Re: [PATCH 10/11] x86/purgatory: Compile purgatory.c with -D__NO_FORTIFY

[Ard Biesheuvel]

On Tue, 18 Aug 2026, at 10:53, Thomas Huth wrote:
...

> Maybe I should rather change the patch to add -D__NO_FORTIFY unconditionally 
> to generic PURGATORY_CFLAGS there? Something like:
>
> diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
> --- a/arch/x86/purgatory/Makefile
> +++ b/arch/x86/purgatory/Makefile
> @@ -11,7 +11,7 @@ $(obj)/string.o: 
> $(srctree)/arch/x86/boot/compressed/string.c FORCE
>   $(obj)/sha256.o: $(srctree)/lib/crypto/sha256.c FORCE
>          $(call if_changed_rule,cc_o_c)
>
> -CFLAGS_sha256.o := -D__DISABLE_EXPORTS -D__NO_FORTIFY
> +CFLAGS_sha256.o := -D__DISABLE_EXPORTS
>
>   # When profile-guided optimization is enabled, llvm emits two different
>   # overlapping text sections, which is not supported by kexec. Remove profile
> @@ -37,6 +37,7 @@ PURGATORY_CFLAGS := -mcmodel=small -ffreestanding 
> -fno-zero-initialized-in-bss -
>   PURGATORY_CFLAGS += -fpic -fvisibility=hidden
>   PURGATORY_CFLAGS += $(DISABLE_KSTACK_ERASE) -DDISABLE_BRANCH_PROFILING
>   PURGATORY_CFLAGS += -fno-stack-protector
> +PURGATORY_CFLAGS +=  -D__NO_FORTIFY
>
>   # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
>   # in turn leaves some undefined symbols like __fentry__ in purgatory and not
>

This seems like the right solution to me.