How to update the CPU microcode on NetBSD systems

NetBSD has a neat utility called cpuctl which will tell you lots about your CPU. It also has a feature which allows newer microcode to be loaded on to Intel processors. This allows CPU updates and fixes to be loaded without relying on motherboard makers to update their BIOSes which sometimes takes much longer than necessary (in the case of Spectre bugs) and in some cases never happens for older motherboards.

To get the latest microcode files from Intel, you can use a pkgsrc package. Update your pkgsrc tree and install:

cd /usr/pkgsrc
cvs update -Pd
cd sysutils/intel-microcode-netbsd
make package update

If the package had never been installed on this system, be sure to add an rc option so it runs at boot:

echo "microcode=YES" >> /etc/rc.conf

Installing the package installs the files in to the system under your pkgsrc prefix. On BSD, we use /usr/local. So, in order for the utility to find the micrcode files, you'll have to update a sysctl variable with the correct path. First, check to see if your path is already correct:

sysctl hw.firmware.path

It should show you something like this:

hw.firmware.path = /libdata/firmware:/usr/libdata/firmware:/usr/pkg/libdata/firmware:/usr/pkg/libdata

Because, in this example, the path includes /usr/pkg instead of /usr/local, you'll have to update it and have it set on boot:

sysctl -w hw.firmware.path=/libdata/firmware:/usr/libdata/firmware:/usr/local/libdata/firmware:/usr/local/libdata
echo "hw.firmware.path=/libdata/firmware:/usr/libdata/firmware:/usr/local/libdata/firmware:/usr/local/libdata" >> /etc/sysctl.conf

To make sure your microcode is properly getting updated, check it before and after updating:

cpuctl identify 0 | grep microcode

Before the update, our example CPU shows:

cpu0: microcode version 0x700000d, platform ID 4

Then run the update:

/etc/rc.d/intel-microcode start
cpuctl identify 0 | grep microcode

This shows:

cpu0: microcode version 0x7000011, platform ID 4

Since the microcode version has changed, you're updated! Yay!

For the fun of it (because this stuff is fun, isn't it?), run "cpuctl identify 0" without the grep to see tons of information about your processor :)

The 0, incidentally, just tells cpuctl which core you want to query. Cores on Intel CPUs are all the same, although you can have a dual or multisocket motherboard with different Intel CPUs (but those are rare). Likewise, some ARM CPUs come in big.LITTLE configurations where some cores are fast and powerful and others are modest and take very little power, so the core number would matter in those instances. Other platforms, like SPARC, commonly have different CPUs installed in the same system.