On Wed, 17 Sep 2025 10:30:04 +0200 Christian Melki <[email protected]> wrote:
> Hi. > > Which version of gcc are we talking about? It is quite old, but I'm bound to it because some software does not compile with newer versions. It looks like that the -fzero-call-used-regs is supported from GCC 11 (released April 2021). > GCC 11 should support this, but I don't know over which archs. > It is there as a security enhancement. I would say something like less > gadgets for ROP style attacks? And while it does slow down execution, > for something like OpenSSL, it usually is worth it imho. I agree.... The option is a must, when it is supported. Moreover, I found a comment in some openssh (not openssl) tracking, saying that to detect whether a version of gcc supports the option or not may be not trivial. > I don't see a suitable toolchain option or hardening flag in ptxdist > that currently fits this cleanly. Not sure if something like this fits > for a its own global pass either. Maybe someone else has another opinion. > > So my immediate suggestion would be to keep this local at your end for > now. OK - and these messages remain as a help if anyone else has the same problem. Regards, Ruggero > > Regards, > Christian
