Skip to content

feat(devices): add remote platform erase support#846

Draft
nmgaston wants to merge 1 commit intomainfrom
remotePlatformErase
Draft

feat(devices): add remote platform erase support#846
nmgaston wants to merge 1 commit intomainfrom
remotePlatformErase

Conversation

@nmgaston
Copy link
Contributor

@nmgaston nmgaston commented Mar 18, 2026

NOTE: Needs to be tested on real HW. Currently don't have an AMT 16+ device that supports RPE.

Description

Adds support for Intel Remote Platform Erase (RPE), a CSME 16.0+ feature that allows remote administrators to securely erase platform storage components on the next system boot.

What's New

API Endpoints

Method Path Description
GET /api/v1/amt/boot/capabilities/:guid Returns AMT_BootCapabilities including the PlatformErase bitmask indicating which erase components the device supports
POST /api/v1/amt/boot/rpe/:guid Enables or disables the RPE feature on the device
POST /api/v1/amt/remoteErase/:guid Triggers the erase on the next boot; accepts an eraseMask bitmask specifying which components to erase

Erase Component Bitmask

Bit Component
0x01 Secure Erase
0x02 EC Storage Erase
0x04 Storage Drive Erase
0x08 ME/CSME Region Erase

RPE Trigger Flow (SendRemoteErase)

  1. GET + PUT AMT_BootSettingData with PlatformErase=true to arm the boot option
  2. CIM_BootService.SetBootConfigRole to activate the boot configuration
  3. CIM_PowerManagementService.RequestPowerStateChange (MasterBusReset) to reset the device and initiate the erase

DTO / Feature Surface

  • AMTFeaturesRequest and Features DTOs (v1 + v2) extended with enablePlatformErase, remoteEraseEnabled, remoteEraseSupported, and platformEraseCaps
  • SetFeatures updated to configure RPE enable/disable alongside existing KVM/SOL/IDER/OCR settings

Testing

  • Unit tests added for all new use-case functions (GetBootCapabilities, SetRPEEnabled, SendRemoteErase) and HTTP controller handlers
  • SetFeatures tests extended to cover the RPE code path

Notes

  • RPE requires AMT/CSME 16.0+; devices that don't support it (PlatformErase == 0 in capabilities) return a validation error rather than attempting the operation
  • An eraseMask of 0 is treated as "erase all supported components"; non-zero values are validated against device capabilities before proceeding

@nmgaston nmgaston force-pushed the remotePlatformErase branch 3 times, most recently from ab3a5ce to 2a3c9f3 Compare March 18, 2026 01:13
@codecov
Copy link

codecov bot commented Mar 20, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.48%. Comparing base (92f460f) to head (a51bd01).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@             Coverage Diff             @@
##             main     #846       +/-   ##
===========================================
+ Coverage   40.13%   58.48%   +18.35%     
===========================================
  Files         114      101       -13     
  Lines       10892     8175     -2717     
===========================================
+ Hits         4371     4781      +410     
+ Misses       6119     2987     -3132     
- Partials      402      407        +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@nmgaston nmgaston force-pushed the remotePlatformErase branch 6 times, most recently from 9963ea5 to 3fb92dc Compare March 23, 2026 22:20
@nmgaston nmgaston force-pushed the remotePlatformErase branch 2 times, most recently from c155e51 to a51bd01 Compare March 25, 2026 17:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant