Re: [PATCH rfc] hvf: arm: Inject SEA when executing insn in invalid memory range

[Zenghui Yu <zenghui.yu@linux.dev>]

On 3/22/26 1:26 AM, Mohamed Mediouni wrote:
> 
> > On 21. Mar 2026, at 18:09, Zenghui Yu <zenghui.yu@linux.dev> wrote:
> >
> > After hacking KUT to let the guest map a VA to IPA 0x1000000000 (an IPA
> > right after 64GB) and execute an insn on that VA, the guest receives an
> > insn abort with IFSC equals to 0x03 (Hello, AddressSize fault!). We can
> > _infer_ from that that the AddressSize fault is injected internally by
> > hvf.
> 
> Hello,
> 
> As far as I tell:
> 
> If the translation fails at stage-1, the fault is routed by hardware 
> to the guest directly instead of going to the hypervisor.

Oops,, you're right. Sorry for the noise on the AddressSize fault part.

Thanks,
Zenghui

> In the case where it’s not a valid IPA in the first place - instead
> of an unmapped one - the hardware triggers a fault to the guest instead
> of going to the hypervisor.
> 
> If the stage-1 translation is successful but the IPA is valid and not
> mapped, _then_ it gets trapped to the hypervisor, and gets routed to 
> user-space for VMM handling.
> 
> The EC_DATAABORT case happens on MMIO faults but the EC_INSNABORT 
> case is… more speculative for QEMU today.
> 
> I can see cases for doing it for on-demand page mappings in user-space
> though… where you’d map the page and then resume from the same PC.
> 
> With the current model QEMU uses I’d expect not handling EC_INSNABORT
> at all to not result in a functionality gap.