wifi: brcmfmac: pcie: Provide a buffer of random bytes to the device

Newer Apple firmwares on chipsets without a hardware RNG require the
host to provide a buffer of 256 random bytes to the device on
initialization. This buffer is present immediately before NVRAM,
suffixed by a footer containing a magic number and the buffer length.

This won't affect chips/firmwares that do not use this feature, so do it
unconditionally for all Apple platforms (those with an Apple OTP).

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Hector Martin <marcan@marcan.st>
Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230214080034.3828-3-marcan@marcan.st

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index a9b9b2dc62d4fcec40f27346eda67d386fe8b07c..2835ef4edb18f0a7b21187c09e141b4fbb2eeeb8 100644 (file)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -15,6 +15,7 @@
 #include <linux/sched/signal.h>
 #include <linux/kthread.h>
 #include <linux/io.h>
+#include <linux/random.h>
 #include <asm/unaligned.h>
 
 #include <soc.h>
@@ -1653,6 +1654,13 @@ brcmf_pcie_init_share_ram_info(struct brcmf_pciedev_info *devinfo,
        return 0;
 }
 
+struct brcmf_random_seed_footer {
+       __le32 length;
+       __le32 magic;
+};
+
+#define BRCMF_RANDOM_SEED_MAGIC                0xfeedc0de
+#define BRCMF_RANDOM_SEED_LENGTH       0x100
 
 static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo,
                                        const struct firmware *fw, void *nvram,
@@ -1689,6 +1697,30 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo,
                          nvram_len;
                memcpy_toio(devinfo->tcm + address, nvram, nvram_len);
                brcmf_fw_nvram_free(nvram);
+
+               if (devinfo->otp.valid) {
+                       size_t rand_len = BRCMF_RANDOM_SEED_LENGTH;
+                       struct brcmf_random_seed_footer footer = {
+                               .length = cpu_to_le32(rand_len),
+                               .magic = cpu_to_le32(BRCMF_RANDOM_SEED_MAGIC),
+                       };
+                       void *randbuf;
+
+                       /* Some Apple chips/firmwares expect a buffer of random
+                        * data to be present before NVRAM
+                        */
+                       brcmf_dbg(PCIE, "Download random seed\n");
+
+                       address -= sizeof(footer);
+                       memcpy_toio(devinfo->tcm + address, &footer,
+                                   sizeof(footer));
+
+                       address -= rand_len;
+                       randbuf = kzalloc(rand_len, GFP_KERNEL);
+                       get_random_bytes(randbuf, rand_len);
+                       memcpy_toio(devinfo->tcm + address, randbuf, rand_len);
+                       kfree(randbuf);
+               }
        } else {
                brcmf_dbg(PCIE, "No matching NVRAM file found %s\n",
                          devinfo->nvram_name);