ucsi_find_fwnode() currently maps UCSI connectors to Device tree
connector nodes based on the order in which connector child nodes
are described in DT.

This can fail because the ordering of child nodes isn't guaranteed
in Device-tree. For example, DTB may contain connector@1 before
connector@0, causing connector numbers to be associated with the wrong
fwnode. As a result, role switch and Type-C notifications can be
delivered to the wrong remote endpoints.

Fix this by using the "reg" property of each connector to match
its corresponding fwnode. While at it, if the reg property isn't
present, then fall back to the old method.

Fixes: c1b0bc2dabfa ("usb: typec: Add support for UCSI interface")
Cc: stable@vger.kernel.org
Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
---
 drivers/usb/typec/ucsi/ucsi.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index bef3f9b71d71..c1450639c795 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -1801,10 +1801,21 @@ static struct fwnode_handle *ucsi_find_fwnode(struct ucsi_connector *con)
 {
 	struct fwnode_handle *fwnode;
 	int i = 1;
+	int ret;
+	u32 port;
 
-	device_for_each_child_node(con->ucsi->dev, fwnode)
-		if (i++ == con->num)
-			return fwnode;
+	device_for_each_child_node(con->ucsi->dev, fwnode) {
+		ret = fwnode_property_read_u32(fwnode, "reg", &port);
+		if (ret < 0) {
+			if (i == con->num)
+				return fwnode;
+		} else {
+			if (port == con->num - 1)
+				return fwnode;
+		}
+
+		i++;
+	}
 	return NULL;
 }
 
-- 
2.34.1

On Wed, Sep 16, 2026 at 09:58:08AM +0530, Prashanth K wrote:
> ucsi_find_fwnode() currently maps UCSI connectors to Device tree
> connector nodes based on the order in which connector child nodes
> are described in DT.
> 
> This can fail because the ordering of child nodes isn't guaranteed
> in Device-tree. For example, DTB may contain connector@1 before
> connector@0, causing connector numbers to be associated with the wrong
> fwnode. As a result, role switch and Type-C notifications can be
> delivered to the wrong remote endpoints.
> 
> Fix this by using the "reg" property of each connector to match
> its corresponding fwnode. While at it, if the reg property isn't
> present, then fall back to the old method.
> 
> Fixes: c1b0bc2dabfa ("usb: typec: Add support for UCSI interface")

That commit does not yet include any kind of support for DT.

Thanks,

> Cc: stable@vger.kernel.org
> Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
> ---
>  drivers/usb/typec/ucsi/ucsi.c | 17 ++++++++++++++---
>  1 file changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index bef3f9b71d71..c1450639c795 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -1801,10 +1801,21 @@ static struct fwnode_handle *ucsi_find_fwnode(struct ucsi_connector *con)
>  {
>  	struct fwnode_handle *fwnode;
>  	int i = 1;
> +	int ret;
> +	u32 port;
>  
> -	device_for_each_child_node(con->ucsi->dev, fwnode)
> -		if (i++ == con->num)
> -			return fwnode;
> +	device_for_each_child_node(con->ucsi->dev, fwnode) {
> +		ret = fwnode_property_read_u32(fwnode, "reg", &port);
> +		if (ret < 0) {
> +			if (i == con->num)
> +				return fwnode;
> +		} else {
> +			if (port == con->num - 1)
> +				return fwnode;
> +		}
> +
> +		i++;
> +	}
>  	return NULL;
>  }
>  
> -- 
> 2.34.1

-- 
heikki

On 9/18/2026 2:48 PM, Heikki Krogerus wrote:
> On Wed, Sep 16, 2026 at 09:58:08AM +0530, Prashanth K wrote:
>> ucsi_find_fwnode() currently maps UCSI connectors to Device tree
>> connector nodes based on the order in which connector child nodes
>> are described in DT.
>>
>> This can fail because the ordering of child nodes isn't guaranteed
>> in Device-tree. For example, DTB may contain connector@1 before
>> connector@0, causing connector numbers to be associated with the wrong
>> fwnode. As a result, role switch and Type-C notifications can be
>> delivered to the wrong remote endpoints.
>>
>> Fix this by using the "reg" property of each connector to match
>> its corresponding fwnode. While at it, if the reg property isn't
>> present, then fall back to the old method.
>>
>> Fixes: c1b0bc2dabfa ("usb: typec: Add support for UCSI interface")
> 
> That commit does not yet include any kind of support for DT.
> 

I understand DT wasn't added at the point where this commit was
authored. But this is the base commit where the bug was introduced,
that's why I added it in fixes tag. Do you have any other suggestion ?

The patch simply distinguishes connectors with and without <reg>
property and uses different logics, hence it should work for all targets.

Regards,
Prashanth K

On Mon, Sep 21, 2026 at 03:03:55PM +0530, Prashanth K wrote:
> 
> 
> On 9/18/2026 2:48 PM, Heikki Krogerus wrote:
> > On Wed, Sep 16, 2026 at 09:58:08AM +0530, Prashanth K wrote:
> >> ucsi_find_fwnode() currently maps UCSI connectors to Device tree
> >> connector nodes based on the order in which connector child nodes
> >> are described in DT.
> >>
> >> This can fail because the ordering of child nodes isn't guaranteed
> >> in Device-tree. For example, DTB may contain connector@1 before
> >> connector@0, causing connector numbers to be associated with the wrong
> >> fwnode. As a result, role switch and Type-C notifications can be
> >> delivered to the wrong remote endpoints.
> >>
> >> Fix this by using the "reg" property of each connector to match
> >> its corresponding fwnode. While at it, if the reg property isn't
> >> present, then fall back to the old method.
> >>
> >> Fixes: c1b0bc2dabfa ("usb: typec: Add support for UCSI interface")
> > 
> > That commit does not yet include any kind of support for DT.
> > 
> 
> I understand DT wasn't added at the point where this commit was
> authored. But this is the base commit where the bug was introduced,
> that's why I added it in fixes tag. Do you have any other suggestion ?
> 
> The patch simply distinguishes connectors with and without <reg>
> property and uses different logics, hence it should work for all targets.

Fair enough.

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

-- 
heikki