diff options
| -rw-r--r-- | kernel/gsp_phys_booter.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 98b85e8..6c415ec 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -1087,6 +1087,19 @@ bool gsp_phys_boot_requested(void) (1u << 21)) /* + * Mode-31 sibling A flags (m29 decode): the identical captured golden shape + * with USERD_INDEX_VALUE=4 instead of 3. The index field is what the server + * turns into the fixed ChID request (kfifoChidMgrAllocChid: ChID64 = + * ownerGranularity + index), so a second golden-shape channel on the same + * client would collide with D's fixed chid 3 and fail NV_ERR_NO_MEMORY (0x51) + * plus the kchannelConstruct/kfifoChidMgr asserts. A is a pure TSG commit + * carrier, so its ChID is functionally irrelevant; index 4 is a free slot. + */ +#define GSP_PHYS_RMCALL_CHANNEL_FLAG_GOLDEN9_SIBLING_A \ + (u32)(GSP_PHYS_RMCALL_CHANNEL_FLAG_PRIVILEGED | (4u << 8) | \ + (1u << 21)) + +/* * Mode-28 alternative golden flags (unused after the m3b first run kept the * captured word): the captured golden word with the USERD placement bits * clear, for experiments where the hardware control block must sit at @@ -9962,7 +9975,7 @@ static int gsp_phys_rmcall_golden_sibling_alloc(void __iomem *bar0) ch.gp_fifo_entries = cpu_to_le32(GSP_PHYS_RMCALL_GOLDEN_GPFIFO_ENTRIES); ch.engine_type = cpu_to_le32(GSP_PHYS_RMCALL_ENGINE_GR0); - ch.flags = cpu_to_le32(GSP_PHYS_RMCALL_CHANNEL_FLAG_GOLDEN9); + ch.flags = cpu_to_le32(GSP_PHYS_RMCALL_CHANNEL_FLAG_GOLDEN9_SIBLING_A); ch.internal_flags = cpu_to_le32( GSP_PHYS_RMCALL_CHANNEL_INTERNALFLAGS_PRIV_KERNEL); ret = gsp_phys_rmcall_alloc_fb_mem(bar0, |