Public bug reported:
[Disclosure]
This issue was diagnosed with the help of an AI assistant (Claude, by
Anthropic), which read the logs and the driver source and wrote this report.
The symptoms, counts and traces come from my machine. The root-cause analysis
is based on reading the source and has not been confirmed by testing, and the
suggested fix has not been built or run.
[Release]
Description: Ubuntu 26.04.1 LTS
Release: 26.04
[Package version]
linux-modules-iwlwifi-generic 7.0.0-38.38
linux-main-modules-iwlwifi-7.0.0-38-generic 7.0.0-38.38
(built from backport-iwlwifi-dkms 1:0~103.14434-gitdf6b5bf4)
Kernel: 7.0.0-38-generic
Module version: iwlwifi-stack-public:release/core103:14434:6861514a
[Hardware]
Intel Wireless-AC 9560 [8086:02f0] subsystem [8086:4234] (Comet Lake PCH-LP
CNVi), firmware QuZ-a0-jf-b0-77.ucode, op_mode iwlmvm.
Dell Inspiron 5491 2n1, BIOS 1.20.0.
Intel IOMMU enabled (default domain type: Translated).
[What I expected to happen]
Wi-Fi works without kernel warnings.
[What happened instead]
The kernel logs this warning about 1.5 times per second while Wi-Fi is
in use:
WARNING: drivers/iommu/dma-iommu.c:1243 at iommu_dma_unmap_phys+0xf2/0x100,
CPU#3: irq/145-iwlwifi/180796
Call Trace:
dma_unmap_phys+0x24a/0x340
dma_unmap_page_attrs+0x17/0x40
iwl_mvm_rx_mpdu_mq+0xe1b/0x1e20 [iwlmvm]
iwl_mvm_rx_mq_rss+0x57/0xb0 [iwlmvm]
iwl_pcie_rx_handle+0x464/0xc10 [iwlwifi]
iwl_pcie_napi_poll_msix+0x3c/0x100 [iwlwifi]
(full trace attached as iwlwifi-trace.txt)
I counted 548,605 occurrences in about 14.5 hours. /var/log/kern.log and
/var/log/syslog reached 5.4 GB each in that time.
One IOMMU fault from the Wi-Fi device was also logged, followed by an RX
queue sanity warning:
DMAR: [DMA Write NO_PASID] Request device [00:14.3] fault addr 0xfec23000
[fault reason 0x05] PTE Write access is not set
frame on invalid queue - is on 2 and indicates 5
WARNING: drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1343 at
iwl_pcie_rx_handle+0x54d/0xc10 [iwlwifi]
[Steps to reproduce]
1. On a machine with an Intel 9000-series (iwlmvm, pre-AX210) card and the
IOMMU enabled, install linux-modules-iwlwifi-generic and reboot.
2. Connect to a Wi-Fi network and generate some traffic.
3. Run: sudo dmesg | grep -c 'dma-iommu.c:1243'
[Regression]
Unknown. I do not know which version first showed it. The in-tree iwlwifi
driver of the same kernel (7.0.0-38) on the same machine does not produce the
warning.
[Analysis]
Introduced by the backport-only commit
"[BUGFIX] wifi: iwlwifi: pcie: allow not unmapping pages" (2025-08-10),
which added a deferred unmap in rxb_steal_page() (iwl-trans.h) for iwlmld.
In iwl_pcie_rx_handle_rb() (pcie/gen1_2/rx.c):
- "mapped" is declared once per RB, before the while loop.
- "rxcb" is re-initialised on every loop iteration with .dev = trans->dev.
- On the first frame the page is unmapped, mapped = false and
rxcb.dev = NULL.
- On the second and later frames in the same RB, rxcb.dev is trans->dev
again, and because "mapped" is already false the block that clears it is
skipped.
- iwlmvm then calls rxb_steal_page() (from iwl_mvm_create_skb(), inlined in
iwl_mvm_rx_mpdu_mq()), which sees r->dev != NULL and calls
dma_unmap_page() a second time on the same IOVA.
AX210 and newer break out of the loop after one frame, so only older devices
that pack several frames per RB are affected.
The same code is present unchanged in upstream backport-iwlwifi
release/core104 and release/core105. Mainline (v7.0 and master) does not have
the commit: it unmaps once in the transport and rxb_steal_page() does not
unmap.
[Suggested fix, untested]
--- a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c
@@ iwl_pcie_rx_handle_rb()
.truesize = max_len,
/* for unmap in rxb_steal_page() */
- .dev = trans->dev,
+ .dev = mapped ? trans->dev : NULL,
.page_dma = rxb->page_dma,
.map_len = max_len,
[Workaround]
Remove linux-modules-iwlwifi-generic and use the in-tree driver, or boot with
iommu.passthrough=1.
** Affects: backport-iwlwifi-dkms (Ubuntu)
Importance: Undecided
Status: New
** Summary changed:
- iwlwifi backport core103: double dma_unmap_page in RX path floods log with
WARNING at dma-iommu.c:1243 (iwlmvm, AC 9560)
+ iwlwifi backport core103: double DMA unmap in RX path floods kernel log
(iwlmvm, AC 9560)
** Description changed:
- ## Disclosure
+ [Disclosure]
This issue was diagnosed with the help of an AI assistant (Claude, by
Anthropic), which read the logs and the driver source and wrote this report.
The symptoms, counts and traces come from my machine. The root-cause analysis
is based on reading the source and has not been confirmed by testing, and the
suggested fix has not been built or run.
- ## Summary
+ [Release]
- With the backport iwlwifi stack (core103) on kernel 7.0, every RX buffer that
- carries more than one frame is DMA-unmapped twice on pre-AX210 (iwlmvm)
- devices. With the IOMMU enabled, each double unmap triggers
- `WARN_ON(!phys)` in `iommu_dma_unmap_phys()`. The warning is not rate limited,
- so the kernel log grows by several GB per day.
+ Description: Ubuntu 26.04.1 LTS
+ Release: 26.04
- ## System
+ [Package version]
- - Ubuntu 26.04.1 LTS, kernel 7.0.0-38-generic
- - Package: linux-main-modules-iwlwifi-7.0.0-38-generic 7.0.0-38.38
- (pulled in by linux-modules-iwlwifi-generic), built from
- backport-iwlwifi-dkms 1:0~103.14434-gitdf6b5bf4
- - Module version: iwlwifi-stack-public:release/core103:14434:6861514a
- - Device: Intel Wireless-AC 9560 [8086:02f0] subsystem [8086:4234]
- (Comet Lake PCH-LP CNVi), firmware QuZ-a0-jf-b0-77.ucode, op_mode iwlmvm
- - Machine: Dell Inspiron 5491 2n1, BIOS 1.20.0
- - Intel IOMMU enabled (default domain type: Translated, DMA-FQ)
+ linux-modules-iwlwifi-generic 7.0.0-38.38
+ linux-main-modules-iwlwifi-7.0.0-38-generic 7.0.0-38.38
+ (built from backport-iwlwifi-dkms 1:0~103.14434-gitdf6b5bf4)
+ Kernel: 7.0.0-38-generic
+ Module version: iwlwifi-stack-public:release/core103:14434:6861514a
- ## Symptoms
+ [Hardware]
- - 548,605 occurrences of the warning below in about 14.5 hours
- (roughly 1.5 per second under normal traffic).
- - /var/log/kern.log and /var/log/syslog reached 5.4 GB each in that time.
- - One IOMMU fault from the wifi device was also logged, followed by an
- RX queue sanity warning, which suggests the second unmap sometimes hits an
- IOVA that has already been reused:
+ Intel Wireless-AC 9560 [8086:02f0] subsystem [8086:4234] (Comet Lake PCH-LP
+ CNVi), firmware QuZ-a0-jf-b0-77.ucode, op_mode iwlmvm.
+ Dell Inspiron 5491 2n1, BIOS 1.20.0.
+ Intel IOMMU enabled (default domain type: Translated).
- DMAR: [DMA Write NO_PASID] Request device [00:14.3] fault addr
0xfec23000 [fault reason 0x05] PTE Write access is not set
- frame on invalid queue - is on 2 and indicates 5
- WARNING: drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1343 at
iwl_pcie_rx_handle+0x54d/0xc10 [iwlwifi]
+ [What I expected to happen]
- ## Trace
+ Wi-Fi works without kernel warnings.
- WARNING: drivers/iommu/dma-iommu.c:1243 at
iommu_dma_unmap_phys+0xf2/0x100, CPU#3: irq/145-iwlwifi/180796
- CPU: 3 UID: 0 PID: 180796 Comm: irq/145-iwlwifi Tainted: G W O
7.0.0-38-generic #38-Ubuntu PREEMPT(lazy)
- Tainted: [W]=WARN, [O]=OOT_MODULE
- Hardware name: Dell Inc. Inspiron 5491 2n1/0GJNK1, BIOS 1.20.0 08/10/2023
- RIP: 0010:iommu_dma_unmap_phys+0xf2/0x100
- Call Trace:
- <IRQ>
- dma_unmap_phys+0x24a/0x340
- dma_unmap_page_attrs+0x17/0x40
- iwl_mvm_rx_mpdu_mq+0xe1b/0x1e20 [iwlmvm]
- iwl_mvm_rx_mq_rss+0x57/0xb0 [iwlmvm]
- iwl_pcie_rx_handle+0x464/0xc10 [iwlwifi]
- iwl_pcie_napi_poll_msix+0x3c/0x100 [iwlwifi]
- __napi_poll+0x34/0x220
- net_rx_action+0x1d7/0x420
- handle_softirqs+0xe1/0x360
- __do_softirq+0x10/0x18
- do_softirq.part.0+0x3f/0x80
- </IRQ>
- <TASK>
- __local_bh_enable_ip+0x6a/0x70
- iwl_pcie_irq_rx_msix_handler+0xf9/0x220 [iwlwifi]
- irq_thread_fn+0x26/0x70
- irq_thread+0xbc/0x1c0
- kthread+0xf7/0x130
- ret_from_fork+0x195/0x2a0
- ret_from_fork_asm+0x1a/0x30
- </TASK>
+ [What happened instead]
- ## Analysis
+ The kernel logs this warning about 1.5 times per second while Wi-Fi is
+ in use:
+
+ WARNING: drivers/iommu/dma-iommu.c:1243 at iommu_dma_unmap_phys+0xf2/0x100,
CPU#3: irq/145-iwlwifi/180796
+ Call Trace:
+ dma_unmap_phys+0x24a/0x340
+ dma_unmap_page_attrs+0x17/0x40
+ iwl_mvm_rx_mpdu_mq+0xe1b/0x1e20 [iwlmvm]
+ iwl_mvm_rx_mq_rss+0x57/0xb0 [iwlmvm]
+ iwl_pcie_rx_handle+0x464/0xc10 [iwlwifi]
+ iwl_pcie_napi_poll_msix+0x3c/0x100 [iwlwifi]
+
+ (full trace attached as iwlwifi-trace.txt)
+
+ I counted 548,605 occurrences in about 14.5 hours. /var/log/kern.log and
+ /var/log/syslog reached 5.4 GB each in that time.
+
+ One IOMMU fault from the Wi-Fi device was also logged, followed by an RX
+ queue sanity warning:
+
+ DMAR: [DMA Write NO_PASID] Request device [00:14.3] fault addr 0xfec23000
[fault reason 0x05] PTE Write access is not set
+ frame on invalid queue - is on 2 and indicates 5
+ WARNING: drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c:1343 at
iwl_pcie_rx_handle+0x54d/0xc10 [iwlwifi]
+
+ [Steps to reproduce]
+
+ 1. On a machine with an Intel 9000-series (iwlmvm, pre-AX210) card and the
+ IOMMU enabled, install linux-modules-iwlwifi-generic and reboot.
+ 2. Connect to a Wi-Fi network and generate some traffic.
+ 3. Run: sudo dmesg | grep -c 'dma-iommu.c:1243'
+
+ [Regression]
+
+ Unknown. I do not know which version first showed it. The in-tree iwlwifi
+ driver of the same kernel (7.0.0-38) on the same machine does not produce the
+ warning.
+
+ [Analysis]
Introduced by the backport-only commit
"[BUGFIX] wifi: iwlwifi: pcie: allow not unmapping pages" (2025-08-10),
- which added a deferred unmap in `rxb_steal_page()` (iwl-trans.h) for iwlmld.
+ which added a deferred unmap in rxb_steal_page() (iwl-trans.h) for iwlmld.
- In `iwl_pcie_rx_handle_rb()` (pcie/gen1_2/rx.c):
+ In iwl_pcie_rx_handle_rb() (pcie/gen1_2/rx.c):
- - `mapped` is declared once per RB, before the `while` loop.
- - `rxcb` is re-initialised on every loop iteration with `.dev = trans->dev`.
- - On the first frame the page is unmapped, `mapped = false` and
- `rxcb.dev = NULL`.
- - On the second and later frames in the same RB, `rxcb.dev` is `trans->dev`
- again, and because `mapped` is already false the block that clears it is
+ - "mapped" is declared once per RB, before the while loop.
+ - "rxcb" is re-initialised on every loop iteration with .dev = trans->dev.
+ - On the first frame the page is unmapped, mapped = false and
+ rxcb.dev = NULL.
+ - On the second and later frames in the same RB, rxcb.dev is trans->dev
+ again, and because "mapped" is already false the block that clears it is
skipped.
- - iwlmvm then calls `rxb_steal_page()` (from `iwl_mvm_create_skb()`, inlined
- in `iwl_mvm_rx_mpdu_mq()`), which sees `r->dev != NULL` and calls
- `dma_unmap_page()` a second time on the same IOVA.
+ - iwlmvm then calls rxb_steal_page() (from iwl_mvm_create_skb(), inlined in
+ iwl_mvm_rx_mpdu_mq()), which sees r->dev != NULL and calls
+ dma_unmap_page() a second time on the same IOVA.
AX210 and newer break out of the loop after one frame, so only older devices
that pack several frames per RB are affected.
The same code is present unchanged in upstream backport-iwlwifi
release/core104 and release/core105. Mainline (v7.0 and master) does not have
- the commit: it unmaps once in the transport and `rxb_steal_page()` does not
- unmap. The in-tree 7.0.0-38 driver on the same machine produces no warnings.
+ the commit: it unmaps once in the transport and rxb_steal_page() does not
+ unmap.
- ## Suggested fix (untested)
+ [Suggested fix, untested]
- --- a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c
- +++ b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c
- @@ iwl_pcie_rx_handle_rb()
- .truesize = max_len,
- /* for unmap in rxb_steal_page() */
- - .dev = trans->dev,
- + .dev = mapped ? trans->dev : NULL,
- .page_dma = rxb->page_dma,
- .map_len = max_len,
+ --- a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c
+ +++ b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c
+ @@ iwl_pcie_rx_handle_rb()
+ .truesize = max_len,
+ /* for unmap in rxb_steal_page() */
+ - .dev = trans->dev,
+ + .dev = mapped ? trans->dev : NULL,
+ .page_dma = rxb->page_dma,
+ .map_len = max_len,
- ## Workaround
+ [Workaround]
Remove linux-modules-iwlwifi-generic and use the in-tree driver, or boot with
- `iommu.passthrough=1`.
+ iommu.passthrough=1.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169637
Title:
iwlwifi backport core103: double DMA unmap in RX path floods kernel
log (iwlmvm, AC 9560)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/backport-iwlwifi-dkms/+bug/2169637/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
