From: sf <sf@openbsd.org>
Date: Tue, 20 Aug 2024 12:36:09 +0000 (+0000)
Subject: fix bus_dmamap_destroy
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=2e0b6c4c1c638789b2cbe7d1172e835ff33f67b3;p=openbsd

fix bus_dmamap_destroy

With bounce buffers, we must pass a larger size to free()

ok bluhm@ hshoexer@
---

diff --git a/sys/arch/amd64/amd64/bus_dma.c b/sys/arch/amd64/amd64/bus_dma.c
index ac8fa405798..a0d3ad1f3a0 100644
--- a/sys/arch/amd64/amd64/bus_dma.c
+++ b/sys/arch/amd64/amd64/bus_dma.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bus_dma.c,v 1.54 2024/08/20 11:45:31 bluhm Exp $	*/
+/*	$OpenBSD: bus_dma.c,v 1.55 2024/08/20 12:36:09 sf Exp $	*/
 /*	$NetBSD: bus_dma.c,v 1.3 2003/05/07 21:33:58 fvdl Exp $	*/
 
 /*-
@@ -223,12 +223,18 @@ _bus_dmamap_destroy(bus_dma_tag_t t, bus_dmamap_t map)
 	size_t mapsize;
 	struct vm_page **pg;
 	struct pglist mlist;
+	int use_bounce_buffer = cpu_sev_guestmode || FORCE_BOUNCE_BUFFER;
 
 	if (map->_dm_pgva) {
 		km_free((void *)map->_dm_pgva, map->_dm_npages << PGSHIFT,
 		    &kv_any, &kp_none);
 	}
 
+	mapsize = sizeof(struct bus_dmamap) +
+		(sizeof(bus_dma_segment_t) * (map->_dm_segcnt - 1));
+	if (use_bounce_buffer)
+		mapsize += sizeof(struct vm_page *) * map->_dm_npages;
+
 	if (map->_dm_pages) {
 		TAILQ_INIT(&mlist);
 		for (pg = map->_dm_pages; map->_dm_npages--; pg++) {
@@ -237,8 +243,6 @@ _bus_dmamap_destroy(bus_dma_tag_t t, bus_dmamap_t map)
 		uvm_pglistfree(&mlist);
 	}
 
-	mapsize = sizeof(struct bus_dmamap) +
-		(sizeof(bus_dma_segment_t) * (map->_dm_segcnt - 1));
 	free(map, M_DEVBUF, mapsize);
 }