From patchwork Fri May 19 10:32:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahisa Kojima X-Patchwork-Id: 683904 Delivered-To: patch@linaro.org Received: by 2002:a5d:4e01:0:0:0:0:0 with SMTP id p1csp853663wrt; Fri, 19 May 2023 03:34:42 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7rwGgyEJ931r+J3oUshAZh6opbiqfHyyGkZZCQQ2ZytGHY9KL8n65uxjWH/SGQCCoxwcRP X-Received: by 2002:a17:902:a713:b0:1ae:1ecf:f25c with SMTP id w19-20020a170902a71300b001ae1ecff25cmr1781479plq.21.1684492482078; Fri, 19 May 2023 03:34:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684492482; cv=none; d=google.com; s=arc-20160816; b=G3DdRgr8rkocrFqhuRXr/PUVIB15eLCom1Z4cVI6TTWCJhB/n64CxdwHiXCZJ6Jt1o gaJahw5t0XCeTHEh/h+l8iTQx6MmNrxH/FZpEjq1JQGQP6ooo3Ilmtni5gJ1UqR1aZD6 VJ7xsVmJ/wbBTIY5yV9M26QndwHRMbZrKciPwEU2OFm43WLqWxCCSnO53Um9X7NkLKDp Tj3YU2bPFqO1+a4aZJHQF7TlBRxDOf42fBPCUoWY9ex0NgC2KH0UqwohnsZDRXvjHiNE RBrAac+fssNG1O7Y4egQ/pS4+Y/a+zFOhOs43SoH8PCQyfe8Pms2RBJrPgqF8+lh8UK4 6RlA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=mo/B7/CjIUzb2/ZwUDiRWA0+pU7luPB1oM8GNU8uZmA=; b=pB1jHlLtpXBNZfbGOWAQsTHSEK2fJPgwMrDF038Fum0zOpvVzKcI8QyAsiTZOipBoN hNaEbwZEH0LM+B7al7JrgmzHZoBFYiXrcD5h/CkzwGO5S0ZUTEXanw61IU7hQeC6Rye+ N0KwBGSi8DDz1fPBLiNKOk1UiwectpQRb3uDQ2DZQUzWy2Ug5gZOgci151LxpOSMPMhi KTAvYUGn5fup6ZL7xldpTrao8IJFv+6mMW518/bfVdEMnVqQWw67XXaVritF51BjVcc4 9T9sDDjT6waMcKTQ/HlmU/H3yoooyoRFhNX92CG+zEVfaLIl/rFW2vCnqBqxyNT4Xfpb rqAg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=WQkAk5IV; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [85.214.62.61]) by mx.google.com with ESMTPS id b4-20020a1709027e0400b001ab089f7319si17772plm.52.2023.05.19.03.34.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 May 2023 03:34:42 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) client-ip=85.214.62.61; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=WQkAk5IV; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 85.214.62.61 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 694328627B; Fri, 19 May 2023 12:33:19 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="WQkAk5IV"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 80E5D862E7; Fri, 19 May 2023 12:33:11 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pj1-x1031.google.com (mail-pj1-x1031.google.com [IPv6:2607:f8b0:4864:20::1031]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id F41D18623E for ; Fri, 19 May 2023 12:33:05 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=masahisa.kojima@linaro.org Received: by mail-pj1-x1031.google.com with SMTP id 98e67ed59e1d1-2537a79b9acso556728a91.3 for ; Fri, 19 May 2023 03:33:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1684492383; x=1687084383; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=mo/B7/CjIUzb2/ZwUDiRWA0+pU7luPB1oM8GNU8uZmA=; b=WQkAk5IV7iFAdFf1mx0a9Ii24NtLcmq5X9CLlfUx9xvinviEqn/5kNdd/TCJOpHz3w E2lUnbgP/lZU1NHnihy6HdhcnxNN3NkYRUV6lDza0GAYRXKCOvLHzAKgwRI1RNokdpMU P1wcv3nfb+I3U+XOlj/H+xb7cK8zIIlX6Fgmw1P/xdXZJYPfOR5/B9T8SROwiAK5S2Ly EdYokFfB+1cEWMOgAhjlAhBeNcCoqdvYl87Hs1nrYFv6cY+3CcLe7pzXWc84HwLtfCKd eh/LTEUFYxAMubk5OvGaUZFocsLJ6K2KdBYheK91jeESQU/JG4uB+oswZ8vjatJCeLYR t3sA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684492383; x=1687084383; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mo/B7/CjIUzb2/ZwUDiRWA0+pU7luPB1oM8GNU8uZmA=; b=KG+pxHh4LedCIQdsKTB2AiatGrPV71NllMPcky6iBPy/FeHObwL+1PatUO8gI4Ek72 i+y1EJY7ktD5StttHABEszII/OFDQ+BiqOnddMc2RnKTlAM+ci+16HwaOG+TID1o685u ymWFKsvDXZ9biid5YZkVbNH+ifnceBVXsaq389oR0k4puwFrA8FUSJoGRXBXtI9vPukJ V78mxbUiQ9j/J6PqqoDtUvkcwGA3G1K3hJQMea9DTO3LRsxg6NNARLrPQyEQbuZXzDAg 5yK9l3i/2gE0OuM6FsQIq6tUnSCHlGbnld2XA7WAraO5oueIfTiMDQalqxWUviqt7dKT aJgw== X-Gm-Message-State: AC+VfDxCXZlYGNNwQQdf7BaVJsm+Aj/+8WMZ806S1BqcPD30yTHuhZ38 EmfQ0nCGhkckyfaYN/7lmrw4Cyg+R6yPsTc0QeI= X-Received: by 2002:a17:90a:7e02:b0:24e:102e:edbf with SMTP id i2-20020a17090a7e0200b0024e102eedbfmr1607284pjl.13.1684492383613; Fri, 19 May 2023 03:33:03 -0700 (PDT) Received: from ubuntu-SVE15129CJS.. ([240d:1a:cf7:5800:8e72:6c60:18e6:c4c4]) by smtp.gmail.com with ESMTPSA id r13-20020a17090a940d00b0025352448ba9sm1195870pjo.0.2023.05.19.03.33.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 May 2023 03:33:03 -0700 (PDT) From: Masahisa Kojima To: u-boot@lists.denx.de Cc: Heinrich Schuchardt , Ilias Apalodimas , Simon Glass , Takahiro Akashi , Masahisa Kojima Subject: [PATCH v6 8/8] doc: uefi: add anti-rollback documentation Date: Fri, 19 May 2023 19:32:14 +0900 Message-Id: <20230519103214.1239656-9-masahisa.kojima@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230519103214.1239656-1-masahisa.kojima@linaro.org> References: <20230519103214.1239656-1-masahisa.kojima@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean This commit describe the procedure to configure lowest supported version in the device tree for anti-rollback protection. Signed-off-by: Masahisa Kojima --- Newly created in v6 doc/develop/uefi/uefi.rst | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst index efab0fc7b1..f1f13bb993 100644 --- a/doc/develop/uefi/uefi.rst +++ b/doc/develop/uefi/uefi.rst @@ -539,6 +539,38 @@ since FMP protocol handles multiple image indexes. [--fit | --raw | --guid +Anti-rollback Protection +~~~~~~~~~~~~~~~~~~~~~~~~ + +The anti-rollback protection is implemented differently from firmware versioning. +U-Boot implements the file-based EFI variable storage, it can be tampered +and not the right place to store the lowest supported version. +U-Boot uses device tree to store the lowest supported version, it is secured +as long as dtb is authenticated together with U-Boot image by the authenticated +capsule update, and the former stage boot loader verifies the image containing the dtb +when the system boots. + +1. Insert the lowest supported version into a device tree + +.. code-block:: console + + $ dtc -@ -I dts -O dtb -o version.dtbo version.dts + $ fdtoverlay -i orig.dtb -o new.dtb -v version.dtbo + +where version.dts looks like:: + + /dts-v1/; + /plugin/; + &{/} { + firmware-version { + image1 { + image-type-id = "09D7CF52-0720-4710-91D1-08469B7FE9C8"; + image-index = <1>; + lowest-supported-version = <3>; + }; + }; + }; + Executing the boot manager ~~~~~~~~~~~~~~~~~~~~~~~~~~