morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #6592] [Bug] PTX inspection rejects valid percent-prefixed kernel identifiers #3978

New issue

Closed

opened 2026-10-31 00:45:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:45:44 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6592

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

inspect-gpu-code-objects recognizes a standalone PTX 7.0 file with kernel %kernel, then marks the PTX object malformed, reports Malformed PTX entry name or parameters, and returns no kernels. Removing only the leading % from the entry name makes the control decode completely.

Reproduction

Executed once for each input. REA_CHECKOUT denotes a built source checkout at the revision below; run these commands from a disposable directory with Node.js v24.22.1 on PATH.

cat > percent-entry.ptx <<'PTX'
.version 7.0
.target sm_80
.address_size 64
.visible .entry %kernel() { ret; }
PTX
node "$REA_CHECKOUT/scripts/rea.mjs" inspect-gpu-code-objects percent-entry.ptx --analysis kernels --detail complete --json

The executed control used the same text with kernel() in place of %kernel() and filename plain-entry-control.ptx, then ran the same CLI arguments with that filename.

Expected behavior

Return the %kernel declaration with zero parameters, as for the otherwise identical control. NVIDIA's PTX identifier grammar permits a leading % followed by identifier characters. REA advertises standalone PTX and kernel declarations; no entry-name restriction excluding this grammar is documented.

Impact and scope

The sole kernel declaration is dropped from this valid 79-byte input, and the object receives an incorrect malformed-input diagnosis. One failure and one passing control were observed. Renaming in a disposable copy works for declaration analysis but changes the kernel name, file bytes and digest. Embedded PTX, other percent-prefixed names, and CUDA compilation/execution were not tested.

REA version

6.7.0; source revision 642f6571ea9d333ea50114c25e648dbb5b8a3c46. The source launcher's --version printed 6.7.0.

Runtime and platform

Node.js v24.22.1; Omarchy 4.0.6, Linux 7.2.8-9-omarchy, x86_64, glibc 2.44. Static reader only; no CUDA assembler, GPU runtime, Hopper, or Ghidra was invoked.

Target and artifact context

Synthetic UTF-8 standalone PTX 7.0, target sm_80, 64-bit address size. Failing fixture: 79 bytes, SHA-256 f456d12307beb2b1836e29db0243cd6d732577055e9f06dc598e72d620ab4759.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Fields selected from the actual CLI normalized_result:

{
  "format": "ptx",
  "coverage": { "discovery": "complete", "payloads": "partial" },
  "objects": [{
    "kind": "ptx",
    "target": "sm_80",
    "inspection": "malformed",
    "limitations": ["Malformed PTX entry name or parameters"]
  }],
  "kernels": []
}

Both commands exited 0 with empty stderr. The control returned objects[0].inspection: "complete", coverage.payloads: "complete" and kernel kernel with parameter_count: 0, parameter_bytes: 0.

Expected source: NVIDIA identifier grammar and REA documentation linked above.
Failure source: observed public CLI result; source-derived diagnosis below.
Evidence provenance: observed.
Local verification: reproduced.
Reproduction completeness: complete; fixture validity is grounded in the published grammar, not an assembler run.

Typed outcome or recovery expected

Retain the ordinary PTX kernel fact with the original %kernel name and complete inspection of this otherwise supported declaration.

Analysis or suspected cause

Source-derived: the lexer preserves %kernel as one token, but the entry-name guard excludes % as its first character. The inventory consumer catches that format failure and keeps an object-level malformed result before yielding the kernel.

Additional context

Open issue bodies and an all-state gh search issues --repo morluto/rea --match title,body search for PTX and PTX identifier found no report of this trigger. Related closed #6493 concerned an omitted optional parameter list; this fixture includes (). Open #6494 concerns compute_80; this fixture uses sm_80. A fresh pre-submission search also found no duplicate.

NOT_ENOUGH_INFO: first affected release and real CUDA producer prevalence were not investigated.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A valid bounded PTX input loses its sole kernel declaration and receives a false malformed diagnosis; the one-character name control succeeds.
Workaround status: unverified
Workaround basis: The observed rename control changes the required kernel name and artifact identity. No option preserving the original artifact and name was demonstrated.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6592 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior `inspect-gpu-code-objects` recognizes a standalone PTX 7.0 file with kernel `%kernel`, then marks the PTX object `malformed`, reports `Malformed PTX entry name or parameters`, and returns no kernels. Removing only the leading `%` from the entry name makes the control decode completely. ### Reproduction Executed once for each input. `REA_CHECKOUT` denotes a built source checkout at the revision below; run these commands from a disposable directory with Node.js v24.22.1 on `PATH`. ```sh cat > percent-entry.ptx <<'PTX' .version 7.0 .target sm_80 .address_size 64 .visible .entry %kernel() { ret; } PTX node "$REA_CHECKOUT/scripts/rea.mjs" inspect-gpu-code-objects percent-entry.ptx --analysis kernels --detail complete --json ``` The executed control used the same text with `kernel()` in place of `%kernel()` and filename `plain-entry-control.ptx`, then ran the same CLI arguments with that filename. ### Expected behavior Return the `%kernel` declaration with zero parameters, as for the otherwise identical control. NVIDIA's [PTX identifier grammar](https://docs.nvidia.com/cuda/parallel-thread-execution/index.html#identifiers) permits a leading `%` followed by identifier characters. REA advertises [standalone PTX and kernel declarations](https://github.com/morluto/rea/blob/642f6571ea9d333ea50114c25e648dbb5b8a3c46/docs/gpu-code-objects.md); no entry-name restriction excluding this grammar is documented. ### Impact and scope The sole kernel declaration is dropped from this valid 79-byte input, and the object receives an incorrect malformed-input diagnosis. One failure and one passing control were observed. Renaming in a disposable copy works for declaration analysis but changes the kernel name, file bytes and digest. Embedded PTX, other percent-prefixed names, and CUDA compilation/execution were not tested. ### REA version 6.7.0; source revision `642f6571ea9d333ea50114c25e648dbb5b8a3c46`. The source launcher's `--version` printed `6.7.0`. ### Runtime and platform Node.js v24.22.1; Omarchy 4.0.6, Linux 7.2.8-9-omarchy, x86_64, glibc 2.44. Static reader only; no CUDA assembler, GPU runtime, Hopper, or Ghidra was invoked. ### Target and artifact context Synthetic UTF-8 standalone PTX 7.0, target `sm_80`, 64-bit address size. Failing fixture: 79 bytes, SHA-256 `f456d12307beb2b1836e29db0243cd6d732577055e9f06dc598e72d620ab4759`. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence Fields selected from the actual CLI `normalized_result`: ```json { "format": "ptx", "coverage": { "discovery": "complete", "payloads": "partial" }, "objects": [{ "kind": "ptx", "target": "sm_80", "inspection": "malformed", "limitations": ["Malformed PTX entry name or parameters"] }], "kernels": [] } ``` Both commands exited 0 with empty stderr. The control returned `objects[0].inspection: "complete"`, `coverage.payloads: "complete"` and kernel `kernel` with `parameter_count: 0`, `parameter_bytes: 0`. - Expected source: NVIDIA identifier grammar and REA documentation linked above. - Failure source: observed public CLI result; source-derived diagnosis below. - Evidence provenance: observed. - Local verification: reproduced. - Reproduction completeness: complete; fixture validity is grounded in the published grammar, not an assembler run. ### Typed outcome or recovery expected Retain the ordinary PTX kernel fact with the original `%kernel` name and complete inspection of this otherwise supported declaration. ### Analysis or suspected cause Source-derived: [the lexer](https://github.com/morluto/rea/blob/642f6571ea9d333ea50114c25e648dbb5b8a3c46/src/gpu/PtxKernels.ts#L57-L66) preserves `%kernel` as one token, but [the entry-name guard](https://github.com/morluto/rea/blob/642f6571ea9d333ea50114c25e648dbb5b8a3c46/src/gpu/PtxKernels.ts#L212-L215) excludes `%` as its first character. [The inventory consumer](https://github.com/morluto/rea/blob/642f6571ea9d333ea50114c25e648dbb5b8a3c46/src/gpu/GpuInventory.ts#L358-L388) catches that format failure and keeps an object-level malformed result before yielding the kernel. ### Additional context Open issue bodies and an all-state `gh search issues --repo morluto/rea --match title,body` search for `PTX` and `PTX identifier` found no report of this trigger. Related closed [#6493](https://github.com/morluto/rea/issues/6493) concerned an omitted optional parameter list; this fixture includes `()`. Open [#6494](https://github.com/morluto/rea/issues/6494) concerns `compute_80`; this fixture uses `sm_80`. A fresh pre-submission search also found no duplicate. NOT_ENOUGH_INFO: first affected release and real CUDA producer prevalence were not investigated. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A valid bounded PTX input loses its sole kernel declaration and receives a false malformed diagnosis; the one-character name control succeeds. - Workaround status: unverified - Workaround basis: The observed rename control changes the required kernel name and artifact identity. No option preserving the original artifact and name was demonstrated.

bsakaguchi closed this issue

2026-10-31 00:45:44 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3978

No description provided.

Rows
Columns