Call for testers - new CPU microcode update plugins

[Patrick M. Hausen]

Hi all,

apparently some (not a majority, but enough for this to be a problem) users are hit by a race condition in the FreeBSD kernel which leads to the system locking up at booting when the microcode update plugin is installed. The specific point here is that the ucode updates are loaded "early" by the standard plugin which means before regular kernel startup.

The FreeBSD package alternatively allows for "late" loading of the ucode updates. This is considered non-optimal, because CPU features might change after the kernel is started and detection of said features has happened.
Yet personally for more than 8 years since ucode updates became a thing I have never seen a problem with late loading. It simply means the kernel boot process and startup of some services will happen with an unpatched CPU, then the updates will be applied with the system up and running.

Specifically the people who experience the boot time lockups with the plugin installed - if you can afford some downtime and a couple of reboots, please try this and report back.

1. Uninstall the os-cpu-microcode-amd from the UI. You probably did this already, if you are running 26.7 and you were hit by this problem.

2. For Intel systems:

Code Select Expand

pkg install x86info
pkg install cpu-microcode-intel
pkg add -f https://pkg.opnsense.org/FreeBSD:15:amd64/snapshots/misc/os-cpu-microcode-intel-devel-1.1_1.pkg

For AMD systems:

Code Select Expand

pkg install x86info
pkg install cpu-microcode-amd
pkg add -f https://pkg.opnsense.org/FreeBSD:15:amd64/snapshots/misc/os-cpu-microcode-amd-devel-1.1_1.pkg

3. Reboot your system. You should be able to observe the late application of the ucode updates in /var/run/dmesg.boot after the reboot.

Thanks and kind regards,
Patrick

[Igor]

Done:

Code Select Expand

--<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(efifb): resolution 800x600
[1] CPU microcode: updated from 0x10 to 0x21
[1] CPU: Intel(R) N100 (806.40-MHz K8-class CPU)
[1]  Origin="GenuineIntel"  Id=0xb06e0  Family=0x6  Model=0xbe  Stepping=0
[1]  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
--
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(efifb): resolution 800x600
[1] WARNING: sysctl vfs.zfs.arc_max is deprecated. Use vfs.zfs.arc.max instead.
[1] CPU microcode: updated from 0x10 to 0x21
[1] CPU: Intel(R) N100 (806.40-MHz K8-class CPU)
[1]  Origin="GenuineIntel"  Id=0xb06e0  Family=0x6  Model=0xbe  Stepping=0
[1]  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>


[db9]

I followed the pkg steps and rebooted the system. No microcode messages in /var/run/dmesg.boot after boot after seconds or minutes.

=====
Message from x86info-1.31.s03_1:
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

Abandoned upstream, fails to identify anything remotely new according to upstrea                                                                                     m issue reports.

It is scheduled to be removed on or after 2025-06-30.

=====
Message from cpu-microcode-intel-20260512_1:

--
To enable microcode updates at boot time:
cat << EOF >> /boot/loader.conf
cpu_microcode_load="YES"
cpu_microcode_name="/boot/firmware/intel-ucode.bin"
EOF


-----

A bit early to ask, but what will be the step to have this converted to the final production version of the package?