diff options
| author | Masahisa Kojima <masahisa.kojima@linaro.org> | 2023-06-07 14:41:58 +0900 |
|---|---|---|
| committer | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2023-06-08 09:20:36 +0200 |
| commit | 027f8a82ea3671a5ffcd5183550cde12bd45da39 (patch) | |
| tree | c7ced5f0b2be9099b82fb39f63a676430ebe6975 | |
| parent | 83be41049b35056c3e0062743aa804671321597f (diff) | |
| download | u-boot-027f8a82ea3671a5ffcd5183550cde12bd45da39.zip u-boot-027f8a82ea3671a5ffcd5183550cde12bd45da39.tar.gz u-boot-027f8a82ea3671a5ffcd5183550cde12bd45da39.tar.bz2 | |
doc: uefi: add anti-rollback documentation
This commit describe the procedure to configure lowest supported
version in the device tree for anti-rollback protection.
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
| -rw-r--r-- | doc/develop/uefi/uefi.rst | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst index 30b90a0..ffd13ce 100644 --- a/doc/develop/uefi/uefi.rst +++ b/doc/develop/uefi/uefi.rst @@ -537,6 +537,45 @@ where signature.dts looks like:: }; }; +Anti-rollback Protection +************************ + +Anti-rollback prevents unintentional installation of outdated firmware. +To enable anti-rollback, you must add the lowest-supported-version property +to dtb and specify --fw-version when creating a capsule file with the +mkeficapsule tool. +When executing capsule update, U-Boot checks if fw_version is greater than +or equal to lowest-supported-version. If fw_version is less than +lowest-supported-version, the update will fail. +For example, if lowest-supported-version is set to 7 and you run capsule +update using a capsule file with --fw-version of 5, the update will fail. +When the --fw-version in the capsule file is updated, lowest-supported-version +in the dtb might be updated accordingly. + +To insert the lowest supported version into a dtb + +.. code-block:: console + + $ dtc -@ -I dts -O dtb -o version.dtbo version.dts + $ fdtoverlay -i orig.dtb -o new.dtb -v version.dtbo + +where version.dts looks like:: + + /dts-v1/; + /plugin/; + &{/} { + firmware-version { + image1 { + image-type-id = "09D7CF52-0720-4710-91D1-08469B7FE9C8"; + image-index = <1>; + lowest-supported-version = <3>; + }; + }; + }; + +The properties of image-type-id and image-index must match the value +defined in the efi_fw_image array as image_type_id and image_index. + Executing the boot manager ~~~~~~~~~~~~~~~~~~~~~~~~~~ |