Two irq elements on the same IOAPIC pin are accepted silently; the second overwrites the first
Component: tool/microkit
Version: SDK 2.1.0, board x86_64_generic, config debug
Impact: a real configuration mistake produces no diagnostic at all. One of the two channels
never fires, and nothing says why.
Summary
The tool rejects two IRQs sharing a vector (see the companion report), but accepts two IRQs
sharing a pin as long as their vectors differ — including within a single protection domain.
Since an IOAPIC redirection entry holds one destination vector per pin, the second declaration
overwrites the first. No warning is emitted.
Reproduction
<system>
<protection_domain name="probe" priority="100" stack_size="0x4000">
<program_image path="probe.elf"/>
<irq id="0" pin="11" vector="43"/>
<irq id="1" pin="11" vector="44"/>
</protection_domain>
</system>$ microkit min.system --board x86_64_generic --config debug --search-path elf -o out.img -r report.txt
MICROKIT|CAPDL SPEC: number of root objects = 47, spec footprint = 6.79 KiB
$ echo $?
0
Both IRQ objects appear in the report:
# IRQ Details
- IRQ: 'irq_43_probe'
* Vector: 43
* IOAPIC: 0
* Pin: 11
- IRQ: 'irq_44_probe'
* Vector: 44
* IOAPIC: 0
* Pin: 11
Suggested fix
Reject — or at minimum warn on — two irq elements targeting the same (ioapic, pin) pair,
the way the vector collision is already rejected. The check is symmetric to the existing one and
catches a mistake that is otherwise invisible until a channel silently stops working.
Two
irqelements on the same IOAPIC pin are accepted silently; the second overwrites the firstComponent:
tool/microkitVersion: SDK 2.1.0, board
x86_64_generic, configdebugImpact: a real configuration mistake produces no diagnostic at all. One of the two channels
never fires, and nothing says why.
Summary
The tool rejects two IRQs sharing a
vector(see the companion report), but accepts two IRQssharing a
pinas long as their vectors differ — including within a single protection domain.Since an IOAPIC redirection entry holds one destination vector per pin, the second declaration
overwrites the first. No warning is emitted.
Reproduction
Both IRQ objects appear in the report:
Suggested fix
Reject — or at minimum warn on — two
irqelements targeting the same(ioapic, pin)pair,the way the vector collision is already rejected. The check is symmetric to the existing one and
catches a mistake that is otherwise invisible until a channel silently stops working.