From bb0a925a767b247a473adcbf8ebcbf0262ccb5ee Mon Sep 17 00:00:00 2001 From: Adam Joseph Date: Sat, 5 Feb 2022 16:38:42 -0800 Subject: [PATCH 1/3] remove unfree HDCP blob from arm-trusted-firmware, closes #148890 This patch comes from https://gitlab.com/vicencb/kevinboot/-/blob/master/atf.patch I have been running firmware with this patch on my daily driver rk3399 laptop for the past four months. --- pkgs/misc/arm-trusted-firmware/default.nix | 2 + .../remove-hdcp-blob.patch | 47 +++++++++++++++++++ 2 files changed, 49 insertions(+) create mode 100644 pkgs/misc/arm-trusted-firmware/remove-hdcp-blob.patch diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix index d0b0ae118443..0c4ce33f4d80 100644 --- a/pkgs/misc/arm-trusted-firmware/default.nix +++ b/pkgs/misc/arm-trusted-firmware/default.nix @@ -20,6 +20,8 @@ let sha256 = "sha256-qT9DdTvMcUrvRzgmVf2qmKB+Rb1WOB4p1rM+fsewGcg="; }; + patches = [ ./remove-hdcp-blob.patch ]; + depsBuildBuild = [ buildPackages.stdenv.cc ]; # For Cortex-M0 firmware in RK3399 diff --git a/pkgs/misc/arm-trusted-firmware/remove-hdcp-blob.patch b/pkgs/misc/arm-trusted-firmware/remove-hdcp-blob.patch new file mode 100644 index 000000000000..7f99fbdcabfd --- /dev/null +++ b/pkgs/misc/arm-trusted-firmware/remove-hdcp-blob.patch @@ -0,0 +1,47 @@ +diff --git a/plat/rockchip/rk3399/drivers/dp/cdn_dp.c b/plat/rockchip/rk3399/drivers/dp/cdn_dp.c +index a8773f4f6..8e28c4830 100644 +--- a/plat/rockchip/rk3399/drivers/dp/cdn_dp.c ++++ b/plat/rockchip/rk3399/drivers/dp/cdn_dp.c +@@ -13,17 +13,6 @@ + + #include + +-__asm__( +- ".pushsection .text.hdcp_handler, \"ax\", %progbits\n" +- ".global hdcp_handler\n" +- ".balign 4\n" +- "hdcp_handler:\n" +- ".incbin \"" HDCPFW "\"\n" +- ".type hdcp_handler, %function\n" +- ".size hdcp_handler, .- hdcp_handler\n" +- ".popsection\n" +-); +- + static uint64_t *hdcp_key_pdata; + static struct cdn_dp_hdcp_key_1x key; + +@@ -38,7 +27,7 @@ uint64_t dp_hdcp_ctrl(uint64_t type) + return 0; + case HDCP_KEY_DATA_START_DECRYPT: + if (hdcp_key_pdata == (uint64_t *)(&key + 1)) +- return hdcp_handler(&key); ++ return PSCI_E_DISABLED; + else + return PSCI_E_INVALID_PARAMS; + assert(0); /* Unreachable */ +diff --git a/plat/rockchip/rk3399/platform.mk b/plat/rockchip/rk3399/platform.mk +index a658fb286..5edb6a25b 100644 +--- a/plat/rockchip/rk3399/platform.mk ++++ b/plat/rockchip/rk3399/platform.mk +@@ -88,11 +88,6 @@ $(eval $(call add_define_val,RK3399M0PMUFW,\"$(RK3399M0PMUFW)\")) + ifdef PLAT_RK_DP_HDCP + BL31_SOURCES += ${RK_PLAT_SOC}/drivers/dp/cdn_dp.c + +-HDCPFW=${RK_PLAT_SOC}/drivers/dp/hdcp.bin +-$(eval $(call add_define_val,HDCPFW,\"$(HDCPFW)\")) +- +-${BUILD_PLAT}/bl31/cdn_dp.o: CCACHE_EXTRAFILES=$(HDCPFW) +-${RK_PLAT_SOC}/drivers/dp/cdn_dp.c: $(HDCPFW) + endif + + # CCACHE_EXTRAFILES is needed because ccache doesn't handle .incbin From a5b8650f8dffe71b66b987da9f6200e776626e17 Mon Sep 17 00:00:00 2001 From: Adam Joseph Date: Tue, 8 Feb 2022 01:44:21 -0800 Subject: [PATCH 2/3] arm-trusted-firmware: add unfreeIncludeHDCPBlob?true to control license and blob-removal patch This change implements @lukegb's idea: https://github.gitop.top/NixOS/nixpkgs/issues/148890#issuecomment-1032002903 Specifically, it introduces a new parameter unfreeIncludeHDCPBlob (defaults to true): * If unfreeIncludeHDCPBlob==true then the license is changed to unfreeRedistributable, which will alert the user to the fact that the blob is being included (unless they set NIXPKGS_ALLOW_UNFREE=1). * If unfreeIncludeHDCPBlob==false then the license is kept as bsd3, but a patch is applied to remove the HDCP blob from the build. --- pkgs/misc/arm-trusted-firmware/default.nix | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix index 0c4ce33f4d80..8bf6d31937fe 100644 --- a/pkgs/misc/arm-trusted-firmware/default.nix +++ b/pkgs/misc/arm-trusted-firmware/default.nix @@ -1,4 +1,9 @@ -{ lib, stdenv, fetchFromGitHub, openssl, pkgsCross, buildPackages }: +{ lib, stdenv, fetchFromGitHub, openssl, pkgsCross, buildPackages + +# Warning: this blob runs on the main CPU (not the GPU) at privilege +# level EL3, which is above both the kernel and the hypervisor. +, unfreeIncludeHDCPBlob ? true +}: let buildArmTrustedFirmware = { filesToInstall @@ -20,7 +25,10 @@ let sha256 = "sha256-qT9DdTvMcUrvRzgmVf2qmKB+Rb1WOB4p1rM+fsewGcg="; }; - patches = [ ./remove-hdcp-blob.patch ]; + patches = lib.optionals (!unfreeIncludeHDCPBlob) [ + # this is a rebased version of https://gitlab.com/vicencb/kevinboot/-/blob/master/atf.patch + ./remove-hdcp-blob.patch + ]; depsBuildBuild = [ buildPackages.stdenv.cc ]; @@ -52,7 +60,7 @@ let meta = with lib; { homepage = "https://github.com/ARM-software/arm-trusted-firmware"; description = "A reference implementation of secure world software for ARMv8-A"; - license = licenses.bsd3; + license = if unfreeIncludeHDCPBlob then licenses.unfreeRedistributable else licenses.bsd3; maintainers = with maintainers; [ lopsided98 ]; } // extraMeta; } // builtins.removeAttrs args [ "extraMeta" ]); From d94759023d9d15a0844c138fc16df1a314a3e4dd Mon Sep 17 00:00:00 2001 From: Adam Joseph Date: Tue, 8 Feb 2022 01:53:25 -0800 Subject: [PATCH 3/3] make meta.license be a list rather than a single value --- pkgs/misc/arm-trusted-firmware/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix index 8bf6d31937fe..49fdc7a829c5 100644 --- a/pkgs/misc/arm-trusted-firmware/default.nix +++ b/pkgs/misc/arm-trusted-firmware/default.nix @@ -60,7 +60,7 @@ let meta = with lib; { homepage = "https://github.com/ARM-software/arm-trusted-firmware"; description = "A reference implementation of secure world software for ARMv8-A"; - license = if unfreeIncludeHDCPBlob then licenses.unfreeRedistributable else licenses.bsd3; + license = (if unfreeIncludeHDCPBlob then [ licenses.unfreeRedistributable ] else []) ++ [ licenses.bsd3 ]; maintainers = with maintainers; [ lopsided98 ]; } // extraMeta; } // builtins.removeAttrs args [ "extraMeta" ]);