[PATCH] remoteproc: k3-r5: Fix crash when issuing rproc init
Richard Genoud (TI)
richard.genoud at bootlin.com
Thu Jun 25 15:30:06 CEST 2026
Prevent NULL pointer dereference with lockstep mode.
Since commit 21d03d60e909 ("j7200 defconfig: add rproc commands"),
issuing rproc init command with cluster configured in lockstep results
in a NULL pointer dereference.
This is because ti_sci_proc_request() is called on both cores on the
same cluster, without checking if they are populated.
To fix that, only request the core being probed, as there is no need to
request the other one.
Moreover, the old code was requesting both cores in lockstep mode, but
only releasing one:
it called k3_r5f_proc_request() with ti_sci_proc_release(), instead of
using k3_r5f_proc_request()/k3_r5f_proc_release() or
ti_sci_proc_request()/ti_sci_proc_release().
So, replacing k3_r5f_proc_request() by ti_sci_proc_request() restores
the intended behavior.
Fixes: 21d03d60e909 ("j7200 defconfig: add rproc commands")
Signed-off-by: Richard Genoud (TI) <richard.genoud at bootlin.com>
---
drivers/remoteproc/ti_k3_r5f_rproc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/remoteproc/ti_k3_r5f_rproc.c b/drivers/remoteproc/ti_k3_r5f_rproc.c
index 7326f5a4b30b..c5810dd0994a 100644
--- a/drivers/remoteproc/ti_k3_r5f_rproc.c
+++ b/drivers/remoteproc/ti_k3_r5f_rproc.c
@@ -861,7 +861,7 @@ static int k3_r5f_probe(struct udevice *dev)
return 0;
}
- ret = k3_r5f_proc_request(core);
+ ret = ti_sci_proc_request(&core->tsp);
if (ret)
return ret;
--
2.47.3
More information about the U-Boot
mailing list