Files
linux/arch/arm/mach-imx/cpu-imx31.c
Yuho Choi ccb4b54b8e ARM: imx31: Fix IIM mapping leak in revision check
mx31_read_cpu_rev() maps the IIM registers with of_iomap() to read the
silicon revision, but returns without unmapping the MMIO mapping.

Keep the normalized revision value in a local variable and route the
return path through iounmap() after the revision register has been read.

Fixes: 3172225d45 ("ARM: imx31: Retrieve the IIM base address from devicetree")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-01 15:58:13 -04:00

73 lines
1.8 KiB
C

// SPDX-License-Identifier: GPL-2.0-or-later
/*
* MX31 CPU type detection
*
* Copyright (c) 2009 Daniel Mack <daniel@caiaq.de>
*/
#include <linux/module.h>
#include <linux/of_address.h>
#include <linux/io.h>
#include "common.h"
#include "hardware.h"
#include "iim.h"
static int mx31_cpu_rev = -1;
static struct {
u8 srev;
const char *name;
unsigned int rev;
} mx31_cpu_type[] = {
{ .srev = 0x00, .name = "i.MX31(L)", .rev = IMX_CHIP_REVISION_1_0 },
{ .srev = 0x10, .name = "i.MX31", .rev = IMX_CHIP_REVISION_1_1 },
{ .srev = 0x11, .name = "i.MX31L", .rev = IMX_CHIP_REVISION_1_1 },
{ .srev = 0x12, .name = "i.MX31", .rev = IMX_CHIP_REVISION_1_1 },
{ .srev = 0x13, .name = "i.MX31L", .rev = IMX_CHIP_REVISION_1_1 },
{ .srev = 0x14, .name = "i.MX31", .rev = IMX_CHIP_REVISION_1_2 },
{ .srev = 0x15, .name = "i.MX31L", .rev = IMX_CHIP_REVISION_1_2 },
{ .srev = 0x28, .name = "i.MX31", .rev = IMX_CHIP_REVISION_2_0 },
{ .srev = 0x29, .name = "i.MX31L", .rev = IMX_CHIP_REVISION_2_0 },
};
static int mx31_read_cpu_rev(void)
{
void __iomem *iim_base;
struct device_node *np;
u32 i, srev;
int rev = IMX_CHIP_REVISION_UNKNOWN;
np = of_find_compatible_node(NULL, NULL, "fsl,imx31-iim");
iim_base = of_iomap(np, 0);
of_node_put(np);
BUG_ON(!iim_base);
/* read SREV register from IIM module */
srev = imx_readl(iim_base + MXC_IIMSREV);
srev &= 0xff;
for (i = 0; i < ARRAY_SIZE(mx31_cpu_type); i++)
if (srev == mx31_cpu_type[i].srev) {
rev = mx31_cpu_type[i].rev;
imx_print_silicon_rev(mx31_cpu_type[i].name,
mx31_cpu_type[i].rev);
goto out;
}
imx_print_silicon_rev("i.MX31", IMX_CHIP_REVISION_UNKNOWN);
out:
iounmap(iim_base);
return rev;
}
int mx31_revision(void)
{
if (mx31_cpu_rev == -1)
mx31_cpu_rev = mx31_read_cpu_rev();
return mx31_cpu_rev;
}
EXPORT_SYMBOL(mx31_revision);