From e9799396d6a20685a632ddf876d52eb4e127d799 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 5 Oct 2026 18:29:48 -0400 Subject: vgsp: golden9c - bind golden channel to the ladder's proven VAS The captured golden VAS cannot be fully constructed by the ladder: its COPY_SERVER_RESERVED_PDES (0x90f10106) consumes client-RM-reserved page-table level PAs that only exist in the real client's memmgr (and are boot-specific). Bind the golden channel to the ladder's own FERMI_VASPACE_A, which already has server page tables installed by the DMA_SET_PAGE_DIRECTORY + PDB build, so the pVAS validation in kchannelConstruct_IMPL is satisfied. hObjectBuffer stays 0 (host sysmem PB is client-local) and the USERD keep the proven V5 memdesc pairing. --- kernel/gsp_phys_booter.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'kernel') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index a25a0f0..cc95175 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -7917,7 +7917,24 @@ static int gsp_phys_rmcall_golden_replay(void __iomem *bar0) GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN9 && gsp_phys_rmcall_engine_is_gr()) { ch.flags = cpu_to_le32(GSP_PHYS_RMCALL_CHANNEL_FLAG_GOLDEN9); + ch.internal_flags = cpu_to_le32( + GSP_PHYS_RMCALL_CHANNEL_INTERNALFLAGS_PRIV_KERNEL); + /* + * The captured golden VAS has no server page tables until the + * 0x90f10106 COPY_SERVER_RESERVED_PDES control runs, and the + * channel alloc's pVAS validation rejects an empty VAS (NOCAT + * 0x51a8f10/0x52008f4/0x51a89a4). Bind the golden channel to + * the ladder's own VAS (the one the working V5 channel/TSG + * already uses, with its page tables installed). + */ + ch.h_va_space = cpu_to_le32(boot_stage.rmcall_vas); ch.h_object_buffer = cpu_to_le32(0); + /* + * The real wire carries its client-local USERD handle; the + * ladder keeps the memdesc pair the V5 shape proved + * (userdMem sysmem chunk, handle array zeroed). + */ + ch.h_userd_memory[0] = cpu_to_le32(0); ch.instance_mem = gsp_phys_rmcall_mem_desc( GSP_PHYS_RMCALL_BUF_INSTANCE); ch.userd_mem = gsp_phys_rmcall_mem_desc( -- cgit v1.2.3