mark branch player-14.1.2 as retired

Since commit 11c5ad0ec441 ("eventpoll: switch to ->poll_mask") in
v4.18-rc1, eventpoll switched from ->poll() to ->poll_mask(). Rather than
calling the callback directly (which would result in null pointer
dereference), use vfs_poll() wrapper. As this wrapper is only available
since 4.18-rc1 cycle as well, provide a copy to use when building against
older kernels.

INSTALL

@@ -150,7 +150,7 @@ test build).
 When using a downloaded tarball, simply run
 
   tar -cf vmmon.tar vmmon-only
-  tar -cf vmnet.tar vmnet-only
+  tar -cf vmnet.tar vmmon-only
 
 to create the tarballs. In this case, there is no protection against
 unwanted local changes.

RETIRED

@@ -0,0 +1,7 @@
+*-----------------------------------------------------------------------------
+* Branch player-14.1.2 has been retired on 2018-08-20 and has not been
+* receiving any updates since. Please switch to latest 14.1.x version
+* available.
+*
+* Latest kernel version this branch is intended to work with is 4.18.
+*-----------------------------------------------------------------------------

vmmon-only/Makefile

@@ -107,7 +107,7 @@ prebuild:: ;
 postbuild:: ;
 
 $(DRIVER_KO): prebuild
-	$(MAKE) -C $(BUILD_DIR) M=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
+	$(MAKE) -C $(BUILD_DIR) SUBDIRS=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) modules
 	$(MAKE) -C $$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) postbuild

vmmon-only/include/hashFunc.h

@@ -251,7 +251,6 @@ static INLINE ub8 hash2(register const ub8 *k, /* the key */
   {
     /* c is reserved for the length */
   case  2: b+=k[1];
-	   /* fall through */
   case  1: a+=k[0];
     /* case 0: nothing left to add */
   }

vmmon-only/include/iocontrols.h

@@ -144,7 +144,7 @@ PtrToVA64(void const *ptr) // IN
  *
  */
 
-#define VMMON_VERSION           (331 << 16 | 0)
+#define VMMON_VERSION           (330 << 16 | 0)
 #define VMMON_VERSION_MAJOR(v)  ((uint32) (v) >> 16)
 #define VMMON_VERSION_MINOR(v)  ((uint16) (v))
 

vmmon-only/include/x86cpuid.h

@@ -460,11 +460,8 @@ FLAG(   6,  0, ECX,  0,  1, HW_COORD_FEEDBACK,                 NO,   0, FALSE) \
 FLAG(   6,  0, ECX,  1,  1, ACNT2,                             ANY, 13, FALSE) \
 FLAG(   6,  0, ECX,  3,  1, ENERGY_PERF_BIAS,                  NO,   0, FALSE)
 
-#define CPUID_7_EDX_28 \
-FLAG(   7,  0, EDX, 28,  1, LEVEL7EDX_RSVD1,                    NO,  0, FALSE)
-
 #define CPUID_7_EDX_31 \
-FLAG(   7,  0, EDX, 31,  1, LEVEL7EDX_RSVD2,                    NO,  0, FALSE)
+FLAG(   7,  0, EDX, 31,  1, LEVEL7EDX_RSVD1,                    NO,  0, FALSE)
 
 /*    LEVEL, SUB-LEVEL, REG, POS, SIZE, NAME,             MON SUPP, HWV, CPL3 */
 #define CPUID_FIELD_DATA_LEVEL_7                                               \
@@ -506,7 +503,6 @@ FLAG(   7,  0, ECX,  4,  1, OSPKE,                             ANY, 13, TRUE)  \
 FLAG(   7,  0, ECX, 30,  1, SGX_LC,                            NO,   0, FALSE) \
 FLAG(   7,  0, EDX, 26,  1, IBRSIBPB,                          ANY,  9, FALSE) \
 FLAG(   7,  0, EDX, 27,  1, STIBP,                             YES,  9, FALSE) \
-CPUID_7_EDX_28                                                                 \
 FLAG(   7,  0, EDX, 29,  1, ARCH_CAPABILITIES,                 ANY,  9, FALSE) \
 CPUID_7_EDX_31
 

vmmon-only/include/x86msr.h

@@ -120,9 +120,6 @@ MSRQuery;
 #define MSR_ARCH_CAPABILITIES_IBRS_ALL            (1ULL << 1)
 #define MSR_ARCH_CAPABILITIES_RSBA                (1ULL << 2)
 
-#define MSR_FLUSH_CMD                        0x10b
-#define MSR_FLUSH_CMD_FLUSH_L1D              1
-
 #define MSR_SPEC_CTRL_IBRS                        (1UL << 0)
 #define MSR_SPEC_CTRL_STIBP                       (1UL << 1)
 #define MSR_PRED_CMD_IBPB                         (1UL << 0)

vmmon-only/include/x86paging_64.h

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998-2014,2016,2018 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998-2014,2016 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -39,7 +39,6 @@
 #include "vm_basic_types.h"
 #include "x86types.h"
 #include "vm_pagetable.h"
-#include "x86paging_common.h"
 
 #define LM_PTE_PFN_MASK      CONST64U(0xffffffffff000)
 #define LM_PTE_2_PFN(_pte)   (((_pte) & LM_PTE_PFN_MASK) >> PT_PTE_PFN_SHIFT)
@@ -71,8 +70,6 @@
 #define LM_MAKE_L1E(_pfn, _avail, _flags) LM_MAKE_PTE(_pfn, _avail, _flags)
 
 
-
-
 /*
  * x86-64 architecture requires implementations supporting less than
  * full 64-bit VAs to ensure that all virtual addresses are in canonical

vmmon-only/linux/driver.c

@@ -73,9 +73,6 @@ static Bool LinuxDriverCheckPadding(void);
 
 struct VMXLinuxState linuxState;
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 17, 0)
-typedef int vm_fault_t;
-#endif
 
 /*
  *----------------------------------------------------------------------
@@ -100,9 +97,9 @@ long LinuxDriver_Ioctl(struct file *filp, u_int iocmd,
 
 static int LinuxDriver_Close(struct inode *inode, struct file *filp);
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
-static vm_fault_t LinuxDriverFault(struct vm_fault *fault);
+static int LinuxDriverFault(struct vm_fault *fault);
 #else
-static vm_fault_t LinuxDriverFault(struct vm_area_struct *vma, struct vm_fault *fault);
+static int LinuxDriverFault(struct vm_area_struct *vma, struct vm_fault *fault);
 #endif
 static int LinuxDriverMmap(struct file *filp, struct vm_area_struct *vma);
 
@@ -597,7 +594,7 @@ LinuxDriver_Close(struct inode *inode, // IN
  *-----------------------------------------------------------------------------
  */
 
-static vm_fault_t
+static int
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
 LinuxDriverFault(struct vm_fault *fault)     //IN/OUT
 #else

vmmon-only/linux/hostif.c

@@ -116,7 +116,13 @@
  */
 #define LOCKED_PAGE_SLACK 10000
 
-u64 uptime_base;
+static struct {
+   Atomic_uint64     uptimeBase;
+   VersionedAtomic   version;
+   uint64            monotimeBase;
+   unsigned long     jiffiesBase;
+   struct timer_list timer;
+} uptimeState;
 
 /*
  * First Page Locking strategy
@@ -175,21 +181,6 @@ u64 uptime_base;
 uint8 monitorIPIVector;
 uint8 hvIPIVector;
 
-static unsigned long compat_totalram_pages(void)
-{
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
-	return totalram_pages;
-#else
-	return totalram_pages();
-#endif
-}
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0) && defined(VERIFY_WRITE)
-	#define write_access_ok(addr, size) access_ok(VERIFY_WRITE, addr, size)
-#else
-	#define write_access_ok(addr, size) access_ok(addr, size)
-#endif
-
 /*
  *-----------------------------------------------------------------------------
  *
@@ -1504,7 +1495,14 @@ unsigned int
 HostIF_EstimateLockedPageLimit(const VMDriver* vm,                // IN
                                unsigned int currentlyLockedPages) // IN
 {
-   unsigned int totalPhysicalPages = compat_totalram_pages();
+   /*
+    * This variable is available and exported to modules,
+    * since at least 2.6.0.
+    */
+
+   extern unsigned long totalram_pages;
+
+   unsigned int totalPhysicalPages = totalram_pages;
 
    /*
     * Use the memory information linux exports as of late for a more
@@ -1602,6 +1600,143 @@ HostIF_WaitForFreePages(unsigned int timeoutMs)  // IN:
 }
 
 
+/*
+ *----------------------------------------------------------------------
+ *
+ * HostIFReadUptimeWork --
+ *
+ *      Reads the current uptime.  The uptime is based on getimeofday,
+ *      which provides the needed high resolution.  However, we don't
+ *      want uptime to be warped by e.g. calls to settimeofday.  So, we
+ *      use a jiffies based monotonic clock to sanity check the uptime.
+ *      If the uptime is more than one second from the monotonic time,
+ *      we assume that the time of day has been set, and recalculate the
+ *      uptime base to get uptime back on track with monotonic time.  On
+ *      the other hand, we do expect jiffies based monotonic time and
+ *      timeofday to have small drift (due to NTP rate correction, etc).
+ *      We handle this by rebasing the jiffies based monotonic clock
+ *      every second (see HostIFUptimeResyncMono).
+ *
+ * Results:
+ *      The uptime, in units of UPTIME_FREQ.  Also returns the jiffies
+ *      value that was used in the monotonic time calculation.
+ *
+ * Side effects:
+ *      May reset the uptime base in the case gettimeofday warp was
+ *      detected.
+ *
+ *----------------------------------------------------------------------
+ */
+
+static uint64
+HostIFReadUptimeWork(unsigned long *j)  // OUT: current jiffies
+{
+   struct timeval tv;
+   uint64 monotime, uptime, upBase, monoBase;
+   int64 diff;
+   uint32 version;
+   unsigned long jifs, jifBase;
+   unsigned int attempts = 0;
+
+ retry:
+   do {
+      version  = VersionedAtomic_BeginTryRead(&uptimeState.version);
+      jifs     = jiffies;
+      jifBase  = uptimeState.jiffiesBase;
+      monoBase = uptimeState.monotimeBase;
+   } while (!VersionedAtomic_EndTryRead(&uptimeState.version, version));
+
+   do_gettimeofday(&tv);
+   upBase = Atomic_Read64(&uptimeState.uptimeBase);
+
+   monotime = (uint64)(jifs - jifBase) * (UPTIME_FREQ / HZ);
+   monotime += monoBase;
+
+   uptime = tv.tv_usec * (UPTIME_FREQ / 1000000) + tv.tv_sec * UPTIME_FREQ;
+   uptime += upBase;
+
+   /*
+    * Use the jiffies based monotonic time to sanity check gettimeofday.
+    * If they differ by more than one second, assume the time of day has
+    * been warped, and use the jiffies time to undo (most of) the warp.
+    */
+
+   diff = uptime - monotime;
+   if (UNLIKELY(diff < -UPTIME_FREQ || diff > UPTIME_FREQ)) {
+      /* Compute a new uptimeBase to get uptime back on track. */
+      uint64 newUpBase = monotime - (uptime - upBase);
+
+      attempts++;
+      if (!Atomic_CMPXCHG64(&uptimeState.uptimeBase, upBase, newUpBase) &&
+          attempts < 5) {
+         /* Another thread updated uptimeBase.  Recalculate uptime. */
+         goto retry;
+      }
+      uptime = monotime;
+
+      Log("%s: detected settimeofday: fixed uptimeBase old %"FMT64"u "
+          "new %"FMT64"u attempts %u\n", __func__,
+          upBase, newUpBase, attempts);
+   }
+   *j = jifs;
+
+   return uptime;
+}
+
+
+/*
+ *----------------------------------------------------------------------
+ *
+ * HostIFUptimeResyncMono --
+ *
+ *      Timer that fires ever second to resynchronize the jiffies based
+ *      monotonic time with the uptime.
+ *
+ * Results:
+ *      None
+ *
+ * Side effects:
+ *      Resets the monotonic time bases so that jiffies based monotonic
+ *      time does not drift from gettimeofday over the long term.
+ *
+ *----------------------------------------------------------------------
+ */
+
+static void
+HostIFUptimeResyncMono(struct timer_list *timer)  // IN: ignored
+{
+   unsigned long jifs;
+   uintptr_t flags;
+
+   /*
+    * Read the uptime and the corresponding jiffies value.  This will
+    * also correct the uptime (which is based on time of day) if needed
+    * before we rebase monotonic time (which is based on jiffies).
+    */
+
+   uint64 uptime = HostIFReadUptimeWork(&jifs);
+
+   /*
+    * Every second, recalculate monoBase and jiffiesBase to squash small
+    * drift between gettimeofday and jiffies.  Also, this prevents
+    * (jiffies - jiffiesBase) wrap on 32-bits.
+    */
+
+   SAVE_FLAGS(flags);
+   CLEAR_INTERRUPTS();
+   VersionedAtomic_BeginWrite(&uptimeState.version);
+
+   uptimeState.monotimeBase = uptime;
+   uptimeState.jiffiesBase  = jifs;
+
+   VersionedAtomic_EndWrite(&uptimeState.version);
+   RESTORE_FLAGS(flags);
+
+   /* Reschedule this timer to expire in one second. */
+   mod_timer(&uptimeState.timer, jifs + HZ);
+}
+
+
 /*
  *----------------------------------------------------------------------
  *
@@ -1613,7 +1748,8 @@ HostIF_WaitForFreePages(unsigned int timeoutMs)  // IN:
  *      None
  *
  * Side effects:
- *      Sets the initial value for the uptime base.
+ *      Sets the initial values for the uptime state, and schedules
+ *      the uptime timer.
  *
  *----------------------------------------------------------------------
  */
@@ -1621,7 +1757,22 @@ HostIF_WaitForFreePages(unsigned int timeoutMs)  // IN:
 void
 HostIF_InitUptime(void)
 {
-   uptime_base = ktime_get_ns();
+   struct timeval tv;
+
+   uptimeState.jiffiesBase = jiffies;
+   do_gettimeofday(&tv);
+   Atomic_Write64(&uptimeState.uptimeBase,
+                  -(tv.tv_usec * (UPTIME_FREQ / 1000000) +
+                    tv.tv_sec * UPTIME_FREQ));
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0) && !defined(timer_setup)
+   init_timer(&uptimeState.timer);
+   uptimeState.timer.function = (void *)HostIFUptimeResyncMono;
+   uptimeState.timer.data = (unsigned long)&uptimeState.timer;
+#else
+   timer_setup(&uptimeState.timer, HostIFUptimeResyncMono, 0);
+#endif
+   mod_timer(&uptimeState.timer, jiffies + HZ);
 }
 
 
@@ -1630,13 +1781,13 @@ HostIF_InitUptime(void)
  *
  * HostIF_CleanupUptime --
  *
- *      No-op, left for backward compatibility.
+ *      Cleanup uptime state, called at module unloading time.
  *
  * Results:
  *      None
  *
  * Side effects:
- *      None
+ *      Deschedule the uptime timer.
  *
  *----------------------------------------------------------------------
  */
@@ -1644,6 +1795,7 @@ HostIF_InitUptime(void)
 void
 HostIF_CleanupUptime(void)
 {
+   del_timer_sync(&uptimeState.timer);
 }
 
 
@@ -1667,10 +1819,9 @@ HostIF_CleanupUptime(void)
 uint64
 HostIF_ReadUptime(void)
 {
-   u64 tm;
+   unsigned long jifs;
 
-   tm = ktime_get_ns();
-   return (tm - uptime_base) / (NSEC_PER_SEC / UPTIME_FREQ);
+   return HostIFReadUptimeWork(&jifs);
 }
 
 
@@ -2014,7 +2165,7 @@ isVAReadable(VA r)  // IN:
    int ret;
 
    old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());
    r = APICR_TO_ADDR(r, APICR_VERSION);
    ret = HostIF_CopyFromUser(&dummy, r, sizeof dummy);
    set_fs(old_fs);
@@ -2047,7 +2198,7 @@ SetVMAPICAddr(VMDriver *vm, // IN/OUT: driver state
    volatile void *hostapic;
 
    ASSERT_ON_COMPILE(APICR_SIZE <= PAGE_SIZE);
-   hostapic = (volatile void *) ioremap(ma, PAGE_SIZE);
+   hostapic = (volatile void *) ioremap_nocache(ma, PAGE_SIZE);
    if (hostapic) {
       if ((APIC_VERSIONREG(hostapic) & 0xF0) == 0x10) {
          vm->hostAPIC.base = (volatile uint32 (*)[4]) hostapic;
@@ -2215,7 +2366,7 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
    }
 
    old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());
 
    {
       struct poll_wqueues table;
@@ -2344,7 +2495,7 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
    }
 
    old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());
 
    /*
     * Always write sizeof(uint64) bytes. This works fine for eventfd and
@@ -3004,7 +3155,7 @@ HostIF_SetFastClockRate(unsigned int rate) // IN: Frequency in Hz.
       }
    } else {
       if (linuxState.fastClockThread) {
-         send_sig(SIGKILL, linuxState.fastClockThread, 1);
+         force_sig(SIGKILL, linuxState.fastClockThread);
          kthread_stop(linuxState.fastClockThread);
 
          linuxState.fastClockThread = NULL;
@@ -3050,7 +3201,7 @@ HostIF_MapUserMem(VA addr,                  // IN: User memory virtual address
 
    ASSERT(handle);
 
-   if (!write_access_ok(p, size)) {
+   if (!access_ok(VERIFY_WRITE, p, size)) {
       printk(KERN_ERR "%s: Couldn't verify write to uva 0x%p with size %"
              FMTSZ"u\n", __func__, p, size);
 

vmnet-only/Makefile

@@ -107,7 +107,7 @@ prebuild:: ;
 postbuild:: ;
 
 $(DRIVER_KO): prebuild
-	$(MAKE) -C $(BUILD_DIR) M=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
+	$(MAKE) -C $(BUILD_DIR) SUBDIRS=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) modules
 	$(MAKE) -C $$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) postbuild

vmnet-only/bridge.c

@@ -66,7 +66,7 @@
 #endif
 
 #if LOGLEVEL >= 4
-static u64 vnetTime;
+static struct timeval vnetTime;
 #endif
 
 typedef struct VNetBridge VNetBridge;
@@ -693,7 +693,7 @@ VNetBridgeReceiveFromVNet(VNetJack        *this, // IN: jack
 
 	 netif_rx_ni(clone);
 #	 if LOGLEVEL >= 4
-	 vnetTime = ktime_get_ns();
+	 do_gettimeofday(&vnetTime);
 #	 endif
       }
    }
@@ -1490,11 +1490,12 @@ VNetBridgeReceiveFromDev(struct sk_buff *skb,         // IN: packet to receive
 
 #  if LOGLEVEL >= 4
    {
-      u64 now;
-
-      now = ktime_get_ns();
+      struct timeval now;
+      do_gettimeofday(&now);
       LOG(3, (KERN_DEBUG "bridge-%s: time %d\n",
-	      bridge->name, (int)((now - vnetTime) / NSEC_PER_USEC)));
+	      bridge->name,
+	      (int)((now.tv_sec * 1000000 + now.tv_usec)
+                    - (vnetTime.tv_sec * 1000000 + vnetTime.tv_usec))));
    }
 #  endif
 

vmnet-only/procfs.c

@@ -161,14 +161,6 @@ VNetProcOpen(struct inode *inode,   // IN:
 }
 
 /* Our procfs callbacks.  We only need to specialize open. */
-#ifdef DEFINE_PROC_SHOW_ATTRIBUTE
-static const struct proc_ops fops = {
-   .proc_open    = VNetProcOpen,
-   .proc_read    = seq_read,
-   .proc_lseek   = seq_lseek,
-   .proc_release = single_release,
-};
-#else
 static struct file_operations fops = {
    .open    = VNetProcOpen,
    .read    = seq_read,
@@ -176,7 +168,6 @@ static struct file_operations fops = {
    .release = single_release,
 };
 #endif
-#endif
 
 
 /*

vmnet-only/userif.c

@@ -78,37 +78,11 @@ static int  VNetUserIfSetUplinkState(VNetPort *port, uint8 linkUp);
 extern unsigned int  vnet_max_qlen;
 
 #if COMPAT_LINUX_VERSION_CHECK_LT(3, 2, 0)
-#   define compat_kmap_frag(frag) kmap((frag)->page)
-#   define compat_kunmap_frag(page) kunmap((frag)->page)
+#   define compat_kmap(page) kmap(page)
+#   define compat_kunmap(page) kunmap(page)
 #else
-#   define compat_kmap_frag(frag) kmap(skb_frag_page(frag))
-#   define compat_kunmap_frag(frag) kunmap(skb_frag_page(frag))
-#endif
-
-static unsigned int compat_skb_frag_size(const skb_frag_t *frag)
-{
-#if COMPAT_LINUX_VERSION_CHECK_LT(3, 2, 0)
-	return frag->size;
-#else
-	return skb_frag_size(frag);
-#endif
-}
-
-static unsigned int compat_skb_frag_off(const skb_frag_t *frag)
-{
-#if COMPAT_LINUX_VERSION_CHECK_LT(5, 4, 0) && \
-	!(defined(CONFIG_SUSE_VERSION) && CONFIG_SUSE_VERSION == 15 && \
-	  defined(CONFIG_SUSE_PATCHLEVEL) && CONFIG_SUSE_PATCHLEVEL >= 2)
-	return frag->page_offset;
-#else
-	return skb_frag_off(frag);
-#endif
-}
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0) && defined(VERIFY_WRITE)
-	#define write_access_ok(addr, size) access_ok(VERIFY_WRITE, addr, size)
-#else
-	#define write_access_ok(addr, size) access_ok(addr, size)
+#   define compat_kmap(page) kmap((page).p)
+#   define compat_kunmap(page) kunmap((page).p)
 #endif
 
 /*
@@ -168,7 +142,7 @@ VNetUserIfMapPtr(VA uAddr,        // IN: pointer to user memory
                  struct page **p, // OUT: locked page
                  void **ptr)      // OUT: kernel mapped pointer
 {
-   if (!write_access_ok((void *)uAddr, size) ||
+   if (!access_ok(VERIFY_WRITE, (void *)uAddr, size) ||
        (((uAddr + size - 1) & ~(PAGE_SIZE - 1)) !=
         (uAddr & ~(PAGE_SIZE - 1)))) {
       return -EINVAL;
@@ -585,21 +559,20 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
    for (frag = skb_shinfo(skb)->frags;
 	frag != skb_shinfo(skb)->frags + skb_shinfo(skb)->nr_frags;
 	frag++) {
-      if (compat_skb_frag_size(frag) > 0) {
+      if (frag->size > 0) {
 	 unsigned int tmpCsum;
 	 const void *vaddr;
 
-	 vaddr = compat_kmap_frag(frag);
-	 tmpCsum = csum_and_copy_to_user(vaddr + compat_skb_frag_off(frag),
-					 curr, compat_skb_frag_size(frag), 0,
-					 &err);
-	 compat_kunmap_frag(frag);
+	 vaddr = compat_kmap(frag->page);
+	 tmpCsum = csum_and_copy_to_user(vaddr + frag->page_offset,
+					 curr, frag->size, 0, &err);
+	 compat_kunmap(frag->page);
 
 	 if (err) {
 	    return err;
 	 }
 	 csum = csum_block_add(csum, tmpCsum, curr - buf);
-	 curr += compat_skb_frag_size(frag);
+	 curr += frag->size;
       }
    }