KleidiAI bug: llama-cli crash when -tb larger than 64 for KlediAI enabled build #15079
Description
Name and Version
This is a day one issue, so exist in all llama-cli version.
I tried on version b5170.
Operating systems
Linux
Which llama.cpp modules do you know to be affected?
llama-cli
Command line
llama-cli -m ./models/Qwen2.5-3B-q4_0.gguf -p "What is a car?" -t 64 -tb 65Problem description & steps to reproduce
Reproduce:
- Compile llama with Kleidi enabled
cmake -B build -DGGML_CPU_KLEIDIAI=ON cmake --build build - Use a q4_0 model and setting -tb 65 (must larger than 64).
- Optional: CPU is arm version, Ampere AltraMax. which core count is 128. If run on this cpu then this crash issue also happen without "-tb 65"
- Run command
llama-cli -m ./models/Qwen2.5-3B-q4_0.gguf -p "What is a car?" -t 64 -tb 65
Analysis
The key issue is in llama.cpp function compute_forward_q4_0 which meet unsigned integer overflow. Then it passes a big value to lower kleidi module.
First Bad Commit
Relevant log output
$ lscpu
Architecture: aarch64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian
CPU(s): 128
On-line CPU(s) list: 0-127
Vendor ID: ARM
BIOS Vendor ID: Ampere(R)
Model name: Neoverse-N1
BIOS Model name: Ampere(R) Altra(R) Max Processor M128-30 CPU @ 3.0GHz
BIOS CPU family: 257
Model: 1
Thread(s) per core: 1
Core(s) per socket: 128
Socket(s): 1
Stepping: r3p1
Frequency boost: disabled
CPU(s) scaling MHz: 100%
CPU max MHz: 3000.0000
CPU min MHz: 1000.0000
BogoMIPS: 50.00
Flags: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm lrcpc dcpop asimddp ssbs
Caches (sum of all):
L1d: 8 MiB (128 instances)
L1i: 8 MiB (128 instances)
L2: 128 MiB (128 instances)
NUMA:
NUMA node(s): 1
NUMA node0 CPU(s): 0-127
Vulnerabilities:
Itlb multihit: Not affected
L1tf: Not affected
Mds: Not affected
Meltdown: Not affected
Mmio stale data: Not affected
Retbleed: Not affected
Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl
Spectre v1: Mitigation; __user pointer sanitization
Spectre v2: Mitigation; CSV2, BHB
Srbds: Not affected
Tsx async abort: Not affected
(gdb) info threads
Id Target Id Frame
1 Thread 0xfffeca28b100 (LWP 365733) 0x0000fffff79f8ffc in kai_run_matmul_clamp_f32_qsi8d32p1x4_qsi4c32p4x4_1x4_neon_dotprod (m=1, n=18446744073709551536, k=2048, bl=32, lhs_packed=0x124fe70, rhs_packed=0xffff83415840, dst=0xffff08fa6d80, dst_stride_row=44032, dst_stride_col=4, scalar_min=-3.40282347e+38, scalar_max=3.40282347e+38) at /home/edward/llama.cpp/build/_deps/kleidiai_download-src/kai/ukernels/matmul/matmul_clamp_f32_qsi8d32p_qsi4c32p/kai_matmul_clamp_f32_qsi8d32p1x4_qsi4c32p4x4_1x4_neon_dotprod.c:142
2 Thread 0xfffff7fdc020 (LWP 365606) 0x0000fffff79f9094 in kai_run_matmul_clamp_f32_qsi8d32p1x4_qsi4c32p4x4_1x4_neon_dotprod (m=1, n=88, k=2048, bl=32, lhs_packed=0x124fe70, rhs_packed=0xffff827e7040, dst=0xffff08f9c040, dst_stride_row=44032, dst_stride_col=4, scalar_min=-3.40282347e+38, scalar_max=3.40282347e+38) at /home/edward/llama.cpp/build/_deps/kleidiai_download-src/kai/ukernels/matmul/matmul_clamp_f32_qsi8d32p_qsi4c32p/kai_matmul_clamp_f32_qsi8d32p1x4_qsi4c32p4x4_1x4_neon_dotprod.c:142
3 Thread 0xfffee1d7b100 (LWP 365686) 0x0000fffff79f9094 in kai_run_matmul_clamp_f32_qsi8d32p1x4_qsi4c32p4x4_1x4_neon_dotprod (m=1, n=88, k=2048, bl=32, lhs_packed=0x124fe70, rhs_packed=0xffff82f8a440, dst=0xffff08fa2ce0, dst_stride_row=44032, dst_stride_col=4, scalar_min=-3.40282347e+38, scalar_max=3.40282347e+38) at /home/edward/llama.cpp/build/_deps/kleidiai_download-src/kai/ukernels/matmul/matmul_clamp_f32_qsi8d32p_qsi4c32p/kai_matmul_clamp_f32_qsi8d32p1x4_qsi4c32p4x4_1x4_neon_dotprod.c:142
4 Thread 0xfffec9a7b100 (LWP 365734) 0x0000fffff79f8ffc in kai_run_matmul_clamp_f32_qsi8d32p1x4_qsi4c32p4x4_1x4_neon_dotprod (m=1, n=18446744073709551448, k=2048, bl=32, lhs_packed=0x124fe70, rhs_packed=0xffff8342e440, dst=0xffff08fa6ee0, dst_stride_row=44032, dst_stride_col=4, scalar_min=-3.40282347e+38, scalar_max=3.40282347e+38) at /home/edward/llama.cpp/build/_deps/kleidiai_download-src/kai/ukernels/matmul/matmul_clamp_f32_qsi8d32p_qsi4c32p/kai_matmul_clamp_f32_qsi8d32p1x4_qsi4c32p4x4_1x4_neon_dotprod.c:142
(gdb) bt
#0 0x0000fffff79f8ffc in kai_run_matmul_clamp_f32_qsi8d32p1x4_qsi4c32p4x4_1x4_neon_dotprod (m=1, n=18446744073709551536, k=2048, bl=32, lhs_packed=0x124fe70, rhs_packed=0xffff83415840, dst=0xffff08fa6d80, dst_stride_row=44032, dst_stride_col=4,
scalar_min=-3.40282347e+38, scalar_max=3.40282347e+38) at /home/edward/llama.cpp/build/_deps/kleidiai_download-src/kai/ukernels/matmul/matmul_clamp_f32_qsi8d32p_qsi4c32p/kai_matmul_clamp_f32_qsi8d32p1x4_qsi4c32p4x4_1x4_neon_dotprod.c:142
#1 0x0000fffff79f4710 in ggml::cpu::kleidiai::tensor_traits::compute_forward (this=0xfffff7a40d00 <ggml::cpu::kleidiai::get_tensor_traits(ggml_backend_buffer*, ggml_tensor*)::traits>, params=0xfffeca28a798, dst=0xe52c90)
at /home/edward/llama.cpp/ggml/src/ggml-cpu/kleidiai/kleidiai.cpp:156
#2 0x0000fffff79dfe4c in ggml_cpu_extra_compute_forward (params=0xfffeca28a798, op=0xe52c90) at /home/edward/llama.cpp/ggml/src/ggml-cpu/ggml-cpu-traits.cpp:17
#3 0x0000fffff79bc1a8 in ggml_compute_forward (params=0xfffeca28a798, tensor=0xe52c90) at /home/edward/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:12830
#4 0x0000fffff79bde08 in ggml_graph_compute_thread (data=0x7d7a60) at /home/edward/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:13963
#5 0x0000fffff79be57c in ggml_graph_compute._omp_fn.0 () at /home/edward/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:14238
#6 0x0000fffff7284308 in gomp_thread_start (xdata=<optimized out>) at ../../../libgomp/team.c:129
#7 0x0000fffff736edc4 in start_thread (arg=0x0) at pthread_create.c:444
#8 0x0000fffff73dd49c in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone.S:79
$ llama-cli -m ./models/Qwen2.5-3B-q4_0.gguf -p "what is a car"
build: 0 (unknown) with cc (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0 for aarch64-linux-gnu
main: llama backend init
main: load the model and apply lora adapter, if any
llama_model_loader: loaded meta data with 34 key-value pairs and 434 tensors from /home/edward/models/Qwen2.5-3B-q4_0.gguf (version GGUF V3 (latest))
llama_model_loader: Dumping metadata keys/values. Note: KV overrides do not apply in this output.
llama_model_loader: - kv 0: general.architecture str = qwen2
llama_model_loader: - kv 1: general.type str = model
llama_model_loader: - kv 2: general.name str = Qwen2.5 3B
llama_model_loader: - kv 3: general.basename str = Qwen2.5
llama_model_loader: - kv 4: general.size_label str = 3B
llama_model_loader: - kv 5: general.license str = other
llama_model_loader: - kv 6: general.license.name str = qwen-research
llama_model_loader: - kv 7: general.license.link str = https://huggingface.co/Qwen/Qwen2.5-3...
llama_model_loader: - kv 8: general.base_model.count u32 = 1
llama_model_loader: - kv 9: general.base_model.0.name str = Qwen2.5 3B
llama_model_loader: - kv 10: general.base_model.0.organization str = Qwen
llama_model_loader: - kv 11: general.base_model.0.repo_url str = https://huggingface.co/Qwen/Qwen2.5-3B
llama_model_loader: - kv 12: general.tags arr[str,2] = ["chat", "text-generation"]
llama_model_loader: - kv 13: general.languages arr[str,1] = ["en"]
llama_model_loader: - kv 14: qwen2.block_count u32 = 36
llama_model_loader: - kv 15: qwen2.context_length u32 = 32768
llama_model_loader: - kv 16: qwen2.embedding_length u32 = 2048
llama_model_loader: - kv 17: qwen2.feed_forward_length u32 = 11008
llama_model_loader: - kv 18: qwen2.attention.head_count u32 = 16
llama_model_loader: - kv 19: qwen2.attention.head_count_kv u32 = 2
llama_model_loader: - kv 20: qwen2.rope.freq_base f32 = 1000000.000000
llama_model_loader: - kv 21: qwen2.attention.layer_norm_rms_epsilon f32 = 0.000001
llama_model_loader: - kv 22: tokenizer.ggml.model str = gpt2
llama_model_loader: - kv 23: tokenizer.ggml.pre str = qwen2
llama_model_loader: - kv 24: tokenizer.ggml.tokens arr[str,151936] = ["!", "\"", "#", "$", "%", "&", "'", ...
llama_model_loader: - kv 25: tokenizer.ggml.token_type arr[i32,151936] = [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, ...
llama_model_loader: - kv 26: tokenizer.ggml.merges arr[str,151387] = ["Ġ Ġ", "ĠĠ ĠĠ", "i n", "Ġ t",...
llama_model_loader: - kv 27: tokenizer.ggml.eos_token_id u32 = 151645
llama_model_loader: - kv 28: tokenizer.ggml.padding_token_id u32 = 151643
llama_model_loader: - kv 29: tokenizer.ggml.bos_token_id u32 = 151643
llama_model_loader: - kv 30: tokenizer.ggml.add_bos_token bool = false
llama_model_loader: - kv 31: tokenizer.chat_template str = {%- if tools %}\n {{- '<|im_start|>...
llama_model_loader: - kv 32: general.quantization_version u32 = 2
llama_model_loader: - kv 33: general.file_type u32 = 2
llama_model_loader: - type f32: 181 tensors
llama_model_loader: - type q4_0: 252 tensors
llama_model_loader: - type q6_K: 1 tensors
print_info: file format = GGUF V3 (latest)
print_info: file type = Q4_0
print_info: file size = 1.69 GiB (4.71 BPW)
load: special tokens cache size = 22
load: token to piece cache size = 0.9310 MB
print_info: arch = qwen2
print_info: vocab_only = 0
print_info: n_ctx_train = 32768
print_info: n_embd = 2048
print_info: n_layer = 36
print_info: n_head = 16
print_info: n_head_kv = 2
print_info: n_rot = 128
print_info: n_swa = 0
print_info: n_swa_pattern = 1
print_info: n_embd_head_k = 128
print_info: n_embd_head_v = 128
print_info: n_gqa = 8
print_info: n_embd_k_gqa = 256
print_info: n_embd_v_gqa = 256
print_info: f_norm_eps = 0.0e+00
print_info: f_norm_rms_eps = 1.0e-06
print_info: f_clamp_kqv = 0.0e+00
print_info: f_max_alibi_bias = 0.0e+00
print_info: f_logit_scale = 0.0e+00
print_info: f_attn_scale = 0.0e+00
print_info: n_ff = 11008
print_info: n_expert = 0
print_info: n_expert_used = 0
print_info: causal attn = 1
print_info: pooling type = 0
print_info: rope type = 2
print_info: rope scaling = linear
print_info: freq_base_train = 1000000.0
print_info: freq_scale_train = 1
print_info: n_ctx_orig_yarn = 32768
print_info: rope_finetuned = unknown
print_info: ssm_d_conv = 0
print_info: ssm_d_inner = 0
print_info: ssm_d_state = 0
print_info: ssm_dt_rank = 0
print_info: ssm_dt_b_c_rms = 0
print_info: model type = 3B
print_info: model params = 3.09 B
print_info: general.name = Qwen2.5 3B
print_info: vocab type = BPE
print_info: n_vocab = 151936
print_info: n_merges = 151387
print_info: BOS token = 151643 '<|endoftext|>'
print_info: EOS token = 151645 '<|im_end|>'
print_info: EOT token = 151645 '<|im_end|>'
print_info: PAD token = 151643 '<|endoftext|>'
print_info: LF token = 198 'Ċ'
print_info: FIM PRE token = 151659 '<|fim_prefix|>'
print_info: FIM SUF token = 151661 '<|fim_suffix|>'
print_info: FIM MID token = 151660 '<|fim_middle|>'
print_info: FIM PAD token = 151662 '<|fim_pad|>'
print_info: FIM REP token = 151663 '<|repo_name|>'
print_info: FIM SEP token = 151664 '<|file_sep|>'
print_info: EOG token = 151643 '<|endoftext|>'
print_info: EOG token = 151645 '<|im_end|>'
print_info: EOG token = 151662 '<|fim_pad|>'
print_info: EOG token = 151663 '<|repo_name|>'
print_info: EOG token = 151664 '<|file_sep|>'
print_info: max token length = 256
load_tensors: loading model tensors, this can take a while... (mmap = true)
**load_tensors: CPU_KLEIDIAI model buffer size = 1488.38 MiB**
load_tensors: CPU_Mapped model buffer size = 1720.63 MiB
.......................................................................................
llama_context: constructing llama_context
llama_context: n_seq_max = 1
llama_context: n_ctx = 4096
llama_context: n_ctx_per_seq = 4096
llama_context: n_batch = 2048
llama_context: n_ubatch = 512
llama_context: causal_attn = 1
llama_context: flash_attn = 0
llama_context: freq_base = 1000000.0
llama_context: freq_scale = 1
llama_context: n_ctx_per_seq (4096) < n_ctx_train (32768) -- the full capacity of the model will not be utilized
llama_context: CPU output buffer size = 0.58 MiB
init: kv_size = 4096, offload = 1, type_k = 'f16', type_v = 'f16', n_layer = 36, can_shift = 1
init: CPU KV buffer size = 144.00 MiB
llama_context: KV self size = 144.00 MiB, K (f16): 72.00 MiB, V (f16): 72.00 MiB
llama_context: CPU compute buffer size = 300.75 MiB
llama_context: graph nodes = 1338
llama_context: graph splits = 1
common_init_from_params: setting dry_penalty_last_n to ctx_size = 4096
common_init_from_params: warming up the model with an empty run - please wait ... (--no-warmup to disable)
**Segmentation fault (core dumped)**