As of version 8 (later backported to 7.3), GCC has added retpoline support . While I understand that it is intended for use in kernel patching for Spectre (ie: ), that does not prevent normal developers from using those flags.
As such, should I use the flags for retpoline (
-mfunction-return, and related)?
For example, I have written a cryptographically-secure password generation program in C . When I compile using
-mindirect-branch=thunk -mfunction-return=thunk, the resulting binary is different than without using those flags, presumably from the switch between call and jump to call and return thunk. Is there any reason for doing this, or any benefits from a security perspective?