Hi Ruslan,

On Wednesday, 21 October 2026 15:40:34 GMT Ruslan Koreev wrote:
> Rillian, could you share the relevant SPB trace, including mode, current
> and timeout writes, together with the installed driver version?

Driver versions: the X9-15 Gen 1 values are from the Windows install on
my machine. The X1 Carbon Gen 14 values are from the current package on
Lenovo's support site.

X9-15 Gen 1:
- lm3643.inf/.sys 70.26100.2.18321 (02/20/2025)
- IR sensor: HM1092, hm1092.inf 70.26100.2.18321
- FlashLEDsIntensity = 0x3C64 (lm3643.inf)
- IRFlashLedIntensity = 40 (hm1092.inf)

X1 Carbon Gen 14:
- lm3643.inf 71.26100.10.21060 (08/05/2026) however lm3643.sys contradicts
  with 71.26100.23.21060
- IR sensor: VD55G1, TBE0020A1.inf 71.26100.10.21060
- FlashLEDsIntensity = 0x3C64 (lm3643.inf)
- IRFlashLedIntensity = 30 (TBE0020A1.inf)

Both lm3643.inf files bind ACPI\TXNW3643 and ACPI\INT347D. Apart from
the version, they differ only in where DeviceCharacteristics/Security
are written. The registry on the X9 matches the INF defaults.

Before I submitted the DMI software node patch, I had seen that the
Carbon had a different driver version and a different IRFlashLedIntensity.
That is why I didn't reuse its values for the X9.

I traced Microsoft-Windows-SPB-ClassExtension (analytic) during a
Windows Hello face unlock on the X9. Every write to the LM3643 is
preceded by a read of the same register. Register decodes are from
SNVS967A.

Start of the session (once, after the controller entered D0):
  R 0x0A=00  R 0x0B=00  R 0x01=03  R 0x0C=02
  R 0x07=09 -> W 0x07=09   boost config, POR default (2 MHz, 2.8 A ILIM,
                           short detect on)
  W 0x01=03                standby, LED1+LED2 enable, TX pin enable off
                           (POR is 0x80)
  W 0x08=00                no torch ramp, flash timeout 10 ms

Per pulse (repeats every ~133 ms):
  W 0x01=03                standby
  W 0x08=0F                no torch ramp, flash timeout 400 ms
  W 0x03=99                bit7 = LED2 flash current override (LED2 = LED1),
                           code 0x19 -> 25 x 11.725 + 10.9 = ~304 mA per
                           LED (~608 mA total)
  W 0x01=0F                flash mode (M1,M0=11), LED1+LED2  <- LED on
  ... ~65 ms ...
  W 0x08=00                timeout set to 10 ms while the flash is running
  W 0x01=03                standby                           <- LED off
  R 0x0A=01  R 0x0B=00     Flags1 bit0 = flash time-out flag (0x00 after
                           the first pulse, 0x01 after every later pulse)

This unlock had 6 pulses. The last one was turned off after ~3 ms, once
the face was recognised. The driver never wrote the torch registers
(0x05/0x06) or the LED2 flash register (0x04), and never used IR mode,
STROBE or TX. The only values written to 0x01 were 0x03 and 0x0F.

The LM3643 transactions with timestamps are attached. The raw ETL/XML
trace is available on request.

--
Rillian Grant