Convert license tags to SPDX identifiers

This commit also converts our own copyright headers to directly use
SPDX, but leaves all other copyright header intact, only adding the
SPDX ident. As far as possible this commit also merges multiple
Data61 copyright statements/headers into one for consistency.

boot: Use extra_bi_size_bits for vreg size calc

The bootinfo extra size region is rounded up to a power of 2 size before
being mapped into the initial threads address space. This wasn't being
handled correctly which lead to a situation where if the bootinfo
finishes on the last address of a page table but the extra region size
is not a power of 2 size then there won't be a page directory allocated
where one needs to be and the kernel would crash.

Create device untypeds at boot for all arches

Currently on x86 device untypeds are generated by passing the entire
address space minus any parts that are reserved by the kernel or that
are "real" memory (e.g. kernel image, physical RAM).

On ARM and RISC-V, device untypeds were generated at compile-time from
a device tree. This patch moves ARM and RISC-V to use the same approach
as x86, and moves the code from x86 into a common location that's
shared between the three architectures.

Co-Authored-By: Anna Lyons <anna@gh.st>

mcs: tickless driver for x86

Add a tickless timer driver for x86. The driver defaults to using
TSC_DEADLINE mode, but falls back to the apic if that feature is not
available.

mcs: Add a scheduling context object

This is the first part of the seL4 MCS. This commit:

* adds a scheduling context object. Threads without scheduling
context objects cannot be scheduled.
* replaces tcbTimeSlice with the scheduling context object
* adds seL4_SchedControl caps for each core
* adds seL4_SchedControl_Configure which allows users to configure
amount of ticks a scheduling context has, and set a core for the
scheduling context.
* adds seL4_SchedContext_Bind, Unbind and UnbindObject, which allows
a tcb to be bound to a scheduling context.

boot: allocate rootserver objects last

This change allows us to know, from just the kernel and dtb, where user
level untyped objects start being allocated from.

- allocate rootserver objects from last available freemem region.
- move create_rootserver_objects call into init_freemem.

boot: refactor allocation of rootserver objects

Prior to this change, the boot process would dynamically allocate
memory for root server objects based on the order of initialisation.
Allocation was a best-fit algorithm.

This change preallocates all memory for root server objects to an
aligned untyped just after the user image. By allocating the objects in
order of size, allocation is greatly simplified and the ability to
reproduce the allocation offline based on the kernel and user image
sizes is increased.

x86 boot: pass mem_p_regs by pointer

This avoids taking the address of a local variable in arch_init_freemem,
which is not supported by the Isabelle C parser.

boot: consolidate init_freemem

init_freemem sets up available regions of memory for the hardware that
seL4 is booting on. Previously this function was duplicated across
architectures, with minor duplication.

This change provides a top-level init_freemem suitable for all
architectures.

- arm/riscv: change get_avail_p_reg to return whole p_reg array
- update all architectures to use new init_freemem.
- wrap init_freemem calls with arch_init_freemem for each arch, where
arch_init_freemem sets up the available and reserved regions of memory
which are passed to init_freemem.

boot: allocate irq cnode statically

The memory used for the irq cnode is never available to the user. As a
result this memory can be allocated statically, simplifying the
bootcode.

- remove allocation of irq cnode
- add static init
- generate irq cnode size from cmake for arm
- add static constants for riscv, x86 as there is no variability at the
moment.

ia32: adjustments to pass c-parser

This commit updates the ia32 build to pass the c-parser.

- replaces ++i with i++
- use void in functions with no parameters
- add a missing typecast
- remove a void cast of an unused variable

It does not provide any verification guarantees about ia32 code.

style: set min-conditional-indent to 0

Given we use braces all the time conditional indents do not make code
cleaner.

style: consistently attach return type

Add attach-return-type to astyle

style: consistently align pointer with name

Run astyle with align-pointer=name

trivial: Fix typo 'injenction'

x86: Introduce IO port control caps

Changes the way IO ports work such that instead of 'minting' IO port caps down into new
IO port caps with smaller ranges new IO port ranges must be allocated centrally from
an IO port control cap. This mechanism acts in a very similar fashion as IRQ handler/control
capabilities and ensures that allocated IO ports do not overlap. Disallowing overlapping
IO ports is necessary to ensure the CDT remains valid as capabilities are deleted.

Remove archInfo from bootinfo

With extended bootinfo providing a more flexible and extensible form of archInfo this
member can be retired.

x86: Store TSC frequency in extended bootinfo header

x86: Calculate tsc frequency earlier in boot

Moves the tsc_init earlier into the boot stage and stashing the frequency in a temporary
variable. Moving tsc_init earlier will allow us to use the value in other parts of the
boot code.

x86: Implement IBRS based Spectre mitigations

Provides the ability to enable the IBRS hardware Spectre mitigation strategies, as well
as completes the software mitigation by disabling jump tables in compilation. The
hardware mitigations are largely provided "for completeness" in the hopes that they
eventually become less expensive. For the moment there is no reason to turn on any
beyond STIBP if running in multicore

x86: Enable SMEP/SMAP if possible

User accesses or execution should not happen from supervisor mode, but generating a fault
if they do can aid debugging and has no cost.

SMEP needs to be enabled as part of mitigating spectre

x86: Supervisor write protection

Prevents the kernel from writing to read only memory. This shouldn't happen, but catching
such attempts aids debugging and costs nothing to have neabled.

x86: Export PMC to user

Provides an option that, on kernel init, enables user reading of the performance
monitoring counters. This is a step towards removing the dependence on
seL4_DebugRun for user level benchmarking/profiling

x86: add framebuffer info of MBI2 via boot_info

x86: Copy struct by assignment instead of memcpy

This prevents the need to take the address of a local variable, which is a violation of the
supported C subset.

x86: Provide copy of RSDP in bootinfo

This gives a rootserver a way to find the ACPI tables in cases where there is no BIOS region
to scan for an RSDP.

[STYLE_FIX]

SELFOUR-1062: Hide all VT-x related code behind #ifdef guards

The VT-x implementation is not going to be verified at the moment, and so the code for
it needs to be hidden from verification, which we do by #ifdef'ing it out if the VT-x
is not enabled. As a result the VT-x configuration depends on a non verification target

SELFOUR-1062: Hide all IOMMU related code behind #ifdef guards

The IOMMU implementation is not going to be verified at the moment, and so the code for
it needs to be hidden from verification, which we do by #ifdef'ing it out if the IOMMU
is not enabled. As a result the IOMMU configuration depends on a non verification target

Share linker.h between architectures

SMP: Introduce ENABLE_SMP_SUPPORT

- Make it more readable and less confusing compared to the 'CONFIG_MAX_NUM_NODES > 1' check

x86: Replace memcpy with direct struct assignment

This is to avoid taking the address of a local variable, which is not permitted
in the subset of C for the kernel

SELFOUR-865: Pass memory map information to user

[STYLE_FIX]

trivial: typos in previous commit

refactor: initialise common core state in one place

x86: Pass VBE information from multiboot through bootinfo

x86: initialize ksActiveFPUState for APs

Move arch independent functions to generic files and HAVE_FPU config

x86: move current active FPU owner to node state

x86: Prevent spurious detection of overlapping regions

Regions are stored as [start, end), therefore the start and end of two
different regions is permitted to be equal

x86: Add BSS regions for BOOT and PHYS code

Uninitialized data structures in BOOT and PHYS code currently get
placed in sections that are allocated in the file of the final image.
Whilst these sections will get reclaimed during kernel boot, so no
runtime memory is being wasted, it results in kernel images that
are much larger to load and transport than necesary.

This change adds explicit BSS regions for both BOOT and PHYS code
and moves all appropriate data structures into them

x86: check if kernel compiled for the host microarchitecture.
also move x86_cpuid_initialize from init_cpu as it has
nothing with initializing the cpu rather than just reading some info.
as well as being in cpu_init cause it to run multiple times in smp.

x86: updating the bootinfo for number of cores

x86: export tsc freq in bootinfo

We read the frequency from the platform info MSR and export it to the
user for accurate timing (for platforms that support platform into)

SELFOUR-287: 32-bit vt-x implementation

This is an implementation of vt-x for x86 kernels running in
ia32 mode.

implement layout of ipi interrupt handling

SELFOUR-499: X86, ARM: Add userspace invocations for hardware debugging

This commit implements the body of SELFOUR-499. The API exposes the x86 DR0-7
and ARM coprocessor 14 features to userspace by virtualizing them as context-
switched registers in the TCB. Implemented as TCB invocations. This feature is
only built when CONFIG_HARDWARE_DEBUG_API is selected.

* Add low-level support routines for setting, unsetting, getting, enabling
and disabling breakpoints.
* Add support for single-stepping as well.
^ Single-stepping is not supported on ARMv6 since the hardware
doesn't have support.
^ ARM implements single-stepping as instruction breakpoints
configured to fault on every instruction -- this is achieved through
the "mismatch" mode, which is only supported from ARMv7 onwards.
* Also support explicit software break requests, a la "BKPT" and "INT $3".

* New invocations:
* seL4_TCB_SetBreakpoint().
* seL4_TCB_GetBreakpoint().
* seL4_TCB_UnsetBreakpoint().
* seL4_TCB_ConfigureSingleStepping().
* New constants:
^ Event types:
^ seL4_InstructionBreakpoint.
^ seL4_DataBreakpoint.
^ seL4_SoftwareBreakRequest.
^ Access types:
^ seL4_BreakOnRead.
^ seL4_BreakOnWrite.
^ seL4_BreakOnReadWrite.
^ Exports:
^ seL4_NumHWBreakpoints.
^ seL4_NumExclusiveBreakpoints.
^ seL4_NumExclusiveWatchpoints.
^ seL4_NumDualFunctionMonitors.
^ seL4_FirstBreakpoint.
^ seL4_FirstWatchpoint.
^ seL4_FirstDualFunctionMonitor.

See documentation in the seL4 API manual.

x86: Support for syscall

syscall/sysret is an additional way of performing kernel entry/exits.
Whilst the instructions themselves are not supported when running
in 32-bit mode, this commit provides the config choice for them as
well as the generic support code for them.

SELFOUR-630:preliminary booting application processors
- update core detection code and Kconfig file
- update kernel stack managment so that BSP does not use boot stack before IPI APs
- move arch dependant data to a single structure
- add cache line size to Kconfig
- add cpu indexing and apic id mapping
- boot APs to halting state
- add guard for kernel stack if there is only one core

[STYLE_FIX]

SELFOUR-421 Introduce explicit device frames and untypeds

Kernel objects cannot be created from device untypeds, with the
exception of frames, which do not get zeroed and cannot be used
as an IPC buffer. Device untypeds additionally cannot be used
in the construction of ASID pools.

This then changes the API to the rootserver (i.e. bootinfo) to
send device untypeds instead of device frames. On ARM these
device untypeds are the same as the previously exported device
frame regions. On x86 PCI scanning is removed and all physical
memory addresses (that are not important for kernel integrity)
are released to the user.

In order to have bits in the frame and untyped caps on ARM the
number of software ASIDs had to be reduced from 2^18 to 2^17,
and the maximum untyped size reduced from 2^31 to 2^30

Revert "Merge pull request #358 in SEL4/sel4 from ~AZARRABI/sel4:multicore to master"

This reverts commit ce2f666bb811c5e4c779829fcb09d5a189ebcdbb, reversing
changes made to dc183f96b81f2344d7d0d910fc430f924eaae940.

SELFOUR-630:preliminary booting application processors
- update core detection code and Kconfig file
- update kernel stack managment so that BSP does not use boot stack before IPI APs
- move arch dependant data to a single structure
- add cache line size to Kconfig
- add cpu indexing and apic id mapping
- boot APs to halting state
- add guard for kernel stack if there is only one core

SELFOUR-518: User-level log buffer

Remove global ksLog and use KS_LOG_PPTR instead

Benchmark - Log buffer: use global page table

Benchmark: share and use KS_LOG_PPTR and PPTR_TOP for x86 and ARM

x86: Fix cpuid family/model composition

Fixes a bug where previously MODEL_ID() was defined as:
`#define MODEL_ID(x) ( ((x & 0xf0000) >> 16) + (x & 0xf0) )`

This was incorrect because (1) it didn't take into account the conditional
nature of the extended_model_ID, and (2) it's actually shifting the
extended_model_ID into the low bits and keeping the model_ID in the high bits,
when it should be the other way around.

This patch also introduces a foundation for more sane testing of CPU vendor,
family, model and brand_ID.

SELFOUR-448 Benchmark: Track thread's CPU utilisation time

trivial: style

x86: Introduce support for XSAVE feature set

The XSAVE feature set is the future proof way for x86 CPUs to
manage extended CPU state. Extended state is MMX, FPU, SSE, AVX etc
registers. This is a replacement for the current FXSAVE and the
512 byte FPU region.

XSAVE introduces a few problems that this commit has to address

* The alignment of the XSAVE region is 64bytes, instead of the 16
bytes of the FXSAVE region
* XSAVE region size is dependent on the desired features, which
are detected at run time
* There are multiple variants of the XSAVE instruction that have
different potential optimizations, but are not always supported

The solutions to these are

* Re-order the FPU state and user registers in the user context
struct so that the new XSAVE region is first, and is thus
aligned to 64bytes without needing lots of padding
* Provide config options for desired features (including XSAVE
instruction variant) and required XSAVE region size. These
are checked at boot time to ensure the CPU meets these
requirements

x86: Rearrange init_cpu in boot code

The CPU should be initialized before calling init_sys_state, as
this attempts to manipulate things such as the FPU, which may
not be in a valid state before performing the full CPU init.
In order to perform init_cpu earlier, init_vm_state is also
moved into init_cpu, where it makes more sense to be to begin with

SELFOUR-446 Benchmark: Track syscall feature

Benchmark feature that currently:
- Keeps track of system calls info
- Start time
- Duration
- Capability type
- Invocation tag
- Log the number of invocations of each system call*
- Log the number of invocations for each capability type per syscall.
- Has 3 new syscalls (dump, reset, get size).
- This new feature uses the existing log buffer (which is 1MiB for x86
and ARM). Since the number of syscall invocations is not
deterministic, the logged number of invocations is limited by the size
of the buffer. I suggested to enable the users to pass their own
user-level buffer, to enable more flexibility, later.
- ENABLE_BENCHMARKS is now a parent config option of trace points and
system call track features, they can't be used at the same time.

x86: Improve translation invalidation

x86_64 (with PCIDs enabled) supports a more fine grained invalidation
approach for the TLB and Page Structure Cache. This change expands
the number and kinds of information passed for certain invalidations,
and provides an implementation of this for ia32.

SELFOUR-114: remove bootinfo.h duplication

x86: Rename ia32->x86

This is a stylistic commit to make names of variables/constants and
functions in the kernel more consistent. That is, things that are
not IA32 specific, but are generic x86, get renamed to having an
x86 name

x86: Abstractions for setting up benchmarking log

x86: IOAPIC/MSI syscalls

Restructure the x86 interrupt handling to allow for a more flexible
method of using IOAPIC and MSI interrupts. The essence of this change
is to allow for the user to pick, for both IOAPIC and MSIs, which
CPU vector to use. Additionally there is future support, in the API,
for seL4 to eventually protect MSI interrupts with the vt-d interrupt
routing tables.

API behaviour for legacy systems using the PIC is preserved

Part of SELFOUR-281

trivial: style

x86: Populate the freemem list from the multiboot mem list

If the multiboot memory list exists, then it may contain more
than just the single contiguous memory region listed in 'mem_upper'
Therefore we use it to populate a more complete free memory list,
if it exists

x86: Move 32-bit specific initial address space creation to vspace_32

x86: Port some of the IOMMU changes on the experimental branch

This changes the IOMMU from using passthrough devices and instead
directly mapping in the reserved regions that are needed for each
device.

x86: With multi-kernel support removed make the kernel PDs etc global instead of passing them around

trivial: fix style

x86: Do not conditionally compile IOMMU code, use build/run time checks

Guarding code with #ifdef's makes even cursor testing of 'does this code compile'
difficult due to code being hidden by the pre-processor. Using config_set in
regular C if statements is performant as the compiler can trivially detect
dead code at compile time, and at -O1 and above will not even link in symbols
referenced by dead code in these blocks, so this will not bloat image size

x86: Do not conditionally compile IRQ controller code, use build/run time checks

Guarding code with #ifdef's makes even cursor testing of 'does this code compile'
difficult due to code being hidden by the pre-processor. Using config_set in
regular C if statements is performant as the compiler can trivially detect
dead code at compile time, and at -O1 and above will not even link in symbols
referenced by dead code in these blocks, so this will not bloat image size

x86: Strip multi kernel support from the x86 kernel. This is not used and is conflicting with planned future features

x86: Move APIC frequency calculation to APIC init, instead of doing it before we initialize paging

Change additional int->word_t due to interraction with the C parser to ease verification

Removed CONFIG_BENCHMARK config option. All checks for '#ifdef CONFIG_BENCHMARK' replaced with '#if CONFIG_MAX_NUM_TRACE_POINTS > 0'.

Added support for using multiple tracepoints at the same time.

xIntroduce RELEASE_PRINTF, which allows a renamed printf (release_printf) to be used in a release build of the kernel - userful for debugging tests that only fail on a release build of the kernel

x86: Make x86 the name of the architecture instead of IA32

IA32 is 32bit version of the x86 architecture. Whilst only IA32
is supported, much of the code is generic x86. Using a generic
x86 architecture will aid in future 64bit support