fix bus_dmamap_destroy

With bounce buffers, we must pass a larger size to free()

ok bluhm@ hshoexer@

diff --git a/sys/arch/amd64/amd64/bus_dma.c b/sys/arch/amd64/amd64/bus_dma.c
index ac8fa40..a0d3ad1 100644 (file)
--- a/sys/arch/amd64/amd64/bus_dma.c
+++ b/sys/arch/amd64/amd64/bus_dma.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: bus_dma.c,v 1.54 2024/08/20 11:45:31 bluhm Exp $      */
+/*     $OpenBSD: bus_dma.c,v 1.55 2024/08/20 12:36:09 sf Exp $ */
 /*     $NetBSD: bus_dma.c,v 1.3 2003/05/07 21:33:58 fvdl Exp $ */
 
 /*-
@@ -223,12 +223,18 @@ _bus_dmamap_destroy(bus_dma_tag_t t, bus_dmamap_t map)
        size_t mapsize;
        struct vm_page **pg;
        struct pglist mlist;
+       int use_bounce_buffer = cpu_sev_guestmode || FORCE_BOUNCE_BUFFER;
 
        if (map->_dm_pgva) {
                km_free((void *)map->_dm_pgva, map->_dm_npages << PGSHIFT,
                    &kv_any, &kp_none);
        }
 
+       mapsize = sizeof(struct bus_dmamap) +
+               (sizeof(bus_dma_segment_t) * (map->_dm_segcnt - 1));
+       if (use_bounce_buffer)
+               mapsize += sizeof(struct vm_page *) * map->_dm_npages;
+
        if (map->_dm_pages) {
                TAILQ_INIT(&mlist);
                for (pg = map->_dm_pages; map->_dm_npages--; pg++) {
@@ -237,8 +243,6 @@ _bus_dmamap_destroy(bus_dma_tag_t t, bus_dmamap_t map)
                uvm_pglistfree(&mlist);
        }
 
-       mapsize = sizeof(struct bus_dmamap) +
-               (sizeof(bus_dma_segment_t) * (map->_dm_segcnt - 1));
        free(map, M_DEVBUF, mapsize);
 }