[COMGR] Harden gfx1250 HotSwap rewriting and fail closed

[jammm]

Also see https://github.com/jammm/hotswap_repros/blob/main/docs/PR_3387_MAPPING.md

Summary

This PR is stacked on
ROCm/llvm-project#3374 at
fae9307759fd7961e479747fd4822d889c925399.

PR #3374 already provides:

• Fail-safe handling for required gfx1250 B0-to-A0 rewrites
• SCC-neutral far transfers, SGPR scratch allocation, gateways, and branch
  islands
• Coherent kernel-resource metadata updates
• Caching and incremental layout accounting for large code objects

This PR adds the remaining cross-pass correctness machinery needed when several
required transformations interact in one large, multi-function code object:

• Transactional ownership across semantic passes
• Site-specific SGPR-pair and VCC dataflow proofs
• Conservative modeling of callable, indirect, and opaque control-flow ingress
• Atomic DS2 and WMMA combined-delay handling
• Must-dataflow proofs for PC-sensitive tensor descriptor repair
• CFG-wide VGPR-MSB state for required WMMA splits
• Entry-aware hard-clause validation
• Structural state for generated executable pools and repeated rewriting

A required transformation now succeeds only when its placement, source-window
ownership, control-flow assumptions, encoding, ELF growth, and metadata update
can all be established. Otherwise the complete rewrite fails without returning
a partially transformed code object.

These gaps were exposed by gfx1250 code objects captured while running
DeepSeek V4 Pro through the open-source ATOM/AITER stack. The captures were
reduced to focused COMGR tests and standalone reproducers. The implementation
is general to gfx1250 HotSwap and contains no model-specific paths.

• Base: PR [comgr][hotswap] scale hotswap rewrites for large code objects (amd-staging companion) #3374 head
  fae9307759fd7961e479747fd4822d889c925399
• Head: 3d900e5b002d
• Branch: users/jam/hotswap-zero-failures-amd-staging-v2

Issues Observed In The Open-Source Workload

Far-return placement and scratch liveness

Large AITER mHC and activation objects contained required sites outside
short-branch range. Some sites had no contiguous source window large enough for
a far-return sequence, while candidate original SGPR pairs or VCC were live on
only some outgoing paths. Large RCCL code objects additionally exposed
fragmented gateway space, protected callable extents, and order-sensitive relay
allocation.

This PR proves a candidate pair dead from the exact resume point across all
modeled successors before reusing it. VCC is subject to the same proof.
Fallback SGPR allocation remains resource-accounted. Gateway, relay, branch
island, and source-window placement respect descriptors, symbols, relocations,
callable entries, materialized PC transfers, and generated-code ownership.

The implementation preserves PR #3374's SCC-neutral
s_get_pc_i64 / s_add_nc_u64 / s_set_pc_i64 routing and does not generate
s_add_pc_i64.

DS2 combined-delay ownership

Generated A8W8, top-k, activation, and RCCL objects contained multiple required
DS2 rewrites protected by one combined s_delay_alu. Applying or relocating
one member independently could consume another member's delay, source window,
or only reachable gateway.

This PR plans all required DS2 members owned by one delay window as one
transaction. Address and destination dependencies, split ordering, alignment,
required s_wait_dscnt 0 placement, source windows, and gateway routes are
validated together. Unsupported tuples, offsets, ownership graphs, or routes
fail the complete rewrite.

PC-sensitive tensor descriptor repair

Grouped-MoE captures contained tensor_load_to_lds sites without the canonical
adjacent scalar-delay slot. Other sites had no spare SGPR for the earlier
save-and-restore approach. Relocating the tensor instruction is not valid
because its linked PC participates in its behavior.

This PR keeps the tensor instruction at its original address. It accepts one
of three proofs:

• The descriptor low bits are already masked
• A canonical adjacent scalar-delay slot can hold the mask
• A local descriptor definition must reach the tensor on every modeled entry
  path and can be masked in place

Descriptor entries, visible callable symbols, direct calls and returns,
materialized PC transfers, opaque control flow, and arbitrary indirect ingress
participate in the proof. A bypassing or unresolved entry disables the proof
and causes the required rewrite to fail closed.

Two retained no-scratch captures still reach a later tensor site whose
descriptor placement cannot be proven. They are intentional fail-closed
negative cases: the API returns an error and produces no output object.

WMMA VGPR-MSB, delays, and hazards

A captured K=128 A8W8 object required a WMMA split after a loop header. The
earlier straight-line recovery rejected it with:

WMMA split: cannot determine VGPR-MSB mode for
v_wmma_f32_16x16x128_fp8_fp8 at offset 0x5D8

A captured logits object also combined the required split with a protected
dependency window, a barrier, a PC-sensitive tensor load, and WMMA hazards.
Moving only the WMMA would leave the original delay describing the wrong
instruction sequence.

This PR computes all four VGPR-MSB fields as a forward CFG fixed point across
branches, loops, joins, and SETREG updates. A split is emitted only when the
complete incoming mode is exact. The upper K=64 operation is encoded under the
required mode and the incoming mode is restored afterward.

Supported combined-delay windows are demerged atomically. WMMA semantic
replacement, reconstructed delays, and RAW, WAR, and WAW hazard repair share
one ownership plan. Conflicting reachable state, unresolved ingress, interior
entries, overlapping dependency windows, or unsupported ownership fail closed.

Hard-clause entry paths

A sparse-prefill object associated with a DeepSeek V4 Pro runtime fault
contained an entry-path s_clause before any compatible VMEM operation. Other
objects showed that deleting every clause is also incorrect.

This PR validates clause family, membership, scope, and transformed members,
then uses a must-analysis over every modeled entry path. Malformed,
mixed-family, transformed-member, and initial-VMEM clauses are removed. A
uniform same-family clause is preserved only when every modeled path has
already executed a compatible VMEM operation.

Cross-pass transactions and repeated rewriting

PR #3374 already records a required-site failure. This PR extends that state
through every semantic pass and adds prepare/commit ownership for shared source
instructions, delay windows, scratch reservations, gateways, and metadata.

The complete appended layout is reserved before final branch fixups. ELF growth
validates executable load coverage, header relocation, symbols, protected
extents, kernel descriptors, and resource metadata before committing.

Generated executable pools carry a non-allocating structural note describing
their layout and target stepping. A later invocation accepts a pool only when
the note, section, executable segment, layout, and target state agree.
Malformed, incomplete, overlapping, unmarked, or target-mismatched state fails
closed. A supported B0-to-A0 output is byte-identical when rewritten to A0
again.

Callable-Control-Flow ABI

HotSwap requires input code objects to follow the AMDGPU
callable-control-flow ABI.

In particular, an s_swap_pc_i64 that writes the standard link pair
s[30:31] must be a call to a callable function entry represented by the code
object. This is an input precondition, not an inference made from MC's generic
instruction classification.

If the target entry or link behavior cannot be resolved from the represented
control-flow information, HotSwap treats the ingress and link state as
unknown. It does not use that transfer as an optimistic call boundary for
liveness, relocation, clause, or must-definition proofs. A required rewrite
that depends on such a proof fails closed.

Generated provenance notes describe structural layout and rewrite state. They
do not authenticate untrusted input. HotSwap assumes input from a trusted
compiler or an earlier trusted HotSwap invocation.

Validation

Fresh host validation from the PR #3374-based source and COMGR build:

Check	Result
COMGR runtime and HotSwap rewrite targets	Passed
HotswapMCTests	98/98 passed
HotswapElfTests	38/38 passed
HotSwap-filtered COMGR LIT	145/145 passed
Full COMGR LIT	175 passed, 1 unsupported, 2 non-HotSwap SDK-version failures

The two full-suite failures are device-lib-linking.cl, whose device-library
expectation differs from the installed SDK, and
spirv-tests/unbundle-compressed.hip, whose expected payload magic differs
from that SDK's compressed bundle output. All HotSwap-filtered tests pass.

Focused host coverage includes:

• Required-patch failure propagation and source ownership
• Site-dead SGPR-pair and VCC proofs
• Protected entries, extents, gateways, relays, and branch islands
• DS2 multi-site and combined-delay transactions
• Tensor must-definition and external-ingress rejection
• VGPR-MSB CFG state, SETREG handling, WMMA delays, and hazards
• Clause must-analysis across callable and indirect entries
• ELF growth, pool provenance, atomic metadata updates, and idempotence

The exact-object validation set includes the captured mHC, activation, logits,
A8W8, mxscale, tensor no-delay, sparse-prefill, and RCCL objects. Supported
objects must complete a first rewrite, pass ELF and disassembly checks, and
produce a byte-identical second rewrite. The two retained tensor negative
objects must return an error without producing output.

Direct device reproducers and RCCL controls are run in separate fresh processes
with HotSwap enabled and disabled. Acceptance is based on process status, exact
output comparisons where available, rewrite diagnostics, runtime library maps,
and absence of GPU fault signatures.

Evidence Boundaries

• The sparse-prefill and mxscale captures retain exact mappings to runtime
  faults, but object-to-fault provenance alone does not prove HotSwap causality.
• The mHC object is combined integration coverage rather than a dedicated
  reproducer for every transform it contains.
• The captured hipBLASLt Cijk object is a negative isolation control; no unique
  HotSwap fix is attributed to it.
• Generic ATOM/AITER launchers map to this PR only through the transforms
  reported by their COMGR rewrite logs.
• Expected fail-closed inputs are not counted as successful rewrite cases.

Scope

• This PR changes COMGR's gfx1250 same-family HotSwap implementation,
  documentation, and tests.
• PR [comgr][hotswap] scale hotswap rewrites for large code objects (amd-staging companion) #3374's fail-safe, far-routing, and large-object foundations remain the
  base of this work.
• Runtime-form HotSwap ISA target parsing is already present below PR [comgr][hotswap] scale hotswap rewrites for large code objects (amd-staging companion) #3374 and
  is not introduced here.
• The TargetParser.h include change selects the header available in the
  installed LLVM SDK and does not change rewrite semantics.
• This PR does not modify ATOM, AITER, Triton, ROCr, RCCL, or model source.