Bug 94536

Summary: 138a:0090 Validity Sensor not recognized
Product: libfprint Reporter: Marc-Antoine Perennou <Marc-Antoine>
Component: libfprintAssignee: libfprint-bugs
Status: RESOLVED MOVED QA Contact:
Severity: enhancement    
Priority: high CC: 1e6c1446-1f45-11e7-bc1c-5f6920a7be5d, acfoltzer, agurenko, akalongman, albflo, alexanderad, alvenca, andr3asgr, anssi, ariel.zelivans, arved, AxelMKlein, bernie, bijan, brandon.dimcheff+freedesktop, brunoabinader, c, christian, codronm+circlecode, det, dtolnay, edmund.laugasson, fake.ae, felipe.abella, fred, freedesktopbugs, freedesktop-bugzilla, freedesktop-bugzilla, freedesktop, freedesktop, geiger.mario, genio10, grb19, gregoire, haaner87, hindsn, i, iliyabo, itay.ariely, jacob.b.bailey, j, jelmer, jlj.babydragon, jmc, kaon, madstitz, mail, mail, mail, mapreri, marcelo.fidel.fernandez, Marcel.Waldvogel, markus.duft, me, michel.kern20, mike, mirec.z, mozello, naktinis, nelg, nemecek, nikolas.hermann, nils-anders, njlmerchant, pahan, paveld, pavel, piskoule, pokorny_jan, rb6, richip, semtlenori, serge, steven.nfd+fdb, sven.liefgen, tagliola, tarkasteve, tibbs, tom, uzytkownik2, v.astafiev, voyageur, yaroslav.isakov, yzhou61, zdenek.zikan
Version: unspecified   
Hardware: Other   
OS: All   
See Also: https://bugs.freedesktop.org/show_bug.cgi?id=99462
Whiteboard:
i915 platform: i915 features:
Attachments: Sniffing usmon logs when doing some operations in a VirtualBOX WIN10 machine

Description Marc-Antoine Perennou 2016-03-14 17:29:41 UTC
Not sure what info are needed/useful

Output from lsusb:

Bus 001 Device 005: ID 138a:0090 Validity Sensors, Inc. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass        16 
  bDeviceProtocol       255 
  bMaxPacketSize0         8
  idVendor           0x138a Validity Sensors, Inc.
  idProduct          0x0090 
  bcdDevice            1.64
  iManufacturer           0 
  iProduct                0 
  iSerial                 1 d9e880d9447e
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           53
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower              100mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           5
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass      0 
      bInterfaceProtocol      0 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval               4
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval              10
Device Status:     0x0000
  (Bus Powered)
Comment 1 Marco Trevisan (Treviño) 2016-05-04 15:22:17 UTC
Created attachment 123459 [details]
Sniffing usmon logs when doing some operations in a VirtualBOX WIN10 machine

This sensor seems to be quite different form the others shipped in the past.
I've been able to use it from a Windows 10 virtual machine running in virtualbox, after installing the Synaptics drivers (I've used the ones provided in the lenovo website for ThinkPad T460s/T460p).

After sniffing the traffinc with usbmon or wireshark, I can't see any re-usable pattern. However I'm attaching here the logs I've taken.

Basically the operations I've done are:
 1. Enabling fingerprint recognition in Window 10
 2. Performing the recognition of the same finger (8 steps)
 3. Locking the machine
 4. Unlocking it with the fingerprint
 5. Add an extra finger to use, but causing recognition errors
 6. Remove fingerprint recognition from the machine
 7. Enabling it again scanning again a finger (not logged)
 8. Lock and Unlock again with new recognized finger

Not sure if someone could get any good info from this.
I guess we should find a way to get Synaptics involved by providing specs.
Comment 2 Marco Trevisan (Treviño) 2016-05-04 15:40:17 UTC
(In reply to Marco Trevisan (Treviño) from comment #1)
> After sniffing the traffinc with usbmon or wireshark, I can't see any
> re-usable pattern.

Of course, excluding the 0x17 0x03 header followed by two bytes containing the payload size. But all the rest seems not to follow a precise rule (as it doesn't either repeat in similar operations, so I guess there's some obfuscation involved).
Comment 3 Vasily Khoruzhick 2016-05-09 17:27:58 UTC
(In reply to Marco Trevisan (Treviño) from comment #2)
> (In reply to Marco Trevisan (Treviño) from comment #1)
> > After sniffing the traffinc with usbmon or wireshark, I can't see any
> > re-usable pattern.
> 
> Of course, excluding the 0x17 0x03 header followed by two bytes containing
> the payload size. But all the rest seems not to follow a precise rule (as it
> doesn't either repeat in similar operations, so I guess there's some
> obfuscation involved).

Probably traffic is encrypted. In this case it's impossible to implement libfprint driver without disassembling Windows driver or getting documentation from Validity.
Comment 4 Pavel Sokolov 2016-06-06 21:09:02 UTC
I have Lenovo Thinkpad X1 Yoga with "138a:0090" fingerprint reader and it also not works.
Comment 5 Vasily Khoruzhick 2016-06-08 00:47:42 UTC
Sorry guys, but I don't have this device. And even if I had it, I'm not sure what can be done if traffic is encrypted. I tried to contact Synaptics (they acquired Validity not a while ago), but so far I have gotten no response.
Comment 6 Alexander 2016-06-13 09:21:38 UTC
This sensor is used at new 4th generation ThinkPad Carbon X1.
Comment 7 Bijan Chokoufe Nejad 2016-06-13 15:22:34 UTC
I think this device is part of all new Thinkpads, also the T-series. I really hope that we will get some support from Lenovo/Synaptic as it doesn't seem to be easily reverse engineerable. Maybe someone knows someone.
Comment 8 Guilherme Rito 2016-06-15 10:54:02 UTC
I also have the same issue, with thinkpad X1 Yoga.
Comment 9 Jason Tibbitts 2016-06-15 17:15:26 UTC
I'm wondering if this item is available in a standalone reader.  If so I would be willing to buy one (or more) and send it/them to whoever might be interested in working on this.

If just having the actual part would be useful, I could see if I can get one from Lenovo's part department or some other supplier.
Comment 10 Jason Tibbitts 2016-06-15 17:53:49 UTC
BTW, I believe it's Lenovo/IBM part 00JT817 which I can actually order for $30.  But figuring out which cable goes with it is rather more difficult.
Comment 11 Vasily Khoruzhick 2016-06-15 17:57:42 UTC
(In reply to Jason Tibbitts from comment #10)
> BTW, I believe it's Lenovo/IBM part 00JT817 which I can actually order for
> $30.  But figuring out which cable goes with it is rather more difficult.

Usually it's USB 2.0 HSIC (high speed inter-chip) device, it has different signal levels, so it's impossible to connect it to generic USB port.

So Lenovo part is useless without special adapter which I don't have.
Comment 12 Jason Tibbitts 2016-06-15 18:14:49 UTC
I'm searching for said special adaptor, but I've not worked with this before so it's tough to be sure I'd have the right thing.  If you know of an adaptor which would work, please let me know.
Comment 13 Jason Tibbitts 2016-06-15 21:05:27 UTC
Maybe the USB3505 board?

https://www.element14.com/community/docs/DOC-70253/l/usb3503-hsic-to-usb-20-mobile-hub-evaluation-board

$106 isn't free, but I'm still willing to buy one and ship it if it would actually help.  This doesn't take care of physical cabling, of course, and I don't know if you can just manually wire it.  Or even if anyone actually wants to work on it.

Sadly, I can't just send along a whole laptop.  I would if I could get a laptop with this device for under $500, which I doubt is possible.
Comment 14 Vasily Khoruzhick 2016-06-15 22:43:08 UTC
(In reply to Jason Tibbitts from comment #13)
> Maybe the USB3505 board?
> 
> https://www.element14.com/community/docs/DOC-70253/l/usb3503-hsic-to-usb-20-
> mobile-hub-evaluation-board
> 
> $106 isn't free, but I'm still willing to buy one and ship it if it would
> actually help.  This doesn't take care of physical cabling, of course, and I
> don't know if you can just manually wire it.  Or even if anyone actually
> wants to work on it.
> 
> Sadly, I can't just send along a whole laptop.  I would if I could get a
> laptop with this device for under $500, which I doubt is possible.

I would buy it if there were any specs for this Validity device. Apparently traffic is encrypted so it's not possible to reverse engineer it without disassembling Windows driver.
Comment 15 grb19 2016-06-17 15:08:03 UTC
No idea, whether this will help, but at least asking doesn't hurt:

https://forums.lenovo.com/t5/ThinkPad-X-Series-Laptops/Validity-Fingerprint-Reader-Linux/td-p/3352145
Comment 16 Christope 2016-07-28 21:27:04 UTC
Some people say that they got it working: https://github.com/maffmeier/fprint_vfs5011
Comment 17 Christope 2016-07-28 21:55:20 UTC
> Some people say that they got it working: https://github.com/maffmeier/fprint_vfs5011

Not the right product number—sorry.
Comment 18 Markus Duft 2016-08-23 08:04:35 UTC
I have a P50 with this reader - if I can provide any helpful information (dumps, etc.) please let me know what and how :) I'd love to have this device supported.
Comment 19 Marco Trevisan (Treviño) 2016-09-12 11:46:25 UTC
So... 

I've been in touch with people that has contacts with Synaptics internals and basically they said that they can't disclose the protocol for this generation of devices. While they try to improve the thing for future devices, they're, at least, working to make a binary driver available.

No ETA known, though.
Comment 20 Glen Ogilvie 2016-11-10 22:53:34 UTC
I also have this sensor, and would like it to work on Linux.  Any update from the manufacturer?
Comment 21 Marco Trevisan (Treviño) 2016-11-18 23:49:40 UTC
Still no update from synaptics :-(
Comment 22 Kartheeswaran 2016-12-27 19:25:04 UTC
I have Lenovo Ideapad Flex 4, has finger print reader 0138a:0094.


Please let me know if we do have nay update from vendor.
Comment 23 naktinis 2016-12-27 19:49:59 UTC
Also, please let us know if anyone has an appropriate contact email at Synaptics/Validity Sensors that could accept this sort of feedback.
Comment 24 Marco Trevisan (Treviño) 2016-12-27 23:03:55 UTC
(In reply to naktinis from comment #23)
> Also, please let us know if anyone has an appropriate contact email at
> Synaptics/Validity Sensors that could accept this sort of feedback.

Unfortunately I've not direct contact with synapitcs, I only asked to the synaptics xorg driver who asked again to his internal contacts.
Comment 25 Avtandil Kikabidze 2017-01-22 21:53:50 UTC
No news about this bug?
Comment 26 Edmund Laugasson 2017-01-22 22:45:45 UTC
Discussion is going here - https://forums.lenovo.com/t5/Linux-Discussion/Validity-Fingerprint-Reader-Linux/td-p/3352145
Comment 27 Vasily Khoruzhick 2017-01-22 23:11:29 UTC
(In reply to Avtandil Kikabidze from comment #25)
> No news about this bug?

If Synaptics is willing to provide specs and hardware, I can develop the driver.
Comment 28 Lukas.Spies 2017-01-23 19:26:03 UTC
Seems like somebody started working on a driver here: https://github.com/nmikhailov/Validity90
Comment 29 ken 2017-01-30 02:12:18 UTC
Willing to donate some money.  Is something set up to receive money?
Comment 30 Vasily Khoruzhick 2017-01-30 06:12:14 UTC
(In reply to ken from comment #29)
> Willing to donate some money.  Is something set up to receive money?

You could try to contact Nikita who's doing driver development for subj device: https://github.com/nmikhailov
As for me, I'm in good standing and doing libfprint development for fun, not for money. Though I'd accept standalone fingerprint scanners that aren't supported by libfprint. No laptops please.
Comment 31 Ilia Bozhinov 2017-02-04 07:29:38 UTC
Just as #22 I have a lenovo yoga 510 with 138a:0094, should I open a new bug or Synaptics will resolve the issue for both devices(0090 and 0094)?
Comment 32 ken 2017-02-04 22:17:53 UTC
Re #30: Is there a standalone fingerprint reader that uses a Validity Sensor 138a:0090?

Or is there a wishlist of devices you'd prefer Vasily Khoruzhick?
Comment 33 mozello 2017-03-11 12:54:06 UTC
(In reply to Ilia Bozhinov from comment #31)
> Just as #22 I have a lenovo yoga 510 with 138a:0094, should I open a new bug
> or Synaptics will resolve the issue for both devices(0090 and 0094)?
Hi all! Lenovo 710s plus - 138a:0094 doesn't work too. Is there any progress?
Comment 34 Ariel Zelivansky 2017-05-15 20:47:36 UTC
Joining the issue with Lenovo T470p. The sensor is 138a:0097.
Comment 35 Marco Trevisan (Treviño) 2017-06-04 15:05:33 UTC
Nikita Mikhailov got some got some great results in his protoype [1] (I've been able to scan an image of my fingerprint in my ThinkPad T460s, while it fails in my T460p).

So please, test the prototype.
Also, it would be appreciated to get dumps (taken with a virtual machine running Windows 10), especially from those who never ran Windows or, never initialized the fingerprint reader in there. In that case it would be great to have logs since of the whole VM live (installation included), so that we can catch if anything special happens.

Join the conversation in gitter [2], for further informations.

[1] https://github.com/nmikhailov/Validity90
[2] https://gitter.im/Validity90/Lobby
Comment 36 Markus Duft 2017-10-18 08:10:30 UTC
Lenovo P50 has the same sensor:

Bus 001 Device 003: ID 138a:0090 Validity Sensors, Inc. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass        16 
  bDeviceProtocol       255 
  bMaxPacketSize0         8
  idVendor           0x138a Validity Sensors, Inc.
  idProduct          0x0090 
  bcdDevice            1.64
  iManufacturer           0 
  iProduct                0 
  iSerial                 1 c73888265432
  bNumConfigurations      1
...
Comment 37 twj 2017-12-28 04:52:13 UTC
Joining the issue with Lenovo T470. The sensor is 138a:0097.
Comment 38 Gurenko Alex 2018-01-10 08:39:39 UTC
Joining the issue with Lenovo T460p.
Comment 39 Mark Harfouche 2018-03-05 21:50:42 UTC
Hi guys,

I kinda got a python script that works on my machine to get pictures of fingerprints.

I'll likely need testers soon to see how it works on different computers:

https://github.com/hmaarrfk/Validity91

Hopefully this sheds some light on the sensor.
Comment 40 Markus Duft 2018-03-06 06:53:30 UTC
Likely more interesting for this bug is https://github.com/nmikhailov/Validity90, which I discovered when looking into your link :)

With the prototype in there I was able to get the sensor in my Lenovo P50 to respond. Looks like there is also some work going on there to create a libfprint driver, which sounds really promising! Thanks!
Comment 41 Markus Duft 2018-03-06 06:59:57 UTC
Owh, missed that this was shared a while ago :)
Comment 42 Marco Trevisan (Treviño) 2018-03-09 11:16:24 UTC
Speaking of libfprint driver, for this specific sensor (1380a:0090) there's already one up and running since some weeks, which I wrote based on Nikita's prototype plus some tunings.

Code is at (packages for Arch and Ubuntu available check README):
 - https://github.com/3v1n0/libfprint

Sensor specific code needs still some tuning, and it's still using libfprint's image comparison. However, changing the driver to use internal fingerprint checks is possible and planned, but there's still some reverse-engineering going to achieve that (in the mean time I've already a driver in the works using basic device).
Comment 43 Marco Trevisan (Treviño) 2018-03-09 11:20:33 UTC
Ah, and yes... That driver will work on newer sensors such as 138a:0091 too.
Comment 44 Kai Mast 2018-03-16 18:25:10 UTC
Hi Marco.

First, thanks a lot for working on this!

I get the following error when I try to use fprint-enroll. 

$> fprintd-enroll 
Using device /net/reactivated/Fprint/Device/0
failed to claim device: Message recipient disconnected from message bus without replying
$> sudo -H fprintd-enroll 
Using device /net/reactivated/Fprint/Device/0
failed to claim device: Open failed with error -5

fprint_demo works until I start to try to scan my finger, when it crashes.

Any idea what I might be doing wrong? The logs of fprintd are not really helpful...

Thanks,
Kai
Comment 45 Bernie Innocenti 2018-04-20 06:49:28 UTC
Has anyone tried with the Validity 138a:0097 product?
I have one of these in a Lenovo Carbon X1 gen 5.
Comment 46 Jason Tibbitts 2018-04-20 15:15:36 UTC
There is a hacked libfprint fork which will authenticate from 138a:0097 sensors, but you must enroll the fingerprints in Windows.  That sensor is match-on-device only; it cannot return a fingerprint image at all.  And the fingerprint enrollment process has not yet been successfully reverse-engineered.

https://github.com/hrenod/libfprint
Comment 47 Jason Tibbitts 2018-04-20 15:21:09 UTC
I should add that the instructions in that fork haven't been changed much from the original 0090 repo, so don't read it and assume that everything there is true for the 0097 device.  It's slightly confusing but it's really just a hack to get something working.  I haven't tried it myself.
Comment 48 GitLab Migration User 2018-05-31 08:56:15 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/libfprint/libfprint/issues/54.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.