DragonFlyBSD Flips On Compiler-Based Retpoline Support For Its Kernel, Also Adds SMAP/SMEP

DragonFlyBSD switched to GCC 8 by default at the end of last year and that allows them now to enable -mindirect-branch=thunk-inline as part of the Spectre Variant Two mitigation strategy. Their earlier GCC5 compiler didn't offer this support albeit it took them a while still to enable this compiler flag by default when compiling the kernel.
This kernel flag is needed inline Retpoline-based methods for software-based Spectre V2 mitigation. When enabling the support, DragonFlyBSD lead developer Matthew Dillon noted he didn't find a change in his simple benchmark of doing a generic build kernel compilation test.
Separately and unrelated to Spectre but in the name of security, Matthew Dillon also added support to the DragonFlyBSD kernel for SMAP and SMEP.
Add A Comment