kernel: dedicated host-RAM vidmem buffer for BAR1 (not host GPU's real VRAM)

Guest VRAM (BAR1) was mapped to the host GPU's real BAR1 (managed by
nvidia.ko) - guest VRAM accesses hit the broken host GPU. Now a
dedicated 256MB vzalloc buffer backs guest VRAM; BAR1 mmap uses
per-page vmalloc_to_pfn (like BAR0 shadow). vfree on cleanup.

1 files changed, 18 insertions, 6 deletions

diff --git a/kernel/main.c b/kernel/main.c
index a47fe23..5e99881 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -1141,18 +1141,30 @@ static int nv_vgpu_vfio_dev_mmap(struct vfio_device *vdev, struct vm_area_struct
 		return 0;
 	}
 
-	/* BAR1 region - VRAM (use physical address directly) */
+	/* BAR1 region - VRAM (emulated vidmem buffer, per-page vmalloc_to_pfn) */
 	region_base = VFIO_PCI_INDEX_TO_OFFSET(VFIO_PCI_BAR1_REGION_INDEX);
 	region_size = vgpu->bars[1].size;
 	if (offset >= region_base && offset < region_base + region_size) {
-		if (region_size == 0)
+		unsigned long vram_off = offset - region_base;
+		unsigned long pos;
+
+		if (!vgpu->bars[1].vaddr || region_size == 0)
 			return -ENODEV;
 		if (offset + size > region_base + region_size)
 			return -EINVAL;
-		/* Use physical address directly since vaddr is NULL (managed by nvidia.ko) */
-		pfn = (vgpu->bars[1].gpa + (offset - region_base)) >> PAGE_SHIFT;
-		vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-		return remap_pfn_range(vma, vma->vm_start, pfn, size, vma->vm_page_prot);
+		/* vidmem buffer is vzalloc'd: physically non-contiguous pages, so
+		 * map one page at a time via vmalloc_to_pfn() (like BAR0 shadow).
+		 * Guest VRAM accesses hit our clean host-RAM backing, not the
+		 * host GPU's real BAR1. */
+		vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP);
+		vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+		for (pos = 0; pos < size; pos += PAGE_SIZE) {
+			pfn = vmalloc_to_pfn(vgpu->bars[1].vaddr + vram_off + pos);
+			if (remap_pfn_range(vma, vma->vm_start + pos, pfn, PAGE_SIZE,
+					    vma->vm_page_prot))
+				return -EAGAIN;
+		}
+		return 0;
 	}
 
 	/* BAR2 region - ioremap'd host BAR; map backing physical address */