drivers/gpu/drm/drm_hdcp.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Copyright (C) 2019 Intel Corporation.
   4  *
   5  * Authors:
   6  * Ramalingam C <ramalingam.c@intel.com>
   7  */
   8
   9 #include <linux/device.h>
  10 #include <linux/err.h>
  11 #include <linux/gfp.h>
  12 #include <linux/export.h>
  13 #include <linux/slab.h>
  14 #include <linux/firmware.h>
  15
  16 #include <drm/drm_hdcp.h>
  17 #include <drm/drm_sysfs.h>
  18 #include <drm/drm_print.h>
  19 #include <drm/drm_device.h>
  20 #include <drm/drm_property.h>
  21 #include <drm/drm_mode_object.h>
  22 #include <drm/drm_connector.h>
  23
  24 #include "drm_internal.h"
  25
  26 static struct hdcp_srm {
  27         u32 revoked_ksv_cnt;
  28         u8 *revoked_ksv_list;
  29
  30         /* Mutex to protect above struct member */
  31         struct mutex mutex;
  32 } *srm_data;
  33
  34 static inline void drm_hdcp_print_ksv(const u8 *ksv)
  35 {
  36         DRM_DEBUG("\t%#02x, %#02x, %#02x, %#02x, %#02x\n",
  37                   ksv[0], ksv[1], ksv[2], ksv[3], ksv[4]);
  38 }
  39
  40 static u32 drm_hdcp_get_revoked_ksv_count(const u8 *buf, u32 vrls_length)
  41 {
  42         u32 parsed_bytes = 0, ksv_count = 0, vrl_ksv_cnt, vrl_sz;
  43
  44         while (parsed_bytes < vrls_length) {
  45                 vrl_ksv_cnt = *buf;
  46                 ksv_count += vrl_ksv_cnt;
  47
  48                 vrl_sz = (vrl_ksv_cnt * DRM_HDCP_KSV_LEN) + 1;
  49                 buf += vrl_sz;
  50                 parsed_bytes += vrl_sz;
  51         }
  52
  53         /*
  54          * When vrls are not valid, ksvs are not considered.
  55          * Hence SRM will be discarded.
  56          */
  57         if (parsed_bytes != vrls_length)
  58                 ksv_count = 0;
  59
  60         return ksv_count;
  61 }
  62
  63 static u32 drm_hdcp_get_revoked_ksvs(const u8 *buf, u8 *revoked_ksv_list,
  64                                      u32 vrls_length)
  65 {
  66         u32 parsed_bytes = 0, ksv_count = 0;
  67         u32 vrl_ksv_cnt, vrl_ksv_sz, vrl_idx = 0;
  68
  69         do {
  70                 vrl_ksv_cnt = *buf;
  71                 vrl_ksv_sz = vrl_ksv_cnt * DRM_HDCP_KSV_LEN;
  72
  73                 buf++;
  74
  75                 DRM_DEBUG("vrl: %d, Revoked KSVs: %d\n", vrl_idx++,
  76                           vrl_ksv_cnt);
  77                 memcpy(revoked_ksv_list, buf, vrl_ksv_sz);
  78
  79                 ksv_count += vrl_ksv_cnt;
  80                 revoked_ksv_list += vrl_ksv_sz;
  81                 buf += vrl_ksv_sz;
  82
  83                 parsed_bytes += (vrl_ksv_sz + 1);
  84         } while (parsed_bytes < vrls_length);
  85
  86         return ksv_count;
  87 }
  88
  89 static inline u32 get_vrl_length(const u8 *buf)
  90 {
  91         return drm_hdcp_be24_to_cpu(buf);
  92 }
  93
  94 static int drm_hdcp_parse_hdcp1_srm(const u8 *buf, size_t count)
  95 {
  96         struct hdcp_srm_header *header;
  97         u32 vrl_length, ksv_count;
  98
  99         if (count < (sizeof(struct hdcp_srm_header) +
 100             DRM_HDCP_1_4_VRL_LENGTH_SIZE + DRM_HDCP_1_4_DCP_SIG_SIZE)) {
 101                 DRM_ERROR("Invalid blob length\n");
 102                 return -EINVAL;
 103         }
 104
 105         header = (struct hdcp_srm_header *)buf;
 106         DRM_DEBUG("SRM ID: 0x%x, SRM Ver: 0x%x, SRM Gen No: 0x%x\n",
 107                   header->srm_id,
 108                   be16_to_cpu(header->srm_version), header->srm_gen_no);
 109
 110         WARN_ON(header->reserved);
 111
 112         buf = buf + sizeof(*header);
 113         vrl_length = get_vrl_length(buf);
 114         if (count < (sizeof(struct hdcp_srm_header) + vrl_length) ||
 115             vrl_length < (DRM_HDCP_1_4_VRL_LENGTH_SIZE +
 116                           DRM_HDCP_1_4_DCP_SIG_SIZE)) {
 117                 DRM_ERROR("Invalid blob length or vrl length\n");
 118                 return -EINVAL;
 119         }
 120
 121         /* Length of the all vrls combined */
 122         vrl_length -= (DRM_HDCP_1_4_VRL_LENGTH_SIZE +
 123                        DRM_HDCP_1_4_DCP_SIG_SIZE);
 124
 125         if (!vrl_length) {
 126                 DRM_ERROR("No vrl found\n");
 127                 return -EINVAL;
 128         }
 129
 130         buf += DRM_HDCP_1_4_VRL_LENGTH_SIZE;
 131         ksv_count = drm_hdcp_get_revoked_ksv_count(buf, vrl_length);
 132         if (!ksv_count) {
 133                 DRM_DEBUG("Revoked KSV count is 0\n");
 134                 return count;
 135         }
 136
 137         kfree(srm_data->revoked_ksv_list);
 138         srm_data->revoked_ksv_list = kcalloc(ksv_count, DRM_HDCP_KSV_LEN,
 139                                              GFP_KERNEL);
 140         if (!srm_data->revoked_ksv_list) {
 141                 DRM_ERROR("Out of Memory\n");
 142                 return -ENOMEM;
 143         }
 144
 145         if (drm_hdcp_get_revoked_ksvs(buf, srm_data->revoked_ksv_list,
 146                                       vrl_length) != ksv_count) {
 147                 srm_data->revoked_ksv_cnt = 0;
 148                 kfree(srm_data->revoked_ksv_list);
 149                 return -EINVAL;
 150         }
 151
 152         srm_data->revoked_ksv_cnt = ksv_count;
 153         return count;
 154 }
 155
 156 static int drm_hdcp_parse_hdcp2_srm(const u8 *buf, size_t count)
 157 {
 158         struct hdcp_srm_header *header;
 159         u32 vrl_length, ksv_count, ksv_sz;
 160
 161         if (count < (sizeof(struct hdcp_srm_header) +
 162             DRM_HDCP_2_VRL_LENGTH_SIZE + DRM_HDCP_2_DCP_SIG_SIZE)) {
 163                 DRM_ERROR("Invalid blob length\n");
 164                 return -EINVAL;
 165         }
 166
 167         header = (struct hdcp_srm_header *)buf;
 168         DRM_DEBUG("SRM ID: 0x%x, SRM Ver: 0x%x, SRM Gen No: 0x%x\n",
 169                   header->srm_id & DRM_HDCP_SRM_ID_MASK,
 170                   be16_to_cpu(header->srm_version), header->srm_gen_no);
 171
 172         if (header->reserved)
 173                 return -EINVAL;
 174
 175         buf = buf + sizeof(*header);
 176         vrl_length = get_vrl_length(buf);
 177
 178         if (count < (sizeof(struct hdcp_srm_header) + vrl_length) ||
 179             vrl_length < (DRM_HDCP_2_VRL_LENGTH_SIZE +
 180             DRM_HDCP_2_DCP_SIG_SIZE)) {
 181                 DRM_ERROR("Invalid blob length or vrl length\n");
 182                 return -EINVAL;
 183         }
 184
 185         /* Length of the all vrls combined */
 186         vrl_length -= (DRM_HDCP_2_VRL_LENGTH_SIZE +
 187                        DRM_HDCP_2_DCP_SIG_SIZE);
 188
 189         if (!vrl_length) {
 190                 DRM_ERROR("No vrl found\n");
 191                 return -EINVAL;
 192         }
 193
 194         buf += DRM_HDCP_2_VRL_LENGTH_SIZE;
 195         ksv_count = (*buf << 2) | DRM_HDCP_2_KSV_COUNT_2_LSBITS(*(buf + 1));
 196         if (!ksv_count) {
 197                 DRM_DEBUG("Revoked KSV count is 0\n");
 198                 return count;
 199         }
 200
 201         kfree(srm_data->revoked_ksv_list);
 202         srm_data->revoked_ksv_list = kcalloc(ksv_count, DRM_HDCP_KSV_LEN,
 203                                              GFP_KERNEL);
 204         if (!srm_data->revoked_ksv_list) {
 205                 DRM_ERROR("Out of Memory\n");
 206                 return -ENOMEM;
 207         }
 208
 209         ksv_sz = ksv_count * DRM_HDCP_KSV_LEN;
 210         buf += DRM_HDCP_2_NO_OF_DEV_PLUS_RESERVED_SZ;
 211
 212         DRM_DEBUG("Revoked KSVs: %d\n", ksv_count);
 213         memcpy(srm_data->revoked_ksv_list, buf, ksv_sz);
 214
 215         srm_data->revoked_ksv_cnt = ksv_count;
 216         return count;
 217 }
 218
 219 static inline bool is_srm_version_hdcp1(const u8 *buf)
 220 {
 221         return *buf == (u8)(DRM_HDCP_1_4_SRM_ID << 4);
 222 }
 223
 224 static inline bool is_srm_version_hdcp2(const u8 *buf)
 225 {
 226         return *buf == (u8)(DRM_HDCP_2_SRM_ID << 4 | DRM_HDCP_2_INDICATOR);
 227 }
 228
 229 static void drm_hdcp_srm_update(const u8 *buf, size_t count)
 230 {
 231         if (count < sizeof(struct hdcp_srm_header))
 232                 return;
 233
 234         if (is_srm_version_hdcp1(buf))
 235                 drm_hdcp_parse_hdcp1_srm(buf, count);
 236         else if (is_srm_version_hdcp2(buf))
 237                 drm_hdcp_parse_hdcp2_srm(buf, count);
 238 }
 239
 240 static void drm_hdcp_request_srm(struct drm_device *drm_dev)
 241 {
 242         char fw_name[36] = "display_hdcp_srm.bin";
 243         const struct firmware *fw;
 244
 245         int ret;
 246
 247         ret = request_firmware_direct(&fw, (const char *)fw_name,
 248                                       drm_dev->dev);
 249         if (ret < 0)
 250                 goto exit;
 251
 252         if (fw->size && fw->data)
 253                 drm_hdcp_srm_update(fw->data, fw->size);
 254
 255 exit:
 256         release_firmware(fw);
 257 }
 258
 259 /**
 260  * drm_hdcp_check_ksvs_revoked - Check the revoked status of the IDs
 261  *
 262  * @drm_dev: drm_device for which HDCP revocation check is requested
 263  * @ksvs: List of KSVs (HDCP receiver IDs)
 264  * @ksv_count: KSV count passed in through @ksvs
 265  *
 266  * This function reads the HDCP System renewability Message(SRM Table)
 267  * from userspace as a firmware and parses it for the revoked HDCP
 268  * KSVs(Receiver IDs) detected by DCP LLC. Once the revoked KSVs are known,
 269  * revoked state of the KSVs in the list passed in by display drivers are
 270  * decided and response is sent.
 271  *
 272  * SRM should be presented in the name of "display_hdcp_srm.bin".
 273  *
 274  * Returns:
 275  * TRUE on any of the KSV is revoked, else FALSE.
 276  */
 277 bool drm_hdcp_check_ksvs_revoked(struct drm_device *drm_dev, u8 *ksvs,
 278                                  u32 ksv_count)
 279 {
 280         u32 rev_ksv_cnt, cnt, i, j;
 281         u8 *rev_ksv_list;
 282
 283         if (!srm_data)
 284                 return false;
 285
 286         mutex_lock(&srm_data->mutex);
 287         drm_hdcp_request_srm(drm_dev);
 288
 289         rev_ksv_cnt = srm_data->revoked_ksv_cnt;
 290         rev_ksv_list = srm_data->revoked_ksv_list;
 291
 292         /* If the Revoked ksv list is empty */
 293         if (!rev_ksv_cnt || !rev_ksv_list) {
 294                 mutex_unlock(&srm_data->mutex);
 295                 return false;
 296         }
 297
 298         for  (cnt = 0; cnt < ksv_count; cnt++) {
 299                 rev_ksv_list = srm_data->revoked_ksv_list;
 300                 for (i = 0; i < rev_ksv_cnt; i++) {
 301                         for (j = 0; j < DRM_HDCP_KSV_LEN; j++)
 302                                 if (ksvs[j] != rev_ksv_list[j]) {
 303                                         break;
 304                                 } else if (j == (DRM_HDCP_KSV_LEN - 1)) {
 305                                         DRM_DEBUG("Revoked KSV is ");
 306                                         drm_hdcp_print_ksv(ksvs);
 307                                         mutex_unlock(&srm_data->mutex);
 308                                         return true;
 309                                 }
 310                         /* Move the offset to next KSV in the revoked list */
 311                         rev_ksv_list += DRM_HDCP_KSV_LEN;
 312                 }
 313
 314                 /* Iterate to next ksv_offset */
 315                 ksvs += DRM_HDCP_KSV_LEN;
 316         }
 317         mutex_unlock(&srm_data->mutex);
 318         return false;
 319 }
 320 EXPORT_SYMBOL_GPL(drm_hdcp_check_ksvs_revoked);
 321
 322 int drm_setup_hdcp_srm(struct class *drm_class)
 323 {
 324         srm_data = kzalloc(sizeof(*srm_data), GFP_KERNEL);
 325         if (!srm_data)
 326                 return -ENOMEM;
 327         mutex_init(&srm_data->mutex);
 328
 329         return 0;
 330 }
 331
 332 void drm_teardown_hdcp_srm(struct class *drm_class)
 333 {
 334         if (srm_data) {
 335                 kfree(srm_data->revoked_ksv_list);
 336                 kfree(srm_data);
 337         }
 338 }
 339
 340 static struct drm_prop_enum_list drm_cp_enum_list[] = {
 341         { DRM_MODE_CONTENT_PROTECTION_UNDESIRED, "Undesired" },
 342         { DRM_MODE_CONTENT_PROTECTION_DESIRED, "Desired" },
 343         { DRM_MODE_CONTENT_PROTECTION_ENABLED, "Enabled" },
 344 };
 345 DRM_ENUM_NAME_FN(drm_get_content_protection_name, drm_cp_enum_list)
 346
 347 /**
 348  * drm_connector_attach_content_protection_property - attach content protection
 349  * property
 350  *
 351  * @connector: connector to attach CP property on.
 352  *
 353  * This is used to add support for content protection on select connectors.
 354  * Content Protection is intentionally vague to allow for different underlying
 355  * technologies, however it is most implemented by HDCP.
 356  *
 357  * The content protection will be set to &drm_connector_state.content_protection
 358  *
 359  * Returns:
 360  * Zero on success, negative errno on failure.
 361  */
 362 int drm_connector_attach_content_protection_property(
 363                 struct drm_connector *connector)
 364 {
 365         struct drm_device *dev = connector->dev;
 366         struct drm_property *prop =
 367                         dev->mode_config.content_protection_property;
 368
 369         if (!prop)
 370                 prop = drm_property_create_enum(dev, 0, "Content Protection",
 371                                                 drm_cp_enum_list,
 372                                                 ARRAY_SIZE(drm_cp_enum_list));
 373         if (!prop)
 374                 return -ENOMEM;
 375
 376         drm_object_attach_property(&connector->base, prop,
 377                                    DRM_MODE_CONTENT_PROTECTION_UNDESIRED);
 378         dev->mode_config.content_protection_property = prop;
 379
 380         return 0;
 381 }
 382 EXPORT_SYMBOL(drm_connector_attach_content_protection_property);