[7.0_bos] NVIDIA: VR: SAUCE: update Arm LFA support to v3#484
Draft
nirmoy wants to merge 25 commits into
Draft
Conversation
…entory updates" This reverts commit 0dc2e3a. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…RIME and ACTIVATE" This reverts commit 0032eb7. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
… lock" This reverts commit 536b31f. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
This reverts commit 143452f. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…sfs file" This reverts commit de8eacb. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…cation" This reverts commit 154c595. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…ger watchdog" This reverts commit 5a1fa22. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
This reverts commit 3b1e48f. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…ware Activation (LFA)" This reverts commit 1eb1efe. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…tion binding" This reverts commit 14aff54. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
SMCCC-discovered firmware services are currently represented by separate platform devices, such as smccc_trng and arm-cca-dev. Those devices do not represent independent DT/ACPI-described platform resources; they are features of the SMCCC firmware interface. Add an Arm SMCCC bus for services discovered through the SMCCC firmware interface. The bus provides SMCCC device and driver registration helpers, name-based matching, modalias generation, and a sysfs modalias attribute so SMCCC service drivers can bind to discovered firmware services and autoload as modules. Follow-up changes can then register SMCCC firmware services as arm-smccc devices instead of creating independent per-feature platform devices. Based on arm_ffa code Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org> (backported from https://lore.kernel.org/r/20260611130429.295516-1-aneesh.kumar@kernel.org/) Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…CCC device The SMCCC TRNG interface is a firmware-provided SMCCC service rather than a standalone platform device. Now that the SMCCC core has an SMCCC bus, create an arm-smccc-trng device for the discovered TRNG service and convert the hwrng driver to an SMCCC driver. The SMCCC id table preserves module autoloading for systems where the TRNG driver is built as a module. The sysfs device path changes from the old smccc_trng platform-device path to an arm-smccc device path. No known userspace dependency on the old path was found; a Debian Code Search lookup for the existing platform-device name/path did not find any users. Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org> Tested-by: Andre Przywara <andre.przywara@arm.com> (backported from https://lore.kernel.org/r/20260611130429.295516-1-aneesh.kumar@kernel.org/) Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
The Arm Live Firmware Activation spec [1] describes updating firmware images during runtime, without requiring a reboot. Update images might be deployed out-of-band, for instance via a BMC, in this case the OS needs to be notified about the availability of a new image. Describe an interrupt that could be triggered by the platform, to notify about any changes. [1] https://developer.arm.com/documentation/den0147/latest/ Signed-off-by: Andre Przywara <andre.przywara@arm.com> (backported from https://lore.kernel.org/r/20260706134455.132091-1-andre.przywara@arm.com/) Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…ivation (LFA) The Arm Live Firmware Activation (LFA) is a specification [1] to describe activating firmware components without a reboot. Those components (like TF-A's BL31, EDK-II, TF-RMM, secure paylods) would be updated the usual way: via fwupd, FF-A or other secure storage methods, or via some IMPDEF Out-Of-Bound method. The user can then activate this new firmware, at system runtime, without requiring a reboot. The specification covers the SMCCC interface to list and query available components and eventually trigger the activation. Add a new directory under /sys/firmware to present firmware components capable of live activation. Each of them is a directory under lfa/, and is identified via its GUID. The activation will be triggered by echoing "1" into the "activate" file: ========================================== /sys/firmware/lfa # ls -l . 6c* .: total 0 drwxr-xr-x 2 0 0 0 Jan 19 11:33 47d4086d-4cfe-9846-9b95-2950cbbd5a00 drwxr-xr-x 2 0 0 0 Jan 19 11:33 6c0762a6-12f2-4b56-92cb-ba8f633606d9 drwxr-xr-x 2 0 0 0 Jan 19 11:33 d6d0eea7-fcea-d54b-9782-9934f234b6e4 6c0762a6-12f2-4b56-92cb-ba8f633606d9: total 0 --w------- 1 0 0 4096 Jan 19 11:33 activate -r--r--r-- 1 0 0 4096 Jan 19 11:33 activation_capable -r--r--r-- 1 0 0 4096 Jan 19 11:33 activation_pending --w------- 1 0 0 4096 Jan 19 11:33 cancel -r--r--r-- 1 0 0 4096 Jan 19 11:33 cpu_rendezvous -r--r--r-- 1 0 0 4096 Jan 19 11:33 current_version -rw-r--r-- 1 0 0 4096 Jan 19 11:33 force_cpu_rendezvous -r--r--r-- 1 0 0 4096 Jan 19 11:33 may_reset_cpu -r--r--r-- 1 0 0 4096 Jan 19 11:33 name -r--r--r-- 1 0 0 4096 Jan 19 11:33 pending_version /sys/firmware/lfa/6c0762a6-12f2-4b56-92cb-ba8f633606d9 # grep . * grep: activate: Permission denied activation_capable:1 activation_pending:1 grep: cancel: Permission denied cpu_rendezvous:1 current_version:0.0 force_cpu_rendezvous:1 may_reset_cpu:0 name:TF-RMM pending_version:0.0 /sys/firmware/lfa/6c0762a6-12f2-4b56-92cb-ba8f633606d9 # echo 1 > activate [ 2825.797871] Arm LFA: firmware activation succeeded. /sys/firmware/lfa/6c0762a6-12f2-4b56-92cb-ba8f633606d9 # ========================================== [1] https://developer.arm.com/documentation/den0147/latest/ Signed-off-by: Salman Nabi <salman.nabi@arm.com> Signed-off-by: Andre Przywara <andre.przywara@arm.com> (backported from https://lore.kernel.org/r/20260706134455.132091-1-andre.przywara@arm.com/) Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…hdog Enhance PRIME/ACTIVATION functions to touch watchdog and implement timeout mechanism. This update ensures that any potential hangs are detected promptly and that the LFA process is allocated sufficient execution time before the watchdog timer expires. These changes improve overall system reliability by reducing the risk of undetected process stalls and unexpected watchdog resets. Signed-off-by: Vedashree Vidwans <vvidwans@nvidia.com> Signed-off-by: Andre Przywara <andre.przywara@arm.com> (backported from https://lore.kernel.org/r/20260706134455.132091-1-andre.przywara@arm.com/) Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
The Arm LFA spec describes an ACPI notification mechanism, where the
platform (firmware) can notify an LFA client about newly available
firmware imag updates ("pending images" in LFA terms).
Bind the LFA driver to the SMCCC bus after discovering the LFA agent,
and use its SMCCC device to check for the ACPI
notification description. Register this when one is provided.
The notification just conveys the fact that at least one firmware image
has now a pending update, it doesn't say which, also there could be more
than one pending. Loop through all images to find every which needs to
be activated, and trigger the activation. We need to do this is a loop,
since an activation might change the number and the status of available
images.
Signed-off-by: Vedashree Vidwans <vvidwans@nvidia.com>
[Andre: convert from platform driver to smccc bus]
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
(backported from https://lore.kernel.org/r/20260706134455.132091-1-andre.przywara@arm.com/)
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
The Arm LFA spec places control over the actual activation process in the hands of the non-secure host OS. An platform initiated interrupt or notification signals the availability of an updateable firmware image, but does not necessarily need to trigger it automatically. Add a sysfs control file that guards such automatic activation. If an administrator wants to allow automatic platform initiated updates, they can activate that by echoing a "1" into the auto_activate file in the respective sysfs directory. Any incoming notification would then result in the activation triggered. Signed-off-by: Andre Przywara <andre.przywara@arm.com> (backported from https://lore.kernel.org/r/20260706134455.132091-1-andre.przywara@arm.com/) Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
The Arm Live Firmware Activation spec describes an asynchronous notification mechanism, where the platform can notify the host OS about newly pending image updates. In the absence of the ACPI notification mechanism also a simple devicetree node can describe an interrupt. Add code to find the respective DT node and register the specified interrupt, to trigger the activation if needed. Signed-off-by: Andre Przywara <andre.przywara@arm.com> (backported from https://lore.kernel.org/r/20260706134455.132091-1-andre.przywara@arm.com/) Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
After a successful live activation, the list of firmware images might change, which also affects the sequence IDs. We store the sequence ID in a data structure and connect it to its GUID, which is the identifier used to access certain image properties from userland. When an activation is happening, the sequence ID associations might change at any point, so we must be sure to not use any previously learned sequence ID during this time. Protect the association between a sequence ID and a firmware image (its GUID, really) by a reader/writer lock. In this case it's a R/W semaphore, so it can sleep and we can hold it for longer, also concurrent SMC calls are not blocked on each other, it's just an activation that blocks calls. Signed-off-by: Andre Przywara <andre.przywara@arm.com> (backported from https://lore.kernel.org/r/20260706134455.132091-1-andre.przywara@arm.com/) Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Document the sysfs attribute files as exported by the LFA driver. Signed-off-by: Andre Przywara <andre.przywara@arm.com> (backported from https://lore.kernel.org/r/20260706134455.132091-1-andre.przywara@arm.com/) Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…eanup Unknown firmware image GUIDs should still expose a useful name in sysfs. Fall back to the image kobject name when no friendly name is known. Unwind all inventory resources if probing fails after the workqueue and kset are created. Also make ACPI removal safe when a DT-only system has no ACPI companion. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
…pdates Firmware image directories are plain kobjects under /sys/firmware, so udev coldplug does not enumerate them as devices. The SMCCC device add event also precedes probe and cannot signal a settled LFA tree. Emit KOBJ_CHANGE from the SMCCC device after the initial inventory is settled and after runtime reconciliations. Publish the event anchor and queue its initial worker under the inventory write lock, while each worker serializes cleanup and notification with the read lock. Userspace rules must now match the arm_smccc device, for example with MODALIAS=arm_smccc:arm-smccc-lfa, rather than the removed faux device. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Automatic activation drops the inventory locks before priming and activating the selected image. A concurrent inventory refresh can otherwise invalidate and release that image while it is still in use. Take a kobject reference while selecting the image, release it after the full operation, and reject invalidated sequence IDs while holding the SMC lock. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Managed resources are released after the driver remove callback. The DT notification thread can therefore still enter while the callback destroys the LFA workqueue and kset. Release the managed IRQ explicitly before teardown so free_irq() synchronizes any active handler. Dispose the OF IRQ mapping on both request failure and removal. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
LFA image kobjects remain visible while remove and probe-error cleanup destroy the inventory workqueue. A concurrent activation can therefore queue work after the workqueue has been freed. The inventory worker also drained active sysfs callbacks while holding the SMC read lock. A callback waiting for the writer lock could deadlock against that drain. Serialize activation and invalid-image deletion without holding the SMC lock through kernfs draining. Track one sequence ID from PRIME through ACTIVATE or exact-ID CANCEL, then quiesce transactions and sysfs before destroying the workqueue. Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Contributor
PR Validation ReportPatchscan ✅ No Missing FixesAll cherry-picked commits checked — no missing upstream fixes found. PR Lint ❌ Errors foundDetailsChecking 25 commits...
Cherry-pick digest:
E: 370acccbff0d ("NVIDIA: VR: SAUCE: firmware: smccc: lfa:"): backport trailer order: ORDER: move [Name: note] after (backported from ...) and before the backporter Signed-off-by
E: 6ec7a9da04f2 ("NVIDIA: VR: SAUCE: firmware: smccc: Add "): diff MISMATCH with lore patch (add [Author: reason] annotation if intentional)
┌──────────────┬──────────────────────────────────────────────────────────────────┬────────────┬─────────┬───────────────────────────┐
│ Local │ Referenced upstream / Patch subject │ Patch-ID │ Subject │ SoB chain │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 08ba8802aa8e │ [SAUCE] firmware: smccc: lfa: harden activation teardown │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ f581fc295ed8 │ [SAUCE] firmware: smccc: lfa: quiesce dt irq on remove │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ a897aa794b31 │ [SAUCE] firmware: smccc: lfa: pin automatic image │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 53e59f862376 │ [SAUCE] firmware: smccc: lfa: emit a uevent on inventory updates │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 61f0c07c47e9 │ [SAUCE] firmware: smccc: lfa: fix image names and probe cleanup │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 6840e869e18f │ firmware: smccc: lfa: add sysfs abi documentation │ match │ found │ ok, backporter: nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 96dcdfa0c187 │ firmware: smccc: lfa: introduce smc access lock │ match │ found │ ok, backporter: nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ d680898e7f9e │ firmware: smccc: lfa: register dt interrupt │ match │ found │ ok, backporter: nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 2011d2c763c0 │ firmware: smccc: lfa: add auto_activate sysfs file │ match │ found │ ok, backporter: nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 370acccbff0d │ firmware: smccc: lfa: register acpi notification │ match │ found │ ORDER: move [Name: note] │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 5585d1f20c57 │ firmware: smccc: lfa: add timeout and trigger watchdog │ match │ found │ ok, backporter: nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ faccb89dbb78 │ firmware: smccc: add support for live firmware activation (lfa) │ match │ found │ ok, backporter: nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ dd7bd337b70b │ dt-bindings: arm: add live firmware activation │ match │ found │ ok, backporter: nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ f9f4be249eff │ firmware: hwrng: arm_smccc_trng: register as an smccc device │ match │ found │ ok, backporter: nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 6ec7a9da04f2 │ firmware: smccc: add an arm smccc bus │ MISMATCH │ found │ ok, backporter: nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 800461ac6746 │ [Revert] dt-bindings: arm: add live firmware activation binding │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ caa057397464 │ [Revert] firmware: smccc: add support for live firmware activati │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ c1e9dc537fd2 │ [Revert] firmware: smccc: lfa: move image rescanning │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ a0e4b57ae783 │ [Revert] firmware: smccc: lfa: add timeout and trigger watchdog │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ c05ee3d01272 │ [Revert] firmware: smccc: lfa: register acpi notification │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ f49ec82957dd │ [Revert] firmware: smccc: lfa: add auto_activate sysfs file │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 14436af1aeac │ [Revert] firmware: smccc: lfa: register dt interrupt │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 53d02ea58103 │ [Revert] firmware: smccc: lfa: introduce smc access lock │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 14c01ed8be54 │ [Revert] firmware: smccc: lfa: handle lfa_busy in prime and acti │ N/A │ N/A │ nirmoyd │
├──────────────┼──────────────────────────────────────────────────────────────────┼────────────┼─────────┼───────────────────────────┤
│ 4bbe2dc2d979 │ [Revert] firmware: smccc: lfa: emit a uevent on inventory update │ N/A │ N/A │ nirmoyd │
└──────────────┴──────────────────────────────────────────────────────────────────┴────────────┴─────────┴───────────────────────────┘
Lint: all checks passed.
|
| @@ -834,27 +923,33 @@ static int activate_pending_image(void) | |||
| _update_fw_image_pending(image); | |||
Collaborator
There was a problem hiding this comment.
This is pre-existing, so maybe it's not in scope for this PR, but...
activate_pending_image() calls the SMC (_update_fw_image_pending → arm_smccc_1_2_invoke) inside spin_lock(&lfa_kset->list_lock). So there's a firmware round-trip under a spinlock -- is this an issue?
Collaborator
Author
There was a problem hiding this comment.
Ack. this needs to be addressed.
Collaborator
Author
BaseOS Kernel ReviewSummaryReviewed 25 commit(s); 65 finding(s) recorded. Findings: Critical: 8, High: 12, Medium: 12, Low: 33 Latest watcher review: open review Generated test plan: open test plan Kernel deb build: successful (download debs, 4 files) Head: This comment is maintained by nv-pr-bot. It is updated when the GitHub watcher publishes a newer review. |
Collaborator
|
The last 5 commits are not at lkml? |
Collaborator
Author
Still going through the patches. I don't think we will merge this PR but I want to get some testing done before I reply to the series author.
I will add a line. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BugLink: https://jirasw.nvidia.com/browse/DGX-16093
LP: https://bugs.launchpad.net/ubuntu/+source/linux-nvidia-bos/+bug/2150652
Summary
Replace the active Arm Live Firmware Activation v2/downstream stack on
26.04_linux-nvidia-boswith the public v3 series:CONFIG_ARM_LFA=yBOS annotation;This replaces the implementation previously tracked in #388.
Upstream series
Internal patch adoption
auto_activateLFA_BUSYhandlingKOBJ_CHANGEarm_smcccdeviceThe downstream tail also fixes image lifetime/revalidation, DT IRQ quiescing, PRIME transaction cancellation, and sysfs/workqueue teardown races found while reviewing v3 for BOS.
Userspace impact
The old faux-platform-device udev match no longer applies. Consumers should match the SMCCC device, for example:
The SMCCC bus prerequisite also changes the Arm SMCCC TRNG device path.
Validation
58bf67191b4e6982e067644c7b480e7784bcfd05495bab9f9d4d37c2f0ea6b1b);W=1build ofdrivers/firmware/smccc/lfa_fw.o;dt_binding_checkforDocumentation/devicetree/bindings/arm/arm,lfa.yaml;git diff --checkand focused lifecycle regression checks;Draft / not yet tested
Hardware LFA activation, ACPI/DT notification delivery, initial/runtime uevents, udev integration, module unbind/unload, the full BOS package build, installation, and boot have not been runtime-tested for v3. Keep this PR in draft until those checks are complete.