Qualcomm: reject a delegate whose QNN graph I/O does not match its si… - #22239
Open
psiddh wants to merge 1 commit into
Open
Qualcomm: reject a delegate whose QNN graph I/O does not match its si…#22239psiddh wants to merge 1 commit into
psiddh wants to merge 1 commit into
Conversation
…gnature At runtime the delegate binds its arguments positionally, walking the tensor lists recovered from the context binary and consuming one argument per tensor the name prefixes mark as bindable. A graph that publishes more bindable I/O than the program passes therefore reads past the end of the argument list on device, where all it leaves behind is a fault address and two counts. Everything needed to catch that is already in hand at the end of _build_op_wrappers: nodes_to_wrappers holds every tensor that will be serialized into the binary, under the names the runtime will read, and the delegated program carries the signature those names have to agree with. Compare them there and report the offending names, rather than letting the disagreement reach a device. The comparison uses the runtime's own rules so the two cannot drift: an "input_"-prefixed tensor binds an input, an "output_"-prefixed tensor binds an output, and anything carrying "mutbuf_" is skipped, since mutable buffers are threaded through separately and never consume an argument. Prebuilt context binaries return earlier in the same function and never reach the check; preprocess_multimethod runs it once per program against that program's own signature; tensor-dump mode promotes native tensors to APP_READ without giving them an output_ prefix, so they are excluded too. Checked against ten real lowerings -- single input/output, multi-input, multi-output, partially-consumed multi-output and a mutable buffer, each in fp16 and quantized -- with no false positives. The unit tests drive the comparison directly with stub wrapper names, covering the matching case, a mutable buffer that must not consume an argument, and a surplus on either side. One case is worth knowing about: a model returning the same tensor twice has two user_outputs but one output_-prefixed wrapper, so this fires. That is a real defect today, since the runtime's output loop never fills the second argument, and the fix belongs on the runtime side rather than in weakening the check. Authored with assistance from Claude Code.
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/22239
Note: Links to docs will display an error until the docs builds have been completed. This comment was automatically generated by Dr. CI and updates every 15 minutes. |
meta-cla
Bot
added
the
CLA Signed
This PR needs a
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…gnature
At runtime the delegate binds its arguments positionally, walking the tensor lists recovered from the context binary and consuming one argument per tensor the name prefixes mark as bindable. A graph that publishes more bindable I/O than the program passes therefore reads past the end of the argument list on device, where all it leaves behind is a fault address and two counts.
Everything needed to catch that is already in hand at the end of _build_op_wrappers: nodes_to_wrappers holds every tensor that will be serialized into the binary, under the names the runtime will read, and the delegated program carries the signature those names have to agree with. Compare them there and report the offending names, rather than letting the disagreement reach a device.
The comparison uses the runtime's own rules so the two cannot drift: an "input_"-prefixed tensor binds an input, an "output_"-prefixed tensor binds an output, and anything carrying "mutbuf_" is skipped, since mutable buffers are threaded through separately and never consume an argument. Prebuilt context binaries return earlier in the same function and never reach the check; preprocess_multimethod runs it once per program against that program's own signature; tensor-dump mode promotes native tensors to APP_READ without giving them an output_ prefix, so they are excluded too.
Checked against ten real lowerings -- single input/output, multi-input, multi-output, partially-consumed multi-output and a mutable buffer, each in fp16 and quantized -- with no false positives. The unit tests drive the comparison directly with stub wrapper names, covering the matching case, a mutable buffer that must not consume an argument, and a surplus on either side.
One case is worth knowing about: a model returning the same tensor twice has two user_outputs but one output_-prefixed wrapper, so this fires. That is a real defect today, since the runtime's output loop never fills the second argument, and the fix belongs on the runtime side rather than in weakening the check.