[PATCH v2 0/3] usb: typec: tipd: add TPS66993 support

[PATCH v2 0/3] usb: typec: tipd: add TPS66993 support

[Radhey Shyam Pandey]

This series adds support for the Texas Instruments TPS66993 USB
Type-C / USB PD controller to the tipd driver.

The TPS66993 is used on the AMD Versal AI Edge Gen 2 VEK385
Evaluation Kit as the USB PD DRP controller for the MMI USB
interface, handling CC signaling, connection detection, PD
negotiation, and power/data role swapping. Although the register
interface is largely shared with TPS6598x, the device is not
host-interface compatible and therefore needs its own
"ti,tps66993" compatible.

Changes in this series:
- Document the "ti,tps66993" compatible in the existing
  ti,tps6598x binding.
- Introduce a read_power_status() callback in tipd_data so
  variants can override how power status is obtained without
  changing TPS6598x, CD321x, or TPS25750 behavior.
- Add TPS66993 support.

Changes for v2:
- Use specific device compatible string as suggested by Krzysztof.
- add TPS66993 driver support.

Depends on (submitted separately):
[PATCH v3 0/3] usb: typec: tipd: improve probe diagnostics and POWER_STATUS handling
https://lore.kernel.org/all/20260618074745.629638-1-radhey.shyam.pandey@amd.com

Radhey Shyam Pandey (3):
  dt-bindings: usb: ti,tps6598x: add TPS66993 compatible
  usb: typec: tipd: add read_power_status callback to tipd_data
  usb: typec: tipd: add TPS66993 support

 .../devicetree/bindings/usb/ti,tps6598x.yaml  |  6 +-
 drivers/usb/typec/tipd/core.c                 | 77 +++++++++++++++++--
 2 files changed, 75 insertions(+), 8 deletions(-)


base-commit: 4f441960e691d37c880d2cc004de06bb5b6bd5e4
-- 
2.43.0

[PATCH v2 1/3] dt-bindings: usb: ti,tps6598x: add TPS66993 compatible

[Radhey Shyam Pandey]

Add a ti,tps66993 compatible to explicitly identify TPS66993 devices.
The TPS66993 is not host-interface compatible with TPS6598x, so a distinct
compatible is required.

On the AMD/Xilinx VEK385 Evaluation Board, the Texas Instruments TPS66993
acts as the USB Type-C/USB PD DRP controller for the MMI USB interface,
handling CC signaling, connection detection, PD negotiation and power/data
role swapping.

Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
---
Changes for v2:
- Rename the compatible to match the exact device (ti,tps66993) and in
  commit mention the usage of TPS66993 chip on VEK385 Evaluation Board.
---
 Documentation/devicetree/bindings/usb/ti,tps6598x.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Documentation/devicetree/bindings/usb/ti,tps6598x.yaml b/Documentation/devicetree/bindings/usb/ti,tps6598x.yaml
index 1745e28b3110..2c589e9e712e 100644
--- a/Documentation/devicetree/bindings/usb/ti,tps6598x.yaml
+++ b/Documentation/devicetree/bindings/usb/ti,tps6598x.yaml
@@ -4,13 +4,14 @@
 $id: http://devicetree.org/schemas/usb/ti,tps6598x.yaml#
 $schema: http://devicetree.org/meta-schemas/core.yaml#
 
-title: Texas Instruments 6598x Type-C Port Switch and Power Delivery controller
+title: Texas Instruments Type-C port switch and USB Power Delivery controllers
 
 maintainers:
   - Bryan O'Donoghue <bryan.odonoghue@linaro.org>
 
 description: |
-  Texas Instruments 6598x Type-C Port Switch and Power Delivery controller
+  Texas Instruments 6598x and 66993 Type-C Port Switch and Power Delivery
+  controller.
 
   A variant of this controller known as Apple CD321x or Apple ACE is also
   present on hardware with Apple SoCs such as the M1.
@@ -19,6 +20,7 @@ properties:
   compatible:
     enum:
       - ti,tps6598x
+      - ti,tps66993
       - apple,cd321x
       - ti,tps25750
 
-- 
2.43.0

Re: [PATCH v2 1/3] dt-bindings: usb: ti,tps6598x: add TPS66993 compatible

[Krzysztof Kozlowski]

On Fri, Jul 03, 2026 at 12:35:25AM +0530, Radhey Shyam Pandey wrote:
> Add a ti,tps66993 compatible to explicitly identify TPS66993 devices.
> The TPS66993 is not host-interface compatible with TPS6598x, so a distinct
> compatible is required.
> 
> On the AMD/Xilinx VEK385 Evaluation Board, the Texas Instruments TPS66993
> acts as the USB Type-C/USB PD DRP controller for the MMI USB interface,
> handling CC signaling, connection detection, PD negotiation and power/data
> role swapping.
> 
> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
> ---
> Changes for v2:
> - Rename the compatible to match the exact device (ti,tps66993) and in
>   commit mention the usage of TPS66993 chip on VEK385 Evaluation Board.

Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>

Best regards,
Krzysztof

[PATCH v2 2/3] usb: typec: tipd: add read_power_status callback to tipd_data

[Radhey Shyam Pandey]

Convert direct tps6598x_read_power_status() calls to use an indirect
read_power_status callback through tipd_data. This allows variants
(e.g. TPS66993) to provide their own power status reading logic while
keeping existing behavior unchanged for TPS6598x, CD321x, and TPS25750.

Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
---
Changes for v2:
- New patch to add TPS66993 driver support.
---
 drivers/usb/typec/tipd/core.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
index d5ee0af9058b..a6cb233a055d 100644
--- a/drivers/usb/typec/tipd/core.c
+++ b/drivers/usb/typec/tipd/core.c
@@ -159,6 +159,7 @@ struct tipd_data {
 	int (*init)(struct tps6598x *tps);
 	int (*switch_power_state)(struct tps6598x *tps, u8 target_state);
 	bool (*read_data_status)(struct tps6598x *tps);
+	bool (*read_power_status)(struct tps6598x *tps);
 	int (*reset)(struct tps6598x *tps);
 	int (*connect)(struct tps6598x *tps, u32 status);
 };
@@ -897,7 +898,7 @@ static irqreturn_t cd321x_interrupt(int irq, void *data)
 		goto err_unlock;
 
 	if (event & APPLE_CD_REG_INT_POWER_STATUS_UPDATE) {
-		if (!tps6598x_read_power_status(tps))
+		if (!tps->data->read_power_status(tps))
 			goto err_unlock;
 		if (TPS_POWER_STATUS_PWROPMODE(tps->pwr_status) == TYPEC_PWR_MODE_PD) {
 			if (tps6598x_read_partner_identity(tps)) {
@@ -952,7 +953,7 @@ static irqreturn_t tps25750_interrupt(int irq, void *data)
 		goto err_clear_ints;
 
 	if (event[0] & TPS_REG_INT_POWER_STATUS_UPDATE)
-		if (!tps6598x_read_power_status(tps))
+		if (!tps->data->read_power_status(tps))
 			goto err_clear_ints;
 
 	if (event[0] & TPS_REG_INT_DATA_STATUS_UPDATE)
@@ -1026,7 +1027,7 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data)
 		goto err_unlock;
 
 	if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE)
-		if (!tps6598x_read_power_status(tps))
+		if (!tps->data->read_power_status(tps))
 			goto err_unlock;
 
 	if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE)
@@ -1836,7 +1837,7 @@ static int tps6598x_probe(struct i2c_client *client)
 
 	if (status & TPS_STATUS_PLUG_PRESENT) {
 		ret = -EINVAL;
-		if (!tps6598x_read_power_status(tps))
+		if (!tps->data->read_power_status(tps))
 			goto err_unregister_port;
 		if (!tps->data->read_data_status(tps))
 			goto err_unregister_port;
@@ -1978,6 +1979,7 @@ static const struct tipd_data cd321x_data = {
 	.trace_status = trace_tps6598x_status,
 	.init = cd321x_init,
 	.read_data_status = cd321x_read_data_status,
+	.read_power_status = tps6598x_read_power_status,
 	.reset = cd321x_reset,
 	.switch_power_state = cd321x_switch_power_state,
 	.connect = cd321x_connect,
@@ -1997,6 +1999,7 @@ static const struct tipd_data tps6598x_data = {
 	.apply_patch = tps6598x_apply_patch,
 	.init = tps6598x_init,
 	.read_data_status = tps6598x_read_data_status,
+	.read_power_status = tps6598x_read_power_status,
 	.reset = tps6598x_reset,
 	.connect = tps6598x_connect,
 };
@@ -2015,6 +2018,7 @@ static const struct tipd_data tps25750_data = {
 	.apply_patch = tps25750_apply_patch,
 	.init = tps25750_init,
 	.read_data_status = tps6598x_read_data_status,
+	.read_power_status = tps6598x_read_power_status,
 	.reset = tps25750_reset,
 	.connect = tps6598x_connect,
 };
-- 
2.43.0

Re: [PATCH v2 2/3] usb: typec: tipd: add read_power_status callback to tipd_data

[Heikki Krogerus]

On Fri, Jul 03, 2026 at 12:35:26AM +0530, Radhey Shyam Pandey wrote:
> Convert direct tps6598x_read_power_status() calls to use an indirect
> read_power_status callback through tipd_data. This allows variants
> (e.g. TPS66993) to provide their own power status reading logic while
> keeping existing behavior unchanged for TPS6598x, CD321x, and TPS25750.
> 
> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
> Changes for v2:
> - New patch to add TPS66993 driver support.
> ---
>  drivers/usb/typec/tipd/core.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
> index d5ee0af9058b..a6cb233a055d 100644
> --- a/drivers/usb/typec/tipd/core.c
> +++ b/drivers/usb/typec/tipd/core.c
> @@ -159,6 +159,7 @@ struct tipd_data {
>  	int (*init)(struct tps6598x *tps);
>  	int (*switch_power_state)(struct tps6598x *tps, u8 target_state);
>  	bool (*read_data_status)(struct tps6598x *tps);
> +	bool (*read_power_status)(struct tps6598x *tps);
>  	int (*reset)(struct tps6598x *tps);
>  	int (*connect)(struct tps6598x *tps, u32 status);
>  };
> @@ -897,7 +898,7 @@ static irqreturn_t cd321x_interrupt(int irq, void *data)
>  		goto err_unlock;
>  
>  	if (event & APPLE_CD_REG_INT_POWER_STATUS_UPDATE) {
> -		if (!tps6598x_read_power_status(tps))
> +		if (!tps->data->read_power_status(tps))
>  			goto err_unlock;
>  		if (TPS_POWER_STATUS_PWROPMODE(tps->pwr_status) == TYPEC_PWR_MODE_PD) {
>  			if (tps6598x_read_partner_identity(tps)) {
> @@ -952,7 +953,7 @@ static irqreturn_t tps25750_interrupt(int irq, void *data)
>  		goto err_clear_ints;
>  
>  	if (event[0] & TPS_REG_INT_POWER_STATUS_UPDATE)
> -		if (!tps6598x_read_power_status(tps))
> +		if (!tps->data->read_power_status(tps))
>  			goto err_clear_ints;
>  
>  	if (event[0] & TPS_REG_INT_DATA_STATUS_UPDATE)
> @@ -1026,7 +1027,7 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data)
>  		goto err_unlock;
>  
>  	if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE)
> -		if (!tps6598x_read_power_status(tps))
> +		if (!tps->data->read_power_status(tps))
>  			goto err_unlock;
>  
>  	if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE)
> @@ -1836,7 +1837,7 @@ static int tps6598x_probe(struct i2c_client *client)
>  
>  	if (status & TPS_STATUS_PLUG_PRESENT) {
>  		ret = -EINVAL;
> -		if (!tps6598x_read_power_status(tps))
> +		if (!tps->data->read_power_status(tps))
>  			goto err_unregister_port;
>  		if (!tps->data->read_data_status(tps))
>  			goto err_unregister_port;
> @@ -1978,6 +1979,7 @@ static const struct tipd_data cd321x_data = {
>  	.trace_status = trace_tps6598x_status,
>  	.init = cd321x_init,
>  	.read_data_status = cd321x_read_data_status,
> +	.read_power_status = tps6598x_read_power_status,
>  	.reset = cd321x_reset,
>  	.switch_power_state = cd321x_switch_power_state,
>  	.connect = cd321x_connect,
> @@ -1997,6 +1999,7 @@ static const struct tipd_data tps6598x_data = {
>  	.apply_patch = tps6598x_apply_patch,
>  	.init = tps6598x_init,
>  	.read_data_status = tps6598x_read_data_status,
> +	.read_power_status = tps6598x_read_power_status,
>  	.reset = tps6598x_reset,
>  	.connect = tps6598x_connect,
>  };
> @@ -2015,6 +2018,7 @@ static const struct tipd_data tps25750_data = {
>  	.apply_patch = tps25750_apply_patch,
>  	.init = tps25750_init,
>  	.read_data_status = tps6598x_read_data_status,
> +	.read_power_status = tps6598x_read_power_status,
>  	.reset = tps25750_reset,
>  	.connect = tps6598x_connect,
>  };
> -- 
> 2.43.0

-- 
heikki

[PATCH v2 3/3] usb: typec: tipd: add TPS66993 support

[Radhey Shyam Pandey]

Derive power status from the STATUS register (0x1A) now that TPS66993
deprecates the Power_Status register (0x3F). Add support for the "APP1"
mode string. TPS66993 controller is configured in polling mode and only
type-c flip orientation feature is supported on AMD Versal AI Edge Gen 2
VEK385 Evaluation Kit.

Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
---
Changes for v2:
- New patch to add TPS66993 driver support.
---
 drivers/usb/typec/tipd/core.c | 65 +++++++++++++++++++++++++++++++++--
 1 file changed, 63 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
index a6cb233a055d..d2394d23a2dc 100644
--- a/drivers/usb/typec/tipd/core.c
+++ b/drivers/usb/typec/tipd/core.c
@@ -130,6 +130,7 @@ enum {
 	TPS_MODE_BIST,
 	TPS_MODE_DISC,
 	TPS_MODE_PTCH,
+	TPS_MODE_APP1,
 };
 
 static const char *const modes[] = {
@@ -138,6 +139,7 @@ static const char *const modes[] = {
 	[TPS_MODE_BIST]	= "BIST",
 	[TPS_MODE_DISC]	= "DISC",
 	[TPS_MODE_PTCH] = "PTCH",
+	[TPS_MODE_APP1]	= "APP1",
 };
 
 /* Unrecognized commands will be replaced with "!CMD" */
@@ -631,6 +633,35 @@ static bool tps6598x_read_power_status(struct tps6598x *tps)
 	return true;
 }
 
+/*
+ * TPS66993 deprecated Power_Status register (0x3F). BC1.2 is not supported
+ * and the remaining bits are redundant with STATUS register (0x1A).
+ * Synthesize pwr_status from the already-read STATUS register.
+ */
+static bool tps66993_read_power_status(struct tps6598x *tps)
+{
+	u16 pwr_status = 0;
+
+	/* Same masks as TPS_POWER_STATUS_CONNECTION() / SOURCESINK() / PWROPMODE() in tps6598x.h */
+	if (tps->status & TPS_STATUS_PLUG_PRESENT)
+		pwr_status |= FIELD_PREP(TPS_POWER_STATUS_CONNECTION_MASK, 1);
+
+	/* SOURCESINK: 1=sink; STATUS.PortRole 1=source, opposite convention */
+	if (!TPS_STATUS_TO_TYPEC_PORTROLE(tps->status))
+		pwr_status |= FIELD_PREP(TPS_POWER_STATUS_SOURCESINK_MASK, 1);
+
+	if (TPS_STATUS_VBUS_STATUS(tps->status) == TPS_STATUS_VBUS_STATUS_PD)
+		pwr_status |= FIELD_PREP(TPS_POWER_STATUS_TYPEC_CURRENT_MASK,
+					 TPS_POWER_STATUS_TYPEC_CURRENT_PD);
+
+	tps->pwr_status = pwr_status;
+
+	if (tps->data->trace_power_status)
+		tps->data->trace_power_status(pwr_status);
+
+	return true;
+}
+
 static void tps6598x_handle_plug_event(struct tps6598x *tps, u32 status)
 {
 	int ret;
@@ -1026,6 +1057,8 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data)
 	if (!tps6598x_read_status(tps, &status))
 		goto err_unlock;
 
+	tps->status = status;
+
 	if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE)
 		if (!tps->data->read_power_status(tps))
 			goto err_unlock;
@@ -1034,9 +1067,15 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data)
 		if (!tps->data->read_data_status(tps))
 			goto err_unlock;
 
-	/* Handle plug insert or removal */
-	if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT)
+	/*
+	 * Refresh power status before connect - needed for TPS66993 which
+	 * synthesizes pwr_status from STATUS and never gets POWER_STATUS_UPDATE.
+	 */
+	if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT) {
+		if (!tps->data->read_power_status(tps))
+			goto err_unlock;
 		tps6598x_handle_plug_event(tps, status);
+	}
 
 err_unlock:
 	mutex_unlock(&tps->lock);
@@ -1072,6 +1111,7 @@ static int tps6598x_check_mode(struct tps6598x *tps)
 
 	switch (ret) {
 	case TPS_MODE_APP:
+	case TPS_MODE_APP1:
 	case TPS_MODE_PTCH:
 		return ret;
 	case TPS_MODE_BOOT:
@@ -1810,6 +1850,8 @@ static int tps6598x_probe(struct i2c_client *client)
 		goto err_clear_mask;
 	}
 
+	tps->status = status;
+
 	/*
 	 * This fwnode has a "compatible" property, but is never populated as a
 	 * struct device. Instead we simply parse it to read the properties.
@@ -2004,6 +2046,24 @@ static const struct tipd_data tps6598x_data = {
 	.connect = tps6598x_connect,
 };
 
+static const struct tipd_data tps66993_data = {
+	.irq_handler = tps6598x_interrupt,
+	.irq_mask1 = TPS_REG_INT_DATA_STATUS_UPDATE |
+		     TPS_REG_INT_PLUG_EVENT,
+	.tps_struct_size = sizeof(struct tps6598x),
+	.register_port = tps6598x_register_port,
+	.unregister_port = tps6598x_unregister_port,
+	.trace_data_status = trace_tps6598x_data_status,
+	.trace_power_status = trace_tps6598x_power_status,
+	.trace_status = trace_tps6598x_status,
+	.apply_patch = tps6598x_apply_patch,
+	.init = tps6598x_init,
+	.read_data_status = tps6598x_read_data_status,
+	.read_power_status = tps66993_read_power_status,
+	.reset = tps6598x_reset,
+	.connect = tps6598x_connect,
+};
+
 static const struct tipd_data tps25750_data = {
 	.irq_handler = tps25750_interrupt,
 	.irq_mask1 = TPS_REG_INT_POWER_STATUS_UPDATE |
@@ -2025,6 +2085,7 @@ static const struct tipd_data tps25750_data = {
 
 static const struct of_device_id tps6598x_of_match[] = {
 	{ .compatible = "ti,tps6598x", &tps6598x_data},
+	{ .compatible = "ti,tps66993", &tps66993_data},
 	{ .compatible = "apple,cd321x", &cd321x_data},
 	{ .compatible = "ti,tps25750", &tps25750_data},
 	{}
-- 
2.43.0

Re: [PATCH v2 3/3] usb: typec: tipd: add TPS66993 support

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 6 potential issue(s) to consider:

New issues:
- [Medium] For TPS66993, the driver fails to update the synthesized power status when a PD contract is established after the initial plug event.
- [Medium] Redundant I2C reads and potential dropping of plug events for legacy TPS6598x devices in the shared interrupt handler.
- [Low] Use of undeclared identifiers 'TPS_POWER_STATUS_CONNECTION_MASK' and 'TPS_POWER_STATUS_SOURCESINK_MASK' causes compilation failure.

Pre-existing issues:
- [High] The `tps->wq_poll` delayed work is queued but never canceled if the probe fails, leading to a Use-After-Free.
- [High] The `cd321x->update_work` delayed work is leaked and runs after free if probe fails after a successful connect.
- [High] The probe function exposes the Type-C port to userspace before it fully initializes the connection state, leading to a race condition with sysfs.
--

commit f75143dbec357f0c1c49269aeab93ef676edfcef
Author: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Subject: usb: typec: tipd: add TPS66993 support

This patch adds support for the TPS66993 controller. It derives power status
from the STATUS register instead of the deprecated Power_Status register and
adds support for the APP1 mode string. The controller is configured in
polling mode.

> diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
> index a6cb233a055da..d2394d23a2dc4 100644
> --- a/drivers/usb/typec/tipd/core.c
> +++ b/drivers/usb/typec/tipd/core.c

[ ... ]

> @@ -631,6 +633,35 @@ static bool tps6598x_read_power_status(struct tps6598x *tps)
>  	return true;
>  }
>  
> +/*
> + * TPS66993 deprecated Power_Status register (0x3F). BC1.2 is not supported
> + * and the remaining bits are redundant with STATUS register (0x1A).
> + * Synthesize pwr_status from the already-read STATUS register.
> + */
> +static bool tps66993_read_power_status(struct tps6598x *tps)
> +{
> +	u16 pwr_status = 0;
> +
> +	/* Same masks as TPS_POWER_STATUS_CONNECTION() / SOURCESINK() / PWROPMODE() in tps6598x.h */
> +	if (tps->status & TPS_STATUS_PLUG_PRESENT)
> +		pwr_status |= FIELD_PREP(TPS_POWER_STATUS_CONNECTION_MASK, 1);
> +
> +	/* SOURCESINK: 1=sink; STATUS.PortRole 1=source, opposite convention */
> +	if (!TPS_STATUS_TO_TYPEC_PORTROLE(tps->status))
> +		pwr_status |= FIELD_PREP(TPS_POWER_STATUS_SOURCESINK_MASK, 1);

[Severity: Low]
Does this code cause a compilation failure? The macros
TPS_POWER_STATUS_CONNECTION_MASK and TPS_POWER_STATUS_SOURCESINK_MASK appear
to be undeclared in the kernel tree.

[ ... ]

> @@ -1026,6 +1057,8 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data)
>  	if (!tps6598x_read_status(tps, &status))
>  		goto err_unlock;
>  
> +	tps->status = status;
> +
>  	if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE)
>  		if (!tps->data->read_power_status(tps))
>  			goto err_unlock;
> @@ -1034,9 +1067,15 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data)
>  		if (!tps->data->read_data_status(tps))
>  			goto err_unlock;
>  
> -	/* Handle plug insert or removal */
> -	if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT)
> +	/*
> +	 * Refresh power status before connect - needed for TPS66993 which
> +	 * synthesizes pwr_status from STATUS and never gets POWER_STATUS_UPDATE.
> +	 */
> +	if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT) {
> +		if (!tps->data->read_power_status(tps))
> +			goto err_unlock;

[Severity: Medium]
For legacy TPS6598x devices where both TPS_REG_INT_POWER_STATUS_UPDATE and
TPS_REG_INT_PLUG_EVENT can be set, does this cause redundant I2C reads since
read_power_status is called for both events?

If the second read fails, will it jump to err_unlock and silently drop the
plug event?

[Severity: Medium]
For the TPS66993, since read_power_status is now restricted to plug events in
this handler, does the driver fail to update the synthesized power status if a
PD contract is established after the initial plug event?

> +		tps6598x_handle_plug_event(tps, status);
> +	}
>  
>  err_unlock:

[ ... ]

> @@ -1810,6 +1850,8 @@ static int tps6598x_probe(struct i2c_client *client)
>  		goto err_clear_mask;
>  	}
>  
> +	tps->status = status;
> +

[Severity: High]
This is a pre-existing issue, but does exposing the Type-C port to userspace
via tps->data->register_port() later in this probe function create a race
condition?

Userspace sysfs writes could potentially race with the subsequent lockless
port mutations in read_power_status, read_data_status, and connect later in
this function.

[Severity: High]
This is a pre-existing issue, but if the device is probed in polling mode
and an earlier connect step fails, the delayed work tps->wq_poll is
initialized and queued:

tps6598x_probe() {
	...
	if (client->irq) {
		...
	} else {
		INIT_DELAYED_WORK(&tps->wq_poll, tps6598x_poll_work);
		queue_delayed_work(system_power_efficient_wq, &tps->wq_poll,
				   msecs_to_jiffies(POLL_INTERVAL));
	}

	if (ret)
		goto err_disconnect;
	...
}

When the code jumps to err_disconnect, tps->wq_poll is never canceled. Can
this lead to a use-after-free when the queued work executes on freed memory?

[Severity: High]
This is a pre-existing issue, but does the error path in this probe function
leak the cd321x->update_work delayed work?

If a CD321x device connects successfully during probe but a subsequent setup
step fails, the error teardown jumps to err_disconnect without calling
remove() or explicitly canceling update_work. Could this result in a
use-after-free?

>  	/*
>  	 * This fwnode has a "compatible" property, but is never populated as a
>  	 * struct device. Instead we simply parse it to read the properties.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702190527.1820671-1-radhey.shyam.pandey@amd.com?part=3

Re: [PATCH v2 3/3] usb: typec: tipd: add TPS66993 support

[Heikki Krogerus]

Hi Radhey,

On Fri, Jul 03, 2026 at 12:35:27AM +0530, Radhey Shyam Pandey wrote:
> Derive power status from the STATUS register (0x1A) now that TPS66993
> deprecates the Power_Status register (0x3F). Add support for the "APP1"
> mode string. TPS66993 controller is configured in polling mode and only
> type-c flip orientation feature is supported on AMD Versal AI Edge Gen 2
> VEK385 Evaluation Kit.
> 
> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
> ---
> Changes for v2:
> - New patch to add TPS66993 driver support.
> ---
>  drivers/usb/typec/tipd/core.c | 65 +++++++++++++++++++++++++++++++++--
>  1 file changed, 63 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
> index a6cb233a055d..d2394d23a2dc 100644
> --- a/drivers/usb/typec/tipd/core.c
> +++ b/drivers/usb/typec/tipd/core.c
> @@ -130,6 +130,7 @@ enum {
>  	TPS_MODE_BIST,
>  	TPS_MODE_DISC,
>  	TPS_MODE_PTCH,
> +	TPS_MODE_APP1,
>  };
>  
>  static const char *const modes[] = {
> @@ -138,6 +139,7 @@ static const char *const modes[] = {
>  	[TPS_MODE_BIST]	= "BIST",
>  	[TPS_MODE_DISC]	= "DISC",
>  	[TPS_MODE_PTCH] = "PTCH",
> +	[TPS_MODE_APP1]	= "APP1",
>  };
>  
>  /* Unrecognized commands will be replaced with "!CMD" */
> @@ -631,6 +633,35 @@ static bool tps6598x_read_power_status(struct tps6598x *tps)
>  	return true;
>  }
>  
> +/*
> + * TPS66993 deprecated Power_Status register (0x3F). BC1.2 is not supported
> + * and the remaining bits are redundant with STATUS register (0x1A).
> + * Synthesize pwr_status from the already-read STATUS register.
> + */
> +static bool tps66993_read_power_status(struct tps6598x *tps)
> +{
> +	u16 pwr_status = 0;
> +
> +	/* Same masks as TPS_POWER_STATUS_CONNECTION() / SOURCESINK() / PWROPMODE() in tps6598x.h */
> +	if (tps->status & TPS_STATUS_PLUG_PRESENT)
> +		pwr_status |= FIELD_PREP(TPS_POWER_STATUS_CONNECTION_MASK, 1);
> +
> +	/* SOURCESINK: 1=sink; STATUS.PortRole 1=source, opposite convention */
> +	if (!TPS_STATUS_TO_TYPEC_PORTROLE(tps->status))
> +		pwr_status |= FIELD_PREP(TPS_POWER_STATUS_SOURCESINK_MASK, 1);
> +
> +	if (TPS_STATUS_VBUS_STATUS(tps->status) == TPS_STATUS_VBUS_STATUS_PD)
> +		pwr_status |= FIELD_PREP(TPS_POWER_STATUS_TYPEC_CURRENT_MASK,
> +					 TPS_POWER_STATUS_TYPEC_CURRENT_PD);
> +
> +	tps->pwr_status = pwr_status;
> +
> +	if (tps->data->trace_power_status)
> +		tps->data->trace_power_status(pwr_status);

Is the condition necesary? Is it possible to get here without that
callback?

Thanks,

> +	return true;
> +}
> +
>  static void tps6598x_handle_plug_event(struct tps6598x *tps, u32 status)
>  {
>  	int ret;
> @@ -1026,6 +1057,8 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data)
>  	if (!tps6598x_read_status(tps, &status))
>  		goto err_unlock;
>  
> +	tps->status = status;
> +
>  	if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE)
>  		if (!tps->data->read_power_status(tps))
>  			goto err_unlock;
> @@ -1034,9 +1067,15 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data)
>  		if (!tps->data->read_data_status(tps))
>  			goto err_unlock;
>  
> -	/* Handle plug insert or removal */
> -	if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT)
> +	/*
> +	 * Refresh power status before connect - needed for TPS66993 which
> +	 * synthesizes pwr_status from STATUS and never gets POWER_STATUS_UPDATE.
> +	 */
> +	if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT) {
> +		if (!tps->data->read_power_status(tps))
> +			goto err_unlock;
>  		tps6598x_handle_plug_event(tps, status);
> +	}
>  
>  err_unlock:
>  	mutex_unlock(&tps->lock);
> @@ -1072,6 +1111,7 @@ static int tps6598x_check_mode(struct tps6598x *tps)
>  
>  	switch (ret) {
>  	case TPS_MODE_APP:
> +	case TPS_MODE_APP1:
>  	case TPS_MODE_PTCH:
>  		return ret;
>  	case TPS_MODE_BOOT:
> @@ -1810,6 +1850,8 @@ static int tps6598x_probe(struct i2c_client *client)
>  		goto err_clear_mask;
>  	}
>  
> +	tps->status = status;
> +
>  	/*
>  	 * This fwnode has a "compatible" property, but is never populated as a
>  	 * struct device. Instead we simply parse it to read the properties.
> @@ -2004,6 +2046,24 @@ static const struct tipd_data tps6598x_data = {
>  	.connect = tps6598x_connect,
>  };
>  
> +static const struct tipd_data tps66993_data = {
> +	.irq_handler = tps6598x_interrupt,
> +	.irq_mask1 = TPS_REG_INT_DATA_STATUS_UPDATE |
> +		     TPS_REG_INT_PLUG_EVENT,
> +	.tps_struct_size = sizeof(struct tps6598x),
> +	.register_port = tps6598x_register_port,
> +	.unregister_port = tps6598x_unregister_port,
> +	.trace_data_status = trace_tps6598x_data_status,
> +	.trace_power_status = trace_tps6598x_power_status,
> +	.trace_status = trace_tps6598x_status,
> +	.apply_patch = tps6598x_apply_patch,
> +	.init = tps6598x_init,
> +	.read_data_status = tps6598x_read_data_status,
> +	.read_power_status = tps66993_read_power_status,
> +	.reset = tps6598x_reset,
> +	.connect = tps6598x_connect,
> +};
> +
>  static const struct tipd_data tps25750_data = {
>  	.irq_handler = tps25750_interrupt,
>  	.irq_mask1 = TPS_REG_INT_POWER_STATUS_UPDATE |
> @@ -2025,6 +2085,7 @@ static const struct tipd_data tps25750_data = {
>  
>  static const struct of_device_id tps6598x_of_match[] = {
>  	{ .compatible = "ti,tps6598x", &tps6598x_data},
> +	{ .compatible = "ti,tps66993", &tps66993_data},
>  	{ .compatible = "apple,cd321x", &cd321x_data},
>  	{ .compatible = "ti,tps25750", &tps25750_data},
>  	{}
> -- 
> 2.43.0

-- 
heikki