Re: [PATCH v1 3/3] efi/libstub: Disable kernel stack erasing in the common flags

[Nathan Chancellor]

On Tue, Oct 06, 2026 at 01:42:23PM -0700, Kees Cook wrote:
> Every architecture that builds the stub now adds $(DISABLE_KSTACK_ERASE)
> to its own flags, so add it once to the flags they share instead.
> 
> Assisted-by: LLM
> Signed-off-by: Kees Cook <kees@xxxxxxxxxx>

Reviewed-by: Nathan Chancellor <nathan@xxxxxxxxxx>

> ---
>  drivers/firmware/efi/libstub/Makefile | 17 +++++++----------
>  1 file changed, 7 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
> index 1f588591f458..d6fe69c3af87 100644
> --- a/drivers/firmware/efi/libstub/Makefile
> +++ b/drivers/firmware/efi/libstub/Makefile
> @@ -19,22 +19,18 @@ cflags-$(CONFIG_X86)		:= $(filter-out -mcmodel=kernel \
>  				     $(PADDING_CFLAGS), $(cflags-y))
>  cflags-$(CONFIG_X86_32)		+= -march=i386
>  cflags-$(CONFIG_X86_64)		+= -mcmodel=small
> -cflags-$(CONFIG_X86)		+= -fPIC $(DISABLE_KSTACK_ERASE)
> +cflags-$(CONFIG_X86)		+= -fPIC
>  # Nothing enables IBT while the stub runs, so ENDBR would only take space.
>  cflags-$(CONFIG_X86)		+= $(call cc-option,-fcf-protection=none)
>  
> -# arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly
> -# disable the stackleak plugin
> -cflags-$(CONFIG_ARM64)		+= -fpie $(DISABLE_KSTACK_ERASE) \
> -				   -fno-unwind-tables -fno-asynchronous-unwind-tables
> +cflags-$(CONFIG_ARM64)		+= -fpie -fno-unwind-tables \
> +				   -fno-asynchronous-unwind-tables
>  cflags-$(CONFIG_ARM)		+= -DEFI_HAVE_STRLEN -DEFI_HAVE_STRNLEN \
>  				   -DEFI_HAVE_MEMCHR -DEFI_HAVE_STRRCHR \
>  				   -DEFI_HAVE_STRCMP -fno-builtin -fpic \
> -				   $(call cc-option,-mno-single-pic-base) \
> -				   $(DISABLE_KSTACK_ERASE)
> -cflags-$(CONFIG_RISCV)		+= -fpic -DNO_ALTERNATIVE -mno-relax \
> -				   $(DISABLE_KSTACK_ERASE)
> -cflags-$(CONFIG_LOONGARCH)	+= -fpie $(DISABLE_KSTACK_ERASE)
> +				   $(call cc-option,-mno-single-pic-base)
> +cflags-$(CONFIG_RISCV)		+= -fpic -DNO_ALTERNATIVE -mno-relax
> +cflags-$(CONFIG_LOONGARCH)	+= -fpie
>  
>  cflags-$(CONFIG_EFI_PARAMS_FROM_FDT)	+= -I$(srctree)/scripts/dtc/libfdt
>  
> @@ -44,6 +40,7 @@ KBUILD_CFLAGS			:= $(subst $(CC_FLAGS_FTRACE),,$(cflags-y)) \
>  				   -D__NO_FORTIFY \
>  				   -ffreestanding \
>  				   -fno-stack-protector \
> +				   $(DISABLE_KSTACK_ERASE) \
>  				   $(call cc-option,-fno-addrsig) \
>  				   -D__DISABLE_EXPORTS
>  
> -- 
> 2.55.0
> 

-- 
Cheers,
Nathan