Adding upstream version 7.0.14-dfsg.upstream/7.0.14-dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

3 files changed, 4203 insertions, 0 deletions

diff --git a/src/VBox/Devices/VirtIO/Makefile.kup b/src/VBox/Devices/VirtIO/Makefile.kup
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/src/VBox/Devices/VirtIO/Makefile.kup
diff --git a/src/VBox/Devices/VirtIO/VirtioCore.cpp b/src/VBox/Devices/VirtIO/VirtioCore.cpp
new file mode 100644
index 00000000..3849aa7c
--- /dev/null
+++ b/src/VBox/Devices/VirtIO/VirtioCore.cpp
@@ -0,0 +1,2727 @@
+/* $Id: VirtioCore.cpp $ */
+
+/** @file
+ * VirtioCore - Virtio Core (PCI, feature & config mgt, queue mgt & proxy, notification mgt)
+ */
+
+/*
+ * Copyright (C) 2009-2023 Oracle and/or its affiliates.
+ *
+ * This file is part of VirtualBox base platform packages, as
+ * available from https://www.virtualbox.org.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation, in version 3 of the
+ * License.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+
+/*********************************************************************************************************************************
+*   Header Files                                                                                                                 *
+*********************************************************************************************************************************/
+#define LOG_GROUP LOG_GROUP_DEV_VIRTIO
+
+#include <iprt/assert.h>
+#include <iprt/uuid.h>
+#include <iprt/mem.h>
+#include <iprt/sg.h>
+#include <iprt/assert.h>
+#include <iprt/string.h>
+#include <iprt/param.h>
+#include <iprt/types.h>
+#include <VBox/log.h>
+#include <VBox/msi.h>
+#include <iprt/types.h>
+#include <VBox/AssertGuest.h>
+#include <VBox/vmm/pdmdev.h>
+#include "VirtioCore.h"
+
+
+/*********************************************************************************************************************************
+*   Defined Constants And Macros                                                                                                 *
+*********************************************************************************************************************************/
+
+#define INSTANCE(a_pVirtio)                 ((a_pVirtio)->szInstance)
+#define VIRTQNAME(a_pVirtio, a_uVirtq)      ((a_pVirtio)->aVirtqueues[(a_uVirtq)].szName)
+
+#define IS_VIRTQ_EMPTY(pDevIns, pVirtio, pVirtq) \
+            (virtioCoreVirtqAvailCnt(pDevIns, pVirtio, pVirtq) == 0)
+
+#define IS_DRIVER_OK(a_pVirtio)             ((a_pVirtio)->fDeviceStatus & VIRTIO_STATUS_DRIVER_OK)
+#define WAS_DRIVER_OK(a_pVirtio)            ((a_pVirtio)->fPrevDeviceStatus & VIRTIO_STATUS_DRIVER_OK)
+
+/**
+ * These defines are used to track  guest virtio-net driver writing driver features accepted flags
+ * in two 32-bit operations (in arbitrary order), and one bit dedicated to ensured 'features complete'
+ * is handled once.
+ */
+#define DRIVER_FEATURES_0_WRITTEN                        1   /**< fDriverFeatures[0]  written by guest virtio-net */
+#define DRIVER_FEATURES_1_WRITTEN                        2   /**< fDriverFeatures[1]  written by guest virtio-net */
+#define DRIVER_FEATURES_0_AND_1_WRITTEN                  3   /**< Both 32-bit parts of fDriverFeatures[] written  */
+#define DRIVER_FEATURES_COMPLETE_HANDLED                 4   /**< Features negotiation complete handler called    */
+
+/**
+ * This macro returns true if the @a a_offAccess and access length (@a
+ * a_cbAccess) are within the range of the mapped capability struct described by
+ * @a a_LocCapData.
+ *
+ * @param[in]  a_offAccess      Input:  The offset into the MMIO bar of the access.
+ * @param[in]  a_cbAccess       Input:  The access size.
+ * @param[out] a_offsetIntoCap  Output: uint32_t variable to return the intra-capability offset into.
+ * @param[in]  a_LocCapData     Input:  The capability location info.
+ */
+#define MATCHES_VIRTIO_CAP_STRUCT(a_offAccess, a_cbAccess, a_offsetIntoCap, a_LocCapData) \
+    (   ((a_offsetIntoCap) = (uint32_t)((a_offAccess) - (a_LocCapData).offMmio)) < (uint32_t)(a_LocCapData).cbMmio \
+     && (a_offsetIntoCap) + (uint32_t)(a_cbAccess) <= (uint32_t)(a_LocCapData).cbMmio )
+
+
+/*********************************************************************************************************************************
+*   Structures and Typedefs                                                                                                      *
+*********************************************************************************************************************************/
+
+/** @name virtq related flags
+ * @{ */
+#define VIRTQ_DESC_F_NEXT                               1        /**< Indicates this descriptor chains to next  */
+#define VIRTQ_DESC_F_WRITE                              2        /**< Marks buffer as write-only (default ro)   */
+#define VIRTQ_DESC_F_INDIRECT                           4        /**< Buffer is list of buffer descriptors      */
+
+#define VIRTQ_USED_F_NO_NOTIFY                          1        /**< Dev to Drv: Don't notify when buf added   */
+#define VIRTQ_AVAIL_F_NO_INTERRUPT                      1        /**< Drv to Dev: Don't notify when buf eaten   */
+/** @} */
+
+/**
+ * virtq-related structs
+ * (struct names follow VirtIO 1.0 spec, field names use VBox styled naming, w/respective spec'd name in comments)
+ */
+typedef struct virtq_desc
+{
+    uint64_t  GCPhysBuf;                                         /**< addr       GC Phys. address of buffer     */
+    uint32_t  cb;                                                /**< len        Buffer length                  */
+    uint16_t  fFlags;                                            /**< flags      Buffer specific flags          */
+    uint16_t  uDescIdxNext;                                      /**< next       Idx set if VIRTIO_DESC_F_NEXT  */
+} VIRTQ_DESC_T, *PVIRTQ_DESC_T;
+
+typedef struct virtq_avail
+{
+    uint16_t  fFlags;                                            /**< flags      avail ring guest-to-host flags */
+    uint16_t  uIdx;                                              /**< idx        Index of next free ring slot   */
+    RT_FLEXIBLE_ARRAY_EXTENSION
+    uint16_t  auRing[RT_FLEXIBLE_ARRAY];                         /**< ring       Ring: avail drv to dev bufs    */
+    //uint16_t  uUsedEventIdx;                                   /**< used_event (if VIRTQ_USED_F_EVENT_IDX)    */
+} VIRTQ_AVAIL_T, *PVIRTQ_AVAIL_T;
+
+typedef struct virtq_used_elem
+{
+    uint32_t  uDescIdx;                                          /**< idx         Start of used desc chain      */
+    uint32_t  cbElem;                                            /**< len         Total len of used desc chain  */
+} VIRTQ_USED_ELEM_T;
+
+typedef struct virt_used
+{
+    uint16_t  fFlags;                                            /**< flags       used ring host-to-guest flags */
+    uint16_t  uIdx;                                              /**< idx         Index of next ring slot       */
+    RT_FLEXIBLE_ARRAY_EXTENSION
+    VIRTQ_USED_ELEM_T aRing[RT_FLEXIBLE_ARRAY];                  /**< ring        Ring: used dev to drv bufs    */
+    //uint16_t  uAvailEventIdx;                                  /**< avail_event if (VIRTQ_USED_F_EVENT_IDX)   */
+} VIRTQ_USED_T, *PVIRTQ_USED_T;
+
+const char *virtioCoreGetStateChangeText(VIRTIOVMSTATECHANGED enmState)
+{
+    switch (enmState)
+    {
+        case kvirtIoVmStateChangedReset:                return "VM RESET";
+        case kvirtIoVmStateChangedSuspend:              return "VM SUSPEND";
+        case kvirtIoVmStateChangedPowerOff:             return "VM POWER OFF";
+        case kvirtIoVmStateChangedResume:               return "VM RESUME";
+        default:                                        return "<BAD ENUM>";
+    }
+}
+
+/* Internal Functions */
+
+static void virtioCoreNotifyGuestDriver(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq);
+static int  virtioNudgeGuest(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint8_t uCause, uint16_t uVec);
+
+#ifdef IN_RING3
+#  ifdef LOG_ENABLED
+DECLINLINE(uint16_t) virtioCoreR3CountPendingBufs(uint16_t uRingIdx, uint16_t uShadowIdx, uint16_t uQueueSize)
+{
+    if (uShadowIdx == uRingIdx)
+        return 0;
+    else
+    if (uShadowIdx > uRingIdx)
+        return uShadowIdx - uRingIdx;
+    return uQueueSize - (uRingIdx - uShadowIdx);
+}
+#  endif
+#endif
+/** @name Internal queue operations
+ * @{ */
+
+/**
+ * Accessor for virtq descriptor
+ */
+#ifdef IN_RING3
+DECLINLINE(void) virtioReadDesc(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq,
+                                uint32_t idxDesc, PVIRTQ_DESC_T pDesc)
+{
+    /*
+     * Shut up assertion for legacy virtio-net driver in FreeBSD up to 12.3 (see virtioCoreR3VirtqUsedBufPut()
+     * for more information).
+     */
+    AssertMsg(   IS_DRIVER_OK(pVirtio)
+              || (   pVirtio->fLegacyDriver
+                  && pVirtq->GCPhysVirtqDesc),
+              ("Called with guest driver not ready\n"));
+    uint16_t const cVirtqItems = RT_MAX(pVirtq->uQueueSize, 1); /* Make sure to avoid div-by-zero. */
+
+    virtioCoreGCPhysRead(pVirtio, pDevIns,
+                         pVirtq->GCPhysVirtqDesc + sizeof(VIRTQ_DESC_T) * (idxDesc % cVirtqItems),
+                         pDesc, sizeof(VIRTQ_DESC_T));
+}
+#endif
+
+/**
+ * Accessors for virtq avail ring
+ */
+#ifdef IN_RING3
+DECLINLINE(uint16_t) virtioReadAvailDescIdx(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq, uint32_t availIdx)
+{
+    uint16_t uDescIdx;
+
+    AssertMsg(pVirtio->fLegacyDriver || IS_DRIVER_OK(pVirtio), ("Called with guest driver not ready\n"));
+    uint16_t const cVirtqItems = RT_MAX(pVirtq->uQueueSize, 1); /* Make sure to avoid div-by-zero. */
+    virtioCoreGCPhysRead(pVirtio, pDevIns,
+                         pVirtq->GCPhysVirtqAvail + RT_UOFFSETOF_DYN(VIRTQ_AVAIL_T, auRing[availIdx % cVirtqItems]),
+                         &uDescIdx, sizeof(uDescIdx));
+    return uDescIdx;
+}
+
+DECLINLINE(uint16_t) virtioReadAvailUsedEvent(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq)
+{
+    uint16_t uUsedEventIdx;
+    /* VirtIO 1.0 uUsedEventIdx (used_event) immediately follows ring */
+    AssertMsg(pVirtio->fLegacyDriver || IS_DRIVER_OK(pVirtio), ("Called with guest driver not ready\n"));
+    virtioCoreGCPhysRead(pVirtio, pDevIns,
+                         pVirtq->GCPhysVirtqAvail + RT_UOFFSETOF_DYN(VIRTQ_AVAIL_T, auRing[pVirtq->uQueueSize]),
+                         &uUsedEventIdx, sizeof(uUsedEventIdx));
+    return uUsedEventIdx;
+}
+#endif
+
+DECLINLINE(uint16_t) virtioReadAvailRingIdx(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq)
+{
+    uint16_t uIdx = 0;
+    AssertMsg(pVirtio->fLegacyDriver || IS_DRIVER_OK(pVirtio), ("Called with guest driver not ready\n"));
+    virtioCoreGCPhysRead(pVirtio, pDevIns,
+                         pVirtq->GCPhysVirtqAvail + RT_UOFFSETOF(VIRTQ_AVAIL_T, uIdx),
+                         &uIdx, sizeof(uIdx));
+    return uIdx;
+}
+
+DECLINLINE(uint16_t) virtioReadAvailRingFlags(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq)
+{
+    uint16_t fFlags = 0;
+    AssertMsg(pVirtio->fLegacyDriver || IS_DRIVER_OK(pVirtio), ("Called with guest driver not ready\n"));
+    virtioCoreGCPhysRead(pVirtio, pDevIns,
+                         pVirtq->GCPhysVirtqAvail + RT_UOFFSETOF(VIRTQ_AVAIL_T, fFlags),
+                         &fFlags, sizeof(fFlags));
+    return fFlags;
+}
+
+/** @} */
+
+/** @name Accessors for virtq used ring
+ * @{
+ */
+
+#ifdef IN_RING3
+DECLINLINE(void) virtioWriteUsedElem(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq,
+                                     uint32_t usedIdx, uint32_t uDescIdx, uint32_t uLen)
+{
+    VIRTQ_USED_ELEM_T elem = { uDescIdx,  uLen };
+    AssertMsg(pVirtio->fLegacyDriver || IS_DRIVER_OK(pVirtio), ("Called with guest driver not ready\n"));
+    uint16_t const cVirtqItems = RT_MAX(pVirtq->uQueueSize, 1); /* Make sure to avoid div-by-zero. */
+    virtioCoreGCPhysWrite(pVirtio, pDevIns,
+                          pVirtq->GCPhysVirtqUsed
+                        + RT_UOFFSETOF_DYN(VIRTQ_USED_T, aRing[usedIdx % cVirtqItems]),
+                          &elem, sizeof(elem));
+}
+
+DECLINLINE(void) virtioWriteUsedRingFlags(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq, uint16_t fFlags)
+{
+    AssertMsg(pVirtio->fLegacyDriver || IS_DRIVER_OK(pVirtio), ("Called with guest driver not ready\n"));
+    RT_UNTRUSTED_VALIDATED_FENCE(); /* VirtIO 1.0, Section 3.2.1.4.1 */
+    virtioCoreGCPhysWrite(pVirtio, pDevIns,
+                          pVirtq->GCPhysVirtqUsed + RT_UOFFSETOF(VIRTQ_USED_T, fFlags),
+                          &fFlags, sizeof(fFlags));
+}
+#endif
+
+DECLINLINE(void) virtioWriteUsedRingIdx(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq, uint16_t uIdx)
+{
+    AssertMsg(pVirtio->fLegacyDriver || IS_DRIVER_OK(pVirtio), ("Called with guest driver not ready\n"));
+    RT_UNTRUSTED_VALIDATED_FENCE(); /* VirtIO 1.0, Section 3.2.1.4.1 */
+    virtioCoreGCPhysWrite(pVirtio, pDevIns,
+                          pVirtq->GCPhysVirtqUsed + RT_UOFFSETOF(VIRTQ_USED_T, uIdx),
+                          &uIdx, sizeof(uIdx));
+}
+
+#ifdef IN_RING3
+DECLINLINE(uint16_t) virtioReadUsedRingIdx(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq)
+{
+    uint16_t uIdx = 0;
+    AssertMsg(pVirtio->fLegacyDriver || IS_DRIVER_OK(pVirtio), ("Called with guest driver not ready\n"));
+    virtioCoreGCPhysRead(pVirtio, pDevIns,
+                         pVirtq->GCPhysVirtqUsed + RT_UOFFSETOF(VIRTQ_USED_T, uIdx),
+                         &uIdx, sizeof(uIdx));
+    return uIdx;
+}
+
+DECLINLINE(uint16_t) virtioReadUsedRingFlags(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq)
+{
+    uint16_t fFlags = 0;
+    AssertMsg(pVirtio->fLegacyDriver || IS_DRIVER_OK(pVirtio), ("Called with guest driver not ready\n"));
+    virtioCoreGCPhysRead(pVirtio, pDevIns,
+                         pVirtq->GCPhysVirtqUsed + RT_UOFFSETOF(VIRTQ_USED_T, fFlags),
+                         &fFlags, sizeof(fFlags));
+    return fFlags;
+}
+
+DECLINLINE(void) virtioWriteUsedAvailEvent(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq, uint32_t uAvailEventIdx)
+{
+    /** VirtIO 1.0 uAvailEventIdx (avail_event) immediately follows ring */
+    AssertMsg(pVirtio->fLegacyDriver || IS_DRIVER_OK(pVirtio), ("Called with guest driver not ready\n"));
+    virtioCoreGCPhysWrite(pVirtio, pDevIns,
+                          pVirtq->GCPhysVirtqUsed
+                        + RT_UOFFSETOF_DYN(VIRTQ_USED_T, aRing[pVirtq->uQueueSize]),
+                          &uAvailEventIdx, sizeof(uAvailEventIdx));
+}
+#endif
+/** @} */
+
+
+DECLINLINE(uint16_t) virtioCoreVirtqAvailCnt(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTQUEUE pVirtq)
+{
+    uint16_t uIdxActual = virtioReadAvailRingIdx(pDevIns, pVirtio, pVirtq);
+    uint16_t uIdxShadow = pVirtq->uAvailIdxShadow;
+    uint16_t uIdxDelta;
+
+    if (uIdxActual < uIdxShadow)
+        uIdxDelta = (uIdxActual + pVirtq->uQueueSize) - uIdxShadow;
+    else
+        uIdxDelta = uIdxActual - uIdxShadow;
+
+    return uIdxDelta;
+}
+/**
+ * Get count of new (e.g. pending) elements in available ring.
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtq      Virtq number
+ *
+ * @returns how many entries have been added to ring as a delta of the consumer's
+ *          avail index and the queue's guest-side current avail index.
+ */
+uint16_t virtioCoreVirtqAvailBufCount(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq)
+{
+    AssertMsgReturn(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues), ("uVirtq out of range"), 0);
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    if (!IS_DRIVER_OK(pVirtio))
+    {
+        LogRelFunc(("Driver not ready\n"));
+        return 0;
+    }
+    if (!pVirtio->fLegacyDriver && !pVirtq->uEnable)
+    {
+        LogRelFunc(("virtq: %s not enabled\n", VIRTQNAME(pVirtio, uVirtq)));
+        return 0;
+    }
+    return virtioCoreVirtqAvailCnt(pDevIns, pVirtio, pVirtq);
+}
+
+#ifdef IN_RING3
+
+void virtioCoreR3FeatureDump(VIRTIOCORE *pVirtio, PCDBGFINFOHLP pHlp, const VIRTIO_FEATURES_LIST *s_aFeatures, int cFeatures, int fBanner)
+{
+#define MAXLINE 80
+    /* Display as a single buf to prevent interceding log messages */
+    uint16_t cbBuf = cFeatures * 132;
+    char *pszBuf = (char *)RTMemAllocZ(cbBuf);
+    Assert(pszBuf);
+    char *cp = pszBuf;
+    for (int i = 0; i < cFeatures; ++i)
+    {
+        bool isOffered    = RT_BOOL(pVirtio->uDeviceFeatures & s_aFeatures[i].fFeatureBit);
+        bool isNegotiated = RT_BOOL(pVirtio->uDriverFeatures & s_aFeatures[i].fFeatureBit);
+        cp += RTStrPrintf(cp, cbBuf - (cp - pszBuf), "        %s       %s   %s",
+                          isOffered ? "+" : "-", isNegotiated ? "x" : " ", s_aFeatures[i].pcszDesc);
+    }
+    if (pHlp) {
+        if (fBanner)
+            pHlp->pfnPrintf(pHlp, "VirtIO Features Configuration\n\n"
+                  "    Offered  Accepted  Feature              Description\n"
+                  "    -------  --------  -------              -----------\n");
+        pHlp->pfnPrintf(pHlp, "%s\n", pszBuf);
+    }
+#ifdef LOG_ENABLED
+    else
+    {
+        if (fBanner)
+            Log(("VirtIO Features Configuration\n\n"
+                  "    Offered  Accepted  Feature              Description\n"
+                  "    -------  --------  -------              -----------\n"));
+        Log(("%s\n", pszBuf));
+    }
+#endif
+    RTMemFree(pszBuf);
+}
+
+/** API Function: See header file*/
+void  virtioCorePrintDeviceFeatures(VIRTIOCORE *pVirtio, PCDBGFINFOHLP pHlp,
+    const VIRTIO_FEATURES_LIST *s_aDevSpecificFeatures, int cFeatures) {
+    virtioCoreR3FeatureDump(pVirtio, pHlp, s_aCoreFeatures, RT_ELEMENTS(s_aCoreFeatures), 1 /*fBanner */);
+    virtioCoreR3FeatureDump(pVirtio, pHlp, s_aDevSpecificFeatures, cFeatures, 0 /*fBanner */);
+}
+
+#endif
+
+#ifdef LOG_ENABLED
+
+/** API Function: See header file */
+void virtioCoreHexDump(uint8_t *pv, uint32_t cb, uint32_t uBase, const char *pszTitle)
+{
+#define ADJCURSOR(cb) pszOut += cb; cbRemain -= cb;
+    size_t cbPrint = 0, cbRemain = ((cb / 16) + 1) * 80;
+    char *pszBuf = (char *)RTMemAllocZ(cbRemain), *pszOut = pszBuf;
+    AssertMsgReturnVoid(pszBuf, ("Out of Memory"));
+    if (pszTitle)
+    {
+        cbPrint = RTStrPrintf(pszOut, cbRemain, "%s [%d bytes]:\n", pszTitle, cb);
+        ADJCURSOR(cbPrint);
+    }
+    for (uint32_t row = 0; row < RT_MAX(1, (cb / 16) + 1) && row * 16 < cb; row++)
+    {
+        cbPrint = RTStrPrintf(pszOut, cbRemain, "%04x: ", row * 16 + uBase); /* line address */
+        ADJCURSOR(cbPrint);
+        for (uint8_t col = 0; col < 16; col++)
+        {
+           uint32_t idx = row * 16 + col;
+           if (idx >= cb)
+               cbPrint = RTStrPrintf(pszOut, cbRemain, "-- %s", (col + 1) % 8 ? "" : "  ");
+           else
+               cbPrint = RTStrPrintf(pszOut, cbRemain, "%02x %s", pv[idx], (col + 1) % 8 ? "" : "  ");
+            ADJCURSOR(cbPrint);
+        }
+        for (uint32_t idx = row * 16; idx < row * 16 + 16; idx++)
+        {
+           cbPrint = RTStrPrintf(pszOut, cbRemain, "%c", (idx >= cb) ? ' ' : (pv[idx] >= 0x20 && pv[idx] <= 0x7e ? pv[idx] : '.'));
+           ADJCURSOR(cbPrint);
+        }
+        *pszOut++ = '\n';
+        --cbRemain;
+    }
+    Log(("%s\n", pszBuf));
+    RTMemFree(pszBuf);
+    RT_NOREF2(uBase, pv);
+#undef ADJCURSOR
+}
+
+/* API FUnction: See header file */
+void virtioCoreGCPhysHexDump(PPDMDEVINS pDevIns, RTGCPHYS GCPhys, uint16_t cb, uint32_t uBase, const char *pszTitle)
+{
+    PVIRTIOCORE pVirtio = PDMDEVINS_2_DATA(pDevIns, PVIRTIOCORE);
+#define ADJCURSOR(cb) pszOut += cb; cbRemain -= cb;
+    size_t cbPrint = 0, cbRemain = ((cb / 16) + 1) * 80;
+    char *pszBuf = (char *)RTMemAllocZ(cbRemain), *pszOut = pszBuf;
+    AssertMsgReturnVoid(pszBuf, ("Out of Memory"));
+    if (pszTitle)
+    {
+        cbPrint = RTStrPrintf(pszOut, cbRemain, "%s [%d bytes]:\n", pszTitle, cb);
+        ADJCURSOR(cbPrint);
+    }
+    for (uint16_t row = 0; row < (uint16_t)RT_MAX(1, (cb / 16) + 1) && row * 16 < cb; row++)
+    {
+        uint8_t c;
+        cbPrint = RTStrPrintf(pszOut, cbRemain, "%04x: ", row * 16 + uBase); /* line address */
+        ADJCURSOR(cbPrint);
+        for (uint8_t col = 0; col < 16; col++)
+        {
+           uint32_t idx = row * 16 + col;
+           virtioCoreGCPhysRead(pVirtio, pDevIns, GCPhys + idx, &c, 1);
+           if (idx >= cb)
+               cbPrint = RTStrPrintf(pszOut, cbRemain, "-- %s", (col + 1) % 8 ? "" : "  ");
+           else
+               cbPrint = RTStrPrintf(pszOut, cbRemain, "%02x %s", c, (col + 1) % 8 ? "" : "  ");
+           ADJCURSOR(cbPrint);
+        }
+        for (uint16_t idx = row * 16; idx < row * 16 + 16; idx++)
+        {
+           virtioCoreGCPhysRead(pVirtio, pDevIns, GCPhys + idx, &c, 1);
+           cbPrint = RTStrPrintf(pszOut, cbRemain, "%c", (idx >= cb) ? ' ' : (c >= 0x20 && c <= 0x7e ? c : '.'));
+           ADJCURSOR(cbPrint);
+        }
+        *pszOut++ = '\n';
+        --cbRemain;
+     }
+    Log(("%s\n", pszBuf));
+    RTMemFree(pszBuf);
+    RT_NOREF(uBase);
+#undef ADJCURSOR
+}
+
+
+/** API function: See header file */
+void virtioCoreLogMappedIoValue(const char *pszFunc, const char *pszMember, uint32_t uMemberSize,
+                                const void *pv, uint32_t cb, uint32_t uOffset, int fWrite,
+                                int fHasIndex, uint32_t idx)
+{
+    if (LogIs6Enabled())
+    {
+        char szIdx[16];
+        if (fHasIndex)
+            RTStrPrintf(szIdx, sizeof(szIdx), "[%d]", idx);
+        else
+            szIdx[0] = '\0';
+
+        if (cb == 1 || cb == 2 || cb == 4 || cb == 8)
+        {
+            char szDepiction[64];
+            size_t cchDepiction;
+            if (uOffset != 0 || cb != uMemberSize) /* display bounds if partial member access */
+                cchDepiction = RTStrPrintf(szDepiction, sizeof(szDepiction), "%s%s[%d:%d]",
+                                           pszMember, szIdx, uOffset, uOffset + cb - 1);
+            else
+                cchDepiction = RTStrPrintf(szDepiction, sizeof(szDepiction), "%s%s", pszMember, szIdx);
+
+            /* padding */
+            if (cchDepiction < 30)
+                szDepiction[cchDepiction++] = ' ';
+            while (cchDepiction < 30)
+                szDepiction[cchDepiction++] = '.';
+            szDepiction[cchDepiction] = '\0';
+
+            RTUINT64U uValue;
+            uValue.u = 0;
+            memcpy(uValue.au8, pv, cb);
+            Log6(("%-23s: Guest %s %s %#0*RX64\n",
+                      pszFunc, fWrite ? "wrote" : "read ", szDepiction, 2 + cb * 2, uValue.u));
+        }
+        else /* odd number or oversized access, ... log inline hex-dump style */
+        {
+            Log6(("%-23s: Guest %s %s%s[%d:%d]: %.*Rhxs\n",
+                      pszFunc, fWrite ? "wrote" : "read ", pszMember,
+                      szIdx, uOffset, uOffset + cb, cb, pv));
+        }
+    }
+    RT_NOREF2(fWrite, pszFunc);
+}
+
+/**
+ * Log MMIO-mapped Virtio fDeviceStatus register bitmask, naming the bits
+ */
+DECLINLINE(void) virtioCoreFormatDeviceStatus(uint8_t bStatus, char *pszBuf, size_t uSize)
+{
+#   define ADJCURSOR(len) { cp += len; uSize -= len; sep = (char *)" | "; }
+    memset(pszBuf, 0, uSize);
+    char *cp = pszBuf, *sep = (char *)"";
+    size_t len;
+    if (bStatus == 0)
+        RTStrPrintf(cp, uSize, "RESET");
+    else
+    {
+        if (bStatus & VIRTIO_STATUS_ACKNOWLEDGE)
+        {
+            len = RTStrPrintf(cp, uSize, "ACKNOWLEDGE");
+            ADJCURSOR(len);
+        }
+        if (bStatus & VIRTIO_STATUS_DRIVER)
+        {
+            len = RTStrPrintf(cp, uSize, "%sDRIVER", sep);
+            ADJCURSOR(len);
+        }
+        if (bStatus & VIRTIO_STATUS_FEATURES_OK)
+        {
+            len = RTStrPrintf(cp, uSize, "%sFEATURES_OK", sep);
+            ADJCURSOR(len);
+        }
+        if (bStatus & VIRTIO_STATUS_DRIVER_OK)
+        {
+            len = RTStrPrintf(cp, uSize, "%sDRIVER_OK", sep);
+            ADJCURSOR(len);
+        }
+        if (bStatus & VIRTIO_STATUS_FAILED)
+        {
+            len = RTStrPrintf(cp, uSize, "%sFAILED", sep);
+            ADJCURSOR(len);
+        }
+        if (bStatus & VIRTIO_STATUS_DEVICE_NEEDS_RESET)
+            RTStrPrintf(cp, uSize, "%sNEEDS_RESET", sep);
+    }
+#   undef ADJCURSOR
+}
+
+#endif /* LOG_ENABLED */
+
+/** API function: See header file */
+int virtioCoreIsLegacyMode(PVIRTIOCORE pVirtio)
+{
+    return pVirtio->fLegacyDriver;
+}
+
+#ifdef IN_RING3
+
+int virtioCoreR3VirtqAttach(PVIRTIOCORE pVirtio, uint16_t uVirtq, const char *pcszName)
+{
+    LogFunc(("Attaching %s to VirtIO core\n", pcszName));
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+    pVirtq->uVirtq = uVirtq;
+    pVirtq->fUsedRingEvent = false;
+    pVirtq->fAttached = true;
+    RTStrCopy(pVirtq->szName, sizeof(pVirtq->szName), pcszName);
+    return VINF_SUCCESS;
+}
+
+int virtioCoreR3VirtqDetach(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr)
+{
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtqNbr];
+    pVirtq->uVirtq          = 0;
+    pVirtq->uAvailIdxShadow = 0;
+    pVirtq->uUsedIdxShadow  = 0;
+    pVirtq->fUsedRingEvent  = false;
+    pVirtq->fAttached       = false;
+    memset(pVirtq->szName, 0, sizeof(pVirtq->szName));
+    return VINF_SUCCESS;
+}
+
+bool virtioCoreR3VirtqIsAttached(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr)
+{
+    return pVirtio->aVirtqueues[uVirtqNbr].fAttached;
+}
+
+bool virtioCoreR3VirtqIsEnabled(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr)
+{
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtqNbr];
+    return (bool)pVirtq->uEnable && pVirtq->GCPhysVirtqDesc;
+}
+
+/** API Fuunction: See header file */
+void virtioCoreR3VirtqInfo(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs, int uVirtq)
+{
+    RT_NOREF(pszArgs);
+    PVIRTIOCORE pVirtio = PDMDEVINS_2_DATA(pDevIns, PVIRTIOCORE);
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    /** @todo add ability to dump physical contents described by any descriptor (using existing VirtIO core API function) */
+//  bool fDump      = pszArgs && (*pszArgs == 'd' || *pszArgs == 'D'); /* "dump" (avail phys descriptor)"
+
+    uint16_t uAvailIdx       = virtioReadAvailRingIdx(pDevIns, pVirtio, pVirtq);
+    uint16_t uAvailIdxShadow = pVirtq->uAvailIdxShadow;
+
+    uint16_t uUsedIdx        = virtioReadUsedRingIdx(pDevIns, pVirtio, pVirtq);
+    uint16_t uUsedIdxShadow  = pVirtq->uUsedIdxShadow;
+
+#ifdef VIRTIO_VBUF_ON_STACK
+    VIRTQBUF_T VirtqBuf;
+    PVIRTQBUF pVirtqBuf = &VirtqBuf;
+#else /* !VIRTIO_VBUF_ON_STACK */
+    PVIRTQBUF pVirtqBuf = NULL;
+#endif /* !VIRTIO_VBUF_ON_STACK */
+
+    bool fEmpty = IS_VIRTQ_EMPTY(pDevIns, pVirtio, pVirtq);
+
+    LogFunc(("%s, empty = %s\n", pVirtq->szName, fEmpty ? "true" : "false"));
+
+    int cSendSegs = 0, cReturnSegs = 0;
+    if (!fEmpty)
+    {
+#ifdef VIRTIO_VBUF_ON_STACK
+        virtioCoreR3VirtqAvailBufPeek(pDevIns,  pVirtio, uVirtq, pVirtqBuf);
+#else /* !VIRTIO_VBUF_ON_STACK */
+        virtioCoreR3VirtqAvailBufPeek(pDevIns,  pVirtio, uVirtq, &pVirtqBuf);
+#endif /* !VIRTIO_VBUF_ON_STACK */
+        cSendSegs   = pVirtqBuf->pSgPhysSend ? pVirtqBuf->pSgPhysSend->cSegs : 0;
+        cReturnSegs = pVirtqBuf->pSgPhysReturn ? pVirtqBuf->pSgPhysReturn->cSegs : 0;
+    }
+
+    bool fAvailNoInterrupt   = virtioReadAvailRingFlags(pDevIns, pVirtio, pVirtq) & VIRTQ_AVAIL_F_NO_INTERRUPT;
+    bool fUsedNoNotify       = virtioReadUsedRingFlags(pDevIns, pVirtio, pVirtq) & VIRTQ_USED_F_NO_NOTIFY;
+
+    pHlp->pfnPrintf(pHlp, "       queue enabled: ........... %s\n", pVirtq->uEnable ? "true" : "false");
+    pHlp->pfnPrintf(pHlp, "       size: .................... %d\n", pVirtq->uQueueSize);
+    pHlp->pfnPrintf(pHlp, "       notify offset: ........... %d\n", pVirtq->uNotifyOffset);
+    if (pVirtio->fMsiSupport)
+        pHlp->pfnPrintf(pHlp, "       MSIX vector: ....... %4.4x\n", pVirtq->uMsixVector);
+    pHlp->pfnPrintf(pHlp, "\n");
+    pHlp->pfnPrintf(pHlp, "       avail ring (%d entries):\n", uAvailIdx - uAvailIdxShadow);
+    pHlp->pfnPrintf(pHlp, "          index: ................ %d\n", uAvailIdx);
+    pHlp->pfnPrintf(pHlp, "          shadow: ............... %d\n", uAvailIdxShadow);
+    pHlp->pfnPrintf(pHlp, "          flags: ................ %s\n", fAvailNoInterrupt ? "NO_INTERRUPT" : "");
+    pHlp->pfnPrintf(pHlp, "\n");
+    pHlp->pfnPrintf(pHlp, "       used ring (%d entries):\n",  uUsedIdx - uUsedIdxShadow);
+    pHlp->pfnPrintf(pHlp, "          index: ................ %d\n", uUsedIdx);
+    pHlp->pfnPrintf(pHlp, "          shadow: ............... %d\n", uUsedIdxShadow);
+    pHlp->pfnPrintf(pHlp, "          flags: ................ %s\n", fUsedNoNotify ? "NO_NOTIFY" : "");
+    pHlp->pfnPrintf(pHlp, "\n");
+    if (!fEmpty)
+    {
+        pHlp->pfnPrintf(pHlp, "       desc chain:\n");
+        pHlp->pfnPrintf(pHlp, "          head idx: ............. %d\n", uUsedIdx);
+        pHlp->pfnPrintf(pHlp, "          segs: ................. %d\n", cSendSegs + cReturnSegs);
+        pHlp->pfnPrintf(pHlp, "          refCnt ................ %d\n", pVirtqBuf->cRefs);
+        pHlp->pfnPrintf(pHlp, "\n");
+        pHlp->pfnPrintf(pHlp, "          host-to-guest (%d bytes):\n",      pVirtqBuf->cbPhysSend);
+        pHlp->pfnPrintf(pHlp,     "             segs: .............. %d\n", cSendSegs);
+        if (cSendSegs)
+        {
+            pHlp->pfnPrintf(pHlp, "             index: ............. %d\n", pVirtqBuf->pSgPhysSend->idxSeg);
+            pHlp->pfnPrintf(pHlp, "             unsent ............. %d\n", pVirtqBuf->pSgPhysSend->cbSegLeft);
+        }
+        pHlp->pfnPrintf(pHlp, "\n");
+        pHlp->pfnPrintf(pHlp,     "      guest-to-host (%d bytes)\n",       pVirtqBuf->cbPhysReturn);
+        pHlp->pfnPrintf(pHlp,     "             segs: .............. %d\n", cReturnSegs);
+        if (cReturnSegs)
+        {
+            pHlp->pfnPrintf(pHlp, "             index: ............. %d\n", pVirtqBuf->pSgPhysReturn->idxSeg);
+            pHlp->pfnPrintf(pHlp, "             unsent ............. %d\n", pVirtqBuf->pSgPhysReturn->cbSegLeft);
+        }
+    } else
+        pHlp->pfnPrintf(pHlp,     "      No desc chains available\n");
+    pHlp->pfnPrintf(pHlp, "\n");
+}
+
+#ifdef VIRTIO_VBUF_ON_STACK
+/** API Function: See header file */
+PVIRTQBUF virtioCoreR3VirtqBufAlloc(void)
+{
+    PVIRTQBUF pVirtqBuf = (PVIRTQBUF)RTMemAllocZ(sizeof(VIRTQBUF_T));
+    AssertReturn(pVirtqBuf, NULL);
+    pVirtqBuf->u32Magic  = VIRTQBUF_MAGIC;
+    pVirtqBuf->cRefs     = 1;
+    return pVirtqBuf;
+}
+#endif /* VIRTIO_VBUF_ON_STACK */
+
+/** API Function: See header file */
+uint32_t virtioCoreR3VirtqBufRetain(PVIRTQBUF pVirtqBuf)
+{
+    AssertReturn(pVirtqBuf, UINT32_MAX);
+    AssertReturn(pVirtqBuf->u32Magic == VIRTQBUF_MAGIC, UINT32_MAX);
+    uint32_t cRefs = ASMAtomicIncU32(&pVirtqBuf->cRefs);
+    Assert(cRefs > 1);
+    Assert(cRefs < 16);
+    return cRefs;
+}
+
+/** API Function: See header file */
+uint32_t virtioCoreR3VirtqBufRelease(PVIRTIOCORE pVirtio, PVIRTQBUF pVirtqBuf)
+{
+    if (!pVirtqBuf)
+        return 0;
+    AssertReturn(pVirtqBuf, 0);
+    AssertReturn(pVirtqBuf->u32Magic == VIRTQBUF_MAGIC, 0);
+    uint32_t cRefs = ASMAtomicDecU32(&pVirtqBuf->cRefs);
+    Assert(cRefs < 16);
+    if (cRefs == 0)
+    {
+        pVirtqBuf->u32Magic = ~VIRTQBUF_MAGIC;
+        RTMemFree(pVirtqBuf);
+#ifdef VBOX_WITH_STATISTICS
+        STAM_REL_COUNTER_INC(&pVirtio->StatDescChainsFreed);
+#endif
+    }
+    RT_NOREF(pVirtio);
+    return cRefs;
+}
+
+/** API Function: See header file */
+void virtioCoreNotifyConfigChanged(PVIRTIOCORE pVirtio)
+{
+    virtioNudgeGuest(pVirtio->pDevInsR3, pVirtio, VIRTIO_ISR_DEVICE_CONFIG, pVirtio->uMsixConfig);
+}
+
+
+/** API Function: See header file */
+void virtioCoreVirtqEnableNotify(PVIRTIOCORE pVirtio, uint16_t uVirtq, bool fEnable)
+{
+    Assert(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues));
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    if (IS_DRIVER_OK(pVirtio))
+    {
+        uint16_t fFlags = virtioReadUsedRingFlags(pVirtio->pDevInsR3, pVirtio, pVirtq);
+
+        if (fEnable)
+            fFlags &= ~VIRTQ_USED_F_NO_NOTIFY;
+        else
+            fFlags |= VIRTQ_USED_F_NO_NOTIFY;
+
+        virtioWriteUsedRingFlags(pVirtio->pDevInsR3, pVirtio, pVirtq, fFlags);
+    }
+}
+
+/** API function: See Header file  */
+void virtioCoreResetAll(PVIRTIOCORE pVirtio)
+{
+    LogFunc(("\n"));
+    pVirtio->fDeviceStatus |= VIRTIO_STATUS_DEVICE_NEEDS_RESET;
+    if (IS_DRIVER_OK(pVirtio))
+    {
+        if (!pVirtio->fLegacyDriver)
+            pVirtio->fGenUpdatePending = true;
+        virtioNudgeGuest(pVirtio->pDevInsR3, pVirtio, VIRTIO_ISR_DEVICE_CONFIG, pVirtio->uMsixConfig);
+    }
+}
+
+/** API function: See Header file  */
+#ifdef VIRTIO_VBUF_ON_STACK
+int virtioCoreR3VirtqAvailBufPeek(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq, PVIRTQBUF pVirtqBuf)
+{
+    return virtioCoreR3VirtqAvailBufGet(pDevIns, pVirtio, uVirtq, pVirtqBuf, false);
+}
+#else /* !VIRTIO_VBUF_ON_STACK */
+int virtioCoreR3VirtqAvailBufPeek(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq,
+                         PPVIRTQBUF ppVirtqBuf)
+{
+    return virtioCoreR3VirtqAvailBufGet(pDevIns, pVirtio, uVirtq, ppVirtqBuf, false);
+}
+#endif /* !VIRTIO_VBUF_ON_STACK */
+
+/** API function: See Header file  */
+int virtioCoreR3VirtqAvailBufNext(PVIRTIOCORE pVirtio, uint16_t uVirtq)
+{
+    Assert(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues));
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    if (!pVirtio->fLegacyDriver)
+        AssertMsgReturn((pVirtio->fDeviceStatus & VIRTIO_STATUS_DRIVER_OK) && pVirtq->uEnable,
+            ("Guest driver not in ready state.\n"), VERR_INVALID_STATE);
+
+    if (IS_VIRTQ_EMPTY(pVirtio->pDevInsR3, pVirtio, pVirtq))
+        return VERR_NOT_AVAILABLE;
+
+    Log6Func(("%s avail shadow idx: %u\n", pVirtq->szName, pVirtq->uAvailIdxShadow));
+    pVirtq->uAvailIdxShadow++;
+
+    return VINF_SUCCESS;
+}
+
+/** API Function: See header file */
+#ifdef VIRTIO_VBUF_ON_STACK
+int virtioCoreR3VirtqAvailBufGet(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq,
+                                 uint16_t uHeadIdx, PVIRTQBUF pVirtqBuf)
+#else /* !VIRTIO_VBUF_ON_STACK */
+int virtioCoreR3VirtqAvailBufGet(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq,
+                             uint16_t uHeadIdx, PPVIRTQBUF ppVirtqBuf)
+#endif /* !VIRTIO_VBUF_ON_STACK */
+{
+#ifndef VIRTIO_VBUF_ON_STACK
+    AssertReturn(ppVirtqBuf, VERR_INVALID_POINTER);
+    *ppVirtqBuf = NULL;
+#endif /* !VIRTIO_VBUF_ON_STACK */
+
+    AssertMsgReturn(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues),
+                        ("uVirtq out of range"), VERR_INVALID_PARAMETER);
+
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    if (!pVirtio->fLegacyDriver)
+        AssertMsgReturn((pVirtio->fDeviceStatus & VIRTIO_STATUS_DRIVER_OK) && pVirtq->uEnable,
+            ("Guest driver not in ready state.\n"), VERR_INVALID_STATE);
+
+    uint16_t uDescIdx = uHeadIdx;
+
+    Log6Func(("%s DESC CHAIN: (head idx = %u)\n", pVirtio->aVirtqueues[uVirtq].szName, uHeadIdx));
+
+    /*
+     * Allocate and initialize the descriptor chain structure.
+     */
+#ifndef VIRTIO_VBUF_ON_STACK
+    PVIRTQBUF pVirtqBuf = (PVIRTQBUF)RTMemAllocZ(sizeof(VIRTQBUF_T));
+    AssertReturn(pVirtqBuf, VERR_NO_MEMORY);
+#endif /* !VIRTIO_VBUF_ON_STACK */
+    pVirtqBuf->u32Magic  = VIRTQBUF_MAGIC;
+    pVirtqBuf->cRefs     = 1;
+    pVirtqBuf->uHeadIdx  = uHeadIdx;
+    pVirtqBuf->uVirtq    = uVirtq;
+#ifndef VIRTIO_VBUF_ON_STACK
+    *ppVirtqBuf          = pVirtqBuf;
+#endif /* !VIRTIO_VBUF_ON_STACK */
+
+    /*
+     * Gather segments.
+     */
+    VIRTQ_DESC_T desc;
+
+    uint32_t cbIn     = 0;
+    uint32_t cbOut    = 0;
+    uint32_t cSegsIn  = 0;
+    uint32_t cSegsOut = 0;
+
+    PVIRTIOSGSEG paSegsIn  = pVirtqBuf->aSegsIn;
+    PVIRTIOSGSEG paSegsOut = pVirtqBuf->aSegsOut;
+
+    do
+    {
+        PVIRTIOSGSEG pSeg;
+        /*
+         * Malicious guests may go beyond paSegsIn or paSegsOut boundaries by linking
+         * several descriptors into a loop. Since there is no legitimate way to get a sequences of
+         * linked descriptors exceeding the total number of descriptors in the ring (see @bugref{8620}),
+         * the following aborts I/O if breach and employs a simple log throttling algorithm to notify.
+         */
+        if (cSegsIn + cSegsOut >= pVirtq->uQueueSize)
+        {
+            static volatile uint32_t s_cMessages  = 0;
+            static volatile uint32_t s_cThreshold = 1;
+            if (ASMAtomicIncU32(&s_cMessages) == ASMAtomicReadU32(&s_cThreshold))
+            {
+                LogRelMax(64, ("Too many linked descriptors; check if the guest arranges descriptors in a loop (cSegsIn=%u cSegsOut=%u uQueueSize=%u).\n",
+                               cSegsIn, cSegsOut, pVirtq->uQueueSize));
+                if (ASMAtomicReadU32(&s_cMessages) != 1)
+                    LogRelMax(64, ("(the above error has occured %u times so far)\n", ASMAtomicReadU32(&s_cMessages)));
+                ASMAtomicWriteU32(&s_cThreshold, ASMAtomicReadU32(&s_cThreshold) * 10);
+            }
+            break;
+        }
+        RT_UNTRUSTED_VALIDATED_FENCE();
+
+        virtioReadDesc(pDevIns, pVirtio, pVirtq, uDescIdx, &desc);
+
+        if (desc.fFlags & VIRTQ_DESC_F_WRITE)
+        {
+            Log6Func(("%s IN  idx=%-4u seg=%-3u addr=%RGp cb=%u\n", pVirtq->szName, uDescIdx, cSegsIn, desc.GCPhysBuf, desc.cb));
+            cbIn += desc.cb;
+            pSeg = &paSegsIn[cSegsIn++];
+        }
+        else
+        {
+            Log6Func(("%s OUT desc_idx=%-4u seg=%-3u addr=%RGp cb=%u\n", pVirtq->szName, uDescIdx, cSegsOut, desc.GCPhysBuf, desc.cb));
+            cbOut += desc.cb;
+            pSeg = &paSegsOut[cSegsOut++];
+#ifdef DEEP_DEBUG
+            if (LogIs11Enabled())
+            {
+                virtioCoreGCPhysHexDump(pDevIns, desc.GCPhysBuf, desc.cb, 0, NULL);
+                Log(("\n"));
+            }
+#endif
+        }
+        pSeg->GCPhys = desc.GCPhysBuf;
+        pSeg->cbSeg = desc.cb;
+        uDescIdx = desc.uDescIdxNext;
+    } while (desc.fFlags & VIRTQ_DESC_F_NEXT);
+
+    /*
+     * Add segments to the descriptor chain structure.
+     */
+    if (cSegsIn)
+    {
+        virtioCoreGCPhysChainInit(&pVirtqBuf->SgBufIn, paSegsIn, cSegsIn);
+        pVirtqBuf->pSgPhysReturn = &pVirtqBuf->SgBufIn;
+        pVirtqBuf->cbPhysReturn  = cbIn;
+#ifdef VBOX_WITH_STATISTICS
+        STAM_REL_COUNTER_ADD(&pVirtio->StatDescChainsSegsIn, cSegsIn);
+#endif
+    }
+
+    if (cSegsOut)
+    {
+        virtioCoreGCPhysChainInit(&pVirtqBuf->SgBufOut, paSegsOut, cSegsOut);
+        pVirtqBuf->pSgPhysSend   = &pVirtqBuf->SgBufOut;
+        pVirtqBuf->cbPhysSend    = cbOut;
+#ifdef VBOX_WITH_STATISTICS
+        STAM_REL_COUNTER_ADD(&pVirtio->StatDescChainsSegsOut, cSegsOut);
+#endif
+    }
+
+#ifdef VBOX_WITH_STATISTICS
+    STAM_REL_COUNTER_INC(&pVirtio->StatDescChainsAllocated);
+#endif
+    Log6Func(("%s -- segs OUT: %u (%u bytes)   IN: %u (%u bytes) --\n",
+        pVirtq->szName, cSegsOut, cbOut, cSegsIn, cbIn));
+
+    return VINF_SUCCESS;
+}
+
+/** API function: See Header file  */
+#ifdef VIRTIO_VBUF_ON_STACK
+int virtioCoreR3VirtqAvailBufGet(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq,
+                                 PVIRTQBUF pVirtqBuf, bool fRemove)
+#else /* !VIRTIO_VBUF_ON_STACK */
+int virtioCoreR3VirtqAvailBufGet(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq,
+                         PPVIRTQBUF ppVirtqBuf, bool fRemove)
+#endif /* !VIRTIO_VBUF_ON_STACK */
+{
+    Assert(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues));
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    if (IS_VIRTQ_EMPTY(pDevIns, pVirtio, pVirtq))
+        return VERR_NOT_AVAILABLE;
+
+    uint16_t uHeadIdx = virtioReadAvailDescIdx(pDevIns, pVirtio, pVirtq, pVirtq->uAvailIdxShadow);
+
+    if (pVirtio->uDriverFeatures & VIRTIO_F_EVENT_IDX)
+        virtioWriteUsedAvailEvent(pDevIns,pVirtio, pVirtq, pVirtq->uAvailIdxShadow + 1);
+
+    if (fRemove)
+        pVirtq->uAvailIdxShadow++;
+
+#ifdef VIRTIO_VBUF_ON_STACK
+    int rc = virtioCoreR3VirtqAvailBufGet(pDevIns, pVirtio, uVirtq, uHeadIdx, pVirtqBuf);
+#else /* !VIRTIO_VBUF_ON_STACK */
+    int rc = virtioCoreR3VirtqAvailBufGet(pDevIns, pVirtio, uVirtq, uHeadIdx, ppVirtqBuf);
+#endif /* !VIRTIO_VBUF_ON_STACK */
+    return rc;
+}
+
+/** API function: See Header file  */
+int virtioCoreR3VirtqUsedBufPut(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq, PRTSGBUF pSgVirtReturn,
+                            PVIRTQBUF pVirtqBuf, bool fFence)
+{
+    Assert(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues));
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    PVIRTIOSGBUF pSgPhysReturn = pVirtqBuf->pSgPhysReturn;
+
+    Assert(pVirtqBuf->u32Magic == VIRTQBUF_MAGIC);
+    Assert(pVirtqBuf->cRefs > 0);
+
+    /*
+     * Workaround for a bug in FreeBSD's virtio-net driver up until 12.3 which supports only the legacy style devive.
+     * When the device is re-initialized from the driver it violates the spec and posts commands to the control queue
+     * before setting the DRIVER_OK flag, breaking the following check and rendering the device non-functional.
+     * The queues are properly set up at this stage however so no real harm is done and we can safely continue here,
+     * for the legacy device only of course after making sure the queue is properly set up.
+     */
+    AssertMsgReturn(   IS_DRIVER_OK(pVirtio)
+                    || (   pVirtio->fLegacyDriver
+                        && pVirtq->GCPhysVirtqDesc),
+                    ("Guest driver not in ready state.\n"), VERR_INVALID_STATE);
+
+    Log6Func(("    Copying device data to %s, [desc:%u -> used ring:%u]\n",
+              VIRTQNAME(pVirtio, uVirtq), pVirtqBuf->uHeadIdx, pVirtq->uUsedIdxShadow));
+
+    /* Copy s/g buf (virtual memory) to guest phys mem (VirtIO "IN" direction). */
+
+    size_t cbCopy = 0, cbTotal = 0, cbRemain = 0;
+
+    if (pSgVirtReturn)
+    {
+        size_t cbTarget = virtioCoreGCPhysChainCalcBufSize(pSgPhysReturn);
+        cbRemain = cbTotal = RTSgBufCalcTotalLength(pSgVirtReturn);
+        AssertMsgReturn(cbTarget >= cbRemain, ("No space to write data to phys memory"), VERR_BUFFER_OVERFLOW);
+        virtioCoreGCPhysChainReset(pSgPhysReturn);
+        while (cbRemain)
+        {
+            cbCopy = RT_MIN(pSgVirtReturn->cbSegLeft,  pSgPhysReturn->cbSegLeft);
+            AssertReturn(cbCopy > 0, VERR_INVALID_PARAMETER);
+            virtioCoreGCPhysWrite(pVirtio, pDevIns, (RTGCPHYS)pSgPhysReturn->GCPhysCur, pSgVirtReturn->pvSegCur, cbCopy);
+            RTSgBufAdvance(pSgVirtReturn, cbCopy);
+            virtioCoreGCPhysChainAdvance(pSgPhysReturn, cbCopy);
+            cbRemain -= cbCopy;
+        }
+
+        if (fFence)
+            RT_UNTRUSTED_NONVOLATILE_COPY_FENCE(); /* needed? */
+
+        Assert(!(cbCopy >> 32));
+    }
+
+    /* Flag if write-ahead crosses threshold where guest driver indicated it wants event notification */
+    if (pVirtio->uDriverFeatures & VIRTIO_F_EVENT_IDX)
+        if (pVirtq->uUsedIdxShadow == virtioReadAvailUsedEvent(pDevIns, pVirtio, pVirtq))
+            pVirtq->fUsedRingEvent = true;
+
+    /*
+     * Place used buffer's descriptor in used ring but don't update used ring's slot index.
+     * That will be done with a subsequent client call to virtioCoreVirtqUsedRingSync()
+     */
+    virtioWriteUsedElem(pDevIns, pVirtio, pVirtq, pVirtq->uUsedIdxShadow++, pVirtqBuf->uHeadIdx, (uint32_t)cbTotal);
+
+#ifdef LOG_ENABLED
+    if (LogIs6Enabled() && pSgVirtReturn)
+    {
+
+        LogFunc(("     ... %d segs, %zu bytes, copied to %u byte buf@offset=%u. Residual: %zu bytes\n",
+             pSgVirtReturn->cSegs,  cbTotal - cbRemain,  pVirtqBuf->cbPhysReturn,
+              ((virtioCoreGCPhysChainCalcBufSize(pVirtqBuf->pSgPhysReturn) -
+                virtioCoreGCPhysChainCalcLengthLeft(pVirtqBuf->pSgPhysReturn)) - (cbTotal - cbRemain)),
+                virtioCoreGCPhysChainCalcLengthLeft(pVirtqBuf->pSgPhysReturn) ));
+
+        uint16_t uPending = virtioCoreR3CountPendingBufs(
+                                virtioReadUsedRingIdx(pDevIns, pVirtio, pVirtq),
+                                pVirtq->uUsedIdxShadow, pVirtq->uQueueSize);
+
+        LogFunc(("    %u used buf%s not synced in %s\n", uPending, uPending == 1 ? "" : "s ",
+                    VIRTQNAME(pVirtio, uVirtq)));
+    }
+#endif
+    return VINF_SUCCESS;
+}
+
+/** API function: See Header file  */
+int virtioCoreR3VirtqUsedBufPut(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq,
+                                size_t cb, void const *pv, PVIRTQBUF pVirtqBuf, size_t cbEnqueue, bool fFence)
+{
+    Assert(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues));
+    Assert(pv);
+
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+    PVIRTIOSGBUF pSgPhysReturn = pVirtqBuf->pSgPhysReturn;
+
+    Assert(pVirtqBuf->u32Magic == VIRTQBUF_MAGIC);
+    Assert(pVirtqBuf->cRefs > 0);
+
+    AssertMsgReturn(IS_DRIVER_OK(pVirtio), ("Guest driver not in ready state.\n"), VERR_INVALID_STATE);
+
+    Log6Func(("    Copying device data to %s, [desc chain head idx:%u]\n",
+              VIRTQNAME(pVirtio, uVirtq), pVirtqBuf->uHeadIdx));
+    /*
+     * Convert virtual memory simple buffer to guest physical memory (VirtIO descriptor chain)
+     */
+    uint8_t *pvBuf = (uint8_t *)pv;
+    size_t cbRemain = cb, cbCopy = 0;
+    while (cbRemain)
+    {
+        cbCopy = RT_MIN(pSgPhysReturn->cbSegLeft, cbRemain);
+        Assert(cbCopy > 0);
+        virtioCoreGCPhysWrite(pVirtio, pDevIns, (RTGCPHYS)pSgPhysReturn->GCPhysCur, pvBuf, cbCopy);
+        virtioCoreGCPhysChainAdvance(pSgPhysReturn, cbCopy);
+        pvBuf += cbCopy;
+        cbRemain -= cbCopy;
+    }
+    LogFunc(("     ...%zu bytes, copied to %u byte buf@offset=%u. Residual: %zu bytes\n",
+              cb ,  pVirtqBuf->cbPhysReturn,
+              ((virtioCoreGCPhysChainCalcBufSize(pVirtqBuf->pSgPhysReturn) -
+                 virtioCoreGCPhysChainCalcLengthLeft(pVirtqBuf->pSgPhysReturn)) - cb),
+                 virtioCoreGCPhysChainCalcLengthLeft(pVirtqBuf->pSgPhysReturn)));
+
+    if (cbEnqueue)
+    {
+        if (fFence)
+        {
+            RT_UNTRUSTED_NONVOLATILE_COPY_FENCE(); /* needed? */
+            Assert(!(cbCopy >> 32));
+        }
+        /* Flag if write-ahead crosses threshold where guest driver indicated it wants event notification */
+        if (pVirtio->uDriverFeatures & VIRTIO_F_EVENT_IDX)
+            if (pVirtq->uUsedIdxShadow == virtioReadAvailUsedEvent(pDevIns, pVirtio, pVirtq))
+                pVirtq->fUsedRingEvent = true;
+        /*
+         * Place used buffer's descriptor in used ring but don't update used ring's slot index.
+         * That will be done with a subsequent client call to virtioCoreVirtqUsedRingSync()
+         */
+        Log6Func(("    Enqueue desc chain head idx %u to %s used ring @ %u\n", pVirtqBuf->uHeadIdx,
+                VIRTQNAME(pVirtio, uVirtq), pVirtq->uUsedIdxShadow));
+
+        virtioWriteUsedElem(pDevIns, pVirtio, pVirtq, pVirtq->uUsedIdxShadow++, pVirtqBuf->uHeadIdx, (uint32_t)cbEnqueue);
+
+#ifdef LOG_ENABLED
+        if (LogIs6Enabled())
+        {
+            uint16_t uPending = virtioCoreR3CountPendingBufs(
+                                    virtioReadUsedRingIdx(pDevIns, pVirtio, pVirtq),
+                                    pVirtq->uUsedIdxShadow, pVirtq->uQueueSize);
+
+            LogFunc(("    %u used buf%s not synced in %s\n",
+                    uPending, uPending == 1 ? "" : "s ", VIRTQNAME(pVirtio, uVirtq)));
+        }
+#endif
+    } /* fEnqueue */
+
+    return VINF_SUCCESS;
+}
+
+
+#endif /* IN_RING3 */
+
+/** API function: See Header file  */
+int virtioCoreVirtqUsedRingSync(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq)
+{
+    Assert(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues));
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    if (!pVirtio->fLegacyDriver)
+        AssertMsgReturn((pVirtio->fDeviceStatus & VIRTIO_STATUS_DRIVER_OK) && pVirtq->uEnable,
+            ("Guest driver not in ready state.\n"), VERR_INVALID_STATE);
+
+    Log6Func(("    Sync %s used ring (%u -> idx)\n",
+                        pVirtq->szName, pVirtq->uUsedIdxShadow));
+
+    virtioWriteUsedRingIdx(pDevIns, pVirtio, pVirtq, pVirtq->uUsedIdxShadow);
+    virtioCoreNotifyGuestDriver(pDevIns, pVirtio, uVirtq);
+
+    return VINF_SUCCESS;
+}
+
+/**
+ * This is called from the MMIO callback code when the guest does an MMIO access to the
+ * mapped queue notification capability area corresponding to a particular queue, to notify
+ * the queue handler of available data in the avail ring of the queue (VirtIO 1.0, 4.1.4.4.1)
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtq      Virtq to check for guest interrupt handling preference
+ * @param   uNotifyIdx  Notification index
+ */
+static void virtioCoreVirtqNotified(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq, uint16_t uNotifyIdx)
+{
+    PVIRTIOCORECC pVirtioCC = PDMINS_2_DATA_CC(pDevIns, PVIRTIOCORECC);
+
+    /* VirtIO 1.0, section 4.1.5.2 implies uVirtq and uNotifyIdx should match. Disregarding any of
+     * these notifications (if those indicies disagree) may break device/driver synchronization,
+     * causing eternal throughput starvation, yet there's no specified way to disambiguate
+     * which queue to wake-up in any awkward situation where the two parameters differ.
+     */
+    AssertMsg(uNotifyIdx == uVirtq,
+              ("Guest kicked virtq %d's notify addr w/non-corresponding virtq idx %d\n",
+              uVirtq, uNotifyIdx));
+    RT_NOREF(uNotifyIdx);
+
+    AssertReturnVoid(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues));
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    Log6Func(("%s: (desc chains: %u)\n", *pVirtq->szName ? pVirtq->szName : "?UNAMED QUEUE?",
+        virtioCoreVirtqAvailCnt(pDevIns, pVirtio, pVirtq)));
+
+    /* Inform client */
+    pVirtioCC->pfnVirtqNotified(pDevIns, pVirtio, uVirtq);
+    RT_NOREF2(pVirtio, pVirtq);
+}
+
+/**
+ * Trigger MSI-X or INT# interrupt to notify guest of data added to used ring of
+ * the specified virtq, depending on the interrupt configuration of the device
+ * and depending on negotiated and realtime constraints flagged by the guest driver.
+ *
+ * See VirtIO 1.0 specification (section 2.4.7).
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtq      Virtq to check for guest interrupt handling preference
+ */
+static void virtioCoreNotifyGuestDriver(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq)
+{
+    Assert(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues));
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    if (!IS_DRIVER_OK(pVirtio))
+    {
+        LogFunc(("Guest driver not in ready state.\n"));
+        return;
+    }
+
+    if (pVirtio->uDriverFeatures & VIRTIO_F_EVENT_IDX)
+    {
+        if (pVirtq->fUsedRingEvent)
+        {
+#ifdef IN_RING3
+            Log6Func(("...kicking guest %s, VIRTIO_F_EVENT_IDX set and threshold (%d) reached\n",
+                   pVirtq->szName, (uint16_t)virtioReadAvailUsedEvent(pDevIns, pVirtio, pVirtq)));
+#endif
+            virtioNudgeGuest(pDevIns, pVirtio, VIRTIO_ISR_VIRTQ_INTERRUPT, pVirtq->uMsixVector);
+            pVirtq->fUsedRingEvent = false;
+            return;
+        }
+#ifdef IN_RING3
+        Log6Func(("...skip interrupt %s, VIRTIO_F_EVENT_IDX set but threshold (%d) not reached (%d)\n",
+                   pVirtq->szName,(uint16_t)virtioReadAvailUsedEvent(pDevIns, pVirtio, pVirtq), pVirtq->uUsedIdxShadow));
+#endif
+    }
+    else
+    {
+        /** If guest driver hasn't suppressed interrupts, interrupt  */
+        if (!(virtioReadAvailRingFlags(pDevIns, pVirtio, pVirtq) & VIRTQ_AVAIL_F_NO_INTERRUPT))
+        {
+            virtioNudgeGuest(pDevIns, pVirtio, VIRTIO_ISR_VIRTQ_INTERRUPT, pVirtq->uMsixVector);
+            return;
+        }
+        Log6Func(("...skipping interrupt for %s (guest set VIRTQ_AVAIL_F_NO_INTERRUPT)\n", pVirtq->szName));
+    }
+}
+
+/**
+ * Raise interrupt or MSI-X
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uCause      Interrupt cause bit mask to set in PCI ISR port.
+ * @param   uVec        MSI-X vector, if enabled
+ */
+static int virtioNudgeGuest(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint8_t uCause, uint16_t uMsixVector)
+{
+    if (uCause == VIRTIO_ISR_VIRTQ_INTERRUPT)
+        Log6Func(("Reason for interrupt - buffer added to 'used' ring.\n"));
+    else
+    if (uCause == VIRTIO_ISR_DEVICE_CONFIG)
+       Log6Func(("Reason for interrupt - device config change\n"));
+
+    if (!pVirtio->fMsiSupport)
+    {
+        pVirtio->uISR |= uCause;
+        PDMDevHlpPCISetIrq(pDevIns, 0, PDM_IRQ_LEVEL_HIGH);
+    }
+    else if (uMsixVector != VIRTIO_MSI_NO_VECTOR)
+        PDMDevHlpPCISetIrq(pDevIns, uMsixVector, 1);
+    return VINF_SUCCESS;
+}
+
+/**
+ * Lower interrupt (Called when guest reads ISR and when resetting)
+ *
+ * @param   pDevIns     The device instance.
+ */
+static void virtioLowerInterrupt(PPDMDEVINS pDevIns, uint16_t uMsixVector)
+{
+    PVIRTIOCORE pVirtio = PDMINS_2_DATA(pDevIns, PVIRTIOCORE);
+    if (!pVirtio->fMsiSupport)
+        PDMDevHlpPCISetIrq(pDevIns, 0, PDM_IRQ_LEVEL_LOW);
+    else if (uMsixVector != VIRTIO_MSI_NO_VECTOR)
+        PDMDevHlpPCISetIrq(pDevIns, pVirtio->uMsixConfig, PDM_IRQ_LEVEL_LOW);
+}
+
+#ifdef IN_RING3
+static void virtioResetVirtq(PVIRTIOCORE pVirtio, uint16_t uVirtq)
+{
+    Assert(uVirtq < RT_ELEMENTS(pVirtio->aVirtqueues));
+    PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+    pVirtq->uQueueSize       = VIRTQ_SIZE;
+    pVirtq->uEnable          = false;
+    pVirtq->uNotifyOffset    = uVirtq;
+    pVirtq->fUsedRingEvent   = false;
+    pVirtq->uAvailIdxShadow  = 0;
+    pVirtq->uUsedIdxShadow   = 0;
+    pVirtq->uMsixVector      = uVirtq + 2;
+
+    if (!pVirtio->fMsiSupport) /* VirtIO 1.0, 4.1.4.3 and 4.1.5.1.2 */
+        pVirtq->uMsixVector = VIRTIO_MSI_NO_VECTOR;
+
+    virtioLowerInterrupt(pVirtio->pDevInsR3, pVirtq->uMsixVector);
+}
+
+static void virtioResetDevice(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio)
+{
+    LogFunc(("Resetting device VirtIO state\n"));
+    pVirtio->fLegacyDriver          = pVirtio->fOfferLegacy;   /* Cleared if VIRTIO_F_VERSION_1 feature ack'd */
+    pVirtio->uDeviceFeaturesSelect  = 0;
+    pVirtio->uDriverFeaturesSelect  = 0;
+    pVirtio->uConfigGeneration      = 0;
+    pVirtio->fDeviceStatus          = 0;
+    pVirtio->uISR                   = 0;
+
+    if (!pVirtio->fMsiSupport)
+        virtioLowerInterrupt(pDevIns, 0);
+    else
+    {
+        virtioLowerInterrupt(pDevIns, pVirtio->uMsixConfig);
+        for (int i = 0; i < VIRTQ_MAX_COUNT; i++)
+            virtioLowerInterrupt(pDevIns, pVirtio->aVirtqueues[i].uMsixVector);
+    }
+
+    if (!pVirtio->fMsiSupport)  /* VirtIO 1.0, 4.1.4.3 and 4.1.5.1.2 */
+        pVirtio->uMsixConfig = VIRTIO_MSI_NO_VECTOR;
+
+    for (uint16_t uVirtq = 0; uVirtq < VIRTQ_MAX_COUNT; uVirtq++)
+        virtioResetVirtq(pVirtio, uVirtq);
+}
+
+/**
+ * Invoked by this implementation when guest driver resets the device.
+ * The driver itself will not until the device has read the status change.
+ */
+static void virtioGuestR3WasReset(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTIOCORECC pVirtioCC)
+{
+    Log(("%-23s: Guest reset the device\n", __FUNCTION__));
+
+    /* Let the client know */
+    pVirtioCC->pfnStatusChanged(pVirtio, pVirtioCC, 0 /* fDriverOk */);
+    virtioResetDevice(pDevIns, pVirtio);
+}
+
+DECLHIDDEN(void) virtioCoreR3ResetDevice(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTIOCORECC pVirtioCC)
+{
+    virtioGuestR3WasReset(pDevIns, pVirtio, pVirtioCC);
+}
+#endif /* IN_RING3 */
+
+/*
+ * Determines whether guest virtio driver is modern or legacy and does callback
+ * informing device-specific code that feature negotiation is complete.
+ * Should be called only once (coordinated via the 'toggle' flag)
+ */
+#ifdef IN_RING3
+DECLINLINE(void) virtioR3DoFeaturesCompleteOnceOnly(PVIRTIOCORE pVirtio, PVIRTIOCORECC pVirtioCC)
+{
+        if (pVirtio->uDriverFeatures & VIRTIO_F_VERSION_1)
+        {
+            LogFunc(("VIRTIO_F_VERSION_1 feature ack'd by guest\n"));
+            pVirtio->fLegacyDriver = 0;
+        }
+        else
+        {
+            if (pVirtio->fOfferLegacy)
+            {
+                pVirtio->fLegacyDriver = 1;
+                LogFunc(("VIRTIO_F_VERSION_1 feature was NOT set by guest\n"));
+            }
+            else
+                AssertMsgFailed(("Guest didn't accept VIRTIO_F_VERSION_1, but fLegacyOffered flag not set.\n"));
+        }
+        if (pVirtioCC->pfnFeatureNegotiationComplete)
+            pVirtioCC->pfnFeatureNegotiationComplete(pVirtio, pVirtio->uDriverFeatures, pVirtio->fLegacyDriver);
+        pVirtio->fDriverFeaturesWritten |= DRIVER_FEATURES_COMPLETE_HANDLED;
+}
+#endif
+
+/**
+ * Handle accesses to Common Configuration capability
+ *
+ * @returns VBox status code
+ *
+ * @param   pDevIns          The device instance.
+ * @param   pVirtio          Pointer to the shared virtio state.
+ * @param   pVirtioCC        Pointer to the current context virtio state.
+ * @param   fWrite           Set if write access, clear if read access.
+ * @param   uOffsetOfAccess  The common configuration capability offset.
+ * @param   cb               Number of bytes to read or write
+ * @param   pv               Pointer to location to write to or read from
+ */
+static int virtioCommonCfgAccessed(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTIOCORECC pVirtioCC,
+                                   int fWrite, uint32_t uOffsetOfAccess, unsigned cb, void *pv)
+{
+    uint16_t uVirtq = pVirtio->uVirtqSelect;
+    int rc = VINF_SUCCESS;
+    uint64_t val;
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(uDeviceFeatures, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+    {
+        if (fWrite) /* Guest WRITE pCommonCfg>uDeviceFeatures */
+        {
+            /* VirtIO 1.0, 4.1.4.3 states device_feature is a (guest) driver readonly field,
+             * yet the linux driver attempts to write/read it back twice */
+            VIRTIO_DEV_CONFIG_LOG_ACCESS(uDeviceFeatures, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess);
+            LogFunc(("... WARNING: Guest attempted to write readonly virtio_pci_common_cfg.device_feature (ignoring)\n"));
+            return VINF_IOM_MMIO_UNUSED_00;
+        }
+        else /* Guest READ pCommonCfg->uDeviceFeatures */
+        {
+            switch (pVirtio->uDeviceFeaturesSelect)
+            {
+                case 0:
+                    val = pVirtio->uDeviceFeatures & UINT32_C(0xffffffff);
+                    memcpy(pv, &val, cb);
+                    VIRTIO_DEV_CONFIG_LOG_ACCESS(uDeviceFeatures, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess);
+                    break;
+                case 1:
+                    val = pVirtio->uDeviceFeatures >> 32;
+                    memcpy(pv, &val, cb);
+                    VIRTIO_DEV_CONFIG_LOG_ACCESS(uDeviceFeatures, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess + sizeof(uint32_t));
+                    break;
+                default:
+                    LogFunc(("Guest read uDeviceFeatures with out of range selector (%#x), returning 0\n",
+                             pVirtio->uDeviceFeaturesSelect));
+                    return VINF_IOM_MMIO_UNUSED_00;
+            }
+        }
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(uDriverFeatures, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+    {
+        if (fWrite) /* Guest WRITE pCommonCfg->udriverFeatures */
+        {
+            switch (pVirtio->uDriverFeaturesSelect)
+            {
+                case 0:
+                    memcpy(&pVirtio->uDriverFeatures, pv, cb);
+                    pVirtio->fDriverFeaturesWritten |= DRIVER_FEATURES_0_WRITTEN;
+            LogFunc(("Set DRIVER_FEATURES_0_WRITTEN. pVirtio->fDriverFeaturesWritten=%d\n", pVirtio->fDriverFeaturesWritten));
+                    if (     (pVirtio->fDriverFeaturesWritten & DRIVER_FEATURES_0_AND_1_WRITTEN) == DRIVER_FEATURES_0_AND_1_WRITTEN
+                        && !(pVirtio->fDriverFeaturesWritten & DRIVER_FEATURES_COMPLETE_HANDLED))
+#ifdef IN_RING0
+                        return VINF_IOM_R3_MMIO_WRITE;
+#endif
+#ifdef IN_RING3
+                        virtioR3DoFeaturesCompleteOnceOnly(pVirtio, pVirtioCC);
+#endif
+                    VIRTIO_DEV_CONFIG_LOG_ACCESS(uDriverFeatures, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess);
+                    break;
+                case 1:
+                    memcpy((char *)&pVirtio->uDriverFeatures + sizeof(uint32_t), pv, cb);
+                    pVirtio->fDriverFeaturesWritten |= DRIVER_FEATURES_1_WRITTEN;
+            LogFunc(("Set DRIVER_FEATURES_1_WRITTEN. pVirtio->fDriverFeaturesWritten=%d\n", pVirtio->fDriverFeaturesWritten));
+                    if (     (pVirtio->fDriverFeaturesWritten & DRIVER_FEATURES_0_AND_1_WRITTEN) == DRIVER_FEATURES_0_AND_1_WRITTEN
+                        && !(pVirtio->fDriverFeaturesWritten & DRIVER_FEATURES_COMPLETE_HANDLED))
+#ifdef IN_RING0
+                        return VINF_IOM_R3_MMIO_WRITE;
+#endif
+#ifdef IN_RING3
+                        virtioR3DoFeaturesCompleteOnceOnly(pVirtio, pVirtioCC);
+#endif
+                    VIRTIO_DEV_CONFIG_LOG_ACCESS(uDriverFeatures, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess + sizeof(uint32_t));
+                    break;
+                default:
+                    LogFunc(("Guest wrote uDriverFeatures with out of range selector (%#x), returning 0\n",
+                             pVirtio->uDriverFeaturesSelect));
+                    return VINF_SUCCESS;
+            }
+        }
+        else /* Guest READ pCommonCfg->udriverFeatures */
+        {
+            switch (pVirtio->uDriverFeaturesSelect)
+            {
+                case 0:
+                    val = pVirtio->uDriverFeatures & 0xffffffff;
+                    memcpy(pv, &val, cb);
+                    VIRTIO_DEV_CONFIG_LOG_ACCESS(uDriverFeatures, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess);
+                    break;
+                case 1:
+                    val = (pVirtio->uDriverFeatures >> 32) & 0xffffffff;
+                    memcpy(pv, &val, cb);
+                    VIRTIO_DEV_CONFIG_LOG_ACCESS(uDriverFeatures, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess + 4);
+                    break;
+                default:
+                    LogFunc(("Guest read uDriverFeatures with out of range selector (%#x), returning 0\n",
+                             pVirtio->uDriverFeaturesSelect));
+                    return VINF_IOM_MMIO_UNUSED_00;
+            }
+        }
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(uNumVirtqs, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+    {
+        if (fWrite)
+        {
+            Log2Func(("Guest attempted to write readonly virtio_pci_common_cfg.num_queues\n"));
+            return VINF_SUCCESS;
+        }
+        *(uint16_t *)pv = VIRTQ_MAX_COUNT;
+        VIRTIO_DEV_CONFIG_LOG_ACCESS(uNumVirtqs, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess);
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(fDeviceStatus, VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+    {
+        if (fWrite) /* Guest WRITE pCommonCfg->fDeviceStatus */
+        {
+            pVirtio->fDeviceStatus = *(uint8_t *)pv;
+            bool fDeviceReset = pVirtio->fDeviceStatus == 0;
+#ifdef LOG_ENABLED
+            if (LogIs7Enabled())
+            {
+                char szOut[80] = { 0 };
+                virtioCoreFormatDeviceStatus(pVirtio->fDeviceStatus, szOut, sizeof(szOut));
+                Log(("%-23s: Guest wrote fDeviceStatus ................ (%s)\n", __FUNCTION__, szOut));
+            }
+#endif
+            bool const fStatusChanged = IS_DRIVER_OK(pVirtio) != WAS_DRIVER_OK(pVirtio);
+
+            if (fDeviceReset || fStatusChanged)
+            {
+#ifdef IN_RING0
+                /* Since VirtIO status changes are cumbersome by nature, e.g. not a benchmark priority,
+                 * handle the rest in R3 to facilitate logging or whatever dev-specific client needs to do */
+                Log6(("%-23s: RING0 => RING3 (demote)\n", __FUNCTION__));
+                return VINF_IOM_R3_MMIO_WRITE;
+#endif
+            }
+
+#ifdef IN_RING3
+            /*
+             * Notify client only if status actually changed from last time and when we're reset.
+             */
+            if (fDeviceReset)
+                virtioGuestR3WasReset(pDevIns, pVirtio, pVirtioCC);
+
+            if (fStatusChanged)
+                pVirtioCC->pfnStatusChanged(pVirtio, pVirtioCC, IS_DRIVER_OK(pVirtio));
+#endif
+            /*
+             * Save the current status for the next write so we can see what changed.
+             */
+            pVirtio->fPrevDeviceStatus = pVirtio->fDeviceStatus;
+        }
+        else /* Guest READ pCommonCfg->fDeviceStatus */
+        {
+            *(uint8_t *)pv = pVirtio->fDeviceStatus;
+#ifdef LOG_ENABLED
+            if (LogIs7Enabled())
+            {
+                char szOut[80] = { 0 };
+                virtioCoreFormatDeviceStatus(pVirtio->fDeviceStatus, szOut, sizeof(szOut));
+                LogFunc(("Guest read  fDeviceStatus ................ (%s)\n", szOut));
+            }
+#endif
+        }
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uMsixConfig,                VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS(         uMsixConfig,                VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uDeviceFeaturesSelect,      VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS(         uDeviceFeaturesSelect,      VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uDriverFeaturesSelect,      VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS(         uDriverFeaturesSelect,      VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uConfigGeneration,          VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS(         uConfigGeneration,          VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uVirtqSelect,               VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+    {
+        if (fWrite) {
+            uint16_t uVirtqNew = *(uint16_t *)pv;
+
+            if (uVirtqNew < RT_ELEMENTS(pVirtio->aVirtqueues))
+                VIRTIO_DEV_CONFIG_ACCESS( uVirtqSelect,               VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio);
+            else
+                LogFunc(("... WARNING: Guest attempted to write invalid virtq selector (ignoring)\n"));
+        }
+        else
+            VIRTIO_DEV_CONFIG_ACCESS(     uVirtqSelect,               VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio);
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   GCPhysVirtqDesc,            VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS_INDEXED( GCPhysVirtqDesc,   uVirtq,  VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio->aVirtqueues);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   GCPhysVirtqAvail,           VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS_INDEXED( GCPhysVirtqAvail,  uVirtq,  VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio->aVirtqueues);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   GCPhysVirtqUsed,            VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS_INDEXED( GCPhysVirtqUsed,   uVirtq,  VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio->aVirtqueues);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uQueueSize,                 VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS_INDEXED( uQueueSize,        uVirtq,  VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio->aVirtqueues);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uEnable,                    VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS_INDEXED( uEnable,           uVirtq,  VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio->aVirtqueues);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uNotifyOffset,              VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS_INDEXED( uNotifyOffset,     uVirtq,  VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio->aVirtqueues);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uMsixVector,                VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess))
+        VIRTIO_DEV_CONFIG_ACCESS_INDEXED( uMsixVector,       uVirtq,  VIRTIO_PCI_COMMON_CFG_T, uOffsetOfAccess, pVirtio->aVirtqueues);
+    else
+    {
+        Log2Func(("Bad guest %s access to virtio_pci_common_cfg: uOffsetOfAccess=%#x (%d), cb=%d\n",
+                  fWrite ? "write" : "read ", uOffsetOfAccess, uOffsetOfAccess, cb));
+        return fWrite ? VINF_SUCCESS : VINF_IOM_MMIO_UNUSED_00;
+    }
+
+#ifndef IN_RING3
+    RT_NOREF(pDevIns, pVirtioCC);
+#endif
+    return rc;
+}
+
+/**
+ * @callback_method_impl{FNIOMIOPORTNEWIN)
+ *
+ * This I/O handler exists only to handle access from legacy drivers.
+ */
+static DECLCALLBACK(VBOXSTRICTRC) virtioLegacyIOPortIn(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t *pu32, unsigned cb)
+{
+    PVIRTIOCORE   pVirtio = PDMINS_2_DATA(pDevIns, PVIRTIOCORE);
+    STAM_PROFILE_ADV_START(&pVirtio->CTX_SUFF(StatRead), a);
+
+    RT_NOREF(pvUser);
+    Log(("%-23s: Port read at offset=%RTiop, cb=%#x%s",
+        __FUNCTION__, offPort, cb,
+        VIRTIO_DEV_CONFIG_MATCH_MEMBER(fIsrStatus, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort) ? "" : "\n"));
+
+    void *pv = pu32; /* To use existing macros */
+    int fWrite = 0;  /* To use existing macros */
+
+    uint16_t uVirtq = pVirtio->uVirtqSelect;
+
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(uDeviceFeatures, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        uint32_t val = pVirtio->uDeviceFeatures & UINT32_C(0xffffffff);
+        memcpy(pu32, &val, cb);
+        VIRTIO_DEV_CONFIG_LOG_ACCESS(uDeviceFeatures,   VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort);
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(uDriverFeatures, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        uint32_t val = pVirtio->uDriverFeatures &  UINT32_C(0xffffffff);
+        memcpy(pu32, &val, cb);
+        VIRTIO_DEV_CONFIG_LOG_ACCESS(uDriverFeatures, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort);
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(fDeviceStatus, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        *(uint8_t *)pu32 = pVirtio->fDeviceStatus;
+#ifdef LOG_ENABLED
+        if (LogIs7Enabled())
+        {
+            char szOut[80] = { 0 };
+            virtioCoreFormatDeviceStatus(pVirtio->fDeviceStatus, szOut, sizeof(szOut));
+            Log(("%-23s: Guest read  fDeviceStatus ................ (%s)\n", __FUNCTION__, szOut));
+        }
+#endif
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(fIsrStatus, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        ASSERT_GUEST_MSG(cb == 1, ("%d\n", cb));
+        *(uint8_t *)pu32 = pVirtio->uISR;
+        pVirtio->uISR = 0;
+        virtioLowerInterrupt( pDevIns,  0);
+        Log((" (ISR read and cleared)\n"));
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uVirtqSelect,               VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+        VIRTIO_DEV_CONFIG_ACCESS(         uVirtqSelect,               VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort, pVirtio);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uVirtqPfn,                  VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        PVIRTQUEUE pVirtQueue = &pVirtio->aVirtqueues[uVirtq];
+        *pu32 = pVirtQueue->GCPhysVirtqDesc >> GUEST_PAGE_SHIFT;
+        Log(("%-23s: Guest read  uVirtqPfn .................... %#x\n",   __FUNCTION__, *pu32));
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uQueueSize,                 VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+        VIRTIO_DEV_CONFIG_ACCESS_INDEXED( uQueueSize,        uVirtq,  VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort, pVirtio->aVirtqueues);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uQueueNotify,               VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+        VIRTIO_DEV_CONFIG_ACCESS(         uQueueNotify,               VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort, pVirtio);
+#ifdef LEGACY_MSIX_SUPPORTED
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uMsixConfig,                VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+        VIRTIO_DEV_CONFIG_ACCESS(         uMsixConfig,                VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort, pVirtio);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uMsixVector,                VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+        VIRTIO_DEV_CONFIG_ACCESS_INDEXED( uMsixVector,       uVirtq,  VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort, pVirtio->aVirtqueues);
+#endif
+    else if (offPort >= sizeof(VIRTIO_LEGACY_PCI_COMMON_CFG_T))
+    {
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatRead), a);
+#ifdef IN_RING3
+        /* Access device-specific configuration */
+        PVIRTIOCORECC pVirtioCC = PDMINS_2_DATA_CC(pDevIns, PVIRTIOCORECC);
+        int rc = pVirtioCC->pfnDevCapRead(pDevIns, offPort - sizeof(VIRTIO_LEGACY_PCI_COMMON_CFG_T), pv, cb);
+        return rc;
+#else
+        return VINF_IOM_R3_IOPORT_READ;
+#endif
+    }
+    else
+    {
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatRead), a);
+        Log2Func(("Bad guest read access to virtio_legacy_pci_common_cfg: offset=%#x, cb=%x\n",
+                   offPort, cb));
+        int rc = PDMDevHlpDBGFStop(pDevIns, RT_SRC_POS,
+                    "virtioLegacyIOPortIn: no valid port at offset offset=%RTiop cb=%#x\n", offPort, cb);
+        return rc;
+    }
+    STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatRead), a);
+    return VINF_SUCCESS;
+}
+
+/**
+ * @callback_method_impl{ * @callback_method_impl{FNIOMIOPORTNEWOUT}
+ *
+ * This I/O Port interface exists only to handle access from legacy drivers.
+ */
+static DECLCALLBACK(VBOXSTRICTRC) virtioLegacyIOPortOut(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
+{
+    PVIRTIOCORE pVirtio = PDMINS_2_DATA(pDevIns, PVIRTIOCORE);
+    STAM_PROFILE_ADV_START(&pVirtio->CTX_SUFF(StatWrite), a);
+    RT_NOREF(pvUser);
+
+    uint16_t uVirtq = pVirtio->uVirtqSelect;
+    uint32_t u32OnStack = u32;  /* allows us to use this impl's MMIO parsing macros */
+    void *pv = &u32OnStack; /* To use existing macros */
+    int fWrite = 1;         /* To use existing macros */
+
+    Log(("%-23s: Port written at offset=%RTiop, cb=%#x, u32=%#x\n",  __FUNCTION__, offPort, cb, u32));
+
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uVirtqSelect,        VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        if (u32 < RT_ELEMENTS(pVirtio->aVirtqueues))
+            VIRTIO_DEV_CONFIG_ACCESS(     uVirtqSelect,        VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort, pVirtio);
+        else
+            LogFunc(("... WARNING: Guest attempted to write invalid virtq selector (ignoring)\n"));
+    }
+    else
+#ifdef LEGACY_MSIX_SUPPORTED
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uMsixConfig,         VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+        VIRTIO_DEV_CONFIG_ACCESS(         uMsixConfig,         VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort, pVirtio);
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(   uMsixVector,         VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+        VIRTIO_DEV_CONFIG_ACCESS_INDEXED( uMsixVector, uVirtq, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort, pVirtio->aVirtqueues);
+    else
+#endif
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(uDeviceFeatures,        VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        /* Check to see if guest acknowledged unsupported features */
+        VIRTIO_DEV_CONFIG_LOG_ACCESS(uDeviceFeatures,          VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort);
+        LogFunc(("... WARNING: Guest attempted to write readonly virtio_pci_common_cfg.device_feature (ignoring)\n"));
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+        return VINF_SUCCESS;
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(uDriverFeatures,        VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        memcpy(&pVirtio->uDriverFeatures, pv, cb);
+        if ((pVirtio->uDriverFeatures & ~VIRTIO_DEV_INDEPENDENT_LEGACY_FEATURES_OFFERED) == 0)
+        {
+                Log(("Guest asked for features host does not support! (host=%x guest=%x)\n",
+                      VIRTIO_DEV_INDEPENDENT_LEGACY_FEATURES_OFFERED, pVirtio->uDriverFeatures));
+                pVirtio->uDriverFeatures &= VIRTIO_DEV_INDEPENDENT_LEGACY_FEATURES_OFFERED;
+        }
+        if (!(pVirtio->fDriverFeaturesWritten & DRIVER_FEATURES_COMPLETE_HANDLED))
+        {
+#ifdef IN_RING0
+            Log6(("%-23s: RING0 => RING3 (demote)\n", __FUNCTION__));
+            return VINF_IOM_R3_IOPORT_WRITE;
+#endif
+#ifdef IN_RING3
+            PVIRTIOCORECC pVirtioCC = PDMINS_2_DATA_CC(pDevIns, PVIRTIOCORECC);
+            virtioR3DoFeaturesCompleteOnceOnly(pVirtio, pVirtioCC);
+#endif
+        }
+        VIRTIO_DEV_CONFIG_LOG_ACCESS(uDriverFeatures,          VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort);
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(uQueueSize,             VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        VIRTIO_DEV_CONFIG_LOG_ACCESS(uQueueSize,               VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort);
+        LogFunc(("... WARNING: Guest attempted to write readonly device_feature (queue size) (ignoring)\n"));
+        return VINF_SUCCESS;
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(fDeviceStatus,          VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        bool const fDriverInitiatedReset = (pVirtio->fDeviceStatus = (uint8_t)u32) == 0;
+        bool const fDriverStateImproved = IS_DRIVER_OK(pVirtio) && !WAS_DRIVER_OK(pVirtio);
+#ifdef LOG_ENABLED
+        if (LogIs7Enabled())
+        {
+            char szOut[80] = { 0 };
+            virtioCoreFormatDeviceStatus(pVirtio->fDeviceStatus, szOut, sizeof(szOut));
+            Log(("%-23s: Guest wrote fDeviceStatus ................ (%s)\n", __FUNCTION__, szOut));
+        }
+#endif
+        if (fDriverStateImproved  || fDriverInitiatedReset)
+        {
+#ifdef IN_RING0
+            Log6(("%-23s: RING0 => RING3 (demote)\n", __FUNCTION__));
+            STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+            return VINF_IOM_R3_IOPORT_WRITE;
+#endif
+        }
+
+#ifdef IN_RING3
+        PVIRTIOCORECC pVirtioCC = PDMINS_2_DATA_CC(pDevIns, PVIRTIOCORECC);
+        if (fDriverInitiatedReset)
+            virtioGuestR3WasReset(pDevIns, pVirtio, pVirtioCC);
+
+        else if (fDriverStateImproved)
+            pVirtioCC->pfnStatusChanged(pVirtio, pVirtioCC, 1 /* fDriverOk */);
+
+#endif
+        pVirtio->fPrevDeviceStatus = pVirtio->fDeviceStatus;
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(uVirtqPfn, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+        uint64_t uVirtqPfn = (uint64_t)u32;
+
+        if (uVirtqPfn)
+        {
+            /* Transitional devices calculate ring physical addresses using rigid spec-defined formulae,
+             * instead of guest conveying respective address of each ring, as "modern" VirtIO drivers do,
+             * thus there is no virtq PFN or single base queue address stored in instance data for
+             * this transitional device, but rather it is derived, when read back, from GCPhysVirtqDesc */
+
+            pVirtq->GCPhysVirtqDesc  = uVirtqPfn * VIRTIO_PAGE_SIZE;
+            pVirtq->GCPhysVirtqAvail = pVirtq->GCPhysVirtqDesc + sizeof(VIRTQ_DESC_T) * pVirtq->uQueueSize;
+            pVirtq->GCPhysVirtqUsed  =
+                RT_ALIGN(pVirtq->GCPhysVirtqAvail + RT_UOFFSETOF_DYN(VIRTQ_AVAIL_T, auRing[pVirtq->uQueueSize]), VIRTIO_PAGE_SIZE);
+        }
+        else
+        {
+            /* Don't set ring addresses for queue (to meaningless values), when guest resets the virtq's PFN */
+            pVirtq->GCPhysVirtqDesc  = 0;
+            pVirtq->GCPhysVirtqAvail = 0;
+            pVirtq->GCPhysVirtqUsed  = 0;
+        }
+        Log(("%-23s: Guest wrote uVirtqPfn .................... %#x:\n"
+             "%68s... %p -> GCPhysVirtqDesc\n%68s... %p -> GCPhysVirtqAvail\n%68s... %p -> GCPhysVirtqUsed\n",
+                __FUNCTION__, u32, " ", pVirtq->GCPhysVirtqDesc, " ", pVirtq->GCPhysVirtqAvail, " ", pVirtq->GCPhysVirtqUsed));
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(uQueueNotify, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+#ifdef IN_RING3
+        ASSERT_GUEST_MSG(cb == 2, ("cb=%u\n", cb));
+        pVirtio->uQueueNotify =  u32 & 0xFFFF;
+        if (uVirtq < VIRTQ_MAX_COUNT)
+        {
+            RT_UNTRUSTED_VALIDATED_FENCE();
+
+            /* Need to check that queue is configured. Legacy spec didn't have a queue enabled flag */
+            if (pVirtio->aVirtqueues[pVirtio->uQueueNotify].GCPhysVirtqDesc)
+                    virtioCoreVirtqNotified(pDevIns, pVirtio, pVirtio->uQueueNotify, pVirtio->uQueueNotify /* uNotifyIdx */);
+            else
+                Log(("The queue (#%d) being notified has not been initialized.\n", pVirtio->uQueueNotify));
+        }
+        else
+            Log(("Invalid queue number (%d)\n", pVirtio->uQueueNotify));
+#else
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+        return VINF_IOM_R3_IOPORT_WRITE;
+#endif
+    }
+    else
+    if (VIRTIO_DEV_CONFIG_MATCH_MEMBER(fIsrStatus, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort))
+    {
+        VIRTIO_DEV_CONFIG_LOG_ACCESS( fIsrStatus, VIRTIO_LEGACY_PCI_COMMON_CFG_T, offPort);
+        LogFunc(("... WARNING: Guest attempted to write readonly device_feature (ISR status) (ignoring)\n"));
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+        return VINF_SUCCESS;
+    }
+    else if (offPort >= sizeof(VIRTIO_LEGACY_PCI_COMMON_CFG_T))
+    {
+#ifdef IN_RING3
+
+        /* Access device-specific configuration */
+        PVIRTIOCORECC pVirtioCC = PDMINS_2_DATA_CC(pDevIns, PVIRTIOCORECC);
+        return pVirtioCC->pfnDevCapWrite(pDevIns, offPort - sizeof(VIRTIO_LEGACY_PCI_COMMON_CFG_T), pv, cb);
+#else
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+        return VINF_IOM_R3_IOPORT_WRITE;
+#endif
+    }
+    else
+    {
+        Log2Func(("Bad guest write access to virtio_legacy_pci_common_cfg: offset=%#x, cb=0x%x\n",
+                  offPort, cb));
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+        int rc = PDMDevHlpDBGFStop(pDevIns, RT_SRC_POS,
+                    "virtioLegacyIOPortOut: no valid port at offset offset=%RTiop cb=0x%#x\n", offPort, cb);
+        return rc;
+    }
+
+    RT_NOREF(uVirtq);
+    STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * @callback_method_impl{FNIOMMMIONEWREAD,
+ * Memory mapped I/O Handler for PCI Capabilities read operations.}
+ *
+ * This MMIO handler specifically supports the VIRTIO_PCI_CAP_PCI_CFG capability defined
+ * in the VirtIO 1.0 specification, section 4.1.4.7, and as such is restricted to reads
+ * of 1, 2 or 4 bytes, only.
+ *
+ */
+static DECLCALLBACK(VBOXSTRICTRC) virtioMmioRead(PPDMDEVINS pDevIns, void *pvUser, RTGCPHYS off, void *pv, unsigned cb)
+{
+    PVIRTIOCORE   pVirtio   = PDMINS_2_DATA(pDevIns, PVIRTIOCORE);
+    PVIRTIOCORECC pVirtioCC = PDMINS_2_DATA_CC(pDevIns, PVIRTIOCORECC);
+    AssertReturn(cb == 1 || cb == 2 || cb == 4, VERR_INVALID_PARAMETER);
+    Assert(pVirtio == (PVIRTIOCORE)pvUser); RT_NOREF(pvUser);
+    STAM_PROFILE_ADV_START(&pVirtio->CTX_SUFF(StatRead), a);
+
+
+    uint32_t uOffset;
+    if (MATCHES_VIRTIO_CAP_STRUCT(off, cb, uOffset, pVirtio->LocDeviceCap))
+    {
+#ifdef IN_RING3
+        /*
+         * Callback to client to manage device-specific configuration.
+         */
+        VBOXSTRICTRC rcStrict = pVirtioCC->pfnDevCapRead(pDevIns, uOffset, pv, cb);
+
+        /*
+         * Anytime any part of the dev-specific dev config (which this virtio core implementation sees
+         * as a blob, and virtio dev-specific code separates into fields) is READ, it must be compared
+         * for deltas from previous read to maintain a config gen. seq. counter (VirtIO 1.0, section 4.1.4.3.1)
+         */
+        bool fDevSpecificFieldChanged = RT_BOOL(memcmp(pVirtioCC->pbDevSpecificCfg + uOffset,
+                                                 pVirtioCC->pbPrevDevSpecificCfg + uOffset,
+                                                 RT_MIN(cb, pVirtioCC->cbDevSpecificCfg - uOffset)));
+
+        memcpy(pVirtioCC->pbPrevDevSpecificCfg, pVirtioCC->pbDevSpecificCfg, pVirtioCC->cbDevSpecificCfg);
+
+        if (pVirtio->fGenUpdatePending || fDevSpecificFieldChanged)
+        {
+            ++pVirtio->uConfigGeneration;
+            Log6Func(("Bumped cfg. generation to %d because %s%s\n", pVirtio->uConfigGeneration,
+                      fDevSpecificFieldChanged ? "<dev cfg changed> " : "",
+                      pVirtio->fGenUpdatePending ? "<update was pending>" : ""));
+            pVirtio->fGenUpdatePending = false;
+        }
+
+        virtioLowerInterrupt(pDevIns, 0);
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatRead), a);
+        return rcStrict;
+#else
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatRead), a);
+        return VINF_IOM_R3_MMIO_READ;
+#endif
+    }
+
+    if (MATCHES_VIRTIO_CAP_STRUCT(off, cb, uOffset, pVirtio->LocCommonCfgCap))
+        return virtioCommonCfgAccessed(pDevIns, pVirtio, pVirtioCC, false /* fWrite */, uOffset, cb, pv);
+
+    if (MATCHES_VIRTIO_CAP_STRUCT(off, cb, uOffset, pVirtio->LocIsrCap))
+    {
+        *(uint8_t *)pv = pVirtio->uISR;
+        Log6Func(("Read and clear ISR\n"));
+        pVirtio->uISR = 0; /* VirtIO spec requires reads of ISR to clear it */
+        virtioLowerInterrupt(pDevIns, 0);
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatRead), a);
+        return VINF_SUCCESS;
+    }
+
+    ASSERT_GUEST_MSG_FAILED(("Bad read access to mapped capabilities region: off=%RGp cb=%u\n", off, cb));
+    STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatRead), a);
+    int rc = PDMDevHlpDBGFStop(pDevIns, RT_SRC_POS,
+                "virtioMmioRead: Bad MMIO access to capabilities, offset=%RTiop cb=%08x\n", off, cb);
+    return rc;
+}
+
+/**
+ * @callback_method_impl{FNIOMMMIONEWREAD,
+ * Memory mapped I/O Handler for PCI Capabilities write operations.}
+ *
+ * This MMIO handler specifically supports the VIRTIO_PCI_CAP_PCI_CFG capability defined
+ * in the VirtIO 1.0 specification, section 4.1.4.7, and as such is restricted to writes
+ * of 1, 2 or 4 bytes, only.
+ */
+static DECLCALLBACK(VBOXSTRICTRC) virtioMmioWrite(PPDMDEVINS pDevIns, void *pvUser, RTGCPHYS off, void const *pv, unsigned cb)
+{
+    PVIRTIOCORE   pVirtio   = PDMINS_2_DATA(pDevIns, PVIRTIOCORE);
+    PVIRTIOCORECC pVirtioCC = PDMINS_2_DATA_CC(pDevIns, PVIRTIOCORECC);
+    AssertReturn(cb == 1 || cb == 2 || cb == 4, VERR_INVALID_PARAMETER);
+    Assert(pVirtio == (PVIRTIOCORE)pvUser); RT_NOREF(pvUser);
+    STAM_PROFILE_ADV_START(&pVirtio->CTX_SUFF(StatWrite), a);
+
+    uint32_t uOffset;
+    if (MATCHES_VIRTIO_CAP_STRUCT(off, cb, uOffset, pVirtio->LocDeviceCap))
+    {
+#ifdef IN_RING3
+        /*
+         * Foreward this MMIO write access for client to deal with.
+         */
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+        return pVirtioCC->pfnDevCapWrite(pDevIns, uOffset, pv, cb);
+#else
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+        Log6(("%-23s: RING0 => RING3 (demote)\n", __FUNCTION__));
+        return VINF_IOM_R3_MMIO_WRITE;
+#endif
+    }
+
+    if (MATCHES_VIRTIO_CAP_STRUCT(off, cb, uOffset, pVirtio->LocCommonCfgCap))
+    {
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+        return virtioCommonCfgAccessed(pDevIns, pVirtio, pVirtioCC, true /* fWrite */, uOffset, cb, (void *)pv);
+    }
+
+    if (MATCHES_VIRTIO_CAP_STRUCT(off, cb, uOffset, pVirtio->LocIsrCap) && cb == sizeof(uint8_t))
+    {
+        pVirtio->uISR = *(uint8_t *)pv;
+        Log6Func(("Setting uISR = 0x%02x (virtq interrupt: %d, dev confg interrupt: %d)\n",
+                  pVirtio->uISR & 0xff,
+                  pVirtio->uISR & VIRTIO_ISR_VIRTQ_INTERRUPT,
+                  RT_BOOL(pVirtio->uISR & VIRTIO_ISR_DEVICE_CONFIG)));
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+        return VINF_SUCCESS;
+    }
+
+    /* This *should* be guest driver dropping index of a new descriptor in avail ring */
+    if (MATCHES_VIRTIO_CAP_STRUCT(off, cb, uOffset, pVirtio->LocNotifyCap) && cb == sizeof(uint16_t))
+    {
+        virtioCoreVirtqNotified(pDevIns, pVirtio, uOffset / VIRTIO_NOTIFY_OFFSET_MULTIPLIER, *(uint16_t *)pv);
+        STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+        return VINF_SUCCESS;
+    }
+
+    ASSERT_GUEST_MSG_FAILED(("Bad write access to mapped capabilities region: off=%RGp pv=%#p{%.*Rhxs} cb=%u\n", off, pv, cb, pv, cb));
+    STAM_PROFILE_ADV_STOP(&pVirtio->CTX_SUFF(StatWrite), a);
+    int rc = PDMDevHlpDBGFStop(pDevIns, RT_SRC_POS,
+                "virtioMmioRead: Bad MMIO access to capabilities, offset=%RTiop cb=%08x\n", off, cb);
+    return rc;
+}
+
+#ifdef IN_RING3
+
+/**
+ * @callback_method_impl{FNPCICONFIGREAD}
+ */
+static DECLCALLBACK(VBOXSTRICTRC) virtioR3PciConfigRead(PPDMDEVINS pDevIns, PPDMPCIDEV pPciDev,
+                                                        uint32_t uAddress, unsigned cb, uint32_t *pu32Value)
+{
+    PVIRTIOCORE   pVirtio   = PDMINS_2_DATA(pDevIns, PVIRTIOCORE);
+    PVIRTIOCORECC pVirtioCC = PDMINS_2_DATA_CC(pDevIns, PVIRTIOCORECC);
+    RT_NOREF(pPciDev);
+
+    if (uAddress == pVirtio->uPciCfgDataOff)
+    {
+     /* See comments in PCI Cfg capability initialization (in capabilities setup section of this code) */
+        struct virtio_pci_cap *pPciCap = &pVirtioCC->pPciCfgCap->pciCap;
+        uint32_t uLength = pPciCap->uLength;
+
+        Log7Func((" pDevIns=%p pPciDev=%p uAddress=%#x%s cb=%u uLength=%d, bar=%d\n",
+                     pDevIns, pPciDev, uAddress,  uAddress < 0x10 ? " " : "", cb, uLength, pPciCap->uBar));
+
+        if (  (uLength != 1 && uLength != 2 && uLength != 4)
+            || pPciCap->uBar != VIRTIO_REGION_PCI_CAP)
+        {
+            ASSERT_GUEST_MSG_FAILED(("Guest read virtio_pci_cfg_cap.pci_cfg_data using mismatching config. "
+                                     "Ignoring\n"));
+            *pu32Value = UINT32_MAX;
+            return VINF_SUCCESS;
+        }
+
+        VBOXSTRICTRC rcStrict = virtioMmioRead(pDevIns, pVirtio, pPciCap->uOffset, pu32Value, cb);
+        Log7Func((" Guest read virtio_pci_cfg_cap.pci_cfg_data, bar=%d, offset=%d, length=%d, result=0x%x -> %Rrc\n",
+                   pPciCap->uBar, pPciCap->uOffset, uLength, *pu32Value, VBOXSTRICTRC_VAL(rcStrict)));
+        return rcStrict;
+    }
+    Log7Func((" pDevIns=%p pPciDev=%p uAddress=%#x%s cb=%u pu32Value=%p\n",
+                 pDevIns, pPciDev, uAddress,  uAddress < 0x10 ? " " : "", cb, pu32Value));
+    return VINF_PDM_PCI_DO_DEFAULT;
+}
+
+/**
+ * @callback_method_impl{FNPCICONFIGWRITE}
+ */
+static DECLCALLBACK(VBOXSTRICTRC) virtioR3PciConfigWrite(PPDMDEVINS pDevIns, PPDMPCIDEV pPciDev,
+                                                         uint32_t uAddress, unsigned cb, uint32_t u32Value)
+{
+    PVIRTIOCORE   pVirtio   = PDMINS_2_DATA(pDevIns, PVIRTIOCORE);
+    PVIRTIOCORECC pVirtioCC = PDMINS_2_DATA_CC(pDevIns, PVIRTIOCORECC);
+    RT_NOREF(pPciDev);
+
+    Log7Func(("pDevIns=%p pPciDev=%p uAddress=%#x %scb=%u u32Value=%#x\n", pDevIns, pPciDev, uAddress, uAddress < 0xf ? " " : "", cb, u32Value));
+    if (uAddress == pVirtio->uPciCfgDataOff)
+    {
+        /* See comments in PCI Cfg capability initialization (in capabilities setup section of this code) */
+        struct virtio_pci_cap *pPciCap = &pVirtioCC->pPciCfgCap->pciCap;
+        uint32_t uLength = pPciCap->uLength;
+
+        if (   (uLength != 1 && uLength != 2 && uLength != 4)
+            || cb != uLength
+            ||  pPciCap->uBar != VIRTIO_REGION_PCI_CAP)
+        {
+            ASSERT_GUEST_MSG_FAILED(("Guest write virtio_pci_cfg_cap.pci_cfg_data using mismatching config. Ignoring\n"));
+            return VINF_SUCCESS;
+        }
+
+        VBOXSTRICTRC rcStrict = virtioMmioWrite(pDevIns, pVirtio, pPciCap->uOffset, &u32Value, cb);
+        Log2Func(("Guest wrote  virtio_pci_cfg_cap.pci_cfg_data, bar=%d, offset=%x, length=%x, value=%d -> %Rrc\n",
+                   pPciCap->uBar, pPciCap->uOffset, uLength, u32Value, VBOXSTRICTRC_VAL(rcStrict)));
+        return rcStrict;
+    }
+    return VINF_PDM_PCI_DO_DEFAULT;
+}
+
+
+/*********************************************************************************************************************************
+*   Saved state (SSM)                                                                                                            *
+*********************************************************************************************************************************/
+
+
+/**
+ * Loads a saved device state (called from device-specific code on SSM final pass)
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   pHlp        The ring-3 device helpers.
+ * @param   pSSM        The saved state handle.
+ * @returns VBox status code.
+ */
+int virtioCoreR3LegacyDeviceLoadExec(PVIRTIOCORE pVirtio, PCPDMDEVHLPR3 pHlp,
+                               PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uVirtioLegacy_3_1_Beta)
+{
+    int rc;
+    uint32_t uDriverFeaturesLegacy32bit;
+
+    rc = pHlp->pfnSSMGetU32(  pSSM, &uDriverFeaturesLegacy32bit);
+    AssertRCReturn(rc, rc);
+    pVirtio->uDriverFeatures = (uint64_t)uDriverFeaturesLegacy32bit;
+
+    rc = pHlp->pfnSSMGetU16(  pSSM, &pVirtio->uVirtqSelect);
+    AssertRCReturn(rc, rc);
+
+    rc = pHlp->pfnSSMGetU8(   pSSM, &pVirtio->fDeviceStatus);
+    AssertRCReturn(rc, rc);
+
+#ifdef LOG_ENABLED
+    char szOut[80] = { 0 };
+    virtioCoreFormatDeviceStatus(pVirtio->fDeviceStatus, szOut, sizeof(szOut));
+    Log(("Loaded legacy device status = (%s)\n", szOut));
+#endif
+
+    rc = pHlp->pfnSSMGetU8(   pSSM, &pVirtio->uISR);
+    AssertRCReturn(rc, rc);
+
+    uint32_t cQueues = 3; /* This constant default value copied from earliest v0.9 code */
+    if (uVersion > uVirtioLegacy_3_1_Beta)
+    {
+        rc = pHlp->pfnSSMGetU32(pSSM, &cQueues);
+        AssertRCReturn(rc, rc);
+    }
+
+    AssertLogRelMsgReturn(cQueues <= VIRTQ_MAX_COUNT, ("%#x\n", cQueues), VERR_SSM_LOAD_CONFIG_MISMATCH);
+    AssertLogRelMsgReturn(pVirtio->uVirtqSelect < cQueues || (cQueues == 0 && pVirtio->uVirtqSelect),
+                          ("uVirtqSelect=%u cQueues=%u\n", pVirtio->uVirtqSelect, cQueues),
+                          VERR_SSM_LOAD_CONFIG_MISMATCH);
+
+    Log(("\nRestoring %d  legacy-only virtio-net device queues from saved state:\n", cQueues));
+    for (unsigned uVirtq = 0; uVirtq < cQueues; uVirtq++)
+    {
+        PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[uVirtq];
+
+        if (uVirtq == cQueues - 1)
+            RTStrPrintf(pVirtq->szName, sizeof(pVirtq->szName), "legacy-ctrlq");
+        else if (uVirtq % 2)
+            RTStrPrintf(pVirtq->szName, sizeof(pVirtq->szName), "legacy-xmitq<%d>", uVirtq / 2);
+        else
+            RTStrPrintf(pVirtq->szName, sizeof(pVirtq->szName), "legacy-recvq<%d>", uVirtq / 2);
+
+        rc = pHlp->pfnSSMGetU16(pSSM, &pVirtq->uQueueSize);
+        AssertRCReturn(rc, rc);
+
+        uint32_t uVirtqPfn;
+        rc = pHlp->pfnSSMGetU32(pSSM, &uVirtqPfn);
+        AssertRCReturn(rc, rc);
+
+        rc = pHlp->pfnSSMGetU16(pSSM, &pVirtq->uAvailIdxShadow);
+        AssertRCReturn(rc, rc);
+
+        rc = pHlp->pfnSSMGetU16(pSSM, &pVirtq->uUsedIdxShadow);
+        AssertRCReturn(rc, rc);
+
+        if (uVirtqPfn)
+        {
+            pVirtq->GCPhysVirtqDesc  = (uint64_t)uVirtqPfn * VIRTIO_PAGE_SIZE;
+            pVirtq->GCPhysVirtqAvail = pVirtq->GCPhysVirtqDesc + sizeof(VIRTQ_DESC_T) * pVirtq->uQueueSize;
+            pVirtq->GCPhysVirtqUsed  =
+                RT_ALIGN(pVirtq->GCPhysVirtqAvail + RT_UOFFSETOF_DYN(VIRTQ_AVAIL_T, auRing[pVirtq->uQueueSize]), VIRTIO_PAGE_SIZE);
+            pVirtq->uEnable = 1;
+        }
+        else
+        {
+            LogFunc(("WARNING: QUEUE \"%s\" PAGE NUMBER ZERO IN SAVED STATE\n", pVirtq->szName));
+            pVirtq->uEnable = 0;
+        }
+        pVirtq->uNotifyOffset = 0;  /* unused in legacy mode */
+        pVirtq->uMsixVector   = 0;  /* unused in legacy mode */
+    }
+    pVirtio->fGenUpdatePending = 0; /* unused in legacy mode */
+    pVirtio->uConfigGeneration = 0; /* unused in legacy mode */
+    pVirtio->uPciCfgDataOff    = 0; /* unused in legacy mode (port I/O used instead)   */
+
+    return VINF_SUCCESS;
+}
+
+/**
+ * Loads a saved device state (called from device-specific code on SSM final pass)
+ *
+ * Note: This loads state saved by a Modern (VirtIO 1.0+) device, of which this transitional device is one,
+ *       and thus supports both legacy and modern guest virtio drivers.
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   pHlp        The ring-3 device helpers.
+ * @param   pSSM        The saved state handle.
+ * @returns VBox status code.
+ */
+int virtioCoreR3ModernDeviceLoadExec(PVIRTIOCORE pVirtio, PCPDMDEVHLPR3 pHlp, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uTestVersion, uint32_t cQueues)
+{
+    RT_NOREF2(cQueues, uVersion);
+    LogFunc(("\n"));
+    /*
+     * Check the marker and (embedded) version number.
+     */
+    uint64_t uMarker = 0;
+    int rc;
+
+    rc = pHlp->pfnSSMGetU64(pSSM, &uMarker);
+    AssertRCReturn(rc, rc);
+    if (uMarker != VIRTIO_SAVEDSTATE_MARKER)
+        return pHlp->pfnSSMSetLoadError(pSSM, VERR_SSM_DATA_UNIT_FORMAT_CHANGED, RT_SRC_POS,
+                                        N_("Expected marker value %#RX64 found %#RX64 instead"),
+                                        VIRTIO_SAVEDSTATE_MARKER, uMarker);
+    uint32_t uVersionSaved = 0;
+    rc = pHlp->pfnSSMGetU32(pSSM, &uVersionSaved);
+    AssertRCReturn(rc, rc);
+    if (uVersionSaved != uTestVersion)
+        return pHlp->pfnSSMSetLoadError(pSSM, VERR_SSM_DATA_UNIT_FORMAT_CHANGED, RT_SRC_POS,
+                                        N_("Unsupported virtio version: %u"), uVersionSaved);
+    /*
+     * Load the state.
+     */
+    rc = pHlp->pfnSSMGetU32(  pSSM, &pVirtio->fLegacyDriver);
+    AssertRCReturn(rc, rc);
+    rc = pHlp->pfnSSMGetBool( pSSM, &pVirtio->fGenUpdatePending);
+    AssertRCReturn(rc, rc);
+    rc = pHlp->pfnSSMGetU8(   pSSM, &pVirtio->fDeviceStatus);
+    AssertRCReturn(rc, rc);
+    rc = pHlp->pfnSSMGetU8(   pSSM, &pVirtio->uConfigGeneration);
+    AssertRCReturn(rc, rc);
+    rc = pHlp->pfnSSMGetU8(   pSSM, &pVirtio->uPciCfgDataOff);
+    AssertRCReturn(rc, rc);
+    rc = pHlp->pfnSSMGetU8(   pSSM, &pVirtio->uISR);
+    AssertRCReturn(rc, rc);
+    rc = pHlp->pfnSSMGetU16(  pSSM, &pVirtio->uVirtqSelect);
+    AssertRCReturn(rc, rc);
+    rc = pHlp->pfnSSMGetU32(  pSSM, &pVirtio->uDeviceFeaturesSelect);
+    AssertRCReturn(rc, rc);
+    rc = pHlp->pfnSSMGetU32(  pSSM, &pVirtio->uDriverFeaturesSelect);
+    AssertRCReturn(rc, rc);
+    rc = pHlp->pfnSSMGetU64(  pSSM, &pVirtio->uDriverFeatures);
+    AssertRCReturn(rc, rc);
+
+    /** @todo Adapt this loop use cQueues argument instead of static queue count (safely with SSM versioning) */
+    for (uint32_t i = 0; i < VIRTQ_MAX_COUNT; i++)
+    {
+        PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[i];
+        rc = pHlp->pfnSSMGetGCPhys64( pSSM, &pVirtq->GCPhysVirtqDesc);
+        AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetGCPhys64( pSSM, &pVirtq->GCPhysVirtqAvail);
+        AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetGCPhys64( pSSM, &pVirtq->GCPhysVirtqUsed);
+        AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetU16(      pSSM, &pVirtq->uNotifyOffset);
+        AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetU16(      pSSM, &pVirtq->uMsixVector);
+        AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetU16(      pSSM, &pVirtq->uEnable);
+        AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetU16(      pSSM, &pVirtq->uQueueSize);
+        AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetU16(      pSSM, &pVirtq->uAvailIdxShadow);
+        AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetU16(      pSSM, &pVirtq->uUsedIdxShadow);
+        AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetMem( pSSM, pVirtq->szName,  sizeof(pVirtq->szName));
+        AssertRCReturn(rc, rc);
+    }
+    return VINF_SUCCESS;
+}
+
+/**
+ * Called from the FNSSMDEVSAVEEXEC function of the device.
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   pHlp        The ring-3 device helpers.
+ * @param   pSSM        The saved state handle.
+ * @returns VBox status code.
+ */
+int virtioCoreR3SaveExec(PVIRTIOCORE pVirtio, PCPDMDEVHLPR3 pHlp, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t cQueues)
+{
+    RT_NOREF(cQueues);
+    /** @todo figure out a way to save cQueues (with SSM versioning) */
+
+    LogFunc(("\n"));
+    pHlp->pfnSSMPutU64(pSSM, VIRTIO_SAVEDSTATE_MARKER);
+    pHlp->pfnSSMPutU32(pSSM, uVersion);
+
+    pHlp->pfnSSMPutU32( pSSM, pVirtio->fLegacyDriver);
+    pHlp->pfnSSMPutBool(pSSM, pVirtio->fGenUpdatePending);
+    pHlp->pfnSSMPutU8(  pSSM, pVirtio->fDeviceStatus);
+    pHlp->pfnSSMPutU8(  pSSM, pVirtio->uConfigGeneration);
+    pHlp->pfnSSMPutU8(  pSSM, pVirtio->uPciCfgDataOff);
+    pHlp->pfnSSMPutU8(  pSSM, pVirtio->uISR);
+    pHlp->pfnSSMPutU16( pSSM, pVirtio->uVirtqSelect);
+    pHlp->pfnSSMPutU32( pSSM, pVirtio->uDeviceFeaturesSelect);
+    pHlp->pfnSSMPutU32( pSSM, pVirtio->uDriverFeaturesSelect);
+    pHlp->pfnSSMPutU64( pSSM, pVirtio->uDriverFeatures);
+
+    for (uint32_t i = 0; i < VIRTQ_MAX_COUNT; i++)
+    {
+        PVIRTQUEUE pVirtq = &pVirtio->aVirtqueues[i];
+
+        pHlp->pfnSSMPutGCPhys64( pSSM, pVirtq->GCPhysVirtqDesc);
+        pHlp->pfnSSMPutGCPhys64( pSSM, pVirtq->GCPhysVirtqAvail);
+        pHlp->pfnSSMPutGCPhys64( pSSM, pVirtq->GCPhysVirtqUsed);
+        pHlp->pfnSSMPutU16(      pSSM, pVirtq->uNotifyOffset);
+        pHlp->pfnSSMPutU16(      pSSM, pVirtq->uMsixVector);
+        pHlp->pfnSSMPutU16(      pSSM, pVirtq->uEnable);
+        pHlp->pfnSSMPutU16(      pSSM, pVirtq->uQueueSize);
+        pHlp->pfnSSMPutU16(      pSSM, pVirtq->uAvailIdxShadow);
+        pHlp->pfnSSMPutU16(      pSSM, pVirtq->uUsedIdxShadow);
+        int rc = pHlp->pfnSSMPutMem(pSSM, pVirtq->szName, 32);
+        AssertRCReturn(rc, rc);
+    }
+    return VINF_SUCCESS;
+}
+
+
+/*********************************************************************************************************************************
+*   Device Level                                                                                                                 *
+*********************************************************************************************************************************/
+
+/**
+ * This must be called by the client to handle VM state changes after the client takes care of its device-specific
+ * tasks for the state change (i.e. reset, suspend, power-off, resume)
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ */
+void virtioCoreR3VmStateChanged(PVIRTIOCORE pVirtio, VIRTIOVMSTATECHANGED enmState)
+{
+    LogFunc(("State changing to %s\n",
+        virtioCoreGetStateChangeText(enmState)));
+
+    switch(enmState)
+    {
+        case kvirtIoVmStateChangedReset:
+            virtioCoreResetAll(pVirtio);
+            break;
+        case kvirtIoVmStateChangedSuspend:
+            break;
+        case kvirtIoVmStateChangedPowerOff:
+            break;
+        case kvirtIoVmStateChangedResume:
+            for (int uVirtq = 0; uVirtq < VIRTQ_MAX_COUNT; uVirtq++)
+            {
+                if ((!pVirtio->fLegacyDriver && pVirtio->aVirtqueues[uVirtq].uEnable)
+                    | pVirtio->aVirtqueues[uVirtq].GCPhysVirtqDesc)
+                        virtioCoreNotifyGuestDriver(pVirtio->pDevInsR3, pVirtio, uVirtq);
+            }
+            break;
+        default:
+            LogRelFunc(("Bad enum value"));
+            return;
+    }
+}
+
+/**
+ * This should be called from PDMDEVREGR3::pfnDestruct.
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   pVirtioCC   Pointer to the ring-3 virtio state.
+ */
+void virtioCoreR3Term(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTIOCORECC pVirtioCC)
+{
+    if (pVirtioCC->pbPrevDevSpecificCfg)
+    {
+        RTMemFree(pVirtioCC->pbPrevDevSpecificCfg);
+        pVirtioCC->pbPrevDevSpecificCfg = NULL;
+    }
+
+    RT_NOREF(pDevIns, pVirtio);
+}
+
+/** API Function: See header file */
+int virtioCoreR3Init(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTIOCORECC pVirtioCC, PVIRTIOPCIPARAMS pPciParams,
+                     const char *pcszInstance, uint64_t fDevSpecificFeatures, uint32_t fOfferLegacy,
+                     void *pvDevSpecificCfg, uint16_t cbDevSpecificCfg)
+{
+    /*
+     * Virtio state must be the first member of shared device instance data,
+     * otherwise can't get our bearings in PCI config callbacks.
+     */
+    AssertLogRelReturn(pVirtio == PDMINS_2_DATA(pDevIns, PVIRTIOCORE), VERR_STATE_CHANGED);
+    AssertLogRelReturn(pVirtioCC == PDMINS_2_DATA_CC(pDevIns, PVIRTIOCORECC), VERR_STATE_CHANGED);
+
+    pVirtio->pDevInsR3 = pDevIns;
+
+    /*
+     * Caller must initialize these.
+     */
+    AssertReturn(pVirtioCC->pfnStatusChanged, VERR_INVALID_POINTER);
+    AssertReturn(pVirtioCC->pfnVirtqNotified, VERR_INVALID_POINTER);
+    AssertReturn(VIRTQ_SIZE > 0 && VIRTQ_SIZE <= 32768,  VERR_OUT_OF_RANGE); /* VirtIO specification-defined limit */
+
+#if 0 /* Until pdmR3DvHlp_PCISetIrq() impl is fixed and Assert that limits vec to 0 is removed
+       * VBox legacy MSI support has not been implemented yet
+       */
+# ifdef VBOX_WITH_MSI_DEVICES
+    pVirtio->fMsiSupport = true;
+# endif
+#endif
+
+    /*
+     * Host features (presented as a smörgasbord for guest to select from)
+     * include both dev-specific features & reserved dev-independent features (bitmask).
+     */
+    pVirtio->uDeviceFeatures = VIRTIO_F_VERSION_1
+                             | VIRTIO_DEV_INDEPENDENT_FEATURES_OFFERED
+                             | fDevSpecificFeatures;
+
+    pVirtio->fLegacyDriver = pVirtio->fOfferLegacy = fOfferLegacy;
+
+    RTStrCopy(pVirtio->szInstance, sizeof(pVirtio->szInstance), pcszInstance);
+    pVirtioCC->cbDevSpecificCfg = cbDevSpecificCfg;
+    pVirtioCC->pbDevSpecificCfg = (uint8_t *)pvDevSpecificCfg;
+    pVirtioCC->pbPrevDevSpecificCfg = (uint8_t *)RTMemDup(pvDevSpecificCfg, cbDevSpecificCfg);
+    AssertLogRelReturn(pVirtioCC->pbPrevDevSpecificCfg, VERR_NO_MEMORY);
+
+    /* Set PCI config registers (assume 32-bit mode) */
+    PPDMPCIDEV pPciDev = pDevIns->apPciDevs[0];
+    PDMPCIDEV_ASSERT_VALID(pDevIns, pPciDev);
+
+    PDMPciDevSetVendorId(pPciDev,           DEVICE_PCI_VENDOR_ID_VIRTIO);
+    PDMPciDevSetDeviceId(pPciDev,           pPciParams->uDeviceId);
+
+    if (pPciParams->uDeviceId < DEVICE_PCI_DEVICE_ID_VIRTIO_BASE)
+        /* Transitional devices MUST have a PCI Revision ID of 0. */
+        PDMPciDevSetRevisionId(pPciDev,     DEVICE_PCI_REVISION_ID_VIRTIO_TRANS);
+    else
+        /* Non-transitional devices SHOULD have a PCI Revision ID of 1 or higher. */
+        PDMPciDevSetRevisionId(pPciDev,     DEVICE_PCI_REVISION_ID_VIRTIO_V1);
+
+    PDMPciDevSetSubSystemId(pPciDev,        pPciParams->uSubsystemId);
+    PDMPciDevSetSubSystemVendorId(pPciDev,  DEVICE_PCI_VENDOR_ID_VIRTIO);
+    PDMPciDevSetClassBase(pPciDev,          pPciParams->uClassBase);
+    PDMPciDevSetClassSub(pPciDev,           pPciParams->uClassSub);
+    PDMPciDevSetClassProg(pPciDev,          pPciParams->uClassProg);
+    PDMPciDevSetInterruptLine(pPciDev,      pPciParams->uInterruptLine);
+    PDMPciDevSetInterruptPin(pPciDev,       pPciParams->uInterruptPin);
+
+    /* Register PCI device */
+    int rc = PDMDevHlpPCIRegister(pDevIns, pPciDev);
+    if (RT_FAILURE(rc))
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("virtio: cannot register PCI Device")); /* can we put params in this error? */
+
+    rc = PDMDevHlpPCIInterceptConfigAccesses(pDevIns, pPciDev, virtioR3PciConfigRead, virtioR3PciConfigWrite);
+    AssertRCReturn(rc, rc);
+
+    /* Construct & map PCI vendor-specific capabilities for virtio host negotiation with guest driver */
+
+#define CFG_ADDR_2_IDX(addr) ((uint8_t)(((uintptr_t)(addr) - (uintptr_t)&pPciDev->abConfig[0])))
+#define SET_PCI_CAP_LOC(a_pPciDev, a_pCfg, a_LocCap, a_uMmioLengthAlign) \
+        do { \
+            (a_LocCap).offMmio = (a_pCfg)->uOffset; \
+            (a_LocCap).cbMmio  = RT_ALIGN_T((a_pCfg)->uLength, a_uMmioLengthAlign, uint16_t); \
+            (a_LocCap).offPci  = (uint16_t)(uintptr_t)((uint8_t *)(a_pCfg) - &(a_pPciDev)->abConfig[0]); \
+            (a_LocCap).cbPci   = (a_pCfg)->uCapLen; \
+        } while (0)
+
+    PVIRTIO_PCI_CAP_T pCfg;
+    uint32_t cbRegion = 0;
+
+    /*
+     * Common capability (VirtIO 1.0, section 4.1.4.3)
+     */
+    pCfg = (PVIRTIO_PCI_CAP_T)&pPciDev->abConfig[0x40];
+    pCfg->uCfgType = VIRTIO_PCI_CAP_COMMON_CFG;
+    pCfg->uCapVndr = VIRTIO_PCI_CAP_ID_VENDOR;
+    pCfg->uCapLen  = sizeof(VIRTIO_PCI_CAP_T);
+    pCfg->uCapNext = CFG_ADDR_2_IDX(pCfg) + pCfg->uCapLen;
+    pCfg->uBar     = VIRTIO_REGION_PCI_CAP;
+    pCfg->uOffset  = RT_ALIGN_32(0, 4); /* Currently 0, but reminder to 32-bit align if changing this */
+    pCfg->uLength  = sizeof(VIRTIO_PCI_COMMON_CFG_T);
+    cbRegion += pCfg->uLength;
+    SET_PCI_CAP_LOC(pPciDev, pCfg, pVirtio->LocCommonCfgCap, 2);
+    pVirtioCC->pCommonCfgCap = pCfg;
+
+    /*
+     * Notify capability (VirtIO 1.0, section 4.1.4.4).
+     *
+     * The size of the spec-defined subregion described by this VirtIO capability is
+     * based-on the choice of this implementation to make the notification area of each
+     * queue equal to queue's ordinal position (e.g. queue selector value). The VirtIO
+     * specification leaves it up to implementation to define queue notification area layout.
+     */
+    pCfg = (PVIRTIO_PCI_CAP_T)&pPciDev->abConfig[pCfg->uCapNext];
+    pCfg->uCfgType = VIRTIO_PCI_CAP_NOTIFY_CFG;
+    pCfg->uCapVndr = VIRTIO_PCI_CAP_ID_VENDOR;
+    pCfg->uCapLen  = sizeof(VIRTIO_PCI_NOTIFY_CAP_T);
+    pCfg->uCapNext = CFG_ADDR_2_IDX(pCfg) + pCfg->uCapLen;
+    pCfg->uBar     = VIRTIO_REGION_PCI_CAP;
+    pCfg->uOffset  = pVirtioCC->pCommonCfgCap->uOffset + pVirtioCC->pCommonCfgCap->uLength;
+    pCfg->uOffset  = RT_ALIGN_32(pCfg->uOffset, 4);
+    pCfg->uLength  = VIRTQ_MAX_COUNT * VIRTIO_NOTIFY_OFFSET_MULTIPLIER + 2;  /* will change in VirtIO 1.1 */
+    cbRegion += pCfg->uLength;
+    SET_PCI_CAP_LOC(pPciDev, pCfg, pVirtio->LocNotifyCap, 1);
+    pVirtioCC->pNotifyCap = (PVIRTIO_PCI_NOTIFY_CAP_T)pCfg;
+    pVirtioCC->pNotifyCap->uNotifyOffMultiplier = VIRTIO_NOTIFY_OFFSET_MULTIPLIER;
+
+    /* ISR capability (VirtIO 1.0, section 4.1.4.5)
+     *
+     * VirtIO 1.0 spec says 8-bit, unaligned in MMIO space. The specification example/diagram
+     * illustrates this capability as 32-bit field with upper bits 'reserved'. Those depictions
+     * differ. The spec's wording, not the diagram, is seen to work in practice.
+     */
+    pCfg = (PVIRTIO_PCI_CAP_T)&pPciDev->abConfig[pCfg->uCapNext];
+    pCfg->uCfgType = VIRTIO_PCI_CAP_ISR_CFG;
+    pCfg->uCapVndr = VIRTIO_PCI_CAP_ID_VENDOR;
+    pCfg->uCapLen  = sizeof(VIRTIO_PCI_CAP_T);
+    pCfg->uCapNext = CFG_ADDR_2_IDX(pCfg) + pCfg->uCapLen;
+    pCfg->uBar     = VIRTIO_REGION_PCI_CAP;
+    pCfg->uOffset  = pVirtioCC->pNotifyCap->pciCap.uOffset + pVirtioCC->pNotifyCap->pciCap.uLength;
+    pCfg->uOffset  = RT_ALIGN_32(pCfg->uOffset, 4);
+    pCfg->uLength  = sizeof(uint8_t);
+    cbRegion += pCfg->uLength;
+    SET_PCI_CAP_LOC(pPciDev, pCfg, pVirtio->LocIsrCap, 4);
+    pVirtioCC->pIsrCap = pCfg;
+
+    /*  PCI Cfg capability (VirtIO 1.0, section 4.1.4.7)
+     *
+     *  This capability facilitates early-boot access to this device (BIOS).
+     *  This region isn't page-MMIO mapped. PCI configuration accesses are intercepted,
+     *  wherein uBar, uOffset and uLength are modulated by consumers to locate and read/write
+     *  values in any part of any region. (NOTE: Linux driver doesn't utilize this feature.
+     *  This capability only appears in lspci output on Linux if uLength is non-zero, 4-byte aligned,
+     *  during initialization of linux virtio driver).
+     */
+    pVirtio->uPciCfgDataOff = pCfg->uCapNext + RT_OFFSETOF(VIRTIO_PCI_CFG_CAP_T, uPciCfgData);
+    pCfg = (PVIRTIO_PCI_CAP_T)&pPciDev->abConfig[pCfg->uCapNext];
+    pCfg->uCfgType = VIRTIO_PCI_CAP_PCI_CFG;
+    pCfg->uCapVndr = VIRTIO_PCI_CAP_ID_VENDOR;
+    pCfg->uCapLen  = sizeof(VIRTIO_PCI_CFG_CAP_T);
+    pCfg->uCapNext = (pVirtio->fMsiSupport || pVirtioCC->pbDevSpecificCfg) ? CFG_ADDR_2_IDX(pCfg) + pCfg->uCapLen : 0;
+    pCfg->uBar     = VIRTIO_REGION_PCI_CAP;
+    pCfg->uOffset  = 0;
+    pCfg->uLength  = 4;
+    cbRegion += pCfg->uLength;
+    SET_PCI_CAP_LOC(pPciDev, pCfg, pVirtio->LocPciCfgCap, 1);
+    pVirtioCC->pPciCfgCap = (PVIRTIO_PCI_CFG_CAP_T)pCfg;
+
+    if (pVirtioCC->pbDevSpecificCfg)
+    {
+        /* Device-specific config capability (VirtIO 1.0, section 4.1.4.6).
+         *
+         * Client defines the device-specific config struct and passes size to virtioCoreR3Init()
+         * to inform this.
+         */
+        pCfg = (PVIRTIO_PCI_CAP_T)&pPciDev->abConfig[pCfg->uCapNext];
+        pCfg->uCfgType = VIRTIO_PCI_CAP_DEVICE_CFG;
+        pCfg->uCapVndr = VIRTIO_PCI_CAP_ID_VENDOR;
+        pCfg->uCapLen  = sizeof(VIRTIO_PCI_CAP_T);
+        pCfg->uCapNext = pVirtio->fMsiSupport ? CFG_ADDR_2_IDX(pCfg) + pCfg->uCapLen : 0;
+        pCfg->uBar     = VIRTIO_REGION_PCI_CAP;
+        pCfg->uOffset  = pVirtioCC->pIsrCap->uOffset + pVirtioCC->pIsrCap->uLength;
+        pCfg->uOffset  = RT_ALIGN_32(pCfg->uOffset, 4);
+        pCfg->uLength  = cbDevSpecificCfg;
+        cbRegion += pCfg->uLength;
+        SET_PCI_CAP_LOC(pPciDev, pCfg, pVirtio->LocDeviceCap, 4);
+        pVirtioCC->pDeviceCap = pCfg;
+    }
+    else
+        Assert(pVirtio->LocDeviceCap.cbMmio == 0 && pVirtio->LocDeviceCap.cbPci == 0);
+
+    if (pVirtio->fMsiSupport)
+    {
+        PDMMSIREG aMsiReg;
+        RT_ZERO(aMsiReg);
+        aMsiReg.iMsixCapOffset  = pCfg->uCapNext;
+        aMsiReg.iMsixNextOffset = 0;
+        aMsiReg.iMsixBar        = VIRTIO_REGION_MSIX_CAP;
+        aMsiReg.cMsixVectors    = VBOX_MSIX_MAX_ENTRIES;
+        rc = PDMDevHlpPCIRegisterMsi(pDevIns, &aMsiReg); /* see MsixR3init() */
+        if (RT_FAILURE(rc))
+        {
+            /* See PDMDevHlp.cpp:pdmR3DevHlp_PCIRegisterMsi */
+            LogFunc(("Failed to configure MSI-X (%Rrc). Reverting to INTx\n", rc));
+            pVirtio->fMsiSupport = false;
+        }
+        else
+            Log2Func(("Using MSI-X for guest driver notification\n"));
+    }
+    else
+        LogFunc(("MSI-X not available for VBox, using INTx notification\n"));
+
+    /* Set offset to first capability and enable PCI dev capabilities */
+    PDMPciDevSetCapabilityList(pPciDev, 0x40);
+    PDMPciDevSetStatus(pPciDev, VBOX_PCI_STATUS_CAP_LIST);
+
+    size_t cbSize = RTStrPrintf(pVirtioCC->szMmioName, sizeof(pVirtioCC->szMmioName), "%s (modern)", pcszInstance);
+    if (cbSize <= 0)
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("virtio: out of memory allocating string")); /* can we put params in this error? */
+
+    cbSize = RTStrPrintf(pVirtioCC->szPortIoName, sizeof(pVirtioCC->szPortIoName), "%s (legacy)", pcszInstance);
+    if (cbSize <= 0)
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("virtio: out of memory allocating string")); /* can we put params in this error? */
+
+    if (pVirtio->fOfferLegacy)
+    {
+        /* As a transitional device that supports legacy VirtIO drivers, this VirtIO device generic implementation presents
+         * legacy driver interface in I/O space at BAR0. The following maps the common (e.g. device independent)
+         * dev config area as well as device-specific dev config area (whose size is passed to init function of this VirtIO
+         * generic device code) for access via Port I/O, since legacy drivers (e.g. pre VirtIO 1.0) don't use MMIO callbacks.
+         * (See VirtIO 1.1, Section 4.1.4.8).
+         */
+        rc = PDMDevHlpPCIIORegionCreateIo(pDevIns, VIRTIO_REGION_LEGACY_IO, sizeof(VIRTIO_LEGACY_PCI_COMMON_CFG_T) + cbDevSpecificCfg,
+                                          virtioLegacyIOPortOut, virtioLegacyIOPortIn, NULL /*pvUser*/, pVirtioCC->szPortIoName,
+                                          NULL /*paExtDescs*/, &pVirtio->hLegacyIoPorts);
+        AssertLogRelRCReturn(rc, PDMDEV_SET_ERROR(pDevIns, rc, N_("virtio: cannot register legacy config in I/O space at BAR0 */")));
+    }
+
+    /*  Note: The Linux driver at drivers/virtio/virtio_pci_modern.c tries to map at least a page for the
+     * 'unknown' device-specific capability without querying the capability to determine size, so pad w/extra page.
+     */
+    rc = PDMDevHlpPCIIORegionCreateMmio(pDevIns, VIRTIO_REGION_PCI_CAP, RT_ALIGN_32(cbRegion + VIRTIO_PAGE_SIZE, VIRTIO_PAGE_SIZE),
+                                        PCI_ADDRESS_SPACE_MEM, virtioMmioWrite, virtioMmioRead, pVirtio,
+                                        IOMMMIO_FLAGS_READ_PASSTHRU | IOMMMIO_FLAGS_WRITE_PASSTHRU,
+                                        pVirtioCC->szMmioName,
+                                        &pVirtio->hMmioPciCap);
+    AssertLogRelRCReturn(rc, PDMDEV_SET_ERROR(pDevIns, rc, N_("virtio: cannot register PCI Capabilities address space")));
+    /*
+     * Statistics.
+     */
+# ifdef VBOX_WITH_STATISTICS
+    PDMDevHlpSTAMRegisterF(pDevIns, &pVirtio->StatDescChainsAllocated,  STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+                           "Total number of allocated descriptor chains",   "DescChainsAllocated");
+    PDMDevHlpSTAMRegisterF(pDevIns, &pVirtio->StatDescChainsFreed,      STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+                           "Total number of freed descriptor chains",       "DescChainsFreed");
+    PDMDevHlpSTAMRegisterF(pDevIns, &pVirtio->StatDescChainsSegsIn,     STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+                           "Total number of inbound segments",              "DescChainsSegsIn");
+    PDMDevHlpSTAMRegisterF(pDevIns, &pVirtio->StatDescChainsSegsOut,    STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+                           "Total number of outbound segments",             "DescChainsSegsOut");
+    PDMDevHlpSTAMRegister(pDevIns, &pVirtio->StatReadR3,    STAMTYPE_PROFILE, "IO/ReadR3",          STAMUNIT_TICKS_PER_CALL, "Profiling IO reads in R3");
+    PDMDevHlpSTAMRegister(pDevIns, &pVirtio->StatReadR0,    STAMTYPE_PROFILE, "IO/ReadR0",          STAMUNIT_TICKS_PER_CALL, "Profiling IO reads in R0");
+    PDMDevHlpSTAMRegister(pDevIns, &pVirtio->StatReadRC,    STAMTYPE_PROFILE, "IO/ReadRC",          STAMUNIT_TICKS_PER_CALL, "Profiling IO reads in RC");
+    PDMDevHlpSTAMRegister(pDevIns, &pVirtio->StatWriteR3,   STAMTYPE_PROFILE, "IO/WriteR3",         STAMUNIT_TICKS_PER_CALL, "Profiling IO writes in R3");
+    PDMDevHlpSTAMRegister(pDevIns, &pVirtio->StatWriteR0,   STAMTYPE_PROFILE, "IO/WriteR0",         STAMUNIT_TICKS_PER_CALL, "Profiling IO writes in R0");
+    PDMDevHlpSTAMRegister(pDevIns, &pVirtio->StatWriteRC,   STAMTYPE_PROFILE, "IO/WriteRC",         STAMUNIT_TICKS_PER_CALL, "Profiling IO writes in RC");
+# endif /* VBOX_WITH_STATISTICS */
+
+    return VINF_SUCCESS;
+}
+
+#else  /* !IN_RING3 */
+
+/**
+ * Sets up the core ring-0/raw-mode virtio bits.
+ *
+ * @returns VBox status code.
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.  This must be the first
+ *                      member in the shared device instance data!
+ */
+int virtioCoreRZInit(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio)
+{
+    AssertLogRelReturn(pVirtio == PDMINS_2_DATA(pDevIns, PVIRTIOCORE), VERR_STATE_CHANGED);
+    int rc;
+#ifdef FUTURE_OPTIMIZATION
+     rc = PDMDevHlpSetDeviceCritSect(pDevIns, PDMDevHlpCritSectGetNop(pDevIns));
+    AssertRCReturn(rc, rc);
+#endif
+    rc = PDMDevHlpMmioSetUpContext(pDevIns, pVirtio->hMmioPciCap, virtioMmioWrite, virtioMmioRead, pVirtio);
+    AssertRCReturn(rc, rc);
+
+    if (pVirtio->fOfferLegacy)
+    {
+        rc = PDMDevHlpIoPortSetUpContext(pDevIns, pVirtio->hLegacyIoPorts, virtioLegacyIOPortOut, virtioLegacyIOPortIn, NULL /*pvUser*/);
+        AssertRCReturn(rc, rc);
+    }
+    return rc;
+}
+
+#endif /* !IN_RING3 */
+
diff --git a/src/VBox/Devices/VirtIO/VirtioCore.h b/src/VBox/Devices/VirtIO/VirtioCore.h
new file mode 100644
index 00000000..00bcb43c
--- /dev/null
+++ b/src/VBox/Devices/VirtIO/VirtioCore.h
@@ -0,0 +1,1476 @@
+/* $Id: VirtioCore.h $ */
+
+/** @file
+ * VirtioCore.h - Virtio Declarations
+ */
+
+/*
+ * Copyright (C) 2009-2023 Oracle and/or its affiliates.
+ *
+ * This file is part of VirtualBox base platform packages, as
+ * available from https://www.virtualbox.org.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation, in version 3 of the
+ * License.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+#ifndef VBOX_INCLUDED_SRC_VirtIO_VirtioCore_h
+#define VBOX_INCLUDED_SRC_VirtIO_VirtioCore_h
+#ifndef RT_WITHOUT_PRAGMA_ONCE
+# pragma once
+#endif
+
+/* Do not allocate VIRTQBUF from the heap when possible */
+#define VIRTIO_VBUF_ON_STACK 1
+
+#include <iprt/ctype.h>
+#include <iprt/sg.h>
+#include <iprt/types.h>
+
+#ifdef LOG_ENABLED
+# define VIRTIO_HEX_DUMP(logLevel, pv, cb, base, title) \
+    do { \
+        if (LogIsItEnabled(logLevel, LOG_GROUP)) \
+            virtioCoreHexDump((pv), (cb), (base), (title)); \
+    } while (0)
+#else
+# define VIRTIO_HEX_DUMP(logLevel, pv, cb, base, title) do { } while (0)
+#endif
+
+/** Marks the start of the virtio saved state (just for sanity). */
+#define VIRTIO_SAVEDSTATE_MARKER                        UINT64_C(0x1133557799bbddff)
+
+/** Pointer to the shared VirtIO state. */
+typedef struct VIRTIOCORE *PVIRTIOCORE;
+/** Pointer to the ring-3 VirtIO state. */
+typedef struct VIRTIOCORER3 *PVIRTIOCORER3;
+/** Pointer to the ring-0 VirtIO state. */
+typedef struct VIRTIOCORER0 *PVIRTIOCORER0;
+/** Pointer to the raw-mode VirtIO state. */
+typedef struct VIRTIOCORERC *PVIRTIOCORERC;
+/** Pointer to the instance data for the current context. */
+typedef CTX_SUFF(PVIRTIOCORE) PVIRTIOCORECC;
+
+#define VIRTIO_MAX_VIRTQ_NAME_SIZE          32                   /**< Maximum length of a queue name           */
+#define VIRTQ_SIZE                        1024                   /**< Max size (# entries) of a virtq          */
+#define VIRTQ_MAX_COUNT                     24                   /**< Max queues we allow guest to create      */
+#define VIRTIO_NOTIFY_OFFSET_MULTIPLIER     2                    /**< VirtIO Notify Cap. MMIO config param     */
+#define VIRTIO_REGION_LEGACY_IO             0                    /**< BAR for VirtIO legacy drivers MBZ        */
+#define VIRTIO_REGION_PCI_CAP               2                    /**< BAR for VirtIO Cap. MMIO (impl specific) */
+#define VIRTIO_REGION_MSIX_CAP              0                    /**< Bar for MSI-X handling                   */
+#define VIRTIO_PAGE_SIZE                 4096                    /**< Page size used by VirtIO specification   */
+
+/**
+ * @todo Move the following virtioCoreGCPhysChain*() functions mimic the functionality of the related
+ *       into some VirtualBox source tree common location and out of this code.
+ *
+ *       They behave identically to the S/G utilities in the RT library, except they work with that
+ *       GCPhys data type specifically instead of void *, to avoid potentially disastrous mismatch
+ *       between sizeof(void *) and sizeof(GCPhys).
+ *
+ */
+typedef struct VIRTIOSGSEG                                      /**< An S/G entry                              */
+{
+    RTGCPHYS GCPhys;                                            /**< Pointer to the segment buffer             */
+    size_t  cbSeg;                                              /**< Size of the segment buffer                */
+} VIRTIOSGSEG;
+
+typedef VIRTIOSGSEG *PVIRTIOSGSEG, **PPVIRTIOSGSEG;
+typedef const VIRTIOSGSEG *PCVIRTIOSGSEG;
+
+typedef struct VIRTIOSGBUF
+{
+    PVIRTIOSGSEG paSegs;                                        /**< Pointer to the scatter/gather array       */
+    unsigned  cSegs;                                            /**< Number of segs in scatter/gather array    */
+    unsigned  idxSeg;                                           /**< Current segment we are in                 */
+    RTGCPHYS  GCPhysCur;                                        /**< Ptr to byte within the current seg        */
+    size_t    cbSegLeft;                                        /**< # of bytes left in the current segment    */
+} VIRTIOSGBUF;
+
+typedef VIRTIOSGBUF *PVIRTIOSGBUF, **PPVIRTIOSGBUF;
+typedef const VIRTIOSGBUF *PCVIRTIOSGBUF;
+
+/**
+ * VirtIO buffers are descriptor chains (e.g. scatter-gather vectors). A VirtIO buffer is referred to by the index
+ * of its head descriptor. Each descriptor optionally chains to another descriptor, and so on.
+ *
+ * For any given descriptor, each length and GCPhys pair in the chain represents either an OUT segment (e.g. guest-to-host)
+ * or an IN segment (host-to-guest).
+ *
+ * A VIRTQBUF is created and retured from a call to to either virtioCoreR3VirtqAvailBufPeek() or virtioCoreR3VirtqAvailBufGet().
+ *
+ * Those functions consolidate the VirtIO descriptor chain into a single representation where:
+ *
+ *     pSgPhysSend    GCPhys s/g buffer containing all of the (VirtIO) OUT descriptors
+ *     pSgPhysReturn  GCPhys s/g buffer containing all of the (VirtIO)  IN descriptors
+ *
+ * The OUT descriptors are data sent from guest to host (dev-specific commands and/or data)
+ * The IN are to be filled with data (converted to physical) on host, to be returned to guest
+ *
+ */
+typedef struct VIRTQBUF
+{
+    uint32_t            u32Magic;                                /**< Magic value, VIRTQBUF_MAGIC.             */
+    uint16_t            uVirtq;                                  /**< VirtIO index of associated virtq         */
+    uint16_t            pad;
+    uint32_t volatile   cRefs;                                   /**< Reference counter.                       */
+    uint32_t            uHeadIdx;                                /**< Head idx of associated desc chain        */
+    size_t              cbPhysSend;                              /**< Total size of src buffer                 */
+    PVIRTIOSGBUF        pSgPhysSend;                             /**< Phys S/G buf for data from guest         */
+    size_t              cbPhysReturn;                            /**< Total size of dst buffer                 */
+    PVIRTIOSGBUF        pSgPhysReturn;                           /**< Phys S/G buf to store result for guest   */
+
+    /** @name Internal (bird combined 5 allocations into a single), fingers off.
+     * @{ */
+    VIRTIOSGBUF         SgBufIn;
+    VIRTIOSGBUF         SgBufOut;
+    VIRTIOSGSEG         aSegsIn[VIRTQ_SIZE];
+    VIRTIOSGSEG         aSegsOut[VIRTQ_SIZE];
+    /** @} */
+} VIRTQBUF_T;
+
+/** Pointers to a Virtio descriptor chain. */
+typedef VIRTQBUF_T *PVIRTQBUF, **PPVIRTQBUF;
+
+/** Magic value for VIRTQBUF_T::u32Magic. */
+#define VIRTQBUF_MAGIC             UINT32_C(0x19600219)
+
+typedef struct VIRTIOPCIPARAMS
+{
+    uint16_t  uDeviceId;                                         /**< PCI Cfg Device ID                         */
+    uint16_t  uClassBase;                                        /**< PCI Cfg Base Class                        */
+    uint16_t  uClassSub;                                         /**< PCI Cfg Subclass                          */
+    uint16_t  uClassProg;                                        /**< PCI Cfg Programming Interface Class       */
+    uint16_t  uSubsystemId;                                      /**< PCI Cfg Card Manufacturer Vendor ID       */
+    uint16_t  uInterruptLine;                                    /**< PCI Cfg Interrupt line                    */
+    uint16_t  uInterruptPin;                                     /**< PCI Cfg Interrupt pin                     */
+} VIRTIOPCIPARAMS, *PVIRTIOPCIPARAMS;
+
+
+/* Virtio Platform Independent Reserved Feature Bits (see 1.1 specification section 6) */
+
+#define VIRTIO_F_NOTIFY_ON_EMPTY            RT_BIT_64(24)        /**< Legacy feature: Force intr if no AVAIL    */
+#define VIRTIO_F_ANY_LAYOUT                 RT_BIT_64(27)        /**< Doc bug: Goes under two names in spec     */
+#define VIRTIO_F_RING_INDIRECT_DESC         RT_BIT_64(28)        /**< Doc bug: Goes under two names in spec     */
+#define VIRTIO_F_INDIRECT_DESC              RT_BIT_64(28)        /**< Allow descs to point to list of descs     */
+#define VIRTIO_F_RING_EVENT_IDX             RT_BIT_64(29)        /**< Doc bug: Goes under two names in spec     */
+#define VIRTIO_F_EVENT_IDX                  RT_BIT_64(29)        /**< Allow notification disable for n elems    */
+#define VIRTIO_F_BAD_FEATURE                RT_BIT_64(30)        /**< QEMU kludge.  UNUSED as of >= VirtIO 1.0  */
+#define VIRTIO_F_VERSION_1                  RT_BIT_64(32)        /**< Required feature bit for 1.0 devices      */
+#define VIRTIO_F_ACCESS_PLATFORM            RT_BIT_64(33)        /**< Funky guest mem access   (VirtIO 1.1 NYI) */
+#define VIRTIO_F_RING_PACKED                RT_BIT_64(34)        /**< Packed Queue Layout      (VirtIO 1.1 NYI) */
+#define VIRTIO_F_IN_ORDER                   RT_BIT_64(35)        /**< Honor guest buf order    (VirtIO 1.1 NYI) */
+#define VIRTIO_F_ORDER_PLATFORM             RT_BIT_64(36)        /**< Host mem access honored  (VirtIO 1.1 NYI) */
+#define VIRTIO_F_SR_IOV                     RT_BIT_64(37)        /**< Dev Single Root I/O virt (VirtIO 1.1 NYI) */
+#define VIRTIO_F_NOTIFICAITON_DATA          RT_BIT_64(38)        /**< Driver passes extra data (VirtIO 1.1 NYI) */
+
+typedef struct VIRTIO_FEATURES_LIST
+{
+    uint64_t fFeatureBit;
+    const char *pcszDesc;
+} VIRTIO_FEATURES_LIST, *PVIRTIO_FEATURES_LIST;
+
+static const VIRTIO_FEATURES_LIST s_aCoreFeatures[] =
+{
+    { VIRTIO_F_VERSION_1,               "   VERSION_1            Guest driver supports VirtIO specification V1.0+ (e.g. \"modern\")\n" },
+    { VIRTIO_F_RING_EVENT_IDX,          "   RING_EVENT_IDX       Enables use_event and avail_event fields described in 2.4.7, 2.4.8\n" },
+    { VIRTIO_F_RING_INDIRECT_DESC,      "   RING_INDIRECT_DESC   Driver can use descriptors with VIRTQ_DESC_F_INDIRECT flag set\n" },
+};
+
+#define VIRTIO_DEV_INDEPENDENT_FEATURES_OFFERED ( 0 )            /**< TBD: Add VIRTIO_F_INDIRECT_DESC           */
+#define VIRTIO_DEV_INDEPENDENT_LEGACY_FEATURES_OFFERED ( 0 )     /**< Only offered to legacy drivers            */
+
+#define VIRTIO_ISR_VIRTQ_INTERRUPT           RT_BIT_32(0)        /**< Virtq interrupt bit of ISR register       */
+#define VIRTIO_ISR_DEVICE_CONFIG             RT_BIT_32(1)        /**< Device configuration changed bit of ISR   */
+#define DEVICE_PCI_NETWORK_SUBSYSTEM                    1        /**< Network Card, per VirtIO legacy spec.     */
+#define DEVICE_PCI_REVISION_ID_VIRTIO_TRANS             0        /**< VirtIO Transitional device revision (MBZ) */
+#define DEVICE_PCI_REVISION_ID_VIRTIO_V1                1        /**< VirtIO device revision (SHOULD be >= 1)   */
+
+#define DEVICE_PCI_VENDOR_ID_VIRTIO                0x1AF4        /**< Guest driver locates dev via (mandatory)  */
+
+/**
+ * Start of the PCI device id range for non-transitional devices.
+ *
+ * "Devices ... have the PCI Device ID calculated by adding 0x1040 to
+ * the Virtio Device ID, as indicated in section [Device Types]. ...
+ * Non-transitional devices SHOULD have a PCI Device ID in the range
+ * 0x1040 to 0x107f.
+ */
+#define DEVICE_PCI_DEVICE_ID_VIRTIO_BASE           0x1040
+
+/** Reserved (*negotiated*) Feature Bits (e.g. device independent features, VirtIO 1.0 spec,section 6) */
+
+#define VIRTIO_MSI_NO_VECTOR                       0xffff        /**< Vector value to disable MSI for queue     */
+
+/** Device Status field constants (from Virtio 1.0 spec) */
+#define VIRTIO_STATUS_ACKNOWLEDGE                    0x01        /**< Guest driver: Located this VirtIO device  */
+#define VIRTIO_STATUS_DRIVER                         0x02        /**< Guest driver: Can drive this VirtIO dev.  */
+#define VIRTIO_STATUS_DRIVER_OK                      0x04        /**< Guest driver: Driver set-up and ready     */
+#define VIRTIO_STATUS_FEATURES_OK                    0x08        /**< Guest driver: Feature negotiation done    */
+#define VIRTIO_STATUS_FAILED                         0x80        /**< Guest driver: Fatal error, gave up        */
+#define VIRTIO_STATUS_DEVICE_NEEDS_RESET             0x40        /**< Device experienced unrecoverable error    */
+
+typedef enum VIRTIOVMSTATECHANGED
+{
+    kvirtIoVmStateChangedInvalid = 0,
+    kvirtIoVmStateChangedReset,
+    kvirtIoVmStateChangedSuspend,
+    kvirtIoVmStateChangedPowerOff,
+    kvirtIoVmStateChangedResume,
+    kvirtIoVmStateChangedFor32BitHack = 0x7fffffff
+} VIRTIOVMSTATECHANGED;
+
+/** @def Virtio Device PCI Capabilities type codes */
+#define VIRTIO_PCI_CAP_COMMON_CFG                       1        /**< Common configuration PCI capability ID    */
+#define VIRTIO_PCI_CAP_NOTIFY_CFG                       2        /**< Notification area PCI capability ID       */
+#define VIRTIO_PCI_CAP_ISR_CFG                          3        /**< ISR PCI capability id                     */
+#define VIRTIO_PCI_CAP_DEVICE_CFG                       4        /**< Device-specific PCI cfg capability ID     */
+#define VIRTIO_PCI_CAP_PCI_CFG                          5        /**< PCI CFG capability ID                     */
+
+#define VIRTIO_PCI_CAP_ID_VENDOR                     0x09        /**< Vendor-specific PCI CFG Device Cap. ID    */
+
+/**
+ * The following is the PCI capability struct common to all VirtIO capability types
+ */
+typedef struct virtio_pci_cap
+{
+    /* All little-endian */
+    uint8_t   uCapVndr;                                          /**< Generic PCI field: PCI_CAP_ID_VNDR        */
+    uint8_t   uCapNext;                                          /**< Generic PCI field: next ptr.              */
+    uint8_t   uCapLen;                                           /**< Generic PCI field: capability length      */
+    uint8_t   uCfgType;                                          /**< Identifies the structure.                 */
+    uint8_t   uBar;                                              /**< Where to find it.                         */
+    uint8_t   uPadding[3];                                       /**< Pad to full dword.                        */
+    uint32_t  uOffset;                                           /**< Offset within bar.  (L.E.)                */
+    uint32_t  uLength;                                           /**< Length of struct, in bytes. (L.E.)        */
+}  VIRTIO_PCI_CAP_T, *PVIRTIO_PCI_CAP_T;
+
+/**
+ * VirtIO Legacy Capabilities' related MMIO-mapped structs (see virtio-0.9.5 spec)
+ *
+ * Note: virtio_pci_device_cap is dev-specific, implemented by client. Definition unknown here.
+ */
+typedef struct virtio_legacy_pci_common_cfg
+{
+    /* Device-specific fields */
+    uint32_t  uDeviceFeatures;                                   /**< RO (device reports features to driver)    */
+    uint32_t  uDriverFeatures;                                   /**< RW (driver-accepted device features)      */
+    uint32_t  uVirtqPfn;                                         /**< RW (driver writes queue page number)      */
+    uint16_t  uQueueSize;                                        /**< RW (queue size, 0 - 2^n)                  */
+    uint16_t  uVirtqSelect;                                      /**< RW (selects queue focus for these fields) */
+    uint16_t  uQueueNotify;                                      /**< RO (offset into virtqueue; see spec)      */
+    uint8_t   fDeviceStatus;                                     /**< RW (driver writes device status, 0=reset) */
+    uint8_t   fIsrStatus;                                        /**< RW (driver writes ISR status, 0=reset)    */
+#ifdef LEGACY_MSIX_SUPPORTED
+    uint16_t  uMsixConfig;                                       /**< RW (driver sets MSI-X config vector)      */
+    uint16_t  uMsixVector;                                       /**< RW (driver sets MSI-X config vector)      */
+#endif
+} VIRTIO_LEGACY_PCI_COMMON_CFG_T, *PVIRTIO_LEGACY_PCI_COMMON_CFG_T;
+
+/**
+ * VirtIO 1.0 Capabilities' related MMIO-mapped structs:
+ *
+ * Note: virtio_pci_device_cap is dev-specific, implemented by client. Definition unknown here.
+ */
+typedef struct virtio_pci_common_cfg
+{
+    /* Device-specific fields */
+    uint32_t  uDeviceFeaturesSelect;                             /**< RW (driver selects device features)       */
+    uint32_t  uDeviceFeatures;                                   /**< RO (device reports features to driver)    */
+    uint32_t  uDriverFeaturesSelect;                             /**< RW (driver selects driver features)       */
+    uint32_t  uDriverFeatures;                                   /**< RW (driver-accepted device features)      */
+    uint16_t  uMsixConfig;                                       /**< RW (driver sets MSI-X config vector)      */
+    uint16_t  uNumVirtqs;                                        /**< RO (device specifies max queues)          */
+    uint8_t   fDeviceStatus;                                     /**< RW (driver writes device status, 0=reset) */
+    uint8_t   uConfigGeneration;                                 /**< RO (device changes when changing configs) */
+
+    /* Virtq-specific fields (values reflect (via MMIO) info related to queue indicated by uVirtqSelect. */
+    uint16_t  uVirtqSelect;                                      /**< RW (selects queue focus for these fields) */
+    uint16_t  uQueueSize;                                        /**< RW (queue size, 0 - 2^n)                  */
+    uint16_t  uMsixVector;                                       /**< RW (driver selects MSI-X queue vector)    */
+    uint16_t  uEnable;                                           /**< RW (driver controls usability of queue)   */
+    uint16_t  uNotifyOffset;                                     /**< RO (offset into virtqueue; see spec)      */
+    uint64_t  GCPhysVirtqDesc;                                   /**< RW (driver writes desc table phys addr)   */
+    uint64_t  GCPhysVirtqAvail;                                  /**< RW (driver writes avail ring phys addr)   */
+    uint64_t  GCPhysVirtqUsed;                                   /**< RW (driver writes used ring  phys addr)   */
+} VIRTIO_PCI_COMMON_CFG_T, *PVIRTIO_PCI_COMMON_CFG_T;
+
+typedef struct virtio_pci_notify_cap
+{
+    struct virtio_pci_cap pciCap;                                /**< Notification MMIO mapping capability      */
+    uint32_t uNotifyOffMultiplier;                               /**< notify_off_multiplier                     */
+} VIRTIO_PCI_NOTIFY_CAP_T, *PVIRTIO_PCI_NOTIFY_CAP_T;
+
+typedef struct virtio_pci_cfg_cap
+{
+    struct virtio_pci_cap pciCap;                                /**< Cap. defines the BAR/off/len to access    */
+    uint8_t uPciCfgData[4];                                      /**< I/O buf for above cap.                    */
+} VIRTIO_PCI_CFG_CAP_T, *PVIRTIO_PCI_CFG_CAP_T;
+
+/**
+ * PCI capability data locations (PCI CFG and MMIO).
+ */
+typedef struct VIRTIO_PCI_CAP_LOCATIONS_T
+{
+    uint16_t        offMmio;
+    uint16_t        cbMmio;
+    uint16_t        offPci;
+    uint16_t        cbPci;
+} VIRTIO_PCI_CAP_LOCATIONS_T;
+
+typedef struct VIRTQUEUE
+{
+    RTGCPHYS                    GCPhysVirtqDesc;                  /**< (MMIO) Addr of virtq's desc  ring   GUEST */
+    RTGCPHYS                    GCPhysVirtqAvail;                 /**< (MMIO) Addr of virtq's avail ring   GUEST */
+    RTGCPHYS                    GCPhysVirtqUsed;                  /**< (MMIO) Addr of virtq's used  ring   GUEST */
+    uint16_t                    uMsixVector;                      /**< (MMIO) MSI-X vector                 GUEST */
+    uint16_t                    uEnable;                          /**< (MMIO) Queue enable flag            GUEST */
+    uint16_t                    uNotifyOffset;                    /**< (MMIO) Notification offset for queue HOST */
+    uint16_t                    uQueueSize;                       /**< (MMIO) Size of queue           HOST/GUEST */
+    uint16_t                    uAvailIdxShadow;                  /**< Consumer's position in avail ring         */
+    uint16_t                    uUsedIdxShadow;                   /**< Consumer's position in used ring          */
+    uint16_t                    uVirtq;                           /**< Index of this queue                       */
+    char                        szName[32];                       /**< Dev-specific name of queue                */
+    bool                        fUsedRingEvent;                   /**< Flags if used idx to notify guest reached */
+    bool                        fAttached;                        /**< Flags if dev-specific client attached     */
+} VIRTQUEUE, *PVIRTQUEUE;
+
+/**
+ * The core/common state of the VirtIO PCI devices, shared edition.
+ */
+typedef struct VIRTIOCORE
+{
+    char                        szInstance[16];                   /**< Instance name, e.g. "VIRTIOSCSI0"         */
+    PPDMDEVINS                  pDevInsR0;                        /**< Client device instance                    */
+    PPDMDEVINS                  pDevInsR3;                        /**< Client device instance                    */
+    VIRTQUEUE                   aVirtqueues[VIRTQ_MAX_COUNT];     /**< (MMIO) VirtIO contexts for queues         */
+    uint64_t                    uDeviceFeatures;                  /**< (MMIO) Host features offered         HOST */
+    uint64_t                    uDriverFeatures;                  /**< (MMIO) Host features accepted       GUEST */
+    uint32_t                    fDriverFeaturesWritten;           /**< (MMIO) Host features complete tracking    */
+    uint32_t                    uDeviceFeaturesSelect;            /**< (MMIO) hi/lo select uDeviceFeatures GUEST */
+    uint32_t                    uDriverFeaturesSelect;            /**< (MMIO) hi/lo select uDriverFeatures GUEST */
+    uint32_t                    uMsixConfig;                      /**< (MMIO) MSI-X vector                 GUEST */
+    uint8_t                     fDeviceStatus;                    /**< (MMIO) Device Status                GUEST */
+    uint8_t                     fPrevDeviceStatus;                /**< (MMIO) Prev Device Status           GUEST */
+    uint8_t                     uConfigGeneration;                /**< (MMIO) Device config sequencer       HOST */
+    uint16_t                    uQueueNotify;                     /**< Caches queue idx in legacy mode     GUEST */
+    bool                        fGenUpdatePending;                /**< If set, update cfg gen after driver reads */
+    uint8_t                     uPciCfgDataOff;                   /**< Offset to PCI configuration data area     */
+    uint8_t                     uISR;                             /**< Interrupt Status Register.                */
+    uint8_t                     fMsiSupport;                      /**< Flag set if using MSI instead of ISR      */
+    uint16_t                    uVirtqSelect;                     /**< (MMIO) queue selector               GUEST */
+    uint32_t                    fLegacyDriver;                    /**< Set if guest drv < VirtIO 1.0 and allowed */
+    uint32_t                    fOfferLegacy;                     /**< Set at init call from dev-specific code   */
+
+    /** @name The locations of the capability structures in PCI config space and the BAR.
+     * @{ */
+    VIRTIO_PCI_CAP_LOCATIONS_T  LocPciCfgCap;                     /**< VIRTIO_PCI_CFG_CAP_T                      */
+    VIRTIO_PCI_CAP_LOCATIONS_T  LocNotifyCap;                     /**< VIRTIO_PCI_NOTIFY_CAP_T                   */
+    VIRTIO_PCI_CAP_LOCATIONS_T  LocCommonCfgCap;                  /**< VIRTIO_PCI_CAP_T                          */
+    VIRTIO_PCI_CAP_LOCATIONS_T  LocIsrCap;                        /**< VIRTIO_PCI_CAP_T                          */
+    VIRTIO_PCI_CAP_LOCATIONS_T  LocDeviceCap;                     /**< VIRTIO_PCI_CAP_T + custom data.           */
+    /** @} */
+
+    IOMMMIOHANDLE               hMmioPciCap;                      /**< MMIO handle of PCI cap. region (\#2)      */
+    IOMIOPORTHANDLE             hLegacyIoPorts;                   /**< Handle of legacy I/O port range.          */
+
+#ifdef VBOX_WITH_STATISTICS
+    /** @name Statistics
+     * @{ */
+    STAMCOUNTER                 StatDescChainsAllocated;
+    STAMCOUNTER                 StatDescChainsFreed;
+    STAMCOUNTER                 StatDescChainsSegsIn;
+    STAMCOUNTER                 StatDescChainsSegsOut;
+    STAMPROFILEADV              StatReadR3;                        /** I/O port and MMIO R3 Read profiling       */
+    STAMPROFILEADV              StatReadR0;                        /** I/O port and MMIO R0 Read profiling       */
+    STAMPROFILEADV              StatReadRC;                        /** I/O port and MMIO R3 Read profiling       */
+    STAMPROFILEADV              StatWriteR3;                       /** I/O port and MMIO R3 Write profiling      */
+    STAMPROFILEADV              StatWriteR0;                       /** I/O port and MMIO R3 Write profiling      */
+    STAMPROFILEADV              StatWriteRC;                       /** I/O port and MMIO R3 Write profiling      */
+#endif
+    /** @} */
+
+} VIRTIOCORE;
+
+#define MAX_NAME 64
+
+/**
+ * The core/common state of the VirtIO PCI devices, ring-3 edition.
+ */
+typedef struct VIRTIOCORER3
+{
+    /** @name Callbacks filled by the device before calling virtioCoreR3Init.
+     * @{  */
+    /**
+     * Implementation-specific client callback to report VirtIO when feature negotiation is
+     * complete. It should be invoked by the VirtIO core only once.
+     *
+     * @param   pVirtio           Pointer to the shared virtio state.
+     * @param   fDriverFeatures   Bitmask of features the guest driver has accepted/declined.
+     * @param   fLegacy           true if legacy mode offered and until guest driver identifies itself
+     *                            as modern(e.g. VirtIO 1.0 featured)
+     */
+    DECLCALLBACKMEMBER(void, pfnFeatureNegotiationComplete, (PVIRTIOCORE pVirtio, uint64_t fDriverFeatures, uint32_t fLegacy));
+
+    /**
+     * Implementation-specific client callback to notify client of significant device status
+     * changes.
+     *
+     * @param   pVirtio    Pointer to the shared virtio state.
+     * @param   pVirtioCC  Pointer to the ring-3 virtio state.
+     * @param   fDriverOk  True if guest driver is okay (thus queues, etc... are
+     *                     valid)
+     */
+    DECLCALLBACKMEMBER(void, pfnStatusChanged,(PVIRTIOCORE pVirtio, PVIRTIOCORECC pVirtioCC, uint32_t fDriverOk));
+
+    /**
+     * Implementation-specific client callback to access VirtIO Device-specific capabilities
+     * (other VirtIO capabilities and features are handled in VirtIO implementation)
+     *
+     * @param   pDevIns    The device instance.
+     * @param   offCap     Offset within device specific capabilities struct.
+     * @param   pvBuf      Buffer in which to save read data.
+     * @param   cbToRead   Number of bytes to read.
+     */
+    DECLCALLBACKMEMBER(int, pfnDevCapRead,(PPDMDEVINS pDevIns, uint32_t offCap, void *pvBuf, uint32_t cbToRead));
+
+    /**
+     * Implementation-specific client callback to access VirtIO Device-specific capabilities
+     * (other VirtIO capabilities and features are handled in VirtIO implementation)
+     *
+     * @param   pDevIns    The device instance.
+     * @param   offCap     Offset within device specific capabilities struct.
+     * @param   pvBuf      Buffer with the bytes to write.
+     * @param   cbToWrite  Number of bytes to write.
+     */
+    DECLCALLBACKMEMBER(int, pfnDevCapWrite,(PPDMDEVINS pDevIns, uint32_t offCap, const void *pvBuf, uint32_t cbWrite));
+
+    /**
+     * When guest-to-host queue notifications are enabled, the guest driver notifies the host
+     * that the avail queue has buffers, and this callback informs the client.
+     *
+     * @param   pVirtio    Pointer to the shared virtio state.
+     * @param   pVirtioCC  Pointer to the ring-3 virtio state.
+     * @param   uVirtqNbr   Index of the notified queue
+     */
+    DECLCALLBACKMEMBER(void, pfnVirtqNotified,(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr));
+
+    /** @} */
+
+    R3PTRTYPE(PVIRTIO_PCI_CFG_CAP_T)    pPciCfgCap;                /**< Pointer to struct in PCI config area.     */
+    R3PTRTYPE(PVIRTIO_PCI_NOTIFY_CAP_T) pNotifyCap;                /**< Pointer  to struct in PCI config area.    */
+    R3PTRTYPE(PVIRTIO_PCI_CAP_T)        pCommonCfgCap;             /**< Pointer to struct in PCI config area.     */
+    R3PTRTYPE(PVIRTIO_PCI_CAP_T)        pIsrCap;                   /**< Pointer to struct in PCI config area.     */
+    R3PTRTYPE(PVIRTIO_PCI_CAP_T)        pDeviceCap;                /**< Pointer to struct in PCI config area.     */
+
+    uint32_t                            cbDevSpecificCfg;          /**< Size of client's dev-specific config data */
+    R3PTRTYPE(uint8_t *)                pbDevSpecificCfg;          /**< Pointer to client's struct                */
+    R3PTRTYPE(uint8_t *)                pbPrevDevSpecificCfg;      /**< Previous read dev-specific cfg of client  */
+    bool                                fGenUpdatePending;         /**< If set, update cfg gen after driver reads */
+    char                                szMmioName[MAX_NAME];      /**< MMIO mapping name                         */
+    char                                szPortIoName[MAX_NAME];    /**< PORT mapping name                         */
+} VIRTIOCORER3;
+
+/**
+ * The core/common state of the VirtIO PCI devices, ring-0 edition.
+ */
+typedef struct VIRTIOCORER0
+{
+    /**
+     * This callback notifies the device-specific portion of this device implementation (if guest-to-host
+     * queue notifications are enabled), that the guest driver has notified the host (this device)
+     * that the VirtIO "avail" ring of a queue has some new s/g buffers added by the guest VirtIO driver.
+     *
+     * @param   pVirtio    Pointer to the shared virtio state.
+     * @param   pVirtioCC  Pointer to the ring-3 virtio state.
+     * @param   uVirtqNbr  Index of the notified queue
+     */
+    DECLCALLBACKMEMBER(void, pfnVirtqNotified,(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr));
+
+} VIRTIOCORER0;
+
+/**
+ * The core/common state of the VirtIO PCI devices, raw-mode edition.
+ */
+typedef struct VIRTIOCORERC
+{
+    uint64_t                    uUnusedAtTheMoment;
+} VIRTIOCORERC;
+
+/** @typedef VIRTIOCORECC
+ * The instance data for the current context. */
+typedef CTX_SUFF(VIRTIOCORE) VIRTIOCORECC;
+
+/** @name API for VirtIO parent device
+ * @{ */
+
+/**
+ * Setup PCI device controller and Virtio state
+ *
+ * This should be called from PDMDEVREGR3::pfnConstruct.
+ *
+ * @param   pDevIns                 Device instance.
+ * @param   pVirtio                 Pointer to the shared virtio state.  This
+ *                                  must be the first member in the shared
+ *                                  device instance data!
+ * @param   pVirtioCC               Pointer to the ring-3 virtio state.  This
+ *                                  must be the first member in the ring-3
+ *                                  device instance data!
+ * @param   pPciParams              Values to populate industry standard PCI Configuration Space data structure
+ * @param   pcszInstance            Device instance name (format-specifier)
+ * @param   fDevSpecificFeatures    VirtIO device-specific features offered by
+ *                                  client
+ * @param   cbDevSpecificCfg        Size of virtio_pci_device_cap device-specific struct
+ * @param   pvDevSpecificCfg        Address of client's dev-specific
+ *                                  configuration struct.
+ */
+int virtioCoreR3Init(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTIOCORECC pVirtioCC,
+                          PVIRTIOPCIPARAMS pPciParams, const char *pcszInstance,
+                          uint64_t fDevSpecificFeatures, uint32_t fOfferLegacy, void *pvDevSpecificCfg, uint16_t cbDevSpecificCfg);
+/**
+ * Initiate orderly reset procedure. This is an exposed API for clients that might need it.
+ * Invoked by client to reset the device and driver (see VirtIO 1.0 section 2.1.1/2.1.2)
+ *
+ * @param   pVirtio     Pointer to the virtio state.
+ */
+void  virtioCoreResetAll(PVIRTIOCORE pVirtio);
+
+/**
+ * Resets the device state upon a VM reset for instance.
+ *
+ * @param   pVirtio     Pointer to the virtio state.
+ *
+ * @note Calls back into the upper device when the status changes.
+ */
+DECLHIDDEN(void) virtioCoreR3ResetDevice(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTIOCORECC pVirtioCC);
+
+/**
+ * 'Attaches' host device-specific implementation's queue state to host VirtIO core
+ * virtqueue management infrastructure, informing the virtio core of the name of the
+ * queue to associate with the queue number.
+
+ * Note: uVirtqNbr (ordinal index) is used as the 'handle' for virtqs in this VirtioCore
+ * implementation's API (as an opaque selector into the VirtIO core's array of queues' states).
+ *
+ * Virtqueue numbers are actually VirtIO-specification defined device-specifically
+ * (i.e. they are unique within each VirtIO device type), but are in some cases scalable
+ * so only the pattern of queue numbers is defined by the spec and implementations may contain
+ * a self-determined plurality of queues.
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ * @param   pcszName    Name to give queue
+ *
+ * @returns VBox status code.
+ */
+int  virtioCoreR3VirtqAttach(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr, const char *pcszName);
+
+/**
+ * Detaches host device-specific implementation's queue state from the host VirtIO core
+ * virtqueue management infrastructure, informing the VirtIO core that the queue is
+ * not utilized by the device-specific code.
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ * @param   pcszName    Name to give queue
+ *
+ * @returns VBox status code.
+ */
+int  virtioCoreR3VirtqDetach(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr);
+
+/**
+ * Checks to see whether queue is attached to core.
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ *
+ * Returns boolean true or false indicating whether dev-specific reflection
+ * of queue is attached to core.
+ */
+bool  virtioCoreR3VirtqIsAttached(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr);
+
+/**
+ * Checks to see whether queue is enabled.
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ *
+ * Returns boolean true or false indicating core queue enable state.
+ * There is no API function to enable the queue, because the actual enabling is handled
+ * by the guest via MMIO.
+ *
+ * NOTE: Guest VirtIO driver's claim over this state is overridden (which violates VirtIO 1.0 spec
+ * in a carefully controlled manner) in the case where the queue MUST be disabled, due to observed
+ * control queue corruption (e.g. null GCPhys virtq base addr) while restoring legacy-only device's
+ * (DevVirtioNet.cpp) as a way to flag that the queue is unusable-as-saved and must to be removed.
+ * That is all handled in the load/save exec logic. Device reset could potentially, depending on
+ * parameters passed from host VirtIO device to guest VirtIO driver, result in guest re-establishing
+ * queue, except, in that situation, the queue operational state would be valid.
+ */
+bool  virtioCoreR3VirtqIsEnabled(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr);
+
+/**
+ * Enable or disable notification for the specified queue.
+ *
+ * When queue notifications are enabled, the guest VirtIO driver notifies host VirtIO device
+ * (via MMIO, see VirtIO 1.0, 4.1.4.4 "Notification Structure Layout") whenever guest driver adds
+ * a new s/g buffer to the "avail" ring of the queue.
+ *
+ * Note: VirtIO queue layout includes flags the device controls in "used" ring to inform guest
+ * driver if it should notify host of guest's buffer additions to the "avail" ring, and
+ * conversely, the guest driver sets flags in the "avail" ring to communicate to host device
+ * whether or not to interrupt guest when it adds buffers to used ring.
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ * @param   fEnable     Selects notification mode (enabled or disabled)
+ */
+void  virtioCoreVirtqEnableNotify(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr, bool fEnable);
+
+/**
+ * Notifies guest (via ISR or MSI-X) of device configuration change
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ */
+void  virtioCoreNotifyConfigChanged(PVIRTIOCORE pVirtio);
+
+/**
+ * Displays a well-formatted human-readable translation of otherwise inscrutable bitmasks
+ * that embody features VirtIO specification definitions, indicating: Totality of features
+ * that can be implemented by host and guest, which features were offered by the host, and
+ * which were actually accepted by the guest. It displays it as a summary view of the device's
+ * finalized operational state (host-guest negotiated architecture) in such a way that shows
+ * which options are available for implementing or enabling.
+ *
+ * The non-device-specific VirtIO features list are managed by core API (e.g. implied).
+ * Only dev-specific features must be passed as parameter.
+
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   pHlp        Pointer to the debug info hlp struct
+ * @param   s_aDevSpecificFeatures  Dev-specific features (virtio-net, virtio-scsi...)
+ * @param   cFeatures   Number of features in aDevSpecificFeatures
+ */
+void  virtioCorePrintDeviceFeatures(VIRTIOCORE *pVirtio, PCDBGFINFOHLP pHlp,
+    const VIRTIO_FEATURES_LIST *aDevSpecificFeatures, int cFeatures);
+
+/*
+ * Debug-assist utility function to display state of the VirtIO core code, including
+ * an overview of the state of all of the queues.
+ *
+ * This can be invoked when running the VirtualBox debugger, or from the command line
+ * using the command: "VboxManage debugvm <VM name or id> info <device name> [args]"
+ *
+ * Example:  VBoxManage debugvm myVnetVm info "virtio-net" help
+ *
+ * This is implemented currently to be invoked by the inheriting device-specific code
+ * (see the the VirtualBox virtio-net (VirtIO network controller device implementation)
+ * for an example of code that receive debugvm callback directly).
+ *
+ * DevVirtioNet lists available sub-options if no arguments are provided. In that
+ * example this virtq info related function is invoked hierarchically when virtio-net
+ * displays its device-specific queue info.
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pHlp        Pointer to the debug info hlp struct
+ * @param   pszArgs     Arguments to function
+ */
+void  virtioCoreR3VirtqInfo(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs, int uVirtqNbr);
+
+/**
+ * Returns the number of avail bufs in the virtq.
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtqueue to return the count of buffers available for.
+ */
+uint16_t virtioCoreVirtqAvailBufCount(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr);
+
+#ifdef VIRTIO_VBUF_ON_STACK
+/**
+ * This function is identical to virtioCoreR3VirtqAvailBufGet(), *except* it doesn't consume
+ * peeked buffer from avail ring of the virtq. The function *becomes* identical to the
+ * virtioCoreR3VirtqAvailBufGet() only if virtioCoreR3VirtqAvailRingNext() is invoked to
+ * consume buf from the queue's avail ring, followed by invocation of virtioCoreR3VirtqUsedBufPut(),
+ * to hand host-processed buffer back to guest, which completes guest-initiated virtq buffer circuit.
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ * @param   pVirtqBuf   Pointer to descriptor chain that contains the
+ *                      pre-processed transaction information pulled from the virtq.
+ *
+ * @returns VBox status code:
+ * @retval  VINF_SUCCESS         Success
+ * @retval  VERR_INVALID_STATE   VirtIO not in ready state (asserted).
+ * @retval  VERR_NOT_AVAILABLE   If the queue is empty.
+ */
+int  virtioCoreR3VirtqAvailBufPeek(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr,
+                                   PVIRTQBUF pVirtqBuf);
+
+/**
+ * This function fetches the next buffer (descriptor chain) from the VirtIO "avail" ring of
+ * indicated queue, separating the buf's s/g vectors into OUT (e.g. guest-to-host)
+ * components and and IN (host-to-guest) components.
+ *
+ * Caller is responsible for GCPhys to host virtual memory conversions. If the
+ * virtq buffer being peeked at is "consumed", virtioCoreR3VirtqAvailRingNext() must
+ * be called, and after that virtioCoreR3VirtqUsedBufPut() must be called to
+ * complete the buffer transfer cycle with the guest.
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ * @param   pVirtqBuf   Pointer to descriptor chain that contains the
+ *                      pre-processed transaction information pulled from the virtq.
+ * @param   fRemove     flags whether to remove desc chain from queue (false = peek)
+ *
+ * @returns VBox status code:
+ * @retval  VINF_SUCCESS         Success
+ * @retval  VERR_INVALID_STATE   VirtIO not in ready state (asserted).
+ * @retval  VERR_NOT_AVAILABLE   If the queue is empty.
+ */
+int  virtioCoreR3VirtqAvailBufGet(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr,
+                                  PVIRTQBUF pVirtqBuf, bool fRemove);
+
+/**
+ * Fetches a specific descriptor chain using avail ring of indicated queue and converts the
+ * descriptor chain into its OUT (to device) and IN (to guest) components.
+ *
+ * The caller is responsible for GCPhys to host virtual memory conversions and *must*
+ * return the virtq buffer using virtioCoreR3VirtqUsedBufPut() to complete the roundtrip
+ * virtq transaction.
+ * *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ * @param   pVirtqBuf   Pointer to descriptor chain that contains the
+ *                      pre-processed transaction information pulled from the virtq.
+ * @param   fRemove     flags whether to remove desc chain from queue (false = peek)
+ *
+ * @returns VBox status code:
+ * @retval  VINF_SUCCESS         Success
+ * @retval  VERR_INVALID_STATE   VirtIO not in ready state (asserted).
+ * @retval  VERR_NOT_AVAILABLE   If the queue is empty.
+ */
+int virtioCoreR3VirtqAvailBufGet(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr,
+                                  uint16_t uHeadIdx, PVIRTQBUF pVirtqBuf);
+#else /* !VIRTIO_VBUF_ON_STACK */
+/**
+ * This function is identical to virtioCoreR3VirtqAvailBufGet(), *except* it doesn't consume
+ * peeked buffer from avail ring of the virtq. The function *becomes* identical to the
+ * virtioCoreR3VirtqAvailBufGet() only if virtioCoreR3VirtqAvailRingNext() is invoked to
+ * consume buf from the queue's avail ring, followed by invocation of virtioCoreR3VirtqUsedBufPut(),
+ * to hand host-processed buffer back to guest, which completes guest-initiated virtq buffer circuit.
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ * @param   ppVirtqBuf  Address to store pointer to descriptor chain that contains the
+ *                      pre-processed transaction information pulled from the virtq.
+ *
+ * @returns VBox status code:
+ * @retval  VINF_SUCCESS         Success
+ * @retval  VERR_INVALID_STATE   VirtIO not in ready state (asserted).
+ * @retval  VERR_NOT_AVAILABLE   If the queue is empty.
+ */
+int  virtioCoreR3VirtqAvailBufPeek(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr,
+                                   PPVIRTQBUF ppVirtqBuf);
+
+/**
+ * This function fetches the next buffer (descriptor chain) from the VirtIO "avail" ring of
+ * indicated queue, separating the buf's s/g vectors into OUT (e.g. guest-to-host)
+ * components and and IN (host-to-guest) components.
+ *
+ * Caller is responsible for GCPhys to host virtual memory conversions. If the
+ * virtq buffer being peeked at is "consumed", virtioCoreR3VirtqAvailRingNext() must
+ * be called, and after that virtioCoreR3VirtqUsedBufPut() must be called to
+ * complete the buffer transfer cycle with the guest.
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ * @param   ppVirtqBuf  Address to store pointer to descriptor chain that contains the
+ *                      pre-processed transaction information pulled from the virtq.
+ *                      Returned reference must be released by calling
+ *                      virtioCoreR3VirtqBufRelease().
+ * @param   fRemove     flags whether to remove desc chain from queue (false = peek)
+ *
+ * @returns VBox status code:
+ * @retval  VINF_SUCCESS         Success
+ * @retval  VERR_INVALID_STATE   VirtIO not in ready state (asserted).
+ * @retval  VERR_NOT_AVAILABLE   If the queue is empty.
+ */
+int  virtioCoreR3VirtqAvailBufGet(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr,
+                                  PPVIRTQBUF ppVirtqBuf, bool fRemove);
+
+/**
+ * Fetches a specific descriptor chain using avail ring of indicated queue and converts the
+ * descriptor chain into its OUT (to device) and IN (to guest) components.
+ *
+ * The caller is responsible for GCPhys to host virtual memory conversions and *must*
+ * return the virtq buffer using virtioCoreR3VirtqUsedBufPut() to complete the roundtrip
+ * virtq transaction.
+ * *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ * @param   ppVirtqBuf  Address to store pointer to descriptor chain that contains the
+ *                      pre-processed transaction information pulled from the virtq.
+ *                      Returned reference must be released by calling
+ *                      virtioCoreR3VirtqBufRelease().
+ * @param   fRemove     flags whether to remove desc chain from queue (false = peek)
+ *
+ * @returns VBox status code:
+ * @retval  VINF_SUCCESS         Success
+ * @retval  VERR_INVALID_STATE   VirtIO not in ready state (asserted).
+ * @retval  VERR_NOT_AVAILABLE   If the queue is empty.
+ */
+int virtioCoreR3VirtqAvailBufGet(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr,
+                                  uint16_t uHeadIdx, PPVIRTQBUF ppVirtqBuf);
+#endif /* !VIRTIO_VBUF_ON_STACK */
+
+/**
+ * Returns data to the guest to complete a transaction initiated by virtioCoreR3VirtqAvailBufGet(),
+ * (or virtioCoreR3VirtqAvailBufPeek()/virtioCoreR3VirtqBufSync() call pair), to complete each
+ * buffer transfer transaction (guest-host buffer cycle), ultimately moving each descriptor chain
+ * from the avail ring of a queue onto the used ring of the queue. Note that VirtIO buffer
+ * transactions are *always* initiated by the guest and completed by the host. In other words,
+ * for the host to send any I/O related data to the guest (and in some cases configuration data),
+ * the guest must provide buffers via the virtq's avail ring, for the host to fill.
+ *
+ * At some some point virtioCoreR3VirtqUsedRingSync() must be called to return data to the guest,
+ * completing all pending virtioCoreR3VirtqAvailBufPut() operations that have accumulated since
+ * the last call to virtioCoreR3VirtqUsedRingSync().
+
+ * @note This function effectively performs write-ahead to the used ring of the virtq.
+ *       Data written won't be seen by the guest until the next call to virtioCoreVirtqUsedRingSync()
+ *
+ * @param   pDevIns         The device instance (for reading).
+ * @param   pVirtio         Pointer to the shared virtio state.
+ * @param   uVirtqNbr       Virtq number
+ *
+ * @param   pSgVirtReturn   Points to scatter-gather buffer of virtual memory
+ *                          segments the caller is returning to the guest.
+ *
+ * @param   pVirtqBuf       This contains the context of the scatter-gather
+ *                          buffer originally pulled from the queue.
+ *
+ * @param   fFence          If true (default), put up copy-fence (memory barrier) after
+ *                          copying to guest phys. mem.
+ *
+ * @returns VBox status code.
+ * @retval  VINF_SUCCESS       Success
+ * @retval  VERR_INVALID_STATE VirtIO not in ready state
+ * @retval  VERR_NOT_AVAILABLE Virtq is empty
+ *
+ * @note    This function will not release any reference to pVirtqBuf.  The
+ *          caller must take care of that.
+ */
+int virtioCoreR3VirtqUsedBufPut(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr, PRTSGBUF pSgVirtReturn,
+                                 PVIRTQBUF pVirtqBuf, bool fFence = true);
+
+
+/**
+ * Quicker variant of same-named function (directly above) that it overloads,
+ * Instead, this variant accepts as input a pointer to a buffer and count,
+ * instead of S/G buffer thus doesn't have to copy between two S/G buffers and avoids some overhead.
+ *
+ * @param   pDevIns         The device instance (for reading).
+ * @param   pVirtio         Pointer to the shared virtio state.
+ * @param   uVirtqNbr       Virtq number
+ * @param   cb              Number of bytes to add to copy to phys. buf.
+ * @param   pv              Virtual mem buf to copy to phys buf.
+ * @param   cbEnqueue       How many bytes in packet to enqueue (0 = don't enqueue)
+ * @param   fFence          If true (default), put up copy-fence (memory barrier) after
+ *                          copying to guest phys. mem.
+ *
+ * @returns VBox status code.
+ * @retval  VINF_SUCCESS       Success
+ * @retval  VERR_INVALID_STATE VirtIO not in ready state
+ * @retval  VERR_NOT_AVAILABLE Virtq is empty
+ *
+ * @note    This function will not release any reference to pVirtqBuf.  The
+ *          caller must take care of that.
+ */
+int virtioCoreR3VirtqUsedBufPut(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtq, size_t cb, const void *pv,
+                            PVIRTQBUF pVirtqBuf, size_t cbEnqueue, bool fFence = true);
+
+
+/**
+ * Advance index of avail ring to next entry in specified virtq (see virtioCoreR3VirtqAvailBufPeek())
+ *
+ * @param   pVirtio      Pointer to the virtio state.
+ * @param   uVirtqNbr    Index of queue
+ */
+int virtioCoreR3VirtqAvailBufNext(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr);
+
+/**
+ * Checks to see if guest has accepted host device's VIRTIO_F_VERSION_1 (i.e. "modern")
+ * behavioral modeling, indicating guest agreed to comply with the modern VirtIO 1.0+ specification.
+ * Otherwise unavoidable presumption is that the host device is dealing with legacy VirtIO
+ * guest driver, thus must be prepared to cope with less mature architecture and behaviors
+ * from prototype era of VirtIO. (see comments in PDM-invoked device constructor for more
+ * information).
+ *
+ * @param   pVirtio      Pointer to the virtio state.
+ */
+int virtioCoreIsLegacyMode(PVIRTIOCORE pVirtio);
+
+/**
+ * This VirtIO transitional device supports "modern" (rev 1.0+) as well as "legacy" (e.g. < 1.0) VirtIO drivers.
+ * Some legacy guest drivers are known to mishandle PCI bus mastering wherein the PCI flavor of GC phys
+ * access functions can't be used. The following wrappers select the memory access method based on whether the
+ * device is operating in legacy mode or not.
+ */
+DECLINLINE(int) virtioCoreGCPhysWrite(PVIRTIOCORE pVirtio, PPDMDEVINS pDevIns, RTGCPHYS GCPhys, void *pvBuf, size_t cbWrite)
+{
+    int rc;
+    if (virtioCoreIsLegacyMode(pVirtio))
+        rc = PDMDevHlpPhysWrite(pDevIns, GCPhys, pvBuf, cbWrite);
+    else
+        rc = PDMDevHlpPCIPhysWrite(pDevIns, GCPhys, pvBuf, cbWrite);
+    return rc;
+}
+
+DECLINLINE(int) virtioCoreGCPhysRead(PVIRTIOCORE pVirtio, PPDMDEVINS pDevIns, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
+{
+    int rc;
+    if (virtioCoreIsLegacyMode(pVirtio))
+        rc = PDMDevHlpPhysRead(pDevIns, GCPhys, pvBuf, cbRead);
+    else
+        rc = PDMDevHlpPCIPhysRead(pDevIns, GCPhys, pvBuf, cbRead);
+    return rc;
+}
+
+/*
+ * (See comments for corresponding function in sg.h)
+ */
+DECLINLINE(void) virtioCoreGCPhysChainInit(PVIRTIOSGBUF pGcSgBuf, PVIRTIOSGSEG paSegs, size_t cSegs)
+{
+    AssertPtr(pGcSgBuf);
+    Assert((cSegs > 0 && RT_VALID_PTR(paSegs)) || (!cSegs && !paSegs));
+    Assert(cSegs < (~(unsigned)0 >> 1));
+
+    pGcSgBuf->paSegs = paSegs;
+    pGcSgBuf->cSegs  = (unsigned)cSegs;
+    pGcSgBuf->idxSeg = 0;
+    if (cSegs && paSegs)
+    {
+        pGcSgBuf->GCPhysCur = paSegs[0].GCPhys;
+        pGcSgBuf->cbSegLeft = paSegs[0].cbSeg;
+    }
+    else
+    {
+        pGcSgBuf->GCPhysCur = 0;
+        pGcSgBuf->cbSegLeft = 0;
+    }
+}
+
+/*
+ * (See comments for corresponding function in sg.h)
+ */
+DECLINLINE(RTGCPHYS) virtioCoreGCPhysChainGet(PVIRTIOSGBUF pGcSgBuf, size_t *pcbData)
+{
+    size_t cbData;
+    RTGCPHYS pGcBuf;
+
+    /* Check that the S/G buffer has memory left. */
+    if (RT_LIKELY(pGcSgBuf->idxSeg < pGcSgBuf->cSegs || pGcSgBuf->cbSegLeft))
+    { /* likely */ }
+    else
+    {
+        *pcbData = 0;
+        return 0;
+    }
+
+    AssertMsg(    pGcSgBuf->cbSegLeft <= 128 * _1M
+              && (RTGCPHYS)pGcSgBuf->GCPhysCur >= (RTGCPHYS)pGcSgBuf->paSegs[pGcSgBuf->idxSeg].GCPhys
+              && (RTGCPHYS)pGcSgBuf->GCPhysCur + pGcSgBuf->cbSegLeft <=
+                   (RTGCPHYS)pGcSgBuf->paSegs[pGcSgBuf->idxSeg].GCPhys + pGcSgBuf->paSegs[pGcSgBuf->idxSeg].cbSeg,
+                 ("pGcSgBuf->idxSeg=%d pGcSgBuf->cSegs=%d pGcSgBuf->GCPhysCur=%p pGcSgBuf->cbSegLeft=%zd "
+                  "pGcSgBuf->paSegs[%d].GCPhys=%p pGcSgBuf->paSegs[%d].cbSeg=%zd\n",
+                  pGcSgBuf->idxSeg, pGcSgBuf->cSegs, pGcSgBuf->GCPhysCur, pGcSgBuf->cbSegLeft,
+                  pGcSgBuf->idxSeg, pGcSgBuf->paSegs[pGcSgBuf->idxSeg].GCPhys, pGcSgBuf->idxSeg,
+                  pGcSgBuf->paSegs[pGcSgBuf->idxSeg].cbSeg));
+
+    cbData = RT_MIN(*pcbData, pGcSgBuf->cbSegLeft);
+    pGcBuf = pGcSgBuf->GCPhysCur;
+    pGcSgBuf->cbSegLeft -= cbData;
+    if (!pGcSgBuf->cbSegLeft)
+    {
+        pGcSgBuf->idxSeg++;
+
+        if (pGcSgBuf->idxSeg < pGcSgBuf->cSegs)
+        {
+            pGcSgBuf->GCPhysCur = pGcSgBuf->paSegs[pGcSgBuf->idxSeg].GCPhys;
+            pGcSgBuf->cbSegLeft = pGcSgBuf->paSegs[pGcSgBuf->idxSeg].cbSeg;
+        }
+        *pcbData = cbData;
+    }
+    else
+        pGcSgBuf->GCPhysCur = pGcSgBuf->GCPhysCur + cbData;
+
+    return pGcBuf;
+}
+
+/*
+ * (See comments for corresponding function in sg.h)
+ */
+DECLINLINE(void) virtioCoreGCPhysChainReset(PVIRTIOSGBUF pGcSgBuf)
+{
+    AssertPtrReturnVoid(pGcSgBuf);
+
+    pGcSgBuf->idxSeg = 0;
+    if (pGcSgBuf->cSegs)
+    {
+        pGcSgBuf->GCPhysCur = pGcSgBuf->paSegs[0].GCPhys;
+        pGcSgBuf->cbSegLeft = pGcSgBuf->paSegs[0].cbSeg;
+    }
+    else
+    {
+        pGcSgBuf->GCPhysCur = 0;
+        pGcSgBuf->cbSegLeft = 0;
+    }
+}
+
+/*
+ * (See comments for corresponding function in sg.h)
+ */
+DECLINLINE(RTGCPHYS) virtioCoreGCPhysChainAdvance(PVIRTIOSGBUF pGcSgBuf, size_t cbAdvance)
+{
+    AssertReturn(pGcSgBuf, 0);
+
+    size_t cbLeft = cbAdvance;
+    while (cbLeft)
+    {
+        size_t cbThisAdvance = cbLeft;
+        virtioCoreGCPhysChainGet(pGcSgBuf, &cbThisAdvance);
+        if (!cbThisAdvance)
+            break;
+
+        cbLeft -= cbThisAdvance;
+    }
+    return cbAdvance - cbLeft;
+}
+
+/*
+ * (See comments for corresponding function in sg.h)
+ */
+DECLINLINE(RTGCPHYS) virtioCoreGCPhysChainGetNextSeg(PVIRTIOSGBUF pGcSgBuf, size_t *pcbSeg)
+{
+    AssertReturn(pGcSgBuf, 0);
+    AssertPtrReturn(pcbSeg, 0);
+
+    if (!*pcbSeg)
+        *pcbSeg = pGcSgBuf->cbSegLeft;
+
+    return virtioCoreGCPhysChainGet(pGcSgBuf, pcbSeg);
+}
+
+/**
+ * Calculate the length of a GCPhys s/g buffer by tallying the size of each segment.
+ *
+ * @param   pGcSgBuf        Guest Context (GCPhys) S/G buffer to calculate length of
+ */
+DECLINLINE(size_t) virtioCoreGCPhysChainCalcBufSize(PCVIRTIOSGBUF pGcSgBuf)
+{
+    size_t   cb = 0;
+    unsigned i  = pGcSgBuf->cSegs;
+    while (i-- > 0)
+        cb += pGcSgBuf->paSegs[i].cbSeg;
+    return cb;
+}
+
+/*
+ * (See comments for corresponding function in sg.h)
+ */
+DECLINLINE(size_t) virtioCoreGCPhysChainCalcLengthLeft(PVIRTIOSGBUF pGcSgBuf)
+{
+    size_t   cb = pGcSgBuf->cbSegLeft;
+    unsigned i  = pGcSgBuf->cSegs;
+    while (i-- > pGcSgBuf->idxSeg + 1)
+        cb += pGcSgBuf->paSegs[i].cbSeg;
+    return cb;
+}
+#define VIRTQNAME(a_pVirtio, a_uVirtq) ((a_pVirtio)->aVirtqueues[(a_uVirtq)].szName)
+
+/**
+ * Convert and append bytes from a virtual-memory simple buffer to VirtIO guest's
+ * physical memory described by a buffer pulled form the avail ring of a virtq.
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   pVirtqBuf   VirtIO buffer to fill
+ * @param   pv          input: virtual memory buffer to receive bytes
+ * @param   cb          number of bytes to add to the s/g buffer.
+ */
+DECLINLINE(void) virtioCoreR3VirqBufFill(PVIRTIOCORE pVirtio, PVIRTQBUF pVirtqBuf, void *pv, size_t cb)
+{
+    uint8_t *pvBuf = (uint8_t *)pv;
+    size_t cbRemain = cb, cbTotal = 0;
+    PVIRTIOSGBUF pSgPhysReturn = pVirtqBuf->pSgPhysReturn;
+    while (cbRemain)
+    {
+        size_t cbBounded = RT_MIN(pSgPhysReturn->cbSegLeft, cbRemain);
+        Assert(cbBounded > 0);
+        virtioCoreGCPhysWrite(pVirtio, CTX_SUFF(pVirtio->pDevIns), (RTGCPHYS)pSgPhysReturn->GCPhysCur, pvBuf, cbBounded);
+        virtioCoreGCPhysChainAdvance(pSgPhysReturn, cbBounded);
+        pvBuf += cbBounded;
+        cbRemain -= cbBounded;
+        cbTotal += cbBounded;
+    }
+    LogFunc(("Appended %d bytes to guest phys buf [head: %u]. %d bytes unused in buf.)\n",
+             cbTotal, pVirtqBuf->uHeadIdx, virtioCoreGCPhysChainCalcLengthLeft(pSgPhysReturn)));
+}
+
+/**
+ * Extract some bytes from of a virtq s/g buffer, converting them from GCPhys space to
+ * to ordinary virtual memory (i.e. making data directly accessible to host device code)
+ *
+ * As a performance optimization, it is left to the caller to validate buffer size.
+ *
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   pVirtqBuf   input: virtq buffer
+ * @param   pv          output: virtual memory buffer to receive bytes
+ * @param   cb          number of bytes to Drain from buffer
+ */
+DECLINLINE(void) virtioCoreR3VirtqBufDrain(PVIRTIOCORE pVirtio, PVIRTQBUF pVirtqBuf, void *pv, size_t cb)
+{
+    uint8_t *pb = (uint8_t *)pv;
+    size_t cbLim = RT_MIN(pVirtqBuf->cbPhysSend, cb);
+    while (cbLim)
+    {
+        size_t cbSeg = cbLim;
+        RTGCPHYS GCPhys = virtioCoreGCPhysChainGetNextSeg(pVirtqBuf->pSgPhysSend, &cbSeg);
+        PDMDevHlpPCIPhysRead(pVirtio->pDevInsR3, GCPhys, pb, cbSeg);
+        pb += cbSeg;
+        cbLim -= cbSeg;
+        pVirtqBuf->cbPhysSend -= cbSeg;
+    }
+    LogFunc(("Drained %d/%d bytes from %s buffer, head idx: %u (%d bytes left)\n",
+             cb - cbLim, cb, VIRTQNAME(pVirtio, pVirtqBuf->uVirtq),
+             pVirtqBuf->uHeadIdx, virtioCoreGCPhysChainCalcLengthLeft(pVirtqBuf->pSgPhysReturn)));
+}
+
+#undef VIRTQNAME
+
+/**
+ * Updates indicated virtq's "used ring" descriptor index to match "shadow" index that tracks
+ * pending buffers added to the used ring, thus exposing all the data added by virtioCoreR3VirtqUsedBufPut()
+ * to the "used ring" since the last virtioCoreVirtqUsedRingSync().
+ *
+ * This *must* be invoked after one or more virtioCoreR3VirtqUsedBufPut() calls to inform guest driver
+ * there is data in the queue. If enabled by guest, IRQ or MSI-X signalling will notify guest
+ * proactively, otherwise guest detects updates by polling. (see VirtIO 1.0, Section 2.4 "Virtqueues").
+ *
+ * @param   pDevIns     The device instance.
+ * @param   pVirtio     Pointer to the shared virtio state.
+ * @param   uVirtqNbr   Virtq number
+ *
+ * @returns VBox status code.
+ * @retval  VINF_SUCCESS       Success
+ * @retval  VERR_INVALID_STATE VirtIO not in ready state
+ */
+int  virtioCoreVirtqUsedRingSync(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, uint16_t uVirtqNbr);
+
+#ifdef VIRTIO_VBUF_ON_STACK
+/**
+ * Allocates a descriptor chain object with the reference count of one. Copying the reference
+ * to this object requires a call to virtioCoreR3VirtqBufRetain. All references must be later
+ * released with virtioCoreR3VirtqBufRelease. Just to be clear, one alloc plus one retain will
+ * require two releases.
+ *
+ * @returns A descriptor chain object.
+ *
+ * @retval  NULL if out of memory.
+ *
+ * NOTE: VIRTQBUF_T objects allocated on the stack will have garbage in the u32Magic field,
+ * triggering an assertion if virtioCoreR3VirtqBufRelease is called on them.
+ */
+PVIRTQBUF virtioCoreR3VirtqBufAlloc(void);
+#endif /* VIRTIO_VBUF_ON_STACK */
+
+/**
+ * Retains a reference to the given descriptor chain.
+ *
+ * @param   pVirtqBuf      The descriptor chain to reference.
+ *
+ * @returns New reference count.
+ * @retval  UINT32_MAX on invalid parameter.
+ */
+uint32_t virtioCoreR3VirtqBufRetain(PVIRTQBUF pVirtqBuf);
+
+/**
+ * Releases a reference to the given descriptor chain.
+ *
+ * @param   pVirtio         Pointer to the shared virtio state.
+ * @param   pVirtqBuf       The descriptor chain to reference.  NULL is quietly
+ *                          ignored (returns 0).
+ * @returns New reference count.
+ * @retval  0 if freed or invalid parameter.
+ */
+uint32_t virtioCoreR3VirtqBufRelease(PVIRTIOCORE pVirtio, PVIRTQBUF pVirtqBuf);
+
+/**
+ * Return queue enable state
+ *
+ * @param   pVirtio      Pointer to the virtio state.
+ * @param   uVirtqNbr    Virtq number.
+ *
+ * @returns true or false indicating queue is enabled or not.
+ */
+DECLINLINE(bool) virtioCoreIsVirtqEnabled(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr)
+{
+    Assert(uVirtqNbr < RT_ELEMENTS(pVirtio->aVirtqueues));
+    if (pVirtio->fLegacyDriver)
+        return pVirtio->aVirtqueues[uVirtqNbr].GCPhysVirtqDesc != 0;
+    return pVirtio->aVirtqueues[uVirtqNbr].uEnable != 0;
+}
+
+/**
+ * Get name of queue, via uVirtqNbr, assigned during virtioCoreR3VirtqAttach()
+ *
+ * @param   pVirtio     Pointer to the virtio state.
+ * @param   uVirtqNbr   Virtq number.
+ *
+ * @returns Pointer to read-only queue name.
+ */
+DECLINLINE(const char *) virtioCoreVirtqGetName(PVIRTIOCORE pVirtio, uint16_t uVirtqNbr)
+{
+    Assert((size_t)uVirtqNbr < RT_ELEMENTS(pVirtio->aVirtqueues));
+    return pVirtio->aVirtqueues[uVirtqNbr].szName;
+}
+
+/**
+ * Get the bitmask of features VirtIO is running with. This is called by the device-specific
+ * VirtIO implementation to identify this device's operational configuration after features
+ * have been negotiated with guest VirtIO driver. Feature negotiation entails host indicating
+ * to guest which features it supports, then guest accepting from among the offered, which features
+ * it will enable. That becomes the agreement between the host and guest. The bitmask containing
+ * virtio core features plus device-specific features is provided as a parameter to virtioCoreR3Init()
+ * by the host side device-specific virtio implementation.
+ *
+ * @param   pVirtio     Pointer to the virtio state.
+ *
+ * @returns Features the guest driver has accepted, finalizing the operational features
+ */
+DECLINLINE(uint64_t) virtioCoreGetNegotiatedFeatures(PVIRTIOCORE pVirtio)
+{
+    return pVirtio->uDriverFeatures;
+}
+
+/**
+ * Get name of the VM state change associated with the enumeration variable
+ *
+ * @param enmState       VM state (enumeration value)
+ *
+ * @returns associated text.
+ */
+const char *virtioCoreGetStateChangeText(VIRTIOVMSTATECHANGED enmState);
+
+/**
+ * Debug assist code for any consumer that inherits VIRTIOCORE.
+ * Log memory-mapped I/O input or output value.
+ *
+ * This is to be invoked by macros that assume they are invoked in functions with
+ * the relevant arguments. (See Virtio_1_0.cpp).
+ *
+ * It is exposed via the API so inheriting device-specific clients can provide similar
+ * logging capabilities for a consistent look-and-feel.
+ *
+ * @param   pszFunc     To avoid displaying this function's name via __FUNCTION__ or LogFunc()
+ * @param   pszMember   Name of struct member
+ * @param   pv          pointer to value
+ * @param   cb          size of value
+ * @param   uOffset     offset into member where value starts
+ * @param   fWrite      True if write I/O
+ * @param   fHasIndex   True if the member is indexed
+ * @param   idx         The index if fHasIndex
+ */
+void virtioCoreLogMappedIoValue(const char *pszFunc, const char *pszMember, uint32_t uMemberSize,
+                                const void *pv, uint32_t cb, uint32_t uOffset,
+                                int fWrite, int fHasIndex, uint32_t idx);
+
+/**
+ * Debug assist for any consumer
+ *
+ * Does a formatted hex dump using Log(()), recommend using VIRTIO_HEX_DUMP() macro to
+ * control enabling of logging efficiently.
+ *
+ * @param   pv          pointer to buffer to dump contents of
+ * @param   cb          count of characters to dump from buffer
+ * @param   uBase       base address of per-row address prefixing of hex output
+ * @param   pszTitle    Optional title. If present displays title that lists
+ *                      provided text with value of cb to indicate VIRTQ_SIZE next to it.
+ */
+void virtioCoreHexDump(uint8_t *pv, uint32_t cb, uint32_t uBase, const char *pszTitle);
+
+/**
+ * Debug assist for any consumer device code
+ * Do a hex dump of memory in guest physical context
+ *
+ * @param   GCPhys      pointer to buffer to dump contents of
+ * @param   cb          count of characters to dump from buffer
+ * @param   uBase       base address of per-row address prefixing of hex output
+ * @param   pszTitle    Optional title. If present displays title that lists
+ *                      provided text with value of cb to indicate size next to it.
+ */
+void virtioCoreGCPhysHexDump(PPDMDEVINS pDevIns, RTGCPHYS GCPhys, uint16_t cb, uint32_t uBase, const char *pszTitle);
+
+/**
+ * The following API is functions identically to the similarly-named calls pertaining to the RTSGBUF
+ */
+
+/** Misc VM and PDM boilerplate */
+int      virtioCoreR3SaveExec(PVIRTIOCORE pVirtio, PCPDMDEVHLPR3 pHlp, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t cQueues);
+int      virtioCoreR3ModernDeviceLoadExec(PVIRTIOCORE pVirtio, PCPDMDEVHLPR3 pHlp, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uTestVersion, uint32_t cQueues);
+int      virtioCoreR3LegacyDeviceLoadExec(PVIRTIOCORE pVirtio, PCPDMDEVHLPR3 pHlp, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uVirtioLegacy_3_1_Beta);
+void     virtioCoreR3VmStateChanged(PVIRTIOCORE pVirtio, VIRTIOVMSTATECHANGED enmState);
+void     virtioCoreR3Term(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio, PVIRTIOCORECC pVirtioCC);
+int      virtioCoreRZInit(PPDMDEVINS pDevIns, PVIRTIOCORE pVirtio);
+const char *virtioCoreGetStateChangeText(VIRTIOVMSTATECHANGED enmState);
+
+/*
+ * The following macros assist with handling/logging MMIO accesses to VirtIO dev-specific config area,
+ * in a way that enhances code readability and debug logging consistency.
+ *
+ * cb, pv and fWrite are implicit parameters and must be defined by the invoker.
+ */
+#ifdef LOG_ENABLED
+
+# define VIRTIO_DEV_CONFIG_LOG_ACCESS(member, tCfgStruct, uOffsetOfAccess) \
+    if (LogIs7Enabled()) { \
+        uint32_t uMbrOffset = uOffsetOfAccess - RT_UOFFSETOF(tCfgStruct, member); \
+        uint32_t uMbrSize   = RT_SIZEOFMEMB(tCfgStruct, member); \
+        virtioCoreLogMappedIoValue(__FUNCTION__, #member, uMbrSize, pv, cb, uMbrOffset, fWrite, false, 0); \
+    }
+
+# define VIRTIO_DEV_CONFIG_LOG_INDEXED_ACCESS(member, tCfgStruct, uOffsetOfAccess, uIdx) \
+    if (LogIs7Enabled()) { \
+        uint32_t uMbrOffset = uOffsetOfAccess - RT_UOFFSETOF(tCfgStruct, member); \
+        uint32_t uMbrSize   = RT_SIZEOFMEMB(tCfgStruct, member); \
+        virtioCoreLogMappedIoValue(__FUNCTION__, #member, uMbrSize,  pv, cb, uMbrOffset, fWrite, true, uIdx); \
+    }
+#else
+# define VIRTIO_DEV_CONFIG_LOG_ACCESS(member, tCfgStruct, uMbrOffset) do { } while (0)
+# define VIRTIO_DEV_CONFIG_LOG_INDEXED_ACCESS(member, tCfgStruct, uMbrOffset, uIdx) do { } while (0)
+#endif
+
+DECLINLINE(bool) virtioCoreMatchMember(uint32_t uOffset, uint32_t cb, uint32_t uMemberOff,
+                                       size_t uMemberSize, bool fSubFieldMatch)
+{
+    /* Test for 8-byte field (always accessed as two 32-bit components) */
+    if (uMemberSize == 8)
+        return (cb == sizeof(uint32_t)) && (uOffset == uMemberOff || uOffset == (uMemberOff + sizeof(uint32_t)));
+
+    if (fSubFieldMatch)
+        return (uOffset >= uMemberOff) && (cb <= uMemberSize - (uOffset - uMemberOff));
+
+    /* Test for exact match */
+    return (uOffset == uMemberOff) && (cb == uMemberSize);
+}
+
+/**
+ * Yields boolean true if uOffsetOfAccess falls within bytes of specified member of config struct
+ */
+#define VIRTIO_DEV_CONFIG_SUBMATCH_MEMBER(member, tCfgStruct, uOffsetOfAccess) \
+            virtioCoreMatchMember(uOffsetOfAccess, cb, \
+                                  RT_UOFFSETOF(tCfgStruct, member),  \
+                                  RT_SIZEOFMEMB(tCfgStruct, member), true /* fSubfieldMatch */)
+
+#define VIRTIO_DEV_CONFIG_MATCH_MEMBER(member, tCfgStruct, uOffsetOfAccess) \
+            virtioCoreMatchMember(uOffsetOfAccess, cb, \
+                                  RT_UOFFSETOF(tCfgStruct, member),  \
+                                  RT_SIZEOFMEMB(tCfgStruct, member), false /* fSubfieldMatch */)
+
+
+
+/**
+ * Copy reads or copy writes specified member field of config struct (based on fWrite),
+ * the memory described by cb and pv.
+ *
+ * cb, pv and fWrite are implicit parameters and must be defined by invoker.
+ */
+#define VIRTIO_DEV_CONFIG_ACCESS(member, tCfgStruct, uOffsetOfAccess, pCfgStruct) \
+    do \
+    { \
+        uint32_t uOffsetInMember = uOffsetOfAccess - RT_UOFFSETOF(tCfgStruct, member); \
+        if (fWrite) \
+            memcpy(((char *)&(pCfgStruct)->member) + uOffsetInMember, pv, cb); \
+        else \
+            memcpy(pv, ((const char *)&(pCfgStruct)->member) + uOffsetInMember, cb); \
+        VIRTIO_DEV_CONFIG_LOG_ACCESS(member, tCfgStruct, uOffsetOfAccess); \
+    } while(0)
+
+/**
+ * Copies bytes into memory described by cb, pv from the specified member field of the config struct.
+ * The operation is a NOP, logging an error if an implied parameter, fWrite, is boolean true.
+ *
+ * cb, pv and fWrite are implicit parameters and must be defined by the invoker.
+ */
+#define VIRTIO_DEV_CONFIG_ACCESS_READONLY(member, tCfgStruct, uOffsetOfAccess, pCfgStruct) \
+    do \
+    { \
+        uint32_t uOffsetInMember = uOffsetOfAccess - RT_UOFFSETOF(tCfgStruct, member); \
+        if (fWrite) \
+            LogFunc(("Guest attempted to write readonly virtio config struct (member %s)\n", #member)); \
+        else \
+        { \
+            memcpy(pv, ((const char *)&(pCfgStruct)->member) + uOffsetInMember, cb); \
+            VIRTIO_DEV_CONFIG_LOG_ACCESS(member, tCfgStruct, uOffsetOfAccess); \
+        } \
+    } while(0)
+
+/**
+ * Copies into or out of specified member field of config struct (based on fWrite),
+ * the memory described by cb and pv.
+ *
+ * cb, pv and fWrite are implicit parameters and must be defined by invoker.
+ */
+#define VIRTIO_DEV_CONFIG_ACCESS_INDEXED(member, uIdx, tCfgStruct, uOffsetOfAccess, pCfgStruct) \
+    do \
+    { \
+        uint32_t uOffsetInMember = uOffsetOfAccess - RT_UOFFSETOF(tCfgStruct, member); \
+        if (fWrite) \
+            memcpy(((char *)&(pCfgStruct[uIdx].member)) + uOffsetInMember, pv, cb); \
+        else \
+            memcpy(pv, ((const char *)&(pCfgStruct[uIdx].member)) + uOffsetInMember, cb); \
+        VIRTIO_DEV_CONFIG_LOG_INDEXED_ACCESS(member, tCfgStruct, uOffsetOfAccess, uIdx); \
+    } while(0)
+
+/**
+ * Copies bytes into memory described by cb, pv from the specified member field of the config struct.
+ * The operation is a nop and logs error if implied parameter fWrite is true.
+ *
+ * cb, pv and fWrite are implicit parameters and must be defined by invoker.
+ */
+#define VIRTIO_DEV_CONFIG_ACCESS_INDEXED_READONLY(member, uidx, tCfgStruct, uOffsetOfAccess, pCfgStruct) \
+    do \
+    { \
+        uint32_t uOffsetInMember = uOffsetOfAccess - RT_UOFFSETOF(tCfgStruct, member); \
+        if (fWrite) \
+            LogFunc(("Guest attempted to write readonly virtio config struct (member %s)\n", #member)); \
+        else \
+        { \
+            memcpy(pv, ((const char *)&(pCfgStruct[uIdx].member)) + uOffsetInMember, cb); \
+            VIRTIO_DEV_CONFIG_LOG_INDEXED_ACCESS(member, tCfgStruct, uOffsetOfAccess, uIdx); \
+        } \
+    } while(0)
+
+/** @} */
+
+/** @name API for VirtIO parent device
+ * @{ */
+
+#endif /* !VBOX_INCLUDED_SRC_VirtIO_VirtioCore_h */