LLVM Adds Additional Protections For Arm's SLS Speculation Vulnerability Mitigation

Revealed earlier this year was the Arm Straight Line Speculation (SLS) vulnerability. SLS was a Google discovery for modern ARMv8 CPUs where speculative execution past unconditional changes in control flow could lead to information disclosure via side-channel analysis. Arm recommended compiler-based mitigations to insert speculation barriers after vulnerable instructions, which GCC and LLVM began adding opt-in protections right away. This weekend some additional SLS functionality was added for LLVM.

On top of the prior SLS mitigation options for LLVM (the initial hardening pass - AArch64SLSHardeningPass - was just focused on RET and BR instructions), the latest code merged on Saturday is around hardening indirect calls against SLS. LLVM already had the option for hardening against SLS across return and BranchRegister usage while the "HardenSlsBr" is to harden across indirect calls. Like with the existing support, it's off by default but can be enabled with the a new LLVM feature option (harden-sls-blr).

For the Clang compiler front-end, a follow-up commit now supports the -mharden-sls= option for controlling the SLS mitigations on ARMv7-A and newer with values of retbr, blr, or all. Plus some related SLS work as well was merged in the tree for what will be LLVM 12 in a couple months.

More details on the Straight Line Speculation issue via Arm's whitepaper.