inmates: Make printk UART base configurable by inmates

This allows to use different UARTs for different inmates. For now, both
included examples continue to use the same.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates/configs: Use separate configs for tiny-demo and apic-demo

Split the inmate configs into to files, allowing the tiny-demo to run in
parallel to the apic-demo on a different CPU and at a different RAM
location. The tiny-demo is now on CPU 2 and uses the second UART. Note
that both cells use the PM timer, but shared access to it is harmless as
it is read-only.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Update README according to config changes, extend it

Reflect the split-up and renaming of inmate config files, and also
describe cell destruction and Jailhouse disabling at that chance.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Rename folder

We keep many of them here, at least more than one so far.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Rename folder

Same logic as for inmates: There is more than one config file kept here.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Remove mmio_lock

There is no state shared between CPUs when runngin mmio_parse. Also, we
no longer modify the hypervisor page table in a way that may require
synchronization: page_map_get_foreign_page only modifies a single PTE
in the given CPU's foreign mapping region. Since d401dba795 we no longer
unmap the foreign pages, only overwrite the mapping. And since
3c01f4192c we guarantee that all page directories are present for the
foreign mapping region. So let's get ride of this unneeded lock.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Convert global wait_lock into per-CPU control_lock

The wait_lock actually only protects CPU-specific fields, thus does not
need to be global. Convert it, and also document what it protects
precisely and under which conditions.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Introduce panic_halt

In case we can recover from a panic situation, either by destroying the
guest cell or by re-initializing the CPU from with that cell, we do not
need to enter the fatal stop state. Provide panic_halt for that
scenarios, it will park the faulted CPU in wait-for-SIPI state instead,
keeping virtualization enabled.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Park CPU on guest originated faults

If a guest CPU violates a cell boundary or cause an unhandled vmexit,
only park the CPU in non-root mode afterwards. This allows to recover
the CPU when its cell is destructed, e.g. Any fault we see in root mode
remains fatal, and we will continue to stop using the CPU from that on.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Perform initialization of UART console

Needed if we don't write to the same one as the hypervisor.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Rename jailhouse_memory::access_flags to flags

We will encode more than access types in them. No functional changes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce communication region

The communication region consists of memory shared between cells and the
hypervisor. One page is reserved for each cell so far, and an empty
jailhouse_comm_region structure is defined. The comm region is mapped
into a cell by defining a memory region with JAILHOUSE_MEM_COMM_REGION
set in its flags.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Prepare for error handling in shutdown

We are going to ask all none-Linux if they permit destruction. In case
they refuse, we need to handle this error and report it to all CPUs that
requested a shutdown via the hypercall.

Prepare the code for this by introducing a per-CPU shutdown_state. Its
default state is SHUTDOWN_NONE, thus no shutdown in progress. It is
set for all CPUs by the one that leads a shutdown either to
SHUTDOWN_STARTED or a negative error code. Then each CPU passing through
shutdown() can check if a) they are leading the shutdown and b) if an
already started shutdown failed and required to report the saved error
back.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Rename arch-specific hypercall headers

asm/jailhouse.h is too generic, these headers actually define the
arch-specific hypercall interface parts of Jailhouse. Rename them but
keep "jailhouse" as part of the name to avoid potential clashes over the
generic "asm/hypercall.h".

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce messaging interface via comm region

This adds an interface to send messages from the hypervisor to cells and
receive answers back. Messages and replies currently consists of plain
integer values. Inline helpers are provided (for x86 only so far) to
ensure proper ordering of comm region field updates.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce cell shutdown control interface

Using the messaging feature of the comm region, this introduces an
interface for cell to control their shutdown. The hypervisor sends a
shutdown request to a cell before destroying it. The cell can either
reject or accept the request in its reply message.

Cells can be excluded from this procedure and will continue to be
destructed immediately by setting the flag JAILHOUSE_CELL_UNMANAGED_EXIT
in their configuration file. For now we mark both demo cells as
unmanaged.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Demonstrate shutdown rejection in apic-demo

Enable managed shutdown in the apic-demo and reject the first request to
demonstrate the mechanism.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Allow a cell to declare itself terminated

This provides communication channel from the cell to the hypervisor to
signal cell termination, either regular one or after a failure. The cell
can set its cell_status field in the comm region for this purpose. The
hypervisor will take this field additionally into account when trying to
destroy a cell that requires managed shutdown.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Add cell_status support to apic-demo

Demonstrate the usage of the cell_status field in the comm region by
performing a self-shutdown after the first shutdown request.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>