Add wolfTrust AArch64 support with QEMU virt and Versal ports

.github/workflows/README.md

@@ -1,7 +1,8 @@
 # wolfTrust CI
 
-CI has a fast per-PR host lane, the tiered M33MU emulator matrix, and static
-analysis. M33MU runs a per-port smoke set on every pull request and the full
+Three lanes, modeled on wolfProvider's CI: a fast per-PR host lane, the M33MU
+emulator matrix, and the AArch64 QEMU matrix, plus static analysis. Both
+emulator lanes are tiered: a smoke set on every pull request, and the full
 matrix on labels, main pushes, and nightly.
 
 `codeql.yml` runs C security queries. `coverity.yml` runs on Sundays at
@@ -22,7 +23,24 @@ An accepted upload queues analysis; results appear after Coverity processes it.
 |------|---------|---------|
 | **Fast (per-PR)** | every PR; push to main | host unit suites, ISO C99, house style, bare-scope scan, Arm PSA-FF conformance, cross-compile, compiler matrix, sanitizers, valgrind, integrations, core/port split guard |
 | **M33MU smoke** | every PR | per port, on both crypto engines: STM32H563 `positive gtzcneg crossdomain bothpsa confboot devcrypto`; MIMXRT700 `positive ahbscneg crossdomain bothpsa confboot devcrypto` |
-| **M33MU full** | PR labels `ci:all`, `ci:h5`, `ci:rt700`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) |
+| **M33MU full** | PR labels `ci:all`, `ci:stm32h563`, `ci:imxrt700`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) |
+| **AArch64 smoke** | every PR | a representative subset: `virt-gicv3-a72` `smoke boot positive crossdomain ffa-direct confboot devcrypto` on both crypto engines, `versal-virt` the same on the native engine, plus dedicated QEMU fwTPM and PKCS#11 interface and isolation jobs |
+| **AArch64 full** | PR labels `ci:all`, `ci:aarch64`, `ci:qemu-virt`, `ci:qemu-versal`; push to main; nightly; `workflow_dispatch` (cell input) | every AArch64 scenario and the Arm FF-A ACS groups on three QEMU cells under both crypto engines (see below) |
+
+All dedicated API and interface-isolation rows require a real terminal pass
+marker; a successful skip cannot satisfy the job. Each job identifies its
+engine and operation profile. M33MU runs 24 positives across
+`[default, full] x [native, hsm] x [psa, pkcs11, tpm] x [zephyr, freertos]`, plus
+eight interface-isolation jobs. QEMU `virt` runs 20 positives/isolation jobs
+across both profiles and engines. Versal cross-builds both engines, but its QEMU
+model cannot provide the XMPU/RISAF isolation those runtime scenarios require.
+
+`stm32h563_interface_footprint` builds the six default-profile API/engine pairs
+with the same compiler, pinned FreeRTOS source, one application and production
+PIN settings. Missing measurements fail the job. Each TPM/PKCS#11 total must
+remain within 8 KiB of same-engine PSA; the uploaded CSV reports Secure,
+application, total flash and RAM sections separately. This is a regression
+ceiling, not a claim of exact parity.
 
 The M33MU workflow (`m33mu.yml`) is label-selected the way wolfProvider's
 `pr-osp-select.yml` is: a `select` job checks the routing table
@@ -33,8 +51,8 @@ groups it picked, so a job that is not selected never appears as skipped.
 | Label | Effect |
 |-------|--------|
 | (no label) | each port's smoke tier on both engines |
-| `ci:h5` | the STM32H563 full matrix (the change touched only that port) |
-| `ci:rt700` | the MIMXRT700 full matrix (the change touched only that port) |
+| `ci:stm32h563` | the STM32H563 full matrix (the change touched only that port) |
+| `ci:imxrt700` | the MIMXRT700 full matrix (the change touched only that port) |
 | `ci:all` / `ci:m33mu` | every scenario of every port (a core change) |
 
 A label keeps applying on later pushes to the PR. Pushes to
@@ -60,6 +78,10 @@ test-target` also reads. The table below is a representative slice:
 | `stm32h563_confboot_<engine>` | `confboot` | full Arm FF-M IPC suite |
 | `stm32h563_devstorage_<engine>` | `devstorage` | PSA ITS/PS conformance |
 | `stm32h563_devcrypto_<engine>` | `devcrypto` | PSA Crypto conformance |
+| `stm32h563_pkcs11_<zephyr\|freertos>_<engine>_<profile>` | `pkcs11` | each RTOS application runs the nine-case default or 40-case full PKCS#11 suite through `SERVICE_PKCS11` and the isolated provider |
+| `stm32h563_tpm_<zephyr\|freertos>_<engine>_<profile>` | `tpm` | each RTOS application sends real TPM 2.0 commands through `SERVICE_TPM` to the Secure fwTPM partition |
+| `stm32h563_pkcs11neg_<engine>_<profile>` | `pkcs11neg` | PKCS#11 partition-band isolation and provider recovery |
+| `stm32h563_tpmneg_<engine>_<profile>` | `tpmneg` | TPM relay and fwTPM partition-band isolation |
 | `stm32h563_vaultrecover_<engine>` | `vaultrecover` | #95 foreign pool reformatted |
 | `stm32h563_vaultrecoversec_<engine>` | `vaultrecoversec` | #95 SECURED never wipes |
 | `mimxrt700_positive_<engine>` | `positive` | MIMXRT700 chain under the RT700 model, both guests finish |
@@ -86,6 +108,42 @@ full matrix on a PR, add its `ci:` label; off-PR against a branch,
 The local box gate `run_m33mu.sh` (a Zephyr+FreeRTOS lifecycle) and the
 `make test-target` loop remain the pre-push mirror of the M33MU jobs.
 
+## AArch64 QEMU
+
+`aarch64-cross-compile.yml` (workflow name **AArch64 cross compilation**) is
+label-selected the same way `m33mu.yml` is: a `select` job self-tests the
+matrix, reads the PR's `ci:*` labels, the event, and the dispatch input, and
+one matrix job runs exactly the cells it picked. It runs in
+`ghcr.io/wolfssl/wolfboot-ci-aarch64` on three cells, `virt-gicv2-a35`,
+`virt-gicv3-a72`, and `versal-virt`.
+
+| Label | Effect |
+|-------|--------|
+| (no label) | the smoke tier: `virt-gicv3-a72` (both engines) and `versal-virt` (native) run the catch-most subset |
+| `ci:qemu-virt` | the two `virt` cells' full suite and FF-A ACS (the change touched only that family) |
+| `ci:qemu-versal` | the `versal-virt` full suite and FF-A ACS |
+| `ci:aarch64` | every cell's full suite and FF-A ACS (a core AArch64 change) |
+| `ci:all` | this plus the full M33MU matrix |
+
+A label keeps applying on later pushes to the PR. Pushes to `main`, the nightly
+schedule (via `nightly.yml`), and manual dispatch (with a `cell` input) run the
+full matrix. The cells and the smoke subset live in
+`tests/target/lib/scenario_matrix.py`, which `make test-target-a` also reads
+(`WT_TIER=full` for the whole suite).
+
+| Check name | What it proves |
+|------------|----------------|
+| `qemuvirt_psa_<engine>` | the Normal-world PSA client uses the selected engine through FF-A |
+| `qemuvirt_tpm_<engine>_<profile>` | the Normal-world application sends real TPM 2.0 GetRandom, CreatePrimary, Sign, and full-profile PCR Extend/Read commands through FF-A and `SERVICE_TPM` to the isolated fwTPM |
+| `qemuvirt_tpmneg_<engine>_<profile>` | the fwTPM round trip plus TPM state-band, provider-RAM, and execute-never isolation negatives |
+| `qemuvirt_pkcs11_<engine>_<profile>` | the Normal-world application runs nine default or 40 full PKCS#11 cases through FF-A and the isolated provider |
+| `qemuvirt_pkcs11neg_<engine>_<profile>` | the PKCS#11 suite plus state-band, provider-RAM, execute-never, and engine-appropriate restart/recovery negatives |
+| `el3_<cell>_<engine>` | the EL3 image links under the symbol guard, then the tier's QEMU AArch64 scenarios run through `tests/target/run_suite.sh qemu-a` |
+| `ffa_acs_<cell>_<engine>` | the Arm FF-A ACS groups (discovery, direct and indirect messaging, memory, notifications, interrupts) at their asserted floors (full tier only) |
+
+To run a scenario locally, use `tests/target/run_qemu_a_scenario.sh <key>`
+with `MACHINE`, `GIC`, `CPU`, and `WT_ENGINE` set as in the workflow.
+
 ## Host unit suites (per-suite checks)
 
 `unit-tests.yml` reads `UNIT_SUITES` from `tests/host/Makefile` (via

.github/workflows/_resolve-wolfssl.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   resolve:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 5
     outputs:
       matrix: ${{ steps.refs.outputs.matrix }}

.github/workflows/aarch64-cross-compile.yml

@@ -0,0 +1,180 @@
+name: AArch64 cross compilation
+
+on:
+  # Pull requests run the AArch64 smoke tier; the ci:all, ci:aarch64,
+  # ci:qemu-virt, and ci:qemu-versal labels, pushes to main, the nightly
+  # schedule (workflow_call from nightly.yml), and manual dispatch run the full
+  # cell matrix and the FF-A ACS.
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      cell:
+        description: AArch64 cell or family whose full matrix to run
+        type: choice
+        options: [all, qemu-virt, qemu-versal, virt-gicv2-a35, virt-gicv3-a72, versal-virt]
+        default: all
+  workflow_call:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: aarch64-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Label-selected the same way m33mu.yml is: one select job reads the ci:*
+  # labels (ci:qemu-virt or ci:qemu-versal for a family's full matrix, ci:all
+  # or ci:aarch64 for every cell, no label for the smoke tier), the event, and
+  # the dispatch input, then one matrix job runs exactly those cells.
+  select:
+    name: qemu_a_select
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.p.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - id: p
+        env:
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ' ') }}
+          CELL_INPUT: ${{ inputs.cell }}
+        run: |
+          python3 tests/target/lib/scenario_matrix.py --selftest
+          matrix=$(python3 tests/target/lib/scenario_matrix.py --aarch64-plan)
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+          printf '%s' "$matrix" | python3 -c 'import json, sys
+          for e in json.load(sys.stdin):
+              print(e["job"], "(" + e["engine"] + ")")'
+
+  interfaces-qemu-a:
+    name: qemuvirt_${{ matrix.scenario }}_${{ matrix.engine }}_${{ matrix.profile }}
+    if: >-
+      github.event_name != 'workflow_dispatch' || inputs.cell == '' ||
+      inputs.cell == 'all' || inputs.cell == 'qemu-virt' ||
+      inputs.cell == 'virt-gicv3-a72'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    container:
+      image: ghcr.io/wolfssl/wolfboot-ci-aarch64:v1.15
+    strategy:
+      fail-fast: false
+      matrix:
+        scenario: [positive, tpm, tpmneg, pkcs11, pkcs11neg]
+        engine: [native, hsm]
+        profile: [default, full]
+    env:
+      WT_ENGINE: ${{ matrix.engine }}
+      WT_CRYPTO_PROFILE: ${{ matrix.profile }}
+      WT_REQUIRE_SCENARIO_PASS: 1
+      MACHINE: virt
+      GIC: 3
+      CPU: cortex-a72
+      SMP: 1
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Trust the checked-out workspace
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Initialize wolfTrust dependencies
+        run: |
+          git config --global url."https://github.com/".insteadOf "git@github.com:"
+          git submodule update --init --single-branch lib/wolfSSL lib/wolfHSM lib/wolfCOSE lib/wolfPSA lib/wolfTPM lib/wolfPKCS11
+
+      - name: Toolchain and emulator versions
+        run: |
+          aarch64-none-elf-gcc --version | head -1
+          qemu-system-aarch64 --version | head -1
+
+      - name: Self-test the EL3 symbol guard and the expect library
+        run: |
+          tools/check-el3-symbols.sh --selftest
+          tests/target/lib/expect.sh --selftest
+
+      - name: Run the direct SPM interface scenario
+        run: tests/target/run_suite.sh qemu-a ${{ matrix.scenario }}
+
+      - name: Show the boot logs
+        if: always()
+        run: |
+          for f in logs/target-*.log; do
+            echo "== $f"
+            cat "$f" || true
+          done
+
+  qemu-a:
+    name: ${{ matrix.job }}
+    needs: select
+    runs-on: ubuntu-latest
+    # The serial suite takes 15-18 min per cell on the reference box; the
+    # per-scenario QEMU budgets are hang detectors, not expected runtimes.
+    timeout-minutes: 75
+    container:
+      image: ${{ matrix.image }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.select.outputs.matrix) }}
+    env:
+      WT_ENGINE: ${{ matrix.engine }}
+      MACHINE: ${{ matrix.machine }}
+      GIC: ${{ matrix.gic }}
+      CPU: ${{ matrix.cpu }}
+      SMP: ${{ matrix.smp }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Trust the checked-out workspace
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Initialize wolfTrust dependencies
+        run: |
+          git config --global url."https://github.com/".insteadOf "git@github.com:"
+          git submodule update --init --single-branch lib/wolfSSL lib/wolfHSM lib/wolfCOSE lib/wolfPSA lib/wolfTPM lib/wolfPKCS11
+
+      - name: Toolchain and emulator versions
+        run: |
+          aarch64-none-elf-gcc --version | head -1
+          qemu-system-aarch64 --version | head -1
+
+      - name: Self-test the EL3 symbol guard and the expect library
+        if: matrix.kind == 'suite'
+        run: |
+          tools/check-el3-symbols.sh --selftest
+          tests/target/lib/expect.sh --selftest
+
+      - name: Cross-build the EL3 monitor image (the symbol guard runs at link)
+        if: matrix.kind == 'suite'
+        run: make ARCH=aarch64 TARGET=${{ matrix.target }} WT_GIC_VERSION="$GIC" WT_CPU="$CPU" BUILD_DIR=build-aarch64-guard el3-image
+
+      - name: Cross-build the Versal TPM and PKCS11 interfaces
+        if: matrix.kind == 'suite' && matrix.target == 'versal'
+        run: |
+          make ARCH=aarch64 TARGET=versal WT_GIC_VERSION="$GIC" \
+            WT_CPU="$CPU" WT_PORT_BOOT_CPUS=1 WT_ENGINE=${{ matrix.engine }} CONFIG_TPM=y \
+            WT_ATTEST_COSE=0 BUILD_DIR=build-versal-tpm secure-image
+          make ARCH=aarch64 TARGET=versal WT_GIC_VERSION="$GIC" \
+            WT_CPU="$CPU" WT_PORT_BOOT_CPUS=1 CONFIG_PKCS11=y \
+            WT_ENGINE=${{ matrix.engine }} WT_ATTEST_COSE=0 \
+            BUILD_DIR=build-versal-pkcs11 secure-image
+
+      - name: Fetch the pinned Arm FF-A ACS once for the six groups
+        if: matrix.kind == 'acs'
+        run: |
+          tests/upstream/fetch_ffa_acs.sh "$GITHUB_WORKSPACE/.acs-cache"
+          echo "WT_FFA_ACS_CACHE=$GITHUB_WORKSPACE/.acs-cache" >> "$GITHUB_ENV"
+
+      - name: Run the AArch64 scenarios
+        run: tests/target/run_suite.sh qemu-a ${{ matrix.scenarios }}
+
+      - name: Show the boot logs
+        if: always()
+        run: |
+          for f in logs/target-*.log; do
+            echo "== $f"
+            cat "$f" || true
+          done

.github/workflows/auto-pin-dependencies.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   pin:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4

.github/workflows/core-port-split.yml

@@ -25,11 +25,13 @@ jobs:
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
           git config --global url."https://github.com/".insteadOf git@github.com:
 
-      - name: Self-test the split and port-only-diff guards
+      - name: Self-test the guards and the scenario assertion library
         run: |
           tools/check-core-port-split.sh --selftest
           tools/check-port-only-diff.sh --selftest
           tools/check-docs-no-internal-links.sh --selftest
+          tools/check-el3-symbols.sh --selftest
+          tests/target/lib/expect.sh --selftest
 
       - name: Enforce the core/port split (strict)
         run: WT_SPLIT_STRICT=1 tools/check-core-port-split.sh

.github/workflows/cross-compile.yml

@@ -25,7 +25,9 @@ jobs:
           git config --global url."https://github.com/".insteadOf git@github.com:
           git submodule update --init --depth 1 --jobs 4 \
             lib/wolfCOSE lib/wolfHSM lib/wolfPSA lib/wolfSSL \
-            lib/wolfhal
+            lib/wolfTPM lib/wolfPKCS11 lib/wolfhal
+          test -f lib/wolfTPM/src/fwtpm/fwtpm.c
+          test -f lib/wolfPKCS11/src/wolfpkcs11.c
       - name: Build STM32H563 secure firmware
         run: make -C tests/firmware/stm32h563 all TOOLPREFIX=arm-none-eabi-
       - name: Validate the LTO gate, rebuild, and size reduction
@@ -119,3 +121,13 @@ jobs:
               WT_CONFORMANCE=1 secure-image TOOLPREFIX=arm-none-eabi- \
               BUILD_DIR=build_rt700_conf_$engine
           done
+      - name: Build both interfaces with both crypto engines on both ports
+        run: |
+          for engine in native hsm; do
+            for target in stm32h563 mimxrt700; do
+              make TARGET="$target" CONFIG_TPM=y WT_ENGINE="$engine" \
+                WT_ATTEST_COSE=0 BUILD_DIR="build-$target-tpm-$engine" secure-image
+              make TARGET="$target" CONFIG_PKCS11=y WT_ENGINE="$engine" \
+                WT_ATTEST_COSE=0 BUILD_DIR="build-$target-pkcs11-$engine" secure-image
+            done
+          done

.github/workflows/fuzz.yml

@@ -17,7 +17,7 @@ jobs:
   # type here: schedule / manual dispatch get the full 600s soak; PR pushes and
   # merges get the 60s smoke that keeps the required checks fast.
   select:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     outputs:
       matrix: ${{ steps.pick.outputs.matrix }}
     steps:
@@ -39,7 +39,7 @@ jobs:
   fuzz:
     name: fuzz_${{ matrix.name }}
     needs: select
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 20
     strategy:
       fail-fast: false

.github/workflows/integration-tests.yml

@@ -22,7 +22,7 @@ jobs:
   wolfcose:
     name: wolfcose_integration_${{ matrix.name }}
     needs: resolve
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     container:
       image: ghcr.io/wolfssl/wolftrust-ci:latest-beb806af7628e02acee729632a74a7a3630f21fd
     timeout-minutes: 30
@@ -69,7 +69,7 @@ jobs:
   wolfpsa:
     name: wolfpsa_integration_${{ matrix.name }}
     needs: resolve
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     container:
       image: ghcr.io/wolfssl/wolftrust-ci:latest-beb806af7628e02acee729632a74a7a3630f21fd
     timeout-minutes: 30