[Bug 221776] New: HP OmniBook X Flip - Broken UCSI firmware / Slow charging

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=221776

            Bug ID: 221776
           Summary: HP OmniBook X Flip - Broken UCSI firmware / Slow
                    charging
           Product: Drivers
           Version: 2.5
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: USB
          Assignee: drivers_usb@kernel-bugs.kernel.org
          Reporter: daviddelsol1998@gmail.com
        Regression: No

The HP OmniBook X Flip has a non-compliant UCSI firmware in its
Embedded Controller. The EC accepts only read-only UCSI commands
(GET_VERSION, GET_CONNECTOR_STATUS) but rejects all control/write
commands (SET_NOTIFICATION_ENABLE, PPM_RESET, CONNECTOR_RESET,
and any _DSM WRITE function calls).

When the ucsi_acpi driver loads and attempts to use UCSI for
USB PD negotiation, the EC state eventually becomes corrupted.
This causes USB PD to drop from 20V (65W) to 5V (~2W to battery),
severely limiting charging speed.

The corruption persists across reboots and even warm reboots.
Only a full EC reset (shutdown + unplug + 30s power drain + replug)
restores normal PD negotiation.

WORKAROUND:
Blacklist ucsi_acpi (module_blacklist=ucsi_acpi on kernel cmdline).
Without UCSI, Linux doesn't talk to the broken EC firmware, the
charger negotiates PD directly, and charging works at 25-30W
(expected "normal speed" with system running).

REPRODUCE:
1. Boot with ucsi_acpi loaded (default)
2. Plug in the 65W USB-C PD charger
3. Wait 30-60 seconds
4. Observe charging current drop from ~25W to ~2W via
/sys/class/power_supply/BAT0/power_now
5. After that, pd voltage locked at 5V (visible via
/sys/class/typec/port0/pd_data)

ROOT CAUSE:
The EC UCSI firmware at ACPI path PNP0CA0 implements the _DSM
(UCSI DSM UUID: 6f8398c2-7ca4-11e4-ad36-631042b5008f) but returns
error for function 1 (WRITE). The ucsi_acpi driver's
ucsi_acpi_async_control() calls _DSM WRITE to send UCSI commands
to the EC mailbox, but these writes either fail or silently corrupt
the EC's internal state.

DIAGNOSTIC EVIDENCE:
  - acpi_call test: _DSM function 1 (WRITE) fails with error
  - UCSI debugfs GET_CONNECTOR_STATUS succeeds
  - UCSI debugfs PPM_RESET/CONNECTOR_RESET returns EOPNOTSUPP
  - After ucsi_acpi loads, /sys/class/typec/port0/power_role shows
    "sink" even though charger is capable of sourcing
  - After corruption, /sys/kernel/debug/usb/ucsi/*/status shows
    PD contract at 5V/3A instead of 20V/3.25A
  - Blacklisting ucsi_acpi + EC reset restores proper PD negotiation

PROPOSED FIX:
Add DMI quirk to ucsi_acpi.c to skip the driver on this hardware:

--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
+++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
@@ -79,6 +79,17 @@ static const struct dmi_system_id ucsi_acpi_quirks[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "90Q"),
                },
                .driver_data = (void *)&ucsi_gram_ops,
+       },
+       {
+               /*
+                * HP OmniBook X Flip has broken UCSI firmware that rejects all
+                * control commands (SET_NOTIFICATION_ENABLE, PPM_RESET, etc.).
+                * Skip UCSI to avoid corrupting EC state and losing PD
negotiation.
+                */
+               .matches = {
+                       DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+                       DMI_MATCH(DMI_PRODUCT_NAME, "HP OmniBook X Flip Laptop
16-ar0xxx"),
+               },
        },
        { }
 };
@@ -213,6 +224,11 @@ static int ucsi_acpi_probe(struct platform_device *pdev)
        ua->dev = &pdev->dev;

        id = dmi_first_match(ucsi_acpi_quirks);
+       if (id && !id->driver_data) {
+               dev_info(&pdev->dev, "broken UCSI firmware, skipping
driver\n");
+               return -ENODEV;
+       }
        if (id)
                ops = id->driver_data;

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.