Issue created by Sebastian Huber:
https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5786
## Summary
Commit `0c339acf220` ("bsps/leon3: Add support for IRQMP IRQMAP", 2026-06-23)
reads 16 interrupt map registers and accepts vectors 1 to 63. The GR740 has 8
map registers and 32 bus interrupt lines. The BSP therefore reads undefined
register offsets and accepts vectors which no bus line carries. The option
`LEON3_IRQAMP_IRQMAP` enables this code, and `sparc/gr740` enables the option
by default.
## Reference
| Source | Section | Statement |
| --- | --- | --- |
| GR740-UM-DS 2.10 | Table 379 | The map registers are IRQMAP0 to IRQMAP7 at
`0x300` to `0x31C`. |
| GR740-UM-DS 2.10 | 21.3.19 | IRQMAPn holds the fields for the bus lines `4*n`
to `4*n+3`. |
| GRIP 2025.2 | Figure 253 | The map switches the 32 lines of
`APBI.PIRQ[31:0]`. |
| GRIP 2025.2 | Table 1857, `irqmap` | The map registers cover bus lines 0 to
15 or 0 to 31. |
No IRQ(A)MP configuration has a map register at `0x320` or above.
## Defects
| Location | Code | Consequence |
| --- | --- | --- |
| `bsp/irq.h` | `BSP_INTERRUPT_VECTOR_MAX_MAP 63` | The bound is 31 on the
GR740. |
| `grlib/irqamp-regs.h` | `uint32_t irqmap[ 16 ]` | The register block names 8
registers which do not exist. |
| `leon3_ext_irq_init()` | loop up to `BSP_INTERRUPT_VECTOR_MAX_MAP` | The BSP
reads `0x320` to `0x33C`. The content of `LEON3_IrqCtrl_Mapping[32..63]` is
undefined. |
| `bsp_interrupt_is_valid_vector()` | `vector <= BSP_INTERRUPT_VECTOR_MAX_MAP`
| Vectors 32 to 63 pass as valid. A handler install on such a vector attaches
to an undefined controller line. |
| `bsp_interrupt_entry_install_first()` | `index = modified_vector` | The
dispatch table has `BSP_INTERRUPT_VECTOR_COUNT` (32) entries. A map value above
31 indexes past its end. |
| every `1U << vector` after the map lookup | `bit = 1U << vector` | A map
field is 8 bits wide. A value above 31 makes the shift undefined behaviour. |
## Test evidence
`ts-validation-intr.exe` uses `BSP_INTERRUPT_VECTOR_COUNT` (32) as its
invalid vector and expects `RTEMS_INVALID_ID`. With `LEON3_IRQAMP_IRQMAP`,
`bsp_interrupt_is_valid_vector()` accepts vector 32. The test fails on any
GR740 for this reason.
The runs used RTEMS `e9d427c097d` on SIS with rtems/tools/rtems-sis!13, which
adds the 8 map registers of the manual. On SIS, offsets `0x320` to `0x33C`
read zero, so vectors 32 to 63 map to controller line 0.
| Build | `BSP_INTERRUPT_VECTOR_MAX_MAP` | Checks | Failed checks |
| --- | --- | --- | --- |
| uni | 63 | 27642 | 434 |
| uni | 31 | 27639 | 0 |
| SMP | 63 | 27305 | 436 |
| SMP | 31 | 27302 | 0 |
The rest of the test suite passes in both builds.
## Proposed fix
1. Set the bound to 31 for the GR740. Derive it from the `irqmap` and `eirq`
configuration if other LEON3 systems need 15.
2. Reduce `irqmap` in `irqamp-regs.h` to 8 registers.
3. Reject a map value of 0 or above 31 in `leon3_ext_irq_init()`, or treat
the bus line as not connected.
## Open point
`leon3_ext_irq_init()` reads the map once. A write to IRQMAPn after the
initialisation leaves `LEON3_IrqCtrl_Mapping` stale. A test which remaps a
line at run time must update the table, or the BSP must provide a set
function.
This description was created with Claude Code assistance.
--
View it on GitLab: https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5786
You're receiving this email because of your account on gitlab.rtems.org.
Unsubscribe from this thread:
https://gitlab.rtems.org/-/namespace/49/sent_notifications/5-2g0g2gj1dzbqpgzwzx6a05qmv-1d/unsubscribe
| Manage all notifications: https://gitlab.rtems.org/-/profile/notifications |
Help: https://gitlab.rtems.org/help
_______________________________________________
bugs mailing list
[email protected]
http://lists.rtems.org/mailman/listinfo/bugs
