[138a:0090] VFS7500 W25Q80B: 5 partitions + FF cert, 0404 on partition/write, 04af on erase — no recovery path - Thinkpad T460p #287

Activity

1. soulsplit

   changed the title [-][138a:0090] VFS7500 W25Q80B: 5 partitions + FF cert, 0404 on partition/write, 04af on erase — no recovery path[/-] [+][138a:0090] VFS7500 W25Q80B: 5 partitions + FF cert, 0404 on partition/write, 04af on erase — no recovery path - Thinkpad T460p[/+] on Sep 23, 2026
2. ejneborn commented on Oct 7, 2026

   

   ejneborn

   on Oct 7, 2026

   More actions

   Same problem here on a ThinkPad T460s (138a:0090, flash IC detected as W25Q80B). Pairing fails at the same step every time, even right after a successful factory reset.

   Environment

   • Arch Linux (Omarchy), kernel 7.2.5, Python 3.14.7
   • python-validity 0.15 (AUR), open-fprintd 0.7, fprintd-clients-git 1.90.1.r2, python-pyusb 1.3.1, libusb 1.0.30
   • BIOS N1CET81W (1.49)
   • Firmware: 6_07f_Lenovo.xpfwext from n1cgn08w.exe (downloaded by validity-sensors-firmware, hash OK)

   What happens

   1. The first run of the service (before the firmware had been downloaded) found an unpartitioned flash (Flash was not initialized yet. Formatting...). The 4f partition command succeeded, then 3f01 (erase partition 1) returned 04af.
   2. The service then crash-looped (Restart=on-failure, also started by the udev rule) with 0315, 0401, 0406 and USB timeouts in get_flash_info. While it was in that state, factory-reset.py failed with 0401 on reset_blob.
   3. After a cold boot with the service masked, factory-reset.py completed without errors. Running dbus-service --debug by hand straight afterwards, with the firmware present in /run/python-validity/:

     File "/usr/lib/python3.14/site-packages/validitysensor/init.py", line 31, in open_common
       init_flash()
     File "/usr/lib/python3.14/site-packages/validitysensor/init_flash.py", line 172, in init_flash
       erase_flash(1)
     File "/usr/lib/python3.14/site-packages/validitysensor/flash.py", line 126, in erase_flash
       assert_status(tls.cmd(pack('<BB', 0x3f, partition)))
     File "/usr/lib/python3.14/site-packages/validitysensor/util.py", line 12, in assert_status
       raise Exception('Failed: %04x' % s)
   Exception: Failed: 04af
   

   4. On later starts, init_flash sees the existing partitions (Flash has 11 partitions. / Clean slate) and returns early, so read_tls_flash() → read_flash(1, 0, 0x1000) fails with 04af too. The only way out is another factory reset, after which it fails at the same erase_flash(1) again.

   So the sensor accepts the 0090 partition layout and signature, but rejects erasing partition 1 straight after the TLS session is opened. I'm happy to test patches or collect full --debug logs if that helps.