Re: [PATCH 3/3] objtool/x86: Fix NOP decode

Peter Zijlstra
2025-09-24T18:42:02Z

On Wed, Sep 24, 2025 at 07:34:00PM +0200, Alexandre Chartre wrote:
>
> On 9/24/25 15:45, Peter Zijlstra wrote:
> > For x86_64 the kernel consistently uses 2 instructions for all NOPs:
> >
> > 90 - NOP
> > 0f 1f /0 - NOPL
> >
> >
> > Notably:
> >
> > - REP NOP is PAUSE, not a NOP instruction.
> >
> > - 0f {0c...0f} is reserved space,
> > except for 0f 0d /1, which is PREFETCHW, not a NOP.
> >
> > - 0f {19,1c...1f} is reserved space,
> > except for 0f 1f /0, which is NOPL.
> >
> > Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> > ---
> > tools/objtool/arch/x86/decode.c | 12 +++++++-----
> > 1 file changed, 7 insertions(+), 5 deletions(-)
> >
> > --- a/tools/objtool/arch/x86/decode.c
> > +++ b/tools/objtool/arch/x86/decode.c
> > @@ -494,7 +494,8 @@ int arch_decode_instruction(struct objto
> > break;
> > case 0x90:
> > + if (prefix != 0xf3) /* REP NOP := PAUSE */
> > + insn->type = INSN_NOP;
> > break;
>
> So this covers NOP1 (0x90) and NOP2 (0x66 0x90), right?

Yes. Everything with opcode 0x90, except 0xf3 0x90, which as stated is
PAUSE.

> > case 0x9c:
> > @@ -547,13 +548,14 @@ int arch_decode_instruction(struct objto
> > } else if (op2 == 0x0b || op2 == 0xb9) {
> > + /* ud2, ud1 */
> > insn->type = INSN_BUG;
> > + } else if (op2 == 0x1f) {
> > + /* 0f 1f /0 := NOPL */
> > + if (modrm_reg == 0)
> > + insn->type = INSN_NOP;
> > } else if (op2 == 0x1e) {
>
> And this covers all other NOPs (0x0f 0x1f ...), including NOP6 which has
> a 0x66 preifx (0x66 0xf 0x1f ...) ?

Sorta, it accepts everything with opcode 0f 1f and modrm_reg==0, which is
how NOPL is encoded.

Both: 66 66 66 66 66 66 66 66 66 66 66 66 66 66 90 (NOP15)
And: 66 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00 (NOP15)

will be accepted here as max length instructions. The kernel will not
actually use those, since a bunch of micro archs have decode penalties
for too many prefixes.

> From arch/x86/include/asm/nops.h we have:

You're looking at old code :-)

> /*
> * Generic 64bit nops from GAS:
> *
> * 1: nop
> * 2: osp nop
> * 3: nopl (%eax)
> * 4: nopl 0x00(%eax)
> * 5: nopl 0x00(%eax,%eax,1)
> * 6: osp nopl 0x00(%eax,%eax,1)
> * 7: nopl 0x00000000(%eax)
> * 8: nopl 0x00000000(%eax,%eax,1)

* 9: cs nopl 0x00000000(%eax,%eax,1)
* 10: osp cs nopl 0x00000000(%eax,%eax,1)
* 11: osp osp cs nopl 0x00000000(%eax,%eax,1)

> */
> #define BYTES_NOP1 0x90
> #define BYTES_NOP2 0x66,BYTES_NOP1
> #define BYTES_NOP3 0x0f,0x1f,0x00
> #define BYTES_NOP4 0x0f,0x1f,0x40,0x00
> #define BYTES_NOP5 0x0f,0x1f,0x44,0x00,0x00
> #define BYTES_NOP6 0x66,BYTES_NOP5
> #define BYTES_NOP7 0x0f,0x1f,0x80,0x00,0x00,0x00,0x00
> #define BYTES_NOP8 0x0f,0x1f,0x84,0x00,0x00,0x00,0x00,0x00

#define BYTES_NOP9 0x2e,BYTES_NOP8
#define BYTES_NOP10 0x66,BYTES_NOP9
#define BYTES_NOP11 0x66,BYTES_NOP10

But yes, first two are NOP and then it switches to NOPL for 3 bytes and
longer (2 opcode, 1 modrm). Where for 11 bytes we have:

- 3 prefixes
- 2 opcode
- 1 modrm
- 1 sib
- 4 displacement