morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #6861] [Bug] Post-type PTX alignment qualifiers erase a declared parameter name #4198

New issue

Closed

opened 2026-10-31 00:47:38 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:47:38 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6861

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

The public inspect-gpu-code-objects CLI reports name: null for the explicit payload parameter in .entry k(.param .b8 .align 8 payload[8]). It retains one parameter and the .b8 type, but loses the identifier along with the layout. Moving .align 8 before .b8 restores the identifier and the eight-byte layout. NVIDIA ptxas 13.4.92 successfully assembled both inputs. This report concerns preservation of the known name even if layout decoding remains partial.

Reproduction

From a built source checkout at the revision below, with Node.js 24.22.1 on PATH, save this executed reduced fixture as alignment-name-failure.ptx in a disposable directory:

.version 8.0
.target sm_80
.address_size 64
.visible .entry k(.param .b8 .align 8 payload[8]) { ret; }

With REA_CHECKOUT pointing to that checkout and WORK representing the disposable fixture directory, the executed CLI invocation was:

node "$REA_CHECKOUT/scripts/rea.mjs" inspect-gpu-code-objects "$WORK/alignment-name-failure.ptx" --analysis kernels --detail complete --json

The executed control, alignment-name-control.ptx, changes only the declaration to .param .align 8 .b8 payload[8] and uses the same CLI invocation with that filename. Each reduced input was inspected once through the CLI; both commands exited 0 with empty stderr. Both were also assembled once using ptxas -arch=sm_80 -o output.cubin INPUT.ptx; both assembler invocations exited 0 with empty stderr. The generated CUBINs were never executed.

Expected behavior

Retain name: "payload" in the first parameter row for both accepted declaration orders. If the second ordering is outside the layout decoder's supported subset, preserve the identifier while leaving the layout fields unknown and coverage partial. REA's documented PTX preservation contract says unsupported parameter layouts retain their known facts. NVIDIA's device-function parameter example uses .param .b8 .align 8 py[12]; independent assembly additionally establishes that the reported entry-parameter input is accepted.

Impact and scope

A valid bounded declaration loses its parameter identifier from structured kernel facts. The result is explicitly partial, the parameter count survives, and the original PTX text remains available verbatim in complete Evidence. The observed impact is therefore bounded: an analyst must read the retained source to recover a name already present in the input. The reduced standalone case and its control were tested; the same loss was observed in an earlier two-parameter fixture. Embedded containers, real-application frequency, and MCP transport were not tested.

REA version

Source main 4526862728af01f1135714079c0d8a8c754eb364; built source CLI --version output: 6.7.0. Latest published tag rea-agents-6.7.0 resolves to 27dc42d10249f0410904a75c0997842eb03b931c and contains no src/gpu, src/application/gpu, or src/domain/gpu tree. This is a source-main finding; no failure of the published package is claimed.

Runtime and platform

Node.js v24.22.1; Linux 7.2.8-9-omarchy x86_64; NVIDIA CUDA compilation tools release 13.4, V13.4.92 used only as a syntax oracle. No GPU, target execution, Hopper, or Ghidra was used.

Target and artifact context

Two synthetic ASCII PTX 8.0 files targeting sm_80, address size 64, one entry, one eight-byte parameter, and ret. Only placement of the existing alignment qualifier differs. No private target is involved.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Selected fields from the actual reduced CLI results:

.param .align 8 .b8 payload[8]: parameter_count=1; name="payload"; offset=0; size=8; parameter_bytes=8; inspection=complete; payloads=complete
.param .b8 .align 8 payload[8]: parameter_count=1; name=null; offset=null; size=null; parameter_bytes=null; inspection=partial; payloads=partial
Both: original retained PTX text matches the input; CLI exit=0; stderr empty; ptxas exit=0; assembler stderr empty.

Expected source: REA's known-fact preservation contract, NVIDIA's alignment example, and the successful independent assembler checks above.
Failure source: executed public CLI comparison of the inline fixture and qualifier-order control; an earlier application-service probe observed the same loss.
Evidence provenance: observed.
Local verification: reproduced.
Reproduction completeness: complete for the source CLI and static reader; no published-package or MCP-transport reproduction was performed.

Typed outcome or recovery expected

Keep payload in the structured parameter name regardless of whether size and offset are calculated. Retain the original PTX and honest layout coverage. No new error type is required.

Analysis or suspected cause

Source-derived: the declaration reader handles alignment before the scalar type, and handles post-type .align only while a pointer qualifier is active. In this non-pointer declaration it marks the layout unknown without consuming the numeric alignment operand. The following name check sees 8 rather than payload and emits null. The ordinary identifier is known independently of the layout interpretation.

Additional context

All-state GitHub searches for PTX, GPU, and PTX alignment, together with the supplied open-issue snapshot, found no report of this remaining non-pointer alignment-order trigger. Related closed #6606 used .u64 .ptr .global .align 4 ptr_arg; the present fixture has no pointer qualifier and reaches the remaining non-pointer branch. Closed #6680 concerned multidimensional array suffixes; this fixture has one literal dimension.

Restoration criterion: inspect the unchanged failing fixture and retain name: "payload"; keep its parameter count and exact source text. The control must retain its observed name and eight-byte layout. Unknown layout fields may remain explicitly partial. No fix or restoration was tested. NOT_ENOUGH_INFO: the first affected source revision and real-producer prevalence were not established. Prepared with AI assistance; no project source was changed.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: An independently assembled valid PTX declaration loses its known parameter identifier through the public source CLI; the result is bounded and explicitly partial.
Workaround status: available
Workaround basis: Both observed CLI results retain the complete original PTX text, from which an analyst can recover the identifier without modifying the artifact.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6861 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Native analysis or decompilation ## Observed behavior The public `inspect-gpu-code-objects` CLI reports `name: null` for the explicit `payload` parameter in `.entry k(.param .b8 .align 8 payload[8])`. It retains one parameter and the `.b8` type, but loses the identifier along with the layout. Moving `.align 8` before `.b8` restores the identifier and the eight-byte layout. NVIDIA `ptxas` 13.4.92 successfully assembled both inputs. This report concerns preservation of the known name even if layout decoding remains partial. ## Reproduction From a built source checkout at the revision below, with Node.js 24.22.1 on `PATH`, save this executed reduced fixture as `alignment-name-failure.ptx` in a disposable directory: ```ptx .version 8.0 .target sm_80 .address_size 64 .visible .entry k(.param .b8 .align 8 payload[8]) { ret; } ``` With `REA_CHECKOUT` pointing to that checkout and `WORK` representing the disposable fixture directory, the executed CLI invocation was: ```sh node "$REA_CHECKOUT/scripts/rea.mjs" inspect-gpu-code-objects "$WORK/alignment-name-failure.ptx" --analysis kernels --detail complete --json ``` The executed control, `alignment-name-control.ptx`, changes only the declaration to `.param .align 8 .b8 payload[8]` and uses the same CLI invocation with that filename. Each reduced input was inspected once through the CLI; both commands exited 0 with empty stderr. Both were also assembled once using `ptxas -arch=sm_80 -o output.cubin INPUT.ptx`; both assembler invocations exited 0 with empty stderr. The generated CUBINs were never executed. ## Expected behavior Retain `name: "payload"` in the first parameter row for both accepted declaration orders. If the second ordering is outside the layout decoder's supported subset, preserve the identifier while leaving the layout fields unknown and coverage partial. REA's [documented PTX preservation contract](https://github.com/morluto/rea/blob/4526862728af01f1135714079c0d8a8c754eb364/docs/gpu-code-objects.md#L100-L114) says unsupported parameter layouts retain their known facts. NVIDIA's [device-function parameter example](https://docs.nvidia.com/cuda/parallel-thread-execution/index.html#device-function-parameters) uses `.param .b8 .align 8 py[12]`; independent assembly additionally establishes that the reported entry-parameter input is accepted. ## Impact and scope A valid bounded declaration loses its parameter identifier from structured kernel facts. The result is explicitly partial, the parameter count survives, and the original PTX text remains available verbatim in complete Evidence. The observed impact is therefore bounded: an analyst must read the retained source to recover a name already present in the input. The reduced standalone case and its control were tested; the same loss was observed in an earlier two-parameter fixture. Embedded containers, real-application frequency, and MCP transport were not tested. ## REA version Source main `4526862728af01f1135714079c0d8a8c754eb364`; built source CLI `--version` output: `6.7.0`. Latest published tag `rea-agents-6.7.0` resolves to `27dc42d10249f0410904a75c0997842eb03b931c` and contains no `src/gpu`, `src/application/gpu`, or `src/domain/gpu` tree. This is a source-main finding; no failure of the published package is claimed. ## Runtime and platform Node.js v24.22.1; Linux 7.2.8-9-omarchy x86_64; NVIDIA CUDA compilation tools release 13.4, V13.4.92 used only as a syntax oracle. No GPU, target execution, Hopper, or Ghidra was used. ## Target and artifact context Two synthetic ASCII PTX 8.0 files targeting `sm_80`, address size 64, one entry, one eight-byte parameter, and `ret`. Only placement of the existing alignment qualifier differs. No private target is involved. ## Interface CLI ## Earliest failure stage Native analysis or reconstruction ## Relevant output or evidence Selected fields from the actual reduced CLI results: ```text .param .align 8 .b8 payload[8]: parameter_count=1; name="payload"; offset=0; size=8; parameter_bytes=8; inspection=complete; payloads=complete .param .b8 .align 8 payload[8]: parameter_count=1; name=null; offset=null; size=null; parameter_bytes=null; inspection=partial; payloads=partial Both: original retained PTX text matches the input; CLI exit=0; stderr empty; ptxas exit=0; assembler stderr empty. ``` - Expected source: REA's known-fact preservation contract, NVIDIA's alignment example, and the successful independent assembler checks above. - Failure source: executed public CLI comparison of the inline fixture and qualifier-order control; an earlier application-service probe observed the same loss. - Evidence provenance: observed. - Local verification: reproduced. - Reproduction completeness: complete for the source CLI and static reader; no published-package or MCP-transport reproduction was performed. ## Typed outcome or recovery expected Keep `payload` in the structured parameter name regardless of whether size and offset are calculated. Retain the original PTX and honest layout coverage. No new error type is required. ## Analysis or suspected cause Source-derived: [the declaration reader](https://github.com/morluto/rea/blob/4526862728af01f1135714079c0d8a8c754eb364/src/gpu/PtxKernels.ts#L160-L194) handles alignment before the scalar type, and handles post-type `.align` only while a pointer qualifier is active. In this non-pointer declaration it marks the layout unknown without consuming the numeric alignment operand. The following name check sees `8` rather than `payload` and emits null. The ordinary identifier is known independently of the layout interpretation. ## Additional context All-state GitHub searches for `PTX`, `GPU`, and `PTX alignment`, together with the supplied open-issue snapshot, found no report of this remaining non-pointer alignment-order trigger. Related closed [#6606](https://github.com/morluto/rea/issues/6606) used `.u64 .ptr .global .align 4 ptr_arg`; the present fixture has no pointer qualifier and reaches the remaining non-pointer branch. Closed [#6680](https://github.com/morluto/rea/issues/6680) concerned multidimensional array suffixes; this fixture has one literal dimension. Restoration criterion: inspect the unchanged failing fixture and retain `name: "payload"`; keep its parameter count and exact source text. The control must retain its observed name and eight-byte layout. Unknown layout fields may remain explicitly partial. No fix or restoration was tested. NOT_ENOUGH_INFO: the first affected source revision and real-producer prevalence were not established. Prepared with AI assistance; no project source was changed. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: An independently assembled valid PTX declaration loses its known parameter identifier through the public source CLI; the result is bounded and explicitly partial. - Workaround status: available - Workaround basis: Both observed CLI results retain the complete original PTX text, from which an analyst can recover the identifier without modifying the artifact.

bsakaguchi closed this issue

2026-10-31 00:47:38 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:00 +00:00

[PR #4198] fix(ghidra): prevent loader relocations from constant folding #6120

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425