Share the isolation level 3 layer across AArch64 ports instead of per board #66

Activity

1. aidangarske

   added

   todoDeferred work tracked for laterDeferred work tracked for later

   P1High: blocks a claim, release, or port milestone; next upHigh: blocks a claim, release, or port milestone; next up

   on Oct 2, 2026
2. aidangarske commented on Oct 3, 2026

   

   aidangarske

   on Oct 3, 2026

   MemberAuthor

   More actions

   Landed on wolfTrust-dev2 (PR #29) in d96e98f

   • Shared layout: port/common/aarch64/l3_layout.h places every Secure EL1 band from the port's WT_L3_BAND_BASE. That covers the SPMC image and RAM, conformance window, keystore window with the vault, attestation and crypto bands, RX/TX, share page, ACS window, boot info and table pool. The board make fragments, the board memory_map.h files, the linker script, the probe code and the runner no longer carry their own copies.
   • Shared hooks: port/common/aarch64/platform_l3.c holds the level 3 platform hooks. A board adds only l3_port.h (WT_L3_SPM_PERIPHERAL_BASE).
   • Layout tool: tools/aarch64_l3_layout.py reads the layout from memory_map.h for the compiler, the linker and the runner. It also checks after the link that the manifest grants exactly the three keystore bands. An unreadable layout stops the build, and a band overridden on the command line reaches every consumer.
   • Gate: WT_ISOLATION_LEVEL ?= 3 in mk/arch-aarch64.mk, where any other value stops the build. It uses the same names as the Cortex-M gate going into Share isolation level 3 across Armv8-M ports and bring MIMXRT700 to parity #72.
   • Required scenarios: QEMU_A_L3_REQUIRED with a per-cell l3_exempt map, which also drives the planned scenarios. Versal exempts secramneg and periphneg, citing Add a Versal hardware port with an XMPU and XPPU Normal-world fence #45. scenario_matrix.py --selftest fails on a dropped scenario or an exemption without a reason.
   • Docs:
     • docs/Porting.md states that level 3 is required for a new port, and adds an "Isolation level 3 on AArch64" section listing what a board supplies.
     • Macros.md and Building.md are updated.
     • The FF-A-Compatibility multi-guest row is scoped to the single AArch64 endpoint.

   Verification:

   • No layout change: across 356 EL3 and SPMC images on all three QEMU cells, every data, bss and absolute symbol address matches the images built at b3587f0.
   • Full suites (both QEMU engines, ACS included):
     • virt GICv3 hsm: 64 pass, 1 skip
     • virt GICv2 native: 61 pass, 4 skip
     • versal-virt native: 59 pass, 6 skip
   • After the final make fix, ACS discovery and the band negatives were rerun on virt and versal.
   • Skoll review-security is clean. Skoll review is clean apart from a suggested host test for the layout tool, which was declined. The Porting.md text was checked against the code over four rounds.