Enable usage reporting

[ Merge from Widevine CDM repo of
  https://widevine-internal-review.googlesource.com/#/c/10171/ and
  https://widevine-internal-review.googlesource.com/#/c/10172/ ]

Updated license_protocol.proto from constituent protos in google3

These changes make use of OEMCrypto v9 changes to support usage reporting.
Usage reporting may be enabled for streaming (by means of secure stops) and
offline playback by a provider session token specified in the license.

Changes include periodically updating usage information for relevant
sessions and reporting and releasing usage information as needed.

The CDM has removed all references to Secure Stops. This change
updates the Android API implementation to comply.

b/11987015

Change-Id: Ibb6f2ced4ef20ee349ca1ae6412ce686b2b5d085

libwvdrmengine/cdm/core/src/license_protocol.proto

@@ -27,6 +27,7 @@ message LicenseIdentification {
   optional bytes purchase_id = 3;
   optional LicenseType type = 4;
   optional int32 version = 5;
+  optional bytes provider_session_token = 6;
 }
 
 message License {
@@ -126,6 +127,8 @@ message License {
         HDCP_NONE = 0;
         HDCP_V1 = 1;
         HDCP_V2 = 2;
+        HDCP_V2_1 = 3;
+        HDCP_V2_2 = 4;
       }
       optional HDCP hdcp = 1 [default = HDCP_NONE];
 
@@ -139,6 +142,15 @@ message License {
       optional CGMS cgms_flags = 2 [default = CGMS_NONE];
     }
 
+    message VideoResolutionConstraint {
+      // Minimum and maximum video resolutions in the range (height x width).
+      optional uint32 min_resolution_pixels = 1;
+      optional uint32 max_resolution_pixels = 2;
+      // Optional output protection requirements for this range. If not
+      // specified, the OutputProtection in the KeyContainer applies.
+      optional OutputProtection required_protection = 3;
+    }
+
     message OperatorSessionKeyPermissions {
       // Permissions/key usage flags for operator service keys
       // (type = OPERATOR_SESSION).
@@ -157,12 +169,20 @@ message License {
     optional OutputProtection requested_protection = 7;
     optional KeyControl key_control = 8;
     optional OperatorSessionKeyPermissions operator_session_key_permissions = 9;
+    // Optional video resolution constraints. If the video resolution of the
+    // content being decrypted/decoded falls within one of the specified ranges,
+    // the optional required_protections may be applied. Otherwise an error will
+    // be reported.
+    repeated VideoResolutionConstraint video_resolution_constraints = 10;
   }
 
   optional LicenseIdentification id = 1;
   optional Policy policy = 2;
   repeated KeyContainer key = 3;
   optional int64 license_start_time = 4;
+  optional bool remote_attestation_verified = 5 [default = false];
+  // Client token generated by the content provider. Optional.
+  optional bytes provider_client_token = 6;
 }
 
 enum ProtocolVersion {
@@ -187,6 +207,8 @@ message LicenseRequest {
     message ExistingLicense {
       optional LicenseIdentification license_id = 1;
       optional int64 seconds_since_started = 2;
+      optional int64 seconds_since_last_played = 3;
+      optional bytes session_usage_table_entry = 4;
     }
 
     // Exactly one of these must be present.
@@ -233,11 +255,22 @@ message LicenseError {
   optional Error error_code = 1;
 }
 
+message RemoteAttestation {
+  // Encrypted ClientIdentification message containing the device remote
+  // attestation certificate. Required.
+  optional EncryptedClientIdentification certificate = 1;
+  // Bytes of salt which were added to the remote attestation challenge prior to
+  // signing it. Required.
+  optional bytes salt = 2;
+  // Signed remote attestation challenge + salt. Required.
+  optional bytes signature = 3;
+}
+
 message SignedMessage {
   enum MessageType {
     LICENSE_REQUEST = 1;
     LICENSE = 2;
-    ERROR = 3;
+    ERROR_RESPONSE = 3;
     SERVICE_CERTIFICATE_REQUEST = 4;
     SERVICE_CERTIFICATE = 5;
   }
@@ -246,10 +279,20 @@ message SignedMessage {
   optional bytes msg = 2;
   optional bytes signature = 3;
   optional bytes session_key = 4;
+  // Remote attestation data which will be present in the initial license
+  // request for ChromeOS client devices operating in verified mode. Remote
+  // attestation challenge data is |msg| field above. Optional.
+  optional RemoteAttestation remote_attestation = 5;
 }
 
 // This message is used to pass optional data on initial license issuance.
 message SessionInit {
+  enum ReplayControl {
+    NO_SESSION_USAGE = 0;
+    NONCE_REQUIRED_AND_NEW_SESSION_USAGE = 1;
+    NONCE_REQUIRED_OR_EXISTING_SESSION_USAGE = 2;
+  }
+
   optional bytes session_id = 1;
   optional bytes purchase_id = 2;
   // master_signing_key should be 128 bits in length.
@@ -258,6 +301,19 @@ message SessionInit {
   // (server || client) HMAC-SHA256 keys.
   optional bytes signing_key = 4;
   optional int64 license_start_time = 5;
+  // Client token for the session. This session is for use by the license
+  // provider, and is akin to a client cookie. It will be copied to
+  // License::provider_client_token, and sent back by the client in
+  // ClientIdentification::provider_client_token in all license requests
+  // thereafter.
+  optional bytes provider_client_token = 6;
+  // Session token for the session. This token is for use by the license
+  // provider, and is akin to a session cookie. It will be copied to
+  // LicenseIdentfication::provider_session_token, and sent back in all
+  // license renewal and release requests for the session thereafter.
+  optional bytes provider_session_token = 7;
+  // Replay control indicator which will be encoded into V9+ KeyControl blocks.
+  optional ReplayControl replay_control = 8 [default = NO_SESSION_USAGE];
 }
 
 // This message is used by the server to preserve and restore session state.
@@ -280,7 +336,7 @@ message SessionState {
 // in the case of X509 certificates, the certificate authority to use.
 message ProvisioningOptions {
   enum CertificateType {
-    RSA_WIDEVINE = 0; // Default.  The original certificate type.
+    WIDEVINE_DRM = 0; // Default.  The original certificate type.
     X509 = 1; // X.509 certificate.
   }
 
@@ -336,6 +392,7 @@ message ClientIdentification {
   enum TokenType {
     KEYBOX = 0;
     DEVICE_CERTIFICATE = 1;
+    REMOTE_ATTESTATION_CERTIFICATE = 2;
   }
 
   message NameValue {
@@ -343,12 +400,36 @@ message ClientIdentification {
     optional string value = 2;
   }
 
+  // Capabilities which not all clients may support. Used for the license
+  // exchange protocol only.
+  message ClientCapabilities {
+    enum HdcpVersion {
+      HDCP_NONE = 0;
+      HDCP_V1 = 1;
+      HDCP_V2 = 2;
+      HDCP_V2_1 = 3;
+      HDCP_V2_2 = 4;
+    }
+
+    optional bool client_token = 1 [default = false];
+    optional bool session_token = 2 [default = false];
+    optional bool video_resolution_constraints = 3 [default = false];
+    optional HdcpVersion max_hdcp_version = 4 [default = HDCP_NONE];
+  }
+
   // Type of factory-provisioned device root of trust. Optional.
   optional TokenType type = 1 [default = KEYBOX];
   // Factory-provisioned device root of trust. Required.
   optional bytes token = 2;
   // Optional client information name/value pairs.
   repeated NameValue client_info = 3;
+  // Client token generated by the content provider. Optional.
+  optional bytes provider_client_token = 4;
+  // Number of licenses received by the client to which the token above belongs.
+  // Only present if client_token is specified.
+  optional uint32 license_counter = 5;
+  // List of non-baseline client capabilities.
+  optional ClientCapabilities client_capabilities = 6;
 }
 
 // EncryptedClientIdentification message used to hold ClientIdentification
@@ -359,16 +440,16 @@ message EncryptedClientIdentification {
   optional string service_id = 1;
   // Serial number for the service certificate for which ClientIdentification is
   // encrypted.
-  optional string service_certificate_serial_number = 2;
-  // Serialized ClientIdentification message, encrypted with the privacy key
-  // using AES-128-CBC with PKCS#5 padding.
+  optional bytes service_certificate_serial_number = 2;
+  // Serialized ClientIdentification message, encrypted with the privacy key using
+  // AES-128-CBC with PKCS#5 padding.
   optional bytes encrypted_client_id = 3;
   // Initialization vector needed to decrypt encrypted_client_id.
   optional bytes encrypted_client_id_iv = 4;
   // AES-128 privacy key, encrytped with the service public public key using
   // RSA-OAEP.
   optional bytes encrypted_privacy_key = 5;
-};
+}
 
 // ----------------------------------------------------------------------------
 // device_certificate.proto
@@ -400,9 +481,10 @@ message DeviceCertificate {
   // Widevine system ID for the device. Required for intermediate and
   // user device certificates.
   optional uint32 system_id = 5;
-  // True if the certificate corresponds to a test (non production) device or
-  // service. Optional.
-  optional bool test_device = 6 [default = false];
+  // Deprecated field, which used to indicate whether the device was a test
+  // (non-production) device. The test_device field in ProvisionedDeviceInfo
+  // below should be observed instead.
+  optional bool test_device_deprecated = 6 [deprecated = true];
   // Service identifier (web origin) for the service which owns the certificate.
   // Required for service certificates.
   optional string service_id = 7;