core/configs/tools: Report IOMMU association of devices via config file

We will need this information for emulating VT-d for the root cell:

Add an iommu field to the PCI device config structure and encode the
unit number in the id field of the IOAPIC's irqchip structure.
The config generator fills the fields according to the DMAR ACPI table.
However, we do not yet understand all exotic forms of Device Scope
structures.

If it turns out that there are PCI devices without any IOMMU
association, refuse to generate a config file - such systems are
unsupported (with the temporary exception of AMD platforms).

Update the h87i config accordingly. QEMU currently only exposes a single
DMAR unit, thus the implicit zero-initialization is fine. As the IOMMU
number is only used in the context of the root cell, ioapic-demo and
pci-demo require no updates as well.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Reorder CPU initialization during setup

Make sure all CPUs are initialized prior to running the late setup. On
x86, we need the APIC map to be fully populated before performing the
VT-d handover.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Let arch_init_late decide when to map memory regions

When VT-d emulation is used on x86, will have to access the root cell's
memory during interrupt handover. This requires us to map the memory
regions right after vtd_init.

To enable this, move the decision when to map the regions into the hands
of arch_init_late. We provide map_root_memory_regions for this.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Introduce x2apic_filter_logical_dest

This helper matches a logical destination mask, redirection hint
enabled, against a cell CPU set and removes all the CPUs from the mask
that are not part of the cell. This can be used to filter/validate IRTE
parameters before programming them.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce accessors for current per_cpu fields

Reserve a register for a quick lookup of fields in the current per_cpu
data structure and enable the address, cpu_id and cell for such direct
access. The accessors are named this_<field>().

This will allow us to avoid passing context references around to deeply
nested users.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Enhance page_map_get_guest_page(s)

Generalize page_map_get_guest_page to map multiple pages in a single
run. Moreover, accept both guest-physical and guest-virtual addresses as
input: if pg_structs is NULL, a physical address is provided.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Remove cpu_data parameter from page_map_get_guest_pages

page_map_get_guest_pages is only allowed to work against the current
CPU. Now that we have this_cpu_data(), we can remove that parameter
from page_map_get_guest_pages to encode this in the API.

This also affects some (indirect) callers positively.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Switch cell_create to page_map_get_guest_pages

This consolidates the code and provides us guest address validation. The
latter is not yet critical as the configuration file may mess up much
more, but it's nice to have and may be beneficial once we can validate
configurations in some Linux-independent way.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Remove unused TEMPORARY_MAPPING_CPU_BASE

All users of the temporary mapping region shall reserve it via
page_map_get_guest_pages now.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce and use PAGES macro

PAGES(s) = PAGE_ALIGN(s) / PAGE_SIZE, a common pattern that can be
wrapped to avoid continuous open-coding.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Extend entry_valid paging callback to check for flags

Generalize the entry_valid callback of paging_structures to test for a
given set of flags, not only the present flag. This will allow us to
validate the access mode on guest and 2nd-level page table walks. For
now we just continue to test PAGE_PRESENT_FLAGS.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Validate access mode on guest page mappings

This extends [arch_]page_map_gphys2phys and also page_map_gvirt2gphys to
accept the required access mode for the target address and make them
validate if the guest would succeed when doing this on its own.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Emulate interrupt remapping support to enable x2APIC usage

If we want to use x2APIC on real hardware (virtual machines do not have
this limitation), interrupt remapping has to be enabled. As we take over
hardware control from Linux, we either have to switch the APIC modes on
handover (tricky specifically for x2APIC->xAPIC) or let Linux boot with
interrupt remapping already enable. We choose the latter way as the
cleaner one that also allow us to run Linux without xAPIC emulation
(non-root cells are expected to use the x2APIC unconditionally).

IR emulation requires both the interpretation of the interrupt remapping
table that Linux uses (vtd_get_remapped_root_int) as well as basic
queued invalidation emulation (vtd_emulate_qi_request). We also need to
handle FSTS register reads, but we simply return 0 here and let
Jailhouse report all faults.

Physical address provided by Linux via registers and data structures are
mapped on demand into the hypervisor. This avoids that we create a
static mapping that depends on Linux-controlled parameters (would be bad
for check-summing). We also make sure this way that the addressed memory
still belongs to Linux.

Returning IR and QI to Linux is more complex than stealing it because we
not only have to load overwritten registers with their original values:
the Invalidation Queue Head cannot be set by software. Instead, we need
to inject dummy invalidation wait requests until the hardware reaches
the value Linux expects.

Note that this IR emulation feature is solely designed to be used by the
root cell. Non-root cells have to continue to program the virtualized
interrupt registers of assigned devices.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Remove cpu_data parameter from panic_stop/halt functions

In many cases, we had no chance to pass a proper cpu_data to these
functions anyway. These days we have this_*() and can make use of it
also for panic stopping/halting.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Print associated cell on panic stop/halt

Helps debugging by clarifying the originating cell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Prepare PIO error reporting for multiple filters

To prepare the addition of the i8042 filter, rework the PIO access error
reporting so that only unhandled errors are printed by the dispatcher.
The PCI config space handler is extended to dump a specific message.
This pattern is analogous to MMIO handling.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Add i8042 moderation

To avoid that a cell can trigger a system reset or fiddle with the A20
gate via the keyboard controller i8042, intercept the command register
access. This happens for all cells, even when port access is granted.
The filter will only perform the access on behalf of the cell if port
access is granted in the cell's PIO bitmap - and the output port of the
i8042 is not touched as well.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: Release only ports 0x60, 0x61 and 0x64 to root cells

The i8042 is now moderated, just the NMI control registers needs a
second look and thought. Other ports in the range 0x60..0x67 should be
unused or are not wired up.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs/README: Fix and update QEMU config and demo description

The config file was no longer in sync with the setup described in the
README. Morever, we should include the HDA audio device in the QEMU
command line so that the pci-demo can be run. Update and enhance the
step-wise introduction in the README accordingly.

Include the virtio-9p-pci device in the config although we are not
referring to it in the README. It's an optional device at 00:1f.7, used
for local testings only.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
configs: h87i: Add non-cap config space regs for Intel HDA

They are all harmless. At least TCSEL is used on device initialization.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>