Fusing instructions #1195
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -2,34 +2,42 @@ | |||||
|
|
||||||
| This section describes the functionality of the Dasharo Tools Suite. These are: | ||||||
|
|
||||||
| - [Features](#features) | ||||||
| + [Available Commands](#available-commands) | ||||||
| + [Dasharo zero-touch initial deployment (i.e. DZTID)](#dasharo-zero-touch-initial-deployment-ie-dztid) | ||||||
| + [HCL Report](#hcl-report) | ||||||
| - [HCL Report correctness](#hcl-report-correctness) | ||||||
| - [HCL Report Using an External Firmware Binary](#hcl-report-using-an-external-firmware-binary) | ||||||
| - [BIOS backup](#bios-backup) | ||||||
| + [Firmware update](#firmware-update) | ||||||
| - [Firmware Update Mode](#firmware-update-mode) | ||||||
| - [Local firmware update](#local-firmware-update) | ||||||
| - [Update issues](#update-issues) | ||||||
| + [EC transition](#ec-transition) | ||||||
| + [EC update](#ec-update) | ||||||
| + [Fusing the device vendor keys](#fusing-the-device-vendor-keys) | ||||||
| + [Verify Intel Boot Guard key](#verify-intel-boot-guard-key) | ||||||
| + [Additional features](#additional-features) | ||||||
| - [Run commands from iPXE shell automatically](#run-commands-from-ipxe-shell-automatically) | ||||||
| - [Run DTS using VentoyOS](#run-dts-using-ventoyos) | ||||||
|
|
||||||
| ## Available Commands | ||||||
|
|
||||||
| When DTS is started, it has following options for the user to choose from: | ||||||
|
|
||||||
| - **1)** [Dasharo HCL Report](#hcl-report) - generate Hardware | ||||||
| Compatibility List Report | ||||||
| - **2)** [Update Dasharo Firmware](#firmware-update) or [Install Dasharo | ||||||
| Firmware](#dasharo-zero-touch-initial-deployment) | ||||||
| - **3)** [Restore Firmware from Dasharo HCL Report](#update-issues) | ||||||
| - **4)** [Load your DPP | ||||||
| keys](../../osf-trivia-list/dts.md#how-can-i-use-my-dasharo-pro-package-credentials) | ||||||
| \- Load your Dasharo Pro Package (DPP) keys | ||||||
| - **R** Reboot | ||||||
| - **P** Poweroff | ||||||
| - **S** Enter shell | ||||||
| - **K** Launch SSH Server | ||||||
| - **L** [Enable sending DTS | ||||||
| logs](../../osf-trivia-list/dts.md#how-can-i-help-the-support-team-diagnose-my-problem-faster) | ||||||
|
|
||||||
| ## Dasharo zero-touch initial deployment (i.e. DZTID) | ||||||
|
|
@@ -60,20 +68,20 @@ version of Dasharo, which we provide for given hardware. | |||||
|
|
||||||
| This feature is supported on the following platforms: | ||||||
|
|
||||||
| - ASUS KGPE-D16, | ||||||
| - Dell OptiPlex 7010/9010, | ||||||
| - MSI PRO Z690-A DDR4, | ||||||
| - MSI PRO Z690-A DDR5, | ||||||
| - MSI PRO Z790-P DDR4, | ||||||
| - MSI PRO Z790-P DDR5, | ||||||
| - NovaCustom NV4x (only 11th Gen (Tiger Lake)), | ||||||
| - NovaCustom NS5x/7x (only 11th Gen (Tiger Lake)), | ||||||
| - ODROID-H4+. | ||||||
|
|
||||||
| And partially (only EC firmware flashing) on: | ||||||
|
|
||||||
| - NovaCustom V540TU/TNx, | ||||||
| - NovaCustom V560TU/TNx. | ||||||
|
|
||||||
| ## HCL Report | ||||||
|
|
||||||
|
|
@@ -185,11 +193,11 @@ contribute information about your hardware configuration. | |||||
|
|
||||||
| Please consider the following options depending on your situation: | ||||||
|
|
||||||
| - **YES** - If you decide to contribute, you can always [get back to | ||||||
| us](https://www.dasharo.com/pages/contact/) and ask about BIOS backup, which | ||||||
| we will provide after simple verification that you are the owner of the | ||||||
| hardware. | ||||||
| - **NO (default)** - If you decide to not contribute, your situation depends on | ||||||
| the boot method you used to execute DTS: | ||||||
| + **Network Boot** - please note that Dasharo booted over iPXE assumes no | ||||||
| storage available, so the report, and your BIOS backup are stored in | ||||||
|
|
@@ -412,7 +420,7 @@ firmware. | |||||
| DTS allows to update open-source Embedded Controller firmware to the newer | ||||||
| version. This is how we can achieve that. | ||||||
|
|
||||||
| - Retrieve information about your current EC. | ||||||
|
|
||||||
| ```bash | ||||||
| dasharo_ectool info | ||||||
|
|
@@ -426,10 +434,10 @@ version. This is how we can achieve that. | |||||
| version: 2022-08-16_c12ff1a | ||||||
| ``` | ||||||
|
|
||||||
| - Download the newest version of Embedded Controller firmware. | ||||||
| - Plug in power supply, without it, flashing EC is not possible as losing power | ||||||
| may cause in damaged firmware. | ||||||
| - Flash Embedded Controller firmware internally. | ||||||
|
|
||||||
| ```bash | ||||||
| dasharo_ectool flash ec_file.rom | ||||||
|
|
@@ -457,10 +465,10 @@ version. This is how we can achieve that. | |||||
|
|
||||||
| > Note: this is example output, versions may differ | ||||||
|
|
||||||
| - Computer will shut down automatically. | ||||||
| - Power on your computer. Booting process may take a while. | ||||||
| - After boot, choose option `S` to drop to Shell. | ||||||
| - Retrieve information about your updated EC. | ||||||
|
|
||||||
| ```bash | ||||||
| dasharo_ectool info | ||||||
|
|
@@ -474,6 +482,40 @@ version. This is how we can achieve that. | |||||
| version: 2022-08-31_cbff21b | ||||||
| ``` | ||||||
|
|
||||||
| ## Fusing the device vendor keys | ||||||
|
|
||||||
| DTS can be used to fuse the device vendor keys onto the SoC to enable | ||||||
| the Dasharo TrustRoot feature. | ||||||
|
|
||||||
| !!! warning | ||||||
|
|
||||||
| This operation is irreversible and can seriously hinder the devices | ||||||
| usability for the sake of security. Make sure you understand the | ||||||
|
Comment on lines
+492
to
+493
Member
There was a problem hiding this comment.
What exactly? Which aspects of usability could be affected after fusing?
Contributor
Author
There was a problem hiding this comment.
The details are already described there should anyone be interested in more details like what functionality could be hindered |
||||||
| consequences before continuing. | ||||||
| Refer to [Glossary / Dasharo TrustRoot](../../glossary.md#dasharo-trustroot) | ||||||
| for more details. | ||||||
|
|
||||||
| The decision to fuse the keys requires the user to explicitly opt-in. | ||||||
| Updating the firmware will never fuse the device on its own. | ||||||
|
|
||||||
| To perform fusing procedure: | ||||||
|
Member
There was a problem hiding this comment.
Suggested change
|
||||||
|
|
||||||
| 1. Make sure a power supply is connected to the device if it is battery powered | ||||||
| 2. Make sure the device has Dasharo firmware and the support for Dasharo | ||||||
|
Member
There was a problem hiding this comment. How can users check this? At the very least, we should have a link to the supported hardware page
Contributor
Author
There was a problem hiding this comment. There is none at this moment
Member
There was a problem hiding this comment.
What does “none” refer to?
Contributor
Author
There was a problem hiding this comment. It refers to the lack of such list as far as I can tell. We have some similar lists in the docs and they often become outdated, like it was the case with Firmware Update Mode and Capsule Updates some time ago. In this case it could be better to make sure the option to "Fuse Platform" only shows on supported devices or depend on the feature to inform in a user friendly way about the lack of support for given device.
Contributor
Author
There was a problem hiding this comment. It refers to the lack of such list as far as I can tell. We have some similar lists in the docs and they often become outdated, like it was the case with Firmware Update Mode and Capsule Updates some time ago. In this case it could be better to make sure the option to "Fuse Platform" only shows on supported devices or depend on the feature to inform in a user friendly way about the lack of support for given device.
Contributor
Author
There was a problem hiding this comment. Made a script that generates the list of trustroot support based on DTS configs - if DTS supports fusing, then it appears on the list #1197 (comment) Could be used in a CI of some sort.
Contributor
Author
There was a problem hiding this comment. Would you like a table like that to be created somewhere?
Member
There was a problem hiding this comment. We have a page with supported hardware: https://docs.dasharo.com/variants/overview/
Contributor
Author
There was a problem hiding this comment. That's a table of the Dasharo supported hardware as a whole, not the hardware that supports the feature of Dasharo TrustRoot. Some information about feature support can be found in test matrices of some devices (https://docs.dasharo.com/variants/dell_optiplex/test-matrix/), some in those tables for some features (https://docs.dasharo.com/kb/firmware-update-mode/#supported-devices, https://docs.dasharo.com/guides/capsule-update/#supported-devices), some are not documented at all as we don't have a well defined list of "features" Dasharo/open-source-firmware-validation#886 Should a list like that, be created, all of those places could be replaced with more solid source. It is deeply connected with the fact that if we define such list, the test cases we run on the devices could potentially be determined automatically. Creating such list of features and defining how the features and tests depend, cause and exclude each other would be a major stretch and require some good planning, but is definitely possible. It's just a complex logic equation that if well defined in some human readable format could be processed by a computer. |
||||||
| TrustRoot. | ||||||
| 3. Boot Dasharo Tools Suite and choose the option `7) Fuse platform`. | ||||||
|  | ||||||
| 1. If you are not using the newest Dasharo version available, you will be | ||||||
| prompted to update Dasharo first. Proceed with [Firmware Update](#firmware-update) | ||||||
| and try again. | ||||||
| 4. You will be prompted to confirm that you want to fuse the device. Select `y` | ||||||
| to continue or `n` to cancel. | ||||||
| 5. From now on the rest of the procedure will look like a normal firmware update. | ||||||
| You will be asked to verify the device model and the firmware version about | ||||||
| to be installed along the fusing procedure. | ||||||
| 6. After everything is done, your device will reboot. | ||||||
|  | ||||||
|
|
||||||
| ## Verify Intel Boot Guard key | ||||||
|
|
||||||
| It's possible to verify which keys currently running firmware is signed with: | ||||||
|
|
@@ -506,11 +548,11 @@ You can use the | |||||
| [local-ipxe-server.sh](https://github.com/Dasharo/meta-dts/blob/main/scripts/local-ipxe-server.sh) | ||||||
| script for that. What it does is: | ||||||
|
|
||||||
| - automatically download the latest version of DTS artifacts needed for iPXE | ||||||
| boot, | ||||||
| - creates a `dts.ipxe` bootchain file, which will boot DTS and also run your | ||||||
| custom script, | ||||||
| - creates a simple, python-based HTTP server, from which you will be able to | ||||||
| boot DTS. | ||||||
|
|
||||||
| > Note: This functionality is available from version 1.2.19. | ||||||
|
|
||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # Dasharo TrustRoot - Fusing vendor keys to the CPU | ||
|
|
||
| In order to take use of the Dasharo TrustRoot feature on supported Devices, | ||
| the device vendor key hashes need to be physically burned into the SoC. | ||
|
|
||
| This document describes the steps for fusing vendor keys into your device. | ||
| For more details check [Glossary / Dasharo TrustRoot](../glossary.md#dasharo-trustroot) | ||
|
|
||
| !!! warning | ||
|
|
||
| Fusing device vendor keys is a feature targeted for advanced security | ||
| freaks. This operation permanently modifies your CPU. Reverting it | ||
| is only possible by replacing the CPU in the device. | ||
| Fusing vendor keys onto your CPU makes it impossible to: | ||
|
|
||
| - Use custom firmware not authorized by the vendor | ||
| - Update the firmware to a custom one if the support for your device ends | ||
|
|
||
| Be careful and make sure you understand the consequences before | ||
| proceeding with fusing your device. | ||
|
|
||
| ## Fusing the device vendor keys using Dasharo Tools Suite | ||
|
|
||
| It's the recommended way of fusing your device. For details refer | ||
| to [Dasharo Tools Suite documentation](../dasharo-tools-suite/documentation/features.md#fusing-the-device-vendor-keys) | ||
|
|
||
| ## Fusing the device using an EOM capsule (ADVANCED!) | ||
|
|
||
| !!! warning | ||
|
|
||
| This method does not include any confirmations and guards from fusing the | ||
| device by a mistake. It is __NOT RECOMMENDED__ to perform the fusing | ||
| using a manual capsule update described here. Please consider doing it | ||
| [using DTS](#fusing-the-device-vendor-keys-using-dasharo-tools-suite) | ||
| instead. | ||
|
|
||
| 1. Locate the EOM capsule file of the desired Dasharo version. EOM firmware is | ||
| marked with `.eom` suffix, like `novacustom_v56x_mtl_igpu_v1.0.0_btg_provisioned.cap.eom`. | ||
| Make sure the firmware version is equal or higher than the currently used. | ||
| 2. Boot Dasharo Tools Suite. On how to, refer to [Running DTS](../dasharo-tools-suite/documentation/running.md) | ||
| 3. Enter the shell by pressing the `S` key as instructed in the main screen. | ||
| 4. Get the capsule file onto the running DTS by any means: `wget`, `scp` etc. | ||
| 5. Run `cat <your_eom_capsule_file> > /dev/efi_capsule_loader` to load the capsule. | ||
| 6. Reboot the device to perform the capsule update and fuse the device in the process. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am confused by this title. Users don’t fuse the keys; they fuse the device.
A better alternative could be: "Fusing the device to enable Dasharo TrustRoot”
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Where is this vocabulary defined?
I believe both versions would be colloquial, as if we would be precise, we should say that we are blowing the fuses that allow write access to the keys saved in the CPU.
I don't think one version is better than the other, but knowing that there are many more fuses unrelated to Intel Boot Guard or Dasharo TrustRoot available in most CPUs, I'd say that fusing the device is more confusing. Please prove me wrong if that's not the case.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We have named this option in DTS, which you are describing in the documentation, “Fuse Platform.” To be consistent, I think it is best to keep this naming and add the title: “Fuse Platform to enable Dasharo TrustRoot.”
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see, if it's just about consistency with DTS then it makes sense, I'll change it
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see, if it's just about consistency with DTS then it makes sense, I'll change it
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
3faae52