bug: kernel bug when unbinding EFI framebuffer

Hi,

When I try to unbind the EFI framebuffer via:

	echo -n efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/unbind

the process gets stuck and dmesg shows the following:

	WARNING: CPU: 14 PID: 1495 at drivers/video/fbdev/core/fbmem.c:1693
	...
	Call Trace: 
		unregister_framebuffer+0x22/0x40 
		efifb_remove+0x1e/0x40 
		platform_drv_remove+0x29/0x50 
		device_release_driver_internal+0x1ba/0x2d0 
 		device_driver_detach+0x14/0x20 
		unbind_store+0x11b/0x150 
		drv_attr_store+0x24/0x30 
		sysfs_kf_write+0x3f/0x50 
		kernfs_fop_write+0xda/0x1b0 
		x64_sys_write+0x17a/0x2f0 
		do_syscall_64+0x57/0x1b0 
		entry_SYSCALL_64_after_hwframe+0x44/0xa9
	... 
	kernel BUG at mm/slub.c:304!
	...
	Call Trace: 
		? do_invalid_op+0x39/0x140 
		? apic_timer_interrupt+0xa/0x20
		? do_unregister_framebuffer+0x10c/0x150
		kfree+0x231/0x250 
		do_unregister_framebuffer+0x10c/0x150 
		unregister_framebuffer+0x22/0x40
		efifb_remove+0x1e/0x40 
		platform_drv_remove+0x29/0x50
		device_release_driver_internal+0x1ba/0x2d0
		device_driver_detach+0x14/0x20
		unbind_store+0x11b/0x150 
		drv_attr_store+0x24/0x30
		sysfs_kf_write+0x3f/0x50
		kernfs_fop_write+0xda/0x1b0 
		x64_sys_write+0x17a/0x2f0
		do_syscall_64+0x57/0x1b0
		entry_SYSCALL_64_after_hwframe+0x44/0xa9

I have attached the full kernel log as well.

I have tested this issue on Ubuntu-based kernels 5.3, 5.4, 5.5 and 5.6 and
they all seem to give the same error. Oddly enough, it only happens when
I have nouveau enabled. In case I blacklist nouveau, everything works fine.
	

Best regards,

Fabian Mastenbroek

On Sat, 2 May 2020 at 22:36, Fabian Mastenbroek [off-list ref] wrote:

Hi,

When I try to unbind the EFI framebuffer via:

        echo -n efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/unbind

Can I ask why?

nouveau kicks the efifb off the hw, and unregisters it, but when you
unbind it it tries to unregister again.

It might be possible to block this, but not sure of the point, efifb
is a built-in, you can't unload the module to save memory.

Dave.

On Wed, 13 May 2020 at 06:03, Dave Airlie [off-list ref] wrote:

On Sat, 2 May 2020 at 22:36, Fabian Mastenbroek [off-list ref] wrote:

quoted

Hi,

When I try to unbind the EFI framebuffer via:

        echo -n efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/unbind

Can I ask why?

nouveau kicks the efifb off the hw, and unregisters it, but when you
unbind it it tries to unregister again.

It might be possible to block this, but not sure of the point, efifb
is a built-in, you can't unload the module to save memory.

diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index 65491ae74808..87405545a903 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c

@@ -598,7 +598,8 @@ static int efifb_remove(struct platform_device *pdev)
 {
        struct fb_info *info = platform_get_drvdata(pdev);

-       unregister_framebuffer(info);
+       if (info->dev)
+               unregister_framebuffer(info);
        sysfs_remove_groups(&pdev->dev.kobj, efifb_groups);
        framebuffer_release(info);

something like that (applied by hand, this is just pasted out into
gmail so won't apply), might stop the oops.

Dave.

Dave.

Ah that explains it. I did not realize that nouveau already unregisters the framebuffer. 

To answer your question on why: I wanted to isolate a GPU so that I pass it forward to a VM. However, as I understand now, I shouldn’t need to touch the EFI framebuffer when using nouveau.

Best regards,

Fabian Mastenbroek

On 12 May 2020, at 22:03, Dave Airlie [off-list ref] wrote:

On Sat, 2 May 2020 at 22:36, Fabian Mastenbroek [off-list ref] wrote:

quoted

Hi,

When I try to unbind the EFI framebuffer via:

       echo -n efi-framebuffer.0 > /sys/bus/platform/drivers/efi-framebuffer/unbind

Can I ask why?

nouveau kicks the efifb off the hw, and unregisters it, but when you
unbind it it tries to unregister again.

It might be possible to block this, but not sure of the point, efifb
is a built-in, you can't unload the module to save memory.

Dave.