Repository navigation
Conversation
The eRoT serves the OCP Recovery interface as the device and the BMC drives it as the Recovery Agent. This crate holds the half that does not depend on the transport: the command codes 0x22 to 0x2f, the byte layouts, the field encodings and the rules for which accesses the device refuses. The SMBus framing, the PEC and the register file the server-runtime owns come later, so the crate stays host-testable and free of kernel dependencies. The AST1030 has no OCP recovery silicon, so firmware has to keep the access semantics the agent expects from hardware. "Write 1, Device Clears" means the agent writes the command value and the device zeroes the field once it has acted, not a bitwise clear of the written bits: each of the three fields that work that way has an apply_agent_write and a clear_*, and writing 0x1 to the activate field is refused rather than leaving 0xe behind. The writes take a fixed-size array so the length is settled by the type, and RecoveryCommand::check_write resolves it where the bytes arrive off the wire. Signed-off-by: Christina Quast <christina.quast@9elements.com>
The register file the eRoT serves to the Recovery Agent, and the dispatch that answers one access: reads serve register bytes, refused writes latch the protocol error into DEVICE_STATUS byte 1, and INDIRECT_FIFO_DATA payloads drain into a FifoSink. The DEVICE_STATUS read is the one place the clear-on-read of the protocol error happens. Policy stays with the caller: an accepted RECOVERY_CTRL or DEVICE_RESET write only lands in the register, and the runtime finds it through take_activation and take_reset_request, which clear the field per the "Write 1, Device Clears" contract. RamStaging backs the FIFO in tests and mirrors the ImageSource shape (len, read_at) without depending on the orchestrator driver; the trait impl lands in an orchestrator adapter at composition, the way the pldm adapter binds FdEvent. The crate is host-testable with no kernel deps, the services/i2c/server half of the pattern. The register file instance will live in the i2c server-runtime loop, which is the only place that can answer an SMBus read before the clock-stretch budget runs out. Signed-off-by: Christina Quast <christina.quast@9elements.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #628 (the first commit is that PR; review the second commit here).
The register file the eRoT serves to the Recovery Agent, and the dispatch that answers one access: reads serve register bytes, refused writes latch the protocol error into DEVICE_STATUS byte 1, and INDIRECT_FIFO_DATA payloads drain into a
FifoSink. The DEVICE_STATUS read is the one place the clear-on-read of the protocol error happens.Policy stays with the caller: an accepted RECOVERY_CTRL or DEVICE_RESET write only lands in the register, and the runtime finds it through
take_activationandtake_reset_request, which clear the field per theWrite 1, Device Clearscontract.RamStagingbacks the FIFO in tests and mirrors theImageSourceshape (len,read_at) without depending on the orchestrator driver; the trait impl lands in an orchestrator adapter at composition, the way the pldm adapter bindsFdEvent.Host-testable, no kernel deps, the
services/i2c/serverhalf of the pattern. The register file instance will live in the i2c server-runtime loop, which is the only placement that can answer an SMBus read within the clock-stretch budget.Checked with
bazel test //services/ocp-recovery/...:all, the clippy aspect, and./pw format --all --check.