diff options
Diffstat (limited to 'kernel/gsp_phys_booter.c')
| -rw-r--r-- | kernel/gsp_phys_booter.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index a25a0f0..cc95175 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -7917,7 +7917,24 @@ static int gsp_phys_rmcall_golden_replay(void __iomem *bar0) GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN9 && gsp_phys_rmcall_engine_is_gr()) { ch.flags = cpu_to_le32(GSP_PHYS_RMCALL_CHANNEL_FLAG_GOLDEN9); + ch.internal_flags = cpu_to_le32( + GSP_PHYS_RMCALL_CHANNEL_INTERNALFLAGS_PRIV_KERNEL); + /* + * The captured golden VAS has no server page tables until the + * 0x90f10106 COPY_SERVER_RESERVED_PDES control runs, and the + * channel alloc's pVAS validation rejects an empty VAS (NOCAT + * 0x51a8f10/0x52008f4/0x51a89a4). Bind the golden channel to + * the ladder's own VAS (the one the working V5 channel/TSG + * already uses, with its page tables installed). + */ + ch.h_va_space = cpu_to_le32(boot_stage.rmcall_vas); ch.h_object_buffer = cpu_to_le32(0); + /* + * The real wire carries its client-local USERD handle; the + * ladder keeps the memdesc pair the V5 shape proved + * (userdMem sysmem chunk, handle array zeroed). + */ + ch.h_userd_memory[0] = cpu_to_le32(0); ch.instance_mem = gsp_phys_rmcall_mem_desc( GSP_PHYS_RMCALL_BUF_INSTANCE); ch.userd_mem = gsp_phys_rmcall_mem_desc( |