Re: [PATCH] KVM: arm64: Inject UNDEF when host is executing an smc with imm16 != 0

[Sebastian Ene]

On Tue, Mar 24, 2026 at 03:13:51PM +0000, Fuad Tabba wrote:

Hi Fuad,

> Hi Seb,
> 
> On Tue, 24 Mar 2026 at 13:57, Sebastian Ene <sebastianene@xxxxxxxxxx> wrote:
> >
> > The ARM Service Calling Convention (SMCCC) specifies that the function
> > identifier and parameters should be passed in registers, leaving the
> > 16-bit immediate field of the SMC instruction un-handled.
> > Currently, our pKVM handler ignores the immediate value, which could lead
> > to non-compliant software relying on implementation-defined behavior.
> > Enforce the host kernel running under pKVM to use an immediate value
> > of 0 by decoding the ISS from the ESR_EL2 and inject an undefined
> > instruction exception back to the caller.
> >
> > Signed-off-by: Sebastian Ene <sebastianene@xxxxxxxxxx>
> > ---
> >  arch/arm64/kvm/hyp/nvhe/hyp-main.c | 7 ++++++-
> >  1 file changed, 6 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > index e7790097db93..ff6a90a4a4c7 100644
> > --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > @@ -756,13 +756,18 @@ static bool handle_host_mte(u64 esr)
> >  void handle_trap(struct kvm_cpu_context *host_ctxt)
> >  {
> >         u64 esr = read_sysreg_el2(SYS_ESR);
> > +       u16 imm16;
> >
> >         switch (ESR_ELx_EC(esr)) {
> >         case ESR_ELx_EC_HVC64:
> >                 handle_host_hcall(host_ctxt);
> >                 break;
> >         case ESR_ELx_EC_SMC64:
> > -               handle_host_smc(host_ctxt);
> > +               imm16 = esr & U16_MAX;
> > +               if (!imm16)
> 
> Do we need to introduce a new variable for this? This isn't easier to read than:
> +               if (!(esr & U16_MAX))
> 
> Also, we have a mask for this: ESR_ELx_xVC_IMM_MASK , please use that instead


I will drop that variable and use the ESR_ELx_xVC_IMM_MASK as you pointed out.

> 
> Cheers,
> /fuad
> 
> 
> 
> > +                       handle_host_smc(host_ctxt);
> > +               else
> > +                       inject_undef64();
> >                 break;
> >         case ESR_ELx_EC_IABT_LOW:
> >         case ESR_ELx_EC_DABT_LOW:
> > --
> > 2.53.0.983.g0bb29b3bc5-goog
> >

Thanks,
Sebastian