core: Drop "Parking CPU" printk from cell_destroy

Reporting that a CPU of a to-be-destroyed cell was parked does not
provide much information. We do not consistently print messages in other
cases when we park CPUs, and the CPU will quickly be resume by Linux
after cell destruction.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Clear/set assigned root CPUs unconditionally

It does not matter for the list of CPUs assigned to the root cell if a
CPU is currently online or not - the hypervisor will revoke access
unconditionally. Consequently, we also have to restore all those CPUs.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Restore list of assigned root CPUs on cell creation error

Make sure we don't "lose" CPUs on cell creation failures.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Use cell's cpus_assigned to offline/online CPUs

Avoid the cell config for CPU list iteration, rather use what we store
in the cell structure anyway: cpus_assigned. This helps to overcome
dependencies on the config passed on other management commands than cell
create.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Filter out offline CPUs from assigned root CPUs

The hypervisor will not allow access to CPUs that are offline during
setup. So drop them from the list of assigned root CPUs.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Catch invalid CPU mask on cell creation

The hypervisor will detect itself when a CPU is to be assigned to a new
cell that does not belong to the root cell. However, our bookkeeping
will become messed up when we rely on this. So catch it before touching
the root cell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Use for_each_cpu rather than for_each_cpu_mask

The former, modern version takes a potential dynamic mask limit into
account.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: Rework help function in jailhouse tool

Instead of invoking exit() at each caller site of help(), move it into
that function but also avoid return a non-zero status code when --help
was requested properly.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver/tools: Switch to ID/name-based cell addressing

No longer request to cell config file for destroying a cell. Rather
use its name or its hypervisor-assigned ID. Numerical parameters are
assumed to be IDs unless --name is prepended.

This pattern will be used in all upcoming cell management commands.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Align demo cell names to file names

Avoid spaces in the name and align them to their file names to make them
more convenient for command line use - now that we accept names for
addressing cells.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Factor out cell_management_prologue

As we will introduce more cell management hypercalls, factor out a
common prologue of their services handlers.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/driver: Introduce and use Cell Start hypercall

This breaks up creation and start of execution of the a cell, a
precondition for enabling cell reload without destruction/recreation.
The new Cell Start hypercall can also be used to restart an already
running cell, thus access control needs to be applied.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Wait for idle UART before starting APIC demo

Cosmetic change to avoid unreadable output on the so far shared first
serial console. This become necessary after we moved the output of cell
start after the submission of reset signals to the cell CPUs.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/configs: Rename cell flag "Unmanaged Exit" to "Passive Comm Region"

The purpose of this flag is to enable simple cells that do not actively
participate in the Communication Region protocols. The fact that we can
be shut down without prior consultation is one result of this but will
not be the only one in the future. Moreover, we may once use the Comm
Region to pass read-only information to the cells - without requiring
every cell to use the region actively or even map it.

Rename the flag to reflect its refined semantic.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/inmates: Generalize message channel of comm region

Prepare the message channel for further message types by generalizing
the replies: requests can be denied or accepted, there is a specific
code to be sent back on reception of unknown messages, and messages can
also be for information only. This allows to factor out a reusable
cell_send_message service.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/driver: Add reconfiguration lock

Introduce the concept of a reconfiguration lock. A cell can activate
this lock by changing its state to "Running/Locked". The lock is checked
by the hypervisor before changing the system configuration via creating
or destroying a cell. This gives cells participating in the
Communication Region protocol the chance to prevent reconfigurations,
thus freezing the system setup. A cell that is supposed to be destroy
does not participate in this voting because it will already receive the
shutdown request.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Block reconfigurations during execution of APIC Demo

Extend the APIC demo to lock all cell configurations while it is
running. This lock can be resolved by destroying the APIC demo cell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Add reconfiguration completion notification

Send an information message to all non-root cells after a cell
reconfiguration is completed. This allows non-root cells to react on
this event, e.g. by freezing the configuration after the expected set of
cells was created.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Factor out unmap_from_root_cell

We will reuse this service soon.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Allow remap_to_root_cell to bail out on errors

When soon using remap_to_root_cell in scenarios that shall report
potential errors of this function, we need to make it return those. As
we still want to use it were errors are both unlikely and cannot be
handled properly, introduce a parameter that controls the error
behavior: ABORT_ON_ERROR or WARN_ON_ERROR.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>