DEV Community

Cover image for Getting the Broadcom ControlVault 3 fingerprint reader (0a5c:5843) working on Debian 13
Fran Quinto
Fran Quinto

Posted on

Getting the Broadcom ControlVault 3 fingerprint reader (0a5c:5843) working on Debian 13

#linux #debian #dell #tutorial

Dell Latitude/Precision laptops ship a Broadcom BCM58200 fingerprint reader that libfprint does not support. Here is how I got it working on Debian 13 with the proprietary TOD driver, including the firmware upgrade gotcha.

If you own a Dell Latitude or Precision from the last few years, chances are your fingerprint reader shows up in lsusb as:

Bus 003 Device 008: ID 0a5c:5843 Broadcom Corp. BCM58200 ControlVault 3 (FingerPrint sensor + Contacted SmartCard)
Enter fullscreen mode Exit fullscreen mode

And chances are it does absolutely nothing on Linux. The usual recipe (apt install fprintd libpam-fprintd, then fprintd-enroll) ends with:

Impossible to enroll: GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice: No devices available
Enter fullscreen mode Exit fullscreen mode

This post documents how I got it working on Debian 13 (trixie) on a Dell Latitude 5431. The same procedure should apply to any Dell with the 0a5c:5843 reader (Latitude 5xxx/7xxx, Precision 3xxx/5xxx/7xxx) and to any Debian release, as long as you match the libfprint version.

TL;DR

  1. libfprint has no driver for this chip. The only working driver is Broadcom's proprietary blob, distributed by Canonical for Ubuntu OEM images.
  2. That blob loads through TOD (Touch OEM Drivers), a libfprint extension that Ubuntu ships and Debian does not.
  3. So you install the blob and its firmware, build libfprint with TOD support in the exact same version Debian ships, replace the system library, and put the package on hold.
  4. On first start the driver flashes new firmware into the ControlVault and then fails once. Restart fprintd and it works.

My setup

Item Value
Laptop Dell Latitude 5431
Reader Broadcom BCM58200 ControlVault 3, USB 0a5c:5843
Actual sensor behind it Goodix GF5288 (GF5288_GM188WNC_APP_10009)
OS Debian 13.7, kernel 6.12.x
libfprint 1:1.94.9-1

Step 0: identify your reader

Before doing anything, make sure you actually have this chip. Run:

cat /etc/debian_version; uname -r
lsusb
dpkg -l | grep -i -E 'fprint|libfprint|pam-fprint'
systemctl status fprintd --no-pager 2>&1 | head -5
sudo dmidecode -s system-product-name
Enter fullscreen mode Exit fullscreen mode

Depending on the vendor and product ID you will be in one of three situations:

  • Goodix (most recent ones), Synaptics 06cb:00xx, Elan, FPC: supported by upstream libfprint. Just install fprintd libpam-fprintd, enroll, and stop reading here.
  • Old Validity 138a:0090 / 138a:0097: needs the external python-validity driver.
  • Broadcom 0a5c:5843: keep reading.

Step 1: prerequisites

You need source repositories enabled, because we are going to pull libfprint's build dependencies. Check:

grep -rh -E '^(deb-src|Types:.*deb-src)' /etc/apt/sources.list /etc/apt/sources.list.d/
Enter fullscreen mode Exit fullscreen mode

If that prints nothing, on Debian 12+ with the deb822 format:

sudo sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/debian.sources
sudo apt update
Enter fullscreen mode Exit fullscreen mode

Then check which libfprint version you have and confirm a matching +tod1 tag exists in the TOD fork:

apt policy libfprint-2-2 | head -3
git ls-remote --tags https://gitlab.freedesktop.org/3v1n0/libfprint.git | grep tod1 | tail -8
Enter fullscreen mode Exit fullscreen mode

On trixie the package is 1.94.9, and the tag v1.94.9+tod1 exists. Use the tag that matches your installed package. The TOD fork tracks upstream releases, so there is almost always a matching tag.

Step 2: install the driver, firmware and TOD-enabled libfprint

Run the whole block as root (sudo -i). It installs build dependencies, clones the proprietary driver from Canonical's Launchpad repo, builds libfprint with TOD, replaces the system library (keeping a backup) and puts the package on hold.

Warning about set -e: if you paste this into an interactive root shell, the shell stays in set -e mode afterwards. The next command that returns non-zero (for example a grep with no match) will silently close your session. Run it as a script, or run set +e at the end. Ask me how I know.

set -e
export DEBIAN_FRONTEND=noninteractive
apt build-dep -y libfprint-2-2
apt install -y git meson ninja-build build-essential

TEMPDIR=$(mktemp -d); cd "$TEMPDIR"

# 1. Proprietary Broadcom driver + firmware.
#    The ubuntu/latest branch ships the firmware for both CV3 and CV3+; older branches do not.
git clone --depth=1 --branch ubuntu/latest https://git.launchpad.net/libfprint-2-tod1-broadcom
cd libfprint-2-tod1-broadcom
cp lib/udev/rules.d/60-libfprint-2-device-broadcom.rules /usr/lib/udev/rules.d/
mkdir -p /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1
cp usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod-1-broadcom.so /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/
mkdir -p /var/lib/fprint
cp -r var/lib/fprint/fw /var/lib/fprint/

# 2. libfprint with TOD support. SAME version as the Debian package (1.94.9 on trixie).
cd "$TEMPDIR"
git clone --branch v1.94.9+tod1 --depth=1 https://gitlab.freedesktop.org/3v1n0/libfprint.git
cd libfprint
sed -i -e "/subdir('tests')/s/^/#/" -e "/subdir('examples')/s/^/#/" meson.build
meson setup build --prefix=/usr -Ddoc=false
meson compile -C build

# 3. Install, keeping a backup of the original library.
cp -n /usr/lib/x86_64-linux-gnu/libfprint-2.so.2 /root/libfprint-2.so.2.debian-orig
cp build/libfprint/tod/libfprint-2-tod.so.1 /usr/lib/x86_64-linux-gnu/
ln -sf /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so.1 /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so
cp build/libfprint/libfprint-2.so.2 /usr/lib/x86_64-linux-gnu/
ldconfig
apt-mark hold libfprint-2-2

# 4. Run fprintd without its idle timeout. The Broadcom driver takes up to a minute
#    to initialise the first time, and fprintd would otherwise exit before it is ready.
mkdir -p /etc/systemd/system/fprintd.service.d
printf '[Service]\nExecStart=\nExecStart=/usr/libexec/fprintd --no-timeout\n' > /etc/systemd/system/fprintd.service.d/override.conf

udevadm control --reload-rules
udevadm trigger
systemctl daemon-reload
systemctl restart fprintd
set +e
Enter fullscreen mode Exit fullscreen mode

The build takes a couple of minutes. No compiler errors on trixie with GCC 14 and Meson 1.7.

A few notes on why it is done this way:

  • Why replace libfprint-2.so.2 instead of installing in parallel? fprintd from Debian is linked against libfprint-2.so.2. The TOD fork builds a drop-in replacement with the same soname that additionally loads plugins from libfprint-2/tod-1/. Replacing the file is the simplest way to make the stock fprintd pick it up.
  • Why the same version? The fork is upstream plus the TOD patches. If you build a newer version than the one Debian packaged, fprintd may hit ABI differences. Matching versions avoids surprises.
  • Why apt-mark hold? The next apt upgrade that touches libfprint-2-2 would overwrite your library and the reader would silently stop working. The hold makes that explicit.

Step 3: the firmware upgrade gotcha

This is the part that is not obvious from any of the guides I found.

On its very first start with the driver, fprintd checks the ControlVault firmware against the files in /var/lib/fprint/fw/ and, if they are newer, flashes the chip. In my case it went from AAI 5.9.13.0 / SBI 137 to AAI 5.15.21.0 / SBI 240. You can watch it happen:

sudo journalctl -u fprintd --no-pager -f
Enter fullscreen mode Exit fullscreen mode 
fprintd[3866353]: Updating ControlVault firmware from 5.9.13.0 to 5.15.21.0
fprintd[3866353]: Event: FwUpgradeStarted
fprintd[3866353]: Upgrade the SBI from 137 to 240, first clear SCD
fprintd[3866353]: Writing /var/lib/fprint/fw/bcm_cv_clearscd.bin to flash
...
fprintd[3866353]: Going to update the BCM with /var/lib/fprint/fw/bcmCitadel_7.otp
fprintd[3866353]: Please wait, this takes about one minute
fprintd[3866353]: Firmware Upgrade Complete
...
fprintd[3866353]: Control Vault firmware upgrade successful
fprintd[3866353]: Sensor type  : 16 Sensor firmware version on device: GF5288_GM188WNC_APP_10009 length: 25
fprintd[3866353]: Sensor firmware versions in file and on device match
fprintd[3866353]: Ignoring device due to initialization error: An unspecified error occurred!
fprintd[3866353]: g_task_return_boolean: assertion 'G_IS_TASK (task)' failed
Enter fullscreen mode Exit fullscreen mode

That last error looks like a failure. It is not. The upgrade succeeded, but the device is left in a half-initialised state and fprintd gives up on it for this run. Just restart the service:

sudo systemctl restart fprintd
sleep 45
sudo journalctl -u fprintd --no-pager --since "-2min"
fprintd-list $USER
Enter fullscreen mode Exit fullscreen mode

On the second start the log should say AAI version matches - it is up do date (sic) and fprintd-list should report:

found 1 devices
Device at /net/reactivated/Fprint/Device/0
Using device /net/reactivated/Fprint/Device/0
User xxxxxx has no fingers enrolled for Broadcom Sensors.
Enter fullscreen mode Exit fullscreen mode

If it still fails after a restart, do a full power off (systemctl poweroff, wait ten seconds, power on). The ControlVault is an independent security chip, and a warm reboot does not always reset it. Do not skip this if you are stuck; it is the difference between "broken" and "works" for several people in the Dell forums.

Do not interrupt the firmware flash. Do not unplug the laptop or suspend it during that minute.

Step 4: enroll and verify

As your normal user, not root:

fprintd-enroll -f right-index-finger    # about 10 touches, ends with enroll-completed
fprintd-enroll -f left-index-finger     # enroll a second finger, you will thank yourself later
fprintd-verify                          # should print verify-match
fprintd-list $USER
Enter fullscreen mode Exit fullscreen mode

Useful extras:

fprintd-delete $USER                    # remove all enrolled fingers for the user
Enter fullscreen mode Exit fullscreen mode

Step 5: enable it in PAM

On Debian do not edit /etc/pam.d/* by hand. The libpam-fprintd package registers a profile, and you enable it with:

sudo pam-auth-update
Enter fullscreen mode Exit fullscreen mode

Tick "Fingerprint authentication" and confirm. Then test in a second terminal, keeping the first one open in case something goes wrong:

sudo -k
sudo true
Enter fullscreen mode Exit fullscreen mode

It should ask for your finger instead of the password. If the finger fails or you do nothing, it falls back to the password after a few seconds, so you cannot lock yourself out. The same change covers the lock screen and the display manager (GDM, SDDM, LightDM). Some desktops need a logout to pick it up.

Maintenance

When Debian updates libfprint (a point release, or when you upgrade to the next stable):

sudo apt-mark unhold libfprint-2-2
sudo apt upgrade
# then repeat steps 2 and 3 of the install block with the new matching vX.Y.Z+tod1 tag
sudo apt-mark hold libfprint-2-2
Enter fullscreen mode Exit fullscreen mode

To undo everything:

sudo apt-mark unhold libfprint-2-2
sudo apt install --reinstall libfprint-2-2
sudo rm /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so* \
        /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod-1-broadcom.so \
        /usr/lib/udev/rules.d/60-libfprint-2-device-broadcom.rules \
        /etc/systemd/system/fprintd.service.d/override.conf
sudo systemctl daemon-reload && sudo systemctl restart fprintd
Enter fullscreen mode Exit fullscreen mode

The firmware already flashed into the chip stays there. That is fine; it is the same firmware Dell ships on Windows.

Files living outside of apt after this procedure, for your own records:

  • /usr/lib/x86_64-linux-gnu/libfprint-2.so.2 (replaced, backup at /root/libfprint-2.so.2.debian-orig)
  • /usr/lib/x86_64-linux-gnu/libfprint-2-tod.so.1 and the .so symlink
  • /usr/lib/x86_64-linux-gnu/libfprint-2/tod-1/libfprint-2-tod-1-broadcom.so
  • /usr/lib/udev/rules.d/60-libfprint-2-device-broadcom.rules
  • /var/lib/fprint/fw/ (the bcmCitadel* and bcmsbiCitadelA0* firmware images)
  • /etc/systemd/system/fprintd.service.d/override.conf

An open-source alternative

In 2025 someone reverse-engineered the ControlVault 3 secure channel and published a keyless, open-source TOD driver: nicolaskemp03/controlvault3-linux-fingerprint. It still needs libfprint built with TOD (steps 1 and 2 above minus the Broadcom blob), and the author's goal is to upstream it into libfprint, which would make all of this unnecessary. I have not tested it; the proprietary driver works for me, so I stopped there. If you prefer not to run a Broadcom binary, that is the route to look at.

Sources

Top comments (0)