[Lenovo P11] CryptMan:
Looks likte the fix is for multiple devices, what's unclear to me is the L3 check "mediaDrm.getPropertyString(KEY_SECURITY_LEVEL).equals("L3")" ... does this not always return L3 on our devices? or is this an online checking?

package com.widevine.otakeyboxprovisioner;

import android.content.Context;
import android.media.DeniedByServerException;
import android.media.MediaDrm;
import android.media.UnsupportedSchemeException;
import android.os.Build;
import android.util.Log;
import androidx.core.app.NotificationCompat;
import androidx.work.ForegroundInfo;
import androidx.work.ListenableWorker;
import androidx.work.Worker;
import androidx.work.WorkerParameters;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import java.util.List;
import java.util.Map;
import java.util.UUID;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class WidevineOTAKeyboxProvisioner extends Worker {
private static final Map<String, String> FACTORY_SYSTEM_IDS = ImmutableMap.ofEntries(WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("coral", "13674"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("flame", "13676"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("sunfish", "17437"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("bramble", "17650"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("redfin", "17660"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("barbet", "19321"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("J706F", "17834"));
private static final String KEY_IGNORE_KEYBOX_COUNT = "debugIgnoreKeyboxCount";
private static final String KEY_OEC_BUILD_INFO = "oemCryptoBuildInformation";
private static final String KEY_OTA_KEYBOX_FALLBACK_DURATION = "debugOtaKeyboxFallbackDuration";
private static final String KEY_SECURITY_LEVEL = "securityLevel";
private static final String KEY_SYSTEM_ID = "systemId";
private static final Map<String, String> OTA_SYSTEM_IDS = ImmutableMap.ofEntries(WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("redfin", "23883"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("bramble", "23941"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("barbet", "23942"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("sunfish", "24135"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("flame", "24136"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("coral", "24137"), WidevineOTAKeyboxProvisioner$$ExternalSyntheticBackport0.m("J706F", "25629"));
private static final String TAG = "com.widevine.otakeyboxprovisioner";
private static final List<String> TEST_SYSTEM_IDs = ImmutableList.of("7912", "26329");
private static final String UNPROVISION_RESPONSE = "unprovision";
private static final UUID WIDEVINE_UUID = new UUID(-1301668207276963122L, -6645017420763422227L);
private Context mContext;
private final String mDevice = Build.DEVICE;

public WidevineOTAKeyboxProvisioner(Context context, WorkerParameters params) {
super(context, params);
this.mContext = context;
}

public ForegroundInfo getForegroundInfo() {
return new ForegroundInfo(1, new NotificationCompat.Builder(this.mContext, "com.widevine.otakeyboxprovisioner").setContentTitle("com.widevine.otakeyboxprovisioner").setContentText(String.format("Updating %s system id from [%s] to [%s] if necessary", new Object[]{this.mDevice, getFactorySystemId(), getOTASystemId()})).setSmallIcon((int) R.drawable.wv_ic_64x64).build());
}

public ListenableWorker.Result doWork() {
Log.i("com.widevine.otakeyboxprovisioner", "Doing Work on " + this.mDevice);
ListenableWorker.Result result = checkPreConditions();
if (result != null) {
return result;
}
ListenableWorker.Result result2 = provision();
if (result2 != null) {
return result2;
}
return checkPostCondition();
}

private ListenableWorker.Result checkPreConditions() {
if (!OTA_SYSTEM_IDS.containsKey(this.mDevice)) {
Log.e("com.widevine.otakeyboxprovisioner", "OTA Keybox re-provisioning not supported");
return ListenableWorker.Result.failure();
}
MediaDrm mediaDrm = null;
try {
mediaDrm = new MediaDrm(WIDEVINE_UUID);
if (mediaDrm.getPropertyString(KEY_SECURITY_LEVEL).equals("L3")) {
Log.e("com.widevine.otakeyboxprovisioner", "L3 device");
return ListenableWorker.Result.failure();
}
String systemId = mediaDrm.getPropertyString(KEY_SYSTEM_ID);
Log.i("com.widevine.otakeyboxprovisioner", "systemId before OTA Keybox re-provisioning: " + systemId);
String factorySystemId = getFactorySystemId();
if (systemId.equals(getOTASystemId())) {
Log.i("com.widevine.otakeyboxprovisioner", "re-provisioning already done");
ListenableWorker.Result success = ListenableWorker.Result.success();
cleanupMediaDrm(mediaDrm);
return success;
} else if (systemId.equals(factorySystemId) || TEST_SYSTEM_IDs.contains(systemId)) {
String oecBuildInfo = mediaDrm.getPropertyString(KEY_OEC_BUILD_INFO);
Matcher matcher = Pattern.compile("Build Information: API_Version: 16.\\d+ LibOEMCrypto_Version: 1.\\d+ TA_Version: 1.(\\d+)").matcher(oecBuildInfo);
if (!matcher.matches()) {
Log.e("com.widevine.otakeyboxprovisioner", "OEMCrypto build info unrecognized: " + oecBuildInfo);
ListenableWorker.Result failure = ListenableWorker.Result.failure();
cleanupMediaDrm(mediaDrm);
return failure;
} else if (Integer.parseInt(matcher.group(1)) < 85) {
Log.e("com.widevine.otakeyboxprovisioner", "unsupported Widevine TA version: " + oecBuildInfo);
ListenableWorker.Result failure2 = ListenableWorker.Result.failure();
cleanupMediaDrm(mediaDrm);
return failure2;
} else {
cleanupMediaDrm(mediaDrm);
return null;
}
} else {
Log.e("com.widevine.otakeyboxprovisioner", String.format("unexpected system id %s; factory system id %s", new Object[]{systemId, factorySystemId}));
ListenableWorker.Result failure3 = ListenableWorker.Result.failure();
cleanupMediaDrm(mediaDrm);
return failure3;
}
} catch (UnsupportedSchemeException e) {
Log.e("com.widevine.otakeyboxprovisioner", "Widevine unsupported", e);
return ListenableWorker.Result.failure();
} finally {
cleanupMediaDrm(mediaDrm);
}
}

private ListenableWorker.Result provision() {
MediaDrm drm = null;
try {
drm = new MediaDrm(WIDEVINE_UUID);
drm.setPropertyString(KEY_IGNORE_KEYBOX_COUNT, "1");
drm.setPropertyString(KEY_OTA_KEYBOX_FALLBACK_DURATION, "fast");
new ProvisionRequester(drm, this.mContext).provision();
cleanupMediaDrm(drm);
return null;
} catch (Exception e) {
Log.e("com.widevine.otakeyboxprovisioner", "Exception occurred in re-provisioning", e);
ListenableWorker.Result retry = ListenableWorker.Result.retry();
cleanupMediaDrm(drm);
return retry;
} catch (Throwable th) {
cleanupMediaDrm(drm);
throw th;
}
}

private ListenableWorker.Result checkPostCondition() {
MediaDrm mediaDrm = null;
try {
mediaDrm = new MediaDrm(WIDEVINE_UUID);
String systemId = mediaDrm.getPropertyString(KEY_SYSTEM_ID);
Log.i("com.widevine.otakeyboxprovisioner", "systemId after reprovisioning: " + systemId);
if (systemId.equals(getOTASystemId())) {
return ListenableWorker.Result.success();
}
ListenableWorker.Result retry = ListenableWorker.Result.retry();
cleanupMediaDrm(mediaDrm);
return retry;
} catch (Exception e) {
Log.e("com.widevine.otakeyboxprovisioner", "Exception occurred checking final system id", e);
return ListenableWorker.Result.retry();
} finally {
cleanupMediaDrm(mediaDrm);
}
}

private static void cleanupMediaDrm(MediaDrm drm) {
if (drm != null) {
try {
drm.provideProvisionResponse(UNPROVISION_RESPONSE.getBytes());
drm.setPropertyString(KEY_IGNORE_KEYBOX_COUNT, "0");
} catch (IllegalArgumentException e) {
Log.w("com.widevine.otakeyboxprovisioner", e.getMessage() + " during cleanup");
} catch (DeniedByServerException e2) {
Log.e("com.widevine.otakeyboxprovisioner", "Impossible to reach here", e2);
throw new AssertionError(e2);
} catch (Throwable th) {
drm.close();
throw th;
}
drm.close();
}
}

private String getOTASystemId() {
return OTA_SYSTEM_IDS.getOrDefault(this.mDevice, "");
}

private String getFactorySystemId() {
return FACTORY_SYSTEM_IDS.getOrDefault(this.mDevice, "");
}
}