fix(pkg): build dkms kvm from 7.2.9 and pin to the exact release

README.md

@@ -66,7 +66,7 @@ cd vfio-native/packaging
 | --- | --- |
 | `vfio-native` | the three commands, the patches, the ACPI tables, the benchmark, the libvirt hook |
 | `vfio-native-qemu` | QEMU 11.1.2 with the platform-identity patches, in `/opt/qemu-native` |
-| `vfio-native-kvm-dkms` | the patched KVM modules, rebuilt by DKMS for every installed 7.2.x kernel |
+| `vfio-native-kvm-dkms` | the patched KVM modules, rebuilt by DKMS for every installed kernel of its pinned release |
 
 The modules land in `updates/dkms/`, which modprobe prefers, but nothing reloads them for you.
 With every VM shut down:
@@ -87,8 +87,8 @@ any further to use it:
 Only `full` needs the QEMU and KVM packages. `native` is domain XML only.
 
 Not an Arch user? The scripts in `scripts/` are plain shell and work standalone, and the module
-sources build as `arch/x86/kvm` against any 7.2.x tree; `scripts/install-modules.sh` is the manual
+patches build as `arch/x86/kvm` from a kernel tree of the release you run;
-path. The packaging is convenience, not a dependency.
+`scripts/install-modules.sh` is the manual path. The packaging is convenience, not a dependency.
 
 ### 2. Fix the guest, once
 
@@ -215,7 +215,7 @@ corrected.
 | --- | --- | --- | --- |
 | `tuned` | 13/85 | nothing | none |
 | `native` | 7/85 | nothing | none |
-| `full` | **1/85** | `vfio-native-qemu` + `vfio-native-kvm-dkms`, passthrough switched on after boot | DKMS rebuilds on kernel updates inside 7.2.x |
+| `full` | **1/85** | `vfio-native-qemu` + `vfio-native-kvm-dkms`, passthrough switched on after boot | bump the DKMS package on every kernel release |
 
 `tuned` buys the pinning and the cache-domain sizing and nothing else.
 
@@ -333,14 +333,15 @@ which libvirt runs after any `qemu` hook you already have, so it does not replac
 
 | Event | `tuned` / `native` | `full` |
 | --- | --- | --- |
-| Kernel update inside 7.2.x | nothing | DKMS rebuilds the modules; reload or reboot |
+| Kernel rebuild of the same release | nothing | DKMS rebuilds the modules; reload or reboot |
-| Kernel update past 7.2 | nothing | **the modules stop building** - bump `_kver` in the DKMS package |
+| Kernel update to a new release | nothing | **the modules stop building** - bump `_kver` in the DKMS package |
 | QEMU package update | nothing | nothing, `/opt/qemu-native` is its own package |
 | Newer QEMU base | nothing | re-apply `patches/qemu/` |
 
-The DKMS tree carries 7.2.3's KVM sources. They build against any 7.2.x headers, and DKMS refuses
+The DKMS tree carries one stable release's KVM sources, and DKMS refuses every other release:
-anything else, so after a kernel upgrade past 7.2 the stock modules load silently, the guest boots
+stable updates change KVM too, so a mismatched tree either fails to compile or silently builds
-fine and scores worse, with nothing to tell you but a pacman hook message:
+stale code. After any kernel upgrade the stock modules load silently, the guest boots fine and
+scores worse, with nothing to tell you but a pacman hook message:
 
 ```sh
 cat /sys/module/kvm/srcversion /sys/module/kvm_amd/srcversion

packaging/vfio-native-kvm-dkms/.SRCINFO

@@ -1,6 +1,6 @@
 pkgbase = vfio-native-kvm-dkms
-	pkgdesc = KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels)
+	pkgdesc = KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.9 kernels)
-	pkgver = 7.2.3
+	pkgver = 7.2.9
 	pkgrel = 1
 	url = https://git.archworks.co/sandwich/vfio-native
 	install = vfio-native-kvm-dkms.install
@@ -11,14 +11,14 @@ pkgbase = vfio-native-kvm-dkms
 	optdepends = vfio-native: the setup and verification tooling
 	provides = vfio-native-kvm
 	conflicts = vfio-native-kvm
-	noextract = linux-7.2.3.tar.xz
+	noextract = linux-7.2.9.tar.xz
-	source = git+https://git.archworks.co/sandwich/vfio-native.git#tag=v1.4.0
+	source = git+https://git.archworks.co/sandwich/vfio-native.git#tag=v1.4.3
-	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.3.tar.xz
+	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.9.tar.xz
 	source = dkms.conf
 	source = dkms-out-of-tree.patch
 	source = kvm-native.hook
 	sha256sums = SKIP
-	sha256sums = 8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03
+	sha256sums = b4c5dfbe51a364a6c7f03869200f88c8e1f77403539005f14b7fc6bc91b8d8ba
 	sha256sums = SKIP
 	sha256sums = SKIP
 	sha256sums = SKIP

packaging/vfio-native-kvm-dkms/PKGBUILD

@@ -1,8 +1,8 @@
 # Maintainer: Sandwich <sandwich@archworks.co>
 #
 # KVM modules patched for architectural conformance, built by DKMS against
-# whichever 7.2.x kernels are installed. Three VMAware checks stop firing as a
+# every installed kernel of _kver's release. Three VMAware checks stop firing
-# direct consequence, because the fix is to raise the exception the
+# as a direct consequence, because the fix is to raise the exception the
 # architecture specifies:
 #
 #   SVM_EXCEPTIONS    a CPL>0 SVM instruction must raise #UD, not #GP
@@ -17,20 +17,23 @@
 # vanilla kernel of the same version and builds them against the installed
 # headers; the two Makefile paths that assume an in-tree build are redirected.
 # The KVM sources do not differ between the Arch flavours of one version (the
-# module srcversion is identical on linux and linux-cachyos-bore 7.2.3), so one
+# module srcversion is identical on linux and linux-cachyos-bore 7.2.3 and
-# source tree serves all of them.
+# 7.2.9), so one source tree serves all of them.
 #
-# THE PIN: the sources are 7.2.3's. They build against any 7.2.x headers and
+# THE PIN: the sources are one stable release's and DKMS refuses every other.
-# are refused for anything else, so after a kernel upgrade past 7.2 the stock
+# Stable updates change KVM too: 7.2.9 moved declarations out of the installed
+# headers into arch/x86/kvm, so 7.2.3's tree stopped compiling, and 7.2.10
+# changes svm.c and x86.c without touching a header, so 7.2.9's tree would
+# build there and silently drop those fixes. After any kernel upgrade the stock
 # modules load silently and the three checks come back. Bump _kver here.
 
 pkgname=vfio-native-kvm-dkms
 _pkgbase=vfio-native-kvm
-_kver=7.2.3
+_kver=7.2.9
 _tag=1.4.3
 pkgver=${_kver}
 pkgrel=1
-pkgdesc="KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels)"
+pkgdesc="KVM modules patched to raise the exceptions the architecture specifies (DKMS, ${_kver} kernels)"
 arch=('x86_64')
 url="https://git.archworks.co/sandwich/vfio-native"
 license=('GPL-2.0-only')
@@ -47,7 +50,7 @@ source=("git+${url}.git#tag=v${_tag}"
         'kvm-native.hook')
 noextract=("linux-${_kver}.tar.xz")
 sha256sums=('SKIP'
-            '8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03'
+            'b4c5dfbe51a364a6c7f03869200f88c8e1f77403539005f14b7fc6bc91b8d8ba'
             'SKIP'
             'SKIP'
             'SKIP')
@@ -70,5 +73,6 @@ package() {
     cp -r "linux-${_kver}/arch/x86/kvm" "${dest}/arch/x86/"
     cp -r "linux-${_kver}/virt/kvm"     "${dest}/virt/"
     sed "s/@PKGVER@/${pkgver}/" dkms.conf > "${dest}/dkms.conf"
-    install -Dm644 kvm-native.hook "${pkgdir}/usr/share/libalpm/hooks/90-vfio-native-kvm.hook"
+    install -dm755 "${pkgdir}/usr/share/libalpm/hooks"
+    sed "s/@PKGVER@/${pkgver}/g" kvm-native.hook > "${pkgdir}/usr/share/libalpm/hooks/90-vfio-native-kvm.hook"
 }

packaging/vfio-native-kvm-dkms/dkms-out-of-tree.patch

@@ -12,8 +12,8 @@ virt/kvm makefile must come from the module tree, not from the headers.
 -include $(srctree)/virt/kvm/Makefile.kvm
 +include $(src)/../../../virt/kvm/Makefile.kvm
  
- kvm-y			+= x86.o emulate.o irq.o lapic.o cpuid.o pmu.o mtrr.o \
+ kvm-y			+= x86.o emulate.o irq.o lapic.o cpuid.o pmu.o regs.o \
- 			   debugfs.o mmu/mmu.o mmu/page_track.o mmu/spte.o
+ 			   mtrr.o debugfs.o mmu/mmu.o mmu/page_track.o mmu/spte.o
 --- a/arch/x86/kvm/trace.h
 +++ b/arch/x86/kvm/trace.h
 @@ -1968,7 +1968,7 @@

packaging/vfio-native-kvm-dkms/dkms.conf

@@ -1,8 +1,9 @@
 PACKAGE_NAME="vfio-native-kvm"
 PACKAGE_VERSION="@PKGVER@"
-# 7.2.3's KVM sources build against 7.2.x headers only; refuse anything else
+# The KVM sources are this exact kernel release's. Stable updates move KVM
-# loudly instead of producing a module that will not load.
+# declarations between the headers and arch/x86/kvm, so any other release
-BUILD_EXCLUSIVE_KERNEL="^7\.2\."
+# either fails to build or silently builds stale KVM code; refuse it.
+BUILD_EXCLUSIVE_KERNEL="^${PACKAGE_VERSION//./\\.}-"
 MAKE[0]="make -C /usr/lib/modules/${kernelver}/build M=${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/build/arch/x86/kvm modules"
 BUILT_MODULE_NAME[0]="kvm"
 BUILT_MODULE_LOCATION[0]="arch/x86/kvm"

packaging/vfio-native-kvm-dkms/kvm-native.hook

@@ -1,4 +1,4 @@
-# Warns when a kernel outside the DKMS tree's 7.2.x range is installed.
+# Warns when a kernel other than the DKMS tree's own release is installed.
 #
 # Without this the failure is silent: DKMS skips the build, the stock modules
 # load, the guest boots normally, and the only symptom is three detections
@@ -13,4 +13,4 @@ Target = usr/lib/modules/*/vmlinuz
 Description = Checking that vfio-native-kvm-dkms can build for the new kernel...
 When = PostTransaction
 NeedsTargets
-Exec = /usr/bin/sh -c 'while read -r p; do k=${p#usr/lib/modules/}; k=${k%/vmlinuz}; case "$k" in 7.2.*) ;; *) echo ">>> vfio-native-kvm-dkms carries 7.2.3 sources and will not build for $k."; echo ">>> Stock KVM loads there and SVM_EXCEPTIONS, KVM_INTERCEPTION and DBVM come back.";; esac; done'
+Exec = /usr/bin/sh -c 'while read -r p; do k=${p#usr/lib/modules/}; k=${k%/vmlinuz}; case "$k" in @PKGVER@-*) ;; *) echo ">>> vfio-native-kvm-dkms carries @PKGVER@ sources and will not build for $k."; echo ">>> Stock KVM loads there and SVM_EXCEPTIONS, KVM_INTERCEPTION and DBVM come back.";; esac; done'

packaging/vfio-native-kvm-dkms/vfio-native-kvm-dkms.install

@@ -1,8 +1,8 @@
 post_install() {
-    cat <<'MSG'
+    cat <<MSG
 
   vfio-native-kvm-dkms: DKMS builds the patched kvm, kvm-amd and kvm-intel
-  for every installed 7.2.x kernel with headers, into updates/, which modprobe
+  for every installed ${1%-*} kernel with headers, into updates/, which modprobe
   prefers over the in-tree modules. They are NOT loaded yet.
 
   With every VM shut down:
@@ -14,11 +14,11 @@ post_install() {
       cat /sys/module/kvm/srcversion /sys/module/kvm_amd/srcversion
       modinfo -F srcversion kvm kvm_amd
 
-  THE PIN: these are 7.2.3's KVM sources. DKMS refuses to build them for a
+  THE PIN: these are ${1%-*}'s KVM sources. DKMS refuses to build them for
-  kernel outside 7.2.x, the stock modules load silently, and three detections
+  any other kernel release, the stock modules load silently, and three
-  come back. A pacman hook warns when that happens.
+  detections come back. A pacman hook warns when that happens.
 
 MSG
 }
-post_upgrade() { post_install; }
+post_upgrade() { post_install "$1"; }
 post_remove() { echo "  Stock KVM loads on the next boot, or reload the modules now."; }