FWUPDMGR HSI levels: seeking information about 'SPI replay protection' (and how to enable it if possible)

Questions
1

I was recently going over a report generated by fwupdmgr securityand found that spi replay protection is the only hardware security feature not enabled by default on my system.

HSI
HSI438×714 35 KB

I’m struggling to find information about this feature apart from some unresolved questions about it on the Framework and HP help forums. It seems the feature is related to another term I can’t find much info on called “RPMC” (Relay Protected Monotonic Counter).

Does anyone have any information on this feature, how to enable it, or what it depends on?

2

SPI being a serial bus, maybe this is some kind of auth replay attack mitigation ?

3

Unfortunately, I believe you can only get this enabled if your OEM issues a firmware update. This is sadly the case for many of the issues on my personal system. You can try reaching out, you might get lucky. I personally, did not.

Here’s more information: FwupdPlugin – 1.0: Host Security ID Specification