reanimator/bee
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(iso): serialize coldplug and harden DMA isolation

Browse Source
This commit is contained in:
Mikhail Chusavitin
2026-08-28 09:51:51 +03:00
parent 2354599889
commit c5c7a2dea3
3 changed files with 102 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
iso/builder/build.sh
+90 -12
View File
@@ -488,6 +488,69 @@ validate_iso_memtest() {
echo "=== memtest validation OK ==="
}
validate_live_cmdline_params() {
cfg="$1"
command="$2"
bootloader="$3"
awk -v command="$command" -v bootloader="$bootloader" '
function has(token, i) {
for (i = 1; i <= NF; i++) {
if ($i == token) {
return 1
}
}
return 0
}
function reject(message) {
printf "ERROR: %s live entry at %s:%d: %s\n", bootloader, FILENAME, NR, message
bad = 1
}
$1 == command && has("boot=live") {
live_entries++
if (!has("udev.children_max=1")) {
reject("missing udev.children_max=1")
}
if (!has("intel_iommu=on")) {
reject("missing intel_iommu=on")
}
if (!has("iommu.passthrough=0")) {
reject("missing iommu.passthrough=0")
}
if (!has("efi=disable_early_pci_dma")) {
reject("missing efi=disable_early_pci_dma")
}
if (has("iommu=pt")) {
reject("contains forbidden iommu=pt")
}
if (has("pci=realloc")) {
failsafe_entries++
if (!has("iommu.strict=1")) {
reject("pci=realloc entry is missing iommu.strict=1")
}
} else if (has("iommu.strict=1")) {
reject("iommu.strict=1 is allowed only in the pci=realloc fail-safe entry")
}
}
END {
if (live_entries == 0) {
printf "ERROR: %s config has no live boot entries\n", bootloader
bad = 1
}
if (failsafe_entries != 1) {
printf "ERROR: %s config has %d pci=realloc fail-safe entries, expected 1\n", bootloader, failsafe_entries
bad = 1
}
exit bad ? 1 : 0
}
' "$cfg"
}
validate_iso_live_boot_entries() {
iso_path="$1"
echo "=== validating live boot entries in ISO ==="
@@ -521,6 +584,21 @@ validate_iso_live_boot_entries() {
exit 1
fi
if grep -q 'iommu=pt' "$grub_cfg" "$isolinux_cfg"; then
echo "ERROR: forbidden iommu=pt remains in ISO bootloader config" >&2
rm -f "$grub_cfg" "$isolinux_cfg"
exit 1
fi
if ! validate_live_cmdline_params "$grub_cfg" linux GRUB; then
rm -f "$grub_cfg" "$isolinux_cfg"
exit 1
fi
if ! validate_live_cmdline_params "$isolinux_cfg" append isolinux; then
rm -f "$grub_cfg" "$isolinux_cfg"
exit 1
fi
grep -q 'menuentry "EASY-BEE v' "$grub_cfg" || {
echo "ERROR: GRUB default EASY-BEE entry is missing" >&2
rm -f "$grub_cfg" "$isolinux_cfg"
@@ -784,27 +862,27 @@ write_canonical_grub_cfg() {
source /boot/grub/config.cfg
menuentry "EASY-BEE v${version_label}" {
linux ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
linux ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
initrd ${initrd}
}
menuentry "EASY-BEE v${version_label} -- load to RAM (toram)" {
linux ${kernel} ${append_live} toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
linux ${kernel} ${append_live} toram nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
initrd ${initrd}
}
menuentry "EASY-BEE v${version_label} -- no GUI / no X11" {
linux ${kernel} ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
linux ${kernel} ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
initrd ${initrd}
}
menuentry "EASY-BEE v${version_label} -- fail-safe (pci=realloc, iommu=pt)" {
linux ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc iommu=pt net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
menuentry "EASY-BEE v${version_label} -- fail-safe (pci=realloc, strict IOMMU)" {
linux ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc udev.children_max=1 intel_iommu=on iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
initrd ${initrd}
}
menuentry "*** WIPE ALL DISKS (irreversible!) ***" {
linux ${kernel} ${append_live} toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0
linux ${kernel} ${append_live} toram nomodeset bee.gui=off bee.wipe=all udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0
initrd ${initrd}
}
@@ -838,32 +916,32 @@ label live-@FLAVOUR@-normal
menu label ^EASY-BEE v${version_label}
linux ${kernel}
initrd ${initrd}
append ${append_live} nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
append ${append_live} nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
label live-@FLAVOUR@-toram
menu label EASY-BEE v${version_label} (^load to RAM)
menu default
linux ${kernel}
initrd ${initrd}
append ${append_live} toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
append ${append_live} toram nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
label live-@FLAVOUR@-console
menu label EASY-BEE v${version_label} (^no GUI / no X11)
linux ${kernel}
initrd ${initrd}
append ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
append ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
label live-@FLAVOUR@-failsafe
menu label EASY-BEE (^fail-safe: pci=realloc, iommu=pt)
menu label EASY-BEE (^fail-safe: pci=realloc, strict IOMMU)
linux ${kernel}
initrd ${initrd}
append ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc iommu=pt net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
append ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc udev.children_max=1 intel_iommu=on iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
label wipe-disks
menu label *** WIPE ALL DISKS (irreversible!) ***
linux ${kernel}
initrd ${initrd}
append ${append_live} toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0
append ${append_live} toram nomodeset bee.gui=off bee.wipe=all udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0
label memtest
menu label ^Memory Test (memtest86+)