1. Patchew
  2. linux
  3. View series

[PATCH] m68k: Fix seccomp filtering on ColdFire and 68000

Christopher Lusk posted 1 patch 1 week, 5 days ago
There is a newer version of this series
arch/m68k/68000/entry.S    | 2 ++
arch/m68k/coldfire/entry.S | 2 ++
2 files changed, 4 insertions(+)
[PATCH] m68k: Fix seccomp filtering on ColdFire and 68000
Posted by Christopher Lusk 1 week, 5 days ago 
m68k selects HAVE_ARCH_SECCOMP_FILTER for all configurations, but the
ColdFire and 68000 syscall entry paths only branch to
syscall_trace_enter() for TIF_SYSCALL_TRACE. TIF_SECCOMP alone falls
through to syscall dispatch, leaving installed filters ineffective.

Test TIF_SECCOMP in both paths and route it through the existing slow
path, matching the classic MMU syscall entry implementation.

Validated under QEMU mcf5208evb (ColdFire): a task installing a seccomp
filter denying getpid() still executed the syscall before this change and
returns -EPERM with it; likewise for a filter denying
openat/unlinkat/reboot. A classic-MMU control (q800) denied the filtered
syscall both before and after, confirming the gap is specific to the
ColdFire/68000 entry paths. The 68000 path shares the same source-level
omission and receives the identical fix but was not separately emulated.
Compile-tested W=1 with CONFIG_SECCOMP_FILTER=y on m5208evb_defconfig.

Fixes: 6baaade15594 ("m68k: Add kernel seccomp support")
Cc: stable@vger.kernel.org # v6.3+
Assisted-by: Claude:claude-opus-4-8
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Christopher Lusk <clusk@northecho.dev>
---

Notes:
    No in-tree m68k defconfig selects the pure-68000/DragonBall path.
    Compile-tested W=1 with a custom no-MMU UCSIMM configuration and
    CONFIG_SECCOMP_FILTER=y; arch/m68k/68000/entry.o and vmlinux both built
    successfully. The added gate is form-identical to the ColdFire and
    classic-MMU gates.

 arch/m68k/68000/entry.S    | 2 ++
 arch/m68k/coldfire/entry.S | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S
index c257cc415..093be0a66 100644
--- a/arch/m68k/68000/entry.S
+++ b/arch/m68k/68000/entry.S
@@ -81,6 +81,8 @@ ENTRY(system_call)
 	getthreadinfo
 	btst	#(TIF_SYSCALL_TRACE%8),%a2@(TINFO_FLAGS+(31-TIF_SYSCALL_TRACE)/8)
 	jne	do_trace
+	btst	#(TIF_SECCOMP%8),%a2@(TINFO_FLAGS+(31-TIF_SECCOMP)/8)
+	jne	do_trace
 	cmpl	#NR_syscalls,%d0
 	jcc	badsys
 	lsl	#2,%d0
diff --git a/arch/m68k/coldfire/entry.S b/arch/m68k/coldfire/entry.S
index 4ea08336e..b73de9585 100644
--- a/arch/m68k/coldfire/entry.S
+++ b/arch/m68k/coldfire/entry.S
@@ -74,6 +74,8 @@ ENTRY(system_call)
 	movel	%sp,%a1@(TASK_THREAD+THREAD_ESP0)
 	btst	#(TIF_SYSCALL_TRACE%8),%a0@(TINFO_FLAGS+(31-TIF_SYSCALL_TRACE)/8)
 	bnes	1f
+	btst	#(TIF_SECCOMP%8),%a0@(TINFO_FLAGS+(31-TIF_SECCOMP)/8)
+	bnes	1f
 
 	movel	%d3,%a0
 	jbsr	%a0@
-- 
2.55.0
Re: [PATCH] m68k: Fix seccomp filtering on ColdFire and 68000
Posted by Andreas Schwab 1 week, 5 days ago 
On Sep 12 2026, Christopher Lusk wrote:

> diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S
> index c257cc415..093be0a66 100644
> --- a/arch/m68k/68000/entry.S
> +++ b/arch/m68k/68000/entry.S
> @@ -81,6 +81,8 @@ ENTRY(system_call)
>  	getthreadinfo
>  	btst	#(TIF_SYSCALL_TRACE%8),%a2@(TINFO_FLAGS+(31-TIF_SYSCALL_TRACE)/8)
>  	jne	do_trace
> +	btst	#(TIF_SECCOMP%8),%a2@(TINFO_FLAGS+(31-TIF_SECCOMP)/8)
> +	jne	do_trace

Perhaps it would be faster to combine the two conditions (which jump to
the same target) with a single AND?

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."
[PATCH v2] m68k: Fix seccomp filtering on ColdFire and 68000
Posted by Christopher Lusk 1 week, 4 days ago 
m68k selects HAVE_ARCH_SECCOMP_FILTER for all configurations, but the
ColdFire and 68000 syscall entry paths only branch to
syscall_trace_enter() for TIF_SYSCALL_TRACE. TIF_SECCOMP alone falls
through to syscall dispatch, leaving installed filters ineffective.

Test the combined TIF_SYSCALL_TRACE and TIF_SECCOMP mask in both paths
and route either flag through the existing slow path. Leave the classic
MMU syscall entry implementation unchanged.

Validated the combined test under QEMU mcf5208evb (ColdFire): filters
denying getpid, openat, unlinkat, and reboot each returned -EPERM. A
classic-MMU control (q800) denied the filtered getpid syscall both before
and after this change. The 68000 path shares the same source-level
omission and receives the identical masked test but was not separately
emulated. Compile-tested W=1 with CONFIG_SECCOMP_FILTER=y on both
m5208evb_defconfig and a custom no-MMU UCSIMM configuration; the latter
built arch/m68k/68000/entry.o and vmlinux.

Fixes: 6baaade15594 ("m68k: Add kernel seccomp support")
Cc: stable@vger.kernel.org # v6.3+
Suggested-by: Andreas Schwab <schwab@linux-m68k.org>
Assisted-by: Claude:claude-opus-4-8
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Christopher Lusk <clusk@northecho.dev>
---

Notes:
    Changes in v2:
    - Combine the TRACE/SECCOMP tests into a single masked branch per Andreas
      Schwab; scoped to the ColdFire/68000 paths, classic MMU unchanged.
    
    No in-tree m68k defconfig selects the pure-68000/DragonBall path.
    Compile-tested W=1 with a custom no-MMU UCSIMM configuration and
    CONFIG_SECCOMP_FILTER=y; arch/m68k/68000/entry.o and vmlinux both built
    successfully. The combined gate uses the same flags byte as the classic-MMU
    entry path.

 arch/m68k/68000/entry.S    | 3 ++-
 arch/m68k/coldfire/entry.S | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S
index c257cc415..0d3cbeded 100644
--- a/arch/m68k/68000/entry.S
+++ b/arch/m68k/68000/entry.S
@@ -79,7 +79,8 @@ ENTRY(system_call)
 
 	/* Doing a trace ? */
 	getthreadinfo
-	btst	#(TIF_SYSCALL_TRACE%8),%a2@(TINFO_FLAGS+(31-TIF_SYSCALL_TRACE)/8)
+	moveb	%a2@(TINFO_FLAGS+2),%d1
+	andl	#((_TIF_SYSCALL_TRACE + _TIF_SECCOMP) >> 8),%d1
 	jne	do_trace
 	cmpl	#NR_syscalls,%d0
 	jcc	badsys
diff --git a/arch/m68k/coldfire/entry.S b/arch/m68k/coldfire/entry.S
index 4ea08336e..d658abdc5 100644
--- a/arch/m68k/coldfire/entry.S
+++ b/arch/m68k/coldfire/entry.S
@@ -72,7 +72,8 @@ ENTRY(system_call)
 	movel	%d2,%a0
 	movel	%a0@,%a1		/* save top of frame */
 	movel	%sp,%a1@(TASK_THREAD+THREAD_ESP0)
-	btst	#(TIF_SYSCALL_TRACE%8),%a0@(TINFO_FLAGS+(31-TIF_SYSCALL_TRACE)/8)
+	moveb	%a0@(TINFO_FLAGS+2),%d2
+	andl	#((_TIF_SYSCALL_TRACE + _TIF_SECCOMP) >> 8),%d2
 	bnes	1f
 
 	movel	%d3,%a0
-- 
2.55.0
Re: [PATCH v2] m68k: Fix seccomp filtering on ColdFire and 68000
Posted by Greg Ungerer 1 day, 23 hours ago 
Hi Christopher,

On 13/9/26 23:17, Christopher Lusk wrote:
> m68k selects HAVE_ARCH_SECCOMP_FILTER for all configurations, but the
> ColdFire and 68000 syscall entry paths only branch to
> syscall_trace_enter() for TIF_SYSCALL_TRACE. TIF_SECCOMP alone falls
> through to syscall dispatch, leaving installed filters ineffective.
> 
> Test the combined TIF_SYSCALL_TRACE and TIF_SECCOMP mask in both paths
> and route either flag through the existing slow path. Leave the classic
> MMU syscall entry implementation unchanged.
> 
> Validated the combined test under QEMU mcf5208evb (ColdFire): filters
> denying getpid, openat, unlinkat, and reboot each returned -EPERM. A
> classic-MMU control (q800) denied the filtered getpid syscall both before
> and after this change. The 68000 path shares the same source-level
> omission and receives the identical masked test but was not separately
> emulated. Compile-tested W=1 with CONFIG_SECCOMP_FILTER=y on both
> m5208evb_defconfig and a custom no-MMU UCSIMM configuration; the latter
> built arch/m68k/68000/entry.o and vmlinux.
> 
> Fixes: 6baaade15594 ("m68k: Add kernel seccomp support")
> Cc: stable@vger.kernel.org # v6.3+
> Suggested-by: Andreas Schwab <schwab@linux-m68k.org>
> Assisted-by: Claude:claude-opus-4-8
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Christopher Lusk <clusk@northecho.dev>

Looks good, thanks for the v2. I will push this into the m68knommu git tree,
for-next branch.

Regards
Greg



> ---
> 
> Notes:
>     Changes in v2:
>     - Combine the TRACE/SECCOMP tests into a single masked branch per Andreas
>       Schwab; scoped to the ColdFire/68000 paths, classic MMU unchanged.
>     
>     No in-tree m68k defconfig selects the pure-68000/DragonBall path.
>     Compile-tested W=1 with a custom no-MMU UCSIMM configuration and
>     CONFIG_SECCOMP_FILTER=y; arch/m68k/68000/entry.o and vmlinux both built
>     successfully. The combined gate uses the same flags byte as the classic-MMU
>     entry path.
> 
>  arch/m68k/68000/entry.S    | 3 ++-
>  arch/m68k/coldfire/entry.S | 3 ++-
>  2 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S
> index c257cc415..0d3cbeded 100644
> --- a/arch/m68k/68000/entry.S
> +++ b/arch/m68k/68000/entry.S
> @@ -79,7 +79,8 @@ ENTRY(system_call)
>  
>  	/* Doing a trace ? */
>  	getthreadinfo
> -	btst	#(TIF_SYSCALL_TRACE%8),%a2@(TINFO_FLAGS+(31-TIF_SYSCALL_TRACE)/8)
> +	moveb	%a2@(TINFO_FLAGS+2),%d1
> +	andl	#((_TIF_SYSCALL_TRACE + _TIF_SECCOMP) >> 8),%d1
>  	jne	do_trace
>  	cmpl	#NR_syscalls,%d0
>  	jcc	badsys
> diff --git a/arch/m68k/coldfire/entry.S b/arch/m68k/coldfire/entry.S
> index 4ea08336e..d658abdc5 100644
> --- a/arch/m68k/coldfire/entry.S
> +++ b/arch/m68k/coldfire/entry.S
> @@ -72,7 +72,8 @@ ENTRY(system_call)
>  	movel	%d2,%a0
>  	movel	%a0@,%a1		/* save top of frame */
>  	movel	%sp,%a1@(TASK_THREAD+THREAD_ESP0)
> -	btst	#(TIF_SYSCALL_TRACE%8),%a0@(TINFO_FLAGS+(31-TIF_SYSCALL_TRACE)/8)
> +	moveb	%a0@(TINFO_FLAGS+2),%d2
> +	andl	#((_TIF_SYSCALL_TRACE + _TIF_SECCOMP) >> 8),%d2
>  	bnes	1f
>  
>  	movel	%d3,%a0

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.