Skip to content

Conversation

@cagatay-y
Copy link

According to the PCI spec (v6.0, p 930), "[t]o determine how much address space a Function requires, system software should write a value of all 1's to each BAR register and then read the value back." QEMU (and possibly others) mask the provided address based on the size of the address space [2], which is always larger than 128 bytes for memory BARs, so the value of the last nibble has no effect. However, cloud-hypervisor (with possibly others) is more strict in its interpretation of the specification and check for exactly the all-bits-set pattern [3]. On the latter platforms, the current pattern can be erroneously interpreted as a BAR relocation instead of sizing.

According to the PCI spec [1], "[t]o determine how much address space a
Function requires, system software should write a value of all 1's to
each BAR register and then read the value back." QEMU (and possibly
others) mask the provided address based on the size of the address space
[2], which is always larger than 128 bytes for memory BARs, so the value
of the last nibble has no effect. However, cloud-hypervisor (with
possibly others) is more strict in its interpretation of the
specification and check for exactly the all-bits-set pattern [3]. On the
latter platforms, the current pattern can be erroneously interpreted as
a BAR relocation instead of sizing.

[1]: PCI Express Base Specification Revision 6.0, page 930
[2]: v10.1.2:hw/pci/pci.c:1658
[3]: v49.0:pci/src/configuration.rs:979
@bjorn3
Copy link
Contributor

bjorn3 commented Nov 20, 2025

I don't have a copy of the pci spec (not worth it to pay for one and couldn't find any copies online, just a bunch of wiki pages, linux source code and some presentation slides), but I would have assumed that the writing all 1s to a BAR register would also change the BAR location on real hardware. Just to something outside of the range the parent bridge allows, hence effectively disabling the BAR until you write back the original value. I wouldn't expect there to be a special case for the literal all 1s value that keeps a shadow copy of the BAR value.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants