r525 the BINAPI-07 oracle object under the adopted internal client: a runtime root alloc answers NV_ERR_INVALID_CLIENT (0x23) because the server's internal client is adopted, so allocate the class-0x2081 child directly under the internal subdevice with a candidate handle list

1 files changed, 40 insertions, 58 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index 37f7054..90556f2 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -3026,64 +3026,42 @@ static int gsp_rm_binapi07_backend_alloc(u32 h_client, u32 h_parent,
 }
 
 /*
- * Build the oracle client on the live session: the captured real-client
- * sequence for a class-0x2081 consumer (root -> device 0xcaf00000 ->
- * subdevice 0xcaf00004 -> class-0x2081 child). The subdevice attempt alone
- * had answered NV_ERR_NOT_SUPPORTED (0x56) because the server dispatches the
- * method from the OBJECT's class, so a real class-0x2081 object is needed.
- * Returns 0 with *out_client/*out_object set on success.
+ * Build the oracle object on the live session: a class-0x2081 child of the
+ * session's internal subdevice, since the server dispatches the method from
+ * the OBJECT's class (the subdevice attempt alone answered
+ * NV_ERR_NOT_SUPPORTED, 0x56, and a fresh root client at runtime answered
+ * NV_ERR_INVALID_CLIENT, 0x23 - the ladder "adopts" the server's own
+ * internal client instead of creating one). A small candidate list of
+ * likely-free handles in that client's namespace is tried; the first
+ * success wins. Returns 0 with *out_object set.
  */
 static int gsp_rm_binapi07_backend_setup(struct gsp_emu_context *ctx,
-					 u32 *out_client, u32 *out_object)
+					 struct gsp_phys_backend_static_config *snap,
+					 u32 *out_object)
 {
-	u8 p120[120], p56[56], p4[4];
-	u32 st = 0xffffffff, cli = 0, dev = 0xcaf00000u;
-	u32 sub = 0xcaf00004u, bin = 0xcaf00099u;
-	int ret;
-
-	/* 1. Root: hClient=0, the server picks and returns the handle. */
-	memset(p120, 0, sizeof(p120));
-	ret = gsp_rm_binapi07_backend_alloc(0, 0, 0, 0x0, p120, 120, true,
-					    &cli, &st);
-	nv_vgpu_info(ctx->vgpu,
-		     "vgsp-rm: BINAPI-EXPERIMENT oracle root alloc: ret=%d status=0x%x hClient=0x%x",
-		     ret, st, cli);
-	if (ret || st != 0 || !cli)
-		return -EIO;
-
-	/* 2. Device (class 0x80): deviceId 0, hClientShare = hClient. */
-	memset(p56, 0, sizeof(p56));
-	memcpy(p56 + 4, &cli, 4);
-	ret = gsp_rm_binapi07_backend_alloc(cli, cli, dev, 0x80, p56, 56,
-					    false, &dev, &st);
-	nv_vgpu_info(ctx->vgpu,
-		     "vgsp-rm: BINAPI-EXPERIMENT oracle device alloc: ret=%d status=0x%x hDevice=0x%x",
-		     ret, st, dev);
-	if (ret || st != 0 || !dev)
-		return -EIO;
-
-	/* 3. Subdevice (class 0x2080): subDeviceId 0. */
-	memset(p4, 0, sizeof(p4));
-	ret = gsp_rm_binapi07_backend_alloc(cli, dev, sub, 0x2080, p4, 4,
-					    false, &sub, &st);
-	nv_vgpu_info(ctx->vgpu,
-		     "vgsp-rm: BINAPI-EXPERIMENT oracle subdevice alloc: ret=%d status=0x%x hSubdevice=0x%x",
-		     ret, st, sub);
-	if (ret || st != 0 || !sub)
-		return -EIO;
-
-	/* 4. BINAPI (class 0x2081) under the subdevice, 4 zero params. */
-	ret = gsp_rm_binapi07_backend_alloc(cli, sub, bin, 0x2081, p4, 4,
-					    false, &bin, &st);
-	nv_vgpu_info(ctx->vgpu,
-		     "vgsp-rm: BINAPI-EXPERIMENT oracle BINAPI alloc: ret=%d status=0x%x hObject=0x%x",
-		     ret, st, bin);
-	if (ret || st != 0 || !bin)
-		return -EIO;
-
-	*out_client = cli;
-	*out_object = bin;
-	return 0;
+	static const u32 cand[] = { 0xabcd2081u, 0xabcd2001u, 0xabcd2a2au,
+				    0xabcd5f5fu, 0xabcd1234u };
+	u8 p4[4] = { 0, 0, 0, 0 };
+	u32 st = 0xffffffff, obj = 0;
+	int i, ret;
+
+	for (i = 0; i < (int)ARRAY_SIZE(cand); i++) {
+		u32 want = cand[i];
+
+		obj = want;
+		ret = gsp_rm_binapi07_backend_alloc(snap->h_internal_client,
+						    snap->h_internal_subdevice,
+						    want, 0x2081, p4, 4,
+						    false, &obj, &st);
+		nv_vgpu_info(ctx->vgpu,
+			     "vgsp-rm: BINAPI-EXPERIMENT oracle BINAPI alloc attempt %d: hObject=0x%x ret=%d status=0x%x",
+			     i, want, ret, st);
+		if (!ret && st == 0 && obj) {
+			*out_object = obj;
+			return 0;
+		}
+	}
+	return -EIO;
 }
 
 /*
@@ -3186,11 +3164,15 @@ static bool gsp_rm_ctrl_forward(struct gsp_emu_context *ctx,
 		goto fallback;
 
 	if (guest_handles && !gsp_rm_binapi07_be_object) {
-		u32 cli = 0, obj = 0;
+		u32 obj = 0;
 
-		if (gsp_rm_binapi07_backend_setup(ctx, &cli, &obj))
+		if (gsp_rm_binapi07_backend_setup(ctx, &snap, &obj))
 			goto fallback;
-		gsp_rm_binapi07_be_client = cli;
+		/*
+		 * The object lives in the internal client's namespace; the
+		 * control is sent as that client (snap.h_internal_client).
+		 */
+		gsp_rm_binapi07_be_client = snap.h_internal_client;
 		gsp_rm_binapi07_be_object = obj;
 	}