Re: [PATCH] KVM: arm64: Inject UNDEF when host is executing an smc with imm16 != 0

On Tue, Mar 24, 2026 at 02:06:40PM +0000, Vincent Donnefort wrote:

On Tue, Mar 24, 2026 at 01:57:28PM +0000, Sebastian Ene wrote:

quoted

The ARM Service Calling Convention (SMCCC) specifies that the function
identifier and parameters should be passed in registers, leaving the
16-bit immediate field of the SMC instruction un-handled.
Currently, our pKVM handler ignores the immediate value, which could lead
to non-compliant software relying on implementation-defined behavior.
Enforce the host kernel running under pKVM to use an immediate value
of 0 by decoding the ISS from the ESR_EL2 and inject an undefined
instruction exception back to the caller.

Signed-off-by: Sebastian Ene <redacted>
---
 arch/arm64/kvm/hyp/nvhe/hyp-main.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
index e7790097db93..ff6a90a4a4c7 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c

@@ -756,13 +756,18 @@ static bool handle_host_mte(u64 esr)
 void handle_trap(struct kvm_cpu_context *host_ctxt)
 {
 	u64 esr = read_sysreg_el2(SYS_ESR);
+	u16 imm16;
 
 	switch (ESR_ELx_EC(esr)) {
 	case ESR_ELx_EC_HVC64:
 		handle_host_hcall(host_ctxt);
 		break;
 	case ESR_ELx_EC_SMC64:
-		handle_host_smc(host_ctxt);
+		imm16 = esr & U16_MAX;
+		if (!imm16)

Hi Vincent,

if (ESR_ELx_xVC_IMM_MASK(esr)) ?

Yes we can use this instead.

Also, I can't find void inject_undef64(void); I think you need a vcpu for that?

Right, there is one version that does that.

quoted

+			handle_host_smc(host_ctxt);
+		else
+			inject_undef64();
 		break;
 	case ESR_ELx_EC_IABT_LOW:
 	case ESR_ELx_EC_DABT_LOW:
-- 
2.53.0.983.g0bb29b3bc5-goog

Thanks,
Sebastian