diff options
| -rw-r--r-- | kernel/gsp_rm_emulation.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c index b4c2872..6996469 100644 --- a/kernel/gsp_rm_emulation.c +++ b/kernel/gsp_rm_emulation.c @@ -3076,9 +3076,12 @@ static bool gsp_rm_ctrl_forward(struct gsp_emu_context *ctx, /* * Allocate the backend's BINAPI object: rpc_gsp_rm_alloc_v03_00 * { hClient, hParent, hObject=0, hClass, status, paramsSize=0, - * flags, reserved[4] }. The guest's own alloc used the DEVICE - * as parent (hParent=0xbeef0004), so mirror that. The reply - * carries status at +16 and the chosen handle at +32. + * flags, reserved[4] }. The guest's own alloc used the + * SUBDEVICE as parent (hParent=0xbeef0004 where 0xbeef0004 is + * the class-0x2080 child 0xbeef0003; the first attempt with the + * device parent came back NV_ERR_INVALID_OBJECT_PARENT, 0x36), + * so mirror that. The reply carries status at +16 and the + * chosen handle at +32. */ u8 *areq; void *arsp = NULL; @@ -3089,7 +3092,7 @@ static bool gsp_rm_ctrl_forward(struct gsp_emu_context *ctx, if (!areq) goto fallback; memcpy(areq + 0, &snap.h_internal_client, 4); - memcpy(areq + 4, &snap.h_internal_device, 4); + memcpy(areq + 4, &snap.h_internal_subdevice, 4); memcpy(areq + 12, &acls, 4); ret = gsp_phys_backend_rpc(GSPRM_RPC_FUNC_GSP_RM_ALLOC, areq, 32, &arsp, &arsp_len, 500); |