Re: [PATCH RFC 1/3] firmware: arm_firme: introduce arm_firme driver

[Yeoreum Yun]

On Thu, Oct 22, 2026 at 06:48:49PM +0900, Kohei Enju wrote:
> On 10/19 15:14, Yeoreum Yun wrote:
> > The Realm Management Extension (FEAT_RME) is part of Arm Confidential
> > Compute Architecture (CCA) and enables support for dynamic, attestable
> > trusted execution environments ("Realms") on Arm systems.
> > 
> > Realm management flows depend on EL3 firmware for operations such as
> > Realm construction, resource allocation and isolation, and attestation
> > of initial Realm state.
> > 
> > The FIRME defines standard interfaces provided by EL3 firmware to
> > satisfy these dependencies. These interfaces include:
> > 
> >   - Granule Protection Table management
> >   - IDE key management for PCIe and CXL Root Ports
> >   - Memory Encryption Context management
> >   - Attestation token management
> >   - Integrated device management
> > 
> > Each group of interfaces forms a FIRME service. A base FIRME service
> > is also defined to provide common concepts, service discovery, and
> > feature discovery across services.
> > 
> > FIRME interfaces are implemented at the EL3 boundary between the
> > Non-secure, Realm, and Secure states. They may also be used on systems
> > without FEAT_RME, for example to provide firmware-based attestation or
> > security services.
> > 
> > arm_firme driver provides the common FIRME framework and service discovery
> > support for client drivers using below FIRME services:
> > 
> >   - Base service.
> >   - Attestation token management.
> > 
> > Signed-off-by: Yeoreum Yun <yeoreum.yun@xxxxxxx>
> 
> Does this series assume that the kernel is running in EL2 implicitly?
> 
> The FIRME spec says:
>   An implementation of one or more FIRME services at a valid Exception level boundary between EL3 and the
>   highest Exception level in a different Security state is called a FIRME instance.
> 
> and I think only NS-EL2 can call FIRME interfaces as a NS FIRME
> instance, right?

Yeap. but it doens't forbid calling the FIRME from EL1 too.
As a just example, when the host running with pkvm, it could use
where kernel running as EL1.

[...]

-- 
Sincerely,
Yeoreum Yun