drm/cma: Use dma_mmap_writecombine() to mmap buffer

The GEM CMA helpers uses a custom mmap implementation based on
remap_pfn_range(). While this works when the buffer DMA and physical
addresses are identical, it fails to take IOMMU into account and tries
to mmap the buffer to userspace using the DMA virtual address instead of
the physical address. This results in mapping random physical pages when
the device is behind an IOMMU.

Use the DMA mapping dma_mmap_writecombine() function instead.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Tested-by: Philipp Zabel <philipp.zabel@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

diff --git a/drivers/gpu/drm/drm_gem_cma_helper.c b/drivers/gpu/drm/drm_gem_cma_helper.c
index 2c07cb9550ef2d3f02ed9f911ab8b6e3fe7a9802..fbb9df6becb00ee090a965124962ff3452c006a2 100644 (file)
--- a/drivers/gpu/drm/drm_gem_cma_helper.c
+++ b/drivers/gpu/drm/drm_gem_cma_helper.c
@@ -234,8 +234,17 @@ static int drm_gem_cma_mmap_obj(struct drm_gem_cma_object *cma_obj,
 {
        int ret;
 
-       ret = remap_pfn_range(vma, vma->vm_start, cma_obj->paddr >> PAGE_SHIFT,
-                       vma->vm_end - vma->vm_start, vma->vm_page_prot);
+       /*
+        * Clear the VM_PFNMAP flag that was set by drm_gem_mmap(), and set the
+        * vm_pgoff (used as a fake buffer offset by DRM) to 0 as we want to map
+        * the whole buffer.
+        */
+       vma->vm_flags &= ~VM_PFNMAP;
+       vma->vm_pgoff = 0;
+
+       ret = dma_mmap_writecombine(cma_obj->base.dev->dev, vma,
+                                   cma_obj->vaddr, cma_obj->paddr,
+                                   vma->vm_end - vma->vm_start);
        if (ret)
                drm_gem_vm_close(vma);