Re: [PATCH] doc: uefi: explicitly describe manual dtb update is required

[Heinrich Schuchardt]

Am 19. Juni 2023 02:49:54 MESZ schrieb Takahiro Akashi <takahiro.akashi at linaro.org>:
>On Sat, Jun 17, 2023 at 09:58:13PM +0200, Heinrich Schuchardt wrote:
>> On 6/15/23 10:03, Masahisa Kojima wrote:
>> > To enforce anti-rollback to any older version, dtb must be
>> > always update manually. This should be described in the
>> > documentation.
>> > 
>> > Signed-off-by: Masahisa Kojima <masahisa.kojima at linaro.org>
>> > ---
>> >   doc/develop/uefi/uefi.rst | 3 +++
>> >   1 file changed, 3 insertions(+)
>> > 
>> > diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst
>> > index ffd13cebe9..d5f8c5f236 100644
>> > --- a/doc/develop/uefi/uefi.rst
>> > +++ b/doc/develop/uefi/uefi.rst
>> > @@ -552,6 +552,9 @@ update using a capsule file with --fw-version of 5, the update will fail.
>> >   When the --fw-version in the capsule file is updated, lowest-supported-version
>> >   in the dtb might be updated accordingly.
>> > 
>> > +If user needs to enroce anti-rollback to any older version,
>> > +the lowest-supported-version property in dtb must be always updated manually.
>> 
>> Thank you for updating the documentation.
>> 
>> Allowing to circumvent the rollback protection is a security issue. On a
>> secure system you would probably want to disable console commands like
>> mc and fdt. Shouldn't we provide an advice for safe settings?
>
>Is there any case where a user wants to use fdt for some reason,
>for example, in CONFIG_PREBOOT or CONFIG_BOOTCOMMAND?
>
>-Takahiro Akashi

Dtb overlays can applied via the fdt command.

Best regards

Heinrich


>
>> E.g.
>> 
>> "If a user wanted to enable a rollback to a version forbidden by the
>> lowest-supported-version property specified in U-Boot's control
>> device-tree, they could change this property using the fdt command.
>> Secure systems should not enable this command."
>> 
>> Best regards
>> 
>> Heinrich
>> 
>> > +
>> >   To insert the lowest supported version into a dtb
>> > 
>> >   .. code-block:: console
>> > 
>> > base-commit: e350d0c60d413d441cbdfa9432ebadb56f625903
>>