greeneye: GMMU/FBIF observability, PTE decoder and oracle, MPU/libos simulator wave

Simulator development wave (docs 42-44): GMMU page-table entry decode with its oracle/workflow harness, FBIF observability, and MPU/LIBOS device surfaces in the device model, plus refreshed boot/machine/profile data (tu104-570.144), the qemu-line results, and the new unit tests. Docs 00/06/35-41 updated to match; harness helpers and .gitignore included.

1 files changed, 15 insertions, 5 deletions

diff --git a/debug/risc-v-gsp-rm-vm/docs/35-GREENEYE-SIMULATOR-DESIGN.md b/debug/risc-v-gsp-rm-vm/docs/35-GREENEYE-SIMULATOR-DESIGN.md
index 83954d4..d5bf4a4 100644
--- a/debug/risc-v-gsp-rm-vm/docs/35-GREENEYE-SIMULATOR-DESIGN.md
+++ b/debug/risc-v-gsp-rm-vm/docs/35-GREENEYE-SIMULATOR-DESIGN.md
@@ -129,11 +129,20 @@ reproducible twice identically and have its device requirements listed.
 |---|---|---|
 | B0 | flat image loads; first MMIO observed at `0x2000000000000A00` | done (native, lenient) |
 | B1 | device model serves the whole boot path: 0 unknown MMIO, 0 unhandled in windows; deterministic 2M-instruction run stopping at the boot-halt/report loop (`0x4010928`) | done (S1 device model; sessions `dumps/gsp-boot-b1-run1/2`) |
-| B2 | boot stage progress: vector table/TCM/MPU/trap handling exercised with the shim; passes the bootargs consumer and reaches the relocation copy, then stops on the known DMEM-runspace unknown (`fault @ 0x400EA0C`; docs/36 §4) | done (shim) |
-| B3 | first CSB/TRANSCOM mailbox poll with correct read-back semantics | target |
-| B4 | message loop reached (`appMain`/equivalent); waits on host message deterministically | target |
+| B2 | boot stage progress: vector table/TCM/MPU/trap handling exercised with the shim; passes the bootargs consumer and reaches the relocation copy | done (S1 device model + XMPU model + bootstrap-args shim; reaches B3) |
+| B3 | libos init completes (TCM registration, pagetable registration, DMA flush, external-interrupt arming) and the message-loop task blocks in the port wait | done (sessions `dumps/gsp-boot-b3-run1/2`: 474 043 insns, stop `ecall` at `0x4018038`, two-run identical) |
+| B4 | first CSB/TRANSCOM mailbox poll served with correct read-back semantics (host-traffic-triggered doorbell) | target |
 | B5 | one scripted host-side RM message served end-to-end with a recorded reply | target (gated by S3 injection) |
 
+**Ladder revision (2026-10-03, B3).** The original B3 wording assumed the
+firmware polls CSB/TRANSCOM during a silent boot. The 570.144 image does not:
+after arming interrupts and completing its libos services it blocks in the
+message-loop port wait, and the CSB/TRANSCOM poll is *triggered by host
+traffic*. B3 is therefore anchored on the observed wait (a real, reproducible
+milestone) and the CSB poll moved to B4, where a scripted doorbell will
+produce it. The pre-revision text is kept in history; this note is the
+operative definition.
+
 The ladder is deliberately versioned-data driven: a new firmware version is a
 new profile + shim record, not a code fork.
 
@@ -211,7 +220,7 @@ flags; every call attributable to a session.
 | Probe/record/plugins | yes | — | backend peer | yes |
 | Ghidra symbol/control bridges | yes | watch/heat-map/nav | protocol-compatible | full (S2/S3) |
 | Injection SDK | demo | RM-core interception H1.3 | demo backend | services vs GSP model (S3) |
-| Device model / real boot | no (faults) | H2.2/H2.3/H2.4 planned | ladder B0–B2 (S1, device model + shim) | B4/B5 (S1/S3) |
+| Device model / real boot | no (faults) | H2.2/H2.3/H2.4 planned | ladder B0–B3 (S1, device model + XMPU + libos services) | B4/B5 (S1/S3) |
 | Determinism/replay | wall-clock | H2.4 budgets | instruction-count | event replay (S2) |
 | MCP | yes (QEMU) | — | native sim tools + backend selection (20) | wider GSP-model tools (S3) |
 | Tiering | — | — | modeled cycles | calibrated bands (S4) |
@@ -277,12 +286,13 @@ The comparison and decision are recorded in the private handoff.
 
 | Wave | Date | Result |
 |---|---|---|
-| Recon + master handoff | 2026-10-03 | `handoff-simulator.md`, local sources register |
+| Recon + master handoff | 2026-10-03 | master handoff; source register |
 | W1 GPGPU-Sim build | 2026-10-03 | CUDA 12 port patches; `vectorAdd` functional+perf green |
 | W1 TU104 config/overlay | 2026-10-03 | config scaffold + sanity 26/26 + admissions draft |
 | W1 GSP cycle-0 | 2026-10-03 | modeled cycles; real image 200k instr deterministic; 298 tests green (2026-10-03 suite run; count varies with prerequisites) |
 | W1 dossier | 2026-10-03 | Turing/Ampere/Blackwell parameter docs + cross-generation survey |
 | W2 Phase S (S1 + S4) | 2026-10-03 | `sim/devices` + `sim/profiles` device model: B0–B2 on the real image (0 unknown MMIO), 2-run determinism; A/B harness discovers the profile and records verdict `above` on the frozen checks (docs/36, docs/37 §4.3, docs/40) |
+| W2 Phase S (4c: XMPU + libos) | 2026-10-03 | `sim/mpu.py` + `sim/libos.py` + bootstrap-args shim: B3 on the real image (474 043 instr, message-loop port wait, 0 unknown MMIO, 2-run identical); A/B re-run at `--instructions 2000000` verdict `above` (docs/37 §4.4); 417 tests green |
 | W2 Phase S | launched | S2 parity, S3 MCP/injection, S4 validation |
 
 Backlog (recorded, not started): Ampere/Blackwell models; fabric (PCIe,