kernel/git/stable/linux.git/fs/Kconfig.binfmt, branch master

binfmt_misc: add binfmt_misc_ops bpf struct_ops

2026-08-03T08:08:41+00:00

Add the bpf plumbing for binary type handlers whose matching and interpreter selection are implemented by bpf programs instead of a fixed magic/extension and a fixed interpreter string recorded at registration time. This serves relocatable binary formats where the interpreter must be computed per binary, e.g. relative to the location of the binary itself, as discussed for hermetic Nix-style executables. A handler is an instance of the new binfmt_misc_ops struct_ops with a name that binfmt_misc entries reference it by and two ops: bool (*match)(struct linux_binprm *bprm); int (*load)(struct linux_binprm *bprm); struct_ops is the sanctioned mechanism for this kind of user-supplied policy callback: program types, attach types, and the uapi helper list are frozen, and every recently added subsystem hook (bpf qdisc, SMC handshake control, io_uring loop ops, sched_ext) is a struct_ops user. The ops receive the bprm as a trusted BTF pointer, so a program can match on the header in bprm->buf, read arbitrary file content via bpf_dynptr_from_file() to parse e.g. ELF program headers, and inspect the binary's location. No dedicated program type, ctx blob, or uapi helper is needed. The two ops split along what they decide, not what they may do: the match program decides whether the handler applies to a binary, the load program decides how a matched binary is run. Both are required to be sleepable. Matching cannot be limited to the prefetched 256 bytes in bprm->buf: deciding whether a handler applies takes e.g. parsing the ELF program headers to find an interpreter segment, which sits at an arbitrary file offset, and non-sleepable file reads are limited to whatever happens to be resident in the page cache. A match program that cannot read the file reliably would have to match broadly and leave the rejection to its load program, which breaks first-match-wins entry semantics the moment more than one handler is registered. Reliable file reads at exec time fault in the file's pages, so both ops must be able to sleep. This also constrains the caller: binfmt_misc must invoke both from sleepable context, which a later patch takes care of. Both ops are required; a handler that wants to decide everything from the load program supplies a match program that just returns true. The load program communicates its decisions through three new kfuncs: int bpf_binprm_set_interp(struct linux_binprm *bprm, const char *path, size_t path__sz); selects the interpreter and enforces an absolute path shorter than PATH_MAX. int bpf_binprm_set_interp_arg(struct linux_binprm *bprm, const char *arg, size_t arg__sz); passes a single optional argument to the interpreter, mirroring the optional argument of a #! interpreter line - something a static entry cannot express at all. int bpf_binprm_set_flags(struct linux_binprm *bprm, enum bpf_binprm_flags flags); chooses the invocation flags for this exec, with BPF_BINPRM_PRESERVE_ARGV0, BPF_BINPRM_CREDENTIALS and BPF_BINPRM_EXECFD mapping to 'P', 'C' and 'O'. Unknown bits are rejected so a program built against a newer kernel fails loudly on an older one rather than silently losing a flag. Repeated calls replace the staged flags and a zero argument clears them again - the set-or-clear semantics of bpf_bprm_opts_set() on the same struct. A flags word carries this better than a kfunc per flag: it is one call, it is set atomically, and new behaviour is a new bit rather than new surface - the same shape the register string's flags field already has. All three stage their result in the bprm; consuming it from load_misc_binary() is wired up by the following patches. The bprm is exclusively owned by the task doing the exec, so no shared or per-CPU state is involved and nothing here can race. The kfuncs are registered for struct_ops programs with a filter that limits them to the load program of a binfmt_misc_ops instance, keyed off the struct_ops member offset the program attaches to: match decides whether a handler applies, load decides how the binary is run, and the verifier enforces that split at program load time. Registering an ops instance (updating the struct_ops map or attaching its link) publishes the handler under its name in a registry keyed by the registering task's user namespace. Lookups do not walk that hierarchy: a handler is only visible in the user namespace it was registered in, so an entry can only reference a handler registered in the same user namespace as its binfmt_misc instance. Consumers take a reference on the ops via bpf_struct_ops_get() which pins the underlying map and programs, so an activated handler keeps working even if the map is deleted or the registering container goes away; deregistration only prevents new activations, exactly like unregistering a tcp congestion ops with live users. Link: https://lore.kernel.org/20260704211409.1978485-1-farid.m.zakaria@gmail.com Link: https://patch.msgid.link/20260714-work-bpf-binfmt_misc-v2-2-57b7529c002c@kernel.org Signed-off-by: Christian Brauner (Amutable)

binfmt_elf: preserve original ELF e_flags for core dumps

2025-09-04T03:49:32+00:00

Some architectures, such as RISC-V, use the ELF e_flags field to encode ABI-specific information (e.g., ISA extensions, fpu support). Debuggers like GDB rely on these flags in core dumps to correctly interpret optional register sets. If the flags are missing or incorrect, GDB may warn and ignore valid data, for example: warning: Unexpected size of section '.reg2/213' in core file. This can prevent access to fpu or other architecture-specific registers even when they were dumped. Save the e_flags field during ELF binary loading (in load_elf_binary()) into the mm_struct, and later retrieve it during core dump generation (in fill_note_info()). Kconfig option CONFIG_ARCH_HAS_ELF_CORE_EFLAGS is introduced for architectures that require this behaviour. Signed-off-by: Svetlana Parfenova Link: https://lore.kernel.org/r/20250901135350.619485-1-svetlana.parfenova@syntacore.com Signed-off-by: Kees Cook

exec: Add KUnit test for bprm_stack_limits()

2024-06-19T20:13:55+00:00

Since bprm_stack_limits() operates with very limited side-effects, add it as the first exec.c KUnit test. Add to Kconfig and adjust MAINTAINERS file to include it. Tested on 64-bit UML: $ tools/testing/kunit/kunit.py run exec Link: https://lore.kernel.org/lkml/20240520021615.741800-1-keescook@chromium.org/ Signed-off-by: Kees Cook

riscv: support the elf-fdpic binfmt loader

2023-08-23T21:17:43+00:00

Add support for enabling and using the binfmt_elf_fdpic program loader on RISC-V platforms. The most important change is to setup registers during program load to pass the mapping addresses to the new process. One of the interesting features of the elf-fdpic loader is that it also allows appropriately compiled ELF format binaries to be loaded on nommu systems. Appropriate being those compiled with -pie. Signed-off-by: Greg Ungerer Acked-by: Kees Cook Link: https://lore.kernel.org/r/20230711130754.481209-3-gerg@kernel.org Signed-off-by: Palmer Dabbelt

Merge tag 'xtensa-20221010' of https://github.com/jcmvbkbc/linux-xtensa

2022-10-10T21:21:11+00:00

Pull xtensa updates from Max Filippov: - add support for FDPIC and static PIE executable formats for noMMU * tag 'xtensa-20221010' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: add FDPIC and static PIE support for noMMU xtensa: clean up ELF_PLAT_INIT macro

a.out: Remove the a.out implementation

2022-09-27T14:11:02+00:00

In commit 19e8b701e258 ("a.out: Stop building a.out/osf1 support on alpha and m68k") the last users of a.out were disabled. As nothing has turned up to cause this change to be reverted, let's remove the code implementing a.out support as well. There may be userspace users of the uapi bits left so the uapi headers have been left untouched. Signed-off-by: "Eric W. Biederman" Acked-by: Arnd Bergmann # arm defconfigs Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/871qrx3hq3.fsf@email.froward.int.ebiederm.org

xtensa: add FDPIC and static PIE support for noMMU

2022-09-14T01:28:00+00:00

Define ELFOSABI_XTENSA_FDPIC and use it as an OSABI tag in the ELF header to distinguish FDPIC ELF files from regular ELF files. Define ELF_FDPIC_PLAT_INIT and put executable map, interpreter map and executable dynamic section addresses into registers a4..a6. Update start_thread macro to preserve register values in the current register window. Add definitions for PTRACE_GETFDPIC, PTRACE_GETFDPIC_EXEC and PTRACE_GETFDPIC_INTERP. Signed-off-by: Max Filippov

Merge tag 'm68knommu-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu

2022-05-30T17:56:18+00:00

Pull m68knommu updates from Greg Ungerer: "A collection of changes to add elf-fdpic loader support for m68k. Also a collection of various fixes. They include typo corrections, undefined symbol compilation fixes, removal of the ISA_DMA_API support and removal of unused code. Summary: - correctly set up ZERO_PAGE pointer - drop ISA_DMA_API support - fix comment typos - fixes for undefined symbols - remove unused code and variables - elf-fdpic loader support for m68k" * tag 'm68knommu-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: fix 68000 CPU link with no platform selected m68k: removed unused "mach_get_ss" m68knommu: fix undefined reference to `mach_get_rtc_pll' m68knommu: fix undefined reference to `_init_sp' m68knommu: allow elf_fdpic loader to be selected m68knommu: add definitions to support elf_fdpic program loader m68knommu: implement minimal regset support m68knommu: use asm-generic/mmu.h for nommu setups m68k: fix typos in comments m68k: coldfire: drop ISA_DMA_API support m68knommu: set ZERO_PAGE() to the allocated zeroed page

m68knommu: allow elf_fdpic loader to be selected

2022-05-16T03:18:30+00:00

The m68k architecture code is capable of supporting the binfmt_elf_fdpic loader, so allow it to be configured. It is restricted to nommu configurations at this time due to the MMU context structures/code not supporting everything elf_fdpic needs when MMU is enabled. Signed-off-by: Greg Ungerer

binfmt_flat: Remove shared library support

2022-04-22T17:57:18+00:00

In a recent discussion[1] it was reported that the binfmt_flat library support was only ever used on m68k and even on m68k has not been used in a very long time. The structure of binfmt_flat is different from all of the other binfmt implementations because of this shared library support and it made life and code review more effort when I refactored the code in fs/exec.c. Since in practice the code is dead remove the binfmt_flat shared library support and make maintenance of the code easier. [1] https://lkml.kernel.org/r/81788b56-5b15-7308-38c7-c7f2502c4e15@linux-m68k.org Signed-off-by: "Eric W. Biederman" Reviewed-by: Damien Le Moal Acked-by: Vladimir Murzin # ARM Tested-by: Patrice Chotard Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/87levzzts4.fsf_-_@email.froward.int.ebiederm.org