Since a double fault always implies that kernel data structures are
corrupt, this fault should neither be handed to user mode handling,
nor should the handler allow resuming the faulting code stream (since
architecturally this isn't a fault, but an abort).

Note that this slightly depends on the previously submitted patch
adjusting the prototype of notify_die() (a compiler warning will result
without that other patch).

From: Jan Beulich <jbeulich@novell.com>

--- 2.6.14/arch/x86_64/kernel/traps.c	2005-10-28 02:02:08.000000000 +0200
+++ 2.6.14-x86_64-doublefault/arch/x86_64/kernel/traps.c	2005-11-07 09:33:53.000000000 +0100
@@ -506,7 +506,35 @@ DO_ERROR(11, SIGBUS,  "segment not prese
 DO_ERROR_INFO(17, SIGBUS, "alignment check", alignment_check, BUS_ADRALN, 0)
 DO_ERROR(18, SIGSEGV, "reserved", reserved)
 DO_ERROR(12, SIGBUS,  "stack segment", stack_segment)
-DO_ERROR( 8, SIGSEGV, "double fault", double_fault)
+
+asmlinkage void do_double_fault(struct pt_regs * regs, long error_code)
+{
+	static const char str[] = "double fault";
+	struct task_struct *tsk = current;
+
+	notify_die(DIE_TRAP, str, regs, error_code, 8, SIGSEGV);
+
+#ifdef CONFIG_CHECKING
+	{ 
+		unsigned long gs; 
+		struct x8664_pda *pda = cpu_pda + safe_smp_processor_id(); 
+		rdmsrl(MSR_GS_BASE, gs); 
+		if (gs != (unsigned long)pda) { 
+			wrmsrl(MSR_GS_BASE, pda); 
+			printk("%s: wrong gs %lx expected %p rip %lx\n",
+			       str, gs, pda, regs->rip);
+		}
+	}
+#endif
+
+	tsk->thread.error_code = error_code;
+	tsk->thread.trap_no = 8;
+
+	/* This is always a kernel trap and never fixable (and thus must
+	   never return). */
+	for (;;)
+		die(str, regs, error_code);
+}
 
 asmlinkage void __kprobes do_general_protection(struct pt_regs * regs,
 						long error_code)