[PATCH 0/2] lockdown: Prevent booting with lockdown enabled but IOMMU disabled

[Mario Limonciello (AMD)]

Lockdown is a kernel LSM that restricts access to sensitive kernel
resources (e.g. /dev/mem, kernel modules, perf, tracing, kprobes,
BPF access to kernel memory). However, without IOMMU, any PCI/PCIe
device can perform DMA to arbitrary physical memory, effectively
bypassing all lockdown protections.

A malicious or compromised device can:
  - Read kernel memory directly (encryption keys, credentials, secrets)
  - Write to kernel memory directly (code patches, rootkits, backdoors)
  - Circumvent all lockdown LSM checks (which run inside the kernel)

This series adds a two-phase check to prevent booting with lockdown
enabled and IOMMU disabled:

1. Early check (in lockdown_lsm_init()): On x86, check the no_iommu
   flag, which is set early by the "iommu=off" kernel cmdline option.
   If lockdown is active and no_iommu is set, panic with a clear error.

2. Late check (late_initcall): On all architectures, check
   iommu_is_available() which returns true if any IOMMU driver
   registered successfully. This catches cases where:
   - IOMMU hardware is absent on the platform
   - IOMMU was disabled by driver initialization failure
   - IOMMU was not detected (broken firmware, missing ACPI tables)

This follows the precedent set by s390 UV code which panics when
security cannot be guaranteed ("System security cannot be guaranteed
unless the system panics now").

This also adds a generic iommu_is_available() API in the IOMMU
subsystem, which is used by the lockdown check. Any IOMMU driver
that successfully registers will automatically call
iommu_set_available() from iommu_device_register().

Signed-off-by: Mario Limonciello (AMD) <superm1@xxxxxxxxxx>

---
Mario Limonciello (AMD) (2):
      iommu: Add iommu_is_available() API
      security: lockdown: Prevent boot with lockdown but no IOMMU

 drivers/iommu/iommu.c        | 48 ++++++++++++++++++++++++++++++++
 include/linux/iommu.h        | 14 ++++++++++
 security/lockdown/lockdown.c | 65 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 127 insertions(+)
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261014-lockdown-iommu-08c763d9f91dd

Best regards,
--  
Mario Limonciello <superm1@xxxxxxxxxx>