feat: arch packages with dkms kvm modules and patched qemu

packaging/vfio-native-kvm-dkms/.SRCINFO

@@ -0,0 +1,26 @@
+pkgbase = vfio-native-kvm-dkms
+	pkgdesc = KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels)
+	pkgver = 7.2.3
+	pkgrel = 1
+	url = https://git.archworks.co/sandwich/vfio-native
+	install = vfio-native-kvm-dkms.install
+	arch = x86_64
+	license = GPL-2.0-only
+	makedepends = git
+	depends = dkms
+	optdepends = vfio-native: the setup and verification tooling
+	provides = vfio-native-kvm
+	conflicts = vfio-native-kvm
+	noextract = linux-7.2.3.tar.xz
+	source = git+https://git.archworks.co/sandwich/vfio-native.git#tag=v1.1.0
+	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.3.tar.xz
+	source = dkms.conf
+	source = dkms-out-of-tree.patch
+	source = kvm-native.hook
+	sha256sums = SKIP
+	sha256sums = 8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03
+	sha256sums = SKIP
+	sha256sums = SKIP
+	sha256sums = SKIP
+
+pkgname = vfio-native-kvm-dkms

packaging/vfio-native-kvm-dkms/PKGBUILD

@@ -0,0 +1,74 @@
+# Maintainer: Sandwich <sandwich@archworks.co>
+#
+# KVM modules patched for architectural conformance, built by DKMS against
+# whichever 7.2.x kernels are installed. Three VMAware checks stop firing as a
+# direct consequence, because the fix is to raise the exception the
+# architecture specifies:
+#
+#   SVM_EXCEPTIONS    a CPL>0 SVM instruction must raise #UD, not #GP
+#   KVM_INTERCEPTION  a CPL>0 VMCALL/hypercall must raise #UD, not #GP or nothing
+#   DBVM              an ICEBP #DB must report the RIP after the instruction
+#
+# The experimental CPUID-passthrough patch is built in as well but is OFF by
+# default (module parameter cpuid_passthrough). It clears the last software
+# check, TIMER, on a 1:1-pinned guest; vm-native-setup prints how to enable it.
+#
+# KVM is in-tree, so the DKMS tree carries arch/x86/kvm and virt/kvm from the
+# vanilla kernel of the same version and builds them against the installed
+# headers; the two Makefile paths that assume an in-tree build are redirected.
+# The KVM sources do not differ between the Arch flavours of one version (the
+# module srcversion is identical on linux and linux-cachyos-bore 7.2.3), so one
+# source tree serves all of them.
+#
+# THE PIN: the sources are 7.2.3's. They build against any 7.2.x headers and
+# are refused for anything else, so after a kernel upgrade past 7.2 the stock
+# modules load silently and the three checks come back. Bump _kver here.
+
+pkgname=vfio-native-kvm-dkms
+_pkgbase=vfio-native-kvm
+_kver=7.2.3
+_tag=1.1.0
+pkgver=${_kver}
+pkgrel=1
+pkgdesc="KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels)"
+arch=('x86_64')
+url="https://git.archworks.co/sandwich/vfio-native"
+license=('GPL-2.0-only')
+depends=('dkms')
+makedepends=('git')
+optdepends=('vfio-native: the setup and verification tooling')
+provides=("${_pkgbase}")
+conflicts=("${_pkgbase}")
+install=${pkgname}.install
+source=("git+${url}.git#tag=v${_tag}"
+        "https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-${_kver}.tar.xz"
+        'dkms.conf'
+        'dkms-out-of-tree.patch'
+        'kvm-native.hook')
+noextract=("linux-${_kver}.tar.xz")
+sha256sums=('SKIP'
+            '8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03'
+            'SKIP'
+            'SKIP'
+            'SKIP')
+
+prepare() {
+    tar -xf "linux-${_kver}.tar.xz" --wildcards \
+        "linux-${_kver}/arch/x86/kvm/*" "linux-${_kver}/virt/kvm/*"
+    cd "linux-${_kver}"
+    for p in "${srcdir}"/vfio-native/patches/kvm/000[1234]-KVM-*.patch \
+             "${srcdir}"/vfio-native/patches/kvm/EXPERIMENTAL-0006-*.patch; do
+        msg2 "applying ${p##*/}"
+        patch -Np1 -i "$p"
+    done
+    patch -Np1 -i "${srcdir}/dkms-out-of-tree.patch"
+}
+
+package() {
+    local dest="${pkgdir}/usr/src/${_pkgbase}-${pkgver}"
+    install -dm755 "${dest}/arch/x86" "${dest}/virt"
+    cp -r "linux-${_kver}/arch/x86/kvm" "${dest}/arch/x86/"
+    cp -r "linux-${_kver}/virt/kvm"     "${dest}/virt/"
+    sed "s/@PKGVER@/${pkgver}/" dkms.conf > "${dest}/dkms.conf"
+    install -Dm644 kvm-native.hook "${pkgdir}/usr/share/libalpm/hooks/90-vfio-native-kvm.hook"
+}

packaging/vfio-native-kvm-dkms/dkms-out-of-tree.patch

@@ -0,0 +1,27 @@
+Build arch/x86/kvm as an external module: the include path and the shared
+virt/kvm makefile must come from the module tree, not from the headers.
+--- a/arch/x86/kvm/Makefile
++++ b/arch/x86/kvm/Makefile
+@@ -1,9 +1,9 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
+-ccflags-y += -I $(srctree)/arch/x86/kvm
++ccflags-y += -I $(src)
+ ccflags-$(CONFIG_KVM_WERROR) += -Werror
+ 
+-include $(srctree)/virt/kvm/Makefile.kvm
++include $(src)/../../../virt/kvm/Makefile.kvm
+ 
+ kvm-y			+= x86.o emulate.o irq.o lapic.o cpuid.o pmu.o mtrr.o \
+ 			   debugfs.o mmu/mmu.o mmu/page_track.o mmu/spte.o
+--- a/arch/x86/kvm/trace.h
++++ b/arch/x86/kvm/trace.h
+@@ -1968,7 +1968,7 @@
+ #endif /* _TRACE_KVM_H */
+ 
+ #undef TRACE_INCLUDE_PATH
+-#define TRACE_INCLUDE_PATH ../../arch/x86/kvm
++#define TRACE_INCLUDE_PATH .
+ #undef TRACE_INCLUDE_FILE
+ #define TRACE_INCLUDE_FILE trace
+ 

packaging/vfio-native-kvm-dkms/dkms.conf

@@ -0,0 +1,16 @@
+PACKAGE_NAME="vfio-native-kvm"
+PACKAGE_VERSION="@PKGVER@"
+# 7.2.3's KVM sources build against 7.2.x headers only; refuse anything else
+# loudly instead of producing a module that will not load.
+BUILD_EXCLUSIVE_KERNEL="^7\.2\."
+MAKE[0]="make -C /usr/lib/modules/${kernelver}/build M=${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/build/arch/x86/kvm modules"
+BUILT_MODULE_NAME[0]="kvm"
+BUILT_MODULE_LOCATION[0]="arch/x86/kvm"
+DEST_MODULE_LOCATION[0]="/updates"
+BUILT_MODULE_NAME[1]="kvm-amd"
+BUILT_MODULE_LOCATION[1]="arch/x86/kvm"
+DEST_MODULE_LOCATION[1]="/updates"
+BUILT_MODULE_NAME[2]="kvm-intel"
+BUILT_MODULE_LOCATION[2]="arch/x86/kvm"
+DEST_MODULE_LOCATION[2]="/updates"
+AUTOINSTALL="yes"

packaging/vfio-native-kvm-dkms/kvm-native.hook

@@ -0,0 +1,16 @@
+# Warns when a kernel outside the DKMS tree's 7.2.x range is installed.
+#
+# Without this the failure is silent: DKMS skips the build, the stock modules
+# load, the guest boots normally, and the only symptom is three detections
+# coming back.
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Type = Path
+Target = usr/lib/modules/*/vmlinuz
+
+[Action]
+Description = Checking that vfio-native-kvm-dkms can build for the new kernel...
+When = PostTransaction
+NeedsTargets
+Exec = /usr/bin/sh -c 'while read -r p; do k=${p#usr/lib/modules/}; k=${k%/vmlinuz}; case "$k" in 7.2.*) ;; *) echo ">>> vfio-native-kvm-dkms carries 7.2.3 sources and will not build for $k."; echo ">>> Stock KVM loads there and SVM_EXCEPTIONS, KVM_INTERCEPTION and DBVM come back.";; esac; done'

packaging/vfio-native-kvm-dkms/vfio-native-kvm-dkms.install

@@ -0,0 +1,24 @@
+post_install() {
+    cat <<'MSG'
+
+  vfio-native-kvm-dkms: DKMS builds the patched kvm, kvm-amd and kvm-intel
+  for every installed 7.2.x kernel with headers, into updates/, which modprobe
+  prefers over the in-tree modules. They are NOT loaded yet.
+
+  With every VM shut down:
+
+      sudo modprobe -r kvm_amd kvm && sudo modprobe kvm_amd     # or kvm_intel
+
+  Confirm BOTH took - checking one passes on a stale build of the other:
+
+      cat /sys/module/kvm/srcversion /sys/module/kvm_amd/srcversion
+      modinfo -F srcversion kvm kvm_amd
+
+  THE PIN: these are 7.2.3's KVM sources. DKMS refuses to build them for a
+  kernel outside 7.2.x, the stock modules load silently, and three detections
+  come back. A pacman hook warns when that happens.
+
+MSG
+}
+post_upgrade() { post_install; }
+post_remove() { echo "  Stock KVM loads on the next boot, or reload the modules now."; }