[dpdk-dev] [PATCH 2/4] net/mlx5: fix secondary process port detach crash

[Suanming Mou <suanmingm@nvidia.com>]

When secondary process starts, in rte_eth_dev_attach_secondary()
function, the secondary process port device data in struct rte_eth_dev
will be initialized to be shared with primary process port.

When failsafe sub-port hot-plug happens, both primary and secondary
process will release the sub-port, and primary process will clear the
sub-port device data in fs_dev_remove() deactivate stage first before
request secondary process to release the sub-port. In this case, the
secondary process will not be able to get the priv memory pointer from
the shared device data memory anymore, since the device data memory
has been cleared.

Since what secondary process needs in port detach is the UAR table size
to unmap the UAR addresses. It used Tx queue number as size of UAR table
in priv. In fact the uar_table_sz in struct mlx5_proc_priv means the size
of UAR register table - the number of UAR records. However, the code set
this field incorrectly to the size of mlx5_proc_priv structure.

This commit fixes UAR table size to match with relevant Tx queue number,
uses the UAR table size directly to avoid the secondary process to access
the priv pointer in the shared device data memory when unmapping the UAR
address.

Fixes: 120dc4a7dcd3 ("net/mlx5: remove device register remap")
cc: stable@dpdk.org

Signed-off-by: Suanming Mou <suanmingm@nvidia.com>
Acked-by: Viacheslav Ovsiienko <viacheslavo@nvidia.com>
---
 drivers/net/mlx5/mlx5.c     |  6 +++---
 drivers/net/mlx5/mlx5_txq.c | 21 +++++++++++++--------
 2 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/drivers/net/mlx5/mlx5.c b/drivers/net/mlx5/mlx5.c
index 3730f32..efedbb9 100644
--- a/drivers/net/mlx5/mlx5.c
+++ b/drivers/net/mlx5/mlx5.c
@@ -1251,13 +1251,13 @@ struct mlx5_dev_ctx_shared *
 	 */
 	ppriv_size =
 		sizeof(struct mlx5_proc_priv) + priv->txqs_n * sizeof(void *);
-	ppriv = mlx5_malloc(MLX5_MEM_RTE, ppriv_size, RTE_CACHE_LINE_SIZE,
-			    dev->device->numa_node);
+	ppriv = mlx5_malloc(MLX5_MEM_RTE | MLX5_MEM_ZERO, ppriv_size,
+			    RTE_CACHE_LINE_SIZE, dev->device->numa_node);
 	if (!ppriv) {
 		rte_errno = ENOMEM;
 		return -rte_errno;
 	}
-	ppriv->uar_table_sz = ppriv_size;
+	ppriv->uar_table_sz = priv->txqs_n;
 	dev->process_private = ppriv;
 	return 0;
 }
diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
index b81bb4a..c53af10 100644
--- a/drivers/net/mlx5/mlx5_txq.c
+++ b/drivers/net/mlx5/mlx5_txq.c
@@ -634,18 +634,23 @@
 void
 mlx5_tx_uar_uninit_secondary(struct rte_eth_dev *dev)
 {
-	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_txq_data *txq;
-	struct mlx5_txq_ctrl *txq_ctrl;
+	struct mlx5_proc_priv *ppriv = (struct mlx5_proc_priv *)
+					dev->process_private;
+	const size_t page_size = rte_mem_page_size();
+	void *addr;
 	unsigned int i;
 
+	if (page_size == (size_t)-1) {
+		DRV_LOG(ERR, "Failed to get mem page size");
+		return;
+	}
 	MLX5_ASSERT(rte_eal_process_type() == RTE_PROC_SECONDARY);
-	for (i = 0; i != priv->txqs_n; ++i) {
-		if (!(*priv->txqs)[i])
+	for (i = 0; i != ppriv->uar_table_sz; ++i) {
+		if (!ppriv->uar_table[i])
 			continue;
-		txq = (*priv->txqs)[i];
-		txq_ctrl = container_of(txq, struct mlx5_txq_ctrl, txq);
-		txq_uar_uninit_secondary(txq_ctrl);
+		addr = ppriv->uar_table[i];
+		rte_mem_unmap(RTE_PTR_ALIGN_FLOOR(addr, page_size), page_size);
+
 	}
 }
 
-- 
1.8.3.1