🌴 Sync 2026-03-05 23:51:42

cpu-checker/files/check-bios-nx

@@ -0,0 +1,66 @@
+#!/bin/sh
+# Copyright 2010, Canonical, Ltd.
+# License: GPLv2
+# Author: Kees Cook <kees@ubuntu.com>
+set -e
+
+export LANG=C
+
+usage() {
+    echo "Usage: $0 [options]"
+    echo ""
+    echo "Options:"
+    echo "  -h, --help  show this help message and exit"
+    echo "  --verbose   Explain in detail what has been detected"
+}
+
+report() {
+    if [ -n "$VERBOSE" ]; then
+        echo "$@" >/dev/stderr
+    fi
+}
+
+VERBOSE=
+
+TEMP=$(getopt -o h --long verbose,help -n check-bios-nx -- "$@")
+eval set -- "$TEMP"
+
+while :; do
+    case "$1" in
+        -h|--help) usage ; exit 0 ;;
+        --verbose) VERBOSE=1; shift ;;
+        --) shift ; break ;;
+        *) usage >&2 ; exit 2 ;;
+    esac
+done
+
+export VERBOSE
+
+if ! uname -m | egrep -q '^(i.86|x86_64)$' ; then
+    report "This script is currently only useful on x86-based CPUs"
+    exit 0
+fi
+
+# Prepare MSR access
+msr="/dev/cpu/0/msr"
+if [ ! -r "$msr" ]; then
+        modprobe msr
+fi
+if [ ! -r "$msr" ]; then
+        echo "$0: You must be root to run this check." >&2
+        exit 2
+fi
+
+# Check MSR_IA32_MISC_ENABLE's bit 34, NX_DISABLE
+BIT=$(rdmsr --bitfield 34:34 0x1a0 2>/dev/null || true)
+if [ "$BIT" = "1" ]; then
+	report "FAIL: the NX bit is being filtered by the BIOS on this CPU!"
+	exit 1
+else
+	if egrep -m1 -q '^flags[[:blank:]]*:.*\<nx\>' /proc/cpuinfo ; then
+		report "ok: the NX bit is operational on this CPU."
+	else
+		report "WARNING: the NX bit is not available for this CPU."
+	fi
+fi
+exit 0

cpu-checker/files/kvm-ok

@@ -0,0 +1,146 @@
+#!/bin/sh
+#
+# kvm-ok - check whether the CPU we're running on supports KVM acceleration
+# Copyright (C) 2008-2010 Canonical Ltd.
+#
+# Authors:
+#  Dustin Kirkland <kirkland@canonical.com>
+#  Kees Cook <kees.cook@canonical.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3,
+# as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+set -e
+
+assert_root() {
+	if [ "$(id -u)" != "0" ]; then
+		echo "INFO: For more detailed results, you should run this as root"
+		echo "HINT:   sudo $0"
+		exit 1
+	fi
+}
+
+verdict() {
+	# Print verdict
+	if [ "$1" = "0" ]; then
+		echo "KVM acceleration can be used"
+		exit 0
+	else
+		echo "KVM acceleration can NOT be used"
+		exit 1
+	fi
+}
+
+ARM_CPU_PART_CORTEX_A15="0xc0f" # <asm/cputype.h>
+
+# check cpu flags for capability
+case "$(uname -m)" in
+    armv7l)
+	if egrep -m1 -w '^CPU part[[:blank:]]*:' /proc/cpuinfo | \
+		egrep -wq "$ARM_CPU_PART_CORTEX_A15"; then
+	    virt="ARM"
+	    kvm_mod="kvm"
+	fi
+	;;
+    aarch64)
+	virt="ARM"
+	kvm_mod="kvm"
+	;;
+    ppc64le|ppc64|s390x)
+	# FIXME: Assume that all POWER and z/Systems are KVM capable
+	virt="generic"
+	kvm_mod="kvm"
+	;;
+    riscv64)
+	virt="RISCV"
+	kvm_mod="kvm"
+	;;
+    loongarch64)
+	virt="LOONGARCH"
+	kvm_mod="kvm"
+	;;
+    *)
+      virt=$(egrep -m1 -w '^flags[[:blank:]]*:' /proc/cpuinfo | egrep -wo '(vmx|svm)') || true
+      [ "$virt" = "vmx" ] && kvm_mod="kvm_intel"
+      [ "$virt" = "svm" ] && kvm_mod="kvm_amd"
+      ;;
+esac
+
+if [ -z "$virt" ]; then
+	echo "INFO: Your CPU does not support KVM extensions"
+	assert_root
+	verdict 1
+fi
+
+# Now, check that the device exists
+if [ -e /dev/kvm ]; then
+	echo "INFO: /dev/kvm exists"
+	verdict 0
+else
+	echo "INFO: /dev/kvm does not exist"
+	echo "HINT:   sudo modprobe $kvm_mod"
+fi
+
+assert_root
+
+# Prepare MSR access
+msr="/dev/cpu/0/msr"
+if [ ! -r "$msr" ]; then
+	modprobe msr
+fi
+if [ -e "$msr" -a ! -r "$msr" ]; then
+	echo "You must be root to run this check." >&2
+	exit 2
+fi
+
+echo "INFO: Your CPU supports KVM extensions"
+
+disabled=0
+# check brand-specific registers
+if [ "$virt" = "vmx" ]; then
+        BIT=$(rdmsr --bitfield 0:0 0x3a 2>/dev/null || true)
+        if [ "$BIT" = "1" ]; then
+                # and FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX clear (no tboot)
+                BIT=$(rdmsr --bitfield 2:2 0x3a 2>/dev/null || true)
+                if [ "$BIT" = "0" ]; then
+			disabled=1
+                fi
+        fi
+
+elif [ "$virt" = "svm" ]; then
+        BIT=$(rdmsr --bitfield 4:4 0xc0010114 2>/dev/null || true)
+        if [ "$BIT" = "1" ]; then
+		disabled=1
+        fi
+elif [ "$virt" = "ARM" ]; then
+    # Should also test that we booted in HYP mode, if detectable
+    :
+elif [ "$virt" = "RISCV" ]; then
+    # Should also test that we booted in HS mode, if detectable
+    :
+elif [ "$virt" = "LOONGARCH" ]; then
+    # Should also test that we booted in LVZ mode, if detectable
+    :
+elif [ "$virt" = "generic" ]; then
+    :
+else
+	echo "FAIL: Unknown virtualization extension: $virt"
+	verdict 1
+fi
+
+if [ "$disabled" -eq 1 ]; then
+	echo "INFO: KVM ($virt) is disabled by your BIOS"
+	echo "HINT: Enter your BIOS setup and enable Virtualization Technology (VT),"
+	echo "      and then hard poweroff/poweron your system"
+	verdict 1
+fi
+
+verdict 0