From 7ed5dce55fa8393972b1bf2bf5af1c818c5e7dc2 Mon Sep 17 00:00:00 2001 From: Jason Perlow Date: Wed, 21 Oct 2026 22:52:38 +0530 Subject: [PATCH] wifi: brcmfmac: map msgbuf RX packet IDs bidirectional Commit f0ba5fd51ff2 ("wifi: brcmfmac: Set DMA direction for msgbuf packet IDs") maps the RX packet ID buffers DMA_FROM_DEVICE. The BCM4364 firmware also reads posted RX buffers, so with VT-d translation enabled every such read faults ("PTE Read access is not set") and the firmware crashes and resets in a loop. Map the RX pool DMA_BIDIRECTIONAL again, as before that commit. TX keeps DMA_TO_DEVICE. Fixes: f0ba5fd51ff2 ("wifi: brcmfmac: Set DMA direction for msgbuf packet IDs") Cc: stable@vger.kernel.org Signed-off-by: Jason Perlow Signed-off-by: Aditya Garg Acked-by: Arend van Spriel Link: https://patch.msgid.link/20261021172238.10004-1-aditya.garg@linux.dev Signed-off-by: Johannes Berg --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c index 069ba7016654..ff47d4827722 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c @@ -1639,7 +1639,7 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr) if (!msgbuf->tx_pktids) goto fail; msgbuf->rx_pktids = brcmf_msgbuf_init_pktids(NR_RX_PKTIDS, - DMA_FROM_DEVICE); + DMA_BIDIRECTIONAL); if (!msgbuf->rx_pktids) goto fail;