Plumb PPAPI PlatformVerification into CDM.h

media/cdm/ppapi/cdm_wrapper.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cstring>
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
+#include "build/build_config.h"
 #include "media/cdm/ppapi/api/content_decryption_module.h"

[ddorwin, 2013/09/17 05:26:46]

You need a DEPS roll in this CL. (Make sure it's backwards compatible.)

 #include "media/cdm/ppapi/linked_ptr.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/pp_stdint.h"
 #include "ppapi/c/private/pp_content_decryptor.h"
 #include "ppapi/cpp/completion_callback.h"
 #include "ppapi/cpp/core.h"
 #include "ppapi/cpp/dev/buffer_dev.h"
 #include "ppapi/cpp/instance.h"
 #include "ppapi/cpp/logging.h"
 #include "ppapi/cpp/module.h"
 #include "ppapi/cpp/pass_ref.h"
 #include "ppapi/cpp/private/content_decryptor_private.h"
 #include "ppapi/cpp/resource.h"
 #include "ppapi/cpp/var.h"
 #include "ppapi/cpp/var_array_buffer.h"
 #include "ppapi/utility/completion_callback_factory.h"
 
 #if defined(CHECK_DOCUMENT_URL)
 #include "ppapi/cpp/dev/url_util_dev.h"
 #include "ppapi/cpp/instance_handle.h"
 #endif  // defined(CHECK_DOCUMENT_URL)
 
+#if defined(OS_CHROMEOS)
+#include "ppapi/cpp/private/platform_verification.h"
+#endif
+
 namespace {
 
 bool IsMainThread() {
   return pp::Module::Get()->core()->IsMainThread();
 }
 
 // Posts a task to run |cb| on the main thread. The task is posted even if the
 // current thread is the main thread.
 void PostOnMain(pp::CompletionCallback cb) {
   pp::Module::Get()->core()->CallOnMainThread(0, cb, PP_OK);
@@ skipping 432 matching lines @@
   DISALLOW_COPY_AND_ASSIGN(AudioFramesImpl);
 };
 
 // GetCdmHostFunc implementation.
 void* GetCdmHost(int host_interface_version, void* user_data);
 
 // A wrapper class for abstracting away PPAPI interaction and threading for a
 // Content Decryption Module (CDM).
 class CdmWrapper : public pp::Instance,
                    public pp::ContentDecryptor_Private,
-                   public cdm::Host {
+                   public cdm::Host_1,
+                   public cdm::Host_2 {

[dmichael (off chromium), 2013/09/17 20:10:46]

Is this just temporary to deal with DEPS? If so, fine. Otherwise, I would rather
have descriptive names :-)

[DaleCurtis, 2013/09/17 20:18:51]

Temporary IIUC.  Host_1 can be removed in favor of just Host once all clients
are converted.

[ddorwin, 2013/09/17 23:24:39]

Correct. Also, _2 is a version of the Host interface struct in our
backwards-compatible API. It's not just type1 and type2. :)

  public:
   CdmWrapper(PP_Instance instance, pp::Module* module);
   virtual ~CdmWrapper();
 
   // pp::Instance implementation.
   virtual bool Init(uint32_t argc, const char* argn[], const char* argv[]) {
     return true;
   }
 
   // PPP_ContentDecryptor_Private implementation.
@@ skipping 17 matching lines @@
       pp::Buffer_Dev extra_data_buffer) OVERRIDE;
   virtual void DeinitializeDecoder(PP_DecryptorStreamType decoder_type,
                                    uint32_t request_id) OVERRIDE;
   virtual void ResetDecoder(PP_DecryptorStreamType decoder_type,
                             uint32_t request_id) OVERRIDE;
   virtual void DecryptAndDecode(
       PP_DecryptorStreamType decoder_type,
       pp::Buffer_Dev encrypted_buffer,
       const PP_EncryptedBlockInfo& encrypted_block_info) OVERRIDE;
 
-  // cdm::Host implementation.
+  // cdm::Host_1 implementation.
   virtual cdm::Buffer* Allocate(int32_t capacity) OVERRIDE;
   virtual void SetTimer(int64_t delay_ms, void* context) OVERRIDE;
   virtual double GetCurrentWallTimeInSeconds() OVERRIDE;
   virtual void SendKeyMessage(
       const char* session_id, int32_t session_id_length,
       const char* message, int32_t message_length,
       const char* default_url, int32_t default_url_length) OVERRIDE;
   virtual void SendKeyError(const char* session_id,
                             int32_t session_id_length,
                             cdm::MediaKeyError error_code,
                             uint32_t system_code) OVERRIDE;
   virtual void GetPrivateData(int32_t* instance,
                               GetPrivateInterface* get_interface) OVERRIDE;
 
+  // cdm::Host_2 implementation.
+  virtual void SendPlatformChallenge(
+      const char* service_id, int32_t service_id_length,
+      const char* challenge, int32_t challenge_length) OVERRIDE;
+  virtual void EnableOutputProtection(
+      uint32_t desired_protection_mask) OVERRIDE;
+  virtual void QueryOutputProtectionStatus() OVERRIDE;
+
  private:
   struct SessionInfo {
     SessionInfo(const std::string& key_system_in,
                 const std::string& session_id_in)
         : key_system(key_system_in),
           session_id(session_id_in) {}
     const std::string key_system;
     const std::string session_id;
   };
 
@@ skipping 47 matching lines @@
   void DeliverSamples(int32_t result,
                       const cdm::Status& status,
                       const LinkedAudioFrames& audio_frames,
                       const PP_DecryptTrackingInfo& tracking_info);
 
   // Helper for SetTimer().
   void TimerExpired(int32_t result, void* context);
 
   bool IsValidVideoFrame(const LinkedVideoFrame& video_frame);
 
+#if defined(OS_CHROMEOS)
+  bool CanChallengePlatform();
+  void CanChallengePlatformDone(int32_t result, bool can_challenge_platform);

[ddorwin, 2013/09/17 05:26:46]

OnCan... ?

[DaleCurtis, 2013/09/17 18:49:33]

Style elsewhere in the file is XxxDone; i.e., DecoderInitializeDone(), etc.  I'm
happy to change it if that's what you prefer though.

+  void SendPlatformChallengeDone(int32_t result);
+
+  // Since CanChallengePlatform() needs to return its value immediately, we need
+  // to delay GenerateKeyRequest() until its value is available.
+  // TODO(dalecurtis): This stinks.  We need to find a way to deliver the value
+  // synchronously.  Potentially as part of the new Initialize(), see
+  // http://crbug.com/250049
+  void DelayedGenerateKeyRequest(int32_t result,
+                                 const std::string& key_system,
+                                 const std::string& type,
+                                 pp::VarArrayBuffer init_data);
+
+  pp::PlatformVerification platform_verification_;
+  bool is_can_challenge_platform_set_;

[ddorwin, 2013/09/17 05:26:46]

It's not clear from the name what this does. _initialized_? _pending_? In the
latter case, it would be true in the constructor then cleared.

[DaleCurtis, 2013/09/23 18:30:57]

Done.

+  pp::CompletionCallback delayed_gkr_;
+
+  // Since PPAPI doesn't provide handlers for CompleteCallbacks w/ more than one

[ddorwin, 2013/09/17 05:26:46]

CompletionC...

[DaleCurtis, 2013/09/23 18:30:57]

Done.

+  // output we need to manage our own.  These values are read only by

[ddorwin, 2013/09/17 05:26:46]

nit: since this order could be ambiguous, swap read & only: only read

[DaleCurtis, 2013/09/23 18:30:57]

Done.

+  // SendPlatformChallengeDone().
+  // TODO(dalecurtis): CompletionCallbackFactory mentions this may not be safe
+  // since the module could be destructed before callbacks complete... True?

[dmichael (off chromium), 2013/09/17 20:10:46]

Can you point me to the comment you saw that indicates this? I don't *think*
that can happen here.

[DaleCurtis, 2013/09/17 20:18:51]

https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/utility/comp...

[dmichael (off chromium), 2013/09/17 20:36:58]

Ah, thanks. This stuff is confusing, and I still forget about that problem.

Your case is a little different than what it's talking about. Your callbacks are
scoped to platform_verification_, and when it gets destroyed, those will get
aborted. Your Vars are scoped to the instance, so they get destroyed about the
same time...  and in the abort case, you don't write to the Vars. So you should
be safe. It would be dangerous if you could get a "successful" callback
invocation after the Vars are destroyed, but that doesn't seem possible here.

[DaleCurtis, 2013/09/23 18:30:57]

Thanks for the explanation.  Comment removed.

+  pp::Var signed_data_output_;
+  pp::Var signed_data_signature_output_;
+  pp::Var platform_key_certificate_output_;
+#endif
+
   PpbBufferAllocator allocator_;
   pp::CompletionCallbackFactory<CdmWrapper> callback_factory_;
   cdm::ContentDecryptionModule* cdm_;

[Rintaro Kuroiwa, 2013/09/20 01:55:06]

When OS_CHROMEOS is defined, this will error at 1264.

[DaleCurtis, 2013/09/23 18:30:57]

Yeah I have another change to the CDM.h that switches over to v2 as the default.
 I'll get that uploaded separately.

   std::string key_system_;
+  bool can_challenge_platform_;

[ddorwin, 2013/09/17 05:26:46]

We don't really need this other than OS_CHROMEOS. It adds one more ifdef, but
it's less confusing when grouped I think.

[DaleCurtis, 2013/09/23 18:30:57]

Done.

 
   DISALLOW_COPY_AND_ASSIGN(CdmWrapper);
 };
 
 CdmWrapper::CdmWrapper(PP_Instance instance, pp::Module* module)
     : pp::Instance(instance),
       pp::ContentDecryptor_Private(this),
+#if defined(OS_CHROMEOS)
+      platform_verification_(this),
+      is_can_challenge_platform_set_(false),
+#endif
       allocator_(this),
-      cdm_(NULL) {
+      cdm_(NULL),
+      can_challenge_platform_(false) {
   callback_factory_.Initialize(this);
+#if defined(OS_CHROMEOS)
+  // Preemptively retrieve the platform challenge status.  It will not change.
+  platform_verification_.CanChallengePlatform(

[ddorwin, 2013/09/17 05:26:46]

Re-entrancy from an Instance constructor seems like a bad idea. Maybe
PostOnMain. That's also re-entrant, but at least I think that operates at a
module level.

[DaleCurtis, 2013/09/17 18:49:33]

Hmm, it will end up as a post anyways when the IPC message is sent, but in an
error state the completion callback might be called prior to returning. 
dmichael@ WDYT?

[dmichael (off chromium), 2013/09/17 20:10:46]

I'm not sure what re-entrancy you're worried about.

The default completion callback is "required", meaning it will run
asynchronously.
(https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/pp_complet...)

So CdmWrapper won't be re-entered.

Re-entering in to Pepper is par for the course...  we have to deal with it; it's
just normal to call Pepper functions when Pepper calls you.

So this looks fine to me.

[ddorwin, 2013/09/17 23:24:39]

I was just worried about re-entrancy when we're in the middle of creating a
pp::Instance. CdmWrapper is a pp::Instance, and we're invoking a completely
separate PPB interface from the constructor of the pp::Instance.

+      callback_factory_.NewCallbackWithOutput(
+          &CdmWrapper::CanChallengePlatformDone));
+#endif
 }
 
 CdmWrapper::~CdmWrapper() {
   if (cdm_)
     cdm_->Destroy();
 }
 
 bool CdmWrapper::CreateCdmInstance(const std::string& key_system) {
   PP_DCHECK(!cdm_);
   cdm_ = static_cast<cdm::ContentDecryptionModule*>(

[Rintaro Kuroiwa, 2013/09/20 01:55:06]

How are we going to make cdm_ be an instance of CDM_2?

[DaleCurtis, 2013/09/23 18:30:57]

It'll be the default.  v1 CDM won't call into methods which require the v2
callbacks.

       ::CreateCdmInstance(cdm::kCdmInterfaceVersion,
                           key_system.data(), key_system.size(),
                           GetCdmHost, this));
 
   return (cdm_ != NULL);
 }
 
 void CdmWrapper::GenerateKeyRequest(const std::string& key_system,
                                     const std::string& type,
                                     pp::VarArrayBuffer init_data) {
   PP_DCHECK(!key_system.empty());
   PP_DCHECK(key_system_.empty() || key_system_ == key_system);
 
 #if defined(CHECK_DOCUMENT_URL)
   PP_URLComponents_Dev url_components = {};
   pp::Var href = pp::URLUtil_Dev::Get()->GetDocumentURL(
       pp::InstanceHandle(pp_instance()), &url_components);
   PP_DCHECK(href.is_string());
   PP_DCHECK(!href.AsString().empty());
   PP_DCHECK(url_components.host.begin);
   PP_DCHECK(0 < url_components.host.len);
 #endif  // defined(CHECK_DOCUMENT_URL)
 
+#if defined(OS_CHROMEOS)
+  // Ensure CanChallengePlatform() has valid data before initializing the CDM;
+  // delaying the GenerateKeyRequest if necessary.
+  if (!is_can_challenge_platform_set_) {
+    delayed_gkr_ = callback_factory_.NewCallback(

[ddorwin, 2013/09/17 05:26:46]

What if you get multiple GKRs at the same time?

[DaleCurtis, 2013/09/17 18:49:33]

Ugh, I didn't realize that was a thing.  To handle delay I'll need to use a list
/ deque of structs containing the initialization data.  

Note, this also unblocks the renderer thread when it returns, allowing other
decoding tasks to start processing.  In testing if the delay is too long the
tests will fail since playback reaches > 1 second without a keyAdded event.

[DaleCurtis, 2013/09/23 18:30:57]

Yeah, delay isn't going to work.  I've instead changed it to err on the side of
the most common case if the value isn't available for now... It's not great, but
until we figure out whats happening with the Initialize() parameter, it's the
best I can come up with.

+        &CdmWrapper::DelayedGenerateKeyRequest, key_system, type, init_data);
+    return;
+  }
+#endif
+
   if (!cdm_) {
     if (!CreateCdmInstance(key_system)) {
       SendUnknownKeyError(key_system, std::string());
       return;
     }
   }
   PP_DCHECK(cdm_);
 
   // Must be set here in case the CDM synchronously calls a cdm::Host method.
   // Clear below on error.
@@ skipping 266 matching lines @@
                               int32_t session_id_length,
                               cdm::MediaKeyError error_code,
                               uint32_t system_code) {
   SendKeyErrorInternal(key_system_,
                        std::string(session_id, session_id_length),
                        error_code,
                        system_code);
 }
 
 void CdmWrapper::GetPrivateData(int32_t* instance,
-                                cdm::Host::GetPrivateInterface* get_interface) {
+                                GetPrivateInterface* get_interface) {
   *instance = pp_instance();
   *get_interface = pp::Module::Get()->get_browser_interface();
 }
 
 void CdmWrapper::SendUnknownKeyError(const std::string& key_system,
                                      const std::string& session_id) {
   SendKeyErrorInternal(key_system, session_id, cdm::kUnknownError, 0);
 }
 
 void CdmWrapper::SendKeyAdded(const std::string& key_system,
@@ skipping 198 matching lines @@
         static_cast<cdm::VideoFrame::VideoPlane>(i);
     if (ppb_buffer->Size() < video_frame->PlaneOffset(plane) +
                              plane_height * video_frame->Stride(plane)) {
       return false;
     }
   }
 
   return true;
 }
 
+bool CdmWrapper::CanChallengePlatform() {
+  return can_challenge_platform_;
+}
+
+void CdmWrapper::SendPlatformChallenge(
+    const char* service_id, int32_t service_id_length,
+    const char* challenge, int32_t challenge_length) {
+#if defined(OS_CHROMEOS)
+  // TODO(dalecurtis): Reinitialize member variables to PP_Undefined?
+
+  pp::VarArrayBuffer challenge_var(challenge_length);
+  uint8_t* var_data = static_cast<uint8_t*>(challenge_var.Map());
+  memcpy(var_data, challenge, challenge_length);
+
+  std::string service_id_str(service_id, service_id_length);
+  int32_t result = platform_verification_.ChallengePlatform(
+      pp::Var(service_id_str), challenge_var, &signed_data_output_,
+      &signed_data_signature_output_, &platform_key_certificate_output_,

[ddorwin, 2013/09/17 05:26:46]

Why are these passed as pointers? Aren't all pp::Vars modifiable?

[DaleCurtis, 2013/09/17 18:49:33]

[out] type variables end up as Var* per the PPAPI generator, so I'm just going
with the flow.  dmichael@ can probably elaborate.

[dmichael (off chromium), 2013/09/17 20:10:46]

ddorwin: I'm not sure what you mean...  we try to follow Chromium/Google style
as much as possible. So we use pointers for out-params, so we can modify the
members. In this case, the Vars will be set to VarArrayBuffers. We have to be
able to set the "type" and the "id" of the vars.

+      callback_factory_.NewCallback(&CdmWrapper::SendPlatformChallengeDone));
+  challenge_var.Unmap();
+#else
+  PlatformChallengeResponse pcr = {};

[ddorwin, 2013/09/17 05:26:46]

suggest: s/pcr/response/

[DaleCurtis, 2013/09/23 18:30:57]

Done.

+  cdm_->OnPlatformChallengeResponse(pcr);
+#endif
+}
+
+#if defined(OS_CHROMEOS)
+void CdmWrapper::CanChallengePlatformDone(int32_t result,
+                                          bool can_challenge_platform) {
+  PP_DCHECK(!is_can_challenge_platform_set_);
+  can_challenge_platform_ = (result == PP_OK) ? can_challenge_platform : false;
+  is_can_challenge_platform_set_ = true;
+  if (!delayed_gkr_.IsOptional())

[ddorwin, 2013/09/17 05:26:46]

? Is the gkr ever optional?

[DaleCurtis, 2013/09/17 18:49:33]

I'm just using it to check if the callback is uninitialized.  In this case it's
equivalent to is_null().

[DaleCurtis, 2013/09/23 18:30:57]

Removed since now I can just store the key system.

+    delayed_gkr_.RunAndClear(PP_OK);
+}
+
+void CdmWrapper::SendPlatformChallengeDone(int32_t result) {
+  if (result != PP_OK) {
+    cdm::PlatformChallengeResponse pcr = {};

[ddorwin, 2013/09/17 05:26:46]

same

[DaleCurtis, 2013/09/23 18:30:57]

Done.

+    cdm_->OnPlatformChallengeResponse(pcr);
+    return;
+  }
+
+  pp::VarArrayBuffer signed_data_var(signed_data_output_);
+  pp::VarArrayBuffer signed_data_signature_var(signed_data_signature_output_);

[dmichael (off chromium), 2013/09/17 20:10:46]

signed_data_output_ = pp::Var();
signed_data_signature_output_ = pp::Var();
?

[DaleCurtis, 2013/09/23 18:30:57]

Done.

+  std::string pkc_string = platform_key_certificate_output_.AsString();

[ddorwin, 2013/09/17 05:26:46]

nit: "pkc" is not descriptive

[DaleCurtis, 2013/09/23 18:30:57]

Done.

+
+  cdm::PlatformChallengeResponse pcr = {
+    static_cast<uint8_t*>(signed_data_var.Map()),
+    signed_data_var.ByteLength(),
+
+    static_cast<uint8_t*>(signed_data_signature_var.Map()),
+    signed_data_signature_var.ByteLength(),
+
+    reinterpret_cast<const uint8_t*>(pkc_string.c_str()),

[dmichael (off chromium), 2013/09/17 20:10:46]

static_cast?

[DaleCurtis, 2013/09/17 20:18:51]

Requires reinterpret_cast for char* -> uint8_t*

[Rintaro Kuroiwa, 2013/09/20 01:55:06]

Also need const_cast. The struct needs a non-const pointer.

[DaleCurtis, 2013/09/23 18:30:57]

I have another patch which makes these fields const in CDM.h. 

+    pkc_string.length()
+  };
+  cdm_->OnPlatformChallengeResponse(pcr);
+
+  signed_data_var.Unmap();
+  signed_data_signature_var.Unmap();
+}
+
+void CdmWrapper::DelayedGenerateKeyRequest(int32_t result,

[ddorwin, 2013/09/17 05:26:46]

nit: The function name is a noun not an action

[DaleCurtis, 2013/09/23 18:30:57]

Removed.

+                                           const std::string& key_system,
+                                           const std::string& type,
+                                           pp::VarArrayBuffer init_data) {

[dmichael (off chromium), 2013/09/17 20:10:46]

It's probably best to pass Var by const-reference, to avoid reference counting
(which has to acquire a lock on both the AddRef and the Release).

[DaleCurtis, 2013/09/23 18:30:57]

Removed.

+  GenerateKeyRequest(key_system, type, init_data);
+}
+#endif
+
+void CdmWrapper::EnableOutputProtection(uint32_t desired_protection_mask) {
+  // TODO(dalecurtis): Add implementation once PPAPI has landed.
+  cdm_->OnQueryOutputProtectionStatus(0, 0);
+}
+
+void CdmWrapper::QueryOutputProtectionStatus() {
+  // TODO(dalecurtis): Add implementation once PPAPI has landed.
+  cdm_->OnQueryOutputProtectionStatus(0, 0);
+}
+
 void* GetCdmHost(int host_interface_version, void* user_data) {
   if (!host_interface_version || !user_data)
     return NULL;
 
-  if (host_interface_version != cdm::kHostInterfaceVersion)
-    return NULL;
-
-  CdmWrapper* cdm_wrapper = static_cast<CdmWrapper*>(user_data);
-  return static_cast<cdm::Host*>(cdm_wrapper);
+  switch (host_interface_version) {
+    case cdm::kHostInterfaceVersion_1:
+      return static_cast<cdm::Host_1*>(static_cast<CdmWrapper*>(user_data));

[ddorwin, 2013/09/17 05:26:46]

tiny optional suggestion: It's an extra line but might be clearer to do the
CdmWrapper cast on a separate line.

[DaleCurtis, 2013/09/23 18:30:57]

Done.

+    case cdm::kHostInterfaceVersion_2:
+      return static_cast<cdm::Host_2*>(static_cast<CdmWrapper*>(user_data));
+    default:
+      return NULL;

[ddorwin, 2013/09/17 05:26:46]

NOTREACHED()

[DaleCurtis, 2013/09/23 18:30:57]

Done.

+  }
 }
 
 // This object is the global object representing this plugin library as long
 // as it is loaded.
 class CdmWrapperModule : public pp::Module {
  public:
   CdmWrapperModule() : pp::Module() {
     // This function blocks the renderer thread (PluginInstance::Initialize()).
     // Move this call to other places if this may be a concern in the future.
     INITIALIZE_CDM_MODULE();
@@ skipping 10 matching lines @@
 }  // namespace media
 
 namespace pp {
 
 // Factory function for your specialization of the Module object.
 Module* CreateModule() {
   return new media::CdmWrapperModule();
 }
 
 }  // namespace pp