multikernel: add isolated SR-IOV VF assignment

Documentation/ABI/testing/multikernel

@@ -0,0 +1,84 @@
+What:		/sys/fs/multikernel/instances/<name>/stats
+Date:		August 2026
+Contact:	Nikolay Nikolaev <nicknickolaev@gmail.com>
+Description:
+		Read-only reliability snapshot for one multikernel instance.  The
+		format is one ``key value`` pair per line.  The first line is always
+		``stats_version 1``.  Versioned formats are append-only; readers must
+		ignore unknown keys.
+
+		The snapshot is observational, not atomic with concurrent producers.
+		Cumulative transport counters are unsigned 32-bit event counts and
+		wrap modulo 2^32.  They reset when the shared buffer is initialized
+		for a new ``spawn_epoch`` and cannot be reset through this file.
+		Compare deltas only between samples with the same nonzero epoch.
+		Gauges are unsigned point-in-time counts and have no reset operation.
+
+		Metadata keys (class; unit; meaning):
+
+		``stats_version`` (metadata; version; this file format, currently 1),
+		``abi_version`` (metadata; version; exact shared transport ABI),
+		``snapshot_atomic`` (metadata; boolean; always 0),
+		``transport_counter_bits`` (metadata; bits; always 32),
+		``transport_available`` (gauge; boolean; shared buffer is mapped), and
+		``spawn_epoch`` (metadata; launch identifier; changes on each start).
+
+		``abi_version`` identifies the exact private kernel-to-kernel transport
+		contract used by the running instance.  Exposing it here supports
+		diagnostics; it is not a stable userspace ABI or a compatibility promise
+		between transport versions.
+
+		Ordered IPI keys (class; unit; increment or sampled condition; reset):
+
+		The duplex transport serializes each direction with a local spinlock and
+		publishes a single shared READY bit. Consequently
+		``ipi.producer_contention``, ``ipi.invalid_state``,
+		``ipi.cancelled_writes``, ``ipi.gate_busy``, ``ipi.slot_writing``,
+		``ipi.slot_consuming``, and ``ipi.slot_cancelled`` remain zero. They are
+		retained in version 1 for reader compatibility.
+
+		``ipi.producer_contention`` (compatibility counter; always zero),
+		``ipi.full_failures`` (counter; sends; either direction's head slot
+		prevented publication; new epoch),
+		``ipi.invalid_state`` and ``ipi.cancelled_writes`` (compatibility
+		counters; always zero), ``ipi.gate_busy`` and ``ipi.slot_writing``
+		(compatibility gauges; always zero), ``ipi.slot_ready`` (gauge; READY
+		slots summed across both directions; sampled), and
+		``ipi.slot_consuming`` and ``ipi.slot_cancelled`` (compatibility gauges;
+		always zero).
+
+		Direct reply keys (class; unit; increment or sampled condition; reset):
+
+		``reply.late_replies`` (counter; replies; stale exact-token claim or
+		completion was rejected; new epoch), ``reply.cancelled_slots``
+		(counter; slots; timeout
+		cancelled RESERVED/WRITING; new epoch), ``reply.atomic_timeouts``
+		(counter; waits; bounded atomic wait expired in cancellable
+		RESERVED/WRITING or indeterminate EXECUTING state; new epoch),
+		``reply.indeterminate_timeouts`` (counter; waits; subset where
+		EXECUTING won and changed to COMMITTED; new epoch),
+		``reply.occupied_failures`` (counter;
+		reservations; no FREE slot; new epoch), ``reply.slot_busy`` (gauge;
+		slots; state is not FREE; sampled), ``reply.slot_reserved`` (gauge;
+		slots; RESERVED; sampled), ``reply.slot_writing`` (gauge; slots;
+		WRITING; sampled), ``reply.slot_executing`` (gauge; slots; EXECUTING;
+		sampled), ``reply.slot_committed`` (gauge; slots; COMMITTED; sampled),
+		``reply.slot_ready`` (gauge; slots; READY; sampled), and
+		``reply.slot_abandoned`` (gauge; slots; ABANDONED; sampled).
+
+		Pending IRQ keys (class; unit; increment or sampled condition; reset):
+
+		``irq.recorded`` (counter; IRQs; pending count recorded; new epoch),
+		``irq.coalesced`` (counter; IRQs; recorded onto an already-pending
+		slot; new epoch), ``irq.masked_deferred`` (counter; IRQs; delivery
+		deferred while logically masked; new epoch), ``irq.stale`` (counter;
+		observations; epoch/generation/route validation rejected work; new
+		epoch), ``irq.dispatch_failed`` (counter; IRQs; validated local dispatch
+		failed; new epoch), ``irq.saturated`` (counter; IRQs; pending count hit
+		its representable limit; new epoch), ``irq.slot_active`` (gauge; slots;
+		nonzero generation; sampled), ``irq.slot_pending`` (gauge; slots;
+		nonzero pending count; sampled), ``irq.slot_masked`` (gauge; slots;
+		MASKED set; sampled), ``irq.slot_consuming`` (gauge; slots; CONSUMING
+		set; sampled), and ``irq.pending_total`` (gauge; IRQs; sum of pending
+		counts across active slots; sampled).
+Users:		multikernel management and diagnostic tools

Documentation/multikernel/usage.rst

@@ -66,6 +66,20 @@ Workflow
    ``device-remove``, and destroy the instance with ``instance-remove``
    once it is stopped.
 
+SR-IOV Assignment Boundary
+===========================
+
+SR-IOV assignment is intended for cooperative spawned kernels. Filtering
+configuration-space access and enumerating only assigned BDFs prevents
+accidental access; it is not a security boundary against a privileged kernel
+that deliberately issues configuration cycles or maps host physical windows.
+
+The host keeps exclusive leases for assigned VFs. Assignment fails unless the
+device is an SR-IOV VF whose identity and ownership can be validated. Host
+drivers remain bound while a VF is merely in the pool and are detached only
+while committing a lease. Nested kernels cannot establish this host-owned
+lifecycle and therefore cannot lease PCI devices to their children.
+
 Instance States
 ===============
 
@@ -75,6 +89,31 @@ Instance States
 - **active**: the kernel is running
 - **failed**: an error occurred; check ``dmesg``
 
+Transport Reliability Statistics
+================================
+
+Each instance exposes a read-only ``stats`` file. Version 1 is an
+append-only key/value interface covering the duplex IPI transport, direct
+reply slots, and pending IRQ mailbox. Readers must ignore unknown keys.
+
+The snapshot is observational rather than atomic. ``transport_available``
+reports whether the instance currently has shared transport state, and
+``spawn_epoch`` identifies the launch whose counters are shown. Transport
+counters are unsigned 32-bit values which may wrap and are reset when a new
+epoch is initialized; compare them as modulo-32-bit deltas only between
+samples with the same nonzero epoch.
+
+``ipi.*`` reports producer failures and current per-direction slot occupancy,
+``reply.*`` reports timeout/recovery counters and reply-slot states, and
+``irq.*`` reports recorded, coalesced, deferred, stale, failed, saturated,
+active, pending, masked, and consuming mailbox state. Gauge values describe
+only the instant at which each field was sampled.
+
+The duplex ready-bit protocol has no shared producer gate or intermediate
+WRITING, CONSUMING, CANCELLED, or invalid states. The corresponding legacy
+version-1 keys remain present and report zero; ``ipi.slot_ready`` and
+``ipi.full_failures`` are summed across both link directions.
+
 Restrictions
 ============
 
@@ -83,3 +122,8 @@ Restrictions
 - Instance files are read-only; an instance's resources change through
   overlays targeting ``/instances/<name>``.
 - Rollback (``rmdir`` on a transaction) cannot destroy a running instance.
+- Logical CPU 0 handles assigned-device MSI forwarding and must remain online
+  while those devices are active.
+- Assigned MSI events are recorded in per-instance shared mailboxes before a
+  doorbell is sent. Masked events remain pending and lost doorbells are retried;
+  each spawn drains only its own parent-link mailbox.

arch/x86/boot/header.S

@@ -379,7 +379,13 @@ xloadflags:
 #define XLF56 0
 #endif
 
-			.word XLF0 | XLF1 | XLF23 | XLF4 | XLF56
+#ifdef CONFIG_MULTIKERNEL
+# define XLF_MK XLF_MULTIKERNEL_IPI
+#else
+# define XLF_MK 0
+#endif
+
+			.word XLF0 | XLF1 | XLF23 | XLF4 | XLF56 | XLF_MK
 
 cmdline_size:   .long   COMMAND_LINE_SIZE-1     #length of the command line,
                                                 #added with boot protocol

arch/x86/include/asm/multikernel.h

@@ -11,6 +11,7 @@
 #ifndef __ASSEMBLY__
 
 #include <linux/build_bug.h>
+#include <linux/init.h>
 #include <linux/stddef.h>
 #include <linux/types.h>
 #include <linux/cpumask.h>
@@ -127,7 +128,7 @@ struct mk_spawn_context {
 	u32 target_apic_id;		/* Target CPU's APIC ID */
 	u32 flags;			/* MK_SPAWN_F_* flags */
 	u32 ready;			/* Signal flag */
-	u32 reserved;			/* Padding for alignment */
+	u32 abi_magic;			/* Host/spawn generation marker */
 	/* Keep all existing context offsets unchanged. */
 	struct boot_params bp;		/* Standard x86 boot params */
 	/* Optional boot data belongs after boot_params, in the zeroed tail. */
@@ -195,7 +196,8 @@ void mk_set_spawn_context(struct mk_spawn_context *ctx,
 int mk_spawn_cpu(struct mk_instance *instance, int cpu,
 		 struct mk_spawn_context *ctx);
 
-/* Initialize boot context tracking in spawn kernel */
+/* Validate and initialize boot context tracking in spawn kernel */
+struct mk_spawn_context *mk_validate_boot_context(phys_addr_t ctx_phys);
 void mk_init_boot_context(phys_addr_t ctx_phys);
 
 
@@ -218,6 +220,11 @@ int multikernel_wakeup_secondary_cpu_64(u32 apicid, unsigned long start_eip,
 int multikernel_restore_ap(unsigned int cpu, unsigned long cr3,
 			   unsigned long gs_base, unsigned long stack,
 			   unsigned long entry);
+#if defined(CONFIG_MULTIKERNEL) && defined(CONFIG_PCI)
+void __init x86_multikernel_pci_platform_init(void);
+#else
+static inline void x86_multikernel_pci_platform_init(void) { }
+#endif
 
 /* NMI on an offline pool CPU: honor a pending force halt */
 #ifdef CONFIG_MULTIKERNEL

arch/x86/include/uapi/asm/bootparam.h

@@ -25,6 +25,7 @@
 #define XLF_5LEVEL			(1<<5)
 #define XLF_5LEVEL_ENABLED		(1<<6)
 #define XLF_MEM_ENCRYPTION		(1<<7)
+#define XLF_MULTIKERNEL_IPI		0x0100
 
 #ifndef __ASSEMBLER__
 

arch/x86/kernel/kexec-bzimage64.c

@@ -554,6 +554,11 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
 				  .buf_max = ULONG_MAX, .top_down = true };
 
 	header = (struct setup_header *)(kernel + setup_hdr_offset);
+	if (image->type == KEXEC_TYPE_MULTIKERNEL &&
+	    !(header->xloadflags & XLF_MULTIKERNEL_IPI)) {
+		pr_err("Loaded kernel lacks the required shared transport layout\n");
+		return ERR_PTR(-EPROTONOSUPPORT);
+	}
 	setup_sects = header->setup_sects;
 	if (setup_sects == 0)
 		setup_sects = 4;
@@ -747,10 +752,29 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
 
 	/* For multikernel, setup custom e820 map */
 	if (image->type == KEXEC_TYPE_MULTIKERNEL) {
+#ifdef CONFIG_MULTIKERNEL
 		image->arch.mk_boot_params = bootparam_load_addr;
+
+		/*
+		 * setup_boot_parameters() copies the host subarchitecture.  A
+		 * spawn kernel must take the multikernel platform path instead.
+		 */
+		params->hdr.hardware_subarch = X86_SUBARCH_MULTIKERNEL;
+
+		/*
+		 * The spawn trampoline enters the compressed kernel directly,
+		 * bypassing purgatory.  The x86 boot protocol's 64-bit entry is
+		 * 0x200 bytes from the start of the protected-mode payload.
+		 */
+		image->arch.mk_kernel_entry = kernel_load_addr + 0x200;
+
 		ret = mk_e820_fill(image->mk_instance, params);
 		if (ret)
 			goto out_free_params;
+#else
+		ret = -EOPNOTSUPP;
+		goto out_free_params;
+#endif
 	}
 
 	/* Allocate loader specific data */