Linux Prepares Straight Line Speculation "SLS" Mitigation For x86/x86_64 CPUs

Last month I reported on activity around Straight Line Speculation "SLS" mitigation for x86_64 CPUs, similar to the work carried out by Arm last year on their SLS vulnerability. That work on the x86 (x86_64 inclusive) side has now been merged to GCC 12 Git and a kernel patch is expected to come shortly that will flip it on as the latest CPU security protection.

Prior to a few weeks ago, much of the Straight Line Speculation talk was in reference to mitigating on Arm with GCC and LLVM/Clang having already merged their mitigation. But now there has been increasing x86_64 activity culminating with the GNU Compiler Collection support being merged on Wednesday.

The merged change introduces the -mharden-sls= option for x86_64 and includes values of none, all, return, or indirect-branch. The behavior mitigates against straight-line speculation of speculatively executing instructions linearly in memory past an unconditional change in control flow. The mitigation is handled by adding an INT3 instruction after function returns and indirect branches.

There was already a Linux kernel patch proposed to make use of this compiler SLS hardening option where available. In the GCC bug comments it's mentioned a new patch is expected to be posted soon (now that the GCC patch is merged) with a proposal to use the option for all RETPOLINE-enabled kernel builds. In turn this would effectively see the option enabled for most kernel builds out there as far as production OS vendor kernel builds are concerned, assuming the patch is accepted. We'll see though if more discussions over x86_64 SLS real-world impact or new disclosures come up soon given the recent industry developer interest.

GCC 12 adds the Straight Line Speculation mitigation for Intel / AMD (x86/x86_64) CPUs.

The GCC 12.1 stable compiler release with this new "-mharden-sls=" option should see its stable release around April if GNU compiler trends hold true. I'll be running some benchmarks soon to confirm any performance impact around this compiler option and the Linux kernel builds at least and potentially other relevant software.