[PATCH v2 0/2] linux-user: implement fsmount(2) series of syscalls

[PATCH v2 0/2] linux-user: implement fsmount(2) series of syscalls

[Xinhui Yang]

The motivation of the implementation is to allow any foreign guest OSes
with systemd v259+ to boot using systemd-nspawn(1), otherwise any
systemd service requiring importing credentials will fail, including
journald, D-Bus service and getty. We used to work around this issue by
patching systemd to retry the clone() without CLONE_NEWNS, which is not
and can not be implemented in QEMU user emulation.

mount(8) from util-linux worked prior to this patch because it will
fallback to the old mount(2) syscall if fsmount(8) series of syscalls
is not available.

Tested good on an x86-64 host, with:

- an AOSC OS mips64r6el guest, which boots successfully with full systemd
  support using systemd-nspawn(1).
- a Gentoo ppc (big endian) guest, which boots successfully with full
  systemd support, using systemd-nspawn(1).

Changes from v1:

* Add missing guard for FSCONFIG_CMD_CREATE_EXCL in strace.c, since it is
  only available since 6.6.
* Fix some wording issues in the cover letter.

Xinhui Yang (2):
  linux-user: implement fsmount(2) series of syscalls
  linux-user/strace: add fsmount series of syscalls

 linux-user/strace.c    | 105 +++++++++++++++++++++++++++++++++++++++++
 linux-user/strace.list |  15 ++++++
 linux-user/syscall.c   |  81 +++++++++++++++++++++++++++++++
 3 files changed, 201 insertions(+)

-- 
2.52.0

[PATCH v2 1/2] linux-user: implement fsmount(2) series of syscalls

[Xinhui Yang]

This series of syscalls replaces the old mount(2) syscall with a series
of syscalls that operates around a filesystem context. This series of
syscalls is available since Linux 5.2 and glibc 2.36+.

Their users include systemd since v259 and libmount from util-linux, and
possibly other widely used projects.

Preliminary checks are implemented to ensure the validity of the
interface.

Signed-off-by: Xinhui Yang <cyan@cyano.uk>
---
 linux-user/syscall.c | 81 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 7d7a7b489c..2ff80f4dfa 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -14412,6 +14412,87 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         return do_map_shadow_stack(cpu_env, arg1, arg2, arg3);
 #endif
 
+#if defined(TARGET_NR_fsopen)
+    case TARGET_NR_fsopen:
+        {
+            p = lock_user_string(arg1);
+            if (!p) {
+                return -TARGET_EFAULT;
+            }
+            ret = get_errno(fsopen(p, arg2));
+            unlock_user(p, arg1, 0);
+        }
+        return ret;
+    case TARGET_NR_fsconfig:
+        {
+            /*
+             * fsconfig(int, int, char *, void *, int)
+             * NOTE: p4 is nullable and its type might not be a string.
+             */
+            void *p3, *p4;
+            int cmd = (int) arg2;
+            switch (cmd) {
+            case FSCONFIG_SET_BINARY:
+            case FSCONFIG_SET_STRING:
+            case FSCONFIG_SET_PATH:
+            case FSCONFIG_SET_PATH_EMPTY:
+                p3 = lock_user_string(arg3);
+                if (cmd != FSCONFIG_SET_BINARY) {
+                    /* key and value must be strings. */
+                    p4 = lock_user_string(arg4);
+                } else {
+                    /* Otherise the value must be a raw buffer. */
+                    p4 = lock_user(VERIFY_READ, arg4, arg5, 1);
+                }
+                if (!p3 || !p4) {
+                    return -TARGET_EFAULT;
+                }
+                ret = get_errno(fsconfig(arg1, arg2, p3, p4, arg5));
+                unlock_user(p3, arg3, 0);
+                unlock_user(p4, arg4, 0);
+                break;
+
+            case FSCONFIG_SET_FLAG:
+            case FSCONFIG_SET_FD:
+                /* value must be NULL. */
+                p3 = lock_user_string(arg3);
+                if (!p3 || arg4) {
+                    return -TARGET_EFAULT;
+                }
+                ret = get_errno(fsconfig(arg1, arg2, p3, NULL, arg5));
+                unlock_user(p3, arg3, 0);
+                break;
+            case FSCONFIG_CMD_CREATE:
+            case FSCONFIG_CMD_RECONFIGURE:
+#ifdef FSCONFIG_CMD_CREATE_EXCL
+            /*
+             * FSCONFIG_CMD_CREATE_EXCL is only available since Linux
+             * 6.6. Guarding it to allow building with pre-6.6 headers.
+             */
+            case FSCONFIG_CMD_CREATE_EXCL:
+#endif
+                /* key and value must be NULL, aux must be 0. */
+                if (arg3 || arg4 || arg5) {
+                    return -TARGET_EFAULT;
+                }
+                ret = get_errno(fsconfig(arg1, arg2, NULL, NULL, 0));
+                break;
+            default:
+                return -TARGET_EFAULT;
+            }
+        }
+        return ret;
+    case TARGET_NR_fsmount:
+        ret = get_errno(fsmount(arg1, arg2, arg3));
+        return ret;
+    case TARGET_NR_fspick:
+        {
+            p = lock_user_string(arg2);
+            ret = get_errno(fspick(arg1, p, arg3));
+            unlock_user(p, arg2, 0);
+        }
+        return ret;
+#endif
     default:
         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
         return -TARGET_ENOSYS;
-- 
2.52.0

[PATCH v2 2/2] linux-user/strace: add fsmount series of syscalls

[Xinhui Yang]

Following the addition of fsmount(2) series of syscalls in the syscall
handler, strace support is added, with a dedicated function to print the
parameters of fsconfig(2), which contains parameters that can be
interpreted as multiple types.

Snippet of the strace dump when running `mount -t tmpfs tmpfs /media`:

18 fsopen(tmpfs,1) = 3
18 read(3,0x407fcf1c,8191) = -1 errno=61 (No data available)
18 fsconfig(3,FSCONFIG_SET_STRING,"source","tmpfs",0) = 0
18 read(3,0x407fce3c,8191) = -1 errno=61 (No data available)
18 fsconfig(3,FSCONFIG_CMD_CREATE,NULL,NULL,0) = 0
18 read(3,0x407fce3c,8191) = -1 errno=61 (No data available)
18 fsmount(3,1,0) = 4
18 read(3,0x407fce3c,8191) = -1 errno=61 (No data available)
18 statx(4,"",AT_EMPTY_PATH|AT_STATX_SYNC_AS_STAT,0x1000,0x407fee98) = 0
18 move_mount(4,,-100,/media,4) = 0
18 read(3,0x407fcfcc,8191) = -1 errno=61 (No data available)
18 close(3) = 0
18 close(4) = 0

Signed-off-by: Xinhui Yang <cyan@cyano.uk>
---
 linux-user/strace.c    | 105 +++++++++++++++++++++++++++++++++++++++++
 linux-user/strace.list |  15 ++++++
 2 files changed, 120 insertions(+)

diff --git a/linux-user/strace.c b/linux-user/strace.c
index 2cbaf94c89..d861f311f6 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -4344,6 +4344,111 @@ print_statx(CPUArchState *cpu_env, const struct syscallname *name,
 }
 #endif
 
+#ifdef TARGET_NR_fsconfig
+static void
+print_fsconfig_cmd_name(int cmd)
+{
+    switch (cmd) {
+    case FSCONFIG_SET_FLAG:
+        qemu_log("%s%s", "FSCONFIG_SET_FLAG", get_comma(0));
+        break;
+    case FSCONFIG_SET_STRING:
+        qemu_log("%s%s", "FSCONFIG_SET_STRING", get_comma(0));
+        break;
+    case FSCONFIG_SET_BINARY:
+        qemu_log("%s%s", "FSCONFIG_SET_BINARY", get_comma(0));
+        break;
+    case FSCONFIG_SET_PATH:
+        qemu_log("%s%s", "FSCONFIG_SET_PATH", get_comma(0));
+        break;
+    case FSCONFIG_SET_PATH_EMPTY:
+        qemu_log("%s%s", "FSCONFIG_SET_PATH_EMPTY", get_comma(0));
+        break;
+    case FSCONFIG_SET_FD:
+        qemu_log("%s%s", "FSCONFIG_SET_FD", get_comma(0));
+        break;
+    case FSCONFIG_CMD_CREATE:
+        qemu_log("%s%s", "FSCONFIG_CMD_CREATE", get_comma(0));
+        break;
+    case FSCONFIG_CMD_RECONFIGURE:
+        qemu_log("%s%s", "FSCONFIG_CMD_RECONFIGURE", get_comma(0));
+        break;
+#ifdef FSCONFIG_CMD_CREATE_EXCL
+    case FSCONFIG_CMD_CREATE_EXCL:
+        /* Only available since Linux 6.6. */
+        qemu_log("%s%s", "FSCONFIG_CMD_CREATE_EXCL", get_comma(0));
+        break;
+#endif
+    default:
+        qemu_log("%s (%d)%s", "UNKNOWN_CMD", cmd, get_comma(0));
+        break;
+    }
+}
+
+static void
+print_fsconfig(CPUArchState *cpu_env, const struct syscallname *name,
+            abi_long arg0, abi_long arg1, abi_long arg2,
+            abi_long arg3, abi_long arg4, abi_long arg5)
+{
+    /*
+     * fsconfig(int fd, int cmd, char* key, void* value, int aux)
+     * Where:
+     * fd: file descriptor returned by fsopen().
+     * cmd: integer constant specifying a command.
+     * key: a string, can be NULL on certain commands.
+     * value: any data in a buffer, can be NULL, raw buffer or a string.
+     * aux: axillary values such as flags for FSCONFIG_SET_PATH.
+     */
+    int cmd = (int) arg1;
+    print_syscall_prologue(name);
+    print_raw_param("%d", arg0, 0);
+    print_fsconfig_cmd_name(cmd);
+    /* Process arg2 (key). */
+    switch (cmd) {
+    case FSCONFIG_SET_FLAG:
+    case FSCONFIG_SET_STRING:
+    case FSCONFIG_SET_BINARY:
+    case FSCONFIG_SET_PATH:
+    case FSCONFIG_SET_PATH_EMPTY:
+    case FSCONFIG_SET_FD:
+        print_string(arg2, 0);
+        break;
+    default:
+        print_pointer(arg2, 0);
+        break;
+    }
+    /* Process arg3 (value). */
+    switch (cmd) {
+    case FSCONFIG_SET_STRING:
+    case FSCONFIG_SET_PATH:
+    case FSCONFIG_SET_PATH_EMPTY:
+        print_string(arg3, 0);
+        break;
+    default:
+        print_pointer(arg3, 0);
+        break;
+    }
+    /*
+     * Process arg4 (aux).
+     * On FSCONFIG_SET_PATH and FSCONFIG_SET_PATH_EMPTY, aux can
+     * be either 0 or AT_FDCWD.
+     * On FSCONFIG_SET_BINARY, aux is an integer to state the length
+     * of the buffer pointed by arg3.
+     * Otherwise, it must be 0.
+     */
+    switch (cmd) {
+    case FSCONFIG_SET_PATH:
+    case FSCONFIG_SET_PATH_EMPTY:
+        print_at_dirfd(arg4, 1);
+        break;
+    default:
+        print_raw_param("%d", arg4, 1);
+        break;
+    }
+    print_syscall_epilogue(name);
+}
+#endif
+
 #ifdef TARGET_NR_ioctl
 static void
 print_ioctl(CPUArchState *cpu_env, const struct syscallname *name,
diff --git a/linux-user/strace.list b/linux-user/strace.list
index 6162a407f9..3a366b8cac 100644
--- a/linux-user/strace.list
+++ b/linux-user/strace.list
@@ -1722,3 +1722,18 @@
 #ifdef TARGET_NR_rseq
 { TARGET_NR_rseq, "rseq" , "%s(%p,%u,%d,%#x)", NULL, NULL },
 #endif
+#ifdef TARGET_NR_fsopen
+{ TARGET_NR_fsopen, "fsopen", "%s(%s,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fsconfig
+{ TARGET_NR_fsconfig, "fsconfig", NULL, print_fsconfig, NULL },
+#endif
+#ifdef TARGET_NR_fsmount
+{ TARGET_NR_fsmount, "fsmount", "%s(%d,%d,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_move_mount
+{ TARGET_NR_move_mount, "move_mount", "%s(%d,%s,%d,%s,%d)", NULL, NULL },
+#endif
+#ifdef TARGET_NR_fspick
+{ TARGET_NR_fspick, "fspick", "%s(%d,%s,%d)", NULL, NULL },
+#endif
-- 
2.52.0

Re: [PATCH v2 1/2] linux-user: implement fsmount(2) series of syscalls

[Pierrick Bouvier]

On 5/27/2026 3:11 AM, Xinhui Yang wrote:
> This series of syscalls replaces the old mount(2) syscall with a series
> of syscalls that operates around a filesystem context. This series of
> syscalls is available since Linux 5.2 and glibc 2.36+.
> 
> Their users include systemd since v259 and libmount from util-linux, and
> possibly other widely used projects.
> 
> Preliminary checks are implemented to ensure the validity of the
> interface.
> 
> Signed-off-by: Xinhui Yang <cyan@cyano.uk>
> ---
>  linux-user/syscall.c | 81 ++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 81 insertions(+)
> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 7d7a7b489c..2ff80f4dfa 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -14412,6 +14412,87 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
>          return do_map_shadow_stack(cpu_env, arg1, arg2, arg3);
>  #endif
>  
> +#if defined(TARGET_NR_fsopen)
> +    case TARGET_NR_fsopen:
> +        {
> +            p = lock_user_string(arg1);
> +            if (!p) {
> +                return -TARGET_EFAULT;
> +            }
> +            ret = get_errno(fsopen(p, arg2));
> +            unlock_user(p, arg1, 0);
> +        }
> +        return ret;
> +    case TARGET_NR_fsconfig:
> +        {
> +            /*
> +             * fsconfig(int, int, char *, void *, int)
> +             * NOTE: p4 is nullable and its type might not be a string.
> +             */
> +            void *p3, *p4;
> +            int cmd = (int) arg2;
> +            switch (cmd) {
> +            case FSCONFIG_SET_BINARY:
> +            case FSCONFIG_SET_STRING:
> +            case FSCONFIG_SET_PATH:
> +            case FSCONFIG_SET_PATH_EMPTY:
> +                p3 = lock_user_string(arg3);
> +                if (cmd != FSCONFIG_SET_BINARY) {
> +                    /* key and value must be strings. */
> +                    p4 = lock_user_string(arg4);
> +                } else {
> +                    /* Otherise the value must be a raw buffer. */
> +                    p4 = lock_user(VERIFY_READ, arg4, arg5, 1);
> +                }
> +                if (!p3 || !p4) {
> +                    return -TARGET_EFAULT;
> +                }

Might leave with locked p3 is p4 fails.
You can add another early return just after p3 and unlock p3 in this if.

> +                ret = get_errno(fsconfig(arg1, arg2, p3, p4, arg5));
> +                unlock_user(p3, arg3, 0);
> +                unlock_user(p4, arg4, 0);
> +                break;
> +
> +            case FSCONFIG_SET_FLAG:
> +            case FSCONFIG_SET_FD:
> +                /* value must be NULL. */
> +                p3 = lock_user_string(arg3);
> +                if (!p3 || arg4) {
> +                    return -TARGET_EFAULT;
> +                }
> +                ret = get_errno(fsconfig(arg1, arg2, p3, NULL, arg5));

Similar to above (if arg4) { unlock... }

> +                unlock_user(p3, arg3, 0);
> +                break;
> +            case FSCONFIG_CMD_CREATE:
> +            case FSCONFIG_CMD_RECONFIGURE:
> +#ifdef FSCONFIG_CMD_CREATE_EXCL
> +            /*
> +             * FSCONFIG_CMD_CREATE_EXCL is only available since Linux
> +             * 6.6. Guarding it to allow building with pre-6.6 headers.
> +             */
> +            case FSCONFIG_CMD_CREATE_EXCL:
> +#endif
> +                /* key and value must be NULL, aux must be 0. */
> +                if (arg3 || arg4 || arg5) {
> +                    return -TARGET_EFAULT;
> +                }
> +                ret = get_errno(fsconfig(arg1, arg2, NULL, NULL, 0));
> +                break;
> +            default:
> +                return -TARGET_EFAULT;
> +            }
> +        }
> +        return ret;
> +    case TARGET_NR_fsmount:
> +        ret = get_errno(fsmount(arg1, arg2, arg3));
> +        return ret;
> +    case TARGET_NR_fspick:
> +        {
> +            p = lock_user_string(arg2);
> +            ret = get_errno(fspick(arg1, p, arg3));
> +            unlock_user(p, arg2, 0);
> +        }
> +        return ret;
> +#endif
>      default:
>          qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
>          return -TARGET_ENOSYS;

Re: [PATCH v2 2/2] linux-user/strace: add fsmount series of syscalls

[Pierrick Bouvier]

On 5/27/2026 3:11 AM, Xinhui Yang wrote:
> Following the addition of fsmount(2) series of syscalls in the syscall
> handler, strace support is added, with a dedicated function to print the
> parameters of fsconfig(2), which contains parameters that can be
> interpreted as multiple types.
> 
> Snippet of the strace dump when running `mount -t tmpfs tmpfs /media`:
> 
> 18 fsopen(tmpfs,1) = 3
> 18 read(3,0x407fcf1c,8191) = -1 errno=61 (No data available)
> 18 fsconfig(3,FSCONFIG_SET_STRING,"source","tmpfs",0) = 0
> 18 read(3,0x407fce3c,8191) = -1 errno=61 (No data available)
> 18 fsconfig(3,FSCONFIG_CMD_CREATE,NULL,NULL,0) = 0
> 18 read(3,0x407fce3c,8191) = -1 errno=61 (No data available)
> 18 fsmount(3,1,0) = 4
> 18 read(3,0x407fce3c,8191) = -1 errno=61 (No data available)
> 18 statx(4,"",AT_EMPTY_PATH|AT_STATX_SYNC_AS_STAT,0x1000,0x407fee98) = 0
> 18 move_mount(4,,-100,/media,4) = 0
> 18 read(3,0x407fcfcc,8191) = -1 errno=61 (No data available)
> 18 close(3) = 0
> 18 close(4) = 0
> 
> Signed-off-by: Xinhui Yang <cyan@cyano.uk>
> ---
>  linux-user/strace.c    | 105 +++++++++++++++++++++++++++++++++++++++++
>  linux-user/strace.list |  15 ++++++
>  2 files changed, 120 insertions(+)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Re: [PATCH v2 1/2] linux-user: implement fsmount(2) series of syscalls

[Xinhui Yang]

Hi,

在 2026/5/29 03:07, Pierrick Bouvier 写道:
> On 5/27/2026 3:11 AM, Xinhui Yang wrote:
>> This series of syscalls replaces the old mount(2) syscall with a series
>> of syscalls that operates around a filesystem context. This series of
>> syscalls is available since Linux 5.2 and glibc 2.36+.
>>
>> Their users include systemd since v259 and libmount from util-linux, and
>> possibly other widely used projects.
>>
>> Preliminary checks are implemented to ensure the validity of the
>> interface.
>>
>> Signed-off-by: Xinhui Yang <cyan@cyano.uk>
>> ---
>>   linux-user/syscall.c | 81 ++++++++++++++++++++++++++++++++++++++++++++
>>   1 file changed, 81 insertions(+)
>>
>> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
>> index 7d7a7b489c..2ff80f4dfa 100644
>> --- a/linux-user/syscall.c
>> +++ b/linux-user/syscall.c
>> @@ -14412,6 +14412,87 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
>>           return do_map_shadow_stack(cpu_env, arg1, arg2, arg3);
>>   #endif
>>   
>> +#if defined(TARGET_NR_fsopen)
>> +    case TARGET_NR_fsopen:
>> +        {
>> +            p = lock_user_string(arg1);
>> +            if (!p) {
>> +                return -TARGET_EFAULT;
>> +            }
>> +            ret = get_errno(fsopen(p, arg2));
>> +            unlock_user(p, arg1, 0);
>> +        }
>> +        return ret;
>> +    case TARGET_NR_fsconfig:
>> +        {
>> +            /*
>> +             * fsconfig(int, int, char *, void *, int)
>> +             * NOTE: p4 is nullable and its type might not be a string.
>> +             */
>> +            void *p3, *p4;
>> +            int cmd = (int) arg2;
>> +            switch (cmd) {
>> +            case FSCONFIG_SET_BINARY:
>> +            case FSCONFIG_SET_STRING:
>> +            case FSCONFIG_SET_PATH:
>> +            case FSCONFIG_SET_PATH_EMPTY:
>> +                p3 = lock_user_string(arg3);
>> +                if (cmd != FSCONFIG_SET_BINARY) {
>> +                    /* key and value must be strings. */
>> +                    p4 = lock_user_string(arg4);
>> +                } else {
>> +                    /* Otherise the value must be a raw buffer. */
>> +                    p4 = lock_user(VERIFY_READ, arg4, arg5, 1);
>> +                }
>> +                if (!p3 || !p4) {
>> +                    return -TARGET_EFAULT;
>> +                }
> 
> Might leave with locked p3 is p4 fails.
> You can add another early return just after p3 and unlock p3 in this if.
> 

Thanks! Sending v3.

>> +                ret = get_errno(fsconfig(arg1, arg2, p3, p4, arg5));
>> +                unlock_user(p3, arg3, 0);
>> +                unlock_user(p4, arg4, 0);
>> +                break;
>> +
>> +            case FSCONFIG_SET_FLAG:
>> +            case FSCONFIG_SET_FD:
>> +                /* value must be NULL. */
>> +                p3 = lock_user_string(arg3);
>> +                if (!p3 || arg4) {
>> +                    return -TARGET_EFAULT;
>> +                }
>> +                ret = get_errno(fsconfig(arg1, arg2, p3, NULL, arg5));
> 
> Similar to above (if arg4) { unlock... }
> 
>> +                unlock_user(p3, arg3, 0);
>> +                break;
>> +            case FSCONFIG_CMD_CREATE:
>> +            case FSCONFIG_CMD_RECONFIGURE:
>> +#ifdef FSCONFIG_CMD_CREATE_EXCL
>> +            /*
>> +             * FSCONFIG_CMD_CREATE_EXCL is only available since Linux
>> +             * 6.6. Guarding it to allow building with pre-6.6 headers.
>> +             */
>> +            case FSCONFIG_CMD_CREATE_EXCL:
>> +#endif
>> +                /* key and value must be NULL, aux must be 0. */
>> +                if (arg3 || arg4 || arg5) {
>> +                    return -TARGET_EFAULT;
>> +                }
>> +                ret = get_errno(fsconfig(arg1, arg2, NULL, NULL, 0));
>> +                break;
>> +            default:
>> +                return -TARGET_EFAULT;
>> +            }
>> +        }
>> +        return ret;
>> +    case TARGET_NR_fsmount:
>> +        ret = get_errno(fsmount(arg1, arg2, arg3));
>> +        return ret;
>> +    case TARGET_NR_fspick:
>> +        {
>> +            p = lock_user_string(arg2);
>> +            ret = get_errno(fspick(arg1, p, arg3));
>> +            unlock_user(p, arg2, 0);
>> +        }
>> +        return ret;
>> +#endif
>>       default:
>>           qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
>>           return -TARGET_ENOSYS;
> 

Xinhui