libFuzzer triggered the following assertion:

  cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
    -nographic -monitor none -serial none \
    -qtest stdio -d guest_errors -trace pci\*
  outl 0xcf8 0xf2000060
  outl 0xcfc 0x8400056e
  EOF
  pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
  Aborted (core dumped)

This is because guest wrote MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD
(reserved value) to the PCIE XBAR register.

There is no indication on the datasheet about what occurs when
this value is written. Simply ignore it on QEMU (and report an
guest error):

  pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
  Q35: Reserved PCIEXBAR LENGTH
  pci_cfg_read mch 00:0 @0x0 -> 0x8086
  pci_cfg_read mch 00:0 @0x0 -> 0x29c08086
  ...

Cc: qemu-stable@nongnu.org
Reported-by: Alexander Bulekov <alxndr@bu.edu>
BugLink: https://bugs.launchpad.net/qemu/+bug/1878641
Fixes: df2d8b3ed4 ("q35: Introduce q35 pc based chipset emulator")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
RFC because I have no idea how to propagate the error.
---
 hw/pci-host/q35.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index b67cb9c29f..a3f839570d 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -29,6 +29,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/log.h"
 #include "hw/i386/pc.h"
 #include "hw/pci-host/q35.h"
 #include "hw/qdev-properties.h"
@@ -318,8 +319,8 @@ static void mch_update_pciexbar(MCHPCIState *mch)
         addr_mask |= MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK;
         break;
     case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD:
-    default:
-        abort();
+        qemu_log_mask(LOG_GUEST_ERROR, "Q35: Reserved PCIEXBAR LENGTH\n");
+        return;
     }
     addr = pciexbar & addr_mask;
     pcie_host_mmcfg_update(pehb, enable, addr, length);
-- 
2.21.3

On 7/17/20 11:17 AM, Philippe Mathieu-Daudé wrote:
>      case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD:
> -    default:
> -        abort();
> +        qemu_log_mask(LOG_GUEST_ERROR, "Q35: Reserved PCIEXBAR LENGTH\n");
> +        return;
>      }

Did you really want to remove the default case?

I guess the mask means that only *_RVD is left over, but the default sorta
self-documents that.

Either way,
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


r~

On 7/17/20 8:38 PM, Richard Henderson wrote:
> On 7/17/20 11:17 AM, Philippe Mathieu-Daudé wrote:
>>      case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD:
>> -    default:
>> -        abort();
>> +        qemu_log_mask(LOG_GUEST_ERROR, "Q35: Reserved PCIEXBAR LENGTH\n");
>> +        return;
>>      }
> 
> Did you really want to remove the default case?

The field takes 2 bits, 3 cases are covered...

> I guess the mask means that only *_RVD is left over, but the default sorta
> self-documents that.

OK I don't have problem keeping it - until a compiler start warning
about it "default case already covered" ;)

> 
> Either way,
> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Thanks!

> 
> 
> r~
>