跳转至

Proxmox 8.4.21 修复 intel-microcode 不生效

  • 主机：零刻 SEi12
  • 系统环境: Linux CatTomServer3 6.8.12-20-pve #1 SMP PREEMPT_DYNAMIC PMX 6.8.12-20 (2026-03-13T08:15Z) x86_64 GNU/Linux
  • 问题: lscpu 报告 Reg file data sampling: Vulnerable: No microcode，此前已执行 apt install intel-microcode，并且已经重启主机。

lscpu 输出：

root@CatTomServer3:~# lscpu
Architecture:                x86_64
  CPU op-mode(s):            32-bit, 64-bit
  Address sizes:             39 bits physical, 48 bits virtual
  Byte Order:                Little Endian
CPU(s):                      12
  On-line CPU(s) list:       0-11
Vendor ID:                   GenuineIntel
  BIOS Vendor ID:            Intel(R) Corporation
  Model name:                12th Gen Intel(R) Core(TM) i5-12450H
    BIOS Model name:         12th Gen Intel(R) Core(TM) i5-12450H To Be Filled By O.E.M. CPU @ 4.0GHz
    BIOS CPU family:         205
    CPU family:              6
    Model:                   154
    Thread(s) per core:      2
    Core(s) per socket:      8
    Socket(s):               1
    Stepping:                3
    CPU(s) scaling MHz:      48%
    CPU max MHz:             4400.0000
    CPU min MHz:             400.0000
    BogoMIPS:                2227.20
    Flags:                   fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mm
                             x fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon peb
                             s bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dte
                             s64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm sse4_1 sse4_2 x2apic movbe
                              popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault
                             epb cat_l2 cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_a
                             d fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a rdseed adx smap clflushopt clw
                             b intel_pt sha_ni xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk avx_vnni dthe
                             rm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req hfi vnmi umip pku osp
                             ke waitpkg gfni vaes vpclmulqdq rdpid movdiri movdir64b fsrm md_clear serialize arch_lbr ib
                             t flush_l1d arch_capabilities ibpb_exit_to_user
Virtualization features:
  Virtualization:            VT-x
Caches (sum of all):
  L1d:                       320 KiB (8 instances)
  L1i:                       384 KiB (8 instances)
  L2:                        7 MiB (5 instances)
  L3:                        12 MiB (1 instance)
NUMA:
  NUMA node(s):              1
  NUMA node0 CPU(s):         0-11
Vulnerabilities:
  Gather data sampling:      Not affected
  Indirect target selection: Not affected
  Itlb multihit:             Not affected
  L1tf:                      Not affected
  Mds:                       Not affected
  Meltdown:                  Not affected
  Mmio stale data:           Not affected
  Reg file data sampling:    Vulnerable: No microcode
  Retbleed:                  Not affected
  Spec rstack overflow:      Not affected
  Spec store bypass:         Mitigation; Speculative Store Bypass disabled via prctl
  Spectre v1:                Mitigation; usercopy/swapgs barriers and __user pointer sanitization
  Spectre v2:                Mitigation; Enhanced / Automatic IBRS; IBPB conditional; PBRSB-eIBRS SW sequence; BHI SW lo
                             op, KVM SW loop
  Srbds:                     Not affected
  Tsa:                       Not affected
  Tsx async abort:           Not affected
  Vmscape:                   Mitigation; IBPB before exit to userspace

grep microcode /proc/cpuinfo | uniq 输出:

root@CatTomServer3:~# grep microcode /proc/cpuinfo | uniq
microcode       : 0x416

dmesg | grep microcode 输出:

root@CatTomServer3:~# dmesg | grep microcode
[    0.099733] Register File Data Sampling: Vulnerable: No microcode
[    0.628218] microcode: Current revision: 0x00000416

修复步骤

检查 microcode 加载条件

cat /proc/cmdline
iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03
grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode
lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'

root@CatTomServer3:~# cat /proc/cmdline
BOOT_IMAGE=/boot/vmlinuz-6.8.12-20-pve root=/dev/mapper/pve-root ro quiet

root@CatTomServer3:~# iucode_tool -S -l /lib/firmware/intel-ucode/06-9a-03
iucode_tool: system has processor(s) with signature 0x000906a3
microcode bundle 1: /lib/firmware/intel-ucode/06-9a-03
selected microcodes:
  001/001: sig 0x000906a3, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256
  001/001: sig 0x000906a4, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256

root@CatTomServer3:~# grep -vE '^[[:space:]]*(#|$)' /etc/default/intel-microcode
IUCODE_TOOL_INITRAMFS=auto

root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
(no output)

上述检查结果表明: intel-microcode 已正确安装最新版本，但未写入 initrd.img 中，因此未能生效。

重新生成 initramfs

update-initramfs -u -k all -v

root@CatTomServer3:~# lsinitramfs "/boot/initrd.img-$(uname -r)" | grep 'kernel/x86/microcode/GenuineIntel.bin'
kernel/x86/microcode/GenuineIntel.bin

重新生成 initramfs 后， intel-microcode 已写入 initrd.img 中，重启服务器即可。

验证 microcode 正确加载

grep microcode /proc/cpuinfo | sort -u
dmesg | grep -Ei 'microcode|Register File Data Sampling'
cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling

root@CatTomServer3:~# grep microcode /proc/cpuinfo | sort -u
microcode       : 0x43a

root@CatTomServer3:~# dmesg | grep -Ei 'microcode|Register File Data Sampling'
[    0.099051] Register File Data Sampling: Mitigation: Clear Register File
[    0.639631] microcode: Current revision: 0x0000043a
[    0.639632] microcode: Updated early from: 0x00000416

root@CatTomServer3:~# cat /sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling
Mitigation: Clear Register File

上述检查结果表明: microcode 已正确加载。