sandwich/vfio-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(pkg): build dkms kvm from 7.2.9 and pin to the exact release

Browse Source
This commit is contained in:
sandwich
2026-10-13 01:19:34 +02:00
parent 0ee2c8d63a
commit 0e5d0b138f
7 changed files with 44 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packaging/vfio-native-kvm-dkms/.SRCINFO
+6 -6
View File
@@ -1,6 +1,6 @@
pkgbase = vfio-native-kvm-dkms
pkgdesc = KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels)
pkgver = 7.2.3
pkgdesc = KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.9 kernels)
pkgver = 7.2.9
pkgrel = 1
url = https://git.archworks.co/sandwich/vfio-native
install = vfio-native-kvm-dkms.install
@@ -11,14 +11,14 @@ pkgbase = vfio-native-kvm-dkms
optdepends = vfio-native: the setup and verification tooling
provides = vfio-native-kvm
conflicts = vfio-native-kvm
noextract = linux-7.2.3.tar.xz
source = git+https://git.archworks.co/sandwich/vfio-native.git#tag=v1.4.0
source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.3.tar.xz
noextract = linux-7.2.9.tar.xz
source = git+https://git.archworks.co/sandwich/vfio-native.git#tag=v1.4.3
source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.9.tar.xz
source = dkms.conf
source = dkms-out-of-tree.patch
source = kvm-native.hook
sha256sums = SKIP
sha256sums = 8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03
sha256sums = b4c5dfbe51a364a6c7f03869200f88c8e1f77403539005f14b7fc6bc91b8d8ba
sha256sums = SKIP
sha256sums = SKIP
sha256sums = SKIP
packaging/vfio-native-kvm-dkms/PKGBUILD
+14 -10
View File
@@ -1,8 +1,8 @@
# Maintainer: Sandwich <sandwich@archworks.co>
#
# KVM modules patched for architectural conformance, built by DKMS against
# whichever 7.2.x kernels are installed. Three VMAware checks stop firing as a
# direct consequence, because the fix is to raise the exception the
# every installed kernel of _kver's release. Three VMAware checks stop firing
# as a direct consequence, because the fix is to raise the exception the
# architecture specifies:
#
# SVM_EXCEPTIONS a CPL>0 SVM instruction must raise #UD, not #GP
@@ -17,20 +17,23 @@
# vanilla kernel of the same version and builds them against the installed
# headers; the two Makefile paths that assume an in-tree build are redirected.
# The KVM sources do not differ between the Arch flavours of one version (the
# module srcversion is identical on linux and linux-cachyos-bore 7.2.3), so one
# source tree serves all of them.
# module srcversion is identical on linux and linux-cachyos-bore 7.2.3 and
# 7.2.9), so one source tree serves all of them.
#
# THE PIN: the sources are 7.2.3's. They build against any 7.2.x headers and
# are refused for anything else, so after a kernel upgrade past 7.2 the stock
# THE PIN: the sources are one stable release's and DKMS refuses every other.
# Stable updates change KVM too: 7.2.9 moved declarations out of the installed
# headers into arch/x86/kvm, so 7.2.3's tree stopped compiling, and 7.2.10
# changes svm.c and x86.c without touching a header, so 7.2.9's tree would
# build there and silently drop those fixes. After any kernel upgrade the stock
# modules load silently and the three checks come back. Bump _kver here.
pkgname=vfio-native-kvm-dkms
_pkgbase=vfio-native-kvm
_kver=7.2.3
_kver=7.2.9
_tag=1.4.3
pkgver=${_kver}
pkgrel=1
pkgdesc="KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels)"
pkgdesc="KVM modules patched to raise the exceptions the architecture specifies (DKMS, ${_kver} kernels)"
arch=('x86_64')
url="https://git.archworks.co/sandwich/vfio-native"
license=('GPL-2.0-only')
@@ -47,7 +50,7 @@ source=("git+${url}.git#tag=v${_tag}"
'kvm-native.hook')
noextract=("linux-${_kver}.tar.xz")
sha256sums=('SKIP'
'8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03'
'b4c5dfbe51a364a6c7f03869200f88c8e1f77403539005f14b7fc6bc91b8d8ba'
'SKIP'
'SKIP'
'SKIP')
@@ -70,5 +73,6 @@ package() {
cp -r "linux-${_kver}/arch/x86/kvm" "${dest}/arch/x86/"
cp -r "linux-${_kver}/virt/kvm" "${dest}/virt/"
sed "s/@PKGVER@/${pkgver}/" dkms.conf > "${dest}/dkms.conf"
install -Dm644 kvm-native.hook "${pkgdir}/usr/share/libalpm/hooks/90-vfio-native-kvm.hook"
install -dm755 "${pkgdir}/usr/share/libalpm/hooks"
sed "s/@PKGVER@/${pkgver}/g" kvm-native.hook > "${pkgdir}/usr/share/libalpm/hooks/90-vfio-native-kvm.hook"
}
packaging/vfio-native-kvm-dkms/dkms-out-of-tree.patch
+2 -2
View File
@@ -12,8 +12,8 @@ virt/kvm makefile must come from the module tree, not from the headers.
-include $(srctree)/virt/kvm/Makefile.kvm
+include $(src)/../../../virt/kvm/Makefile.kvm
kvm-y += x86.o emulate.o irq.o lapic.o cpuid.o pmu.o mtrr.o \
debugfs.o mmu/mmu.o mmu/page_track.o mmu/spte.o
kvm-y += x86.o emulate.o irq.o lapic.o cpuid.o pmu.o regs.o \
mtrr.o debugfs.o mmu/mmu.o mmu/page_track.o mmu/spte.o
--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -1968,7 +1968,7 @@
packaging/vfio-native-kvm-dkms/dkms.conf
+4 -3
View File
@@ -1,8 +1,9 @@
PACKAGE_NAME="vfio-native-kvm"
PACKAGE_VERSION="@PKGVER@"
# 7.2.3's KVM sources build against 7.2.x headers only; refuse anything else
# loudly instead of producing a module that will not load.
BUILD_EXCLUSIVE_KERNEL="^7\.2\."
# The KVM sources are this exact kernel release's. Stable updates move KVM
# declarations between the headers and arch/x86/kvm, so any other release
# either fails to build or silently builds stale KVM code; refuse it.
BUILD_EXCLUSIVE_KERNEL="^${PACKAGE_VERSION//./\\.}-"
MAKE[0]="make -C /usr/lib/modules/${kernelver}/build M=${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/build/arch/x86/kvm modules"
BUILT_MODULE_NAME[0]="kvm"
BUILT_MODULE_LOCATION[0]="arch/x86/kvm"
packaging/vfio-native-kvm-dkms/kvm-native.hook
+2 -2
View File
@@ -1,4 +1,4 @@
# Warns when a kernel outside the DKMS tree's 7.2.x range is installed.
# Warns when a kernel other than the DKMS tree's own release is installed.
#
# Without this the failure is silent: DKMS skips the build, the stock modules
# load, the guest boots normally, and the only symptom is three detections
@@ -13,4 +13,4 @@ Target = usr/lib/modules/*/vmlinuz
Description = Checking that vfio-native-kvm-dkms can build for the new kernel...
When = PostTransaction
NeedsTargets
Exec = /usr/bin/sh -c 'while read -r p; do k=${p#usr/lib/modules/}; k=${k%/vmlinuz}; case "$k" in 7.2.*) ;; *) echo ">>> vfio-native-kvm-dkms carries 7.2.3 sources and will not build for $k."; echo ">>> Stock KVM loads there and SVM_EXCEPTIONS, KVM_INTERCEPTION and DBVM come back.";; esac; done'
Exec = /usr/bin/sh -c 'while read -r p; do k=${p#usr/lib/modules/}; k=${k%/vmlinuz}; case "$k" in @PKGVER@-*) ;; *) echo ">>> vfio-native-kvm-dkms carries @PKGVER@ sources and will not build for $k."; echo ">>> Stock KVM loads there and SVM_EXCEPTIONS, KVM_INTERCEPTION and DBVM come back.";; esac; done'
packaging/vfio-native-kvm-dkms/vfio-native-kvm-dkms.install
+6 -6
View File
@@ -1,8 +1,8 @@
post_install() {
cat <<'MSG'
cat <<MSG
vfio-native-kvm-dkms: DKMS builds the patched kvm, kvm-amd and kvm-intel
for every installed 7.2.x kernel with headers, into updates/, which modprobe
for every installed ${1%-*} kernel with headers, into updates/, which modprobe
prefers over the in-tree modules. They are NOT loaded yet.
With every VM shut down:
@@ -14,11 +14,11 @@ post_install() {
cat /sys/module/kvm/srcversion /sys/module/kvm_amd/srcversion
modinfo -F srcversion kvm kvm_amd
THE PIN: these are 7.2.3's KVM sources. DKMS refuses to build them for a
kernel outside 7.2.x, the stock modules load silently, and three detections
come back. A pacman hook warns when that happens.
THE PIN: these are ${1%-*}'s KVM sources. DKMS refuses to build them for
any other kernel release, the stock modules load silently, and three
detections come back. A pacman hook warns when that happens.
MSG
}
post_upgrade() { post_install; }
post_upgrade() { post_install "$1"; }
post_remove() { echo " Stock KVM loads on the next boot, or reload the modules now."; }