Maxing Out Sessions Can Cause SPOID Failures

(This is a merge of http://go/wvgerrit/25581)

To prevent dead DRM Plugins from being instantiated when there are no
sessions available, the time at which the device ID is queried has been
moved from instantiation-time to SPOID-calculation-time.

SPOIDs can now fail to be generated. Which means anything that depends
on a SPOID may fail because of this. However, this is a more actionable
problem for apps than having them receive a dead or unusable DRM Plugin
object.

Bug: 36660726
Test: libwvdrmdrmplugin_hidl_test
Change-Id: Ice6a8eabfee8d48bf2af02e2e7169aa95af9f2e4

libwvdrmengine/mediadrm/include_hidl/WVDrmPlugin.h

@@ -308,12 +308,21 @@ struct WVDrmPlugin : public IDrmPlugin, IDrmPluginListener,
 
   class CdmIdentifierBuilder {
    public:
-    CdmIdentifierBuilder(bool useSpoid, const std::string& appPackageName);
+    CdmIdentifierBuilder(bool useSpoid, const WVDrmPlugin& parent,
+                         const std::string& appPackageName);
 
-    const CdmIdentifier& get_identifier();
+    // Fills in the passed-in struct with the CDM Identifier for the current
-    const std::string& get_device_unique_id();
+    // combination of Origin, Application, and Device. This is needed by some
+    // calls into the CDM in order to identify which CDM instance should receive
+    // the call. Calling this will seal the CDM Identifier Builder, thus making
+    // it an error to change the origin.
+    status_t getCdmIdentifier(CdmIdentifier* identifier);
 
-    bool set_device_id(const std::string& id);
+    // Gets the application-safe device-unique ID. On non-SPOID devices, this is
+    // the device-unique ID from OEMCrypto. On SPOID devices, this is the SPOID.
+    // On SPOID devices, calling this will seal the CDM Identifier Builder, thus
+    // making it an error to change the origin.
+    status_t getDeviceUniqueId(std::string* id);
 
     const std::string& origin() const { return mCdmIdentifier.origin; }
     bool set_origin(const std::string& id);
@@ -325,10 +334,16 @@ struct WVDrmPlugin : public IDrmPlugin, IDrmPluginListener,
     bool mIsIdentifierSealed;
 
     bool mUseSpoid;
-    std::string mDeviceId;
     std::string mAppPackageName;
+    const WVDrmPlugin& mParent;
 
-    void calculateSpoid();
+    status_t calculateSpoid();
+
+    // Gets the device-unique ID from OEMCrypto. This must be private, since
+    // this value must not be exposed to applications on SPOID devices. Code
+    // outside this class should use getDeviceUniqueId() to get the
+    // application-safe device-unique ID.
+    status_t getOemcryptoDeviceId(std::string* id);
   } mCdmIdentifierBuilder;
 
   sp<wvcdm::WvContentDecryptionModule> const mCDM;

libwvdrmengine/mediadrm/src_hidl/WVDrmPlugin.cpp

@@ -104,14 +104,10 @@ WVDrmPlugin::WVDrmPlugin(const sp<WvContentDecryptionModule>& cdm,
                          const std::string& appPackageName,
                          WVGenericCryptoInterface* crypto,
                          bool useSpoid)
-  : mCdmIdentifierBuilder(useSpoid, appPackageName),
+  : mCdmIdentifierBuilder(useSpoid, *this, appPackageName),
     mCDM(cdm),
     mCrypto(crypto),
-    mCryptoSessions() {
+    mCryptoSessions() {}
-  std::string deviceId;
-  queryProperty(wvcdm::QUERY_KEY_DEVICE_ID, deviceId);
-  mCdmIdentifierBuilder.set_device_id(deviceId);
-}
 
 WVDrmPlugin::~WVDrmPlugin() {
   typedef map<CdmSessionId, CryptoSession>::iterator mapIterator;
@@ -130,10 +126,16 @@ Return<void> WVDrmPlugin::openSession(openSession_cb _hidl_cb) {
   status_t status = android::OK;
   std::vector<uint8_t> sessionId;
 
+  CdmIdentifier identifier;
+  status = mCdmIdentifierBuilder.getCdmIdentifier(&identifier);
+  if (status != android::OK) {
+    _hidl_cb(toStatus(status), toHidlVec(sessionId));
+    return Void();
+  }
+
   CdmSessionId cdmSessionId;
   CdmResponseType res =
-      mCDM->OpenSession("com.widevine", &mPropertySet,
+      mCDM->OpenSession("com.widevine", &mPropertySet, identifier, this,
-                        mCdmIdentifierBuilder.get_identifier(), this,
                         &cdmSessionId);
 
   if (!isCdmResponseTypeSuccess(res)) {
@@ -213,6 +215,14 @@ Return<void> WVDrmPlugin::getKeyRequest(
   std::vector<uint8_t> request;
   const std::vector<uint8_t> scopeId = toVector(scope);
 
+  CdmIdentifier identifier;
+  status = mCdmIdentifierBuilder.getCdmIdentifier(&identifier);
+  if (status != android::OK) {
+    _hidl_cb(toStatus(status), toHidlVec(request), requestType,
+             defaultUrl.c_str());
+    return Void();
+  }
+
   CdmLicenseType cdmLicenseType;
   CdmSessionId cdmSessionId;
   CdmKeySetId cdmKeySetId;
@@ -285,8 +295,7 @@ Return<void> WVDrmPlugin::getKeyRequest(
   CdmKeyRequest keyRequest;
   CdmResponseType res = mCDM->GenerateKeyRequest(
       cdmSessionId, cdmKeySetId, cdmInitDataType, processedInitData,
-      cdmLicenseType, cdmParameters, &mPropertySet,
+      cdmLicenseType, cdmParameters, &mPropertySet, identifier, &keyRequest);
-      mCdmIdentifierBuilder.get_identifier(), &keyRequest);
 
   requestType = ConvertFromCdmKeyRequestType(keyRequest.type);
 
@@ -431,6 +440,16 @@ Return<Status> WVDrmPlugin::restoreKeys(const hidl_vec<uint8_t>& sessionId,
      const hidl_string& certificateType,
      const hidl_string& certificateAuthority,
      getProvisionRequest_cb _hidl_cb) {
+  status_t status = android::OK;
+  std::string defaultUrl;
+  std::vector<uint8_t> request;
+
+  CdmIdentifier identifier;
+  status = mCdmIdentifierBuilder.getCdmIdentifier(&identifier);
+  if (status != android::OK) {
+    _hidl_cb(toStatus(status), toHidlVec(request), hidl_string(defaultUrl));
+    return Void();
+  }
 
   CdmProvisioningRequest cdmProvisionRequest;
   std::string cdmDefaultUrl;
@@ -443,10 +462,8 @@ Return<Status> WVDrmPlugin::restoreKeys(const hidl_vec<uint8_t>& sessionId,
   std::string cdmCertAuthority = certificateAuthority;
 
   CdmResponseType res = mCDM->GetProvisioningRequest(
-      cdmCertType, cdmCertAuthority, mCdmIdentifierBuilder.get_identifier(),
+      cdmCertType, cdmCertAuthority, identifier, &cdmProvisionRequest,
-       &cdmProvisionRequest, &cdmDefaultUrl);
+      &cdmDefaultUrl);
-  std::string defaultUrl;
-  std::vector<uint8_t> request;
   if (isCdmResponseTypeSuccess(res)) {
     request = StrToVector(cdmProvisionRequest);
     defaultUrl.clear();
@@ -470,14 +487,20 @@ Return<void> WVDrmPlugin::provideProvisionResponse(
   std::vector<uint8_t> certificate;
   std::vector<uint8_t> wrappedKey;
 
+  CdmIdentifier identifier;
+  status_t status = mCdmIdentifierBuilder.getCdmIdentifier(&identifier);
+  if (status != android::OK) {
+    _hidl_cb(toStatus(status), toHidlVec(certificate), toHidlVec(wrappedKey));
+  }
+
   CdmProvisioningResponse cdmResponse(resp.begin(), resp.end());
   if (cdmResponse == kSpecialUnprovisionResponse) {
-    if (mCdmIdentifierBuilder.get_identifier() == kDefaultCdmIdentifier) {
+    if (identifier == kDefaultCdmIdentifier) {
       _hidl_cb(toStatus(kErrorNoOriginSpecified), toHidlVec(certificate),
                toHidlVec(wrappedKey));
       return Void();
     }
-    _hidl_cb(toStatus(unprovision(mCdmIdentifierBuilder.get_identifier())),
+    _hidl_cb(toStatus(unprovision(identifier)),
              toHidlVec(certificate),
              toHidlVec(wrappedKey));
     return Void();
@@ -485,8 +508,7 @@ Return<void> WVDrmPlugin::provideProvisionResponse(
     std::string cdmCertificate;
     std::string cdmWrappedKey;
     CdmResponseType res = mCDM->HandleProvisioningResponse(
-        mCdmIdentifierBuilder.get_identifier(), cdmResponse, &cdmCertificate,
+        identifier, cdmResponse, &cdmCertificate, &cdmWrappedKey);
-        &cdmWrappedKey);
     if (isCdmResponseTypeSuccess(res)) {
       certificate = StrToVector(cdmCertificate);
       wrappedKey = StrToVector(cdmWrappedKey);
@@ -650,7 +672,11 @@ Return<void> WVDrmPlugin::getPropertyByteArray(
   std::vector<uint8_t> value;
 
   if (name == "deviceUniqueId") {
-    value = StrToVector(mCdmIdentifierBuilder.get_device_unique_id());
+    std::string id;
+    status = mCdmIdentifierBuilder.getDeviceUniqueId(&id);
+    if (status == android::OK) {
+      value = StrToVector(id);
+    }
   } else if (name == "provisioningUniqueId") {
     status = queryProperty(wvcdm::QUERY_KEY_PROVISIONING_ID, value);
   } else if (name == "serviceCertificate") {
@@ -1285,31 +1311,36 @@ status_t WVDrmPlugin::unprovision(const CdmIdentifier& identifier) {
 
 // Implementation for the CdmIdentifierBuilder inner class
 WVDrmPlugin::CdmIdentifierBuilder::CdmIdentifierBuilder(
-    bool useSpoid, const std::string& appPackageName)
+    bool useSpoid, const WVDrmPlugin& parent, const std::string& appPackageName)
   : mCdmIdentifier(),
     mIsIdentifierSealed(false),
     mUseSpoid(useSpoid),
-    mDeviceId(),
+    mAppPackageName(appPackageName),
-    mAppPackageName(appPackageName) {}
+    mParent(parent) {}
 
-const CdmIdentifier& WVDrmPlugin::CdmIdentifierBuilder::get_identifier() {
+status_t WVDrmPlugin::CdmIdentifierBuilder::getCdmIdentifier(
-  if (!mIsIdentifierSealed) calculateSpoid();
+    CdmIdentifier* identifier) {
-  mIsIdentifierSealed = true;
+  if (!mIsIdentifierSealed) {
-  return mCdmIdentifier;
+    status_t res = calculateSpoid();
-}
+    if (res != android::OK) return res;
 
-const std::string& WVDrmPlugin::CdmIdentifierBuilder::get_device_unique_id() {
+    mIsIdentifierSealed = true;
-  if (mUseSpoid) {
-    return get_identifier().spoid;
-  } else {
-    return mDeviceId;
   }
+  *identifier = mCdmIdentifier;
+  return android::OK;
 }
 
-bool WVDrmPlugin::CdmIdentifierBuilder::set_device_id(const std::string& id) {
+status_t WVDrmPlugin::CdmIdentifierBuilder::getDeviceUniqueId(std::string* id) {
-  if (mIsIdentifierSealed) return false;
+  if (mUseSpoid) {
-  mDeviceId = id;
+    CdmIdentifier identifier;
-  return true;
+    status_t res = getCdmIdentifier(&identifier);
+    if (res != android::OK) return res;
+
+    *id = identifier.spoid;
+    return android::OK;
+  } else {
+    return getOemcryptoDeviceId(id);
+  }
 }
 
 bool WVDrmPlugin::CdmIdentifierBuilder::set_origin(const std::string& id) {
@@ -1318,12 +1349,16 @@ bool WVDrmPlugin::CdmIdentifierBuilder::set_origin(const std::string& id) {
   return true;
 }
 
-void WVDrmPlugin::CdmIdentifierBuilder::calculateSpoid() {
+status_t WVDrmPlugin::CdmIdentifierBuilder::calculateSpoid() {
   if (mUseSpoid) {
+    std::string deviceId;
+    status_t res = getOemcryptoDeviceId(&deviceId);
+    if (res != android::OK) return res;
+
     uint8_t hash[SHA256_DIGEST_LENGTH];
     SHA256_CTX ctx;
     SHA256_Init(&ctx);
-    SHA256_Update(&ctx, mDeviceId.data(), mDeviceId.length());
+    SHA256_Update(&ctx, deviceId.data(), deviceId.length());
     SHA256_Update(&ctx, mAppPackageName.data(), mAppPackageName.length());
     SHA256_Update(&ctx, origin().data(), origin().length());
     SHA256_Final(hash, &ctx);
@@ -1331,6 +1366,12 @@ void WVDrmPlugin::CdmIdentifierBuilder::calculateSpoid() {
     mCdmIdentifier.spoid =
         std::string(reinterpret_cast<char*>(hash), SHA256_DIGEST_LENGTH);
   }
+  return android::OK;
+}
+
+status_t WVDrmPlugin::CdmIdentifierBuilder::getOemcryptoDeviceId(
+    std::string* id) {
+  return mParent.queryProperty(wvcdm::QUERY_KEY_DEVICE_ID, *id);
 }
 
 }  // namespace widevine

libwvdrmengine/mediadrm/test/WVDrmPlugin_test.cpp

@@ -114,7 +114,6 @@ const std::string kAppId("com.unittest.mock.app.id");
 const uint8_t* const kUnprovisionResponse =
     reinterpret_cast<const uint8_t*>("unprovision");
 const size_t kUnprovisionResponseSize = 11;
-const std::string kDeviceId = "0123456789ABCDEF";
 }
 
 class MockCDM : public WvContentDecryptionModule {
@@ -282,9 +281,6 @@ TEST_F(WVDrmPluginTest, OpensSessions) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   EXPECT_CALL(*cdm,
       OpenSession(StrEq("com.widevine"), _, HasOrigin(EMPTY_ORIGIN), _, _))
@@ -314,9 +310,6 @@ TEST_F(WVDrmPluginTest, ClosesSessions) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   EXPECT_CALL(*cdm, CloseSession(cdmSessionId))
       .Times(1);
@@ -330,9 +323,6 @@ TEST_F(WVDrmPluginTest, ClosesSessionWithoutReturningError) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   EXPECT_CALL(*cdm, CloseSession(cdmSessionId))
       .WillOnce(testing::Return(wvcdm::SESSION_NOT_FOUND_1));
@@ -347,9 +337,6 @@ TEST_F(WVDrmPluginTest, DISABLED_GeneratesKeyRequests) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const size_t kInitDataSize = 128;
   uint8_t initDataRaw[kInitDataSize];
@@ -535,9 +522,6 @@ TEST_F(WVDrmPluginTest, AddsKeys) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const uint32_t kResponseSize = 256;
   uint8_t responseRaw[kResponseSize];
@@ -591,9 +575,6 @@ TEST_F(WVDrmPluginTest, HandlesPrivacyCertCaseOfAddKey) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   sp<StrictMock<MockDrmPluginListener> > listener =
       new StrictMock<MockDrmPluginListener>();
@@ -662,9 +643,6 @@ TEST_F(WVDrmPluginTest, RemovesKeys) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   EXPECT_CALL(*cdm, RemoveKeys(cdmSessionId))
       .Times(1);
@@ -678,9 +656,6 @@ TEST_F(WVDrmPluginTest, RestoresKeys) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const size_t kKeySetIdSize = 32;
   uint8_t keySetIdRaw[kKeySetIdSize];
@@ -704,9 +679,6 @@ TEST_F(WVDrmPluginTest, QueriesKeyStatus) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   std::map<std::string, std::string> expectedLicenseStatus;
   CdmQueryMap cdmLicenseStatus;
@@ -747,9 +719,6 @@ TEST_F(WVDrmPluginTest, GetsProvisioningRequests) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const uint32_t kRequestSize = 256;
   uint8_t requestRaw[kRequestSize];
@@ -783,9 +752,6 @@ TEST_F(WVDrmPluginTest, HandlesProvisioningResponses) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const uint32_t kResponseSize = 512;
   uint8_t responseRaw[kResponseSize];
@@ -818,9 +784,6 @@ TEST_F(WVDrmPluginTest, UnprovisionsDevice) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   EXPECT_CALL(*cdm, Unprovision(kSecurityLevelL1, HasOrigin(EMPTY_ORIGIN)))
       .Times(1);
@@ -836,9 +799,6 @@ TEST_F(WVDrmPluginTest, MuxesUnprovisioningErrors) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   // Tests that both Unprovisions are called even if one fails. Also tests that
   // no matter which fails, the function always propagates the error.
@@ -864,9 +824,6 @@ TEST_F(WVDrmPluginTest, UnprovisionsOrigin) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   std::vector<uint8_t> cert;
   std::vector<uint8_t> key;
@@ -900,9 +857,6 @@ TEST_F(WVDrmPluginTest, WillNotUnprovisionWithoutOrigin) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   std::vector<uint8_t> cert;
   std::vector<uint8_t> key;
@@ -926,9 +880,6 @@ TEST_F(WVDrmPluginTest, MuxesOriginUnprovisioningErrors) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   std::vector<uint8_t> cert;
   std::vector<uint8_t> key;
@@ -979,9 +930,6 @@ TEST_F(WVDrmPluginTest, GetsSecureStops) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const uint32_t kStopSize = 53;
   static const uint32_t kStopCount = 7;
@@ -1038,9 +986,6 @@ TEST_F(WVDrmPluginTest, ReleasesAllSecureStops) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   EXPECT_CALL(*cdm, ReleaseAllUsageInfo(StrEq("")))
       .Times(1);
@@ -1059,9 +1004,6 @@ TEST_F(WVDrmPluginTest, ReleasesSecureStop) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const uint32_t kMessageSize = 128;
   uint8_t messageRaw[kMessageSize];
@@ -1085,9 +1027,6 @@ TEST_F(WVDrmPluginTest, ReturnsExpectedPropertyValues) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   CdmQueryMap l1Map;
   l1Map[QUERY_KEY_SECURITY_LEVEL] = QUERY_VALUE_SECURITY_LEVEL_L1;
@@ -1095,6 +1034,7 @@ TEST_F(WVDrmPluginTest, ReturnsExpectedPropertyValues) {
   CdmQueryMap l3Map;
   l3Map[QUERY_KEY_SECURITY_LEVEL] = QUERY_VALUE_SECURITY_LEVEL_L3;
 
+  static const std::string deviceId("0123456789\0ABCDEF", 17);
   static const std::string systemId = "The Universe";
   static const std::string provisioningId("Life\0&Everything", 16);
   static const std::string openSessions = "42";
@@ -1107,6 +1047,10 @@ TEST_F(WVDrmPluginTest, ReturnsExpectedPropertyValues) {
       .WillOnce(DoAll(SetArgPointee<2>(QUERY_VALUE_SECURITY_LEVEL_L3),
                       testing::Return(wvcdm::NO_ERROR)));
 
+  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
+      .WillOnce(DoAll(SetArgPointee<2>(deviceId),
+                      testing::Return(wvcdm::NO_ERROR)));
+
   EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_SYSTEM_ID, _))
       .WillOnce(DoAll(SetArgPointee<2>(systemId),
                       testing::Return(wvcdm::NO_ERROR)));
@@ -1174,7 +1118,7 @@ TEST_F(WVDrmPluginTest, ReturnsExpectedPropertyValues) {
                   [&](Status status, hidl_vec<uint8_t> vectorResult) {
     ASSERT_EQ(Status::OK, status);
     std::vector<uint8_t> id(vectorResult);
-    EXPECT_THAT(id, ElementsAreArray(kDeviceId.data(), kDeviceId.size()));
+    EXPECT_THAT(id, ElementsAreArray(deviceId.data(), deviceId.size()));
   });
 
   plugin.getPropertyString(
@@ -1219,9 +1163,6 @@ TEST_F(WVDrmPluginTest, DoesNotGetUnknownProperties) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   WVDrmPlugin plugin(cdm.get(), appPackageName, &crypto, false);
   std::string stringResult;
@@ -1246,9 +1187,6 @@ TEST_F(WVDrmPluginTest, DoesNotSetUnknownProperties) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const uint32_t kValueSize = 32;
   uint8_t valueRaw[kValueSize];
@@ -1273,9 +1211,6 @@ TEST_F(WVDrmPluginTest, FailsGenericMethodsWithoutAnAlgorithmSet) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   std::vector<uint8_t> keyId;
   std::vector<uint8_t> input;
@@ -1343,9 +1278,6 @@ TEST_F(WVDrmPluginTest, CallsGenericEncrypt) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const size_t kDataSize = 256;
   uint8_t keyIdRaw[KEY_ID_SIZE];
@@ -1414,9 +1346,6 @@ TEST_F(WVDrmPluginTest, CallsGenericDecrypt) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const size_t kDataSize = 256;
   uint8_t keyIdRaw[KEY_ID_SIZE];
@@ -1485,9 +1414,6 @@ TEST_F(WVDrmPluginTest, CallsGenericSign) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const size_t kDataSize = 256;
   uint8_t keyIdRaw[KEY_ID_SIZE];
@@ -1559,9 +1485,6 @@ TEST_F(WVDrmPluginTest, CallsGenericVerify) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   static const size_t kDataSize = 256;
   static const size_t kSignatureSize = 16;
@@ -1649,9 +1572,6 @@ TEST_F(WVDrmPluginTest, RegistersForEvents) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   // Provide expected behavior to support session creation
   EXPECT_CALL(*cdm, OpenSession(StrEq("com.widevine"), _, _, _, _))
@@ -1676,9 +1596,6 @@ TEST_F(WVDrmPluginTest, UnregistersForAllEventsOnDestruction) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   uint8_t sessionIdRaw1[kSessionIdSize];
   uint8_t sessionIdRaw2[kSessionIdSize];
@@ -1723,9 +1640,6 @@ TEST_F(WVDrmPluginTest, DISABLED_MarshalsEvents) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   sp<StrictMock<MockDrmPluginListener> > listener =
       new StrictMock<MockDrmPluginListener>();
@@ -1810,9 +1724,6 @@ TEST_F(WVDrmPluginTest, DISABLED_GeneratesProvisioningNeededEvent) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   sp<StrictMock<MockDrmPluginListener> > listener =
       new StrictMock<MockDrmPluginListener>();
@@ -1845,9 +1756,6 @@ TEST_F(WVDrmPluginTest, ProvidesExpectedDefaultPropertiesToCdm) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   const CdmClientPropertySet* propertySet = NULL;
 
@@ -1887,9 +1795,6 @@ TEST_F(WVDrmPluginTest, CanSetAppId) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   const CdmClientPropertySet* propertySet = NULL;
 
@@ -1945,9 +1850,6 @@ TEST_P(WVDrmPluginOriginTest, CanSetOrigin) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   OriginTestVariant params = GetParam();
 
@@ -1994,9 +1896,6 @@ TEST_F(WVDrmPluginTest, CanSetSecurityLevel) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   const CdmClientPropertySet* propertySet = NULL;
 
@@ -2127,9 +2026,6 @@ TEST_F(WVDrmPluginTest, CanSetPrivacyMode) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   const CdmClientPropertySet* propertySet = NULL;
 
@@ -2181,9 +2077,6 @@ TEST_F(WVDrmPluginTest, CanSetServiceCertificate) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   const CdmClientPropertySet* propertySet = NULL;
 
@@ -2257,9 +2150,6 @@ TEST_F(WVDrmPluginTest, CanSetSessionSharing) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   const CdmClientPropertySet* propertySet = NULL;
 
@@ -2336,9 +2226,6 @@ TEST_F(WVDrmPluginTest, AllowsStoringOfSessionSharingId) {
   android::sp<StrictMock<MockCDM>> cdm = new StrictMock<MockCDM>();
   StrictMock<MockCrypto> crypto;
   std::string appPackageName;
-  EXPECT_CALL(*cdm, QueryStatus(_, QUERY_KEY_DEVICE_ID, _))
-      .WillOnce(DoAll(SetArgPointee<2>(kDeviceId),
-                      testing::Return(wvcdm::NO_ERROR)));
 
   CdmClientPropertySet* propertySet = NULL;