Skip to content

Integer overflow in buffer descriptor length in compiler #3033

@andrej

Description

@andrej

In MLIR-AIE, the len and sizes of a aie.dma_bd op is a 32-bit integer attribute representing the number of elements to transfer in number of elements of the given memref's data type. In hardware, Buffer_Length for buffer desciptors is a 32-bit register, with meaning "Buffer Length (number of 32-bit words)".

This appears to create a potential integer overflow condition during the conversion from number of elements to number of 32-bit words, as that conversion seems to be done via an intermediate step to number of bytes, which can then overflow.

Error:

Softmax_r196608_n16384_c1_ch1_rtp_vector_size16384_mask_patch_value0_chunk_size1024_npu2.mlir.prj/aiecc_failure_1776457760_992476.mlir:153:9: error: 'aie.dma_bd' op Buffer descriptor length does not match length of transfer expressed by lowest three dimensions of data layout transformation strides/wraps. BD length is 2147483648 bytes. Lowest three dimensions of data layout transformation would result in transfer of 6442450944 bytes. 
        aie.dma_bd(%arg0 : memref<3221225472xbf16>, 0, -1073741824, [<size = 1, stride = 0>, <size = 1, stride = 0>, <size = 1, stride = 0>, <size = 3221225472, stride = 1>]) {burst_length = 0 : i32}

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions