- C++ 88.6%
- Shell 11.4%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
Jorijn van der Graaf
dff77110ef
Fingerprintd:Engine is the policy the trustlet cannot supply. It never polls for a finger: the normal world captures a frame, decides whether a finger is there, and tells it. So finger detection, edge reporting and the accounting all live out here, and they are the parts most easily got wrong in a way that reads as bad hardware. Baseline refuses to be a fixed threshold. The capture metric is per frame, so it scales with how many frames a capture asks for, and it drifts upward while idle -- an early session read "18 -> 24 with a finger" as weak detection when the values were climbing regardless of what was on the sensor. The floor is the maximum of the idle samples, and an uncalibrated Baseline calls nothing a finger rather than inventing a threshold. TouchTracker keeps the two modes apart. Enrolment reports touch on the rising edge and release on the falling one and nothing while held, mirroring stock, whose entire enrolment trace contains no image-ready event; emitting one per held frame feeds the algorithm near-duplicate images from a single press. Authentication does want it, because event 7 reaches the matcher unconditionally. AuthTally exists to stop two counting mistakes. Only a terminal verdict is an attempt -- counting rescan frames as rejections is what turned an 8-for-8 run into an apparent 8-of-39. And a press that ran out of frames without reaching a verdict is UNDECIDED, not failed; treating it as a failure is the same error one level up, which is why decided presses are counted separately. The tests replay the three recorded runs in order rather than as totals, because press structure only exists in the order. That makes the per-press claim re-derivable here instead of quoted: the enrolled finger matched on all five presses although five of its twenty frames did not, the wrong-finger control matched nothing, and on the stock-budget run five of ten presses reached a verdict and all five matched. Verified by mutation: counting undecided presses as decided, using a baseline before calibration, emitting image-ready during enrolment, and taking the first idle sample as the floor each fail the suite. |
||
| implementations | ||
| interfaces | ||
| tests | ||
| .gitignore | ||
| LICENSE | ||
| lint-rules.h | ||
| project.cpp | ||
| README.md | ||
fingerprintd
Fingerprint daemon for the Fairphone 6 (milos, SM7635) on mainline Linux.
Why a daemon
The sensor is a FocalTech FT9391 on a TrustZone-owned SPI bus. spi@a88000 is
disabled in both the mainline and the stock Android device tree, and the pads
are XPU-protected — touching them from the normal world is an instant SError
reboot. Every pixel the sensor produces stays inside the TEE: capture,
preprocessing, the classifier, enrolment and matching all run in the focal64
trustlet, which reports a matched finger id and nothing else. A libfprint-style
driver cannot exist on this device.
So the normal world's job is narrower than usual, and none of it is per-request work:
- Power the sensor. Rail on gpio29, reset on gpio74, interrupt on gpio75 — the same division of labour the downstream driver uses. One sensor reset buys exactly one trustlet init, so whatever powers the sensor must also hold the session open.
- Be QTEE's filesystem. QTEE cannot reach storage. When the trustlet saves
or loads a template it calls back into the normal world through the
gpfile(0x7000) and RPMB (0x2000) listeners, and expects them served. QTEE does the crypto and the anti-rollback; this side moves opaque bytes and performs the authenticated RPMB transactions against the UFS device. - Speak a biometrics API. The daemon owns
net.reactivated.Fprint, sopam_fprintd, the Plasma fingerprint KCM andfprintd-enroll(1)work against it unmodified.
A listener registration is held for as long as the process lives and QTEE's listener table is global to the boot, so this has to be one long-lived process rather than a tool spawned per request.
Layout
interfaces/ Fingerprintd{,-Sfs}.cppm the core: pure C++ modules
implementations/main.cpp the daemon shell
tests/ one suite per core module
fingerprintd-core is a static library with no GLib, no libqcomtee and no
system headers. Everything in it is a wire format or a state machine that was
recovered by reverse-engineering, so all of it is pinned by tests that run on a
dev box with no phone, no TEE and no sensor. The daemon shell holds everything
that touches hardware.
Build
crafter-build # bin/fingerprintd-<target>-<march>/fingerprintd
crafter-build test # the unit suites
Cross-compiling for the phone:
crafter-build -- --target=aarch64-alpine-linux-musl \
--sysroot=<alpine-aarch64-sysroot> --march=armv8-a --mtune=generic
crafter-build test --target=aarch64-alpine-linux-musl
Status
Early. The core is being ported one wire format at a time out of the research
harness that first made the sensor work (utilities/fpta.c in the fp6 repo),
each piece landing with tests before the next starts. Fingerprintd:Sfs — the
gpfile frame — is done. The daemon itself does not run yet.
The working reference enrols a finger, keeps it across a reboot, and matches it with zero false accepts; the port exists to turn that into a service rather than to rediscover it.
Runtime dependencies, not carried here
The focal64 trustlet is proprietary and is not in this repo. It is
extracted from the device's own stock Android partition on first boot by the
fp6-vendor-blobs mechanism, the same way the audio firmware is.