DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org A354A606B1DB
Received-SPF: pass (mail2.incublab.at: connection is authenticated)
Message-ID: <b010a7fa-73ea-43fa-a020-c2ea706295dd@itsolution.at>
Date: Fri, 13 Nov 2026 09:39:23 +0100
Precedence: list
MIME-Version: 1.0
User-Agent: Betterbird (Linux)
Content-Language: en-US, de-AT
To: linux-wireless@vger.kernel.org, brcm80211@lists.linux.dev
Cc: iommu@lists.linux.dev, regressions@lists.linux.dev
From: Argishti KHACHIK <argishti.khachik@itsolution.at>
Subject: [REGRESSION] brcmfmac BCM43602: DMAR read faults and firmware
 timeouts on 7.3.3 with intel_iommu=on, works on 7.2.14 / with iommu=pt
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hi,

since updating from 7.2.14 to 7.3.3 (Fedora 44 kernels), the
BCM43602 Wi-Fi in my Dell XPS 15 9550 is unusable when the Intel
IOMMU is in translation mode. Booting with iommu=pt fixes it.

Hardware: Dell XPS 15 9550, BIOS 1.14.0 02/13/2020
Device:   Broadcom BCM43602 [14e4:43ba], PCIe, brcmfmac (msgbuf)
Firmware: BCM43602/1 wl0: Nov 10 2015 06:38:10 version 7.35.177.61
           (r598657) FWID 01-ea662a8c (linux-firmware)
Cmdline:  ... intel_iommu=on

Results:
- 7.2.14-200.fc44.x86_64:            works
- 7.3.3-200.fc44.x86_64:             broken
- 7.3.3-200.fc44.x86_64 + iommu=pt:  works

Userspace and firmware are identical in all three cases.

The firmware loads fine, then a few seconds later the IOMMU
rejects DMA reads from the card:

   brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43602/1 wl0: Nov 10 
2015 06:38:10 version 7.35.177.61 (r598657) FWID 01-ea662a8c
   brcmfmac 0000:02:00.0 wlp2s0: renamed from wlan0
   DMAR: DRHD: handling fault status reg 2
   DMAR: [DMA Read NO_PASID] Request device [0000:02:00.0] fault addr 
0xfff83000 [fault reason 0x06] PTE Read access is not set
   DMAR: [DMA Read NO_PASID] Request device [0000:02:00.0] fault addr 
0xfff80000 [fault reason 0x06] PTE Read access is not set
   DMAR: [DMA Read NO_PASID] Request device [0000:02:00.0] fault addr 
0xfff7e000 [fault reason 0x06] PTE Read access is not set

After that, every firmware command times out:

   ieee80211 phy0: brcmf_msgbuf_query_dcmd: Timeout on response for 
query command
   ieee80211 phy0: brcmf_cfg80211_get_channel: chanspec failed (-5)
   ieee80211 phy0: brcmf_run_escan: error (-5)
   ieee80211 phy0: brcmf_set_wsec: failed to change PSK in firmware (len=0)

and after about two minutes the command ring is full:

   ieee80211 phy0: brcmf_msgbuf_tx_ioctl: Failed to reserve space in 
commonring
   ieee80211 phy0: brcmf_run_escan: error (-12)

Unloading and reloading brcmfmac reproduces the same DMAR faults
right after the firmware loads again.

User-visible effect: networks show up briefly, connecting never
completes, then the scan list goes empty. Boot is noticeably slower.

I can provide the full kernel log, test patches or bisect between
v7.2 and v7.3 if that helps.

#regzbot introduced: v7.2..v7.3

Thanks,
Argishti