Skip to content
Blog

Yoga 9 14IAP7 Fingerprint Reader

The laptop which I use at work is a Yoga 9 14IAP7 with a Goodix 27c6:550c fingerprint reader. Unfortunately, there are no publicly available drivers to get this thing working on Linux (openSUSE Tumbleweed). The official libfprint does not support this particular sensor (likely because of the encrypted TLS-PSK link). Anyway, some [nice dude](brianporeilly/goodix-550c-driver](https://github.com/brianporeilly/goodix-550c-driver) developed a driver for this chip which got built into libfrprint v1.94.10. As that version is not available on Tumbleweed (yet), here follows a how-to guide to get this sensor working. Just execute those commands; trust me bro!

Prerequisites

lsusb | grep 27c6:550c          # sensor present, no driver bound
sudo zypper in meson ninja gcc-c++ glib2-devel libgusb-devel libopenssl-3-devel opencv-devel innoextract git fprintd fprintd-pam
rpm -q libfprint-2-2            # note the version; build against the same libfprint tag

Build the driver

Let's start by cloning the driver and libfprint:

W=~/src/goodix550c && mkdir -p $W && cd $W	# adjust to whatevery your working dir is
git clone https://github.com/brianporeilly/goodix-550c-driver.git driver
git clone --depth 1 --branch v1.94.10 https://gitlab.freedesktop.org/libfprint/libfprint.git libfprint

Essentially the same instructions as in the driver's install.sh script:

mkdir -p libfprint/libfprint/drivers/goodix53x5 libfprint/libfprint/sigfm
cp driver/drivers/goodix53x5/* libfprint/libfprint/drivers/goodix53x5/
cp driver/sigfm/*              libfprint/libfprint/sigfm/
patch -d libfprint -p1 < driver/meson-integration.patch

Build that thing:

```sh
meson setup libfprint/builddir libfprint --prefix=/usr/local --libdir=lib64 \
  -Ddrivers=goodix53x5 -Dudev_hwdb=disabled -Dudev_rules=disabled \
  -Dintrospection=false -Dinstalled-tests=false -Ddoc=false
ninja -C libfprint/builddir

libfprint/builddir/libfprint/fprint-list-supported-devices | grep 550c   # must list 27c6:550c

Now extract the firmware:

mkdir -p $W/fw
python3 -I $W/driver/tools/extract-firmware.py --download -o $W/fw/550c-app.bin

The script downloads Lenovo's installer and checks it against Lenovo's published SHA-256. It then unpacks the installer with innoextract and rebuilds the image. Expected result: 23436 bytes, sha256 7a230f035b09e07a243bf7dd8c5055c8c8e8faf85dc102fd6c4f7b6249da6e8c.

Install the library

Install it to /usr/local/lib64. That directory is in /etc/ld.so.conf and is searched before /usr/lib64, so the library overrides the rpm without touching it.

sudo install -Dm755 $W/libfprint/builddir/libfprint/libfprint-2.so.2.0.0 /usr/local/lib64/libfprint-2.so.2.0.0
sudo ldconfig
sudo systemctl stop fprintd

ldd /usr/libexec/fprintd | grep fprint    # -> /usr/local/lib64/libfprint-2.so.2
fprintd-list $USER                        # -> "Goodix HTK32 Fingerprint Sensor"

Reflash the sensor and enjoy

Keep the laptop on AC power and don't suspend it during this step. Good luck!

sudo install -Dm644 $W/fw/550c-app.bin /etc/goodix550c-app.bin   # this arms the reflash
fprintd-enroll $USER        # expected to FAIL with "device removed / please retry"
journalctl -u fprintd --since -5min | grep Self-heal

A successful run logs this sequence:

Self-heal: device firmware 'GF5288_GM168SEC_APP_13021'
Self-heal: erasing app to enter IAP
Self-heal: device firmware 'MILAN_GM168SEC_IAP_10007'
Self-heal: writing PSK container (chunk 1/2) ... (chunk 2/2)
Self-heal: reflashing app firmware (23436 bytes)
Self-heal: PSK committed; resetting into app
Self-heal: sensor reprovisioned to the all-zero PSK and re-enumerated on the USB bus

Now it's time for the moment of truth; enroll yourself and verify afterwards:

sudo systemctl restart fprintd    # drop the stale, re-enumerated device
fprintd-enroll $USER              # 8-16 touches; shift the finger a little each time
fprintd-verify $USER

Enable login and sudo

This step is optional, but without your new fingerprint sensor doesn't make a lot of sense:

sudo pam-config -a --fprintd

On the GNOME lock screen, also turn on fingerprint login in Settings → Users. pam_fprintd falls back to the password after a timeout or failed reads. After this step, you're good to go!

Updating

Any distro update (that touches libfprint or fprintd) will overwrite the library. Run following to restore:

rpm -q libfprint-2-2 fprintd
ldd /usr/libexec/fprintd | grep fprint
fprintd-list $USER

In the case of an driver or libfprint update, rebuild from a fresh libfprint tree, because the meson patch only applies once.

cd $W
git -C driver pull
rm -rf libfprint
git clone --depth 1 --branch v<LIBFPRINT_VERSION> https://gitlab.freedesktop.org/libfprint/libfprint.git libfprint
# then repeat the copy/patch/meson/ninja block from step 2 and the install block from step 4
sudo systemctl restart fprintd

The reflash does not run again. The driver reads the sensor's key hash, sees the all-zero key, and skips it. Leave /etc/goodix550c-app.bin in place. If a driver update changes the expected firmware hash, redo step 3.