pietrushnic

A summary of the upcoming UEFI capsule updates, exploring areas that were in need of improvement and what has actually been done. The developments affect general usage and documentation, provide strong security guarantees, and enhance feedback during firmware updates. Additionally, a related subject of fwupd as a capsule delivery mechanism on FreeBSD, Qubes OS and Windows is also covered.

3mdeb’s latest Dasharo builds finally let you touch CPU and memory voltages from an open-source BIOS. The release notes are refreshingly blunt about what happens next.

The latest Dasharo firmware release for MSI PRO Z690-A (v1.1.7) and MSI PRO Z790-P (v0.9.5) is here. This release brings preliminary SMI Transfer Monitor support, a new Platform Setup Menu with experimental CPU overclocking options, XMP improvements, and many other fixes and enhancements.

A look at DRTM on ARM: where it stands compared to Intel TXT/AMD SKINIT and what will it take to run TrenchBoot on AArch64. How can TrenchBoot support both x86 and ARM architectures at the same time.

"Long story short, the Dasharo performance led to effectively the same performance as the default proprietary BIOS performance overall. No overall loss in performance in going for the AMD openSIL / open-source option."

This report details a release engineering incident where a Dasharo firmware update successfully performed End-of-Manufacturing (EOM) fusing on NovaCustom laptops but utilized an ephemeral testing key instead of the persistent production key. We provide a technical analysis of the situation and outline impact for affected end users.

This is a post about the process of porting Dasharo to a modern Intel-based server platform if you would like to learn how a coreboot port is integrated into Dasharo and enhanced with its features feel free to ask any questions.

In the blog post, the author explains the effort of porting platform-specific ACPI code and shows the extent of bugfixes required to run operating systems without issues on the AMD Turin server platform, the Gigabyte MZ33-AR1.

Another post about the Gigabyte MZ33-AR1 porting effort progress. This time, we add definitions for PCI Express initialization, and validate BMC KVM VGA and keyboard. Also, improvements to HCL reporting and data dumping on AMD systems have been made.

As the Gigabyte MZ33-AR1 porting effort progresses, coreboot has to add definitions for I/O bus initialization, such as SATA, USB, and PCI Express. If you are curious how it is done on an AMD Turin-based system or want to educate yourself about modern server SATA, USB, and PCIe buses, this blog post is for you.

The blog post describes the analysis of PSP blobs on Gigabyte. MZ33-AR1. The analysis covers various aspects of stitching AMD firmware BIOS images and how support for stitching Turin blobs was developed in coreboot.

Remote Management Solutions, everyone wants them, but nobody wants to be the one doing them. Bringing support to a new platform is challenging, but bringing support to a proprietary platform is on another level.

Check out what it takes to port OpenBMC to a proprietary platform:

* What are the caveats of working with proprietary platforms? * How to identify and resolve the issues? * Why is the community effort necessary? * Some inside insights on what we managed to learn during the development.

Whether you are evaluating OpenBMC for the first time or looking for practical tips to streamline your deployment, this presentation explores the challenges, obstacles, and little victories along the way, offering a real-life example to learn from.

Keeping UEFI Secure Boot DBX and CPU microcode up to date in CI pipelines can be challenging, especially if you want to automate the process and stay in sync with upstream security updates.

One approach we explored involved adding mechanisms for automatic DBX updates (UEFI Secure Boot revocation lists) and CPU microcode refresh to CI workflows, as described in this blogpost. The goal was to reduce manual steps when integrating updated DBX payloads and microcode packages, while enabling early detection of regressions during firmware validation.

By making these updates part of the reproducible build process, it becomes easier to maintain supply-chain transparency and strengthen platform resilience against known vulnerabilities.

Presentation describing the implementation: https://cfp.3mdeb.com/developers-vpub-0xf-2025/talk/3KFCDR/

This is precisely it. Also, maybe some regulatory requirements of cloud providers and organizations like OCP. Commoditizing their complement is probably another obvious goal.

We also have to note that AMD seems to be heading for being a market leader in the server market (some signals are active in OCP Caliptra and OSF). We can see their presence at the upcoming OCP Summit, where they (together with Intel) will push forward the agenda of a generic framework for bootstrapping firmware, which is called openSFI: https://youtu.be/1CE6olXT604