Re: [PATCH rfc] hvf: arm: Inject SEA when executing insn in invalid memory range

Zenghui Yu
2026-03-21T17:40:41Z

On 3/22/26 1:26 AM, Mohamed Mediouni wrote:
>
> > On 21. Mar 2026, at 18:09, Zenghui Yu <zenghui.yu@linux.dev> wrote:
> >
> > After hacking KUT to let the guest map a VA to IPA 0x1000000000 (an IPA
> > right after 64GB) and execute an insn on that VA, the guest receives an
> > insn abort with IFSC equals to 0x03 (Hello, AddressSize fault!). We can
> > _infer_ from that that the AddressSize fault is injected internally by
> > hvf.
>
> Hello,
>
> As far as I tell:
>
> If the translation fails at stage-1, the fault is routed by hardware
> to the guest directly instead of going to the hypervisor.

Oops,, you're right. Sorry for the noise on the AddressSize fault part.

Thanks,
Zenghui

> In the case where it’s not a valid IPA in the first place - instead
> of an unmapped one - the hardware triggers a fault to the guest instead
> of going to the hypervisor.
>
> If the stage-1 translation is successful but the IPA is valid and not
> mapped, _then_ it gets trapped to the hypervisor, and gets routed to
> user-space for VMM handling.
>
> The EC_DATAABORT case happens on MMIO faults but the EC_INSNABORT
> case is… more speculative for QEMU today.
>
> I can see cases for doing it for on-demand page mappings in user-space
> though… where you’d map the page and then resume from the same PC.
>
> With the current model QEMU uses I’d expect not handling EC_INSNABORT
> at all to not result in a functionality gap.