From patchwork Thu Jun 22 05:51:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahisa Kojima X-Patchwork-Id: 694889 Delivered-To: patch@linaro.org Received: by 2002:adf:e885:0:0:0:0:0 with SMTP id d5csp1224155wrm; Wed, 21 Jun 2023 22:52:14 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ65unMJqnfu2mMnhhH8pMGMLwkZ2GiKWL61YJpqyKboTaOgK9SLwc//w/2UwxAUcknRtRrR X-Received: by 2002:a05:6214:21a2:b0:625:b3a2:f637 with SMTP id t2-20020a05621421a200b00625b3a2f637mr21398668qvc.8.1687413134703; Wed, 21 Jun 2023 22:52:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1687413134; cv=none; d=google.com; s=arc-20160816; b=R5NN73CiXGG5Nm8kEdrVA5lc3vNbo53WLYavznOzNvKyCi8iWXUs44RNcwqkcRlAyq lz3qoHgrUxn5nfsN17mINU9+ZaablTks1saZ/F/TXecaxkt5cTs6YbyZi15s5EJ0rogr AxrhhFoiDYB3TGjv10RSPHyzmzEtLgvNp/Etsd4RwyEpGVOTxv0XMRDYYz9a48gH8gm1 AqJQcCOzeUl70ZATktbbz10Ji4r2a0xysEYUKLHS7Hj4UHcpgQoreRBbZ0g39sxag4Jm /NpURt7N6hn4ArW2BjmCy1yCmjah1tP3UVKOljhkiX34UswFTeInbFCmUMgiA5rszzVM ZKMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=u9r1Yw6WkXbUrjAtQ4JCogTgNrFbnQBtQvzCwDBbwk4=; b=OTdnPioxIqmVQa76ug/betac/oVOEdUOgZLfdj2vIYeUefMiErcwdO5lS+hfncaIOU sfuZqq6kVG/8sYI1bzZCGAdZwDBVKhEZgul9bNw9zh7lN0ETPvKmJys9/2zCYJXmBfHg 7wpe5SpdN9JW4mS2QtHWvWLMm8YEdu25WNfBDTc0+bwy1g4VKYZfrJhlNE6cggPiXSOP OcM/b1nRy27STFwaNfNYE6JT2xdw6ZZTqHUifD4vCc/KMZTEzGRRuE+cku+utpPtnVm+ IslA7yB5733dDprL8p2o6vkF9kjUOYCObdWQQOK0uyke/T9YFV8ieNNt/DDXHjCvaOsK gCzQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=Cvq9dDM1; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id g11-20020a0562140acb00b006262cd1f8besi2405377qvi.442.2023.06.21.22.52.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Jun 2023 22:52:14 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=Cvq9dDM1; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id DDA5E82A2C; Thu, 22 Jun 2023 07:52:06 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="Cvq9dDM1"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 5092B80EB1; Thu, 22 Jun 2023 07:52:00 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pg1-x534.google.com (mail-pg1-x534.google.com [IPv6:2607:f8b0:4864:20::534]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 8D9C08062B for ; Thu, 22 Jun 2023 07:51:55 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=masahisa.kojima@linaro.org Received: by mail-pg1-x534.google.com with SMTP id 41be03b00d2f7-54f71fa7e41so3757944a12.3 for ; Wed, 21 Jun 2023 22:51:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1687413113; x=1690005113; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=u9r1Yw6WkXbUrjAtQ4JCogTgNrFbnQBtQvzCwDBbwk4=; b=Cvq9dDM1bOQg30qydKPNMp5Nk1MEskKyCTEEmwF+pyWm1/ls4qDfd7G4dYXqj5SgBZ eXmH0LiHBlwV0jbQLYtcG+ceO/K+GbaLrV2u5IOUI3NXYYRLKCB3jrTkbV5ryBDAUIIP XUzi1aUl2yOm9XUEy391X5VwxyHI0VpbtOds1Y+Lzw2ei2FPLUnxk1dDGWJZgKpXJ1VF x0xobbwd+5yD3V99s3FkbVAo5N6nQwEGkirtwLA5qVfYeB9Gg6Vg5wkq70ddm6YvLG3F zmWpv12UC2gPODSnb518Wn3Crgfr0jBeT0JVxtEmojBoe7HAZmq5O72C0ncOvOc7ibIK 6/WQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1687413113; x=1690005113; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=u9r1Yw6WkXbUrjAtQ4JCogTgNrFbnQBtQvzCwDBbwk4=; b=EsheMk5S+uLAGXhx+BzuzudjHDms0FEi6zhPbxXTDS/QYlO9dp1eh5uU+YjHseh+KO nCKL+6ltUX7i8HHvy6MVhXdH1m2AV0MAONJ9Gn3bwfON5r3gQOoi+38uBHPpXpXMUCuy tU9DuQgYiP7NX4DWO0ZKhma2tTJyFhQrx8ZEE6OsRmnxV83nes3bhqO26JeAP0AOb1vA +EmkqMbolnZ1KzQRyLTOb0A+KwclpZVTx7WdGXgvG5cpkv/UiWrNhA+PsuUQNEgwfFg+ ri9Ozb4cgyueXaJD2QLjR7d8ol9WB3vi40uGbV4StBRzEZqVDjBYpm6Auqi9F+fE3gXm xz3A== X-Gm-Message-State: AC+VfDySqV8GV5b0zx1CzyE2TYp5mxsrqRQkqVYYh2eSdLz1eE8HOtmZ IRGEdBk4KkMSHAukuc6lAGQed1Dxb9rFC7lXVf0= X-Received: by 2002:a05:6a20:7f93:b0:10b:8bc7:e112 with SMTP id d19-20020a056a207f9300b0010b8bc7e112mr18652270pzj.10.1687413113584; Wed, 21 Jun 2023 22:51:53 -0700 (PDT) Received: from localhost ([164.70.16.189]) by smtp.gmail.com with ESMTPSA id i15-20020aa78b4f000000b006687198c3easm3883846pfd.179.2023.06.21.22.51.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Jun 2023 22:51:53 -0700 (PDT) From: Masahisa Kojima To: u-boot@lists.denx.de Cc: Heinrich Schuchardt , Ilias Apalodimas , Takahiro Akashi , Masahisa Kojima Subject: [PATCH v2] doc: uefi: enhance anti-rollback documentation Date: Thu, 22 Jun 2023 14:51:30 +0900 Message-Id: <20230622055130.127656-1-masahisa.kojima@linaro.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean To enforce anti-rollback to any older version, dtb must be always update manually. This should be described in the documentation. This commit also adds the recommendation that secure system should not enable the fdt command because lowest-supported-version property in device tree can be changed by fdt command. Signed-off-by: Masahisa Kojima Reviewed-by: Ilias Apalodimas --- doc/develop/uefi/uefi.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst index ffd13cebe9..7407f178f5 100644 --- a/doc/develop/uefi/uefi.rst +++ b/doc/develop/uefi/uefi.rst @@ -552,6 +552,13 @@ update using a capsule file with --fw-version of 5, the update will fail. When the --fw-version in the capsule file is updated, lowest-supported-version in the dtb might be updated accordingly. +If user needs to enroce anti-rollback to any older version, +the lowest-supported-version property in dtb must be always updated manually. + +Note that the lowest-supported-version property specified in U-Boot's control +device tree can be changed by U-Boot fdt command. +Secure systems should not enable this command. + To insert the lowest supported version into a dtb .. code-block:: console