smallsolar/u-boot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

doc: uefi: enhance anti-rollback documentation

Browse Source 
To enforce anti-rollback to any older version, dtb must be
always update manually. This should be described in the
documentation.

This commit also adds the recommendation that secure system should not
enable the fdt command because lowest-supported-version
property in device tree can be changed by fdt command.

Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
This commit is contained in:
Masahisa Kojima
2023-06-22 17:06:29 +09:00
committed by Heinrich Schuchardt
parent a12b36434d
commit 345a8b15ac
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
doc/develop/uefi/uefi.rst
View File

@@ -552,6 +552,13 @@ update using a capsule file with --fw-version of 5, the update will fail.
When the --fw-version in the capsule file is updated, lowest-supported-version
in the dtb might be updated accordingly.
If user needs to enforce anti-rollback to any older version,
the lowest-supported-version property in dtb must be always updated manually.
Note that the lowest-supported-version property specified in U-Boot's control
device tree can be changed by U-Boot fdt command.
Secure systems should not enable this command.
To insert the lowest supported version into a dtb
.. code-block:: console