┌─────────────────────────────────────────┐
│              Guest OS                   │
├─────────────────────────────────────────┤
│           Jailhouse Hypervisor          │
│  ┌─────────────┐  ┌─────────────────┐   │
│  │ APIC虚拟化  │  │  中断路由与过滤  │   │
│  └─────────────┘  └─────────────────┘   │
├─────────────────────────────────────────┤
│            物理中断控制器                │
│     (APIC/IOAPIC/GIC)                  │
└─────────────────────────────────────────┘

// configs/x86/linux-x86-demo.c
static struct jailhouse_irqchip irqchips[] = {
    /* IOAPIC */ {
        .address = 0xfec00000,
        .id = 0xff00,
        .pin_bitmap = {
            0xffffff  // 允许的中断引脚位图
        },
    },
};

// hypervisor/arch/x86/ioapic.c
int ioapic_cell_init(struct cell *cell)
{
    const struct jailhouse_irqchip *irqchip;
    unsigned int n;

    // 验证cell的中断配置
    for_each_irqchip(irqchip, cell->config, n) {
        if (irqchip->address != IOAPIC_BASE_ADDR)
            return trace_error(-EINVAL);

        // 检查中断引脚分配冲突
        if (!ioapic_pin_bitmap_valid(irqchip->pin_bitmap))
            return trace_error(-EBUSY);
    }
    return 0;
}

// hypervisor/arch/x86/ioapic.c
enum mmio_result ioapic_mmio_access(void *arg, struct mmio_access *mmio)
{
    struct cell *cell = this_cell();
    unsigned int index, pin;
    u32 *reg_val;

    // 拦截IOAPIC寄存器访问
    switch (mmio->address - IOAPIC_BASE_ADDR) {
    case IOAPIC_REG_INDEX:
        // 索引寄存器访问
        if (mmio->is_write)
            ioapic_reg_index = mmio->value & 0xff;
        else
            mmio->value = ioapic_reg_index;
        break;

    case IOAPIC_REG_DATA:
        // 数据寄存器访问
        if (ioapic_reg_index >= IOAPIC_REDIR_TBL_START) {
            pin = (ioapic_reg_index - IOAPIC_REDIR_TBL_START) / 2;

            // 检查cell是否拥有该中断引脚
            if (!ioapic_cell_owns_pin(cell, pin))
                return MMIO_HANDLED; // 拒绝访问

            // 允许访问并转发到物理IOAPIC
            return ioapic_access_allowed(mmio);
        }
        break;
    }
    return MMIO_HANDLED;
}

// hypervisor/arch/x86/ioapic.c
static bool ioapic_cell_owns_pin(struct cell *cell, unsigned int pin)
{
    const struct jailhouse_irqchip *irqchip;
    unsigned int n;

    for_each_irqchip(irqchip, cell->config, n) {
        if (pin < IOAPIC_NUM_PINS &&
            test_bit(pin, irqchip->pin_bitmap))
            return true;
    }
    return false;
}

// hypervisor/arch/x86/pci.c
int x86_pci_config_handler(u16 port, bool dir_in, unsigned int size)
{
    // 拦截PCI配置端口访问
    if (port == PCI_CONFIG_ADDRESS) {
        if (!dir_in) {
            pci_config_address = *(u32*)&guest_regs->rax;
            // 验证设备访问权限
            if (!pci_device_access_allowed(pci_config_address))
                return 1; // 拒绝访问
        }
    }

    if (port >= PCI_CONFIG_DATA && port < PCI_CONFIG_DATA + 4) {
        // 处理MSI配置访问
        return pci_handle_msi_config(port, dir_in, size);
    }

    return 0; // 允许直接访问
}

// hypervisor/pci.c
static bool pci_msi_address_valid(u64 msi_address, struct cell *cell)
{
    // 验证MSI目标地址是否指向cell拥有的CPU
    unsigned int cpu_id = apic_msi_address_to_cpu_id(msi_address);

    return cell_owns_cpu(cell, cpu_id);
}

// hypervisor/arch/x86/apic.c
static bool apic_handle_timer_write(u32 reg, u32 val)
{
    switch (reg) {
    case APIC_REG_TIMER_ICR:
        // 初始计数值 - 允许guest设置
        apic_ops.write(reg, val);
        break;

    case APIC_REG_TIMER_DCR:
        // 分频器配置 - 允许guest设置
        apic_ops.write(reg, val);
        break;

    case APIC_REG_LVT_TIMER:
        // Timer LVT寄存器 - 检查并允许
        if (apic_lvt_valid(val))
            apic_ops.write(reg, val);
        break;
    }
    return true;
}

// Timer中断直接投递给guest，无需hypervisor干预
// 除非配置了特殊的中断重定向

// hypervisor/mmio.c
static enum mmio_result hpet_mmio_access(void *arg, struct mmio_access *mmio)
{
    struct cell *cell = this_cell();

    // 检查cell是否有HPET访问权限
    if (!cell_has_hpet_access(cell))
        return MMIO_UNHANDLED;

    // 允许直接访问HPET寄存器
    return mmio_perform_access(mmio->address, mmio);
}

// 对于需要PIT的legacy guest，提供虚拟化支持
// 大多数现代系统使用APIC timer或HPET

// hypervisor/arch/x86/apic.c
static bool apic_handle_icr_write(u32 lo_val, u32 hi_val)
{
    u32 shorthand = lo_val & APIC_ICR_SH_MASK;
    unsigned int target_cpu_id;

    // 验证投递模式
    switch (lo_val & APIC_ICR_DLVR_MASK) {
    case APIC_ICR_DLVR_FIXED:    // 固定投递
    case APIC_ICR_DLVR_LOWPRI:   // 低优先级
        break;
    case APIC_ICR_DLVR_NMI:      // NMI - 特殊处理
        return apic_handle_nmi_ipi(lo_val, hi_val);
    case APIC_ICR_DLVR_INIT:     // INIT信号
    case APIC_ICR_DLVR_SIPI:     // SIPI信号
        return apic_handle_init_sipi(lo_val, hi_val);
    default:
        panic_printk("FATAL: Unsupported APIC delivery mode\n");
        return false;
    }

    // 处理目标选择
    switch (shorthand) {
    case APIC_ICR_SH_SELF:       // 发送给自己
        apic_ops.write(APIC_REG_ICR, lo_val);
        return true;

    case APIC_ICR_SH_ALL:        // 发送给所有CPU
        return apic_send_ipi_all(lo_val, -1);

    case APIC_ICR_SH_ALLOTHER:   // 发送给其他所有CPU
        return apic_send_ipi_all(lo_val, this_cpu_id());

    default:
        // 指定目标的IPI
        if (lo_val & APIC_ICR_DEST_LOGICAL) {
            return apic_send_logical_dest_ipi(lo_val, hi_val);
        } else {
            target_cpu_id = apic_to_cpu_id[hi_val];
            return apic_send_physical_dest_ipi(target_cpu_id, lo_val);
        }
    }
}

// hypervisor/arch/x86/apic.c
static bool apic_send_physical_dest_ipi(unsigned int target_cpu_id, u32 icr_lo)
{
    // 关键检查：目标CPU是否属于当前cell
    if (!cell_owns_cpu(this_cell(), target_cpu_id)) {
        printk("WARNING: CPU %d specified IPI destination outside "
               "cell boundaries\n", this_cpu_id());
        return true; // 静默丢弃，不报错
    }

    // 发送IPI到目标CPU
    apic_ops.send_ipi(public_per_cpu(target_cpu_id)->apic_id, icr_lo);
    return true;
}

// hypervisor/arch/x86/apic.c
u32 x2apic_filter_logical_dest(struct cell *cell, u32 destination)
{
    unsigned int apic_id, logical_id, cluster_id;
    u32 dest = destination;

    // 解析x2APIC逻辑目标格式
    cluster_id = (destination & X2APIC_DEST_CLUSTER_ID_MASK) >>
        X2APIC_DEST_CLUSTER_ID_SHIFT;
    dest = destination & X2APIC_DEST_LOGICAL_ID_MASK;

    // 逐位检查目标CPU
    while (dest != 0) {
        logical_id = ffsl(dest) - 1;  // 找到最低设置位
        dest &= ~(1UL << logical_id);
        apic_id = logical_id | (cluster_id << X2APIC_CLUSTER_ID_SHIFT);

        // 关键过滤：移除不属于cell的CPU
        if (apic_id > APIC_MAX_PHYS_ID ||
            !cell_owns_cpu(cell, apic_to_cpu_id[apic_id])) {
            destination &= ~(1UL << logical_id);  // 清除该位
        }
    }
    return destination;  // 返回过滤后的目标掩码
}

// hypervisor/arch/x86/apic.c
static bool apic_send_ipi_all(u32 icr_lo, int exclude_cpu)
{
    struct cell *cell = this_cell();
    unsigned int cpu;

    // 只向cell拥有的CPU发送IPI
    for_each_cpu(cpu, cell->cpu_set) {
        if (cpu != exclude_cpu) {
            apic_ops.send_ipi(public_per_cpu(cpu)->apic_id, icr_lo);
        }
    }
    return true;
}

// hypervisor/arch/x86/apic.c
static bool apic_handle_init_sipi(u32 icr_lo, u32 icr_hi)
{
    unsigned int target_cpu_id;
    int sipi_vector;

    if (icr_lo & APIC_ICR_DEST_LOGICAL) {
        // 逻辑目标模式 - 复杂处理
        return apic_handle_logical_init_sipi(icr_lo, icr_hi);
    }

    // 物理目标模式
    target_cpu_id = apic_to_cpu_id[icr_hi];

    // 验证目标CPU所有权
    if (!cell_owns_cpu(this_cell(), target_cpu_id)) {
        printk("WARNING: INIT/SIPI to CPU outside cell boundaries\n");
        return true;
    }

    if ((icr_lo & APIC_ICR_DLVR_MASK) == APIC_ICR_DLVR_INIT) {
        // INIT信号
        x86_send_init_sipi(target_cpu_id, X86_INIT, -1);
    } else {
        // SIPI信号
        sipi_vector = icr_lo & APIC_ICR_VECTOR_MASK;
        x86_send_init_sipi(target_cpu_id, X86_SIPI, sipi_vector);
    }

    return true;
}

// hypervisor/arch/x86/control.c
void x86_send_init_sipi(unsigned int cpu_id, enum x86_init_sipi type,
                        int sipi_vector)
{
    struct public_per_cpu *target_data = public_per_cpu(cpu_id);
    bool send_nmi = false;

    spin_lock(&target_data->control_lock);

    if (type == X86_INIT) {
        if (!target_data->wait_for_sipi &&
            !target_data->init_signaled) {
            target_data->init_signaled = true;
            send_nmi = true;
        }
    } else if (target_data->wait_for_sipi) {
        target_data->sipi_vector = sipi_vector;
        send_nmi = true;
    }

    spin_unlock(&target_data->control_lock);

    if (send_nmi) {
        // 通过NMI通知目标CPU处理INIT/SIPI
        apic_send_nmi_ipi(target_data);
    }
}

// hypervisor/arch/x86/control.c
void x86_check_events(void)
{
    struct public_per_cpu *cpu_public = this_cpu_public();
    int sipi_vector = -1;

    spin_lock(&cpu_public->control_lock);

    if (cpu_public->init_signaled) {
        // 收到INIT信号，进入等待SIPI状态
        x86_enter_wait_for_sipi(cpu_public);
    } else if (cpu_public->sipi_vector >= 0) {
        if (!cpu_public->failed) {
            cpu_public->wait_for_sipi = false;
            sipi_vector = cpu_public->sipi_vector;
        }
        cpu_public->sipi_vector = -1;
    }

    spin_unlock(&cpu_public->control_lock);

    if (sipi_vector >= 0) {
        printk("CPU %d received SIPI, vector %x\n", 
               this_cpu_id(), sipi_vector);
        apic_clear();
        vcpu_reset(sipi_vector);  // 重置CPU状态并启动
    }
}

// hypervisor/arch/x86/apic.c
static bool apic_handle_nmi_ipi(u32 icr_lo, u32 icr_hi)
{
    unsigned int target_cpu_id;

    // NMI通常用于系统管理，需要特殊权限检查
    if (!cell_has_nmi_permission(this_cell())) {
        printk("WARNING: Cell attempted to send NMI without permission\n");
        return true;
    }

    target_cpu_id = apic_to_cpu_id[icr_hi];

    if (!cell_owns_cpu(this_cell(), target_cpu_id)) {
        printk("WARNING: NMI to CPU outside cell boundaries\n");
        return true;
    }

    // 发送NMI到目标CPU
    apic_send_nmi_ipi(public_per_cpu(target_cpu_id));
    return true;
}

// hypervisor/arch/x86/vmx.c
static void vmx_handle_exception_nmi(void)
{
    u32 intr_info = vmcs_read32(VM_EXIT_INTR_INFO);

    if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR) {
        // NMI中断处理
        cpu_public->stats[JAILHOUSE_CPU_STAT_VMEXITS_MANAGEMENT]++;

        // 重新注入NMI到guest
        asm volatile("int %0" : : "i" (NMI_VECTOR));

        // 检查管理事件
        vmx_check_events();
    }
}

// SMI通常被hypervisor拦截，不允许guest直接处理
// 这是为了维护系统安全和稳定性

// hypervisor/arch/arm-common/gic-v2.c
bool gicv2_handle_sgir_write(u32 sgir)
{
    unsigned int cpu_mask = (sgir >> 16) & 0xff;
    unsigned int sgi_id = sgir & 0xf;
    unsigned int cpu;

    // 过滤目标CPU，只允许向cell内CPU发送SGI
    cpu_mask = gic_filter_cpu_mask(this_cell(), cpu_mask);

    if (cpu_mask) {
        // 发送SGI到过滤后的CPU
        for_each_cpu_in_mask(cpu, cpu_mask) {
            gic_send_sgi(sgi_id, cpu);
        }
    }

    return true;
}

// hypervisor/arch/arm-common/gic-v2.c
static bool gic_handle_irq_route(unsigned int irq, unsigned int cpu)
{
    struct cell *cell = this_cell();

    // 检查中断是否属于当前cell
    if (!irqchip_irq_in_cell(cell, irq))
        return false;

    // 检查目标CPU是否属于当前cell
    if (!cell_owns_cpu(cell, cpu))
        return false;

    // 允许路由
    return true;
}

// hypervisor/arch/arm64/gic-v3.c
void gicv3_inject_virtual_irq(unsigned int irq, unsigned int cpu)
{
    struct per_cpu *cpu_data = per_cpu(cpu);

    // 设置虚拟中断寄存器
    gicv3_write_lr(cpu_data, irq, GICV3_LR_STATE_PENDING);

    // 触发虚拟中断
    gicv3_enable_virtual_irq(cpu_data);
}

// 从Documentation/articles/LWN.net-article-01-2014.txt:
"In vmcs_setup(), Jailhouse skips enabling external-interrupt exiting 
and sets exception bitmaps to all-zeroes. This means the only interrupt 
that results in VM-Exit is NMI."

// hypervisor/arch/x86/vmx.c - vmcs_setup()中的关键配置
val = read_msr(MSR_IA32_VMX_PINBASED_CTLS);
val |= PIN_BASED_NMI_EXITING;  // 只启用NMI退出
// 注意：没有设置 PIN_BASED_EXT_INTR_EXITING
ok &= vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, val);

外部中断 → VM Exit → Hypervisor处理 → 中断注入 → Guest处理
延迟：~5-20μs (包含VM Exit/Entry开销)

外部中断 → 直接投递给Guest → Guest直接处理
延迟：~1-3μs (接近原生性能)

// configs/x86/linux-x86-demo.c
static struct jailhouse_irqchip irqchips[] = {
    /* IOAPIC */ {
        .address = 0xfec00000,
        .id = 0xff00,
        .pin_bitmap = {
            0xffffff  // 静态分配的中断引脚
        },
    },
};

// 中断直接投递，无需hypervisor介入
// 消除了中断上下文切换开销
static bool irq_can_passthrough(unsigned int irq, struct cell *cell)
{
    // 检查中断是否可以完全直通
    return irqchip_irq_in_cell(cell, irq) && 
           !irq_shared_with_other_cells(irq) &&
           device_exclusively_assigned(irq);
}

// hypervisor/arch/x86/vmx.c
// 只虚拟化APIC访问，不虚拟化中断投递
val |= SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
// 注意：没有启用 SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY
ok &= vmcs_write32(SECONDARY_VM_EXEC_CONTROL, val);

// Jailhouse目前不使用Posted Interrupt机制
// 原因：静态分区使得传统的Posted Interrupt优势不明显
// 而且增加了复杂性，与简洁设计哲学不符

// hypervisor/arch/x86/svm.c
/* AVIC support */
/* FIXME: Jailhouse support is incomplete so far
if (cpuid_edx(0x8000000A, 0) & X86_FEATURE_AVIC)
    has_avic = true; */

// TODO: Setup AVIC
// TODO: Handle VMEXIT_AVIC_NOACCEL and VMEXIT_AVIC_INCOMPLETE_IPI

Jailhouse: 接近原生性能 (95-98%)
KVM: 80-90% 原生性能
Xen: 75-85% 原生性能

Jailhouse中断相关的VM Exit：
- NMI (系统管理)
- APIC寄存器访问 (配置)
- 跨cell的IPI (安全检查)
- Hypercall (管理操作)

传统Hypervisor：
- 所有外部中断
- 所有IPI
- Timer中断
- 中断控制器访问

// 由于静态分区，中断延迟完全可预测
// 没有动态调度和资源竞争
// 适合硬实时系统要求

Jailhouse中断抖动：
├── 最好情况：±0.1-0.5μs
├── 典型情况：±0.5-1μs
└── 最坏情况：±1-2μs

传统Hypervisor中断抖动：
├── 最好情况：±2-5μs
├── 典型情况：±5-15μs  
└── 最坏情况：±50-100μs

// hypervisor/include/jailhouse/percpu.h
struct public_per_cpu {
    // ...
    u32 stats[JAILHOUSE_NUM_CPU_STATS];
    // JAILHOUSE_CPU_STAT_VMEXITS_MMIO
    // JAILHOUSE_CPU_STAT_VMEXITS_PIO  
    // JAILHOUSE_CPU_STAT_VMEXITS_XAPIC
    // JAILHOUSE_CPU_STAT_VMEXITS_CR
    // JAILHOUSE_CPU_STAT_VMEXITS_MSR_X2APIC_ICR
};

// tools/jailhouse-cell-stats
// 提供中断统计信息查看工具
void print_interrupt_stats(struct cell *cell)
{
    printf("APIC exits: %u\n", 
           cell->stats[JAILHOUSE_CPU_STAT_VMEXITS_XAPIC]);
    printf("IPI exits: %u\n",
           cell->stats[JAILHOUSE_CPU_STAT_VMEXITS_MSR_X2APIC_ICR]);
}

// 启用中断调试时的详细日志
#ifdef DEBUG_INTERRUPTS
#define irq_debug(fmt, ...) printk("IRQ: " fmt, ##__VA_ARGS__)
#else
#define irq_debug(fmt, ...)
#endif

+ 极低的中断延迟 (1-3μs)
+ 确定性性能表现
+ 简单可验证的实现
+ 易于安全认证
+ 接近原生的吞吐量
+ 最小化的攻击面

- 静态资源分配限制
- 有限的运行时灵活性
- 不支持资源超分配
- 需要专门的内核适配

+ 动态资源管理
+ 高度运行时灵活性
+ 支持资源超分配
+ 丰富的虚拟化功能
+ 广泛的OS兼容性

- 较高的中断延迟 (5-20μs)
- 复杂的实现和维护
- 难以预测的性能表现
- 较大的安全攻击面

// 未来可能集成的硬件特性：
// - 更高级的Posted Interrupt支持
// - 硬件级中断虚拟化
// - 专用的实时中断通道
// - 确定性中断路由硬件

// Jailhouse + 容器的混合架构
// 提供硬件级隔离 + 应用级灵活性