Measured 2026-09-04: the trustlet's duplicated-finger check refuses to re-enrol
a finger it already has a template for -- 0 accepted of 7 presses, rc=0 on each,
while a never-enrolled finger progressed normally. Re-enrolment adds a template
and there is no trustlet-side remove, so a measured finger's old template has to
go before it can be enrolled again.
wipe does that the way it has been done by hand twice: backup first, daemon
stopped so the trustlet reloads from the store, only the template containers
removed, the group index kept because deleting it risks the RPMB anti-rollback
counters going stale, the name map cleared, then a restart and the sizes.
enrol checks the name map and refuses a finger that is already there, pointing
at wipe, so the refusal cannot be mistaken for bad pressing again.
A refused enrolment sample is one of two things: an image the algorithm saw and
turned down (rc=0, samples remaining unchanged) or an error the trustlet never
got past (a negative rc). The touch line printed the count and the fid but not
the rc, so a run of twenty-two refusals in a row said nothing about which it was.
It does now.
EXTRA=... on deploy-dev.sh appends daemon flags, so a diagnostic session can
come up with --ta-log without editing the script or the unit by hand.
Nothing is packaged yet, so the binary, the scripts, the module load, the
persist mount and the transient unit all live in places a reboot wipes. That is
deliberate -- a reboot leaves a stock phone rather than a half-installed daemon
-- but its cost was a list of manual steps in a journal handoff, and the second
reboot of the day showed what that costs. The list is now a script.
Two things it gets right that a first draft did not. The readiness check is
scoped to the current systemd invocation: the journal persists across restarts
and reboots, so grepping the whole unit history matches the previous run's ready
line and reports the daemon up while the session is still coming up on the
worker thread. And the binary is copied under a new name and swapped in with mv
after the unit stops, because a running executable cannot be overwritten and
scp reports that only as "dest open: Failure" -- which a retry loop turns into
six identical failures instead of one clear one.
Verified from a freshly rebooted phone and again over a running daemon.
Learning rewrites the template on every matched press, so run two is not a
repeat of run one and an A/B against a moving template is not an A/B. The order
is the measurement:
enrol a fresh template at 20 samples with no position prompts, which is also
the outstanding replication of the best result this lane has seen
base learning off: the clean number for that template, and the only figure
comparable to every rate already recorded
trend learning on, three times: the rate should climb, with the container
size as an independent witness that it is the template moving
A rate that climbs while the body grows is learning. A rate that moves while the
body does not is noise, and the daemon's own learn: lines say which. Run one of
the trend is not evidence that learning helped; it starts on the template the
baseline ended on.
One limit the script states rather than letting someone discover it: learning
only fires on a press that matched, so a template that never matches never
improves. That is why the protocol re-enrols instead of building on a template
already measured at 0 of 10.
The matcher has been a black box that answers yes or no, and that is why "the
matcher saw a full-contact image of the enrolled finger and rejected it" went a
whole session with no explanation.
There is no tzdbg on mainline -- /sys/kernel/debug/tzdbg does not exist on this
kernel -- so the /proc/tzdbg/qsee_log route that captured the Android reference
log is unavailable, and the qcomtee qseelog ring is on record as wedging TZ. But
focal64 writes its log into the response buffer, which is how the research
harness printed it all along. --ta-log scans it, so the matcher's own verdicts
are readable on pmOS: auth success score, identify fail with the
FtVerifyByTemplate return, and the per-frame image quality, coverage and
humidity.
Turning it on taught three things, all of which are configuration rather than
code.
A log level is not enough. The trustlet answered "no key named
diagnosis.enable_algorithm_log, use default value" -- that switch and two
siblings are separate on/off gates that stock sets on and we had never sent at
all, so the algorithm log level was being applied to a stream that was off.
Lower is more verbose and 6 is off: level 0 produced 244 lines where 5 produced
far fewer. That settles a direction the config generator explicitly left open,
and it means the old verbose setting of 5 was very nearly a quiet one.
The ring is the scarce resource. It is about 150 lines per session and is never
reset, so the config dump alone overflows it: at framework level 0 the dump
produced 244 lines and UPDATE_TEMPLATE's own lines never arrived. The shipped
verbose config now leaves the framework log off and the algorithm log at 0,
which cut the init ring to 38 lines and reserves it for the matcher. Framework
tracing is a separate run and cannot also have the matcher's lines, and the
level cannot be raised later because 6 is unrecoverable by a runtime SYNC_CONFIG.
Template learning, the half of the algorithm this daemon never ran. Every match
rate measured against this device -- 1/10, 2/10, 3/10, 7/10 -- was measured
against a day-zero template that no stock user lives with, because a stock
template is rewritten on every successful press and ours never moved a byte.
HarvestTemplate mirrors stock's post-match loop: while the finger is still on
the sensor, capture and fold, sending no event so the matcher cannot re-run and
revise a verdict the client already has. A quick tap pays almost nothing, since
the finger is gone by the time a verdict lands and the first capture reads the
idle floor; a held press contributes the frames it was actually held for.
That last property is why this subsumes the enrolment-tuning thread. The working
hypothesis after the strict-threshold and 30-sample failures was that enrolment
conditions have to resemble verification conditions. Learning is exactly that,
done by the algorithm from real unlock presses instead of by coaching a user
into positions they never use.
FlushTemplate issues the SAVE_DATA, and the worker calls it after the verdict is
posted rather than before. Persisting a learned template is roughly 350 ms of
gpfile and RPMB traffic and it does not belong on an unlock path; stock defers it
the same way, with a lazy-updater timer.
--learn=0 turns the whole thing off, which is the only way the comparison is
single-variable: learning is cumulative, so an A/B needs one binary and one
template lineage rather than two builds. --learn-frames bounds what one press may
contribute, because the template body moves as a single gpfile op against a
516084-byte listener buffer and a 30-sample body already measured 386402.
--probe-learn sends one UPDATE_TEMPLATE with no finger and then ENUMERATEs to
prove the trustlet survived it, which is the part a bare return code cannot say.
Stock rewrites the stored template on every successful press. Its post-match
loop is QUERY_FINGER_STATUS, CAPTURE_IMAGE, 0x1015 UPDATE_TEMPLATE while the
finger stays down, with no REPORT_EVENT in it -- so the matcher does not re-run
and the verdict cannot change. Forty-six of those against eighty-six captures in
one reference session, and the stored body measurably grows: 333278 bytes at
enrolment, 360822 at the next session's load, 371734 after one authentication
session. This daemon sent none of them.
The command shares REPORT_EVENT's event context. The stock wrapper memsets 732
bytes and writes six fields: a zero byte at +0x2a4, the scan-slot count, a zero
word, the count of frames folded so far in this press, a flags word of
0x00080000 with bit 6 set on the frame whose event was FingerTouched, and a zero
at +0x2d8. Declared length 0x2dc.
+0x2d8 is the one that matters, and it matters by staying zero. The dispatcher
stub reads it after the handler returns and only if it is non-zero does it read
+0x2dc and make that the response length. Every earlier attempt in this project
set both fields and varied the declared length across 0x2e0, 0x400 and 0x1000;
all of them answered -90, the trustlet gone, and the conclusion recorded was
"do not retry until a template is loaded". A loaded template was necessary but
not sufficient. The stock HAL sets neither field.
Measured on the device with two templates loaded and no finger: both branches
answer rc=0 and ENUMERATE still reports 2, so the app did not fault.
Those fields are little endian, assembled low-address-first by the handler. An
earlier reading called them big endian, off the bfi order, and was wrong.
Bit 6 selects which algorithm entry runs: clear takes libfp_template_x_update,
set takes the other, which also reads the scan-slot count.
pos() was eval'ing over the script's positional parameters from inside a
function, where $1 is the function's own argument. So `pos 3` printed "3" and
`pos 10` printed "100": every run this script has ever driven printed sample
numbers where positions should have been.
That rewrites an earlier conclusion rather than just fixing a bug. No enrolment
on this device had ever been guided, including the one that produced the best
template measured so far -- its spread came entirely from the config's overlap
band refusing near-duplicates, not from anything this script said. The
paired-test attribution drops a contributor, and the 30-sample run becomes
directly comparable to it because both were equally unguided.
Prompts are therefore opt-in now, behind FPENROL_GUIDE=1. The first run where
they actually fired steered the finger to edges, tips and hard rolls, needed 74
presses for 30 accepts, and produced a template that matched 0 of 10 taps.
Prompting a user toward positions they never use in a real tap builds a template
of positions they never use in a real tap. The default is the instruction that
worked: press as you would to unlock, and let the refusals move you.
The stage count comes from the daemon's num-enroll-stages property rather than a
second hardcoded 20.
Three fixes from the same session, all of which had been left uncommitted.
The tee_shm fd leak is the serious one. The per-frame capture region was
released only on the invoke-FAILURE path, on the belief that an invoke consumes
its input objects. That is libqcomtee's rule for callback objects, not memory
objects -- its own ta_load.c hands a memory object in exactly this way and
releases it unconditionally afterwards. So one fd leaked per captured frame, and
the first daemon instance to live through ~1000 frames hit the 1024 limit: every
capture then answered "memory region alloc failed" and an enrolment in progress
ran out of frames with nothing on the sensor to blame. Soak-proven fixed at 93
frames with the fd count flat at 2-3.
The enrolment sample count lived in two places, a hardcoded 20 here and
common.max_enrolling_samples in the trustlet config. When the config said 30 the
daemon still advertised 20 stages, so the progress counter froze at 20/20 and
the run looked clamped or hung when in fact all 30 samples were taken. It now
comes from the same JSON the trustlet is given, so the two cannot drift, with
--samples= as a deliberate override.
--probe-ta-load loads one TA image through the daemon's own loader and reports
the raw loader result. It brings up only what a load needs and unloads
afterwards, so a refusal is inert.
Jorijn asked whether re-enrolling a finger overwrites its template. It does
not. The trustlet stores a new one and keeps the old, because
FF_CMD_TA_REMOVE is not implemented -- the group on this device now holds six
templates, including one from the research harness and a pair from an
enrolment two configs ago.
The trustlet identifies against every template loaded in the group, and this
daemon reported verify-match for whatever fid came back. So a request naming
one finger was answered by any of them, including templates no name maps to
any more. That is wrong by fprintd's contract, and it also means the last
measurement was taken against the union of every template ever enrolled here
rather than against the one under test.
VerifyStart now computes which fids may answer -- the named finger's, or every
named finger's for "any" -- and a match on anything else is not a match for
that request. A fid that no name maps to answers for nothing at all.
This does not reclaim the slots. Five templates per group is the configured
limit and stale ones still occupy it; removing them needs FF_CMD_TA_REMOVE,
whose payload is not reverse-engineered.
The enrol callbacks emitted enroll-stage-passed and enroll-retry-scan as D-Bus
traffic and wrote nothing to the transcript. So a grep for refusals in the log
of the guided enrolment found none, and I recorded that the new coverage and
overlap thresholds might have refused nothing at all -- while Jorijn had been
watching the refusals scroll past on the client, which is where the signal
actually surfaced.
The conclusion was drawn from the absence of something never written. Both
outcomes are now logged with the running count, so a run's refusals can be
counted from its transcript instead of from whoever happened to be watching.
Jorijn asked whether the sample count is ours to control and whether more
samples would help. It is -- and the config dump says something more useful.
Stock enrols with 20 samples, not the 10 we had guessed, but it also sets six
keys we were leaving entirely to the trustlet's built-in defaults:
min_enrolling_coverage_threshold 70
min_enrolling_quality_threshold 20
enroll_overlap_min_area 60
enroll_overlap_max_area 80
enable_duplicated_finger_checking on
max_extral_enroll_low_quality 16
Those defaults accept anything, which is how ten quick taps in one position
became a stored template. The overlap bounds are the mechanism that matters:
a sample must overlap the previous one by 60 to 80 percent -- more means the
finger did not move, less means a gap -- so the algorithm now refuses the
same-spot sample instead of storing it. Sample count alone would have stored
twenty near-duplicates rather than ten.
Deliberately left out: min_identify_quality_threshold and
min_identify_coverage_threshold. Those gate matching rather than enrolment and
would reject exactly the landing frames the 1.5x detection threshold exists to
catch. One group of variables at a time.
fpenrol.sh grows to twenty positions, and its rejection message now says to
move rather than to press harder, because the enforcement and the guidance
finally agree on what a rejected sample means.
The threshold change is the first thing to move accuracy. Labelled protocol,
enrolled quick taps: 4 of 10, against 2 of 10 for every previous build. Seven
of fifteen presses now get two or more frames where none did before, and the
landing frames the old threshold discarded turn up in the transcript at 207,
213, 242 and 284. Wrong finger still 0 of 5.
It also explains the latency asymmetry Jorijn noticed. A match ends the loop
the moment it happens, mean 1317 ms. A no-match waits for the finger to lift,
mean 2190 ms, because a later frame in the same press may still match -- and
they do, at frames 3, 5 and 8. That is the press rule working, not a fault.
What the same run says about the template is worse than the loop ever was. One
press produced eight frames at full contact, 362 to 367, and every one
rejected; another produced six. Roughly one frame in seven matches, against the
47 to 75 percent the journal records for the template the research harness
enrolled. The first template here was ten quick taps in about one position, so
the algorithm was handed ten near-duplicate images of one spot.
fpenrol.sh enrols with a different contact position per ACCEPTED sample --
centre, left, right, tip, joint, rolled either way -- driven by
fprintd-enroll's own per-stage output rather than by counting presses. Enrol as
a SECOND finger so both templates coexist and the comparison holds the loop
constant; the trustlet reports which fid matched, and the daemon's map turns
that back into a name.
Three loop changes have now failed to move quick-tap accuracy: the frame gap
from 500 to 40 ms, the rising edge from two matcher runs to one (3x cheaper
frame), and waking on the touch edge instead of polling. All three left every
press at exactly one frame and the rate at 2 of 10. The transcript says why:
frame 20 @ 4005ms: metric=247 irq=1 finger landing, below threshold
frame 21 @ 4399ms: metric=366 FINGER rej detected; this frame costs ~400 ms
frame 22 @ 4562ms: metric=132 already gone
A frame that detects a finger takes 400-580 ms to process, of which the
trustlet's own REPORT_EVENT is about 300, and a quick tap lasts 400-600 ms.
There is no room for a second frame however early the loop wakes. Speed was
never the constraint.
But the landing frames are being thrown away. 209 and 247 against a 133 floor,
with the interrupt already asserted, discarded by a 2x threshold -- and they are
the only frames a quick tap has to spare. 1.5x puts the threshold at 200: above
the highest idle drift observed (147), below the lowest landing frame seen
(209). The tests pin it between those two measurements rather than to a
constant, and assert that 2x would have discarded both.
Single variable against the labelled 2-of-10 baseline.
The measurement that made this worth building: gpio75 is silent at idle under
WAIT_TOUCH -- zero edges in sixty seconds -- and bursts within milliseconds of
a finger landing. In the observed taps the burst appeared in the transcript
hundreds of milliseconds before the polled capture noticed the finger, which is
why a quick tap only ever produced one frame however cheap the frame became.
So the inter-frame wait is now a wait on the line rather than a sleep. At idle
it times out at the fallback cadence and costs nothing. At contact it returns
at once, so the first capture of a press happens when the finger lands. While
the finger stays down the sensor keeps pulsing, so the wait keeps returning
immediately and the loop runs as fast as QTEE allows -- which is what a press
wants and what stock's architecture does.
Queued edges are dropped when a session arms, or the previous press's burst
would wake the first wait instantly. --edge-wake gates it as a single variable
against the labelled 2-of-10 baseline; it and --irq-observe are mutually
exclusive because both would drain the same fd.
Taps are one frame at ~200 ms per frame just as they were at ~700, so the
polling cadence is what catches a tap once and the loop's cost is no longer the
limit. The remaining lever is the architecture stock uses: react to the touch
edge, then capture as fast as QTEE allows for the length of the press.
That rests on a prerequisite worth measuring before a line of it is written.
The IRQ line is requested with both edges enabled and an observer thread polls
it and logs every event with the kernel timestamp, the interval since the last,
and the pulse width. Pure observation -- the matching loop is untouched.
Two questions it answers. Whether edges are observable from userspace at all,
and how quiet the line is at idle under an armed session: the level poll caught
it high on 5 of 136 idle frames, so there are pulses at rest, and if they are
frequent a wake-on-edge is dead before it starts.
Labelled baseline on the proven loop, quick taps only: enrolled finger 2 of 10,
wrong finger 0 of 5. Every press was one frame.
The rising-edge frame costs ~700 ms because it runs the matcher twice -- event 5
and event 7 on the same image, two verdicts back. A human tap is over before a
second frame can exist at that cost. Keeping only the touch event keeps what
every recorded match followed, halves the rising frame, and may be the
difference between one frame per tap and two. It is a single variable against a
labelled baseline; if the rate drops, it comes out.
Also fixes fptrial.sh's latency column, which was all zero: busybox date has no
%N, so it reads /proc/uptime instead.
Thirteen real fprintd-verify runs produced four matches and nine misses and no
rate, because nothing recorded which finger each run used. This script runs the
protocol -- N quick taps with the enrolled finger, then N with a different one
-- tells the user which finger and which tap they are on, and records the label
and the wall-clock latency from prompt to client result per tap. The daemon's
transcript has the frames; this has the labels. A loop change is measured
against this, one variable at a time.
Two changes went in together and the next four runs matched nothing, including
a held press. They cannot be separated after the fact, so both come out and the
loop returns to the shape that has matched every time it was asked to.
One is definitely broken. The rising-edge recapture assumed a frame 50 ms after
detection would show a settled finger; on a quick tap the finger was already
gone, the recapture read the idle floor -- metric 133, still flagged FINGER
from the first capture -- and an empty image went to the matcher. A guaranteed
miss on exactly the case it was meant to fix.
The other is probably wrong. Dropping event 5 as a duplicate rested on
observing that event 7 alone produces a verdict -- but every such observation
was a held frame that followed an event 5 on the same press. Whether the touch
event initialises the press in the trustlet is not known, and five finger
frames with no match is not the evidence to remove it on.
The process error is the one worth writing down: two variables changed at
once, on a live user's finger, with no way to attribute the result. One at a
time from here.
Two changes to the verify loop, both from measurement on the daemon.
The rising edge sent events 5 and 7 from the same capture and got two verdicts
back from one image -- rej rej, -11 -11, MATCH MATCH. Event 5 reaches the
matcher here as well as event 7, so the second REPORT_EVENT was 250 to 300 ms
of redundant work on every press, on the frame where speed matters most.
Authentication now sends only event 7. Enrolment keeps event 5, where it is the
sample trigger rather than a duplicate.
And the frame that detects the finger is the finger landing: partial contact,
and the frame that rejects most often -- across the real runs matches came at
frame 3, 5 and 8 of a press, and a quick tap is one frame. So on the rising
edge the daemon captures once more, about 50 ms later, before reporting, and
the matcher's first look is at a settled finger.
The rescan-budget experiment is reverted. At the stock budget every
non-matching frame answered -11, for the enrolled finger and the wrong one
alike, while matches landed exactly where they did at rescan=0. The budget
relabels a non-match; it does not make the trustlet try harder. Under the press
rule the two are functionally identical, and rescan=0's terminal rejection is
the cleaner label.
rescan=0 made every frame terminal, which is what stopped a wrong finger from
hanging the client -- but it also disabled the trustlet's own "image not good
enough yet, try again" answer, so a marginal first frame became a hard
rejection. In real use that showed as a quick tap of the enrolled finger
answering verify-no-match: one frame, rejected. Matches land at frame 3, 5, 8
of a press; the first frame is the finger landing.
The alternative is to let the trustlet keep its rescan budget and handle the
wrong finger where it actually manifests, at the press level: a press that
lifts with no terminal verdict is reported as no-match. The trustlet then
answers -11 on marginal frames instead of rejecting them, and the press keeps
going until it matches or the finger lifts.
A knob rather than a decision, because the trade-off is measured, not assumed:
under the stock budget seven of nineteen correct presses ended undecided at the
old 500 ms frame rate, and whether the faster loop closes that gap is the
question the next runs answer.
A claim is held by a bus connection. If that connection goes away -- the client
crashed, was killed, or never called Release -- the claim has to go with it, or
the device is AlreadyInUse for everyone until the daemon restarts. fprintd
watches the claimant's name for exactly this reason.
Found the hard way: a Claim issued from one busctl invocation, which exits the
moment it returns, left the device permanently claimed by a connection that no
longer existed. The daemon now subscribes to NameOwnerChanged for the
claimant's unique name and, when it loses its owner, cancels any running
operation and clears the claim. Release goes through the same path so the
subscription is torn down either way.
Verified with the stock client killed mid-verify under timeout: the claim
dropped, the verify cancelled, and fprintd-list worked immediately after.
500 ms between frames was the research harness's pace, chosen so a person
could read the transcript as it scrolled. It became the daemon's pace by
inheritance, not by decision, and it is the root of both complaints from real
use: false negatives and a slow answer after lifting.
The matcher rejects the early frames of a correct press and matches several
frames in -- frames 3 and 8 in the acceptance run. So the number of frames a
press gets is what decides it, and at 500 ms a one-second press gets two. And a
lift is only noticed on the next frame, so the gap is also the latency a user
feels before verify-no-match.
A frame costs four QTEE round trips whatever the gap; the gap is pure delay on
top. 40 ms is a starting point, not a measurement: the loop now logs
milliseconds per frame so the real achievable rate is read rather than assumed,
and logs the IRQ line alongside the metric so it is visible whether gpio75
tracks the finger under an armed session -- if it does, lift detection can
become an edge wait instead of a poll. --frame-gap= overrides it.
A wrong finger against the daemon was a silent wait: the loop exited only on a
terminal verdict, and at the stock rescan budget a wrong finger never produces
one -- it answers "not identified yet" on every frame until the right finger
shows up. fprintd's PAM module needs a verify-no-match to deny or retry, so
that is a client that hangs.
The unit of decision is now a press. Within one press the matcher may reject
early frames and match a later one, so a press is judged when the finger lifts:
any match wins, only rejections is no-match, no terminal frame at all is
undecided and scanning continues. A press that matches is reported the moment
it does rather than making the user hold for a release.
Undecided presses are exactly why the rescan budget matters here. At 0 every
frame is terminal and every press decides; at the stock budget seven of
nineteen correct-finger presses ended undecided in the last measurement, which
under a press rule would read as rejections. So the daemon is being run with
rescan forced to 0 while that trade-off is measured on the new template rather
than assumed.
Every frame is logged under --verbose and every press always, so the next
wrong-finger control is visible in the transcript instead of absent from it.
fprintd's contract: a status with done=true means no more status is coming,
not that the operation is over. The client still calls EnrollStop or
VerifyStop, and until it does the device is busy with that operation. Clearing
the op on done made every stock client's Stop fail with NoActionInProgress --
seen on the first fprintd-enroll against this daemon, which otherwise succeeded
through all ten stages.
Clearing it from the worker was also a race: a client that cancels and
immediately starts a new operation would have had that new operation cleared by
the old one's completion event. The worker no longer touches the op state at
all; only Stop and Release do, on the main thread.
A seeded map was reported as empty. The instrumented path shows why in one line:
`user` on postmarketOS is uid 10000, not 1000, so the daemon looked for
fingers-10000.map and the file I had written was fingers-1000.map. Two probe-mode
enrolments today also went into gid 1000 on the same assumption -- a group the
daemon will never select for that user, since gid is the uid by design.
Nothing to correct in the daemon; the assumption was mine, and the fix is to
enrol through the daemon rather than around it. The log line stays because
"which uid did we resolve and which file did we open" is the first question
every time this surface says a user has nothing enrolled.
The probe becomes the thing the plan was for. Three threads: the supplicant
services QTEE's callbacks; the worker owns the sensor rail, the QTEE session
and the trustlet and is the only thread that ever invokes it, so every
enrolment and authentication is serialised by construction; the main thread
runs the GLib loop and speaks fprintd's own D-Bus interface, never touching
the trustlet directly.
Session is the bring-up from a cold /dev/tee0 to a calibrated sensor, plus the
enrol and verify loops as methods that take a cancel flag and progress
callbacks. Worker is a job queue on a pthread with an 8 MiB stack -- musl's
default is 128 KiB and the session keeps request buffers on the stack. Results
come back through g_idle_add so signals are emitted on the thread that owns
the connection.
net.reactivated.Fprint is implemented rather than wrapped: Manager with
GetDevices/GetDefaultDevice, Device with Claim/Release, EnrollStart/Stop,
VerifyStart/Stop, ListEnrolledFingers and the three Delete variants, the three
signals, and the five properties. Owning fprintd's name is what lets
pam_fprintd, the Plasma KCM and fprintd-enroll work unmodified.
Two honest limits. Authorisation is the conservative rule -- you may act on
your own prints, root on anyone's -- because polkit is not in this milestone.
And DeleteEnrolledFingers removes the finger's NAME only: FF_CMD_TA_REMOVE
exists but its payload is not reverse-engineered, and guessing at a command
that writes to the store is exactly how an index got invalidated earlier
today. A deleted finger loses its name and stops being offered; its template
still occupies a slot in the group. Logged as such.
The finger-name map is written per user under the state directory, tmp-file
and rename. An enrolment records the fid the trustlet reported in the touch
event's response; if none was reported the finger cannot be named yet, and
the daemon says so rather than inventing one.
Verified on the phone as a systemd unit: owns the bus name, init chain
complete, floor calibrated, ready.
SAVE_DATA now returns rc=0: 24 gpfile writes, 13 RPMB writes, no rollback.
The last fault was collecting the RPMB result frame into a local array. QTEE
reads it at req + req[0x0c] -- the same place the request frames were -- so
into a local means QTEE never sees the device's answer, fails the whole
transaction with an I/O error, and rolls back, having already committed the
counter. The reference passes the shared buffer as both source and result
destination for exactly this reason.
Also: req+0x14 is not always a usable chunk size. The reference falls back to
the whole block count when it is zero or exceeds nblocks, and refusing instead
aborts a legitimate write.
--cal-save drives a calibration save, which writes a real container through the
entire storage stack and needs NO FINGER. Three faults were found and fixed
with it in minutes, each of which would otherwise have cost a person ten
press-and-lift cycles to reach.
A process note worth more than the code. An earlier attempt at this appeared to
die mid-transaction; it did, and I killed it -- piping the phone's output
through `head` closed the pipe, SIGPIPE travelled back through tee, and the
daemon was terminated during an RPMB write sequence. That is precisely the
state the journal warns leaves a store inconsistent with a counter that cannot
be moved back. Never truncate a long-running device command's output; let it
finish and read its transcript.
A store with no enrolments has no group directory, and open(O_CREAT) creates
the file but never its parent. A first enrolment into a fresh store therefore
failed with ENOENT, which QTEE reports as an I/O error -- indistinguishable
from a real storage fault, and the same -5 a refused RPMB write produces.
An enrolment collected all ten samples and then SAVE_DATA answered -5. The
cause was not the sensor or the storage framing: ServeRpmb only ever
implemented Op::Read. A write fell through the branch with rc still -1 and was
refused, whatever --rpmb-write said. QTEE could not commit the anti-rollback
record, so it rolled the transaction back -- after it had already rewritten the
group's index container on disk.
The write sequence is per chunk: the data frames out, a Result Read Request
out, the result frame back. A remainder is refused rather than partially
committed, and a non-zero device result aborts instead of continuing into
further chunks, because at that point the counter state is not what we think it
is.
The refusal was not the only failure. Two assumptions were wrong and both are
recorded in the journal:
--group-path does NOT isolate the group directory. The writes went to the
Android group, the one holding the working template, not to a new group derived
from the namespace path. Isolation has to come from pointing the SFS root at a
separate tree, not from the namespace key.
And the rolled-back transaction left the index rewritten, so QTEE rejected it
and the template became unreachable -- ENUMERATE 0, and repeated unlink
attempts refused only because the mount had been switched back to read-only.
Restoring the index from the pre-enrolment backup brought it back: templates
loaded 1.
The RPMB counter never moved, which is why restoring an older index worked at
all. Had the write path been implemented, it would have.
Two problems from a real attempt, one mine and one the tool failing to explain
itself.
A sample is taken on the RISING edge only. Holding the finger down produces no
further touch events however long it stays there, so a run with the finger
almost permanently down collects one sample: 55 finger frames across 60, three
touch events, two samples accepted. The loop now says which state it is in on
every line -- press, hold, or LIFT -- shows accepted-of-total as it goes, and
calls out a finger that has been held for several frames, because that is the
state where nothing is happening and nothing on screen said so.
And the total is now read from the config instead of inferred. `rem` is
reported after the sample is processed, so the first reading of a healthy
enrolment is already 9, and a session that takes the first reading as its total
is permanently off by one -- it reported "1 of 9 accepted" when two samples had
been accepted out of ten. common.max_enrolling_samples is stated explicitly in
the generated config so both sides agree on the number rather than one of them
guessing.
Also recorded: not every press is accepted. The third touch of that run
reported the same count as the second, which is the algorithm rejecting a
sample, and is normal.
A three-tap enrolment declared itself complete. The transcript says why:
frame 2: metric=308 FINGER ev5 rem=10
frame 3: metric=187 ev6 rem=0
samples: 10 of 10 accepted
The release event never enters do_enroll, so its response leaves
samples-remaining untouched at 0 -- which is indistinguishable from "none
remaining, you are finished". The session believed it, stopped after one press,
and called SAVE_DATA on an algorithm holding no template. That answered -1 and
wrote nothing, so the store was undamaged, but only by luck: the guard meant to
prevent a partial save was itself satisfied by the bogus count.
A reading is only meaningful when it came from the event that runs the enrol
path, and nothing about the value says so -- the caller has to. Observe now
takes that as an argument. Two further guards: a FIRST reading of 0 is an
unpopulated field rather than a finished enrolment, and the count only ever
falls, so an increase is noise.
Verified by mutation: trusting the release event's count, and accepting a
leading zero, each fail the suite.
Enrolment is the first thing here that writes: template containers through the
gpfile listener and counter records through RPMB. It refuses to run unless both
--sfs-writable and --rpmb-write are given, and it refuses to call SAVE_DATA if
the sample count did not reach zero, because a partial template is worse than
none.
The sequence is stock's: cancel, reset-lockout, authenticate, cancel,
reset-lockout, PRE_ENROLL, authenticate, cancel, ENROLL, the sample loop,
POST_ENROLL, SAVE_DATA with bit 30 set. AUTHENTICATE is what arms the capture
session, which is why it appears in an enrolment at all.
Enrolment takes one sample per PRESS: touch on the rising edge, release on the
falling one, nothing in between. Stock's entire enrolment trace contains no
image-ready event, and feeding every held frame gives the algorithm
near-duplicate images from a single press.
Two things named honestly. The ENROLL payload's u32 at +69 was recorded here as
a "timeout"; the trustlet reports it back as the GROUP ID, and filling a
mislabelled field with a plausible number is the entire provenance of gid 60.
It is the gid now, so an enrolment can choose its own group.
And --group-path exposes the namespace key the trustlet hashes into the group's
directory name. It defaults to Android's, which is where this device's existing
store lives and how that template is readable. But SAVE_DATA rewrites the
group's index container, and an index QTEE later fails to verify takes every
template listed in it -- so enrolling into a DIFFERENT namespace is complete
isolation from a store we did not write.
A correct-finger run matched on frame 1 -- twice, on both the touch and the
image-ready event, with the right gid and fid -- and then answered "not
identified yet" for the remaining 39 frames without ever producing another
verdict. The matcher was never the problem; our loop wedged after the first
result.
The reference frame loop is {QUERY_EVENT_STATUS, CAPTURE_IMAGE, REPORT_EVENT,
QUERY_EVENT_STATUS, REPORT_EVENT}. Ours queried only at the top of the frame.
QUERY_EVENT_STATUS answers in rc -- 5 while an event is pending, 0 once
REPORT_EVENT has consumed it -- so the trailing query is what acknowledges the
trustlet's event state before the next frame. Without it the state is never
cleared and every later frame is refused.
Both status values are now printed per frame, so the state machine is visible
rather than inferred.
This also explains the wrong-finger control reading as 40 rescans and no
rejection: a session that never resolves has nothing to acknowledge, so it
looked the same either way and told us less than it appeared to.
PoisonFid takes the payload and offsets to the fid field internally. It was
being handed a span already offset by the payload offset, so the poison landed
at payload+0x20 and the real fid field stayed zero. A frame where the matcher
never ran then looks exactly like a frame where it ran and rejected -- which is
the specific failure this project has recorded three times and is precisely
what the poison exists to prevent.
Visible in a real run: the frames marked REJECTED were 138, 138, 133, 137, 134
against a floor of 136, i.e. every one of them was a finger-RELEASE frame with
nothing on the sensor. Five rejections that never happened.
The two offsets are numerically equal, which is why double-applying is silent,
so the test now pins both directions: poisoning the payload marks the fid
field, and poisoning an already-offset span leaves it zero and misclassifies.
Also adds --rescan=N, which patches common.max_authentication_rescan_times into
the config. The stock budget lets a whole run end with no terminal verdict --
correct for shipping, useless as a measurement, because a wrong-finger control
that never reaches a verdict has not demonstrated a rejection. Forcing 0 makes
every frame terminal. It prints MEASUREMENT ONLY because a rate taken that way
is a per-frame figure with the retry mechanism disabled, and is not a shipping
reject rate.
A run whose result nobody recorded is a run that has to be repeated on a
human's finger, and this daemon printed to stdout and nowhere else. Two real
authentication runs -- an enrolled finger and a wrong-finger control -- were
performed and their output is simply gone.
A single shared log path would be worse than none: the next run, including a
quick control, overwrites the interesting one. That very nearly cost this
project the transcript of its first successful authentication, which is why
the harness moved to per-run files.
Teeing is done at the file-descriptor level rather than by wrapping a stream.
std::println writes to stdout through C stdio, so an ostream wrapper captures
nothing; routing fd 1 through tee catches every line, including whatever the
library prints.
Arms a scan session and drives the frame loop: capture, decide finger from the
calibrated floor, report the touch edges, classify the verdict.
It needs no writes of any kind -- no SAVE_DATA, no RPMB write, no SFS write --
so it runs safely against an existing template with the store read-only. That
is what makes it the right thing to try before enrolment rather than after.
Verified armed on the phone: the template loads, the floor calibrates, and
AUTHENTICATE returns rc=0, which also proves the gid agrees with the one
SET_ACTIVE_GROUP used (a mismatch answers -200). With no finger present the
loop correctly reports nothing: no touch edge, no event, no terminal frame.
The fid field is poisoned before every REPORT_EVENT, because a zero-initialised
buffer cannot distinguish "the matcher never ran" from "the matcher ran and
rejected" -- the failure path writes zero there too.
The tally reports terminal frames as the denominator and presses separately,
so a run cannot be read as having rejections it did not have.
The whole storage path now works from the daemon. On the phone, against the
real store:
listener 0x7000 sb=516096 -> result=0 REGISTERED
listener 0x2000 sb=25600 -> result=0 REGISTERED
SET_ACTIVE_GROUP gid=60 path='/data/vendor_de/0/fpdata'
gpfile READ .../1lPrxAL0vXRvWPeDkW2c off=4096 len=252114
...
CMD 0x2005 -> result=0 rc=1
templates loaded: 1
QTEE read a 252114-byte enrolled template through our gpfile listener, verified
it, and loaded it. Since QTEE unlinks any container whose keyed integrity tag
fails, a load is proof the framing is right -- the read/write offset split, the
container chunking, and the RPMB anti-rollback read that has to succeed before
QTEE will trust any of it.
RPMB is served too: SECURITY PROTOCOL IN/OUT against the RPMB well-known LUN,
retrying the unit attention the LUN raises once after a reset. Writes are
refused unless asked for, because they advance a counter that cannot be moved
back, and key programming is refused unconditionally.
The store was served READ-ONLY throughout, which is the point. A listener that
serves bytes at the wrong offset does not merely fail: QTEE deletes the
container it cannot verify, and that is an enrolled fingerprint gone. Read-only
makes a wrong build harmless, so it is the default and writing is opt-in.
Two ordering facts, both of which produce -2 with no storage read at all --
indistinguishable from a broken listener:
* a template reload needs the device init chain to have run FIRST, because
that chain allocates the per-slot array the reload writes through;
* SET_ACTIVE_GROUP's second field is a NAMESPACE path, not a filesystem one
and not the gid again. The trustlet hashes it into the group's directory
name, so it has to match what the store was written under.
Also: a positive rc is not an error code. ENUMERATE returns the template count
there, and running that through the error table printed "unknown" for a good
answer.
The finger-free path is complete. On the phone, from a cold start:
client env -> loader -> trustlet -> config -> sensor rail -> init chain
calibrating the idle floor (5 samples)
idle 1/5: rc=-11 metric=133
...
idle floor = 133, finger threshold = 266
133 is the number the journal records for this sensor, so the port reproduces
the reference measurement rather than merely producing one.
Two things had to be right at once, and the first attempt had neither.
The memory region: CAPTURE_IMAGE reads an output-buffer pointer out of
payload+0x00, and QTEE only patches an address there if the location is named
in embeddedBufOffsets and the region handed over in an object slot. The
instrumented dump shows it working -- payload+0x00 came back holding
0x088db98000 -- which is what made the remaining failure legible instead of
mysterious.
And two fields inside the capture payload that an all-zero request leaves
unset: a frame count at +0x0c and a branch selector at +0x10. Selector 0
returns metric 0. Sending zeros gets -201 with the region correctly attached,
which reads exactly like a broken region and is not one. They are named
constants now, with the note that the metric is PER FRAME so a threshold
calibrated at one frame count means nothing at another.
The flags word at payload+0x18 stays past the declared length of 0x14 on
purpose: the trustlet range-checks that length to exactly 0x14 and reads the
flags anyway.
--verbose keeps the region and reqOut dumps, which is what turned this from
guesswork into reading.
The daemon now powers the sensor and initialises the trustlet against it. On
the phone, every step of the chain returning rc=0:
gpiochip 'f100000.pinctrl' is /dev/gpiochip5 (168 lines)
sensor powered, reset released, irq=1
CMD 0x1006 INIT_SPI rc=0
CMD 0x100a PROBE_DEVICE rc=0
CMD 0x100b INIT_DEVICE rc=0
CMD 0x1004 TA_INIT rc=0
CMD 0x1020 WORK_MODE rc=0
CMD 0x100e SYNC_STATISTICS rc=0
GPIO v2 chardev ioctls directly rather than libgpiod, which is on neither the
phone nor the sysroot and would be a dependency for three lines.
The chip is found by label, and the label is not what the device tree calls it:
the node is pinctrl@f100000 so the chardev advertises "f100000.pinctrl", while
every DT reference says "tlmm". Matching on "tlmm" finds nothing, which is how
the first run failed. There is a second check on the line count, because this
SoC has another pinctrl with 23 lines and driving line 75 of the wrong
controller is not something you recover from over ssh.
The XPU guard is enforced where the line is actually opened, not only asserted
in the core. gpio8-11 are the fingerprint SPI pads and touching one is an
immediate SError with the phone rebooting where it stands, so a refusal has to
sit in front of the ioctl.
Owning the rail is what makes the session recoverable at all: one reset buys
exactly one trustlet init and a second answers -205, so a failed session needs
the rail cycled rather than the chain retried. The harness split these across
two processes and every run began by restarting the one holding the rail.
CAPTURE_IMAGE answers -201 here and that is correct, not a regression: it needs
a shared memory region whose address QTEE patches into the payload, and none is
supplied yet. That is the next piece.
On the phone, end to end from the daemon:
lookupTA('focal64') -> result=23 (nothing to unload)
trustlet loaded from /lib/firmware/focal64.mbn, distName='fingerprint'
config /lib/firmware/fingerprintd.json: 349 bytes
CMD 0x100d -> result=0 rc=0 (Success)
CMD 0x2005 -> result=0 rc=0 (Success)
The config is the one fp6fpcfg.py --daemon generates, so the reduction of nine
hand-edited ffcfg files to one generator is confirmed against the trustlet
rather than only against the files it replaced.
A stale instance is unloaded before loading, which is what stops a crashed
experiment costing a reboot; result=23 is the clean-slate answer.
The request envelope moves into Fingerprintd:Ta with the rest of the layouts:
command id at +0, declared length at +4, payload at +0x10, and on the way back
the trustlet's own rc at +8 and the capture metric at +0x0c. Both are HEADER
fields ahead of the payload -- the metric has been miscalled "payload+12" in
this project's notes, and every recorded finger number depends on reading it
where it actually is.
ENUMERATE answering rc=0 is correct here and not a regression: no group is
active and no storage listeners are registered yet, so there are no templates
to count.
fingerprintd's own code now talks to QTEE. On the phone:
root object on /dev/tee0
client env obtained (uid 0, 13-byte credentials)
QSEECOM-compat app loader (UID 122) opened
The credentials object is ours rather than libqcomtee's. Upstream's exists only
to build a thirteen-byte CBOR map and drags in QCBOR to do it, so
packaging/make-libqcomtee.sh compiles the two sources that matter and drops
credentials_obj.c entirely -- nothing else references it, and the library then
has no dependency beyond libc. The map is built in Fingerprintd:Tee where it is
pinned byte-for-byte against the string verified on-device, and the object's
two-op read protocol is served here.
Three interop details, all of which cost a build cycle:
* libqcomtee's headers carry no extern "C" guard, having only ever been
consumed from C, so everything came out C++-mangled. They also pull in
<stdatomic.h> and <stdio.h>, which under libc++ drag in templates that may
not appear inside extern "C" -- so those are included first.
* tee_call_t's second parameter is unsigned long on glibc and int on musl.
The native build is glibc and the phone is musl; both forms are compiled.
* On the callback path a UBUF_OUTPUT param arrives with addr = NULL. The
dispatcher supplies the buffer, so a handler POINTS the param at its own
storage rather than writing through the incoming address. Doing the latter
is a null dereference that takes the supplicant thread with it, which is
how the first run against real QTEE ended -- with the correct behaviour
already spelled out in the module comment above the code that ignored it.
That comment now says so in as many words.
packaging/make-sysroot.sh populates a minimal Alpine aarch64 rootfs with
apk-tools-static, so a cross build needs no root, no qemu and no phone. Adapted
from imsd's, plus glib-dev for the bus layer that is coming.
Building against a real Alpine sysroot means the binary links dynamically
against the phone's own musl and libc++ -- libc++, libc++abi, libunwind and
libgcc_s are all already on pmOS. The harness this daemon replaces had to be
built -static, but only because it was built with the host's glibc toolchain;
that constraint was never about the target.
The pipeline is proven end to end rather than assumed: the cross-built binary
runs on the phone, and all five core suites pass there too -- on the real
hardware, not just under qemu-aarch64. That matters for modules that are almost
entirely little-endian field packing and offset arithmetic.
gid 60 was never a decision -- it was the ENROLL token's timeout field being
read as a gid, then made self-consistent. Keeping it readable alongside gid =
uid would be a second code path, a second group to reason about, and a
migration to eventually retire, all to avoid re-enrolling one finger on one dev
phone. Re-enrol it instead.
Fingerprintd:Store holds the correspondence between two vocabularies that know
nothing about each other: the trustlet identifies a finger by an opaque 32-bit
id it chose, and fprintd speaks users and names like "right-index-finger".
Nothing else can hold it -- the trustlet has no field for a name.
No biometric data passes through here. A template is a ~252 KB container the
trustlet encrypts and QTEE anti-rollback protects; this is a table of {name ->
the id the trustlet reported}, worth about as much as a username. It is stored
as one "name fid" per line, deliberately boring and greppable, because losing
it costs names rather than templates and it should be repairable by hand.
Two properties are load-bearing. fid 0 is never storable or matchable: 0 is
what the trustlet writes into the fid field when authentication FAILS, so a
stored 0 would turn every rejection into a match. And a damaged map degrades to
"fewer names known" rather than to a daemon that will not start -- unknown
names, missing ids, partly-numeric ids and zero fids are all skipped, since the
daemon that fails to start is the one that unlocks the phone.
The gid is the caller's Linux uid. SET_ACTIVE_GROUP and AUTHENTICATE only have
to agree with each other, so the value is ours to choose, and the uid makes the
mapping total with no allocation table. The dev phone's gid 60 is recorded as a
legacy group -- it was never a decision, just the ENROLL token's timeout field
read as a gid and then made self-consistent.
Verified by mutation: storing fid 0 and accepting a partly-numeric id both fail
the suite. A third mutation did not: Lookup's own zero guard is unreachable
because Add is the only way an entry is created and it already refuses 0. The
guard stays as defence in depth for a future writer, and the test now asserts
the invariant that makes it unreachable -- no entry holds fid 0 however it was
created -- rather than leaving a branch that no test can reach.
Fingerprintd:Engine is the policy the trustlet cannot supply. It never polls
for a finger: the normal world captures a frame, decides whether a finger is
there, and tells it. So finger detection, edge reporting and the accounting all
live out here, and they are the parts most easily got wrong in a way that reads
as bad hardware.
Baseline refuses to be a fixed threshold. The capture metric is per frame, so
it scales with how many frames a capture asks for, and it drifts upward while
idle -- an early session read "18 -> 24 with a finger" as weak detection when
the values were climbing regardless of what was on the sensor. The floor is the
maximum of the idle samples, and an uncalibrated Baseline calls nothing a
finger rather than inventing a threshold.
TouchTracker keeps the two modes apart. Enrolment reports touch on the rising
edge and release on the falling one and nothing while held, mirroring stock,
whose entire enrolment trace contains no image-ready event; emitting one per
held frame feeds the algorithm near-duplicate images from a single press.
Authentication does want it, because event 7 reaches the matcher
unconditionally.
AuthTally exists to stop two counting mistakes. Only a terminal verdict is an
attempt -- counting rescan frames as rejections is what turned an 8-for-8 run
into an apparent 8-of-39. And a press that ran out of frames without reaching a
verdict is UNDECIDED, not failed; treating it as a failure is the same error one
level up, which is why decided presses are counted separately.
The tests replay the three recorded runs in order rather than as totals,
because press structure only exists in the order. That makes the per-press
claim re-derivable here instead of quoted: the enrolled finger matched on all
five presses although five of its twenty frames did not, the wrong-finger
control matched nothing, and on the stock-budget run five of ten presses
reached a verdict and all five matched.
Verified by mutation: counting undecided presses as decided, using a baseline
before calibration, emitting image-ready during enrolment, and taking the first
idle sample as the floor each fail the suite.
Fingerprintd:Rpmb is the other half of QTEE's storage. Where gpfile moves the
container bytes, RPMB is the anti-rollback: an authenticated, monotonically
counted area of the UFS device that lets QTEE tell a genuine store from an old
one replayed back at it. Framing and policy only; the SCSI transport stays in
the daemon shell.
The guard is the reason this module has tests rather than just constants.
req_resp 0x0001 is Authentication Key Programming, and the RPMB key is one-time
programmable in the UFS device -- relaying such a frame destroys that part's
RPMB permanently and no reflash recovers it. QTEE has no legitimate reason to
send one, so it is refused unconditionally, whatever the write policy says. It
is tested for scanning every frame rather than the first, and for refusing a
request that claims more frames than the buffer holds instead of reading past
the end.
The out-parameter at +0x08 is the field that failed every RPMB transaction for
a week. librpmb passes it by address, so it reports bytes transferred, and QTEE
compares it against what it expected and rejects the transaction on a mismatch.
A read posts one request frame however large nblocks is while a write posts
nblocks * 512, so the two directions genuinely do not report the same thing --
tested as such, because leaving the request's frame size there is the bug.
+0x0c is kept exactly as the request supplied it. QTEE looks for the response
frames at req + req[0x0c] and the request arrives with 0x18; librpmb's
hardcoded 20 points four bytes early.
Chunking refuses a remainder rather than following the reference, which
silently drops one -- a partial authenticated write leaves the store
inconsistent with a counter that cannot be moved back.
Verified by mutation: checking only the first frame for key programming,
reporting a flat frame size as bytes transferred, and admitting a remainder
each fail the suite.
