FWUPD Explores Improvement For Easier & More Robust Firmware Updating On Linux

[phoronix]

Phoronix: FWUPD Explores Improvement For Easier & More Robust Firmware Updating On Linux

Currently when it comes to shipping new/updated device support for firmware updating under Linux with FWUPD/LVFS, it requires making/adjusting a Fwupd plug-in for carrying out the actual firmware copying/updating of the device and then adding in the device VID/PID to a quirks table so Fwupd knows about what to match a given device to for the firware plug-in to use. Even in new devices where no plug-in changes are required, new device entries are still needed in the quirks table and it makes it challenging when Linux distributions don't quickly move to new FWUPD releases. Moving forward a better solution is being explored...

https://www.phoronix.com/news/FWUPD-Descriptor-Sets-Matching

[tildearrow]

Typo:

Phoronix: FWUPD Explores Improvement For Easier & More Robust Firmware Updating On Linux

Currently when it comes to shipping new/updated device support for firmware updating under Linux with FWUPD/LVFS, it requires making/adjusting a Fwupd plug-in for carrying out the actual firmware copying/updating of the device and then adding in the device VID/PID to a quirks table so Fwupd knows about what to match a given device to for the firware plug-in to use. Even in new devices where no plug-in changes are required, new device entries are still needed in the quirks table and it makes it challenging when Linux distributions don't quickly move to new FWUPD releases. Moving forward a better solution is being explored...

https://www.phoronix.com/news/FWUPD-...-Sets-Matching

[uid313]

Why doesn't just fwupd has a built-in function to fetch the quirks table from a remote server?

[Quackdoc]

just commenting so I can read the inevitable "but micro$oft" comments

[CochainComplex]

just commenting so I can read the inevitable "but micro$oft" comments

You cant really complain about fwup...so the hate is left for M$

[hughsie]

Why doesn't just fwupd has a built-in function to fetch the quirks table from a remote server?

Good question, but I answered this here: https://blogs.gnome.org/hughsie/2022...sers/#comments

[skeevy420]

Good question, but I answered this here: https://blogs.gnome.org/hughsie/2022...sers/#comments

(a) “Your Implementation” means Your: (i) firmware and/or hardware that implements the OS Descriptor set described in the Specification to interface with a Microsoft OS Descriptor enabled operating system, or other systems authorized by Microsoft to retrieve and use this information; and (ii) software drivers that implementing the OS Descriptor set described in the Specification to interface only in conjunction with the Windows 8.1.

That part of their license stands out to me. Depending on where you look, their documentation only lists only Windows 8.1 or both Windows 10 and 8.1 as OS Descriptor 2.0 supported operating systems. The license explicitly states 8.1. Without reaching out and collaborating with Microsoft to get authorization on this you'd technically be violating that part of their license by using it on Linux.

Microsoft should probably update their license to include Windows 10 & 11 as well.

with the Windows 8.1

[hughsie]

Without reaching out and collaborating with Microsoft to get authorization on this you'd technically be violating that part of their license by using it on Linux.

That's a valid concern, good work, thanks. After a night of not sleeping and instead thinking about USB stuff, I also think it might be safer to use a BOS platform device capability descriptor, and not use the Microsoft UUID to encode something additional to a Microsoft OS 2.0 Platform Descriptor Set. It's kinda sucky that we'd had to invent a new mini-specification that's fwupd specific, but the advantages would be:

• less data encoded, as we can use UTF-8 rather than UTF-16/UCS
• no need for a fwupd. prefix on each key name
• less likely to get a cease-and-desist from a overzealous Microsoft legal team

[CommunityMember]

Why doesn't just fwupd has a built-in function to fetch the quirks table from a remote server?

I could easily imagine a potential of a MiTM and/or supply chain attack when using network sourced configuration data/firmware.

[stormcrow]

That's a valid concern, good work, thanks. After a night of not sleeping and instead thinking about USB stuff, I also think it might be safer to use a BOS platform device capability descriptor, and not use the Microsoft UUID to encode something additional to a Microsoft OS 2.0 Platform Descriptor Set. It's kinda sucky that we'd had to invent a new mini-specification that's fwupd specific, but the advantages would be:

• less data encoded, as we can use UTF-8 rather than UTF-16/UCS
• no need for a fwupd. prefix on each key name
• less likely to get a cease-and-desist from a overzealous Microsoft legal team

Aside from the licensing issues, which are definitely important don't get me wrong, but there's also the problem that OEMs are traditionally awful at following and implementing any given specification even if it's required for a platform operation. One need look no further than the crapshoot that is USB peripherals or ACPI. If they weren't so gawd awful at following specs there would be no need for any arbitrary driver to have an army's worth of quirks and blacklistings.