feat(devices): add remote platform erase support#846
Draft
Conversation
ab3a5ce to
2a3c9f3
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #846 +/- ##
===========================================
+ Coverage 40.13% 58.48% +18.35%
===========================================
Files 114 101 -13
Lines 10892 8175 -2717
===========================================
+ Hits 4371 4781 +410
+ Misses 6119 2987 -3132
- Partials 402 407 +5 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
9963ea5 to
3fb92dc
Compare
c155e51 to
a51bd01
Compare
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NOTE: Needs to be tested on real HW. Currently don't have an AMT 16+ device that supports RPE.
Description
Adds support for Intel Remote Platform Erase (RPE), a CSME 16.0+ feature that allows remote administrators to securely erase platform storage components on the next system boot.
What's New
API Endpoints
GET/api/v1/amt/boot/capabilities/:guidAMT_BootCapabilitiesincluding thePlatformErasebitmask indicating which erase components the device supportsPOST/api/v1/amt/boot/rpe/:guidPOST/api/v1/amt/remoteErase/:guideraseMaskbitmask specifying which components to eraseErase Component Bitmask
0x010x020x040x08RPE Trigger Flow (
SendRemoteErase)GET+PUTAMT_BootSettingDatawithPlatformErase=trueto arm the boot optionCIM_BootService.SetBootConfigRoleto activate the boot configurationCIM_PowerManagementService.RequestPowerStateChange(MasterBusReset) to reset the device and initiate the eraseDTO / Feature Surface
AMTFeaturesRequestandFeaturesDTOs (v1 + v2) extended withenablePlatformErase,remoteEraseEnabled,remoteEraseSupported, andplatformEraseCapsSetFeaturesupdated to configure RPE enable/disable alongside existing KVM/SOL/IDER/OCR settingsTesting
GetBootCapabilities,SetRPEEnabled,SendRemoteErase) and HTTP controller handlersSetFeaturestests extended to cover the RPE code pathNotes
PlatformErase == 0in capabilities) return a validation error rather than attempting the operationeraseMaskof0is treated as "erase all supported components"; non-zero values are validated against device capabilities before proceeding