vgsp: host CUDA bridge + sema release recovery; greeneye simulator wave

- kernel: gsp_cuda_bridge (QMD launch capture, debugfs job/out/done, param+output resolution cached from inline writes), sema drain fixes (never hold/starve a channel), GR ring autopin + counter autoreg, per-page push reads, counter-derive gate; module builds clean
- tools/cuda-bridge: CUDA driver-API daemon executing mail/vadd kernels on the physical GPU, CUBB2/CBD2 v2 protocol, layout check + self-tests
- tools/guest-diag + tools/cuda-ab: scanner/pin fixes, victory push-only mode
- debug/risc-v-gsp-rm-vm: Phase S simulator wave (GSP device model, boot ladder, triage/re-demo harnesses, docs 30-41), GPGPU-sim scaffolding
- STATE-CURRENT/docs updates

2 files changed, 44 insertions, 0 deletions

diff --git a/debug/risc-v-gsp-rm-vm/greeneye/inject.py b/debug/risc-v-gsp-rm-vm/greeneye/inject.py
index eb4b16a..fc4d5c0 100644
--- a/debug/risc-v-gsp-rm-vm/greeneye/inject.py
+++ b/debug/risc-v-gsp-rm-vm/greeneye/inject.py
@@ -20,6 +20,9 @@ from .errors import GreenEyeError
 #: Symbol the injector calls in a service blob.
 ENTRY_SYMBOL = "ge_demo_service_dispatch"
 
+#: Session attribute holding the per-session service registry (load order).
+SERVICE_REGISTRY_ATTR = "_injected_services"
+
 #: Demo uproc control-block field offsets (see firmware/uproc_demo).
 CTRL_HANDLERS = 0x150
 CTRL_MAILBOX = 0x20
@@ -46,6 +49,36 @@ class InjectedService:
             f"entry {self.entry_addr:#x} (offset {self.dispatch_offset:#x}), slot {self.slot}"
         )
 
+    def to_dict(self) -> dict:
+        """Plain-data view for MCP/reporting (no behavior)."""
+        return {
+            "path": self.path,
+            "name": self.name,
+            "load_addr": self.load_addr,
+            "entry_addr": self.entry_addr,
+            "dispatch_offset": self.dispatch_offset,
+            "slot": self.slot,
+            "size": self.size,
+        }
+
+
+def services(session) -> list["InjectedService"]:
+    """Services loaded into ``session`` this process, in load order.
+
+    The registry lives on the session object (``SERVICE_REGISTRY_ATTR``) and is
+    populated by :func:`load_service`; it is process-local and not part of the
+    on-disk session format.
+    """
+    return list(getattr(session, SERVICE_REGISTRY_ATTR, ()) or ())
+
+
+def _register(session, service: InjectedService) -> None:
+    registry = getattr(session, SERVICE_REGISTRY_ATTR, None)
+    if registry is None:
+        registry = []
+        setattr(session, SERVICE_REGISTRY_ATTR, registry)
+    registry.append(service)
+
 
 def load_service(
     session,
@@ -110,6 +143,7 @@ def load_service(
         slot=slot,
         size=total,
     )
+    _register(session, service)
     return service
 
 
diff --git a/debug/risc-v-gsp-rm-vm/greeneye/sim_backend.py b/debug/risc-v-gsp-rm-vm/greeneye/sim_backend.py
index a2d2c6a..852536e 100644
--- a/debug/risc-v-gsp-rm-vm/greeneye/sim_backend.py
+++ b/debug/risc-v-gsp-rm-vm/greeneye/sim_backend.py
@@ -313,6 +313,7 @@ def launch_native(
     *,
     kernel: str | None = None,
     memory_mb: int = 256,
+    ram_base: int = 0x80000000,
     record=None,
     symbols: SymbolDB | None = None,
     name: str = "session",
@@ -324,6 +325,7 @@ def launch_native(
     unknown_mmio: str = "fault",
     learn_mmio: bool = False,
     bias: int = 0,
+    cycle_model=None,
 ) -> Session:
     """Boot the native simulator and return a ready Session.
 
@@ -340,6 +342,11 @@ def launch_native(
     ``learn_mmio=True`` writes the observed values back into the map.
     ``bias`` relocates PT_LOAD segments and the entry for images linked for
     GPU physical addresses (e.g. ``0x80000000`` for the real GSP fwimage).
+
+    ``cycle_model`` selects the modeled instruction-class cycle accounting
+    (:mod:`sim.cycles`): ``None`` (default) uses the default table, ``False``
+    disables it (``machine.cycles`` stays 0), or pass a ``CycleModel``.  The
+    model never changes execution.
     """
     try:
         tracer = make_trace(trace)
@@ -353,14 +360,17 @@ def launch_native(
         device_map = DeviceMap.load(os.fspath(device_map))
     machine = Machine(
         memory_mb=memory_mb,
+        ram_base=ram_base,
         device_map=device_map,
         unknown_mmio=unknown_mmio,
         learn_mmio=learn_mmio,
         bias=bias,
+        cycle_model=cycle_model,
     )
     target = SimTarget(
         machine,
         memory_mb=memory_mb,
+        ram_base=ram_base,
         sim_ips=sim_ips,
         keep_alive=keep_alive,
         trace=tracer,