RFE: add Alpha support by glaubitz · Pull Request #481 · seccomp/libseccomp

glaubitz · 2026-02-16T09:36:06Z

This adds architecture support for Alpha, the other architecture besides SPARC which is unsupported yet.

A patch to add support for SECCOMP_FILTER was just posted to LKML.

This PR is missing the update to src/syscalls.csv since I have no clue how that works now. See this issue.

CC @linmag7 who is working on the kernel part.

coveralls · 2026-02-16T09:39:48Z

coverage: 88.986% (-0.04%) from 89.024%
when pulling a494011 on glaubitz:alpha-support
into 4b0bf50 on seccomp:main.

linmag7 · 2026-02-17T06:09:19Z

Hi all,

I've been running the libseccomp test suit (make check) on my Alpha UP2000+ with a kernel patched for libseccomp support, here are some results:

Regression Test Summary
tests run: 3891
tests skipped: 126
tests passed: 3715
tests failed: 176
tests errored: 149

So it mostly works I'd say! great work with libseccomp!. Below are some of the tests that fail:

Test 33-sim-socket_syscalls_be%%001-00001 result: ERROR 33-sim-socket_syscalls_be rc=14
test arch: s390
Test 33-sim-socket_syscalls_be%%002-00001 result: ERROR 33-sim-socket_syscalls_be rc=14
test arch: s390

Test 34-sim-basic_denylist%%003-00001 result: FAILURE bpf_sim resulted in ALLOW
Test 34-sim-basic_denylist%%003-00002 result: FAILURE bpf_sim resulted in ALLOW

Test 43-sim-a2_order%%031-00001 result: FAILURE bpf_sim resulted in KILL
Test 43-sim-a2_order%%032-00001 result: FAILURE bpf_sim resulted in KILL

Test 62-sim-arch_transactions%%001-00001 result: FAILURE bpf_sim resulted in ALLOW
Test 62-sim-arch_transactions%%002-00001 result: FAILURE bpf_sim resulted in ALLOW

Test 53-sim-binary_tree%%001-00001 result: ERROR 53-sim-binary_tree rc=14
test arch: x86_64

I haven't yet looked into the details as to why tests fail, seems like some of them just assumes the
wrong arch?

pcmoore · 2026-04-08T22:47:01Z

Without looking at the patch, I just want to remind everyone that we generally don't merge new architecture support until we have a released upstream kernel with seccomp support for that architecture.

pcmoore · 2026-04-08T22:47:43Z

Looking at Linus' tree, it doesn't appear that the seccomp support patch for Alpha has landed.

glaubitz · 2026-04-09T07:05:50Z

Looking at Linus' tree, it doesn't appear that the seccomp support patch for Alpha has landed.

It's part of Magnus Lindholm's tree in the for-next branch and will be submitted once the merge window opens again.

pcmoore · 2026-04-09T19:52:38Z

Great, we'll look forward to that. Hopefully that will give folks enough time to sort out the test failures.

On a personal note, my first job out of college was working on Tru64 UNIX for the Alpha, merging Alpha support into libseccomp would make me very happy :)

glaubitz · 2026-04-17T16:13:35Z

Support for SECCOMP and SECCOMP_FILTER was just merged into Linus' tree.

See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/arch/alpha?id=55b22075f7840ef48254886758976531fe146609

glaubitz · 2026-05-01T12:53:29Z

@pcmoore Ping. All bits and pieces are now in the upstream kernel. ;-)

drakenclimber

@glaubitz . I applied your Alpha patch on top of the latest proposed syscall table from Pull Request #487. I then updated syscalls.csv with an Alpha column and populated it via arch-syscall-validate. See this commit - drakenclimber@45211d9. Note that some tests are still failing, so we still have some work to do.

glaubitz · 2026-05-21T06:50:39Z

@glaubitz . I applied your Alpha patch on top of the latest proposed syscall table from Pull Request #487. I then updated syscalls.csv with an Alpha column and populated it via arch-syscall-validate. See this commit - drakenclimber@45211d9. Note that some tests are still failing, so we still have some work to do.

Hmm, I might have forgotten to pick up some changes that @linmag7 had suggested. He did a lot of testing on Alpha and also implemented the kernel bits.

glaubitz · 2026-05-21T10:03:29Z

I just had a look and it's 38-basic-pfc_coverage.sh that's failing.

Unfortunately, it doesn't produce any output:

(unstable-amd64-sbuild)glaubitz@esk:~/libseccomp/tests$ ./38-basic-pfc_coverage.sh    
(unstable-amd64-sbuild)glaubitz@esk:~/libseccomp/tests$ echo $?
1
(unstable-amd64-sbuild)glaubitz@esk:~/libseccomp/tests$

Any ideas?

linmag7 · 2026-05-21T15:16:04Z

When I run "make check" I get this:

 Regression Test Summary
 tests run: 4814
 tests skipped: 126
 tests passed: 4813
 tests failed: 1
 tests errored: 1
============================================================
FAIL: regression
==================
1 of 1 test failed
==================

The 38-basic-pfc_coverage fails but might that be because it the 38-basic-pfc_coverage.pfc files need updating with the expected results from alpha for the test to work?

lindholm@up2000 ~/libseccomp/tests $ ./38-basic-pfc_coverage > /tmp/actual.pfc
lindholm@up2000 ~/libseccomp/tests $ diff -u 38-basic-pfc_coverage.pfc /tmp/actual.pfc
--- 38-basic-pfc_coverage.pfc	2026-02-16 23:00:44.160758776 +0100
+++ /tmp/actual.pfc	2026-05-21 20:12:55.410355786 +0200
@@ -168,6 +168,103 @@
             action KILL;
   # default action
   action ALLOW;
+# filter for arch alpha (3221262374)
+if ($arch == 3221262374)
+  # filter for syscall "exit_group" (405) [priority: 65535]
+  if ($syscall == 405)
+    action LOG;
+  # filter for syscall "fstat" (91) [priority: 65535]
+  if ($syscall == 91)
+    action KILL_PROCESS;
+  # filter for syscall "open" (45) [priority: 65535]
+  if ($syscall == 45)
+    action KILL;
+  # filter for syscall "close" (6) [priority: 65535]
+  if ($syscall == 6)
+    action ERRNO(1);
+  # filter for syscall "exit" (1) [priority: 65535]
+  if ($syscall == 1)
+    action TRACE(1);
+  # filter for syscall "write" (4) [priority: 65527]
+  if ($syscall == 4)
+    if ($a0.hi32 == 0)
+      if ($a0.lo32 == 0)
+      else
+        if ($a1.hi32 > 0)
+        else
+          if ($a1.hi32 == 0)
+            if ($a1.lo32 > 1)
+            else
+              if ($a2.hi32 > 0)
+              else
+                if ($a2.hi32 == 0)
+                  if ($a2.lo32 >= 2)
+                  else
+                    action TRAP;
+                else
+                  action TRAP;
+          else
+            if ($a2.hi32 > 0)
+            else
+              if ($a2.hi32 == 0)
+                if ($a2.lo32 >= 2)
+                else
+                  action TRAP;
+              else
+                action TRAP;
+    else
+      if ($a1.hi32 > 0)
+      else
+        if ($a1.hi32 == 0)
+          if ($a1.lo32 > 1)
+          else
+            if ($a2.hi32 > 0)
+            else
+              if ($a2.hi32 == 0)
+                if ($a2.lo32 >= 2)
+                else
+                  action TRAP;
+              else
+                action TRAP;
+        else
+          if ($a2.hi32 > 0)
+          else
+            if ($a2.hi32 == 0)
+              if ($a2.lo32 >= 2)
+              else
+                action TRAP;
+            else
+              action TRAP;
+  # filter for syscall "read" (3) [priority: 65525]
+  if ($syscall == 3)
+    if ($a0.hi32 == 0)
+      if ($a0.lo32 == 0)
+        if ($a1.hi32 > 0)
+          if ($a2.hi32 > 0)
+            if ($a3.hi32 & 0x00000000 == 0)
+              if ($a3.lo32 & 0x0000000f == 3)
+                action KILL;
+          else
+            if ($a2.hi32 == 0)
+              if ($a2.lo32 > 2)
+                if ($a3.hi32 & 0x00000000 == 0)
+                  if ($a3.lo32 & 0x0000000f == 3)
+                    action KILL;
+        else
+          if ($a1.hi32 == 0)
+            if ($a1.lo32 >= 1)
+              if ($a2.hi32 > 0)
+                if ($a3.hi32 & 0x00000000 == 0)
+                  if ($a3.lo32 & 0x0000000f == 3)
+                    action KILL;
+              else
+                if ($a2.hi32 == 0)
+                  if ($a2.lo32 > 2)
+                    if ($a3.hi32 & 0x00000000 == 0)
+                      if ($a3.lo32 & 0x0000000f == 3)
+                        action KILL;
+  # default action
+  action ALLOW;
 # filter for arch arm (1073741864)
 if ($arch == 1073741864)
   # filter for syscall "exit_group" (248) [priority: 65535]

linmag7 · 2026-05-21T21:42:59Z

Got here now:

Regression Test Summary
 tests run: 5165
 tests skipped: 126
 tests passed: 5165
 tests failed: 0
 tests errored: 0
============================================================
PASS: regression
=============
1 test passed
=============

RFE: Add Alpha support

4a107e3

glaubitz force-pushed the alpha-support branch 3 times, most recently from d0bd0a4 to 0590350 Compare February 24, 2026 08:40

pcmoore changed the title ~~RFE: Add Alpha support~~ RFE: add Alpha support Apr 8, 2026

pcmoore added enhancement pending/revision labels Apr 8, 2026

drakenclimber reviewed May 20, 2026

View reviewed changes

Comment thread src/arch-syscall-dump.c Outdated

glaubitz force-pushed the alpha-support branch 2 times, most recently from 5562cbe to 4a107e3 Compare May 21, 2026 10:16

Conversation

glaubitz commented Feb 16, 2026

Uh oh!

coveralls commented Feb 16, 2026

Uh oh!

linmag7 commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pcmoore commented Apr 8, 2026

Uh oh!

pcmoore commented Apr 8, 2026

Uh oh!

glaubitz commented Apr 9, 2026

Uh oh!

pcmoore commented Apr 9, 2026

Uh oh!

glaubitz commented Apr 17, 2026

Uh oh!

glaubitz commented May 1, 2026

Uh oh!

drakenclimber left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

glaubitz commented May 21, 2026

Uh oh!

glaubitz commented May 21, 2026

Uh oh!

linmag7 commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linmag7 commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

linmag7 commented Feb 17, 2026 •

edited

Loading

linmag7 commented May 21, 2026 •

edited

Loading