diff --git a/blake2.cpp b/blake2.cpp
index 593795d7..2cc68ef2 100644
--- a/blake2.cpp
+++ b/blake2.cpp
@@ -28,22 +28,24 @@ NAMESPACE_BEGIN(CryptoPP)
 # undef CRYPTOPP_BOOL_SSE4_INTRINSICS_AVAILABLE
 #endif
 
-// SunCC needs 12.4 for _mm_set_epi64x, _mm_blend_epi16, _mm_shuffle_epi16, etc
-#if defined(__SUNPRO_CC) && (__SUNPRO_CC < 0x5130)
-# undef CRYPTOPP_BOOL_SSE2_INTRINSICS_AVAILABLE
-# undef CRYPTOPP_BOOL_SSE4_INTRINSICS_AVAILABLE
-#elif (__SUNPRO_CC >= 0x5130)
-# include <emmintrin.h>    // _mm_set_epi64x
-# include <smmintrin.h>    // _mm_blend_epi16
-# include <tmmintrin.h>    // _mm_shuffle_epi16
-#endif
-
 // Apple Clang 6.0/Clang 3.5 does not have SSSE3 intrinsics
 //   http://llvm.org/bugs/show_bug.cgi?id=20213
 #if (defined(CRYPTOPP_APPLE_CLANG_VERSION) && (CRYPTOPP_APPLE_CLANG_VERSION <= 60000)) || (defined(CRYPTOPP_LLVM_CLANG_VERSION) && (CRYPTOPP_LLVM_CLANG_VERSION <= 30500))
 # undef CRYPTOPP_BOOL_SSE4_INTRINSICS_AVAILABLE
 #endif
 
+// SunCC needs 12.4 for _mm_set_epi64x, _mm_blend_epi16, _mm_shuffle_epi16, etc
+#if defined(__SUNPRO_CC) && (__SUNPRO_CC < 0x5130)
+# undef CRYPTOPP_BOOL_SSE2_INTRINSICS_AVAILABLE
+# undef CRYPTOPP_BOOL_SSE4_INTRINSICS_AVAILABLE
+#endif
+
+#if defined(CRYPTOPP_BOOL_SSE4_INTRINSICS_AVAILABLE) && ((__SUNPRO_CC >= 0x5130) || defined(__clang__))
+# include <emmintrin.h>    // _mm_set_epi64x
+# include <smmintrin.h>    // _mm_blend_epi16
+# include <tmmintrin.h>    // _mm_shuffle_epi16
+#endif
+
 // C/C++ implementation
 static void BLAKE2_CXX_Compress32(const byte* input, BLAKE2_State<word32, false>& state);
 static void BLAKE2_CXX_Compress64(const byte* input, BLAKE2_State<word64, true>& state);
diff --git a/config.h b/config.h
index dfe090ee..fa6455df 100644
--- a/config.h
+++ b/config.h
@@ -340,6 +340,15 @@ NAMESPACE_END
 	#endif
 #endif
 
+// The section attribute attempts to initialize CPU flags to avoid Valgrind findings
+#if ((__MACH__ >= 1) && ((CRYPTOPP_LLVM_CLANG_VERSION >= 30600) || (CRYPTOPP_APPLE_CLANG_VERSION >= 70100)))
+	#define CRYPTOPP_SECTION_INIT __attribute__((section ("__DATA,__data")))
+#elif ((__ELF__ >= 1) && (CRYPTOPP_GCC_VERSION >= 40300))
+	#define CRYPTOPP_SECTION_INIT __attribute__((section ("nocommon")))
+#else
+	#define CRYPTOPP_SECTION_INIT
+#endif
+
 #if defined(_MSC_VER) || defined(__fastcall)
 	#define CRYPTOPP_FASTCALL __fastcall
 #else
diff --git a/config.recommend b/config.recommend
index b18ac3b1..423e51d6 100644
--- a/config.recommend
+++ b/config.recommend
@@ -340,6 +340,15 @@ NAMESPACE_END
 	#endif
 #endif
 
+// The section attribute attempts to initialize CPU flags to avoid Valgrind findings
+#if ((__MACH__ >= 1) && ((CRYPTOPP_LLVM_CLANG_VERSION >= 30600) || (CRYPTOPP_APPLE_CLANG_VERSION >= 70100)))
+	#define CRYPTOPP_SECTION_INIT __attribute__((section ("__DATA,__data")))
+#elif ((__ELF__ >= 1) && (CRYPTOPP_GCC_VERSION >= 40300))
+	#define CRYPTOPP_SECTION_INIT __attribute__((section ("nocommon")))
+#else
+	#define CRYPTOPP_SECTION_INIT
+#endif
+
 #if defined(_MSC_VER) || defined(__fastcall)
 	#define CRYPTOPP_FASTCALL __fastcall
 #else
diff --git a/cpu.cpp b/cpu.cpp
index b13dd255..8ce4cb13 100644
--- a/cpu.cpp
+++ b/cpu.cpp
@@ -182,10 +182,13 @@ static bool TrySSE2()
 #endif
 }
 
-bool g_x86DetectionDone = false;
-bool g_hasMMX = false, g_hasISSE = false, g_hasSSE2 = false, g_hasSSSE3 = false, g_hasSSE4 = false, g_hasAESNI = false, g_hasCLMUL = false, g_isP4 = false, g_hasRDRAND = false, g_hasRDSEED = false;
-bool g_hasPadlockRNG = false, g_hasPadlockACE = false, g_hasPadlockACE2 = false, g_hasPadlockPHE = false, g_hasPadlockPMM = false;
-word32 g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
+bool CRYPTOPP_SECTION_INIT g_x86DetectionDone = false;
+bool CRYPTOPP_SECTION_INIT g_hasMMX = false, CRYPTOPP_SECTION_INIT g_hasISSE = false, CRYPTOPP_SECTION_INIT g_hasSSE2 = false, CRYPTOPP_SECTION_INIT g_hasSSSE3 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSSE4 = false, CRYPTOPP_SECTION_INIT g_hasAESNI = false, CRYPTOPP_SECTION_INIT g_hasCLMUL = false, CRYPTOPP_SECTION_INIT g_isP4 = false;
+bool CRYPTOPP_SECTION_INIT g_hasRDRAND = false, CRYPTOPP_SECTION_INIT g_hasRDSEED = false;
+bool CRYPTOPP_SECTION_INIT g_hasPadlockRNG = false, CRYPTOPP_SECTION_INIT g_hasPadlockACE = false, CRYPTOPP_SECTION_INIT g_hasPadlockACE2 = false;
+bool CRYPTOPP_SECTION_INIT g_hasPadlockPHE = false, CRYPTOPP_SECTION_INIT g_hasPadlockPMM = false;
+word32 CRYPTOPP_SECTION_INIT g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
 
 static inline bool IsIntel(const word32 output[4])
 {
@@ -205,7 +208,7 @@ static inline bool IsAMD(const word32 output[4])
 
 static inline bool IsVIA(const word32 output[4])
 {
-	// This is the "CentaurHauls" string. Some non-PadLock can return "VIA VIA VIA ".
+	// This is the "CentaurHauls" string. Some non-PadLock's can return "VIA VIA VIA "
 	return (output[1] /*EBX*/ == 0x746e6543) &&
 		(output[2] /*ECX*/ == 0x736c7561) &&
 		(output[3] /*EDX*/ == 0x48727561);
@@ -281,16 +284,7 @@ void DetectX86Features()
 		static const unsigned int  PMM_FLAGS = (0x3 << 12);
 
 		CpuId(0xC0000000, cpuid);
-		if (cpuid[0] < 0xC0000001)
-		{
-			// No extended features
-			g_hasPadlockRNG  = false;
-			g_hasPadlockACE  = false;
-			g_hasPadlockACE2 = false;
-			g_hasPadlockPHE  = false;
-			g_hasPadlockPMM  = false;
-		}
-		else
+		if (cpuid[0] >= 0xC0000001)
 		{
 			// Extended features available
 			CpuId(0xC0000001, cpuid);
@@ -324,10 +318,10 @@ void DetectX86Features()
 // The following does not work well either. Its appears to be missing constants, and it does not detect Aarch32 execution environments on Aarch64
 // http://community.arm.com/groups/android-community/blog/2014/10/10/runtime-detection-of-cpu-features-on-an-armv8-a-cpu
 //
-bool g_ArmDetectionDone = false;
-bool g_hasNEON = false, g_hasCRC32 = false, g_hasAES = false, g_hasSHA1 = false, g_hasSHA2 = false;
-
-word32 g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
+bool CRYPTOPP_SECTION_INIT g_ArmDetectionDone = false;
+bool CRYPTOPP_SECTION_INIT g_hasNEON = false, CRYPTOPP_SECTION_INIT g_hasCRC32 = false, CRYPTOPP_SECTION_INIT g_hasAES = false, CRYPTOPP_SECTION_INIT g_hasSHA1 = false;
+bool CRYPTOPP_SECTION_INIT g_hasSHA2 = false;
+word32 CRYPTOPP_SECTION_INIT g_cacheLineSize = CRYPTOPP_L1_CACHE_LINE_SIZE;
 
 #ifndef CRYPTOPP_MS_STYLE_INLINE_ASSEMBLY
 extern "C"
diff --git a/crc.cpp b/crc.cpp
index 3cdcc9a9..f3383f2f 100644
--- a/crc.cpp
+++ b/crc.cpp
@@ -14,7 +14,7 @@ NAMESPACE_BEGIN(CryptoPP)
 #endif
 
 // SunCC 12.4 and above
-#if defined(CRYPTOPP_BOOL_SSE4_INTRINSICS_AVAILABLE) && (__SUNPRO_CC >= 0x5130)
+#if defined(CRYPTOPP_BOOL_SSE4_INTRINSICS_AVAILABLE) && ((__SUNPRO_CC >= 0x5130) || defined(__clang__))
 # include <nmmintrin.h>
 #endif
 
diff --git a/cryptest.sh b/cryptest.sh
index e9f30b0c..6958b754 100755
--- a/cryptest.sh
+++ b/cryptest.sh
@@ -744,7 +744,7 @@ fi
 
 # Respect user's preferred flags, but filter the stuff we expliclty test
 FILTERED_CXXFLAGS=("-DDEBUG" "-DNDEBUG" "-g" "-g0" "-g1" "-g2" "-g3" "-O0" "-O1" "-O2" "-O3" "-O4" "-O5" "-Os" "-Og"
-                   "-xO0" "-xO1" "-xO2" "-xO3" "-xO4" "-xO5" "-std=c++03" "-std=c++11" "-std=c++14" "-std=c++17"
+                   "-Ofast" "-xO0" "-xO1" "-xO2" "-xO3" "-xO4" "-xO5" "-std=c++03" "-std=c++11" "-std=c++14" "-std=c++17"
                    "-m32" "-m64" "-mx32" "-maes" "-mrdrand" "-mrdrnd" "-mrdseed" "-mpclmul" "-Wa,-q" "-mfpu=neon"
                    "-march=armv7a" "-Wall" "-Wextra" "-Wconversion" "-Wcast-align" "-Wformat-security" "-Wtrampolines"
                    "-DCRYPTOPP_DISABLE_ASM" "-DCRYPTOPP_DISABLE_SSSE3" "-DCRYPTOPP_DISABLE_AESNI"
@@ -4347,8 +4347,8 @@ echo | tee -a "$TEST_RESULTS"
 # "ERROR" is from this script
 # "Error" is from the GNU assembler
 # "error" is from the sanitizers
-# "Illegal", "0 errors" and "suppressed errors" are from Valgrind.
-ECOUNT=$("$EGREP" '(Error|ERROR|error|FAILED|Illegal)' $TEST_RESULTS | "$EGREP" -v '( 0 errors|suppressed errors|error detector)' | wc -l | "$AWK" '{print $1}')
+# "Illegal", "Conditional", "0 errors" and "suppressed errors" are from Valgrind.
+ECOUNT=$("$EGREP" '(Error|ERROR|error|FAILED|Illegal|Conditional)' $TEST_RESULTS | "$EGREP" -v '( 0 errors|suppressed errors|error detector)' | wc -l | "$AWK" '{print $1}')
 if (( "$ECOUNT" == "0" )); then
 	echo "No failures detected" | tee -a "$TEST_RESULTS"
 else