vgsp: host CUDA bridge + sema release recovery; greeneye simulator wave

- kernel: gsp_cuda_bridge (QMD launch capture, debugfs job/out/done, param+output resolution cached from inline writes), sema drain fixes (never hold/starve a channel), GR ring autopin + counter autoreg, per-page push reads, counter-derive gate; module builds clean
- tools/cuda-bridge: CUDA driver-API daemon executing mail/vadd kernels on the physical GPU, CUBB2/CBD2 v2 protocol, layout check + self-tests
- tools/guest-diag + tools/cuda-ab: scanner/pin fixes, victory push-only mode
- debug/risc-v-gsp-rm-vm: Phase S simulator wave (GSP device model, boot ladder, triage/re-demo harnesses, docs 30-41), GPGPU-sim scaffolding
- STATE-CURRENT/docs updates

5 files changed, 154 insertions, 0 deletions

diff --git a/tools/ghidra/gsp-fwimage-570.144/scripts/Disasm.java b/tools/ghidra/gsp-fwimage-570.144/scripts/Disasm.java
new file mode 100644
index 0000000..68a8a52
--- /dev/null
+++ b/tools/ghidra/gsp-fwimage-570.144/scripts/Disasm.java
@@ -0,0 +1,29 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Instruction;
+import ghidra.program.model.listing.Listing;
+
+public class Disasm extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        Listing listing = currentProgram.getListing();
+        String[] args = getScriptArgs();
+        for (String arg : args) {
+            String[] parts = arg.split(":");
+            Address start = toAddr(parts[0]);
+            int count = parts.length > 1 ? Integer.decode(parts[1]) : 60;
+            println("### DISASM " + start + " count=" + count);
+            Address cur = start;
+            for (int i = 0; i < count; i++) {
+                Instruction insn = listing.getInstructionAt(cur);
+                if (insn == null) {
+                    try { disassemble(cur); } catch (Exception e) { println("  disasm stop: " + e); break; }
+                    insn = listing.getInstructionAt(cur);
+                }
+                if (insn == null) { println("  no instruction at " + cur); break; }
+                println("  " + insn.getAddress() + ": " + insn.toString());
+                cur = insn.getMaxAddress().add(1);
+            }
+        }
+    }
+}
diff --git a/tools/ghidra/gsp-fwimage-570.144/scripts/DumpFuncs.java b/tools/ghidra/gsp-fwimage-570.144/scripts/DumpFuncs.java
new file mode 100644
index 0000000..6948492
--- /dev/null
+++ b/tools/ghidra/gsp-fwimage-570.144/scripts/DumpFuncs.java
@@ -0,0 +1,35 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.listing.FunctionManager;
+import ghidra.app.decompiler.DecompInterface;
+import ghidra.app.decompiler.DecompileResults;
+import ghidra.util.task.TaskMonitor;
+
+public class DumpFuncs extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        String[] args = getScriptArgs();
+        FunctionManager fm = currentProgram.getFunctionManager();
+        DecompInterface decompiler = new DecompInterface();
+        decompiler.openProgram(currentProgram);
+        for (String arg : args) {
+            String s = arg.trim();
+            Address addr = toAddr(s);
+            Function func = fm.getFunctionContaining(addr);
+            if (func == null) {
+                func = createFunction(addr, null);
+            }
+            println("### FUNC " + s + " -> " + (func != null ? func.getName() + " @ " + func.getEntryPoint() : "NOT FOUND"));
+            if (func != null) {
+                DecompileResults res = decompiler.decompileFunction(func, 120, monitor);
+                if (res != null && res.decompileCompleted()) {
+                    println(res.getDecompiledFunction().getC());
+                } else {
+                    println("// decompile failed: " + (res != null ? res.getErrorMessage() : "null"));
+                }
+            }
+        }
+        decompiler.dispose();
+    }
+}
diff --git a/tools/ghidra/gsp-fwimage-570.144/scripts/MemCheck.java b/tools/ghidra/gsp-fwimage-570.144/scripts/MemCheck.java
new file mode 100644
index 0000000..6cb573e
--- /dev/null
+++ b/tools/ghidra/gsp-fwimage-570.144/scripts/MemCheck.java
@@ -0,0 +1,26 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Instruction;
+import ghidra.program.model.listing.Listing;
+import ghidra.program.model.mem.Memory;
+
+public class MemCheck extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        String[] args = getScriptArgs();
+        Memory mem = currentProgram.getMemory();
+        println("min=" + mem.getMinAddress() + " max=" + mem.getMaxAddress());
+        for (String arg : args) {
+            Address a = toAddr(arg.trim());
+            boolean c = mem.contains(a);
+            println(arg + " contains=" + c);
+            if (c) {
+                byte[] b = new byte[16];
+                int n = mem.getBytes(a, b);
+                StringBuilder sb = new StringBuilder();
+                for (int i = 0; i < n; i++) sb.append(String.format("%02x ", b[i]));
+                println("  bytes: " + sb);
+            }
+        }
+    }
+}
diff --git a/tools/ghidra/gsp-fwimage-570.144/scripts/ScanBranches.java b/tools/ghidra/gsp-fwimage-570.144/scripts/ScanBranches.java
new file mode 100644
index 0000000..cff36f0
--- /dev/null
+++ b/tools/ghidra/gsp-fwimage-570.144/scripts/ScanBranches.java
@@ -0,0 +1,34 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Instruction;
+import ghidra.program.model.listing.Listing;
+import ghidra.program.model.symbol.FlowType;
+
+public class ScanBranches extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        Listing listing = currentProgram.getListing();
+        String[] args = getScriptArgs();
+        Address start = toAddr(args[0]);
+        Address end = toAddr(args[1]);
+        Address target = toAddr(args[2]);
+        Address cur = start;
+        int n = 0;
+        while (cur.compareTo(end) < 0 && n < 20000) {
+            Instruction insn = listing.getInstructionAt(cur);
+            if (insn == null) {
+                try { disassemble(cur); } catch (Exception e) { println("stop at " + cur + ": " + e); break; }
+                insn = listing.getInstructionAt(cur);
+            }
+            if (insn == null) { println("no insn at " + cur); break; }
+            for (Address a : insn.getFlows()) {
+                if (a.equals(target)) {
+                    println("TARGET HIT: " + insn.getAddress() + ": " + insn.toString());
+                }
+            }
+            cur = insn.getMaxAddress().add(1);
+            n++;
+        }
+        println("scanned " + n + " instructions from " + start + " to " + cur);
+    }
+}
diff --git a/tools/ghidra/gsp-fwimage-570.144/scripts/Xrefs.java b/tools/ghidra/gsp-fwimage-570.144/scripts/Xrefs.java
new file mode 100644
index 0000000..65d4b7f
--- /dev/null
+++ b/tools/ghidra/gsp-fwimage-570.144/scripts/Xrefs.java
@@ -0,0 +1,30 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.listing.FunctionManager;
+import ghidra.program.model.symbol.Reference;
+import ghidra.program.model.symbol.ReferenceIterator;
+import ghidra.program.model.symbol.ReferenceManager;
+
+public class Xrefs extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        String[] args = getScriptArgs();
+        ReferenceManager rm = currentProgram.getReferenceManager();
+        FunctionManager fm = currentProgram.getFunctionManager();
+        for (String arg : args) {
+            Address target = toAddr(arg.trim());
+            println("### XREFS to " + target);
+            ReferenceIterator it = rm.getReferencesTo(target);
+            int n = 0;
+            while (it.hasNext()) {
+                Reference r = it.next();
+                Address from = r.getFromAddress();
+                Function f = fm.getFunctionContaining(from);
+                println("  from " + from + " (" + (f != null ? f.getName() + "@" + f.getEntryPoint() : "?") + ") type=" + r.getReferenceType());
+                n++;
+            }
+            println("  total=" + n);
+        }
+    }
+}