In order to keep the dmabuf alive whilst the mmap is, we need to hold a reference to the dmabuf and not the backing object. This is important as the dmabuf not only keeps the object alive, but also the device so that
dmabuf = vgem_create_dmabuf(); ptr = mmap(... dmabuf ...); close(dmabuf);
persists across module-unload as well as device closure.
Testcase: igt/vgem_basic/unload Signed-off-by: Chris Wilson chris@chris-wilson.co.uk Cc: Petri Latvala petri.latvala@intel.com --- drivers/gpu/drm/vgem/vgem_drv.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c index f36c14729b55..74a83e41efa9 100644 --- a/drivers/gpu/drm/vgem/vgem_drv.c +++ b/drivers/gpu/drm/vgem/vgem_drv.c @@ -198,7 +198,6 @@ static struct drm_ioctl_desc vgem_ioctls[] = {
static int vgem_mmap(struct file *filp, struct vm_area_struct *vma) { - unsigned long flags = vma->vm_flags; int ret;
ret = drm_gem_mmap(filp, vma); @@ -208,7 +207,7 @@ static int vgem_mmap(struct file *filp, struct vm_area_struct *vma) /* Keep the WC mmaping set by drm_gem_mmap() but our pages * are ordinary and not special. */ - vma->vm_flags = flags | VM_DONTEXPAND | VM_DONTDUMP; + vma->vm_flags &= ~(VM_IO | VM_PFNMAP); return 0; }
@@ -281,21 +280,11 @@ static int vgem_prime_mmap(struct drm_gem_object *obj, { int ret;
- if (obj->size < vma->vm_end - vma->vm_start) - return -EINVAL; - - if (!obj->filp) - return -ENODEV; - - ret = obj->filp->f_op->mmap(obj->filp, vma); + ret = drm_gem_mmap_obj(obj, obj->size, vma); if (ret) return ret;
- fput(vma->vm_file); - vma->vm_file = get_file(obj->filp); - vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP; - vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags)); - + vma->vm_flags &= ~(VM_IO | VM_PFNMAP); return 0; }