Repository navigation
W4: Add the manifest-honesty negatives to the QEMU AArch64 suite #69
Description
Context
Plan item W4 of the AArch64 level 3 plan (tracking #46). The M33MU manifest-honesty negatives (#36) have no QEMU twin yet.
Origin
#36 parity for the AArch64 ports; the AArch64 level 3 plan
What is needed
manifestneg2: a manifest declaring isolation level 2 is refused at bootmanifestneg3: a composed table that grants the vault a granule of the crypto partition's band is refused by the boot-time partition separation check
Blockers and dependencies
manifestneg3 needs #43 (W1), which gives each keystore partition a private band and runs the separation check on every AArch64 boot.
Acceptance criteria
- Both twins pass on virt gicv2 a35, virt gicv3 a72 and versal-virt with both engines
- Skoll review and review-security clean on the change
Activity
aidangarske commentedon Oct 3, 2026
Landed on wolfTrust-dev2 (#29):
manifestneg2QEMU twin: a manifest declaring isolation level 2 stops the boot with the manifest-validation panic.manifestneg3QEMU twin: a vault table granted part of the crypto partition's band is refused by the boot-time separation check, not the table builder, and the boot stops with the same panic.Remaining: none for W4.