Share the isolation level 3 layer across AArch64 ports instead of per board

[aidangarske]

Context

The Armv8-M level 3 layer is moving to port/common/armv8m so a new Cortex-M port gets level 3 without rewriting it. AArch64 needs the same: the band layout, SPMC linker placement, S-EL0 partition bands and level 3 platform hooks must live once in port/common/aarch64, not per board in port/qemuvirt and port/versal.

Origin

#46, #29, the shared Armv8-M level 3 layer

What is needed

• A shared AArch64 level 3 layout header, platform file and linker fragment in port/common/aarch64; each board supplies only base addresses and its attribution backend
• The Split the AArch64 keystore band so vault, crypto and attestation meet isolation level 3 #43 keystore band split built on the shared layer rather than per board
• A level 3 required-scenario set for the QEMU runner that fails a port missing one
• An AArch64 section in the docs/Porting.md isolation level 3 guide

Blockers and dependencies

#29 merges first. #43 should land on this layer.

Acceptance criteria

• qemuvirt and versal-virt build level 3 from the shared layer with no per-board duplication of bands, hooks or linker sections
• QEMU level 3 negatives pass on both engines
• confboot 85/4/0 and positive on virt with both engines

[aidangarske]

Landed on wolfTrust-dev2 (PR #29) in d96e98f

• Shared layout: port/common/aarch64/l3_layout.h places every Secure EL1 band from the port's WT_L3_BAND_BASE. That covers the SPMC image and RAM, conformance window, keystore window with the vault, attestation and crypto bands, RX/TX, share page, ACS window, boot info and table pool. The board make fragments, the board memory_map.h files, the linker script, the probe code and the runner no longer carry their own copies.
• Shared hooks: port/common/aarch64/platform_l3.c holds the level 3 platform hooks. A board adds only l3_port.h (WT_L3_SPM_PERIPHERAL_BASE).
• Layout tool: tools/aarch64_l3_layout.py reads the layout from memory_map.h for the compiler, the linker and the runner. It also checks after the link that the manifest grants exactly the three keystore bands. An unreadable layout stops the build, and a band overridden on the command line reaches every consumer.
• Gate: WT_ISOLATION_LEVEL ?= 3 in mk/arch-aarch64.mk, where any other value stops the build. It uses the same names as the Cortex-M gate going into Share isolation level 3 across Armv8-M ports and bring MIMXRT700 to parity #72.
• Required scenarios: QEMU_A_L3_REQUIRED with a per-cell l3_exempt map, which also drives the planned scenarios. Versal exempts secramneg and periphneg, citing Add a Versal hardware port with an XMPU and XPPU Normal-world fence #45. scenario_matrix.py --selftest fails on a dropped scenario or an exemption without a reason.
• Docs:
  • docs/Porting.md states that level 3 is required for a new port, and adds an "Isolation level 3 on AArch64" section listing what a board supplies.
  • Macros.md and Building.md are updated.
  • The FF-A-Compatibility multi-guest row is scoped to the single AArch64 endpoint.

Verification:

• No layout change: across 356 EL3 and SPMC images on all three QEMU cells, every data, bss and absolute symbol address matches the images built at b3587f0.
• Full suites (both QEMU engines, ACS included):
  • virt GICv3 hsm: 64 pass, 1 skip
  • virt GICv2 native: 61 pass, 4 skip
  • versal-virt native: 59 pass, 6 skip
• After the final make fix, ACS discovery and the band negatives were rerun on virt and versal.
• Skoll review-security is clean. Skoll review is clean apart from a suggested host test for the layout tool, which was declined. The Porting.md text was checked against the code over four rounds.