On Tue, 11 Aug 2026 at 15:35, Marcelo Manzo <[email protected]> wrote:
>
> This series gets raspi4b's PCIe root complex and GENET Ethernet
> controller working end to end: the PCIe link comes up and devices on
> it actually enumerate, and GENET passes real network traffic (DHCP,
> SSH) under both older and newer guest kernels.
>
If you run "make check-functional" on a build that's been built
with the clang sanitizers, i.e.
'../../configure' '--cc=clang' '--cxx=clang++' '--enable-ubsan'
'--target-list=arm-softmmu,arm-linux-user,aarch64-softmmu,aarch64-linux-user'
then it fails because it hits a UB case due to a misaligned address:
../../hw/net/bcm2838_genet.c:878:22: runtime error: member access
within misaligned address 0x73754ab7d70f for type
'BCM2838GenetXmitStatus' (aka 'struct BCM2838GenetXmitStatus'), which
requires 4 byte alignment
0x73754ab7d70f: note: pointer points here
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
^
#0 0x5b07158bf9d7 in bcm2838_genet_rdma
/home/pm215/qemu/build/arm-clang/../../hw/net/bcm2838_genet.c:878:22
#1 0x5b07158bf9d7 in bcm2838_genet_receive
/home/pm215/qemu/build/arm-clang/../../hw/net/bcm2838_genet.c:949:30
#2 0x5b07151ee119 in nc_sendv_compat
/home/pm215/qemu/build/arm-clang/../../net/net.c:823:11
#3 0x5b07151ee119 in qemu_deliver_packet_iov
/home/pm215/qemu/build/arm-clang/../../net/net.c:870:15
#4 0x5b07151fdf91 in qemu_net_queue_deliver_iov
/home/pm215/qemu/build/arm-clang/../../net/queue.c:179:11
#5 0x5b07151fdf91 in qemu_net_queue_send_iov
/home/pm215/qemu/build/arm-clang/../../net/queue.c:235:11
#6 0x5b07151ebfa3 in net_hub_receive_iov
/home/pm215/qemu/build/arm-clang/../../net/hub.c:75:9
#7 0x5b07151ebfa3 in net_hub_port_receive_iov
/home/pm215/qemu/build/arm-clang/../../net/hub.c:126:12
#8 0x5b07151edfe0 in qemu_deliver_packet_iov
/home/pm215/qemu/build/arm-clang/../../net/net.c:868:15
#9 0x5b07151fc820 in qemu_net_queue_deliver
/home/pm215/qemu/build/arm-clang/../../net/queue.c:164:11
#10 0x5b07151fc956 in qemu_net_queue_send
/home/pm215/qemu/build/arm-clang/../../net/queue.c:210:11
#11 0x5b07151f3129 in qemu_send_packet_async_with_flags
/home/pm215/qemu/build/arm-clang/../../net/net.c:761:12
#12 0x5b0715226901 in net_slirp_send_packet
/home/pm215/qemu/build/arm-clang/../../net/slirp.c:133:12
#13 0x737552c98f9d (/lib/x86_64-linux-gnu/libslirp.so.0+0x19f9d)
(BuildId: 025218e04d3a070185822fbfa2a72d2054796c61)
#14 0x737552c86dd0 (/lib/x86_64-linux-gnu/libslirp.so.0+0x7dd0)
(BuildId: 025218e04d3a070185822fbfa2a72d2054796c61)
#15 0x737552c8757a (/lib/x86_64-linux-gnu/libslirp.so.0+0x857a)
(BuildId: 025218e04d3a070185822fbfa2a72d2054796c61)
#16 0x737552c87d56 (/lib/x86_64-linux-gnu/libslirp.so.0+0x8d56)
(BuildId: 025218e04d3a070185822fbfa2a72d2054796c61)
#17 0x737552c972ed (/lib/x86_64-linux-gnu/libslirp.so.0+0x182ed)
(BuildId: 025218e04d3a070185822fbfa2a72d2054796c61)
#18 0x737552c8b2ef (/lib/x86_64-linux-gnu/libslirp.so.0+0xc2ef)
(BuildId: 025218e04d3a070185822fbfa2a72d2054796c61)
#19 0x737552c9055e in slirp_input
(/lib/x86_64-linux-gnu/libslirp.so.0+0x1155e) (BuildId:
025218e04d3a070185822fbfa2a72d2054796c61)
#20 0x5b0715225f3a in net_slirp_receive
/home/pm215/qemu/build/arm-clang/../../net/slirp.c:140:5
#21 0x5b07151ee119 in nc_sendv_compat
/home/pm215/qemu/build/arm-clang/../../net/net.c:823:11
#22 0x5b07151ee119 in qemu_deliver_packet_iov
/home/pm215/qemu/build/arm-clang/../../net/net.c:870:15
#23 0x5b07151fdf91 in qemu_net_queue_deliver_iov
/home/pm215/qemu/build/arm-clang/../../net/queue.c:179:11
#24 0x5b07151fdf91 in qemu_net_queue_send_iov
/home/pm215/qemu/build/arm-clang/../../net/queue.c:235:11
#25 0x5b07151ebfa3 in net_hub_receive_iov
/home/pm215/qemu/build/arm-clang/../../net/hub.c:75:9
#26 0x5b07151ebfa3 in net_hub_port_receive_iov
/home/pm215/qemu/build/arm-clang/../../net/hub.c:126:12
#27 0x5b07151edfe0 in qemu_deliver_packet_iov
/home/pm215/qemu/build/arm-clang/../../net/net.c:868:15
#28 0x5b07151fc820 in qemu_net_queue_deliver
/home/pm215/qemu/build/arm-clang/../../net/queue.c:164:11
#29 0x5b07151fc956 in qemu_net_queue_send
/home/pm215/qemu/build/arm-clang/../../net/queue.c:210:11
#30 0x5b07151f3129 in qemu_send_packet_async_with_flags
/home/pm215/qemu/build/arm-clang/../../net/net.c:761:12
#31 0x5b07158bc247 in bcm2838_genet_xmit_packet
/home/pm215/qemu/build/arm-clang/../../hw/net/bcm2838_genet.c:431:5
#32 0x5b07158bc247 in bcm2838_genet_tx
/home/pm215/qemu/build/arm-clang/../../hw/net/bcm2838_genet.c:492:13
#33 0x5b07158bc247 in bcm2838_genet_tdma
/home/pm215/qemu/build/arm-clang/../../hw/net/bcm2838_genet.c:593:36
#34 0x5b07158ba981 in bcm2838_genet_write
/home/pm215/qemu/build/arm-clang/../../hw/net/bcm2838_genet.c:735:13
#35 0x5b0715dec5d6 in memory_region_write_accessor
/home/pm215/qemu/build/arm-clang/../../system/memory.c:492:5
#36 0x5b0715debb5d in access_with_adjusted_size
/home/pm215/qemu/build/arm-clang/../../system/memory.c:568:18
#37 0x5b0715deb622 in memory_region_dispatch_write
/home/pm215/qemu/build/arm-clang/../../system/memory.c
#38 0x5b07151074b0 in int_st_mmio_leN
/home/pm215/qemu/build/arm-clang/../../accel/tcg/cputlb.c:2462:13
#39 0x5b07151073ad in do_st_mmio_leN
/home/pm215/qemu/build/arm-clang/../../accel/tcg/cputlb.c:2495:12
#40 0x5b07150f4dd6 in do_st_4
/home/pm215/qemu/build/arm-clang/../../accel/tcg/cputlb.c:2657:9
#41 0x5b07150f4dd6 in do_st4_mmu
/home/pm215/qemu/build/arm-clang/../../accel/tcg/cputlb.c:2733:9
In bcm2838_genet_rdma(), doing this:
BCM2838GenetXmitStatus *xmit_status = (BCM2838GenetXmitStatus *)dma_buf;
is casting an arbitrary byte pointer into the received
packet data to a struct that's a set of uint32_t fields.
This is UB for misaligned pointers, and also will do the
wrong thing on big-endian hosts.
Generally trying to operate on in-guest-memory or
in-packet-data structures with host C structs is awkward;
I usually find it's better to do explicit "load a 4 byte
little-endian word from this address" accesses with
ldl_le_p() or similar, so there's a clear distinction
between the in-memory representation and the C struct.
thanks
-- PMM
