vmmon: avoid using alloc_vm_area() for crosspage allocation

Mainline commit 301fa9f2ddf7 ("mm: remove alloc_vm_area") in v5.10-rc1
removed alloc_vm_area() function used to allow allocating crosspage as
executable after vmap() started silently setting NX flag in kernel 5.8.

Similar to what upstream did in Xen code, use apply_to_page_range() to fix
the crosspage flags, except we don't need to use get_vm_area() which is not
exported. Thanks to virtualbox for the hint that current->mm can be used
instead of init_mm (which is not exported either).

vmmon-only/linux/hostif.c

@@ -56,6 +56,7 @@
 #include <linux/hrtimer.h>
 #include <linux/signal.h>
 #include <linux/taskstats_kern.h> // For linux/sched/signal.h without version check
+#include <linux/eventfd.h>
 
 #include "vmware.h"
 #include "x86apic.h"
@@ -605,6 +606,15 @@ HostIF_FastClockUnlock(int callerID) // IN
    MutexUnlock(&fastClockMutex, callerID);
 }
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 8, 0)
+static int crosspage_set_exec(pte_t *pte, unsigned long addr, void *data)
+{
+	struct page *p = data;
+
+	set_pte(pte, mk_pte(p, VM_PAGE_KERNEL_EXEC));
+	return 0;
+}
+#endif
 
 /*
  *----------------------------------------------------------------------
@@ -625,23 +635,28 @@ HostIF_FastClockUnlock(int callerID) // IN
 static void *
 MapCrossPage(struct page *p)  // IN:
 {
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
+#if COMPAT_LINUX_VERSION_CHECK_LT(5, 8, 0)
    return vmap(&p, 1, VM_MAP, VM_PAGE_KERNEL_EXEC);
 #else
+   void *addr;
+
+   addr = vmap(&p, 1, VM_MAP, VM_PAGE_KERNEL_EXEC);
+   if (!addr)
+	   return NULL;
+
    /* Starting with 5.8, vmap() always sets the NX bit, but the cross
     * page needs to be executable. */
-   pte_t *ptes[1];
-   struct vm_struct *area = alloc_vm_area(1UL << PAGE_SHIFT, ptes);
-   if (area == NULL)
+   if (apply_to_page_range(current->mm, (unsigned long)addr, PAGE_SIZE,
+			   crosspage_set_exec, p)) {
+      vunmap(addr);
       return NULL;
-
-   set_pte(ptes[0], mk_pte(p, VM_PAGE_KERNEL_EXEC));
+   }
 
    preempt_disable();
    __flush_tlb_all();
    preempt_enable();
 
-   return area->addr;
+   return addr;
 #endif
 }
 
@@ -2012,6 +2027,27 @@ HostIF_VMLockIsHeld(VMDriver *vm) // IN
 
 #if defined(CONFIG_SMP) || defined(CONFIG_X86_UP_IOAPIC) || \
     defined(CONFIG_X86_UP_APIC) || defined(CONFIG_X86_LOCAL_APIC)
+
+#if COMPAT_LINUX_VERSION_CHECK_LT(5, 8, 0)
+static long compat_copy_from_kernel_nofault(void *dst, VA src, size_t size)
+{
+   mm_segment_t old_fs;
+   long ret;
+
+   old_fs = get_fs();
+   set_fs(KERNEL_DS);
+   ret = HostIF_CopyFromUser(dst, src, size);
+   set_fs(old_fs);
+
+   return ret;
+}
+#else
+static long compat_copy_from_kernel_nofault(void *dst, VA src, size_t size)
+{
+   return copy_from_kernel_nofault(dst, (const void *)src, size);
+}
+#endif
+
 /*
  *----------------------------------------------------------------------
  *
@@ -2031,15 +2067,11 @@ HostIF_VMLockIsHeld(VMDriver *vm) // IN
 static Bool
 isVAReadable(VA r)  // IN:
 {
-   mm_segment_t old_fs;
    uint32 dummy;
-   int ret;
+   long ret;
 
-   old_fs = get_fs();
-   set_fs(KERNEL_DS);
    r = APICR_TO_ADDR(r, APICR_VERSION);
-   ret = HostIF_CopyFromUser(&dummy, r, sizeof dummy);
-   set_fs(old_fs);
+   ret = compat_copy_from_kernel_nofault(&dummy, r, sizeof(dummy));
 
    return ret == 0;
 }
@@ -2225,48 +2257,41 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
                      uint64 *args)   // IN:
 {
    struct file *file;
-   mm_segment_t old_fs;
    int res;
    int waitFD = args[0];
    int timeoutms = args[2];
    uint64 value;
+   struct poll_wqueues table;
+   unsigned int mask;
 
    file = vmware_fget(waitFD);
    if (file == NULL) {
       return MX_WAITERROR;
    }
 
-   old_fs = get_fs();
-   set_fs(KERNEL_DS);
-
-   {
-      struct poll_wqueues table;
-      unsigned int mask;
-
-      poll_initwait(&table);
-      current->state = TASK_INTERRUPTIBLE;
-      mask = compat_vfs_poll(file, &table.pt);
-      if (!(mask & (POLLIN | POLLERR | POLLHUP))) {
-         vm->vmhost->vcpuSemaTask[vcpuid] = current;
-         schedule_timeout(timeoutms * HZ / 1000);  // convert to Hz
-         vm->vmhost->vcpuSemaTask[vcpuid] = NULL;
-      }
-      current->state = TASK_RUNNING;
-      poll_freewait(&table);
+   poll_initwait(&table);
+   current->state = TASK_INTERRUPTIBLE;
+   mask = compat_vfs_poll(file, &table.pt);
+   if (!(mask & (POLLIN | POLLERR | POLLHUP))) {
+      vm->vmhost->vcpuSemaTask[vcpuid] = current;
+      schedule_timeout(timeoutms * HZ / 1000);  // convert to Hz
+      vm->vmhost->vcpuSemaTask[vcpuid] = NULL;
    }
+   current->state = TASK_RUNNING;
+   poll_freewait(&table);
 
    /*
     * Userland only writes in multiples of sizeof(uint64). This will allow
     * the code to happily deal with a pipe or an eventfd. We only care about
     * reading no bytes (EAGAIN - non blocking fd) or sizeof(uint64).
+    *
+    * Upstream Linux changed the function parameter types/ordering in 4.14.0.
     */
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)
-   res = kernel_read(file, (char *) &value, sizeof value, &file->f_pos);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+   res = kernel_read(file, file->f_pos, (char *)&value, sizeof value);
 #else
-   res = file->f_op->read(file, (char *) &value, sizeof value, &file->f_pos);
+   res = kernel_read(file, &value, sizeof value, &file->f_pos);
 #endif
-
    if (res == sizeof value) {
       res = MX_WAITNORMAL;
    } else {
@@ -2275,7 +2300,6 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
       }
    }
 
-   set_fs(old_fs);
    fput(file);
 
    /*
@@ -2358,8 +2382,8 @@ HostIF_SemaphoreForceWakeup(VMDriver *vm,       // IN:
 int
 HostIF_SemaphoreSignal(uint64 *args)  // IN:
 {
+   struct eventfd_ctx *eventfd;
    struct file *file;
-   mm_segment_t old_fs;
    int res;
    int signalFD = args[1];
    uint64 value = 1;  // make an eventfd happy should it be there
@@ -2369,26 +2393,34 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
       return MX_WAITERROR;
    }
 
-   old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   /*
+    * If it's eventfd, use specific eventfd interface as kernel writes
+    * to eventfd may not be allowed in kernel 5.10 and later.
+    */
+   eventfd = eventfd_ctx_fileget(file);
+   if (!IS_ERR(eventfd)) {
+      eventfd_signal(eventfd, 1);
+      fput(file);
+      return MX_WAITNORMAL;
+   }
 
    /*
     * Always write sizeof(uint64) bytes. This works fine for eventfd and
     * pipes. The data written is formatted to make an eventfd happy should
     * it be present.
+    *
+    * Upstream Linux changed the function parameter types/ordering in 4.14.0.
     */
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)
-   res = kernel_write(file, (char *) &value, sizeof value, &file->f_pos);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0)
+   res = kernel_write(file, (char *)&value, sizeof value, file->f_pos);
 #else
-   res = file->f_op->write(file, (char *) &value, sizeof value, &file->f_pos);
+   res = kernel_write(file, &value, sizeof value, &file->f_pos);
 #endif
 
    if (res == sizeof value) {
       res = MX_WAITNORMAL;
    }
 
-   set_fs(old_fs);
    fput(file);
 
    /*
@@ -2907,12 +2939,9 @@ static int
 HostIFFastClockThread(void *unused)  // IN:
 {
    int res;
-   mm_segment_t oldFS;
    unsigned int rate = 0;
    unsigned int prevRate = 0;
 
-   oldFS = get_fs();
-   set_fs(KERNEL_DS);
    allow_signal(SIGKILL);
 
    while ((rate = linuxState.fastClockRate) > MIN_RATE) {
@@ -2935,8 +2964,6 @@ HostIFFastClockThread(void *unused)  // IN:
    }
 
  out:
-   set_fs(oldFS);
-
    /*
     * Do not exit thread until we are told to do so.
     */

vmnet-only/userif.c

@@ -111,6 +111,24 @@ static unsigned int compat_skb_frag_off(const skb_frag_t *frag)
 	#define write_access_ok(addr, size) access_ok(addr, size)
 #endif
 
+#if COMPAT_LINUX_VERSION_CHECK_LT(5, 10, 0)
+static inline
+__wsum compat_csum_and_copy_to_user(const void *src, void __user *dst, int len)
+{
+	int err;
+	__wsum ret;
+
+	ret = csum_and_copy_to_user(src, dst, len, 0, &err);
+	return err ? 0 : ret;
+}
+#else
+static inline
+__wsum compat_csum_and_copy_to_user(const void *src, void __user *dst, int len)
+{
+	return csum_and_copy_to_user(src, dst, len);
+}
+#endif
+
 /*
  *-----------------------------------------------------------------------------
  *
@@ -563,7 +581,6 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
 		     char *buf)			// OUT: where to copy data
 {
    unsigned int csum;
-   int err = 0;
    int len = skb_headlen(skb) - offset;
    char *curr = buf;
    const skb_frag_t *frag;
@@ -576,10 +593,9 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
       return -EINVAL;
    }
 
-   csum = csum_and_copy_to_user(skb->data + offset, curr, len, 0, &err);
-   if (err) {
-      return err;
-   }
+   csum = compat_csum_and_copy_to_user(skb->data + offset, curr, len);
+   if (!csum)
+	   return -EFAULT;
    curr += len;
 
    for (frag = skb_shinfo(skb)->frags;
@@ -590,14 +606,12 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
 	 const void *vaddr;
 
 	 vaddr = compat_kmap_frag(frag);
-	 tmpCsum = csum_and_copy_to_user(vaddr + compat_skb_frag_off(frag),
-					 curr, compat_skb_frag_size(frag), 0,
-					 &err);
+	 tmpCsum = compat_csum_and_copy_to_user(vaddr + compat_skb_frag_off(frag),
+						curr, compat_skb_frag_size(frag));
 	 compat_kunmap_frag(frag);
 
-	 if (err) {
-	    return err;
-	 }
+	 if (!tmpCsum)
+		 return -EFAULT;
 	 csum = csum_block_add(csum, tmpCsum, curr - buf);
 	 curr += compat_skb_frag_size(frag);
       }