ThinkWiki - User contributions [en]

Installation instructions for the ThinkPad T60p

2006-10-08T08:15:07Z

Edovino: /* Portage Ebuilds */

[[Category:T60p]]
==Installing Ubuntu Dapper==

To get it going:

* Get Dapper i386 (I used the Daily ISO DVD).

* Install the default distribution.

It will work, but you need an SMP kernel, and accelerated and higher resolution graphics, so:

* Install the i686-smp kernel (search for 'linux-kernel' in synaptic).

* Search for fglrx in synaptic, and install the fglrx modules, X driver and ATI control panel.

* Edit /etc/X11/xorg.conf, so each of the "Modeline" entries contains a 1600x1200 resolution as well (or whatever the top resolution of your LCD panel is), and change the driver section as follows:

Section "Device"
Identifier "ATI Technologies, Inc. ATI Default Card"
Driver "fglrx" <----- ADD THIS LINE
#Driver "vesa" <---- COMMENT OUT THIS LINE
BusID "PCI:1:0:0"
ChipID 0x71c5 <----- '''MAYBE''' ADD THIS LINE
EndSection

[On my UXGA t60p the ChipID line was actually fatal to getting fglrx to start up (/var/log/Xorg.0.log showed the driver falling back to VESA and fgl_glxgears would crash). Without that ChipID line my chip was identified as:

Chipset: "MOBILITY FireGL V5200 (M56 71C4)" (Chipset = 0x71c4)

which appears to correspond exactly to my machine's spec, and fgl_glxgears worked fine.]

Reboot, and you should be done. Check "cat /proc/cpuinfo" shows two CPUs, and run fgl_glxgears and check you get around 580 frames a second.

I've reported [https://launchpad.net/distros/ubuntu/+bug/46527 bug 46527] on the lack of screen driver detection, so hopefully this will get even easier.

Note you do NOT need to install ATI drivers from the ATI site. The Ubuntu drivers are sufficient.

Thanks to Rich Tango-Lowy (see below) for the hint re chip detection.

==Kubuntu Dapper Live CD==

If you're trying to install from the Kubuntu Desktop CD, you'll never make it to the login screen because the ATI display driver isn't recognized.

* Ctrl-Alt-F1
* sudo nano /etc/X11/xorg.conf
* change the display driver line that looks like:

Driver "ati"

to

Driver "vesa"

[I think I remember that it was "ati", but I could be wrong. In any
case this is very clearly the only Driver line in the ATI device specification section]

* Save and exit
* sudo /etc/init.d kdm restart

Now you get a login screen.

== Installing Gentoo 2006.0 ==

===Boot from Live CD===
Upon booting off the live cd you will come to the kernel selection prompt.
Enter:
gentoo doscsi
I had some trouble getting the wired NIC to be linked to the driver, often getting an error that the EEPROM failed a check. If this happens, you can try re-inserting the module,
>rmmod e1000; modprobe e1000
or rebooting and trying again. The wireless card isn't supported by the live cd so you're going to have to stick to wired for now.

===/etc/make.conf Settings===
The make.conf settings are the first thing you want to setup correctly before you proceed with the rest of the install process. All future updates will depend upon these settings as well.
CFLAGS="-march=prescott -O2 -pipe -msse3 -fomit-frame-pointer
VIDEO_CARDS="fglrx vesa fbdev"
INPUT_DEVICES="keyboard mouse synaptics"
FEATURES="sandbox ccache distlocks autoaddcvs parallel-fetch"
MAKEOPTS="-j3"
For a more complete discussion of the CFLAGS to use for a Core Duo processor, see [http://forums.gentoo.org/viewtopic-t-448761-highlight-core+duo+prescott.html?sid=97485d7e26a1f77e2bb06fa437a448ff this forum thread]. Some users recommend that the USE variable has the ibm value in it (eg. USE="ibm") but the Gentoo website says this is only for Power PC64 systems; I don't think we should use it. If anyone can shed more light on this, please update this section.

===Kernel Settings===
I was able to get the laptop running from i686 gentoo sources and recommend this to anyone installing Gentoo on their T60p. Alot of graphics support is left out of the kernel since the best graphics performance is with ATI's propietary drivers which you can emerge at the end of the kernel compile.
====Processor type and features====
* Turn on Symmetric multi-processing support.
* Set processor family to Pentium M.
* Turn off toshiba and dell laptop support.
* Set timer frequency to 1000 Hz since this is a desktop system.
* Found on a [http://forum.thinkpads.com/viewtopic.php?t=19031 forum posting] that "Hotpluggable CPU" should be set to get acpi sleep to work. Go figure...

====Power management options====
* Turn on all ACPI settings (especially IBM Thinkpad Extras) except ASUS/Medion and Toshiba Laptop Extras.
* Turn on CPU Frequency scaling.
** Turn on powersave, userspace, ondemand and conservative governor.
** Turn off ACPI Processor P-States driver.
** Turn off all AMD and Cyrix options.
** Turn on Intel Enhanced SpeedStep and Intel Speedstep on ICH-M chipsets (ioport interface).
** Turn off Intel SpeedStep on 440BX/ZX/MX chipsets (SMI interface).
** Turn off Intel Pentium 4 clock modulation, nVidia nForce2 FSB changing and Transmeta LongRun.
====Bus options====
* Turn on PCI Express support.
* Turn on Message Signaled Interupts.
* Turn on PCCard support and CardBus yenta-compatible bridge support.
====Networking support====
* Turn off Generic IEEE 802.11 Networking Stack.
* Turn on IrDA (infrared) subsystem support and sub-options.
* Turn on Bluetooth subsystem support and sub-options.
* Turn off Amateur Radio support (unless you work with actual radios.)
====Device Drivers====
* Turn off Memory Technology Devices.
* Turn off parallel port support.
* Turn on SCSI device support. In "low-level device drivers", chose the Serial ATA (SATA) support. Build it as a part of the kernel, and not as a kernel module.
* Turn off Fusion MPT device support.
* Turn on IEEE 1394 (FireWire) support.
* Turn on Network device support.
** Turn off all options in all categories under Network device support except the stated ones below.
** Turn on Intel(R) PRO/1000 Gigabit Ethernet support under Ethernet (1000 Mbit).
** Turn on Wireless LAN drivers (non-hamradio) & Wireless Extensions and none of the sub-options underneath.
** Most people do not need Fibre channel, ATM, WAN or PPP/SLIP support (if you do then turn it on. PPP is needed for GPRS/UMTS connectivity)
* Character device options...
** Turn off Parallel printer support.
** Turn on Intel/AMD/VIA HW Random Number Generator support.
** Turn on /dev/nvram support.
** Turn off /dev/agpgart (AGP Support).
** Turn off Direct Rendering Manager.
** Support for the [[Embedded_Security_Subsystem|Fritz Chip]] is located in "TPM Devices".
* Turn off all Graphics support options except the stated ones below,
** Turn on VESA VGA graphics support and set VESA driver type to vesafb.
** Turn on Enable firmware EDID and Enable Video Mode Handling Helpers.
** Turn on Support for the framebuffer splash.
* '''IMPORTANT:''' Turn off all Wireless device support under USB support -> USB Network Adapters or you will tear your hair out trying to get wireless.
* Turn on Sound card support.
** Turn on Advanced Linux Sound Architecture.
** Turn off all ISA, PCI, USB, generic and PCMCIA device options the stated on below.
** Turn on Intel HD Audio under PCI devices.
* Turn off all MMC/SD Card support options.
* Turn off LED devices.
* Cryptographic options... (needed for the wireless card ipw9345)
** Turn on AES chiphers
** Turn on Michael MIC keyed digest algorithm

That should do it. (I know, that's it.)
That should make sure that you have all the drivers necessary to boot the system and be able to use all your hardware (almost).

===Portage Ebuilds===

Always make sure you run this command before going any further so you can get the latest portage build and version...
emerge --sync && emerge portage

Since September 24 2006 I was able to make the latest ati-drivers work on the T60p without adding any lines to the unmask file (/etc/portage/package.unmask) under the gentoo-sources kernel. You should be able to run...
emerge ati-drivers
...without any problems.

Don't forget to emerge all the Thinkpad software as well...
emerge tpb tp_smapi tpctl

Then you can start to setup the wireless in this order at the command line...
/bin/sh /usr/portage/net-wireless/ieee80211/files/remove-old /usr/src/linux
emerge ieee80211 ipw3945 ipw3945d wireless-tools

For some reason the wireless driver consists of two parts: the module itself, ipw3949.ko, and some sort of support daemon, ipw3945d. The ebuild updates the modules.conf file to automatically stop and start this deamon when the module is loaded or unloaded, respectively. Check if the following lines are present in /etc/modules.conf (or actually, in /etc/modules.d/ipw3945d - /etc/modules.conf is built from the separate files in /etc/modules.d when you run /sbin/modules-update)

install ipw3945 /sbin/modprobe --ignore-install ipw3945; sleep 0.5; /sbin/ipw3945d --quiet
remove ipw3945 /sbin/ipw3945d --kill; /sbin/modprobe -r --ignore-remove ipw3945

In other words, to load the module, and start the daemon, do

modprobe ipw3945

To remove the module, and kill the daemon, enter

modprobe -r ipw3945

'''Note''': rmmod does '''not''' work - it doesn't use /etc/modprobe.conf, and therefore doesn't kill the daemon: while the daemon is running, you cannot unload the module. (You'll get an errormessage saying the module is in use).

If for some reason you need to kill the module manually, use

/sbin/ipw3945d --kill

Ofcourse the normal 'kill' command also works, but you'll have to remove the pid file /var/run/ipw3945d.pid by hand.

===xorg.conf Settings===

A piece of code is worth a thousand words; here is my xorg.conf that works at 3000-5000 FPS so far. I am still trying to find better parameters, but this is the best I got it to run so far. I intentionally left out the InputDevice section since I disabled my Synaptics pad (I like the center joystick better.) Just modify your xorg.conf sections with what is shown below.

Section "Module"
Load "dbe" # Double buffer extension
SubSection "extmod"
Option "omit xfree86-dga" # don't initialise the DGA extension
EndSubSection
Load "freetype"
Load "dri"
Load "glx"
EndSection

Section "Device"
Identifier "VideoCard"
Driver "fglrx"
VendorName "ati"
BusID "PCI:1:0:0"
Option "VideoOverlay" "off"
EndSection

Section "dri"
Group "video"
Mode 0666
EndSection

Section "Extensions"
Option "XVideo" "Enable"
EndSection

Section "Screen"
Identifier "Screen"
Device "VideoCard"
Monitor "Monitor"
DefaultDepth 24
SubSection "Display"
Viewport 0 0
Depth 24
Modes "1280x1024" "1024x768" "800x600" "640x480"
EndSubSection
EndSection

Make sure you assign your username to the video group in the /etc/group file or you will net get DRI (Direct Rendering) support. When debugging your running X windows system, always check /var/log/Xorg.0.log for any errors or hints at what may be configured incorrectly. This is how I was able to get so far with the graphics.

==External Sources==
*[http://arscognita.com/~richtl/T60p/index.html Rich Tango-Lowy's Mandriva 2007 Cooker on T60p page]
*[http://buzzy.tesuji.org/thinkpad_t60p.html Jon Lin's Gentoo Thinkpad T60p]

Installation instructions for the ThinkPad T60p

2006-10-08T08:07:33Z

Edovino: stopping / starting wireless

[[Category:T60p]]
==Installing Ubuntu Dapper==

To get it going:

* Get Dapper i386 (I used the Daily ISO DVD).

* Install the default distribution.

It will work, but you need an SMP kernel, and accelerated and higher resolution graphics, so:

* Install the i686-smp kernel (search for 'linux-kernel' in synaptic).

* Search for fglrx in synaptic, and install the fglrx modules, X driver and ATI control panel.

* Edit /etc/X11/xorg.conf, so each of the "Modeline" entries contains a 1600x1200 resolution as well (or whatever the top resolution of your LCD panel is), and change the driver section as follows:

Section "Device"
Identifier "ATI Technologies, Inc. ATI Default Card"
Driver "fglrx" <----- ADD THIS LINE
#Driver "vesa" <---- COMMENT OUT THIS LINE
BusID "PCI:1:0:0"
ChipID 0x71c5 <----- '''MAYBE''' ADD THIS LINE
EndSection

[On my UXGA t60p the ChipID line was actually fatal to getting fglrx to start up (/var/log/Xorg.0.log showed the driver falling back to VESA and fgl_glxgears would crash). Without that ChipID line my chip was identified as:

Chipset: "MOBILITY FireGL V5200 (M56 71C4)" (Chipset = 0x71c4)

which appears to correspond exactly to my machine's spec, and fgl_glxgears worked fine.]

Reboot, and you should be done. Check "cat /proc/cpuinfo" shows two CPUs, and run fgl_glxgears and check you get around 580 frames a second.

I've reported [https://launchpad.net/distros/ubuntu/+bug/46527 bug 46527] on the lack of screen driver detection, so hopefully this will get even easier.

Note you do NOT need to install ATI drivers from the ATI site. The Ubuntu drivers are sufficient.

Thanks to Rich Tango-Lowy (see below) for the hint re chip detection.

==Kubuntu Dapper Live CD==

If you're trying to install from the Kubuntu Desktop CD, you'll never make it to the login screen because the ATI display driver isn't recognized.

* Ctrl-Alt-F1
* sudo nano /etc/X11/xorg.conf
* change the display driver line that looks like:

Driver "ati"

to

Driver "vesa"

[I think I remember that it was "ati", but I could be wrong. In any
case this is very clearly the only Driver line in the ATI device specification section]

* Save and exit
* sudo /etc/init.d kdm restart

Now you get a login screen.

== Installing Gentoo 2006.0 ==

===Boot from Live CD===
Upon booting off the live cd you will come to the kernel selection prompt.
Enter:
gentoo doscsi
I had some trouble getting the wired NIC to be linked to the driver, often getting an error that the EEPROM failed a check. If this happens, you can try re-inserting the module,
>rmmod e1000; modprobe e1000
or rebooting and trying again. The wireless card isn't supported by the live cd so you're going to have to stick to wired for now.

===/etc/make.conf Settings===
The make.conf settings are the first thing you want to setup correctly before you proceed with the rest of the install process. All future updates will depend upon these settings as well.
CFLAGS="-march=prescott -O2 -pipe -msse3 -fomit-frame-pointer
VIDEO_CARDS="fglrx vesa fbdev"
INPUT_DEVICES="keyboard mouse synaptics"
FEATURES="sandbox ccache distlocks autoaddcvs parallel-fetch"
MAKEOPTS="-j3"
For a more complete discussion of the CFLAGS to use for a Core Duo processor, see [http://forums.gentoo.org/viewtopic-t-448761-highlight-core+duo+prescott.html?sid=97485d7e26a1f77e2bb06fa437a448ff this forum thread]. Some users recommend that the USE variable has the ibm value in it (eg. USE="ibm") but the Gentoo website says this is only for Power PC64 systems; I don't think we should use it. If anyone can shed more light on this, please update this section.

===Kernel Settings===
I was able to get the laptop running from i686 gentoo sources and recommend this to anyone installing Gentoo on their T60p. Alot of graphics support is left out of the kernel since the best graphics performance is with ATI's propietary drivers which you can emerge at the end of the kernel compile.
====Processor type and features====
* Turn on Symmetric multi-processing support.
* Set processor family to Pentium M.
* Turn off toshiba and dell laptop support.
* Set timer frequency to 1000 Hz since this is a desktop system.
* Found on a [http://forum.thinkpads.com/viewtopic.php?t=19031 forum posting] that "Hotpluggable CPU" should be set to get acpi sleep to work. Go figure...

====Power management options====
* Turn on all ACPI settings (especially IBM Thinkpad Extras) except ASUS/Medion and Toshiba Laptop Extras.
* Turn on CPU Frequency scaling.
** Turn on powersave, userspace, ondemand and conservative governor.
** Turn off ACPI Processor P-States driver.
** Turn off all AMD and Cyrix options.
** Turn on Intel Enhanced SpeedStep and Intel Speedstep on ICH-M chipsets (ioport interface).
** Turn off Intel SpeedStep on 440BX/ZX/MX chipsets (SMI interface).
** Turn off Intel Pentium 4 clock modulation, nVidia nForce2 FSB changing and Transmeta LongRun.
====Bus options====
* Turn on PCI Express support.
* Turn on Message Signaled Interupts.
* Turn on PCCard support and CardBus yenta-compatible bridge support.
====Networking support====
* Turn off Generic IEEE 802.11 Networking Stack.
* Turn on IrDA (infrared) subsystem support and sub-options.
* Turn on Bluetooth subsystem support and sub-options.
* Turn off Amateur Radio support (unless you work with actual radios.)
====Device Drivers====
* Turn off Memory Technology Devices.
* Turn off parallel port support.
* Turn on SCSI device support. In "low-level device drivers", chose the Serial ATA (SATA) support. Build it as a part of the kernel, and not as a kernel module.
* Turn off Fusion MPT device support.
* Turn on IEEE 1394 (FireWire) support.
* Turn on Network device support.
** Turn off all options in all categories under Network device support except the stated ones below.
** Turn on Intel(R) PRO/1000 Gigabit Ethernet support under Ethernet (1000 Mbit).
** Turn on Wireless LAN drivers (non-hamradio) & Wireless Extensions and none of the sub-options underneath.
** Most people do not need Fibre channel, ATM, WAN or PPP/SLIP support (if you do then turn it on. PPP is needed for GPRS/UMTS connectivity)
* Character device options...
** Turn off Parallel printer support.
** Turn on Intel/AMD/VIA HW Random Number Generator support.
** Turn on /dev/nvram support.
** Turn off /dev/agpgart (AGP Support).
** Turn off Direct Rendering Manager.
** Support for the [[Embedded_Security_Subsystem|Fritz Chip]] is located in "TPM Devices".
* Turn off all Graphics support options except the stated ones below,
** Turn on VESA VGA graphics support and set VESA driver type to vesafb.
** Turn on Enable firmware EDID and Enable Video Mode Handling Helpers.
** Turn on Support for the framebuffer splash.
* '''IMPORTANT:''' Turn off all Wireless device support under USB support -> USB Network Adapters or you will tear your hair out trying to get wireless.
* Turn on Sound card support.
** Turn on Advanced Linux Sound Architecture.
** Turn off all ISA, PCI, USB, generic and PCMCIA device options the stated on below.
** Turn on Intel HD Audio under PCI devices.
* Turn off all MMC/SD Card support options.
* Turn off LED devices.
* Cryptographic options... (needed for the wireless card ipw9345)
** Turn on AES chiphers
** Turn on Michael MIC keyed digest algorithm

That should do it. (I know, that's it.)
That should make sure that you have all the drivers necessary to boot the system and be able to use all your hardware (almost).

===Portage Ebuilds===

Always make sure you run this command before going any further so you can get the latest portage build and version...
emerge --sync && emerge portage

Since September 24 2006 I was able to make the latest ati-drivers work on the T60p without adding any lines to the unmask file (/etc/portage/package.unmask) under the gentoo-sources kernel. You should be able to run...
emerge ati-drivers
...without any problems.

Don't forget to emerge all the Thinkpad software as well...
emerge tpb tp_smapii tpctl

Then you can start to setup the wireless in this order at the command line...
/bin/sh /usr/portage/net-wireless/ieee80211/files/remove-old /usr/src/linux
emerge ieee80211 ipw3945 ipw3945d wireless-tools

For some reason the wireless driver consists of two parts: the module itself, ipw3949.ko, and some sort of support daemon, ipw3945d. The ebuild updates the modules.conf file to automatically stop and start this deamon when the module is loaded or unloaded, respectively.

install ipw3945 /sbin/modprobe --ignore-install ipw3945; sleep 0.5; /sbin/ipw3945d --quiet
remove ipw3945 /sbin/ipw3945d --kill; /sbin/modprobe -r --ignore-remove ipw3945

In other words, to load the module, and start the deamon, do

modprobe ipw3945

To remove the module, and kill the daemon, enter

modprobe -r ipw3945

'''Note''' rmmod does '''not''' work - that won't execute the line from modprobe.conf, and doesn't kill the deamon. While the daemon is running, you cannot unload the module. (You'll get an errormessage saying the module is in use)
If for some reason you need to kill the module manually, use

/sbin/ipw3945d --kill

===xorg.conf Settings===

A piece of code is worth a thousand words; here is my xorg.conf that works at 3000-5000 FPS so far. I am still trying to find better parameters, but this is the best I got it to run so far. I intentionally left out the InputDevice section since I disabled my Synaptics pad (I like the center joystick better.) Just modify your xorg.conf sections with what is shown below.

Section "Module"
Load "dbe" # Double buffer extension
SubSection "extmod"
Option "omit xfree86-dga" # don't initialise the DGA extension
EndSubSection
Load "freetype"
Load "dri"
Load "glx"
EndSection

Section "Device"
Identifier "VideoCard"
Driver "fglrx"
VendorName "ati"
BusID "PCI:1:0:0"
Option "VideoOverlay" "off"
EndSection

Section "dri"
Group "video"
Mode 0666
EndSection

Section "Extensions"
Option "XVideo" "Enable"
EndSection

Section "Screen"
Identifier "Screen"
Device "VideoCard"
Monitor "Monitor"
DefaultDepth 24
SubSection "Display"
Viewport 0 0
Depth 24
Modes "1280x1024" "1024x768" "800x600" "640x480"
EndSubSection
EndSection

Make sure you assign your username to the video group in the /etc/group file or you will net get DRI (Direct Rendering) support. When debugging your running X windows system, always check /var/log/Xorg.0.log for any errors or hints at what may be configured incorrectly. This is how I was able to get so far with the graphics.

==External Sources==
*[http://arscognita.com/~richtl/T60p/index.html Rich Tango-Lowy's Mandriva 2007 Cooker on T60p page]
*[http://buzzy.tesuji.org/thinkpad_t60p.html Jon Lin's Gentoo Thinkpad T60p]

Installation instructions for the ThinkPad T60p

2006-10-08T08:06:55Z

Edovino: /* Portage Ebuilds */

[[Category:T60p]]
==Installing Ubuntu Dapper==

To get it going:

* Get Dapper i386 (I used the Daily ISO DVD).

* Install the default distribution.

It will work, but you need an SMP kernel, and accelerated and higher resolution graphics, so:

* Install the i686-smp kernel (search for 'linux-kernel' in synaptic).

* Search for fglrx in synaptic, and install the fglrx modules, X driver and ATI control panel.

* Edit /etc/X11/xorg.conf, so each of the "Modeline" entries contains a 1600x1200 resolution as well (or whatever the top resolution of your LCD panel is), and change the driver section as follows:

Section "Device"
Identifier "ATI Technologies, Inc. ATI Default Card"
Driver "fglrx" <----- ADD THIS LINE
#Driver "vesa" <---- COMMENT OUT THIS LINE
BusID "PCI:1:0:0"
ChipID 0x71c5 <----- '''MAYBE''' ADD THIS LINE
EndSection

[On my UXGA t60p the ChipID line was actually fatal to getting fglrx to start up (/var/log/Xorg.0.log showed the driver falling back to VESA and fgl_glxgears would crash). Without that ChipID line my chip was identified as:

Chipset: "MOBILITY FireGL V5200 (M56 71C4)" (Chipset = 0x71c4)

which appears to correspond exactly to my machine's spec, and fgl_glxgears worked fine.]

Reboot, and you should be done. Check "cat /proc/cpuinfo" shows two CPUs, and run fgl_glxgears and check you get around 580 frames a second.

I've reported [https://launchpad.net/distros/ubuntu/+bug/46527 bug 46527] on the lack of screen driver detection, so hopefully this will get even easier.

Note you do NOT need to install ATI drivers from the ATI site. The Ubuntu drivers are sufficient.

Thanks to Rich Tango-Lowy (see below) for the hint re chip detection.

==Kubuntu Dapper Live CD==

If you're trying to install from the Kubuntu Desktop CD, you'll never make it to the login screen because the ATI display driver isn't recognized.

* Ctrl-Alt-F1
* sudo nano /etc/X11/xorg.conf
* change the display driver line that looks like:

Driver "ati"

to

Driver "vesa"

[I think I remember that it was "ati", but I could be wrong. In any
case this is very clearly the only Driver line in the ATI device specification section]

* Save and exit
* sudo /etc/init.d kdm restart

Now you get a login screen.

== Installing Gentoo 2006.0 ==

===Boot from Live CD===
Upon booting off the live cd you will come to the kernel selection prompt.
Enter:
gentoo doscsi
I had some trouble getting the wired NIC to be linked to the driver, often getting an error that the EEPROM failed a check. If this happens, you can try re-inserting the module,
>rmmod e1000; modprobe e1000
or rebooting and trying again. The wireless card isn't supported by the live cd so you're going to have to stick to wired for now.

===/etc/make.conf Settings===
The make.conf settings are the first thing you want to setup correctly before you proceed with the rest of the install process. All future updates will depend upon these settings as well.
CFLAGS="-march=prescott -O2 -pipe -msse3 -fomit-frame-pointer
VIDEO_CARDS="fglrx vesa fbdev"
INPUT_DEVICES="keyboard mouse synaptics"
FEATURES="sandbox ccache distlocks autoaddcvs parallel-fetch"
MAKEOPTS="-j3"
For a more complete discussion of the CFLAGS to use for a Core Duo processor, see [http://forums.gentoo.org/viewtopic-t-448761-highlight-core+duo+prescott.html?sid=97485d7e26a1f77e2bb06fa437a448ff this forum thread]. Some users recommend that the USE variable has the ibm value in it (eg. USE="ibm") but the Gentoo website says this is only for Power PC64 systems; I don't think we should use it. If anyone can shed more light on this, please update this section.

===Kernel Settings===
I was able to get the laptop running from i686 gentoo sources and recommend this to anyone installing Gentoo on their T60p. Alot of graphics support is left out of the kernel since the best graphics performance is with ATI's propietary drivers which you can emerge at the end of the kernel compile.
====Processor type and features====
* Turn on Symmetric multi-processing support.
* Set processor family to Pentium M.
* Turn off toshiba and dell laptop support.
* Set timer frequency to 1000 Hz since this is a desktop system.
* Found on a [http://forum.thinkpads.com/viewtopic.php?t=19031 forum posting] that "Hotpluggable CPU" should be set to get acpi sleep to work. Go figure...

====Power management options====
* Turn on all ACPI settings (especially IBM Thinkpad Extras) except ASUS/Medion and Toshiba Laptop Extras.
* Turn on CPU Frequency scaling.
** Turn on powersave, userspace, ondemand and conservative governor.
** Turn off ACPI Processor P-States driver.
** Turn off all AMD and Cyrix options.
** Turn on Intel Enhanced SpeedStep and Intel Speedstep on ICH-M chipsets (ioport interface).
** Turn off Intel SpeedStep on 440BX/ZX/MX chipsets (SMI interface).
** Turn off Intel Pentium 4 clock modulation, nVidia nForce2 FSB changing and Transmeta LongRun.
====Bus options====
* Turn on PCI Express support.
* Turn on Message Signaled Interupts.
* Turn on PCCard support and CardBus yenta-compatible bridge support.
====Networking support====
* Turn off Generic IEEE 802.11 Networking Stack.
* Turn on IrDA (infrared) subsystem support and sub-options.
* Turn on Bluetooth subsystem support and sub-options.
* Turn off Amateur Radio support (unless you work with actual radios.)
====Device Drivers====
* Turn off Memory Technology Devices.
* Turn off parallel port support.
* Turn on SCSI device support. In "low-level device drivers", chose the Serial ATA (SATA) support. Build it as a part of the kernel, and not as a kernel module.
* Turn off Fusion MPT device support.
* Turn on IEEE 1394 (FireWire) support.
* Turn on Network device support.
** Turn off all options in all categories under Network device support except the stated ones below.
** Turn on Intel(R) PRO/1000 Gigabit Ethernet support under Ethernet (1000 Mbit).
** Turn on Wireless LAN drivers (non-hamradio) & Wireless Extensions and none of the sub-options underneath.
** Most people do not need Fibre channel, ATM, WAN or PPP/SLIP support (if you do then turn it on. PPP is needed for GPRS/UMTS connectivity)
* Character device options...
** Turn off Parallel printer support.
** Turn on Intel/AMD/VIA HW Random Number Generator support.
** Turn on /dev/nvram support.
** Turn off /dev/agpgart (AGP Support).
** Turn off Direct Rendering Manager.
** Support for the [[Embedded_Security_Subsystem|Fritz Chip]] is located in "TPM Devices".
* Turn off all Graphics support options except the stated ones below,
** Turn on VESA VGA graphics support and set VESA driver type to vesafb.
** Turn on Enable firmware EDID and Enable Video Mode Handling Helpers.
** Turn on Support for the framebuffer splash.
* '''IMPORTANT:''' Turn off all Wireless device support under USB support -> USB Network Adapters or you will tear your hair out trying to get wireless.
* Turn on Sound card support.
** Turn on Advanced Linux Sound Architecture.
** Turn off all ISA, PCI, USB, generic and PCMCIA device options the stated on below.
** Turn on Intel HD Audio under PCI devices.
* Turn off all MMC/SD Card support options.
* Turn off LED devices.
* Cryptographic options... (needed for the wireless card ipw9345)
** Turn on AES chiphers
** Turn on Michael MIC keyed digest algorithm

That should do it. (I know, that's it.)
That should make sure that you have all the drivers necessary to boot the system and be able to use all your hardware (almost).

===Portage Ebuilds===

Always make sure you run this command before going any further so you can get the latest portage build and version...
emerge --sync && emerge portage

Since September 24 2006 I was able to make the latest ati-drivers work on the T60p without adding any lines to the unmask file (/etc/portage/package.unmask) under the gentoo-sources kernel. You should be able to run...
emerge ati-drivers
...without any problems.

Don't forget to emerge all the Thinkpad software as well...
emerge tpb tp_smapii tpctl

Then you can start to setup the wireless in this order at the command line...
/bin/sh /usr/portage/net-wireless/ieee80211/files/remove-old /usr/src/linux
emerge ieee80211 ipw3945 ipw3945d wireless-tools

For some reason the wireless driver consists of two parts: the module itself, ipw3949.ko, and some sort of support daemon, ipw3945d. The ebuild updates the modules.conf file to automatically stop and start this deamon when the module is loaded or unloaded, respectively.

install ipw3945 /sbin/modprobe --ignore-install ipw3945; sleep 0.5; /sbin/ipw3945d --quiet
remove ipw3945 /sbin/ipw3945d --kill; /sbin/modprobe -r --ignore-remove ipw3945

In other words, to load the module, and start the deamon, do

modprobe ipw3945

To remove the module, and kill the daemon, enter

modprobe -r ipw3945

'''Note''' rmmod does '''not''' work - that won't execute the line from modprobe.conf, and doesn't kill the deamon. While the daemon is running, you cannot unload the module. (You'll get an errormessage saying the module is in use)
If for some reason you need to kill the module manually, use

sbin/ipw3945d --kill

===xorg.conf Settings===

A piece of code is worth a thousand words; here is my xorg.conf that works at 3000-5000 FPS so far. I am still trying to find better parameters, but this is the best I got it to run so far. I intentionally left out the InputDevice section since I disabled my Synaptics pad (I like the center joystick better.) Just modify your xorg.conf sections with what is shown below.

Section "Module"
Load "dbe" # Double buffer extension
SubSection "extmod"
Option "omit xfree86-dga" # don't initialise the DGA extension
EndSubSection
Load "freetype"
Load "dri"
Load "glx"
EndSection

Section "Device"
Identifier "VideoCard"
Driver "fglrx"
VendorName "ati"
BusID "PCI:1:0:0"
Option "VideoOverlay" "off"
EndSection

Section "dri"
Group "video"
Mode 0666
EndSection

Section "Extensions"
Option "XVideo" "Enable"
EndSection

Section "Screen"
Identifier "Screen"
Device "VideoCard"
Monitor "Monitor"
DefaultDepth 24
SubSection "Display"
Viewport 0 0
Depth 24
Modes "1280x1024" "1024x768" "800x600" "640x480"
EndSubSection
EndSection

Make sure you assign your username to the video group in the /etc/group file or you will net get DRI (Direct Rendering) support. When debugging your running X windows system, always check /var/log/Xorg.0.log for any errors or hints at what may be configured incorrectly. This is how I was able to get so far with the graphics.

==External Sources==
*[http://arscognita.com/~richtl/T60p/index.html Rich Tango-Lowy's Mandriva 2007 Cooker on T60p page]
*[http://buzzy.tesuji.org/thinkpad_t60p.html Jon Lin's Gentoo Thinkpad T60p]

Installation instructions for the ThinkPad T60p

2006-08-23T15:36:43Z

Edovino:

How to enable integrated fingerprint reader with BioAPI

2006-01-02T11:15:14Z

Edovino: /* Installing the driver */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the [[Integrated Fingerprint Reader|integrated fingerprint reader]] to work under Linux. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 9.3, SuSE 10, and {{Gentoo}}.
|}

==Basic installation==
===Installing the bioapi framework===
====Binary packages====
=====Debian=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
*This seems to work for Ubuntu breezy/dapper too, so saver yourself some trouble and grab it.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
====Automated installation script====
The [[Script for enabling the fingerprint reader]] automates the installation of most components (bioapi framework, driver, pam_bioapi, pam setup, device permissions, pamtester and enrolling), for some Linux distributions.

====Installing from source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.
* By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
:Create a dedicated directory, for example {{path|/opt/bioapi}} .
:Append <tt>--prefix=/opt/bioapi</tt> to the above <tt>./configure</tt> command.
:Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>.
:When installing the driver (below), tell it the new install path: {{cmdroot|sh install.sh /opt/bioapi/lib}}

===Installing the driver===
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from http://www.upek.com/support/dl_linux_bsp.asp and unzip it into a seperate folder, as it will not create one. If you have trouble and none of the fixes below work, there is also an older beta version, {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html, which expires January 1, 2006.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If you're running Gentoo, use
:{{cmdroot|sh install.sh /usr/lib}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
*Likewise, you'll need to make the usbfs files readable/writeable by your normal user:
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:Some (older?) distros mount usbfs at {{path|/dev/bus/usb}} instead or additionally; in this case, modify these instructions accordingly.
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro.
:It might be necessary to put the above line into a startup script somewhere. It might also be necessary to run it after resume from sleep or hibernate.
:Alternately, you can set mount options for usbfs in {{path|/etc/fstab|}} -- see the {{cmd|mount(8)|}} manpage. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
* To increase the security level (minimize false accept rate), set this in {{path|/etc/tfmessbsp.cfg}}:
:<tt>security-level="5"</tt>
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}

===Testing the driver and enrolling a fingerprint===
To test the driver and generate the file containing your fingerprint information, you need a sample program included with the driver. The compilation steps below were discovered by trial and error; if they don't work for you, try the binary {{cmd|Sample|}} utility that came with the beta versions of the driver (i.e., {{path|TFMESS_BSP_LIN_1.0beta2.zip}} as mentioned above).
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:Edit {{path|main.c|}} and remove (or comment out) the line
#include "port/bioapi_port.h"
:{{cmdroot|gcc -o Sample main.c -L/usr/local/lib -lbioapi100 -DUNIX -DLITTLE_ENDIAN}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root, unless you've already configured the usbfs file permissions.
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account).
:You'll save a step later if you use your own login username as the username to enroll here.

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
{{path|/etc/pam.d/system-auth}} for '''Gentoo'''-Users:

auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
account required pam_unix.so
password required pam_cracklib.so difok=2 minlen=8 dcredit=2 credit=2 retry=3
password sufficient pam_unix.so nullok md5 shadow use_authtok
password required pam_deny.so
session required pam_limits.so
session required pam_unix.so
----

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, '''Gentoo''' will give you 'account expired' errors.
CREATE {{path|/etc/pam.d/common-auth}} like so.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

On {{Fedora}}4 or {{Aurox}}11, you may need to add {{path|/usr/local/lib}} to ldconfig configuration.
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
If you see bioapi libs
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password. If you use kdm, there is no pop up. In xdm, enter your username and a blank password, then swipe (there is no popup).

You can do some useful testing with [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}], which calls the pam modules as if it were a program of your choice. Examples:
:{{cmdroot|pamtester xdm yourusername authenticate}}
:{{cmduser|pamtester xscreensaver yourusername authenticate}}
where {{cmd|yourusername|}} is your username. Note that {{cmd|pamtester|}} should run as root if and only if the program in question does.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting or removing/inserting USB kernel modules might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. (on {{Fedora}} it is {{path|/var/log/secure}}) Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files (depending on which xscreensaver features you want), in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

(15.12.2005: small Gentoo-update! {darcline (at) gmx.net} with a now fully operational Thinkpad X41 running Gentoo and E17)
Thank you badcode!

(20.12.2005: small Suse-update! {marten.gustafson (at) gmail.com} now with a fully operational Thinkpad T43 running Suse 10)
Thanks!

How to enable integrated fingerprint reader with BioAPI

2005-11-20T21:28:16Z

Edovino:

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4, SuSE 10, and {{Gentoo}}.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
=====Gentoo=====
You can either Grab the ebuild from http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2, or use the source-install procedure below.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`/sbin/lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:It might be nessecary to put the above line into a startup script somewhere.

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account)
:You'll save a step later if you user your own login username as the username to enroll here

==GDM Login via pam_bioapi==
===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
{{NOTE|If encountering 'rpl_malloc' symbol, remove the related term in the makefile. (FC3)}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi1.10/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi1.10/pam/$SERIAL}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, Gentoo will probably give you 'account expired' errors. Edit {{path|/etc/pam.d/common-auth}} to look like this.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|/sbin/lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files, in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de

How to enable integrated fingerprint reader with BioAPI

2005-11-20T21:10:35Z

Edovino: /* Configuring pam */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the fingerprint reader to work. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4 and SuSE 10.
|}

==Basic driver installation==
===Getting required libs and tools===
====Installing the bioapi framework====
=====Binary packages=====
*If you're using {{Debian}} Sid (the unstable branch) you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.
=====Installing from source=====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-1.2.2.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)

====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0beta2.zip}} from http://www.qrivy.net/~michael/blua/upek-bsp.html and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again
*If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), do the following as root (this doesn't seem necessary on SuSE 10):
:{{cmdroot|chmod 777 -R /usr/local/var/bioapi/}}
:Actually this depends on where you installed, if you did as suggested, it should work. Otherwise you probably know what you're doing anyways. :)
:{{cmdroot|touch /var/log/BSP.log && chmod 666 /var/log/BSP.log}}
:{{cmdroot|chmod -R a+X /proc/bus/usb}}
:{{cmdroot|chmod 666 /proc/bus/usb/`/sbin/lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:It might be nessecary to put the above line into a startup script somewhere.

===Testing the driver===
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0beta2.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:{{cmdroot|chmod +x Sample}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account)
:You'll save a step later if you user your own login username as the username to enroll here

==GDM Login via pam_bioapi==
===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
*Get and compile the pam_bioapi module.
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-0.2.1.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible. The patch comes from [http://linuxbiometrics.com/modules/newbb/viewtopic.php?viewmode=flat&topic_id=80&forum=1 this thread].
:{{cmduser|./configure && make}}
{{NOTE|If encountering 'rpl_malloc' symbol, remove the related term in the makefile. (FC3)}}
:and as root
:{{cmdroot| make install}}
:{{cmdroot| cp /usr/local/lib/security/* /lib/security/}}
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi1.10/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi1.10/pam/$SERIAL}}

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or SuSE you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure

With this modification pam immediately starts to use the fingerprint reader to do local authorization (e.g. sudo/gdm use the fingerprint reader).

''Note:'' With a system-auth like above, Gentoo will probably give you 'account expired' errors. Edit {{path|/etc/pam.d/common-auth}} to look like this.

account required pam_unix.so
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
auth required pam_unix.so nullok_secure
session required pam_limits.so
session required pam_uni

Note that if su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings...

For some applications (kdm, SuSE 10 KDE screen saver), you'll need to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt. kdm didn't give any visual indication it was going to the fingerprint reader, other than the cursor stopped blinking, but I swiped, and it let me in.

Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

On {{Fedora}}, you may need to add {{path|/usr/local/lib}} to your LD_LIBRARY path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. Also the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

Now gdm should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.

==Make xscreensaver use the scanner==
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://nax.hn.org/pub/bioapi/xscreensaver-4.22_alternativeAuth.diff}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you recieve an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again
*and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
:*In case it doesn't, try
::{{cmduser|1=export PATH=/usr/local/bin:$PATH}} and retry.
*Kill the running instance of xscreensaver:
:{{cmduser|xscreensaver-command -exit}}
*Make sure you have the following line in your {{path|~/.xscreensaver}}:
alternativeAuth: True
*Now edit {{path|/etc/pam.d/xscreensaver}} to include the following line (If you're on {{Ubuntu}} Breezy and you already changed {{path|/etc/pam.d/common-auth}} you should not need to do this.):
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi1.10/pam/
*Start the new xscreensaver
:{{cmduser|xscreensaver}} There should be a splash screen with version 4.23.
*Now try:
:{{cmduser|xscreensaver-command -lock}}

If you have questions or problems with this procedure, ask: t43fingerprint (at) badcode.de .

===Package for Debian sid===

If you're running {{Debian}} sid (the unstable branch) you can also try the patched .deb-package (built from current Debian sources fetched with {{cmd|apt-get source|}}) from [http://linux.spiney.org/debian_gnu_linux_on_an_ibm_thinkpad_t43p_fingerprint_reader this page], which also has Debian-specific instructions on how to setup the fingerprint reader. Use it on your own risk.

==Troubleshooting and Hints==
# After installing the driver, don't forget to reboot!
## This might not be necessary. it worked here without having to reboot.
# To see if the fingerprint device is know on the USB bus do:
:{{cmdroot|/sbin/lsusb}}
:as root and you should see a line like:
:{{cmdresult|Bus 003 Device 004: ID 0483:2016 SGS Thomson Microelectronics}}
:The bus and device number can be different. This should work without the driver installed. If the device does not show up, you have a hardware problem/quirk, Rebooting might fix this.
# For some installation, after installing the driver as in section [[#Installing the driver|Installing the driver]] and makingÂ´sure the device is recognized, try to test it by going to {{path|NonGUI_Sample}} directory and run {{cmdroot|./Sample}}, one get segmentation fault. In this case, try getting the Beta1 instead of Beta2 of the driver and installing it
# There was some confusion about the /etc/bioapi1.10/pam{5550454b-2054-464d-2f45-535320425350} path, this has been fixed in the howto, if you have problems, check the section again, the path needs to have the '-' in them
# When something goes wrong look at the tail of {{path|/var/log/auth.log}}. Specifically if you see an entry saying something like
pam_bioapi[10480]: Unable to load BioAPI BSP with UUID of {5550454b-2054-464d-2f45-535320425350}, BioAPI error <nowiki>#</nowiki>194d.
Check whether your {{path|/proc/bus/usb}} directory permissions are set up as in the
section [[#Installing the driver|Installing the driver]].
# To get the xscreensaver compiled you might need a bunch of header files, in my case I need the following:
#*python-gtk2-dev
#*libgstreamer0.8-dev
#*xlibs-dev
# Sometimes {{path|$HOME/.xscreensaver}} got overwritten, try changing it to read-only.
# If after suspending to RAM and resume, lsusb no longer have "SGS Thomson Microelectronics" entry, try adding a line
:{{cmdroot|/etc/init.d/hotplug restart}}
to your {{path|/etc/acpi/resume.sh}} file
#If after resume lsusb shows the device but xscreensaver does not ask for fingerprint for login, you might want to check the permission of the usb bus in the appropriate {{path|/proc/bus/usb/}} entry. If necessesary you might need to add a line to {{path|/etc/acpi/resume.sh}} as in section [[#Installing the driver|Installing the driver]] to set the permission right.
-----
If it still doesn't work, ask me for help (and make sure all usefull stuff makes it back into this wiki :)
to get a starting point as to where your problem is please include the output of:

:{{cmduser|lsusb}}

:{{cmduser|ldconfig -p | grep bioapi}}

:{{cmdroot|updatedb && locate bioapi}}

t43fingerprint (at) badcode.de