[PATCH] doc: uefi: explicitly describe manual dtb update is required

[Heinrich Schuchardt]

On 6/15/23 10:03, Masahisa Kojima wrote:
> To enforce anti-rollback to any older version, dtb must be
> always update manually. This should be described in the
> documentation.
>
> Signed-off-by: Masahisa Kojima <masahisa.kojima at linaro.org>
> ---
>   doc/develop/uefi/uefi.rst | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst
> index ffd13cebe9..d5f8c5f236 100644
> --- a/doc/develop/uefi/uefi.rst
> +++ b/doc/develop/uefi/uefi.rst
> @@ -552,6 +552,9 @@ update using a capsule file with --fw-version of 5, the update will fail.
>   When the --fw-version in the capsule file is updated, lowest-supported-version
>   in the dtb might be updated accordingly.
>
> +If user needs to enroce anti-rollback to any older version,
> +the lowest-supported-version property in dtb must be always updated manually.

Thank you for updating the documentation.

Allowing to circumvent the rollback protection is a security issue. On a
secure system you would probably want to disable console commands like
mc and fdt. Shouldn't we provide an advice for safe settings?

E.g.

"If a user wanted to enable a rollback to a version forbidden by the
lowest-supported-version property specified in U-Boot's control
device-tree, they could change this property using the fdt command.
Secure systems should not enable this command."

Best regards

Heinrich

> +
>   To insert the lowest supported version into a dtb
>
>   .. code-block:: console
>
> base-commit: e350d0c60d413d441cbdfa9432ebadb56f625903