git: d09a64e15d8f - main - arm64: Enable kernel branch protection

The branch main has been updated by andrew:

URL: https://cgit.FreeBSD.org/src/commit/?id=d09a64e15d8fad6588b9aad62979f20afa8441df

commit d09a64e15d8fad6588b9aad62979f20afa8441df
Author:     Andrew Turner <andrew@FreeBSD.org>
AuthorDate: 2023-10-02 15:55:31 +0000
Commit:     Andrew Turner <andrew@FreeBSD.org>
CommitDate: 2023-10-10 09:52:16 +0000

    arm64: Enable kernel branch protection
    
    Add the build flags to enable branch protection on arm64. This enable
    the use of PAC and BTI in the kernel.
    
    For PAC we already install the kernel keys when entering the kernel
    from userspace so this will start using these to sign the stack.
    
    For BTI we need to mark the kernel page tables with a new guarded page
    field. As this will require all code that could be reached through a
    function pointer with an appropriate branch target instruction we
    are enabling this before setting the field.
    
    As the pointer authentication support shouldn't be reached via a
    function pointer it is safe to not enable the use of BTI there.
    
    Reviewed by:    markj
    Sponsored by:   Arm Ltd
    Differential Revision:  https://reviews.freebsd.org/D42079
---
 sys/conf/kern.mk | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/conf/kern.mk b/sys/conf/kern.mk
index b508bc81b5f0..72b7387d3959 100644
--- a/sys/conf/kern.mk
+++ b/sys/conf/kern.mk
@@ -140,6 +140,8 @@ INLINE_LIMIT?=	8000
 CFLAGS += -mgeneral-regs-only
 # Reserve x18 for pcpu data
 CFLAGS += -ffixed-x18
+# Build with BTI+PAC
+CFLAGS += -mbranch-protection=standard
 INLINE_LIMIT?=	8000
 .endif