[PATCH] phy: rockchip-samsung-dcphy: fix out-of-range max_register

[PATCH] phy: rockchip-samsung-dcphy: fix out-of-range max_register

[Jason Yang via B4 Relay]

From: Jason Yang <jason98166@gmail.com>

The PHY register block is 64KB, so with a register stride of 4 the
last accessible register sits at offset 0xfffc. max_register names
0x10000, one register past the end of the mapping: dumping the
registers through the regmap debugfs interface reads beyond the
ioremapped region and oopses on the unmapped page. The oops fires
with the regmap lock held, so later PHY operations deadlock.

Fixes: b2a1a2ae7818 ("phy: rockchip: Add Samsung MIPI D-/C-PHY driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jason Yang <jason98166@gmail.com>
Assisted-by: Claude:claude-opus-5
---
Observed on an RK3588 board (v7.2-rc4): reading the debugfs
registers file for this PHY faults deterministically at offset
0x10000 (translation fault in regmap_mmio_read32le), and every
later PHY operation then blocks on the leaked lock. With
max_register corrected the dump walks 0x0000-0xfffc and completes,
and the PHY keeps working afterwards.

Growing the mapping is not an option: the TRM address map lists
each MIPI CD PHY as a 64KB block and the second PHY starts at the
next 64KB boundary, so offset 0x10000 of one PHY is register zero
of the other.

The same mistake was fixed the same way in c7d436a6c1a2
("dmaengine: xilinx: xdma: Fix regmap max_register").

This is independent of the D-PHY receiver series for the same
driver and applies in either order.
---
 drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c b/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
index cbd780556da8..18f5f582d1d7 100644
--- a/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
+++ b/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
@@ -1526,7 +1526,7 @@ static const struct regmap_config samsung_mipi_dcphy_regmap_config = {
 	.reg_bits = 32,
 	.val_bits = 32,
 	.reg_stride = 4,
-	.max_register = 0x10000,
+	.max_register = 0xfffc,
 };
 
 static struct phy *samsung_mipi_dcphy_xlate(struct device *dev,

---
base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
change-id: 20260811-dcphy-maxreg-v1-74a99944cf52

Best regards,
-- 
Jason Yang <jason98166@gmail.com>

Re: [PATCH] phy: rockchip-samsung-dcphy: fix out-of-range max_register

[Sebastian Reichel]

[-- Attachment #1: Type: text/plain, Size: 2552 bytes --]

Hi,

On Tue, Aug 11, 2026 at 04:10:22PM +0800, Jason Yang via B4 Relay wrote:
> From: Jason Yang <jason98166@gmail.com>
> 
> The PHY register block is 64KB, so with a register stride of 4 the
> last accessible register sits at offset 0xfffc. max_register names
> 0x10000, one register past the end of the mapping: dumping the
> registers through the regmap debugfs interface reads beyond the
> ioremapped region and oopses on the unmapped page. The oops fires
> with the regmap lock held, so later PHY operations deadlock.
> 
> Fixes: b2a1a2ae7818 ("phy: rockchip: Add Samsung MIPI D-/C-PHY driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jason Yang <jason98166@gmail.com>
> Assisted-by: Claude:claude-opus-5
> ---
> Observed on an RK3588 board (v7.2-rc4): reading the debugfs
> registers file for this PHY faults deterministically at offset
> 0x10000 (translation fault in regmap_mmio_read32le), and every
> later PHY operation then blocks on the leaked lock. With
> max_register corrected the dump walks 0x0000-0xfffc and completes,
> and the PHY keeps working afterwards.
> 
> Growing the mapping is not an option: the TRM address map lists
> each MIPI CD PHY as a 64KB block and the second PHY starts at the
> next 64KB boundary, so offset 0x10000 of one PHY is register zero
> of the other.
> 
> The same mistake was fixed the same way in c7d436a6c1a2
> ("dmaengine: xilinx: xdma: Fix regmap max_register").
> 
> This is independent of the D-PHY receiver series for the same
> driver and applies in either order.
> ---

Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>

Greetings,

-- Sebastian

>  drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c b/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
> index cbd780556da8..18f5f582d1d7 100644
> --- a/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
> +++ b/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
> @@ -1526,7 +1526,7 @@ static const struct regmap_config samsung_mipi_dcphy_regmap_config = {
>  	.reg_bits = 32,
>  	.val_bits = 32,
>  	.reg_stride = 4,
> -	.max_register = 0x10000,
> +	.max_register = 0xfffc,
>  };
>  
>  static struct phy *samsung_mipi_dcphy_xlate(struct device *dev,
> 
> ---
> base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
> change-id: 20260811-dcphy-maxreg-v1-74a99944cf52
> 
> Best regards,
> -- 
> Jason Yang <jason98166@gmail.com>
> 
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] phy: rockchip-samsung-dcphy: fix out-of-range max_register

[Vinod Koul]

On Tue, 11 Aug 2026 16:10:22 +0800, Jason Yang wrote:
> The PHY register block is 64KB, so with a register stride of 4 the
> last accessible register sits at offset 0xfffc. max_register names
> 0x10000, one register past the end of the mapping: dumping the
> registers through the regmap debugfs interface reads beyond the
> ioremapped region and oopses on the unmapped page. The oops fires
> with the regmap lock held, so later PHY operations deadlock.
> 
> [...]

Applied, thanks!

[1/1] phy: rockchip-samsung-dcphy: fix out-of-range max_register
      commit: 4486e75ba647bd8b98fc1f053101b40caceeed4b

Best regards,
-- 
~Vinod