oxidecomputer · mkeeter · Apr 6, 2026 · Apr 1, 2026 · Apr 3, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -31,6 +31,7 @@ members = [
     "cmd/doc",
     "cmd/dump",
     "cmd/tofino-eeprom",
+    "cmd/discover",
     "cmd/exec",
     "cmd/extract",
     "cmd/flash",
@@ -41,7 +42,6 @@ members = [
     "cmd/hiffy",
     "cmd/host",
     "cmd/hydrate",
-    "cmd/rpc",
     "cmd/i2c",
     "cmd/ibc",
     "cmd/jefe",
@@ -140,6 +140,7 @@ cmd-counters = { path = "./cmd/counters", package = "humility-cmd-counters" }
 cmd-dashboard = { path = "./cmd/dashboard", package = "humility-cmd-dashboard" }
 cmd-diagnose = { path = "./cmd/diagnose", package = "humility-cmd-diagnose" }
 cmd-debugmailbox = { path = "./cmd/debugmailbox", package = "humility-cmd-debugmailbox" }
+cmd-discover = { path = "./cmd/discover", package = "humility-cmd-discover" }
 cmd-doc = { path = "./cmd/doc", package = "humility-cmd-doc" }
 cmd-dump = { path = "./cmd/dump", package = "humility-cmd-dump" }
 cmd-tofino-eeprom = { path = "./cmd/tofino-eeprom", package = "humility-cmd-tofino-eeprom" }
@@ -177,7 +178,6 @@ cmd-reset = { path = "./cmd/reset", package = "humility-cmd-reset" }
 cmd-rencm = { path = "./cmd/rencm", package = "humility-cmd-rencm" }
 cmd-rendmp = { path = "./cmd/rendmp", package = "humility-cmd-rendmp" }
 cmd-ringbuf = { path = "./cmd/ringbuf", package = "humility-cmd-ringbuf" }
-cmd-rpc = { path = "./cmd/rpc", package = "humility-cmd-rpc" }
 cmd-sbrmi = { path = "./cmd/sbrmi", package = "humility-cmd-sbrmi" }
 cmd-sensors = { path = "./cmd/sensors", package = "humility-cmd-sensors" }
 cmd-spctrl = { path = "./cmd/spctrl", package = "humility-cmd-spctrl" }

diff --git a/README.md b/README.md
@@ -239,6 +239,7 @@ a specified target.  (In the above example, one could execute `humility
 - [humility dashboard](#humility-dashboard): dashboard for Hubris sensor data
 - [humility debugmailbox](#humility-debugmailbox): interact with the debug mailbox on the LPC55
 - [humility diagnose](#humility-diagnose): analyze a system to detect common problems
+- [humility discover](#humility-discover): listen for compatible SPs on a network
 - [humility doc](#humility-doc): print command documentation
 - [humility dump](#humility-dump): generate Hubris dump
 - [humility exec](#humility-exec): execute command within context of an environment
@@ -276,7 +277,6 @@ a specified target.  (In the above example, one could execute `humility
 - [humility repl](#humility-repl): read, eval, print, loop
 - [humility reset](#humility-reset): Reset the chip using external pins
 - [humility ringbuf](#humility-ringbuf): read and display a specified ring buffer
-- [humility rpc](#humility-rpc): execute Idol calls over a network
 - [humility sbrmi](#humility-sbrmi): Sideband Remote Management Interface (SB-RMI) commands
 - [humility sensors](#humility-sensors): query sensors and sensor data
 - [humility spctrl](#humility-spctrl): RoT -> SP control
@@ -553,6 +553,40 @@ into things the _application_ may think are fishy -- only general behaviors
 at the OS level, like faults.
 
 
+### `humility discover`
+
+`humility discover` lets you discover SPs on a network, instead of using a
+physically attached debugger.  Once SPs are discovered, they may be used as
+a target by setting `HUMILITY_IP` or providing the `--ip` argument.
+
+You may need to configure an IPv6 network for `humility discover` to work. On
+illumos, it looks like this:
+
+```console
+$ pfexec ipadm create-addr -t -T addrconf e1000g0/addrconf
+```
+
+To listen for compatible devices on your network, run `humility discover`
+
+```console
+$ humility discover
+humility: listening... (ctrl-C to stop, or timeout in 5s)
+MAC               IPv6                      COMPAT PART        REV SERIAL
+a8:40:25:04:02:81 fe80::aa40:25ff:fe04:281  Yes    913-0000019   6 BRM42220066
+a8:40:25:05:05:00 fe80::aa40:25ff:fe05:500  No     (legacy)      0 (legacy)
+a8:40:25:05:05:00 fe80::aa40:25ff:fe05:501  No     (legacy)      0 (legacy)
+```
+
+Under the hood, this listens for packets from the Hubris `udpbroadcast`
+task, which includes MAC address and image ID (checked for compatibility).
+When listening, it is mandatory to specify the interface (e.g. `humility
+discover  -i en0` on MacOS). If the `Part` / `Serial` columns are
+marked as `(legacy)`, the SP is running an older version of `udpbroadcast`
+that did not include identity information. If they are marked as
+`(vpdfail)`, they are running a new-enough `udpbroadcast`, but the SP was
+unable to read its identity from its VPD.
+
+
 ### `humility doc`
 
 Provides detailed documentation for Humility and its commands.  To
@@ -2761,61 +2795,6 @@ See the [`ringbuf`
 documentation](https://github.com/oxidecomputer/hubris/blob/master/lib/ringbuf/src/lib.rs) for more details.
 
 
-### `humility rpc`
-
-`humility rpc` allows for execution of Idol commands over a network, rather
-than through a debugger.
-
-It requires the Hubris `udprpc` task to be listening on port 8.  This task
-decodes bytes from a UDP packet, and shoves them directly into `sys_send` to
-a target task.
-
-An archive is required so that `humility` knows what functions are available
-and how to call them.  The archive ID is checked against the image ID on the
-target; `udprpc` will refuse to execute commands when the ID does not match.
-
-Function calls are handled identically to the `humility hiffy` subcommand,
-except that an `--ip` address is required:
-
-```console
-$ humility rpc --ip fe80::0c1d:9aff:fe64:b8c2%en0 -c UserLeds.led_on -aindex=0
-UserLeds.led_on() = ()
-```
-
-Alternatively, you can set the `HUMILITY_RPC_IP` environmental variable.
-
-You may need to configure an IPv6 network for `humility rpc` to work. On
-illumos, it looks like this:
-
-```console
-$ pfexec ipadm create-addr -t -T addrconf e1000g0/addrconf
-```
-
-To listen for compatible devices on your network, run `humility rpc
---listen`
-
-```console
-$ humility rpc --listen
-humility: listening... (ctrl-C to stop, or timeout in 5s)
-MAC               IPv6                      COMPAT PART        REV SERIAL
-a8:40:25:04:02:81 fe80::aa40:25ff:fe04:281  Yes    913-0000019   6 BRM42220066
-a8:40:25:05:05:00 fe80::aa40:25ff:fe05:500  No     (legacy)      0 (legacy)
-a8:40:25:05:05:00 fe80::aa40:25ff:fe05:501  No     (legacy)      0 (legacy)
-```
-
-Under the hood, this listens for packets from the Hubris `udpbroadcast`
-task, which includes MAC address and image ID (checked for compatibility).
-When listening, it is mandatory to specify the interface (e.g. `humility rpc
---listen -i en0` on MacOS). If the `Part` / `Serial` columns are marked as
-`(legacy)`, the SP is running an older version of `udpbroadcast` that did
-not include identity information. If they are marked as `(vpdfail)`, they
-are running a new-enough `udpbroadcast`, but the SP was unable to read its
-identity from its VPD.
-
-To call all targets that match an archive, `--listen` can be combined with
-`--call`
-
-
 ### `humility sbrmi`
 
 Print out information retrieved via AMD's sideband remote management

diff --git a/cmd/rpc/Cargo.toml → cmd/discover/Cargo.toml b/cmd/rpc/Cargo.toml → cmd/discover/Cargo.toml
@@ -1,8 +1,8 @@
 [package]
-name = "humility-cmd-rpc"
+name = "humility-cmd-discover"
 version = "0.1.0"
 edition.workspace = true
-description = "execute Idol calls over a network"
+description = "listen for compatible SPs on a network"
 
 [dependencies]
 humility.workspace = true