Re: [PATCH rfc] hvf: arm: Inject SEA when executing insn in invalid memory range

Mohamed Mediouni
2026-03-21T17:27:28Z

> On 21. Mar 2026, at 18:09, Zenghui Yu <zenghui.yu@linux.dev> wrote:
>
> After hacking KUT to let the guest map a VA to IPA 0x1000000000 (an IPA
> right after 64GB) and execute an insn on that VA, the guest receives an
> insn abort with IFSC equals to 0x03 (Hello, AddressSize fault!). We can
> _infer_ from that that the AddressSize fault is injected internally by
> hvf.

Hello,

As far as I tell:

If the translation fails at stage-1, the fault is routed by hardware
to the guest directly instead of going to the hypervisor.

In the case where it’s not a valid IPA in the first place - instead
of an unmapped one - the hardware triggers a fault to the guest instead
of going to the hypervisor.

If the stage-1 translation is successful but the IPA is valid and not
mapped, _then_ it gets trapped to the hypervisor, and gets routed to
user-space for VMM handling.

The EC_DATAABORT case happens on MMIO faults but the EC_INSNABORT
case is… more speculative for QEMU today.

I can see cases for doing it for on-demand page mappings in user-space
though… where you’d map the page and then resume from the same PC.

With the current model QEMU uses I’d expect not handling EC_INSNABORT
at all to not result in a functionality gap.