[debianyu]

Add LoongArch64 (loongarch64) processor support to libaudit, following the same pattern as RISCV64 and
AARCH64.

• New file: lib/loongarch64_table.h (326 syscall entries)

Tested on x86_64 host with loongarch64 cross-compiler (GCC 15.1.0):
autoreconf, configure, make, lookup_test all pass.

Closes: #88

[debianyu]

Hi, gentle ping on this PR. Is there anything that needs to be adjusted? Thanks!

[stevegrubb]

Well, first thing is that there is a moratorium on adding new hardware platforms because I have no time for adding syscalls every kernel release. This was announced on the mail list a couple years ago:

https://lore.kernel.org/linux-audit/4855993.31r3eYUQgx@x2/T/#u

See item 6.MIPS was let in because they promised to update the tables.

[debianyu]

Thanks for the explanation, Steve. I understand the maintenance burden concern.

loongarch64 is an actively deployed architecture in production, and I'm willing to commit to keeping syscall-names.list and
the loongarch64 syscall table updated for each kernel release, the same way MIPS was let in with that commitment.

Would that be acceptable? Or would you prefer me to resubmit this after the moratorium is lifted?

[stevegrubb]

I'm considering it. I want to double check with new maintainers what their opinion is.

[Cropi]

I'm not sure this will eventually get merged but here are some things that would probably need fixing either way.

Missing syscall. The table ends at 471 (rseq_slice_yield) but scripts/syscall.tbl in the kernel already has 472 (fchroot). Since loongarch64 uses the generic table, it needs _S(472, "fchroot") too. It's a relatively new thing in audit, see commit ccd29d1

auparse/interpret.c:968 bound is wrong. There's a check if (machine > MACH_RISCV64) that detects unknown future machine types and routes them through ELF-number conversion instead of the normal lookup. MACH_LOONGARCH64 is added after MACH_RISCV64 in the enum, so that condition is always true for loongarch64 events — they'll be misinterpreted. That line needs updating to machine > MACH_LOONGARCH64.

ausyscall missing the disabled-arch message. Every other optional arch (aarch64, riscv32/64) has a #ifndef WITH_ARCH block in tools/ausyscall/ausyscall.c that prints a clear error if someone tries to use it when support isn't compiled in. loongarch64 has nothing, so it silently falls through to a generic "unknown arch" error. Please add the same pattern.

[debianyu]

Thanks for the thorough review, Attila!

I've addressed all three points (amended into the single commit):

1. Missing syscall: added _S(472, "fchroot") to lib/loongarch64_table.h
   (verified against the kernel's scripts/syscall.tbl).

2. auparse/interpret.c bound: changed machine > MACH_RISCV64 to
   machine > MACH_LOONGARCH64.

3. ausyscall disabled-arch message: added the #ifndef WITH_LOONGARCH64
   block following the aarch64/riscv pattern.

Verified locally on x86_64 with both configurations:

• --with-loongarch64: clean build; ausyscall loongarch64 472 → fchroot
  (and the reverse lookup); --dump ends at 472; lookup_test passes
  including the loongarch64 table.
• default (support disabled): clean build; ausyscall loongarch64 1 prints
  "LoongArch64 processor support is not enabled" and exits 1.

The updated branch is force-pushed. I also retitled the commit to
"Add support for LoongArch64 (loongarch64)" to mirror the RISC-V commit,
since the change now touches auparse/ and tools/ as well.

[sergio-correia]

getrlimit and setrlimit are not real syscalls on loongarch64. In the kernel's generic table these slots are opt-in: scripts/syscall.tbl tags 163/164 with the rlimit abi, and arch/loongarch/kernel/Makefile.syscalls selects only memfd_secret on top of the common/64 defaults. RISC-V opted into rlimit (which is why the riscv64 table legitimately has these entries), but LoongArch never did, in any kernel version. Slots 163/164 are sys_ni_syscall holes there. Our own riscv32_table.h already omits them for exactly this reason.

Could you drop these two entries? The table then matches the kernel's loongarch64 set exactly (325 entries).

Suggested change

	_S(163, "getrlimit")
	_S(164, "setrlimit")