mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Marek Czernohous <mczernohous@gmail.com>
To: nouveau@lists.freedesktop.org
Cc: Lyude Paul <lyude@redhat.com>, Danilo Krummrich <dakr@kernel.org>,
	dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 0/2] drm/nouveau: nv04 FIFO cleanup + recovery for Tesla
Date: Sat, 25 Jul 2026 20:59:48 +0200	[thread overview]
Message-ID: <20260725185948.219510-1-marek@czernohous.de> (raw)
In-Reply-To: <20260513175014.96599-1-marek@czernohous.de>

Please do not apply this series. Since sending it I have been running it on
the reference machine and found three defects in it, one of which is a
guaranteed crash on exactly the hardware it targets.

1) Patch 2/2 calls nvkm_chan_error(chan, true). nv50 and g84 channels have
   no .preempt callback and the call site in nvkm_chan_error() is not
   guarded, so this dereferences a NULL function pointer under chan->lock
   in interrupt context. It fired here on 2026-06-02 on the first CACHE_ERROR
   after a VRAM stress test:

     fifo: CACHE_ERROR - ch 2 [labwc[3950]] subc 3 mthd 0f00 data 0000007b
     nv04_fifo_intr_cache_error+0x111 -> nv04_fifo_recover+0x80
      -> nvkm_chan_error+0x99
     RIP: 0010:0x0

   The oops escalated to a panic and the watchdog reset the machine.

2) Killing the channel on the first fault is wrong. There is a single PFIFO
   cache puller and on a fault it names the channel that is resident, not
   necessarily the one that caused it, as nv04_fifo_pause() already
   documents. Here this killed the Wayland compositor twice for faults it
   did not cause.

3) On Tesla a killed channel is not survivable at all. The channel-killed
   event is only subscribed for FERMI_CHANNEL_GPFIFO and newer, so
   nouveau_fence_context_kill() never runs and the pending fences of the
   killed channel are never signalled. The display commit tail and the TTM
   delayed-delete workers then wait forever, uninterruptibly. The series as
   posted therefore trades a recoverable fault for an unrecoverable hang.

v2 fixes all three and adds a prerequisite patch for the event
subscription. It is written and rebased, but I am not sending it yet: the
new escalation logic has only hours of runtime here and no fault has hit it
so far. I would rather restore the debugfs fault injector I used for the
original validation and demonstrate the corrected paths with injected
faults than post a second series that is short on evidence. That is what I
am doing next.

Lyude: v2 will carry the Assisted-by trailers, as offered in my reply to
your question in May.

Sorry for the noise, and thanks for not having applied it yet.

Marek

      parent reply	other threads:[~2026-07-25 18:59 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-13 17:50 Marek Czernohous
2026-05-13 17:50 ` [PATCH 1/2] drm/nouveau/fifo/nv04: filter benign CACHE_ERROR from Mesa NV50 bind probe Marek Czernohous
2026-05-13 17:50 ` [PATCH 2/2] drm/nouveau/fifo: add recovery path for Tesla cache_error/dma_pusher Marek Czernohous
2026-05-19 22:01 ` [PATCH 0/2] drm/nouveau: nv04 FIFO cleanup + recovery for Tesla lyude
2026-05-20  4:27   ` Marek Czernohous
2026-07-25 18:59 ` Marek Czernohous [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260725185948.219510-1-marek@czernohous.de \
    --to=mczernohous@gmail.com \
    --cc=dakr@kernel.org \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lyude@redhat.com \
    --cc=nouveau@lists.freedesktop.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®