Jorijn van der Graaf
a91fb2ff58
fingerprintd's own code now talks to QTEE. On the phone:
root object on /dev/tee0
client env obtained (uid 0, 13-byte credentials)
QSEECOM-compat app loader (UID 122) opened
The credentials object is ours rather than libqcomtee's. Upstream's exists only
to build a thirteen-byte CBOR map and drags in QCBOR to do it, so
packaging/make-libqcomtee.sh compiles the two sources that matter and drops
credentials_obj.c entirely -- nothing else references it, and the library then
has no dependency beyond libc. The map is built in Fingerprintd:Tee where it is
pinned byte-for-byte against the string verified on-device, and the object's
two-op read protocol is served here.
Three interop details, all of which cost a build cycle:
* libqcomtee's headers carry no extern "C" guard, having only ever been
consumed from C, so everything came out C++-mangled. They also pull in
<stdatomic.h> and <stdio.h>, which under libc++ drag in templates that may
not appear inside extern "C" -- so those are included first.
* tee_call_t's second parameter is unsigned long on glibc and int on musl.
The native build is glibc and the phone is musl; both forms are compiled.
* On the callback path a UBUF_OUTPUT param arrives with addr = NULL. The
dispatcher supplies the buffer, so a handler POINTS the param at its own
storage rather than writing through the incoming address. Doing the latter
is a null dereference that takes the supplicant thread with it, which is
how the first run against real QTEE ended -- with the correct behaviour
already spelled out in the module comment above the code that ignored it.
That comment now says so in as many words.
20 lines
707 B
C++
20 lines
707 B
C++
// SPDX-License-Identifier: GPL-3.0-only
|
|
// SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
|
|
|
/*
|
|
fingerprintd — fingerprint daemon for the Fairphone 6 on mainline Linux.
|
|
|
|
The sensor is a FocalTech FT9391 on a TrustZone-owned SPI bus: the normal world
|
|
cannot reach it, and raw frames never leave the TEE. All capture, enrolment and
|
|
matching happen inside the focal64 trustlet. This daemon owns the sensor rail,
|
|
holds the QTEE session open, serves the storage callbacks QTEE makes back into
|
|
the normal world, and reports the matched finger id.
|
|
*/
|
|
|
|
export module Fingerprintd;
|
|
export import :Sfs;
|
|
export import :Rpmb;
|
|
export import :Ta;
|
|
export import :Engine;
|
|
export import :Store;
|
|
export import :Tee;
|