diff options
| -rw-r--r-- | kernel/gsp_phys_booter.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index ecf95b6..c2390d6 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -16869,6 +16869,24 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, inl->data, len); copied++; } + /* + * m134: re-apply the pointer relocation AFTER the inline + * data replay. The inline records carry the driver's own + * parameter block (the original guest pointers) and were + * overwriting the relocated pointers in the page that is + * actually mapped for the engine - the rewrite at 16771 + * and every dump before this point looked correct, but + * the win0/win1 copy below copied the restored originals + * (m133: win0 param page held 0x7d8a1ec00000 while the + * +0x150 dump held 0x110000). Idempotent: already + * relocated values no longer match a guest data VA. + */ + if (pg->hpa && pg->qmd_word >= 32 && pg->qmd_word <= 47 && + !(pg->qmd_word & 1)) + gsp_phys_gr_rewrite_data_vars((u32 *)sh_page, + GSP_PHYS_PAGE_SIZE / 4, req, + (pg->qmd_word - 32) / 2, + (u32 *)__va(pg->hpa)); if (copied) { u32 sh_line = boot_stage.rmcall_guest_pt_next_line; |