Re: [PATCH 5/7] nouveau/gsp: fix vblank interrupts on GB20x

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] NULL pointer dereference in `nvkm_uhead_mthd_scanoutpos` due to missing `.rgpos` callback in `gb202_head`.
- [Low] Build failure due to undeclared identifier `r535_head_state` in `gb202_head` struct.
--

--- Patch [5]: [PATCH 5/7] nouveau/gsp: fix vblank interrupts on GB20x ---
commit f0249296d0fe470f2e8d8e3f163056c84c1f8f5d
Author: Mohamed Ahmed <[email protected]>

nouveau/gsp: fix vblank interrupts on GB20x

The GSP path programs per-head timing (vblank) interrupts the same way on
every generation. NVD5.0 (GB20x) reworked the FE interrupt frontend
around four message-based kernel vectors and moved RM head-timing
interrupts to the dedicated low-latency vector. This patch selects the
head functions and interrupt handler per generation to fix vblank interrupts.

> diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c
> index fd473b4d12a82..bc91d46e646d5 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c
[ ... ]
> @@ -692,6 +692,33 @@ r535_head = {
>  	.vblank_put = r535_head_vblank_put,
>  };
>  
[ ... ]
> +static const struct nvkm_head_func
> +gb202_head = {
> +	.state = r535_head_state,

[Severity: Low]
Does r535_head_state exist? It appears this might cause a build failure
due to an undeclared identifier. The existing r535_head struct uses
gv100_head_state for this field.

[Severity: High]
Is it safe to omit the rgpos callback here?

When userspace queries the head scanout position via NVIF_HEAD_V0_SCANOUTPOS,
execution goes to nvkm_uhead_mthd_scanoutpos(), which unconditionally
dereferences head->func->rgpos:

    head->func->rgpos(head, &args->v0.hline, &args->v0.vline);

Without rgpos being set on gb202_head, will this cause a NULL pointer
dereference when accessed from userspace?

> +	.vblank_get = gb202_head_vblank_get,
> +	.vblank_put = gb202_head_vblank_put,
> +};
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=5