linux.git/arch/m68k/kernel/entry.S, branch v6.16

m68k: Fix spinlock race in kernel thread creation

2024-05-08T15:43:22+00:00

Context switching does take care to retain the correct lock owner across
the switch from 'prev' to 'next' tasks.  This does rely on interrupts
remaining disabled for the entire duration of the switch.

This condition is guaranteed for normal process creation and context
switching between already running processes, because both 'prev' and
'next' already have interrupts disabled in their saved copies of the
status register.

The situation is different for newly created kernel threads.  The status
register is set to PS_S in copy_thread(), which does leave the IPL at 0.
Upon restoring the 'next' thread's status register in switch_to() aka
resume(), interrupts then become enabled prematurely.  resume() then
returns via ret_from_kernel_thread() and schedule_tail() where run queue
lock is released (see finish_task_switch() and finish_lock_switch()).

A timer interrupt calling scheduler_tick() before the lock is released
in finish_task_switch() will find the lock already taken, with the
current task as lock owner.  This causes a spinlock recursion warning as
reported by Guenter Roeck.

As far as I can ascertain, this race has been opened in commit
533e6903bea0 ("m68k: split ret_from_fork(), simplify kernel_thread()")
but I haven't done a detailed study of kernel history so it may well
predate that commit.

Interrupts cannot be disabled in the saved status register copy for
kernel threads (init will complain about interrupts disabled when
finally starting user space).  Disable interrupts temporarily when
switching the tasks' register sets in resume().

Note that a simple oriw 0x700,%sr after restoring sr is not enough here
- this leaves enough of a race for the 'spinlock recursion' warning to
still be observed.

Tested on ARAnyM and qemu (Quadra 800 emulation).

Fixes: 533e6903bea0 ("m68k: split ret_from_fork(), simplify kernel_thread()")
Reported-by: Guenter Roeck 
Closes: https://lore.kernel.org/all/07811b26-677c-4d05-aeb4-996cd880b789@roeck-us.net
Signed-off-by: Michael Schmitz 
Tested-by: Guenter Roeck 
Reviewed-by: Geert Uytterhoeven 
Link: https://lore.kernel.org/r/20240411033631.16335-1-schmitzmic@gmail.com
Signed-off-by: Geert Uytterhoeven

m68k: Replace GPL 2.0+ README.legal boilerplate with SPDX

2023-10-06T08:03:04+00:00

Upstream Linux never had a "README.legal" file, but it was present
in early source releases of Linux/m68k.  It contained a simple copyright
notice and a link to a version of the "COPYING" file that predated the
addition of the "only valid GPL version is v2" clause.

Get rid of the references to non-existent files by replacing the
boilerplate with SPDX license identifiers.

Signed-off-by: Geert Uytterhoeven 
Acked-by: Greg Ungerer 
Link: https://lore.kernel.org/r/23430c233728ab02ec0af8e714994398d383137a.1695031668.git.geert@linux-m68k.org

m68k: Add kernel seccomp support

2023-01-30T15:40:15+00:00

Add secure_computing() call to syscall_trace_enter to actually
filter system calls.

Add necessary arch Kconfig options, define TIF_SECCOMP trace
flag and provide basic seccomp filter support in asm/syscall.h

syscall_get_nr currently uses the syscall nr stored in orig_d0
because we change d0 to a default return code before starting a
syscall trace. This may be inconsistent with syscall_rollback
copying orig_d0 to d0 (which we never check upon return from
trace). We use d0 for the return code from syscall_trace_enter
in entry.S currently, and could perhaps expand that to store
a new syscall number returned by the seccomp filter before
executing the syscall. This clearly needs some discussion.

seccomp_bpf self test on ARAnyM passes 81 out of 94 tests.

Signed-off-by: Michael Schmitz 
Reviewed-by: Geert Uytterhoeven 
Link: https://lore.kernel.org/r/20230112035529.13521-3-schmitzmic@gmail.com
Signed-off-by: Geert Uytterhoeven

m68k: Check syscall_trace_enter() return code

2023-01-30T15:40:15+00:00

Check return code of syscall_trace_enter(), and skip syscall
if -1. Return code will be left at what had been set by
ptrace or seccomp (in regs->d0).

No regression seen in testing with strace on ARAnyM.

Signed-off-by: Michael Schmitz 
Reviewed-by: Geert Uytterhoeven 
Link: https://lore.kernel.org/r/20230112035529.13521-2-schmitzmic@gmail.com
Signed-off-by: Geert Uytterhoeven

m68k: Wire up syscall_trace_enter/leave for m68k

2022-05-09T11:13:58+00:00

m68k (other than Coldfire) uses syscall_trace for both trace entry
and trace exit. Seccomp support requires separate entry points for
trace entry and exit which are already provided for Coldfire.

Replace syscall_trace by syscall_trace_enter and syscall_trace_leave
in preparation for seccomp support.

No regression seen in testing with strace on ARAnyM.

Signed-off-by: Michael Schmitz 
Acked-by: "Eric W. Biederman" 
Link: https://lore.kernel.org/r/20220127074158.25888-2-schmitzmic@gmail.com
Signed-off-by: Geert Uytterhoeven

m68k: Remove set_fs()

2021-09-24T11:35:07+00:00

Add a m68k-only set_fc helper to set the SFC and DFC registers for the
few places that need to override it for special MM operations, but
disconnect that from the deprecated kernel-wide set_fs() API.

Note that the SFC/DFC registers are context switched, so there is no need
to disable preemption.

Partially based on an earlier patch from
Linus Torvalds .

Signed-off-by: Christoph Hellwig 
Reviewed-by: Michael Schmitz 
Tested-by: Michael Schmitz 
Link: https://lore.kernel.org/r/20210916070405.52750-7-hch@lst.de
Signed-off-by: Geert Uytterhoeven

m68k: Leave stack mangling to asm wrapper of sigreturn()

2021-09-24T11:35:03+00:00

sigreturn has to deal with an unpleasant problem - exception stack frames
have different sizes, depending upon the exception (and processor model, as
well) and variable-sized part of exception frame may contain information
needed for instruction restart.  So when signal handler terminates and calls
sigreturn to resume the execution at the place where we'd been when we caught
the signal, it has to rearrange the frame at the bottom of kernel stack.
Worse, it might need to open a gap in the kernel stack, shifting pt_regs
towards lower addresses.

Doing that from C is insane - we'd need to shift stack frames (return addresses,
local variables, etc.) of C call chain, right under the nose of compiler and
hope it won't fall apart horribly.  What had been actually done is only slightly
less insane - an inline asm in mangle_kernel_stack() moved the stuff around,
then reset stack pointer and jumped to label in asm glue.

However, we can avoid all that mess if the asm wrapper we have to use anyway
would reserve some space on the stack between switch_stack and the C stack
frame of do_{rt_,}sigreturn().   Then C part can simply memmove() pt_regs +
switch_stack, memcpy() the variable part of exception frame into the opened
gap - all of that without inline asm, buggering C call chain, magical jumps
to asm labels, etc.

Asm wrapper would need to know where the moved switch_stack has ended up -
it might have been shifted into the gap we'd reserved before do_rt_sigreturn()
call.  That's where it needs to set the stack pointer to.  So let the C part
return just that and be done with that.

While we are at it, the call of berr_040cleanup() we need to do when
returning via 68040 bus error exception frame can be moved into C part
as well.

Signed-off-by: Al Viro 
Tested-by: Michael Schmitz 
Reviewed-by: Michael Schmitz 
Tested-by: Finn Thain 
Link: https://lore.kernel.org/r/YP2dTQPm1wGPWFgD@zeniv-ca.linux.org.uk
Signed-off-by: Geert Uytterhoeven

m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal

2021-09-24T11:35:01+00:00

We get there when sigreturn has performed obscene acts on kernel stack;
in particular, the location of pt_regs has shifted.  We are about to call
syscall_trace(), which might stop for tracer.  If that happens, we'd better
have task_pt_regs() returning correct result...

Fucked-up-by: Al Viro 
Fixes: bd6f56a75bb2 ("m68k: Missing syscall_trace() on sigreturn")
Signed-off-by: Al Viro 
Tested-by: Michael Schmitz 
Reviewed-by: Michael Schmitz 
Tested-by: Finn Thain 
Link: https://lore.kernel.org/r/YP2dMWeV1LkHiOpr@zeniv-ca.linux.org.uk
Signed-off-by: Geert Uytterhoeven

m68k: Wire up clone3() syscall

2020-01-12T15:49:20+00:00

Wire up the clone3() syscall for m68k. The special entry point is done in
assembler as was done for clone() as well. This is needed because all
registers need to be saved. The C wrapper then calls the generic
sys_clone3() with the correct arguments.

Tested on A1200 using the simple test program from:

  https://lore.kernel.org/lkml/20190716130631.tohj4ub54md25dys@brauner.io/

Signed-off-by: Kars de Jong 
Link: https://lore.kernel.org/r/20191124195225.31230-1-jongk@linux-m68k.org
Signed-off-by: Geert Uytterhoeven

m68k: Use conventional function parameters for do_sigreturn

2016-02-29T08:51:43+00:00

Create conventional stack parameters for the calls to do_sigreturn and
do_rt_sigreturn. The current C code for do_sigreturn and do_rt_sigreturn
dig into the stack to create local pointers to the saved switch stack
and the pt_regs structs.

The motivation for this change is a problem with non-MMU targets that
have broken signal return paths on newer versions of gcc. It appears as
though gcc has determined that the pointers into the saved stack structs,
and the saved structs themselves, are function parameters and updates to
them will be lost on function return, so they are optimized away. This
results in large parts of restore_sigcontext() and mangle_kernel_stack()
functions being removed. Of course this results in non-functional code
causing kernel oops. This problem has been observed with gcc version
5.2 and 5.3, and probably exists in earlier versions as well.

Using conventional stack parameter pointers passed to these functions has
the advantage of the code here not needing to know the exact details of
how the underlying entry handler layed these structs out on the stack.
So the rather ugly pointer setup casting and arg referencing can be
removed.

The resulting code after this change is a few bytes larger (due to the
overhead of creating the stack args and their tear down). Not being hot
paths I don't think this is too much of a problem here.

An alternative solution is to put a barrier() in the do_sigreturn() code,
but this doesn't feel quite as clean as this solution.

This change has been compile tested on all defconfigs, and run tested on
Atari (through aranym), ColdFire with MMU (M5407EVB) and ColdFire with
no-MMU (QEMU and M5208EVB).

Signed-off-by: Greg Ungerer 
Acked-by: Andreas Schwab 
Signed-off-by: Geert Uytterhoeven