With "-z force-bti" the linker warns (or errors with CONFIG_WERROR) for every libstub object:
warning: BTI is required by -z force-bti, but this input object file lacks the necessary property note. On arm64 the EFI stub is part of vmlinux, so its objects are annotated as __init at the section level by running objcopy with --prefix-alloc-sections=.init. That has the side effect of renaming .note.gnu.property to .init.note.gnu.property, which LLD ignores, resulting in the BTI bit getting removed. That's only a problem for toolchains which advertise the branch protection features solely through .note.gnu.property. GCC 16 and Clang 20 also record them in .ARM.attributes, which objcopy leaves alone, but older compilers emit only the note. Rename the section back to its original name so the linker sees it, and so the generic NOTES macro can discard it. objcopy applies --rename-section before --prefix-alloc-sections regardless of their order on the command line, so this needs a second objcopy invocation rather than another flag on the existing one. RISC-V and LoongArch apply the same .init prefix, so key the rename off that rather than on arm64 alone. Neither emits .note.gnu.property today, and renaming a section which isn't present is a no-op, so this changes nothing for them for now, but it prevents a future silent failure mode. The note is still stripped by --remove-section=.note.gnu.property, so this change is inert until that section removal goes away in a subsequent patch. Signed-off-by: Josh Poimboeuf <[email protected]> --- drivers/firmware/efi/libstub/Makefile | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile index 77a2b2d74f3f6..b1c95f69e807d 100644 --- a/drivers/firmware/efi/libstub/Makefile +++ b/drivers/firmware/efi/libstub/Makefile @@ -155,6 +155,12 @@ STUBCOPY_FLAGS-$(CONFIG_LOONGARCH) += --prefix-alloc-sections=.init \ --prefix-symbols=__efistub_ STUBCOPY_RELOC-$(CONFIG_LOONGARCH) := R_LARCH_MARK_LA +# --prefix-alloc-sections=.init also renames .note.gnu.property, which the +# linker then ignores, dropping the branch protection properties. Rename it +# back on any architecture which applies the prefix. +STUBCOPY_RENAME-y = $(if $(findstring --prefix-alloc-sections,$(STUBCOPY_FLAGS-y)), \ + --rename-section .init.note.gnu.property=.note.gnu.property) + $(obj)/%.stub.o: $(obj)/%.o FORCE $(call if_changed,stubcopy) @@ -171,4 +177,5 @@ quiet_cmd_stubcopy = STUBCPY $@ echo "$@: absolute symbol references not allowed in the EFI stub" >&2; \ /bin/false; \ fi; \ - $(OBJCOPY) $(STUBCOPY_FLAGS-y) $< $@ + $(OBJCOPY) $(STUBCOPY_FLAGS-y) $< $@ \ + $(if $(STUBCOPY_RENAME-y),; $(OBJCOPY) $(STUBCOPY_RENAME-y) $@) -- 2.55.0
