[PATCH ath-current v3] wifi: ath12k: fix DMA direction for re-injected Rx buffers

[Baochen Qiang]

On 10/24/2026 12:49 AM, Lorenzo Bianconi wrote:
> Defragmented MPDUs that are re-injected into the REO are mapped with
> DMA_TO_DEVICE, but all the Rx reap and teardown paths unmap them with
> DMA_FROM_DEVICE. The DMA API requires the unmap direction to match the
> map direction, so this violates the contract.
> 
> The mapping actually spans both directions, since the host has written
> the buffer before the REO reads it and the buffer is read back by the
> host afterwards, so DMA_BIDIRECTIONAL is the correct choice.
> 
> Add a common ath12k_dp_unmap_rx_buf() helper that selects
> DMA_BIDIRECTIONAL for re-injected buffers, identified by the existing
> ath12k_skb_rxcb::is_frag flag, and DMA_FROM_DEVICE otherwise, then use it
> in all the Rx reap and cleanup paths. Map and unmap the re-injected buffer
> with DMA_BIDIRECTIONAL consistently.
> 
> Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
> 
> Fixes: 33322e3ef074 ("wifi: ath12k: change DMA direction while mapping reinjected packets")
> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi at oss.qualcomm.com>

Back in the ath11k days I tested the DMA_TO_DEVICE change (86a03dad0f5a) and
did not see any DMA API warning about the direction mismatch on unmap, but
most likely CONFIG_DMA_API_DEBUG was simply not enabled in my build.

Functionally, re-injection on ath11k has been working fine with
DMA_TO_DEVICE, so my guess is that hardware/firmware does not touch the frame
payload after the re-injection, which is why DMA_TO_DEVICE happens to work.

Still, the buffer is written by the host before the REO reads it and read
back by the host afterwards, and map/unmap must use the same direction, so
DMA_BIDIRECTIONAL is the right fix here.

Reviewed-by: Baochen Qiang <baochen.qiang at oss.qualcomm.com>