Repository navigation
Conversation
One device's durable SVN floor behind the capability seam: floor() and advance(), monotonic and idempotent so a replayed commit is harmless, durable when advance returns. Storage encoding (OTP fuse counters, protected flash) stays behind the trait; PLDM devices that commit internally simply have no eRoT-side floor. Trait only — the OTP-backed adapter and the driver's commit_svn_floor executor follow separately. Assisted-by: Claude:claude-fable-5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
Per review: reading the floor does not require exclusive access. Assisted-by: Claude:claude-fable-5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
The trait cannot enforce it: one-way encodings get it for free, any other storage must check itself. Assisted-by: Claude:claude-fable-5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
Collaborator
Author
|
Superseded: SvnFloor landed upstream (OpenPRoT/openprot main). |
chrysh
added a commit
that referenced
this pull request
Oct 15, 2026
The pin sat at c709ae4, fifteen commits back. The one that matters here is UpdateSecurityRevision: the message (#22), its FdOps callback (#27), the responder that joins them (OpenPRoT#34) and the response checks (#28). All four are on main, so this pins main's head rather than a PR branch. Four callbacks became required, so every FdOps implementation gains them. All of them refuse a pending-component activation and a security revision commit, and report every component as still functioning, because none of them has anything else to say yet. `now()` is one of the four. It used to default to the constant 0xbaddbadd, which froze FD_T1 and FD_T2 for anyone who did not override it; pldm-lib #18 made it required, and every implementation here now reads a clock. Assisted-by: Claude Opus 5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
chrysh
added a commit
that referenced
this pull request
Oct 15, 2026
The pin sat at c709ae4, fifteen commits back. The one that matters here is UpdateSecurityRevision: the message (#22), its FdOps callback (#27), the responder that joins them (OpenPRoT#34) and the response checks (#28). All four are on main, so this pins main's head rather than a PR branch. Four callbacks became required, so every FdOps implementation gains them. All of them refuse a pending-component activation and a security revision commit, and report every component as still functioning, because none of them has anything else to say yet. `now()` is one of the four. It used to default to the constant 0xbaddbadd, which froze FD_T1 and FD_T2 for anyone who did not override it; pldm-lib #18 made it required, and every implementation here now reads a clock. Assisted-by: Claude Opus 5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
chrysh
added a commit
that referenced
this pull request
Oct 15, 2026
The pin sat at c709ae4, fifteen commits back. The one that matters here is UpdateSecurityRevision: the message (#22), its FdOps callback (#27), the responder that joins them (OpenPRoT#34) and the response checks (#28). All four are on main, so this pins main's head rather than a PR branch. Four callbacks became required, so every FdOps implementation gains them. All of them refuse a pending-component activation and a security revision commit, and report every component as still functioning, because none of them has anything else to say yet. The five host tests said that identically, so they say it once: `fd_ops_nothing_to_say!` in tests/common.rs, which they already share. The two QEMU firmware devices write the callbacks out, because theirs differ: one reads a real clock and one asks the RoT whether to commit. `now()` is one of the four. It used to default to the constant 0xbaddbadd, which froze FD_T1 and FD_T2 for anyone who did not override it; pldm-lib #18 made it required, and every implementation here now reads a clock. Assisted-by: Claude Opus 5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
chrysh
added a commit
that referenced
this pull request
Oct 15, 2026
The pin sat at c709ae4, fifteen commits back. The one that matters here is UpdateSecurityRevision: the message (#22), its FdOps callback (#27), the responder that joins them (OpenPRoT#34) and the response checks (#28). All four are on main, so this pins main's head rather than a PR branch. Four callbacks became required, so every FdOps implementation gains them. All of them refuse a pending-component activation and a security revision commit, and report every component as still functioning, because none of them has anything else to say yet. The five host tests said that identically, so they say it once: `fd_ops_nothing_to_say!` in tests/common.rs, which they already share. The two QEMU firmware devices write the callbacks out, because theirs differ: one reads a real clock and one asks the RoT whether to commit. `now()` is one of the four. It used to default to the constant 0xbaddbadd, which froze FD_T1 and FD_T2 for anyone who did not override it; pldm-lib #18 made it required, and every implementation here now reads a clock. Assisted-by: Claude Opus 5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SvnFlooris the anti-rollback capability seam: one managed device's durable SVN floor.advance(to)is monotonic (at-or-below is anOkno-op) and durable on return; storage encoding (OTP fuses, protected flash, mocks) stays behind the trait.Trait only — implementations and the orchestrator commit path follow in separate PRs.
Part of #18