Re: Downfall microcode update

void <[email protected]> Thu, 10 Aug 2023 01:13:00 +0100

Newsgroups	gmane.os.freebsd.security.general
Message-ID	<ZNQrjNUuimrHTT8W@int21h>

On Wed, Aug 09, 2023 at 11:46:10AM +0200, Dag-Erling SmÃ¸rgrav wrote:
>Eugene Grosbein <[email protected]> writes:
>> cpupdate_enable="YES" # in /etc/rc.conf should be enough
>
>You mean
>
>microcode_update_enable="yes"
>
>DES

What's the proper way then, for intel?

1. install sysutils/cpupdate and enable it in rc.conf ?
2. microcode_update_enable="yes" in rc.conf ?

3. in /boot/loader.conf:
    cpu_microcode_load="YES" 
    cpu_microcode_name="/boot/firmware/intel-ucode.bin"
    ?

All 3 ? Just 1 & 2? Is just #3 sufficient?

Make cron attempt to download updates daily, via service cpupdate download ?

Is CPM needed?

The manpage for cpupdate has this:

CPUPDATE(8)             FreeBSD System Manager's Manual            CPUPDATE(8)

NAME
      cpupdate TO BE DONE: MANPAGE

      FreeBSD 13.2-STABLE            January 15, 2018            FreeBSD 13.2-STABLE
--