1.1 --- a/tools/ioemu/target-i386-dm/helper2.c	Sun Apr 15 21:56:38 2007 +0100
     1.2 +++ b/tools/ioemu/target-i386-dm/helper2.c	Mon Apr 16 11:35:58 2007 +0100
     1.3 @@ -408,6 +408,21 @@ void cpu_ioreq_add(CPUState *env, ioreq_
     1.4      req->data = tmp1;
     1.5  }
     1.6  
     1.7 +void cpu_ioreq_sub(CPUState *env, ioreq_t *req)
     1.8 +{
     1.9 +    unsigned long tmp1, tmp2;
    1.10 +
    1.11 +    if (req->data_is_ptr != 0)
    1.12 +        hw_error("expected scalar value");
    1.13 +
    1.14 +    read_physical(req->addr, req->size, &tmp1);
    1.15 +    if (req->dir == IOREQ_WRITE) {
    1.16 +        tmp2 = tmp1 - (unsigned long) req->data;
    1.17 +        write_physical(req->addr, req->size, &tmp2);
    1.18 +    }
    1.19 +    req->data = tmp1;
    1.20 +}
    1.21 +
    1.22  void cpu_ioreq_or(CPUState *env, ioreq_t *req)
    1.23  {
    1.24      unsigned long tmp1, tmp2;
    1.25 @@ -496,6 +511,9 @@ void __handle_ioreq(CPUState *env, ioreq
    1.26      case IOREQ_TYPE_ADD:
    1.27          cpu_ioreq_add(env, req);
    1.28          break;
    1.29 +    case IOREQ_TYPE_SUB:
    1.30 +        cpu_ioreq_sub(env, req);
    1.31 +        break;
    1.32      case IOREQ_TYPE_OR:
    1.33          cpu_ioreq_or(env, req);
    1.34          break;

     2.1 --- a/xen/arch/x86/hvm/platform.c	Sun Apr 15 21:56:38 2007 +0100
     2.2 +++ b/xen/arch/x86/hvm/platform.c	Mon Apr 16 11:35:58 2007 +0100
     2.3 @@ -1240,6 +1240,10 @@ void handle_mmio(unsigned long gpa)
     2.4          mmio_operands(IOREQ_TYPE_ADD, gpa, mmio_op, op_size);
     2.5          break;
     2.6  
     2.7 +    case INSTR_SUB:
     2.8 +        mmio_operands(IOREQ_TYPE_SUB, gpa, mmio_op, op_size);
     2.9 +        break;
    2.10 +
    2.11      case INSTR_XOR:
    2.12          mmio_operands(IOREQ_TYPE_XOR, gpa, mmio_op, op_size);
    2.13          break;
    2.14 @@ -1261,7 +1265,6 @@ void handle_mmio(unsigned long gpa)
    2.15  
    2.16      case INSTR_CMP:        /* Pass through */
    2.17      case INSTR_TEST:
    2.18 -    case INSTR_SUB:
    2.19          /* send the request and wait for the value */
    2.20          send_mmio_req(IOREQ_TYPE_COPY, gpa, 1, op_size, 0, IOREQ_READ, df, 0);
    2.21          break;

     3.1 --- a/xen/include/public/hvm/ioreq.h	Sun Apr 15 21:56:38 2007 +0100
     3.2 +++ b/xen/include/public/hvm/ioreq.h	Mon Apr 16 11:35:58 2007 +0100
     3.3 @@ -41,6 +41,7 @@
     3.4  #define IOREQ_TYPE_ADD          6
     3.5  #define IOREQ_TYPE_TIMEOFFSET   7
     3.6  #define IOREQ_TYPE_INVALIDATE   8 /* mapcache */
     3.7 +#define IOREQ_TYPE_SUB          9
     3.8  
     3.9  /*
    3.10   * VMExit dispatcher should cooperate with instruction decoder to