Package the daemon, so a fingerprint survives a reflash
An aport, the units, and everything a phone needs to come up with a working
sensor without a single command being run by hand. Verified on the dev phone
across two reboots: modules-load.d loads qcomtee, tmpfiles builds the SFS
root, the mount unit brings up persist, and the daemon is ready 51 seconds
into the boot, owning net.reactivated.Fprint with the enrolled finger
visible.
The packaging shape is the one imsd uses for 81voltd. A versioned
provides="fprintd=..." satisfies plasma-workspace -- its Users KCM is the
enrolment UI and speaks exactly this bus name -- and excludes the real
fprintd, which is not tidiness: fprintd is D-Bus-activatable, so a client
call would otherwise start it and fight us for the name. The cost is the
fprintd-* CLIs, which go with the package.
fprintd-pam is an install_if subpackage pinned to the exact fprintd version,
so the provides breaks its condition and apk purges it -- taking pam_fprintd,
which is the entire point of the daemon, with it. Depending on it explicitly
is what keeps it, and it has no dependency on fprintd itself.
Two things the packaging exposed in the daemon:
The transcript is for experiments, not for a shipped daemon. A file per start
in an unrotated directory, recording the time of every unlock, to say what
the journal already has. It is now opt-in behind --log-dir, which is what
deploy-dev.sh passes since fplearn.sh reads it.
Taking it off the daemon path also took away the setvbuf it was doing as a
side effect of dup2'ing fd 1, and under systemd stdout is a pipe, which means
full buffering: the daemon started, worked, answered D-Bus calls, and printed
nothing. A working daemon that looks hung. stdout is now line-buffered from
the first line of main.
The config ships as generated by fp6fpcfg.py --daemon --verbose, sha256
b205c756914a66f1, because that is the file every accuracy number was measured
on. The quieter variant is untested and switching is a measurement.
The trustlet is not here and never will be: focal64.mbn is a proprietary
OEM-signed blob, and the unit's ConditionPathExists is what keeps the package
inert without it -- as it does on a kernel with no CONFIG_QCOMTEE.
2026-09-05 02:52:01 +02:00
|
|
|
# SPDX-License-Identifier: GPL-3.0-only
|
|
|
|
|
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
|
|
|
|
[Unit]
|
|
|
|
|
Description=Fingerprint daemon (FocalTech FT9391 behind QTEE)
|
|
|
|
|
Documentation=https://forgejo.catcrafts.net/Catcrafts/fingerprintd
|
|
|
|
|
# The trustlet does the matching and it is a proprietary OEM-signed blob
|
|
|
|
|
# extracted from the stock vendor partition, so it is not in this package.
|
|
|
|
|
# Without it there is no sensor, and the unit stays out of the way instead of
|
|
|
|
|
# restart-looping.
|
|
|
|
|
ConditionPathExists=/usr/lib/firmware/focal64.mbn
|
|
|
|
|
# /dev/tee0 is the qcomtee driver, which the pmOS kernel does not build yet
|
|
|
|
|
# (CONFIG_QCOMTEE). modules-load.d asks for the module; this condition is what
|
|
|
|
|
# makes the package harmless on a kernel that has none.
|
|
|
|
|
ConditionPathExists=/dev/tee0
|
|
|
|
|
# The templates are QTEE containers on the Android persist partition, reached
|
|
|
|
|
# through the SFS root's persist-data/root3 symlinks.
|
|
|
|
|
RequiresMountsFor=/mnt/persist
|
|
|
|
|
Requires=dbus.service
|
A verify nobody answered is not a failure, and the trustlet is not ours to ship
Two things the packaging left behind.
A verify that ran its 600-frame budget without the sensor being touched was
reported to the client as verify-unknown-error. Nothing had gone wrong: nobody
had pressed. It cost three verifications during packaging, each reading as a
broken daemon. fprintd's contract is that a verify runs until the client stops
it, so the frame cap bounds one trustlet scan session rather than the user's
patience, and a window with no press simply runs again. Verified across the
rollover: 600 frames untouched, "still waiting", then a press matching on its
first contact frame in 44 ms.
Presses that happen and never reach a verdict now report verify-retry-scan --
a bad scan, which fprintd has a word for, and not the matcher saying no.
The cost is that an unanswered verify polls every ~200 ms for as long as the
client holds it. The cure is measured and available -- gpio75 is silent at
idle and bursts on contact -- but it would make the IRQ the only way a press
is ever noticed, deleting the poll under every rate this daemon has been
measured at. Noted where the loop waits, not done.
And the trustlet: focal64.mbn is a proprietary OEM-signed blob, so the package
ships a fp6-vendor-blobs manifest fragment instead, the same mechanism
soc-fairphone-fp6-audio uses for the amp config. It needed a new directive
there -- a QTEE image is an ELF header file plus one payload per program
header, not one file -- and reassembly on the phone reproduces the image QTEE
has accepted since August, byte for byte.
2026-09-05 04:01:06 +02:00
|
|
|
# fp6-vendor-blobs reassembles the trustlet from the stock modem
|
|
|
|
|
# partition; it runs in sysinit so this ordering already holds, and
|
|
|
|
|
# saying so keeps the ConditionPathExists above from looking arbitrary.
|
|
|
|
|
After=dbus.service fp6-vendor-blobs.service
|
Package the daemon, so a fingerprint survives a reflash
An aport, the units, and everything a phone needs to come up with a working
sensor without a single command being run by hand. Verified on the dev phone
across two reboots: modules-load.d loads qcomtee, tmpfiles builds the SFS
root, the mount unit brings up persist, and the daemon is ready 51 seconds
into the boot, owning net.reactivated.Fprint with the enrolled finger
visible.
The packaging shape is the one imsd uses for 81voltd. A versioned
provides="fprintd=..." satisfies plasma-workspace -- its Users KCM is the
enrolment UI and speaks exactly this bus name -- and excludes the real
fprintd, which is not tidiness: fprintd is D-Bus-activatable, so a client
call would otherwise start it and fight us for the name. The cost is the
fprintd-* CLIs, which go with the package.
fprintd-pam is an install_if subpackage pinned to the exact fprintd version,
so the provides breaks its condition and apk purges it -- taking pam_fprintd,
which is the entire point of the daemon, with it. Depending on it explicitly
is what keeps it, and it has no dependency on fprintd itself.
Two things the packaging exposed in the daemon:
The transcript is for experiments, not for a shipped daemon. A file per start
in an unrotated directory, recording the time of every unlock, to say what
the journal already has. It is now opt-in behind --log-dir, which is what
deploy-dev.sh passes since fplearn.sh reads it.
Taking it off the daemon path also took away the setvbuf it was doing as a
side effect of dup2'ing fd 1, and under systemd stdout is a pipe, which means
full buffering: the daemon started, worked, answered D-Bus calls, and printed
nothing. A working daemon that looks hung. stdout is now line-buffered from
the first line of main.
The config ships as generated by fp6fpcfg.py --daemon --verbose, sha256
b205c756914a66f1, because that is the file every accuracy number was measured
on. The quieter variant is untested and switching is a measurement.
The trustlet is not here and never will be: focal64.mbn is a proprietary
OEM-signed blob, and the unit's ConditionPathExists is what keeps the package
inert without it -- as it does on a kernel with no CONFIG_QCOMTEE.
2026-09-05 02:52:01 +02:00
|
|
|
|
|
|
|
|
[Service]
|
|
|
|
|
Type=simple
|
|
|
|
|
# --edge-wake wait on the sensor IRQ instead of polling for a finger
|
|
|
|
|
# --sfs-writable QTEE must be able to WRITE the template store, or an
|
|
|
|
|
# enrolment cannot be saved. It can also unlink a container it
|
|
|
|
|
# rejects, which is why it is opt-in rather than the default.
|
|
|
|
|
# --rpmb-write the anti-rollback counter lives in RPMB; a save that cannot
|
|
|
|
|
# write it does not commit.
|
|
|
|
|
# No --verbose: it prints the frame-by-frame state machine, which on a phone
|
|
|
|
|
# is both journal noise and a record of when its owner unlocked it.
|
|
|
|
|
ExecStart=/usr/bin/fingerprintd --daemon --edge-wake \
|
|
|
|
|
--sfs-root=/var/lib/fingerprintd/sfs --sfs-writable --rpmb-write
|
|
|
|
|
# Root is required and not reducible: the daemon drives the sensor rails over
|
|
|
|
|
# gpiochip, holds /dev/tee0, and serves QTEE's RPMB transactions against the
|
|
|
|
|
# raw UFS RPMB device. No sandboxing is declared here rather than declaring
|
|
|
|
|
# some that was never tested against those three.
|
|
|
|
|
Restart=on-failure
|
|
|
|
|
RestartSec=5
|
|
|
|
|
# SIGTERM: the worker finishes the invoke it is inside before the session goes
|
|
|
|
|
# down; QTEE's listener table is global to the boot and a half-torn session
|
|
|
|
|
# leaves it holding ours.
|
|
|
|
|
KillMode=mixed
|
|
|
|
|
TimeoutStopSec=15
|
|
|
|
|
|
|
|
|
|
[Install]
|
|
|
|
|
WantedBy=multi-user.target
|