Skip to content

target/ast10x0: Advance the eRoT SVN floor after the trial - #621

Open
chrysh wants to merge 2 commits into
OpenPRoT:ocp-global-demo-wipfrom
9elements:itest-erot-floor-pr2
Open

chrysh wants to merge 2 commits into
OpenPRoT:ocp-global-demo-wipfrom
9elements:itest-erot-floor-pr2

Conversation

@chrysh

@chrysh chrysh commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Stacked on #620, whose commit this branch carries. Review the second commit; merge #620 first and this diff shrinks to it.

Entering Ready confirms the trial and names the eRoT in awaiting_floor_advance, so the request the Update Agent would send with UpdateSecurityRevision finds something outstanding. No request arrived, so commit_self_svn_floor had no caller outside the driver tests.

mock_downstream_device/self_trial now dispatches Event::SvnCommitRequest for the eRoT, the way the update scenarios dispatch it for their device, and checks the SVN floor reads the SVN the trial recorded and the session closed. A request the state machine drops emits no effect, so the grant waits on Effect::CommitSvnFloor rather than on the dispatch returning.

Serving 0x22 over PLDM for the eRoT is still unbuilt: it needs the eRoT to be a Firmware Device to the Update Agent, a four-app image on a memory map that holds two, and a session in storage rather than RAM. GAPS.md says so in place of the old entry.

Verified by aiming the request at the managed device instead, which fails with "the request for the SVN floor advance was dropped". 42 of 42 integration tests pass with --nocache_test_results.

Issue: 9elements#21

Every scenario here binds SvnFloorBinding::SelfManaged, so commit_svn_floor
returns at the binding test and the pass that brings the spare slot up to
the committed image never runs. slot_resync is svn_commit with the eRoT
keeping the floor for the managed component, which is what reaches it.

The run checks the order the driver promises: the floor still reads 0 when
the commit is granted, nothing advances it while the pass is running, and
it reads the SVN the chain walk recorded once the spare slot holds the
image byte for byte. The board verifier has to return an SVN for that; the
stub returns none, which makes the driver hold the advance and report
SvnFloorHeld instead.

The spare slot is memory the orchestrator app owns. No PLDM operation
pushes bytes to a Firmware Device and only pldm_fd maps the FMC, so an
Updatable that writes flash the device holds is not available here.
Entering Ready confirms the trial and names the eRoT in
awaiting_floor_advance, so the request the Update Agent would send with
UpdateSecurityRevision finds something outstanding. No request arrived, so
commit_self_svn_floor had no caller outside the driver tests.

self_trial now dispatches Event::SvnCommitRequest for the eRoT, the way
the update scenarios dispatch it for their device, and checks the floor
reads the SVN the trial recorded and the session closed. A request the
state machine drops emits no effect, so the grant waits on
Effect::CommitSvnFloor rather than on the dispatch returning.

Serving 0x22 over PLDM for the eRoT is still unbuilt: it needs the eRoT
to be a Firmware Device to the Update Agent, a four-app image on a memory
map that holds two, and a session in storage rather than RAM.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant