Debian

On my Debian desktop, I have both of my primary monitors in portrait mode, with a third monitor in landscape mode. The login screen is therefore rotated 90 degrees from how it needs to be. After login, I need to manually go into System Settings, and manually rotate the monitors.

That is, up until now. A little poking around says I need to:

apt install arandr

This is a GUI application which will create a script in .screenlayout which can be auto-started upon login:

$ cat .screenlayout/bythree.sh
#!/bin/sh
xrandr \
  --output DisplayPort-0 --primary --mode 3840x2160 --pos 0x8 --rotate right \
  --output DisplayPort-1 --mode 3840x2160 --pos 2160x0 --rotate right \
  --output DisplayPort-2 --off \
  --output DisplayPort-3 --mode 2560x1600 --pos 4320x0 --rotate normal \
  --output HDMI-A-0 --off \
  --output HDMI-A-1 --off

This can be autostarted in LXDE with:

$ cat ~/.config/lxsession/LXDE/autostart
@lxpanel --profile LXDE
@pcmanfm --desktop --profile LXDE
@xscreensaver -no-splash
#@~/.screenlayout/bythree.sh    <= does not work
#@${HOME}/.screenlayout/bythree.sh   <= does not work
# make sure there is a line return at end of command:
@/home/me/.screenlayout/bythree.sh

Instructions for the autostart file can be found at LXSession.

When needing to rebuild a personal linux machine, some suggested commands to collect state:

dpkg --get-selections > ~/mint/Package.list
apt-key exportall > ~/mint/Repo.keys
crontab -u wgking -l > ~/mint/crontab.backup

For some odd reason, my Bluetooth based mouse stopped working on my Debian Linux workstation. Going into the Bluetooth control panel in Settings indicated that no Bluetooth Adapter could be found.

In scouring the help groups, the solution is to go into BIOS, disable Bluetooth, reboot, restart into BIOS, and enable Bluetooth. In the end, this revived my Bluetooth adapters and devices.

At one point in time, removing 'quiet' and placing 'text' on the grub/linux command line would boot in to console mode, the current way to do that is the remove 'quiet' and add the following to the linux kernel command line:

systemctl set-default multi-user.target

I need to keep this around and see what it does to the boot up log listing (based upon Force Debian console into text mode, it can be used when ILO complains of "Monitor is in graphics mode or an unsupported text mode.":

GRUB_CMDLINE_LINUX_DEFAULT="nomodeset"

Another useful function is the following to disable graphical terminal in the grub boot file (use update-grub after any changes):

GRUB_TERMINAL=console

On Debian Buster, even when cleaned of all older kernels, my /boot directory seems to be short of space now. I can't seem to update when just one kernel is present:

# ls -alt /boot total 42733 drwxr-xr-x 5 root root 1024 Jun 26 01:02 . -rw-r--r-- 1 root root 34752610 Jun 26 01:01 initrd.img-4.19.0-5-amd64 drwxr-xr-x 5 root root 1024 Jun 25 23:29 grub drwxr-xr-x 1 root root 234 Jun 3 18:06 .. -rw-r--r-- 1 root root 206223 May 15 16:07 config-4.19.0-5-amd64 -rw-r--r-- 1 root root 3370661 May 15 16:07 System.map-4.19.0-5-amd64 -rw-r--r-- 1 root root 5217520 May 15 16:07 vmlinuz-4.19.0-5-amd64 drwx------ 2 root root 12288 Jul 25 2018 lost+found drwx------ 3 root root 4096 Dec 31 1969 efi

My problem, is when adding or installing packages, I end up with:

Building cpio /boot/initrd.img-4.19.0-5-amd64.new initramfs
pigz: abort: write error on  (No space left on device)
E: mkinitramfs failure pigz 28
update-initramfs: failed for /boot/initrd.img-4.19.0-5-amd64 with 1.

The solution is to mv or remove initrd.img-4.19.0-5-amd64.

I can then rebuild the file with:

# update-initramfs -cvk `uname -r`

or removing the file prior to installing updates:

~/initramfs# rm /boot/initrd.img-4.19.0-5-amd64
~/initramfs# apt install -f
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 140 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Setting up initramfs-tools (0.133) ...
update-initramfs: deferring update (trigger activated)
Processing triggers for initramfs-tools (0.133) ...

On watching the build, there must be a bunch of firmware files going in there. I wonder how to tone that down (mostly nuc8i7hvk01 special purpose display).

A bunch here -- will need to tone that down I think -- will need to go back to my installation notes to see why they are there:

# du -h --max-depth=1 /lib/firmware/amdgpu/
25M     /lib/firmware/amdgpu/

For simpler jobs, some commands to keep in mind:

• sudo apt-get autoclean
• sudo apt-get clean
• sudo apt-get autoremove
• sudo apt-get purge

2019/08/12 Most of the firmware size issue is resolved by:

• removing the firmware-misc-nonfree package, most of which seems to be included with no descretion
• keeping the firmware-amd-graphics package, but moving the /lib/firmware/amdgpu and /lib/firmware/radeon directories elsewhere, and 'mv firmware/amdgpu/vegam* /lib/firmware/' back again as the only files needed based upon 'dmesg|grep firmware'.

# lshw -short |grep Polaris
/0/100/1/0         /dev/fb0    display        Polaris 22 XT [Radeon RX Vega M GH]
/0/100/1/0.1                   multimedia     Polaris 22 HDMI Audio

# dmesg|grep firmware
[    0.229009] Spectre V2 : Enabling Restricted Speculation for firmware calls
[    1.313160] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_pfp.bin
[    1.313171] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_me.bin
[    1.313179] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_ce.bin
[    1.313188] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_rlc.bin
[    1.313224] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_mec.bin
[    1.313261] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_mec2.bin
[    1.314058] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_sdma.bin
[    1.314069] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_sdma1.bin
[    1.314167] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_uvd.bin
[    1.314170] [drm] Found UVD firmware Version: 1.130 Family ID: 16
[    1.314786] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_vce.bin
[    1.314789] [drm] Found VCE firmware Version: 53.21 Binary ID: 3
[    1.314987] amdgpu 0000:01:00.0: firmware: direct-loading firmware amdgpu/vegam_smc.bin
[    3.772379] iwlwifi 0000:06:00.0: firmware: direct-loading firmware iwlwifi-8265-36.ucode
[    3.775171] iwlwifi 0000:06:00.0: loaded firmware version 36.8fd77bb3.0 op_mode iwlmvm

# ls -alt /lib/firmware/amdgpu/
total 1284
drwxr-xr-x 1 root root    290 Aug 13 09:36 .
-rw-r--r-- 1 root root  16660 Aug 13 09:36 vegam_rlc.bin
-rw-r--r-- 1 root root  12692 Aug 13 09:36 vegam_sdma1.bin
-rw-r--r-- 1 root root  12692 Aug 13 09:36 vegam_sdma.bin
-rw-r--r-- 1 root root 130964 Aug 13 09:36 vegam_smc.bin
-rw-r--r-- 1 root root 375424 Aug 13 09:36 vegam_uvd.bin
-rw-r--r-- 1 root root 166816 Aug 13 09:36 vegam_vce.bin
-rw-r--r-- 1 root root   8852 Aug 13 09:36 vegam_ce.bin
-rw-r--r-- 1 root root  17044 Aug 13 09:36 vegam_me.bin
-rw-r--r-- 1 root root 262824 Aug 13 09:36 vegam_mec2.bin
-rw-r--r-- 1 root root 262824 Aug 13 09:36 vegam_mec.bin
-rw-r--r-- 1 root root  17044 Aug 13 09:36 vegam_pfp.bin
drwxr-xr-x 1 root root   2740 Aug 13 09:31 ..

I came across a Epson Perfection V39 and thought I'd try getting it to work on Linux Debian.

I have installed xsane, gscan2pdf and sane-utils.

When plugging into USB, /var/log/messages has:

Jun 25 23:16:04  usb 1-1: new full-speed USB device number 22 using xhci_hcd
Jun 25 23:16:05  usb 1-1: new high-speed USB device number 23 using xhci_hcd
Jun 25 23:16:05  usb 1-1: New USB device found, idVendor=04b8, idProduct=013d, bcdDevice= 1.00
Jun 25 23:16:05  usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Jun 25 23:16:05  usb 1-1: Product: Epson Perfection V39
Jun 25 23:16:05  usb 1-1: Manufacturer: EPSON
Jun 25 23:16:05  usb 1-1: SerialNumber: VCFY057184

I tried creating the following file:

# cat /etc/udev/hwdb.d/epson-v39.hwdb
# Epson Perfection V39
usb:v04B8p013D*
 libsane_matched=yes

and running 'systemd-hwdb update', but no luck

From a different perspective, Epson Drivers can be used to find the drivers. Put 'V39' only as the search criteria. One of the versions shown is 1.0.1, but v1.0.4 is actually available at v1.0.4. I wish there was a directory to browse as I found that one by trial and error on the url line.

However, skipping all that, this is the one that worked with xsane on Debian Buster: Image Scan! for Linux 1.0.1.

The scanner is seen:

iscan-gt-s650-bundle-1.0.1.x64.deb# scanimage -L
device `epkowa:interpreter:001:025' is a Epson (unknown model) flatbed scanner

As a side note, the 1.0.4 version provided a mechanism of seeing network based scanners such as an HP multifunction.

For future reference, find a scanner which is compatible: SANE - Supported Devices

From the Debian bugs mailing list here is an interesting result of using non-native code in emulation:

1) Install qemu-system-arm.

2) Unpack kernel .deb, locate vmlinuz-4.9.0-8-armmp.
Or search your just-built zImage.

3) Run qemu (no root required):

  qemu-system-arm -M virt -nographic -kernel vmlinuz-4.9.0-8-armmp

If you see a kernel panic - the outcome is positive, the kernel is OK.
If it just stays there eating 100% CPU - the outcome is negative.

The above is used to sus out some issues with the linux-image-4.9.0-8-armmp-lpae:armhf kernel on Banana PI and Lamobo R1, with the notes in Bug#922478. More talk of the bug on Hacker News.

From Things you can do with Debian: multimedia editing

• gimp - image processing
• audacity - quick audio recording / editing
• ardour - audio recording / editing / mixing / mastering
• kdenlive - video editing / mixing
• openshot - video editing / mixing
• handbrake - video transcoding

Simple streaming the Linux desktop to Kodi using GStreamer and RTP by Petter Reinholdtsen

2018/09/13 - Distributing static routes with DHCP

2021/03/21 - Debugging a Doorbell - fascinating Linux debug mechanisms for an embedded device

Intel has released a new NUC, the NUC8i7HVK. It used an integrated AMD GPU graphics engine, the Radeon RX Vega M GH in the NUC8i7HVK model.

During the initial release days, most of the installation and configuration documentation revolved around installing a specific version of Ubuntu, and installing a particular driver set from the AMD support pages.

That is no longer necessary. AMD has been contributing a significant amount of code to recent versions of the kernel for driving their new graphics chipsets.

I had tried to load, build, and install the amdgpu-pro driver, but it would never match up with the current kernel header files in Stretch and Buster.

One important note: the built in Intel graphics adapter needs to be disabled in the BIOS. Then these are the installation steps to get things running (I have two 4K screens attached, both rotated 90 degrees). So things seem to work.

In addition, i have the following in /etc/default/grub (run update-grub after changing):

GRUB_CMDLINE_LINUX="amdgpu.dc=1"

I used the non-free firmware image of Debian Buster to get the ball rolling. I think I encountered some black screens so had to ssh in from a different computer to fix various gaffes on the way to getting something working.

apt -t experimental install linux-image-4.18.0-rc4-amd64 linux-headers-4.18.0-rc4-amd64
reboot
apt -t experimental install mesa-utils mesa-utils-extra mesa-va-drivers \
         mesa-vdpau-drivers mesa-vulkan-drivers libglx-mesa0 \
         xserver-xorg-video-amdgpu
wget -m -np https://people.freedesktop.org/~agd5f/radeon_ucode/vegam/
mkdir /lib/firmware/amdgpu
cp people.freedesktop.org/~agd5f/radeon_ucode/vegam/*.bin /lib/firmware/amdgpu/
/usr/sbin/update-initramfs -u -k all
reboot

Which results in:

# lspci|grep -i vga
01:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Polaris 22 [Radeon RX Vega M GH] (rev c0)
# uname -a
Linux nuc8i7hvk01 4.18.0-rc4-amd64 #1 SMP Debian 4.18~rc4-1~exp1 (2018-07-12) x86_64 GNU/Linux

Long story short, the solution was to install the latest firmware. In this case, I have an Intel NUC8i7HVK Mini PC with Intel Wireless-AC 8265 and Bluetooth 4.2. I installed the Intel wireless firmware package from experimental:

apt -t experimental install firmware-iwlwifi

This is also running current experimental kernel:

# uname -a
Linux nuc8i7hvk01 4.18.0-rc4-amd64 #1 SMP Debian 4.18~rc4-1~exp1 (2018-07-12) x86_64 GNU/Linux

Which provided a more recent load on boot:

[ 2.478527] iwlwifi 0000:06:00.0: firmware: direct-loading firmware iwlwifi-8265-36.ucode

Upon reboot, it was easy to scan, connect, and pair the Logitech MX Anywhere 2S mouse.

For future reference, here are some commands to see some activiites:

$ hcitool dev
Devices:
        hci0    0C:54:15:66:3B:9E

$ hciconfig
hci0:   Type: Primary  Bus: USB
        BD Address: 0C:54:15:66:3B:9E  ACL MTU: 1021:4  SCO MTU: 96:6
        UP RUNNING PSCAN ISCAN
        RX bytes:41366 acl:2102 sco:0 events:164 errors:0
        TX bytes:4913 acl:29 sco:0 commands:75 errors:0

# bluetoothctl
Agent registered
[MX Anywhere 2S]# help
Menu main:
Available commands:
-------------------
advertise                                         Advertise Options Submenu
scan                                              Scan Options Submenu
gatt                                              Generic Attribute Submenu
list                                              List available controllers
show [ctrl]                                       Controller information
select                                      Select default controller
devices                                           List available devices
paired-devices                                    List paired devices
system-alias                                Set controller alias
reset-alias                                       Reset controller alias
power                                     Set controller power
pairable                                  Set controller pairable mode
discoverable                              Set controller discoverable mode
agent                          Enable/disable agent with given capability
default-agent                                     Set agent as the default one
advertise                            Enable/disable advertising with given type
set-alias                                  Set device alias
scan                                      Scan for devices
info [dev]                                        Device information
pair [dev]                                        Pair with device
trust [dev]                                       Trust device
untrust [dev]                                     Untrust device
block [dev]                                       Block device
unblock [dev]                                     Unblock device
remove                                       Remove device
connect                                      Connect device
disconnect [dev]                                  Disconnect device
menu                                        Select submenu
version                                           Display version
quit                                              Quit program
exit                                              Quit program
help                                              Display help about this program

[MX Anywhere 2S]# paired-devices
Device E1:38:CB:49:A9:A5 MX Anywhere 2S

[MX Anywhere 2S]# devices
Device E1:38:CB:49:A9:A5 MX Anywhere 2S

[MX Anywhere 2S]# paired-devices
Device E1:38:CB:49:A9:A5 MX Anywhere 2S

Debian wiki on bluetooth: Using Bluetooth in a Debian system

2024/06/02 If the mouse does not start when logging into KDE, the file '~/.config/bluedevilglobalrc' may need to be adjusted with:

[Adapters]
<Your Bluetooth adapter> mac_powered=true

Even though you appear to enable it in the bluetooth configuration screen, it does not seem to 'stick'. Another 'fix' is after setting the powered option to true make the file read-only so that it doesn't get set to false again (should that happen).

On a Debian Stretch KDE system, some combination of the following was able to change the natural scrolling direction to match that of a MacOS computer.

apt install xinput
apt install xserver-xorg-input-synaptics
apt install xserver-xorg-input-evdev

Place the following (from /usr/share/X11/xorg.conf.d/70-synaptics.conf) in /etc/X11/xorg.conf.d/70-synaptics.conf:

# Example xorg.conf.d snippet that assigns the touchpad driver
# to all touchpads. See xorg.conf.d(5) for more information on
# InputClass.
# DO NOT EDIT THIS FILE, your distribution will likely overwrite
# it when updating. Copy (and rename) this file into
# /etc/X11/xorg.conf.d first.
# Additional options may be added in the form of
#   Option "OptionName" "value"
#
Section "InputClass"
        Identifier "touchpad catchall"
        Driver "synaptics"
        MatchIsTouchpad "on"
# This option is recommend on all Linux systems using evdev, but cannot be
# enabled by default. See the following link for details:
# http://who-t.blogspot.com/2010/11/how-to-ignore-configuration-errors.html
#       MatchDevicePath "/dev/input/event*"
        Option "NaturalScrolling" "true"
EndSection

Section "InputClass"
        Identifier "touchpad ignore duplicates"
        MatchIsTouchpad "on"
        MatchOS "Linux"
        MatchDevicePath "/dev/input/mouse*"
        Option "Ignore" "on"
EndSection

# This option enables the bottom right corner to be a right button on clickpads
# and the right and middle top areas to be right / middle buttons on clickpads
# with a top button area.
# This option is only interpreted by clickpads.
Section "InputClass"
        Identifier "Default clickpad buttons"
        MatchDriver "synaptics"
        Option "SoftButtonAreas" "50% 0 82% 0 0 0 0 0"
        Option "SecondarySoftButtonAreas" "58% 0 0 15% 42% 58% 0 15%"
EndSection

# This option disables software buttons on Apple touchpads.
# This option is only interpreted by clickpads.
Section "InputClass"
        Identifier "Disable clickpad buttons on Apple touchpads"
        MatchProduct "Apple|bcm5974"
        MatchDriver "synaptics"
        Option "SoftButtonAreas" "0 0 0 0 0 0 0 0"
EndSection

In 'System Settings' -> 'Input Devices' -> TouchPad -> Scrolling, I have 'Reverse Scrolling' -> Vertical enabled.

The last section of SynapticsTouchpad mentioned the driver to install, which contradicts the beginning of the page, but indicates that libinput lacks what synaptics provides, so the roles need to be reversed.

From [SOLVED] KDE reverse/natural scrolling not working, I added the Option "NaturalScrolling" "true" line in the above file.

Reverse two finger scroll direction (natural scrolling)? didn't help much, but did introduce the "xinput" command.

I rebooted to get everything functional.

I have a couple old HP DL360 G6 servers running a several year old version of Debian Stretch. It became time to update them. Rather than fooling around with an upgrade, this is a re-install scenario. The servers have ILO2, with very lame keystroke ability. I had to use a combination of the ILO2 Remote Access in Internet Explorer as the viewer with an ssh login on another window to get keystrokes and menu operations going. I think it was a lot easier back with original Internet Explorer and Java. The Remote Mount of a CD also worked after a couple attempts at getting everything correct.

With the operating system installed, I used the Linux HP Smart Array Raid Controller article to determine the mechanism for installing HP proprietary tools. HPE (Hewlett Packard Enterprise) has a Software Delivery Repository. I am glad I hit the guy's article first, as I would not have known what to do without it.

Here is the server type determined via DMI:

 dmidecode | grep -A3 '^System Information'
System Information
        Manufacturer: HP
        Product Name: ProLiant DL360 G6
        Version: Not Specified

PCI information shows the RAID Controller type:

# lspci -k|grep -i -A2 raid
03:00.0 RAID bus controller: Hewlett-Packard Company Smart Array G6 controllers (rev 01)
        Subsystem: Hewlett-Packard Company Smart Array P410i
        Kernel driver in use: hpsa

Which confirms kernel modules in use for my SAS drives:

# lsmod |grep hpsa
hpsa                  102400  2
scsi_transport_sas     45056  1 hpsa
scsi_mod              253952  8 sd_mod,usb_storage,scsi_transport_sas,libata,hpsa,uas,sr_mod,sg

Since I am using Debian Stretch, here are some revised commands to get at some tools. This is the closest I could get to a set of descriptions.

# apt install curl
# curl https://downloads.linux.hpe.com/SDR/hpePublicKey2048_key1.pub | apt-key add -
# echo -e "deb http://downloads.linux.hpe.com/SDR/repo/mcp/ stretch/current non-free" \
      > /etc/apt/sources.list.d/hpe.list
# apt update
# apt install ssacli
# apt install ssaducli
# apt install hponcfg

ssacli provides access to the raid controller information. ssaducli is supposed to show wear rates, but it generated an empty report for me. And hponcfg deals with ILO management. More articles are needed for decoding that beast. Continue reading "HP DL360 G6 P410i with Debian Stretch" »

I have a couple older HP servers I acquired prior to understanding free firmware vs non-free. In the Debian world, when there are non-free network drivers, this can be an issue, as the non-free drivers are not included with the standard distribution downloads. Case in point, the bnx2 firmware. There are a ways to build your own distribution, but Debian, via an out of the way location, does provide an installable image: Unofficial non-free images including firmware packages

When trying out Debian Testing, here is the Debian Testing Installer page.

• dynamic dns:
• Dynamic DNS on your own domain: the important bit for me was the mention of using the "ddclient" client package for the client side. Now to search for something for the server side.
• Route-based VPN on Linux with WireGuard: I think I referenced this somewhere already, but I will do it again. And quoting from the article: "As an alternative to IPsec, WireGuard is an extremely simple (less than 5,000 lines of code) yet fast and modern VPN that utilizes state-of-the-art and opinionated cryptography (Curve25519, ChaCha20, Poly1305) and whose protocol, based on Noise, has been formally verified. It is currently available as an out-of-tree module for Linux but is likely to be merged when the protocol is not subject to change anymore. Compared to IPsec, its major weakness is its lack of interoperability."
• DKIM (DomainKeys Identified Mail) Modernization : notes on using Domain Keys in a Debian Stretch setting
• Reservoir sampling with few random bits: an excellent article describing the mechanism of randomly sampling from a stream: hold and choose, hold and choose, ...
• Using the switch on Turris Omnia with Debian: I have seen the Turris Omnia mentioned elsewhere, and this is an interesting reference on one mechansim of invoking hardware forwarding in the built in switch.

Debian Stretch has been out for a while, and is running stable, as it should. However, the kernel version is getting a bit long in the tooth:

4.9.0-4-amd64 #1 SMP Debian 4.9.65-3 (2017-12-03) x86_64 GNU/Linux

There is quite a bit of new stuff coming down the pipe in more recent versions of the kernel. I used to manually build kernels and install them. Well, I need to still do that for bleeding edge development requirements.

However, since I manage a network of machines, I want something more current, stable, and easy to maintain. Debian Stretch Backports seems to fit the bill. As a preseed configuration with a few other goodies thrown in for good measure:

# backport selection
d-i apt-setup/services-select multiselect backports
d-i apt-setup/non-free boolean true
d-i apt-setup/contrib boolean true

#  preseed/late_command
d-i preseed/late_command string \
apt-install linux-image-4.14.0-0.bpo.3-amd64; \
apt-install iucode-tool; \
in-target /usr/bin/apt-get install -y -t stretch-backports iproute2; \
in-target /usr/bin/apt-get install -y -t stretch-backports firmware-linux-free; \
in-target /usr/bin/apt-get install -y -t stretch-backports firmware-linux; \
in-target /usr/bin/apt-get install -y -t stretch-backports intel-microcode

The first section adds the backport repository to the mix, which results in:

# cat /etc/apt/sources.list
# deb http://ftp.us.debian.org/debian/ stretch main

deb http://ftp.us.debian.org/debian/ stretch main non-free contrib
# deb-src http://ftp.us.debian.org/debian/ stretch main non-free contrib

# stretch-backports, previously on backports.debian.org
deb http://ftp.us.debian.org/debian/ stretch-backports main contrib non-free
# deb-src http://ftp.us.debian.org/debian/ stretch-backports main contrib non-free

The microcode files are non-free, as are some of the firmware files, hence the non-free flag. The iucode-tool package is part of contrib, hence the contrib flag.

The preseed/late_command entry can have multiple commands, with each command terminated with a ';'. apt-install is used to install the kernel, as an 'in-target' flavour will not have enough memory. As I do considerable amount of networking, iproute2 is installed in the same cycle to get it's tools in place. The 'partman' portion of my install sets /boot as ro, so the these packages need to be installed prior to reboot.

Backports repository has priority of 100. Since the kernel name is unique, the installer knows to use the backports respository. iucode-tool does not have a backports version, so is pulled from the stable repository. The other ones have versions in both stable and backports. They therefore need the override in order to have the backports version installed.

On reboot, with 'uname -a', I have:

 4.14.0-0.bpo.3-amd64 #1 SMP Debian 4.14.13-1~bpo9+1 (2018-01-14) x86_64 GNU/Linux

Some references:

• Example PreSeed
• Hands Free Installation - with various good remarks and comments about the process
• "Hands-off" Debian Installation - some details on command line entries for debugging the preseed process
• Debian Preseed Documentation

After some more reading, here is iteration two of the preseed:

# backport selection
d-i apt-setup/services-select multiselect backports
d-i apt-setup/non-free boolean true
d-i apt-setup/contrib boolean true

#  preseed/late_command
d-i preseed/late_command string \
in-target /usr/bin/apt-get upgrade -y -t stretch-backports; \
apt-install linux-image-4.14.0-0.bpo.3-amd64; \
apt-install iucode-tool; \
in-target /usr/bin/apt-get install -y -t stretch-backports firmware-linux-free; \
in-target /usr/bin/apt-get install -y -t stretch-backports firmware-linux; \
in-target /usr/bin/apt-get install -y -t stretch-backports intel-microcode; \
in-target /usr/bin/apt-get upgrade -y -t stretch-backports

This does an upgrade prior to installation of anything. Which upgrades iproute2. There is a final upgrade as the kernel installation adds some additional packages, which also need an upgrade.

But a caveat does exist from backports.debian.org:

It is therefore recommended to only select single backported packages that fit your needs, and not use all available backports.

... so running the 'upgrade' command may not be the sensible thing to do.