oxidecomputer / oxidecomputer/hubris

Deprecate erroneous behavior in SP's `versioned_rot_boot_info` function

Open
#2,193 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
3.6k
Forks
239
Avg merge
1d 12h
Merged PRs (30d)
23

Description

The initial PR for issue 2185 does not remove the all of the incorrect mappings of the MGS and RoT found in task/control-plane-agent/src/mgs_common.rs.
A simple correct mapping of versions is RoT version = (MGS version - 1) where MGS version > 0 .

The previous code mapped MGS 1 to a response constructed from data in a RoT V1 message instead of returning an error for the deprecated RoT version 0.

To ensure that RoT update, manufacturing processes, and any support procedures, continue to work across all prior supported update-capable versions, it is necessary to understand which, if any, combinations of MGS, SP, and RoT firmware may break if this old behavior is made consistent with the intended design, i.e. "fixed".

In general, this is the sort of exercise that we need to go through before deprecating any SP/RoT-related update code unless we choose to support old functions and data structures indefinitely.

In addition to the support burden of maintaining old interfaces, they expand the potential attack surface of the devices. So, it is desirable to trim the implementation where practical while maintaining a robust implementation.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in task/control-plane-agent/src/mgs_common.rs at the versioned_rot_boot_info function, then review the initial work referenced from issue 2185. Trace the supported MGS, SP, and RoT version combinations and identify which update, manufacturing, and support procedures depend on the old mapping. Done means the compatibility impact is understood and the deprecated behavior can be removed or consistently rejected without breaking prior supported update-capable versions.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
embedded-iot
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.