gsp-phys: stage-3b boot layout plus a hazard gate for the claim path

Stage 3b allocates the three coherent boot-argument pages and fills the
256-byte WPR metadata from the computed Turing FB layout; no device
registers are written (uncommitted work from the previous session,
committed as-is behind the new gate).

The physical claim unbinds the distribution NVIDIA driver; on this host
that power-gates the dGPU board and the re-bind can leave the GPU
unresponsive and hard-freeze the system (observed twice, 2026-09-30, no
crash record). The claim now refuses unless the new gsp_phys_hazard_ack
module parameter is also set, so a stale command line cannot re-trigger
it. See the hazard note at the top of gsp_phys_gpu.c.

1 files changed, 37 insertions, 0 deletions

diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index 0724cf3..24ed887 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -6,6 +6,26 @@
  * driver is unbound (reversibly) and this module's pci_driver claims the
  * GPU, maps its BARs, and exposes the registers the backend needs.
  *
+ * !!! HOST-FREEZE HAZARD (observed twice, 2026-09-30) !!!
+ * Unbinding the distribution driver lets this laptop's dGPU board
+ * power-gate (D3cold allowed, xHCI on the same board logs "root hub lost
+ * power or was reset"). Re-binding the distribution driver must then
+ * power the board back up, and that intermittently fails: the GPU never
+ * answers config reads again ("not ready ... after resume; waiting" from
+ * pci_bridge_wait_for_secondary_bus) and the host hard-freezes within a
+ * minute with no crash record (no oops, pstore empty, journal stops).
+ * Both observed freezes followed an nvidia unbind/rebind (a sysfs
+ * unbind/bind test, and a claim/release cycle held only ~5 s vs the ~8 s
+ * of the cycles that survived). Nothing in the module's own code
+ * crashed; the trigger is the loss of the dGPU power domain.
+ *
+ * Therefore claim now requires BOTH gsp_phys_gpu=1 AND
+ * gsp_phys_hazard_ack=1, and must not be enabled without a reviewed
+ * recovery plan. The normal emulation path (module load, mdev, VM) does
+ * not unbind anything and is unaffected. The execution backend must be
+ * redesigned to not unbind the distribution driver (host-RM proxy), see
+ * the handoff.
+ *
  * Disabled by default (gsp_phys_gpu=N). Claim only when no VM holds an mdev.
  */
 
@@ -37,6 +57,18 @@ static char *gsp_phys_fw_name = GSP_PHYS_FW_DEFAULT;
 module_param_named(gsp_phys_fw, gsp_phys_fw_name, charp, 0644);
 MODULE_PARM_DESC(gsp_phys_fw, "GSP firmware image to load (default " GSP_PHYS_FW_DEFAULT ")");
 
+/*
+ * Second gate for the claim path: gsp_phys_gpu=1 alone is not enough.
+ * The claim unbinds the distribution driver, which can power-gate the
+ * dGPU board and hard-freeze the host on the rebind (see the hazard note
+ * at the top of this file). Requiring an explicit acknowledgement keeps
+ * a copied command line from ever re-triggering it.
+ */
+static bool gsp_phys_hazard_ack;
+module_param_named(gsp_phys_hazard_ack, gsp_phys_hazard_ack, bool, 0644);
+MODULE_PARM_DESC(gsp_phys_hazard_ack,
+		 "Acknowledge the host-freeze hazard of unbinding the distribution driver; required in addition to gsp_phys_gpu=1 (default 0)");
+
 /* BAR0 registers sampled after claim as proof of live access. */
 #define GSP_PHYS_BOOT_0		0x00000000
 #define GSP_PHYS_BOOT_1		0x00000004
@@ -349,6 +381,11 @@ int gsp_phys_gpu_claim(void)
 	if (phys.claimed)
 		return 0;
 
+	if (!gsp_phys_hazard_ack) {
+		pr_err("gsp-phys: REFUSED: claiming the physical GPU unbinds the distribution NVIDIA driver; on this host that can leave the dGPU unresponsive and hard-freeze the system (observed 2026-09-30, no crash record). Pass gsp_phys_hazard_ack=1 only with a reviewed recovery plan and no other work on the host.\n");
+		return -EPERM;
+	}
+
 	pdev = pci_get_device(GSP_PHYS_VENDOR, GSP_PHYS_DEVICE, NULL);
 	if (!pdev) {
 		pr_err("gsp-phys: device %04x:%04x not found\n",