2026-09-24 –, GPN-T Main Room
This talk examines the practical experience of implementing and evaluating
fwupd HSI on the Gigabyte MZ33-AR1, a server platform running Dasharo
open-source firmware based on coreboot and EDKII. The platform reaches HSI-2
with all requirements for HSI-4 met - a strong baseline - yet several attributes
remain out of reach for various reasons. SPI replay protection, for instance,
is unavailable due to the SPI flash chip chosen in the board design rather
than any AMD-specific limitation. Other gaps are more directly tied to AMD
platform specifics: non-trivial interactions between HSI test tooling and
superuser privileges, and incorrect upstream interpretation of suspend-to-idle
support. These cases illustrate how the gap between what HSI tests
for and what AMD silicon currently exposes to firmware creates friction for
both developers and end users trying to interpret their security scores.
The goal is to give firmware engineers and security practitioners a clear
picture of where HSI on AMD stands today, what is blocking progress, and what
a more complete AMD security attestation story could look like as the
open-source firmware ecosystem matures.
The Host Security ID (HSI) specification, implemented in fwupd, provides an
automated framework for assessing firmware security posture on Linux-based
x86 platforms. Its tests are inherently silicon-vendor-specific, probing
features such as SPI write protection, memory encryption, and boot guard
mechanisms as exposed by the underlying hardware. While Intel platforms have
historically been the primary target of HSI development, AMD server hardware
presents a distinct set of challenges that reveal both the limits of the
current specification and the gaps in the open-source firmware ecosystem's
coverage of AMD security features.
Beyond the current specification, the talk surveys candidate extensions that
would make HSI more expressive on AMD platforms: AMD Secure Launch
(DRTM/SKINIT-based measured launch), chipset GPIO IOMUX lock verification, AMD
SMM Supervisor integration (client-side attestation), and Data Fabric register
lock status reporting. Each maps to a real attack surface and has a plausible
path to implementation within the fwupd attestation model, though each also
carries its own platform-specific verification challenges.
Michał Żygowski is a versatile engineer with a strong focus on system firmware. Works as a senior firmware engineer at 3mdeb Embedded Systems Consulting . Active contributor of coreboot and other open-source projects. Core coreboot developer, maintainer of Braswell SoC, PC Engines, Protectli, MSI and Libretrend platforms. Loves travelling and attending conferences, which actively speaks on. Mainly interested in the firmware, security and advanced hardware features.