Every architecture that builds the stub now adds $(DISABLE_KSTACK_ERASE) to its own flags, so add it once to the flags they share instead.
Assisted-by: LLM Signed-off-by: Kees Cook <[email protected]> --- drivers/firmware/efi/libstub/Makefile | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile index 1f588591f458..d6fe69c3af87 100644 --- a/drivers/firmware/efi/libstub/Makefile +++ b/drivers/firmware/efi/libstub/Makefile @@ -19,22 +19,18 @@ cflags-$(CONFIG_X86) := $(filter-out -mcmodel=kernel \ $(PADDING_CFLAGS), $(cflags-y)) cflags-$(CONFIG_X86_32) += -march=i386 cflags-$(CONFIG_X86_64) += -mcmodel=small -cflags-$(CONFIG_X86) += -fPIC $(DISABLE_KSTACK_ERASE) +cflags-$(CONFIG_X86) += -fPIC # Nothing enables IBT while the stub runs, so ENDBR would only take space. cflags-$(CONFIG_X86) += $(call cc-option,-fcf-protection=none) -# arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly -# disable the stackleak plugin -cflags-$(CONFIG_ARM64) += -fpie $(DISABLE_KSTACK_ERASE) \ - -fno-unwind-tables -fno-asynchronous-unwind-tables +cflags-$(CONFIG_ARM64) += -fpie -fno-unwind-tables \ + -fno-asynchronous-unwind-tables cflags-$(CONFIG_ARM) += -DEFI_HAVE_STRLEN -DEFI_HAVE_STRNLEN \ -DEFI_HAVE_MEMCHR -DEFI_HAVE_STRRCHR \ -DEFI_HAVE_STRCMP -fno-builtin -fpic \ - $(call cc-option,-mno-single-pic-base) \ - $(DISABLE_KSTACK_ERASE) -cflags-$(CONFIG_RISCV) += -fpic -DNO_ALTERNATIVE -mno-relax \ - $(DISABLE_KSTACK_ERASE) -cflags-$(CONFIG_LOONGARCH) += -fpie $(DISABLE_KSTACK_ERASE) + $(call cc-option,-mno-single-pic-base) +cflags-$(CONFIG_RISCV) += -fpic -DNO_ALTERNATIVE -mno-relax +cflags-$(CONFIG_LOONGARCH) += -fpie cflags-$(CONFIG_EFI_PARAMS_FROM_FDT) += -I$(srctree)/scripts/dtc/libfdt @@ -44,6 +40,7 @@ KBUILD_CFLAGS := $(subst $(CC_FLAGS_FTRACE),,$(cflags-y)) \ -D__NO_FORTIFY \ -ffreestanding \ -fno-stack-protector \ + $(DISABLE_KSTACK_ERASE) \ $(call cc-option,-fno-addrsig) \ -D__DISABLE_EXPORTS -- 2.55.0
