Sk8Scott's x86-64-v2 kernel for Nehalem through Ivy Bridge.

Built at -march=x86-64-v2 for CPUs with SSE4.2 and POPCNT and no AVX: Nehalem, Westmere, Sandy Bridge, Ivy Bridge, Silvermont, Bulldozer, Piledriver, Steamroller, Excavator, Jaguar. Every choice below spends a fixed safety budget to buy cycles on a single-tenant machine that runs only trusted code.

Build. The kernel image does not take rpm Optflags, and 7.2.x has no MX86_64_V2 Kconfig symbol, so -march=x86-64-v2 goes on the make line through KCFLAGS. The kernel compiles its own code with SSE disabled, so this reaches scalar instruction selection only; an instruction-level comparison against the stock image shows no material codegen difference. The build-side saving comes from dropping DEBUG_INFO and DEBUG_INFO_BTF, which removes several hundred megabytes of output and roughly forty percent of compile time.

Speculation mitigations, twenty-four disabled. PAGE_TABLE_ISOLATION, RETPOLINE, RETHUNK, UNRET_ENTRY, CALL_DEPTH_TRACKING, IBPB_ENTRY, IBRS_ENTRY, SRSO, SLS, GDS, RFDS, SPECTRE_BHI, MDS, TAA, MMIO_STALE_DATA, L1TF, RETBLEED, SPECTRE_V1, SPECTRE_V2, SRBDS, SSB, ITS, TSA, VMSCAPE. These defend a kernel against hostile code on shared silicon. With one tenant, no untrusted binaries and no remote code execution, the fences and buffer clears on every entry and syscall are cost without a threat. Disabling them restores the direct syscall path and drops the branch-predictor barriers from context switches.

Allocator and copy paths. SLAB_FREELIST_RANDOM, SLAB_FREELIST_HARDENED and SLAB_BUCKETS cost a store and a load on every allocation. PAGE_POISONING, PAGE_TABLE_CHECK and SHUFFLE_PAGE_ALLOCATOR spend memory bandwidth, the scarce resource on this class of machine. HARDENED_USERCOPY and FORTIFY_SOURCE add bounds checks to every user copy. STACKPROTECTOR and STACKPROTECTOR_STRONG add a canary load and compare to every function. RANDOMIZE_KSTACK_OFFSET and VMAP_STACK add per-syscall stack randomisation and guard pages. RANDOMIZE_BASE costs boot time and page-table locality.

Scheduler and CPU features. SCHED_CORE constrains SMT siblings, and placement is controlled by hand here. X86_KERNEL_IBT and X86_UMIP implement CET and user-mode instruction prevention, neither of which this silicon enforces.

Tracing. FTRACE, FUNCTION_TRACER, FUNCTION_GRAPH_TRACER and TRACEPOINTS plant an mcount or fentry call site in every function. Measurement here comes from perf PMU counters, which need none of it.

Build artefacts. DEBUG_INFO and DEBUG_INFO_BTF roughly double compile time and add several hundred megabytes of output. KALLSYMS still decodes an oops.

Kept, with reasons. KALLSYMS for symbol resolution in oops and perf, one to two megabytes and no runtime cost. CRASH_DUMP because kdump is wanted for crash forensics. SECCOMP because systemd SystemCallFilter units depend on it. BPF_SYSCALL and BPF_JIT because they cost nothing while unused, and systemd and nftables depend on them.

Runtime flags. mitigations=off, selinux=0, preempt=full, crashkernel retained.

Totals. Sixty-one options inventoried, fifty-three disabled, three forced on by the packaging (MODULE_SIG, KPROBES, QUOTA), five kept deliberately. kernel-source is a multibuild and kernel-default is the installable flavour, built against openSUSE:Factory standard for x86_64.