Help wanted: GXFP51A0 silent after validated SPI transport; Windows common-init reconstructed

[GodsQuantum]

Current state — 2026-09-02

The original issue description is obsolete.

The old interpretation around constant MISO=0xFF, generic 0xB0 wake and
firmware upload is no longer the current research boundary.

Confirmed

• Sensor: Goodix GXFP51A0 / GF3658 Milan.
• Exact Goodix FP 1.1.141.36 maps ACPI\GXFP51A0 to transport mode 5.
• Windows mode 5 uses two separate synchronous SPB writes:
  outer 4 bytes -> 2 ms -> inner bytes.
• Linux matches that exact transaction boundary.
• Native ACPI readiness mapping resolves hardware IRQ 48, level-high.
  The Linux virtual IRQ is dynamic and must not be hardcoded.
• Main GSPI1 pads have been confirmed in native mode.
• A fresh-boot live Linux trace confirmed tested transfers reach:
  spi_set_cs -> pxa2xx_spi_set_cs -> lpss_ssp_cs_control.
• Controller completion was clean, but the sensor generated no readiness IRQ.

Important startup correction

send_driver_install_to_MCU() calls SetDriverState(Install) but does not
propagate that result as the _DeviceInit startup gate.

Windows continues into init_MCU().

The first meaningful sensor-response gate is GetEvkVersionWithRetry.

Goodix FP 1.1.141.36:

• retry_count_for_common_init compiled default = 3;
• three initial GetEvkVersion calls;
• after all three fail, if D0Exit has not started: HardResetMcu;
• the reset BOOL is ignored by this wrapper;
• exactly one final GetEvkVersion.

The Linux research harness now reproduces that control flow.

A completely silent default run is bounded at 34 physical SPI transfers.

The implementation was developed TDD-first and passed:

• expected RED;
• GREEN;
• complete research test suite;
• runtime compile;
• ASAN/UBSAN;
• GCC fanalyzer;
• source-safety checks;
• privacy and secret audits.

Help wanted now

The investigation remains software-first.

Especially useful:

• review of the exact Goodix FP 1.1.141.36 reconstruction;
• Windows WDF / IFR / WPP / ETW traces from a working GXFP51A0;
• results from another GXFP51A0 running the same startup sequence;
• Intel LPSS / pxa2xx-spi expertise, especially short-transfer DMA vs PIO and
  runtime-PM/controller state.

A hardware logic-analyzer capture is welcome from contributors who already
have one, but it is not a prerequisite for continuing this project.

Current canonical technical state:
https://github.com/GodsQuantum/huawei-matebook-fingerprint-linux/blob/main/docs/software-boundary-2026-09-02.md