alpha: add support for SECCOMP and SECCOMP_FILTER

This patch adds SECCOMP and SECCOMP_FILTER support to the Alpha architecture.

The seccomp-bpf selftests exercise syscall tracing, restart, and signal interaction paths that were previously untested on Alpha. To support these, the ptrace/strace syscall path is updated to reliably distinguish internal skip-dispatch from userspace invalid syscall numbers, ensuring that syscall(-1) continues to return -ENOSYS with correct r0/a3 semantics.

Supporting seccomp also requires correct syscall restart handling when ptrace and signal delivery are involved. The traced syscall entry path now consistently tracks syscall state using r0, r1, and r2 while preserving Alpha's a3-based error reporting ABI:

- r1 holds the mutable "current" syscall number
- r2 preserves the original syscall number for restart
- r0 and r19 (a3) retain their traditional roles as return value and error indicator

This separation allows syscall restarts to be gated strictly on valid ERESTART* return codes in the ptrace/strace paths and prevents kernel-internal restart values from leaking into userspace.

Alpha also lacked support for PTRACE_GETREGSET(NT_PRSTATUS), causing ptrace-based seccomp tests to fail with -EIO. Minimal GETREGSET and SETREGSET support is added to export struct pt_regs directly.

With these changes applied, the seccomp-bpf and ptrace syscall selftests (seccomp_bpf, extended for Alpha) pass reliably on Alpha systems.

---
Changes since v1:
- Update features documentation for seccomp-filter/alpha

Magnus Lindholm (1):
alpha: add support for SECCOMP and SECCOMP_FILTER

 .../seccomp/seccomp-filter/arch-support.txt   |   2 +-
 arch/alpha/Kconfig                            |   2 +
 arch/alpha/include/asm/seccomp.h              |  13 ++
 arch/alpha/include/asm/syscall.h              |  90 ++++++++++++-
 arch/alpha/include/asm/thread_info.h          |  16 ++-
 arch/alpha/kernel/entry.S                     | 123 +++++++++++++++---
 arch/alpha/kernel/ptrace.c                    |  83 +++++++++++-
 7 files changed, 305 insertions(+), 24 deletions(-)
 create mode 100644 arch/alpha/include/asm/seccomp.h

2.52.0

Add SECCOMP and SECCOMP_FILTER support to the Alpha architecture and fix syscall entry and ptrace issues uncovered by the seccomp-bpf selftests.

The syscall entry path is reworked to consistently track syscall state using r0, r1 and r2:
- r1 holds the active syscall number
- r2 preserves the original syscall number for restart
- r0 carries the return value, with r19 (a3) indicating success/error

This allows syscall restarts to be permitted only for valid ERESTART* return codes and prevents kernel-internal restart values from leaking to userspace. The syscall tracing error marker is corrected to use the saved syscall number slot, matching the Alpha ABI.

Additionally, implement minimal PTRACE_GETREGSET and PTRACE_SETREGSET support for NT_PRSTATUS, exporting struct pt_regs directly. This fixes ptrace-based seccomp tests that previously failed with -EIO.

With these changes, seccomp-bpf and ptrace syscall tests pass reliably on Alpha.

---
 .../seccomp/seccomp-filter/arch-support.txt   |   2 +-
 arch/alpha/Kconfig                            |   2 +
 arch/alpha/include/asm/seccomp.h              |  13 ++
 arch/alpha/include/asm/syscall.h              |  90 ++++++++++++-
 arch/alpha/include/asm/thread_info.h          |  16 ++-
 arch/alpha/kernel/entry.S                     | 123 +++++++++++++++---
 arch/alpha/kernel/ptrace.c                    |  83 +++++++++++-
 7 files changed, 305 insertions(+), 24 deletions(-)
 create mode 100644 arch/alpha/include/asm/seccomp.h

index 13feb679649e..9336bdfc125c 100644
@@ -6,7 +6,7 @@
     -----------------------
     |         arch |status|
     -----------------------
-    |       alpha: | TODO |
+    |       alpha: |  ok  |
     |         arc: | TODO |
     |         arm: |  ok  |
     |       arm64: |  ok  |

index 6c7dbf0adad6..7b7dafe7d9df 100644
@@ -31,6 +31,8 @@ config ALPHA
 	select GENERIC_SMP_IDLE_THREAD
 	select HAS_IOPORT
 	select HAVE_ARCH_AUDITSYSCALL
+	select HAVE_ARCH_SECCOMP
+	select HAVE_ARCH_SECCOMP_FILTER
 	select HAVE_MOD_ARCH_SPECIFIC
 	select LOCK_MM_AND_FIND_VMA
 	select MODULES_USE_ELF_RELA

new file mode 100644
index 000000000000..311934d20340
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_ALPHA_SECCOMP_H
+#define _ASM_ALPHA_SECCOMP_H
+
+#include <asm/unistd.h>
+#include <asm-generic/seccomp.h>
+#include <uapi/linux/audit.h>
+
+#define SECCOMP_ARCH_NATIVE            AUDIT_ARCH_ALPHA
+#define SECCOMP_ARCH_NATIVE_NR         NR_syscalls
+#define SECCOMP_ARCH_NATIVE_NAME       "alpha"
+
+#endif /* _ASM_ALPHA_SECCOMP_H */

index 98ccbca64984..94ef9cfa30f5 100644
@@ -56,7 +56,8 @@ register unsigned long *current_stack_pointer __asm__ ("$30");
  * - pending work-to-be-done flags come first and must be assigned to be
  *   within bits 0 to 7 to fit in and immediate operand.
  *
- * TIF_SYSCALL_TRACE is known to be 0 via blbs.
+ * (Historically TIF_SYSCALL_TRACE was known to be 0 via blbs, but we may
+ *  also test multiple bits via masks now.)
  */
 #define TIF_SYSCALL_TRACE	0	/* syscall trace active */
 #define TIF_NOTIFY_RESUME	1	/* callback before returning to user */

@@ -64,6 +65,7 @@ register unsigned long *current_stack_pointer __asm__ ("$30");
 #define TIF_NEED_RESCHED	3	/* rescheduling necessary */
 #define TIF_SYSCALL_AUDIT	4	/* syscall audit active */
 #define TIF_NOTIFY_SIGNAL	5	/* signal notifications exist */
+#define TIF_SECCOMP		6	/* seccomp syscall filtering active */
 #define TIF_DIE_IF_KERNEL	9	/* dik recursion lock */
 #define TIF_MEMDIE		13	/* is terminating due to OOM killer */
 #define TIF_POLLING_NRFLAG	14	/* idle is polling for TIF_NEED_RESCHED */

@@ -74,8 +76,20 @@ register unsigned long *current_stack_pointer __asm__ ("$30");
 #define _TIF_NOTIFY_RESUME	(1<<TIF_NOTIFY_RESUME)
 #define _TIF_SYSCALL_AUDIT	(1<<TIF_SYSCALL_AUDIT)
 #define _TIF_NOTIFY_SIGNAL	(1<<TIF_NOTIFY_SIGNAL)
+#define _TIF_SECCOMP		(1<<TIF_SECCOMP)
 #define _TIF_POLLING_NRFLAG	(1<<TIF_POLLING_NRFLAG)
 
+/*
+ * Work to do on syscall entry (in entry.S).
+ * If you want this to exactly mirror what entry.S checks, keep it aligned
+ * with the mask used before branching to syscall_trace_enter().
+ */
+#ifdef CONFIG_AUDITSYSCALL
+# define _TIF_SYSCALL_WORK	(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SECCOMP)
+#else
+# define _TIF_SYSCALL_WORK	(_TIF_SYSCALL_TRACE | _TIF_SECCOMP)
+#endif
+
 /* Work to do on interrupt/exception return.  */
 #define _TIF_WORK_MASK		(_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
 				 _TIF_NOTIFY_RESUME | _TIF_NOTIFY_SIGNAL)

2.52.0

Passes the seccomp-bpf selftests and the live tests of Adrian's alpha-support branch of libseccomp on my ES45.

Cheers,
Michael.