Re: [PATCH v4 2/8] firmware: smccc: Add support for Live Firmware Activation (LFA)

[Mark Rutland <mark.rutland@arm.com>]

On Fri, Oct 16, 2026 at 06:42:52PM +0100, Andre Przywara wrote:
> On 10/13/26 16:48, Mark Rutland wrote:
> > On Mon, Sep 21, 2026 at 05:25:25PM +0200, Andre Przywara wrote:
> > > On 9/18/26 17:24, Mark Rutland wrote:
> > > > On Fri, Sep 18, 2026 at 04:11:05PM +0200, Andre Przywara wrote:
> > > > > From: Salman Nabi <salman.nabi@arm.com>
> > > > > 
> > > > > The Arm Live Firmware Activation (LFA) is a specification [1] to describe
> > > > > activating firmware components without a reboot. Those components
> > > > > (like TF-A's BL31, EDK-II, TF-RMM, secure paylods) would be updated the
> > > > > usual way: via fwupd, FF-A or other secure storage methods, or via some
> > > > > IMPDEF Out-Of-Bound method. The user can then activate this new firmware,
> > > > > at system runtime, without requiring a reboot.
> > > > > The specification covers the SMCCC interface to list and query available
> > > > > components and eventually trigger the activation.
> > > > 
> > > > It'd be helpful to have a few basic concepts covered here or in the
> > > > code. For example, I have no idea what a "rendezvous" is, and it's not
> > > > at all obvious from the code.
> > > 
> > > OK, I can give a brief summary of the concepts, but I guess doing this a top
> > > comment in the source file is more useful than here in the commit message?
> > 
> >  From my PoV, even placing that in the cover letter would be fine. The
> > key thing is just to get enough context to be able to review this
> > without having to ingest the entire LFA spec.
> > 
> > In particular with "rendezvous", I have no idea why the admin should
> > have any choice at all, and without some context I can't tell if there's
> > some sensible use-case I'm missing.
> 
> The admin should indeed not have a say, and if the firmware component
> requires rendezvous, it will always be used.
> But for firmware that claims to not need any rendezvous, we default to using
> it anyway, because it's the safest way to guarantee continuity for the
> kernel. We don't know which firmware services might be affected, and if they
> respond with something like -EAGAIN or just block for a longer period during
> the activation. The kernel seems to rely on the firmware services (TRNG,
> SoC-ID, SCMI, ...) replying, once they have been initialised, so them
> suddenly returning an (even transient) error will probably confuse the
> drivers.
> So the safe way to do this is to send all cores into the firmware
> regardless, there they cannot do any harm.
> 
> Now as users asked for it on the list, if the admin knows exactly that this
> firmware component does not provide any services to the kernel (say some fan
> controller), they can override this policy and allow a single CPU to trigger
> the activation. This was meant as a compromise to keep the kernel side sane,
> but still allow less disruptive updates. The idea would be that some user
> space component sets this attribute at boot time, if it matches some UUID
> that is known to be safe.

I don't think it's a good idea to leave this up to the admin. The admin
has no idea what the kernel will depend upon (especially as this can
change over time), and if they get it wrong, everything is broken.

If LFA permits arbitrary firmware components to enter a transiently
broken state, then the LFA design sounds broken.

You said someone asked for this on the list; can you shre a link?

[...]

> > > > > +static const char *get_image_name(const struct fw_image *image)
> > > > > +{
> > > > > +	if (image->image_name && image->image_name[0] != '\0')
> > > > > +		return image->image_name;
> > > > > +
> > > > > +	return kobject_name(&image->kobj);
> > > > > +}
> > > > 
> > > > As before, please just use the UUID.
> > > > 
> > > > I *assume* that we cannot have more than one image for a given
> > > > component, and hence we cannot have two entries for the same UUID? Is
> > > > that mandated by the LFA spec?
> > > 
> > > The LFA spec speaks about "firmware components" as its area of interest, by
> > > design all the real firmware *image* related parts, for instance how the
> > > firmware update image lands on the system, is left implementation defined.
> > > So yes, each firmware component, identified by its UUID, appears only once
> > > in the system, by design.
> > 
> > Ok; does the spec *clearly* mandate that?
> 
> Well, there is only one logical bit (somewhat confusingly named "activation
> pending") to say whether an update image has been provided for a specific
> component or not. If someone pushes another image, it would replace the
> already "pending" one (depending on firmware policy).

My concern here was more that each UUID appears only once. Where I said
"image" above, please read that as "component".

Does the spec clearly mandate that each component UUID shows up at most
once?

I know it's "obvious", but people WILL get this sort of thing wrong
unless it's in black-and-white in the spec.

Mark.