Add Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md
Deploy / deploy (push) Successful in 1m27s
Deploy / deploy (push) Successful in 1m27s
This commit is contained in:
2 files changed
+165
No files matched your search
@@ -0,0 +1,164 @@
|
||||
# Proxmox 8.4.21 修复 intel-microcode 不生效
|
||||
|
||||
- 主机：零刻 SEi12
|
||||
- 系统环境: `Linux CatTomServer3 6.8.12-20-pve #1 SMP PREEMPT_DYNAMIC PMX 6.8.12-20 (2026-03-13T08:15Z) x86_64 GNU/Linux`
|
||||
- 问题: `lscpu` 报告 `Reg file data sampling: Vulnerable: No microcode`，此前已执行 `apt install intel-microcode`，并且已经重启主机。
|
||||
|
||||
**`lscpu` 输出**：
|
||||
|
||||
``` hl_lines="52"
|
||||
root@CatTomServer3:~# lscpu
|
||||
Architecture: x86_64
|
||||
CPU op-mode(s): 32-bit, 64-bit
|
||||
Address sizes: 39 bits physical, 48 bits virtual
|
||||
Byte Order: Little Endian
|
||||
CPU(s): 12
|
||||
On-line CPU(s) list: 0-11
|
||||
Vendor ID: GenuineIntel
|
||||
BIOS Vendor ID: Intel(R) Corporation
|
||||
Model name: 12th Gen Intel(R) Core(TM) i5-12450H
|
||||
BIOS Model name: 12th Gen Intel(R) Core(TM) i5-12450H To Be Filled By O.E.M. CPU @ 4.0GHz
|
||||
BIOS CPU family: 205
|
||||
CPU family: 6
|
||||
Model: 154
|
||||
Thread(s) per core: 2
|
||||
Core(s) per socket: 8
|
||||
Socket(s): 1
|
||||
Stepping: 3
|
||||
CPU(s) scaling MHz: 48%
|
||||
CPU max MHz: 4400.0000
|
||||
CPU min MHz: 400.0000
|
||||
BogoMIPS: 2227.20
|
||||
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mm
|
||||
x fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon peb
|
||||
s bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dte
|
||||
s64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm sse4_1 sse4_2 x2apic movbe
|
||||
popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault
|
||||
epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_a
|
||||
d fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a rdseed adx smap clflushopt clw
|
||||
b intel_pt sha_ni xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk avx_vnni dthe
|
||||
rm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req hfi vnmi umip pku osp
|
||||
ke waitpkg gfni vaes vpclmulqdq rdpid movdiri movdir64b fsrm md_clear serialize arch_lbr ib
|
||||
t flush_l1d arch_capabilities ibpb_exit_to_user
|
||||
Virtualization features:
|
||||
Virtualization: VT-x
|
||||
Caches (sum of all):
|
||||
L1d: 320 KiB (8 instances)
|
||||
L1i: 384 KiB (8 instances)
|
||||
L2: 7 MiB (5 instances)
|
||||
L3: 12 MiB (1 instance)
|
||||
NUMA:
|
||||
NUMA node(s): 1
|
||||
NUMA node0 CPU(s): 0-11
|
||||
Vulnerabilities:
|
||||
Gather data sampling: Not affected
|
||||
Indirect target selection: Not affected
|
||||
Itlb multihit: Not affected
|
||||
L1tf: Not affected
|
||||
Mds: Not affected
|
||||
Meltdown: Not affected
|
||||
Mmio stale data: Not affected
|
||||
Reg file data sampling: Vulnerable: No microcode
|
||||
Retbleed: Not affected
|
||||
Spec rstack overflow: Not affected
|
||||
Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl
|
||||
Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization
|
||||
Spectre v2: Mitigation; Enhanced / Automatic IBRS; IBPB conditional; PBRSB-eIBRS SW sequence; BHI SW lo
|
||||
op, KVM SW loop
|
||||
Srbds: Not affected
|
||||
Tsa: Not affected
|
||||
Tsx async abort: Not affected
|
||||
Vmscape: Mitigation; IBPB before exit to userspace
|
||||
```
|
||||
|
||||
**`grep microcode /proc/cpuinfo | uniq` 输出**:
|
||||
|
||||
```
|
||||
root@CatTomServer3:~# grep microcode /proc/cpuinfo | uniq
|
||||
microcode : 0x416
|
||||
```
|
||||
|
||||
**`dmesg | grep microcode` 输出**:
|
||||
|
||||
```
|
||||
root@CatTomServer3:~# dmesg | grep microcode
|
||||
[ 0.099733] Register File Data Sampling: Vulnerable: No microcode
|
||||
[ 0.628218] microcode: Current revision: 0x00000416
|
||||
```
|
||||
|
||||
## 修复步骤
|
||||
|
||||
### 检查 microcode 加载条件
|
||||
|
||||
```bash
|
||||
cat /proc/cmdline
|
||||
iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03
|
||||
grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode
|
||||
lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
|
||||
```
|
||||
|
||||
```
|
||||
root@CatTomServer3:~# cat /proc/cmdline
|
||||
BOOT_IMAGE=/boot/vmlinuz-6.8.12-20-pve root=/dev/mapper/pve-root ro quiet
|
||||
```
|
||||
|
||||
``` hl_lines="5"
|
||||
root@CatTomServer3:~# iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03
|
||||
iucode_tool: system has processor(s) with signature 0x000906a3
|
||||
microcode bundle 1: /lib/firmware/intel-ucode/06-9a-03
|
||||
selected microcodes:
|
||||
001/001: sig 0x000906a3, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256
|
||||
001/001: sig 0x000906a4, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256
|
||||
```
|
||||
|
||||
```
|
||||
root@CatTomServer3:~# grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode
|
||||
IUCODE_TOOL_INITRAMFS=auto
|
||||
```
|
||||
|
||||
```
|
||||
root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
|
||||
(no output)
|
||||
```
|
||||
|
||||
上述检查结果表明: `intel-microcode` 已正确安装最新版本，但未写入 `initrd.img` 中，因此未能生效。
|
||||
|
||||
### 重新生成 initramfs
|
||||
|
||||
```bash
|
||||
update-initramfs -u -k all -v
|
||||
```
|
||||
|
||||
```
|
||||
root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
|
||||
kernel/x86/microcode/GenuineIntel.bin
|
||||
```
|
||||
|
||||
重新生成 initramfs 后， `intel-microcode` 已写入 `initrd.img` 中，重启服务器即可。
|
||||
|
||||
### 验证 microcode 正确加载
|
||||
|
||||
```bash
|
||||
grep microcode /proc/cpuinfo | sort -u
|
||||
dmesg | grep -Ei 'microcode|Register File Data Sampling'
|
||||
cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
|
||||
```
|
||||
|
||||
``` hl_lines="2"
|
||||
root@CatTomServer3:~# grep microcode /proc/cpuinfo | sort -u
|
||||
microcode : 0x43a
|
||||
```
|
||||
|
||||
``` hl_lines="4"
|
||||
root@CatTomServer3:~# dmesg | grep -Ei 'microcode|Register File Data Sampling'
|
||||
[ 0.099051] Register File Data Sampling: Mitigation: Clear Register File
|
||||
[ 0.639631] microcode: Current revision: 0x0000043a
|
||||
[ 0.639632] microcode: Updated early from: 0x00000416
|
||||
```
|
||||
|
||||
``` hl_lines="2"
|
||||
root@CatTomServer3:~# cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
|
||||
Mitigation: Clear Register File
|
||||
```
|
||||
|
||||
上述检查结果表明: microcode 已正确加载。
|
||||
@@ -108,6 +108,7 @@ nav:
|
||||
- "定制 Debian 13 镜像": tech/Customize-Debian-13-Image.md
|
||||
- "手把手教你备份和还原 Docker 卷": tech/Backup-and-Restore-of-Docker-Volumes-A-Step-by-Step-Guide.md
|
||||
- "在 Ubuntu 24.04 上添加交换空间": tech/How-to-Add-Swap-Space-on-Ubuntu-2404.md
|
||||
- "Proxmox 8.4.21 修复 intel-microcode 不生效": tech/Proxmox-8.4.21-fixes-intel-microcode-not-taking-effect.md
|
||||
- "macOS 26 配置 SSH 密钥登录和修改 SSH 监听端口": tech/macOS-26-Configure-SSH-key-based-login-and-change-the-SSH-listening-port.md
|
||||
- "创建和管理 Linux 服务器用于身份验证的 SSH 密钥": tech/Creating-and-Managing-SSH-Keys-for-Authentication-on-Linux-Servers.md
|
||||
- "服务器运行与维护常用命令": tech/Commands-for-Server-Operation-and-Maintenance.md
|
||||
|
||||
Reference in new issue
Block a user