8 files changed, 131 insertions, 13 deletions

diff --git a/drivers/video/tegra/nvmap/nvmap_alloc.c b/drivers/video/tegra/nvmap/nvmap_alloc.c
index 74c9e4b90..ea648b8bf 100644
--- a/drivers/video/tegra/nvmap/nvmap_alloc.c
+++ b/drivers/video/tegra/nvmap/nvmap_alloc.c
@@ -775,6 +775,7 @@ int nvmap_alloc_handle(struct nvmap_client *client,
                 nvmap_stats_read(NS_TOTAL),
                 nvmap_stats_read(NS_ALLOC));
         h->userflags = flags;
+        h->userheap_mask = heap_mask;
         nr_page = ((h->size + PAGE_SIZE - 1) >> PAGE_SHIFT);
         /* Force mapping to uncached for VPR memory. */
         if (heap_mask & (NVMAP_HEAP_CARVEOUT_VPR | ~nvmap_dev->cpu_access_mask))
@@ -911,20 +912,9 @@ int nvmap_alloc_handle_from_va(struct nvmap_client *client,
         return err;
 }
 
-void _nvmap_handle_free(struct nvmap_handle *h)
+void __nvmap_handle_free(struct nvmap_handle *h)
 {
         unsigned int i, nr_page, page_index = 0;
-        struct nvmap_handle_dmabuf_priv *curr, *next;
-
-        list_for_each_entry_safe(curr, next, &h->dmabuf_priv, list) {
-                curr->priv_release(curr->priv);
-                list_del(&curr->list);
-                kzfree(curr);
-        }
-
-        if (nvmap_handle_remove(nvmap_dev, h) != 0)
-                return;
-
         if (!h->alloc)
                 goto out;
 
@@ -980,8 +970,24 @@ void _nvmap_handle_free(struct nvmap_handle *h)
         }
 
         nvmap_altfree(h->pgalloc.pages, nr_page * sizeof(struct page *));
-
 out:
+        h->alloc = false;
+}
+
+void _nvmap_handle_free(struct nvmap_handle *h)
+{
+        struct nvmap_handle_dmabuf_priv *curr, *next;
+
+        list_for_each_entry_safe(curr, next, &h->dmabuf_priv, list) {
+                curr->priv_release(curr->priv);
+                list_del(&curr->list);
+                kzfree(curr);
+        }
+
+        if (nvmap_handle_remove(nvmap_dev, h) != 0)
+                return;
+        __nvmap_handle_free(h);
+        // Next two calls were originally in the `out` clause
         NVMAP_TAG_TRACE(trace_nvmap_destroy_handle,
                 NULL, get_current()->pid, 0, NVMAP_TP_ARGS_H(h));
         kfree(h);
@@ -1041,3 +1047,57 @@ void nvmap_free_handle_fd(struct nvmap_client *client,
                 nvmap_handle_put(handle);
         }
 }
+
+// Frees backing pages. Handle remains valid.
+void nvmap_dealloc_fd(struct nvmap_client *client, int fd)
+{
+        struct nvmap_handle *handle = nvmap_handle_get_from_fd(fd);
+        if (handle)
+                __nvmap_handle_free(handle);
+}
+
+// For deallocations from elsewhere in the kernel.
+// (Userspace should use NVMAP_IOC_DEALLOC ioctl.)
+int nvmap_dealloc_dmabuf(struct dma_buf *dmabuf) {
+        struct nvmap_handle_info *info;
+
+        if (!dmabuf_is_nvmap(dmabuf))
+                return -EINVAL;
+        info = dmabuf->priv;
+        // Fail if mapped into kernelspace
+        // (Unclear if this is necessary, but no handles have been observed with this
+        // set, and so testing has not been possible.)
+        if (atomic_read(&info->handle->kmap_count))
+                goto out_busy;
+        // Buffer cannot currently be mapped into userspace (via mmap)
+        if (atomic_read(&info->handle->umap_count))
+                goto out_busy;
+        // Other devices should not still have this pinned into DMA memory
+        if (atomic_read(&info->handle->pin))
+                goto out_busy;
+        __nvmap_handle_free(info->handle);
+        return 0;
+out_busy:
+        printk(KERN_WARNING "nvmap: Unmap requested on FD that is currently in-use! (%d h->pin, %d h->kmap_count, %d h->umap_count)\n",
+               atomic_read(&info->handle->pin),
+               atomic_read(&info->handle->kmap_count),
+               atomic_read(&info->handle->umap_count));
+        return -EBUSY;
+}
+EXPORT_SYMBOL(nvmap_dealloc_dmabuf);
+
+// For reallocations from elsewhere in the kernel.
+// (Userspace should use NVMAP_IOC_ALLOC ioctl.)
+int nvmap_realloc_dmabuf(struct dma_buf *dmabuf) {
+        struct nvmap_handle_info *info;
+        struct nvmap_handle *h;
+
+        if (!dmabuf_is_nvmap(dmabuf))
+                return -EINVAL;
+        info = dmabuf->priv;
+        h = info->handle;
+        return nvmap_alloc_handle(h->owner, h, h->userheap_mask,
+                                  h->align, 0, h->userflags,
+                                  NVMAP_IVM_INVALID_PEER);
+}
+EXPORT_SYMBOL(nvmap_realloc_dmabuf);
diff --git a/drivers/video/tegra/nvmap/nvmap_dev.c b/drivers/video/tegra/nvmap/nvmap_dev.c
index eb5791464..a11e3edfb 100644
--- a/drivers/video/tegra/nvmap/nvmap_dev.c
+++ b/drivers/video/tegra/nvmap/nvmap_dev.c
@@ -360,6 +360,10 @@ static long nvmap_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 err = nvmap_ioctl_alloc(filp, uarg);
                 break;
 
+        case NVMAP_IOC_DEALLOC:
+                err = nvmap_ioctl_dealloc(filp, arg);
+                break;
+
         case NVMAP_IOC_ALLOC_IVM:
                 err = nvmap_ioctl_alloc_ivm(filp, uarg);
                 break;
diff --git a/drivers/video/tegra/nvmap/nvmap_dmabuf.c b/drivers/video/tegra/nvmap/nvmap_dmabuf.c
index 850e07e06..33dcf5fe5 100644
--- a/drivers/video/tegra/nvmap/nvmap_dmabuf.c
+++ b/drivers/video/tegra/nvmap/nvmap_dmabuf.c
@@ -659,6 +659,7 @@ struct dma_buf *__nvmap_make_dmabuf(struct nvmap_client *client,
         info->handle = handle;
         INIT_LIST_HEAD(&info->maps);
         mutex_init(&info->maps_lock);
+        INIT_LIST_HEAD(&info->user_priv_list);
 
         dmabuf = __dma_buf_export(info, handle->size, ro_buf);
         if (IS_ERR(dmabuf)) {
@@ -791,3 +792,13 @@ error:
         dma_buf_put(dmabuf);
         return ret;
 }
+
+struct list_head* nvmap_get_priv_list(struct dma_buf *dmabuf) {
+        struct nvmap_handle_info *info;
+
+        if (!dmabuf_is_nvmap(dmabuf))
+                return ERR_PTR(-EINVAL);
+        info = dmabuf->priv;
+        return &info->user_priv_list;
+}
+EXPORT_SYMBOL(nvmap_get_priv_list);
diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c
index 7fd13e625..93a418eb3 100644
--- a/drivers/video/tegra/nvmap/nvmap_ioctl.c
+++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c
@@ -460,6 +460,19 @@ int nvmap_ioctl_free(struct file *filp, unsigned long arg)
         return sys_close(arg);
 }
 
+// Returns memory freed by deallocation
+int nvmap_ioctl_dealloc(struct file *filp, unsigned long arg)
+{
+        struct nvmap_client *client = filp->private_data;
+        u64 before = nvmap_stats_read(NS_TOTAL);
+
+        if (!arg)
+                return 0;
+
+        nvmap_dealloc_fd(client, arg);
+        return before - nvmap_stats_read(NS_TOTAL);
+}
+
 static ssize_t rw_handle(struct nvmap_client *client, struct nvmap_handle *h,
                          int is_read, unsigned long h_offs,