Re: [PATCH] phy: rockchip-samsung-dcphy: fix out-of-range max_register

Sebastian Reichel <[email protected]> Tue, 11 Aug 2026 11:58:53 +0200

Newsgroups	org.infradead.lists.linux-rockchip,org.infradead.lists.linux-arm-kernel,org.infradead.lists.linux-phy,org.kernel.vger.linux-kernel,org.kernel.vger.stable
Message-ID	<anryDBa6t1k_VhY3@venus>

Hi,

On Tue, Aug 11, 2026 at 04:10:22PM +0800, Jason Yang via B4 Relay wrote:
> From: Jason Yang <[email protected]>
> 
> The PHY register block is 64KB, so with a register stride of 4 the
> last accessible register sits at offset 0xfffc. max_register names
> 0x10000, one register past the end of the mapping: dumping the
> registers through the regmap debugfs interface reads beyond the
> ioremapped region and oopses on the unmapped page. The oops fires
> with the regmap lock held, so later PHY operations deadlock.
> 
> Fixes: b2a1a2ae7818 ("phy: rockchip: Add Samsung MIPI D-/C-PHY driver")
> Cc: [email protected]
> Signed-off-by: Jason Yang <[email protected]>
> Assisted-by: Claude:claude-opus-5
> ---
> Observed on an RK3588 board (v7.2-rc4): reading the debugfs
> registers file for this PHY faults deterministically at offset
> 0x10000 (translation fault in regmap_mmio_read32le), and every
> later PHY operation then blocks on the leaked lock. With
> max_register corrected the dump walks 0x0000-0xfffc and completes,
> and the PHY keeps working afterwards.
> 
> Growing the mapping is not an option: the TRM address map lists
> each MIPI CD PHY as a 64KB block and the second PHY starts at the
> next 64KB boundary, so offset 0x10000 of one PHY is register zero
> of the other.
> 
> The same mistake was fixed the same way in c7d436a6c1a2
> ("dmaengine: xilinx: xdma: Fix regmap max_register").
> 
> This is independent of the D-PHY receiver series for the same
> driver and applies in either order.
> ---

Reviewed-by: Sebastian Reichel <[email protected]>

Greetings,

-- Sebastian

>  drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c b/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
> index cbd780556da8..18f5f582d1d7 100644
> --- a/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
> +++ b/drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c
> @@ -1526,7 +1526,7 @@ static const struct regmap_config samsung_mipi_dcphy_regmap_config = {
>  	.reg_bits = 32,
>  	.val_bits = 32,
>  	.reg_stride = 4,
> -	.max_register = 0x10000,
> +	.max_register = 0xfffc,
>  };
>  
>  static struct phy *samsung_mipi_dcphy_xlate(struct device *dev,
> 
> ---
> base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
> change-id: 20260811-dcphy-maxreg-v1-74a99944cf52
> 
> Best regards,
> -- 
> Jason Yang <[email protected]>
> 
>

_______________________________________________
Linux-rockchip mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-rockchip

signature.asc (application/pgp-signature, 833 B)