From a6b0008124aa06eddffb0b80f203af576821bec3 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 30 Sep 2026 23:45:45 -0400 Subject: gsp-phys: stage-3b boot layout plus a hazard gate for the claim path Stage 3b allocates the three coherent boot-argument pages and fills the 256-byte WPR metadata from the computed Turing FB layout; no device registers are written (uncommitted work from the previous session, committed as-is behind the new gate). The physical claim unbinds the distribution NVIDIA driver; on this host that power-gates the dGPU board and the re-bind can leave the GPU unresponsive and hard-freeze the system (observed twice, 2026-09-30, no crash record). The claim now refuses unless the new gsp_phys_hazard_ack module parameter is also set, so a stale command line cannot re-trigger it. See the hazard note at the top of gsp_phys_gpu.c. --- kernel/gsp_phys_gpu.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) (limited to 'kernel') diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c index 0724cf3..24ed887 100644 --- a/kernel/gsp_phys_gpu.c +++ b/kernel/gsp_phys_gpu.c @@ -6,6 +6,26 @@ * driver is unbound (reversibly) and this module's pci_driver claims the * GPU, maps its BARs, and exposes the registers the backend needs. * + * !!! HOST-FREEZE HAZARD (observed twice, 2026-09-30) !!! + * Unbinding the distribution driver lets this laptop's dGPU board + * power-gate (D3cold allowed, xHCI on the same board logs "root hub lost + * power or was reset"). Re-binding the distribution driver must then + * power the board back up, and that intermittently fails: the GPU never + * answers config reads again ("not ready ... after resume; waiting" from + * pci_bridge_wait_for_secondary_bus) and the host hard-freezes within a + * minute with no crash record (no oops, pstore empty, journal stops). + * Both observed freezes followed an nvidia unbind/rebind (a sysfs + * unbind/bind test, and a claim/release cycle held only ~5 s vs the ~8 s + * of the cycles that survived). Nothing in the module's own code + * crashed; the trigger is the loss of the dGPU power domain. + * + * Therefore claim now requires BOTH gsp_phys_gpu=1 AND + * gsp_phys_hazard_ack=1, and must not be enabled without a reviewed + * recovery plan. The normal emulation path (module load, mdev, VM) does + * not unbind anything and is unaffected. The execution backend must be + * redesigned to not unbind the distribution driver (host-RM proxy), see + * the handoff. + * * Disabled by default (gsp_phys_gpu=N). Claim only when no VM holds an mdev. */ @@ -37,6 +57,18 @@ static char *gsp_phys_fw_name = GSP_PHYS_FW_DEFAULT; module_param_named(gsp_phys_fw, gsp_phys_fw_name, charp, 0644); MODULE_PARM_DESC(gsp_phys_fw, "GSP firmware image to load (default " GSP_PHYS_FW_DEFAULT ")"); +/* + * Second gate for the claim path: gsp_phys_gpu=1 alone is not enough. + * The claim unbinds the distribution driver, which can power-gate the + * dGPU board and hard-freeze the host on the rebind (see the hazard note + * at the top of this file). Requiring an explicit acknowledgement keeps + * a copied command line from ever re-triggering it. + */ +static bool gsp_phys_hazard_ack; +module_param_named(gsp_phys_hazard_ack, gsp_phys_hazard_ack, bool, 0644); +MODULE_PARM_DESC(gsp_phys_hazard_ack, + "Acknowledge the host-freeze hazard of unbinding the distribution driver; required in addition to gsp_phys_gpu=1 (default 0)"); + /* BAR0 registers sampled after claim as proof of live access. */ #define GSP_PHYS_BOOT_0 0x00000000 #define GSP_PHYS_BOOT_1 0x00000004 @@ -349,6 +381,11 @@ int gsp_phys_gpu_claim(void) if (phys.claimed) return 0; + if (!gsp_phys_hazard_ack) { + pr_err("gsp-phys: REFUSED: claiming the physical GPU unbinds the distribution NVIDIA driver; on this host that can leave the dGPU unresponsive and hard-freeze the system (observed 2026-09-30, no crash record). Pass gsp_phys_hazard_ack=1 only with a reviewed recovery plan and no other work on the host.\n"); + return -EPERM; + } + pdev = pci_get_device(GSP_PHYS_VENDOR, GSP_PHYS_DEVICE, NULL); if (!pdev) { pr_err("gsp-phys: device %04x:%04x not found\n", -- cgit v1.2.3