driver: Export "hypervisor enabled" state via sysfs

This starts sysfs support for Jailhouse by exporting the enabled state
via the management device's sysfs directory (/sys/devices/jailhouse).

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Avoid local variable name "cell"

Rename local variables cell to cell_params. We are about to call some
other object "cell". No functional changes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Reorder error path of jailhouse_cell_create

We will add more rollback code that is executed errors. This step avoids
that all the rollback calls need to be guarded by "if (err)".

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Track all active cells

Create a kobject for every existing cell, including the root cell, and
add it to sysfs. This will allow to export state information etc. about
active cells later on and to maintain additional data over the lifetime
of a cell in the driver.

Moreover, we can now avoid trying to create a cell twice. This only
triggers a memory access violation when writing to the reserved memory
of the existing cell, effectively offlining the Linux CPU that tries it.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce and use for_each_cell

Encapsulate the common pattern to iterate over all cells.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/driver: Switch to ID-based cell addressing scheme

Return the cell ID on cell creation and request this ID instead of the
cell name for destruction. Will also help to keep future per-cell
hypercalls simple.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Inline cell_find

Only one user remaining, so it's simpler to merge it into its caller.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Documentation: Update and extend interface descriptions

First of all, introduce a glossary for key terms used in the Jailhouse
docs. It introduces the new terms "root cell" and "non-root cell". Then
extend and refactor the hypervisor interface descriptions, specifically
adding hypercalls for obtaining some basic diagnostic data. This data is
supposed to be exposed by the driver via sysfs. Start documenting its
structure.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Start exporting cell attributes via sysfs

Expose the cell ID via sysfs.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/x86: Provide "Cell Get State" hypercall

Implement the hypercall to retrieve the cell state. This is based on the
information the cell provides via its communication page (as long as it
is alive). So the value may be corrupt, and we need to check it before
returning it to the caller.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Expose cell state via sysfs

Make use of "Cell Get State" hypercall to export the cell state via its
sysfs directory.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/inmates: Rename cell "status" to "state"

Was called inconsistently in the documentation and the code.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Factor out generic panic_stop/halt services

These functions already contain too much generic logic, and panic_halt
will gain even more soon. Move them under the hood of the control module
and split them up into generic and arch-specific pieces.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Move fault handler to control.c

The fault module became so trivial that we can perfectly host it as part
of control.c, saving one set of code and header files. Rename the
exception handler to x86_exception_handler in order to mark it
architecture specific.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Mark CPU as "failed" after any violation

When marking a CPU that caused a fault in guest mode marked it as
"failed" until we forward it from the root cell or pass it back to it on
cell destruction.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Set cell state to "failed" if all its CPUs have failed

A cell that has crashed all its CPUs can be marked as failed. This means
that the root cell can destroy it even when it would otherwise ask for
permission first - there is no need to ask anymore, we are already deep
into an unordered cell shutdown at this point.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>