core: Consider fragmentation in page allocator

Rework the page allocator to be bit less simplistic and take
fragmentation of the free page bitmap into account. Such fragmentation
is more likely to occur when cells get created and destroyed.

The algorithm for find n contiguous pages in page_alloc now looks like
this: Find the first free page, starting at bitmap position 0, then
check if n-1 directly succeeding pages are free as well. If one page is
not adjacent, use that page as start page for another search round.
Search ends as soon as the page index reaches the total number of pages
in a pool.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Consolidate cpuid_eax and cpuid_ecx definitions via a macro

Only the register name varies, and we can save some lines of code with
the help of the preprocessor.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Introduce fine-grained flush_cache

To avoid having to flushe the full cache, introduce a more fine-grained
flush_cache helper that uses clflush on x86.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Add support for cache-coherent changes to page tables

Extend page_map_create and page_map_destroy with a parameter that
controls cache flushes after page table changes. This feature is useful
for changes on VT-d tables, therefore only related invocations will be
tagged with PAGE_MAP_COHERENT, the rest remains PAGE_MAP_NON_COHERENT.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Replace wbinvd on vtd_cell_init with focused flush_cache calls

Instead of force a complete cache flush, only mark those root entries
and context entries invalid that are actually changed. The DMA page
table creation was already marked as coherent.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Limit domain IDs to maximum that all DMAR units support

VT-d spec says that we must not use the same DID for different domain,
namely for different DMA page tables. So reject any cell with an ID
larges than the range that all DMAR units support.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Require DMAR units with CM=0

According to the spec, all hardware implementation have to support cache
mode 0, i.e. they do not cache invalid remapping table entries. We
target real hardware and will make use of this property, so validate
this assumption during startup.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Minor cleanup of DMAR unit enabling

No need to check per unit if it is enabled, we require all of them to be
off initially: if the first one is on, all are on.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Officially focus vmx_cell_shrink on the Linux cell

Let's make it clear: vmx_cell_shrink shall only be used to shrink the
Linux cell by a given config. Rename the function and reduce its
parameter list accordingly.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Reconfigure DMAR units on cell creation

Remove devices that shall be assigned to a newly created cell from
Linux. Then we can initialize the new cell regularly via vtd_cell_init.
We use a register-based cache flush on Linux cell shrinking, requesting
domain granularity for the flush. As the page table will be new and all
reassigned devices are disabled before entry of vtd_cell_init, there is
no need to flush caches after the creation.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/driver: Introduce jailhouse_cell_mem_regions helper

Given a cell configuration, this function returns a pointer to the first
memory region. Use it instead of open-coding the address calculation.
This requires marking several pointers to jailhouse_memory as
referencing a constant data structure.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce jailhouse_cell_pio_bitmap helper

Given a cell configuration, this function returns a pointer to the PIO
bitmap. Use it instead of open-coding the address calculation.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core/driver: Introduce jailhouse_cell_cpu_set helper

Given a cell configuration, this function returns a pointer to the CPU
set. Use it instead of open-coding the address calculation.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Introduce jailhouse_cell_pci_devices helper

Given a cell configuration, this function returns a pointer to the first
PCI device. Use it instead of open-coding the address calculation.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Generic memory region handling on cell destruction

Most of vmx_remap_to_linux and also the memory region loop in
vmx_cell_exit are generic and can be reused for adding VT-d support and,
later on, different architectures. So move the generic bits to the core
and provide arch_map_memory_region and arch_unmap_memory_region instead.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Release VT-d resources on cell destruction

Corresponding to VMX, implement vtd_map_memory_region,
vtd_unmap_memory_region and vtd_cell_exit so that we can drop all VT-d
related resources of a cell on its destruction and, according to the
configuration, reassign them back to Linux.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Suspend cell before its destruction

To avoid that CPU parking races with INIT/SIPI signals sent by not yet
parked CPUs of the same cell, stop all cell CPUs first.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Enforce cell creation and hypervisor shutdown to run over Linux

The rule is already encoded for cell destruction, also establish it
formally for cell creation and Jailhouse shutdown: The code is not yet
prepared to take those commands over non-Linux cell. May change one day
(if there will be a use case), but for now play safe and reject rule
violations, now with the error code -EPERM.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Factor out interrupt_entry macro

Move the interrupt entry code into an assembly macro so that it can be
reused for other interrupts than the NMI.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Introduce enable_irq and disable_irq inline helpers

To be used soon for APIC interrupt draining.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>