spe cfg file addr change(malloc --> 0x9A00 0000) when phy get the cfg file addr return the phy addr, not the vir addr