gsp-phys: freeze-safe release, boot-proof READY, and guest-wiring P2/P3/P5-wave1

Host-freeze fix bundle (validated 2/2 supervised cycles):
- power unlock now latches D0/D3cold by default (new gsp_phys_repower,
  default 0); releasing the claim can no longer power-gate the board and
  hard-freeze the host on resume
- bounded post-rebind readiness gate before dropping the locks; bounded D0
  settle/verify before the unbind
- READY means a live GSP-RM session: the async worker and the module-owned
  join only expose READY when init-done is seen and no unload was sent;
  otherwise the claim is released fail-open
- FWSEC reads DMEM0/IMEM back before STARTCPU and fails fast when the
  staging is not visible
- the claim harness leaves the board latched by default and takes
  --restore-power to opt back into the old restore

Guest-wiring:
- P2: generation-keyed fn65 static-config snapshot cache plus a default-off
  identity overlay (new gsp_phys_static_live) for name/short-name/VBIOS;
  the probe cycle runs once per backend generation at READY
- P3: default-off read-only RM_CONTROL forwarding whitelist (new
  gsp_phys_ctrl_forward) with emulated-handle translation to the adopted
  server handles and full emulation fallback
- P5 wave 1: default-off shadow execution of guest CE pushes on the ladder
  channel (new gsp_phys_work_forward) via a dedicated ordered work item;
  the ladder stage-4 submission is refactored into a shared bounded helper
  and the software release path stays authoritative

Live: module-owned boot to init-done, guest smoke ALL OK 64/64 with P2/P3
enabled, 514 shadow copies observed on the physical CE; all cycles released
cleanly with WPR2 down and no reboot.

1 files changed, 22 insertions, 0 deletions

diff --git a/kernel/gsp_phys_fwsec.c b/kernel/gsp_phys_fwsec.c
index 83a68ed..c20758b 100644
--- a/kernel/gsp_phys_fwsec.c
+++ b/kernel/gsp_phys_fwsec.c
@@ -875,6 +875,28 @@ static int gsp_phys_fwsec_exec_with_loader(void __iomem *bar0,
 		GSP_PHYS_SEC2_BL_CODE_SIZE, bl_dst, block_count,
 		GSP_PHYS_SEC2_BL_START_TAG);
 
+	/*
+	 * Read both staged regions back before the kick. A silent DMA failure
+	 * leaves the falcon reading zeros, burns the full halt timeout and the
+	 * boot only fails much later with no useful evidence; a mismatch here
+	 * means the falcon is not accepting DMA, so fail open before STARTCPU.
+	 */
+	{
+		u32 dmem_rd[4], imem_rd[4];
+
+		gsp_phys_falcon_dmem_read(bar0, GSP_PHYS_GSP_BASE, 0,
+					  dmem_rd, 4);
+		gsp_phys_falcon_imem_read(bar0, GSP_PHYS_GSP_BASE, bl_dst,
+					  imem_rd, 4);
+		if (memcmp(dmem_rd, &bl, sizeof(dmem_rd)) ||
+		    memcmp(imem_rd, gsp_phys_sec2_bl_image, sizeof(imem_rd))) {
+			pr_err("gsp-phys-fwsec: staging not visible before kick (DMEM0 %08x/%08x/%08x/%08x IMEM %08x/%08x/%08x/%08x); the falcon is not accepting DMA - aborting before STARTCPU\n",
+			       dmem_rd[0], dmem_rd[1], dmem_rd[2], dmem_rd[3],
+			       imem_rd[0], imem_rd[1], imem_rd[2], imem_rd[3]);
+			return -EIO;
+		}
+	}
+
 	writel(GSP_PHYS_SEC2_BL_START_TAG << 8,
 	       bar0 + GSP_PHYS_GSP_BASE + GSP_PHYS_FALCON_BOOTVEC);
 	cpuctl = readl(bar0 + GSP_PHYS_GSP_BASE + GSP_PHYS_FALCON_CPUCTL);