[PATCH] KVM: arm64: Inject UNDEF when host is executing an smc with imm16 != 0

[Fuad Tabba]

Hi Seb,

On Tue, 24 Mar 2026 at 13:57, Sebastian Ene <sebastianene at google.com> wrote:
>
> The ARM Service Calling Convention (SMCCC) specifies that the function
> identifier and parameters should be passed in registers, leaving the
> 16-bit immediate field of the SMC instruction un-handled.
> Currently, our pKVM handler ignores the immediate value, which could lead
> to non-compliant software relying on implementation-defined behavior.
> Enforce the host kernel running under pKVM to use an immediate value
> of 0 by decoding the ISS from the ESR_EL2 and inject an undefined
> instruction exception back to the caller.
>
> Signed-off-by: Sebastian Ene <sebastianene at google.com>
> ---
>  arch/arm64/kvm/hyp/nvhe/hyp-main.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> index e7790097db93..ff6a90a4a4c7 100644
> --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> @@ -756,13 +756,18 @@ static bool handle_host_mte(u64 esr)
>  void handle_trap(struct kvm_cpu_context *host_ctxt)
>  {
>         u64 esr = read_sysreg_el2(SYS_ESR);
> +       u16 imm16;
>
>         switch (ESR_ELx_EC(esr)) {
>         case ESR_ELx_EC_HVC64:
>                 handle_host_hcall(host_ctxt);
>                 break;
>         case ESR_ELx_EC_SMC64:
> -               handle_host_smc(host_ctxt);
> +               imm16 = esr & U16_MAX;
> +               if (!imm16)

Do we need to introduce a new variable for this? This isn't easier to read than:
+               if (!(esr & U16_MAX))

Also, we have a mask for this: ESR_ELx_xVC_IMM_MASK , please use that instead

Cheers,
/fuad



> +                       handle_host_smc(host_ctxt);
> +               else
> +                       inject_undef64();
>                 break;
>         case ESR_ELx_EC_IABT_LOW:
>         case ESR_ELx_EC_DABT_LOW:
> --
> 2.53.0.983.g0bb29b3bc5-goog
>