Commit 8085fcd7 authored by Josh Poimboeuf's avatar Josh Poimboeuf Committed by Peter Zijlstra
Browse files

x86/traps: Make exc_double_fault() consistently noreturn 



The CONFIG_X86_ESPFIX64 version of exc_double_fault() can return to its
caller, but the !CONFIG_X86_ESPFIX64 version never does.  In the latter
case the compiler and/or objtool may consider it to be implicitly
noreturn.

However, due to the currently inflexible way objtool detects noreturns,
a function's noreturn status needs to be consistent across configs.

The current workaround for this issue is to suppress unreachable
warnings for exc_double_fault()'s callers.  Unfortunately that can
result in ORC coverage gaps and potentially worse issues like inert
static calls and silently disabled CPU mitigations.

Instead, prevent exc_double_fault() from ever being implicitly marked
noreturn by forcing a return behind a never-taken conditional.

Until a more integrated noreturn detection method exists, this is likely
the least objectionable workaround.

Fixes: 55eeab2a ("objtool: Ignore exc_double_fault() __noreturn warnings")
Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: default avatarBrendan Jackman <jackmanb@google.com>
Link: https://lore.kernel.org/r/d1f4026f8dc35d0de6cc61f2684e0cb6484009d1.1741975349.git.jpoimboe@kernel.org
parent e20ab7d4

arch/x86/kernel/traps.c

+17 −1
Original line number Diff line number Diff line
@@ -379,6 +379,21 @@ __visible void __noreturn handle_stack_overflow(struct pt_regs *regs, 
}

#endif



/*

 * Prevent the compiler and/or objtool from marking the !CONFIG_X86_ESPFIX64

 * version of exc_double_fault() as noreturn.  Otherwise the noreturn mismatch

 * between configs triggers objtool warnings.

 *

 * This is a temporary hack until we have compiler or plugin support for

 * annotating noreturns.

 */

#ifdef CONFIG_X86_ESPFIX64

#define always_true() true

#else

bool always_true(void);

bool __weak always_true(void) { return true; }

#endif



/*

 * Runs on an IST stack for x86_64 and on a special task stack for x86_32.

 *
@@ -514,6 +529,7 @@ DEFINE_IDTENTRY_DF(exc_double_fault) 


	pr_emerg("PANIC: double fault, error_code: 0x%lx\n", error_code);

	die("double fault", regs, error_code);

	if (always_true())

		panic("Machine halted.");

	instrumentation_end();

}

tools/objtool/check.c

+1 −30
Original line number Diff line number Diff line
@@ -4460,35 +4460,6 @@ static int validate_sls(struct objtool_file *file) 
	return warnings;

}



static bool ignore_noreturn_call(struct instruction *insn)

{

	struct symbol *call_dest = insn_call_dest(insn);



	/*

	 * FIXME: hack, we need a real noreturn solution

	 *

	 * Problem is, exc_double_fault() may or may not return, depending on

	 * whether CONFIG_X86_ESPFIX64 is set.  But objtool has no visibility

	 * to the kernel config.

	 *

	 * Other potential ways to fix it:

	 *

	 *   - have compiler communicate __noreturn functions somehow

	 *   - remove CONFIG_X86_ESPFIX64

	 *   - read the .config file

	 *   - add a cmdline option

	 *   - create a generic objtool annotation format (vs a bunch of custom

	 *     formats) and annotate it

	 */

	if (!strcmp(call_dest->name, "exc_double_fault")) {

		/* prevent further unreachable warnings for the caller */

		insn->sym->warned = 1;

		return true;

	}



	return false;

}



static int validate_reachable_instructions(struct objtool_file *file)

{

	struct instruction *insn, *prev_insn;
@@ -4505,7 +4476,7 @@ static int validate_reachable_instructions(struct objtool_file *file) 
		prev_insn = prev_insn_same_sec(file, insn);

		if (prev_insn && prev_insn->dead_end) {

			call_dest = insn_call_dest(prev_insn);

			if (call_dest && !ignore_noreturn_call(prev_insn)) {

			if (call_dest) {

				WARN_INSN(insn, "%s() is missing a __noreturn annotation",

					  call_dest->name);

				warnings++;