fix(iso): serialize coldplug and harden DMA isolation

iso/builder/build.sh

@@ -488,6 +488,69 @@ validate_iso_memtest() {
     echo "=== memtest validation OK ==="
 }
 
+validate_live_cmdline_params() {
+    cfg="$1"
+    command="$2"
+    bootloader="$3"
+
+    awk -v command="$command" -v bootloader="$bootloader" '
+        function has(token, i) {
+            for (i = 1; i <= NF; i++) {
+                if ($i == token) {
+                    return 1
+                }
+            }
+            return 0
+        }
+
+        function reject(message) {
+            printf "ERROR: %s live entry at %s:%d: %s\n", bootloader, FILENAME, NR, message
+            bad = 1
+        }
+
+        $1 == command && has("boot=live") {
+            live_entries++
+
+            if (!has("udev.children_max=1")) {
+                reject("missing udev.children_max=1")
+            }
+            if (!has("intel_iommu=on")) {
+                reject("missing intel_iommu=on")
+            }
+            if (!has("iommu.passthrough=0")) {
+                reject("missing iommu.passthrough=0")
+            }
+            if (!has("efi=disable_early_pci_dma")) {
+                reject("missing efi=disable_early_pci_dma")
+            }
+            if (has("iommu=pt")) {
+                reject("contains forbidden iommu=pt")
+            }
+
+            if (has("pci=realloc")) {
+                failsafe_entries++
+                if (!has("iommu.strict=1")) {
+                    reject("pci=realloc entry is missing iommu.strict=1")
+                }
+            } else if (has("iommu.strict=1")) {
+                reject("iommu.strict=1 is allowed only in the pci=realloc fail-safe entry")
+            }
+        }
+
+        END {
+            if (live_entries == 0) {
+                printf "ERROR: %s config has no live boot entries\n", bootloader
+                bad = 1
+            }
+            if (failsafe_entries != 1) {
+                printf "ERROR: %s config has %d pci=realloc fail-safe entries, expected 1\n", bootloader, failsafe_entries
+                bad = 1
+            }
+            exit bad ? 1 : 0
+        }
+    ' "$cfg"
+}
+
 validate_iso_live_boot_entries() {
     iso_path="$1"
     echo "=== validating live boot entries in ISO ==="
@@ -521,6 +584,21 @@ validate_iso_live_boot_entries() {
         exit 1
     fi
 
+    if grep -q 'iommu=pt' "$grub_cfg" "$isolinux_cfg"; then
+        echo "ERROR: forbidden iommu=pt remains in ISO bootloader config" >&2
+        rm -f "$grub_cfg" "$isolinux_cfg"
+        exit 1
+    fi
+
+    if ! validate_live_cmdline_params "$grub_cfg" linux GRUB; then
+        rm -f "$grub_cfg" "$isolinux_cfg"
+        exit 1
+    fi
+    if ! validate_live_cmdline_params "$isolinux_cfg" append isolinux; then
+        rm -f "$grub_cfg" "$isolinux_cfg"
+        exit 1
+    fi
+
     grep -q 'menuentry "EASY-BEE v' "$grub_cfg" || {
         echo "ERROR: GRUB default EASY-BEE entry is missing" >&2
         rm -f "$grub_cfg" "$isolinux_cfg"
@@ -784,27 +862,27 @@ write_canonical_grub_cfg() {
 source /boot/grub/config.cfg
 
 menuentry "EASY-BEE v${version_label}" {
-    linux   ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    linux   ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  ${initrd}
 }
 
 menuentry "EASY-BEE v${version_label} -- load to RAM (toram)" {
-    linux   ${kernel} ${append_live} toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    linux   ${kernel} ${append_live} toram nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  ${initrd}
 }
 
 menuentry "EASY-BEE v${version_label} -- no GUI / no X11" {
-    linux   ${kernel} ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    linux   ${kernel} ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  ${initrd}
 }
 
-menuentry "EASY-BEE v${version_label} -- fail-safe (pci=realloc, iommu=pt)" {
+menuentry "EASY-BEE v${version_label} -- fail-safe (pci=realloc, strict IOMMU)" {
-    linux   ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc iommu=pt net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    linux   ${kernel} ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc udev.children_max=1 intel_iommu=on iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  ${initrd}
 }
 
 menuentry "*** WIPE ALL DISKS (irreversible!) ***" {
-    linux   ${kernel} ${append_live} toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0
+    linux   ${kernel} ${append_live} toram nomodeset bee.gui=off bee.wipe=all udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0
     initrd  ${initrd}
 }
 
@@ -838,32 +916,32 @@ label live-@FLAVOUR@-normal
     menu label ^EASY-BEE v${version_label}
     linux ${kernel}
     initrd ${initrd}
-    append ${append_live} nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    append ${append_live} nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
 label live-@FLAVOUR@-toram
     menu label EASY-BEE v${version_label} (^load to RAM)
     menu default
     linux ${kernel}
     initrd ${initrd}
-    append ${append_live} toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    append ${append_live} toram nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
 label live-@FLAVOUR@-console
     menu label EASY-BEE v${version_label} (^no GUI / no X11)
     linux ${kernel}
     initrd ${initrd}
-    append ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    append ${append_live} nomodeset bee.gui=off bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
 label live-@FLAVOUR@-failsafe
-    menu label EASY-BEE (^fail-safe: pci=realloc, iommu=pt)
+    menu label EASY-BEE (^fail-safe: pci=realloc, strict IOMMU)
     linux ${kernel}
     initrd ${initrd}
-    append ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc iommu=pt net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    append ${append_live} nomodeset bee.nvidia.mode=normal pci=realloc udev.children_max=1 intel_iommu=on iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
 label wipe-disks
     menu label *** WIPE ALL DISKS (irreversible!) ***
     linux ${kernel}
     initrd ${initrd}
-    append ${append_live} toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0
+    append ${append_live} toram nomodeset bee.gui=off bee.wipe=all udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0
 
 label memtest
     menu label ^Memory Test (memtest86+)

iso/builder/config/bootloaders/grub-efi/grub.cfg

@@ -1,27 +1,27 @@
 source /boot/grub/config.cfg
 
 menuentry "EASY-BEE v@VERSION@" {
-    linux   @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  @INITRD_LIVE@
 }
 
 menuentry "EASY-BEE v@VERSION@ -- load to RAM (toram)" {
-    linux   @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  @INITRD_LIVE@
 }
 
 menuentry "EASY-BEE v@VERSION@ -- no GUI / no X11" {
-    linux   @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.gui=off bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.gui=off bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  @INITRD_LIVE@
 }
 
-menuentry "EASY-BEE v@VERSION@ -- fail-safe (pci=realloc, iommu=pt)" {
+menuentry "EASY-BEE v@VERSION@ -- fail-safe (pci=realloc, strict IOMMU)" {
-    linux   @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal pci=realloc iommu=pt net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal pci=realloc udev.children_max=1 intel_iommu=on iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
     initrd  @INITRD_LIVE@
 }
 
 menuentry "*** WIPE ALL DISKS (irreversible!) ***" {
-    linux   @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.gui=off bee.wipe=all udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0
     initrd  @INITRD_LIVE@
 }
 

iso/builder/config/bootloaders/isolinux/live.cfg.in

@@ -2,32 +2,32 @@ label live-@FLAVOUR@-normal
     menu label ^EASY-BEE v@VERSION@
     linux @LINUX@
     initrd @INITRD@
-    append @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    append @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
 label live-@FLAVOUR@-toram
     menu label EASY-BEE v@VERSION@ (^load to RAM)
     menu default
     linux @LINUX@
     initrd @INITRD@
-    append @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    append @APPEND_LIVE@ toram nomodeset bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
 label live-@FLAVOUR@-console
     menu label EASY-BEE v@VERSION@ (^no GUI / no X11)
     linux @LINUX@
     initrd @INITRD@
-    append @APPEND_LIVE@ nomodeset bee.gui=off bee.nvidia.mode=normal net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    append @APPEND_LIVE@ nomodeset bee.gui=off bee.nvidia.mode=normal udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
 label live-@FLAVOUR@-failsafe
-    menu label EASY-BEE (^fail-safe: pci=realloc, iommu=pt)
+    menu label EASY-BEE (^fail-safe: pci=realloc, strict IOMMU)
     linux @LINUX@
     initrd @INITRD@
-    append @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal pci=realloc iommu=pt net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
+    append @APPEND_LIVE@ nomodeset bee.nvidia.mode=normal pci=realloc udev.children_max=1 intel_iommu=on iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0 mitigations=off transparent_hugepage=always numa_balancing=disable pcie_aspm=off intel_idle.max_cstate=1 processor.max_cstate=1 nowatchdog nosoftlockup
 
 label wipe-disks
     menu label *** WIPE ALL DISKS (irreversible!) ***
     linux @LINUX@
     initrd @INITRD@
-    append @APPEND_LIVE@ toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0
+    append @APPEND_LIVE@ toram nomodeset bee.gui=off bee.wipe=all udev.children_max=1 intel_iommu=on iommu.passthrough=0 efi=disable_early_pci_dma net.ifnames=0 biosdevname=0
 
 label memtest
     menu label ^Memory Test (memtest86+)