core: Remove unused page_map_virt2phys

This might have been useful for reverse-walking hypervisor-provided
guest page tables, but there is still no use case in sight. Can be
reintroduced when needed.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Make sure that cpu suspension take precedence over INIT processing

If arch_suspend_cpu send by one CPU races with an INIT signal send by
another, make sure that we process the suspension first. Cell management
has high priority than intra-cell events.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Move CPU control logic from apic.c to control.c

A lot of APIC-unrelated CPU execution control piled up in apic.c.
Factor it out from the APIC core logic and move it over to x86/control.c
in order to keep duties separated.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Rename apic_deliver_[logical_dest]ipi -> apic_send_[logical_dest]ipi

Delivery takes place on the target CPU, sending is rather what we do
here. No functional changes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Reorganize vmx_handle_exit to have a common return-to-guest path

This common path will be exploited soon to check for pending SIPI
events.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Signal pending SIPI via per_cpu field

Instead of returning the pending SIPI vector from x86_handle_events,
mark its delivery as pending in struct per_cpu. This allows to call
x86_handle_events from more places without having to worry about the
returned SIPI vector. As sipi_vector == -1 is no longer a valid state
make it unsigned.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Make cell_suspend robust against concurrent invocations

If multiple CPUs race for cell_suspend of their own cell, we will
currently enter a deadlock. This resolves the issue by introducing a
cell state suspended and checking for that state under suspend_lock
before issuing arch_suspend_cpu for all cell CPUs. If the cell that is
supposed to be suspended is the cell of the issuing CPU and that cell is
already performing a suspension, the caller of cell_suspend will now
perform arch_suspend_self instead. This will make it wait properly for
cell resumption before trying its own suspension.

These changes turn cell_suspend/cell_resume in a lock-like service for
management work on the cell of the caller. That is effectively the Linux
cell as we reject management calls issued by other cells.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Replace shutdown_lock with cell_suspend/resume

Now that we can call cell_suspend concurrently, there is no more need to
use a separate lock during shutdown. Just let all Linux CPUs that are
issuing the shutdown hypercall be serialized via cell_suspend. Once the
shutdown has started, cell_suspend now refuses to suspend so that other
CPUs can shut themselves down directly.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Suspend non-Linux cells during shutdown

Just like we already do during cell destruction, we also have to suspend
non-Linux cell that are still running during a hypervisor shutdown. This
excludes race scenarios in cells with multiple CPUs.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
driver: Register reboot notifier to shut down Jailhouse

Provided the shutdown can be performed without problems, this allows to
clean up Jailhouse and all running cells before system reboot or
power-down.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>