Add the FF-A runtime transport implementation needed after ExitBootServices() so EFI runtime services can continue to exchange direct messages with secure partitions. The runtime code keeps resident FF-A private data, tracks whether the runtime context is ready, translates FF-A error codes, and exposes ffa_sync_send_receive_runtime() for FFA_MSG_SEND_DIRECT_REQ/RESP.
Add the ARM_FFA_RT_MODE Kconfig option and build arm-ffa-runtime.c when FF-A transport and EFI loader support are enabled. Move FF-A errno translation out of arm-ffa-uclass.c so boot-time and runtime callers use the same mapping. Tag the runtime code and data with __efi_runtime and __efi_runtime_data so they remain available after ExitBootServices(). The runtime direct-message path uses invoke_ffa_fn_runtime() and rejects requests until the runtime context has been enabled. Reviewed-by: Simon Glass <[email protected]> Acked-by: Abdellatif El Khlifi <[email protected]> Signed-off-by: Harsimran Singh Tungal <[email protected]> --- drivers/firmware/arm-ffa/Kconfig | 11 + drivers/firmware/arm-ffa/Makefile | 4 +- drivers/firmware/arm-ffa/arm-ffa-runtime.c | 251 +++++++++++++++++++++ drivers/firmware/arm-ffa/arm-ffa-uclass.c | 35 +-- include/arm_ffa_runtime.h | 132 +++++++++++ 5 files changed, 397 insertions(+), 36 deletions(-) create mode 100644 drivers/firmware/arm-ffa/arm-ffa-runtime.c diff --git a/drivers/firmware/arm-ffa/Kconfig b/drivers/firmware/arm-ffa/Kconfig index 3706a889305..7aaf25fdb58 100644 --- a/drivers/firmware/arm-ffa/Kconfig +++ b/drivers/firmware/arm-ffa/Kconfig @@ -18,6 +18,9 @@ config ARM_FFA_TRANSPORT The FF-A support in U-Boot is based on FF-A specification v1.0 and uses SMC32 calling convention. + The FF-A bus also provides a runtime layer to keep a minimal set of FF-A + operations available after ExitBootServices(). + FF-A specification: https://developer.arm.com/documentation/den0077/a/?lang=en @@ -41,3 +44,11 @@ config ARM_FFA_TRANSPORT Secure World (sandbox_ffa.c). For more details about the FF-A support, please refer to doc/arch/arm64.ffa.rst + +config ARM_FFA_RT_MODE + bool "Enable FF-A runtime support" + depends on ARM_FFA_TRANSPORT && EFI_LOADER + default y + help + Enable the FF-A runtime layer, keeping a minimal set of FF-A + operations available after ExitBootServices(). diff --git a/drivers/firmware/arm-ffa/Makefile b/drivers/firmware/arm-ffa/Makefile index 318123a7f42..9deb59ba640 100644 --- a/drivers/firmware/arm-ffa/Makefile +++ b/drivers/firmware/arm-ffa/Makefile @@ -1,12 +1,12 @@ # SPDX-License-Identifier: GPL-2.0+ # -# Copyright 2022-2023 Arm Limited and/or its affiliates <[email protected]> +# Copyright 2022-2023, 2026 Arm Limited and/or its affiliates <[email protected]> # # Authors: # Abdellatif El Khlifi <[email protected]> # build the generic FF-A methods -obj-y += arm-ffa-uclass.o +obj-y += arm-ffa-uclass.o arm-ffa-runtime.o ifeq ($(CONFIG_SANDBOX),y) # build the FF-A sandbox emulator and driver obj-y += ffa-emul-uclass.o sandbox_ffa.o diff --git a/drivers/firmware/arm-ffa/arm-ffa-runtime.c b/drivers/firmware/arm-ffa/arm-ffa-runtime.c new file mode 100644 index 00000000000..d761ec9ee07 --- /dev/null +++ b/drivers/firmware/arm-ffa/arm-ffa-runtime.c @@ -0,0 +1,251 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright 2026 Arm Limited and/or its affiliates <[email protected]> + * + * Authors: + * Harsimran Singh Tungal <[email protected]> + * Abdellatif El Khlifi <[email protected]> + */ + +#include <arm_ffa_runtime.h> +#include <arm_ffa_priv.h> +#include <log.h> +#include <linux/errno.h> +#include <linux/types.h> + +/* Error mapping declarations */ + +int __ffa_runtime_data ffa_to_std_errmap[MAX_NUMBER_FFA_ERR] = { + [NOT_SUPPORTED] = -EOPNOTSUPP, + [INVALID_PARAMETERS] = -EINVAL, + [NO_MEMORY] = -ENOMEM, + [BUSY] = -EBUSY, + [INTERRUPTED] = -EINTR, + [DENIED] = -EACCES, + [RETRY] = -EAGAIN, + [ABORTED] = -ECANCELED, +}; + +static __ffa_runtime_data struct ffa_priv_runtime ffa_priv_rt = {0}; +static __ffa_runtime_data bool ffa_runtime_enabled; + +/* Arm FF-A driver runtime operations */ +static const __ffa_runtime_data struct ffa_bus_ops_runtime ffa_ops_rt = { + .sync_send_receive = ffa_msg_send_direct_req_hdlr_runtime, +}; + +#define ffa_get_ops_runtime() (&ffa_ops_rt) +#define ffa_get_priv_runtime() (&ffa_priv_rt) + +/** + * ffa_copy_runtime_priv() - copy runtime data into resident storage + * @priv: pointer to the runtime private data + * + * Copy boot-time runtime data into the resident runtime storage to be used + * after ExitBootServices(). + */ +void ffa_copy_runtime_priv(const struct ffa_priv_runtime *priv) +{ + struct ffa_priv_runtime *priv_rt = ffa_get_priv_runtime(); + + if (priv) + *priv_rt = *priv; +} + +/** + * ffa_runtime_context_enable() - Enable FF-A runtime context + * + * This function marks the FF-A runtime environment as ready for use by + * EFI runtime services. It is called when ExitBootServices() is invoked, + * after the FF-A bus device has successfully probed and U-Boot's FF-A + * endpoint ID has been discovered and stored in the runtime private data + * structure. + * + * The FF-A runtime flag allows the EFI runtime layer to verify that the + * FF-A transport was initialized during the boot phase and that all + * runtime-safe FF-A operations may now be used after ExitBootServices(). + * + */ +void ffa_runtime_context_enable(void) +{ + ffa_runtime_enabled = true; +} + +/** + * ffa_runtime_context_reset() - Reset FF-A runtime resident state + * + * Clear the resident runtime flag and private data. This is used by the + * FF-A unit tests to avoid leaking runtime state across test cases. + */ +void ffa_runtime_context_reset(void) +{ + struct ffa_priv_runtime *priv_rt = ffa_get_priv_runtime(); + + *priv_rt = (struct ffa_priv_runtime){0}; + ffa_runtime_enabled = false; +} + +/** + * ffa_runtime_context_ready() - Query FF-A runtime readiness + * + * This helper returns whether the FF-A runtime environment has been + * enabled during the boot phase. Runtime FF-A operations must check this + * flag before attempting any FF-A access, as the U-Boot driver model + * (DM/uclass) is no longer available after ExitBootServices(). + * + * The runtime context becomes enabled when ffa_runtime_context_enable() + * is called, typically after the FF-A bus device has probed and the + * endpoint ID has been discovered and stored in the runtime private + * data structure. + * + * Return: true if FF-A runtime support is ready, false otherwise. + */ +bool __ffa_runtime ffa_runtime_context_ready(void) +{ + return ffa_runtime_enabled; +} + +/** + * ffa_to_std_errno() - convert FF-A error code to standard error code + * @ffa_errno: Error code returned by the FF-A ABI + * + * Map the given FF-A error code as specified + * by the spec to a u-boot standard error code. + * + * Return: Standard U-Boot errno for known FF-A errors, or -EINVAL otherwise. + */ +int __ffa_runtime ffa_to_std_errno(int ffa_errno) +{ + int err_idx = -ffa_errno; + + /* Map the FF-A error code to the standard u-boot error code */ + if (err_idx > 0 && err_idx < MAX_NUMBER_FFA_ERR) + return ffa_to_std_errmap[err_idx]; + return -EINVAL; +} + +/** + * ffa_invoke_msg_send_direct_req() - Invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} + * @endpoint_id: u-boot endpoint id + * @dst_part_id: destination partition ID + * @msg: pointer to the message data preallocated by the client (in/out) + * @is_smc64: select 64-bit or 32-bit FF-A ABI + * + * This function invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} FF-A functions. + * + * FFA_MSG_SEND_DIRECT_REQ is used to send the data to the secure partition. + * The response from the secure partition is handled by reading the + * FFA_MSG_SEND_DIRECT_RESP arguments. + * + * The maximum size of the data that can be exchanged is 40 bytes which is + * sizeof(struct ffa_send_direct_data) as defined by the FF-A specification 1.0 + * in the section relevant to FFA_MSG_SEND_DIRECT_{REQ,RESP} + * + * Return: 0 on success, negative errno on failure. + */ +int __ffa_runtime ffa_invoke_msg_send_direct_req(u16 endpoint_id, u16 dst_part_id, + struct ffa_send_direct_data *msg, bool is_smc64) +{ + int ffa_errno; + u64 req_mode; + ffa_value_t ffa_args_rt; + ffa_value_t ffa_res_rt; + + if (is_smc64) + req_mode = FFA_SMC_64(FFA_MSG_SEND_DIRECT_REQ); + else + req_mode = FFA_SMC_32(FFA_MSG_SEND_DIRECT_REQ); + efi_memset_runtime(&ffa_args_rt, 0, sizeof(ffa_args_rt)); + efi_memset_runtime(&ffa_res_rt, 0, sizeof(ffa_res_rt)); + ffa_args_rt.a0 = req_mode; + ffa_args_rt.a1 = PREP_SELF_ENDPOINT_ID(endpoint_id) | + PREP_PART_ENDPOINT_ID(dst_part_id); + ffa_args_rt.a2 = 0; + ffa_args_rt.a3 = msg->data0; + ffa_args_rt.a4 = msg->data1; + ffa_args_rt.a5 = msg->data2; + ffa_args_rt.a6 = msg->data3; + ffa_args_rt.a7 = msg->data4; + + invoke_ffa_fn_runtime(&ffa_args_rt, &ffa_res_rt); + + while (ffa_res_rt.a0 == FFA_SMC_32(FFA_INTERRUPT) || + ffa_res_rt.a0 == FFA_SMC_64(FFA_INTERRUPT)) { + efi_memset_runtime(&ffa_args_rt, 0, sizeof(ffa_args_rt)); + ffa_args_rt.a0 = (ffa_res_rt.a0 == FFA_SMC_64(FFA_INTERRUPT)) ? + FFA_SMC_64(FFA_RUN) : FFA_SMC_32(FFA_RUN); + ffa_args_rt.a1 = ffa_res_rt.a1; + + invoke_ffa_fn_runtime(&ffa_args_rt, &ffa_res_rt); + } + if (ffa_res_rt.a0 == FFA_SMC_32(FFA_SUCCESS) || + ffa_res_rt.a0 == FFA_SMC_64(FFA_SUCCESS)) { + /* Message sent with no response */ + return 0; + } + + if (ffa_res_rt.a0 == FFA_SMC_32(FFA_MSG_SEND_DIRECT_RESP) || + ffa_res_rt.a0 == FFA_SMC_64(FFA_MSG_SEND_DIRECT_RESP)) { + /* Message sent with response extract the return data */ + msg->data0 = ffa_res_rt.a3; + msg->data1 = ffa_res_rt.a4; + msg->data2 = ffa_res_rt.a5; + msg->data3 = ffa_res_rt.a6; + msg->data4 = ffa_res_rt.a7; + return 0; + } + + ffa_errno = ffa_res_rt.a2; + return ffa_to_std_errno(ffa_errno); +} + +/** + * ffa_msg_send_direct_req_hdlr_runtime() - Runtime implementation of + * FFA_MSG_SEND_DIRECT_{REQ,RESP} handler function + * @dst_part_id: destination partition ID + * @msg: pointer to the message data preallocated by the client (in/out) + * @is_smc64: select 64-bit or 32-bit FF-A ABI + * + * This function calls the ffa_invoke_msg_send_direct_req() function which + * invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} FF-A functions. + * + * Return: + * + * 0 on success. Otherwise, failure + */ +int __ffa_runtime ffa_msg_send_direct_req_hdlr_runtime(u16 dst_part_id, + struct ffa_send_direct_data *msg, + bool is_smc64) +{ + struct ffa_priv_runtime *priv_rt = ffa_get_priv_runtime(); + + return ffa_invoke_msg_send_direct_req(priv_rt->id, dst_part_id, msg, is_smc64); +} + +/** + * ffa_sync_send_receive_runtime() - Runtime implementation of + * ffa_sync_send_receive() + * @dst_part_id: destination partition ID + * @msg: pointer to the message data preallocated by the client (in/out) + * @is_smc64: select 64-bit or 32-bit FF-A ABI + * + * Please see ffa_msg_send_direct_req_hdlr_runtime() description for more details. + * + * Return: + * + * 0 on success. Otherwise, failure + */ +int __ffa_runtime ffa_sync_send_receive_runtime(u16 dst_part_id, + struct ffa_send_direct_data *msg, + bool is_smc64) +{ + const struct ffa_bus_ops_runtime *ops_rt = ffa_get_ops_runtime(); + + if (!ffa_runtime_context_ready()) + return -EPERM; + + if (!ops_rt->sync_send_receive) + return -ENOSYS; + + return ops_rt->sync_send_receive(dst_part_id, msg, is_smc64); +} diff --git a/drivers/firmware/arm-ffa/arm-ffa-uclass.c b/drivers/firmware/arm-ffa/arm-ffa-uclass.c index eb159dbfade..13e22a1b7f7 100644 --- a/drivers/firmware/arm-ffa/arm-ffa-uclass.c +++ b/drivers/firmware/arm-ffa/arm-ffa-uclass.c @@ -7,6 +7,7 @@ */ #include <arm_ffa.h> #include <arm_ffa_priv.h> +#include <arm_ffa_runtime.h> #include <dm.h> #include <log.h> #include <malloc.h> @@ -18,19 +19,6 @@ #include <linux/errno.h> #include <linux/sizes.h> -/* Error mapping declarations */ - -int ffa_to_std_errmap[MAX_NUMBER_FFA_ERR] = { - [NOT_SUPPORTED] = -EOPNOTSUPP, - [INVALID_PARAMETERS] = -EINVAL, - [NO_MEMORY] = -ENOMEM, - [BUSY] = -EBUSY, - [INTERRUPTED] = -EINTR, - [DENIED] = -EACCES, - [RETRY] = -EAGAIN, - [ABORTED] = -ECANCELED, -}; - static struct ffa_abi_errmap err_msg_map[FFA_ERRMAP_COUNT] = { [FFA_ID_TO_ERRMAP_ID(FFA_VERSION)] = { { @@ -94,27 +82,6 @@ static struct ffa_abi_errmap err_msg_map[FFA_ERRMAP_COUNT] = { }, }; -/** - * ffa_to_std_errno() - convert FF-A error code to standard error code - * @ffa_errno: Error code returned by the FF-A ABI - * - * Map the given FF-A error code as specified - * by the spec to a u-boot standard error code. - * - * Return: - * - * The standard error code on success. . Otherwise, failure - */ -static int ffa_to_std_errno(int ffa_errno) -{ - int err_idx = -ffa_errno; - - /* Map the FF-A error code to the standard u-boot error code */ - if (err_idx > 0 && err_idx < MAX_NUMBER_FFA_ERR) - return ffa_to_std_errmap[err_idx]; - return -EINVAL; -} - /** * ffa_print_error_log() - print the error log corresponding to the selected FF-A ABI * @ffa_id: FF-A ABI ID diff --git a/include/arm_ffa_runtime.h b/include/arm_ffa_runtime.h index 66096db3d24..77b528745e8 100644 --- a/include/arm_ffa_runtime.h +++ b/include/arm_ffa_runtime.h @@ -12,6 +12,7 @@ #include <linux/types.h> #include <arm_ffa.h> +#include <arm_ffa_priv.h> #include <efi_loader.h> /** @@ -38,4 +39,135 @@ */ void __ffa_runtime invoke_ffa_fn_runtime(ffa_value_t *args, ffa_value_t *res); +/** + * struct ffa_bus_ops_runtime - Operations for FF-A runtime + * @sync_send_receive: callback for the FFA_MSG_SEND_DIRECT_REQ + * + * The data structure providing all the runtime operations supported by the driver. + * This structure is an EFI runtime resident. + */ +struct ffa_bus_ops_runtime { + int (*sync_send_receive)(u16 dst_part_id, struct ffa_send_direct_data *msg, + bool is_smc64); +}; + +/** + * ffa_runtime_context_enable() - Enable FF-A runtime context + * + * This function marks the FF-A runtime environment as ready for use by + * EFI runtime services. It is called when ExitBootServices() is invoked, + * after the FF-A bus device has successfully probed and U-Boot's FF-A + * endpoint ID has been discovered and stored in the runtime private data + * structure. + * + * The FF-A runtime flag allows the EFI runtime layer to verify that the + * FF-A transport was initialized during the boot phase and that all + * runtime-safe FF-A operations may now be used after ExitBootServices(). + * + */ +void ffa_runtime_context_enable(void); + +/** + * ffa_runtime_context_reset() - Reset FF-A runtime resident state + * + * Clear the resident runtime flag and private data. This is used by the + * FF-A unit tests to avoid leaking runtime state across test cases. + */ +void ffa_runtime_context_reset(void); + +/** + * ffa_copy_runtime_priv() - copy runtime data into resident storage + * @priv: pointer to the runtime private data + * + * Copy boot-time runtime data into the resident runtime storage to be used + * after ExitBootServices(). + */ +void ffa_copy_runtime_priv(const struct ffa_priv_runtime *priv); + +/** + * ffa_runtime_context_ready() - Query FF-A runtime readiness + * + * This helper returns whether the FF-A runtime environment has been + * enabled during the boot phase. Runtime FF-A operations must check this + * flag before attempting any FF-A access, as the U-Boot driver model + * (DM/uclass) is no longer available after ExitBootServices(). + * + * The runtime context becomes enabled when ffa_runtime_context_enable() + * is called, typically after the FF-A bus device has probed and the + * endpoint ID has been discovered and stored in the runtime private + * data structure. + * + * Return: true if FF-A runtime support is ready, false otherwise. + */ +bool __ffa_runtime ffa_runtime_context_ready(void); + +/** + * ffa_to_std_errno() - convert FF-A error code to standard error code + * @ffa_errno: Error code returned by the FF-A ABI + * + * Map the given FF-A error code as specified + * by the spec to a u-boot standard error code. + * + * Return: Standard U-Boot errno for known FF-A errors, or -EINVAL otherwise. + */ +int __ffa_runtime ffa_to_std_errno(int ffa_errno); + +/** + * ffa_sync_send_receive_runtime() - Runtime implementation of + * ffa_sync_send_receive() + * @dst_part_id: destination partition ID + * @msg: pointer to the message data preallocated by the client (in/out) + * @is_smc64: select 64-bit or 32-bit FF-A ABI + * + * Please see ffa_msg_send_direct_req_hdlr_runtime() description for more details. + * + * Return: 0 on success, negative errno on failure. + */ +int __ffa_runtime ffa_sync_send_receive_runtime(u16 dst_part_id, + struct ffa_send_direct_data *msg, + bool is_smc64); + +/** + * ffa_invoke_msg_send_direct_req() - Invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} + * @endpoint_id: u-boot endpoint id + * @dst_part_id: destination partition ID + * @msg: pointer to the message data preallocated by the client (in/out) + * @is_smc64: select 64-bit or 32-bit FF-A ABI + * + * This function invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} FF-A functions. + * + * FFA_MSG_SEND_DIRECT_REQ is used to send the data to the secure partition. + * The response from the secure partition is handled by reading the + * FFA_MSG_SEND_DIRECT_RESP arguments. + * + * The maximum size of the data that can be exchanged is 40 bytes which is + * sizeof(struct ffa_send_direct_data) as defined by the FF-A specification 1.0 + * in the section relevant to FFA_MSG_SEND_DIRECT_{REQ,RESP} + * + * Return: + * + * 0 on success. Otherwise, error on failure + */ +int __ffa_runtime ffa_invoke_msg_send_direct_req(u16 endpoint_id, u16 dst_part_id, + struct ffa_send_direct_data *msg, + bool is_smc64); + +/** + * ffa_msg_send_direct_req_hdlr_runtime() - Runtime implementation of + * FFA_MSG_SEND_DIRECT_{REQ,RESP} handler function + * @dst_part_id: destination partition ID + * @msg: pointer to the message data preallocated by the client (in/out) + * @is_smc64: select 64-bit or 32-bit FF-A ABI + * + * This function calls the ffa_invoke_msg_send_direct_req() function which + * invokes FFA_MSG_SEND_DIRECT_{REQ,RESP} FF-A functions. + * + * Return: + * + * 0 on success. Otherwise, failure + */ +int __ffa_runtime ffa_msg_send_direct_req_hdlr_runtime(u16 dst_part_id, + struct ffa_send_direct_data *msg, + bool is_smc64); + #endif -- 2.34.1
