|WARNING| [v12, 26/26] doc: update release notes with NXP DPAA changes

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/167928

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-08-18

# DPAA Patch Series Review

## Summary

This is a 26-patch series for the DPAA (Data Path Acceleration Architecture) bus and PMD, primarily bug fixes, cleanup improvements, and feature additions. Below is the structured review following the AGENTS.md guidelines, separating correctness bugs (report at >=50% confidence) from style/process concerns.

---

## CORRECTNESS BUGS (Highest Priority)

### Patch 01/26: net/dpaa: fix device remove

**Error**: Double-call to `dpaa_eth_dev_close()`

The old code called `dpaa_eth_dev_close()` unconditionally, stored the result in `ret`, then conditionally called it again if the device state is not UNUSED. The first call's return value is lost (dead store), and the function may be called twice on the same device, which could cause double-free or other undefined behavior.

```c
/* BAD - old code */
ret = dpaa_eth_dev_close(eth_dev);  /* always called */
if (eth_dev->state != RTE_ETH_DEV_UNUSED) {
    dpaa_eth_dev_close(eth_dev);    /* called again, ignoring first ret */
    ret = rte_eth_dev_release_port(eth_dev);
}
```

**Fix**: The patch correctly changes this to call `dpaa_eth_dev_close()` only once, inside the state check, and stores its return value. The new code logs a warning if close fails but proceeds to release the port anyway, which is the correct cleanup pattern.

```c
/* GOOD - patched code */
if (eth_dev && eth_dev->state != RTE_ETH_DEV_UNUSED) {
    int close_ret = dpaa_eth_dev_close(eth_dev);
    if (close_ret)
        DPAA_PMD_WARN(...);
    ret = rte_eth_dev_release_port(eth_dev);
}
```

### Patch 02/26: net/dpaa: fix Tx confirmation queue memory leak

**Error**: Resource leak on every device close and probe failure

`dpaa_intf->tx_conf_queues` is allocated in `dpaa_dev_init()` but never freed. It is a driver private allocation, so `rte_eth_dev_release_port()` does not free it. The memory leaks on every device close and on every probe failure after the allocation.

**Fix**: The patch adds `rte_free(dpaa_intf->tx_conf_queues)` in `dpaa_eth_dev_close()` and in the error path of `dpaa_dev_init()`. The pointer is set to `NULL` after free to avoid double-free on a second call. This is correct.

### Patch 03/26: bus/dpaa: fix FQD dest wq channel decoding

**Error**: Incorrect bitfield extraction causes failure to drain pool-channel FQs

The old code extracted channel and work queue from the hardware descriptor's `dest_wq` field as:

```c
channel = dest_wq & 0x7;      /* bits 2:0 */
wq = dest_wq >> 3;            /* bits 15:3 */
```

But in the actual hardware descriptor, the work queue is bits 2:0 and the channel is bits 15:3. The old code therefore extracted a 0-7 value as the channel and the real channel as the work queue. `qman_shutdown_fq()` compares the channel against the pool-channel range to decide how to drain the queue, and that comparison can never succeed with a 0-7 value, so pool-channel FQs were not drained correctly.

**Fix**: The patch adds `qm_fqd_get_chan()` and `qm_fqd_get_wq()` helpers that extract the correct bitfields, and uses them in `qman_shutdown_fq()`.

```c
/* GOOD */
channel = qm_fqd_get_chan(&mcr->queryfq.fqd);  /* bits 15:3 */
wq = qm_fqd_get_wq(&mcr->queryfq.fqd);        /* bits 2:0 */
```

This is a correctness fix for FQ shutdown.

### Patch 08/26: drivers: add DPAA cgrid cleanup support

**Error**: CGR not released on device close, causing CGRID leak and stale FQs left behind

The old code deleted the CGR via `qman_delete_cgr()` but did not call `qman_release_cgrid_range()` to return the CGRID to the allocator. On a subsequent run, the CGRID range is re-allocated but the old FQs attached to it from the previous run are still in hardware. The patch adds `dpaa_cgr_stale_fq_cleanup()` which calls `qman_pending_fq_by_cgrid()` in a loop to find and shut down any FQs still attached, then adds `qman_release_cgrid_range()` to free the CGRID range.

This is a correctness fix for CGR cleanup.

### Patch 09/26: bus/dpaa: improve FQ shutdown with channel validation

**Error**: Hardcoded pool channel range check fails on multi-FMAN setups; pool-channel FQs not drained

The old code hardcoded the pool channel range as `qm_channel_pool1` to `qm_channel_pool1 + 15`. On a system with multiple FMAN blocks, the pool channel range may start at a different base. The patch replaces the hardcoded range with DTS-derived values (`dpaa_get_qm_channel_pool()` and `dpaa_get_qm_channel_pool_num()`).

Additionally, the old code had a portal affinity check for pool-channel FQs that could never pass because `p->config->channel` (the portal's dedicated channel) never equals a pool channel. The patch removes that check and programs `SDQCR` unconditionally for both dedicated and pool channels, then restores `SDQCR` after draining.

This is a correctness fix for FQ shutdown on multi-FMAN systems.

### Patch 14/26: dma/dpaa: add SG data validation and ERR050757

**Error**: ERR050757 workaround applied unconditionally, may corrupt data on affected silicon

The patch adds a workaround for hardware erratum ERR050757: when `RTE_DMA_DPAA_ERRATA_ERR050757` is defined, the driver sets `sdf->srttype` and `sdf->ss*` to force PCI read transactions to stay within the errata-safe length limit. The code is wrapped in `if (s_pci_read)` which defaults to 1. The `dpaa_dma_pci_read_disable` device argument can disable the workaround.

This is a correctness addition (workaround for a hardware bug). No error to flag here; the patch is correct.

### Patch 22/26: net/dpaa: enhance VSP port support

**Error**: VSP not cleaned up on error path after allocation

The patch modifies `dpaa_port_vsp_update()` to allocate and free VSP handles. On the error path after `fm_vsp_config()` or `fm_vsp_config_buffer_prefix_content()` fails, the patch does not free the VSP handle created by `fm_vsp_config()`. However, looking at the code flow, if `fm_vsp_config()` fails it returns `NULL` so `vsp->vsp_handle` is `NULL` and there is nothing to free. If `fm_vsp_config_buffer_prefix_content()` fails, the patch does not call `fm_vsp_free()` on `vsp->vsp_handle`.

**Actually, on second look**: the patch calls `fm_vsp_config()` and checks the return. If it fails, `vsp->vsp_handle` is `NULL`. If it succeeds, `vsp->vsp_handle` is set. Then `fm_vsp_config_buffer_prefix_content()` is called. If that fails, the function returns the error code without freeing `vsp->vsp_handle`. This is a **resource leak on error path**.

**Fix needed**: After the `fm_vsp_config_buffer_prefix_content()` check, if it fails, call `fm_vsp_free(vsp->vsp_handle)` before returning.

```c
ret = fm_vsp_config_buffer_prefix_content(vsp->vsp_handle, &buf_prefix_cont);
if (ret != E_OK) {
    DPAA_PMD_ERR(...);
    fm_vsp_free(vsp->vsp_handle);  /* MISSING */
    vsp->vsp_handle = NULL;
    return ret;
}
```

### Patch 24/26: crypto/dpaa_sec: improve crypto fq resource handling

**Error**: FQID range not released on error path if `dpaa_sec_init_tx()` fails partway through the loop

The patch adds `qman_alloc_fqid_range()` to allocate all Tx FQIDs at once, then initializes them in a loop. If `dpaa_sec_init_tx()` fails on iteration `i`, the error path (`init_error1`) shuts down FQs `0..i-1`, but the entire range `fqids[0]..fqids[max_nb_queue_pairs-1]` was reserved. The patch releases the entire range with `qman_release_fqid_range(fqids[0], internals->max_nb_queue_pairs)`, which is correct because `qman_shutdown_fq()` only affects the FQs that were created; the rest are just reserved IDs that can be released without shutting down.

No error here; the patch is correct.

---

## STYLE AND PROCESS ISSUES

### Patch 04/26: bus/dpaa: refine fman naming

**Info**: Renames `ccsr_map` to `memac_map` and `bmi_map` to `rx_bmi_map` for clarity. This is a refactoring patch with no functional change. The naming is more descriptive. No issue.

### Patch 05/26: bus/dpaa: scan max BPID from DTS

**Info**: Calculates max BPID from DTS instead of hardcoded value. Updates default BMAN HW version. No issue.

### Patch 06/26: drivers: add process-type guards for secondary process

**Info**: Adds `RTE_PROC_PRIMARY` checks in init paths so secondary processes skip hardware access. This is correct. No issue.

### Patch 07/26: drivers: shutdown DPAA FQ by fq descriptor

**Info**: Changes `qman_shutdown_fq()` to take a `struct qman_fq*` instead of just `fqid`, so that channel-affine portals can be accessed. This is a refactoring to support the fix in patch 09. No issue.

### Patch 10/26: drivers: add BMI Tx statistics

**Info**: Adds Tx BMI statistics support. The code checks if the register block is mapped before reading it, and reports zero if not. This is correct. No issue.

### Patch 11/26: net/dpaa: optimize FM deconfig

**Info**: Consolidates FM deconfig to a single location. Removes redundant checks. No issue.

### Patch 12/26: net/dpaa: optimize FMC MAC type parsing

**Info**: Refactors MAC type parsing in FMC to use the port name instead of MAC type and port number, which is more robust for ls104xa where MAC9 and MAC10 can be 10G/2.5G/1G depending on serdes config. No issue.

### Patch 13/26: drivers: release DPAA bpid on driver destructor

**Info**: Adds a destructor that releases allocated BPIDs on exit. Tracks allocated BPIDs in a static array. This is correct. No issue.

### Patch 15/26: net/dpaa: support Rx/Tx taildrop threshold devarg

**Info**: Adds device arguments to configure Rx/Tx taildrop thresholds. The code parses the devargs and sets the thresholds. No issue.

### Patch 16/26: net/dpaa: add Tx rate limiting API

**Info**: Adds an experimental PMD API to set Tx rate limit. The API checks that the port is a DPAA port before accessing DPAA-specific private data. This is correct. No issue.

### Patch 17/26: bus/dpaa: orp queue create and burst enqueue

**Info**: Adds ORP (order restoration point) support for burst enqueue. The code checks `fq->force_ooo` and falls back to non-ORP if needed. No issue.

### Patch 18/26: net/dpaa: support fmcless rxq number as devargs

**Info**: Adds a device argument to set the number of Rx queues in FMCLESS mode. The code parses the devarg and validates the range. No issue.

### Patch 19/26: net/dpaa: support non fmX-macY type of shared Ethernet name

**Info**: Adds a device argument to provide the kernel interface name for a shared MAC. The code parses the devarg and uses it in `SIOCGIFMTU` ioctl. No issue.

### Patch 20/26: bus/dpaa: optimize DPAA multi-entry buffer pool operations

**Info**: Replaces hardcoded buffer acquire count of 8 with `FSL_BM_BURST_MAX` constant. Uses a single `bm_hw_buf_desc` structure for HW initialization. No issue.

### Patch 21/26: bus/dpaa: improve log macro and fix bus detection

**Info**: Replaces `DPAA_BUS_LOG(LEVEL, ...)` with shorthand macros. Improves error messages. No issue.

### Patch 23/26: drivers: add offline (O/H) port device support

**Info**: Adds support for DPAA offline (O/H) port device. The feature is selected through the `drv_oldev` bus devarg. The code allocates Rx/Tx queues and initializes them. On the error paths, the patch releases the queues. No issue.

### Patch 25/26: drivers: add dpaax enter destructor to gate EAL memory frees

**Info**: Adds `dpaax_enter_destructor()` to signal that the process is tearing down, so that EAL memory frees are skipped (the EAL may have already unmapped hugepages). This is a workaround for destructor ordering issues. The `kfree()` macro checks `is_dpaax_in_destructor()` and skips `rte_free()` if true. This is correct. No issue.

### Patch 26/26: doc: update release notes

**Info**: Updates release notes with new features. This is required for user-facing changes. No issue.

---

## SUMMARY

**Errors (Correctness Bugs)**:

1. **Patch 22/26**: Resource leak in `dpaa_port_vsp_configure()` on error path after `fm_vsp_config_buffer_prefix_content()` fails. The VSP handle is not freed before returning.

**All other patches are correct.**

---

## DETAILED FINDINGS BY PATCH

### Patch 22/26: net/dpaa: enhance VSP port support

**Error**: Resource leak in `dpaa_port_vsp_configure()`

In `dpaa_port_vsp_configure()`, after `fm_vsp_config()` succeeds and stores the handle in `vsp->vsp_handle`, if the subsequent `fm_vsp_config_buffer_prefix_content()` call fails, the function returns the error code without freeing the VSP handle. This leaks the VSP resource.

```c
vsp->vsp_handle = fm_vsp_config(&vsp_params);
if (!vsp->vsp_handle) {
    DPAA_PMD_ERR("Configure VSP[%d] failed!", vsp_id);
    return -EIO;
}

ret = fm_vsp_config_buffer_prefix_content(vsp->vsp_handle, &buf_prefix_cont);
if (ret != E_OK) {
    DPAA_PMD_ERR("Configure VSP[%d]'s buffer prefix failed(%d)!", vsp_id, ret);
    /* MISSING: fm_vsp_free(vsp->vsp_handle); */
    /* MISSING: vsp->vsp_handle = NULL; */
    return ret;
}
```

**Suggested fix**:

```c
ret = fm_vsp_config_buffer_prefix