thermosphere: major refactor of memory map

- use recursive stage 1 page table (thanks @fincs for this idea)
- NULL now unmapped
- no identity mapping
- image + GICv2 now mapped at the same address for every platform
- tempbss mapped just after "real" bss, can now steal unused mem from
the latter
- no hardcoded VAs for other MMIO devices
- tegra: remove timers, use the generic timer instead

thermosphere/src/smc.c

@@ -2,14 +2,12 @@
 #include "smc.h"
 #include "core_ctx.h"
 #include "caches.h"
+#include "memory_map.h"
 
 // Currently in exception_vectors.s:
 extern const u32 doSmcIndirectCallImpl[];
 extern const u32 doSmcIndirectCallImplSmcInstructionOffset, doSmcIndirectCallImplSize;
 
-// start.s
-void start2(u64 contextId);
-
 void doSmcIndirectCall(ExceptionStackFrame *frame, u32 smcId)
 {
     u32 codebuf[doSmcIndirectCallImplSize / 4]; // note: potential VLA
@@ -29,7 +27,7 @@ static void doCpuOnHook(ExceptionStackFrame *frame, u32 smcId)
     // frame->x[3] is contextId
     if (cpuId < 4) {
         g_coreCtxs[cpuId].kernelEntrypoint = ep;
-        frame->x[2] = (uintptr_t)start2;
+        frame->x[2] = g_loadImageLayout.startPa + 4;
     }
 }