From 79b1e72fb59d96a85f2f7b86c581cc39be983cdb Mon Sep 17 00:00:00 2001
From: Arthur Hanson Rasmusson <arthur@vgpu.io>
Date: Thu, 29 Oct 2026 05:46:14 -0400
Subject: vgsp: sticky C597 attachment + BEGIN recognizer + draw-scan window;
 draws captured and replayed on 3D lane (engine reaches program header
 validation); guest-page blob delivery; two mdevs coexist (SESSION 153
 r944-r946)

---
 kernel/gsp_phys_booter.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

(limited to 'kernel/gsp_phys_booter.c')

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index f7b43fb..6228d28 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -19375,6 +19375,29 @@ static u32 gsp_phys_rmcall_gr_3d_patch_window(const u32 *in, u32 n, u32 *out,
 				   addr < 0x4000 && (addr & 0x3fu) == 0x14 &&
 				   cnt >= 2) {
 				pair = true;
+			} else if (op == 1 && (addr == 0x1c00 || addr == 0x1c10) &&
+				   cnt >= 3) {
+				/* SESSION 153-CONTINUED-10: SET_VERTEX_STREAM_
+				 * A_FORMAT(j)+BASE(j) run [fmt, upper, lower]
+				 * (j*0x10 stride) - the vertex data the draw
+				 * reads. Observed [00001000 1 2150b790]. */
+				lo_i = 1;
+				pair = true;
+			} else if (op == 1 && addr == 0x2380 && cnt >= 3) {
+				/* SET_CONSTANT_BUFFER_SELECTOR_A/B:
+				 * [size, upper, lower]; observed
+				 * [00010000 1 2150a500]. */
+				lo_i = 1;
+				pair = true;
+			} else if (op == 1 && addr >= 0x0800 && addr < 0x0c00 &&
+				   (addr & 0x3fu) == 0u && cnt >= 2) {
+				/* SET_COLOR_TARGET_A/B(j) offset pair:
+				 * [upper, lower, w, h, fmt]; the surface the
+				 * draw rasterizes into (must live in guest
+				 * RAM for the present lane to see pixels).
+				 * Observed [1 222fa200 40 4 f7 0]. */
+				lo_i = 0;
+				pair = true;
 			}
 			if (pair && gsp_phys_rmcall_gr_3d_reloc(&d[lo_i],
 								&d[lo_i + 1],
@@ -20177,6 +20200,29 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 				memcpy(sh_page + (inl->dst_va &
 						  (GSP_PHYS_PAGE_SIZE - 1)),
 				       inl->data, len);
+				/*
+				 * SESSION 153-CONTINUED-10: a stream3d (3D
+				 * method-window) submission maps the engine's
+				 * VAs straight at the GUEST page HPA
+				 * (gsp_phys_rmcall_gr_map_shadow_locked
+				 * installs the guest PTE - there is no
+				 * shadow-chunk copy in that path), so the
+				 * engine's I-fetch reads the guest page, not
+				 * sh_page. The GLX program page is never
+				 * written by the guest itself (the driver's
+				 * uploads never ran), and the r945 evidence is
+				 * exactly that: "Graphics Exception: Shader
+				 * Program Header 11/18 Error" on the draw
+				 * whose inline prog-hex blob had only reached
+				 * this shadow copy. Author the inline bytes
+				 * into the guest page too, emulating the
+				 * upload that never executed.
+				 */
+				if (stream3d && pg->hpa)
+					memcpy((u8 *)__va(pg->hpa) +
+						       (inl->dst_va &
+							(GSP_PHYS_PAGE_SIZE - 1)),
+					       inl->data, len);
 				copied++;
 			}
 			/*
-- 
cgit v1.2.3