1 files changed, 51 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 2b8b422..d79bfc5 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -14264,6 +14264,12 @@ MODULE_PARM_DESC(sema_mme_prelude_cap,
 static u64 svc_mme_sa_present;
 static u32 svc_mme_sa_entry[64];
 static u32 svc_mme_sa_log;
+/*
+ * SESSION 153-CONTINUED-70: last LOAD_MME_START_ADDRESS_RAM_POINTER (0x11c)
+ * value; the data port (0x120) writes entries for consecutive slots from
+ * here (see the 0x120 case in svc_mme_prelude_capture).
+ */
+static u32 svc_mme_sa_ptr;
 
 /*
  * SESSION 153-CONTINUED-68: furthest IR instruction any CAPTURED 0x114
@@ -14283,6 +14289,15 @@ u32 gsp_sema_mme_ir_end_get(void)
 }
 
 /*
+ * SESSION 153-CONTINUED-70: IR code words captured so far (the maturity
+ * gate's measure; the MME-PRE-DUMP prints it for the offline sim).
+ */
+u32 gsp_sema_mme_code_words_get(void)
+{
+	return READ_ONCE(svc_mme_prelude_code_words);
+}
+
+/*
  * SESSION 153-CONTINUED-68: instruction-granular coverage of the IR the
  * REPLAY buffer actually holds (marked for every 0x114 run that entered
  * svc_mme_prelude_buf). Values >= SVC_MME_IR_BITS are treated as covered
@@ -14392,7 +14407,43 @@ static void svc_mme_prelude_capture(const u8 *buf, u32 len, u64 push_va,
 				memcpy(&sv, buf + off + 4u + 4u * k, 4);
 				memcpy(&ev, buf + off + 8u + 4u * k, 4);
 				svc_mme_sa_record(sv, ev);
+				/* the pointer follows the pair (see the
+				 * 0x120 data-port case below). */
+				svc_mme_sa_ptr = sv + 1u;
+			}
+		} else if (addr == 0x11cu && cnt == 1u && span > 1u) {
+			/* pointer-only write (LOAD_MME_START_ADDRESS_RAM_
+			 * POINTER <- slot) */
+			u32 sv;
+
+			memcpy(&sv, buf + off + 4u, 4);
+			svc_mme_sa_ptr = sv;
+		}
+		/*
+		 * SESSION 153-CONTINUED-70: SA data-port form. The pair form
+		 * above only catches [slot,entry] runs AT 0x11c; a client that
+		 * seeds the pointer once and then streams entries through
+		 * LOAD_MME_START_ADDRESS_RAM (0x120) left every slot beyond
+		 * the seeded range unrecorded, so the builder stubbed macros
+		 * the client had really uploaded (r1143/r1144: only slots
+		 * 0..12 known while the window calls 34/39/40/48/51/57). The
+		 * data port takes consecutive slots from the last 0x11c
+		 * pointer value; whether the hardware auto-increments is not
+		 * externally documented, so the host-side table is treated as
+		 * a hint - the builder's keep/stub decision still A/Bs one
+		 * slot at a time and the engine only ever sees the client's
+		 * own runs.
+		 */
+		if (addr == 0x120u && cnt && span > 1u) {
+			u32 k;
+
+			for (k = 0; k < cnt; k++) {
+				u32 ev;
+
+				memcpy(&ev, buf + off + 4u + 4u * k, 4);
+				svc_mme_sa_record(svc_mme_sa_ptr + k, ev);
 			}
+			svc_mme_sa_ptr += cnt;
 		}
 		if (!svc_mme_setup_run_addr(addr)) {
 			off += span * 4u;