Add Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md

docs/tech/Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md

@@ -0,0 +1,164 @@
+# Proxmox 8.4.21 修复 intel-microcode 不生效
+
+- 主机：零刻 SEi12
+- 系统环境: `Linux CatTomServer3 6.8.12-20-pve #1 SMP PREEMPT_DYNAMIC PMX 6.8.12-20 (2026-03-13T08:15Z) x86_64 GNU/Linux`
+- 问题: `lscpu` 报告 `Reg file data sampling: Vulnerable: No microcode`，此前已执行 `apt install intel-microcode`，并且已经重启主机。
+
+**`lscpu` 输出**：
+
+``` hl_lines="52"
+root@CatTomServer3:~# lscpu
+Architecture:                x86_64
+  CPU op-mode(s):            32-bit, 64-bit
+  Address sizes:             39 bits physical, 48 bits virtual
+  Byte Order:                Little Endian
+CPU(s):                      12
+  On-line CPU(s) list:       0-11
+Vendor ID:                   GenuineIntel
+  BIOS Vendor ID:            Intel(R) Corporation
+  Model name:                12th Gen Intel(R) Core(TM) i5-12450H
+    BIOS Model name:         12th Gen Intel(R) Core(TM) i5-12450H To Be Filled By O.E.M. CPU @ 4.0GHz
+    BIOS CPU family:         205
+    CPU family:              6
+    Model:                   154
+    Thread(s) per core:      2
+    Core(s) per socket:      8
+    Socket(s):               1
+    Stepping:                3
+    CPU(s) scaling MHz:      48%
+    CPU max MHz:             4400.0000
+    CPU min MHz:             400.0000
+    BogoMIPS:                2227.20
+    Flags:                   fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mm
+                             x fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon peb
+                             s bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dte
+                             s64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm sse4_1 sse4_2 x2apic movbe
+                              popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault
+                             epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_a
+                             d fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a rdseed adx smap clflushopt clw
+                             b intel_pt sha_ni xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk avx_vnni dthe
+                             rm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req hfi vnmi umip pku osp
+                             ke waitpkg gfni vaes vpclmulqdq rdpid movdiri movdir64b fsrm md_clear serialize arch_lbr ib
+                             t flush_l1d arch_capabilities ibpb_exit_to_user
+Virtualization features:
+  Virtualization:            VT-x
+Caches (sum of all):
+  L1d:                       320 KiB (8 instances)
+  L1i:                       384 KiB (8 instances)
+  L2:                        7 MiB (5 instances)
+  L3:                        12 MiB (1 instance)
+NUMA:
+  NUMA node(s):              1
+  NUMA node0 CPU(s):         0-11
+Vulnerabilities:
+  Gather data sampling:      Not affected
+  Indirect target selection: Not affected
+  Itlb multihit:             Not affected
+  L1tf:                      Not affected
+  Mds:                       Not affected
+  Meltdown:                  Not affected
+  Mmio stale data:           Not affected
+  Reg file data sampling:    Vulnerable: No microcode
+  Retbleed:                  Not affected
+  Spec rstack overflow:      Not affected
+  Spec store bypass:         Mitigation; Speculative Store Bypass disabled via prctl
+  Spectre v1:                Mitigation; usercopy/swapgs barriers and __user pointer sanitization
+  Spectre v2:                Mitigation; Enhanced / Automatic IBRS; IBPB conditional; PBRSB-eIBRS SW sequence; BHI SW lo
+                             op, KVM SW loop
+  Srbds:                     Not affected
+  Tsa:                       Not affected
+  Tsx async abort:           Not affected
+  Vmscape:                   Mitigation; IBPB before exit to userspace
+```
+
+**`grep microcode /proc/cpuinfo | uniq` 输出**:
+
+```
+root@CatTomServer3:~# grep microcode /proc/cpuinfo | uniq
+microcode       : 0x416
+```
+
+**`dmesg | grep microcode` 输出**:
+
+```
+root@CatTomServer3:~# dmesg | grep microcode
+[    0.099733] Register File Data Sampling: Vulnerable: No microcode
+[    0.628218] microcode: Current revision: 0x00000416
+```
+
+## 修复步骤
+
+### 检查 microcode 加载条件
+
+```bash
+cat /proc/cmdline
+iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03
+grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode
+lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
+```
+
+```
+root@CatTomServer3:~# cat /proc/cmdline
+BOOT_IMAGE=/boot/vmlinuz-6.8.12-20-pve root=/dev/mapper/pve-root ro quiet
+```
+
+``` hl_lines="5"
+root@CatTomServer3:~# iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03
+iucode_tool: system has processor(s) with signature 0x000906a3
+microcode bundle 1: /lib/firmware/intel-ucode/06-9a-03
+selected microcodes:
+  001/001: sig 0x000906a3, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256
+  001/001: sig 0x000906a4, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256
+```
+
+```
+root@CatTomServer3:~# grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode
+IUCODE_TOOL_INITRAMFS=auto
+```
+
+```
+root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
+(no output)
+```
+
+上述检查结果表明: `intel-microcode` 已正确安装最新版本，但未写入 `initrd.img` 中，因此未能生效。
+
+### 重新生成 initramfs
+
+```bash
+update-initramfs -u -k all -v
+```
+
+```
+root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
+kernel/x86/microcode/GenuineIntel.bin
+```
+
+重新生成 initramfs 后， `intel-microcode` 已写入 `initrd.img` 中，重启服务器即可。
+
+### 验证 microcode 正确加载
+
+```bash
+grep microcode /proc/cpuinfo | sort -u
+dmesg | grep -Ei 'microcode|Register File Data Sampling'
+cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
+```
+
+``` hl_lines="2"
+root@CatTomServer3:~# grep microcode /proc/cpuinfo | sort -u
+microcode       : 0x43a
+```
+
+``` hl_lines="4"
+root@CatTomServer3:~# dmesg | grep -Ei 'microcode|Register File Data Sampling'
+[    0.099051] Register File Data Sampling: Mitigation: Clear Register File
+[    0.639631] microcode: Current revision: 0x0000043a
+[    0.639632] microcode: Updated early from: 0x00000416
+```
+
+``` hl_lines="2"
+root@CatTomServer3:~# cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
+Mitigation: Clear Register File
+```
+
+上述检查结果表明: microcode 已正确加载。

mkdocs.yml

@@ -108,6 +108,7 @@ nav:
       - "定制 Debian 13 镜像": tech/Customize-Debian-13-Image.md
       - "手把手教你备份和还原 Docker 卷": tech/Backup-and-Restore-of-Docker-Volumes-A-Step-by-Step-Guide.md
       - "在 Ubuntu 24.04 上添加交换空间": tech/How-to-Add-Swap-Space-on-Ubuntu-2404.md
+      - "Proxmox 8.4.21 修复 intel-microcode 不生效": tech/Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md
       - "macOS 26 配置 SSH 密钥登录和修改 SSH 监听端口": tech/macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md
       - "创建和管理 Linux 服务器用于身份验证的 SSH 密钥": tech/Creating-and-Managing-SSH-Keys-for-Authentication-on-Linux-Servers.md
       - "服务器运行与维护常用命令": tech/Commands-for-Server-Operation-and-Maintenance.md