|WARNING| [v19, 26/26] doc: update release notes with NXP DPAA changes

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/170484

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-01

# DPAA Patch Series Review

## Overview
This is a 26-patch series for the DPAA (Data Path Acceleration Architecture) driver in DPDK, targeting the 26.11 release. The series includes bug fixes, new features, code refactoring, and documentation updates.

---

## Pass 1: Correctness Issues (Priority Findings)

### Patch 01/26: net/dpaa: fix double close and null deref on remove
**Error**: Missing NULL check on `eth_dev` before dereferencing
```c
eth_dev = rte_eth_dev_allocated(dpaa_dev->device.name);
if (eth_dev != NULL && eth_dev->state != RTE_ETH_DEV_UNUSED) {
```
The code checks `eth_dev != NULL` but then outside this block accesses `eth_dev->state` without the NULL guard when adjusting the valid device count. However, examining the full context shows `dpaa_valid_dev--` occurs unconditionally outside the block, which is safe because it's a counter operation, not a dereference of `eth_dev`.

**Status**: No issue on closer inspection.

### Patch 02/26: net/dpaa: fix resource leak on probe failure
**Status**: Correct. The patch properly unwinds through `close_dev` - `release_port` labels, matching the existing `dpaa_dev_init()` failure path. No issues.

### Patch 03/26: net/dpaa: fix free port resources on close
**Status**: Correct. Adds the missing `rte_free(dpaa_intf->tx_conf_queues)` on both close and probe-failure paths, sets the pointer to NULL after freeing, and adds cleanup to the new `clean_1` label for offline/ONIC ports. No issues.

### Patch 04/26: bus/dpaa: fix FQD dest wq channel decoding
**Error**: Incorrect bit extraction for hardware descriptor field
The old code extracted:
```c
channel = dest_wq & 0x7;        // bits 2:0 as channel
wq = dest_wq >> 3;              // bits 15:3 as wq
```
But the hardware descriptor has:
- work queue in bits 2:0
- channel in bits 15:3

The fix correctly swaps them:
```c
channel = qm_fqd_get_chan(&mcr->queryfq.fqd);  // bits 15:3
wq = qm_fqd_get_wq(&mcr->queryfq.fqd);         // bits 2:0
```
**Status**: Correct fix for a real bug. No issues with the patch.

### Patch 10/26: drivers: add DPAA cgrid cleanup support
**Error**: Resource leak - CGRIDs allocated but never released on failure or close

Before this patch:
- `qman_alloc_cgrid_range()` reserves congestion group IDs
- CGRs are created and linked into the portal's list via `qman_create_cgr()`
- On close or probe failure, the code deleted the CGRs but never called `qman_release_cgrid_range()` to return the IDs

The patch adds the missing releases:
```c
qman_release_cgrid_range(dpaa_intf->cgr_rx[0].cgrid, dpaa_intf->nb_rx_queues);
```

It also adds `dpaa_cgr_stale_fq_cleanup()` to scan for and shut down FQs that are still attached to a CGR before deleting it (a CGR must have no members when deleted).

**Status**: Correct fix. No issues.

### Patch 15/26: mempool/dpaa: fix write after free on pool free
**Error**: Use-after-free / write into freed memory
```c
rte_free(mp->pool_data);
bp_info->bp = NULL;             // bp_info IS mp->pool_data, just freed
```
The patch correctly reorders:
```c
bp_info->bp = NULL;
rte_free(bp_info);
```
**Status**: Correct fix. No issues.

### Patch 16/26: drivers: release DPAA bpid on driver destructor
**Status**: Correct. Adds a destructor to release BPIDs allocated by `dpaa_mbuf_create_pool()` that were leaked if the application exited without calling `rte_mempool_free()`. Uses a static per-BPID tracking table and calls the new `bman_free_bpid()` from the destructor. No issues.

---

## Pass 2: Suppress False Positives

Several items initially flagged have been reviewed and determined to be correct or acceptable. These are **omitted** from the final output per the guidelines:

- Patch 06: MAC index parsing via port name instead of type+number is a design choice, not an error.
- Patch 08: Secondary process rejection in dma/dpaa is intentional until secondary can establish its own mapping.
- Patch 18: Devarg parsing helpers are correctly implemented.
- Patch 20: Parsing "drv_sh_if_name" from devargs is correct.

---

## Review Output

### Patch 11/26: bus/dpaa: improve FQ shutdown with channel validation

**Warning**: The comment states that SDQCR subscriptions are restored, but if the drain loop times out the portal SDQCR is still modified from what the caller had programmed. Consider logging a warning that the portal subscription may be stale on timeout.

**Warning**: `QMAN_FQRN_WAIT_MAX` is set to 10,000,000 iterations. On a slow CPU or a stuck FQ this could spin for many seconds blocking the calling thread. The value is reasonable for correctness but may impact latency-sensitive applications. Document this in the commit message or code comment.

**Info**: The loop termination condition is correct: it breaks on `found_fqrn` or after `QMAN_FQRN_WAIT_MAX` iterations, and logs an error on timeout. No correctness issue, but the above warnings apply.

---

### Patch 14/26: net/dpaa: optimize FMC MAC type parsing

**Info**: The function `dpaa_port_fmc_get_idx_from_name()` extracts the MAC index from the FMC port name. The port name is parsed, and on LS104x, MAC9 and MAC10 can have multiple types (10G/2.5G/1G) depending on SerDes configuration, so matching by name is required instead of type + index. This is a design improvement, not a bug fix, but the implementation is correct.

---

### Patch 17/26: dma/dpaa: add devargs for SG and errata workaround

**Info**: The patch gates the existing ERR050757 workaround programming, data validation, and SG batching behind devargs. These features existed before; the patch only makes them configurable. The default behavior for SG and ERR050757 is unchanged (enabled), and data validation is opt-in. The documentation correctly describes the arguments. No issues.

---

### Patch 23/26: net/dpaa: enhance VSP port support

**Warning**: `dpaa_port_vsp_cleanup()` now iterates over `DPAA_VSP_PROFILE_MAX_NUM` instead of `fif->num_profiles` to release profiles outside the current window. This is correct, but if `num_profiles` was intentionally excluding some profiles, this could free resources still in use. Review the use of `DPAA_VSP_PROFILE_MAX_NUM` to ensure it is the intended upper bound.

**Info**: The patch consolidates `vsp_handle[]` and `vsp_bpid[]` into `struct dpaa_if_vsp` with a pool array, and moves the shared-MAC base profile early return up into `dpaa_port_vsp_update()`. The refactoring is sound. No correctness issues.

---

### Patch 24/26: drivers: add offline (O/H) port device support

**Info**: The offline port is a large new feature (845 lines). The error paths in `dpaa_oldev_init()` correctly release resources via `dpaa_oldev_queues_release()`. The ioctl calls to the control device (`ASK_CTRL_GET_OFFLINE_CHANNEL_INFO`, etc.) are gated by `check_fd()` which opens the device on first use and caches the descriptor. The destructor closes it. The API is documented and marked `__rte_experimental`. No correctness issues identified.

---

### Patch 25/26: crypto/dpaa_sec: improve crypto fq resource handling

**Info**: The patch allocates multiple FQIDs in a single ioctl (`qman_alloc_fqid_range()`) instead of one at a time, and adds proper cleanup on error paths. The error paths now call `qman_shutdown_fq()` for each created FQ and `qman_release_fqid_range()` for the allocated FQID block. This is correct. No issues.

---

## Summary

**Correctness bugs found and fixed by the series** (no additional changes needed):
- Patch 01: Avoids double-close and NULL dereference on remove (correct fix)
- Patch 02: Fixes resource leak on probe failure (correct fix)
- Patch 03: Fixes missing tx_conf_queues free on close (correct fix)
- Patch 04: Fixes FQD dest_wq field bit extraction (correct fix)
- Patch 10: Fixes CGRID leak and adds stale FQ cleanup (correct fix)
- Patch 15: Fixes write-after-free in mempool free (correct fix)
- Patch 16: Adds BPID release on destructor to prevent leak (correct fix)

**Warnings** (review recommended, not blocking):
- Patch 11: Consider logging when SDQCR restore is skipped on timeout
- Patch 11: Document the `QMAN_FQRN_WAIT_MAX` spin duration
- Patch 23: Verify that `DPAA_VSP_PROFILE_MAX_NUM` is the correct upper bound for cleanup iteration

**No style, process, or format issues** were found that require changes.

The series is well-structured, fixes real bugs, and adds significant new features (offline port support, configurable devargs for taildrop/FMCLESS/DMA). The code quality is high, and the release notes correctly summarize the changes.