vgsp-gr: enlarge the data bounce window to 208 pages (256 KB operands)

victory_matmul (256x256 float: 256 KB per operand) failed with all-wrong
results while 128 KB workloads passed: the relocation bounce window was
112 pages with a 100-page data cap and 33 pages per pointer, so each 64-page
operand was truncated and the engine ran on partial/mismatched windows.

Grow the planted bounce window to 208 pages (main-PT slots 0x110..0x1df),
move the mail page to the last data-free slot (206, marker 207), and raise
the per-pointer cap to 68 pages and the data cap to 205 (three 256 KB
operands = 3x68 = 204 <= 205). Operands larger than 256 KB still hit the cap
and need a chunked data path (documented at the define).

2 files changed, 28 insertions, 12 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 0c3e829..110731d 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -2188,19 +2188,27 @@ static struct gsp_phys_boot_stage {
 	/* m104: module page holding the injected mail_kernel message. */
 	struct gsp_phys_boot_chunk rmcall_gr_mail;
 	/*
-	 * m114: pre-commit bounce window. 112 pages planted into the main
-	 * small-PT at slots 0x110..0x17f during stage 3 (the proven win0
-	 * pattern: the SM walker resolves the commit-time tree only). The
-	 * launch copies the kernel's data pages in, rewrites the pointers to
-	 * these VAs (reloc base 0x110000), and copies the results back after
-	 * the release; page 100 (VA 0x174000) carries the mail message.
+	 * m114: pre-commit bounce window, planted into the main small-PT at
+	 * slots 0x110..0x1df during stage 3 (the proven win0 pattern: the SM
+	 * walker resolves the commit-time tree only). The launch copies the
+	 * kernel's data pages in, rewrites the pointers to these VAs (reloc
+	 * base 0x110000), and copies the results back after the release.
+	 *
+	 * The window is 208 pages so the data region below the mail page can
+	 * carry the operand pages of kernels whose buffers exceed the old
+	 * 128 KB (victory_matmul's 256 KB buffers need 64 pages each; three
+	 * of them plus argument/bank candidates exceed the old 100-page /
+	 * 33-pages-per-pointer caps and the engine then ran on truncated
+	 * windows). The mail page is the LAST data-free page (slot 206) and
+	 * the m132 marker sits at 207; the main PT page deliberately covers
+	 * the whole 0x110000..0x1df000 range with nothing else planted there.
 	 */
 	struct gsp_phys_boot_chunk rmcall_gr_bounce;
 	u32 rmcall_gr_bounce_used;
-#define GSP_PHYS_RMCALL_GR_BOUNCE_PAGES	112u
+#define GSP_PHYS_RMCALL_GR_BOUNCE_PAGES	208u
 #define GSP_PHYS_RMCALL_GR_BOUNCE_SLOT0	0x110u
 #define GSP_PHYS_RMCALL_GR_BOUNCE_VA0	0x110000ULL
-#define GSP_PHYS_RMCALL_GR_MAIL_SLOT	100u
+#define GSP_PHYS_RMCALL_GR_MAIL_SLOT	206u
 	/* m99: guest data identity-map table branches (see the PD*_MAX block). */
 	struct gsp_phys_boot_chunk
 		rmcall_gr_data_pd1[GSP_PHYS_RMCALL_GR_DATA_PD1_MAX];
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 10992c3..c07915f 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -12366,10 +12366,18 @@ static bool svc_gr_page_inline_covers(u64 page)
  * accesses the tail: with 32 pages the tail read the NEXT candidate's
  * relocated page (wrong values; vadd tails). 3x33=99 <= the 100-page cap.
  */
-#define SVC_GR_DATA_PAGES_PER_PTR	33u
-/* m114: total pages the pre-commit bounce window can carry (slot 100 is
- * the mail message). */
-#define SVC_GR_DATA_BOUNCE_MAX	100u
+/*
+ * m150 (large buffers): the bounce window was grown to 208 pages (mail page
+ * at slot 206). 68 pages per candidate/pointer covers a 256 KB cudaMalloc'd
+ * operand whose pointer sits 0x400 into its page (64 full + offset + tail),
+ * and up to three such operands (3x68 = 204 <= 205) fit below the mail page.
+ * Larger-than-256 KB operands still hit the cap; they need a chunked data
+ * path (future work).
+ */
+#define SVC_GR_DATA_PAGES_PER_PTR	68u
+/* Total pages the pre-commit bounce window can carry below the mail page
+ * (GSP_PHYS_RMCALL_GR_MAIL_SLOT = 206). */
+#define SVC_GR_DATA_BOUNCE_MAX	205u
 
 static u32 svc_gr_data_log;	/* m142: bounded per-page attribution log */
 static u32 svc_gr_src_log;	/* m150: bounded per-candidate source log */