RTX 4070 (AD104) — Black screen after LUKS2 unlock on all kernels since early July

Hi all,

I’ve been running Qubes OS R4.2 dom0 (Fedora 37) with an NVIDIA RTX 4070 (AD104) using the nouveau driver for months without issue. About a month ago, after entering my LUKS2 passphrase, I now get only a black screen. The system boots fine otherwise — TTY works (Ctrl+Alt+F2) — but no graphical desktop appears. Lightdm start and is running
when I check status, but it does not appear graphically.
What changed:
Around early July there were updates to linux-firmware, linux-firmware-whence and the kernel. This is also when the problem began.

What I have tried so far:
(I can log into tty.)
Booting older kernels: 6.12.21, 6.12.25, 6.12.37, 6.13.7 — all show the same black screen.

Rolling back linux-firmware to multiple versions:

2025-07-08 (latest at the time)

2025-06-27

2025-04-10

Downloaded from repo with curl and transferred these older RPMs from another qube, installed in dom0, and rebuilt initramfs for each tested kernel:

sudo dracut --force --kver <kernel_version>

Verified AD104 firmware blobs are present in initramfs (lsinitrd | grep nvidia lists many .bin files).

Booted each kernel with its corresponding rebuilt initramfs — same result: black screen after LUKS2 unlock.

dmesg consistently shows:

nouveau : gsp ctor failed : -2
nouveau: probe with driver nouveau failed with error -2

Related reports:
Red Hat Bug 2375308 — GSP firmware init failure on Ada GPUs
Red Hat Bug 2375857

Similar Qubes forum thread

Summary:
Even after rolling back firmware to known working versions and rebuilding initramfs for multiple older kernels, the issue persists.

Regard.

EDIT
I found a work around!

ATTENTION - THIS FIX IS AT YOUR OWN RISK AND THERE IS NO WARRANTY ABOUT THE SECURITY.
I did not think of any threat model doing this. This is probably out of QubesOS security guidelines since we download a rpm from the web from the default personal appvm and then copy it into dom0 and install.

You will have to downgrade the firmware.

if needed, in /etc/default/grub, add 3 nomodeset modprobe.blacklist=nouveau
then

sudo grub2-mkconfig -o /boot/efi/EFI/qubes/grub.cfg

for convenience(this assume you use UEFI).

you will have to download linux-firmware, linux-firmware-whence and nvidia-gpu-firmware
from a older version and then install it and then do a dracut for each kernel, then remove the blacklist and nomodeset 3, then another grub2-mkconfig.
Personnaly I used firmware version 20250509 for both linux-firmware and nvidia-gpu-firmware and I boot with kernel 6.14.4-1. Then use dnf versionlock add linux-firmware nvidia-gpu-firmware
You need to install it with python3-dnf-plugins-extras-versionlock.

To list all package use this:

qvm-run --pass-io personal ‘curl -s https://yum.qubes-os.org/r4.2/current/dom0/fc37/rpm/’ | grep linux-firmware

same for linux-firmware-whence and nvidia-gpu-firmware

then download with

qvm-run personal ‘curl -fL -O https://yum.qubes-os.org/r4.2/current/dom0/fc37/rpm/nvidia-gpu-firmware-20250509-1.fc37.noarch.rpm

(optional)Verify the presence and type of rpm

qvm-run -p personal ‘file *.rpm’

They have to show RPM v3.0 bin etc.
then transfer with

qvm-run --pass-io personal ‘cat ~/nvidia-gpu-firmware-20250509-1.fc37.noarch.rpm’ > ~/nvidia-gpu-firmware-20250509-1.fc37.noarch.rpm

Do the same with linux-firmware and linux-firmware-whence.

Verify signature with :

rpm -q --qf “%{NAME}-%{VERSION}-%{RELEASE} : %{SIGPGP:pgpsig}\n” linux-firmware nvidia-gpu-firmware

compare with

gpg --show-keys /etc/pki/rpm-gpg/* | less

then install both:

sudo dnf install --disablerepo=* --setopt=install_weak_deps=False ./nvidia-gpu-firmware-20250509-1.fc37.noarch.rpm

then regenerate initramfs.

sudo dracut --force --kver 6.14.4-1.qubes.fc37.x86_64

(optional)Verify the presence of .img

ls -lh /boot/initramfs-*.img

then

sudo grub2-mkconfig -o /boot/efi/EFI/qubes/grub.cfg