Protected Surfaces for VAAPI decode

This adds a new BufferUsage of PROTECTED_VDA_WRITE which is intended to
be used by HW video decoders to decode to a HW protected buffer.
Initially this will only target the VAAPI decoders.

This path will not be used yet, as there are other CLs pending to
enable protected decode in VAAPI as well as kernel patches for the
graphics driver. The high level functionality is also behind a Chrome
flag.

BUG=b:153111783
TEST=Built/ran with full prototype

Change-Id: I775bda3782e5c72b28cbbf2c6c4b0e0eed76abaa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2499087Reviewed-by: ccameron <ccameron@chromium.org>
Reviewed-by: Daniele Castagna <dcastagna@chromium.org>
Reviewed-by: Dominick Ng <dominickn@chromium.org>
Commit-Queue: Jeffrey Kardatzke <jkardatzke@google.com>
Cr-Commit-Position: refs/heads/master@{#825978}

gpu/ipc/common/gpu_memory_buffer_impl_io_surface.cc

@@ -41,6 +41,7 @@ uint32_t LockFlags(gfx::BufferUsage usage) {
     case gfx::BufferUsage::CAMERA_AND_CPU_READ_WRITE:
     case gfx::BufferUsage::SCANOUT_CPU_READ_WRITE:
     case gfx::BufferUsage::SCANOUT_VDA_WRITE:
+    case gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
       return 0;
   }
   NOTREACHED();

gpu/ipc/common/gpu_memory_buffer_impl_shared_memory.cc

@@ -163,6 +163,7 @@ bool GpuMemoryBufferImplSharedMemory::IsUsageSupported(gfx::BufferUsage usage) {
     case gfx::BufferUsage::SCANOUT_CAMERA_READ_WRITE:
     case gfx::BufferUsage::CAMERA_AND_CPU_READ_WRITE:
     case gfx::BufferUsage::SCANOUT_VDA_WRITE:
+    case gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
     case gfx::BufferUsage::SCANOUT_VEA_CPU_READ:
     case gfx::BufferUsage::SCANOUT_VEA_READ_CAMERA_AND_CPU_READ_WRITE:
       return false;

gpu/ipc/common/gpu_memory_buffer_impl_test_template.h

@@ -98,6 +98,7 @@ TYPED_TEST_P(GpuMemoryBufferImplTest, CreateFromHandle) {
         gfx::BufferUsage::CAMERA_AND_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_VDA_WRITE,
+        gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE,
         gfx::BufferUsage::GPU_READ_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_VEA_CPU_READ,
         gfx::BufferUsage::SCANOUT_VEA_READ_CAMERA_AND_CPU_READ_WRITE,
@@ -140,6 +141,7 @@ TYPED_TEST_P(GpuMemoryBufferImplTest, CreateFromHandleSmallBuffer) {
         gfx::BufferUsage::CAMERA_AND_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_VDA_WRITE,
+        gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE,
         gfx::BufferUsage::GPU_READ_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_VEA_CPU_READ,
         gfx::BufferUsage::SCANOUT_VEA_READ_CAMERA_AND_CPU_READ_WRITE,
@@ -318,6 +320,7 @@ TYPED_TEST_P(GpuMemoryBufferImplTest, SerializeAndDeserialize) {
         gfx::BufferUsage::CAMERA_AND_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_VDA_WRITE,
+        gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE,
         gfx::BufferUsage::GPU_READ_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_VEA_CPU_READ,
         gfx::BufferUsage::SCANOUT_VEA_READ_CAMERA_AND_CPU_READ_WRITE,

gpu/ipc/common/gpu_memory_buffer_support.cc

@@ -95,6 +95,7 @@ bool GpuMemoryBufferSupport::IsNativeGpuMemoryBufferConfigurationSupported(
              format == gfx::BufferFormat::YUV_420_BIPLANAR ||
              format == gfx::BufferFormat::P010;
     case gfx::BufferUsage::SCANOUT_VDA_WRITE:
+    case gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
     case gfx::BufferUsage::SCANOUT_CAMERA_READ_WRITE:
     case gfx::BufferUsage::CAMERA_AND_CPU_READ_WRITE:
     case gfx::BufferUsage::SCANOUT_VEA_CPU_READ:
@@ -116,6 +117,7 @@ bool GpuMemoryBufferSupport::IsNativeGpuMemoryBufferConfigurationSupported(
     case gfx::BufferUsage::SCANOUT_CPU_READ_WRITE:
     case gfx::BufferUsage::GPU_READ_CPU_READ_WRITE:
     case gfx::BufferUsage::SCANOUT_VDA_WRITE:
+    case gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
     case gfx::BufferUsage::SCANOUT_CAMERA_READ_WRITE:
     case gfx::BufferUsage::CAMERA_AND_CPU_READ_WRITE:
     case gfx::BufferUsage::SCANOUT_VEA_CPU_READ:
@@ -146,6 +148,7 @@ bool GpuMemoryBufferSupport::IsNativeGpuMemoryBufferConfigurationSupported(
     case gfx::BufferUsage::SCANOUT_CPU_READ_WRITE:
     case gfx::BufferUsage::GPU_READ_CPU_READ_WRITE:
     case gfx::BufferUsage::SCANOUT_VDA_WRITE:
+    case gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
     case gfx::BufferUsage::SCANOUT_CAMERA_READ_WRITE:
     case gfx::BufferUsage::CAMERA_AND_CPU_READ_WRITE:
     case gfx::BufferUsage::SCANOUT_VEA_CPU_READ:

gpu/ipc/host/gpu_memory_buffer_support.cc

@@ -39,6 +39,7 @@ GpuMemoryBufferConfigurationSet GetNativeGpuMemoryBufferConfigurations(
       gfx::BufferUsage::CAMERA_AND_CPU_READ_WRITE,
       gfx::BufferUsage::SCANOUT_CPU_READ_WRITE,
       gfx::BufferUsage::SCANOUT_VDA_WRITE,
+      gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE,
       gfx::BufferUsage::GPU_READ_CPU_READ_WRITE,
       gfx::BufferUsage::SCANOUT_VEA_CPU_READ,
       gfx::BufferUsage::SCANOUT_VEA_READ_CAMERA_AND_CPU_READ_WRITE,

gpu/ipc/service/gpu_memory_buffer_factory_test_template.h

@@ -68,6 +68,7 @@ TYPED_TEST_P(GpuMemoryBufferFactoryTest, CreateGpuMemoryBuffer) {
         gfx::BufferUsage::CAMERA_AND_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_VDA_WRITE,
+        gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE,
         gfx::BufferUsage::GPU_READ_CPU_READ_WRITE,
         gfx::BufferUsage::SCANOUT_VEA_CPU_READ,
         gfx::BufferUsage::SCANOUT_VEA_READ_CAMERA_AND_CPU_READ_WRITE,

media/gpu/chromeos/dmabuf_video_frame_pool.h

@@ -47,7 +47,8 @@ class MEDIA_GPU_EXPORT DmabufVideoFramePool {
       const gfx::Size& coded_size,
       const gfx::Rect& visible_rect,
       const gfx::Size& natural_size,
-      size_t max_num_frames) = 0;
+      size_t max_num_frames,
+      bool use_protected) = 0;
 
   // Returns a frame from the pool with the parameters assigned by
   // SetFrameFormat() and zero timestamp. Returns nullptr if the pool is

media/gpu/chromeos/image_processor_with_pool.cc

@@ -19,7 +19,8 @@ std::unique_ptr<ImageProcessorWithPool> ImageProcessorWithPool::Create(
     const scoped_refptr<base::SequencedTaskRunner> task_runner) {
   const ImageProcessor::PortConfig& config = image_processor->output_config();
   base::Optional<GpuBufferLayout> layout = frame_pool->Initialize(
-      config.fourcc, config.size, config.visible_rect, config.size, num_frames);
+      config.fourcc, config.size, config.visible_rect, config.size, num_frames,
+      /*use_protected=*/false);
   if (!layout || layout->size() != config.size) {
     VLOGF(1) << "Failed to request frame with correct size. "
              << config.size.ToString() << " != "

media/gpu/chromeos/platform_video_frame_pool.cc

@@ -13,6 +13,7 @@
 #include "media/gpu/chromeos/gpu_buffer_layout.h"
 #include "media/gpu/chromeos/platform_video_frame_utils.h"
 #include "media/gpu/macros.h"
+#include "media/media_buildflags.h"
 
 namespace media {
 
@@ -25,10 +26,20 @@ scoped_refptr<VideoFrame> DefaultCreateFrame(
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
     const gfx::Size& natural_size,
+    bool use_protected,
     base::TimeDelta timestamp) {
-  return CreateGpuMemoryBufferVideoFrame(
+  scoped_refptr<VideoFrame> frame = CreateGpuMemoryBufferVideoFrame(
       gpu_memory_buffer_factory, format, coded_size, visible_rect, natural_size,
-      timestamp, gfx::BufferUsage::SCANOUT_VDA_WRITE);
+      timestamp,
+      use_protected ? gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE
+                    : gfx::BufferUsage::SCANOUT_VDA_WRITE);
+  if (frame && use_protected) {
+    media::VideoFrameMetadata frame_metadata;
+    frame_metadata.protected_video = true;
+    frame_metadata.hw_protected = true;
+    frame->set_metadata(frame_metadata);
+  }
+  return frame;
 }
 
 }  // namespace
@@ -89,7 +100,7 @@ scoped_refptr<VideoFrame> PlatformVideoFramePool::GetFrame() {
     scoped_refptr<VideoFrame> new_frame =
         create_frame_cb_.Run(gpu_memory_buffer_factory_, format, coded_size,
                              gfx::Rect(GetRectSizeFromOrigin(visible_rect_)),
-                             coded_size, base::TimeDelta());
+                             coded_size, use_protected_, base::TimeDelta());
     if (!new_frame)
       return nullptr;
 
@@ -114,6 +125,16 @@ scoped_refptr<VideoFrame> PlatformVideoFramePool::GetFrame() {
   // Clear all metadata before returning to client, in case origin frame has any
   // unrelated metadata.
   wrapped_frame->clear_metadata();
+
+  // We need to put this metadata in the wrapped frame if we are in protected
+  // mode.
+  if (use_protected_) {
+    media::VideoFrameMetadata frame_metadata;
+    frame_metadata.protected_video = true;
+    frame_metadata.hw_protected = true;
+    wrapped_frame->set_metadata(frame_metadata);
+  }
+
   return wrapped_frame;
 }
 
@@ -122,7 +143,8 @@ base::Optional<GpuBufferLayout> PlatformVideoFramePool::Initialize(
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
     const gfx::Size& natural_size,
-    size_t max_num_frames) {
+    size_t max_num_frames,
+    bool use_protected) {
   DVLOGF(4);
   base::AutoLock auto_lock(lock_);
 
@@ -133,6 +155,13 @@ base::Optional<GpuBufferLayout> PlatformVideoFramePool::Initialize(
     return base::nullopt;
   }
 
+#if !BUILDFLAG(USE_CHROMEOS_PROTECTED_MEDIA)
+  if (use_protected) {
+    VLOGF(1) << "Protected buffers unsupported";
+    return base::nullopt;
+  }
+#endif
+
   // If the frame layout changed we need to allocate new frames so we will clear
   // the pool here. If only the visible rect or natural size changed, we don't
   // need to allocate new frames (unless the change in the visible rect causes a
@@ -145,15 +174,15 @@ base::Optional<GpuBufferLayout> PlatformVideoFramePool::Initialize(
   // hardware overlay purposes. The caveat is that different visible rectangles
   // can map to the same framebuffer size, i.e., all the visible rectangles with
   // the same bottom-right corner map to the same framebuffer size.
-  if (!IsSameFormat_Locked(format, coded_size, visible_rect)) {
+  if (!IsSameFormat_Locked(format, coded_size, visible_rect, use_protected)) {
     DVLOGF(4) << "The video frame format is changed. Clearing the pool.";
     free_frames_.clear();
 
     // Create a temporary frame in order to know VideoFrameLayout that
     // VideoFrame that will be allocated in GetFrame() has.
-    auto frame =
-        create_frame_cb_.Run(gpu_memory_buffer_factory_, format, coded_size,
-                             visible_rect, natural_size, base::TimeDelta());
+    auto frame = create_frame_cb_.Run(gpu_memory_buffer_factory_, format,
+                                      coded_size, visible_rect, natural_size,
+                                      use_protected, base::TimeDelta());
     if (!frame) {
       VLOGF(1) << "Failed to create video frame " << format << " (fourcc "
                << fourcc.ToString() << ")";
@@ -167,6 +196,7 @@ base::Optional<GpuBufferLayout> PlatformVideoFramePool::Initialize(
   visible_rect_ = visible_rect;
   natural_size_ = natural_size;
   max_num_frames_ = max_num_frames;
+  use_protected_ = use_protected;
 
   // The pool might become available because of |max_num_frames_| increased.
   // Notify the client if so.
@@ -236,7 +266,8 @@ void PlatformVideoFramePool::OnFrameReleased(
   frames_in_use_.erase(it);
 
   if (IsSameFormat_Locked(origin_frame->format(), origin_frame->coded_size(),
-                          origin_frame->visible_rect())) {
+                          origin_frame->visible_rect(),
+                          origin_frame->metadata()->hw_protected)) {
     InsertFreeFrame_Locked(std::move(origin_frame));
   }
 
@@ -261,10 +292,10 @@ size_t PlatformVideoFramePool::GetTotalNumFrames_Locked() const {
   return free_frames_.size() + frames_in_use_.size();
 }
 
-bool PlatformVideoFramePool::IsSameFormat_Locked(
-    VideoPixelFormat format,
-    const gfx::Size& coded_size,
-    const gfx::Rect& visible_rect) const {
+bool PlatformVideoFramePool::IsSameFormat_Locked(VideoPixelFormat format,
+                                                 const gfx::Size& coded_size,
+                                                 const gfx::Rect& visible_rect,
+                                                 bool use_protected) const {
   DVLOGF(4);
   lock_.AssertAcquired();
 
@@ -272,7 +303,8 @@ bool PlatformVideoFramePool::IsSameFormat_Locked(
          frame_layout_->fourcc().ToVideoPixelFormat() == format &&
          frame_layout_->size() == coded_size &&
          GetRectSizeFromOrigin(visible_rect_) ==
-             GetRectSizeFromOrigin(visible_rect);
+             GetRectSizeFromOrigin(visible_rect) &&
+         use_protected_ == use_protected;
 }
 
 size_t PlatformVideoFramePool::GetPoolSizeForTesting() {

media/gpu/chromeos/platform_video_frame_pool.h

@@ -52,7 +52,8 @@ class MEDIA_GPU_EXPORT PlatformVideoFramePool : public DmabufVideoFramePool {
                                              const gfx::Size& coded_size,
                                              const gfx::Rect& visible_rect,
                                              const gfx::Size& natural_size,
-                                             size_t max_num_frames) override;
+                                             size_t max_num_frames,
+                                             bool use_protected) override;
   scoped_refptr<VideoFrame> GetFrame() override;
   bool IsExhausted() override;
   void NotifyWhenFrameAvailable(base::OnceClosure cb) override;
@@ -87,7 +88,8 @@ class MEDIA_GPU_EXPORT PlatformVideoFramePool : public DmabufVideoFramePool {
   size_t GetTotalNumFrames_Locked() const EXCLUSIVE_LOCKS_REQUIRED(lock_);
   bool IsSameFormat_Locked(VideoPixelFormat format,
                            const gfx::Size& coded_size,
-                           const gfx::Rect& visible_rect) const
+                           const gfx::Rect& visible_rect,
+                           bool use_protected) const
       EXCLUSIVE_LOCKS_REQUIRED(lock_);
   bool IsExhausted_Locked() EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
@@ -98,6 +100,7 @@ class MEDIA_GPU_EXPORT PlatformVideoFramePool : public DmabufVideoFramePool {
       const gfx::Size& coded_size,
       const gfx::Rect& visible_rect,
       const gfx::Size& natural_size,
+      bool use_protected,
       base::TimeDelta timestamp)>;
   CreateFrameCB create_frame_cb_;
 
@@ -128,6 +131,9 @@ class MEDIA_GPU_EXPORT PlatformVideoFramePool : public DmabufVideoFramePool {
   // The maximum number of frames created by the pool.
   size_t max_num_frames_ GUARDED_BY(lock_) = 0;
 
+  // If we are using HW protected buffers.
+  bool use_protected_ GUARDED_BY(lock_) = false;
+
   // Callback which is called when the pool is not exhausted.
   base::OnceClosure frame_available_cb_ GUARDED_BY(lock_);
 

media/gpu/chromeos/platform_video_frame_pool_unittest.cc

@@ -30,6 +30,7 @@ scoped_refptr<VideoFrame> CreateGpuMemoryBufferVideoFrame(
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
     const gfx::Size& natural_size,
+    bool use_protected,
     base::TimeDelta timestamp) {
   base::Optional<gfx::BufferFormat> gfx_format =
       VideoPixelFormatToGfxBufferFormat(format);
@@ -68,7 +69,8 @@ class PlatformVideoFramePoolTest
     visible_rect_ = visible_rect;
     natural_size_ = visible_rect.size();
     layout_ = pool_->Initialize(fourcc, coded_size, visible_rect_,
-                                natural_size_, kNumFrames);
+                                natural_size_, kNumFrames,
+                                /*use_protected=*/false);
     return !!layout_;
   }
 
@@ -288,7 +290,8 @@ TEST_P(PlatformVideoFramePoolTest, InitializeFail) {
   SetCreateFrameCB(base::BindRepeating(
       [](gpu::GpuMemoryBufferFactory* factory, VideoPixelFormat format,
          const gfx::Size& coded_size, const gfx::Rect& visible_rect,
-         const gfx::Size& natural_size, base::TimeDelta timestamp) {
+         const gfx::Size& natural_size, bool use_protected,
+         base::TimeDelta timestamp) {
         auto frame = scoped_refptr<VideoFrame>(nullptr);
         return frame;
       }));

media/gpu/chromeos/vda_video_frame_pool.cc

@@ -34,10 +34,16 @@ base::Optional<GpuBufferLayout> VdaVideoFramePool::Initialize(
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
     const gfx::Size& natural_size,
-    size_t max_num_frames) {
+    size_t max_num_frames,
+    bool use_protected) {
   DVLOGF(3);
   DCHECK_CALLED_ON_VALID_SEQUENCE(parent_sequence_checker_);
 
+  if (use_protected) {
+    LOG(ERROR) << "Cannot allocated protected buffers for VDA";
+    return base::nullopt;
+  }
+
   visible_rect_ = visible_rect;
   natural_size_ = natural_size;
 

media/gpu/chromeos/vda_video_frame_pool.h

@@ -66,7 +66,8 @@ class VdaVideoFramePool : public DmabufVideoFramePool {
                                              const gfx::Size& coded_size,
                                              const gfx::Rect& visible_rect,
                                              const gfx::Size& natural_size,
-                                             size_t max_num_frames) override;
+                                             size_t max_num_frames,
+                                             bool use_protected) override;
   scoped_refptr<VideoFrame> GetFrame() override;
   bool IsExhausted() override;
   void NotifyWhenFrameAvailable(base::OnceClosure cb) override;

media/gpu/chromeos/video_decoder_pipeline_unittest.cc

@@ -35,12 +35,13 @@ class MockVideoFramePool : public DmabufVideoFramePool {
   ~MockVideoFramePool() override = default;
 
   // DmabufVideoFramePool implementation.
-  MOCK_METHOD5(Initialize,
+  MOCK_METHOD6(Initialize,
                base::Optional<GpuBufferLayout>(const Fourcc&,
                                                const gfx::Size&,
                                                const gfx::Rect&,
                                                const gfx::Size&,
-                                               size_t));
+                                               size_t,
+                                               bool));
   MOCK_METHOD0(GetFrame, scoped_refptr<VideoFrame>());
   MOCK_METHOD0(IsExhausted, bool());
   MOCK_METHOD1(NotifyWhenFrameAvailable, void(base::OnceClosure));

media/gpu/v4l2/v4l2_video_decoder.cc

@@ -347,7 +347,8 @@ bool V4L2VideoDecoder::SetupOutputFormat(const gfx::Size& size,
   if (pool) {
     base::Optional<GpuBufferLayout> layout = pool->Initialize(
         fourcc, adjusted_size, visible_rect,
-        GetNaturalSize(visible_rect, pixel_aspect_ratio_), num_output_frames_);
+        GetNaturalSize(visible_rect, pixel_aspect_ratio_), num_output_frames_,
+        /*use_protected=*/false);
     if (!layout) {
       VLOGF(1) << "Failed to setup format to VFPool";
       return false;

media/gpu/vaapi/vaapi_video_decoder.cc

@@ -468,9 +468,11 @@ void VaapiVideoDecoder::ApplyResolutionChange() {
   CHECK(format);
   auto format_fourcc = Fourcc::FromVideoPixelFormat(*format);
   CHECK(format_fourcc);
-  if (!frame_pool_->Initialize(*format_fourcc, pic_size, visible_rect,
-                               natural_size,
-                               decoder_->GetRequiredNumOfPictures())) {
+  // TODO(jkardatzke): Pass true for the last argument when we are in protected
+  // mode.
+  if (!frame_pool_->Initialize(
+          *format_fourcc, pic_size, visible_rect, natural_size,
+          decoder_->GetRequiredNumOfPictures(), /*use_protected=*/false)) {
     DLOG(WARNING) << "Failed Initialize()ing the frame pool.";
     SetState(State::kError);
     return;

ui/gfx/buffer_types.h

@@ -36,6 +36,8 @@ enum class BufferFormat {
 // by the CPU. SCANOUT implies GPU_READ_WRITE.
 // *_VDA_WRITE is for cases where a video decode accellerator writes into
 // the buffers.
+// PROTECTED_* are for HW protected buffers that cannot be read by the CPU and
+// can only be read in protected GPU contexts or scanned out to overlays.
 
 // TODO(reveman): Add GPU_READ_WRITE for use-cases where SCANOUT is not
 // required.
@@ -47,6 +49,7 @@ enum class BufferUsage {
   CAMERA_AND_CPU_READ_WRITE,
   SCANOUT_CPU_READ_WRITE,
   SCANOUT_VDA_WRITE,
+  PROTECTED_SCANOUT_VDA_WRITE,
   GPU_READ_CPU_READ_WRITE,
   SCANOUT_VEA_CPU_READ,
   SCANOUT_VEA_READ_CAMERA_AND_CPU_READ_WRITE,

ui/gfx/buffer_usage_util.cc

@@ -20,6 +20,8 @@ const char* BufferUsageToString(BufferUsage usage) {
       return "SCANOUT_CPU_READ_WRITE";
     case BufferUsage::SCANOUT_VDA_WRITE:
       return "SCANOUT_VDA_WRITE";
+    case BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
+      return "PROTECTED_SCANOUT_VDA_WRITE";
     case BufferUsage::GPU_READ_CPU_READ_WRITE:
       return "GPU_READ_CPU_READ_WRITE";
     case BufferUsage::SCANOUT_VEA_CPU_READ:

ui/gfx/linux/client_native_pixmap_dmabuf.cc

@@ -159,7 +159,8 @@ bool ClientNativePixmapDmaBuf::IsConfigurationSupported(
           format == gfx::BufferFormat::BGRA_8888 ||
           format == gfx::BufferFormat::RGBX_8888 ||
           format == gfx::BufferFormat::RGBA_8888;
-    case gfx::BufferUsage::SCANOUT_VDA_WRITE:
+    case gfx::BufferUsage::SCANOUT_VDA_WRITE:  // fallthrough
+    case gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
       return false;
 
     case gfx::BufferUsage::GPU_READ_CPU_READ_WRITE:

ui/gfx/linux/client_native_pixmap_factory_dmabuf.cc

@@ -66,6 +66,7 @@ class ClientNativePixmapFactoryDmabuf : public ClientNativePixmapFactory {
       case gfx::BufferUsage::GPU_READ:
       case gfx::BufferUsage::SCANOUT:
       case gfx::BufferUsage::SCANOUT_VDA_WRITE:
+      case gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
         return base::WrapUnique(new ClientNativePixmapOpaque);
     }
     NOTREACHED();

ui/gfx/linux/gbm_defines.h

@@ -19,6 +19,7 @@
 #define GBM_BO_USE_CAMERA_WRITE 0
 #define GBM_BO_USE_HW_VIDEO_DECODER 0
 #define GBM_BO_USE_HW_VIDEO_ENCODER 0
+#define GBM_BO_USE_PROTECTED 0
 #endif
 
 #endif  // UI_GFX_LINUX_GBM_DEFINES_H_

ui/gfx/linux/gbm_util.cc

@@ -25,6 +25,9 @@ uint32_t BufferUsageToGbmFlags(gfx::BufferUsage usage) {
     case gfx::BufferUsage::SCANOUT_VDA_WRITE:
       return GBM_BO_USE_SCANOUT | GBM_BO_USE_TEXTURING |
              GBM_BO_USE_HW_VIDEO_DECODER;
+    case gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
+      return GBM_BO_USE_SCANOUT | GBM_BO_USE_PROTECTED |
+             GBM_BO_USE_HW_VIDEO_DECODER;
     case gfx::BufferUsage::GPU_READ_CPU_READ_WRITE:
       return GBM_BO_USE_LINEAR | GBM_BO_USE_TEXTURING;
     case gfx::BufferUsage::SCANOUT_VEA_CPU_READ:

ui/gfx/mojom/buffer_types.mojom

@@ -33,6 +33,7 @@ enum BufferUsage {
   CAMERA_AND_CPU_READ_WRITE,
   SCANOUT_CPU_READ_WRITE,
   SCANOUT_VDA_WRITE,
+  PROTECTED_SCANOUT_VDA_WRITE,
   GPU_READ_CPU_READ_WRITE,
   SCANOUT_VEA_CPU_READ,
   SCANOUT_VEA_READ_CAMERA_AND_CPU_READ_WRITE,

ui/gfx/mojom/buffer_types_mojom_traits.h

@@ -129,6 +129,8 @@ struct COMPONENT_EXPORT(GFX_SHARED_MOJOM_TRAITS)
         return gfx::mojom::BufferUsage::SCANOUT_CPU_READ_WRITE;
       case gfx::BufferUsage::SCANOUT_VDA_WRITE:
         return gfx::mojom::BufferUsage::SCANOUT_VDA_WRITE;
+      case gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
+        return gfx::mojom::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE;
       case gfx::BufferUsage::GPU_READ_CPU_READ_WRITE:
         return gfx::mojom::BufferUsage::GPU_READ_CPU_READ_WRITE;
       case gfx::BufferUsage::SCANOUT_VEA_CPU_READ:
@@ -161,6 +163,9 @@ struct COMPONENT_EXPORT(GFX_SHARED_MOJOM_TRAITS)
       case gfx::mojom::BufferUsage::SCANOUT_VDA_WRITE:
         *out = gfx::BufferUsage::SCANOUT_VDA_WRITE;
         return true;
+      case gfx::mojom::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE:
+        *out = gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE;
+        return true;
       case gfx::mojom::BufferUsage::GPU_READ_CPU_READ_WRITE:
         *out = gfx::BufferUsage::GPU_READ_CPU_READ_WRITE;
         return true;

ui/ozone/platform/drm/gpu/drm_thread.cc

@@ -152,7 +152,8 @@ void DrmThread::CreateBuffer(gfx::AcceleratedWidget widget,
   // explicitly set via kms on a CRTC (e.g: BufferQueue buffers), therefore
   // allocation should fail if it's not possible to allocate a BO_USE_SCANOUT
   // buffer in that case.
-  if (!*buffer && usage != gfx::BufferUsage::SCANOUT) {
+  if (!*buffer && usage != gfx::BufferUsage::SCANOUT &&
+      usage != gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE) {
     flags &= ~GBM_BO_USE_SCANOUT;
     CreateBufferWithGbmFlags(drm, fourcc_format, size, framebuffer_size, flags,
                              modifiers, buffer, framebuffer);