Add wolfTrust AArch64 support with QEMU virt and Versal ports

.github/workflows/README.md

@@ -1,7 +1,8 @@
 # wolfTrust CI
 
-CI has a fast per-PR host lane, the tiered M33MU emulator matrix, and static
-analysis. M33MU runs a per-port smoke set on every pull request and the full
+Three lanes, modeled on wolfProvider's CI: a fast per-PR host lane, the M33MU
+emulator matrix, and the AArch64 QEMU matrix, plus static analysis. Both
+emulator lanes are tiered: a smoke set on every pull request, and the full
 matrix on labels, main pushes, and nightly.
 
 `codeql.yml` runs C security queries. `coverity.yml` runs on Sundays at
@@ -22,7 +23,9 @@ An accepted upload queues analysis; results appear after Coverity processes it.
 |------|---------|---------|
 | **Fast (per-PR)** | every PR; push to main | host unit suites, ISO C99, house style, bare-scope scan, Arm PSA-FF conformance, cross-compile, compiler matrix, sanitizers, valgrind, integrations, core/port split guard |
 | **M33MU smoke** | every PR | per port, on both crypto engines: STM32H563 `positive gtzcneg crossdomain bothpsa confboot devcrypto`; MIMXRT700 `positive ahbscneg crossdomain bothpsa confboot devcrypto` |
-| **M33MU full** | PR labels `ci:all`, `ci:h5`, `ci:rt700`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) |
+| **M33MU full** | PR labels `ci:all`, `ci:stm32h563`, `ci:imxrt700`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) |
+| **AArch64 smoke** | every PR | a representative subset: `virt-gicv3-a72` `smoke boot positive crossdomain ffa-direct confboot devcrypto` on both crypto engines, and `versal-virt` the same on the native engine |
+| **AArch64 full** | PR labels `ci:all`, `ci:aarch64`, `ci:qemu-virt`, `ci:qemu-versal`; push to main; nightly; `workflow_dispatch` (cell input) | every AArch64 scenario and the Arm FF-A ACS groups on three QEMU cells under both crypto engines (see below) |
 
 The M33MU workflow (`m33mu.yml`) is label-selected the way wolfProvider's
 `pr-osp-select.yml` is: a `select` job checks the routing table
@@ -33,8 +36,8 @@ groups it picked, so a job that is not selected never appears as skipped.
 | Label | Effect |
 |-------|--------|
 | (no label) | each port's smoke tier on both engines |
-| `ci:h5` | the STM32H563 full matrix (the change touched only that port) |
-| `ci:rt700` | the MIMXRT700 full matrix (the change touched only that port) |
+| `ci:stm32h563` | the STM32H563 full matrix (the change touched only that port) |
+| `ci:imxrt700` | the MIMXRT700 full matrix (the change touched only that port) |
 | `ci:all` / `ci:m33mu` | every scenario of every port (a core change) |
 
 A label keeps applying on later pushes to the PR. Pushes to
@@ -86,6 +89,37 @@ full matrix on a PR, add its `ci:` label; off-PR against a branch,
 The local box gate `run_m33mu.sh` (a Zephyr+FreeRTOS lifecycle) and the
 `make test-target` loop remain the pre-push mirror of the M33MU jobs.
 
+## AArch64 QEMU
+
+`aarch64-cross-compile.yml` (workflow name **AArch64 cross compilation**) is
+label-selected the same way `m33mu.yml` is: a `select` job self-tests the
+matrix, reads the PR's `ci:*` labels, the event, and the dispatch input, and
+one matrix job runs exactly the cells it picked. It runs in
+`ghcr.io/wolfssl/wolfboot-ci-aarch64` on three cells, `virt-gicv2-a35`,
+`virt-gicv3-a72`, and `versal-virt`.
+
+| Label | Effect |
+|-------|--------|
+| (no label) | the smoke tier: `virt-gicv3-a72` (both engines) and `versal-virt` (native) run the catch-most subset |
+| `ci:qemu-virt` | the two `virt` cells' full suite and FF-A ACS (the change touched only that family) |
+| `ci:qemu-versal` | the `versal-virt` full suite and FF-A ACS |
+| `ci:aarch64` | every cell's full suite and FF-A ACS (a core AArch64 change) |
+| `ci:all` | this plus the full M33MU matrix |
+
+A label keeps applying on later pushes to the PR. Pushes to `main`, the nightly
+schedule (via `nightly.yml`), and manual dispatch (with a `cell` input) run the
+full matrix. The cells and the smoke subset live in
+`tests/target/lib/scenario_matrix.py`, which `make test-target-a` also reads
+(`WT_TIER=full` for the whole suite).
+
+| Check name | What it proves |
+|------------|----------------|
+| `el3_<cell>_<engine>` | the EL3 image links under the symbol guard, then the tier's QEMU AArch64 scenarios run through `tests/target/run_suite.sh qemu-a` |
+| `ffa_acs_<cell>_<engine>` | the Arm FF-A ACS groups (discovery, direct and indirect messaging, memory, notifications, interrupts) at their asserted floors (full tier only) |
+
+To run a scenario locally, use `tests/target/run_qemu_a_scenario.sh <key>`
+with `MACHINE`, `GIC`, `CPU`, and `WT_ENGINE` set as in the workflow.
+
 ## Host unit suites (per-suite checks)
 
 `unit-tests.yml` reads `UNIT_SUITES` from `tests/host/Makefile` (via

.github/workflows/_resolve-wolfssl.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   resolve:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 5
     outputs:
       matrix: ${{ steps.refs.outputs.matrix }}

.github/workflows/aarch64-cross-compile.yml

@@ -0,0 +1,113 @@
+name: AArch64 cross compilation
+
+on:
+  # Pull requests run the AArch64 smoke tier; the ci:all, ci:aarch64,
+  # ci:qemu-virt, and ci:qemu-versal labels, pushes to main, the nightly
+  # schedule (workflow_call from nightly.yml), and manual dispatch run the full
+  # cell matrix and the FF-A ACS.
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      cell:
+        description: AArch64 cell or family whose full matrix to run
+        type: choice
+        options: [all, qemu-virt, qemu-versal, virt-gicv2-a35, virt-gicv3-a72, versal-virt]
+        default: all
+  workflow_call:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Label-selected the same way m33mu.yml is: one select job reads the ci:*
+  # labels (ci:qemu-virt or ci:qemu-versal for a family's full matrix, ci:all
+  # or ci:aarch64 for every cell, no label for the smoke tier), the event, and
+  # the dispatch input, then one matrix job runs exactly those cells.
+  select:
+    name: qemu_a_select
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.p.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - id: p
+        env:
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ' ') }}
+          CELL_INPUT: ${{ inputs.cell }}
+        run: |
+          python3 tests/target/lib/scenario_matrix.py --selftest
+          matrix=$(python3 tests/target/lib/scenario_matrix.py --aarch64-plan)
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+          printf '%s' "$matrix" | python3 -c 'import json, sys
+          for e in json.load(sys.stdin):
+              print(e["job"], "(" + e["engine"] + ")")'
+
+  qemu-a:
+    name: ${{ matrix.job }}
+    needs: select
+    runs-on: ubuntu-latest
+    # The serial suite takes 15-18 min per cell on the reference box; the
+    # per-scenario QEMU budgets are hang detectors, not expected runtimes.
+    timeout-minutes: 75
+    container:
+      image: ${{ matrix.image }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.select.outputs.matrix) }}
+    env:
+      WT_ENGINE: ${{ matrix.engine }}
+      MACHINE: ${{ matrix.machine }}
+      GIC: ${{ matrix.gic }}
+      CPU: ${{ matrix.cpu }}
+      SMP: ${{ matrix.smp }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Trust the checked-out workspace
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Initialize wolfTrust dependencies
+        run: |
+          git config --global url."https://github.com/".insteadOf "git@github.com:"
+          git submodule update --init --single-branch lib/wolfSSL lib/wolfHSM lib/wolfCOSE lib/wolfPSA
+
+      - name: Toolchain and emulator versions
+        run: |
+          aarch64-none-elf-gcc --version | head -1
+          qemu-system-aarch64 --version | head -1
+
+      - name: Self-test the EL3 symbol guard and the expect library
+        if: matrix.kind == 'suite'
+        run: |
+          tools/check-el3-symbols.sh --selftest
+          tests/target/lib/expect.sh --selftest
+
+      - name: Cross-build the EL3 monitor image (the symbol guard runs at link)
+        if: matrix.kind == 'suite'
+        run: make ARCH=aarch64 TARGET=${{ matrix.target }} WT_GIC_VERSION="$GIC" WT_CPU="$CPU" BUILD_DIR=build-aarch64-guard el3-image
+
+      - name: Fetch the pinned Arm FF-A ACS once for the six groups
+        if: matrix.kind == 'acs'
+        run: |
+          tests/upstream/fetch_ffa_acs.sh "$GITHUB_WORKSPACE/.acs-cache"
+          echo "WT_FFA_ACS_CACHE=$GITHUB_WORKSPACE/.acs-cache" >> "$GITHUB_ENV"
+
+      - name: Run the AArch64 scenarios
+        run: tests/target/run_suite.sh qemu-a ${{ matrix.scenarios }}
+
+      - name: Show the boot logs
+        if: always()
+        run: |
+          for f in logs/target-*.log; do
+            echo "== $f"
+            cat "$f" || true
+          done

.github/workflows/auto-pin-dependencies.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   pin:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4

.github/workflows/core-port-split.yml

@@ -25,11 +25,13 @@ jobs:
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
           git config --global url."https://github.com/".insteadOf git@github.com:
 
-      - name: Self-test the split and port-only-diff guards
+      - name: Self-test the guards and the scenario assertion library
         run: |
           tools/check-core-port-split.sh --selftest
           tools/check-port-only-diff.sh --selftest
           tools/check-docs-no-internal-links.sh --selftest
+          tools/check-el3-symbols.sh --selftest
+          tests/target/lib/expect.sh --selftest
 
       - name: Enforce the core/port split (strict)
         run: WT_SPLIT_STRICT=1 tools/check-core-port-split.sh

.github/workflows/fuzz.yml

@@ -17,7 +17,7 @@ jobs:
   # type here: schedule / manual dispatch get the full 600s soak; PR pushes and
   # merges get the 60s smoke that keeps the required checks fast.
   select:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     outputs:
       matrix: ${{ steps.pick.outputs.matrix }}
     steps:
@@ -39,7 +39,7 @@ jobs:
   fuzz:
     name: fuzz_${{ matrix.name }}
     needs: select
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 20
     strategy:
       fail-fast: false

.github/workflows/integration-tests.yml

@@ -22,7 +22,7 @@ jobs:
   wolfcose:
     name: wolfcose_integration_${{ matrix.name }}
     needs: resolve
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     container:
       image: ghcr.io/wolfssl/wolftrust-ci:latest-beb806af7628e02acee729632a74a7a3630f21fd
     timeout-minutes: 30
@@ -69,7 +69,7 @@ jobs:
   wolfpsa:
     name: wolfpsa_integration_${{ matrix.name }}
     needs: resolve
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     container:
       image: ghcr.io/wolfssl/wolftrust-ci:latest-beb806af7628e02acee729632a74a7a3630f21fd
     timeout-minutes: 30

.github/workflows/m33mu.yml

@@ -1,7 +1,7 @@
 name: M33MU
 
 on:
-  # Pull requests run each port's smoke tier; the ci:all, ci:h5, and ci:rt700
+  # Pull requests run each port's smoke tier; the ci:all, ci:stm32h563, and ci:imxrt700
   # labels, pushes to main, the nightly schedule (workflow_call from
   # nightly.yml), and manual dispatch run a port's full matrix.
   pull_request:
@@ -280,7 +280,7 @@ jobs:
           fi
 
   # Label-selected, the wolfProvider way: one select job reads the ci:* labels
-  # (ci:h5 or ci:rt700 for that port's full matrix when only that port
+  # (ci:stm32h563 or ci:imxrt700 for that port's full matrix when only that port
   # changed, ci:all or ci:m33mu for everything after a core change, no label
   # for each port's smoke tier), the event, and the dispatch input, then one
   # matrix job runs exactly those scenario groups, so nothing shows up skipped.

.github/workflows/nightly.yml

@@ -37,6 +37,9 @@ jobs:
   cross_compile:
     uses: ./.github/workflows/cross-compile.yml
 
+  aarch64_cross_compile:
+    uses: ./.github/workflows/aarch64-cross-compile.yml
+
   core_port_split:
     uses: ./.github/workflows/core-port-split.yml
 

.github/workflows/unit-tests.yml

@@ -31,7 +31,7 @@ jobs:
   host-unit-tests:
     name: ${{ matrix.suite }}
     needs: discover
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     container:
       image: ghcr.io/wolfssl/wolftrust-ci:latest-beb806af7628e02acee729632a74a7a3630f21fd
     timeout-minutes: 20
@@ -52,7 +52,7 @@ jobs:
     name: arm_psa_ff_conformance
     # Bare runner, not the CI image: the image inherits m33mu, and
     # make test-conformance takes the emulator path when m33mu is on PATH.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4

.github/workflows/wiki-sync.yml

@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   sync:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - name: Publish docs/ to wiki

.gitignore

@@ -1,8 +1,11 @@
 # Build outputs
 /build/
+/build-aarch64-*/
 tests/firmware/stm32h563/build/
 tests/firmware/stm32h563-vnet/build/
 tests/firmware/mimxrt700-baremetal/build/
+tests/firmware/aarch64-smoke/build/
+tests/firmware/aarch64-ns-smoke/build/
 tests/firmware/stm32h563-vnet/stm32h563_OTP.bin
 *.o
 /wolftrust
@@ -22,6 +25,11 @@ tests/fuzz/crash-*
 tests/fuzz/oom-*
 tests/fuzz/timeout-*
 
+# Target runner logs and the CI's FF-A ACS clone cache
+/ci-*.log
+/h5-uart-capture.log
+/.acs-cache/
+
 # Stray duplicate at repo root
 /stm32h563_OTP.bin
 

Makefile

@@ -21,7 +21,7 @@ include mk/common.mk
 
 .DEFAULT_GOAL := all
 
-.PHONY: all secure-image size-report test c99-check test-conformance test-target test-hardware fetch-psa-ff-tests \
+.PHONY: all secure-image size-report test c99-check test-conformance test-target test-target-a test-hardware fetch-psa-ff-tests \
 		clean firmware-stm32h563 run-stm32h563 run-stm32h563-tui run-stm32h563-uarts \
 		test-domain-host test-domain-compilers test-domain-sanitize \
 		test-domain-valgrind test-manifest-host test-manifest-compilers \
@@ -83,6 +83,20 @@ else
 	fi
 endif
 
+# AArch64 twin of test-target on QEMU (virt GICv2/GICv3, xlnx-versal-virt);
+# auto-detect qemu-system-aarch64 + aarch64-none-elf (or WT_TARGET_SCENARIOS=1),
+# skip explicitly otherwise. MACHINE/GIC/CPU/SMP pass through to the runner.
+# WT_TIER=smoke (default) runs the per-PR subset, WT_TIER=full the whole suite,
+# both from tests/target/lib/scenario_matrix.py (the FF-A ACS stays in CI).
+WT_QEMU_A_SCENARIOS ?= $(shell python3 tests/target/lib/scenario_matrix.py --aarch64-flat --tier $(WT_TIER))
+test-target-a:
+	@if ! tests/target/detect_qemu_a.sh >/dev/null 2>&1; then \
+		echo "SKIP: AArch64 QEMU scenarios ($$(tests/target/detect_qemu_a.sh 2>&1))"; \
+	else \
+		MACHINE="$(MACHINE)" GIC="$(GIC)" CPU="$(CPU)" SMP="$(SMP)" \
+			tests/target/run_suite.sh qemu-a $(WT_QEMU_A_SCENARIOS); \
+	fi
+
 # Real STM32H563 hardware equivalence suite: positive lifecycle + restart
 # recovery + cross-domain isolation on a Nucleo-H563ZI, the on-silicon
 # counterpart of test-target. Needs the ST-Link + board (detect_h5.sh) and a
@@ -147,6 +161,8 @@ clean:
 	rm -rf $(BUILD_DIR)
 	$(MAKE) -C tests/firmware/stm32h563 clean
 	$(MAKE) -C tests/firmware/stm32h563-vnet clean
+	$(MAKE) -C tests/firmware/aarch64-smoke clean
+	$(MAKE) -C tests/firmware/aarch64-ns-smoke clean
 	$(MAKE) -C tests/host/domain clean
 	$(MAKE) -C tests/host/manifest clean
 	$(MAKE) -C tests/host/lifecycle clean