The interface is defined in
hardware/interfaces/drm/aidl(http://go/ag/15329852).
Test: build
m android.hardware.drm-service.widevine -j128
Test: build_and_run_all_unit_tests.sh
for hidl tests
Test: atest VtsAidlHalDrmTargetTest
Bug: 200055138
Bug: 170964303
Change-Id: If2f2a129914436ba5cef1c46f6cb9415e12c3d1c
(This is a merge of http://go/wvgerrit/139989.)
Googletest added a new, more powerful MOCK_METHOD() macro in 1.10. This
patch updates all our usage of the old MOCK_METHOD family to the new
macro. Full details can be found at
https://github.com/google/googletest/blob/release-1.10.0/googlemock/docs/cook_book.md#creating-mock-classes
but in brief, the new MOCK_METHOD() replaces the entire old MOCK_METHOD
family and has the following advantages:
1) No need to count parameters or update the macro name when changing
parameters.
2) No need for a different macro for const methods.
3) The ability to specify override, noexcept, and other function
qualifiers.
4) The macro order is now the same as C++ method definition order:
Return Type -> Name -> Arguments -> Qualifiers
In addition to upgrading all our usage sites to the new macro, the
addition of the override qualifier to our MOCK_METHODs helped uncover
several cases where we were using MOCK_METHOD to override methods that
didn't exist. This is a great example of why the override qualifier is
so useful. These places have been updated, by removing the invalid and
unused mock method.
Bug: 207693687
Test: build_and_run_all_unit_tests
Change-Id: Iaad4a22c7f72bb48b1356fe01a41eb0a2f555244
[ Merge of http://go/wvgerrit/138089 ]
Non-hidl code is no longer needed in the widevine android plugin. By
doing work this cleanup will save the team from having to keep
maintaining code that isn't needed anymore.
Clean up steps taken as follows:
1. Remove non-hidl code but keep commonly used code
2. Remove legacy test code
3. Remove legacy test build and test entry
Bug: 69573078
Bug: 172285246
Test: unit tests, GtsMediaTestCases, CtsMediaDrmTestCases
Change-Id: I75938d69413c631ef6be82da3d885ba173efc581
The shared memory buffer used by srcPtr can be freed by another
thread because it is not protected by a mutex. Subsequently,
a use after free AIGABRT can occur in a race condition.
SafetyNet logging is not added to avoid log spamming. The
mutex lock is called to setup for decryption, which is
called frequently.
The crash was reproduced on the device before the fix.
Verified the test passes after the fix.
Test: sts
sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176495665#testPocBug_176495665
Test: push to device with target_hwasan-userdebug build
adb shell /data/local/tmp/Bug-176495665_sts64
Bug: 176495665
Bug: 176444161
Change-Id: If62b73a9c636048f942a2fc63a13b5bfd1e57b86
This commit is a combination of the following:
* http://go/wvgerrit/117003
* http://go/wvgerrit/118303
Bug: 162255728
Test: MediaDrmTest#testGetLogMessages
Change-Id: I5699b64d5c4bab463e5b587595fa7d324dc1d93f
There is a potential integer overflow to bypass the
destination base size check in decrypt. The destPtr
can then point to the outside of the destination buffer.
Test: sts-tradefed
sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176444622#testPocBug_176444622
Test: push to device with target_hwasan-userdebug build
adb shell /data/local/tmp/Bug-17644462264
Bug: 176444622
Bug: 176496353
Change-Id: Id3aece61d46d548c304782d4e1dc3a4747795c01
Merged from http://go/wvgerrit/114903
There is a potential integer overflow to bypass the
source base size check in decrypt. The source pointer
can then point to the outside of the source buffer,
which could potentially leak arbitrary memory content
to destination pointer.
Test: sts-tradefed
sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176496160#testPocBug_176496160
Test: push to device with target_hwasan-userdebug build
adb shell /data/local/tmp/Bug-17649616064
Bug: 176496160
Bug: 176444786
Change-Id: I208e0d5d949e8ef003fcf7d6f129eab66b9b3656
Merging CL:
* http://go/wvgerrit/108203
* http://go/wvgerrit/103904 (changes to L3 source files excluded)
Also added ODK dependency which is required by L3 v16.
Do not replace constant sizeof() with a hard-coded value in L3 library because it is target-specific.
Test: Unit tests on gLinux
jenkins/linux_unit_tests
jenkins/ce_cdm_tests
Test: Unit tests on Pixel 4(flame-userdebug, rvc-qpr-dev)
vendor/widevine/libwvdrmengine/build_and_run_all_unit_tests.sh
Test: Manual ExoPlayer L1/L3 playback tests (flame-userdebug)
WV: Secure HD/SD (cenc,MP4,H264)
WV: Secure HD/SD (cbc1,MP4,H264)
WV: Secure HD/SD (cbcs,MP4,H264)
Test: Widevine GTS tests(bramble-userdebug, master)
http://ab/I23800006571451275
Bug: 136317881
Bug: 139814713
Bug: 173331251
Change-Id: I1656e83a74a0eaf650f55f5e2388819bf5020c0d
[ Merge of http://go/wvgerrit/108084 ]
The Widevine License Agreement has been renamed to use inclusive
language. This covers files in the android directory.
Bug: 168562298
Test: verified compilation (comment only change)
Change-Id: I0f9e6445e0168ebe85425baeb81371e182e5a39c
This CL builds the Widevine drm services and libraries.
Soong makefile conversion for unit and integration
tests will be in a different CL.
This doc may help with the review:
https://docs.google.com/document/d/1lK3X9RFPwbbwewLNlS4TfSMhxIlPuAkHRnGcgwWpChU/edit?usp=sharing
Test: build
Test: Play Movies and Netflix streaming
Test: unit tests
build_and_run_all_tests.sh
Test: gts
ANDROID_BUILD_TOP= ./android-gts/tools/gts-tradefed run gts -m GtsMediaTestCases -t com.google.android.media.gts.MediaDrmTest
atest GtsExoPlayerTestCases:com.google.android.exoplayer.gts.DashTest
Test: vts
ANDROID_BUILD_TOP= PATH="$PWD/android-vts/tools:$PATH" vts-tradefed run commandAndExit vts --module VtsHalDrmV1_3Target
Bug: 162321744
Change-Id: I50c0fb2e8f28dfe7901587e3d3203542943e23b1
(This is a merge of http://go/wvgerrit/94928.)
In OEMCrypto v16, we dropped support for 'cens' and 'cbc1'. However, we
did not redefine the pattern (0,0) to be a valid pattern for 'cbcs', even
though it was no longer being used to signal 'cbc1'. Instead, we made
the CDM reject CTR with a pattern ('cens') and CBC with a (0,0) pattern
('cbc1') to mirror the behavior of OEMCrypto v16.
However, some apps have been using 'cbc1' mode to decrypt audio in
'cbcs' content. This is normally not possible but is possible for a
subset of content. Furthermore, it is easy to do by accident because of
the way most packagers package 'cbcs' audio and the special significance
Widevine has historically given the (0,0) pattern.
This patch updates the CDM to not reject CBC with a (0,0) pattern but
instead treat it as 'cbcs' content. To decrypt it correctly, the pattern
is treated specially inside the CDM core and converted to the
recommended equivalent pattern — (10,0) — before passing the content to
OEMCrypto.
For more specifics, please see the design doc: http://go/vclfg
Bug: 150219982
Test: ExoPlayer Demo App 'cbcs' Content
Test: GTS 'cbcs' Content
Change-Id: I334ff15db5f7b7d62040a036ba6d17515c3caee4
(This is a merge of http://go/wvgerrit/93829,
http://go/wvgerrit/93830, http://go/wvgerrit/93832,
http://go/wvgerrit/93833, and http://go/wvgerrit/93834 from the
Widevine repo.)
This implements the CDM code changes necessary to take advantage of
Combined Decrypt Calls on OEMCrypto v16. The result of this is that
WVCryptoPlugin is much lighter now because it can pass the full sample
down to the core in one call, but CryptoSession is heavier, as it now
has to handle more complex fallback logic when devices can't handle
multiple subsamples at once.
This patch also removes support for the 'cens' and 'cbc1' schema, which
are being dropped in OEMCrypto v16. This fixes an overflow in the code
for handling those schemas by removing it entirely.
This patch also fixes the "in chunks" legacy decrypt path to use larger
chunk sizes on devices with higher resource rating tiers.
Bug: 135285640
Bug: 123435824
Bug: 138584971
Bug: 139257871
Bug: 78289910
Bug: 149361893
Test: no new CE CDM Unit Test failures
Test: Google Play plays
Test: Netflix plays
Test: no new GTS failures
Change-Id: Ic4952c9fa3bc7fd5ed08698e88254380a7a18514
(This is a merge of http://go/wvgerrit/92191)
This reverts commit 8fe569cc1265021e275a9bccbc362ebd2ba3be5f.
The ISO-CENC spec is ambiguous about how to handle the early truncation
of the pattern in the 'cens' and 'cbcs' schema. We originally
interpreted it to mean "follow the pattern until you run out of full
crypto blocks" and shipped the Android and OEMCrypto code accordingly.
Later, however, other engineers at Google asserted that it should mean
"follow the pattern until you run out of enough crypto blocks to follow
the encrypted part of the pattern", which is subtly different when the
number of encrypted blocks in the pattern is greater than 1. We made
changes to start accommodating this. However, after further discussion,
everyone is in agreement that the original behavior was correct. So I am
reverting the "fixes" that had already been made.
This has no practical effect, since it only affects 'cens' content with
a pattern that has more than one encrypted block, and as far as we know,
no one has ever generated content like that. Shaka Packager is not
capable of generating content like that.
Bug: 111001481
Test: No new Android Unit Tests failures
Change-Id: I8f0292b1222d6af9a0ae33d6cb91707fd40101f4
Since these were combined into libhidlbase.
Bug: 135686713
Test: build only (libhwbinder/libhidltransport are empty)
Change-Id: Ie7052b17c1d468f63250755f3ffa5099760c9602
Switch Widevine service to link dynamic libcrypto.so.
Merge from http://go/wvgerrit/86323
Test: Play Movies & TV, Netflix, ExoPlayer, GTS
bug: 141082724
Change-Id: I16a7de4dab69bf3b4b550bb2ee202f4600682837
This change renames the IMemory raw pointer accessors to
unsecure*() to make it apparent to coders and code reviewers
that the returned buffer may potentially be shared with
untrusted processes, who may, after the fact, attempt to
read and/or modify the contents. This may lead to hard to
find security bugs and hopefully the rename makes it harder
to forget.
The change also attempts to fix all the callsites to make
everything build correctly, but in the processes, wherever the
callsite code was not obviously secure, I added a TODO requesting
the owners to either document why it's secure or to change the
code. Apologies in advance to the owners if there are some false
positives here - I don't have enough context to reason about all
the different callsites.
Test: Completely syntactic change. Made sure code still builds.
Change-Id: I13466e045f587e612ad80e518fee27f4da0bde5e
[ Merge of http://go/wvgerrit/73044 ]
The tests currently get copied to /data/bin. Changes in location
of system libraries causes test failures when tests are unable to
find dependent dynamic libraries.
Bug: 123879070
Test: WV unit/integration tests
Change-Id: I86edbe33b4753238fcf8b84243ac6e6c058ea145
(This is a merge of modmaker@'s change from the Widevine repo,
http://go/wvgerrit/48880)
When using pattern encryption, WVCryptoPlugin needs to increment the
IV after each subsample. It should increment it based on the number
of actually encrypted samples (i.e. ignore clear data caused by
subsamples or pattern encryption).
In the common encryption spec, section 9.6.1 states:
If the last Block pattern in a Subsample is incomplete, the partial
pattern SHALL be followed until truncated by the BytesOfProtectedData
size and any partial crypt_byte_block SHALL remain unencrypted.
This fixes the counting of encrypted blocks to account for partial
patterns. This also makes it more efficient by removing the loop.
Bug: 111001481
Test: build_and_run_all_unit_tests
Test: Widevine GTS Tests
Change-Id: Ibd2bf10f64461b9bce10ef07453096fe4a4f6376
[ Merge of http://go/wvgerrit/70203 ]
The earlier property_get() method had a limitation on property length.
Properties of some new devices exceed that length. An error message
is returned rather than a truncated string. Replace its use with
android::base::GetProperty() which does not have a length limitation.
Bug: 115358798
Test: WV unit/integration tests
Change-Id: I46ce9a7e77bcd031225d0082f83c57d484fe5405
Merge of http://go/wvgerrit/70163
New codes are being added to handle resource
contention, lost session state, frame size too
large and insufficient security level for
decryption. Also cleans up inconsistent use of
tamper detected error where invalid state error
should have been used.
bug:111504510
bug:111505796
test: cts and gts media tests, widevine integration tests
Change-Id: I96ee441717d32ccbcabaa85c8f6a0013055ce16e
It is not an error for mapMemory to return nullptr,
remove the log message.
merged from http://go/wvgerrit/68605
bug:120148333
Change-Id: If58a4335ec3b8bd8d84993bb3959e5ccafb708e1
Widevine HIDL service added new v1.2 media APIs,
update the service to support new APIs.
Merged from http://go/wvgerrit/67083
Test: Netflix and Play Movies & TV (streaming and offline playback)
Test: GTS WidevineH264PlaybackTests test
e.g. ANDROID_BUILD_TOP= ./android-gts/toolsefed run gts -m GtsMediaTestCases
--test com.google.android.media.gts.WidevineH264PlaybackTests#testL1With480P30
Test: Widevine unit tests
bug: 117570686
Change-Id: I3a2091e7c62a0d2697ef97f983fd898aedfb4519
Merge from Widevine repo of http://go/wvgerrit/46204
Refactor utility code - split the mock, step 1
Merge from Widevine repo of http://go/wvgerrit/46205
Move some OEMCrypto types to common header - split the mock, step 2
Merge from Widevine repo of http://go/wvgerrit/46206
Split mock into two -- step 3
Merge from Widevine repo of http://go/wvgerrit/47460
Split the mock into two -- step 3.5
The CL moves several files used by oemcrypto and cdm into a common
subdirectory, so that it may more easily be shared with partners.
The CORE_DISALLOW_COPY_AND_ASSIGN macro was moved to its own header in
the util/include directory.
This CL removes some references to the mock from other code, and puts
some constants and types, such as the definition of the keybox, into a
header in oemcrypto.
Test: tested as part of http://go/ag/4674759
bug: 76393338
Change-Id: I75b4bde7062ed8ee572c97ebc2f4da018f4be0c9
Merge from Widevine repo of http://go/wvgerrit/47860
This CL updates the copyright notice to indicate that files
shared with partners are shared under the Widevine Master
License Agreement.
bug: 77926774
test: comment change only
Change-Id: I0423668111578b80fb39a932d763df2827e2dfc3
Merged from http://go/wvgerrit/44803.
Upgrade HIDL service to v1.1 and implements new 1.1 media API.
Test: Netflix and Play Movies & TV
streaming and offline playback
Test: GTS WidevineH264PlaybackTests test
e.g. ANDROID_BUILD_TOP= ./android-gts/tools/gts-tradefed run gts -m GtsMediaTestCases
--test com.google.android.media.gts.WidevineH264PlaybackTests#testL1With480P30
Test: GTS MediaDrmTest tests
e.g. ANDROID_BUILD_TOP= ./android-gts/tools/gts-tradefed run gts -m GtsMediaTestCases
--test com.google.android.media.gts.MediaDrmTest#testWidevineApi28
Test: unit tests
bug: 69674645
Change-Id: I91e7e43f9178b61a531e846beffb5f5c17050a3c
Merge from Widevine repo of http://go/wvgerrit/43420
Remove or mark unused variables. Fix unsigned/signed comparisons.
bug: 73390805
test: unit tests
Change-Id: Ic523400a5decf82fae733042b260e0c39a087cd3
[ Merged of http://go/wvgerrit/39766 ]
The security level (software/hardware, decryption/decode)
in the policy that specified how the key was to be used was
not being respected for L3. Playback would either continue or
a vendor specific error would be thrown.
If the device cannot use the key as permitted by the policy
CryptoException#ERROR_INSUFFICIENT_OUTPUT_PROTECTION will be thrown.
Bug: 31913737
Bug: 31913439
Test: WV unit/integration tests
Test: Playback using playmovies and netflix. Cast playback using
playmovies.
Change-Id: If25735ab0f789108431115623cb236687c5ef818
