How to improve my Host Security ID (HSI) level?

Ask Fedora
,
1

I recently got a Thinkpad T14 gen 1 AMD and I’m trying to improve the security level.
After running sudo fwupdmgr security --force to display the current level, I get this:

signal-2025-03-03-203947_002
signal-2025-03-03-203947_0021201×1600 131 KB

After a deep research on the internet on how to enable SPI write protection, I found nothing. I checked the BIOS, but there isn’t anything that I found.

So, I’m not sure how to enable this, does anyone know?

2 
sudo fwupdmgr security -v --force

-v stands for verbouse and gives you a bit more infos. Try also

sudo fwupdmgr security --help  #to see more options
3

So I ran the first command and here’s what I got:

Host Security ID: HSI:1 (v1.9.28)

HSI-1
✔ BIOS firmware updates:         Enabled
✔ Fused platform:                Locked
✔ Supported CPU:                 Valid
✔ TPM empty PCRs:                Valid
✔ TPM v2.0:                      Found
✔ UEFI bootservice variables:    Locked
✔ UEFI platform key:             Valid
✔ UEFI secure boot:              Enabled

HSI-2
✔ BIOS rollback protection:      Enabled
✔ IOMMU:                         Enabled
✔ Platform debugging:            Locked
✔ TPM PCR0 reconstruction:       Valid
✘ SPI write protection:          Disabled

HSI-3
✔ Pre-boot DMA protection:       Enabled
✔ Suspend-to-idle:               Enabled
✔ Suspend-to-ram:                Disabled
✘ SPI replay protection:         Not supported
✘ CET Platform:                  Not supported

HSI-4
✔ Encrypted RAM:                 Encrypted
✔ SMAP:                          Enabled
✘ Processor rollback protection: Disabled

Runtime Suffix -!
✔ fwupd plugins:                 Untainted
✔ Linux kernel lockdown:         Enabled
✔ Linux swap:                    Encrypted
✔ Linux kernel:                  Untainted

Host Security Events
2025-03-03 18:47:43:  ✔ BIOS rollback protection changed: Disabled → Enabled
2025-03-03 18:47:43:  ✔ Suspend-to-idle changed: Disabled → Enabled
2025-03-03 18:47:43:  ✔ Suspend-to-ram changed: Enabled → Disabled
2025-03-03 18:47:43:  ✔ Encrypted RAM changed: Not supported → Encrypted

I doesn’t seem to specify how to enable it.

4

Does this happen to work? (source)

sudo flashrom --wp-disable

This page mentions FuPluginPciPsp: fwupdmgr security reports disabled SPI write protection · Issue #432 · fwupd/firmware-lenovo · GitHub

It looks like this might report specifically what’s not working:

sudo fwupdtool security -vv
6

Does this happen to work?

I’m confused, how would disabling it even help?

After running sudo fwupdtool security -vv, this is the just of what I got.

15:09:08.184 FuPluginPciPsp       rollback protection not enforced
15:09:08.184 FuPluginPciPsp       no RPMC compatible SPI rom present
15:09:08.184 FuPluginPciPsp       ROM armor not enforced

15:09:08.221 FuMain                 AppstreamId:          org.fwupd.hsi.Amd.SpiWriteProtection
  Created:              2025-03-04
  HsiLevel:             2
  HsiResult:            not-enabled
  HsiResultSuccess:     enabled
  Flags:                action-contact-oem
  Name:                 SPI write protection
  Summary:              AMD Firmware Write Protection
  Description:          Firmware Write Protection protects device firmware memory from being tampered with.
  Plugin:               pci_psp
  Uri:                  https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Amd.SpiWriteProtection
  Guid:                 0e8dc554-a0a2-51fb-b439-1eb72b14ec38
  Guid:                 66c84470-1ef2-55dd-89c2-3a240a2380b4

So what I’m getting from this is that it’s not enabled. But the question still remains how to enable it.

7

BIOS settings to enable stuff that was what i did to get HSI 3 since my NVIDIA taints Kernel

Idle…: 0%
Host Security ID: HSI:3! (v1.9.28)

HSI-1
✔ BIOS firmware updates:         Enabled
✔ MEI key manifest:              Valid
✔ csme manufacturing mode:       Locked
✔ csme override:                 Locked
✔ csme v0:15.0.50.2633:          Valid
✔ Platform debugging:            Disabled
✔ SPI write:                     Disabled
✔ SPI lock:                      Enabled
✔ SPI BIOS region:               Locked
✔ Supported CPU:                 Valid
✔ TPM empty PCRs:                Valid
✔ TPM v2.0:                      Found
✔ UEFI bootservice variables:    Locked
✔ UEFI platform key:             Valid
✔ UEFI secure boot:              Enabled

HSI-2
✔ BIOS rollback protection:      Enabled
✔ Intel BootGuard ACM protected: Valid
✔ Intel BootGuard:               Enabled
✔ Intel BootGuard OTP fuse:      Valid
✔ Intel BootGuard verified boot: Valid
✔ Intel GDS mitigation:          Enabled
✔ IOMMU:                         Enabled
✔ Platform debugging:            Locked
✔ TPM PCR0 reconstruction:       Valid

HSI-3
✔ Intel BootGuard error policy:  Valid
✔ CET Platform:                  Supported
✔ Pre-boot DMA protection:       Enabled
✔ Suspend-to-idle:               Enabled
✔ Suspend-to-ram:                Disabled

HSI-4
✔ SMAP:                          Enabled
✘ Encrypted RAM:                 Not supported

Runtime Suffix -!
✔ fwupd plug-ins:                Untainted
✔ CET OS Support:                Supported
✔ Linux kernel lockdown:         Enabled
✔ Linux swap:                    Encrypted
✘ Linux kernel:                  Tainted

This system has HSI runtime issues.
 » https://fwupd.github.io/hsi.html#hsi-runtime-suffix

Host Security Events
  2025-02-26 13:30:37:  ✘ Kernel is tainted
8

I bet you can’t. This is probably something Lenovo has to fix via a firmware update. fwupdmgr security reports disabled SPI write protection · Issue #432 · fwupd/firmware-lenovo · GitHub seems like the correct issue report for this; Lenovo actively monitors that GitHub repo.

1 Like
9

I was thinking the setting could be flipped to enable if it did anything, but it seems that’s not related.

SPI replay protection requires hardware and firmware support. SPI write protection requires firmware support.

The BIOS setting in the ASUS BIOS does not enable AMD’s secure processor firmware anti rollback (FAR), it is an ASUS specific implementation.

A quick search of that FAR name showed:

AMD Ryzen™ PRO 5000 series mobile processors has a feature called “Firmware Anti-Rollback (FAR)”

Which implies it might not be possible on 4000-series (Lenovo reports 3 4000-series CPUs for T14)

2 Likes
10

I remember when I got into this a year or so ago I was able to get some more check marks by enabling “Use OS defaults” or the like in my UEFI and then resetting the UEFI to default. Even still as someone mentioned I have a failure in every level, so I’m HSI-0. Whatevs, maybe when I get a new laptop when this one dies it will be better about it.

(Found the old thread on this)