[PATCH v5 0/2] drm/bridge: convert users of of_drm_find_bridge(), part 4

[PATCH v5 0/2] drm/bridge: convert users of of_drm_find_bridge(), part 4

[Luca Ceresoli]

This series converts many DRM drivers from the now deprecated
of_drm_find_bridge() to its replacement of_drm_find_and_get_bridge() which
allows correct bridge refcounting.

This is part of the work to support hotplug of DRM bridges. The grand plan
was discussed in [0].

Here's the work breakdown (➜ marks the current series):

 1. ➜ add refcounting to DRM bridges struct drm_bridge,
      based on devm_drm_bridge_alloc()
    A. ✔ add new alloc API and refcounting (v6.16)
    B. ✔ convert all bridge drivers to new API (v6.17)
    C. ✔ kunit tests (v6.17)
    D. ✔ add get/put to drm_bridge_add/remove() + attach/detach()
         and warn on old allocation pattern (v6.17)
    E. ➜ add get/put on drm_bridge accessors
       1. ✔ drm_bridge_chain_get_first_bridge(), add cleanup action (v6.18)
       2. ✔ drm_bridge_get_prev_bridge() (v6.18)
       3. ✔ drm_bridge_get_next_bridge() (v6.19)
       4. ✔ drm_for_each_bridge_in_chain() (v6.19)
       5. ✔ drm_bridge_connector_init (v6.19)
       6. … protect encoder bridge chain with a mutex
       7. ➜ of_drm_find_bridge
          a. ✔ add of_drm_get_bridge() (v7.0),
	       convert basic direct users (v7.0-v7.1)
	  b. ✔ convert direct of_drm_get_bridge() users, part 2 (v7.0)
	  c. ✔ convert direct of_drm_get_bridge() users, part 3 (v7.0)
	  d. ➜ convert direct of_drm_get_bridge() users, part 4
	       (some v7.1, some pending)
	  e.   convert bridge-only drm_of_find_panel_or_bridge() users
       8. drm_of_find_panel_or_bridge, *_of_get_bridge
       9. ✔ enforce drm_bridge_add before drm_bridge_attach (v6.19)
    F. ✔ debugfs improvements
       1. ✔ add top-level 'bridges' file (v6.16)
       2. ✔ show refcount and list lingering bridges (v6.19)
 2. … handle gracefully atomic updates during bridge removal
    A. ✔ Add drm_bridge_enter/exit() to protect device resources (v7.0)
    B. … protect private_obj removal from list
    C. ✔ Add drm_bridge_clear_and_put() (v7.1)
 3. … DSI host-device driver interaction
 4. ✔ removing the need for the "always-disconnected" connector
 5. … Migrate i.MX LCDIF driver to bridge-connector
 6.   DRM bridge hotplug
    A.   Bridge hotplug management in the DRM core
    B.   Device tree description

[0] https://lore.kernel.org/lkml/20250206-hotplug-drm-bridge-v6-0-9d6f2c9c3058@bootlin.com/#t

This work is a continuation of the work to correctly handle bridge
refcounting for existing of_drm_find_bridge(). The ground work is in:

 - commit 293a8fd7721a ("drm/bridge: add of_drm_find_and_get_bridge()")
 - commit 9da0e06abda8 ("drm/bridge: deprecate of_drm_find_bridge()")
 - commit 3fdeae134ba9 ("drm/bridge: add next_bridge pointer to struct drm_bridge")

The whole conversion is split in multiple series to make the review process
a bit smoother:

 - Part 2: mostly drivers in drivers/gpu/drm/bridge [2], applied
 - Part 3: other drivers, low-medium complexity [3], applied
 - Part 4: other drivers, converting the most complex cases [this series]

[2] https://lore.kernel.org/lkml/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-0-8bad3ef90b9f@bootlin.com/
[3] https://lore.kernel.org/lkml/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-3-v2-0-8d7a3dbacdf4@bootlin.com/

Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
---
Changes in v5:
- Drop patches 2,4, now applied
- Use no_free_ptr to simplify the 2 remaining patches
- Link to v4: https://patch.msgid.link/20260402-drm-bridge-alloc-getput-drm_of_find_bridge-4-v4-0-421781c8c061@bootlin.com

Changes in v4:
- Patch 3: many improvements as suggested by Laurent
- Patch 1: add comment after Laurent's suggestion on patch 3
- Link to v3: https://lore.kernel.org/r/20260318-drm-bridge-alloc-getput-drm_of_find_bridge-4-v3-0-10f502520357@bootlin.com

Changes in v3:
- Rebased on current drm-misc-next (on v7.0-rc3)
- Dropped patches already applied
- Link to v2: https://lore.kernel.org/r/20260131-drm-bridge-alloc-getput-drm_of_find_bridge-4-v2-0-e081bcdc1467@bootlin.com

Changes in v2:
- Removed bouncing recipient: Edmund Dea <edmund.j.dea@intel.com>
- used break instead of a warning patch 3, adapted patch 4 as a
  consequence
- Link to v1: https://lore.kernel.org/r/20260116-drm-bridge-alloc-getput-drm_of_find_bridge-4-v1-0-e34b38f50d27@bootlin.com

---
Luca Ceresoli (2):
      drm: renesas: rz-du: rzg2l_du_encoder: convert to of_drm_find_and_get_bridge()
      drm: rcar-du: encoder: convert to of_drm_find_and_get_bridge()

 drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c | 29 +++++++++++++++++++----
 drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.h |  1 +
 drivers/gpu/drm/renesas/rcar-du/rcar_du_kms.c     |  2 ++
 drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c  | 13 +++++++---
 4 files changed, 37 insertions(+), 8 deletions(-)
---
base-commit: 4d5876596774995cad1f5901fbf486f3aecd6602
change-id: 20260107-drm-bridge-alloc-getput-drm_of_find_bridge-4-0a92b361fe9d

Best regards,
--  
Luca Ceresoli <luca.ceresoli@bootlin.com>

[PATCH v5 1/2] drm: renesas: rz-du: rzg2l_du_encoder: convert to of_drm_find_and_get_bridge()

[Luca Ceresoli]

of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done.

This is made somewhat simpler by the fact that 'bridge' is a local
variable.

However we need to handle both branches of the main if().

In the 'else' case, just switch to of_drm_find_and_get_bridge() to ensure
the bridge is not freed while in use in the function tail
(drm_bridge_attach() mainly).

In the 'then' case, devm_drm_panel_bridge_add_typed() already increments
the refcount using devres which ties the bridge allocation lifetime to the
device lifetime, so we would not need to do anything. However to have the
same behaviour in both branches take an additional reference here, so that
the bridge needs to be put whichever branch is taken without more
complicated logic.

Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Tested-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
---

Changes in v5:
- simplify error bailout using no_free_ptr

Changes in v4:
- Added comment to clarify the additional drm_bridge_get() in the
  panel_bridge case (keeping the R-by and T-by tags as it's just a comment)
---
 drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c b/drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c
index 5e6dd16705e6..d53068733c66 100644
--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c
+++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_du_encoder.c
@@ -67,7 +67,7 @@ int rzg2l_du_encoder_init(struct rzg2l_du_device  *rcdu,
 {
 	struct rzg2l_du_encoder *renc;
 	struct drm_connector *connector;
-	struct drm_bridge *bridge;
+	struct drm_bridge *bridge __free(drm_bridge_put) = NULL;
 	int ret;
 
 	/*
@@ -84,9 +84,16 @@ int rzg2l_du_encoder_init(struct rzg2l_du_device  *rcdu,
 		bridge = devm_drm_panel_bridge_add_typed(rcdu->dev, panel,
 							 DRM_MODE_CONNECTOR_DPI);
 		if (IS_ERR(bridge))
-			return PTR_ERR(bridge);
+			return PTR_ERR(no_free_ptr(bridge));
+
+		/*
+		 * The reference taken by devm_drm_panel_bridge_add_typed() is
+		 * released automatically. Take a second one for the __free()
+		 * when this function will return.
+		 */
+		drm_bridge_get(bridge);
 	} else {
-		bridge = of_drm_find_bridge(enc_node);
+		bridge = of_drm_find_and_get_bridge(enc_node);
 		if (!bridge)
 			return -EPROBE_DEFER;
 	}

-- 
2.53.0

[PATCH v5 2/2] drm: rcar-du: encoder: convert to of_drm_find_and_get_bridge()

[Luca Ceresoli]

of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done.

We need to handle the two cases: when a panel_bridge is added and when it
isn't. So:

 * in the 'else' case a panel_bridge is not added and bridge is found: use
   of_drm_find_and_get_bridge() to get a reference to the found bridge
 * in the 'then' case a panel_bridge is found using a devm function which
   already takes a refcount and will put it on removal, but we need to take
   another so the following code in this function always get exactly one
   reference that it needs to put

In order to put the reference, add the needed drm_bridge_put() calls in the
existing cleanup function.

Reviewed-by: Linus Walleij <linusw@kernel.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
---

Changes in v5:
- simplify error bailout using no_free_ptr

Changes in v4:
- fixed conflict after commit 3bce3fdd1ff2 ("drm: rcar-du: Don't leak
  device_link to CMM")
- Use ARRAY_SIZE() instead of define
- Unsigned variable for never-negative variable
- Added comment to clarify the additional drm_bridge_get() in the
  panel_bridge case
- Coding style (C comments, line wrap at 80)
---
 drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c | 29 +++++++++++++++++++----
 drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.h |  1 +
 drivers/gpu/drm/renesas/rcar-du/rcar_du_kms.c     |  2 ++
 3 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c b/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c
index 7ecec7b04a8d..32ea09d65d76 100644
--- a/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c
+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.c
@@ -51,7 +51,7 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu,
 {
 	struct rcar_du_encoder *renc;
 	struct drm_connector *connector;
-	struct drm_bridge *bridge;
+	struct drm_bridge *bridge __free(drm_bridge_put) = NULL;
 	int ret;
 
 	/*
@@ -70,19 +70,28 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu,
 		bridge = devm_drm_panel_bridge_add_typed(rcdu->dev, panel,
 							 DRM_MODE_CONNECTOR_DPI);
 		if (IS_ERR(bridge))
-			return PTR_ERR(bridge);
+			return PTR_ERR(no_free_ptr(bridge));
+
+		/*
+		 * The reference taken by devm_drm_panel_bridge_add_typed() is
+		 * released automatically. Take a second one for the __free()
+		 * when this function will return.
+		 */
+		drm_bridge_get(bridge);
 	} else {
-		bridge = of_drm_find_bridge(enc_node);
+		bridge = of_drm_find_and_get_bridge(enc_node);
 		if (!bridge)
 			return -EPROBE_DEFER;
 
 		if (output == RCAR_DU_OUTPUT_LVDS0 ||
 		    output == RCAR_DU_OUTPUT_LVDS1)
-			rcdu->lvds[output - RCAR_DU_OUTPUT_LVDS0] = bridge;
+			rcdu->lvds[output - RCAR_DU_OUTPUT_LVDS0] =
+				drm_bridge_get(bridge);
 
 		if (output == RCAR_DU_OUTPUT_DSI0 ||
 		    output == RCAR_DU_OUTPUT_DSI1)
-			rcdu->dsi[output - RCAR_DU_OUTPUT_DSI0] = bridge;
+			rcdu->dsi[output - RCAR_DU_OUTPUT_DSI0] =
+				drm_bridge_get(bridge);
 	}
 
 	/*
@@ -135,3 +144,13 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu,
 
 	return drm_connector_attach_encoder(connector, &renc->base);
 }
+
+void rcar_du_encoder_cleanup(struct rcar_du_device *rcdu)
+{
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(rcdu->lvds); i++)
+		drm_bridge_put(rcdu->lvds[i]);
+	for (i = 0; i < ARRAY_SIZE(rcdu->dsi); i++)
+		drm_bridge_put(rcdu->dsi[i]);
+}
diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.h b/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.h
index e5ec8fbb3979..b2b5e93f30f8 100644
--- a/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.h
+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_du_encoder.h
@@ -25,5 +25,6 @@ struct rcar_du_encoder {
 int rcar_du_encoder_init(struct rcar_du_device *rcdu,
 			 enum rcar_du_output output,
 			 struct device_node *enc_node);
+void rcar_du_encoder_cleanup(struct rcar_du_device *rcdu);
 
 #endif /* __RCAR_DU_ENCODER_H__ */
diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/renesas/rcar-du/rcar_du_kms.c
index b2d0e4651e35..1119c84e5fe9 100644
--- a/drivers/gpu/drm/renesas/rcar-du/rcar_du_kms.c
+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_du_kms.c
@@ -832,6 +832,8 @@ static void rcar_du_modeset_cleanup(struct drm_device *dev, void *res)
 
 		put_device(cmm->dev);
 	}
+
+	rcar_du_encoder_cleanup(rcdu);
 }
 
 int rcar_du_modeset_init(struct rcar_du_device *rcdu)

-- 
2.53.0

Claude review: drm/bridge: convert users of of_drm_find_bridge(), part 4

[Claude Code Review Bot]

Overall Series Review

Subject: drm/bridge: convert users of of_drm_find_bridge(), part 4
Author: Luca Ceresoli <luca.ceresoli@bootlin.com>
Patches: 3
Reviewed: 2026-04-12T11:12:49.754762

---

This is a clean, well-structured 2-patch series converting the two Renesas DU encoder drivers (`rz-du` and `rcar-du`) from the deprecated `of_drm_find_bridge()` to `of_drm_find_and_get_bridge()`, as part of the ongoing DRM bridge refcounting work. The series is at v5 and has already collected Reviewed-by tags from four reviewers (Biju Das, Linus Walleij, Laurent Pinchart, Louis Chauvet).

The approach is sound: use `__free(drm_bridge_put)` on the local `bridge` variable for automatic cleanup, take an extra reference via `drm_bridge_get()` in the panel-bridge path to unify the two branches, and use `no_free_ptr()` to suppress cleanup for error pointers. The v5 simplification with `no_free_ptr` is a nice improvement over explicit goto-based cleanup.

Both patches are correct. The refcounting logic is balanced across all paths. No issues found that would block merging.

---
Generated by Claude Code Patch Reviewer

Claude review: drm: renesas: rz-du: rzg2l_du_encoder: convert to of_drm_find_and_get_bridge()

[Claude Code Review Bot]

Patch Review

**Status: Good to merge.**

This is the simpler of the two patches since `bridge` is purely a local variable with no long-lived storage.

**Refcounting analysis:**

*Panel-bridge path:*
- `devm_drm_panel_bridge_add_typed()` returns a bridge with one devres-managed reference
- `drm_bridge_get(bridge)` takes a second reference for the `__free` to put at function exit
- `drm_bridge_attach()` takes its own reference (per the earlier work in step 1.D)
- On success: `__free` puts the `drm_bridge_get` reference; attach holds its own; devres holds its own. Balanced.

*of_drm_find_and_get_bridge path:*
- `of_drm_find_and_get_bridge()` returns with one reference
- `drm_bridge_attach()` takes another
- On success: `__free` puts the find reference; attach holds its own. Balanced.

*Error paths:*
```c
if (IS_ERR(bridge))
    return PTR_ERR(no_free_ptr(bridge));
```
`no_free_ptr()` nullifies `bridge` before the `__free` cleanup runs, correctly preventing `drm_bridge_put()` from being called on an `ERR_PTR`. This is correct.

The `!bridge` (NULL) return path from `of_drm_find_and_get_bridge` is also safe since `DEFINE_FREE` checks `if (_T)`.

**Comment quality:** The comment explaining the extra `drm_bridge_get()` is clear and helpful.

No issues.

---
Generated by Claude Code Patch Reviewer

Claude review: drm: rcar-du: encoder: convert to of_drm_find_and_get_bridge()

[Claude Code Review Bot]

Patch Review

**Status: Good to merge.**

This is the more complex patch because `rcar_du_encoder_init()` stores bridge pointers in long-lived `rcdu->lvds[]` and `rcdu->dsi[]` arrays, requiring explicit cleanup.

**Refcounting analysis for stored references:**

```c
rcdu->lvds[output - RCAR_DU_OUTPUT_LVDS0] =
    drm_bridge_get(bridge);
```

This neatly takes a new reference and assigns it in one expression. After function return, `__free` puts the local reference, and `rcdu->lvds[]` retains its own independent reference. Same pattern for `dsi[]`.

**Cleanup correctness:**

The new `rcar_du_encoder_cleanup()`:
```c
for (i = 0; i < ARRAY_SIZE(rcdu->lvds); i++)
    drm_bridge_put(rcdu->lvds[i]);
for (i = 0; i < ARRAY_SIZE(rcdu->dsi); i++)
    drm_bridge_put(rcdu->dsi[i]);
```

This is safe for NULL entries (the `DEFINE_FREE` pattern at `drm_bridge.h:1297` checks for NULL, and `drm_bridge_put()` itself should handle NULL). It's called from `rcar_du_modeset_cleanup()` which is registered via `drmm_add_action()` early in `rcar_du_modeset_init()` (line 857) -- before `rcar_du_encoders_init()` is called (line 955). This ensures cleanup runs even if encoder init fails partway through.

**Early return paths after lvds/dsi storage:**

The `-ENOLINK` returns at lines 98 and 103 happen after `rcdu->lvds[]` may have been populated with an extra reference. This is safe because:
1. `__free` puts the local reference
2. The stored reference in `rcdu->lvds[]` will be put by `rcar_du_encoder_cleanup()` via the already-registered `drmm_add_action`
3. The caller (`rcar_du_encoders_init`) handles `-ENOLINK` with `continue`, and other error paths also eventually tear down via drmm

**One observation** (not a blocker): `drm_bridge_put()` is called directly rather than going through `if (ptr)` guards in `rcar_du_encoder_cleanup()`. This relies on `drm_bridge_put()` handling NULL gracefully. Checking the `DEFINE_FREE` at `drm_bridge.h:1297` shows it does check `if (_T)`, and looking at standard kernel conventions, `drm_bridge_put(NULL)` should be a no-op. This is fine.

No issues.

---
Generated by Claude Code Patch Reviewer