diff options
| author | Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> | 2010-11-27 03:05:46 +0800 |
|---|---|---|
| committer | Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> | 2010-12-03 01:53:13 +0800 |
| commit | 04191aa0fc14eb01a750641343e5e0b98d7725c6 (patch) | |
| tree | 510f615bed27e58bd962fd3fd79fc7c6c7720326 | |
| parent | fec9928dc7141d449ac3afc91500af68727b4020 (diff) | |
| download | barebox-04191aa0fc14eb01a750641343e5e0b98d7725c6.tar.gz barebox-04191aa0fc14eb01a750641343e5e0b98d7725c6.tar.xz | |
cfi_flash: do not reset flash when probe fails
The CFI flash driver starts at flash_init() which calls down into
flash_get_size(). This starts by calling flash_detect_cfi(). If said
function fails, flash_get_size() finishes by attempting to reset the
flash. Unfortunately, it does this with an info->portwidth set to 0x10
which filters down into flash_make_cmd() and that happily smashes the
stack by sticking info->portwidth bytes into a cfiword_t variable that
lives on the stack. On a 64bit system you probably won't notice, but
killing the last 8 bytes on a 32bit system usually leads to a corrupt
return address. Which is what happens on a Blackfin system.
based on U-Boot
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
| -rw-r--r-- | drivers/nor/cfi_flash.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/nor/cfi_flash.c b/drivers/nor/cfi_flash.c index 041fb92dec..a7df3b4f4d 100644 --- a/drivers/nor/cfi_flash.c +++ b/drivers/nor/cfi_flash.c @@ -494,9 +494,9 @@ static ulong flash_get_size (struct flash_info *info, ulong base) if ((info->interface == FLASH_CFI_X8X16) && (info->chipwidth == FLASH_CFI_BY8)) { info->portwidth >>= 1; /* XXX - Need to test on x8/x16 in parallel. */ } + flash_write_cmd (info, 0, 0, info->cmd_reset); } - flash_write_cmd (info, 0, 0, info->cmd_reset); return info->size; } |