x86: Reject PCI config space writes to unowned devices

Align the PIO path with MMIO accesses: We should report any write to a
non-existing or unowned device as failure than silently swallowing it.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Rework PCI config space access handling

Move more logic into generic code by extending the write handler to
pci_cfg_write_moderate and introducing pci_cfg_read_moderate. These
handlers are responsible for any config space access, including to
unowned or non-existent devices. They can reject the access, return an
emulated value on read or a real value to be written to hardware, or
they instruct the caller to perform the access directly.

We already pass a reference to the issuing cell to the access handlers.
It stays unused for now but will be needed by succeeding changes. So
add it now to avoid changing API and callers once again later on.

This commit lays the foundation for capability access moderation and,
specifically, MSI/MSI-X emulation.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Minimize scope of pci_lock

Move PIO accesses and the related spinlock into data_port_in/out_handler
in order to reduce the lock contention time.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Enable unwinding from exception handler

Preserve the .eh_frame section for the linked hypervisor objection and
only remove it from the binary. Then add .cfi directives to the
exception entry code. This enables to use a debugger for unwinding from
the exception handler to the causing function and beyond (not perfect
due to missing stack frames, though).

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Fix error handling of MMCONFIG setup

If we have an MMCONFIG region, we must either successfully map it or
fail the initialization. Succeeding without setting up pci_space will
cause crashes later on when accessing it on behalf of a cell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Don't match MMIO accesses if there is no MMCONFIG space

Without this additional check, we will use addr >= (u64)-1 as upper
boundary if there is no MMCONFIG, which is almost always true.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Increase remapping region size

If we have to map the MMCONFIG space of a complete PCI section, we run
out of remapping space. 4 means 128K pages, more than enough for now.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Enable MMCONFIG moderation for QEMU Q35 and H87i

Exclude the MMCONFIG regions from memory regions so that Jailhouse can
intercept accesses. Not yet converted is the H700 config.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Tune memory regions of H87i

ACPI was off by one page, and two regions overlapped, exposing too much
access.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Update ACPI location and size of QEMU VM

The ACPI region size grew to 16K with latest QEMU. Adjust the config.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Allow writing to more PCI config space registers

Enable write access to the Master Latency Timer (non-functional for
PCIe) and the Cacheline Size (no misuse potential identified).

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Account for larger sets of CPUs

Reserves as many cpu set words as actually required. Format the
initialization in hex to improve readability with large numbers of CPUs.

Signed-off-by: Henning Schild <henning.schild@siemens.com>
[Jan: fixed trailing whitespace]
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Return empty dir list when running in generator mode

No point in returning valid results here. The files in this directory
may not be accessible for normal users, and then the collector
generation will fail prematurely.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Get rid of record switch in input_open

We no longer invoke input_open if the file is part of a recorded
directory. So this switch became obsolete.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Cleanup typos and style in collector template

No functional changes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Differentiate between optional and mandatory files during collect

Bail out if a required file is missing but continue without irritating
warnings if an optional one cannot be found.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Simplify optional file handling and generator mode

Stop passing exceptions from input_open to its callers: An optional file
can be returned as empty (derived from /dev/null), same on failures
during collector creation. The typical mode for input_open is 'r', so we
can save passing this explicitly in most cases. Same for optional which
is generally False.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Do not bail out on missing ACPI tables

Rather warn and give the user a chance to post-process the config file.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools: config-create: Sort listed directories

This will specifically ensure that PCI devices will be added to the
configuration file in a sorted manner which helps with manual
post-processing.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
tools/configs: Describe PCI capabilities in config files

Instead of parsing the PCI config spaces in the hypervisor, offload this
to the configuration generator. It will produce a (logically) linked
list of capabilities per device, their ID, start and length. Each
capability can furthermore be marked as writable by the cell.

Note that identical capability lists shared between multiple devices
will automatically folded into a single one. The user can duplicate and
customize them individually in a manual post-processing step.

Configurations are updated for QEMU, the H87i and the pci-demo cell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>