Re: [PATCH 0/2] drm/nouveau: fix GK107 VDPAU regressions

[Kush Chandak]

On Sun, 13 Sep 2026 23:12:23 +0300, Risto Pajula wrote:
> This series fixes two independent Nouveau regressions affecting VDPAU
> hardware video decoding on NVIDIA GK107 (Kepler).

I ran into both regressions on a GK208B (GeForce GT 710, NV106) with
VA-API and arrived at the same two fixes. Built against the same nouveau
source, my versions and this series give identical machine code for
gk104.o and uchan.o.

Tested on Ubuntu 26.04 (kernel 7.0.0-38) with the two changes applied
to nouveau, video firmware extracted from NVIDIA 340.108, Mesa 26.0.8
with the VA-API fixes from Mesa MR !45340, and ffmpeg -hwaccel vaapi:

  H.264 1920x1080:  600/600 frames identical to software decoding, 115 fps
  MPEG-2 1920x1080: 300 frames, 164 fps
  no nouveau messages in dmesg

Without patch 1, MSVLD faults with PRIV_VIOLATION on the first frame
and the channel is killed. With only patch 1, decoding blocks for 30 s
in DRM_IOCTL_NOUVEAU_GEM_CPU_PREP and then fails with -EBUSY.

Patch 2 also fixes an out-of-bounds access. Without nonstall_ctor,
nvkm_fifo_oneinit() creates the non-stall event with a single index,
so event->refs[] has one entry, but nvkm_event_get()/nvkm_event_put()
are called with index runl->id and don't check it against index_nr.
The Kepler video engines are on non-zero runlists, so their channels'
non-stall events increment and decrement memory past the end of
refs[].

Both regressions are in stable kernels (since 6.2 and 6.6), so it may
be worth adding

  Cc: stable@xxxxxxxxxxxxxxx

to both patches.

Tested-by: Kush Chandak <kushc451@xxxxxxxxx>

I used an AI assistant (Claude) to help debug and test this.