[PULL 0/7] Linux user patches

[PULL 0/7] Linux user patches

[Helge Deller]

From: Helge Deller <deller@gmx.de>

The following changes since commit 3e3ccab106f879b1512f8e0d51a827dd4de30e22:

  Update version for v11.1.0-rc3 release (2026-08-04 15:36:08 -0400)

are available in the Git repository at:

  https://github.com/hdeller/qemu-hppa.git tags/linux-user-pull-request

for you to fetch changes up to ce276ab1a92cad460930fada1bc2e2e4a96f7595:

  linux-user/sh4: write the floating-point registers to a core dump (2026-08-07 18:14:13 +0200)

----------------------------------------------------------------
linux-user patches

Patches from Mat Turner to support the mount_setattr() syscall and to add
floating-point registers to core dumps on alpha, mips, hppa, riscv and sh4.

----------------------------------------------------------------

Matt Turner (7):
  linux-user: implement mount_setattr(2)
  linux-user: support writing floating-point registers to a core dump
  linux-user/alpha: write the floating-point registers to a core dump
  linux-user/mips: write the floating-point registers to a core dump
  linux-user/hppa: write the floating-point registers to a core dump
  linux-user/riscv: write the floating-point registers to a core dump
  linux-user/sh4: write the floating-point registers to a core dump

 linux-user/alpha/elfload.c     | 10 ++++++++
 linux-user/alpha/target_elf.h  | 11 +++++++++
 linux-user/elfload.c           | 19 +++++++++++++++
 linux-user/hppa/elfload.c      |  7 ++++++
 linux-user/hppa/target_elf.h   |  9 +++++++
 linux-user/loader.h            |  3 +++
 linux-user/mips/elfload.c      |  8 +++++++
 linux-user/mips/target_elf.h   | 13 ++++++++++
 linux-user/mips64/target_elf.h | 13 ++++++++++
 linux-user/riscv/elfload.c     |  9 +++++++
 linux-user/riscv/target_elf.h  | 11 +++++++++
 linux-user/sh4/elfload.c       | 10 ++++++++
 linux-user/sh4/target_elf.h    | 12 ++++++++++
 linux-user/strace.list         |  3 +++
 linux-user/syscall.c           | 44 ++++++++++++++++++++++++++++++++++
 linux-user/syscall_defs.h      | 13 ++++++++++
 16 files changed, 195 insertions(+)

-- 
2.54.0

[PULL 1/7] linux-user: implement mount_setattr(2)

[Helge Deller]

From: Matt Turner <mattst88@gmail.com>

mount_setattr() was in the syscall tables but had no implementation, so
guests always got -ENOSYS. systemd uses it when setting up per-unit
credential mounts, which fails the affected units with EXIT_CREDENTIALS.

struct mount_attr is an extensible struct like open_how, so handle it the
same way openat2() does: reject sizes smaller than the ver0 struct and
require any unknown trailing bytes to be zero. All of its fields are
64-bit, and the MOUNT_ATTR_* and MS_* propagation values are identical on
every target, so only the byte order needs fixing up.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/strace.list    |  3 +++
 linux-user/syscall.c      | 44 +++++++++++++++++++++++++++++++++++++++
 linux-user/syscall_defs.h | 13 ++++++++++++
 3 files changed, 60 insertions(+)

diff --git a/linux-user/strace.list b/linux-user/strace.list
index 25ace05187..e952f15d20 100644
--- a/linux-user/strace.list
+++ b/linux-user/strace.list
@@ -1737,3 +1737,6 @@
 #ifdef TARGET_NR_fspick
 { TARGET_NR_fspick, "fspick", "%s(%d,%s,%d)", NULL, NULL },
 #endif
+#ifdef TARGET_NR_mount_setattr
+{ TARGET_NR_mount_setattr, "mount_setattr", "%s(%d,%s,%d,%p,%d)", NULL, NULL },
+#endif
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index dc028686f4..cfa68dfbdb 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -9735,6 +9735,13 @@ _syscall5(int, sys_move_mount, int, __from_dfd, const char *, __from_pathname,
            int, __to_dfd, const char *, __to_pathname, unsigned int, flag)
 #endif
 
+#if defined(TARGET_NR_mount_setattr) && defined(__NR_mount_setattr)
+#define __NR_sys_mount_setattr __NR_mount_setattr
+_syscall5(int, sys_mount_setattr, int, dfd, const char *, path,
+          unsigned int, flags, struct mount_attr_ver0 *, uattr,
+          size_t, usize)
+#endif
+
 #if defined(TARGET_NR_fsopen) && defined(__NR_fsopen)
 #define __NR_sys_fsopen __NR_fsopen
 _syscall2(int, sys_fsopen, const char *, fs_name, unsigned int, flags);
@@ -14480,6 +14487,43 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         return do_map_shadow_stack(cpu_env, arg1, arg2, arg3);
 #endif
 
+#if defined(TARGET_NR_mount_setattr) && defined(__NR_mount_setattr)
+    case TARGET_NR_mount_setattr:
+        {
+            struct mount_attr_ver0 attr = {};
+            abi_ulong usize = arg5;
+
+            if (usize < sizeof(struct target_mount_attr_ver0)) {
+                return -TARGET_EINVAL;
+            }
+            ret = copy_struct_from_user(&attr, sizeof(attr), arg4, usize);
+            if (ret) {
+                if (ret == -TARGET_E2BIG) {
+                    qemu_log_mask(LOG_UNIMP,
+                                  "Unimplemented mount_setattr mount_attr "
+                                  "size: " TARGET_ABI_FMT_lu "\n", usize);
+                }
+                return ret;
+            }
+            /*
+             * MOUNT_ATTR_* and the MS_* propagation flags have the same
+             * values on all targets, so only byte order needs fixing up.
+             */
+            attr.attr_set = tswap64(attr.attr_set);
+            attr.attr_clr = tswap64(attr.attr_clr);
+            attr.propagation = tswap64(attr.propagation);
+            attr.userns_fd = tswap64(attr.userns_fd);
+
+            p = lock_user_string(arg2);
+            if (!p) {
+                return -TARGET_EFAULT;
+            }
+            ret = get_errno(sys_mount_setattr(arg1, p, arg3, &attr,
+                                              sizeof(attr)));
+            unlock_user(p, arg2, 0);
+        }
+        return ret;
+#endif
 #if defined(TARGET_NR_fsopen) && defined(__NR_fsopen)
     case TARGET_NR_fsopen:
         {
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index e033c7db34..e28853c93b 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -2770,6 +2770,19 @@ struct target_open_how_ver0 {
     abi_ullong mode;
     abi_ullong resolve;
 };
+/* from kernel's include/uapi/linux/mount.h */
+struct mount_attr_ver0 {
+    uint64_t attr_set;
+    uint64_t attr_clr;
+    uint64_t propagation;
+    uint64_t userns_fd;
+};
+struct target_mount_attr_ver0 {
+    abi_ullong attr_set;
+    abi_ullong attr_clr;
+    abi_ullong propagation;
+    abi_ullong userns_fd;
+};
 #ifndef RESOLVE_NO_MAGICLINKS
 #define RESOLVE_NO_MAGICLINKS   0x02
 #endif
-- 
2.54.0

[PULL 2/7] linux-user: support writing floating-point registers to a core dump

[Helge Deller]

From: Matt Turner <mattst88@gmail.com>

Write an NT_FPREGSET note for targets that opt in: a target_elf.h that
defines HAVE_ELF_CORE_FPREGS and target_elf_fpregset_t, and supplies an
elf_core_copy_fpregs() beside the existing elf_core_copy_regs().

Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/elfload.c | 19 +++++++++++++++++++
 linux-user/loader.h  |  3 +++
 2 files changed, 22 insertions(+)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index e7c56af8ed..88508deac5 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1887,6 +1887,17 @@ static void fill_elf_note_phdr(struct elf_phdr *phdr, size_t sz, off_t offset)
     bswap_phdr(phdr, 1);
 }
 
+#ifdef HAVE_ELF_CORE_FPREGS
+static void fill_fpregset_note(void *data, CPUState *cpu)
+{
+    /* Fill locally and copy: note memory is only aligned to 4. */
+    target_elf_fpregset_t fpregs = {};
+
+    elf_core_copy_fpregs(&fpregs, cpu_env(cpu));
+    memcpy(data, &fpregs, sizeof(fpregs));
+}
+#endif
+
 static void fill_prstatus_note(void *data, CPUState *cpu, int signr)
 {
     /*
@@ -2166,6 +2177,9 @@ static int elf_core_dump(int signr, const CPUArchState *env)
     offset += size_note("CORE", ts->info->auxv_len);
     offset += size_note("CORE", sizeof(struct target_elf_prpsinfo));
     offset += size_note("CORE", sizeof(struct target_elf_prstatus)) * cpus;
+#ifdef HAVE_ELF_CORE_FPREGS
+    offset += size_note("CORE", sizeof(target_elf_fpregset_t)) * cpus;
+#endif
     note_size = offset - note_offset;
     data_offset = TARGET_PAGE_ALIGN(offset);
 
@@ -2222,6 +2236,11 @@ static int elf_core_dump(int signr, const CPUArchState *env)
             dptr = fill_note(&hptr, NT_PRSTATUS, "CORE",
                              sizeof(struct target_elf_prstatus));
             fill_prstatus_note(dptr, cpu_iter, cpu_iter == cpu ? signr : 0);
+#ifdef HAVE_ELF_CORE_FPREGS
+            dptr = fill_note(&hptr, NT_FPREGSET, "CORE",
+                             sizeof(target_elf_fpregset_t));
+            fill_fpregset_note(dptr, cpu_iter);
+#endif
         }
 
         if (dump_write(fd, header, data_offset) < 0) {
diff --git a/linux-user/loader.h b/linux-user/loader.h
index da9ad28db5..5ddd140276 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -109,6 +109,9 @@ bool init_guest_commpage(void);
 
 struct target_elf_gregset_t;
 void elf_core_copy_regs(struct target_elf_gregset_t *, const CPUArchState *);
+/* Only defined by a target whose target_elf.h sets HAVE_ELF_CORE_FPREGS. */
+struct target_elf_fpregset_t;
+void elf_core_copy_fpregs(struct target_elf_fpregset_t *, const CPUArchState *);
 
 typedef struct {
     const uint8_t *image;
-- 
2.54.0

[PULL 3/7] linux-user/alpha: write the floating-point registers to a core dump

[Helge Deller]

From: Matt Turner <mattst88@gmail.com>

A guest core carried only the general-purpose registers, so a debugger
opening one reported every floating-point register as unavailable --
including the arguments of the function that crashed.

Implement HAVE_ELF_CORE_FPREGS for Alpha: define target_elf_fpregset_t
to match the kernel's layout ($f0-$f30 plus the control register in the
slot $f31 would occupy) and fill it from elf_core_copy_fpregs().

Checked with lldb on a core from a program that faults with live values
in $f16 and $f17: both read back correctly, as does the control register.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/alpha/elfload.c    | 10 ++++++++++
 linux-user/alpha/target_elf.h | 11 +++++++++++
 2 files changed, 21 insertions(+)

diff --git a/linux-user/alpha/elfload.c b/linux-user/alpha/elfload.c
index 7be9e466b6..c2517516ad 100644
--- a/linux-user/alpha/elfload.c
+++ b/linux-user/alpha/elfload.c
@@ -32,3 +32,13 @@ const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "ev67";
 }
+
+void elf_core_copy_fpregs(target_elf_fpregset_t *r, const CPUAlphaState *env)
+{
+    int i;
+
+    for (i = 0; i < 31; i++) {
+        r->fpr[i] = tswap64(env->fir[i]);
+    }
+    r->fpcr = tswap64(cpu_alpha_load_fpcr((CPUAlphaState *)env));
+}
diff --git a/linux-user/alpha/target_elf.h b/linux-user/alpha/target_elf.h
index dd90c6f783..5efe7f3174 100644
--- a/linux-user/alpha/target_elf.h
+++ b/linux-user/alpha/target_elf.h
@@ -19,6 +19,17 @@
  *   r0-r30 at indices 0-30, pc at 31, ps at 32.
  * r31 (hardwired zero) is not stored; pc occupies index 31.
  */
+/*
+ * The floating-point note holds $f0 through $f30 and then the control
+ * register in the slot $f31 would occupy; $f31 reads as zero.
+ */
+#define HAVE_ELF_CORE_FPREGS    1
+
+typedef struct target_elf_fpregset_t {
+    uint64_t fpr[31];    /* $f0-$f30 */
+    uint64_t fpcr;       /* the slot for $f31 */
+} target_elf_fpregset_t;
+
 typedef struct target_elf_gregset_t {
     abi_ulong regs[31];  /* integer registers r0-r30  [0..30] */
     abi_ulong pc;        /* program counter           [31]    */
-- 
2.54.0

[PULL 4/7] linux-user/mips: write the floating-point registers to a core dump

[Helge Deller]

From: Matt Turner <mattst88@gmail.com>

Write an NT_FPREGSET note for MIPS and MIPS64, matching the kernel's
elf_fpregset_t layout (ELF_NFPREG = 33): fpr[0..31] hold f0-f31, and
fcsr occupies the low 32 bits of slot 32.  The pad field rounds the
struct to 33 × 8 bytes = 264 bytes.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/mips/elfload.c      |  8 ++++++++
 linux-user/mips/target_elf.h   | 13 +++++++++++++
 linux-user/mips64/target_elf.h | 13 +++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c
index ce2c4514f3..1d62ae0a4d 100644
--- a/linux-user/mips/elfload.c
+++ b/linux-user/mips/elfload.c
@@ -130,6 +130,14 @@ const char *get_elf_base_platform(CPUState *cs)
 
 #undef MATCH_PLATFORM_INSN
 
+void elf_core_copy_fpregs(target_elf_fpregset_t *r, const CPUMIPSState *env)
+{
+    for (int i = 0; i < 32; i++) {
+        r->fpr[i] = tswap64(env->active_fpu.fpr[i].d);
+    }
+    r->fcsr = tswap32(env->active_fpu.fcr31);
+}
+
 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
 #ifndef TARGET_MIPS64
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env)
diff --git a/linux-user/mips/target_elf.h b/linux-user/mips/target_elf.h
index 157306f7a0..426f905d3a 100644
--- a/linux-user/mips/target_elf.h
+++ b/linux-user/mips/target_elf.h
@@ -26,4 +26,17 @@ typedef struct target_elf_gregset_t {
     };
 } target_elf_gregset_t;
 
+#define HAVE_ELF_CORE_FPREGS    1
+
+/*
+ * Matches the kernel's elf_fpregset_t (ELF_NFPREG = 33):
+ *   fpr[0..31] hold f0-f31; fcsr occupies the low 32 bits of slot 32.
+ *   pad rounds the struct to 33 × 8 bytes = 264 bytes.
+ */
+typedef struct target_elf_fpregset_t {
+    uint64_t fpr[32];
+    uint32_t fcsr;
+    uint32_t pad;
+} target_elf_fpregset_t;
+
 #endif
diff --git a/linux-user/mips64/target_elf.h b/linux-user/mips64/target_elf.h
index 061471a0f1..efb5d97563 100644
--- a/linux-user/mips64/target_elf.h
+++ b/linux-user/mips64/target_elf.h
@@ -32,4 +32,17 @@ typedef struct target_elf_gregset_t {
     };
 } target_elf_gregset_t;
 
+#define HAVE_ELF_CORE_FPREGS    1
+
+/*
+ * Matches the kernel's elf_fpregset_t (ELF_NFPREG = 33):
+ *   fpr[0..31] hold f0-f31; fcsr occupies the low 32 bits of slot 32.
+ *   pad rounds the struct to 33 × 8 bytes = 264 bytes.
+ */
+typedef struct target_elf_fpregset_t {
+    uint64_t fpr[32];
+    uint32_t fcsr;
+    uint32_t pad;
+} target_elf_fpregset_t;
+
 #endif
-- 
2.54.0

[PULL 5/7] linux-user/hppa: write the floating-point registers to a core dump

[Helge Deller]

From: Matt Turner <mattst88@gmail.com>

Write an NT_FPREGSET note for HPPA, matching the kernel's
elf_fpregset_t layout (ELF_NFPREG = 32): fr0-fr31 as 64-bit values.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/hppa/elfload.c    | 7 +++++++
 linux-user/hppa/target_elf.h | 9 +++++++++
 2 files changed, 16 insertions(+)

diff --git a/linux-user/hppa/elfload.c b/linux-user/hppa/elfload.c
index ff4301b2ed..dd5b0b380e 100644
--- a/linux-user/hppa/elfload.c
+++ b/linux-user/hppa/elfload.c
@@ -17,6 +17,13 @@ const char *get_elf_platform(CPUState *cs)
     return "PARISC";
 }
 
+void elf_core_copy_fpregs(target_elf_fpregset_t *r, const CPUArchState *env)
+{
+    for (int i = 0; i < 32; i++) {
+        r->fpr[i] = tswap64(env->fr[i]);
+    }
+}
+
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUArchState *env)
 {
     int i;
diff --git a/linux-user/hppa/target_elf.h b/linux-user/hppa/target_elf.h
index 22547b1437..4357873aff 100644
--- a/linux-user/hppa/target_elf.h
+++ b/linux-user/hppa/target_elf.h
@@ -39,4 +39,13 @@ typedef struct target_elf_gregset_t {
 #define STACK_ALIGNMENT         64
 #define VDSO_HEADER             "vdso.c.inc"
 
+#define HAVE_ELF_CORE_FPREGS    1
+
+/*
+ * Matches the kernel's elf_fpregset_t (ELF_NFPREG = 32): fr0-fr31.
+ */
+typedef struct target_elf_fpregset_t {
+    uint64_t fpr[32];
+} target_elf_fpregset_t;
+
 #endif
-- 
2.54.0

[PULL 6/7] linux-user/riscv: write the floating-point registers to a core dump

[Helge Deller]

From: Matt Turner <mattst88@gmail.com>

Write an NT_FPREGSET note for RISC-V, matching struct __riscv_d_ext_state
from uapi/asm/ptrace.h: f0-f31 as 64-bit values followed by fcsr.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/riscv/elfload.c    |  9 +++++++++
 linux-user/riscv/target_elf.h | 11 +++++++++++
 2 files changed, 20 insertions(+)

diff --git a/linux-user/riscv/elfload.c b/linux-user/riscv/elfload.c
index afe103a631..1bc8beacb1 100644
--- a/linux-user/riscv/elfload.c
+++ b/linux-user/riscv/elfload.c
@@ -11,6 +11,15 @@ const char *get_elf_cpu_model(uint32_t eflags)
     return "max";
 }
 
+void elf_core_copy_fpregs(target_elf_fpregset_t *r, const CPURISCVState *env)
+{
+    for (int i = 0; i < 32; i++) {
+        r->fpr[i] = tswap64(env->fpr[i]);
+    }
+    r->fcsr = tswap32(((uint32_t)env->frm << FSR_RD_SHIFT) |
+                      (riscv_cpu_get_fflags((CPURISCVState *)env) << FSR_AEXC_SHIFT));
+}
+
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPURISCVState *env)
 {
     r->pc = tswapal(env->pc);
diff --git a/linux-user/riscv/target_elf.h b/linux-user/riscv/target_elf.h
index 859f726578..185b81a2db 100644
--- a/linux-user/riscv/target_elf.h
+++ b/linux-user/riscv/target_elf.h
@@ -27,4 +27,15 @@ typedef struct target_elf_gregset_t {
     abi_ulong regs[31];
 } target_elf_gregset_t;
 
+#define HAVE_ELF_CORE_FPREGS    1
+
+/*
+ * Matches struct __riscv_d_ext_state from uapi/asm/ptrace.h:
+ *   f0-f31 as 64-bit values followed by fcsr.
+ */
+typedef struct target_elf_fpregset_t {
+    uint64_t fpr[32];
+    uint32_t fcsr;
+} target_elf_fpregset_t;
+
 #endif
-- 
2.54.0

[PULL 7/7] linux-user/sh4: write the floating-point registers to a core dump

[Helge Deller]

From: Matt Turner <mattst88@gmail.com>

Write an NT_FPREGSET note for SH4, matching struct user_fpu_struct
from arch/sh/include/asm/user.h: fr0-fr15, xf0-xf15, fpscr, fpul.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/sh4/elfload.c    | 10 ++++++++++
 linux-user/sh4/target_elf.h | 12 ++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/linux-user/sh4/elfload.c b/linux-user/sh4/elfload.c
index f03ce49e7d..41601626ca 100644
--- a/linux-user/sh4/elfload.c
+++ b/linux-user/sh4/elfload.c
@@ -52,6 +52,16 @@ abi_ulong get_elf_hwcap(CPUState *cs)
     return hwcap;
 }
 
+void elf_core_copy_fpregs(target_elf_fpregset_t *r, const CPUSH4State *env)
+{
+    for (int i = 0; i < 16; i++) {
+        r->fpregs[i] = tswap32(env->fregs[i]);
+        r->xfpregs[i] = tswap32(env->fregs[16 + i]);
+    }
+    r->fpscr = tswap32(env->fpscr);
+    r->fpul = tswap32(env->fpul);
+}
+
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUSH4State *env)
 {
     for (int i = 0; i < 16; i++) {
diff --git a/linux-user/sh4/target_elf.h b/linux-user/sh4/target_elf.h
index 3fcb63d409..5923022036 100644
--- a/linux-user/sh4/target_elf.h
+++ b/linux-user/sh4/target_elf.h
@@ -25,4 +25,16 @@ typedef struct target_elf_gregset_t {
     struct target_pt_regs pt;
 } target_elf_gregset_t;
 
+#define HAVE_ELF_CORE_FPREGS    1
+
+/*
+ * Matches struct user_fpu_struct from arch/sh/include/asm/user.h.
+ */
+typedef struct target_elf_fpregset_t {
+    uint32_t fpregs[16];
+    uint32_t xfpregs[16];
+    uint32_t fpscr;
+    uint32_t fpul;
+} target_elf_fpregset_t;
+
 #endif
-- 
2.54.0