Add OutputProtection mojo interface for Chrome OS daemon

This adds the mojo OutputProtection interface and implementation that is
used to provide the OutputProtection service to the Chrome OS
cdm-oemcrypto daemon.

BUG=b:168230642,b:153111783,b:132039686,b:169530695
TEST=Unit tests pass, HDCP enabling/verify works with daemon

Change-Id: Ia40a8631894f937e79ab4504a7121d31b3713ba1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2432804Reviewed-by: Stéphane Marchesin <marcheu@chromium.org>
Reviewed-by: James Cook <jamescook@chromium.org>
Reviewed-by: Dominick Ng <dominickn@chromium.org>
Reviewed-by: Xiaohan Wang <xhwang@chromium.org>
Reviewed-by: Scott Violet <sky@chromium.org>
Reviewed-by: Yusuke Sato <yusukes@chromium.org>
Commit-Queue: Jeffrey Kardatzke <jkardatzke@google.com>
Cr-Commit-Position: refs/heads/master@{#811423}

chrome/browser/chromeos/arc/oemcrypto/arc_oemcrypto_bridge.cc

@@ -104,8 +104,14 @@ void ArcOemCryptoBridge::Connect(
 void ArcOemCryptoBridge::ConnectToDaemon(
     mojo::PendingReceiver<mojom::OemCryptoService> receiver,
     mojo::PendingRemote<mojom::ProtectedBufferManager> gpu_buffer_manager) {
+  // Create the OutputProtection interface to pass to the CDM.
+  mojo::PendingRemote<chromeos::cdm::mojom::OutputProtection> output_protection;
+  chromeos::CdmFactoryDaemonProxy::GetInstance().GetOutputProtection(
+      output_protection.InitWithNewPipeAndPassReceiver());
+
   chromeos::CdmFactoryDaemonProxy::GetInstance().ConnectOemCrypto(
-      std::move(receiver), std::move(gpu_buffer_manager));
+      std::move(receiver), std::move(gpu_buffer_manager),
+      std::move(output_protection));
 }
 
 }  // namespace arc

chromeos/components/cdm_factory_daemon/BUILD.gn

@@ -8,13 +8,17 @@ component("cdm_factory_daemon_browser") {
   sources = [
     "cdm_factory_daemon_proxy.cc",
     "cdm_factory_daemon_proxy.h",
+    "output_protection_impl.cc",
+    "output_protection_impl.h",
   ]
   public_deps = [ "//chromeos/components/cdm_factory_daemon/mojom" ]
   deps = [
+    "//ash",
     "//base",
     "//chromeos/dbus/cdm_factory_daemon",
     "//content/public/browser",
     "//mojo/public/cpp/bindings",
+    "//ui/display/manager",
   ]
   defines = [ "IS_CDM_FACTORY_DAEMON_IMPL" ]
 }
@@ -44,17 +48,21 @@ source_set("unit_tests") {
   sources = [
     "cdm_storage_adapter_unittest.cc",
     "content_decryption_module_adapter_unittest.cc",
+    "output_protection_impl_unittest.cc",
   ]
 
   deps = [
+    ":cdm_factory_daemon_browser",
     ":cdm_factory_daemon_gpu",
     "//base",
     "//base/test:test_support",
     "//chromeos/components/cdm_factory_daemon/mojom",
     "//chromeos/components/cdm_factory_daemon/mojom:unit_tests",
+    "//content/test:test_support",
     "//media:test_support",
     "//mojo/public/cpp/bindings",
     "//testing/gmock",
     "//testing/gtest",
+    "//ui/display/fake",
   ]
 }

chromeos/components/cdm_factory_daemon/DEPS

 include_rules = [
   "+components/arc/mojom",
   "+content/public/browser",
+  "+content/public/test",
   "+media/base",
   "+media/mojo/mojom",
-]
\ No newline at end of file
+  "+ui/display",
+]
+
+specific_include_rules = {
+  "output_protection_impl.cc": [
+    "+ash/shell.h",
+  ]
+}
\ No newline at end of file

chromeos/components/cdm_factory_daemon/cdm_factory_daemon_proxy.cc

@@ -11,6 +11,7 @@
 #include "base/no_destructor.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "chromeos/components/cdm_factory_daemon/output_protection_impl.h"
 #include "chromeos/dbus/cdm_factory_daemon/cdm_factory_daemon_client.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
@@ -53,16 +54,27 @@ void CdmFactoryDaemonProxy::CreateFactory(const std::string& key_system,
                      base::Unretained(this), key_system, std::move(callback)));
 }
 
-void CdmFactoryDaemonProxy::ConnectOemCrypto(
+void CdmFactoryDaemonProxy::ConnectOemCryptoDeprecated(
     mojo::PendingReceiver<arc::mojom::OemCryptoService> oemcryptor,
     mojo::PendingRemote<arc::mojom::ProtectedBufferManager>
         protected_buffer_manager) {
+  // This will never get called because this originates from Chrome as well
+  // which will always be on the same version as us.
+  NOTIMPLEMENTED();
+}
+
+void CdmFactoryDaemonProxy::ConnectOemCrypto(
+    mojo::PendingReceiver<arc::mojom::OemCryptoService> oemcryptor,
+    mojo::PendingRemote<arc::mojom::ProtectedBufferManager>
+        protected_buffer_manager,
+    mojo::PendingRemote<cdm::mojom::OutputProtection> output_protection) {
   // This gets invoked from ArcBridge which uses a different thread.
   if (!mojo_task_runner_->RunsTasksInCurrentSequence()) {
     mojo_task_runner_->PostTask(
         FROM_HERE, base::BindOnce(&CdmFactoryDaemonProxy::ConnectOemCrypto,
                                   base::Unretained(this), std::move(oemcryptor),
-                                  std::move(protected_buffer_manager)));
+                                  std::move(protected_buffer_manager),
+                                  std::move(output_protection)));
     return;
   }
 
@@ -70,14 +82,20 @@ void CdmFactoryDaemonProxy::ConnectOemCrypto(
   if (daemon_remote_.is_bound()) {
     DVLOG(1) << "CdmFactoryDaemon mojo connection already exists, re-use it";
     CompleteOemCryptoConnection(std::move(oemcryptor),
-                                std::move(protected_buffer_manager));
+                                std::move(protected_buffer_manager),
+                                std::move(output_protection));
     return;
   }
 
-  EstablishDaemonConnection(
-      base::BindOnce(&CdmFactoryDaemonProxy::CompleteOemCryptoConnection,
-                     base::Unretained(this), std::move(oemcryptor),
-                     std::move(protected_buffer_manager)));
+  EstablishDaemonConnection(base::BindOnce(
+      &CdmFactoryDaemonProxy::CompleteOemCryptoConnection,
+      base::Unretained(this), std::move(oemcryptor),
+      std::move(protected_buffer_manager), std::move(output_protection)));
+}
+
+void CdmFactoryDaemonProxy::GetOutputProtection(
+    mojo::PendingReceiver<cdm::mojom::OutputProtection> output_protection) {
+  OutputProtectionImpl::Create(std::move(output_protection));
 }
 
 void CdmFactoryDaemonProxy::SendDBusRequest(base::ScopedFD fd,
@@ -155,7 +173,8 @@ void CdmFactoryDaemonProxy::GetFactoryInterface(
 void CdmFactoryDaemonProxy::CompleteOemCryptoConnection(
     mojo::PendingReceiver<arc::mojom::OemCryptoService> oemcryptor,
     mojo::PendingRemote<arc::mojom::ProtectedBufferManager>
-        protected_buffer_manager) {
+        protected_buffer_manager,
+    mojo::PendingRemote<cdm::mojom::OutputProtection> output_protection) {
   if (!daemon_remote_ || !daemon_remote_.is_bound()) {
     LOG(ERROR) << "daemon_remote_ interface is not connected";
     // Just let the mojo objects go out of scope and be destructed to signal
@@ -163,7 +182,8 @@ void CdmFactoryDaemonProxy::CompleteOemCryptoConnection(
     return;
   }
   daemon_remote_->ConnectOemCrypto(std::move(oemcryptor),
-                                   std::move(protected_buffer_manager));
+                                   std::move(protected_buffer_manager),
+                                   std::move(output_protection));
 }
 
 // static

chromeos/components/cdm_factory_daemon/cdm_factory_daemon_proxy.h

@@ -42,10 +42,18 @@ class COMPONENT_EXPORT(CDM_FACTORY_DAEMON) CdmFactoryDaemonProxy
   // chromeos::cdm::mojom::CdmFactoryDaemon:
   void CreateFactory(const std::string& key_system,
                      CreateFactoryCallback callback) override;
-  void ConnectOemCrypto(
+  void ConnectOemCryptoDeprecated(
       mojo::PendingReceiver<arc::mojom::OemCryptoService> oemcryptor,
       mojo::PendingRemote<arc::mojom::ProtectedBufferManager>
           protected_buffer_manager) override;
+  void ConnectOemCrypto(
+      mojo::PendingReceiver<arc::mojom::OemCryptoService> oemcryptor,
+      mojo::PendingRemote<arc::mojom::ProtectedBufferManager>
+          protected_buffer_manager,
+      mojo::PendingRemote<cdm::mojom::OutputProtection> output_protection)
+      override;
+  void GetOutputProtection(mojo::PendingReceiver<cdm::mojom::OutputProtection>
+                               output_protection) override;
 
  private:
   void SendDBusRequest(base::ScopedFD fd, base::OnceClosure callback);
@@ -56,7 +64,8 @@ class COMPONENT_EXPORT(CDM_FACTORY_DAEMON) CdmFactoryDaemonProxy
   void CompleteOemCryptoConnection(
       mojo::PendingReceiver<arc::mojom::OemCryptoService> oemcryptor,
       mojo::PendingRemote<arc::mojom::ProtectedBufferManager>
-          protected_buffer_manager);
+          protected_buffer_manager,
+      mojo::PendingRemote<cdm::mojom::OutputProtection> output_protection);
   void OnGpuMojoConnectionError();
   void OnDaemonMojoConnectionError();
   void BindReceiver(mojo::PendingReceiver<CdmFactoryDaemon> receiver);

chromeos/components/cdm_factory_daemon/chromeos_cdm_factory.cc

@@ -187,10 +187,16 @@ void ChromeOsCdmFactory::CreateCdm(
               session_closed_cb, session_keys_change_cb,
               session_expiration_update_cb));
 
+  // Create the OutputProtection interface to pass to the CDM.
+  mojo::PendingRemote<cdm::mojom::OutputProtection> output_protection_remote;
+  GetCdmFactoryDaemonRemote()->GetOutputProtection(
+      output_protection_remote.InitWithNewPipeAndPassReceiver());
+
   // Now create the remote CDM instance that links everything up.
   remote_factory_->CreateCdm(cdm->GetClientInterface(),
                              std::move(storage_remote),
-                             std::move(cros_cdm_pending_receiver));
+                             std::move(cros_cdm_pending_receiver),
+                             std::move(output_protection_remote));
 
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE, base::BindOnce(std::move(cdm_created_cb), std::move(cdm), ""));

chromeos/components/cdm_factory_daemon/mojom/BUILD.gn

@@ -9,6 +9,7 @@ mojom_component("mojom") {
     "cdm_factory_daemon.mojom",
     "cdm_storage.mojom",
     "content_decryption_module.mojom",
+    "output_protection.mojom",
   ]
 
   public_deps = [
@@ -44,9 +45,20 @@ mojom_component("mojom") {
           mojom = "chromeos.cdm.mojom.PromiseException"
           cpp = "::media::CdmPromise::Exception"
         },
+        {
+          mojom = "chromeos.cdm.mojom.ProtectionType"
+          cpp = "::display::ContentProtectionMethod"
+        },
+        {
+          mojom = "chromeos.cdm.mojom.LinkType"
+          cpp = "::display::DisplayConnectionType"
+        },
       ]
       traits_headers = [ "cdm_types_enum_mojom_traits.h" ]
-      traits_public_deps = [ "//media" ]
+      traits_public_deps = [
+        "//media",
+        "//ui/display/types",
+      ]
     },
     {
       types = [

chromeos/components/cdm_factory_daemon/mojom/cdm_factory_daemon.mojom

@@ -9,24 +9,36 @@
 // interface can also be used to connect directly to the OEMCrypto
 // implementation for ARC.
 
+// Next MinVersion: 2
+
 module chromeos.cdm.mojom;
 
 import "chromeos/components/cdm_factory_daemon/mojom/cdm_storage.mojom";
 import "chromeos/components/cdm_factory_daemon/mojom/content_decryption_module.mojom";
+import "chromeos/components/cdm_factory_daemon/mojom/output_protection.mojom";
 import "components/arc/mojom/oemcrypto.mojom";
 import "components/arc/mojom/protected_buffer_manager.mojom";
 
-// Next Method ID: 1
+// Next Method ID: 2
 interface CdmFactory {
+  // Deprecated, do not use.
+  CreateCdmDeprecated@0(
+      pending_associated_remote<ContentDecryptionModuleClient> client,
+      pending_associated_remote<CdmStorage> storage,
+      pending_associated_receiver<ContentDecryptionModule> cdm);
+
   // Creates a new ContentDecryptionModule instance with the corresponding
-  // client and remote storage implementation. Use an associated interface to
-  // ensure ordering and that all become invalidated at the same time.
-  CreateCdm@0(pending_associated_remote<ContentDecryptionModuleClient> client,
+  // client, remote storage implementation and output protection. Use an
+  // associated interface to ensure ordering and that all become invalidated at
+  // the same time.
+  [MinVersion=1]
+  CreateCdm@1(pending_associated_remote<ContentDecryptionModuleClient> client,
               pending_associated_remote<CdmStorage> storage,
-              pending_associated_receiver<ContentDecryptionModule> cdm);
+              pending_associated_receiver<ContentDecryptionModule> cdm,
+              pending_remote<OutputProtection> output_protection);
 };
 
-// Next Method ID: 2
+// Next Method ID: 4
 // Used for bootstrapping the connection between Chrome and the daemon, then
 // methods can be invoked to obtain interfaces to perform CDM or OEMCrypto
 // operations.
@@ -37,10 +49,22 @@ interface CdmFactoryDaemon {
   // get the interface from the daemon.
   CreateFactory@0(string key_system) => (pending_remote<CdmFactory>? factory);
 
+  // Deprecated, do not use.
+  ConnectOemCryptoDeprecated@1(
+      pending_receiver<arc.mojom.OemCryptoService> oemcryptor,
+      pending_remote<arc.mojom.ProtectedBufferManager>
+          protected_buffer_manager);
+
   // Used to establish a connection to the OEMCrypto implementation to provide
   // that service to ARC.
-  ConnectOemCrypto@1(
+  [MinVersion=1] ConnectOemCrypto@2(
       pending_receiver<arc.mojom.OemCryptoService> oemcryptor,
       pending_remote<arc.mojom.ProtectedBufferManager>
-          protected_buffer_manager);
+          protected_buffer_manager,
+      pending_remote<OutputProtection> output_protection);
+
+  // Creates a new OutputProtection interface to be used for passing into the
+  // CreateCdm call in CdmFactory.
+  [MinVersion=1]
+  GetOutputProtection@3(pending_receiver<OutputProtection> output_protection);
 };

chromeos/components/cdm_factory_daemon/mojom/cdm_storage.mojom

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Next MinVersion: 2
+// Next MinVersion: 1
 
 module chromeos.cdm.mojom;
 

chromeos/components/cdm_factory_daemon/mojom/content_decryption_module.mojom

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Next MinVersion: 2
+// Next MinVersion: 1
 
 module chromeos.cdm.mojom;
 

chromeos/components/cdm_factory_daemon/mojom/output_protection.mojom

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Next MinVersion: 1
+
+module chromeos.cdm.mojom;
+
+// Provides an interface for Chrome OS to apply and/or query content protection
+// settings for an output link. These have no ability to specify a specific
+// display, so they will be relevant to all external outputs. When the Mojo
+// connection is dropped, the request will be cancelled.
+// Next Method ID: 2
+interface OutputProtection {
+  // HDCP protection types.
+  [Extensible]
+  enum ProtectionType {
+    NONE = 0,
+    HDCP_TYPE_0 = 1,  // Inferred to be HDCP 1.4.
+    HDCP_TYPE_1 = 2,  // Inferred to be HDCP 2.2.
+  };
+
+  // Video output link types.
+  [Extensible]
+  enum LinkType {
+    NONE = 0,
+    UNKNOWN = 1,
+    INTERNAL = 2,
+    VGA = 4,
+    HDMI = 8,
+    DVI = 16,
+    DISPLAYPORT = 32,
+    NETWORK = 64,
+  };
+
+  // Queries link status and protection status.
+  // Clients need to query status periodically in order to detect changes.
+  //
+  // - success: Whether the query succeeded. If false, values of |link_mask| and
+  //   |protection| should be ignored.
+  // - link_mask: The type of connected output links, which is a bit-mask of the
+  //   LinkType values.
+  // - protection: The highest level of HDCP that is applied across all the
+  //   external outputs.
+  QueryStatus@0() => (bool success, uint32 link_mask,
+                      ProtectionType protection);
+
+  // Sets desired protection method.
+  //
+  // When the desired protection method has been applied to all applicable
+  // output links, the |protection| returned by QueryStatus() will be set if it
+  // was able to be achieved. There is no separate error code or callback for a
+  // failure to set a desired ProtectionType.
+  //
+  // Protection will be disabled if no longer desired by all instances.
+  //
+  // - desired_protection: The desired protection method.
+  // - success: True when the protection request has been made. This may be
+  //   before the protection has actually been applied. Call QueryStatus() to
+  //   get protection status. False if it failed to make the protection request,
+  //   and in this case there is no need to call QueryStatus().
+  EnableProtection@1(ProtectionType desired_protection) => (bool success);
+};

chromeos/components/cdm_factory_daemon/output_protection_impl.h

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROMEOS_COMPONENTS_CDM_FACTORY_DAEMON_OUTPUT_PROTECTION_IMPL_H_
+#define CHROMEOS_COMPONENTS_CDM_FACTORY_DAEMON_OUTPUT_PROTECTION_IMPL_H_
+
+#include <memory>
+#include <vector>
+
+#include "base/component_export.h"
+#include "base/memory/weak_ptr.h"
+#include "chromeos/components/cdm_factory_daemon/mojom/output_protection.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "ui/display/display_observer.h"
+#include "ui/display/manager/content_protection_manager.h"
+#include "ui/display/types/display_snapshot.h"
+
+namespace chromeos {
+
+// Provides a Mojo implementation of the OutputProtection interface which then
+// calls into the ContentProtectionManger singleton owned by the ash shell.
+class COMPONENT_EXPORT(CDM_FACTORY_DAEMON) OutputProtectionImpl
+    : public cdm::mojom::OutputProtection,
+      public display::DisplayObserver {
+ public:
+  // Mainly to enable testing, this abstracts out calls that would normally
+  // be made into display::ContentProtectionManager, ash::Screen and
+  // display::DisplayConfigurator.
+  class DisplaySystemDelegate {
+   public:
+    virtual ~DisplaySystemDelegate() = default;
+
+    // Delegate to display::ContentProtectionManager.
+    virtual void ApplyContentProtection(
+        display::ContentProtectionManager::ClientId client_id,
+        int64_t display_id,
+        uint32_t protection_mask,
+        display::ContentProtectionManager::ApplyContentProtectionCallback
+            callback) = 0;
+    virtual void QueryContentProtection(
+        display::ContentProtectionManager::ClientId client_id,
+        int64_t display_id,
+        display::ContentProtectionManager::QueryContentProtectionCallback
+            callback) = 0;
+    virtual display::ContentProtectionManager::ClientId RegisterClient() = 0;
+    virtual void UnregisterClient(
+        display::ContentProtectionManager::ClientId client_id) = 0;
+
+    // Delegate to ash::screen::GetScreen().
+    virtual void AddObserver(display::DisplayObserver* observer) = 0;
+    virtual void RemoveObserver(display::DisplayObserver* observer) = 0;
+
+    // Delegate to display::DisplayConfigurator.
+    virtual const std::vector<display::DisplaySnapshot*>& cached_displays()
+        const = 0;
+  };
+
+  static void Create(
+      mojo::PendingReceiver<cdm::mojom::OutputProtection> receiver,
+      std::unique_ptr<DisplaySystemDelegate> delegate = nullptr);
+
+  explicit OutputProtectionImpl(
+      std::unique_ptr<DisplaySystemDelegate> delegate);
+
+  OutputProtectionImpl(const OutputProtectionImpl&) = delete;
+  OutputProtectionImpl& operator=(const OutputProtectionImpl&) = delete;
+
+  ~OutputProtectionImpl() override;
+
+  // chromeos::cdm::mojom::OutputProtection:
+  void QueryStatus(QueryStatusCallback callback) override;
+  void EnableProtection(
+      cdm::mojom::OutputProtection::ProtectionType desired_protection,
+      EnableProtectionCallback callback) override;
+
+ private:
+  void Initialize();
+
+  // This is used to successively enable protection on all the displays and
+  // aggregate the overall result and fire the callback when complete.
+  void EnableProtectionCallbackAggregator(
+      std::vector<int64_t> remaining_displays,
+      EnableProtectionCallback callback,
+      bool aggregate_success,
+      bool success);
+
+  // This is used to query multiple displays for the status and then aggregate
+  // that into one before we invoke the callback.
+  void QueryStatusCallbackAggregator(std::vector<int64_t> remaining_displays,
+                                     QueryStatusCallback callback,
+                                     bool aggregate_success,
+                                     uint32_t aggregate_link_mask,
+                                     uint32_t aggregate_protection_mask,
+                                     uint32_t aggregate_no_protection_mask,
+                                     bool success,
+                                     uint32_t link_mask,
+                                     uint32_t protection_mask);
+
+  // display::DisplayObserver:
+  void OnDisplayMetricsChanged(const display::Display& display,
+                               uint32_t changed_metrics) override;
+
+  std::unique_ptr<DisplaySystemDelegate> delegate_;
+  display::ContentProtectionManager::ClientId client_id_;
+
+  std::vector<int64_t> display_id_list_;
+
+  uint32_t desired_protection_mask_{0};
+
+  // WeakPtrFactory to use for callbacks.
+  base::WeakPtrFactory<OutputProtectionImpl> weak_factory_{this};
+};
+
+}  // namespace chromeos
+
+#endif  // CHROMEOS_COMPONENTS_CDM_FACTORY_DAEMON_OUTPUT_PROTECTION_IMPL_H_