fwupd/fwupd
Fwupd
fwupd est un service système permettant de découvrir, télécharger et installer des mises à jour de firmware matériel sous Linux. Il fonctionne comme un client de distribution de firmware et un outil de découverte de périphériques qui compare les composants du système aux métadonnées des fournisseurs pour identifier les mises à jour compatibles. Il sert également de gestionnaire de sécurité de plateforme pour évaluer les attributs de sécurité de l'hôte et appliquer les paramètres du BIOS.
Le projet inclut un gestionnaire dédié aux capsules de firmware UEFI, générant et gérant les binaires que le système traite lors de la séquence de démarrage. Il fournit des frameworks de sécurité pour filtrer les mises à jour via une approbation basée sur les versions et des listes d'autorisation de sommes de contrôle (checksums), garantissant que seules les versions vérifiées sont déployées.
Le système couvre de vastes domaines de capacités, notamment la gestion des périphériques pour l'identification et le déploiement matériel, ainsi que le traitement des firmwares pour les installations basées sur des binaires bruts ou des archives. Il implémente également le partage de métadonnées au niveau réseau pour réduire la bande passante via une distribution locale en pair-à-pair (P2P).
Le service utilise un système d'abstraction matérielle basé sur des plugins pour étendre la prise en charge de diverses spécifications de périphériques et s'appuie sur un démon pour orchestrer les états de mise à jour et le contrôle d'accès au système.
Features
- Hardware Firmware Updaters - Detects compatible hardware and applies firmware and BIOS updates either immediately or staged for reboot.
- Firmware Distribution Clients - Functions as a firmware distribution client that synchronizes with vendor metadata to fetch signed binaries.
- Metadata-Driven - Synchronizes remote XML or JSON metadata stores to map hardware identifiers to compatible firmware versions.
- Metadata Retrieval - Provides the ability to download latest firmware information from vendor services to identify available updates.
- Version-Based Filtering - Filters available firmware to a specific list of approved versions to ensure only tested updates are applied.
- Firmware Deployment Tools - Installs, reinstalls, or downgrades device firmware from remote servers or local archives.
- Firmware Management - Updates hardware device firmware on Linux systems by fetching metadata and binaries from vendor remotes.
- Metadata Parsing - Analyzes raw binary files to extract critical metadata like version numbers and chip identifiers.
- Firmware Repository Synchronization - Aligns local version records with remote vendor service data to identify available software updates.
- Hardware Device Discovery - Enumerates system hardware and matches device identifiers against vendor metadata to identify compatible updates.
- Hardware Device Identification - Enumerates system devices and searches for compatible firmware updates using unique identifiers and vendor names.
- Device Protocol Abstractions - Uses a modular plugin system to implement device-specific communication protocols for reading and writing firmware.
- Firmware Checksum Verifications - Verifies the integrity and authenticity of firmware binaries by matching cryptographic hashes against approved allowlists.
- Checksum Allowlists - Restricts installable firmware to a specific list of approved checksums to ensure only verified releases are deployed.
- UEFI Capsule Management - Generates boot-time binaries that the system firmware processes during the early boot sequence for low-level updates.
- UEFI Capsule Updates - Provides a dedicated manager for generating and managing UEFI firmware capsules for boot-time updates.
- UEFI Update Integration - Generates UEFI binaries and manages capsule splash support to update firmware during the boot process.
- Platform Security Management - Evaluates host security attributes, applies fixes to security failures, and modifies BIOS firmware settings.
- Platform Security Managers - Evaluates host security attributes and applies BIOS settings or security fixes to the system platform.
- Plugin-Based Device Support - Allows the addition of new plugin types to read and write firmware for various hardware specifications.
- Approved Checksum Filtering - Restricts available hardware updates to an approved list of checksums to ensure only verified versions are installed.
- UEFI Capsule Managers - Generates and manages UEFI binaries used to perform firmware updates during the boot process.
- Hardware Lifecycle Tracking - Tracks firmware versions and applies updates or downgrades to ensure hardware stays compatible and secure.
- Local Firmware Metadata Sharing - Publishes downloaded firmware metadata to the local network via mDNS or LLMNR to reduce external bandwidth.
- Peer Metadata Exchanges - Re-publishes downloaded firmware metadata on the local network so other clients can retrieve updates.
- Plugin Coordinators - Implements a coordination mechanism that allows different hardware plugins to share metadata and resolve dependencies during the update process.
- Raw Binary Firmware Installation - Writes raw binary firmware files directly to target hardware using specific device identifiers.
- Inter-Daemon Message Bus - Communicates between the system daemon and session software using a standardized D-Bus inter-process communication framework.
- Staged Update Orchestration - Manages the lifecycle of updates through staged states to handle dependencies and required system reboots.
- Hardware Compatibility Mapping - Retrieves a detailed list of hardware devices supported by plugins including unique identifiers and versions.
