From: Marek Czernohous <mczernohous@gmail.com>
To: nouveau@lists.freedesktop.org
Cc: Lyude Paul <lyude@redhat.com>, Danilo Krummrich <dakr@kernel.org>,
dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 0/2] drm/nouveau: nv04 FIFO cleanup + recovery for Tesla
Date: Sat, 25 Jul 2026 20:59:48 +0200 [thread overview]
Message-ID: <20260725185948.219510-1-marek@czernohous.de> (raw)
In-Reply-To: <20260513175014.96599-1-marek@czernohous.de>
Please do not apply this series. Since sending it I have been running it on
the reference machine and found three defects in it, one of which is a
guaranteed crash on exactly the hardware it targets.
1) Patch 2/2 calls nvkm_chan_error(chan, true). nv50 and g84 channels have
no .preempt callback and the call site in nvkm_chan_error() is not
guarded, so this dereferences a NULL function pointer under chan->lock
in interrupt context. It fired here on 2026-06-02 on the first CACHE_ERROR
after a VRAM stress test:
fifo: CACHE_ERROR - ch 2 [labwc[3950]] subc 3 mthd 0f00 data 0000007b
nv04_fifo_intr_cache_error+0x111 -> nv04_fifo_recover+0x80
-> nvkm_chan_error+0x99
RIP: 0010:0x0
The oops escalated to a panic and the watchdog reset the machine.
2) Killing the channel on the first fault is wrong. There is a single PFIFO
cache puller and on a fault it names the channel that is resident, not
necessarily the one that caused it, as nv04_fifo_pause() already
documents. Here this killed the Wayland compositor twice for faults it
did not cause.
3) On Tesla a killed channel is not survivable at all. The channel-killed
event is only subscribed for FERMI_CHANNEL_GPFIFO and newer, so
nouveau_fence_context_kill() never runs and the pending fences of the
killed channel are never signalled. The display commit tail and the TTM
delayed-delete workers then wait forever, uninterruptibly. The series as
posted therefore trades a recoverable fault for an unrecoverable hang.
v2 fixes all three and adds a prerequisite patch for the event
subscription. It is written and rebased, but I am not sending it yet: the
new escalation logic has only hours of runtime here and no fault has hit it
so far. I would rather restore the debugfs fault injector I used for the
original validation and demonstrate the corrected paths with injected
faults than post a second series that is short on evidence. That is what I
am doing next.
Lyude: v2 will carry the Assisted-by trailers, as offered in my reply to
your question in May.
Sorry for the noise, and thanks for not having applied it yet.
Marek
prev parent reply other threads:[~2026-07-25 18:59 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-13 17:50 Marek Czernohous
2026-05-13 17:50 ` [PATCH 1/2] drm/nouveau/fifo/nv04: filter benign CACHE_ERROR from Mesa NV50 bind probe Marek Czernohous
2026-05-13 17:50 ` [PATCH 2/2] drm/nouveau/fifo: add recovery path for Tesla cache_error/dma_pusher Marek Czernohous
2026-05-19 22:01 ` [PATCH 0/2] drm/nouveau: nv04 FIFO cleanup + recovery for Tesla lyude
2026-05-20 4:27 ` Marek Czernohous
2026-07-25 18:59 ` Marek Czernohous [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260725185948.219510-1-marek@czernohous.de \
--to=mczernohous@gmail.com \
--cc=dakr@kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lyude@redhat.com \
--cc=nouveau@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®