[Solicey]

Problem

Linux briefly changes a level-triggered IOAPIC redirection table entry (RTE) to masked + edge while handling EOI. If a virtio completion arrived during that window, hvisor dropped it according to the temporary RTE value, even though the device's interrupt line remained asserted. Zone1 could then hang waiting for I/O, as reported in #409.

Changes

• Keep each IOAPIC pin's asserted line state separately from its RTE. An x86 virtio completion asserts the pin; the existing deassert hypercall now lowers it when the backend reports that the guest has acknowledged the interrupt. The companion hvisor-tool change supplies that report.
• Apply the RTE's trigger mode to the line state. A rising edge is delivered only if its RTE is unmasked and has a valid vector. A level request remains asserted while masked, including during Linux's temporary masked + edge EOI sequence, and is delivered when the RTE is restored to unmasked + level.
• Track the vector awaiting EOI for each level-triggered pin and expose its Remote IRR bit on RTE reads. EOI clears that state and permits another delivery only while the pin is still asserted. The virtual LAPIC also tracks the injected vector in its ISR and TMR registers so Linux reads the correct trigger mode during acknowledgement.
• Block further pin deliveries when a zone starts shutting down, then reset its IOAPIC state before the zone is reused.
• Replace the x86 QEMU zone1 smoke check with one iteration that waits for a zone1 shell, performs a 100 MiB direct write and read on its root disk, and checks the SHA-256 digest. Archive the console logs in Jenkins for failed-run diagnosis.

[peikachu]

This PR seems to break riscv64. In src/hypercall/mod.rs, the old not(target_arch = "loongarch64") also covered riscv64, but it’s now aarch64 / any(aarch64, loongarch64). As a result, riscv64 fails to build. Even after fixing the build, hv_virtio_inject_irq never advances res_agent and loops forever without injecting any IRQ, and hv_zone_shutdown no longer takes the VIRTIO_IRQS lock or clears the zone’s irq_list.

[peikachu]

Race on x86: ioapic_reset() clears the stopping flag before remove_zone(). A virtio injection from another root CPU in between still passes find_zone() and sets the asserted bit on the reset state. If this zone is started again, it will lose its first edge IRQ or get a spurious level IRQ on unmask.

[agicy]

While using Linux 7.2 kernel for testing, I found a problem here.

Linux assigns MSI-X vectors from 0x20 up, so a passed-through device can own 0x21. Filtering it here swallows that device's completion interrupts.