On 29 August 2015 at 17:04, Jonathan Neuschäfer <j.neuschae...@gmx.net> wrote: > On Thu, Aug 27, 2015 at 07:06:24PM +0100, Peter Maydell wrote: >> This definitely looks like a bug, but I don't think this is >> a sufficient fix, because if DEBUG_REMAP is defined then the >> locked-memory which the target_cmsghdr* is in is not a >> simple g2h() away from the host pointer. >> >> What you need to do is change target_to_host_cmsg and >> host_to_target_cmsg so that when at the top of the function >> we do: >> target_cmsg_addr = tswapal(target_msgh->msg_control); >> target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, >> 1); > > After following your advice, I found two more bugs in related code, > which I had to fix. I probably missed something, but my test case > (wine), which receives two headers via a single recvmsg call, is now > working properly. Perhaps an isolated test case would be nice.
I generally test linux-user with the LTP tests: http://wiki.qemu.org/Testing/LTP though they're not always as good at flushing out QEMU bugs as you might hope. Still, LTP is probably the best home for syscall tests. thanks -- PMM
