Updating USB devices firmware with qubes-fwubd

Is there a way to use fwupd to update usb devices? qubes-fwupd in dom0 don’t see them? And ragular fwupd in sys-usb will not work unless switching to uefi. Is there some designed way to do that?

1 Like

Bump, since I still not found the answer. According 3mdeb website updates in sys-usb should be handled by qubes-fwubd. But I can’t find a way to do it. Thoughts dereferenced from the scratchpad noise. | Project status of the fwupd/LVFS support for Qubes OS

@marmarek?

1 Like

Ok, it looks like 3mdeb drops the fwupd_usbvm_validate function from mainline fwupd. So the question is how I can perform fwupd in sys-usb manually? Is there a way to create sys-usb with UEFI support? Or if I want to update usb device I need to install HVM manually with uefi support enabled, or even use other machine?

1 Like

EFI System Partition of a TemplateVM is not set up:
TemplateVMs don’t populate EFI system partition · Issue #9539 · QubesOS/qubes-issues · GitHub
So I guess currently you need to install the OS from ISO in HVM with UEFI and attach USB device to it:
UEFI enabled HVMs hang on "Guest has not initialized the display (yet)" · Issue #8625 · QubesOS/qubes-issues · GitHub
Or you can boot from Live OS ISO instead of installing it for one time use.

1 Like

I wander why handling it from dom0 qubes_fwupdmgr with fwupd_usbvm_validate was dropped.

1 Like

Are you sure that fwupd in sys-usb won’t work without UEFI? It’s just updating the USB devices firmware, I don’t think that UEFI is needed for this.
And based on this:
Drop sys-usb support · fwupd/fwupd@ff1f367 · GitHub
I guess you should just run fwupd inside sys-usb and it should work through updates proxy.

1 Like

fwupd service not starting since there is no /efi/EFI

1 Like

Do you need this service running for fwupdtool to work?
I don’t know how it works.
If it’s required then maybe file a bug report on github.

1 Like

Ok, I can use fwupdtool instead of fwupdmgr, but it looks like it can’t resolve a host. Now I have to figure out why proxy, doesn’t work.

1 Like

Try to set the proxy for it e.g.:

https_proxy=http://127.0.0.1:8082/ http_proxy=http://127.0.0.1:8082/ fwupdtool

On second thought, you need to enable the proxy service for sys-usb for it to work:

qvm-service sys-usb updates-proxy-setup on
1 Like

It works with the proxy in template but I can’t start the proxy for sys-usb. I added that service that you mentioned, added user rules for proxy, and run /usr/lib/qubes/update-proxy-configs inside sys-usb. Still can’t refresh fwupdtool.

1 Like

Did you restart the sys-usb after adding the service?
Try to check the proxy in sys-usb with curl:

https_proxy=http://127.0.0.1:8082/ http_proxy=http://127.0.0.1:8082 curl https://debian.org
1 Like

Check the systemd service status in sys-usb:

sudo systemctl status qubes-updates-proxy-forwarder.socket
1 Like

I have unmet condition: no /var/run/qubes-service/qubes-updates-proxy.

1 Like

Make sure that you have updates-proxy-setup added and enabled in sys-usb Settings → Services tab.
And that qubes-updates-proxy service is not enabled.

1 Like

In that tab I have only updates-proxy-setup and qubes-ctap-proxy.

1 Like

Ok, I added and disabled qubes-updates-proxy and now it work.

1 Like

According to /usr/lib/qubes/init/qubes-sysinit.sh it seems that qubes-updates-proxy service is enabled by default in NetVMs (qubes with “Provides network” option set and with net qube set to none: sys-net/sys-usb).

1 Like

I have such error when using fwupdtool: failed to parse platform BOS descriptor: failed to parse: no supported platform version: did not find magic I’m not sure if this is a bug in Qubes configuration for fwupd, Fedora 40 issue or fwupd itself, or maybe just some of the device is not handled. @Demi what you think?

1 Like

Originally, Qubes OS’s fwupd integration had support for updating USB device firmware from dom0. I removed this as it added complexity and seemed to provide little value above using fwupd in sys-usb or a VM with the device passed through to it. Using fwupd is expected to work in both cases.

2 Likes