Skip to content

fix(vex): decode arm64 MRS of all EL0-visible ID registers - #59

Merged
not-matthias merged 2 commits into
masterfrom
cod-4082-arm64-mrs-of-id_aa64fpfr0_el1-and-other-id-registers-is-not
Nov 2, 2026
Merged

not-matthias merged 2 commits into
masterfrom
cod-4082-arm64-mrs-of-id_aa64fpfr0_el1-and-other-id-registers-is-not

Conversation

@not-matthias

Copy link
Copy Markdown
Member

Decode arm64 MRS of every ID register Linux emulates for EL0, and of TPIDRRO_EL0, instead of raising SIGILL.

Linux traps and emulates EL0 reads of Op0=3, Op1=0, CRn=0, CRm=2..7, returning the sanitized value or 0 for untracked registers (is_emulated() / emulate_sys_reg() in arch/arm64/kernel/cpufeature.c). VEX decoded only part of that range, so reads such as ID_AA64FPFR0_EL1 worked natively but crashed under Valgrind. NumKong reads it unconditionally in a load-time constructor, so import numkong (and import usearch >= 2.25) died with exit 132 and no traceback.

Changes:

  • One catch-all case after the specific ID-register cases returns 0 for any remaining S3_0_C0_C<2..7>_<op2>. This reports the features as absent, consistent with the SVE-free PFR0 and zero PFR1 Valgrind already reports and with the HWCAPs it hides. An exhaustive check over all 128 CRm/op2 encodings in CRn=0 shows the decoder now accepts exactly the set the kernel emulates (CRm=1 and unknown CRm=0 encodings still SIGILL, as natively).
  • The case labelled ID_AA64ZFR0_EL1 actually decodes 0xD5380440 = ID_AA64PFR2_EL1; relabelled.
  • MRS TPIDRRO_EL0 returns 0: EL0 may read it (Arm ARM), and Linux zeroes it for AArch64 tasks (tls_thread_switch()). MSR to it stays undefined, as on hardware.
  • New none/tests/arm64/mrs_id_regs regression test.

Verification (x86_64 host, aarch64 cross-build run under qemu-aarch64 -cpu max; not yet run on real arm64 hardware, and CI does not run arm64 tests):

mrs_id_regs import numkong (7.6.0, CPython 3.12)
master SIGILL, exit 132 SIGILL at the ID_AA64FPFR0_EL1 read, exit 132
this PR passes, output matches imports; capabilities serial, neon

Encodings cross-checked against Linux arch/arm64/tools/sysreg and the LLVM disassembler. Upstream has the same gap (KDE bug 487413).

Closes #58

Linux emulates EL0 reads of the ID registers in Op0=3, Op1=0, CRn=0,
CRm=2..7 and returns 0 for registers it does not track, so these reads
never trap natively. VEX decoded only some of them and raised SIGILL for
the rest, e.g. ID_AA64FPFR0_EL1, which NumKong reads at import time.

Return 0 for every encoding in that range that no specific case
handles, reporting the features as absent. Also relabel the case for
0xD5380440, which decodes ID_AA64PFR2_EL1, not ID_AA64ZFR0_EL1.

Closes #58
@not-matthias not-matthias changed the title fix(vex): decode arm64 MRS of all EL0-visible ID registers (COD-4082) fix(vex): decode arm64 MRS of all EL0-visible ID registers Nov 2, 2026
@not-matthias
not-matthias marked this pull request as ready for review November 2, 2026 08:38
@greptile-apps

greptile-apps Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

RetriggerView in GreptileConfidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Extends ARM64 register reads so programs can check additional CPU features without hitting SIGILL.

  • Arm64 programs can read the remaining EL0 ID registers under Valgrind.
  • Arm64 reads of TPIDRRO_EL0 return zero under Valgrind.

No actionable issues found. Runtime tests were not run during this review.

Reviews (1) · Last reviewed commit: "fix(vex): decode arm64 MRS of TPIDRRO_EL..." · Reviewed by Greptile

@codspeed

codspeed Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 84 untouched benchmarks
⏩ 60 skipped benchmarks1


Comparing cod-4082-arm64-mrs-of-id_aa64fpfr0_el1-and-other-id-registers-is-not (8a69791) with master (8f356dd)

Open in CodSpeed

Footnotes

  1. 60 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@GuillaumeLagrange GuillaumeLagrange left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

olgtm, quite niche but always good to fix

Comment thread CODSPEED-CHANGELOG.md Resolved
EL0 may read TPIDRRO_EL0, and Linux zeroes it for AArch64 tasks, so the
read succeeds natively. VEX had no case for it and raised SIGILL. Return
0, matching the kernel.
@not-matthias
not-matthias force-pushed the cod-4082-arm64-mrs-of-id_aa64fpfr0_el1-and-other-id-registers-is-not branch from a205ba0 to 8a69791 Compare November 2, 2026 16:40
@not-matthias
not-matthias merged commit 4f30939 into master Nov 2, 2026
10 checks passed
@not-matthias
not-matthias deleted the cod-4082-arm64-mrs-of-id_aa64fpfr0_el1-and-other-id-registers-is-not branch November 2, 2026 16:58
gimsesu pushed a commit to gimsesu/opentelemetry-collector that referenced this pull request Nov 3, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) |
action | patch | `v5.6.0` → `v5.6.3` |
|
[github/codeql-action](https://redirect.github.com/github/codeql-action)
| action | patch | `v4.39.1` → `v4.39.2` |

---

### Release Notes

<details>
<summary>CodSpeedHQ/action</summary>

###
[`v5.6.3`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.6.3)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.6.1...v5.6.3)

Bumps the CodSpeed runner to
[v5.6.3](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.6.3),
including
[v5.6.2](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.6.2).

##### Highlights

##### Go benchmark times match `go test`

`b.Loop()` benchmarks that stop and restart the timer inside an
iteration now report all of their timed work. A round previously counted
only the time since the most recent `StartTimer`, so results for those
benchmarks will move.

##### Unsupported `go test` flags no longer fail the run

`go test -p 1 ./... -bench .` used to strip `-p`, parse `1` as a
package, and fail with `package 1 is not in std` after every benchmark
had passed. Flags and their values are now dropped together.

##### Fixed randomness in CPU Simulation

`getrandom()`, `/dev/urandom`, `AT_RANDOM` and hardware RNG instructions
now return the same values on every CPU Simulation run, removing one
source of run-to-run variance.

##### Fixes

- Simulation: fix SIGILL on arm64 when programs read previously
unsupported CPU ID registers or `TPIDRRO_EL0`
([#&open-telemetry#8203;59](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/59)).
- Go: benchmarks that draw from the global `math/rand` now start from
the same seed on every run, so their results no longer vary between runs
([#&open-telemetry#8203;596](https://redirect.github.com/CodSpeedHQ/codspeed/pull/596)).

##### 🚀 Features

- Seed Go's global math/rand deterministically
([#&open-telemetry#8203;596](https://redirect.github.com/CodSpeedHQ/action/issues/596))
by [@&open-telemetry#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&open-telemetry#8203;596](https://redirect.github.com/CodSpeedHQ/runner/pull/596)
- Always enable deterministic RNG
([#&open-telemetry#8203;600](https://redirect.github.com/CodSpeedHQ/action/issues/600))
by [@&open-telemetry#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&open-telemetry#8203;600](https://redirect.github.com/CodSpeedHQ/runner/pull/600)

##### 🐛 Bug Fixes

- Bump go-runner to
[1.4.0](https://redirect.github.com/CodSpeedHQ/codspeed-go/releases/tag/v1.4.0)
([#&open-telemetry#8203;605](https://redirect.github.com/CodSpeedHQ/action/issues/605))
by [@&open-telemetry#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&open-telemetry#8203;605](https://redirect.github.com/CodSpeedHQ/runner/pull/605)
- fix(cli): drop the value of unsupported go test flags by
[@&open-telemetry#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/codspeed-go#67](https://redirect.github.com/CodSpeedHQ/codspeed-go/pull/67)
- fix(go-runner): count all timed segments of a b.Loop() iteration by
[@&open-telemetry#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/codspeed-go#69](https://redirect.github.com/CodSpeedHQ/codspeed-go/pull/69)

##### ⚙️ Internals

- Bump pinned valgrind-codspeed to
[3.26.0-0codspeed12](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed12)
([#&open-telemetry#8203;604](https://redirect.github.com/CodSpeedHQ/action/issues/604))
by [@&open-telemetry#8203;adriencaccia](https://redirect.github.com/adriencaccia) in
[#&open-telemetry#8203;604](https://redirect.github.com/CodSpeedHQ/runner/pull/604)
- feat: add --deterministic-rng to make client randomness reproducible
by [@&open-telemetry#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/valgrind-codspeed#54](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/54)
- feat(vex): serve arm64 RNDR and RNDRRS with --deterministic-rng by
[@&open-telemetry#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/valgrind-codspeed#56](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/56)
- fix(vex): decode arm64 MRS of all EL0-visible ID registers by
[@&open-telemetry#8203;not-matthias](https://redirect.github.com/not-matthias) in
[CodSpeedHQ/valgrind-codspeed#59](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/59)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- chore: bump runner version to 5.6.2 by
[@&open-telemetry#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&open-telemetry#8203;255](https://redirect.github.com/CodSpeedHQ/action/pull/255)
- chore: bump runner version to 5.6.3 by
[@&open-telemetry#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&open-telemetry#8203;256](https://redirect.github.com/CodSpeedHQ/action/pull/256)

**Full Changelog**:
<CodSpeedHQ/action@v5.6.1...v5.6.3>

###
[`v5.6.1`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.6.1)

[Compare
Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.6.0...v5.6.1)

Bumps the CodSpeed runner to
[v5.6.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.6.1).

##### Fixes

- Walltime: the runner no longer hangs after the benchmark exits when a
Python process forks and leaves a corrupted perf jitdump
([#&open-telemetry#8203;599](https://redirect.github.com/CodSpeedHQ/codspeed/pull/599))
- Simulation: stop the libpython symlink warning from firing falsely
([#&open-telemetry#8203;594](https://redirect.github.com/CodSpeedHQ/codspeed/pull/594))

##### 🐛 Bug Fixes

- Stop the libpython symlink warning from firing falsely by
[@&open-telemetry#8203;not-matthias](https://redirect.github.com/not-matthias) in
[#&open-telemetry#8203;594](https://redirect.github.com/CodSpeedHQ/runner/pull/594)

##### 💼 Other

- Bump submodule to not loop on corrupted jit dump by
[@&open-telemetry#8203;GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange)
in [#&open-telemetry#8203;599](https://redirect.github.com/CodSpeedHQ/runner/pull/599)

**Full Runner Changelog**:
<https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md>

#### What's Changed

- docs(examples): update the example workflows by
[@&open-telemetry#8203;SuperMuel](https://redirect.github.com/SuperMuel) in
[#&open-telemetry#8203;252](https://redirect.github.com/CodSpeedHQ/action/pull/252)
- chore: bump runner version to 5.6.1 by
[@&open-telemetry#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in [#&open-telemetry#8203;254](https://redirect.github.com/CodSpeedHQ/action/pull/254)

#### New Contributors

- [@&open-telemetry#8203;SuperMuel](https://redirect.github.com/SuperMuel) made their
first contribution in
[#&open-telemetry#8203;252](https://redirect.github.com/CodSpeedHQ/action/pull/252)

**Full Changelog**:
<CodSpeedHQ/action@v5.6.0...v5.6.1>

</details>

<details>
<summary>github/codeql-action</summary>

###
[`v4.39.2`](https://redirect.github.com/github/codeql-action/releases/tag/v4.39.2)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v4.39.1...v4.39.2)

- Update default CodeQL bundle version to
[2.27.4](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4).
[#&open-telemetry#8203;4284](https://redirect.github.com/github/codeql-action/pull/4284)
- *Upcoming breaking change*: CodeQL version 2.22.3 and earlier were
discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18,
and will be unsupported by the next minor release of the CodeQL Action.
Added a deprecation warning for customers using these versions of
CodeQL.
[#&open-telemetry#8203;4266](https://redirect.github.com/github/codeql-action/pull/4266)
- Starting with macOS 27 and Xcode 27, traced analyses are unsupported.
See [this blog post for more
information](https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/).
The CodeQL Action will now try to identify if a workflow is about to
perform a traced analysis on version 27 or above of macOS or Xcode. If
so, the CodeQL Action will emit a corresponding warning that will also
be visible on the [Tool Status
Page](https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning).
This check will be rolled out following this release of the CodeQL
Action.
[#&open-telemetry#8203;4221](https://redirect.github.com/github/codeql-action/pull/4221)
- The undocumented TRAP cache cleanup feature that could be enabled
using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable has
been removed, as announced in the release notes for CodeQL Action
4.35.2. The `analyze` Action now warns if this environment variable is
set. If you used TRAP cache cleanup to limit Actions cache usage, we
recommend disabling TRAP caching by passing the `trap-caching: false`
input to the `init` Action.
[#&open-telemetry#8203;4243](https://redirect.github.com/github/codeql-action/pull/4243)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "on tuesday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/open-telemetry/opentelemetry-collector).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMDIuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjIwNC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZWJvdCJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

arm64: MRS of ID_AA64FPFR0_EL1 and other ID registers is not decoded, so the guest gets SIGILL (breaks import numkong)

2 participants