* [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables
@ 2026-06-27 14:44 Harsimran Singh Tungal
2026-06-27 14:44 ` [PATCH v3 01/10] efi_loader: add runtime memset helper Harsimran Singh Tungal
` (9 more replies)
0 siblings, 10 replies; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
Hi all,
This series adds FF-A runtime transport support so EFI variable runtime
services can communicate with the secure world after ExitBootServices().
It also extends tests, docs, and board configs to validate the runtime
path and keep boot-time behavior aligned with the runtime flow.
Changes in this series:
- Add EFI runtime-safe memset helper and FF-A runtime transport support.
- Implement FF-A runtime communication in the EFI variable TEE backend.
- Enable EFI runtime variable operations over the FF-A transport.
- Add sandbox runtime transport tests.
- Extend EFI selftests for runtime variables and bootefi selftest config.
- Document the FF-A runtime transport and selftest behavior.
Changes in v3:
Address Simon Glass's review comments:
- Move FF-A ExitBootServices event registration to the end of probe and
clean up RX/TX buffer handling on failure.
- Rename FF-A runtime-context helpers to the ffa_runtime_context_* form.
- Rework FF-A/MM cache maintenance to cover only rounded request and
response ranges.
- Add SetVirtualAddressMap handling for the FF-A shared buffer.
- Document FF-A shared-buffer ownership and alignment assumptions.
- Add EFIAPI to the TEE runtime GetVariable and GetNextVariableName
entry points.
- Tighten sandbox FF-A runtime tests and reset runtime state between
test cases.
- Update FF-A and bootefi documentation for the runtime transport and
split runtime-variable selftests.
- Rework commit messages to drop redundant information.
Address Ilias Apalodimas's review comments:
- Keep efi_var_common.c unchanged and drop commit 6 from v2 patchset.
- Rename the TEE/FF-A runtime handlers to the *_int_runtime form.
- Remove log_*() calls from __efi_runtime FF-A/MM communication paths.
Other:
- Fix FF-A memory-share sender_id to use the runtime private endpoint
ID after rebasing.
- Fix the expected QueryVariableInfo() return status for the
TEE-backed runtime selftest path.
Changes in v2:
Address Simon Glass's review comments:
- Fix efi_memset_runtime() style, declaration, and byte cast
- Tighten the FF-A runtime context failure path, clean up arm-ffa-runtime.c
style issues, and move ExitBootServices event registration earlier in probe
- Add shared-buffer bounds/alignment checks, and tightening comments/kernel-doc
- Document the FF-A shared buffer cacheline-alignment requirement and add
BUILD_BUG_ON() checks for the address
- Cache attributes before the shared buffer is reused, moving the read-only
check earlier, and split the u16_strsize() related change in separate patch
- Reword commit messages for the runtime helper relocation
- Rework the non-volatile runtime variable selftest into setup/verify phases
- Extend the sandbox FF-A runtime tests with no-context coverage,
runtime-context reset, and separate errno-mapping coverage
- Refresh the FF-A runtime transport and bootefi documentation
- Drop patch 12 in v1, as ffa_mm_communicate handles both runtime and
boottime capabilities in v2
- Squash patch 8 and patch 9 from v1
Address Ilias Apalodimas's review comments:
- Reuse common MM SP error mapping for boot and runtime paths
- Rename runtime-phase tracking to reflect the ExitBootServices transition
- Collapse duplicated boot-time and runtime MM communication helpers into common
implementations
- Keep the arm64 cache-maintenance path runtime-safe
- Move FF-A shared-buffer runtime memory-map registration to the end of
variable-service initialization
Link to v2: https://lore.kernel.org/u-boot/20260514124924.1804332-1-harsimransingh.tungal@arm.com/
Link to v1: https://lore.kernel.org/u-boot/20260424173151.371134-1-harsimransingh.tungal@arm.com/
Harsimran Singh Tungal (10):
efi_loader: add runtime memset helper
arm-ffa: add FF-A bus runtime support
efi_loader: add FF-A runtime support in EFI variable TEE driver
efi_loader: enable EFI runtime SetVariable()/GetVariable() using FF-A
transport
charset: mark u16_strsize() as __efi_runtime
corstone1000: enable bootefi selftest
efi: selftest: add runtime variable tests with non-volatile storage
test: dm: add sandbox FF-A runtime transport tests
doc: arm64: document FF-A runtime path for EFI variables
doc: bootefi: note two-phase runtime variables selftest
arch/arm/cpu/armv8/cache.S | 8 +
arch/arm/cpu/armv8/cache_v8.c | 13 +-
arch/sandbox/include/asm/sandbox_arm_ffa.h | 16 +-
configs/corstone1000_defconfig | 3 +
doc/arch/arm64.ffa.rst | 88 ++-
doc/usage/cmd/armffa.rst | 11 +
doc/usage/cmd/bootefi.rst | 31 +
drivers/firmware/arm-ffa/Kconfig | 11 +
drivers/firmware/arm-ffa/Makefile | 4 +-
drivers/firmware/arm-ffa/arm-ffa-runtime.c | 294 +++++++
drivers/firmware/arm-ffa/arm-ffa-uclass.c | 114 +--
drivers/firmware/arm-ffa/arm-ffa.c | 16 +-
drivers/firmware/arm-ffa/ffa-emul-uclass.c | 49 +-
include/arm_ffa.h | 16 +-
include/arm_ffa_priv.h | 22 +-
include/arm_ffa_runtime.h | 191 +++++
include/efi_loader.h | 3 +
lib/charset.c | 2 +-
lib/efi_loader/Kconfig | 4 +
lib/efi_loader/efi_runtime.c | 20 +
lib/efi_loader/efi_variable_tee.c | 726 +++++++++++++++---
.../efi_selftest_variables_runtime.c | 715 +++++++++++------
test/dm/Makefile | 3 +-
test/dm/ffa.c | 6 +-
test/dm/ffa_runtime.c | 123 +++
25 files changed, 1997 insertions(+), 492 deletions(-)
create mode 100644 drivers/firmware/arm-ffa/arm-ffa-runtime.c
create mode 100644 include/arm_ffa_runtime.h
create mode 100644 test/dm/ffa_runtime.c
--
2.34.1
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH v3 01/10] efi_loader: add runtime memset helper
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
@ 2026-06-27 14:44 ` Harsimran Singh Tungal
2026-06-29 18:21 ` Abdellatif El Khlifi
2026-06-27 14:44 ` [PATCH v3 02/10] arm-ffa: add FF-A bus runtime support Harsimran Singh Tungal
` (8 subsequent siblings)
9 siblings, 1 reply; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
Add efi_memset_runtime() for EFI runtime paths
This keeps buffer initialization in runtime-resident code after
ExitBootServices() and avoids relying on non-runtime helpers.
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
include/efi_loader.h | 3 +++
lib/efi_loader/efi_runtime.c | 20 ++++++++++++++++++++
2 files changed, 23 insertions(+)
diff --git a/include/efi_loader.h b/include/efi_loader.h
index 3a4d502631c..9dfea1fd7de 100644
--- a/include/efi_loader.h
+++ b/include/efi_loader.h
@@ -1151,6 +1151,9 @@ void efi_memcpy_runtime(void *dest, const void *src, size_t n);
/* runtime implementation of memcmp() */
int efi_memcmp_runtime(const void *s1, const void *s2, size_t n);
+/* runtime implementation of memset() */
+void *efi_memset_runtime(void *dest, int c, size_t n);
+
/* commonly used helper functions */
u16 *efi_create_indexed_name(u16 *buffer, size_t buffer_size, const char *name,
unsigned int index);
diff --git a/lib/efi_loader/efi_runtime.c b/lib/efi_loader/efi_runtime.c
index 73d4097464c..c0182931c42 100644
--- a/lib/efi_loader/efi_runtime.c
+++ b/lib/efi_loader/efi_runtime.c
@@ -233,6 +233,26 @@ int __efi_runtime efi_memcmp_runtime(const void *s1, const void *s2, size_t n)
return 0;
}
+/**
+ * efi_memset_runtime() - fill memory area
+ *
+ * At runtime memset() is not available.
+ *
+ * @dest: destination buffer
+ * @c: byte value used to fill destination buffer
+ * @n: number of bytes to set
+ * Return: pointer to destination buffer
+ */
+__efi_runtime void *efi_memset_runtime(void *dest, int c, size_t n)
+{
+ u8 *d = dest;
+
+ for (; n; --n)
+ *d++ = (u8)c;
+
+ return dest;
+}
+
/**
* efi_update_table_header_crc32() - Update crc32 in table header
*
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v3 02/10] arm-ffa: add FF-A bus runtime support
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
2026-06-27 14:44 ` [PATCH v3 01/10] efi_loader: add runtime memset helper Harsimran Singh Tungal
@ 2026-06-27 14:44 ` Harsimran Singh Tungal
2026-06-29 18:12 ` Abdellatif El Khlifi
` (2 more replies)
2026-06-27 14:44 ` [PATCH v3 03/10] efi_loader: add FF-A runtime support in EFI variable TEE driver Harsimran Singh Tungal
` (7 subsequent siblings)
9 siblings, 3 replies; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
Add the FF-A runtime infrastructure needed after ExitBootServices() so
EFI runtime services can continue to use the FF-A transport layer.
Introduce drivers/firmware/arm-ffa/arm-ffa-runtime.c and
include/arm_ffa_runtime.h with runtime-resident FF-A helpers for
direct messaging, SMC invocation, and error translation. Add the
sandbox runtime SMC wrapper, the ARM_FFA_RT_MODE Kconfig option, and
the ExitBootServices hook that copies the required FF-A runtime data
into resident storage before enabling the runtime context.
Tag the runtime code and data with __efi_runtime and
__efi_runtime_data so they remain available after
ExitBootServices().
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
----
Changelog:
===============
v3:
Simon:
- Move ExitBootServices event registration to the end of probe
- Use an early-return guard and log missing-context with log_warning()
- Rename the runtime-context helpers to the ffa_runtime_context_* form
- Drop the unrelated whitespace-only hunk
- Fix commit message styling
v2:
Simon:
- Leave runtime mode disabled if private data is missing
and update the log message
- Remove unused global-data plumbing
- Switch to `IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)`
- Fix style issues
- Register the ExitBootServices event earlier in probe
- Keep the runtime-enabled flag separate from copied boot time data
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
drivers/firmware/arm-ffa/Kconfig | 11 +
drivers/firmware/arm-ffa/Makefile | 4 +-
drivers/firmware/arm-ffa/arm-ffa-runtime.c | 294 +++++++++++++++++++++
drivers/firmware/arm-ffa/arm-ffa-uclass.c | 114 ++------
drivers/firmware/arm-ffa/arm-ffa.c | 16 +-
drivers/firmware/arm-ffa/ffa-emul-uclass.c | 12 +
include/arm_ffa.h | 16 +-
include/arm_ffa_priv.h | 22 +-
include/arm_ffa_runtime.h | 191 +++++++++++++
test/dm/ffa.c | 6 +-
10 files changed, 567 insertions(+), 119 deletions(-)
create mode 100644 drivers/firmware/arm-ffa/arm-ffa-runtime.c
create mode 100644 include/arm_ffa_runtime.h
diff --git a/drivers/firmware/arm-ffa/Kconfig b/drivers/firmware/arm-ffa/Kconfig
index 3706a889305..7aaf25fdb58 100644
--- a/drivers/firmware/arm-ffa/Kconfig
+++ b/drivers/firmware/arm-ffa/Kconfig
@@ -18,6 +18,9 @@ config ARM_FFA_TRANSPORT
The FF-A support in U-Boot is based on FF-A specification v1.0 and uses SMC32
calling convention.
+ The FF-A bus also provides a runtime layer to keep a minimal set of FF-A
+ operations available after ExitBootServices().
+
FF-A specification:
https://developer.arm.com/documentation/den0077/a/?lang=en
@@ -41,3 +44,11 @@ config ARM_FFA_TRANSPORT
Secure World (sandbox_ffa.c).
For more details about the FF-A support, please refer to doc/arch/arm64.ffa.rst
+
+config ARM_FFA_RT_MODE
+ bool "Enable FF-A runtime support"
+ depends on ARM_FFA_TRANSPORT && EFI_LOADER
+ default y
+ help
+ Enable the FF-A runtime layer, keeping a minimal set of FF-A
+ operations available after ExitBootServices().
diff --git a/drivers/firmware/arm-ffa/Makefile b/drivers/firmware/arm-ffa/Makefile
index 318123a7f42..9deb59ba640 100644
--- a/drivers/firmware/arm-ffa/Makefile
+++ b/drivers/firmware/arm-ffa/Makefile
@@ -1,12 +1,12 @@
# SPDX-License-Identifier: GPL-2.0+
#
-# Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
+# Copyright 2022-2023, 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
#
# Authors:
# Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
# build the generic FF-A methods
-obj-y += arm-ffa-uclass.o
+obj-y += arm-ffa-uclass.o arm-ffa-runtime.o
ifeq ($(CONFIG_SANDBOX),y)
# build the FF-A sandbox emulator and driver
obj-y += ffa-emul-uclass.o sandbox_ffa.o
diff --git a/drivers/firmware/arm-ffa/arm-ffa-runtime.c b/drivers/firmware/arm-ffa/arm-ffa-runtime.c
new file mode 100644
index 00000000000..84c1a203d40
--- /dev/null
+++ b/drivers/firmware/arm-ffa/arm-ffa-runtime.c
@@ -0,0 +1,294 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Copyright 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ *
+ * Authors:
+ * Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
+ * Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
+ */
+
+#include <arm_ffa_runtime.h>
+#include <arm_ffa_priv.h>
+#include <log.h>
+#include <linux/errno.h>
+#include <linux/types.h>
+
+/* Error mapping declarations */
+
+int __ffa_runtime_data ffa_to_std_errmap[MAX_NUMBER_FFA_ERR] = {
+ [NOT_SUPPORTED] = -EOPNOTSUPP,
+ [INVALID_PARAMETERS] = -EINVAL,
+ [NO_MEMORY] = -ENOMEM,
+ [BUSY] = -EBUSY,
+ [INTERRUPTED] = -EINTR,
+ [DENIED] = -EACCES,
+ [RETRY] = -EAGAIN,
+ [ABORTED] = -ECANCELED,
+};
+
+static __ffa_runtime_data struct ffa_priv_runtime ffa_priv_rt = {0};
+static __ffa_runtime_data bool ffa_runtime_enabled;
+
+/* Arm FF-A driver runtime operations */
+static const __ffa_runtime_data struct ffa_bus_ops_runtime ffa_ops_rt = {
+ .sync_send_receive = ffa_msg_send_direct_req_hdlr_runtime,
+};
+
+#define ffa_get_ops_runtime() (&ffa_ops_rt)
+#define ffa_get_priv_runtime() (&ffa_priv_rt)
+
+#if IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)
+static void EFIAPI ffa_rt_exit_boot_services_notify(struct efi_event *event,
+ void *context)
+{
+ struct ffa_priv *priv = context;
+
+ if (!priv) {
+ log_warning("FF-A: runtime data missing, keeping RT mode disabled\n");
+ return;
+ }
+
+ ffa_copy_runtime_priv(&priv->rt);
+ ffa_runtime_context_enable();
+}
+
+/**
+ * ffa_setup_efi_exit_boot_services_event() - register ExitBootServices event
+ * @priv: pointer to the FF-A private data
+ *
+ * Register an EFI event that enables the FF-A runtime context when
+ * ExitBootServices() is invoked.
+ *
+ * Return: 0 on success, -EPERM on failure to create the event.
+ */
+int ffa_setup_efi_exit_boot_services_event(struct ffa_priv *priv)
+{
+ efi_status_t efi_ret;
+ struct efi_event *evt = NULL;
+
+ efi_ret = efi_create_event(EVT_SIGNAL_EXIT_BOOT_SERVICES, TPL_CALLBACK,
+ ffa_rt_exit_boot_services_notify, priv,
+ &efi_guid_event_group_exit_boot_services,
+ &evt);
+ if (efi_ret != EFI_SUCCESS) {
+ log_err("FF-A: cannot install ExitBootServices event %p, err (%lu)\n",
+ evt, efi_ret);
+ return -EPERM;
+ }
+
+ return 0;
+}
+#endif
+
+/**
+ * ffa_copy_runtime_priv() - copy runtime data into resident storage
+ * @priv: pointer to the runtime private data
+ *
+ * Copy boot-time runtime data into the resident runtime storage to be used
+ * after ExitBootServices().
+ */
+void ffa_copy_runtime_priv(const struct ffa_priv_runtime *priv)
+{
+ struct ffa_priv_runtime *priv_rt = ffa_get_priv_runtime();
+
+ if (priv)
+ *priv_rt = *priv;
+}
+
+/**
+ * ffa_runtime_context_enable() - Enable FF-A runtime context
+ *
+ * This function marks the FF-A runtime environment as ready for use by
+ * EFI runtime services. It is called when ExitBootServices() is invoked,
+ * after the FF-A bus device has successfully probed and U-Boot's FF-A
+ * endpoint ID has been discovered and stored in the runtime private data
+ * structure.
+ *
+ * The FF-A runtime flag allows the EFI runtime layer to verify that the
+ * FF-A transport was initialized during the boot phase and that all
+ * runtime-safe FF-A operations may now be used after ExitBootServices().
+ *
+ */
+void ffa_runtime_context_enable(void)
+{
+ ffa_runtime_enabled = true;
+}
+
+/**
+ * ffa_runtime_context_reset() - Reset FF-A runtime resident state
+ *
+ * Clear the resident runtime flag and private data. This is used by the
+ * FF-A unit tests to avoid leaking runtime state across test cases.
+ */
+void ffa_runtime_context_reset(void)
+{
+ struct ffa_priv_runtime *priv_rt = ffa_get_priv_runtime();
+
+ *priv_rt = (struct ffa_priv_runtime){0};
+ ffa_runtime_enabled = false;
+}
+
+/**
+ * ffa_runtime_context_ready() - Query FF-A runtime readiness
+ *
+ * This helper returns whether the FF-A runtime environment has been
+ * enabled during the boot phase. Runtime FF-A operations must check this
+ * flag before attempting any FF-A access, as the U-Boot driver model
+ * (DM/uclass) is no longer available after ExitBootServices().
+ *
+ * The runtime context becomes enabled when ffa_runtime_context_enable()
+ * is called, typically after the FF-A bus device has probed and the
+ * endpoint ID has been discovered and stored in the runtime private
+ * data structure.
+ *
+ * Return: true if FF-A runtime support is ready, false otherwise.
+ */
+bool __ffa_runtime ffa_runtime_context_ready(void)
+{
+ return ffa_runtime_enabled;
+}
+
+/**
+ * ffa_to_std_errno() - convert FF-A error code to standard error code
+ * @ffa_errno: Error code returned by the FF-A ABI
+ *
+ * Map the given FF-A error code as specified
+ * by the spec to a u-boot standard error code.
+ *
+ * Return: Standard U-Boot errno for known FF-A errors, or -EINVAL otherwise.
+ */
+int __ffa_runtime ffa_to_std_errno(int ffa_errno)
+{
+ int err_idx = -ffa_errno;
+
+ /* Map the FF-A error code to the standard u-boot error code */
+ if (err_idx > 0 && err_idx < MAX_NUMBER_FFA_ERR)
+ return ffa_to_std_errmap[err_idx];
+ return -EINVAL;
+}
+
+/**
+ * ffa_invoke_msg_send_direct_req() - Invokes FFA_MSG_SEND_DIRECT_{REQ,RESP}
+ * @endpoint_id: u-boot endpoint id
+ * @dst_part_id: destination partition ID
+ * @msg: pointer to the message data preallocated by the client (in/out)
+ * @is_smc64: select 64-bit or 32-bit FF-A ABI
+ *
+ * This function invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} FF-A functions.
+ *
+ * FFA_MSG_SEND_DIRECT_REQ is used to send the data to the secure partition.
+ * The response from the secure partition is handled by reading the
+ * FFA_MSG_SEND_DIRECT_RESP arguments.
+ *
+ * The maximum size of the data that can be exchanged is 40 bytes which is
+ * sizeof(struct ffa_send_direct_data) as defined by the FF-A specification 1.0
+ * in the section relevant to FFA_MSG_SEND_DIRECT_{REQ,RESP}
+ *
+ * Return: 0 on success, negative errno on failure.
+ */
+int __ffa_runtime ffa_invoke_msg_send_direct_req(u16 endpoint_id, u16 dst_part_id,
+ struct ffa_send_direct_data *msg, bool is_smc64)
+{
+ int ffa_errno;
+ u64 req_mode;
+ ffa_value_t ffa_args_rt;
+ ffa_value_t ffa_res_rt;
+
+ if (is_smc64)
+ req_mode = FFA_SMC_64(FFA_MSG_SEND_DIRECT_REQ);
+ else
+ req_mode = FFA_SMC_32(FFA_MSG_SEND_DIRECT_REQ);
+ efi_memset_runtime(&ffa_args_rt, 0, sizeof(ffa_args_rt));
+ efi_memset_runtime(&ffa_res_rt, 0, sizeof(ffa_res_rt));
+ ffa_args_rt.a0 = req_mode;
+ ffa_args_rt.a1 = PREP_SELF_ENDPOINT_ID(endpoint_id) |
+ PREP_PART_ENDPOINT_ID(dst_part_id);
+ ffa_args_rt.a2 = 0;
+ ffa_args_rt.a3 = msg->data0;
+ ffa_args_rt.a4 = msg->data1;
+ ffa_args_rt.a5 = msg->data2;
+ ffa_args_rt.a6 = msg->data3;
+ ffa_args_rt.a7 = msg->data4;
+
+ invoke_ffa_fn_runtime(&ffa_args_rt, &ffa_res_rt);
+
+ while (ffa_res_rt.a0 == FFA_SMC_32(FFA_INTERRUPT) ||
+ ffa_res_rt.a0 == FFA_SMC_64(FFA_INTERRUPT)) {
+ efi_memset_runtime(&ffa_args_rt, 0, sizeof(ffa_args_rt));
+ ffa_args_rt.a0 = (ffa_res_rt.a0 == FFA_SMC_64(FFA_INTERRUPT)) ?
+ FFA_SMC_64(FFA_RUN) : FFA_SMC_32(FFA_RUN);
+ ffa_args_rt.a1 = ffa_res_rt.a1;
+
+ invoke_ffa_fn_runtime(&ffa_args_rt, &ffa_res_rt);
+ }
+ if (ffa_res_rt.a0 == FFA_SMC_32(FFA_SUCCESS) ||
+ ffa_res_rt.a0 == FFA_SMC_64(FFA_SUCCESS)) {
+ /* Message sent with no response */
+ return 0;
+ }
+
+ if (ffa_res_rt.a0 == FFA_SMC_32(FFA_MSG_SEND_DIRECT_RESP) ||
+ ffa_res_rt.a0 == FFA_SMC_64(FFA_MSG_SEND_DIRECT_RESP)) {
+ /* Message sent with response extract the return data */
+ msg->data0 = ffa_res_rt.a3;
+ msg->data1 = ffa_res_rt.a4;
+ msg->data2 = ffa_res_rt.a5;
+ msg->data3 = ffa_res_rt.a6;
+ msg->data4 = ffa_res_rt.a7;
+ return 0;
+ }
+
+ ffa_errno = ffa_res_rt.a2;
+ return ffa_to_std_errno(ffa_errno);
+}
+
+/**
+ * ffa_msg_send_direct_req_hdlr_runtime() - Runtime implementation of
+ * FFA_MSG_SEND_DIRECT_{REQ,RESP} handler function
+ * @dst_part_id: destination partition ID
+ * @msg: pointer to the message data preallocated by the client (in/out)
+ * @is_smc64: select 64-bit or 32-bit FF-A ABI
+ *
+ * This function calls the ffa_invoke_msg_send_direct_req() function which
+ * invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} FF-A functions.
+ *
+ * Return:
+ *
+ * 0 on success. Otherwise, failure
+ */
+int __ffa_runtime ffa_msg_send_direct_req_hdlr_runtime(u16 dst_part_id,
+ struct ffa_send_direct_data *msg,
+ bool is_smc64)
+{
+ struct ffa_priv_runtime *priv_rt = ffa_get_priv_runtime();
+
+ return ffa_invoke_msg_send_direct_req(priv_rt->id, dst_part_id, msg, is_smc64);
+}
+
+/**
+ * ffa_sync_send_receive_runtime() - Runtime implementation of
+ * ffa_sync_send_receive()
+ * @dst_part_id: destination partition ID
+ * @msg: pointer to the message data preallocated by the client (in/out)
+ * @is_smc64: select 64-bit or 32-bit FF-A ABI
+ *
+ * Please see ffa_msg_send_direct_req_hdlr_runtime() description for more details.
+ *
+ * Return:
+ *
+ * 0 on success. Otherwise, failure
+ */
+int __ffa_runtime ffa_sync_send_receive_runtime(u16 dst_part_id,
+ struct ffa_send_direct_data *msg,
+ bool is_smc64)
+{
+ const struct ffa_bus_ops_runtime *ops_rt = ffa_get_ops_runtime();
+
+ if (!ffa_runtime_context_ready())
+ return -EPERM;
+
+ if (!ops_rt->sync_send_receive)
+ return -ENOSYS;
+
+ return ops_rt->sync_send_receive(dst_part_id, msg, is_smc64);
+}
diff --git a/drivers/firmware/arm-ffa/arm-ffa-uclass.c b/drivers/firmware/arm-ffa/arm-ffa-uclass.c
index 76a8775e911..d21cc4cc35c 100644
--- a/drivers/firmware/arm-ffa/arm-ffa-uclass.c
+++ b/drivers/firmware/arm-ffa/arm-ffa-uclass.c
@@ -1,12 +1,13 @@
// SPDX-License-Identifier: GPL-2.0+
/*
- * Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ * Copyright 2022-2023, 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
*
* Authors:
* Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
*/
#include <arm_ffa.h>
#include <arm_ffa_priv.h>
+#include <arm_ffa_runtime.h>
#include <dm.h>
#include <log.h>
#include <malloc.h>
@@ -18,19 +19,6 @@
#include <linux/errno.h>
#include <linux/sizes.h>
-/* Error mapping declarations */
-
-int ffa_to_std_errmap[MAX_NUMBER_FFA_ERR] = {
- [NOT_SUPPORTED] = -EOPNOTSUPP,
- [INVALID_PARAMETERS] = -EINVAL,
- [NO_MEMORY] = -ENOMEM,
- [BUSY] = -EBUSY,
- [INTERRUPTED] = -EINTR,
- [DENIED] = -EACCES,
- [RETRY] = -EAGAIN,
- [ABORTED] = -ECANCELED,
-};
-
static struct ffa_abi_errmap err_msg_map[FFA_ERRMAP_COUNT] = {
[FFA_ID_TO_ERRMAP_ID(FFA_VERSION)] = {
{
@@ -94,27 +82,6 @@ static struct ffa_abi_errmap err_msg_map[FFA_ERRMAP_COUNT] = {
},
};
-/**
- * ffa_to_std_errno() - convert FF-A error code to standard error code
- * @ffa_errno: Error code returned by the FF-A ABI
- *
- * Map the given FF-A error code as specified
- * by the spec to a u-boot standard error code.
- *
- * Return:
- *
- * The standard error code on success. . Otherwise, failure
- */
-static int ffa_to_std_errno(int ffa_errno)
-{
- int err_idx = -ffa_errno;
-
- /* Map the FF-A error code to the standard u-boot error code */
- if (err_idx > 0 && err_idx < MAX_NUMBER_FFA_ERR)
- return ffa_to_std_errmap[err_idx];
- return -EINVAL;
-}
-
/**
* ffa_print_error_log() - print the error log corresponding to the selected FF-A ABI
* @ffa_id: FF-A ABI ID
@@ -204,7 +171,7 @@ int ffa_get_version_hdlr(struct udevice *dev)
if (dev) {
uc_priv = dev_get_uclass_priv(dev);
if (uc_priv)
- uc_priv->fwk_version = res.a0;
+ uc_priv->rt.fwk_version = res.a0;
}
return 0;
@@ -238,8 +205,8 @@ static int ffa_get_endpoint_id(struct udevice *dev)
}, &res);
if (res.a0 == FFA_SMC_32(FFA_SUCCESS)) {
- uc_priv->id = GET_SELF_ENDPOINT_ID((u32)res.a2);
- log_debug("FF-A endpoint ID is %u\n", uc_priv->id);
+ uc_priv->rt.id = GET_SELF_ENDPOINT_ID((u32)res.a2);
+ log_debug("FF-A endpoint ID is %u\n", uc_priv->rt.id);
return 0;
}
@@ -461,7 +428,7 @@ int ffa_unmap_rxtx_buffers_hdlr(struct udevice *dev)
invoke_ffa_fn((ffa_value_t){
.a0 = FFA_SMC_32(FFA_RXTX_UNMAP),
- .a1 = PREP_SELF_ENDPOINT_ID(uc_priv->id),
+ .a1 = PREP_SELF_ENDPOINT_ID(uc_priv->rt.id),
}, &res);
if (res.a0 == FFA_SMC_32(FFA_SUCCESS)) {
@@ -851,16 +818,8 @@ static int ffa_cache_partitions_info(struct udevice *dev)
* @msg: pointer to the message data preallocated by the client (in/out)
* @is_smc64: select 64-bit or 32-bit FF-A ABI
*
- * Implement FFA_MSG_SEND_DIRECT_{REQ,RESP}
- * FF-A functions.
- *
- * FFA_MSG_SEND_DIRECT_REQ is used to send the data to the secure partition.
- * The response from the secure partition is handled by reading the
- * FFA_MSG_SEND_DIRECT_RESP arguments.
- *
- * The maximum size of the data that can be exchanged is 40 bytes which is
- * sizeof(struct ffa_send_direct_data) as defined by the FF-A specification 1.0
- * in the section relevant to FFA_MSG_SEND_DIRECT_{REQ,RESP}
+ * This function calls the ffa_invoke_msg_send_direct_req() function which
+ * invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} FF-A functions.
*
* Return:
*
@@ -869,9 +828,6 @@ static int ffa_cache_partitions_info(struct udevice *dev)
int ffa_msg_send_direct_req_hdlr(struct udevice *dev, u16 dst_part_id,
struct ffa_send_direct_data *msg, bool is_smc64)
{
- ffa_value_t res = {0};
- int ffa_errno;
- u64 req_mode, resp_mode;
struct ffa_priv *uc_priv;
uc_priv = dev_get_uclass_priv(dev);
@@ -880,50 +836,7 @@ int ffa_msg_send_direct_req_hdlr(struct udevice *dev, u16 dst_part_id,
if (!uc_priv->partitions.count || !uc_priv->partitions.descs)
return -ENODEV;
- if (is_smc64) {
- req_mode = FFA_SMC_64(FFA_MSG_SEND_DIRECT_REQ);
- resp_mode = FFA_SMC_64(FFA_MSG_SEND_DIRECT_RESP);
- } else {
- req_mode = FFA_SMC_32(FFA_MSG_SEND_DIRECT_REQ);
- resp_mode = FFA_SMC_32(FFA_MSG_SEND_DIRECT_RESP);
- }
-
- invoke_ffa_fn((ffa_value_t){
- .a0 = req_mode,
- .a1 = PREP_SELF_ENDPOINT_ID(uc_priv->id) |
- PREP_PART_ENDPOINT_ID(dst_part_id),
- .a2 = 0,
- .a3 = msg->data0,
- .a4 = msg->data1,
- .a5 = msg->data2,
- .a6 = msg->data3,
- .a7 = msg->data4,
- }, &res);
-
- while (res.a0 == FFA_SMC_32(FFA_INTERRUPT))
- invoke_ffa_fn((ffa_value_t){
- .a0 = FFA_SMC_32(FFA_RUN),
- .a1 = res.a1,
- }, &res);
-
- if (res.a0 == FFA_SMC_32(FFA_SUCCESS)) {
- /* Message sent with no response */
- return 0;
- }
-
- if (res.a0 == resp_mode) {
- /* Message sent with response extract the return data */
- msg->data0 = res.a3;
- msg->data1 = res.a4;
- msg->data2 = res.a5;
- msg->data3 = res.a6;
- msg->data4 = res.a7;
-
- return 0;
- }
-
- ffa_errno = res.a2;
- return ffa_to_std_errno(ffa_errno);
+ return ffa_invoke_msg_send_direct_req(uc_priv->rt.id, dst_part_id, msg, is_smc64);
}
/* FF-A driver operations (used by clients for communicating with FF-A)*/
@@ -1024,6 +937,7 @@ int ffa_rxtx_unmap(struct udevice *dev)
static int ffa_do_probe(struct udevice *dev)
{
int ret;
+ struct ffa_priv *uc_priv = dev_get_uclass_priv(dev);
ret = ffa_get_version_hdlr(dev);
if (ret)
@@ -1047,6 +961,14 @@ static int ffa_do_probe(struct udevice *dev)
return ret;
}
+ if (IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)) {
+ ret = ffa_setup_efi_exit_boot_services_event(uc_priv);
+ if (ret) {
+ ffa_unmap_rxtx_buffers_hdlr(dev);
+ return ret;
+ }
+ }
+
return 0;
}
diff --git a/drivers/firmware/arm-ffa/arm-ffa.c b/drivers/firmware/arm-ffa/arm-ffa.c
index 9e6b5dcc542..241ef018817 100644
--- a/drivers/firmware/arm-ffa/arm-ffa.c
+++ b/drivers/firmware/arm-ffa/arm-ffa.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0+
/*
- * Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ * Copyright 2022-2023, 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
*
* Authors:
* Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
@@ -8,6 +8,7 @@
#include <arm_ffa.h>
#include <arm_ffa_priv.h>
+#include <arm_ffa_runtime.h>
#include <dm.h>
#include <log.h>
#include <dm/device-internal.h>
@@ -25,6 +26,19 @@ void invoke_ffa_fn(ffa_value_t args, ffa_value_t *res)
arm_smccc_1_2_smc(&args, res);
}
+/**
+ * invoke_ffa_fn_runtime() - Runtime-safe SMC wrapper
+ * @args: FF-A ABI arguments to be copied to Xn registers
+ * @res: FF-A ABI return values copied from Xn registers
+ *
+ * Calls the SMCCC SMC 1.2 helper from EFI runtime context. This wrapper
+ * is marked __ffa_runtime so it remains available after ExitBootServices().
+ */
+void __ffa_runtime invoke_ffa_fn_runtime(ffa_value_t *args, ffa_value_t *res)
+{
+ arm_smccc_1_2_smc(args, res);
+}
+
/**
* arm_ffa_discover() - perform FF-A discovery
* @dev: The Arm FF-A bus device (arm_ffa)
diff --git a/drivers/firmware/arm-ffa/ffa-emul-uclass.c b/drivers/firmware/arm-ffa/ffa-emul-uclass.c
index 6198d687354..d270f7b614e 100644
--- a/drivers/firmware/arm-ffa/ffa-emul-uclass.c
+++ b/drivers/firmware/arm-ffa/ffa-emul-uclass.c
@@ -671,6 +671,18 @@ void invoke_ffa_fn(ffa_value_t args, ffa_value_t *res)
sandbox_arm_ffa_smccc_smc(&args, res);
}
+/**
+ * invoke_ffa_fn_runtime() - Runtime-safe SMC wrapper
+ * @args: FF-A ABI arguments to be copied to Xn registers
+ * @res: FF-A ABI return data to be copied from Xn registers
+ *
+ * Calls the emulated SMC call.
+ */
+void invoke_ffa_fn_runtime(ffa_value_t *args, ffa_value_t *res)
+{
+ sandbox_arm_ffa_smccc_smc(args, res);
+}
+
/**
* ffa_emul_find() - Find the FF-A emulator
* @dev: the sandbox FF-A device (sandbox-arm-ffa)
diff --git a/include/arm_ffa.h b/include/arm_ffa.h
index 2994d8ee3ae..6a03aad81a8 100644
--- a/include/arm_ffa.h
+++ b/include/arm_ffa.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0+ */
/*
- * Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ * Copyright 2022-2023, 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
*
* Authors:
* Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
@@ -129,21 +129,13 @@ int ffa_sync_send_receive(struct udevice *dev, u16 dst_part_id,
/**
* ffa_msg_send_direct_req_hdlr() - FFA_MSG_SEND_DIRECT_{REQ,RESP} handler function
- * @dev: The arm_ffa bus device
+ * @dev: The FF-A bus device
* @dst_part_id: destination partition ID
* @msg: pointer to the message data preallocated by the client (in/out)
* @is_smc64: select 64-bit or 32-bit FF-A ABI
*
- * This function implements FFA_MSG_SEND_DIRECT_{REQ,RESP}
- * FF-A functions.
- *
- * FFA_MSG_SEND_DIRECT_REQ is used to send the data to the secure partition.
- * The response from the secure partition is handled by reading the
- * FFA_MSG_SEND_DIRECT_RESP arguments.
- *
- * The maximum size of the data that can be exchanged is 40 bytes which is
- * sizeof(struct ffa_send_direct_data) as defined by the FF-A specification 1.0
- * in the section relevant to FFA_MSG_SEND_DIRECT_{REQ,RESP}
+ * This function calls the ffa_invoke_msg_send_direct_req() function which
+ * invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} FF-A functions.
*
* Return:
*
diff --git a/include/arm_ffa_priv.h b/include/arm_ffa_priv.h
index d564c33c647..3c74c63dfa6 100644
--- a/include/arm_ffa_priv.h
+++ b/include/arm_ffa_priv.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0+ */
/*
- * Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ * Copyright 2022-2023, 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
*
* Authors:
* Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
@@ -200,11 +200,24 @@ struct ffa_partitions {
};
/**
- * struct ffa_priv - the driver private data structure
+ * struct ffa_priv_runtime - the driver's private runtime data structure
*
* @fwk_version: FF-A framework version
- * @emul: FF-A sandbox emulator
* @id: u-boot endpoint ID
+ *
+ * The device private runtime data structure containing all the
+ * data read from secure world.
+ */
+struct ffa_priv_runtime {
+ u32 fwk_version;
+ u16 id;
+};
+
+/**
+ * struct ffa_priv - the driver private data structure
+ *
+ * @rt: Runtime data captured at boot time
+ * @emul: FF-A sandbox emulator
* @partitions: The partitions descriptors structure
* @pair: The RX/TX buffers pair
*
@@ -212,9 +225,8 @@ struct ffa_partitions {
* data read from secure world.
*/
struct ffa_priv {
- u32 fwk_version;
+ struct ffa_priv_runtime rt;
struct udevice *emul;
- u16 id;
struct ffa_partitions partitions;
struct ffa_rxtxpair pair;
};
diff --git a/include/arm_ffa_runtime.h b/include/arm_ffa_runtime.h
new file mode 100644
index 00000000000..bfc4d387660
--- /dev/null
+++ b/include/arm_ffa_runtime.h
@@ -0,0 +1,191 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ *
+ * Authors:
+ * Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
+ * Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
+ */
+
+#ifndef __ARM_FFA_RUNTIME_H
+#define __ARM_FFA_RUNTIME_H
+
+#include <linux/types.h>
+#include <arm_ffa.h>
+#include <arm_ffa_priv.h>
+#include <efi_loader.h>
+
+/**
+ * __ffa_runtime - controls whether functions are
+ * available after calling the EFI ExitBootServices service.
+ * Functions tagged with these keywords are resident (available at boot time and
+ * at runtime)
+ */
+#if IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)
+#define __ffa_runtime_data __efi_runtime_data
+#define __ffa_runtime __efi_runtime
+#else
+#define __ffa_runtime_data
+#define __ffa_runtime
+#endif
+
+/**
+ * invoke_ffa_fn_runtime() - Runtime-safe SMC wrapper
+ * @args: FF-A ABI arguments to be copied to Xn registers
+ * @res: FF-A ABI return values copied from Xn registers
+ *
+ * Calls low level SMC implementation. This wrapper
+ * is marked __ffa_runtime so it remains available after ExitBootServices().
+ */
+void __ffa_runtime invoke_ffa_fn_runtime(ffa_value_t *args, ffa_value_t *res);
+
+/**
+ * struct ffa_bus_ops_runtime - Operations for FF-A runtime
+ * @sync_send_receive: callback for the FFA_MSG_SEND_DIRECT_REQ
+ *
+ * The data structure providing all the runtime operations supported by the driver.
+ * This structure is an EFI runtime resident.
+ */
+struct ffa_bus_ops_runtime {
+ int (*sync_send_receive)(u16 dst_part_id, struct ffa_send_direct_data *msg,
+ bool is_smc64);
+};
+
+/**
+ * ffa_runtime_context_enable() - Enable FF-A runtime context
+ *
+ * This function marks the FF-A runtime environment as ready for use by
+ * EFI runtime services. It is called when ExitBootServices() is invoked,
+ * after the FF-A bus device has successfully probed and U-Boot's FF-A
+ * endpoint ID has been discovered and stored in the runtime private data
+ * structure.
+ *
+ * The FF-A runtime flag allows the EFI runtime layer to verify that the
+ * FF-A transport was initialized during the boot phase and that all
+ * runtime-safe FF-A operations may now be used after ExitBootServices().
+ *
+ */
+void ffa_runtime_context_enable(void);
+
+/**
+ * ffa_runtime_context_reset() - Reset FF-A runtime resident state
+ *
+ * Clear the resident runtime flag and private data. This is used by the
+ * FF-A unit tests to avoid leaking runtime state across test cases.
+ */
+void ffa_runtime_context_reset(void);
+
+/**
+ * ffa_copy_runtime_priv() - copy runtime data into resident storage
+ * @priv: pointer to the runtime private data
+ *
+ * Copy boot-time runtime data into the resident runtime storage to be used
+ * after ExitBootServices().
+ */
+void ffa_copy_runtime_priv(const struct ffa_priv_runtime *priv);
+
+/**
+ * ffa_setup_efi_exit_boot_services_event() - register ExitBootServices event
+ * @priv: pointer to the FF-A private data
+ *
+ * Register an EFI event that enables the FF-A runtime context when
+ * ExitBootServices() is invoked.
+ *
+ * Return: 0 on success, -EPERM on failure to create the event.
+ */
+#if IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)
+int ffa_setup_efi_exit_boot_services_event(struct ffa_priv *priv);
+#else
+static inline int ffa_setup_efi_exit_boot_services_event(struct ffa_priv *priv)
+{
+ return 0;
+}
+#endif
+
+/**
+ * ffa_runtime_context_ready() - Query FF-A runtime readiness
+ *
+ * This helper returns whether the FF-A runtime environment has been
+ * enabled during the boot phase. Runtime FF-A operations must check this
+ * flag before attempting any FF-A access, as the U-Boot driver model
+ * (DM/uclass) is no longer available after ExitBootServices().
+ *
+ * The runtime context becomes enabled when ffa_runtime_context_enable()
+ * is called, typically after the FF-A bus device has probed and the
+ * endpoint ID has been discovered and stored in the runtime private
+ * data structure.
+ *
+ * Return: true if FF-A runtime support is ready, false otherwise.
+ */
+bool __ffa_runtime ffa_runtime_context_ready(void);
+
+/**
+ * ffa_to_std_errno() - convert FF-A error code to standard error code
+ * @ffa_errno: Error code returned by the FF-A ABI
+ *
+ * Map the given FF-A error code as specified
+ * by the spec to a u-boot standard error code.
+ *
+ * Return: Standard U-Boot errno for known FF-A errors, or -EINVAL otherwise.
+ */
+int __ffa_runtime ffa_to_std_errno(int ffa_errno);
+
+/**
+ * ffa_sync_send_receive_runtime() - Runtime implementation of
+ * ffa_sync_send_receive()
+ * @dst_part_id: destination partition ID
+ * @msg: pointer to the message data preallocated by the client (in/out)
+ * @is_smc64: select 64-bit or 32-bit FF-A ABI
+ *
+ * Please see ffa_msg_send_direct_req_hdlr_runtime() description for more details.
+ *
+ * Return: 0 on success, negative errno on failure.
+ */
+int __ffa_runtime ffa_sync_send_receive_runtime(u16 dst_part_id,
+ struct ffa_send_direct_data *msg,
+ bool is_smc64);
+
+/**
+ * ffa_invoke_msg_send_direct_req() - Invokes FFA_MSG_SEND_DIRECT_{REQ,RESP}
+ * @endpoint_id: u-boot endpoint id
+ * @dst_part_id: destination partition ID
+ * @msg: pointer to the message data preallocated by the client (in/out)
+ * @is_smc64: select 64-bit or 32-bit FF-A ABI
+ *
+ * This function invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} FF-A functions.
+ *
+ * FFA_MSG_SEND_DIRECT_REQ is used to send the data to the secure partition.
+ * The response from the secure partition is handled by reading the
+ * FFA_MSG_SEND_DIRECT_RESP arguments.
+ *
+ * The maximum size of the data that can be exchanged is 40 bytes which is
+ * sizeof(struct ffa_send_direct_data) as defined by the FF-A specification 1.0
+ * in the section relevant to FFA_MSG_SEND_DIRECT_{REQ,RESP}
+ *
+ * Return:
+ *
+ * 0 on success. Otherwise, error on failure
+ */
+int __ffa_runtime ffa_invoke_msg_send_direct_req(u16 endpoint_id, u16 dst_part_id,
+ struct ffa_send_direct_data *msg,
+ bool is_smc64);
+
+/**
+ * ffa_msg_send_direct_req_hdlr_runtime() - Runtime implementation of
+ * FFA_MSG_SEND_DIRECT_{REQ,RESP} handler function
+ * @dst_part_id: destination partition ID
+ * @msg: pointer to the message data preallocated by the client (in/out)
+ * @is_smc64: select 64-bit or 32-bit FF-A ABI
+ *
+ * This function calls the ffa_invoke_msg_send_direct_req() function which
+ * invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} FF-A functions.
+ *
+ * Return:
+ *
+ * 0 on success. Otherwise, failure
+ */
+int __ffa_runtime ffa_msg_send_direct_req_hdlr_runtime(u16 dst_part_id,
+ struct ffa_send_direct_data *msg,
+ bool is_smc64);
+
+#endif
diff --git a/test/dm/ffa.c b/test/dm/ffa.c
index 593b7177fce..a0c95e62607 100644
--- a/test/dm/ffa.c
+++ b/test/dm/ffa.c
@@ -2,7 +2,7 @@
/*
* Functional tests for UCLASS_FFA class
*
- * Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ * Copyright 2022-2023, 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
*
* Authors:
* Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
@@ -26,14 +26,14 @@ static int check_fwk_version(struct ffa_priv *uc_priv, struct unit_test_state *u
func_data.data0 = &fwk_version;
func_data.data0_size = sizeof(fwk_version);
ut_assertok(sandbox_query_ffa_emul_state(FFA_VERSION, &func_data));
- ut_asserteq(uc_priv->fwk_version, fwk_version);
+ ut_asserteq(uc_priv->rt.fwk_version, fwk_version);
return 0;
}
static int check_endpoint_id(struct ffa_priv *uc_priv, struct unit_test_state *uts)
{
- ut_asserteq(0, uc_priv->id);
+ ut_asserteq(0, uc_priv->rt.id);
return 0;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v3 03/10] efi_loader: add FF-A runtime support in EFI variable TEE driver
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
2026-06-27 14:44 ` [PATCH v3 01/10] efi_loader: add runtime memset helper Harsimran Singh Tungal
2026-06-27 14:44 ` [PATCH v3 02/10] arm-ffa: add FF-A bus runtime support Harsimran Singh Tungal
@ 2026-06-27 14:44 ` Harsimran Singh Tungal
2026-06-29 18:40 ` Abdellatif El Khlifi
2026-07-01 13:56 ` Ilias Apalodimas
2026-06-27 14:44 ` [PATCH v3 04/10] efi_loader: enable EFI runtime SetVariable()/GetVariable() using FF-A transport Harsimran Singh Tungal
` (6 subsequent siblings)
9 siblings, 2 replies; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
Enable MM variable services over FF-A after ExitBootServices
Extend lib/efi_loader/efi_variable_tee.c to support FF-A
communication with the secure world during EFI runtime. Reuse the
statically reserved FF-A shared buffer after ExitBootServices(),
make the MM communication path runtime-safe so runtime variable
operations continue to reach the secure partition.
Share the MM communication and MM SP notification helpers between the
boot and runtime paths instead of maintaining separate runtime-only
variants. Select dynamic allocation during boot and the fixed FF-A
shared buffer at runtime, and reject requests that would exceed the
shared buffer size.
Mark the required code and data with __efi_runtime and
__efi_runtime_data, use range-based cache maintenance on the shared
buffer for the runtime FF-A path, and add the shared buffer to the EFI
runtime memory map. Document the FF-A shared MM buffer
cacheline-alignment requirement in Kconfig and add BUILD_BUG_ON()
checks in ffa_mm_communicate() for the FF-A shared buffer alignment
used by the arm64 cache-maintenance path.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
arch/arm/cpu/armv8/cache.S | 8 +
arch/arm/cpu/armv8/cache_v8.c | 13 +-
lib/efi_loader/Kconfig | 4 +
lib/efi_loader/efi_variable_tee.c | 382 ++++++++++++++++++++++--------
4 files changed, 306 insertions(+), 101 deletions(-)
diff --git a/arch/arm/cpu/armv8/cache.S b/arch/arm/cpu/armv8/cache.S
index c9e46859b4f..916558fe477 100644
--- a/arch/arm/cpu/armv8/cache.S
+++ b/arch/arm/cpu/armv8/cache.S
@@ -169,7 +169,11 @@ ENDPROC(__asm_flush_l3_dcache)
* x0: start address
* x1: end address
*/
+#ifdef CONFIG_EFI_LOADER
+.pushsection .text.efi_runtime.__asm_flush_dcache_range, "ax"
+#else
.pushsection .text.__asm_flush_dcache_range, "ax"
+#endif
ENTRY(__asm_flush_dcache_range)
mrs x3, ctr_el0
ubfx x3, x3, #16, #4
@@ -195,7 +199,11 @@ ENDPROC(__asm_flush_dcache_range)
* x0: start address
* x1: end address
*/
+#ifdef CONFIG_EFI_LOADER
+.pushsection .text.efi_runtime.__asm_invalidate_dcache_range, "ax"
+#else
.pushsection .text.__asm_invalidate_dcache_range, "ax"
+#endif
ENTRY(__asm_invalidate_dcache_range)
mrs x3, ctr_el0
ubfx x3, x3, #16, #4
diff --git a/arch/arm/cpu/armv8/cache_v8.c b/arch/arm/cpu/armv8/cache_v8.c
index 7c0e3f6d055..d150da4778e 100644
--- a/arch/arm/cpu/armv8/cache_v8.c
+++ b/arch/arm/cpu/armv8/cache_v8.c
@@ -8,6 +8,7 @@
*/
#include <cpu_func.h>
+#include <efi_loader.h>
#include <hang.h>
#include <log.h>
#include <asm/cache.h>
@@ -855,7 +856,8 @@ inline void flush_dcache_all(void)
/*
* Invalidates range in all levels of D-cache/unified cache
*/
-void invalidate_dcache_range(unsigned long start, unsigned long stop)
+void __efi_runtime invalidate_dcache_range(unsigned long start,
+ unsigned long stop)
{
__asm_invalidate_dcache_range(start, stop);
}
@@ -863,16 +865,19 @@ void invalidate_dcache_range(unsigned long start, unsigned long stop)
/*
* Flush range(clean & invalidate) from all levels of D-cache/unified cache
*/
-void flush_dcache_range(unsigned long start, unsigned long stop)
+void __efi_runtime flush_dcache_range(unsigned long start,
+ unsigned long stop)
{
__asm_flush_dcache_range(start, stop);
}
#else
-void invalidate_dcache_range(unsigned long start, unsigned long stop)
+void __efi_runtime invalidate_dcache_range(unsigned long start,
+ unsigned long stop)
{
}
-void flush_dcache_range(unsigned long start, unsigned long stop)
+void __efi_runtime flush_dcache_range(unsigned long start,
+ unsigned long stop)
{
}
#endif /* CONFIG_SYS_DISABLE_DCACHE_OPS */
diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index 4cb13ae7c8a..a9791b8f2e3 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -195,6 +195,8 @@ config FFA_SHARED_MM_BUF_SIZE
the MM SP in secure world.
The size of the memory region must be a multiple of the size of the maximum
translation granule size that is specified in the ID_AA64MMFR0_EL1 System register.
+ For arm64 FF-A cache maintenance, this size must also be aligned to
+ CONFIG_SYS_CACHELINE_SIZE.
It is assumed that the MM SP knows the size of the shared MM communication buffer.
config FFA_SHARED_MM_BUF_OFFSET
@@ -211,6 +213,8 @@ config FFA_SHARED_MM_BUF_ADDR
This defines the address of the shared MM communication buffer
used for communication between the MM feature in U-Boot and
the MM SP in secure world.
+ For arm64 FF-A cache maintenance, this address must also be aligned to
+ CONFIG_SYS_CACHELINE_SIZE.
It is assumed that the MM SP knows the address of the shared MM communication buffer.
config EFI_VARIABLE_SF_OFFSET
diff --git a/lib/efi_loader/efi_variable_tee.c b/lib/efi_loader/efi_variable_tee.c
index 6a1fa39bb6f..fe205bdf966 100644
--- a/lib/efi_loader/efi_variable_tee.c
+++ b/lib/efi_loader/efi_variable_tee.c
@@ -4,7 +4,7 @@
*
* Copyright (C) 2019 Linaro Ltd. <sughosh.ganu@linaro.org>
* Copyright (C) 2019 Linaro Ltd. <ilias.apalodimas@linaro.org>
- * Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ * Copyright 2022-2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
*
* Authors:
* Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
@@ -14,6 +14,7 @@
#if CONFIG_IS_ENABLED(ARM_FFA_TRANSPORT)
#include <arm_ffa.h>
+#include <arm_ffa_runtime.h>
#endif
#include <cpu_func.h>
#include <dm.h>
@@ -21,6 +22,8 @@
#include <efi_api.h>
#include <efi_loader.h>
#include <efi_variable.h>
+#include <linux/build_bug.h>
+#include <linux/kernel.h>
#include <malloc.h>
#include <mapmem.h>
#include <mm_communication.h>
@@ -34,20 +37,49 @@
#define MM_DENIED (-3)
#define MM_NO_MEMORY (-5)
+/*
+ * MM_* return codes are negative. Use -MM_* as sparse positive indices so
+ * ffa_map_sp_event() can look up mm_sp_errmap[-sp_event_ret]. Unassigned
+ * slots remain 0 and are treated as unmapped MM return codes.
+ */
+static const int __efi_runtime_rodata mm_sp_errmap[] = {
+ [-MM_NOT_SUPPORTED] = -EINVAL,
+ [-MM_INVALID_PARAMETER] = -EPERM,
+ [-MM_DENIED] = -EACCES,
+ [-MM_NO_MEMORY] = -EBUSY,
+};
+
static const char *mm_sp_svc_uuid = MM_SP_UUID;
-static u16 mm_sp_id;
+static u16 __efi_runtime_data mm_sp_id;
#endif
+static void *__efi_runtime_data ffa_shared_buf;
extern struct efi_var_file __efi_runtime_data *efi_var_buf;
-static efi_uintn_t max_buffer_size; /* comm + var + func + data */
-static efi_uintn_t max_payload_size; /* func + data */
+static efi_uintn_t __efi_runtime_data max_buffer_size; /* comm + var + func + data */
+static efi_uintn_t __efi_runtime_data max_payload_size; /* func + data */
static const u16 __efi_runtime_rodata pk[] = u"PK";
+static bool __efi_runtime_data ebs_called;
struct mm_connection {
struct udevice *tee;
u32 session;
};
+/**
+ * efi_at_runtime() - Indicate whether the system is in the UEFI runtime phase
+ *
+ * This helper returns whether the firmware has transitioned into the
+ * UEFI runtime phase, meaning that ExitBootServices() has been invoked.
+ *
+ * Return:
+ * true - The system is operating in UEFI runtime mode.
+ * false - The system is still in the boot services phase.
+ */
+static bool __efi_runtime efi_at_runtime(void)
+{
+ return ebs_called;
+}
+
/**
* get_connection() - Retrieve OP-TEE session for a specific UUID.
*
@@ -169,6 +201,28 @@ static efi_status_t optee_mm_communicate(void *comm_buf, ulong dsize)
}
#if CONFIG_IS_ENABLED(ARM_FFA_TRANSPORT)
+/**
+ * ffa_map_sp_event() - Map MM SP response to errno
+ * @sp_event_ret: MM SP return code from MM SP notification
+ *
+ * Convert the MM SP return code into a standard U-Boot errno. This helper
+ * is marked __efi_runtime so it can be shared by both the boot and runtime
+ * FF-A notification paths.
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int __efi_runtime ffa_map_sp_event(int sp_event_ret)
+{
+ int idx = -sp_event_ret;
+
+ if (sp_event_ret == MM_SUCCESS)
+ return 0;
+ if (idx > 0 && idx < (int)ARRAY_SIZE(mm_sp_errmap) &&
+ mm_sp_errmap[idx])
+ return mm_sp_errmap[idx];
+ return -EACCES;
+}
+
/**
* ffa_notify_mm_sp() - Announce there is data in the shared buffer
*
@@ -177,52 +231,34 @@ static efi_status_t optee_mm_communicate(void *comm_buf, ulong dsize)
* This is a blocking call during which trusted world has exclusive access
* to the MM shared buffer.
*
- * Return:
- *
- * 0 on success
+ * Return: 0 on success
*/
-static int ffa_notify_mm_sp(void)
+static int __efi_runtime ffa_notify_mm_sp(void)
{
struct ffa_send_direct_data msg = {0};
int ret;
int sp_event_ret;
- struct udevice *dev;
+ bool at_runtime = efi_at_runtime();
- ret = uclass_first_device_err(UCLASS_FFA, &dev);
- if (ret) {
- log_err("EFI: Cannot find FF-A bus device, notify MM SP failure\n");
- return ret;
- }
+ msg.data0 = CONFIG_FFA_SHARED_MM_BUF_OFFSET;
+
+ if (at_runtime) {
+ ret = ffa_sync_send_receive_runtime(mm_sp_id, &msg, 1);
+ } else {
+ struct udevice *dev;
- msg.data0 = CONFIG_FFA_SHARED_MM_BUF_OFFSET; /* x3 */
+ ret = uclass_first_device_err(UCLASS_FFA, &dev);
+ if (ret)
+ return ret;
- ret = ffa_sync_send_receive(dev, mm_sp_id, &msg, 1);
+ ret = ffa_sync_send_receive(dev, mm_sp_id, &msg, 1);
+ }
if (ret)
return ret;
- sp_event_ret = msg.data0; /* x3 */
-
- switch (sp_event_ret) {
- case MM_SUCCESS:
- ret = 0;
- break;
- case MM_NOT_SUPPORTED:
- ret = -EINVAL;
- break;
- case MM_INVALID_PARAMETER:
- ret = -EPERM;
- break;
- case MM_DENIED:
- ret = -EACCES;
- break;
- case MM_NO_MEMORY:
- ret = -EBUSY;
- break;
- default:
- ret = -EACCES;
- }
+ sp_event_ret = msg.data0;
- return ret;
+ return ffa_map_sp_event(sp_event_ret);
}
/**
@@ -266,77 +302,128 @@ static int ffa_discover_mm_sp_id(void)
}
/**
- * ffa_mm_communicate() - Exchange EFI services data with the MM partition using FF-A
+ * ffa_mm_communicate() - Exchange EFI services data with the MM partition using FF-A
* @comm_buf: locally allocated communication buffer used for rx/tx
- * @dsize: communication buffer size
+ * @comm_buf_size: communication buffer size
*
* Issue a door bell event to notify the MM partition (SP) running in OP-TEE
* that there is data to read from the shared buffer.
* Communication with the MM SP is performed using FF-A transport.
* On the event, MM SP can read the data from the buffer and
* update the MM shared buffer with response data.
- * The response data is copied back to the communication buffer.
- *
- * Return:
+ * The response data is copied back to the communication buffer during the
+ * boot phase. At runtime, the communication buffer is already the FF-A
+ * shared buffer and is updated in place.
*
- * EFI status code
+ * Return: EFI status code
*/
-static efi_status_t ffa_mm_communicate(void *comm_buf, ulong comm_buf_size)
+static efi_status_t __efi_runtime ffa_mm_communicate(void *comm_buf,
+ ulong comm_buf_size)
{
+ ulong hdr_cache_size;
ulong tx_data_size;
+ ulong tx_cache_size;
int ffa_ret;
efi_status_t efi_ret;
struct efi_mm_communicate_header *mm_hdr;
- void *virt_shared_buf;
+ u8 *shared_buf;
+ bool at_runtime = efi_at_runtime();
if (!comm_buf)
return EFI_INVALID_PARAMETER;
- /* Discover MM partition ID at boot time */
- if (!mm_sp_id && ffa_discover_mm_sp_id()) {
- log_err("EFI: Failure to discover MM SP ID at boot time, FF-A MM comms failure\n");
- return EFI_UNSUPPORTED;
+ if (!mm_sp_id) {
+ if (at_runtime)
+ return EFI_UNSUPPORTED;
+ if (ffa_discover_mm_sp_id())
+ return EFI_UNSUPPORTED;
}
mm_hdr = (struct efi_mm_communicate_header *)comm_buf;
tx_data_size = mm_hdr->message_len + sizeof(efi_guid_t) + sizeof(size_t);
+ hdr_cache_size = ALIGN(sizeof(*mm_hdr), CONFIG_SYS_CACHELINE_SIZE);
+ tx_cache_size = ALIGN(tx_data_size, CONFIG_SYS_CACHELINE_SIZE);
if (comm_buf_size != tx_data_size || tx_data_size > CONFIG_FFA_SHARED_MM_BUF_SIZE)
return EFI_INVALID_PARAMETER;
- /* Copy the data to the shared buffer */
-
- virt_shared_buf = map_sysmem((phys_addr_t)CONFIG_FFA_SHARED_MM_BUF_ADDR, 0);
- memcpy(virt_shared_buf, comm_buf, tx_data_size);
+ if (at_runtime) {
+ shared_buf = comm_buf;
+ } else {
+ /* Copy the data to the shared buffer */
+ shared_buf = map_sysmem((phys_addr_t)CONFIG_FFA_SHARED_MM_BUF_ADDR, 0);
+ memcpy(shared_buf, comm_buf, tx_data_size);
+ }
/*
- * The secure world might have cache disabled for
- * the device region used for shared buffer (which is the case for Optee).
- * In this case, the secure world reads the data from DRAM.
- * Let's flush the cache so the DRAM is updated with the latest data.
+ * Shared buffer cache maintenance for FF-A / OP-TEE communication:
+ *
+ * NS -> S (request path):
+ *
+ * The non-secure side populates the shared buffer. If the buffer is cached
+ * in NS, the updated bytes may reside in dirty D-cache lines and not yet be
+ * visible in DDR. Since the secure world typically reads the shared buffer
+ * directly from DDR (e.g. with caches disabled / non-coherent mapping), we
+ * must clean the corresponding cache lines to the Point of Coherency (PoC)
+ * before entering secure world.
+ *
+ * S -> NS (response path):
+ *
+ * The secure world may update the same shared buffer in DDR. After returning
+ * to non-secure, any cached copies of that region in NS may be stale. We
+ * therefore invalidate the shared buffer range after the FF-A call to drop
+ * those lines and force subsequent reads to fetch the latest data from DDR.
+ *
+ * Note: Whole-cache invalidation must not be used in EFI runtime context.
+ * After ExitBootServices(), the OS owns the cache hierarchy; global
+ * invalidation could drop OS dirty lines and violate the OS coherency
+ * model. Always operate on the shared buffer range only.
*/
-#ifdef CONFIG_ARM64
- invalidate_dcache_all();
-#endif
+ if (IS_ENABLED(CONFIG_ARM64)) {
+ BUILD_BUG_ON(CONFIG_FFA_SHARED_MM_BUF_ADDR %
+ CONFIG_SYS_CACHELINE_SIZE);
+ BUILD_BUG_ON(CONFIG_FFA_SHARED_MM_BUF_SIZE %
+ CONFIG_SYS_CACHELINE_SIZE);
+ flush_dcache_range((unsigned long)shared_buf,
+ (unsigned long)(shared_buf +
+ tx_cache_size));
+ }
/* Announce there is data in the shared buffer */
-
ffa_ret = ffa_notify_mm_sp();
switch (ffa_ret) {
case 0: {
ulong rx_data_size;
- /* Copy the MM SP response from the shared buffer to the communication buffer */
- rx_data_size = ((struct efi_mm_communicate_header *)virt_shared_buf)->message_len +
+ ulong rx_cache_size;
+
+ if (IS_ENABLED(CONFIG_ARM64))
+ invalidate_dcache_range((unsigned long)shared_buf,
+ (unsigned long)(shared_buf +
+ hdr_cache_size));
+
+ rx_data_size = ((struct efi_mm_communicate_header *)shared_buf)->message_len +
sizeof(efi_guid_t) +
sizeof(size_t);
- if (rx_data_size > comm_buf_size) {
+ if (rx_data_size > comm_buf_size ||
+ rx_data_size > CONFIG_FFA_SHARED_MM_BUF_SIZE) {
efi_ret = EFI_OUT_OF_RESOURCES;
break;
}
- memcpy(comm_buf, virt_shared_buf, rx_data_size);
+ if (IS_ENABLED(CONFIG_ARM64)) {
+ rx_cache_size = ALIGN(rx_data_size,
+ CONFIG_SYS_CACHELINE_SIZE);
+ if (rx_cache_size > hdr_cache_size)
+ invalidate_dcache_range((unsigned long)(shared_buf +
+ hdr_cache_size),
+ (unsigned long)(shared_buf +
+ rx_cache_size));
+ }
+
+ if (!at_runtime)
+ memcpy(comm_buf, shared_buf, rx_data_size);
efi_ret = EFI_SUCCESS;
break;
}
@@ -356,41 +443,45 @@ static efi_status_t ffa_mm_communicate(void *comm_buf, ulong comm_buf_size)
efi_ret = EFI_ACCESS_DENIED;
}
- unmap_sysmem(virt_shared_buf);
+ if (!at_runtime)
+ unmap_sysmem(shared_buf);
return efi_ret;
}
/**
* get_mm_comms() - detect the available MM transport
*
- * Make sure the FF-A bus is probed successfully
- * which means FF-A communication with secure world works and ready
- * for use.
+ * Make sure the FF-A bus is probed successfully during the boot phase,
+ * which means FF-A communication with secure world works and is ready for
+ * use. During the runtime phase, only the FF-A runtime transport can be
+ * selected.
*
- * If FF-A bus is not ready, use OPTEE comms.
+ * If FF-A bus is not ready at boot, use OP-TEE comms.
*
- * Return:
- *
- * MM_COMMS_FFA or MM_COMMS_OPTEE
+ * Return: MM_COMMS_FFA, MM_COMMS_OPTEE, or MM_COMMS_UNDEFINED
*/
-static enum mm_comms_select get_mm_comms(void)
+static enum mm_comms_select __efi_runtime get_mm_comms(void)
{
struct udevice *dev;
int ret;
+ if (efi_at_runtime()) {
+ if (IS_ENABLED(CONFIG_ARM_FFA_RT_MODE))
+ return MM_COMMS_FFA;
+ return MM_COMMS_UNDEFINED;
+ }
+
ret = uclass_first_device_err(UCLASS_FFA, &dev);
- if (ret) {
- log_debug("EFI: Cannot find FF-A bus device, trying Optee comms\n");
+ if (ret)
return MM_COMMS_OPTEE;
- }
return MM_COMMS_FFA;
}
#endif
/**
- * mm_communicate() - Adjust the communication buffer to the MM SP and send
- * it to OP-TEE
+ * mm_communicate() - Adjust the communication buffer to the MM SP and send it
+ * to the selected MM transport
*
* @comm_buf: locally allocated communication buffer
* @dsize: buffer size
@@ -400,11 +491,12 @@ static enum mm_comms_select get_mm_comms(void)
* When using the u-boot OP-TEE driver, StandAlonneMM is supported.
* When using the u-boot FF-A driver, any MM SP is supported.
*
- * Return: status code
+ * Return: status code
*/
-static efi_status_t mm_communicate(u8 *comm_buf, efi_uintn_t dsize)
+static efi_status_t __efi_runtime mm_communicate(u8 *comm_buf,
+ efi_uintn_t dsize)
{
- efi_status_t ret;
+ efi_status_t ret = EFI_UNSUPPORTED;
struct efi_mm_communicate_header *mm_hdr;
struct smm_variable_communicate_header *var_hdr;
#if CONFIG_IS_ENABLED(ARM_FFA_TRANSPORT)
@@ -419,23 +511,73 @@ static efi_status_t mm_communicate(u8 *comm_buf, efi_uintn_t dsize)
mm_comms = get_mm_comms();
if (mm_comms == MM_COMMS_FFA)
ret = ffa_mm_communicate(comm_buf, dsize);
- else
+ else if (mm_comms == MM_COMMS_OPTEE)
ret = optee_mm_communicate(comm_buf, dsize);
#else
- ret = optee_mm_communicate(comm_buf, dsize);
+ ret = optee_mm_communicate(comm_buf, dsize);
#endif
- if (ret != EFI_SUCCESS) {
- log_err("%s failed!\n", __func__);
+ if (ret != EFI_SUCCESS)
return ret;
- }
return var_hdr->ret_status;
}
/**
- * setup_mm_hdr() - Allocate a buffer for StandAloneMM and initialize the
- * header data.
+ * get_comm_buf() - Obtain a communication buffer for MM/FF-A exchange
+ * @payload_size: size of the payload that will be appended to the
+ * MM communication header
+ *
+ * This helper returns a buffer suitable for constructing an
+ * EFI_MM_COMMUNICATE message. During the boot phase a new buffer is
+ * dynamically allocated. After ExitBootServices(), dynamic
+ * allocation is no longer permitted, and all runtime communication must
+ * use the statically reserved FF-A shared buffer.
+ *
+ * The caller owns the returned buffer only during the boot phase and
+ * must release it with free(). During the runtime phase, the returned
+ * pointer aliases the static FF-A shared buffer and must not be freed.
+ *
+ * Return:
+ * Pointer to a valid communication buffer on success.
+ * NULL if no suitable communication buffer is available.
+ */
+static __efi_runtime u8 *get_comm_buf(efi_uintn_t payload_size)
+{
+ efi_uintn_t comm_buf_size;
+ u8 *comm_buf;
+
+ comm_buf_size = MM_COMMUNICATE_HEADER_SIZE +
+ MM_VARIABLE_COMMUNICATE_SIZE +
+ payload_size;
+
+ /*
+ * After ExitBootServices(), dynamic allocation is no longer permitted.
+ * Use the predefined FF-A shared buffer at runtime; otherwise allocate
+ * a fresh buffer during the boot phase.
+ */
+ if (efi_at_runtime()) {
+ if (IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)) {
+ if (comm_buf_size > CONFIG_FFA_SHARED_MM_BUF_SIZE)
+ return NULL;
+ comm_buf = ffa_shared_buf;
+ if (!comm_buf)
+ return NULL;
+ efi_memset_runtime(comm_buf, 0, comm_buf_size);
+ } else {
+ return NULL;
+ }
+ } else {
+ comm_buf = calloc(1, comm_buf_size);
+ if (!comm_buf)
+ return NULL;
+ }
+ return comm_buf;
+}
+
+/**
+ * setup_mm_hdr() - Obtain a communication buffer for StandAloneMM and
+ * initialize the MM header
*
* @dptr: pointer address of the corresponding StandAloneMM
* function
@@ -444,10 +586,11 @@ static efi_status_t mm_communicate(u8 *comm_buf, efi_uintn_t dsize)
* @ret: EFI return code
* Return: buffer or NULL
*/
-static u8 *setup_mm_hdr(void **dptr, efi_uintn_t payload_size,
- efi_uintn_t func, efi_status_t *ret)
+static __efi_runtime u8 *setup_mm_hdr(void **dptr, efi_uintn_t payload_size,
+ efi_uintn_t func, efi_status_t *ret)
{
- const efi_guid_t mm_var_guid = EFI_MM_VARIABLE_GUID;
+ static const __efi_runtime_rodata efi_guid_t mm_var_guid =
+ EFI_MM_VARIABLE_GUID;
struct efi_mm_communicate_header *mm_hdr;
struct smm_variable_communicate_header *var_hdr;
u8 *comm_buf;
@@ -465,16 +608,15 @@ static u8 *setup_mm_hdr(void **dptr, efi_uintn_t payload_size,
return NULL;
}
- comm_buf = calloc(1, MM_COMMUNICATE_HEADER_SIZE +
- MM_VARIABLE_COMMUNICATE_SIZE +
- payload_size);
+ comm_buf = get_comm_buf(payload_size);
if (!comm_buf) {
*ret = EFI_OUT_OF_RESOURCES;
return NULL;
}
mm_hdr = (struct efi_mm_communicate_header *)comm_buf;
- guidcpy(&mm_hdr->header_guid, &mm_var_guid);
+ efi_memcpy_runtime(&mm_hdr->header_guid, &mm_var_guid,
+ sizeof(mm_hdr->header_guid));
mm_hdr->message_len = MM_VARIABLE_COMMUNICATE_SIZE + payload_size;
var_hdr = (struct smm_variable_communicate_header *)mm_hdr->data;
@@ -982,6 +1124,21 @@ void efi_variables_boot_exit_notify(void)
efi_get_next_variable_name_runtime;
efi_runtime_services.set_variable = efi_set_variable_runtime;
efi_update_table_header_crc32(&efi_runtime_services.hdr);
+
+ /* Record that ExitBootServices() has been called */
+ ebs_called = true;
+}
+
+/**
+ * ffa_shared_buf_notify_virtual_address_map() - SetVirtualAddressMap callback
+ *
+ * @event: callback event
+ * @context: callback context
+ */
+static void EFIAPI __efi_runtime
+ffa_shared_buf_notify_virtual_address_map(struct efi_event *event, void *context)
+{
+ efi_convert_pointer(0, (void **)&ffa_shared_buf);
}
/**
@@ -992,6 +1149,7 @@ void efi_variables_boot_exit_notify(void)
efi_status_t efi_init_variables(void)
{
efi_status_t ret;
+ struct efi_event *event;
/* Create a cached copy of the variables that will be enabled on ExitBootServices() */
ret = efi_var_mem_init();
@@ -1010,5 +1168,35 @@ efi_status_t efi_init_variables(void)
if (ret != EFI_SUCCESS)
return ret;
+ if (IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)) {
+ /*
+ * The FF-A shared buffer is accessed by EFI runtime services, so
+ * keep the resident pointer convertible across
+ * SetVirtualAddressMap() and mark the region as runtime memory.
+ *
+ * CONFIG_FFA_SHARED_MM_BUF_ADDR is expected to be EFI-page aligned.
+ */
+ BUILD_BUG_ON(CONFIG_FFA_SHARED_MM_BUF_ADDR & EFI_PAGE_MASK);
+ ffa_shared_buf = (void *)CONFIG_FFA_SHARED_MM_BUF_ADDR;
+ ret = efi_create_event(EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE,
+ TPL_CALLBACK,
+ ffa_shared_buf_notify_virtual_address_map,
+ NULL, NULL, &event);
+ if (ret != EFI_SUCCESS)
+ return ret;
+ ret = efi_add_memory_map(CONFIG_FFA_SHARED_MM_BUF_ADDR,
+ CONFIG_FFA_SHARED_MM_BUF_SIZE,
+ EFI_RUNTIME_SERVICES_DATA);
+ if (ret != EFI_SUCCESS) {
+ efi_close_event(event);
+ log_err("EFI: failed to add FF-A shared buffer to runtime map (%lu)\n",
+ ret);
+ return ret;
+ }
+ log_info("EFI: FF-A shared buffer runtime map: addr=0x%lx size=0x%lx\n",
+ (ulong)CONFIG_FFA_SHARED_MM_BUF_ADDR,
+ (ulong)CONFIG_FFA_SHARED_MM_BUF_SIZE);
+ }
+
return EFI_SUCCESS;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v3 04/10] efi_loader: enable EFI runtime SetVariable()/GetVariable() using FF-A transport
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
` (2 preceding siblings ...)
2026-06-27 14:44 ` [PATCH v3 03/10] efi_loader: add FF-A runtime support in EFI variable TEE driver Harsimran Singh Tungal
@ 2026-06-27 14:44 ` Harsimran Singh Tungal
2026-07-01 13:49 ` Ilias Apalodimas
2026-06-27 14:44 ` [PATCH v3 05/10] charset: mark u16_strsize() as __efi_runtime Harsimran Singh Tungal
` (5 subsequent siblings)
9 siblings, 1 reply; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
Route EFI runtime variable APIs through FF-A MM communication
Route EFI runtime variable services through the FF-A/MM backend in
lib/efi_loader/efi_variable_tee.c. After ExitBootServices(),
GetVariable(), SetVariable(), GetNextVariableName(), and
QueryVariableInfo() use the runtime entry points and continue to reach
the MM secure partition.
Keep the existing boot-time helpers unchanged and add runtime service
wrappers for variable access and property handling. Reuse the
runtime-safe setup_mm_hdr() and common mm_communicate() path, which
selects the FF-A transport appropriate for the current phase, and use
the EFI runtime-safe memory helpers in the runtime-only code.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
lib/efi_loader/efi_variable_tee.c | 344 ++++++++++++++++++++++++++++--
1 file changed, 326 insertions(+), 18 deletions(-)
diff --git a/lib/efi_loader/efi_variable_tee.c b/lib/efi_loader/efi_variable_tee.c
index fe205bdf966..474dd186a3e 100644
--- a/lib/efi_loader/efi_variable_tee.c
+++ b/lib/efi_loader/efi_variable_tee.c
@@ -716,6 +716,38 @@ out:
return ret;
}
+static efi_status_t __efi_runtime set_property_int_runtime(const u16 *variable_name,
+ efi_uintn_t name_size,
+ const efi_guid_t *vendor,
+ struct var_check_property *var_property)
+{
+ struct smm_variable_var_check_property *smm_property;
+ efi_uintn_t payload_size;
+ u8 *comm_buf = NULL;
+ efi_status_t ret;
+
+ payload_size = sizeof(*smm_property) + name_size;
+ if (payload_size > max_payload_size) {
+ ret = EFI_INVALID_PARAMETER;
+ return ret;
+ }
+ comm_buf = setup_mm_hdr((void **)&smm_property, payload_size,
+ SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_SET,
+ &ret);
+ if (!comm_buf)
+ return ret;
+
+ efi_memcpy_runtime(&smm_property->guid, vendor, sizeof(*vendor));
+ smm_property->name_size = name_size;
+ efi_memcpy_runtime(&smm_property->property, var_property,
+ sizeof(smm_property->property));
+ efi_memcpy_runtime(smm_property->name, variable_name, name_size);
+
+ ret = mm_communicate(comm_buf, payload_size);
+
+ return ret;
+}
+
static efi_status_t get_property_int(const u16 *variable_name,
efi_uintn_t name_size,
const efi_guid_t *vendor,
@@ -761,6 +793,49 @@ out:
return ret;
}
+static efi_status_t __efi_runtime get_property_int_runtime(const u16 *variable_name,
+ efi_uintn_t name_size,
+ const efi_guid_t *vendor,
+ struct var_check_property *var_property)
+{
+ struct smm_variable_var_check_property *smm_property;
+ efi_uintn_t payload_size;
+ u8 *comm_buf = NULL;
+ efi_status_t ret;
+
+ efi_memset_runtime(var_property, 0, sizeof(*var_property));
+ payload_size = sizeof(*smm_property) + name_size;
+ if (payload_size > max_payload_size) {
+ ret = EFI_INVALID_PARAMETER;
+ return ret;
+ }
+ comm_buf = setup_mm_hdr((void **)&smm_property, payload_size,
+ SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET,
+ &ret);
+ if (!comm_buf)
+ return ret;
+
+ efi_memcpy_runtime(&smm_property->guid, vendor, sizeof(smm_property->guid));
+ smm_property->name_size = name_size;
+ efi_memcpy_runtime(smm_property->name, variable_name, name_size);
+
+ ret = mm_communicate(comm_buf, payload_size);
+ /*
+ * Currently only R/O property is supported in StMM.
+ * Variables that are not set to R/O will not set the property in StMM
+ * and the call will return EFI_NOT_FOUND. We are setting the
+ * properties to 0x0 so checking against that is enough for the
+ * EFI_NOT_FOUND case.
+ */
+ if (ret == EFI_NOT_FOUND)
+ return EFI_SUCCESS;
+ if (ret != EFI_SUCCESS)
+ return ret;
+ efi_memcpy_runtime(var_property, &smm_property->property, sizeof(*var_property));
+
+ return EFI_SUCCESS;
+}
+
efi_status_t efi_get_variable_int(const u16 *variable_name,
const efi_guid_t *vendor,
u32 *attributes, efi_uintn_t *data_size,
@@ -848,6 +923,93 @@ out:
return ret;
}
+efi_status_t __efi_runtime EFIAPI
+efi_get_variable_int_runtime(u16 *variable_name, const efi_guid_t *vendor,
+ u32 *attributes, efi_uintn_t *data_size, void *data)
+{
+ struct var_check_property var_property;
+ struct smm_variable_access *var_acc;
+ efi_uintn_t payload_size;
+ efi_uintn_t name_size;
+ efi_uintn_t tmp_dsize;
+ u8 *comm_buf = NULL;
+ efi_status_t ret, tmp;
+ u32 var_attr = 0;
+
+ if (!variable_name || !vendor || !data_size) {
+ ret = EFI_INVALID_PARAMETER;
+ return ret;
+ }
+
+ /* Check payload size */
+ name_size = u16_strsize(variable_name);
+ if (name_size > max_payload_size - MM_VARIABLE_ACCESS_HEADER_SIZE) {
+ ret = EFI_INVALID_PARAMETER;
+ return ret;
+ }
+
+ /* Trim output buffer size */
+ tmp_dsize = *data_size;
+ if (name_size + tmp_dsize >
+ max_payload_size - MM_VARIABLE_ACCESS_HEADER_SIZE) {
+ tmp_dsize = max_payload_size -
+ MM_VARIABLE_ACCESS_HEADER_SIZE -
+ name_size;
+ }
+
+ /* Get communication buffer and initialize header */
+ payload_size = MM_VARIABLE_ACCESS_HEADER_SIZE + name_size + tmp_dsize;
+ comm_buf = setup_mm_hdr((void **)&var_acc, payload_size,
+ SMM_VARIABLE_FUNCTION_GET_VARIABLE, &ret);
+ if (!comm_buf)
+ return ret;
+
+ /* Fill in contents */
+ efi_memcpy_runtime(&var_acc->guid, vendor, sizeof(var_acc->guid));
+ var_acc->data_size = tmp_dsize;
+ var_acc->name_size = name_size;
+ var_acc->attr = attributes ? *attributes : 0;
+ efi_memcpy_runtime(var_acc->name, variable_name, name_size);
+
+ /* Communicate */
+ ret = mm_communicate(comm_buf, payload_size);
+ if (ret != EFI_SUCCESS && ret != EFI_BUFFER_TOO_SMALL)
+ return ret;
+
+ /* Update with reported data size for trimmed case */
+ *data_size = var_acc->data_size;
+ if (attributes)
+ var_attr = var_acc->attr;
+
+ /* Copy the data if ret is EFI_SUCCESS */
+ if (ret == EFI_SUCCESS) {
+ if (data)
+ efi_memcpy_runtime(data, (u8 *)var_acc->name + var_acc->name_size,
+ var_acc->data_size);
+ else
+ ret = EFI_INVALID_PARAMETER;
+ }
+
+ /*
+ * UEFI > 2.7 needs the attributes set even if the buffer is
+ * smaller
+ */
+ if (attributes) {
+ tmp = get_property_int_runtime(variable_name, name_size, vendor,
+ &var_property);
+ if (tmp != EFI_SUCCESS) {
+ ret = tmp;
+ return ret;
+ }
+ *attributes = var_attr;
+ if (var_property.property &
+ VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY)
+ *attributes |= EFI_VARIABLE_READ_ONLY;
+ }
+
+ return ret;
+}
+
efi_status_t efi_get_next_variable_name_int(efi_uintn_t *variable_name_size,
u16 *variable_name,
efi_guid_t *guid)
@@ -912,6 +1074,68 @@ out:
return ret;
}
+efi_status_t __efi_runtime EFIAPI
+efi_get_next_variable_name_int_runtime(efi_uintn_t *variable_name_size,
+ u16 *variable_name, efi_guid_t *guid)
+{
+ struct smm_variable_getnext *var_getnext;
+ efi_uintn_t payload_size;
+ efi_uintn_t out_name_size;
+ efi_uintn_t in_name_size;
+ u8 *comm_buf = NULL;
+ efi_status_t ret;
+
+ if (!variable_name_size || !variable_name || !guid) {
+ ret = EFI_INVALID_PARAMETER;
+ return ret;
+ }
+
+ out_name_size = *variable_name_size;
+ in_name_size = u16_strsize(variable_name);
+
+ if (out_name_size < in_name_size) {
+ ret = EFI_INVALID_PARAMETER;
+ return ret;
+ }
+
+ if (in_name_size > max_payload_size - MM_VARIABLE_GET_NEXT_HEADER_SIZE) {
+ ret = EFI_INVALID_PARAMETER;
+ return ret;
+ }
+
+ /* Trim output buffer size */
+ if (out_name_size > max_payload_size - MM_VARIABLE_GET_NEXT_HEADER_SIZE)
+ out_name_size = max_payload_size - MM_VARIABLE_GET_NEXT_HEADER_SIZE;
+
+ payload_size = MM_VARIABLE_GET_NEXT_HEADER_SIZE + out_name_size;
+ comm_buf = setup_mm_hdr((void **)&var_getnext, payload_size,
+ SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME,
+ &ret);
+ if (!comm_buf)
+ return ret;
+
+ /* Fill in contents */
+ efi_memcpy_runtime(&var_getnext->guid, guid, sizeof(*guid));
+ var_getnext->name_size = out_name_size;
+ efi_memcpy_runtime(var_getnext->name, variable_name, in_name_size);
+ efi_memset_runtime((u8 *)var_getnext->name + in_name_size, 0x0,
+ out_name_size - in_name_size);
+
+ /* Communicate */
+ ret = mm_communicate(comm_buf, payload_size);
+ if (ret == EFI_SUCCESS || ret == EFI_BUFFER_TOO_SMALL) {
+ /* Update with reported data size for trimmed case */
+ *variable_name_size = var_getnext->name_size;
+ }
+ if (ret != EFI_SUCCESS)
+ return ret;
+
+ efi_memcpy_runtime(guid, &var_getnext->guid, sizeof(*guid));
+ efi_memcpy_runtime(variable_name, var_getnext->name, var_getnext->name_size);
+
+ return ret;
+}
+
efi_status_t efi_set_variable_int(const u16 *variable_name,
const efi_guid_t *vendor, u32 attributes,
efi_uintn_t data_size, const void *data,
@@ -994,7 +1218,7 @@ efi_status_t efi_set_variable_int(const u16 *variable_name,
var_property.property |= VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY;
var_property.attributes = attributes;
var_property.minsize = 1;
- var_property.maxsize = var_acc->data_size;
+ var_property.maxsize = data_size;
ret = set_property_int(variable_name, name_size, vendor, &var_property);
}
@@ -1045,7 +1269,7 @@ out:
}
/**
- * efi_query_variable_info() - get information about EFI variables
+ * efi_query_variable_info_int_runtime() - get information about EFI variables
*
* This function implements the QueryVariableInfo() runtime service.
*
@@ -1054,24 +1278,50 @@ out:
*
* @attributes: bitmask to select variables to be
* queried
- * @maximum_variable_storage_size: maximum size of storage area for the
+ * @max_variable_storage_size: maximum size of storage area for the
* selected variable types
- * @remaining_variable_storage_size: remaining size of storage are for the
+ * @remain_variable_storage_size: remaining size of storage are for the
* selected variable types
- * @maximum_variable_size: maximum size of a variable of the
+ * @max_variable_size: maximum size of a variable of the
* selected type
* Return: status code
*/
efi_status_t EFIAPI __efi_runtime
-efi_query_variable_info_runtime(u32 attributes, u64 *max_variable_storage_size,
- u64 *remain_variable_storage_size,
- u64 *max_variable_size)
+efi_query_variable_info_int_runtime(u32 attributes, u64 *max_variable_storage_size,
+ u64 *remain_variable_storage_size,
+ u64 *max_variable_size)
{
- return EFI_UNSUPPORTED;
+ struct smm_variable_query_info *mm_query_info;
+ efi_uintn_t payload_size;
+ efi_status_t ret;
+ u8 *comm_buf;
+
+ if (!max_variable_storage_size ||
+ !remain_variable_storage_size ||
+ !max_variable_size || !attributes)
+ return EFI_INVALID_PARAMETER;
+
+ payload_size = sizeof(*mm_query_info);
+ comm_buf = setup_mm_hdr((void **)&mm_query_info, payload_size,
+ SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO,
+ &ret);
+ if (!comm_buf)
+ return ret;
+
+ mm_query_info->attr = attributes;
+ ret = mm_communicate(comm_buf, payload_size);
+ if (ret != EFI_SUCCESS)
+ return ret;
+ *max_variable_storage_size = mm_query_info->max_variable_storage;
+ *remain_variable_storage_size =
+ mm_query_info->remaining_variable_storage;
+ *max_variable_size = mm_query_info->max_variable_size;
+
+ return ret;
}
/**
- * efi_set_variable_runtime() - runtime implementation of SetVariable()
+ * efi_set_variable_int_runtime() - runtime implementation of SetVariable()
*
* @variable_name: name of the variable
* @guid: vendor GUID
@@ -1081,11 +1331,69 @@ efi_query_variable_info_runtime(u32 attributes, u64 *max_variable_storage_size,
* Return: status code
*/
static efi_status_t __efi_runtime EFIAPI
-efi_set_variable_runtime(u16 *variable_name, const efi_guid_t *guid,
- u32 attributes, efi_uintn_t data_size,
- const void *data)
+efi_set_variable_int_runtime(u16 *variable_name, const efi_guid_t *guid,
+ u32 attributes, efi_uintn_t data_size,
+ const void *data)
{
- return EFI_UNSUPPORTED;
+ efi_status_t ret, mm_communicate_ret = EFI_SUCCESS;
+ struct var_check_property var_property;
+ struct smm_variable_access *var_acc;
+ efi_uintn_t payload_size;
+ efi_uintn_t name_size;
+ u8 *comm_buf = NULL;
+ bool ro;
+
+ if (!variable_name || variable_name[0] == 0 || !guid)
+ return EFI_INVALID_PARAMETER;
+
+ if (data_size > 0 && !data)
+ return EFI_INVALID_PARAMETER;
+
+ /* Check payload size */
+ name_size = u16_strsize(variable_name);
+ payload_size = MM_VARIABLE_ACCESS_HEADER_SIZE + name_size + data_size;
+ if (payload_size > max_payload_size)
+ return EFI_INVALID_PARAMETER;
+
+ ro = !!(attributes & EFI_VARIABLE_READ_ONLY);
+ attributes &= EFI_VARIABLE_MASK;
+
+ ret = get_property_int_runtime(variable_name, name_size, guid,
+ &var_property);
+ if (ret != EFI_SUCCESS)
+ return ret;
+
+ if (var_property.property & VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY)
+ return EFI_WRITE_PROTECTED;
+
+ comm_buf = setup_mm_hdr((void **)&var_acc, payload_size,
+ SMM_VARIABLE_FUNCTION_SET_VARIABLE, &ret);
+ if (!comm_buf)
+ return ret;
+
+ /* Fill in contents */
+ efi_memcpy_runtime(&var_acc->guid, guid, sizeof(*guid));
+ var_acc->data_size = data_size;
+ var_acc->name_size = name_size;
+ var_acc->attr = attributes;
+ efi_memcpy_runtime(var_acc->name, variable_name, name_size);
+ efi_memcpy_runtime((u8 *)var_acc->name + name_size, data, data_size);
+
+ /* Communicate */
+ ret = mm_communicate(comm_buf, payload_size);
+ if (ret != EFI_SUCCESS)
+ mm_communicate_ret = ret;
+
+ if (ro && !(var_property.property & VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY)) {
+ var_property.revision = VAR_CHECK_VARIABLE_PROPERTY_REVISION;
+ var_property.property |= VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY;
+ var_property.attributes = attributes;
+ var_property.minsize = 1;
+ var_property.maxsize = data_size;
+ ret = set_property_int_runtime(variable_name, name_size, guid, &var_property);
+ }
+
+ return (mm_communicate_ret == EFI_SUCCESS) ? ret : mm_communicate_ret;
}
/**
@@ -1118,11 +1426,11 @@ void efi_variables_boot_exit_notify(void)
/* Update runtime service table */
efi_runtime_services.query_variable_info =
- efi_query_variable_info_runtime;
- efi_runtime_services.get_variable = efi_get_variable_runtime;
+ efi_query_variable_info_int_runtime;
+ efi_runtime_services.get_variable = efi_get_variable_int_runtime;
efi_runtime_services.get_next_variable_name =
- efi_get_next_variable_name_runtime;
- efi_runtime_services.set_variable = efi_set_variable_runtime;
+ efi_get_next_variable_name_int_runtime;
+ efi_runtime_services.set_variable = efi_set_variable_int_runtime;
efi_update_table_header_crc32(&efi_runtime_services.hdr);
/* Record that ExitBootServices() has been called */
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v3 05/10] charset: mark u16_strsize() as __efi_runtime
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
` (3 preceding siblings ...)
2026-06-27 14:44 ` [PATCH v3 04/10] efi_loader: enable EFI runtime SetVariable()/GetVariable() using FF-A transport Harsimran Singh Tungal
@ 2026-06-27 14:44 ` Harsimran Singh Tungal
2026-06-27 18:50 ` Ilias Apalodimas
2026-06-29 18:28 ` Abdellatif El Khlifi
2026-06-27 14:44 ` [PATCH v3 06/10] corstone1000: enable bootefi selftest Harsimran Singh Tungal
` (4 subsequent siblings)
9 siblings, 2 replies; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
Mark u16_strsize() as __efi_runtime so it can be called from the EFI
runtime variable paths added for FF-A/MM communication after
ExitBootServices().
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
lib/charset.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/charset.c b/lib/charset.c
index 182c92a50c4..738ad1352de 100644
--- a/lib/charset.c
+++ b/lib/charset.c
@@ -407,7 +407,7 @@ size_t __efi_runtime u16_strnlen(const u16 *in, size_t count)
return i;
}
-size_t u16_strsize(const void *in)
+size_t __efi_runtime u16_strsize(const void *in)
{
return (u16_strlen(in) + 1) * sizeof(u16);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v3 06/10] corstone1000: enable bootefi selftest
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
` (4 preceding siblings ...)
2026-06-27 14:44 ` [PATCH v3 05/10] charset: mark u16_strsize() as __efi_runtime Harsimran Singh Tungal
@ 2026-06-27 14:44 ` Harsimran Singh Tungal
2026-06-29 18:44 ` Abdellatif El Khlifi
2026-06-27 14:44 ` [PATCH v3 07/10] efi: selftest: add runtime variable tests with non-volatile storage Harsimran Singh Tungal
` (3 subsequent siblings)
9 siblings, 1 reply; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
Enable `CMD_BOOTEFI_SELFTEST` in `corstone1000_defconfig` so the later
runtime-variable selftest patch in this series can be exercised on
Corstone-1000.
Keep `CMD_BOOTEFI_HELLO` and `CMD_POWEROFF` explicitly disabled.
Enabling `CMD_BOOTEFI_SELFTEST` would otherwise make
`CMD_BOOTEFI_HELLO` default to `y` and pull in `CMD_POWEROFF` on this
PSCI-based defconfig. The intent here is to enable the selftest command
without broadening the rest of the board command set.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
configs/corstone1000_defconfig | 3 +++
1 file changed, 3 insertions(+)
diff --git a/configs/corstone1000_defconfig b/configs/corstone1000_defconfig
index 876b915b6a4..e16b13043ac 100644
--- a/configs/corstone1000_defconfig
+++ b/configs/corstone1000_defconfig
@@ -32,6 +32,8 @@ CONFIG_SYS_PROMPT="corstone1000# "
# CONFIG_CMD_CONSOLE is not set
CONFIG_CMD_FWU_METADATA=y
CONFIG_CMD_BOOTZ=y
+# CONFIG_CMD_BOOTEFI_HELLO is not set
+CONFIG_CMD_BOOTEFI_SELFTEST=y
# CONFIG_CMD_XIMG is not set
CONFIG_CMD_GPT=y
CONFIG_CMD_LOADM=y
@@ -62,6 +64,7 @@ CONFIG_SYSRESET=y
CONFIG_SYSRESET_PSCI=y
CONFIG_TEE=y
CONFIG_OPTEE=y
+# CONFIG_CMD_POWEROFF is not set
CONFIG_USB=y
CONFIG_USB_ISP1760=y
# CONFIG_RANDOM_UUID is not set
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v3 07/10] efi: selftest: add runtime variable tests with non-volatile storage
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
` (5 preceding siblings ...)
2026-06-27 14:44 ` [PATCH v3 06/10] corstone1000: enable bootefi selftest Harsimran Singh Tungal
@ 2026-06-27 14:44 ` Harsimran Singh Tungal
2026-06-27 14:44 ` [PATCH v3 08/10] test: dm: add sandbox FF-A runtime transport tests Harsimran Singh Tungal
` (2 subsequent siblings)
9 siblings, 0 replies; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
Extend runtime variable tests for persistent storage
Runtime variable selftests already cover the volatile-store path in a
single run, but non-volatile storage needs state to survive a reboot.
Make that flow explicit by keeping the existing "variables at runtime"
test for CONFIG_EFI_RT_VOLATILE_STORE=y and adding on-request
"variables at runtime setup" and "variables at runtime verify" tests
for the non-volatile case.
The setup phase runs QueryVariableInfo(), exercises create/delete of a
runtime variable, prepares the persistent test state, and prompts the
user to reboot and run the verify test. If an old test variable is
already present, reuse it only when it matches the expected
half-payload; otherwise delete it and recreate clean state. The setup
path also performs a best-effort cleanup if a later check fails.
The verify phase checks the prepared value, appends the remaining
payload, validates the full contents, deletes the test variable, and
confirms that it is gone.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
.../efi_selftest_variables_runtime.c | 715 ++++++++++++------
1 file changed, 482 insertions(+), 233 deletions(-)
diff --git a/lib/efi_selftest/efi_selftest_variables_runtime.c b/lib/efi_selftest/efi_selftest_variables_runtime.c
index fd570d673f0..90ec568ca3a 100644
--- a/lib/efi_selftest/efi_selftest_variables_runtime.c
+++ b/lib/efi_selftest/efi_selftest_variables_runtime.c
@@ -3,6 +3,7 @@
* efi_selftest_variables_runtime
*
* Copyright (c) 2019 Heinrich Schuchardt <xypron.glpk@gmx.de>
+ * Copyright (c) 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
*
* This unit test checks the runtime services for variables after
* ExitBootServices():
@@ -17,294 +18,542 @@
#define EFI_ST_MAX_VARNAME_SIZE 40
static const efi_guid_t guid_vendor0 = EFI_GLOBAL_VARIABLE_GUID;
-static const efi_guid_t efi_rt_var_guid = U_BOOT_EFI_RT_VAR_FILE_GUID;
/**
- * execute() - execute unit test
+ * check_runtime_query_variable_info() - Run QueryVariableInfo() checks
+ * @phase: test phase string used in failure logs
+ *
+ * Run the runtime QueryVariableInfo() checks for the current test phase.
*
- * As runtime support is not implmented expect EFI_UNSUPPORTED to be returned.
+ * Return: EFI_ST_SUCCESS on success, EFI_ST_FAILURE on failure
*/
-static int execute(void)
+static int check_runtime_query_variable_info(const char *phase)
{
efi_status_t ret;
- efi_uintn_t len, avail, append_len = 17;
- u32 attr;
- u8 v[16] = {0x5d, 0xd1, 0x5e, 0x51, 0x5a, 0x05, 0xc7, 0x0c,
- 0x35, 0x4a, 0xae, 0x87, 0xa5, 0xdf, 0x0f, 0x65,};
- u8 v2[CONFIG_EFI_VAR_BUF_SIZE];
- u8 data[EFI_ST_MAX_DATA_SIZE];
- u8 data2[CONFIG_EFI_VAR_BUF_SIZE];
- u16 varname[EFI_ST_MAX_VARNAME_SIZE];
- efi_guid_t guid;
u64 max_storage, rem_storage, max_size;
int test_ret;
- memset(v2, 0x1, sizeof(v2));
-
if (IS_ENABLED(CONFIG_EFI_VARIABLE_FILE_STORE)) {
test_ret = efi_st_query_variable_common(
EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS);
if (test_ret != EFI_ST_SUCCESS) {
- efi_st_error("QueryVariableInfo failed\n");
+ efi_st_error("%s: QueryVariableInfo checks failed\n",
+ phase);
return EFI_ST_FAILURE;
}
} else {
ret = st_runtime->query_variable_info(
EFI_VARIABLE_BOOTSERVICE_ACCESS, &max_storage,
&rem_storage, &max_size);
- if (ret != EFI_UNSUPPORTED) {
- efi_st_error("QueryVariableInfo failed\n");
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("%s: QueryVariableInfo returned status=%x\n",
+ phase, (u32)ret);
return EFI_ST_FAILURE;
}
}
+ return EFI_ST_SUCCESS;
+}
+
+/**
+ * check_runtime_variable_enumeration() - Check runtime variable enumeration
+ * @phase: test phase string used in failure logs
+ *
+ * Confirm that runtime variable reads and GetNextVariableName() still work
+ * while the current test state is present.
+ *
+ * Return: EFI_ST_SUCCESS on success, EFI_ST_FAILURE on failure
+ */
+static int check_runtime_variable_enumeration(const char *phase)
+{
+ efi_status_t ret;
+ efi_uintn_t len;
+ u32 attr = 0;
+ u8 data[EFI_ST_MAX_DATA_SIZE];
+ u16 varname[EFI_ST_MAX_VARNAME_SIZE];
+ efi_guid_t guid;
+
+ len = sizeof(data);
+ ret = st_runtime->get_variable(u"PlatformLangCodes", &guid_vendor0,
+ &attr, &len, data);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("%s: failed to read PlatformLangCodes, status=%lx\n",
+ phase, (ulong)ret);
+ return EFI_ST_FAILURE;
+ }
+
+ memset(&guid, 0, sizeof(guid));
+ *varname = 0;
+ len = sizeof(varname);
+ ret = st_runtime->get_next_variable_name(&len, varname, &guid);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("%s: GetNextVariableName failed, status=%lx\n",
+ phase, (ulong)ret);
+ return EFI_ST_FAILURE;
+ }
+
+ return EFI_ST_SUCCESS;
+}
+
+#ifdef CONFIG_EFI_RT_VOLATILE_STORE
+static const efi_guid_t efi_rt_var_guid = U_BOOT_EFI_RT_VAR_FILE_GUID;
+
+/**
+ * execute() - Execute the single-run volatile-store runtime test
+ *
+ * Run the runtime variable checks that complete in a single invocation when
+ * the runtime store is volatile.
+ *
+ * Return: EFI_ST_SUCCESS on success, EFI_ST_FAILURE on failure
+ */
+static int execute(void)
+{
+ efi_status_t ret;
+ efi_uintn_t len, avail, append_len = 17;
+ u32 attr = 0;
+ u8 v[16] = {0x5d, 0xd1, 0x5e, 0x51, 0x5a, 0x05, 0xc7, 0x0c,
+ 0x35, 0x4a, 0xae, 0x87, 0xa5, 0xdf, 0x0f, 0x65,};
+ u8 v2[CONFIG_EFI_VAR_BUF_SIZE];
+ u8 data[EFI_ST_MAX_DATA_SIZE];
+ u8 data2[CONFIG_EFI_VAR_BUF_SIZE];
+ efi_uintn_t prev_len, delta;
+ struct efi_var_entry *var;
+ struct efi_var_file *hdr;
+
+ memset(v2, 0x1, sizeof(v2));
+
+ if (check_runtime_query_variable_info("runtime") != EFI_ST_SUCCESS)
+ return EFI_ST_FAILURE;
+
ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS,
3, v + 4);
- if (IS_ENABLED(CONFIG_EFI_RT_VOLATILE_STORE)) {
- efi_uintn_t prev_len, delta;
- struct efi_var_entry *var;
- struct efi_var_file *hdr;
-
- /* At runtime only non-volatile variables may be set. */
- if (ret != EFI_INVALID_PARAMETER) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
- /* runtime attribute must be set */
- ret = st_runtime->set_variable(
- u"efi_st_var0", &guid_vendor0,
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_NON_VOLATILE,
- 3, v + 4);
- if (ret != EFI_INVALID_PARAMETER) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
+ /* At runtime only non-volatile variables may be set. */
+ if (ret != EFI_INVALID_PARAMETER) {
+ efi_st_error("SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
- len = sizeof(data);
- ret = st_runtime->get_variable(u"RTStorageVolatile",
- &efi_rt_var_guid, &attr, &len,
- data);
- if (ret != EFI_SUCCESS) {
- efi_st_error("GetVariable failed\n");
- return EFI_ST_FAILURE;
- }
+ /* runtime attribute must be set */
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ 3, v + 4);
+ if (ret != EFI_INVALID_PARAMETER) {
+ efi_st_error("SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
- if (len != sizeof(EFI_VAR_FILE_NAME) ||
- memcmp(data, EFI_VAR_FILE_NAME, sizeof(EFI_VAR_FILE_NAME))) {
- data[len - 1] = 0;
- efi_st_error("RTStorageVolatile = %s\n", data);
- return EFI_ST_FAILURE;
- }
+ len = sizeof(data);
+ ret = st_runtime->get_variable(u"RTStorageVolatile", &efi_rt_var_guid,
+ &attr, &len, data);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("GetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
- len = sizeof(data2);
- ret = st_runtime->get_variable(u"VarToFile", &efi_rt_var_guid,
- &attr, &len, data2);
- if (ret != EFI_SUCCESS) {
- efi_st_error("GetVariable failed\n");
- return EFI_ST_FAILURE;
- }
- /*
- * VarToFile size must change once a variable is inserted
- * Store it now, we'll use it later
- */
- prev_len = len;
- ret = st_runtime->set_variable(
- u"efi_st_var0", &guid_vendor0,
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS |
- EFI_VARIABLE_NON_VOLATILE,
- sizeof(v2), v2);
- /*
- * This will try to update VarToFile as well and must fail,
- * without changing or deleting VarToFile
- */
- if (ret != EFI_OUT_OF_RESOURCES) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
- len = sizeof(data2);
- ret = st_runtime->get_variable(u"VarToFile", &efi_rt_var_guid,
- &attr, &len, data2);
- if (ret != EFI_SUCCESS || prev_len != len) {
- efi_st_error("Get/SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
+ if (len != sizeof(EFI_VAR_FILE_NAME) ||
+ memcmp(data, EFI_VAR_FILE_NAME, sizeof(EFI_VAR_FILE_NAME))) {
+ data[len - 1] = 0;
+ efi_st_error("RTStorageVolatile = %s\n", data);
+ return EFI_ST_FAILURE;
+ }
- /* Add an 8byte aligned variable */
- ret = st_runtime->set_variable(
- u"efi_st_var0", &guid_vendor0,
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS |
- EFI_VARIABLE_NON_VOLATILE,
- sizeof(v), v);
- if (ret != EFI_SUCCESS) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
+ len = sizeof(data2);
+ ret = st_runtime->get_variable(u"VarToFile", &efi_rt_var_guid,
+ &attr, &len, data2);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("GetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
+ /*
+ * VarToFile size must change once a variable is inserted
+ * Store it now, we'll use it later
+ */
+ prev_len = len;
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ sizeof(v2), v2);
+ /*
+ * This will try to update VarToFile as well and must fail,
+ * without changing or deleting VarToFile
+ */
+ if (ret != EFI_OUT_OF_RESOURCES) {
+ efi_st_error("SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
+ len = sizeof(data2);
+ ret = st_runtime->get_variable(u"VarToFile", &efi_rt_var_guid,
+ &attr, &len, data2);
+ if (ret != EFI_SUCCESS || prev_len != len) {
+ efi_st_error("Get/SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
- /* Delete it by setting the attrs to 0 */
- ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0, 0,
- sizeof(v), v);
- if (ret != EFI_SUCCESS) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
+ /* Add an 8byte aligned variable */
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ sizeof(v), v);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
- /* Add it back */
- ret = st_runtime->set_variable(
- u"efi_st_var0", &guid_vendor0,
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS |
- EFI_VARIABLE_NON_VOLATILE,
- sizeof(v), v);
- if (ret != EFI_SUCCESS) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
+ /* Delete it by setting the attrs to 0 */
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0, 0,
+ sizeof(v), v);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
- /* Delete it again by setting the size to 0 */
- ret = st_runtime->set_variable(
- u"efi_st_var0", &guid_vendor0,
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS |
- EFI_VARIABLE_NON_VOLATILE,
- 0, NULL);
- if (ret != EFI_SUCCESS) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
+ /* Add it back */
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ sizeof(v), v);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
- /* Delete it again and make sure it's not there */
- ret = st_runtime->set_variable(
- u"efi_st_var0", &guid_vendor0,
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS |
- EFI_VARIABLE_NON_VOLATILE,
- 0, NULL);
- if (ret != EFI_NOT_FOUND) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
+ /* Delete it again by setting the size to 0 */
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ 0, NULL);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
- /*
- * Add a non-aligned variable
- * VarToFile updates must include efi_st_var0
- */
- ret = st_runtime->set_variable(
- u"efi_st_var0", &guid_vendor0,
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS |
- EFI_VARIABLE_NON_VOLATILE,
- 9, v + 4);
- if (ret != EFI_SUCCESS) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
- var = efi_var_mem_find(&guid_vendor0, u"efi_st_var0", NULL);
- if (!var) {
- efi_st_error("GetVariable failed\n");
- return EFI_ST_FAILURE;
- }
- delta = efi_var_entry_len(var);
- len = sizeof(data2);
- ret = st_runtime->get_variable(u"VarToFile", &efi_rt_var_guid,
- &attr, &len, data2);
- if (ret != EFI_SUCCESS || prev_len + delta != len) {
- efi_st_error("Get/SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
+ /* Delete it again and make sure it's not there */
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ 0, NULL);
+ if (ret != EFI_NOT_FOUND) {
+ efi_st_error("SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
- /*
- * Append on an existing variable must update VarToFile
- * Our variable entries are 8-byte aligned.
- * Adding a single byte will fit on the existing space
- */
- prev_len = len;
- avail = efi_var_entry_len(var) -
- (sizeof(u16) * (u16_strlen(var->name) + 1) +
- sizeof(*var)) -
- var->length;
- if (avail >= append_len)
- delta = 0;
- else
- delta = ALIGN(append_len - avail, 8);
- ret = st_runtime->set_variable(
- u"efi_st_var0", &guid_vendor0,
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS |
- EFI_VARIABLE_APPEND_WRITE |
- EFI_VARIABLE_NON_VOLATILE,
- append_len, v2);
- if (ret != EFI_SUCCESS) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
- len = sizeof(data2);
- ret = st_runtime->get_variable(u"VarToFile", &efi_rt_var_guid,
- &attr, &len, data2);
+ /*
+ * Add a non-aligned variable
+ * VarToFile updates must include efi_st_var0
+ */
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ 9, v + 4);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
+ var = efi_var_mem_find(&guid_vendor0, u"efi_st_var0", NULL);
+ if (!var) {
+ efi_st_error("GetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
+ delta = efi_var_entry_len(var);
+ len = sizeof(data2);
+ ret = st_runtime->get_variable(u"VarToFile", &efi_rt_var_guid,
+ &attr, &len, data2);
+ if (ret != EFI_SUCCESS || prev_len + delta != len) {
+ efi_st_error("Get/SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
+
+ /*
+ * Append on an existing variable must update VarToFile
+ * Our variable entries are 8-byte aligned.
+ * Adding a single byte will fit on the existing space
+ */
+ prev_len = len;
+ avail = efi_var_entry_len(var) -
+ (sizeof(u16) * (u16_strlen(var->name) + 1) +
+ sizeof(*var)) -
+ var->length;
+ if (avail >= append_len)
+ delta = 0;
+ else
+ delta = ALIGN(append_len - avail, 8);
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_APPEND_WRITE |
+ EFI_VARIABLE_NON_VOLATILE,
+ append_len, v2);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
+ len = sizeof(data2);
+ ret = st_runtime->get_variable(u"VarToFile", &efi_rt_var_guid,
+ &attr, &len, data2);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("GetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
+ if (prev_len + delta != len) {
+ efi_st_error("Unexpected VarToFile size");
+ return EFI_ST_FAILURE;
+ }
+
+ /* Make sure that variable contains a valid file */
+ hdr = (struct efi_var_file *)data2;
+ if (hdr->magic != EFI_VAR_FILE_MAGIC || len != hdr->length ||
+ hdr->crc32 != crc32(0,
+ (u8 *)((uintptr_t)data2 +
+ sizeof(struct efi_var_file)),
+ len - sizeof(struct efi_var_file))) {
+ efi_st_error("VarToFile invalid header\n");
+ return EFI_ST_FAILURE;
+ }
+
+ /* Variables that are BS, RT and volatile are RO after EBS */
+ ret = st_runtime->set_variable(u"VarToFile", &efi_rt_var_guid,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ sizeof(v), v);
+ if (ret != EFI_WRITE_PROTECTED) {
+ efi_st_error("Get/SetVariable failed\n");
+ return EFI_ST_FAILURE;
+ }
+
+ return check_runtime_variable_enumeration("runtime");
+}
+
+EFI_UNIT_TEST(variables_run) = {
+ .name = "variables at runtime",
+ .phase = EFI_SETUP_BEFORE_BOOTTIME_EXIT,
+ .execute = execute,
+};
+#else
+/**
+ * execute_setup() - Prepare the non-volatile runtime-variable test state
+ *
+ * Create the persistent variable state consumed by execute_verify() after a
+ * reboot and make the reboot boundary explicit to the caller.
+ *
+ * Return: EFI_ST_SUCCESS on success, EFI_ST_FAILURE on failure
+ */
+static int execute_setup(void)
+{
+ efi_status_t ret;
+ efi_uintn_t len;
+ u32 attr = 0;
+ u8 v[16] = {0x5d, 0xd1, 0x5e, 0x51, 0x5a, 0x05, 0xc7, 0x0c,
+ 0x35, 0x4a, 0xae, 0x87, 0xa5, 0xdf, 0x0f, 0x65,};
+ u8 data[EFI_ST_MAX_DATA_SIZE];
+
+ /* Check if the setup variable already exists in non-volatile storage. */
+ len = sizeof(data);
+ ret = st_runtime->get_variable(u"efi_st_var0", &guid_vendor0,
+ &attr, &len, data);
+ if (ret == EFI_SUCCESS && len == sizeof(v) / 2 && !memcmp(data, v, len)) {
+ efi_st_printf("setup: efi_st_var0 ready, run verify\n");
+ return EFI_ST_SUCCESS;
+ }
+ if (ret == EFI_SUCCESS || ret == EFI_BUFFER_TOO_SMALL) {
+ /* Delete a stale variable before recreating the setup state. */
+ if (!attr)
+ attr = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE;
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ attr, 0, NULL);
if (ret != EFI_SUCCESS) {
- efi_st_error("GetVariable failed\n");
- return EFI_ST_FAILURE;
- }
- if (prev_len + delta != len) {
- efi_st_error("Unexpected VarToFile size");
+ efi_st_error("setup: failed to delete stale efi_st_var0, status=%lx\n",
+ (ulong)ret);
return EFI_ST_FAILURE;
}
+ } else if (ret != EFI_NOT_FOUND) {
+ efi_st_error("setup: failed to inspect existing efi_st_var0, status=%lx\n",
+ (ulong)ret);
+ return EFI_ST_FAILURE;
+ }
- /* Make sure that variable contains a valid file */
- hdr = (struct efi_var_file *)data2;
- if (hdr->magic != EFI_VAR_FILE_MAGIC || len != hdr->length ||
- hdr->crc32 != crc32(0,
- (u8 *)((uintptr_t)data2 +
- sizeof(struct efi_var_file)),
- len - sizeof(struct efi_var_file))) {
- efi_st_error("VarToFile invalid header\n");
- return EFI_ST_FAILURE;
- }
+ /* QueryVariableInfo */
+ if (check_runtime_query_variable_info("setup") != EFI_ST_SUCCESS)
+ return EFI_ST_FAILURE;
- /* Variables that are BS, RT and volatile are RO after EBS */
- ret = st_runtime->set_variable(
- u"VarToFile", &efi_rt_var_guid,
- EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS |
- EFI_VARIABLE_NON_VOLATILE,
- sizeof(v), v);
- if (ret != EFI_WRITE_PROTECTED) {
- efi_st_error("Get/SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
- } else {
- if (ret != EFI_UNSUPPORTED) {
- efi_st_error("SetVariable failed\n");
- return EFI_ST_FAILURE;
- }
+ /* Create and delete a volatile runtime variable. */
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS,
+ 3, v + 4);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("setup: failed to create volatile efi_st_var0, status=%lx\n",
+ (ulong)ret);
+ return EFI_ST_FAILURE;
}
- len = EFI_ST_MAX_DATA_SIZE;
- ret = st_runtime->get_variable(u"PlatformLangCodes", &guid_vendor0,
+
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS,
+ 0, NULL);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("setup: failed to delete volatile efi_st_var0, status=%lx\n",
+ (ulong)ret);
+ return EFI_ST_FAILURE;
+ }
+
+ /* Create the non-volatile variable that verify expects after reboot. */
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ sizeof(v) / 2, v);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("setup: failed to create non-volatile efi_st_var0, status=%lx\n",
+ (ulong)ret);
+ return EFI_ST_FAILURE;
+ }
+
+ /* Check variable enumeration while the setup variable is present. */
+ if (check_runtime_variable_enumeration("setup") != EFI_ST_SUCCESS) {
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ 0, NULL);
+ if (ret != EFI_SUCCESS)
+ efi_st_error("setup: enumeration failed and cleanup returned status=%lx\n",
+ (ulong)ret);
+ return EFI_ST_FAILURE;
+ }
+
+ efi_st_printf("Reboot and run 'variables at runtime verify'\n");
+
+ return EFI_ST_SUCCESS;
+}
+
+/**
+ * execute_verify() - Verify the non-volatile runtime-variable test state
+ *
+ * Validate the state created by execute_setup(), append the remaining
+ * payload, confirm the full value, and remove the test variable.
+ *
+ * Return: EFI_ST_SUCCESS on success, EFI_ST_FAILURE on failure
+ */
+static int execute_verify(void)
+{
+ efi_status_t ret;
+ efi_uintn_t len, append_len;
+ u32 attr = 0;
+ u8 v[16] = {0x5d, 0xd1, 0x5e, 0x51, 0x5a, 0x05, 0xc7, 0x0c,
+ 0x35, 0x4a, 0xae, 0x87, 0xa5, 0xdf, 0x0f, 0x65,};
+ u8 data[EFI_ST_MAX_DATA_SIZE];
+
+ /* Validate the non-volatile variable created by setup. */
+ len = sizeof(v) / 2;
+ ret = st_runtime->get_variable(u"efi_st_var0", &guid_vendor0,
&attr, &len, data);
+ if (ret == EFI_NOT_FOUND) {
+ efi_st_error("verify: efi_st_var0 missing, run setup first\n");
+ return EFI_ST_FAILURE;
+ }
if (ret != EFI_SUCCESS) {
- efi_st_error("GetVariable failed\n");
+ efi_st_error("verify: failed to read prepared efi_st_var0, status=%lx\n",
+ (ulong)ret);
return EFI_ST_FAILURE;
}
- memset(&guid, 0, 16);
- *varname = 0;
- len = 2 * EFI_ST_MAX_VARNAME_SIZE;
- ret = st_runtime->get_next_variable_name(&len, varname, &guid);
+ if (len != sizeof(v) / 2) {
+ efi_st_error("verify: unexpected prepared variable size=%lu\n",
+ (ulong)len);
+ return EFI_ST_FAILURE;
+ }
+ if (memcmp(data, v, len)) {
+ efi_st_error("verify: prepared variable contents do not match setup payload\n");
+ return EFI_ST_FAILURE;
+ }
+
+ /* Append the remaining payload. */
+ append_len = sizeof(v) - len;
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_APPEND_WRITE |
+ EFI_VARIABLE_NON_VOLATILE,
+ append_len, v + len);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("verify: failed to append remaining payload, status=%lx\n",
+ (ulong)ret);
+ return EFI_ST_FAILURE;
+ }
+
+ /* Validate the full variable contents after append. */
+ len = sizeof(v);
+ ret = st_runtime->get_variable(u"efi_st_var0", &guid_vendor0,
+ &attr, &len, data);
if (ret != EFI_SUCCESS) {
- efi_st_error("GetNextVariableName failed\n");
+ efi_st_error("verify: failed to read appended efi_st_var0, status=%lx\n",
+ (ulong)ret);
+ return EFI_ST_FAILURE;
+ }
+ if (len != sizeof(v)) {
+ efi_st_error("verify: unexpected appended variable size=%lu\n",
+ (ulong)len);
+ return EFI_ST_FAILURE;
+ }
+ if (memcmp(data, v, len)) {
+ efi_st_error("verify: appended variable contents do not match expected payload\n");
return EFI_ST_FAILURE;
}
+ /* Delete the test variable. */
+ ret = st_runtime->set_variable(u"efi_st_var0", &guid_vendor0,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ EFI_VARIABLE_NON_VOLATILE,
+ 0, NULL);
+ if (ret != EFI_SUCCESS) {
+ efi_st_error("verify: failed to delete efi_st_var0, status=%lx\n",
+ (ulong)ret);
+ return EFI_ST_FAILURE;
+ }
+
+ /* Make sure the variable is no longer present. */
+ len = sizeof(data);
+ ret = st_runtime->get_variable(u"efi_st_var0", &guid_vendor0,
+ &attr, &len, data);
+ if (ret != EFI_NOT_FOUND) {
+ if (ret == EFI_SUCCESS || ret == EFI_BUFFER_TOO_SMALL)
+ efi_st_error("verify: efi_st_var0 still exists after delete\n");
+ else
+ efi_st_error("verify: failed to confirm deletion, status=%lx\n",
+ (ulong)ret);
+ return EFI_ST_FAILURE;
+ }
+
+ efi_st_printf("verify: runtime variable test passed\n");
+
return EFI_ST_SUCCESS;
}
-EFI_UNIT_TEST(variables_run) = {
- .name = "variables at runtime",
+EFI_UNIT_TEST(variables_run_setup) = {
+ .name = "variables at runtime setup",
.phase = EFI_SETUP_BEFORE_BOOTTIME_EXIT,
- .execute = execute,
+ .execute = execute_setup,
+ .on_request = true,
+};
+
+EFI_UNIT_TEST(variables_run_verify) = {
+ .name = "variables at runtime verify",
+ .phase = EFI_SETUP_BEFORE_BOOTTIME_EXIT,
+ .execute = execute_verify,
+ .on_request = true,
};
+#endif
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v3 08/10] test: dm: add sandbox FF-A runtime transport tests
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
` (6 preceding siblings ...)
2026-06-27 14:44 ` [PATCH v3 07/10] efi: selftest: add runtime variable tests with non-volatile storage Harsimran Singh Tungal
@ 2026-06-27 14:44 ` Harsimran Singh Tungal
2026-06-27 14:44 ` [PATCH v3 09/10] doc: arm64: document FF-A runtime path for EFI variables Harsimran Singh Tungal
2026-06-27 14:44 ` [PATCH v3 10/10] doc: bootefi: note two-phase runtime variables selftest Harsimran Singh Tungal
9 siblings, 0 replies; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
Exercise FF-A runtime helpers via sandbox DM tests
Test the successful runtime direct-message round trip and the invalid
destination-partition case, using the shared FF-A prepare step so the
sandbox emulator has initialized partition state before exercising the
runtime-only messaging helpers.
Add a dedicated no-context test that calls
ffa_sync_send_receive_runtime() before enabling the runtime context and
checks that it returns -EPERM. Reset the resident FF-A runtime context
around the transport tests so the runtime flag and private data do not
leak across test cases.
Split the ffa_to_std_errno() checks into a separate DM test so
error-mapping regressions are reported independently from transport
failures. Cover both the valid mappings and the boundary inputs that
must return -EINVAL.
Replace the hard-coded synthetic partition execution-context and
property values in ffa-emul-uclass.c with the shared
SANDBOX_SP*_EXEC_CTXT and SANDBOX_SP*_PROPERTIES macros. This lets the
sandbox emulator and tests reuse a single definition of the synthetic
partition metadata.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
arch/sandbox/include/asm/sandbox_arm_ffa.h | 16 ++-
drivers/firmware/arm-ffa/ffa-emul-uclass.c | 37 +++++--
test/dm/Makefile | 3 +-
test/dm/ffa_runtime.c | 123 +++++++++++++++++++++
4 files changed, 166 insertions(+), 13 deletions(-)
create mode 100644 test/dm/ffa_runtime.c
diff --git a/arch/sandbox/include/asm/sandbox_arm_ffa.h b/arch/sandbox/include/asm/sandbox_arm_ffa.h
index be2790f4960..a20eb159b73 100644
--- a/arch/sandbox/include/asm/sandbox_arm_ffa.h
+++ b/arch/sandbox/include/asm/sandbox_arm_ffa.h
@@ -1,6 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0+ */
/*
- * Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ * Copyright 2022-2023, 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
*
* Authors:
* Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
@@ -26,6 +26,20 @@
#define SANDBOX_SP3_ID 0x6452
#define SANDBOX_SP4_ID 0x7814
+/*
+ * The sandbox FF-A emulator uses fixed, synthetic execution-context counts and
+ * property bitfields for each partition.
+ */
+#define SANDBOX_SP1_EXEC_CTXT 0x5687
+#define SANDBOX_SP2_EXEC_CTXT 0x9587
+#define SANDBOX_SP3_EXEC_CTXT 0x7687
+#define SANDBOX_SP4_EXEC_CTXT 0x1487
+
+#define SANDBOX_SP1_PROPERTIES 0x89325621
+#define SANDBOX_SP2_PROPERTIES 0x45325621
+#define SANDBOX_SP3_PROPERTIES 0x23325621
+#define SANDBOX_SP4_PROPERTIES 0x70325621
+
/* Invalid service UUID (no matching SP) */
#define SANDBOX_SERVICE3_UUID "55d532ed-0942-e699-722d-c09ca798d9cd"
diff --git a/drivers/firmware/arm-ffa/ffa-emul-uclass.c b/drivers/firmware/arm-ffa/ffa-emul-uclass.c
index d270f7b614e..3351d2e2edd 100644
--- a/drivers/firmware/arm-ffa/ffa-emul-uclass.c
+++ b/drivers/firmware/arm-ffa/ffa-emul-uclass.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0+
/*
- * Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ * Copyright 2022-2023, 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
*
* Authors:
* Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
@@ -19,42 +19,57 @@
/* The partitions (SPs) table */
static struct ffa_partition_desc sandbox_partitions[SANDBOX_PARTITIONS_CNT] = {
{
- .info = { .id = SANDBOX_SP1_ID, .exec_ctxt = 0x5687, .properties = 0x89325621 },
+ .info = {
+ .id = SANDBOX_SP1_ID,
+ .exec_ctxt = SANDBOX_SP1_EXEC_CTXT,
+ .properties = SANDBOX_SP1_PROPERTIES,
+ },
.sp_uuid = {
.a1 = SANDBOX_SERVICE1_UUID_A1,
.a2 = SANDBOX_SERVICE1_UUID_A2,
.a3 = SANDBOX_SERVICE1_UUID_A3,
.a4 = SANDBOX_SERVICE1_UUID_A4,
- }
+ },
},
{
- .info = { .id = SANDBOX_SP3_ID, .exec_ctxt = 0x7687, .properties = 0x23325621 },
+ .info = {
+ .id = SANDBOX_SP3_ID,
+ .exec_ctxt = SANDBOX_SP3_EXEC_CTXT,
+ .properties = SANDBOX_SP3_PROPERTIES,
+ },
.sp_uuid = {
.a1 = SANDBOX_SERVICE2_UUID_A1,
.a2 = SANDBOX_SERVICE2_UUID_A2,
.a3 = SANDBOX_SERVICE2_UUID_A3,
.a4 = SANDBOX_SERVICE2_UUID_A4,
- }
+ },
},
{
- .info = { .id = SANDBOX_SP2_ID, .exec_ctxt = 0x9587, .properties = 0x45325621 },
+ .info = {
+ .id = SANDBOX_SP2_ID,
+ .exec_ctxt = SANDBOX_SP2_EXEC_CTXT,
+ .properties = SANDBOX_SP2_PROPERTIES,
+ },
.sp_uuid = {
.a1 = SANDBOX_SERVICE1_UUID_A1,
.a2 = SANDBOX_SERVICE1_UUID_A2,
.a3 = SANDBOX_SERVICE1_UUID_A3,
.a4 = SANDBOX_SERVICE1_UUID_A4,
- }
+ },
},
{
- .info = { .id = SANDBOX_SP4_ID, .exec_ctxt = 0x1487, .properties = 0x70325621 },
+ .info = {
+ .id = SANDBOX_SP4_ID,
+ .exec_ctxt = SANDBOX_SP4_EXEC_CTXT,
+ .properties = SANDBOX_SP4_PROPERTIES,
+ },
.sp_uuid = {
.a1 = SANDBOX_SERVICE2_UUID_A1,
.a2 = SANDBOX_SERVICE2_UUID_A2,
.a3 = SANDBOX_SERVICE2_UUID_A3,
.a4 = SANDBOX_SERVICE2_UUID_A4,
- }
- }
-
+ },
+ },
};
/* The emulator functions */
diff --git a/test/dm/Makefile b/test/dm/Makefile
index 0e3c63568dd..102b1e98284 100644
--- a/test/dm/Makefile
+++ b/test/dm/Makefile
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0+
#
# Copyright (c) 2013 Google, Inc
-# Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
+# Copyright 2022-2023, 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
# Tests for particular subsystems - when enabling driver model for a new
# subsystem you must add sandbox tests here.
@@ -98,6 +98,7 @@ obj-$(CONFIG_ACPI_PMC) += pmc.o
obj-$(CONFIG_DM_PMIC) += pmic.o
obj-$(CONFIG_DM_PWM) += pwm.o
obj-$(CONFIG_ARM_FFA_TRANSPORT) += ffa.o
+obj-$(CONFIG_ARM_FFA_TRANSPORT) += ffa_runtime.o
obj-$(CONFIG_QFW) += qfw.o
obj-$(CONFIG_RAM) += ram.o
obj-y += regmap.o
diff --git a/test/dm/ffa_runtime.c b/test/dm/ffa_runtime.c
new file mode 100644
index 00000000000..3820628f86b
--- /dev/null
+++ b/test/dm/ffa_runtime.c
@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Functional tests for FF-A runtime helpers
+ *
+ * Copyright 2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
+ *
+ * Authors:
+ * Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
+ */
+
+#include <dm.h>
+#include <dm/test.h>
+#include <asm/sandbox_arm_ffa.h>
+#include <asm/sandbox_arm_ffa_priv.h>
+#include <arm_ffa_runtime.h>
+#include <test/ut.h>
+
+static int ffa_runtime_prepare(struct unit_test_state *uts, u16 *sp_id)
+{
+ struct ffa_partition_desc *descs;
+ u32 count;
+ struct udevice *dev;
+ const char *svc_uuid = SANDBOX_SERVICE1_UUID;
+
+ ut_assertok(uclass_first_device_err(UCLASS_FFA, &dev));
+ ut_assertok(ffa_partition_info_get(dev, svc_uuid, &count, &descs));
+ ut_assert(count > 0);
+
+ if (sp_id)
+ *sp_id = descs[0].info.id;
+
+ return 0;
+}
+
+static void ffa_runtime_teardown(void)
+{
+ ffa_runtime_context_reset();
+}
+
+static int ffa_runtime_setup(struct unit_test_state *uts, u16 *sp_id)
+{
+ ffa_runtime_teardown();
+ ut_assert(!ffa_runtime_context_ready());
+ ut_assertok(ffa_runtime_prepare(uts, sp_id));
+
+ ffa_copy_runtime_priv(&(struct ffa_priv_runtime){
+ .id = NS_PHYS_ENDPOINT_ID,
+ });
+ ffa_runtime_context_enable();
+
+ /* Ensure runtime context is available before attempting runtime-only paths */
+ ut_assert(ffa_runtime_context_ready());
+
+ return 0;
+}
+
+static int dm_test_ffa_runtime_no_context(struct unit_test_state *uts)
+{
+ struct ffa_send_direct_data msg = {0};
+ u16 sp_id;
+
+ ffa_runtime_teardown();
+ ut_assert(!ffa_runtime_context_ready());
+
+ ut_assertok(ffa_runtime_prepare(uts, &sp_id));
+
+ /* Runtime messaging must fail until the runtime context is enabled */
+ ut_asserteq(-EPERM, ffa_sync_send_receive_runtime(sp_id, &msg, true));
+
+ ffa_runtime_teardown();
+ return 0;
+}
+
+DM_TEST(dm_test_ffa_runtime_no_context, UTF_SCAN_FDT | UTF_CONSOLE);
+
+static int dm_test_ffa_to_std_errno(struct unit_test_state *uts)
+{
+ ut_asserteq(-EINVAL, ffa_to_std_errno(0));
+ ut_asserteq(-EINVAL, ffa_to_std_errno(MAX_NUMBER_FFA_ERR));
+ ut_asserteq(-EINVAL, ffa_to_std_errno(-MAX_NUMBER_FFA_ERR));
+ ut_asserteq(-EINVAL, ffa_to_std_errno(-(MAX_NUMBER_FFA_ERR + 1)));
+
+ ut_asserteq(-EINVAL, ffa_to_std_errno(-INVALID_PARAMETERS));
+ ut_asserteq(-EOPNOTSUPP, ffa_to_std_errno(-NOT_SUPPORTED));
+
+ return 0;
+}
+
+DM_TEST(dm_test_ffa_to_std_errno, UTF_SCAN_FDT | UTF_CONSOLE);
+
+static int dm_test_ffa_runtime_ack(struct unit_test_state *uts)
+{
+ struct ffa_send_direct_data msg = {0};
+ u16 sp_id;
+ u8 cnt;
+
+ ut_assertok(ffa_runtime_setup(uts, &sp_id));
+
+ /* Runtime messaging should reuse the sandbox emulator and return 0xff pattern */
+ ut_assertok(ffa_sync_send_receive_runtime(sp_id, &msg, true));
+ for (cnt = 0; cnt < sizeof(struct ffa_send_direct_data) / sizeof(u64); cnt++)
+ ut_asserteq_64(-1UL, ((u64 *)&msg)[cnt]);
+
+ ffa_runtime_teardown();
+ return 0;
+}
+
+DM_TEST(dm_test_ffa_runtime_ack, UTF_SCAN_FDT | UTF_CONSOLE);
+
+static int dm_test_ffa_runtime_nack(struct unit_test_state *uts)
+{
+ struct ffa_send_direct_data msg = {0};
+
+ ut_assertok(ffa_runtime_setup(uts, NULL));
+
+ /* Invalid partition IDs must be rejected and mapped to -EINVAL */
+ ut_asserteq(-EINVAL, ffa_sync_send_receive_runtime(0xffff, &msg, true));
+
+ ffa_runtime_teardown();
+ return 0;
+}
+
+DM_TEST(dm_test_ffa_runtime_nack, UTF_SCAN_FDT | UTF_CONSOLE);
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v3 09/10] doc: arm64: document FF-A runtime path for EFI variables
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
` (7 preceding siblings ...)
2026-06-27 14:44 ` [PATCH v3 08/10] test: dm: add sandbox FF-A runtime transport tests Harsimran Singh Tungal
@ 2026-06-27 14:44 ` Harsimran Singh Tungal
2026-06-29 18:15 ` Abdellatif El Khlifi
2026-06-27 14:44 ` [PATCH v3 10/10] doc: bootefi: note two-phase runtime variables selftest Harsimran Singh Tungal
9 siblings, 1 reply; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
The arm64 FF-A documentation still said EFI runtime support was a
future development, so readers had no description of the current FF-A
runtime transport or how EFI runtime variable services use it.
Document the FF-A runtime transport, the shared MM communication path,
and the EFI runtime variable flow on arm64. Also clarify that the
armffa command is boot-time only and point readers to the architecture
documentation for EFI runtime variable services over FF-A.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
doc/arch/arm64.ffa.rst | 88 ++++++++++++++++++++++++++++++++++++----
doc/usage/cmd/armffa.rst | 11 +++++
2 files changed, 92 insertions(+), 7 deletions(-)
diff --git a/doc/arch/arm64.ffa.rst b/doc/arch/arm64.ffa.rst
index f966f8ba6af..145bb70abce 100644
--- a/doc/arch/arm64.ffa.rst
+++ b/doc/arch/arm64.ffa.rst
@@ -15,10 +15,10 @@ application in S-EL0, or a Trusted OS in S-EL1.
The U-Boot FF-A support (the bus) implements the interfaces to communicate
with partitions in the Secure world aka Secure partitions (SPs).
-The FF-A support specifically focuses on communicating with SPs that
-isolate portions of EFI runtime services that must run in a protected
-environment which is inaccessible by the Host OS or Hypervisor.
-Examples of such services are set/get variables.
+U-Boot's FF-A bus support exposes an optional transport that EFI runtime
+services can use to communicate with Secure partitions. Through this
+interface, EFI services (such as variable access) can request or exchange
+data with the Secure world using FF-A.
The FF-A support uses the SMC ABIs defined by the FF-A specification to:
@@ -26,13 +26,13 @@ The FF-A support uses the SMC ABIs defined by the FF-A specification to:
- Access an SP's service through communication protocols
e.g. EFI MM communication protocol
-At this stage of development only EFI boot-time services are supported.
-Runtime support will be added in future developments.
-
The U-Boot FF-A support provides the following parts:
- A Uclass driver providing generic FF-A methods.
- An Arm FF-A device driver providing Arm-specific methods and reusing the Uclass methods.
+- An optional runtime FF-A transport (toggled via CONFIG_ARM_FFA_RT_MODE) that is
+ resident after ExitBootServices() and enables EFI runtime variable services
+ via FF-A helpers and a shared MM communication buffer.
- A sandbox emulator for Arm FF-A, emulates the FF-A side of the Secure World and provides
FF-A ABIs inspection methods.
- An FF-A sandbox device driver for FF-A communication with the emulated Secure World.
@@ -69,6 +69,12 @@ CONFIG_ARM_FFA_TRANSPORT
When using an Arm 64-bit platform, the Arm FF-A driver will be used.
When using sandbox, the sandbox FF-A emulator and FF-A sandbox driver will be used.
+CONFIG_ARM_FFA_RT_MODE
+ Enables the FF-A runtime transport. This option depends on
+ CONFIG_ARM_FFA_TRANSPORT and CONFIG_EFI_LOADER, and is enabled by default.
+ When enabled, a minimal set of FF-A operations remains available after
+ ExitBootServices().
+
FF-A ABIs under the hood
------------------------
@@ -158,6 +164,73 @@ they want to use (32-bit vs 64-bit). Selecting the protocol means using
the 32-bit or 64-bit version of FFA_MSG_SEND_DIRECT_{REQ, RESP}.
The calling convention between U-Boot and the secure world stays the same: SMC32.
+FF-A runtime support for EFI variables
+--------------------------------------
+
+U-Boot provides an FF-A runtime transport to keep a minimal set of FF-A operations
+available after ExitBootServices(). This runtime transport is enabled with
+CONFIG_ARM_FFA_RT_MODE. The runtime helpers and data are marked with
+``__efi_runtime`` / ``__efi_runtime_data`` through the
+``__ffa_runtime`` / ``__ffa_runtime_data`` aliases in
+``include/arm_ffa_runtime.h``.
+
+Runtime context is enabled at ExitBootServices(), and the following prerequisites
+are prepared during FF-A bus probe:
+
+- The U-Boot FF-A endpoint ID is discovered at boot time with FFA_ID_GET and
+ stored in the runtime private data.
+- An ExitBootServices() event is registered by the FF-A runtime transport so
+ the resident runtime context is enabled when EFI transitions to runtime.
+
+At runtime, the driver model is no longer available. Runtime users should
+use the helpers exported by ``include/arm_ffa_runtime.h``. In particular,
+``ffa_runtime_context_ready()`` verifies that the resident runtime context
+is available and ``ffa_sync_send_receive_runtime()`` issues direct FF-A
+messages after ExitBootServices().
+
+EFI variable services over FF-A
+-------------------------------
+
+When CONFIG_EFI_MM_COMM_TEE and CONFIG_ARM_FFA_TRANSPORT are enabled, U-Boot
+routes EFI variable services to an MM Secure Partition (SP) over FF-A.
+The MM SP is discovered at boot time using FFA_PARTITION_INFO_GET and its
+partition ID is cached in runtime data.
+
+The data path uses a shared MM communication buffer and a door-bell style
+direct message:
+
+- The communication buffer is located at CONFIG_FFA_SHARED_MM_BUF_ADDR and
+ sized by CONFIG_FFA_SHARED_MM_BUF_SIZE.
+- CONFIG_FFA_SHARED_MM_BUF_OFFSET is sent in the FF-A direct message payload
+ to indicate where the data begins.
+
+After ExitBootServices(), EFI SetVariable()/GetVariable() call paths use the
+runtime MM communication path:
+
+- A pre-reserved shared buffer is used for the MM communication payload.
+- The cached MM SP partition ID and FF-A runtime transport are used to
+ dispatch direct FF-A messages to the Secure world after
+ ExitBootServices().
+
+Configuration notes
+-------------------
+
+Enable FF-A transport and MM communication:
+
+- CONFIG_ARM_FFA_TRANSPORT
+- CONFIG_ARM_FFA_RT_MODE
+- CONFIG_EFI_MM_COMM_TEE
+
+CONFIG_ARM_FFA_RT_MODE is enabled by default. It turns on MM communication for
+EFI runtime and may be disabled when EFI services over FF-A are not required
+after ExitBootServices().
+
+Configure the shared MM communication buffer:
+
+- CONFIG_FFA_SHARED_MM_BUF_ADDR
+- CONFIG_FFA_SHARED_MM_BUF_SIZE
+- CONFIG_FFA_SHARED_MM_BUF_OFFSET
+
Requirements for user drivers
-----------------------------
@@ -256,6 +329,7 @@ For example, when using FF-A with Corstone-1000, debug logs enabled, the output
Contributors
------------
* Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
+ * Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
.. _`FF-A v1.0 specification`: https://documentation-service.arm.com/static/5fb7e8a6ca04df4095c1d65e
.. _`SMC Calling Convention v1.2 specification`: https://documentation-service.arm.com/static/5f8edaeff86e16515cdbe4c6
diff --git a/doc/usage/cmd/armffa.rst b/doc/usage/cmd/armffa.rst
index dbe4d5bc842..64571d615cb 100644
--- a/doc/usage/cmd/armffa.rst
+++ b/doc/usage/cmd/armffa.rst
@@ -39,6 +39,17 @@ The command also allows to gather secure partitions information and ping these
The command is also helpful in testing the communication with secure partitions.
+Notes
+-----
+
+armffa is a boot-time test command. It relies on the FF-A driver model device
+(UCLASS_FFA) and is not part of the resident FF-A runtime transport used after
+ExitBootServices().
+
+armffa does not provide EFI variable operations. For more information about
+the FF-A runtime transport and EFI runtime variable services over FF-A please see
+:doc:`../../arch/arm64.ffa`.
+
Example
-------
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v3 10/10] doc: bootefi: note two-phase runtime variables selftest
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
` (8 preceding siblings ...)
2026-06-27 14:44 ` [PATCH v3 09/10] doc: arm64: document FF-A runtime path for EFI variables Harsimran Singh Tungal
@ 2026-06-27 14:44 ` Harsimran Singh Tungal
9 siblings, 0 replies; 22+ messages in thread
From: Harsimran Singh Tungal @ 2026-06-27 14:44 UTC (permalink / raw)
To: u-boot
Cc: Abdellatif El Khlifi, Tom Rini, Ilias Apalodimas,
Heinrich Schuchardt, Hugues Kamba Mpiana, Simon Glass,
Harsimran Singh Tungal
The bootefi documentation did not describe how to run the
runtime-variable selftest, so users had no guidance on its reboot
requirements or on which flow applies to their configuration.
Document the runtime-variable selftest flow in bootefi.rst. Describe
the non-volatile path, note the single-run
CONFIG_EFI_RT_VOLATILE_STORE=y case, and show how to select the
runtime-variable selftest with efi_selftest.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
doc/usage/cmd/bootefi.rst | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/doc/usage/cmd/bootefi.rst b/doc/usage/cmd/bootefi.rst
index 7c5448586b7..0a7800b93ce 100644
--- a/doc/usage/cmd/bootefi.rst
+++ b/doc/usage/cmd/bootefi.rst
@@ -160,6 +160,37 @@ environment variable to match one of the listed identifiers
Some of the tests execute the ExitBootServices() UEFI boot service and will not
return to the command line but require a board reset.
+When CONFIG_EFI_RT_VOLATILE_STORE is enabled, the test
+*variables at runtime* completes within one *bootefi selftest* run, so
+it does not depend on preserving state across multiple runs. It still
+executes ExitBootServices(), so a board reset is required afterwards
+before returning to the command line.
+
+::
+
+ => setenv efi_selftest 'variables at runtime'
+ => bootefi selftest
+
+When CONFIG_EFI_RT_VOLATILE_STORE is not enabled, the runtime-variable
+flow is split into *variables at runtime setup* and
+*variables at runtime verify*. Run the setup test once to create the
+runtime-accessible variable in non-volatile storage, reboot, then run
+the verify test to validate, append, and delete that variable.
+Both phases are on-request tests, so they only run when selected by
+``efi_selftest``.
+
+::
+
+ => setenv efi_selftest 'variables at runtime setup'
+ => bootefi selftest
+
+After reboot:
+
+::
+
+ => setenv efi_selftest 'variables at runtime verify'
+ => bootefi selftest
+
Configuration
-------------
--
2.34.1
^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [PATCH v3 05/10] charset: mark u16_strsize() as __efi_runtime
2026-06-27 14:44 ` [PATCH v3 05/10] charset: mark u16_strsize() as __efi_runtime Harsimran Singh Tungal
@ 2026-06-27 18:50 ` Ilias Apalodimas
2026-06-29 18:28 ` Abdellatif El Khlifi
1 sibling, 0 replies; 22+ messages in thread
From: Ilias Apalodimas @ 2026-06-27 18:50 UTC (permalink / raw)
To: Harsimran Singh Tungal
Cc: u-boot, Abdellatif El Khlifi, Tom Rini, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
On Sat, 27 Jun 2026 at 17:44, Harsimran Singh Tungal
<harsimransingh.tungal@arm.com> wrote:
>
> Mark u16_strsize() as __efi_runtime so it can be called from the EFI
> runtime variable paths added for FF-A/MM communication after
> ExitBootServices().
>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
> ---
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> lib/charset.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/charset.c b/lib/charset.c
> index 182c92a50c4..738ad1352de 100644
> --- a/lib/charset.c
> +++ b/lib/charset.c
> @@ -407,7 +407,7 @@ size_t __efi_runtime u16_strnlen(const u16 *in, size_t count)
> return i;
> }
>
> -size_t u16_strsize(const void *in)
> +size_t __efi_runtime u16_strsize(const void *in)
> {
> return (u16_strlen(in) + 1) * sizeof(u16);
> }
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3 02/10] arm-ffa: add FF-A bus runtime support
2026-06-27 14:44 ` [PATCH v3 02/10] arm-ffa: add FF-A bus runtime support Harsimran Singh Tungal
@ 2026-06-29 18:12 ` Abdellatif El Khlifi
2026-07-01 12:59 ` Ilias Apalodimas
2026-07-01 13:59 ` Ilias Apalodimas
2 siblings, 0 replies; 22+ messages in thread
From: Abdellatif El Khlifi @ 2026-06-29 18:12 UTC (permalink / raw)
To: Harsimran Singh Tungal, Tom Rini
Cc: u-boot, Ilias Apalodimas, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
On Sat, Jun 27, 2026 at 03:44:13PM +0100, Harsimran Singh Tungal wrote:
> Add the FF-A runtime infrastructure needed after ExitBootServices() so
> EFI runtime services can continue to use the FF-A transport layer.
> Introduce drivers/firmware/arm-ffa/arm-ffa-runtime.c and
> include/arm_ffa_runtime.h with runtime-resident FF-A helpers for
> direct messaging, SMC invocation, and error translation. Add the
> sandbox runtime SMC wrapper, the ARM_FFA_RT_MODE Kconfig option, and
> the ExitBootServices hook that copies the required FF-A runtime data
> into resident storage before enabling the runtime context.
>
> Tag the runtime code and data with __efi_runtime and
> __efi_runtime_data so they remain available after
> ExitBootServices().
>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
>
> ----
> Changelog:
> ===============
>
> v3:
>
> Simon:
>
> - Move ExitBootServices event registration to the end of probe
> - Use an early-return guard and log missing-context with log_warning()
> - Rename the runtime-context helpers to the ffa_runtime_context_* form
> - Drop the unrelated whitespace-only hunk
> - Fix commit message styling
>
> v2:
>
> Simon:
>
> - Leave runtime mode disabled if private data is missing
> and update the log message
> - Remove unused global-data plumbing
> - Switch to `IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)`
> - Fix style issues
> - Register the ExitBootServices event earlier in probe
> - Keep the runtime-enabled flag separate from copied boot time data
>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Acked-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3 09/10] doc: arm64: document FF-A runtime path for EFI variables
2026-06-27 14:44 ` [PATCH v3 09/10] doc: arm64: document FF-A runtime path for EFI variables Harsimran Singh Tungal
@ 2026-06-29 18:15 ` Abdellatif El Khlifi
0 siblings, 0 replies; 22+ messages in thread
From: Abdellatif El Khlifi @ 2026-06-29 18:15 UTC (permalink / raw)
To: Harsimran Singh Tungal, Tom Rini
Cc: u-boot, Ilias Apalodimas, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
On Sat, Jun 27, 2026 at 03:44:20PM +0100, Harsimran Singh Tungal wrote:
> The arm64 FF-A documentation still said EFI runtime support was a
> future development, so readers had no description of the current FF-A
> runtime transport or how EFI runtime variable services use it.
>
> Document the FF-A runtime transport, the shared MM communication path,
> and the EFI runtime variable flow on arm64. Also clarify that the
> armffa command is boot-time only and point readers to the architecture
> documentation for EFI runtime variable services over FF-A.
>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Acked-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3 01/10] efi_loader: add runtime memset helper
2026-06-27 14:44 ` [PATCH v3 01/10] efi_loader: add runtime memset helper Harsimran Singh Tungal
@ 2026-06-29 18:21 ` Abdellatif El Khlifi
0 siblings, 0 replies; 22+ messages in thread
From: Abdellatif El Khlifi @ 2026-06-29 18:21 UTC (permalink / raw)
To: Harsimran Singh Tungal
Cc: u-boot, Tom Rini, Ilias Apalodimas, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
On Sat, Jun 27, 2026 at 03:44:12PM +0100, Harsimran Singh Tungal wrote:
> Add efi_memset_runtime() for EFI runtime paths
>
> This keeps buffer initialization in runtime-resident code after
> ExitBootServices() and avoids relying on non-runtime helpers.
>
> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
> ---
> include/efi_loader.h | 3 +++
> lib/efi_loader/efi_runtime.c | 20 ++++++++++++++++++++
> 2 files changed, 23 insertions(+)
>
> diff --git a/include/efi_loader.h b/include/efi_loader.h
> index 3a4d502631c..9dfea1fd7de 100644
> --- a/include/efi_loader.h
> +++ b/include/efi_loader.h
> @@ -1151,6 +1151,9 @@ void efi_memcpy_runtime(void *dest, const void *src, size_t n);
> /* runtime implementation of memcmp() */
> int efi_memcmp_runtime(const void *s1, const void *s2, size_t n);
>
> +/* runtime implementation of memset() */
> +void *efi_memset_runtime(void *dest, int c, size_t n);
> +
> /* commonly used helper functions */
> u16 *efi_create_indexed_name(u16 *buffer, size_t buffer_size, const char *name,
> unsigned int index);
> diff --git a/lib/efi_loader/efi_runtime.c b/lib/efi_loader/efi_runtime.c
> index 73d4097464c..c0182931c42 100644
> --- a/lib/efi_loader/efi_runtime.c
> +++ b/lib/efi_loader/efi_runtime.c
> @@ -233,6 +233,26 @@ int __efi_runtime efi_memcmp_runtime(const void *s1, const void *s2, size_t n)
> return 0;
> }
>
> +/**
> + * efi_memset_runtime() - fill memory area
> + *
> + * At runtime memset() is not available.
> + *
> + * @dest: destination buffer
> + * @c: byte value used to fill destination buffer
> + * @n: number of bytes to set
> + * Return: pointer to destination buffer
> + */
> +__efi_runtime void *efi_memset_runtime(void *dest, int c, size_t n)
> +{
> + u8 *d = dest;
> +
> + for (; n; --n)
> + *d++ = (u8)c;
> +
> + return dest;
> +}
> +
> /**
> * efi_update_table_header_crc32() - Update crc32 in table header
> *
> --
> 2.34.1
>
Reviewed-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3 05/10] charset: mark u16_strsize() as __efi_runtime
2026-06-27 14:44 ` [PATCH v3 05/10] charset: mark u16_strsize() as __efi_runtime Harsimran Singh Tungal
2026-06-27 18:50 ` Ilias Apalodimas
@ 2026-06-29 18:28 ` Abdellatif El Khlifi
1 sibling, 0 replies; 22+ messages in thread
From: Abdellatif El Khlifi @ 2026-06-29 18:28 UTC (permalink / raw)
To: Harsimran Singh Tungal
Cc: u-boot, Tom Rini, Ilias Apalodimas, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
Hi Harsimran,
On Sat, Jun 27, 2026 at 03:44:16PM +0100, Harsimran Singh Tungal wrote:
> Mark u16_strsize() as __efi_runtime so it can be called from the EFI
> runtime variable paths added for FF-A/MM communication after
> ExitBootServices().
>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
> ---
> lib/charset.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/charset.c b/lib/charset.c
> index 182c92a50c4..738ad1352de 100644
> --- a/lib/charset.c
> +++ b/lib/charset.c
> @@ -407,7 +407,7 @@ size_t __efi_runtime u16_strnlen(const u16 *in, size_t count)
> return i;
> }
>
> -size_t u16_strsize(const void *in)
> +size_t __efi_runtime u16_strsize(const void *in)
> {
> return (u16_strlen(in) + 1) * sizeof(u16);
> }
> --
> 2.34.1
>
Reviewed-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Kind regards
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3 03/10] efi_loader: add FF-A runtime support in EFI variable TEE driver
2026-06-27 14:44 ` [PATCH v3 03/10] efi_loader: add FF-A runtime support in EFI variable TEE driver Harsimran Singh Tungal
@ 2026-06-29 18:40 ` Abdellatif El Khlifi
2026-07-01 13:56 ` Ilias Apalodimas
1 sibling, 0 replies; 22+ messages in thread
From: Abdellatif El Khlifi @ 2026-06-29 18:40 UTC (permalink / raw)
To: Harsimran Singh Tungal
Cc: u-boot, Tom Rini, Ilias Apalodimas, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
Hi Harsimran,
On Sat, Jun 27, 2026 at 03:44:14PM +0100, Harsimran Singh Tungal wrote:
> Enable MM variable services over FF-A after ExitBootServices
>
> Extend lib/efi_loader/efi_variable_tee.c to support FF-A
> communication with the secure world during EFI runtime. Reuse the
> statically reserved FF-A shared buffer after ExitBootServices(),
> make the MM communication path runtime-safe so runtime variable
> operations continue to reach the secure partition.
>
> Share the MM communication and MM SP notification helpers between the
> boot and runtime paths instead of maintaining separate runtime-only
> variants. Select dynamic allocation during boot and the fixed FF-A
> shared buffer at runtime, and reject requests that would exceed the
> shared buffer size.
>
> Mark the required code and data with __efi_runtime and
> __efi_runtime_data, use range-based cache maintenance on the shared
> buffer for the runtime FF-A path, and add the shared buffer to the EFI
> runtime memory map. Document the FF-A shared MM buffer
> cacheline-alignment requirement in Kconfig and add BUILD_BUG_ON()
> checks in ffa_mm_communicate() for the FF-A shared buffer alignment
> used by the arm64 cache-maintenance path.
>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
> ---
> arch/arm/cpu/armv8/cache.S | 8 +
> arch/arm/cpu/armv8/cache_v8.c | 13 +-
> lib/efi_loader/Kconfig | 4 +
> lib/efi_loader/efi_variable_tee.c | 382 ++++++++++++++++++++++--------
> 4 files changed, 306 insertions(+), 101 deletions(-)
>
> diff --git a/arch/arm/cpu/armv8/cache.S b/arch/arm/cpu/armv8/cache.S
> index c9e46859b4f..916558fe477 100644
> --- a/arch/arm/cpu/armv8/cache.S
> +++ b/arch/arm/cpu/armv8/cache.S
> @@ -169,7 +169,11 @@ ENDPROC(__asm_flush_l3_dcache)
> * x0: start address
> * x1: end address
> */
> +#ifdef CONFIG_EFI_LOADER
> +.pushsection .text.efi_runtime.__asm_flush_dcache_range, "ax"
> +#else
> .pushsection .text.__asm_flush_dcache_range, "ax"
> +#endif
> ENTRY(__asm_flush_dcache_range)
> mrs x3, ctr_el0
> ubfx x3, x3, #16, #4
> @@ -195,7 +199,11 @@ ENDPROC(__asm_flush_dcache_range)
> * x0: start address
> * x1: end address
> */
> +#ifdef CONFIG_EFI_LOADER
> +.pushsection .text.efi_runtime.__asm_invalidate_dcache_range, "ax"
> +#else
> .pushsection .text.__asm_invalidate_dcache_range, "ax"
> +#endif
> ENTRY(__asm_invalidate_dcache_range)
> mrs x3, ctr_el0
> ubfx x3, x3, #16, #4
> diff --git a/arch/arm/cpu/armv8/cache_v8.c b/arch/arm/cpu/armv8/cache_v8.c
> index 7c0e3f6d055..d150da4778e 100644
> --- a/arch/arm/cpu/armv8/cache_v8.c
> +++ b/arch/arm/cpu/armv8/cache_v8.c
> @@ -8,6 +8,7 @@
> */
>
> #include <cpu_func.h>
> +#include <efi_loader.h>
> #include <hang.h>
> #include <log.h>
> #include <asm/cache.h>
> @@ -855,7 +856,8 @@ inline void flush_dcache_all(void)
> /*
> * Invalidates range in all levels of D-cache/unified cache
> */
> -void invalidate_dcache_range(unsigned long start, unsigned long stop)
> +void __efi_runtime invalidate_dcache_range(unsigned long start,
> + unsigned long stop)
> {
> __asm_invalidate_dcache_range(start, stop);
> }
> @@ -863,16 +865,19 @@ void invalidate_dcache_range(unsigned long start, unsigned long stop)
> /*
> * Flush range(clean & invalidate) from all levels of D-cache/unified cache
> */
> -void flush_dcache_range(unsigned long start, unsigned long stop)
> +void __efi_runtime flush_dcache_range(unsigned long start,
> + unsigned long stop)
> {
> __asm_flush_dcache_range(start, stop);
> }
> #else
> -void invalidate_dcache_range(unsigned long start, unsigned long stop)
> +void __efi_runtime invalidate_dcache_range(unsigned long start,
> + unsigned long stop)
> {
> }
>
> -void flush_dcache_range(unsigned long start, unsigned long stop)
> +void __efi_runtime flush_dcache_range(unsigned long start,
> + unsigned long stop)
> {
> }
> #endif /* CONFIG_SYS_DISABLE_DCACHE_OPS */
> diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
> index 4cb13ae7c8a..a9791b8f2e3 100644
> --- a/lib/efi_loader/Kconfig
> +++ b/lib/efi_loader/Kconfig
> @@ -195,6 +195,8 @@ config FFA_SHARED_MM_BUF_SIZE
> the MM SP in secure world.
> The size of the memory region must be a multiple of the size of the maximum
> translation granule size that is specified in the ID_AA64MMFR0_EL1 System register.
> + For arm64 FF-A cache maintenance, this size must also be aligned to
> + CONFIG_SYS_CACHELINE_SIZE.
> It is assumed that the MM SP knows the size of the shared MM communication buffer.
>
> config FFA_SHARED_MM_BUF_OFFSET
> @@ -211,6 +213,8 @@ config FFA_SHARED_MM_BUF_ADDR
> This defines the address of the shared MM communication buffer
> used for communication between the MM feature in U-Boot and
> the MM SP in secure world.
> + For arm64 FF-A cache maintenance, this address must also be aligned to
> + CONFIG_SYS_CACHELINE_SIZE.
> It is assumed that the MM SP knows the address of the shared MM communication buffer.
>
> config EFI_VARIABLE_SF_OFFSET
> diff --git a/lib/efi_loader/efi_variable_tee.c b/lib/efi_loader/efi_variable_tee.c
> index 6a1fa39bb6f..fe205bdf966 100644
> --- a/lib/efi_loader/efi_variable_tee.c
> +++ b/lib/efi_loader/efi_variable_tee.c
> @@ -4,7 +4,7 @@
> *
> * Copyright (C) 2019 Linaro Ltd. <sughosh.ganu@linaro.org>
> * Copyright (C) 2019 Linaro Ltd. <ilias.apalodimas@linaro.org>
> - * Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
> + * Copyright 2022-2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
> *
> * Authors:
> * Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
> @@ -14,6 +14,7 @@
>
> #if CONFIG_IS_ENABLED(ARM_FFA_TRANSPORT)
> #include <arm_ffa.h>
> +#include <arm_ffa_runtime.h>
> #endif
> #include <cpu_func.h>
> #include <dm.h>
> @@ -21,6 +22,8 @@
> #include <efi_api.h>
> #include <efi_loader.h>
> #include <efi_variable.h>
> +#include <linux/build_bug.h>
> +#include <linux/kernel.h>
> #include <malloc.h>
> #include <mapmem.h>
> #include <mm_communication.h>
> @@ -34,20 +37,49 @@
> #define MM_DENIED (-3)
> #define MM_NO_MEMORY (-5)
>
> +/*
> + * MM_* return codes are negative. Use -MM_* as sparse positive indices so
> + * ffa_map_sp_event() can look up mm_sp_errmap[-sp_event_ret]. Unassigned
> + * slots remain 0 and are treated as unmapped MM return codes.
> + */
> +static const int __efi_runtime_rodata mm_sp_errmap[] = {
> + [-MM_NOT_SUPPORTED] = -EINVAL,
> + [-MM_INVALID_PARAMETER] = -EPERM,
> + [-MM_DENIED] = -EACCES,
> + [-MM_NO_MEMORY] = -EBUSY,
> +};
> +
> static const char *mm_sp_svc_uuid = MM_SP_UUID;
> -static u16 mm_sp_id;
> +static u16 __efi_runtime_data mm_sp_id;
> #endif
>
> +static void *__efi_runtime_data ffa_shared_buf;
> extern struct efi_var_file __efi_runtime_data *efi_var_buf;
> -static efi_uintn_t max_buffer_size; /* comm + var + func + data */
> -static efi_uintn_t max_payload_size; /* func + data */
> +static efi_uintn_t __efi_runtime_data max_buffer_size; /* comm + var + func + data */
> +static efi_uintn_t __efi_runtime_data max_payload_size; /* func + data */
> static const u16 __efi_runtime_rodata pk[] = u"PK";
> +static bool __efi_runtime_data ebs_called;
>
> struct mm_connection {
> struct udevice *tee;
> u32 session;
> };
>
> +/**
> + * efi_at_runtime() - Indicate whether the system is in the UEFI runtime phase
> + *
> + * This helper returns whether the firmware has transitioned into the
> + * UEFI runtime phase, meaning that ExitBootServices() has been invoked.
> + *
> + * Return:
> + * true - The system is operating in UEFI runtime mode.
> + * false - The system is still in the boot services phase.
> + */
> +static bool __efi_runtime efi_at_runtime(void)
> +{
> + return ebs_called;
> +}
> +
> /**
> * get_connection() - Retrieve OP-TEE session for a specific UUID.
> *
> @@ -169,6 +201,28 @@ static efi_status_t optee_mm_communicate(void *comm_buf, ulong dsize)
> }
>
> #if CONFIG_IS_ENABLED(ARM_FFA_TRANSPORT)
> +/**
> + * ffa_map_sp_event() - Map MM SP response to errno
> + * @sp_event_ret: MM SP return code from MM SP notification
> + *
> + * Convert the MM SP return code into a standard U-Boot errno. This helper
> + * is marked __efi_runtime so it can be shared by both the boot and runtime
> + * FF-A notification paths.
> + *
> + * Return: 0 on success, negative errno on failure
> + */
> +static int __efi_runtime ffa_map_sp_event(int sp_event_ret)
> +{
> + int idx = -sp_event_ret;
> +
> + if (sp_event_ret == MM_SUCCESS)
> + return 0;
> + if (idx > 0 && idx < (int)ARRAY_SIZE(mm_sp_errmap) &&
> + mm_sp_errmap[idx])
> + return mm_sp_errmap[idx];
> + return -EACCES;
> +}
> +
> /**
> * ffa_notify_mm_sp() - Announce there is data in the shared buffer
> *
> @@ -177,52 +231,34 @@ static efi_status_t optee_mm_communicate(void *comm_buf, ulong dsize)
> * This is a blocking call during which trusted world has exclusive access
> * to the MM shared buffer.
> *
> - * Return:
> - *
> - * 0 on success
> + * Return: 0 on success
> */
> -static int ffa_notify_mm_sp(void)
> +static int __efi_runtime ffa_notify_mm_sp(void)
> {
> struct ffa_send_direct_data msg = {0};
> int ret;
> int sp_event_ret;
> - struct udevice *dev;
> + bool at_runtime = efi_at_runtime();
>
> - ret = uclass_first_device_err(UCLASS_FFA, &dev);
> - if (ret) {
> - log_err("EFI: Cannot find FF-A bus device, notify MM SP failure\n");
> - return ret;
> - }
> + msg.data0 = CONFIG_FFA_SHARED_MM_BUF_OFFSET;
> +
> + if (at_runtime) {
> + ret = ffa_sync_send_receive_runtime(mm_sp_id, &msg, 1);
> + } else {
> + struct udevice *dev;
>
> - msg.data0 = CONFIG_FFA_SHARED_MM_BUF_OFFSET; /* x3 */
> + ret = uclass_first_device_err(UCLASS_FFA, &dev);
> + if (ret)
> + return ret;
>
> - ret = ffa_sync_send_receive(dev, mm_sp_id, &msg, 1);
> + ret = ffa_sync_send_receive(dev, mm_sp_id, &msg, 1);
> + }
> if (ret)
> return ret;
>
> - sp_event_ret = msg.data0; /* x3 */
> -
> - switch (sp_event_ret) {
> - case MM_SUCCESS:
> - ret = 0;
> - break;
> - case MM_NOT_SUPPORTED:
> - ret = -EINVAL;
> - break;
> - case MM_INVALID_PARAMETER:
> - ret = -EPERM;
> - break;
> - case MM_DENIED:
> - ret = -EACCES;
> - break;
> - case MM_NO_MEMORY:
> - ret = -EBUSY;
> - break;
> - default:
> - ret = -EACCES;
> - }
> + sp_event_ret = msg.data0;
>
> - return ret;
> + return ffa_map_sp_event(sp_event_ret);
> }
>
> /**
> @@ -266,77 +302,128 @@ static int ffa_discover_mm_sp_id(void)
> }
>
> /**
> - * ffa_mm_communicate() - Exchange EFI services data with the MM partition using FF-A
> + * ffa_mm_communicate() - Exchange EFI services data with the MM partition using FF-A
> * @comm_buf: locally allocated communication buffer used for rx/tx
> - * @dsize: communication buffer size
> + * @comm_buf_size: communication buffer size
> *
> * Issue a door bell event to notify the MM partition (SP) running in OP-TEE
> * that there is data to read from the shared buffer.
> * Communication with the MM SP is performed using FF-A transport.
> * On the event, MM SP can read the data from the buffer and
> * update the MM shared buffer with response data.
> - * The response data is copied back to the communication buffer.
> - *
> - * Return:
> + * The response data is copied back to the communication buffer during the
> + * boot phase. At runtime, the communication buffer is already the FF-A
> + * shared buffer and is updated in place.
> *
> - * EFI status code
> + * Return: EFI status code
> */
> -static efi_status_t ffa_mm_communicate(void *comm_buf, ulong comm_buf_size)
> +static efi_status_t __efi_runtime ffa_mm_communicate(void *comm_buf,
> + ulong comm_buf_size)
> {
> + ulong hdr_cache_size;
> ulong tx_data_size;
> + ulong tx_cache_size;
> int ffa_ret;
> efi_status_t efi_ret;
> struct efi_mm_communicate_header *mm_hdr;
> - void *virt_shared_buf;
> + u8 *shared_buf;
> + bool at_runtime = efi_at_runtime();
>
> if (!comm_buf)
> return EFI_INVALID_PARAMETER;
>
> - /* Discover MM partition ID at boot time */
> - if (!mm_sp_id && ffa_discover_mm_sp_id()) {
> - log_err("EFI: Failure to discover MM SP ID at boot time, FF-A MM comms failure\n");
> - return EFI_UNSUPPORTED;
> + if (!mm_sp_id) {
> + if (at_runtime)
> + return EFI_UNSUPPORTED;
> + if (ffa_discover_mm_sp_id())
> + return EFI_UNSUPPORTED;
> }
>
> mm_hdr = (struct efi_mm_communicate_header *)comm_buf;
> tx_data_size = mm_hdr->message_len + sizeof(efi_guid_t) + sizeof(size_t);
> + hdr_cache_size = ALIGN(sizeof(*mm_hdr), CONFIG_SYS_CACHELINE_SIZE);
> + tx_cache_size = ALIGN(tx_data_size, CONFIG_SYS_CACHELINE_SIZE);
>
> if (comm_buf_size != tx_data_size || tx_data_size > CONFIG_FFA_SHARED_MM_BUF_SIZE)
> return EFI_INVALID_PARAMETER;
>
> - /* Copy the data to the shared buffer */
> -
> - virt_shared_buf = map_sysmem((phys_addr_t)CONFIG_FFA_SHARED_MM_BUF_ADDR, 0);
> - memcpy(virt_shared_buf, comm_buf, tx_data_size);
> + if (at_runtime) {
> + shared_buf = comm_buf;
> + } else {
> + /* Copy the data to the shared buffer */
> + shared_buf = map_sysmem((phys_addr_t)CONFIG_FFA_SHARED_MM_BUF_ADDR, 0);
> + memcpy(shared_buf, comm_buf, tx_data_size);
> + }
>
> /*
> - * The secure world might have cache disabled for
> - * the device region used for shared buffer (which is the case for Optee).
> - * In this case, the secure world reads the data from DRAM.
> - * Let's flush the cache so the DRAM is updated with the latest data.
> + * Shared buffer cache maintenance for FF-A / OP-TEE communication:
> + *
> + * NS -> S (request path):
> + *
> + * The non-secure side populates the shared buffer. If the buffer is cached
> + * in NS, the updated bytes may reside in dirty D-cache lines and not yet be
> + * visible in DDR. Since the secure world typically reads the shared buffer
> + * directly from DDR (e.g. with caches disabled / non-coherent mapping), we
> + * must clean the corresponding cache lines to the Point of Coherency (PoC)
> + * before entering secure world.
> + *
> + * S -> NS (response path):
> + *
> + * The secure world may update the same shared buffer in DDR. After returning
> + * to non-secure, any cached copies of that region in NS may be stale. We
> + * therefore invalidate the shared buffer range after the FF-A call to drop
> + * those lines and force subsequent reads to fetch the latest data from DDR.
> + *
> + * Note: Whole-cache invalidation must not be used in EFI runtime context.
> + * After ExitBootServices(), the OS owns the cache hierarchy; global
> + * invalidation could drop OS dirty lines and violate the OS coherency
> + * model. Always operate on the shared buffer range only.
> */
> -#ifdef CONFIG_ARM64
> - invalidate_dcache_all();
> -#endif
> + if (IS_ENABLED(CONFIG_ARM64)) {
> + BUILD_BUG_ON(CONFIG_FFA_SHARED_MM_BUF_ADDR %
> + CONFIG_SYS_CACHELINE_SIZE);
> + BUILD_BUG_ON(CONFIG_FFA_SHARED_MM_BUF_SIZE %
> + CONFIG_SYS_CACHELINE_SIZE);
> + flush_dcache_range((unsigned long)shared_buf,
> + (unsigned long)(shared_buf +
> + tx_cache_size));
> + }
>
> /* Announce there is data in the shared buffer */
> -
> ffa_ret = ffa_notify_mm_sp();
>
> switch (ffa_ret) {
> case 0: {
> ulong rx_data_size;
> - /* Copy the MM SP response from the shared buffer to the communication buffer */
> - rx_data_size = ((struct efi_mm_communicate_header *)virt_shared_buf)->message_len +
> + ulong rx_cache_size;
> +
> + if (IS_ENABLED(CONFIG_ARM64))
> + invalidate_dcache_range((unsigned long)shared_buf,
> + (unsigned long)(shared_buf +
> + hdr_cache_size));
> +
> + rx_data_size = ((struct efi_mm_communicate_header *)shared_buf)->message_len +
> sizeof(efi_guid_t) +
> sizeof(size_t);
>
> - if (rx_data_size > comm_buf_size) {
> + if (rx_data_size > comm_buf_size ||
> + rx_data_size > CONFIG_FFA_SHARED_MM_BUF_SIZE) {
> efi_ret = EFI_OUT_OF_RESOURCES;
> break;
> }
>
> - memcpy(comm_buf, virt_shared_buf, rx_data_size);
> + if (IS_ENABLED(CONFIG_ARM64)) {
> + rx_cache_size = ALIGN(rx_data_size,
> + CONFIG_SYS_CACHELINE_SIZE);
> + if (rx_cache_size > hdr_cache_size)
> + invalidate_dcache_range((unsigned long)(shared_buf +
> + hdr_cache_size),
> + (unsigned long)(shared_buf +
> + rx_cache_size));
> + }
> +
> + if (!at_runtime)
> + memcpy(comm_buf, shared_buf, rx_data_size);
> efi_ret = EFI_SUCCESS;
> break;
> }
> @@ -356,41 +443,45 @@ static efi_status_t ffa_mm_communicate(void *comm_buf, ulong comm_buf_size)
> efi_ret = EFI_ACCESS_DENIED;
> }
>
> - unmap_sysmem(virt_shared_buf);
> + if (!at_runtime)
> + unmap_sysmem(shared_buf);
> return efi_ret;
> }
>
> /**
> * get_mm_comms() - detect the available MM transport
> *
> - * Make sure the FF-A bus is probed successfully
> - * which means FF-A communication with secure world works and ready
> - * for use.
> + * Make sure the FF-A bus is probed successfully during the boot phase,
> + * which means FF-A communication with secure world works and is ready for
> + * use. During the runtime phase, only the FF-A runtime transport can be
> + * selected.
> *
> - * If FF-A bus is not ready, use OPTEE comms.
> + * If FF-A bus is not ready at boot, use OP-TEE comms.
> *
> - * Return:
> - *
> - * MM_COMMS_FFA or MM_COMMS_OPTEE
> + * Return: MM_COMMS_FFA, MM_COMMS_OPTEE, or MM_COMMS_UNDEFINED
> */
> -static enum mm_comms_select get_mm_comms(void)
> +static enum mm_comms_select __efi_runtime get_mm_comms(void)
> {
> struct udevice *dev;
> int ret;
>
> + if (efi_at_runtime()) {
> + if (IS_ENABLED(CONFIG_ARM_FFA_RT_MODE))
> + return MM_COMMS_FFA;
> + return MM_COMMS_UNDEFINED;
> + }
> +
> ret = uclass_first_device_err(UCLASS_FFA, &dev);
> - if (ret) {
> - log_debug("EFI: Cannot find FF-A bus device, trying Optee comms\n");
> + if (ret)
> return MM_COMMS_OPTEE;
> - }
>
> return MM_COMMS_FFA;
> }
> #endif
>
> /**
> - * mm_communicate() - Adjust the communication buffer to the MM SP and send
> - * it to OP-TEE
> + * mm_communicate() - Adjust the communication buffer to the MM SP and send it
> + * to the selected MM transport
> *
> * @comm_buf: locally allocated communication buffer
> * @dsize: buffer size
> @@ -400,11 +491,12 @@ static enum mm_comms_select get_mm_comms(void)
> * When using the u-boot OP-TEE driver, StandAlonneMM is supported.
> * When using the u-boot FF-A driver, any MM SP is supported.
> *
> - * Return: status code
> + * Return: status code
> */
> -static efi_status_t mm_communicate(u8 *comm_buf, efi_uintn_t dsize)
> +static efi_status_t __efi_runtime mm_communicate(u8 *comm_buf,
> + efi_uintn_t dsize)
> {
> - efi_status_t ret;
> + efi_status_t ret = EFI_UNSUPPORTED;
> struct efi_mm_communicate_header *mm_hdr;
> struct smm_variable_communicate_header *var_hdr;
> #if CONFIG_IS_ENABLED(ARM_FFA_TRANSPORT)
> @@ -419,23 +511,73 @@ static efi_status_t mm_communicate(u8 *comm_buf, efi_uintn_t dsize)
> mm_comms = get_mm_comms();
> if (mm_comms == MM_COMMS_FFA)
> ret = ffa_mm_communicate(comm_buf, dsize);
> - else
> + else if (mm_comms == MM_COMMS_OPTEE)
> ret = optee_mm_communicate(comm_buf, dsize);
> #else
> - ret = optee_mm_communicate(comm_buf, dsize);
> + ret = optee_mm_communicate(comm_buf, dsize);
> #endif
>
> - if (ret != EFI_SUCCESS) {
> - log_err("%s failed!\n", __func__);
> + if (ret != EFI_SUCCESS)
> return ret;
> - }
>
> return var_hdr->ret_status;
> }
>
> /**
> - * setup_mm_hdr() - Allocate a buffer for StandAloneMM and initialize the
> - * header data.
> + * get_comm_buf() - Obtain a communication buffer for MM/FF-A exchange
> + * @payload_size: size of the payload that will be appended to the
> + * MM communication header
> + *
> + * This helper returns a buffer suitable for constructing an
> + * EFI_MM_COMMUNICATE message. During the boot phase a new buffer is
> + * dynamically allocated. After ExitBootServices(), dynamic
> + * allocation is no longer permitted, and all runtime communication must
> + * use the statically reserved FF-A shared buffer.
> + *
> + * The caller owns the returned buffer only during the boot phase and
> + * must release it with free(). During the runtime phase, the returned
> + * pointer aliases the static FF-A shared buffer and must not be freed.
> + *
> + * Return:
> + * Pointer to a valid communication buffer on success.
> + * NULL if no suitable communication buffer is available.
> + */
> +static __efi_runtime u8 *get_comm_buf(efi_uintn_t payload_size)
> +{
> + efi_uintn_t comm_buf_size;
> + u8 *comm_buf;
> +
> + comm_buf_size = MM_COMMUNICATE_HEADER_SIZE +
> + MM_VARIABLE_COMMUNICATE_SIZE +
> + payload_size;
> +
> + /*
> + * After ExitBootServices(), dynamic allocation is no longer permitted.
> + * Use the predefined FF-A shared buffer at runtime; otherwise allocate
> + * a fresh buffer during the boot phase.
> + */
> + if (efi_at_runtime()) {
> + if (IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)) {
> + if (comm_buf_size > CONFIG_FFA_SHARED_MM_BUF_SIZE)
> + return NULL;
> + comm_buf = ffa_shared_buf;
> + if (!comm_buf)
> + return NULL;
> + efi_memset_runtime(comm_buf, 0, comm_buf_size);
> + } else {
> + return NULL;
> + }
> + } else {
> + comm_buf = calloc(1, comm_buf_size);
> + if (!comm_buf)
> + return NULL;
> + }
> + return comm_buf;
> +}
> +
> +/**
> + * setup_mm_hdr() - Obtain a communication buffer for StandAloneMM and
> + * initialize the MM header
> *
> * @dptr: pointer address of the corresponding StandAloneMM
> * function
> @@ -444,10 +586,11 @@ static efi_status_t mm_communicate(u8 *comm_buf, efi_uintn_t dsize)
> * @ret: EFI return code
> * Return: buffer or NULL
> */
> -static u8 *setup_mm_hdr(void **dptr, efi_uintn_t payload_size,
> - efi_uintn_t func, efi_status_t *ret)
> +static __efi_runtime u8 *setup_mm_hdr(void **dptr, efi_uintn_t payload_size,
> + efi_uintn_t func, efi_status_t *ret)
> {
> - const efi_guid_t mm_var_guid = EFI_MM_VARIABLE_GUID;
> + static const __efi_runtime_rodata efi_guid_t mm_var_guid =
> + EFI_MM_VARIABLE_GUID;
> struct efi_mm_communicate_header *mm_hdr;
> struct smm_variable_communicate_header *var_hdr;
> u8 *comm_buf;
> @@ -465,16 +608,15 @@ static u8 *setup_mm_hdr(void **dptr, efi_uintn_t payload_size,
> return NULL;
> }
>
> - comm_buf = calloc(1, MM_COMMUNICATE_HEADER_SIZE +
> - MM_VARIABLE_COMMUNICATE_SIZE +
> - payload_size);
> + comm_buf = get_comm_buf(payload_size);
> if (!comm_buf) {
> *ret = EFI_OUT_OF_RESOURCES;
> return NULL;
> }
>
> mm_hdr = (struct efi_mm_communicate_header *)comm_buf;
> - guidcpy(&mm_hdr->header_guid, &mm_var_guid);
> + efi_memcpy_runtime(&mm_hdr->header_guid, &mm_var_guid,
> + sizeof(mm_hdr->header_guid));
> mm_hdr->message_len = MM_VARIABLE_COMMUNICATE_SIZE + payload_size;
>
> var_hdr = (struct smm_variable_communicate_header *)mm_hdr->data;
> @@ -982,6 +1124,21 @@ void efi_variables_boot_exit_notify(void)
> efi_get_next_variable_name_runtime;
> efi_runtime_services.set_variable = efi_set_variable_runtime;
> efi_update_table_header_crc32(&efi_runtime_services.hdr);
> +
> + /* Record that ExitBootServices() has been called */
> + ebs_called = true;
> +}
> +
> +/**
> + * ffa_shared_buf_notify_virtual_address_map() - SetVirtualAddressMap callback
> + *
> + * @event: callback event
> + * @context: callback context
> + */
> +static void EFIAPI __efi_runtime
> +ffa_shared_buf_notify_virtual_address_map(struct efi_event *event, void *context)
> +{
> + efi_convert_pointer(0, (void **)&ffa_shared_buf);
> }
>
> /**
> @@ -992,6 +1149,7 @@ void efi_variables_boot_exit_notify(void)
> efi_status_t efi_init_variables(void)
> {
> efi_status_t ret;
> + struct efi_event *event;
>
> /* Create a cached copy of the variables that will be enabled on ExitBootServices() */
> ret = efi_var_mem_init();
> @@ -1010,5 +1168,35 @@ efi_status_t efi_init_variables(void)
> if (ret != EFI_SUCCESS)
> return ret;
>
> + if (IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)) {
> + /*
> + * The FF-A shared buffer is accessed by EFI runtime services, so
> + * keep the resident pointer convertible across
> + * SetVirtualAddressMap() and mark the region as runtime memory.
> + *
> + * CONFIG_FFA_SHARED_MM_BUF_ADDR is expected to be EFI-page aligned.
> + */
> + BUILD_BUG_ON(CONFIG_FFA_SHARED_MM_BUF_ADDR & EFI_PAGE_MASK);
> + ffa_shared_buf = (void *)CONFIG_FFA_SHARED_MM_BUF_ADDR;
> + ret = efi_create_event(EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE,
> + TPL_CALLBACK,
> + ffa_shared_buf_notify_virtual_address_map,
> + NULL, NULL, &event);
> + if (ret != EFI_SUCCESS)
> + return ret;
> + ret = efi_add_memory_map(CONFIG_FFA_SHARED_MM_BUF_ADDR,
> + CONFIG_FFA_SHARED_MM_BUF_SIZE,
> + EFI_RUNTIME_SERVICES_DATA);
> + if (ret != EFI_SUCCESS) {
> + efi_close_event(event);
> + log_err("EFI: failed to add FF-A shared buffer to runtime map (%lu)\n",
> + ret);
> + return ret;
> + }
> + log_info("EFI: FF-A shared buffer runtime map: addr=0x%lx size=0x%lx\n",
> + (ulong)CONFIG_FFA_SHARED_MM_BUF_ADDR,
> + (ulong)CONFIG_FFA_SHARED_MM_BUF_SIZE);
> + }
> +
> return EFI_SUCCESS;
> }
> --
> 2.34.1
>
Reviewed-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Kind regards
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3 06/10] corstone1000: enable bootefi selftest
2026-06-27 14:44 ` [PATCH v3 06/10] corstone1000: enable bootefi selftest Harsimran Singh Tungal
@ 2026-06-29 18:44 ` Abdellatif El Khlifi
0 siblings, 0 replies; 22+ messages in thread
From: Abdellatif El Khlifi @ 2026-06-29 18:44 UTC (permalink / raw)
To: Harsimran Singh Tungal
Cc: u-boot, Tom Rini, Ilias Apalodimas, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
Hi Harsimran,
On Sat, Jun 27, 2026 at 03:44:17PM +0100, Harsimran Singh Tungal wrote:
> Enable `CMD_BOOTEFI_SELFTEST` in `corstone1000_defconfig` so the later
> runtime-variable selftest patch in this series can be exercised on
> Corstone-1000.
>
> Keep `CMD_BOOTEFI_HELLO` and `CMD_POWEROFF` explicitly disabled.
> Enabling `CMD_BOOTEFI_SELFTEST` would otherwise make
> `CMD_BOOTEFI_HELLO` default to `y` and pull in `CMD_POWEROFF` on this
> PSCI-based defconfig. The intent here is to enable the selftest command
> without broadening the rest of the board command set.
>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
> ---
> configs/corstone1000_defconfig | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/configs/corstone1000_defconfig b/configs/corstone1000_defconfig
> index 876b915b6a4..e16b13043ac 100644
> --- a/configs/corstone1000_defconfig
> +++ b/configs/corstone1000_defconfig
> @@ -32,6 +32,8 @@ CONFIG_SYS_PROMPT="corstone1000# "
> # CONFIG_CMD_CONSOLE is not set
> CONFIG_CMD_FWU_METADATA=y
> CONFIG_CMD_BOOTZ=y
> +# CONFIG_CMD_BOOTEFI_HELLO is not set
> +CONFIG_CMD_BOOTEFI_SELFTEST=y
> # CONFIG_CMD_XIMG is not set
> CONFIG_CMD_GPT=y
> CONFIG_CMD_LOADM=y
> @@ -62,6 +64,7 @@ CONFIG_SYSRESET=y
> CONFIG_SYSRESET_PSCI=y
> CONFIG_TEE=y
> CONFIG_OPTEE=y
> +# CONFIG_CMD_POWEROFF is not set
> CONFIG_USB=y
> CONFIG_USB_ISP1760=y
> # CONFIG_RANDOM_UUID is not set
> --
> 2.34.1
>
Reviewed-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Kind regards
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3 02/10] arm-ffa: add FF-A bus runtime support
2026-06-27 14:44 ` [PATCH v3 02/10] arm-ffa: add FF-A bus runtime support Harsimran Singh Tungal
2026-06-29 18:12 ` Abdellatif El Khlifi
@ 2026-07-01 12:59 ` Ilias Apalodimas
2026-07-01 13:59 ` Ilias Apalodimas
2 siblings, 0 replies; 22+ messages in thread
From: Ilias Apalodimas @ 2026-07-01 12:59 UTC (permalink / raw)
To: Harsimran Singh Tungal
Cc: u-boot, Abdellatif El Khlifi, Tom Rini, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
Hi Harsimran,
On Sat, 27 Jun 2026 at 17:44, Harsimran Singh Tungal
<harsimransingh.tungal@arm.com> wrote:
>
> Add the FF-A runtime infrastructure needed after ExitBootServices() so
> EFI runtime services can continue to use the FF-A transport layer.
> Introduce drivers/firmware/arm-ffa/arm-ffa-runtime.c and
> include/arm_ffa_runtime.h with runtime-resident FF-A helpers for
> direct messaging, SMC invocation, and error translation. Add the
> sandbox runtime SMC wrapper, the ARM_FFA_RT_MODE Kconfig option, and
> the ExitBootServices hook that copies the required FF-A runtime data
> into resident storage before enabling the runtime context.
>
> Tag the runtime code and data with __efi_runtime and
> __efi_runtime_data so they remain available after
> ExitBootServices().
>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Having the FFA driver in drivers/firmware/arm-ffa/ in fine. I am not
so sure about the parts that touch the efi_loader though. I would
prefer having this there. Is there a reason you are defined this in
the ffa driver?
[...]
Thanks
/Ilias
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3 04/10] efi_loader: enable EFI runtime SetVariable()/GetVariable() using FF-A transport
2026-06-27 14:44 ` [PATCH v3 04/10] efi_loader: enable EFI runtime SetVariable()/GetVariable() using FF-A transport Harsimran Singh Tungal
@ 2026-07-01 13:49 ` Ilias Apalodimas
0 siblings, 0 replies; 22+ messages in thread
From: Ilias Apalodimas @ 2026-07-01 13:49 UTC (permalink / raw)
To: Harsimran Singh Tungal
Cc: u-boot, Abdellatif El Khlifi, Tom Rini, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
Hi Harsimran,
Thanks for fixingthe callbacks. The logic is correct now but please
split these into 4 different patches on the next revision, one for
each runtime call that changes.
Thanks
/Ilias
On Sat, 27 Jun 2026 at 17:44, Harsimran Singh Tungal
<harsimransingh.tungal@arm.com> wrote:
>
> Route EFI runtime variable APIs through FF-A MM communication
>
> Route EFI runtime variable services through the FF-A/MM backend in
> lib/efi_loader/efi_variable_tee.c. After ExitBootServices(),
> GetVariable(), SetVariable(), GetNextVariableName(), and
> QueryVariableInfo() use the runtime entry points and continue to reach
> the MM secure partition.
>
> Keep the existing boot-time helpers unchanged and add runtime service
> wrappers for variable access and property handling. Reuse the
> runtime-safe setup_mm_hdr() and common mm_communicate() path, which
> selects the FF-A transport appropriate for the current phase, and use
> the EFI runtime-safe memory helpers in the runtime-only code.
>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
> ---
> lib/efi_loader/efi_variable_tee.c | 344 ++++++++++++++++++++++++++++--
> 1 file changed, 326 insertions(+), 18 deletions(-)
>
> diff --git a/lib/efi_loader/efi_variable_tee.c b/lib/efi_loader/efi_variable_tee.c
> index fe205bdf966..474dd186a3e 100644
> --- a/lib/efi_loader/efi_variable_tee.c
> +++ b/lib/efi_loader/efi_variable_tee.c
> @@ -716,6 +716,38 @@ out:
> return ret;
> }
>
> +static efi_status_t __efi_runtime set_property_int_runtime(const u16 *variable_name,
> + efi_uintn_t name_size,
> + const efi_guid_t *vendor,
> + struct var_check_property *var_property)
> +{
> + struct smm_variable_var_check_property *smm_property;
> + efi_uintn_t payload_size;
> + u8 *comm_buf = NULL;
> + efi_status_t ret;
> +
> + payload_size = sizeof(*smm_property) + name_size;
> + if (payload_size > max_payload_size) {
> + ret = EFI_INVALID_PARAMETER;
> + return ret;
> + }
> + comm_buf = setup_mm_hdr((void **)&smm_property, payload_size,
> + SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_SET,
> + &ret);
> + if (!comm_buf)
> + return ret;
> +
> + efi_memcpy_runtime(&smm_property->guid, vendor, sizeof(*vendor));
> + smm_property->name_size = name_size;
> + efi_memcpy_runtime(&smm_property->property, var_property,
> + sizeof(smm_property->property));
> + efi_memcpy_runtime(smm_property->name, variable_name, name_size);
> +
> + ret = mm_communicate(comm_buf, payload_size);
> +
> + return ret;
> +}
> +
> static efi_status_t get_property_int(const u16 *variable_name,
> efi_uintn_t name_size,
> const efi_guid_t *vendor,
> @@ -761,6 +793,49 @@ out:
> return ret;
> }
>
> +static efi_status_t __efi_runtime get_property_int_runtime(const u16 *variable_name,
> + efi_uintn_t name_size,
> + const efi_guid_t *vendor,
> + struct var_check_property *var_property)
> +{
> + struct smm_variable_var_check_property *smm_property;
> + efi_uintn_t payload_size;
> + u8 *comm_buf = NULL;
> + efi_status_t ret;
> +
> + efi_memset_runtime(var_property, 0, sizeof(*var_property));
> + payload_size = sizeof(*smm_property) + name_size;
> + if (payload_size > max_payload_size) {
> + ret = EFI_INVALID_PARAMETER;
> + return ret;
> + }
> + comm_buf = setup_mm_hdr((void **)&smm_property, payload_size,
> + SMM_VARIABLE_FUNCTION_VAR_CHECK_VARIABLE_PROPERTY_GET,
> + &ret);
> + if (!comm_buf)
> + return ret;
> +
> + efi_memcpy_runtime(&smm_property->guid, vendor, sizeof(smm_property->guid));
> + smm_property->name_size = name_size;
> + efi_memcpy_runtime(smm_property->name, variable_name, name_size);
> +
> + ret = mm_communicate(comm_buf, payload_size);
> + /*
> + * Currently only R/O property is supported in StMM.
> + * Variables that are not set to R/O will not set the property in StMM
> + * and the call will return EFI_NOT_FOUND. We are setting the
> + * properties to 0x0 so checking against that is enough for the
> + * EFI_NOT_FOUND case.
> + */
> + if (ret == EFI_NOT_FOUND)
> + return EFI_SUCCESS;
> + if (ret != EFI_SUCCESS)
> + return ret;
> + efi_memcpy_runtime(var_property, &smm_property->property, sizeof(*var_property));
> +
> + return EFI_SUCCESS;
> +}
> +
> efi_status_t efi_get_variable_int(const u16 *variable_name,
> const efi_guid_t *vendor,
> u32 *attributes, efi_uintn_t *data_size,
> @@ -848,6 +923,93 @@ out:
> return ret;
> }
>
> +efi_status_t __efi_runtime EFIAPI
> +efi_get_variable_int_runtime(u16 *variable_name, const efi_guid_t *vendor,
> + u32 *attributes, efi_uintn_t *data_size, void *data)
> +{
> + struct var_check_property var_property;
> + struct smm_variable_access *var_acc;
> + efi_uintn_t payload_size;
> + efi_uintn_t name_size;
> + efi_uintn_t tmp_dsize;
> + u8 *comm_buf = NULL;
> + efi_status_t ret, tmp;
> + u32 var_attr = 0;
> +
> + if (!variable_name || !vendor || !data_size) {
> + ret = EFI_INVALID_PARAMETER;
> + return ret;
> + }
> +
> + /* Check payload size */
> + name_size = u16_strsize(variable_name);
> + if (name_size > max_payload_size - MM_VARIABLE_ACCESS_HEADER_SIZE) {
> + ret = EFI_INVALID_PARAMETER;
> + return ret;
> + }
> +
> + /* Trim output buffer size */
> + tmp_dsize = *data_size;
> + if (name_size + tmp_dsize >
> + max_payload_size - MM_VARIABLE_ACCESS_HEADER_SIZE) {
> + tmp_dsize = max_payload_size -
> + MM_VARIABLE_ACCESS_HEADER_SIZE -
> + name_size;
> + }
> +
> + /* Get communication buffer and initialize header */
> + payload_size = MM_VARIABLE_ACCESS_HEADER_SIZE + name_size + tmp_dsize;
> + comm_buf = setup_mm_hdr((void **)&var_acc, payload_size,
> + SMM_VARIABLE_FUNCTION_GET_VARIABLE, &ret);
> + if (!comm_buf)
> + return ret;
> +
> + /* Fill in contents */
> + efi_memcpy_runtime(&var_acc->guid, vendor, sizeof(var_acc->guid));
> + var_acc->data_size = tmp_dsize;
> + var_acc->name_size = name_size;
> + var_acc->attr = attributes ? *attributes : 0;
> + efi_memcpy_runtime(var_acc->name, variable_name, name_size);
> +
> + /* Communicate */
> + ret = mm_communicate(comm_buf, payload_size);
> + if (ret != EFI_SUCCESS && ret != EFI_BUFFER_TOO_SMALL)
> + return ret;
> +
> + /* Update with reported data size for trimmed case */
> + *data_size = var_acc->data_size;
> + if (attributes)
> + var_attr = var_acc->attr;
> +
> + /* Copy the data if ret is EFI_SUCCESS */
> + if (ret == EFI_SUCCESS) {
> + if (data)
> + efi_memcpy_runtime(data, (u8 *)var_acc->name + var_acc->name_size,
> + var_acc->data_size);
> + else
> + ret = EFI_INVALID_PARAMETER;
> + }
> +
> + /*
> + * UEFI > 2.7 needs the attributes set even if the buffer is
> + * smaller
> + */
> + if (attributes) {
> + tmp = get_property_int_runtime(variable_name, name_size, vendor,
> + &var_property);
> + if (tmp != EFI_SUCCESS) {
> + ret = tmp;
> + return ret;
> + }
> + *attributes = var_attr;
> + if (var_property.property &
> + VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY)
> + *attributes |= EFI_VARIABLE_READ_ONLY;
> + }
> +
> + return ret;
> +}
> +
> efi_status_t efi_get_next_variable_name_int(efi_uintn_t *variable_name_size,
> u16 *variable_name,
> efi_guid_t *guid)
> @@ -912,6 +1074,68 @@ out:
> return ret;
> }
>
> +efi_status_t __efi_runtime EFIAPI
> +efi_get_next_variable_name_int_runtime(efi_uintn_t *variable_name_size,
> + u16 *variable_name, efi_guid_t *guid)
> +{
> + struct smm_variable_getnext *var_getnext;
> + efi_uintn_t payload_size;
> + efi_uintn_t out_name_size;
> + efi_uintn_t in_name_size;
> + u8 *comm_buf = NULL;
> + efi_status_t ret;
> +
> + if (!variable_name_size || !variable_name || !guid) {
> + ret = EFI_INVALID_PARAMETER;
> + return ret;
> + }
> +
> + out_name_size = *variable_name_size;
> + in_name_size = u16_strsize(variable_name);
> +
> + if (out_name_size < in_name_size) {
> + ret = EFI_INVALID_PARAMETER;
> + return ret;
> + }
> +
> + if (in_name_size > max_payload_size - MM_VARIABLE_GET_NEXT_HEADER_SIZE) {
> + ret = EFI_INVALID_PARAMETER;
> + return ret;
> + }
> +
> + /* Trim output buffer size */
> + if (out_name_size > max_payload_size - MM_VARIABLE_GET_NEXT_HEADER_SIZE)
> + out_name_size = max_payload_size - MM_VARIABLE_GET_NEXT_HEADER_SIZE;
> +
> + payload_size = MM_VARIABLE_GET_NEXT_HEADER_SIZE + out_name_size;
> + comm_buf = setup_mm_hdr((void **)&var_getnext, payload_size,
> + SMM_VARIABLE_FUNCTION_GET_NEXT_VARIABLE_NAME,
> + &ret);
> + if (!comm_buf)
> + return ret;
> +
> + /* Fill in contents */
> + efi_memcpy_runtime(&var_getnext->guid, guid, sizeof(*guid));
> + var_getnext->name_size = out_name_size;
> + efi_memcpy_runtime(var_getnext->name, variable_name, in_name_size);
> + efi_memset_runtime((u8 *)var_getnext->name + in_name_size, 0x0,
> + out_name_size - in_name_size);
> +
> + /* Communicate */
> + ret = mm_communicate(comm_buf, payload_size);
> + if (ret == EFI_SUCCESS || ret == EFI_BUFFER_TOO_SMALL) {
> + /* Update with reported data size for trimmed case */
> + *variable_name_size = var_getnext->name_size;
> + }
> + if (ret != EFI_SUCCESS)
> + return ret;
> +
> + efi_memcpy_runtime(guid, &var_getnext->guid, sizeof(*guid));
> + efi_memcpy_runtime(variable_name, var_getnext->name, var_getnext->name_size);
> +
> + return ret;
> +}
> +
> efi_status_t efi_set_variable_int(const u16 *variable_name,
> const efi_guid_t *vendor, u32 attributes,
> efi_uintn_t data_size, const void *data,
> @@ -994,7 +1218,7 @@ efi_status_t efi_set_variable_int(const u16 *variable_name,
> var_property.property |= VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY;
> var_property.attributes = attributes;
> var_property.minsize = 1;
> - var_property.maxsize = var_acc->data_size;
> + var_property.maxsize = data_size;
> ret = set_property_int(variable_name, name_size, vendor, &var_property);
> }
>
> @@ -1045,7 +1269,7 @@ out:
> }
>
> /**
> - * efi_query_variable_info() - get information about EFI variables
> + * efi_query_variable_info_int_runtime() - get information about EFI variables
> *
> * This function implements the QueryVariableInfo() runtime service.
> *
> @@ -1054,24 +1278,50 @@ out:
> *
> * @attributes: bitmask to select variables to be
> * queried
> - * @maximum_variable_storage_size: maximum size of storage area for the
> + * @max_variable_storage_size: maximum size of storage area for the
> * selected variable types
> - * @remaining_variable_storage_size: remaining size of storage are for the
> + * @remain_variable_storage_size: remaining size of storage are for the
> * selected variable types
> - * @maximum_variable_size: maximum size of a variable of the
> + * @max_variable_size: maximum size of a variable of the
> * selected type
> * Return: status code
> */
> efi_status_t EFIAPI __efi_runtime
> -efi_query_variable_info_runtime(u32 attributes, u64 *max_variable_storage_size,
> - u64 *remain_variable_storage_size,
> - u64 *max_variable_size)
> +efi_query_variable_info_int_runtime(u32 attributes, u64 *max_variable_storage_size,
> + u64 *remain_variable_storage_size,
> + u64 *max_variable_size)
> {
> - return EFI_UNSUPPORTED;
> + struct smm_variable_query_info *mm_query_info;
> + efi_uintn_t payload_size;
> + efi_status_t ret;
> + u8 *comm_buf;
> +
> + if (!max_variable_storage_size ||
> + !remain_variable_storage_size ||
> + !max_variable_size || !attributes)
> + return EFI_INVALID_PARAMETER;
> +
> + payload_size = sizeof(*mm_query_info);
> + comm_buf = setup_mm_hdr((void **)&mm_query_info, payload_size,
> + SMM_VARIABLE_FUNCTION_QUERY_VARIABLE_INFO,
> + &ret);
> + if (!comm_buf)
> + return ret;
> +
> + mm_query_info->attr = attributes;
> + ret = mm_communicate(comm_buf, payload_size);
> + if (ret != EFI_SUCCESS)
> + return ret;
> + *max_variable_storage_size = mm_query_info->max_variable_storage;
> + *remain_variable_storage_size =
> + mm_query_info->remaining_variable_storage;
> + *max_variable_size = mm_query_info->max_variable_size;
> +
> + return ret;
> }
>
> /**
> - * efi_set_variable_runtime() - runtime implementation of SetVariable()
> + * efi_set_variable_int_runtime() - runtime implementation of SetVariable()
> *
> * @variable_name: name of the variable
> * @guid: vendor GUID
> @@ -1081,11 +1331,69 @@ efi_query_variable_info_runtime(u32 attributes, u64 *max_variable_storage_size,
> * Return: status code
> */
> static efi_status_t __efi_runtime EFIAPI
> -efi_set_variable_runtime(u16 *variable_name, const efi_guid_t *guid,
> - u32 attributes, efi_uintn_t data_size,
> - const void *data)
> +efi_set_variable_int_runtime(u16 *variable_name, const efi_guid_t *guid,
> + u32 attributes, efi_uintn_t data_size,
> + const void *data)
> {
> - return EFI_UNSUPPORTED;
> + efi_status_t ret, mm_communicate_ret = EFI_SUCCESS;
> + struct var_check_property var_property;
> + struct smm_variable_access *var_acc;
> + efi_uintn_t payload_size;
> + efi_uintn_t name_size;
> + u8 *comm_buf = NULL;
> + bool ro;
> +
> + if (!variable_name || variable_name[0] == 0 || !guid)
> + return EFI_INVALID_PARAMETER;
> +
> + if (data_size > 0 && !data)
> + return EFI_INVALID_PARAMETER;
> +
> + /* Check payload size */
> + name_size = u16_strsize(variable_name);
> + payload_size = MM_VARIABLE_ACCESS_HEADER_SIZE + name_size + data_size;
> + if (payload_size > max_payload_size)
> + return EFI_INVALID_PARAMETER;
> +
> + ro = !!(attributes & EFI_VARIABLE_READ_ONLY);
> + attributes &= EFI_VARIABLE_MASK;
> +
> + ret = get_property_int_runtime(variable_name, name_size, guid,
> + &var_property);
> + if (ret != EFI_SUCCESS)
> + return ret;
> +
> + if (var_property.property & VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY)
> + return EFI_WRITE_PROTECTED;
> +
> + comm_buf = setup_mm_hdr((void **)&var_acc, payload_size,
> + SMM_VARIABLE_FUNCTION_SET_VARIABLE, &ret);
> + if (!comm_buf)
> + return ret;
> +
> + /* Fill in contents */
> + efi_memcpy_runtime(&var_acc->guid, guid, sizeof(*guid));
> + var_acc->data_size = data_size;
> + var_acc->name_size = name_size;
> + var_acc->attr = attributes;
> + efi_memcpy_runtime(var_acc->name, variable_name, name_size);
> + efi_memcpy_runtime((u8 *)var_acc->name + name_size, data, data_size);
> +
> + /* Communicate */
> + ret = mm_communicate(comm_buf, payload_size);
> + if (ret != EFI_SUCCESS)
> + mm_communicate_ret = ret;
> +
> + if (ro && !(var_property.property & VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY)) {
> + var_property.revision = VAR_CHECK_VARIABLE_PROPERTY_REVISION;
> + var_property.property |= VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY;
> + var_property.attributes = attributes;
> + var_property.minsize = 1;
> + var_property.maxsize = data_size;
> + ret = set_property_int_runtime(variable_name, name_size, guid, &var_property);
> + }
> +
> + return (mm_communicate_ret == EFI_SUCCESS) ? ret : mm_communicate_ret;
> }
>
> /**
> @@ -1118,11 +1426,11 @@ void efi_variables_boot_exit_notify(void)
>
> /* Update runtime service table */
> efi_runtime_services.query_variable_info =
> - efi_query_variable_info_runtime;
> - efi_runtime_services.get_variable = efi_get_variable_runtime;
> + efi_query_variable_info_int_runtime;
> + efi_runtime_services.get_variable = efi_get_variable_int_runtime;
> efi_runtime_services.get_next_variable_name =
> - efi_get_next_variable_name_runtime;
> - efi_runtime_services.set_variable = efi_set_variable_runtime;
> + efi_get_next_variable_name_int_runtime;
> + efi_runtime_services.set_variable = efi_set_variable_int_runtime;
> efi_update_table_header_crc32(&efi_runtime_services.hdr);
>
> /* Record that ExitBootServices() has been called */
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3 03/10] efi_loader: add FF-A runtime support in EFI variable TEE driver
2026-06-27 14:44 ` [PATCH v3 03/10] efi_loader: add FF-A runtime support in EFI variable TEE driver Harsimran Singh Tungal
2026-06-29 18:40 ` Abdellatif El Khlifi
@ 2026-07-01 13:56 ` Ilias Apalodimas
1 sibling, 0 replies; 22+ messages in thread
From: Ilias Apalodimas @ 2026-07-01 13:56 UTC (permalink / raw)
To: Harsimran Singh Tungal
Cc: u-boot, Abdellatif El Khlifi, Tom Rini, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
Hi Harsimran,
On Sat, 27 Jun 2026 at 17:44, Harsimran Singh Tungal
<harsimransingh.tungal@arm.com> wrote:
>
> Enable MM variable services over FF-A after ExitBootServices
>
> Extend lib/efi_loader/efi_variable_tee.c to support FF-A
> communication with the secure world during EFI runtime. Reuse the
> statically reserved FF-A shared buffer after ExitBootServices(),
> make the MM communication path runtime-safe so runtime variable
> operations continue to reach the secure partition.
>
> Share the MM communication and MM SP notification helpers between the
> boot and runtime paths instead of maintaining separate runtime-only
> variants. Select dynamic allocation during boot and the fixed FF-A
> shared buffer at runtime, and reject requests that would exceed the
> shared buffer size.
>
> Mark the required code and data with __efi_runtime and
> __efi_runtime_data, use range-based cache maintenance on the shared
> buffer for the runtime FF-A path, and add the shared buffer to the EFI
> runtime memory map. Document the FF-A shared MM buffer
> cacheline-alignment requirement in Kconfig and add BUILD_BUG_ON()
> checks in ffa_mm_communicate() for the FF-A shared buffer alignment
> used by the arm64 cache-maintenance path.
>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
> ---
> arch/arm/cpu/armv8/cache.S | 8 +
> arch/arm/cpu/armv8/cache_v8.c | 13 +-
> lib/efi_loader/Kconfig | 4 +
> lib/efi_loader/efi_variable_tee.c | 382 ++++++++++++++++++++++--------
> 4 files changed, 306 insertions(+), 101 deletions(-)
>
> diff --git a/arch/arm/cpu/armv8/cache.S b/arch/arm/cpu/armv8/cache.S
> index c9e46859b4f..916558fe477 100644
> --- a/arch/arm/cpu/armv8/cache.S
> +++ b/arch/arm/cpu/armv8/cache.S
> @@ -169,7 +169,11 @@ ENDPROC(__asm_flush_l3_dcache)
> * x0: start address
> * x1: end address
> */
> +#ifdef CONFIG_EFI_LOADER
> +.pushsection .text.efi_runtime.__asm_flush_dcache_range, "ax"
> +#else
> .pushsection .text.__asm_flush_dcache_range, "ax"
> +#endif
> ENTRY(__asm_flush_dcache_range)
> mrs x3, ctr_el0
> ubfx x3, x3, #16, #4
> @@ -195,7 +199,11 @@ ENDPROC(__asm_flush_dcache_range)
> * x0: start address
> * x1: end address
> */
> +#ifdef CONFIG_EFI_LOADER
> +.pushsection .text.efi_runtime.__asm_invalidate_dcache_range, "ax"
> +#else
> .pushsection .text.__asm_invalidate_dcache_range, "ax"
> +#endif
> ENTRY(__asm_invalidate_dcache_range)
> mrs x3, ctr_el0
> ubfx x3, x3, #16, #4
> diff --git a/arch/arm/cpu/armv8/cache_v8.c b/arch/arm/cpu/armv8/cache_v8.c
> index 7c0e3f6d055..d150da4778e 100644
> --- a/arch/arm/cpu/armv8/cache_v8.c
> +++ b/arch/arm/cpu/armv8/cache_v8.c
> @@ -8,6 +8,7 @@
> */
>
> #include <cpu_func.h>
> +#include <efi_loader.h>
> #include <hang.h>
> #include <log.h>
> #include <asm/cache.h>
> @@ -855,7 +856,8 @@ inline void flush_dcache_all(void)
> /*
> * Invalidates range in all levels of D-cache/unified cache
> */
> -void invalidate_dcache_range(unsigned long start, unsigned long stop)
> +void __efi_runtime invalidate_dcache_range(unsigned long start,
> + unsigned long stop)
> {
> __asm_invalidate_dcache_range(start, stop);
> }
> @@ -863,16 +865,19 @@ void invalidate_dcache_range(unsigned long start, unsigned long stop)
> /*
> * Flush range(clean & invalidate) from all levels of D-cache/unified cache
> */
> -void flush_dcache_range(unsigned long start, unsigned long stop)
> +void __efi_runtime flush_dcache_range(unsigned long start,
> + unsigned long stop)
> {
> __asm_flush_dcache_range(start, stop);
> }
> #else
> -void invalidate_dcache_range(unsigned long start, unsigned long stop)
> +void __efi_runtime invalidate_dcache_range(unsigned long start,
> + unsigned long stop)
> {
> }
>
> -void flush_dcache_range(unsigned long start, unsigned long stop)
> +void __efi_runtime flush_dcache_range(unsigned long start,
> + unsigned long stop)
> {
> }
> #endif /* CONFIG_SYS_DISABLE_DCACHE_OPS */
This needs to be a patch of it's own explaining *why* having these
available at runtime is a needed.
[...]
> @@ -4,7 +4,7 @@
> *
> * Copyright (C) 2019 Linaro Ltd. <sughosh.ganu@linaro.org>
> * Copyright (C) 2019 Linaro Ltd. <ilias.apalodimas@linaro.org>
> - * Copyright 2022-2023 Arm Limited and/or its affiliates <open-source-office@arm.com>
> + * Copyright 2022-2026 Arm Limited and/or its affiliates <open-source-office@arm.com>
> *
> * Authors:
> * Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
> @@ -14,6 +14,7 @@
>
> #if CONFIG_IS_ENABLED(ARM_FFA_TRANSPORT)
> #include <arm_ffa.h>
> +#include <arm_ffa_runtime.h>
> #endif
> #include <cpu_func.h>
> #include <dm.h>
> @@ -21,6 +22,8 @@
> #include <efi_api.h>
> #include <efi_loader.h>
> #include <efi_variable.h>
> +#include <linux/build_bug.h>
> +#include <linux/kernel.h>
> #include <malloc.h>
> #include <mapmem.h>
> #include <mm_communication.h>
> @@ -34,20 +37,49 @@
> #define MM_DENIED (-3)
> #define MM_NO_MEMORY (-5)
These need to be removed now with the enum
>
> +/*
> + * MM_* return codes are negative. Use -MM_* as sparse positive indices so
> + * ffa_map_sp_event() can look up mm_sp_errmap[-sp_event_ret]. Unassigned
> + * slots remain 0 and are treated as unmapped MM return codes.
> + */
> +static const int __efi_runtime_rodata mm_sp_errmap[] = {
> + [-MM_NOT_SUPPORTED] = -EINVAL,
> + [-MM_INVALID_PARAMETER] = -EPERM,
> + [-MM_DENIED] = -EACCES,
> + [-MM_NO_MEMORY] = -EBUSY,
> +};
[...]
> +static void *__efi_runtime_data ffa_shared_buf;
> extern struct efi_var_file __efi_runtime_data *efi_var_buf;
> -static efi_uintn_t max_buffer_size; /* comm + var + func + data */
> -static efi_uintn_t max_payload_size; /* func + data */
> +static efi_uintn_t __efi_runtime_data max_buffer_size; /* comm + var + func + data */
> +static efi_uintn_t __efi_runtime_data max_payload_size; /* func + data */
> static const u16 __efi_runtime_rodata pk[] = u"PK";
> +static bool __efi_runtime_data ebs_called;
>
> struct mm_connection {
> struct udevice *tee;
> u32 session;
> };
>
> +/**
> + * efi_at_runtime() - Indicate whether the system is in the UEFI runtime phase
> + *
> + * This helper returns whether the firmware has transitioned into the
> + * UEFI runtime phase, meaning that ExitBootServices() has been invoked.
> + *
> + * Return:
> + * true - The system is operating in UEFI runtime mode.
> + * false - The system is still in the boot services phase.
> + */
> +static bool __efi_runtime efi_at_runtime(void)
> +{
> + return ebs_called;
> +}
> +
> /**
> * get_connection() - Retrieve OP-TEE session for a specific UUID.
> *
> @@ -169,6 +201,28 @@ static efi_status_t optee_mm_communicate(void *comm_buf, ulong dsize)
> }
>
[...]
> -
> - virt_shared_buf = map_sysmem((phys_addr_t)CONFIG_FFA_SHARED_MM_BUF_ADDR, 0);
> - memcpy(virt_shared_buf, comm_buf, tx_data_size);
> + if (at_runtime) {
> + shared_buf = comm_buf;
> + } else {
> + /* Copy the data to the shared buffer */
> + shared_buf = map_sysmem((phys_addr_t)CONFIG_FFA_SHARED_MM_BUF_ADDR, 0);
> + memcpy(shared_buf, comm_buf, tx_data_size);
> + }
>
> /*
> - * The secure world might have cache disabled for
> - * the device region used for shared buffer (which is the case for Optee).
> - * In this case, the secure world reads the data from DRAM.
> - * Let's flush the cache so the DRAM is updated with the latest data.
> + * Shared buffer cache maintenance for FF-A / OP-TEE communication:
> + *
> + * NS -> S (request path):
> + *
> + * The non-secure side populates the shared buffer. If the buffer is cached
> + * in NS, the updated bytes may reside in dirty D-cache lines and not yet be
> + * visible in DDR. Since the secure world typically reads the shared buffer
> + * directly from DDR (e.g. with caches disabled / non-coherent mapping), we
> + * must clean the corresponding cache lines to the Point of Coherency (PoC)
> + * before entering secure world.
> + *
> + * S -> NS (response path):
> + *
> + * The secure world may update the same shared buffer in DDR. After returning
> + * to non-secure, any cached copies of that region in NS may be stale. We
> + * therefore invalidate the shared buffer range after the FF-A call to drop
> + * those lines and force subsequent reads to fetch the latest data from DDR.
> + *
> + * Note: Whole-cache invalidation must not be used in EFI runtime context.
> + * After ExitBootServices(), the OS owns the cache hierarchy; global
> + * invalidation could drop OS dirty lines and violate the OS coherency
> + * model. Always operate on the shared buffer range only.
> */
> -#ifdef CONFIG_ARM64
> - invalidate_dcache_all();
> -#endif
> + if (IS_ENABLED(CONFIG_ARM64)) {
> + BUILD_BUG_ON(CONFIG_FFA_SHARED_MM_BUF_ADDR %
> + CONFIG_SYS_CACHELINE_SIZE);
> + BUILD_BUG_ON(CONFIG_FFA_SHARED_MM_BUF_SIZE %
> + CONFIG_SYS_CACHELINE_SIZE);
> + flush_dcache_range((unsigned long)shared_buf,
> + (unsigned long)(shared_buf +
> + tx_cache_size));
> + }
>
> /* Announce there is data in the shared buffer */
> -
> ffa_ret = ffa_notify_mm_sp();
>
> switch (ffa_ret) {
> case 0: {
> ulong rx_data_size;
> - /* Copy the MM SP response from the shared buffer to the communication buffer */
> - rx_data_size = ((struct efi_mm_communicate_header *)virt_shared_buf)->message_len +
> + ulong rx_cache_size;
> +
> + if (IS_ENABLED(CONFIG_ARM64))
> + invalidate_dcache_range((unsigned long)shared_buf,
> + (unsigned long)(shared_buf +
> + hdr_cache_size));
> +
> + rx_data_size = ((struct efi_mm_communicate_header *)shared_buf)->message_len +
> sizeof(efi_guid_t) +
> sizeof(size_t);
>
> - if (rx_data_size > comm_buf_size) {
> + if (rx_data_size > comm_buf_size ||
> + rx_data_size > CONFIG_FFA_SHARED_MM_BUF_SIZE) {
> efi_ret = EFI_OUT_OF_RESOURCES;
> break;
> }
>
> - memcpy(comm_buf, virt_shared_buf, rx_data_size);
> + if (IS_ENABLED(CONFIG_ARM64)) {
> + rx_cache_size = ALIGN(rx_data_size,
> + CONFIG_SYS_CACHELINE_SIZE);
> + if (rx_cache_size > hdr_cache_size)
> + invalidate_dcache_range((unsigned long)(shared_buf +
> + hdr_cache_size),
> + (unsigned long)(shared_buf +
> + rx_cache_size));
> + }
> +
> + if (!at_runtime)
> + memcpy(comm_buf, shared_buf, rx_data_size);
> efi_ret = EFI_SUCCESS;
> break;
> }
> @@ -356,41 +443,45 @@ static efi_status_t ffa_mm_communicate(void *comm_buf, ulong comm_buf_size)
> efi_ret = EFI_ACCESS_DENIED;
> }
>
> - unmap_sysmem(virt_shared_buf);
> + if (!at_runtime)
> + unmap_sysmem(shared_buf);
> return efi_ret;
> }
>
> /**
> * get_mm_comms() - detect the available MM transport
> *
> - * Make sure the FF-A bus is probed successfully
> - * which means FF-A communication with secure world works and ready
> - * for use.
> + * Make sure the FF-A bus is probed successfully during the boot phase,
> + * which means FF-A communication with secure world works and is ready for
> + * use. During the runtime phase, only the FF-A runtime transport can be
> + * selected.
> *
> - * If FF-A bus is not ready, use OPTEE comms.
> + * If FF-A bus is not ready at boot, use OP-TEE comms.
> *
> - * Return:
> - *
> - * MM_COMMS_FFA or MM_COMMS_OPTEE
> + * Return: MM_COMMS_FFA, MM_COMMS_OPTEE, or MM_COMMS_UNDEFINED
> */
> -static enum mm_comms_select get_mm_comms(void)
> +static enum mm_comms_select __efi_runtime get_mm_comms(void)
> {
> struct udevice *dev;
> int ret;
>
> + if (efi_at_runtime()) {
> + if (IS_ENABLED(CONFIG_ARM_FFA_RT_MODE))
> + return MM_COMMS_FFA;
> + return MM_COMMS_UNDEFINED;
Why undefined? It's either backed by OP-TEE or an FF-A SP.
Later down the road you are changing the
efi_runtime_services.get_variable to point to this
efi_query_variable_info_int_runtime(). if we are at runtime
ARM_FFA_TRANSPORT is enabled and CONFIG_ARM_FFA_RT_MODE is not
enabled the op-tee path will never run.
> +
> + /* Record that ExitBootServices() has been called */
> + ebs_called = true;
> +}
> +
> +/**
> + * ffa_shared_buf_notify_virtual_address_map() - SetVirtualAddressMap callback
> + *
> + * @event: callback event
> + * @context: callback context
> + */
> +static void EFIAPI __efi_runtime
> +ffa_shared_buf_notify_virtual_address_map(struct efi_event *event, void *context)
> +{
> + efi_convert_pointer(0, (void **)&ffa_shared_buf);
> }
>
> /**
> @@ -992,6 +1149,7 @@ void efi_variables_boot_exit_notify(void)
> efi_status_t efi_init_variables(void)
> {
> efi_status_t ret;
> + struct efi_event *event;
>
> /* Create a cached copy of the variables that will be enabled on ExitBootServices() */
> ret = efi_var_mem_init();
> @@ -1010,5 +1168,35 @@ efi_status_t efi_init_variables(void)
> if (ret != EFI_SUCCESS)
> return ret;
>
> + if (IS_ENABLED(CONFIG_ARM_FFA_RT_MODE)) {
> + /*
> + * The FF-A shared buffer is accessed by EFI runtime services, so
> + * keep the resident pointer convertible across
> + * SetVirtualAddressMap() and mark the region as runtime memory.
> + *
> + * CONFIG_FFA_SHARED_MM_BUF_ADDR is expected to be EFI-page aligned.
> + */
> + BUILD_BUG_ON(CONFIG_FFA_SHARED_MM_BUF_ADDR & EFI_PAGE_MASK);
> + ffa_shared_buf = (void *)CONFIG_FFA_SHARED_MM_BUF_ADDR;
> + ret = efi_create_event(EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE,
> + TPL_CALLBACK,
> + ffa_shared_buf_notify_virtual_address_map,
> + NULL, NULL, &event);
> + if (ret != EFI_SUCCESS)
> + return ret;
> + ret = efi_add_memory_map(CONFIG_FFA_SHARED_MM_BUF_ADDR,
> + CONFIG_FFA_SHARED_MM_BUF_SIZE,
> + EFI_RUNTIME_SERVICES_DATA);
> + if (ret != EFI_SUCCESS) {
> + efi_close_event(event);
> + log_err("EFI: failed to add FF-A shared buffer to runtime map (%lu)\n",
> + ret);
> + return ret;
> + }
> + log_info("EFI: FF-A shared buffer runtime map: addr=0x%lx size=0x%lx\n",
> + (ulong)CONFIG_FFA_SHARED_MM_BUF_ADDR,
> + (ulong)CONFIG_FFA_SHARED_MM_BUF_SIZE);
> + }
> +
> return EFI_SUCCESS;
> }
> --
> 2.34.1
>
I am trying to go throughh the patches, but they are way too big for
proper review. Please split in a number of independently reviewable
patches.
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v3 02/10] arm-ffa: add FF-A bus runtime support
2026-06-27 14:44 ` [PATCH v3 02/10] arm-ffa: add FF-A bus runtime support Harsimran Singh Tungal
2026-06-29 18:12 ` Abdellatif El Khlifi
2026-07-01 12:59 ` Ilias Apalodimas
@ 2026-07-01 13:59 ` Ilias Apalodimas
2 siblings, 0 replies; 22+ messages in thread
From: Ilias Apalodimas @ 2026-07-01 13:59 UTC (permalink / raw)
To: Harsimran Singh Tungal
Cc: u-boot, Abdellatif El Khlifi, Tom Rini, Heinrich Schuchardt,
Hugues Kamba Mpiana, Simon Glass
[...]
> +
> +/**
> + * ffa_sync_send_receive_runtime() - Runtime implementation of
> + * ffa_sync_send_receive()
> + * @dst_part_id: destination partition ID
> + * @msg: pointer to the message data preallocated by the client (in/out)
> + * @is_smc64: select 64-bit or 32-bit FF-A ABI
[...]
Just out of curiocity. Why can't we use the runtime part in boot time
as well and keep one function?
Thanks
/Ilias
^ permalink raw reply [flat|nested] 22+ messages in thread
end of thread, other threads:[~2026-07-01 14:00 UTC | newest]
Thread overview: 22+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-27 14:44 [PATCH v3 00/10] arm64: FF-A runtime transport for EFI variables Harsimran Singh Tungal
2026-06-27 14:44 ` [PATCH v3 01/10] efi_loader: add runtime memset helper Harsimran Singh Tungal
2026-06-29 18:21 ` Abdellatif El Khlifi
2026-06-27 14:44 ` [PATCH v3 02/10] arm-ffa: add FF-A bus runtime support Harsimran Singh Tungal
2026-06-29 18:12 ` Abdellatif El Khlifi
2026-07-01 12:59 ` Ilias Apalodimas
2026-07-01 13:59 ` Ilias Apalodimas
2026-06-27 14:44 ` [PATCH v3 03/10] efi_loader: add FF-A runtime support in EFI variable TEE driver Harsimran Singh Tungal
2026-06-29 18:40 ` Abdellatif El Khlifi
2026-07-01 13:56 ` Ilias Apalodimas
2026-06-27 14:44 ` [PATCH v3 04/10] efi_loader: enable EFI runtime SetVariable()/GetVariable() using FF-A transport Harsimran Singh Tungal
2026-07-01 13:49 ` Ilias Apalodimas
2026-06-27 14:44 ` [PATCH v3 05/10] charset: mark u16_strsize() as __efi_runtime Harsimran Singh Tungal
2026-06-27 18:50 ` Ilias Apalodimas
2026-06-29 18:28 ` Abdellatif El Khlifi
2026-06-27 14:44 ` [PATCH v3 06/10] corstone1000: enable bootefi selftest Harsimran Singh Tungal
2026-06-29 18:44 ` Abdellatif El Khlifi
2026-06-27 14:44 ` [PATCH v3 07/10] efi: selftest: add runtime variable tests with non-volatile storage Harsimran Singh Tungal
2026-06-27 14:44 ` [PATCH v3 08/10] test: dm: add sandbox FF-A runtime transport tests Harsimran Singh Tungal
2026-06-27 14:44 ` [PATCH v3 09/10] doc: arm64: document FF-A runtime path for EFI variables Harsimran Singh Tungal
2026-06-29 18:15 ` Abdellatif El Khlifi
2026-06-27 14:44 ` [PATCH v3 10/10] doc: bootefi: note two-phase runtime variables selftest Harsimran Singh Tungal
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.