From c5c7a2dea34f1f3a21c0dfefcda16f9b4855ce1c Mon Sep 17 00:00:00 2001 From: Mikhail Chusavitin Date: Fri, 28 Aug 2026 09:51:51 +0300 Subject: [PATCH] fix(iso): serialize coldplug and harden DMA isolation --- iso/builder/build.sh | 102 +++++++++++++++--- .../config/bootloaders/grub-efi/grub.cfg | 12 +-- .../config/bootloaders/isolinux/live.cfg.in | 12 +-- 3 files changed, 102 insertions(+), 24 deletions(-) diff --git a/iso/builder/build.sh b/iso/builder/build.sh index 9328925..08652c5 100755 --- a/iso/builder/build.sh +++ b/iso/builder/build.sh @@ -488,6 +488,69 @@ validate_iso_memtest() { echo "=== memtest validation OK ===" } +validate_live_cmdline_params() { + cfg="$1" + command="$2" + bootloader="$3" + + awk -v command="$command" -v bootloader="$bootloader" ' + function has(token, i) { + for (i = 1; i <= NF; i++) { + if ($i == token) { + return 1 + } + } + return 0 + } + + function reject(message) { + printf "ERROR: %s live entry at %s:%d: %s\n", bootloader, FILENAME, NR, message + bad = 1 + } + + $1 == command && has("boot=live") { + live_entries++ + + if (!has("udev.children_max=1")) { + reject("missing udev.children_max=1") + } + if (!has("intel_iommu=on")) { + reject("missing intel_iommu=on") + } + if (!has("iommu.passthrough=0")) { + reject("missing iommu.passthrough=0") + } + if (!has("efi=disable_early_pci_dma")) { + reject("missing efi=disable_early_pci_dma") + } + if (has("iommu=pt")) { + reject("contains forbidden iommu=pt") + } + + if (has("pci=realloc")) { + failsafe_entries++ + if (!has("iommu.strict=1")) { + reject("pci=realloc entry is missing iommu.strict=1") + } + } else if (has("iommu.strict=1")) { + reject("iommu.strict=1 is allowed only in the pci=realloc fail-safe entry") + } + } + + END { + if (live_entries == 0) { + printf "ERROR: %s config has no live boot entries\n", bootloader + bad = 1 + } + if (failsafe_entries != 1) { + printf "ERROR: %s config has %d pci=realloc fail-safe entries, expected 1\n", bootloader, failsafe_entries + bad = 1 + } + exit bad ? 1 : 0 + } + ' "$cfg" +} + validate_iso_live_boot_entries() { iso_path="$1" echo "=== validating live boot entries in ISO ===" @@ -521,6 +584,21 @@ validate_iso_live_boot_entries() { exit 1 fi + if grep -q 'iommu=pt' "$grub_cfg" "$isolinux_cfg"; then + echo "ERROR: forbidden iommu=pt remains in ISO bootloader config" >&2 + rm -f "$grub_cfg" "$isolinux_cfg" + exit 1 + fi + + if ! validate_live_cmdline_params "$grub_cfg" linux GRUB; then + rm -f "$grub_cfg" "$isolinux_cfg" + exit 1 + fi + if ! validate_live_cmdline_params "$isolinux_cfg" append isolinux; then + rm -f "$grub_cfg" "$isolinux_cfg" + exit 1 + fi + grep -q 'menuentry "EASY-BEE v' "$grub_cfg" || { echo "ERROR: GRUB default EASY-BEE entry is missing" >&2 rm -f "$grub_cfg" "$isolinux_cfg" @@ -784,27 +862,27 @@ write_canonical_grub_cfg() { source /boot/grub/config.cfg menuentry "EASY-BEE v${version_label}" { - linux ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + linux ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup initrd ${initrd} } menuentry "EASY-BEE v${version_label} -- load to RAM (toram)" { - linux ${kernel} ${append_live} toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + linux ${kernel} ${append_live} toram nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup initrd ${initrd} } menuentry "EASY-BEE v${version_label} -- no GUI / no X11" { - linux ${kernel} ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + linux ${kernel} ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup initrd ${initrd} } -menuentry "EASY-BEE v${version_label} -- fail-safe (pci=realloc, iommu=pt)" { - linux ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc iommu=pt net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup +menuentry "EASY-BEE v${version_label} -- fail-safe (pci=realloc, strict IOMMU)" { + linux ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc udev.children_max=1 intel_iommu=on iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup initrd ${initrd} } menuentry "*** WIPE ALL DISKS (irreversible!) ***" { - linux ${kernel} ${append_live} toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0 + linux ${kernel} ${append_live} toram nomodeset bee.gui=off bee.wipe=all udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 initrd ${initrd} } @@ -838,32 +916,32 @@ label live-@FLAVOUR@-normal menu label ^EASY-BEE v${version_label} linux ${kernel} initrd ${initrd} - append ${append_live} nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + append ${append_live} nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup label live-@FLAVOUR@-toram menu label EASY-BEE v${version_label} (^load to RAM) menu default linux ${kernel} initrd ${initrd} - append ${append_live} toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + append ${append_live} toram nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup label live-@FLAVOUR@-console menu label EASY-BEE v${version_label} (^no GUI / no X11) linux ${kernel} initrd ${initrd} - append ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + append ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup label live-@FLAVOUR@-failsafe - menu label EASY-BEE (^fail-safe: pci=realloc, iommu=pt) + menu label EASY-BEE (^fail-safe: pci=realloc, strict IOMMU) linux ${kernel} initrd ${initrd} - append ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc iommu=pt net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + append ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc udev.children_max=1 intel_iommu=on iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup label wipe-disks menu label *** WIPE ALL DISKS (irreversible!) *** linux ${kernel} initrd ${initrd} - append ${append_live} toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0 + append ${append_live} toram nomodeset bee.gui=off bee.wipe=all udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 label memtest menu label ^Memory Test (memtest86+) diff --git a/iso/builder/config/bootloaders/grub-efi/grub.cfg b/iso/builder/config/bootloaders/grub-efi/grub.cfg index 91fb01e..29b16a6 100644 --- a/iso/builder/config/bootloaders/grub-efi/grub.cfg +++ b/iso/builder/config/bootloaders/grub-efi/grub.cfg @@ -1,27 +1,27 @@ source /boot/grub/config.cfg menuentry "EASY-BEE v@VERSION@" { - linux @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + linux @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup initrd @INITRD_LIVE@ } menuentry "EASY-BEE v@VERSION@ -- load to RAM (toram)" { - linux @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + linux @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup initrd @INITRD_LIVE@ } menuentry "EASY-BEE v@VERSION@ -- no GUI / no X11" { - linux @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.gui=off bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + linux @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.gui=off bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup initrd @INITRD_LIVE@ } -menuentry "EASY-BEE v@VERSION@ -- fail-safe (pci=realloc, iommu=pt)" { - linux @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal pci=realloc iommu=pt net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup +menuentry "EASY-BEE v@VERSION@ -- fail-safe (pci=realloc, strict IOMMU)" { + linux @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal pci=realloc udev.children_max=1 intel_iommu=on iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup initrd @INITRD_LIVE@ } menuentry "*** WIPE ALL DISKS (irreversible!) ***" { - linux @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0 + linux @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.gui=off bee.wipe=all udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 initrd @INITRD_LIVE@ } diff --git a/iso/builder/config/bootloaders/isolinux/live.cfg.in b/iso/builder/config/bootloaders/isolinux/live.cfg.in index 165258b..24e2704 100644 --- a/iso/builder/config/bootloaders/isolinux/live.cfg.in +++ b/iso/builder/config/bootloaders/isolinux/live.cfg.in @@ -2,32 +2,32 @@ label live-@FLAVOUR@-normal menu label ^EASY-BEE v@VERSION@ linux @LINUX@ initrd @INITRD@ - append @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + append @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup label live-@FLAVOUR@-toram menu label EASY-BEE v@VERSION@ (^load to RAM) menu default linux @LINUX@ initrd @INITRD@ - append @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + append @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup label live-@FLAVOUR@-console menu label EASY-BEE v@VERSION@ (^no GUI / no X11) linux @LINUX@ initrd @INITRD@ - append @APPEND_LIVE@ nomodeset bee.gui=off bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + append @APPEND_LIVE@ nomodeset bee.gui=off bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup label live-@FLAVOUR@-failsafe - menu label EASY-BEE (^fail-safe: pci=realloc, iommu=pt) + menu label EASY-BEE (^fail-safe: pci=realloc, strict IOMMU) linux @LINUX@ initrd @INITRD@ - append @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal pci=realloc iommu=pt net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup + append @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal pci=realloc udev.children_max=1 intel_iommu=on iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup label wipe-disks menu label *** WIPE ALL DISKS (irreversible!) *** linux @LINUX@ initrd @INITRD@ - append @APPEND_LIVE@ toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0 + append @APPEND_LIVE@ toram nomodeset bee.gui=off bee.wipe=all udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 label memtest menu label ^Memory Test (memtest86+)