Hi,
Thank you Jérôme and Daniel for your input, that's really helpful!
I have another question: in ttm_bo_mmap(), a reference to the buffer object is acquired at the beginning of the function. Another reference is acquired in ttm_bo_vm_open() (released in ttm_bo_vm_close()).
But where is the first reference released?