diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-07 21:03:19 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-07 21:03:19 -0400 |
| commit | cc784674988a9401a430fd346fc2ffedeb36b524 (patch) | |
| tree | 095f08035aa6aede85e7477e5618274bf337a738 | |
| parent | 6306336996a6392a533cee520470e577b709871d (diff) | |
| download | open-iov-cc784674988a9401a430fd346fc2ffedeb36b524.tar.gz open-iov-cc784674988a9401a430fd346fc2ffedeb36b524.zip | |
vgsp: m140 - resolve 33 pages/pointer (128KB buffers with 0x400 in-page offset span 33 pages; tails read the next reloc record)
| -rw-r--r-- | kernel/gsp_sema_service.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index ac2e561..9872fac 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -9564,8 +9564,12 @@ static bool svc_gr_page_inline_covers(u64 page) * bounce cap (mail 2x32=64, vadd 3x32=96); at 64/ptr the second/third * candidate run was truncated by the cap and its pointer word never * rewritten (m119: first LDG base c[0x0][0x168] possibly untouched). + * m140: 32 -> 33. A cudaMalloc'd 128 KB buffer whose pointer is 0x400 + * into its page spans 33 pages (32 full + the 1 KB tail), and the kernel + * accesses the tail: with 32 pages the tail read the NEXT candidate's + * relocated page (wrong values; vadd tails). 3x33=99 <= the 100-page cap. */ -#define SVC_GR_DATA_PAGES_PER_PTR 32u +#define SVC_GR_DATA_PAGES_PER_PTR 33u /* m114: total pages the pre-commit bounce window can carry (slot 100 is * the mail message). */ #define SVC_GR_DATA_BOUNCE_MAX 100u |