Jorijn van der Graaf
1d26852a6b
fingerprintd will own the FP6's fingerprint sensor: the rail, the QTEE session, the storage callbacks QTEE makes back into the normal world, and net.reactivated.Fprint so pam_fprintd and the desktop need no changes. None of that runs yet. What is here is the first core module and the machinery around it. Fingerprintd:Sfs is the gpfile listener's frame -- the callback that carries 47 of 66 storage requests during an enrolment. It is parse, reply and root mapping only: no file I/O, no TEE, no allocation of the shared buffer. The daemon shell supplies those, which is what lets every byte-level decision be tested on a dev box with no phone. The module exists mainly to hold one fact. READ answers at req+0x00c and WRITE reads its payload from req+0x110, because the frame is a union: a WRITE still needs its path while the payload is copied out, so it sits past the 256-byte path field, while a READ has consumed the path and packs its reply over it. Conflating them is wrong in both directions with the same symptom -- the container does not round-trip, QTEE's HMAC check fails, and the file is unlinked as tampered on the next session. So the tests do not assert the constants against themselves. They load two real containers off the phone -- one written correctly, one written with the offsets conflated -- and re-derive the bug: the broken one opens with ASCII path text rather than a binary HMAC, that text is the group name from character 8 because the read offset is 8 bytes into the path field, and the real container sits exactly 0x104 further in. Then a write-store-read round trip must be the identity, and the same round trip through a single offset must not be. O_TRUNC gets a static_assert of its own. QTEE writes a container as write(0,4096), write(4096,N), write(0,4096), so truncating on open leaves 4096 bytes where a 258850-byte template belongs; it unlinks a file it means to shorten rather than relying on the opener. Verified by mutation: conflating the offsets, making DataOffset return the read offset for writes, and setting O_TRUNC each fail the suite.
79 lines
3.3 KiB
Markdown
79 lines
3.3 KiB
Markdown
# fingerprintd
|
|
|
|
Fingerprint daemon for the Fairphone 6 (`milos`, SM7635) on mainline Linux.
|
|
|
|
## Why a daemon
|
|
|
|
The sensor is a FocalTech FT9391 on a TrustZone-owned SPI bus. `spi@a88000` is
|
|
`disabled` in both the mainline and the stock Android device tree, and the pads
|
|
are XPU-protected — touching them from the normal world is an instant SError
|
|
reboot. Every pixel the sensor produces stays inside the TEE: capture,
|
|
preprocessing, the classifier, enrolment and matching all run in the `focal64`
|
|
trustlet, which reports a matched finger id and nothing else. A libfprint-style
|
|
driver cannot exist on this device.
|
|
|
|
So the normal world's job is narrower than usual, and none of it is per-request
|
|
work:
|
|
|
|
* **Power the sensor.** Rail on gpio29, reset on gpio74, interrupt on gpio75 —
|
|
the same division of labour the downstream driver uses. One sensor reset buys
|
|
exactly one trustlet init, so whatever powers the sensor must also hold the
|
|
session open.
|
|
* **Be QTEE's filesystem.** QTEE cannot reach storage. When the trustlet saves
|
|
or loads a template it calls back into the normal world through the `gpfile`
|
|
(0x7000) and RPMB (0x2000) listeners, and expects them served. QTEE does the
|
|
crypto and the anti-rollback; this side moves opaque bytes and performs the
|
|
authenticated RPMB transactions against the UFS device.
|
|
* **Speak a biometrics API.** The daemon owns `net.reactivated.Fprint`, so
|
|
`pam_fprintd`, the Plasma fingerprint KCM and `fprintd-enroll(1)` work
|
|
against it unmodified.
|
|
|
|
A listener registration is held for as long as the process lives and QTEE's
|
|
listener table is global to the boot, so this has to be one long-lived process
|
|
rather than a tool spawned per request.
|
|
|
|
## Layout
|
|
|
|
```
|
|
interfaces/ Fingerprintd{,-Sfs}.cppm the core: pure C++ modules
|
|
implementations/main.cpp the daemon shell
|
|
tests/ one suite per core module
|
|
```
|
|
|
|
`fingerprintd-core` is a static library with no GLib, no libqcomtee and no
|
|
system headers. Everything in it is a wire format or a state machine that was
|
|
recovered by reverse-engineering, so all of it is pinned by tests that run on a
|
|
dev box with no phone, no TEE and no sensor. The daemon shell holds everything
|
|
that touches hardware.
|
|
|
|
## Build
|
|
|
|
```sh
|
|
crafter-build # bin/fingerprintd-<target>-<march>/fingerprintd
|
|
crafter-build test # the unit suites
|
|
```
|
|
|
|
Cross-compiling for the phone:
|
|
|
|
```sh
|
|
crafter-build -- --target=aarch64-alpine-linux-musl \
|
|
--sysroot=<alpine-aarch64-sysroot> --march=armv8-a --mtune=generic
|
|
crafter-build test --target=aarch64-alpine-linux-musl
|
|
```
|
|
|
|
## Status
|
|
|
|
Early. The core is being ported one wire format at a time out of the research
|
|
harness that first made the sensor work (`utilities/fpta.c` in the fp6 repo),
|
|
each piece landing with tests before the next starts. `Fingerprintd:Sfs` — the
|
|
gpfile frame — is done. The daemon itself does not run yet.
|
|
|
|
The working reference enrols a finger, keeps it across a reboot, and matches it
|
|
with zero false accepts; the port exists to turn that into a service rather
|
|
than to rediscover it.
|
|
|
|
## Runtime dependencies, not carried here
|
|
|
|
The `focal64` trustlet is proprietary and is **not** in this repo. It is
|
|
extracted from the device's own stock Android partition on first boot by the
|
|
`fp6-vendor-blobs` mechanism, the same way the audio firmware is.
|