diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-24 14:12:55 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-24 14:12:55 -0400 |
| commit | 005b8e24b382f387ca1217018f9209aca741d726 (patch) | |
| tree | 93cb5f2ecebf3882f18ee6e3d51e60bcb08c79d6 /wiki/CUDA-Userspace-Driver.md | |
| parent | 3497ceb950e57130fdec244318e5b6b9ea58a63e (diff) | |
| download | open-iov-005b8e24b382f387ca1217018f9209aca741d726.tar.gz open-iov-005b8e24b382f387ca1217018f9209aca741d726.zip | |
vgsp-sema r627: the copy-landing parity pass no longer clobbers per-page landings - the r623c wrong-write site
The post-loop parity store (r254-era) recorded a large virtual-destination
copy's whole range contiguously (dst + po) AFTER the per-page loop had
already stored each page's true resolved PA (m180/r391). For a scattered
UVM host buffer the contiguity guess overwrote the true entries; the next
copy of the same VA then followed the poisoned ledger (the non-pin DIVERGE
branch keeps the ledger) and wrote client c-data into guest pages the
kernel had since re-used.
r623c evidence chain (saxpy D2H readback of 0x70e64e700000):
sema-ledger: rewrite va=0x70e64e77f000 old=0x12e700000 new=0x115800000
504x sema-ledger: DIVERGE write ... prev=0x1158xxxxx cur=0x12e7xxxxx
guest panic: kchannelGetGfid_IMPL+0x12, garbage 0x44560800445590f0
(IEEE754 floats 854.25/856.125 = client c-data in nvidia channel structs)
Fix: the parity pass skips pages the per-page loop already stored (lookup
guard); it only seeds pages the loop did not reach. True per-page landings
are never overwritten.
Diffstat (limited to 'wiki/CUDA-Userspace-Driver.md')
0 files changed, 0 insertions, 0 deletions