diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-05 18:29:48 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-05 18:29:48 -0400 |
| commit | e9799396d6a20685a632ddf876d52eb4e127d799 (patch) | |
| tree | 668e693c04a11f8198b0c89bedae38baf240580c | |
| parent | fc8d7923c83c6babd0ee8c23565ac18b709fa5a5 (diff) | |
| download | open-iov-e9799396d6a20685a632ddf876d52eb4e127d799.tar.gz open-iov-e9799396d6a20685a632ddf876d52eb4e127d799.zip | |
vgsp: golden9c - bind golden channel to the ladder's proven VAS
The captured golden VAS cannot be fully constructed by the ladder: its
COPY_SERVER_RESERVED_PDES (0x90f10106) consumes client-RM-reserved page-table
level PAs that only exist in the real client's memmgr (and are boot-specific).
Bind the golden channel to the ladder's own FERMI_VASPACE_A, which already has
server page tables installed by the DMA_SET_PAGE_DIRECTORY + PDB build, so the
pVAS validation in kchannelConstruct_IMPL is satisfied. hObjectBuffer stays 0
(host sysmem PB is client-local) and the USERD keep the proven V5 memdesc
pairing.
| -rw-r--r-- | kernel/gsp_phys_booter.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index a25a0f0..cc95175 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -7917,7 +7917,24 @@ static int gsp_phys_rmcall_golden_replay(void __iomem *bar0) GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN9 && gsp_phys_rmcall_engine_is_gr()) { ch.flags = cpu_to_le32(GSP_PHYS_RMCALL_CHANNEL_FLAG_GOLDEN9); + ch.internal_flags = cpu_to_le32( + GSP_PHYS_RMCALL_CHANNEL_INTERNALFLAGS_PRIV_KERNEL); + /* + * The captured golden VAS has no server page tables until the + * 0x90f10106 COPY_SERVER_RESERVED_PDES control runs, and the + * channel alloc's pVAS validation rejects an empty VAS (NOCAT + * 0x51a8f10/0x52008f4/0x51a89a4). Bind the golden channel to + * the ladder's own VAS (the one the working V5 channel/TSG + * already uses, with its page tables installed). + */ + ch.h_va_space = cpu_to_le32(boot_stage.rmcall_vas); ch.h_object_buffer = cpu_to_le32(0); + /* + * The real wire carries its client-local USERD handle; the + * ladder keeps the memdesc pair the V5 shape proved + * (userdMem sysmem chunk, handle array zeroed). + */ + ch.h_userd_memory[0] = cpu_to_le32(0); ch.instance_mem = gsp_phys_rmcall_mem_desc( GSP_PHYS_RMCALL_BUF_INSTANCE); ch.userd_mem = gsp_phys_rmcall_mem_desc( |