RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 815998 - iwlwifi - drivers/pci/intel-iommu.c:2775: Driver unmaps unmatched page at PFN 0
Summary: iwlwifi - drivers/pci/intel-iommu.c:2775: Driver unmaps unmatched page at PFN 0
Keywords:
Status: CLOSED DUPLICATE of bug 827193
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: kernel
Version: 6.3
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Stanislaw Gruszka
QA Contact: Desktop QE
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-04-25 02:24 UTC by Alex Williamson
Modified: 2012-12-13 00:04 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-08-13 11:27:50 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
dmesg | grep iwl (2.6.32-262.el6.x86_64) (1.03 KB, text/plain)
2012-04-25 02:53 UTC, Alex Williamson 		no flags Details
dmesg | grep iwl (2.6.32-220.13.1.el6.x86_64) (736 bytes, text/plain)
2012-04-25 02:55 UTC, Alex Williamson 		no flags Details
0001-iwlwifi-fix-a-potential-race-in-receive-buffer-alloc.patch (1.57 KB, patch)
2012-05-01 17:20 UTC, John W. Linville 		no flags Details | Diff
0001-iwlwifi-give-PCIe-its-own-lock.patch (11.39 KB, patch)
2012-05-02 15:20 UTC, John W. Linville 		no flags Details | Diff
debug kernel dmesg with iwlwifi debug=1 (101.86 KB, text/plain)
2012-05-02 15:32 UTC, Alex Williamson 		no flags Details
0001-pci-dma-x86-use-include-linux-pci-dma.h.patch (2.95 KB, text/plain)
2012-05-12 16:40 UTC, Stanislaw Gruszka 		no flags Details
View All

Description Alex Williamson 2012-04-25 02:24:53 UTC 
Description of problem:
iwlwifi 0000:02:00.0: L1 Disabled; Enabling L0S
iwlwifi 0000:02:00.0: Radio type=0x0-0x3-0x1
------------[ cut here ]------------
WARNING: at drivers/pci/intel-iommu.c:2775 intel_unmap_page+0x15f/0x180() (Not tainted)
Hardware name: 3680B45
Driver unmaps unmatched page at PFN 0
Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf ipv6 ext3 jbd sha256_generic aesni_intel cryptd aes_x86_64 aes_generic cbc dm_crypt vhost_net macvtap macvlan tun kvm_intel kvm uinput btusb bluetooth thinkpad_acpi arc4 iwlwifi mac80211 cfg80211 rfkill sg uvcvideo videodev v4l2_compat_ioctl32 microcode intel_ips i2c_i801 iTCO_wdt iTCO_vendor_support shpchp snd_hda_codec_hdmi snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc e1000e ext4 mbcache jbd2 sd_mod crc_t10dif ahci wmi i915 drm_kms_helper drm i2c_algo_bit i2c_core video output dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
Pid: 0, comm: swapper Not tainted 2.6.32-262.el6.x86_64 #1
Call Trace:
 <IRQ>  [<ffffffff8106b607>] ? warn_slowpath_common+0x87/0xc0
 [<ffffffff8106b6f6>] ? warn_slowpath_fmt+0x46/0x50
 [<ffffffff812a70ab>] ? find_iova+0x5b/0xa0
 [<ffffffff812ab39f>] ? intel_unmap_page+0x15f/0x180
 [<ffffffffa03a6833>] ? iwlagn_unmap_tfd+0x73/0x140 [iwlwifi]
 [<ffffffffa03a6b74>] ? iwl_tx_cmd_complete+0xf4/0x3c0 [iwlwifi]
 [<ffffffff81053363>] ? __wake_up+0x53/0x70
 [<ffffffffa03a5a6f>] ? iwl_irq_tasklet+0x20f/0x900 [iwlwifi]
 [<ffffffff81074195>] ? tasklet_action+0xe5/0x120
 [<ffffffff81073d81>] ? __do_softirq+0xc1/0x1e0
 [<ffffffff810db690>] ? handle_IRQ_event+0x60/0x170
 [<ffffffff8100c24c>] ? call_softirq+0x1c/0x30
 [<ffffffff8100de85>] ? do_softirq+0x65/0xa0
 [<ffffffff81073b65>] ? irq_exit+0x85/0x90
 [<ffffffff81502b75>] ? do_IRQ+0x75/0xf0
 [<ffffffff8100ba53>] ? ret_from_intr+0x0/0x11
 <EOI>  [<ffffffff812cc61e>] ? intel_idle+0xde/0x170
 [<ffffffff812cc601>] ? intel_idle+0xc1/0x170
 [<ffffffff8109900d>] ? sched_clock_cpu+0xcd/0x110
 [<ffffffff81405707>] ? cpuidle_idle_call+0xa7/0x140
 [<ffffffff81009e06>] ? cpu_idle+0xb6/0x110
 [<ffffffff814f3d65>] ? start_secondary+0x22a/0x26d
---[ end trace 19983f17a94a9846 ]---
iwlwifi 0000:02:00.0: L1 Disabled; Enabling L0S
iwlwifi 0000:02:00.0: Radio type=0x0-0x3-0x1

Version-Release number of selected component (if applicable):
2.6.32-262.el6.x86_64

How reproducible:
unknown

Steps to Reproduce:
1. boot system (Lenovo X201)
2.
3.
  
Actual results:
backtrace, wifi still works

Expected results:
no backtrace

Additional info:

cmdline:
ro root=/dev/mapper/vg_x201-lv_rhel6 rd_LVM_LV=vg_x201/lv_rhel6 rd_LVM_LV=vg_x201/lv_swap rd_NO_LUKS rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us rhgb quiet crashkernel=129M@0M cgroup_disable=memory intel_iommu=on,igfx_off selinux=0
Comment 2 Alex Williamson 2012-04-25 02:38:17 UTC 
The device:

02:00.0 Network controller: Intel Corporation Centrino Ultimate-N 6300 (rev 35)
	Subsystem: Intel Corporation Centrino Ultimate-N 6300 3x3 AGN
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0, Cache Line Size: 64 bytes
	Interrupt: pin A routed to IRQ 30
	Region 0: Memory at f2400000 (64-bit, non-prefetchable) [size=8K]
	Capabilities: [c8] Power Management version 3
		Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
		Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [d0] MSI: Enable+ Count=1/1 Maskable- 64bit+
		Address: 00000000fee0f00c  Data: 41a1
	Capabilities: [e0] Express (v1) Endpoint, MSI 00
		DevCap:	MaxPayload 128 bytes, PhantFunc 0, Latency L0s <512ns, L1 unlimited
			ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset+
		DevCtl:	Report errors: Correctable- Non-Fatal- Fatal- Unsupported-
			RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+ FLReset-
			MaxPayload 128 bytes, MaxReadReq 128 bytes
		DevSta:	CorrErr+ UncorrErr- FatalErr- UnsuppReq+ AuxPwr+ TransPend-
		LnkCap:	Port #0, Speed 2.5GT/s, Width x1, ASPM L0s L1, Latency L0 <128ns, L1 <32us
			ClockPM+ Surprise- LLActRep- BwNot-
		LnkCtl:	ASPM Disabled; RCB 64 bytes Disabled- Retrain- CommClk+
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
		LnkSta:	Speed 2.5GT/s, Width x1, TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
	Capabilities: [100] Advanced Error Reporting
		UESta:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UEMsk:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UESvrt:	DLP+ SDES- TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
		CESta:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- NonFatalErr+
		CEMsk:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- NonFatalErr+
		AERCap:	First Error Pointer: 00, GenCap- CGenEn- ChkCap- ChkEn-
	Capabilities: [140] Device Serial Number 00-24-d7-ff-ff-04-11-f8
	Kernel driver in use: iwlwifi
	Kernel modules: iwlwifi
Comment 3 Alex Williamson 2012-04-25 02:53:59 UTC 
Created attachment 580046 [details]
dmesg | grep iwl (2.6.32-262.el6.x86_64)
Comment 4 Alex Williamson 2012-04-25 02:55:12 UTC 
Created attachment 580047 [details]
dmesg | grep iwl (2.6.32-220.13.1.el6.x86_64)

Problem does not occur on 6.2 .220 kernel with same cmdline.  Happens consistently on .262
Comment 5 John W. Linville 2012-04-26 16:42:35 UTC 
Wey-yi, the RHEL 6.3 kernel is hitting a problem in the iwl_tx_cmd_complete path, leading to a problem unmapping some memory.  The code is more-or-less identical to what was available in the upstream 3.2 kernels.

Does this sound like a familiar issue?  Do you have any suggestions for where to look?
Comment 6 John W. Linville 2012-04-30 17:23:51 UTC 
http://marc.info/?l=linux-wireless&m=133580639402395&w=2
Comment 7 John W. Linville 2012-05-01 17:20:30 UTC 
Created attachment 581432 [details]
0001-iwlwifi-fix-a-potential-race-in-receive-buffer-alloc.patch

Patch from upstream email thread...
Comment 9 John W. Linville 2012-05-01 17:37:58 UTC 
Alex, I am making some test kernels available to you.  Please attempt to recreate the issue with those kernels and post the results here...thanks!
Comment 12 Alex Williamson 2012-05-01 21:13:09 UTC 
(In reply to comment #9)
> Alex, I am making some test kernels available to you.  Please attempt to
> recreate the issue with those kernels and post the results here...thanks!

Does not fix it:

------------[ cut here ]------------
WARNING: at drivers/pci/intel-iommu.c:2775 intel_unmap_page+0x15f/0x180() (Not tainted)
Hardware name: 3680B45
Driver unmaps unmatched page at PFN 0
Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf ipv6 ext3 jbd sha256_generic aesni_intel cryptd aes_x86_64 aes_generic cbc dm_crypt vhost_net macvtap macvlan tun kvm_intel kvm uinput thinkpad_acpi arc4 iwlwifi mac80211 cfg80211 sg btusb bluetooth rfkill uvcvideo videodev v4l2_compat_ioctl32 microcode intel_ips i2c_i801 iTCO_wdt iTCO_vendor_support snd_hda_codec_hdmi snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc shpchp e1000e ext4 mbcache jbd2 sd_mod crc_t10dif ahci wmi i915 drm_kms_helper drm i2c_algo_bit i2c_core video output dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
Pid: 0, comm: swapper Not tainted 2.6.32-268.el6.bz815998.1.x86_64 #1
Call Trace:
 <IRQ>  [<ffffffff8106b6b7>] ? warn_slowpath_common+0x87/0xc0
 [<ffffffff8106b7a6>] ? warn_slowpath_fmt+0x46/0x50
 [<ffffffff812a7f7b>] ? find_iova+0x5b/0xa0
 [<ffffffff812ac26f>] ? intel_unmap_page+0x15f/0x180
 [<ffffffffa03d47d3>] ? iwlagn_unmap_tfd+0x73/0x140 [iwlwifi]
 [<ffffffffa03d4b14>] ? iwl_tx_cmd_complete+0xf4/0x3c0 [iwlwifi]
 [<ffffffff81053363>] ? __wake_up+0x53/0x70
 [<ffffffffa03d3a0f>] ? iwl_irq_tasklet+0x20f/0x900 [iwlwifi]
 [<ffffffff81074245>] ? tasklet_action+0xe5/0x120
 [<ffffffff81073e31>] ? __do_softirq+0xc1/0x1e0
 [<ffffffff810db740>] ? handle_IRQ_event+0x60/0x170
 [<ffffffff81073e8f>] ? __do_softirq+0x11f/0x1e0
 [<ffffffff8100c24c>] ? call_softirq+0x1c/0x30
 [<ffffffff8100de85>] ? do_softirq+0x65/0xa0
 [<ffffffff81073c15>] ? irq_exit+0x85/0x90
 [<ffffffff815053e5>] ? do_IRQ+0x75/0xf0
 [<ffffffff8100ba53>] ? ret_from_intr+0x0/0x11
 <EOI>  [<ffffffff812cd4ee>] ? intel_idle+0xde/0x170
 [<ffffffff812cd4d1>] ? intel_idle+0xc1/0x170
 [<ffffffff814071d7>] ? cpuidle_idle_call+0xa7/0x140
 [<ffffffff81009e06>] ? cpu_idle+0xb6/0x110
 [<ffffffff814f65d5>] ? start_secondary+0x22a/0x26d
---[ end trace 091a9df45a3aad96 ]---
Comment 13 John W. Linville 2012-05-02 13:27:29 UTC 
Thanks for the quick feedback!  I'll work another lead and get back to you.  In the meantime (from the upstream email thread)...

"Can you please re-run with debug=1 and send the whole log ?
This will give a better indication on when the issue occurs."
Comment 14 Alex Williamson 2012-05-02 14:17:01 UTC 
(In reply to comment #13)
> Thanks for the quick feedback!  I'll work another lead and get back to you.  In
> the meantime (from the upstream email thread)...
> 
> "Can you please re-run with debug=1 and send the whole log ?
> This will give a better indication on when the issue occurs."

afaict, there's no debug option on iwlwifi on rhel6.3beta, so I tested 3.3.4-1.fc14.x86_64 and don't see the warning there.
Comment 15 Alex Williamson 2012-05-02 14:17:30 UTC 
s/fc14/fc17/
Comment 16 John W. Linville 2012-05-02 15:12:16 UTC 
FWIW, it looks like you'll need to run the "debug" variant of the RHEL6 kernel for the debug option for iwlwifi to be available.
Comment 17 John W. Linville 2012-05-02 15:20:53 UTC 
Created attachment 581642 [details]
0001-iwlwifi-give-PCIe-its-own-lock.patch
Comment 18 Alex Williamson 2012-05-02 15:32:02 UTC 
Created attachment 581650 [details]
debug kernel dmesg with iwlwifi debug=1
Comment 19 John W. Linville 2012-05-02 15:45:21 UTC 
Test kernels w/ patch from comment 17 are building here:

   https://brewweb.devel.redhat.com/taskinfo?taskID=4367329

I'm not entirely convinced that the patch is relevant to this issue, but since it was mentioned in the thread from comment 6, I thought it was worth a follow-up...
Comment 20 Alex Williamson 2012-05-03 17:06:25 UTC 
(In reply to comment #19)
> Test kernels w/ patch from comment 17 are building here:
> 
>    https://brewweb.devel.redhat.com/taskinfo?taskID=4367329
> 
> I'm not entirely convinced that the patch is relevant to this issue, but since
> it was mentioned in the thread from comment 6, I thought it was worth a
> follow-up...

Nope, not fixed.  2.5.32-268.el6.bz815998.2 generates the same warning.
Comment 23 Stanislaw Gruszka 2012-05-12 16:40:27 UTC 
Created attachment 584047 [details]
0001-pci-dma-x86-use-include-linux-pci-dma.h.patch

This patch makes kernel-debug warning at check_unmap() gone, perhaps it fix also warning at intel_unmap_page(), but I'm not sure - iommu does not work on my laptop.

Test kernel with the patch is here:
https://brewweb.devel.redhat.com/taskinfo?taskID=4404944
Comment 27 Suzanne Logcher 2012-05-18 20:57:14 UTC 
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 31 mateusz.kijowski 2012-10-23 14:31:41 UTC 
I've been hit by this bug, but can't check what the resolution was since now the bug has "Status: CLOSED DUPLICATE of bug 827193" and bug 827193 seems to be private. Is it possible to get the resolution appended to this (public) bug?
Comment 32 Stanislaw Gruszka 2012-10-23 14:36:20 UTC 
Problem is fixed in kernel-2.6.32-298.el6
Comment 33 Enrique Trillo 2012-10-30 01:45:56 UTC 
Please, when the kernel-2.6.32-298.el6 will be released? I am installing in a HP Laptop 8760w and I am having the same WARNING with the kernel problem and I downloaded RHEL 6.3 x64 yesterday with kernel version 2.6.32-279.el6.x86_64.
Comment 34 Stanislaw Gruszka 2012-10-30 06:47:49 UTC 
With RHEL6.4 release. If you want that fix on earlier kernel version, you need to contact official RH support.
Comment 35 xset1980 2012-12-13 00:04:35 UTC 
Similar bug on CentOS 6.3:

kernel: 2.6.32-279.14.1.el6.i686
cmdline: kernel /boot/vmlinuz-2.6.32-279.14.1.el6.i686 ro root=UUID=de281b18-e31f-465a-be13-72a329485f44 rootfstype=ext4 rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=es_ES.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=la-latin1 crashkernel=0@0 audit=1 rdshell selinux=0 intel_iommu=on

Crash:

iwlwifi 0000:03:00.0: L1 Disabled; Enabling L0S
iwlwifi 0000:03:00.0: Radio type=0x1-0x2-0x0
------------[ cut here ]------------
WARNING: at drivers/pci/intel-iommu.c:2775 intel_unmap_page+0xe4/0x180() (Not tainted)
Hardware name: 6474ES3
Driver unmaps unmatched page at PFN 0
Modules linked in: ipv6 uinput btusb bluetooth thinkpad_acpi uvcvideo videodev sg microcode arc4 i2c_i801 iTCO_wdt iTCO_vendor_support iwlwifi mac80211 cfg80211 rfkill snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc e1000e ext4 mbcache jbd2 yenta_socket rsrc_nonstatic sd_mod crc_t10dif sr_mod cdrom wmi ahci i915 drm_kms_helper drm i2c_algo_bit i2c_core video output dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
Pid: 0, comm: swapper Not tainted 2.6.32-279.14.1.el6.i686 #1
Call Trace:
 [<c0455c51>] ? warn_slowpath_common+0x81/0xc0
 [<c062e294>] ? intel_unmap_page+0xe4/0x180
 [<c062e294>] ? intel_unmap_page+0xe4/0x180
 [<c0455d23>] ? warn_slowpath_fmt+0x33/0x40
 [<c062e294>] ? intel_unmap_page+0xe4/0x180
 [<c062e1b0>] ? intel_unmap_page+0x0/0x180
 [<f92ddf65>] ? iwlagn_unmap_tfd+0x65/0x140 [iwlwifi]
 [<f92de239>] ? iwl_tx_cmd_complete+0x99/0x350 [iwlwifi]
 [<c04403d2>] ? __wake_up+0x42/0x60
 [<f92dd392>] ? iwl_irq_tasklet+0x1f2/0x830 [iwlwifi]
 [<c047ac79>] ? hrtimer_get_next_event+0xe9/0x140
 [<c062e1b0>] ? intel_unmap_page+0x0/0x180
 [<c045d539>] ? tasklet_action+0xa9/0xe0
 [<c045cf8a>] ? __do_softirq+0x8a/0x1a0
 [<c04b8d71>] ? move_native_irq+0x11/0x50
 [<c045d0dd>] ? do_softirq+0x3d/0x50
 [<c045d235>] ? irq_exit+0x65/0x70
 [<c040b110>] ? do_IRQ+0x50/0xc0
 [<c040f608>] ? sched_clock+0x8/0x10
 [<c0409ff0>] ? common_interrupt+0x30/0x38
 [<c0670734>] ? acpi_idle_enter_bm+0x26b/0x29c
 [<c07671e2>] ? cpuidle_idle_call+0x72/0x100
 [<c0408964>] ? cpu_idle+0x94/0xd0
 [<f9257366>] ? ieee80211_rx_handlers_result+0xe6/0x220 [mac80211]
 [<c0aa79fc>] ? start_kernel+0x3b0/0x3b5
 [<c0aa748a>] ? unknown_bootoption+0x0/0x190
---[ end trace baf56102a77bacb0 ]---

Why can'nt view the bug #827193 ?
Note You need to log in before you can comment on or make changes to this bug.