Repository navigation
W3: Harden the AArch64 SPMC against partition stack, SVC, deputy and FP faults #68
Description
Context
Plan item W3 of the AArch64 level 3 plan (tracking #46). Main's SPM and fault hardening (#39) has no AArch64 counterpart yet; the AArch64 manifests stay at isolation_profile 0 until it lands.
Origin
#39 parity for the AArch64 SPMC; the AArch64 level 3 plan
What is needed
- Guard pages below every S-EL0 partition stack, so an overflow faults and restarts only that partition (twin of
mspovfneg) - No partition page both writable and executable, checked when the tables are composed (twin of
xnneg) - An invalid SVC from a partition panics only that partition (twin of
svcneg) - The confused-deputy refusal on the SPMC's privileged paths (twin of
deputyneg) - An FP and SIMD trap policy for partitions (twin of
fpneg)
Blockers and dependencies
#43 (W1, the keystore band split) lands first, since the guard pages sit beside its bands.
Acceptance criteria
- The five twins pass on virt gicv2 a35, virt gicv3 a72 and versal-virt with both engines
- The full AArch64 suite and the ACS stay green
- Skoll review and review-security clean on the change
Activity
aidangarske commentedon Oct 2, 2026
W3 is done on wolfTrust-dev2 (#29):
svcneg: a partition that issues the SPMC yield SVC is panicked and restarted.fpneg: a partition's FP instruction traps at S-EL0 and is contained.mspovfneg: an SPMC stack overflow hits an unmapped guard page and panics fail-closed.xnneg: executing from SPM RAM aborts (execute-never).deputyneghas no AArch64 counterpart. There is no privileged flash deputy: the vault's NVM sits in its own band and is reached at S-EL0, andbandnegalready shows other partitions are refused the keystore flash operation.Gates: Skoll review and review-security both clean; the full QEMU suite passes on virt (hsm) and versal-virt (native).