RFE: Add Alpha support by glaubitz · Pull Request #481 · seccomp/libseccomp

glaubitz · 2026-02-16T09:36:06Z

This adds architecture support for Alpha, the other architecture besides SPARC which is unsupported yet.

A patch to add support for SECCOMP_FILTER was just posted to LKML.

This PR is missing the update to src/syscalls.csv since I have no clue how that works now. See this issue.

CC @linmag7 who is working on the kernel part.

coveralls · 2026-02-16T09:39:48Z

coverage: 88.986% (-0.04%) from 89.024%
when pulling a494011 on glaubitz:alpha-support
into 4b0bf50 on seccomp:main.

linmag7 · 2026-02-17T06:09:19Z

Hi all,

I've been running the libseccomp test suit (make check) on my Alpha UP2000+ with a kernel patched for libseccomp support, here are some results:

Regression Test Summary
tests run: 3891
tests skipped: 126
tests passed: 3715
tests failed: 176
tests errored: 149

So it mostly works I'd say! great work with libseccomp!. Below are some of the tests that fail:

Test 33-sim-socket_syscalls_be%%001-00001 result: ERROR 33-sim-socket_syscalls_be rc=14
test arch: s390
Test 33-sim-socket_syscalls_be%%002-00001 result: ERROR 33-sim-socket_syscalls_be rc=14
test arch: s390

Test 34-sim-basic_denylist%%003-00001 result: FAILURE bpf_sim resulted in ALLOW
Test 34-sim-basic_denylist%%003-00002 result: FAILURE bpf_sim resulted in ALLOW

Test 43-sim-a2_order%%031-00001 result: FAILURE bpf_sim resulted in KILL
Test 43-sim-a2_order%%032-00001 result: FAILURE bpf_sim resulted in KILL

Test 62-sim-arch_transactions%%001-00001 result: FAILURE bpf_sim resulted in ALLOW
Test 62-sim-arch_transactions%%002-00001 result: FAILURE bpf_sim resulted in ALLOW

Test 53-sim-binary_tree%%001-00001 result: ERROR 53-sim-binary_tree rc=14
test arch: x86_64

I haven't yet looked into the details as to why tests fail, seems like some of them just assumes the
wrong arch?

pcmoore · 2026-04-08T22:47:01Z

Without looking at the patch, I just want to remind everyone that we generally don't merge new architecture support until we have a released upstream kernel with seccomp support for that architecture.

pcmoore · 2026-04-08T22:47:43Z

Looking at Linus' tree, it doesn't appear that the seccomp support patch for Alpha has landed.

glaubitz · 2026-04-09T07:05:50Z

Looking at Linus' tree, it doesn't appear that the seccomp support patch for Alpha has landed.

It's part of Magnus Lindholm's tree in the for-next branch and will be submitted once the merge window opens again.

pcmoore · 2026-04-09T19:52:38Z

Great, we'll look forward to that. Hopefully that will give folks enough time to sort out the test failures.

On a personal note, my first job out of college was working on Tru64 UNIX for the Alpha, merging Alpha support into libseccomp would make me very happy :)

glaubitz · 2026-04-17T16:13:35Z

Support for SECCOMP and SECCOMP_FILTER was just merged into Linus' tree.

See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/arch/alpha?id=55b22075f7840ef48254886758976531fe146609

glaubitz · 2026-05-01T12:53:29Z

@pcmoore Ping. All bits and pieces are now in the upstream kernel. ;-)

drakenclimber

@glaubitz . I applied your Alpha patch on top of the latest proposed syscall table from Pull Request #487. I then updated syscalls.csv with an Alpha column and populated it via arch-syscall-validate. See this commit - drakenclimber@45211d9. Note that some tests are still failing, so we still have some work to do.

glaubitz · 2026-05-21T06:50:39Z

@glaubitz . I applied your Alpha patch on top of the latest proposed syscall table from Pull Request #487. I then updated syscalls.csv with an Alpha column and populated it via arch-syscall-validate. See this commit - drakenclimber@45211d9. Note that some tests are still failing, so we still have some work to do.

Hmm, I might have forgotten to pick up some changes that @linmag7 had suggested. He did a lot of testing on Alpha and also implemented the kernel bits.

glaubitz · 2026-05-21T10:03:29Z

I just had a look and it's 38-basic-pfc_coverage.sh that's failing.

Unfortunately, it doesn't produce any output:

(unstable-amd64-sbuild)glaubitz@esk:~/libseccomp/tests$ ./38-basic-pfc_coverage.sh    
(unstable-amd64-sbuild)glaubitz@esk:~/libseccomp/tests$ echo $?
1
(unstable-amd64-sbuild)glaubitz@esk:~/libseccomp/tests$

Any ideas?

linmag7 · 2026-05-21T15:16:04Z

When I run "make check" I get this:

 Regression Test Summary
 tests run: 4814
 tests skipped: 126
 tests passed: 4813
 tests failed: 1
 tests errored: 1
============================================================
FAIL: regression
==================
1 of 1 test failed
==================

The 38-basic-pfc_coverage fails but might that be because it the 38-basic-pfc_coverage.pfc files need updating with the expected results from alpha for the test to work?

lindholm@up2000 ~/libseccomp/tests $ ./38-basic-pfc_coverage > /tmp/actual.pfc
lindholm@up2000 ~/libseccomp/tests $ diff -u 38-basic-pfc_coverage.pfc /tmp/actual.pfc
--- 38-basic-pfc_coverage.pfc	2026-02-16 23:00:44.160758776 +0100
+++ /tmp/actual.pfc	2026-05-21 20:12:55.410355786 +0200
@@ -168,6 +168,103 @@
             action KILL;
   # default action
   action ALLOW;
+# filter for arch alpha (3221262374)
+if ($arch == 3221262374)
+  # filter for syscall "exit_group" (405) [priority: 65535]
+  if ($syscall == 405)
+    action LOG;
+  # filter for syscall "fstat" (91) [priority: 65535]
+  if ($syscall == 91)
+    action KILL_PROCESS;
+  # filter for syscall "open" (45) [priority: 65535]
+  if ($syscall == 45)
+    action KILL;
+  # filter for syscall "close" (6) [priority: 65535]
+  if ($syscall == 6)
+    action ERRNO(1);
+  # filter for syscall "exit" (1) [priority: 65535]
+  if ($syscall == 1)
+    action TRACE(1);
+  # filter for syscall "write" (4) [priority: 65527]
+  if ($syscall == 4)
+    if ($a0.hi32 == 0)
+      if ($a0.lo32 == 0)
+      else
+        if ($a1.hi32 > 0)
+        else
+          if ($a1.hi32 == 0)
+            if ($a1.lo32 > 1)
+            else
+              if ($a2.hi32 > 0)
+              else
+                if ($a2.hi32 == 0)
+                  if ($a2.lo32 >= 2)
+                  else
+                    action TRAP;
+                else
+                  action TRAP;
+          else
+            if ($a2.hi32 > 0)
+            else
+              if ($a2.hi32 == 0)
+                if ($a2.lo32 >= 2)
+                else
+                  action TRAP;
+              else
+                action TRAP;
+    else
+      if ($a1.hi32 > 0)
+      else
+        if ($a1.hi32 == 0)
+          if ($a1.lo32 > 1)
+          else
+            if ($a2.hi32 > 0)
+            else
+              if ($a2.hi32 == 0)
+                if ($a2.lo32 >= 2)
+                else
+                  action TRAP;
+              else
+                action TRAP;
+        else
+          if ($a2.hi32 > 0)
+          else
+            if ($a2.hi32 == 0)
+              if ($a2.lo32 >= 2)
+              else
+                action TRAP;
+            else
+              action TRAP;
+  # filter for syscall "read" (3) [priority: 65525]
+  if ($syscall == 3)
+    if ($a0.hi32 == 0)
+      if ($a0.lo32 == 0)
+        if ($a1.hi32 > 0)
+          if ($a2.hi32 > 0)
+            if ($a3.hi32 & 0x00000000 == 0)
+              if ($a3.lo32 & 0x0000000f == 3)
+                action KILL;
+          else
+            if ($a2.hi32 == 0)
+              if ($a2.lo32 > 2)
+                if ($a3.hi32 & 0x00000000 == 0)
+                  if ($a3.lo32 & 0x0000000f == 3)
+                    action KILL;
+        else
+          if ($a1.hi32 == 0)
+            if ($a1.lo32 >= 1)
+              if ($a2.hi32 > 0)
+                if ($a3.hi32 & 0x00000000 == 0)
+                  if ($a3.lo32 & 0x0000000f == 3)
+                    action KILL;
+              else
+                if ($a2.hi32 == 0)
+                  if ($a2.lo32 > 2)
+                    if ($a3.hi32 & 0x00000000 == 0)
+                      if ($a3.lo32 & 0x0000000f == 3)
+                        action KILL;
+  # default action
+  action ALLOW;
 # filter for arch arm (1073741864)
 if ($arch == 1073741864)
   # filter for syscall "exit_group" (248) [priority: 65535]

linmag7 · 2026-05-21T21:42:59Z

Got here now:

Regression Test Summary
 tests run: 5165
 tests skipped: 126
 tests passed: 5165
 tests failed: 0
 tests errored: 0
============================================================
PASS: regression
=============
1 test passed
=============

linmag7 · 2026-05-22T18:58:09Z

Below is from "regression -T live" on my UP2000+ Alpha

Regression Test Summary
 tests run: 11
 tests skipped: 0
 tests passed: 11
 tests failed: 0
 tests errored: 0
============================================================

glaubitz · 2026-05-22T19:00:42Z

Below is from "regression -T live" on my UP2000+ Alpha

Regression Test Summary
 tests run: 11
 tests skipped: 0
 tests passed: 11
 tests failed: 0
 tests errored: 0
============================================================

Shall I just add your patch to my pull request?

linmag7 · 2026-05-22T19:19:06Z

Below is from "regression -T live" on my UP2000+ Alpha
Regression Test Summary
 tests run: 11
 tests skipped: 0
 tests passed: 11
 tests failed: 0
 tests errored: 0
============================================================
Shall I just add your patch to my pull request?

yes, that probably easiest, please do.

glaubitz · 2026-07-30T19:47:13Z

Ping. Any news on this?

glaubitz · 2026-09-02T05:54:32Z

@pcmoore Any chance you could review this PR?

Add the expected PFC output for SCMP_ARCH_ALPHA to the 38-basic-pfc_coverage golden file. The new block is the direct output from seccomp_export_pfc() after adding alpha to the test. It is sane as reference output: the audit arch token is AUDIT_ARCH_ALPHA, the syscall numbers match alpha (open=45, close=6, read=3, write=4, fstat=91, exit_group=405), and the rule actions/argument checks mirror the existing 64-bit architectures. No existing architecture output is changed; the golden file is only extended with the reviewed alpha section. Signed-off-by: Magnus Lindholm <linmag7@gmail.com>

Add missing alpha entries to special_syscalls so syscall CSV generation succeeds for alpha. Also add known alpha syscall numbers for legacy/special syscalls such as tuxcall, bdflush, uselib, and afs_syscall instead of incorrectly marking them as undefined. Signed-off-by: Magnus Lindholm <linmag7@gmail.com>

mattst88

I built this and ran the test suite on an AlphaServer ES47 running a 7.3 kernel with the SECCOMP_FILTER patch, and also on x86_64.

As posted, src/syscalls.csv has no alpha column but struct arch_syscall_table does, so every arch after aarch64 picks up the values from the column to its left. On x86_64, scmp_sys_resolver -a loongarch64 openat returns 288 (m68k's number) and make check has 132 failures across 10 tests. The CSV needs to be regenerated in the same commit that adds the struct fields.

To get further, I spliced an alpha column into the CSV from the kernel's alpha syscall tables. With that, everything builds cleanly on alpha. The sim and basic tests pass except for the issues noted inline, and the C live tests pass against the kernel. A few other things:

tests/16-sim-arch_basic.py and tests/23-sim-arch_all_le_basic.py need the same alpha additions as their C counterparts. Without them, running the suite on an alpha host gives 9 failures with "bpf_sim resulted in KILL".
The Python live tests 21, 24, 32 and 54 fail on alpha. Alpha has no vDSO, so the interpreter's clock_gettime() is a real syscall and gets trapped. The Python SIGSYS handler is installed without SA_SIGINFO, so it returns through sigreturn rather than rt_sigreturn, and that gets trapped too.
64-live-trapx fails in both C and Python because glibc on alpha implements getppid() with getxpid, so the filter rule on getppid never matches. Calling syscall(__NR_getppid) directly, or picking a different syscall, would fix it.
The first commit needs a commit message body and a Signed-off-by. The pfc golden file update should be squashed into the commit that adds alpha to test 38.

mattst88 · 2026-10-29T04:57:24Z

 	int aarch64;
 	enum scmp_kver aarch64_kver;

+	int alpha;


This needs a matching alpha,alpha_kver column in src/syscalls.csv at the same position, after aarch64_kver. arch-gperf-generate fills this struct by position, so without the column every arch from loongarch64 onward is off by one.

When regenerating, note that alpha's uapi unistd.h has #define __NR_getpid __NR_getxpid, and does the same for getuid and getgid. The CSV needs 20, 24 and 47 for those, not PNR, or the build fails with '__PNR_getpid' undeclared.

Thanks for taking a look at this Matt,

In order to run the test you first need to generate a fresh syscalls.csv, this is what I did:

first:
I had to clone the git repo for https://github.com/hrw/syscalls-table.git
./src/arch-build-kver-tables.py -d "$PWD/syscalls-table" -k
"$HOME/linux-git" -V 6.14,6.15,6.16

second:
(manually edit/shorten the kernel_versions list in the script, use same as
above, for example: 6.14,6.15,6.16 )

./src/arch-create-syscalls-csv.py -d . -k /usr/src/linux -o src/syscalls.csv

Should an updated syscalls.csv be part of this PR maybe?

mattst88 · 2026-10-29T04:57:24Z

+                   'x32': [42, 'UNDEF'],
+                   'alpha': [None, 'UNDEF'],


x32 doesn't have nfsservctl: syscall_64.tbl lists 180 64 nfsservctl, so it's 64-bit only. 42 on x32 is connect. Alpha does reserve a number for it, 342 common nfsservctl sys_ni_syscall, which matches how afs_syscall, tuxcall, etc. are handled above.

Suggested change

'x32': [42, 'UNDEF'],

'alpha': [None, 'UNDEF'],

'x32': [None, 'UNDEF'],

'alpha': [342, 'UNDEF'],

mattst88 · 2026-10-29T04:57:24Z

+                if ($a2.hi32 == 0)
+                  if ($a2.lo32 >= 2)
+                  else
+                    action TRAP;


The output format changed to action TRAP(0); in de2bf46 ("api,doc,tests: Add SCMP_ACT_TRAPX()"). This block has 8 action TRAP; lines, which is the only remaining diff in test 38. The block needs to be regenerated against current main.

mattst88 · 2026-10-29T04:57:24Z

+/**
+ * The Alpha architecture tokens
+ */
+#define SCMP_ARCH_ALPHA		AUDIT_ARCH_ALPHA


The other arches have a fallback for older kernel headers. AUDIT_ARCH_ALPHA has been around long enough that it probably doesn't matter, but for consistency:

Suggested change

#define SCMP_ARCH_ALPHA AUDIT_ARCH_ALPHA

#ifndef AUDIT_ARCH_ALPHA

#ifndef EM_ALPHA

#define EM_ALPHA 0x9026

#endif /* EM_ALPHA */

#define AUDIT_ARCH_ALPHA (EM_ALPHA|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)

#endif /* AUDIT_ARCH_ALPHA */

#define SCMP_ARCH_ALPHA AUDIT_ARCH_ALPHA

mattst88 · 2026-10-29T04:57:24Z

 #define __PNR_listns				-10252
 #define __PNR_rseq_slice_yield			-10253
 #define __PNR_uprobe				-10254
+#define __PNR_open_tree_attr			-10255


This looks like a fix for building against kernel headers that predate open_tree_attr, not something alpha-specific (alpha's headers define it as 577). Could it go in a separate commit?

mattst88 · 2026-10-29T04:57:25Z

 		rc_log=164
 		;;
-	mips|mipsel|mips64|mips64n32|mipsel64|mipsel64n32)
+	alpha|mips|mipsel|mips64|mips64n32|mipsel64|mipsel64n32)


140 is correct for alpha: SIGSYS is 12 there, the same as on MIPS. I confirmed it with the kill tests on hardware.

glaubitz force-pushed the alpha-support branch 3 times, most recently from d0bd0a4 to 0590350 Compare February 24, 2026 08:40

pcmoore changed the title ~~RFE: Add Alpha support~~ RFE: add Alpha support Apr 8, 2026

pcmoore added enhancement pending/revision labels Apr 8, 2026

drakenclimber reviewed May 20, 2026

View reviewed changes

Comment thread src/arch-syscall-dump.c Resolved

glaubitz force-pushed the alpha-support branch 2 times, most recently from 5562cbe to 4a107e3 Compare May 21, 2026 10:16

glaubitz mentioned this pull request Sep 18, 2026

libseccomp is missing support for alpha alphalinux/issues#2

Open

glaubitz and others added 3 commits October 9, 2026 11:08

RFE: Add Alpha support

e65e36f

glaubitz force-pushed the alpha-support branch from fc8c76d to 9090720 Compare October 9, 2026 09:10

glaubitz changed the title ~~RFE: add Alpha support~~ RFE: Add Alpha support Oct 9, 2026

mattst88 reviewed Oct 29, 2026

View reviewed changes

-#define SCMP_ARCH_ALPHA		AUDIT_ARCH_ALPHA
+#ifndef AUDIT_ARCH_ALPHA
+#ifndef EM_ALPHA
+#define EM_ALPHA		0x9026
+#endif /* EM_ALPHA */
+#define AUDIT_ARCH_ALPHA	(EM_ALPHA|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#endif /* AUDIT_ARCH_ALPHA */
+#define SCMP_ARCH_ALPHA		AUDIT_ARCH_ALPHA

Conversation

glaubitz commented Feb 16, 2026

Uh oh!

coveralls commented Feb 16, 2026

Uh oh!

linmag7 commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pcmoore commented Apr 8, 2026

Uh oh!

pcmoore commented Apr 8, 2026

Uh oh!

glaubitz commented Apr 9, 2026

Uh oh!

pcmoore commented Apr 9, 2026

Uh oh!

glaubitz commented Apr 17, 2026

Uh oh!

glaubitz commented May 1, 2026

Uh oh!

drakenclimber left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

glaubitz commented May 21, 2026

Uh oh!

glaubitz commented May 21, 2026

Uh oh!

linmag7 commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linmag7 commented May 21, 2026

Uh oh!

linmag7 commented May 22, 2026

Uh oh!

glaubitz commented May 22, 2026

Uh oh!

linmag7 commented May 22, 2026

Uh oh!

glaubitz commented Jul 30, 2026

Uh oh!

glaubitz commented Sep 2, 2026

Uh oh!

mattst88 left a comment

Choose a reason for hiding this comment

Uh oh!

mattst88 Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

linmag7 Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

mattst88 Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

mattst88 Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

mattst88 Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

mattst88 Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

mattst88 Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

linmag7 commented Feb 17, 2026 •

edited

Loading

linmag7 commented May 21, 2026 •

edited

Loading