PCI Express downstream slot has a single PCI slot behind it, using PCI_DEVFN(PCI_SLOT(devfn), 0) does not give you function 0 in cases such as ARI as well as some error cases.
This is exactly what we are hitting: $ qemu-system-x86_64 -machine q35 -readconfig docs/q35-chipset.cfg -monitor stdio (qemu) device_add e1000e,bus=ich9-pcie-port-4,addr=00 (qemu) device_add e1000e,bus=ich9-pcie-port-4,addr=08 Segmentation fault (core dumped) The fix is to use the pci_get_function_0 API. Cc: qemu-sta...@nongnu.org Signed-off-by: Michael S. Tsirkin <m...@redhat.com> Reported-by: Eduardo Habkost <ehabk...@redhat.com> Tested-by: Cao jin <caoj.f...@cn.fujitsu.com> Tested-by: Eduardo Habkost <ehabk...@redhat.com> Reviewed-by: Eduardo Habkost <ehabk...@redhat.com> --- hw/pci/pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/pci/pci.c b/hw/pci/pci.c index 24fae16..637d545 100644 --- a/hw/pci/pci.c +++ b/hw/pci/pci.c @@ -982,8 +982,8 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus, pci_get_function_0(pci_dev)) { error_setg(errp, "PCI: slot %d function 0 already ocuppied by %s," " new func %s cannot be exposed to guest.", - PCI_SLOT(devfn), - bus->devices[PCI_DEVFN(PCI_SLOT(devfn), 0)]->name, + PCI_SLOT(pci_get_function_0(pci_dev)->devfn), + pci_get_function_0(pci_dev)->name, name); return NULL; -- MST