[Crash] qemu-system-x86_64: mov_ss_trap_64 PANIC: double fault, error_code: 0x0
Kselftest test case mov_ss_trap_64 is causing kernel panic on
qemu-system-x86_64 and PASS on real x86_64 hardware.
qemu-system-x86_64 version is 2.12.0
host architecture: amd64
Test failed on recent stable rc kernel,
4.17.3-rc1, 4.16.18-rc1 and 4.14.52-rc1.
Test code snippet,
main() {
<>
printf("[RUN]\tMOV SS; CS CS INT3\n");
asm volatile ("mov %[ss], %%ss; .byte 0x2e, 0x2e; int3" :: [ss] "m" (ss));
<>
}
Kerel crash log,
# cd /opt/kselftests/mainline/x86
# ./mov_ss_trap_64
SS = 0x2b, &SS = 0x0x604188
Set up a watchpoint
DR0 = 604188, DR1 = 400a19, DR7 = 7000a
[RUN] Read from watched memory (should get SIGTRAP)
Got SIGTRAP with RIP=4008ea, EFLAGS.RF=0
[RUN] MOV SS; INT3
Got SIGTRAP with RIP=4008fb, EFLAGS.RF=0
[RUN] MOV SS; INT 3
Got SIGTRAP with RIP=40090d, EFLAGS.RF=0
[RUN] M[ 20.305426] PANIC: double fault, error_code: 0x0
OV SS; CS CS INT3
Got SIGTRAP with RIP=400920,[ 20.308317] CPU: 3 PID: 2471 Comm: mov_ss_trap_64 Not tainted 4.17.3-rc1 #1
EFLAGS.RF=0
[RUN] MOV SS; CSx14 INT3
[ 20.311664] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 20.314738] RIP: 0010:error_entry+0x32/0x100
[ 20.316198] RSP: 0000:fffffe0000086000 EFLAGS: 00010046
[ 20.317911] RAX: 0000000092400a87 RBX: 0000000000000000 RCX: 0000000000000000
[ 20.320168] RDX: 0000000000000000 RSI: ffffffff92400f18 RDI: ffffffff92401146
[ 20.322405] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 20.324320] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 20.326073] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 20.327869] FS: 00007f3174aefe80(0000) GS:ffff9f447fd80000(0000) knlGS:0000000000000000
[ 20.329850] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 20.331343] CR2: fffffe0000085ff8 CR3: 0000000136d2e000 CR4: 00000000000006e0
[ 20.333150] DR0: 0000000000604188 DR1: 0000000000400a19 DR2: 0000000000000000
[ 20.334893] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 000000000007060a
[ 20.336649] Call Trace:
[ 20.337523]
[ 20.338507] ? native_iret+0x7/0x7
[ 20.339611] ? page_fault+0x8/0x30
[ 20.340693] ? error_entry+0x86/0x100
[ 20.341871] ? trace_hardirqs_off_caller+0x7/0xa0
[ 20.343212] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 20.344554] ? native_iret+0x7/0x7
[ 20.345647] ? page_fault+0x8/0x30
[ 20.346716] ? error_entry+0x86/0x100
[ 20.347853] ? page_fault+0x8/0x30
[ 20.348920] ? ist_enter+0x6/0xa0
[ 20.349961] ? do_int3+0x34/0x120
[ 20.351095] ? int3+0x14/0x20
[ 20.352047]
[ 20.353060] Code: 48 89 7c 24 08 52 31 d2 51 31 c9 50 41 50 45 31 c0 41 51 45 31 c9 41 52 45 31 d2 41 53 45 31 db 53 31 db 55 31 ed 41 54 45 31 e4 <41> 55 45 31 ed 41 56 45 31 f6 41 57 45 31 ff 56 48 8d 6c 24 09
[ 20.357895] Kernel panic - not syncing: Machine halted.
[ 20.359385] CPU: 3 PID: 2471 Comm: mov_ss_trap_64 Not tainted 4.17.3-rc1 #1
[ 20.361271] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 20.363513] Call Trace:
[ 20.364367] <#DF>
[ 20.365109] dump_stack+0x68/0x95
[ 20.366131] panic+0xe3/0x22a
[ 20.367207] df_debug+0x2d/0x30
[ 20.368254] do_double_fault+0x9f/0x120
[ 20.369387] double_fault+0x23/0x30
[ 20.370444] RIP: 0010:error_entry+0x32/0x100
[ 20.371791] RSP: 0000:fffffe0000086000 EFLAGS: 00010046
[ 20.373246] RAX: 0000000092400a87 RBX: 0000000000000000 RCX: 0000000000000000
[ 20.375250] RDX: 0000000000000000 RSI: ffffffff92400f18 RDI: ffffffff92401146
[ 20.377103] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 20.378958] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 20.380808] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 20.382744] ? page_fault+0x8/0x30
[ 20.383925] ? error_entry+0x86/0x100
[ 20.385037]
[ 20.385793]
[ 20.386774] ? native_iret+0x7/0x7
[ 20.387839] ? page_fault+0x8/0x30
[ 20.388901] ? error_entry+0x86/0x100
[ 20.389997] ? trace_hardirqs_off_caller+0x7/0xa0
[ 20.391464] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 20.392850] ? native_iret+0x7/0x7
[ 20.393886] ? page_fault+0x8/0x30
[ 20.394984] ? error_entry+0x86/0x100
[ 20.396092] ? page_fault+0x8/0x30
[ 20.397145] ? ist_enter+0x6/0xa0
[ 20.398167] ? do_int3+0x34/0x120
[ 20.399213] ? int3+0x14/0x20
[ 20.400226]
[ 20.401574] Kernel Offset: 0x10800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 20.404788] ---[ end Kernel panic - not syncing: Machine halted. ]---
Full crash log can be found at,
https://lkft.validation.linaro.org/scheduler/job/303760
Download this image.
http://snapshots.linaro.org/openembedded/lkft/morty/intel-core2-32/rpb/linux-stable-rc-4.17/7/rpb-console-image-intel-core2-32-20180624171508-7.hddimg.xz
Boot command:
qemu-system-x86_64
-cpu host
-enable-kvm
-nographic
-net nic,model=virtio,macaddr=DE:AD:BE:EF:66:01
-net tap -m 1024
-monitor none
-drive format=raw,file=rpb-console-image-intel-core2-32-20180624171508-7.hddimg,if=virtio
-m 4096
-smp 4
-drive format=qcow2,file=/lava-guest.qcow2,media=disk,if=virtio
After successfull boot,
login as root
Run the in-built test,
cd /opt/kselftests/mainline/x86
./mov_ss_trap_64
Test case link,
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/tree/tools/testing/selftests/x86/mov_ss_trap.c?h=linux-4.17.y