github.com/u-root/u-root@v7.0.1-0.20200915234505-ad7babab0a8e+incompatible/cmds/core/lockmsrs/lockmsrs_linux.go (about)

     1  // Copyright 2012-2020 the u-root Authors. All rights reserved
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // lockmsrs locks important intel MSRs.
     6  //
     7  // All MSRs are specified in the Intel Software developer's manual.
     8  // This seems like a good set of bits to lock down when booting through NERF/LINUXBOOT
     9  // to some other OS. When locked, these MSRs generally prevent
    10  // further modifications until reset.
    11  package main
    12  
    13  import (
    14  	"flag"
    15  	"log"
    16  	"os"
    17  
    18  	"github.com/u-root/u-root/pkg/msr"
    19  )
    20  
    21  var (
    22  	verbose = flag.Bool("v", false, "verbose mode")
    23  	verify  = flag.Bool("V", false, "Verify, do not write")
    24  	debug   = func(string, ...interface{}) {}
    25  )
    26  
    27  func main() {
    28  	flag.Parse()
    29  
    30  	if *verbose {
    31  		debug = log.Printf
    32  	}
    33  
    34  	msr.Debug = debug
    35  
    36  	if *verify {
    37  		if err := msr.Locked(); err != nil {
    38  			log.Fatal(err)
    39  		}
    40  		os.Exit(0)
    41  	}
    42  
    43  	cpus, err := msr.AllCPUs()
    44  	if err != nil {
    45  		log.Fatal(err)
    46  	}
    47  	for _, m := range msr.LockIntel {
    48  		debug("Lock MSR %s on cpus %v, clearmask %#08x, setmask %#08x", m.String(), cpus, m.Clear, m.Set)
    49  		var errs []error
    50  		if m.WriteOnly {
    51  			errs = m.Addr.Write(cpus, m.Set)
    52  		} else {
    53  			errs = m.Addr.TestAndSet(cpus, m.Clear, m.Set)
    54  		}
    55  
    56  		for i, e := range errs {
    57  			if e != nil {
    58  				// Hope no one ever modifies this slice.
    59  				log.Printf("Error locking msr %v on cpu %v: %v\n", m.Addr.String(), cpus[i], e)
    60  			}
    61  		}
    62  	}
    63  }