# Proxmox 8.4.21 修复 intel-microcode 不生效 - 主机：零刻 SEi12 - 系统环境: `Linux CatTomServer3 6.8.12-20-pve #1 SMP PREEMPT_DYNAMIC PMX 6.8.12-20 (2026-03-13T08:15Z) x86_64 GNU/Linux` - 问题: `lscpu` 报告 `Reg file data sampling: Vulnerable: No microcode`，此前已执行 `apt install intel-microcode`，并且已经重启主机。 **`lscpu` 输出**： ``` hl_lines="52" root@CatTomServer3:~# lscpu Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Address sizes: 39 bits physical, 48 bits virtual Byte Order: Little Endian CPU(s): 12 On-line CPU(s) list: 0-11 Vendor ID: GenuineIntel BIOS Vendor ID: Intel(R) Corporation Model name: 12th Gen Intel(R) Core(TM) i5-12450H BIOS Model name: 12th Gen Intel(R) Core(TM) i5-12450H To Be Filled By O.E.M. CPU @ 4.0GHz BIOS CPU family: 205 CPU family: 6 Model: 154 Thread(s) per core: 2 Core(s) per socket: 8 Socket(s): 1 Stepping: 3 CPU(s) scaling MHz: 48% CPU max MHz: 4400.0000 CPU min MHz: 400.0000 BogoMIPS: 2227.20 Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mm x fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon peb s bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dte s64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_a d fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a rdseed adx smap clflushopt clw b intel_pt sha_ni xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk avx_vnni dthe rm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req hfi vnmi umip pku osp ke waitpkg gfni vaes vpclmulqdq rdpid movdiri movdir64b fsrm md_clear serialize arch_lbr ib t flush_l1d arch_capabilities ibpb_exit_to_user Virtualization features: Virtualization: VT-x Caches (sum of all): L1d: 320 KiB (8 instances) L1i: 384 KiB (8 instances) L2: 7 MiB (5 instances) L3: 12 MiB (1 instance) NUMA: NUMA node(s): 1 NUMA node0 CPU(s): 0-11 Vulnerabilities: Gather data sampling: Not affected Indirect target selection: Not affected Itlb multihit: Not affected L1tf: Not affected Mds: Not affected Meltdown: Not affected Mmio stale data: Not affected Reg file data sampling: Vulnerable: No microcode Retbleed: Not affected Spec rstack overflow: Not affected Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization Spectre v2: Mitigation; Enhanced / Automatic IBRS; IBPB conditional; PBRSB-eIBRS SW sequence; BHI SW lo op, KVM SW loop Srbds: Not affected Tsa: Not affected Tsx async abort: Not affected Vmscape: Mitigation; IBPB before exit to userspace ``` **`grep microcode /proc/cpuinfo | uniq` 输出**: ``` root@CatTomServer3:~# grep microcode /proc/cpuinfo | uniq microcode : 0x416 ``` **`dmesg | grep microcode` 输出**: ``` root@CatTomServer3:~# dmesg | grep microcode [ 0.099733] Register File Data Sampling: Vulnerable: No microcode [ 0.628218] microcode: Current revision: 0x00000416 ``` ## 修复步骤 ### 检查 microcode 加载条件 ```bash cat /proc/cmdline iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03 grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin' ``` ``` root@CatTomServer3:~# cat /proc/cmdline BOOT_IMAGE=/boot/vmlinuz-6.8.12-20-pve root=/dev/mapper/pve-root ro quiet ``` ``` hl_lines="5" root@CatTomServer3:~# iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03 iucode_tool: system has processor(s) with signature 0x000906a3 microcode bundle 1: /lib/firmware/intel-ucode/06-9a-03 selected microcodes: 001/001: sig 0x000906a3, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256 001/001: sig 0x000906a4, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256 ``` ``` root@CatTomServer3:~# grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode IUCODE_TOOL_INITRAMFS=auto ``` ``` root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin' (no output) ``` 上述检查结果表明: `intel-microcode` 已正确安装最新版本，但未写入 `initrd.img` 中，因此未能生效。 ### 重新生成 initramfs ```bash update-initramfs -u -k all -v ``` ``` root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin' kernel/x86/microcode/GenuineIntel.bin ``` 重新生成 initramfs 后， `intel-microcode` 已写入 `initrd.img` 中，重启服务器即可。 ### 验证 microcode 正确加载 ```bash grep microcode /proc/cpuinfo | sort -u dmesg | grep -Ei 'microcode|Register File Data Sampling' cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling ``` ``` hl_lines="2" root@CatTomServer3:~# grep microcode /proc/cpuinfo | sort -u microcode : 0x43a ``` ``` hl_lines="4" root@CatTomServer3:~# dmesg | grep -Ei 'microcode|Register File Data Sampling' [ 0.099051] Register File Data Sampling: Mitigation: Clear Register File [ 0.639631] microcode: Current revision: 0x0000043a [ 0.639632] microcode: Updated early from: 0x00000416 ``` ``` hl_lines="2" root@CatTomServer3:~# cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling Mitigation: Clear Register File ``` 上述检查结果表明: microcode 已正确加载。