diff options
Diffstat (limited to 'kernel/gsp_phys_booter.c')
| -rw-r--r-- | kernel/gsp_phys_booter.c | 64 |
1 files changed, 64 insertions, 0 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index babd3c0..0cd45f5 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -31167,6 +31167,17 @@ gr_page_unmapped: if ((w0 & 0x1fu) != 1u || ((w0 >> 10) & 0xfu) != 1u) continue; + /* + * eng56: a 640 B candidate with IMAP w6=0 is + * not the live VTG SPH (c749 fam 0x4350000: + * it authored a zero-map image and the DS + * went badf1201). Require a nonzero w6; fall + * back to the builtin image when no record + * qualifies. + */ + if (inl->len >= 28u && + get_unaligned_le32(inl->data + 24u) == 0u) + continue; vinl = inl; vj = vj2; } @@ -31290,6 +31301,59 @@ gr_page_unmapped: !READ_ONCE(gsp_phys_rmcall_gr_sph_vtg600)) ? (fam + 0x900u) : (fam + 0x600u); + /* + * eng56: the window's own slot-1 pair (0x2054) + * executes AFTER the synthesized prelude and + * overwrites j1 with the client's +0x600/+0x300 + * SASS pointer (c743: DS-IMAGE st1=0b0b7208 + * while st0=the authored 020a0481). Rewrite that + * operand in the patched window to the authored + * +0x900 image, in the same form the window's + * relocation chose (client family VA or its + * pair-cache shadow line), so the window's own + * bind and the prelude agree. + */ + if (vtg_auth && win3d && win3d_n) { + u32 wi, wi2, nrew = 0; + + for (wi = 0; wi + 2u < win3d_n; wi++) { + u32 lo, page, nlo = 0; + + if (win3d[wi] != 0x20020815u) + continue; + lo = win3d[wi + 2u]; + if ((lo & 0xfffu) != 0x600u && + (lo & 0xfffu) != 0x300u) + continue; + page = lo & ~0xfffu; + if (fam && + page == (u32)(fam & ~0xfffu)) + nlo = (u32)fam | 0x900u; + else + for (wi2 = 0; + wi2 < gsp_phys_gr_pair_n; + wi2++) + if ((u32) + gsp_phys_gr_pair_va[wi2] + == page) { + nlo = page | + 0x900u; + break; + } + if (!nlo) + continue; + ((u32 *)win3d)[wi + 2u] = nlo; + nrew++; + pr_info_ratelimited("vgsp-gr: SPH-SLOT1-REWRITE old=0x%08x new=0x%08x h=0x%x push=0x%llx\n", + lo, nlo, req->h_object, + req->push_va); + } + if (nrew) + pr_info_ratelimited("vgsp-gr: SPH-SLOT1 done rewrites=%u fam=0x%llx h=0x%x push=0x%llx\n", + nrew, (unsigned long long)fam, + req->h_object, req->push_va); + } + bool bind_binding = READ_ONCE(gsp_phys_rmcall_gr_sph_bind_binding); bool pair_safe = |