Skip to content

[comgr][hotswap] Emit address-carrying half last when splitting ds_load_2addr_* with dst/addr overlap#3319

Draft
YashDeshpande25 wants to merge 2 commits into
ROCm:amd-stagingfrom
YashDeshpande25:yash-rocthrust-dsload-reg-overlap-race
Draft

[comgr][hotswap] Emit address-carrying half last when splitting ds_load_2addr_* with dst/addr overlap#3319
YashDeshpande25 wants to merge 2 commits into
ROCm:amd-stagingfrom
YashDeshpande25:yash-rocthrust-dsload-reg-overlap-race

Conversation

@YashDeshpande25

@YashDeshpande25 YashDeshpande25 commented Jul 11, 2026

Copy link
Copy Markdown

When the B0→A0 hotswap splits a ds_load_2addr_* into two single-address ds_load_* instructions, the naive "low half first" emission order corrupts the load if the source address register aliases the destination register window. This makes expandDs2AddrLoad scan the destination window and emit the half that carries the address last, and adds a LIT test covering the full window for both b32 and b64.

The bug & fix

A ds_load_2addr_* address register may alias its destination tuple — this occurs in real gfx1250 code (e.g. rocThrust emits ds_load_2addr_b64 v[2:5], v2 offset1:1, where v2 is both the address and the low destination pair). The single 2-address instruction is safe because the hardware reads the address once before writing any destination, but the naive low-half-first split overwrites v2 before the second load reads it, so that load computes its LDS location from the clobbered register — an intermittent wrong/torn read with no prior test coverage. The fix makes expandDs2AddrLoad scan the whole destination window, determine which half aliases the address, and emit that address-carrying half last: a single ds_load reads its address before writing its destination, so it's safe as the final use, while the disjoint half emitted first never touches the address (loads only, overlap only; instruction count/size, trampoline sizing, and the s_wait_dscnt 0 drain are unchanged).

Original (single 2-address instruction):

ds_load_2addr_b64 v[2:5], v2 offset1:1   ; v2 is both the address and the low dest pair

Before (buggy):

ds_load_b64 v[2:3], v2            ; writes v2,v3 -> CLOBBERS the address in v2
ds_load_b64 v[4:5], v2 offset:8   ; reads the corrupted v2 -> wrong LDS address

After (fixed):

ds_load_b64 v[4:5], v2 offset:8   ; reads v2, writes v4,v5 (v2 untouched)
ds_load_b64 v[2:3], v2            ; reads v2 (still valid), then overwrites it — last use```

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant