Backport the ARM64 VNCR fixmap state fix

[ejc3]

Backport upstream Linux 5949004d7032767e8fde1e8c986a33f241b2a192 to the carried ARM64 kernel patches. The pinned 6.18.44 source still invalidates the VNCR fixmap without clearing its per-CPU flag or map count. Successful retranslation then sets the CPU ID to -1, leaving state that can trigger the schedule-out BUG_ON.

Targets main after parent #919 merged.

The production patch is byte-identical to upstream, with its authorship retained: 17 additions and 10 deletions in nested.c. It shares the CPU-local reset helper between translation and vCPU put. The normal patch globs include it in both ARM host and guest build inputs. No kernel version, DSB barrier, PSCI/WFx patch, or FUSE change is included.

Evidence:

• arm64_vncr_retranslation_releases_cpu_mapping_before_vcpu_put compiles and executes verbatim v6.18.44 C functions with dependencies stubbed, after applying the carried patch.
• Unfixed successful retranslation produced cpu=-1, mapped=1, map count=2 and no PTE. The early-error case also retained inconsistent ownership. Both fail the state invariant; the unmapped control passes.
• All three cases pass with the fix. Removing only the production patch makes the two mapped cases fail again; the unmapped control remains green. Restoring the patch passes all cases. The complete kernel-patch test binary passes 4/4.
• Source excerpts match the official stable source. The full kernel archive SHA-256 is 0f72d938f06828e82c90405174fe572287db7bfe089e2fc46572a99a7f240d43.
• All nine host-side carried patches apply to the complete v6.18.44 source with --fuzz=0.
• make lint passes. Main-agent review of the complete four-file delta found no blocking issue.
• The normal content-addressed nested guest-kernel build passed locally. CI run 34176079318 also passed on this exact head: both ARM Host-Root jobs built and selected vmlinux-nested-6.18.44-aarch64-0f3464ff2fe9.bin. All 16 expected jobs are present (15 passed; the unrelated benchmark harness job was skipped).

The C regression proves this single-CPU state transition, not hardware TLB behavior or the remaining nested-ARM hypotheses. Without the fix, it fails its inconsistent-state assertion before the later vCPU-put call; it does not reproduce a hardware kernel crash. No host kernel has been installed, no host reboot or crashing nested reproduction has been attempted, and no upstream submission has been opened.

Addresses the VNCR-fix item in #770. The remaining patch audit and ARM validation stay open.

Upstream: torvalds/linux@5949004

Summary by CodeRabbit

• Bug Fixes

  • Corrected ARM64 KVM VNCR mapping cleanup during translation and virtual CPU transitions.
  • Ensured fixmap ownership, translation validity, and mapping counters remain synchronized.
  • Prevented stale CPU mappings that could trigger failures when releasing a virtual CPU.

• Tests

  • Added integration coverage for successful translations, translation failures, and unmapped control scenarios.
  • Verified mapping cleanup and translation state across virtual CPU release and retranslation paths.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 97e05106-65dd-48e1-be6f-7377d66ec7c8

📥 Commits

Reviewing files that changed from the base of the PR and between 894259c and f8b9ece.

📒 Files selected for processing (4)

• kernel/patches-arm64/vncr-fixmap-state.patch
• tests/fixtures/vncr/harness.c
• tests/fixtures/vncr/nested.c
• tests/test_kernel_patch_invariants.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The patch centralizes VNCR fixmap teardown and updates translation handling to reset mapping state before retranslating. New fixtures and an integration test compile and execute the patched kernel code across mapped, unmapped, successful, and failing translation scenarios.

Changes

VNCR fixmap state

Layer / File(s)	Summary
Centralized VNCR fixmap reset kernel/patches-arm64/vncr-fixmap-state.patch	Adds this_cpu_reset_vncr_fixmap() and uses it from kvm_vcpu_put_hw_mmu() and kvm_translate_vncr(). The helper clears the fixmap, releases CPU ownership, clears L1_VNCR_MAPPED, and updates vncr_map_count.
Executable VNCR invariant validation tests/fixtures/vncr/nested.c, tests/fixtures/vncr/harness.c, tests/test_kernel_patch_invariants.rs	Adds a production-code fixture, simulated KVM state, and scenarios that validate fixmap clearing, CPU release, map-count stability, and translation validity. The Rust test applies, compiles, and runs the patched fixture.

Priority: ⬇️ Low — Defer this ARM64 KVM VNCR state fix because its scope is limited to synchronizing fixmap teardown and regression coverage for a specific kernel path.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to f8b9e

This change keeps ARM64 nested-virtualization VNCR mapping state synchronized during retranslation and vCPU teardown, preventing stale state from triggering teardown failures. Covered state-transition scenarios pass with no active merge-blocking risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 3 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: backporting the ARM64 VNCR fixmap state fix.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 3 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/vncr-fixmap-770

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T01:19:58.699113Z	f8b9ece	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ejc3]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[ejc3]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[ejc3]

NOT-A-DEFECT: The docstring-percentage warning is a style metric. The nested.c fixture intentionally preserves verbatim Linux 6.18.44 functions; the fixture, harness and Rust test document their provenance and tested scenarios. Adding comments solely to meet a percentage would alter the upstream excerpt without improving this regression test.