Create new token types for DRM reprovisioning

Creates new token types for the DRM reprovisioning scheme that will be
used by L3 CDMs with baked-in certificates to allow for use of unique
serial numbers.

- Create new `CdmClientTokenType` for DRM reprovisioning in the CDM
  core.
- Create a new `ProvisioningType` for DRM reprovisioning in the
  provisioning message proto.
- Create new enum value for `DEVICE_EMBEDDED` in DrmCertificate type.
- Update uses of the above to include the new token types.

Bug: b/305093063
Merged from https://widevine-internal-review.googlesource.com/186934

Change-Id: I7e6cc8744b80cbbb624d31e5be1eab1be8a9680f

libwvdrmengine/cdm/core/include/wv_cdm_types.h

@@ -606,6 +606,7 @@ enum CdmClientTokenType : int32_t {
   kClientTokenOemCert,
   kClientTokenUninitialized,
   kClientTokenBootCertChain,
+  kClientTokenDrmReprovisioning,
 };
 
 // kNonSecureUsageSupport - TEE does not provide any support for usage

libwvdrmengine/cdm/core/src/cdm_engine.cpp

@@ -754,6 +754,7 @@ CdmResponseType CdmEngine::QueryStatus(RequestedSecurityLevel security_level,
     }
     switch (token_type) {
       case kClientTokenDrmCert:
+      case kClientTokenDrmReprovisioning:
         *query_response = QUERY_VALUE_DRM_CERTIFICATE;
         break;
       case kClientTokenKeybox:

libwvdrmengine/cdm/core/src/certificate_provisioning.cpp

@@ -169,6 +169,8 @@ CertificateProvisioning::GetProvisioningType() {
       return SignedProvisioningMessage::PROVISIONING_40;
     case kClientTokenOemCert:
       return SignedProvisioningMessage::PROVISIONING_30;
+    case kClientTokenDrmReprovisioning:
+      return SignedProvisioningMessage::DRM_REPROVISIONING;
     default:
       return SignedProvisioningMessage::PROVISIONING_20;
   }

libwvdrmengine/cdm/core/src/client_identification.cpp

@@ -384,6 +384,8 @@ bool ClientIdentification::GetProvisioningTokenType(
           video_widevine::ClientIdentification::BOOT_CERTIFICATE_CHAIN;
       return true;
     case kClientTokenDrmCert:
+    // TODO: b/305093063 - Add token for DRM reprovisioning requests.
+    case kClientTokenDrmReprovisioning:
     default:
       // shouldn't happen
       LOGE("Unexpected provisioning type: %d", static_cast<int>(token));

libwvdrmengine/cdm/core/src/license_protocol.proto

@@ -1026,6 +1026,8 @@ message SignedProvisioningMessage {
     ARCPP_PROVISIONING = 4;  // ChromeOS/Arc++ devices.
     // Android-Attestation-based OTA keyboxes.
     ANDROID_ATTESTATION_KEYBOX_OTA = 6;
+    // Certificate reprovisioning for internal L3 CDMs only.
+    DRM_REPROVISIONING = 7;
     INTEL_SIGMA_101 = 101;  // Intel Sigma 1.0.1 protocol.
     INTEL_SIGMA_210 = 210;  // Intel Sigma 2.1.0 protocol.
   }
@@ -1270,6 +1272,9 @@ message DrmCertificate {
     DEVICE = 2;
     SERVICE = 3;
     PROVISIONER = 4;
+    // Only used by baked-in certificates with internal L3 CDMs that support
+    // Drm Reprovisioning.
+    DEVICE_EMBEDDED = 5;
   }
   enum ServiceType {
     UNKNOWN_SERVICE_TYPE = 0;

libwvdrmengine/cdm/core/src/system_id_extractor.cpp

@@ -59,6 +59,8 @@ bool SystemIdExtractor::ExtractSystemId(uint32_t* system_id) {
   bool success = false;
   switch (type) {
     case kClientTokenDrmCert:
+    // TODO: b/305093063 - Extract system id when handling DRM reprovisioning.
+    case kClientTokenDrmReprovisioning:
       LOGW(
           "Cannot get a system ID from a DRM certificate, "
           "using null system ID: security_level = %s",

libwvdrmengine/cdm/core/src/wv_cdm_types.cpp

@@ -74,6 +74,8 @@ const char* CdmClientTokenTypeToString(CdmClientTokenType type) {
       return "BootCertChain";
     case kClientTokenUninitialized:
       return "Uninitialized";
+    case kClientTokenDrmReprovisioning:
+      return "DrmReprovisioning";
   }
   return UnknownValueRep(type);
 }