[PATCH v2 0/5] regcache: Avoid accessing non-initialised cache

[PATCH v2 0/5] regcache: Avoid accessing non-initialised cache

[Andy Shevchenko]

Refactor regcache flow that populates cache on initialisation phase
based on the values in HW. This makes code robust against any possible
accesses to not-fully initialised caches.

Changelog v2:
- rebased on top of the latest regmap changes (Mark)
- added two more little cleanups (patches 4 & 5)

Andy Shevchenko (5):
  regcache: Remove duplicate check in regcache_hw_init()
  regcache: Split regcache_count_cacheable_registers() helper
  regcache: Move HW readback after cache initialisation
  regcache: Define iterator inside for-loop and align their types
  regcache: Amend printf() specifiers when printing registers

 drivers/base/regmap/internal.h |  2 +-
 drivers/base/regmap/regcache.c | 57 ++++++++++++++++++----------------
 2 files changed, 32 insertions(+), 27 deletions(-)

-- 
2.50.1

[PATCH v2 1/5] regcache: Remove duplicate check in regcache_hw_init()

[Andy Shevchenko]

The regcache_hw_init() is never called without preliminary check
for num_reg_defaults_raw not being 0. Thus, remove duplicate in
the function.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index a35f2b20298b..d41cdb39c78f 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -50,9 +50,6 @@ static int regcache_hw_init(struct regmap *map)
 	unsigned int reg, val;
 	void *tmp_buf;
 
-	if (!map->num_reg_defaults_raw)
-		return -EINVAL;
-
 	/* calculate the size of reg_defaults */
 	for (count = 0, i = 0; i < map->num_reg_defaults_raw; i++)
 		if (regmap_readable(map, i * map->reg_stride) &&
-- 
2.50.1

[PATCH v2 2/5] regcache: Split regcache_count_cacheable_registers() helper

[Andy Shevchenko]

The introduced helper allows to check for the non-cacheable configurations
earlier during initialisation.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index d41cdb39c78f..73cfe8120669 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -42,13 +42,10 @@ void regcache_sort_defaults(struct reg_default *defaults, unsigned int ndefaults
 }
 EXPORT_SYMBOL_GPL(regcache_sort_defaults);
 
-static int regcache_hw_init(struct regmap *map)
+static int regcache_count_cacheable_registers(struct regmap *map)
 {
-	int i, j;
-	int ret;
 	int count;
-	unsigned int reg, val;
-	void *tmp_buf;
+	int i;
 
 	/* calculate the size of reg_defaults */
 	for (count = 0, i = 0; i < map->num_reg_defaults_raw; i++)
@@ -57,10 +54,18 @@ static int regcache_hw_init(struct regmap *map)
 			count++;
 
 	/* all registers are unreadable or volatile, so just bypass */
-	if (!count) {
+	if (!count)
 		map->cache_bypass = true;
-		return 0;
-	}
+
+	return count;
+}
+
+static int regcache_hw_init(struct regmap *map, int count)
+{
+	int i, j;
+	int ret;
+	unsigned int reg, val;
+	void *tmp_buf;
 
 	map->num_reg_defaults = count;
 	map->reg_defaults = kmalloc_objs(struct reg_default, count);
@@ -129,6 +134,7 @@ static int regcache_hw_init(struct regmap *map)
 
 int regcache_init(struct regmap *map, const struct regmap_config *config)
 {
+	int count = 0;
 	int ret;
 	int i;
 	void *tmp_buf;
@@ -193,15 +199,17 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 			return -ENOMEM;
 		map->reg_defaults = tmp_buf;
 	} else if (map->num_reg_defaults_raw) {
+		count = regcache_count_cacheable_registers(map);
+		if (map->cache_bypass)
+			return 0;
+
 		/* Some devices such as PMICs don't have cache defaults,
 		 * we cope with this by reading back the HW registers and
 		 * crafting the cache defaults by hand.
 		 */
-		ret = regcache_hw_init(map);
+		ret = regcache_hw_init(map, count);
 		if (ret < 0)
 			return ret;
-		if (map->cache_bypass)
-			return 0;
 	}
 
 	if (!map->max_register_is_set && map->num_reg_defaults_raw) {
-- 
2.50.1

[PATCH v2 3/5] regcache: Move HW readback after cache initialisation

[Andy Shevchenko]

Make sure that cache is initialised before calling any IO
using regmap, this makes sure that we won't access NULL or
invalid pointers in the cache which hasn't been initialised.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 73cfe8120669..de03b090f152 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -202,14 +202,6 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 		count = regcache_count_cacheable_registers(map);
 		if (map->cache_bypass)
 			return 0;
-
-		/* Some devices such as PMICs don't have cache defaults,
-		 * we cope with this by reading back the HW registers and
-		 * crafting the cache defaults by hand.
-		 */
-		ret = regcache_hw_init(map, count);
-		if (ret < 0)
-			return ret;
 	}
 
 	if (!map->max_register_is_set && map->num_reg_defaults_raw) {
@@ -227,6 +219,15 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
 			goto err_free;
 	}
 
+	/*
+	 * Some devices such as PMICs don't have cache defaults,
+	 * we cope with this by reading back the HW registers and
+	 * crafting the cache defaults by hand.
+	 */
+	ret = regcache_hw_init(map, count);
+	if (ret)
+		goto err_exit;
+
 	if (map->cache_ops->populate &&
 	    (map->num_reg_defaults || map->reg_default_cb)) {
 		dev_dbg(map->dev, "Populating %s cache\n", map->cache_ops->name);
-- 
2.50.1

Re: [PATCH v2 3/5] regcache: Move HW readback after cache initialisation

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 821 bytes --]

On Wed, Feb 25, 2026 at 05:15:57PM +0100, Andy Shevchenko wrote:
> Make sure that cache is initialised before calling any IO
> using regmap, this makes sure that we won't access NULL or
> invalid pointers in the cache which hasn't been initialised.

Either this (I suspect it's this) or the subsequent patch is introducing
regressions in the ASoC tests on several of my systems in the form:

# ok 1 get_value.AT91SAMG20EK.13
# # AT91SAMG20EK.13 Inpwm8731 1-001b: ASoC error (-5): at soc_component_read_no_lock() on wm8731.1-001b for register: [0x00000004]
ut Mux

  https://lava.sirena.org.uk/scheduler/job/2498613#L1549

It's not absolutely everything but it's multiple systems (several with
Wolfson devices, plus the Pine64 Plus which has an integrated Allwinner
CODEC).  I didn't check beyond seeing the failures yet.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 484 bytes --]

Re: [PATCH v2 3/5] regcache: Move HW readback after cache initialisation

[Andy Shevchenko]

On Thu, Feb 26, 2026 at 12:20:44PM +0000, Mark Brown wrote:
> On Wed, Feb 25, 2026 at 05:15:57PM +0100, Andy Shevchenko wrote:
> > Make sure that cache is initialised before calling any IO
> > using regmap, this makes sure that we won't access NULL or
> > invalid pointers in the cache which hasn't been initialised.
> 
> Either this (I suspect it's this) or the subsequent patch is introducing
> regressions in the ASoC tests on several of my systems in the form:
> 
> # ok 1 get_value.AT91SAMG20EK.13
> # # AT91SAMG20EK.13 Inpwm8731 1-001b: ASoC error (-5): at soc_component_read_no_lock() on wm8731.1-001b for register: [0x00000004]
> ut Mux
> 
>   https://lava.sirena.org.uk/scheduler/job/2498613#L1549
> 
> It's not absolutely everything but it's multiple systems (several with
> Wolfson devices, plus the Pine64 Plus which has an integrated Allwinner
> CODEC).  I didn't check beyond seeing the failures yet.

Thanks!

I also run kunit test cases and it seems like half-failing. I'm about to check
deeper what's the cause. (Obviously it works in my case on real HW, but...)

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 3/5] regcache: Move HW readback after cache initialisation

[Andy Shevchenko]

On Thu, Feb 26, 2026 at 03:27:28PM +0200, Andy Shevchenko wrote:
> On Thu, Feb 26, 2026 at 12:20:44PM +0000, Mark Brown wrote:
> > On Wed, Feb 25, 2026 at 05:15:57PM +0100, Andy Shevchenko wrote:
> > > Make sure that cache is initialised before calling any IO
> > > using regmap, this makes sure that we won't access NULL or
> > > invalid pointers in the cache which hasn't been initialised.
> > 
> > Either this (I suspect it's this) or the subsequent patch is introducing
> > regressions in the ASoC tests on several of my systems in the form:
> > 
> > # ok 1 get_value.AT91SAMG20EK.13
> > # # AT91SAMG20EK.13 Inpwm8731 1-001b: ASoC error (-5): at soc_component_read_no_lock() on wm8731.1-001b for register: [0x00000004]
> > ut Mux
> > 
> >   https://lava.sirena.org.uk/scheduler/job/2498613#L1549
> > 
> > It's not absolutely everything but it's multiple systems (several with
> > Wolfson devices, plus the Pine64 Plus which has an integrated Allwinner
> > CODEC).  I didn't check beyond seeing the failures yet.
> 
> Thanks!
> 
> I also run kunit test cases and it seems like half-failing. I'm about to check
> deeper what's the cause. (Obviously it works in my case on real HW, but...)

At least one small amendment fixed all kunit failures for me. I will send a new
version soon with also fixed patch 5.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 3/5] regcache: Move HW readback after cache initialisation

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 481 bytes --]

On Thu, Feb 26, 2026 at 03:41:38PM +0200, Andy Shevchenko wrote:
> On Thu, Feb 26, 2026 at 03:27:28PM +0200, Andy Shevchenko wrote:

> > I also run kunit test cases and it seems like half-failing. I'm about to check
> > deeper what's the cause. (Obviously it works in my case on real HW, but...)

Yeah, it worked for me on a bunch of other hardware.

> At least one small amendment fixed all kunit failures for me. I will send a new
> version soon with also fixed patch 5.

Great.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[PATCH v2 4/5] regcache: Define iterator inside for-loop and align their types

[Andy Shevchenko]

Some of the iterators may be defined inside the respective for-loop
reducing the scope and potential risk of their misuse. While at it,
align their types based on the type of the upper or lower limits.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/internal.h |  2 +-
 drivers/base/regmap/regcache.c | 13 ++++++-------
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index 5bf993165438..c77f3a49a89e 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -162,7 +162,7 @@ struct regmap {
 	bool no_sync_defaults;
 
 	struct reg_sequence *patch;
-	int patch_regs;
+	unsigned int patch_regs;
 
 	/* if set, the regmap core can sleep */
 	bool can_sleep;
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index de03b090f152..7ac30762c236 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -44,11 +44,11 @@ EXPORT_SYMBOL_GPL(regcache_sort_defaults);
 
 static int regcache_count_cacheable_registers(struct regmap *map)
 {
-	int count;
-	int i;
+	unsigned int count;
 
 	/* calculate the size of reg_defaults */
-	for (count = 0, i = 0; i < map->num_reg_defaults_raw; i++)
+	count = 0;
+	for (unsigned int i = 0; i < map->num_reg_defaults_raw; i++)
 		if (regmap_readable(map, i * map->reg_stride) &&
 		    !regmap_volatile(map, i * map->reg_stride))
 			count++;
@@ -62,7 +62,6 @@ static int regcache_count_cacheable_registers(struct regmap *map)
 
 static int regcache_hw_init(struct regmap *map, int count)
 {
-	int i, j;
 	int ret;
 	unsigned int reg, val;
 	void *tmp_buf;
@@ -95,7 +94,7 @@ static int regcache_hw_init(struct regmap *map, int count)
 	}
 
 	/* fill the reg_defaults */
-	for (i = 0, j = 0; i < map->num_reg_defaults_raw; i++) {
+	for (unsigned int i = 0, j = 0; i < map->num_reg_defaults_raw; i++) {
 		reg = i * map->reg_stride;
 
 		if (!regmap_readable(map, reg))
@@ -841,13 +840,13 @@ static int regcache_sync_block_raw(struct regmap *map, void *block,
 			    unsigned int block_base, unsigned int start,
 			    unsigned int end)
 {
-	unsigned int i, val;
 	unsigned int regtmp = 0;
 	unsigned int base = 0;
 	const void *data = NULL;
+	unsigned int val;
 	int ret;
 
-	for (i = start; i < end; i++) {
+	for (unsigned int i = start; i < end; i++) {
 		regtmp = block_base + (i * map->reg_stride);
 
 		if (!regcache_reg_present(cache_present, i) ||
-- 
2.50.1

[PATCH v2 5/5] regcache: Amend printf() specifiers when printing registers

[Andy Shevchenko]

In one case the 0x is provided in the formatting string, while
the rest use # for that.

In a couple of more cases a decimal signed value specifier is used.

Amend them to use %#x when register is printed. Note, for the case,
when it's related to the read/write, use %x to be in align with
the similar messages in regmap core.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/base/regmap/regcache.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 7ac30762c236..1d1e252a9f7e 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -112,7 +112,7 @@ static int regcache_hw_init(struct regmap *map, int count)
 			ret = regmap_read(map, reg, &val);
 			map->cache_bypass = cache_bypass;
 			if (ret != 0) {
-				dev_err(map->dev, "Failed to read %d: %d\n",
+				dev_err(map->dev, "Failed to read %x: %d\n",
 					reg, ret);
 				goto err_free;
 			}
@@ -509,7 +509,7 @@ int regcache_sync_region(struct regmap *map, unsigned int min,
 	bypass = map->cache_bypass;
 
 	name = map->cache_ops->name;
-	dev_dbg(map->dev, "Syncing %s cache from %d-%d\n", name, min, max);
+	dev_dbg(map->dev, "Syncing %s cache from %#x-%#x\n", name, min, max);
 
 	trace_regcache_sync(map, name, "start region");
 
@@ -818,7 +818,7 @@ static int regcache_sync_block_raw_flush(struct regmap *map, const void **data,
 
 	count = (cur - base) / map->reg_stride;
 
-	dev_dbg(map->dev, "Writing %zu bytes for %d registers from 0x%x-0x%x\n",
+	dev_dbg(map->dev, "Writing %zu bytes for %d registers from %#x-%#x\n",
 		count * val_bytes, count, base, cur - map->reg_stride);
 
 	map->cache_bypass = true;
-- 
2.50.1

Re: [PATCH v2 5/5] regcache: Amend printf() specifiers when printing registers

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 333 bytes --]

On Wed, Feb 25, 2026 at 05:15:59PM +0100, Andy Shevchenko wrote:

> -	dev_dbg(map->dev, "Writing %zu bytes for %d registers from 0x%x-0x%x\n",
> +	dev_dbg(map->dev, "Writing %zu bytes for %d registers from %#x-%#x\n",
>  		count * val_bytes, count, base, cur - map->reg_stride);

I'm really not convinced this is helping legibility.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH v2 5/5] regcache: Amend printf() specifiers when printing registers

[Andy Shevchenko]

On Wed, Feb 25, 2026 at 07:15:18PM +0000, Mark Brown wrote:
> On Wed, Feb 25, 2026 at 05:15:59PM +0100, Andy Shevchenko wrote:

...

> > -	dev_dbg(map->dev, "Writing %zu bytes for %d registers from 0x%x-0x%x\n",
> > +	dev_dbg(map->dev, "Writing %zu bytes for %d registers from %#x-%#x\n",
> >  		count * val_bytes, count, base, cur - map->reg_stride);
> 
> I'm really not convinced this is helping legibility.

You mean the only this hunk, or the entire patch?

If the former, I have no strong opinion, can drop it as 0x%x is (almost)
an equivalent to %#x. For the %d --> %x I think it needs to be applied as
it makes harder to debug and follow when some of the messages use register
printed in decimal.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 5/5] regcache: Amend printf() specifiers when printing registers

[Andy Shevchenko]

On Wed, Feb 25, 2026 at 09:24:36PM +0200, Andy Shevchenko wrote:
> On Wed, Feb 25, 2026 at 07:15:18PM +0000, Mark Brown wrote:
> > On Wed, Feb 25, 2026 at 05:15:59PM +0100, Andy Shevchenko wrote:

...

> > > -	dev_dbg(map->dev, "Writing %zu bytes for %d registers from 0x%x-0x%x\n",
> > > +	dev_dbg(map->dev, "Writing %zu bytes for %d registers from %#x-%#x\n",
> > >  		count * val_bytes, count, base, cur - map->reg_stride);
> > 
> > I'm really not convinced this is helping legibility.
> 
> You mean the only this hunk, or the entire patch?
> 
> If the former, I have no strong opinion, can drop it as 0x%x is (almost)
> an equivalent to %#x. For the %d --> %x I think it needs to be applied as

> it makes harder to debug and follow when some of the messages use register

Under 'it' I meant here the decimal printing versus hexadecimal.

> printed in decimal.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 5/5] regcache: Amend printf() specifiers when printing registers

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 635 bytes --]

On Wed, Feb 25, 2026 at 09:24:32PM +0200, Andy Shevchenko wrote:
> On Wed, Feb 25, 2026 at 07:15:18PM +0000, Mark Brown wrote:
> > On Wed, Feb 25, 2026 at 05:15:59PM +0100, Andy Shevchenko wrote:

> > > -	dev_dbg(map->dev, "Writing %zu bytes for %d registers from 0x%x-0x%x\n",
> > > +	dev_dbg(map->dev, "Writing %zu bytes for %d registers from %#x-%#x\n",
> > >  		count * val_bytes, count, base, cur - map->reg_stride);

> > I'm really not convinced this is helping legibility.

> You mean the only this hunk, or the entire patch?

Just that hunk, it's new and unusual, reads less cleanly and I can't
identify any problem it solves.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: (subset) [PATCH v2 0/5] regcache: Avoid accessing non-initialised cache

[Mark Brown]

On Wed, 25 Feb 2026 17:15:54 +0100, Andy Shevchenko wrote:
> Refactor regcache flow that populates cache on initialisation phase
> based on the values in HW. This makes code robust against any possible
> accesses to not-fully initialised caches.
> 
> Changelog v2:
> - rebased on top of the latest regmap changes (Mark)
> - added two more little cleanups (patches 4 & 5)
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-next

Thanks!

[1/5] regcache: Remove duplicate check in regcache_hw_init()
      commit: 1fcf171178f021ef2005d47e281544624b93c5a5
[2/5] regcache: Split regcache_count_cacheable_registers() helper
      commit: c2bcf62ca75c541ec4297e6ff02a68ddc2e02029
[3/5] regcache: Move HW readback after cache initialisation
      (no commit info)
[4/5] regcache: Define iterator inside for-loop and align their types
      (no commit info)

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark