Intel ucode Plugin vs Package

[dseven]

Why is a plugin needed to get the ucode.bin into loader? That makes no sense to me.

If you install the package on FreeBSD, there is a manual step required to effect loading of the microcode on boot - specifically adding lines to the loader configuration. The plugin does this for you, as well as installing the microcode package and the utilities required to support it.

OPNsense is (I believe) attempting to be a firewall appliance. In an ideal world, you wouldn't even know that it's FreeBSD under the covers, much less be mucking around in a shell. Everything required to operate a firewall should be manageable through the UI. The world we live in is not quite ideal, of course, but that's still the aim (I think).

Side-note: stock FreeBSD 14.3 currently installs Intel microcode version 20260227 too...

Code Select Expand

root@fbvm1:~ # pkg install cpu-microcode-intel
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
Updating FreeBSD-kmods repository catalogue...
FreeBSD-kmods repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        cpu-microcode-intel: 20260227 [FreeBSD]

Number of packages to be installed: 1

The process will require 30 MiB more space.
25 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/1] Fetching cpu-microcode-intel-20260227: 100%    25 MiB   8.9 MB/s    00:03
Checking integrity... done (0 conflicting)
[1/1] Installing cpu-microcode-intel-20260227...
[1/1] Extracting cpu-microcode-intel-20260227: 100%
=====
Message from cpu-microcode-intel-20260227:

--
To enable microcode updates at boot time:
cat << EOF >> /boot/loader.conf
cpu_microcode_load="YES"
cpu_microcode_name="/boot/firmware/intel-ucode.bin"
EOF
root@fbvm1:~ #


[BrandyWine]

If you install the package on FreeBSD, there is a manual step required to effect loading of the microcode on boot.

Side-note: stock FreeBSD 14.3 currently installs Intel microcode version 20260227 too..

OPNsense is an installer. No manual step needed. Just sayin.

It (std freeBSD ucode pkg) can be activated during the install, or, the package can be there installed but the option for user to activate it can be a checkbox in the webgui, and handled via .py. ;)

There's no need to have an additional pkg installed ("plugin") if cpucontrol handles ucode.bin.

What comes with the OPNsense installer is what they bundle into the installer. Having the ucode packages there makes sense to me.