Initial multi environment support for components

Provides a way to switch on the desired 'environment' for a component. Currently the only
supported environment is the existing C environment, and this is therefore made the default
making this change invisible to existing systems.

Refactor component.template.c into multiple files

Prepares the way for supporting different environments by moving the C specific environment
code into a separate file.

Define component_control_main

component_control_main is intended to be the entry point for a component control thread
in potentially different environments. Currently, as there is only one assumed environment,
this just acts as a minor refactor, but once environment support is added this can be
moved to a different template.

Extract control thread init into helpers

Takes the interface thread synchronization logic of the control thread and puts it into
two helper functions. This provides a much cleaner view of what is happening in the control
thread and opens up the possibility for different control logic that reuses these helpers.

Change __arch_putchar to use new method

We instead explicitly register the output function using
sel4muslcsys_register_stdio_write_fn

CAMKES-629: Use old capDL fault endpoints for mcs

On MCS kernel fault ep caps that are passed to seL4_TCBConfigure refer
to the callers cspace rather than the target's cspace. In the capDL
python library there are two ways for specifying a threads fault ep, the
old way passed the objects name and capDL will give it an object ID that
makes it possible for the capDL loader app to refer to the object at
runtime. The other way is to just specify a CPtr in the target threads
cspace that capDL will blindly use, assuming that it refers to a correct
object. This commit reverts to the first way for mcs kernels.

camkes: name threads component:interface_name|control

For easier debugging

Fix licenses

templates: Refactor linker template to use default

We only need the linker template to provide shared data sections, and
when using single address space components to eagerly resolve
constructors and destructors

CAMKES-584: Add array support for Attributes

This makes it possible to define an attribute as a list of a type.
Assigning values to an attribute can be achieved by using the
`[3,4,5,6]` syntax.

SELFOUR-862: CONFIG_PRINTING --> seL4_DebugPutChar

Add scheduling context cap to simple

Update #ifdef to use correct CONFIG_ definition

Add preserved_text section

Check for rt before creating fault reply object

CAMKES-560: Add support for new-rt APIs to next

Replace instances of seL4_Recv, seL4_SignalRecv, seL4_Send, with
RT-compliant versions that operate on reply object caps.

Add dependency on muslcsys and remove duplication of syscalls

libsel4camkes previously had its own implementations of all muslc syscalls. These
syscalls were originally copied from libsel4muslcsys and modified / added to.

This change modifies the syscalls in the following ways
* Syscalls that were completely duplicated have been removed in favour of the
muslcsys ones
* Some of the IO syscalls were extended in CAmkES and the run time overriding
is used to provide the extended behaviour and fall back to the libsel4muslcsys
implementation for the remaining behaviour
* exit, thread and related syscalls are completely overriden in favour of CAmkES ones
* memory related syscalls (brk, mmap, munmap, etc) are removed in favour of
libsel4muslcsys ones. The ability for CAmkES to control the heap allocation is now
dependent upon libsel4muslcsys havings its heap set to 0 so that it switches into
dynamic mode, at which point CAmkES can install its own heap
* Remaining syscalls are not present in libsel4muslcsys and their implementation
is left unchanged
All syscalls have their names changed to have a camkes_ prefix to prevent symbol
name clashes
This change removes any duplicate syscalls, and uses the run time overriding of
syscalls to extend the IO syscalls

Avoid multiple C library initializations

This changes makes it so that of all the threads in the system only the control
thread initializes the C library. All other threads will proceed straight to
the CAmkES init code, where they will perform the existing wait of the control
thread to complete its pre init phase.

Give read/write rights to dma frame caps

Custom sections for page-size alignment on arm

On ARM, the GNU assembler doesn't permit symbols to be aligned to more
than 15 bits. This adds a workaround where custom, page-size-aligned
sections are added, and multiple-of-page-sized that require page-size
alignment are added to the appropriately aligned section.

Removed "persistent" section

Avoid warning in cast

This avoids a warning when `char*` and `int` are of different sizes

Added binary_semaphore primitive

Access to caps to frames backing dma pool

Added missing checks for rt in component template

Support custom passive interface init functions

CAmkES allows components to define "pre_init", "<interface>_init" (for
each interafce)and "post_init" functions. During initialisation,
pre_init is called on the instance's main thread, then each
<interface>_init function is called on respective interface thread, then
post_init is called on the instance main thread. After post_init has
completed, each interface thread is permitted to progress and call their
appropriate "run" function.

This change allows systems with passive threads to use init functions.
Passive interface threads have a scheduling context bound to them
temporarily to allow them to complete their <interface>_init function.

Fixed race condition in passive interface init

Prior to this change, each passive interface thread had a notification
cap which it used to signal to the main instance thread that it was
ready to have its SC unbound. The main instance thread would wait on
each notification sequentially and unbind the appropriate thread when
its signal was received. It is assumed that passive interface threads
have a lower priority than their main instance thread.

Since all passive interface threads were initialised concurrently, but
the main thread was only waiting on one endpoint at a time, it's
possible that the first passive interface thread to complete
initialising won't be the one on whose notification the main instance
thread waits on first. In such a situation, the main instance thread
will remain blocked on a notification of a not-yet-initialised interface
thread, and the just-initialised interface thread will be blocked on its
endpoint waiting for messages from clients. If a client sends a message
to the passive interface, it will wake up and run on its own scheduling
context, which hasn't been unbound by the main instance thread as it's
still blocked. This is a problem as if the main instance thread gets
around to unbinding the interface thread's scheduling context while the
interface thread isn't blocked on an endpoint, the interface thread will
be left in an un-runnable state.

This commit changes passive interface threads such that they start
without a bound scheduling context. For each component instance, there
is a single scheduling context used to initialise passive interface
threads. The main instance thread binds the scheduling context to each
passive interface thread, one at a time, allowing them to start waiting
on their endpoint before unbinding it. This solves the problem as
now the main instance thread unbinds passive interface thread scheduling
contexts as soon as they start waiting on their endpoints, assuming
passive interface threads have lower priority than the main instance
thread.

Replaced aep_pool with notification_pool

Breaking change that replaces the aep_pool configuration setting with
notification_pool.

Replaced aep with notification internally

This changes variable names and comments replacing aep with
notification. This change should have no impact on functionality.

libsel4camkes: Add basic version infrastructure.

Implement generated PID values for component instances.

Implemented passive interface init protocol

Passive interface threads are initialised by capdl with bound scheduling
contexts. This is to allow the interface thread to perform some
initialisation and start waiting. It is up to the glue code generated
for the interface to relinquish its scheduling context when it's
finished initialising. It does this by sending on a notification, whose
cptr was passed as an argument to the interface's "run" function.
Typically this is done using SignalRecv, so the passive thread can send
on the notification and start waiting for input in a single call.

When the main thread of the component instance receives a notification
sent by a passive interface thread, it unbinds its scheduling context.
It is expected that the passive interface thread will be blocked waiting
for for IPC when its scheduling context is unbound. If this isn't the
case, the thread will stop running and have no way of starting again
without having a scheduling context explicitly bound. This situation
could happen if another thread sends on the endpoint which the passive
thread was blocked on, before the main component instance thread got
around to unbinding the scheduling context. This can be prevented by
ensuring clients of passive servers run at a lower priority than the
server.

Creating single prefix for TCB and SC names

Implement runtime-available address space information.

This commit implements the functionality necessary to enable user code (or
generated code) to inspect a component instance's address space at runtime.

JIRA: Closes CAMKES-462.

Always set morecore region, even when heap size is 0.

Following this commit, a morecore region is unconditionally configured when
CAmkES applications start up. The effect of this is that a confusing error is
avoided when applications without a heap attempt to `malloc`. It is still not
possible to allocate dynamic memory without a heap, but at least the error
triggered is more sensible now.

SchedContext names can derive their environment

Scheduling contexts are now named using the same scheme as is used for
TCBs. This allows the instance, interface and intra-index of a
scheduling context to derived from its name. This will simplify applying
capdl filters to scheduling contexts.

Primitive support for realtime seL4

This allows camkes systems to be built to run on realtime seL4. If the
realtime kernel is used, scheduling contexts are created for each
thread. This also adds options to the runner for specifying default
scheduling context field values.

Error checking for SchedContext_(Un)Bind calls

Remove call to debug_set_id_fn.

This is a debugging assistance that is not currently in use.

Omitting SCs from the capdl spec if rt not enabled

Checking kernel supports rt at compile time

If passive interfaces are used, or the control thread is declared
passive, a compile error is generated unless the rt kernel is in use.

Removed unused template variables

Replace "sc" attribute with "passive" attribute

The "passive" attribute is a boolean which replaces the string attribute
"sc". The only use of the "sc" attribute was to mark a component or
interface thread as passive (ie. no scheduling context). This can now be
done directly by setting the "passive" attribute to true. Its default
value is false.

Replace seL4_NBSendRecv with seL4_SignalRecv

Clean up check for passive thread in templates

Pass init ntfn cap to passive interface run fn

Trivial: removed "my_" prefix from init cap names

Use configuration to find sc in templates

Some templates need to know the value of the sc attribute of an instance
or interface. A custom function was added to the template context for
looking up a given entity's sc. This change uses the configuration
settings, and camkes name mangling to find the sc instead, removing the
need for these custom lookup functions.

Removed unneeded TCB_Resume for passive threads

Using TCB_Suspend to stop unused interface threads

Previously unused passive interface threads would block on an endpoint
which was never sent to. This change causes passive interface threads to
call TCB_Suspend on themselves causing them to block forever.

Removed race condition in passive thread init

RPC interfaces that use a passive thread (ie. no scheduling context)
need a temporary scheduling context during initialization. Passive RPC
threads run on this temporary scheduling context to perform some
initialization tasks, then use NBSendRecv to tell the main component
thread they are finished initializing, and block on and endpoint,
waiting for RPC calls. When the main component thread is notified of a
passive interface thread completing its initialization, it unbinds its
scheduling context.

Prior to this change, the interface thread told the main thread its
initialization was complete by doing a non-blocking send on and
endpoint. It was possible that the main thread wouldn't be waiting on
the endpoint by the time the non-blocking send was attempted. If the
main thread started waiting on the endpoint after the send was
attempted, it would never receive the message and block forever.

This commit replaces the endpoint with a notification. Passive interface
threads perform a non-blocking send on a notification when they are
finished initializing. If the main thread isn't waiting on the
notification when the send is performed, when it eventually waits on the
notification it will immediately receive it.

Updated sc api function calls in templates

This replaces SchedContext_BindTCB and SchedContext_UnbindTCB with
SchedContext_Bind and SchedContext_Unbind respectively.

Only creating init sc for passive threads

Fixed indentation of sc init in templates

[Fix] Replaced "arm" with "aarch32"

Remove debugging messages.

Avoid redefinition of variables where a component has more than one interfaces.

Added an extra TCB_Resume to work around a bug in the kernel. This should be removed once the bug is fixed.

JIRA CAMKES-429

Implementation of passive threads and scheduling context donation.

JIRA CAMKES-429

Replace usage of seL4_Wait with seL4_Recv to match new API.

Find and replace seL4_AsyncEndpointObject with seL4_NotificationObject.

Change command line argument "arm-hyp" to "arm_hyp".

This commit aligns the CAmkES string used for architecture with the strings
used by the common build system.

Initialise passive threads from a component's control thread.

JIRA CAMKES-429

Added initial support for scheduling contexts.

This assigns an SC to every thread, unless the user requests not to.
It also adds extra priority config settings for threads.

JIRA CAMKES-429

Use a collision-resistant TCB name mangling algorithm.

Prior to this commit, it was possible to generate a naming collision in a CapDL
spec using a specific input spec. For example, in the following:

component Foo {
uses Proc tcb;
}

component Bar {
provides Proc tcb_tcb;
}

assembly {
composition {
component Foo abc_tcb;
component Bar abc;

connection seL4RPC c(from abc_tcb.tcb, to abc.tcb_tcb);
}
}

two CapDL objects named "tcb_abc_tcb_tcb_0000" would be generated. This was
symptomatic of a TCB name mangling algorithm that permitted collisions. This
commit moves to an algorithm designed to avoid such collisions. The above
example would now generate TCBs "abc_tcb_7_tcb_3_0000_tcb" and
"abc_3_tcb_tcb_7_0000_tcb".

As a more broad description of the algorithm, interface TCBs are named:

<instance>_<len(instance)>_<interface>_<len(interface)>_<intra_index>_tcb

Fault handler TCBs are named:

<instance>_<len(instance)>_0_fault_handler_15_0000_tcb

Note that this still fits in with the previous coincidental naming in that
these TCBs can still be treated as interface TCBs in certain contexts. Control
TCBs are named:

<instance>_<len(instance)>_0_control_9_tcb

The above scheme is intended to be resistant to all possible collisions. Note
that this commit also moves the "tcb" tag to the end of the name, which ensures
that these objects can also no longer collide with endpoints or CNodes.

Closes CAMKES-418

Refactored parser init commit.

Replaced AsyncEndpoint with Notification. Applied "s/AsyncEndpoint/Notification/g" and "s/aep/notification/g" to each file.

Set the thread name of component threads when possible.

This makes debugging easier as kernel messages will print out the name of the
thread that has caused the fault. Note that this is only enabled on a debug
kernel when TCB caps are available. In other scenarios, you will get the old
(TCB address) messages.

Squash some compiler errors.

In these functions involving template loops, when the loop executes 0 times the
body of the function can end up intentionally blank. This can result in the C
compiler throwing misleading warnings in some configurations about unused
variables.

Fix: Rename control TCB to avoid symbol collisions.

**BREAKING CHANGE**

This commit renames the control TCB from "tcb__control" to "tcb_0_control". The
purpose is to avoid unintentional symbol collisions with TCBs belonging to
interfaces named "_control". As part of the same disambiguation process, any
attributes that were of the form "_control_<property>" are now "_<property>".
Because an interface cannot have the empty string as a name, this avoids
collisions.

This is marked as a breaking change because users who adjust attributes of the
control thread (priority, stack size, domain, etc.) will need to change the
attribute they are setting. It is possible to set both the new and the old
attribute in order to smooth the transition across this changeset.

Fix: Tighten some attribute regexes.

Python's `re.match` only requires a match from the start of the source string,
not exactly matching the source string. So, for example, the regex r'hello'
matches 'hello world', though you may have actually intended it to only match
precisely 'hello'. This commit fixes some `re.match` calls in template code.

Removed unnecessary check for assembly configuration being none.

component template: Remove #include of legacy generated header.

JIRA CAMKES-331

Correct heap_size check in component template

The heap_size variable defaults to a configuration string, which
cannot be meaningfully compared with an integer. This comparison
needs to happen at compile time, so the 'if' has been changed to
a '#if'

Component template: Rephrase some settings access.

Fix whitespace schizophrenia.

Template: Simplify a range comparison.

Allow custom heap sizes for different components

Currently all components must either use the same statically configured
heap size in the muslccamkes library, or all components must provide
their own heap definition. This commit makes the component template the
'owner' of the heap and the size can be set on a per component basis.

Unconditionally include sync headers in the per-component template.

The sync library is part of the CAmkES core, so conditionally including these
headers here is just creating unnecessary noise for the reader of these
templates.

Implement per-thread stack configuration.

Closes JIRA CAMKES-164

Optimisation: Use new configuration dictionary interface in the templates.

Templates: Be more explicit about testing for None and [].

This commit replaces the idiom 'if foo' with explicit tests for None or the
empty list when that is the intention of the given code. This makes the
templates a little more readable and is necessary to avoid confusion in
relation to some upcoming commits.

Fix: Pass DMA pool in bytes, not pages.

Commit 2c00525103fcc1c88f121192b4189789c03fa157 changed the meaning of this
argument to DMA initialisation from number of pages to number of bytes of the
DMA pool. Unfortunately the adjustment at the call site of the initialisation
function was not correct and we were passing a size that was now far too small.

libsel4camkes: Make the DMA allocator agnostic to page size.

This commit adjusts the API for the DMA allocator to allow the caller to
specify the page size used in the mappings backing the DMA pool. It also allows
the caller to instruct the allocator itself to automatically determine the page
size. The purpose of this is to future proof this code against potential
changes to allow the DMA pool to be backed with large frames. No users are
expected to be manually calling the DMA initialisation function, so this is not
expected to have any user-visible effects.

Templates: Use the UNUSED macro where relevant.

Optimisation: Cache virtual-to-physical address translations.

Doing DMA on a CAmkES system requires specifying a DMA pool, which results in a
region of your address space backed by frames that are "reversible" (you can
ask the kernel what their physical address is). This commit caches these
reverse lookups in static variables. The result is that we avoid the syscall
overhead when repeatedly reversing DMA frames, as can happen in a naïve DMA
driver.

libsel4camkes: Separate IO functionality from DMA.

Prior to this commit, the DMA allocator functions incorrectly presumed that the
user would want to use ps_io functions to lookup DMA pages by their physical
address. These functions are actually intended to be used to lookup the virtual
addresses of memory-mapped IO devices. This commit separates this functionality
into a separate file and extends IO access functionality to cover IO ports as
well. This is primarily for interaction with libplatsupport. If you are not
using libplatsupport infrastructure, it will probably be simply to directly
invoke CAmkES interface functions.

Add missing #include.

Implement error handling in glue code.

This commit replaces previous assertion placeholders and other assumptions with
a flexible error handling mechanism. For details on how to use this, refer to
the accompanying documentation.

Fix: missing dependency for DMA address reversal process.

This functionality relies on some macro wrappers in libsel4utils that were
mistakenly not depended upon.

libsel4camkes: Restructure DMA allocator to book-keep in-place.

This commit restructures how the DMA allocator tracks its free list internally,
by using a link-list constructed with pointers in the DMA pages themselves. The
main purpose of this is to have a cleaner API and reduce confusion from callers
and unnecessary memory usage.

Remove arch page abstractions for GetAddress and friends.

These abstractions are now in libsel4utils.

Templates: trivial: Make an assert failure slightly more descriptive.

Merge DMA support from 'development'.

This commit contains the changes to implement support for DMA as well as some
auxiliary changes to how we implement dataports. Specifically, DMA pools can
now be created as described in the docs and allocated from. Memory allocated
from this pool can be reverse looked up to get its physical address(es).

A linker script is introduced in this commit, which is actually part of the (to
come) support for large frames. DMA pools, stacks, IPC buffers and dataports
all end up in specific custom sections. The dataport change that comes as part
of this commit is that we now define dataports in the connection templates (as
opposed to just declaring them there and then defining them in the component
template). This is a little cleaner, though it doesn't remove all dataport code
from the component template.

As of this commit, the dataport declaration the user sees is only tagged as
weak if they have used the 'maybe' keyword. If this is the case, they are
expected to check at runtime whether the dataport is connected or not.

Change template license headers to Jinja comments.

The effect of this is that they do not appear in generated output, which was a
bit confusing previously.

Closes JIRA CAMKES-319

Conflicts:
camkes/templates/autocorres/AsynchNativeFrom.template.thy
camkes/templates/autocorres/AsynchNativeTo.template.thy
camkes/templates/autocorres/RPCSimpleFrom.template.thy
camkes/templates/autocorres/RPCSimpleTo.template.thy
camkes/templates/autocorres/SharedDataFrom.template.thy
camkes/templates/autocorres/SharedDataTo.template.thy
camkes/templates/echronos/eChronosAsynch-from.template.c
camkes/templates/echronos/eChronosAsynch-to.template.c
camkes/templates/echronos/eChronosDirectCall-from.template.c
camkes/templates/echronos/eChronosDirectCall-to.template.c
camkes/templates/linker.lds
camkes/templates/linux/component.template.c
camkes/templates/linux/component.template.h
camkes/templates/linux/linuxMQ-from.template.c
camkes/templates/linux/linuxMQ-to.template.c
camkes/templates/linux/linuxMQEmpty-from.template.c
camkes/templates/linux/linuxMQEmpty-to.template.c
camkes/templates/linux/linuxMmap-from.template.c
camkes/templates/linux/linuxMmap-to.template.c

Move Jinja macros into Python.

Jinja macros have unexpected, and often unpleasant, behaviour. A non-exhaustive
list of issues with them is:
- They are not first class Python functions so cannot be passed within the
template context to, e.g., `map`;
- They can mask and inadvertently overwrite your local variables;
- Certain types of references have unexpected expansions within the context of
a macro;
- Calling a macro within a macro is dangerous; and
- You cannot call certain Python functions from within a macro.

This commit transliterates the existing macros into Python, attempting to
preserve all current functionality. This has involved essentially inverting
their implementation such that they become C hosted within Python, rather than
Python hosted within C. The macros are now unconditionally available to all
templates (see Context.py).

This change is intended to be transparent to template authors and CAmkES users.

Conflicts:
camkes/templates/echronos/eChronosAsynch-from.template.c
camkes/templates/echronos/eChronosAsynch-to.template.c
camkes/templates/linux/component.template.h
camkes/templates/linux/linuxMQ-from.template.c
camkes/templates/linux/linuxMQ-to.template.c
camkes/templates/linux/linuxMQEmpty-from.template.c
camkes/templates/linux/linuxMQEmpty-to.template.c
camkes/templates/linux/linuxMmap-from.template.c
camkes/templates/linux/linuxMmap-to.template.c
camkes/templates/macros.jinja

Add trywait to semaphore.

Use separate untyped pools for simple generation as the overload of the existing camkes pools does not make sense as camkes allocator should not be used if you are retrieving untypeds through the simple interface

Pass a tls_init function to a threads _start routine so that TLS can be initialized
with the C library before execution gets to component_main

Changes to libsel4debug include namespace

Use new muslc port. Change _start to _camkes_start that creates an environment compatible for calling to the regular _start

Release snapshot