riscv: implement multikernel lifecycle and safe shutdown

Documentation/multikernel/device-tree.rst

@@ -80,6 +80,7 @@ back the pool::
         #address-cells = <2>;
         #size-cells = <2>;
         id = <0>;
+        memory-granule = <0x0 0x400000>;
         resources {
             cpus = <0x0 0x1  0x0 0x2  0x0 0x3>;     /* every pool member */
             cpus-available = <0x0 0x2  0x0 0x3>;    /* the free subset */
@@ -91,16 +92,24 @@ back the pool::
             devices { ... };                        /* platform devices only */
         };
         aliases {
-            enp9s0 = "/pci@0/pci@3,0/pci@0,0";
+            enp9s0 = "/pci@0,9/pci@0,0";
         };
-        pci@0 { ... };                              /* see Devices below */
+        pci@0,9 { ... };                            /* see Devices below */
     };
 
 ``cpus`` lists every CPU the pool owns, including CPUs lent to instances;
 ``cpus-available`` lists the free ones. There is one ``memory@<base>`` node
 per pool chunk in the standard memory node form. Free pool PCI devices
 appear under their host bridge.
 
+``memory-granule`` is the unit memory moves into or out of the kernel
+reading the tree in: the base and size of a pool chunk, or of memory added
+to or removed from the kernel at run time, are multiples of it. Every
+kernel's own ``/sys/fs/multikernel/device_tree`` carries it, a spawn
+kernel's included, and an instance tree does not, as it describes another
+kernel. It covers whole MAX_PAGE_ORDER blocks, 4M on x86, as the buddy
+allocator merges free pages across them.
+
 The Instance Tree
 =================
 
@@ -120,54 +129,55 @@ instance owns. The root is the instance, named by ``model``::
             devices { ... };                        /* platform devices only */
         };
         aliases {
-            enp9s0 = "/pci@0/pci@3,0/pci@0,0";
+            enp9s0 = "/pci@0,9/pci@0,0";
         };
-        pci@0 { ... };
+        pci@0,9 { ... };
     };
 
 Devices
 =======
 
 PCI devices are described where the devicetree PCI bus binding puts them:
-under the bus they sit on. One node per root bus the instance reaches,
-then one node per bridge on the way down, then the device as a leaf::
+under the bus they sit on. Each bus that holds a device of the instance is
+a root bus of its own, with the instance's devices on it as leaves and
+nothing else. The bridges above it are not described: they belong to the
+kernel that writes the tree, which keeps driving them::
 
-    pci@0 {
+    pci@0,9 {                                       /* domain 0, bus 9 */
         compatible = "multikernel,pci-host-bridge";
         device_type = "pci";
         #address-cells = <3>;
         #size-cells = <2>;
         linux,pci-domain = <0>;
-        bus-range = <0x0 0xff>;
-        reg = <0x0 0xb0000000  0x0 0x10000000>;    /* ECAM window, when known */
-        ranges = <0x01000000 0x0 0x0  0x0 0x0  0x0 0xcf8      /* I/O */
-                  0x02000000 0x0 0x80000000  0x0 0x80000000  0x0 0x30000000
-                  ...>;
-        pci@3,0 {                                   /* a bridge on the path */
-            device_type = "pci";
-            #address-cells = <3>;
-            #size-cells = <2>;
-            reg = <0x00001800 0 0 0 0>;             /* bus 0, device 3, fn 0 */
-            bus-range = <0x9 0x9>;
-            pci@0,0 {                               /* the device */
-                reg = <0x00090000 0 0 0 0>;         /* bus 9, device 0, fn 0 */
-                vendor-id = <0x1af4>;
-                device-id = <0x1041>;
-            };
+        bus-range = <0x9 0x9>;
+        reg = <0x0 0xb0900000  0x0 0x100000>;       /* the bus's ECAM, when known */
+        ranges = <0x02000000 0x0 0xfe800000  0x0 0xfe800000  0x0 0x200000
+                  0x43000000 0x0 0xfc800000  0x0 0xfc800000  0x0 0x200000>;
+        pci@0,0 {                                   /* the device */
+            reg = <0x00090000 0 0 0 0>;             /* bus 9, device 0, fn 0 */
+            vendor-id = <0x1af4>;
+            device-id = <0x1041>;
         };
     };
 
-The unit address of a device or bridge is ``device,function`` in hex and
-its ``reg`` encodes bus, device and function in the first cell as the
-binding prescribes, so ``pci_set_of_node()`` finds it by devfn under its
-bus. ``ranges`` uses the standard 7-cell PCI encoding. ``reg`` on a host
-bridge is its ECAM window; a spawn kernel installs it so that any domain
-and extended config space are reachable, and falls back to port ``0xCF8``
-for domain 0 without one.
-
-The path down comes from the bus structures of the kernel that writes the
-tree, so a device that has been detached from that kernel is still placed
-correctly.
+Bus, device and function numbers are the real ones, so a device has the
+same address in every kernel. The unit address of a device is
+``device,function`` in hex and its ``reg`` encodes bus, device and function
+in the first cell as the binding prescribes, so ``pci_set_of_node()`` finds
+it by devfn under its bus. ``ranges`` uses the standard 7-cell PCI encoding
+and holds the windows of the bridge above the bus, or of the host bridge
+for a root bus, which cover the BARs of every device on it.
+
+A PCI function handed to a running spawn comes with the same description
+of its bus, and the spawn adds the nodes it would have booted with: the
+device under its bus, and the bus as a root bus of its own when the
+spawn has none.
+
+``reg`` is the ECAM window of the bus, as in the generic ECAM host bridge
+binding. A spawn kernel does not use it while the kernel that lent the
+devices is alive: it reaches their config space through that kernel, over
+the message ring, and goes to the window only once it has fenced that
+kernel.
 
 Platform devices stay under ``/resources/devices`` as nodes with
 ``device-type = "platform"`` and ``device-name`` or ``acpi-hid``.
@@ -216,11 +226,11 @@ everything else read the tree through the usual ``of_*`` helpers.
 What a spawn does with its tree:
 
 * creates a PCI root bus per ``multikernel,pci-host-bridge`` node, with
-  the node's bus range, windows and ECAM;
+  the node's bus range and windows, whose config space it asks the host
+  for;
 * probes a PCI slot only when the bus's node has a child at that devfn,
-  which admits the bridges on the path and nothing else on the shared
-  fabric, and registers a platform device only when a
-  ``/resources/devices`` node names it;
+  which admits nothing else on the shared fabric, and registers a
+  platform device only when a ``/resources/devices`` node names it;
 * binds every bus and device to its node, so ``dev->of_node`` is set as on
   any devicetree platform;
 * names network devices from ``/aliases``.

Documentation/multikernel/overlays.rst

@@ -234,6 +234,7 @@ kernel that manages a pool, its ``/resources`` node describes the pool::
         #address-cells = <2>;
         #size-cells = <2>;
         id = <0>;
+        memory-granule = <0x0 0x400000>;
         resources {
             cpus = <...>;                       /* every pool member */
             cpus-available = <...>;             /* the free subset */
@@ -248,6 +249,8 @@ kernel that manages a pool, its ``/resources`` node describes the pool::
         pci@0 { ... };                          /* free pool PCI devices */
     };
 
+``memory-granule`` is what the base and size of a ``memory-add`` or
+``memory-remove`` item for this kernel must be multiples of.
 ``cpus`` lists every CPU the pool owns, including CPUs currently lent to
 instances; ``cpus-available`` lists only the free ones. There is one
 ``memory@<base>`` node per pool chunk, in the standard memory node form, and

Documentation/multikernel/riscv-lifecycle.rst

@@ -0,0 +1,61 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+RISC-V lifecycle and entry cache maintenance
+==========================================
+
+The #23--#25 series requires SBI HSM and supervisor-mode rv64 multikernel
+kernels. It does not provide the #26 Image loader, #27 boot-tree CPU/intc
+description or #28 parent doorbell/panic-notification transport. Generic
+controller serialization and confirmed-stop retirement are separate master
+prerequisites. Force-stop is unsupported on RISC-V and must fail closed.
+
+Both host and spawn must use kernels with ``CONFIG_BUILTIN_DTB=n`` and
+``CONFIG_RISCV_BOOT_SPINWAIT=n``; Kconfig excludes multikernel otherwise.
+A built-in DTB replaces the supplied manifest before spawn detection, leaving
+host-wide reset setup enabled. Spinwait boot rejects physical hart IDs beyond
+``NR_CPUS`` and can leave a hart waiting in Image memory instead of HART_STOP.
+Ordered SBI HSM boot avoids that physical-ID bound. These checks constrain
+kernel builds, not arbitrary foreign Images loaded by the host.
+
+The host owns two adjacent control pages for the instance lifetime: a mutable
+entry record followed by immutable entry code. Before each start, the host
+copies the Image and writes the current entry, then publishes those stores
+before HART_START. The copied stub executes fence.i, finds the preceding page
+from its PC, reads the entry and jumps without modifying a0 (physical hartid)
+or a1 (primary boot tree or secondary SBI boot data). The code uses neither an
+embedded mutable entry immediate nor an absolute relocation target.
+
+A fence.i at the start of a newly copied code page alone is insufficient: the
+first instruction fetch can see an earlier occupant of that physical page.
+Every assigned hart first runs mk_riscv_entry_fence_stop in immutable, reserved
+host text, executes fence.i and HART_STOP. The host confirms STOPPED before
+starting the copied stub. Linux pool entry also fences before HART_STOP. This
+is a first-fetch priming handshake, not an assumption that a stopped hart can
+service a remote-fence request. Host text must stay reserved and unchanged.
+
+Using SBI's opaque argument for an entry record would put that record in a1;
+an alternative must recover the boot-tree/secondary argument before entry and
+still avoid fetching recycled code before a local fence.i. The adjacent-page
+design preserves the firmware boot arguments directly. Secondary entry updates
+the record through memremap, so a no-map control reservation need not be in the
+spawn linear map. The child must reserve all host-owned control pages (#27).
+
+On the modern foundation, a1 names the execution-time 256KB instance manifest,
+not a separate load-time clone of the host DTB. Manifest and ring pages are
+persistent host allocations outside the Image grant. #27 must emit assigned
+hart/intc nodes, initrd/boot arguments and the required no-map reservations in
+that boot tree. Reclaim is allowed only after every assigned/tracked hart is
+confirmed stopped. A timeout, failed query or STOP_PENDING cannot authorize
+reuse; a STOPPED observation does not cancel outstanding remote start work.
+
+Requested and voluntary shutdown, reboot and panic stop local harts with HSM;
+spawn reset must never reach SRST or legacy shutdown. With panic_timeout=0,
+the spawn panic notifier halts immediately rather than leaving the panic CPU
+in the generic infinite wait loop. With a nonzero timeout, the notifier returns
+to the generic panic path: positive values delay restart, while negative values
+restart without that delay. The spawn restart override stops locally in either
+case; it must not reset the host. Parent notification is a separate #28 concern.
+An unexpected HART_STOP return leaves a local wait loop, so the host must fail
+confirmation and retain resources. Ring reset is not a remote-work retirement
+protocol and does not supply #7/session guarantees. Matched revisions and fresh
+QEMU/OpenSBI failure and replacement tests remain release gates.

arch/riscv/Kconfig

@@ -1094,6 +1094,9 @@ config ARCH_SUPPORTS_MULTIKERNEL
 	depends on KEXEC_FILE
 	depends on HOTPLUG_CPU
 	depends on !RISCV_M_MODE
+	# Spawn identity requires the supplied DTB and ordered HSM boot.
+	depends on !BUILTIN_DTB
+	depends on !RISCV_BOOT_SPINWAIT
 
 config ARCH_SUPPORTS_CRASH_DUMP
 	def_bool y

arch/riscv/include/asm/cpu_ops_sbi.h

@@ -12,6 +12,14 @@
 
 extern const struct cpu_operations cpu_ops_sbi;
 
+int sbi_hsm_hart_start(unsigned long hartid, unsigned long saddr,
+		       unsigned long priv);
+
+#ifdef CONFIG_HOTPLUG_CPU
+int sbi_hsm_hart_stop(void);
+int sbi_hsm_hart_get_status(unsigned long hartid);
+#endif
+
 /**
  * struct sbi_hart_boot_data - Hart specific boot used during booting and
  *			       cpu hotplug.

arch/riscv/include/asm/multikernel.h

@@ -36,17 +36,25 @@ static inline int arch_cpu_from_physical_id(u64 hartid)
  */
 #define MK_CTRL_BLOCK_SIZE	(SZ_64K + 2 * PAGE_SIZE)
 
-/*
- * Architecture-private spawn and park state is added with the SBI HSM
- * and Image loader support. The compile-only skeleton intentionally has
- * none.
- */
+struct mk_riscv_spawn_context {
+	unsigned long image_entry;
+};
+
+/* Per-instance state, allocated from the control block on first spawn. */
 struct mk_instance_arch {
+	struct mk_riscv_spawn_context *ctx;
+	phys_addr_t ctx_phys;
+	const void *stub;
+	phys_addr_t stub_phys;
 };
 
 struct mk_pool_arch {
 };
 
+extern char mk_riscv_entry_stub_start[];
+extern char mk_riscv_entry_stub_end[];
+extern char mk_riscv_entry_fence_stop[];
+
 #endif /* !__ASSEMBLY__ */
 
 #endif /* _ASM_RISCV_MULTIKERNEL_H */

arch/riscv/kernel/cpu_ops_sbi.c

@@ -5,8 +5,11 @@
  * Copyright (c) 2020 Western Digital Corporation or its affiliates.
  */
 
+#include <linux/cacheflush.h>
 #include <linux/init.h>
+#include <linux/io.h>
 #include <linux/mm.h>
+#include <linux/multikernel.h>
 #include <linux/sched/task_stack.h>
 #include <asm/cpu_ops.h>
 #include <asm/cpu_ops_sbi.h>
@@ -23,45 +26,90 @@ const struct cpu_operations cpu_ops_sbi;
  */
 static struct sbi_hart_boot_data boot_data[NR_CPUS];
 
-static int sbi_hsm_hart_start(unsigned long hartid, unsigned long saddr,
-			      unsigned long priv)
+static int sbi_hsm_err_map_linux_errno(long err)
+{
+	switch (err) {
+	case SBI_ERR_ALREADY_AVAILABLE:
+	case SBI_ERR_ALREADY_STARTED:
+	case SBI_ERR_ALREADY_STOPPED:
+		return -EALREADY;
+	case SBI_ERR_FAILURE:
+		return -EIO;
+	default:
+		return sbi_err_map_linux_errno(err);
+	}
+}
+
+int sbi_hsm_hart_start(unsigned long hartid, unsigned long saddr,
+		       unsigned long priv)
 {
 	struct sbiret ret;
 
 	ret = sbi_ecall(SBI_EXT_HSM, SBI_EXT_HSM_HART_START,
 			hartid, saddr, priv, 0, 0, 0);
 	if (ret.error)
-		return sbi_err_map_linux_errno(ret.error);
+		return sbi_hsm_err_map_linux_errno(ret.error);
 	else
 		return 0;
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
-static int sbi_hsm_hart_stop(void)
+int sbi_hsm_hart_stop(void)
 {
 	struct sbiret ret;
 
+	/* A stopped hart cannot receive the remote fence for its next entry. */
+	local_flush_icache_all();
 	ret = sbi_ecall(SBI_EXT_HSM, SBI_EXT_HSM_HART_STOP, 0, 0, 0, 0, 0, 0);
 
 	if (ret.error)
-		return sbi_err_map_linux_errno(ret.error);
+		return sbi_hsm_err_map_linux_errno(ret.error);
 	else
 		return 0;
 }
 
-static int sbi_hsm_hart_get_status(unsigned long hartid)
+int sbi_hsm_hart_get_status(unsigned long hartid)
 {
 	struct sbiret ret;
 
 	ret = sbi_ecall(SBI_EXT_HSM, SBI_EXT_HSM_HART_STATUS,
 			hartid, 0, 0, 0, 0, 0);
 	if (ret.error)
-		return sbi_err_map_linux_errno(ret.error);
+		return sbi_hsm_err_map_linux_errno(ret.error);
 	else
 		return ret.value;
 }
 #endif
 
+#ifdef CONFIG_MULTIKERNEL
+static int sbi_spawn_cpu_entry(unsigned long *boot_addr)
+{
+	struct mk_riscv_spawn_context *ctx;
+	phys_addr_t stub_addr;
+
+	if (!mk_spawned())
+		return 0;
+
+	stub_addr = mk_manifest_entry_stub_phys();
+	if (stub_addr < PAGE_SIZE || !IS_ALIGNED(stub_addr, PAGE_SIZE)) {
+		pr_err_once("SBI: invalid multikernel entry stub address %pa\n",
+			    &stub_addr);
+		return -EINVAL;
+	}
+
+	/* #27 reserves this host-owned data no-map; do not assume a linear map. */
+	ctx = memremap(stub_addr - PAGE_SIZE, PAGE_SIZE, MEMREMAP_WB);
+	if (!ctx)
+		return -ENOMEM;
+	WRITE_ONCE(ctx->image_entry, *boot_addr);
+	/* Publish the secondary entry before firmware can enter the stub. */
+	smp_wmb();
+	memunmap(ctx);
+	*boot_addr = stub_addr;
+	return 0;
+}
+#endif
+
 static int sbi_cpu_start(unsigned int cpuid, struct task_struct *tidle)
 {
 	unsigned long boot_addr = __pa_symbol(secondary_start_sbi);
@@ -73,6 +121,14 @@ static int sbi_cpu_start(unsigned int cpuid, struct task_struct *tidle)
 	smp_mb();
 	bdata->task_ptr = tidle;
 	bdata->stack_ptr = task_pt_regs(tidle);
+#ifdef CONFIG_MULTIKERNEL
+	{
+		int ret = sbi_spawn_cpu_entry(&boot_addr);
+
+		if (ret)
+			return ret;
+	}
+#endif
 	/* Make sure boot data is updated */
 	smp_mb();
 	hsm_data = __pa(bdata);