arm64 port tracking issue #21

Tracking issue for porting multikernel to arm64.

Evaluation summary

On x86, arch/x86/multikernel/ (~2,800 lines) is almost entirely a software CPU lifecycle: relocate/secondary trampolines, an MMU-on park loop with private GDT/IDT, identity page tables, head_64.S scrubbing inherited CR4/EFER/GS state, and the repark/confirm-parked bookkeeping. It exists because x86 has no firmware-mediated CPU control after boot, and it is where the hardest bugs have lived.

On arm64 EL3 firmware owns CPU state through PSCI, and Linux already wraps it (cpu_psci_ops):

• The pool is the PSCI OFF state: a parked CPU executes nothing.
• The boot trampoline is CPU_ON(mpidr, entry, dtb): it produces exactly the entry state head.S requires. No arm64 direct_boot.S, no head_64.S.
• Spawn secondaries come up through stock cpu_psci_cpu_boot(); halt returns them with cpu_off(); confirm-parked is AFFINITY_INFO == OFF.
• Timer calibration handoff disappears (CNTFRQ_EL0 is firmware-set, CNTPCT is global).

The difficulty moves to the interrupt controller: GICv3 has one distributor (stock gic_dist_init() would reset host SPIs) and one ITS command queue per ITS (a spawn cannot map its own MSIs). Those two, plus synthesizing the instance DTB on ACPI hosts, are the bulk of the work and the only places a port can break the host.

Tasks, in dependency order

Foundation

• arm64 prep: remove x86-isms from generic multikernel core #8 remove x86-isms from the generic core
• arm64: Kconfig, asm/multikernel.h and arch stubs #9 Kconfig, asm/multikernel.h, arch stubs (links with CONFIG_MULTIKERNEL=y)

CPU lifecycle (small, low risk)

• arm64: PSCI-based spawn, confirm-parked and release #10 PSCI spawn / confirm-parked / release
• arm64 spawn: halt/restart must CPU_OFF every CPU, secondaries via stock PSCI #11 spawn halt must CPU_OFF every CPU
• arm64: KEXEC_TYPE_MULTIKERNEL Image loader, placement in the grant, PoC cleaning #12 KEXEC_TYPE_MULTIKERNEL Image loader + PoC cleaning

Boot data and messaging

• arm64: instance DTB synthesis (ACPI host) and filtering (DT host) #13 instance DTB synthesis (ACPI host first, DT filtering second)
• arm64: multikernel doorbell SGI (IPI_MULTIKERNEL) and foreign-SGI filtering #14 doorbell SGI

Milestone A: device-less spawn boots on its own CPUs and memory, exchanges ring messages with the host, halts gracefully, re-spawns.

Interrupts (highest risk)

• arm64: GICv3 tenant mode (no distributor init, restricted SPI domain) #15 GICv3 tenant mode
• arm64: host-proxied ITS for MSI/LPI delivery to spawn kernels #16 host-proxied ITS for MSI/LPI

Milestone B: a PCIe device (virtio-pci on QEMU, NIC/NVMe on hardware) works in a spawn.

Robustness and isolation

• arm64: forced halt via SDEI, pseudo-NMI SGI, plain SGI fallback #17 forced halt (SDEI / pseudo-NMI / SGI)
• arm64: SMMU bypass / stage-2 containment for devices assigned to a spawn #18 SMMU bypass / stage-2 containment

Optional

• arm64: spin-table fallback park loop for platforms without PSCI #19 spin-table fallback for platforms without PSCI

Infrastructure

• arm64: QEMU virt + TF-A test environment, kerf support and docs #20 QEMU virt + TF-A environment, kerf support, docs

First target: QEMU virt with TF-A (secure=on,gic-version=3,its=on), then an SBSA server (Neoverse: PSCI + GICv3 + ITS + ECAM + TF-A/SDEI).