linux-kernel - Re: [PATCH] x86/vmware: Fix hypercall clobbers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4zzbwghl7reocb2j7cqunj6sgngtnep6hhisex3yhonwvghhc4@jivgl2ntikfs>
Date: Thu, 22 Jan 2026 09:40:16 -0800
From: Josh Poimboeuf <jpoimboe@...nel.org>
To: Alexey Makhalov <alexey.makhalov@...adcom.com>
Cc: x86@...nel.org, linux-kernel@...r.kernel.org, 
	Ajay Kaher <ajay.kaher@...adcom.com>, bcm-kernel-feedback-list@...adcom.com, 
	Peter Zijlstra <peterz@...radead.org>, Justin Forbes <jforbes@...oraproject.org>
Subject: Re: [PATCH] x86/vmware: Fix hypercall clobbers

On Thu, Jan 22, 2026 at 02:00:50AM -0800, Alexey Makhalov wrote:
> Hi Josh,
> 
> Thanks for reporting the problem.
> 
> VMware hypercall 0x27 (VMWARE_CMD_ABSPOINTER_DATA) handler only modifies
> (returns data) on the first 4 arguments, regs: RAX, RBX, RCX, RDX.
> It does not and should not clobber any other guest registers except CC
> state.
> 
> From the Oops message, the hardware is QEMU Standard PC.
> And the issue is caused by the vmmouse emulation there, specifically in
> vmmouse_ioport_read() function.
> 
> 1. vmmouse_get_data(data) saves lower 32 bit for all 6 args.
> https://github.com/qemu/qemu/blob/master/hw/i386/vmmouse.c#L227
> 2. vmmouse_data() processes the hypercall preparing the data for the first 4
> arguments. https://github.com/qemu/qemu/blob/master/hw/i386/vmmouse.c#L255
> 3. vmmouse_set_data(data). Copies only lower 32 bit back to all 6 args and
> _zeroes_ upper 32 bits for untouched RDI and RSI.
> 
> Workarounding QEMU misbehavior from the kernel side by introducing less
> efficient asm inlines does not sound correct.
> 
> Please report or fix the issue from QEMU side.
> Recommended QEMU fix: vmmouse_get_data/vmmouse_set_data should save/restore
> target_ulong type instead of uint32_t.

Ah, not sure how I didn't see that was QEMU.  I will report/fix it
there.  Thanks!

-- 
Josh