tegra: dc: hdcp: Fix buffer overflow in driver
[linux-3.10.git] / drivers / video / tegra / dc / hdmihdcp.c
1 /*
2  * drivers/video/tegra/dc/hdmihdcp.c
3  *
4  * Copyright (c) 2014-2017, NVIDIA CORPORATION, All rights reserved.
5  *
6  * This software is licensed under the terms of the GNU General Public
7  * License version 2, as published by the Free Software Foundation, and
8  * may be copied, distributed, and modified under those terms.
9  *
10  * This program is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  * GNU General Public License for more details.
14  *
15  */
16
17 #include <linux/kernel.h>
18 #include <linux/delay.h>
19 #include <linux/i2c.h>
20 #include <linux/miscdevice.h>
21 #include <linux/module.h>
22 #include <linux/poll.h>
23 #include <linux/sched.h>
24 #include <linux/uaccess.h>
25 #include <linux/wait.h>
26 #include <linux/workqueue.h>
27 #include <asm/atomic.h>
28 #include <linux/debugfs.h>
29 #include <linux/delay.h>
30
31 #include <mach/dc.h>
32 #include <mach/kfuse.h>
33
34 #include <video/nvhdcp.h>
35
36 #include "dc_reg.h"
37 #include "dc_priv.h"
38 #include "edid.h"
39 #include "hdmi2.0.h"
40 #include "sor.h"
41 #include "sor_regs.h"
42 #include "hdmihdcp.h"
43 #include "hdmi_reg.h"
44 #include "host1x/host1x01_hardware.h"
45 #include "tsec/tsec.h"
46 #include "class_ids.h"
47 #include "tsec_drv.h"
48 #include "tsec/tsec_methods.h"
49 #include "nvhdcp_hdcp22_methods.h"
50
51 static DECLARE_WAIT_QUEUE_HEAD(wq_worker);
52
53 /* Print no more than 5 messages every minute */
54 static DEFINE_RATELIMIT_STATE(ratelimit, 60*HZ, 5);
55
56 /* for 0x40 Bcaps */
57 #define BCAPS_REPEATER (1 << 6)
58 #define BCAPS_READY (1 << 5)
59 #define BCAPS_11 (1 << 1) /* used for both Bcaps and Ainfo */
60
61 /* for 0x41 Bstatus */
62 #define BSTATUS_MAX_DEVS_EXCEEDED       (1 << 7)
63 #define BSTATUS_MAX_CASCADE_EXCEEDED    (1 << 11)
64
65 /* for HDCP2.2 */
66 #define HDCP_READY                      1
67 #define HDCP_REAUTH                     2
68 #define HDCP_REAUTH_MASK                (1 << 11)
69 #define HDCP_MSG_SIZE_MASK              0x03FF
70 #define HDCP22_PROTOCOL                 1
71 #define HDCP1X_PROTOCOL                 0
72 #define HDCP_INFINITE_RETRIES           -1
73 #define HDCP_DEBUG                      0
74 #define SEQ_NUM_M_MAX_RETRIES           1
75
76 #define HDCP_FALLBACK_1X                0xdeadbeef
77 #define HDCP_NON_22_RX                  0x0300
78
79 #define HDCP_EESS_ENABLE                (0x1)
80 #define HDCP22_EESS_START               (0x201)
81 #define HDCP22_EESS_END                 (0x211)
82 #define HDCP1X_EESS_START               (0x200)
83 #define HDCP1X_EESS_END                 (0x210)
84 #define HDMI_VSYNC_WINDOW               (0xc2)
85
86 #define HDCP_SERVICE_UUID               {0x13F616F9, 0x4A6F8572,\
87                                  0xAA04F1A1, 0xFFF9059B}
88 #define HDCP_PKT_SIZE                   32
89 #define HDCP_SESSION_SUCCESS            0
90 #define HDCP_SESSION_FAILURE            1
91 #define HDCP_CMAC_OFFSET                6
92 #define HDCP_TSEC_ADDR_OFFSET           22
93 #define HDCP_CMD_GEN_CMAC               0xA
94
95 #ifdef VERBOSE_DEBUG
96 #define nvhdcp_vdbg(...)        \
97                 pr_debug("nvhdcp: " __VA_ARGS__)
98 #else
99 #define nvhdcp_vdbg(...)                \
100 ({                                              \
101         if (0)                                  \
102                 pr_debug("nvhdcp: " __VA_ARGS__); \
103         0;                                      \
104 })
105 #endif
106 #define nvhdcp_debug(...)       \
107                 pr_debug("nvhdcp: " __VA_ARGS__)
108 #define nvhdcp_err(...) \
109                 if (__ratelimit(&ratelimit)) \
110                         pr_err("nvhdcp: Error: " __VA_ARGS__)
111 #define nvhdcp_info(...)        \
112                 pr_info("nvhdcp: " __VA_ARGS__)
113
114 static u8 g_seq_num_m_retries;
115 static u8 g_fallback;
116
117 static struct tegra_dc *tegra_dc_hdmi_get_dc(struct tegra_hdmi *hdmi)
118 {
119         return hdmi ? hdmi->dc : NULL;
120 }
121
122 static inline u32 nvhdcp_sor_readl(struct tegra_hdmi *hdmi, u32 reg)
123 {
124         return readl(hdmi->sor->base + reg * 4);
125 }
126
127 static inline void nvhdcp_sor_writel(struct tegra_hdmi *hdmi,
128         u32 val, u32 reg)
129 {
130         writel(val, hdmi->sor->base + reg * 4);
131 }
132
133 static inline bool nvhdcp_is_plugged(struct tegra_nvhdcp *nvhdcp)
134 {
135         rmb();
136         return nvhdcp->plugged;
137 }
138
139 static inline bool nvhdcp_set_plugged(struct tegra_nvhdcp *nvhdcp, bool plugged)
140 {
141         nvhdcp->plugged = plugged;
142         wmb();
143         return plugged;
144 }
145
146 static int nvhdcp_i2c_read(struct tegra_nvhdcp *nvhdcp, u8 reg,
147                                         size_t len, void *data)
148 {
149         int status;
150         int retries = 11;
151         struct i2c_msg msg[] = {
152                 {
153                         .addr = 0x74 >> 1, /* primary link */
154                         .flags = 0,
155                         .len = 1,
156                         .buf = &reg,
157                 },
158                 {
159                         .addr = 0x74 >> 1, /* primary link */
160                         .flags = I2C_M_RD,
161                         .len = len,
162                         .buf = data,
163                 },
164         };
165         struct tegra_dc *dc = tegra_dc_hdmi_get_dc(nvhdcp->hdmi);
166
167         if (dc->vedid)
168                 goto skip_hdcp_i2c;
169
170         tegra_dc_ddc_enable(dc, true);
171         do {
172                 mutex_lock(&nvhdcp->lock);
173                 if (!nvhdcp_is_plugged(nvhdcp)) {
174                         nvhdcp_err("disconnect during i2c xfer\n");
175                         mutex_unlock(&nvhdcp->lock);
176                         tegra_dc_ddc_enable(dc, false);
177                         return -EIO;
178                 }
179                 mutex_unlock(&nvhdcp->lock);
180                 status = i2c_transfer(nvhdcp->client->adapter,
181                         msg, ARRAY_SIZE(msg));
182                 if ((status < 0) && (retries > 1))
183                         msleep(250);
184         } while ((status < 0) && retries--);
185         tegra_dc_ddc_enable(dc, false);
186
187         if (status < 0) {
188                 nvhdcp_err("i2c xfer error %d\n", status);
189                 return status;
190         }
191
192         return 0;
193
194 skip_hdcp_i2c:
195         nvhdcp_err("vedid active\n");
196         return -EIO;
197 }
198
199 static int nvhdcp_i2c_write(struct tegra_nvhdcp *nvhdcp, u8 reg,
200                                         size_t len, const void *data)
201 {
202         int status;
203         u8 buf[len + 1];
204         struct i2c_msg msg[] = {
205                 {
206                         .addr = 0x74 >> 1, /* primary link */
207                         .flags = 0,
208                         .len = len + 1,
209                         .buf = buf,
210                 },
211         };
212         int retries = 15;
213         struct tegra_dc *dc = tegra_dc_hdmi_get_dc(nvhdcp->hdmi);
214
215         if (dc->vedid)
216                 goto skip_hdcp_i2c;
217
218         buf[0] = reg;
219         memcpy(buf + 1, data, len);
220
221         tegra_dc_ddc_enable(dc, true);
222         do {
223                 mutex_lock(&nvhdcp->lock);
224                 if (!nvhdcp_is_plugged(nvhdcp)) {
225                         nvhdcp_err("disconnect during i2c xfer\n");
226                         mutex_unlock(&nvhdcp->lock);
227                         tegra_dc_ddc_enable(dc, false);
228                         return -EIO;
229                 }
230                 mutex_unlock(&nvhdcp->lock);
231                 status = i2c_transfer(nvhdcp->client->adapter,
232                         msg, ARRAY_SIZE(msg));
233                 if ((status < 0) && (retries > 1))
234                         msleep(250);
235         } while ((status < 0) && retries--);
236         tegra_dc_ddc_enable(dc, false);
237
238         if (status < 0) {
239                 nvhdcp_err("i2c xfer error %d\n", status);
240                 return status;
241         }
242
243         return 0;
244
245 skip_hdcp_i2c:
246         nvhdcp_err("vedid active\n");
247         return -EIO;
248 }
249
250 static inline int nvhdcp_i2c_read8(struct tegra_nvhdcp *nvhdcp, u8 reg, u8 *val)
251 {
252         return nvhdcp_i2c_read(nvhdcp, reg, 1, val);
253 }
254
255 static inline int nvhdcp_i2c_write8(struct tegra_nvhdcp *nvhdcp, u8 reg, u8 val)
256 {
257         return nvhdcp_i2c_write(nvhdcp, reg, 1, &val);
258 }
259
260 static inline int nvhdcp_i2c_read16(struct tegra_nvhdcp *nvhdcp,
261                                         u8 reg, u16 *val)
262 {
263         u8 buf[2];
264         int e;
265
266         e = nvhdcp_i2c_read(nvhdcp, reg, sizeof(buf), buf);
267         if (e)
268                 return e;
269
270         if (val)
271                 *val = buf[0] | (u16)buf[1] << 8;
272
273         return 0;
274 }
275
276 static int nvhdcp_i2c_read40(struct tegra_nvhdcp *nvhdcp, u8 reg, u64 *val)
277 {
278         u8 buf[5];
279         int e, i;
280         u64 n;
281
282         e = nvhdcp_i2c_read(nvhdcp, reg, sizeof(buf), buf);
283         if (e)
284                 return e;
285
286         for (i = 0, n = 0; i < 5; i++) {
287                 n <<= 8;
288                 n |= buf[4 - i];
289         }
290
291         if (val)
292                 *val = n;
293
294         return 0;
295 }
296
297 static int nvhdcp_i2c_write40(struct tegra_nvhdcp *nvhdcp, u8 reg, u64 val)
298 {
299         char buf[5];
300         int i;
301         for (i = 0; i < 5; i++) {
302                 buf[i] = val;
303                 val >>= 8;
304         }
305         return nvhdcp_i2c_write(nvhdcp, reg, sizeof(buf), buf);
306 }
307
308 static int nvhdcp_i2c_write64(struct tegra_nvhdcp *nvhdcp, u8 reg, u64 val)
309 {
310         char buf[8];
311         int i;
312         for (i = 0; i < 8; i++) {
313                 buf[i] = val;
314                 val >>= 8;
315         }
316         return nvhdcp_i2c_write(nvhdcp, reg, sizeof(buf), buf);
317 }
318
319 /* 64-bit link encryption session random number */
320 static inline u64 get_an(struct tegra_hdmi *hdmi)
321 {
322         u64 r;
323         r = (u64)nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_AN_MSB) << 32;
324         r |= nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_AN_LSB);
325         return r;
326 }
327
328 /* 64-bit upstream exchange random number */
329 static inline void set_cn(struct tegra_hdmi *hdmi, u64 c_n)
330 {
331         nvhdcp_sor_writel(hdmi, (u32)c_n, NV_SOR_TMDS_HDCP_CN_LSB);
332         nvhdcp_sor_writel(hdmi, c_n >> 32, NV_SOR_TMDS_HDCP_CN_MSB);
333 }
334
335
336 /* 40-bit transmitter's key selection vector */
337 static inline u64 get_aksv(struct tegra_hdmi *hdmi)
338 {
339         u64 r;
340         r = (u64)nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_AKSV_MSB) << 32;
341         r |= nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_AKSV_LSB);
342         return r;
343 }
344
345 /* 40-bit receiver's key selection vector */
346 static inline void set_bksv(struct tegra_hdmi *hdmi, u64 b_ksv, bool repeater)
347 {
348         if (repeater)
349                 b_ksv |= (u64)REPEATER << 32;
350         nvhdcp_sor_writel(hdmi, (u32)b_ksv, NV_SOR_TMDS_HDCP_BKSV_LSB);
351         nvhdcp_sor_writel(hdmi, b_ksv >> 32, NV_SOR_TMDS_HDCP_BKSV_MSB);
352 }
353
354
355 /* 40-bit software's key selection vector */
356 static inline void set_cksv(struct tegra_hdmi *hdmi, u64 c_ksv)
357 {
358         nvhdcp_sor_writel(hdmi, (u32)c_ksv, NV_SOR_TMDS_HDCP_CKSV_LSB);
359         nvhdcp_sor_writel(hdmi, c_ksv >> 32, NV_SOR_TMDS_HDCP_CKSV_MSB);
360 }
361
362 /* 40-bit connection state */
363 static inline u64 get_cs(struct tegra_hdmi *hdmi)
364 {
365         u64 r;
366         r = (u64)nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_CS_MSB) << 32;
367         r |= nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_CS_LSB);
368         return r;
369 }
370
371 /* 40-bit upstream key selection vector */
372 static inline u64 get_dksv(struct tegra_hdmi *hdmi)
373 {
374         u64 r;
375         r = (u64)nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_DKSV_MSB) << 32;
376         r |= nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_DKSV_LSB);
377         return r;
378 }
379
380 /* 64-bit encrypted M0 value */
381 static inline u64 get_mprime(struct tegra_hdmi *hdmi)
382 {
383         u64 r;
384         r = (u64)nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_MPRIME_MSB) << 32;
385         r |= nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_MPRIME_LSB);
386         return r;
387 }
388
389 static inline u16 get_transmitter_ri(struct tegra_hdmi *hdmi)
390 {
391         return nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_RI);
392 }
393
394 static inline int get_receiver_ri(struct tegra_nvhdcp *nvhdcp, u16 *r)
395 {
396         return nvhdcp_i2c_read16(nvhdcp, 0x8, r); /* long read */
397 }
398
399 static int get_bcaps(struct tegra_nvhdcp *nvhdcp, u8 *b_caps)
400 {
401         return nvhdcp_i2c_read8(nvhdcp, 0x40, b_caps);
402 }
403
404 static int get_ksvfifo(struct tegra_nvhdcp *nvhdcp,
405                                         unsigned num_bksv_list, u64 *ksv_list)
406 {
407         u8 *buf, *p;
408         int e;
409         unsigned i;
410         size_t buf_len = num_bksv_list * 5;
411
412         if (!ksv_list || num_bksv_list > TEGRA_NVHDCP_MAX_DEVS)
413                 return -EINVAL;
414
415         if (num_bksv_list == 0)
416                 return 0;
417
418         buf = kmalloc(buf_len, GFP_KERNEL);
419         if (IS_ERR_OR_NULL(buf))
420                 return -ENOMEM;
421
422         e = nvhdcp_i2c_read(nvhdcp, 0x43, buf_len, buf);
423         if (e) {
424                 kfree(buf);
425                 return e;
426         }
427
428         /* load 40-bit keys from repeater into array of u64 */
429         p = buf;
430         for (i = 0; i < num_bksv_list; i++) {
431                 ksv_list[i] = p[0] | ((u64)p[1] << 8) | ((u64)p[2] << 16)
432                                 | ((u64)p[3] << 24) | ((u64)p[4] << 32);
433                 p += 5;
434         }
435
436         kfree(buf);
437         return 0;
438 }
439
440 /* get V' 160-bit SHA-1 hash from repeater */
441 static int get_vprime(struct tegra_nvhdcp *nvhdcp, u8 *v_prime)
442 {
443         int e, i;
444
445         for (i = 0; i < 20; i += 4) {
446                 e = nvhdcp_i2c_read(nvhdcp, 0x20 + i, 4, v_prime + i);
447                 if (e)
448                         return e;
449         }
450         return 0;
451 }
452
453
454 /* set or clear RUN_YES */
455 static void hdcp_ctrl_run(struct tegra_hdmi *hdmi, bool v)
456 {
457         u32 ctrl;
458
459         if (v) {
460                 ctrl = nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_CTRL);
461                 ctrl |= HDCP_RUN_YES;
462         } else {
463                 ctrl = 0;
464         }
465
466         nvhdcp_sor_writel(hdmi, ctrl, NV_SOR_TMDS_HDCP_CTRL);
467 }
468
469 /* wait for any bits in mask to be set in NV_SOR_TMDS_HDCP_CTRL
470  * sleeps up to 120mS */
471 static int wait_hdcp_ctrl(struct tegra_hdmi *hdmi, u32 mask, u32 *v)
472 {
473         int retries = 13;
474         u32 ctrl;
475
476         do {
477                 ctrl = nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_CTRL);
478                 if ((ctrl & mask)) {
479                         if (v)
480                                 *v = ctrl;
481                         break;
482                 }
483                 if (retries > 1)
484                         usleep_range(10, 15);
485         } while (--retries);
486         if (!retries) {
487                 nvhdcp_err("ctrl read timeout (mask=0x%x)\n", mask);
488                 return -EIO;
489         }
490         return 0;
491 }
492
493 /* wait for bits in mask to be set to value in NV_SOR_KEY_CTRL
494  * waits up to 100mS */
495 static int wait_key_ctrl(struct tegra_hdmi *hdmi, u32 mask, u32 value)
496 {
497         int retries = 101;
498         u32 ctrl;
499
500         do {
501                 usleep_range(1, 2);
502                 ctrl = nvhdcp_sor_readl(hdmi, NV_SOR_KEY_CTRL);
503                 if (((ctrl ^ value) & mask) == 0)
504                         break;
505         } while (--retries);
506         if (!retries) {
507                 nvhdcp_err("key ctrl read timeout (mask=0x%x)\n", mask);
508                 return -EIO;
509         }
510         return 0;
511 }
512
513 /* check that key selection vector is well formed.
514  * NOTE: this function assumes KSV has already been checked against
515  * revocation list.
516  */
517 static int verify_ksv(u64 k)
518 {
519         unsigned i;
520
521         /* count set bits, must be exactly 20 set to be valid */
522         for (i = 0; k; i++)
523                 k ^= k & -k;
524
525         return  (i != 20) ? -EINVAL : 0;
526 }
527
528 static int get_nvhdcp_state(struct tegra_nvhdcp *nvhdcp,
529                         struct tegra_nvhdcp_packet *pkt)
530 {
531         int     i;
532
533         mutex_lock(&nvhdcp->lock);
534         if (nvhdcp->state != STATE_LINK_VERIFY) {
535                 memset(pkt, 0, sizeof(*pkt));
536                 pkt->packet_results = TEGRA_NVHDCP_RESULT_LINK_FAILED;
537         } else {
538                 pkt->num_bksv_list = nvhdcp->num_bksv_list;
539                 for (i = 0; i < pkt->num_bksv_list; i++)
540                         pkt->bksv_list[i] = nvhdcp->bksv_list[i];
541                 pkt->b_status = nvhdcp->b_status;
542                 pkt->b_ksv = nvhdcp->b_ksv;
543                 memcpy(pkt->v_prime, nvhdcp->v_prime, sizeof(nvhdcp->v_prime));
544                 pkt->packet_results = TEGRA_NVHDCP_RESULT_SUCCESS;
545                 pkt->hdcp22 = nvhdcp->hdcp22;
546                 pkt->port = TEGRA_NVHDCP_PORT_HDMI;
547         }
548         mutex_unlock(&nvhdcp->lock);
549         return 0;
550 }
551
552 /* get Status and Kprime signature - READ_S on TMDS0_LINK0 only */
553 static int get_s_prime(struct tegra_nvhdcp *nvhdcp,
554                         struct tegra_nvhdcp_packet *pkt)
555 {
556         struct tegra_hdmi *hdmi = nvhdcp->hdmi;
557         u32 sp_msb, sp_lsb1, sp_lsb2;
558         int e;
559
560         /* if connection isn't authenticated ... */
561         mutex_lock(&nvhdcp->lock);
562         if (nvhdcp->state != STATE_LINK_VERIFY) {
563                 memset(pkt, 0, sizeof(*pkt));
564                 pkt->packet_results = TEGRA_NVHDCP_RESULT_LINK_FAILED;
565                 e = 0;
566                 goto err;
567         }
568
569         pkt->packet_results = TEGRA_NVHDCP_RESULT_UNSUCCESSFUL;
570
571         /* we will be taking c_n, c_ksv as input */
572         if (!(pkt->value_flags & TEGRA_NVHDCP_FLAG_CN)
573                         || !(pkt->value_flags & TEGRA_NVHDCP_FLAG_CKSV)) {
574                 nvhdcp_err("missing value_flags (0x%x)\n", pkt->value_flags);
575                 e = -EINVAL;
576                 goto err;
577         }
578
579         pkt->value_flags = 0;
580
581         pkt->a_ksv = nvhdcp->a_ksv;
582         pkt->a_n = nvhdcp->a_n;
583         pkt->value_flags = TEGRA_NVHDCP_FLAG_AKSV | TEGRA_NVHDCP_FLAG_AN;
584
585         nvhdcp_vdbg("%s():cn %llx cksv %llx\n", __func__, pkt->c_n, pkt->c_ksv);
586
587         set_cn(hdmi, pkt->c_n);
588
589         nvhdcp_sor_writel(hdmi, TMDS0_LINK0 | READ_S,
590                                         NV_SOR_TMDS_HDCP_CMODE);
591
592         set_cksv(hdmi, pkt->c_ksv);
593
594         e = wait_hdcp_ctrl(hdmi, SPRIME_VALID, NULL);
595         if (e) {
596                 nvhdcp_err("Sprime read timeout\n");
597                 pkt->packet_results = TEGRA_NVHDCP_RESULT_UNSUCCESSFUL;
598                 e = -EIO;
599                 goto err;
600         }
601
602         msleep(50);
603
604         /* read 56-bit Sprime plus 16 status bits */
605         sp_msb = nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_SPRIME_MSB);
606         sp_lsb1 = nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_SPRIME_LSB1);
607         sp_lsb2 = nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_SPRIME_LSB2);
608
609         /* top 8 bits of LSB2 and bottom 8 bits of MSB hold status bits. */
610         pkt->hdcp_status = (sp_msb << 8) | (sp_lsb2 >> 24);
611         pkt->value_flags |= TEGRA_NVHDCP_FLAG_S;
612
613         /* 56-bit Kprime */
614         pkt->k_prime = ((u64)(sp_lsb2 & 0xffffff) << 32) | sp_lsb1;
615         pkt->value_flags |= TEGRA_NVHDCP_FLAG_KP;
616
617         /* is connection state supported? */
618         if (sp_msb & STATUS_CS) {
619                 pkt->cs = get_cs(hdmi);
620                 pkt->value_flags |= TEGRA_NVHDCP_FLAG_CS;
621         }
622
623         /* load Dksv */
624         pkt->d_ksv = get_dksv(hdmi);
625         if (verify_ksv(pkt->d_ksv)) {
626                 nvhdcp_err("Dksv invalid!\n");
627                 pkt->packet_results = TEGRA_NVHDCP_RESULT_UNSUCCESSFUL;
628                 e = -EIO; /* treat bad Dksv as I/O error */
629         }
630         pkt->value_flags |= TEGRA_NVHDCP_FLAG_DKSV;
631
632         /* copy current Bksv */
633         pkt->b_ksv = nvhdcp->b_ksv;
634         pkt->value_flags |= TEGRA_NVHDCP_FLAG_BKSV;
635
636         pkt->packet_results = TEGRA_NVHDCP_RESULT_SUCCESS;
637         mutex_unlock(&nvhdcp->lock);
638         return 0;
639
640 err:
641         mutex_unlock(&nvhdcp->lock);
642         return e;
643 }
644
645 /* get M prime - READ_M on TMDS0_LINK0 only */
646 static inline int get_m_prime(struct tegra_nvhdcp *nvhdcp,
647                                 struct tegra_nvhdcp_packet *pkt)
648 {
649         struct tegra_hdmi *hdmi = nvhdcp->hdmi;
650         int e;
651
652         pkt->packet_results = TEGRA_NVHDCP_RESULT_UNSUCCESSFUL;
653
654         /* if connection isn't authenticated ... */
655         mutex_lock(&nvhdcp->lock);
656         if (nvhdcp->state != STATE_LINK_VERIFY) {
657                 memset(pkt, 0, sizeof(*pkt));
658                 pkt->packet_results = TEGRA_NVHDCP_RESULT_LINK_FAILED;
659                 e = 0;
660                 goto err;
661         }
662
663         pkt->a_ksv = nvhdcp->a_ksv;
664         pkt->a_n = nvhdcp->a_n;
665         pkt->value_flags = TEGRA_NVHDCP_FLAG_AKSV | TEGRA_NVHDCP_FLAG_AN;
666
667         set_cn(hdmi, pkt->c_n);
668
669         nvhdcp_sor_writel(hdmi, TMDS0_LINK0 | READ_M,
670                                         NV_SOR_TMDS_HDCP_CMODE);
671
672         /* Cksv write triggers Mprime update */
673         set_cksv(hdmi, pkt->c_ksv);
674
675         e = wait_hdcp_ctrl(hdmi, MPRIME_VALID, NULL);
676         if (e) {
677                 nvhdcp_err("Mprime read timeout\n");
678                 e = -EIO;
679                 goto err;
680         }
681         msleep(50);
682
683         /* load Mprime */
684         pkt->m_prime = get_mprime(hdmi);
685         pkt->value_flags |= TEGRA_NVHDCP_FLAG_MP;
686
687         pkt->b_status = nvhdcp->b_status;
688         pkt->value_flags |= TEGRA_NVHDCP_FLAG_BSTATUS;
689
690         /* copy most recent KSVFIFO, if it is non-zero */
691         pkt->num_bksv_list = nvhdcp->num_bksv_list;
692         if (nvhdcp->num_bksv_list) {
693                 BUILD_BUG_ON(sizeof(pkt->bksv_list) !=
694                                 sizeof(nvhdcp->bksv_list));
695                 memcpy(pkt->bksv_list, nvhdcp->bksv_list,
696                         nvhdcp->num_bksv_list * sizeof(*pkt->bksv_list));
697                 pkt->value_flags |= TEGRA_NVHDCP_FLAG_BKSVLIST;
698         }
699
700         /* copy v_prime */
701         BUILD_BUG_ON(sizeof(pkt->v_prime) != sizeof(nvhdcp->v_prime));
702         memcpy(pkt->v_prime, nvhdcp->v_prime, sizeof(nvhdcp->v_prime));
703         pkt->value_flags |= TEGRA_NVHDCP_FLAG_V;
704
705         /* load Dksv */
706         pkt->d_ksv = get_dksv(hdmi);
707         if (verify_ksv(pkt->d_ksv)) {
708                 nvhdcp_err("Dksv invalid!\n");
709                 e = -EIO;
710                 goto err;
711         }
712         pkt->value_flags |= TEGRA_NVHDCP_FLAG_DKSV;
713
714         /* copy current Bksv */
715         pkt->b_ksv = nvhdcp->b_ksv;
716         pkt->value_flags |= TEGRA_NVHDCP_FLAG_BKSV;
717
718         pkt->packet_results = TEGRA_NVHDCP_RESULT_SUCCESS;
719         mutex_unlock(&nvhdcp->lock);
720         return 0;
721
722 err:
723         mutex_unlock(&nvhdcp->lock);
724         return e;
725 }
726
727 static int load_kfuse(struct tegra_hdmi *hdmi)
728 {
729         unsigned buf[KFUSE_DATA_SZ / 4];
730         int e, i;
731         u32 ctrl;
732         u32 tmp;
733         int retries;
734
735         /* copy load kfuse into buffer - only needed for early Tegra parts */
736         e = tegra_kfuse_read(buf, sizeof(buf));
737         if (e) {
738                 nvhdcp_err("Kfuse read failure\n");
739                 return e;
740         }
741
742         /* write the kfuse to HDMI SRAM */
743
744         nvhdcp_sor_writel(hdmi, 1, NV_SOR_KEY_CTRL); /* LOAD_KEYS */
745
746         /* issue a reload */
747         ctrl = nvhdcp_sor_readl(hdmi, NV_SOR_KEY_CTRL);
748         nvhdcp_sor_writel(hdmi, ctrl | PKEY_RELOAD_TRIGGER
749                                         | LOCAL_KEYS , NV_SOR_KEY_CTRL);
750
751         e = wait_key_ctrl(hdmi, PKEY_LOADED, PKEY_LOADED);
752         if (e) {
753                 nvhdcp_err("key reload timeout\n");
754                 return -EIO;
755         }
756
757         nvhdcp_sor_writel(hdmi, 0, NV_SOR_KEY_SKEY_INDEX);
758
759         /* wait for SRAM to be cleared */
760         retries = 6;
761         do {
762                 tmp = nvhdcp_sor_readl(hdmi, NV_SOR_KEY_DEBUG0);
763                 if ((tmp & 1) == 0)
764                         break;
765                 if (retries > 1)
766                         mdelay(1);
767         } while (--retries);
768         if (!retries) {
769                 nvhdcp_err("key SRAM clear timeout\n");
770                 return -EIO;
771         }
772
773         for (i = 0; i < KFUSE_DATA_SZ / 4; i += 4) {
774
775                 /* load 128-bits*/
776                 nvhdcp_sor_writel(hdmi, buf[i], NV_SOR_KEY_HDCP_KEY_0);
777                 nvhdcp_sor_writel(hdmi, buf[i+1], NV_SOR_KEY_HDCP_KEY_1);
778                 nvhdcp_sor_writel(hdmi, buf[i+2], NV_SOR_KEY_HDCP_KEY_2);
779                 nvhdcp_sor_writel(hdmi, buf[i+3], NV_SOR_KEY_HDCP_KEY_3);
780
781                 /* trigger LOAD_HDCP_KEY */
782                 nvhdcp_sor_writel(hdmi, 0x100, NV_SOR_KEY_HDCP_KEY_TRIG);
783
784                 tmp = LOCAL_KEYS | WRITE16;
785                 if (i)
786                         tmp |= AUTOINC;
787                 nvhdcp_sor_writel(hdmi, tmp, NV_SOR_KEY_CTRL);
788
789                 /* wait for WRITE16 to complete */
790                 e = wait_key_ctrl(hdmi, 0x10, 0); /* WRITE16 */
791                 if (e) {
792                         nvhdcp_err("key write timeout\n");
793                         return -EIO;
794                 }
795         }
796
797         return 0;
798 }
799
800 static int verify_link(struct tegra_nvhdcp *nvhdcp, bool wait_ri)
801 {
802         struct tegra_hdmi *hdmi = nvhdcp->hdmi;
803         int retries = 3;
804         u16 old, rx, tx;
805         int e;
806
807         old = 0;
808         rx = 0;
809         tx = 0;
810         /* retry 3 times to deal with I2C link issues */
811         do {
812                 if (wait_ri)
813                         old = get_transmitter_ri(hdmi);
814
815                 e = get_receiver_ri(nvhdcp, &rx);
816                 if (!e) {
817                         if (!rx) {
818                                 nvhdcp_err("Ri is 0!\n");
819                                 return -EINVAL;
820                         }
821
822                         tx = get_transmitter_ri(hdmi);
823                 } else {
824                         rx = ~tx;
825                         msleep(50);
826                 }
827
828         } while (wait_ri && --retries && old != tx);
829
830         nvhdcp_debug("R0 Ri poll:rx=0x%04x tx=0x%04x\n", rx, tx);
831
832         mutex_lock(&nvhdcp->lock);
833         if (!nvhdcp_is_plugged(nvhdcp)) {
834                 nvhdcp_err("aborting verify links - lost hdmi connection\n");
835                 mutex_unlock(&nvhdcp->lock);
836                 return -EIO;
837         }
838         mutex_unlock(&nvhdcp->lock);
839
840         if (rx != tx)
841                 return -EINVAL;
842
843         return 0;
844 }
845
846 static int get_repeater_info(struct tegra_nvhdcp *nvhdcp)
847 {
848         int e, retries;
849         u8 b_caps;
850         u16 b_status;
851
852         nvhdcp_vdbg("repeater found:fetching repeater info\n");
853
854         /* wait up to 5 seconds for READY on repeater */
855         retries = 51;
856         do {
857                 mutex_lock(&nvhdcp->lock);
858                 if (!nvhdcp_is_plugged(nvhdcp)) {
859                         nvhdcp_err("disconnect while waiting for repeater\n");
860                         mutex_unlock(&nvhdcp->lock);
861                         return -EIO;
862                 }
863                 mutex_unlock(&nvhdcp->lock);
864
865                 e = get_bcaps(nvhdcp, &b_caps);
866                 if (!e && (b_caps & BCAPS_READY)) {
867                         nvhdcp_debug("Bcaps READY from repeater\n");
868                         break;
869                 }
870                 if (retries > 1)
871                         msleep(100);
872         } while (--retries);
873         if (!retries) {
874                 nvhdcp_err("repeater Bcaps read timeout\n");
875                 return -ETIMEDOUT;
876         }
877
878         e = nvhdcp_i2c_read16(nvhdcp, 0x41, &b_status);
879         if (e) {
880                 nvhdcp_err("Bstatus read failure!\n");
881                 return e;
882         }
883
884         if (b_status & BSTATUS_MAX_DEVS_EXCEEDED) {
885                 nvhdcp_err("repeater:max devices (0x%04x)\n", b_status);
886                 return -EINVAL;
887         }
888
889         if (b_status & BSTATUS_MAX_CASCADE_EXCEEDED) {
890                 nvhdcp_err("repeater:max cascade (0x%04x)\n", b_status);
891                 return -EINVAL;
892         }
893
894         nvhdcp->b_status = b_status;
895         nvhdcp->num_bksv_list = b_status & 0x7f;
896         nvhdcp_vdbg("Bstatus 0x%x (devices: %d)\n",
897                                 b_status, nvhdcp->num_bksv_list);
898
899         memset(nvhdcp->bksv_list, 0, sizeof(nvhdcp->bksv_list));
900         e = get_ksvfifo(nvhdcp, nvhdcp->num_bksv_list, nvhdcp->bksv_list);
901         if (e) {
902                 nvhdcp_err("repeater:could not read KSVFIFO (err %d)\n", e);
903                 return e;
904         }
905
906         memset(nvhdcp->v_prime, 0, sizeof(nvhdcp->v_prime));
907         e = get_vprime(nvhdcp, nvhdcp->v_prime);
908         if (e) {
909                 nvhdcp_err("repeater Vprime read failure!\n");
910                 return e;
911         }
912
913         return 0;
914 }
915
916 static int nvhdcp_ake_init_send(struct tegra_nvhdcp *nvhdcp, u8 *buf)
917 {
918         int e;
919         e = nvhdcp_i2c_write(nvhdcp, 0x60, SIZE_AKE_INIT, buf);
920         return e;
921 }
922
923 static int nvhdcp_ake_cert_receive(struct tegra_nvhdcp *nvhdcp, u8 *buf)
924 {
925         int e;
926         e = nvhdcp_i2c_read(nvhdcp, 0x80, SIZE_AKE_SEND_CERT, buf);
927         return e;
928 }
929
930 static int nvhdcp_ake_no_stored_km_send(struct tegra_nvhdcp *nvhdcp, u8 *buf)
931 {
932         int e;
933         e = nvhdcp_i2c_write(nvhdcp, 0x60, SIZE_AKE_NO_STORED_KM, buf);
934         return e;
935 }
936
937 static int nvhdcp_ake_hprime_receive(struct tegra_nvhdcp *nvhdcp, u8 *buf)
938 {
939         int e;
940         e = nvhdcp_i2c_read(nvhdcp, 0x80, SIZE_AKE_SEND_HPRIME, buf);
941         return e;
942 }
943
944 static int nvhdcp_ake_pairing_info_receive(struct tegra_nvhdcp *nvhdcp,
945         u8 *buf)
946 {
947         int e;
948         e = nvhdcp_i2c_read(nvhdcp, 0x80, SIZE_AKE_SEND_PAIRING_INFO, buf);
949         return e;
950 }
951
952 static int nvhdcp_lc_init_send(struct tegra_nvhdcp *nvhdcp, u8 *buf)
953 {
954         int e;
955         e = nvhdcp_i2c_write(nvhdcp, 0x60, SIZE_LC_INIT, buf);
956         return e;
957 }
958
959 static int nvhdcp_lc_lprime_receive(struct tegra_nvhdcp *nvhdcp, u8 *buf)
960 {
961         int e;
962         e = nvhdcp_i2c_read(nvhdcp, 0x80, SIZE_LC_SEND_LPRIME, buf);
963         return e;
964 }
965
966 static int nvhdcp_ske_eks_send(struct tegra_nvhdcp *nvhdcp, u8 *buf)
967 {
968         int e;
969         e = nvhdcp_i2c_write(nvhdcp, 0x60, SIZE_SKE_SEND_EKS, buf);
970         return e;
971 }
972
973 static int nvhdcp_receiverid_list_receive(struct tegra_nvhdcp *nvhdcp, u8 *buf)
974 {
975         int e;
976         e = nvhdcp_i2c_read(nvhdcp, 0x80, SIZE_SEND_RCVR_ID_LIST, buf);
977         return e;
978 }
979
980 static int nvhdcp_rptr_ack_send(struct tegra_nvhdcp *nvhdcp, u8 *buf)
981 {
982         int e;
983         e = nvhdcp_i2c_write(nvhdcp, 0x60, SIZE_SEND_RPTR_ACK, buf);
984         return e;
985 }
986
987 static int nvhdcp_rptr_stream_manage_send(struct tegra_nvhdcp *nvhdcp,
988         u8 *buf)
989 {
990         int e;
991         e = nvhdcp_i2c_write(nvhdcp, 0x60, SIZE_SEND_RPTR_STREAM_MANAGE, buf);
992         return e;
993 }
994
995 static int nvhdcp_rptr_stream_ready_receive(struct tegra_nvhdcp *nvhdcp,
996         u8 *buf)
997 {
998         int e;
999         e = nvhdcp_i2c_read(nvhdcp, 0x80, SIZE_SEND_RPTR_STREAM_READY, buf);
1000         return e;
1001 }
1002
1003 static int nvhdcp_poll(struct tegra_nvhdcp *nvhdcp, int timeout, int status)
1004 {
1005         int e;
1006         u16 val;
1007         s64 start_time;
1008         s64 end_time;
1009         struct timespec tm;
1010         ktime_get_ts(&tm);
1011         start_time = timespec_to_ns(&tm);
1012         while (1) {
1013                 ktime_get_ts(&tm);
1014                 end_time = timespec_to_ns(&tm);
1015                 if ((end_time - start_time)/1000 >= timeout*1000)
1016                         return -ETIMEDOUT;
1017                 else {
1018                         e = nvhdcp_i2c_read(nvhdcp, 0x70, 2, &val);
1019                         if (e) {
1020                                 nvhdcp_err("nvhdcp_poll_ready failed\n");
1021                                 goto exit;
1022                         }
1023                         if (status == HDCP_READY) {
1024                                 if (val & HDCP_MSG_SIZE_MASK)
1025                                         break;
1026                         } else if (status == HDCP_REAUTH) {
1027                                 if (cpu_to_be16(val) & HDCP_REAUTH_MASK)
1028                                         break;
1029                         }
1030                 }
1031         }
1032         e = 0;
1033 exit:
1034         return e;
1035 }
1036
1037 static int nvhdcp_poll_ready(struct tegra_nvhdcp *nvhdcp, int timeout)
1038 {
1039         int e;
1040         e = nvhdcp_poll(nvhdcp, timeout, HDCP_READY);
1041         return e;
1042 }
1043
1044 static int tsec_hdcp_authentication(struct tegra_nvhdcp *nvhdcp,
1045                                 struct hdcp_context_t *hdcp_context)
1046 {
1047         int err = 0;
1048         u8 version = 2;
1049         u16 caps = 0;
1050         u16 txcaps = 0x0;
1051         uint8_t *pkt = NULL;
1052 #if defined(CONFIG_TRUSTED_LITTLE_KERNEL)
1053         unsigned char nonce[HDCP_NONCE_SIZE];
1054         uint32_t hdcp_uuid[4] = HDCP_SERVICE_UUID;
1055         u32 session_id = 0;
1056 #endif
1057
1058         err =  tsec_hdcp_readcaps(hdcp_context);
1059         if (err)
1060                 goto exit;
1061         err =  tsec_hdcp_init(hdcp_context);
1062         if (err)
1063                 goto exit;
1064         err =  tsec_hdcp_create_session(hdcp_context);
1065         if (err)
1066                 goto exit;
1067         err =  tsec_hdcp_exchange_info(hdcp_context,
1068                         HDCP_EXCHANGE_INFO_GET_TMTR_INFO,
1069                         &version,
1070                         &caps);
1071         if (err)
1072                 goto exit;
1073         hdcp_context->msg.txcaps_version = version;
1074         hdcp_context->msg.txcaps_capmask = txcaps;
1075         hdcp_context->msg.ake_init_msg_id = ID_AKE_INIT;
1076
1077         err = nvhdcp_ake_init_send(nvhdcp,
1078                 (u8 *)&hdcp_context->msg.ake_init_msg_id);
1079         if (err)
1080                 goto exit;
1081
1082         err = nvhdcp_poll_ready(nvhdcp, 1000);
1083         if (err)
1084                 goto exit;
1085         err = nvhdcp_ake_cert_receive(nvhdcp,
1086                 &hdcp_context->msg.ake_send_cert_msg_id);
1087         if (err)
1088                 goto exit;
1089         if (hdcp_context->msg.ake_send_cert_msg_id != ID_AKE_SEND_CERT) {
1090                 nvhdcp_err("Not ID_AKE_SEND_CERT but %d instead\n",
1091                         hdcp_context->msg.ake_send_cert_msg_id);
1092                 err = -EINVAL;
1093                 goto exit;
1094         }
1095         err =  tsec_hdcp_verify_cert(hdcp_context);
1096         if (err)
1097                 goto exit;
1098         err =  tsec_hdcp_update_rrx(hdcp_context);
1099         if (err)
1100                 goto exit;
1101         err =  tsec_hdcp_generate_ekm(hdcp_context);
1102         if (err)
1103                 goto exit;
1104         hdcp_context->msg.ake_no_stored_km_msg_id = ID_AKE_NO_STORED_KM;
1105         err = nvhdcp_ake_no_stored_km_send(nvhdcp,
1106                 &hdcp_context->msg.ake_no_stored_km_msg_id);
1107         if (err)
1108                 goto exit;
1109         err =  tsec_hdcp_exchange_info(hdcp_context,
1110                 HDCP_EXCHANGE_INFO_SET_RCVR_INFO,
1111                 &hdcp_context->msg.rxcaps_version,
1112                 &hdcp_context->msg.rxcaps_capmask);
1113         if (err)
1114                 goto exit;
1115         pkt = kzalloc(HDCP_PKT_SIZE, GFP_KERNEL);
1116         if (!pkt) {
1117                 nvhdcp_err("Memory allocation failed!\n");
1118                 goto exit;
1119         }
1120 #if defined(CONFIG_TRUSTED_LITTLE_KERNEL)
1121         /* generate nonce in the ucode */
1122         err = tsec_hdcp_generate_nonce(hdcp_context, nonce);
1123         if (err) {
1124                 nvhdcp_err("Error generating nonce!\n");
1125                 goto exit;
1126         }
1127         /* pass the nonce to hdcp TA and get the signature back */
1128         err = te_open_trusted_session(hdcp_uuid, sizeof(hdcp_uuid),
1129                                         &session_id);
1130         if (err) {
1131                 nvhdcp_err("Error opening trusted session\n");
1132                 goto exit;
1133         }
1134         memcpy(pkt, nonce, HDCP_NONCE_SIZE);
1135         err = te_launch_trusted_oper(pkt, HDCP_PKT_SIZE, session_id,
1136                         hdcp_uuid, HDCP_CMD_GEN_CMAC, sizeof(hdcp_uuid));
1137         if (err) {
1138                 nvhdcp_err("Error launching session\n");
1139                 goto exit;
1140         }
1141 #endif
1142         err =  tsec_hdcp_revocation_check(hdcp_context,
1143         (pkt + HDCP_CMAC_OFFSET),
1144         (unsigned int *)(pkt + HDCP_TSEC_ADDR_OFFSET));
1145         if (err)
1146                 goto exit;
1147         err = nvhdcp_poll_ready(nvhdcp, 1000);
1148         if (err)
1149                 goto exit;
1150         err = nvhdcp_ake_hprime_receive(nvhdcp,
1151                 &hdcp_context->msg.ake_send_hprime_msg_id);
1152         if (err)
1153                 goto exit;
1154         if (hdcp_context->msg.ake_send_hprime_msg_id != ID_AKE_SEND_HPRIME) {
1155                 nvhdcp_err("Not ID_AKE_SEND_HPRIME but %d instead\n",
1156                         hdcp_context->msg.ake_send_hprime_msg_id);
1157                 err = -EINVAL;
1158                 goto exit;
1159         }
1160         err =  tsec_hdcp_verify_hprime(hdcp_context);
1161         if (err)
1162                 goto exit;
1163         err = nvhdcp_poll_ready(nvhdcp, 200);
1164         if (err)
1165                 goto exit;
1166         err = nvhdcp_ake_pairing_info_receive(nvhdcp,
1167                 &hdcp_context->msg.ake_send_pairing_info_msg_id);
1168         if (err)
1169                 goto exit;
1170         if (hdcp_context->msg.ake_send_pairing_info_msg_id !=
1171         ID_AKE_SEND_PAIRING_INFO) {
1172                 nvhdcp_err("Not ID_AKE_SEND_PAIRING_INFO but %d instead\n",
1173                         hdcp_context->msg.ake_send_hprime_msg_id);
1174                 err = -EINVAL;
1175                 goto exit;
1176         }
1177         err =  tsec_hdcp_encrypt_pairing_info(hdcp_context);
1178         if (err)
1179                 goto exit;
1180         err =  tsec_hdcp_generate_lc_init(hdcp_context);
1181         if (err)
1182                 goto exit;
1183         hdcp_context->msg.lc_init_msg_id = ID_LC_INIT;
1184         err = nvhdcp_lc_init_send(nvhdcp, &hdcp_context->msg.lc_init_msg_id);
1185         if (err)
1186                 goto exit;
1187         err = nvhdcp_poll_ready(nvhdcp, 20);
1188         if (err)
1189                 goto exit;
1190         err = nvhdcp_lc_lprime_receive(nvhdcp,
1191                 &hdcp_context->msg.lc_send_lprime_msg_id);
1192         if (err)
1193                 goto exit;
1194         if (hdcp_context->msg.lc_send_lprime_msg_id != ID_LC_SEND_LPRIME) {
1195                 nvhdcp_err("Not ID_LC_SEND_LPRIME but %d instead\n",
1196                         hdcp_context->msg.lc_send_lprime_msg_id);
1197                 err = -EINVAL;
1198                 goto exit;
1199         }
1200         err =  tsec_hdcp_verify_lprime(hdcp_context);
1201         if (err)
1202                 goto exit;
1203         err =  tsec_hdcp_ske_init(hdcp_context);
1204         if (err)
1205                 goto exit;
1206         hdcp_context->msg.ske_send_eks_msg_id = ID_SKE_SEND_EKS;
1207         err = nvhdcp_ske_eks_send(nvhdcp,
1208                 &hdcp_context->msg.ske_send_eks_msg_id);
1209         if (err)
1210                 goto exit;
1211         if (hdcp_context->msg.rxcaps_capmask & HDCP_22_REPEATER) {
1212                 nvhdcp->repeater = 1;
1213                 err = nvhdcp_poll_ready(nvhdcp, 3000);
1214                 if (err)
1215                         goto exit;
1216                 err = nvhdcp_receiverid_list_receive(nvhdcp,
1217                                 &hdcp_context->msg.send_receiverid_list_msg_id);
1218                 if (err)
1219                         goto exit;
1220                 if (hdcp_context->msg.send_receiverid_list_msg_id !=
1221                 ID_SEND_RCVR_ID_LIST) {
1222                         nvhdcp_err("Not ID_SEND_RCVR_ID_LIST but %d instead\n",
1223                                 hdcp_context->msg.send_receiverid_list_msg_id);
1224                         err = -EINVAL;
1225                         goto exit;
1226                 }
1227
1228                 if (hdcp_context->msg.rxinfo & HDCP_NON_22_RX) {
1229                         err = HDCP_FALLBACK_1X;
1230                         g_fallback = 1;
1231                         goto exit;
1232                 }
1233 #if defined(CONFIG_TRUSTED_LITTLE_KERNEL)
1234                 /* generate_nonce in the ucode for v' verification */
1235                 err = tsec_hdcp_generate_nonce(hdcp_context, nonce);
1236                 if (err) {
1237                         nvhdcp_err("Error generating nonce!\n");
1238                         goto exit;
1239                 }
1240
1241                 memcpy(pkt, nonce, HDCP_NONCE_SIZE);
1242                 err = te_launch_trusted_oper(pkt, HDCP_PKT_SIZE, session_id,
1243                                 hdcp_uuid, HDCP_CMD_GEN_CMAC, sizeof(hdcp_uuid));
1244                 if (err) {
1245                         nvhdcp_err("Error launching session\n");
1246                         goto exit;
1247                 }
1248 #endif
1249                 err =  tsec_hdcp_verify_vprime(hdcp_context,
1250                                 (pkt + HDCP_CMAC_OFFSET), (unsigned int *)(pkt + HDCP_TSEC_ADDR_OFFSET));
1251                 if (err)
1252                         goto exit;
1253                 hdcp_context->msg.rptr_send_ack_msg_id = ID_SEND_RPTR_ACK;
1254                 err = nvhdcp_rptr_ack_send(nvhdcp,
1255                         &hdcp_context->msg.rptr_send_ack_msg_id);
1256                 if (err)
1257                         goto exit;
1258 stream_manage_send:
1259                 err =  tsec_hdcp_rptr_stream_manage(hdcp_context);
1260                 if (err)
1261                         goto exit;
1262                 hdcp_context->msg.rptr_auth_stream_manage_msg_id =
1263                         ID_SEND_RPTR_STREAM_MANAGE;
1264                 /* Num of streams = 1, only video, big endian */
1265                 hdcp_context->msg.k = 0x0100;
1266                 /* STREAM_ID = 0 and Type = 0  */
1267                 hdcp_context->msg.streamid_type[0] = 0x0100;
1268
1269                 err = nvhdcp_rptr_stream_manage_send(nvhdcp,
1270                         &hdcp_context->msg.rptr_auth_stream_manage_msg_id);
1271                 if (err)
1272                         goto exit;
1273                 err = nvhdcp_poll_ready(nvhdcp, 100);
1274                 if (err) {
1275                         /* HDCP 2.2 analyzer expects to retry atleast once */
1276                         if (g_seq_num_m_retries >= SEQ_NUM_M_MAX_RETRIES)
1277                                 goto exit;
1278                         else {
1279                                 g_seq_num_m_retries++;
1280                                 goto stream_manage_send;
1281                         }
1282                 }
1283                 err = nvhdcp_rptr_stream_ready_receive(nvhdcp,
1284                         &hdcp_context->msg.rptr_auth_stream_ready_msg_id);
1285                 if (err)
1286                         goto exit;
1287                 if (hdcp_context->msg.rptr_auth_stream_ready_msg_id !=
1288                 ID_SEND_RPTR_STREAM_READY) {
1289                         nvhdcp_err("Not ID_SEND_RPTR_STREAM_READY but %d\n",
1290                         hdcp_context->msg.rptr_auth_stream_ready_msg_id);
1291                         err = -EINVAL;
1292                         goto exit;
1293                 }
1294                 err =  tsec_hdcp_rptr_stream_ready(hdcp_context);
1295                 if (err) {
1296                         /* HDCP 2.2 analyzer expects to retry atleast once */
1297                         if (g_seq_num_m_retries >= SEQ_NUM_M_MAX_RETRIES)
1298                                 goto exit;
1299                         else {
1300                                 g_seq_num_m_retries++;
1301                                 goto stream_manage_send;
1302                         }
1303                 }
1304         }
1305
1306         nvhdcp_info("HDCP Authentication successful!\n");
1307
1308 exit:
1309         if (err)
1310                 nvhdcp_err("HDCP authentication failed with err %x\n", err);
1311         kfree(pkt);
1312 #if defined(CONFIG_TRUSTED_LITTLE_KERNEL)
1313         if (session_id) {
1314                 te_close_trusted_session(session_id, hdcp_uuid, sizeof(hdcp_uuid));
1315                 session_id = 0;
1316         }
1317 #endif
1318         return err;
1319 }
1320
1321 int tegra_hdmi_get_hotplug_state(struct tegra_hdmi *hdmi);
1322 void tegra_hdmi_set_hotplug_state(struct tegra_hdmi *hdmi, int new_hpd_state);
1323
1324 static void nvhdcp_fallback_worker(struct work_struct *work)
1325 {
1326         struct tegra_nvhdcp *nvhdcp =
1327                 container_of(to_delayed_work(work), struct tegra_nvhdcp, fallback_work);
1328         struct tegra_hdmi *hdmi = nvhdcp->hdmi;
1329         struct tegra_dc *dc = tegra_dc_hdmi_get_dc(hdmi);
1330         int hotplug_state;
1331         bool dc_enabled;
1332
1333         hotplug_state = tegra_hdmi_get_hotplug_state(hdmi);
1334
1335         mutex_lock(&dc->lock);
1336         dc_enabled = dc->enabled;
1337         mutex_unlock(&dc->lock);
1338
1339         if (hotplug_state == TEGRA_HPD_STATE_NORMAL) {
1340                 tegra_hdmi_set_hotplug_state(hdmi, TEGRA_HPD_STATE_FORCE_DEASSERT);
1341                 cancel_delayed_work(&nvhdcp->fallback_work);
1342                 queue_delayed_work(nvhdcp->fallback_wq, &nvhdcp->fallback_work,
1343                         msecs_to_jiffies(1000));
1344         } else if (hotplug_state == TEGRA_HPD_STATE_FORCE_DEASSERT && dc_enabled) {
1345                 cancel_delayed_work(&nvhdcp->fallback_work);
1346                 queue_delayed_work(nvhdcp->fallback_wq, &nvhdcp->fallback_work,
1347                         msecs_to_jiffies(1000));
1348         } else if (hotplug_state == TEGRA_HPD_STATE_FORCE_DEASSERT && !dc_enabled) {
1349                 tegra_hdmi_set_hotplug_state(hdmi, TEGRA_HPD_STATE_NORMAL);
1350         }
1351 }
1352
1353 static void nvhdcp_downstream_worker(struct work_struct *work)
1354 {
1355         struct tegra_nvhdcp *nvhdcp =
1356                 container_of(to_delayed_work(work), struct tegra_nvhdcp, hdcp1x_work);
1357         struct tegra_hdmi *hdmi = nvhdcp->hdmi;
1358         struct tegra_dc *dc = tegra_dc_hdmi_get_dc(hdmi);
1359         int e;
1360         u8 b_caps;
1361         u32 tmp;
1362         u32 res;
1363
1364         g_fallback = 0;
1365
1366         nvhdcp_vdbg("%s():started thread %s\n", __func__, nvhdcp->name);
1367         tegra_dc_io_start(dc);
1368
1369         mutex_lock(&nvhdcp->lock);
1370         if (nvhdcp->state == STATE_OFF) {
1371                 nvhdcp_err("nvhdcp failure - giving up\n");
1372                 goto err;
1373         }
1374         nvhdcp->state = STATE_UNAUTHENTICATED;
1375
1376         /* check plug state to terminate early in case flush_workqueue() */
1377         if (!nvhdcp_is_plugged(nvhdcp)) {
1378                 nvhdcp_err("worker started while unplugged!\n");
1379                 goto lost_hdmi;
1380         }
1381         nvhdcp_vdbg("%s():hpd=%d\n", __func__, nvhdcp->plugged);
1382
1383         nvhdcp->a_ksv = 0;
1384         nvhdcp->b_ksv = 0;
1385         nvhdcp->a_n = 0;
1386         mutex_unlock(&nvhdcp->lock);
1387
1388         e = get_bcaps(nvhdcp, &b_caps);
1389         mutex_lock(&nvhdcp->lock);
1390         if (e) {
1391                 nvhdcp_err("Bcaps read failure\n");
1392                 goto failure;
1393         }
1394
1395         nvhdcp_vdbg("read Bcaps = 0x%02x\n", b_caps);
1396
1397         nvhdcp_vdbg("kfuse loading ...\n");
1398
1399         /* repeater flag in Bskv must be configured before loading fuses */
1400         set_bksv(hdmi, 0, (b_caps & BCAPS_REPEATER));
1401
1402         e = load_kfuse(hdmi);
1403         if (e) {
1404                 nvhdcp_err("kfuse could not be loaded\n");
1405                 goto failure;
1406         }
1407
1408         usleep_range(20000, 25000);
1409         hdcp_ctrl_run(hdmi, 1);
1410
1411         nvhdcp_vdbg("wait AN_VALID ...\n");
1412
1413         /* wait for hardware to generate HDCP values */
1414         e = wait_hdcp_ctrl(hdmi, AN_VALID | SROM_ERR, &res);
1415         if (e) {
1416                 nvhdcp_err("An key generation timeout\n");
1417                 goto failure;
1418         }
1419         if (res & SROM_ERR) {
1420                 nvhdcp_err("SROM error\n");
1421                 goto failure;
1422         }
1423
1424         msleep(25);
1425
1426         nvhdcp->a_ksv = get_aksv(hdmi);
1427         nvhdcp->a_n = get_an(hdmi);
1428         nvhdcp_vdbg("Aksv is 0x%016llx\n", nvhdcp->a_ksv);
1429         nvhdcp_vdbg("An is 0x%016llx\n", nvhdcp->a_n);
1430         if (verify_ksv(nvhdcp->a_ksv)) {
1431                 nvhdcp_err("Aksv verify failure! (0x%016llx)\n", nvhdcp->a_ksv);
1432                 goto disable;
1433         }
1434         mutex_unlock(&nvhdcp->lock);
1435
1436         /* write Ainfo to receiver - set 1.1 only if b_caps supports it */
1437         e = nvhdcp_i2c_write8(nvhdcp, 0x15, b_caps & BCAPS_11);
1438         if (e) {
1439                 nvhdcp_err("Ainfo write failure\n");
1440                 mutex_lock(&nvhdcp->lock);
1441                 goto failure;
1442         }
1443
1444         /* write An to receiver */
1445         e = nvhdcp_i2c_write64(nvhdcp, 0x18, nvhdcp->a_n);
1446         if (e) {
1447                 nvhdcp_err("An write failure\n");
1448                 mutex_lock(&nvhdcp->lock);
1449                 goto failure;
1450         }
1451
1452         nvhdcp_vdbg("wrote An = 0x%016llx\n", nvhdcp->a_n);
1453
1454         /* write Aksv to receiver - triggers auth sequence */
1455         e = nvhdcp_i2c_write40(nvhdcp, 0x10, nvhdcp->a_ksv);
1456         if (e) {
1457                 nvhdcp_err("Aksv write failure\n");
1458                 mutex_lock(&nvhdcp->lock);
1459                 goto failure;
1460         }
1461
1462         nvhdcp_vdbg("wrote Aksv = 0x%010llx\n", nvhdcp->a_ksv);
1463
1464         mutex_lock(&nvhdcp->lock);
1465         /* bail out if unplugged in the middle of negotiation */
1466         if (!nvhdcp_is_plugged(nvhdcp))
1467                 goto lost_hdmi;
1468         mutex_unlock(&nvhdcp->lock);
1469
1470         /* get Bksv from receiver */
1471         e = nvhdcp_i2c_read40(nvhdcp, 0x00, &nvhdcp->b_ksv);
1472         mutex_lock(&nvhdcp->lock);
1473         if (e) {
1474                 nvhdcp_err("Bksv read failure\n");
1475                 goto failure;
1476         }
1477         nvhdcp_vdbg("Bksv is 0x%016llx\n", nvhdcp->b_ksv);
1478         if (verify_ksv(nvhdcp->b_ksv)) {
1479                 nvhdcp_err("Bksv verify failure!\n");
1480                 goto failure;
1481         }
1482
1483         nvhdcp_vdbg("read Bksv = 0x%010llx from device\n", nvhdcp->b_ksv);
1484
1485         set_bksv(hdmi, nvhdcp->b_ksv, (b_caps & BCAPS_REPEATER));
1486
1487         nvhdcp_vdbg("loaded Bksv into controller\n");
1488
1489         e = wait_hdcp_ctrl(hdmi, R0_VALID, NULL);
1490         if (e) {
1491                 nvhdcp_err("R0 read failure!\n");
1492                 goto failure;
1493         }
1494
1495         nvhdcp_vdbg("R0 valid\n");
1496
1497         msleep(100); /* can't read R0' within 100ms of writing Aksv */
1498
1499         nvhdcp_vdbg("verifying links ...\n");
1500
1501         mutex_unlock(&nvhdcp->lock);
1502         e = verify_link(nvhdcp, false);
1503         if (e) {
1504                 nvhdcp_err("link verification failed err %d\n", e);
1505                 mutex_lock(&nvhdcp->lock);
1506                 goto failure;
1507         }
1508
1509         /* if repeater then get repeater info */
1510         if (b_caps & BCAPS_REPEATER) {
1511                 e = get_repeater_info(nvhdcp);
1512                 if (e) {
1513                         nvhdcp_err("get repeater info failed\n");
1514                         mutex_lock(&nvhdcp->lock);
1515                         goto failure;
1516                 }
1517         }
1518
1519         mutex_lock(&nvhdcp->lock);
1520         tmp = nvhdcp_sor_readl(hdmi, NV_SOR_TMDS_HDCP_CTRL);
1521         tmp |= CRYPT_ENABLED;
1522         if (b_caps & BCAPS_11) /* HDCP 1.1 ? */
1523                 tmp |= ONEONE_ENABLED;
1524         nvhdcp_sor_writel(hdmi, tmp, NV_SOR_TMDS_HDCP_CTRL);
1525
1526         nvhdcp_vdbg("CRYPT enabled\n");
1527
1528         nvhdcp->state = STATE_LINK_VERIFY;
1529         nvhdcp_info("link verified!\n");
1530
1531         while (1) {
1532                 if (!nvhdcp_is_plugged(nvhdcp))
1533                         goto lost_hdmi;
1534
1535                 if (nvhdcp->state != STATE_LINK_VERIFY)
1536                         goto failure;
1537
1538                 mutex_unlock(&nvhdcp->lock);
1539                 e = verify_link(nvhdcp, true);
1540                 if (e) {
1541                         nvhdcp_err("link verification failed err %d\n", e);
1542                         mutex_lock(&nvhdcp->lock);
1543                         goto failure;
1544                 }
1545                 tegra_dc_io_end(dc);
1546                 wait_event_interruptible_timeout(wq_worker,
1547                         !nvhdcp_is_plugged(nvhdcp), msecs_to_jiffies(1500));
1548                 tegra_dc_io_start(dc);
1549                 mutex_lock(&nvhdcp->lock);
1550
1551         }
1552
1553 failure:
1554         nvhdcp->fail_count++;
1555         if (nvhdcp->max_retries <= HDCP_INFINITE_RETRIES ||
1556                 nvhdcp->fail_count < nvhdcp->max_retries) {
1557                 nvhdcp_err("nvhdcp failure - renegotiating in 1 second\n");
1558                 if (!nvhdcp_is_plugged(nvhdcp))
1559                         goto lost_hdmi;
1560                 queue_delayed_work(nvhdcp->downstream_wq, &nvhdcp->hdcp1x_work,
1561                                                 msecs_to_jiffies(1000));
1562         } else {
1563                 nvhdcp_err("nvhdcp failure - too many failures, giving up!\n");
1564         }
1565
1566 lost_hdmi:
1567         nvhdcp->state = STATE_UNAUTHENTICATED;
1568         hdcp_ctrl_run(hdmi, 0);
1569
1570 err:
1571         mutex_unlock(&nvhdcp->lock);
1572         tegra_dc_io_end(dc);
1573         return;
1574 disable:
1575         nvhdcp->state = STATE_OFF;
1576         nvhdcp_set_plugged(nvhdcp, false);
1577         mutex_unlock(&nvhdcp->lock);
1578         tegra_dc_io_end(dc);
1579         return;
1580 }
1581
1582 static int link_integrity_check(struct tegra_nvhdcp *nvhdcp,
1583                         struct hdcp_context_t *hdcp_context)
1584 {
1585         u16 rx_status = 0;
1586         int err = 0;
1587         uint8_t *pkt = NULL;
1588 #if defined(CONFIG_TRUSTED_LITTLE_KERNEL)
1589         char nonce[HDCP_NONCE_SIZE];
1590         uint32_t hdcp_uuid[4] = HDCP_SERVICE_UUID;
1591         u32 session_id = 0;
1592 #endif
1593
1594         nvhdcp_i2c_read16(nvhdcp, HDCP_RX_STATUS, &rx_status);
1595         if (nvhdcp->repeater && (rx_status & HDCP_RX_STATUS_MSG_READY_YES)) {
1596                 err = nvhdcp_poll_ready(nvhdcp, 1000);
1597                 if (err) {
1598                         nvhdcp_err("Failed to get RX list\n");
1599                         goto exit;
1600                 }
1601                 err = nvhdcp_receiverid_list_receive(nvhdcp,
1602                                 &hdcp_context->msg.send_receiverid_list_msg_id);
1603                 if (err)
1604                         goto exit;
1605                 if (hdcp_context->msg.send_receiverid_list_msg_id !=
1606                 ID_SEND_RCVR_ID_LIST) {
1607                         nvhdcp_err("Not ID_SEND_RCVR_ID_LIST but %d instead\n",
1608                                 hdcp_context->msg.send_receiverid_list_msg_id);
1609                         err = -EINVAL;
1610                         goto exit;
1611                 }
1612                 if (hdcp_context->msg.rxinfo & HDCP_NON_22_RX) {
1613                         g_fallback = 1;
1614                         cancel_delayed_work(&nvhdcp->fallback_work);
1615                         queue_delayed_work(nvhdcp->fallback_wq, &nvhdcp->fallback_work,
1616                                                         msecs_to_jiffies(10));
1617                         goto exit;
1618                 }
1619                 pkt = kzalloc(HDCP_PKT_SIZE, GFP_KERNEL);
1620                 if (!pkt) {
1621                         nvhdcp_err("Memory allocation failed\n");
1622                         goto exit;
1623                 }
1624 #if defined(CONFIG_TRUSTED_LITTLE_KERNEL)
1625                 /* generate_nonce in the ucode for v' verification */
1626                 err = tsec_hdcp_generate_nonce(hdcp_context, nonce);
1627                 if (err) {
1628                         nvhdcp_err("Error generating nonce!\n");
1629                         goto exit;
1630                 }
1631
1632                 /* pass the nonce to hdcp TA and get the signature back */
1633                 err = te_open_trusted_session(hdcp_uuid, sizeof(hdcp_uuid),
1634                                                 &session_id);
1635                 if (err) {
1636                         nvhdcp_err("Error opening session\n");
1637                         goto exit;
1638                 }
1639                 memcpy(pkt, nonce, HDCP_NONCE_SIZE);
1640                 err = te_launch_trusted_oper(pkt, HDCP_PKT_SIZE, session_id,
1641                         hdcp_uuid, HDCP_CMD_GEN_CMAC, sizeof(hdcp_uuid));
1642                 if (err) {
1643                         nvhdcp_err("Error launching session\n");
1644                         goto exit;
1645                 }
1646 #endif
1647                 err =  tsec_hdcp_verify_vprime(hdcp_context,
1648                                 (pkt + HDCP_CMAC_OFFSET), (unsigned int *)(pkt + HDCP_TSEC_ADDR_OFFSET));
1649                 if (err)
1650                         goto exit;
1651                 hdcp_context->msg.rptr_send_ack_msg_id = ID_SEND_RPTR_ACK;
1652                 err = nvhdcp_rptr_ack_send(nvhdcp,
1653                         &hdcp_context->msg.rptr_send_ack_msg_id);
1654                 if (err)
1655                         goto exit;
1656                 kfree(pkt);
1657 #if defined(CONFIG_TRUSTED_LITTLE_KERNEL)
1658                 if (session_id) {
1659                         te_close_trusted_session(session_id, hdcp_uuid, sizeof(hdcp_uuid));
1660                         session_id = 0;
1661                 }
1662 #endif
1663                 return 0;
1664         } else
1665                 return rx_status & HDCP_RX_STATUS_MSG_REAUTH_REQ;
1666 exit:
1667         kfree(pkt);
1668 #if defined(CONFIG_TRUSTED_LITTLE_KERNEL)
1669         if (session_id) {
1670                 te_close_trusted_session(session_id, hdcp_uuid, sizeof(hdcp_uuid));
1671                 session_id = 0;
1672         }
1673 #endif
1674                 return 1;
1675 }
1676
1677 static void nvhdcp2_downstream_worker(struct work_struct *work)
1678 {
1679         struct tegra_nvhdcp *nvhdcp =
1680                 container_of(to_delayed_work(work), struct tegra_nvhdcp, hdcp22_work);
1681         struct tegra_hdmi *hdmi = nvhdcp->hdmi;
1682         struct tegra_dc *dc = tegra_dc_hdmi_get_dc(hdmi);
1683         int e;
1684         int ret;
1685         struct hdcp_context_t hdcp_context;
1686         g_seq_num_m_retries = 0;
1687
1688         e = tsec_hdcp_create_context(&hdcp_context);
1689         if (e) {
1690                 mutex_lock(&nvhdcp->lock);
1691                 goto err;
1692         }
1693
1694         nvhdcp_vdbg("%s():started thread %s\n", __func__, nvhdcp->name);
1695         tegra_dc_io_start(dc);
1696
1697         mutex_lock(&nvhdcp->lock);
1698         if (nvhdcp->state == STATE_OFF) {
1699                 nvhdcp_err("nvhdcp failure - giving up\n");
1700                 goto err;
1701         }
1702         nvhdcp->state = STATE_UNAUTHENTICATED;
1703
1704         /* check plug state to terminate early in case flush_workqueue() */
1705         if (!nvhdcp_is_plugged(nvhdcp)) {
1706                 nvhdcp_err("worker started while unplugged!\n");
1707                 goto lost_hdmi;
1708         }
1709         nvhdcp_vdbg("%s():hpd=%d\n", __func__, nvhdcp->plugged);
1710         mutex_unlock(&nvhdcp->lock);
1711
1712         ret = tsec_hdcp_authentication(nvhdcp, &hdcp_context);
1713         if (ret == HDCP_FALLBACK_1X) {
1714                 cancel_delayed_work(&nvhdcp->fallback_work);
1715                 queue_delayed_work(nvhdcp->fallback_wq, &nvhdcp->fallback_work,
1716                                                 msecs_to_jiffies(10));
1717                 mutex_lock(&nvhdcp->lock);
1718                 goto lost_hdmi;
1719         } else if (ret) {
1720                 mutex_lock(&nvhdcp->lock);
1721                 goto failure;
1722         }
1723
1724         mdelay(350);
1725         nvhdcp_vdbg("link integrity check ...\n");
1726         e = link_integrity_check(nvhdcp, &hdcp_context);
1727         if (e) {
1728                 nvhdcp_err("link integrity check failed err %d\n", e);
1729                 mutex_lock(&nvhdcp->lock);
1730                 goto failure;
1731         }
1732
1733         mutex_lock(&nvhdcp->lock);
1734         nvhdcp->state = STATE_LINK_VERIFY;
1735         nvhdcp_info("link integrity check passed!\n");
1736         mutex_unlock(&nvhdcp->lock);
1737
1738         e = tsec_hdcp_session_ctrl(&hdcp_context,
1739                 HDCP_SESSION_CTRL_FLAG_ACTIVATE);
1740         if (e) {
1741                 nvhdcp_info("tsec_hdcp_session_ctrl failed\n");
1742                 mutex_lock(&nvhdcp->lock);
1743                 goto failure;
1744         }
1745         nvhdcp_info("HDCP 2.2 crypt enabled!\n");
1746
1747
1748         mutex_lock(&nvhdcp->lock);
1749         while (1) {
1750                 if (!nvhdcp_is_plugged(nvhdcp))
1751                         goto lost_hdmi;
1752
1753                 if (nvhdcp->state != STATE_LINK_VERIFY)
1754                         goto failure;
1755
1756                 mutex_unlock(&nvhdcp->lock);
1757                 e = link_integrity_check(nvhdcp, &hdcp_context);
1758                 if (e) {
1759                         nvhdcp_err("link integrity check failed err %d\n", e);
1760                         mutex_lock(&nvhdcp->lock);
1761                         goto failure;
1762                 }
1763                 tegra_dc_io_end(dc);
1764                 /* HDCP 2.2 Analyzer expects to check rx status more */
1765                 /* frequently for repeaters */
1766                 if (nvhdcp->repeater)
1767                         wait_event_interruptible_timeout(wq_worker,
1768                                 !nvhdcp_is_plugged(nvhdcp),
1769                                 msecs_to_jiffies(300));
1770                 else
1771                         wait_event_interruptible_timeout(wq_worker,
1772                                 !nvhdcp_is_plugged(nvhdcp),
1773                                 msecs_to_jiffies(500));
1774                 tegra_dc_io_start(dc);
1775                 mutex_lock(&nvhdcp->lock);
1776
1777         }
1778
1779 failure:
1780
1781         nvhdcp->fail_count++;
1782         if (nvhdcp->max_retries <= HDCP_INFINITE_RETRIES ||
1783                 nvhdcp->fail_count < nvhdcp->max_retries) {
1784                 nvhdcp_err("nvhdcp failure - renegotiating in 1 second\n");
1785                 if (!nvhdcp_is_plugged(nvhdcp))
1786                         goto lost_hdmi;
1787                 queue_delayed_work(nvhdcp->downstream_wq, &nvhdcp->hdcp22_work,
1788                                                 msecs_to_jiffies(1000));
1789         } else {
1790                 nvhdcp_err("nvhdcp failure - too many failures, giving up!\n");
1791         }
1792
1793 lost_hdmi:
1794         nvhdcp->state = STATE_UNAUTHENTICATED;
1795
1796 err:
1797         nvhdcp->repeater = 0;
1798         mutex_unlock(&nvhdcp->lock);
1799         tegra_dc_io_end(dc);
1800         e = tsec_hdcp_free_context(&hdcp_context);
1801         return;
1802 }
1803
1804 static int tegra_nvhdcp_on(struct tegra_nvhdcp *nvhdcp)
1805 {
1806         u8 hdcp2version = 0;
1807         int e;
1808         int val;
1809         int delay = tegra_edid_get_quirks(nvhdcp->hdmi->edid) &
1810                     TEGRA_EDID_QUIRK_DELAY_HDCP ? 5000 : 100;
1811         nvhdcp->state = STATE_UNAUTHENTICATED;
1812         if (nvhdcp_is_plugged(nvhdcp) &&
1813                 atomic_read(&nvhdcp->policy) !=
1814                 TEGRA_DC_HDCP_POLICY_ALWAYS_OFF &&
1815                 !(tegra_edid_get_quirks(nvhdcp->hdmi->edid) &
1816                   TEGRA_EDID_QUIRK_NO_HDCP)
1817                 ) {
1818                 nvhdcp->fail_count = 0;
1819                 e = nvhdcp_i2c_read8(nvhdcp, HDCP_HDCP2_VERSION, &hdcp2version);
1820                 if (e)
1821                         nvhdcp_err("nvhdcp i2c HDCP22 version read failed\n");
1822                 /* Do not stop nauthentication if i2c version reads fail as  */
1823                 /* HDCP 1.x test 1A-04 expects reading HDCP regs */
1824                 if (hdcp2version & HDCP_HDCP2_VERSION_HDCP22_YES) {
1825                         if (g_fallback) {
1826                                 val = HDCP_EESS_ENABLE<<31|
1827                                         HDCP1X_EESS_START<<16|
1828                                         HDCP1X_EESS_END;
1829                                 nvhdcp_sor_writel(nvhdcp->hdmi, val,
1830                                                         HDMI_VSYNC_WINDOW);
1831                                 nvhdcp->hdcp22 = HDCP1X_PROTOCOL;
1832                                 queue_delayed_work(nvhdcp->downstream_wq,
1833                                         &nvhdcp->hdcp1x_work,
1834                                         msecs_to_jiffies(delay));
1835                         } else {
1836                                 val = HDCP_EESS_ENABLE<<31|
1837                                         HDCP22_EESS_START<<16|
1838                                         HDCP22_EESS_END;
1839                                 nvhdcp_sor_writel(nvhdcp->hdmi, val,
1840                                                         HDMI_VSYNC_WINDOW);
1841                                 nvhdcp->hdcp22 = HDCP22_PROTOCOL;
1842                                 queue_delayed_work(nvhdcp->downstream_wq,
1843                                         &nvhdcp->hdcp22_work,
1844                                         msecs_to_jiffies(delay));
1845                         }
1846                 } else {
1847                         val = HDCP_EESS_ENABLE<<31|
1848                                 HDCP1X_EESS_START<<16|
1849                                 HDCP1X_EESS_END;
1850                         nvhdcp_sor_writel(nvhdcp->hdmi, val,
1851                                                         HDMI_VSYNC_WINDOW);
1852                         nvhdcp->hdcp22 = HDCP1X_PROTOCOL;
1853                         queue_delayed_work(nvhdcp->downstream_wq,
1854                                 &nvhdcp->hdcp1x_work,
1855                                 msecs_to_jiffies(delay));
1856                 }
1857         }
1858         return 0;
1859 }
1860
1861 static int tegra_nvhdcp_off(struct tegra_nvhdcp *nvhdcp)
1862 {
1863         mutex_lock(&nvhdcp->lock);
1864         nvhdcp->state = STATE_OFF;
1865         nvhdcp_set_plugged(nvhdcp, false);
1866         mutex_unlock(&nvhdcp->lock);
1867         wake_up_interruptible(&wq_worker);
1868         cancel_delayed_work_sync(&nvhdcp->hdcp1x_work);
1869         cancel_delayed_work_sync(&nvhdcp->hdcp22_work);
1870         return 0;
1871 }
1872
1873 void tegra_nvhdcp_set_plug(struct tegra_nvhdcp *nvhdcp, bool hpd)
1874 {
1875         nvhdcp_debug("hdmi hotplug detected (hpd = %d)\n", hpd);
1876
1877         if (hpd) {
1878                 nvhdcp_set_plugged(nvhdcp, true);
1879                 tegra_nvhdcp_on(nvhdcp);
1880         } else {
1881                 tegra_nvhdcp_off(nvhdcp);
1882         }
1883 }
1884
1885 int tegra_nvhdcp_set_policy(struct tegra_nvhdcp *nvhdcp, int pol)
1886 {
1887         if (pol == TEGRA_DC_HDCP_POLICY_ALWAYS_ON) {
1888                 nvhdcp_info("using \"always on\" policy.\n");
1889                 if (atomic_xchg(&nvhdcp->policy, pol) != pol) {
1890                         /* policy changed, start working */
1891                         tegra_nvhdcp_on(nvhdcp);
1892                 }
1893         } else if (pol == TEGRA_DC_HDCP_POLICY_ALWAYS_OFF) {
1894                 nvhdcp_info("using \"always off\" policy.\n");
1895                 if (atomic_xchg(&nvhdcp->policy, pol) != pol) {
1896                         /* policy changed, stop working */
1897                         tegra_nvhdcp_off(nvhdcp);
1898                 }
1899         } else {
1900                 /* unsupported policy */
1901                 return -EINVAL;
1902         }
1903
1904         return 0;
1905 }
1906
1907 static int tegra_nvhdcp_renegotiate(struct tegra_nvhdcp *nvhdcp)
1908 {
1909         mutex_lock(&nvhdcp->lock);
1910         nvhdcp->state = STATE_RENEGOTIATE;
1911         mutex_unlock(&nvhdcp->lock);
1912         tegra_nvhdcp_on(nvhdcp);
1913         return 0;
1914 }
1915
1916 void tegra_nvhdcp_suspend(struct tegra_nvhdcp *nvhdcp)
1917 {
1918         if (!nvhdcp)
1919                 return;
1920         tegra_nvhdcp_off(nvhdcp);
1921 }
1922
1923 void tegra_nvhdcp_resume(struct tegra_nvhdcp *nvhdcp)
1924 {
1925         if (!nvhdcp)
1926                 return;
1927         tegra_nvhdcp_renegotiate(nvhdcp);
1928 }
1929
1930 void tegra_nvhdcp_shutdown(struct tegra_nvhdcp *nvhdcp)
1931 {
1932         if (!nvhdcp)
1933                 return;
1934         tegra_nvhdcp_off(nvhdcp);
1935 }
1936
1937 static int tegra_nvhdcp_recv_capable(struct tegra_nvhdcp *nvhdcp)
1938 {
1939         if (!nvhdcp)
1940                 return 0;
1941
1942         if (nvhdcp->state == STATE_LINK_VERIFY)
1943                 return 1;
1944         else {
1945                 __u64 b_ksv;
1946                 /* get Bksv from receiver */
1947                 if (!nvhdcp_i2c_read40(nvhdcp, 0x00, &b_ksv))
1948                         return !verify_ksv(b_ksv);
1949         }
1950         return 0;
1951 }
1952
1953 static long nvhdcp_dev_ioctl(struct file *filp,
1954                 unsigned int cmd, unsigned long arg)
1955 {
1956         struct tegra_nvhdcp *nvhdcp = filp->private_data;
1957         struct tegra_nvhdcp_packet *pkt;
1958         int e = -ENOTTY;
1959
1960         switch (cmd) {
1961         case TEGRAIO_NVHDCP_ON:
1962                 return tegra_nvhdcp_on(nvhdcp);
1963
1964         case TEGRAIO_NVHDCP_OFF:
1965                 return tegra_nvhdcp_off(nvhdcp);
1966
1967         case TEGRAIO_NVHDCP_SET_POLICY:
1968                 return tegra_nvhdcp_set_policy(nvhdcp, arg);
1969
1970         case TEGRAIO_NVHDCP_READ_M:
1971                 pkt = kmalloc(sizeof(*pkt), GFP_KERNEL);
1972                 if (!pkt)
1973                         return -ENOMEM;
1974                 if (copy_from_user(pkt, (void __user *)arg, sizeof(*pkt))) {
1975                         e = -EFAULT;
1976                         goto kfree_pkt;
1977                 }
1978                 e = get_m_prime(nvhdcp, pkt);
1979                 if (copy_to_user((void __user *)arg, pkt, sizeof(*pkt))) {
1980                         e = -EFAULT;
1981                         goto kfree_pkt;
1982                 }
1983                 kfree(pkt);
1984                 return e;
1985
1986         case TEGRAIO_NVHDCP_READ_S:
1987                 pkt = kmalloc(sizeof(*pkt), GFP_KERNEL);
1988                 if (!pkt)
1989                         return -ENOMEM;
1990                 if (copy_from_user(pkt, (void __user *)arg, sizeof(*pkt))) {
1991                         e = -EFAULT;
1992                         goto kfree_pkt;
1993                 }
1994                 e = get_s_prime(nvhdcp, pkt);
1995                 if (copy_to_user((void __user *)arg, pkt, sizeof(*pkt))) {
1996                         e = -EFAULT;
1997                         goto kfree_pkt;
1998                 }
1999                 kfree(pkt);
2000                 return e;
2001
2002         case TEGRAIO_NVHDCP_RENEGOTIATE:
2003                 e = tegra_nvhdcp_renegotiate(nvhdcp);
2004                 break;
2005
2006         case TEGRAIO_NVHDCP_HDCP_STATE:
2007                 pkt = kmalloc(sizeof(*pkt), GFP_KERNEL);
2008                 if (!pkt)
2009                         return -ENOMEM;
2010                 e = get_nvhdcp_state(nvhdcp, pkt);
2011                 if (copy_to_user((void __user *)arg, pkt, sizeof(*pkt))) {
2012                         e = -EFAULT;
2013                         goto kfree_pkt;
2014                 }
2015                 kfree(pkt);
2016                 return e;
2017
2018         case TEGRAIO_NVHDCP_RECV_CAPABLE:
2019                 {
2020                         __u32 recv_capable = tegra_nvhdcp_recv_capable(nvhdcp);
2021                         if (copy_to_user((void __user *)arg, &recv_capable,
2022                                 sizeof(recv_capable)))
2023                                 return -EFAULT;
2024                         return 0;
2025                 }
2026         }
2027
2028         return e;
2029 kfree_pkt:
2030         kfree(pkt);
2031         return e;
2032 }
2033
2034 static int nvhdcp_dev_open(struct inode *inode, struct file *filp)
2035 {
2036         struct miscdevice *miscdev = filp->private_data;
2037         struct tegra_nvhdcp *nvhdcp =
2038                 container_of(miscdev, struct tegra_nvhdcp, miscdev);
2039         filp->private_data = nvhdcp;
2040         return 0;
2041 }
2042
2043 static int nvhdcp_dev_release(struct inode *inode, struct file *filp)
2044 {
2045         filp->private_data = NULL;
2046         return 0;
2047 }
2048
2049 static const struct file_operations nvhdcp_fops = {
2050         .owner          = THIS_MODULE,
2051         .llseek         = no_llseek,
2052         .unlocked_ioctl = nvhdcp_dev_ioctl,
2053         .open           = nvhdcp_dev_open,
2054         .release        = nvhdcp_dev_release,
2055 #ifdef CONFIG_COMPAT
2056         .compat_ioctl   = nvhdcp_dev_ioctl,
2057 #endif
2058 };
2059
2060 /* we only support one AP right now, so should only call this once. */
2061 struct tegra_nvhdcp *tegra_nvhdcp_create(struct tegra_hdmi *hdmi,
2062                         int id, int bus)
2063 {
2064         static struct tegra_nvhdcp *nvhdcp; /* prevent multiple calls */
2065         struct i2c_adapter *adapter;
2066         int e;
2067
2068         if (nvhdcp)
2069                 return ERR_PTR(-EMFILE);
2070
2071         nvhdcp = kzalloc(sizeof(*nvhdcp), GFP_KERNEL);
2072         if (!nvhdcp)
2073                 return ERR_PTR(-ENOMEM);
2074
2075         nvhdcp->id = id;
2076         snprintf(nvhdcp->name, sizeof(nvhdcp->name), "nvhdcp%u", id);
2077         nvhdcp->hdmi = hdmi;
2078         mutex_init(&nvhdcp->lock);
2079
2080         strlcpy(nvhdcp->info.type, nvhdcp->name, sizeof(nvhdcp->info.type));
2081         nvhdcp->bus = bus;
2082         nvhdcp->info.addr = 0x74 >> 1;
2083         nvhdcp->info.platform_data = nvhdcp;
2084         nvhdcp->fail_count = 0;
2085         nvhdcp->max_retries = HDCP_INFINITE_RETRIES;
2086         atomic_set(&nvhdcp->policy, hdmi->dc->pdata->default_out->hdcp_policy);
2087
2088         adapter = i2c_get_adapter(bus);
2089         if (!adapter) {
2090                 nvhdcp_err("can't get adapter for bus %d\n", bus);
2091                 e = -EBUSY;
2092                 goto free_nvhdcp;
2093         }
2094
2095         nvhdcp->client = i2c_new_device(adapter, &nvhdcp->info);
2096         i2c_put_adapter(adapter);
2097
2098         if (!nvhdcp->client) {
2099                 nvhdcp_err("can't create new device\n");
2100                 e = -EBUSY;
2101                 goto free_nvhdcp;
2102         }
2103
2104         nvhdcp->state = STATE_UNAUTHENTICATED;
2105
2106         nvhdcp->downstream_wq = create_singlethread_workqueue(nvhdcp->name);
2107         nvhdcp->fallback_wq = create_singlethread_workqueue(nvhdcp->name);
2108
2109         INIT_DELAYED_WORK(&nvhdcp->fallback_work, nvhdcp_fallback_worker);
2110         INIT_DELAYED_WORK(&nvhdcp->hdcp1x_work, nvhdcp_downstream_worker);
2111         INIT_DELAYED_WORK(&nvhdcp->hdcp22_work, nvhdcp2_downstream_worker);
2112
2113         nvhdcp->miscdev.minor = MISC_DYNAMIC_MINOR;
2114         nvhdcp->miscdev.name = nvhdcp->name;
2115         nvhdcp->miscdev.fops = &nvhdcp_fops;
2116
2117         e = misc_register(&nvhdcp->miscdev);
2118         if (e)
2119                 goto free_workqueue;
2120
2121         nvhdcp_vdbg("%s(): created misc device %s\n", __func__, nvhdcp->name);
2122
2123         return nvhdcp;
2124 free_workqueue:
2125         destroy_workqueue(nvhdcp->downstream_wq);
2126         destroy_workqueue(nvhdcp->fallback_wq);
2127         i2c_release_client(nvhdcp->client);
2128 free_nvhdcp:
2129         kfree(nvhdcp);
2130         nvhdcp_err("unable to create device.\n");
2131         return ERR_PTR(e);
2132 }
2133
2134 void tegra_nvhdcp_destroy(struct tegra_nvhdcp *nvhdcp)
2135 {
2136         misc_deregister(&nvhdcp->miscdev);
2137         tegra_nvhdcp_off(nvhdcp);
2138         destroy_workqueue(nvhdcp->downstream_wq);
2139         destroy_workqueue(nvhdcp->fallback_wq);
2140         i2c_release_client(nvhdcp->client);
2141         kfree(nvhdcp);
2142 }
2143
2144 #ifdef CONFIG_TEGRA_DEBUG_HDCP
2145 /* show current maximum number of retries for HDCP authentication */
2146 static int tegra_nvhdcp_max_retries_dbg_show(struct seq_file *m, void *unused)
2147 {
2148         struct tegra_nvhdcp *hdcp = m->private;
2149
2150         if (WARN_ON(!hdcp))
2151                 return -EINVAL;
2152
2153         seq_printf(m, "hdcp max_retries value: %d\n", hdcp->max_retries);
2154
2155         return 0;
2156 }
2157
2158 /*
2159  * sw control for hdcp max retries.
2160  * -1 is the default value which indicates infinite retries
2161  * If a non-infinite value is desired, set max_retries to a non-negative
2162  *  integer
2163  * 0 is the minimum number of retries.
2164  */
2165 static ssize_t tegra_nvhdcp_max_retries_dbg_write(struct file *file,
2166                                                 const char __user *addr,
2167                                                 size_t len, loff_t *pos)
2168 {
2169         struct seq_file *m = file->private_data;
2170         struct tegra_nvhdcp *hdcp = m->private;
2171         u8 new_max_retries;
2172         int ret;
2173
2174         if (WARN_ON(!hdcp))
2175                 return -EINVAL;
2176
2177         ret = kstrtou8_from_user(addr, len, 6, &new_max_retries);
2178         if (ret < 0)
2179                 return ret;
2180
2181         hdcp->max_retries = new_max_retries;
2182
2183         return len;
2184 }
2185
2186 static int tegra_nvhdcp_max_retries_dbg_open(struct inode *inode,
2187                 struct file *file)
2188 {
2189         return single_open(file, tegra_nvhdcp_max_retries_dbg_show,
2190                         inode->i_private);
2191 }
2192
2193 static const struct file_operations tegra_nvhdcp_max_retries_dbg_ops = {
2194         .open = tegra_nvhdcp_max_retries_dbg_open,
2195         .read = seq_read,
2196         .write = tegra_nvhdcp_max_retries_dbg_write,
2197         .llseek = seq_lseek,
2198         .release = single_release,
2199 };
2200
2201 void tegra_nvhdcp_debugfs_init(struct tegra_nvhdcp *nvhdcp)
2202 {
2203         struct dentry *dir, *ret;
2204
2205         dir = debugfs_create_dir("tegra_nvhdcp",  NULL);
2206         if (IS_ERR_OR_NULL(dir))
2207                 return;
2208
2209         ret = debugfs_create_file("max_retries", S_IRUGO, dir,
2210                                 nvhdcp, &tegra_nvhdcp_max_retries_dbg_ops);
2211         if (IS_ERR_OR_NULL(ret))
2212                 goto fail;
2213
2214         return;
2215 fail:
2216         debugfs_remove_recursive(dir);
2217         return;
2218 }
2219 #else
2220 void tegra_nvhdcp_debugfs_init(struct tegra_nvhdcp *nvhdcp)
2221 {
2222         return;
2223 }
2224 #endif