Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

ADR-047 — Isolation leftovers decisions (SError / PAN / _start / umbrella)

  • Status: Accepted (docs decision). Does not mint Verified for taken SError, PAN enable, yank _start, or “EL0 isolated.”
  • Date: 2026-09-13

Context

Track A / A5 closed a deep isolation ladder through ADR-042 (start-stay honesty), ADR-043 (FIQ + SError park), ADR-044 / ADR-045 (taken SError research + QMP attempt), and ADR-026 (PAN ID-field). Four leftovers still read as open Planned work in the ledger and roadmap even though sponsor intent is to decide them honestly rather than leave them as pending miles that invite a fake Verified.

This ADR records those decisions. It does not change guest code. CloudAgent HELD; (amd64 workstation) Docker re-smoke is optional for this docs-only PR.

Hypotheses

IDOptionNotes
H1 (chosen)Decide each leftover: taken SError = non-goal/deferred on this smoke machine; PAN enable = non-goal on default -cpu cortex-a57; never yank _start while -kernel needs 0x4008_0000; leftover frame RAM optional Planned; umbrella “EL0 isolated” stays Planned/non-claim.Honest close of the leftover decision without inventing probes.
H2 (rejected)Mark taken SError / PAN enable / “EL0 isolated” Verified from existing miles.Round-up. Forbidden.
H3 (rejected)Silent -cpu switch or yank _start to “finish” isolation.Breaks honesty / QEMU -kernel.

Decision

1. Taken lower-EL SError — non-goal / deferred on this smoke machine

  • QMP inject-nmi fails on QEMU 10 virt + -cpu cortex-a57 (machine does not provide NMIs). There is no honest host inject on this probe today (ADR-045).
  • Decision: taken lower-EL SError while standing is a non-goal / deferred on this smoke machine until an honest inject exists (new QEMU feature, accepted different machine story, or sponsor-approved CPU/GIC change with its own ADR).
  • Keep el0: serror-park Verified (park honesty).
  • Keep guest A-clear standing plumbing (el0: serror-arm / eret_to_el0_serror / EXPECT) as dormant prep — do not delete; do not require el0: serror in smoke.
  • Do not claim taken SError Verified.

2. PAN enable on default -cpu cortex-a57 — non-goal on the default probe CPU

  • ID field is 0 (pan: absent). Enable + EL1-vs-EL0 fault is impossible without inventing hardware (ADR-026).
  • Decision: PAN enable is a non-goal on the default probe CPU. Do not silent -cpu switch.
  • ID-field probe (pan: id= / pan: absent) stays Verified.
  • An optional future CPU story (different default -cpu, FEAT_PAN present, enable + fault probe) needs its own ADR + sponsor approval. Until then, do not claim PAN.

3. Yank _start / leftover identity RAM

Amended 2026-09-26 by ADR-089 (sponsor D2): “never yank _start” stands. Leftover identity RAM was torn (ADR-049, ADR-087), and the MMIO identity block was torn too (ADR-088). The _start stub page [0x4008_0000, 0x4008_1000) is the one documented identity exception, and a fail-closed TTBR0 inventory enforces it. The original text below is kept for history.

  • QEMU -kernel still needs _start at 0x4008_0000.
  • Decision: never yank _start while that boot contract holds. ident: start-stay / ident: ram-stay stay Verified honesty (ADR-042).
  • Leftover identity frame RAM after the heap may stay Planned as an optional later unmap. It is not required to close the umbrella isolation row under current constraints.
  • Do not claim “the kernel moved” or full identity teardown.

4. Umbrella “EL0 isolated” (P-SEC-3l) — Planned / non-claim

  • Decision: remains Planned / non-claim under current constraints (no PAN enable on a57, _start stays, taken SError deferred).
  • Specific Verified miles (IRQ/FIQ/tears/start-stay/PAN ID-field/…) are not this row. Do not round them up to “EL0 isolated.”
  • Follow-on (2026-09-28, M6): every ADR-055 §B row is Met and the sponsor accepted the umbrella sentence in writing (B3). This row is Verified, only as the accepted ADR-091 sentence. The decision above is as of 2026-09-14.

Status table (after this ADR)

ItemStatusNotes
el0: serror-parkVerifiedPark honesty
Guest A-clear SError prep (ADR-045)Dormant prepNot a taken probe
Taken lower-EL SError on this smoke machineDeferred / non-goal (locked)ADR-053
PAN ID-field on cortex-a57Verifiedpan: absent
PAN enable on default cortex-a57Non-goal (locked)ADR-054 reopen gate
ident: start-stay / never yank _startVerified (honesty) / decidedKeep 0x4008_0000
Leftover identity RAM after heapVerified (optional) via ADR-049Not umbrella-required
Umbrella “EL0 isolated”Planned / non-claim until checklistADR-055; constraints above

Honesty

Say the decisions above only as documentation. Do not say:

  • taken lower-EL SError is Verified
  • PAN is enabled / “EL0 isolated”
  • _start was yanked / the kernel moved
  • app hosting is done (see ADR-048)

Consequences

  • Docs: el0.md, security.md (threat-model v1.26), honesty ledger (Planned→decided wording), roadmap P-SEC-3k/3l/3r + leftover blurb, NFR-10 text in place, SUMMARY.
  • Code: unchanged. Smoke still requires park / start-stay / pan: absent; still rejects el0: serror as a required marker and rejects pan: enabled.
  • A later ADR may reopen taken SError (honest inject), PAN (new CPU story), or boot redesign so _start can leave identity — each needs sponsor scope.
  • 2026-09-14 locks: ADR-053 hard-stops taken SError with dated QMP evidence; ADR-054 locks PAN enable + reopen gate; ADR-055 publishes the umbrella non-claim checklist. Decisions in this ADR stand; those ADRs remove fuzzy Planned wording.
  • 2026-09-15 sponsor closure: ADR-060 is the sponsor-facing one-pager (locks + reopen gates). Does not rewrite decisions here.