[PATCH] phy: rockchip-samsung-dcphy: fix out-of-range max_register

[Sebastian Reichel]

Hi,

On Tue, Aug 11, 2026 at 04:10:22PM +0800, Jason Yang via B4 Relay wrote:
> From: Jason Yang <jason98166 at gmail.com>
> 
> The PHY register block is 64KB, so with a register stride of 4 the
> last accessible register sits at offset 0xfffc. max_register names
> 0x10000, one register past the end of the mapping: dumping the
> registers through the regmap debugfs interface reads beyond the
> ioremapped region and oopses on the unmapped page. The oops fires
> with the regmap lock held, so later PHY operations deadlock.
> 
> Fixes: b2a1a2ae7818 ("phy: rockchip: Add Samsung MIPI D-/C-PHY driver")
> Cc: stable at vger.kernel.org
> Signed-off-by: Jason Yang <jason98166 at gmail.com>
> Assisted-by: Claude:claude-opus-5
> ---
> Observed on an RK3588 board (v7.2-rc4): reading the debugfs
> registers file for this PHY faults deterministically at offset
> 0x10000 (translation fault in regmap_mmio_read32le), and every
> later PHY operation then blocks on the leaked lock. With
> max_register corrected the dump walks 0x0000-0xfffc and completes,
> and the PHY keeps working afterwards.
> 
> Growing the mapping is not an option: the TRM address map lists
> each MIPI CD PHY as a 64KB block and the second PHY starts at the
> next 64KB boundary, so offset 0x10000 of one PHY is register zero
> of the other.
> 
> The same mistake was fixed the same way in c7d436a6c1a2
> ("dmaengine: xilinx: xdma: Fix regmap max_register").
> 
> This is independent of the D-PHY receiver series for the same
> driver and applies in either order.
> ---

Reviewed-by: Sebastian Reichel <sebastian.reichel at collabora.com>

Greetings,

-- Sebastian

>  drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c b/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
> index cbd780556da8..18f5f582d1d7 100644
> --- a/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
> +++ b/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
> @@ -1526,7 +1526,7 @@ static const struct regmap_config samsung_mipi_dcphy_regmap_config = {
>  	.reg_bits = 32,
>  	.val_bits = 32,
>  	.reg_stride = 4,
> -	.max_register = 0x10000,
> +	.max_register = 0xfffc,
>  };
>  
>  static struct phy *samsung_mipi_dcphy_xlate(struct device *dev,
> 
> ---
> base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
> change-id: 20260811-dcphy-maxreg-v1-74a99944cf52
> 
> Best regards,
> -- 
> Jason Yang <jason98166 at gmail.com>
> 
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20260811/40f5b5db/attachment.sig>