. defines the BAR/off/len to access    */
+    uint8_t uPciCfgData[4];                                      /**< I/O buf for above cap.                    */
+} VIRTIO_PCI_CFG_CAP_T,   *PVIRTIO_PCI_CFG_CAP_T;
+
+/** For ISR, spec says min. 1 byte. Diagram shows 32-bits, mostly reserved */
+typedef uint32_t VIRTIO_PCI_ISR_CAP_T, *PVIRTIO_PCI_ISR_CAP_T;
 
 /**
@@ -115 +141 @@
 typedef struct VIRTIOSTATE
 {
-    PDMPCIDEV                    dev;
-    PDMCRITSECT                  cs;                                    /**< Critical section - what is it protecting? */
-    /* Read-only part, never changes after initialization. */
-    char                         szInstance[8];                         /**< Instance name, e.g. VNet#1. */
-
-#if HC_ARCH_BITS != 64
-    uint32_t                     padding1;
-#endif
-
-    /** Status LUN: Base interface. */
-    PDMIBASE                     IBase;
-
-    /** Status LUN: LED port interface. */
-    PDMILEDPORTS                 ILed;
-
-    /* Read/write part, protected with critical section. */
-    /** Status LED. */
-    PDMLED                       led;
-
-    VIRTIOCALLBACKS              virtioCallbacks;
-
-    /** Status LUN: LED connector (peer). */
-    R3PTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
-
-    PPDMDEVINSR3                 pDevInsR3;                           /**< Device instance - R3. */
-    PPDMDEVINSR0                 pDevInsR0;                           /**< Device instance - R0. */
-    PPDMDEVINSRC                 pDevInsRC;                           /**< Device instance - RC. */
-
-
-    uint8_t                      uPciCfgDataOff;
-#if HC_ARCH_BITS == 64
-    uint32_t                     padding2;
-#endif
-
-    /** Base port of I/O space region. */
-    RTIOPORT                     IOPortBase;
-
-    uint32_t                     uGuestFeatures;
-    uint16_t                     uQueueSelector;                      /** An index in aQueues array. */
-    uint8_t                      uStatus;                             /** Device Status (bits are device-specific). */
-    uint8_t                      uISR;                                /** Interrupt Status Register. */
-
-#if HC_ARCH_BITS != 64
-    uint32_t                     padding3;
-#endif
-
-    VQUEUE                       Queues[VIRTIO_MAX_QUEUES];
-    uint32_t                     uNotifyOffMultiplier;                /* Multiplier for uQueueNotifyOff[idx] */
-
-    /** Whole virtio device */
-    uint32_t                     uDeviceFeaturesSelect;               /** Select hi/lo 32-bit uDeviceFeatures to r/w */
-    uint64_t                     uDeviceFeatures;                     /** Host features offered */
-    uint32_t                     uDriverFeaturesSelect;               /** Selects hi/lo 32-bit uDriverFeatures to r/w*/
-    uint64_t                     uDriverFeatures;                     /** Host features accepted by guest */
-    uint32_t                     uMsixConfig;
-    uint32_t                     uNumQueues;                          /** Actual number of queues used. */
-    uint8_t                      uDeviceStatus;
-    uint8_t                      uConfigGeneration;
-
-    /** Specific virtqueue */
-    uint16_t                     uQueueSelect;
-    uint16_t                     uQueueSize[VIRTIO_MAX_QUEUES];       /** Device sets on reset, driver can modify */
-    uint16_t                     uQueueNotifyOff[VIRTIO_MAX_QUEUES];  /** Device sets this */
-    uint16_t                     uQueueMsixVector[VIRTIO_MAX_QUEUES]; /** Driver specifies queue vector for MSI-X */
-    uint16_t                     uQueueEnable[VIRTIO_MAX_QUEUES];     /** Driver controls device access to queue */
-    uint64_t                     uQueueDesc[VIRTIO_MAX_QUEUES];       /** Driver provides this */
-    uint64_t                     uQueueAvail[VIRTIO_MAX_QUEUES];      /** Driver provides this */
-    uint64_t                     uQueueUsed[VIRTIO_MAX_QUEUES];       /** Driver provides this */
-
-
-    uint8_t                      uVirtioCapBar;                       /* Capabilities BAR (region) assigned by client */
-
-    /** Callbacks when guest driver reads or writes VirtIO device-specific capabilities(s) */
-    PFNPCICONFIGREAD             pfnPciConfigReadOld;
-    PFNPCICONFIGWRITE            pfnPciConfigWriteOld;
-
-    uint32_t                     cbDevSpecificCap;                    /* Size of client's dev-specific config data  */
-    void                        *pDevSpecificCap;                     /* Pointer to client's struct                 */
-    void                        *pPrevDevSpecificCap;                 /* Previous read dev-specific cfg of client */
-    bool                         fGenUpdatePending;                   /* If set, update cfg gen. after driver reads */
-
-    PVIRTIO_PCI_CFG_CAP_T        pPciCfgCap;                          /** Pointer to struct in configuration area */
-    PVIRTIO_PCI_NOTIFY_CAP_T     pNotifyCap;                          /** Pointer to struct in configuration area */
-    PVIRTIO_PCI_CAP_T            pCommonCfgCap;                       /** Pointer to struct in configuration area */
-    PVIRTIO_PCI_CAP_T            pIsrCap;                             /** Pointer to struct in configuration area */
-    PVIRTIO_PCI_CAP_T            pDeviceCap;                          /** Pointer to struct in configuration area */
-
-    /** Base address of PCI capabilities */
-    RTGCPHYS                     GCPhysPciCapBase;
-    RTGCPHYS                     pGcPhysCommonCfg;                    /** Pointer to MMIO mapped capability data */
-    RTGCPHYS                     pGcPhysNotifyCap;                    /** Pointer to MMIO mapped capability data */
-    RTGCPHYS                     pGcPhysIsrCap;                       /** Pointer to MMIO mapped capability data */
-    RTGCPHYS                     pGcPhysDeviceCap;                    /** Pointer to MMIO mapped capability data */
-
-    bool fDeviceConfigInterrupt;
-    bool fQueueInterrupt;
+    PDMPCIDEV                 dev;                               /**< PCI device                                */
+    char                      szInstance[16];                    /**< Instance name, e.g. "VIRTIOSCSI0"         */
+
+    PPDMDEVINSR3              pDevInsR3;                         /**< Device instance - R3                      */
+    PPDMDEVINSR0              pDevInsR0;                         /**< Device instance - R0                      */
+    PPDMDEVINSRC              pDevInsRC;                         /**< Device instance - RC                      */
+
+    RTGCPHYS                  pGcPhysPciCapBase;                 /**< Pointer to MMIO mapped capability data    */
+    RTGCPHYS                  pGcPhysCommonCfg;                  /**< Pointer to MMIO mapped capability data    */
+    RTGCPHYS                  pGcPhysNotifyCap;                  /**< Pointer to MMIO mapped capability data    */
+    RTGCPHYS                  pGcPhysIsrCap;                     /**< Pointer to MMIO mapped capability data    */
+    RTGCPHYS                  pGcPhysDeviceCap;                  /**< Pointer to MMIO mapped capability data    */
+
+    RTGCPHYS                  pGcPhysQueueDesc[VIRTQ_MAX_CNT];   /**< (MMIO) PhysAdr per-Q desc structs   GUEST */
+    RTGCPHYS                  pGcPhysQueueAvail[VIRTQ_MAX_CNT];  /**< (MMIO) PhysAdr per-Q avail structs  GUEST */
+    RTGCPHYS                  pGcPhysQueueUsed[VIRTQ_MAX_CNT];   /**< (MMIO) PhysAdr per-Q used structs   GUEST */
+    uint16_t                  uQueueNotifyOff[VIRTQ_MAX_CNT];    /**< (MMIO) per-Q notify offset           HOST */
+    uint16_t                  uQueueMsixVector[VIRTQ_MAX_CNT];   /**< (MMIO) Per-queue vector for MSI-X   GUEST */
+    uint16_t                  uQueueEnable[VIRTQ_MAX_CNT];       /**< (MMIO) Per-queue enable             GUEST */
+    uint16_t                  uQueueSize[VIRTQ_MAX_CNT];         /**< (MMIO) Per-queue size          HOST/GUEST */
+    uint16_t                  uQueueSelect;                      /**< (MMIO) queue selector               GUEST */
+    uint16_t                  padding;
+    uint64_t                  uDeviceFeatures;                   /**< (MMIO) Host features offered         HOST */
+    uint64_t                  uDriverFeatures;                   /**< (MMIO) Host features accepted       GUEST */
+    uint32_t                  uDeviceFeaturesSelect;             /**< (MMIO) hi/lo select uDeviceFeatures GUEST */
+    uint32_t                  uDriverFeaturesSelect;             /**< (MMIO) hi/lo select uDriverFeatures GUEST */
+    uint32_t                  uMsixConfig;                       /**< (MMIO) MSI-X vector                 GUEST */
+    uint32_t                  uNumQueues;                        /**< (MMIO) Actual number of queues      GUEST */
+    uint8_t                   uDeviceStatus;                     /**< (MMIO) Device Status                GUEST */
+    uint8_t                   uConfigGeneration;                 /**< (MMIO) Device config sequencer       HOST */
+
+    VIRTQ_CONTEXT_T           queueContext[VIRTQ_MAX_CNT];       /**< Local impl-specific queue context         */
+    VIRTIOCALLBACKS           virtioCallbacks;                   /**< Callback vectors to client                */
+
+    PFNPCICONFIGREAD          pfnPciConfigReadOld;               /**< Prev rd. cb. intercepting PCI Cfg I/O     */
+    PFNPCICONFIGWRITE         pfnPciConfigWriteOld;              /**< Prev wr. cb. intercepting PCI Cfg I/O     */
+
+    PVIRTIO_PCI_CFG_CAP_T     pPciCfgCap;                        /**< Pointer to struct in configuration area   */
+    PVIRTIO_PCI_NOTIFY_CAP_T  pNotifyCap;                        /**< Pointer to struct in configuration area   */
+    PVIRTIO_PCI_CAP_T         pCommonCfgCap;                     /**< Pointer to struct in configuration area   */
+    PVIRTIO_PCI_CAP_T         pIsrCap;                           /**< Pointer to struct in configuration area   */
+    PVIRTIO_PCI_CAP_T         pDeviceCap;                        /**< Pointer to struct in configuration area   */
+
+    uint32_t                  cbDevSpecificCap;                  /**< Size of client's dev-specific config data */
+    void                     *pDevSpecificCap;                   /**< Pointer to client's struct                */
+    void                     *pPrevDevSpecificCap;               /**< Previous read dev-specific cfg of client  */
+    bool                      fGenUpdatePending;                 /**< If set, update cfg gen after driver reads */
+    uint8_t                   uPciCfgDataOff;
+    uint8_t                   uVirtioCapBar;                     /**< Capabilities BAR/region (client-assigned) */
+    uint8_t                   uISR;                              /**< Interrupt Status Register.                */
 
 } VIRTIOSTATE, *PVIRTIOSTATE;
 
-DECLINLINE(uint16_t) vringReadAvail(PVIRTIOSTATE pVirtio, PVIRTQ pVirtQ)
-{
-    uint16_t dataWord;
-    PDMDevHlpPhysRead(pVirtio->CTX_SUFF(pDevIns),
-                      pVirtQ->pGcPhysVirtqAvail + RT_UOFFSETOF(VIRTQ_AVAIL_T, uIdx),
-                      &dataWord, sizeof(dataWord));
-    return dataWord;
-}
-
-DECLINLINE(bool) virtQueuePeek(PVIRTIOSTATE pVirtio, PVQUEUE pQueue, PVQUEUEELEM pElem)
-{
-    return virtQueueGet(pVirtio, pQueue, pElem, /* fRemove */ false);
-}
-
-DECLINLINE(bool) virtQueueIsReady(PVIRTIOSTATE pVirtio, PVQUEUE pQueue)
-{
-    NOREF(pVirtio);
-    return !!pQueue->VirtQ.pGcPhysVirtqAvail;
-}
-
-DECLINLINE(bool) virtQueueIsEmpty(PVIRTIOSTATE pVirtio, PVQUEUE pQueue)
-{
-    return (vringReadAvail(pVirtio, &pQueue->VirtQ) == pQueue->uNextAvailIndex);
-}
+/** virtq related flags */
+#define VIRTQ_DESC_F_NEXT                               1        /**< Indicates this descriptor chains to next  */
+#define VIRTQ_DESC_F_WRITE                              2        /**< Marks buffer as write-only (default ro)   */
+#define VIRTQ_DESC_F_INDIRECT                           4        /**< Buffer is list of buffer descriptors      */
+
+#define VIRTQ_USED_F_NO_NOTIFY                          1        /**< Dev to Drv: Don't notify when buf added   */
+#define VIRTQ_AVAIL_F_NO_INTERRUPT                      1        /**< Drv to Dev: Don't notify when buf eaten   */
+
+/**
+ * virtq related structs
+ * (struct names follow VirtIO 1.0 spec, typedef use VBox style)
+ */
+typedef struct virtq_desc
+{
+    uint64_t  pGcPhysBuf;                                        /**< addr       GC Phys. address of buffer     */
+    uint32_t  cb;                                                /**< len        Buffer length                  */
+    uint16_t  fFlags;                                            /**< flags      Buffer specific flags          */
+    uint16_t  uDescIdxNext;                                      /**< next       Idx set if VIRTIO_DESC_F_NEXT  */
+} VIRTQ_DESC_T, *PVIRTQ_DESC_T;
+
+typedef struct virtq_avail
+{
+    uint16_t  fFlags;                                            /**< flags      avail ring drv to dev flags    */
+    uint16_t  uDescIdx;                                          /**< idx        Index of next free ring slot   */
+    uint16_t  auRing[1];                                         /**< ring       Ring: avail drv to dev bufs    */
+    uint16_t  uUsedEventIdx;                                     /**< used_event (if VIRTQ_USED_F_NO_NOTIFY)    */
+} VIRTQ_AVAIL_T, *PVIRTQ_AVAIL_T;
+
+typedef struct virtq_used_elem
+{
+    uint32_t  uDescIdx;                                          /**< idx         Start of used desc chain      */
+    uint32_t  cbElem;                                            /**< len         Total len of used desc chain  */
+} VIRTQ_USED_ELEM_T;
+
+typedef struct virt_used
+{
+    uint16_t  fFlags;                                            /**< flags       used ring host-to-guest flags */
+    uint16_t  uDescIdx;                                          /**< idx         Index of next ring slot       */
+    VIRTQ_USED_ELEM_T auRing[1];                                 /**< ring        Ring: used dev to drv bufs    */
+    uint16_t  uAvailEventIdx;                                    /**< avail_event if (VIRTQ_USED_F_NO_NOTIFY)   */
+} VIRTQ_USED_T, *PVIRTQ_USED_T;
+
 /**
 * This macro returns true if physical address and access length are within the mapped capability struct.
@@ -249 +247 @@
 *     @param    GCPhysAddr     - [input, implied] Physical address accessed (via MMIO callback)
 *     @param    cb             - [input, implied] Number of bytes to access
-*
 */
 #define MATCH_VIRTIO_CAP_STRUCT(pGcPhysCapData, pCfgCap, fMatched) \
@@ -268 +265 @@
  * @result           - true or false
  */
-#define COMMON_CFG(member) \
+#define MATCH_COMMON_CFG(member) \
         (RT_SIZEOFMEMB(VIRTIO_PCI_COMMON_CFG_T, member) == 8 \
          && (   uOffset == RT_OFFSETOF(VIRTIO_PCI_COMMON_CFG_T, member) \
@@ -276 +273 @@
            && cb == RT_SIZEOFMEMB(VIRTIO_PCI_COMMON_CFG_T, member))
 
-#define LOG_ACCESSOR(member) \
-        virtioLogMappedIoValue(__FUNCTION__, #member, pv, cb, uIntraOff, fWrite, false, 0);
-
-#define LOG_INDEXED_ACCESSOR(member, idx) \
-        virtioLogMappedIoValue(__FUNCTION__, #member, pv, cb, uIntraOff, fWrite, true, idx);
-
-#define ACCESSOR(member) \
+#define LOG_COMMON_CFG_ACCESS(member) \
+        virtioLogMappedIoValue(__FUNCTION__, #member, RT_SIZEOFMEMB(VIRTIO_PCI_COMMON_CFG_T, member), \
+                                pv, cb, uIntraOff, fWrite, false, 0);
+
+#define LOG_COMMON_CFG_ACCESS_INDEXED(member, idx) \
+        virtioLogMappedIoValue(__FUNCTION__, #member, RT_SIZEOFMEMB(VIRTIO_PCI_COMMON_CFG_T, member), \
+                               pv, cb, uIntraOff, fWrite, true, idx);
+
+#define COMMON_CFG_ACCESSOR(member) \
     { \
         uint32_t uIntraOff = uOffset - RT_OFFSETOF(VIRTIO_PCI_COMMON_CFG_T, member); \
@@ -289 +288 @@
         else \
             memcpy((char *)pv, (const char *)(((char *)&pVirtio->member) + uIntraOff), cb); \
-        LOG_ACCESSOR(member); \
+        LOG_COMMON_CFG_ACCESS(member); \
     }
 
-#define ACCESSOR_WITH_IDX(member, idx) \
+#define COMMON_CFG_ACCESSOR_INDEXED(member, idx) \
     { \
         uint32_t uIntraOff = uOffset - RT_OFFSETOF(VIRTIO_PCI_COMMON_CFG_T, member); \
@@ -299 +298 @@
         else \
             memcpy((char *)pv, (const char *)(((char *)(pVirtio->member + idx)) + uIntraOff), cb); \
-        LOG_INDEXED_ACCESSOR(member, idx); \
+        LOG_COMMON_CFG_ACCESS_INDEXED(member, idx); \
     }
 
-#define ACCESSOR_READONLY(member) \
+#define COMMON_CFG_ACCESSOR_READONLY(member) \
     { \
         uint32_t uIntraOff = uOffset - RT_OFFSETOF(VIRTIO_PCI_COMMON_CFG_T, member); \
@@ -310 +309 @@
         { \
             memcpy((char *)pv, (const char *)(((char *)&pVirtio->member) + uIntraOff), cb); \
-            LOG_ACCESSOR(member); \
+            LOG_COMMON_CFG_ACCESS(member); \
         } \
     }
 
-#define ACCESSOR_READONLY_WITH_IDX(member, idx) \
+#define COMMON_CFG_ACCESSOR_INDEXED_READONLY(member, idx) \
     { \
         uint32_t uIntraOff = uOffset - RT_OFFSETOF(VIRTIO_PCI_COMMON_CFG_T, member); \
@@ -321 +320 @@
         else \
         { \
-            memcpy((char *)pv, ((char *)(pVirtio->member + idx)) + uOffset, cb); \
-            LOG_INDEXED_ACCESSOR(member, idx); \
+            memcpy((char *)pv, ((char *)(pVirtio->member + idx)) + uIntraOff, cb); \
+            LOG_COMMON_CFG_ACCESS_INDEXED(member, idx); \
         } \
     }
 
-#ifdef VBOX_DEVICE_STRUCT_TESTCASE
-#  define virtioDumpState(x, s)  do {} while (0)
-#else
-#  ifdef DEBUG
-        static void virtioDumpState(PVIRTIOSTATE pVirtio, const char *pcszCaller)
-        {
-            RT_NOREF2(pVirtio, pcszCaller);
-            /* PK TODO, dump state features, selector, status, ISR, queue info (iterate),
-                        descriptors, avail, used, size, indices, address
-                        each by variable name on new line, indented slightly */
-        }
-#  endif
-#endif
-
+/**
+ * Internal queue operations
+ */
+
+static int         vqIsEventNeeded(uint16_t uEventIdx, uint16_t uDescIdxNew, uint16_t uDescIdxOld);
+static bool        vqIsEmpty              (PVIRTIOSTATE pVirtio, uint16_t qIdx);
+static void        vqReset                (PVIRTIOSTATE pVirtio, uint16_t qIdx);
+static void        vqReadDesc             (PVIRTIOSTATE pVirtio, uint16_t qIdx, uint32_t uDescIdx, PVIRTQ_DESC_T pDesc);
+static uint16_t    vqReadAvailRingDescIdx (PVIRTIOSTATE pVirtio, uint16_t qIdx, uint32_t availIdx);
+static uint16_t    vqReadAvailDescIdx     (PVIRTIOSTATE pVirtio, uint16_t qIdx);
+static uint16_t    vqReadAvailFlags       (PVIRTIOSTATE pVirtio, uint16_t qIdx);
+static uint16_t    vqReadAvailUsedEvent   (PVIRTIOSTATE pVirtio, uint16_t qIdx);
+static void        vqWriteUsedElem        (PVIRTIOSTATE pVirtio, uint16_t qIdx, uint32_t usedIdx, uint32_t uDescIdx, uint32_t uLen);
+static void        vqWriteUsedRingDescIdx (PVIRTIOSTATE pVirtio, uint16_t qIdx, uint16_t uDescIdx);
+static uint16_t    vqReadUsedDescIdx      (PVIRTIOSTATE pVirtio, uint16_t qIdx);
+static uint16_t    vqReadUsedFlags        (PVIRTIOSTATE pVirtio, uint16_t qIdx);
+static void        vqWriteUsedFlags       (PVIRTIOSTATE pVirtio, uint16_t qIdx, uint32_t fFlags);
+static uint16_t    vqReadUsedAvailEvent   (PVIRTIOSTATE pVirtio, uint16_t qIdx);
+static void        vqWriteUsedAvailEvent  (PVIRTIOSTATE pVirtio, uint16_t qIdx, uint32_t uAvailEventIdx);
+
+DECLINLINE(int) vqIsEventNeeded(uint16_t uEventIdx, uint16_t uDescIdxNew, uint16_t uDescIdxOld)
+{
+    return (uint16_t)(uDescIdxNew - uEventIdx - 1) < (uint16_t)(uDescIdxNew - uDescIdxOld);
+}
+
+DECLINLINE(bool) vqIsEmpty(PVIRTIOSTATE pVirtio, uint16_t qIdx)
+{
+    return vqReadAvailDescIdx(pVirtio, qIdx) == pVirtio->queueContext->uNextAvailIdx;
+}
+
+/**
+ * Accessor for virtq descspVirtio
+ */
+DECLINLINE(void) vqReadDesc(PVIRTIOSTATE pVirtio, uint16_t qIdx, uint32_t uDescIdx, PVIRTQ_DESC_T pDesc)
+{
+    //Log(("%s virtioQueueReadDesc: ring=%p idx=%u\n", INSTANCE(pState), pVirtQ, idx));
+    PDMDevHlpPhysRead(pVirtio->CTX_SUFF(pDevIns),
+                      pVirtio->pGcPhysQueueDesc[qIdx]
+                         + sizeof(VIRTQ_DESC_T) * (uDescIdx % pVirtio->uQueueSize[qIdx]),
+                      pDesc, sizeof(VIRTQ_DESC_T));
+}
+
+/**
+ * Accessors for virtq avail ring
+ */
+DECLINLINE(uint16_t) vqReadAvailRingDescIdx(PVIRTIOSTATE pVirtio, uint16_t qIdx, uint32_t availIdx)
+{
+    uint16_t uDescIdx;
+    PDMDevHlpPhysRead(pVirtio->CTX_SUFF(pDevIns),
+                      pVirtio->pGcPhysQueueAvail[qIdx]
+                         + RT_UOFFSETOF_DYN(VIRTQ_AVAIL_T, auRing[availIdx % pVirtio->uQueueSize[qIdx]]),
+                      &uDescIdx, sizeof(uDescIdx));
+    return uDescIdx;
+}
+
+DECLINLINE(uint16_t) vqReadAvailDescIdx(PVIRTIOSTATE pVirtio, uint16_t qIdx)
+{
+    uint16_t uDescIdx;
+    PDMDevHlpPhysRead(pVirtio->CTX_SUFF(pDevIns),
+                      pVirtio->pGcPhysQueueAvail[qIdx] + RT_UOFFSETOF(VIRTQ_AVAIL_T, uDescIdx),
+                      &uDescIdx, sizeof(uDescIdx));
+    return uDescIdx;
+}
+
+DECLINLINE(uint16_t) vqReadAvailFlags(PVIRTIOSTATE pVirtio, uint16_t qIdx)
+{
+    uint16_t fFlags;
+    PDMDevHlpPhysRead(pVirtio->CTX_SUFF(pDevIns),
+                      pVirtio->pGcPhysQueueAvail[qIdx] + RT_UOFFSETOF(VIRTQ_AVAIL_T, fFlags),
+                      &fFlags, sizeof(fFlags));
+    return fFlags;
+}
+
+DECLINLINE(uint16_t) vqReadAvailUsedEvent(PVIRTIOSTATE pVirtio, uint16_t qIdx)
+{
+    uint16_t uUsedEventIdx;
+    /** VirtIO 1.0 uUsedEventIdx (used_event) immediately follows ring */
+    PDMDevHlpPhysRead(pVirtio->CTX_SUFF(pDevIns),
+                      + RT_UOFFSETOF_DYN(VIRTQ_AVAIL_T, auRing[pVirtio->uQueueSize[qIdx]]),
+                      &uUsedEventIdx, sizeof(uUsedEventIdx));
+    return uUsedEventIdx;
+}
+
+/**
+ * Accessors for virtq used ring
+ */
+DECLINLINE(void) vqWriteUsedElem(PVIRTIOSTATE pVirtio, uint16_t qIdx, uint32_t usedIdx, uint32_t uDescIdx, uint32_t uLen)
+{
+    VIRTQ_USED_ELEM_T elem = { uDescIdx,  uLen };
+    PDMDevHlpPCIPhysWrite(pVirtio->CTX_SUFF(pDevIns),
+                          pVirtio->pGcPhysQueueUsed[qIdx]
+                            + RT_UOFFSETOF_DYN(VIRTQ_USED_T, auRing[usedIdx % pVirtio->uQueueSize[qIdx]]),
+                          &elem, sizeof(elem));
+}
+
+DECLINLINE(void) vqWriteUsedRingDescIdx(PVIRTIOSTATE pVirtio, uint16_t qIdx, uint16_t uDescIdx)
+{
+    PDMDevHlpPCIPhysWrite(pVirtio->CTX_SUFF(pDevIns),
+                          pVirtio->pGcPhysQueueUsed[qIdx] + RT_UOFFSETOF(VIRTQ_USED_T, uDescIdx),
+                          &uDescIdx, sizeof(uDescIdx));
+}
+
+DECLINLINE(uint16_t)vqReadUsedDescIdx(PVIRTIOSTATE pVirtio, uint16_t qIdx)
+{
+    uint16_t uDescIdx;
+    PDMDevHlpPhysRead(pVirtio->CTX_SUFF(pDevIns),
+                      pVirtio->pGcPhysQueueUsed[qIdx] + RT_UOFFSETOF(VIRTQ_USED_T, uDescIdx),
+                      &uDescIdx, sizeof(uDescIdx));
+    return uDescIdx;
+}
+
+DECLINLINE(uint16_t) vqReadUsedFlags(PVIRTIOSTATE pVirtio, uint16_t qIdx)
+{
+    uint16_t fFlags;
+    PDMDevHlpPhysRead(pVirtio->CTX_SUFF(pDevIns),
+                      pVirtio->pGcPhysQueueUsed[qIdx] + RT_UOFFSETOF(VIRTQ_USED_T, fFlags),
+                      &fFlags, sizeof(fFlags));
+    return fFlags;
+}
+
+DECLINLINE(void) vqWriteUsedFlags(PVIRTIOSTATE pVirtio, uint16_t qIdx, uint32_t fFlags)
+{
+    PDMDevHlpPCIPhysWrite(pVirtio->CTX_SUFF(pDevIns),
+                          pVirtio->pGcPhysQueueUsed[qIdx] + RT_UOFFSETOF(VIRTQ_USED_T, fFlags),
+                          &fFlags, sizeof(fFlags));
+}
+
+DECLINLINE(uint16_t) vqReadUsedAvailEvent(PVIRTIOSTATE pVirtio, uint16_t qIdx)
+{
+    uint16_t uAvailEventIdx;
+    /** VirtIO 1.0 uAvailEventIdx (avail_event) immediately follows ring */
+    PDMDevHlpPhysRead(pVirtio->CTX_SUFF(pDevIns),
+                    + RT_UOFFSETOF_DYN(VIRTQ_USED_T, auRing[pVirtio->uQueueSize[qIdx]]),
+                      &uAvailEventIdx, sizeof(uAvailEventIdx));
+    return uAvailEventIdx;
+}
+
+DECLINLINE(void) vqWriteUsedAvailEvent(PVIRTIOSTATE pVirtio, uint16_t qIdx, uint32_t uAvailEventIdx)
+{
+    /** VirtIO 1.0 uAvailEventIdx (avail event) immediately follows ring */
+    PDMDevHlpPCIPhysWrite(pVirtio->CTX_SUFF(pDevIns),
+                          pVirtio->pGcPhysQueueUsed[qIdx]
+                            + RT_UOFFSETOF_DYN(VIRTQ_USED_T, auRing[pVirtio->uQueueSize[qIdx]]),
+                          &uAvailEventIdx, sizeof(uAvailEventIdx));
+}
+
+/**
+ * Makes the MMIO-mapped Virtio uDeviceStatus registers non-cryptic */
 DECLINLINE(void) virtioLogDeviceStatus( uint8_t status)
 {
@@ -358 +491 @@
             Log(("%sFAILED",      primed++ ? " | " : ""));
         if (status & VIRTIO_STATUS_DEVICE_NEEDS_RESET)
-            Log(("%sACKNOWLEDGE", primed++ ? " | " : ""));
+            Log(("%sNEEDS_RESET", primed++ ? " | " : ""));
     }
 }
 
-/*  FROM Virtio 1.0 SPEC, NYI
-      static inline int virtq_need_event(uint16_t event_idx, uint16_t new_idx, uint16_t old_idx)
-            return (uint16_t)(new_idx - event_idx - 1) < (uint16_t)(new_idx - old_idx);
-      }
-      // Get location of event indices (only with VIRTIO_F_EVENT_IDX)
-      static inline le16 *virtq_used_event(struct virtq *vq)
-      {
-              // For backwards compat, used event index is at *end* of avail ring.
-              return &vq->avail->ring[vq->num];
-}
-      static inline le16 *virtq_avail_event(struct virtq *vq)
-      {
-              // For backwards compat, avail event index is at *end* of used ring.
-              return (le16 *)&vq->used->ring[vq->num];
-      }
-}
-*/
-void    virtioRelocate(PPDMDEVINS pDevIns, RTGCINTPTR offDelta);
-void   *virtioQueryInterface(struct PDMIBASE *pInterface, const char *pszIID);
-int     virtioSaveExec(PVIRTIOSTATE pVirtio, PSSMHANDLE pSSM);
-int     virtioLoadExec(PVIRTIOSTATE pVirtio, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass, uint32_t uNumQueues);
+void   vqNotified(PVIRTIOSTATE pVirtio, uint32_t qidx, uint16_t uDescIdx);
+static int virtioRaiseInterrupt(PVIRTIOSTATE pVirtio, uint8_t uCause);
+
+//void    virtioNotifyDriver(     VIRTIOHANDLE hVirtio);
+//void    virtQueueNotify(        VIRTIOHANDLE hVirtio, PVQUEUE pQueue);
+//void    vringSetNotification(   VIRTIOHANDLE hVirtio, PVIRTQ pVirtQ, bool fEnabled);
+
+static DECLCALLBACK(int) virtioR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM);
+static DECLCALLBACK(int) virtioR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass);
+static DECLCALLBACK(int) virtioR3LoadDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM);
+static DECLCALLBACK(int) virtioR3LiveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass);
 
 #endif /* !VBOX_INCLUDED_SRC_VirtIO_Virtio_1_0_impl_h */