From e07f69641b99751abc02091d3a824dd3039bbd27 Mon Sep 17 00:00:00 2001 From: Avi Weiss Date: Fri, 1 May 2026 09:54:26 +0200 Subject: [PATCH] bsp/arm/tms570: protect against vector < 2 in irq_set_priority calls to tms570_irq_set_priority protect against requesting a priority < 2, but not against inputs with vector < 2. for example calling tms570_irq_set_priority(ESM_HIGH, 10) will not only get through the guard, it will attempt to write to CHANCTRL0 (which gets blocked by hardware), puts whatever was there (apparently hardcoded INT-REQ0) into channel 10, and returns success. So the channel 10 request dissappeared from the VIM channel map completely - yet this call returns RTEMS_SUCCESSFUL TRM (for both TMS570LS31x and TMS570LC43x) states: NOTE: CHAN0 and CHAN1 are hard wired to INT_REQ0 and INT_REQ1, so they cannot be remapped. This commit puts a guard to fail on requests with vector < 2. --- bsps/arm/tms570/include/bsp/irq.h | 4 +++- bsps/arm/tms570/irq/irq.c | 5 +++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/bsps/arm/tms570/include/bsp/irq.h b/bsps/arm/tms570/include/bsp/irq.h index 118a20a4ce..7973022745 100644 --- a/bsps/arm/tms570/include/bsp/irq.h +++ b/bsps/arm/tms570/include/bsp/irq.h @@ -152,6 +152,8 @@ * channel associated with the priority is assigned to this channel. The * specified interrupt vector is assigned to the channel associated with the * priority. So, this function swaps the channels of two interrupt vectors. + * Interrupt vectors 0 and 1 cannot be reprioritized because the corresponding + * VIM channels are hardwired to INT_REQ0 and INT_REQ1 (FIQ requests). * * @param vector is the number of the interrupt vector to set the priority. * @@ -160,7 +162,7 @@ * @retval ::RTEMS_SUCCESSFUL The requested operation was successful. * * @retval ::RTEMS_INVALID_ID There was no interrupt vector associated with the - * number specified by ``vector``. + * number specified by ``vector``, or the vector cannot be remapped. * * @retval ::RTEMS_INVALID_PRIORITY The interrupt priority specified in * ``priority`` was invalid. diff --git a/bsps/arm/tms570/irq/irq.c b/bsps/arm/tms570/irq/irq.c index 0cb9bd661c..adeb967440 100644 --- a/bsps/arm/tms570/irq/irq.c +++ b/bsps/arm/tms570/irq/irq.c @@ -79,6 +79,11 @@ rtems_status_code tms570_irq_set_priority( return RTEMS_INVALID_ID; } + /* CHAN0 & CHAN1 are hard wired to INT_REQ0 & INT_REQ1 and can't be remapped. */ + if (vector < 2) { + return RTEMS_INVALID_ID; + } + if (priority < 2) { return RTEMS_INVALID_PRIORITY; }