Re: [PATCH v2] KVM: arm64: Prevent the host from using an smc with imm16 != 0

On Wed, Mar 25, 2026 at 12:12:18PM +0000, Will Deacon wrote:

On Wed, Mar 25, 2026 at 11:46:29AM +0000, Marc Zyngier wrote:

quoted

On Wed, 25 Mar 2026 11:35:18 +0000,
Vincent Donnefort [off-list ref] wrote:

quoted

On Wed, Mar 25, 2026 at 11:31:38AM +0000, Sebastian Ene wrote:

quoted

The ARM Service Calling Convention (SMCCC) specifies that the function
identifier and parameters should be passed in registers, leaving the
16-bit immediate field of the SMC instruction un-handled.
Currently, our pKVM handler ignores the immediate value, which could lead
to non-compliant software relying on implementation-defined behavior.
Enforce the host kernel running under pKVM to use an immediate value
of 0 by decoding the ISS from the ESR_EL2 and return a not supported
error code back to the caller.

quoted

It also begs the question: if you don't want to handle SMCs with a
non-zero immediate, why is it OK to do it for HVCs?

I suppose the difference is that the HVC API is a private interface
between EL2 and the host. As it stands, EL2 ignores the immediate but we
don't have a way to know how EL3 responds to the immediate for an SMC.

When proxying an SMC from the host, EL2 therefore has three choices:

  1. Ignore the immediate from the host and always use zero when talking
     to EL3. That's the current behaviour, but it could theoretically
     lead to problems if EL3 is using the immediate for something.

  2. Propagate the immediate from the host. That should work, but it's
     a bit involved.

  3. Reject non-zero immediates (this patch).

I think (3) is the only safe option. As described in:

  https://lore.kernel.org/linux-arm-kernel/acPi5V0DgGcgHNGO@J2N7QTR9R3/ (local)

... regardless of the the conduit (HVS/SMC) used, a non-zero immediate
is NOT a legitimate SMCCC call. (1) is not safe, becuase it could change
the semantic of the call, and (2) is not safe because the calling
convention could differ (and e.g. things might be clobbered that we
don't expect).

We know that the host *SHOULD* use a zero immediate, and so anything
else represents a bug that we will want to catch.

Mark.