DragonFlyBSD Flips On Compiler-Based Retpoline Support For Its Kernel, Also Adds SMAP/SMEP

In addition to DragonFlyBSD seeing MDS "Zombie Load" mitigations this week, the DragonFlyBSD kernel now has better Spectre Variant Two coverage with making use of the GCC compiler support.

DragonFlyBSD switched to GCC 8 by default at the end of last year and that allows them now to enable -mindirect-branch=thunk-inline as part of the Spectre Variant Two mitigation strategy. Their earlier GCC5 compiler didn't offer this support albeit it took them a while still to enable this compiler flag by default when compiling the kernel.

This kernel flag is needed inline Retpoline-based methods for software-based Spectre V2 mitigation. When enabling the support, DragonFlyBSD lead developer Matthew Dillon noted he didn't find a change in his simple benchmark of doing a generic build kernel compilation test.

Separately and unrelated to Spectre but in the name of security, Matthew Dillon also added support to the DragonFlyBSD kernel for SMAP and SMEP.