vgsp: m124 - reset the window-0 shadow slot cursor per launch (second launch collided with the bounce window)

1 files changed, 11 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 39c8a3a..8fd5d5b 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -16485,6 +16485,17 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 
 	gsp_phys_gr_submitted++;
 	gsp_phys_gr_override_apply_param();
+	/*
+	 * m124: reset the window-0 shadow slot cursor per launch. The cursor
+	 * was only initialized once at boot, so a second forwarded launch in
+	 * the same boot (e.g. the guest's vadd after the mail kernel) copied
+	 * its param/program/bank pages into slots 0x110+ - the pre-commit
+	 * BOUNCE window - and the same launch's data copy-in then overwrote
+	 * the program page (silent corruption; no launch can survive it).
+	 * The win0 PTEs are planted once at stage 3; reusing the same VAs
+	 * with fresh content is the proven pattern.
+	 */
+	boot_stage.rmcall_gr_shadow_win0_used = 0;
 	mutex_lock(&gsp_phys_rm_lock);
 	if (!gsp_phys_backend_gr_ready()) {
 		mutex_unlock(&gsp_phys_rm_lock);