虚拟设备框架重构

[ZR233]

[YanLien]

AxDevice 框架改进方案

目录

1. 现状分析
2. 核心架构
3. 改进一：统一并发控制
4. 改进二：统一通知机制
5. 改进三：高效设备查找
6. 改进四：多段地址支持
7. 改进五：设备热插拔
8. 改进六：VirtIO 设备支持
9. 完整工作流程
10. 迁移指南
11. 总结

---

1. 现状分析

1.1 当前代码结构

// axdevice_base/src/lib.rs
pub trait BaseDeviceOps<R: DeviceAddrRange>: Any {
    fn emu_type(&self) -> EmuDeviceType;
    fn address_range(&self) -> R;
    fn handle_read(&self, addr: R::Addr, width: AccessWidth) -> AxResult<usize>;
    fn handle_write(&self, addr: R::Addr, width: AccessWidth, val: usize) -> AxResult;
}

// axdevice/src/device.rs
pub struct AxEmuDevices<R: DeviceAddrRange> {
    emu_devices: Vec<Arc<dyn BaseDeviceOps<R>>>,  // 简单的 Vec 存储
}

pub struct AxVmDevices {
    emu_mmio_devices: AxEmuMmioDevices,
    emu_sys_reg_devices: AxEmuSysRegDevices,
    emu_port_devices: AxEmuPortDevices,
}

1.2 存在的问题

问题	描述	影响
无并发控制	多 vCPU 同时访问设备时无保护	数据竞争、未定义行为
RefCell 不是 Sync	设备需要内部可变性，但 RefCell 无法多线程共享	编译失败或需要 Mutex
O(n) 查找	线性遍历查找设备	设备多时性能下降
无设备移除	只能添加设备，无法移除	不支持热插拔
无中断管理	设备需要自行处理中断路由	代码重复、架构耦合
单段地址	每设备只支持一个地址范围	无法表示 PCI/VirtIO 设备
无生命周期管理	设备访问时可能被移除	TOCTOU 竞态条件

1.3 框架组成

改进后的 AxDevice 框架由两个核心 crate 组成：

Crate	职责	依赖
axdevice_base	定义设备 trait、中断类型、多段地址支持类型	无框架依赖，可独立使用
axdevice	设备注册、并发控制、生命周期管理、中断管理	依赖 axdevice_base

---

2. 核心架构

2.1 三层架构设计

┌──────────────────────────────────────────────────────────────┐
│  Layer 3: 设备实现层                                           │
│  职责：只实现设备业务逻辑                                        │
│  示例：Serial, VirtioBlk, VirtioConsole                       │
│  特点：无需关心并发、中断路由、地址查找                            │
│        使用 DeviceCell 封装状态，框架保证线程安全                 │
└─────────────────────────┬────────────────────────────────────┘
                          │
┌─────────────────────────▼─────────────────────────────────────┐
│  Layer 2: 框架自动处理层 (axdevice)                             │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ A. 并发控制                    B. 通知管理                │  │
│  │    • 设备级独立锁                  • 通知注册和路由         │  │
│  │    • DeviceCell 内部可变性         • 优先级队列             │  │
│  │    • 原子状态机 + CAS             • CPU 亲和性            │  │
│  │                                   • 多种通知方式          │  │
│  └─────────────────────────────────────────────────────────┘  │
│  ┌─────────────────────────────────────────────────────────┐  │
│  │ C. 地址管理                    D. 生命周期                 │  │
│  │    • 地址范围查找                  • 原子状态转换           │  │
│  │    • 多段地址缓存                  • 访问计数跟踪           │  │
│  │    • Region 快速查找               • 安全热插拔             │  │
│  └──────────────────────────────────────────────────────────┘  │
└─────────────────────────┬──────────────────────────────────────┘
                          │
┌─────────────────────────▼──────────────────────────────────────┐
│  Layer 1: 设备 Trait 定义层 (axdevice_base)                     │
│  • BaseDeviceOps trait                                        │
│  • 通知类型定义 (NotificationConfig, DeviceEvent, etc.)         │
│  • 中断类型定义 (InterruptConfig, IrqType - 已废弃)             │
│  • 多段地址类型 (RegionId, RegionHit, DeviceRegion)             │
└─────────────────────────────────────────────────────────────────┘

2.2 模块结构

axdevice_base/
├── lib.rs              # BaseDeviceOps trait, 通知类型, 中断类型(废弃), 多段地址类型

axdevice/
├── lib.rs              # 公共导出
├── device.rs           # AxEmuDevices, AxVmDevices (兼容层)
├── device_cell.rs      # DeviceCell<T> 内部可变性工具
├── registry.rs         # DeviceRegistry 设备注册表
├── wrapper.rs          # DeviceWrapper, DeviceId, DeviceStats
├── lifecycle.rs        # DeviceLifecycle, StateAndCount, WaitQueue
├── region.rs           # CachedRegions 区域缓存
├── notify/             # 通知管理模块（新）
│   ├── mod.rs          # 模块入口，类型别名（向后兼容）
│   ├── manager.rs      # DeviceNotificationManager
│   ├── notifier.rs     # DeviceNotifierImpl
│   ├── queue.rs        # TransactionalInterruptQueue, PendingNotification
│   ├── routing.rs      # RoutingTable
│   └── poll.rs         # PollFlags
└── virtio/
    ├── mod.rs          # VirtIO 模块入口, Dummy 设备
    ├── blk.rs          # VirtioBlkDevice
    └── console.rs      # VirtioConsoleDevice

---

3. 改进一：统一并发控制

3.1 问题分析

当前 BaseDeviceOps::handle_read/write 使用 &self，这带来三个关键挑战：

问题 1：设备状态修改需要 interior mutability

由于方法签名是 &self，设备内部需要使用某种内部可变性机制来修改状态。

问题 2：RefCell 不是 Sync

最自然的选择是 RefCell，但它不实现 Sync trait：

// ❌ 编译错误
pub struct MyDevice {
    state: RefCell<DeviceState>,  // RefCell 不是 Sync
}
// Arc<dyn BaseDeviceOps> 要求 BaseDeviceOps: Sync

问题 3：设备需要被多个 vCPU 共享

Arc<dyn BaseDeviceOps> 要求类型是 Send + Sync，但包含 RefCell 的类型无法满足 Sync 约束。

核心矛盾：

• 需要内部可变性 → 想用 RefCell
• 需要多线程共享 → 要求 Sync
• RefCell 不是 Sync → 编译失败 ❌

3.2 解决方案：设备级独立锁 + DeviceCell

核心原则：在框架层面处理所有并发问题，让设备实现者无需考虑多 vCPU 并发访问的同步问题。

采用两层机制：

1. 外层锁（DeviceWrapper）: 每个设备独立的 Mutex<()>，保证同一时刻只有一个 vCPU 访问同一设备
2. 内层工具（DeviceCell）: 提供类似 RefCell 但实现了 Sync 的内部可变性，由外层锁保证安全

┌─────────────────────────────────────────────────────┐
│              多 vCPU 并发访问                          │
└─────────────────────┬───────────────────────────────┘
                      │
         ┌────────────▼─────────────┐
         │   DeviceWrapper          │
         │  - lifecycle 状态检查    │  ← 第1层：设备级锁
         │  - lock.lock()          │     保证同一设备串行访问
         └────────────┬─────────────┘
                      │ 序列化访问同一设备
         ┌────────────▼─────────────┐
         │    Arc<dyn Device>       │
         │  - DeviceCell<State>     │  ← 第2层：内部可变性
         └──────────────────────────┘     零成本抽象

3.3 扩展后的设备 Trait

/// 所有模拟设备必须实现的 trait
pub trait BaseDeviceOps<R: DeviceAddrRange>: Any + Send + Sync {
    // === 必需方法 ===
    fn emu_type(&self) -> EmuDeviceType;
    fn address_ranges(&self) -> &[R];
    fn handle_read(&self, addr: R::Addr, width: AccessWidth) -> AxResult<usize>;
    fn handle_write(&self, addr: R::Addr, width: AccessWidth, val: usize) -> AxResult;

    // === 通知方法（新 API）===
    fn notification_config(&self) -> Option<NotificationConfig> { None }
    fn set_notifier(&self, _notifier: Arc<dyn DeviceNotifier>) {}

    // === 旧版中断方法（已废弃）===
    #[deprecated] fn interrupt_config(&self) -> Option<InterruptConfig> { None }
    #[deprecated] fn set_interrupt_trigger(&self, _trigger: Arc<dyn InterruptTrigger>) {}

    // === 多段地址方法（可选）===
    fn region_descriptor(&self) -> Option<RegionDescriptor> { None }
    fn region_lookup(&self, addr: usize) -> Option<RegionHit> {
        self.region_descriptor()?.lookup(addr)
    }
    fn notify_region_change(&self) -> bool { false }
}

3.4 DeviceCell 实现

框架提供 DeviceCell<T> 解决 RefCell 不是 Sync 的问题：

//! axdevice/src/device_cell.rs - 设备内部可变性工具

use core::cell::UnsafeCell;

/// 设备内部可变性封装
///
/// 类似 `RefCell`，但实现了 `Sync`。
///
/// # Safety Contract
///
/// **此类型仅供 AxDevice 框架内部使用！**
/// 安全性依赖于 DeviceWrapper 的设备级锁保护。
/// 直接使用此类型而不经过框架可能导致数据竞争。
pub struct DeviceCell<T> {
    value: UnsafeCell<T>,
}

// SAFETY: DeviceWrapper 的设备锁保证了互斥访问
unsafe impl<T: Send> Sync for DeviceCell<T> {}

impl<T> DeviceCell<T> {
    /// 创建新的 DeviceCell
    pub const fn new(value: T) -> Self {
        Self { value: UnsafeCell::new(value) }
    }

    /// 获取不可变引用
    #[inline]
    pub fn get(&self) -> &T {
        unsafe { &*self.value.get() }
    }

    /// 获取可变引用（框架保证安全）
    #[inline]
    pub fn get_mut(&self) -> &mut T {
        unsafe { &mut *self.value.get() }
    }

    /// 替换内部值并返回旧值
    #[inline]
    pub fn replace(&self, value: T) -> T {
        core::mem::replace(self.get_mut(), value)
    }

    /// 消费并返回内部值
    pub fn into_inner(self) -> T {
        self.value.into_inner()
    }
}

impl<T: Default> Default for DeviceCell<T> {
    fn default() -> Self { Self::new(T::default()) }
}

impl<T: Clone> Clone for DeviceCell<T> {
    fn clone(&self) -> Self { Self::new(self.get().clone()) }
}

impl<T: core::fmt::Debug> core::fmt::Debug for DeviceCell<T> {
    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        self.get().fmt(f)
    }
}

3.5 使用建议

数据类型	推荐方案	示例
Copy 类型	Cell<T>	Cell<u32>, Cell<bool>
简单 Option	Cell<Option<T>>	Cell<Option<u32>>
驱动结构体	DeviceCell<T>	DeviceCell<SerialDriver>
集合类型	DeviceCell<T>	DeviceCell<VecDeque<u8>>
Arc/引用	DeviceCell<T>	DeviceCell<Option<Arc<Handler>>>

3.6 DeviceCell vs Mutex：何时使用哪种？

核心原则：如果状态只在 handle_read/write 中访问，使用 DeviceCell；
如果状态需要从多个上下文访问（如公共方法、中断处理器），使用 Mutex。

场景	推荐	原因
状态只在 handle_read/write 中访问	DeviceCell	框架锁已保证安全，零额外开销
有公共方法访问状态（如 set_irq_pending）	Mutex	公共方法不受框架锁保护
状态需要从中断处理器访问	Mutex	中断上下文不走 DeviceWrapper
需要跨设备共享状态	Mutex 或其他同步原语	框架锁是设备级别的

实际例子：

// ✅ DummyVirtioDevice - 使用 DeviceCell
// 状态只在 handle_read/write 中访问
pub struct DummyVirtioDevice {
    state: DeviceCell<DummyVirtioState>,  // 零成本
}

// ✅ VPlicGlobal - 使用 Mutex
// pending_irqs 需要从 set_irq_pending() 公共方法访问
// 该方法可能从中断处理器调用，不经过 DeviceWrapper
pub struct VPlicGlobal {
    pending_irqs: Mutex<Bitmap<1024>>,  // 需要独立同步
    active_irqs: Mutex<Bitmap<1024>>,
}

impl VPlicGlobal {
    // 这个方法不走 DeviceWrapper，需要自己保证同步
    pub fn set_irq_pending(&self, irq: usize) -> bool {
        let mut pending = self.pending_irqs.lock();  // 必须用 Mutex
        pending.set(irq, true);
        true
    }
}

双重锁定问题：

// ❌ 错误：在 handle_read 中使用 Mutex 导致双重锁定
impl BaseDeviceOps<...> for MyDevice {
    fn handle_read(&self, ...) -> AxResult<usize> {
        // DeviceWrapper 已经持有设备锁！
        let state = self.state.lock();  // ❌ 第二把锁，额外开销
        Ok(state.value)
    }
}

// ✅ 正确：使用 DeviceCell 消除双重锁定
impl BaseDeviceOps<...> for MyDevice {
    fn handle_read(&self, ...) -> AxResult<usize> {
        let state = self.state.get();  // ✅ 零成本，仅指针转换
        Ok(state.value)
    }
}

3.7 DeviceWrapper 实现

pub struct DeviceWrapper<R: DeviceAddrRange> {
    inner: Arc<dyn BaseDeviceOps<R>>,
    lifecycle: Arc<DeviceLifecycle>,
    lock: Arc<Mutex<()>>,
    id: DeviceId,
    stats: DeviceStats,
    cached_regions: Option<CachedRegions>,
}

impl<R: DeviceAddrRange> DeviceWrapper<R> {
    pub fn new(id: DeviceId, device: Arc<dyn BaseDeviceOps<R>>) -> Self {
        let cached_regions = device.region_descriptor()
            .map(|desc| CachedRegions::from_descriptor(&desc));

        Self {
            inner: device,
            lifecycle: Arc::new(DeviceLifecycle::new()),
            lock: Arc::new(Mutex::new(())),
            id,
            stats: DeviceStats::new(),
            cached_regions,
        }
    }

    /// 尝试获取读访问权限并执行
    pub fn try_access_for_read(&self, addr: R::Addr, width: AccessWidth) -> AxResult<usize> {
        // 1. 检查生命周期状态（CAS 原子操作）
        if !self.lifecycle.try_begin_access() {
            return ax_err!(InvalidState, "Device is being removed");
        }

        // 2. 获取设备锁
        let _guard = self.lock.lock();

        // 3. 调用设备方法
        let result = self.inner.handle_read(addr, width);

        // 4. 更新统计
        self.stats.record_read();

        // 5. 释放访问计数
        self.lifecycle.end_access();

        result
    }

    /// 尝试获取写访问权限并执行
    pub fn try_access_for_write(&self, addr: R::Addr, width: AccessWidth, val: usize) -> AxResult {
        if !self.lifecycle.try_begin_access() {
            return ax_err!(InvalidState, "Device is being removed");
        }

        let _guard = self.lock.lock();
        let result = self.inner.handle_write(addr, width, val);
        self.stats.record_write();
        self.lifecycle.end_access();

        result
    }
}

3.8 设备实现示例

use axdevice::DeviceCell;
use core::cell::Cell;

/// 串口设备 - 使用 DeviceCell 封装驱动
pub struct Serial {
    range: GuestPhysAddrRange,
    irq: u32,
    /// 使用 DeviceCell 封装整个驱动状态
    driver: DeviceCell<SerialDriver>,
    /// 中断触发器（由框架注入）
    trigger: DeviceCell<Option<Arc<dyn InterruptTrigger>>>,
}

/// 串口驱动核心逻辑
struct SerialDriver {
    ier: u8,
    lcr: u8,
    lsr: u8,
    rx_fifo: VecDeque<u8>,
}

impl BaseDeviceOps<GuestPhysAddrRange> for Serial {
    fn emu_type(&self) -> EmuDeviceType {
        EmuDeviceType::Console
    }

    fn address_ranges(&self) -> &[GuestPhysAddrRange] {
        core::slice::from_ref(&self.range)
    }

    fn handle_read(&self, addr: GuestPhysAddr, width: AccessWidth) -> AxResult<usize> {
        let driver = self.driver.get_mut();
        let offset = (addr.as_usize() - self.range.start.as_usize()) as u8;
        Ok(driver.read_reg(offset) as usize)
    }

    fn handle_write(&self, addr: GuestPhysAddr, width: AccessWidth, val: usize) -> AxResult {
        let driver = self.driver.get_mut();
        let offset = (addr.as_usize() - self.range.start.as_usize()) as u8;
        driver.write_reg(offset, val as u8);
        Ok(())
    }
}

3.9 并发控制流程

vCPU0: 访问串口设备 0x9000000
vCPU1: 访问 RTC 设备 0x9001000
vCPU2: 访问串口设备 0x9000000

┌──────────────────────────────────────────────────────────────┐
│ DeviceRegistry::handle_read()                                │
│                                                              │
│ 1. 通过地址查找设备 ID                                         │
│    device_id = find_device_id(addr)                         │
│                                                              │
│ 2. 获取设备包装器                                             │
│    wrapper = devices.get(device_id)                         │
│                                                              │
│ 3. 调用 wrapper.try_access_for_read()                       │
│    a. lifecycle.try_begin_access() ← CAS 原子检查状态+增计数   │
│    b. _guard = lock.lock()         ← 获取设备锁              │
│    c. device.handle_read()         ← 调用设备方法            │
│    d. lifecycle.end_access()       ← 减少访问计数            │
└──────────────────────────────────────────────────────────────┘

结果：
- vCPU0 和 vCPU1 **并发执行**（不同设备，不同锁）
- vCPU0 和 vCPU2 **串行执行**（同一设备，同一锁）

---

4. 改进二：统一通知机制

4.1 问题分析

当前设备需要自己处理中断：

• 直接依赖架构特定的中断控制器（VGIC/PLIC）
• 没有统一的中断路由机制
• 设备代码与中断实现耦合
• 无优先级控制和 CPU 亲和性支持
• 只支持中断方式，不支持轮询、回调等其他通知方式

// ❌ 旧代码：设备直接调用中断控制器
impl OldDevice {
    fn trigger_irq(&self, vgic: &Vgic) {
        vgic.set_pending(0, self.irq);  // 直接耦合 VGIC
    }
}

4.2 解决方案：统一通知机制

新的设计引入了统一通知机制，支持多种通知方式：

通知方式	适用场景	特点
Interrupt	低频设备、功耗敏感	传统 vPLIC/vGIC 中断注入
Poll	高频设备、低延迟	设备设置标志，vCPU 周期性检查
Callback	测试场景	同步回调，需注意死锁
Event	突发流量	异步事件队列，支持批处理

┌─────────────────────────────────────────────────────────────┐
│              设备通知机制架构                                  │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   ┌─────────────┐                                           │
│   │   Device    │                                           │
│   │             │ ─── notifier.notify(DeviceEvent) ───┐     │
│   └─────────────┘                                     │     │
│                                                       ▼     │
│   ┌─────────────────────────────────────────────────────┐   │
│   │        DeviceNotificationManager                    │   │
│   │  ┌─────────────────────────────────────────────┐    │   │
│   │  │ match method {                              │    │   │
│   │  │   Interrupt => inject_to_plic_queue()      │    │   │
│   │  │   Poll      => set_poll_flag()             │    │   │
│   │  │   Callback  => invoke_callback()           │    │   │
│   │  │   Event     => push_to_event_queue()       │    │   │
│   │  │ }                                          │    │   │
│   │  └─────────────────────────────────────────────┘    │   │
│   └─────────────────────────────────────────────────────┘   │
│                           │                                 │
│          ┌────────────────┼────────────────┐                │
│          ▼                ▼                ▼                │
│   ┌──────────┐     ┌──────────┐     ┌──────────┐            │
│   │ vPLIC    │     │ PollFlags│     │ EventQ   │            │
│   │ Inject   │     │ Check    │     │ Process  │            │
│   └──────────┘     └──────────┘     └──────────┘            │
│                                                             │
└─────────────────────────────────────────────────────────────┘

4.2.1 通知类型定义（axdevice_base）

/// 通知方式枚举
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub enum NotifyMethod {
    /// 硬件中断 - 传统的 vPLIC/vGIC 注入方式
    /// 适用于：低频设备、功耗敏感场景
    #[default]
    Interrupt,
    /// 轮询标志 - 设备设置标志，vCPU 循环周期性检查
    /// 适用于：高频设备、低延迟场景
    Poll,
    /// 同步回调 - 立即执行（注意死锁风险）
    /// 适用于：测试、简单场景
    Callback,
    /// 事件队列 - 异步事件，支持批处理
    /// 适用于：突发流量模式的设备
    Event,
}

/// 设备事件类型（语义化，替代 IrqType）
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum DeviceEvent {
    /// 数据就绪（如 VirtIO receiveq 有数据）
    DataReady,
    /// 空间可用（如 VirtIO transmitq 有空间）
    SpaceAvailable,
    /// 配置变更
    ConfigChanged,
    /// 通用中断请求（向后兼容 IrqType）
    Irq(IrqType),
    /// 自定义设备事件
    Custom(u32),
}

impl DeviceEvent {
    /// 转换为轮询标志位
    pub const fn as_flag(&self) -> u32 {
        match self {
            DeviceEvent::DataReady => 1 << 0,
            DeviceEvent::SpaceAvailable => 1 << 1,
            DeviceEvent::ConfigChanged => 1 << 2,
            DeviceEvent::Irq(IrqType::Primary) => 1 << 3,
            DeviceEvent::Irq(IrqType::Additional(n)) => 1 << (4 + (*n % 12)),
            DeviceEvent::Custom(n) => 1 << (16 + (*n % 16)),
        }
    }
}

/// 中断触发模式
pub enum TriggerMode {
    Edge,   // 边沿触发
    Level,  // 电平触发
    Msi,    // MSI
    MsiX,   // MSI-X
}

/// CPU 亲和性策略
pub enum CpuAffinity {
    Fixed(usize),    // 固定到指定 CPU
    RoundRobin,      // 轮询分发
    LoadBalance,     // 负载均衡（选择队列最短的 CPU）
    Broadcast,       // 广播到所有 CPU
}

/// 中断类型（保留用于向后兼容）
pub enum IrqType {
    Primary,           // 主中断
    Additional(u32),   // 附加中断（索引）
}

/// 通知配置（新 API）
#[derive(Debug, Clone)]
pub struct NotificationConfig {
    /// 通知方式
    pub method: NotifyMethod,
    /// 主 IRQ 号（Interrupt 方式必需）
    pub primary_irq: Option<u32>,
    /// 附加 IRQ 号（多中断设备）
    pub additional_irqs: Vec<u32>,
    /// 触发模式
    pub trigger_mode: TriggerMode,
    /// CPU 亲和性
    pub cpu_affinity: CpuAffinity,
    /// 优先级（0-255）
    pub priority: u8,
    /// 启用事件合并以减少通知频率
    pub coalesce: bool,
}

impl NotificationConfig {
    /// 创建中断通知配置
    pub fn interrupt(irq: u32) -> Self {
        Self {
            method: NotifyMethod::Interrupt,
            primary_irq: Some(irq),
            ..Default::default()
        }
    }

    /// 创建轮询通知配置
    pub fn poll() -> Self {
        Self {
            method: NotifyMethod::Poll,
            primary_irq: None,
            coalesce: true,
            ..Default::default()
        }
    }

    /// 创建事件通知配置
    pub fn event() -> Self {
        Self {
            method: NotifyMethod::Event,
            primary_irq: None,
            coalesce: true,
            ..Default::default()
        }
    }

    /// Builder: 设置 CPU 亲和性
    pub fn with_cpu_affinity(mut self, affinity: CpuAffinity) -> Self {
        self.cpu_affinity = affinity;
        self
    }

    /// Builder: 设置优先级
    pub fn with_priority(mut self, priority: u8) -> Self {
        self.priority = priority;
        self
    }

    /// 从旧版 InterruptConfig 转换（向后兼容）
    pub fn from_interrupt_config(config: &InterruptConfig) -> Self {
        Self {
            method: NotifyMethod::Interrupt,
            primary_irq: Some(config.primary_irq),
            additional_irqs: config.additional_irqs.clone(),
            trigger_mode: config.trigger_mode,
            cpu_affinity: config.cpu_affinity.clone(),
            priority: config.priority,
            coalesce: false,
        }
    }
}

/// 中断配置（已废弃，保留用于向后兼容）
#[deprecated(since = "0.3.0", note = "Use NotificationConfig instead")]
pub struct InterruptConfig {
    pub primary_irq: u32,
    pub additional_irqs: Vec<u32>,
    pub trigger_mode: TriggerMode,
    pub cpu_affinity: CpuAffinity,
    pub priority: u8,  // 0-255，越大越高
}

/// 设备通知器 trait（新 API）
pub trait DeviceNotifier: Send + Sync {
    /// 发送通知到 Guest
    fn notify(&self, event: DeviceEvent) -> AxResult;

    /// 清除通知（电平触发中断）
    fn clear(&self, _event: DeviceEvent) -> AxResult {
        Ok(()) // 默认无操作
    }

    /// 获取通知方式
    fn method(&self) -> NotifyMethod;

    /// 检查是否有待处理通知（Poll 方式）
    fn has_pending(&self) -> bool {
        false
    }
}

/// 中断触发器 trait（已废弃，保留用于向后兼容）
/// 注意：DeviceNotifier 自动实现此 trait
#[deprecated(since = "0.3.0", note = "Use DeviceNotifier instead")]
pub trait InterruptTrigger: Send + Sync {
    fn trigger(&self, irq_type: IrqType) -> AxResult;
    fn clear(&self, irq_type: IrqType) -> AxResult;
}

/// 适配器：DeviceNotifier 自动实现 InterruptTrigger
impl<T: DeviceNotifier + ?Sized> InterruptTrigger for T {
    fn trigger(&self, irq_type: IrqType) -> AxResult {
        self.notify(DeviceEvent::Irq(irq_type))
    }

    fn clear(&self, irq_type: IrqType) -> AxResult {
        DeviceNotifier::clear(self, DeviceEvent::Irq(irq_type))
    }
}

4.2.2 通知管理器实现（axdevice）

/// 设备通知管理器
/// 支持多种通知方式：Interrupt, Poll, Callback, Event
pub struct DeviceNotificationManager {
    /// 设备通知路由表
    routing_table: RoutingTable,
    /// 每个 CPU 的待处理中断队列
    pending_queues: Vec<Mutex<TransactionalInterruptQueue>>,
    /// 每个 CPU 的轮询标志
    poll_flags: Vec<AtomicU32>,
    /// 轮询计数器（用于 RoundRobin 亲和性）
    next_cpu: AtomicU64,
    /// 时间戳计数器
    timestamp: AtomicU64,
    /// CPU 数量
    cpu_count: usize,
}

impl DeviceNotificationManager {
    pub fn new(cpu_count: usize) -> Self;

    /// 注册设备通知配置（新 API）
    pub fn register_notification(
        &self,
        device_id: DeviceId,
        config: NotificationConfig,
    ) -> AxResult;

    /// 注册设备中断配置（向后兼容旧 API）
    #[deprecated(since = "0.3.0", note = "Use register_notification instead")]
    pub fn register(
        &self,
        device_id: DeviceId,
        config: InterruptConfig,
    ) -> AxResult {
        self.register_notification(
            device_id,
            NotificationConfig::from_interrupt_config(&config),
        )
    }

    /// 注销设备通知
    pub fn unregister(&self, device_id: DeviceId) -> AxResult;

    /// 注入通知（根据设备配置的方式）
    pub fn inject(&self, device_id: DeviceId, event: DeviceEvent) -> AxResult {
        let config = self.routing_table.get(device_id)?;

        match config.method {
            NotifyMethod::Interrupt => {
                let irq = config.primary_irq.ok_or(AxError::InvalidInput)?;
                let cpu_id = self.select_cpu(&config.cpu_affinity);
                self.pending_queues[cpu_id].lock().push(PendingNotification {
                    irq,
                    priority: config.priority,
                    device_id,
                    event,
                    timestamp: self.timestamp.fetch_add(1, Ordering::Relaxed),
                });
            }
            NotifyMethod::Poll => {
                let cpu_id = self.select_cpu(&config.cpu_affinity);
                self.poll_flags[cpu_id].fetch_or(event.as_flag(), Ordering::Release);
            }
            NotifyMethod::Callback => {
                // 直接调用回调（需要设备自行注册）
                // 注意：可能导致死锁，仅用于测试
            }
            NotifyMethod::Event => {
                // 加入事件队列，稍后批处理
            }
        }
        Ok(())
    }

    /// 直接按 IRQ 注入（用于 passthrough 设备）
    pub fn inject_raw(&self, irq: u32, cpu_id: usize, priority: u8) -> AxResult;

    /// 获取待处理通知
    pub fn pop_pending(&self, cpu_id: usize) -> Option<PendingNotification>;

    /// 检查并清除轮询标志
    pub fn check_and_clear_poll_flags(&self, cpu_id: usize) -> u32 {
        self.poll_flags[cpu_id].swap(0, Ordering::AcqRel)
    }

    /// 检查特定事件的轮询标志
    pub fn check_poll_event(&self, cpu_id: usize, event: DeviceEvent) -> bool {
        (self.poll_flags[cpu_id].load(Ordering::Acquire) & event.as_flag()) != 0
    }

    /// 清除所有待处理通知
    pub fn clear_all_pending(&self);
}

/// 待处理通知
pub struct PendingNotification {
    pub irq: u32,
    pub priority: u8,
    pub device_id: DeviceId,
    pub event: DeviceEvent,
    pub timestamp: u64,
}

// 类型别名（向后兼容）
pub type DeviceInterruptManager = DeviceNotificationManager;
pub type PendingInterrupt = PendingNotification;

4.2.3 设备通知器实现

/// 设备通知器实现（新 API）
pub struct DeviceNotifierImpl {
    device_id: DeviceId,
    manager: Arc<DeviceNotificationManager>,
    method: NotifyMethod,
}

impl DeviceNotifierImpl {
    pub fn new(
        device_id: DeviceId,
        manager: Arc<DeviceNotificationManager>,
        method: NotifyMethod,
    ) -> Self {
        Self { device_id, manager, method }
    }
}

impl DeviceNotifier for DeviceNotifierImpl {
    fn notify(&self, event: DeviceEvent) -> AxResult {
        self.manager.inject(self.device_id, event)
    }

    fn clear(&self, event: DeviceEvent) -> AxResult {
        // TODO: 实现电平触发中断清除
        Ok(())
    }

    fn method(&self) -> NotifyMethod {
        self.method
    }
}

/// 设备中断触发器（向后兼容）
/// 注意：由于 DeviceNotifier 自动实现 InterruptTrigger，
/// 这个类型主要用于保持 API 兼容性
pub type DeviceInterruptTrigger = DeviceNotifierImpl;

4.2.4 轮询标志管理

/// 轮询标志管理（用于 Poll 通知方式）
pub struct PollFlags {
    flags: AtomicU32,
}

impl PollFlags {
    pub const fn new() -> Self {
        Self { flags: AtomicU32::new(0) }
    }

    /// 设置事件标志
    pub fn set(&self, event: DeviceEvent) {
        self.flags.fetch_or(event.as_flag(), Ordering::Release);
    }

    /// 检查事件标志
    pub fn check(&self, event: DeviceEvent) -> bool {
        (self.flags.load(Ordering::Acquire) & event.as_flag()) != 0
    }

    /// 检查并清除所有标志
    pub fn take_all(&self) -> u32 {
        self.flags.swap(0, Ordering::AcqRel)
    }

    /// 检查是否有任何待处理标志
    pub fn has_pending(&self) -> bool {
        self.flags.load(Ordering::Acquire) != 0
    }
}

4.3 设备使用示例

4.3.1 新 API（推荐）

use axdevice::{DeviceNotifier, DeviceEvent, NotificationConfig, NotifyMethod};

impl BaseDeviceOps<GuestPhysAddrRange> for VirtioConsole {
    /// 返回通知配置（新 API）
    fn notification_config(&self) -> Option<NotificationConfig> {
        Some(NotificationConfig::interrupt(self.irq)
            .with_priority(100)
            .with_cpu_affinity(CpuAffinity::Fixed(0)))
    }

    /// 设置通知器（新 API）
    fn set_notifier(&self, notifier: Arc<dyn DeviceNotifier>) {
        *self.notifier.get_mut() = Some(notifier);
    }

    fn handle_write(&self, addr: GuestPhysAddr, width: AccessWidth, val: usize) -> AxResult {
        let driver = self.driver.get_mut();
        driver.write_reg(offset, val as u8);

        // ✅ 使用语义化事件触发通知
        if driver.has_data_for_guest() {
            if let Some(notifier) = self.notifier.get().as_ref() {
                notifier.notify(DeviceEvent::DataReady)?;
            }
        }

        Ok(())
    }
}

4.3.2 高频设备使用 Poll 方式

impl BaseDeviceOps<GuestPhysAddrRange> for HighFreqDevice {
    fn notification_config(&self) -> Option<NotificationConfig> {
        // 使用轮询方式，避免中断开销
        Some(NotificationConfig::poll()
            .with_cpu_affinity(CpuAffinity::Fixed(0)))
    }

    fn set_notifier(&self, notifier: Arc<dyn DeviceNotifier>) {
        *self.notifier.get_mut() = Some(notifier);
    }

    fn handle_write(&self, addr: GuestPhysAddr, width: AccessWidth, val: usize) -> AxResult {
        // ... 设备逻辑 ...

        // Poll 方式只设置标志，不触发中断
        if let Some(notifier) = self.notifier.get().as_ref() {
            notifier.notify(DeviceEvent::DataReady)?;
        }
        Ok(())
    }
}

4.3.3 旧 API（向后兼容）

use axdevice::{InterruptTrigger, InterruptConfig, IrqType};

impl BaseDeviceOps<GuestPhysAddrRange> for Serial {
    /// 返回中断配置（旧 API，已废弃）
    #[allow(deprecated)]
    fn interrupt_config(&self) -> Option<InterruptConfig> {
        Some(InterruptConfig {
            primary_irq: self.irq,
            additional_irqs: vec![],
            trigger_mode: TriggerMode::Level,
            cpu_affinity: CpuAffinity::Fixed(0),
            priority: 100,
        })
    }

    /// 设置中断触发器（旧 API，已废弃）
    #[allow(deprecated)]
    fn set_interrupt_trigger(&self, trigger: Arc<dyn InterruptTrigger>) {
        *self.trigger.get_mut() = Some(trigger);
    }

    fn handle_write(&self, addr: GuestPhysAddr, width: AccessWidth, val: usize) -> AxResult {
        let driver = self.driver.get_mut();
        driver.write_reg(offset, val as u8);

        // 旧 API 使用 IrqType
        if driver.should_interrupt() {
            if let Some(trigger) = self.trigger.get().as_ref() {
                trigger.trigger(IrqType::Primary)?;
            }
        }

        Ok(())
    }
}

4.4 通知处理流程

┌─────────────────────────────────────────────────────────────────┐
│ 1. 设备触发通知                                                  │
│    notifier.notify(DeviceEvent::DataReady)                      │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 2. DeviceNotifierImpl::notify()                                  │
│    manager.inject(device_id, event)                              │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 3. DeviceNotificationManager::inject()                           │
│    • 查询路由表获取通知配置                                       │
│    • 根据 NotifyMethod 选择处理方式：                             │
│      - Interrupt: 加入 pending_queues                            │
│      - Poll: 设置 poll_flags                                     │
│      - Callback: 直接调用                                         │
│      - Event: 加入事件队列                                        │
│    • 根据亲和性选择目标 CPU                                       │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 4. vCPU 循环中检查                                               │
│                                                                  │
│    // 方式 1: Interrupt - 检查并注入中断                          │
│    if let Some(notif) = manager.pop_pending(cpu_id) {            │
│        vcpu.inject_interrupt(notif.irq);                         │
│    }                                                             │
│                                                                  │
│    // 方式 2: Poll - 检查轮询标志                                 │
│    let flags = manager.check_and_clear_poll_flags(cpu_id);       │
│    if DeviceEvent::DataReady.is_set_in(flags) {                  │
│        // 处理数据就绪事件                                        │
│    }                                                             │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 5. Guest 处理通知                                                │
│    - Interrupt: Guest 响应 IRQ                                   │
│    - Poll: Guest 检查设备状态                                    │
└─────────────────────────────────────────────────────────────────┘

4.5 BaseDeviceOps Trait 扩展

pub trait BaseDeviceOps<R: DeviceAddrRange>: Any + Send + Sync {
    // ... 现有方法 ...

    // ========================================================================
    // 通知方法（新 API）
    // ========================================================================

    /// 返回通知配置
    ///
    /// 设备可以选择不同的通知方式：
    /// - `NotifyMethod::Interrupt`: 传统中断（默认）
    /// - `NotifyMethod::Poll`: 高频设备使用轮询
    /// - `NotifyMethod::Event`: 突发流量使用事件队列
    fn notification_config(&self) -> Option<NotificationConfig> {
        // 默认：尝试从旧 API 转换（向后兼容）
        #[allow(deprecated)]
        self.interrupt_config().map(|ic| NotificationConfig::from_interrupt_config(&ic))
    }

    /// 设置通知器
    ///
    /// 框架在设备注册时调用此方法注入通知器。
    /// 设备应存储通知器并在需要时使用 `notifier.notify(event)`。
    fn set_notifier(&self, _notifier: Arc<dyn DeviceNotifier>) {
        // 默认无操作，设备需覆盖此方法
    }

    // ========================================================================
    // 旧版中断方法（已废弃，保留用于向后兼容）
    // ========================================================================

    /// 返回中断配置（已废弃）
    #[deprecated(since = "0.3.0", note = "Use notification_config() instead")]
    fn interrupt_config(&self) -> Option<InterruptConfig> {
        None
    }

    /// 设置中断触发器（已废弃）
    #[deprecated(since = "0.3.0", note = "Use set_notifier() instead")]
    fn set_interrupt_trigger(&self, _trigger: Arc<dyn InterruptTrigger>) {
        // 默认无操作
    }
}

4.6 Passthrough 设备支持

对于直通设备，使用 inject_raw 方法直接按 IRQ 号注入：

// 物理中断处理
@S_EXT => {
    let irq = plic.claim(context)?;

    // 通过 DeviceNotificationManager 注入
    let manager = get_vm_interrupt_manager();
    manager.inject_raw(irq.get(), current_cpu_id(), 50);
}

4.7 迁移指南：从旧 API 迁移到新 API

旧 API	新 API	说明
InterruptConfig	NotificationConfig	使用 NotificationConfig::interrupt(irq)
InterruptTrigger	DeviceNotifier	自动实现旧 trait
interrupt_config()	notification_config()	默认会尝试转换旧配置
set_interrupt_trigger()	set_notifier()	存储通知器
trigger.trigger(IrqType::Primary)	notifier.notify(DeviceEvent::DataReady)	使用语义化事件
DeviceInterruptManager	DeviceNotificationManager	类型别名保持兼容
PendingInterrupt	PendingNotification	类型别名保持兼容

迁移步骤：

1. 更新通知配置：

// 旧
fn interrupt_config(&self) -> Option<InterruptConfig> { ... }

// 新
fn notification_config(&self) -> Option<NotificationConfig> {
    Some(NotificationConfig::interrupt(self.irq))
}

2. 更新通知器存储：

// 旧
trigger: DeviceCell<Option<Arc<dyn InterruptTrigger>>>,

// 新
notifier: DeviceCell<Option<Arc<dyn DeviceNotifier>>>,

3. 更新通知调用：

// 旧
trigger.trigger(IrqType::Primary)?;

// 新（语义化）
notifier.notify(DeviceEvent::DataReady)?;
// 或保持兼容
notifier.notify(DeviceEvent::Irq(IrqType::Primary))?;

---

5. 改进三：高效设备查找

5.1 问题分析

当前使用 Vec + 线性查找：

// ❌ O(n) 查找
fn find_dev(&self, addr: R::Addr) -> Option<Arc<dyn BaseDeviceOps<R>>> {
    self.emu_devices.iter()
        .find(|&dev| dev.address_range().contains(addr))
        .cloned()
}

设备数量增加时性能下降明显。

5.2 解决方案：DeviceRegistry

使用地址范围列表 + 设备表实现设备管理。线性搜索对于 <50 个设备的场景仍然高效（cache-friendly）：

pub struct DeviceRegistry<R: DeviceAddrRange> {
    /// 地址范围列表 (linear search, acceptable for <50 devices)
    range_list: RwLock<Vec<(R, DeviceId)>>,

    /// 设备 ID -> 设备包装器
    devices: RwLock<BTreeMap<DeviceId, DeviceWrapper<R>>>,

    /// 设备 ID 计数器
    next_id: AtomicUsize,
}

impl<R: DeviceAddrRange> DeviceRegistry<R> {
    pub fn new() -> Self;

    /// 添加设备，返回设备 ID
    pub fn add_device(&self, device: Arc<dyn BaseDeviceOps<R>>) -> AxResult<DeviceId>;

    /// 通过地址查找设备
    pub fn get_device_by_addr(&self, addr: R::Addr) -> Option<DeviceWrapper<R>>;

    /// 通过 ID 查找设备
    pub fn get_device(&self, id: DeviceId) -> Option<DeviceWrapper<R>>;

    /// 处理读操作（自动处理并发和生命周期）
    pub fn handle_read(&self, addr: R::Addr, width: AccessWidth) -> AxResult<usize>;

    /// 处理写操作（自动处理并发和生命周期）
    pub fn handle_write(&self, addr: R::Addr, width: AccessWidth, val: usize) -> AxResult;

    /// 移除设备（安全热插拔）
    pub fn remove_device(&self, id: DeviceId) -> AxResult;

    /// 获取设备统计
    pub fn get_device_stats(&self, id: DeviceId) -> Option<(u64, u64, u64)>;
}

5.3 DeviceId

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
pub struct DeviceId(pub usize);

impl DeviceId {
    /// Passthrough 设备 ID 基址
    pub const PASSTHROUGH_BASE: usize = 0x1000_0000;

    /// 创建 passthrough 设备 ID
    pub const fn passthrough(irq: u32) -> Self {
        Self(Self::PASSTHROUGH_BASE + irq as usize)
    }

    /// 检查是否为 passthrough 设备
    pub const fn is_passthrough(&self) -> bool {
        self.0 >= Self::PASSTHROUGH_BASE
    }
}

5.4 DeviceStats

pub struct DeviceStats {
    pub read_count: AtomicU64,
    pub write_count: AtomicU64,
    pub error_count: AtomicU64,
}

impl DeviceStats {
    pub fn new() -> Self {
        Self {
            read_count: AtomicU64::new(0),
            write_count: AtomicU64::new(0),
            error_count: AtomicU64::new(0),
        }
    }

    pub fn record_read(&self)  { self.read_count.fetch_add(1, Ordering::Relaxed); }
    pub fn record_write(&self) { self.write_count.fetch_add(1, Ordering::Relaxed); }
    pub fn record_error(&self) { self.error_count.fetch_add(1, Ordering::Relaxed); }
    pub fn total_operations(&self) -> u64 {
        self.read_count.load(Ordering::Relaxed)
        + self.write_count.load(Ordering::Relaxed)
    }
}

---

6. 改进四：多段地址支持

6.1 问题分析

当前 BaseDeviceOps::address_range() 只返回单个地址范围，无法支持：

• VirtIO 设备（控制区、通知区、状态区、配置区）
• PCI 设备（配置空间 + 多个 BAR）
• 复杂的中断控制器（分发器、重分发器、ITS）

性能陷阱：如果让设备在每次 MMIO 时重建 Vec<DeviceRegion>，会导致：

1. 热路径上频繁的堆内存分配（~500ns 开销）
2. 不必要的 Vec 复制

6.2 解决方案：零分配的多段地址支持

采用框架缓存 + 设备快速查找的两层设计：

1. 框架层：注册时缓存 region 信息，用于地址分发
2. 设备层：提供零分配的快速查找方法 region_lookup()

6.2.1 多段地址类型定义（axdevice_base）

/// 区域 ID（避免字符串比较）
pub struct RegionId(pub u8);

impl RegionId {
    pub const CONTROL: Self = Self(0);
    pub const STATUS: Self = Self(1);
    pub const NOTIFICATION: Self = Self(2);
    pub const CONFIG: Self = Self(3);
    pub const DATA: Self = Self(4);
    pub const DEFAULT: Self = Self(5);
    // PCI BARs
    pub const BAR0: Self = Self(16);
    pub const BAR1: Self = Self(17);
    pub const BAR2: Self = Self(18);
    pub const BAR3: Self = Self(19);
    pub const BAR4: Self = Self(20);
    pub const BAR5: Self = Self(21);
}

/// 区域类型
pub enum RegionType {
    Generic,
    Control,
    Status,
    Data,
    Notification,
    Config,
    PciConfig,
    PciBar(u8),
}

/// 访问权限
pub enum Permissions {
    ReadWrite,
    ReadOnly,
    WriteOnly,
    None,
}

/// 区域查找结果（零分配，栈上返回）
pub struct RegionHit {
    pub region_id: RegionId,
    pub offset: usize,
    pub region_type: RegionType,
    pub permissions: Permissions,
}

/// 设备地址区域描述
pub struct DeviceRegion {
    pub id: RegionId,
    pub name: &'static str,
    pub base: usize,
    pub size: usize,
    pub region_type: RegionType,
    pub permissions: Permissions,
}

impl DeviceRegion {
    pub const fn new(id: RegionId, name: &'static str, base: usize, size: usize) -> Self {
        Self {
            id, name, base, size,
            region_type: RegionType::Generic,
            permissions: Permissions::ReadWrite,
        }
    }

    pub const fn with_type(mut self, region_type: RegionType) -> Self {
        self.region_type = region_type;
        self
    }

    pub const fn with_permissions(mut self, permissions: Permissions) -> Self {
        self.permissions = permissions;
        self
    }

    /// 尝试匹配地址，返回命中信息（零分配）
    #[inline]
    pub fn try_hit(&self, addr: usize) -> Option<RegionHit> {
        if addr >= self.base && addr < self.base + self.size {
            Some(RegionHit {
                region_id: self.id,
                offset: addr - self.base,
                region_type: self.region_type,
                permissions: self.permissions,
            })
        } else {
            None
        }
    }
}

/// 静态区域描述符（最多 8 个区域，无堆分配）
pub const MAX_REGIONS_PER_DEVICE: usize = 8;

pub struct RegionDescriptor {
    regions: ArrayVec<DeviceRegion, MAX_REGIONS_PER_DEVICE>,
}

impl RegionDescriptor {
    pub fn new() -> Self {
        Self { regions: ArrayVec::new() }
    }

    pub fn with_region(mut self, region: DeviceRegion) -> Self {
        self.regions.push(region);
        self
    }

    pub fn single(base: usize, size: usize) -> Self {
        Self::new().with_region(
            DeviceRegion::new(RegionId::DEFAULT, "default", base, size)
        )
    }

    /// 查找地址所属的区域（O(n)，但 n ≤ 8）
    #[inline]
    pub fn lookup(&self, addr: usize) -> Option<RegionHit> {
        self.regions.iter().find_map(|r| r.try_hit(addr))
    }
}

6.2.2 CachedRegions（框架缓存）

pub struct CachedRegions {
    regions: ArrayVec<DeviceRegion, MAX_REGIONS_PER_DEVICE>,
    version: AtomicU32,
}

impl CachedRegions {
    pub fn new() -> Self;
    pub fn from_descriptor(desc: &RegionDescriptor) -> Self;
    pub fn from_device<R, D>(device: &D) -> Option<Self>;

    /// 零分配查找
    #[inline]
    pub fn lookup(&self, addr: usize) -> Option<RegionHit> {
        self.regions.iter().find_map(|r| r.try_hit(addr))
    }

    /// 更新缓存（用于动态区域变化）
    pub fn update(&mut self, desc: &RegionDescriptor);

    pub fn version(&self) -> u32;
    pub fn regions(&self) -> &[DeviceRegion];
}

6.3 设备实现示例：多段地址设备

pub struct VirtioNet {
    base: usize,
    ranges: [GuestPhysAddrRange; 2],
    driver: DeviceCell<VirtioNetDriver>,
}

impl VirtioNet {
    /// 内联快速查找（零分配，直接计算）
    #[inline(always)]
    fn fast_lookup(&self, addr: usize) -> Option<RegionHit> {
        let offset = addr.checked_sub(self.base)?;

        if offset < 0x100 {
            Some(RegionHit {
                region_id: RegionId::CONTROL,
                offset,
                region_type: RegionType::Control,
                permissions: Permissions::ReadWrite,
            })
        } else if offset >= 0x1000 && offset < 0x2000 {
            Some(RegionHit {
                region_id: RegionId::NOTIFICATION,
                offset: offset - 0x1000,
                region_type: RegionType::Notification,
                permissions: Permissions::WriteOnly,
            })
        } else {
            None
        }
    }
}

impl BaseDeviceOps<GuestPhysAddrRange> for VirtioNet {
    fn address_ranges(&self) -> &[GuestPhysAddrRange] {
        &self.ranges
    }

    fn region_descriptor(&self) -> Option<RegionDescriptor> {
        Some(RegionDescriptor::new()
            .with_region(
                DeviceRegion::new(RegionId::CONTROL, "control", self.base, 0x100)
                    .with_type(RegionType::Control)
            )
            .with_region(
                DeviceRegion::new(RegionId::NOTIFICATION, "notify",
                    self.base + 0x1000, 0x1000)
                    .with_type(RegionType::Notification)
                    .with_permissions(Permissions::WriteOnly)
            ))
    }

    /// 覆盖默认实现，使用内联快速查找
    #[inline]
    fn region_lookup(&self, addr: usize) -> Option<RegionHit> {
        self.fast_lookup(addr)
    }

    fn handle_read(&self, addr: GuestPhysAddr, width: AccessWidth) -> AxResult<usize> {
        let hit = self.fast_lookup(addr.as_usize())
            .ok_or_else(|| ax_err!(NotFound, "Address not in device"))?;

        let driver = self.driver.get_mut();
        match hit.region_id {
            RegionId::CONTROL => driver.read_control(hit.offset, width),
            _ => Ok(0),
        }
    }

    fn handle_write(&self, addr: GuestPhysAddr, width: AccessWidth, val: usize) -> AxResult {
        let hit = self.fast_lookup(addr.as_usize())
            .ok_or_else(|| ax_err!(NotFound, "Address not in device"))?;

        let driver = self.driver.get_mut();
        match hit.region_id {
            RegionId::CONTROL => driver.write_control(hit.offset, width, val),
            RegionId::NOTIFICATION => driver.write_notify(hit.offset, width, val),
            _ => Ok(()),
        }
    }
}

---

7. 改进五：设备热插拔

7.1 问题分析

当前只能添加设备，无法移除。热插拔需要考虑：

• 引用安全：正在访问的设备不能被移除
• 状态清理：中断路由等需要清理
• 原子性：移除过程需要是原子的
• TOCTOU 竞态：检查状态和修改之间可能被其他线程干扰

❌ 传统做法（有 TOCTOU 竞态）：
Thread A:  if state == Active { count += 1; }   // 两步操作，非原子
Thread B:  state = Removing;                     // 在 A 的两步之间执行

✅ CAS 做法（原子操作）：
Thread A:  CAS(old_value, new_value)             // 原子检查+修改

7.2 解决方案：原子状态机 + CAS 操作

使用单个原子变量同时存储状态和计数，通过 CAS 操作保证原子性。

7.2.1 设备状态

#[repr(u8)]
pub enum DeviceState {
    Active = 0,    // 设备活跃，可处理请求
    Removing = 1,  // 正在移除，拒绝新请求
    Removed = 2,   // 已移除
}

状态转换：

┌─────────┐  begin_removal()   ┌──────────┐  complete_removal()  ┌─────────┐
│ Active  │ ──────────────────> │ Removing │ ───────────────────> │ Removed │
└─────────┘                     └──────────┘                      └─────────┘
     ▲                                                                  │
     └──────────────────── reset_to_active() ───────────────────────────┘

7.2.2 StateAndCount（无竞态设计）

/// 布局: [状态(8位) | 访问计数(24位)]
pub struct StateAndCount(AtomicU32);

impl StateAndCount {
    const STATE_SHIFT: u32 = 24;
    const COUNT_MASK: u32 = (1 << Self::STATE_SHIFT) - 1;

    pub fn new() -> Self {
        Self(AtomicU32::new(0))  // Active, count=0
    }

    /// 原子地尝试增加访问计数（仅在 Active 状态成功）
    /// 使用 CAS 循环保证：检查状态和增加计数是原子操作
    pub fn try_acquire(&self) -> Result<(), DeviceState> {
        loop {
            let current = self.0.load(Ordering::Acquire);
            let state = current >> Self::STATE_SHIFT;

            if state != 0 {  // 不是 Active
                return Err(match state {
                    1 => DeviceState::Removing,
                    _ => DeviceState::Removed,
                });
            }

            let count = current & Self::COUNT_MASK;
            if count == Self::COUNT_MASK {
                return Err(DeviceState::Active);  // 计数溢出
            }

            let new_value = (state << Self::STATE_SHIFT) | (count + 1);

            // CAS: 原子检查状态并增加计数
            match self.0.compare_exchange_weak(
                current, new_value,
                Ordering::AcqRel, Ordering::Acquire
            ) {
                Ok(_) => return Ok(()),
                Err(_) => continue,  // 值被修改，重试
            }
        }
    }

    /// 减少访问计数
    pub fn release(&self) {
        self.0.fetch_sub(1, Ordering::AcqRel);
    }

    /// 设置为 Removing 状态，返回当前计数
    pub fn set_removing(&self) -> u32 {
        loop {
            let current = self.0.load(Ordering::Acquire);
            let count = current & Self::COUNT_MASK;
            let new_value = (1 << Self::STATE_SHIFT) | count;

            match self.0.compare_exchange_weak(
                current, new_value,
                Ordering::AcqRel, Ordering::Acquire
            ) {
                Ok(_) => return count,
                Err(_) => continue,
            }
        }
    }

    /// 设置为 Removed 状态
    pub fn set_removed(&self) {
        self.0.store(2 << Self::STATE_SHIFT, Ordering::Release);
    }

    /// 重置为 Active 状态
    pub fn reset_to_active(&self) -> bool {
        let current = self.0.load(Ordering::Acquire);
        let state = current >> Self::STATE_SHIFT;
        if state != 2 { return false; }  // 只能从 Removed 重置

        self.0.compare_exchange(
            current, 0,  // Active, count=0
            Ordering::AcqRel, Ordering::Acquire
        ).is_ok()
    }
}

7.2.3 DeviceLifecycle

pub struct DeviceLifecycle {
    state_count: StateAndCount,
    idle_waiters: WaitQueue,
}

impl DeviceLifecycle {
    pub fn new() -> Self {
        Self {
            state_count: StateAndCount::new(),
            idle_waiters: WaitQueue::new(),
        }
    }

    /// 尝试开始访问（原子、无竞态）
    pub fn try_begin_access(&self) -> bool {
        self.state_count.try_acquire().is_ok()
    }

    /// 结束访问（并通知等待者）
    pub fn end_access(&self) {
        self.state_count.release();
        if self.state_count.count() == 0 {
            self.idle_waiters.notify_all();
        }
    }

    /// 开始移除
    pub fn begin_removal(&self) -> bool {
        self.state_count.set_removing();
        true
    }

    /// 等待所有访问完成
    pub fn wait_idle(&self) {
        self.idle_waiters.wait_until(
            || self.state_count.count() == 0,
            1000000
        );
    }

    /// 带超时等待
    pub fn wait_idle_timeout(&self, max_spins: usize) -> bool {
        self.idle_waiters.wait_until(
            || self.state_count.count() == 0,
            max_spins
        )
    }

    /// 完成移除
    pub fn complete_removal(&self) {
        self.state_count.set_removed();
    }

    /// 重置为活跃状态
    pub fn reset_to_active(&self) -> bool {
        self.state_count.reset_to_active()
    }
}

7.2.4 WaitQueue

避免忙等待的等待队列：

pub struct WaitQueue {
    waiters: AtomicUsize,
    notified: AtomicBool,
}

impl WaitQueue {
    pub const fn new() -> Self {
        Self {
            waiters: AtomicUsize::new(0),
            notified: AtomicBool::new(false),
        }
    }

    /// 等待条件满足
    pub fn wait_until<F>(&self, mut condition: F, max_spins: usize) -> bool
    where F: FnMut() -> bool
    {
        if condition() { return true; }

        self.waiters.fetch_add(1, Ordering::AcqRel);
        let mut spins = 0;

        loop {
            if condition() {
                self.waiters.fetch_sub(1, Ordering::AcqRel);
                return true;
            }

            if spins >= max_spins {
                self.waiters.fetch_sub(1, Ordering::AcqRel);
                return false;
            }

            if self.notified.swap(false, Ordering::AcqRel) {
                continue;
            }

            core::hint::spin_loop();
            spins += 1;
        }
    }

    /// 唤醒所有等待者
    pub fn notify_all(&self) {
        if self.waiters.load(Ordering::Acquire) > 0 {
            self.notified.store(true, Ordering::Release);
        }
    }
}

7.3 设备移除流程

┌─────────────────────────────────────────────────────────────────┐
│ 1. 开始移除                                                      │
│    wrapper.begin_removal()                                      │
│    → state: Active → Removing                                   │
│    → 新访问将被拒绝                                              │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 2. 等待活跃访问完成                                              │
│    wrapper.wait_idle()                                          │
│    → 等待 access_count == 0                                     │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 3. 从注册表移除                                                  │
│    registry.remove_device(id)                                   │
│    → 从地址查找表移除                                            │
│    → 从设备表移除                                                │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 4. 完成移除                                                      │
│    wrapper.complete_removal()                                   │
│    → state: Removing → Removed                                  │
└─────────────────────────────────────────────────────────────────┘

---

8. 改进六：VirtIO 设备支持

8.1 问题分析

• 需要为 VirtIO 块设备和控制台设备提供统一的封装
• 设备配置和构建过程复杂，参数众多
• Guest 访问未实现的设备时会崩溃，需要 Dummy 设备兜底

8.2 解决方案：Builder 模式 + Dummy 设备

8.2.1 VirtIO 块设备

#[cfg(feature = "virtio-blk")]
pub struct VirtioBlkDeviceBuilder {
    base_address: Option<GuestPhysAddr>,
    size: usize,
    irq: Option<u32>,
    capacity_bytes: u64,
}

impl VirtioBlkDeviceBuilder {
    pub fn new() -> Self;
    pub fn base_address(self, addr: GuestPhysAddr) -> Self;
    pub fn size(self, size: usize) -> Self;
    pub fn irq(self, irq: u32) -> Self;
    pub fn capacity_bytes(self, bytes: u64) -> Self;
    pub fn build<B, A>(self, backend: B, accessor: A) -> AxResult<VirtioBlkDevice>;
}

8.2.2 VirtIO 控制台设备

#[cfg(feature = "virtio-console")]
pub struct VirtioConsoleDeviceBuilder {
    base_address: Option<GuestPhysAddr>,
    size: usize,
    irq: Option<u32>,
    cols: u16,
    rows: u16,
}

impl VirtioConsoleDeviceBuilder {
    pub fn new() -> Self;
    pub fn base_address(self, addr: GuestPhysAddr) -> Self;
    pub fn size(self, size: usize) -> Self;
    pub fn irq(self, irq: u32) -> Self;
    pub fn terminal_size(self, cols: u16, rows: u16) -> Self;
    pub fn build<B, A>(self, backend: B, accessor: A) -> AxResult<VirtioConsoleDevice>;
}

8.2.3 Dummy 设备

用于防止 Guest 访问未实现设备时崩溃。这些设备使用 DeviceCell 而非 Mutex，
因为它们的状态只在 handle_read/write 中访问，框架的设备锁已保证安全：

use crate::DeviceCell;

/// Dummy VirtIO 设备 - 模拟一个未初始化的 VirtIO 设备
/// 使用 DeviceCell 实现零成本内部可变性（框架保证安全）
pub struct DummyVirtioDevice {
    range: GuestPhysAddrRange,
    state: DeviceCell<DummyVirtioState>,  // ✅ DeviceCell，非 Mutex
}

struct DummyVirtioState {
    magic: u32,       // 0x74726976 ("virt")
    version: u32,     // 2
    device_id: u32,   // 0 (invalid) ← 关键：返回 0 让 Guest 知道设备无效
    vendor_id: u32,
    status: u32,
    // ... 其他 VirtIO MMIO 寄存器
}

impl BaseDeviceOps<GuestPhysAddrRange> for DummyVirtioDevice {
    fn handle_read(&self, addr: GuestPhysAddr, width: AccessWidth) -> AxResult<usize> {
        let state = self.state.get();  // 零成本：仅指针转换
        // 根据 offset 返回对应寄存器值
        Ok(state.magic as usize)
    }

    fn handle_write(&self, addr: GuestPhysAddr, width: AccessWidth, val: usize) -> AxResult {
        let state = self.state.get_mut();  // 零成本：仅指针转换
        // 更新寄存器状态
        state.status = val as u32;
        Ok(())
    }
}

/// Dummy UART 设备 - 使用 DeviceCell 封装所有寄存器状态
pub struct DummyUartDevice {
    range: GuestPhysAddrRange,
    state: DeviceCell<DummyUartState>,  // ✅ 合并多个字段为单一结构体
}

struct DummyUartState {
    rhr_thr: u8,  // 接收/发送保持寄存器
    ier: u8,      // 中断使能寄存器
    fcr: u8,      // FIFO 控制寄存器
    lcr: u8,      // 线路控制寄存器
    lsr: u8,      // 线路状态寄存器 (默认 0x60: THRE + TEMT)
}

/// Dummy CLINT 设备 - 无状态，不需要 DeviceCell
pub struct DummyClintDevice {
    range: GuestPhysAddrRange,
    // 无可变状态，所有读返回 0，忽略写入
}

// 便捷构造函数
pub fn new_dummy_virtio_device(base: GuestPhysAddr, size: Option<usize>)
    -> Arc<dyn BaseDeviceOps<GuestPhysAddrRange>>;

pub fn new_dummy_uart_device(base: GuestPhysAddr, size: Option<usize>)
    -> Arc<dyn BaseDeviceOps<GuestPhysAddrRange>>;

pub fn new_dummy_clint_device(base: GuestPhysAddr, size: Option<usize>)
    -> Arc<dyn BaseDeviceOps<GuestPhysAddrRange>>;

8.3 特性标志

[features]
virtio-blk = ["dep:axvirtio-blk"]
virtio-console = ["dep:axvirtio-console"]

---

9. 完整工作流程

9.1 设备注册流程

┌─────────────────────────────────────────────────────────────────┐
│ 1. 创建设备                                                      │
│    let device = Arc::new(MyDevice::new(base, irq));             │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 2. 注册到 Registry                                               │
│    let id = registry.add_device(device)?;                       │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 3. 框架自动处理                                                  │
│    a. 创建 DeviceWrapper（包含 lifecycle, lock, stats）          │
│    b. 缓存 region 信息（如果有）                                 │
│    c. 注册地址范围到查找表                                       │
│    d. 如果有中断配置，注册到 InterruptManager                    │
│    e. 如果有中断配置，创建并注入 InterruptTrigger               │
└─────────────────────────────────────────────────────────────────┘

9.2 设备访问流程

┌─────────────────────────────────────────────────────────────────┐
│ 1. Guest 执行 MMIO 写操作                                        │
│    写入地址 0x9000004                                            │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 2. VM Exit → Hypervisor                                         │
│    exit_reason = MmioWrite { addr: 0x9000004, width: 4, val }   │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 3. registry.handle_write(addr, width, val)                      │
│    a. find_device_by_addr(addr)      // 查找设备                 │
│    b. wrapper.try_access_for_write() // 获取访问权限             │
│       - lifecycle.try_begin_access() // CAS 检查状态             │
│       - _guard = lock.lock()         // 获取设备锁               │
│       - device.handle_write()        // 调用设备方法             │
│       - lifecycle.end_access()       // 释放访问                 │
│       - 更新统计信息                                             │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 4. 设备处理写操作                                                │
│    let driver = self.driver.get_mut();                          │
│    driver.process_write(offset, val);                           │
│    if need_interrupt {                                          │
│        trigger.trigger(IrqType::Primary)?;                      │
│    }                                                            │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 5. 中断处理（如果触发）                                          │
│    InterruptManager.inject()                                    │
│    → 加入 pending_queues[cpu_id]                                │
└────────────────────┬────────────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────────────┐
│ 6. VM Entry 前                                                  │
│    if let Some(irq) = manager.pop_pending(cpu_id) {             │
│        vcpu.inject_interrupt(irq.irq);                          │
│    }                                                            │
└────────────────────────────────────────────────────────────────┘

---

10. 迁移指南

10.1 从旧版本迁移

步骤 1：更新 trait 实现

// ❌ 旧代码
impl BaseDeviceOps<GuestPhysAddrRange> for MyDevice {
    fn emu_type(&self) -> EmuDeviceType { ... }
    fn address_range(&self) -> GuestPhysAddrRange { ... }  // 已废弃
    fn handle_read(&self, ...) -> AxResult<usize> { ... }
    fn handle_write(&self, ...) -> AxResult { ... }
}

// ✅ 新代码
impl BaseDeviceOps<GuestPhysAddrRange> for MyDevice {
    fn emu_type(&self) -> EmuDeviceType { ... }

    // 使用 address_ranges() 替代 address_range()
    fn address_ranges(&self) -> &[GuestPhysAddrRange] {
        core::slice::from_ref(&self.range)
    }

    fn handle_read(&self, ...) -> AxResult<usize> { ... }
    fn handle_write(&self, ...) -> AxResult { ... }
}

步骤 2：使用 DeviceCell 处理内部可变性

// ❌ 旧代码（使用 Mutex，每次访问都获取锁）
pub struct OldDevice {
    state: Mutex<DeviceState>,
}

impl OldDevice {
    fn handle_read(&self, ...) {
        let state = self.state.lock();  // 需要获取锁
        // ...
    }
}

// ✅ 新代码（使用 DeviceCell，框架已保证安全）
use axdevice::DeviceCell;

pub struct NewDevice {
    state: DeviceCell<DeviceState>,
}

impl NewDevice {
    fn handle_read(&self, ...) {
        let state = self.state.get_mut();  // 框架已保证安全
        // ...
    }
}

重要说明：

• ❌ 不能用 RefCell（不是 Sync）
• ✅ 用 DeviceCell（框架提供，类似 RefCell 但实现了 Sync）
• ✅ 简单 Copy 类型可以用标准 Cell

步骤 3：添加中断支持（可选）

// ❌ 旧代码：直接调用中断控制器
impl OldDevice {
    fn trigger_irq(&self, vgic: &Vgic) {
        vgic.set_pending(0, self.irq);  // 直接耦合 VGIC
    }
}

// ✅ 新代码：使用框架中断系统
impl BaseDeviceOps<GuestPhysAddrRange> for NewDevice {
    fn interrupt_config(&self) -> Option<InterruptConfig> {
        Some(InterruptConfig {
            primary_irq: self.irq,
            additional_irqs: vec![],
            trigger_mode: TriggerMode::Level,
            cpu_affinity: CpuAffinity::Fixed(0),
            priority: 100,
        })
    }

    fn set_interrupt_trigger(&self, trigger: Arc<dyn InterruptTrigger>) {
        *self.trigger.get_mut() = Some(trigger);
    }

    fn handle_write(&self, ...) -> AxResult {
        // ...
        if let Some(trigger) = self.trigger.get().as_ref() {
            trigger.trigger(IrqType::Primary)?;
        }
        Ok(())
    }
}

10.2 兼容性说明

方面	兼容性
现有 trait 方法	完全兼容
address_range()	已废弃，但仍可用
新增可选方法	有默认实现
Send + Sync 要求	必须满足
中断系统	可选迁移

---

11. 总结

11.1 改进对照表

问题	改进	收益
RefCell 不是 Sync	DeviceCell	解决内部可变性与多线程共享的矛盾
无并发控制	设备级独立锁	不同设备可并发访问，同设备串行
双重锁定开销	DeviceCell 替代内部 Mutex	消除 ~50-100 CPU 周期的冗余锁开销
TOCTOU 竞态	CAS 状态机	消除竞态条件，保证原子性
无中断管理	统一通知机制	统一的通知路由、优先级、亲和性、多种通知方式
O(n) 查找	DeviceRegistry	高效的设备查找和管理
单段地址	RegionDescriptor	支持 VirtIO/PCI 等复杂设备
无热插拔	DeviceLifecycle	安全的设备移除
无 VirtIO 支持	Builder + Dummy	完整的 VirtIO 设备框架

11.2 DeviceCell 实际应用

框架中的 Dummy 设备已使用 DeviceCell：

设备	内部可变性方案	原因
DummyVirtioDevice	DeviceCell<DummyVirtioState>	状态只在 handle_read/write 中访问
DummyUartDevice	DeviceCell<DummyUartState>	状态只在 handle_read/write 中访问
DummyClintDevice	无	无可变状态
VPlicGlobal	Mutex<Bitmap>	有公共方法 set_irq_pending 需要外部访问

11.3 架构优势

设备开发者只需关注：          框架自动处理：
┌─────────────────┐          ┌─────────────────────────────┐
│ • 业务逻辑       │          │ • 并发控制（设备级锁）          │
│ • 寄存器实现     │    →     │ • DeviceCell 内部可变性       │
│ • 协议处理       │          │ • 中断路由                    │
│ • 用 DeviceCell  │          │ • 地址查找                   │
│                 │          │ • 生命周期管理                │
│ (~100-200 行)   │          │ • 统计监控                    │
└─────────────────┘          └─────────────────────────────┘

11.4 后续工作

1. IOMMU 支持
2. 设备状态快照（VM 迁移）
3. 设备性能分析工具
4. PCI 设备完整支持
5. 设备树集成

[YanLien]

AxVsior启动Linux

OpenSBI v1.7
   ____                    _____ ____ _____
  / __ \                  / ____|  _ \_   _|
 | |  | |_ __   ___ _ __ | (___ | |_) || |
 | |  | | '_ \ / _ \ '_ \ \___ \|  _ < | |
 | |__| | |_) |  __/ | | |____) | |_) || |_
  \____/| .__/ \___|_| |_|_____/|____/_____|
        | |
        |_|

Platform Name               : riscv-virtio,qemu
Platform Features           : medeleg
Platform HART Count         : 4
Platform IPI Device         : aclint-mswi
Platform Timer Device       : aclint-mtimer @ 10000000Hz
Platform Console Device     : uart8250
Platform HSM Device         : ---
Platform PMU Device         : ---
Platform Reboot Device      : syscon-reboot
Platform Shutdown Device    : syscon-poweroff
Platform Suspend Device     : ---
Platform CPPC Device        : ---
Firmware Base               : 0x80000000
Firmware Size               : 353 KB
Firmware RW Offset          : 0x40000
Firmware RW Size            : 97 KB
Firmware Heap Offset        : 0x4c000
Firmware Heap Size          : 49 KB (total), 3 KB (reserved), 12 KB (used), 33 KB (free)
Firmware Scratch Size       : 4096 B (total), 1400 B (used), 2696 B (free)
Runtime SBI Version         : 3.0
Standard SBI Extensions     : time,rfnc,ipi,base,hsm,srst,pmu,dbcn,fwft,legacy,dbtr,sse
Experimental SBI Extensions : none

Domain0 Name                : root
Domain0 Boot HART           : 0
Domain0 HARTs               : 0*,1*,2*,3*
Domain0 Region00            : 0x0000000000100000-0x0000000000100fff M: (I,R,W) S/U: (R,W)
Domain0 Region01            : 0x0000000010000000-0x0000000010000fff M: (I,R,W) S/U: (R,W)
Domain0 Region02            : 0x0000000002000000-0x000000000200ffff M: (I,R,W) S/U: ()
Domain0 Region03            : 0x0000000080040000-0x000000008005ffff M: (R,W) S/U: ()
Domain0 Region04            : 0x0000000080000000-0x000000008003ffff M: (R,X) S/U: ()
Domain0 Region05            : 0x000000000c400000-0x000000000c5fffff M: (I,R,W) S/U: (R,W)
Domain0 Region06            : 0x000000000c000000-0x000000000c3fffff M: (I,R,W) S/U: (R,W)
Domain0 Region07            : 0x0000000000000000-0xffffffffffffffff M: () S/U: (R,W,X)
Domain0 Next Address        : 0x0000000080200000
Domain0 Next Arg1           : 0x000000027fe00000
Domain0 Next Mode           : S-mode
Domain0 SysReset            : yes
Domain0 SysSuspend          : yes

Boot HART ID                : 0
Boot HART Domain            : root
Boot HART Priv Version      : v1.12
Boot HART Base ISA          : rv64imafdch
Boot HART ISA Extensions    : zicntr,zihpm,zicboz,zicbom,sdtrig,svadu
Boot HART PMP Count         : 16
Boot HART PMP Granularity   : 2 bits
Boot HART PMP Address Bits  : 54
Boot HART MHPM Info         : 16 (0x0007fff8)
Boot HART Debug Triggers    : 2 triggers
Boot HART MIDELEG           : 0x0000000000001666
Boot HART MEDELEG           : 0x0000000000f4b509

       d8888                            .d88888b.   .d8888b.
      d88888                           d88P" "Y88b d88P  Y88b
     d88P888                           888     888 Y88b.
    d88P 888 888d888  .d8888b  .d88b.  888     888  "Y888b.
   d88P  888 888P"   d88P"    d8P  Y8b 888     888     "Y88b.
  d88P   888 888     888      88888888 888     888       "888
 d8888888888 888     Y88b.    Y8b.     Y88b. .d88P Y88b  d88P
d88P     888 888      "Y8888P  "Y8888   "Y88888P"   "Y8888P"

smp = 4


       d8888            888     888  d8b
      d88888            888     888  Y8P
     d88P888            888     888
    d88P 888  888  888  Y88b   d88P  888  .d8888b    .d88b.   888d888
   d88P  888  `Y8bd8P'   Y88b d88P   888  88K       d88""88b  888P"
  d88P   888    X88K      Y88o88P    888  "Y8888b.  888  888  888
 d8888888888  .d8""8b.     Y888P     888       X88  Y88..88P  888
d88P     888  888  888      Y8P      888   88888P'   "Y88P"   888


by AxVisor Team

[    0.000000] Booting Linux on hartid 0
[    0.000000] Linux version 6.18.0-rc6-gfd95357fd8c6-dirty (runner@s1lqc) (riscv64-linux-gnu-gcc (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #24 SMP Tue Jan  6 10:48:53 CST 2026
[    0.000000] Machine model: riscv-virtio,qemu
[    0.000000] SBI specification v2.0 detected
[    0.000000] SBI implementation ID=0x4 Version=0x400
[    0.000000] SBI RFENCE extension detected
[    0.000000] SBI SRST extension detected
[    0.000000] SBI DBCN extension detected
[    0.000000] earlycon: sbi0 at I/O port 0x0 (options '')
[    0.000000] printk: legacy bootconsole [sbi0] enabled
[    0.000000] efi: UEFI not found.
[    0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT
[    0.000000] Zone ranges:
[    0.000000]   DMA32    [mem 0x0000000090000000-0x00000000cfffffff]
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000090000000-0x00000000cfffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000090000000-0x00000000cfffffff]
[    0.000000] SBI HSM extension detected
[    0.000000] riscv: base ISA extensions acdfim
[    0.000000] riscv: ELF capabilities acdfim
[    0.000000] Ticket spinlock: enabled
[    0.000000] percpu: Embedded 31 pages/cpu s86296 r8192 d32488 u126976
[    0.000000] Kernel command line: earlycon=sbi console=ttyS0,115200 init=/init root=/dev/vda rw
[    0.000000] printk: log buffer data + meta data: 131072 + 458752 = 589824 bytes
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 262144
[    0.000000] mem auto-init: stack:all(zero), heap alloc:off, heap free:off
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: 	RCU event tracing is enabled.
[    0.000000] rcu: 	RCU restricting CPUs from NR_CPUS=64 to nr_cpu_ids=1.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1
[    0.000000] RCU Tasks Trace: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] riscv-intc: 64 local interrupts mapped
[    0.000000] riscv: providing IPIs using SBI IPI extension
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] clocksource: riscv_clocksource: mask: 0xffffffffffffffff max_cycles: 0x24e6a1710, max_idle_ns: 440795202120 ns
[    0.000132] sched_clock: 64 bits at 10MHz, resolution 100ns, wraps every 4398046511100ns
[    0.012400] Console: colour dummy device 80x25
[    0.016097] Calibrating delay loop (skipped), value calculated using timer frequency.. 20.00 BogoMIPS (lpj=40000)
[    0.016639] pid_max: default: 32768 minimum: 301
[    0.021361] LSM: initializing lsm=capability
[    0.025462] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.025811] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.087604] riscv: ELF compat mode supported
[    0.088039] ASID allocator using 16 bits (65536 entries)
[    0.090928] rcu: Hierarchical SRCU implementation.
[    0.091231] rcu: 	Max phase no-delay instances is 1000.
[    0.096391] EFI services will not be available.
[    0.098517] smp: Bringing up secondary CPUs ...
[    0.099970] smp: Brought up 1 node, 1 CPU
[    0.108048] Memory: 981428K/1048576K available (11605K kernel code, 5896K rwdata, 6144K rodata, 2421K init, 415K bss, 63140K reserved, 0K cma-reserved)
[    0.124225] devtmpfs: initialized
[    0.141498] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.142110] posixtimers hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.142901] futex hash table entries: 256 (16384 bytes on 1 NUMA nodes, total 16 KiB, linear).
[    0.147920] pinctrl core: initialized pinctrl subsystem
[    0.160559] DMI not present or invalid.
[    0.165003] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.171800] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.172401] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.173012] audit: initializing netlink subsys (disabled)
[    0.179809] thermal_sys: Registered thermal governor 'step_wise'
[    0.181438] audit: type=2000 audit(0.152:1): state=initialized audit_enabled=0 res=1
[    0.182924] cpuidle: using governor menu
[    0.209973] cpu0: Ratio of byte access time to unaligned word access is 7.52, unaligned accesses are fast
[    0.254698] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[    0.255025] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page
[    0.265468] ACPI: Interpreter disabled.
[    0.266744] iommu: Default domain type: Translated
[    0.267012] iommu: DMA domain TLB invalidation policy: strict mode
[    0.278417] SCSI subsystem initialized
[    0.286159] usbcore: registered new interface driver usbfs
[    0.286996] usbcore: registered new interface driver hub
[    0.287857] usbcore: registered new device driver usb
[    0.297673] Advanced Linux Sound Architecture Driver Initialized.
[    0.339938] vgaarb: loaded
[    0.351788] clocksource: Switched to clocksource riscv_clocksource
[    0.360425] pnp: PnP ACPI: disabled
[    0.437978] NET: Registered PF_INET protocol family
[    0.440332] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.451962] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.452367] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.452752] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.453609] TCP bind hash table entries: 8192 (order: 6, 262144 bytes, linear)
[    0.454386] TCP: Hash tables configured (established 8192 bind 8192)
[    0.456581] UDP hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.457212] UDP-Lite hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.459951] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.489179] RPC: Registered named UNIX socket transport module.
[    0.489541] RPC: Registered udp transport module.
[    0.489757] RPC: Registered tcp transport module.
[    0.489965] RPC: Registered tcp-with-tls transport module.
[    0.490203] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.490666] PCI: CLS 0 bytes, default 64
[    0.521461] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    0.538135] NFS: Registering the id_resolver key type
[    0.539276] Key type id_resolver registered
[    0.539550] Key type id_legacy registered
[    0.540325] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[    0.540746] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[    0.542336] 9p: Installing v9fs 9p2000 file system support
[    0.545933] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 244)
[    0.556116] io scheduler mq-deadline registered
[    0.556490] io scheduler kyber registered
[    0.557120] io scheduler bfq registered
[    0.587110] riscv-plic: plic@c000000: mapped 95 interrupts with 1 handlers for 2 contexts.
[    0.642582] virtio-mmio 10006000.virtio_mmio: Wrong magic value 0x00000000!
[    0.645069] virtio-mmio 10005000.virtio_mmio: Wrong magic value 0x00000000!
[    0.645681] virtio-mmio 10004000.virtio_mmio: Wrong magic value 0x00000000!
[    0.646246] virtio-mmio 10003000.virtio_mmio: Wrong magic value 0x00000000!
[    0.646792] virtio-mmio 10002000.virtio_mmio: Wrong magic value 0x00000000!
[    0.647847] virtio-mmio 10001000.virtio_mmio: Wrong magic value 0x00000000!
[    0.961951] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
[    1.001258] printk: legacy console [ttyS0] disabled
[    1.019607] 10000000.serial: ttyS0 at MMIO 0x10000000 (irq = 12, base_baud = 230400) is a 16550A
[    1.022563] printk: legacy console [ttyS0] enabled
[    1.022563] printk: legacy console [ttyS0] enabled
[    1.023850] printk: legacy bootconsole [sbi0] disabled
[    1.023850] printk: legacy bootconsole [sbi0] disabled
[    1.093845] loop: module loaded
[    1.096531] virtio_blk virtio0: 1/0/0 default/read/poll queues
[    1.111838] virtio_blk virtio0: [vda] 524288 512-byte logical blocks (268 MB/256 MiB)
[    1.197031] e1000e: Intel(R) PRO/1000 Network Driver
[    1.197233] e1000e: Copyright(c) 1999 - 2015 Intel Corporation.
[    1.213714] usbcore: registered new interface driver uas
[    1.214448] usbcore: registered new interface driver usb-storage
[    1.216370] mousedev: PS/2 mouse device common for all mice
[    1.219463] sdhci: Secure Digital Host Controller Interface driver
[    1.219679] sdhci: Copyright(c) Pierre Ossman
[    1.219947] Synopsys Designware Multimedia Card Interface Driver
[    1.220566] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.223838] usbcore: registered new interface driver usbhid
[    1.224170] usbhid: USB HID core driver
[    1.225455] riscv-pmu-sbi: SBI PMU extension is available
[    1.227537] riscv-pmu-sbi: 16 firmware and 18 hardware counters
[    1.227819] riscv-pmu-sbi: Perf sampling/filtering is not supported as sscof extension is not available
[    1.259145] NET: Registered PF_INET6 protocol family
[    1.285855] Segment Routing with IPv6
[    1.286350] In-situ OAM (IOAM) with IPv6
[    1.287430] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[    1.292508] NET: Registered PF_PACKET protocol family
[    1.293643] 9pnet: Installing 9P2000 support
[    1.294270] Key type dns_resolver registered
[    2.178302] clk: Disabling unused clocks
[    2.179166] PM: genpd: Disabling unused power domains
[    2.179554] ALSA device list:
[    2.179739]   No soundcards found.
[    2.190628] check access for rdinit=/init failed: -2, ignoring
[    2.257946] EXT4-fs (vda): recovery complete
[    2.260032] EXT4-fs (vda): mounted filesystem 31aa9613-fef9-45d1-bfba-e952d151f1eb r/w with ordered data mode. Quota mode: disabled.
[    2.260925] VFS: Mounted root (ext4 filesystem) on device 254:0.
[    2.265744] devtmpfs: mounted
[    2.394211] Freeing unused kernel image (initmem) memory: 2420K
[    2.395463] Run /init as init process
test pass!
/bin/sh: can't access tty; job control turned off
~ # 

[YanLien]

AxVisor接入Virtio-Console

[    1.668179] printk: legacy console [hvc0] enabled
[    1.669840] printk: legacy bootconsole [sbi0] disabled
[  2.405982 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff800a0770
[  2.406261 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  2.406500 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.408441 0:14 riscv_vcpu::vcpu:686] [GPF] Guest page fault: fault_addr=GPA:0x10007070, sepc=0xffffffff80699ace, is_write=false
[  2.409974 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff8023f45a
[  2.410247 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  2.410484 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.413982 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80122968
[  2.414257 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.414489 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.417967 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80b4155e
[  2.418222 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.418451 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.422001 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff805aab7c
[  2.422273 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.422504 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.425993 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff804b16f6
[  2.426270 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.426503 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.429981 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80495368
[  2.430260 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.430494 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.433986 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80122992
[  2.434269 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.434502 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.437969 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80122964
[  2.438226 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.438453 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.441984 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80122964
[  2.442248 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.442474 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.445970 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff804b608a
[  2.446249 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.446481 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.449979 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff802feff2
[  2.450260 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.450492 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.453975 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff8012298e
[  2.454241 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.454474 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.457968 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80122992
[  2.458224 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.458453 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.461978 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff802fefd4
[  2.462249 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.462481 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.465984 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff8028dc50
[  2.466264 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  2.466502 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.469965 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80b4b3b0
[  2.470233 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.470465 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.473966 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80122992
[  2.474218 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.474444 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.477969 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80288006
[  2.478236 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.478465 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.481980 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff802fef4e
[  2.482253 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.482483 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.484814 0:14 riscv_vcpu::vcpu:686] [GPF] Guest page fault: fault_addr=GPA:0x10007050, sepc=0xffffffff80699d36, is_write=true
[  2.485079 0:14 axdevice::virtio::console:220] [VirtioConsole] QUEUE_NOTIFY: queue=1, interrupt_status=0
[  2.485266 0:14 axvirtio_console::mmio::device:362] [VirtioConsole] handle_queue_notify: queue_index=1
[  2.485495 0:14 axvirtio_console::mmio::device:376] [VirtioConsole] Transmitq notified, processing...
[  2.486164 0:14 axaddrspace::address_space:174] vaddr GPA:0x91ff5002 translate to PA:0x91ff5002
[  2.486509 0:14 axvirtio_console::mmio::device:408] [VirtioConsole] process_transmit_queue: avail_idx=1, last_avail=0
[  2.486955 0:14 axaddrspace::address_space:174] vaddr GPA:0x91ff5004 translate to PA:0x91ff5004
[  2.487217 0:14 axvirtio_console::mmio::device:421] [VirtioConsole] Processing descriptor chain at index 0
[  2.487726 0:14 axaddrspace::address_space:174] vaddr GPA:0x91ff4000 translate to PA:0x91ff4000
[  2.488073 0:14 axvirtio_console::mmio::device:467] [VirtioConsole] process_transmit_chain: 1 descriptors
[  2.488363 0:14 axaddrspace::address_space:174] vaddr GPA:0x91c55d20 translate to PA:0x91c55d20
[  2.488605 0:14 axvirtio_console::mmio::device:486] [VirtioConsole] Writing 16 bytes to backend
[    1.750596] l[  2.488863 0:14 axvirtio_console::mmio::device:491] [VirtioConsole] Backend wrote 16 bytes
[  2.489205 0:14 axvirtio_console::mmio::device:425] [VirtioConsole] Processed 16 bytes
[  2.489610 0:14 axvirtio_common::queue::used:224] [UsedRing] Writing used element to addr 0x91ff6004: id=0, len=16
[  2.489837 0:14 axaddrspace::address_space:174] vaddr GPA:0x91ff6004 translate to PA:0x91ff6004
[  2.490051 0:14 axaddrspace::address_space:174] vaddr GPA:0x91ff6004 translate to PA:0x91ff6004
[  2.490330 0:14 axvirtio_common::queue::used:236] [UsedRing] Verified used element: id=0, len=16 (expected id=0, len=16)
[  2.490663 0:14 axvirtio_common::queue::used:277] [UsedRing] Writing used_idx 1 to addr 0x91ff6002
[  2.490867 0:14 axaddrspace::address_space:174] vaddr GPA:0x91ff6002 translate to PA:0x91ff6002
[  2.491087 0:14 axaddrspace::address_space:174] vaddr GPA:0x91ff6002 translate to PA:0x91ff6002
[  2.491340 0:14 axvirtio_common::queue::used:298] [UsedRing] Verified used_idx write: wrote=1, readback=1
[  2.491586 0:14 axvirtio_common::queue::used:260] [UsedRing] Added used entry: id=0, len=16, new_used_idx=1
[  2.491883 0:14 axaddrspace::address_space:174] vaddr GPA:0x91ff5084 translate to PA:0x91ff5084
[  2.492171 0:14 axvirtio_common::queue:301] [VirtioQueue] should_notify (EVENT_IDX, first): new_idx=1, used_event=0, returning true
[  2.492548 0:14 axdevice::virtio::console:230] [VirtioConsole] After QUEUE_NOTIFY: interrupt_status=1
[  2.492740 0:14 axvm::arch::cpu:215] vCPU CPU(0) MMIO write: addr=GPA:0x10007050, width=Dword, data=0x1
[  2.492947 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0xa0, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  2.493156 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80699d38
[  2.493419 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  4.867259 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xe0, scause=0x8000000000000005, sepc=0xffffffff806ea8fc
[  4.867705 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  4.877240 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xe0, scause=0x8000000000000005, sepc=0xffffffff806ea8fc
[  4.877667 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  4.887237 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xe0, scause=0x8000000000000005, sepc=0xffffffff806ea8fc
[  4.887650 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  4.897232 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xe0, scause=0x8000000000000005, sepc=0xffffffff806ea8fc
[  4.897635 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  4.907236 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xe0, scause=0x8000000000000005, sepc=0xffffffff806ea8fc
[  4.907701 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  4.917235 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xe0, scause=0x8000000000000005, sepc=0xffffffff806ea8fc
[  4.917653 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  4.927236 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xe0, scause=0x8000000000000005, sepc=0xffffffff806ea8fc
[  4.927643 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  4.937232 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xe0, scause=0x8000000000000005, sepc=0xffffffff806ea8fc
[  4.937649 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  4.947235 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xe0, scause=0x8000000000000005, sepc=0xffffffff806ea8fc
[  4.947840 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)
[  4.957255 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xe0, scause=0x8000000000000005, sepc=0xffffffff806ea8fc
[  4.957735 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000020 (SIE=false)

VS

未接入之前

[  2.706496 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff804ad940
[  2.706794 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.707033 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.710512 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff802feffe
[  2.710791 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.711033 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.714512 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80122968
[  2.714790 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.715048 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.718494 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80122968
[  2.718750 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.718980 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.722497 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff8012297a
[  2.722752 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.722982 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[    2.009875] loop: module loaded
[  2.725811 0:14 riscv_vcpu::vcpu:686] [GPF] Guest page fault: fault_addr=GPA:0x10008070, sepc=0xffffffff80699ace, is_write=false
[  2.726071 0:14 riscv_vcpu::vcpu:705] [GPF] Decoded instruction: Lw(IType(9475)), len=2
[  2.726245 0:14 riscv_vcpu::vcpu:777] [GPF] MMIO read: addr=GPA:0x10008070, width=Dword, rd=10
[  2.726535 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff80693f54
[  2.726798 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.727038 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0x40, scause=0xa, sepc=0xffffffff8001ba90
[  2.727446 0:14 riscv_vcpu::vcpu:686] [GPF] Guest page fault: fault_addr=GPA:0x10008070, sepc=0xffffffff80699ee6, is_write=true
[  2.727747 0:14 riscv_vcpu::vcpu:705] [GPF] Decoded instruction: Sw(SType(11542563)), len=2
[  2.727926 0:14 riscv_vcpu::vcpu:792] [GPF] MMIO write: addr=GPA:0x10008070, width=Dword, rs2=11, value=0x3
[  2.728139 0:14 axvm::arch::cpu:215] vCPU CPU(0) MMIO write: addr=GPA:0x10008070, width=Dword, data=0x3
[  2.728401 0:14 riscv_vcpu::vcpu:686] [GPF] Guest page fault: fault_addr=GPA:0x10008014, sepc=0xffffffff80699fd4, is_write=true
[  2.728635 0:14 riscv_vcpu::vcpu:705] [GPF] Decoded instruction: Sw(SType(14688291)), len=2
[  2.728809 0:14 riscv_vcpu::vcpu:792] [GPF] MMIO write: addr=GPA:0x10008014, width=Dword, rs2=14, value=0x1
[  2.729046 0:14 axvm::arch::cpu:215] vCPU CPU(0) MMIO write: addr=GPA:0x10008014, width=Dword, data=0x1
[  2.729292 0:14 riscv_vcpu::vcpu:686] [GPF] Guest page fault: fault_addr=GPA:0x10008010, sepc=0xffffffff8069a004, is_write=false
[  2.729527 0:14 riscv_vcpu::vcpu:705] [GPF] Decoded instruction: Lw(IType(10115)), len=2
[  2.729697 0:14 riscv_vcpu::vcpu:777] [GPF] MMIO read: addr=GPA:0x10008010, width=Dword, rd=15
[  2.729949 0:14 riscv_vcpu::vcpu:686] [GPF] Guest page fault: fault_addr=GPA:0x10008014, sepc=0xffffffff8069a01a, is_write=true
[  2.730187 0:14 riscv_vcpu::vcpu:705] [GPF] Decoded instruction: Sw(SType(11542563)), len=4
[  2.730360 0:14 riscv_vcpu::vcpu:792] [GPF] MMIO write: addr=GPA:0x10008014, width=Dword, rs2=11, value=0x0
[  2.730600 0:14 axvm::arch::cpu:215] vCPU CPU(0) MMIO write: addr=GPA:0x10008014, width=Dword, data=0x0
[  2.730804 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0xa0, vsie=0x222, vsstatus=0x200000022 (SIE=true)
[  2.731015 0:14 riscv_vcpu::vcpu:227] [RUN] After exit: HVIP=0xa0, scause=0x8000000000000005, sepc=0xffffffff8069a01e
[  2.731268 0:14 riscv_vcpu::vcpu:204] [RUN] HVIP=0x40, vsie=0x222, vsstatus=0x200000022 (SIE=true)

[YanLien]

VirtIO Console 挂起问题分析

问题现象

Linux Guest 通过 hvc0 控制台输出时，只能发送第一个 16 字节的数据包，之后整个控制台输出就卡住了。

根本原因

问题出在 VIRTIO_F_RING_EVENT_IDX 特性与 Linux HVC 驱动的交互上。

EVENT_IDX 机制简述：

• 当启用 EVENT_IDX 时，Device 端通过写入 avail_event 告诉 Guest："只有当你的 avail_idx 越过这个阈值时，才需要发送 QUEUE_NOTIFY"
• Guest 每次添加 buffer 后，通过 vring_need_event(avail_event, new, old) 公式判断是否需要 kick

挂起的原因：

Linux virtio-console 驱动中，发送队列（transmitq）的中断回调函数 out_intr 只调用了 wake_up_interruptible(&port->waitq)，而没有调用 hvc_kick()。相比之下，接收队列的回调 in_intr 会调用 hvc_kick() 来唤醒 HVC 层。

这导致以下流程断裂：

1. Guest 添加 buffer 0 (avail_idx=1)，读到 avail_event=0
   → vring_need_event(0, 1, 0) = TRUE → 发送 QUEUE_NOTIFY ✓

2. Device 处理 buffer 0，写入 used ring，触发中断

3. Guest 收到中断，out_intr 被调用
   → 只唤醒了 port->waitq，但 HVC 层并不在这里等待
   → HVC 层不知道 buffer 已完成，不会尝试发送更多数据

4. 没有新的 buffer 被添加到 transmitq → 控制台永久挂起

修复方案

在 axvirtio-console/src/constants/console.rs 中，将 VIRTIO_F_RING_EVENT_IDX 从 Console 设备的默认特性中移除：

// 修复前
pub const VIRTIO_CONSOLE_DEFAULT_FEATURES: u64 =
    VIRTIO_F_VERSION_1 | VIRTIO_F_RING_EVENT_IDX | VIRTIO_CONSOLE_F_SIZE;

// 修复后
pub const VIRTIO_CONSOLE_DEFAULT_FEATURES: u64 =
    VIRTIO_F_VERSION_1 | VIRTIO_CONSOLE_F_SIZE;

禁用 EVENT_IDX 后，Guest 使用 flags 模式进行通知控制。在 flags 模式下，只要 used_ring->flags 没有设置 VIRTQ_USED_F_NO_NOTIFY（我们初始化为 0），Guest 每次添加 buffer 都会发送 QUEUE_NOTIFY，不依赖 HVC 层对发送完成的响应，从而避免了这个问题。

注意： Block 设备保留了 EVENT_IDX，因为 Block 驱动的中断回调能正确唤醒上层发起新请求。这个问题仅影响 Console/HVC 的发送路径。