Re: [PATCH RFC] x86/syscall: Dispatch via sys_call_table when Spectre v2 and BHI are off

[Linus Torvalds]

On Mon, 2 Nov 2026 at 10:49, Breno Leitao <leitao@xxxxxxxxxx> wrote:
>
> I am looking at this on top of Peter's "x86: Harden syscall dispatch"
> series [1], and before spending more time on it, I would like to
> clarify how you see this suggestion fitting with Peter's series.
>
> Peter's patch 1 makes -fno-jump-tables unconditional on x86_64 and
> drops array_index_nospec() from the dispatch. Patch 4 then marks every
> syscall __noendbr, since dispatch is only direct calls.

So I'd just make this all a generated asm thing.

It would have to be done as asm, because I don't think gcc (of clang)
understand to use computed branches. They always generate table
lookups.

And doing the system calls as __noendbr is fine, because the resulting
code never does an indirect branch to the system call. The only
indirect branch would be that

      leaq table(%rax,%rax,4),%rax
      jmp *%rax

which does the computed jump (the "table" isn't a table of pointers,
it's just a table of 5-byte "jmp" instructions).

But *those* would have to be marked with endbr, I guess, so they don't
actually end up being 5-byte at all. I guess they'd be 9-byte
sequences ('endbr' is 4 bytes, no?).

So the actual sequence would have to be

      leaq table(%rax,%rax,8),%rax
      jmp *%rax

with that nasty generated sequence of 'endbr ; jmp syscallX' for the table.

           Linus