[xen staging-4.21] vpci/msix: check for BARs enabled in vpci_make_msix_hole

[patchbot@xxxxxxx]

commit 999c6fadf71485ea070add4cdb76926b6a9574ff
Author:     Stewart Hildebrand <stewart.hildebrand@xxxxxxx>
AuthorDate: Tue Mar 10 14:37:20 2026 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Mar 10 14:37:20 2026 +0100

    vpci/msix: check for BARs enabled in vpci_make_msix_hole
    
    A hotplugged PCI device may be added uninitialized. In particular,
    memory decoding might be disabled and the BARs might be zeroed. In this
    case, the BARs will not be mapped in p2m. However, vpci_make_msix_hole()
    unconditionally attempts to punch holes in p2m, leading to init_msix()
    failing:
    
    (XEN) d0v0 0000:01:00.0: existing mapping (mfn: 1c1880 type: 0) at 0 
clobbers MSIX MMIO area
    (XEN) d0 0000:01:00.0: init legacy cap 17 fail rc=-17, mask it
    
    vpci_make_msix_hole() should only attempt to punch holes if the BARs
    containing the MSI-X/PBA tables are mapped in p2m. Introduce a helper
    for checking if a BAR is enabled, and add a check for the situation
    inside vpci_make_msix_hole().
    
    As a result of the newly introduced checks in vpci_make_msix_hole(),
    move the call to vpci_make_msix_hole() within modify_decoding() to after
    setting ->enabled.
    
    Fixes: ee2eb6849d50 ("vpci: Refactor REGISTER_VPCI_INIT")
    Signed-off-by: Stewart Hildebrand <stewart.hildebrand@xxxxxxx>
    Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    master commit: 7c24d58a6e641e2979978c5abb312bff877dede3
    master date: 2026-03-05 09:27:50 +0100
---
 xen/drivers/vpci/header.c | 26 +++++++++++++-------------
 xen/drivers/vpci/msix.c   |  3 +++
 xen/include/xen/vpci.h    |  6 ++++++
 3 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/xen/drivers/vpci/header.c b/xen/drivers/vpci/header.c
index aae663bbf5..a3e8d0ec82 100644
--- a/xen/drivers/vpci/header.c
+++ b/xen/drivers/vpci/header.c
@@ -122,19 +122,6 @@ static void modify_decoding(const struct pci_dev *pdev, 
uint16_t cmd,
     bool map = cmd & PCI_COMMAND_MEMORY;
     unsigned int i;
 
-    /*
-     * Make sure there are no mappings in the MSIX MMIO areas, so that accesses
-     * can be trapped (and emulated) by Xen when the memory decoding bit is
-     * enabled.
-     *
-     * FIXME: punching holes after the p2m has been set up might be racy for
-     * DomU usage, needs to be revisited.
-     */
-#ifdef CONFIG_HAS_PCI_MSI
-    if ( map && !rom_only && vpci_make_msix_hole(pdev) )
-        return;
-#endif
-
     for ( i = 0; i < ARRAY_SIZE(header->bars); i++ )
     {
         struct vpci_bar *bar = &header->bars[i];
@@ -164,6 +151,19 @@ static void modify_decoding(const struct pci_dev *pdev, 
uint16_t cmd,
             bar->enabled = map;
     }
 
+    /*
+     * Make sure there are no mappings in the MSIX MMIO areas, so that accesses
+     * can be trapped (and emulated) by Xen when the memory decoding bit is
+     * enabled.
+     *
+     * FIXME: punching holes after the p2m has been set up might be racy for
+     * DomU usage, needs to be revisited.
+     */
+#ifdef CONFIG_HAS_PCI_MSI
+    if ( map && !rom_only && vpci_make_msix_hole(pdev) )
+        return;
+#endif
+
     if ( !rom_only )
     {
         pci_conf_write16(pdev->sbdf, PCI_COMMAND, cmd);
diff --git a/xen/drivers/vpci/msix.c b/xen/drivers/vpci/msix.c
index 032e471bb1..955fad3304 100644
--- a/xen/drivers/vpci/msix.c
+++ b/xen/drivers/vpci/msix.c
@@ -605,6 +605,9 @@ int vpci_make_msix_hole(const struct pci_dev *pdev)
         unsigned long end = PFN_DOWN(vmsix_table_addr(pdev->vpci, i) +
                                      vmsix_table_size(pdev->vpci, i) - 1);
 
+        if ( !vmsix_table_bar_valid(pdev->vpci, i) )
+            continue;
+
         for ( ; start <= end; start++ )
         {
             p2m_type_t t;
diff --git a/xen/include/xen/vpci.h b/xen/include/xen/vpci.h
index 9ae75d946a..50d0ad05a6 100644
--- a/xen/include/xen/vpci.h
+++ b/xen/include/xen/vpci.h
@@ -271,6 +271,12 @@ static inline paddr_t vmsix_table_addr(const struct vpci 
*vpci, unsigned int nr)
            (vpci->msix->tables[nr] & ~PCI_MSIX_BIRMASK);
 }
 
+static inline bool vmsix_table_bar_valid(const struct vpci *vpci,
+                                         unsigned int nr)
+{
+    return vpci->header.bars[vpci->msix->tables[nr] & 
PCI_MSIX_BIRMASK].enabled;
+}
+
 /*
  * Note regarding the size calculation of the PBA: the spec mentions "The last
  * QWORD will not necessarily be fully populated", so it implies that the PBA
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.21