Hi Daero,

Thanks for the detailed analysis. Your reading of the current setup matches my understanding: the host unit-tests are effectively exercising the normal-world / hypervisor view of the shared core, which I suspect is more a consequence of the project’s earlier hypervisor-focused history than an explicit decision to cover both worlds equally.

On your specific questions:

1. Speaking generally, I do think it makes sense for full SPMC runtime behavior to be covered primarily by the vmapi / TFTF / integration-style tests, while the host unit-tests stay focused on shared logic and behavior that is local, deterministic, and easy to exercise in isolation. 2. That said, I also think there is value in adding unit-level coverage for SECURE_WORLD == 1 branches where the behavior is self-contained, particularly around manifest handling, VM-ID layout, and primary/partition rules. For that kind of logic, I would prefer a dedicated secure-world host configuration over trying to make all existing fixtures implicitly support both worlds.

More broadly, my view is that, for Hafnium as it is used today, S-EL2/SPMC behavior is increasingly the more important area to validate. So I do think improving coverage for secure world-specific logic is worthwhile, even if the broader runtime behavior remains better exercised through the higher-level test layers.

Happy to review an Gerrit change in that direction.

Thanks, Manish Badarkhe ________________________________ From: 이대로 daero_le.lee@samsung.com on behalf of 이대로 via Hafnium hafnium@lists.trustedfirmware.org Sent: 12 October 2026 04:42 To: shaun.longhorn@linaro.org shaun.longhorn@linaro.org; hafnium@lists.trustedfirmware.org hafnium@lists.trustedfirmware.org Subject: [Hafnium] Re: Question: do the host unit-tests target the normal-world (Hypervisor) role?

Hi Hafnium team,

Sorry for encrypted message. This is the original message that I want to ask.

----------------------------------------------------------------------- ------------

Subject: Question: do the host unit-tests target the normal-world (Hypervisor) role?

Hi maintainers,

I'm Daero Lee working on secure hypervisor solutions at Samsung S.LSI.

I've been reading through how the host unit-tests are set up and was curious about the intended world configuration, so I wanted to ask before changing anything.

From what I can see:

- test/unit_test:unit_tests builds with the host_fake_clang toolchain, which uses plat_arch = "fake" (build/toolchain/host.gni).

- The fake arch doesn't define SECURE_WORLD, and src/arch/fake/inc/hf/arch/vmid_base.h hardcodes the normal-world layout (HF_VM_ID_BASE 0, HF_OTHER_WORLD_ID HF_TEE_VM_ID).

- The aarch64 default in src/arch/aarch64/args.gni is secure_world = "0". So it looks like the unit-tests currently only ever exercise the normal-world (Hypervisor) view of the shared core. I was wondering whether that's a deliberate choice, or something that grew out of the project's earlier history as a Hypervisor.

Out of curiosity I also tried building the fake arch with SECURE_WORLD=1 locally, and noticed a few things I'd love your perspective on:

- src/manifest.c has SECURE_WORLD-dependent branches (run-time EL vs S_EL, reserved VM-ID range, primary-VM rules), and the secure-world path doesn't appear to have direct unit coverage.

- Some fixtures seem tied to the normal world, e.g. vm_test.cc:117 uses vm_find(1) (which isn't valid when HF_VM_ID_BASE = 0x8000), and the manifest goldens expect EL1. Switching to SECURE_WORLD=1 makes those fail and the vm tests dereference NULL.

- The more clearly world-independent suites (bits/fdt/ipi/mm/mpool/string/vcpu) pass unchanged in both settings.

My questions, if you don't mind:

1. Speaking generally, do you see SPMC runtime behavior as something the integration/TFTF tests should cover, keeping the unit-tests focused on shared, world-independent logic?

2. If unit-level coverage of the SECURE_WORLD == 1 branches (mainly manifest.c, VM-ID/primary handling) would be useful, would you prefer a second secure-world host toolchain (parameterized like the aarch64 secure_world arg), or just making the fixtures world-agnostic?

Happy to put together a Gerrit change in whichever direction you think makes sense.

Thanks for your time.

----------------------------------------------------------------------- ---------------------

Best regards,

Daero Lee

--------- Original Message ---------

Sender : Shaun Longhorn via Hafnium hafnium@lists.trustedfirmware.org

Date : 2026-10-08 20:04 (GMT+9)

Title : [Hafnium] Re: Question: do the host unit-tests target the normal-world (Hypervisor) role?

Hi Daero,

Please retry your translated post.

Kinds Regards,

Shaun

Trusted Firmware

Community Manager

On Tue, 6 Oct 2026 at 10:47, 이대로 via Hafnium <

hafnium@lists.trustedfirmware.org> wrote:

[89WvfwGAfwEKStaSsUXVEgAAAABJRU5ErkJggg==]

보안 문서

보안 문서는 PDF로 암호화 됩니다.

보안문서 열람을 위해 인증 방법 및 필수 설치프로그램을 확인하여 주십시오.

 * 1. 보안문서를 조회하려면 본인인증이 필요합니다.

 * - Knox Portal 사용자 : Knox Portal 아이디 + 비밀번호

 * - 미사용자 : E-mail주소 + *사전등록 비밀번호

 * *사전등록 비밀번호 : 별도 수신한 '보안 문서 열람을 위한 등록안내' 메일 참고

 * 2. 보안문서는 Adobe Reader로만 열람 가능합니다.

 * Adobe Reader 10.1.1 이상 설치되어 있어야 사용 가능합니다.

 * 미 설치자의 경우 [1]클릭하여 설치하세요.

 * * Windows 뷰어 앱으로 오픈 불가 [ windows 8.1 이상]

 * 3. 보안문서를 열람하는 동안 화면캡쳐방지 프로그램이 동작합니다.

 * 해당 프로그램은 화면캡쳐를 제한하는 기능만을 포함합니다.

 * 자동 설치되지 않을 경우 [2]클릭하여 설치하세요.

 * 4. 보안문서의 답장, 전달 시 최초 수신인 외에는 열람이 불가합니다.

필수 프로그램 설치하였으나 PDF 파일이 열리지 않을 경우 아래 내용을 확인해주세요.

브라우저의 PDF 저장 설정 (Chrome) 설정 → 개인정보 및 보안 → 사이트 설정 → 추가 콘텐츠 설정 → PDF

문서 →

‘Chrome에서 PDF 파일을 자동으로 여는 대신 다운로드’를 On으로 설정 (Edge) 설정 → 쿠키 및 사이트

권한 →

PDF 문서 → ‘항상 PDF 파일 다운로드‘를 On으로 설정 Adobe Reader PDF 파일을 저장 후 Adobe

Reader 프로그램을 단독 실행하여 저장된 PDF파일 불러오기로 진행

※ 문제해결이 되지 않는 경우 Adobe Reader 프로그램 삭제 후 Adobe Reader DC버전으로 재설치 후

다시

시도해 주십시오.

추가적인 도움이 필요하시면 [3]FAQ 확인 또는

서비스 데스크 (+82-(2)-1661-3311 <+82%202-1661-3311>) 로 연락주십시오.

Security Document

Secure documents are encrypted into PDF.

Check the authentication procedure and required installation

program to

view the security document

 * 1. To view a secure document, you need to authenticate

yourself

   using the following information.

 * - Knox Portal User : Knox Portal ID + Knox Portal Password

 * - Knox Portal Non-User : E-mail address + *pre-registered

Password

 * *pre-registered Password : See the "Guide for Security Mail,"

which

   was sent separately.

 * 2. Security documents can be viewed only with Adobe Reader.

 * It can be used only if the installed version is 10.1.1 or

higher.

 * If you have not installed it yet, please [4]click to install

it.

 * * Cannot be opened with Windows Viewer App [ windows 8.1 or

higher

   ]

 * 3. The screen capture prevention program is active while

viewing a

   secure document.

 * It only has a feature that blocks screen captures.

 * If it does not install automatically, please [5]click to

install

   it.

 * 4. When replying or forwarding a secure document, it is not

   available for viewing except the first recipient.

If the required program is installed but the PDF file does not

open,

please check the following.

PDF Save Settings in Browser (Chrome) Settings → Privacy and

security →

Site Settings → Additional content settings →

PDF documents → Select "Download PDFs" (Edge) Settings → Cookies

and

site permissions → PDF documents →

Select "Always download PDF files" Adobe Reader After saving the

PDF

file, run the Adobe Reader program alone and proceed to loading

the

file If the problem is not resolved,

uninstall the Adobe Reader program, reinstall the Adobe Reader DC

version, and try again.

If you need additional help, please check [6]FAQ or contact us.

Service Desk (+82-(2)-1661-3311 <+82%202-1661-3311>)

References

https://protect2.fireeye.com/v1/url?k=e7d95989-b8426096-e7d8d2c6-000bab dfecba-fac0deb2a457034e&q=1&e=4cd4f1a0-221f-4a9d-9378-7d20221493d1&u=ht tp%3A%2F%2Fglobal103.cdnworks.com%2FAdbeRdr10112_mui_Std.zip

2. http://ssdrm.samsung.net/install/ssdrm/SSDRM_for_mySingle.exe

3. http://ssdrm.samsung.net/static/ssdrm/mySingle_SSDRM_FAQ_ko.pdf

https://protect2.fireeye.com/v1/url?k=f65bf9c5-a9c0c0da-f65a728a-000bab dfecba-01451e05ba05e27b&q=1&e=4cd4f1a0-221f-4a9d-9378-7d20221493d1&u=ht tp%3A%2F%2Fglobal103.cdnworks.com%2FAdbeRdr10112_mui_Std.zip

5. http://ssdrm.samsung.net/install/ssdrm/SSDRM_for_mySingle.exe

6. http://ssdrm.samsung.net/static/ssdrm/mySingle_SSDRM_FAQ_en.pdf

--

Hafnium mailing list -- hafnium@lists.trustedfirmware.org

To unsubscribe send an email to

hafnium-leave@lists.trustedfirmware.org

--

Hafnium mailing list -- hafnium@lists.trustedfirmware.org

To unsubscribe send an email to hafnium-leave@lists.trustedfirmware.org

[cid:cafe_image_0@s-core.co.kr] [cid:cafe_image_1@s-core.co.kr]

[update?userid=daero_le.lee&do=bWFpbElEPTIwMjYxMDEyMDM0MjQ2ZXBjbXMycDgw ZjM1NTgzNGVlMzgwNTA2NmNmYzEzYWViMjMxMTUyNSZyZWNpcGllbnRBZGRyZXNzPWhhZm5 pdW1AbGlzdHMudHJ1c3RlZGZpcm13YXJlLm9yZw__] -- Hafnium mailing list -- hafnium@lists.trustedfirmware.org To unsubscribe send an email to hafnium-leave@lists.trustedfirmware.org