From cc784674988a9401a430fd346fc2ffedeb36b524 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 7 Oct 2026 21:03:19 -0400 Subject: vgsp: m140 - resolve 33 pages/pointer (128KB buffers with 0x400 in-page offset span 33 pages; tails read the next reloc record) --- kernel/gsp_sema_service.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index ac2e561..9872fac 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -9564,8 +9564,12 @@ static bool svc_gr_page_inline_covers(u64 page) * bounce cap (mail 2x32=64, vadd 3x32=96); at 64/ptr the second/third * candidate run was truncated by the cap and its pointer word never * rewritten (m119: first LDG base c[0x0][0x168] possibly untouched). + * m140: 32 -> 33. A cudaMalloc'd 128 KB buffer whose pointer is 0x400 + * into its page spans 33 pages (32 full + the 1 KB tail), and the kernel + * accesses the tail: with 32 pages the tail read the NEXT candidate's + * relocated page (wrong values; vadd tails). 3x33=99 <= the 100-page cap. */ -#define SVC_GR_DATA_PAGES_PER_PTR 32u +#define SVC_GR_DATA_PAGES_PER_PTR 33u /* m114: total pages the pre-commit bounce window can carry (slot 100 is * the mail message). */ #define SVC_GR_DATA_BOUNCE_MAX 100u -- cgit v1.2.3