[aidangarske]

Adds AArch64 (Cortex-A) support to wolfTrust.

• EL3 monitor: SMCCC 1.2, PSCI 1.1, FF-A SPMD
• S-EL1 SPMC running the FF-M core with Secure Partitions at S-EL0
• FF-A 1.2: discovery, direct and indirect messaging, notifications, interrupts, memory share/lend/donate with fragmentation
• FF-A power management messages: the SPMD tells the SPMC of every CPU_SUSPEND, CPU_OFF, SYSTEM_OFF and SYSTEM_RESET and completes it only on SUCCESS
• PSA client for the Normal world over FF-A
• Ports: QEMU virt (GICv2 and GICv3) and xlnx-versal-virt
• Both crypto engines (native, hsm)
• FF-M isolation level 3 on QEMU virt: a private keystore band each for vault, crypto and attestation, interrupt and peripheral ownership, SPM stack guard, SVC, FP and execute-never hardening
• Shared AArch64 level 3 layer in port/common/aarch64 (layout, platform hooks, layout tool), gated by WT_ISOLATION_LEVEL, so a new board supplies only its addresses
• QEMU twins of the M33MU isolation negatives (bandneg, restartneg, svcneg, fpneg, mspovfneg, xnneg, manifestneg2/3, periphspneg, hsmpinneg, devattestqcbor) with a required level 3 scenario set
• Host suites, QEMU scenario runner, Normal-world test payloads, CI matrix
• Arm FF-A ACS harness with recorded spec patches
• Docs: porting (level 3 required for new ports), FF-A compatibility register, testing, Cortex-A level 3 claim

Induced by merge into this branch

• Add SPM-mediated PKCS#11 and TPM 2.0 interfaces #76 Add SPM-mediated PKCS#11 and TPM 2.0 interfaces: wolfPKCS11 and firmware TPM providers in isolated partitions behind
  role-checked SPM relays, off by default, with level 3 layouts for STM32H563 and MIMXRT700
• Reduce TPM2 and PKCS11 size and cover both crypto engines #81 Reduce TPM2 and PKCS11 size and cover both crypto engines: default TPM2 and PKCS#11 builds 30 to 37% smaller, each
  within 8 KiB of the PSA build on the same crypto engine, tested with native and hsm

Closes #42, #43, #44, #66, #67, #68, #69, #70

DEFERRED

• Add a Versal hardware port with an XMPU and XPPU Normal-world fence #45 versal-virt has no Normal-world fence model, so versal claims no isolation level. Needs a Versal board to program and lock the XMPU and XPPU
• Forward FF-A power management messages to registered Secure Partitions on AArch64 #73 Power management messages from the SPMC to partitions and the warm boot message. No partition takes FF-A messages yet and there is no power-down state
• Run Zephyr and FreeRTOS as the AArch64 Normal-world OS over FF-A #74 Zephyr and FreeRTOS as the AArch64 Normal-world OS, like the H5 guests. Starts with Zephyr qemu_cortex_a53 as the single NS-EL1 OS
• Accept Hypervisor-allocated Normal-world VM ids in the AArch64 SPMC #75 SPMC accepting Normal-world VM ids other than 0, for a Hypervisor at NS-EL2 running several guests

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.