Repository navigation
Document the enforced isolation boundaries and state the level 3 claim #42
Description
Activity
W8 (the Cortex-A part of this issue) landed on wolfTrust-dev2 (PR #29) in eaee0625
docs/Security-Model.md gains a "Cortex-A isolation level 3" section for the AArch64 port on QEMU
virt. It has three parts:- The FF-M rule table (I1, I2, I3 and its three sub-boundaries, private runtime state, violation handling), with each row checked against the AArch64 code.
- Deviations: level 3 only (level 0 claims nothing), bounded restart of a faulted partition, one Normal-world FF-A endpoint,
xlnx-versal-virtclaiming no level until Add a Versal hardware port with an XMPU and XPPU Normal-world fence #45, and emulator evidence only. - Evidence: FF-M IPC 85 passed and 4 skipped, the six FF-A ACS groups at their floors with the recorded deviations, and the QEMU isolation negatives on both engines. All of it passed at b3587f0 in https://github.com/wolfSSL/wolfTrust/actions/runs/37090043983
Skoll
blogchecked the section against the dev2 code over three rounds and found five overclaims, all fixed: FF-A shared memory, restart semantics, the ACS deviation, profile 0, and the Versal block names. review and review-security are clean.The section sits just before "Source anchors", so it does not textually conflict with the H5 level 3 section #31 adds at the top of the file.
Context
The docs hedge the isolation level. Once the level 3 work lands, the docs should state each enforced boundary and its properties and make the claim on tested SHAs.
Origin
FF-M isolation level 3 compliance plan, WI-13 and WI-14
What is needed
Blockers and dependencies
Every other issue in the level 3 tracking issue.
Acceptance criteria