Emit LLVM nonnull / align / dereferenceable for proven Rust references #1098

Activity

1. nihalpasham

   added

   codegenDevice code-generation pipeline (Rust MIR to IR to PTX)Device code-generation pipeline (Rust MIR to IR to PTX)

   DependsBlocked on another PR/issue or an upstream dependencyBlocked on another PR/issue or an upstream dependency

   IR-loweringLowering between dialects (dialect-mir to LLVM dialect)Lowering between dialects (dialect-mir to LLVM dialect)

   llvm-exportTextual LLVM/NVVM IR exporter (llvm-export crate)Textual LLVM/NVVM IR exporter (llvm-export crate)

   perfPerformance of generated code or of the compiler itselfPerformance of generated code or of the compiler itself

   questionFurther information is requestedFurther information is requested

   soundness-auditCorrectness case under active maintainer audit; not cleared for merge yetCorrectness case under active maintainer audit; not cleared for merge yet

   on Aug 24, 2026
2. nihalpasham commented on Aug 24, 2026

   

   nihalpasham

   on Aug 24, 2026

   Collaborator

   More actions

   Keeping this open only as part of the same post-#413 design as #1088.

   • nonnull and align may be straightforward, but dereferenceable is an optimizer promise with more conditions than the table in this issue.
   • The closed feat(mir): preserve Rust pointer and reference kind #1062/perf(llvm): emit proven Rust reference parameter attrs #1089 proof path cannot be reused.
   • Re-derive the policy from the pinned rustc ABI implementation, including ZSTs, DSTs, UnsafeCell, pinned types, argument position, optimization mode, and erased reference information.
   • Show a material LLVM/PTX or runtime benefit, with raw-pointer and erased-pointer controls plus verifier tests for invalid combinations.

   No implementation should start until #1088 and #1098 share one auditable per-argument proof model that meets the current acceptance criteria.
3. nihalpasham commented on Sep 3, 2026

   

   nihalpasham

   on Sep 3, 2026

   Last edited by nihalpasham

   Collaborator

   More actions

   This is the half of the #1088 design that can start now. Same rule: every fact comes through rustc_public. No TyCtxt reads, no Debug-string parsing.

   What is buildable today, and what waits:

   attribute              needs                                   status
   nonnull                reference kind (#1186)                  now: SharedRef / UniqueRef from RigidTy::Ref
   align N                pointee layout, N > 1                    now: Ty::layout().shape().abi_align
   dereferenceable(N)     rustc's nofree (Freeze / Unpin facts)   waits for typed ArgAttributes in rustc_public, with #1088's noalias / readonly
   

   • Scope of this half:
     • kernel entry parameters that are Rust references to a sized pointee: &T, &mut T, and the data pointer of &[T] / &mut [T];
     • ZST pointee: nonnull yes, align only when > 1, never dereferenceable(0);
     • raw pointers, DisjointSlice, slice len, by-value structs, extern "C" kernels: nothing.
   • Flow:
     • mir-importer stamps a typed attribute on mir.func per source argument, from kind + layout;
     • mir-lower maps it onto the flattened parameter (slice: data pointer only);
     • llvm-export prints it on kernel entry params, NVVM path only if nvvmVerifyProgram accepts.
   • Expectations: nonnull / align alone will not move PTX much; the measured win (Preserve Rust reference kind and exclusivity through MIR import and lowering #413) arrives with noalias / readonly once the upstream change lands. This half puts the plumbing in place so that becomes a bit copy.
   • Tests: an example that greps its own .ll for the parameter lines: &f32, &mut f32, &[f32], an over-aligned ZST, plus the bare controls above.

   @uurl - want to take this half? An approach note here first would be great.
4. nihalpasham commented on Sep 3, 2026

   

   nihalpasham

   on Sep 3, 2026

   Collaborator

   More actions

   Filed the upstream ask for typed ArgAttributes in rustc_public: rust-lang/rustc_public#132.
5. uurl commented on Sep 3, 2026

   

   uurl

   on Sep 3, 2026

   ContributorAuthor

   More actions

   Yes @nihalpasham , I’ll take the nonnull / align half. I’ll post an approach note here first, scoped to facts available through rustc_public only: reference kind + pointee layout, a typed per-source-argument attribute on mir.func, slice-data-pointer remapping in mir-lower, and LLVM export on kernel entry parameters with the bare controls you listed.

   I’ll leave dereferenceable, noalias, and readonly out of scope until typed ArgAttributes are available through rustc_public, and track rust-lang/rustc_public#132 as that dependency.
6. uurl commented on Sep 4, 2026

   

   uurl

   on Sep 4, 2026

   ContributorAuthor

   More actions

   Thanks — here is the approach I plan to use for the currently unblocked nonnull / align half.

   Proof boundary

   I’ll treat rustc_public as the only semantic source of truth.

   No TyCtxt reads, rustc_internal conversion, auto-trait re-derivation, or Debug parsing.

   The importer-side facts will come from:

   • RigidTy::Ref for reference classification;
   • Ty::layout() for exact pointee alignment.

   For a thin &T / &mut T, the pointee layout directly supplies the alignment.

   For &[T] / &mut [T], [T] itself is unsized, so the slice data-pointer alignment will be derived from the typed element T layout. If the required typed layout is unavailable, the importer will fail closed and emit no validity fact rather than infer one.

   MIR representation

   I plan to add one domain-specific typed MIR attribute representing the proven kernel-parameter validity facts, conceptually:

   ReferenceParamValidity {
       nonnull: true,
       align: Option<N>,
   }
   

   The fact is recorded by source argument index on mir.func.

   I will not reuse the string/integer marker scheme from the closed #1099 path.

   Only facts established by the importer will be transported downstream; neither mir-lower nor llvm-export will infer reference semantics.

   Scope

   This change will apply only to Rust CUDA kernel entry parameters.

   Positive cases:

   • &T → nonnull, plus align N when N > 1
   • &mut T → same
   • &[T] / &mut [T] → attributes on the flattened data pointer only
   • ZST pointee → nonnull; align N only when N > 1

   Bare controls:

   • raw pointers
   • DisjointSlice
   • slice length parameter
   • by-value structs
   • non-kernel/internal functions
   • extern "C" kernel parameters

   No attribute will be recovered from pointer mutability, address space, an erased pointer kind, or lowered LLVM pointer shape.

   Lowering

   mir-lower will consume the typed per-source-argument fact only for a kernel entry function and map it through the existing kernel ABI lowering.

   For slices:

   source &[T]
       |
       +-- LLVM data pointer  -> nonnull / align N
       |
       +-- LLVM length        -> bare
   

   No general-purpose function-parameter attribute inference is planned.

   LLVM export

   llvm-export will mechanically serialize the facts already carried by the lowered function parameter:

   ptr nonnull
   ptr nonnull align N

   No dereferenceable, noalias, or readonly will be emitted in this change.

   The NVVM path will also be checked through the existing verifier/toolkit validation.

   Validation

   I plan to add:

   1. importer tests proving the classification is sourced only from typed rustc_public information;

   2. MIR attribute verifier coverage, including malformed/out-of-range combinations;

   3. source-argument → physical-parameter lowering tests, especially slice data pointer vs. length;

   4. LLVM exporter tests for nonnull and align;

   5. an end-to-end example that inspects its generated .ll parameter lines for:

      • &f32
      • &mut f32
      • &[f32]
      • &mut [f32]
      • an over-aligned ZST
      • the bare controls above;

   6. nvvmVerifyProgram / normal CUDA example validation.

   Explicitly deferred

   These remain blocked on typed ArgAttributes through rustc_public / rust-lang/rustc_public#132:

   • noalias
   • readonly
   • dereferenceable

   I won’t re-derive Freeze, Unpin, NoFree, or equivalent semantics locally.
7. uurl commented on Sep 4, 2026

   

   uurl

   on Sep 4, 2026

   ContributorAuthor

   More actions

   One soundness edge came up while validating the implementation before opening the PR.

   DeviceBuffer currently represents a zero-byte allocation with CUdeviceptr == 0, and the typed #[cuda_module] slice launch paths forward that pointer into the (data, len) kernel ABI. That conflicts with emitting LLVM nonnull on the data pointer of &[T] / &mut [T] for an empty slice. The same case exists for ZST element buffers, whose byte extent is zero even when len > 0.

   I don't want to paper over that at the exporter boundary.

   My proposed fix is to normalize zero-byte Rust-slice launch pointers at the typed host marshalling boundary: when len == 0 or size_of::<T>() == 0, pass a non-null dangling value aligned to align_of::<T>(); otherwise preserve the actual CUdeviceptr. I would apply this consistently to the sync and async slice launch helpers and add host-side tests for empty slices, over-aligned ZSTs, and the normal non-empty path.

   This does not add dereferenceability or alias promises, and DisjointSlice remains bare.

   If that matches the intended slice contract for this half, I'll include the launch-side normalization with the nonnull / align plumbing.
8. nihalpasham commented on Sep 6, 2026

   

   nihalpasham

   on Sep 6, 2026

   Collaborator

   More actions

   Looks good to me.

   • nonnull/align scoping matches the split from Emit LLVM noalias / readonly for Rust references with proven semantics #1088: rustc_public-only, typed MIR attribute, kernel entry params only, dereferenceable/noalias/readonly deferred to rustc_public#132.
   • the empty/ZST DeviceBuffer null-pointer issue makes sense - ptr: 0 is intentional there (Drop-skip), and cuda-host's slice launch forwards it as-is today.
   • normalizing at the cuda-host marshalling boundary (not inside DeviceBuffer) is the right layer - that's cuda-oxide's own ABI contract, and not a cutile-rs bug.

   A PR now would be great.
9. nihalpasham commented on Sep 15, 2026

   

   nihalpasham

   on Sep 15, 2026

   Collaborator

   More actions

   #1244 is ready after maintainer repair and partially addresses this issue.

   • Typed nonnull / alignment facts now reach kernel pointer parameters.
   • The shared host adapter checks nonempty pointer alignment before enqueue; empty/ZST packets use an aligned non-null sentinel.
   • Native and legacy/modern NVVM checks, valid GPU launches, memcheck and hosted CI pass.

   Rust reference fact + checked launch packet -> justified LLVM promise
   

   Keeping #1098 open for dereferenceable and the remaining typed-attribute work; this PR claims no measured speedup.
10. nihalpasham

    added a commit that references this issue on Oct 11, 2026

    cuda-oxide: update to nightly-2026-10-11 (#1482)

    ...

    91a0066
11. nihalpasham commented on Oct 11, 2026

    

    nihalpasham

    on Oct 11, 2026

    Collaborator

    More actions

    Related upstream report: LLVM #230960 tracks lost volatile reads with noalias readonly kernel parameters.

    #1483 still adds rustc-proven, no_free-gated sized dereferenceability on top of the existing nonnull/alignment work from #1244. It defers explicit readonly because of the upstream bug. The validity-attribute work can proceed under that narrower contract; this comment does not close the issue.
12. nihalpasham

    added a commit that references this issue on Oct 11, 2026

    cuda-oxide: preserve rustc reference attributes on kernels (#1483)

    ...

    d141118