diff options
Diffstat (limited to 'kernel/gsp_sema_service.c')
| -rw-r--r-- | kernel/gsp_sema_service.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index ac2e561..9872fac 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -9564,8 +9564,12 @@ static bool svc_gr_page_inline_covers(u64 page) * bounce cap (mail 2x32=64, vadd 3x32=96); at 64/ptr the second/third * candidate run was truncated by the cap and its pointer word never * rewritten (m119: first LDG base c[0x0][0x168] possibly untouched). + * m140: 32 -> 33. A cudaMalloc'd 128 KB buffer whose pointer is 0x400 + * into its page spans 33 pages (32 full + the 1 KB tail), and the kernel + * accesses the tail: with 32 pages the tail read the NEXT candidate's + * relocated page (wrong values; vadd tails). 3x33=99 <= the 100-page cap. */ -#define SVC_GR_DATA_PAGES_PER_PTR 32u +#define SVC_GR_DATA_PAGES_PER_PTR 33u /* m114: total pages the pre-commit bounce window can carry (slot 100 is * the mail message). */ #define SVC_GR_DATA_BOUNCE_MAX 100u |