From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: gpu: nova-core: run Booter Unloader and FWSEC-SB upon unbinding
Date: Sat, 16 May 2026 09:54:09 +1000
Message-ID: <review-patch7-20260515-nova-unload-v5-7-c4d6250ad160@nvidia.com>
In-Reply-To: <20260515-nova-unload-v5-7-c4d6250ad160@nvidia.com>
References: <20260515-nova-unload-v5-0-c4d6250ad160@nvidia.com> <20260515-nova-unload-v5-7-c4d6250ad160@nvidia.com>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0

Patch Review

This is the culmination of the series. The design of pre-loading unload firmware at boot time is well-motivated (filesystem may not be available at unbind).

The `FwsecUnloadFirmware` enum cleanly handles the with/without-bootloader variants:

```rust
+enum FwsecUnloadFirmware {
+    WithoutBl(FwsecFirmware),
+    WithBl(FwsecFirmwareWithBl),
+}
```

The `Sec2UnloadBundle::build()` returns `KBox<dyn UnloadBundle>` -- the heap allocation is appropriate since the firmware blobs can be large. The coercion `b as KBox<dyn UnloadBundle>` is the standard pattern.

The unload sequence is correctly ordered:
1. FWSEC-SB (reset GSP falcon to pre-libos state)
2. Booter Unloader (remove WPR2 region)

The Booter Unloader writes a sentinel value `0xff` to both mailboxes and checks mbox0 for success:

```rust
+const MAILBOX_SENTINEL: u32 = 0xff;
+let (mbox0, _) =
+    sec2_falcon.boot(bar, Some(MAILBOX_SENTINEL), Some(MAILBOX_SENTINEL))?;
+if mbox0 != 0 {
+    dev_err!(dev, "Booter Unloader returned error 0x{:x}\n", mbox0);
+    return Err(EINVAL);
+}
```

Good: WPR2 removal is verified after Booter Unloader returns:

```rust
+let wpr2_hi = bar.read(regs::NV_PFB_PRI_MMU_WPR2_ADDR_HI);
+if wpr2_hi.is_wpr2_set() {
+    dev_err!(dev, "WPR2 region still set after Booter Unloader returned\n");
+    return Err(EBUSY);
+}
```

The non-fatal handling of unload bundle preparation failure during boot is well-done:

```rust
+let unload_bundle =
+    Sec2UnloadBundle::build(dev, bar, chipset, &bios, gsp_falcon, sec2_falcon)
+        .inspect_err(|e| {
+            dev_warn!(dev, "Failed to prepare unload firmware: {:?}\n", e);
+            ...
+        })
+        .ok();
```

Using `.ok()` to convert the error to `None` means boot succeeds even if unload prep fails, which is the right tradeoff -- better to have a working driver that needs a manual GPU reset on unbind than to fail probe entirely.

The `is_wpr2_set()` helper in regs.rs is a thin wrapper over `hi_val() != 0`, which is functionally equivalent to the existing `higher_bound() != 0` check used elsewhere. This is fine for readability.

One observation: the `unload` field is set via pin projection `*self.as_mut().project().unload = unload_bundle`. Since `unload` is not a `#[pin]` field, this should work correctly through the generated pin projection.

No blocking issues.

---
Generated by Claude Code Patch Reviewer