Integrate restart-safe NFS cancellation and matching livepatches

docs/containers/administration.md

@@ -116,6 +116,39 @@ file        /tank/conf/ct/myct01.yml
 file        /tank/log/ct/myct01.log                                                  valid     LXC log file
 ```
 
+## NFS during container shutdown
+
+With a kernel that provides host-controlled NFS cancellation, NFS mounts made
+inside containers retain their normal retry policy: the default is a hard mount.
+An unreachable or slow server does not by itself cause *osctld* to cancel I/O.
+Applications should synchronize their data and unmount NFS as part of an orderly
+shutdown.
+
+For `osctl ct stop --kill`, or after the normal stop timeout expires, *osctld*
+quiesces the container payload and requests terminal cancellation before asking
+LXC to finish teardown. It also requests cancellation when container init is
+exiting, including when init is blocked closing its own NFS file descriptors.
+This lets teardown proceed without waiting for the NFS server to return.
+
+**Cancellation is not a successful flush.** Pending writes can fail or be lost,
+and a backup interrupted by forced teardown must be checked or retried. Prefer
+a clean application shutdown when the server is available. The cancellation
+mechanism does not provide an NFS server durability guarantee.
+
+Cancellation is scoped to the container run's authenticated user namespace and
+the network namespaces owned by it or its descendants. This includes namespaces
+kept alive by mounts even when no process occupies them. It affects all NFS
+mounts and client SUNRPC activity in that scope, including NLM lock requests.
+Namespaces owned by the host or another container are not selected. Host-created
+NFS mounts passed into a container are outside this ownership guarantee; manage
+their lifecycle on the host.
+
+The operation cannot be undone in the cancelled namespaces. Restart the
+container through *osctl* to obtain fresh namespaces; do not try to revive old
+namespace handles. On older kernels, *osctld* uses the available per-namespace or
+per-filesystem control, while the older kernel's forced-soft policy remains in
+effect. This mechanism does not implement cancellation of CIFS/SMB requests.
+
 ## Attaching containers
 Administrators can use `osctl ct attach` to enter containers and get root shell,
 without the need of knowing password for SSH or `osctl ct console`. *osctl*

docs/os/livepatches/6.12.95.md

@@ -1,14 +1,47 @@
 # Linux 6.12.95 livepatch coverage
 
 This page applies only to vpsAdminOS systems booted with Linux `6.12.95`.
-Livepatch availability and vulnerability coverage are specific to a boot
-kernel; no coverage for other kernel versions is implied.
+Livepatch availability and vulnerability coverage are specific to an exact boot
+kernel, not just its version string. No coverage for other kernel versions is
+implied.
+
+## Boot-kernel variants
+
+The NFS cancellation kernel at `563bbb35e8753e1bb34dad19ebeec8962ee3c1cd`
+retains the Linux `6.12.95` version but changes its NFS/SUNRPC ABI. Its kernel
+package selects the `nfs-cancel` livepatch variant, loaded as
+`livepatch_6_nfs_cancel`. The original boot kernel at
+`a2384967b90f24d2470c9eb15f0e66d938df7e08` continues to use `livepatch_6`.
+Both represent cumulative coverage version 6 and report `6.12.95.6` when active;
+their modules are not interchangeable.
+
+The new boot kernel already contains the NFS file-lock-list, FREE_STATEID
+lifetime, and SUNRPC TLS lifetime fixes. Its livepatch variant omits the old
+kernel's corresponding function replacements and transition state, while
+retaining the other cumulative security changes. This does not disable
+livepatching or remove those fixes from the combined boot-kernel/livepatch
+coverage. The original cumulative patch inputs remain unchanged for the old
+boot kernel and its migration tests.
+
+`live-patches` verifies the booted kernel image and its kernel notes before
+performing an operation. The new variant requires a GNU build ID; its kernel
+build retains the content-derived SHA1 build ID. After switching OS generations
+without rebooting, a utility built for a different kernel refuses to load or
+unload its module and leaves existing protection untouched. The exporter uses
+the booted generation's livepatch requirements in that case. Reboot into the
+configured kernel before managing its module; do not bypass the check with
+manual `insmod`.
+
+The coverage table below describes the original v6 livepatch history. Fixes
+moved into the new boot kernel retain that coverage history; the table is not
+an assertion that the same function replacements exist in both module files.
 
 ## Current livepatch
 
 The current cumulative livepatch is **v6**. When active, it changes the kernel
 release reported by `uname -r` from `6.12.95` to `6.12.95.6` and is loaded as
-module `livepatch_6`.
+module `livepatch_6` on the original boot kernel. See the variant distinction
+above for the NFS cancellation kernel.
 
 | Item | Value |
 | --- | --- |

libosctl/lib/libosctl/sys.rb

@@ -103,6 +103,13 @@ def mount_proc(dst)
       ret
     end
 
+    def mount_sysfs(dst)
+      ret = Int.mount('none', dst, 'sysfs', MS_NOSUID | MS_NODEV | MS_NOEXEC, 0)
+      raise SystemCallError, Fiddle.last_error if ret != 0
+
+      ret
+    end
+
     def make_shared(dst)
       ret = Int.mount('none', dst, 0, MS_SHARED, 0)
       raise SystemCallError, Fiddle.last_error if ret != 0

os/livepatches/available-patches.nix

@@ -1,19 +1,29 @@
 {
   lib,
   version ? null,
+  variant ? null,
   ...
 }:
 with lib;
 
+assert variant == null || variant == "nfs-cancel";
+
 let
 
   availablePatches = [
     {
       name = "bp-6.12.95-cumulative";
-      buildPatches = [
-        "bp-6.12.95-cumulative"
-        "bp-6.12.95-uname"
-      ];
+      buildPatches =
+        if variant == "nfs-cancel" then
+          [
+            "bp-6.12.95-nfs-cancel-cumulative"
+            "bp-6.12.95-nfs-cancel-uname"
+          ]
+        else
+          [
+            "bp-6.12.95-cumulative"
+            "bp-6.12.95-uname"
+          ];
       filterFn = availableFor "6.12.95";
       version = 6;
       # kpatch-build groups these .ko targets into one modpost pass. Include