fix(os): drop init_on_free hardening that breaks GCP TDX boot

Author: kvinwang

os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg

@@ -49,10 +49,18 @@ CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=y
 
 # Production kernel self-protection baseline.
+#
+# CONFIG_INIT_ON_FREE_DEFAULT_ON is deliberately NOT set: with init_on_free=1
+# a GCP TDX guest is silently killed by the host during mem_encrypt_init()
+# (the 1 GiB SWIOTLB private->shared conversion) and reboot-loops before
+# reaching /init. Confirmed on c3-standard-4 by booting the same image with
+# init_on_alloc=0/init_on_free=0 cmdline overrides: only init_on_free=1
+# reproduces the reset; init_on_alloc=1 alone boots fine (and is kept below).
+# The same kernel with init_on_free=1 boots fine on AWS EC2 and QEMU TDX,
+# so this is a GCP host-side interaction, not a generic kernel bug.
 CONFIG_SECURITY_DMESG_RESTRICT=y
 CONFIG_IO_STRICT_DEVMEM=y
 CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
-CONFIG_INIT_ON_FREE_DEFAULT_ON=y
 CONFIG_SLAB_FREELIST_RANDOM=y
 CONFIG_SLAB_FREELIST_HARDENED=y
 CONFIG_HARDENED_USERCOPY=y

os/yocto/tools/aws/audit-aws-ec2-image-hardening.sh

@@ -150,7 +150,9 @@ echo "== Kernel hardening recommendations =="
 recommend_config CONFIG_SECURITY_DMESG_RESTRICT y
 recommend_config CONFIG_IO_STRICT_DEVMEM y
 recommend_config CONFIG_INIT_ON_ALLOC_DEFAULT_ON y
-recommend_config CONFIG_INIT_ON_FREE_DEFAULT_ON y
+# CONFIG_INIT_ON_FREE_DEFAULT_ON is intentionally not recommended: the unified
+# image also boots on GCP TDX, where init_on_free=1 makes the host kill the
+# guest during the SWIOTLB private->shared conversion (see dstack.cfg).
 recommend_config CONFIG_SLAB_FREELIST_RANDOM y
 recommend_config CONFIG_SLAB_FREELIST_HARDENED y
 recommend_config CONFIG_HARDENED_USERCOPY y