* [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset
@ 2026-09-21 5:59 Clément MATHIEU--DRIF
2026-09-21 6:54 ` Akihiko Odaki
2026-10-28 13:14 ` Michael S. Tsirkin
0 siblings, 2 replies; 7+ messages in thread
From: Clément MATHIEU--DRIF @ 2026-09-21 5:59 UTC (permalink / raw)
To: qemu-devel@nongnu.org
Cc: mst@redhat.com, odaki@rsg.ci.i.u-tokyo.ac.jp,
Clément MATHIEU--DRIF
The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
dedicated 32-bit configuration field. Fix the reset loop to write
32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
As a side effect of this change, update PCIESriovPF::vf_bar_type
to match the number of regions exposed by SR-IOV and rework the
associated assert statements.
Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
---
hw/pci/pcie_sriov.c | 9 +++++----
include/hw/pci/pcie_sriov.h | 2 +-
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index c41ac95bee..df61f281ea 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
assert(sriov_cap > 0);
assert(region_num >= 0);
- assert(region_num < PCI_NUM_REGIONS);
- assert(region_num != PCI_ROM_SLOT);
+ assert(region_num < PCI_SRIOV_NUM_BARS);
wmask = ~(size - 1);
addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
@@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
dev->exp.sriov_pf.vf = vfs;
dev->exp.sriov_pf.vf_user_created = true;
+ assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
+
for (i = 0; i < PCI_NUM_REGIONS; i++) {
PCIIORegion *region = &vfs[0]->io_regions[i];
@@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
*/
pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
- for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
- pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
+ for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
+ pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
dev->exp.sriov_pf.vf_bar_type[i]);
}
}
diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
index b0ea6a62c7..5f81e3b1bb 100644
--- a/include/hw/pci/pcie_sriov.h
+++ b/include/hw/pci/pcie_sriov.h
@@ -16,7 +16,7 @@
#include "hw/pci/pci.h"
typedef struct PCIESriovPF {
- uint8_t vf_bar_type[PCI_NUM_REGIONS]; /* Store type for each VF bar */
+ uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS]; /* Store type for each VF bar */
PCIDevice **vf; /* Pointer to an array of num_vfs VF devices */
bool vf_user_created; /* If VFs are created by user */
} PCIESriovPF;
--
2.55.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset
2026-09-21 5:59 [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset Clément MATHIEU--DRIF
@ 2026-09-21 6:54 ` Akihiko Odaki
2026-10-28 13:14 ` Michael S. Tsirkin
1 sibling, 0 replies; 7+ messages in thread
From: Akihiko Odaki @ 2026-09-21 6:54 UTC (permalink / raw)
To: Clément MATHIEU--DRIF, qemu-devel@nongnu.org; +Cc: mst@redhat.com
On 2026/09/21 14:59, Clément MATHIEU--DRIF wrote:
> The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> dedicated 32-bit configuration field. Fix the reset loop to write
> 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
>
> As a side effect of this change, update PCIESriovPF::vf_bar_type
> to match the number of regions exposed by SR-IOV and rework the
> associated assert statements.
>
> Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset
2026-09-21 5:59 [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset Clément MATHIEU--DRIF
2026-09-21 6:54 ` Akihiko Odaki
@ 2026-10-28 13:14 ` Michael S. Tsirkin
2026-10-28 13:40 ` Clément MATHIEU--DRIF
1 sibling, 1 reply; 7+ messages in thread
From: Michael S. Tsirkin @ 2026-10-28 13:14 UTC (permalink / raw)
To: Clément MATHIEU--DRIF
Cc: qemu-devel@nongnu.org, odaki@rsg.ci.i.u-tokyo.ac.jp
On Mon, Sep 21, 2026 at 05:59:23AM +0000, Clément MATHIEU--DRIF wrote:
> The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> dedicated 32-bit configuration field. Fix the reset loop to write
> 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
>
> As a side effect of this change, update PCIESriovPF::vf_bar_type
> to match the number of regions exposed by SR-IOV and rework the
> associated assert statements.
>
> Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
I queued another patch fixing this, yours will become a cleanup.
Once my pull is merged, pls rebase and report.
Thanks!
> ---
> hw/pci/pcie_sriov.c | 9 +++++----
> include/hw/pci/pcie_sriov.h | 2 +-
> 2 files changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> index c41ac95bee..df61f281ea 100644
> --- a/hw/pci/pcie_sriov.c
> +++ b/hw/pci/pcie_sriov.c
> @@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
>
> assert(sriov_cap > 0);
> assert(region_num >= 0);
> - assert(region_num < PCI_NUM_REGIONS);
> - assert(region_num != PCI_ROM_SLOT);
> + assert(region_num < PCI_SRIOV_NUM_BARS);
>
> wmask = ~(size - 1);
> addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
> @@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
> dev->exp.sriov_pf.vf = vfs;
> dev->exp.sriov_pf.vf_user_created = true;
>
> + assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
> +
> for (i = 0; i < PCI_NUM_REGIONS; i++) {
> PCIIORegion *region = &vfs[0]->io_regions[i];
>
> @@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
> */
> pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
>
> - for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
> - pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> + for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
> + pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> dev->exp.sriov_pf.vf_bar_type[i]);
> }
> }
> diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> index b0ea6a62c7..5f81e3b1bb 100644
> --- a/include/hw/pci/pcie_sriov.h
> +++ b/include/hw/pci/pcie_sriov.h
> @@ -16,7 +16,7 @@
> #include "hw/pci/pci.h"
>
> typedef struct PCIESriovPF {
> - uint8_t vf_bar_type[PCI_NUM_REGIONS]; /* Store type for each VF bar */
> + uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS]; /* Store type for each VF bar */
> PCIDevice **vf; /* Pointer to an array of num_vfs VF devices */
> bool vf_user_created; /* If VFs are created by user */
> } PCIESriovPF;
> --
> 2.55.0
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset
2026-10-28 13:14 ` Michael S. Tsirkin
@ 2026-10-28 13:40 ` Clément MATHIEU--DRIF
2026-10-28 13:51 ` Michael S. Tsirkin
0 siblings, 1 reply; 7+ messages in thread
From: Clément MATHIEU--DRIF @ 2026-10-28 13:40 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: qemu-devel@nongnu.org, odaki@rsg.ci.i.u-tokyo.ac.jp
On Wed, 2026-10-28 at 09:14 -0400, Michael S. Tsirkin wrote:
> Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
>
>
> On Mon, Sep 21, 2026 at 05:59:23AM +0000, Clément MATHIEU--DRIF wrote:
>
> > The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> > dedicated 32-bit configuration field. Fix the reset loop to write
> > 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> >
> > As a side effect of this change, update PCIESriovPF::vf_bar_type
> > to match the number of regions exposed by SR-IOV and rework the
> > associated assert statements.
> >
> > Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> > Signed-off-by: Clement Mathieu--Drif <[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com)>
>
>
> I queued another patch fixing this, yours will become a cleanup.
> Once my pull is merged, pls rebase and report.
>
> Thanks!
Hi Michael,
Do you want version rebased on master or another ref?
cmd
>
>
> > ---
> > hw/pci/pcie_sriov.c | 9 +++++----
> > include/hw/pci/pcie_sriov.h | 2 +-
> > 2 files changed, 6 insertions(+), 5 deletions(-)
> >
> > diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> > index c41ac95bee..df61f281ea 100644
> > --- a/hw/pci/pcie_sriov.c
> > +++ b/hw/pci/pcie_sriov.c
> > @@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
> >
> > assert(sriov_cap > 0);
> > assert(region_num >= 0);
> > - assert(region_num < PCI_NUM_REGIONS);
> > - assert(region_num != PCI_ROM_SLOT);
> > + assert(region_num < PCI_SRIOV_NUM_BARS);
> >
> > wmask = ~(size - 1);
> > addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
> > @@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
> > dev->exp.sriov_pf.vf = vfs;
> > dev->exp.sriov_pf.vf_user_created = true;
> >
> > + assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
> > +
> > for (i = 0; i < PCI_NUM_REGIONS; i++) {
> > PCIIORegion *region = &vfs[0]->io_regions[i];
> >
> > @@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
> > */
> > pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
> >
> > - for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
> > - pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > + for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
> > + pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > dev->exp.sriov_pf.vf_bar_type[i]);
> > }
> > }
> > diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> > index b0ea6a62c7..5f81e3b1bb 100644
> > --- a/include/hw/pci/pcie_sriov.h
> > +++ b/include/hw/pci/pcie_sriov.h
> > @@ -16,7 +16,7 @@
> > #include "hw/pci/pci.h"
> >
> > typedef struct PCIESriovPF {
> > - uint8_t vf_bar_type[PCI_NUM_REGIONS]; /* Store type for each VF bar */
> > + uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS]; /* Store type for each VF bar */
> > PCIDevice **vf; /* Pointer to an array of num_vfs VF devices */
> > bool vf_user_created; /* If VFs are created by user */
> > } PCIESriovPF;
> > --
> > 2.55.0
>
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset
2026-10-28 13:40 ` Clément MATHIEU--DRIF
@ 2026-10-28 13:51 ` Michael S. Tsirkin
2026-10-28 14:12 ` Clément MATHIEU--DRIF
0 siblings, 1 reply; 7+ messages in thread
From: Michael S. Tsirkin @ 2026-10-28 13:51 UTC (permalink / raw)
To: Clément MATHIEU--DRIF
Cc: qemu-devel@nongnu.org, odaki@rsg.ci.i.u-tokyo.ac.jp
On Wed, Oct 28, 2026 at 01:40:24PM +0000, Clément MATHIEU--DRIF wrote:
>
> On Wed, 2026-10-28 at 09:14 -0400, Michael S. Tsirkin wrote:
> > Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
> >
> >
> > On Mon, Sep 21, 2026 at 05:59:23AM +0000, Clément MATHIEU--DRIF wrote:
> >
> > > The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> > > dedicated 32-bit configuration field. Fix the reset loop to write
> > > 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> > >
> > > As a side effect of this change, update PCIESriovPF::vf_bar_type
> > > to match the number of regions exposed by SR-IOV and rework the
> > > associated assert statements.
> > >
> > > Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> > > Signed-off-by: Clement Mathieu--Drif <[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com)>
> >
> >
> > I queued another patch fixing this, yours will become a cleanup.
> > Once my pull is merged, pls rebase and report.
> >
> > Thanks!
>
> Hi Michael,
>
> Do you want version rebased on master or another ref?
>
> cmd
pci branch in my tree will do
> >
> >
> > > ---
> > > hw/pci/pcie_sriov.c | 9 +++++----
> > > include/hw/pci/pcie_sriov.h | 2 +-
> > > 2 files changed, 6 insertions(+), 5 deletions(-)
> > >
> > > diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> > > index c41ac95bee..df61f281ea 100644
> > > --- a/hw/pci/pcie_sriov.c
> > > +++ b/hw/pci/pcie_sriov.c
> > > @@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
> > >
> > > assert(sriov_cap > 0);
> > > assert(region_num >= 0);
> > > - assert(region_num < PCI_NUM_REGIONS);
> > > - assert(region_num != PCI_ROM_SLOT);
> > > + assert(region_num < PCI_SRIOV_NUM_BARS);
> > >
> > > wmask = ~(size - 1);
> > > addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
> > > @@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
> > > dev->exp.sriov_pf.vf = vfs;
> > > dev->exp.sriov_pf.vf_user_created = true;
> > >
> > > + assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
> > > +
> > > for (i = 0; i < PCI_NUM_REGIONS; i++) {
> > > PCIIORegion *region = &vfs[0]->io_regions[i];
> > >
> > > @@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
> > > */
> > > pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
> > >
> > > - for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
> > > - pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > + for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
> > > + pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > dev->exp.sriov_pf.vf_bar_type[i]);
> > > }
> > > }
> > > diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> > > index b0ea6a62c7..5f81e3b1bb 100644
> > > --- a/include/hw/pci/pcie_sriov.h
> > > +++ b/include/hw/pci/pcie_sriov.h
> > > @@ -16,7 +16,7 @@
> > > #include "hw/pci/pci.h"
> > >
> > > typedef struct PCIESriovPF {
> > > - uint8_t vf_bar_type[PCI_NUM_REGIONS]; /* Store type for each VF bar */
> > > + uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS]; /* Store type for each VF bar */
> > > PCIDevice **vf; /* Pointer to an array of num_vfs VF devices */
> > > bool vf_user_created; /* If VFs are created by user */
> > > } PCIESriovPF;
> > > --
> > > 2.55.0
> >
> >
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset
2026-10-28 13:51 ` Michael S. Tsirkin
@ 2026-10-28 14:12 ` Clément MATHIEU--DRIF
2026-10-28 14:19 ` Michael S. Tsirkin
0 siblings, 1 reply; 7+ messages in thread
From: Clément MATHIEU--DRIF @ 2026-10-28 14:12 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: qemu-devel@nongnu.org, odaki@rsg.ci.i.u-tokyo.ac.jp
On Wed, 2026-10-28 at 09:51 -0400, Michael S. Tsirkin wrote:
> Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
>
>
> On Wed, Oct 28, 2026 at 01:40:24PM +0000, Clément MATHIEU--DRIF wrote:
>
>
> > On Wed, 2026-10-28 at 09:14 -0400, Michael S. Tsirkin wrote:
> >
> > > Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
> > >
> > >
> > > On Mon, Sep 21, 2026 at 05:59:23AM +0000, Clément MATHIEU--DRIF wrote:
> > >
> > >
> > > > The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> > > > dedicated 32-bit configuration field. Fix the reset loop to write
> > > > 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> > > >
> > > > As a side effect of this change, update PCIESriovPF::vf_bar_type
> > > > to match the number of regions exposed by SR-IOV and rework the
> > > > associated assert statements.
> > > >
> > > > Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> > > > Signed-off-by: Clement Mathieu--Drif <[[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com)](mailto:[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com))>
> > >
> > >
> > >
> > > I queued another patch fixing this, yours will become a cleanup.
> > > Once my pull is merged, pls rebase and report.
> > >
> > > Thanks!
> >
> >
> > Hi Michael,
> >
> > Do you want version rebased on master or another ref?
> >
> > cmd
>
>
> pci branch in my tree will do
You already put the patch in the branch.
I'm ok with the remaining changes if we update the commit message to:
```
pcie_sriov: Rework the assert statements checking region numbers
pcie_sriov_pf_init_vf_bar: PCI_ROM_SLOT is already out of the SR-IOV regions.
pcie_sriov_pf_init_from_user_created_vfs: ROM region must never have a non-zero size.
```
>
>
>
> > >
> > >
> > >
> > > > ---
> > > > hw/pci/pcie_sriov.c | 9 +++++----
> > > > include/hw/pci/pcie_sriov.h | 2 +-
> > > > 2 files changed, 6 insertions(+), 5 deletions(-)
> > > >
> > > > diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> > > > index c41ac95bee..df61f281ea 100644
> > > > --- a/hw/pci/pcie_sriov.c
> > > > +++ b/hw/pci/pcie_sriov.c
> > > > @@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
> > > >
> > > > assert(sriov_cap > 0);
> > > > assert(region_num >= 0);
> > > > - assert(region_num < PCI_NUM_REGIONS);
> > > > - assert(region_num != PCI_ROM_SLOT);
> > > > + assert(region_num < PCI_SRIOV_NUM_BARS);
> > > >
> > > > wmask = ~(size - 1);
> > > > addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
> > > > @@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
> > > > dev->exp.sriov_pf.vf = vfs;
> > > > dev->exp.sriov_pf.vf_user_created = true;
> > > >
> > > > + assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
> > > > +
> > > > for (i = 0; i < PCI_NUM_REGIONS; i++) {
> > > > PCIIORegion *region = &vfs[0]->io_regions[i];
> > > >
> > > > @@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
> > > > */
> > > > pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
> > > >
> > > > - for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
> > > > - pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > > + for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
> > > > + pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > > dev->exp.sriov_pf.vf_bar_type[i]);
> > > > }
> > > > }
> > > > diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> > > > index b0ea6a62c7..5f81e3b1bb 100644
> > > > --- a/include/hw/pci/pcie_sriov.h
> > > > +++ b/include/hw/pci/pcie_sriov.h
> > > > @@ -16,7 +16,7 @@
> > > > #include "hw/pci/pci.h"
> > > >
> > > > typedef struct PCIESriovPF {
> > > > - uint8_t vf_bar_type[PCI_NUM_REGIONS]; /* Store type for each VF bar */
> > > > + uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS]; /* Store type for each VF bar */
> > > > PCIDevice **vf; /* Pointer to an array of num_vfs VF devices */
> > > > bool vf_user_created; /* If VFs are created by user */
> > > > } PCIESriovPF;
> > > > --
> > > > 2.55.0
> > >
> > >
> > >
> >
>
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset
2026-10-28 14:12 ` Clément MATHIEU--DRIF
@ 2026-10-28 14:19 ` Michael S. Tsirkin
0 siblings, 0 replies; 7+ messages in thread
From: Michael S. Tsirkin @ 2026-10-28 14:19 UTC (permalink / raw)
To: Clément MATHIEU--DRIF
Cc: qemu-devel@nongnu.org, odaki@rsg.ci.i.u-tokyo.ac.jp
On Wed, Oct 28, 2026 at 02:12:43PM +0000, Clément MATHIEU--DRIF wrote:
>
> On Wed, 2026-10-28 at 09:51 -0400, Michael S. Tsirkin wrote:
> > Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
> >
> >
> > On Wed, Oct 28, 2026 at 01:40:24PM +0000, Clément MATHIEU--DRIF wrote:
> >
> >
> > > On Wed, 2026-10-28 at 09:14 -0400, Michael S. Tsirkin wrote:
> > >
> > > > Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
> > > >
> > > >
> > > > On Mon, Sep 21, 2026 at 05:59:23AM +0000, Clément MATHIEU--DRIF wrote:
> > > >
> > > >
> > > > > The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> > > > > dedicated 32-bit configuration field. Fix the reset loop to write
> > > > > 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> > > > >
> > > > > As a side effect of this change, update PCIESriovPF::vf_bar_type
> > > > > to match the number of regions exposed by SR-IOV and rework the
> > > > > associated assert statements.
> > > > >
> > > > > Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> > > > > Signed-off-by: Clement Mathieu--Drif <[[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com)](mailto:[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com))>
> > > >
> > > >
> > > >
> > > > I queued another patch fixing this, yours will become a cleanup.
> > > > Once my pull is merged, pls rebase and report.
> > > >
> > > > Thanks!
> > >
> > >
> > > Hi Michael,
> > >
> > > Do you want version rebased on master or another ref?
> > >
> > > cmd
> >
> >
> > pci branch in my tree will do
>
> You already put the patch in the branch.
>
> I'm ok with the remaining changes if we update the commit message to:
>
> ```
> pcie_sriov: Rework the assert statements checking region numbers
>
> pcie_sriov_pf_init_vf_bar: PCI_ROM_SLOT is already out of the SR-IOV regions.
> pcie_sriov_pf_init_from_user_created_vfs: ROM region must never have a non-zero size.
> ```
Pls revert and post the corrected version, I will replace mine with that
one.
> >
> >
> >
> > > >
> > > >
> > > >
> > > > > ---
> > > > > hw/pci/pcie_sriov.c | 9 +++++----
> > > > > include/hw/pci/pcie_sriov.h | 2 +-
> > > > > 2 files changed, 6 insertions(+), 5 deletions(-)
> > > > >
> > > > > diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
> > > > > index c41ac95bee..df61f281ea 100644
> > > > > --- a/hw/pci/pcie_sriov.c
> > > > > +++ b/hw/pci/pcie_sriov.c
> > > > > @@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
> > > > >
> > > > > assert(sriov_cap > 0);
> > > > > assert(region_num >= 0);
> > > > > - assert(region_num < PCI_NUM_REGIONS);
> > > > > - assert(region_num != PCI_ROM_SLOT);
> > > > > + assert(region_num < PCI_SRIOV_NUM_BARS);
> > > > >
> > > > > wmask = ~(size - 1);
> > > > > addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
> > > > > @@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
> > > > > dev->exp.sriov_pf.vf = vfs;
> > > > > dev->exp.sriov_pf.vf_user_created = true;
> > > > >
> > > > > + assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
> > > > > +
> > > > > for (i = 0; i < PCI_NUM_REGIONS; i++) {
> > > > > PCIIORegion *region = &vfs[0]->io_regions[i];
> > > > >
> > > > > @@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
> > > > > */
> > > > > pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
> > > > >
> > > > > - for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
> > > > > - pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > > > + for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
> > > > > + pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
> > > > > dev->exp.sriov_pf.vf_bar_type[i]);
> > > > > }
> > > > > }
> > > > > diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
> > > > > index b0ea6a62c7..5f81e3b1bb 100644
> > > > > --- a/include/hw/pci/pcie_sriov.h
> > > > > +++ b/include/hw/pci/pcie_sriov.h
> > > > > @@ -16,7 +16,7 @@
> > > > > #include "hw/pci/pci.h"
> > > > >
> > > > > typedef struct PCIESriovPF {
> > > > > - uint8_t vf_bar_type[PCI_NUM_REGIONS]; /* Store type for each VF bar */
> > > > > + uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS]; /* Store type for each VF bar */
> > > > > PCIDevice **vf; /* Pointer to an array of num_vfs VF devices */
> > > > > bool vf_user_created; /* If VFs are created by user */
> > > > > } PCIESriovPF;
> > > > > --
> > > > > 2.55.0
> > > >
> > > >
> > > >
> > >
> >
> >
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-10-28 14:20 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-21 5:59 [PATCH] pcie_sriov: Avoid capability structure overflow in PF reset Clément MATHIEU--DRIF
2026-09-21 6:54 ` Akihiko Odaki
2026-10-28 13:14 ` Michael S. Tsirkin
2026-10-28 13:40 ` Clément MATHIEU--DRIF
2026-10-28 13:51 ` Michael S. Tsirkin
2026-10-28 14:12 ` Clément MATHIEU--DRIF
2026-10-28 14:19 ` Michael S. Tsirkin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.