[ptxdist] PTXDIST 2025.09.0: build failure of openssl-3.5.2 when gcc option -fzero-call-used-regs is not supported

[ptxdist] PTXDIST 2025.09.0: build failure of openssl-3.5.2 when gcc option -fzero-call-used-regs is not supported

[ruggero rossi via ptxdist]

[-- Attachment #1: Type: text/plain, Size: 537 bytes --]

Hello everybody,

On my system, the gcc toolchain does not support the
-fzero-call-used-regs option.

With PTXDIST 2025.09.0 this causes the build of OpenSSL 3.5.2 to fail.

An ad-hoc patch is trivial:
I removed the -fzero-call-used-regs=used-gpr flag from
openssl-3.5.2/Configurations/20-debian.conf (see attached patch).

My question is: would it be possible to integrate a more general solution
into PTXDIST, so that the build works regardless of whether the toolchain
supports this GCC option?

Best regards,

Ruggero Rossi










[-- Attachment #2: 0005-no-fzero-call-used-regs.patch --]
[-- Type: text/x-patch, Size: 469 bytes --]

Index: openssl-3.5.2/Configurations/20-debian.conf
===================================================================
--- openssl-3.5.2.orig/Configurations/20-debian.conf
+++ openssl-3.5.2/Configurations/20-debian.conf
@@ -1,6 +1,6 @@
 my %targets = (
 	"debian" => {
-		cflags => add("-Wa,--noexecstack -Wall -fzero-call-used-regs=used-gpr"),
+		cflags => add("-Wa,--noexecstack -Wall"),
 	},
 	"debian-alpha" => {
 		inherit_from => [ "linux-alpha-gcc", "debian" ],

Re: [ptxdist] PTXDIST 2025.09.0: build failure of openssl-3.5.2 when gcc option -fzero-call-used-regs is not supported

[Christian Melki]

Hi.

Which version of gcc are we talking about?
GCC 11 should support this, but I don't know over which archs.
It is there as a security enhancement. I would say something like less gadgets for ROP style attacks?
And while it does slow down execution, for something like OpenSSL, it usually is worth it imho.
I don't see a suitable toolchain option or hardening flag in ptxdist that currently fits this cleanly.
Not sure if something like this fits for a its own global pass either.
Maybe someone else has another opinion.

So my immediate suggestion would be to keep this local at your end for now.

Regards,
Christian

On 9/17/25 8:32 AM, ruggero rossi via ptxdist wrote:
> Hello everybody,
> 
> On my system, the gcc toolchain does not support the
> -fzero-call-used-regs option.
> 
> With PTXDIST 2025.09.0 this causes the build of OpenSSL 3.5.2 to fail.
> 
> An ad-hoc patch is trivial:
> I removed the -fzero-call-used-regs=used-gpr flag from
> openssl-3.5.2/Configurations/20-debian.conf (see attached patch).
> 
> My question is: would it be possible to integrate a more general solution
> into PTXDIST, so that the build works regardless of whether the toolchain
> supports this GCC option?
> 
> Best regards,
> 
> Ruggero Rossi
> 
> 
> 
> 
> 
> 
> 
> 
> 

Re: [ptxdist] PTXDIST 2025.09.0: build failure of openssl-3.5.2 when gcc option -fzero-call-used-regs is not supported

[ruggero rossi via ptxdist]

On Wed, 17 Sep 2025 10:30:04 +0200
Christian Melki <christian.melki@t2data.com> wrote:

> Hi.
> 
> Which version of gcc are we talking about?
It is quite old, but I'm bound to it because some software does not
compile with newer versions. It looks like that the -fzero-call-used-regs
is supported from GCC 11 (released April 2021).

> GCC 11 should support this, but I don't know over which archs.
> It is there as a security enhancement. I would say something like less
> gadgets for ROP style attacks? And while it does slow down execution,
> for something like OpenSSL, it usually is worth it imho. 
I agree.... The option is a must, when it is supported.

Moreover, I found a comment in some openssh (not openssl) tracking,
saying that to detect whether a version of gcc supports the option or not
may be not trivial.

> I don't see a suitable toolchain option or hardening flag in ptxdist
> that currently fits this cleanly.  Not sure if something like this fits
> for a its own global pass either. Maybe someone else has another opinion.
> 
> So my immediate suggestion would be to keep this local at your end for
> now.

OK - and these messages remain as a help if anyone else has the same
problem.

Regards,
Ruggero

> 
> Regards,
> Christian

Re: [ptxdist] PTXDIST 2025.09.0: build failure of openssl-3.5.2 when gcc option -fzero-call-used-regs is not supported

[Christian Melki]

On 9/17/25 11:00 AM, ruggero rossi wrote:
> On Wed, 17 Sep 2025 10:30:04 +0200
> Christian Melki <christian.melki@t2data.com> wrote:
> 
>> Hi.
>>
>> Which version of gcc are we talking about?
> It is quite old, but I'm bound to it because some software does not
> compile with newer versions. It looks like that the -fzero-call-used-regs
> is supported from GCC 11 (released April 2021).
> 
>> GCC 11 should support this, but I don't know over which archs.
>> It is there as a security enhancement. I would say something like less
>> gadgets for ROP style attacks? And while it does slow down execution,
>> for something like OpenSSL, it usually is worth it imho.
> I agree.... The option is a must, when it is supported.
> 
> Moreover, I found a comment in some openssh (not openssl) tracking,
> saying that to detect whether a version of gcc supports the option or not
> may be not trivial.
> 
>> I don't see a suitable toolchain option or hardening flag in ptxdist
>> that currently fits this cleanly.  Not sure if something like this fits
>> for a its own global pass either. Maybe someone else has another opinion.
>>
>> So my immediate suggestion would be to keep this local at your end for
>> now.
> 
> OK - and these messages remain as a help if anyone else has the same
> problem.

Indeed. Appreciate the time taken to report it.

Christian

> 
> Regards,
> Ruggero
> 
>>
>> Regards,
>> Christian