multikernel: make IPI publication ordered and recoverable

Serialize shared-ring producers with a bounded owner-aware gate. Preserve FIFO publication and recover a gate only after its producer CPU is known to be parked.

The gate and slot-state protocol change the private shared transport layout. Add exact pre-launch ABI checks and require an initialization acknowledgment before activation. Prepare each downlink with its target identity so callers can queue messages while the receiver boots, then drain those entries when its handlers publish readiness.

Keep console-path failure diagnostics deferred to avoid recursive printk locking. Mark a launched instance active before releasing the global kexec lock, and wait for readiness without blocking crash kexec. Validate nested-parent identity dynamically and fail initialization cleanly when manifest restoration leaves no root instance.

Fail invalid manifests and missing acknowledgments closed. A spawn started by a host without the pre-launch check validates the boot-context anchor before using shifted fields and parks locally on mismatch.

Signed-off-by: Nikolay Nikolaev <nicknickolaev@gmail.com>

Author: nickolaev

arch/x86/boot/header.S

@@ -379,7 +379,13 @@ xloadflags:
 #define XLF56 0
 #endif
 
-			.word XLF0 | XLF1 | XLF23 | XLF4 | XLF56
+#ifdef CONFIG_MULTIKERNEL
+# define XLF_MK XLF_MULTIKERNEL_IPI
+#else
+# define XLF_MK 0
+#endif
+
+			.word XLF0 | XLF1 | XLF23 | XLF4 | XLF56 | XLF_MK
 
 cmdline_size:   .long   COMMAND_LINE_SIZE-1     #length of the command line,
                                                 #added with boot protocol

arch/x86/include/asm/multikernel.h

@@ -104,11 +104,14 @@ struct mk_spawn_context {
 	unsigned long boot_cpu_khz;	/* Host CPU frequency calibration */
 	unsigned long boot_tsc_khz;	/* Host TSC frequency calibration */
 	unsigned long boot_apic_hz;	/* Host local APIC timer frequency */
+	u64 abi_magic;			/* Validated context producer */
 } __aligned(PAGE_SIZE);
 
 static_assert(offsetof(struct mk_spawn_context, bp) == 144);
 static_assert(offsetof(struct mk_spawn_context, boot_lps) ==
 	      144 + sizeof(struct boot_params));
+static_assert(offsetof(struct mk_spawn_context, abi_magic) ==
+	      144 + sizeof(struct boot_params) + 4 * sizeof(unsigned long));
 static_assert(sizeof(struct mk_spawn_context) == 2 * PAGE_SIZE);
 
 /* Pool park loop code, copied by the host into per-instance park pages */
@@ -163,7 +166,8 @@ void mk_set_spawn_context(struct mk_spawn_context *ctx,
 int mk_spawn_cpu(struct mk_instance *instance, int cpu,
 		 struct mk_spawn_context *ctx);
 
-/* Initialize boot context tracking in spawn kernel */
+/* Validate and initialize boot context tracking in spawn kernel */
+struct mk_spawn_context *mk_validate_boot_context(phys_addr_t ctx_phys);
 void mk_init_boot_context(phys_addr_t ctx_phys);
 
 /* Identity page table and trampoline setup */

arch/x86/include/uapi/asm/bootparam.h

@@ -25,6 +25,7 @@
 #define XLF_5LEVEL			(1<<5)
 #define XLF_5LEVEL_ENABLED		(1<<6)
 #define XLF_MEM_ENCRYPTION		(1<<7)
+#define XLF_MULTIKERNEL_IPI		0x0100
 
 #ifndef __ASSEMBLER__
 

arch/x86/kernel/kexec-bzimage64.c

@@ -554,6 +554,11 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
 				  .buf_max = ULONG_MAX, .top_down = true };
 
 	header = (struct setup_header *)(kernel + setup_hdr_offset);
+	if (image->type == KEXEC_TYPE_MULTIKERNEL &&
+	    !(header->xloadflags & XLF_MULTIKERNEL_IPI)) {
+		pr_err("Loaded kernel lacks the required shared transport layout\n");
+		return ERR_PTR(-EPROTONOSUPPORT);
+	}
 	setup_sects = header->setup_sects;
 	if (setup_sects == 0)
 		setup_sects = 4;

arch/x86/kernel/kexec-vmlinux.c

@@ -60,6 +60,12 @@ struct elf_kernel_info {
 	unsigned long reloc_size;   /* Size of relocation data */
 };
 
+struct mk_elf_note_desc {
+	u64 entry;
+	u32 ipi_abi_version;
+	u32 reserved;
+};
+
 /*
  * Find multikernel entry point from PT_NOTE section.
  * Looks for note with name "Linux" and type 0x4d4b ('MK').
@@ -93,12 +99,20 @@ static unsigned long find_multikernel_entry_note(const void *buf, size_t len,
 
 			if (nhdr->n_type == 0x4d4b &&
 			    nhdr->n_namesz == 6 &&
-			    nhdr->n_descsz == sizeof(u64) &&
+			    nhdr->n_descsz == sizeof(struct mk_elf_note_desc) &&
 			    !memcmp(ptr + sizeof(*nhdr), "Linux", 6)) {
-				u64 entry = *(u64 *)(ptr + sizeof(*nhdr) +
-						     ALIGN(nhdr->n_namesz, 4));
-				pr_info("multikernel: entry=0x%llx\n", entry);
-				return entry;
+				const struct mk_elf_note_desc *desc;
+
+				desc = ptr + sizeof(*nhdr) +
+				       ALIGN(nhdr->n_namesz, 4);
+				if (desc->ipi_abi_version != MK_IPI_ABI_VERSION) {
+					pr_err("multikernel IPI ABI %u is not supported\n",
+					       desc->ipi_abi_version);
+					return 0;
+				}
+				pr_info("multikernel: entry=0x%llx, IPI ABI=%u\n",
+					desc->entry, desc->ipi_abi_version);
+				return desc->entry;
 			}
 			ptr += note_size;
 		}

arch/x86/kernel/platform-quirks.c

@@ -47,9 +47,9 @@ static void __init multikernel_setup_calibration(void)
 {
 	phys_addr_t ctx_phys = orig_boot_params -
 		offsetof(struct mk_spawn_context, bp);
-	struct mk_spawn_context *ctx = __va(ctx_phys);
+	struct mk_spawn_context *ctx = mk_validate_boot_context(ctx_phys);
 
-	if (ctx->self_phys != ctx_phys || !ctx->boot_tsc_khz)
+	if (!ctx || !ctx->boot_tsc_khz)
 		return;
 
 	multikernel_tsc_khz = ctx->boot_tsc_khz;

arch/x86/multikernel/head_64.S

@@ -16,6 +16,7 @@
 #include <linux/linkage.h>
 #include <linux/init.h>
 #include <linux/pgtable.h>
+#include <linux/multikernel_abi.h>
 #include <asm/segment.h>
 #include <asm/page.h>
 #include <asm/msr.h>
@@ -273,4 +274,6 @@ SYM_CODE_END(multikernel_secondary_startup)
 1:	.asciz	"Linux"
 2:	.balign 4
 3:	.quad	multikernel_startup_64 - __START_KERNEL_map
+	.long	MK_IPI_ABI_VERSION
+	.long	0
 4:	.balign 4

arch/x86/multikernel/spawn.c

@@ -71,6 +71,7 @@
 
 /* Set in spawn kernels: the context this kernel booted from */
 static struct mk_spawn_context *mk_boot_context;
+static phys_addr_t mk_boot_context_phys;
 
 /*
  * Spawn kernel's own trampoline for secondary CPU wakeup.
@@ -84,6 +85,16 @@ static struct mk_spawn_context *mk_boot_context;
  */
 static void *spawn_trampoline_va;
 static unsigned long spawn_trampoline_phys;
+static bool spawn_trampoline_prepared;
+static bool spawn_pool_park_prepared;
+static bool spawn_park_ready;
+static int spawn_park_error;
+
+bool mk_arch_park_ready(void)
+{
+	/* Pair with publication after both executable park mappings succeed. */
+	return smp_load_acquire(&spawn_park_ready);
+}
 
 extern char multikernel_relocate_kernel_start[];
 extern char multikernel_relocate_kernel_end[];
@@ -471,6 +482,7 @@ int mk_arch_spawn_instance(struct kimage *image, struct mk_instance *instance,
 	instance->spawn_ctx->boot_tsc_khz = tsc_khz;
 	instance->spawn_ctx->boot_apic_hz =
 		(unsigned long)lapic_timer_period * HZ;
+	instance->spawn_ctx->abi_magic = MK_BOOT_CONTEXT_MAGIC;
 
 	return mk_spawn_cpu(instance, cpu, instance->spawn_ctx);
 }
@@ -693,18 +705,38 @@ void __init mk_arch_register_cpu(u64 phys_id)
 	topology_register_apic((u32)phys_id, CPU_ACPIID_INVALID, true);
 }
 
-/*
- * Initialize boot context tracking in spawn kernel.
- * Called early during spawn kernel boot.
- */
-void mk_init_boot_context(phys_addr_t ctx_phys)
+static __noreturn void mk_reject_spawn_context(void)
+{
+	/*
+	 * The host context layout is unknown, so neither its park state nor any
+	 * shared context field is safe to use. Keep this CPU local and inert. An NMI
+	 * can wake HLT, but returns to this loop with maskable interrupts still
+	 * disabled; disable them again before every halt for defense in depth.
+	 */
+	for (;;) {
+		native_irq_disable();
+		native_halt();
+	}
+}
+
+struct mk_spawn_context *mk_validate_boot_context(phys_addr_t ctx_phys)
 {
 	struct mk_spawn_context *ctx;
+	phys_addr_t stamped_phys;
+	u64 abi_magic;
 
 	if (!ctx_phys) {
 		pr_err("mk_spawn: Boot context physical address is 0!\n");
-		return;
+		return NULL;
 	}
+	if (mk_boot_context) {
+		if (ctx_phys != mk_boot_context_phys)
+			mk_reject_spawn_context();
+		return mk_boot_context;
+	}
+	/* Reject an invalid derived address before mapping or dereferencing it. */
+	if (!IS_ALIGNED(ctx_phys, PAGE_SIZE))
+		mk_reject_spawn_context();
 
 	/*
 	 * The spawn context is in the multikernel pool which is regular RAM,
@@ -721,14 +753,28 @@ void mk_init_boot_context(phys_addr_t ctx_phys)
 	 * work and then fails much later, when this kernel shuts down and
 	 * its CPUs park on nonsense addresses.
 	 */
-	if (ctx->self_phys != ctx_phys) {
-		pr_err("mk_spawn: Boot context at %pa is stamped %pa\n",
-		       &ctx_phys, &ctx->self_phys);
-		pr_err("mk_spawn: Spawn context layout mismatch - host and spawn kernels must be built from the same source\n");
-		return;
-	}
-
+	stamped_phys = READ_ONCE(ctx->self_phys);
+	if (stamped_phys != ctx_phys)
+		mk_reject_spawn_context();
+	abi_magic = READ_ONCE(ctx->abi_magic);
+	if (abi_magic != MK_BOOT_CONTEXT_MAGIC)
+		mk_reject_spawn_context();
+
+	mk_boot_context_phys = ctx_phys;
 	mk_boot_context = ctx;
+	return ctx;
+}
+
+/*
+ * Initialize boot context tracking in spawn kernel.
+ * Called early during spawn kernel boot.
+ */
+void mk_init_boot_context(phys_addr_t ctx_phys)
+{
+	struct mk_spawn_context *ctx = mk_validate_boot_context(ctx_phys);
+
+	if (!ctx)
+		return;
 	/*
 	 * A spawn kernel cannot calibrate against legacy timers because they
 	 * belong to the host. Reuse the selected physical CPU's delay and local
@@ -764,52 +810,74 @@ void mk_init_boot_context(phys_addr_t ctx_phys)
  *
  * One physical page serves every wake path of this instance: the host
  * allocates it once in mk_setup_trampoline() and reuses it across
- * re-spawns, and mk_prepare_trampoline() places our own trampoline copy
+ * re-spawns, and mk_arch_prepare_park() places our own trampoline copy
  * (including the secondary entry) in the same page.
  */
-static int __init mk_prepare_trampoline(void)
+int __init mk_arch_prepare_park(void)
 {
 	struct mk_spawn_context *ctx = mk_boot_context;
 	unsigned long virt;
 	int ret;
 
+	if (mk_arch_park_ready())
+		return 0;
+	if (spawn_park_error)
+		return spawn_park_error;
 	if (!ctx)
 		return 0;
+	if (!ctx->trampoline_phys || !ctx->park_phys || !ctx->park_cr3) {
+		ret = -EINVAL;
+		goto fail;
+	}
 
 	/*
 	 * Put our own copy of the trampoline in the page the host set
 	 * aside, while the kernel is fully alive: after shutdown this page
 	 * is entered from an offline CPU, where changing page attributes
 	 * is not allowed.
 	 */
-	spawn_trampoline_phys = ctx->trampoline_phys;
-	spawn_trampoline_va = __va(spawn_trampoline_phys);
-	memcpy(spawn_trampoline_va, multikernel_relocate_kernel_start,
-	       multikernel_relocate_kernel_end - multikernel_relocate_kernel_start);
+	if (!spawn_trampoline_prepared) {
+		spawn_trampoline_phys = ctx->trampoline_phys;
+		spawn_trampoline_va = __va(spawn_trampoline_phys);
+		memcpy(spawn_trampoline_va, multikernel_relocate_kernel_start,
+		       multikernel_relocate_kernel_end -
+		       multikernel_relocate_kernel_start);
 
-	/*
-	 * Both pages are executed from the direct map, which is writable,
-	 * so drop write before adding execute. Leaving them writable and
-	 * executable trips the kernel's own W^X check.
-	 */
-	virt = (unsigned long)spawn_trampoline_va & PAGE_MASK;
-	ret = set_memory_ro(virt, 1);
-	if (!ret)
-		ret = set_memory_x(virt, 1);
-	if (ret)
-		return ret;
+		/*
+		 * Both pages are executed from the direct map, which is writable,
+		 * so drop write before adding execute. Leaving them writable and
+		 * executable trips the kernel's own W^X check.
+		 */
+		virt = (unsigned long)spawn_trampoline_va & PAGE_MASK;
+		ret = set_memory_ro(virt, 1);
+		if (!ret)
+			ret = set_memory_x(virt, 1);
+		if (ret)
+			goto fail;
+		spawn_trampoline_prepared = true;
+	}
 
 	/* The pool park page is entered the same way when this kernel dies */
-	if (ctx->park_phys) {
+	if (!spawn_pool_park_prepared) {
 		virt = (unsigned long)__va(ctx->park_phys) & PAGE_MASK;
 		ret = set_memory_ro(virt, 1);
 		if (!ret)
 			ret = set_memory_x(virt, 1);
+		if (ret)
+			goto fail;
+		spawn_pool_park_prepared = true;
 	}
 
+	/* Publish executable mappings before any reject or abort can park. */
+	smp_store_release(&spawn_park_ready, true);
+	return 0;
+
+fail:
+	/* A partial W^X transition is not safe to retry. */
+	spawn_park_error = ret;
 	return ret;
 }
-early_initcall(mk_prepare_trampoline);
+early_initcall(mk_arch_prepare_park);
 
 /*
  * Add a 2MB executable mapping to a page table.