[ Merge of http://go/wvgerrit/89888 ]
A macro validates parameters in CryptoSession and return a
specified error code. Some error codes have been retired and replaced with
the error code PARAMETER_NULL.
Bug: 136123217
Test: Android unit/integration tests
Change-Id: I6ecbad53e87cce04dfd9ea27861400e83044cf5e
[ Merge of http://go/wvgerrit/87283 ]
SPOIDs (Stable Per-Origin IDentifiers) were not correctly being
set during CdmEngine construction. This resulted in SPOID values not
being sent in provisioning requests. This caused the serial number in
the drm certificate to not be stable after a reprovision.
This behaviour appears to be true going back to O.
CdmEngine no longer takes a SPOID in the constructor since not all
callers use SPOIDs. A setter has been added in its place. Previously
spoid had a default argument to the constructor.
Bug: 142368328
Test: android unit/integration tests
Change-Id: I711346df609636ecf1475dc37873454a7ef000c0
[ Merge of http://go/wvgerrit/87964 ]
A preliminary test has been added, more to follow.
Bug: 142747616
Test: android unit tests
Change-Id: Ida8eb853c14f73f60f7bc354f14a02224c2ce66c
[ Merge of http://go/wvgerrit/87905 ]
Protobuf parsing of the provisioning message has been centralized in
certificate_provisioning.cpp since it will be invoked from
multiple locations. This will also ease maintainability of the code.
Bug: 142731300
Test: android unit/integration tests
Change-Id: Idebf6b0145b317698559cac1cf18a3a0b98315ad
(This is a merge of http://go/wvgerrit/84510)
When the CE CDM 3.5 behavior around service certificates was originally
implemented, it allowed sessions to be created if a service certificate
had not yet been installed, in keeping with the EME spec. However, the
service certificate in use at session creation time was cached, and so
there was a bug where any sessions open before a service certificate was
installed would never be updated with any future service certificates.
The code also caused problems for Android. When it was merged to master,
it was fixed to simply not allow session creation on CE CDM without a
service certificate. However, this created an impedance mismatch between
the CE CDM and EME that has caused pain for Shaka Player Embedded,
Chrome, Chromecast, Fuchsia, and likely every partner that is trying to
implement a fully-compliant EME stack on top of CE CDM.
Removing the code that blocks session creation without a service
certificate is easy. Fixing the bug that motivated it is not. Removing
the caching is not possible because Android needs it for certain
behavior on its end. So instead, the CE CDM will have to iterate over
all open sessions and update their service certificates if the installed
service certificate changes.
Test: CE CDM Unit Tests
Test: Android Unit Tests
Bug: 111766009
Change-Id: I1bd70553e2209b823a6acdc221c0497a5f3181b2
[ Merge of http://go/wvgerrit/84990 ]
Storing and retrieving licenses from device files had required 15
parameters to the DeviceFiles methods. Now, licenses information is
bundled together in a single struct `CdmLicenseData`, similar to
`CdmUsageData`.
Bug: 137882164
Test: Linux and Android unittest
Change-Id: I149b39573800e7c66681343b252b41341a8902f7
[ Merge of http://go/wvgerrit/84607 ]
[ Merge of http://go/wvgerrit/84608 ]
The primary goal is to replace the use of `rand()` with the random
number generators provided with the C++11 standard.
This simplified generator wraps some of the technical aspects of the
<random> library and provides an interface for uniformly distributed
integers.
As part of the `rand()` purge in the CDM, all uses of the C random int
function in `core()` have been removed. Places that previously used
`rand()` now use `CdmRandom` facilities.
Test: Linux unittest and Android unittest
Bug: 130680365
Change-Id: Ica383870536ed462dbb80e630c2d66845e38b937
[ Merge of http://go/wvgerrit/84647 ]
[ Merge of http://go/wvgerrit/84648 ]
Replacing most instances of C's NULL with C++'s nullptr. Also changed
how a NULL check is performed on smart pointers. They provided an
implicit boolean operator for null checks, meaning the underlying
pointer does not need to be compared directly (as it was in some places
before).
Note that clang-format has performed additional changes to some of the
test files that have not yet been formatted.
Bug: 120602075
Test: Linux and Android unittests
Change-Id: I06ddebe34b0ea6dfecedb5527e7e808e32f5269a
[ Merge of http://go/wvgerrit/83804 ]
There is a private helper method in `UsageTableHeader` which is used by
other methods to shrink the table by removing a specified number of
entries.
Prior to this change, if `Shrink` was called to remove more entries
than there are, it would: 1) do nothing and 2) return `NO_ERROR`.
Obviously, at least one of those action should change.
Instead of doing nothing, it will simply remove all the entries from
the table and return `NO_ERROR`. A warning will be logged that it was
requested to shrink by more entries than there are.
Four (4) new tests have been created to ensure that `Shrink()` works as
expected.
Test: Linux unit tests
Bug: 138242127
Change-Id: Idedd922bd883d7ae1b84ce8ec1255fdce00c0948
[ Merge of http://go/wvgerrit/81743 and http://go/ag/7747989 ]
This fixes some failures in tests. A platform property has been added
which controls whether an offline license can be restored if a release
request has been previously made. This behaviour was introduced by
CE CDM in b/113167010 but is not permitted for android.
The tests failures addressed are
* ProvisioningTestWithServiceCertificate
* ReleaseRetryOfflineKeyTest
* ReleaseRetryL3OfflineKeyTest
* ReleaseRetryL3OfflineKeySessionUsageDisable
Bug: 119428680
Bug: 133684744
Test: WV unit/integration tests
Change-Id: I5beacecea32f26c8a319a6d73a45cc36f04d8aa1
(This is a merge of http://go/wvgerrit/81628. Although it is primarily
to support a CE CDM feature, this patch touched shared code and so must
be merged.)
The problem that has long stopped the OEMCrypto Testbed from working
with the CE CDM build is that the OEMCrypto Testbed sometimes accesses
the storage via the normal filesystem APIs rather than the FileSystem
abstraction. Furthermore, when doing this, it assumes that FileSystem
abstraction is just a wrapper around direct filesystem access and thus
it should use the same paths in both kinds of filesystem access.
However, this is not true on the CE CDM where FileSystem wraps an opaque
key/value store.
This patch adds a property that allows a platform to indicate if its
FileSystem base path represents a real file system path and sets it
appropriately. ("true" for all platforms except CE CDM) It also adds
code to the OEMCrypto Testbed that makes use of this property to modify
its behavior. When running on a device where the FileSystem base path is
not a real file system path, it will instead use the directory of the
current executable as its base path when accessing the filesystem
directly.
Bug: 129311942
Test: CE CDM Build with Fake L1
Test: Android Build
Change-Id: Iadb3cc57d3bbc8ce0d49224b7df31c46bd5ea56c
[ Merge of http://go/wvgerrit/80805 ]
This change was used only where `typedef` was used for type aliasing,
and not for defining a new type (such as enums, structs, or function
pointer types).
Clang-format was used on the changed files.
Test: WV unit tests
Bug: 134437705
Change-Id: I730b9709a5ac773b3036daa79024caab665b3daa
Bug: b/133855570
Tests: Android tests/CE CDM tests/Linux tests
Merge of http://go/wvgerrit/80163
Adds a query option to QueryStatus to get the provisioning model of the
OEMCrypto.
Change-Id: I1896984be6294a5ada9a97b63e6d9080297e92b0
[ Merge of http://go/wvgerrit/80483 ]
Clang-format has been run on files in core/include
Bug: 134365840
Test: WV unit/integration tests
Change-Id: I890127f23f30f0e63f826d3638521b4cc12fb995
[ Merge of http://go/wvgerrit/80084 ]
Corrected the key type being returned after entitled keys from
init data are loaded. Made test changes to validate.
Bug: 133903028
Test: WV unit/integration tests
Change-Id: Icb44587f5c3aba3b0facae6d83dc9344d6b60833
[ Merge of http://go/wvgerrit/77506 ]
Callers of MediaDrm can register to be notified when key status
changes and if they are usable for decryption. A number of factors
are evaluated when making this determination. Key container security
level will now be included in the evaluation.
Bug: 78652608
Test: WV unit/integration test, GtsMediaDrmTest, Play movies playback
testing.
Change-Id: I20243e5cb160f7957e3239e8d05f715ff0ee6dd6
Merge from Widevine repo of http://go/wvgerrit/78623
This updates the license request client identification to include
OEMCrypto build information.
Bug: 129070445
Test: ExoPlayer on crosshatch with mod mock
Change-Id: I0dbce0cca4e9810e14f60561e4e434f1dbcadfb6
[ Merge of http://go/wvgerrit/77049 ]
Entitlement PSSHs can now be provided in follow on key generation
requests to cause keys to be rotated without needing a license
exchange.
Bug: 128462397
Test: WV unit/integration tests, Netflix and GPlay tests,
GtsMediaDrmTests
Change-Id: I6ed0901a35c498240f42e405a522d82ea8dce2f7
(This is a merge of http://go/wvgerrit/76043)
This renames the tests to be *GenericCrypto* to match the OEMCrypto
tests and ensures these tests are skipped when the device doesn't
support generic crypto.
Test: Android Unit Tests
Bug: 126392281
Change-Id: Ib16ca8c57ed5d99dde802d4d9a63eced0fa807a5
[ Merge of http://go/wvgerrit/74627 ]
Limited duration licenses (where license duration is unlimited and
playback window is set to a small value) did not work correctly when
the initial decrypt call occured before the license was received.
Bug: 109653883
Test: WV unit/integration tests
Change-Id: I0738e97db525b239455e2ac93ab0bedd6611b311
(This is a merge of http://go/wvgerrit/74844)
__attribute__ is not supported on all compilers, notably it's not
supported on MSVC. Commenting out the variable should suppress the
warning this is trying to fix.
Test: Android CDM Build
Bug: 122953649
Change-Id: I0101df1cca271415a6444e5455eb0085676bcabf
(This is a merge of http://go/wvgerrit/73803)
While playing around with compiler settings, I found that
EntitlementKeySession::Type() is missing the `override` keyword.
Bug: 127498046
Test: CE CDM Build
Test: Android Build
Change-Id: I5a18dbbd425b0a493575a34b9f5f77b2d7c8f10d
(This is a merge of http://go/wvgerrit/71883)
This moves all the SSL code to privacy_crypto so we can use the
iOS-specific versions and not use any BoringSSL. The iOS version
doesn't support OEM certificates.
Note that the tests still use BoringSSL.
Bug: 126559819
Test: build_and_run_all_unit_tests.sh
Change-Id: Ib0fad5d95b283b6cd6e02d8a08bcf248c5900bc4
(This is a merge of http://go/wvgerrit/72867)
This patch replaces the previous static std::mutexes in CryptoSession
with shared_mutexes, allowing multiple readers to access the resources
they protect. For the shared fields, this means only Initialize(),
Terminate(), and the code that sets up the usage table headers needs
exclusive access. All other CryptoSession code is able to read these
fields in parallel.
For OEMCrypto, the static OEMCrypto lock is joined by a per-session
std::mutex, which are used in concert to enforce the OEMCrypto v15
threading guarantees.
On my machine this results in a noticeable increase in performance for
the parallel unit tests.
Bug: 70889998
Bug: 118584039
Test: CE CDM Unit Tests
Test: Android Unit Tests
Test: Jenkins Tests
Change-Id: Ie6332ae4926ed4f14af897685d37bfe63831b14f
Test: CE CDM tests, Android unit/integration tests
Bug: b/124773017
Merge of http://go/wvgerrit/73144
Since OEMCrypto supports one content key per entitlement key,
LoadEntitledContentKeys must be called every time we want to select a
key. EntitlementKeySession::SelectKey calls ContentKeySession::SelectKey
after loading the keys, which caches the key id from the previous call,
and if the key id hasn't changed, doesn't call SelectKey. This caching
is fine for content keys since we don't call LoadKeys every time, but
not fine for entitled keys since we do call LoadEntitledContentKeys
every time. So, we instead cache the current content key id per
entitlement key and only call LoadEntitledContentKeys and SelectKey if
the entitled content key id changes. Furthermore, the test
HandlesKeyRotationWithOnlyOneLicenseRequest is modified to complete
multiple decrypts per key to test this behavior.
Change-Id: I9d0d94e49da0fe1965beadbddec99d8dff744d73
[ Merge from http://go/wvgerrit/72724 ]
This adds a message that contains SDK and service version information
useful for debugging problems that occur because of different services.
BUG: 80536436
Test: Unit tests and manual GPlay testing.
Change-Id: I095f893b907ea7c2cd149155fb2cd4c7181e7bb2
(This is a merge of http://go/wvgerrit/72764)
Netflix has identified a calling pattern that causes this mutex to be
taken recursively. This is not guaranteed to be safe for Widevine's
old custom Lock implementation nor std::mutex. However, it is guaranteed
to be safe for std::recursive_mutex. This patch updates the mutex in use
accordingly.
In the long-term, this lock needs to be reconsidered, as already noted
by comments in the code. It would be great if the reconsidered locking
did not require a recursive-safe lock. The TODO for this has been spun
off into its own bug and the comment has been updated to point to this.
Bug: 120471929
Test: CE CDM Unit Tests
Test: Android Unit Tests
Change-Id: I34df64456de4b469b75caf25a33f0bc53a5da330
[ Merge of http://go/wvgerrit/72703 ]
SRM is an optional feature and whether it is implemented is upto the
discretion of OEMs. If it is not, avoid logging this information.
Bug: 124391178
Test: WV unit/integration tests
Change-Id: If8d2b1e0b59fb11825f832a5d4259b03c482fd6b
(This is a merge of http://go/wvgerrit/71325)
Widevine CE CDM and the buildbot now have parallel operations unit
tests. These tests are not relevant on Android since it is not possible
to call into the Android CDM from multiple threads. However, there is
one change in CdmEngine that needs to be copied over to Android for
consistency's sake.
Bug: 70889998
Bug: 118584039
Test: Android Build
Change-Id: Iea5df62be256383e832b4fcfbd5ff5090e3f3b03
(This is a merge of http://go/wvgerrit/71324)
This patch increases the granularity of the locking in CryptoSession
without substantially changing its locking semantics. Where before
there was a single |crypto_lock_| performing multiple duties, now
there are three locks:
1) |static_field_lock_|, which is used when needing to access the
non-atomic static member fields of CryptoSession.
2) |oem_crypto_lock_|, which is used when needing to call into
OEMCrypto.
3) |factory_lock_|, used only by the functions that interact with the
CryptoSession factory.
All the code in CryptoSession has been updated to use these locks. It
has also been updated to only hold them for the minimal amount of time
necessary, as opposed to holding them for a whole function. This should
help some with the ability of CryptoSession calls to happen
concurrently. To assist in taking locks in a consistent manner, two
helper functions, |WithStaticFieldLock()| and |WithOecLock()| have been
added. Also, for the very common case of reading |initialized_|, the
accessor |IsInitialized()| will read the value safely.
While changing all the code to lock differently, I found that some
places in CryptoSession were *not* locking before accessing static state
or calling into OEMCrypto. I have made these callsites consistent with
the rest of CryptoSession.
As a result of taking locks for only the minimum time necessary, it is
no longer necessary for functions to make assumptions about whether the
lock will already be held before they are called. Locks should not be
held while calling helper functions, and code should always take a lock
for the brief time it is necessary to do so.
In tests, including the concurrent unit tests coming in the following
patch, this code did not perform substantially better or worse than the
code that preceded it, but the hope is that it will experience less
contention on devices that are more resource-constrained than my
desktop, such as older game consoles.
This patch appears to address some real threading issues. Hopefully, it
will also make it easier to maintain soundness in the future and to
reason about when code in CryptoSession needs to take a lock.
This is the first step to implementing the "Finer-Grained Locking in
CryptoSession" specification. A future patch will make some of these
locks reader-writer locks, to allow even greater parallelism.
Bug: 70889998
Bug: 118584039
Bug: 123319961
Test: CE CDM Unit Tests
Test: Android Unit Tests
Test: GTS
Test: Play Movies
Test: Netflix
Change-Id: I346c04a5d9875723db54af33ee91772bf49ca12f
[ Merge from http://go/wvgerrit/71923 ]
Plumb through the device files error detail and add the detail to
metrics.
Bug: http://b/115382201
Test: Unit tests, manual GPlay.
Change-Id: I18139f6712b6670be5fed863a97f9f03440745c7
