Call for testing: Secure Boot and Kernel Lockdown support

[erpalma]

Kernel Lockdown, which most distributions enable automatically with Secure Boot, blocks the direct MSR and /dev/mem writes throttled relies on. Until now that meant throttled could not work on those systems at all (see #430).

The lockdown-sysfs branch adds a backend that applies the settings through kernel drivers, which keep working under Lockdown:

Setting	Kernel interface
PL1_*, PL2_*	intel_rapl powercap package zones (intel-rapl and intel-rapl-mmio)
Trip_Temp_C	int340x tcc_offset_degree_celsius or the intel_tcc_cooling device
HWP_Mode	cpufreq energy_performance_preference

Undervolt, IccMax, cTDP and Disable_BDPROCHOT have no kernel interface and are ignored with a warning. --monitor keeps working because Lockdown only blocks register writes. The new [GENERAL] Backend option selects auto (the default: sysfs only when Lockdown is active), msr or sysfs.

Another change: when the kernel refuses hardware access, throttled now exits with status 77 and the systemd unit no longer restarts it every 5 seconds.

How to test

git clone -b lockdown-sysfs https://github.com/erpalma/throttled.git
cd throttled
sudo ./install.sh
journalctl -u throttled.service -b
sudo systemctl stop throttled.service && sudo throttled --debug

Testing without Lockdown is useful too: set Backend: sysfs in /etc/throttled.conf and restart the service.

Please report

• CPU model and family/model/stepping, kernel version, distribution;
• output of cat /sys/kernel/security/lockdown;
• the startup log and a few cycles of --debug;
• whether the limits stick, checked with --monitor or cat /sys/class/powercap/intel-rapl*:0/constraint_*_power_limit_uw.

A beta release with packages will follow once the first reports confirm it works.