OPNsense Forum

UPDATED! Please check the list of packages needing a manual install if you do not notice any ucode updates happening.

Hi all,

apparently some (not a majority, but enough for this to be a problem) users are hit by a race condition in the FreeBSD kernel which leads to the system locking up at booting when the microcode update plugin is installed. The specific point here is that the ucode updates are loaded "early" by the standard plugin which means before regular kernel startup.

The FreeBSD package alternatively allows for "late" loading of the ucode updates. This is considered non-optimal, because CPU features might change after the kernel is started and detection of said features has happened.
Yet personally for more than 8 years since ucode updates became a thing I have never seen a problem with late loading. It simply means the kernel boot process and startup of some services will happen with an unpatched CPU, then the updates will be applied with the system up and running.

Specifically the people who experience the boot time lockups with the plugin installed - if you can afford some downtime and a couple of reboots, please try this and report back.

1. Uninstall the os-cpu-microcode-amd from the UI. You probably did this already, if you are running 26.7 and you were hit by this problem.

2. For Intel systems:

pkg install x86info
pkg install cpu-microcode-intel
pkg install cpu-microcode-rc
pkg add -f https://pkg.opnsense.org/FreeBSD:15:amd64/snapshots/misc/os-cpu-microcode-intel-devel-1.1_1.pkg

For AMD systems:

pkg install x86info
pkg install cpu-microcode-amd
pkg install cpu-microcode-rc
pkg add -f https://pkg.opnsense.org/FreeBSD:15:amd64/snapshots/misc/os-cpu-microcode-amd-devel-1.1_1.pkg

3. Reboot your system. You should be able to observe the late application of the ucode updates in /var/run/dmesg.boot after the reboot.

Thanks and kind regards,
Patrick

Done:
--<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(efifb): resolution 800x600
[1] CPU microcode: updated from 0x10 to 0x21
[1] CPU: Intel(R) N100 (806.40-MHz K8-class CPU)
[1]  Origin="GenuineIntel"  Id=0xb06e0  Family=0x6  Model=0xbe  Stepping=0
[1]  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
--
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(efifb): resolution 800x600
[1] WARNING: sysctl vfs.zfs.arc_max is deprecated. Use vfs.zfs.arc.max instead.
[1] CPU microcode: updated from 0x10 to 0x21
[1] CPU: Intel(R) N100 (806.40-MHz K8-class CPU)
[1]  Origin="GenuineIntel"  Id=0xb06e0  Family=0x6  Model=0xbe  Stepping=0
[1]  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>


I followed the pkg steps and rebooted the system. No microcode messages in /var/run/dmesg.boot after boot after seconds or minutes.

=====
Message from x86info-1.31.s03_1:
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

Abandoned upstream, fails to identify anything remotely new according to upstrea                                                                                     m issue reports.

It is scheduled to be removed on or after 2025-06-30.

=====
Message from cpu-microcode-intel-20260512_1:

--
To enable microcode updates at boot time:
cat << EOF >> /boot/loader.conf
cpu_microcode_load="YES"
cpu_microcode_name="/boot/firmware/intel-ucode.bin"
EOF


-----

A bit early to ask, but what will be the step to have this converted to the final production version of the package?

I followed the steps and also do not see the microcode load.  Under SYSTEM > FIRMWARE > PLUGINS I see "os-cpu-microcode-intel-devel (misconfigured)" with the Repository as "unknown-repository" so I believe I have it correctly loaded, but it doesn't appear to ever update the microcode:

---<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(vga): resolution 640x480
[1] CPU: Intel(R) N100 (806.40-MHz K8-class CPU)
[1]   Origin="GenuineIntel"  Id=0xb06e0  Family=0x6  Model=0xbe  Stepping=0
[1]   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[1]   Features2=0x7ffafbbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,FMA,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND>
[1]   AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[1]   AMD Features2=0x121<LAHF,ABM,Prefetch>
[1]   Structured Extended Features=0x239ca7eb<FSGSBASE,TSCADJ,BMI1,AVX2,FDPEXC,SMEP,BMI2,ERMS,INVPCID,NFPUSG,PQE,RDSEED,ADX,SMAP,CLFLUSHOPT,CLWB,PROCTRACE,SHA>
[1]   Structured Extended Features2=0x98c007bc<UMIP,PKU,OSPKE,WAITPKG,GFNI,VAES,VPCLMULQDQ,RDPID,MOVDIRI,MOVDIR64B>
[1]   Structured Extended Features3=0xfc184410<FSRM,MD_CLEAR,IBT,IBPB,STIBP,L1DFL,ARCH_CAP,CORE_CAP,SSBD>
[1]   Structured Extended Features4=0x810
[1]   XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
[1]   IA32_ARCH_CAPS=0x180fd6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO,TAA_NO>
[1]   VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
[1]   TSC: P-state invariant, performance statistics
[1] real memory  = 34358689792 (32767 MB)
[1] avail memory = 33219031040 (31680 MB)
[1] Event timer "LAPIC" quality 600
[1] ACPI APIC Table: <ALASKA A M I >
[1] WARNING: L3 data cache covers more APIC IDs than a package (7 > 3)
[1] FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
[1] FreeBSD/SMP: 1 package(s) x 4 core(s)
[1] random: registering fast source Intel Secure Key Seed
[1] random: fast provider: "Intel Secure Key Seed"
[1] random: unblocking device.
[1] ioapic0 <Version 2.0> irqs 0-119
[1] Launching APs: 1 2 3
[1] random: entropy device external interface
[1] wlan: mac acl policy registered
[1] kbd0 at kbdmux0
[1] WARNING: Device "spkr" is Giant locked and may be deleted before FreeBSD 16.0.
[1] efirtc0: <EFI Realtime Clock>
[1] efirtc0: registered as a time-of-day clock, resolution 1.000000s
[1] smbios0: <System Management BIOS> at iomem 0x75cc3000-0x75cc3017
[1] smbios0: Entry point: v3 (64-bit), Version: 3.5
[1] aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256>
[1] acpi0: <ALASKA A M I >
[1] acpi0: Power Button (fixed)
[1] hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
[1] Timecounter "HPET" frequency 19200000 Hz quality 950
[1] Event timer "HPET" frequency 19200000 Hz quality 550
[1] Event timer "HPET1" frequency 19200000 Hz quality 440
[1] Event timer "HPET2" frequency 19200000 Hz quality 440
[1] Event timer "HPET3" frequency 19200000 Hz quality 440
[1] Event timer "HPET4" frequency 19200000 Hz quality 440
[1] atrtc1: <AT realtime clock> on acpi0
[1] atrtc1: Warning: Couldn't map I/O.
[1] atrtc1: registered as a time-of-day clock, resolution 1.000000s
[1] Event timer "RTC" frequency 32768 Hz quality 0
[1] attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
[1] Timecounter "i8254" frequency 1193182 Hz quality 0
[1] Event timer "i8254" frequency 1193182 Hz quality 100
[1] Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
[1] acpi_timer0: <24-bit timer at 3.579545MHz> port 0x1808-0x180b on acpi0
[1] pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
[1] pci0: <ACPI PCI bus> on pcib0
[1] vgapci0: <VGA-compatible display> port 0x3000-0x303f mem 0x6000000000-0x6000ffffff,0x4000000000-0x400fffffff at device 2.0 on pci0
[1] vgapci0: Boot video device
[1] xhci0: <XHCI (generic) USB 3.0 controller> mem 0x6001110000-0x600111ffff at device 13.0 on pci0
[1] xhci0: 32 bytes context size, 64-bit DMA
[1] xhci0: xECP capabilities <PROTO,PROTO,VEND(c0),LEGACY,VEND(c6),VEND(c7),VEND(c2),DEBUG,VEND(c3),VEND(d1),VEND(ce),VEND(c8),VEND(c9),VEND(ca),VEND(cc),VEND(cd),VEND(d2),VEND(cf),VEND(d3)>
[1] usbus0 on xhci0
[1] usbus0: 5.0Gbps Super Speed USB v3.0
[1] xhci1: <XHCI (generic) USB 3.0 controller> mem 0x6001100000-0x600110ffff at device 20.0 on pci0
[1] xhci1: 32 bytes context size, 64-bit DMA
[1] xhci1: xECP capabilities <PROTO,PROTO,VEND(c0),LEGACY,VEND(c6),VEND(c7),VEND(c2),DEBUG,VEND(c3),VEND(c4),VEND(ce),VEND(c8),VEND(c9),VEND(ca),VEND(cb),VEND(cc),VEND(cd)>
[1] usbus1 on xhci1
[1] usbus1: 5.0Gbps Super Speed USB v3.0
[1] pci0: <memory, RAM> at device 20.2 (no driver attached)
[1] pci0: <simple comms> at device 22.0 (no driver attached)
[1] pcib1: <ACPI PCI-PCI bridge> at device 28.0 on pci0
[1] pci1: <ACPI PCI bus> on pcib1
[1] igc0: <Intel(R) Ethernet Controller I226-V> mem 0x80e00000-0x80efffff,0x80f00000-0x80f03fff at device 0.0 on pci1
[1] igc0: EEPROM V2.13-0 eTrack 0x80000284
[1] igc0: Using 1024 TX descriptors and 1024 RX descriptors
[1] igc0: Using 4 RX queues 4 TX queues
[1] igc0: Using MSI-X interrupts with 5 vectors
[1] igc0: Ethernet address: 00:d0:b4:01:57:0c
[1] igc0: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib2: <ACPI PCI-PCI bridge> at device 28.1 on pci0
[1] pci2: <ACPI PCI bus> on pcib2
[1] igc1: <Intel(R) Ethernet Controller I226-V> mem 0x80b00000-0x80bfffff,0x80c00000-0x80c03fff at device 0.0 on pci2
[1] igc1: EEPROM V2.13-0 eTrack 0x80000284
[1] igc1: Using 1024 TX descriptors and 1024 RX descriptors
[1] igc1: Using 4 RX queues 4 TX queues
[1] igc1: Using MSI-X interrupts with 5 vectors
[1] igc1: Ethernet address: 00:d0:b4:01:57:0d
[1] igc1: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib3: <ACPI PCI-PCI bridge> at device 28.2 on pci0
[1] pci3: <ACPI PCI bus> on pcib3
[1] igc2: <Intel(R) Ethernet Controller I226-V> mem 0x80800000-0x808fffff,0x80900000-0x80903fff at device 0.0 on pci3
[1] igc2: EEPROM V2.13-0 eTrack 0x80000284
[1] igc2: Using 1024 TX descriptors and 1024 RX descriptors
[1] igc2: Using 4 RX queues 4 TX queues
[1] igc2: Using MSI-X interrupts with 5 vectors
[1] igc2: Ethernet address: 00:d0:b4:01:57:0e
[1] igc2: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib4: <ACPI PCI-PCI bridge> at device 28.6 on pci0
[1] pci4: <ACPI PCI bus> on pcib4
[1] igc3: <Intel(R) Ethernet Controller I226-V> mem 0x80500000-0x805fffff,0x80600000-0x80603fff at device 0.0 on pci4
[1] igc3: EEPROM V2.13-0 eTrack 0x80000284
[1] igc3: Using 1024 TX descriptors and 1024 RX descriptors
[1] igc3: Using 4 RX queues 4 TX queues
[1] igc3: Using MSI-X interrupts with 5 vectors
[1] igc3: Ethernet address: 00:d0:b4:01:57:0f
[1] igc3: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib5: <ACPI PCI-PCI bridge> at device 29.0 on pci0
[1] pci5: <ACPI PCI bus> on pcib5
[1] nvme0: <Generic NVMe Device> mem 0x81000000-0x81003fff at device 0.0 on pci5
[1] isab0: <PCI-ISA bridge> at device 31.0 on pci0
[1] isa0: <ISA bus> on isab0
[1] hdac0: <Intel Alder Lake-N HDA Controller> mem 0x6001120000-0x6001123fff,0x6001000000-0x60010fffff at device 31.3 on pci0
[1] pci0: <serial bus> at device 31.5 (no driver attached)
[1] acpi_button0: <Sleep Button> on acpi0
[1] cpu0: <ACPI CPU> on acpi0
[1] acpi_button1: <Power Button> on acpi0
[1] acpi_tz0: <Thermal Zone> on acpi0
[1] uart: ns8250: UART FCR is broken (0x1)
[1] uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
[1] uart0: console (115200,n,8,1)
[1] uart: ns8250: UART FCR is broken (0x1)
[1] uart1: <16550 or compatible> port 0x2f8-0x2ff irq 3 on acpi0
[1] acpi_syscontainer0: <System Container> on acpi0
[1] acpi_syscontainer1: <System Container> on acpi0
[1] atrtc0: <AT realtime clock> at port 0x70 irq 8 on isa0
[1] atrtc0: Warning: Couldn't map I/O.
[1] atrtc0: registered as a time-of-day clock, resolution 1.000000s
[1] atrtc0: Can't map interrupt.
[1] hwpstate_intel0: <Intel Speed Shift> on cpu0
[1] cpufreq0: <CPU frequency control> on cpu0
[1] hwpstate_intel1: <Intel Speed Shift> on cpu1
[1] cpufreq1: <CPU frequency control> on cpu1
[1] hwpstate_intel2: <Intel Speed Shift> on cpu2
[1] cpufreq2: <CPU frequency control> on cpu2
[1] hwpstate_intel3: <Intel Speed Shift> on cpu3
[1] cpufreq3: <CPU frequency control> on cpu3
[1] Timecounter "TSC" frequency 806401148 Hz quality 1000
[1] Timecounters tick every 1.000 msec
[1] ugen1.1: <Intel XHCI root HUB> at usbus1
[1] ugen0.1: <Intel XHCI root HUB> at usbus0
[1] uhub0 on usbus1
[1] uhub0: <Intel XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus1
[1] ZFS filesystem version: 5
[1] ZFS storage pool version: features support (5000)
[1] uhub1 on usbus0
[1] uhub1: <Intel XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
[1] nda0 at nvme0 bus 0 scbus0 target 0 lun 1
nda0: <Samsung SSD 970 EVO Plus 500GB 2B2QEXM7 S58SNJ0N613187J>
nda0: Serial Number S58SNJ0N613187J
[1] nda0: nvme version 1.3
nda0: 476940MB (976773168 512 byte sectors)
[1] Trying to mount root from zfs:zroot/ROOT/24.1 []...
[1] uhub1: 3 ports with 3 removable, self powered
[2] uhub0: 16 ports with 16 removable, self powered
[2] pid 30 (zpool) is attempting to use unsafe AIO requests - not logging anymore


Nothing applied could mean that you already have the latest ucode, such as from a BIOS update.

Quote from: OPNenthu on July 17, 2026, 08:22:12 PMNothing applied could mean that you already have the latest ucode, such as from a BIOS update.

Makes sense.  I just tried it on an N5105 I have running as well, and I do see the microcode update:

[1] CPU microcode: updated from 0x1d to 0x24000026

Quote from: db9 on July 17, 2026, 06:07:36 PMMessage from x86info-1.31.s03_1:
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

Abandoned upstream, fails to identify anything remotely new according to upstream issue reports.

It is scheduled to be removed on or after 2025-06-30.

This is irrelevant, the "x86info" package will simply go away, eventually. Nothing to worry.

Quote from: db9 on July 17, 2026, 06:07:36 PMA bit early to ask, but what will be the step to have this converted to the final production version of the package?

It will be included in 26.7.1 - or a hotfix if the team deems it necessary.

Quote from: Igor on July 17, 2026, 05:43:16 PM[1] CPU microcode: updated from 0x10 to 0x21

So worked as intended.

Quote from: db9 on July 17, 2026, 06:07:36 PMI followed the pkg steps and rebooted the system. No microcode messages in /var/run/dmesg.boot after boot after seconds or minutes.

After a reboot, right?

Quote from: LOTRouter on July 17, 2026, 07:53:42 PMI followed the steps and also do not see the microcode load.

To verify you can always do this with the system running:

/usr/local/etc/rc.syshook.d/early/40-cpu-microcode
dmesg

You should see a repetition of the CPU info output you normally see at the top of /var/run/dmesg.boot like so:

[447] CPU: AMD Ryzen Embedded V1500B                       (2195.88-MHz K8-class CPU)
[447]   Origin="AuthenticAMD"  Id=0x810f10  Family=0x17  Model=0x11  Stepping=0
[447]   Features=0x178bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,MMX,FXSR,SSE,SSE2,HTT>
[447]   Features2=0x7ed8320b<SSE3,PCLMULQDQ,MON,SSSE3,FMA,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND>
[...]

If that is the case and you do not see that "updated from ... to ..." there was nothing to update.

Plus of course make sure you have the correct (Intel vs. AMD) version.

HTH,
Patrick

When I run the manual syshook on Intel.

root@fw254:~ # /usr/local/etc/rc.syshook.d/early/40-cpu-microcode
/usr/local/etc/rc.syshook.d/early/40-cpu-microcode: /usr/local/etc/rc.d/microcode_update: not found

I did a search for microcode files and don't find the microcode_update anywhere.

I looked on an existing 26.1 and this file doesn't exist.

Quote from: zz00mm on July 17, 2026, 10:08:43 PMroot@fw254:~ # /usr/local/etc/rc.syshook.d/early/40-cpu-microcode
/usr/local/etc/rc.syshook.d/early/40-cpu-microcode: /usr/local/etc/rc.d/microcode_update: not found

Try this and repeat, please:
pkg install cpu-microcode-rc

I'll update the first posting accordingly. Thank you for reporting.

Patrick,
     Thank you for the quick response. Now working.

Zz00mm

Quote from: Patrick M. Hausen on July 17, 2026, 10:15:16 PMTry this and repeat, please:

Code Select Expand

pkg install cpu-microcode-rc


Whoops, good call. rc package used to be a direct dependency but it no longer is.  Need to add that to the plugin dependencies.

So that's

https://github.com/opnsense/plugins/commit/ac68d4e
https://github.com/opnsense/tools/commit/854a5a8ce

for 26.7.1 then.


Cheers,
Franco

QuoteEarlier kernels may cause boot stalls ...

Did you mean to say "Earlier bootloaders ..."?

Hi Patrick and all,

Just to add my experience with microcode on this platform: I'm on an N5105 box with 4× i226‑V. With OPNsense 26.1.4 I had the official os-intel-microcode plugin installed, and I experienced boot hangs when both WAN and LAN were connected (link stayed amber, system seemed stuck, no progress on console). After removing os-intel-microcode, all reboots completed successfully and the issue did not return.

Because of that, I haven't tried any microcode plugin on 26.7/27 yet. From my side, the safe configuration so far has been "no microcode plugin, BIOS handles everything".

If the new "late load" devel packages are meant to address exactly this kind of early‑boot race condition, I'd be interested in testing them, but I'd prefer to wait for the official 26.7.1 / hotfix version before touching microcode again on this box.

Thanks,

Quote from: (MARLOO) on July 18, 2026, 10:17:17 PMIf the new "late load" devel packages are meant to address exactly this kind of early‑boot race condition

They are.

Quote from: (MARLOO) on July 18, 2026, 10:17:17 PMbut I'd prefer to wait for the official 26.7.1 / hotfix version before touching microcode again on this box.

You do you :-)

@(MARLOO):

So I understand what you are essentially answering to this "call for testing": "No, thank you, I am not going to test the potential fix, but rather wait for other people's confirmation that the fix works and only then apply it with the next hotfix."?

How clever. (Sorry for being a bit harsh)

P.S.: The whole point of this thread is to gain knowledge if the presumed fix works for affected people, so just you know.... the only reason I did not try is that I do not experience the problem myself even with early microcode loading.

I just re-installed the microcode plugin after upgrade to 26.7 and mine looks affected.  Console getting stuck here:

   Autoboot in 0 seconds. [Space] to pause  26.7  ``The Road Ahead''   /
Loading kernel...
/boot/kernel/kernel text=0x18d968 text=0xe7b06c text=0x47b433 data=0x180+0xe80 data=0x1a84c0+0x857b40 0x8+0x1abe48+0x8+0x1d1c04
Loading configured modules...
/boot/kernel/zfs.ko size 0x628648 at 0x277e000
/boot/kernel/if_enc.ko size 0x4be0 at 0x2da7000
/boot/firmware/intel-ucode.bin size=0x1050000
/boot/kernel/if_lagg.ko size 0x15ef8 at 0x3dfc000
loading required module 'if_infiniband'
/boot/kernel/if_infiniband.ko size 0x3558 at 0x3e12000
/boot/kernel/carp.ko size 0x11b40 at 0x3e16000
/boot/kernel/if_gre.ko size 0xaa78 at 0x3e28000
/boot/kernel/pflog.ko size 0x3c08 at 0x3e33000
loading required module 'pf'
/boot/kernel/pf.ko size 0xbd6e8 at 0x3e37000
/boot/kernel/opensolaris.ko size 0x1e2f0 at 0x3ef5000
/boot/kernel/pfsync.ko size 0x12340 at 0x3f14000
/boot/entropy size=0x1000
/boot/kernel/if_bridge.ko size 0x10a68 at 0x3f28000
loading required module 'bridgestp'
/boot/kernel/bridgestp.ko size 0x8af8 at 0x3f39000
/etc/hostid size=0x25
staging 0x6c000000 (not copying) tramp 0x76df6000 PT4 0x76ded000
Start @ 0xffffffff8038e000 ...
Loading splash ok

To try the late loading fix, I think I need to first apply both of @franco's patches from post #11 and I need to upgrade my bootloader to the latest as per the comment (https://github.com/opnsense/plugins/commit/ac68d4e) in the commit.

Only then should I do the steps @Patrick wrote in post #1.  Is that right?

Thanks!

For reference: Protectli V1410, N5105, coreboot v0.9.4.

@meyergru There seems to be a connection to an outdated boot loader causing this issue when loading early.

The whole ZFS pool upgrade and boot loader upgrade situation is a bit frustrating for the whole FreeBSD ecosystem, not only OPNsense. We really need a conclusive solution in upstream.

One of the things I am taking with me to Brussels for the upcoming FreeBSD developer summit.

@OPNenthu

If you apply the steps outlined by me you do not need a boot loader update. That's the point. Similarly the changes by Franco that will be in 26.7.1 address exactly this issue for people without a current boot loader.

It would be interesting to see if a boot loader upgrade alone fixes things for you!

@ meyergru

Hi meyergru,

I see how my previous message could sound like "I'll wait for others to test first", and I understand why that comes across as not really helping the thread. That wasn't my intent.

To be clear: on my N5105 box with 4× i226‑V I did hit a concrete problem with the microcode plugin. After updating the i226 NVM to 2.32 and running OPNsense 26.1.4, with os-intel-microcode installed I was getting boot hangs whenever both WAN and LAN were connected (link stayed amber, system seemed stuck, no progress on console). I documented this here in the i226 thread (posts #198–#199) and the issue disappeared after I removed os-intel-microcode.

https://forum.opnsense.org/index.php?topic=48695.msg263682#msg263682

Because of that experience, I'm a bit cautious about re‑introducing any microcode plugin on this primary firewall. I'm absolutely willing to help verify the "late load" fix, but I'm trying to balance testing with not breaking a production device again.

OPNenthu  with very similar hardware (N5105, 4× i226‑V) is now reporting boot stalls after reinstalling the microcode plugin on 26.7. This matches what I experienced on 26.1.4, which is why I'm being cautious about re‑enabling microcode on this box until the "late load" fix is fully validated.

My intention isn't to avoid testing, just to make sure I do it in a controlled way after having already been affected by the early‑load issue on this hardware.

Bottom line: I'm happy to contribute real‑world data on the fix, just please bear with me if I'm a bit more careful than usual on a box that already hung at boot because of microcode.

Quote from: Patrick M. Hausen on July 18, 2026, 11:06:03 PMThere seems to be a connection to an outdated boot loader causing this issue when loading early.

Do we know how outdated it has to be in order to cause issues ?

Quote from: Patrick M. Hausen on July 18, 2026, 11:08:27 PM@OPNenthu

If you apply the steps outlined by me you do not need a boot loader update. That's the point. Similarly the changes by Franco that will be in 26.7.1 address exactly this issue for people without a current boot loader.

It would be interesting to see if a boot loader upgrade alone fixes things for you!

Ok, this is interesting.  Neither option works for me.

I first tried the bootcode update as per your post here (I have the same layout): https://forum.opnsense.org/index.php?topic=48145.msg243083#msg243083

On reboot, the console got stuck at the same place.

I then rolled back and applied your instructions in post #1, but this too got stuck.

Posting my install log for reference.  I wonder if there's a vendor/firmware quirk that breaks this?

root@firewall:~ # pkg install x86info
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
The following 3 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
libpci: 3.15.0 [OPNsense]
pciids: 20260624 [OPNsense]
x86info: 1.31.s03_1 [OPNsense]

Number of packages to be installed: 3

The process will require 2 MiB more space.
447 KiB to be downloaded.

Proceed with this action? [y/N]: y
[1/3] Fetching x86info-1.31.s03_1.pkg: 100%   72 KiB  73.4kB/s    00:01   
[2/3] Fetching pciids-20260624.pkg: 100%  297 KiB 304.2kB/s    00:01   
[3/3] Fetching libpci-3.15.0.pkg: 100%   79 KiB  80.5kB/s    00:01   
Checking integrity... done (0 conflicting)
[1/3] Installing pciids-20260624...
[1/3] Extracting pciids-20260624: 100%
[2/3] Installing libpci-3.15.0...
[2/3] Extracting libpci-3.15.0: 100%
[3/3] Installing x86info-1.31.s03_1...
[3/3] Extracting x86info-1.31.s03_1: 100%
=====
Message from x86info-1.31.s03_1:

--
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

Abandoned upstream, fails to identify anything remotely new according to upstream issue reports.

It is scheduled to be removed on or after 2025-06-30.
root@firewall:~ # pkg install cpu-microcode-intel
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
cpu-microcode-intel: 20260512_1 [OPNsense]

Number of packages to be installed: 1

The process will require 38 MiB more space.
25 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/1] Fetching cpu-microcode-intel-20260512_1.pkg: 100%   25 MiB  12.9MB/s    00:02   
Checking integrity... done (0 conflicting)
[1/1] Installing cpu-microcode-intel-20260512_1...
[1/1] Extracting cpu-microcode-intel-20260512_1: 100%
=====
Message from cpu-microcode-intel-20260512_1:

--
To enable microcode updates at boot time:
cat << EOF >> /boot/loader.conf
cpu_microcode_load="YES"
cpu_microcode_name="/boot/firmware/intel-ucode.bin"
EOF
root@firewall:~ # pkg install cpu-microcode-rc
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
cpu-microcode-rc: 1.0_2 [OPNsense]

Number of packages to be installed: 1

2 KiB to be downloaded.

Proceed with this action? [y/N]: y
[1/1] Fetching cpu-microcode-rc-1.0_2.pkg: 100%    2 KiB   2.5kB/s    00:01   
Checking integrity... done (0 conflicting)
[1/1] Installing cpu-microcode-rc-1.0_2...
[1/1] Extracting cpu-microcode-rc-1.0_2: 100%
=====
Message from cpu-microcode-rc-1.0_2:

--
This port includes an RC script, which is one of two methods to update
the CPU microcode on a FreeBSD system.

1. Early loading.
   This method does not use the RC script included here.
   This is the preferred method, because it ensures that any CPU features
   added or removed by a microcode update are visible to the kernel by
   applying the update before the kernel performs CPU feature detection.

   To enable updates using early loading, add the following lines to
   /boot/loader.conf:

   cpu_microcode_load="YES"

   and the appropriate one of these lines:

   cpu_microcode_name="/boot/firmware/intel-ucode.bin"
   cpu_microcode_name="/boot/firmware/amd-ucode.bin"

   The microcode update will be loaded when the system is rebooted.

   AMD systems running FreeBSD prior to 2024-02-22 snapshot
   34467bd76 only support late loading.


2. Late loading.
   This method, which does use the RC script included here, is enabled by
   adding the following line to /etc/rc.conf:

   microcode_update_enable="YES"

   The microcode update is then applied upon reboot or when the microcode
   update service is run via:

   # service microcode_update start

   If the CPU requires a microcode update, a console message such as the
   following will appear:

   Updating CPU Microcode...
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl0 from rev 0x17 to rev 0x22... done.
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl2 from rev 0x17 to rev 0x22... done.
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl4 from rev 0x17 to rev 0x22... done.
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl6 from rev 0x17 to rev 0x22... done.
   Done.

It is safe to enable both methods.
root@firewall:~ # pkg add -f https://pkg.opnsense.org/FreeBSD:15:amd64/snapshots/misc/os-cpu-microcode-intel-devel-1.1_1.pkg
Fetching os-cpu-microcode-intel-devel-1.1_1.pkg: 100%    1 KiB   1.3kB/s    00:01   
Installing os-cpu-microcode-intel-devel-1.1_1...
Extracting os-cpu-microcode-intel-devel-1.1_1: 100%
Reloading firmware configuration
Flushing all caches...done.
Writing firmware settings: OPNsense
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
root@firewall:~ #


Quote from: nero355 on July 18, 2026, 11:34:07 PMDo we know how outdated it has to be in order to cause issues?

Anything below the boot loader that comes with FreeBSD 15.1 is potentially suffering from this problem. It was fixed in this commit:

https://cgit.freebsd.org/src/commit/?h=releng/15.1&id=56e59980b673affb82c8c5da9d4338e10d946acd

If you do a fresh installation of OPNsense 26.7 you will have everything in place. If you came to 26.7 via an upgrade, you can update your boot loader from the running system by copying the /boot/loader.efi to your EFI partition.

Unfortunately or not OPNsense/Franco took the conservative approach and in the next OPNsense release we will simply load the ucode updates later in the boot process. I am not aware of any downsides to this approach with about 100 servers in production to back that claim. Yet, from a theoretical point of view loading ucode updates before kernel startup is "better". Not much arguing about that. We (me at least) are just not quite sure about the impact.

So there are two issues at hand, now:

- OPNsense as its own project will fix the boot lockup problem by changing to late ucode update loading.
- FreeBSD as upstream identified a problem with early ucode update loading and fixed it in the boot loader.

If I was product manager for OPNsense I would publish Franco's changes with the next release, case closed for now. But put a re-evaluation of the entire approach on the board for 27.1. Possibly (?) FreeBSD will have a reasonable unified approach to automated boot loader management.

Kind regards,
Patrick

@OPNenthu

Thanks for sharing your logs and screenshots, it's really helpful to see that on very similar hardware (N5105, 4× i226‑V) both the bootloader update and the "late load" steps still result in a boot hang.

Just to connect the dots: my original issue appeared after updating the i226‑V NVM firmware to 2.32 on 26.1.4. With the microcode plugin installed, the box would hang at boot when both WAN and LAN were linked. Removing the microcode plugin fixed it.

Out of curiosity, which NVM/firmware version are your i226‑V NICs currently running?
You can check with:

bash
dmesg | grep -i igc
and look for lines like "EEPROM Vx.xx‑x"

@(MARLOO) I have no clue how or why the NVM version would impact this, but mine is on the original 2.13 that shipped with the mini pc.  Also, there may be differences in behavior across vendors and BIOS images, which was part of my question... so I am hesitant to assume that all N5105 boxes behave the same.  I'm not sure though.

@OPNenthu

Agreed, the NVM version itself probably doesn't directly "cause" the microcode issue. I mentioned it mainly because my boot hangs started right after I updated the i226 firmware, so I was trying to see if there was any pattern.

The reason I updated the i226‑V NVM to 2.32 back then was that the interfaces were flapping a lot. After the firmware update, the flapping completely disappeared. I documented that here:
https://forum.opnsense.org/index.php?topic=48695.195

The fact that you're on 2.13 and I was on 2.32, yet both of us hit boot hangs with the microcode plugin, actually supports your point: it's likely not about the NIC firmware, but about how early microcode loading interacts with the N5105 platform and/or specific BIOS images.

On my box, the practical workaround for now is to keep the microcode plugin removed and wait until the "late load" fix is officially rolled out. If you're okay with a bit more testing, your setup is probably perfect to help validate the fix across different N5105 boxes.

Quote from: franco on July 18, 2026, 09:56:19 PMSo that's

https://github.com/opnsense/plugins/commit/ac68d4e
https://github.com/opnsense/tools/commit/854a5a8ce

for 26.7.1 then.

This seems to be the AMD version if I look at github, Intel will follow?

Quote from: db9 on July 19, 2026, 08:43:40 AM

Quote from: franco on July 18, 2026, 09:56:19 PMSo that's

https://github.com/opnsense/plugins/commit/ac68d4e
https://github.com/opnsense/tools/commit/854a5a8ce

for 26.7.1 then.

This seems to be the AMD version if I look at github, Intel will follow?

It's a major change for both versions and a minor fix for AMD.

Quote from: Patrick M. Hausen on July 19, 2026, 12:03:21 AMAnything below the boot loader that comes with FreeBSD 15.1 is potentially suffering from this problem. It was fixed in this commit:

https://cgit.freebsd.org/src/commit/?h=releng/15.1&id=56e59980b673affb82c8c5da9d4338e10d946acd

If you do a fresh installation of OPNsense 26.7 you will have everything in place. If you came to 26.7 via an upgrade, you can update your boot loader from the running system by copying the /boot/loader.efi to your EFI partition.

While reading this I realized my question was already answered in this thread, but somehow I finally connected the dots after reading your post : Thank you! :)

Regarding my post #21, is there anything else I can try that would be useful here?

I'll give this a couple days before attempting to reinstall from 26.7 images.

If you completely remove the ucode update plugin, you still cannot upgrade?

Sorry, let me clarify:

I'm already on 26.7 because I had proactively removed the microcode plugin before upgrading from 26.1.  I took a snapshot after the OS upgrade and before installing the microcode plugin again.  Let's call this snapshot X.  From this starting point I then did the following.

Attempt 1: Re-installed the microcode plugin (intel) from the 26.7 UI
-> console freeze on reboot; problem confirmed

Rolled back to snapshot X.

Attempt 2: Installed the plugin & manually upgraded the bootcode by copying /boot/loader.efi to /boot/efi/efi/boot/bootx64.efi and /boot/efi/efi/freebsd/loader.efi
-> console freeze on reboot; no change

Rolled back to snapshot X.  Confirmed system was again booting normally.

Attempt 3: Followed the steps for Intel in post #1 only (no bootcode upgrade)
-> console freeze on reboot; no change

So I've again rolled back to snapshot X and this is where I'm sitting currently.

Ok, I think this was my fault.  I re-did everything as below:

1. From a running 26.1.11_10 version, first remove the os-cpu-microcode-intel plugin
2. Upgrade to 26.7
3. Update bootloader as per https://forum.opnsense.org/index.php?topic=48145.msg243083#msg243083
4. Apply the steps in @Patrick's post #1 (for Intel)
5. Reboot

Now, I see the late loading in the console just before the initialization of interfaces and the output is not freezing!  It appears I also don't have any ucode updates available as nothing newer is getting applied, but that's OK.

Updating CPU Microcode...
CPU: Intel(R) Celeron(R) N5105 @ 2.00GHz (1996.80-MHz K8-class CPU)
  Origin="GenuineIntel"  Id=0x906c0  Family=0x6  Model=0x9c  Stepping=0
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
  AMD Features=0x28100800<SYSCALL,NX,RDTSCP,LM>
  AMD Features2=0x101<LAHF,Prefetch>
  Structured Extended Features=0x2394a2c3<FSGSBASE,TSCADJ,FDPEXC,SMEP,ERMS,NFPUSG,PQE,RDSEED,SMAP,CLFLUSHOPT,CLWB,PROCTRACE,SHA>
  Structured Extended Features2=0x18400124<UMIP,WAITPKG,GFNI,RDPID,MOVDIRI,MOVDIR64B>
  Structured Extended Features3=0xfc000400<MD_CLEAR,IBPB,STIBP,L1DFL,ARCH_CAP,CORE_CAP,SSBD>
  XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
  IA32_ARCH_CAPS=0x14020c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
  VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
  TSC: P-state invariant, performance statistics
Done.

So from this state now with the manually installed packages, what will I need to do on the next OPNsense update?  Will it automatically clear the manual packages and apply the updated plugin?

Thanks!

With the updated bootloader you would not need my manual steps.

I'm willing to retry it in case I messed up earlier but that is what I already tried in post #21.  You had asked if updating the bootloader alone would fix the issue for me but it didn't.

Maybe the order of operations matters.  I already had the plugin installed when I did the bootloader update.  Let me instead try the bootloader update without the ucode plugin, reboot, install the plugin, reboot again.  I'll report back shortly.

Reproducible boot freeze:

1. Upgrade to 26.7 (without ucode plugin installed)
2. Update the bootloader
3. Reboot
4. Install the os-cpu-microcode-intel plugin from the GUI
5. Reboot
   -> console locks up on the "Loading splash ok" line.

   Autoboot in 0 seconds. [Space] to pause  26.7  ``The Road Ahead''   /
Loading kernel...
/boot/kernel/kernel text=0x18d968 text=0xe7b06c text=0x47b433 data=0x180+0xe80 data=0x1a84c0+0x857b40 0x8+0x1abe48+0x8+0x1d1c04
Loading configured modules...
/boot/kernel/pf.ko size 0xbd6e8 at 0x277e000
/boot/kernel/zfs.ko size 0x628648 at 0x283c000
/boot/kernel/pfsync.ko size 0x12340 at 0x2e65000
/boot/kernel/carp.ko size 0x11b40 at 0x2e78000
/boot/kernel/pflog.ko size 0x3c08 at 0x2e8a000
/boot/kernel/opensolaris.ko size 0x1e2f0 at 0x2e8e000
/etc/hostid size=0x25
/boot/kernel/if_gre.ko size 0xaa78 at 0x2ead000
/boot/kernel/if_lagg.ko size 0x15ef8 at 0x2eb8000
loading required module 'if_infiniband'
/boot/kernel/if_infiniband.ko size 0x3558 at 0x2ece000
/boot/kernel/if_enc.ko size 0x4be0 at 0x2ed2000
/boot/firmware/intel-ucode.bin size=0x1050000
/boot/entropy size=0x1000
/boot/kernel/if_bridge.ko size 0x10a68 at 0x3f28000
loading required module 'bridgestp'
/boot/kernel/bridgestp.ko size 0x8af8 at 0x3f39000
staging 0x6c000000 (not copying) tramp 0x76df6000 PT4 0x76ded000
Start @ 0xffffffff8038e000 ...
Loading splash ok

Working:

The original method in this thread.

1. Upgrade to 26.7 (without ucode plugin installed)
2. Install the Intel ucode packages manually from post #1
3. Reboot
  -> working

Generating configuration: templates...done
>>> Invoking early script 'cpu-microcode'
Updating CPU Microcode...
CPU: Intel(R) Celeron(R) N5105 @ 2.00GHz (1996.80-MHz K8-class CPU)
  Origin="GenuineIntel"  Id=0x906c0  Family=0x6  Model=0x9c  Stepping=0
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
  AMD Features=0x28100800<SYSCALL,NX,RDTSCP,LM>
  AMD Features2=0x101<LAHF,Prefetch>
  Structured Extended Features=0x2394a2c3<FSGSBASE,TSCADJ,FDPEXC,SMEP,ERMS,NFPUSG,PQE,RDSEED,SMAP,CLFLUSHOPT,CLWB,PROCTRACE,SHA>
  Structured Extended Features2=0x18400124<UMIP,WAITPKG,GFNI,RDPID,MOVDIRI,MOVDIR64B>
  Structured Extended Features3=0xfc000400<MD_CLEAR,IBPB,STIBP,L1DFL,ARCH_CAP,CORE_CAP,SSBD>
  XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
  IA32_ARCH_CAPS=0x14020c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
  VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
  TSC: P-state invariant, performance statistics
Done.

So, at least on my particular system the bootloader update is not enough to get the microcode plugin working.

The method in post #1 works and I probably did something wrong in my last try.

Hope someone else with Intel can validate this.

Thanks a lot for testing again. How did you update the boot loader?

Starting point:

root@firewall:~ # uname -a
FreeBSD firewall.h1.home.arpa 15.1-RELEASE-p1 FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
root@firewall:~ # cat /etc/fstab
# Device        Mountpoint    FStype    Options        Dump    Pass#
/dev/gpt/efiboot0    /boot/efi    msdosfs    rw,noauto    2    2
/dev/nda0p3        none        swap    sw        0    0
root@firewall:~ # gpart show
=>       40  488397088  nda0  GPT  (233G)
         40     532480     1  efi  (260M)
     532520       1024     2  freebsd-boot  (512K)
     533544        984        - free -  (492K)
     534528   16777216     3  freebsd-swap  (8.0G)
   17311744  471085056     4  freebsd-zfs  (225G)
  488396800        328        - free -  (164K)

root@firewall:~ # ls -l /boot/efi
total 0

Procedure:

root@firewall:~ # mkdir -p /boot/efi/efi/boot /boot/efi/efi/freebsd
root@firewall:~ # cp /boot/loader.efi /boot/efi/efi/boot/bootx64.efi
root@firewall:~ # cp /boot/loader.efi /boot/efi/efi/freebsd/loader.efi
root@firewall:~ # gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 2 nda0
partcode written to nda0p2
bootcode written to nda0
root@firewall:~ #

Reference: https://forum.opnsense.org/index.php?topic=48145.msg243083#msg243083

Did you mount /boot/efi, first? From the output of your "ls" command I fear you did not. So possibly you copied the boot loader to a directory named /boot/efi on the root filesystem.

Ah, that's what I missed.  Thanks!

Trying again...

I've updated 4 FWs yesterday using the latest loaders-update script v1.4.0 (last time I've tested it was 1.3.2).

2xFW4c and a DEC750 on ZFS and an APU4 on UFS.

Unfortunately neither of these FWs appear to be in scope for a microcode update on boot. The bootloader update though seems to be required on major OS upgrades so that's one thing less to worry about.

Quote from: Patrick M. Hausen on July 20, 2026, 09:15:49 AMDid you mount /boot/efi, first? From the output of your "ls" command I fear you did not. So possibly you copied the boot loader to a directory named /boot/efi on the root filesystem.

Yes, this was the issue.  I had put the "noauto" mount option on the efi boot partition some time ago and didn't mount it manually.

All good now.  The bootloader is updated and the os-cpu-microcode-intel plugin is installed and loading early:

---<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
VT(vga): resolution 640x480
CPU microcode: no matching update found
CPU: Intel(R) Celeron(R) N5105 @ 2.00GHz (1996.80-MHz K8-class CPU)
  Origin="GenuineIntel"  Id=0x906c0  Family=0x6  Model=0x9c  Stepping=0
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
  AMD Features=0x28100800<SYSCALL,NX,RDTSCP,LM>
  AMD Features2=0x101<LAHF,Prefetch>
  Structured Extended Features=0x2394a2c3<FSGSBASE,TSCADJ,FDPEXC,SMEP,ERMS,NFPUSG,PQE,RDSEED,SMAP,CLFLUSHOPT,CLWB,PROCTRACE,SHA>
  Structured Extended Features2=0x18400124<UMIP,WAITPKG,GFNI,RDPID,MOVDIRI,MOVDIR64B>
  Structured Extended Features3=0xfc000400<MD_CLEAR,IBPB,STIBP,L1DFL,ARCH_CAP,CORE_CAP,SSBD>
  XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
  IA32_ARCH_CAPS=0x14020c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
  VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
  TSC: P-state invariant, performance statistics

Thanks again, Patrick

I just ran into that microcode issue. I have two (almost) identical devices, TK Edge 4L and TK Edge4Go¹, both Intel Celeron J3455. The Edge 4L is affected by this issue, TK Edge4Go is not. Should I remove os-cpu-microcode-intel from the working Edge4Go, too?
Why is one affected, the other not?


1) https://www.thomas-krenn.com/de/produkte/low-energy-systeme

kenv smbios.bios.vendor: American Megatrends Inc./Advantech
kenv smbios.bios.version: T011G206
kenv smbios.bios.reldate: 04/18/2023
sysctl hw.model: hw.model: Intel(R) Celeron(R) CPU J3455 @ 1.50GHz

Because it is a complex timing issue that manifests itself only under specific circumstances.

@opn_mndr12101 Update the boot loaders on both devices and you can keep the plugin.

It's good that this will be taken to the FreeBSD maintainers as feedback because although the actual commands to update the bootloader are simple, arriving at the correct ones requires some arcane knowledge.  It's not well documented.  The FreeBSD handbook has barely one sentence (https://docs.freebsd.org/en/books/handbook/cutting-edge/#updating-bootcode) about it and links out to various man pages.  Good luck to any beginners.

In case you are interested in all the details: https://klarasystems.com/articles/the-freebsd-boot-process/

Don't miss the "Additional Resources" section ;-)

I don't really get it yet. Do I need to do something before I upgrade?

root@OPNsense:~ # zpool status
  pool: zroot
 state: ONLINE
  scan: scrub repaired 0B in 00:10:32 with 0 errors on Sun Nov 23 00:59:47 2025
config:

        NAME        STATE     READ WRITE CKSUM
        zroot       ONLINE       0     0     0
          mirror-0  ONLINE       0     0     0
            nda0p4  ONLINE       0     0     0
            nda1p4  ONLINE       0     0     0

errors: No known data errors
root@OPNsense:~ # file /boot/loader.efi
/boot/loader.efi: PE32+ executable for EFI (application), x86-64, 10 sections

root@OPNsense:~ # md5sum /boot/loader.efi
2f8e91724d3927826909c128c27efa16  /boot/loader.efi

root@OPNsense:~ # file /boot/efi/efi/boot/bootx64.efi
/boot/efi/efi/boot/bootx64.efi: PE32+ executable for EFI (application), x86-64, 10 sections

root@OPNsense:~ # md5sum /boot/efi/efi/boot/bootx64.efi
18ccc82fd9eeaa815f0ff1194dd36b4a  /boot/efi/efi/boot/bootx64.efi

root@OPNsense:~ # file /boot/efi/efi/freebsd/loader.efi
/boot/efi/efi/freebsd/loader.efi: PE32+ executable for EFI (application), x86-64, 10 sections

root@OPNsense:~ # md5sum /boot/efi/efi/freebsd/loader.efi
18ccc82fd9eeaa815f0ff1194dd36b4a  /boot/efi/efi/freebsd/loader.efi

root@OPNsense:~ # strings /boot/efi/efi/boot/bootx64.efi | grep -i "FreeBSD"
FreeBSD vinum
FreeBSD boot
freebsd
FreeBSD UFS
Can't fetch FreeBSD::%s we know is there
freebsd:nvstore
/efi/freebsd/loader.env
FreeBSD Loader
FreeBSD
freebsd:bootonce
FreeBSD ZFS
Can't allocate %d bytes to fetch FreeBSD::%s env var
No FreeBSD kernel provided, aborting
FreeBSD swap
org.freebsd:zstd_compress
DFreeBSD/amd64 EFI loader, Revision 1.1

root@OPNsense:~ # strings /boot/loader.efi | grep -i "FreeBSD"
FreeBSD vinum
FreeBSD boot
freebsd
FreeBSD UFS
Can't fetch FreeBSD::%s we know is there
freebsd:nvstore
/efi/freebsd/loader.env
FreeBSD Loader
FreeBSD
freebsd:bootonce
FreeBSD ZFS
Can't allocate %d bytes to fetch FreeBSD::%s env var
No FreeBSD kernel provided, aborting
FreeBSD swap
org.freebsd:zstd_compress
DFreeBSD/amd64 EFI loader, Revision 3.0

Do you have one of the os-cpu-microcode-* plugins installed? If yes, you should

- uninstall it
- then perform the upgrade to 27.6
- then after the upgrade update your boot loader
- then reinstall the plugin

And how exactly do I update the bootloader on both mirror disks?

Look back to post #37 if you do not want to use the forum search.

Quote from: bamf on July 21, 2026, 09:54:09 AMAnd how exactly do I update the bootloader on both mirror disks?

Quote from: meyergru on July 21, 2026, 09:58:11 AMLook back to post #37 if you do not want to use the forum search.

Why not quote https://forum.opnsense.org/index.php?topic=48145.msg243083#msg243083 here too ?!

=>

Quote from: Patrick M. Hausen on July 27, 2025, 10:15:40 PM@Sinister Pisces - this applies to your partition layout and device names.
@tessus - if yours are identical, go ahead. If not, please post your fstab and partition table, too.

Update EFI boot loader - the partition is mounted, already, so that's easy.

Code Select Expand

mkdir -p /boot/efi/efi/boot /boot/efi/efi/freebsd
cp /boot/loader.efi /boot/efi/efi/boot/bootx64.efi
cp /boot/loader.efi /boot/efi/efi/freebsd/loader.efi

I prefer to not have the EFI partition mounted all the time - if you agree, change fstab

Code Select Expand

/dev/gpt/efiboot0    /boot/efi       msdosfs     rw             2       2

to

Code Select Expand

/dev/gpt/efiboot0    /boot/efi       msdosfs     rw,noauto             2       2

Update BIOS boot loader, too, just in case you might switch hardware and want to just transfer the installed drive(s).

Code Select Expand

gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 2 nda0

HTH,
Patrick

w00t! :)

/EDIT :

Quote from: OPNenthu on July 21, 2026, 06:54:06 PMPlease also read the two posts before that one in the linked thread.

Those instructions are tailored and should not be copy/pasted everywhere.

For future readers convenience :
- https://forum.opnsense.org/index.php?topic=48145.msg243039#msg243039
- https://forum.opnsense.org/index.php?topic=48145.msg243081#msg243081

;)

Please also read the two posts before that one in the linked thread. Those instructions are tailored and should not be copy/pasted everywhere.

BTW: I just updated to 26.7.1 and it looks like it brought in the changes to enable late loading for the microcode and reinstalled the plugin and ucode package, so maybe now the bootcode update is optional again.

I think I have successfully updated the bootloader from 1.1 to 3.0 (still on OPNsense 26.1.11_10).

root@OPNsense:~ # strings /boot/efi/efi/boot/bootx64.efi | grep "Revision"
DFreeBSD/amd64 EFI loader, Revision 3.0
root@OPNsense:~ # strings /boot/efi/efi/freebsd/loader.efi  | grep "Revision"
DFreeBSD/amd64 EFI loader, Revision 3.0
But do I need to update the bootloader on the second SSD too?

root@OPNsense:~ # zpool status
  pool: zroot
 state: ONLINE
  scan: scrub repaired 0B in 00:10:32 with 0 errors on Sun Nov 23 00:59:47 2025
config:

        NAME        STATE     READ WRITE CKSUM
        zroot       ONLINE       0     0     0
          mirror-0  ONLINE       0     0     0
            nda0p4  ONLINE       0     0     0
            nda1p4  ONLINE       0     0     0
root@OPNsense:~ # gpart show -l
=>       40  500118112  nda0  GPT  (238G)
         40     532480     1  efiboot0  (260M)
     532520       1024     2  gptboot0  (512K)
     533544        984        - free -  (492K)
     534528   16777216     3  swap0  (8.0G)
   17311744  482805760     4  zfs0  (230G)
  500117504        648        - free -  (324K)

=>       40  500118112  nda1  GPT  (238G)
         40     532480     1  efiboot1  (260M)
     532520       1024     2  gptboot1  (512K)
     533544        984        - free -  (492K)
     534528   16777216     3  swap1  (8.0G)
   17311744  482805760     4  zfs1  (230G)
  500117504        648        - free -  (324K)

=>      63  10485697  da0  MBR  (5.0G)
        63      1985       - free -  (993K)
      2048  10418176    1  (null)  [active]  (5.0G)
  10420224     65536    2  (null)  (32M)
I guess so, but how? What's the correct command to mount the EFI partition?

root@OPNsense:~ # mkdir -p /mnt/efi
root@OPNsense:~ # mount -t msdosfs /dev/nda1p1 /mnt/efi
mount_msdosfs: /dev/nda1p1: Invalid argument

EDIT:

Seems the EFI partition on the second SSD is not functional at all?

root@OPNsense:~ # fstyp /dev/nda0p1
msdosfs
root@OPNsense:~ # fstyp /dev/nda1p1
fstyp: /dev/nda1p1: filesystem not recognized

Quote from: bamf on July 21, 2026, 07:53:25 PMI guess so, but how? What's the correct command to mount the EFI partition?

Possibly there is an EFI partition on your second drive but it's not formatted and no boot loader copied to it. The FreeBSD installer does not do this, that's left to the admin. The easiest way is to unmount the working partition of the first drive, then dd that over to the second one.

What I do is create a mirror of all EFI partitions of all disks, then format this with FAT32 and copy the boot loader to it.

Quote from: Patrick M. Hausen on July 21, 2026, 07:57:06 PMPossibly there is an EFI partition on your second drive but it's not formatted and no boot loader copied to it. The FreeBSD installer does not do this, that's left to the admin.

That explains a lot. I was assuming choosing a ZFS mirror in the OPNsense installer creates a fully redundant setup where all drives are bootable.

I have now formatted the EFI partition on /dev/nda1p1 and copied the bootloader files manually. Thanks for the explanation!

Quote from: bamf on July 21, 2026, 08:24:07 PMThat explains a lot. I was assuming choosing a ZFS mirror in the OPNsense installer creates a fully redundant setup where all drives are bootable.

Yeah ... *sigh* ... the whole situation leaves a bit to be desired. But that's a FreeBSD problem, not an OPNsense one. I will work on getting this improved but as participation in open source projects goes - no promises, sorry.

Potential bug report (?)

I upgraded a second, remote firewall to 26.7.1.  Before the upgrade it was on 26.7 with updated bootcode and with the os-cpu-microcode-intel plugin installed from the UI.  I had done that the prior day.  After the upgrade it received new microcode packages that were released today, but now it's not applying the microcode update on boot.

Before (26.7 + ucode plugin):

---<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(vga): resolution 640x480
[1] CPU microcode: updated from 0x24 to 0x26
[1] CPU: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz (1996.80-MHz K8-class CPU)
[1]   Origin="GenuineIntel"  Id=0x706a8  Family=0x6  Model=0x7a  Stepping=8
[1]   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[1]   Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[1]   AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[1]   AMD Features2=0x101<LAHF,Prefetch>
[1]   Structured Extended Features=0x2294e287<FSGSBASE,TSCADJ,SGX,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[1]   Structured Extended Features2=0x40400004<UMIP,RDPID,SGXLC>
[1]   Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
[1]   XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
[1]   IA32_ARCH_CAPS=0x14000c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
[1]   VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
[1]   TSC: P-state invariant, performance statistics

The early microcode update appears with the line "[1] CPU microcode: updated from 0x24 to 0x26".

After (26.7.1 + new ucode plugin/package):

---<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(vga): resolution 640x480
[1] CPU: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz (1996.80-MHz K8-class CPU)
[1]   Origin="GenuineIntel"  Id=0x706a8  Family=0x6  Model=0x7a  Stepping=8
[1]   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[1]   Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[1]   AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[1]   AMD Features2=0x101<LAHF,Prefetch>
[1]   Structured Extended Features=0x2294e287<FSGSBASE,TSCADJ,SGX,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[1]   Structured Extended Features2=0x40400004<UMIP,RDPID,SGXLC>
[1]   Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
[1]   XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
[1]   IA32_ARCH_CAPS=0x14000c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
[1]   VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
[1]   TSC: P-state invariant, performance statistics
[1] real memory  = 8589934592 (8192 MB)
[1] avail memory = 7859204096 (7495 MB)
[1] Event timer "LAPIC" quality 600
[1] ACPI APIC Table: <COREv4 COREBOOT>
[1] WARNING: L1 data cache covers fewer APIC IDs than a core (0 < 1)
[1] FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
[1] FreeBSD/SMP: 1 package(s) x 4 core(s)
[1] random: registering fast source Intel Secure Key Seed
[1] random: fast provider: "Intel Secure Key Seed"
[1] random: unblocking device.
[1] ioapic0 <Version 2.0> irqs 0-119
[1] Launching APs: 2 1 3
[1] random: entropy device external interface
[1] wlan: mac acl policy registered
[1] kbd0 at kbdmux0
[1] WARNING: Device "spkr" is Giant locked and may be deleted before FreeBSD 16.0.
[1] efirtc0: <EFI Realtime Clock>
[1] efirtc0: registered as a time-of-day clock, resolution 1.000000s
[1] smbios0: <System Management BIOS> at iomem 0x69533000-0x69533017
[1] smbios0: Entry point: v3 (64-bit), Version: 3.3
[1] aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256>
[1] acpi0: <COREv4 COREBOOT>
[1] acpi0: Power Button (fixed)
[1] hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
[1] Timecounter "HPET" frequency 19200000 Hz quality 950
[1] Event timer "HPET" frequency 19200000 Hz quality 550
[1] Event timer "HPET1" frequency 19200000 Hz quality 440
[1] Event timer "HPET2" frequency 19200000 Hz quality 440
[1] Event timer "HPET3" frequency 19200000 Hz quality 440
[1] Event timer "HPET4" frequency 19200000 Hz quality 440
[1] atrtc0: <AT realtime clock> port 0x70-0x77 on acpi0
[1] atrtc0: registered as a time-of-day clock, resolution 1.000000s
[1] Event timer "RTC" frequency 32768 Hz quality 0
[1] attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
[1] Timecounter "i8254" frequency 1193182 Hz quality 0
[1] Event timer "i8254" frequency 1193182 Hz quality 100
[1] Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
[1] acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0
[1] pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
[1] pci0: <ACPI PCI bus> on pcib0
[1] vgapci0: <VGA-compatible display> port 0x5000-0x503f mem 0x90000000-0x90ffffff,0x80000000-0x8fffffff at device 2.0 on pci0
[1] vgapci0: Boot video device
[1] hdac0: <Intel Gemini Lake HDA Controller> mem 0x91510000-0x91513fff,0x91000000-0x910fffff at device 14.0 on pci0
[1] pci0: <simple comms> at device 15.0 (no driver attached)
[1] ahci0: <Intel Gemini Lake AHCI SATA controller> port 0x5060-0x5067,0x5068-0x506b,0x5040-0x505f mem 0x91514000-0x91515fff,0x9151c000-0x9151c0ff,0x9151b000-0x9151b7ff at device 18.0 on pci0
[1] ahci0: AHCI v1.31 with 2 6Gbps ports, Port Multiplier supported
[1] ahcich0: <AHCI channel> at channel 0 on ahci0
[1] ahcich1: <AHCI channel> at channel 1 on ahci0
[1] pcib1: <ACPI PCI-PCI bridge> at device 19.0 on pci0
[1] pci1: <ACPI PCI bus> on pcib1
[1] igb0: <Intel(R) I210 Flashless (Copper)> port 0x1000-0x101f mem 0x91100000-0x9111ffff,0x91120000-0x91123fff at device 0.0 on pci1
[1] igb0: NVM V0.6 imgtype6
[1] igb0: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb0: Using 4 RX queues 4 TX queues
[1] igb0: Using MSI-X interrupts with 5 vectors
[1] igb0: Ethernet address: <redacted>
[1] igb0: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib2: <PCI-PCI bridge> at device 19.1 on pci0
[1] pci2: <PCI bus> on pcib2
[1] igb1: <Intel(R) I210 Flashless (Copper)> port 0x2000-0x201f mem 0x91200000-0x9121ffff,0x91220000-0x91223fff at device 0.0 on pci2
[1] igb1: NVM V0.6 imgtype6
[1] igb1: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb1: Using 4 RX queues 4 TX queues
[1] igb1: Using MSI-X interrupts with 5 vectors
[1] igb1: Ethernet address: <redacted>
[1] igb1: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib3: <PCI-PCI bridge> at device 19.2 on pci0
[1] pci3: <PCI bus> on pcib3
[1] igb2: <Intel(R) I210 Flashless (Copper)> port 0x3000-0x301f mem 0x91300000-0x9131ffff,0x91320000-0x91323fff at device 0.0 on pci3
[1] igb2: NVM V0.6 imgtype6
[1] igb2: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb2: Using 4 RX queues 4 TX queues
[1] igb2: Using MSI-X interrupts with 5 vectors
[1] igb2: Ethernet address: <redacted>
[1] igb2: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib4: <PCI-PCI bridge> at device 19.3 on pci0
[1] pci4: <PCI bus> on pcib4
[1] pcib5: <PCI-PCI bridge> at device 0.0 on pci4
[1] pci5: <PCI bus> on pcib5
[1] pcib6: <PCI-PCI bridge> at device 1.0 on pci5
[1] pci6: <PCI bus> on pcib6
[1] igb3: <Intel(R) I210 Flashless (Copper)> port 0x4000-0x401f mem 0x91400000-0x9141ffff,0x91420000-0x91423fff at device 0.0 on pci6
[1] igb3: NVM V0.6 imgtype6
[1] igb3: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb3: Using 4 RX queues 4 TX queues
[1] igb3: Using MSI-X interrupts with 5 vectors
[1] igb3: Ethernet address: <redacted>
[1] igb3: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib7: <PCI-PCI bridge> at device 3.0 on pci5
[1] pci7: <PCI bus> on pcib7
[1] pcib8: <PCI-PCI bridge> at device 5.0 on pci5
[1] pci8: <PCI bus> on pcib8
[1] pcib9: <PCI-PCI bridge> at device 7.0 on pci5
[1] pci9: <PCI bus> on pcib9
[1] xhci0: <Intel Gemini Lake USB 3.0 controller> mem 0x91500000-0x9150ffff at device 21.0 on pci0
[1] xhci0: 32 bytes context size, 64-bit DMA
[1] xhci0: xECP capabilities <PROTO,PROTO,VEND(c0),LEGACY,VEND(c6),VEND(c7),VEND(c2),DEBUG,VEND(c3),VEND(c4),VEND(c5),VEND(c8),VEND(c9),VEND(cb)>
[1] usbus0 on xhci0
[1] usbus0: 5.0Gbps Super Speed USB v3.0
[1] sdhci_pci0: <Generic SD HCI> mem 0x91519000-0x91519fff,0x9151a000-0x9151afff at device 28.0 on pci0
[1] sdhci_pci0: 1 slot(s) allocated
[1] mmc0: <MMC/SD bus> on sdhci_pci0
[1] isab0: <PCI-ISA bridge> at device 31.0 on pci0
[1] isa0: <ISA bus> on isab0
[1] acpi_button0: <Sleep Button> on acpi0
[1] cpu0: <ACPI CPU> on acpi0
[1] uart: ns8250: UART FCR is broken (0x1)
[1] uart0: <16550 or compatible> at port 0x3f8 irq 4 flags 0x10 on isa0
[1] uart0: console (115200,n,8,1)
[1] est0: <Enhanced SpeedStep Frequency Control> on cpu0
[1] cpufreq0: <CPU frequency control> on cpu0
[1] cpufreq1: <CPU frequency control> on cpu1
[1] cpufreq2: <CPU frequency control> on cpu2
[1] cpufreq3: <CPU frequency control> on cpu3
[1] Timecounter "TSC" frequency 1996800807 Hz quality 1000
[1] Timecounters tick every 1.000 msec
[1] ugen0.1: <Intel XHCI root HUB> at usbus0
[1] ZFS filesystem version: 5
[1] ZFS storage pool version: features support (5000)
[1] uhub0 on usbus0
[1] uhub0: <Intel XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
[1] hdacc0: <Intel Gemini Lake HDA CODEC> at cad 2 on hdac0
[1] hdaa0: <Intel Gemini Lake Audio Function Group> at nid 1 on hdacc0
[1] pcm0: <Intel Gemini Lake (HDMI/DP 8ch)> at nid 3 on hdaa0
[1] mmcsd0: 8GB <MMCHC 8GTF4R 0.6 SN 115AE8FD MFG 02/2023 by 21 0x0000> at mmc0 200.0MHz/8bit/8192-block
[1] mmcsd0boot0: 4MB partition 1 at mmcsd0
[1] mmcsd0boot1: 4MB partition 2 at mmcsd0
[1] mmcsd0rpmb: 524kB partition 3 at mmcsd0
[1] ada0 at ahcich0 bus 0 scbus0 target 0 lun 0
ada0: <CT1000MX500SSD4 M3CR023> ACS-3 ATA SATA 3.x device
ada0: Serial Number 1826E146E7D3
ada0: 600.000MB/s transfers (SATA 3.x, UDMA6, PIO 512bytes)
ada0: Command Queueing enabled
ada0: 953869MB (1953525168 512 byte sectors)
[1] Trying to mount root from zfs:zroot/ROOT/default []...
[2] uhub0: 16 ports with 16 removable, self powered
[2] Dual Console: Serial Primary, Video Secondary
[10] CPU: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz (1996.80-MHz K8-class CPU)
[10]   Origin="GenuineIntel"  Id=0x706a8  Family=0x6  Model=0x7a  Stepping=8
[10]   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[10]   Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[10]   AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[10]   AMD Features2=0x101<LAHF,Prefetch>
[10]   Structured Extended Features=0x2294e287<FSGSBASE,TSCADJ,SGX,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[10]   Structured Extended Features2=0x40400004<UMIP,RDPID,SGXLC>
[10]   Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
[10]   XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
[10]   IA32_ARCH_CAPS=0x14000c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
[10]   VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
[10]   TSC: P-state invariant, performance statistics
[12] igb0: link state changed to UP
[13] igb1: link state changed to UP
[14] igb2: link state changed to UP
[20] ichsmb0: <Intel Gemini Lake SMBus controller> port 0xefa0-0xefbf mem 0x9151d000-0x9151d0ff at device 31.1 on pci0
[20] smbus0: <System Management Bus> on ichsmb0
[23] lo0: link state changed to UP
[23] coretemp0: <CPU On-Die Thermal Sensors> on cpu0
[25] load_dn_sched dn_sched FIFO loaded
[25] load_dn_sched dn_sched QFQ loaded
[25] load_dn_sched dn_sched RR loaded
[25] load_dn_sched dn_sched WF2Q+ loaded
[25] load_dn_sched dn_sched PRIO loaded
[25] load_dn_sched dn_sched FQ_CODEL loaded
[25] load_dn_sched dn_sched FQ_PIE loaded
[25] load_dn_aqm dn_aqm CODEL loaded
[25] load_dn_aqm dn_aqm PIE loaded
[25] ipfw2 (+ipv6) initialized, divert loadable, nat loadable, default to accept, logging disabled
[28] vlan0: changing name to 'vlan0.2010'
[28] igb2: link state changed to DOWN
[28] vlan1: changing name to 'vlan0.2020'
[28] vlan2: changing name to 'vlan0.2030'
[28] vlan3: changing name to 'vlan0.2040'
[28] vlan4: changing name to 'vlan0.2050'
[28] vlan5: changing name to 'vlan0.2060'
[28] vlan6: changing name to 'vlan0.2070'
[30] igb0: link state changed to DOWN
[32] igb2: link state changed to UP
[32] vlan0.2040: link state changed to UP
[32] vlan0.2010: link state changed to UP
[32] vlan0.2060: link state changed to UP
[32] vlan0.2030: link state changed to UP
[32] vlan0.2050: link state changed to UP
[32] vlan0.2020: link state changed to UP
[32] vlan0.2070: link state changed to UP
[32] igb1: link state changed to DOWN
[34] igb0: link state changed to UP
[37] igb1: link state changed to UP
[43] wg0: link state changed to UP

I'm not seeing the line "CPU microcode: updated from 0x24 to 0x26" in the logs now.

root@firewall:~ # dmesg | grep microcode
root@firewall:~ #

And here is the update log from 26.7 -> 26.7.1:

***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7 (amd64) at Tue Jul 21 19:31:15 EDT 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (10 candidates): .......... done
Processing candidates (10 candidates): .......... done
The following 11 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
cpu-microcode-rc: 1.0_2 [OPNsense]

Installed packages to be UPGRADED:
ca_root_nss: 3.124 -> 3.125 [OPNsense]
freeipmi: 1.6.17 -> 1.6.18 [OPNsense]
json-c: 0.18 -> 0.19 [OPNsense]
nss: 3.124 -> 3.125 [OPNsense]
opnsense: 26.7 -> 26.7.1 [OPNsense]
os-cpu-microcode-intel: 1.1 -> 1.1_1 [OPNsense]
pciids: 20260624 -> 20260711 [OPNsense]
py313-certifi: 2026.5.20 -> 2026.6.17 [OPNsense]
py313-cryptography: 48.0.0_1,1 -> 48.0.1,1 [OPNsense]

Installed packages to be REINSTALLED:
cpu-microcode-intel-20260512_1 [OPNsense] (options changed)

Number of packages to be installed: 1
Number of packages to be upgraded: 9
Number of packages to be reinstalled: 1

37 MiB to be downloaded.
[1/11] Fetching pciids-20260711.pkg: .......... done
[2/11] Fetching nss-3.125.pkg: .......... done
[3/11] Fetching json-c-0.19.pkg: ......... done
[4/11] Fetching os-cpu-microcode-intel-1.1_1.pkg: . done
[5/11] Fetching py313-certifi-2026.6.17.pkg: ......... done
[6/11] Fetching ca_root_nss-3.125.pkg: ........ done
[7/11] Fetching py313-cryptography-48.0.1,1.pkg: .......... done
[8/11] Fetching freeipmi-1.6.18.pkg: .......... done
[9/11] Fetching cpu-microcode-rc-1.0_2.pkg: . done
[10/11] Fetching opnsense-26.7.1.pkg: .......... done
[11/11] Fetching cpu-microcode-intel-20260512_1.pkg: .......... done
Checking integrity... done (0 conflicting)
[1/11] Upgrading ca_root_nss from 3.124 to 3.125...
[1/11] Extracting ca_root_nss-3.125: ..... done
[2/11] Installing cpu-microcode-rc-1.0_2...
[2/11] Extracting cpu-microcode-rc-1.0_2: .... done
[3/11] Reinstalling cpu-microcode-intel-20260512_1...
[3/11] Extracting cpu-microcode-intel-20260512_1: .......... done
[4/11] Upgrading freeipmi from 1.6.17 to 1.6.18...
[4/11] Extracting freeipmi-1.6.18: .......... done
[5/11] Upgrading json-c from 0.18 to 0.19...
[5/11] Extracting json-c-0.19: .......... done
[6/11] Upgrading nss from 3.124 to 3.125...
[6/11] Extracting nss-3.125: .......... done
[7/11] Upgrading opnsense from 26.7 to 26.7.1...
[7/11] Extracting opnsense-26.7.1: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh.sh'
Migrated OPNsense\Trust\General from 1.0.1 to 1.0.2
Flushing all caches...done.
Writing firmware settings: OPNsense
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
[8/11] Upgrading os-cpu-microcode-intel from 1.1 to 1.1_1...
[8/11] Extracting os-cpu-microcode-intel-1.1_1: ... done
Reloading firmware configuration
Flushing all caches...done.
Writing firmware settings: OPNsense
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
[9/11] Upgrading pciids from 20260624 to 20260711...
[9/11] Extracting pciids-20260711: ..... done
[10/11] Upgrading py313-certifi from 2026.5.20 to 2026.6.17...
[10/11] Extracting py313-certifi-2026.6.17: .......... done
[11/11] Upgrading py313-cryptography from 48.0.0_1,1 to 48.0.1,1...
[11/11] Extracting py313-cryptography-48.0.1,1: .......... done
You may need to manually remove /usr/local/etc/ssl/cert.pem if it is no longer needed.
=====
Message from cpu-microcode-rc-1.0_2:

--
This port includes an RC script, which is one of two methods to update
the CPU microcode on a FreeBSD system.

1. Early loading.
   This method does not use the RC script included here.
   This is the preferred method, because it ensures that any CPU features
   added or removed by a microcode update are visible to the kernel by
   applying the update before the kernel performs CPU feature detection.

   To enable updates using early loading, add the following lines to
   /boot/loader.conf:

   cpu_microcode_load="YES"

   and the appropriate one of these lines:

   cpu_microcode_name="/boot/firmware/intel-ucode.bin"
   cpu_microcode_name="/boot/firmware/amd-ucode.bin"

   The microcode update will be loaded when the system is rebooted.

   AMD systems running FreeBSD prior to 2024-02-22 snapshot
   34467bd76 only support late loading.


2. Late loading.
   This method, which does use the RC script included here, is enabled by
   adding the following line to /etc/rc.conf:

   microcode_update_enable="YES"

   The microcode update is then applied upon reboot or when the microcode
   update service is run via:

   # service microcode_update start

   If the CPU requires a microcode update, a console message such as the
   following will appear:

   Updating CPU Microcode...
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl0 from rev 0x17 to rev 0x22... done.
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl2 from rev 0x17 to rev 0x22... done.
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl4 from rev 0x17 to rev 0x22... done.
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl6 from rev 0x17 to rev 0x22... done.
   Done.

It is safe to enable both methods.
=====
Message from opnsense-26.7.1:

--
Just a dream and the wind to carry me
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
The following package files will be deleted:
/var/cache/pkg/ca_root_nss-3.125~8725d4a9fe.pkg
/var/cache/pkg/nss-3.125~3bd727dc98.pkg
/var/cache/pkg/cpu-microcode-intel-20260512_1~ec7bd62a9e.pkg
/var/cache/pkg/opnsense-26.7.1~d7ce0a8dc3.pkg
/var/cache/pkg/x86info-1.31.s03_1.pkg
/var/cache/pkg/py313-certifi-2026.6.17.pkg
/var/cache/pkg/x86info-1.31.s03_1~109a6a1959.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1~44bb796f52.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1.pkg
/var/cache/pkg/cpu-microcode-intel-20260512_1~d3e1dc811e.pkg
/var/cache/pkg/freeipmi-1.6.18.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1_1~8ae9834ac8.pkg
/var/cache/pkg/py313-certifi-2026.6.17~58dc2bd8ba.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1_1.pkg
/var/cache/pkg/ca_root_nss-3.125.pkg
/var/cache/pkg/libpci-3.15.0~d1b99100f6.pkg
/var/cache/pkg/cpu-microcode-intel-20260512_1.pkg
/var/cache/pkg/pciids-20260711.pkg
/var/cache/pkg/pciids-20260711~34ad3f8084.pkg
/var/cache/pkg/libpci-3.15.0.pkg
/var/cache/pkg/pciids-20260624.pkg
/var/cache/pkg/pciids-20260624~b510601872.pkg
/var/cache/pkg/opnsense-26.7.1.pkg
/var/cache/pkg/json-c-0.19~0011d31480.pkg
/var/cache/pkg/freeipmi-1.6.18~dc301d55f9.pkg
/var/cache/pkg/cpu-microcode-rc-1.0_2~e75ff3975e.pkg
/var/cache/pkg/cpu-microcode-rc-1.0_2.pkg
/var/cache/pkg/nano-9.0~df3c54c509.pkg
/var/cache/pkg/py313-cryptography-48.0.1,1.pkg
/var/cache/pkg/nss-3.125.pkg
/var/cache/pkg/json-c-0.19.pkg
/var/cache/pkg/py313-cryptography-48.0.1,1~b6c2f86624.pkg
/var/cache/pkg/nano-9.0.pkg
The cleanup will free 63 MiB
Deleting files: .......... done
Nothing to do.
Flushing temporary package files... done
Starting web GUI...done.
***DONE***


The new 26.7.1 ucode package performs late loading, now. That was the hole point of this thread.

@Patrick, yes, I understand.  I think I should still see the line which loads the ucode update though, no?

Before the upgrade it was updating the ucode from 0x24 to 0x26 (early).

After the upgrade it's loading late, but not actually updating the ucode.

Did I misunderstand the logs?

I installed the microcode-develop following the procedure in this thread. Today I installed the OPNsense 26.7.1 update. Is this enough to make it permanent or should I (de)install packages?

In the firmware - plugins is shown 1.1_1 os-cpu-microcode-intel-devel (misconfigured)
In the firmware - packages is shown cpu-microcode-intel 20260512_1, cpu-microcode-rc 1.0.2 and os-cpu-microcode-intel-devel 1.1_1

Deinstall the packages you installed manually, then install the plugin from the UI. This is to get the packages recorded as a dependency instead of directly installed.

Quote from: OPNenthu on July 22, 2026, 08:21:39 AMBefore the upgrade it was updating the ucode from 0x24 to 0x26 (early).

After the upgrade it's loading late, but not actually updating the ucode.

Any error message when you invoke the script manually?

/usr/local/etc/rc.syshook.d/early/40-cpu-microcode
dmesg


I'm a little confused after reading this thread as I am currently running 26.1.11_10 with the os-cpu-microcode-intel v1.1 plugin and have held off updating to 26.7

To help me fully understand the current recommendation, can you please confirm that if I want to update to 26.7.1 I need to perform the following:

• create a snapshot just in case
• uninstall the os-cpu-microcode-intel plugin
• update to 26.7.1
• reinstall the os-cpu-microcode-intel plugin

One option, yes.

Second option:

- uninstall os-cpu-microcode-* plugin
- upgrade to 26.7
- update your boot loader
- imstall 26.7.1, os-cpu-microcode-*, whatever ...

The underlying issue is booting 26.7 and the plugin version that comes with it with an older boot loader. Updating the boot loader fixes that. Additionally the plugin in 26.7.1 has a workaround (which I am not entirely happy with, now that the root cause has been identified and fixed).

Quote from: Patrick M. Hausen on July 22, 2026, 10:04:45 AM

Quote from: OPNenthu on July 22, 2026, 08:21:39 AMBefore the upgrade it was updating the ucode from 0x24 to 0x26 (early).

After the upgrade it's loading late, but not actually updating the ucode.

Any error message when you invoke the script manually?

Code Select Expand

/usr/local/etc/rc.syshook.d/early/40-cpu-microcode
dmesg


No, looks like a clean run.

Just doesn't report that any ucode update is applied, but clearly there should be one as per the previously installed ucode package.

root@firewall:~ # /usr/local/etc/rc.syshook.d/early/40-cpu-microcode
Updating CPU Microcode...
Done.

root@firewall:~ # dmesg
---<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(vga): resolution 640x480
[1] CPU: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz (1996.80-MHz K8-class CPU)
[1]   Origin="GenuineIntel"  Id=0x706a8  Family=0x6  Model=0x7a  Stepping=8
[1]   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[1]   Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[1]   AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[1]   AMD Features2=0x101<LAHF,Prefetch>
[1]   Structured Extended Features=0x2294e287<FSGSBASE,TSCADJ,SGX,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[1]   Structured Extended Features2=0x40400004<UMIP,RDPID,SGXLC>
[1]   Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
[1]   XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
[1]   IA32_ARCH_CAPS=0x14000c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
[1]   VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
[1]   TSC: P-state invariant, performance statistics
[1] real memory  = 8589934592 (8192 MB)
[1] avail memory = 7859204096 (7495 MB)
[1] Event timer "LAPIC" quality 600
[1] ACPI APIC Table: <COREv4 COREBOOT>
[1] WARNING: L1 data cache covers fewer APIC IDs than a core (0 < 1)
[1] FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
[1] FreeBSD/SMP: 1 package(s) x 4 core(s)
[1] random: registering fast source Intel Secure Key Seed
[1] random: fast provider: "Intel Secure Key Seed"
[1] random: unblocking device.
[1] ioapic0 <Version 2.0> irqs 0-119
[1] Launching APs: 2 3 1
[1] random: entropy device external interface
[1] wlan: mac acl policy registered
[1] kbd0 at kbdmux0
[1] WARNING: Device "spkr" is Giant locked and may be deleted before FreeBSD 16.0.
[1] efirtc0: <EFI Realtime Clock>
[1] efirtc0: registered as a time-of-day clock, resolution 1.000000s
[1] smbios0: <System Management BIOS> at iomem 0x69533000-0x69533017
[1] smbios0: Entry point: v3 (64-bit), Version: 3.3
[1] aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256>
[1] acpi0: <COREv4 COREBOOT>
[1] acpi0: Power Button (fixed)
[1] hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
[1] Timecounter "HPET" frequency 19200000 Hz quality 950
[1] Event timer "HPET" frequency 19200000 Hz quality 550
[1] Event timer "HPET1" frequency 19200000 Hz quality 440
[1] Event timer "HPET2" frequency 19200000 Hz quality 440
[1] Event timer "HPET3" frequency 19200000 Hz quality 440
[1] Event timer "HPET4" frequency 19200000 Hz quality 440
[1] atrtc0: <AT realtime clock> port 0x70-0x77 on acpi0
[1] atrtc0: registered as a time-of-day clock, resolution 1.000000s
[1] Event timer "RTC" frequency 32768 Hz quality 0
[1] attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
[1] Timecounter "i8254" frequency 1193182 Hz quality 0
[1] Event timer "i8254" frequency 1193182 Hz quality 100
[1] Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
[1] acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0
[1] pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
[1] pci0: <ACPI PCI bus> on pcib0
[1] vgapci0: <VGA-compatible display> port 0x5000-0x503f mem 0x90000000-0x90ffffff,0x80000000-0x8fffffff at device 2.0 on pci0
[1] vgapci0: Boot video device
[1] hdac0: <Intel Gemini Lake HDA Controller> mem 0x91510000-0x91513fff,0x91000000-0x910fffff at device 14.0 on pci0
[1] pci0: <simple comms> at device 15.0 (no driver attached)
[1] ahci0: <Intel Gemini Lake AHCI SATA controller> port 0x5060-0x5067,0x5068-0x506b,0x5040-0x505f mem 0x91514000-0x91515fff,0x9151c000-0x9151c0ff,0x9151b000-0x9151b7ff at device 18.0 on pci0
[1] ahci0: AHCI v1.31 with 2 6Gbps ports, Port Multiplier supported
[1] ahcich0: <AHCI channel> at channel 0 on ahci0
[1] ahcich1: <AHCI channel> at channel 1 on ahci0
[1] pcib1: <ACPI PCI-PCI bridge> at device 19.0 on pci0
[1] pci1: <ACPI PCI bus> on pcib1
[1] igb0: <Intel(R) I210 Flashless (Copper)> port 0x1000-0x101f mem 0x91100000-0x9111ffff,0x91120000-0x91123fff at device 0.0 on pci1
[1] igb0: NVM V0.6 imgtype6
[1] igb0: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb0: Using 4 RX queues 4 TX queues
[1] igb0: Using MSI-X interrupts with 5 vectors
[1] igb0: Ethernet address: <redacted>
[1] igb0: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib2: <PCI-PCI bridge> at device 19.1 on pci0
[1] pci2: <PCI bus> on pcib2
[1] igb1: <Intel(R) I210 Flashless (Copper)> port 0x2000-0x201f mem 0x91200000-0x9121ffff,0x91220000-0x91223fff at device 0.0 on pci2
[1] igb1: NVM V0.6 imgtype6
[1] igb1: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb1: Using 4 RX queues 4 TX queues
[1] igb1: Using MSI-X interrupts with 5 vectors
[1] igb1: Ethernet address: <redacted>
[1] igb1: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib3: <PCI-PCI bridge> at device 19.2 on pci0
[1] pci3: <PCI bus> on pcib3
[1] igb2: <Intel(R) I210 Flashless (Copper)> port 0x3000-0x301f mem 0x91300000-0x9131ffff,0x91320000-0x91323fff at device 0.0 on pci3
[1] igb2: NVM V0.6 imgtype6
[1] igb2: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb2: Using 4 RX queues 4 TX queues
[1] igb2: Using MSI-X interrupts with 5 vectors
[1] igb2: Ethernet address: <redacted>
[1] igb2: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib4: <PCI-PCI bridge> at device 19.3 on pci0
[1] pci4: <PCI bus> on pcib4
[1] pcib5: <PCI-PCI bridge> at device 0.0 on pci4
[1] pci5: <PCI bus> on pcib5
[1] pcib6: <PCI-PCI bridge> at device 1.0 on pci5
[1] pci6: <PCI bus> on pcib6
[1] igb3: <Intel(R) I210 Flashless (Copper)> port 0x4000-0x401f mem 0x91400000-0x9141ffff,0x91420000-0x91423fff at device 0.0 on pci6
[1] igb3: NVM V0.6 imgtype6
[1] igb3: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb3: Using 4 RX queues 4 TX queues
[1] igb3: Using MSI-X interrupts with 5 vectors
[1] igb3: Ethernet address: <redacted>
[1] igb3: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib7: <PCI-PCI bridge> at device 3.0 on pci5
[1] pci7: <PCI bus> on pcib7
[1] pcib8: <PCI-PCI bridge> at device 5.0 on pci5
[1] pci8: <PCI bus> on pcib8
[1] pcib9: <PCI-PCI bridge> at device 7.0 on pci5
[1] pci9: <PCI bus> on pcib9
[1] xhci0: <Intel Gemini Lake USB 3.0 controller> mem 0x91500000-0x9150ffff at device 21.0 on pci0
[1] xhci0: 32 bytes context size, 64-bit DMA
[1] xhci0: xECP capabilities <PROTO,PROTO,VEND(c0),LEGACY,VEND(c6),VEND(c7),VEND(c2),DEBUG,VEND(c3),VEND(c4),VEND(c5),VEND(c8),VEND(c9),VEND(cb)>
[1] usbus0 on xhci0
[1] usbus0: 5.0Gbps Super Speed USB v3.0
[1] sdhci_pci0: <Generic SD HCI> mem 0x91519000-0x91519fff,0x9151a000-0x9151afff at device 28.0 on pci0
[1] sdhci_pci0: 1 slot(s) allocated
[1] mmc0: <MMC/SD bus> on sdhci_pci0
[1] isab0: <PCI-ISA bridge> at device 31.0 on pci0
[1] isa0: <ISA bus> on isab0
[1] acpi_button0: <Sleep Button> on acpi0
[1] cpu0: <ACPI CPU> on acpi0
[1] uart: ns8250: UART FCR is broken (0x1)
[1] uart0: <16550 or compatible> at port 0x3f8 irq 4 flags 0x10 on isa0
[1] uart0: console (115200,n,8,1)
[1] est0: <Enhanced SpeedStep Frequency Control> on cpu0
[1] cpufreq0: <CPU frequency control> on cpu0
[1] cpufreq1: <CPU frequency control> on cpu1
[1] cpufreq2: <CPU frequency control> on cpu2
[1] cpufreq3: <CPU frequency control> on cpu3
[1] Timecounter "TSC" frequency 1996800733 Hz quality 1000
[1] Timecounters tick every 1.000 msec
[1] ugen0.1: <Intel XHCI root HUB> at usbus0
[1] uhub0 on usbus0
[1] uhub0: <Intel XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
[1] ZFS filesystem version: 5
[1] ZFS storage pool version: features support (5000)
[1] hdacc0: <Intel Gemini Lake HDA CODEC> at cad 2 on hdac0
[1] hdaa0: <Intel Gemini Lake Audio Function Group> at nid 1 on hdacc0
[1] pcm0: <Intel Gemini Lake (HDMI/DP 8ch)> at nid 3 on hdaa0
[1] mmcsd0: 8GB <MMCHC 8GTF4R 0.6 SN 115AE8FD MFG 02/2023 by 21 0x0000> at mmc0 200.0MHz/8bit/8192-block
[1] mmcsd0boot0: 4MB partition 1 at mmcsd0
[1] mmcsd0boot1: 4MB partition 2 at mmcsd0
[1] mmcsd0rpmb: 524kB partition 3 at mmcsd0
[1] ada0 at ahcich0 bus 0 scbus0 target 0 lun 0
ada0: <CT1000MX500SSD4 M3CR023> ACS-3 ATA SATA 3.x device
ada0: Serial Number 1826E146E7D3
ada0: 600.000MB/s transfers (SATA 3.x, UDMA6, PIO 512bytes)
ada0: Command Queueing enabled
ada0: 953869MB (1953525168 512 byte sectors)
[1] Trying to mount root from zfs:zroot/ROOT/default []...
[2] uhub0: 16 ports with 16 removable, self powered
[2] Dual Console: Serial Primary, Video Secondary
[10] CPU: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz (1996.80-MHz K8-class CPU)
[10]   Origin="GenuineIntel"  Id=0x706a8  Family=0x6  Model=0x7a  Stepping=8
[10]   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[10]   Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[10]   AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[10]   AMD Features2=0x101<LAHF,Prefetch>
[10]   Structured Extended Features=0x2294e287<FSGSBASE,TSCADJ,SGX,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[10]   Structured Extended Features2=0x40400004<UMIP,RDPID,SGXLC>
[10]   Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
[10]   XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
[10]   IA32_ARCH_CAPS=0x14000c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
[10]   VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
[10]   TSC: P-state invariant, performance statistics
[12] igb0: link state changed to UP
[13] igb1: link state changed to UP
[14] igb2: link state changed to UP
[20] ichsmb0: <Intel Gemini Lake SMBus controller> port 0xefa0-0xefbf mem 0x9151d000-0x9151d0ff at device 31.1 on pci0
[20] smbus0: <System Management Bus> on ichsmb0
[22] lo0: link state changed to UP
[22] coretemp0: <CPU On-Die Thermal Sensors> on cpu0
[25] load_dn_sched dn_sched FIFO loaded
[25] load_dn_sched dn_sched QFQ loaded
[25] load_dn_sched dn_sched RR loaded
[25] load_dn_sched dn_sched WF2Q+ loaded
[25] load_dn_sched dn_sched PRIO loaded
[25] load_dn_sched dn_sched FQ_CODEL loaded
[25] load_dn_sched dn_sched FQ_PIE loaded
[25] load_dn_aqm dn_aqm CODEL loaded
[25] load_dn_aqm dn_aqm PIE loaded
[25] ipfw2 (+ipv6) initialized, divert loadable, nat loadable, default to accept, logging disabled
[28] vlan0: changing name to 'vlan0.2010'
[28] igb2: link state changed to DOWN
[28] vlan1: changing name to 'vlan0.2020'
[28] vlan2: changing name to 'vlan0.2030'
[28] vlan3: changing name to 'vlan0.2040'
[28] vlan4: changing name to 'vlan0.2050'
[28] vlan5: changing name to 'vlan0.2060'
[28] vlan6: changing name to 'vlan0.2070'
[30] igb0: link state changed to DOWN
[32] igb2: link state changed to UP
[32] vlan0.2040: link state changed to UP
[32] vlan0.2010: link state changed to UP
[32] vlan0.2060: link state changed to UP
[32] vlan0.2030: link state changed to UP
[32] vlan0.2050: link state changed to UP
[32] vlan0.2020: link state changed to UP
[32] vlan0.2070: link state changed to UP
[32] igb1: link state changed to DOWN
[34] igb0: link state changed to UP
[36] igb1: link state changed to UP
[43] wg0: link state changed to UP
[6299] CPU: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz (1996.80-MHz K8-class CPU)
[6299]   Origin="GenuineIntel"  Id=0x706a8  Family=0x6  Model=0x7a  Stepping=8
[6299]   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[6299]   Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[6299]   AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[6299]   AMD Features2=0x101<LAHF,Prefetch>
[6299]   Structured Extended Features=0x2294e287<FSGSBASE,TSCADJ,SGX,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[6299]   Structured Extended Features2=0x40400004<UMIP,RDPID,SGXLC>
[6299]   Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
[6299]   XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
[6299]   IA32_ARCH_CAPS=0x14000c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
[6299]   VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
[6299]   TSC: P-state invariant, performance statistics


Thank you Patrick,

Re your second option, if the three files /boot/loader.efi /boot/efi/efi/boot/bootx64.efi /boot/efi/efi/freebsd/loader.efi are identical in size, can I assume there's no need to update the boot loader?

With the updated boot loader in place you can enable early loading if you like. Add two tunables following

https://github.com/opnsense/plugins/blob/ac68d4ef08fbd7aed966f41daec3c443673dc533/sysutils/cpu-microcode/src/etc/rc.loader.d/40-cpu-microcode.in

Quote from: vk2him on July 22, 2026, 10:34:35 AMThank you Patrick,

Re your second option, if the three files

Code Select Expand

/boot/loader.efi /boot/efi/efi/boot/bootx64.efi /boot/efi/efi/freebsd/loader.efi are identical in size, can I assume there's no need to update the boot loader?

Are they AFTER you upgraded to 26.7? I doubt that. You need to update the boot loader with the version that comes with FreeBSD 15.1 which is only present as /boot/loader.efi after the upgrade.

Second size doesn't say anything about the content. Try "cmp" to check if the files are identical. Or simply copy /boot/loader.efi over the two other ones - won't hurt.

@Patrick, I got this command from ChatGPT.  It looks like the loaded ucode is 0x26, which is the updated version.  So the late loading is working even though it doesn't print anything was applied in dmesg.

Maybe it's simply a logging bug then and not a functional one.

root@firewall:~ # cpucontrol -m 0x8b /dev/cpuctl0
MSR 0x8b: 0x00000026 0x00000000

JFYI

Quote from: bamf on July 21, 2026, 08:24:07 PMI was assuming choosing a ZFS mirror in the OPNsense installer creates a fully redundant setup where all drives are bootable.

Quote from: Patrick M. Hausen on July 21, 2026, 08:44:18 PMYeah ... *sigh* ... the whole situation leaves a bit to be desired. But that's a FreeBSD problem, not an OPNsense one. I will work on getting this improved but as participation in open source projects goes - no promises, sorry.

Quick FYI :

Linux has the same issue when using MDM Software RAID and you have to manually make sure GRUB is installed on both disks.

I had a lot of customers in the past who wrongly assumed the same thing sadly, so the wrong disk gone = the OS gone too! :(

It seems my system does not load any microcode on boot after the update?

root@OPNsense:/var/log/system # dmesg | grep -i -E "microcode|cpu0"
[1] cpu0: <ACPI CPU> on acpi0
[1] est0: <Enhanced SpeedStep Frequency Control> on cpu0
[1] cpufreq0: <CPU frequency control> on cpu0
[119] coretemp0: <CPU On-Die Thermal Sensors> on cpu0
Do I need to edit loader.conf?

root@OPNsense:/var/log/system # grep microcode /boot/loader.conf
# tries to load microcode updates.
# cpu_microcode_load="YES"
# cpu_microcode_name="/boot/firmware/intel-ucode.bin"

See post #69.

How do I know if it's the updated version?

root@OPNsense:/var/log/system # cpucontrol -m 0x8b /dev/cpuctl0
MSR 0x8b: 0x0000003e 0x00000000
root@OPNsense:/var/log/system # dmesg | grep -i "CPU:"
[1] CPU: Intel(R) Atom(TM) CPU C3808 @ 2.00GHz (2000.44-MHz K8-class CPU)
[38] CPU: Intel(R) Atom(TM) CPU C3808 @ 2.00GHz (2000.00-MHz K8-class CPU)
EDIT:

Ok found this https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/main/releasenote.md

DNV    B0    06-5f-01/01    00000038    0000003e    Atom C Series

So probably 0x0000003e is the most recent microcode.

A few observations:

1. The new late loading scheme does not leave any traces in dmesg, even if it did update the CPU microcode. You can check with cpucontrol instead.
2. dmesg can show multiple boot logs, so if you only grep in its output, you cannot be sure which previous boot it was in. You would need something like this to grep only the last boot:

dmesg | awk '/---<<BOOT>>---/{boot=""} {boot=boot $0 "\n"} END{print boot}' | fgrep microcode

3. After having upgraded your boot files, you may use early loading again by adding these tuneables via System:Settings:Tunables (for Intel CPUs):

cpu_microcode_load = YES
cpu_microcode_name = /boot/firmware/intel-ucode.bin


Quote from: meyergru on July 23, 2026, 12:39:47 PM3. After having upgraded your boot files, you may use early loading again by adding these tuneables via System:Settings:Tunables (for Intel CPUs):

Thank you, that was the missing piece.

root@OPNsense:~ # dmesg | awk '/---<<BOOT>>---/{boot=""} {boot=boot $0 "\n"} END{print boot}' | fgrep microcode
[1] CPU microcode: updated from 0x24 to 0x3e

Hello,

just to recap, these are the steps in the correct order:

• uninstall os-cpu-microcode-* plugin
• upgrade to 26.7.1
• update your boot loader
• install 26.7.1, os-cpu-microcode-* plugin

My OPNsense version is: 26.1.11_10 and bootloader is:
DFreeBSD/amd64 EFI loader, Revision 3.0

Now the question is: what are the exact steps to update the bootloader?

Thank you

Again: See post #37 (https://forum.opnsense.org/index.php?msg=271117) or use the forum search.

Ok I follow this steps:

1. Check bootloader version:

root@firewall:~ # strings /boot/efi/efi/boot/bootx64.efi | grep "Revision"
DFreeBSD/amd64 EFI loader, Revision 3.0

2. Show partition with fstab and be careful to /dev/ada0p3:

root@firewall:~ # cat /etc/fstab
# Device                Mountpoint      FStype  Options         Dump    Pass#
/dev/gpt/efiboot0               /boot/efi       msdosfs rw              2       2
/dev/ada0p3             none    swap    sw              0       0

3. Show Partition:
root@firewall:~ # gpart show
=>       40  488397088  nda0  GPT  (233G)
         40     532480     1  efi  (260M)
     532520       1024     2  freebsd-boot  (512K)
     533544        984        - free -  (492K)
     534528   16777216     3  freebsd-swap  (8.0G)
   17311744  471085056     4  freebsd-zfs  (225G)
  488396800        328        - free -  (164K)

4. Uninstall os-cpu-microcode-* plugin

5. Reboot

6. upgrade to 26.7.1_1

7. Update bootloader:

root@firewall:~ # mkdir -p /boot/efi/efi/boot /boot/efi/efi/freebsd
root@firewall:~ # cp /boot/loader.efi /boot/efi/efi/boot/bootx64.efi
root@firewall:~ # cp /boot/loader.efi /boot/efi/efi/freebsd/loader.efi
root@firewall:~ # gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 2 ada0
partcode written to ada0p2
bootcode written to ada0
root@firewall:~ #


8. Reboot

9. Install os-cpu-microcode-* plugin


Now, do I have to ad the following lines to /boot/loader.conf before reboot?

cpu_microcode_load="YES"
cpu_microcode_name="/boot/firmware/intel-ucode.bin"

Thank you

You do not need to add these lines, you are safe to reboot. The OS then uses late loading of microcode.

These lines are intended to enable early loading of the microcode which is preferred over late loading as the kernel then loads with the already updated microcode. So if you followed all steps, which you seemingly did, you should be fine to enable early loading.

loader.conf.local - loader.conf will be overwritten by UI actions.

Or better: Use the UI. Add the lines as Tunables under System: Settings: Tunables.

Hi all!
this by:
1.-uninstall CPU-Microcode
2.-Upgrade to 26.7.1
3.-Update Boot Loader
4.-Install CPU- Microcode
Do we always have to do this when updating to ver. 26.7.1 or will there be a new version of OPNsense that will work without all the above steps?
Best regards!
//Hugo

You can skip the boot loader update because OPNsense shipped a workaround in 26.7.1 by late loading of the ucode update.

But if you want to use early loading via loader.conf.local you must update the boot loader first.

Abd yes, the ucode update plugin must be uninstalled before rebooting any system with a boot loader older than 26.7 but 26.7  now active because of an OPNsense update.

How many more times do I need to repeat this? 😉

Quote from: Patrick M. Hausen on August 09, 2026, 03:56:53 PMHow many more times do I need to repeat this?

#JustPeopleOnTheInternetTheseDays... 😉

Nothing we can do about it sadly :(