Re: [PATCH] usb: typec: ucsi: acpi: Disable on devices with broken firmware
From: Rong Zhang
Date: Mon May 11 2026 - 15:23:24 EST
(+CC Mark Pearson from Lenovo)
Hi Greg,
On Mon, 2026-05-11 at 20:25 +0200, Greg Kroah-Hartman wrote:
> On Tue, May 12, 2026 at 01:59:34AM +0800, Rong Zhang wrote:
> > Some Lenovo devices have broken firmware, which reads/writes half-valid-
> > half-garbage values.
>
> How does this work with this firmware on other operating systems?
>
The timeout can hardly reached unless a bunch of events cause multiple
drivers to compete for the same mutex simultaneously.
If other operating systems' UCSI drivers don't send any command during
power events, they won't suffer from the mutex acquisition timeout.
Also, if other drivers on these operating systems don't touch the mutex
on power events at all, their UCSI drivers should work well too.
These operating systems' UCSI drivers are powered by undefined behavior
(TM) in both cases.
> What
> is the odds of fixing the firmware?
They are not Linux-certified devices, so Lenovo is very unlikely to fix
the firmware unless it breaks Windows :(
Quoting Mark Pearson's reply to the bugzilla thread:
I can't promise anything - I don't have any official levers to pull for
this platform I'm afraid (it is better to buy Linux supported/certified
systems ;) )
https://bugzilla.kernel.org/show_bug.cgi?id=221065#c38
>
> > Given that everything is broken, disable ucsi_acpi on these devices. The
> > impact of disabling it is minimal, as Lenovo laptops usually have most
> > USCI commands more or less stubbed, and the EC can always handles USB-C
> > events on its own.
> >
> > Link: https://bugzilla.kernel.org/show_bug.cgi?id=221065#c33
> > Signed-off-by: Rong Zhang <i@xxxxxxxx>
> > ---
> > drivers/usb/typec/ucsi/ucsi_acpi.c | 91 ++++++++++++++++++++++++++++++++++++++
> > 1 file changed, 91 insertions(+)
> >
> > diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c
> > index 6b92f296e985..7632b441d401 100644
> > --- a/drivers/usb/typec/ucsi/ucsi_acpi.c
> > +++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
> > @@ -155,6 +155,91 @@ static const struct dmi_system_id ucsi_acpi_quirks[] = {
> > { }
> > };
> >
> > +static const struct dmi_system_id ucsi_acpi_broken_devices[] = {
> > + /* Firmware reads/writes half-valid-half-garbage values. */
> > +
> > + /* BIOS: P1CN??WW */
> > + {
> > + .ident = "Lenovo IdeaPad 5 2-in-1 14AHP9",
> > + .matches = {
> > + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> > + DMI_MATCH(DMI_PRODUCT_NAME, "83DR"),
> > + },
> > + },
> > + {
> > + .ident = "Lenovo IdeaPad 5 2-in-1 16AHP9",
> > + .matches = {
> > + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> > + DMI_MATCH(DMI_PRODUCT_NAME, "83DS"),
> > + },
> > + },
> > +
> > + /* BIOS: R0CN??WW */
> > + {
> > + .ident = "Lenovo IdeaPad Slim 5 14AKP10",
> > + .matches = {
> > + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> > + DMI_MATCH(DMI_PRODUCT_NAME, "83NJ"),
> > + },
> > + },
> > + {
> > + .ident = "Lenovo IdeaPad Slim 5 14AKP10",
> > + .matches = {
> > + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> > + DMI_MATCH(DMI_PRODUCT_NAME, "83HX"),
> > + },
> > + },
> > + {
> > + .ident = "Lenovo IdeaPad Slim 5 16AKP10",
> > + .matches = {
> > + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> > + DMI_MATCH(DMI_PRODUCT_NAME, "83HY"),
> > + },
> > + },
> > +
> > + /* BIOS: QXCN??WW */
> > + {
> > + .ident = "Lenovo Yoga 7 2-in-1 14AKP10",
> > + .matches = {
> > + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> > + DMI_MATCH(DMI_PRODUCT_NAME, "83JR"),
> > + },
> > + },
> > + {
> > + .ident = "Lenovo Yoga 7 2-in-1 16AKP10",
> > + .matches = {
> > + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> > + DMI_MATCH(DMI_PRODUCT_NAME, "83JU"),
> > + },
> > + },
> > +
> > + /* BIOS: LNCN??WW */
> > + {
> > + .ident = "Lenovo Yoga Pro 7 14ARP8",
> > + .matches = {
> > + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> > + DMI_MATCH(DMI_PRODUCT_NAME, "83AU"),
> > + },
> > + },
> > + {
> > + .ident = "Lenovo Slim Pro 7 14ARP8",
> > + .matches = {
> > + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> > + DMI_MATCH(DMI_PRODUCT_NAME, "83AX"),
> > + },
> > + },
> > +
> > + /* BIOS: PSCN??WW */
> > + {
> > + .ident = "Lenovo Yoga Pro 7 14ASP9",
> > + .matches = {
> > + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> > + DMI_MATCH(DMI_PRODUCT_NAME, "83HN"),
> > + },
> > + },
> > + { }
> > +};
>
> That is a lot of devices to exclude, are you sure that none of them will
> ever work properly?
Yes. I carefully checked all acpidumps for these devices provided by
device owners who replied to the bugzilla thread, and confirmed that
they all share the same UCSI-ACPI implementation.
83DR, 83HN, 83HY, 83AU, 83JR are owned by these device owners. Other
devices share the same BIOS images (see comments in the match table), so
I added them as well.
Device owners also reported their dmesg dumps/snips with ucsi_acpi
errors.
As a reference, buggy ASL methods are shown as below.
\_SB.PCI0.LPC0.EC0:
Method (ECRD, 1, Serialized)
{
Local0 = Acquire (ECMT, 0x03E8)
If ((Local0 == Zero))
{
If (ECAV)
{
Local1 = DerefOf (Arg0)
Release (ECMT)
Return (Local1)
}
Else
{
Release (ECMT)
}
}
Return (Zero)
}
Method (ECWT, 2, Serialized)
{
Local0 = Acquire (ECMT, 0x03E8)
If ((Local0 == Zero))
{
If (ECAV)
{
Arg1 = Arg0
}
Release (ECMT)
}
}
\_SB.UBTC:
Method (ECWR, 0, Serialized)
{
IO80 = 0xD0
\_SB.PCI0.LPC0.EC0.ECWT (MGO0, RefOf (\_SB.PCI0.LPC0.EC0.MGO0))
\_SB.PCI0.LPC0.EC0.ECWT (MGO1, RefOf (\_SB.PCI0.LPC0.EC0.MGO1))
\_SB.PCI0.LPC0.EC0.ECWT (MGO2, RefOf (\_SB.PCI0.LPC0.EC0.MGO2))
\_SB.PCI0.LPC0.EC0.ECWT (MGO3, RefOf (\_SB.PCI0.LPC0.EC0.MGO3))
\_SB.PCI0.LPC0.EC0.ECWT (MGO4, RefOf (\_SB.PCI0.LPC0.EC0.MGO4))
\_SB.PCI0.LPC0.EC0.ECWT (MGO5, RefOf (\_SB.PCI0.LPC0.EC0.MGO5))
\_SB.PCI0.LPC0.EC0.ECWT (MGO6, RefOf (\_SB.PCI0.LPC0.EC0.MGO6))
\_SB.PCI0.LPC0.EC0.ECWT (MGO7, RefOf (\_SB.PCI0.LPC0.EC0.MGO7))
\_SB.PCI0.LPC0.EC0.ECWT (MGO8, RefOf (\_SB.PCI0.LPC0.EC0.MGO8))
\_SB.PCI0.LPC0.EC0.ECWT (MGO9, RefOf (\_SB.PCI0.LPC0.EC0.MGO9))
\_SB.PCI0.LPC0.EC0.ECWT (MGOA, RefOf (\_SB.PCI0.LPC0.EC0.MGOA))
\_SB.PCI0.LPC0.EC0.ECWT (MGOB, RefOf (\_SB.PCI0.LPC0.EC0.MGOB))
\_SB.PCI0.LPC0.EC0.ECWT (MGOC, RefOf (\_SB.PCI0.LPC0.EC0.MGOC))
\_SB.PCI0.LPC0.EC0.ECWT (MGOD, RefOf (\_SB.PCI0.LPC0.EC0.MGOD))
\_SB.PCI0.LPC0.EC0.ECWT (MGOE, RefOf (\_SB.PCI0.LPC0.EC0.MGOE))
\_SB.PCI0.LPC0.EC0.ECWT (MGOF, RefOf (\_SB.PCI0.LPC0.EC0.MGOF))
\_SB.PCI0.LPC0.EC0.ECWT (CTL0, RefOf (\_SB.PCI0.LPC0.EC0.CTL0))
\_SB.PCI0.LPC0.EC0.ECWT (CTL1, RefOf (\_SB.PCI0.LPC0.EC0.CTL1))
\_SB.PCI0.LPC0.EC0.ECWT (CTL2, RefOf (\_SB.PCI0.LPC0.EC0.CTL2))
\_SB.PCI0.LPC0.EC0.ECWT (CTL3, RefOf (\_SB.PCI0.LPC0.EC0.CTL3))
\_SB.PCI0.LPC0.EC0.ECWT (CTL4, RefOf (\_SB.PCI0.LPC0.EC0.CTL4))
\_SB.PCI0.LPC0.EC0.ECWT (CTL5, RefOf (\_SB.PCI0.LPC0.EC0.CTL5))
\_SB.PCI0.LPC0.EC0.ECWT (CTL6, RefOf (\_SB.PCI0.LPC0.EC0.CTL6))
\_SB.PCI0.LPC0.EC0.ECWT (CTL7, RefOf (\_SB.PCI0.LPC0.EC0.CTL7))
\_SB.PCI0.LPC0.EC0.ECWT (0xE0, RefOf (\_SB.PCI0.LPC0.EC0.USDC))
IO80 = 0xD1
}
Method (ECRD, 0, Serialized)
{
IO80 = 0xD3
MGI0 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGI0))
MGI1 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGI1))
MGI2 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGI2))
MGI3 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGI3))
MGI4 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGI4))
MGI5 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGI5))
MGI6 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGI6))
MGI7 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGI7))
MGI8 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGI8))
MGI9 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGI9))
MGIA = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGIA))
MGIB = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGIB))
MGIC = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGIC))
MGID = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGID))
MGIE = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGIE))
MGIF = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.MGIF))
VER1 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.VER1))
VER2 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.VER2))
RSV1 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.RSV1))
RSV2 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.RSV2))
CCI0 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.CCI0))
CCI1 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.CCI1))
CCI2 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.CCI2))
CCI3 = \_SB.PCI0.LPC0.EC0.ECRD (RefOf (\_SB.PCI0.LPC0.EC0.CCI3))
\_SB.PCI0.LPC0.EC0.ECWT (0xE1, RefOf (\_SB.PCI0.LPC0.EC0.USGC))
IO80 = 0xD4
}
Method (_DSM, 4, Serialized) // _DSM: Device-Specific Method
{
If ((Arg0 == ToUUID ("6f8398c2-7ca4-11e4-ad36-631042b5008f") /* Unknown UUID */))
{
If ((ToInteger (Arg2) == Zero))
{
Return (Buffer (One)
{
0x0F // .
})
}
ElseIf ((ToInteger (Arg2) == One))
{
ECWR ()
}
ElseIf ((ToInteger (Arg2) == 0x02))
{
ECRD ()
}
Else
{
Return (Zero)
}
}
Return (Zero)
}
}
Thanks,
Rong
>
> thanks,
>
> greg k-h