multikernel: serialize lifecycle operations and retain uncertain resources

arch/x86/Kconfig

@@ -2029,6 +2029,9 @@ config ARCH_SUPPORTS_MULTIKERNEL
 config ARCH_HAS_MK_HOST_PARK
 	def_bool X86_64
 
+config ARCH_HAS_MK_FORCE_STOP
+	def_bool X86_64
+
 config ARCH_SUPPORTS_CRASH_DUMP
 	def_bool X86_64 || (X86_32 && HIGHMEM)
 

arch/x86/include/asm/multikernel.h

@@ -8,6 +8,13 @@
 #define MK_SPAWN_F_SECONDARY	BIT(0)	/* Secondary CPU joining existing kernel */
 #define MK_SPAWN_F_REPARK	BIT(1)	/* Move the CPU to another park slot */
 
+/* Shared C/assembly protocol. All participating kernels must use it. */
+#define MK_SLOT_IDLE		0
+#define MK_SLOT_PENDING		1
+#define MK_SLOT_BUSY		2
+#define MK_SLOT_ACK		3
+#define MK_SLOT_QUARANTINED	4
+
 #ifndef __ASSEMBLY__
 
 #include <linux/build_bug.h>
@@ -126,7 +133,7 @@ struct mk_spawn_context {
 	unsigned long ctrl_size;	/* park page, page tables. Spawn must not reuse it */
 	u32 target_apic_id;		/* Target CPU's APIC ID */
 	u32 flags;			/* MK_SPAWN_F_* flags */
-	u32 ready;			/* Signal flag */
+	u32 ready;			/* MK_SLOT_* state, not a boolean */
 	u32 reserved;			/* Padding for alignment */
 	/* Keep all existing context offsets unchanged. */
 	struct boot_params bp;		/* Standard x86 boot params */
@@ -184,12 +191,12 @@ struct mk_spawn_context *mk_alloc_spawn_context(struct mk_instance *instance,
 struct boot_params *mk_spawn_context_boot_params(struct mk_spawn_context *ctx);
 
 /* Set up spawn context for kernel boot */
-void mk_set_spawn_context(struct mk_spawn_context *ctx,
-			  unsigned long identity_cr3,
-			  unsigned long kernel_entry,
-			  unsigned long trampoline_virt,
-			  unsigned long trampoline_phys,
-			  unsigned long park_phys);
+int mk_set_spawn_context(struct mk_spawn_context *ctx,
+			 unsigned long identity_cr3,
+			 unsigned long kernel_entry,
+			 unsigned long trampoline_virt,
+			 unsigned long trampoline_phys,
+			 unsigned long park_phys);
 
 /* Trigger spawn on a pool CPU */
 int mk_spawn_cpu(struct mk_instance *instance, int cpu,

arch/x86/kernel/kexec-bzimage64.c

@@ -752,12 +752,14 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
 		goto out_free_params;
 
 	/* For multikernel, setup custom e820 map */
+#ifdef CONFIG_MULTIKERNEL
 	if (image->type == KEXEC_TYPE_MULTIKERNEL) {
 		image->arch.mk_boot_params = bootparam_load_addr;
 		ret = mk_e820_fill(image->mk_instance, params);
 		if (ret)
 			goto out_free_params;
 	}
+#endif
 
 	/* Allocate loader specific data */
 	ldata = kzalloc_obj(struct bzimage64_data);

arch/x86/multikernel/direct_boot.S

@@ -322,7 +322,7 @@ SYM_CODE_START_LOCAL_NOALIGN(mk_park_identity)
 
 .Lpark_wait:
 	movl	MK_CTX_ready(%r12), %eax
-	cmpl	$1, %eax
+	cmpl	$MK_SLOT_PENDING, %eax
 	je	.Lpark_pending
 
 	testq	%r15, %r15
@@ -334,7 +334,7 @@ SYM_CODE_START_LOCAL_NOALIGN(mk_park_identity)
 	xorl	%edx, %edx
 	monitor
 	movl	MK_CTX_ready(%r12), %eax
-	cmpl	$1, %eax
+	cmpl	$MK_SLOT_PENDING, %eax
 	je	.Lpark_pending
 	xorl	%eax, %eax
 	xorl	%ecx, %ecx
@@ -346,17 +346,24 @@ SYM_CODE_START_LOCAL_NOALIGN(mk_park_identity)
 	jmp	.Lpark_wait
 
 .Lpark_pending:
-	/* Wakeup published; is it for us? */
+	/* Advisory filter only; recheck after claiming the current publication. */
 	movl	MK_CTX_target_apic_id(%r12), %eax
 	cmpl	%r13d, %eax
 	jne	.Lpark_relax
 
 	/*
-	 * Copy the publication into registers BEFORE claiming: once the
-	 * claim clears ready, the publisher may reuse the slot for the
-	 * next CPU. The claim (lock cmpxchg) makes exactly one of
-	 * waker-revoke and us win; on loss the staged values are dropped.
+	 * Claim before authoritative reads. A reader delayed across slot reuse
+	 * can claim a newer publication, but then must re-read its target and
+	 * every dispatch field. BUSY prevents writes while registers are staged.
 	 */
+	movl	$MK_SLOT_PENDING, %eax
+	movl	$MK_SLOT_BUSY, %ebp
+	lock cmpxchgl %ebp, MK_CTX_ready(%r12)
+	jnz	.Lpark_wait
+	movl	MK_CTX_target_apic_id(%r12), %eax
+	cmpl	%r13d, %eax
+	jne	.Lpark_wrong_target
+
 	movl	MK_CTX_flags(%r12), %r11d
 	testl	$MK_SPAWN_F_REPARK, %r11d
 	jnz	.Lpark_repark
@@ -375,8 +382,8 @@ SYM_CODE_START_LOCAL_NOALIGN(mk_park_identity)
 	addq	$MK_CTX_bp, %rsi
 	movq	MK_CTX_kernel_entry(%r12), %rdx
 	movq	MK_CTX_trampoline_phys(%r12), %r8
-	movl	$1, %eax
-	xorl	%ebp, %ebp
+	movl	$MK_SLOT_BUSY, %eax
+	movl	$MK_SLOT_ACK, %ebp
 	lock cmpxchgl %ebp, MK_CTX_ready(%r12)
 	jnz	.Lpark_wait
 	movq	%r8, %rcx
@@ -395,8 +402,8 @@ SYM_CODE_START_LOCAL_NOALIGN(mk_park_identity)
 	movq	MK_CTX_stack(%r12), %rcx
 	movq	MK_CTX_secondary_trampoline_phys(%r12), %r8
 	movq	MK_CTX_spawn_cr3(%r12), %r9
-	movl	$1, %eax
-	xorl	%ebp, %ebp
+	movl	$MK_SLOT_BUSY, %eax
+	movl	$MK_SLOT_ACK, %ebp
 	lock cmpxchgl %ebp, MK_CTX_ready(%r12)
 	jnz	.Lpark_wait
 	ANNOTATE_RETPOLINE_SAFE
@@ -414,12 +421,15 @@ SYM_CODE_START_LOCAL_NOALIGN(mk_park_identity)
 	 * The repark_* dispatch fields are separate from the park_phys/
 	 * park_cr3/self_phys anchor so that publishing a repark on a live
 	 * instance context never corrupts the context's own park identity.
+	 * ACK below proves only staged dispatch. Before retiring this page or
+	 * its page table the publisher must obtain a second claim from the
+	 * destination loop, which cannot run until the jump below completes.
 	 */
 	movq	MK_CTX_repark_park_cr3(%r12), %r14
 	movq	MK_CTX_repark_park_phys(%r12), %rcx
 	movq	MK_CTX_repark_slot_phys(%r12), %r10
-	movl	$1, %eax
-	xorl	%ebp, %ebp
+	movl	$MK_SLOT_BUSY, %eax
+	movl	$MK_SLOT_ACK, %ebp
 	lock cmpxchgl %ebp, MK_CTX_ready(%r12)
 	jnz	.Lpark_wait
 	movq	%r10, %r12
@@ -430,6 +440,13 @@ SYM_CODE_START_LOCAL_NOALIGN(mk_park_identity)
 	addq	$mk_park_identity - mk_pool_park, %rcx
 	ANNOTATE_RETPOLINE_SAFE
 	jmp	*%rcx
+
+.Lpark_wrong_target:
+	/* A newer request belongs to another CPU; never undo quarantine. */
+	movl	$MK_SLOT_BUSY, %eax
+	movl	$MK_SLOT_PENDING, %ebp
+	lock cmpxchgl %ebp, MK_CTX_ready(%r12)
+	jmp	.Lpark_wait
 SYM_CODE_END(mk_park_identity)
 
 /*