Re: [PATCH] bpf, x86: use 32-bit zero idiom for shorter encoding

[Alexei Starovoitov]

On Fri, Sep 25, 2026 at 12:01 AM George Hu <integral@xxxxxxxxxxxxx> wrote:
> -			EMIT3(0x48, 0x31, 0xC0); /* xor rax, rax */
> +			EMIT2(0x31, 0xC0);
>  		else
>  			/* Keep the same instruction layout. */
>  			emit_nops(&prog, 3);     /* nop3 */

No. This breaks tail calls.

xor is 3 bytes to match nop3 in the else branch.
Every tail call jumps to prog->bpf_func + X86_TAIL_CALL_OFFSET of
the target prog, and that is a constant 12 + ENDBR_INSN_SIZE.
With 2 byte xor a tail call into a prog that does tail calls itself
lands one byte into the insn that follows 'mov rbp, rsp'.
Without IBT it is 'sub rsp, imm32' 48 81 EC. Without the first byte
it becomes 'sub esp, imm32' and clears the upper 32 bits of rsp.
With IBT it's the middle of endbr64.

It was xor eax, eax, nop2 and offset 11 before
commit 116e04ba1459 ("bpf, x64: Fix tailcall hierarchy").

pw-bot: cr