This is based on a patch submitted by Amlogic.
When we're doing decrypt fallback, either in the CDM or the OEMCrypto
tests, we sometimes fall back to a point where we're synthesizing new
samples and/or subsamples for the content being decrypted. When this
happens and the output buffer is clear, we should limit the size of the
output buffer to only the space needed to hold the output.
Previously, we've been passing the entire output buffer to every call.
This can create a problem if the reason for the fallback is a lack of
enough memory to communicate the buffers to the TA, since the output
buffer will remain the same size as the total output. Restricting the
buffer passed to each call to only the space needed by that call will
reduce the memory requirement.
Cherry-picked from http://go/wvgerrit/205311
Bug: 354834629
Test: x86-64
Merged from https://widevine-internal-review.googlesource.com/204810
Change-Id: I412f43d8f88c72072ef1dd5293436bdb58e500b3
This test should have been removed in v17, when we allowed this pattern
to be used with cbcs. Although we can't start enforcing the correct
behavior until v20 now, we can remove enforcement of the incorrect
behavior.
Cherry-picked from http://go/wvgerrit/205310
Bug: 356173926
Merged from https://widevine-internal-review.googlesource.com/204832
Change-Id: Idc6e3109286daabb83874d52ad3abaff5e14badb
The docs on OEMCrypto_DecryptCENC() weren't updated correctly when we
allowed the (0,0) pattern in v17. This patch brings the header docs
in-line with the handwritten part of the devsite documentation.
Merged from http://go/wvgerrit/204611
Bug: 336330529
Change-Id: Ic6c81d8f04904b83c34fbc0235ebbae8705a4182
[ Merge of http://go/wvgerrit/200415 ]
UDC specific: No DRM reprovisioning support
The SystemIdExtractor did not properly define behavior when working
with opened/closed CryptoSessions. Due to the CryptoSession's class
dual role of being both a session and a general handle into the
crypto engine, small bugs relying on undefined behavior which happened
to return expected output allowed tests to pass.
This CL makes the following changes:
1) Have SystemIdExtractor verify caller expectations when session is
open.
2) Improved SystemIdExtractor to operate when CryptoSession is opened
or closed.
3) Updates several SystemIdExtractorTest cases to better test defined
behavior without relying on undefined behavior.
4) Better code comments; hopefully some which will help prevent future
misuse of the internal APIs.
Test: system_id_extractor_unittest on Oriole
Test: WVTS on oriole
Bug: 329713288
Change-Id: I65518fe62f43e8060ea752852eb08a3d7132e2a0
Also added a unit test to verify that decryption without a license fails
with the correct error code. Also changed comment types for policy
integration tests and core integration tests to be picked up by Doxygen.
Bug: 320785945
Merged from https://widevine-internal-review.googlesource.com/194910
Change-Id: Ibdb70683003bb430dde9b4a1bd9fc9839bace342
(cherry picked from commit d05d3738b4)
There are three changes here that should help reduce the
amount of duration test failures caused by clock skew.
First, we reported some skew when the test expected playback
to start immediately after loading the license. However,
with round-off, this could easily be more than 1 second. So
this does not warrent even a warning.
Second, the fake and real clocks were only synced after
computing how long to sleep. This is fixed by moving
SleepUntil to the TestSleep class and having it sync before
computing the delta and after doing the sleep.
Third, I am guessing that some failures due to unexpected
lenience were caused by the rental or playback clock being
started at the end of signing the license or the end of the
first decrypt instead of the beginning. We work around this
by recording how long these operations take, and then adding
this extra time at the end of the check for FailDecrypt.
Bug: 275003529
Bug: 279249646
Bug: 207500749
Test: Luci tests
Change-Id: I6a973565edfbebca53ee7f239b4b93f8f73d1e0a
[ Merge of http://go/wvgerrit/194930 ]
[ Cherry-pick of http://ag/26577931 ]
OEMCrypto v17 introduced higher granularity in the device's HDCP V1
levels. Previously, all HDCP v1.x were group together. The change
was aimed towards server policy enforcement, not device enforcement.
Core code was updated, and could then be reflected in license
requests; however, reporting the new v1.x subversions was never
exposed to the higher app layers.
It is likely that devices which attempted to use specific 1.x versions
encountered test failures (for both CE CDM and Android CDM) as neither
implementations could handle such versions when communicating with
the app.
This change updates both CE CDM and Android CDM:
1) The CE CDM now uses the same subversion version comparisons as
performed by the core code.
2) The Android CDM will now recognize new HDCP levels, and not return
unexpected values.
Bug: 329155501
Test: run_x86_64_tests
Test: request_license_test on Oriole
Change-Id: I61fc0f11808f594456bd00210fd9b2bb5ed16c0e
[ Merge of http://go/wvgerrit/189650 ]
The CDM session shares its CryptoSession instance with a few additional
member objects (CdmLicense and PolicyEngine). When the CDM session's
crypto session is reset, it must also reset the CdmLicense and
PolicyEngine otherwise, a potential stale pointer reference may occur.
Test: request_license_test on Oriole
Test: WVTS on Oriole
Bug: 311239278
Change-Id: Ie175513ae652dcd96e12e5e1def574a8a56d5863
ag/26105061 accidentally reverted some of these changes so I am pushing
up another patch to add them back in.
[ Merged of go/wvgerrit/186370 ]
CDM by default allows test keybox from device side.
Bug: 299987160
Bug: 301669353
Change-Id: I6acf93c78f76a13f2c4539aabfd0262670b54c48
Merge of
https://widevine-internal-review.git.corp.google.com/c/cdm/+/193670
Default to OEMCrypto_CipherMode_CBC instead of OEMCrypto_CipherMode_CENC
which is not used by CAS.
Test: CAS unit tests
Bug: 325639114
Bug: 322928572
Change-Id: I8876d5262643015fb6a322eae6444ef4001d146d
[ Merge of TBD ]
The merge of oemcrypto-v18 cdm branch to udc-widevine-dev
caused a number of CDM/plugin fixes to be lost.
This undoes the non-oemcrypto changes in http://go/ag/26105061
Bug: 290252845
Test: WVTS, unittests on panther
Change-Id: I2bb99f423bda351eee30276cb0e26e3d9e27fa7d
Get the udc-widevine-dev Android branch and oemcrypto-v18 cdm branch in
sync. The commit ID for 18.4 on oemcrypto-v18 is
a2f23a2281e5e06dc2867585bdc516fa132b6396.
Merged from go/wvgerrit/190151
Bug: 290252845
Test: WVTS tests are running and passing
Change-Id: I457332e7ca70a5b5169345e1279b3eb9f18413b6
[ Merge of http://go/wvgerrit/148949 ]
For ATSC licenses use ATSC certificates/private keys rather than
any cert/private key specified in the license.
Bug: 216420542
Test: WV unit/integration tests
Change-Id: I12541577e672c67cc4c6eb3365e48bf2034fd9a4
[ Merge of http://go/wvgerrit/187610 ]
[ Partial cherry-pick of http://ag/25096962 ]
The removeOfflineLicense() API in the Media DRM plug would attempt
to remove the specified license from L1, then retry L3 if L1 failed
for any reason. This causes error emitted by L1 to be masked by
errors emitted from L3. In particular, if an internal error occurs
on L1 when removing the license, because the plugin would then
try L3 which does not contain the license, the app will receive either
a "does not exist" or "needs provisioning" error from L3.
This CL changes the plugin to first determines which security level
the license exists for. Then only attempts removal on that security
level.
Bug: 301910628
Bug: 291181955
Bug: 296300842
Bug: 302612540
Test: MediaDrmParameterizedTests GTS on oriole
Change-Id: I5fbb6805e598650f9b384a3b0e8d67f1c2a0f78d
[ Merge of http://go/wvgerrit/187610 ]
[ Partial cherry-pick of http://ag/25096961 ]
Certain GTS tests do not fully consider restrictions on ATSC devices.
In particular, GTS assumes if there are any key set IDs returned to
the app via the MediaDrm API, then the device must already be
provisioned. ATSC license are special in that they may be available,
but the CDM is not provisioned while outside of ATCS mode.
To work around this assumption made by GTS, we filter out ATSC licenses
returned by getOfflineLicenseKeySetIds() when the device is not in
ATSC mode, and filter out non-ATSC license when it is in ATSC mode.
This is only a soft enforcement mechanism as calling the API with a
valid ATSC license while outside ATSC mode (or a non-TSC license in
ATSC mode) will continue to result in the failures experienced by
certain OEMs.
Bug: 301910628
Bug: 291181955
Bug: 296300842
Bug: 302612540
Test: MediaDrmParameterizedTests GTS on oriole
Change-Id: Idb1853a7b7c93c7f22bc4db530ec26f20402dbb7
[ Merged of go/wvgerrit/186370 ]
CDM by default allows test keybox from device side.
Bug: 299987160
Bug: 301669353
Change-Id: I06f1936ccd068eb71364a5a8931970954233b686
[ Merge of http://go/wvgerrit/183472 and http://go/ag/24537206 ]
For provisioning 4.0 devices, the DRM certificate serial number
was changing on a reprovisioning attempt or factory reset. The
app parameters sent up in the client identification name-value
pair field were being filtered out in provisioning requests.
This has been corrected for provisioning 4.0 stage 2
(DRM certificate request). There is no need to include them for
stage 1 (OEM certificate request).
The test case WvCdmRequestLicenseTest.ProvisioningSpoidTest
was created earlier to ensure that SPOIDs and DRM certificates are
stable. Unfortunately due to another bug b/250099615, the RKP service
was holding a connection to the Widevine TA for provisioning 4.0
devices. When native tests ran as their own process, L1 would fail
to load due to a connection failure and the test would run as L3.
The tests passed for provisioning 4.0 devices Pixel 7 and 8 when
they should have failed. This gave us a false sense of confidence
that the SPOIDs were stable.
For now a workaround is to run a shell command to kill the widevine
TA before running native tests.
$ adb shell pkill -f -9 widevine
New tests have been introduced to provide integration coverage
WVPluginTest at the WV plugin level and CoreIntegrationTest
for core. GTS tests are also being written in b/295538002.
Bug: 294451432
Bug: 293950895
Test: WVPluginTest.ProvisioningStableSpoidTestL1, WVTS tests
Change-Id: Ib9ace4387866ea38bb1840feb69cea78d2d2c09c
[ Merge of http://go/wvgerrit/183472 ]
For provisioning 4.0 devices, the DRM certificate serial number
was changing on a reprovisioning attempt or factory reset. The
app parameters sent up in the client identification name-value
pair field were being filtered out in provisioning requests.
This has been corrected for provisioning 4.0 stage 2
(DRM certificate request). There is no need to include them for
stage 1 (OEM certificate request).
The test case WvCdmRequestLicenseTest.ProvisioningSpoidTest
was created earlier to ensure that SPOIDs and DRM certificates are
stable. Unfortunately due to another bug b/250099615, the RKP service
was holding a connection to the Widevine TA for provisioning 4.0
devices. When native tests ran as their own process, L1 would fail
to load due to a connection failure and the test would run as L3.
The tests passed for provisioning 4.0 devices Pixel 7 and 8 when
they should have failed. This gave us a false sense of confidence
that the SPOIDs were stable.
For now a workaround is to run a shell command to kill the widevine
TA before running native tests.
$ adb shell pkill -f -9 widevine
New tests have been introduced to provide integration coverage
WVPluginTest at the WV plugin level and CoreIntegrationTest
for core. GTS tests are also being written in b/295538002.
Bug: 294451432
Bug: 293950895
Test: WVPluginTest.ProvisioningStableSpoidTestL1, WVTS tests
Change-Id: Ib9ace4387866ea38bb1840feb69cea78d2d2c09c
