From d056aece283b35da42b4649eddd772a1e2fbb923 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?ryan4yin=20=7C=20=E4=BA=8C=E8=8A=B1?= Date: Sat, 3 Oct 2026 11:25:34 +0800 Subject: [PATCH] chore(workarounds): re-evaluate stale hardware/kernel fixes (#360) * chore(workarounds): re-evaluate stale hardware/kernel fixes Prune workarounds whose root cause is gone, fix one vendor typo, and document the ones we keep: - drop `transparent_hugepage=madvise` on shoryu/shushou/youko: it was tied to the old fixed 1G hugetlb pool, and the VMs now use ordinary memory - shoryu: `hardware.cpu.intel.updateMicrocode` -> `amd` (it is an AMD APU) - ai: drop `i915.enable_guc=3` (GuC/HuC submission is the default on modern i915/Xe) - kernel-hardening: name the Dirty Frag CVEs (CVE-2026-43284 / CVE-2026-43500) and the re-evaluation condition - document re-eval conditions for the Insta360 resume fix, the darwin auto-optimise-store workaround, and the youko USB-SATA bridge mitigations * chore(workarounds): keep the Dirty Frag module blacklist as defence in depth * chore(ai): correct the i915.enable_guc rationale (verified against the kernel) * chore(darwin): drop the auto-optimise-store workaround (nix#7273 fixed) --- hosts/12kingdoms-shoryu/default.nix | 8 -------- hosts/12kingdoms-shoryu/hardware-configuration.nix | 2 +- hosts/12kingdoms-shushou/default.nix | 8 -------- hosts/12kingdoms-youko/default.nix | 7 ++----- hosts/idols-ai/default.nix | 1 + hosts/idols-ai/hardware-intel.nix | 6 +++++- modules/darwin/nix-core.nix | 5 ----- modules/nixos/base/kernel-hardening.nix | 5 ++++- 8 files changed, 13 insertions(+), 29 deletions(-) diff --git a/hosts/12kingdoms-shoryu/default.nix b/hosts/12kingdoms-shoryu/default.nix index d1d00f00..dc513c8d 100644 --- a/hosts/12kingdoms-shoryu/default.nix +++ b/hosts/12kingdoms-shoryu/default.nix @@ -30,12 +30,4 @@ in # node_exporter's drm collector exposes its utilization/VRAM. modules.btop.package = pkgs.btop-rocm; services.prometheus.exporters.node.enabledCollectors = [ "drm" ]; - - boot.kernelParams = [ - # Use transparent huge pages on demand (madvise) instead of a fixed 1G hugetlb - # pool. The static pool cannot be overcommitted or shared with the host / - # other VMs, which stranded memory and blocked scheduling; the VMs now use - # ordinary memory (see the instancetypes in k8s-gitops). - "transparent_hugepage=madvise" - ]; } diff --git a/hosts/12kingdoms-shoryu/hardware-configuration.nix b/hosts/12kingdoms-shoryu/hardware-configuration.nix index d69566d0..c7365731 100644 --- a/hosts/12kingdoms-shoryu/hardware-configuration.nix +++ b/hosts/12kingdoms-shoryu/hardware-configuration.nix @@ -53,5 +53,5 @@ nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } diff --git a/hosts/12kingdoms-shushou/default.nix b/hosts/12kingdoms-shushou/default.nix index c23902a9..1957e286 100644 --- a/hosts/12kingdoms-shushou/default.nix +++ b/hosts/12kingdoms-shushou/default.nix @@ -29,12 +29,4 @@ in # node_exporter's drm collector exposes its utilization/VRAM. modules.btop.package = pkgs.btop-rocm; services.prometheus.exporters.node.enabledCollectors = [ "drm" ]; - - boot.kernelParams = [ - # Use transparent huge pages on demand (madvise) instead of a fixed 1G hugetlb - # pool. The static pool cannot be overcommitted or shared with the host / - # other VMs, which stranded memory and blocked scheduling; the VMs now use - # ordinary memory (see the instancetypes in k8s-gitops). - "transparent_hugepage=madvise" - ]; } diff --git a/hosts/12kingdoms-youko/default.nix b/hosts/12kingdoms-youko/default.nix index 34fab148..f33ec3c0 100644 --- a/hosts/12kingdoms-youko/default.nix +++ b/hosts/12kingdoms-youko/default.nix @@ -91,13 +91,10 @@ in systemd.services.restic-rest-server.unitConfig.RequiresMountsFor = "/data/backups"; boot.kernelParams = [ - # Use transparent huge pages on demand (madvise) instead of a fixed 1G hugetlb - # pool (cannot be overcommitted/shared; it stranded memory and blocked - # scheduling). The VMs now use ordinary memory. - "transparent_hugepage=madvise" - # --- mitigations for the flaky USB-SATA bridge the two 4TB HDDs sit behind. # It is a JMicron JMS567 that resets and throws link (UDMA-CRC) + I/O errors. + # Keep until the bridge/controller is replaced; smartctl_exporter now tracks + # the drives' CRC/media errors, which is the signal to re-evaluate. "usbcore.autosuspend=-1" # no USB autosuspend "usb-storage.delay_use=10" # give the bridge time to settle after probing ]; diff --git a/hosts/idols-ai/default.nix b/hosts/idols-ai/default.nix index 426a108a..c1aa93bb 100644 --- a/hosts/idols-ai/default.nix +++ b/hosts/idols-ai/default.nix @@ -78,6 +78,7 @@ in # QEMU/KVM(HostCpuOnly) for local VMs. environment.systemPackages = [ pkgs.qemu_kvm ]; + # Re-evaluate after the Insta360 Link firmware or the kernel's uvcvideo changes. powerManagement.resumeCommands = '' # Insta360 Link may stay enumerated with a stalled UVC endpoint after S3 resume. ${pkgs.coreutils}/bin/sleep 1 diff --git a/hosts/idols-ai/hardware-intel.nix b/hosts/idols-ai/hardware-intel.nix index 9dae829c..ed7c1ad6 100644 --- a/hosts/idols-ai/hardware-intel.nix +++ b/hosts/idols-ai/hardware-intel.nix @@ -50,7 +50,11 @@ # May help if FFmpeg/VAAPI/QSV init fails (esp. on Arc with i915): hardware.enableRedistributableFirmware = true; - boot.kernelParams = [ "i915.enable_guc=3" ]; + # (dropped) `i915.enable_guc=3`: i915's `enable_guc` is a "dangerous" option + # (it taints the kernel), and since Alder Lake the driver already auto-enables + # HuC + GuC submission on non-TGL/RKL Gen12+ platforms -- including this Arrow + # Lake-S iGPU, where auto = `HuC | GuC submission` = 3. Re-add only if + # VAAPI/QSV init regresses. # May help services that have trouble accessing /dev/dri (e.g., jellyfin/plex): # users.users..extraGroups = [ "video" "render" ]; diff --git a/modules/darwin/nix-core.nix b/modules/darwin/nix-core.nix index 502e0d0c..8b64bd47 100644 --- a/modules/darwin/nix-core.nix +++ b/modules/darwin/nix-core.nix @@ -17,11 +17,6 @@ # conflicts with nix-darwin's native Nix management. so we should disable this option. nix.enable = false; - # Disable auto-optimise-store because of this issue: - # https://github.com/NixOS/nix/issues/7273 - # "error: cannot link '/nix/store/.tmp-link-xxxxx-xxxxx' to '/nix/store/.links/xxxx': File exists" - nix.settings.auto-optimise-store = false; - nix.gc.automatic = false; system.stateVersion = 5; diff --git a/modules/nixos/base/kernel-hardening.nix b/modules/nixos/base/kernel-hardening.nix index 7f05ac51..034856de 100644 --- a/modules/nixos/base/kernel-hardening.nix +++ b/modules/nixos/base/kernel-hardening.nix @@ -5,7 +5,10 @@ ... }: { - # Kernel module blacklisting to mitigate Dirty Frag LPE (Local Privilege Escalation) vulnerabilities. + # Blacklist unused kernel modules to shrink the attack surface. esp4/esp6/rxrpc + # were the vectors for the Dirty Frag LPE (CVE-2026-43284 / CVE-2026-43500); + # kept as defence in depth even though the upstream fix has long landed, since + # nothing here uses them. boot.blacklistedKernelModules = [ "esp4" "esp6"