Incorrect removal of permissions on PCI device unplug

[XSA-475, CVE-2025-58147, CVE-2025-58148]

.gitignore

@@ -6,4 +6,4 @@ lwip-1.3.0.tar.gz
 pciutils-2.2.9.tar.bz2
 zlib-1.2.3.tar.gz
 polarssl-1.1.4-gpl.tgz
-/xen-4.19.1.tar.gz
+/xen-4.19.3.tar.gz

sources

@@ -4,4 +4,4 @@ SHA512 (newlib-1.16.0.tar.gz) = 40eb96bbc6736a16b6399e0cdb73e853d0d90b685c967e77
 SHA512 (zlib-1.2.3.tar.gz) = 021b958fcd0d346c4ba761bcf0cc40f3522de6186cf5a0a6ea34a70504ce9622b1c2626fce40675bc8282cf5f5ade18473656abc38050f72f5d6480507a2106e
 SHA512 (polarssl-1.1.4-gpl.tgz) = 88da614e4d3f4409c4fd3bb3e44c7587ba051e3fed4e33d526069a67e8180212e1ea22da984656f50e290049f60ddca65383e5983c0f8884f648d71f698303ad
 SHA512 (pciutils-2.2.9.tar.bz2) = 2b3d98d027e46d8c08037366dde6f0781ca03c610ef2b380984639e4ef39899ed8d8b8e4cd9c9dc54df101279b95879bd66bfd4d04ad07fef41e847ea7ae32b5
-SHA512 (xen-4.19.1.tar.gz) = 6971d07d4eafd40186f35cf6de235badbdf0e1640974693b8fbd415876c46634094178a6157e6dfdc16af885c70ff3b7a72be35a88dcc63daf36e6eb08f9b17b
+SHA512 (xen-4.19.3.tar.gz) = 1e4ea1d6f3e1ac9ec5cba85ebe12a1fdbf9a2b6fcec413b7d9da46c47cd40850596b8612508eecfa5e5e85657c63c5f01540a0774d10fc68f91187987395e746

xen.spec

@@ -54,8 +54,8 @@
 
 Summary: Xen is a virtual machine monitor
 Name:    xen
-Version: 4.19.1
-Release: 3%{?dist}
+Version: 4.19.3
+Release: 7%{?dist}
 # Automatically converted from old format: GPLv2+ and LGPLv2+ and BSD - review is highly recommended.
 License: GPL-2.0-or-later AND LicenseRef-Callaway-LGPLv2+ AND LicenseRef-Callaway-BSD
 URL:     http://xen.org/
@@ -111,6 +111,14 @@ Patch43: xen.gcc11.fixes.patch
 Patch45: xen.gcc12.fixes.patch
 Patch46: xen.efi.build.patch
 Patch49: xen.python3.12.patch
+Patch50: xsa472-1.patch
+Patch51: xsa472-2.patch
+Patch52: xsa472-3.patch
+Patch53: xsa473-1.patch
+Patch54: xsa473-2.patch
+Patch55: xsa475-4.19-1.patch
+Patch56: xsa475-4.19-2.patch
+Patch57: xsa476-4.20.patch
 
 
 %if %build_qemutrad
@@ -319,6 +327,14 @@ manage Xen virtual machines.
 %patch 45 -p1
 %patch 46 -p1
 %patch 49 -p1
+%patch 50 -p1
+%patch 51 -p1
+%patch 52 -p1
+%patch 53 -p1
+%patch 54 -p1
+%patch 55 -p1
+%patch 56 -p1
+%patch 57 -p1
 
 # qemu-xen-traditional patches
 pushd tools/qemu-xen-traditional
@@ -551,9 +567,11 @@ find . -path licensedir -prune -o -path stubdom/ioemu -prune -o \
   install -m 644 $file licensedir/$file
 done
 
-############ workaround debugedit bug
-%ifarch aarch64
-/bin/rm -r dist/install/usr/{bin,lib64,libexec,sbin}
+############ remove xen*.efi.elf files to avoid debuginfo failure
+
+%ifarch x86_64
+rm dist/install/usr/lib/debug/xen-*.efi.elf
+rm %{buildroot}/usr/lib/debug/xen-*.efi.elf
 %endif
 
 ############ all done now ############
@@ -931,6 +949,45 @@ fi
 %endif
 
 %changelog
+* Fri Oct 24 2025 Michael Young <m.a.young@durham.ac.uk> - 4.19.3-7
+ - Incorrect removal of permissions on PCI device unplug [XSA-476,
+	CVE-2025-58149]
+
+* Tue Oct 21 2025 Michael Young <m.a.young@durham.ac.uk> - 4.19.3-5
+- x86: Incorrect input sanitisation in Viridian hypercalls [XSA-475,
+	CVE-2025-58147, CVE-2025-58148]
+
+* Mon Sep 15 2025 Michael Young <m.a.young@durham.ac.uk> - 4.19.3-3
+- Mutiple vulnerabilities in the Viridian interface [XSA-472,
+        CVE-2025-27466, CVE-2025-58142, CVE-2025-58143]
+- Arm issues with page refcounting [XSA-473, CVE-2025-58144,
+        CVE-2025-58145]
+
+* Tue Aug 05 2025 Michael Young <m.a.young@durham.ac.uk> - 4.19.3-1
+- update to xen-4.19.3
+  remove patches now included or superceded upstream
+  includes patches for
+  x86: Incorrect stubs exception handling for flags recovery [XSA-470,
+        CVE-2025-27465]
+  x86: Transitive Scheduler Attacks [XSA-471, CVE-2024-36350,
+        CVE-2024-36357]
+
+* Tue May 13 2025 Michael Young <m.a.young@durham.ac.uk> - 4.19.2-3
+- x86: Indirect Target Selection [XSA-469, CVE-2024-28956]
+
+* Mon Apr 07 2025 Michael Young <m.a.young@durham.ac.uk> - 4.19.2-1
+- update to xen-4.19.2
+  remove patches now included or superceded upstream
+  remove xen*.efi.elf files to avoid debuginfo failure
+  remove debugedit fix as no longer needed
+
+* Thu Feb 27 2025 Michael Young <m.a.young@durham.ac.uk> - 4.19.1-5
+- deadlock potential with VT-d and legacy PCI device pass-through
+	[XSA-467, CVE-2025-1713]
+
+* Wed Jan 29 2025 Jerry James <loganjerry@gmail.com> - 4.19.1-4
+- OCaml 5.2.1 rebuild for Fedora 41
+
 * Thu Jan 09 2025 Michael Young <m.a.young@durham.ac.uk> - 4.19.1-3
 - work around debugedit bug to fix aarch64 builds
 

xsa472-1.patch

@@ -0,0 +1,43 @@
+From 262114a440bf7c32fd6d215e243b3eaebdd6d7cd Mon Sep 17 00:00:00 2001
+From: Roger Pau Monne <roger.pau@citrix.com>
+Date: Thu, 10 Jul 2025 15:51:40 +0200
+Subject: [PATCH 1/3] x86/viridian: avoid NULL pointer dereference in
+ update_reference_tsc()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The function is only called when the MSR has the enabled bit set, but even
+then the page might not be mapped because the guest provided gfn is not
+suitable.
+
+Prevent a NULL pointer dereference in update_reference_tsc() by checking
+whether the page is mapped.
+
+This is CVE-2025-27466 / part of XSA-472.
+
+Fixes: 386b3365221d ('viridian: use viridian_map/unmap_guest_page() for reference tsc page')
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+---
+ xen/arch/x86/hvm/viridian/time.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c
+index 137577384f1e..ca6d526f46b7 100644
+--- a/xen/arch/x86/hvm/viridian/time.c
++++ b/xen/arch/x86/hvm/viridian/time.c
+@@ -26,6 +26,10 @@ static void update_reference_tsc(const struct domain *d, bool initialize)
+     HV_REFERENCE_TSC_PAGE *p = rt->ptr;
+     uint32_t seq;
+ 
++    /* Reference TSC page might not be mapped even if the MSR is enabled. */
++    if ( !p )
++        return;
++
+     if ( initialize )
+         clear_page(p);
+ 
+-- 
+2.49.0
+

xsa472-2.patch

@@ -0,0 +1,41 @@
+From 71c9568e290b51dfd7ab091ac98b272fd0aa0b90 Mon Sep 17 00:00:00 2001
+From: Roger Pau Monne <roger.pau@citrix.com>
+Date: Thu, 10 Jul 2025 15:58:51 +0200
+Subject: [PATCH 2/3] x86/viridian: avoid NULL pointer dereference in
+ viridian_synic_deliver_timer_msg()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The function is called unconditionally, regardless of whether the SIM page
+is mapped.  Avoid a NULL pointer dereference in
+viridian_synic_deliver_timer_msg() by checking whether the SIM page is
+mapped.
+
+This is CVE-2025-58142 / part of XSA-472.
+
+Fixes: 26fba3c85571 ('viridian: add implementation of synthetic timers')
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+---
+ xen/arch/x86/hvm/viridian/synic.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/xen/arch/x86/hvm/viridian/synic.c b/xen/arch/x86/hvm/viridian/synic.c
+index c3dc573b003d..e6cba7548f1b 100644
+--- a/xen/arch/x86/hvm/viridian/synic.c
++++ b/xen/arch/x86/hvm/viridian/synic.c
+@@ -338,6 +338,10 @@ bool viridian_synic_deliver_timer_msg(struct vcpu *v, unsigned int sintx,
+         .DeliveryTime = delivery,
+     };
+ 
++    /* Don't assume SIM page to be mapped. */
++    if ( !msg )
++        return false;
++
+     /*
+      * To avoid using an atomic test-and-set, and barrier before calling
+      * vlapic_set_irq(), this function must be called in context of the
+-- 
+2.49.0
+

xsa472-3.patch

@@ -0,0 +1,94 @@
+From aed4cfd64d178aee677a8790440addda03678cd6 Mon Sep 17 00:00:00 2001
+From: Roger Pau Monne <roger.pau@citrix.com>
+Date: Thu, 3 Jul 2025 13:09:03 +0200
+Subject: [PATCH 3/3] x86/viridian: protect concurrent modification of the
+ reference TSC page
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The reference TSC page is shared between all vCPUs, and the data stored in
+the domain struct.  However the handlers to set and clear it are not safe
+against concurrent accesses.  It's possible for two (or more) vCPUs to call
+HV_X64_MSR_REFERENCE_TSC at the same time and cause the in-use reference
+TSC page to be freed, while still being on the p2m.  This creates an
+information leak, where the page can end up mapped in another domain while
+still being part of the original domain p2m.
+
+It's also possible to underflow the reference counter, as multiple
+concurrent writes to HV_X64_MSR_REFERENCE_TSC can create an imbalance on
+the number of put_page_and_type() calls.
+
+Introduce a lock to protect the reference TSC domain field, thus
+serializing concurrent vCPU accesses.
+
+This is CVE-2025-58143 / part of XSA-472.
+
+Fixes: 386b3365221d ('viridian: use viridian_map/unmap_guest_page() for reference tsc page')
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+---
+ xen/arch/x86/hvm/viridian/time.c        | 4 ++++
+ xen/arch/x86/hvm/viridian/viridian.c    | 2 ++
+ xen/arch/x86/include/asm/hvm/viridian.h | 1 +
+ 3 files changed, 7 insertions(+)
+
+diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c
+index ca6d526f46b7..9311858d63c0 100644
+--- a/xen/arch/x86/hvm/viridian/time.c
++++ b/xen/arch/x86/hvm/viridian/time.c
+@@ -108,8 +108,10 @@ static void time_ref_count_thaw(const struct domain *d)
+ 
+     trc->off = (int64_t)trc->val - trc_val(d, 0);
+ 
++    spin_lock(&vd->lock);
+     if ( vd->reference_tsc.msr.enabled )
+         update_reference_tsc(d, false);
++    spin_unlock(&vd->lock);
+ }
+ 
+ static uint64_t time_ref_count(const struct domain *d)
+@@ -331,6 +333,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val)
+         if ( !(viridian_feature_mask(d) & HVMPV_reference_tsc) )
+             return X86EMUL_EXCEPTION;
+ 
++        spin_lock(&vd->lock);
+         viridian_unmap_guest_page(&vd->reference_tsc);
+         vd->reference_tsc.msr.raw = val;
+         viridian_dump_guest_page(v, "REFERENCE_TSC", &vd->reference_tsc);
+@@ -339,6 +342,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val)
+             viridian_map_guest_page(d, &vd->reference_tsc);
+             update_reference_tsc(d, true);
+         }
++        spin_unlock(&vd->lock);
+         break;
+ 
+     case HV_X64_MSR_TIME_REF_COUNT:
+diff --git a/xen/arch/x86/hvm/viridian/viridian.c b/xen/arch/x86/hvm/viridian/viridian.c
+index 7ea6c9016894..c0be24bd2210 100644
+--- a/xen/arch/x86/hvm/viridian/viridian.c
++++ b/xen/arch/x86/hvm/viridian/viridian.c
+@@ -494,6 +494,8 @@ int viridian_domain_init(struct domain *d)
+     if ( !d->arch.hvm.viridian )
+         return -ENOMEM;
+ 
++    spin_lock_init(&d->arch.hvm.viridian->lock);
++
+     rc = viridian_synic_domain_init(d);
+     if ( rc )
+         goto fail;
+diff --git a/xen/arch/x86/include/asm/hvm/viridian.h b/xen/arch/x86/include/asm/hvm/viridian.h
+index 4c8ff6e80b6f..47c9d13841ac 100644
+--- a/xen/arch/x86/include/asm/hvm/viridian.h
++++ b/xen/arch/x86/include/asm/hvm/viridian.h
+@@ -71,6 +71,7 @@ struct viridian_domain
+     DECLARE_BITMAP(hypercall_flags, _HCALL_nr);
+     struct viridian_time_ref_count time_ref_count;
+     struct viridian_page reference_tsc;
++    spinlock_t lock;
+ };
+ 
+ void cpuid_viridian_leaves(const struct vcpu *v, uint32_t leaf,
+-- 
+2.49.0
+

xsa473-1.patch

@@ -0,0 +1,43 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: Arm: foreign page handling in p2m_get_page_from_gfn()
+
+I can't see what would make the 1st of the assertions safe: For example,
+the P2M lock not being held, the foreign page may disappear before we
+get to call page_get_owner_and_reference(), which hence may return NULL.
+
+Even the 2nd, which appears to be safe safe, is lacking proper release
+build fallbacks.
+
+Drop the former in favor of an if(), and convert the latter to the
+equivalent of what x86 uses: ASSERT_UNREACHABLE() plus putting of the
+obtained page.
+
+This is CVE-2025-58144 / part of XSA-473.
+
+Fixes: 9486a8d07ba8 ("xen/arm: Handle remove foreign mapping")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Julien Grall <jgrall@amazon.com>
+
+--- a/xen/arch/arm/p2m.c
++++ b/xen/arch/arm/p2m.c
+@@ -74,10 +74,16 @@ struct page_info *p2m_get_page_from_gfn(
+      */
+     if ( p2m_is_foreign(p2mt) )
+     {
+-        struct domain *fdom = page_get_owner_and_reference(page);
+-        ASSERT(fdom != NULL);
+-        ASSERT(fdom != d);
+-        return page;
++        const struct domain *fdom = page_get_owner_and_reference(page);
++
++        if ( fdom )
++        {
++            if ( fdom != d )
++                return page;
++            ASSERT_UNREACHABLE();
++            put_page(page);
++        }
++        return NULL;
+     }
+ 
+     return get_page(page, d) ? page : NULL;

xsa473-2.patch

@@ -0,0 +1,62 @@
+From: Jan Beulich <jbeulich@suse.com>
+Subject: Arm: adjust locking in p2m_get_page_from_gfn()
+
+In order to safely acquire a reference for a foreign page mapping, the
+P2M lock needs to be held until we have the reference in hand (or
+getting one failed). Otherwise the page can change P2M type and
+ownership in between.
+
+This is CVE-2025-58145 / part of XSA-473.
+
+Fixes: 9486a8d07ba8 ("xen/arm: Handle remove foreign mapping")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Julien Grall <jgrall@amazon.com>
+
+--- a/xen/arch/arm/p2m.c
++++ b/xen/arch/arm/p2m.c
+@@ -53,18 +53,22 @@ mfn_t p2m_lookup(struct domain *d, gfn_t
+ struct page_info *p2m_get_page_from_gfn(struct domain *d, gfn_t gfn,
+                                         p2m_type_t *t)
+ {
++    struct p2m_domain *p2m = p2m_get_hostp2m(d);
+     struct page_info *page;
+     p2m_type_t p2mt;
+-    mfn_t mfn = p2m_lookup(d, gfn, &p2mt);
++    mfn_t mfn;
++
++    p2m_read_lock(p2m);
++    mfn = p2m_get_entry(p2m, gfn, &p2mt, NULL, NULL, NULL);
+ 
+     if ( t )
+         *t = p2mt;
+ 
+-    if ( !p2m_is_any_ram(p2mt) )
+-        return NULL;
+-
+-    if ( !mfn_valid(mfn) )
++    if ( !p2m_is_any_ram(p2mt) || !mfn_valid(mfn) )
++    {
++        p2m_read_unlock(p2m);
+         return NULL;
++    }
+ 
+     page = mfn_to_page(mfn);
+ 
+@@ -76,6 +80,8 @@ struct page_info *p2m_get_page_from_gfn(
+     {
+         const struct domain *fdom = page_get_owner_and_reference(page);
+ 
++        p2m_read_unlock(p2m);
++
+         if ( fdom )
+         {
+             if ( fdom != d )
+@@ -86,6 +92,8 @@ struct page_info *p2m_get_page_from_gfn(
+         return NULL;
+     }
+ 
++    p2m_read_unlock(p2m);
++
+     return get_page(page, d) ? page : NULL;
+ }
+ 

xsa475-4.19-1.patch

@@ -0,0 +1,26 @@
+From: Teddy Astie <teddy.astie@vates.tech>
+Subject: x86/viridian: Enforce bounds check in vpmask_set()
+
+Callers can pass vp/mask values which exceed the size of vpmask->mask.  Ensure
+we only set bits which are within bounds.
+
+This is XSA-475 / CVE-2025-58147.
+
+Fixes: b4124682db6e ("viridian: add ExProcessorMasks variants of the flush hypercalls")
+Signed-off-by: Teddy Astie <teddy.astie@vates.tech>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+
+diff --git a/xen/arch/x86/hvm/viridian/viridian.c b/xen/arch/x86/hvm/viridian/viridian.c
+index a41a70e37a29..41e93ef20fb2 100644
+--- a/xen/arch/x86/hvm/viridian/viridian.c
++++ b/xen/arch/x86/hvm/viridian/viridian.c
+@@ -562,7 +562,8 @@ static void vpmask_set(struct hypercall_vpmask *vpmask, unsigned int vp,
+ 
+         if ( mask & 1 )
+         {
+-            ASSERT(vp < HVM_MAX_VCPUS);
++            if ( vp >= HVM_MAX_VCPUS )
++                break;
+             __set_bit(vp, vpmask->mask);
+         }
+ 

xsa475-4.19-2.patch

@@ -0,0 +1,52 @@
+From: Teddy Astie <teddy.astie@vates.tech>
+Subject: x86/viridian: Enforce bounds check in send_ipi()
+
+Callers can pass in a vpmask which exceeds d->max_vcpus.  Prevent out-of-bound
+reads of d->vcpu[].
+
+This is XSA-475 / CVE-2025-58148.
+
+Fixes: 728acba1ba4a ("viridian: use hypercall_vpmask in hvcall_ipi()")
+Signed-off-by: Teddy Astie <teddy.astie@vates.tech>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+
+diff --git a/xen/arch/x86/hvm/viridian/viridian.c b/xen/arch/x86/hvm/viridian/viridian.c
+index 41e93ef20fb2..d45751365fde 100644
+--- a/xen/arch/x86/hvm/viridian/viridian.c
++++ b/xen/arch/x86/hvm/viridian/viridian.c
+@@ -577,26 +577,6 @@ static void vpmask_fill(struct hypercall_vpmask *vpmask)
+     bitmap_fill(vpmask->mask, HVM_MAX_VCPUS);
+ }
+ 
+-static unsigned int vpmask_first(const struct hypercall_vpmask *vpmask)
+-{
+-    return find_first_bit(vpmask->mask, HVM_MAX_VCPUS);
+-}
+-
+-static unsigned int vpmask_next(const struct hypercall_vpmask *vpmask,
+-                                unsigned int vp)
+-{
+-    /*
+-     * If vp + 1 > HVM_MAX_VCPUS then find_next_bit() will return
+-     * HVM_MAX_VCPUS, ensuring the for_each_vp ( ... ) loop terminates.
+-     */
+-    return find_next_bit(vpmask->mask, HVM_MAX_VCPUS, vp + 1);
+-}
+-
+-#define for_each_vp(vpmask, vp) \
+-	for ( (vp) = vpmask_first(vpmask); \
+-	      (vp) < HVM_MAX_VCPUS; \
+-	      (vp) = vpmask_next(vpmask, vp) )
+-
+ static unsigned int vpmask_nr(const struct hypercall_vpmask *vpmask)
+ {
+     return bitmap_weight(vpmask->mask, HVM_MAX_VCPUS);
+@@ -813,7 +793,7 @@ static void send_ipi(struct hypercall_vpmask *vpmask, uint8_t vector)
+     if ( nr > 1 )
+         cpu_raise_softirq_batch_begin();
+ 
+-    for_each_vp ( vpmask, vp )
++    for_each_set_bit ( vp, vpmask->mask, currd->max_vcpus )
+     {
+         struct vlapic *vlapic = vcpu_vlapic(currd->vcpu[vp]);
+ 

xsa476-4.20.patch

@@ -0,0 +1,57 @@
+From: Jiqian Chen <Jiqian.Chen@amd.com>
+Subject: tools/libs/light: fix BAR memory address truncation
+
+64-bit BAR memory address is truncated when removing a passthrough
+pci device from guest since it uses "unsigned int".
+
+So, change to use 64-bit type to fix this problem.
+
+This is XSA-476 / CVE-2025-58149.
+
+Fixes: b0a1af61678b ("libxenlight: implement pci passthrough")
+Signed-off-by: Jiqian Chen <Jiqian.Chen@amd.com>
+Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Acked-by: Anthony PERARD <anthony.perard@vates.tech>
+
+diff --git a/tools/libs/light/libxl_pci.c b/tools/libs/light/libxl_pci.c
+index 1647fd6f4756..7af602224aba 100644
+--- a/tools/libs/light/libxl_pci.c
++++ b/tools/libs/light/libxl_pci.c
+@@ -2179,7 +2179,7 @@ static void pci_remove_detached(libxl__egc *egc,
+ {
+     STATE_AO_GC(prs->aodev->ao);
+     libxl_ctx *ctx = libxl__gc_owner(gc);
+-    unsigned int start = 0, end = 0, flags = 0, size = 0;
++    uint64_t start = 0, end = 0, flags = 0, size = 0;
+     int  irq = 0, i, stubdomid = 0;
+     const char *sysfs_path;
+     FILE *f;
+@@ -2209,7 +2209,8 @@ static void pci_remove_detached(libxl__egc *egc,
+     }
+ 
+     for (i = 0; i < PROC_PCI_NUM_RESOURCES; i++) {
+-        if (fscanf(f, "0x%x 0x%x 0x%x\n", &start, &end, &flags) != 3)
++        if (fscanf(f, "0x%"SCNx64" 0x%"SCNx64" 0x%"SCNx64"\n",
++                   &start, &end, &flags) != 3)
+             continue;
+         size = end - start + 1;
+         if (start) {
+@@ -2218,7 +2219,7 @@ static void pci_remove_detached(libxl__egc *egc,
+                                                  size, 0);
+                 if (rc < 0)
+                     LOGED(ERROR, domid,
+-                          "xc_domain_ioport_permission error 0x%x/0x%x",
++                          "xc_domain_ioport_permission error %#"PRIx64"/%#"PRIx64,
+                           start,
+                           size);
+             } else {
+@@ -2228,7 +2229,7 @@ static void pci_remove_detached(libxl__egc *egc,
+                                                 0);
+                 if (rc < 0)
+                     LOGED(ERROR, domid,
+-                          "xc_domain_iomem_permission error 0x%x/0x%x",
++                          "xc_domain_iomem_permission error %#"PRIx64"/%#"PRIx64,
+                           start,
+                           size);
+             }