diff options
| -rw-r--r-- | kernel/gsp_phys_booter.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 39c8a3a..8fd5d5b 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -16485,6 +16485,17 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, gsp_phys_gr_submitted++; gsp_phys_gr_override_apply_param(); + /* + * m124: reset the window-0 shadow slot cursor per launch. The cursor + * was only initialized once at boot, so a second forwarded launch in + * the same boot (e.g. the guest's vadd after the mail kernel) copied + * its param/program/bank pages into slots 0x110+ - the pre-commit + * BOUNCE window - and the same launch's data copy-in then overwrote + * the program page (silent corruption; no launch can survive it). + * The win0 PTEs are planted once at stage 3; reusing the same VAs + * with fresh content is the proven pattern. + */ + boot_stage.rmcall_gr_shadow_win0_used = 0; mutex_lock(&gsp_phys_rm_lock); if (!gsp_phys_backend_gr_ready()) { mutex_unlock(&gsp_phys_rm_lock); |