kernel: dedicated host-RAM vidmem buffer for BAR1 (not host GPU's real VRAM)

Guest VRAM (BAR1) was mapped to the host GPU's real BAR1 (managed by
nvidia.ko) - guest VRAM accesses hit the broken host GPU. Now a
dedicated 256MB vzalloc buffer backs guest VRAM; BAR1 mmap uses
per-page vmalloc_to_pfn (like BAR0 shadow). vfree on cleanup.

2 files changed, 38 insertions, 9 deletions

diff --git a/kernel/bar_init.c b/kernel/bar_init.c
index bf993ab..a3ed5fa 100644
--- a/kernel/bar_init.c
+++ b/kernel/bar_init.c
@@ -56,9 +56,18 @@ int nv_vgpu_bar_init(struct nv_vgpu_device *vgpu)
 	if (bar_addr && bar_size) {
 		vgpu->bars[1].gpa = bar_addr;
 		vgpu->bars[1].size = bar_size;
-		/* BAR1 (FB) is already mapped by nvidia.ko - don't remap */
-		vgpu->bars[1].vaddr = NULL;
-		nv_vgpu_info(vgpu, "BAR1: gpa=0x%llx, size=0x%llx (managed by nvidia.ko)", bar_addr, bar_size);
+		/* Emulated vidmem: a dedicated host-RAM buffer backing the guest's
+		 * VRAM aperture. Do NOT map the host GPU's real BAR1 - guest VRAM
+		 * accesses must hit our own clean buffer, not the (broken) host
+		 * GPU's VRAM. Allocated lazily on first use to keep mdev create
+		 * cheap; 256MB to match the GSCI fb size. */
+		vgpu->bars[1].vaddr = vzalloc(NV_VGPU_BAR1_SIZE);
+		if (!vgpu->bars[1].vaddr) {
+			nv_vgpu_err(vgpu, "Failed to allocate emulated vidmem (256MB)");
+			return -ENOMEM;
+		}
+		nv_vgpu_info(vgpu, "BAR1: gpa=0x%llx, size=0x%llx, emulated vidmem=%p",
+			     bar_addr, bar_size, vgpu->bars[1].vaddr);
 	}
 
 	bar_addr = pci_resource_start(pdev, 2);
@@ -115,7 +124,15 @@ void nv_vgpu_bar_cleanup(struct nv_vgpu_device *vgpu)
 	nv_vgpu_irq_teardown_msi(vgpu);
 	nv_vgpu_bar_emul_cleanup(vgpu);
 
+	/* Free the emulated vidmem buffer (vzalloc'd, not ioremap'd) */
+	if (vgpu->bars[1].vaddr) {
+		vfree(vgpu->bars[1].vaddr);
+		vgpu->bars[1].vaddr = NULL;
+	}
+
 	for (i = 0; i < NV_VGPU_MAX_REGIONS; i++) {
+		if (i == 1)
+			continue; /* vidmem buffer already freed above */
 		if (vgpu->bars[i].vaddr) {
 			iounmap(vgpu->bars[i].vaddr);
 			vgpu->bars[i].vaddr = NULL;
diff --git a/kernel/main.c b/kernel/main.c
index a47fe23..5e99881 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -1141,18 +1141,30 @@ static int nv_vgpu_vfio_dev_mmap(struct vfio_device *vdev, struct vm_area_struct
 		return 0;
 	}
 
-	/* BAR1 region - VRAM (use physical address directly) */
+	/* BAR1 region - VRAM (emulated vidmem buffer, per-page vmalloc_to_pfn) */
 	region_base = VFIO_PCI_INDEX_TO_OFFSET(VFIO_PCI_BAR1_REGION_INDEX);
 	region_size = vgpu->bars[1].size;
 	if (offset >= region_base && offset < region_base + region_size) {
-		if (region_size == 0)
+		unsigned long vram_off = offset - region_base;
+		unsigned long pos;
+
+		if (!vgpu->bars[1].vaddr || region_size == 0)
 			return -ENODEV;
 		if (offset + size > region_base + region_size)
 			return -EINVAL;
-		/* Use physical address directly since vaddr is NULL (managed by nvidia.ko) */
-		pfn = (vgpu->bars[1].gpa + (offset - region_base)) >> PAGE_SHIFT;
-		vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-		return remap_pfn_range(vma, vma->vm_start, pfn, size, vma->vm_page_prot);
+		/* vidmem buffer is vzalloc'd: physically non-contiguous pages, so
+		 * map one page at a time via vmalloc_to_pfn() (like BAR0 shadow).
+		 * Guest VRAM accesses hit our clean host-RAM backing, not the
+		 * host GPU's real BAR1. */
+		vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP);
+		vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+		for (pos = 0; pos < size; pos += PAGE_SIZE) {
+			pfn = vmalloc_to_pfn(vgpu->bars[1].vaddr + vram_off + pos);
+			if (remap_pfn_range(vma, vma->vm_start + pos, pfn, PAGE_SIZE,
+					    vma->vm_page_prot))
+				return -EAGAIN;
+		}
+		return 0;
 	}
 
 	/* BAR2 region - ioremap'd host BAR; map backing physical address */