Frank Zechert
61 lines
2.3 KiB
Plaintext
61 lines
2.3 KiB
Plaintext
.docname {Firmware Udpates}
|
|
.include {docs}
|
|
|
|
## Missing Firmware
|
|
|
|
During the initramfs generation with command `mkinitcpio -P` you might see warnings about potentially
|
|
missing firmware.
|
|
|
|
Some of the warnings can be fixed by installing additional software packages. Others can be ignored.
|
|
|
|
Run `mkinitcpio -P` to see the current list of warnings. Then install missing firmware if available.
|
|
|
|
- missing `xhci_pie`: Install `yay -S upd72020x-fw` from the AUR
|
|
- missing `qat_6xxx`: This is a Intel Encryption Accelerator firmware. Its use is possible on
|
|
Linux, but is discouraged because it is buggy and slow[^1].
|
|
|
|
## Firmware Updates
|
|
|
|
`fwupd` is a daemon to simply update firmware of your device - if it is supported by the vendor of
|
|
the firmware and hardware.
|
|
|
|
Install `sudo pacman -S fwupd udisks2`. Enable and start the `udisk` service with
|
|
`systemctl enable --now udisks2`. Then restart `fwupd` with `systemctl restart fwupd`.
|
|
|
|
Run the following commands for firmware upgrades
|
|
|
|
- `sudo fwupdmgr get-devices`: list all devices detected by the firmware update tool
|
|
- `sudo fwupdmgr refresh`: download the latest metadata available from the Linux Vendor firmware service
|
|
- `sudo fwupdmgr get-updates`: list available updates for your system
|
|
- `sudo fwupdmgr update`: perform the update
|
|
|
|
> Important: If you use secure boot, follow the next section before running `sudo fwupdmgr update`
|
|
|
|
### Secure Boot
|
|
|
|
`fwupd` relies on shim to chainload the `fwupd` EFI binary on systems with Secure Boot enabled.
|
|
Since we do not use shim for Secure Boot, this will not work on our system. We need to sign the
|
|
firmware update binaries with our own keys.
|
|
|
|
List binaries for UEFI firmware updates with `ls /usr/lib/fwupd/efi/fwupdx64.efi`.
|
|
Then sign it and store it at `/usr/lib/fwupd/efi/fwupdx64.efi.signed`:
|
|
|
|
```sh
|
|
sbctl sign /usr/lib/fwupd/efi/fwupdx64.efi -o /usr/lib/fwupd/efi/fwupdx64.efi.signed -s
|
|
```
|
|
|
|
Once this is done, it will be automatically executed when there are future updates thanks to a `sbctl`
|
|
hook in pacman.
|
|
|
|
Finally disable the unushed shim mechanism. Create or modify `/etc/fwupd/fwupd.conf`
|
|
|
|
```ini
|
|
[uefi_capsule]
|
|
DisableShimForSecureBoot=true
|
|
```
|
|
|
|
Restart `systemctl restart fwupd.service`.
|
|
You can now run `fwupdmgr update` to update firmware on your device.
|
|
|
|
[^1]: <https://www.phoronix.com/news/Intel-QAT-FSCRYPT-Linux-6.17>
|