mac80211: brcm: backport remaining brcmfmac 5.2 patches
authorRafał Miłecki <rafal@milecki.pl>
Sun, 16 Jun 2019 16:56:15 +0000 (18:56 +0200)
committerRafał Miłecki <rafal@milecki.pl>
Sun, 16 Jun 2019 20:05:54 +0000 (22:05 +0200)
This improves FullMAC firmware compatibility, adds logging in case of
firmware crash and *may* fix "Invalid packet id" errors.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 8888cb725d492ad5cad5b59fc7117b006e1bba5a)

package/kernel/mac80211/patches/brcm/369-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch [new file with mode: 0644]
package/kernel/mac80211/patches/brcm/370-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch [new file with mode: 0644]
package/kernel/mac80211/patches/brcm/371-v5.2-Revert-brcmfmac-send-mailbox-interrupt-twice-for-spe.patch [new file with mode: 0644]
package/kernel/mac80211/patches/brcm/372-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch [new file with mode: 0644]
package/kernel/mac80211/patches/brcm/373-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch [new file with mode: 0644]
package/kernel/mac80211/patches/brcm/374-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch [new file with mode: 0644]
package/kernel/mac80211/patches/brcm/375-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch [new file with mode: 0644]
package/kernel/mac80211/patches/brcm/865-brcmfmac-get-RAM-info-right-before-downloading-PCIe-.patch

diff --git a/package/kernel/mac80211/patches/brcm/369-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch b/package/kernel/mac80211/patches/brcm/369-v5.2-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC-T8-a.patch
new file mode 100644 (file)
index 0000000..b0207d8
--- /dev/null
@@ -0,0 +1,70 @@
+From b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 22 Apr 2019 22:41:23 +0200
+Subject: [PATCH] brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11
+ mini PCs
+
+The ACEPC T8 and T11 mini PCs contain quite generic names in the sys_vendor
+and product_name DMI strings, without this patch brcmfmac will try to load:
+"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which
+is way too generic.
+
+The DMI strings on which we are matching are somewhat generic too, but
+"To be filled by O.E.M." is less common then "Default string" and the
+system-sku and bios-version strings are pretty unique. Beside the DMI
+strings we also check the wifi-module chip-id and revision. I'm confident
+that the combination of all this is unique.
+
+Both the T8 and T11 use the same wifi-module, this commit adds DMI
+quirks for both mini PCs pointing to brcmfmac43455-sdio.acepc-t8.txt .
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1690852
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/dmi.c         | 26 +++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+@@ -31,6 +31,10 @@ struct brcmf_dmi_data {
+ /* NOTE: Please keep all entries sorted alphabetically */
++static const struct brcmf_dmi_data acepc_t8_data = {
++      BRCM_CC_4345_CHIP_ID, 6, "acepc-t8"
++};
++
+ static const struct brcmf_dmi_data gpd_win_pocket_data = {
+       BRCM_CC_4356_CHIP_ID, 2, "gpd-win-pocket"
+ };
+@@ -49,6 +53,28 @@ static const struct brcmf_dmi_data pov_t
+ static const struct dmi_system_id dmi_platform_data[] = {
+       {
++              /* ACEPC T8 Cherry Trail Z8350 mini PC */
++              .matches = {
++                      DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++                      DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++                      DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"),
++                      /* also match on somewhat unique bios-version */
++                      DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++              },
++              .driver_data = (void *)&acepc_t8_data,
++      },
++      {
++              /* ACEPC T11 Cherry Trail Z8350 mini PC, same wifi as the T8 */
++              .matches = {
++                      DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++                      DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++                      DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T11"),
++                      /* also match on somewhat unique bios-version */
++                      DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++              },
++              .driver_data = (void *)&acepc_t8_data,
++      },
++      {
+               /* Match for the GPDwin which unfortunately uses somewhat
+                * generic dmi strings, which is why we test for 4 strings.
+                * Comparing against 23 other byt/cht boards, board_vendor
diff --git a/package/kernel/mac80211/patches/brcm/370-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch b/package/kernel/mac80211/patches/brcm/370-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch
new file mode 100644 (file)
index 0000000..c0a1fcd
--- /dev/null
@@ -0,0 +1,32 @@
+From 99d94ef367af67f630b38c93ff46c5819b7d06b6 Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Thu, 25 Apr 2019 07:05:46 +0000
+Subject: [PATCH] brcmfmac: send mailbox interrupt twice for specific hardware
+ device
+
+For PCIE wireless device with core revision less than 14, device may miss
+PCIE to System Backplane Interrupt via PCIEtoSBMailbox. So add sending
+mail box interrupt twice as a hardware workaround.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -698,7 +698,11 @@ brcmf_pcie_send_mb_data(struct brcmf_pci
+       brcmf_pcie_write_tcm32(devinfo, addr, htod_mb_data);
+       pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
+-      pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
++
++      /* Send mailbox interrupt twice as a hardware workaround */
++      core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2);
++      if (core->rev <= 13)
++              pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
+       return 0;
+ }
diff --git a/package/kernel/mac80211/patches/brcm/371-v5.2-Revert-brcmfmac-send-mailbox-interrupt-twice-for-spe.patch b/package/kernel/mac80211/patches/brcm/371-v5.2-Revert-brcmfmac-send-mailbox-interrupt-twice-for-spe.patch
new file mode 100644 (file)
index 0000000..8c7e6a8
--- /dev/null
@@ -0,0 +1,30 @@
+From 324f1feb960c79a07df3acde89a119a5aa80cb10 Mon Sep 17 00:00:00 2001
+From: Kalle Valo <kvalo@codeaurora.org>
+Date: Thu, 25 Apr 2019 20:08:31 +0300
+Subject: [PATCH] Revert "brcmfmac: send mailbox interrupt twice for specific
+ hardware device"
+
+This reverts commit 99d94ef367af67f630b38c93ff46c5819b7d06b6. I accidentally
+applied this broken (failed to compile) patch due to a bug in my patchwork
+script.
+
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -698,11 +698,7 @@ brcmf_pcie_send_mb_data(struct brcmf_pci
+       brcmf_pcie_write_tcm32(devinfo, addr, htod_mb_data);
+       pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
+-
+-      /* Send mailbox interrupt twice as a hardware workaround */
+-      core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2);
+-      if (core->rev <= 13)
+-              pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
++      pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
+       return 0;
+ }
diff --git a/package/kernel/mac80211/patches/brcm/372-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch b/package/kernel/mac80211/patches/brcm/372-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch
new file mode 100644 (file)
index 0000000..1fcf8c7
--- /dev/null
@@ -0,0 +1,39 @@
+From 9ef77fbedad9ea8895cd5d7fb7aee16071f527dc Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Fri, 26 Apr 2019 03:12:32 +0000
+Subject: [PATCH] brcmfmac: send mailbox interrupt twice for specific hardware
+ device
+
+For PCIE wireless device with core revision less than 14, device may miss
+PCIE to System Backplane Interrupt via PCIEtoSBMailbox. So add sending
+mail box interrupt twice as a hardware workaround.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -675,6 +675,7 @@ static int
+ brcmf_pcie_send_mb_data(struct brcmf_pciedev_info *devinfo, u32 htod_mb_data)
+ {
+       struct brcmf_pcie_shared_info *shared;
++      struct brcmf_core *core;
+       u32 addr;
+       u32 cur_htod_mb_data;
+       u32 i;
+@@ -698,7 +699,11 @@ brcmf_pcie_send_mb_data(struct brcmf_pci
+       brcmf_pcie_write_tcm32(devinfo, addr, htod_mb_data);
+       pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
+-      pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
++
++      /* Send mailbox interrupt twice as a hardware workaround */
++      core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2);
++      if (core->rev <= 13)
++              pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
+       return 0;
+ }
diff --git a/package/kernel/mac80211/patches/brcm/373-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch b/package/kernel/mac80211/patches/brcm/373-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch
new file mode 100644 (file)
index 0000000..b4d56c3
--- /dev/null
@@ -0,0 +1,50 @@
+From e025da3d7aa4770bb1d1b3b0aa7cc4da1744852d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 24 Apr 2019 12:52:18 +0300
+Subject: [PATCH] brcm80211: potential NULL dereference in
+ brcmf_cfg80211_vndr_cmds_dcmd_handler()
+
+If "ret_len" is negative then it could lead to a NULL dereference.
+
+The "ret_len" value comes from nl80211_vendor_cmd(), if it's negative
+then we don't allocate the "dcmd_buf" buffer.  Then we pass "ret_len" to
+brcmf_fil_cmd_data_set() where it is cast to a very high u32 value.
+Most of the functions in that call tree check whether the buffer we pass
+is NULL but there are at least a couple places which don't such as
+brcmf_dbg_hex_dump() and brcmf_msgbuf_query_dcmd().  We memcpy() to and
+from the buffer so it would result in a NULL dereference.
+
+The fix is to change the types so that "ret_len" can't be negative.  (If
+we memcpy() zero bytes to NULL, that's a no-op and doesn't cause an
+issue).
+
+Fixes: 1bacb0487d0e ("brcmfmac: replace cfg80211 testmode with vendor command")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
+@@ -35,9 +35,10 @@ static int brcmf_cfg80211_vndr_cmds_dcmd
+       struct brcmf_if *ifp;
+       const struct brcmf_vndr_dcmd_hdr *cmdhdr = data;
+       struct sk_buff *reply;
+-      int ret, payload, ret_len;
++      unsigned int payload, ret_len;
+       void *dcmd_buf = NULL, *wr_pointer;
+       u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
++      int ret;
+       if (len < sizeof(*cmdhdr)) {
+               brcmf_err("vendor command too short: %d\n", len);
+@@ -65,7 +66,7 @@ static int brcmf_cfg80211_vndr_cmds_dcmd
+                       brcmf_err("oversize return buffer %d\n", ret_len);
+                       ret_len = BRCMF_DCMD_MAXLEN;
+               }
+-              payload = max(ret_len, len) + 1;
++              payload = max_t(unsigned int, ret_len, len) + 1;
+               dcmd_buf = vzalloc(payload);
+               if (NULL == dcmd_buf)
+                       return -ENOMEM;
diff --git a/package/kernel/mac80211/patches/brcm/374-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch b/package/kernel/mac80211/patches/brcm/374-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch
new file mode 100644 (file)
index 0000000..6702dd5
--- /dev/null
@@ -0,0 +1,49 @@
+From 2d91c8ad068a5cad4d9e7ece8dc811a697c7176a Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Fri, 26 Apr 2019 03:41:46 +0000
+Subject: [PATCH] brcmfmac: set txflow request id from 1 to pktids array size
+
+Some PCIE firmwares drop txstatus if pktid is 0 and make packet held in
+host side and never be released. If that packet type is 802.1x, the
+pend_8021x_cnt value will be always greater than 0 and show "Timed out
+waiting for no pending 802.1x packets" error message when sending key to
+dongle every time.
+
+To be compatible with all firmwares, host should set txflow request id
+from 1 instead of from 0.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -375,7 +375,7 @@ brcmf_msgbuf_get_pktid(struct device *de
+       struct brcmf_msgbuf_pktid *pktid;
+       struct sk_buff *skb;
+-      if (idx >= pktids->array_size) {
++      if (idx < 0 || idx >= pktids->array_size) {
+               brcmf_err("Invalid packet id %d (max %d)\n", idx,
+                         pktids->array_size);
+               return NULL;
+@@ -747,7 +747,7 @@ static void brcmf_msgbuf_txflow(struct b
+               tx_msghdr = (struct msgbuf_tx_msghdr *)ret_ptr;
+               tx_msghdr->msg.msgtype = MSGBUF_TYPE_TX_POST;
+-              tx_msghdr->msg.request_id = cpu_to_le32(pktid);
++              tx_msghdr->msg.request_id = cpu_to_le32(pktid + 1);
+               tx_msghdr->msg.ifidx = brcmf_flowring_ifidx_get(flow, flowid);
+               tx_msghdr->flags = BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3;
+               tx_msghdr->flags |= (skb->priority & 0x07) <<
+@@ -884,7 +884,7 @@ brcmf_msgbuf_process_txstatus(struct brc
+       u16 flowid;
+       tx_status = (struct msgbuf_tx_status *)buf;
+-      idx = le32_to_cpu(tx_status->msg.request_id);
++      idx = le32_to_cpu(tx_status->msg.request_id) - 1;
+       flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
+       flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+       skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
diff --git a/package/kernel/mac80211/patches/brcm/375-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch b/package/kernel/mac80211/patches/brcm/375-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch
new file mode 100644 (file)
index 0000000..ceb8505
--- /dev/null
@@ -0,0 +1,90 @@
+From 47dd82e3d25e85a7c7c4e4b0eac9d297d1e5e2d4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 28 Apr 2019 23:38:26 +0200
+Subject: [PATCH] brcmfmac: print firmware messages after a firmware crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Normally firmware messages are printed with debugging enabled only. It's
+a good idea as firmware may print a lot of messages that normal users
+don't need to care about.
+
+However, on firmware crash, it may be very helpful to log all recent
+messages. There is almost always a backtrace available as well as rought
+info on the latest actions/state.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/pcie.c        | 24 ++++++++++++++-----
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -764,15 +764,22 @@ static void brcmf_pcie_bus_console_init(
+                 console->base_addr, console->buf_addr, console->bufsize);
+ }
+-
+-static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo)
++/**
++ * brcmf_pcie_bus_console_read - reads firmware messages
++ *
++ * @error: specifies if error has occurred (prints messages unconditionally)
++ */
++static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo,
++                                      bool error)
+ {
++      struct pci_dev *pdev = devinfo->pdev;
++      struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+       struct brcmf_pcie_console *console;
+       u32 addr;
+       u8 ch;
+       u32 newidx;
+-      if (!BRCMF_FWCON_ON())
++      if (!error && !BRCMF_FWCON_ON())
+               return;
+       console = &devinfo->shared.console;
+@@ -796,7 +803,10 @@ static void brcmf_pcie_bus_console_read(
+               }
+               if (ch == '\n') {
+                       console->log_str[console->log_idx] = 0;
+-                      pr_debug("CONSOLE: %s", console->log_str);
++                      if (error)
++                              brcmf_err(bus, "CONSOLE: %s", console->log_str);
++                      else
++                              pr_debug("CONSOLE: %s", console->log_str);
+                       console->log_idx = 0;
+               }
+       }
+@@ -857,7 +867,7 @@ static irqreturn_t brcmf_pcie_isr_thread
+                                                       &devinfo->pdev->dev);
+               }
+       }
+-      brcmf_pcie_bus_console_read(devinfo);
++      brcmf_pcie_bus_console_read(devinfo, false);
+       if (devinfo->state == BRCMFMAC_PCIE_STATE_UP)
+               brcmf_pcie_intr_enable(devinfo);
+       devinfo->in_irq = false;
+@@ -1426,6 +1436,8 @@ static int brcmf_pcie_reset(struct devic
+       struct brcmf_fw_request *fwreq;
+       int err;
++      brcmf_pcie_bus_console_read(devinfo, true);
++
+       brcmf_detach(dev);
+       brcmf_pcie_release_irq(devinfo);
+@@ -1818,7 +1830,7 @@ static void brcmf_pcie_setup(struct devi
+       if (brcmf_attach(&devinfo->pdev->dev, devinfo->settings) == 0)
+               return;
+-      brcmf_pcie_bus_console_read(devinfo);
++      brcmf_pcie_bus_console_read(devinfo, false);
+ fail:
+       device_release_driver(dev);
index 88b98073110a7d36f6ab6752d02763c2c84137a8..b2671564fda9c8c53bee6071b7194b04194f209c 100644 (file)
@@ -55,7 +55,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  void brcmf_chip_detach(struct brcmf_chip *chip);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
-@@ -1762,6 +1762,12 @@ static void brcmf_pcie_setup(struct devi
+@@ -1779,6 +1779,12 @@ static void brcmf_pcie_setup(struct devi
        nvram_len = fwreq->items[BRCMF_PCIE_FW_NVRAM].nv_data.len;
        kfree(fwreq);