Planner should handle SP/RoT/RoT bootloader rollback protection

[karencfv]

As per RFD349, the SP/RoT/RoT bootloader will use an epoch based system for rollback protection.

This means that once the EPOC field is populated, the planner should make use of it to verify that the EPOC in the artifact's caboose is larger than the one reported by the inventory's caboose.

[davepacheco]

Is there some way to record that we cannot start using this field until we've done this work? CC @lzrd

[karencfv]

Is there some way to record that we cannot start using this field until we've done this work?

@davepacheco: I'm not sure I fully understand, where are you expecting this to be recorded? Like the RFD? Or in an issue in Hubris?

[davepacheco]

I'm not sure. The only problem I'm trying to avoid is that we implement mandatory rollback protection in the RoT or bootloader and ship that before having done the work in the control plane to use it, resulting in a broken system at runtime. If that's not a risk (either because the software doesn't work that way or because the work is already being managed as a project that includes the control plane parts), great.

[karencfv]

We talked about this today at the update watercoooler. The functionality is not implemented yet, and during the first phases of implementation only test devices will have it enabled. So it's not really something we need to worry about for a while. @lzrd can correct me if I'm wrong.

This is the corresponding hubris PR oxidecomputer/hubris#1809 and issue oxidecomputer/hubris#1570