Reporting back on this issue: upgrading the Librem EC to version 2021-08-03, following https://puri.sm/projects/librem-ec/ fixed the issue I described.
For the reference, I was running an EC version from April prior to flashing.
Many thanks for the support/advises @MrChromebox but also for the continuous improvements on the devices firmwares: that is one of the aspect I enjoy with Librem devices, bugs exists (as with any product) but it is continuously improving
Well, an average user would mostly just follow-up with the updates and such issues would go by themselves.
Beside OS updates, you would be looking into PureBoot or Coreboot updates from Purism (for a Librem 14, depending on what you bought), and Librem EC. Detailed instructions to be found on Purism website (they are easy to follow):
As far as I know, they have never been automatic. This is for the same reasons that your Windows PC doesn’t just automatically update its bios (excluding Microsoft products, which do).
In general, the rule of thumb is to not update your bios firmware unless there is a problem you are trying to correct. Hence making it something that auto updates is not advisable.
From a functionnality perspective, this is correct - if you’r happy with it why change it?
From a security perspective, you will be missing CPU microcode updates that help address CPU vulnerabilities like the speculative ones (spectre, meltdown etc…), so from that perspective, applying the updates would be recomended.
I must say, wrt. my coreboot/pureboot update experience: I own several Purism devices, from several generations (server, mini, L13 and L14), using PureBoot (on the server) and coreboot everywhere else: all the updates always happened flawlessly, and I track almost every new releases.
I’m not sure but I think that may be “Windows only”. With Linux the CPU microcode updates are applied during the boot. Technically that means that your CPU is vulnerable for a period of time in the early boot but if a hacker can run code before that point in time then you may have bigger problems.
I had a look further and the intel-microcode package is released under the non-free section in Debian.
I would expect PureOS does not ship it at all, therefore having some up to dates microcode shipped with coreboot is better than nothing imho.
That “rule” is perfect security antipattern, and is being used by companies to reduce support load.
Problem with this approach is:
BIOS is no longer simple program. In UEFI context it’s standalone small quite capable (can even TCP/IP) OS that runs parallel to your operating system. google CVE UEFI to see how many critical bugs were found in software of many Vendors …
and this is only BIOS , there other firmware, that also can be vunreable in the system.
So NO! Not updating firmware is not a good idea, even “if you don’t have issues”…
technically every single piece of software at some point will be marked asvulnerable.
it’s only code, written by human.
what is worse even hardware can be vulnerable too Spectre / Meltdown etc.
When vendors says something like: Do not upgrade BIOS/Furmware unless you are trying to fix Issue you are facing…
My answer is always: You will say same thing to Windows XP users? Some of them also not facing any issues…
No matter what type of initialisation Firmware you have, is it a BIOS , UEFI , EFI . that piece of software can be bugy, some of those bugs can be exploited some not. You will probably never know…
Sometimes they are saying that because the update has only had very limited testing to fix one specific problem and may not work in all situations and may not work in all configurations and environments and with all hardware.
So what they are saying is that the risk v. reward trade-off is not good. If you aren’t experiencing that one specific problem (e.g. you don’t even use the functionality that is misbehaving) then the reward is zero, but, with the very limited testing, the risk is greater than zero.
I would be very hesitant to accept that line of thinking for a security problem however.
Hi. It looks like I’ve run into the original WiFi problem described in this thread. My Librem 14 freezes after ~5 min of work with the said messages in the dmesg, regardless of wether I boot from the Hard drive or from my bootable USB.
So, I’m thinking about how to upgrade the firmware in a hope that it will fix the issue. But how could I do that with such a short stable working time?
Update
I’ve upgraded the Librem EC and the Coreboot bootloader from the PureOS LiveUSB. Unfortunately, the problem seems to be NOT FIXED for me. To say more, after WiFi card starts to issue error messages (in my case I see these messages not after the system resume, but at random moments of time), EXT4 driver crashes and the system effectively freezes. I suspect that WiFi affects PCI bus somehow.