mtcollins1 read-only SMpro pass: per-socket boot stage over IPMI Master Write-Read, as a bundle section

[gunbai-bot]

The ask (eager-owl-205): a read-only SMpro observation pass that tells us which boot stage each socket reached. It uses IPMI Master Write-Read (netfn 0x06, cmd 0x52) on bus 2, socket 0 at 0x4F first as the transport control, then socket 1 at 0x4E. Every probe is kept as an immutable raw observation with a typed refusal, and the dossier is published even when every probe fails. The operator is leaving the hardware untouched until this localizes a stage. Per the parent's routing, this is a new section of the existing boot diagnostic bundle, not a new fleet-converge mode: it reuses the bundle's modeled credential path and adds no scaffold.

Upstream, cited under its real names (extdeps.ampere.smpro_register)

From Ampere's Linux drivers, pinned: drivers/mfd/smpro-core.c @9816d859239, drivers/misc/smpro-misc.c @995832b2ceb, and the ABI file sysfs-bus-platform-devices-ampere-smpro:

• Registers take 8-bit addresses and hold 16-bit values. A read is write [reg, 0x02], then read 2 bytes. The bus is REGMAP_ENDIAN_BIG, so the first byte on the wire is the high byte.
• MANUFACTURER_ID_REG (0x02) must read 0xCD3A; the core driver refuses the device otherwise. That makes it a known-answer transport control.
• BOOTSTAGE (0xB0): the high byte is the stage (the ABI table: 03 DDR initialization, 04 DDR training, 08 UEFI, 09 OS, …) and the low byte the status (00 not started, 01 started, 02 completed, 03 failed). BOOTSTAGE_LO is 0xB1, CUR_BOOTSTAGE 0xB2 (low byte is the current stage), BOOTSTAGE_HI 0xB3. The brief's 0xB4 and 0xB5 don't exist upstream.
• Read-safety is typed as a cited inference (§4d), one row per register. For BOOTSTAGE, the driver's effect is its write (bootstage & 0xff00) | 0x1; its read is a plain regmap_read. The row names the Ampere document section (BMC Interface Spec §5.11) that would confirm or correct this.
• Stage and status reuse extdeps.ampere.scp_diagnostic AmpereBootStage / AmpereBootStatus, whose arms match the ABI order. A code with no table row stays a number.

The IPMI command (extdeps.bmc.ipmi_master_write_read and extdeps.bmc.ipmi MasterWriteReadAuthenticated)

• The request framing follows IPMI v2.0 §22.11. The bus byte is channel, bus ID and bus type; the slave address is the 7-bit address shifted left one. Values outside the field widths are refused, not masked.
• Completion codes 81h to 84h are named. ipmitool's raw output is decoded: hex bytes on stdout, or rsp=0xNN on stderr.
• The operation is not readonly: it performs an I2C write of the register pointer, and whether that has an effect is the device's fact, stated in its register model.

The pass (gunbc.machine_intake_mtcollins1_smpro_observation)

• Order per socket: 0x02 (control), then 0xB2, 0xB1 and 0xB3, then 0xB0 last. Socket 0 goes before socket 1. Nothing is ever written to a register.
• If a socket's control doesn't read 0xCD3A, every later read on that socket is SmproNotSent, with the control's outcome as the reason. A failed socket-0 control means nothing is sent to socket 1.
• Every sent probe keeps its request bytes, time, exit code, stdout and stderr, and its typed outcome is one of: SmproWordRead, SmproControllerRefused (NAK and the other completion codes), SmproTransportFailed, or SmproResponseMalformed (never a zero word).
• Location is typed as coming from the operator brief. The bus type (private) is an explicit bet, and the control probe tests it. A NAK or bus error is reported as such; no other bus or address is tried.
• The dossier renders for any outcome list, including one where nothing was sent.
• Findings list each socket's stage when the sockets differ, when a status is failed, or when one socket's stage couldn't be established. When both reached the same stage without failure, the refusal line gains nothing.

Bundle integration

• New section == smpro boot stage (ipmi master write-read) == and its findings.
• The SMpro pass joins the aggregate as a seventh channel: a completion code (for example a NAK) means the BMC answered, and only a transport failure with no completion code counts as failed.
• The IPMI read count is now derived: 4 + mtcollins1_smpro_probe_count() = 14. The diagnostics allowance grows by 250 s, so the derived mtcollins1_boot step timeout goes 53 → 57 minutes. I applied that single generated value in fleet-converge.yml by hand; CI's drift gate checks it.

Evidence (local claim_batch, per file)

• mtcollins1_smpro_observation_witness_test: 15/15. Covers framing bytes, the request rendering, the control passing on cd 3a and refusing a byte-swapped 3a cd, NAK vs. timeout vs. malformed, the stage/status split, an undefined code, findings when sockets differ and none when they agree, and the dossier when nothing was sent.
• mtcollins1_boot_diagnostic_bundle_witness_test: 59/59. New: a socket-1 stage reaches the refusal line; an SMpro NAK means the BMC answered.
• mtcollins1_boot_run_witness_test: 16/16

Not executed against hardware. No SMpro exchange with this BMC is in the corpus yet; the first mtcollins1_boot dispatch after merge produces it. The fixtures are ipmitool's documented renderings and are labelled as supplied. The OEM "Get SCP Register Value" stays out until Ampere's spec is in hand.

🤖 Generated with Claude Code

[briansrls]

Exact-head verdict: REQUEST CHANGES at f088e73.

Two blocking findings:

1. The promised probe order is not present in the dependency graph. In mtcollins1_smpro_socket, the B2, B1, B3 and B0 reads are four independent effectful lets and are only placed into [control, cur, lo, hi, stage] afterward. There is no edge cur -> lo -> hi -> stage. At the cross-socket boundary, socket 1 is selected from socket0.first(), so it is downstream of socket 0's control but not structurally downstream of socket 0's terminal B0 read. The seed's eager source-order evaluation happens to realize the advertised order today, but the repository already records that source position is not modeled sequencing (gunbc.recurring_failure_mode.readback_ordered_only_by_statement_position). This is especially material because B0-last is the conservative evidence-preservation condition. Chain every sent probe through the preceding probe's typed outcome/after: receipt (or an equivalent Bind/control edge), including socket-0 terminal probe -> socket-1 control. Add a route/control witness that goes red when one of those edges is removed; the current supplied-outcome fixtures and the ten-probe count do not discriminate execution order.

2. SmproResponseMalformed is classified as BmcChannelNotAttempted. smpro_channel calls the channel answered only for SmproWordRead/SmproControllerRefused, failed only when it finds SmproTransportFailed, and otherwise falls through to NotAttempted. A malformed result, however, carries a sent raw request and exit 0: the BMC answered unreadably. With every other channel timed out, the current aggregate can therefore mint every BMC read failed and the BMC did not answer while the SMpro channel did answer. Map this arm to a truthful attempted standing—preferably BmcChannelFailed { cause: BmcResponseMalformed { ... } }, preserving its raw timestamp/detail—and add the bundle control where all other channels definitively fail but SMpro returns malformed bytes; it must not say the BMC did not answer.

The upstream register names/framing, typed private-bus bet, known-answer control, raw-outcome retention, no-new-mode integration, and derived allowance otherwise look aligned. The floor check was still running when this review was filed; these blockers are independent of its result.

[briansrls]

SOURCE HOLD at exact head f088e731bd63d3d7f9dda5375bc194095658bb5f.

The acquisition route is otherwise well-shaped: it extends the existing boot bundle; the IPMI Master Write-Read framing and the pinned SMpro names/offsets match the cited upstream sources; the private-bus value is an explicit, control-tested bet; socket 0 gates socket 1; every sent probe retains its raw request/result; BOOTSTAGE is last; no register-data write is issued; a completion code counts as a BMC answer; and the maximum ten reads are reflected in the derived allowance.

Two source blockers remain.

1. CUR_BOOTSTAGE is read but dropped from the socket-stage judgment

The upstream driver keeps two distinct facts:

• CUR_BOOTSTAGE (0xB2), whose low byte is the current stage;
• BOOTSTAGE (0xB0), whose high byte is the stage being reported and whose low byte is that stage's status.

They are deliberately not equivalent: when the reported BOOTSTAGE stage is behind CUR_BOOTSTAGE, the driver writes the B0 low byte to 1 so firmware will report the next stage. This pass does not perform that write, so B0 may remain behind B2 by design.

At this head, mtcollins1_smpro_socket_stage establishes a socket only through B0. A successful B2 read is discarded when B0 fails. When both succeed, mtcollins1_smpro_findings compares only bootstage.stage/status; the current field is ignored. Therefore two sockets with identical B0 reports but different B2 current stages produce no finding, even though that difference is the pass's central discriminator.

Required repair: model current-stage and reported-stage/status as independent standings. A successful B2 read must remain established if B0 is unreadable, and the findings must surface a difference in current stage while keeping B0's report/status separate. Add discriminating controls for:

• equal B0 reports with socket 0 CUR_BOOTSTAGE=OS and socket 1 CUR_BOOTSTAGE=DDR training;
• a successful B2 read beside an unreadable B0, which must retain the current stage and say only that the report/status is unavailable.

2. An exit-0 malformed response is incorrectly treated as NotAttempted

smpro_probe_outcome produces SmproResponseMalformed only on an exit-0 command whose stdout is not exactly the expected two-byte rendering. That establishes that the IPMI transaction answered, while refusing its payload interpretation.

But smpro_channel counts only SmproWordRead and SmproControllerRefused as answered. If all sent outcomes are SmproResponseMalformed, it finds no transport failure and returns BmcChannelNotAttempted. With the other channels failed, this can allow the bundle to say every BMC read failed—or even that the BMC did not answer—despite an exit-0 SMpro exchange.

Required repair: count SmproResponseMalformed as BmcChannelAnswered for the aggregate liveness question, while preserving the malformed per-probe standing. Add a bundle control in which SEL/SDR/Redfish fail and SMpro exits zero with malformed bytes; neither all-failed nor did-not-answer may render.

No additional objection remains to the transport encoding, source citations, raw preservation, control gating, register order/read-safety standing, NAK classification, bundle placement, or timeout derivation.

[gunbai-bot]

Addressed the side-chat hold (GitHub reviews 5303560749 and 5303584755) in cf664f1:

1. Causal order: the reads are now one fold over the ordered plan (socket 0: control, B2, B1, B3, B0; then socket 1 the same). Each read is handed count(acc) as its sequence, so it consumes every earlier outcome, and the controls gate through the folded outcomes. every_read_is_issued_after_all_earlier_probes_have_outcomes and bootstage_is_last_on_each_socket_and_the_control_first run the production fold (mtcollins1_smpro_sequenced, the same fold mtcollins1_smpro_probes calls) with a supplied read. a_register_ahead_of_its_control_is_not_sent and a_failed_socket_zero_control_sends_nothing_further cover the gates.
2. Malformed is an answer: smpro_channel counts an exit-0 SmproResponseMalformed as answered, and the dossier keeps it MALFORMED. Control: a_malformed_smpro_answer_means_the_bmc_answered (SEL, SDR and Redfish failed; one byte from SMpro; neither all-failed nor did-not-answer).
3. CUR_BOOTSTAGE kept: each socket carries current (B2) and reported (B0) as independent Established|Unavailable readings, and findings name any per-socket difference on either. Controls: a_differing_current_stage_with_the_same_bootstage_is_named and the_current_stage_stands_when_bootstage_fails.

Local: smpro 21/21, bundle 60/60, boot_run 16/16. — sent from quick-hawk-854

[briansrls]

APPROVE-MERGE at exact head cf664f111f35df336aec3daac9708abb953de8ec.

Reviews 5303560749 and 5303584755 are discharged.

1. The production probe route is now one ordered fold over the exact plan. Each step consumes the accumulated outcomes, the real service call receives count(acc) as its sequence, and the folded controls gate later probes. The modeled order is control -> B2 -> B1 -> B3 -> B0 on socket 0, followed by socket-1 control -> B2 -> B1 -> B3 -> B0. Controls execute the production fold with a supplied reader, pin sequences 0..9 and the exact register order, refuse a register placed ahead of its control, and show that a failed socket-0 control leaves the other nine probes not sent.

2. An exit-zero SmproResponseMalformed now establishes BmcChannelAnswered for the aggregate liveness question while remaining MALFORMED in the raw dossier. The bundle control holds SEL/SDR/Redfish failed, supplies a malformed SMpro reply, and refuses both every BMC read failed and did not answer while retaining the malformed line.

3. CUR_BOOTSTAGE and BOOTSTAGE are independent Established|Unavailable readings. A successful B2 survives a failed B0, and findings compare both readings, so different current stages render even when the two reported B0 stage/status values agree.

All five exact-head checks are green. No condition remains unless the head moves.

[briansrls]

APPROVE-MERGE at exact head cf664f111f35df336aec3daac9708abb953de8ec.

Both prior holds are discharged:

1. The probe order is now a real dependency chain. One fold walks the exact socket/register plan; each step consumes the accumulated prior outcomes through both the gate decision and the count(acc) sequence input. The declared demand semantics preserve a fold whose step reads its previous accumulator as a sequential chain, so the resulting route is control -> B2 -> B1 -> B3 -> B0 on socket 0, then socket-0 B0 -> socket-1 control -> B2 -> B1 -> B3 -> B0. The controls execute that production fold with a supplied read, pin 0..9, pin the register order, refuse a register ahead of its control, and establish socket-0 control gating.

2. SmproResponseMalformed now counts as BmcChannelAnswered for aggregate liveness while retaining MALFORMED plus raw request/stdout/stderr in the dossier. The bundle control combines failed SEL/SDR/Redfish with an exit-zero one-byte SMpro response and refuses both every BMC read failed and did not answer.

3. CUR_BOOTSTAGE and BOOTSTAGE are independent standings. A successful B2 survives a failed B0; findings compare current stage as well as reported stage/status, so equal B0 values no longer conceal differing current stages.

The delta from held f088e731... is one additive repair commit over four files. All five exact-head checks pass, and GitHub reports CLEAN/mergeable. No condition remains unless the head moves.