|WARNING| [v23, 27/27] doc: update release notes with NXP DPAA changes

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/170923

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-09

# DPAA Patch Review

## Summary

This is a 27-patch series for DPAA (Data Path Acceleration Architecture) drivers covering correctness bugs, resource cleanup, API improvements, and new features including offline port support.

---

## Patch 1/27: net/dpaa: fix double close and null deref on remove

**Correctness Issues:**

**Error:** Use-after-free in `rte_dpaa_remove()`
- The unconditional `dpaa_eth_dev_close(eth_dev)` call dereferences `eth_dev` before checking if `rte_eth_dev_allocated()` found anything (line 2682).
- If the device was already released, `eth_dev` is NULL and the close call is a NULL pointer dereference.
- The fix correctly guards both the close and the release with a NULL check on `eth_dev` and the state check.

**Error:** Double-close
- The original code called `dpaa_eth_dev_close(eth_dev)` unconditionally at line 2682, then again inside the `if (eth_dev->state != RTE_ETH_DEV_UNUSED)` block at line 2685.
- Both closures tear down the same port, producing undefined behavior on the second call.
- The fix removes the unconditional call and closes only once, inside the state check.

**Correctness Note:**
- The release status is returned because the port must be released regardless of how the close ended. This is the correct pattern.

---

## Patch 2/27: net/dpaa: fix probe success when FMC init fails

**Error:** Error code not propagated
- `dpaa_port_fmc_init()` returns a negative error code in `num_rx_fqs` when it fails.
- The original code jumps to `free_rx` without setting `ret`, so `ret` is still `0` from its initializer, and the probe returns success despite the failure.
- The fix sets `ret = num_rx_fqs;` before the `goto free_rx;`, correctly propagating the error.

---

## Patch 3/27: net/dpaa: fix resource leak on probe failure

**Error:** Resource leak on early return
- When `dpaa_tx_sg_pool` creation fails, the original code returns `-ENOMEM` directly without calling `dpaa_eth_dev_close()` or `rte_eth_dev_release_port()`.
- `dpaa_dev_init()` has already succeeded at that point, so the early return abandons everything it set up (Rx/Tx queues, CGRs, etc.).
- The fix adds `close_dev:` and `release_port:` cleanup labels so the failure path unwinds correctly, matching the existing `dpaa_dev_init()` error handling.

---

## Patch 4/27: net/dpaa: fix free port resources on close

**Error:** Memory leak
- `dpaa_intf->tx_conf_queues` is allocated unconditionally in `dpaa_dev_init()` but never freed.
- `rte_eth_dev_release_port()` does not free it because it is driver-private allocation.
- The fix calls `rte_free(dpaa_intf->tx_conf_queues)` and sets the pointer to NULL in `dpaa_eth_dev_close()`.

**Error:** Early return skips cleanup
- `dpaa_eth_dev_close()` returned early for offline (O/H) and ONIC ports before the common cleanup that frees queue and congestion-group memory.
- The fix adds a `clean_1:` label for the common cleanup path and jumps to it from the offline/ONIC case instead of returning early.

---

## Patch 5/27: bus/dpaa: fix FQD dest wq channel decoding

**Error:** Bit extraction reversed
- The original code extracted channel as `dest_wq & 0x7` and work queue as `dest_wq >> 3`.
- In the hardware descriptor, work queue is bits 2:0 and channel is bits 15:3, so the extraction is backwards.
- This produces a 0-7 channel value that can never match the pool-channel range check, so pool-channel FQs are not drained correctly.
- The fix adds helper functions `qm_fqd_get_chan()` and `qm_fqd_get_wq()` that extract the fields correctly using the hardware layout.

---

## Patch 6/27: bus/dpaa: accept QDMA device name in devargs

**Error:** QDMA devargs rejected
- `rte_dpaa_bus_parse()` does not recognize the `dpaa_qdma-N` name format created by `dpaa_create_device_list()`.
- The name falls through to the `fm%u-mac%u` sscanf, which does not match, so the function returns `-EINVAL`.
- This causes `-a dpaa_bus:dpaa_qdma-1,...` to fail in `rte_devargs_parse()` with "failed to parse device" and abort EAL init.
- The fix adds a `dpaa_qdma-%u` parsing branch that bounds the index against `RTE_DPAA_QDMA_DEVICES`.

---

## Patch 7/27: bus/dpaa: refine fman naming

**Info:** Naming clarification
- Renaming `ccsr_map` to `memac_map` and `bmi_map` to `rx_bmi_map` improves clarity: the former maps MEMAC registers, not generic CCSR, and the latter is specifically the Rx BMI, distinct from Tx BMI.
- This is a readability improvement with no functional change.

---

## Patch 8/27: bus/dpaa: scan max BPID from DTS

**Error:** Hardcoded BPID maximum
- The original code used a hardcoded `bman_pool_max = 64` for all hardware versions.
- The device tree `fsl,bpid-range` property describes the actual available BPID range, which may differ.
- The fix reads the property, bounds the range against `BMAN_MAX_POOLS` (64), and sets `bman_pool_max` accordingly.
- If the range exceeds `BMAN_MAX_POOLS`, the fix caps it at 64 and logs a warning rather than indexing past the end of the depletion mask or SCN registers.

---

## Patch 9/27: drivers: add process-type guards for secondary process

**Error:** dma/dpaa advertises unusable device in secondary
- `struct fsl_qdma_engine` is in shared memory, but `reg_base` in it is a process-private mmap created by the primary.
- A secondary process that probes the device would advertise a dmadev whose MMIO pointers are not valid in its address space.
- The fix returns `-ENOTSUP` from `dpaa_qdma_probe()` when `rte_eal_process_type()` is secondary, deferring the feature until secondary mapping is implemented.

**Correctness Note:** net/dpaa secondary handling
- `rte_dpaa_remove()` now returns early for a secondary process, letting it release only the local ethdev port without touching `dpaa_valid_dev` or `dpaa_tx_sg_pool`, which are primary-owned.
- This is correct: the secondary did not allocate them, so it must not release them.

---

## Patch 10/27: drivers: shutdown DPAA FQ by fq descriptor

**Error:** Wrong portal used for draining
- `qman_shutdown_fq()` always used `get_affine_portal()`, which is the calling thread's portal.
- A frame queue belonging to a different portal cannot be drained that way: `QM_SDQCR_CHANNELS_DEDICATED` only dequeues the portal's own channel.
- The fix takes the FQ descriptor instead of just the fqid, and uses `fq->qp` when available, falling back to the affine portal otherwise.
- This allows a caller that owns the queue to drain it on the portal it is bound to.

---

## Patch 11/27: drivers: add DPAA cgrid cleanup support

**Error:** Congestion group not deleted on close
- CGRs allocated in `dpaa_dev_init()` are never deleted or returned to the allocator.
- A CGR must have no member FQs when it is deleted, but FQs left behind by a previous run are not shut down before the CGR deletion is attempted.
- The fix adds `dpaa_cgr_stale_fq_cleanup()` to find and shut down any stale FQs still linked to the CGR before deleting it, and returns the CGRID range to the allocator after deletion.

**Error:** qman_create_cgr() failure continues probe
- The original code logged a warning when `qman_create_cgr()` failed but continued the probe without tail drop on that queue.
- The fix returns the error from `dpaa_rx_queue_init()` and `dpaa_tx_queue_init()`, failing the probe cleanly.
- The caller's error path deletes one CGR per initialized queue, so a failed `qman_create_cgr()` would have left a dangling pointer in the portal list. The fix unlinks the CGR before returning.

---

## Patch 12/27: bus/dpaa: improve FQ shutdown with channel validation

**Error:** Infinite loop on non-drainable FQ
- The original code spun forever waiting for FQRN when draining a queue scheduled on another portal's dedicated channel.
- `QM_SDQCR_CHANNELS_DEDICATED` only dequeues the calling portal's own channel, so the FQRN would never arrive.
- The fix validates the channel: if it is another portal's dedicated channel (or a DCP portal channel), it returns `-EBUSY` instead of entering the drain loop.

**Error:** Unbounded FQRN wait
- The drain loop had no iteration bound, so a queue that never retires could hang the caller.
- The fix bounds the wait by `QMAN_FQRN_WAIT_MAX` iterations, returning `-EBUSY` if the retire does not complete.

**Correctness Note:** DTS-derived pool channel range
- The fix reads the `pool-channel-range` property from the device tree instead of using a hardcoded value, and validates that the property has two items (start and count).
- This ensures the pool channel check uses the hardware configuration rather than assuming a fixed layout.

---

## Patch 13/27: drivers: add BMI Tx statistics

**Info:** New feature
- Adds BMI Tx statistics counters (`fmbm_tfrc`, `fmbm_tfdc`, `fmbm_tfledc`, `fmbm_tfufdc`, `fmbm_tbdc`) to match the existing Rx counters.
- Extends `fman_if_bmi_stats_get_all()` to read both Rx and Tx registers and report zero for blocks that are not mapped for the port type (offline ports have no MAC Tx BMI).
- This is a feature addition, not a bug fix.

---

## Patch 14/27: net/dpaa: optimize FM deconfig

**Correctness Note:** Consolidation, not a bug
- Moves the `dpaa_fm_deconfig()` call to a single location and removes duplicate checks in the device close path.
- The deconfig is now called before FQ shutdown for FMCLESS shared MAC mode, so ingress traffic is directed to the kernel before the DPDK FQs are torn down.
- This is a cleanup and ordering improvement, not a correctness bug fix in the sense of memory corruption or leaks.

---

## Patch 15/27: net/dpaa: optimize FMC MAC type parsing

**Correctness Note:** Improved parsing
- The original code derived the MAC index from the port type and a hardcoded offset.
- The fix derives it from the port name in the FMC profile, parsing the number from the name string.
- For ls104xa, MAC9 and MAC10 can be 10G/2.5G/1G depending on serdes configuration, so the name-based approach is more robust than assuming a fixed mapping.
- This is a robustness improvement, not a crash or leak fix.

---

## Patch 16/27: mempool/dpaa: fix write after free on pool free

**Error:** Write into freed memory
- `dpaa_mbuf_free_pool()` freed `mp->pool_data` and then wrote to `bp_info->bp`, which is `DPAA_MEMPOOL_TO_POOL_INFO(mp)`, i.e., the same allocation.
- The fix clears `bp_info->bp` before the `rte_free(bp_info)` call, and frees `bp_info` directly rather than the `mp->pool_data` alias.

---

## Patch 17/27: drivers: release DPAA bpid on driver destructor

**Error:** BPID leak
- A BPID allocated by `dpaa_mbuf_create_pool()` is never returned to the kernel allocator unless the application calls `rte_mempool_free()`.
- An application that exits without calling `rte_mempool_free()` leaks the BPID until the board is rebooted.
- The fix adds a driver destructor that tracks allocated BPIDs in a static per-BPID table and releases them at process exit using a new `bman_free_bpid()` helper.

**Correctness Note:** `rte_dpaa_bpid_info` not freed
- The fix leaves `rte_dpaa_bpid_info` (the shared hugepage array) alone. Releasing it when the last local mempool goes away would leave dangling references in Rx queues, and a destructor cannot release it because `rte_eal_cleanup()` detaches EAL memory before destructors run.
- The fix only clears the per-BPID `mp` and `bp` pointers in `rte_dpaa_bpid_info`; the array itself is left to process teardown. This is correct.

---

## Patch 18/27: dma/dpaa: add devargs for SG and errata workaround

**Info:** New feature
- Adds runtime devargs `dpaa_dma_sg_disable`, `dpaa_dma_data_validation`, and `dpaa_dma_pci_read_disable` to control existing driver behavior.
- The data validation and ERR050757 programming were previously always on; the fix gates them behind the devargs.
- This is a feature addition, not a bug fix.

---

## Patch 19/27: net/dpaa: support Rx/Tx taildrop threshold devarg

**Info:** New feature
- Adds `drv_rx_taildrop` and `drv_tx_taildrop` device arguments to set tail drop thresholds per port, replacing the fixed compile-time Rx value and the environment variable for Tx.
- The fix also resets both thresholds to their defaults at the start of `dpaa_dev_init()` so a value configured for one port is not inherited by the next probe.
- This is a feature addition, not a bug fix.

---

## Patch 20/27: net/dpaa: support fmcless rxq number as devargs

**Info:** New feature
- In FMCLESS mode, the default Rx queue count is now the maximum supported per port instead of the lcore count.
- Adds `drv_fmcless_rxq` device argument to override the number of Rx queues at probe time.
- The fix also fails the probe if the argument is malformed, rather than silently using the default.
- This is a feature addition, not a bug fix.

---

## Patch 21/27: net/dpaa: support non fmX-macY type of shared Ethernet name

**Info:** New feature
- Adds `drv_sh_if_name` device argument to provide the kernel Linux interface name for a shared MAC when it differs from the `fmX-macY` name used by DPDK.
- This is a feature addition, not a bug fix.

---

## Patch 22/27: bus/dpaa: optimize DPAA multi-entry buffer pool operations

**Info:** Optimization
- Adds a big-endian hardware buffer descriptor overlay to `struct bm_buffer` so release/acquire entries can be built and parsed with one 8-byte access instead of separate 16-bit and 32-bit fields.
- The `bm_buffer_set64_to_be()` helper clears the reserved byte and bpid field, preventing uninitialized stack content from reaching the hardware ring.
- This is a performance and robustness improvement, not a correctness bug fix in the sense of memory corruption.

---

## Patch 23/27: bus/dpaa: improve log macro usages

**Info:**