Add OEMCrypto_FactoryInstallBCCSignature API

This was requested by OEM and SOCs to support Prov 4 signing
model in the factory.

Bug: 275567037
Merged from https://widevine-internal-review.googlesource.com/176310

Change-Id: I2907841c4a16f37ae9a2241a6c9eaad73ff616af

libwvdrmengine/oemcrypto/include/OEMCryptoCENC.h

@@ -3,7 +3,7 @@
 // License Agreement.
 
 /**
- * @mainpage OEMCrypto API v18.2
+ * @mainpage OEMCrypto API v18.3
  *
  * OEMCrypto is the low level library implemented by the OEM to provide key and
  * content protection, usually in a separate secure memory or process space. The
@@ -712,6 +712,7 @@ typedef enum OEMCrypto_SignatureHashAlgorithm {
 #define OEMCrypto_GetSignatureHashAlgorithm   _oecc139
 #define OEMCrypto_EnterTestMode               _oecc140
 #define OEMCrypto_GetDeviceSignedCsrPayload   _oecc141
+#define OEMCrypto_FactoryInstallBCCSignature  _oecc142
 // clang-format on
 
 /// @addtogroup initcontrol
@@ -2996,6 +2997,41 @@ OEMCryptoResult OEMCrypto_WrapKeyboxOrOEMCert(
 OEMCryptoResult OEMCrypto_InstallKeyboxOrOEMCert(const uint8_t* keybox_or_cert,
                                                  size_t keybox_or_cert_length);
 
+/**
+ * Install a factory generated signature for the BCC. This is for devices that
+ * use Provisioning 4.0, with the signing option in the factory. With the
+ * signing option, the BCC is extracted from the device in the factory. Instead
+ * of being uploaded to the Widevine server, the BCC is signed by a certificate
+ * that the manufacturer shares with Widevine. The signature is then installed
+ * on the device is a secure location. The signature must not be erased during
+ * factory reset.
+ *
+ * This signature should be returned as `addition_signature` in a call to the
+ * function `OEMCrypto_GetBootCertificateChain()`.
+ *
+ * Devices that do not support Provisioning 4.0, or only support Provisioning
+ * 4.0 Option 1 should return OEMCrypto_ERROR_NOT_IMPLEMENTED.
+ *
+ *
+ * @param[in] signature: pointer to data as input
+ * @param[in] signature_length: length of the data in bytes
+ *
+ * @retval OEMCrypto_SUCCESS success
+ * @retval OEMCrypto_ERROR_INSUFFICIENT_RESOURCES
+ * @retval OEMCrypto_ERROR_NOT_IMPLEMENTED
+ * @retval OEMCrypto_ERROR_SYSTEM_INVALIDATED
+ *
+ * @threading
+ *   This is an "Initialization and Termination Function" and will not be
+ *   called simultaneously with any other function, as if the CDM holds a write
+ *   lock on the OEMCrypto system.
+ *
+ * @version
+ *   This method is new in API version 18.3.
+ */
+OEMCryptoResult OEMCrypto_FactoryInstallBCCSignature(const uint8_t* signature,
+                                                     size_t signature_length);
+
 /**
  * This function is for OEMCrypto to tell the layer above what provisioning
  * method it uses: keybox or OEM certificate.