Support request: Synaptics 06cb:00cb (HP Pavilion x360 14-dh0xxx)

[satviktiwari]

Device info

Laptop: HP Pavilion x360 Convertible 14-dh0xxx
OS: Zorin OS (Ubuntu 24.04 Noble base)
Sensor: Synaptics, Inc. Fingerprint scanner

lsusb output:
Bus 001 Device 007: ID 06cb:00cb Synaptics, Inc. Fingerprint scanner

What was tried

Installed python3-validity + open-fprintd from the uunicorn PPA.
Manually added 06cb:00cb to usb.py, firmware_tables.py, and udev rules,
mapping it to the same firmware as DEV_9a (nz3gf07w.exe).

Firmware downloaded successfully. Service starts but fails with USB timeout:

usb.core.USBTimeoutError: [Errno 110] Operation timed out
  File "tls.py", line 124, in cmd
  File "usb.py", line 105, in cmd
    self.dev.write(1, out)   <-- times out on cmd 0x3e

Manual USB probing results

Probed the device directly with pyusb. Key findings:

Command	Response	Notes
0x01	0000f0b05e54a40000000607013000010000a488c96870600023000000000100000003d10007	ROM info — works
0x02	0404	error status
0x03	0104	error status
0x04	0404	error status
0x05	0000	OK
0x06	device disconnects	reboot command
0x07	device disconnects	reboot command
0x08	write OK, no response	—
0x09–0x20	0104 mostly	not supported
0x19	65 bytes (see below)	TLS/session info — works!
0x44	1503030002022f	version/caps
0x43 0x02	0504	fwext not loaded
0x3e	write timeout	flash info — fails

0x01 decoded (ROM Info):

chip_id:   0x545eb0f0
fw_ver:    0x000000a4
sensor?:   06070130
full:      0000f0b05e54a40000000607013000010000a488c96870600023000000000100000003d10007

0x19 response (65 bytes):

000000030102000100000000000000000000000070548ded
0200000000000000000000000000000000000000000000
000000000000000000000000000000000000000000

0x44 response:

1503030002022f  (version/capability info)

Key observations

• Sensor accepts 0x01 write but gives NO response (unlike 009a which responds immediately)
• After sending 0x01 + reading all endpoints for 15 seconds: no response on any endpoint
• Sensor locks up after first command sequence — requires USB deauthorize/authorize to reset
• The 009a init_hardcoded blob (581 bytes, starts 06020000...) times out on write
• The send_init() sequence (01 -> 19 -> 4302) fails at step 1 unless sensor is freshly reset
• 0x06 and 0x07 both trigger a USB disconnect/reboot of the sensor

Hypothesis

The 00cb chip appears to be a newer Prometheus variant that requires a
different initialization sequence before it will accept further commands.
It may need a different hardcoded blob or a pre-auth handshake not present
in the 009a driver path.

Windows USB traffic capture (Wireshark + USBPcap) would be the most
effective next step to identify the correct init sequence — unfortunately
not available in this case.

Happy to test patches if anyone wants to take this further.