Skip to content

[rocjitsu][amdisa] Prevent scalar buffer mem op if range not in bounds - #14922

Merged
accauble merged 3 commits into
developfrom
users/accauble/rj-cdna-s-buffer-load-bounds
Nov 5, 2026
Merged

accauble merged 3 commits into
developfrom
users/accauble/rj-cdna-s-buffer-load-bounds

Conversation

@accauble

@accauble accauble commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

Motivation

For a scalar buffer memory op simulation, we checked to see if the first byte was in range, but not the rest of the load. This adds that check and tests. Related to Issue #13025.

* For a scalar buffer memory op, we checked to see if the first byte
  was in range, but not the rest of the load. Add that check
@therock-pr-bot

therock-pr-bot Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

✅ All Checks Passed — Ready for Review

Check Status Details
📝 PR Description ✅ Pass —
⛔ Forbidden Files ✅ Pass —
🧪 Unit Test ✅ Pass —
🔎 pre-commit ✅ Pass —
🚫 Draft PR 🔜 To Be Enabled —
🚩 Feature Flag 🔜 To Be Enabled —
📊 Code Coverage 🔜 To Be Enabled —
🤖 therock-pr-bot ✅ Pass —

🎉 All checks passed! This PR is ready for review.

📖 Need help? See the Policy FAQ for details on every check and how to fix failures.

🙋 Wish to Override Policy?

@therock-pr-bot

therock-pr-bot Bot commented Nov 3, 2026

Copy link
Copy Markdown

🎉 All checks passed! This PR is ready for review.

@accauble
accauble marked this pull request as ready for review November 3, 2026 16:17
@accauble
accauble requested review from a team and atgutier as code owners November 3, 2026 16:17

@kuhar kuhar left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would help to document the two alignment masks at emulation/rocjitsu/lib/rocjitsu/src/rocjitsu/isa/arch/amdgpu/shared/addr_calc_scalar.h:44-49: align_mask rounds the returned address, while size_align_mask rounds the byte bound used for per-DWORD masking. GFX9 now passes 3 for both; RDNA4 passes its access alignment, while RDNA1 through RDNA3.5 retain the default zero size mask. A short note that zero leaves the bound unrounded, and that those RDNA callers are unchanged by this fix, would make the policy distinction clear without implying their hardware behavior was validated here.

@kuhar kuhar left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might help to require each scalar_buffer_address caller to pass its bound alignment explicitly (emulation/rocjitsu/lib/rocjitsu/src/rocjitsu/isa/arch/amdgpu/shared/addr_calc_scalar.h:56). Omitting size_align_mask silently selects the first-byte rule, which would give the wrong result for a new caller that needs whole DWORDs. The four RDNA1–3.5 callers could pass /*align_mask=*/3, /*size_align_mask=*/0. A reference at the RDNA3 call site to ISA §§8.1.2 and 8.4.1 would explain the unrounded bound without implying it was tested on hardware.

@accauble
accauble requested a review from kuhar November 4, 2026 00:18

@kuhar kuhar left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@accauble
accauble merged commit 4a43fe0 into develop Nov 5, 2026
69 checks passed
@accauble
accauble deleted the users/accauble/rj-cdna-s-buffer-load-bounds branch November 5, 2026 17:03
@github-actions

github-actions Bot commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

rocjitsu post-commit fuzz passed

The 32-worker multiplexer campaigns for commit 4a43fe000393 completed without recording a crash or hang.

  • ASan+UBSan (6-minute): 534,924 input executions (1,519.22 inputs/s)
  • TSan (6-minute): 513,613 input executions (1,469.43 inputs/s)

View the workflow run.

accauble added a commit that referenced this pull request Nov 5, 2026
## Motivation

This models the `s_buffer_atomic_*` instructions (Issue #13025). The
implementation is very similar to the `s_atomic` implementation except
for how smem_calculate_address computes the address and an extra bounds
check.

Requires a quick fix in PR #14922. I also found another possible bug
with how the buffer memory accesses are checked for the debugger. That
is scoped as a follow-up since it existed before this change. (PR
#14995)
@systems-assistant

Copy link
Copy Markdown
Contributor

TheRock Submodule Bump Activity

Newest first

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants