From e4148bd2358dbbc2c8641725588ff39234b4feb7 Mon Sep 17 00:00:00 2001 From: Cat Tom Date: Sun, 8 Nov 2026 23:54:15 +0800 Subject: [PATCH] Add Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md --- ...fixes-intel-microcode-not-taking-effect.md | 164 ++++++++++++++++++ mkdocs.yml | 1 + 2 files changed, 165 insertions(+) create mode 100644 docs/tech/Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md diff --git a/docs/tech/Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md b/docs/tech/Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md new file mode 100644 index 0000000..6925acc --- /dev/null +++ b/docs/tech/Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md @@ -0,0 +1,164 @@ +# Proxmox 8.4.21 修复 intel-microcode 不生效 + +- 主机：零刻 SEi12 +- 系统环境: `Linux CatTomServer3 6.8.12-20-pve #1 SMP PREEMPT_DYNAMIC PMX 6.8.12-20 (2026-03-13T08:15Z) x86_64 GNU/Linux` +- 问题: `lscpu` 报告 `Reg file data sampling: Vulnerable: No microcode`，此前已执行 `apt install intel-microcode`，并且已经重启主机。 + +**`lscpu` 输出**： + +``` hl_lines="52" +root@CatTomServer3:~# lscpu +Architecture: x86_64 + CPU op-mode(s): 32-bit, 64-bit + Address sizes: 39 bits physical, 48 bits virtual + Byte Order: Little Endian +CPU(s): 12 + On-line CPU(s) list: 0-11 +Vendor ID: GenuineIntel + BIOS Vendor ID: Intel(R) Corporation + Model name: 12th Gen Intel(R) Core(TM) i5-12450H + BIOS Model name: 12th Gen Intel(R) Core(TM) i5-12450H To Be Filled By O.E.M. CPU @ 4.0GHz + BIOS CPU family: 205 + CPU family: 6 + Model: 154 + Thread(s) per core: 2 + Core(s) per socket: 8 + Socket(s): 1 + Stepping: 3 + CPU(s) scaling MHz: 48% + CPU max MHz: 4400.0000 + CPU min MHz: 400.0000 + BogoMIPS: 2227.20 + Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mm + x fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon peb + s bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dte + s64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm sse4_1 sse4_2 x2apic movbe + popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault + epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_a + d fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a rdseed adx smap clflushopt clw + b intel_pt sha_ni xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk avx_vnni dthe + rm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req hfi vnmi umip pku osp + ke waitpkg gfni vaes vpclmulqdq rdpid movdiri movdir64b fsrm md_clear serialize arch_lbr ib + t flush_l1d arch_capabilities ibpb_exit_to_user +Virtualization features: + Virtualization: VT-x +Caches (sum of all): + L1d: 320 KiB (8 instances) + L1i: 384 KiB (8 instances) + L2: 7 MiB (5 instances) + L3: 12 MiB (1 instance) +NUMA: + NUMA node(s): 1 + NUMA node0 CPU(s): 0-11 +Vulnerabilities: + Gather data sampling: Not affected + Indirect target selection: Not affected + Itlb multihit: Not affected + L1tf: Not affected + Mds: Not affected + Meltdown: Not affected + Mmio stale data: Not affected + Reg file data sampling: Vulnerable: No microcode + Retbleed: Not affected + Spec rstack overflow: Not affected + Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl + Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization + Spectre v2: Mitigation; Enhanced / Automatic IBRS; IBPB conditional; PBRSB-eIBRS SW sequence; BHI SW lo + op, KVM SW loop + Srbds: Not affected + Tsa: Not affected + Tsx async abort: Not affected + Vmscape: Mitigation; IBPB before exit to userspace +``` + +**`grep microcode /proc/cpuinfo | uniq` 输出**: + +``` +root@CatTomServer3:~# grep microcode /proc/cpuinfo | uniq +microcode : 0x416 +``` + +**`dmesg | grep microcode` 输出**: + +``` +root@CatTomServer3:~# dmesg | grep microcode +[ 0.099733] Register File Data Sampling: Vulnerable: No microcode +[ 0.628218] microcode: Current revision: 0x00000416 +``` + +## 修复步骤 + +### 检查 microcode 加载条件 + +```bash +cat /proc/cmdline +iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03 +grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode +lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin' +``` + +``` +root@CatTomServer3:~# cat /proc/cmdline +BOOT_IMAGE=/boot/vmlinuz-6.8.12-20-pve root=/dev/mapper/pve-root ro quiet +``` + +``` hl_lines="5" +root@CatTomServer3:~# iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03 +iucode_tool: system has processor(s) with signature 0x000906a3 +microcode bundle 1: /lib/firmware/intel-ucode/06-9a-03 +selected microcodes: + 001/001: sig 0x000906a3, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256 + 001/001: sig 0x000906a4, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256 +``` + +``` +root@CatTomServer3:~# grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode +IUCODE_TOOL_INITRAMFS=auto +``` + +``` +root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin' +(no output) +``` + +上述检查结果表明: `intel-microcode` 已正确安装最新版本，但未写入 `initrd.img` 中，因此未能生效。 + +### 重新生成 initramfs + +```bash +update-initramfs -u -k all -v +``` + +``` +root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin' +kernel/x86/microcode/GenuineIntel.bin +``` + +重新生成 initramfs 后， `intel-microcode` 已写入 `initrd.img` 中，重启服务器即可。 + +### 验证 microcode 正确加载 + +```bash +grep microcode /proc/cpuinfo | sort -u +dmesg | grep -Ei 'microcode|Register File Data Sampling' +cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling +``` + +``` hl_lines="2" +root@CatTomServer3:~# grep microcode /proc/cpuinfo | sort -u +microcode : 0x43a +``` + +``` hl_lines="4" +root@CatTomServer3:~# dmesg | grep -Ei 'microcode|Register File Data Sampling' +[ 0.099051] Register File Data Sampling: Mitigation: Clear Register File +[ 0.639631] microcode: Current revision: 0x0000043a +[ 0.639632] microcode: Updated early from: 0x00000416 +``` + +``` hl_lines="2" +root@CatTomServer3:~# cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling +Mitigation: Clear Register File +``` + +上述检查结果表明: microcode 已正确加载。 \ No newline at end of file diff --git a/mkdocs.yml b/mkdocs.yml index 185c5ba..eee4364 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -108,6 +108,7 @@ nav: - "定制 Debian 13 镜像": tech/Customize-Debian-13-Image.md - "手把手教你备份和还原 Docker 卷": tech/Backup-and-Restore-of-Docker-Volumes-A-Step-by-Step-Guide.md - "在 Ubuntu 24.04 上添加交换空间": tech/How-to-Add-Swap-Space-on-Ubuntu-2404.md + - "Proxmox 8.4.21 修复 intel-microcode 不生效": tech/Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md - "macOS 26 配置 SSH 密钥登录和修改 SSH 监听端口": tech/macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md - "创建和管理 Linux 服务器用于身份验证的 SSH 密钥": tech/Creating-and-Managing-SSH-Keys-for-Authentication-on-Linux-Servers.md - "服务器运行与维护常用命令": tech/Commands-for-Server-Operation-and-Maintenance.md