From: Sebastian Ene <sebastianene@google.com>
To: Vincent Donnefort <vdonnefort@google.com>
Cc: kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, android-kvm@google.com,
catalin.marinas@arm.com, joey.gouly@arm.com,
mark.rutland@arm.com, maz@kernel.org, oupton@kernel.org,
suzuki.poulose@arm.com, tabba@google.com, will@kernel.org,
yuzenghui@huawei.com
Subject: Re: [PATCH] KVM: arm64: Inject UNDEF when host is executing an smc with imm16 != 0
Date: Tue, 24 Mar 2026 14:41:56 +0000 [thread overview]
Message-ID: <acKitObzn6jrO205@google.com> (raw)
In-Reply-To: <acKacAd6aV32624m@google.com>
On Tue, Mar 24, 2026 at 02:06:40PM +0000, Vincent Donnefort wrote:
> On Tue, Mar 24, 2026 at 01:57:28PM +0000, Sebastian Ene wrote:
> > The ARM Service Calling Convention (SMCCC) specifies that the function
> > identifier and parameters should be passed in registers, leaving the
> > 16-bit immediate field of the SMC instruction un-handled.
> > Currently, our pKVM handler ignores the immediate value, which could lead
> > to non-compliant software relying on implementation-defined behavior.
> > Enforce the host kernel running under pKVM to use an immediate value
> > of 0 by decoding the ISS from the ESR_EL2 and inject an undefined
> > instruction exception back to the caller.
> >
> > Signed-off-by: Sebastian Ene <sebastianene@google.com>
> > ---
> > arch/arm64/kvm/hyp/nvhe/hyp-main.c | 7 ++++++-
> > 1 file changed, 6 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > index e7790097db93..ff6a90a4a4c7 100644
> > --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > @@ -756,13 +756,18 @@ static bool handle_host_mte(u64 esr)
> > void handle_trap(struct kvm_cpu_context *host_ctxt)
> > {
> > u64 esr = read_sysreg_el2(SYS_ESR);
> > + u16 imm16;
> >
> > switch (ESR_ELx_EC(esr)) {
> > case ESR_ELx_EC_HVC64:
> > handle_host_hcall(host_ctxt);
> > break;
> > case ESR_ELx_EC_SMC64:
> > - handle_host_smc(host_ctxt);
> > + imm16 = esr & U16_MAX;
> > + if (!imm16)
>
Hi Vincent,
> if (ESR_ELx_xVC_IMM_MASK(esr)) ?
Yes we can use this instead.
>
> Also, I can't find void inject_undef64(void); I think you need a vcpu for that?
>
Right, there is one version that does that.
> > + handle_host_smc(host_ctxt);
> > + else
> > + inject_undef64();
> > break;
> > case ESR_ELx_EC_IABT_LOW:
> > case ESR_ELx_EC_DABT_LOW:
> > --
> > 2.53.0.983.g0bb29b3bc5-goog
> >
Thanks,
Sebastian
next prev parent reply other threads:[~2026-03-24 14:42 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-24 13:57 [PATCH] KVM: arm64: Inject UNDEF when host is executing an smc with imm16 != 0 Sebastian Ene
2026-03-24 14:06 ` Vincent Donnefort
2026-03-24 14:09 ` Vincent Donnefort
2026-03-24 14:18 ` Vincent Donnefort
2026-03-24 15:05 ` Sebastian Ene
2026-03-24 14:41 ` Sebastian Ene [this message]
2026-03-24 14:43 ` Marc Zyngier
2026-03-24 15:04 ` Sebastian Ene
2026-03-24 15:13 ` Fuad Tabba
2026-03-25 10:01 ` Sebastian Ene
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=acKitObzn6jrO205@google.com \
--to=sebastianene@google.com \
--cc=android-kvm@google.com \
--cc=catalin.marinas@arm.com \
--cc=joey.gouly@arm.com \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=maz@kernel.org \
--cc=oupton@kernel.org \
--cc=suzuki.poulose@arm.com \
--cc=tabba@google.com \
--cc=vdonnefort@google.com \
--cc=will@kernel.org \
--cc=yuzenghui@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox