Re: intel-iommu: DMAR PTE Read fault crash-loops a PCIe wifi device, v7.3-rc7 -> v7.3 final regression, reproduces on one unit out of five tested

[Arend van Spriel <arend.vanspriel@broadcom.com>]

Please respond inline. No top posting.

On 21/10/2026 09:33, Jason Perlow wrote:
> Yes, done. rc7 with intel_iommu=on on the same MacBookPro16,1 shows
> the same fault: 95 DMAR faults, each followed by brcmf_fw_crashed, in
> one boot. So no rc7 -> final regression in the IOMMU code.
> 
> It is a v7.2 -> v7.3-rc1 regression in brcmfmac, from f0ba5fd51ff2
> ("wifi: brcmfmac: Set DMA direction for msgbuf packet IDs"). RX
> buffers are now mapped DMA_FROM_DEVICE (prot 0x6, no IOMMU_READ) and
> the BCM4364 firmware reads them:
> 
>    36.512689 map   iova=0xffeff2c0 size=2048 prot=0x6 (brcmf_msgbuf_rxbuf_data_post)
>    41.110125 DMAR: [DMA Read NO_PASID] Request device [0000:05:00.0] fault addr 0xffeff000 [fault reason 0x06] PTE Read access is not set
>    41.139317 brcmf_fw_crashed: Firmware has halted or crashed
> 
> The fault comes before the crash. Before that commit the direction
> stayed 0 (DMA_BIDIRECTIONAL).
> 
> Thanks for the pointer.

The only DMA related commit that I could think of was indeed the DMA 
direction change. Hope restoring DMA_BIDIRECTIONAL fixes it.

Regards,
Arend