From 0e5d0b138fbb6c2859bb1cf9a2ec030e42f16eca Mon Sep 17 00:00:00 2001 From: Sandwich Date: Tue, 13 Oct 2026 01:19:34 +0200 Subject: [PATCH] fix(pkg): build dkms kvm from 7.2.9 and pin to the exact release --- README.md | 19 ++++++++------- packaging/vfio-native-kvm-dkms/.SRCINFO | 12 +++++----- packaging/vfio-native-kvm-dkms/PKGBUILD | 24 +++++++++++-------- .../dkms-out-of-tree.patch | 4 ++-- packaging/vfio-native-kvm-dkms/dkms.conf | 7 +++--- .../vfio-native-kvm-dkms/kvm-native.hook | 4 ++-- .../vfio-native-kvm-dkms.install | 12 +++++----- 7 files changed, 44 insertions(+), 38 deletions(-) diff --git a/README.md b/README.md index 9f6c264..0abd962 100644 --- a/README.md +++ b/README.md @@ -66,7 +66,7 @@ cd vfio-native/packaging | --- | --- | | `vfio-native` | the three commands, the patches, the ACPI tables, the benchmark, the libvirt hook | | `vfio-native-qemu` | QEMU 11.1.2 with the platform-identity patches, in `/opt/qemu-native` | -| `vfio-native-kvm-dkms` | the patched KVM modules, rebuilt by DKMS for every installed 7.2.x kernel | +| `vfio-native-kvm-dkms` | the patched KVM modules, rebuilt by DKMS for every installed kernel of its pinned release | The modules land in `updates/dkms/`, which modprobe prefers, but nothing reloads them for you. With every VM shut down: @@ -87,8 +87,8 @@ any further to use it: Only `full` needs the QEMU and KVM packages. `native` is domain XML only. Not an Arch user? The scripts in `scripts/` are plain shell and work standalone, and the module -sources build as `arch/x86/kvm` against any 7.2.x tree; `scripts/install-modules.sh` is the manual -path. The packaging is convenience, not a dependency. +patches build as `arch/x86/kvm` from a kernel tree of the release you run; +`scripts/install-modules.sh` is the manual path. The packaging is convenience, not a dependency. ### 2. Fix the guest, once @@ -215,7 +215,7 @@ corrected. | --- | --- | --- | --- | | `tuned` | 13/85 | nothing | none | | `native` | 7/85 | nothing | none | -| `full` | **1/85** | `vfio-native-qemu` + `vfio-native-kvm-dkms`, passthrough switched on after boot | DKMS rebuilds on kernel updates inside 7.2.x | +| `full` | **1/85** | `vfio-native-qemu` + `vfio-native-kvm-dkms`, passthrough switched on after boot | bump the DKMS package on every kernel release | `tuned` buys the pinning and the cache-domain sizing and nothing else. @@ -333,14 +333,15 @@ which libvirt runs after any `qemu` hook you already have, so it does not replac | Event | `tuned` / `native` | `full` | | --- | --- | --- | -| Kernel update inside 7.2.x | nothing | DKMS rebuilds the modules; reload or reboot | -| Kernel update past 7.2 | nothing | **the modules stop building** - bump `_kver` in the DKMS package | +| Kernel rebuild of the same release | nothing | DKMS rebuilds the modules; reload or reboot | +| Kernel update to a new release | nothing | **the modules stop building** - bump `_kver` in the DKMS package | | QEMU package update | nothing | nothing, `/opt/qemu-native` is its own package | | Newer QEMU base | nothing | re-apply `patches/qemu/` | -The DKMS tree carries 7.2.3's KVM sources. They build against any 7.2.x headers, and DKMS refuses -anything else, so after a kernel upgrade past 7.2 the stock modules load silently, the guest boots -fine and scores worse, with nothing to tell you but a pacman hook message: +The DKMS tree carries one stable release's KVM sources, and DKMS refuses every other release: +stable updates change KVM too, so a mismatched tree either fails to compile or silently builds +stale code. After any kernel upgrade the stock modules load silently, the guest boots fine and +scores worse, with nothing to tell you but a pacman hook message: ```sh cat /sys/module/kvm/srcversion /sys/module/kvm_amd/srcversion diff --git a/packaging/vfio-native-kvm-dkms/.SRCINFO b/packaging/vfio-native-kvm-dkms/.SRCINFO index 3542d66..e5fbd9f 100644 --- a/packaging/vfio-native-kvm-dkms/.SRCINFO +++ b/packaging/vfio-native-kvm-dkms/.SRCINFO @@ -1,6 +1,6 @@ pkgbase = vfio-native-kvm-dkms - pkgdesc = KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels) - pkgver = 7.2.3 + pkgdesc = KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.9 kernels) + pkgver = 7.2.9 pkgrel = 1 url = https://git.archworks.co/sandwich/vfio-native install = vfio-native-kvm-dkms.install @@ -11,14 +11,14 @@ pkgbase = vfio-native-kvm-dkms optdepends = vfio-native: the setup and verification tooling provides = vfio-native-kvm conflicts = vfio-native-kvm - noextract = linux-7.2.3.tar.xz - source = git+https://git.archworks.co/sandwich/vfio-native.git#tag=v1.4.0 - source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.3.tar.xz + noextract = linux-7.2.9.tar.xz + source = git+https://git.archworks.co/sandwich/vfio-native.git#tag=v1.4.3 + source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.9.tar.xz source = dkms.conf source = dkms-out-of-tree.patch source = kvm-native.hook sha256sums = SKIP - sha256sums = 8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03 + sha256sums = b4c5dfbe51a364a6c7f03869200f88c8e1f77403539005f14b7fc6bc91b8d8ba sha256sums = SKIP sha256sums = SKIP sha256sums = SKIP diff --git a/packaging/vfio-native-kvm-dkms/PKGBUILD b/packaging/vfio-native-kvm-dkms/PKGBUILD index 78333db..c9999c4 100644 --- a/packaging/vfio-native-kvm-dkms/PKGBUILD +++ b/packaging/vfio-native-kvm-dkms/PKGBUILD @@ -1,8 +1,8 @@ # Maintainer: Sandwich # # KVM modules patched for architectural conformance, built by DKMS against -# whichever 7.2.x kernels are installed. Three VMAware checks stop firing as a -# direct consequence, because the fix is to raise the exception the +# every installed kernel of _kver's release. Three VMAware checks stop firing +# as a direct consequence, because the fix is to raise the exception the # architecture specifies: # # SVM_EXCEPTIONS a CPL>0 SVM instruction must raise #UD, not #GP @@ -17,20 +17,23 @@ # vanilla kernel of the same version and builds them against the installed # headers; the two Makefile paths that assume an in-tree build are redirected. # The KVM sources do not differ between the Arch flavours of one version (the -# module srcversion is identical on linux and linux-cachyos-bore 7.2.3), so one -# source tree serves all of them. +# module srcversion is identical on linux and linux-cachyos-bore 7.2.3 and +# 7.2.9), so one source tree serves all of them. # -# THE PIN: the sources are 7.2.3's. They build against any 7.2.x headers and -# are refused for anything else, so after a kernel upgrade past 7.2 the stock +# THE PIN: the sources are one stable release's and DKMS refuses every other. +# Stable updates change KVM too: 7.2.9 moved declarations out of the installed +# headers into arch/x86/kvm, so 7.2.3's tree stopped compiling, and 7.2.10 +# changes svm.c and x86.c without touching a header, so 7.2.9's tree would +# build there and silently drop those fixes. After any kernel upgrade the stock # modules load silently and the three checks come back. Bump _kver here. pkgname=vfio-native-kvm-dkms _pkgbase=vfio-native-kvm -_kver=7.2.3 +_kver=7.2.9 _tag=1.4.3 pkgver=${_kver} pkgrel=1 -pkgdesc="KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels)" +pkgdesc="KVM modules patched to raise the exceptions the architecture specifies (DKMS, ${_kver} kernels)" arch=('x86_64') url="https://git.archworks.co/sandwich/vfio-native" license=('GPL-2.0-only') @@ -47,7 +50,7 @@ source=("git+${url}.git#tag=v${_tag}" 'kvm-native.hook') noextract=("linux-${_kver}.tar.xz") sha256sums=('SKIP' - '8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03' + 'b4c5dfbe51a364a6c7f03869200f88c8e1f77403539005f14b7fc6bc91b8d8ba' 'SKIP' 'SKIP' 'SKIP') @@ -70,5 +73,6 @@ package() { cp -r "linux-${_kver}/arch/x86/kvm" "${dest}/arch/x86/" cp -r "linux-${_kver}/virt/kvm" "${dest}/virt/" sed "s/@PKGVER@/${pkgver}/" dkms.conf > "${dest}/dkms.conf" - install -Dm644 kvm-native.hook "${pkgdir}/usr/share/libalpm/hooks/90-vfio-native-kvm.hook" + install -dm755 "${pkgdir}/usr/share/libalpm/hooks" + sed "s/@PKGVER@/${pkgver}/g" kvm-native.hook > "${pkgdir}/usr/share/libalpm/hooks/90-vfio-native-kvm.hook" } diff --git a/packaging/vfio-native-kvm-dkms/dkms-out-of-tree.patch b/packaging/vfio-native-kvm-dkms/dkms-out-of-tree.patch index 36289a8..352ac6b 100644 --- a/packaging/vfio-native-kvm-dkms/dkms-out-of-tree.patch +++ b/packaging/vfio-native-kvm-dkms/dkms-out-of-tree.patch @@ -12,8 +12,8 @@ virt/kvm makefile must come from the module tree, not from the headers. -include $(srctree)/virt/kvm/Makefile.kvm +include $(src)/../../../virt/kvm/Makefile.kvm - kvm-y += x86.o emulate.o irq.o lapic.o cpuid.o pmu.o mtrr.o \ - debugfs.o mmu/mmu.o mmu/page_track.o mmu/spte.o + kvm-y += x86.o emulate.o irq.o lapic.o cpuid.o pmu.o regs.o \ + mtrr.o debugfs.o mmu/mmu.o mmu/page_track.o mmu/spte.o --- a/arch/x86/kvm/trace.h +++ b/arch/x86/kvm/trace.h @@ -1968,7 +1968,7 @@ diff --git a/packaging/vfio-native-kvm-dkms/dkms.conf b/packaging/vfio-native-kvm-dkms/dkms.conf index e751073..372c189 100644 --- a/packaging/vfio-native-kvm-dkms/dkms.conf +++ b/packaging/vfio-native-kvm-dkms/dkms.conf @@ -1,8 +1,9 @@ PACKAGE_NAME="vfio-native-kvm" PACKAGE_VERSION="@PKGVER@" -# 7.2.3's KVM sources build against 7.2.x headers only; refuse anything else -# loudly instead of producing a module that will not load. -BUILD_EXCLUSIVE_KERNEL="^7\.2\." +# The KVM sources are this exact kernel release's. Stable updates move KVM +# declarations between the headers and arch/x86/kvm, so any other release +# either fails to build or silently builds stale KVM code; refuse it. +BUILD_EXCLUSIVE_KERNEL="^${PACKAGE_VERSION//./\\.}-" MAKE[0]="make -C /usr/lib/modules/${kernelver}/build M=${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/build/arch/x86/kvm modules" BUILT_MODULE_NAME[0]="kvm" BUILT_MODULE_LOCATION[0]="arch/x86/kvm" diff --git a/packaging/vfio-native-kvm-dkms/kvm-native.hook b/packaging/vfio-native-kvm-dkms/kvm-native.hook index b12e471..c0fa0a4 100644 --- a/packaging/vfio-native-kvm-dkms/kvm-native.hook +++ b/packaging/vfio-native-kvm-dkms/kvm-native.hook @@ -1,4 +1,4 @@ -# Warns when a kernel outside the DKMS tree's 7.2.x range is installed. +# Warns when a kernel other than the DKMS tree's own release is installed. # # Without this the failure is silent: DKMS skips the build, the stock modules # load, the guest boots normally, and the only symptom is three detections @@ -13,4 +13,4 @@ Target = usr/lib/modules/*/vmlinuz Description = Checking that vfio-native-kvm-dkms can build for the new kernel... When = PostTransaction NeedsTargets -Exec = /usr/bin/sh -c 'while read -r p; do k=${p#usr/lib/modules/}; k=${k%/vmlinuz}; case "$k" in 7.2.*) ;; *) echo ">>> vfio-native-kvm-dkms carries 7.2.3 sources and will not build for $k."; echo ">>> Stock KVM loads there and SVM_EXCEPTIONS, KVM_INTERCEPTION and DBVM come back.";; esac; done' +Exec = /usr/bin/sh -c 'while read -r p; do k=${p#usr/lib/modules/}; k=${k%/vmlinuz}; case "$k" in @PKGVER@-*) ;; *) echo ">>> vfio-native-kvm-dkms carries @PKGVER@ sources and will not build for $k."; echo ">>> Stock KVM loads there and SVM_EXCEPTIONS, KVM_INTERCEPTION and DBVM come back.";; esac; done' diff --git a/packaging/vfio-native-kvm-dkms/vfio-native-kvm-dkms.install b/packaging/vfio-native-kvm-dkms/vfio-native-kvm-dkms.install index 5dcec4f..946e98b 100644 --- a/packaging/vfio-native-kvm-dkms/vfio-native-kvm-dkms.install +++ b/packaging/vfio-native-kvm-dkms/vfio-native-kvm-dkms.install @@ -1,8 +1,8 @@ post_install() { - cat <<'MSG' + cat <