The QEMU project is currently considering to move its bug tracking to another
system. For this we need to know which bugs are still valid and which could be
closed already. Thus we are setting older bugs to "Incomplete" now.
If you still think this bug report here is valid, then please switch the state
back to "New" within the next 60 days, otherwise this report will be marked as
"Expired". Or mark it as "Fix Released" if the problem has been solved with a
newer version of QEMU already. Thank you and sorry for the inconvenience.
** Changed in: qemu
Status: New => Incomplete
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1778473
Title:
[Crash] qemu-system-x86_64: mov_ss_trap_64 PANIC: double fault,
error_code: 0x0
Status in QEMU:
Incomplete
Bug description:
Kselftest test case mov_ss_trap_64 is causing kernel panic on
qemu-system-x86_64 and PASS on real x86_64 hardware.
qemu-system-x86_64 version is 2.12.0
host architecture: amd64
Test failed on recent stable rc kernel,
4.17.3-rc1, 4.16.18-rc1 and 4.14.52-rc1.
Test code snippet,
main() {
<>
printf("[RUN]\tMOV SS; CS CS INT3\n");
asm volatile ("mov %[ss], %%ss; .byte 0x2e, 0x2e; int3" :: [ss] "m"
(ss));
<>
}
Kerel crash log,
# cd /opt/kselftests/mainline/x86
# ./mov_ss_trap_64
SS = 0x2b, &SS = 0x0x604188
Set up a watchpoint
DR0 = 604188, DR1 = 400a19, DR7 = 7000a
[RUN] Read from watched memory (should get SIGTRAP)
Got SIGTRAP with RIP=4008ea, EFLAGS.RF=0
[RUN] MOV SS; INT3
Got SIGTRAP with RIP=4008fb, EFLAGS.RF=0
[RUN] MOV SS; INT 3
Got SIGTRAP with RIP=40090d, EFLAGS.RF=0
[RUN] M[ 20.305426] PANIC: double fault, error_code: 0x0
OV SS; CS CS INT3
Got SIGTRAP with RIP=400920,[ 20.308317] CPU: 3 PID: 2471 Comm:
mov_ss_trap_64 Not tainted 4.17.3-rc1 #1
EFLAGS.RF=0
[RUN] MOV SS; CSx14 INT3
[ 20.311664] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.10.2-1 04/01/2014
[ 20.314738] RIP: 0010:error_entry+0x32/0x100
[ 20.316198] RSP: 0000:fffffe0000086000 EFLAGS: 00010046
[ 20.317911] RAX: 0000000092400a87 RBX: 0000000000000000 RCX:
0000000000000000
[ 20.320168] RDX: 0000000000000000 RSI: ffffffff92400f18 RDI:
ffffffff92401146
[ 20.322405] RBP: 0000000000000000 R08: 0000000000000000 R09:
0000000000000000
[ 20.324320] R10: 0000000000000000 R11: 0000000000000000 R12:
0000000000000000
[ 20.326073] R13: 0000000000000000 R14: 0000000000000000 R15:
0000000000000000
[ 20.327869] FS: 00007f3174aefe80(0000) GS:ffff9f447fd80000(0000)
knlGS:0000000000000000
[ 20.329850] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 20.331343] CR2: fffffe0000085ff8 CR3: 0000000136d2e000 CR4:
00000000000006e0
[ 20.333150] DR0: 0000000000604188 DR1: 0000000000400a19 DR2:
0000000000000000
[ 20.334893] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
000000000007060a
[ 20.336649] Call Trace:
[ 20.337523] <ENTRY_TRAMPOLINE>
[ 20.338507] ? native_iret+0x7/0x7
[ 20.339611] ? page_fault+0x8/0x30
[ 20.340693] ? error_entry+0x86/0x100
[ 20.341871] ? trace_hardirqs_off_caller+0x7/0xa0
[ 20.343212] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 20.344554] ? native_iret+0x7/0x7
[ 20.345647] ? page_fault+0x8/0x30
[ 20.346716] ? error_entry+0x86/0x100
[ 20.347853] ? page_fault+0x8/0x30
[ 20.348920] ? ist_enter+0x6/0xa0
[ 20.349961] ? do_int3+0x34/0x120
[ 20.351095] ? int3+0x14/0x20
[ 20.352047] </ENTRY_TRAMPOLINE>
[ 20.353060] Code: 48 89 7c 24 08 52 31 d2 51 31 c9 50 41 50 45 31 c0 41 51
45 31 c9 41 52 45 31 d2 41 53 45 31 db 53 31 db 55 31 ed 41 54 45 31 e4 <41> 55
45 31 ed 41 56 45 31 f6 41 57 45 31 ff 56 48 8d 6c 24 09
[ 20.357895] Kernel panic - not syncing: Machine halted.
[ 20.359385] CPU: 3 PID: 2471 Comm: mov_ss_trap_64 Not tainted 4.17.3-rc1 #1
[ 20.361271] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.10.2-1 04/01/2014
[ 20.363513] Call Trace:
[ 20.364367] <#DF>
[ 20.365109] dump_stack+0x68/0x95
[ 20.366131] panic+0xe3/0x22a
[ 20.367207] df_debug+0x2d/0x30
[ 20.368254] do_double_fault+0x9f/0x120
[ 20.369387] double_fault+0x23/0x30
[ 20.370444] RIP: 0010:error_entry+0x32/0x100
[ 20.371791] RSP: 0000:fffffe0000086000 EFLAGS: 00010046
[ 20.373246] RAX: 0000000092400a87 RBX: 0000000000000000 RCX:
0000000000000000
[ 20.375250] RDX: 0000000000000000 RSI: ffffffff92400f18 RDI:
ffffffff92401146
[ 20.377103] RBP: 0000000000000000 R08: 0000000000000000 R09:
0000000000000000
[ 20.378958] R10: 0000000000000000 R11: 0000000000000000 R12:
0000000000000000
[ 20.380808] R13: 0000000000000000 R14: 0000000000000000 R15:
0000000000000000
[ 20.382744] ? page_fault+0x8/0x30
[ 20.383925] ? error_entry+0x86/0x100
[ 20.385037] </#DF>
[ 20.385793] <ENTRY_TRAMPOLINE>
[ 20.386774] ? native_iret+0x7/0x7
[ 20.387839] ? page_fault+0x8/0x30
[ 20.388901] ? error_entry+0x86/0x100
[ 20.389997] ? trace_hardirqs_off_caller+0x7/0xa0
[ 20.391464] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 20.392850] ? native_iret+0x7/0x7
[ 20.393886] ? page_fault+0x8/0x30
[ 20.394984] ? error_entry+0x86/0x100
[ 20.396092] ? page_fault+0x8/0x30
[ 20.397145] ? ist_enter+0x6/0xa0
[ 20.398167] ? do_int3+0x34/0x120
[ 20.399213] ? int3+0x14/0x20
[ 20.400226] </ENTRY_TRAMPOLINE>
[ 20.401574] Kernel Offset: 0x10800000 from 0xffffffff81000000 (relocation
range: 0xffffffff80000000-0xffffffffbfffffff)
[ 20.404788] ---[ end Kernel panic - not syncing: Machine halted. ]---
Full crash log can be found at,
https://lkft.validation.linaro.org/scheduler/job/303760
Download this image.
http://snapshots.linaro.org/openembedded/lkft/morty/intel-core2-32/rpb/linux-stable-rc-4.17/7/rpb-console-image-intel-core2-32-20180624171508-7.hddimg.xz
Boot command:
qemu-system-x86_64
-cpu host
-enable-kvm
-nographic
-net nic,model=virtio,macaddr=DE:AD:BE:EF:66:01
-net tap -m 1024
-monitor none
-drive
format=raw,file=rpb-console-image-intel-core2-32-20180624171508-7.hddimg,if=virtio
-m 4096
-smp 4
-drive format=qcow2,file=/lava-guest.qcow2,media=disk,if=virtio
After successfull boot,
login as root
Run the in-built test,
cd /opt/kselftests/mainline/x86
./mov_ss_trap_64
Test case link,
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/tree/tools/testing/selftests/x86/mov_ss_trap.c?h=linux-4.17.y
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1778473/+subscriptions
