firmware-update

Updating firmware is hard. It is a process that is individual for every piece of hardware and requires a long downtime. Most vendors do not even provide updates for their BIOS. Also sometimes updates can make the system unstable and who wants to touch a running system? There is a rule to not do that.

But what if the process was easy?

Meltdown and Spectre have shown us that not only software is vulnerable. Hardware is so, too. Very often when we use that term, we are talking about vulnerabilities in software that is running very close to the hardware: The BIOS or other management functionality. In this Wiki, this is just firmware.

Keeping the firmware updated is a bit hard (no pun intended). Very often you need to prepare a special USB key. And when the system is remote, rebooting into that Key is not possible at all.

What if we just baked all this into one simple command? firmware-update update

On supported systems, this command will flash the latest firmware version onto the SPI flash of the board the system is running on. After a reboot, you are running the latest firmware. How much easier can it get?

Note - Only PC Engines APU1 - APU6 images are currently supported. See request for help below.

We decided to not make this process automatic - although there are some reasons for that. Either way, it is just two commands away for all PC Engines APU-based systems:

Installation

firmware-update can be installed with the Pakfire web interface (WebUI) or via the console:

pakfire install firmware-update

Usage

There is no web interface for this Addon. To run this Addon open the client console or terminal and access the IPFire box via SSH.

pakfire install pcengines-apu-firmware      # download current images
firmware-update update

Options

firmware-update { info | update | version }
[root@ipfire ~]# firmware-update info
Board       : PC Engines apu4
HW Version  : 1.0
Serial      : 123456
BIOS Version: v4.12.0.1 (05/29/2020)

[root@ipfire ~]# firmware-update version
firmware-update: Version 20210107

Community Participation required

We, the developers, of course do not have access to all the hardware. We decided to go with the PC Engines boards, because they have a firmware that is regularly updated and extended and we also got a free sample of the board. Thank you very much to the people from PC Engines for that!

However, there is other boards that have a (freely distributable firmware) that could be integrated, too. If you have one of those and there is a larger user base of them in IPFire, please send patches.

It would be great if this would grow into a small collection of firmware so that many systems can easily be kept up to date. The tool would also support firmware updates for NICs and other parts that have firmware blobs.

Edit Page ‐ Yes, you can edit!

Older Revisions • Thursday at 4:28 pm • Jon