From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f226.google.com (mail-yw1-f226.google.com [209.85.128.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0553E334685 for ; Thu, 22 Jan 2026 10:00:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.226 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769076057; cv=none; b=N/ksSH0bFHMH9cVqe6V6whsIdUE3Sx0jNva0L1Mt+JZaOuvMMcxYcs9Q2puZQkZrwAdrsLZ98CliIoR7/wY6U217PtUvS7KlaxksnyQyDezwnPN89zG8NeUXt9T1LVjE8Xu3aD9t8qLiAK3/sZ21xfyka2GitpqYAU86rvxl9pk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769076057; c=relaxed/simple; bh=IPbQBZL51FYF+1m/9PbbUd8BtrvECTjPFZQk566IQSs=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=gQSX5zZiGdW3Fg7WIJuKN6MfTba13D2M3aMATWDPdKk21CxVnUQu/DP9pDELUmyDKipvR4KorXObT+H2Ug2fkDM7lXW/Q1JpdsG5CkGY95eiq5wuKb/Y0VJSIpe7K7mmHlCELjPU/NBbCNbtnO5L98vZ4Aqmo/gYibmh06fP3Ro= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=XR8BryaC; arc=none smtp.client-ip=209.85.128.226 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="XR8BryaC" Received: by mail-yw1-f226.google.com with SMTP id 00721157ae682-78fc4425b6bso6802377b3.1 for ; Thu, 22 Jan 2026 02:00:55 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769076055; x=1769680855; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:dkim-signature:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=mzhDWt6r1qiqpFOP4HcXR5wpvnP9Ep/nK3G0vmNwYmo=; b=e7msBs0JGsMgn3BFh4f+g4o1D7ioB1bT6JpBjcNF6Sy1Pq0AN2cZBzZLUbKA0rOowX 2GWKdWjoV9wwbGIGz+63itHpBy6oM/Bmeu+2uwArCSFYIMXVUMCEJRs5XVQ/l8+/Rlrv m5O0bVfpSk4fHVZVO6tGSbssE8pWpXfORA7TeJEdkJV3lM68jM7W4X3irfJ6xa4MaqjL uSmSg129Am/rqAYF8j8iGXJzJqKprV7ZUlMjcRCitOLfBYInWgfwBxzcYllfQF89Paq1 Zj10EuIZYjlUXnNCJrVX1PU77AVqF6rH7q+RGE2CGaIaqfYRSkCbCMlhkFQlwq5aKH4Z +D4g== X-Gm-Message-State: AOJu0YwBUzJYy82jvwKa9IKw6oM8Bdy40qvu7aHc9jmmhJ4bsdL0KybN wd6pwkcV2HcahbcEk0Uidtp4xlh0gpymkjd173drgtA0Tjget4UKow1JOM9q7JgwsLAMB0N8yug ZAMpxFuM3BEHwskTCh640nypGBh1sHyh3MMWQh+eroYzI53AdDYb4flPZssAABTw/Ws7Gz6Xoc8 ZWU3+KRB05y6ZxJWjvvReqWJeYOCF5OKxkb1LOuwn70eE24ZFIsDMJ628Ua9SAa9sVwz1jGtTe0 WFNFTj4cbDWVpfx90M/nXQ= X-Gm-Gg: AZuq6aLl5eNju1nMCATK+zSc85qmXozUDDjJvx1wVJOyGf251dMo4tYOdMM4Qn1PtvJ kQigXbBhzi0J3tL2KczUcfA/OOd2wUkFDdq2SkEGZfAfm4mWVcgD/Rd5oJiBYXyAwh53t8ui4Kk oLrGw99IDBfjXCczqdFn8zISQjrNkf+DbFWaR+z7Baj+89JMCumwrZX0pw3i0HVUy3bLlO6h+Q0 MzXHIDFPI1KYEsmoyUp5dEAahzgoF96bKEGRlwlVHGwuHZH1cNmpQZMKEQe4ITSHlIJXQcS5V8D 4dVQ6YdcMKsNxQtiaZAY09wKan2vA0GDoJCR9zJ42vf+n7FbBAbVa/iaTd+5Oo1BvR5toiuutlg dSSkZ+U29aMJ4nbYvBTz6Khk3aHYyd96R0dmT87oIV2+16OzsPcPDg3OIsF/i2gSm8VgQTp9471 9RjcqAtcOOL8LaaX65vLNv5pCE8KDPqQTfzHWBvPURSIzOMwsXrZk= X-Received: by 2002:a05:690c:b06:b0:78f:afdb:ea41 with SMTP id 00721157ae682-7940a156388mr68659467b3.18.1769076054717; Thu, 22 Jan 2026 02:00:54 -0800 (PST) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-118.dlp.protect.broadcom.com. [144.49.247.118]) by smtp-relay.gmail.com with ESMTPS id 00721157ae682-793c6816c5csm12034927b3.17.2026.01.22.02.00.54 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 22 Jan 2026 02:00:54 -0800 (PST) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-qv1-f69.google.com with SMTP id 6a1803df08f44-8946f1b8691so27856816d6.3 for ; Thu, 22 Jan 2026 02:00:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1769076053; x=1769680853; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to; bh=mzhDWt6r1qiqpFOP4HcXR5wpvnP9Ep/nK3G0vmNwYmo=; b=XR8BryaC6935lxTAEU4c22JiBg0Ea1ixYf7unUUtR4bDrsun9panohdBnav8QcKYCV PfXLMkldSDwaf5/BTIRs+R10bAnFyDOtlRyQZqEw4sdXdBuqj7e4Nd+h8H9VtqnJI9J/ /DtFmVWoHLnjh3y+sCYwoQqfDF3rxtYuLxpqU= X-Received: by 2002:a05:6214:d08:b0:894:2d0c:5de4 with SMTP id 6a1803df08f44-894638dcddcmr118409196d6.34.1769076053439; Thu, 22 Jan 2026 02:00:53 -0800 (PST) X-Received: by 2002:a05:6214:d08:b0:894:2d0c:5de4 with SMTP id 6a1803df08f44-894638dcddcmr118408696d6.34.1769076052928; Thu, 22 Jan 2026 02:00:52 -0800 (PST) Received: from [192.168.0.196] ([50.35.70.34]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8942e5e4d79sm162380536d6.2.2026.01.22.02.00.51 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 22 Jan 2026 02:00:52 -0800 (PST) Message-ID: <99a9c69a-fc1a-43b7-8d1e-c42d6493b41f@broadcom.com> Date: Thu, 22 Jan 2026 02:00:50 -0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] x86/vmware: Fix hypercall clobbers To: Josh Poimboeuf , x86@kernel.org Cc: linux-kernel@vger.kernel.org, Ajay Kaher , bcm-kernel-feedback-list@broadcom.com, Peter Zijlstra , Justin Forbes References: Content-Language: en-US From: Alexey Makhalov Autocrypt: addr=alexey.makhalov@broadcom.com; keydata= xsFNBGVo9lkBEACeouRIm6Q3QTvjcnPczfBqgLffURstVJz5nqjnrNR4T+8dwNrZB8PTgOWA QdGV4bIyqtNG7UHQuZ7sVKr2tx0gYJyQ5uZgncEHB5YIuhQ/CyAHrVmO+5/0/xWCLI0g44rF ZJqsYw2JQ2+vayTWbR65rkOiKL8GOVFNZanDg80BRh6qCmCEMXd/tymxvgnvWpHtxMgukexk 4vV9nV4XhxRVYdpLk8mBxsh+AEbHE+nbWgIuJDrmrZDGI2Dha7JFoB0Mi6hbbYd9BdkcHKQ7 6c+S1xOrZL3jX7OIFhb4NNnEOhh8/+BDlyby478p6YsimNa7TgAUbrygGyfVG8usrZy8SvO+ vUbVQwqjcJaCK1xazK12dfuZm2kSMJUrJqa9ng6OMjkE2/WrtnK8ruFNSCdytzbuheT0nYUJ Uwy84cU4p2K/N2C4vYjcn+IT+l1BFr5FViKYruoRLVH6zK/WOoZjA+Fc6tdM5nC1pgSB9c7h XLQqDSzYPzk3nqeHWG1qJ0Hu7pscIrjxyNTIZ5le0TlpblJdoRcL5maDNw22yle8m4D18ERF VrqNoqwW8fObMCHbd6C3m75lzerq1HhrSvLyU4UfprEyAcjOI1C0319SXfYlXDjKXRQyaDZP wxln8uShSitSSnx0AsSAjcUa8Cc7km81+G2WSK3S2wVIAN11awARAQABzS5BbGV4ZXkgTWFr aGFsb3YgPGFsZXhleS5tYWtoYWxvdkBicm9hZGNvbS5jb20+wsGNBBMBCAA3FiEEjLzRtST/ a5u42vOKbM7yHr5SJ3cFAmVo9lwFCQ0oaIACGwMECwkIBwUVCAkKCwUWAgMBAAAKCRBszvIe vlInd0jTD/9bZtjehewLRrW3dRDAbLG/+J5g1K4X5qQPfAo42NrhZQlOTibL7ixwq7NSXynZ V4Iu9jHAW++KXjxJzkg7zjBf9OOvvgCpqZGKYgWNvHHnX4eIVh8Ikp5JtvGPMBcRv7lJA5co kb+RHo9iRrB1dvRIOsP1SlGS85SiNA0yvmgqwbigLDmDRSWtvvt9XPwU1iqF+1OopT3UE10i /z+qE2ogcw2ADveBovq2W4JeQEBvlETwDKOdh8Q3UBHOqrZUrL7YjpUxgmb89FcjdDzUU95I fCB5YxF0hUctxFH5Uujh2F4qk0m2rp7+aOGtxWCJUqkHXjgpOoxyn0FPZiZlDkst84NO5OSI 5ZFPwaFqxUrFF+cFCY2O/UE2gpoK9Lt3gYNK6o2WIAtufuiYVdK6lANMkBgZ+t2fDLIN147a 172zu8XnyJMTo+tVfUjxwqynoR/NSWpVPs0Ck3K0LGjQE0tJ6HZrH0vudXk3YaiqW+D4CtGh I17Pk0h6x8LCdjmWmuDXoc99ezOEFSyWuTHjAYxx3cmgSUyIhdHtimuf0CVLTcFoBErb/5pJ zjb11Cj0HP87FMH57bnD3qyfkBMOB6tztfdt3vkCBaWkxaiTGXNhwr4IiLUoi90yIdXDMcTj /gvnjXgN+31iYgPWgTOdUEQud0DwDwuDwkzx/0x4sF1Dfc7BTQRlaPZcARAAuGkoYKWcrCh8 5RffedM6uBZ4p5Z4+RVj05uq7hlAwhHUpLP/XGbgNzhJP375Lonmnuyg2x7oHxfiwOohuuiA MnhSeEXn2qWZJuHosrYxs9y2zyiE/GTUAcqKiYBFa/96zOaZjHpNuQ5qSHYL64WhqvtmCQYg fL+jes2Z4IXl2R7MrN9OE+G3A3pOAo8TZKUEmlUV85fSmgopIX+hCiSQmRNRtp2jK6hd2+38 YAXc+eRxYgXKaWX5zeBgNrfM7Oxeh/0iWRZPWstTvVH2xMlzywOB3e/fqg+Q3NlPGDrTyHoc L86ZELSLcMTFn+RXw8lX8oVjTcQA0M8sQHB5g0JEWtMsFjnQZkJGCfeh0Odbn/F8nZ6LQQtu +fjc/4n9vRun+PZjdhd3W9ZM9D87W9XJg9txIaYnoUXBLLpHK/OirFfr5cJTUf4svtE3EVXb x6P9vr7zqUbE0f76h1eDPmyMwFAuibIXhNoEoKQtEjLX9aKgKYny3hczRiuQpA+6U4oTNn4S /CEqphLPT53aMH0w4x0CebMPozf24ZE9YphdX8ECclLBlDL1/zx2xKrJNw8v6wdXMSfsybBW 98b5b1eVBk1uc1UMlpDl7AIHyCMTjL9Ha85eoya/Hk9l93aVHgK04hOBY2ED1/ZRpj0M5P5m tNX1JqZunpyvKooT1PrJr4UAEQEAAcLBfAQYAQgAJhYhBIy80bUk/2ubuNrzimzO8h6+Uid3 BQJlaPZeBQkNKGiAAhsMAAoJEGzO8h6+Uid3SDoQAI3XXqsehWKvyAVeGXPxmkk+Suos/nJC xZWjp4U2xbbegBnNWladZoNdlVW/WV+FSFsN5IWztxQTWBMI12A0dx+Ooi9PSIANnlN+gQsA 9WeQ5iDNveEHZyK1GmuqZ3M3YZ1r3T2KyzTnPPZQ1B8gMQ442bOBWe077MqtLaC0J1jHyWHU j6BbUCAyR2/OCV/n1bH4wYIm2lgrOd2WuzoAGvju+j2g7hMRxw/xeHeu8S0czHuEZ0dC6fR1 ZKUOw03+mM/xRzL1be6RVS9AF7R5oDd11RrTOb7k14z0inFqSRrRwzOPKcuMxrApcquar336 3FQuLcJLjBo/SAOh2JatOkkwkw5PZseqdwcAk5+wcCbdYy8J8ttR04iV1FzrdQp8HbVxGNo7 AlDn1qtoHzvJHSQG51tbXWfLIi1ek3tpwJWj08+Zo+M47X6B65g7wdrwCiiFfclhXhI1eJNy fqqZgi3rxgu4sc5lmR846emZ/Tx85/nizqWCv7xUBxQwmhRPZRW+37vS2OLpyrTtBj3/tEM9 m9GMmTZqaJFeK7WCpprJV4jNHpWZuNAsQrdK1MrceIxb0/6wYe0xK79lScxms+zs9pGTrO4U 5RoS4gXK65ECcBH8/mumV6oBmLrNxKUrzTczdo9PnkmRyZcAa6AndbjmQDznwxvTZu2LjMPC EuY0 In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e Hi Josh, Thanks for reporting the problem. VMware hypercall 0x27 (VMWARE_CMD_ABSPOINTER_DATA) handler only modifies (returns data) on the first 4 arguments, regs: RAX, RBX, RCX, RDX. It does not and should not clobber any other guest registers except CC state. From the Oops message, the hardware is QEMU Standard PC. And the issue is caused by the vmmouse emulation there, specifically in vmmouse_ioport_read() function. 1. vmmouse_get_data(data) saves lower 32 bit for all 6 args. https://github.com/qemu/qemu/blob/master/hw/i386/vmmouse.c#L227 2. vmmouse_data() processes the hypercall preparing the data for the first 4 arguments. https://github.com/qemu/qemu/blob/master/hw/i386/vmmouse.c#L255 3. vmmouse_set_data(data). Copies only lower 32 bit back to all 6 args and _zeroes_ upper 32 bits for untouched RDI and RSI. Workarounding QEMU misbehavior from the kernel side by introducing less efficient asm inlines does not sound correct. Please report or fix the issue from QEMU side. Recommended QEMU fix: vmmouse_get_data/vmmouse_set_data should save/restore target_ulong type instead of uint32_t. Regards, --Alexey On 1/21/26 7:18 PM, Josh Poimboeuf wrote: > Fedora QA reported the following panic: > > BUG: unable to handle page fault for address: 0000000040003e54 > #PF: supervisor write access in kernel mode > #PF: error_code(0x0002) - not-present page > PGD 1082ec067 P4D 0 > Oops: Oops: 0002 [#1] SMP NOPTI > CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.19.0-0.rc4.260108gf0b9d8eb98df.34.fc43.x86_64 #1 PREEMPT(lazy) > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20251119-3.fc43 11/19/2025 > RIP: 0010:vmware_hypercall4.constprop.0+0x52/0x90 > Code: 48 83 c4 20 5b e9 69 f0 fc fe 8b 05 a0 c1 b2 01 85 c0 74 23 b8 68 58 4d 56 b9 27 00 00 00 31 d2 bb 04 00 00 00 66 ba 58 56 ed <89> 1f 89 0e 41 89 10 5b e9 3c f0 fc fe 6a 00 49 89 f9 45 31 c0 31 > RSP: 0018:ff5eeb3240003e40 EFLAGS: 00010046 > RAX: 0000000000000000 RBX: 000000000000ffca RCX: 000000000000ffac > RDX: 0000000000000000 RSI: 0000000040003e58 RDI: 0000000040003e54 > RBP: ff1e05f3c1204800 R08: ff5eeb3240003e5c R09: 000000009d899c41 > R10: 000000000000003d R11: ff5eeb3240003ff8 R12: 0000000000000000 > R13: 00000000000000ff R14: ff1e05f3c02f9e00 R15: 000000000000000c > FS: 0000000000000000(0000) GS:ff1e05f489e40000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000040003e54 CR3: 000000010841d002 CR4: 0000000000771ef0 > PKRU: 55555554 > Call Trace: > > vmmouse_report_events+0x13e/0x1b0 > psmouse_handle_byte+0x15/0x60 > ps2_interrupt+0x8a/0xd0 > ... > > The panic was triggered by dereferencing a bad pointer (in RDI) > immediately after a VMware hypercall: > > ffffffff82135070 : > ... > ffffffff821350ac: b8 68 58 4d 56 mov $0x564d5868,%eax > ffffffff821350b1: b9 27 00 00 00 mov $0x27,%ecx > ffffffff821350b6: 31 d2 xor %edx,%edx > ffffffff821350b8: bb 04 00 00 00 mov $0x4,%ebx > ffffffff821350bd: 66 ba 58 56 mov $0x5658,%dx > ffffffff821350c1: ed in (%dx),%eax <-- hypercall > ffffffff821350c2: 89 1f mov %ebx,(%rdi) <-- crash > > Reading the disassembly shows that RDI should contain the value of a > valid kernel stack address here (0xff5eeb3240003e54). Instead it > contains 0x40003e54, suggesting the hypervisor cleared the upper 32 > bits. > > This issue was bisected to commit aca282ab7e75 ("x86/asm: Annotate > special section entries"), which added annotations to the ALTERNATIVE() > macro. Despite the use of asm_inline, that commit caused the compiler > to un-inline and const-propagate vmware_hypercall4(). > > That made RDI live across the hypercall, making the hypervisor's > register clobbering visible and exposing this latent bug. > > The open-vm-tools reference implementation treats all six registers as > clobbered for all hypercalls. Match that behavior here. > > Fixes: 34bf25e820ae ("x86/vmware: Introduce VMware hypercall API") > Fixes: aca282ab7e75 ("x86/asm: Annotate special section entries") > Reported-by: Justin Forbes > Signed-off-by: Josh Poimboeuf > --- > arch/x86/include/asm/vmware.h | 72 +++++++++++++++++------------------ > 1 file changed, 34 insertions(+), 38 deletions(-) > > diff --git a/arch/x86/include/asm/vmware.h b/arch/x86/include/asm/vmware.h > index c9cf43d5ef23..372173d4ea27 100644 > --- a/arch/x86/include/asm/vmware.h > +++ b/arch/x86/include/asm/vmware.h > @@ -98,7 +98,7 @@ extern unsigned long vmware_tdx_hypercall(unsigned long cmd, > static inline > unsigned long vmware_hypercall1(unsigned long cmd, unsigned long in1) > { > - unsigned long out0; > + unsigned long out0, tmp = 0; > > if (cpu_feature_enabled(X86_FEATURE_TDX_GUEST)) > return vmware_tdx_hypercall(cmd, in1, 0, 0, 0, > @@ -109,13 +109,11 @@ unsigned long vmware_hypercall1(unsigned long cmd, unsigned long in1) > NULL, NULL, NULL, NULL, NULL); > > asm_inline volatile (VMWARE_HYPERCALL > - : "=a" (out0) > + : "=a" (out0), "+b" (in1), "+c" (cmd), "+d" (tmp) > : [port] "i" (VMWARE_HYPERVISOR_PORT), > - "a" (VMWARE_HYPERVISOR_MAGIC), > - "b" (in1), > - "c" (cmd), > - "d" (0) > - : "cc", "memory"); > + "a" (VMWARE_HYPERVISOR_MAGIC) > + : "di", "si", "cc", "memory"); > + > return out0; > } > > @@ -123,7 +121,7 @@ static inline > unsigned long vmware_hypercall3(unsigned long cmd, unsigned long in1, > u32 *out1, u32 *out2) > { > - unsigned long out0; > + unsigned long out0, tmp = 0; > > if (cpu_feature_enabled(X86_FEATURE_TDX_GUEST)) > return vmware_tdx_hypercall(cmd, in1, 0, 0, 0, > @@ -134,13 +132,13 @@ unsigned long vmware_hypercall3(unsigned long cmd, unsigned long in1, > out1, out2, NULL, NULL, NULL); > > asm_inline volatile (VMWARE_HYPERCALL > - : "=a" (out0), "=b" (*out1), "=c" (*out2) > + : "=a" (out0), "=b" (*out1), "=c" (*out2), "+d" (tmp) > : [port] "i" (VMWARE_HYPERVISOR_PORT), > "a" (VMWARE_HYPERVISOR_MAGIC), > "b" (in1), > - "c" (cmd), > - "d" (0) > - : "cc", "memory"); > + "c" (cmd) > + : "di", "si", "cc", "memory"); > + > return out0; > } > > @@ -165,7 +163,8 @@ unsigned long vmware_hypercall4(unsigned long cmd, unsigned long in1, > "b" (in1), > "c" (cmd), > "d" (0) > - : "cc", "memory"); > + : "di", "si", "cc", "memory"); > + > return out0; > } > > @@ -185,15 +184,13 @@ unsigned long vmware_hypercall5(unsigned long cmd, unsigned long in1, > NULL, out2, NULL, NULL, NULL); > > asm_inline volatile (VMWARE_HYPERCALL > - : "=a" (out0), "=c" (*out2) > + : "=a" (out0), "+b" (in1), "=c" (*out2), "+d" (in3), > + "+S" (in4), "+D" (in5) > : [port] "i" (VMWARE_HYPERVISOR_PORT), > "a" (VMWARE_HYPERVISOR_MAGIC), > - "b" (in1), > - "c" (cmd), > - "d" (in3), > - "S" (in4), > - "D" (in5) > + "c" (cmd) > : "cc", "memory"); > + > return out0; > } > > @@ -213,14 +210,14 @@ unsigned long vmware_hypercall6(unsigned long cmd, unsigned long in1, > NULL, out2, out3, out4, out5); > > asm_inline volatile (VMWARE_HYPERCALL > - : "=a" (out0), "=c" (*out2), "=d" (*out3), "=S" (*out4), > - "=D" (*out5) > + : "=a" (out0), "+b" (in1), "=c" (*out2), "=d" (*out3), > + "=S" (*out4), "=D" (*out5) > : [port] "i" (VMWARE_HYPERVISOR_PORT), > "a" (VMWARE_HYPERVISOR_MAGIC), > - "b" (in1), > "c" (cmd), > "d" (in3) > : "cc", "memory"); > + > return out0; > } > > @@ -241,15 +238,15 @@ unsigned long vmware_hypercall7(unsigned long cmd, unsigned long in1, > out1, out2, out3, NULL, NULL); > > asm_inline volatile (VMWARE_HYPERCALL > - : "=a" (out0), "=b" (*out1), "=c" (*out2), "=d" (*out3) > + : "=a" (out0), "=b" (*out1), "=c" (*out2), "=d" (*out3), > + "+S" (in4), "+D" (in5) > : [port] "i" (VMWARE_HYPERVISOR_PORT), > "a" (VMWARE_HYPERVISOR_MAGIC), > "b" (in1), > "c" (cmd), > - "d" (in3), > - "S" (in4), > - "D" (in5) > + "d" (in3) > : "cc", "memory"); > + > return out0; > } > > @@ -272,7 +269,9 @@ unsigned long vmware_hypercall_hb_out(unsigned long cmd, unsigned long in2, > unsigned long in5, unsigned long in6, > u32 *out1) > { > - unsigned long out0; > + unsigned long out0, port; > + > + port = in3 | VMWARE_HYPERVISOR_PORT_HB; > > asm_inline volatile ( > UNWIND_HINT_SAVE > @@ -282,15 +281,13 @@ unsigned long vmware_hypercall_hb_out(unsigned long cmd, unsigned long in2, > "rep outsb\n\t" > "pop %%" _ASM_BP "\n\t" > UNWIND_HINT_RESTORE > - : "=a" (out0), "=b" (*out1) > + : "=a" (out0), "=b" (*out1), "+c" (in2), "+d" (port), > + "+S" (in4), "+D" (in5) > : "a" (VMWARE_HYPERVISOR_MAGIC), > "b" (cmd), > - "c" (in2), > - "d" (in3 | VMWARE_HYPERVISOR_PORT_HB), > - "S" (in4), > - "D" (in5), > [in6] VMW_BP_CONSTRAINT (in6) > : "cc", "memory"); > + > return out0; > } > > @@ -300,7 +297,9 @@ unsigned long vmware_hypercall_hb_in(unsigned long cmd, unsigned long in2, > unsigned long in5, unsigned long in6, > u32 *out1) > { > - unsigned long out0; > + unsigned long out0, port; > + > + port = in3 | VMWARE_HYPERVISOR_PORT_HB; > > asm_inline volatile ( > UNWIND_HINT_SAVE > @@ -310,13 +309,10 @@ unsigned long vmware_hypercall_hb_in(unsigned long cmd, unsigned long in2, > "rep insb\n\t" > "pop %%" _ASM_BP "\n\t" > UNWIND_HINT_RESTORE > - : "=a" (out0), "=b" (*out1) > + : "=a" (out0), "=b" (*out1), "+c" (in2), "+d" (port), > + "+S" (in4), "+D" (in5) > : "a" (VMWARE_HYPERVISOR_MAGIC), > "b" (cmd), > - "c" (in2), > - "d" (in3 | VMWARE_HYPERVISOR_PORT_HB), > - "S" (in4), > - "D" (in5), > [in6] VMW_BP_CONSTRAINT (in6) > : "cc", "memory"); > return out0;