On Fri, 2026-10-09 at 23:53 +0200, Danilo Krummrich wrote: > On Fri Oct 9, 2026 at 7:44 PM CEST, Jim Cromie via B4 Relay wrote: > > From: Jim Cromie <[email protected]> > > > > Commit cb4c7603678c ("drm/nouveau/gsp/r570: Add support for > > INTERNAL_GCX_ENTRY_PREREQUISITE") hooked nvif_device_gcx_ready() > > into > > nouveau_pmops_runtime_suspend() to consult GSP before runtime > > suspend. > > > > On GPUs running without GSP-RM (e.g. Volta GV100, NvGspRm=0, or > > missing > > GSP firmware blobs), device->gsp is instantiated but gsp->rm > > remains > > NULL. nvkm_udevice_gcx_ready() checked "!gsp" instead of verifying > > nvkm_gsp_rm(gsp), allowing non-RM instances to invoke > > nvkm_gsp_gcx_ready(). nvkm_gsp_gcx_ready() then unconditionally > > dereferenced gsp->rm->api, causing a kernel oops: > > > > RIP: 0010:nvkm_gsp_gcx_ready+0x10/0x30 [nouveau] > > Code: ... 48 8b 87 70 0e 00 00 <48> 8b 40 18 ... > > RAX: 0000000000000000 RDI: ffff8c9555fca000 > > Call Trace: > > nvkm_udevice_mthd+0xa5/0x150 [nouveau] > > nvkm_ioctl+0xcc/0x1d0 [nouveau] > > nvif_object_mthd+0x110/0x1e0 [nouveau] > > nvif_device_gcx_ready+0x36/0x60 [nouveau] > > nouveau_pmops_runtime_suspend+0x39/0x140 [nouveau] > > > > Instruction decode shows `mov rax, [rdi+0xe70]` loads gsp->rm > > (0x0), > > and `<48> 8b 40 18` (`mov rax, [rax+0x18]`) faults accessing rm- > > >api. > > > > Fix by: > > 0. Checking !nvkm_gsp_rm(gsp) in nvkm_udevice_gcx_ready() so non-RM > > devices report GC6/GcOff ready and bypass the GSP call entirely. > > 1. Guarding gsp and gsp->rm in nvkm_gsp_gcx_ready() before > > inspecting > > gsp->rm->api->gsp->gcx_ready. > > > > Fixes: cb4c7603678c ("drm/nouveau/gsp/r570: Add support for > > INTERNAL_GCX_ENTRY_PREREQUISITE") > > Signed-off-by: Jim Cromie <[email protected]> > > Isn't this fixed in commit 4d0e27041185 ("nouveau: check gsp->rm as > well as gsp > pointer before gcx ready") already?
(gonna hold off on pushing all 3 of these patches, you're right - I completely forgot that we had already pushed a commit for this)
