Skip to content

Add riscv64 support #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rota1001 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add riscv64 support #19

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0c29e03
Fix host syscall table error
rota1001 Mar 23, 2026
d8d82b1
Add riscv64 support
rota1001 Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,6 +235,7 @@ See `docs/gdb-workflow.md` for the full workflow.

- x86_64
- aarch64
- riscv64

## License
`kbox` is available under a permissive MIT-style license.
Expand Down
5 changes: 5 additions & 0 deletions mk/toolchain.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,11 @@ CFLAGS += -std=gnu11 -D_GNU_SOURCE -Wall -Wextra -Wpedantic -Wshadow
CFLAGS += -Wno-unused-parameter
CFLAGS += -Iinclude -Isrc

# Disable link relaxation of riscv64 architecture to prevent long link time
ifeq ($(ARCH),riscv64)
LDFLAGS += -Wl,--no-relax
endif

# Build mode from Kconfig (fallback to BUILD= for unconfigured builds)
ifeq ($(CONFIG_BUILD_RELEASE),y)
CFLAGS += -O2 -DNDEBUG
Expand Down
1 change: 1 addition & 0 deletions scripts/alpine-sha256.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
55ea3e5a7c2c35e6268c5dcbb8e45a9cd5b0e372e7b4e798499a526834f7ed90 alpine-minirootfs-3.21.0-x86_64.tar.gz
f31202c4070c4ef7de9e157e1bd01cb4da3a2150035d74ea5372c5e86f1efac1 alpine-minirootfs-3.21.0-aarch64.tar.gz
b2c5ed2be586aebd2da5dd13dbc96bc8cc41b72e517d0726dfbbb0a9810e66d6 alpine-minirootfs-3.21.0-riscv64.tar.gz
1 change: 1 addition & 0 deletions scripts/fetch-lkl.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ set -eu
case "${1:-$(uname -m)}" in
x86_64 | amd64) ARCH="x86_64" ;;
aarch64 | arm64) ARCH="aarch64" ;;
riscv64) ARCH="riscv64" ;;
*)
echo "error: unsupported architecture: ${1:-$(uname -m)}" >&2
exit 1
Expand Down
1 change: 1 addition & 0 deletions scripts/mkrootfs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ if [ -z "${ALPINE_ARCH:-}" ]; then
case "$(uname -m)" in
aarch64 | arm64) ALPINE_ARCH="aarch64" ;;
x86_64 | amd64) ALPINE_ARCH="x86_64" ;;
riscv64) ALPINE_ARCH="riscv64" ;;
*) die "Unsupported host architecture: $(uname -m). Set ALPINE_ARCH explicitly." ;;
esac
fi
Expand Down
2 changes: 1 addition & 1 deletion src/seccomp-bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ static const int deny_nrs[] = {
153, /* vhangup */
};

#elif defined(__aarch64__)
#elif defined(__aarch64__) || (defined(__riscv) && __riscv_xlen == 64)
static const int deny_nrs[] = {
/* Seccomp manipulation */
277, /* seccomp */
Expand Down
15 changes: 11 additions & 4 deletions src/seccomp-defs.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@
#define KBOX_AUDIT_ARCH_CURRENT 0xc000003eU
#elif defined(__aarch64__)
#define KBOX_AUDIT_ARCH_CURRENT 0xc00000b7U
#elif defined(__riscv) && __riscv_xlen == 64
#define KBOX_AUDIT_ARCH_CURRENT 0xc00000f3U
#else
#error "unsupported architecture"
#endif
Expand All @@ -44,11 +46,16 @@ struct kbox_sock_fprog {
struct kbox_sock_filter *filter;
};

#define KBOX_BPF_STMT(c, val) {(unsigned short) (c), 0, 0, (unsigned int) (val)}
#define KBOX_BPF_STMT(c, val) \
{ \
(unsigned short) (c), 0, 0, (unsigned int) (val) \
}

#define KBOX_BPF_JUMP(c, val, t, f) \
{(unsigned short) (c), (unsigned char) (t), (unsigned char) (f), \
(unsigned int) (val)}
#define KBOX_BPF_JUMP(c, val, t, f) \
{ \
(unsigned short) (c), (unsigned char) (t), (unsigned char) (f), \
(unsigned int) (val) \
}
Copy link
Copy Markdown

@visitorckw visitorckw Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like unrelated style changes?
Please keep the changes to a minimum.
Otherwise, this will make git blame messy.

Copy link
Copy Markdown
Collaborator Author

@rota1001 rota1001 Apr 9, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change was made because the source code wasn't properly formatted with clang-format, which caused it to be blocked by the new commit-hook. Did you mean I have to separate it to another commit?

Copy link
Copy Markdown

@visitorckw visitorckw Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally, a single patch should contain only one logical change.
However, it looks like this patch is doing two things:

  1. Fixing a pre-existing clang-format error.
  2. Adding RISC-V support.

So, yes, I would prefer splitting this into two patches.


struct kbox_seccomp_notif {
uint64_t id;
Expand Down
2 changes: 1 addition & 1 deletion src/seccomp-dispatch.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4548,7 +4548,7 @@ struct kbox_dispatch kbox_dispatch_syscall(struct kbox_supervisor_ctx *ctx,
return kbox_dispatch_continue(); /* return from signal handler */
if (nr == h->rt_sigpending)
return kbox_dispatch_continue(); /* pending signal query */
if (nr == h->rt_sigaltstack)
if (nr == h->sigaltstack)
return kbox_dispatch_continue(); /* alternate signal stack */
if (nr == h->setitimer)
return kbox_dispatch_continue(); /* interval timer */
Expand Down
2 changes: 1 addition & 1 deletion src/seccomp-supervisor.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,7 +369,7 @@ int kbox_run_supervisor(const struct kbox_sysnrs *sysnrs,
/* Architecture-specific host syscall numbers for the BPF filter. */
#if defined(__x86_64__)
const struct kbox_host_nrs *host_nrs = &HOST_NRS_X86_64;
#elif defined(__aarch64__)
#elif defined(__aarch64__) || (defined(__riscv) && __riscv_xlen == 64)
const struct kbox_host_nrs *host_nrs = &HOST_NRS_AARCH64;
Copy link
Copy Markdown

@visitorckw visitorckw Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reusing the HOST_NRS_AARCH64 struct directly for RISC-V is semantically confusing for future maintenance. Maybe consider adding a preparatory refactoring patch to rename it to something more generic before wiring up RISC-V support?

#else
#error "Unsupported architecture"
Expand Down
8 changes: 4 additions & 4 deletions src/syscall-nr.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,7 +298,7 @@ const struct kbox_host_nrs HOST_NRS_X86_64 = {
.rt_sigprocmask = 14,
.rt_sigreturn = 15,
.rt_sigpending = 127,
.rt_sigaltstack = 131,
.sigaltstack = 131,
.kill = 62,
.tgkill = 234,
.tkill = 200,
Expand Down Expand Up @@ -467,7 +467,7 @@ const struct kbox_host_nrs HOST_NRS_AARCH64 = {
.rt_sigprocmask = 135,
.rt_sigreturn = 139,
.rt_sigpending = 136,
.rt_sigaltstack = 132,
.sigaltstack = 132,
.kill = 129,
.tgkill = 131,
.tkill = 130,
Expand Down Expand Up @@ -500,7 +500,7 @@ const struct kbox_host_nrs HOST_NRS_AARCH64 = {
.sched_getaffinity = 123,
.prlimit64 = 261,
.madvise = 233,
.getrlimit = -1,
.getrlimit = 163,
.getrusage = 165,
.epoll_create1 = 20,
.epoll_ctl = 21,
Expand All @@ -516,7 +516,7 @@ const struct kbox_host_nrs HOST_NRS_AARCH64 = {
.timerfd_gettime = 87,
.eventfd = -1,
.eventfd2 = 19,
.statfs = -1,
.statfs = 43,
.fstatfs = 44,
.sysinfo = 179,
.readlink = -1,
Expand Down
2 changes: 1 addition & 1 deletion src/syscall-nr.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@
X(rt_sigprocmask) \
X(rt_sigreturn) \
X(rt_sigpending) \
X(rt_sigaltstack) \
X(sigaltstack) \
X(kill) \
X(tgkill) \
X(tkill) \
Expand Down
Loading