Hi Kojima-san,
On Fri, May 19, 2023 at 07:32:14PM +0900, Masahisa Kojima wrote:
> This commit describe the procedure to configure lowest supported
> version in the device tree for anti-rollback protection.
>
> Signed-off-by: Masahisa Kojima <masahisa.koj...@linaro.org>
> ---
> Newly created in v6
>
> doc/develop/uefi/uefi.rst | 32 ++++++++++++++++++++++++++++++++
> 1 file changed, 32 insertions(+)
>
> diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst
> index efab0fc7b1..f1f13bb993 100644
> --- a/doc/develop/uefi/uefi.rst
> +++ b/doc/develop/uefi/uefi.rst
> @@ -539,6 +539,38 @@ since FMP protocol handles multiple image indexes.
> [--fit | --raw | --guid <guid-string] \
> <image_blob> <capsule_file_name>
>
> +Anti-rollback Protection
> +~~~~~~~~~~~~~~~~~~~~~~~~
> +
> +The anti-rollback protection is implemented differently from firmware
> versioning.
> +U-Boot implements the file-based EFI variable storage, it can be tampered
> +and not the right place to store the lowest supported version.
> +U-Boot uses device tree to store the lowest supported version, it is secured
> +as long as dtb is authenticated together with U-Boot image by the
> authenticated
> +capsule update, and the former stage boot loader verifies the image
> containing the dtb
> +when the system boots.
This is details of implementation.
You should rather mention the usage, i.e. how "anti-rollback" can be managed
and achieved using firmware-version and lowest-supported-version and that users
should always update their device tree to enforce the protection.
(If the lowest-supported-version is kept the same even after the firmware
update,
anti-rollback won't work.)
-Takahiro Akashi
> +1. Insert the lowest supported version into a device tree
> +
> +.. code-block:: console
> +
> + $ dtc -@ -I dts -O dtb -o version.dtbo version.dts
> + $ fdtoverlay -i orig.dtb -o new.dtb -v version.dtbo
> +
> +where version.dts looks like::
> +
> + /dts-v1/;
> + /plugin/;
> + &{/} {
> + firmware-version {
> + image1 {
> + image-type-id =
> "09D7CF52-0720-4710-91D1-08469B7FE9C8";
> + image-index = <1>;
> + lowest-supported-version = <3>;
> + };
> + };
> + };
> +
> Executing the boot manager
> ~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> --
> 2.17.1
>
