[PATCH v2] sh: select BINFMT_FLAT_NO_DATA_START_OFFSET for noMMU

[PATCH v2] sh: select BINFMT_FLAT_NO_DATA_START_OFFSET for noMMU

[Waldemar Brodkorb]

binfmt_flat offsets the in-memory start of the data segment by
MAX_SHARED_LIBS words and then aligns it to FLAT_DATA_ALIGN, so FLAT_FLAG_RAM
binaries end up with a gap between text and data (commit 2217b9826246
("binfmt_flat: revert "binfmt_flat: don't offset the data start"")).

SH position-independent code finds the GOT with a PC-relative mova of
_GLOBAL_OFFSET_TABLE_, which assumes data follows text directly, as elf2flt
lays out the image. With the gap, the GOT register points below the real GOT,
so every GOT load reads the neighbouring slot and gets a wrong pointer. On a
J2 (sh2eb, noMMU) this made userland crash or hang right after start-up.
In my case the data was moved up by 0x20 bytes.

Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") added
CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET for architectures that cannot
tolerate such a gap; currently only riscv noMMU selects it. Select it on SH
as well when building without an MMU.

Tested on a J2 board (Numato Mimas V2, sh2eb, noMMU) with Linux 7.3 and
FLAT binaries built with elf2flt: with this change the data segment starts
exactly at the end of text and init runs.

Without the patch bootup fails with:
[   12.080472] Fixing up unaligned userspace access in "init" pid=1 pc=0x(ptrval) ins=0x6583
[   12.123609] Fixing up unaligned userspace access in "init" pid=1 pc=0x(ptrval) ins=0x6583
[   12.175153] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f00

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Assisted-by: LLM
Fixes: 2217b9826246 ("binfmt_flat: revert "binfmt_flat: don't offset the data start"")

---
v1->v2:
  - add fixes tag (Geert)
  - tested with 7.3 + Florian's uaccess patch (Geert)
  - added failing bootup messages to commit message
---
 arch/sh/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index d60f1d5a94c0..b501153551c0 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -15,6 +15,7 @@ config SUPERH
 	select ARCH_MIGHT_HAVE_PC_PARPORT
 	select ARCH_WANT_IPC_PARSE_VERSION
 	select ARCH_NEED_CMPXCHG_1_EMU
+	select BINFMT_FLAT_NO_DATA_START_OFFSET if !MMU
 	select CPU_NO_EFFICIENT_FFS
 	select DMA_DECLARE_COHERENT
 	select GENERIC_ATOMIC64
-- 
2.47.3

Re: [PATCH v2] sh: select BINFMT_FLAT_NO_DATA_START_OFFSET for noMMU

[John Paul Adrian Glaubitz]

Hi Waldemar,

On Wed, 2026-10-21 at 02:02 +0200, Waldemar Brodkorb wrote:
> binfmt_flat offsets the in-memory start of the data segment by
> MAX_SHARED_LIBS words and then aligns it to FLAT_DATA_ALIGN, so FLAT_FLAG_RAM
> binaries end up with a gap between text and data (commit 2217b9826246
> ("binfmt_flat: revert "binfmt_flat: don't offset the data start"")).
> 
> SH position-independent code finds the GOT with a PC-relative mova of
> _GLOBAL_OFFSET_TABLE_, which assumes data follows text directly, as elf2flt
> lays out the image. With the gap, the GOT register points below the real GOT,
> so every GOT load reads the neighbouring slot and gets a wrong pointer. On a
> J2 (sh2eb, noMMU) this made userland crash or hang right after start-up.
> In my case the data was moved up by 0x20 bytes.
> 
> Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") added
> CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET for architectures that cannot
> tolerate such a gap; currently only riscv noMMU selects it. Select it on SH
> as well when building without an MMU.
> 
> Tested on a J2 board (Numato Mimas V2, sh2eb, noMMU) with Linux 7.3 and
> FLAT binaries built with elf2flt: with this change the data segment starts
> exactly at the end of text and init runs.
> 
> Without the patch bootup fails with:
> [   12.080472] Fixing up unaligned userspace access in "init" pid=1 pc=0x(ptrval) ins=0x6583
> [   12.123609] Fixing up unaligned userspace access in "init" pid=1 pc=0x(ptrval) ins=0x6583
> [   12.175153] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f00
> 
> Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
> Assisted-by: LLM
> Fixes: 2217b9826246 ("binfmt_flat: revert "binfmt_flat: don't offset the data start"")
> 
> ---
> v1->v2:
>   - add fixes tag (Geert)
>   - tested with 7.3 + Florian's uaccess patch (Geert)
>   - added failing bootup messages to commit message
> ---
>  arch/sh/Kconfig | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
> index d60f1d5a94c0..b501153551c0 100644
> --- a/arch/sh/Kconfig
> +++ b/arch/sh/Kconfig
> @@ -15,6 +15,7 @@ config SUPERH
>  	select ARCH_MIGHT_HAVE_PC_PARPORT
>  	select ARCH_WANT_IPC_PARSE_VERSION
>  	select ARCH_NEED_CMPXCHG_1_EMU
> +	select BINFMT_FLAT_NO_DATA_START_OFFSET if !MMU
>  	select CPU_NO_EFFICIENT_FFS
>  	select DMA_DECLARE_COHERENT
>  	select GENERIC_ATOMIC64

I have not tested this yet but I will do so later this week. Personally, I
test my kernel images on J2 with ToyBox which builds a minimal rootfs with
busybox.

I am not sure if the binaries are flat binaries in this case, do you know?

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913

Re: [PATCH v2] sh: select BINFMT_FLAT_NO_DATA_START_OFFSET for noMMU

[Waldemar Brodkorb]

Hi Adrian,
John Paul Adrian Glaubitz wrote,

> Hi Waldemar,
> 
> On Wed, 2026-10-21 at 02:02 +0200, Waldemar Brodkorb wrote:
> > binfmt_flat offsets the in-memory start of the data segment by
> > MAX_SHARED_LIBS words and then aligns it to FLAT_DATA_ALIGN, so FLAT_FLAG_RAM
> > binaries end up with a gap between text and data (commit 2217b9826246
> > ("binfmt_flat: revert "binfmt_flat: don't offset the data start"")).
> > 
> > SH position-independent code finds the GOT with a PC-relative mova of
> > _GLOBAL_OFFSET_TABLE_, which assumes data follows text directly, as elf2flt
> > lays out the image. With the gap, the GOT register points below the real GOT,
> > so every GOT load reads the neighbouring slot and gets a wrong pointer. On a
> > J2 (sh2eb, noMMU) this made userland crash or hang right after start-up.
> > In my case the data was moved up by 0x20 bytes.
> > 
> > Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") added
> > CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET for architectures that cannot
> > tolerate such a gap; currently only riscv noMMU selects it. Select it on SH
> > as well when building without an MMU.
> > 
> > Tested on a J2 board (Numato Mimas V2, sh2eb, noMMU) with Linux 7.3 and
> > FLAT binaries built with elf2flt: with this change the data segment starts
> > exactly at the end of text and init runs.
> > 
> > Without the patch bootup fails with:
> > [   12.080472] Fixing up unaligned userspace access in "init" pid=1 pc=0x(ptrval) ins=0x6583
> > [   12.123609] Fixing up unaligned userspace access in "init" pid=1 pc=0x(ptrval) ins=0x6583
> > [   12.175153] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f00
> > 
> > Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
> > Assisted-by: LLM
> > Fixes: 2217b9826246 ("binfmt_flat: revert "binfmt_flat: don't offset the data start"")
> > 
> > ---
> > v1->v2:
> >   - add fixes tag (Geert)
> >   - tested with 7.3 + Florian's uaccess patch (Geert)
> >   - added failing bootup messages to commit message
> > ---
> >  arch/sh/Kconfig | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
> > index d60f1d5a94c0..b501153551c0 100644
> > --- a/arch/sh/Kconfig
> > +++ b/arch/sh/Kconfig
> > @@ -15,6 +15,7 @@ config SUPERH
> >  	select ARCH_MIGHT_HAVE_PC_PARPORT
> >  	select ARCH_WANT_IPC_PARSE_VERSION
> >  	select ARCH_NEED_CMPXCHG_1_EMU
> > +	select BINFMT_FLAT_NO_DATA_START_OFFSET if !MMU
> >  	select CPU_NO_EFFICIENT_FFS
> >  	select DMA_DECLARE_COHERENT
> >  	select GENERIC_ATOMIC64
> 
> I have not tested this yet but I will do so later this week. Personally, I
> test my kernel images on J2 with ToyBox which builds a minimal rootfs with
> busybox.
> 
> I am not sure if the binaries are flat binaries in this case, do you know?

They are not. Toybox uses musl C library, which is FDPIC.
I use OpenADK (https://openadk.org) to build a J2 image with
uClibc-ng and FLAT binaries. You could either try OpenADK or just
believe me :).
For OpenADK you need to choose experimental support and uClibc-ng
git version, as there was another bug in uClibc-ng to let it work.

best regards
 Waldemar

Re: [PATCH v2] sh: select BINFMT_FLAT_NO_DATA_START_OFFSET for noMMU

[John Paul Adrian Glaubitz]

Hi Waldemar,

On Wed, 2026-10-21 at 11:25 +0200, Waldemar Brodkorb wrote:
> Hi Adrian,
> John Paul Adrian Glaubitz wrote,
> 
> > Hi Waldemar,
> > 
> > On Wed, 2026-10-21 at 02:02 +0200, Waldemar Brodkorb wrote:
> > > binfmt_flat offsets the in-memory start of the data segment by
> > > MAX_SHARED_LIBS words and then aligns it to FLAT_DATA_ALIGN, so FLAT_FLAG_RAM
> > > binaries end up with a gap between text and data (commit 2217b9826246
> > > ("binfmt_flat: revert "binfmt_flat: don't offset the data start"")).
> > > 
> > > SH position-independent code finds the GOT with a PC-relative mova of
> > > _GLOBAL_OFFSET_TABLE_, which assumes data follows text directly, as elf2flt
> > > lays out the image. With the gap, the GOT register points below the real GOT,
> > > so every GOT load reads the neighbouring slot and gets a wrong pointer. On a
> > > J2 (sh2eb, noMMU) this made userland crash or hang right after start-up.
> > > In my case the data was moved up by 0x20 bytes.
> > > 
> > > Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") added
> > > CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET for architectures that cannot
> > > tolerate such a gap; currently only riscv noMMU selects it. Select it on SH
> > > as well when building without an MMU.
> > > 
> > > Tested on a J2 board (Numato Mimas V2, sh2eb, noMMU) with Linux 7.3 and
> > > FLAT binaries built with elf2flt: with this change the data segment starts
> > > exactly at the end of text and init runs.
> > > 
> > > Without the patch bootup fails with:
> > > [   12.080472] Fixing up unaligned userspace access in "init" pid=1 pc=0x(ptrval) ins=0x6583
> > > [   12.123609] Fixing up unaligned userspace access in "init" pid=1 pc=0x(ptrval) ins=0x6583
> > > [   12.175153] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f00
> > > 
> > > Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
> > > Assisted-by: LLM
> > > Fixes: 2217b9826246 ("binfmt_flat: revert "binfmt_flat: don't offset the data start"")
> > > 
> > > ---
> > > v1->v2:
> > >   - add fixes tag (Geert)
> > >   - tested with 7.3 + Florian's uaccess patch (Geert)
> > >   - added failing bootup messages to commit message
> > > ---
> > >  arch/sh/Kconfig | 1 +
> > >  1 file changed, 1 insertion(+)
> > > 
> > > diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
> > > index d60f1d5a94c0..b501153551c0 100644
> > > --- a/arch/sh/Kconfig
> > > +++ b/arch/sh/Kconfig
> > > @@ -15,6 +15,7 @@ config SUPERH
> > >  	select ARCH_MIGHT_HAVE_PC_PARPORT
> > >  	select ARCH_WANT_IPC_PARSE_VERSION
> > >  	select ARCH_NEED_CMPXCHG_1_EMU
> > > +	select BINFMT_FLAT_NO_DATA_START_OFFSET if !MMU
> > >  	select CPU_NO_EFFICIENT_FFS
> > >  	select DMA_DECLARE_COHERENT
> > >  	select GENERIC_ATOMIC64
> > 
> > I have not tested this yet but I will do so later this week. Personally, I
> > test my kernel images on J2 with ToyBox which builds a minimal rootfs with
> > busybox.
> > 
> > I am not sure if the binaries are flat binaries in this case, do you know?
> 
> They are not. Toybox uses musl C library, which is FDPIC.
> I use OpenADK (https://openadk.org) to build a J2 image with
> uClibc-ng and FLAT binaries. You could either try OpenADK or just
> believe me :).
> For OpenADK you need to choose experimental support and uClibc-ng
> git version, as there was another bug in uClibc-ng to let it work.

Thanks for the clarification. Wouldn't your patch then interfere with Toybox then?

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913

Re: [PATCH v2] sh: select BINFMT_FLAT_NO_DATA_START_OFFSET for noMMU

[Waldemar Brodkorb]

Hi Adrian,
John Paul Adrian Glaubitz wrote,

> Hi Waldemar,
> 
> On Wed, 2026-10-21 at 11:25 +0200, Waldemar Brodkorb wrote:
> > Hi Adrian,
> > John Paul Adrian Glaubitz wrote,
> > 
> > > Hi Waldemar,
> > > 
> > > On Wed, 2026-10-21 at 02:02 +0200, Waldemar Brodkorb wrote:
> > > > binfmt_flat offsets the in-memory start of the data segment by
> > > > MAX_SHARED_LIBS words and then aligns it to FLAT_DATA_ALIGN, so FLAT_FLAG_RAM
> > > > binaries end up with a gap between text and data (commit 2217b9826246
> > > > ("binfmt_flat: revert "binfmt_flat: don't offset the data start"")).
> > > > 
> > > > SH position-independent code finds the GOT with a PC-relative mova of
> > > > _GLOBAL_OFFSET_TABLE_, which assumes data follows text directly, as elf2flt
> > > > lays out the image. With the gap, the GOT register points below the real GOT,
> > > > so every GOT load reads the neighbouring slot and gets a wrong pointer. On a
> > > > J2 (sh2eb, noMMU) this made userland crash or hang right after start-up.
> > > > In my case the data was moved up by 0x20 bytes.
> > > > 
> > > > Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") added
> > > > CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET for architectures that cannot
> > > > tolerate such a gap; currently only riscv noMMU selects it. Select it on SH
> > > > as well when building without an MMU.
> > > > 
> > > > Tested on a J2 board (Numato Mimas V2, sh2eb, noMMU) with Linux 7.3 and
> > > > FLAT binaries built with elf2flt: with this change the data segment starts
> > > > exactly at the end of text and init runs.
> > > > 
> > > > Without the patch bootup fails with:
> > > > [   12.080472] Fixing up unaligned userspace access in "init" pid=1 pc=0x(ptrval) ins=0x6583
> > > > [   12.123609] Fixing up unaligned userspace access in "init" pid=1 pc=0x(ptrval) ins=0x6583
> > > > [   12.175153] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f00
> > > > 
> > > > Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
> > > > Assisted-by: LLM
> > > > Fixes: 2217b9826246 ("binfmt_flat: revert "binfmt_flat: don't offset the data start"")
> > > > 
> > > > ---
> > > > v1->v2:
> > > >   - add fixes tag (Geert)
> > > >   - tested with 7.3 + Florian's uaccess patch (Geert)
> > > >   - added failing bootup messages to commit message
> > > > ---
> > > >  arch/sh/Kconfig | 1 +
> > > >  1 file changed, 1 insertion(+)
> > > > 
> > > > diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
> > > > index d60f1d5a94c0..b501153551c0 100644
> > > > --- a/arch/sh/Kconfig
> > > > +++ b/arch/sh/Kconfig
> > > > @@ -15,6 +15,7 @@ config SUPERH
> > > >  	select ARCH_MIGHT_HAVE_PC_PARPORT
> > > >  	select ARCH_WANT_IPC_PARSE_VERSION
> > > >  	select ARCH_NEED_CMPXCHG_1_EMU
> > > > +	select BINFMT_FLAT_NO_DATA_START_OFFSET if !MMU
> > > >  	select CPU_NO_EFFICIENT_FFS
> > > >  	select DMA_DECLARE_COHERENT
> > > >  	select GENERIC_ATOMIC64
> > > 
> > > I have not tested this yet but I will do so later this week. Personally, I
> > > test my kernel images on J2 with ToyBox which builds a minimal rootfs with
> > > busybox.
> > > 
> > > I am not sure if the binaries are flat binaries in this case, do you know?
> > 
> > They are not. Toybox uses musl C library, which is FDPIC.
> > I use OpenADK (https://openadk.org) to build a J2 image with
> > uClibc-ng and FLAT binaries. You could either try OpenADK or just
> > believe me :).
> > For OpenADK you need to choose experimental support and uClibc-ng
> > git version, as there was another bug in uClibc-ng to let it work.
> 
> Thanks for the clarification. Wouldn't your patch then interfere with Toybox then?

No, because it is BINFMT FLAT specific patch. It does not change
anything about FDPIC.
best regards
 Waldemar

Re: [PATCH v2] sh: select BINFMT_FLAT_NO_DATA_START_OFFSET for noMMU

[John Paul Adrian Glaubitz]

Hi Waldemar,

On Wed, 2026-10-21 at 11:43 +0200, Waldemar Brodkorb wrote:
> > > They are not. Toybox uses musl C library, which is FDPIC.
> > > I use OpenADK (https://openadk.org) to build a J2 image with
> > > uClibc-ng and FLAT binaries. You could either try OpenADK or just
> > > believe me :).
> > > For OpenADK you need to choose experimental support and uClibc-ng
> > > git version, as there was another bug in uClibc-ng to let it work.
> > 
> > Thanks for the clarification. Wouldn't your patch then interfere with Toybox then?
> 
> No, because it is BINFMT FLAT specific patch. It does not change
> anything about FDPIC.

OK, thanks! I have no objection against taking this patch for v7.4 then.

Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>

PS: Please make sure to CC all SH maintainers for future submissions.

Thanks,
Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913