1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * Copyright (C) 2019 Intel Corporation. |
4 | * |
5 | * Authors: |
6 | * Ramalingam C <ramalingam.c@intel.com> |
7 | */ |
8 | |
9 | #include <linux/device.h> |
10 | #include <linux/err.h> |
11 | #include <linux/gfp.h> |
12 | #include <linux/export.h> |
13 | #include <linux/slab.h> |
14 | #include <linux/firmware.h> |
15 | |
16 | #include <drm/display/drm_hdcp_helper.h> |
17 | #include <drm/drm_sysfs.h> |
18 | #include <drm/drm_print.h> |
19 | #include <drm/drm_device.h> |
20 | #include <drm/drm_property.h> |
21 | #include <drm/drm_mode_object.h> |
22 | #include <drm/drm_connector.h> |
23 | |
24 | static inline void drm_hdcp_print_ksv(const u8 *ksv) |
25 | { |
26 | DRM_DEBUG("\t%#02x, %#02x, %#02x, %#02x, %#02x\n" , |
27 | ksv[0], ksv[1], ksv[2], ksv[3], ksv[4]); |
28 | } |
29 | |
30 | static u32 drm_hdcp_get_revoked_ksv_count(const u8 *buf, u32 vrls_length) |
31 | { |
32 | u32 parsed_bytes = 0, ksv_count = 0, vrl_ksv_cnt, vrl_sz; |
33 | |
34 | while (parsed_bytes < vrls_length) { |
35 | vrl_ksv_cnt = *buf; |
36 | ksv_count += vrl_ksv_cnt; |
37 | |
38 | vrl_sz = (vrl_ksv_cnt * DRM_HDCP_KSV_LEN) + 1; |
39 | buf += vrl_sz; |
40 | parsed_bytes += vrl_sz; |
41 | } |
42 | |
43 | /* |
44 | * When vrls are not valid, ksvs are not considered. |
45 | * Hence SRM will be discarded. |
46 | */ |
47 | if (parsed_bytes != vrls_length) |
48 | ksv_count = 0; |
49 | |
50 | return ksv_count; |
51 | } |
52 | |
53 | static u32 drm_hdcp_get_revoked_ksvs(const u8 *buf, u8 **revoked_ksv_list, |
54 | u32 vrls_length) |
55 | { |
56 | u32 vrl_ksv_cnt, vrl_ksv_sz, vrl_idx = 0; |
57 | u32 parsed_bytes = 0, ksv_count = 0; |
58 | |
59 | do { |
60 | vrl_ksv_cnt = *buf; |
61 | vrl_ksv_sz = vrl_ksv_cnt * DRM_HDCP_KSV_LEN; |
62 | |
63 | buf++; |
64 | |
65 | DRM_DEBUG("vrl: %d, Revoked KSVs: %d\n" , vrl_idx++, |
66 | vrl_ksv_cnt); |
67 | memcpy((*revoked_ksv_list) + (ksv_count * DRM_HDCP_KSV_LEN), |
68 | buf, vrl_ksv_sz); |
69 | |
70 | ksv_count += vrl_ksv_cnt; |
71 | buf += vrl_ksv_sz; |
72 | |
73 | parsed_bytes += (vrl_ksv_sz + 1); |
74 | } while (parsed_bytes < vrls_length); |
75 | |
76 | return ksv_count; |
77 | } |
78 | |
79 | static inline u32 get_vrl_length(const u8 *buf) |
80 | { |
81 | return drm_hdcp_be24_to_cpu(seq_num: buf); |
82 | } |
83 | |
84 | static int drm_hdcp_parse_hdcp1_srm(const u8 *buf, size_t count, |
85 | u8 **revoked_ksv_list, u32 *revoked_ksv_cnt) |
86 | { |
87 | struct hdcp_srm_header *; |
88 | u32 vrl_length, ksv_count; |
89 | |
90 | if (count < (sizeof(struct hdcp_srm_header) + |
91 | DRM_HDCP_1_4_VRL_LENGTH_SIZE + DRM_HDCP_1_4_DCP_SIG_SIZE)) { |
92 | DRM_ERROR("Invalid blob length\n" ); |
93 | return -EINVAL; |
94 | } |
95 | |
96 | header = (struct hdcp_srm_header *)buf; |
97 | DRM_DEBUG("SRM ID: 0x%x, SRM Ver: 0x%x, SRM Gen No: 0x%x\n" , |
98 | header->srm_id, |
99 | be16_to_cpu(header->srm_version), header->srm_gen_no); |
100 | |
101 | WARN_ON(header->reserved); |
102 | |
103 | buf = buf + sizeof(*header); |
104 | vrl_length = get_vrl_length(buf); |
105 | if (count < (sizeof(struct hdcp_srm_header) + vrl_length) || |
106 | vrl_length < (DRM_HDCP_1_4_VRL_LENGTH_SIZE + |
107 | DRM_HDCP_1_4_DCP_SIG_SIZE)) { |
108 | DRM_ERROR("Invalid blob length or vrl length\n" ); |
109 | return -EINVAL; |
110 | } |
111 | |
112 | /* Length of the all vrls combined */ |
113 | vrl_length -= (DRM_HDCP_1_4_VRL_LENGTH_SIZE + |
114 | DRM_HDCP_1_4_DCP_SIG_SIZE); |
115 | |
116 | if (!vrl_length) { |
117 | DRM_ERROR("No vrl found\n" ); |
118 | return -EINVAL; |
119 | } |
120 | |
121 | buf += DRM_HDCP_1_4_VRL_LENGTH_SIZE; |
122 | ksv_count = drm_hdcp_get_revoked_ksv_count(buf, vrls_length: vrl_length); |
123 | if (!ksv_count) { |
124 | DRM_DEBUG("Revoked KSV count is 0\n" ); |
125 | return 0; |
126 | } |
127 | |
128 | *revoked_ksv_list = kcalloc(n: ksv_count, DRM_HDCP_KSV_LEN, GFP_KERNEL); |
129 | if (!*revoked_ksv_list) { |
130 | DRM_ERROR("Out of Memory\n" ); |
131 | return -ENOMEM; |
132 | } |
133 | |
134 | if (drm_hdcp_get_revoked_ksvs(buf, revoked_ksv_list, |
135 | vrls_length: vrl_length) != ksv_count) { |
136 | *revoked_ksv_cnt = 0; |
137 | kfree(objp: *revoked_ksv_list); |
138 | return -EINVAL; |
139 | } |
140 | |
141 | *revoked_ksv_cnt = ksv_count; |
142 | return 0; |
143 | } |
144 | |
145 | static int drm_hdcp_parse_hdcp2_srm(const u8 *buf, size_t count, |
146 | u8 **revoked_ksv_list, u32 *revoked_ksv_cnt) |
147 | { |
148 | struct hdcp_srm_header *; |
149 | u32 vrl_length, ksv_count, ksv_sz; |
150 | |
151 | if (count < (sizeof(struct hdcp_srm_header) + |
152 | DRM_HDCP_2_VRL_LENGTH_SIZE + DRM_HDCP_2_DCP_SIG_SIZE)) { |
153 | DRM_ERROR("Invalid blob length\n" ); |
154 | return -EINVAL; |
155 | } |
156 | |
157 | header = (struct hdcp_srm_header *)buf; |
158 | DRM_DEBUG("SRM ID: 0x%x, SRM Ver: 0x%x, SRM Gen No: 0x%x\n" , |
159 | header->srm_id & DRM_HDCP_SRM_ID_MASK, |
160 | be16_to_cpu(header->srm_version), header->srm_gen_no); |
161 | |
162 | if (header->reserved) |
163 | return -EINVAL; |
164 | |
165 | buf = buf + sizeof(*header); |
166 | vrl_length = get_vrl_length(buf); |
167 | |
168 | if (count < (sizeof(struct hdcp_srm_header) + vrl_length) || |
169 | vrl_length < (DRM_HDCP_2_VRL_LENGTH_SIZE + |
170 | DRM_HDCP_2_DCP_SIG_SIZE)) { |
171 | DRM_ERROR("Invalid blob length or vrl length\n" ); |
172 | return -EINVAL; |
173 | } |
174 | |
175 | /* Length of the all vrls combined */ |
176 | vrl_length -= (DRM_HDCP_2_VRL_LENGTH_SIZE + |
177 | DRM_HDCP_2_DCP_SIG_SIZE); |
178 | |
179 | if (!vrl_length) { |
180 | DRM_ERROR("No vrl found\n" ); |
181 | return -EINVAL; |
182 | } |
183 | |
184 | buf += DRM_HDCP_2_VRL_LENGTH_SIZE; |
185 | ksv_count = (*buf << 2) | DRM_HDCP_2_KSV_COUNT_2_LSBITS(*(buf + 1)); |
186 | if (!ksv_count) { |
187 | DRM_DEBUG("Revoked KSV count is 0\n" ); |
188 | return 0; |
189 | } |
190 | |
191 | *revoked_ksv_list = kcalloc(n: ksv_count, DRM_HDCP_KSV_LEN, GFP_KERNEL); |
192 | if (!*revoked_ksv_list) { |
193 | DRM_ERROR("Out of Memory\n" ); |
194 | return -ENOMEM; |
195 | } |
196 | |
197 | ksv_sz = ksv_count * DRM_HDCP_KSV_LEN; |
198 | buf += DRM_HDCP_2_NO_OF_DEV_PLUS_RESERVED_SZ; |
199 | |
200 | DRM_DEBUG("Revoked KSVs: %d\n" , ksv_count); |
201 | memcpy(*revoked_ksv_list, buf, ksv_sz); |
202 | |
203 | *revoked_ksv_cnt = ksv_count; |
204 | return 0; |
205 | } |
206 | |
207 | static inline bool is_srm_version_hdcp1(const u8 *buf) |
208 | { |
209 | return *buf == (u8)(DRM_HDCP_1_4_SRM_ID << 4); |
210 | } |
211 | |
212 | static inline bool is_srm_version_hdcp2(const u8 *buf) |
213 | { |
214 | return *buf == (u8)(DRM_HDCP_2_SRM_ID << 4 | DRM_HDCP_2_INDICATOR); |
215 | } |
216 | |
217 | static int drm_hdcp_srm_update(const u8 *buf, size_t count, |
218 | u8 **revoked_ksv_list, u32 *revoked_ksv_cnt) |
219 | { |
220 | if (count < sizeof(struct hdcp_srm_header)) |
221 | return -EINVAL; |
222 | |
223 | if (is_srm_version_hdcp1(buf)) |
224 | return drm_hdcp_parse_hdcp1_srm(buf, count, revoked_ksv_list, |
225 | revoked_ksv_cnt); |
226 | else if (is_srm_version_hdcp2(buf)) |
227 | return drm_hdcp_parse_hdcp2_srm(buf, count, revoked_ksv_list, |
228 | revoked_ksv_cnt); |
229 | else |
230 | return -EINVAL; |
231 | } |
232 | |
233 | static int drm_hdcp_request_srm(struct drm_device *drm_dev, |
234 | u8 **revoked_ksv_list, u32 *revoked_ksv_cnt) |
235 | { |
236 | char fw_name[36] = "display_hdcp_srm.bin" ; |
237 | const struct firmware *fw; |
238 | int ret; |
239 | |
240 | ret = request_firmware_direct(fw: &fw, name: (const char *)fw_name, |
241 | device: drm_dev->dev); |
242 | if (ret < 0) { |
243 | *revoked_ksv_cnt = 0; |
244 | *revoked_ksv_list = NULL; |
245 | ret = 0; |
246 | goto exit; |
247 | } |
248 | |
249 | if (fw->size && fw->data) |
250 | ret = drm_hdcp_srm_update(buf: fw->data, count: fw->size, revoked_ksv_list, |
251 | revoked_ksv_cnt); |
252 | |
253 | exit: |
254 | release_firmware(fw); |
255 | return ret; |
256 | } |
257 | |
258 | /** |
259 | * drm_hdcp_check_ksvs_revoked - Check the revoked status of the IDs |
260 | * |
261 | * @drm_dev: drm_device for which HDCP revocation check is requested |
262 | * @ksvs: List of KSVs (HDCP receiver IDs) |
263 | * @ksv_count: KSV count passed in through @ksvs |
264 | * |
265 | * This function reads the HDCP System renewability Message(SRM Table) |
266 | * from userspace as a firmware and parses it for the revoked HDCP |
267 | * KSVs(Receiver IDs) detected by DCP LLC. Once the revoked KSVs are known, |
268 | * revoked state of the KSVs in the list passed in by display drivers are |
269 | * decided and response is sent. |
270 | * |
271 | * SRM should be presented in the name of "display_hdcp_srm.bin". |
272 | * |
273 | * Format of the SRM table, that userspace needs to write into the binary file, |
274 | * is defined at: |
275 | * 1. Renewability chapter on 55th page of HDCP 1.4 specification |
276 | * https://www.digital-cp.com/sites/default/files/specifications/HDCP%20Specification%20Rev1_4_Secure.pdf |
277 | * 2. Renewability chapter on 63rd page of HDCP 2.2 specification |
278 | * https://www.digital-cp.com/sites/default/files/specifications/HDCP%20on%20HDMI%20Specification%20Rev2_2_Final1.pdf |
279 | * |
280 | * Returns: |
281 | * Count of the revoked KSVs or -ve error number in case of the failure. |
282 | */ |
283 | int drm_hdcp_check_ksvs_revoked(struct drm_device *drm_dev, u8 *ksvs, |
284 | u32 ksv_count) |
285 | { |
286 | u32 revoked_ksv_cnt = 0, i, j; |
287 | u8 *revoked_ksv_list = NULL; |
288 | int ret = 0; |
289 | |
290 | ret = drm_hdcp_request_srm(drm_dev, revoked_ksv_list: &revoked_ksv_list, |
291 | revoked_ksv_cnt: &revoked_ksv_cnt); |
292 | if (ret) |
293 | return ret; |
294 | |
295 | /* revoked_ksv_cnt will be zero when above function failed */ |
296 | for (i = 0; i < revoked_ksv_cnt; i++) |
297 | for (j = 0; j < ksv_count; j++) |
298 | if (!memcmp(p: &ksvs[j * DRM_HDCP_KSV_LEN], |
299 | q: &revoked_ksv_list[i * DRM_HDCP_KSV_LEN], |
300 | DRM_HDCP_KSV_LEN)) { |
301 | DRM_DEBUG("Revoked KSV is " ); |
302 | drm_hdcp_print_ksv(ksv: &ksvs[j * DRM_HDCP_KSV_LEN]); |
303 | ret++; |
304 | } |
305 | |
306 | kfree(objp: revoked_ksv_list); |
307 | return ret; |
308 | } |
309 | EXPORT_SYMBOL_GPL(drm_hdcp_check_ksvs_revoked); |
310 | |
311 | static struct drm_prop_enum_list drm_cp_enum_list[] = { |
312 | { DRM_MODE_CONTENT_PROTECTION_UNDESIRED, "Undesired" }, |
313 | { DRM_MODE_CONTENT_PROTECTION_DESIRED, "Desired" }, |
314 | { DRM_MODE_CONTENT_PROTECTION_ENABLED, "Enabled" }, |
315 | }; |
316 | DRM_ENUM_NAME_FN(drm_get_content_protection_name, drm_cp_enum_list) |
317 | |
318 | static struct drm_prop_enum_list drm_hdcp_content_type_enum_list[] = { |
319 | { DRM_MODE_HDCP_CONTENT_TYPE0, "HDCP Type0" }, |
320 | { DRM_MODE_HDCP_CONTENT_TYPE1, "HDCP Type1" }, |
321 | }; |
322 | DRM_ENUM_NAME_FN(drm_get_hdcp_content_type_name, |
323 | drm_hdcp_content_type_enum_list) |
324 | |
325 | /** |
326 | * drm_connector_attach_content_protection_property - attach content protection |
327 | * property |
328 | * |
329 | * @connector: connector to attach CP property on. |
330 | * @hdcp_content_type: is HDCP Content Type property needed for connector |
331 | * |
332 | * This is used to add support for content protection on select connectors. |
333 | * Content Protection is intentionally vague to allow for different underlying |
334 | * technologies, however it is most implemented by HDCP. |
335 | * |
336 | * When hdcp_content_type is true enum property called HDCP Content Type is |
337 | * created (if it is not already) and attached to the connector. |
338 | * |
339 | * This property is used for sending the protected content's stream type |
340 | * from userspace to kernel on selected connectors. Protected content provider |
341 | * will decide their type of their content and declare the same to kernel. |
342 | * |
343 | * Content type will be used during the HDCP 2.2 authentication. |
344 | * Content type will be set to &drm_connector_state.hdcp_content_type. |
345 | * |
346 | * The content protection will be set to &drm_connector_state.content_protection |
347 | * |
348 | * When kernel triggered content protection state change like DESIRED->ENABLED |
349 | * and ENABLED->DESIRED, will use drm_hdcp_update_content_protection() to update |
350 | * the content protection state of a connector. |
351 | * |
352 | * Returns: |
353 | * Zero on success, negative errno on failure. |
354 | */ |
355 | int drm_connector_attach_content_protection_property( |
356 | struct drm_connector *connector, bool hdcp_content_type) |
357 | { |
358 | struct drm_device *dev = connector->dev; |
359 | struct drm_property *prop = |
360 | dev->mode_config.content_protection_property; |
361 | |
362 | if (!prop) |
363 | prop = drm_property_create_enum(dev, flags: 0, name: "Content Protection" , |
364 | props: drm_cp_enum_list, |
365 | ARRAY_SIZE(drm_cp_enum_list)); |
366 | if (!prop) |
367 | return -ENOMEM; |
368 | |
369 | drm_object_attach_property(obj: &connector->base, property: prop, |
370 | DRM_MODE_CONTENT_PROTECTION_UNDESIRED); |
371 | dev->mode_config.content_protection_property = prop; |
372 | |
373 | if (!hdcp_content_type) |
374 | return 0; |
375 | |
376 | prop = dev->mode_config.hdcp_content_type_property; |
377 | if (!prop) |
378 | prop = drm_property_create_enum(dev, flags: 0, name: "HDCP Content Type" , |
379 | props: drm_hdcp_content_type_enum_list, |
380 | ARRAY_SIZE( |
381 | drm_hdcp_content_type_enum_list)); |
382 | if (!prop) |
383 | return -ENOMEM; |
384 | |
385 | drm_object_attach_property(obj: &connector->base, property: prop, |
386 | DRM_MODE_HDCP_CONTENT_TYPE0); |
387 | dev->mode_config.hdcp_content_type_property = prop; |
388 | |
389 | return 0; |
390 | } |
391 | EXPORT_SYMBOL(drm_connector_attach_content_protection_property); |
392 | |
393 | /** |
394 | * drm_hdcp_update_content_protection - Updates the content protection state |
395 | * of a connector |
396 | * |
397 | * @connector: drm_connector on which content protection state needs an update |
398 | * @val: New state of the content protection property |
399 | * |
400 | * This function can be used by display drivers, to update the kernel triggered |
401 | * content protection state changes of a drm_connector such as DESIRED->ENABLED |
402 | * and ENABLED->DESIRED. No uevent for DESIRED->UNDESIRED or ENABLED->UNDESIRED, |
403 | * as userspace is triggering such state change and kernel performs it without |
404 | * fail.This function update the new state of the property into the connector's |
405 | * state and generate an uevent to notify the userspace. |
406 | */ |
407 | void drm_hdcp_update_content_protection(struct drm_connector *connector, |
408 | u64 val) |
409 | { |
410 | struct drm_device *dev = connector->dev; |
411 | struct drm_connector_state *state = connector->state; |
412 | |
413 | WARN_ON(!drm_modeset_is_locked(&dev->mode_config.connection_mutex)); |
414 | if (state->content_protection == val) |
415 | return; |
416 | |
417 | state->content_protection = val; |
418 | drm_sysfs_connector_property_event(connector, |
419 | property: dev->mode_config.content_protection_property); |
420 | } |
421 | EXPORT_SYMBOL(drm_hdcp_update_content_protection); |
422 | |