diff options
Diffstat (limited to 'kernel/gsp_phys_booter.c')
| -rw-r--r-- | kernel/gsp_phys_booter.c | 22 |
1 files changed, 18 insertions, 4 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 62ab6eb..33e1b35 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -27933,7 +27933,21 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, * into the guest page too, emulating the * upload that never executed. */ - if (stream3d && pg->hpa) + /* + * SESSION 154: a program page whose CODESRC + * verdict keeps it at the guest VA is read by + * the engine directly (code_keep_guest sets + * mapped without a QMD rewrite). The inline + * image MUST land in the guest HPA there even + * when the window was not classified + * stream3d: the shadow copy is then unused and + * the engine fetches the empty guest page. + * r1470: the complete 0x41c0000 window's VS + * applied guest=0 into the shadow while the + * guest page stayed zero (the win0 shadow copy + * then restored the zero page as well). + */ + if ((stream3d || code_keep_guest) && pg->hpa) memcpy((u8 *)__va(pg->hpa) + (inl->dst_va & (GSP_PHYS_PAGE_SIZE - 1)), @@ -27951,8 +27965,8 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, inl_apply_log++; pr_info("vgsp-gr: INLINE-APPLY dst=0x%llx len=%u pg_va=0x%llx guest=%u first=%08x %08x\n", inl->dst_va, len, pg_va, - stream3d && pg->hpa ? - 1u : 0u, + (stream3d || code_keep_guest) && + pg->hpa ? 1u : 0u, len >= 4 ? get_unaligned_le32(inl->data) : 0u, len >= 8 ? get_unaligned_le32(inl->data + 4) : 0u); } @@ -27967,7 +27981,7 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, * still rejects the header, the bytes are known * present at the VA it fetched. */ - if (stream3d && pg->hpa) { + if ((stream3d || code_keep_guest) && pg->hpa) { static u32 inl_rb_log; const u32 *gw = (const u32 *) ((u8 *)__va(pg->hpa) + |