vgsp-mme: log-only non-blind d24/d25 capture - print shadow[c597] 0x3490/0x3494/0xd24/0xd25 via gsp_phys_mme_shadow_read (8/boot cap, zero behavior change) so sema_mme_state_d24/d25 can be seeded from the engine's own state instead of blind values

1 files changed, 25 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 67642c8..9d5fb71 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -5326,6 +5326,31 @@ static void gsp_phys_store_side_log(void __iomem *bar0, const char *tag,
 		gsp_phys_mme_shadow_read(bar0, 0xc597u, 0xd78u),
 		gsp_phys_mme_shadow_read(bar0, 0xc597u, 0x1618u));
 	/*
+	 * r1453 capture (LOG-ONLY, zero behaviour change): the engine's own
+	 * macro-state shadow values for the slow-path STATE 0xD24/0xD25
+	 * inputs. d24 = SET_MME_SHADOW_SCRATCH(0x24) = method 0x3490, d25 =
+	 * scratch 0x25 = method 0x3494 (the client/X-lane never writes
+	 * either, so the MME shadow is the only non-blind source of these
+	 * values). 0xd24/0xd25 are read as literal method indices through
+	 * the same shadow port (same helper; masked to 12 bits) so the
+	 * tracker interpretation is captured alongside the write methods.
+	 * Rate-limited to 8 lines per boot, no new module parameter; the
+	 * reads use the existing shadow-read path only (no emission change).
+	 */
+	{
+		static u32 d24_d25_cap_n;
+
+		if (d24_d25_cap_n < 8u) {
+			d24_d25_cap_n++;
+			pr_info("vgsp-store: %s h=0x%x shadow[c597] d24d25 0x3490=%08x 0x3494=%08x 0xd24=%08x 0xd25=%08x\n",
+				tag, h_object,
+				gsp_phys_mme_shadow_read(bar0, 0xc597u, 0x3490u),
+				gsp_phys_mme_shadow_read(bar0, 0xc597u, 0x3494u),
+				gsp_phys_mme_shadow_read(bar0, 0xc597u, 0xd24u),
+				gsp_phys_mme_shadow_read(bar0, 0xc597u, 0xd25u));
+		}
+	}
+	/*
 	 * SESSION 153-CONTINUED-83 probe 2: the CALL trigger methods the
 	 * window uses (are the calls even reaching the MME?), a repeat read
 	 * (does a read clear?), and the dword-address interpretation of the