fix(pkg): build dkms kvm from 7.2.9 and pin to the exact release

README.md

@@ -66,7 +66,7 @@ cd vfio-native/packaging
 | --- | --- |
 | `vfio-native` | the three commands, the patches, the ACPI tables, the benchmark, the libvirt hook |
 | `vfio-native-qemu` | QEMU 11.1.2 with the platform-identity patches, in `/opt/qemu-native` |
-| `vfio-native-kvm-dkms` | the patched KVM modules, rebuilt by DKMS for every installed 7.2.x kernel |
+| `vfio-native-kvm-dkms` | the patched KVM modules, rebuilt by DKMS for every installed kernel of its pinned release |
 
 The modules land in `updates/dkms/`, which modprobe prefers, but nothing reloads them for you.
 With every VM shut down:
@@ -87,8 +87,8 @@ any further to use it:
 Only `full` needs the QEMU and KVM packages. `native` is domain XML only.
 
 Not an Arch user? The scripts in `scripts/` are plain shell and work standalone, and the module
-sources build as `arch/x86/kvm` against any 7.2.x tree; `scripts/install-modules.sh` is the manual
+patches build as `arch/x86/kvm` from a kernel tree of the release you run;
-path. The packaging is convenience, not a dependency.
+`scripts/install-modules.sh` is the manual path. The packaging is convenience, not a dependency.
 
 ### 2. Fix the guest, once
 
@@ -215,7 +215,7 @@ corrected.
 | --- | --- | --- | --- |
 | `tuned` | 13/85 | nothing | none |
 | `native` | 7/85 | nothing | none |
-| `full` | **1/85** | `vfio-native-qemu` + `vfio-native-kvm-dkms`, passthrough switched on after boot | DKMS rebuilds on kernel updates inside 7.2.x |
+| `full` | **1/85** | `vfio-native-qemu` + `vfio-native-kvm-dkms`, passthrough switched on after boot | bump the DKMS package on every kernel release |
 
 `tuned` buys the pinning and the cache-domain sizing and nothing else.
 
@@ -333,14 +333,15 @@ which libvirt runs after any `qemu` hook you already have, so it does not replac
 
 | Event | `tuned` / `native` | `full` |
 | --- | --- | --- |
-| Kernel update inside 7.2.x | nothing | DKMS rebuilds the modules; reload or reboot |
+| Kernel rebuild of the same release | nothing | DKMS rebuilds the modules; reload or reboot |
-| Kernel update past 7.2 | nothing | **the modules stop building** - bump `_kver` in the DKMS package |
+| Kernel update to a new release | nothing | **the modules stop building** - bump `_kver` in the DKMS package |
 | QEMU package update | nothing | nothing, `/opt/qemu-native` is its own package |
 | Newer QEMU base | nothing | re-apply `patches/qemu/` |
 
-The DKMS tree carries 7.2.3's KVM sources. They build against any 7.2.x headers, and DKMS refuses
+The DKMS tree carries one stable release's KVM sources, and DKMS refuses every other release:
-anything else, so after a kernel upgrade past 7.2 the stock modules load silently, the guest boots
+stable updates change KVM too, so a mismatched tree either fails to compile or silently builds
-fine and scores worse, with nothing to tell you but a pacman hook message:
+stale code. After any kernel upgrade the stock modules load silently, the guest boots fine and
+scores worse, with nothing to tell you but a pacman hook message:
 
 ```sh
 cat /sys/module/kvm/srcversion /sys/module/kvm_amd/srcversion

packaging/vfio-native-kvm-dkms/.SRCINFO

@@ -1,6 +1,6 @@
 pkgbase = vfio-native-kvm-dkms
-	pkgdesc = KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels)
+	pkgdesc = KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.9 kernels)
-	pkgver = 7.2.3
+	pkgver = 7.2.9
 	pkgrel = 1
 	url = https://git.archworks.co/sandwich/vfio-native
 	install = vfio-native-kvm-dkms.install
@@ -11,14 +11,14 @@ pkgbase = vfio-native-kvm-dkms
 	optdepends = vfio-native: the setup and verification tooling
 	provides = vfio-native-kvm
 	conflicts = vfio-native-kvm
-	noextract = linux-7.2.3.tar.xz
+	noextract = linux-7.2.9.tar.xz
-	source = git+https://git.archworks.co/sandwich/vfio-native.git#tag=v1.4.0
+	source = git+https://git.archworks.co/sandwich/vfio-native.git#tag=v1.4.3
-	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.3.tar.xz
+	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.9.tar.xz
 	source = dkms.conf
 	source = dkms-out-of-tree.patch
 	source = kvm-native.hook
 	sha256sums = SKIP
-	sha256sums = 8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03
+	sha256sums = b4c5dfbe51a364a6c7f03869200f88c8e1f77403539005f14b7fc6bc91b8d8ba
 	sha256sums = SKIP
 	sha256sums = SKIP
 	sha256sums = SKIP

packaging/vfio-native-kvm-dkms/PKGBUILD

@@ -1,8 +1,8 @@
 # Maintainer: Sandwich <sandwich@archworks.co>
 #
 # KVM modules patched for architectural conformance, built by DKMS against
-# whichever 7.2.x kernels are installed. Three VMAware checks stop firing as a
+# every installed kernel of _kver's release. Three VMAware checks stop firing
-# direct consequence, because the fix is to raise the exception the
+# as a direct consequence, because the fix is to raise the exception the
 # architecture specifies:
 #
 #   SVM_EXCEPTIONS    a CPL>0 SVM instruction must raise #UD, not #GP
@@ -17,20 +17,23 @@
 # vanilla kernel of the same version and builds them against the installed
 # headers; the two Makefile paths that assume an in-tree build are redirected.
 # The KVM sources do not differ between the Arch flavours of one version (the
-# module srcversion is identical on linux and linux-cachyos-bore 7.2.3), so one
+# module srcversion is identical on linux and linux-cachyos-bore 7.2.3 and
-# source tree serves all of them.
+# 7.2.9), so one source tree serves all of them.
 #
-# THE PIN: the sources are 7.2.3's. They build against any 7.2.x headers and
+# THE PIN: the sources are one stable release's and DKMS refuses every other.
-# are refused for anything else, so after a kernel upgrade past 7.2 the stock
+# Stable updates change KVM too: 7.2.9 moved declarations out of the installed
+# headers into arch/x86/kvm, so 7.2.3's tree stopped compiling, and 7.2.10
+# changes svm.c and x86.c without touching a header, so 7.2.9's tree would
+# build there and silently drop those fixes. After any kernel upgrade the stock
 # modules load silently and the three checks come back. Bump _kver here.
 
 pkgname=vfio-native-kvm-dkms
 _pkgbase=vfio-native-kvm
-_kver=7.2.3
+_kver=7.2.9
-_tag=1.4.2
+_tag=1.4.3
 pkgver=${_kver}
 pkgrel=1
-pkgdesc="KVM modules patched to raise the exceptions the architecture specifies (DKMS, 7.2.x kernels)"
+pkgdesc="KVM modules patched to raise the exceptions the architecture specifies (DKMS, ${_kver} kernels)"
 arch=('x86_64')
 url="https://git.archworks.co/sandwich/vfio-native"
 license=('GPL-2.0-only')
@@ -47,7 +50,7 @@ source=("git+${url}.git#tag=v${_tag}"
         'kvm-native.hook')
 noextract=("linux-${_kver}.tar.xz")
 sha256sums=('SKIP'
-            '8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03'
+            'b4c5dfbe51a364a6c7f03869200f88c8e1f77403539005f14b7fc6bc91b8d8ba'
             'SKIP'
             'SKIP'
             'SKIP')
@@ -70,5 +73,6 @@ package() {
     cp -r "linux-${_kver}/arch/x86/kvm" "${dest}/arch/x86/"
     cp -r "linux-${_kver}/virt/kvm"     "${dest}/virt/"
     sed "s/@PKGVER@/${pkgver}/" dkms.conf > "${dest}/dkms.conf"
-    install -Dm644 kvm-native.hook "${pkgdir}/usr/share/libalpm/hooks/90-vfio-native-kvm.hook"
+    install -dm755 "${pkgdir}/usr/share/libalpm/hooks"
+    sed "s/@PKGVER@/${pkgver}/g" kvm-native.hook > "${pkgdir}/usr/share/libalpm/hooks/90-vfio-native-kvm.hook"
 }

packaging/vfio-native-kvm-dkms/dkms-out-of-tree.patch

@@ -12,8 +12,8 @@ virt/kvm makefile must come from the module tree, not from the headers.
 -include $(srctree)/virt/kvm/Makefile.kvm
 +include $(src)/../../../virt/kvm/Makefile.kvm
  
- kvm-y			+= x86.o emulate.o irq.o lapic.o cpuid.o pmu.o mtrr.o \
+ kvm-y			+= x86.o emulate.o irq.o lapic.o cpuid.o pmu.o regs.o \
- 			   debugfs.o mmu/mmu.o mmu/page_track.o mmu/spte.o
+ 			   mtrr.o debugfs.o mmu/mmu.o mmu/page_track.o mmu/spte.o
 --- a/arch/x86/kvm/trace.h
 +++ b/arch/x86/kvm/trace.h
 @@ -1968,7 +1968,7 @@

packaging/vfio-native-kvm-dkms/dkms.conf

@@ -1,8 +1,9 @@
 PACKAGE_NAME="vfio-native-kvm"
 PACKAGE_VERSION="@PKGVER@"
-# 7.2.3's KVM sources build against 7.2.x headers only; refuse anything else
+# The KVM sources are this exact kernel release's. Stable updates move KVM
-# loudly instead of producing a module that will not load.
+# declarations between the headers and arch/x86/kvm, so any other release
-BUILD_EXCLUSIVE_KERNEL="^7\.2\."
+# either fails to build or silently builds stale KVM code; refuse it.
+BUILD_EXCLUSIVE_KERNEL="^${PACKAGE_VERSION//./\\.}-"
 MAKE[0]="make -C /usr/lib/modules/${kernelver}/build M=${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/build/arch/x86/kvm modules"
 BUILT_MODULE_NAME[0]="kvm"
 BUILT_MODULE_LOCATION[0]="arch/x86/kvm"

packaging/vfio-native-kvm-dkms/kvm-native.hook

@@ -1,4 +1,4 @@
-# Warns when a kernel outside the DKMS tree's 7.2.x range is installed.
+# Warns when a kernel other than the DKMS tree's own release is installed.
 #
 # Without this the failure is silent: DKMS skips the build, the stock modules
 # load, the guest boots normally, and the only symptom is three detections
@@ -13,4 +13,4 @@ Target = usr/lib/modules/*/vmlinuz
 Description = Checking that vfio-native-kvm-dkms can build for the new kernel...
 When = PostTransaction
 NeedsTargets
-Exec = /usr/bin/sh -c 'while read -r p; do k=${p#usr/lib/modules/}; k=${k%/vmlinuz}; case "$k" in 7.2.*) ;; *) echo ">>> vfio-native-kvm-dkms carries 7.2.3 sources and will not build for $k."; echo ">>> Stock KVM loads there and SVM_EXCEPTIONS, KVM_INTERCEPTION and DBVM come back.";; esac; done'
+Exec = /usr/bin/sh -c 'while read -r p; do k=${p#usr/lib/modules/}; k=${k%/vmlinuz}; case "$k" in @PKGVER@-*) ;; *) echo ">>> vfio-native-kvm-dkms carries @PKGVER@ sources and will not build for $k."; echo ">>> Stock KVM loads there and SVM_EXCEPTIONS, KVM_INTERCEPTION and DBVM come back.";; esac; done'

packaging/vfio-native-kvm-dkms/vfio-native-kvm-dkms.install

@@ -1,8 +1,8 @@
 post_install() {
-    cat <<'MSG'
+    cat <<MSG
 
   vfio-native-kvm-dkms: DKMS builds the patched kvm, kvm-amd and kvm-intel
-  for every installed 7.2.x kernel with headers, into updates/, which modprobe
+  for every installed ${1%-*} kernel with headers, into updates/, which modprobe
   prefers over the in-tree modules. They are NOT loaded yet.
 
   With every VM shut down:
@@ -14,11 +14,11 @@ post_install() {
       cat /sys/module/kvm/srcversion /sys/module/kvm_amd/srcversion
       modinfo -F srcversion kvm kvm_amd
 
-  THE PIN: these are 7.2.3's KVM sources. DKMS refuses to build them for a
+  THE PIN: these are ${1%-*}'s KVM sources. DKMS refuses to build them for
-  kernel outside 7.2.x, the stock modules load silently, and three detections
+  any other kernel release, the stock modules load silently, and three
-  come back. A pacman hook warns when that happens.
+  detections come back. A pacman hook warns when that happens.
 
 MSG
 }
-post_upgrade() { post_install; }
+post_upgrade() { post_install "$1"; }
 post_remove() { echo "  Stock KVM loads on the next boot, or reload the modules now."; }

packaging/vfio-native-qemu/PKGBUILD

@@ -7,9 +7,9 @@
 
 pkgname=vfio-native-qemu
 _qver=11.1.2
-_tag=1.4.2
+_tag=1.4.3
 pkgver=${_qver}
-pkgrel=4
+pkgrel=5
 pkgdesc="QEMU ${_qver} with the vfio-native platform-identity patches, in /opt/qemu-native"
 arch=('x86_64')
 url="https://git.archworks.co/sandwich/vfio-native"

packaging/vfio-native/PKGBUILD

@@ -8,7 +8,7 @@
 #   vfio-native-qemu       QEMU 11.1.2 with the platform-identity patches, in /opt
 
 pkgname=vfio-native
-pkgver=1.4.2
+pkgver=1.4.3
 pkgrel=1
 pkgdesc="Present a libvirt guest as a self-consistent physical machine, and tune it"
 arch=('any')

patches/README.md

@@ -42,7 +42,7 @@ Against QEMU v11.1.2. Apply in numeric order.
 | `02-disk-identity` | `VIRTUAL_DISK`, `DISK_SERIAL` - `QEMU HARDDISK`, empty serials, SCSI inquiry strings |
 | `03-pci-ids` | `PCI_VENDOR`, `DEVICES` - Red Hat/QEMU vendor and subsystem IDs, ICH9 layout |
 | `04-fw-cfg` | `QEMU_FW_CFG` - the fw_cfg device signature |
-| `05-usb-hid` | `QEMU_USB` - USB HID descriptor strings |
+| `05-usb-identity` | `QEMU_USB` - USB HID descriptor strings, and the usb-net CDC/RNDIS device-identity strings (keeps the `0525:a4a1` CDC id so generic CDC-ECM drivers still bind it) |
 | `06-audio` | `DEVICES` - HDA codec and controller identity |
 | `07-edid` | none. Carried for other detectors; VMAware does not read EDID. |
 | `08-cpu-misc` | none. CPU feature plumbing and one upstream backport. |

patches/qemu/05-usb-identity.patch

@@ -1,11 +1,15 @@
-Subject: [PATCH] usb-hid: QEMU_USB
+Subject: [PATCH] usb: QEMU_USB
 
 Targets VMAware check: QEMU_USB
 
-USB HID descriptors carrying QEMU vendor strings and product IDs.
+USB device identity strings that name QEMU: the HID descriptors (dev-hid.c)
+and the usb-net CDC/RNDIS descriptors plus its RNDIS vendor-description and
+product_desc (dev-network.c). The usb-net VID/PID (0525:a4a1, a real Linux
+USB Ethernet Gadget id) is left intact so the device stays CDC-class and the
+guest's generic CDC-ECM driver (e.g. macOS AppleUSBEthernet) still binds it.
 
 Applies to QEMU v11.1.2. Apply from the source root with:
-    patch -p1 < 05-usb-hid.patch
+    patch -p1 < 05-usb-identity.patch
 
 ---
 diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
@@ -109,3 +113,49 @@ index ae19d60..9fe1223 100644
      dc->vmsd = &vmstate_usb_kbd;
      device_class_set_props(dc, usb_keyboard_properties);
      set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
+
+diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
+--- a/hw/usb/dev-network.c
++++ b/hw/usb/dev-network.c
+@@ -99,15 +99,15 @@
+ #define ETH_FRAME_LEN                   1514 /* Max. octets in frame sans FCS */
+ 
+ static const USBDescStrings usb_net_stringtable = {
+-    [STRING_MANUFACTURER]       = "QEMU",
+-    [STRING_PRODUCT]            = "RNDIS/QEMU USB Network Device",
++    [STRING_MANUFACTURER]       = "Linux",
++    [STRING_PRODUCT]            = "USB Ethernet",
+     [STRING_ETHADDR]            = "400102030405",
+-    [STRING_DATA]               = "QEMU USB Net Data Interface",
+-    [STRING_CONTROL]            = "QEMU USB Net Control Interface",
+-    [STRING_RNDIS_CONTROL]      = "QEMU USB Net RNDIS Control Interface",
+-    [STRING_CDC]                = "QEMU USB Net CDC",
+-    [STRING_SUBSET]             = "QEMU USB Net Subset",
+-    [STRING_RNDIS]              = "QEMU USB Net RNDIS",
++    [STRING_DATA]               = "CDC Ethernet Data",
++    [STRING_CONTROL]            = "CDC Ethernet Control",
++    [STRING_RNDIS_CONTROL]      = "RNDIS Communications Control",
++    [STRING_CDC]                = "CDC Ethernet",
++    [STRING_SUBSET]             = "CDC Subset Ethernet",
++    [STRING_RNDIS]              = "RNDIS Ethernet",
+     [STRING_SERIALNUMBER]       = "1",
+ };
+ 
+@@ -717,7 +717,7 @@
+ 
+     /* mandatory */
+     case OID_GEN_VENDOR_DESCRIPTION:
+-        pstrcpy((char *)outbuf, outlen, "QEMU USB RNDIS Net");
++        pstrcpy((char *)outbuf, outlen, "USB Ethernet");
+         return strlen((char *)outbuf) + 1;
+ 
+     case OID_GEN_VENDOR_DRIVER_VERSION:
+@@ -1417,7 +1417,7 @@
+     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
+ 
+     uc->realize        = usb_net_realize;
+-    uc->product_desc   = "QEMU USB Network Interface";
++    uc->product_desc   = "USB Ethernet Adapter";
+     uc->usb_desc       = &desc_net;
+     uc->handle_reset   = usb_net_handle_reset;
+     uc->handle_control = usb_net_handle_control;