Reviewed-by: Lyude Paul <[email protected]> Will push to drm-misc-fixes in a moment, thanks!
On Fri, 2026-10-02 at 12:09 -0600, Jim Cromie via B4 Relay wrote: > From: Jim Cromie <[email protected]> > > Commit cb4c7603678c ("drm/nouveau/gsp/r570: Add support for > INTERNAL_GCX_ENTRY_PREREQUISITE") hooked nvif_device_gcx_ready() into > nouveau_pmops_runtime_suspend() to consult GSP before runtime > suspend. > > On GPUs running without GSP-RM (e.g. Volta GV100, NvGspRm=0, or > missing > GSP firmware blobs), device->gsp is instantiated but gsp->rm remains > NULL. nvkm_udevice_gcx_ready() checked "!gsp" instead of verifying > nvkm_gsp_rm(gsp), allowing non-RM instances to invoke > nvkm_gsp_gcx_ready(). nvkm_gsp_gcx_ready() then unconditionally > dereferenced gsp->rm->api, causing a kernel oops: > > RIP: 0010:nvkm_gsp_gcx_ready+0x10/0x30 [nouveau] > Code: ... 48 8b 87 70 0e 00 00 <48> 8b 40 18 ... > RAX: 0000000000000000 RDI: ffff8c9555fca000 > Call Trace: > nvkm_udevice_mthd+0xa5/0x150 [nouveau] > nvkm_ioctl+0xcc/0x1d0 [nouveau] > nvif_object_mthd+0x110/0x1e0 [nouveau] > nvif_device_gcx_ready+0x36/0x60 [nouveau] > nouveau_pmops_runtime_suspend+0x39/0x140 [nouveau] > > Instruction decode shows `mov rax, [rdi+0xe70]` loads gsp->rm (0x0), > and `<48> 8b 40 18` (`mov rax, [rax+0x18]`) faults accessing rm->api. > > Fix by: > 0. Checking !nvkm_gsp_rm(gsp) in nvkm_udevice_gcx_ready() so non-RM > devices report GC6/GcOff ready and bypass the GSP call entirely. > 1. Guarding gsp and gsp->rm in nvkm_gsp_gcx_ready() before inspecting > gsp->rm->api->gsp->gcx_ready. > > Fixes: cb4c7603678c ("drm/nouveau/gsp/r570: Add support for > INTERNAL_GCX_ENTRY_PREREQUISITE") > Signed-off-by: Jim Cromie <[email protected]> > --- > drivers/gpu/drm/nouveau/nvkm/engine/device/user.c | 2 +- > drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/user.c > b/drivers/gpu/drm/nouveau/nvkm/engine/device/user.c > index f78e6b9b4292..d469437eb991 100644 > --- a/drivers/gpu/drm/nouveau/nvkm/engine/device/user.c > +++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/user.c > @@ -201,7 +201,7 @@ nvkm_udevice_gcx_ready(struct nvkm_udevice *udev, > void *data, u32 size) > } *args = data; > int ret = -ENOSYS; > > - if (!gsp) { > + if (!nvkm_gsp_rm(gsp)) { > args->v0.ready = NV_DEVICE_GC6_READY | > NV_DEVICE_GCOFF_READY; > return 0; > } > diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c > b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c > index e475d0e8fa7b..9e07d67dcb0f 100644 > --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c > +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c > @@ -51,7 +51,7 @@ nvkm_gsp_intr_stall(struct nvkm_gsp *gsp, enum > nvkm_subdev_type type, int inst) > int > nvkm_gsp_gcx_ready(struct nvkm_gsp *gsp) > { > - if (!gsp->rm->api->gsp->gcx_ready) > + if (!gsp || !gsp->rm || !gsp->rm->api->gsp->gcx_ready) > return NV_DEVICE_GC6_READY | NV_DEVICE_GCOFF_READY; > > return gsp->rm->api->gsp->gcx_ready(gsp);
