Reach FF-M isolation level 3 on every port and close the AArch64 follow-ups

[aidangarske]

Context

Tracking issue for the work that makes the isolation level 3 claim true on STM32H563, MIMXRT700 and the AArch64 ports, plus the AArch64 items deferred from #29. Each item below has its own issue; check it off when its PR merges.

Origin

#29; the FF-M isolation level 3 compliance plan

What is needed

wolfTurst-M

• P0 Private security fixes (tracked privately, land first)
• Make the manifest's privilege and isolation level declarations match what the SPM enforces #36 P1 Manifest and isolation-level honesty
• Give the vault, crypto and attestation partitions private bands with a mechanical ownership check #37 P1 Three-band split with the composition invariant and restart lifecycle
• Add peripheral, MMIO and DMA ownership and put interrupts in a Secure disabled state at boot #38 P1 Peripheral, MMIO, DMA and interrupt ownership
• Harden the SPM against stack overflow and faults at level 3 #39 P1 SPM and fault hardening
• Review each port's hardware errata against the isolation assumptions #41 P2 Hardware errata review per port
• Share the isolation level 3 layer across Cortex-M ports instead of per board #65 P1 Shared Cortex-M level 3 layer and level 3 bar for every port
• Carry the isolation level 3 changes to the MIMXRT700 port #40 P2 MIMXRT700 parity for the level 3 changes (on Share the isolation level 3 layer across Cortex-M ports instead of per board #65)

wolfTrust-A

• Merge Add wolfTrust AArch64 support with QEMU virt and Versal ports #29
• W1 Split the AArch64 keystore band so vault, crypto and attestation meet isolation level 3 #43 P1 AArch64 keystore band split (closes with W5)
• W2 W2: Own interrupt lines and peripherals per partition on the AArch64 SPMC #67 P1 Interrupt and peripheral ownership on the AArch64 SPMC
• W3 W3: Harden the AArch64 SPMC against partition stack, SVC, deputy and FP faults #68 P1 AArch64 SPM hardening
• W4 W4: Add the manifest-honesty negatives to the QEMU AArch64 suite #69 P2 Manifest-honesty negatives on AArch64
• W5 qemuvirt manifests declare isolation level 3 (part of Split the AArch64 keystore band so vault, crypto and attestation meet isolation level 3 #43)
• W6 W6: Bring the QEMU AArch64 suite to parity with the M33MU negatives #70 P2 QEMU AArch64 parity with the M33MU negatives
• W7 Send the FF-A power management messages from the SPMD to the SPMC and partitions #44 P2 FF-A power management messages
• W8 Document the enforced isolation boundaries and state the level 3 claim #42 P2 Level 3 documentation and the public claim
• Add a Versal hardware port with an XMPU and XPPU Normal-world fence #45 P3 Versal hardware port with an XMPU and XPPU fence
• Share the isolation level 3 layer across AArch64 ports instead of per board #66 P1 Shared AArch64 level 3 layer

Order is dependency order; the tag is priority (P0 now, P1 next, P2 needed, P3 later).

Blockers and dependencies

The private fixes land first. #29 merges before the AArch64 items. The documentation and claim issue lands last.

Acceptance criteria

Every item above is closed, and the claim issue records the tested SHAs.