Skip to content

ASRock Rack TURIND8UD-2T/X550 Dasharo Release Notes

Following Release Notes describe status of open-source firmware development for ASRock Rack TURIND8UD-2T/X550

For details about our release process please read Dasharo Standard Release Process.

Note

Before using this firmware, please review the Dasharo Terms of Service and AMD's openSIL project page, which describes openSIL's current Proof-of-Concept status and AMD's evaluation-only support model. Use of this firmware is at the user's own responsibility.

Dasharo Pro Package

This is a Dasharo Pro Package (DPP) release. The pre-built binaries are not publicly available. Access is provided through the BenchRack ASRock TURIND8UD-2T/X550 with Dasharo Pro Package for Servers product in the 3mdeb shop, or by otherwise becoming a Dasharo Pro Package subscriber. As a subscriber you receive access to all firmware updates for the duration of your subscription via the Dasharo Pro Package newsletter, and gain entry to the Dasharo Premier Support invite-only live chat on the Matrix network, enabling direct engagement with the Dasharo Team and fellow subscribers for personalized, priority assistance. See the Dasharo Pro Package FAQ for more details.

v0.9.0 - 2026-08-13

Test results for this release can be found here.

Added

Known issues

Binaries

Raw Dasharo image

sha256 sha256.sig (asrock_turind8ud_v0.9.0.rom)

SBOM CycloneDX

asrock_turind8ud_v0.9.0.sbom.json sha256 sha256.sig

This is a Dasharo Pro Package release. For this platform, access to pre-built binaries is provided exclusively through the Full Build for ASRock Rack TURIND8UD-2T/X550, a bundled hardware-and-firmware product available in the 3mdeb shop. A standalone Dasharo Pro Package subscription is not offered for this platform.

With the Full Build, you receive firmware updates for the duration of your subscription via the Dasharo Pro Package newsletter, and gain entry to the Dasharo Premier Support invite-only live chat on the Matrix network, enabling direct engagement with the Dasharo Team and fellow subscribers for personalized, priority assistance.

To verify binary integrity with hash and signature please follow the instructions in Dasharo release signature verification using this key

SBOM (Software Bill of Materials)

An integrated SBOM is also included in the firmware images. It describes a complete set of components and their versions used to build the firmware images. The published SBOM artifact is in CycloneDX format and can be viewed by SBOM tools, for example sbom-tools.

EU Cyber Resilience Act (CRA)

The EU Cyber Resilience Act requires manufacturers to document what their products are made of and how they handle security issues. This release ships a Software Bill of Materials (SBOM) that lists every firmware component. We check it against the CRA requirements with sbom-tools.

EU CRA Phase 1 (2026): Compliant

Vulnerability and incident reporting (Article 14): how security issues are reported to us and how we notify the authorities. Applies from 11 September 2026.

All mandatory requirements are met. 5 recommendations can still be improved.

Area What it covers Errors Warnings Info
Security Information How to report vulnerabilities and get security updates 0 4 3
Integrity Information Checksums that prove each component is unmodified 0 0 3
Document Metadata Who made the firmware and when the SBOM was created 0 1 0
License Information Under which licenses each component is distributed 0 0 1

Errors are serious gaps. Warnings are smaller gaps or recommendations; after a phase's deadline, missing items are reported as warnings too. Info findings are for reference only.

Show all findings
  • CRA Art. 13(7) / Annex I Part II (1): SBOM freshness (Document Metadata): SBOM has no creation timestamp; keep the documented component inventory current when components change
  • CRA Art. 13(17): Vulnerability disclosure contact (Security Information): SBOM should include a security contact or vulnerability disclosure reference
  • CRA Art. 14(2)(a): 24-hour early-warning channel (Security Information): 24-hour early-warning channel missing — required when an actively-exploited vulnerability is identified
  • CRA Art. 14(2)(b): 72-hour notification channel (Security Information): 72-hour notification channel missing — required for actively exploited vulnerabilities and severe incidents
  • CRA Art. 14: PSIRT contact for external vulnerability reports (Security Information): PSIRT URL missing — required to handle external vulnerability reports
  • CRA Annex I Part I (2)(f): Component integrity information (hash) (Integrity Information): Component 'coreboot' missing cryptographic hash (recommended for integrity) Components: coreboot, AMD openSIL, GCC
  • CRA Art. 13(5): Third-party due diligence (license tracking) (License Information): 1/87 components (1%) missing license information needed to evidence third-party due diligence
  • CRA Annex I Part II (1): Documented vulnerability information (Security Information): No vulnerability data or vulnerability assertion found; include vulnerability information or a statement of no known vulnerabilities
  • CRA Art. 13(8) / 13(19): Support period disclosure (Security Information): Consider specifying a support end date for security updates
  • CRA Art. 14(7): ENISA single reporting platform (Security Information): No ENISA single reporting platform identifier — track ENISA publication and add enisaReportingPlatformId to the CRA sidecar when available

EU CRA Phase 2 (2027): Compliant

All CRA requirements for products sold in the EU, including a complete SBOM, security updates and a support period. Applies from 11 December 2027.

All mandatory requirements are met. 7 recommendations can still be improved.

Area What it covers Errors Warnings Info
Security Information How to report vulnerabilities and get security updates 0 5 4
Integrity Information Checksums that prove each component is unmodified 0 0 3
Document Metadata Who made the firmware and when the SBOM was created 0 2 1
License Information Under which licenses each component is distributed 0 0 1

Errors are serious gaps. Warnings are smaller gaps or recommendations; after a phase's deadline, missing items are reported as warnings too. Info findings are for reference only.

Show all findings
  • CRA Art. 13(2): Documented risk assessment (Document Metadata): No documented risk assessment referenced — add an externalReference of type 'risk-assessment' or supply riskAssessmentUrl in the CRA sidecar
  • CRA Art. 13(7) / Annex I Part II (1): SBOM freshness (Document Metadata): SBOM has no creation timestamp; keep the documented component inventory current when components change
  • CRA Annex I Part II (5): Coordinated vulnerability disclosure policy (Security Information): SBOM should reference a coordinated vulnerability disclosure policy (advisories URL or disclosure URL)
  • CRA Art. 13(17): Vulnerability disclosure contact (Security Information): SBOM should include a security contact or vulnerability disclosure reference
  • CRA Art. 14(2)(a): 24-hour early-warning channel (Security Information): 24-hour early-warning channel missing — required when an actively-exploited vulnerability is identified
  • CRA Art. 14(2)(b): 72-hour notification channel (Security Information): 72-hour notification channel missing — required for actively exploited vulnerabilities and severe incidents
  • CRA Art. 14: PSIRT contact for external vulnerability reports (Security Information): PSIRT URL missing — required to handle external vulnerability reports
  • CRA Annex V: EU Declaration of Conformity reference (Document Metadata): Missing reference to the EU Declaration of Conformity (attestation or certification external reference) for product class Default
  • CRA Annex I Part I (2)(f): Component integrity information (hash) (Integrity Information): Component 'coreboot' missing cryptographic hash (recommended for integrity) Components: coreboot, AMD openSIL, GCC
  • CRA Art. 13(5): Third-party due diligence (license tracking) (License Information): 1/87 components (1%) missing license information needed to evidence third-party due diligence
  • CRA Annex I Part II (1): Documented vulnerability information (Security Information): No vulnerability data or vulnerability assertion found; include vulnerability information or a statement of no known vulnerabilities
  • CRA Annex II (7): Component lifecycle status (Security Information): Consider including component lifecycle/end-of-support information
  • CRA Art. 13(8) / 13(19): Support period disclosure (Security Information): Consider specifying a support end date for security updates
  • CRA Art. 14(7): ENISA single reporting platform (Security Information): No ENISA single reporting platform identifier — track ENISA publication and add enisaReportingPlatformId to the CRA sidecar when available

Platform security (fwupd HSI)

HSI:1 (Critical State)

Basic protection is in place, but a failure at the next level would still have a critical security impact.

fwupd tested this firmware on real hardware and gave it a Host Security ID of HSI:1, level 1 on a scale from 0 (Insecure) to 4 (Secure). Higher is better. To reach a level, the platform must pass all of the checks at that level and at all of the levels below it. More about HSI.

Level What it covers Checks passed Result
HSI-1
Critical		 The most basic protections, considered essential. A failure here could let an attacker compromise the firmware without physical access. 6 / 6
HSI-2
Risky		 Protection of the boot process against an attacker with local access. Failures here are theoretical or hard to exploit. 3 / 5
HSI-3
Protected		 Out-of-band protection of the firmware, possibly including recovery. 2 / 5
HSI-4
Secure		 Encryption and execution protection for the firmware. 2 / 3
Runtime (!) Security issues in the operating system that was running during the test, such as an unencrypted swap partition. They add a "!" to the result but never change the level. 2 / 5
HSI-1 Critical: 6 of 6 checks passed
Check What it checks Status
SMM locked down System Management Mode, the most privileged CPU mode, is locked down. Locked
BIOS firmware updates Firmware updates can be installed through the standard UEFI capsule mechanism. Enabled
Fused platform The chipset is in its locked, production configuration. Locked
Supported CPU fwupd knows how to check the security of this processor. Valid
TPM empty PCRs The firmware records every boot stage in the TPM. Valid
TPM v2.0 A TPM 2.0 security chip is present and usable. Found
HSI-2 Risky: 3 of 5 checks passed
Check What it checks Status
IOMMU Devices are restricted to the memory they are allowed to use (blocks DMA attacks, e.g. via Thunderbolt). Enabled
Platform debugging Hardware debugging interfaces are disabled and locked. Locked
TPM PCR0 reconstruction The TPM boot measurements match the firmware event log. Valid
Platform secure boot The processor only runs firmware signed with the platform vendor's key (AMD PSB).
Why it fails: issue 1		 Disabled
SPI write protection The firmware flash chip is locked against writes from the OS.
Why it fails: note 2		 Disabled
HSI-3 Protected: 2 of 5 checks passed
Check What it checks Status
CET Platform Control-flow Enforcement Technology, which blocks a common class of exploits, is available. Supported
Suspend-to-ram The system does not use S3 sleep, during which memory is less protected. Disabled
SPI replay protection The flash chip rejects replayed writes, so old firmware cannot be written back.
Why it fails: issue 3		 Not supported
Pre-boot DMA protection Devices cannot read or write memory through DMA before the OS has started.
Why it fails: issue 4		 Disabled
Suspend-to-idle The system supports modern standby, which keeps protections active while asleep.
Why it fails: issue 5		 Disabled
HSI-4 Secure: 2 of 3 checks passed
Check What it checks Status
Processor rollback protection The platform refuses to run older, possibly vulnerable firmware. Enabled
SMAP The kernel is prevented from accidentally accessing user memory. Enabled
Encrypted RAM RAM contents are encrypted, protecting against cold-boot and bus snooping attacks.
Why it fails: issue 6		 Not supported
Runtime: 2 of 5 checks passed

Security issues in the operating system that was running during the test, such as an unencrypted swap partition. They add a "!" to the result but never change the level.

Check What it checks Status
fwupd plugins fwupd is running without third-party plugins. Untainted
Linux kernel The Linux kernel has not loaded unsigned or proprietary modules. Untainted
CET OS Support The operating system uses Control-flow Enforcement Technology to block a common class of exploits. Not supported
Linux kernel lockdown The Linux kernel blocks root from modifying the running kernel. Disabled
Linux swap Swap space is encrypted, so memory contents are not written to disk in the clear. Unencrypted

Why some checks fail

  1. Platform secure boot (HSI-2): Platform Secure Boot is currently not implemented in Dasharo firmware.
  2. SPI write protection (HSI-2): SPI Write Protection is not enabled by default in UEFI settings and must be enabled manually.
  3. SPI replay protection (HSI-3): SPI Replay Protection (RPMC) is unsupported by the board's SPI BIOS chip.
  4. Pre-boot DMA protection (HSI-3): Pre-boot DMA protection is currently not supported for AMD platforms in Dasharo firmware.
  5. Suspend-to-idle (HSI-3): Suspend-to-idle isn't supported on server hardware.
  6. Encrypted RAM (HSI-4): fwupdtool --security does not correctly detect server RAM encryption
Full fwupdmgr security output 
HSI-1
✔ SMM locked down:               Locked
✔ BIOS firmware updates:         Enabled
✔ Fused platform:                Locked
✔ Supported CPU:                 Valid
✔ TPM empty PCRs:                Valid
✔ TPM v2.0:                      Found

HSI-2
✔ IOMMU:                         Enabled
✔ Platform debugging:            Locked
✔ TPM PCR0 reconstruction:       Valid
✘ Platform secure boot:          Disabled
✘ SPI write protection:          Disabled

HSI-3
✔ CET Platform:                  Supported
✔ Suspend-to-ram:                Disabled
✘ SPI replay protection:         Not supported
✘ Pre-boot DMA protection:       Disabled
✘ Suspend-to-idle:               Disabled

HSI-4
✔ Processor rollback protection: Enabled
✔ SMAP:                          Enabled
✘ Encrypted RAM:                 Not supported

Runtime Suffix -!
✔ fwupd plugins:                 Untainted
✔ Linux kernel:                  Untainted
✘ CET OS Support:                Not supported
✘ Linux kernel lockdown:         Disabled
✘ Linux swap:                    Unencrypted