diff --git a/src/binfmt_rto/binfmt_rto.c b/src/binfmt_rto/binfmt_rto.c
index ebfa2822a69b95e47d33cb20f455ee0cbe22ea38..3998cc52073bef72fa446fefe2a71182372f7812 100644
--- a/src/binfmt_rto/binfmt_rto.c
+++ b/src/binfmt_rto/binfmt_rto.c
@@ -73,6 +73,10 @@ MODULE_PARM_DESC(debug, "debug mode");
 #define EF_AARCH64_HUGEPAGE (0x00020000U)
 #endif
 
+#ifndef EF_AARCH64_RTO
+#define EF_AARCH64_RTO (0x00040000U)
+#endif
+
 #ifndef EF_X86_64_SYMBOLIC_LINK
 #define EF_X86_64_SYMBOLIC_LINK    (0x00010000U)
 #endif
@@ -80,13 +84,18 @@ MODULE_PARM_DESC(debug, "debug mode");
 #ifndef EF_X86_64_HUGEPAGE
 #define EF_X86_64_HUGEPAGE         (0x00020000U)
 #endif
+#ifndef EF_X86_64_RTO
+#define EF_X86_64_RTO              (0x00040000U)
+#endif
 
 #ifdef CONFIG_ARM64
 #define OS_SPECIFIC_FLAG_SYMBOLIC_LINK EF_AARCH64_SYMBOLIC_LINK
 #define OS_SPECIFIC_FLAG_HUGEPAGE EF_AARCH64_HUGEPAGE
+#define OS_SPECIFIC_FLAG_RTO EF_AARCH64_RTO
 #else
 #define OS_SPECIFIC_FLAG_SYMBOLIC_LINK EF_X86_64_SYMBOLIC_LINK
 #define OS_SPECIFIC_FLAG_HUGEPAGE EF_X86_64_HUGEPAGE
+#define OS_SPECIFIC_FLAG_RTO EF_X86_64_RTO
 #endif
 
 /* compat 22.03 LTS, 22.03 LTS SP2 */
@@ -1096,6 +1105,9 @@ static struct file * try_get_rto_file(struct file *file)
 	strcat(rto_path, ".rto");
 	rto_file = open_exec(rto_path);
 
+	// bug: the path is wrong when NFS
+	printk("zk--- %s\n", rto_path);
+
 	kfree(buffer);
 	return rto_file;
 }
@@ -1190,9 +1202,10 @@ static int load_elf_binary(struct linux_binprm *bprm)
 	struct pt_regs *regs;
 
 #ifdef CONFIG_ELF_SYSBOOST
-	bool is_rto_format = elf_ex->e_flags & OS_SPECIFIC_FLAG_SYMBOLIC_LINK;
+	bool is_rto_format = false;
 
 load_rto:
+	is_rto_format = elf_ex->e_flags & OS_SPECIFIC_FLAG_RTO;
 	retval = -ENOEXEC;
 
 	/* close feature to rmmod this ko */
@@ -1219,10 +1232,20 @@ load_rto:
 		goto out;
 
 #ifdef CONFIG_ELF_SYSBOOST
-	/* e_flags will change */
+	/* replace app.rto file, then use binfmt */
 	if (elf_ex->e_flags & OS_SPECIFIC_FLAG_SYMBOLIC_LINK) {
-		if (!try_replace_file(bprm))
-			goto load_rto;
+		int ret = try_replace_file(bprm);
+		if (!ret) {
+			if (elf_ex->e_flags & OS_SPECIFIC_FLAG_RTO) {
+				goto load_rto;
+			} else {
+				goto out;
+			}
+		} else {
+			/* limit print */
+			printk("replace rto file fail, %d\n", ret);
+			goto out;
+		}
 	} else if (debug) {
 		goto out;
 	}
diff --git a/src/elf_hugepage.c b/src/elf_hugepage.c
index db5d0c0bc086979b303ace9ce404ef34b4650ac3..be59dbd83b496f02818ee512e25f5c207c51ddaa 100644
--- a/src/elf_hugepage.c
+++ b/src/elf_hugepage.c
@@ -26,6 +26,10 @@
 #define EF_AARCH64_HUGEPAGE (0x00020000U)
 #endif
 
+#ifndef EF_AARCH64_RTO
+#define EF_AARCH64_RTO (0x00040000U)
+#endif
+
 #ifndef EF_X86_64_SYMBOLIC_LINK
 #define EF_X86_64_SYMBOLIC_LINK    (0x00010000U)
 #endif
@@ -34,16 +38,22 @@
 #define EF_X86_64_HUGEPAGE         (0x00020000U)
 #endif
 
+#ifndef EF_X86_64_RTO
+#define EF_X86_64_RTO              (0x00040000U)
+#endif
+
 #ifdef __aarch64__
 #define OS_SPECIFIC_FLAG_SYMBOLIC_LINK EF_AARCH64_SYMBOLIC_LINK
 #define OS_SPECIFIC_FLAG_HUGEPAGE EF_AARCH64_HUGEPAGE
+#define OS_SPECIFIC_FLAG_RTO EF_AARCH64_RTO
 #else
 #define OS_SPECIFIC_FLAG_SYMBOLIC_LINK EF_X86_64_SYMBOLIC_LINK
 #define OS_SPECIFIC_FLAG_HUGEPAGE EF_X86_64_HUGEPAGE
+#define OS_SPECIFIC_FLAG_RTO EF_X86_64_RTO
 #endif
 #define OS_SPECIFIC_MASK (0xffffffffU ^ OS_SPECIFIC_FLAG_SYMBOLIC_LINK ^ OS_SPECIFIC_FLAG_HUGEPAGE)
 
-void _elf_set_symbolic_link(elf_file_t *ef, bool state)
+static void _elf_set_symbolic_link(elf_file_t *ef, bool state)
 {
 	if (state) {
 		ef->hdr->e_flags |= OS_SPECIFIC_FLAG_SYMBOLIC_LINK;
@@ -52,26 +62,6 @@ void _elf_set_symbolic_link(elf_file_t *ef, bool state)
 	}
 }
 
-void elf_set_hugepage(elf_link_t *elf_link)
-{
-	int i, exec_only = 1;
-	elf_file_t *ef = &elf_link->out_ef;
-	int count = ef->hdr->e_phnum;
-	Elf64_Phdr *phdr = (Elf64_Phdr *)ef->hdr_Phdr;
-
-	for (i = 0; i < count; i++) {
-		if (phdr[i].p_type != PT_LOAD) {
-			continue;
-		}
-		if (exec_only && !(phdr[i].p_flags & PF_X)) {
-			continue;
-		}
-		phdr[i].p_flags |= PF_HUGEPAGE;
-	}
-
-	ef->hdr->e_flags |= OS_SPECIFIC_FLAG_HUGEPAGE;
-}
-
 int elf_set_symbolic_link(char *path, bool state)
 {
 	// this memory will free by process exit
@@ -93,3 +83,24 @@ int elf_set_symbolic_link(char *path, bool state)
 	// on the process exit.
 	return 0;
 }
+
+void elf_set_hugepage(elf_link_t *elf_link)
+{
+	int i, exec_only = 1;
+	elf_file_t *ef = &elf_link->out_ef;
+	int count = ef->hdr->e_phnum;
+	Elf64_Phdr *phdr = (Elf64_Phdr *)ef->hdr_Phdr;
+
+	for (i = 0; i < count; i++) {
+		if (phdr[i].p_type != PT_LOAD) {
+			continue;
+		}
+		if (exec_only && !(phdr[i].p_flags & PF_X)) {
+			continue;
+		}
+		phdr[i].p_flags |= PF_HUGEPAGE;
+	}
+
+	ef->hdr->e_flags |= OS_SPECIFIC_FLAG_HUGEPAGE;
+}
+
diff --git a/tests/test_binfmt_rto/.gitignore b/tests/test_binfmt_rto/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..c00f79e8b7bab3437e177eb99a4460da1ca06c2f
--- /dev/null
+++ b/tests/test_binfmt_rto/.gitignore
@@ -0,0 +1 @@
+bash_test_link
diff --git a/tests/test_binfmt_rto/Makefile b/tests/test_binfmt_rto/Makefile
index 78099bd80dbb075e112d83ac10fcc4da5bdf6a2a..09ae11ea9389db31702ce81775bc3cb5ed92b048 100644
--- a/tests/test_binfmt_rto/Makefile
+++ b/tests/test_binfmt_rto/Makefile
@@ -9,18 +9,18 @@ KO_DIR=$(ROOT_DIR)src/binfmt_rto
 all: test_ko
 
 link:
-	cp /usr/bin/ls ls_test_link
-	$(SYSBOOST) --set ls_test_link
-	readelf -W -a ls_test_link > ls_test_link.link.elf
+	cp /usr/bin/bash bash_test_link
+	$(SYSBOOST) --set bash_test_link
+	readelf -W -a bash_test_link > bash_test_link.link.elf
 
 test_ko: link
 	make -C $(KO_DIR) install
-	cp /usr/bin/ls ls_test_link.rto
-	./ls_test_link
+	cp /usr/bin/bash bash_test_link.rto
+	./bash_test_link -c "echo 1"
 
 env:
 	echo 0 > /proc/sys/kernel/randomize_va_space
 	cat /proc/sys/kernel/randomize_va_space
 
 clean:
-	$(RM) *.o *.ro *.old *.so *.asm *.elf *.rto *.out ls_test_link
+	$(RM) *.o *.ro *.old *.so *.asm *.elf *.rto *.out bash_test_link
diff --git a/tests/test_binfmt_rto/ls_test_link b/tests/test_binfmt_rto/ls_test_link
deleted file mode 100755
index 2101cf1f2be4339e45878364fbc8013e7f6885db..0000000000000000000000000000000000000000
Binary files a/tests/test_binfmt_rto/ls_test_link and /dev/null differ