Merge "Face Biometric Virtual HAL" into main

}

filegroup {

    name: "face-default.rc",

    srcs: ["face-default.rc"],

    name: "face-example.rc",

    srcs: ["face-example.rc"],

}

filegroup {

    name: "face-default.xml",

    srcs: ["face-default.xml"],

    name: "face-example.xml",

    srcs: ["face-example.xml"],

}

cc_binary {

    name: "android.hardware.biometrics.face-service.example",

    relative_install_path: "hw",

    init_rc: [":face-default.rc"],

    vintf_fragments: [":face-default.xml"],

    init_rc: [":face-example.rc"],

    vintf_fragments: [":face-example.xml"],

    vendor: true,

    shared_libs: [

        "libbase",

#pragma once

#define LOG_TAG "FaceVirtualHal"

#include <aidl/android/hardware/biometrics/common/SensorStrength.h>

#include <aidl/android/hardware/biometrics/face/BnSession.h>

#include <aidl/android/hardware/biometrics/face/FaceSensorType.h>

# Virtual Face HAL

# Face Virtual HAL (VHAL)

This is a virtual HAL implementation that is backed by system properties

instead of actual hardware. It's intended for testing and UI development

on debuggable builds to allow devices to masquerade as alternative device

types and for emulators.

Note: The virtual face HAL feature development will be done in phases. Refer to this doc often for

the latest supported features

## Device Selection

## Supported Devices

You can either run the FakeFaceEngine on a [real device](#actual-device) or a [virtual device/cuttlefish](#getting-started-on-a-virtual-device-cuttlefish). This document should

help you to get started on either one.

The face virtual hal is automatically built in in all debug builds (userdebug and eng) for the latest pixel devices and CF.

The instructions in this doc applies  to all

After setting up a device, go ahead and try out [enrolling](#enrolling) & [authenticating](#authenticating)

## Enabling Face Virtual HAL

### Getting started on a Virtual Device (cuttlefish)

On pixel devicse (non-CF), by default (after manufacture reset), Face VHAL is not enabled. Therefore real Face HAL is used.

Face VHAL enabling is gated by the following two AND conditions:

1. The Face VHAL feature flag (as part of Trunk-development strategy) must be tured until the flags life-cycle ends.

2. The Face VHAL must be enabled via sysprop

##Getting Stared

Note, I'm running this via a cloudtop virtual device.

1. Setup cuttlefish on cloudtop, See [this](https://g3doc.corp.google.com/company/teams/android/teampages/acloud/getting_started.md?cl=head) for more details.

2. acloud create --local-image

3. Enter in the shell command to disable hidl

A basic use case for a successful authentication via Face VHAL is given as an exmple below.

### Enabling VHAL

```shell

$ adb root

$ adb shell settings put secure com.android.server.biometrics.AuthService.hidlDisabled 1

$ adb shell device_config put biometrics_framework com.android.server.biometrics.face_vhal_feature true

$ adb shell settings put secure biometric_virtual_enabled 1

$ adb shell setprop persist.vendor.face.virtual.strength strong

$ adb shell setprop persist.vendor.face.virtual.type RGB

$ adb reboot

```

4. You should now be able to do fake enrollments and authentications (as seen down below)

### Actual Device

1. Modify your real devices make file (I.E. vendor/google/products/{YOUR_DEVICE}.mk)

2. Ensure that there is no other face HAL that is being included by the device

3. Add the following

```

PRODUCT_COPY_FILES += \

    frameworks/native/data/etc/android.hardware.biometrics.face.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/permissions/android.hardware.biometrics.face.xml

PRODUCT_PACKAGES += \

    android.hardware.biometrics.face-service.example \

### Direct Enrollment

```shell

$ adb shell locksettings set-pin 0000

$ adb shell setprop persist.vendor.face.virtual.enrollments 1

$ adb shell cmd face syncadb shell cmd face sync

```

4. Now build and flash m -j120 && flash

5. Run the following commands

## Authenticating

To authenticate successfully, the captured (hit) must match the enrollment id set above. To  trigger

authentication failure, set the hit id to a different value.

```shell

# This is a temporary workaround

$ adb root

$ adb shell setprop persist.vendor.face.virtual.type RGB

$ adb shell setprop persist.vendor.face.virtual.strength strong

$ adb shell locksettings set-pin 0000

$ adb reboot

$ adb shell setprop vendor.face.virtual.operation_authenticate_duration 800

$ adb shell setprop vendor.face.virtual.enrollment_hit 1

```

Note: At the initial phase of the Face VHAL development, Face-on-camera simulation is not supported, hence

the authentication immediately occurrs  as soon as the authentication request arriving at VHAL.

## Enrolling

## Enrollment via Setup

```shell

# authenticar_id,bucket_id:duration:(true|false)....

$ adb shell setprop vendor.face.virtual.next_enrollment 1,0:500:true,5:250:true,10:150:true,15:500:true

$ adb shell am start -n com.android.settings/.biometrics.face.FaceEnrollIntroduction

$ walk thru the manual enrollment process by following screen instructions

# If you would like to get rid of the enrollment, run the follwoing command

$ adb shell setprop persist.vendor.face.virtual.enrollments \"\"

```

## Authenticating

```shell

# If enrollment hasn't been setup

$ adb shell setprop persist.vendor.face.virtual.enrollments 1

$ adb shell cmd face sync

# After enrollment has been setup

$ adb shell setprop vendor.face.virtual.operation_authenticate_duration 800

$ adb shell setprop vendor.face.virtual.enrollment_hit 1

# Power button press to simulate auth

$ adb shell input keyevent 26

```

#include "Session.h"

#undef LOG_TAG

#define LOG_TAG "FaceVirtualHalSession"

namespace aidl::android::hardware::biometrics::face {

constexpr size_t MAX_WORKER_QUEUE_SIZE = 5;

}

apex_key {

    name: "com.android.hardware.biometrics.face.key",

    public_key: "com.android.hardware.biometrics.face.avbpubkey",

    private_key: "com.android.hardware.biometrics.face.pem",

    name: "com.android.hardware.biometrics.face.virtual.key",

    public_key: "com.android.hardware.biometrics.face.virtual.avbpubkey",

    private_key: "com.android.hardware.biometrics.face.virtual.pem",

}

android_app_certificate {

    name: "com.android.hardware.biometrics.face.certificate",

    certificate: "com.android.hardware.biometrics.face",

    name: "com.android.hardware.biometrics.face.virtual.certificate",

    certificate: "com.android.hardware.biometrics.face.virtual",

}

apex {

    name: "com.android.hardware.biometrics.face",

    name: "com.android.hardware.biometrics.face.virtual",

    manifest: "manifest.json",

    file_contexts: "file_contexts",

    key: "com.android.hardware.biometrics.face.key",

    certificate: ":com.android.hardware.biometrics.face.certificate",

    key: "com.android.hardware.biometrics.face.virtual.key",

    certificate: ":com.android.hardware.biometrics.face.virtual.certificate",

    updatable: false,

    vendor: true,

    use_vndk_as_stable: true,

    ],

    prebuilts: [

        // init_rc

        "face-default-apex.rc",

        "face-example-apex.rc",

        // vintf_fragment

        "face-default-apex.xml",

        // permission

        "android.hardware.biometrics.face.prebuilt.xml",

        "face-example-apex.xml",

    ],

    overrides: [

}

prebuilt_etc {

    name: "face-default-apex.rc",

    src: ":gen-face-default-apex.rc",

    vendor: true,

    name: "face-example-apex.rc",

    src: ":gen-face-example-apex.rc",

    installable: false,

}

genrule {

    name: "gen-face-default-apex.rc",

    srcs: [":face-default.rc"],

    out: ["face-default-apex.rc"],

    cmd: "sed -e 's@/vendor/bin/@/apex/com.android.hardware.biometrics.face/bin/@' $(in) > $(out)",

    name: "gen-face-example-apex.rc",

    srcs: [":face-example.rc"],

    out: ["face-example-apex.rc"],

    cmd: "sed -e 's@/vendor/bin/@/apex/com.android.hardware.biometrics.face.virtual/bin/@' $(in) > $(out)",

}

prebuilt_etc {

    name: "face-default-apex.xml",

    src: ":face-default.xml",

    name: "face-example-apex.xml",

    src: ":face-example.xml",

    sub_dir: "vintf",

    vendor: true,

    installable: false,

}