Linux fwupd

fwupd manages device firmware, treating each updatable device as a package.

Firmware inventory and updates come from the LVFS (Linux Vendor Firmware Service). Each package is keyed by its fwupd DeviceId, carrying the device name and current firmware version. mpm drives fwupdmgr in JSON mode (get-devices --json, get-updates --json), which sets the version floor at 1.9.5: the first release to emit JSON for get-devices.

Note

installed and outdated report only devices carrying the updatable flag: fixed or unsupported hardware is skipped even though fwupdmgr still lists it.

Note

No search (firmware has no name catalog to query) and no remove (firmware cannot be uninstalled). Flashing runs as root and is forced non-interactive: no confirmation prompt, no reboot check, no device-selection prompt.

Platforms

  • 🐧 Linux

Operations

Operation

Supported

installed

✓

outdated

✓

search

install

✓

upgrade

✓

upgrade_all

✓

remove

sync

✓

cleanup

Ecosystem

  • Accepted purl types: pkg:fwupd

Usage

$ mpm --fwupd installed
$ mpm --fwupd upgrade --all
$ mpm install pkg:fwupd/hello
$ mpm --dry-run --fwupd upgrade --all

Every example above accepts --dry-run, which simulates the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Deselect the manager for a single run with --no-fwupd, disable it from your configuration, or tune its invocation attributes with per-manager overrides.

Command line

  • CLI names, in lookup order: fwupdmgr

  • Arguments forced before each call: --assume-yes --no-reboot-check --no-device-prompt

The version is probed by running:

$ fwupdmgr --version
compile   com.hughsie.libxmlb           0.3.18
compile   com.hughsie.libjcat           0.2.0
compile   org.freedesktop.fwupd         1.9.24
runtime   org.freedesktop.fwupd-efi     1.4
compile   org.freedesktop.gusb          0.4.8
runtime   com.hughsie.libxmlb           0.3.x
runtime   org.freedesktop.gusb          0.4.8
runtime   com.hughsie.libjcat           0.2.0
runtime   org.freedesktop.fwupd         1.9.24
runtime   org.kernel                    6.8.0-48-generic

and extracted with:

r"compile\s+org\.freedesktop\.fwupd\s+(?P<version>\S+)\s+"

Privilege escalation

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Linux fwupd’s release-age gating, from the cooldown support table:

  • Status: ➖ N/A (LVFS staged deployment)

  • Reference: LVFS news

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Linux fwupd well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ fwupdmgr --assume-yes --no-reboot-check --no-device-prompt get-devices --json
{
  "Devices": [
    {
      "Name": "USB2.0 Hub",
      "DeviceId": "7622d5fdbf1d1e08138156da7d83bf693986ad16",
      "ParentDeviceId" : "b5540761dfe33d9abccd3bb21f1d725f9e69f541",
      "CompositeId" : "b5540761dfe33d9abccd3bb21f1d725f9e69f541",
      "InstanceIds": [
        "USB\VID_17EF&PID_3080",
        "USB\VID_17EF&PID_3080&REV_5163",
        "USB\VID_17EF&PID_3080&HUB_20",
        "USB\VID_17EF&PID_3080&SPI_C220",
        "USB\VID_17EF&PID_3080&SPI_C220&REV_5163",
        "USB\VID_17EF&PID_3080&DEV_VL820Q7"
      ],
      "Guid": [
        "8ee94f0e-9b44-596a-bdd9-6f90401664cc",
        "35199e34-cf82-5b09-9287-622d225056e4",
        "0987e3c9-b1ee-5763-ac6e-51329b034e4b",
        "163cea66-5a78-58af-80ba-21be960aae5c",
        "c7def18d-66ae-5531-924b-2020c3638181"
      ],
      "Summary": "USB 3.x hub",
      "Plugin": "vli",
      "Protocol" : "com.vli.usbhub",
      "Flags": [
        "updatable",
        "registered",
        "can-verify",
        "can-verify-image",
        "dual-image",
        "self-recovery",
        "add-counterpart-guids",
        "unsigned-payload"
      ],
      "Vendor": "VIA Labs, Inc.",
      "VendorId" : "USB:0x17EF",
      "Version": "51.63",
      "VersionFormat" : "bcd",
      "VersionRaw": 20835,
      "Icons": [
        "usb-hub"
      ],
      "InstallDuration" : 15,
      "Created": 1686048073
    },
    {
      "DeviceId" : "20de1d77d0d1787bc56ef62f7d05de49361e1e07",
      "InstanceIds" : [
        "DRM\VEN_RHT&DEV_1234"
      ],
      "Guid" : [
        "90b1437c-86da-5374-a9a7-ceca8b0afd5e"
      ],
      "Plugin" : "linux_display",
      "Flags" : [
        "registered"
      ],
      "Created" : 1731659840
    },
    {
      "Name" : "UEFI dbx",
      "DeviceId" : "362301da643102b9f38477387e2193e57abaa590",
      "InstanceIds" : [
        "UEFI\CRT_E1FFABB40A30D9EE750BDA8BAF36ACA304FF20526138129247576B3339C54537&ARCH_AA64",
        "UEFI\CRT_A1117F516A32CEFCBA3F2D1ACE10A87972FD6BBE8FE0D0B996E09E65D802A503&ARCH_AA64"
      ],
      "Guid" : [
        "a9b31b16-b184-560f-97cb-1aa25e418c7d",
        "67d35028-ca5b-5834-834a-f97380381082"
      ],
      "Summary" : "UEFI revocation database",
      "Plugin" : "uefi_dbx",
      "Protocol" : "org.uefi.dbx",
      "Flags" : [
        "internal",
        "updatable",
        "supported",
        "registered",
        "needs-reboot",
        "usable-during-update",
        "only-version-upgrade",
        "signed-payload"
      ],
      "Checksums" : [
        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
      ],
      "VendorId" : "UEFI:Linux Foundation",
      "Version" : "0",
      "VersionLowest" : "0",
      "VersionFormat" : "number",
      "Icons" : [
        "computer"
      ],
      "InstallDuration" : 1,
      "Created" : 1731659840,
      "Releases" : [
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "35289",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>Insecure versions of the Microsoft Windows boot manager affected by Black Lotus were added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.Applying this update may also cause some Windows install media to not start correctly.</p>",
          "Version" : "26",
          "Filename" : "DBXUpdate-20230509-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-21894"
          ],
          "Checksum" : [
            "46a42362cd34c0d103cf534ca431508d24715e51",
            "3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4610,
          "Created" : 1683590400,
          "Locations" : [
            "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "28503",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>An insecure version of software from vmware has been added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.</p>",
          "Version" : "22",
          "Filename" : "DBXUpdate-20230314-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2023-28005"
          ],
          "Checksum" : [
            "611e745638f05e9a11c2998cfba38f0bad651141",
            "533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4418,
          "Created" : 1678752000,
          "Locations" : [
            "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "15180",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.</p>",
          "Version" : "21",
          "Filename" : "DBXUpdate-20220812-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-34303",
            "309662",
            "CVE-2022-34302",
            "CVE-2022-34301"
          ],
          "Checksum" : [
            "4032a1d8734e6085f4a6e4bb26a038eb639603b9",
            "bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4370,
          "Created" : 1595980800,
          "Locations" : [
            "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        }
      ]
    },
    {
      "Name" : "Virtio network device",
      "DeviceId" : "17076870bcf7a84a9c8e999d7e54e39b446032bb",
      "InstanceIds" : [
        "PCI\VEN_1AF4&DEV_1000",
        "PCI\VEN_1AF4&DEV_1000&SUBSYS_1AF40001"
      ],
      "Guid" : [
        "21c85fac-5270-576f-a84e-04969f8cf75a",
        "b93ef629-0df1-5505-9fee-6992b8b9abd8"
      ],
      "Plugin" : "optionrom",
      "Flags" : [
        "internal",
        "registered",
        "can-verify",
        "can-verify-image"
      ],
      "Vendor" : "Red Hat, Inc.",
      "VendorId" : "PCI:0x1AF4",
      "Created" : 1731659840
    }
  ]
}

$ fwupdmgr --assume-yes --no-reboot-check --no-device-prompt get-updates --json
{
  "Devices" : [
    {
      "Name" : "UEFI dbx",
      "DeviceId" : "362301da643102b9f38477387e2193e57abaa590",
      "InstanceIds" : [
        "UEFI\CRT_E1FFABB40A30D9EE750BDA8BAF36ACA304FF20526138129247576B3339C54537&ARCH_AA64",
        "UEFI\CRT_A1117F516A32CEFCBA3F2D1ACE10A87972FD6BBE8FE0D0B996E09E65D802A503&ARCH_AA64"
      ],
      "Guid" : [
        "a9b31b16-b184-560f-97cb-1aa25e418c7d",
        "67d35028-ca5b-5834-834a-f97380381082"
      ],
      "Summary" : "UEFI revocation database",
      "Plugin" : "uefi_dbx",
      "Protocol" : "org.uefi.dbx",
      "Flags" : [
        "internal",
        "updatable",
        "supported",
        "registered",
        "needs-reboot",
        "usable-during-update",
        "only-version-upgrade",
        "signed-payload"
      ],
      "Checksums" : [
        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
      ],
      "VendorId" : "UEFI:Linux Foundation",
      "Version" : "0",
      "VersionLowest" : "0",
      "VersionFormat" : "number",
      "Icons" : [
        "computer"
      ],
      "InstallDuration" : 1,
      "Created" : 1731659840,
      "Releases" : [
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "35289",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>Insecure versions of the Microsoft Windows boot manager affected by Black Lotus were added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.Applying this update may also cause some Windows install media to not start correctly.</p>",
          "Version" : "26",
          "Filename" : "DBXUpdate-20230509-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-21894"
          ],
          "Checksum" : [
            "46a42362cd34c0d103cf534ca431508d24715e51",
            "3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4610,
          "Created" : 1683590400,
          "Locations" : [
            "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/3ff3f17a9e5d372e51503803f22294f32ca90d1fe570b0bef4088c3a542617e6-DBXUpdate-20230509-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "28503",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>An insecure version of software from vmware has been added to the list of forbidden signatures due to a discovered security problem.This updates the dbx to the latest release from Microsoft.</p><p>Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures.</p>",
          "Version" : "22",
          "Filename" : "DBXUpdate-20230314-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2023-28005"
          ],
          "Checksum" : [
            "611e745638f05e9a11c2998cfba38f0bad651141",
            "533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4418,
          "Created" : 1678752000,
          "Locations" : [
            "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/533ce4ac028585925268d9e39079b71730a7abd94f611bc532707938d4271ad3-DBXUpdate-20230314-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        },
        {
          "AppstreamId" : "org.linuxfoundation.dbx.aa64.firmware",
          "ReleaseId" : "15180",
          "RemoteId" : "lvfs",
          "Name" : "Secure Boot dbx",
          "NameVariantSuffix" : "aa64",
          "Summary" : "UEFI Secure Boot Forbidden Signature Database",
          "Description" : "<p>This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.</p>",
          "Version" : "21",
          "Filename" : "DBXUpdate-20220812-aa64.cab",
          "Protocol" : "org.uefi.dbx",
          "Categories" : [
            "X-Configuration",
            "X-System"
          ],
          "Issues" : [
            "CVE-2022-34303",
            "309662",
            "CVE-2022-34302",
            "CVE-2022-34301"
          ],
          "Checksum" : [
            "4032a1d8734e6085f4a6e4bb26a038eb639603b9",
            "bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999"
          ],
          "License" : "LicenseRef-proprietary",
          "Size" : 4370,
          "Created" : 1595980800,
          "Locations" : [
            "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab"
          ],
          "Uri" : "https://fwupd.org/downloads/bf56092de6586604d2b41d5bb4c9b7787a07adde408fd4134a3f3606f7fda999-DBXUpdate-20220812-aa64.cab",
          "Homepage" : "https://uefi.org/revocationlistfile",
          "Vendor" : "Linux Foundation",
          "Flags" : [
            "trusted-metadata",
            "is-upgrade"
          ],
          "InstallDuration" : 1
        }
      ]
    }
  ]
}