Re: [gentoo-hardened] stack fault in kernel mode with i686 with 2.6.26-r9 and 2.6.27-r8

On 7 Mar 2009 at 18:39, basile wrote:

> Hi guys,
>
> I'm encountering a reproduceable problem with hardened 2.6.26-r9 and
> 2.6.27-r8 that wasn't there with 2.6.25-r13 on i686, and isn't there
> with amd64 using approximately the same kernel configuration in every
> case.  I've been able to reproduce it in vmware, qemu and on physical
> boxes, one with a Intel(R) Core(TM)2 Quad CPU Q6700, the other AMD
> Athlon(tm) 64 FX-62 Dual Core.  It a stack fault in kernel mode, but I
> can't pin it down further.  It happens almost immediately after the
> bootloader passes control to the kernel.  The best error message comes
> from qemu which gives the states of the registers.  Here's the error
> message from a bootable ISO I made suing 2.6.26-r9.  Any idea where I
> can start tackling this one?

you'll have to check what code was executed just before the triple fault,
start at around EIP. also passing -d in_asm,int,exec,cpu,pcall will produce
a nice log file that will make it even easier.

>
> # qemu -cdrom th-i686-20090307-RC3.iso
> qemu: fatal: triple fault
> EAX=000000ff EBX=0153cac0 ECX=0013a2d1 EDX=0013a2d1
> ESI=0024c000 EDI=01400000 EBP=01541a20 ESP=01541a10
> EIP=0153a2d0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
  ^^^^^^^^^^^^