[dpdk-stable] patch 'net/mlx5: fix crash on secondary process port close' has been queued to stable release 19.11.7

[Christian Ehrhardt]

Hi,

FYI, your patch has been queued to stable release 19.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 02/10/21. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/cpaelzer/dpdk-stable-queue

This queued commit can be viewed at:
https://github.com/cpaelzer/dpdk-stable-queue/commit/0db4935be6c3834c61aac3cda1fc08f20eb11a3e

Thanks.

Christian Ehrhardt <christian.ehrhardt at canonical.com>

---
>From 0db4935be6c3834c61aac3cda1fc08f20eb11a3e Mon Sep 17 00:00:00 2001
From: Suanming Mou <suanmingm at nvidia.com>
Date: Mon, 8 Feb 2021 11:04:00 +0800
Subject: [PATCH] net/mlx5: fix crash on secondary process port close

[ upstream commit 84a22cbcc467a02772dd24156773940331994c84 ]

When secondary process starts, in rte_eth_dev_attach_secondary()
function, the secondary process port device data in struct rte_eth_dev
will be initialized to be shared with primary process port.

When failsafe sub-port hot-plug happens, both primary and secondary
process will release the sub-port, and primary process will clear the
sub-port device data in fs_dev_remove() deactivate stage first before
request secondary process to release the sub-port. In this case, the
secondary process will not be able to get the priv memory pointer from
the shared device data memory anymore, since the device data memory
has been cleared.

Since what secondary process needs in port detach is the UAR table size
to unmap the UAR addresses. It used Tx queue number as size of UAR table
in priv. In fact the uar_table_sz in struct mlx5_proc_priv means the
size of UAR register table - the number of UAR records. However, the
code set this field incorrectly to the size of mlx5_proc_priv structure.

This commit fixes UAR table size to match with relevant Tx queue number,
uses the UAR table size directly to avoid the secondary process to
access the priv pointer in the shared device data memory when unmapping
the UAR address.

Fixes: 120dc4a7dcd3 ("net/mlx5: remove device register remap")
Cc: stable at dpdk.org

Signed-off-by: Suanming Mou <suanmingm at nvidia.com>
Acked-by: Viacheslav Ovsiienko <viacheslavo at nvidia.com>
---
 drivers/net/mlx5/mlx5.c     |  4 ++--
 drivers/net/mlx5/mlx5_txq.c | 21 +++++++++++++--------
 2 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/drivers/net/mlx5/mlx5.c b/drivers/net/mlx5/mlx5.c
index 4307005865..ac4745295c 100644
--- a/drivers/net/mlx5/mlx5.c
+++ b/drivers/net/mlx5/mlx5.c
@@ -1251,13 +1251,13 @@ mlx5_proc_priv_init(struct rte_eth_dev *dev)
 	 */
 	ppriv_size =
 		sizeof(struct mlx5_proc_priv) + priv->txqs_n * sizeof(void *);
-	ppriv = rte_malloc_socket("mlx5_proc_priv", ppriv_size,
+	ppriv = rte_zmalloc_socket("mlx5_proc_priv", ppriv_size,
 				  RTE_CACHE_LINE_SIZE, dev->device->numa_node);
 	if (!ppriv) {
 		rte_errno = ENOMEM;
 		return -rte_errno;
 	}
-	ppriv->uar_table_sz = ppriv_size;
+	ppriv->uar_table_sz = priv->txqs_n;
 	dev->process_private = ppriv;
 	return 0;
 }
diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
index fd1edfff65..9c929a57ea 100644
--- a/drivers/net/mlx5/mlx5_txq.c
+++ b/drivers/net/mlx5/mlx5_txq.c
@@ -433,18 +433,23 @@ txq_uar_uninit_secondary(struct mlx5_txq_ctrl *txq_ctrl)
 void
 mlx5_tx_uar_uninit_secondary(struct rte_eth_dev *dev)
 {
-	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_txq_data *txq;
-	struct mlx5_txq_ctrl *txq_ctrl;
+	struct mlx5_proc_priv *ppriv = (struct mlx5_proc_priv *)
+					dev->process_private;
+	const size_t page_size = sysconf(_SC_PAGESIZE);
+	void *addr;
 	unsigned int i;
 
+	if (page_size == (size_t)-1) {
+		DRV_LOG(ERR, "Failed to get mem page size");
+		return;
+	}
 	assert(rte_eal_process_type() == RTE_PROC_SECONDARY);
-	for (i = 0; i != priv->txqs_n; ++i) {
-		if (!(*priv->txqs)[i])
+	for (i = 0; i != ppriv->uar_table_sz; ++i) {
+		if (!ppriv->uar_table[i])
 			continue;
-		txq = (*priv->txqs)[i];
-		txq_ctrl = container_of(txq, struct mlx5_txq_ctrl, txq);
-		txq_uar_uninit_secondary(txq_ctrl);
+		addr = ppriv->uar_table[i];
+		munmap(RTE_PTR_ALIGN_FLOOR(addr, page_size), page_size);
+
 	}
 }
 
-- 
2.30.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2021-02-08 12:04:29.587570377 +0100
+++ 0001-net-mlx5-fix-crash-on-secondary-process-port-close.patch	2021-02-08 12:04:29.515496791 +0100
@@ -1 +1 @@
-From 84a22cbcc467a02772dd24156773940331994c84 Mon Sep 17 00:00:00 2001
+From 0db4935be6c3834c61aac3cda1fc08f20eb11a3e Mon Sep 17 00:00:00 2001
@@ -3 +3 @@
-Date: Sun, 24 Jan 2021 19:02:04 +0800
+Date: Mon, 8 Feb 2021 11:04:00 +0800
@@ -5,0 +6,2 @@
+[ upstream commit 84a22cbcc467a02772dd24156773940331994c84 ]
+
@@ -35 +37 @@
- drivers/net/mlx5/mlx5.c     |  6 +++---
+ drivers/net/mlx5/mlx5.c     |  4 ++--
@@ -37 +39 @@
- 2 files changed, 16 insertions(+), 11 deletions(-)
+ 2 files changed, 15 insertions(+), 10 deletions(-)
@@ -40 +42 @@
-index 50a6d2b19f..93629e5b05 100644
+index 4307005865..ac4745295c 100644
@@ -47,4 +49,3 @@
--	ppriv = mlx5_malloc(MLX5_MEM_RTE, ppriv_size, RTE_CACHE_LINE_SIZE,
--			    dev->device->numa_node);
-+	ppriv = mlx5_malloc(MLX5_MEM_RTE | MLX5_MEM_ZERO, ppriv_size,
-+			    RTE_CACHE_LINE_SIZE, dev->device->numa_node);
+-	ppriv = rte_malloc_socket("mlx5_proc_priv", ppriv_size,
++	ppriv = rte_zmalloc_socket("mlx5_proc_priv", ppriv_size,
+ 				  RTE_CACHE_LINE_SIZE, dev->device->numa_node);
@@ -61 +62 @@
-index 5142e50858..15624428aa 100644
+index fd1edfff65..9c929a57ea 100644
@@ -64 +65 @@
-@@ -634,18 +634,23 @@ txq_uar_uninit_secondary(struct mlx5_txq_ctrl *txq_ctrl)
+@@ -433,18 +433,23 @@ txq_uar_uninit_secondary(struct mlx5_txq_ctrl *txq_ctrl)
@@ -73 +74 @@
-+	const size_t page_size = rte_mem_page_size();
++	const size_t page_size = sysconf(_SC_PAGESIZE);
@@ -81 +82 @@
- 	MLX5_ASSERT(rte_eal_process_type() == RTE_PROC_SECONDARY);
+ 	assert(rte_eal_process_type() == RTE_PROC_SECONDARY);
@@ -91 +92 @@
-+		rte_mem_unmap(RTE_PTR_ALIGN_FLOOR(addr, page_size), page_size);
++		munmap(RTE_PTR_ALIGN_FLOOR(addr, page_size), page_size);