vgsp: host CUDA bridge + sema release recovery; greeneye simulator wave

- kernel: gsp_cuda_bridge (QMD launch capture, debugfs job/out/done, param+output resolution cached from inline writes), sema drain fixes (never hold/starve a channel), GR ring autopin + counter autoreg, per-page push reads, counter-derive gate; module builds clean
- tools/cuda-bridge: CUDA driver-API daemon executing mail/vadd kernels on the physical GPU, CUBB2/CBD2 v2 protocol, layout check + self-tests
- tools/guest-diag + tools/cuda-ab: scanner/pin fixes, victory push-only mode
- debug/risc-v-gsp-rm-vm: Phase S simulator wave (GSP device model, boot ladder, triage/re-demo harnesses, docs 30-41), GPGPU-sim scaffolding
- STATE-CURRENT/docs updates

1 files changed, 34 insertions, 0 deletions

diff --git a/debug/risc-v-gsp-rm-vm/greeneye/inject.py b/debug/risc-v-gsp-rm-vm/greeneye/inject.py
index eb4b16a..fc4d5c0 100644
--- a/debug/risc-v-gsp-rm-vm/greeneye/inject.py
+++ b/debug/risc-v-gsp-rm-vm/greeneye/inject.py
@@ -20,6 +20,9 @@ from .errors import GreenEyeError
 #: Symbol the injector calls in a service blob.
 ENTRY_SYMBOL = "ge_demo_service_dispatch"
 
+#: Session attribute holding the per-session service registry (load order).
+SERVICE_REGISTRY_ATTR = "_injected_services"
+
 #: Demo uproc control-block field offsets (see firmware/uproc_demo).
 CTRL_HANDLERS = 0x150
 CTRL_MAILBOX = 0x20
@@ -46,6 +49,36 @@ class InjectedService:
             f"entry {self.entry_addr:#x} (offset {self.dispatch_offset:#x}), slot {self.slot}"
         )
 
+    def to_dict(self) -> dict:
+        """Plain-data view for MCP/reporting (no behavior)."""
+        return {
+            "path": self.path,
+            "name": self.name,
+            "load_addr": self.load_addr,
+            "entry_addr": self.entry_addr,
+            "dispatch_offset": self.dispatch_offset,
+            "slot": self.slot,
+            "size": self.size,
+        }
+
+
+def services(session) -> list["InjectedService"]:
+    """Services loaded into ``session`` this process, in load order.
+
+    The registry lives on the session object (``SERVICE_REGISTRY_ATTR``) and is
+    populated by :func:`load_service`; it is process-local and not part of the
+    on-disk session format.
+    """
+    return list(getattr(session, SERVICE_REGISTRY_ATTR, ()) or ())
+
+
+def _register(session, service: InjectedService) -> None:
+    registry = getattr(session, SERVICE_REGISTRY_ATTR, None)
+    if registry is None:
+        registry = []
+        setattr(session, SERVICE_REGISTRY_ATTR, registry)
+    registry.append(service)
+
 
 def load_service(
     session,
@@ -110,6 +143,7 @@ def load_service(
         slot=slot,
         size=total,
     )
+    _register(session, service)
     return service