Merge changes from topic "s-resetlockout-update" into sc-dev

* changes:
  Add resetLockoutRequiresChallenge property
  Update lockout-related properties for easier understandability

core/java/android/hardware/biometrics/SensorPropertiesInternal.java

@@ -31,23 +31,31 @@ public class SensorPropertiesInternal implements Parcelable {
     public final int sensorId;
     @SensorProperties.Strength public final int sensorStrength;
     public final int maxEnrollmentsPerUser;
+    public final boolean resetLockoutRequiresHardwareAuthToken;
+    public final boolean resetLockoutRequiresChallenge;
 
     public static SensorPropertiesInternal from(@NonNull SensorPropertiesInternal prop) {
         return new SensorPropertiesInternal(prop.sensorId, prop.sensorStrength,
-                prop.maxEnrollmentsPerUser);
+                prop.maxEnrollmentsPerUser, prop.resetLockoutRequiresHardwareAuthToken,
+                prop.resetLockoutRequiresChallenge);
     }
 
     protected SensorPropertiesInternal(int sensorId, @SensorProperties.Strength int sensorStrength,
-            int maxEnrollmentsPerUser) {
+            int maxEnrollmentsPerUser, boolean resetLockoutRequiresHardwareAuthToken,
+            boolean resetLockoutRequiresChallenge) {
         this.sensorId = sensorId;
         this.sensorStrength = sensorStrength;
         this.maxEnrollmentsPerUser = maxEnrollmentsPerUser;
+        this.resetLockoutRequiresHardwareAuthToken = resetLockoutRequiresHardwareAuthToken;
+        this.resetLockoutRequiresChallenge = resetLockoutRequiresChallenge;
     }
 
     protected SensorPropertiesInternal(Parcel in) {
         sensorId = in.readInt();
         sensorStrength = in.readInt();
         maxEnrollmentsPerUser = in.readInt();
+        resetLockoutRequiresHardwareAuthToken = in.readBoolean();
+        resetLockoutRequiresChallenge = in.readBoolean();
     }
 
     public static final Creator<SensorPropertiesInternal> CREATOR =
@@ -73,6 +81,8 @@ public class SensorPropertiesInternal implements Parcelable {
         dest.writeInt(sensorId);
         dest.writeInt(sensorStrength);
         dest.writeInt(maxEnrollmentsPerUser);
+        dest.writeBoolean(resetLockoutRequiresHardwareAuthToken);
+        dest.writeBoolean(resetLockoutRequiresChallenge);
     }
 
     @Override

core/java/android/hardware/face/FaceSensorPropertiesInternal.java

@@ -41,8 +41,11 @@ public class FaceSensorPropertiesInternal extends SensorPropertiesInternal {
      */
     public FaceSensorPropertiesInternal(int sensorId, @SensorProperties.Strength int strength,
             int maxEnrollmentsPerUser, boolean supportsFaceDetection,
-            boolean supportsSelfIllumination) {
-        super(sensorId, strength, maxEnrollmentsPerUser);
+            boolean supportsSelfIllumination, boolean resetLockoutRequiresChallenge) {
+        // resetLockout is managed by the HAL and requires a HardwareAuthToken for all face
+        // HAL interfaces (IBiometricsFace@1.0 HIDL and IFace@1.0 AIDL).
+        super(sensorId, strength, maxEnrollmentsPerUser,
+                true /* resetLockoutRequiresHardwareAuthToken */, resetLockoutRequiresChallenge);
         this.supportsFaceDetection = supportsFaceDetection;
         this.supportsSelfIllumination = supportsSelfIllumination;
     }

core/java/android/hardware/fingerprint/FingerprintSensorPropertiesInternal.java

@@ -35,12 +35,6 @@ public class FingerprintSensorPropertiesInternal extends SensorPropertiesInterna
      */
     public final @FingerprintSensorProperties.SensorType int sensorType;
 
-    /**
-     * IBiometricsFingerprint@2.1 does not manage timeout below the HAL, so the Gatekeeper HAT
-     * cannot be checked
-     */
-    public final boolean resetLockoutRequiresHardwareAuthToken;
-
     /**
      * The location of the center of the sensor if applicable. For example, sensors of type
      * {@link FingerprintSensorProperties#TYPE_UDFPS_OPTICAL} would report this value as the
@@ -68,9 +62,13 @@ public class FingerprintSensorPropertiesInternal extends SensorPropertiesInterna
             @FingerprintSensorProperties.SensorType int sensorType,
             boolean resetLockoutRequiresHardwareAuthToken, int sensorLocationX, int sensorLocationY,
             int sensorRadius) {
-        super(sensorId, strength, maxEnrollmentsPerUser);
+        // IBiometricsFingerprint@2.1 handles lockout in the framework, so the challenge is not
+        // required as it can only be generated/attested/verified by TEE components.
+        // IFingerprint@1.0 handles lockout below the HAL, but does not require a challenge. See
+        // the HAL interface for more details.
+        super(sensorId, strength, maxEnrollmentsPerUser, resetLockoutRequiresHardwareAuthToken,
+                false /* resetLockoutRequiresChallenge */);
         this.sensorType = sensorType;
-        this.resetLockoutRequiresHardwareAuthToken = resetLockoutRequiresHardwareAuthToken;
         this.sensorLocationX = sensorLocationX;
         this.sensorLocationY = sensorLocationY;
         this.sensorRadius = sensorRadius;
@@ -98,9 +96,9 @@ public class FingerprintSensorPropertiesInternal extends SensorPropertiesInterna
             @SensorProperties.Strength int strength, int maxEnrollmentsPerUser,
             @FingerprintSensorProperties.SensorType int sensorType,
             boolean resetLockoutRequiresHardwareAuthToken) {
-        super(sensorId, strength, maxEnrollmentsPerUser);
+        super(sensorId, strength, maxEnrollmentsPerUser, resetLockoutRequiresHardwareAuthToken,
+                false /* resetLockoutRequiresChallenge */);
         this.sensorType = sensorType;
-        this.resetLockoutRequiresHardwareAuthToken = resetLockoutRequiresHardwareAuthToken;
 
         int[] props = context.getResources().getIntArray(
                 com.android.internal.R.array.config_udfps_sensor_props);
@@ -119,7 +117,6 @@ public class FingerprintSensorPropertiesInternal extends SensorPropertiesInterna
     protected FingerprintSensorPropertiesInternal(Parcel in) {
         super(in);
         sensorType = in.readInt();
-        resetLockoutRequiresHardwareAuthToken = in.readBoolean();
         sensorLocationX = in.readInt();
         sensorLocationY = in.readInt();
         sensorRadius = in.readInt();
@@ -147,7 +144,6 @@ public class FingerprintSensorPropertiesInternal extends SensorPropertiesInterna
     public void writeToParcel(Parcel dest, int flags) {
         super.writeToParcel(dest, flags);
         dest.writeInt(sensorType);
-        dest.writeBoolean(resetLockoutRequiresHardwareAuthToken);
         dest.writeInt(sensorLocationX);
         dest.writeInt(sensorLocationY);
         dest.writeInt(sensorRadius);

packages/SystemUI/tests/src/com/android/keyguard/KeyguardUpdateMonitorTest.java

@@ -195,7 +195,8 @@ public class KeyguardUpdateMonitorTest extends SysuiTestCase {
         when(mFaceSensorProperties.get(anyInt())).thenReturn(new FaceSensorPropertiesInternal(
                 0 /* id */,
                 FaceSensorProperties.STRENGTH_STRONG, 1 /* maxTemplatesAllowed */,
-                false /* supportsFaceDetection */, true /* supportsSelfIllumination */));
+                false /* supportsFaceDetection */, true /* supportsSelfIllumination */,
+                false /* resetLockoutRequiresChallenge */));
 
         when(mFingerprintManager.isHardwareDetected()).thenReturn(true);
         when(mFingerprintManager.hasEnrolledTemplates(anyInt())).thenReturn(true);

services/core/java/com/android/server/biometrics/sensors/face/aidl/FaceProvider.java

@@ -137,7 +137,7 @@ public class FaceProvider implements IBinder.DeathRecipient, ServiceProvider {
             final FaceSensorPropertiesInternal internalProp = new FaceSensorPropertiesInternal(
                     prop.commonProps.sensorId, prop.commonProps.sensorStrength,
                     prop.commonProps.maxEnrollmentsPerUser, false /* supportsFaceDetection */,
-                    prop.halControlsPreview);
+                    prop.halControlsPreview, false /* resetLockoutRequiresChallenge */);
             final Sensor sensor = new Sensor(getTag() + "/" + sensorId, this, mContext, mHandler,
                     internalProp);
 

services/core/java/com/android/server/biometrics/sensors/face/hidl/Face10.java

@@ -332,7 +332,8 @@ public class Face10 implements IHwBinder.DeathRecipient, ServiceProvider {
             @NonNull BiometricScheduler scheduler) {
         mSensorProperties = new FaceSensorPropertiesInternal(sensorId,
                 Utils.authenticatorStrengthToPropertyStrength(strength),
-                maxTemplatesAllowed, false /* supportsFaceDetect */, supportsSelfIllumination);
+                maxTemplatesAllowed, false /* supportsFaceDetect */, supportsSelfIllumination,
+                true /* resetLockoutRequiresChallenge */);
         mContext = context;
         mSensorId = sensorId;
         mScheduler = scheduler;

services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/Fingerprint21.java

@@ -347,7 +347,8 @@ public class Fingerprint21 implements IHwBinder.DeathRecipient, ServiceProvider
         final @FingerprintSensorProperties.SensorType int sensorType =
                 mIsUdfps ? FingerprintSensorProperties.TYPE_UDFPS_OPTICAL
                         : FingerprintSensorProperties.TYPE_REAR;
-        // resetLockout is controlled by the framework, so hardwareAuthToken is not required
+        // IBiometricsFingerprint@2.1 does not manage timeout below the HAL, so the Gatekeeper HAT
+        // cannot be checked
         final boolean resetLockoutRequiresHardwareAuthToken = false;
         final int maxEnrollmentsPerUser = mContext.getResources()
                 .getInteger(R.integer.config_fingerprintMaxTemplatesPerUser);