[ANNOUNCE] mklinux v7.0-mk4 and kerf 0.4.0

[Cong Wang]

Hi all,

mklinux v7.0-mk4 is out. mklinux is the tree carrying the multikernel
work: several Linux kernels running side by side on one machine, each
owning its own CPUs, memory and devices, with no hypervisor underneath.
A host kernel spawns the others through kexec_file_load() and they talk
over shared-memory message rings and IPIs.

This release is 41 patches on top of v7.0-mk3.

Git:

  https://github.com/multikernel/linux.git  tag v7.0-mk4

Release page, with x86_64 .deb and .rpm packages built from the tag:

  https://github.com/multikernel/linux/releases/tag/v7.0-mk4

Use it together with kerf 0.4.0, the user-space tool that creates and
manages instances, released alongside it:

  https://github.com/multikernel/kerf/releases/tag/v0.4.0

PCI config space: a spawn no longer generates config cycles itself. The
kernel that lent its functions answers for their config space over the
message ring, the way xen-pciback answers pcifront, and filters writes
so an instance can neither move a BAR nor enable SR-IOV. The ring gains
synchronous requests that wait for their answer with interrupts off, so
the accessors work under the PCI core's lock. Each bus holding a device
of an instance is described as a root bus of its own, so the spawn never
enumerates the host's bridges. A running spawn can take a function it
did not boot with, a lone function of a slot (00:1f.2 without 00:1f.0)
is found, functions without MSI-X are lent, and a function taken back
from an instance is reset, or has bus mastering cleared, before it is
handed out again.

Takeover: a backup is told about every PCI bus of its host. Once the
fence confirms the host parked, config space switches to each bus's ECAM
window, filtered to the spawn's own functions, and a spawn can adopt a
function of its fenced host. A CPU that panicked with the NMI watchdog
running is now parked by a force halt instead of perf claiming the NMI.

Memory: pool memory is hot-removed from the host's direct map, so a
stray host write can no longer reach a spawn, and instance memory is no
longer claimed as host System RAM. Memory hotplug can remove and add
back parts of memory blocks in subsections, so pool chunks and instance
memory moves need only be multiples of 4M on x86 rather than whole
blocks; the granule is published in the device tree. A partly removed 1G
direct mapping is split first. Each instance region is exactly one chunk
of its instance pool, fixing a genalloc BUG and leaked memory on resize,
and a memory-add claims the range the kernel actually adds.

kexec: multikernel images load only through kexec_file_load(), are
published only once loaded, and fix error-path leaks, double frees and a
stale -EBUSY. The manifest page and IPI ring live in the instance. ELF
vmlinux spawn kernels can carry an appended signature, so KEXEC_SIG and
lockdown work. Starting an instance moved out of kexec into the instance
code.

x86: spawns get no host RSDP, keep ACPI off against acpi=force, reserve
no RAM buffers past their E820 regions, and never use IPI shorthands,
which had broadcast host IPIs into spawns and the other way round.

Fixes: the host doorbell is rung on the host's real boot CPU rather than
physical CPU 0, released mk_transport vsock sockets are unhashed (exec
failed after 512 runs), the spawn console starts with standard terminal
modes, and a device-add binds only where the bus would.

The binary packages are a convenience for trying the tree. They use an
Ubuntu-based config with CONFIG_MULTIKERNEL=y, modules are signed with a
per-build key, and the kernel is not Secure Boot signed.

Feedback, testing reports and review are very welcome.

Thanks,
Cong