Ocp global demo review fixes - #1
Open
rusty1968 wants to merge 5 commits into
Open
Conversation
The file landed at docs/demo-proposal-flow.md, outside the book root: docs/book.toml sets src = "src", so mdBook never built the page and it had no SUMMARY entry. Move it under docs/src/design/ and register it in SUMMARY.md and in the Design section's README, which indexes that directory by hand. Pure move plus registration; the page content is unchanged here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017cqmuaq8X73aFGfvh3qi1g
Rendering and prose ------------------- * Wrap the diagram in a ```mermaid fence. Without it the whole diagram rendered as a run-on paragraph, on GitHub and in the book alike; docs/book.toml already wires up mdbook-mermaid for fenced blocks. * Add a title heading, a Status line and section structure, so the page reads like the rest of the book. * Spelling and grammar: OpenPRoT, AST2700, GetFirmwareParameters. Flow corrections ---------------- * Begin at the BMC writing the candidate into the staging area. That step is what makes the staging "external", and without it the reader cannot tell where the staged image came from. * Drop the "Activation failed" response sent to a BMC whose power has already been pulled. Outcomes are reported through GetStatus once the BMC is running again. * Give the rejected and rolled-back paths their own terminal states, so neither can arrive at a completed update. * Mark "B" as a trial slot and commit it only after an observed good boot, and erase the staging area last, so a power loss cannot cost a re-transfer of the image over PLDM. * Keep "A" as the known-good rollback image rather than resyncing it to match "B". * Show the boot-complete checkpoint that signals a good boot, and name the timeouts that bound each phase. * Distinguish the candidate's authenticity check (signature and anti-rollback) from the integrity check made after the copy into "B". * Query device identifiers before firmware parameters, and take the component identifier from the GetFirmwareParameters response. The flow is split into a linear sequence diagram for the message exchange and a state diagram for the outcomes, which keeps either one readable. Decisions that still need answers are recorded under Open questions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017cqmuaq8X73aFGfvh3qi1g
The diagram has three participants and none of them asks the BMC to stage an image, so the flow appears to begin with the BMC spontaneously writing a candidate into its own flash. Name the gap in three places: a note on the staging step in the diagram, a paragraph on the missing actor and why it matters, and an open question asking what drives it for the demo. Worth naming because the update takes down the machine that asked for it. From ActivatePendingComponentImage until power is restored there is no management path to the BMC, and EstimatedTimeForActivation is only an estimate of how long that lasts, so whatever drives the flow has to expect the endpoint to disappear and to remember across the gap that an update was in flight. The open question also records a consequence of keeping the staging area after a rolled-back attempt: OpenPRoT is never told that staging happened and cannot tell a fresh candidate from a leftover one. Signature and anti-rollback checks still gate what runs, but re-applying an identical version that was already tried is not caught. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017cqmuaq8X73aFGfvh3qi1g
The staging area was assumed to be a third region of the BMC flash. That staging lives in BMC flash at all is now supported by precedent rather than guessed: Aspeed's PFR firmware for this silicon places it there, and its ast2700_dual_flash_amd board carves a separate staging region per updatable component (64 MiB for the BMC, 1 MiB for the RoT's own image, 4 MiB for the CPLD), each holding a signed capsule rather than a bare image. Narrow the open question to what precedent does not settle: whether the demo uses one staging region or one per component, whether the staged unit is a capsule or a bare image, and how either shape reconciles with the flash topologies in the Use Cases specification, which describe dual-flash side-by-side as two parts with one partition each and direct-connect as one double-sized part, neither of which names a staging region. The capsule question is not cosmetic. It decides what the verification step parses, where the anti-rollback version is read from, and whether copying the candidate into the inactive slot is a region copy at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017cqmuaq8X73aFGfvh3qi1g
Delivers the candidate and triggers the on-BMC agent via a Redfish action, then tolerates the BMC activation blackout and reports the outcome on return.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.