From 345a8b15acf228c4a429f6569c34cbc0232e76eb Mon Sep 17 00:00:00 2001 From: Masahisa Kojima Date: Thu, 22 Jun 2023 17:06:29 +0900 Subject: [PATCH] doc: uefi: enhance anti-rollback documentation To enforce anti-rollback to any older version, dtb must be always update manually. This should be described in the documentation. This commit also adds the recommendation that secure system should not enable the fdt command because lowest-supported-version property in device tree can be changed by fdt command. Reviewed-by: Ilias Apalodimas Signed-off-by: Masahisa Kojima --- doc/develop/uefi/uefi.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst index 6626ceec52..a7a41f2fac 100644 --- a/doc/develop/uefi/uefi.rst +++ b/doc/develop/uefi/uefi.rst @@ -552,6 +552,13 @@ update using a capsule file with --fw-version of 5, the update will fail. When the --fw-version in the capsule file is updated, lowest-supported-version in the dtb might be updated accordingly. +If user needs to enforce anti-rollback to any older version, +the lowest-supported-version property in dtb must be always updated manually. + +Note that the lowest-supported-version property specified in U-Boot's control +device tree can be changed by U-Boot fdt command. +Secure systems should not enable this command. + To insert the lowest supported version into a dtb .. code-block:: console