The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
dedicated 32-bit configuration field. Fix the reset loop to write
32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.

As a side effect of this change, update PCIESriovPF::vf_bar_type
to match the number of regions exposed by SR-IOV and rework the
associated assert statements.

Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
---
 hw/pci/pcie_sriov.c         | 9 +++++----
 include/hw/pci/pcie_sriov.h | 2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index c41ac95bee..df61f281ea 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -229,8 +229,7 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
 
     assert(sriov_cap > 0);
     assert(region_num >= 0);
-    assert(region_num < PCI_NUM_REGIONS);
-    assert(region_num != PCI_ROM_SLOT);
+    assert(region_num < PCI_SRIOV_NUM_BARS);
 
     wmask = ~(size - 1);
     addr = sriov_cap + PCI_SRIOV_BAR + region_num * 4;
@@ -344,6 +343,8 @@ int16_t pcie_sriov_pf_init_from_user_created_vfs(PCIDevice *dev,
     dev->exp.sriov_pf.vf = vfs;
     dev->exp.sriov_pf.vf_user_created = true;
 
+    assert(vfs[0]->io_regions[PCI_ROM_SLOT].size == 0);
+
     for (i = 0; i < PCI_NUM_REGIONS; i++) {
         PCIIORegion *region = &vfs[0]->io_regions[i];
 
@@ -463,8 +464,8 @@ void pcie_sriov_pf_reset(PCIDevice *dev)
      */
     pci_set_word(dev->config + sriov_cap + PCI_SRIOV_SYS_PGSIZE, 0x1);
 
-    for (uint16_t i = 0; i < PCI_NUM_REGIONS; i++) {
-        pci_set_quad(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
+    for (uint16_t i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
+        pci_set_long(dev->config + sriov_cap + PCI_SRIOV_BAR + i * 4,
                      dev->exp.sriov_pf.vf_bar_type[i]);
     }
 }
diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
index b0ea6a62c7..5f81e3b1bb 100644
--- a/include/hw/pci/pcie_sriov.h
+++ b/include/hw/pci/pcie_sriov.h
@@ -16,7 +16,7 @@
 #include "hw/pci/pci.h"
 
 typedef struct PCIESriovPF {
-    uint8_t vf_bar_type[PCI_NUM_REGIONS];   /* Store type for each VF bar */
+    uint8_t vf_bar_type[PCI_SRIOV_NUM_BARS];   /* Store type for each VF bar */
     PCIDevice **vf;     /* Pointer to an array of num_vfs VF devices */
     bool vf_user_created; /* If VFs are created by user */
 } PCIESriovPF;
-- 
2.55.0

On 2026/09/21 14:59, Clément MATHIEU--DRIF wrote:
> The SR-IOV PCIe capability exposes 6 regions (no ROM), each with a
> dedicated 32-bit configuration field. Fix the reset loop to write
> 32 bits instead of 64 bits and stop after PCI_SRIOV_NUM_BARS iterations.
> 
> As a side effect of this change, update PCIESriovPF::vf_bar_type
> to match the number of regions exposed by SR-IOV and rework the
> associated assert statements.
> 
> Fixes: c8bc4db403e1 ("pcie_sriov: Reset SR-IOV extended capability")
> Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>