* [PATCH v2 1/2] regmap: Remove debugfs before cache teardown
2026-10-04 12:38 [PATCH v2 0/2] regmap: Fix cache lifecycle locking and teardown Michael Reeves via B4 Relay
@ 2026-10-04 12:38 ` Michael Reeves via B4 Relay
2026-10-04 12:38 ` [PATCH v2 2/2] regmap: Drop map lock during cache init and exit Michael Reeves via B4 Relay
1 sibling, 0 replies; 5+ messages in thread
From: Michael Reeves via B4 Relay @ 2026-10-04 12:38 UTC (permalink / raw)
To: Mark Brown
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Danilo Krummrich,
Liam R. Howlett, linux-kernel, driver-core, maple-tree, asahi,
Michael Reeves
From: Michael Reeves <michael.reeves077@gmail.com>
regmap_exit() and regmap_reinit_cache() destroy the register cache before
removing debugfs. A concurrent debugfs cache operation can therefore
access cache state after the backend exit callback starts freeing it.
Remove debugfs before cache teardown, and clear the debugfs pointer after
removal. During cache reinitialization, recreate debugfs only after the
new cache initializes successfully.
Signed-off-by: Michael Reeves <michael.reeves077@gmail.com>
---
drivers/base/regmap/regmap-debugfs.c | 1 +
drivers/base/regmap/regmap.c | 15 +++++++++------
2 files changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 18f1c60749..9a09df2ba8 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -664,6 +664,7 @@ void regmap_debugfs_exit(struct regmap *map)
{
if (map->debugfs) {
debugfs_remove_recursive(map->debugfs);
+ map->debugfs = NULL;
mutex_lock(&map->cache_lock);
regmap_debugfs_free_dump_cache(map);
mutex_unlock(&map->cache_lock);
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index e6e022b026..8e50a05ff0 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1422,8 +1422,8 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
{
int ret;
- regcache_exit(map);
regmap_debugfs_exit(map);
+ regcache_exit(map);
map->max_register = config->max_register;
map->max_register_is_set = map->max_register ?: config->max_register_is_0;
@@ -1440,12 +1440,16 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
if (ret)
return ret;
- regmap_debugfs_init(map);
-
map->cache_bypass = false;
map->cache_only = false;
- return regcache_init(map, config);
+ ret = regcache_init(map, config);
+ if (ret)
+ return ret;
+
+ regmap_debugfs_init(map);
+
+ return 0;
}
EXPORT_SYMBOL_GPL(regmap_reinit_cache);
@@ -1459,9 +1463,8 @@ void regmap_exit(struct regmap *map)
struct regmap_async *async;
regmap_detach_dev(map->dev, map);
- regcache_exit(map);
-
regmap_debugfs_exit(map);
+ regcache_exit(map);
regmap_range_exit(map);
if (map->bus && map->bus->free_context)
map->bus->free_context(map->bus_context);
--
2.55.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v2 2/2] regmap: Drop map lock during cache init and exit
2026-10-04 12:38 [PATCH v2 0/2] regmap: Fix cache lifecycle locking and teardown Michael Reeves via B4 Relay
2026-10-04 12:38 ` [PATCH v2 1/2] regmap: Remove debugfs before cache teardown Michael Reeves via B4 Relay
@ 2026-10-04 12:38 ` Michael Reeves via B4 Relay
2026-10-05 12:03 ` Mark Brown
1 sibling, 1 reply; 5+ messages in thread
From: Michael Reeves via B4 Relay @ 2026-10-04 12:38 UTC (permalink / raw)
To: Mark Brown
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Danilo Krummrich,
Liam R. Howlett, linux-kernel, driver-core, maple-tree, asahi,
Michael Reeves
From: Michael Reeves <michael.reeves077@gmail.com>
On systems with CONFIG_PROVE_RAW_LOCK_NESTING enabled, Apple GPIO probe
triggers an "Invalid wait context" lockdep warning.
The driver uses a regmap with a raw spinlock and REGCACHE_FLAT. During
regcache_init(), regcache_flat_init() allocates memory while holding the
raw spinlock. The memory allocator can acquire a non-raw spinlock, which
causes an invalid raw-to-non-raw lock nesting error. The abbreviated call
chain is:
apple_gpio_pinctrl_probe
regcache_init
regcache_flat_init
__kmalloc_noprof
__pcs_replace_empty_main
refill_objects
_raw_spin_lock_irqsave
Cache allocation occurs before the regmap is published, cache destruction
occurs after users have stopped accessing it, and regmap_reinit_cache()
requires callers to prevent concurrent access. Remove the outer map lock
from cache initialization and destruction. Keep it for cache population
and normal register access.
The Maple cache still uses its internal spinlock during teardown. That
lock can also be acquired from hard IRQ context during register access, so
use spin_lock_irqsave() during teardown to preserve its IRQ-safe lockdep
state.
Fixes: fd4ebc07b4df ("regmap: Hold the regmap lock when allocating and freeing the cache")
Signed-off-by: Michael Reeves <michael.reeves077@gmail.com>
---
drivers/base/regmap/regcache-maple.c | 5 +++--
drivers/base/regmap/regcache.c | 6 ------
2 files changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/base/regmap/regcache-maple.c b/drivers/base/regmap/regcache-maple.c
index e46fe5c32b..9419dc1be9 100644
--- a/drivers/base/regmap/regcache-maple.c
+++ b/drivers/base/regmap/regcache-maple.c
@@ -312,16 +312,17 @@ static void regcache_maple_exit(struct regmap *map)
struct maple_tree *mt = map->cache;
MA_STATE(mas, mt, 0, UINT_MAX);
unsigned int *entry;
+ unsigned long flags;
/* if we've already been called then just return */
if (!mt)
return;
- mas_lock(&mas);
+ spin_lock_irqsave(&mt->ma_lock, flags);
mas_for_each(&mas, entry, UINT_MAX)
kfree(entry);
__mt_destroy(mt);
- mas_unlock(&mas);
+ spin_unlock_irqrestore(&mt->ma_lock, flags);
kfree(mt);
map->cache = NULL;
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 0d58d900a2..b137ded7fd 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -225,9 +225,7 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
if (map->cache_ops->init) {
dev_dbg(map->dev, "Initializing %s cache\n",
map->cache_ops->name);
- map->lock(map->lock_arg);
ret = map->cache_ops->init(map);
- map->unlock(map->lock_arg);
if (ret)
goto err_free_reg_defaults;
}
@@ -259,9 +257,7 @@ int regcache_init(struct regmap *map, const struct regmap_config *config)
err_exit:
if (map->cache_ops->exit) {
dev_dbg(map->dev, "Destroying %s cache\n", map->cache_ops->name);
- map->lock(map->lock_arg);
map->cache_ops->exit(map);
- map->unlock(map->lock_arg);
}
err_free_reg_defaults:
kfree(map->reg_defaults);
@@ -281,9 +277,7 @@ void regcache_exit(struct regmap *map)
if (map->cache_ops->exit) {
dev_dbg(map->dev, "Destroying %s cache\n",
map->cache_ops->name);
- map->lock(map->lock_arg);
map->cache_ops->exit(map);
- map->unlock(map->lock_arg);
}
kfree(map->reg_defaults);
--
2.55.0
^ permalink raw reply [flat|nested] 5+ messages in thread