Skip to content

tool: detect duplicate I/O APIC IRQs and MSIs - #600

Merged
dreamliner787-9 merged 1 commit into
seL4:mainfrom
au-ts:x86_duplicate_irq_check
Sep 18, 2026
Merged

dreamliner787-9 merged 1 commit into
seL4:mainfrom
au-ts:x86_duplicate_irq_check

Conversation

@dreamliner787-9

@dreamliner787-9 dreamliner787-9 commented Sep 15, 2026 •

Copy link
Copy Markdown
Collaborator

If you create multiple IRQ elements in the SDF with different vectors but the same I/O APIC or PCI device source, the kernel will silently overwrite all of those with the element that is processed last by the capDL initialiser at runtime.

We should guard against this footgun by reporting an error in the tool.

Closes #598.

Related: seL4/seL4#1748.

Comment thread tool/microkit/tests/test.rs
}

impl Ord for PciDevice {
fn cmp(&self, other: &Self) -> Ordering {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this needed because the capDL tool doesn't have Cmp on object::PCIDevice?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea that's right

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't want to block this PR, but should we add a comment and fix it upstream?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could, but I'm not sure if there are negative implications if we add derives that the upstream code themselves don't use.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nah, it will be dead-code eliminated quite easily.

Comment thread tool/microkit/src/sdf.rs Outdated
@terryzbai

Copy link
Copy Markdown
Contributor

One I/O APIC IRQ number can be only mapped to one vector, but it is possible to share same I/O APIC IRQ number among multiple PCI devices, which means the same IRQ might need to be mapped to at least two driver PDs.

@dreamliner787-9

dreamliner787-9 commented Sep 15, 2026 •

Copy link
Copy Markdown
Collaborator Author

One I/O APIC IRQ number can be only mapped to one vector, but it is possible to share same I/O APIC IRQ number among multiple PCI devices

Sure

which means the same IRQ might need to be mapped to at least two driver PDs.

I don't think the kernel allow you to do this, seL4_IRQHandler_SetNotification section in the manual doesn't specify that you can bind > 1 notification to an interrupt. So you would have to do some Ntfn cap copy or something like that which I don't think will work in Microkit. Plus this problem can be entirely avoided by using MSI in the driver

@midnightveil

Copy link
Copy Markdown
Collaborator

Even if the kernel allowed it, you still can't tell which PD the interrupt is for, you need device knowledge for that, which requires either broadcast or some driver-level knowledge: so to replicate it on seL4 you need an intermediary PD.

(Possibly we should document this pattern somewhere?)

@dreamliner787-9

Copy link
Copy Markdown
Collaborator Author

(Possibly we should document this pattern somewhere?)

We could make an example?

@dreamliner787-9
dreamliner787-9 force-pushed the x86_duplicate_irq_check branch 3 times, most recently from 8b80405 to b59153d Compare September 18, 2026 00:37
If you create multiple IRQ elements in the SDF with different vectors
but the same I/O APIC or PCI device source, the kernel will silently
overwrite all of those with the element that is processed last by the
capDL initialiser at runtime.

We should guard against this footgun by reporting an error in the tool.

Signed-off-by: Bill Nguyen <bill.nguyen@unsw.edu.au>
@dreamliner787-9
dreamliner787-9 merged commit 8c6ca8c into seL4:main Sep 18, 2026
12 checks passed
@dreamliner787-9
dreamliner787-9 deleted the x86_duplicate_irq_check branch September 18, 2026 01:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Two irq elements on the same IOAPIC pin are accepted silently; the second overwrites the first

3 participants