[PATCH 0/2] drm/nouveau: fix GK107 VDPAU regressions

[PATCH 0/2] drm/nouveau: fix GK107 VDPAU regressions

[Risto Pajula]

Hi,

This series fixes two independent Nouveau regressions affecting VDPAU
hardware video decoding on NVIDIA GK107 (Kepler).

Patch 1 fixes engine context mappings for the legacy MSVLD, MSPDEC and
MSPPP video engines. Since commit 8ab849d6dd4c
("drm/nouveau/fifo: add new engine context handling"), privileged engine
context mappings cause FIFO PRIV_VIOLATION faults and kill the channel
during VDPAU decoding on GK107.

Patch 2 fixes a fence/progress hang introduced by commit 55e1a5996085
("drm/nouveau/fifo/ga100-: add per-runlist nonstall intr handling").
Legacy FIFO implementations use a single global nonstall event at
index 0, while channel event registration was changed to use runl->id
unconditionally. This can leave fence completion waiting for an event
that is never signalled.


Tested on NVIDIA GK107 with a Linux 7.3-rc2 based drm-misc tree,
Mesa 25.0.7 and mpv using VDPAU_DRIVER=nouveau and vdpau-copy.

With both patches applied:

  H.264 1920x1080:        PASS
  MPEG-2 1920x1080:      PASS
  VC-1 Advanced Profile: PASS

All three tests completed using VDPAU hardware decoding. No Nouveau
faults were reported in dmesg.


Thanks,
Risto

Risto Pajula (2):
  drm/nouveau/fifo/gk104: fix legacy video engine context mappings
  drm/nouveau/fifo: use global nonstall event on legacy FIFO

 drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c | 14 ++++++++++++++
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c |  3 ++-
 2 files changed, 16 insertions(+), 1 deletion(-)

-- 
2.47.3

[PATCH 1/2] drm/nouveau/fifo/gk104: fix legacy video engine context mappings

[Risto Pajula]

Commit 8ab849d6dd4c ("drm/nouveau/fifo: add new engine context handling")
made gk104_ectx_ctor() map engine contexts privileged by default.

On GK107, mapping the legacy MSVLD, MSPDEC and MSPPP video engine
contexts privileged causes FIFO PRIV_VIOLATION faults and kills the
channel during VDPAU decoding.

These engines require non-privileged engine context mappings. Keep
privileged mappings for the other engines, but clear the privileged
flag for the legacy video engines.

Fixes: 8ab849d6dd4c ("drm/nouveau/fifo: add new engine context handling")
Assisted-by: LLM
Signed-off-by: Risto Pajula <or.pajula@gmail.com>
---
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
index 5655eda52..bbeb33cd9 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
@@ -180,6 +180,20 @@ gk104_ectx_ctor(struct nvkm_engn *engn, struct nvkm_vctx *vctx)
 	struct gf100_vmm_map_v0 args = { .priv = 1 };
 	int ret;
 
+	/*
+	 * Legacy video engines access their engine contexts through
+	 * non-privileged MMU requests.
+	 */
+	switch (engn->engine->subdev.type) {
+	case NVKM_ENGINE_MSPDEC:
+	case NVKM_ENGINE_MSPPP:
+	case NVKM_ENGINE_MSVLD:
+		args.priv = 0;
+		break;
+	default:
+		break;
+	}
+
 	ret = nvkm_vmm_get(vctx->vmm, 12, vctx->inst->size, &vctx->vma);
 	if (ret)
 		return ret;
-- 
2.47.3

[PATCH 2/2] drm/nouveau/fifo: use global nonstall event on legacy FIFO

[Risto Pajula]

The per-runlist nonstall interrupt handling change made channel
nonstall event registration use the runlist ID instead of the global
event index 0.

Legacy FIFO implementations do not provide a nonstall constructor.
They have a single global nonstall event, and their interrupt handlers
signal event index 0. Registering channel events using runl->id can
therefore leave fence completion waiting for an event that is never
signalled.

Use the runlist ID when per-runlist nonstall interrupts have been
constructed, and keep using event index 0 for legacy FIFO
implementations.

Fixes: 55e1a5996085 ("drm/nouveau/fifo/ga100-: add per-runlist nonstall intr handling")
Assisted-by: LLM
Signed-off-by: Risto Pajula <or.pajula@gmail.com>
---
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c
index d6a87cec2..b96e84192 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/uchan.c
@@ -52,7 +52,8 @@ nvkm_uchan_uevent(struct nvkm_object *object, void *argv, u32 argc, struct nvkm_
 
 	switch (args->v0.type) {
 	case NVIF_CHAN_EVENT_V0_NON_STALL_INTR:
-		return nvkm_uevent_add(uevent, &runl->fifo->nonstall.event, runl->id,
+		return nvkm_uevent_add(uevent, &runl->fifo->nonstall.event,
+				runl->fifo->func->nonstall_ctor ? runl->id : 0,
 				       NVKM_FIFO_NONSTALL_EVENT, NULL);
 	case NVIF_CHAN_EVENT_V0_KILLED:
 		return nvkm_uevent_add(uevent, &runl->chid->event, chan->id,
-- 
2.47.3

Re: [PATCH 0/2] drm/nouveau: fix GK107 VDPAU regressions

[Kush Chandak]

On Sun, 13 Sep 2026 23:12:23 +0300, Risto Pajula wrote:
> This series fixes two independent Nouveau regressions affecting VDPAU
> hardware video decoding on NVIDIA GK107 (Kepler).

I ran into both regressions on a GK208B (GeForce GT 710, NV106) with
VA-API and arrived at the same two fixes. Built against the same nouveau
source, my versions and this series give identical machine code for
gk104.o and uchan.o.

Tested on Ubuntu 26.04 (kernel 7.0.0-38) with the two changes applied
to nouveau, video firmware extracted from NVIDIA 340.108, Mesa 26.0.8
with the VA-API fixes from Mesa MR !45340, and ffmpeg -hwaccel vaapi:

  H.264 1920x1080:  600/600 frames identical to software decoding, 115 fps
  MPEG-2 1920x1080: 300 frames, 164 fps
  no nouveau messages in dmesg

Without patch 1, MSVLD faults with PRIV_VIOLATION on the first frame
and the channel is killed. With only patch 1, decoding blocks for 30 s
in DRM_IOCTL_NOUVEAU_GEM_CPU_PREP and then fails with -EBUSY.

Patch 2 also fixes an out-of-bounds access. Without nonstall_ctor,
nvkm_fifo_oneinit() creates the non-stall event with a single index,
so event->refs[] has one entry, but nvkm_event_get()/nvkm_event_put()
are called with index runl->id and don't check it against index_nr.
The Kepler video engines are on non-zero runlists, so their channels'
non-stall events increment and decrement memory past the end of
refs[].

Both regressions are in stable kernels (since 6.2 and 6.6), so it may
be worth adding

  Cc: stable@vger.kernel.org

to both patches.

Tested-by: Kush Chandak <kushc451@gmail.com>

I used an AI assistant (Claude) to help debug and test this.