164 lines
6.5 KiB
Markdown
164 lines
6.5 KiB
Markdown
# Proxmox 8.4.21 修复 intel-microcode 不生效
|
||
|
||
- 主机：零刻 SEi12
|
||
- 系统环境: `Linux CatTomServer3 6.8.12-20-pve #1 SMP PREEMPT_DYNAMIC PMX 6.8.12-20 (2026-03-13T08:15Z) x86_64 GNU/Linux`
|
||
- 问题: `lscpu` 报告 `Reg file data sampling: Vulnerable: No microcode`，此前已执行 `apt install intel-microcode`，并且已经重启主机。
|
||
|
||
**`lscpu` 输出**：
|
||
|
||
``` hl_lines="52"
|
||
root@CatTomServer3:~# lscpu
|
||
Architecture: x86_64
|
||
CPU op-mode(s): 32-bit, 64-bit
|
||
Address sizes: 39 bits physical, 48 bits virtual
|
||
Byte Order: Little Endian
|
||
CPU(s): 12
|
||
On-line CPU(s) list: 0-11
|
||
Vendor ID: GenuineIntel
|
||
BIOS Vendor ID: Intel(R) Corporation
|
||
Model name: 12th Gen Intel(R) Core(TM) i5-12450H
|
||
BIOS Model name: 12th Gen Intel(R) Core(TM) i5-12450H To Be Filled By O.E.M. CPU @ 4.0GHz
|
||
BIOS CPU family: 205
|
||
CPU family: 6
|
||
Model: 154
|
||
Thread(s) per core: 2
|
||
Core(s) per socket: 8
|
||
Socket(s): 1
|
||
Stepping: 3
|
||
CPU(s) scaling MHz: 48%
|
||
CPU max MHz: 4400.0000
|
||
CPU min MHz: 400.0000
|
||
BogoMIPS: 2227.20
|
||
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mm
|
||
x fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon peb
|
||
s bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dte
|
||
s64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm sse4_1 sse4_2 x2apic movbe
|
||
popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault
|
||
epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_a
|
||
d fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a rdseed adx smap clflushopt clw
|
||
b intel_pt sha_ni xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk avx_vnni dthe
|
||
rm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req hfi vnmi umip pku osp
|
||
ke waitpkg gfni vaes vpclmulqdq rdpid movdiri movdir64b fsrm md_clear serialize arch_lbr ib
|
||
t flush_l1d arch_capabilities ibpb_exit_to_user
|
||
Virtualization features:
|
||
Virtualization: VT-x
|
||
Caches (sum of all):
|
||
L1d: 320 KiB (8 instances)
|
||
L1i: 384 KiB (8 instances)
|
||
L2: 7 MiB (5 instances)
|
||
L3: 12 MiB (1 instance)
|
||
NUMA:
|
||
NUMA node(s): 1
|
||
NUMA node0 CPU(s): 0-11
|
||
Vulnerabilities:
|
||
Gather data sampling: Not affected
|
||
Indirect target selection: Not affected
|
||
Itlb multihit: Not affected
|
||
L1tf: Not affected
|
||
Mds: Not affected
|
||
Meltdown: Not affected
|
||
Mmio stale data: Not affected
|
||
Reg file data sampling: Vulnerable: No microcode
|
||
Retbleed: Not affected
|
||
Spec rstack overflow: Not affected
|
||
Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl
|
||
Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization
|
||
Spectre v2: Mitigation; Enhanced / Automatic IBRS; IBPB conditional; PBRSB-eIBRS SW sequence; BHI SW lo
|
||
op, KVM SW loop
|
||
Srbds: Not affected
|
||
Tsa: Not affected
|
||
Tsx async abort: Not affected
|
||
Vmscape: Mitigation; IBPB before exit to userspace
|
||
```
|
||
|
||
**`grep microcode /proc/cpuinfo | uniq` 输出**:
|
||
|
||
```
|
||
root@CatTomServer3:~# grep microcode /proc/cpuinfo | uniq
|
||
microcode : 0x416
|
||
```
|
||
|
||
**`dmesg | grep microcode` 输出**:
|
||
|
||
```
|
||
root@CatTomServer3:~# dmesg | grep microcode
|
||
[ 0.099733] Register File Data Sampling: Vulnerable: No microcode
|
||
[ 0.628218] microcode: Current revision: 0x00000416
|
||
```
|
||
|
||
## 修复步骤
|
||
|
||
### 检查 microcode 加载条件
|
||
|
||
```bash
|
||
cat /proc/cmdline
|
||
iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03
|
||
grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode
|
||
lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
|
||
```
|
||
|
||
```
|
||
root@CatTomServer3:~# cat /proc/cmdline
|
||
BOOT_IMAGE=/boot/vmlinuz-6.8.12-20-pve root=/dev/mapper/pve-root ro quiet
|
||
```
|
||
|
||
``` hl_lines="5"
|
||
root@CatTomServer3:~# iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03
|
||
iucode_tool: system has processor(s) with signature 0x000906a3
|
||
microcode bundle 1: /lib/firmware/intel-ucode/06-9a-03
|
||
selected microcodes:
|
||
001/001: sig 0x000906a3, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256
|
||
001/001: sig 0x000906a4, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256
|
||
```
|
||
|
||
```
|
||
root@CatTomServer3:~# grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode
|
||
IUCODE_TOOL_INITRAMFS=auto
|
||
```
|
||
|
||
```
|
||
root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
|
||
(no output)
|
||
```
|
||
|
||
上述检查结果表明: `intel-microcode` 已正确安装最新版本，但未写入 `initrd.img` 中，因此未能生效。
|
||
|
||
### 重新生成 initramfs
|
||
|
||
```bash
|
||
update-initramfs -u -k all -v
|
||
```
|
||
|
||
```
|
||
root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
|
||
kernel/x86/microcode/GenuineIntel.bin
|
||
```
|
||
|
||
重新生成 initramfs 后， `intel-microcode` 已写入 `initrd.img` 中，重启服务器即可。
|
||
|
||
### 验证 microcode 正确加载
|
||
|
||
```bash
|
||
grep microcode /proc/cpuinfo | sort -u
|
||
dmesg | grep -Ei 'microcode|Register File Data Sampling'
|
||
cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
|
||
```
|
||
|
||
``` hl_lines="2"
|
||
root@CatTomServer3:~# grep microcode /proc/cpuinfo | sort -u
|
||
microcode : 0x43a
|
||
```
|
||
|
||
``` hl_lines="4"
|
||
root@CatTomServer3:~# dmesg | grep -Ei 'microcode|Register File Data Sampling'
|
||
[ 0.099051] Register File Data Sampling: Mitigation: Clear Register File
|
||
[ 0.639631] microcode: Current revision: 0x0000043a
|
||
[ 0.639632] microcode: Updated early from: 0x00000416
|
||
```
|
||
|
||
``` hl_lines="2"
|
||
root@CatTomServer3:~# cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
|
||
Mitigation: Clear Register File
|
||
```
|
||
|
||
上述检查结果表明: microcode 已正确加载。 |