release: notes say what changed; the report is KVM-only at 20 boots a row

[aledbf]

Three changes to how a spin-machine release is made and described.

1. The notes say what changed. Until now they said which checksums moved and which checkpoints stop resuming, but not why. hack/releasenotes (Go, with a test) reads git between the previous release and this one and writes what reached the machine:

• the commits, grouped by the part they changed: QEMU and firmware, kernel, base image, the definition and CLI;
• the pins in versions.yaml that moved;
• the kernel options turned on, off or changed;
• the patches added, changed or removed, named by their Subject, or by their commit when they are bare diffs.

Commits that did not reach the machine (tests, the lab, CI) are listed apart, collapsed. This section leads the notes, above the fingerprint verdict. Below is what it writes for v20261001.01 against v20260930.02.

2. Every qboot patch ships in the release. hack/release listed the qboot patches by name, and mtrr.patch (#75) was never added to that list. v20261001.01 shipped a qboot.bin without the GPL patch it was built with. It now copies every qemu/qboot/*.patch, so a new patch cannot be left out again.

3. The report is KVM-only, at 20 boots a row.

• accel=tcg is gone: the TCG build is for CI runners without KVM, and timing it says nothing about a host.
• At 3 boots a row, comparing v20261001.01 with v20260930.02 flagged every KVM row 5-11% slower. 20 boots of each release, alternated on construct, put them within 5 ms of each other.
• The report takes about 5-8 minutes now.

Tests: task lint and task test pass. hack/releasenotes has a test over a temporary repository. With a planted bug (the kernel option comparison inverted), it fails.

What the new section writes for v20261001.01

What changed since v20260930.02

QEMU and firmware

• qboot: enable the MTRRs, write-back by default (qboot: enable the MTRRs, write-back by default #75)
• qemu: carry upstream's discard accounting for virtio-blk (qemu: carry upstream's discard accounting for virtio-blk #79)

Kernel

• kernel: a config with erofs builds (kernel: a config with erofs builds #66)
• kernel: lockdown at confidentiality and the BPF LSM

Base image

• image: fstrim hourly (image: fstrim hourly #76)

Kernel configuration

• CONFIG_BPF_LSM n → y
• CONFIG_DEVMEM y → n
• CONFIG_DEVPORT y → n
• CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY n → y
• CONFIG_LSM n → "lockdown,bpf"
• CONFIG_PROC_KCORE y → n
• CONFIG_SECURITY n → y
• CONFIG_SECURITYFS n → y
• CONFIG_SECURITY_LOCKDOWN_LSM n → y
• CONFIG_SECURITY_LOCKDOWN_LSM_EARLY n → y
• CONFIG_SECURITY_NETWORK n → y
• CONFIG_SECURITY_PATH n → y

Patches to upstream source

• added qemu/patches/0002-hw-virtio-blk-account-discard-operations.patch: hw/virtio-blk: Account discard operations
• added qemu/qboot/mtrr.patch: qboot: enable the MTRRs, write-back by default (qboot: enable the MTRRs, write-back by default #75)

22 more, none of them in the machine: tests, the lab, CI, tooling

• boot: compare pairs a renamed row with the one that boots its command line (boot: compare pairs a renamed row with the one that boots its command line #52)
• boot: compare pairs a row across a dropped axis by the nearest command line (boot: compare pairs a row across a dropped axis by the nearest command line #53)
• go-tools 7fefec3: the mutation gate holds each test process to its share of the memory, and refuses an edit that passes it
• go-tools 8ea5167: the mutation gate watches each test process on its own, and ends with it
• boot: NBD is loaded only where its devices are not there already (boot: NBD is loaded only where its devices are not there already #56)
• boot: page-cache, the host's cache and the guest's, measured (boot: page-cache, the host's cache and the guest's, measured #57)
• boot: page-cache times the guest's I/O by /proc/uptime (boot: page-cache times the guest's I/O by /proc/uptime #58)
• boot: page-cache reads small files back, and refuses tmpfs (boot: page-cache reads small files back, and refuses tmpfs #59)
• boot: page-cache asks whether memory.reclaim keeps a working set (boot: page-cache asks whether memory.reclaim keeps a working set #60)
• lab: pass page-cache's FILE_MB and CACHE_TIMEOUT_S on (lab: pass page-cache's FILE_MB and CACHE_TIMEOUT_S on #61)
• boot: page-cache variants - reporting order, subclusters, memory.high, prefetch (boot: page-cache variants - reporting order, subclusters, memory.high, prefetch #62)
• boot: page-cache reclaimers - memory.reclaim, DAMON_RECLAIM, lru_gen (boot: page-cache reclaimers - memory.reclaim, DAMON_RECLAIM, lru_gen #64)
• boot: page-cache says where the guest's discards went (boot: page-cache says where the guest's discards went #67)
• boot: reclaimers mounts debugfs for lru_gen (boot: reclaimers mounts debugfs for lru_gen #68)
• boot: page-cache's QMP socket under /tmp (boot: page-cache's QMP socket under /tmp #69)
• boot: page-cache's discard note tells kept zeroes from given-back ones (boot: page-cache's discard note tells kept zeroes from given-back ones #70)
• boot: page-cache's lru_gen shows its generations, and a probe for first writes (boot: page-cache's lru_gen shows its generations, and a probe for first writes #71)
• boot: page-cache trims after the removal is committed (boot: page-cache trims after the removal is committed #72)
• boot: reclaimers' lru_gen dump escapes its printf (boot: reclaimers' lru_gen dump escapes its printf #73)
• boot: reclaimers' lru_gen ages and evicts every memcg (boot: reclaimers' lru_gen ages and evicts every memcg #74)
• boot: page-cache splits QEMU's memory into the guest's RAM and its own (boot: page-cache splits QEMU's memory into the guest's RAM and its own #77)
• boot: reclaim asks whether what was freed is reported back in a minute (boot: reclaim asks whether what was freed is reported back in a minute #78)

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}