|WARNING| [v19, 26/26] doc: update release notes with NXP DPAA changes

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/170484

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-01

# DPAA Patch Series Review

This is a 26-patch series for the DPAA (Data Path Acceleration Architecture) drivers. I'll review patches that have correctness or style issues requiring attention, omitting patches with no findings.

---

## Patch 01/26: net/dpaa: fix double close and null deref on remove

**Errors:**

1. **NULL pointer dereference after dereferencing `eth_dev`.**
   The patch already performs the NULL check (`eth_dev != NULL`) before use, so this is correct as written. No issue here.

## Patch 02/26: net/dpaa: fix resource leak on probe failure

**No issues found.**

The patch correctly unwinds through cleanup labels on mempool creation failure, matching the existing error path for `dpaa_dev_init()`.

---

## Patch 03/26: net/dpaa: fix free port resources on close

**No issues found.**

The patch correctly adds cleanup of `tx_conf_queues` on both the close and init-failure paths, and moves the cleanup to a label that is reached for offline/ONIC ports as well.

---

## Patch 04/26: bus/dpaa: fix FQD dest wq channel decoding

**No issues found.**

The bit extraction was indeed wrong (channel and work queue were swapped). The fix correctly uses `>> 3` for the channel (bits 15:3) and `& 0x7` for the work queue (bits 2:0).

---

## Patch 05/26: bus/dpaa: accept QDMA device name in devargs

**No issues found.**

The patch correctly adds parsing for `dpaa_qdma-N` names, bounding the index by `RTE_DPAA_QDMA_DEVICES` and handling it alongside the existing MAC/OH/ONIC/SEC cases.

---

## Patch 06/26: bus/dpaa: refine fman naming

**No issues found.**

Renaming `ccsr_map` to `memac_map` and `bmi_map` to `rx_bmi_map` clarifies what each field represents. No functional change.

---

## Patch 07/26: bus/dpaa: scan max BPID from DTS

**No issues found.**

The patch correctly replaces the hardcoded pool max with a value read from the device tree `fsl,bpid-range` property, clamped to `BMAN_MAX_POOLS` to avoid array overruns in the depletion mask and SCN registers.

---

## Patch 08/26: drivers: add process-type guards for secondary process

**No issues found.**

The patch correctly rejects QDMA probe in a secondary process (the register bases in `struct fsl_qdma_engine` are primary-only mappings) and makes `rte_dpaa_remove()` skip the driver device count and shared mempool cleanup in a secondary (those are primary-only state).

---

## Patch 09/26: drivers: shutdown DPAA FQ by fq descriptor

**No issues found.**

Changing `qman_shutdown_fq()` to take the FQ descriptor instead of just an FQID, and selecting the portal from `fq->qp` when available, is the correct fix: an FQ on a different portal cannot be drained from the affine portal.

---

## Patch 10/26: drivers: add DPAA cgrid cleanup support

**Errors:**

1. **Missing null check on `fqid` and `cgrid` output parameters in `qman_pending_fq_by_cgrid_range()`.**
   The function dereferences both output pointers without checking if they are NULL. The caller may pass NULL for `cgrid` (the comment says "May be NULL"), but the function writes to it unconditionally:
   ```c
   if (fqid)
       *fqid = fq.fqid;
   if (cgrid)
       *cgrid = fqd.cgid;
   ```
   This is correct: the if-guards are present. No issue.

**No other issues.**

The patch correctly adds `qman_pending_fq_by_cgrid()` and `qman_pending_fq_by_cgrid_range()` to scan for stale FQs, and calls them from the close and init-failure paths to clean up CGRs before releasing their CGRIDs.

---

## Patch 11/26: bus/dpaa: improve FQ shutdown with channel validation

**No issues found.**

The patch correctly adds channel validation (reject dedicated channels that are not the portal's own, and reject DCP channels), bounds the FQRN wait loop, and reads the pool channel start and count from the device tree.

---

## Patch 12/26: drivers: add BMI Tx statistics

**No issues found.**

The patch extends `fman_if_bmi_stats_get_all()` to read Tx BMI registers in addition to the existing Rx ones, and updates the xstats array and DPAA_BMI_XSTATS_COUNT accordingly.

---

## Patch 13/26: net/dpaa: optimize FM deconfig

**No issues found.**

The patch consolidates FM deconfig to a single location and moves it after FQ shutdown for FMCLESS/shared-MAC ports, avoiding a double-deconfig.

---

## Patch 14/26: net/dpaa: optimize FMC MAC type parsing

**No issues found.**

The patch replaces the index-derivation logic (MAC type + offset) with a direct name parse for MAC9/MAC10 on ls104xa, where the type varies with serdes configuration.

---

## Patch 15/26: mempool/dpaa: fix write after free on pool free

**No issues found.**

The patch correctly moves the `bp_info->bp = NULL` write before the `rte_free(bp_info)` to avoid a write-after-free.

---

## Patch 16/26: drivers: release DPAA bpid on driver destructor

**No issues found.**

The patch adds a per-BPID tracking table and a destructor to release any BPID still marked in use at process exit. The array and flags are process-local static storage, so they are valid at destructor time even after EAL memory detaches.

---

## Patch 17/26: dma/dpaa: add devargs for SG and errata workaround

**No issues found.**

The patch adds three new device arguments (`dpaa_dma_sg_disable`, `dpaa_dma_data_validation`, `dpaa_dma_pci_read_disable`) to make existing driver features configurable at runtime, and updates the documentation.

---

## Patch 18/26: net/dpaa: support Rx/Tx taildrop threshold devarg

**No issues found.**

The patch adds `drv_rx_taildrop` and `drv_tx_taildrop` device arguments, with a helper to parse integer devargs, and resets the thresholds at the start of `dpaa_dev_init()` so values do not leak across ports.

---

## Patch 19/26: net/dpaa: support fmcless rxq number as devargs

**No issues found.**

The patch defaults the FMCLESS Rx queue count to `DPAA_MAX_NUM_PCD_QUEUES` instead of lcore count, and adds a `drv_fmcless_rxq` devarg to override it.

---

## Patch 20/26: net/dpaa: support non fmX-macY type of shared Ethernet name

**No issues found.**

The patch adds a `drv_sh_if_name` device argument to provide the kernel interface name for shared MACs when it differs from the `fmX-macY` name, and uses it in the `SIOCGIFMTU` ioctl.

---

## Patch 21/26: bus/dpaa: optimize DPAA multi-entry buffer pool operations

**No issues found.**

The patch replaces hardcoded 8 with `FSL_BM_BURST_MAX`, adds a big-endian hardware descriptor overlay to the `bm_buffer` union for single-store writes, and uses `memcpy` for entries 1..n-1 when publishing to the release ring.

---

## Patch 22/26: bus/dpaa: improve log macro usages

**No issues found.**

Mechanical replacement of `DPAA_BUS_LOG(LEVEL, ...)` with shorthand macros.

---

## Patch 23/26: net/dpaa: enhance VSP port support

**Errors:**

1. **Possible use-after-free in `dpaa_port_vsp_cleanup()`.**
   The function frees `vsp->vsp_handle` with `fm_vsp_free()`, then sets `vsp->vsp_handle = NULL` in the same iteration. If `fm_vsp_free()` fails, the handle is set to NULL even though the free did not succeed, and subsequent cleanup attempts will skip it. This is a potential resource leak, not a use-after-free. **Not an error in the traditional sense, but worth noting.** The current code says:
   ```c
   ret = fm_vsp_free(vsp->vsp_handle);
   if (ret != E_OK) {
       DPAA_PMD_ERR("Free VSP[%d] failed(%d)", idx, ret);
       return ret;   // early return, so the NULL assignment below doesn't run
   }
   vsp->vsp_handle = NULL;
   ```
   On a failed free, the function returns early without setting NULL. This is correct: the handle is left in place for a future attempt. **No issue.**

**No other issues.**

The patch correctly bounds the VSP ID against `DPAA_VSP_PROFILE_MAX_NUM` before indexing `vsp[]`, iterates cleanup over all profile slots (not just the current window), and consolidates the VSP structure into a single `struct dpaa_if_vsp` with the pool array.

---

## Patch 24/26: drivers: add offline (O/H) port device support

**Warnings:**

1. **New library API in installed header without release notes for non-test/internal changes.**
   The patch adds `rte_pmd_dpaa_ol_set_classif_info()`, `rte_pmd_dpaa_ol_reset_classif_info()`, `rte_pmd_dpaa_ol_set_lgw_info()`, and `rte_pmd_dpaa_ol_reset_lgw_info()` to `rte_pmd_dpaa_oldev.h`, and marks them `__rte_experimental`. These are documented in the header with `@b EXPERIMENTAL`, and the patch includes a release notes entry in patch 26/26. **No issue.**

**No errors found.**

The patch correctly adds the O/H port device support, with proper devargs parsing, FQ initialization, and secondary process rejection (the control device and FQIDs are primary-only).

---

## Patch 25/26: crypto/dpaa_sec: improve crypto fq resource handling

**No issues found.**

The patch correctly allocates FQIDs in bulk, shuts down FQs on uninit, and releases the FQID ranges, unwinding through cleanup labels on each failure point.

---

## Patch 26/26: doc: update release notes with NXP DPAA changes

**No issues found.**

The release notes entry correctly summarizes the new features and device arguments added by the series in a single bullet with sub-items.

---

# Summary

**All patches reviewed:** No correctness bugs (use-after-free, resource leaks, race conditions, logic errors) were found. The series correctly fixes double-close, resource leaks on probe failure, VSP cleanup, FQD decoding, and adds new features with proper error handling and cleanup paths.

**No style or process errors** require changes.

This is a clean series. All patches are correct as written.