T480: replace fingerprint reader with Framework Goodix module (accuracy/speed/multi-finger)

[landsman]

Problem

The stock T480 fingerprint reader (Synaptics Validity 06cb:009a) is slow and unreliable — usually takes all 3 pam_fprintd attempts and still misses most of the time. Only one finger is currently enrolled. Want: faster/more accurate matching, multiple enrolled fingers.

Root cause of the current bad UX is almost certainly a poor on-chip template from a single enrollment done during the flaky-USB-on-resume period (see fix-validity-fingerprint in system/) — not something a driver swap fixes, since no better driver exists for 06cb:009a (upstream libfprint lists it unsupported; python-validity/open-fprintd is the only option and is already what's installed).

Decision: replace the sensor module

Researched alternatives (driver support, accuracy, sourcing risk) — see conversation log for full trail. Summary of what was ruled out and why:

• Re-enroll on the existing 009a chip — cheap, but ceiling is capped by the chip itself; doesn't address "want it fast and it never misses."
• Native/no-blob libfprint sensors (ELAN swipe, old UPEK/AES, DigitalPersona) — confirmed via fprint.freedesktop.org + community reports that these have measurably worse match quality (small imaging area, sparse minutiae, low verification rates) — a downgrade, not an upgrade.
• Newer Synaptics Prometheus (06cb:00bd) pulled from a donor ThinkPad (T490s/T14s/P53) — good accuracy (TOD-supported, match-on-chip), but:
  • Needs a proprietary TOD blob, gated by PID (must confirm the exact board revision's PID is in the current libfprint-2-tod1-synaptics package before buying).
  • Same chip family as python-validity, which is documented (uunicorn/python-validity#15) to require a dedicated factory-reset, not just template deletion, to move to a new host — normal fprintd-delete / Windows Hello "remove fingerprint" does not clear the host-pairing/TLS state. Risk of ending up with a sensor that refuses to (re)pair, with no way to force a reset from outside (closed driver).
• Framework Laptop Fingerprint Reader Kit (Goodix 27c6:609c) — chosen option, see below.

Why Framework's module wins

• Native, upstream libfprint driver (libfprint >= 1.92) — submitted by Framework's own firmware engineer, not a reverse-engineered TOD blob. No PID-gating gamble, no blob to trust.
• Match-on-chip accuracy, same class as the Prometheus option.
• Official firmware updates via fwupd/LVFS — actively maintained, unlike Prometheus (fwupd has no update path for it).
• No host-pairing/reset risk: security research on this sensor (community.frame.work "A Touch of Pwn" thread) points out the opposite problem — the host does not strongly authenticate the sensor's identity. There's no documented hard pairing lock like the Synaptics/Validity family. A previously-used (e.g. refurbished) unit should be safe to reuse with a plain fprintd-delete — no special factory-reset tooling needed.
• Documented pinout (CC BY 4.0, FrameworkComputer/Framework-Laptop-13 repo) — no reverse-engineering needed for the wiring.
• Sold new/refurbished directly by Framework (not a used pull from an unknown machine) — matches the "reset it myself before pulling" intent, but with much lower residual risk than the ThinkPad donor path.

1st Gen vs 2nd Gen kit: functionally identical (same Goodix chip, same accuracy/firmware). 2nd Gen only changes LED uniformity/PWM dimming — irrelevant here since the LED pins won't be wired up (see below). Buy whichever is cheaper, 1st Gen refurbished is fine.

Parts

• Framework Laptop 13 Fingerprint Reader Kit (Goodix 27c6:609c) — https://frame.work/products/fingerprint-reader-kit — 1st Gen refurbished is fine, no functional difference vs 2nd Gen for this use.

Pinout (from Framework's official docs — 10-pin Kyocera connector)

Pin	Signal	Used?
1	VBUS (5V)	Yes
2	USB D+	Yes
3	USB D−	Yes
4	GND	Yes
5	FPR_CTRL	No
6	SWITCH	No
7–10	LED (W/G/R/COM)	No — driven by Framework's own EC firmware for the power-button LED, not by the sensor's scan state. Would need custom logic (fprintd D-Bus signal + a T480-side GPIO) to repurpose as a "sensor active" indicator; not a plug-and-play wire. Separate stretch goal, not required for core functionality.

Only pins 1–4 (standard USB) are needed for fingerprint function.

Steps

1. Buy the Framework Fingerprint Reader Kit (refurbished 1st Gen acceptable).
2. On arrival, sanity-check lsusb shows 27c6:609c.
3. Confirm libfprint --version on the T480 is >= 1.92 (already true on current Kubuntu 26.04 install — no TOD package needed).
4. Identify the T480's internal USB header/ZIF that currently feeds the 009a reader (multimeter continuity check against the stock cable to confirm VBUS/D+/D−/GND pin identity).
5. Wire pins 1–4 of the Framework module to that internal USB source.
6. Mount the sensor under the palmrest — it will not drop into the original 009a cutout; expect to fix it in place (screw/tape) and adapt the window opening as needed.
7. fprintd-delete "$USER" to clear any leftover enrollment from a refurbished unit, then enroll multiple fingers:

   for f in right-index-finger left-index-finger right-thumb left-thumb; do
     fprintd-enroll -f "$f"
   done

8. Run fwupdmgr refresh && fwupdmgr get-updates post-install to pick up any firmware fixes.

Open risks / unknowns to validate hands-on

• Exact T480-side ZIF pin mapping isn't documented anywhere found — needs a multimeter check against the original cable before wiring.
• No confirmed report of anyone doing this exact swap (Framework sensor into a T480) — physical mounting is a DIY fit, not a known-good repro.
• LED "active scan" replication is a nice-to-have, not core — track separately if wanted later.