Call for testers - new CPU microcode update plugins

[OPNenthu]

It's good that this will be taken to the FreeBSD maintainers as feedback because although the actual commands to update the bootloader are simple, arriving at the correct ones requires some arcane knowledge.  It's not well documented.  The FreeBSD handbook has barely one sentence about it and links out to various man pages.  Good luck to any beginners.

[Patrick M. Hausen]

In case you are interested in all the details: https://klarasystems.com/articles/the-freebsd-boot-process/

Don't miss the "Additional Resources" section ;-)

[bamf]

I don't really get it yet. Do I need to do something before I upgrade?

Code Select Expand

root@OPNsense:~ # zpool status
  pool: zroot
 state: ONLINE
  scan: scrub repaired 0B in 00:10:32 with 0 errors on Sun Nov 23 00:59:47 2025
config:

        NAME        STATE     READ WRITE CKSUM
        zroot       ONLINE       0     0     0
          mirror-0  ONLINE       0     0     0
            nda0p4  ONLINE       0     0     0
            nda1p4  ONLINE       0     0     0

errors: No known data errors

Code Select Expand

root@OPNsense:~ # file /boot/loader.efi
/boot/loader.efi: PE32+ executable for EFI (application), x86-64, 10 sections

root@OPNsense:~ # md5sum /boot/loader.efi
2f8e91724d3927826909c128c27efa16  /boot/loader.efi

root@OPNsense:~ # file /boot/efi/efi/boot/bootx64.efi
/boot/efi/efi/boot/bootx64.efi: PE32+ executable for EFI (application), x86-64, 10 sections

root@OPNsense:~ # md5sum /boot/efi/efi/boot/bootx64.efi
18ccc82fd9eeaa815f0ff1194dd36b4a  /boot/efi/efi/boot/bootx64.efi

root@OPNsense:~ # file /boot/efi/efi/freebsd/loader.efi
/boot/efi/efi/freebsd/loader.efi: PE32+ executable for EFI (application), x86-64, 10 sections

root@OPNsense:~ # md5sum /boot/efi/efi/freebsd/loader.efi
18ccc82fd9eeaa815f0ff1194dd36b4a  /boot/efi/efi/freebsd/loader.efi

root@OPNsense:~ # strings /boot/efi/efi/boot/bootx64.efi | grep -i "FreeBSD"
FreeBSD vinum
FreeBSD boot
freebsd
FreeBSD UFS
Can't fetch FreeBSD::%s we know is there
freebsd:nvstore
/efi/freebsd/loader.env
FreeBSD Loader
FreeBSD
freebsd:bootonce
FreeBSD ZFS
Can't allocate %d bytes to fetch FreeBSD::%s env var
No FreeBSD kernel provided, aborting
FreeBSD swap
org.freebsd:zstd_compress
DFreeBSD/amd64 EFI loader, Revision 1.1

root@OPNsense:~ # strings /boot/loader.efi | grep -i "FreeBSD"
FreeBSD vinum
FreeBSD boot
freebsd
FreeBSD UFS
Can't fetch FreeBSD::%s we know is there
freebsd:nvstore
/efi/freebsd/loader.env
FreeBSD Loader
FreeBSD
freebsd:bootonce
FreeBSD ZFS
Can't allocate %d bytes to fetch FreeBSD::%s env var
No FreeBSD kernel provided, aborting
FreeBSD swap
org.freebsd:zstd_compress
DFreeBSD/amd64 EFI loader, Revision 3.0

[Patrick M. Hausen]

Do you have one of the os-cpu-microcode-* plugins installed? If yes, you should

- uninstall it
- then perform the upgrade to 27.6
- then after the upgrade update your boot loader
- then reinstall the plugin

[bamf]

And how exactly do I update the bootloader on both mirror disks?

[meyergru]

Look back to post #37 if you do not want to use the forum search.

[nero355]

And how exactly do I update the bootloader on both mirror disks?

Look back to post #37 if you do not want to use the forum search.

Why not quote https://forum.opnsense.org/index.php?topic=48145.msg243083#msg243083 here too ?!

=>

@Sinister Pisces - this applies to your partition layout and device names.
@tessus - if yours are identical, go ahead. If not, please post your fstab and partition table, too.

Update EFI boot loader - the partition is mounted, already, so that's easy.

Code Select Expand

mkdir -p /boot/efi/efi/boot /boot/efi/efi/freebsd
cp /boot/loader.efi /boot/efi/efi/boot/bootx64.efi
cp /boot/loader.efi /boot/efi/efi/freebsd/loader.efi

I prefer to not have the EFI partition mounted all the time - if you agree, change fstab

Code Select Expand

/dev/gpt/efiboot0    /boot/efi       msdosfs     rw             2       2

to

Code Select Expand

/dev/gpt/efiboot0    /boot/efi       msdosfs     rw,noauto             2       2

Update BIOS boot loader, too, just in case you might switch hardware and want to just transfer the installed drive(s).

Code Select Expand

gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 2 nda0

HTH,
Patrick

w00t! :)

[OPNenthu]

Please also read the two posts before that one in the linked thread. Those instructions are tailored and should not be copy/pasted everywhere.

BTW: I just updated to 26.7.1 and it looks like it brought in the changes to enable late loading for the microcode and reinstalled the plugin and ucode package, so maybe now the bootcode update is optional again.

[bamf]

I think I have successfully updated the bootloader from 1.1 to 3.0 (still on OPNsense 26.1.11_10).

Code Select Expand

root@OPNsense:~ # strings /boot/efi/efi/boot/bootx64.efi | grep "Revision"
DFreeBSD/amd64 EFI loader, Revision 3.0
root@OPNsense:~ # strings /boot/efi/efi/freebsd/loader.efi  | grep "Revision"
DFreeBSD/amd64 EFI loader, Revision 3.0
But do I need to update the bootloader on the second SSD too?

Code Select Expand

root@OPNsense:~ # zpool status
  pool: zroot
 state: ONLINE
  scan: scrub repaired 0B in 00:10:32 with 0 errors on Sun Nov 23 00:59:47 2025
config:

        NAME        STATE     READ WRITE CKSUM
        zroot       ONLINE       0     0     0
          mirror-0  ONLINE       0     0     0
            nda0p4  ONLINE       0     0     0
            nda1p4  ONLINE       0     0     0

Code Select Expand

root@OPNsense:~ # gpart show -l
=>       40  500118112  nda0  GPT  (238G)
         40     532480     1  efiboot0  (260M)
     532520       1024     2  gptboot0  (512K)
     533544        984        - free -  (492K)
     534528   16777216     3  swap0  (8.0G)
   17311744  482805760     4  zfs0  (230G)
  500117504        648        - free -  (324K)

=>       40  500118112  nda1  GPT  (238G)
         40     532480     1  efiboot1  (260M)
     532520       1024     2  gptboot1  (512K)
     533544        984        - free -  (492K)
     534528   16777216     3  swap1  (8.0G)
   17311744  482805760     4  zfs1  (230G)
  500117504        648        - free -  (324K)

=>      63  10485697  da0  MBR  (5.0G)
        63      1985       - free -  (993K)
      2048  10418176    1  (null)  [active]  (5.0G)
  10420224     65536    2  (null)  (32M)
I guess so, but how? What's the correct command to mount the EFI partition?

Code Select Expand

root@OPNsense:~ # mkdir -p /mnt/efi
root@OPNsense:~ # mount -t msdosfs /dev/nda1p1 /mnt/efi
mount_msdosfs: /dev/nda1p1: Invalid argument

EDIT:

Seems the EFI partition on the second SSD is not functional at all?

Code Select Expand

root@OPNsense:~ # fstyp /dev/nda0p1
msdosfs
root@OPNsense:~ # fstyp /dev/nda1p1
fstyp: /dev/nda1p1: filesystem not recognized

[Patrick M. Hausen]

I guess so, but how? What's the correct command to mount the EFI partition?

Possibly there is an EFI partition on your second drive but it's not formatted and no boot loader copied to it. The FreeBSD installer does not do this, that's left to the admin. The easiest way is to unmount the working partition of the first drive, then dd that over to the second one.

What I do is create a mirror of all EFI partitions of all disks, then format this with FAT32 and copy the boot loader to it.

[bamf]

Possibly there is an EFI partition on your second drive but it's not formatted and no boot loader copied to it. The FreeBSD installer does not do this, that's left to the admin.

That explains a lot. I was assuming choosing a ZFS mirror in the OPNsense installer creates a fully redundant setup where all drives are bootable.

I have now formatted the EFI partition on /dev/nda1p1 and copied the bootloader files manually. Thanks for the explanation!

[Patrick M. Hausen]

That explains a lot. I was assuming choosing a ZFS mirror in the OPNsense installer creates a fully redundant setup where all drives are bootable.

Yeah ... *sigh* ... the whole situation leaves a bit to be desired. But that's a FreeBSD problem, not an OPNsense one. I will work on getting this improved but as participation in open source projects goes - no promises, sorry.

[OPNenthu]

Potential bug report (?)

I upgraded a second, remote firewall to 26.7.1.  Before the upgrade it was on 26.7 with updated bootcode and with the os-cpu-microcode-intel plugin installed from the UI.  I had done that the prior day.  After the upgrade it received new microcode packages that were released today, but now it's not applying the microcode update on boot.

Before (26.7 + ucode plugin):

Code Select Expand

---<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(vga): resolution 640x480
[1] CPU microcode: updated from 0x24 to 0x26
[1] CPU: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz (1996.80-MHz K8-class CPU)
[1]   Origin="GenuineIntel"  Id=0x706a8  Family=0x6  Model=0x7a  Stepping=8
[1]   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[1]   Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[1]   AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[1]   AMD Features2=0x101<LAHF,Prefetch>
[1]   Structured Extended Features=0x2294e287<FSGSBASE,TSCADJ,SGX,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[1]   Structured Extended Features2=0x40400004<UMIP,RDPID,SGXLC>
[1]   Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
[1]   XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
[1]   IA32_ARCH_CAPS=0x14000c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
[1]   VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
[1]   TSC: P-state invariant, performance statistics

The early microcode update appears with the line "[1] CPU microcode: updated from 0x24 to 0x26".

After (26.7.1 + new ucode plugin/package):

Code Select Expand

---<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(vga): resolution 640x480
[1] CPU: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz (1996.80-MHz K8-class CPU)
[1]   Origin="GenuineIntel"  Id=0x706a8  Family=0x6  Model=0x7a  Stepping=8
[1]   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[1]   Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[1]   AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[1]   AMD Features2=0x101<LAHF,Prefetch>
[1]   Structured Extended Features=0x2294e287<FSGSBASE,TSCADJ,SGX,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[1]   Structured Extended Features2=0x40400004<UMIP,RDPID,SGXLC>
[1]   Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
[1]   XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
[1]   IA32_ARCH_CAPS=0x14000c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
[1]   VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
[1]   TSC: P-state invariant, performance statistics
[1] real memory  = 8589934592 (8192 MB)
[1] avail memory = 7859204096 (7495 MB)
[1] Event timer "LAPIC" quality 600
[1] ACPI APIC Table: <COREv4 COREBOOT>
[1] WARNING: L1 data cache covers fewer APIC IDs than a core (0 < 1)
[1] FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
[1] FreeBSD/SMP: 1 package(s) x 4 core(s)
[1] random: registering fast source Intel Secure Key Seed
[1] random: fast provider: "Intel Secure Key Seed"
[1] random: unblocking device.
[1] ioapic0 <Version 2.0> irqs 0-119
[1] Launching APs: 2 1 3
[1] random: entropy device external interface
[1] wlan: mac acl policy registered
[1] kbd0 at kbdmux0
[1] WARNING: Device "spkr" is Giant locked and may be deleted before FreeBSD 16.0.
[1] efirtc0: <EFI Realtime Clock>
[1] efirtc0: registered as a time-of-day clock, resolution 1.000000s
[1] smbios0: <System Management BIOS> at iomem 0x69533000-0x69533017
[1] smbios0: Entry point: v3 (64-bit), Version: 3.3
[1] aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256>
[1] acpi0: <COREv4 COREBOOT>
[1] acpi0: Power Button (fixed)
[1] hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
[1] Timecounter "HPET" frequency 19200000 Hz quality 950
[1] Event timer "HPET" frequency 19200000 Hz quality 550
[1] Event timer "HPET1" frequency 19200000 Hz quality 440
[1] Event timer "HPET2" frequency 19200000 Hz quality 440
[1] Event timer "HPET3" frequency 19200000 Hz quality 440
[1] Event timer "HPET4" frequency 19200000 Hz quality 440
[1] atrtc0: <AT realtime clock> port 0x70-0x77 on acpi0
[1] atrtc0: registered as a time-of-day clock, resolution 1.000000s
[1] Event timer "RTC" frequency 32768 Hz quality 0
[1] attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
[1] Timecounter "i8254" frequency 1193182 Hz quality 0
[1] Event timer "i8254" frequency 1193182 Hz quality 100
[1] Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
[1] acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0
[1] pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
[1] pci0: <ACPI PCI bus> on pcib0
[1] vgapci0: <VGA-compatible display> port 0x5000-0x503f mem 0x90000000-0x90ffffff,0x80000000-0x8fffffff at device 2.0 on pci0
[1] vgapci0: Boot video device
[1] hdac0: <Intel Gemini Lake HDA Controller> mem 0x91510000-0x91513fff,0x91000000-0x910fffff at device 14.0 on pci0
[1] pci0: <simple comms> at device 15.0 (no driver attached)
[1] ahci0: <Intel Gemini Lake AHCI SATA controller> port 0x5060-0x5067,0x5068-0x506b,0x5040-0x505f mem 0x91514000-0x91515fff,0x9151c000-0x9151c0ff,0x9151b000-0x9151b7ff at device 18.0 on pci0
[1] ahci0: AHCI v1.31 with 2 6Gbps ports, Port Multiplier supported
[1] ahcich0: <AHCI channel> at channel 0 on ahci0
[1] ahcich1: <AHCI channel> at channel 1 on ahci0
[1] pcib1: <ACPI PCI-PCI bridge> at device 19.0 on pci0
[1] pci1: <ACPI PCI bus> on pcib1
[1] igb0: <Intel(R) I210 Flashless (Copper)> port 0x1000-0x101f mem 0x91100000-0x9111ffff,0x91120000-0x91123fff at device 0.0 on pci1
[1] igb0: NVM V0.6 imgtype6
[1] igb0: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb0: Using 4 RX queues 4 TX queues
[1] igb0: Using MSI-X interrupts with 5 vectors
[1] igb0: Ethernet address: 64:62:66:22:e0:47
[1] igb0: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib2: <PCI-PCI bridge> at device 19.1 on pci0
[1] pci2: <PCI bus> on pcib2
[1] igb1: <Intel(R) I210 Flashless (Copper)> port 0x2000-0x201f mem 0x91200000-0x9121ffff,0x91220000-0x91223fff at device 0.0 on pci2
[1] igb1: NVM V0.6 imgtype6
[1] igb1: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb1: Using 4 RX queues 4 TX queues
[1] igb1: Using MSI-X interrupts with 5 vectors
[1] igb1: Ethernet address: 64:62:66:22:e0:48
[1] igb1: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib3: <PCI-PCI bridge> at device 19.2 on pci0
[1] pci3: <PCI bus> on pcib3
[1] igb2: <Intel(R) I210 Flashless (Copper)> port 0x3000-0x301f mem 0x91300000-0x9131ffff,0x91320000-0x91323fff at device 0.0 on pci3
[1] igb2: NVM V0.6 imgtype6
[1] igb2: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb2: Using 4 RX queues 4 TX queues
[1] igb2: Using MSI-X interrupts with 5 vectors
[1] igb2: Ethernet address: 64:62:66:22:e0:49
[1] igb2: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib4: <PCI-PCI bridge> at device 19.3 on pci0
[1] pci4: <PCI bus> on pcib4
[1] pcib5: <PCI-PCI bridge> at device 0.0 on pci4
[1] pci5: <PCI bus> on pcib5
[1] pcib6: <PCI-PCI bridge> at device 1.0 on pci5
[1] pci6: <PCI bus> on pcib6
[1] igb3: <Intel(R) I210 Flashless (Copper)> port 0x4000-0x401f mem 0x91400000-0x9141ffff,0x91420000-0x91423fff at device 0.0 on pci6
[1] igb3: NVM V0.6 imgtype6
[1] igb3: Using 1024 TX descriptors and 1024 RX descriptors
[1] igb3: Using 4 RX queues 4 TX queues
[1] igb3: Using MSI-X interrupts with 5 vectors
[1] igb3: Ethernet address: 64:62:66:22:e0:4a
[1] igb3: netmap queues/slots: TX 4/1024, RX 4/1024
[1] pcib7: <PCI-PCI bridge> at device 3.0 on pci5
[1] pci7: <PCI bus> on pcib7
[1] pcib8: <PCI-PCI bridge> at device 5.0 on pci5
[1] pci8: <PCI bus> on pcib8
[1] pcib9: <PCI-PCI bridge> at device 7.0 on pci5
[1] pci9: <PCI bus> on pcib9
[1] xhci0: <Intel Gemini Lake USB 3.0 controller> mem 0x91500000-0x9150ffff at device 21.0 on pci0
[1] xhci0: 32 bytes context size, 64-bit DMA
[1] xhci0: xECP capabilities <PROTO,PROTO,VEND(c0),LEGACY,VEND(c6),VEND(c7),VEND(c2),DEBUG,VEND(c3),VEND(c4),VEND(c5),VEND(c8),VEND(c9),VEND(cb)>
[1] usbus0 on xhci0
[1] usbus0: 5.0Gbps Super Speed USB v3.0
[1] sdhci_pci0: <Generic SD HCI> mem 0x91519000-0x91519fff,0x9151a000-0x9151afff at device 28.0 on pci0
[1] sdhci_pci0: 1 slot(s) allocated
[1] mmc0: <MMC/SD bus> on sdhci_pci0
[1] isab0: <PCI-ISA bridge> at device 31.0 on pci0
[1] isa0: <ISA bus> on isab0
[1] acpi_button0: <Sleep Button> on acpi0
[1] cpu0: <ACPI CPU> on acpi0
[1] uart: ns8250: UART FCR is broken (0x1)
[1] uart0: <16550 or compatible> at port 0x3f8 irq 4 flags 0x10 on isa0
[1] uart0: console (115200,n,8,1)
[1] est0: <Enhanced SpeedStep Frequency Control> on cpu0
[1] cpufreq0: <CPU frequency control> on cpu0
[1] cpufreq1: <CPU frequency control> on cpu1
[1] cpufreq2: <CPU frequency control> on cpu2
[1] cpufreq3: <CPU frequency control> on cpu3
[1] Timecounter "TSC" frequency 1996800807 Hz quality 1000
[1] Timecounters tick every 1.000 msec
[1] ugen0.1: <Intel XHCI root HUB> at usbus0
[1] ZFS filesystem version: 5
[1] ZFS storage pool version: features support (5000)
[1] uhub0 on usbus0
[1] uhub0: <Intel XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
[1] hdacc0: <Intel Gemini Lake HDA CODEC> at cad 2 on hdac0
[1] hdaa0: <Intel Gemini Lake Audio Function Group> at nid 1 on hdacc0
[1] pcm0: <Intel Gemini Lake (HDMI/DP 8ch)> at nid 3 on hdaa0
[1] mmcsd0: 8GB <MMCHC 8GTF4R 0.6 SN 115AE8FD MFG 02/2023 by 21 0x0000> at mmc0 200.0MHz/8bit/8192-block
[1] mmcsd0boot0: 4MB partition 1 at mmcsd0
[1] mmcsd0boot1: 4MB partition 2 at mmcsd0
[1] mmcsd0rpmb: 524kB partition 3 at mmcsd0
[1] ada0 at ahcich0 bus 0 scbus0 target 0 lun 0
ada0: <CT1000MX500SSD4 M3CR023> ACS-3 ATA SATA 3.x device
ada0: Serial Number 1826E146E7D3
ada0: 600.000MB/s transfers (SATA 3.x, UDMA6, PIO 512bytes)
ada0: Command Queueing enabled
ada0: 953869MB (1953525168 512 byte sectors)
[1] Trying to mount root from zfs:zroot/ROOT/default []...
[2] uhub0: 16 ports with 16 removable, self powered
[2] Dual Console: Serial Primary, Video Secondary
[10] CPU: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz (1996.80-MHz K8-class CPU)
[10]   Origin="GenuineIntel"  Id=0x706a8  Family=0x6  Model=0x7a  Stepping=8
[10]   Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[10]   Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[10]   AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[10]   AMD Features2=0x101<LAHF,Prefetch>
[10]   Structured Extended Features=0x2294e287<FSGSBASE,TSCADJ,SGX,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[10]   Structured Extended Features2=0x40400004<UMIP,RDPID,SGXLC>
[10]   Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
[10]   XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES>
[10]   IA32_ARCH_CAPS=0x14000c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO>
[10]   VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr
[10]   TSC: P-state invariant, performance statistics
[12] igb0: link state changed to UP
[13] igb1: link state changed to UP
[14] igb2: link state changed to UP
[20] ichsmb0: <Intel Gemini Lake SMBus controller> port 0xefa0-0xefbf mem 0x9151d000-0x9151d0ff at device 31.1 on pci0
[20] smbus0: <System Management Bus> on ichsmb0
[23] lo0: link state changed to UP
[23] coretemp0: <CPU On-Die Thermal Sensors> on cpu0
[25] load_dn_sched dn_sched FIFO loaded
[25] load_dn_sched dn_sched QFQ loaded
[25] load_dn_sched dn_sched RR loaded
[25] load_dn_sched dn_sched WF2Q+ loaded
[25] load_dn_sched dn_sched PRIO loaded
[25] load_dn_sched dn_sched FQ_CODEL loaded
[25] load_dn_sched dn_sched FQ_PIE loaded
[25] load_dn_aqm dn_aqm CODEL loaded
[25] load_dn_aqm dn_aqm PIE loaded
[25] ipfw2 (+ipv6) initialized, divert loadable, nat loadable, default to accept, logging disabled
[28] vlan0: changing name to 'vlan0.2010'
[28] igb2: link state changed to DOWN
[28] vlan1: changing name to 'vlan0.2020'
[28] vlan2: changing name to 'vlan0.2030'
[28] vlan3: changing name to 'vlan0.2040'
[28] vlan4: changing name to 'vlan0.2050'
[28] vlan5: changing name to 'vlan0.2060'
[28] vlan6: changing name to 'vlan0.2070'
[30] igb0: link state changed to DOWN
[32] igb2: link state changed to UP
[32] vlan0.2040: link state changed to UP
[32] vlan0.2010: link state changed to UP
[32] vlan0.2060: link state changed to UP
[32] vlan0.2030: link state changed to UP
[32] vlan0.2050: link state changed to UP
[32] vlan0.2020: link state changed to UP
[32] vlan0.2070: link state changed to UP
[32] igb1: link state changed to DOWN
[34] igb0: link state changed to UP
[37] igb1: link state changed to UP
[43] wg0: link state changed to UP

I'm not seeing the line "CPU microcode: updated from 0x24 to 0x26" in the logs now.

Code Select Expand

root@firewall:~ # dmesg | grep microcode
root@firewall:~ #

And here is the update log from 26.7 -> 26.7.1:

Code Select Expand

***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.7 (amd64) at Tue Jul 21 19:31:15 EDT 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (10 candidates): .......... done
Processing candidates (10 candidates): .......... done
The following 11 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
cpu-microcode-rc: 1.0_2 [OPNsense]

Installed packages to be UPGRADED:
ca_root_nss: 3.124 -> 3.125 [OPNsense]
freeipmi: 1.6.17 -> 1.6.18 [OPNsense]
json-c: 0.18 -> 0.19 [OPNsense]
nss: 3.124 -> 3.125 [OPNsense]
opnsense: 26.7 -> 26.7.1 [OPNsense]
os-cpu-microcode-intel: 1.1 -> 1.1_1 [OPNsense]
pciids: 20260624 -> 20260711 [OPNsense]
py313-certifi: 2026.5.20 -> 2026.6.17 [OPNsense]
py313-cryptography: 48.0.0_1,1 -> 48.0.1,1 [OPNsense]

Installed packages to be REINSTALLED:
cpu-microcode-intel-20260512_1 [OPNsense] (options changed)

Number of packages to be installed: 1
Number of packages to be upgraded: 9
Number of packages to be reinstalled: 1

37 MiB to be downloaded.
[1/11] Fetching pciids-20260711.pkg: .......... done
[2/11] Fetching nss-3.125.pkg: .......... done
[3/11] Fetching json-c-0.19.pkg: ......... done
[4/11] Fetching os-cpu-microcode-intel-1.1_1.pkg: . done
[5/11] Fetching py313-certifi-2026.6.17.pkg: ......... done
[6/11] Fetching ca_root_nss-3.125.pkg: ........ done
[7/11] Fetching py313-cryptography-48.0.1,1.pkg: .......... done
[8/11] Fetching freeipmi-1.6.18.pkg: .......... done
[9/11] Fetching cpu-microcode-rc-1.0_2.pkg: . done
[10/11] Fetching opnsense-26.7.1.pkg: .......... done
[11/11] Fetching cpu-microcode-intel-20260512_1.pkg: .......... done
Checking integrity... done (0 conflicting)
[1/11] Upgrading ca_root_nss from 3.124 to 3.125...
[1/11] Extracting ca_root_nss-3.125: ..... done
[2/11] Installing cpu-microcode-rc-1.0_2...
[2/11] Extracting cpu-microcode-rc-1.0_2: .... done
[3/11] Reinstalling cpu-microcode-intel-20260512_1...
[3/11] Extracting cpu-microcode-intel-20260512_1: .......... done
[4/11] Upgrading freeipmi from 1.6.17 to 1.6.18...
[4/11] Extracting freeipmi-1.6.18: .......... done
[5/11] Upgrading json-c from 0.18 to 0.19...
[5/11] Extracting json-c-0.19: .......... done
[6/11] Upgrading nss from 3.124 to 3.125...
[6/11] Extracting nss-3.125: .......... done
[7/11] Upgrading opnsense from 26.7 to 26.7.1...
[7/11] Extracting opnsense-26.7.1: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh.sh'
Migrated OPNsense\Trust\General from 1.0.1 to 1.0.2
Flushing all caches...done.
Writing firmware settings: OPNsense
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
[8/11] Upgrading os-cpu-microcode-intel from 1.1 to 1.1_1...
[8/11] Extracting os-cpu-microcode-intel-1.1_1: ... done
Reloading firmware configuration
Flushing all caches...done.
Writing firmware settings: OPNsense
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
[9/11] Upgrading pciids from 20260624 to 20260711...
[9/11] Extracting pciids-20260711: ..... done
[10/11] Upgrading py313-certifi from 2026.5.20 to 2026.6.17...
[10/11] Extracting py313-certifi-2026.6.17: .......... done
[11/11] Upgrading py313-cryptography from 48.0.0_1,1 to 48.0.1,1...
[11/11] Extracting py313-cryptography-48.0.1,1: .......... done
You may need to manually remove /usr/local/etc/ssl/cert.pem if it is no longer needed.
=====
Message from cpu-microcode-rc-1.0_2:

--
This port includes an RC script, which is one of two methods to update
the CPU microcode on a FreeBSD system.

1. Early loading.
   This method does not use the RC script included here.
   This is the preferred method, because it ensures that any CPU features
   added or removed by a microcode update are visible to the kernel by
   applying the update before the kernel performs CPU feature detection.

   To enable updates using early loading, add the following lines to
   /boot/loader.conf:

   cpu_microcode_load="YES"

   and the appropriate one of these lines:

   cpu_microcode_name="/boot/firmware/intel-ucode.bin"
   cpu_microcode_name="/boot/firmware/amd-ucode.bin"

   The microcode update will be loaded when the system is rebooted.

   AMD systems running FreeBSD prior to 2024-02-22 snapshot
   34467bd76 only support late loading.


2. Late loading.
   This method, which does use the RC script included here, is enabled by
   adding the following line to /etc/rc.conf:

   microcode_update_enable="YES"

   The microcode update is then applied upon reboot or when the microcode
   update service is run via:

   # service microcode_update start

   If the CPU requires a microcode update, a console message such as the
   following will appear:

   Updating CPU Microcode...
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl0 from rev 0x17 to rev 0x22... done.
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl2 from rev 0x17 to rev 0x22... done.
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl4 from rev 0x17 to rev 0x22... done.
   /usr/local/share/cpucontrol/m32306c3_00000022.fw: updating cpu /dev/cpuctl6 from rev 0x17 to rev 0x22... done.
   Done.

It is safe to enable both methods.
=====
Message from opnsense-26.7.1:

--
Just a dream and the wind to carry me
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
The following package files will be deleted:
/var/cache/pkg/ca_root_nss-3.125~8725d4a9fe.pkg
/var/cache/pkg/nss-3.125~3bd727dc98.pkg
/var/cache/pkg/cpu-microcode-intel-20260512_1~ec7bd62a9e.pkg
/var/cache/pkg/opnsense-26.7.1~d7ce0a8dc3.pkg
/var/cache/pkg/x86info-1.31.s03_1.pkg
/var/cache/pkg/py313-certifi-2026.6.17.pkg
/var/cache/pkg/x86info-1.31.s03_1~109a6a1959.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1~44bb796f52.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1.pkg
/var/cache/pkg/cpu-microcode-intel-20260512_1~d3e1dc811e.pkg
/var/cache/pkg/freeipmi-1.6.18.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1_1~8ae9834ac8.pkg
/var/cache/pkg/py313-certifi-2026.6.17~58dc2bd8ba.pkg
/var/cache/pkg/os-cpu-microcode-intel-1.1_1.pkg
/var/cache/pkg/ca_root_nss-3.125.pkg
/var/cache/pkg/libpci-3.15.0~d1b99100f6.pkg
/var/cache/pkg/cpu-microcode-intel-20260512_1.pkg
/var/cache/pkg/pciids-20260711.pkg
/var/cache/pkg/pciids-20260711~34ad3f8084.pkg
/var/cache/pkg/libpci-3.15.0.pkg
/var/cache/pkg/pciids-20260624.pkg
/var/cache/pkg/pciids-20260624~b510601872.pkg
/var/cache/pkg/opnsense-26.7.1.pkg
/var/cache/pkg/json-c-0.19~0011d31480.pkg
/var/cache/pkg/freeipmi-1.6.18~dc301d55f9.pkg
/var/cache/pkg/cpu-microcode-rc-1.0_2~e75ff3975e.pkg
/var/cache/pkg/cpu-microcode-rc-1.0_2.pkg
/var/cache/pkg/nano-9.0~df3c54c509.pkg
/var/cache/pkg/py313-cryptography-48.0.1,1.pkg
/var/cache/pkg/nss-3.125.pkg
/var/cache/pkg/json-c-0.19.pkg
/var/cache/pkg/py313-cryptography-48.0.1,1~b6c2f86624.pkg
/var/cache/pkg/nano-9.0.pkg
The cleanup will free 63 MiB
Deleting files: .......... done
Nothing to do.
Flushing temporary package files... done
Starting web GUI...done.
***DONE***