Bug 815998 - iwlwifi - drivers/pci/intel-iommu.c:2775: Driver unmaps unmatched page at PFN 0
iwlwifi - drivers/pci/intel-iommu.c:2775: Driver unmaps unmatched page at PFN 0
Status: CLOSED DUPLICATE of bug 827193
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: kernel (Show other bugs)
6.3
x86_64 Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Stanislaw Gruszka
Desktop QE
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-04-24 22:24 EDT by Alex Williamson
Modified: 2012-12-12 19:04 EST (History)
8 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-08-13 07:27:50 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
dmesg | grep iwl (2.6.32-262.el6.x86_64) (1.03 KB, text/plain)
2012-04-24 22:53 EDT, Alex Williamson
no flags Details
dmesg | grep iwl (2.6.32-220.13.1.el6.x86_64) (736 bytes, text/plain)
2012-04-24 22:55 EDT, Alex Williamson
no flags Details
0001-iwlwifi-fix-a-potential-race-in-receive-buffer-alloc.patch (1.57 KB, patch)
2012-05-01 13:20 EDT, John W. Linville
no flags Details | Diff
0001-iwlwifi-give-PCIe-its-own-lock.patch (11.39 KB, patch)
2012-05-02 11:20 EDT, John W. Linville
no flags Details | Diff
debug kernel dmesg with iwlwifi debug=1 (101.86 KB, text/plain)
2012-05-02 11:32 EDT, Alex Williamson
no flags Details
0001-pci-dma-x86-use-include-linux-pci-dma.h.patch (2.95 KB, text/plain)
2012-05-12 12:40 EDT, Stanislaw Gruszka
no flags Details

  None (edit)
Description Alex Williamson 2012-04-24 22:24:53 EDT
Description of problem:
iwlwifi 0000:02:00.0: L1 Disabled; Enabling L0S
iwlwifi 0000:02:00.0: Radio type=0x0-0x3-0x1
------------[ cut here ]------------
WARNING: at drivers/pci/intel-iommu.c:2775 intel_unmap_page+0x15f/0x180() (Not tainted)
Hardware name: 3680B45
Driver unmaps unmatched page at PFN 0
Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf ipv6 ext3 jbd sha256_generic aesni_intel cryptd aes_x86_64 aes_generic cbc dm_crypt vhost_net macvtap macvlan tun kvm_intel kvm uinput btusb bluetooth thinkpad_acpi arc4 iwlwifi mac80211 cfg80211 rfkill sg uvcvideo videodev v4l2_compat_ioctl32 microcode intel_ips i2c_i801 iTCO_wdt iTCO_vendor_support shpchp snd_hda_codec_hdmi snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc e1000e ext4 mbcache jbd2 sd_mod crc_t10dif ahci wmi i915 drm_kms_helper drm i2c_algo_bit i2c_core video output dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
Pid: 0, comm: swapper Not tainted 2.6.32-262.el6.x86_64 #1
Call Trace:
 <IRQ>  [<ffffffff8106b607>] ? warn_slowpath_common+0x87/0xc0
 [<ffffffff8106b6f6>] ? warn_slowpath_fmt+0x46/0x50
 [<ffffffff812a70ab>] ? find_iova+0x5b/0xa0
 [<ffffffff812ab39f>] ? intel_unmap_page+0x15f/0x180
 [<ffffffffa03a6833>] ? iwlagn_unmap_tfd+0x73/0x140 [iwlwifi]
 [<ffffffffa03a6b74>] ? iwl_tx_cmd_complete+0xf4/0x3c0 [iwlwifi]
 [<ffffffff81053363>] ? __wake_up+0x53/0x70
 [<ffffffffa03a5a6f>] ? iwl_irq_tasklet+0x20f/0x900 [iwlwifi]
 [<ffffffff81074195>] ? tasklet_action+0xe5/0x120
 [<ffffffff81073d81>] ? __do_softirq+0xc1/0x1e0
 [<ffffffff810db690>] ? handle_IRQ_event+0x60/0x170
 [<ffffffff8100c24c>] ? call_softirq+0x1c/0x30
 [<ffffffff8100de85>] ? do_softirq+0x65/0xa0
 [<ffffffff81073b65>] ? irq_exit+0x85/0x90
 [<ffffffff81502b75>] ? do_IRQ+0x75/0xf0
 [<ffffffff8100ba53>] ? ret_from_intr+0x0/0x11
 <EOI>  [<ffffffff812cc61e>] ? intel_idle+0xde/0x170
 [<ffffffff812cc601>] ? intel_idle+0xc1/0x170
 [<ffffffff8109900d>] ? sched_clock_cpu+0xcd/0x110
 [<ffffffff81405707>] ? cpuidle_idle_call+0xa7/0x140
 [<ffffffff81009e06>] ? cpu_idle+0xb6/0x110
 [<ffffffff814f3d65>] ? start_secondary+0x22a/0x26d
---[ end trace 19983f17a94a9846 ]---
iwlwifi 0000:02:00.0: L1 Disabled; Enabling L0S
iwlwifi 0000:02:00.0: Radio type=0x0-0x3-0x1

Version-Release number of selected component (if applicable):
2.6.32-262.el6.x86_64

How reproducible:
unknown

Steps to Reproduce:
1. boot system (Lenovo X201)
2.
3.
  
Actual results:
backtrace, wifi still works

Expected results:
no backtrace

Additional info:

cmdline:
ro root=/dev/mapper/vg_x201-lv_rhel6 rd_LVM_LV=vg_x201/lv_rhel6 rd_LVM_LV=vg_x201/lv_swap rd_NO_LUKS rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us rhgb quiet crashkernel=129M@0M cgroup_disable=memory intel_iommu=on,igfx_off selinux=0
Comment 2 Alex Williamson 2012-04-24 22:38:17 EDT
The device:

02:00.0 Network controller: Intel Corporation Centrino Ultimate-N 6300 (rev 35)
	Subsystem: Intel Corporation Centrino Ultimate-N 6300 3x3 AGN
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0, Cache Line Size: 64 bytes
	Interrupt: pin A routed to IRQ 30
	Region 0: Memory at f2400000 (64-bit, non-prefetchable) [size=8K]
	Capabilities: [c8] Power Management version 3
		Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
		Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [d0] MSI: Enable+ Count=1/1 Maskable- 64bit+
		Address: 00000000fee0f00c  Data: 41a1
	Capabilities: [e0] Express (v1) Endpoint, MSI 00
		DevCap:	MaxPayload 128 bytes, PhantFunc 0, Latency L0s <512ns, L1 unlimited
			ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset+
		DevCtl:	Report errors: Correctable- Non-Fatal- Fatal- Unsupported-
			RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+ FLReset-
			MaxPayload 128 bytes, MaxReadReq 128 bytes
		DevSta:	CorrErr+ UncorrErr- FatalErr- UnsuppReq+ AuxPwr+ TransPend-
		LnkCap:	Port #0, Speed 2.5GT/s, Width x1, ASPM L0s L1, Latency L0 <128ns, L1 <32us
			ClockPM+ Surprise- LLActRep- BwNot-
		LnkCtl:	ASPM Disabled; RCB 64 bytes Disabled- Retrain- CommClk+
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
		LnkSta:	Speed 2.5GT/s, Width x1, TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
	Capabilities: [100] Advanced Error Reporting
		UESta:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UEMsk:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UESvrt:	DLP+ SDES- TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
		CESta:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- NonFatalErr+
		CEMsk:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- NonFatalErr+
		AERCap:	First Error Pointer: 00, GenCap- CGenEn- ChkCap- ChkEn-
	Capabilities: [140] Device Serial Number 00-24-d7-ff-ff-04-11-f8
	Kernel driver in use: iwlwifi
	Kernel modules: iwlwifi
Comment 3 Alex Williamson 2012-04-24 22:53:59 EDT
Created attachment 580046 [details]
dmesg | grep iwl (2.6.32-262.el6.x86_64)
Comment 4 Alex Williamson 2012-04-24 22:55:12 EDT
Created attachment 580047 [details]
dmesg | grep iwl (2.6.32-220.13.1.el6.x86_64)

Problem does not occur on 6.2 .220 kernel with same cmdline.  Happens consistently on .262
Comment 5 John W. Linville 2012-04-26 12:42:35 EDT
Wey-yi, the RHEL 6.3 kernel is hitting a problem in the iwl_tx_cmd_complete path, leading to a problem unmapping some memory.  The code is more-or-less identical to what was available in the upstream 3.2 kernels.

Does this sound like a familiar issue?  Do you have any suggestions for where to look?
Comment 6 John W. Linville 2012-04-30 13:23:51 EDT
http://marc.info/?l=linux-wireless&m=133580639402395&w=2
Comment 7 John W. Linville 2012-05-01 13:20:30 EDT
Created attachment 581432 [details]
0001-iwlwifi-fix-a-potential-race-in-receive-buffer-alloc.patch

Patch from upstream email thread...
Comment 9 John W. Linville 2012-05-01 13:37:58 EDT
Alex, I am making some test kernels available to you.  Please attempt to recreate the issue with those kernels and post the results here...thanks!
Comment 12 Alex Williamson 2012-05-01 17:13:09 EDT
(In reply to comment #9)
> Alex, I am making some test kernels available to you.  Please attempt to
> recreate the issue with those kernels and post the results here...thanks!

Does not fix it:

------------[ cut here ]------------
WARNING: at drivers/pci/intel-iommu.c:2775 intel_unmap_page+0x15f/0x180() (Not tainted)
Hardware name: 3680B45
Driver unmaps unmatched page at PFN 0
Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf ipv6 ext3 jbd sha256_generic aesni_intel cryptd aes_x86_64 aes_generic cbc dm_crypt vhost_net macvtap macvlan tun kvm_intel kvm uinput thinkpad_acpi arc4 iwlwifi mac80211 cfg80211 sg btusb bluetooth rfkill uvcvideo videodev v4l2_compat_ioctl32 microcode intel_ips i2c_i801 iTCO_wdt iTCO_vendor_support snd_hda_codec_hdmi snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc shpchp e1000e ext4 mbcache jbd2 sd_mod crc_t10dif ahci wmi i915 drm_kms_helper drm i2c_algo_bit i2c_core video output dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
Pid: 0, comm: swapper Not tainted 2.6.32-268.el6.bz815998.1.x86_64 #1
Call Trace:
 <IRQ>  [<ffffffff8106b6b7>] ? warn_slowpath_common+0x87/0xc0
 [<ffffffff8106b7a6>] ? warn_slowpath_fmt+0x46/0x50
 [<ffffffff812a7f7b>] ? find_iova+0x5b/0xa0
 [<ffffffff812ac26f>] ? intel_unmap_page+0x15f/0x180
 [<ffffffffa03d47d3>] ? iwlagn_unmap_tfd+0x73/0x140 [iwlwifi]
 [<ffffffffa03d4b14>] ? iwl_tx_cmd_complete+0xf4/0x3c0 [iwlwifi]
 [<ffffffff81053363>] ? __wake_up+0x53/0x70
 [<ffffffffa03d3a0f>] ? iwl_irq_tasklet+0x20f/0x900 [iwlwifi]
 [<ffffffff81074245>] ? tasklet_action+0xe5/0x120
 [<ffffffff81073e31>] ? __do_softirq+0xc1/0x1e0
 [<ffffffff810db740>] ? handle_IRQ_event+0x60/0x170
 [<ffffffff81073e8f>] ? __do_softirq+0x11f/0x1e0
 [<ffffffff8100c24c>] ? call_softirq+0x1c/0x30
 [<ffffffff8100de85>] ? do_softirq+0x65/0xa0
 [<ffffffff81073c15>] ? irq_exit+0x85/0x90
 [<ffffffff815053e5>] ? do_IRQ+0x75/0xf0
 [<ffffffff8100ba53>] ? ret_from_intr+0x0/0x11
 <EOI>  [<ffffffff812cd4ee>] ? intel_idle+0xde/0x170
 [<ffffffff812cd4d1>] ? intel_idle+0xc1/0x170
 [<ffffffff814071d7>] ? cpuidle_idle_call+0xa7/0x140
 [<ffffffff81009e06>] ? cpu_idle+0xb6/0x110
 [<ffffffff814f65d5>] ? start_secondary+0x22a/0x26d
---[ end trace 091a9df45a3aad96 ]---
Comment 13 John W. Linville 2012-05-02 09:27:29 EDT
Thanks for the quick feedback!  I'll work another lead and get back to you.  In the meantime (from the upstream email thread)...

"Can you please re-run with debug=1 and send the whole log ?
This will give a better indication on when the issue occurs."
Comment 14 Alex Williamson 2012-05-02 10:17:01 EDT
(In reply to comment #13)
> Thanks for the quick feedback!  I'll work another lead and get back to you.  In
> the meantime (from the upstream email thread)...
> 
> "Can you please re-run with debug=1 and send the whole log ?
> This will give a better indication on when the issue occurs."

afaict, there's no debug option on iwlwifi on rhel6.3beta, so I tested 3.3.4-1.fc14.x86_64 and don't see the warning there.
Comment 15 Alex Williamson 2012-05-02 10:17:30 EDT
s/fc14/fc17/
Comment 16 John W. Linville 2012-05-02 11:12:16 EDT
FWIW, it looks like you'll need to run the "debug" variant of the RHEL6 kernel for the debug option for iwlwifi to be available.
Comment 17 John W. Linville 2012-05-02 11:20:53 EDT
Created attachment 581642 [details]
0001-iwlwifi-give-PCIe-its-own-lock.patch
Comment 18 Alex Williamson 2012-05-02 11:32:02 EDT
Created attachment 581650 [details]
debug kernel dmesg with iwlwifi debug=1
Comment 19 John W. Linville 2012-05-02 11:45:21 EDT
Test kernels w/ patch from comment 17 are building here:

   https://brewweb.devel.redhat.com/taskinfo?taskID=4367329

I'm not entirely convinced that the patch is relevant to this issue, but since it was mentioned in the thread from comment 6, I thought it was worth a follow-up...
Comment 20 Alex Williamson 2012-05-03 13:06:25 EDT
(In reply to comment #19)
> Test kernels w/ patch from comment 17 are building here:
> 
>    https://brewweb.devel.redhat.com/taskinfo?taskID=4367329
> 
> I'm not entirely convinced that the patch is relevant to this issue, but since
> it was mentioned in the thread from comment 6, I thought it was worth a
> follow-up...

Nope, not fixed.  2.5.32-268.el6.bz815998.2 generates the same warning.
Comment 23 Stanislaw Gruszka 2012-05-12 12:40:27 EDT
Created attachment 584047 [details]
0001-pci-dma-x86-use-include-linux-pci-dma.h.patch

This patch makes kernel-debug warning at check_unmap() gone, perhaps it fix also warning at intel_unmap_page(), but I'm not sure - iommu does not work on my laptop.

Test kernel with the patch is here:
https://brewweb.devel.redhat.com/taskinfo?taskID=4404944
Comment 27 Suzanne Yeghiayan 2012-05-18 16:57:14 EDT
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 31 mateusz.kijowski 2012-10-23 10:31:41 EDT
I've been hit by this bug, but can't check what the resolution was since now the bug has "Status: CLOSED DUPLICATE of bug 827193" and bug 827193 seems to be private. Is it possible to get the resolution appended to this (public) bug?
Comment 32 Stanislaw Gruszka 2012-10-23 10:36:20 EDT
Problem is fixed in kernel-2.6.32-298.el6
Comment 33 Enrique Trillo 2012-10-29 21:45:56 EDT
Please, when the kernel-2.6.32-298.el6 will be released? I am installing in a HP Laptop 8760w and I am having the same WARNING with the kernel problem and I downloaded RHEL 6.3 x64 yesterday with kernel version 2.6.32-279.el6.x86_64.
Comment 34 Stanislaw Gruszka 2012-10-30 02:47:49 EDT
With RHEL6.4 release. If you want that fix on earlier kernel version, you need to contact official RH support.
Comment 35 xset1980 2012-12-12 19:04:35 EST
Similar bug on CentOS 6.3:

kernel: 2.6.32-279.14.1.el6.i686
cmdline: kernel /boot/vmlinuz-2.6.32-279.14.1.el6.i686 ro root=UUID=de281b18-e31f-465a-be13-72a329485f44 rootfstype=ext4 rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=es_ES.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=la-latin1 crashkernel=0@0 audit=1 rdshell selinux=0 intel_iommu=on

Crash:

iwlwifi 0000:03:00.0: L1 Disabled; Enabling L0S
iwlwifi 0000:03:00.0: Radio type=0x1-0x2-0x0
------------[ cut here ]------------
WARNING: at drivers/pci/intel-iommu.c:2775 intel_unmap_page+0xe4/0x180() (Not tainted)
Hardware name: 6474ES3
Driver unmaps unmatched page at PFN 0
Modules linked in: ipv6 uinput btusb bluetooth thinkpad_acpi uvcvideo videodev sg microcode arc4 i2c_i801 iTCO_wdt iTCO_vendor_support iwlwifi mac80211 cfg80211 rfkill snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc e1000e ext4 mbcache jbd2 yenta_socket rsrc_nonstatic sd_mod crc_t10dif sr_mod cdrom wmi ahci i915 drm_kms_helper drm i2c_algo_bit i2c_core video output dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
Pid: 0, comm: swapper Not tainted 2.6.32-279.14.1.el6.i686 #1
Call Trace:
 [<c0455c51>] ? warn_slowpath_common+0x81/0xc0
 [<c062e294>] ? intel_unmap_page+0xe4/0x180
 [<c062e294>] ? intel_unmap_page+0xe4/0x180
 [<c0455d23>] ? warn_slowpath_fmt+0x33/0x40
 [<c062e294>] ? intel_unmap_page+0xe4/0x180
 [<c062e1b0>] ? intel_unmap_page+0x0/0x180
 [<f92ddf65>] ? iwlagn_unmap_tfd+0x65/0x140 [iwlwifi]
 [<f92de239>] ? iwl_tx_cmd_complete+0x99/0x350 [iwlwifi]
 [<c04403d2>] ? __wake_up+0x42/0x60
 [<f92dd392>] ? iwl_irq_tasklet+0x1f2/0x830 [iwlwifi]
 [<c047ac79>] ? hrtimer_get_next_event+0xe9/0x140
 [<c062e1b0>] ? intel_unmap_page+0x0/0x180
 [<c045d539>] ? tasklet_action+0xa9/0xe0
 [<c045cf8a>] ? __do_softirq+0x8a/0x1a0
 [<c04b8d71>] ? move_native_irq+0x11/0x50
 [<c045d0dd>] ? do_softirq+0x3d/0x50
 [<c045d235>] ? irq_exit+0x65/0x70
 [<c040b110>] ? do_IRQ+0x50/0xc0
 [<c040f608>] ? sched_clock+0x8/0x10
 [<c0409ff0>] ? common_interrupt+0x30/0x38
 [<c0670734>] ? acpi_idle_enter_bm+0x26b/0x29c
 [<c07671e2>] ? cpuidle_idle_call+0x72/0x100
 [<c0408964>] ? cpu_idle+0x94/0xd0
 [<f9257366>] ? ieee80211_rx_handlers_result+0xe6/0x220 [mac80211]
 [<c0aa79fc>] ? start_kernel+0x3b0/0x3b5
 [<c0aa748a>] ? unknown_bootoption+0x0/0x190
---[ end trace baf56102a77bacb0 ]---

Why can'nt view the bug #827193 ?

Note You need to log in before you can comment on or make changes to this bug.