[PATCH 1/4] drm/bridge: tc358767: register DP aux bus even in DRM_BRIDGE_ATTACH_NO_CONNECTOR case

[PATCH 1/4] drm/bridge: tc358767: register DP aux bus even in DRM_BRIDGE_ATTACH_NO_CONNECTOR case

[Alexander Stein]

Even if DRM_BRIDGE_ATTACH_NO_CONNECTOR is set the DP aux bus has to be
registered. Move the flags check after registration.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
---
 drivers/gpu/drm/bridge/tc358767.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index 7188935fdb826..a1663cc6c2236 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -1833,14 +1833,14 @@ static int tc_edp_bridge_attach(struct drm_bridge *bridge,
 			return ret;
 	}
 
-	if (flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR)
-		return 0;
-
 	tc->aux.drm_dev = drm;
 	ret = drm_dp_aux_register(&tc->aux);
 	if (ret < 0)
 		return ret;
 
+	if (flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR)
+		return 0;
+
 	/* Create DP/eDP connector */
 	drm_connector_helper_add(&tc->connector, &tc_connector_helper_funcs);
 	ret = drm_connector_init(drm, &tc->connector, &tc_connector_funcs, tc->bridge.type);
-- 
2.54.0

[PATCH 2/4] drm/bridge: tc358767: allow panels or bridges (connectors) on output

[Alexander Stein]

With DRM_BRIDGE_ATTACH_NO_CONNECTOR becoming more common, explicit
connectors (bridges on its own) are necessary. Allow specifying bridges
on the output endpoint.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
---
 drivers/gpu/drm/bridge/tc358767.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index a1663cc6c2236..2e705bd0d6be5 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -2346,11 +2346,12 @@ static int tc_probe_dpi_bridge_endpoint(struct tc_data *tc)
 static int tc_probe_edp_bridge_endpoint(struct tc_data *tc)
 {
 	struct device *dev = tc->dev;
+	struct drm_bridge *bridge;
 	struct drm_panel *panel;
 	int ret;
 
 	/* port@2 is the output port */
-	ret = drm_of_find_panel_or_bridge(dev->of_node, 2, 0, &panel, NULL);
+	ret = drm_of_find_panel_or_bridge(dev->of_node, 2, 0, &panel, &bridge);
 	if (ret && ret != -ENODEV)
 		return dev_err_probe(dev, ret,
 				     "Could not find DSI panel or bridge\n");
-- 
2.54.0

[PATCH 3/4] drm/bridge: tc358767: do not open-code devm_drm_of_get_bridge in DPI path

[Alexander Stein]

Use devm_drm_of_get_bridge() to simplify probing code path.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
---
 drivers/gpu/drm/bridge/tc358767.c | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index 2e705bd0d6be5..8d5a05dd8d32c 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -2318,29 +2318,23 @@ static int tc_probe_dpi_bridge_endpoint(struct tc_data *tc)
 {
 	struct device *dev = tc->dev;
 	struct drm_bridge *bridge;
-	struct drm_panel *panel;
 	int ret;
 
 	/* port@1 is the DPI input/output port */
-	ret = drm_of_find_panel_or_bridge(dev->of_node, 1, 0, &panel, &bridge);
-	if (ret && ret != -ENODEV)
-		return dev_err_probe(dev, ret,
-				     "Could not find DPI panel or bridge\n");
-
-	if (panel) {
-		bridge = devm_drm_panel_bridge_add(dev, panel);
-		if (IS_ERR(bridge))
-			return PTR_ERR(bridge);
+	bridge = devm_drm_of_get_bridge(dev, dev->of_node, 1, 0);
+	if (IS_ERR(bridge)) {
+		ret = PTR_ERR(bridge);
+		if (ret != -ENODEV)
+			return dev_err_probe(dev, ret,
+					     "Could not find DPI panel or bridge\n");
+		else
+			return ret;
 	}
 
-	if (bridge) {
-		tc->panel_bridge = bridge;
-		tc->bridge.type = DRM_MODE_CONNECTOR_DPI;
-
-		return 0;
-	}
+	tc->panel_bridge = bridge;
+	tc->bridge.type = DRM_MODE_CONNECTOR_DPI;
 
-	return ret;
+	return 0;
 }
 
 static int tc_probe_edp_bridge_endpoint(struct tc_data *tc)
-- 
2.54.0

[PATCH 4/4] drm/bridge: tc358767: do not open-code devm_drm_of_get_bridge in DSI path

[Alexander Stein]

Use devm_drm_of_get_bridge() to simplify probing code path.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
---
 drivers/gpu/drm/bridge/tc358767.c | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index 8d5a05dd8d32c..7b64521839893 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -2341,28 +2341,22 @@ static int tc_probe_edp_bridge_endpoint(struct tc_data *tc)
 {
 	struct device *dev = tc->dev;
 	struct drm_bridge *bridge;
-	struct drm_panel *panel;
 	int ret;
 
 	/* port@2 is the output port */
-	ret = drm_of_find_panel_or_bridge(dev->of_node, 2, 0, &panel, &bridge);
-	if (ret && ret != -ENODEV)
-		return dev_err_probe(dev, ret,
-				     "Could not find DSI panel or bridge\n");
-
-	if (panel) {
-		struct drm_bridge *panel_bridge;
-
-		panel_bridge = devm_drm_panel_bridge_add(dev, panel);
-		if (IS_ERR(panel_bridge))
-			return PTR_ERR(panel_bridge);
-
-		tc->panel_bridge = panel_bridge;
-		tc->bridge.type = DRM_MODE_CONNECTOR_eDP;
-	} else {
-		tc->bridge.type = DRM_MODE_CONNECTOR_DisplayPort;
+	bridge = devm_drm_of_get_bridge(dev, dev->of_node, 2, 0);
+	if (IS_ERR(bridge)) {
+		ret = PTR_ERR(bridge);
+		if (ret != -ENODEV)
+			return dev_err_probe(dev, ret,
+					     "Could not find DSI panel or bridge\n");
+		else
+			return ret;
 	}
 
+	tc->panel_bridge = bridge;
+	tc->bridge.type = bridge->type;
+
 	if (tc->hpd_pin >= 0)
 		tc->bridge.ops |= DRM_BRIDGE_OP_DETECT;
 	tc->bridge.ops |= DRM_BRIDGE_OP_EDID;
-- 
2.54.0

Re: [PATCH 4/4] drm/bridge: tc358767: do not open-code devm_drm_of_get_bridge in DSI path

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Probe fails with -ENODEV when port 2 has no downstream panel or bridge defined, breaking DisplayPort output.
--

commit 70b94894718399f191075561feb4f2f4f31b4aa9
Author: Alexander Stein <alexander.stein@ew.tq-group.com>

drm/bridge: tc358767: do not open-code devm_drm_of_get_bridge in DSI path

This commit replaces the open-coded panel/bridge discovery logic
with devm_drm_of_get_bridge() to simplify the probing code path
in the tc358767 bridge driver.

> diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
> --- a/drivers/gpu/drm/bridge/tc358767.c
> +++ b/drivers/gpu/drm/bridge/tc358767.c
[ ... ]
> @@ -2341,28 +2341,22 @@ static int tc_probe_edp_bridge_endpoint(struct tc_data *tc)
>  {
>  	struct device *dev = tc->dev;
>  	struct drm_bridge *bridge;
> -	struct drm_panel *panel;
>  	int ret;
>  
>  	/* port@2 is the output port */
> -	ret = drm_of_find_panel_or_bridge(dev->of_node, 2, 0, &panel, &bridge);
> -	if (ret && ret != -ENODEV)
> -		return dev_err_probe(dev, ret,
> -				     "Could not find DSI panel or bridge\n");
> -
> -	if (panel) {
> -		struct drm_bridge *panel_bridge;
> -
> -		panel_bridge = devm_drm_panel_bridge_add(dev, panel);
> -		if (IS_ERR(panel_bridge))
> -			return PTR_ERR(panel_bridge);
> -
> -		tc->panel_bridge = panel_bridge;
> -		tc->bridge.type = DRM_MODE_CONNECTOR_eDP;
> -	} else {
> -		tc->bridge.type = DRM_MODE_CONNECTOR_DisplayPort;
> +	bridge = devm_drm_of_get_bridge(dev, dev->of_node, 2, 0);
> +	if (IS_ERR(bridge)) {
> +		ret = PTR_ERR(bridge);
> +		if (ret != -ENODEV)
> +			return dev_err_probe(dev, ret,
> +					     "Could not find DSI panel or bridge\n");
> +		else
> +			return ret;

[Severity: High]
Does this break the probe sequence for DisplayPort configurations?

The previous code in tc_probe_edp_bridge_endpoint() allowed -ENODEV
to bypass the early return, falling back to setting the bridge type to
DRM_MODE_CONNECTOR_DisplayPort when no panel or bridge was found.

By explicitly returning ret when it equals -ENODEV, probe is now aborted
if the downstream device isn't fixed in the device tree. Could this cause
the DisplayPort/eDP bridge driver to fail to load on valid hardware setups?

>  	}
>  
> +	tc->panel_bridge = bridge;
> +	tc->bridge.type = bridge->type;
> +
>  	if (tc->hpd_pin >= 0)
>  		tc->bridge.ops |= DRM_BRIDGE_OP_DETECT;
>  	tc->bridge.ops |= DRM_BRIDGE_OP_EDID;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260624121515.2301219-1-alexander.stein@ew.tq-group.com?part=4

Re: [PATCH 1/4] drm/bridge: tc358767: register DP aux bus even in DRM_BRIDGE_ATTACH_NO_CONNECTOR case

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The bridge detach function `tc_edp_bridge_detach` does not call `drm_connector_cleanup()` for the connector initialized in `tc_edp_bridge_attach()`, leading to a use-after-free when the module unloads.
--

commit 29555064108dbff74cdded5aeba9baee8adfd8a7
Author: Alexander Stein <alexander.stein@ew.tq-group.com>

drm/bridge: tc358767: register DP aux bus even in DRM_BRIDGE_ATTACH_NO_CONNECTOR case

This commit changes the bridge attach sequence to always register the DP aux
bus. It achieves this by moving the check for the no-connector flag to after
the aux registration is complete.

> diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
> index 7188935fdb826..a1663cc6c2236 100644
> --- a/drivers/gpu/drm/bridge/tc358767.c
> +++ b/drivers/gpu/drm/bridge/tc358767.c
> @@ -1833,14 +1833,14 @@ static int tc_edp_bridge_attach(struct drm_bridge *bridge,
>  			return ret;
>  	}
>  
> -	if (flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR)
> -		return 0;
> -
>  	tc->aux.drm_dev = drm;
>  	ret = drm_dp_aux_register(&tc->aux);
>  	if (ret < 0)
>  		return ret;
>  
> +	if (flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR)
> +		return 0;
> +
>  	/* Create DP/eDP connector */
>  	drm_connector_helper_add(&tc->connector, &tc_connector_helper_funcs);
>  	ret = drm_connector_init(drm, &tc->connector, &tc_connector_funcs, tc->bridge.type);

[Severity: High]
This isn't a bug introduced by this patch, but is a pre-existing issue. Does
tc_edp_bridge_detach() properly clean up the connector initialized here?

Looking at the detach function in drivers/gpu/drm/bridge/tc358767.c:

static void tc_edp_bridge_detach(struct drm_bridge *bridge)
{
	drm_dp_aux_unregister(&bridge_to_tc(bridge)->aux);
}

It seems drm_connector_cleanup() is never called for tc->connector.

Since tc_data (which embeds the connector) is allocated via devm_kzalloc,
could the freed connector remain linked in the active drm_device connector
list when the driver is unbound?

Would this cause a use-after-free if the DRM core accesses the connector list
after the module is unloaded or unbound?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260624121515.2301219-1-alexander.stein@ew.tq-group.com?part=1