[PATCH 0/3] x86: Fixes for not-quite-XSA in pci_conf_write_intercept()

[PATCH 0/3] x86: Fixes for not-quite-XSA in pci_conf_write_intercept()

[Andrew Cooper]

Plumb pci_sbdf_t up and down the callchain to simplify parameter passing and
make it harder to forget the segment.

Andrew Cooper (3):
  x86/pv: Convert struct mmio_ro_emulate_ctxt to use pci_sbdf_t
  x86/pci: Convert pci_mmcfg_{read,write}() to use pci_sbdf_t
  x86/pci: Update pci_conf_write_intercept() to use pci_sbdf_t

 xen/arch/x86/include/asm/pci.h    |  5 ++---
 xen/arch/x86/pci.c                |  6 ++----
 xen/arch/x86/pv/emul-priv-op.c    | 10 +++++-----
 xen/arch/x86/pv/ro-page-fault.c   | 18 ++++++++++--------
 xen/arch/x86/x86_64/mmconfig_64.c | 18 ++++++++----------
 xen/arch/x86/x86_64/pci.c         | 12 ++++++------
 xen/include/xen/pci.h             |  8 ++++----
 7 files changed, 37 insertions(+), 40 deletions(-)


base-commit: a2ca4f8b9890899ca89d6116002e7a9c5957d8c6
-- 
2.39.5

[PATCH 1/3] x86/pv: Convert struct mmio_ro_emulate_ctxt to use pci_sbdf_t

[Andrew Cooper]

This will be used to simplify some call chains.  Reposition the new field to
avoid creating a interior hole.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <jbeulich@suse.com>
CC: Roger Pau Monné <roger@xenproject.org>
CC: Teddy Astie <teddy.astie@vates.tech>
---
 xen/arch/x86/pv/ro-page-fault.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/xen/arch/x86/pv/ro-page-fault.c b/xen/arch/x86/pv/ro-page-fault.c
index d89306d34fc6..e70e09a6a6a1 100644
--- a/xen/arch/x86/pv/ro-page-fault.c
+++ b/xen/arch/x86/pv/ro-page-fault.c
@@ -301,10 +301,10 @@ static int ptwr_do_page_fault(struct x86_emulate_ctxt *ctxt,
 
 struct mmio_ro_emulate_ctxt {
     unsigned long cr2;
-    /* Used only for mmcfg case */
-    unsigned int seg, bdf;
     /* Used only for non-mmcfg case */
     mfn_t mfn;
+    /* Used only for mmcfg case */
+    pci_sbdf_t sbdf;
 };
 
 static int cf_check mmcfg_intercept_write(
@@ -329,10 +329,10 @@ static int cf_check mmcfg_intercept_write(
     }
 
     offset &= 0xfff;
-    if ( pci_conf_write_intercept(mmio_ctxt->seg, mmio_ctxt->bdf,
+    if ( pci_conf_write_intercept(mmio_ctxt->sbdf.seg, mmio_ctxt->sbdf.bdf,
                                   offset, bytes, p_data) >= 0 )
-        pci_mmcfg_write(mmio_ctxt->seg, PCI_BUS(mmio_ctxt->bdf),
-                        PCI_DEVFN(mmio_ctxt->bdf), offset, bytes,
+        pci_mmcfg_write(mmio_ctxt->sbdf.seg, mmio_ctxt->sbdf.bus,
+                        mmio_ctxt->sbdf.devfn, offset, bytes,
                         *(uint32_t *)p_data);
 
     return X86EMUL_OKAY;
@@ -390,6 +390,7 @@ static int mmio_ro_do_page_fault(struct x86_emulate_ctxt *ctxt,
                                  unsigned long addr, l1_pgentry_t pte)
 {
     struct mmio_ro_emulate_ctxt mmio_ro_ctxt = { .cr2 = addr };
+    unsigned int seg, bdf;
     mfn_t mfn = l1e_get_mfn(pte);
 
     if ( mfn_valid(mfn) )
@@ -404,8 +405,12 @@ static int mmio_ro_do_page_fault(struct x86_emulate_ctxt *ctxt,
     }
 
     ctxt->data = &mmio_ro_ctxt;
-    if ( pci_ro_mmcfg_decode(mfn_x(mfn), &mmio_ro_ctxt.seg, &mmio_ro_ctxt.bdf) )
+    if ( pci_ro_mmcfg_decode(mfn_x(mfn), &seg, &bdf) )
+    {
+        mmio_ro_ctxt.sbdf = PCI_SBDF(seg, bdf);
+
         return x86_emulate(ctxt, &mmcfg_intercept_ops);
+    }
 
     mmio_ro_ctxt.mfn = mfn;
 
-- 
2.39.5

[PATCH 2/3] x86/pci: Convert pci_mmcfg_{read,write}() to use pci_sbdf_t

[Andrew Cooper]

All callers now have an sbdf already.  Pass it down directly, rather than
splitting into three parameters.

In turn this shows that bus and devfn bounds checks were unreachable, making
them safe to drop.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <jbeulich@suse.com>
CC: Roger Pau Monné <roger@xenproject.org>
CC: Teddy Astie <teddy.astie@vates.tech>
---
 xen/arch/x86/pv/ro-page-fault.c   |  4 +---
 xen/arch/x86/x86_64/mmconfig_64.c | 18 ++++++++----------
 xen/arch/x86/x86_64/pci.c         | 12 ++++++------
 xen/include/xen/pci.h             |  8 ++++----
 4 files changed, 19 insertions(+), 23 deletions(-)

diff --git a/xen/arch/x86/pv/ro-page-fault.c b/xen/arch/x86/pv/ro-page-fault.c
index e70e09a6a6a1..c10541709e8b 100644
--- a/xen/arch/x86/pv/ro-page-fault.c
+++ b/xen/arch/x86/pv/ro-page-fault.c
@@ -331,9 +331,7 @@ static int cf_check mmcfg_intercept_write(
     offset &= 0xfff;
     if ( pci_conf_write_intercept(mmio_ctxt->sbdf.seg, mmio_ctxt->sbdf.bdf,
                                   offset, bytes, p_data) >= 0 )
-        pci_mmcfg_write(mmio_ctxt->sbdf.seg, mmio_ctxt->sbdf.bus,
-                        mmio_ctxt->sbdf.devfn, offset, bytes,
-                        *(uint32_t *)p_data);
+        pci_mmcfg_write(mmio_ctxt->sbdf, offset, bytes, *(uint32_t *)p_data);
 
     return X86EMUL_OKAY;
 }
diff --git a/xen/arch/x86/x86_64/mmconfig_64.c b/xen/arch/x86/x86_64/mmconfig_64.c
index 91b1a398e646..6477bf8b44bd 100644
--- a/xen/arch/x86/x86_64/mmconfig_64.c
+++ b/xen/arch/x86/x86_64/mmconfig_64.c
@@ -55,19 +55,18 @@ static char __iomem *pci_dev_base(unsigned int seg, unsigned int bus, unsigned i
      return addr + ((bus << 20) | (devfn << 12));
 }
 
-int pci_mmcfg_read(unsigned int seg, unsigned int bus,
-              unsigned int devfn, int reg, int len, u32 *value)
+int pci_mmcfg_read(
+    pci_sbdf_t sbdf, unsigned int reg, unsigned int len, uint32_t *value)
 {
     char __iomem *addr;
 
     /* Why do we have this when nobody checks it. How about a BUG()!? -AK */
-    if (unlikely((bus > 255) || (devfn > 255) ||
-                 (reg + len > PCI_CFG_SPACE_EXP_SIZE))) {
+    if (unlikely(reg + len > PCI_CFG_SPACE_EXP_SIZE)) {
 err:        *value = -1;
         return -EINVAL;
     }
 
-    addr = pci_dev_base(seg, bus, devfn);
+    addr = pci_dev_base(sbdf.seg, sbdf.bus, sbdf.devfn);
     if (!addr)
         goto err;
 
@@ -86,17 +85,16 @@ err:        *value = -1;
     return 0;
 }
 
-int pci_mmcfg_write(unsigned int seg, unsigned int bus,
-               unsigned int devfn, int reg, int len, u32 value)
+int pci_mmcfg_write(
+    pci_sbdf_t sbdf, unsigned int reg, unsigned int len, uint32_t value)
 {
     char __iomem *addr;
 
     /* Why do we have this when nobody checks it. How about a BUG()!? -AK */
-    if (unlikely((bus > 255) || (devfn > 255) ||
-                 (reg + len > PCI_CFG_SPACE_EXP_SIZE)))
+    if (unlikely(reg + len > PCI_CFG_SPACE_EXP_SIZE))
         return -EINVAL;
 
-    addr = pci_dev_base(seg, bus, devfn);
+    addr = pci_dev_base(sbdf.seg, sbdf.bus, sbdf.devfn);
     if (!addr)
         return -EINVAL;
 
diff --git a/xen/arch/x86/x86_64/pci.c b/xen/arch/x86/x86_64/pci.c
index 6298141c3ca7..970c010e12f6 100644
--- a/xen/arch/x86/x86_64/pci.c
+++ b/xen/arch/x86/x86_64/pci.c
@@ -17,7 +17,7 @@ uint8_t pci_conf_read8(pci_sbdf_t sbdf, unsigned int reg)
 
     if ( sbdf.seg || reg > 255 )
     {
-        pci_mmcfg_read(sbdf.seg, sbdf.bus, sbdf.devfn, reg, 1, &value);
+        pci_mmcfg_read(sbdf, reg, 1, &value);
         return value;
     }
 
@@ -30,7 +30,7 @@ uint16_t pci_conf_read16(pci_sbdf_t sbdf, unsigned int reg)
     {
         uint32_t value;
 
-        pci_mmcfg_read(sbdf.seg, sbdf.bus, sbdf.devfn, reg, 2, &value);
+        pci_mmcfg_read(sbdf, reg, 2, &value);
         return value;
     }
 
@@ -43,7 +43,7 @@ uint32_t pci_conf_read32(pci_sbdf_t sbdf, unsigned int reg)
     {
         uint32_t value;
 
-        pci_mmcfg_read(sbdf.seg, sbdf.bus, sbdf.devfn, reg, 4, &value);
+        pci_mmcfg_read(sbdf, reg, 4, &value);
         return value;
     }
 
@@ -53,7 +53,7 @@ uint32_t pci_conf_read32(pci_sbdf_t sbdf, unsigned int reg)
 void pci_conf_write8(pci_sbdf_t sbdf, unsigned int reg, uint8_t data)
 {
     if ( sbdf.seg || reg > 255 )
-        pci_mmcfg_write(sbdf.seg, sbdf.bus, sbdf.devfn, reg, 1, data);
+        pci_mmcfg_write(sbdf, reg, 1, data);
     else
         pci_conf_write(PCI_CONF_ADDRESS(sbdf, reg), reg & 3, 1, data);
 }
@@ -61,7 +61,7 @@ void pci_conf_write8(pci_sbdf_t sbdf, unsigned int reg, uint8_t data)
 void pci_conf_write16(pci_sbdf_t sbdf, unsigned int reg, uint16_t data)
 {
     if ( sbdf.seg || reg > 255 || !IS_ALIGNED(reg, 2) )
-        pci_mmcfg_write(sbdf.seg, sbdf.bus, sbdf.devfn, reg, 2, data);
+        pci_mmcfg_write(sbdf, reg, 2, data);
     else
         pci_conf_write(PCI_CONF_ADDRESS(sbdf, reg), reg & 2, 2, data);
 }
@@ -69,7 +69,7 @@ void pci_conf_write16(pci_sbdf_t sbdf, unsigned int reg, uint16_t data)
 void pci_conf_write32(pci_sbdf_t sbdf, unsigned int reg, uint32_t data)
 {
     if ( sbdf.seg || reg > 255 || !IS_ALIGNED(reg, 4) )
-        pci_mmcfg_write(sbdf.seg, sbdf.bus, sbdf.devfn, reg, 4, data);
+        pci_mmcfg_write(sbdf, reg, 4, data);
     else
         pci_conf_write(PCI_CONF_ADDRESS(sbdf, reg), 0, 4, data);
 }
diff --git a/xen/include/xen/pci.h b/xen/include/xen/pci.h
index ade882caeef4..b7a35371a71a 100644
--- a/xen/include/xen/pci.h
+++ b/xen/include/xen/pci.h
@@ -258,10 +258,10 @@ void pci_conf_write16(pci_sbdf_t sbdf, unsigned int reg, uint16_t data);
 void pci_conf_write32(pci_sbdf_t sbdf, unsigned int reg, uint32_t data);
 uint32_t pci_conf_read(uint32_t cf8, uint8_t offset, uint8_t bytes);
 void pci_conf_write(uint32_t cf8, uint8_t offset, uint8_t bytes, uint32_t data);
-int pci_mmcfg_read(unsigned int seg, unsigned int bus,
-                   unsigned int devfn, int reg, int len, u32 *value);
-int pci_mmcfg_write(unsigned int seg, unsigned int bus,
-                    unsigned int devfn, int reg, int len, u32 value);
+int pci_mmcfg_read(
+    pci_sbdf_t sbdf, unsigned int reg, unsigned int len, uint32_t *value);
+int pci_mmcfg_write(
+    pci_sbdf_t sbdf, unsigned int reg, unsigned int len, uint32_t value);
 unsigned int pci_find_cap_offset(pci_sbdf_t sbdf, unsigned int cap);
 unsigned int pci_find_next_cap_ttl(pci_sbdf_t sbdf, unsigned int pos,
                                    const unsigned int caps[], unsigned int n,
-- 
2.39.5

[PATCH 3/3] x86/pci: Update pci_conf_write_intercept() to use pci_sbdf_t

[Andrew Cooper]

... rather than splitting across two parameters.

No functional change.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <jbeulich@suse.com>
CC: Roger Pau Monné <roger@xenproject.org>
CC: Teddy Astie <teddy.astie@vates.tech>
---
 xen/arch/x86/include/asm/pci.h  |  5 ++---
 xen/arch/x86/pci.c              |  6 ++----
 xen/arch/x86/pv/emul-priv-op.c  | 10 +++++-----
 xen/arch/x86/pv/ro-page-fault.c |  3 +--
 4 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/xen/arch/x86/include/asm/pci.h b/xen/arch/x86/include/asm/pci.h
index 0b98081aeaa4..8d8e66928d7f 100644
--- a/xen/arch/x86/include/asm/pci.h
+++ b/xen/arch/x86/include/asm/pci.h
@@ -36,9 +36,8 @@ struct arch_pci_dev {
     struct page_list_head pgtables_list;
 };
 
-int pci_conf_write_intercept(unsigned int seg, unsigned int bdf,
-                             unsigned int reg, unsigned int size,
-                             uint32_t *data);
+int pci_conf_write_intercept(
+    pci_sbdf_t sbdf, unsigned int reg, unsigned int size, uint32_t *data);
 int pci_msi_conf_write_intercept(struct pci_dev *pdev, unsigned int reg,
                                  unsigned int size, uint32_t *data);
 bool pci_mmcfg_decode(unsigned long mfn, unsigned int *seg,
diff --git a/xen/arch/x86/pci.c b/xen/arch/x86/pci.c
index 4c279875517b..0731f7e762b8 100644
--- a/xen/arch/x86/pci.c
+++ b/xen/arch/x86/pci.c
@@ -72,11 +72,9 @@ void pci_conf_write(uint32_t cf8, uint8_t offset, uint8_t bytes, uint32_t data)
     spin_unlock_irqrestore(&pci_config_lock, flags);
 }
 
-int pci_conf_write_intercept(unsigned int seg, unsigned int bdf,
-                             unsigned int reg, unsigned int size,
-                             uint32_t *data)
+int pci_conf_write_intercept(
+    pci_sbdf_t sbdf, unsigned int reg, unsigned int size, uint32_t *data)
 {
-    pci_sbdf_t sbdf = PCI_SBDF(seg, bdf);
     struct pci_dev *pdev;
     int rc = xsm_pci_config_permission(XSM_HOOK, current->domain, sbdf.sbdf,
                                        reg, reg + size - 1, true);
diff --git a/xen/arch/x86/pv/emul-priv-op.c b/xen/arch/x86/pv/emul-priv-op.c
index dc21515e447b..fd9b533e57c7 100644
--- a/xen/arch/x86/pv/emul-priv-op.c
+++ b/xen/arch/x86/pv/emul-priv-op.c
@@ -228,7 +228,7 @@ static bool admin_io_okay(unsigned int port, unsigned int bytes,
 static bool pci_cfg_ok(struct domain *currd, unsigned int start,
                        unsigned int size, uint32_t *write)
 {
-    uint32_t machine_bdf;
+    pci_sbdf_t sbdf = {}; /* Seg always 0 for IO port CFG accesses. */
 
     if ( !is_hardware_domain(currd) )
         return false;
@@ -236,12 +236,12 @@ static bool pci_cfg_ok(struct domain *currd, unsigned int start,
     if ( !CF8_ENABLED(currd->arch.pci_cf8) )
         return true;
 
-    machine_bdf = CF8_BDF(currd->arch.pci_cf8);
+    sbdf.bdf = CF8_BDF(currd->arch.pci_cf8);
     if ( write )
     {
         const unsigned long *ro_map = pci_get_ro_map(0);
 
-        if ( ro_map && test_bit(machine_bdf, ro_map) )
+        if ( ro_map && test_bit(sbdf.bdf, ro_map) )
             return false;
     }
     start |= CF8_ADDR_LO(currd->arch.pci_cf8);
@@ -259,9 +259,9 @@ static bool pci_cfg_ok(struct domain *currd, unsigned int start,
     }
 
     return !write ?
-           xsm_pci_config_permission(XSM_HOOK, currd, machine_bdf,
+           xsm_pci_config_permission(XSM_HOOK, currd, sbdf.sbdf,
                                      start, start + size - 1, false) == 0 :
-           pci_conf_write_intercept(0, machine_bdf, start, size, write) >= 0;
+           pci_conf_write_intercept(sbdf, start, size, write) >= 0;
 }
 
 static uint32_t guest_io_read(unsigned int port, unsigned int bytes,
diff --git a/xen/arch/x86/pv/ro-page-fault.c b/xen/arch/x86/pv/ro-page-fault.c
index c10541709e8b..34349e9437eb 100644
--- a/xen/arch/x86/pv/ro-page-fault.c
+++ b/xen/arch/x86/pv/ro-page-fault.c
@@ -329,8 +329,7 @@ static int cf_check mmcfg_intercept_write(
     }
 
     offset &= 0xfff;
-    if ( pci_conf_write_intercept(mmio_ctxt->sbdf.seg, mmio_ctxt->sbdf.bdf,
-                                  offset, bytes, p_data) >= 0 )
+    if ( pci_conf_write_intercept(mmio_ctxt->sbdf, offset, bytes, p_data) >= 0 )
         pci_mmcfg_write(mmio_ctxt->sbdf, offset, bytes, *(uint32_t *)p_data);
 
     return X86EMUL_OKAY;
-- 
2.39.5

Re: [PATCH 0/3] x86: Fixes for not-quite-XSA in pci_conf_write_intercept()

[Jan Beulich]

On 08.09.2026 23:57, Andrew Cooper wrote:
> Plumb pci_sbdf_t up and down the callchain to simplify parameter passing and
> make it harder to forget the segment.
> 
> Andrew Cooper (3):
>   x86/pv: Convert struct mmio_ro_emulate_ctxt to use pci_sbdf_t
>   x86/pci: Convert pci_mmcfg_{read,write}() to use pci_sbdf_t
>   x86/pci: Update pci_conf_write_intercept() to use pci_sbdf_t

Reviewed-by: Jan Beulich <jbeulich@suse.com>

[PATCH 4/3] x86/PCI: use pci_sbdf_t also for pci_dev_base()

[Jan Beulich]

No need to pass three arguments when both callers already hold SBDF in
their hands.

No functional change.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
With gcc16 this turns out to change generated code only in so far as a
SHR moves position.

--- a/xen/arch/x86/x86_64/mmconfig_64.c
+++ b/xen/arch/x86/x86_64/mmconfig_64.c
@@ -45,14 +45,15 @@ static char __iomem *get_virt(unsigned i
     return NULL;
 }
 
-static char __iomem *pci_dev_base(unsigned int seg, unsigned int bus, unsigned int devfn)
+static char __iomem *pci_dev_base(pci_sbdf_t sbdf)
 {
-    char __iomem *addr;
+    unsigned int bus = sbdf.bus;
+    char __iomem *addr = get_virt(sbdf.seg, &bus);
 
-    addr = get_virt(seg, &bus);
     if (!addr)
         return NULL;
-     return addr + ((bus << 20) | (devfn << 12));
+
+    return addr + ((bus << 20) | (sbdf.devfn << 12));
 }
 
 int pci_mmcfg_read(
@@ -66,7 +67,7 @@ err:        *value = -1;
         return -EINVAL;
     }
 
-    addr = pci_dev_base(sbdf.seg, sbdf.bus, sbdf.devfn);
+    addr = pci_dev_base(sbdf);
     if (!addr)
         goto err;
 
@@ -94,7 +95,7 @@ int pci_mmcfg_write(
     if (unlikely(reg + len > PCI_CFG_SPACE_EXP_SIZE))
         return -EINVAL;
 
-    addr = pci_dev_base(sbdf.seg, sbdf.bus, sbdf.devfn);
+    addr = pci_dev_base(sbdf);
     if (!addr)
         return -EINVAL;
 

Re: [PATCH 4/3] x86/PCI: use pci_sbdf_t also for pci_dev_base()

[Roger Pau Monné]

On Wed, Sep 09, 2026 at 09:16:46AM +0200, Jan Beulich wrote:
> No need to pass three arguments when both callers already hold SBDF in
> their hands.
> 
> No functional change.
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Acked-by: Roger Pau Monné <roger@xenproject.org>

Thanks, Roger.

Re: [PATCH 0/3] x86: Fixes for not-quite-XSA in pci_conf_write_intercept()

[Teddy Astie]

[-- Attachment #1.1: Type: text/plain, Size: 969 bytes --]

Le 08/09/2026 à 23:57, Andrew Cooper a écrit :
> Plumb pci_sbdf_t up and down the callchain to simplify parameter passing and
> make it harder to forget the segment.
> 
> Andrew Cooper (3):
>    x86/pv: Convert struct mmio_ro_emulate_ctxt to use pci_sbdf_t
>    x86/pci: Convert pci_mmcfg_{read,write}() to use pci_sbdf_t
>    x86/pci: Update pci_conf_write_intercept() to use pci_sbdf_t
> 
>   xen/arch/x86/include/asm/pci.h    |  5 ++---
>   xen/arch/x86/pci.c                |  6 ++----
>   xen/arch/x86/pv/emul-priv-op.c    | 10 +++++-----
>   xen/arch/x86/pv/ro-page-fault.c   | 18 ++++++++++--------
>   xen/arch/x86/x86_64/mmconfig_64.c | 18 ++++++++----------
>   xen/arch/x86/x86_64/pci.c         | 12 ++++++------
>   xen/include/xen/pci.h             |  8 ++++----
>   7 files changed, 37 insertions(+), 40 deletions(-)
> 
> 
> base-commit: a2ca4f8b9890899ca89d6116002e7a9c5957d8c6

Reviewed-by: Teddy Astie <teddy.astie@vates.tech>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 665 bytes --]

Re: [PATCH 4/3] x86/PCI: use pci_sbdf_t also for pci_dev_base()

[Teddy Astie]

[-- Attachment #1.1: Type: text/plain, Size: 1611 bytes --]

Le 09/09/2026 à 09:16, Jan Beulich a écrit :
> No need to pass three arguments when both callers already hold SBDF in
> their hands.
> 
> No functional change.
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> ---
> With gcc16 this turns out to change generated code only in so far as a
> SHR moves position.
> 
> --- a/xen/arch/x86/x86_64/mmconfig_64.c
> +++ b/xen/arch/x86/x86_64/mmconfig_64.c
> @@ -45,14 +45,15 @@ static char __iomem *get_virt(unsigned i
>       return NULL;
>   }
>   
> -static char __iomem *pci_dev_base(unsigned int seg, unsigned int bus, unsigned int devfn)
> +static char __iomem *pci_dev_base(pci_sbdf_t sbdf)
>   {
> -    char __iomem *addr;
> +    unsigned int bus = sbdf.bus;
> +    char __iomem *addr = get_virt(sbdf.seg, &bus);
>   
> -    addr = get_virt(seg, &bus);
>       if (!addr)
>           return NULL;
> -     return addr + ((bus << 20) | (devfn << 12));
> +
> +    return addr + ((bus << 20) | (sbdf.devfn << 12));
>   }
>   
>   int pci_mmcfg_read(
> @@ -66,7 +67,7 @@ err:        *value = -1;
>           return -EINVAL;
>       }
>   
> -    addr = pci_dev_base(sbdf.seg, sbdf.bus, sbdf.devfn);
> +    addr = pci_dev_base(sbdf);
>       if (!addr)
>           goto err;
>   
> @@ -94,7 +95,7 @@ int pci_mmcfg_write(
>       if (unlikely(reg + len > PCI_CFG_SPACE_EXP_SIZE))
>           return -EINVAL;
>   
> -    addr = pci_dev_base(sbdf.seg, sbdf.bus, sbdf.devfn);
> +    addr = pci_dev_base(sbdf);
>       if (!addr)
>           return -EINVAL;
>   

Reviewed-by: Teddy Astie <teddy.astie@vates.tech>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 665 bytes --]

Re: [PATCH 0/3] x86: Fixes for not-quite-XSA in pci_conf_write_intercept()

[Andrew Cooper]

On 09/09/2026 7:39 am, Jan Beulich wrote:
> On 08.09.2026 23:57, Andrew Cooper wrote:
>> Plumb pci_sbdf_t up and down the callchain to simplify parameter passing and
>> make it harder to forget the segment.
>>
>> Andrew Cooper (3):
>>   x86/pv: Convert struct mmio_ro_emulate_ctxt to use pci_sbdf_t
>>   x86/pci: Convert pci_mmcfg_{read,write}() to use pci_sbdf_t
>>   x86/pci: Update pci_conf_write_intercept() to use pci_sbdf_t
> Reviewed-by: Jan Beulich <jbeulich@suse.com>
>

Thanks.

It's worth saying that there's also some cleanup to XSM wanting to
happen, but I'm going to wait until your series is fully in before even
starting to look at that.

~Andrew

Re: [PATCH 4/3] x86/PCI: use pci_sbdf_t also for pci_dev_base()

[Andrew Cooper]

On 09/09/2026 8:16 am, Jan Beulich wrote:
> No need to pass three arguments when both callers already hold SBDF in
> their hands.
>
> No functional change.
>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>