x86: Rework evaluation of MSR_IA32_VMX_TRUE_*_CTLS

The SDM recommends to keep default1-class controls enabled if they are
unknown to the VMM. This applies to most of those bits. Even worse, by
using the TRUE_*_CTLS, we kept DEBUG_CONTROLS saving/loading disabled on
most machines, corrupting the related states on vmexit.

Switch to the "untrue" capability MSRs, except for CR3 loading/storing,
which will ensure that default1 bits are kept enabled also on future
CPUs.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Make vtd_remove_device_from_cell more robust against non-existent devices

Do not crash if we call vtd_remove_device_from_cell for a device that is
not added to a cell, and there is even no corresponding context table.
This allows to use vtd_remove_device_from_cell e.g. for rollbacks of
half-done configurations after an error occurred.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Move vtd_remove_device_from_cell

Move vtd_remove_device_from_cell unmodified. We will need it earlier.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Fold vmx/vtd_root_cell_shrink into vmx/vtd_cell_init

This primarily fixes a regression of 46ab6c2f1e: Due to that reordering,
we were first adding devices to a new cell, then removing them from the
root cell which effectively disabled them in the context table.

Analyzing the content of vmx/vtd_root_cell_shrink, we are better off
folding them into the corresponding cell_init functions. We fix the
ordering issue while doing this.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/configs: Clean up config structure alignment/packing

Instead of spreading aligned(1), we rather need to pack all config
structures and also the containers we define in the config files
themselves. Clean this up, also dropping the now unneeded padding from
jailhouse_cell_desc.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Replace shrinking_set with root_cell.cpu_set in cell_create

Let's make it clear: the set we shrink is always the one of the root cell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Factor out cell_destroy_internal

We will reuse it to roll back failed cell creations.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Guard vtd_add_device_to_cell against addition of existing devices

Avoid that we add an already registered device to a cell, specifically
that we report this to the console. This case can happen soon when
rolling back failed cell creations.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Remove some unneeded local caching of cell->config

No hot-paths, we can save the local variables.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce arch_config_commit

This function primarily serves to split IOMMU activation from related
root cell and memory region mapping setup. This is required for generic
memory region mapping but also helps to consistently flush the affected
caches after configuration changes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Pull root cell initialization into vmx/vtd_init

Provides a micro-simplification regarding error handling and belongs
together conceptually anyway.

Some constant name shortening is required to avoid line wrappings.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Generic memory region mapping with rollback on error for cell creation

Pull the memory region mappings that currently happen in vmx and vtd
into generic code paths. This allows us to properly roll back on errors
during cell creation.

We now perform the arch-specific cell initialization first, then
transfer CPUs and finally remap the memory regions. For the rollback, we
can simply use the infrastructure available for cell destruction, both
at generic level as well as inside vmx/vtd.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Simplify vtd_get_fault_rec_reg_addr

The logic remains readable when written in a single statement.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Refactor vtd constant definitions

Make use of BIT_MASK and refactor the constant definitions used for vtd
into a consistent form that is more easily verifiable against the spec.
Drop some unused constants.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Drop redundant call to vtd_init_fault_nmi

We already call this at the end of vtd_init via root cell
initialization.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Clean up vtd_init_fault_reporting

Remove the unneeded return code, compact the code and do some style
cleanups.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Extend vtd_init_fault_reporting to vtd_init_unit

Move the root table pointer setup from vtd_config_commit. More logic
will be added later.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Avoid warning on passing volatile pointers to page_map_hvirt2phys

This allows to swallow every pointer type without explicit casts.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Clean up vtd_init_fault_nmi, vtd_check_pending_faults and related MSI constants

Coding style fixes and clarifications of the comments. No functional
changes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Park a CPU when a VM entry failed

Do not give up a CPU if only VM entry failed. For whatever reason, we
may have loaded an invalid CPU state from which we can still recover by
resetting the virtual CPU. This also simplifies the exit handling.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>