Convert license tags to SPDX identifiers

This commit also converts our own copyright headers to directly use
SPDX, but leaves all other copyright header intact, only adding the
SPDX ident. As far as possible this commit also merges multiple
Data61 copyright statements/headers into one for consistency.

style: set min-conditional-indent to 0

Given we use braces all the time conditional indents do not make code
cleaner.

style: consistently attach return type

Add attach-return-type to astyle

style: consistently align pointer with name

Run astyle with align-pointer=name

style: correct parenthesis padding

Use astyle's unpad-paren to unpad all parentheses that are not included
by pad-header, pad-oper, and pad-comma.

x86: IOPortIn invocations respect Call

The kernel should not 'reply' to an invocation unless the user did a 'Call'. This change
is essentially mirroring existing logic and explanations from the tcb ReadRegisters invocation

x86: Handle IOPort control caps in finaliseCap

Whilst the control cap should never be deleted by the user (as they would forever lose the
ability to use IO ports), the kernel should still handle this case without crashing.

x86: check last port in Arch_sameRegionAs for IOPort caps

x86: Introduce IO port control caps

Changes the way IO ports work such that instead of 'minting' IO port caps down into new
IO port caps with smaller ranges new IO port ranges must be allocated centrally from
an IO port control cap. This mechanism acts in a very similar fashion as IRQ handler/control
capabilities and ensures that allocated IO ports do not overlap. Disallowing overlapping
IO ports is necessary to ensure the CDT remains valid as capabilities are deleted.

Allow Arch_finaliseCap to return cleanup information

Changes Arch_finaliseCap and Mode_finaliseCap to return the same finaliseCap_ret_t type
as finaliseCap. This allows the Arch and Mode specific functions to define cleanup
information of its capabilities if necessary, just like the generic capabilities can
in finaliseCap.

x64: compare frame is-device flag in Arch_sameObjectAs

[STYLE_FIX]

SELFOUR-1062: Hide all VT-x related code behind #ifdef guards

The VT-x implementation is not going to be verified at the moment, and so the code for
it needs to be hidden from verification, which we do by #ifdef'ing it out if the VT-x
is not enabled. As a result the VT-x configuration depends on a non verification target

SELFOUR-1062: Hide all IOMMU related code behind #ifdef guards

The IOMMU implementation is not going to be verified at the moment, and so the code for
it needs to be hidden from verification, which we do by #ifdef'ing it out if the IOMMU
is not enabled. As a result the IOMMU configuration depends on a non verification target

arm: Pass 'call' down to invokeVCPUReadReg

invokeVCPUReadReg should not be setting message registers for the return message unless
the user performed a call. In doing so we must refactor the call to readVCPUReg to
outside the introduced `if` condition since, as it performs machine operations, it
should always happen

x86: Consider all IO port caps to be the same object

There is no 'object' backing an IO port capability, rather it represents the
authority to use an IO port range. The derived authority for ranges is checked
by `Arch_sameRegionAs`, but currently `Arch_sameObjectAs` always considers
two IO port caps to not be from the same object. Whilst this is true, it is
also true to say that all IO ports are from the same object (since there is
no object).

As it is easier to reason about IO port caps being from the same object, and
then restriction by region, this changes `Arch_sameObjectAs` to consider all
IO port caps to be from the same object.

Move arch independent functions to generic files and HAVE_FPU config

SELFOUR-501: x86 - Remove PAE support

x86: Make ioport caps never be considered as the same object

An I/O port capability has no backing object and asking if two caps refer to the same object
is therefore a meaningless question to ask.

SELFOUR-567: use seL4_CapRights_t from libsel4

This change

* changes seL4_CapRights from the kernel to be seL4_CapRights_t in
libsel4
* deprecates the duplicated seL4_CapRights in libsel4, which is
now the bitfield generated type seL4_CapRights_t.
* fixes all usages in kernel and libsel4

Impact: for verification, this will require the type to change name
from cap_rights to seL4_CapRights_t.
This is a breaking libsel4 API change, although most code uses
seL4_AllRights or similar constants, which will not break
at a source level as these constants have been updated.

Fix VTX compile error

[STYLE_FIX]

Remove recycle

Removes the recycle operation and adds an operation
to cancel any badged sends on and endpoint. Calling
Revoke + CancelBadgedSend is equivalent to Recycle
on a badged endpoint

SELFOUR-444: Preemptible zeroing for retype.

Change to the order of operations and timing behaviour of
invokeUntyped_Retype. The Retype operation now zeroes the
entire range of the Untyped cap (if it is being used for
the first time) before installing any objects. This avoids
the need for long-running initialisation of large objects,
whose initial contents are always zero. The initial zeroing
phase is preemptible, and may take multiple timeslices to
complete.

x64: Guard vt-x that is not yet implemented

These guards are needed because vt-x is not yet properly supported
in x86-64 builds. Once it is these guards can be removed again

[STYLE_FIX]

SELFOUR-287: 32-bit vt-x implementation

This is an implementation of vt-x for x86 kernels running in
ia32 mode.

x86: Rename decodeIA32PortOperation->decodeX86PortOperation

x86: Fixup IOMMU implementation

Adds a mapping type to frame caps that tracks
what kind of hierarchy the cap is mapped into;
an MMU, IOMMU and in the future an EPT structure.

Additionally the IOMMU code is updated to
have correct functionality and be verification
friendly.

SELFOUR-421 Introduce explicit device frames and untypeds

Kernel objects cannot be created from device untypeds, with the
exception of frames, which do not get zeroed and cannot be used
as an IPC buffer. Device untypeds additionally cannot be used
in the construction of ASID pools.

This then changes the API to the rootserver (i.e. bootinfo) to
send device untypeds instead of device frames. On ARM these
device untypeds are the same as the previously exported device
frame regions. On x86 PCI scanning is removed and all physical
memory addresses (that are not important for kernel integrity)
are released to the user.

In order to have bits in the frame and untyped caps on ARM the
number of software ASIDs had to be reduced from 2^18 to 2^17,
and the maximum untyped size reduced from 2^31 to 2^30

SELFOUR-33: Correctly implement revoke for I/O ports

This commit allows for I/O ports to be correctly revoked

x86: Use IO page table size defined in libsel4

x86: Rename ia32->x86

This is a stylistic commit to make names of variables/constants and
functions in the kernel more consistent. That is, things that are
not IA32 specific, but are generic x86, get renamed to having an
x86 name

x86/libsel4: Rename ia32->x86

Rename all functions, constants and types in libsel4 that are in the
general x86 architecture to have an X86 name instead of an IA32 name.
As libsel4 and the kernel share names this requires changing those
in the kernel as well.

All the original IA32 names can still be used for the moment, but are
marked as deprecated.

SELFOUR-399: object sizes and globals frame addr should come from the same source

x86: Factor out IA32 specific objecttype code

x86: Use typedef for vspace roots instead of void*

SELFOUR-114: remove duplication of seL4_MessageInfo_t, adjust naming to avoid cparser mangling

x86: Extract 32-bit specific vspace functions in mode/vspace.c

x86: Port some of the IOMMU changes on the experimental branch

This changes the IOMMU from using passthrough devices and instead
directly mapping in the reserved regions that are needed for each
device.

x86: Do not conditionally compile IOMMU code, use build/run time checks

Guarding code with #ifdef's makes even cursor testing of 'does this code compile'
difficult due to code being hidden by the pre-processor. Using config_set in
regular C if statements is performant as the compiler can trivially detect
dead code at compile time, and at -O1 and above will not even link in symbols
referenced by dead code in these blocks, so this will not bloat image size

unsigned int -> word_t

x86: Make x86 the name of the architecture instead of IA32

IA32 is 32bit version of the x86 architecture. Whilst only IA32
is supported, much of the code is generic x86. Using a generic
x86 architecture will aid in future 64bit support