v8 Kernel Allocation Ownership
CKE tracks every direct C allocation inside src/kernels as ownership debt. The audit currently finds
55 allocation call sites in 21 functions, including 51 sites classified as production. Every function now has a
reviewed owner, lifetime, size formula, execution role, migration target, and priority. The nightly ratchet rejects
new or unreviewed sites.
Evidence and scope
The ownership manifest
is the reviewed source of size formulas and migration decisions. The
nightly allocation report and latest nightly JSON combine it with a fresh source scan,
kernel-map reachability, and checked-in circuit consumers. Reproduce it with
python3 version/v8/scripts/audit_kernel_allocations_v8.py --check --json or
make test-v8-kernel-allocations. The audit implementation and contract tests are in
audit_kernel_allocations_v8.py
and test_v8_kernel_allocation_audit.py.
Counts are static source locations. They do not count live allocations, bytes retained, or leaks. One allocation
can have several cleanup sites, so comparing malloc and free source counts cannot diagnose a
leak. Runtime instrumentation and ownership/control-flow analysis are required for that claim.
Repair order
| Priority | Path | Consumers | Ownership action |
|---|---|---|---|
| P0 | patch_projection_image_bf16_pytorch_onednn_conv3d_storage and its Conv3D helper | qwen3_vl_vision candidate contract | Move image packing and BF16 conversion buffers to planner scratch. Prepare shape-specific oneDNN state outside compute. |
| P0 | gemm_nt_bf16_pytorch_onednn_3_12_brgemm_bf16_storage_workspace | muse_glimmer_text, qwen4_exp | Tensor scratch is already caller-owned. Measure oneDNN allocations, then prepare reusable descriptors, primitives, memory objects, and library scratch during model/session setup. |
| P1 | oneDNN 3.7 legacy GEMM provider helper | Qwen-family legacy numerical contract | Redirect or retire the heap-backed map after numerical and ABI checks. |
| P1 | Whisper WAV log-Mel frontend | Audio frontend | Give decoded samples frontend or session ownership; this lifetime is outside generated kernel scratch. |
| P2 | Attention, MLA, AMX GEMM, fused attention, and recurrent compatibility wrappers | No selected heap-backed v8 entry point | Keep them outside generated paths and retire them incrementally. Their mapped replacements already receive planner scratch. |
| Defer | ggml oracle and tensor-dump utilities | Diagnostics only | Keep separately classified; add caller-owned diagnostic buffers only if repeated allocation becomes material. |
What the source scan means for selected paths
A function with no direct map can still be reachable through a provider helper. The report therefore resolves
direct and transitive map ownership and lists circuits whose numerical contracts can select each map. Conversely,
an allocating compatibility wrapper can remain in source while generated v8 code calls its allocation-free
_workspace entry point. The manifest records both cases explicitly.
Muse attention and projection tensors use planner-declared scratch, and Muse added no direct C allocator site. Its BF16 projection path is still labeled caller-owned tensor scratch, rather than allocation-free execution, because oneDNN creates objects per invocation and may allocate internally under a global mutex. The audit records this as an external-library risk that grep cannot discover.
Acceptance gate for each repair
- Preserve the numerical contract, cast boundaries, alignment, aliasing rules, and required ABI compatibility.
- Declare exact scratch size, lifetime, capacity, and per-worker ownership; reject null, undersized, and overflowing workspaces before writes.
- Run parity tests at minimum, exact, tail, and large shapes, plus concurrent-session isolation where the provider is threaded.
- Instrument repeated calls after initialization, including the selected helper and external-library call chain.
- Record before/after allocation counts and timing. Do not raise the allocation baseline to land a new provider.