core: Document implicit synchronization between cell/cpu_get_state and cell_create/destroy

It may not be obvious why we do not need to synchronize with cell
creation/destruction while accessing cell data structures from the
get_state hypercalls.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Generic hypercall dispatching

Move the switch-case part of vmx_handle_hypercall into a generic
hypercall dispatcher.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/driver: Remove multi-arg support for hypercalls

There is no scenario is sight where we may need to pass more than one
argument to a hypercall. So remove the related infrastructure and update
the ABI documentation for zero or single-argument hypercalls only.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Factor out cell_management_prologue

As we will introduce more cell management hypercalls, factor out a
common prologue of their services handlers.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Drop printk from cell_suspend

This message lacks corresponding resumption printouts. As we will create
even more of them due to the breakup of the cell management hypercalls,
it's cleaner to drop this debug output.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/driver: Introduce and use Cell Start hypercall

This breaks up creation and start of execution of the a cell, a
precondition for enabling cell reload without destruction/recreation.
The new Cell Start hypercall can also be used to restart an already
running cell, thus access control needs to be applied.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Wait for idle UART before starting APIC demo

Cosmetic change to avoid unreadable output on the so far shared first
serial console. This become necessary after we moved the output of cell
start after the submission of reset signals to the cell CPUs.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/configs: Rename cell flag "Unmanaged Exit" to "No Comm Region"

The purpose of this flag is to enable simple cells that do not
participate in the Communication Region protocols. The fact that we can
be shut down without prior consultation is one result of this, but will
not be the only one in the future. So rename the flag to better reflect
its semantic.

Note that we will continue to initialize the communication region of a
cell even if the flag is set for it. It is simply not worth to consider
this case and skip the code related code.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce and use for_each_non_root_cell

Add a macro for iterating over all cells except for the root cell. We
already have two use case that can be converted.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/inmates: Generalize message channel of comm region

Prepare the message channel for further message types by generalizing
the replies: requests can be denied or accepted, there is a specific
code to be sent back on reception of unknown messages, and messages can
also be for information only. This allows to factor out a reusable
cell_send_message service.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/driver: Add reconfiguration lock

Introduce the concept of a reconfiguration lock. A cell can activate
this lock by changing its state to "Running/Locked". The lock is checked
by the hypervisor before changing the system configuration via creating
or destroying a cell. This gives cells participating in the
Communication Region protocol the chance to prevent reconfigurations,
thus freezing the system setup. A cell that is supposed to be destroy
does not participate in this voting because it will already receive the
shutdown request.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Block reconfigurations during execution of APIC Demo

Extend the APIC demo to lock all cell configurations while it is
running. This lock can be resolved by destroying the APIC demo cell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Add reconfiguration completion notification

Send an information message to all non-root cells after a cell
reconfiguration is completed. This allows non-root cells to react on
this event, e.g. by freezing the configuration after the expected set of
cells was created.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Factor out unmap_from_root_cell

We will reuse this service soon.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Allow remap_to_root_cell to bail out on errors

When soon using remap_to_root_cell in scenarios that shall report
potential errors of this function, we need to make it return those. As
we still want to use it were errors are both unlikely and cannot be
handled properly, introduce a parameter that controls the error
behavior: ABORT_ON_ERROR or WARN_ON_ERROR.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Add Cell Reload hypercall

Provide the new hypercall "Cell Reload". It has the semantic of
suspending an existing cell and remapping all its memory regions that
are marked reloadable back to the root cell.  On cell start, all its
reloadable regions that are mapped to the root cell will be unmapped
from it again.

This enables reloading of non-root cells without the so far required
cell destruction/recreation cycle.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver/tools: Refactor IOCTL data structures

Rename the structures used in the driver's IOCTLs: jailhouse_new_cell to
jailhouse_cell_init, jailhouse_cell to jailhouse_cell_cfg. Also use
jailhouse_cell_cfg inside jailhouse_cell_init. This shall make the
semantic of those structures clearer, specifically as the
jailhouse_cell_init structure will be reused to the reload IOCTL.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Factor out get_config

Factor out a helper function that reads the user-provided configuration
into a dynamically allocated kernel buffer.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver/tools: Add and use cell reload IOCTL

Provide "jailhouse cell reload ..." to shutdown a running cell, reload
code and data into the cell and then start it gain. This service is
implemented as a new driver IOCTL.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Mark RAM of tiny-demo and apic-demo cells reloadable

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>