Getting the Broadcom ControlVault 3 fingerprint reader (0a5c:5843) working on Debian 13

Dell Latitude/Precision laptops ship a Broadcom BCM58200 fingerprint reader that libfprint does not support. Here is how I got it working on Debian 13 with the proprietary TOD driver, including the firmware upgrade gotcha. If you own a Dell Latitude or Precision from the last few years, chances are your fingerprint reader shows up in lsusb as: Bus 003 Device 008: ID 0a5c:5843 Broadcom Corp. BCM58200 ControlVault 3 (FingerPrint sensor + Contacted SmartCard) And chances are it does absolutely nothing on Linux. The usual recipe (apt install fprintd libpam-fprintd , then fprintd-enroll ) ends with: Impossible to enroll: GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice: No devices available This post documents how I got it working on Debian 13 (trixie) on a Dell Latitude 5431. The same procedure should apply to any Dell with the 0a5c:5843 reader (Latitude 5xxx/7xxx, Precision 3xxx/5xxx/7xxx) and to any Debian release, as long as you match the libfprint version. TL;DR - libfprint has no driver for this chip. The only working driver is Broadcom's proprietary blob, distributed by Canonical for Ubuntu OEM images. - That blob loads through TOD (Touch OEM Drivers), a libfprint extension that Ubuntu ships and Debian does not. - So you install the blob and its firmware, build libfprint with TOD support in the exact same version Debian ships, replace the system library, and put the package on hold. - On first start the driver flashes new firmware into the ControlVault and then fails once. Restart fprintd and it works. My setup | Item | Value | |---|---| | Laptop | Dell Latitude 5431 | | Reader | Broadcom BCM58200 ControlVault 3, USB 0a5c:5843 | | Actual sensor behind it | Goodix GF5288 (GF5288_GM188WNC_APP_10009 ) | | OS | Debian 13.7, kernel 6.12.x | | libfprint | 1:1.94.9-1 | Step 0: identify your reader Before doing anything, make sure you actually have this chip. Run: cat /etc/debian_version; uname -r lsusb dpkg -l | grep -i -E 'fprint|libfprint|pam-fprint' systemctl status fprintd --no-pager 2>&1 | head -5 sudo dmidecode -s system-product-name Depending on the vendor and product ID you will be in one of three situations: - Goodix (most recent ones), Synaptics 06cb:00xx , Elan, FPC: supported by upstream libfprint. Just installfprintd libpam-fprintd , enroll, and stop reading here. - Old Validity 138a:0090 /138a:0097 : needs the externalpython-validity driver. - Broadcom 0a5c:5843 : keep reading. Step 1: prerequisites You need source repositories enabled, because we are going to pull libfprint's build dependencies. Check: grep -rh -E '^(deb-src|Types:.deb-src)' /etc/apt/sources.list /etc/apt/sources.list.d/ If that prints nothing, on Debian 12+ with the deb822 format: sudo sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources sudo apt update Then check which libfprint version you have and confirm a matching +tod1 tag exists in the TOD fork: apt policy libfprint-2-2 | head -3 git ls-remote --tags https://gitlab.freedesktop.org/3v1n0/libfprint.git | grep tod1 | tail -8 On trixie the package is 1.94.9 , and the tag v1.94.9+tod1 exists. Use the tag that matches your installed package. The TOD fork tracks upstream releases, so there is almost always a matching tag. Step 2: install the driver, firmware and TOD-enabled libfprint Run the whole block as root (sudo -i ). It installs build dependencies, clones the proprietary driver from Canonical's Launchpad repo, builds libfprint with TOD, replaces the system library (keeping a backup) and puts the package on hold. Warning about set -e : if you paste this into an interactive root shell, the shell stays inset -e mode afterwards. The next command that returns non-zero (for example agrep with no match) will silently close your session. Run it as a script, or runset +e at the end. Ask me how I know. set -e export DEBIAN_FRONTEND=noninteractive apt build-dep -y libfprint-2-2 apt install -y git meson ninja-build build-essential TEMPDIR=$(mktemp -d); cd "$TEMPDIR" # 1. Proprietary Broadcom driver + firmware. # The ubuntu/latest branch ships the firmware for both CV3 and CV3+; older branches do not. git clone --depth=1 --branch ubuntu/latest https://git.launchpad.net/libfprint-2-tod1-broadcom cd libfprint-2-tod1-broadcom cp lib/udev/rules.d/60-libfprint-2-device-broadcom.rules /usr/lib/udev/rules.d/ mkdir -p /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1 cp usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod-1-broadcom.so /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/ mkdir -p /var/lib/fprint cp -r var/lib/fprint/fw /var/lib/fprint/ # 2. libfprint with TOD support. SAME version as the Debian package (1.94.9 on trixie). cd "$TEMPDIR" git clone --branch v1.94.9+tod1 --depth=1 https://gitlab.freedesktop.org/3v1n0/libfprint.git cd libfprint sed -i -e "/subdir('tests')/s/^/#/" -e "/subdir('examples')/s/^/#/" meson.build meson setup build --prefix=/usr -Ddoc=false meson compile -C build # 3. Install, keeping a backup of the original library. cp -n /usr/lib/x86_64-linux-gnu/libfprint-2.so.2 /root/libfprint-2.so.2.debian-orig cp build/libfprint/tod/libfprint-2-tod.so.1 /usr/lib/x86_64-linux-gnu/ ln -sf /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so.1 /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so cp build/libfprint/libfprint-2.so.2 /usr/lib/x86_64-linux-gnu/ ldconfig apt-mark hold libfprint-2-2 # 4. Run fprintd without its idle timeout. The Broadcom driver takes up to a minute # to initialise the first time, and fprintd would otherwise exit before it is ready. mkdir -p /etc/systemd/system/fprintd.service.d printf '[Service]\nExecStart=\nExecStart=/usr/libexec/fprintd --no-timeout\n' > /etc/systemd/system/fprintd.service.d/override.conf udevadm control --reload-rules udevadm trigger systemctl daemon-reload systemctl restart fprintd set +e The build takes a couple of minutes. No compiler errors on trixie with GCC 14 and Meson 1.7. A few notes on why it is done this way: - Why replace libfprint-2.so.2 instead of installing in parallel? fprintd from Debian is linked againstlibfprint-2.so.2 . The TOD fork builds a drop-in replacement with the same soname that additionally loads plugins fromlibfprint-2/tod-1/ . Replacing the file is the simplest way to make the stock fprintd pick it up. - Why the same version? The fork is upstream plus the TOD patches. If you build a newer version than the one Debian packaged, fprintd may hit ABI differences. Matching versions avoids surprises. - Why apt-mark hold ? The nextapt upgrade that toucheslibfprint-2-2 would overwrite your library and the reader would silently stop working. The hold makes that explicit. Step 3: the firmware upgrade gotcha This is the part that is not obvious from any of the guides I found. On its very first start with the driver, fprintd checks the ControlVault firmware against the files in /var/lib/fprint/fw/ and, if they are newer, flashes the chip. In my case it went from AAI 5.9.13.0 / SBI 137 to AAI 5.15.21.0 / SBI 240. You can watch it happen: sudo journalctl -u fprintd --no-pager -f fprintd[3866353]: Updating ControlVault firmware from 5.9.13.0 to 5.15.21.0 fprintd[3866353]: Event: FwUpgradeStarted fprintd[3866353]: Upgrade the SBI from 137 to 240, first clear SCD fprintd[3866353]: Writing /var/lib/fprint/fw/bcm_cv_clearscd.bin to flash ... fprintd[3866353]: Going to update the BCM with /var/lib/fprint/fw/bcmCitadel_7.otp fprintd[3866353]: Please wait, this takes about one minute fprintd[3866353]: Firmware Upgrade Complete ... fprintd[3866353]: Control Vault firmware upgrade successful fprintd[3866353]: Sensor type : 16 Sensor firmware version on device: GF5288_GM188WNC_APP_10009 length: 25 fprintd[3866353]: Sensor firmware versions in file and on device match fprintd[3866353]: Ignoring device due to initialization error: An unspecified error occurred! fprintd[3866353]: g_task_return_boolean: assertion 'G_IS_TASK (task)' failed That last error looks like a failure. It is not. The upgrade succeeded, but the device is left in a half-initialised state and fprintd gives up on it for this run. Just restart the service: sudo systemctl restart fprintd sleep 45 sudo journalctl -u fprintd --no-pager --since "-2min" fprintd-list $USER On the second start the log should say AAI version matches - it is up do date (sic) and fprintd-list should report: found 1 devices Device at /net/reactivated/Fprint/Device/0 Using device /net/reactivated/Fprint/Device/0 User xxxxxx has no fingers enrolled for Broadcom Sensors. If it still fails after a restart, do a full power off (systemctl poweroff , wait ten seconds, power on). The ControlVault is an independent security chip, and a warm reboot does not always reset it. Do not skip this if you are stuck; it is the difference between "broken" and "works" for several people in the Dell forums. Do not interrupt the firmware flash. Do not unplug the laptop or suspend it during that minute. Step 4: enroll and verify As your normal user, not root: fprintd-enroll -f right-index-finger # about 10 touches, ends with enroll-completed fprintd-enroll -f left-index-finger # enroll a second finger, you will thank yourself later fprintd-verify # should print verify-match fprintd-list $USER Useful extras: fprintd-delete $USER # remove all enrolled fingers for the user Step 5: enable it in PAM On Debian do not edit /etc/pam.d/ by hand. The libpam-fprintd package registers a profile, and you enable it with: sudo pam-auth-update Tick "Fingerprint authentication" and confirm. Then test in a second terminal, keeping the first one open in case something goes wrong: sudo -k sudo true It should ask for your finger instead of the password. If the finger fails or you do nothing, it falls back to the password after a few seconds, so you cannot lock yourself out. The same change covers the lock screen and the display manager (GDM, SDDM, LightDM). Some desktops need a logout to pick it up. Maintenance When Debian updates libfprint (a point release, or when you upgrade to the next stable): sudo apt-mark u