mark branch player-15.0.1 as retired

Commit 11c5ad0ec441 ("eventpoll: switch to ->poll_mask") in v4.18-rc1, made
eventpoll switch from ->poll() to ->poll_mask(), resulting in a null
pointer dereference as vmmon calls the callback directly without checking
its availability.

Rather than calling the callback directly (which would result in null
pointer dereference), use vfs_poll() wrapper. As this wrapper is only
available since 4.18-rc1 cycle as well, provide a copy to use when building
against older kernels.

Note: even if the commit revealing the problem was reverted in 4.18-rc3
(and is unlikely to go back in the same form) so that vmmon no longer
crashes with 4.18 kernel, calling the callback without a check is a bad
practice so let's keep the patch in place.

INSTALL

@@ -150,7 +150,7 @@ test build).
 When using a downloaded tarball, simply run
 
   tar -cf vmmon.tar vmmon-only
-  tar -cf vmnet.tar vmnet-only
+  tar -cf vmnet.tar vmmon-only
 
 to create the tarballs. In this case, there is no protection against
 unwanted local changes.

RETIRED

@@ -1,7 +1,7 @@
 *-----------------------------------------------------------------------------
-* Branch workstation-15.1.0 has been retired on 2020-02-10 and has not been
-* receiving any updates since. Please switch to latest 15.1.x version
+* Branch player-15.0.1 has been retired on 2018-12-26 and has not been
+* receiving any updates since. Please switch to latest 15.0.x version
 * available.
 *
-* Latest kernel version this branch is intended to work with is 5.5.
+* Latest kernel version this branch is intended to work with is 4.20.
 *-----------------------------------------------------------------------------

vmmon-only/Makefile

@@ -107,7 +107,7 @@ prebuild:: ;
 postbuild:: ;
 
 $(DRIVER_KO): prebuild
-	$(MAKE) -C $(BUILD_DIR) M=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
+	$(MAKE) -C $(BUILD_DIR) SUBDIRS=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) modules
 	$(MAKE) -C $$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) postbuild

vmmon-only/common/phystrack.c

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998,2014,2019 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998,2014 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -24,8 +24,9 @@
  *    Depending on configuration phystracker provides either 2-level or
  *    3-level structure to track whether page (specified by its MPN) is
  *    locked or no.  Linux uses 3-level structures with top limit of
- *    1TB (32bit) or 16TB (64bit).  Windows and Mac use 2-level structures
- *    ready to hold 128GB (32bit) or 2TB (64bit) of memory.
+ *    1TB (32bit) or 16TB (64bit).  Windows use 2-level structures
+ *    ready to hold 128GB (32bit) or 2TB (64bit) of memory.  On Mac
+ *    limit is 2-level 128GB.
  *
  *    2-level phystracker is built on top of 3-level one by collapsing
  *    middle level.
@@ -49,7 +50,9 @@
 #define BYTES_PER_ENTRY      (PAGE_SIZE)
 #define PHYSTRACK_L3_ENTRIES (8 * BYTES_PER_ENTRY) /* 128MB */
 
-#if defined(__linux__)
+#if defined(WINNT_DDK)
+#define PHYSTRACK_L1_ENTRIES (PHYSTRACK_MAX_SUPPORTED_GB * 8)
+#elif defined(__linux__)
 #define PHYSTRACK_L2_ENTRIES (BYTES_PER_ENTRY / sizeof(void *)) /* 64GB or 128GB */
 /*
  * Currently MPN is 32 bits.  15 bits are in L3, 9 bits are in L2,
@@ -57,7 +60,7 @@
  */
 #define PHYSTRACK_L1_ENTRIES (256) /* 16TB. */
 #else
-#define PHYSTRACK_L1_ENTRIES (PHYSTRACK_MAX_SUPPORTED_GB * 8)
+#define PHYSTRACK_L1_ENTRIES ((128 + 4) * 8) /* 128 GB */
 #endif
 
 #ifndef PHYSTRACK_L2_ENTRIES

vmmon-only/common/phystrack.h

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998,2019 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -29,7 +29,7 @@
 #define INCLUDE_ALLOW_VMCORE
 #include "includeCheck.h"
 
-#if !defined (__linux__)
+#if defined(WINNT_DDK)
 /* XXX: can be more efficient based on server vs. desktop and version of Windows */
 #define PHYSTRACK_MAX_SUPPORTED_GB (2048 + 4) /* 2 TB 64-bit W2k8 + 4 GB PCI */
 #endif

vmmon-only/common/task.c

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998-2019 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998-2018 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -2920,18 +2920,6 @@ Task_Switch(VMDriver *vm,  // IN
    }
 
    if (crosspage->crosspageData.moduleCallType == MODULECALL_INTR) {
-
-      /*
-       * Newer versions of Window expect EFLAGS_AC to be set when handling an
-       * interupt - PR  2248661.
-       */
-      if ((flags & EFLAGS_AC) != 0) {
-         uintptr_t   curFlags;
-         SAVE_FLAGS(curFlags);
-         curFlags |= EFLAGS_AC;
-         RESTORE_FLAGS(curFlags);
-      }
-
       /*
        * Note we must do the RAISE_INTERRUPT before ever enabling
        * interrupts or bad things have happened (might want to know exactly

vmmon-only/include/iocontrols.h

@@ -144,7 +144,7 @@ PtrToVA64(void const *ptr) // IN
  * See bora/doc/vmcore details.
  */
 
-#define VMMON_VERSION           (361 << 16 | 0)
+#define VMMON_VERSION           (360 << 16 | 0)
 #define VMMON_VERSION_MAJOR(v)  ((uint32) (v) >> 16)
 #define VMMON_VERSION_MINOR(v)  ((uint16) (v))
 
@@ -276,7 +276,6 @@ enum IOCTLCmd {
 #endif
 
 #if defined __APPLE__
-   IOCTLCMD(GET_NUM_RESPONDING_CPUS),
    IOCTLCMD(ALLOC_LOW_PAGES),
    IOCTLCMD(INIT_DRIVER),
    IOCTLCMD(BLUEPILL),

vmmon-only/include/x86cpuid.h

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998-2019 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998-2018 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -465,9 +465,6 @@ FLAG(   6,  0, ECX,  3,  1, ENERGY_PERF_BIAS,                  NO,   0, FALSE)
 #define CPUID_7_EDX_28 \
 FLAG(   7,  0, EDX, 28,  1, LEVEL7EDX_RSVD1,                    NO,  0, FALSE)
 
-/*    LEVEL, SUB-LEVEL, REG, POS, SIZE, NAME,             MON SUPP, HWV, CPL3 */
-#define CPUID_7_EDX_10 \
-FLAG(   7,  0, EDX, 10,  1, LEAF7_RSVD,                         NO,  0, FALSE)
 #define CPUID_7_EDX_31 \
 FLAG(   7,  0, EDX, 31,  1, LEVEL7EDX_RSVD2,                    NO,  0, FALSE)
 
@@ -522,7 +519,6 @@ FLAG(   7,  0, ECX, 22,  1, RDPID,                             NO,   0, TRUE)  \
 FLAG(   7,  0, ECX, 30,  1, SGX_LC,                            YES, 17, FALSE) \
 FLAG(   7,  0, EDX,  2,  1, AVX512QVNNIW,                      YES, 16, TRUE)  \
 FLAG(   7,  0, EDX,  3,  1, AVX512QFMAPS,                      YES, 16, TRUE)  \
-CPUID_7_EDX_10                                                                 \
 FLAG(   7,  0, EDX, 26,  1, IBRSIBPB,                          ANY,  9, FALSE) \
 FLAG(   7,  0, EDX, 27,  1, STIBP,                             YES,  9, FALSE) \
 CPUID_7_EDX_28                                                                 \
@@ -1436,8 +1432,6 @@ CPUIDCheck(int32 eaxIn, int32 eaxInCheck,
 #define CPUID_STEPPING_KABYLAKE_ES     0x8  // Kabylake S/H/U/Y ES
 #define CPUID_STEPPING_COFFEELAKE_A    0xA  // Coffeelake U/S/H
 #define CPUID_STEPPING_COFFEELAKE_B    0xB  // Coffeelake S/H
-#define CPUID_STEPPING_CASCADELAKE_A   0x5  // Cascade Lake A-step
-#define CPUID_STEPPING_CASCADELAKE_B1  0x7  // Cascade Lake B1-step
 
 #define CPUID_MODEL_PIII_07    7
 #define CPUID_MODEL_PIII_08    8
@@ -1662,15 +1656,6 @@ CPUID_MODEL_IS_HASWELL(uint32 v) // IN: %eax from CPUID with %eax=1.
            effectiveModel == CPUID_MODEL_HASWELL_46);
 }
 
-static INLINE Bool
-CPUID_MODEL_IS_CASCADELAKE(uint32 v) // IN: %eax from CPUID with %eax=1.
-{
-   /* Assumes the CPU manufacturer is Intel. */
-   return CPUID_FAMILY_IS_P6(v) &&
-          CPUID_EFFECTIVE_MODEL(v) == CPUID_MODEL_SKYLAKE_55 &&
-          CPUID_EFFECTIVE_STEPPING(v) >= CPUID_STEPPING_CASCADELAKE_A &&
-          CPUID_EFFECTIVE_STEPPING(v) <= CPUID_STEPPING_CASCADELAKE_B1;
-}
 
 static INLINE Bool
 CPUID_MODEL_IS_SKYLAKE(uint32 v) // IN: %eax from CPUID with %eax=1.

vmmon-only/include/x86msr.h

@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 1998-2019 VMware, Inc. All rights reserved.
+ * Copyright (C) 1998-2018 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -121,8 +121,6 @@ MSRQuery;
 #define MSR_ARCH_CAPABILITIES_RDCL_NO             (1ULL << 0)
 #define MSR_ARCH_CAPABILITIES_IBRS_ALL            (1ULL << 1)
 #define MSR_ARCH_CAPABILITIES_RSBA                (1ULL << 2)
-#define MSR_ARCH_CAPABILITIES_NOL1F_VMENTRY       (1ULL << 3)
-#define MSR_ARCH_CAPABILITIES_SSB_NO              (1ULL << 4)
 
 
 #define MSR_SPEC_CTRL_IBRS                        (1UL << 0)

vmmon-only/linux/driver.c

@@ -73,9 +73,6 @@ static Bool LinuxDriverCheckPadding(void);
 
 struct VMXLinuxState linuxState;
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 17, 0)
-typedef int vm_fault_t;
-#endif
 
 /*
  *----------------------------------------------------------------------
@@ -100,9 +97,9 @@ long LinuxDriver_Ioctl(struct file *filp, u_int iocmd,
 
 static int LinuxDriver_Close(struct inode *inode, struct file *filp);
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
-static vm_fault_t LinuxDriverFault(struct vm_fault *fault);
+static int LinuxDriverFault(struct vm_fault *fault);
 #else
-static vm_fault_t LinuxDriverFault(struct vm_area_struct *vma, struct vm_fault *fault);
+static int LinuxDriverFault(struct vm_area_struct *vma, struct vm_fault *fault);
 #endif
 static int LinuxDriverMmap(struct file *filp, struct vm_area_struct *vma);
 
@@ -598,7 +595,7 @@ LinuxDriver_Close(struct inode *inode, // IN
  *-----------------------------------------------------------------------------
  */
 
-static vm_fault_t
+static int
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
 LinuxDriverFault(struct vm_fault *fault)     //IN/OUT
 #else

vmmon-only/linux/hostif.c

@@ -1639,13 +1639,9 @@ HostIF_EstimateLockedPageLimit(const VMDriver* vm,                // IN
     * since at least 2.6.0.
     */
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
    extern unsigned long totalram_pages;
 
    unsigned int totalPhysicalPages = totalram_pages;
-#else
-   unsigned int totalPhysicalPages = totalram_pages();
-#endif
 
    /*
     * Use the memory information linux exports as of late for a more
@@ -1743,49 +1739,6 @@ HostIF_WaitForFreePages(unsigned int timeoutMs)  // IN:
 }
 
 
-/*
- *----------------------------------------------------------------------
- *
- * HostIFGetTime --
- *
- *      Reads the current time in UPTIME_FREQ units.
- *
- * Results:
- *      The uptime, in units of UPTIME_FREQ.
- *
- * Side effects:
- *      None.
- *
- *----------------------------------------------------------------------
- */
-
-static uint64
-HostIFGetTime(void)
-{
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
-   struct timeval tv;
-
-   do_gettimeofday(&tv);
-   return tv.tv_usec * (UPTIME_FREQ / 1000000) + tv.tv_sec * UPTIME_FREQ;
-#else
-   struct timespec64 now;
-
-   /*
-    * Use raw time used by Posix timers.  This time is not affected by
-    * NTP adjustments, so it may drift from real time and monotonic time,
-    * but it will stay in sync with other timers.
-    */
-   ktime_get_raw_ts64(&now);
-   /*
-    * UPTIME_FREQ resolution is lower than tv_nsec,
-    * so we have to do division...
-    */
-   ASSERT_ON_COMPILE(1000000000 % UPTIME_FREQ == 0);
-   return now.tv_nsec / (1000000000 / UPTIME_FREQ) + now.tv_sec * UPTIME_FREQ;
-#endif
-}
-
-
 /*
  *----------------------------------------------------------------------
  *
@@ -1817,6 +1770,7 @@ HostIFGetTime(void)
 static uint64
 HostIFReadUptimeWork(unsigned long *j)  // OUT: current jiffies
 {
+   struct timeval tv;
    uint64 monotime, uptime, upBase, monoBase;
    int64 diff;
    uint32 version;
@@ -1831,12 +1785,13 @@ HostIFReadUptimeWork(unsigned long *j)  // OUT: current jiffies
       monoBase = uptimeState.monotimeBase;
    } while (!VersionedAtomic_EndTryRead(&uptimeState.version, version));
 
-   uptime = HostIFGetTime();
+   do_gettimeofday(&tv);
    upBase = Atomic_Read64(&uptimeState.uptimeBase);
 
    monotime = (uint64)(jifs - jifBase) * (UPTIME_FREQ / HZ);
    monotime += monoBase;
 
+   uptime = tv.tv_usec * (UPTIME_FREQ / 1000000) + tv.tv_sec * UPTIME_FREQ;
    uptime += upBase;
 
    /*
@@ -1941,11 +1896,13 @@ HostIFUptimeResyncMono(struct timer_list *timer)  // IN: ignored
 void
 HostIF_InitUptime(void)
 {
-   uint64 tm;
+   struct timeval tv;
 
    uptimeState.jiffiesBase = jiffies;
-   tm = HostIFGetTime();
-   Atomic_Write64(&uptimeState.uptimeBase, -tm);
+   do_gettimeofday(&tv);
+   Atomic_Write64(&uptimeState.uptimeBase,
+                  -(tv.tv_usec * (UPTIME_FREQ / 1000000) +
+                    tv.tv_sec * UPTIME_FREQ));
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0) && !defined(timer_setup)
    init_timer(&uptimeState.timer);
@@ -2329,7 +2286,7 @@ isVAReadable(VA r)  // IN:
    int ret;
 
    old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());
    r = APICR_TO_ADDR(r, APICR_VERSION);
    ret = HostIF_CopyFromUser(&dummy, r, sizeof dummy);
    set_fs(old_fs);
@@ -2606,7 +2563,7 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
    }
 
    old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());
 
    {
       struct poll_wqueues table;
@@ -2735,7 +2692,7 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
    }
 
    old_fs = get_fs();
-   set_fs(KERNEL_DS);
+   set_fs(get_ds());
 
    /*
     * Always write sizeof(uint64) bytes. This works fine for eventfd and
@@ -3403,7 +3360,7 @@ HostIF_SetFastClockRate(unsigned int rate) // IN: Frequency in Hz.
       }
    } else {
       if (linuxState.fastClockThread) {
-         send_sig(SIGKILL, linuxState.fastClockThread, 1);
+         force_sig(SIGKILL, linuxState.fastClockThread);
          kthread_stop(linuxState.fastClockThread);
 
          linuxState.fastClockThread = NULL;
@@ -3449,12 +3406,7 @@ HostIF_MapUserMem(VA addr,                  // IN: User memory virtual address
 
    ASSERT(handle);
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 0, 0)
-   if (!access_ok(VERIFY_WRITE, p, size))
-#else
-   if (!access_ok(p, size))
-#endif
-   {
+   if (!access_ok(VERIFY_WRITE, p, size)) {
       printk(KERN_ERR "%s: Couldn't verify write to uva 0x%p with size %"
              FMTSZ"u\n", __func__, p, size);
 

vmnet-only/Makefile

@@ -107,7 +107,7 @@ prebuild:: ;
 postbuild:: ;
 
 $(DRIVER_KO): prebuild
-	$(MAKE) -C $(BUILD_DIR) M=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
+	$(MAKE) -C $(BUILD_DIR) SUBDIRS=$$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) modules
 	$(MAKE) -C $$PWD SRCROOT=$$PWD/$(SRCROOT) \
 	  MODULEBUILDDIR=$(MODULEBUILDDIR) postbuild

vmnet-only/bridge.c

@@ -67,18 +67,6 @@
 
 #if LOGLEVEL >= 4
 static struct timeval vnetTime;
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
-static void do_gettimeofday(struct timeval *tv)
-{
-	struct timespec64 now;
-
-	ktime_get_real_ts64(&now);
-	tv->tv_sec = now.tv_sec;
-	tv->tv_usec = now.tv_nsec / 1000;
-}
-#endif
-
 #endif
 
 typedef struct VNetBridge VNetBridge;

vmnet-only/userif.c

@@ -78,33 +78,13 @@ static int  VNetUserIfSetUplinkState(VNetPort *port, uint8 linkUp);
 extern unsigned int  vnet_max_qlen;
 
 #if COMPAT_LINUX_VERSION_CHECK_LT(3, 2, 0)
-#   define compat_kmap_frag(frag) kmap((frag)->page)
-#   define compat_kunmap_frag(page) kunmap((frag)->page)
+#   define compat_kmap(page) kmap(page)
+#   define compat_kunmap(page) kunmap(page)
 #else
-#   define compat_kmap_frag(frag) kmap(skb_frag_page(frag))
-#   define compat_kunmap_frag(frag) kunmap(skb_frag_page(frag))
+#   define compat_kmap(page) kmap((page).p)
+#   define compat_kunmap(page) kunmap((page).p)
 #endif
 
-static unsigned int compat_skb_frag_size(const skb_frag_t *frag)
-{
-#if COMPAT_LINUX_VERSION_CHECK_LT(3, 2, 0)
-	return frag->size;
-#else
-	return skb_frag_size(frag);
-#endif
-}
-
-static unsigned int compat_skb_frag_off(const skb_frag_t *frag)
-{
-#if COMPAT_LINUX_VERSION_CHECK_LT(5, 4, 0) && \
-	!(defined(CONFIG_SUSE_VERSION) && CONFIG_SUSE_VERSION == 15 && \
-	  defined(CONFIG_SUSE_PATCHLEVEL) && CONFIG_SUSE_PATCHLEVEL >= 2)
-	return frag->page_offset;
-#else
-	return skb_frag_off(frag);
-#endif
-}
-
 /*
  *-----------------------------------------------------------------------------
  *
@@ -157,21 +137,16 @@ UserifLockPage(VA addr) // IN
  */
 
 static INLINE int
-VNetUserIfMapPtr(VA64 uAddr,      // IN: pointer to user memory
+VNetUserIfMapPtr(VA uAddr,        // IN: pointer to user memory
                  size_t size,     // IN: size of data
                  struct page **p, // OUT: locked page
                  void **ptr)      // OUT: kernel mapped pointer
 {
-   uint8 v;
-
-   /* Check area does not straddle two pages. */
-   if ((uAddr & (PAGE_SIZE - 1)) + size > PAGE_SIZE) {
+   if (!access_ok(VERIFY_WRITE, (void *)uAddr, size) ||
+       (((uAddr + size - 1) & ~(PAGE_SIZE - 1)) !=
+        (uAddr & ~(PAGE_SIZE - 1)))) {
       return -EINVAL;
    }
-   /* Check if it is user's area.  UserifLockPage() checks writability. */
-   if (copy_from_user(&v, (void *)(unsigned long)uAddr, sizeof v) != 0) {
-      return -EFAULT;
-   }
 
    *p = UserifLockPage(uAddr);
    if (*p == NULL) {
@@ -183,7 +158,7 @@ VNetUserIfMapPtr(VA64 uAddr,      // IN: pointer to user memory
 }
 
 static INLINE int
-VNetUserIfMapUint32Ptr(VA64 uAddr,      // IN: pointer to user memory
+VNetUserIfMapUint32Ptr(VA uAddr,        // IN: pointer to user memory
                        struct page **p, // OUT: locked page
                        uint32 **ptr)    // OUT: kernel mapped pointer
 {
@@ -226,7 +201,7 @@ VNetUserIfSetupNotify(VNetUserIF *userIf, // IN
       return -EBUSY;
    }
 
-   if ((retval = VNetUserIfMapUint32Ptr(vn->pollPtr, &pollPage,
+   if ((retval = VNetUserIfMapUint32Ptr((VA)vn->pollPtr, &pollPage,
                                         &pollPtr)) < 0) {
       return retval;
    }
@@ -238,7 +213,7 @@ VNetUserIfSetupNotify(VNetUserIF *userIf, // IN
       goto error_free;
    }
 
-   if ((retval = VNetUserIfMapUint32Ptr(vn->recvClusterPtr,
+   if ((retval = VNetUserIfMapUint32Ptr((VA)vn->recvClusterPtr,
                                         &recvClusterPage,
                                         &recvClusterCount)) < 0) {
       goto error_free;
@@ -584,21 +559,20 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
    for (frag = skb_shinfo(skb)->frags;
 	frag != skb_shinfo(skb)->frags + skb_shinfo(skb)->nr_frags;
 	frag++) {
-      if (compat_skb_frag_size(frag) > 0) {
+      if (frag->size > 0) {
 	 unsigned int tmpCsum;
 	 const void *vaddr;
 
-	 vaddr = compat_kmap_frag(frag);
-	 tmpCsum = csum_and_copy_to_user(vaddr + compat_skb_frag_off(frag),
-					 curr, compat_skb_frag_size(frag), 0,
-					 &err);
-	 compat_kunmap_frag(frag);
+	 vaddr = compat_kmap(frag->page);
+	 tmpCsum = csum_and_copy_to_user(vaddr + frag->page_offset,
+					 curr, frag->size, 0, &err);
+	 compat_kunmap(frag->page);
 
 	 if (err) {
 	    return err;
 	 }
 	 csum = csum_block_add(csum, tmpCsum, curr - buf);
-	 curr += compat_skb_frag_size(frag);
+	 curr += frag->size;
       }
    }