[PATCH v6 0/3] regcache: Avoid accessing non-initialised cache

[PATCH v6 0/3] regcache: Avoid accessing non-initialised cache

[Andy Shevchenko]

Refactor regcache flow that populates cache on initialisation phase
based on the values in HW. This makes code robust against any possible
accesses to not-fully initialised caches.

Changelog v6:
- refactored to make sure we always clean up the allocated resources (Mark)
- dropped applied patches

v5: 20260303092820.2818138-1-andriy.shevchenko@linux.intel.com

Changelog v5:
- added a precursor patch to make things clearer
- also put the freeing resources into an order (Mark)
- dropped applied patches

v4: 20260302095847.2310066-1-andriy.shevchenko@linux.intel.com

Changelog v4:
- made conditional against 'count' to make it less dependent to the previous code path

v3: 20260226135918.381979-1-andriy.shevchenko@linux.intel.com

Changelog v3:
- dropped unneeded churn in patch 3 (Mark)
- fixed code to pass kunit test cases (Mark)

v2: 20260225161659.3811671-1-andriy.shevchenko@linux.intel.com

Changelog v2:
- rebased on top of the latest regmap changes (Mark)
- added two more little cleanups (patches 4 & 5)

Andy Shevchenko (3):
  regcache: Move count check and cache_bypass assignment to the caller
  regcache: Allocate and free reg_defaults on the same level
  regcache: Move HW readback after cache initialisation

 drivers/base/regmap/regcache.c | 63 +++++++++++++++++-----------------
 1 file changed, 31 insertions(+), 32 deletions(-)

-- 
2.50.1

[PATCH v6 1/3] regcache: Move count check and cache_bypass assignment to the caller

[Andy Shevchenko]

Make regcache_count_cacheable_registers() just a counting routine
without any side effects by moving count check and cache_bypass
assignment to the caller.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 329cdee1ae1c..b73de70bbf3f 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -53,10 +53,6 @@ static int regcache_count_cacheable_registers(struct regmap *map)
 		    !regmap_volatile(map, i * map->reg_stride))
 			count++;
 
-	/* all registers are unreadable or volatile, so just bypass */
-	if (!count)
-		map->cache_bypass = true;
-
 	return count;
 }
 
@@ -206,6 +202,10 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		map->reg_defaults = tmp_buf;
 	} else if (map->num_reg_defaults_raw) {
 		count = regcache_count_cacheable_registers(map);
+		if (!count)
+			map->cache_bypass = true;
+
+		/* All registers are unreadable or volatile, so just bypass */
 		if (map->cache_bypass)
 			return 0;
 
-- 
2.50.1

[PATCH v6 2/3] regcache: Allocate and free reg_defaults on the same level

[Andy Shevchenko]

Currently reg_defaults buffer may be allocated on two different
levels when the user provided them and we duplicate it in regcache_init()
or when user wants us to read back from HW in regcache_hw_init().
This inconsistency makes code harder to follow and maintain. Allocate
and free reg_defaults on the same level in regcache_init() to improve
the readability and maintenance efforts.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 34 +++++++++++++++-------------------
 1 file changed, 15 insertions(+), 19 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index b73de70bbf3f..e9d95aa63938 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -56,17 +56,12 @@ static int regcache_count_cacheable_registers(struct regmap *map)
 	return count;
 }
 
-static int regcache_hw_init(struct regmap *map, int count)
+static int regcache_hw_init(struct regmap *map)
 {
 	int ret;
 	unsigned int reg, val;
 	void *tmp_buf;
 
-	map->num_reg_defaults = count;
-	map->reg_defaults = kmalloc_objs(struct reg_default, count);
-	if (!map->reg_defaults)
-		return -ENOMEM;
-
 	if (!map->reg_defaults_raw) {
 		bool cache_bypass = map->cache_bypass;
 		dev_dbg(map->dev, "No cache defaults, reading back from HW\n");
@@ -74,10 +69,8 @@ static int regcache_hw_init(struct regmap *map, int count)
 		/* Bypass the cache access till data read from HW */
 		map->cache_bypass = true;
 		tmp_buf = kmalloc(map->cache_size_raw, GFP_KERNEL);
-		if (!tmp_buf) {
-			ret = -ENOMEM;
-			goto err_free;
-		}
+		if (!tmp_buf)
+			return -ENOMEM;
 		ret = regmap_raw_read(map, 0, tmp_buf,
 				      map->cache_size_raw);
 		map->cache_bypass = cache_bypass;
@@ -110,7 +103,7 @@ static int regcache_hw_init(struct regmap *map, int count)
 			if (ret != 0) {
 				dev_err(map->dev, "Failed to read %x: %d\n",
 					reg, ret);
-				goto err_free;
+				return ret;
 			}
 		}
 
@@ -120,16 +113,10 @@ static int regcache_hw_init(struct regmap *map, int count)
 	}
 
 	return 0;
-
-err_free:
-	kfree(map->reg_defaults);
-
-	return ret;
 }
 
 static void regcache_hw_exit(struct regmap *map)
 {
-	kfree(map->reg_defaults);
 	if (map->cache_free)
 		kfree(map->reg_defaults_raw);
 }
@@ -209,13 +196,18 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		if (map->cache_bypass)
 			return 0;
 
+		map->num_reg_defaults = count;
+		map->reg_defaults = kmalloc_objs(struct reg_default, count);
+		if (!map->reg_defaults)
+			return -ENOMEM;
+
 		/* Some devices such as PMICs don't have cache defaults,
 		 * we cope with this by reading back the HW registers and
 		 * crafting the cache defaults by hand.
 		 */
-		ret = regcache_hw_init(map, count);
+		ret = regcache_hw_init(map);
 		if (ret < 0)
-			return ret;
+			goto err_free_reg_defaults;
 	}
 
 	if (!map->max_register_is_set && map->num_reg_defaults_raw) {
@@ -253,6 +245,8 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 	}
 err_free:
 	regcache_hw_exit(map);
+err_free_reg_defaults:
+	kfree(map->reg_defaults);
 
 	return ret;
 }
@@ -273,6 +267,8 @@ void regcache_exit(struct regmap *map)
 		map->cache_ops->exit(map);
 		map->unlock(map->lock_arg);
 	}
+
+	kfree(map->reg_defaults);
 }
 
 /**
-- 
2.50.1

[PATCH v6 3/3] regcache: Move HW readback after cache initialisation

[Andy Shevchenko]

Make sure that cache is initialised before calling any IO
using regmap, this makes sure that we won't access NULL or
invalid pointers in the cache which hasn't been initialised.

As a side effect it also makes the ordering of cleaning up
the resources in regcache_exit() to be the same (and correct)
as in the error path of regcache_init(). This is not a problem
right now as they do not have dependencies, but it makes code
robust against potential changes in the future.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index e9d95aa63938..27616b05111c 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -200,14 +200,6 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		map->reg_defaults = kmalloc_objs(struct reg_default, count);
 		if (!map->reg_defaults)
 			return -ENOMEM;
-
-		/* Some devices such as PMICs don't have cache defaults,
-		 * we cope with this by reading back the HW registers and
-		 * crafting the cache defaults by hand.
-		 */
-		ret = regcache_hw_init(map);
-		if (ret < 0)
-			goto err_free_reg_defaults;
 	}
 
 	if (!map->max_register_is_set && map->num_reg_defaults_raw) {
@@ -222,7 +214,18 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		ret = map->cache_ops->init(map);
 		map->unlock(map->lock_arg);
 		if (ret)
-			goto err_free;
+			goto err_free_reg_defaults;
+	}
+
+	/*
+	 * Some devices such as PMICs don't have cache defaults,
+	 * we cope with this by reading back the HW registers and
+	 * crafting the cache defaults by hand.
+	 */
+	if (count) {
+		ret = regcache_hw_init(map);
+		if (ret)
+			goto err_exit;
 	}
 
 	if (map->cache_ops->populate &&
@@ -232,10 +235,12 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		ret = map->cache_ops->populate(map);
 		map->unlock(map->lock_arg);
 		if (ret)
-			goto err_exit;
+			goto err_free;
 	}
 	return 0;
 
+err_free:
+	regcache_hw_exit(map);
 err_exit:
 	if (map->cache_ops->exit) {
 		dev_dbg(map->dev, "Destroying %s cache\n", map->cache_ops->name);
@@ -243,8 +248,6 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		ret = map->cache_ops->exit(map);
 		map->unlock(map->lock_arg);
 	}
-err_free:
-	regcache_hw_exit(map);
 err_free_reg_defaults:
 	kfree(map->reg_defaults);
 
-- 
2.50.1

Re: [PATCH v6 0/3] regcache: Avoid accessing non-initialised cache

[Mark Brown]

On Thu, 05 Mar 2026 09:52:59 +0100, Andy Shevchenko wrote:
> Refactor regcache flow that populates cache on initialisation phase
> based on the values in HW. This makes code robust against any possible
> accesses to not-fully initialised caches.
> 
> Changelog v6:
> - refactored to make sure we always clean up the allocated resources (Mark)
> - dropped applied patches
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-next

Thanks!

[1/3] regcache: Move count check and cache_bypass assignment to the caller
      commit: 8e2d279724944f788edc633e4888107eae666a37
[2/3] regcache: Allocate and free reg_defaults on the same level
      commit: 0cb7ae981894ff1fd0283813a17253250a747cf5
[3/3] regcache: Move HW readback after cache initialisation
      commit: e7662bced2e98ffa2c572126677deb9cf55d43b3

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark