[Bug 1778473] Re: [Crash] qemu-system-x86_64: mov_ss_trap_64 PANIC: double fault, error_code: 0x0

[Thomas Huth]

The QEMU project is currently considering to move its bug tracking to another 
system. For this we need to know which bugs are still valid and which could be 
closed already. Thus we are setting older bugs to "Incomplete" now.
If you still think this bug report here is valid, then please switch the state 
back to "New" within the next 60 days, otherwise this report will be marked as 
"Expired". Or mark it as "Fix Released" if the problem has been solved with a 
newer version of QEMU already. Thank you and sorry for the inconvenience.

** Changed in: qemu
       Status: New => Incomplete

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1778473

Title:
  [Crash] qemu-system-x86_64: mov_ss_trap_64 PANIC: double fault,
  error_code: 0x0

Status in QEMU:
  Incomplete

Bug description:
  Kselftest test case mov_ss_trap_64 is causing kernel panic on
  qemu-system-x86_64 and PASS on real x86_64 hardware.

  qemu-system-x86_64 version is 2.12.0
  host architecture: amd64

  Test failed on recent stable rc kernel,
  4.17.3-rc1, 4.16.18-rc1 and 4.14.52-rc1.

  
  Test code snippet,
  main() {
  <>
        printf("[RUN]\tMOV SS; CS CS INT3\n");
        asm volatile ("mov %[ss], %%ss; .byte 0x2e, 0x2e; int3" :: [ss] "m" 
(ss));
  <>
  }

  Kerel crash log,
  # cd /opt/kselftests/mainline/x86
  # ./mov_ss_trap_64
        SS = 0x2b, &SS = 0x0x604188
        Set up a watchpoint
        DR0 = 604188, DR1 = 400a19, DR7 = 7000a
  [RUN] Read from watched memory (should get SIGTRAP)
        Got SIGTRAP with RIP=4008ea, EFLAGS.RF=0
  [RUN] MOV SS; INT3
        Got SIGTRAP with RIP=4008fb, EFLAGS.RF=0
  [RUN] MOV SS; INT 3
        Got SIGTRAP with RIP=40090d, EFLAGS.RF=0
  [RUN] M[   20.305426] PANIC: double fault, error_code: 0x0
  OV SS; CS CS INT3
        Got SIGTRAP with RIP=400920,[   20.308317] CPU: 3 PID: 2471 Comm: 
mov_ss_trap_64 Not tainted 4.17.3-rc1 #1
   EFLAGS.RF=0
  [RUN] MOV SS; CSx14 INT3
  [   20.311664] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 
1.10.2-1 04/01/2014
  [   20.314738] RIP: 0010:error_entry+0x32/0x100
  [   20.316198] RSP: 0000:fffffe0000086000 EFLAGS: 00010046
  [   20.317911] RAX: 0000000092400a87 RBX: 0000000000000000 RCX: 
0000000000000000
  [   20.320168] RDX: 0000000000000000 RSI: ffffffff92400f18 RDI: 
ffffffff92401146
  [   20.322405] RBP: 0000000000000000 R08: 0000000000000000 R09: 
0000000000000000
  [   20.324320] R10: 0000000000000000 R11: 0000000000000000 R12: 
0000000000000000
  [   20.326073] R13: 0000000000000000 R14: 0000000000000000 R15: 
0000000000000000
  [   20.327869] FS:  00007f3174aefe80(0000) GS:ffff9f447fd80000(0000) 
knlGS:0000000000000000
  [   20.329850] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [   20.331343] CR2: fffffe0000085ff8 CR3: 0000000136d2e000 CR4: 
00000000000006e0
  [   20.333150] DR0: 0000000000604188 DR1: 0000000000400a19 DR2: 
0000000000000000
  [   20.334893] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 
000000000007060a
  [   20.336649] Call Trace:
  [   20.337523]  <ENTRY_TRAMPOLINE>
  [   20.338507]  ? native_iret+0x7/0x7
  [   20.339611]  ? page_fault+0x8/0x30
  [   20.340693]  ? error_entry+0x86/0x100
  [   20.341871]  ? trace_hardirqs_off_caller+0x7/0xa0
  [   20.343212]  ? trace_hardirqs_off_thunk+0x1a/0x1c
  [   20.344554]  ? native_iret+0x7/0x7
  [   20.345647]  ? page_fault+0x8/0x30
  [   20.346716]  ? error_entry+0x86/0x100
  [   20.347853]  ? page_fault+0x8/0x30
  [   20.348920]  ? ist_enter+0x6/0xa0
  [   20.349961]  ? do_int3+0x34/0x120
  [   20.351095]  ? int3+0x14/0x20
  [   20.352047]  </ENTRY_TRAMPOLINE>
  [   20.353060] Code: 48 89 7c 24 08 52 31 d2 51 31 c9 50 41 50 45 31 c0 41 51 
45 31 c9 41 52 45 31 d2 41 53 45 31 db 53 31 db 55 31 ed 41 54 45 31 e4 <41> 55 
45 31 ed 41 56 45 31 f6 41 57 45 31 ff 56 48 8d 6c 24 09 
  [   20.357895] Kernel panic - not syncing: Machine halted.
  [   20.359385] CPU: 3 PID: 2471 Comm: mov_ss_trap_64 Not tainted 4.17.3-rc1 #1
  [   20.361271] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 
1.10.2-1 04/01/2014
  [   20.363513] Call Trace:
  [   20.364367]  <#DF>
  [   20.365109]  dump_stack+0x68/0x95
  [   20.366131]  panic+0xe3/0x22a
  [   20.367207]  df_debug+0x2d/0x30
  [   20.368254]  do_double_fault+0x9f/0x120
  [   20.369387]  double_fault+0x23/0x30
  [   20.370444] RIP: 0010:error_entry+0x32/0x100
  [   20.371791] RSP: 0000:fffffe0000086000 EFLAGS: 00010046
  [   20.373246] RAX: 0000000092400a87 RBX: 0000000000000000 RCX: 
0000000000000000
  [   20.375250] RDX: 0000000000000000 RSI: ffffffff92400f18 RDI: 
ffffffff92401146
  [   20.377103] RBP: 0000000000000000 R08: 0000000000000000 R09: 
0000000000000000
  [   20.378958] R10: 0000000000000000 R11: 0000000000000000 R12: 
0000000000000000
  [   20.380808] R13: 0000000000000000 R14: 0000000000000000 R15: 
0000000000000000
  [   20.382744]  ? page_fault+0x8/0x30
  [   20.383925]  ? error_entry+0x86/0x100
  [   20.385037]  </#DF>
  [   20.385793]  <ENTRY_TRAMPOLINE>
  [   20.386774]  ? native_iret+0x7/0x7
  [   20.387839]  ? page_fault+0x8/0x30
  [   20.388901]  ? error_entry+0x86/0x100
  [   20.389997]  ? trace_hardirqs_off_caller+0x7/0xa0
  [   20.391464]  ? trace_hardirqs_off_thunk+0x1a/0x1c
  [   20.392850]  ? native_iret+0x7/0x7
  [   20.393886]  ? page_fault+0x8/0x30
  [   20.394984]  ? error_entry+0x86/0x100
  [   20.396092]  ? page_fault+0x8/0x30
  [   20.397145]  ? ist_enter+0x6/0xa0
  [   20.398167]  ? do_int3+0x34/0x120
  [   20.399213]  ? int3+0x14/0x20
  [   20.400226]  </ENTRY_TRAMPOLINE>
  [   20.401574] Kernel Offset: 0x10800000 from 0xffffffff81000000 (relocation 
range: 0xffffffff80000000-0xffffffffbfffffff)
  [   20.404788] ---[ end Kernel panic - not syncing: Machine halted. ]---

  Full crash log can be found at,
  https://lkft.validation.linaro.org/scheduler/job/303760

  Download this image.
  
http://snapshots.linaro.org/openembedded/lkft/morty/intel-core2-32/rpb/linux-stable-rc-4.17/7/rpb-console-image-intel-core2-32-20180624171508-7.hddimg.xz
 

  Boot command:
  qemu-system-x86_64
   -cpu host
   -enable-kvm
   -nographic
   -net nic,model=virtio,macaddr=DE:AD:BE:EF:66:01
   -net tap -m 1024
   -monitor none
   -drive 
format=raw,file=rpb-console-image-intel-core2-32-20180624171508-7.hddimg,if=virtio
   -m 4096
   -smp 4
   -drive format=qcow2,file=/lava-guest.qcow2,media=disk,if=virtio

  
  After successfull boot,
  login as root

  Run the in-built test,
  cd /opt/kselftests/mainline/x86
  ./mov_ss_trap_64

  Test case link,
  
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/tree/tools/testing/selftests/x86/mov_ss_trap.c?h=linux-4.17.y

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1778473/+subscriptions