tools: Fix freeing of image memory after cell creation

Regression of 95666fd1: We are not allocating multiple images, and the
image variable does not point to a valid address when we try to free the
former only image at the end of cell_create. Properly loop over all the
images for freeing.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
gitignore: Exclude vi temp files

Do not track temporary files created by vi.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Documentation: a few cosmetic changes

Signed-off-by: Henning Schild <henning.schild@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Factor out cell_management_prologue

As we will introduce more cell management hypercalls, factor out a
common prologue of their services handlers.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Drop printk from cell_suspend

This message lacks corresponding resumption printouts. As we will create
even more of them due to the breakup of the cell management hypercalls,
it's cleaner to drop this debug output.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/driver: Introduce and use Cell Start hypercall

This breaks up creation and start of execution of the a cell, a
precondition for enabling cell reload without destruction/recreation.
The new Cell Start hypercall can also be used to restart an already
running cell, thus access control needs to be applied.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Wait for idle UART before starting APIC demo

Cosmetic change to avoid unreadable output on the so far shared first
serial console. This become necessary after we moved the output of cell
start after the submission of reset signals to the cell CPUs.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/configs: Rename cell flag "Unmanaged Exit" to "No Comm Region"

The purpose of this flag is to enable simple cells that do not
participate in the Communication Region protocols. The fact that we can
be shut down without prior consultation is one result of this, but will
not be the only one in the future. So rename the flag to better reflect
its semantic.

Note that we will continue to initialize the communication region of a
cell even if the flag is set for it. It is simply not worth to consider
this case and skip the code related code.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce and use for_each_non_root_cell

Add a macro for iterating over all cells except for the root cell. We
already have two use case that can be converted.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/inmates: Generalize message channel of comm region

Prepare the message channel for further message types by generalizing
the replies: requests can be denied or accepted, there is a specific
code to be sent back on reception of unknown messages, and messages can
also be for information only. This allows to factor out a reusable
cell_send_message service.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/inmates: Add reconfiguration voting

Introduce a reconfiguration request that is sent to all non-root cells
before changing the system configuration via creating or destroying a
cell. This gives cells participating in the Communication Region
protocol the change to vote against reconfigurations, thus freezing the
system setup. A cell that is supposed to be destroy does not participate
in this voting because it will already receive the shutdown request.

The APIC demo is extended to vote against reconfigurations while it is
running. This demonstrates a configuration freeze. It can be resolved by
destroying the APIC demo cell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Add reconfiguration completion notification

Send an information message to all non-root cells after a system
reconfiguration is completed. This allows non-root cells to react on
this event, e.g. by freezing the configuration after the expected set of
cells was created.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Factor out unmap_from_root_cell

We will reuse this service soon.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/configs: Introduce concept of loadable memory regions

Loadable memory regions are useful to allow the root cell to load code
and data into an already created non-root cell before it is started.
This feature is a precondition for reloading non-root cells without a
complete cell destruction/recreation cycle.

This feature is realized via an additional memory region flag. When set,
the region will remain accessible for the root cell until the Cell Start
hypercall is issued.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Allow remap_to_root_cell to bail out on errors

When soon using remap_to_root_cell in scenarios that shall report
potential errors of this function, we need to make it return those. As
we still want to use it were errors are both unlikely and cannot be
handled properly, introduce a parameter that controls the error
behavior: ABORT_ON_ERROR or WARN_ON_ERROR.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Add Cell Reload hypercall

Provide the new hypercall "Cell Reload". It has the semantic of
suspending a preexisting cell and remapping all its memory regions that
are marked loadable back to the root cell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver/tools: Refactor IOCTL data structures

Rename the structures used in the driver's IOCTLs: jailhouse_new_cell to
jailhouse_cell_init, jailhouse_cell to jailhouse_cell_cfg. Also use
jailhouse_cell_cfg inside jailhouse_cell_init. This shall make the
semantic of those structures clearer, specifically as the
jailhouse_cell_init structure will be reused to the reload IOCTL.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Factor out get_config

Factor out a helper function that reads the user-provided configuration
into a dynamically allocated kernel buffer.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver/tools: Add and use cell reload IOCTL

Provide "jailhouse cell reload ..." to shutdown a running cell, reload
code and data into the cell and then start it gain. This service is
implemented as a new driver IOCTL.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>