Repository navigation
W6: Bring the QEMU AArch64 suite to parity with the M33MU negatives #70
Description
Context
Plan item W6 of the AArch64 level 3 plan (tracking #46). The QEMU AArch64 suite should exercise the same behaviors as the M33MU negatives wherever the AArch64 ports have the feature.
Origin
The M33MU scenario list compared with the QEMU AArch64 list; the AArch64 level 3 plan
What is needed
- Twins:
restartneg1torestartneg3(a restarted partition's band returns to its link-time image),hsmpinneg,sealneg,sealbootneg,sealhaltneg,sealpivotneg,remeasureneg,authneg,devattestqcbor,bothiso,bothpsa - Document as not applicable, with the reason, in docs/Testing.md:
gtzcnegandrevneg: STM32H5 onlyvnetandvnetneg: the H5 VNET optionbootupdateandfwustage: until wolfBoot boots the AArch64 imagerestart: no managed Normal-world guests, and S-EL0 restart is covered byspfaultnegandspbudgetneghsmfaultneg: the HSM tasklet is privileged S-EL1rollbackneg: needs persistent NVM and a rollback hook
Blockers and dependencies
restartneg1 to restartneg3 need #43 (W1), which brings private bands that reload on restart.
Acceptance criteria
- Every listed twin passes on virt gicv2 a35, virt gicv3 a72 and versal-virt with both engines, or SKIPs with a stated reason
- The not-applicable rows are in docs/Testing.md
- Skoll review and review-security clean on each change
Activity
aidangarske commentedon Oct 2, 2026
W6 progress, on wolfTrust-dev2 (#29):
No AArch64 twin needed, because the behaviour does not exist on AArch64:
sealneg,sealbootneg,sealhaltneg,sealpivotneg: Armv8-M secure stack sealing.authneg,remeasureneg,bothiso,bothpsa: these need managed, launch-authenticated Normal-world guests; the AArch64 ports run one unmanaged endpoint.Remaining: the other half of this issue (
hsmpinneg,restartneg1torestartneg3, and the not-applicable rows in docs/Testing.md), which lands in the next push.aidangarske commentedon Oct 3, 2026
Landed on wolfTrust-dev2 (#29), this session's half of W6:
hsmpinnegQEMU twin. Underhsm, the relay forges its wolfHSM server pointers into SPM RAM before every pin, and the positive flow still completes; an nm guard proves the probe is linked. It is skipped undernative.restartneg1torestartneg3QEMU twins. The crypto, attestation or vault partition plants state in its private band and faults once, and the restarted instance must find the band at its link-time image. With band reset disabled, all three fail on the second fault.Not applicable on AArch64 (documented in Testing.md):
restart,hsmfaultneg,authneg,remeasureneg,bothisoandbothpsa: there are no managed Normal-world guests.rollbackneg: the QEMU NVM is in RAM, so a version floor does not survive a reset.deputyneg: there is no privileged flash deputy.sealneg,sealbootneg,sealhaltnegandsealpivotneg: these test Armv8-M stack seals.Remaining in W6: none. The other half, including
devattestqcbor(8f7465c1), is already on dev2.