Skip to content

fix(os): drop guest kernel drivers no CVM can reach #1160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kvinwang merged 1 commit into from
Sep 2, 2026
+59 −0
Merged

fix(os): drop guest kernel drivers no CVM can reach #1160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions os/mkosi/components/kernel/kernel.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -302,3 +302,38 @@ CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
# No IP6_NF_* counterpart to dstack-docker.cfg's: this image has no legacy
# tables at all, so there is no legacy ip6tables to complete. The nftables
# frontend synthesises the IPv6 nat table Incus lists, with no module behind it.

# Devices that cannot exist in a CVM. x86_64_defconfig builds these for bare
# metal, but a dstack guest only ever sees virtio, plus GVE on GCP and ENA on
# AWS, both enabled above. Leaving the rest in means a host that presents the
# matching PCI IDs can steer the guest into driver code no deployment uses.
# Passing a ConnectX NIC through later is an addition here -- CONFIG_MLX5_CORE
# and the INFINIBAND stack -- not a relaxation of these.
CONFIG_TIGON3=n
CONFIG_E100=n
CONFIG_E1000=n
CONFIG_E1000E=n
CONFIG_SKY2=n
CONFIG_FORCEDETH=n
CONFIG_8139TOO=n
CONFIG_R8169=n
CONFIG_NET_TULIP=n

# Buses and platform glue with no counterpart in a virtual machine.
CONFIG_PCCARD=n
CONFIG_AGP=n
CONFIG_MACINTOSH_DRIVERS=n
CONFIG_NVRAM=n

# Early-boot debug paths that exist to give an external device access to memory
# before the kernel is up. PROVIDE_OHCI1394_DMA_INIT enables FireWire DMA
# specifically so a machine can be debugged over the bus, which is the same
# primitive an untrusted host would want; EARLY_PRINTK_DBGP is the USB debug
# port equivalent. Neither is reachable from anything a tenant needs.
CONFIG_PROVIDE_OHCI1394_DMA_INIT=n
CONFIG_EARLY_PRINTK_DBGP=n

# NETCONSOLE ships the kernel log to a UDP peer. Inside a CVM that is an
# egress channel for whatever the log happens to contain, configurable at
# runtime by root, and nothing in the image uses it.
CONFIG_NETCONSOLE=n
24 changes: 24 additions & 0 deletions os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,3 +103,27 @@ CONFIG_FUSE_FS=y
CONFIG_CUSE=y
CONFIG_TCG_TPM=y
CONFIG_TCG_VTPM_PROXY=y

# Devices that cannot exist in a CVM. The linux-yocto baseline builds these for
# bare metal, but a dstack guest only ever sees virtio, plus gVNIC on GCP and
# ENA on AWS. Leaving them in means a host that presents the matching PCI IDs
# can steer the guest into driver code no deployment uses. Kept in step with
# os/mkosi/components/kernel/kernel.config so both guest kernels carry the same
# device policy. Passing a ConnectX NIC through later is an addition here --
# CONFIG_MLX5_CORE and the INFINIBAND stack -- not a relaxation of these.
CONFIG_TIGON3=n
CONFIG_E100=n
CONFIG_E1000=n
CONFIG_E1000E=n
CONFIG_SKY2=n
CONFIG_FORCEDETH=n
CONFIG_8139TOO=n
CONFIG_R8169=n
CONFIG_NET_TULIP=n
CONFIG_PCCARD=n
CONFIG_AGP=n
CONFIG_MACINTOSH_DRIVERS=n
CONFIG_NVRAM=n
CONFIG_PROVIDE_OHCI1394_DMA_INIT=n
CONFIG_EARLY_PRINTK_DBGP=n
CONFIG_NETCONSOLE=n
Loading