Repository navigation
multikernel: serialize lifecycle operations and retain uncertain resources - #41
Draft
pro-utkarshM wants to merge 47 commits into
Draft
pro-utkarshM wants to merge 47 commits into
pro-utkarshM wants to merge 47 commits into
Conversation
Exercise actual pending, send and dispatch paths with controlled kernel boundaries. Regression mode intentionally fails on the current baseline; characterization records existing rejection and cleanup behavior. This is evidence and a bounded proposal, not a production protocol fix. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Keep the first completion result under the pending lock, including after a waiter consumes the completion token. Snapshot the result and detach atomically, without allowing a late reply to reverse a timeout. Validate the shutdown ACK operation and outer/inner message types before dispatch. Request-ID correlation follows separately. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Allocate nonzero boot-local IDs under the pending lock, refuse wrap, and match IDs alongside the existing type, operation and resource tuple. Carry the existing wire-header ID through receive callbacks, deferred workers and replies. Update all seven pending callers and the vsock callback; retain zero IDs for uncorrelated sends and notifications. Use explicit local cancellation on send failure. Cancellation does not stop work already delivered to a peer. Preserve first-result and timeout semantics and reject allocation or ID exhaustion without publishing a pending entry. Exercise verbatim production workers, round trips, failure cleanup and exhaustion. Document matched-revision qualification, requester-lifetime limits and the separately reproduced baseline UBSan alignment failure. No wire layout or CPU ownership behavior changes. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
The device workers widen an int expression to u64, while their requesters first store that same expression in u32. For domains with bit 15 set, the ACK key can be sign-extended and fail tuple matching after a successful remote operation. The signed left shift is also undefined in C. Pack the domain as u32 on both sides. Preserve the wire layout and all resource operations. Add real worker round trips for add/remove in domains 0x8000 and 0xffff; all four timed out before this change. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
The flexible message payload starts at offset 20 on rv64 and x86-64. Casting it directly to CPU, memory or ACK structs requires eight-byte alignment and triggers undefined behavior. Copy the bounded known payloads into aligned local unions before typed accesses. Keep the wire header, offsets and payload sizes, retain short message validation, and leave the receive buffer intact. Deferred workers capture their inputs before the callback returns; vsock copies into an skb. Extend the production-path host checks for receive-buffer preservation, maximum-size trailing data, truncated requests and HALTED decoding. The 101 checks pass with full Clang ASan and UBSan including alignment; x86 multikernel/vsock vmlinux also links. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Allocate the waiter and reserve target CPU ownership before active hot-add handoff. Retain ownership after a failed handoff, transport error, or missing ACK rather than guessing that remote work has been canceled. Track possible x86 instance users before secondary, boot and hot-add mailbox publication. Confirm tracking back-to-front because the host-slot fallback can remove the current member; forward traversal could skip a running CPU and incorrectly allow image overwrite. Add production-path host checks for reservation failure, lost ACK, partial handoff, conservative retention and mutation-safe confirmation. Shared resource/image locking, queued-work fencing and runtime lifecycle qualification remain separate follow-ups. selftests/multikernel: wrap CPU ownership checks Wrap the ownership assertions and split the x86 extraction patterns to keep the full patch within the kernel line-length limit. No production behavior changes. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Use the existing overlay mutex for multikernel file load, exec and cleanup. Take it after kexec_lock and before instance lookup, and release it only after image teardown or publication has finished. Keep registry locking short-lived inside that window. File-load cleanup must precede kexec_unlock: failed loads and unloads still use the instance pool. This also matches legacy kexec_load's cleanup order. Assert the resource-lock contract at multikernel image lookup and release. Add production-function host checks using real pthread mutexes and a competing overlay rollback. Cover load, exec, unload, failed-load cleanup, error-path unlocks and normal/crash image behavior. Document substituted kernel boundaries and the remaining teardown and remote-work gates. This is controller serialization, not cancellation of queued remote work or proof that active-image unload and halt settlement are safe. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
CPU add and remove requests currently run independently on the system workqueue. A remove can complete and send its ACK while an older add is still queued, leaving a start pending after the requester returns the CPU. Use a CPU-only ordered workqueue so an admitted remove follows earlier CPU requests. Keep memory, device and shutdown work scheduling unchanged. Protect submission and detachment with an IRQ-safe spinlock. Close CPU admission before unregister and drain accepted work before freeing the queue. Unwind registration failure and reject late submissions without leaking their work records. Add production-function host regression checks with an adverse scheduler, init/cleanup failures, sparse CPU IDs, ACK errors and admission/drain checks. Retain the existing ACK suite's deterministic scheduler boundary. This orders received CPU work, not all controllers or surviving peers. Shutdown quiescence, safe halt settlement and reclamation remain separate. multikernel: keep CPU queue admission raw in hard IPI context The CPU request receiver runs directly from the multikernel system-vector handler. On PREEMPT_RT, ordinary spin locks become sleepable and their irqsave variant does not disable hard interrupts. Use a raw spinlock for the short CPU queue submission, detachment and publication critical sections. Keep hotplug execution and queue draining outside the admission lock. Extend the host fixture to model hard-IPI context with RT lock semantics. It first reports twelve invalid acquisitions with the ordinary lock, then passes with raw locking. This is an API/context regression check, not a reproduced RT kernel deadlock or whole-port RT qualification. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Close resource admission and wait for accepted CPU, memory and device workers to finish before sending a requested shutdown ACK. Keep CPU request ordering and existing memory/device scheduling. Initialize hotplug admission before publishing the system handler and drain incoming work during cleanup. This process-context barrier does not qualify voluntary or force-stop paths, other writers, or reclamation. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
…re retirement Serialize incoming resource workers against controller mutation, drain callback and local writer lifetimes, and retain resources whenever complete CPU stop confirmation fails. Refuse active Image unload and stop on manifest-finalization errors; drain kernfs outside registry locking. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
A source mailbox claim stages dispatch registers but still executes the old park page until its destination jump. Obtain a destination self-repark claim under the existing park mutex before permitting tracking removal or reclamation. Failure retains the old context; no new mailbox ABI is introduced. The extracted production handoff test first failed four of eight assertions with delayed destination arrival and now passes. CPU ownership tests retain their timeout and uncertain-start coverage; adjusted wake counts include the new arrival proof. Native delayed-departure qualification remains required. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Keep messaging registration, replacement and cleanup ordered through callback retirement. Registration begins closed, initialization opens it once, and cleanup permanently closes it. Callbacks never acquire the process-only registry mutex; owners must not hold callback-owned locks while retiring handlers. Host mktty list writers exclude same-CPU IRQ reentry and publish the connection target once under its lookup lock. Production-extraction registry and mktty tests passed full ASan/UBSan, and the affected GCC objects compiled. Native IRQ/RCU and PREEMPT_RT behavior remain unqualified. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Publish the consumer tail with release ordering only after clearing the consumed slot. Have producers acquire that tail before reusing capacity. Apply the same ordering to invalid-entry consumption and the existing drop-pending helper. This pairs slot clearing with reuse; it does not establish peer quiescence or make a shared-ring reset safe. Shared-ring reset removal is separate. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Stopping one instance does not stop other peers from publishing into the host receive ring or exclude its interrupt consumer. Resetting that ring during respawn can discard live traffic or race its head/tail updates. Remove the host-ring reset and its helper. Retain an unpublished slot rather than manufacture reusable capacity without ownership or quiescence proof. The instance's own ring reset remains separate. Recovery of an abandoned shared slot needs a future protocol; this is not a multikernel#7 solution. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Expand compact statements in the halt-settlement, writer, teardown, callback, mktty and repark-arrival fixtures. Keep their operations and assertions unchanged while making the test code easier to inspect. This patch changes fixture presentation, not kernel behavior or the scope of the runtime qualification. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Pending ACK completion runs directly from a hard IPI. An ordinary spinlock can become sleepable on PREEMPT_RT, so it is not the appropriate lock for the shared pending list in that context. Use a raw spinlock consistently for list publication, cancellation, completion and waiter detachment. Keep allocation and freeing outside the critical sections and preserve request-ID and single-shot semantics. Give the extracted ACK fixture a distinct raw-lock type and exercise completion in modeled hard-IPI context. This checks API/context use, not whole-port PREEMPT_RT behavior or native lockdep qualification. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
A spawn can donate a secondary to its own pool. That CPU watches the local park mailbox, not the parent-given boot context or an adopted parent slot. Select the local mailbox first while retaining dispatch from the running kernel context. Serialize selection and publication against pool park storage changes. Refuse a missing or unmappable local mailbox without publishing a fallback wakeup. x86/multikernel: map the boot trampoline before local pool dispatch The park loop jumps to the physical secondary trampoline under its existing park page table, before the trampoline switches CR3. A nested local pool maps only its donated chunks, not necessarily the parent-allocated boot trampoline. Establish that identity mapping before publishing a local wakeup, fail closed on mapping errors, and keep table allocations with the local pool. Extend extracted dispatch tests to check initial fetch coverage and the complete payload. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
The bzImage loader can be compiled without multikernel, but its custom E820 setup accesses multikernel-only fields and helpers. Compile that block only when CONFIG_MULTIKERNEL is enabled. Keep the ordinary loader path and enabled multikernel behavior unchanged. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
The receive callback runs in hard IPI context. Keep connection lookup and receive-buffer publication under raw locks, then queue preinitialized work to wake readers outside that context. Queue the wakeup while the connection lifetime lock is held. Release unlinks the connection before flushing its work, and does not wait while holding a raw lock. Validate the payload's actual extent before copying. Include host receive/lifetime fixtures. These controlled boundaries do not by themselves establish whole-port PREEMPT_RT qualification. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Copy incoming bytes into a preallocated FIFO under a raw lock rather than performing TTY input delivery directly from the hard IPI callback. A bounded worker holds a TTY reference, delivers buffered data and reports dropped bytes from process context. Serialize requeue with receive admission. Close admission before canceling work and resetting the FIFO during port shutdown; do not take the port mutex from the worker. Use raw locking for the console buffer as well. Include controlled delivery, overflow and shutdown fixtures. Native execution remains a separate validation gate. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Unwind host and spawn device registration when callback registration fails, instead of leaving a device without a receive handler. Have the host wake worker acquire the receive lock before checking readability, including when workqueue enqueueing coalesces. Flush the spawn line discipline after hangup has drained receive work so buffered input cannot cross the session boundary. Extend initialization, wakeup and lifetime fixtures for these paths. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
CPUHP wake callbacks do not take the overlay mutex. Protect pool set growth and membership changes with a dedicated mutex, also held while selecting and publishing the x86 wake slot. Do not hold it across CPU hotplug, ACK waits or repark calls. Reusing park_lock in the writers would invert the registry-to-park order against park teardown. Keep the set lock innermost instead. Extend the extracted ownership and wake tests to check the lock on all mutations and reads, allocation failure, and lock release across the CPUHP and ACK boundaries. These deterministic tests are not native concurrency proof. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Format the ACK, mktty initialization/lifetime/input and wake-slot fixtures using the kernel layout. Preserve string literals and fixture behavior; there is no production-kernel change in this patch. Keep formatting separate from the subsequent halt-settlement and native CPU-hotplug changes so their functional deltas remain visible. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
A stopped-CPU snapshot does not establish that an active instance has completed halt settlement or retired every potential start issuer. Reject multikernel execution with EBUSY while its state is ACTIVE, before confirmation and Image-copy work. Keep the existing serialized halt path responsible for changing that state. Extend the Image-lock fixture to verify rejection leaves the instance and its allocations retained. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Draining multikernel resource workers alone does not exclude native CPU hotplug from starting a hart during requested shutdown. Disable and drain native CPU hotplug before acquiring the controller mutex and sending the shutdown acknowledgment. Keep that exclusion through the terminal parking path. Extend the worker and ACK fixtures to require native hotplug exclusion before notification. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Only normal terminal shutdown may acquire the controller mutex after native CPU hotplug has been disabled. Retain that exclusion through final parking, and reject panic, ordinary kexec and unqualified exits as permission to publish HALTED. Pass explicit notification permission to the shared parking helper. Local parking remains available without a notice, and requested shutdown retains its existing drain and correlated acknowledgment. Keep qualification x86-local so it does not compete with the separate RISC-V transport. Add extracted machine-operation checks for normal, emergency, panic, kexec, contended and host paths. These are host fixtures, not native shutdown qualification. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
…ters Protect root and instance DT generation with the existing resource mutex. Trylock and return EAGAIN on contention: destruction holds this mutex while draining kernfs, so a blocking read-side acquisition could deadlock teardown. Release the mutex after generation, including errors, before copying the owned snapshot. Add defensive callback checks for exclusion, contention, retry, partial reads and cleanup without racing mutable kernel allocations. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Post-load cleanup intentionally retains cmdline_buf for a loaded Image. The early allocation unwind frees the Image directly and bypasses the command-line cleanup in kimage_free, leaking the buffer after a later preparation failure. Call the existing cleanup helper before the final early free. Extend the extracted normal, crash and multikernel load checks to verify failed-load cleanup and successful-load retention. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Keep CPU-map serialization from online-state validation through departure, presence withdrawal and device bookkeeping. Native bringup must not observe a present departed CPU after the donation transaction has completed. Reject ordinary offline and intermediate CPUs rather than reporting a successful donation, and disallow selecting DEPARTED through native state control. The multikernel caller updates ownership only after success. Add extracted-function checks for the transaction and its shared caller. These host checks and object builds are not live lockdep or runtime proof. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
…rship Reserve local CPU ownership before registration or native bringup. Restore presence, run CPUHP and handle rollback under native hotplug serialization, with ordinary possible-CPU, NUMA, hotplug-disable and SMT preflight checks. Share CPU-device NUMA bookkeeping with the ordinary online path. Report whether native bringup was attempted rather than treating errno as proof that the CPU is quiescent. Preflight rejection rolls back only newly reserved ownership. An attempted failure retains ownership and removes free-pool eligibility, without automatically retrying. Preserve the pool membership needed for x86 wake-slot selection until the attempt finishes. Do not mark an online CPU absent if native rollback is incomplete. Leave ordinary add_cpu unchanged and validate logical IDs before per-CPU access. Add extracted-function ownership and transaction checks. These userspace checks and configuration object builds are not native runtime qualification. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Reserve the shared slot before publishing and claim it before authoritative APIC and dispatch reads. Recheck the target after claiming, stage all fields, and acknowledge only while still owning BUSY. Only the publisher consumes ACK. On bounded-wait failure quarantine the selected, own and local pool slots. Never revoke and reuse an uncertain publication. Keep destination-arrival confirmation for repark retirement, and remove timeout fallback to a second mailbox. Require secondary wake acknowledgment before returning to CPUHP. Reject retained-context rewrite and teardown, including empty tracking. A native handback may fail after mailbox ACK, so require locally owned CPUs to be online before retiring pool code/page tables. This conservatively defers pool teardown for ordinary offline local CPUs as well. Keep context offsets unchanged but explicitly change shared semantics: all host, spawn and nested kernels must use this protocol. Quarantine has no reset/retry path; recovery requires a full host reboot. Land C, assembly and state definitions together. Add extracted writer, lifetime and pool-retirement checks plus unprivileged assembly dispatch checks. These and object builds are not final native runtime or lockdep qualification. Preserve earlier runtime evidence. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
CPU donation and handback require native hotplug. The x86 architecture also assumes SMP for physical CPU mapping, so accepting MULTIKERNEL without HOTPLUG_CPU exposes an unbuildable configuration. RISC-V already enforces this prerequisite in its architecture foundation. Require HOTPLUG_CPU at the shared configuration boundary. Keep ordinary UP kernels available and add actual Kconfig rejection/restoration plus affected CPU object build checks. Supported SMP configurations are unchanged. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
The PCI backend registers its message handler at arch_initcall, before multikernel messaging reaches subsys_initcall. Starting handler admission closed therefore rejects the PCI registration with -ESHUTDOWN and leaves the backend unable to receive forwarded configuration requests. Open admission from static initialization and let messaging init only mark the registry initialized. Cleanup still closes admission permanently, and a second init still fails. Extend the registry fixture to cover the early registration order and its cleanup boundary. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Pool control teardown now unmaps both control allocations before freeing their physical storage. The mailbox lifetime fixture still extracted only the outer teardown helper and counted frees, so it no longer modeled this retirement boundary. Extract the control-free helper, record map removals separately, and assert that quarantined slots trigger neither unmap nor free. A successful pool teardown must remove both mappings before releasing the three allocations. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Manifest generation restores the boot Device Tree and uses the early flat tree interfaces unconditionally. MULTIKERNEL could still be selected with those interfaces disabled, producing an unsupported configuration. Require OF and OF_EARLY_FLATTREE at the shared Kconfig boundary. Extend the configuration test to reject multikernel without boot Device Tree support and to verify that enabling OF restores the supported configuration. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Deferred PCI configuration work looked up its grant by instance ID and BDF when the worker ran. An instance could be retired and a replacement could reuse those identifiers first, redirecting old work and its reply into a later execution generation. Device reset could also race an admitted slow configuration access. Pin the exact grant while admitting deferred work. Revoke admission under the registry lock, then serialize the admitted access and its reply against reset with a per-grant mutex. Publish reusable instance state only after PCI retirement, and keep negative replies synchronous without deferred lookup. Add controlled fixtures for replacement-grant isolation, reply suppression, config/reset serialization, direct and deferred writes, and pin release. They model PCI and workqueue boundaries and do not exercise physical PCI or DMA quiescence. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Reserve PCI ownership before lending or publishing hotplug requests. Retain grants after unsuccessful published requests, keep pending memory removals reserved, and block instance reuse until resource uncertainty is resolved by controller reboot. Reject pool insertion of devices still assigned to another instance. Create inactive overlay records before applying effects and retain failed apply or rollback records without retrying a partial inverse. Remove the unused unsafe overlay exit path. Cover controller senders, pool admission and transaction lifetime with extracted-function host fixtures; these do not qualify remote execution or PCI hardware. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
After confirming every owned and tracked CPU parked, drain a captured inbox prefix before permitting grant or instance reuse. Dispatch PCI requests while their original grants still exist so deferred workers retain the existing pin and revocation guarantees. Return -EBUSY for unpublished slots or recursive polling. Preserve blocked slots and unrelated peer traffic, and count malformed slots within the captured bound. Cover retry, wraparound, continuous arrivals, PCI grant replacement and confirmation failure with extracted-function fixtures; cross-kernel ordering and runtime qualification remain separate. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Make pool unmap and instance memory retirement return errors. Unmap control memory before detaching region metadata, and stop destruction, re-reservation and baseline replacement on failure. Keep the record on an unexpected final-reference failure; x86 keeps its existing successful mapping removal and guards the physical free wrapper. Exercise failed unmap through the extracted production memory, baseline, reservation, destruction and final-release paths. Return CPU and device resources before memory as before; failed retirement is safe retention, not an atomic rollback of earlier resource returns. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
The first baseline clears an empty mk_self memory record while host CPUs are running. RISC-V architecture release confirms every assigned hart STOPPED, so the empty record incorrectly fails with -EBUSY. Skip architecture release only for mk_self with no pool, control mapping, regions or tracked park users. Keep the active or failed, Image and uncertain ownership refusals, and retain confirmation for every child or allocation. The extracted cleanup fixture covers initial admission and nine refusals. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
MK_SYS_SHUTDOWN is received while the raw IPI drain lock is held. Allocating and initializing work there can fail under memory pressure and adds allocator and workqueue initialization paths to hard IPI context, even though a kernel can accept only one terminal shutdown request. Use one static work item and atomically admit the first valid request. The worker drains resource and native CPU hotplug, sends the correlated reply and parks forever, so the slot never needs to reopen. Reject short requests before claiming it and coalesce all later requests without replacing the original ID. Extend the ACK fixture to cover allocator exhaustion, duplicate admission, short payloads and the permanent one-shot boundary. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Voluntary HALTED handling allocated work in IPI context and looked up the instance by ID only when that worker ran. A delayed notice could therefore settle a replacement record after ID reuse, while allocation failure could silently discard the only settlement attempt. Embed one work item and pending flag in each instance. Pin the exact instance before queueing, validate the halt result, coalesce duplicates and hold the pin until stop confirmation finishes. Keep start blocked while settlement is pending, and release the pin if queueing fails. Extend the ACK, halt settlement and start-lifetime fixtures for identity, duplicate coalescing, invalid notices, reference release and start exclusion. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Message sends allocated a temporary wire buffer with GFP_ATOMIC before taking the destination ring lock. Callers include raw-locked IPI callbacks, where allocator entry is unsafe and allocation failure can discard control replies. Reserve the ring entry first and assemble the fixed header and payload directly in that slot under the existing producer lock. Publish data_size only after both copies, preserve the wire layout and zero padding, and retain the existing reference rules for ID and held-instance routes. Extend the ACK and ring-writer fixtures for allocator exhaustion, full-size messages, null payloads, overflow and queue errors, byte layout and release publication ordering. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
CPU, memory and device resource messages allocated and initialized work items while the raw IPI drain lock was held. The shared ring already bounds accepted requests, so dynamic allocation is unnecessary and can fail in the most constrained receive context. Preinitialize separate ring-sized CPU and non-CPU work arrays. Under the hotplug raw lock, validate the payload, reserve a free slot, copy the request and account it as inflight before queueing. Release the slot only after the worker finishes mutation and reply transmission; shutdown still closes admission and waits for all accepted work. Extend the resource fixtures for saturation, slot reuse, copied payloads, allocator exclusion, queue identity and shutdown quiescence. Full capacity fails closed without overwriting an admitted request. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
Nested PCI configuration requests allocated and initialized deferred work from the raw IPI receive path. Replace that allocation with a ring-sized array of preinitialized slots protected by the PCI registry lock. A slot pins the exact grant until its worker finishes access and any reply, then becomes reusable. Keep direct accesses and negative replies synchronous. Copy wire payloads into aligned local storage before reading their sequence number, reject short messages, and fail closed on slot exhaustion without taking an extra pin or overwriting older work. Extend the lifetime fixture for saturation, reuse, copied values, unaligned decoding, revocation and replacement-grant isolation. The fixture models PCI, IRQ and workqueue boundaries rather than physical device behavior. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
The network message callback allocated an skb and entered the ordinary skb queue while the raw IPI drain lock was held. Move packet ownership across that boundary with a fixed record FIFO protected by a raw lock. The callback now validates lengths and copies complete records without allocating or entering the socket stack. Let the existing worker allocate skbs and consume at most one ring's worth of records per invocation, requeueing if data remains. Drop a whole new packet on FIFO exhaustion and drop one record on allocation failure; neither case claims end-to-end delivery. Order init and exit so callbacks cannot race an absent transport or a destroyed workqueue. Add an extracted fixture for malformed input, copied lifetime, saturation and reuse, allocation failure, worker races and init or unregister errors. This does not qualify full VSOCK streams or physical hardware. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
MULTIKERNEL does not require PCI, but its local device add and remove helpers unconditionally reference pci_find_bus and pci_bus_type. Both declarations are unavailable with CONFIG_PCI=n, breaking the build. Compile the PCI-only bodies when PCI is enabled and return -EOPNOTSUPP otherwise. Keep the existing caller error propagation and resource ACK handling while preserving the PCI-enabled implementations. Signed-off-by: Utkarsh Maurya <projects.utkarshMaurya@gmail.com>
pro-utkarshM
force-pushed
the
mk/lifecycle-safety-submit-v25
branch
from
November 3, 2026 20:06
426c9c7 to
b7a6f1c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is the generic/x86 lifecycle and ownership prerequisite requested during
PR #39 review. It is now rebased onto current master
39c88f5dc18bb9a97ba2b9c214efb98e64bcba41; current head isb7a6f1cbb7b754982f13f6d1cd9dbfffe66ddda8.The 47-commit series:
memory, overlay, mailbox, PCI, and ring ownership
resource, PCI, VSOCK, and message-send paths
mailbox handoffs
gaps
RISC-V HSM/stub/shutdown, the Image loader, host-IPI fallback, manifest hook,
pool mapping, and ordinary-kexec relocation repair remain separately
identifiable dependencies.
History preservation and DCO
checkpatch; the affected fixture passes normally and under ASan/UBSan
remaining diagnostics are fixture-style warnings/checks
Validation
vmlinux+bzImagelink atb7a6f1cbb7b7109 harness cases, six modeled fixtures, full kernel link, live requested
shutdown, and live mailbox-timeout retention
ring, VSOCK, and pool-retention fixtures passed during development
Fresh runtime was not rerun on the v44 commit ID. The new source differs from
the tested predecessor only by
localversion-mk(-mk3to-mk4) and theselftest-only formatting cleanup.
Evidence boundary and draft status
The live results are QEMU evidence, not physical CPU-retirement proof. This
does not claim broad mixed-version ACK compatibility, a complete restart epoch
for #7, full VSOCK streaming, or whole-port PREEMPT_RT qualification. The
official SPDX parser is blocked locally by a missing Python
plymodule;manual SPDX-header review passed but is not an official parser result.
This remains a draft; this refresh does not request review or mark it ready.