kvm/arm64: send SIGKILL if ring0.El0SyncInv has been triggered

Linux does the same thing.

PiperOrigin-RevId: 722789748

Author: avagin

images/default/Dockerfile

@@ -30,6 +30,6 @@ RUN curl https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud
     ln -s /google-cloud-sdk/bin/gcloud /usr/bin/gcloud
 
 # Download the official bazel binary. The APT repository isn't used because there is not packages for arm64.
-RUN sh -c 'curl -o /usr/local/bin/bazel https://releases.bazel.build/7.3.2/release/bazel-7.3.2-linux-$(uname -m | sed s/aarch64/arm64/) && chmod ugo+x /usr/local/bin/bazel'
+RUN sh -c 'curl -o /usr/local/bin/bazel https://releases.bazel.build/7.5.0/release/bazel-7.5.0-linux-$(uname -m | sed s/aarch64/arm64/) && chmod ugo+x /usr/local/bin/bazel'
 WORKDIR /workspace
 ENTRYPOINT ["/usr/local/bin/bazel"]

pkg/sentry/platform/kvm/machine_arm64_unsafe.go

@@ -327,7 +327,8 @@ func (c *vCPU) SwitchToUser(switchOpts ring0.SwitchOpts, info *linux.SignalInfo)
 		return c.fault(int32(unix.SIGBUS), info)
 	case ring0.Vector(bounce): // ring0.VirtualizationException.
 		return hostarch.NoAccess, platform.ErrContextInterrupt
-	case ring0.El0SyncUndef:
+	case ring0.El0SyncUndef,
+		ring0.El0SyncInv:
 		return c.fault(int32(unix.SIGILL), info)
 	case ring0.El0SyncDbg:
 		*info = linux.SignalInfo{