Fix NULL pointer dereference in eventfd read call

Starting with commit 12aceb89b0bc ("eventfd: convert to f_op->read_iter()") in 5.8-rc1, the "read" function pointer in eventfd's file_operations is NULL, "read_iter" is available instead. Use kernel_read() and kernel_write() instead of directly calling the function pointers to handle this correctly. We can do that safely for kernel 4.14 and newer (older versions have different arguments of kernel_read() and kernel_write()).
Fix NX bit handling for Linux 5.8+
2020-09-19 21:58:43 +02:00 · 2020-09-19 21:58:43 +02:00 · 2020-08-20 11:17:17 +02:00 · 2020-08-20 10:20:07 +02:00 · 2020-02-24 11:06:33 +01:00 · 2020-02-24 11:06:33 +01:00
17 changed files with 194 additions and 211 deletions
@@ -150,7 +150,7 @@ test build).
 When using a downloaded tarball, simply run

  tar -cf vmmon.tar vmmon-only
-  tar -cf vmnet.tar vmmon-only
+  tar -cf vmnet.tar vmnet-only

 to create the tarballs. In this case, there is no protection against
 unwanted local changes.
@@ -107,7 +107,7 @@ prebuild:: ;
 postbuild:: ;

 $(DRIVER_KO): prebuild
-	$(MAKE) -C $(BUILD_DIR) SUBDIRS=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
+	$(MAKE) -C $(BUILD_DIR) M=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) modules
 	$(MAKE) -C $$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) postbuild
@@ -31,7 +31,7 @@ $(DRIVER)-y := $(subst $(SRCROOT)/, , $(patsubst %.c, %.o, \
 		$(SRCROOT)/bootstrap/*.c)))

 clean:
-	rm -rf $(wildcard $(DRIVER).mod.c $(DRIVER).ko .tmp_versions \
+	rm -rf $(wildcard $(DRIVER).mod.c $(DRIVER).ko .tmp_versions .cache.mk \
 		Module.symvers Modules.symvers Module.markers modules.order \
 		$(foreach dir,linux/ common/ vmcore/ bootstrap/ \
 		./,$(addprefix $(dir),.*.cmd .*.o.flags *.o)))
@@ -2203,12 +2203,23 @@ TaskSwitchToMonitor(VMCrossPage *crosspage)
   {
      uint64 raxGetsWiped, rcxGetsWiped;

+#ifdef CALL_NOSPEC
+      __asm__ __volatile__(CALL_NOSPEC
+                           : "=a" (raxGetsWiped),
+                             "=c" (rcxGetsWiped)
+                           : "0" (codePtr),
+                             "1" (crosspage),
+                             THUNK_TARGET(codePtr)
+                           : "rdx", "r8", "r9", "r10", "r11", "cc", "memory");
+#else
      __asm__ __volatile__("call *%%rax"
                           : "=a" (raxGetsWiped),
                             "=c" (rcxGetsWiped)
                           : "0" (codePtr),
                             "1" (crosspage)
                           : "rdx", "r8", "r9", "r10", "r11", "cc", "memory");
+#endif
+
   }
 #elif defined(_MSC_VER)
   /*
@@ -0,0 +1,30 @@
+#ifndef __COMPAT_POLL_H__
+#define __COMPAT_POLL_H__
+
+#include <linux/poll.h>
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 18, 0))
+
+#ifndef __poll_t
+typedef unsigned int __poll_t;
+#endif
+
+static inline __poll_t compat_vfs_poll(struct file *file,
+				       struct poll_table_struct *pt)
+{
+	if (unlikely(!file->f_op->poll))
+		return DEFAULT_POLLMASK;
+	return file->f_op->poll(file, pt);
+}
+
+#else
+
+static inline __poll_t compat_vfs_poll(struct file *file,
+				       struct poll_table_struct *pt)
+{
+	return vfs_poll(file, pt);
+}
+
+#endif
+
+#endif /* __COMPAT_POLL_H__ */
@@ -251,6 +251,7 @@ static INLINE ub8 hash2(register const ub8 *k, /* the key */
  {
    /* c is reserved for the length */
  case  2: b+=k[1];
+	   /* fall through */
  case  1: a+=k[0];
    /* case 0: nothing left to add */
  }
@@ -67,6 +67,7 @@ extern "C" {
 #if defined (VMKPANIC) 
 #include "vmk_assert.h"
 #else /* !VMKPANIC */
+#include <linux/kernel.h>
 #define _ASSERT_PANIC(name) \
           Panic(_##name##Fmt "\n", __FILE__, __LINE__)
 #define _ASSERT_PANIC_BUG(bug, name) \
@@ -107,7 +108,7 @@ NORETURN void Panic_NoSave(const char *fmt, ...) PRINTF_DECL(1, 2);
 } while(0)

 #else
-NORETURN void Panic(const char *fmt, ...) PRINTF_DECL(1, 2);
+#define Panic panic
 #endif

 void LogThrottled(uint32 *count, const char *fmt, ...) PRINTF_DECL(2, 3);
@@ -35,6 +35,8 @@
 #define INCLUDE_ALLOW_VMCORE
 #include "includeCheck.h"

+#include <asm/processor-flags.h>
+
 #define X86_MAX_INSTR_LEN  15   /* Max byte length of an x86 instruction. */

 #define NUM_IDT_VECTORS 256
@@ -75,7 +77,9 @@
 #define CR3_PDB_MASK   0xfffff000
 #define CR3_IGNORE     0xFFF
 #define PAE_CR3_IGNORE 0x1F
+#ifndef CR3_PCID_MASK
 #define CR3_PCID_MASK  0xFFF
+#endif
 #define CR3_NO_FLUSH   (1ULL << 63)

 #define CR4_VME        0x00000001
@@ -24,6 +24,7 @@

 #ifndef _X86MSR_H_
 #define _X86MSR_H_
+#include <asm/msr-index.h>
 #define INCLUDE_ALLOW_USERLEVEL
 #define INCLUDE_ALLOW_VMX

@@ -126,7 +127,9 @@ MSRQuery;
 #define MSR_SPEC_CTRL_STIBP                       (1UL << 1)
 #define MSR_PRED_CMD_IBPB                         (1UL << 0)

+#ifndef MSR_MISC_FEATURES_ENABLES
 #define MSR_MISC_FEATURES_ENABLES            0x140
+#endif

 /* Intel Core Architecture and later: use only architected counters. */
 #define IA32_MSR_PERF_CAPABILITIES                0x345
@@ -450,7 +453,9 @@ typedef enum {
 #define MSR_K7_HWCR_SSEDIS         0x00008000ULL // Disable SSE bit
 #define MSR_K7_HWCR_MONMWAITUSEREN 0x00000400ULL // Enable MONITOR/MWAIT CPL>0
 #define MSR_K7_HWCR_TLBFFDIS       0x00000040ULL // Disable TLB Flush Filter
+#ifndef MSR_K7_HWCR_SMMLOCK
 #define MSR_K7_HWCR_SMMLOCK        0x00000001ULL // Lock SMM environment
+#endif

 #ifndef MSR_K8_SYSCFG
 #define MSR_K8_SYSCFG        0xc0010010
@@ -628,7 +633,11 @@ typedef enum {
 /*
 * MISC_FEATURES_ENABLES bits
 */
+#ifdef MSR_MISC_FEATURES_ENABLES_CPUID_FAULT
+#define MSR_MISC_FEATURES_ENABLES_CPUID_FAULTING MSR_MISC_FEATURES_ENABLES_CPUID_FAULT
+#else
 #define MSR_MISC_FEATURES_ENABLES_CPUID_FAULTING 1
+#endif



@@ -73,6 +73,9 @@ static Bool LinuxDriverCheckPadding(void);

 struct VMXLinuxState linuxState;

+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 17, 0)
+typedef int vm_fault_t;
+#endif

 /*
 *----------------------------------------------------------------------
@@ -97,9 +100,9 @@ long LinuxDriver_Ioctl(struct file *filp, u_int iocmd,

 static int LinuxDriver_Close(struct inode *inode, struct file *filp);
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
-static int LinuxDriverFault(struct vm_fault *fault);
+static vm_fault_t LinuxDriverFault(struct vm_fault *fault);
 #else
-static int LinuxDriverFault(struct vm_area_struct *vma, struct vm_fault *fault);
+static vm_fault_t LinuxDriverFault(struct vm_area_struct *vma, struct vm_fault *fault);
 #endif
 static int LinuxDriverMmap(struct file *filp, struct vm_area_struct *vma);

@@ -594,7 +597,7 @@ LinuxDriver_Close(struct inode *inode, // IN
 *-----------------------------------------------------------------------------
 */

-static int
+static vm_fault_t
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
 LinuxDriverFault(struct vm_fault *fault)     //IN/OUT
 #else
@@ -981,7 +984,7 @@ LinuxDriverReadTSC(void *data,   // OUT: TSC values
 *-----------------------------------------------------------------------------
 */

-__attribute__((always_inline)) static Bool
+__always_inline static Bool
 LinuxDriverSyncReadTSCs(uint64 *delta) // OUT: TSC max - TSC min
 {
   TSCDelta tscDelta;
@@ -47,7 +47,9 @@
 #include <asm/asm.h>
 #include <asm/io.h>
 #include <asm/page.h>
+#include <asm/tlbflush.h>
 #include <asm/uaccess.h>
+#include <asm/irq_vectors.h>
 #include <linux/capability.h>
 #include <linux/kthread.h>
 #include <linux/wait.h>
@@ -74,6 +76,7 @@

 #include "pgtbl.h"
 #include "versioned_atomic.h"
+#include "compat_poll.h"

 #if !defined(CONFIG_HIGH_RES_TIMERS)
 #error CONFIG_HIGH_RES_TIMERS required for acceptable performance
@@ -115,13 +118,7 @@
 */
 #define LOCKED_PAGE_SLACK 10000

-static struct {
-   Atomic_uint64     uptimeBase;
-   VersionedAtomic   version;
-   uint64            monotimeBase;
-   unsigned long     jiffiesBase;
-   struct timer_list timer;
-} uptimeState;
+u64 uptime_base;

 /*
 * First Page Locking strategy
@@ -180,6 +177,21 @@ static struct {
 uint8 monitorIPIVector;
 uint8 hvIPIVector;

+static unsigned long compat_totalram_pages(void)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
+	return totalram_pages;
+#else
+	return totalram_pages();
+#endif
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0) && defined(VERIFY_WRITE)
+	#define write_access_ok(addr, size) access_ok(VERIFY_WRITE, addr, size)
+#else
+	#define write_access_ok(addr, size) access_ok(addr, size)
+#endif
+
 /*
 *-----------------------------------------------------------------------------
 *
@@ -613,7 +625,24 @@ HostIF_FastClockUnlock(int callerID) // IN
 static void *
 MapCrossPage(struct page *p)  // IN:
 {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
   return vmap(&p, 1, VM_MAP, VM_PAGE_KERNEL_EXEC);
+#else
+   /* Starting with 5.8, vmap() always sets the NX bit, but the cross
+    * page needs to be executable. */
+   pte_t *ptes[1];
+   struct vm_struct *area = alloc_vm_area(1UL << PAGE_SHIFT, ptes);
+   if (area == NULL)
+      return NULL;
+
+   set_pte(ptes[0], mk_pte(p, VM_PAGE_KERNEL_EXEC));
+
+   preempt_disable();
+   __flush_tlb_all();
+   preempt_enable();
+
+   return area->addr;
+#endif
 }


@@ -1494,14 +1523,7 @@ unsigned int
 HostIF_EstimateLockedPageLimit(const VMDriver* vm,                // IN
                               unsigned int currentlyLockedPages) // IN
 {
-   /*
-    * This variable is available and exported to modules,
-    * since at least 2.6.0.
-    */
-
-   extern unsigned long totalram_pages;
-
-   unsigned int totalPhysicalPages = totalram_pages;
+   unsigned int totalPhysicalPages = compat_totalram_pages();

   /*
    * Use the memory information linux exports as of late for a more
@@ -1526,8 +1548,11 @@ HostIF_EstimateLockedPageLimit(const VMDriver* vm,                // IN
 #else
   lockedPages += global_page_state(NR_PAGETABLE);
 #endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0)
+   /* NR_SLAB_* converted to byte counters in 5.9 */
+   lockedPages += global_node_page_state_pages(NR_SLAB_UNRECLAIMABLE_B);
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
   /* NR_SLAB_* moved from zone to node in 4.13. */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
   lockedPages += global_node_page_state(NR_SLAB_UNRECLAIMABLE);
 #else
   lockedPages += global_page_state(NR_SLAB_UNRECLAIMABLE);
@@ -1599,143 +1624,6 @@ HostIF_WaitForFreePages(unsigned int timeoutMs)  // IN:
 }


-/*
- *----------------------------------------------------------------------
- *
- * HostIFReadUptimeWork --
- *
- *      Reads the current uptime.  The uptime is based on getimeofday,
- *      which provides the needed high resolution.  However, we don't
- *      want uptime to be warped by e.g. calls to settimeofday.  So, we
- *      use a jiffies based monotonic clock to sanity check the uptime.
- *      If the uptime is more than one second from the monotonic time,
- *      we assume that the time of day has been set, and recalculate the
- *      uptime base to get uptime back on track with monotonic time.  On
- *      the other hand, we do expect jiffies based monotonic time and
- *      timeofday to have small drift (due to NTP rate correction, etc).
- *      We handle this by rebasing the jiffies based monotonic clock
- *      every second (see HostIFUptimeResyncMono).
- *
- * Results:
- *      The uptime, in units of UPTIME_FREQ.  Also returns the jiffies
- *      value that was used in the monotonic time calculation.
- *
- * Side effects:
- *      May reset the uptime base in the case gettimeofday warp was
- *      detected.
- *
- *----------------------------------------------------------------------
- */
-
-static uint64
-HostIFReadUptimeWork(unsigned long *j)  // OUT: current jiffies
-{
-   struct timeval tv;
-   uint64 monotime, uptime, upBase, monoBase;
-   int64 diff;
-   uint32 version;
-   unsigned long jifs, jifBase;
-   unsigned int attempts = 0;
-
- retry:
-   do {
-      version  = VersionedAtomic_BeginTryRead(&uptimeState.version);
-      jifs     = jiffies;
-      jifBase  = uptimeState.jiffiesBase;
-      monoBase = uptimeState.monotimeBase;
-   } while (!VersionedAtomic_EndTryRead(&uptimeState.version, version));
-
-   do_gettimeofday(&tv);
-   upBase = Atomic_Read64(&uptimeState.uptimeBase);
-
-   monotime = (uint64)(jifs - jifBase) * (UPTIME_FREQ / HZ);
-   monotime += monoBase;
-
-   uptime = tv.tv_usec * (UPTIME_FREQ / 1000000) + tv.tv_sec * UPTIME_FREQ;
-   uptime += upBase;
-
-   /*
-    * Use the jiffies based monotonic time to sanity check gettimeofday.
-    * If they differ by more than one second, assume the time of day has
-    * been warped, and use the jiffies time to undo (most of) the warp.
-    */
-
-   diff = uptime - monotime;
-   if (UNLIKELY(diff < -UPTIME_FREQ || diff > UPTIME_FREQ)) {
-      /* Compute a new uptimeBase to get uptime back on track. */
-      uint64 newUpBase = monotime - (uptime - upBase);
-
-      attempts++;
-      if (!Atomic_CMPXCHG64(&uptimeState.uptimeBase, upBase, newUpBase) &&
-          attempts < 5) {
-         /* Another thread updated uptimeBase.  Recalculate uptime. */
-         goto retry;
-      }
-      uptime = monotime;
-
-      Log("%s: detected settimeofday: fixed uptimeBase old %"FMT64"u "
-          "new %"FMT64"u attempts %u\n", __func__,
-          upBase, newUpBase, attempts);
-   }
-   *j = jifs;
-
-   return uptime;
-}
-
-
-/*
- *----------------------------------------------------------------------
- *
- * HostIFUptimeResyncMono --
- *
- *      Timer that fires ever second to resynchronize the jiffies based
- *      monotonic time with the uptime.
- *
- * Results:
- *      None
- *
- * Side effects:
- *      Resets the monotonic time bases so that jiffies based monotonic
- *      time does not drift from gettimeofday over the long term.
- *
- *----------------------------------------------------------------------
- */
-
-static void
-HostIFUptimeResyncMono(struct timer_list *timer)  // IN: ignored
-{
-   unsigned long jifs;
-   uintptr_t flags;
-
-   /*
-    * Read the uptime and the corresponding jiffies value.  This will
-    * also correct the uptime (which is based on time of day) if needed
-    * before we rebase monotonic time (which is based on jiffies).
-    */
-
-   uint64 uptime = HostIFReadUptimeWork(&jifs);
-
-   /*
-    * Every second, recalculate monoBase and jiffiesBase to squash small
-    * drift between gettimeofday and jiffies.  Also, this prevents
-    * (jiffies - jiffiesBase) wrap on 32-bits.
-    */
-
-   SAVE_FLAGS(flags);
-   CLEAR_INTERRUPTS();
-   VersionedAtomic_BeginWrite(&uptimeState.version);
-
-   uptimeState.monotimeBase = uptime;
-   uptimeState.jiffiesBase  = jifs;
-
-   VersionedAtomic_EndWrite(&uptimeState.version);
-   RESTORE_FLAGS(flags);
-
-   /* Reschedule this timer to expire in one second. */
-   mod_timer(&uptimeState.timer, jifs + HZ);
-}
-
-
 /*
 *----------------------------------------------------------------------
 *
@@ -1747,8 +1635,7 @@ HostIFUptimeResyncMono(struct timer_list *timer)  // IN: ignored
 *      None
 *
 * Side effects:
- *      Sets the initial values for the uptime state, and schedules
- *      the uptime timer.
+ *      Sets the initial value for the uptime base.
 *
 *----------------------------------------------------------------------
 */
@@ -1756,22 +1643,7 @@ HostIFUptimeResyncMono(struct timer_list *timer)  // IN: ignored
 void
 HostIF_InitUptime(void)
 {
-   struct timeval tv;
-
-   uptimeState.jiffiesBase = jiffies;
-   do_gettimeofday(&tv);
-   Atomic_Write64(&uptimeState.uptimeBase,
-                  -(tv.tv_usec * (UPTIME_FREQ / 1000000) +
-                    tv.tv_sec * UPTIME_FREQ));
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0) && !defined(timer_setup)
-   init_timer(&uptimeState.timer);
-   uptimeState.timer.function = (void *)HostIFUptimeResyncMono;
-   uptimeState.timer.data = (unsigned long)&uptimeState.timer;
-#else
-   timer_setup(&uptimeState.timer, HostIFUptimeResyncMono, 0);
-#endif
-   mod_timer(&uptimeState.timer, jiffies + HZ);
+   uptime_base = ktime_get_ns();
 }


@@ -1780,13 +1652,13 @@ HostIF_InitUptime(void)
 *
 * HostIF_CleanupUptime --
 *
- *      Cleanup uptime state, called at module unloading time.
+ *      No-op, left for backward compatibility.
 *
 * Results:
 *      None
 *
 * Side effects:
- *      Deschedule the uptime timer.
+ *      None
 *
 *----------------------------------------------------------------------
 */
@@ -1794,7 +1666,6 @@ HostIF_InitUptime(void)
 void
 HostIF_CleanupUptime(void)
 {
-   del_timer_sync(&uptimeState.timer);
 }


@@ -1818,9 +1689,10 @@ HostIF_CleanupUptime(void)
 uint64
 HostIF_ReadUptime(void)
 {
-   unsigned long jifs;
+   u64 tm;

-   return HostIFReadUptimeWork(&jifs);
+   tm = ktime_get_ns();
+   return (tm - uptime_base) / (NSEC_PER_SEC / UPTIME_FREQ);
 }


@@ -2164,7 +2036,7 @@ isVAReadable(VA r)  // IN:
   int ret;

   old_fs = get_fs();
-   set_fs(get_ds());
+   set_fs(KERNEL_DS);
   r = APICR_TO_ADDR(r, APICR_VERSION);
   ret = HostIF_CopyFromUser(&dummy, r, sizeof dummy);
   set_fs(old_fs);
@@ -2197,7 +2069,7 @@ SetVMAPICAddr(VMDriver *vm, // IN/OUT: driver state
   volatile void *hostapic;

   ASSERT_ON_COMPILE(APICR_SIZE <= PAGE_SIZE);
-   hostapic = (volatile void *) ioremap_nocache(ma, PAGE_SIZE);
+   hostapic = (volatile void *) ioremap(ma, PAGE_SIZE);
   if (hostapic) {
      if ((APIC_VERSIONREG(hostapic) & 0xF0) == 0x10) {
         vm->hostAPIC.base = (volatile uint32 (*)[4]) hostapic;
@@ -2365,7 +2237,7 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
   }

   old_fs = get_fs();
-   set_fs(get_ds());
+   set_fs(KERNEL_DS);

   {
      struct poll_wqueues table;
@@ -2373,7 +2245,7 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:

      poll_initwait(&table);
      current->state = TASK_INTERRUPTIBLE;
-      mask = file->f_op->poll(file, &table.pt);
+      mask = compat_vfs_poll(file, &table.pt);
      if (!(mask & (POLLIN | POLLERR | POLLHUP))) {
         vm->vmhost->vcpuSemaTask[vcpuid] = current;
         schedule_timeout(timeoutms * HZ / 1000);  // convert to Hz
@@ -2389,7 +2261,11 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
    * reading no bytes (EAGAIN - non blocking fd) or sizeof(uint64).
    */

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)
+   res = kernel_read(file, (char *) &value, sizeof value, &file->f_pos);
+#else
   res = file->f_op->read(file, (char *) &value, sizeof value, &file->f_pos);
+#endif

   if (res == sizeof value) {
      res = MX_WAITNORMAL;
@@ -2494,7 +2370,7 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
   }

   old_fs = get_fs();
-   set_fs(get_ds());
+   set_fs(KERNEL_DS);

   /*
    * Always write sizeof(uint64) bytes. This works fine for eventfd and
@@ -2502,7 +2378,11 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
    * it be present.
    */

+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)
+   res = kernel_write(file, (char *) &value, sizeof value, &file->f_pos);
+#else
   res = file->f_op->write(file, (char *) &value, sizeof value, &file->f_pos);
+#endif

   if (res == sizeof value) {
      res = MX_WAITNORMAL;
@@ -3154,7 +3034,7 @@ HostIF_SetFastClockRate(unsigned int rate) // IN: Frequency in Hz.
      }
   } else {
      if (linuxState.fastClockThread) {
-         force_sig(SIGKILL, linuxState.fastClockThread);
+         send_sig(SIGKILL, linuxState.fastClockThread, 1);
         kthread_stop(linuxState.fastClockThread);

         linuxState.fastClockThread = NULL;
@@ -3200,7 +3080,7 @@ HostIF_MapUserMem(VA addr,                  // IN: User memory virtual address

   ASSERT(handle);

-   if (!access_ok(VERIFY_WRITE, p, size)) {
+   if (!write_access_ok(p, size)) {
      printk(KERN_ERR "%s: Couldn't verify write to uva 0x%p with size %"
             FMTSZ"u\n", __func__, p, size);

@@ -107,7 +107,7 @@ prebuild:: ;
 postbuild:: ;

 $(DRIVER_KO): prebuild
-	$(MAKE) -C $(BUILD_DIR) SUBDIRS=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
+	$(MAKE) -C $(BUILD_DIR) M=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) modules
 	$(MAKE) -C $$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) postbuild
@@ -32,6 +32,6 @@ $(DRIVER)-y := driver.o hub.o userif.o netif.o bridge.o procfs.o smac_compat.o \
 ####

 clean:
-	rm -rf $(DRIVER).o $(DRIVER).mod.o $(DRIVER).mod.c $(DRIVER).ko \
+	rm -rf $(DRIVER).o $(DRIVER).mod.o $(DRIVER).mod.c $(DRIVER).ko .cache.mk \
 	       .tmp_versions Module.symvers Modules.symvers Module.markers \
 	       modules.order $($(DRIVER)-y) .*.cmd .*.o.flags
@@ -66,7 +66,7 @@
 #endif

 #if LOGLEVEL >= 4
-static struct timeval vnetTime;
+static u64 vnetTime;
 #endif

 typedef struct VNetBridge VNetBridge;
@@ -693,7 +693,7 @@ VNetBridgeReceiveFromVNet(VNetJack        *this, // IN: jack

 	 netif_rx_ni(clone);
 #	 if LOGLEVEL >= 4
-	 do_gettimeofday(&vnetTime);
+	 vnetTime = ktime_get_ns();
 #	 endif
      }
   }
@@ -1490,12 +1490,11 @@ VNetBridgeReceiveFromDev(struct sk_buff *skb,         // IN: packet to receive

 #  if LOGLEVEL >= 4
   {
-      struct timeval now;
-      do_gettimeofday(&now);
+      u64 now;
+
+      now = ktime_get_ns();
      LOG(3, (KERN_DEBUG "bridge-%s: time %d\n",
-	      bridge->name,
-	      (int)((now.tv_sec * 1000000 + now.tv_usec)
-                    - (vnetTime.tv_sec * 1000000 + vnetTime.tv_usec))));
+	      bridge->name, (int)((now - vnetTime) / NSEC_PER_USEC)));
   }
 #  endif

@@ -161,6 +161,14 @@ VNetProcOpen(struct inode *inode,   // IN:
 }

 /* Our procfs callbacks.  We only need to specialize open. */
+#ifdef DEFINE_PROC_SHOW_ATTRIBUTE
+static const struct proc_ops fops = {
+   .proc_open    = VNetProcOpen,
+   .proc_read    = seq_read,
+   .proc_lseek   = seq_lseek,
+   .proc_release = single_release,
+};
+#else
 static struct file_operations fops = {
   .open    = VNetProcOpen,
   .read    = seq_read,
@@ -168,6 +176,7 @@ static struct file_operations fops = {
   .release = single_release,
 };
 #endif
+#endif


 /*
@@ -78,11 +78,37 @@ static int  VNetUserIfSetUplinkState(VNetPort *port, uint8 linkUp);
 extern unsigned int  vnet_max_qlen;

 #if COMPAT_LINUX_VERSION_CHECK_LT(3, 2, 0)
-#   define compat_kmap(page) kmap(page)
-#   define compat_kunmap(page) kunmap(page)
+#   define compat_kmap_frag(frag) kmap((frag)->page)
+#   define compat_kunmap_frag(page) kunmap((frag)->page)
 #else
-#   define compat_kmap(page) kmap((page).p)
-#   define compat_kunmap(page) kunmap((page).p)
+#   define compat_kmap_frag(frag) kmap(skb_frag_page(frag))
+#   define compat_kunmap_frag(frag) kunmap(skb_frag_page(frag))
+#endif
+
+static unsigned int compat_skb_frag_size(const skb_frag_t *frag)
+{
+#if COMPAT_LINUX_VERSION_CHECK_LT(3, 2, 0)
+	return frag->size;
+#else
+	return skb_frag_size(frag);
+#endif
+}
+
+static unsigned int compat_skb_frag_off(const skb_frag_t *frag)
+{
+#if COMPAT_LINUX_VERSION_CHECK_LT(5, 4, 0) && \
+	!(defined(CONFIG_SUSE_VERSION) && CONFIG_SUSE_VERSION == 15 && \
+	  defined(CONFIG_SUSE_PATCHLEVEL) && CONFIG_SUSE_PATCHLEVEL >= 2)
+	return frag->page_offset;
+#else
+	return skb_frag_off(frag);
+#endif
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0) && defined(VERIFY_WRITE)
+	#define write_access_ok(addr, size) access_ok(VERIFY_WRITE, addr, size)
+#else
+	#define write_access_ok(addr, size) access_ok(addr, size)
 #endif

 /*
@@ -142,7 +168,7 @@ VNetUserIfMapPtr(VA uAddr,        // IN: pointer to user memory
                 struct page **p, // OUT: locked page
                 void **ptr)      // OUT: kernel mapped pointer
 {
-   if (!access_ok(VERIFY_WRITE, (void *)uAddr, size) ||
+   if (!write_access_ok((void *)uAddr, size) ||
       (((uAddr + size - 1) & ~(PAGE_SIZE - 1)) !=
        (uAddr & ~(PAGE_SIZE - 1)))) {
      return -EINVAL;
@@ -559,20 +585,21 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
   for (frag = skb_shinfo(skb)->frags;
 	frag != skb_shinfo(skb)->frags + skb_shinfo(skb)->nr_frags;
 	frag++) {
-      if (frag->size > 0) {
+      if (compat_skb_frag_size(frag) > 0) {
 	 unsigned int tmpCsum;
 	 const void *vaddr;

-	 vaddr = compat_kmap(frag->page);
-	 tmpCsum = csum_and_copy_to_user(vaddr + frag->page_offset,
-					 curr, frag->size, 0, &err);
-	 compat_kunmap(frag->page);
+	 vaddr = compat_kmap_frag(frag);
+	 tmpCsum = csum_and_copy_to_user(vaddr + compat_skb_frag_off(frag),
+					 curr, compat_skb_frag_size(frag), 0,
+					 &err);
+	 compat_kunmap_frag(frag);

 	 if (err) {
 	    return err;
 	 }
 	 csum = csum_block_add(csum, tmpCsum, curr - buf);
-	 curr += frag->size;
+	 curr += compat_skb_frag_size(frag);
      }
   }

@@ -35,6 +35,8 @@
 #endif
 #endif

+#include <linux/pci_ids.h>
+
 /* LSILogic 53C1030 Parallel SCSI controller
 * LSILogic SAS1068 SAS controller
 */
@@ -53,7 +55,10 @@
 *    VMware HD Audio codec
 *    VMware HD Audio controller
 */
+#ifndef PCI_VENDOR_ID_VMWARE
 #define PCI_VENDOR_ID_VMWARE                    0x15AD
+#endif
+
 #define PCI_DEVICE_ID_VMWARE_SVGA2              0x0405
 #define PCI_DEVICE_ID_VMWARE_SVGA               0x0710
 #define PCI_DEVICE_ID_VMWARE_VGA                0x0711
@@ -70,7 +75,11 @@
 #define PCI_DEVICE_ID_VMWARE_1394               0x0780
 #define PCI_DEVICE_ID_VMWARE_BRIDGE             0x0790
 #define PCI_DEVICE_ID_VMWARE_ROOTPORT           0x07A0
+
+#ifndef PCI_DEVICE_ID_VMWARE_VMXNET3
 #define PCI_DEVICE_ID_VMWARE_VMXNET3            0x07B0
+#endif
+
 #define PCI_DEVICE_ID_VMWARE_PVSCSI             0x07C0
 #define PCI_DEVICE_ID_VMWARE_82574              0x07D0
 #define PCI_DEVICE_ID_VMWARE_AHCI               0x07E0
Author	SHA1	Message	Date
Jan Andres	9cbb077f8d	Fix NULL pointer dereference in eventfd read call Starting with commit 12aceb89b0bc ("eventfd: convert to f_op->read_iter()") in 5.8-rc1, the "read" function pointer in eventfd's file_operations is NULL, "read_iter" is available instead. Use kernel_read() and kernel_write() instead of directly calling the function pointers to handle this correctly. We can do that safely for kernel 4.14 and newer (older versions have different arguments of kernel_read() and kernel_write()).	2020-09-19 21:58:43 +02:00
Jan Andres	4e40ef62ee	Fix NX bit handling for Linux 5.8+ Do not use vmap() to map the cross page, it needs to be executable and vmap() unconditionally sets the NX bit starting with commit cca98e9f8b5e ("mm: enforce that vmap can't map pages executable") in 5.8-rc1. Emulate previous behavior of vmap() by using alloc_vm_area() and explicitly setting the PTE.	2020-09-19 21:58:43 +02:00
Michal Kubecek	11bf1a7d96	vmmon: include <asm/irq_vectors.h> explicitly After mainline commit 13c01139b171 ("x86/headers: Remove APIC headers from <asm/smp.h>") in 5.9-rc1, APIC headers are no longer included via <asm/smp.h> so that linux/hostif.c will lack the definition of SPURIOUS_APIC_VECTOR. Include <asm/irq_vectors.h> in linux/hostif.c explicitly to avoid that.	2020-08-20 11:17:17 +02:00
Michal Kubecek	f3b55e5bca	vmmon: handle change of vmstat slab counters to bytes Mainline commit d42f3245c7e2 ("mm: memcg: convert vmstat slab counters to bytes") in kernel 5.9-rc1 changed vmstat accounting of slab to byte counters. Unfortunately there doesn't seem to be any obvious way to check for this change except version check.	2020-08-20 10:20:07 +02:00
Michal Kubecek	ba25bac1e0	vmmon: clean up the uptime handling The do_gettimeofday() helper was removed by commit e4b92b108c6c ("timekeeping: remove obsolete time accessors") in v5.0-rc1 and commit c766d1472c70 ("y2038: hide timeval/timespec/itimerval/itimerspec types") in v5.6-rc3 hides struct timeval from kernel code. Rather than copying what newer 15.5.x versions do, clean up the whole mess of simultaneous crosschecking between jiffies and wall time. Apparently this was introduced once to work around the absence of a high resolution monotonic timer. As kernel provides one at least since version 2.6.17 and 64-bit interface for it since 3.17 and VMware is unlikely to ever release any update for Workstation/Player 14.1.x or 12.5.x anyway, let's just drop all of it and use ktime_get_ns() instead.	2020-02-24 11:06:33 +01:00
Michal Kubecek	0ff0d40dda	vmnet: convert VNetBridge debugging code to ktime_get_ns() The do_gettimeofday() helper was removed by commit e4b92b108c6c ("timekeeping: remove obsolete time accessors") in v5.0-rc1 and commit c766d1472c70 ("y2038: hide timeval/timespec/itimerval/itimerspec types") in v5.6-rc3 hides struct timeval from kernel code. Convert the do_gettimeofday() relics in VNetBridge (which are only compiled with LOGLEVEL >= 4) completely to ktime based interface.	2020-02-24 11:06:33 +01:00
Michal Kubecek	8f3d9f4bb5	vmnet: convert from file_operations to proc_ops Manline commit 97a32539b956 ("proc: convert everything to "struct proc_ops"") in v5.6-rc1 introduces struct proc_ops and converts procfs file operations to it. Convert vmnet to do the same. As the same commit also introduces DEFINE_PROC_SHOW_ATTRIBUTE macro, we can use it for detection rather than rely on version comparison.	2020-02-10 07:11:26 +01:00
Michal Kubecek	56b7374fc4	vmmon: replace ioremap_nocache() with ioremap() Mainline commit 4bdc0d676a64 ("remove ioremap_nocache and devm_ioremap_nocache") in v5.6-rc1 removes ioremap_nocache() and replaces all uses with ioremap(). As the commit message says that "ioremap has provided non-cached semantics by default since the Linux 2.6", do the same unconditionally.	2020-02-10 07:11:26 +01:00
Michal Kubecek	6af901cc45	vmnet: work around skb_frag_t build failure for SLE15-SP2 and openSUSE-15.2 The kernels used in (upcoming) SLE15 SP2 and openSUSE Leap 15.2 are based on upstream version 5.3 but have a backport of the skb_frag_t conversion to bio_vec which reached mainline in v5.4-rc1. As we cannot easily check availability compat_skb_frag_off() (which was also added in v5.4-rc1) and have to resort to version check, add an exception for SLE15-SP2 and openSUSE-15.2 kernels.	2019-11-25 08:25:32 +01:00
Michal Kubecek	4b6eb20f62	vmnet: handle switch of skb_frag_t to bio_vec The switch from custom skb_frag_t implementation to bio_vec in v5.4-rc1 is mostly transparent for modules which use accessor for skb_frag_t members. Unfortunately many users access the members directly and function VNetCsumCopyDatagram() in vmnet is one of those. Use accessors everywhere so that vmnet code is compatible with kernel 5.4 and newer. Use "compat_" prefix to avoid clashes with backports adding the accessors to older codebase.	2019-09-30 21:33:56 +02:00
Michal Kubecek	d184686860	Merge branch 'master' into player-14.1.7	2019-09-09 08:41:52 +02:00
Michal Kubecek	85ede6aae9	misc: fix wrong directory name in INSTALL (fixes #36 ) Fix wrong directory name in one of the examples.	2019-09-09 08:38:27 +02:00
Michal Kubecek	26fb3d29e0	vmmon: mark expected switch fall through Since v5.3-rc2, kernel is built with -Wimplicit-fallthrough by default so that compiler warns about switch fall thgrough unless it is marked as expected. Add comment to mark one existing fall through as expected. Note: this function is no longer present in 15.1.0 and it is probably dead code anyway as hash2() is only called from HashFunc_HashPage() which does not seem to be called anywhere. But to keep the code as close to upstream as reasonably possible, just mark the fall through and keep both functions in place.	2019-07-31 13:58:13 +02:00
Michal Kubecek	4f88bce684	vmmon: fix HostIF_SetFastClockRate() not to use force_sig() Commit 3cf5d076fb4d ("signal: Remove task parameter from force_sig") in v5.3-rc1 drops second argument of force_sig(); before that, all callers which passed something else than current task as second argument were fixed, mostly to use send_sig() instead. The situation in HostIF_SetFastClockRate() is the same as e.g. in bpfilter call fixed by commit 1dfd1711de29 ("signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig"): locking in force_sig_info() cannot handle task exiting and using force_sig() for SIGKILL is pointless anyway as this signal cannot be blocked. As send_sig() is present with unchanged signature since the pre-git era, we can use send_sig() unconditionally, regardless of kernel version.	2019-07-22 06:57:08 +02:00
Michal Kubecek	be81b2f770	vmmon: fix return type of vm_operations_struct::fault handler Commit 3d3539018d2c ("mm: create the new vm_fault_t type") in mainline 5.1-rc1 changed the definition of vm_fault_t type to unsigned to catch vm_operations_struct::fault handlers which still have int as return value. LinuxDriverFault() in vmmon module is one of those. As handler return type was changed by commit 1c8f422059ae ("mm: change return type to vm_fault_t") in 4.17-rc1, make LinuxDriverFault() always return vm_fault_t and define vm_fault_t as int when building against a pre-4.17 kernel.	2019-03-17 21:29:57 +01:00
Michal Kubecek	d9bb126f7d	vmmon: use KERNEL_DS rather than get_ds() Commit 736706bee329 ("get rid of legacy 'get_ds()' function") in v5.1-rc1 removed get_ds() helper. As this helper always returned KERNEL_DS on x86_64 since the architecture was introduced (and even on i386, it did so since v2.1.0), simply use KERNEL_DS regardless of kernel version.	2019-03-17 21:29:57 +01:00
Michal Kubecek	d09d2d0188	modules: handle access_ok() with two arguments Since commit 96d4f267e40f ("Remove 'type' argument from access_ok() function") in v5.0-rc1, the type argument of access_ok() was dropped. The same commit also dropped macros VERIFY_READ and VERIFY_WRITE so check for their existence on pre-5.0 kernels to allow build against kernels with this change backported.	2019-01-07 13:38:55 +01:00
Michal Kubecek	8b1156629b	vmmon: bring back the do_gettimeofday() helper The do_gettimeofday() helper was removed by commit e4b92b108c6c ("timekeeping: remove obsolete time accessors") in v5.0-rc1. Bring it back for users in vmmon-only/linux/hostif.c. This feels like a quick and clumsy band aid to allow build with post-4.20 kernels. On a closer look, the whole gymnastics around uptimeState and HostIFReadUptimeWork() with jiffies and wall time checking and correcting each other seems to be a workaround for an absence of high resolution monotonic time. Considering ktime_get_ts64() is available since 3.17 and before that, ktime_get_ts() since 2.6.17, perhaps the time has come to clean all this machinery up. But something like this would be beyond the scope of this repository.	2019-01-07 13:38:55 +01:00
Michal Kubecek	46911bde4f	vmmon: totalram_pages is a function since 5.0 Since commit ca79b0c211af ("mm: convert totalram_pages and totalhigh_pages variables to atomic") in v5.0-rc1, totalram_pages() is an accessor function and the actual variable is an atomic.	2019-01-07 13:38:55 +01:00
Michal Kubecek	ee5d329441	modules: replace SUBDIRS with M Since commit 0126be38d988 ("kbuild: announce removal of SUBDIRS if used") in v5.0-rc1, using SUBDIRS when building out of tree modules produces a deprecation warning. As M used to work since pretty much ever, use it unconditionally.	2019-01-07 13:38:55 +01:00
Michal Kubecek	fac2c93374	vmmon: check presence of file_operations::poll() Commit 11c5ad0ec441 ("eventpoll: switch to ->poll_mask") in v4.18-rc1, made eventpoll switch from ->poll() to ->poll_mask(), resulting in a null pointer dereference as vmmon calls the callback directly without checking its availability. Rather than calling the callback directly (which would result in null pointer dereference), use vfs_poll() wrapper. As this wrapper is only available since 4.18-rc1 cycle as well, provide a copy to use when building against older kernels. Note: even if the commit revealing the problem was reverted in 4.18-rc3 (and is unlikely to go back in the same form) so that vmmon no longer crashes with 4.18 kernel, calling the callback without a check is a bad practice so let's keep the patch in place.	2018-08-20 07:46:13 +02:00
Michal Kubecek	e6804c4f5b	vmmon: fix indirect call with retpoline build Build against kernel with retpoline support issues warning objtool: Task_Switch()+0x425: indirect call found in RETPOLINE build This is because an indirect call in TaskSwitchToMonitor() is encoded using inline assembler so that it bypasses retpoline generation. For this purpose, macro CALL_NOSPEC exists since v4.15-rc8 (and has been backported into some distribution kernels with the rest of retpoline support). Use the macro if available and fallback to the original code if not.	2018-08-20 07:37:40 +02:00
Michal Kubecek	d620eaf4e4	vmmon: fix always_inline attribute usage Function declared with __attribute__((always_inline)) should also be declared as inline, otherwise gcc issues a warning "always_inline function might not be inlinable". It's just cosmetic but getting rid of known harmless warnings makes it easier to spot actual problems. Use the __always_inline macro for LinuxDriverSyncReadTSCs() as this is how always inline functions should be declared in kernel code.	2018-08-20 07:37:33 +02:00
Michal Kubecek	173a605d6f	vmmon: use standard definition of MSR_K7_HWCR_SMMLOCK if available The MSR_K7_HWCR_SMMLOCK macro is defined in mainline since commit 18c71ce9c882 ("x86/CPU/AMD: Add the Secure Encrypted Virtualization CPU feature") in v4.16-rc1.	2018-08-20 07:37:29 +02:00
Theo Bertacchini	6747202f86	modules: remove .cache.mk on make clean Remove .cache.mk inside vmmon-only and vmnet-only when executing "make clean". This file can cause issues when upgrading gcc as make will still look for includes inside older gcc includes directory. File .cache.mk with cache of generated variables is created by build since kernel v4.15-rc1, commit 3298b690b21c ("kbuild: Add a cache for generated variables").	2018-08-20 07:36:26 +02:00
Michal Kubecek	b73189148b	vmmon: quick workaround for objtool warnings As discussed in https://bugzilla.suse.com/show_bug.cgi?id=1059674 the reason for multiple objtool warnings is the fact that vmmon module defines its own Panic() function which never returns. While it is marked as such which is used by the compiler for optimization, there is no way to find this from object file. While this seems innocuous, it might result in problems with unwinder later. The quickest way around is to replace vmmon's own Panic() with standard kernel panic() until a cleaner solution is found.	2018-08-20 07:34:04 +02:00
Michal Kubecek	5c38f36d20	vmmon: use standard definition of CR3_PCID_MASK if available The CR3_PCID_MASK is defined in mainline asm/processor-flags.h since commit 6c690ee1039b ("x86/mm: Split read_cr3() into read_cr3_pa() and __read_cr3()") in v4.13-rc1.	2018-08-20 07:33:44 +02:00
Michal Kubecek	6a61649088	vmmon: use standard definition of MSR_MISC_FEATURES_ENABLES if available The MSR_MISC_FEATURES_ENABLES macro is defined in mainline since commit ab6d9468631a ("x86/msr: Rename MISC_FEATURE_ENABLES to MISC_FEATURES_ENABLES") in v4.12-rc1. The MSR_MISC_FEATURES_ENABLES_CPUID_FAULT macro is defined in mainline since commit e9ea1e7f53b8 ("x86/arch_prctl: Add ARCH_[GET\|SET]_CPUID") in v4.12-rc1.	2018-08-20 07:33:31 +02:00
Michal Kubecek	9cf4254e55	vmnet: use standard definition of PCI_VENDOR_ID_VMWARE_VMXNET3 if available The PCI_DEVICE_ID_VMWARE_VMXNET3 macro is defined in mainline pci_ids.h since commit b1226c7db1d9 ("vmxnet3: Move PCI Id to pci_ids.h") in v4.10-rc1.	2018-08-20 07:33:11 +02:00
Michal Kubecek	5435177e9c	vmnet: use standard definition of PCI_VENDOR_ID_VMWARE if available The PCI_VENDOR_ID_VMWARE macro is defined in mainline pci_ids.h since commit 94e57fea6202 ("PCI: Move PCI_VENDOR_ID_VMWARE to pci_ids.h") in v3.18-rc1.	2018-08-20 07:32:34 +02:00