Re: [PATCH RFC] x86/syscall: Dispatch via sys_call_table when Spectre v2 and BHI are off

[Andrew Cooper]

> I do wonder if we could do computed jumps. It would be lovely if we
> could basically do something like
>
>       # syscall number in %rax
>       leaq table(%rax,%rax,4),%rax
>       jmp *%rax
> table:
>      jmp syscall0
>      jmp syscall1
>      jmp syscall2
>     ....
>
> and avoid any indirect memory lookup or indirect branches (outside of
> the one computed one). And no extra call/ret frame.

You would need ENDBR64's too, when building for CET-IBT.

> It's possible that the branch prediction hardware hates those kinds of
> very dense jmp patterns, though. I don't know.

This doesn't buy you anything, except a larger code footprint and more
branch predictor pressure.

The moment you've got any indirect branch reasonable from the syscall
entrypoint, you're open to all the Spectre v2 attacks.

That's fine if the user wants to go fast, but then just use a real jump
table pointing to the real system calls.  This is a Not-Inveted-Here
halfway house which is just extra bytes to decode and an extra jump to
perform.

~Andrew