x86: Make sure that cpu suspension take precedence over INIT processing

If arch_suspend_cpu send by one CPU races with an INIT signal send by
another, make sure that we process the suspension first. Cell management
has higher priority than intra-cell events.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Move CPU control logic from apic.c to control.c

A lot of APIC-unrelated CPU execution control piled up in apic.c.
Factor it out from the APIC core logic and move it over to x86/control.c
in order to keep duties separated.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Rename apic_deliver_[logical_dest]ipi -> apic_send_[logical_dest]ipi

Delivery takes place on the target CPU, sending is rather what we do
here. No functional changes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Suspend non-Linux cells during shutdown

Just like we already do during cell destruction, we also have to suspend
non-Linux cell that are still running during a hypervisor shutdown. This
excludes race scenarios in cells with multiple CPUs.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Register reboot notifier to shut down Jailhouse

Provided the cell shutdown can be performed without problems, this
allows to clean up Jailhouse and all running cells before system reboot
or power-down.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Fix state test in vmx_schedule_vmexit

Obviously broken. This could cause hypervisor faults, e.g. when sending
NMI IPIs to a CPU in panic state.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Add barrier after vmx_state to VMXOFF

This plugs potential races between vmx_cpu_exit switching VMX mode off
and vmx_schedule_vmexit still accessing the VMCS of the same CPU.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Loop over hlt in shutdown state

If an NMI should hit us while waiting for Linux to get this CPU online
again, we should avoid resuming execution of the hypervisor code. The
active hypervisor page table may not allow us to cause much damage, but
it's better to not rely on this.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Don't switch off virtualization on panic stops

This CPU is lost until the next system reset. Disabling VMX mode doesn't
buy us anything, so drop that line of code.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>