Operation not permitted

[HeylonNHP]

When reading or applying undervolt settings I get operation not permitted
heylon@heylon-Lenovo-IdeaPad-S145-15IWL:~/git/intel-undervolt$ sudo intel-undervolt read CPU (0): Operation not permitted GPU (1): Operation not permitted CPU Cache (2): Operation not permitted System Agent (3): Operation not permitted Analog I/O (4): Operation not permitted heylon@heylon-Lenovo-IdeaPad-S145-15IWL:~/git/intel-undervolt$ sudo intel-undervolt apply CPU (0): Operation not permitted GPU (1): Operation not permitted CPU Cache (2): Operation not permitted System Agent (3): Operation not permitted Analog I/O (4): Operation not permitted
Trying without sudo and I get:
heylon@heylon-Lenovo-IdeaPad-S145-15IWL:~/git/intel-undervolt$ intel-undervolt apply Failed to open MSR device: Permission denied Failed to setup the program heylon@heylon-Lenovo-IdeaPad-S145-15IWL:~/git/intel-undervolt$ intel-undervolt read Failed to open MSR device: Permission denied Failed to setup the program
Not sure what's the issue
Installed as per instructions on Ubuntu 19.10 running on a laptop with an Intel i7-8565U

[rbikbov]

@HeylonNHP This answer works for me.
#17 (comment)

[kinghajj]

Is there no way to keep SecureBoot enabled and still have this tool work? Maybe a kernel module could be used to override the kernel's default behavior of denying access to the MSR to userland.

[kinghajj]

To anyone else who's having this issue and wants to keep SecureBoot on, I found a way. It requires building a custom version of the msr kernel module. For the current Ubuntu 20.04 kernel, the patch looks like this:

--- ./msr.c     2019-11-24 16:32:01.000000000 -0800
+++ ./linux-source-5.4.0/arch/x86/kernel/msr.c  2020-05-15 19:19:43.790524038 -0700
@@ -77,15 +77,15 @@
        u32 data[2];
        u32 reg = *ppos;
        int cpu = iminor(file_inode(file));
        int err = 0;
        ssize_t bytes = 0;

-       err = security_locked_down(LOCKDOWN_MSR);
-       if (err)
-               return err;
+       //err = security_locked_down(LOCKDOWN_MSR);
+       //if (err)
+       //      return err;

        if (count % 8)
                return -EINVAL; /* Invalid chunk size */

        for (; count; count -= 8) {
                if (copy_from_user(&data, tmp, 8)) {
@@ -132,15 +132,15 @@
                        break;
                }
                if (copy_from_user(&regs, uregs, sizeof(regs))) {
                        err = -EFAULT;
                        break;
                }
-               err = security_locked_down(LOCKDOWN_MSR);
-               if (err)
-                       break;
+               //err = security_locked_down(LOCKDOWN_MSR);
+               //if (err)
+               //      break;
                err = wrmsr_safe_regs_on_cpu(cpu, regs);
                if (err)
                        break;
                if (copy_to_user(uregs, &regs, sizeof(regs)))
                        err = -EFAULT;
                break;

Pretty straightforward, just don't check if the kernel is in "lockdown mode," and let writes through. Build the module, sign it, and replace the stock msr.ko under /lib/modules/<kernel version>. You also need to run setcap to give CAP_SYS_RAWIO to the intel-undervolt executable, so that it can open the MSR device files at all.

setcap cap_sys_rawio=ep `which intel-undervolt`

An orthogonal issue, is that recent Dell BIOS updates have new Intel microcode that disables changing the voltage settings through the MSR at all, so you may have to reset your BIOS to factory settings.

[lzyang2000]

To anyone else who's having this issue and wants to keep SecureBoot on, I found a way. It requires building a custom version of the msr kernel module. For the current Ubuntu 20.04 kernel, the patch looks like this:

--- ./msr.c     2019-11-24 16:32:01.000000000 -0800
+++ ./linux-source-5.4.0/arch/x86/kernel/msr.c  2020-05-15 19:19:43.790524038 -0700
@@ -77,15 +77,15 @@
        u32 data[2];
        u32 reg = *ppos;
        int cpu = iminor(file_inode(file));
        int err = 0;
        ssize_t bytes = 0;

-       err = security_locked_down(LOCKDOWN_MSR);
-       if (err)
-               return err;
+       //err = security_locked_down(LOCKDOWN_MSR);
+       //if (err)
+       //      return err;

        if (count % 8)
                return -EINVAL; /* Invalid chunk size */

        for (; count; count -= 8) {
                if (copy_from_user(&data, tmp, 8)) {
@@ -132,15 +132,15 @@
                        break;
                }
                if (copy_from_user(&regs, uregs, sizeof(regs))) {
                        err = -EFAULT;
                        break;
                }
-               err = security_locked_down(LOCKDOWN_MSR);
-               if (err)
-                       break;
+               //err = security_locked_down(LOCKDOWN_MSR);
+               //if (err)
+               //      break;
                err = wrmsr_safe_regs_on_cpu(cpu, regs);
                if (err)
                        break;
                if (copy_to_user(uregs, &regs, sizeof(regs)))
                        err = -EFAULT;
                break;

Pretty straightforward, just don't check if the kernel is in "lockdown mode," and let writes through. Build the module, sign it, and replace the stock msr.ko under /lib/modules/<kernel version>. You also need to run setcap to give CAP_SYS_RAWIO to the intel-undervolt executable, so that it can open the MSR device files at all.

setcap cap_sys_rawio=ep `which intel-undervolt`

An orthogonal issue, is that recent Dell BIOS updates have new Intel microcode that disables changing the voltage settings through the MSR at all, so you may have to reset your BIOS to factory settings.

I tried it but is stuck at the last step of replacing the stock msr.ko . I simply deleted the old one and put the new one in but it is still not working. Any tips on how to replace it correctly? Thanks!