Load gpu_unlock before nvidia on Bazzite for an RTX 3090

Steps#

1. Clone upstream and check out the pinned commit.

   $ cd ~ && git clone -q https://github.com/Zagitta/gpu-unlock.git && cd gpu-unlock && git checkout -q af28cbb && git log -1 --format='%h %ad' --date=short
   af28cbb 2026-10-24
   

   Expected: af28cbb 2026-10-24. The remaining commands run in ~/gpu-unlock.

   GotchaDo not build a 3090 unlock from a newer upstream without checking

   Upstream commit fc83321 broke the unlock on several RTX 3090s (issue #20, poll timeout then -110; issue #23). 4189b17 reverted it together with 291f7fa, back to the tree of c274e74, and af28cbb has that same kernel/ code. On 2026-10-26 #20 was still open and main was nine commits past af28cbb, including a kernel refactor ("Refactor driver to be recipe driven"). Before you build from a later commit, read #20 and the newer 3090 reports.

2. Build the module against the booted kernel.

   $ make -C kernel/gpu_unlock KCFLAGS=-Werror
   make: Entering directory '/var/home/user/gpu-unlock/kernel/gpu_unlock'
   make -C "/lib/modules/7.2.9-ogc3.1.fc44.x86_64/build" M="/var/home/user/gpu-unlock/kernel/gpu_unlock" modules
   make[1]: Entering directory '/usr/src/kernels/7.2.9-ogc3.1.fc44.x86_64'
   make[2]: Entering directory '/var/home/user/gpu-unlock/kernel/gpu_unlock'
   warning: pahole version differs from the one used to build the kernel
     The kernel was built with: 131
     You are using:             0
     CC [M]  main.o
     CC [M]  gfw_eval.o
     CC [M]  prep_610.o
     CC [M]  layout_610.o
     CC [M]  vbios_610.o
     CC [M]  unlock_610.o
     LD [M]  gpu_unlock.o
     MODPOST Module.symvers
     CC [M]  gpu_unlock.mod.o
     CC [M]  .module-common.o
     LD [M]  gpu_unlock.ko
     BTF [M] gpu_unlock.ko
   Skipping BTF generation for gpu_unlock.ko due to unavailability of vmlinux
   make[2]: Leaving directory '/var/home/user/gpu-unlock/kernel/gpu_unlock'
   make[1]: Leaving directory '/usr/src/kernels/7.2.9-ogc3.1.fc44.x86_64'
   make: Leaving directory '/var/home/user/gpu-unlock/kernel/gpu_unlock'
   

   Expected: exit code 0 and LD [M] gpu_unlock.ko. The pahole warning and Skipping BTF generation are not errors. Check the build kernel:

   $ modinfo -F vermagic kernel/gpu_unlock/gpu_unlock.ko
   7.2.9-ogc3.1.fc44.x86_64 SMP preempt mod_unload
   

   Expected: the first word equals uname -r from Before you start.

3. Download the pinned NVIDIA inputs and generate the firmware.

   $ make assets
   python3 firmware/fetch_artifacts.py /home/user/.cache/gpu-unlock/inputs
   /home/user/.cache/gpu-unlock/inputs/NVIDIA-kernel-module-source-610.43.03.tar.xz
   /home/user/.cache/gpu-unlock/inputs/nvidia-utils-610.43.03-1-x86_64_v3.pkg.tar.zst
   make firmware
   make[1]: Entering directory '/var/home/user/gpu-unlock'
   rm -rf /home/user/.cache/gpu-unlock/assets.src
   mkdir -p /home/user/.cache/gpu-unlock/assets.src
   tar -xf /home/user/.cache/gpu-unlock/inputs/NVIDIA-kernel-module-source-610.43.03.tar.xz -C /home/user/.cache/gpu-unlock/assets.src
   python3 firmware/generate_v67.py "$(realpath /home/user/.cache/gpu-unlock/inputs/nvidia-utils-610.43.03-1-x86_64_v3.pkg.tar.zst)" /home/user/.cache/gpu-unlock/assets
   python3 firmware/extract_boot_assets.py /home/user/.cache/gpu-unlock/assets.src/NVIDIA-kernel-module-source-610.43.03 /home/user/.cache/gpu-unlock/assets
   make[1]: Leaving directory '/var/home/user/gpu-unlock'
   

   $ ls -l ~/.cache/gpu-unlock/assets
   total 82480
   -rw-r--r--. 1 user user    61256 Oct 26 21:41 booter_load_ga102.bin
   -rw-r--r--. 1 user user       84 Oct 26 21:41 gsp_boot_desc_ga102.bin
   -rw-r--r--. 1 user user    24576 Oct 26 21:41 gsp_boot_ga102.bin
   -rw-r--r--. 1 user user 84277400 Oct 26 21:41 gsp_ga10x.bin
   -rw-r--r--. 1 user user    22653 Oct 26 21:41 NVIDIA-LICENSE
   -rw-r--r--. 1 user user    64000 Oct 26 21:41 v67-ga102-610.43.03.bin
   

   Expected: the five .bin files and NVIDIA-LICENSE. The generators check every input and output against a pinned SHA-256 and stop on a mismatch.

4. Save the loader script and the modprobe.d rule. Both are GPL-2.0-only, written for this setup; they are not in upstream.

   load.sh runs before every nvidia load, in the initramfs and later. It reads the gpu_unlock.* options from the kernel command line (insmod does not, unlike modprobe), points the firmware loader at /etc/gpu-unlock/firmware, loads the module, and always exits 0 so that nvidia loads whatever happened. It uses only shell builtins and absolute paths: the initramfs need not have cat, and PATH may not be set there.

   mkdir -p bazzite
   cat > bazzite/load.sh <<'EOF'
   #!/bin/sh
   # SPDX-License-Identifier: GPL-2.0-only
   # Run by the modprobe.d install rule for nvidia, in the initramfs and on the
   # root filesystem: load gpu_unlock from /etc just before nvidia. Bazzite's
   # /usr is read-only, so the module and its firmware live in /etc/gpu-unlock
   # and reach the initramfs through rpm-ostree initramfs-etc. Never fails, so
   # nvidia always loads.
   dir=/etc/gpu-unlock
   [ -d /sys/module/gpu_unlock ] && exit 0
   # insmod does not read gpu_unlock.* from the command line as modprobe would.
   # Builtins only: the initramfs need not have cat or PATH set.
   read -r cmdline < /proc/cmdline
   params=
   for word in $cmdline; do
   	case "$word" in
   	gpu_unlock.*=*) params="$params ${word#gpu_unlock.}" ;;
   	esac
   done
   [ -n "$params" ] || exit 0
   # The firmware is under /etc too; resume loads it again, so the path stays set.
   fw=/sys/module/firmware_class/parameters/path
   current=
   [ -w "$fw" ] && read -r current < "$fw"
   if [ -w "$fw" ] && [ -z "$current" ]; then
   	printf %s "$dir/firmware" > "$fw"
   fi
   /usr/bin/insmod "$dir/gpu_unlock.ko" $params
   exit 0
   EOF
   

   The rule runs load.sh through /bin/sh -c, then loads nvidia with its usual options. A path in it that does not exist in the initramfs stops nvidia from loading at all.

   cat > bazzite/modprobe.conf <<'EOF'
   # SPDX-License-Identifier: GPL-2.0-only
   # Bazzite: gpu_unlock is not under /usr/lib/modules, so no softdep can name it.
   install nvidia /bin/sh /etc/gpu-unlock/load.sh; /sbin/modprobe --ignore-install nvidia $CMDLINE_OPTS
   EOF
   

   Check what you saved:

   $ sha256sum bazzite/load.sh bazzite/modprobe.conf
   453dfef73e601ecbea06f43eff208fc07d633452fe8d5fdb03b81789c12801ba  bazzite/load.sh
   fee0e6f424735d531eeb8a1c05cea70c6329f874e2159f9d1796913b20ab44b9  bazzite/modprobe.conf
   

   Expected: these two hashes. A different hash means the paste changed the file.

5. Install the module, firmware, loader and rule into /etc.

   sudo install -Dm644 kernel/gpu_unlock/gpu_unlock.ko /etc/gpu-unlock/gpu_unlock.ko
   sudo install -Dm755 bazzite/load.sh /etc/gpu-unlock/load.sh
   sudo install -Dm644 -t /etc/gpu-unlock/firmware/gpu-unlock/610.43.03 \
     ~/.cache/gpu-unlock/assets/booter_load_ga102.bin \
     ~/.cache/gpu-unlock/assets/gsp_ga10x.bin \
     ~/.cache/gpu-unlock/assets/gsp_boot_ga102.bin \
     ~/.cache/gpu-unlock/assets/gsp_boot_desc_ga102.bin \
     ~/.cache/gpu-unlock/assets/v67-ga102-610.43.03.bin
   sudo install -Dm644 bazzite/modprobe.conf /etc/modprobe.d/gpu-unlock.conf
   

   Expected: no output. cmp kernel/gpu_unlock/gpu_unlock.ko /etc/gpu-unlock/gpu_unlock.ko prints nothing.

6. Add the files to the initramfs as an overlay.

   F=/etc/gpu-unlock/firmware/gpu-unlock/610.43.03
   sudo rpm-ostree initramfs-etc --force-sync \
     --track=/etc/gpu-unlock/gpu_unlock.ko --track=/etc/gpu-unlock/load.sh \
     --track=/etc/modprobe.d/gpu-unlock.conf \
     --track=$F/booter_load_ga102.bin --track=$F/gsp_ga10x.bin --track=$F/gsp_boot_ga102.bin \
     --track=$F/gsp_boot_desc_ga102.bin --track=$F/v67-ga102-610.43.03.bin
   

   Output on the tested box (same command, run as root; repository lines cut):

   Checking out tree 278edb6...done
   …
   Resolving dependencies...done
   Checking out packages...done
   Running systemd-sysusers...done
   Running pre scripts...done
   Running post scripts...done
   Running posttrans scripts...done
   Writing rpmdb...done
   Writing OSTree commit...done
   Staging deployment...done
   Freed: 138.7 MB (pkgcache branches: 0)
   Run "systemctl reboot" to start a reboot
   

   Expected: Staging deployment...done. No dracut run: the image's initramfs stays as it is and the overlay is a second initrd in the new boot entry.

7. Opt in on the kernel command line.

   sudo rpm-ostree kargs --append-if-missing=gpu_unlock.targets=all
   

   Output on the tested box, cut (an image update was staged, so it listed that update's package diff):

   Checking out tree 278edb6...done
   Resolving dependencies...done
   Checking out packages...done
   Running systemd-sysusers...done
   Running pre scripts...done
   Running post scripts...done
   Running posttrans scripts...done
   Writing rpmdb...done
   Writing OSTree commit...done
   Staging deployment...done
   Freed: 138.7 MB (pkgcache branches: 0)
   …
   Changes queued for next boot. Run "systemctl reboot" to start a reboot
   

   Expected: Changes queued for next boot.

   NoteOptions are per deployment

   rpm-ostree kargs writes the option only into the new deployment. The entry you booted from keeps its old options and is now the rollback: booting it gives a locked card. Image updates copy the option and the overlay from the deployment they build on.

8. Power off fully, then power on.

   systemctl poweroff
   

   Do not use reboot for the first unlock. The module refuses a card that a driver has already used since power on (card already initialised since power on (WPR2 enabled); power off first). A full power off clears that state. I saw a warm reboot clear it once (Field notes); that is not a guarantee.

   WarningSingle-GPU box: a failed unlock is a black screen

   The screen on the card goes blank from the card's reset until nvidia-drm takes over. If the card's firmware does not stop during the unlock, the module keeps the DMA buffers that firmware may still use until the next power off, on purpose. Separately, with the broken fc83321, issue #23 reports that nvidia could not use either card after a failed unlock until the machine was fully restarted. On a single-GPU box that means no picture: follow Recovery below.

9. Check that this boot unlocked the card.

   $ journalctl -k -b -o cat | grep 'gpu_unlock: unlocked'
   pci 0000:10:00.0: gpu_unlock: unlocked
   

   Expected: one line ending in gpu_unlock: unlocked. Nothing printed: see Failure modes before going on. The full checks are under Verify.

10. Optional: install a login warning for boots that did not unlock. An image update that brings a new kernel leaves the old module in /etc. The kernel's version check is expected to make insmod refuse it (not yet seen on this box); load.sh ignores the failure, nvidia loads as usual and the card stays locked with no visible sign. This script, started at login, sends a desktop notification when the option is set but this boot did not unlock: module missing, module built for another kernel, or no gpu_unlock: unlocked line. On a headless box, check the journal after each update instead.

    mkdir -p bazzite
    cat > bazzite/check.sh <<'EOF'
    #!/bin/sh
    # SPDX-License-Identifier: GPL-2.0-only
    # Run at login (XDG autostart): warn on the desktop when the unlock is opted in but did not happen,
    # most often because an image update brought a kernel the module was not built for.
    # GU_CMDLINE, GU_KVER and GU_NOTIFY override the inputs for testing.
    cmdline=$(cat "${GU_CMDLINE:-/proc/cmdline}")
    case " $cmdline " in
    *" gpu_unlock.targets="*) ;;
    *) exit 0 ;;
    esac
    ko=/etc/gpu-unlock/gpu_unlock.ko
    kver=${GU_KVER:-$(uname -r)}
    notify=${GU_NOTIFY:-notify-send}
    built=$(modinfo -F vermagic "$ko" 2>/dev/null | cut -d' ' -f1)
    if [ -z "$built" ]; then
    	msg="$ko is missing: the unlock is not installed."
    elif [ "$built" != "$kver" ]; then
    	msg="Module built for $built, running $kver: the card is locked. Rebuild the module for this kernel, reinstall it, then power off fully."
    elif ! journalctl -k -b 2>/dev/null | grep -q 'gpu_unlock: unlocked'; then
    	msg="No 'gpu_unlock: unlocked' this boot. Check: journalctl -k -b | grep gpu_unlock"
    else
    	exit 0
    fi
    "$notify" -a gpu-unlock -u critical "gpu-unlock: not unlocked" "$msg"
    EOF
    

    cat > bazzite/gpu-unlock-check.desktop <<'EOF'
    [Desktop Entry]
    Type=Application
    Name=gpu-unlock check
    Comment=Warn when the GPU unlock did not happen this boot
    Exec=/bin/sh /etc/gpu-unlock/check.sh
    NoDisplay=true
    X-KDE-autostart-phase=2
    EOF
    

    $ sha256sum bazzite/check.sh bazzite/gpu-unlock-check.desktop
    98e136a627ad306b10ea98359351043d37dce0e7547547d3d3d8ade4429b8ef5  bazzite/check.sh
    aac408322d320c6679521e3d15490c903e1ad4ff1c78e73c49c29d342c2bf580  bazzite/gpu-unlock-check.desktop
    

    Test it before installing. On an unlocked boot it is silent; with GU_KVER set to another kernel version and GU_NOTIFY=echo, it prints the notification it would send:

    $ sh bazzite/check.sh; echo "rc=$?"
    rc=0
    

    $ GU_KVER=0.0.0-test GU_NOTIFY=echo sh bazzite/check.sh
    -a gpu-unlock -u critical gpu-unlock: not unlocked Module built for 7.2.9-ogc3.1.fc44.x86_64, running 0.0.0-test: the card is locked. Rebuild the module for this kernel, reinstall it, then power off fully.
    

    Install it:

    sudo install -Dm755 bazzite/check.sh /etc/gpu-unlock/check.sh
    install -Dm644 bazzite/gpu-unlock-check.desktop ~/.config/autostart/gpu-unlock-check.desktop
    

    check.sh is not needed in the initramfs, so it is not tracked in step 6.

11. Optional: make every boot entry unlocked. Only after Verify passed:

    sudo rpm-ostree cleanup -r
    

    This deletes the rollback deployment, so the boot menu no longer offers a locked entry or the state before step 6. Recovery then goes through the boot menu's edit screen.