On Tue, Oct 06, 2026 at 01:42:23PM -0700, Kees Cook wrote: > Every architecture that builds the stub now adds $(DISABLE_KSTACK_ERASE) > to its own flags, so add it once to the flags they share instead. > > Assisted-by: LLM > Signed-off-by: Kees Cook <[email protected]>
Reviewed-by: Nathan Chancellor <[email protected]> > --- > drivers/firmware/efi/libstub/Makefile | 17 +++++++---------- > 1 file changed, 7 insertions(+), 10 deletions(-) > > diff --git a/drivers/firmware/efi/libstub/Makefile > b/drivers/firmware/efi/libstub/Makefile > index 1f588591f458..d6fe69c3af87 100644 > --- a/drivers/firmware/efi/libstub/Makefile > +++ b/drivers/firmware/efi/libstub/Makefile > @@ -19,22 +19,18 @@ cflags-$(CONFIG_X86) := $(filter-out > -mcmodel=kernel \ > $(PADDING_CFLAGS), $(cflags-y)) > cflags-$(CONFIG_X86_32) += -march=i386 > cflags-$(CONFIG_X86_64) += -mcmodel=small > -cflags-$(CONFIG_X86) += -fPIC $(DISABLE_KSTACK_ERASE) > +cflags-$(CONFIG_X86) += -fPIC > # Nothing enables IBT while the stub runs, so ENDBR would only take space. > cflags-$(CONFIG_X86) += $(call cc-option,-fcf-protection=none) > > -# arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly > -# disable the stackleak plugin > -cflags-$(CONFIG_ARM64) += -fpie $(DISABLE_KSTACK_ERASE) \ > - -fno-unwind-tables > -fno-asynchronous-unwind-tables > +cflags-$(CONFIG_ARM64) += -fpie -fno-unwind-tables \ > + -fno-asynchronous-unwind-tables > cflags-$(CONFIG_ARM) += -DEFI_HAVE_STRLEN -DEFI_HAVE_STRNLEN \ > -DEFI_HAVE_MEMCHR -DEFI_HAVE_STRRCHR \ > -DEFI_HAVE_STRCMP -fno-builtin -fpic \ > - $(call cc-option,-mno-single-pic-base) \ > - $(DISABLE_KSTACK_ERASE) > -cflags-$(CONFIG_RISCV) += -fpic -DNO_ALTERNATIVE -mno-relax \ > - $(DISABLE_KSTACK_ERASE) > -cflags-$(CONFIG_LOONGARCH) += -fpie $(DISABLE_KSTACK_ERASE) > + $(call cc-option,-mno-single-pic-base) > +cflags-$(CONFIG_RISCV) += -fpic -DNO_ALTERNATIVE -mno-relax > +cflags-$(CONFIG_LOONGARCH) += -fpie > > cflags-$(CONFIG_EFI_PARAMS_FROM_FDT) += -I$(srctree)/scripts/dtc/libfdt > > @@ -44,6 +40,7 @@ KBUILD_CFLAGS := $(subst > $(CC_FLAGS_FTRACE),,$(cflags-y)) \ > -D__NO_FORTIFY \ > -ffreestanding \ > -fno-stack-protector \ > + $(DISABLE_KSTACK_ERASE) \ > $(call cc-option,-fno-addrsig) \ > -D__DISABLE_EXPORTS > > -- > 2.55.0 > -- Cheers, Nathan
