Re: [PATCH v4 00/22] arm64: FF-A runtime transport for EFI variables

On 7/30/26 13:12, Ilias Apalodimas wrote:
> Hi Peter,
>
>>
>> Hi Ilias,
>>
>>> I'll be off next week so this is going to take some time for a wider review.
>>> Since this is quite a lot of code to review, I'd prefer being able to
>>> test all of the cases to make sure nothing breaks and add more
>>> selftests in the future. I don't have access to a Corstone-1000.  The
>>
>> You can get the Corstone-1K FVP here:
>> https://corstone1000.docs.arm.com/en/corstone1000-2026.05/index.html
>>
>
> Ok thanks. I'd still prefer to have this on QEMU since we can
> reproduce all the cases there (variables in RPMB as of today + the
> FF-A variant). Even if we do use the FVP, I'd like to have information
> of how to build & test this as part of the cover letter, since Tom
> includes that in pull requests.
>
> Cheers
> /Ilias

Hi Ilias,

The instructions to build the Corstone-1000 FVP can be found here:
https://corstone1000.docs.arm.com/en/corstone1000-2026.05/user-guide.html.

For the QEMU/RPMB/OP-TEE question: QEMU RPMB would cover the storage
backend, but the FF-A runtime transport also needs the secure world to
expose the MM variable service through an FF-A secure partition. OP-TEE
alone would exercise the existing CONFIG_EFI_MM_COMM_TEE transport, not
the FF-A runtime transport, unless OP-TEE/SPMC is hosting an FF-A SP
that implements the same MM variable communication protocol.

For Corstone-1000 we are already using the Trusted Services SMM Gateway
SP. That SP implements the MM variable service and exposes the MM
Communicate endpoint over FF-A direct messages, which is the path used
by this series.

I agree that QEMU would be better for wider review and CI. I will have
to investigate the QEMU setup using the same SMM Gateway SP along with
OP-TEE/SPMC and RPMB, so we can reproduce the FF-A runtime variable path
without access to Corstone-1000.

Do you suggest that I investigate this QEMU setup for the
next revision?

The setup I am currently testing is Corstone-1000 FVP with the MM
variable service exposed through FF-A. The FF-A runtime path is tested
in two phases as follows:

The first phase (setup phase) creates the non-volatile runtime variable
before reset. On U-Boot prompt:

corstone1000# setenv efi_selftest 'variables at runtime setup'
corstone1000# bootefi selftest


Then reset the Corstone-1000 FVP and run the second phase.
The second phase verifies that the variable is available after reset,
then exercises runtime get/set/append/delete paths.
On U-Boot prompt after reset, execute the following commands:

corstone1000# setenv efi_selftest 'variables at runtime verify'
corstone1000# bootefi selftest

The testing steps are documented in the bootefi documentation commit:
doc: bootefi: note two-phase runtime variables selftest

For v5, I can add these tested steps to the cover letter.

Thanks
Harsimran Singh Tungal

>>> latest version of QEMU do support emulating an RPMB device. Would the
>>> changes above work with with an SP, QEMU RPMB and OP-TEE?
>>>
>>> Thanks
>>> /Ilias
>>>
>>> On Wed, 29 Jul 2026 at 11:51, Harsimran Singh Tungal
>>> <[email protected]> wrote:
>>>>
>>>> Hi all,
>>>>
>>>> This series adds FF-A runtime transport support so EFI variable runtime
>>>> services can communicate with the secure world after ExitBootServices().
>>>> It also extends tests, documentation, and Corstone-1000 configuration to
>>>> validate the runtime path and keep boot-time behavior aligned with the
>>>> runtime flow.
>>>>
>>>> Changes in this series:
>>>> - Add EFI runtime-safe memset helper and FF-A runtime transport support.
>>>> - Add runtime-safe FF-A direct-message handling and ExitBootServices setup.
>>>> - Implement FF-A runtime communication in the EFI variable TEE backend.
>>>> - Enable EFI runtime SetVariable(), GetVariable(), GetNextVariableName(),
>>>>    and QueryVariableInfo() over the FF-A transport.
>>>> - Add sandbox FF-A runtime transport tests.
>>>> - Extend EFI selftests for runtime variables and enable bootefi selftest
>>>>    on Corstone-1000.
>>>> - Document the FF-A runtime transport and runtime-variable selftest flow.
>>>>
>>>> Changes in v4:
>>>>
>>>> Address Ilias Apalodimas's review comments:
>>>> - Split FF-A bus runtime support into smaller patches covering runtime
>>>>    private data, SMC invocation, direct-message helpers, boot-time reuse,
>>>>    and ExitBootServices setup.
>>>> - Split the ARMv8 cache range-maintenance runtime annotations into a
>>>>    separate patch.
>>>> - Split the EFI variable TEE runtime SetVariable(), GetVariable(),
>>>>    GetNextVariableName(), and QueryVariableInfo() support into separate
>>>>    patches.
>>>> - Replace MM SP status macros with an enum.
>>>> - Keep OP-TEE as the runtime fallback when FF-A runtime mode is not
>>>>    enabled.
>>>>
>>>> Other changes:
>>>> - Rebased the series onto current U-Boot master.
>>>>
>>>> Changes in v3:
>>>>
>>>> Address Simon Glass's review comments:
>>>> - Move FF-A ExitBootServices event registration to the end of probe and
>>>>    clean up RX/TX buffer handling on failure.
>>>> - Rename FF-A runtime-context helpers to the ffa_runtime_context_* form.
>>>> - Rework FF-A/MM cache maintenance to cover only rounded request and
>>>>    response ranges.
>>>> - Add SetVirtualAddressMap handling for the FF-A shared buffer.
>>>> - Document FF-A shared-buffer ownership and alignment assumptions.
>>>> - Add EFIAPI to the TEE runtime GetVariable and GetNextVariableName
>>>>    entry points.
>>>> - Tighten sandbox FF-A runtime tests and reset runtime state between
>>>>    test cases.
>>>> - Update FF-A and bootefi documentation for the runtime transport and
>>>>    split runtime-variable selftests.
>>>> - Rework commit messages to drop redundant information.
>>>>
>>>> Address Ilias Apalodimas's review comments:
>>>> - Keep efi_var_common.c unchanged and drop commit 6 from v2 patchset.
>>>> - Rename the TEE/FF-A runtime handlers to the *_int_runtime form.
>>>> - Remove log_*() calls from __efi_runtime FF-A/MM communication paths.
>>>>
>>>> Other:
>>>> - Fix FF-A memory-share sender_id to use the runtime private endpoint
>>>>    ID after rebasing.
>>>> - Fix the expected QueryVariableInfo() return status for the
>>>>    TEE-backed runtime selftest path.
>>>>
>>>>
>>>> Changes in v2:
>>>>
>>>> Address Simon Glass's review comments:
>>>> - Fix efi_memset_runtime() style, declaration, and byte cast
>>>> - Tighten the FF-A runtime context failure path, clean up arm-ffa-runtime.c
>>>>    style issues, and move ExitBootServices event registration earlier in probe
>>>> - Add shared-buffer bounds/alignment checks, and tightening comments/kernel-doc
>>>> - Document the FF-A shared buffer cacheline-alignment requirement and add
>>>>    BUILD_BUG_ON() checks for the address
>>>> - Cache attributes before the shared buffer is reused, moving the read-only
>>>>    check earlier, and split the u16_strsize() related change in separate patch
>>>> - Reword commit messages for the runtime helper relocation
>>>> - Rework the non-volatile runtime variable selftest into setup/verify phases
>>>> - Extend the sandbox FF-A runtime tests with no-context coverage,
>>>>    runtime-context reset, and separate errno-mapping coverage
>>>> - Refresh the FF-A runtime transport and bootefi documentation
>>>> - Drop patch 12 in v1, as ffa_mm_communicate handles both runtime and
>>>>    boottime capabilities in v2
>>>> - Squash patch 8 and patch 9 from v1
>>>>
>>>> Address Ilias Apalodimas's review comments:
>>>> - Reuse common MM SP error mapping for boot and runtime paths
>>>> - Rename runtime-phase tracking to reflect the ExitBootServices transition
>>>> - Collapse duplicated boot-time and runtime MM communication helpers into common
>>>>    implementations
>>>> - Keep the arm64 cache-maintenance path runtime-safe
>>>> - Move FF-A shared-buffer runtime memory-map registration to the end of
>>>>    variable-service initialization
>>>>
>>>> Link to v3: https://lore.kernel.org/u-boot/[email protected]/
>>>> Link to v2: https://lore.kernel.org/u-boot/[email protected]/
>>>> Link to v1: https://lore.kernel.org/u-boot/[email protected]/
>>>>
>>>> Harsimran Singh Tungal (22):
>>>>    efi_loader: add runtime memset helper
>>>>    arm-ffa: store boot-discovered runtime data separately
>>>>    arm-ffa: add runtime-safe FF-A SMC wrapper
>>>>    arm-ffa: add runtime direct-message support
>>>>    arm-ffa: reuse direct-message helper at boot time
>>>>    arm-ffa: enable runtime context at ExitBootServices
>>>>    arm: cache: keep range maintenance available at EFI runtime
>>>>    efi_loader: add MM SP status mapping for FF-A variables
>>>>    efi_loader: make MM transport selection runtime-safe
>>>>    efi_loader: make FF-A MM SP notification runtime-safe
>>>>    efi_loader: make FF-A MM communication runtime-safe
>>>>    efi_loader: reserve FF-A shared buffer for runtime variables
>>>>    efi_loader: enable TEE runtime SetVariable() over FF-A
>>>>    efi_loader: enable TEE runtime GetVariable() over FF-A
>>>>    efi_loader: enable TEE runtime GetNextVariableName() over FF-A
>>>>    efi_loader: enable TEE runtime QueryVariableInfo() over FF-A
>>>>    charset: mark u16_strsize() as __efi_runtime
>>>>    corstone1000: enable bootefi selftest
>>>>    efi: selftest: add runtime variable tests with non-volatile storage
>>>>    test: dm: add sandbox FF-A runtime transport tests
>>>>    doc: arm64: document FF-A runtime path for EFI variables
>>>>    doc: bootefi: note two-phase runtime variables selftest
>>>>
>>>>   arch/arm/cpu/armv8/cache.S                    |   8 +
>>>>   arch/arm/cpu/armv8/cache_v8.c                 |  13 +-
>>>>   arch/sandbox/include/asm/sandbox_arm_ffa.h    |  16 +-
>>>>   configs/corstone1000_defconfig                |   3 +
>>>>   doc/arch/arm64.ffa.rst                        |  88 ++-
>>>>   doc/usage/cmd/armffa.rst                      |  11 +
>>>>   doc/usage/cmd/bootefi.rst                     |  31 +
>>>>   drivers/firmware/arm-ffa/Kconfig              |  11 +
>>>>   drivers/firmware/arm-ffa/Makefile             |   4 +-
>>>>   drivers/firmware/arm-ffa/arm-ffa-runtime.c    | 294 +++++++
>>>>   drivers/firmware/arm-ffa/arm-ffa-uclass.c     | 114 +--
>>>>   drivers/firmware/arm-ffa/arm-ffa.c            |  16 +-
>>>>   drivers/firmware/arm-ffa/ffa-emul-uclass.c    |  49 +-
>>>>   include/arm_ffa.h                             |  16 +-
>>>>   include/arm_ffa_priv.h                        |  22 +-
>>>>   include/arm_ffa_runtime.h                     | 191 +++++
>>>>   include/efi_loader.h                          |   3 +
>>>>   lib/charset.c                                 |   2 +-
>>>>   lib/efi_loader/Kconfig                        |   4 +
>>>>   lib/efi_loader/efi_runtime.c                  |  20 +
>>>>   lib/efi_loader/efi_variable_tee.c             | 739 +++++++++++++++---
>>>>   .../efi_selftest_variables_runtime.c          | 715 +++++++++++------
>>>>   test/dm/Makefile                              |   3 +-
>>>>   test/dm/ffa.c                                 |   6 +-
>>>>   test/dm/ffa_runtime.c                         | 123 +++
>>>>   25 files changed, 2004 insertions(+), 498 deletions(-)
>>>>   create mode 100644 drivers/firmware/arm-ffa/arm-ffa-runtime.c
>>>>   create mode 100644 include/arm_ffa_runtime.h
>>>>   create mode 100644 test/dm/ffa_runtime.c
>>>>
>>>> --
>>>> 2.34.1
>>>>

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.