have you updated your os-cpu-microcode for your select processor?

[DEC670airp414user]

https://forum.opnsense.org/index.php?topic=42355.msg209137#msg209137

its been available for almost a month.

I just updated my AMD Dec670.  so far no issues after the reboot. 

[julsssark]

Yes, on my Protectli FW4B with Intel Celeron J3160. No problems.

[nodakbarnes]

Yes, working fine on Protectli FW2B with Intel Celeron J3060.

[computeralex92]

I used the microcode-package before the official plugin, no problems so far with both options.

CPU: Intel N100

[troplin]

I also installed it without problems but I‘m not sure I understand how the plugin works exactly. Is it a one-time installation or does it keep installing microcode updates in the future?

Also, is there a way to find out if there was actually something installed? As far as I can tell, there’s a single plugin for all intel CPUs, how do I know if it applies to my specific model?

[computeralex92]

I also installed it without problems but I‘m not sure I understand how the plugin works exactly. Is it a one-time installation or does it keep installing microcode updates in the future?

Also, is there a way to find out if there was actually something installed? As far as I can tell, there’s a single plugin for all intel CPUs, how do I know if it applies to my specific model?

The Plug-In installs basically the FreeBSD microcode package (specific for intel or AMD CPUs) and setup some config.
Therefore, with every reboot the update will be applied if for the used CPU there is an update included.

You can check if there was an update applied if you connect via SSH and run the dmesg command.
Quite early in the output there is a line saying “Microcode was updated from x to y”.

And no, there is no further maintenance etc. needed, because if there is a newer microcode package merged from FreeBSD base, you will get it with the next opnsense update.
After that, automatically the next reboot use a maybe included newer microcode.

And btw.: as long you want to use the newer microcode, you need to have the plugin installed.
As usual, this microcode plugin is only able to update the CPU on runtime, so no permanent update within the CPU is happening (only a BIOS update can do that)

[troplin]

Oh wow thanks a lot for the detailed answer, that clears it up. Especially the last paragraph.

Not being familiar with FreeBSD in general I just assumed it was a permanent update and it didn’t even cross my mind that it could work the way it does.
I might even have removed it at some point in the future not knowing that this would undo it completely.

This might be common knowledge but I think it wouldn’t hurt to add a short explanation to the plugin description @franco

[franco]

If anything is missing from https://docs.opnsense.org/manual/cpu-microcode.html that might be good to add.


Cheers,
Franco

[vk2him]

Yes, working fine on Protectli FW2B with Intel Celeron J3060.

I have a Protectli VP2410 with a Intel Celeron J4125 - which os-cpu-microcode should I select as the OPNsense version architecture is AMD64 while it has Intel CPU? Thanks

[Seimus]

Yes, working fine on Protectli FW2B with Intel Celeron J3060.

I have a Protectli VP2410 with a Intel Celeron J4125 - which os-cpu-microcode should I select as the OPNsense version architecture is AMD64 while it has Intel CPU? Thanks

Its per CPU as written, yours is Intel so the Intel os-cpu-microcode-intel.

Regards,
S.

[kevindd992002]

Is this microcode update beneficial if opnsense is running on a proxmox vm?

[Patrick M. Hausen]

On the Proxmoxhost? Probably. You cannot update the CPU microcode from a VM.

[kevindd992002]

No, I mean from the plugins page in opnsense that's on a proxmox vm. So that's a no then. I have the microcode updated on the host already.

[Patrick M. Hausen]

The microcode update updates the microcode in the processor hardware itself. That does not make sense in a VM at all. The VM does not have access to the CPU. Only the hypervisor host does.

[kevindd992002]

Got it. Thanks.