unbind framebuffer causes oops in unregister_framebuffer (TU106 [GeForce RTX 2070])
In attempting to get vfio-pci passthrough on 5.8.0 mainline kernel:
trigger by:
echo efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/unbind
kernel args include: intel_iommu=on iommu=pt
vt-d enabled in bios
01:00.0 VGA compatible controller [0300]: NVIDIA Corporation TU106 [GeForce RTX 2070] [10de:1f02] (rev a1)
01:00.1 Audio device [0403]: NVIDIA Corporation TU106 High Definition Audio Controller [10de:10f9] (rev a1)
01:00.2 USB controller [0c03]: NVIDIA Corporation TU106 USB 3.1 Host Controller [10de:1ada] (rev a1)
01:00.3 Serial bus controller [0c80]: NVIDIA Corporation TU106 USB Type-C UCSI Controller [10de:1adb] (rev a1)[ 0.392592] pci 0000:01:00.0: [10de:1f02] type 00 class 0x030000
[ 0.392610] pci 0000:01:00.0: reg 0x10: [mem 0x80000000-0x80ffffff]
[ 0.392618] pci 0000:01:00.0: reg 0x14: [mem 0x6000000000-0x600fffffff 64bit pref]
[ 0.392626] pci 0000:01:00.0: reg 0x1c: [mem 0x6010000000-0x6011ffffff 64bit pref]
[ 0.392631] pci 0000:01:00.0: reg 0x24: [io 0x3000-0x307f]
[ 0.392637] pci 0000:01:00.0: reg 0x30: [mem 0x81000000-0x8107ffff pref]
[ 0.392650] pci 0000:01:00.0: BAR 1: assigned to efifb
[ 0.392684] pci 0000:01:00.0: PME# supported from D0 D3hot
[ 0.392731] pci 0000:01:00.0: 32.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x16 link at 0000:00:01.0 (capable of 126.016 Gb/s with 8.0 GT/s PCIe x16 link)
[ 0.392768] pci 0000:01:00.1: [10de:10f9] type 00 class 0x040300
[ 0.392779] pci 0000:01:00.1: reg 0x10: [mem 0x81080000-0x81083fff]
[ 0.392870] pci 0000:01:00.2: [10de:1ada] type 00 class 0x0c0330
[ 0.392885] pci 0000:01:00.2: reg 0x10: [mem 0x6012000000-0x601203ffff 64bit pref]
[ 0.392898] pci 0000:01:00.2: reg 0x1c: [mem 0x6012040000-0x601204ffff 64bit pref]
[ 0.392943] pci 0000:01:00.2: PME# supported from D0 D3hot
[ 0.392982] pci 0000:01:00.3: [10de:1adb] type 00 class 0x0c8000
[ 0.392993] pci 0000:01:00.3: reg 0x10: [mem 0x81084000-0x81084fff]
[ 0.393048] pci 0000:01:00.3: PME# supported from D0 D3hot
[ 0.934377] pci 0000:00:01.0: Adding to iommu group 1
..
[ 0.934490] pci 0000:01:00.0: Adding to iommu group 1
[ 0.934493] pci 0000:01:00.1: Adding to iommu group 1
[ 0.934496] pci 0000:01:00.2: Adding to iommu group 1
[ 0.934499] pci 0000:01:00.3: Adding to iommu group 1
...
[ 2.004345] nouveau 0000:01:00.0: DRM: VRAM: 8192 MiB
[ 2.004345] nouveau 0000:01:00.0: DRM: GART: 536870912 MiB
[ 2.004346] nouveau 0000:01:00.0: DRM: BIT table 'A' not found
[ 2.004347] nouveau 0000:01:00.0: DRM: BIT table 'L' not found
[ 2.004348] nouveau 0000:01:00.0: DRM: TMDS table version 2.0
[ 2.004348] nouveau 0000:01:00.0: DRM: DCB version 4.1
[ 2.004349] nouveau 0000:01:00.0: DRM: DCB outp 00: 02800f66 04600020
[ 2.004350] nouveau 0000:01:00.0: DRM: DCB outp 01: 02000f62 04620020
[ 2.004351] nouveau 0000:01:00.0: DRM: DCB outp 03: 02011f52 00020010
[ 2.004351] nouveau 0000:01:00.0: DRM: DCB outp 04: 04822f76 04600010
[ 2.004352] nouveau 0000:01:00.0: DRM: DCB outp 05: 04022f72 04620010
[ 2.004353] nouveau 0000:01:00.0: DRM: DCB outp 06: 04833f86 04600020
[ 2.004353] nouveau 0000:01:00.0: DRM: DCB outp 08: 01844f36 04600010
[ 2.004354] nouveau 0000:01:00.0: DRM: DCB outp 09: 01044f32 00020010
[ 2.004354] nouveau 0000:01:00.0: DRM: DCB conn 00: 00020046
[ 2.004355] nouveau 0000:01:00.0: DRM: DCB conn 01: 00010161
[ 2.004356] nouveau 0000:01:00.0: DRM: DCB conn 02: 01000246
[ 2.004356] nouveau 0000:01:00.0: DRM: DCB conn 03: 02000371
[ 2.004357] nouveau 0000:01:00.0: DRM: DCB conn 04: 00001446
[ 2.004632] nouveau 0000:01:00.0: DRM: MM: using COPY for buffer copies
...
[ 2.620458] nouveau 0000:01:00.0: DRM: allocated 3840x2160 fb: 0x200000, bo 00000000223cf665
[ 2.621146] fbcon: nouveaudrmfb (fb0) is primary device
[ 2.621147] fbcon: Deferring console take-over
[ 2.621148] nouveau 0000:01:00.0: fb0: nouveaudrmfb frame buffer device
[ 2.630224] [drm] Initialized nouveau 1.3.1 20120801 for 0000:01:00.0 on minor 1
[ 2.630225] nouveau 0000:01:00.0: DRM: Disabling PCI power management to avoid bug
...
[ 3796.132573] ------------[ cut here ]------------
[ 3796.132586] WARNING: CPU: 2 PID: 5173 at drivers/video/fbdev/core/fbmem.c:1693 do_unregister_framebuffer+0x13/0x110
[ 3796.132588] Modules linked in: uinput rfcomm xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_nat_tftp nf_conntrack_tftp tun bridge stp llc nft_objref nf_conntrack_netb
ios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ip6table_nat ip6tabl
e_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_mangle iptable_raw iptable_security ip_set nf_tables nf
netlink ip6table_filter ip6_tables iptable_filter cmac bnep sunrpc vfat fat squashfs loop intel_rapl_msr ucsi_ccg typec_ucsi typec ee1004 mei_hdcp iTCO_wdt iTCO_vendor_support
intel_rapl_common x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass rapl intel_cstate intel_uncore eeepc_wmi asus_wmi sparse_keymap wmi_bmof pcspkr joyde
v btusb btrtl btbcm btintel bluetooth snd_usb_audio snd_usbmidi_lib snd_rawmidi mc apple_mfi_fastcharge ecdh_generic ecc snd_sof_pci
[ 3796.132644] snd_sof_intel_byt snd_sof_intel_ipc acpi_pad acpi_tad snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_xtensa_dsp snd_sof_intel_hda snd_sof snd_hda_codec_real
tek snd_soc_skl snd_hda_codec_generic snd_soc_sst_ipc ledtrig_audio snd_soc_sst_dsp snd_hda_ext_core snd_soc_acpi_intel_match snd_soc_acpi iwlmvm snd_soc_core snd_hda_codec_hd
mi snd_compress ac97_bus snd_pcm_dmaengine mac80211 snd_hda_intel snd_intel_dspcfg snd_hda_codec i2c_nvidia_gpu snd_hda_core snd_hwdep snd_seq libarc4 snd_seq_device snd_pcm i
wlwifi snd_timer snd i2c_i801 i2c_smbus soundcore cfg80211 mei_me mei rfkill ie31200_edac ip_tables hid_logitech_hidpp hid_apple hid_plantronics nouveau crct10dif_pclmul crc32
_pclmul i915 mxm_wmi ttm crc32c_intel hid_logitech_dj cec ghash_clmulni_intel nvme i2c_algo_bit e1000e drm_kms_helper nvme_core drm wmi video pinctrl_cannonlake pinctrl_intel
fuse i2c_dev
[ 3796.132698] CPU: 2 PID: 5173 Comm: bash Not tainted 5.8.0 #6
[ 3796.132700] Hardware name: System manufacturer System Product Name/ROG STRIX Z390-E GAMING, BIOS 1502 02/21/2020
[ 3796.132705] RIP: 0010:do_unregister_framebuffer+0x13/0x110
[ 3796.132710] Code: 85 c0 74 05 e9 be f2 81 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 1f 44 00 00 41 54 55 8b 77 04 48 89 fd 83 fe 1f 76 63 <0f> 0b 48 8b bd f0 01 00 00
48 85 ff 74 0d f6 85 0c 02 00 00 01 0f
[ 3796.132713] RSP: 0018:ffffbdb7c2337dd0 EFLAGS: 00010206
[ 3796.132716] RAX: 0000000000000000 RBX: ffff9fd41812a000 RCX: 0000000000000000
[ 3796.132718] RDX: ffff9fd28fae8000 RSI: 0000000000000000 RDI: ffff9fd417287800
[ 3796.132720] RBP: ffff9fd417287800 R08: ffff9fd4104b3cc8 R09: 0000000000000000
[ 3796.132721] R10: 0000000000000000 R11: ffffbdb7c2337d01 R12: 0000000000000000
[ 3796.132723] R13: ffffffff9a75fac8 R14: ffffbdb7c2337f10 R15: ffff9fd3b33f7860
[ 3796.132727] FS: 00007f6aafe71740(0000) GS:ffff9fd41dc80000(0000) knlGS:0000000000000000
[ 3796.132729] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3796.132731] CR2: 0000564b2b2d0000 CR3: 00000006cfb7a003 CR4: 00000000003606e0
[ 3796.132733] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3796.132735] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3796.132737] Call Trace:
[ 3796.132748] unregister_framebuffer+0x1d/0x30
[ 3796.132754] efifb_remove+0x19/0x40
[ 3796.132759] platform_drv_remove+0x24/0x40
[ 3796.132765] __device_release_driver+0x15c/0x210
[ 3796.132772] device_driver_detach+0x3c/0xa0
[ 3796.132778] unbind_store+0x113/0x130
[ 3796.132785] kernfs_fop_write+0xce/0x1b0
[ 3796.132790] vfs_write+0xc7/0x1f0
[ 3796.132794] ksys_write+0x4f/0xc0
[ 3796.132799] do_syscall_64+0x52/0x90
[ 3796.132833] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 3796.132837] RIP: 0033:0x7f6aaff66537
[ 3796.132842] Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3
48 83 ec 28 48 89 54 24 18 48 89 74 24
[ 3796.132844] RSP: 002b:00007ffcb424dfc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 3796.132847] RAX: ffffffffffffffda RBX: 0000000000000012 RCX: 00007f6aaff66537
[ 3796.132849] RDX: 0000000000000012 RSI: 0000564b2b1cd5c0 RDI: 0000000000000001
[ 3796.132851] RBP: 0000564b2b1cd5c0 R08: 000000000000000a R09: 0000000000000011
[ 3796.132853] R10: 0000564b2b2f8c80 R11: 0000000000000246 R12: 0000000000000012
[ 3796.132854] R13: 00007f6ab0038500 R14: 0000000000000012 R15: 00007f6ab0038700
[ 3796.132860] ---[ end trace 5b10c7416ca32ff0 ]---Edited by Daniel Black