linux-kernel - Re: [PATCH] x86/vmware: Fix hypercall clobbers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9c491fa6-f59d-489e-97ce-b364ce76af73@broadcom.com>
Date: Fri, 23 Jan 2026 17:01:31 -0800
From: Alexey Makhalov <alexey.makhalov@...adcom.com>
To: Thorsten Leemhuis <regressions@...mhuis.info>,
 Josh Poimboeuf <jpoimboe@...nel.org>, x86@...nel.org
Cc: linux-kernel@...r.kernel.org, Ajay Kaher <ajay.kaher@...adcom.com>,
 bcm-kernel-feedback-list@...adcom.com, Peter Zijlstra
 <peterz@...radead.org>, Justin Forbes <jforbes@...oraproject.org>,
 Linux kernel regressions list <regressions@...ts.linux.dev>,
 Zack Rusin <zack.rusin@...adcom.com>
Subject: Re: [PATCH] x86/vmware: Fix hypercall clobbers

On 1/23/26 1:47 AM, Thorsten Leemhuis wrote:
> Well, fixing bugs right where they are obviously is a good thing.
> 
> But well, the problem according to the description quoted below was
> exposed by a change that went into 6.19-rc1 -- which makes it a kernel
> regression that must be fixed in the kernel (ideally before 6.19 is out).

The Linux change 34bf25e820ae ("x86/vmware: Introduce VMware hypercall 
API") that revealed QEMU issue was introduced not now, but back in June 
2024 in v6.11-rc1. Two LTS versions 6.12 and 6.18 have it.

This issue can be triggered only for specific hypercall (usually 
statically inlined) and _only_ if compiler keeps rsi/rdi in use during 
the hypercall.

The proposed kernel fix forces compiler to use memory instead of rsi/rdi 
registers for _every_ VMware hypercall. Every VMware hypercall caller 
should pay a penalty for QEMU issue, even if it runs on non qemu or 
fixed/newer qemu platform.

IMHO, user who faced this issue should be given one choice to fix it - 
update QEMU as the system may not be operable with this combination 
QEMU+Kernel.

If kernel colleagues still believe it should be also solved from the 
kernel side, then my proposal is to perform precise fix by using wider 
hypercall just for VMWARE_CMD_ABSPOINTER_DATA:

--- a/drivers/input/mouse/vmmouse.c
+++ b/drivers/input/mouse/vmmouse.c
@@ -145,7 +145,7 @@ static psmouse_ret_t vmmouse_report_events(struct 
psmouse *psmouse)
                 }

                 /* Now get it */
-               status = vmware_hypercall4(VMWARE_CMD_ABSPOINTER_DATA, 4,
+               status = vmware_hypercall7(VMWARE_CMD_ABSPOINTER_DATA, 
4, 0, 0, 0,
                                            &x, &y, &z);

                 /*

Regards,
--Alexey