[GH-ISSUE #6624] [Bug] CUBIN V2 parameter records are omitted with complete kernel coverage #4009

New issue

Closed

opened 2026-10-31 00:46:01 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:46:01 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6624

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

The public CLI returns parameter_bytes: 20000, parameter_count: null and parameters: [] for a producer-built CUBIN whose kernel has one 20,000-byte parameter. Object inspection and payload coverage are both complete, without an unsupported-parameter limitation. NVIDIA's current cuobjdump identifies its EIATTR_KPARAM_INFO_V2 record as ordinal 0, offset 0, size 0x4e20.

The unchanged source service returns the same facts. Its retained kernels page preserves the empty list, and its targets page reports kernel_coverage: "complete". Controls with 16- and 4100-byte parameters return one correctly sized parameter with complete coverage.

Reproduction

The producer fixture was assembled with NVIDIA ptxas 12.9.86. PTXAS12 below denotes that exact assembler; REA_CHECKOUT denotes a prepared source checkout at the revision below. The producer command and subsequent static reader commands were executed; no kernel was launched.

cat > param-20000.ptx <<'PTX'
.version 8.8
.target sm_80
.address_size 64
.visible .entry k(.param .align 4 .b8 blob[20000]) { ret; }
PTX
"$PTXAS12" --gpu-name sm_80 param-20000.ptx -o cuda12-param-20000.cubin
node "$REA_CHECKOUT/scripts/rea.mjs" inspect-gpu-code-objects cuda12-param-20000.cubin --analysis kernels --detail complete --json
cuobjdump --dump-elf cuda12-param-20000.cubin

The CUBIN is 28,968 bytes, SHA-256 6daac86a7837c1be7433954e8485059f3a803767f976ee584bfba5f1765ec33e. The public CLI inspection ran once per input, exited 0 and emitted no stderr. A separate source-provider run and source-service run agreed for the failing fixture.

Expected behavior

Retain the declared V2 parameter, or explicitly report unsupported parameter decoding and partial coverage. Complete coverage should not conceal a skipped parameter declaration. NVIDIA documents parameters up to 32,764 bytes on Volta and later; this sm_80 fixture is within that limit. The producer and independent metadata reader establish the exact parameter facts.

Impact and scope

Structured signature evidence loses a parameter tuple while coverage claims completeness. The byte total and unrelated kernel facts survive. The demonstrated scope is a standalone CUBIN containing a V2 parameter record; workload prevalence, embedded host containers and GPU behavior were not tested. Static cuobjdump --dump-elf recovers the declaration as a manual workaround.

REA version

Source revision aee249b1ddb3e643b22ce049909160f0ce37a63e; source launcher prints 6.7.0. Both prepared compiled CLI and unchanged source service were executed. Latest published tag rea-agents-6.7.0 is 27dc42d10249f0410904a75c0997842eb03b931c; GPU reader/CLI source paths are absent there. No published-package runtime reproduction is claimed.

Runtime and platform

Node.js v24.22.1; Omarchy 4.0.6, Linux 7.2.8-9-omarchy, x86_64. Public CLI used isolated HOME/XDG directories. Historical fixture producer: NVIDIA ptxas 12.9.86. Independent static oracle: current NVIDIA cuobjdump 13.4.92. A current ptxas 13.4.92 fixture was also checked; see below. Tools remained in disposable storage; no global installation occurred.

Target and artifact context

Unmodified NVIDIA-produced ELF64 CUBIN, target sm_80, kernel k, one aligned byte-array parameter. No GPU, provider engine or target execution was needed.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

cuobjdump: EIATTR_KPARAM_INFO_V2; Index=0; Ordinal=0; Offset=0; Size=0x4e20
REA: parameter_bytes=20000; parameter_count=null; parameters=[]
REA: object inspection=complete; payload coverage=complete
Retained targets page: kernel_coverage=complete

The original numeric record is 04450c000000000000000000204e0000: format 4, attribute 0x45, 12 payload bytes. There is no V2/parameter-decoding limitation in the returned kernel or object.

Expected source: NVIDIA producer, current metadata oracle and large-parameter documentation above.
Failure source: observed public CLI and source service at the stated revision.
Evidence provenance: observed.
Local verification: reproduced.
Reproduction completeness: complete for static standalone inspection.

Typed outcome or recovery expected

One parameter with ordinal 0, offset 0 and size 20000, or explicit partial coverage explaining that the V2 parameter record was not decoded.

Analysis or suspected cause

Source-derived: CudaInfo.ts:92 accepts parameter attribute 0x17 and skips V2 attribute 0x45. It consequently returns no limitation; GpuElfKernels.ts:306 leaves decoding complete.

Additional context

A ptxas 13.4.92 CUBIN from the same PTX also loses its V2 parameter through the public CLI. Its coverage is already partial because REA explicitly treats that producer's ELF target flags as unknown; the historical fixture above isolates the false-completeness behavior. This is not fixed by using the current producer.

Open/closed searches for KPARAM_INFO_V2, CUBIN parameter and parameter/20000 found no matching issue. #6600 concerns extended ELF section indices, and #6594 concerns legacy PTX body parameters; neither uses this numeric record. NOT_ENOUGH_INFO: the first affected source revision and prevalence were not established.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A valid producer-declared parameter disappears from structured CUBIN evidence without a decoding limitation, and the clean fixture and retained target page claim complete coverage.
Workaround status: available
Workaround basis: Executed current cuobjdump --dump-elf returns the parameter's ordinal, offset and size from the unchanged CUBIN, permitting manual static recovery.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6624 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Native analysis or decompilation ## Observed behavior The public CLI returns `parameter_bytes: 20000`, `parameter_count: null` and `parameters: []` for a producer-built CUBIN whose kernel has one 20,000-byte parameter. Object inspection and payload coverage are both `complete`, without an unsupported-parameter limitation. NVIDIA's current `cuobjdump` identifies its `EIATTR_KPARAM_INFO_V2` record as ordinal 0, offset 0, size `0x4e20`. The unchanged source service returns the same facts. Its retained kernels page preserves the empty list, and its targets page reports `kernel_coverage: "complete"`. Controls with 16- and 4100-byte parameters return one correctly sized parameter with complete coverage. ## Reproduction The producer fixture was assembled with NVIDIA ptxas 12.9.86. `PTXAS12` below denotes that exact assembler; `REA_CHECKOUT` denotes a prepared source checkout at the revision below. The producer command and subsequent static reader commands were executed; no kernel was launched. ```sh cat > param-20000.ptx <<'PTX' .version 8.8 .target sm_80 .address_size 64 .visible .entry k(.param .align 4 .b8 blob[20000]) { ret; } PTX "$PTXAS12" --gpu-name sm_80 param-20000.ptx -o cuda12-param-20000.cubin node "$REA_CHECKOUT/scripts/rea.mjs" inspect-gpu-code-objects cuda12-param-20000.cubin --analysis kernels --detail complete --json cuobjdump --dump-elf cuda12-param-20000.cubin ``` The CUBIN is 28,968 bytes, SHA-256 `6daac86a7837c1be7433954e8485059f3a803767f976ee584bfba5f1765ec33e`. The public CLI inspection ran once per input, exited 0 and emitted no stderr. A separate source-provider run and source-service run agreed for the failing fixture. ## Expected behavior Retain the declared V2 parameter, or explicitly report unsupported parameter decoding and partial coverage. Complete coverage should not conceal a skipped parameter declaration. NVIDIA documents [parameters up to 32,764 bytes](https://developer.nvidia.com/blog/cuda-12-1-supports-large-kernel-parameters/) on Volta and later; this sm_80 fixture is within that limit. The producer and independent metadata reader establish the exact parameter facts. ## Impact and scope Structured signature evidence loses a parameter tuple while coverage claims completeness. The byte total and unrelated kernel facts survive. The demonstrated scope is a standalone CUBIN containing a V2 parameter record; workload prevalence, embedded host containers and GPU behavior were not tested. Static `cuobjdump --dump-elf` recovers the declaration as a manual workaround. ## REA version Source revision `aee249b1ddb3e643b22ce049909160f0ce37a63e`; source launcher prints `6.7.0`. Both prepared compiled CLI and unchanged source service were executed. Latest published tag `rea-agents-6.7.0` is `27dc42d10249f0410904a75c0997842eb03b931c`; GPU reader/CLI source paths are absent there. No published-package runtime reproduction is claimed. ## Runtime and platform Node.js v24.22.1; Omarchy 4.0.6, Linux 7.2.8-9-omarchy, x86_64. Public CLI used isolated HOME/XDG directories. Historical fixture producer: NVIDIA ptxas 12.9.86. Independent static oracle: current NVIDIA cuobjdump 13.4.92. A current ptxas 13.4.92 fixture was also checked; see below. Tools remained in disposable storage; no global installation occurred. ## Target and artifact context Unmodified NVIDIA-produced ELF64 CUBIN, target sm_80, kernel `k`, one aligned byte-array parameter. No GPU, provider engine or target execution was needed. ## Interface CLI ## Earliest failure stage Native analysis or reconstruction ## Relevant output or evidence ```text cuobjdump: EIATTR_KPARAM_INFO_V2; Index=0; Ordinal=0; Offset=0; Size=0x4e20 REA: parameter_bytes=20000; parameter_count=null; parameters=[] REA: object inspection=complete; payload coverage=complete Retained targets page: kernel_coverage=complete ``` The original numeric record is `04450c000000000000000000204e0000`: format 4, attribute `0x45`, 12 payload bytes. There is no V2/parameter-decoding limitation in the returned kernel or object. - Expected source: NVIDIA producer, current metadata oracle and large-parameter documentation above. - Failure source: observed public CLI and source service at the stated revision. - Evidence provenance: observed. - Local verification: reproduced. - Reproduction completeness: complete for static standalone inspection. ## Typed outcome or recovery expected One parameter with ordinal 0, offset 0 and size 20000, or explicit partial coverage explaining that the V2 parameter record was not decoded. ## Analysis or suspected cause Source-derived: [CudaInfo.ts:92](https://github.com/morluto/rea/blob/aee249b1ddb3e643b22ce049909160f0ce37a63e/src/gpu/CudaInfo.ts#L92) accepts parameter attribute `0x17` and skips V2 attribute `0x45`. It consequently returns no limitation; [GpuElfKernels.ts:306](https://github.com/morluto/rea/blob/aee249b1ddb3e643b22ce049909160f0ce37a63e/src/gpu/GpuElfKernels.ts#L306) leaves decoding complete. ## Additional context A ptxas 13.4.92 CUBIN from the same PTX also loses its V2 parameter through the public CLI. Its coverage is already partial because REA explicitly treats that producer's ELF target flags as unknown; the historical fixture above isolates the false-completeness behavior. This is not fixed by using the current producer. Open/closed searches for `KPARAM_INFO_V2`, `CUBIN parameter` and parameter/20000 found no matching issue. #6600 concerns extended ELF section indices, and #6594 concerns legacy PTX body parameters; neither uses this numeric record. NOT_ENOUGH_INFO: the first affected source revision and prevalence were not established. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A valid producer-declared parameter disappears from structured CUBIN evidence without a decoding limitation, and the clean fixture and retained target page claim complete coverage. - Workaround status: available - Workaround basis: Executed current cuobjdump --dump-elf returns the parameter's ordinal, offset and size from the unchanged CUBIN, permitting manual static recovery.

bsakaguchi closed this issue

2026-10-31 00:46:02 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:11 +00:00

[PR #4238] [MERGED] fix(lifecycle): preserve ownership, cancellation, and cleanup outcomes #6141