id = 1164
title = "q35: incorrect values for PCIEXBAR masks"
state = "opened"
created_at = "2022-08-18T02:46:56.030Z"
closed_at = "n/a"
labels = ["device: PCI", "target: i386"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/1164"
host-os = "n/a"
host-arch = "n/a"
qemu-version = "n/a"
guest-os = "n/a"
guest-arch = "n/a"
description = """https://lore.kernel.org/all/1fded151ce5ecbf7010427871b908000b2aba9ee.1520867956.git.x1917x@gmail.com/

In function [mch_update_pciexbar](https://gitlab.com/qemu-project/qemu/-/blob/master/hw/pci-host/q35.c#L295)

There are two small issues in PCIEXBAR address mask handling:
- wrong bit positions for address mask bits (see PCIEXBAR description
  in Q35 datasheet)
- incorrect usage of 64ADR_MASK

Due to this, attempting to write a valid PCIEXBAR address may cause it to
shift to another address, causing memory layout corruption where emulated
MMIO regions may overlap real (passed through) MMIO ranges. Fix this
by providing correct values."""
reproduce = "n/a"
additional = """Q35 datasheet: https://www.intel.com/Assets/PDF/datasheet/316966.pdf  ( 5.1.16 PCIEXBAR—PCI Express* Register Range Base Address )"""