chore(workarounds): re-evaluate stale hardware/kernel fixes (#360)

* chore(workarounds): re-evaluate stale hardware/kernel fixes

Prune workarounds whose root cause is gone, fix one vendor typo, and
document the ones we keep:

- drop `transparent_hugepage=madvise` on shoryu/shushou/youko: it was tied to
  the old fixed 1G hugetlb pool, and the VMs now use ordinary memory
- shoryu: `hardware.cpu.intel.updateMicrocode` -> `amd` (it is an AMD APU)
- ai: drop `i915.enable_guc=3` (GuC/HuC submission is the default on modern
  i915/Xe)
- kernel-hardening: name the Dirty Frag CVEs (CVE-2026-43284 / CVE-2026-43500)
  and the re-evaluation condition
- document re-eval conditions for the Insta360 resume fix, the darwin
  auto-optimise-store workaround, and the youko USB-SATA bridge mitigations

* chore(workarounds): keep the Dirty Frag module blacklist as defence in depth

* chore(ai): correct the i915.enable_guc rationale (verified against the kernel)

* chore(darwin): drop the auto-optimise-store workaround (nix#7273 fixed)

hosts/12kingdoms-shoryu/default.nix

@@ -30,12 +30,4 @@ in
   # node_exporter's drm collector exposes its utilization/VRAM.
   modules.btop.package = pkgs.btop-rocm;
   services.prometheus.exporters.node.enabledCollectors = [ "drm" ];
-
-  boot.kernelParams = [
-    # Use transparent huge pages on demand (madvise) instead of a fixed 1G hugetlb
-    # pool. The static pool cannot be overcommitted or shared with the host /
-    # other VMs, which stranded memory and blocked scheduling; the VMs now use
-    # ordinary memory (see the instancetypes in k8s-gitops).
-    "transparent_hugepage=madvise"
-  ];
 }

hosts/12kingdoms-shoryu/hardware-configuration.nix

@@ -53,5 +53,5 @@
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/12kingdoms-shushou/default.nix

@@ -29,12 +29,4 @@ in
   # node_exporter's drm collector exposes its utilization/VRAM.
   modules.btop.package = pkgs.btop-rocm;
   services.prometheus.exporters.node.enabledCollectors = [ "drm" ];
-
-  boot.kernelParams = [
-    # Use transparent huge pages on demand (madvise) instead of a fixed 1G hugetlb
-    # pool. The static pool cannot be overcommitted or shared with the host /
-    # other VMs, which stranded memory and blocked scheduling; the VMs now use
-    # ordinary memory (see the instancetypes in k8s-gitops).
-    "transparent_hugepage=madvise"
-  ];
 }

hosts/12kingdoms-youko/default.nix

@@ -91,13 +91,10 @@ in
   systemd.services.restic-rest-server.unitConfig.RequiresMountsFor = "/data/backups";
 
   boot.kernelParams = [
-    # Use transparent huge pages on demand (madvise) instead of a fixed 1G hugetlb
-    # pool (cannot be overcommitted/shared; it stranded memory and blocked
-    # scheduling). The VMs now use ordinary memory.
-    "transparent_hugepage=madvise"
-
     # --- mitigations for the flaky USB-SATA bridge the two 4TB HDDs sit behind.
     # It is a JMicron JMS567 that resets and throws link (UDMA-CRC) + I/O errors.
+    # Keep until the bridge/controller is replaced; smartctl_exporter now tracks
+    # the drives' CRC/media errors, which is the signal to re-evaluate.
     "usbcore.autosuspend=-1" # no USB autosuspend
     "usb-storage.delay_use=10" # give the bridge time to settle after probing
   ];

hosts/idols-ai/default.nix

@@ -78,6 +78,7 @@ in
   # QEMU/KVM(HostCpuOnly) for local VMs.
   environment.systemPackages = [ pkgs.qemu_kvm ];
 
+  # Re-evaluate after the Insta360 Link firmware or the kernel's uvcvideo changes.
   powerManagement.resumeCommands = ''
     # Insta360 Link may stay enumerated with a stalled UVC endpoint after S3 resume.
     ${pkgs.coreutils}/bin/sleep 1

hosts/idols-ai/hardware-intel.nix

@@ -50,7 +50,11 @@
 
   # May help if FFmpeg/VAAPI/QSV init fails (esp. on Arc with i915):
   hardware.enableRedistributableFirmware = true;
-  boot.kernelParams = [ "i915.enable_guc=3" ];
+  # (dropped) `i915.enable_guc=3`: i915's `enable_guc` is a "dangerous" option
+  # (it taints the kernel), and since Alder Lake the driver already auto-enables
+  # HuC + GuC submission on non-TGL/RKL Gen12+ platforms -- including this Arrow
+  # Lake-S iGPU, where auto = `HuC | GuC submission` = 3. Re-add only if
+  # VAAPI/QSV init regresses.
 
   # May help services that have trouble accessing /dev/dri (e.g., jellyfin/plex):
   # users.users.<service>.extraGroups = [ "video" "render" ];

modules/darwin/nix-core.nix

@@ -17,11 +17,6 @@
   # conflicts with nix-darwin's native Nix management. so we should disable this option.
   nix.enable = false;
 
-  # Disable auto-optimise-store because of this issue:
-  #   https://github.com/NixOS/nix/issues/7273
-  # "error: cannot link '/nix/store/.tmp-link-xxxxx-xxxxx' to '/nix/store/.links/xxxx': File exists"
-  nix.settings.auto-optimise-store = false;
-
   nix.gc.automatic = false;
 
   system.stateVersion = 5;

modules/nixos/base/kernel-hardening.nix

@@ -5,7 +5,10 @@
   ...
 }:
 {
-  # Kernel module blacklisting to mitigate Dirty Frag LPE (Local Privilege Escalation) vulnerabilities.
+  # Blacklist unused kernel modules to shrink the attack surface. esp4/esp6/rxrpc
+  # were the vectors for the Dirty Frag LPE (CVE-2026-43284 / CVE-2026-43500);
+  # kept as defence in depth even though the upstream fix has long landed, since
+  # nothing here uses them.
   boot.blacklistedKernelModules = [
     "esp4"
     "esp6"