Convert license tags to SPDX identifiers

This commit also converts our own copyright headers to directly use
SPDX, but leaves all other copyright header intact, only adding the
SPDX ident. As far as possible this commit also merges multiple
Data61 copyright statements/headers into one for consistency.

arm: remote IPI call support for VIRQS

Added support for injecting remote IPI calls towards given VCPU's
on SMP configured systems. This introudcing a new type of
IpiRemoteCall and handlers for updating the vgic state on
incoming/outgoing IPI's.

Co-authored-by: Yanyan Shen <yanyan.shen@data61.csiro.au>

arm-hyp: bound check irq in decodeVCPUAckVPPI

Provide an error if IRQ is outside of valid Arch_checkIRQ bounds.

arm-hyp: thread runnable check before handleFault

At this time verification does not have a provable link between the
current active VCPU and the current thread which would allow concluding
the current thread is runnable when the current VCPU is active. To
handle a fault, the current thread must be runnable.
Added extra checks to VGICMaintenance and VPPIEvent.

arm_hyp: return error in decodeVCPUAckVPPI

An invalid VPPI caused out-of-bounds array access due to missing return
statement.

VGICMaintenance: Update spurious check

Ignore any VGIC maintenance interrupts that arrive if a VCPU isn't
currently running.

arm_hyp: Save and restore vtimer state on switches

Added support for reading and writing additional virtual timer
registers for vcpu hw read and write accesses. These include the
compare value register (CNTV_CVAL) and offset register (CNTV_OFF),
each represented as two 32 bit (high and low) registers on aarch32 and
as single 64 bit registers on aarch64.

Added support for explicitly saving and restoring the virtual
timer registers when the vcpu is enabled and disabled. This
ensures when the vcpu is switched in and out, the virtual timer
registers are restored to a state that is consistent to when
it was last run.

By default the CNTVOFF register will be updated by the kernel to
accumulate the time the VCPU is not running. From the guest this will
result in the VCNT register not increasing when the VCPU is suspended.
This behavior can be turned off by disabling the
KernelArmVtimerUpdateVOffset config option.

arm: New virtual PPI event fault type

This commit introduces a new fault type, seL4_Fault_VPPIEvent.

This change means the kernel can reserve PPI interrupts and virtualise
them via delivering the irq to the active vcpu through a
specific fault. This enables multiplexing PPI IRQs across multiple VCPUS
which requires correctly masking and unmasking the IRQ depending on
which VCPU is running.

A new VCPU invocation, seL4_ARM_VCPU_AckVPPI is also added for
acknowledging the handling of the IRQ. This takes an IRQ as a parameter
but will only accept IRQ numbers that are sent as VPPIEvent faults.

Co-authored-by: Rafal Kolanski <rafal.kolanski@data61.csiro.au>
Co-authored-by: Kent McLeod <Kent.Mcleod@data61.csiro.au>

arm_hyp: Remove some vcpu_* wrapper functions

These functions have entirely arch specific implementations so remove
function wrapping indirection to ease maintainability.

arm_hyp: Refactor code into arch headers

Move vcpu functions that are specific to a particular Arm architecture
version into the relevant header files. Also move some generic functions
into the generic vcpu header file for use by arch specific headers.

aarch64: Move tpidrro_el0 from vcpu to tcb context

This register is visible to software executing at EL0 but not writeable.
Storing it in the VCPU context required custom save/restore handling as
it had to be explicitly handled when switching from a VCPU thread to a
non-VCPU thread so that it didn't become a channel. It is possible to
now update this register via seL4_TCB_WriteRegisters for software
executing at EL0.

This also fixes a potential bug where if a vcpu-thread is switched for a
non-vcpu-thread and then switched to a different vcpu-thread the
original vcpu-thread's copy of this register will get set to 0.

mcs: tickless scheduler implementation

This changes the budget/remaining fields in scheduling contexts
to contain timer ticks, not number of abstract sel4ticks.

seL4_SchedControl_Configure now takes microseconds, not ticks.

This commit is plat-independant - the platform and arch specific
timer code follows in later commits.

arm: Rename gic_pl390 to gic_v2

This is to reflect that this driver provides support for features that
are newer than gic_pl390 such as virtualisation.

RFC-3: Update user context for ARM with thread IDs

Switched appropriate naming conventions.
Was using the aarch64, have switched to aarch64 names.

TIPDRURW -> tpidr_el0
TPIDRURO -> tpidrro_el0
TPIDRPRW -> tpidr_el1

Switch TLS register on aarch32 from TPIDURO (tpidrro_el0) to tpidr_ro so
that it can be written to from user-land.

Thread ID registers tpidr_el0 have been added to the user context for
aarch32 and aarch64.

Only the thread ID that is writeable from EL0 is saved in the TCB and
saved/restored on context switch.

Thread IDs that are only changed within a VM (the read-only thread ID
for exception level 0 and the thread ID for exception level 1) are
stored in the VCPU and saved and stored as part of VM enable/disable.

Thread IDs that are only changed with VMs have been separated out into
hypervisor code.

style: consistently attach return type

Add attach-return-type to astyle

style: consistently align pointer with name

Run astyle with align-pointer=name

style: correct parenthesis padding

Use astyle's unpad-paren to unpad all parentheses that are not included
by pad-header, pad-oper, and pad-comma.

aarch32: Rework access of fpu control registers

GCC accepts MCR/MRC instructions to modify fpu control registers. Clang
does not. VMSR/VMRS are instructions that the ARM specification suggests
to use when accessing fpu control registers.

arm: Make Arm VCPU states per-node.

ARM: stop using plat/machine/devices.h

This header is going away and contains nothing of substance. Remove it.

arm/hyp: Guard armv7-only FPU access function

armv7/hyp: Move armv7 code armv7-a/armv/vcpu.h

arm/hyp: uint32 -> word_t

arm/hyp: Fix style

arm/hyp: Use vcpu_read/write_reg instead

arm/hyp: Fix typo TTBRC -> TTBCR

arm/hyp: Write VCPU's SCTRL when inactive

arm/hyp: Fail for invalid index or null vcpu.

arm/hyp: Add inlines for CNTV_TVAL and CNTV_CTL.

arm: Change TTBR0/1 read/write function names.

The following functions, readTTBR0, writeTTBR0, readTTBR1, and
writeTTBR1, write and return raw TTBR0/1 values.
The function writeTTBR0Ptr is added for used in context swtich
functions, and it modify the input physical address before
writing the TTBR0. Places using these functions are also
updated.

arm/hyp: Remove CNTV_CVAL

arm/hyp: Remove redundant check.

arm/hyp: access_reg to vcpu_hw_read/write_reg

arm/hyp: refactor VCPU states

Use an array and constants to replace register names in the VCPU.

arm/hyp: add support for running multiple ARM VMs

This commit saves/restores various control registers that can be
modified by guest VM kernels, so seL4 can execute multiple ARM
32-bit VMs multiplexing a single physical core.

When the CONFIG_HAVE_FPU option is selected, the commit allows
the VMs to use FPU registers and enables lazily saving/restoring
FPU registers for the VMs.

armv8/hyp: Parse inputs for VCPUInjectIRQ

armv8/hyp: Sync the status of vgic.lr

arm/hyp: Call aarch64 VCPU functions

arm/hyp: Call aarch64 vcpu_enable/disable code

arm/hyp: ksCurThread -> NODE_STATE(ksCurThread)

armv7/hyp: Move v7 hyp code to armv7-a/armv/vcpu.h

arm/hyp: uint32_t -> word_t

arm/hyp: Move common HCR macros to vcpu.h

arm: Move VGIC code to gic_pl390 files

[STYLE_FIX]

arm-hyp: refactor VGICMaintenance to avoid potential overflow

seL4_Fault_VGICMaintenance can store indices up to 63, but
ctzl(eisr1) + 32 can be 64.

Also move current_fault assignment to after hardware interaction
for simpler verification conditions.

Refactor sanitiseRegister to take a bool rather than a (tcb_t *).

This involves adding a function to determine if a tcb has a vcpu, and
makes verification a lot easier for arm-hyp.

Fix out-by-1 in decodeVCPUInjectIRQ

arm-hyp: get gic_vcpu_num_list_regs via a local variable in vcpu_save and vcpu_restore

arm: Check current thread isRunnable in VGICMaintenance

This check should never be false, but is added until this fact can be proven

arm: Set badgeRegister in invokeVCPUReadReg

To be a proper kernel reply the badgeRegister should be set to 0

arm: Lookup IPCBuffer in invokeVCPUReadReg and use setMR

arm: Pass 'call' down to invokeVCPUReadReg

invokeVCPUReadReg should not be setting message registers for the return message unless
the user performed a call. In doing so we must refactor the call to readVCPUReg to
outside the introduced `if` condition since, as it performs machine operations, it
should always happen

arm-hyp: vcpu_disable, split reading and setting of registers for easier verification

arm-hyp: change the type of i in the loops in vcpu_restore and vcpu_save

arm: Swap lines for verification simplicity

arm hyp: make invokeVCPUInjectIRQ index arg unsigned long

Argument passed to it comes directly from a word_t so it shouldn't be
signed. Also, verification.

SELFOUR-836: arm-hyp: Config option for saving/loading vs trapping debug state

Provides a configuration option for enabling HDCR.TD* traps, or saving and loading debug
state on VCPU switches. Currently verification only plans to support the trap setting.

As this option complicates all of the #ifdef's related to debug registers even further,
abstractions for enabling/disabling each individual piece of the debug code for different
configuration options are also implemented.

Part of these refactored #ifdef guards was to remove the guards completely from libsel4
around the definitions of the number of breakpoints and watchpoints.

SELFOUR-836: Hardware debug API functions should take tcb_t and not arch_tcb_t

Touches files all throughout x86 (32 and 64) and ARM.

rename arch_tcb.vcpu -> arch_tcb.tcbVCPU, vcpu.tcb -> vcpu.vcpuTCB

struct vcpu { struct tcb* tcb; ...
struct arch_tcb { struct vcpu* vcpu; ...
and
struct tcb { struct arch_tcb tcbArch; ...

These conspire to generate a type error on verification side due to
assumptions about non-colliding names.

SELFOUR-836: Fix build error in verification build

SELFOUR-836: Disable debug context save/restore between VMs

This patch disables the debug register state save and restore on ARM-hyp,
such that Guest VMs can now interfere with one another and trigger
one another for certain limited scenarios. This will be undone later on.

Pass tcb_t to sanitiseRegister instead of arch_tcb_t

Add PL0 debug-API support for hyp-mode kernel

This patch enables the hype-mode kernel to intercept non-secure PL0
debug exceptions. Since it uses the HDCR register to do this (and not the SDCR),
it consequentially has no effect on any secure-monitor that may be executing
alongside the hypmode kernel.

For native seL4-hyp user threads, when the CPU sees a need to raise a debug
exception that was taken from PL0 (user), it will naturally try to raise that
exception to PL1 (supervisor).

But since seL4 is in PL2 and not PL1, seL4 has not set up an exception vector
table (VBAR) for PL1. So when the CPU attempts to vector into the PL1 VBAR,
it just gets a data abort, which it then delivers to PL2.

This patch causes the PL2 seL4 hypervisor to directly catch the debug exception
straight from PL0 and process the debug exception directly, for native threads.

Guest VM VCPUs are unaffected by this change. Their debug exceptions are delivered
to the Guest VM's PL1 VBAR as per usual.

ARM-HYP: Add support for save/restore of debug registers

As things are now, the Guest VMs can modify the debug registers at will
from non-secure PL1, and the kernel does nothing to ensure that guest VM
debug coprocessor registers are preserved.

This is a preliminary patch that simply hooks into vcpu_save and saves the
CPU's debug coprocessor registers when saving VCPU state.

For restoring the debug registers on switching to a VCPU, we just re-use
restore_user_debug_context, which is already called in restore_user_context.
(Restore_user_context is called by c_handle_vcpu_fault()). Specifically,
we modify the used_breakpoints_bf so that restore_user_debug_context()
will always pop all the debug context.

This patch only covers the breakpoint and watchpoint registers,
and it doesn't cover the entire debug coprocessor, which is another
conversation.

Provide spec for CTZL

Provides a spec for the __builtin_ctzl function and changes existing
code to use this wrapper

arm: Ensure only a VCPU with a linked TCB can be active

Changes `dissociateVCPUTCB` to invalidate the active VCPU if the active
VCPU is the one being dissociated. Given that the only linked VCPUs
can be active the check in `vcpu_finalise` can be removed as it already
calls `dissociatedVCPUTCB`

arm: Move setThreadState in VCPU invocations

It is easier for verification if setThreadState happens just prior to the perform
phase of an invocation, instead of during the perform

arm: VCPU interface for manipulating banked registers

Adds extra fields to the Read/Write VCPU Register invocations to read and write
the banked the registers

arm: save/restore banked registers in VCPUs

Adds space in the vcpu_t struct for the registers from the different operating modes
and saves/restores these registers as part of saving and restoring the VCPU

arm: SELFOUR-781: Only allow threads with VCPU to run outside user mode

Previously any thread could be set to run in any mode (except HYP mode).
Whilst this causes no security issues for the kernel, different execution
modes in ARM have different banked registers. These registers are not
currently saved and restored allowing for threads to manipulate registers
that will be seen (or potentially are being actively used) by other threads.

Saving and restoring these banked registers for all threads is a performance
cost (even if only done for the actual mode the thread runs in) for no real
benefit, as there is no clear reason to run a thread in other modes if you
do not have a vcpu. Therefore this commit restricts being in modes other than
user to threads that have a vcpu. When multiple VCPUs are properly supported
the switching of VCPUs will then save/restore these banked registers.

arm: Read/Write fields from active VCPUs

This is a commit to prepare for adding additional registers to the Read
and Write operations. As these registers are expected to be manipulated
in the course of normal virtualization the overhead of effectively switching
the VCPU out, just to modify a register, and then switch it back in, is
excessively high.

arm: Introduce constant for VCPU register

Remove many DONT_TRANSLATE markers.

The vast majority of the DONT_TRANSLATE markers in the kernel are used
to hide __asm__ statements and builtin functions
(e.g. __builtin_unreachable ()) from the C-to-Isabelle parser.

The parser now supports underscore identifiers and many __asm__ statements,
and the builtin functions are prototyped, meaning the vast majority of the
DONT_TRANSLATE markers can be dropped. The remaining markers cover functions
that must be treated specially.

SELFOUR-413: refactor libsel4 fault API

This is a *breaking API change*

This commit:

* makes seL4_Fault_tag_t common between the kernel and libsel4
* deprecates the existing functions from sel4/messages.h includes
* introduces a new fault API in sel4/faults.h and
* sel4/sel4_arch/faults.h
* deprecates seL4_GetTag(), as the function did not work without
the user calling seL4_SetTag() first (seL4_MessageInfo is passed
in registers and not set in the IPC buffer)
* removes previously deprecated functions (deprecated prior to 3.0.0)
* updates the seL4 manual to reflect the changes

arm_hyp: Correct vcpu_save

The use of the `active` flag in this function was inverted

[STYLE_FIX]

arm_hyp: Used cached value for num LRs

arm_hyp: Add lazy vcpu switching

arm_hyp: Declare armHSCurVCPU in header

arm_hyp: Correctly destroy armHSCurVCPU

When finalizing a vcpu, if it is the current vcpu (as defined by
armHSCurVCPU) we should update the current vcpu, this change does
that

arm: Correct fail cases for reading and writing VCPU fields

SELFOUR-615: arm entry point stubs

Provide generic C entry/exit hook routines

It can be deseriable to run code before/after user mode, but
not have to write it in assembly. This commit adds such stubs
that get called as the first/last C code when coming in
and out of the kernel

SELFOUR-609: Introduce virq type in bitfield

Introduces a bitfield defined virq type that is then used to replace
manual bit packing of virtual irqs in the vcpu/vgic LR registers

[STYLE_FIX]

SELFOUR-551: Remove direct accesses to machine data structures

This commit wraps accesses to the vgic in functions that are marked as
DONT_TRANSLATE and uses a global constant (that is determined at boot time)
for the number of LR registers to prevent loops that have undefined bounds

SELFOUR-551: Standardize VCPU capitalization

For acronyms seL4 other does CAPS or caps, this changes some functions
that were doing Caps

SELFOUR-551: Do setThreadState in perform functions

Move some instances of setThreadState from decode functions into
perform functions

SELFOUR-551: Remove unused arguments from decodeVCPUSetTCB

SELFOUR-551: Swap argument order of [di|a]ssociateVcpuTcb

Attempts to create some consistently across other functions that have
VCPU first in the name and also VCPU first in the argument list

SELFOUR-575: Remove unnecessary deriveCap in decodeVCPUSetTCB

SELFOUR-574: Remove schedule from VGICMaintenance

All call paths of VGICMaintenance will call schedule and
activeThread themselves. The operation is therefore redundant
here and is confusing for verification

SELFOUR-555: Rename ksCurCPU->armHSCurVCPU

arm-hyp: Comment on SCTLR_DEFAULT

arm-hyp: Minor cleanups

Cleanup some small licensing, whitespace and configuration details

arm-hyp/tk1: address review comments.

arm-hyp/tk1: should trap SMC from guest kernel

arm/tk1: a checkpoint for SMMU implementation

arm/tk1: addresses/interrupts for hyp mode

arm_hyp: remove unused macros

arm_hyp: rm ARM_HYP ifdefs; func inline assembly

vcpu.c:
encapsulate inline assembly into inline functions that added to
device_pl2.h file.

other files:
replace #ifdef ARM_HYP with config_set(ARM_HYP)

arm_hyp: remove unused macros

arm_hyp: rm ARM_HYP ifdefs; func inline assembly

vcpu.c:
encapsulate inline assembly into inline functions that added to
device_pl2.h file.

other files:
replace #ifdef ARM_HYP with config_set(ARM_HYP)

Fixes for recent merge with master branch

ARM hyp: trap sensitive CPU operations via HCR

ARM HYP: Trap SMC

ARM-HYP: Allow unaligned access for PL0

Recommit of arm_hyp branch on release snapshot