> For the complete documentation index, see [llms.txt](https://asus-isg-aidc.gitbook.io/guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://asus-isg-aidc.gitbook.io/guide/latest/cli/commandreference/firmwareupdate.md).

# Firmware Update

| Developer | Last modified |
| --------- | ------------- |
| AIDC Team | 2026/08/21    |

## Table of Contents

* [1. Overview](#overview)
* [2. BIOS Firmware Update](#bios-firmware-update)
* [3. BMC Firmware Update](#bmc-firmware-update)
* [4. Mellanox Firmware Update](#mellanox-firmware-update)
* [5. NVMe Firmware Update](#nvme-firmware-update)
* [6. NVLink Switch Firmware Update](#nvlink-switch-firmware-update)
* [7. Quick Summary](#quick-summary)
* [8. Usage Examples](#usage-examples)

***

## 1. Overview <a href="#overview" id="overview"></a>

{% hint style="warning" %}
**⚠️ Prerequisite: `aidc-cli init` required first**

This command depends on settings saved by [`aidc-cli init`](/guide/latest/cli/commandreference/init.md). Before running it, make sure you have completed:

* [`aidc-cli init inventory`](/guide/latest/cli/commandreference/init.md#inventory) — render the node inventory from `aidc.csv`
* SSH access to the nodes — [`aidc-cli deploy install`](/guide/latest/cli/commandreference/deploy.md) sets this up during OS deployment; for nodes that already have an OS, run [`aidc-cli deploy access-key`](/guide/latest/cli/commandreference/deploy.md) or fill the `password` column in `aidc.csv`
* [`aidc-cli init bmc-set`](/guide/latest/cli/commandreference/init.md#bmc-configuration) — save the BMC credentials
* [`aidc-cli init nvme-set`](/guide/latest/cli/commandreference/init.md#14-nvme-firmware-update-configuration) — required for NVMe firmware updates

For the full setup sequence, see the [Getting Started](/guide/latest/cli/gettingstarted.md) guide.
{% endhint %}

The `fwupdate` command updates BIOS, BMC, Mellanox, NVMe, and NVLink switch firmware. The current CLI uses five canonical subcommands and then selects the detailed update workflow through flags such as `--backend`, `--platform`, `--device`, or `--source`.

```bash
aidc-cli fwupdate <bios|bmc|mlnx|nvme|nvlink-sw> [flags]
```

{% hint style="danger" %}
Firmware updates can leave hardware unusable if the wrong package is selected or the process is interrupted. Verify hardware compatibility, firmware format, and power stability before running any update.
{% endhint %}

***

## 2. BIOS Firmware Update <a href="#bios-firmware-update" id="bios-firmware-update"></a>

Use `aidc-cli fwupdate bios` for both in-band tool updates and Redfish-based updates.

```bash
aidc-cli fwupdate bios [flags]
```

| Flag            | Short |  Default | Required | Description                                                         |
| --------------- | :---: | :------: | :------: | ------------------------------------------------------------------- |
| `--backend`     |   —   |  `tool`  |     ❌    | Update backend: `tool` or `redfish`                                 |
| `--platform`    |   —   |   `x86`  |     ❌    | Redfish BIOS platform: `x86` or `arm`                               |
| `--file`        |  `-f` |     —    |    ❌\*   | Firmware file name from the configured BIOS firmware directory      |
| `--reboot`      |  `-r` |  `false` |     ❌    | Reboot after an in-band tool update                                 |
| `--update-mode` |  `-m` | `staged` |     ❌    | Redfish update mode: `staged` or `direct`                           |
| `--uri`         |  `-u` |     —    |    ❌\*   | Remote firmware URI for Redfish remote update                       |
| `--proto`       |   —   |  `HTTP`  |     ❌    | Transfer protocol for the remote firmware server: `HTTP` or `HTTPS` |
| `--file-user`   |   —   |     —    |    ❌\*   | Username for the remote firmware server                             |
| `--file-pwd`    |   —   |     —    |    ❌\*   | Password for the remote firmware server                             |
| `--poweroff`    |  `-p` |  `false` |     ❌    | Auto graceful shutdown via Redfish before update                    |

**Behavior by mode**

| Workflow                           | Required Inputs | Notes                                                                                                                    |
| ---------------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `--backend tool`                   | `--file`        | Performs an in-band BIOS update. `--reboot` is supported only for this backend.                                          |
| `--backend redfish --platform x86` | `--file`        | Local Redfish upload for x86 BIOS firmware. `.cap` and `.hpm` are accepted.                                              |
| `--backend redfish --platform x86` | `--uri`         | Remote Redfish pull for x86 BIOS firmware. If `--proto HTTPS` is used, both `--file-user` and `--file-pwd` are required. |
| `--backend redfish --platform arm` | `--file`        | ARM Redfish BIOS update is local-file only and expects a `.fwpkg` file.                                                  |

{% hint style="info" %}
There is no separate flag to choose local vs. remote Redfish updates. `--file` and `--uri` are mutually exclusive — giving `--file` performs a local upload, giving `--uri` performs a remote pull, and you must give exactly one.

When `--update-mode direct` is selected, the CLI forces the Redfish `poweroff` behavior even if `--poweroff` was not explicitly passed.
{% endhint %}

***

## 3. BMC Firmware Update <a href="#bmc-firmware-update" id="bmc-firmware-update"></a>

Use `aidc-cli fwupdate bmc` for Redfish-based BMC firmware updates.

```bash
aidc-cli fwupdate bmc [flags]
```

| Flag          | Short | Default | Required | Description                                                         |
| ------------- | :---: | :-----: | :------: | ------------------------------------------------------------------- |
| `--file`      |  `-f` |    —    |    ❌\*   | Firmware file name from the configured BMC firmware directory       |
| `--preserve`  |  `-p` | `false` |     ❌    | Preserve the current BMC configuration                              |
| `--uri`       |  `-u` |    —    |    ❌\*   | Remote firmware URI for a remote Redfish update                     |
| `--proto`     |   —   |  `HTTP` |     ❌    | Transfer protocol for the remote firmware server: `HTTP` or `HTTPS` |
| `--file-user` |   —   |    —    |    ❌\*   | Username for the remote firmware server                             |
| `--file-pwd`  |   —   |    —    |    ❌\*   | Password for the remote firmware server                             |

**Behavior by mode**

| Workflow | Required Inputs | Notes                                                                                              |
| -------- | --------------- | -------------------------------------------------------------------------------------------------- |
| `--file` | `--file`        | Local Redfish upload                                                                               |
| `--uri`  | `--uri`         | Remote Redfish pull. If `--proto HTTPS` is used, both `--file-user` and `--file-pwd` are required. |

{% hint style="info" %}
BMC updates are Redfish-only — there is no `tool` backend and no separate local/remote selector flag. `--file` and `--uri` are mutually exclusive — giving `--file` performs a local upload, giving `--uri` performs a remote pull, and you must give exactly one.
{% endhint %}

***

## 4. Mellanox Firmware Update <a href="#mellanox-firmware-update" id="mellanox-firmware-update"></a>

Use `aidc-cli fwupdate mlnx` and choose the target family with `--device`.

```bash
aidc-cli fwupdate mlnx [-d <nic|dpu>] -f <firmware-file> [-r]
```

| Flag       | Short | Default | Required | Description                                             |
| ---------- | :---: | :-----: | :------: | ------------------------------------------------------- |
| `--device` |  `-d` |  `nic`  |     ❌    | Mellanox device family: `nic` or `dpu`                  |
| `--file`   |  `-f` |    —    |     ✅    | Firmware file name (`.bin` for `nic`, `.bfb` for `dpu`) |
| `--reboot` |  `-r` | `false` |     ❌    | Enable the reboot option                                |

{% hint style="warning" %}
`--device nic` requires a `.bin` firmware file. `--device dpu` requires a `.bfb` firmware file.
{% endhint %}

***

## 5. NVMe Firmware Update <a href="#nvme-firmware-update" id="nvme-firmware-update"></a>

The `nvme` subcommand loads defaults from the NVMe init configuration, then applies any explicit CLI overrides.

```bash
aidc-cli fwupdate nvme [-f <firmware-file>] [-d <device>]... [-r]
```

| Flag       | Short | Required | Description                                                               |
| ---------- | :---: | :------: | ------------------------------------------------------------------------- |
| `--file`   |  `-f` |     ❌    | Override the firmware file name from `aidc-cli init nvme-get`             |
| `--device` |  `-d` |     ❌    | Override NVMe device paths; repeat or comma-separate for multiple devices |
| `--reboot` |  `-r` |     ❌    | Override the reboot setting from init configuration                       |

{% hint style="info" %}
Before execution, the resolved NVMe firmware file and target device list must both be present. Configure them with `aidc-cli init nvme-set` or provide them through the CLI flags. Currently only Samsung NVMe drives are supported.
{% endhint %}

***

## 6. NVLink Switch Firmware Update <a href="#nvlink-switch-firmware-update" id="nvlink-switch-firmware-update"></a>

The `nvlink-sw` subcommand updates the NVOS image and component firmware (BMC, FPGA, ERoT, CPLD1, BIOS) of NVLink switches, from either a local source or a remote server.

```bash
aidc-cli fwupdate nvlink-sw [--source local|remote] [component flags]
```

| Flag         | Short | Default | Required | Description                                                                             |
| ------------ | :---: | :-----: | :------: | --------------------------------------------------------------------------------------- |
| `--source`   |  `-s` | `local` |     ❌    | Firmware source: `local` (on the AIDC Server) or `remote`                               |
| `--protocol` |   —   |  `scp`  |     ❌    | Remote transfer protocol (remote source only): `scp`, `https`, `file`, `ftp`, or `sftp` |
| `--host`     |   —   |    —    |    ❌\*   | Remote server host/IP (remote source only)                                              |
| `--user`     |   —   |    —    |    ❌\*   | Remote server login user (remote source only)                                           |
| `--password` |   —   |    —    |    ❌\*   | Remote server login password (remote source only)                                       |
| `--bmc`      |   —   |    —    |     ❌    | BMC firmware: file name (local) or remote path                                          |
| `--fpga`     |   —   |    —    |     ❌    | FPGA firmware: file name (local) or remote path                                         |
| `--erot`     |   —   |    —    |     ❌    | ERoT firmware: file name (local) or remote path                                         |
| `--cpld1`    |   —   |    —    |     ❌    | CPLD1 firmware: file name (local) or remote path                                        |
| `--bios`     |   —   |    —    |     ❌    | BIOS firmware: file name (local) or remote path                                         |
| `--nvos`     |   —   |    —    |     ❌    | NVOS image: file name (local) or remote path                                            |
| `--reboot`   |  `-r` |  `true` |     ❌    | Reboot the switch at the end to activate firmware/NVOS                                  |

\*Required when `--source remote` is used.

{% hint style="info" %}
Pass only the component flags you want to update — components without a file are skipped. Note the reboot default is `true` for this subcommand (unlike the other `fwupdate` subcommands); pass `--reboot=false` to defer activation.
{% endhint %}

***

## 7. Quick Summary <a href="#quick-summary" id="quick-summary"></a>

| Subcommand           | Selector Flags                             | Target                          | Notes                                                                                                       |
| -------------------- | ------------------------------------------ | ------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| `fwupdate bios`      | `--backend`, `--platform`, `--update-mode` | BIOS                            | Covers both tool-based and Redfish BIOS updates; Redfish local vs. remote is inferred from `--file`/`--uri` |
| `fwupdate bmc`       | —                                          | BMC                             | Redfish-only; local vs. remote is inferred from `--file`/`--uri`                                            |
| `fwupdate mlnx`      | `--device`                                 | Mellanox NIC or DPU             | `.bin` for `nic`, `.bfb` for `dpu`                                                                          |
| `fwupdate nvme`      | —                                          | NVMe                            | Uses init defaults unless CLI overrides are passed                                                          |
| `fwupdate nvlink-sw` | `--source`                                 | NVLink switch NVOS + components | Reboot defaults to `true`; component flags select what to update                                            |

***

## 8. Usage Examples <a href="#usage-examples" id="usage-examples"></a>

```bash
# Update BIOS with the in-band tool backend
aidc-cli fwupdate bios --backend tool -f "K15PP-D24-ASUS-0801.CAP" -r

# Update x86 BIOS via Redfish with a local .cap file
aidc-cli fwupdate bios --backend redfish --platform x86 -f "K15PP-D24-ASUS-0801.CAP" -m direct -p

# Update x86 BIOS via Redfish with a local .hpm file
aidc-cli fwupdate bios --backend redfish --platform x86 -f "Z14PP-D32-ASUS-0903.HPM"

# Update x86 BIOS via Redfish from an HTTP server
aidc-cli fwupdate bios --backend redfish --platform x86 -u "http://192.168.1.100/firmware/bios.hpm"

# Update x86 BIOS via Redfish from an HTTPS server
aidc-cli fwupdate bios --backend redfish --platform x86 -u "https://files.example.com/bios.cap" --proto HTTPS --file-user admin --file-pwd secret123 -m direct

# Update ARM BIOS via Redfish with a local .fwpkg file
aidc-cli fwupdate bios --backend redfish --platform arm -f "NCPH-U0-ASUS-0403-NCH0009-24060701.fwpkg"

# Update BMC via Redfish with a local firmware file, preserving current settings
aidc-cli fwupdate bmc -f "BHS_Gen_1.34.00_enc.hpm" -p

# Update BMC via Redfish from an HTTPS server
aidc-cli fwupdate bmc -u "https://files.example.com/BHS_Gen_1.34.00_enc.hpm" --proto HTTPS --file-user admin --file-pwd secret123

# Update Mellanox NIC firmware
aidc-cli fwupdate mlnx -d nic -f "fw-ConnectX7-rel-28_42_1000-MCX75310AAS-HEA_Ax-UEFI-14.35.15-FlexBoot-3.7.500.signed.bin" -r

# Update Mellanox DPU firmware
aidc-cli fwupdate mlnx -d dpu -f "bf-fwbundle-3.4.0-92_26.04-prod.bfb" -r

# Configure default NVMe firmware update settings
aidc-cli init nvme-set -f "General_PM9A3_U.2_GDC5A02Q_Noformat.bin" -d /dev/nvme0,/dev/nvme1 -r

# Update NVMe firmware by using saved init settings
aidc-cli fwupdate nvme

# Override NVMe firmware file and device list for a single run
aidc-cli fwupdate nvme -f "General_PM9A3_U.2_GDC5A02Q_Noformat.bin" -d /dev/nvme0 -d /dev/nvme1 -r

# Update NVLink switch NVOS from a local image
aidc-cli fwupdate nvlink-sw --nvos "nvos-25.02.3004.bin"

# Update NVLink switch BMC + FPGA firmware from a remote server over SCP
aidc-cli fwupdate nvlink-sw -s remote --protocol scp --host 192.168.1.50 --user admin --password secret123 --bmc "/firmware/nvl-bmc-88.0002.0512.bin" --fpga "/firmware/nvl-fpga-0.1F.bin"

# Post-update verification
aidc-cli chkfw summary
```