[PATCH] pcie_sriov: Avoid capability structure overflow in PF reset

[PATCH] pcie_sriov: Avoid capability structure overflow in PF reset

[Clément MATHIEU--DRIF]

The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
dedicated 32-bit configuration field. Fix the reset loop to write
32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.

As a side effect of this change, update PCIESriovPF::vf_bar_type
to match the number of regions exposed by SR-IOV and rework the
associated assert statements.

Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
---
 hw/pci/pcie_sriov.c         | 9 +++++----
 include/hw/pci/pcie_sriov.h | 2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index c41ac95bee..df61f281ea 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
 
     assert(sriov_cap > 0);
     assert(region_num >= 0);
-    assert(region_num < PCI_NUM_REGIONS);
-    assert(region_num != PCI_ROM_SLOT);
+    assert(region_num < PCI_SRIOV_NUM_BARS);
 
     wmask = ~(size - 1);
     addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
@@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
     dev->exp.sriov_pf.vf = vfs;
     dev->exp.sriov_pf.vf_user_created = true;
 
+    assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
+
     for (i = 0; i < PCI_NUM_REGIONS; i++) {
         PCIIORegion *region = &vfs[0]->io_regions[i];
 
@@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
      */
     pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
 
-    for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
-        pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
+    for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
+        pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
                      dev->exp.sriov_pf.vf_bar_type[i]);
     }
 }
diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
index b0ea6a62c7..5f81e3b1bb 100644
--- a/include/hw/pci/pcie_sriov.h
+++ b/include/hw/pci/pcie_sriov.h
@@ -16,7 +16,7 @@
 #include "hw/pci/pci.h"
 
 typedef struct PCIESriovPF {
-    uint8_t vf_bar_type[PCI_NUM_REGIONS];   /* Store type for each VF bar */
+    uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS];   /* Store type for each VF bar */
     PCIDevice **vf;     /* Pointer to an array of num_vfs VF devices */
     bool vf_user_created; /* If VFs are created by user */
 } PCIESriovPF;
-- 
2.55.0

Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset

[Akihiko Odaki]

On 2026/09/21 14:59, Clément MATHIEU--DRIF wrote:
> The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> dedicated 32-bit configuration field. Fix the reset loop to write
> 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> 
> As a side effect of this change, update PCIESriovPF::vf_bar_type
> to match the number of regions exposed by SR-IOV and rework the
> associated assert statements.
> 
> Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset

[Michael S. Tsirkin]

On Mon, Sep 21, 2026 at 05:59:23AM +0000, Clément MATHIEU--DRIF wrote:
> The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> dedicated 32-bit configuration field. Fix the reset loop to write
> 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> 
> As a side effect of this change, update PCIESriovPF::vf_bar_type
> to match the number of regions exposed by SR-IOV and rework the
> associated assert statements.
> 
> Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>

I queued another patch fixing this, yours will become a cleanup.
Once my pull is merged, pls rebase and report.

Thanks!

> ---
>  hw/pci/pcie_sriov.c         | 9 +++++----
>  include/hw/pci/pcie_sriov.h | 2 +-
>  2 files changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> index c41ac95bee..df61f281ea 100644
> --- a/hw/pci/pcie_sriov.c
> +++ b/hw/pci/pcie_sriov.c
> @@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
>  
>      assert(sriov_cap > 0);
>      assert(region_num >= 0);
> -    assert(region_num < PCI_NUM_REGIONS);
> -    assert(region_num != PCI_ROM_SLOT);
> +    assert(region_num < PCI_SRIOV_NUM_BARS);
>  
>      wmask = ~(size - 1);
>      addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
> @@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
>      dev->exp.sriov_pf.vf = vfs;
>      dev->exp.sriov_pf.vf_user_created = true;
>  
> +    assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
> +
>      for (i = 0; i < PCI_NUM_REGIONS; i++) {
>          PCIIORegion *region = &vfs[0]->io_regions[i];
>  
> @@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
>       */
>      pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
>  
> -    for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
> -        pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> +    for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
> +        pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
>                       dev->exp.sriov_pf.vf_bar_type[i]);
>      }
>  }
> diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> index b0ea6a62c7..5f81e3b1bb 100644
> --- a/include/hw/pci/pcie_sriov.h
> +++ b/include/hw/pci/pcie_sriov.h
> @@ -16,7 +16,7 @@
>  #include "hw/pci/pci.h"
>  
>  typedef struct PCIESriovPF {
> -    uint8_t vf_bar_type[PCI_NUM_REGIONS];   /* Store type for each VF bar */
> +    uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS];   /* Store type for each VF bar */
>      PCIDevice **vf;     /* Pointer to an array of num_vfs VF devices */
>      bool vf_user_created; /* If VFs are created by user */
>  } PCIESriovPF;
> -- 
> 2.55.0

Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset

[Clément MATHIEU--DRIF]

On Wed, 2026-10-28 at 09:14 -0400, Michael S. Tsirkin wrote:
> Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
> 
> 
> On Mon, Sep 21, 2026 at 05:59:23AM +0000, Clément MATHIEU--DRIF wrote:
> 
> > The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> > dedicated 32-bit configuration field. Fix the reset loop to write
> > 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> > 
> > As a side effect of this change, update PCIESriovPF::vf_bar_type
> > to match the number of regions exposed by SR-IOV and rework the
> > associated assert statements.
> > 
> > Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> > Signed-off-by: Clement Mathieu--Drif <[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com)>
> 
> 
> I queued another patch fixing this, yours will become a cleanup.  
> Once my pull is merged, pls rebase and report.
> 
> Thanks!

Hi Michael,

Do you want version rebased on master or another ref?

cmd

> 
> 
> > ---
> >  hw/pci/pcie_sriov.c         | 9 +++++----
> >  include/hw/pci/pcie_sriov.h | 2 +-
> >  2 files changed, 6 insertions(+), 5 deletions(-)
> > 
> > diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> > index c41ac95bee..df61f281ea 100644
> > --- a/hw/pci/pcie_sriov.c
> > +++ b/hw/pci/pcie_sriov.c
> > @@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
> > 
> >      assert(sriov_cap > 0);
> >      assert(region_num >= 0);
> > -    assert(region_num < PCI_NUM_REGIONS);
> > -    assert(region_num != PCI_ROM_SLOT);
> > +    assert(region_num < PCI_SRIOV_NUM_BARS);
> > 
> >      wmask = ~(size - 1);
> >      addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
> > @@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
> >      dev->exp.sriov_pf.vf = vfs;
> >      dev->exp.sriov_pf.vf_user_created = true;
> > 
> > +    assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
> > +
> >      for (i = 0; i < PCI_NUM_REGIONS; i++) {
> >          PCIIORegion *region = &vfs[0]->io_regions[i];
> > 
> > @@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
> >       */
> >      pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
> > 
> > -    for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
> > -        pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > +    for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
> > +        pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> >                       dev->exp.sriov_pf.vf_bar_type[i]);
> >      }
> >  }
> > diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> > index b0ea6a62c7..5f81e3b1bb 100644
> > --- a/include/hw/pci/pcie_sriov.h
> > +++ b/include/hw/pci/pcie_sriov.h
> > @@ -16,7 +16,7 @@
> >  #include "hw/pci/pci.h"
> > 
> >  typedef struct PCIESriovPF {
> > -    uint8_t vf_bar_type[PCI_NUM_REGIONS];   /* Store type for each VF bar */
> > +    uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS];   /* Store type for each VF bar */
> >      PCIDevice **vf;     /* Pointer to an array of num_vfs VF devices */
> >      bool vf_user_created; /* If VFs are created by user */
> >  } PCIESriovPF;
> > --
> > 2.55.0
> 
> 

Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset

[Michael S. Tsirkin]

On Wed, Oct 28, 2026 at 01:40:24PM +0000, Clément MATHIEU--DRIF wrote:
> 
> On Wed, 2026-10-28 at 09:14 -0400, Michael S. Tsirkin wrote:
> > Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
> > 
> > 
> > On Mon, Sep 21, 2026 at 05:59:23AM +0000, Clément MATHIEU--DRIF wrote:
> > 
> > > The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> > > dedicated 32-bit configuration field. Fix the reset loop to write
> > > 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> > > 
> > > As a side effect of this change, update PCIESriovPF::vf_bar_type
> > > to match the number of regions exposed by SR-IOV and rework the
> > > associated assert statements.
> > > 
> > > Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> > > Signed-off-by: Clement Mathieu--Drif <[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com)>
> > 
> > 
> > I queued another patch fixing this, yours will become a cleanup.  
> > Once my pull is merged, pls rebase and report.
> > 
> > Thanks!
> 
> Hi Michael,
> 
> Do you want version rebased on master or another ref?
> 
> cmd

pci branch in my tree will do

> > 
> > 
> > > ---
> > >  hw/pci/pcie_sriov.c         | 9 +++++----
> > >  include/hw/pci/pcie_sriov.h | 2 +-
> > >  2 files changed, 6 insertions(+), 5 deletions(-)
> > > 
> > > diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> > > index c41ac95bee..df61f281ea 100644
> > > --- a/hw/pci/pcie_sriov.c
> > > +++ b/hw/pci/pcie_sriov.c
> > > @@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
> > > 
> > >      assert(sriov_cap > 0);
> > >      assert(region_num >= 0);
> > > -    assert(region_num < PCI_NUM_REGIONS);
> > > -    assert(region_num != PCI_ROM_SLOT);
> > > +    assert(region_num < PCI_SRIOV_NUM_BARS);
> > > 
> > >      wmask = ~(size - 1);
> > >      addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
> > > @@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
> > >      dev->exp.sriov_pf.vf = vfs;
> > >      dev->exp.sriov_pf.vf_user_created = true;
> > > 
> > > +    assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
> > > +
> > >      for (i = 0; i < PCI_NUM_REGIONS; i++) {
> > >          PCIIORegion *region = &vfs[0]->io_regions[i];
> > > 
> > > @@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
> > >       */
> > >      pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
> > > 
> > > -    for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
> > > -        pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > +    for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
> > > +        pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > >                       dev->exp.sriov_pf.vf_bar_type[i]);
> > >      }
> > >  }
> > > diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> > > index b0ea6a62c7..5f81e3b1bb 100644
> > > --- a/include/hw/pci/pcie_sriov.h
> > > +++ b/include/hw/pci/pcie_sriov.h
> > > @@ -16,7 +16,7 @@
> > >  #include "hw/pci/pci.h"
> > > 
> > >  typedef struct PCIESriovPF {
> > > -    uint8_t vf_bar_type[PCI_NUM_REGIONS];   /* Store type for each VF bar */
> > > +    uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS];   /* Store type for each VF bar */
> > >      PCIDevice **vf;     /* Pointer to an array of num_vfs VF devices */
> > >      bool vf_user_created; /* If VFs are created by user */
> > >  } PCIESriovPF;
> > > --
> > > 2.55.0
> > 
> > 

Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset

[Clément MATHIEU--DRIF]

On Wed, 2026-10-28 at 09:51 -0400, Michael S. Tsirkin wrote:
> Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
> 
> 
> On Wed, Oct 28, 2026 at 01:40:24PM +0000, Clément MATHIEU--DRIF wrote:
> 
> 
> > On Wed, 2026-10-28 at 09:14 -0400, Michael S. Tsirkin wrote:
> > 
> > > Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
> > > 
> > > 
> > > On Mon, Sep 21, 2026 at 05:59:23AM +0000, Clément MATHIEU--DRIF wrote:
> > > 
> > > 
> > > > The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> > > > dedicated 32-bit configuration field. Fix the reset loop to write
> > > > 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> > > > 
> > > > As a side effect of this change, update PCIESriovPF::vf_bar_type
> > > > to match the number of regions exposed by SR-IOV and rework the
> > > > associated assert statements.
> > > > 
> > > > Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> > > > Signed-off-by: Clement Mathieu--Drif <[[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com)](mailto:[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com))>
> > > 
> > > 
> > > 
> > > I queued another patch fixing this, yours will become a cleanup.
> > > Once my pull is merged, pls rebase and report.
> > > 
> > > Thanks!
> > 
> > 
> > Hi Michael,
> > 
> > Do you want version rebased on master or another ref?
> > 
> > cmd
> 
> 
> pci branch in my tree will do

You already put the patch in the branch.

I'm ok with the remaining changes if we update the commit message to:

```
pcie_sriov: Rework the assert statements checking region numbers  

pcie_sriov_pf_init_vf_bar: PCI_ROM_SLOT is already out of the SR-IOV regions.  
pcie_sriov_pf_init_from_user_created_vfs: ROM region must never have a non-zero size.
```

> 
> 
> 
> > > 
> > > 
> > > 
> > > > ---
> > > >  hw/pci/pcie_sriov.c         | 9 +++++----
> > > >  include/hw/pci/pcie_sriov.h | 2 +-
> > > >  2 files changed, 6 insertions(+), 5 deletions(-)
> > > > 
> > > > diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> > > > index c41ac95bee..df61f281ea 100644
> > > > --- a/hw/pci/pcie_sriov.c
> > > > +++ b/hw/pci/pcie_sriov.c
> > > > @@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
> > > > 
> > > >      assert(sriov_cap > 0);
> > > >      assert(region_num >= 0);
> > > > -    assert(region_num < PCI_NUM_REGIONS);
> > > > -    assert(region_num != PCI_ROM_SLOT);
> > > > +    assert(region_num < PCI_SRIOV_NUM_BARS);
> > > > 
> > > >      wmask = ~(size - 1);
> > > >      addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
> > > > @@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
> > > >      dev->exp.sriov_pf.vf = vfs;
> > > >      dev->exp.sriov_pf.vf_user_created = true;
> > > > 
> > > > +    assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
> > > > +
> > > >      for (i = 0; i < PCI_NUM_REGIONS; i++) {
> > > >          PCIIORegion *region = &vfs[0]->io_regions[i];
> > > > 
> > > > @@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
> > > >       */
> > > >      pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
> > > > 
> > > > -    for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
> > > > -        pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > > +    for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
> > > > +        pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > >                       dev->exp.sriov_pf.vf_bar_type[i]);
> > > >      }
> > > >  }
> > > > diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> > > > index b0ea6a62c7..5f81e3b1bb 100644
> > > > --- a/include/hw/pci/pcie_sriov.h
> > > > +++ b/include/hw/pci/pcie_sriov.h
> > > > @@ -16,7 +16,7 @@
> > > >  #include "hw/pci/pci.h"
> > > > 
> > > >  typedef struct PCIESriovPF {
> > > > -    uint8_t vf_bar_type[PCI_NUM_REGIONS];   /* Store type for each VF bar */
> > > > +    uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS];   /* Store type for each VF bar */
> > > >      PCIDevice **vf;     /* Pointer to an array of num_vfs VF devices */
> > > >      bool vf_user_created; /* If VFs are created by user */
> > > >  } PCIESriovPF;
> > > > --
> > > > 2.55.0
> > > 
> > > 
> > > 
> >
> 
> 

Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset

[Michael S. Tsirkin]

On Wed, Oct 28, 2026 at 02:12:43PM +0000, Clément MATHIEU--DRIF wrote:
> 
> On Wed, 2026-10-28 at 09:51 -0400, Michael S. Tsirkin wrote:
> > Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
> > 
> > 
> > On Wed, Oct 28, 2026 at 01:40:24PM +0000, Clément MATHIEU--DRIF wrote:
> > 
> > 
> > > On Wed, 2026-10-28 at 09:14 -0400, Michael S. Tsirkin wrote:
> > > 
> > > > Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
> > > > 
> > > > 
> > > > On Mon, Sep 21, 2026 at 05:59:23AM +0000, Clément MATHIEU--DRIF wrote:
> > > > 
> > > > 
> > > > > The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> > > > > dedicated 32-bit configuration field. Fix the reset loop to write
> > > > > 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> > > > > 
> > > > > As a side effect of this change, update PCIESriovPF::vf_bar_type
> > > > > to match the number of regions exposed by SR-IOV and rework the
> > > > > associated assert statements.
> > > > > 
> > > > > Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> > > > > Signed-off-by: Clement Mathieu--Drif <[[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com)](mailto:[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com))>
> > > > 
> > > > 
> > > > 
> > > > I queued another patch fixing this, yours will become a cleanup.
> > > > Once my pull is merged, pls rebase and report.
> > > > 
> > > > Thanks!
> > > 
> > > 
> > > Hi Michael,
> > > 
> > > Do you want version rebased on master or another ref?
> > > 
> > > cmd
> > 
> > 
> > pci branch in my tree will do
> 
> You already put the patch in the branch.
> 
> I'm ok with the remaining changes if we update the commit message to:
> 
> ```
> pcie_sriov: Rework the assert statements checking region numbers  
> 
> pcie_sriov_pf_init_vf_bar: PCI_ROM_SLOT is already out of the SR-IOV regions.  
> pcie_sriov_pf_init_from_user_created_vfs: ROM region must never have a non-zero size.
> ```

Pls revert and post the corrected version, I will replace mine with that
one.

> > 
> > 
> > 
> > > > 
> > > > 
> > > > 
> > > > > ---
> > > > >  hw/pci/pcie_sriov.c         | 9 +++++----
> > > > >  include/hw/pci/pcie_sriov.h | 2 +-
> > > > >  2 files changed, 6 insertions(+), 5 deletions(-)
> > > > > 
> > > > > diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> > > > > index c41ac95bee..df61f281ea 100644
> > > > > --- a/hw/pci/pcie_sriov.c
> > > > > +++ b/hw/pci/pcie_sriov.c
> > > > > @@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
> > > > > 
> > > > >      assert(sriov_cap > 0);
> > > > >      assert(region_num >= 0);
> > > > > -    assert(region_num < PCI_NUM_REGIONS);
> > > > > -    assert(region_num != PCI_ROM_SLOT);
> > > > > +    assert(region_num < PCI_SRIOV_NUM_BARS);
> > > > > 
> > > > >      wmask = ~(size - 1);
> > > > >      addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
> > > > > @@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
> > > > >      dev->exp.sriov_pf.vf = vfs;
> > > > >      dev->exp.sriov_pf.vf_user_created = true;
> > > > > 
> > > > > +    assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
> > > > > +
> > > > >      for (i = 0; i < PCI_NUM_REGIONS; i++) {
> > > > >          PCIIORegion *region = &vfs[0]->io_regions[i];
> > > > > 
> > > > > @@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
> > > > >       */
> > > > >      pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
> > > > > 
> > > > > -    for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
> > > > > -        pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > > > +    for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
> > > > > +        pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > > >                       dev->exp.sriov_pf.vf_bar_type[i]);
> > > > >      }
> > > > >  }
> > > > > diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> > > > > index b0ea6a62c7..5f81e3b1bb 100644
> > > > > --- a/include/hw/pci/pcie_sriov.h
> > > > > +++ b/include/hw/pci/pcie_sriov.h
> > > > > @@ -16,7 +16,7 @@
> > > > >  #include "hw/pci/pci.h"
> > > > > 
> > > > >  typedef struct PCIESriovPF {
> > > > > -    uint8_t vf_bar_type[PCI_NUM_REGIONS];   /* Store type for each VF bar */
> > > > > +    uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS];   /* Store type for each VF bar */
> > > > >      PCIDevice **vf;     /* Pointer to an array of num_vfs VF devices */
> > > > >      bool vf_user_created; /* If VFs are created by user */
> > > > >  } PCIESriovPF;
> > > > > --
> > > > > 2.55.0
> > > > 
> > > > 
> > > > 
> > >
> > 
> >