x86: Re-park CPU while in wait-for-SIPI state

We may receive IPIs, e.g. to stop the CPU, while in wait-for-SIPI state.
In this case, we must park the CPU again before leaving
x86_handle_events. Currently, we resume CPU execution erroneously.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Update TODO list

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Simplify config field accessors

Express config field accessors by using the accessor of the previous
field. This removes duplicate statements for field sizes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Clean up PIO bitmaps

Remove unneeded access permissions to PIC1 from all config. DMA and IDE
access is only relevant to QEMU in PIIX2 mode, so drop this from real
machines and the config template. ACPI access is also not needed during
typical operation, nor is it safe.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Account for larger sets of CPUs

Reserves as many cpu set words as actually required. Format the
initialization in hex to improve readability with large numbers of CPUs.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Return empty dir list when running in generator mode

No point in returning valid results here. The files in this directory
may not be accessible for normal users, and then the collector
generation will fail prematurely.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Get rid of record switch in input_open

We no longer invoke input_open if the file is part of a recorded
directory. So this switch became obsolete.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Cleanup typos and style in collector template

No functional changes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Differentiate between optional and mandatory files during collect

Bail out if a required file is missing but continue without irritating
warnings if an optional one cannot be found.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Simplify optional file handling and generator mode

Stop passing exceptions from input_open to its callers: An optional file
can be returned as empty (derived from /dev/null), same on failures
during collector creation. The typical mode for input_open is 'r', so we
can save passing this explicitly in most cases. Same for optional which
is generally False.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Do not bail out on missing ACPI tables

Rather warn and give the user a chance to post-process the config file.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Reject PCI config space writes to unowned devices

Align the PIO path with MMIO accesses: We should report any write to a
non-existing or unowned device as failure than silently swallowing it.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Rework PCI config space access handling

Move more logic into generic code by extending the write handler to
pci_cfg_write_moderate and introducing pci_cfg_read_moderate. These
handlers are responsible for any config space access, including to
unowned or non-existent devices. They can reject the access, return an
emulated value on read or a real value to be written to hardware, or
they instruct the caller to perform the access directly.

We already pass a reference to the issuing cell to the access handlers.
It stays unused for now but will be needed by succeeding changes. So
add it now to avoid changing API and callers once again later on.

This commit lays the foundation for capability access moderation and,
specifically, MSI/MSI-X emulation.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Minimize scope of pci_lock

Move PIO accesses and the related spinlock into data_port_in/out_handler
in order to reduce the lock contention time.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Enable unwinding from exception handler

Preserve the .eh_frame section for the linked hypervisor objection and
only remove it from the binary. Then add .cfi directives to the
exception entry code. This enables to use a debugger for unwinding from
the exception handler to the causing function and beyond (not perfect
due to missing stack frames, though).

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Fix error handling of MMCONFIG setup

If we have an MMCONFIG region, we must either successfully map it or
fail the initialization. Succeeding without setting up pci_space will
cause crashes later on when accessing it on behalf of a cell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Don't match MMIO accesses if there is no MMCONFIG space

Without this additional check, we will use addr >= (u64)-1 as upper
boundary if there is no MMCONFIG, which is almost always true.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Increase remapping region size

If we have to map the MMCONFIG space of a complete PCI section, we run
out of remapping space. 4 means 128K pages, more than enough for now.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Enable MMCONFIG moderation for QEMU Q35 and H87i

Exclude the MMCONFIG regions from memory regions so that Jailhouse can
intercept accesses. Not yet converted is the H700 config.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Tune memory regions of H87i

ACPI was off by one page, and two regions overlapped, exposing too much
access.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>