x86: Fix state test in vmx_schedule_vmexit

Obviously broken. This could cause hypervisor faults, e.g. when sending
NMI IPIs to a CPU in panic state.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Add barrier after vmx_state to VMXOFF

This plugs potential races between vmx_cpu_exit switching VMX mode off
and vmx_schedule_vmexit still accessing the VMCS of the same CPU.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Make printk UART base configurable by inmates

This allows to use different UARTs for different inmates. For now, both
included examples continue to use the same.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates/configs: Use separate configs for tiny-demo and apic-demo

Split the inmate configs into to files, allowing the tiny-demo to run in
parallel to the apic-demo on a different CPU and at a different RAM
location. The tiny-demo is now on CPU 2 and uses the second UART. Note
that both cells use the PM timer, but shared access to it is harmless as
it is read-only.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Update README according to config changes, extend it

Reflect the split-up and renaming of inmate config files, and also
describe cell destruction and Jailhouse disabling at that chance.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
gitignore: Exclude all *.bin files

We don't want to track any binary file at all.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
inmates: Rename folder

We keep many of them here, at least more than one so far.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Rename folder

Same logic as for inmates: There is more than one config file kept here.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Look over hlt in shutdown state

If an NMI should hit us while waiting for Linux to get this CPU online
again, we need to avoid resuming execution of the hypervisor code.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Introduce panic_halt

In case we can recover from a panic situation, either by destroying the
guest cell or by re-initializing the CPU from with that cell, we do not
need to enter the fatal stop state. Provide panic_halt for that
scenarios, it will park the faulted CPU in wait-for-SIPI state instead,
keeping virtualization enabled.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Don't switch off virtualization on panic stops

This CPU is lost until the next system reset. Disabling VMX mode doesn't
buy us anything, so drop that line of code.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Park CPU on guest originated faults

If a guest CPU violates a cell boundary or cause an unhandled vmexit,
only park the CPU in non-root mode afterwards. This allows to recover
the CPU when its cell is destructed, e.g. Any fault we see in root mode
remains fatal, and we will continue to stop using the CPU from that on.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>