6.7.7.53 Zero-call-used-regs Option

The -fzero-call-used-regs=choice option instructs the compiler to zero out a subset of the "call-used" registers associated with each function when those functions return. Call-used registers are those registers that can be altered by a function call. This action can enhance program security by reducing the risk of return-oriented programming (ROP) attacks or preventing information leakage through registers.

To balance security needs with runtime performance, the choice argument allows you to select which subset of call-used registers should be zeroed. The four basic options for choice are:

skip: No call-used registers are zeroed.
used: Only call-used registers that have been set or referenced in the function are zeroed.
all: All call-used registers are zeroed.

The used and all options can be further refined with the following suffixes:

-gpr: Limits zeroing to general-purpose registers.
-arg: Limits zeroing to function argument registers, as defined by the platform’s calling convention.

You can use these suffixes individually or together. If both are used, they must appear in the above order. For example, used-gpr zeros only general-purpose call-used registers that have been set or referenced in the function; used-arg zeros only call-used registers used for function arguments that have been set or referenced; and used-gpr-arg zeros only general-purpose call-used registers used for function arguments that have been set or referenced.

Choices like used-arg, used-gpr-arg, all-arg, and all-gpr-arg are primarily used for ROP mitigation.

The compiler's encoding of individual functions can be controlled by the zero_call_used_regs attribute, which overrides this option. See Zero_call_used_regs Function Attribute.