Complete guide to updating firmware on Linux with fwupd

If you're using Linux on a brand-name computer or a self-built desktop, keeping your motherboard firmware up to date, SSD or peripherals is not a whim, but a key aspect of stability, performance and security. Nowadays, thanks to fwupd and the LVFS service, doing so is much easier than in the past, when it was necessary to boot into Windows or pull a pendrive with DOS.

Beyond the clichés, fwupd has matured into the standard way to install and update firmware on Linux. I'm going to explain how to install it, how to use it safely, what's new in its latest major version, what alternatives you have if your hardware doesn't appear in LVFS and furthermore how does all this fit into ChromeOS where Google applies specific requirements for users to receive updates through the system interface.

Related article:

How to access and update firmware (BIOS/UEFI) settings from Linux using systemctl and systemd

What is fwupd and how does it fit into LVFS?

fwupd is a open source daemon that allows you to manage and flash firmware on a wide variety of devices from Linux. It integrates with the Linux Vendor Firmware Service (LVFS), a centralized catalog where manufacturers publish their firmware packages in .cab along with metadata to correctly identify the target hardware.

In practice, this eliminates the need for different packaging per distribution: suppliers upload a single .cab file with metadata and users receive it through their distros. Today, LVFS collects firmware for more than 1.600 devices from 160 manufacturers, and fwupd integrates with graphical managers such as GNOME Software and KDE Discover to make the process even more convenient.

The scope is wide: from UEFA / BIOS up to devices USB, Thunderbolt, or even displays. Many updates can be applied without leaving the work environment, and when necessary, reboots are securely scheduled and managed to complete the flashing during the Boot.

Prerequisites and recommended checks

Before you jump in, it's a good idea to check if your hardware is supported. You can consult the list of devices on the LVFS website. It's not an exhaustive database, but it's a great reference: there are cases where a specific machine doesn't appear, yet the manufacturer is well supported and updates arrive without problems.

It is common for fwupd to detect several components when you run its commands For example, on two Dell computers (a Latitude 7390 and a Precision 3450 desktop) the flow was identical: supported devices were listed, metadata was refreshed from LVFS, available updates were reviewed, and applied with a supervised restart later. The experience, overall, is smooth.

Safety recommendations: make sure you have the equipment connected to power (and battery charged in portable), don't interrupt the process during boot, and always download the appropriate firmware for your specific model when using manual methods. Some utilities offer to back up the current firmware; if available, it's worth using.

Keep in mind that fwupd focuses on components for which the vendor publishes firmware on LVFS (such as UEFI or specific drivers). It's not the way to update, for example, the video card driver, and certain network cards or GPUs are supported using other mechanisms.

How to install fwupd on your distribution

On most distros, fwupd it comes pre-installedIf this isn't your case, you can install it from official repositories. On Debian, Ubuntu, and derivatives:

sudo apt-get update
sudo apt-get install fwupd

In Ubuntu and derivatives you can also use its most common alias:

sudo apt install fwupd

In Fedora:

sudo dnf install fwupd

On Arch Linux and based:

sudo pacman -S fwupd

fwupd installs a service and a systemd timer that allow you to automate firmware checks if desired. Many people prefer to manually check and update so they have control over the timing of the reboot and the changes applied; it's a personal decision, although automation can be useful in managed environments.

Basic usage: list, refresh and update firmware

Once installed, the first step is see what hardware fwupd detects:

fwupdmgr get-devices

Next, refresh the LVFS metadata, which includes device catalogs, versions, and available fixes:

fwupdmgr refresh

With your inventory updated, check for new versions for your equipment:

fwupdmgr get-updates

If patches exist, you can download and install all updates applicable to the system:

fwupdmgr update

Are you only interested in a specific device? You can apply the update by filtering by the device ID:

fwupdmgr update <DEVICEID>

Once the process is complete, fwupd may offer to restart. It's not mandatory to do so immediately, but when you restart, do not interrupt the bootThe firmware installer will run and, depending on the number of components, may take a few minutes. It's normal for the first boot to be slightly slower while the changes are completed.

To see what updates have been applied to fwupd over time, you have available the historial:

fwupdmgr history

What devices will you see: SSD, UEFI dbx, and “System Firmware”

It is common that when using fwupd, several components appear: for example, your SSD, the list UEFI dbx and the system firmware itself. The dbx (revocation database) is the UEFI revocation list used to invalidate compromised or insecure signed binaries.

The “System Firmware” item usually refers to the UEFI/BIOS implementation of your motherboard. Not all manufacturers release these updates via LVFS; if you see an unupdatable “UEFI System Resource Table Device,” it usually means it’s handled by the vendor’s usual method (e.g., the UEFI-integrated update utility or proprietary tools). On custom ASUS boards, it’s common to still use the BIOS update via USB if there is no support in LVFS.

Highlights of fwupd 2.0

The 2.0 series brought significant internal changes. Background processing migrated from the GObject binding in GUsb to the direct access to libusb and sysfsThis transition allowed device emulation to be moved to the library. libfwupdplugin and implement update emulation on dummy devices hidraw y nvme, similar to simulated USB drives. This strengthened testing and identified issues that could arise with changes to fwupd.

Another novelty is the elimination of dependence on GUdev (GObject bindings on libudev). Instead, the process creates a netlink socket to parse udev events. This change significantly reduces the memory and CPU usage at startup and during runtime, and also paves the way for future compatibility with Android through support for ueventd.

Optimizations were introduced to reduce memory consumption when transferring firmware: instead of copying the file to RAM, the firmware is copied to the transfer via file descriptor. Support for new devices was also added and technical cleanup was performed: support for legacy metadata and old verification formats was discontinued, and deprecated command-line utilities.

In addition, an API was incorporated to upload reports to gnome-firmware, the build system added support for the Darwin platform, and practical utilities were added such as listing ESP files in JSON with fwupdtool esp-list --json, along with options to define emulated devices from settings.

Alternatives when fwupd is not the best option

Although fwupd is the preferred path, there are cases where the firmware is not distributed via LVFS or support does not yet exist. In these scenarios, it is advisable to use manufacturer's methodsThe choice depends on the equipment and the age of the hardware.

Integrated BIOS/UEFI update: Virtually all manufacturers include a utility within the system firmware itself (names like “EZ Flash,” “Q-Flash,” “BIOS Flashback,” or “BIOS Update Utility”). Downloads the firmware file from the supplier's website, copy it to a USB in FAT32, you enter the UEFI settings and you select the file to flash. It is the most reliable method because it does not depend on the operating system and This is the recommended path for computers not supported by LVFS..

Bootable USB with DOS/FreeDOS: Some older boards or older utilities only offer DOS executables. In that case, you create a USB with FreeDOS, copy the utility and firmware, boot from the flash drive, and run the tool from the command line. It's more manual and less common today, but it can save you money with older hardware. configuration complexity is its biggest disadvantage.

Windows-based tool (dual boot or Windows PE): If the manufacturer only offers an updater for Windows, you can use a existing dual boot or create a USB drive with Windows PE, boot it, and run the installer. It's straightforward and vendor-compatible, although it requires set up a temporary Windows environment if you don't already have it.

Which one to choose? First try fwupd if your hardware participates in LVFS. If it doesn't appear or the update is critical and the vendor doesn't publish to LVFS, use the manufacturer's UEFI utilityFor very old hardware or specific cases, DOS/FreeDOS or Windows PE are the backup options.

fwupd on ChromeOS: Google requirements, signed reports, and availability

On ChromeOS, fwupd is the official mechanism for updating peripherals. Just like in Linux, payloads are files .cab hosted on LVFS. The key difference is that Google validates and enforces a allowed list firmware to ensure a good user experience. Therefore, just because a firmware is in LVFS doesn't mean it will automatically appear in ChromeOS.

Google processes fwupd updates according to the Chromium release schedule. If a vendor urgently needs new support after the feature freeze, you must create an issue in the Partner Issue Tracker (ChromeOS component > External > WWCB > PERIPHERAL OEM > fwupd), indicating the required version, features, bugs fixed, supported hardware, brand and model, VID:PID and GUIDWith this, the ChromeOS team can incorporate the necessary fwupd version and promote it to upstream channels (e.g., canary) for testing.

Two typical scenarios for WWCB peripherals: if the version of fwupd on ChromeOS does not yet support the device, the ODM/OEM works with the chipset vendor to ship plugin changes and settings of .quirk to fwupd upstream. After confirmation from the maintainers and official release (e.g., 1.8.X), the uprev on ChromeOS. If support already exists, skip ahead to packaging the firmware.

Packaging and uploading to LVFS: All firmware is uploaded as .cab and includes at least one .metainfo.xml which describes the device and firmware. It must be on the remote stable of LVFS (not in private/embargo/testing) and marked as validated. If it is the first time, Google requires that there be at least Two versions in stable (one base to test downgrade and the new one to upgrade).

ChromeOS Testing and “Signed Reports”: For an update to reach users, a signed report from ChromeOS must exist. The process links the device under test (DUT) to the manufacturer's account by uploading the client certificate to LVFS. In the Chromebook, in developer mode, the certificate is located in /var/lib/fwupd/pkiAfter uploading it to the LVFS profile, the updates are tested on the DUT by running:

fwupdmgr refresh
fwupdmgr update
fwupdmgr report-history --sign

If you have already sent unsigned reports by mistake, you can forward them with:

fwupdmgr report-history --sign --force

The signed report may take a few hours to appear. On the LVFS device page, you'll see, under “Tested By”, the ChromeOS version, the fwupd version, and the entity. When “Release Gating” show the check mark as “Available for ChromeOS users”, after 24 hours users will be able to go to Settings > About ChromeOS > Firmware Updates and apply the update. Please note that the updates are not automatic: These are initiated by the user and depend on the urgency configured in LVFS (low/medium/high without forced notification; critical with notification at each start).

Starting with milestone M126, ChromeOS only exposes updates whose firmware has signed reports. changes to previous versions via fwupd; in case of a production issue, clean up the signed report on LVFS and ensure a base version is available on the stable remote for future testing. All devices with M101 or later support fwupd.

How to find out the fwupd version on ChromeOS: you can open chrome://system and search fwupd_version, or in developer mode use fwupdmgr --version and check the runtime org.freedesktop.fwupd. To activate developer mode, the standard procedure is to boot into recovery mode, ask Ctrl + D, confirm with Enter and wait for the system to prepare the environment; this process typically takes from minutes to an hour, depending on the device.

Good practices and security recommendations

Power is king: plug your computer into a stable source And if it's a laptop, make sure the battery is charged. A power outage in the middle of flashing can render the device unusable.

Verify identity and version: download the exact firmware for your model when using manual methods; confusing board revisions or variants can be fatal. In fwupd, review the metadata and commit messages before applying changes.

Read the supplier's notes: many manufacturers detail critical steps and warnings on their support pages. If they offer a backup of the current state, take advantage of it. And if the update fixes security issues, it's a good idea to act quickly.

Reboot control: Although fwupd allows postponing reboots, it avoids accumulating pending reboots. When it is your turn, do not interrupt the boot; you'll see that the update is orchestrated automatically and the first launch may take a little longer.

This entire ecosystem allows for reliable and increasingly universal firmware updates on Linux. Between fwupd/LVFS for most modern devices, the manufacturer's UEFI utilities when there's no support, and ChromeOS-specific flows with signed reports, there are solutions for virtually any scenario, with clear benefits in security and stability of the System.

Isaac

Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.