vfio: fix array bounds check

[dpdk.git] / lib / librte_eal / linuxapp / eal / eal_vfio.c

diff --git a/lib/librte_eal/linuxapp/eal/eal_vfio.c b/lib/librte_eal/linuxapp/eal/eal_vfio.c
index 6e2e84c..946df7e 100644 (file)
--- a/lib/librte_eal/linuxapp/eal/eal_vfio.c
+++ b/lib/librte_eal/linuxapp/eal/eal_vfio.c
@@ -172,6 +172,55 @@ vfio_get_group_fd(int iommu_group_no)
        return -1;
 }
 
+
+static int
+get_vfio_group_idx(int vfio_group_fd)
+{
+       int i;
+       for (i = 0; i < VFIO_MAX_GROUPS; i++)
+               if (vfio_cfg.vfio_groups[i].fd == vfio_group_fd)
+                       return i;
+       return -1;
+}
+
+static void
+vfio_group_device_get(int vfio_group_fd)
+{
+       int i;
+
+       i = get_vfio_group_idx(vfio_group_fd);
+       if (i < 0 || i > (VFIO_MAX_GROUPS - 1))
+               RTE_LOG(ERR, EAL, "  wrong vfio_group index (%d)\n", i);
+       else
+               vfio_cfg.vfio_groups[i].devices++;
+}
+
+static void
+vfio_group_device_put(int vfio_group_fd)
+{
+       int i;
+
+       i = get_vfio_group_idx(vfio_group_fd);
+       if (i < 0 || i > (VFIO_MAX_GROUPS - 1))
+               RTE_LOG(ERR, EAL, "  wrong vfio_group index (%d)\n", i);
+       else
+               vfio_cfg.vfio_groups[i].devices--;
+}
+
+static int
+vfio_group_device_count(int vfio_group_fd)
+{
+       int i;
+
+       i = get_vfio_group_idx(vfio_group_fd);
+       if (i < 0 || i > (VFIO_MAX_GROUPS - 1)) {
+               RTE_LOG(ERR, EAL, "  wrong vfio_group index (%d)\n", i);
+               return -1;
+       }
+
+       return vfio_cfg.vfio_groups[i].devices;
+}
+
 int
 clear_group(int vfio_group_fd)
 {
@@ -180,14 +229,14 @@ clear_group(int vfio_group_fd)
 
        if (internal_config.process_type == RTE_PROC_PRIMARY) {
 
-               for (i = 0; i < VFIO_MAX_GROUPS; i++)
-                       if (vfio_cfg.vfio_groups[i].fd == vfio_group_fd) {
-                               vfio_cfg.vfio_groups[i].group_no = -1;
-                               vfio_cfg.vfio_groups[i].fd = -1;
-                               vfio_cfg.vfio_active_groups--;
-                               return 0;
-                       }
-               return -1;
+               i = get_vfio_group_idx(vfio_group_fd);
+               if (i < 0)
+                       return -1;
+               vfio_cfg.vfio_groups[i].group_no = -1;
+               vfio_cfg.vfio_groups[i].fd = -1;
+               vfio_cfg.vfio_groups[i].devices = 0;
+               vfio_cfg.vfio_active_groups--;
+               return 0;
        }
 
        /* This is just for SECONDARY processes */
@@ -298,33 +347,37 @@ vfio_setup_device(const char *sysfs_base, const char *dev_addr,
                        clear_group(vfio_group_fd);
                        return -1;
                }
-       }
 
-       /*
-        * pick an IOMMU type and set up DMA mappings for container
-        *
-        * needs to be done only once, only when first group is assigned to
-        * a container and only in primary process. Note this can happen several
-        * times with the hotplug functionality.
-        */
-       if (internal_config.process_type == RTE_PROC_PRIMARY &&
-                       vfio_cfg.vfio_active_groups == 1) {
-               /* select an IOMMU type which we will be using */
-               const struct vfio_iommu_type *t =
+               /*
+                * pick an IOMMU type and set up DMA mappings for container
+                *
+                * needs to be done only once, only when first group is
+                * assigned to a container and only in primary process.
+                * Note this can happen several times with the hotplug
+                * functionality.
+                */
+               if (internal_config.process_type == RTE_PROC_PRIMARY &&
+                               vfio_cfg.vfio_active_groups == 1) {
+                       /* select an IOMMU type which we will be using */
+                       const struct vfio_iommu_type *t =
                                vfio_set_iommu_type(vfio_cfg.vfio_container_fd);
-               if (!t) {
-                       RTE_LOG(ERR, EAL, "  %s failed to select IOMMU type\n", dev_addr);
-                       close(vfio_group_fd);
-                       clear_group(vfio_group_fd);
-                       return -1;
-               }
-               ret = t->dma_map_func(vfio_cfg.vfio_container_fd);
-               if (ret) {
-                       RTE_LOG(ERR, EAL, "  %s DMA remapping failed, "
-                                       "error %i (%s)\n", dev_addr, errno, strerror(errno));
-                       close(vfio_group_fd);
-                       clear_group(vfio_group_fd);
-                       return -1;
+                       if (!t) {
+                               RTE_LOG(ERR, EAL,
+                                       "  %s failed to select IOMMU type\n",
+                                       dev_addr);
+                               close(vfio_group_fd);
+                               clear_group(vfio_group_fd);
+                               return -1;
+                       }
+                       ret = t->dma_map_func(vfio_cfg.vfio_container_fd);
+                       if (ret) {
+                               RTE_LOG(ERR, EAL,
+                                       "  %s DMA remapping failed, error %i (%s)\n",
+                                       dev_addr, errno, strerror(errno));
+                               close(vfio_group_fd);
+                               clear_group(vfio_group_fd);
+                               return -1;
+                       }
                }
        }
 
@@ -353,6 +406,7 @@ vfio_setup_device(const char *sysfs_base, const char *dev_addr,
                clear_group(vfio_group_fd);
                return -1;
        }
+       vfio_group_device_get(vfio_group_fd);
 
        return 0;
 }
@@ -390,17 +444,31 @@ vfio_release_device(const char *sysfs_base, const char *dev_addr,
         * code will unset the container and the IOMMU mappings.
         */
 
-       if (close(vfio_group_fd) < 0)
-               RTE_LOG(INFO, EAL, "Error when closing vfio_group_fd for %s\n",
-                                  dev_addr);
-
-       if (close(vfio_dev_fd) < 0)
+       /* Closing a device */
+       if (close(vfio_dev_fd) < 0) {
                RTE_LOG(INFO, EAL, "Error when closing vfio_dev_fd for %s\n",
                                   dev_addr);
+               return -1;
+       }
 
-       if (clear_group(vfio_group_fd) < 0)
-               RTE_LOG(INFO, EAL, "Error when clearing group for %s\n",
-                                  dev_addr);
+       /* An VFIO group can have several devices attached. Just when there is
+        * no devices remaining should the group be closed.
+        */
+       vfio_group_device_put(vfio_group_fd);
+       if (!vfio_group_device_count(vfio_group_fd)) {
+
+               if (close(vfio_group_fd) < 0) {
+                       RTE_LOG(INFO, EAL, "Error when closing vfio_group_fd for %s\n",
+                               dev_addr);
+                       return -1;
+               }
+
+               if (clear_group(vfio_group_fd) < 0) {
+                       RTE_LOG(INFO, EAL, "Error when clearing group for %s\n",
+                                          dev_addr);
+                       return -1;
+               }
+       }
 
        return 0;
 }
@@ -415,6 +483,7 @@ vfio_enable(const char *modname)
        for (i = 0; i < VFIO_MAX_GROUPS; i++) {
                vfio_cfg.vfio_groups[i].fd = -1;
                vfio_cfg.vfio_groups[i].group_no = -1;
+               vfio_cfg.vfio_groups[i].devices = 0;
        }
 
        /* inform the user that we are probing for VFIO */