[PATCH v3 0/2] Add ITE885x UCSI I2C transport driver

[PATCH v3 0/2] Add ITE885x UCSI I2C transport driver

[Edward Blair]

Some ASUS desktop boards describe the same ITE USB-C controller twice
in ACPI: as an MSFT8000 Resource Hub Proxy and as an ITE885x device at
the same I2C address. If the Resource Hub Proxy claims the address first,
the ITE device cannot be registered. Only the ITE node provides the
interrupt required by this transport.

Patch 1 handles MSFT8000 generically in the ACPI core. It keeps the ACPI
device present but prevents its SerialBus resources from being
instantiated as I2C, SPI or serdev clients.

Patch 2 adds the ITE885x UCSI transport. These controllers use
ITE-specific offsets for CCI, MESSAGE_IN, CONTROL and interrupt
handling. They do not expose a VERSION register or accept PPM_RESET
over I2C.

The register layout and reset behaviour were checked against the ITE
Windows driver supplied for this board.

Tested on an ASUS ROG Strix Z790-E Gaming WiFi with ITE8853:

- Built and booted on x86_64.
- ucsi_ite bound to ITE8853:00 without the previous -EBUSY failure.
- /sys/class/typec/port0 was registered.
- USB-C attachment detection worked.
- No UCSI, ITE or Type-C initialization errors were logged.

Suspend/resume and the ITE8800 through ITE8805 IDs have not been tested.

Changes in v3:

- Rework patch 1 as suggested by Armin: add MSFT8000 to
  ignore_serial_bus_ids[] in acpi_device_enumeration_by_parent().
- Keep the MSFT8000 ACPI device present while preventing its SerialBus
  resources from being instantiated as bus clients.
- Drop the ITE-specific ACPI x86 status override added in v2.
- Add a comment explaining why MSFT8000 is ignored during serial bus
  enumeration.
- Rebase onto current mainline and retest the series.
- Patch 2 is unchanged apart from the rebase.

Changes in v2:

- Move the v1 duplicate-device handling from the I2C core to the ACPI
  x86 status-override code, as suggested by Mika and Heikki.
- Correctly identify MSFT8000 as a Resource Hub Proxy.
- Restrict the quirk to exact matching I2C resources.
- Use devm_request_threaded_irq(), as suggested by Heikki.
- Rebase onto Linux 7.2 and update for the current UCSI API.
- Read and cache complete UCSI events before acknowledging them.
- Match the vendor transport's MESSAGE_IN and PPM_RESET behaviour.

Changes in v1:

- Initial submission.

v2: https://lore.kernel.org/all/20260825201426.47030-1-edward.blair@gmail.com/
v1: https://lore.kernel.org/all/20260314013157.7181-1-edward.blair@gmail.com/

Edward Blair (2):
  ACPI: scan: do not enumerate MSFT8000 as a serial bus slave
  usb: typec: ucsi: add ITE885x I2C transport driver

 drivers/acpi/scan.c               |   5 +
 drivers/usb/typec/ucsi/Kconfig    |  11 +
 drivers/usb/typec/ucsi/Makefile   |   1 +
 drivers/usb/typec/ucsi/ucsi_ite.c | 395 ++++++++++++++++++++++++++++++
 4 files changed, 412 insertions(+)
 create mode 100644 drivers/usb/typec/ucsi/ucsi_ite.c


base-commit: 1b78070aaef63512688aebfbc82365ef9d6660f1
-- 
2.55.0

[PATCH v3 1/2] ACPI: scan: do not enumerate MSFT8000 as a serial bus slave

[Edward Blair]

MSFT8000 represents the Windows Resource Hub Proxy. Its SerialBus
resources describe connections that Windows exposes to userspace rather
than a physical peripheral attached to a serial bus.

Treat the device like other ACPI nodes which contain SerialBus resources
without being serial bus slaves. This keeps the ACPI device present while
preventing the resources from being instantiated as I2C, SPI or serdev
clients and conflicting with the actual devices.

Suggested-by: Armin Wolf <W_Armin@gmx.de>
Signed-off-by: Edward Blair <edward.blair@gmail.com>
---
 drivers/acpi/scan.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 7dcf78419..608527cda 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1770,6 +1770,11 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device)
 	 * attached to a serial bus at all.
 	 */
 		{"MSHW0028", },
+	/*
+	 * MSFT8000 is a Windows Resource Hub Proxy device. Its SerialBus
+	 * resources grant userspace access and do not describe a slave.
+	 */
+		{"MSFT8000", },
 	/*
 	 * HIDs of device with an UartSerialBusV2 resource for which userspace
 	 * expects a regular tty cdev to be created (instead of the in kernel
-- 
2.55.0

[PATCH v3 2/2] usb: typec: ucsi: add ITE885x I2C transport driver

[Edward Blair]

Add a UCSI transport driver for ITE8853 and ITE8800 through ITE8805
USB Type-C controllers found on desktop motherboards.

These controllers expose CCI, MESSAGE_IN and CONTROL at ITE-specific I2C
offsets and signal UCSI and vendor events through a shared interrupt
status register. Read and cache each complete UCSI event before
acknowledging it so command data remains coherent between the interrupt
handler and UCSI core.

The interface does not expose a VERSION register and does not accept
PPM_RESET over I2C. Report UCSI 1.0, limit MESSAGE_IN to its 16-byte
window and handle PPM_RESET locally, matching the vendor driver's
behavior.

Signed-off-by: Edward Blair <edward.blair@gmail.com>
---
 drivers/usb/typec/ucsi/Kconfig    |  11 +
 drivers/usb/typec/ucsi/Makefile   |   1 +
 drivers/usb/typec/ucsi/ucsi_ite.c | 395 ++++++++++++++++++++++++++++++
 3 files changed, 407 insertions(+)
 create mode 100644 drivers/usb/typec/ucsi/ucsi_ite.c

diff --git a/drivers/usb/typec/ucsi/Kconfig b/drivers/usb/typec/ucsi/Kconfig
index 87dd992a4..3819c4f73 100644
--- a/drivers/usb/typec/ucsi/Kconfig
+++ b/drivers/usb/typec/ucsi/Kconfig
@@ -104,4 +104,15 @@ config UCSI_HUAWEI_GAOKUN
 	  To compile the driver as a module, choose M here: the module will be
 	  called ucsi_huawei_gaokun.
 
+config UCSI_ITE
+	tristate "UCSI Interface Driver for ITE885x"
+	depends on ACPI && I2C
+	help
+	  This driver enables UCSI support on platforms that expose an ITE8853
+	  or ITE8800-ITE8805 USB Type-C controller over I2C, commonly found
+	  on ASUS Z690/Z790/X670E motherboards.
+
+	  To compile the driver as a module, choose M here: the module will be
+	  called ucsi_ite.
+
 endif
diff --git a/drivers/usb/typec/ucsi/Makefile b/drivers/usb/typec/ucsi/Makefile
index c7e38bf01..9bc1d6bbb 100644
--- a/drivers/usb/typec/ucsi/Makefile
+++ b/drivers/usb/typec/ucsi/Makefile
@@ -28,3 +28,4 @@ obj-$(CONFIG_UCSI_PMIC_GLINK)		+= ucsi_glink.o
 obj-$(CONFIG_CROS_EC_UCSI)		+= cros_ec_ucsi.o
 obj-$(CONFIG_UCSI_LENOVO_YOGA_C630)	+= ucsi_yoga_c630.o
 obj-$(CONFIG_UCSI_HUAWEI_GAOKUN)	+= ucsi_huawei_gaokun.o
+obj-$(CONFIG_UCSI_ITE)			+= ucsi_ite.o
diff --git a/drivers/usb/typec/ucsi/ucsi_ite.c b/drivers/usb/typec/ucsi/ucsi_ite.c
new file mode 100644
index 000000000..16b22c77f
--- /dev/null
+++ b/drivers/usb/typec/ucsi/ucsi_ite.c
@@ -0,0 +1,395 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * UCSI I2C transport driver for ITE885x USB-C controllers
+ *
+ * ITE8853/ITE8800-ITE8805 are UCSI-compliant USB-C controllers found on
+ * desktop motherboards. They communicate over I2C using UCSI registers at
+ * ITE-specific offsets and signal events through a vendor interrupt register.
+ */
+
+#include <linux/acpi.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+
+#include "ucsi.h"
+
+#define ITE_REG_CCI		0x84
+#define ITE_REG_MESSAGE_IN	0x88
+#define ITE_REG_CONTROL		0x98
+#define ITE_REG_INT_ACK		0xbc
+#define ITE_REG_INT_STATUS	0xbd
+
+#define ITE_INT_VENDOR_ALERT	BIT(0)
+#define ITE_INT_CCI		BIT(1)
+#define ITE_INT_MASK		(ITE_INT_VENDOR_ALERT | ITE_INT_CCI)
+
+#define ITE_MESSAGE_IN_MAX_LEN	0x10
+
+enum ucsi_ite_event {
+	ITE_EVENT_NONE,
+	ITE_EVENT_CCI,
+	ITE_EVENT_VENDOR,
+};
+
+struct ucsi_ite {
+	struct i2c_client *client;
+	struct ucsi *ucsi;
+	struct mutex event_lock;	/* Serializes IRQ and polling */
+	struct mutex received_lock;	/* Protects CCI and message_in */
+	u8 message_in[ITE_MESSAGE_IN_MAX_LEN];
+	u32 cci;
+	bool registered;
+};
+
+static int ucsi_ite_read(struct ucsi_ite *ite, u8 reg, void *val, size_t len)
+{
+	struct i2c_client *client = ite->client;
+	struct i2c_msg msgs[] = {
+		{
+			.addr = client->addr,
+			.len = 1,
+			.buf = &reg,
+		},
+		{
+			.addr = client->addr,
+			.flags = I2C_M_RD,
+			.len = len,
+			.buf = val,
+		},
+	};
+	int ret;
+
+	ret = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
+	if (ret == ARRAY_SIZE(msgs))
+		return 0;
+
+	ret = ret < 0 ? ret : -EIO;
+	dev_err_ratelimited(&client->dev,
+			    "register 0x%02x read failed: %d\n", reg, ret);
+	return ret;
+}
+
+static int ucsi_ite_write(struct ucsi_ite *ite, u8 reg, const void *val,
+			  size_t len)
+{
+	struct i2c_client *client = ite->client;
+	u8 buf[sizeof(u64) + 1];
+	struct i2c_msg msg = {
+		.addr = client->addr,
+		.len = len + 1,
+		.buf = buf,
+	};
+	int ret;
+
+	if (len > sizeof(buf) - 1)
+		return -EINVAL;
+
+	buf[0] = reg;
+	memcpy(&buf[1], val, len);
+
+	ret = i2c_transfer(client->adapter, &msg, 1);
+	if (ret == 1)
+		return 0;
+
+	ret = ret < 0 ? ret : -EIO;
+	dev_err_ratelimited(&client->dev,
+			    "register 0x%02x write failed: %d\n", reg, ret);
+	return ret;
+}
+
+static int ucsi_ite_process_event(struct ucsi_ite *ite, u32 *cci)
+{
+	u8 message_in[ITE_MESSAGE_IN_MAX_LEN] = {};
+	__le32 raw_cci;
+	u8 status;
+	u8 len = 0;
+	int event;
+	int err = 0;
+	int ret;
+
+	mutex_lock(&ite->event_lock);
+
+	ret = ucsi_ite_read(ite, ITE_REG_INT_STATUS, &status, sizeof(status));
+	if (ret)
+		goto out_unlock;
+
+	status &= ITE_INT_MASK;
+	if (!status) {
+		mutex_lock(&ite->received_lock);
+		*cci = ite->cci;
+		mutex_unlock(&ite->received_lock);
+		ret = ITE_EVENT_NONE;
+		goto out_unlock;
+	}
+
+	if (status & ITE_INT_CCI) {
+		err = ucsi_ite_read(ite, ITE_REG_CCI, &raw_cci,
+				    sizeof(raw_cci));
+		if (!err) {
+			*cci = le32_to_cpu(raw_cci);
+			len = UCSI_CCI_LENGTH(*cci);
+
+			if (len > sizeof(message_in)) {
+				len = sizeof(message_in);
+				*cci &= ~GENMASK(15, 8);
+				*cci |= UCSI_SET_CCI_LENGTH(len);
+			}
+			if (len) {
+				err = ucsi_ite_read(ite, ITE_REG_MESSAGE_IN,
+						    message_in, len);
+			}
+		}
+	}
+
+	/* Acknowledge each latched event with the value expected by the PPM. */
+	if (status & ITE_INT_VENDOR_ALERT) {
+		u8 ack = ITE_INT_VENDOR_ALERT;
+
+		ret = ucsi_ite_write(ite, ITE_REG_INT_ACK, &ack, sizeof(ack));
+		if (ret)
+			goto out_unlock;
+	}
+
+	if ((status & ITE_INT_CCI) && !err) {
+		u8 ack = ITE_INT_CCI;
+
+		ret = ucsi_ite_write(ite, ITE_REG_INT_ACK, &ack, sizeof(ack));
+		if (ret)
+			goto out_unlock;
+	}
+
+	if (err) {
+		ret = err;
+		goto out_unlock;
+	}
+
+	if (status & ITE_INT_CCI) {
+		mutex_lock(&ite->received_lock);
+		ite->cci = *cci;
+		memset(ite->message_in, 0, sizeof(ite->message_in));
+		memcpy(ite->message_in, message_in, len);
+		mutex_unlock(&ite->received_lock);
+		event = ITE_EVENT_CCI;
+	} else {
+		mutex_lock(&ite->received_lock);
+		*cci = ite->cci;
+		mutex_unlock(&ite->received_lock);
+		event = ITE_EVENT_VENDOR;
+	}
+
+	ret = event;
+
+out_unlock:
+	mutex_unlock(&ite->event_lock);
+	return ret;
+}
+
+static int ucsi_ite_read_version(struct ucsi *ucsi, u16 *version)
+{
+	/* The ITE interface does not expose a VERSION register. */
+	*version = UCSI_VERSION_1_0;
+	return 0;
+}
+
+static int ucsi_ite_read_cci(struct ucsi *ucsi, u32 *cci)
+{
+	struct ucsi_ite *ite = ucsi_get_drvdata(ucsi);
+
+	mutex_lock(&ite->received_lock);
+	*cci = ite->cci;
+	mutex_unlock(&ite->received_lock);
+
+	return 0;
+}
+
+static int ucsi_ite_poll_cci(struct ucsi *ucsi, u32 *cci)
+{
+	struct ucsi_ite *ite = ucsi_get_drvdata(ucsi);
+	int ret;
+
+	ret = ucsi_ite_process_event(ite, cci);
+	return ret < 0 ? ret : 0;
+}
+
+static int ucsi_ite_read_message_in(struct ucsi *ucsi, void *val, size_t len)
+{
+	struct ucsi_ite *ite = ucsi_get_drvdata(ucsi);
+
+	if (len > sizeof(ite->message_in))
+		return -EINVAL;
+
+	mutex_lock(&ite->received_lock);
+	memcpy(val, ite->message_in, len);
+	mutex_unlock(&ite->received_lock);
+
+	return 0;
+}
+
+static int ucsi_ite_async_control(struct ucsi *ucsi, u64 command)
+{
+	struct ucsi_ite *ite = ucsi_get_drvdata(ucsi);
+	__le64 raw_command = cpu_to_le64(command);
+	int ret;
+
+	if (UCSI_COMMAND(command) == UCSI_PPM_RESET) {
+		/* The PPM handles reset internally; do not write it over I2C. */
+		mutex_lock(&ite->event_lock);
+		mutex_lock(&ite->received_lock);
+		ite->cci = UCSI_CCI_RESET_COMPLETE;
+		memset(ite->message_in, 0, sizeof(ite->message_in));
+		mutex_unlock(&ite->received_lock);
+		mutex_unlock(&ite->event_lock);
+		return 0;
+	}
+
+	mutex_lock(&ite->event_lock);
+	mutex_lock(&ite->received_lock);
+	ite->cci = 0;
+	memset(ite->message_in, 0, sizeof(ite->message_in));
+	mutex_unlock(&ite->received_lock);
+	ret = ucsi_ite_write(ite, ITE_REG_CONTROL, &raw_command,
+			     sizeof(raw_command));
+	mutex_unlock(&ite->event_lock);
+
+	return ret;
+}
+
+static const struct ucsi_operations ucsi_ite_ops = {
+	.read_version = ucsi_ite_read_version,
+	.read_cci = ucsi_ite_read_cci,
+	.poll_cci = ucsi_ite_poll_cci,
+	.read_message_in = ucsi_ite_read_message_in,
+	.sync_control = ucsi_sync_control_common,
+	.async_control = ucsi_ite_async_control,
+};
+
+static irqreturn_t ucsi_ite_irq(int irq, void *data)
+{
+	struct ucsi_ite *ite = data;
+	u32 cci;
+	int ret;
+
+	ret = ucsi_ite_process_event(ite, &cci);
+	if (ret == ITE_EVENT_NONE)
+		return IRQ_NONE;
+	if (ret < 0)
+		return IRQ_HANDLED;
+
+	if (ret == ITE_EVENT_CCI)
+		ucsi_notify_common(ite->ucsi, cci);
+
+	return IRQ_HANDLED;
+}
+
+static void ucsi_ite_destroy(void *data)
+{
+	struct ucsi_ite *ite = data;
+
+	if (ite->registered)
+		ucsi_unregister(ite->ucsi);
+	ucsi_destroy(ite->ucsi);
+}
+
+static int ucsi_ite_probe(struct i2c_client *client)
+{
+	struct device *dev = &client->dev;
+	struct ucsi_ite *ite;
+	u32 cci;
+	int ret;
+
+	if (client->irq <= 0)
+		return dev_err_probe(dev, -ENODEV, "no IRQ provided\n");
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C))
+		return dev_err_probe(dev, -EOPNOTSUPP,
+				     "adapter does not support I2C transfers\n");
+
+	ite = devm_kzalloc(dev, sizeof(*ite), GFP_KERNEL);
+	if (!ite)
+		return -ENOMEM;
+
+	ite->client = client;
+	mutex_init(&ite->event_lock);
+	mutex_init(&ite->received_lock);
+	i2c_set_clientdata(client, ite);
+
+	ite->ucsi = ucsi_create(dev, &ucsi_ite_ops);
+	if (IS_ERR(ite->ucsi))
+		return dev_err_probe(dev, PTR_ERR(ite->ucsi),
+				     "failed to create UCSI interface\n");
+
+	ret = devm_add_action_or_reset(dev, ucsi_ite_destroy, ite);
+	if (ret)
+		return ret;
+
+	ucsi_set_drvdata(ite->ucsi, ite);
+
+	ret = devm_request_threaded_irq(dev, client->irq, NULL,
+					ucsi_ite_irq, IRQF_ONESHOT,
+					dev_name(dev), ite);
+	if (ret)
+		return dev_err_probe(dev, ret, "failed to request IRQ\n");
+
+	ret = ucsi_ite_process_event(ite, &cci);
+	if (ret < 0)
+		dev_warn(dev, "initial event processing failed: %d\n", ret);
+
+	ret = ucsi_register(ite->ucsi);
+	if (ret)
+		return dev_err_probe(dev, ret,
+				     "failed to register UCSI interface\n");
+
+	ite->registered = true;
+	return 0;
+}
+
+static int ucsi_ite_suspend(struct device *dev)
+{
+	struct ucsi_ite *ite = dev_get_drvdata(dev);
+	int ret;
+
+	disable_irq(ite->client->irq);
+	ret = ucsi_suspend(ite->ucsi);
+	if (ret)
+		enable_irq(ite->client->irq);
+
+	return ret;
+}
+
+static int ucsi_ite_resume(struct device *dev)
+{
+	struct ucsi_ite *ite = dev_get_drvdata(dev);
+
+	enable_irq(ite->client->irq);
+	return ucsi_resume(ite->ucsi);
+}
+
+static DEFINE_SIMPLE_DEV_PM_OPS(ucsi_ite_pm, ucsi_ite_suspend,
+				ucsi_ite_resume);
+
+static const struct acpi_device_id ucsi_ite_acpi_ids[] = {
+	{ "ITE8853" },
+	{ "ITE8800" },
+	{ "ITE8801" },
+	{ "ITE8802" },
+	{ "ITE8803" },
+	{ "ITE8804" },
+	{ "ITE8805" },
+	{ }
+};
+MODULE_DEVICE_TABLE(acpi, ucsi_ite_acpi_ids);
+
+static struct i2c_driver ucsi_ite_driver = {
+	.driver = {
+		.name = "ucsi_ite",
+		.acpi_match_table = ucsi_ite_acpi_ids,
+		.pm = pm_sleep_ptr(&ucsi_ite_pm),
+	},
+	.probe = ucsi_ite_probe,
+};
+module_i2c_driver(ucsi_ite_driver);
+
+MODULE_AUTHOR("Edward Blair <edward.blair@gmail.com>");
+MODULE_DESCRIPTION("UCSI I2C transport driver for ITE885x USB-C controllers");
+MODULE_LICENSE("GPL");
-- 
2.55.0

Re: [PATCH v3 1/2] ACPI: scan: do not enumerate MSFT8000 as a serial bus slave

[Armin Wolf]

Am 29.08.26 um 16:55 schrieb Edward Blair:

> MSFT8000 represents the Windows Resource Hub Proxy. Its SerialBus
> resources describe connections that Windows exposes to userspace rather
> than a physical peripheral attached to a serial bus.
>
> Treat the device like other ACPI nodes which contain SerialBus resources
> without being serial bus slaves. This keeps the ACPI device present while
> preventing the resources from being instantiated as I2C, SPI or serdev
> clients and conflicting with the actual devices.

Reviewed-by: Armin Wolf <W_Armin@gmx.de>

> Suggested-by: Armin Wolf <W_Armin@gmx.de>
> Signed-off-by: Edward Blair <edward.blair@gmail.com>
> ---
>   drivers/acpi/scan.c | 5 +++++
>   1 file changed, 5 insertions(+)
>
> diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
> index 7dcf78419..608527cda 100644
> --- a/drivers/acpi/scan.c
> +++ b/drivers/acpi/scan.c
> @@ -1770,6 +1770,11 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device)
>   	 * attached to a serial bus at all.
>   	 */
>   		{"MSHW0028", },
> +	/*
> +	 * MSFT8000 is a Windows Resource Hub Proxy device. Its SerialBus
> +	 * resources grant userspace access and do not describe a slave.
> +	 */
> +		{"MSFT8000", },
>   	/*
>   	 * HIDs of device with an UartSerialBusV2 resource for which userspace
>   	 * expects a regular tty cdev to be created (instead of the in kernel