|WARNING| [v23, 27/27] doc: update release notes with NXP DPAA changes

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/170923

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-09

# DPAA Patch Series Review

## Summary

This is a 27-patch series for DPAA (Data Plane Acceleration Architecture) drivers fixing resource management, error handling, and adding new features. The patches target bus/dpaa, net/dpaa, dma/dpaa, mempool/dpaa, and crypto/dpaa_sec.

---

## CORRECTNESS BUGS (Errors)

### Patch 01/27: net/dpaa: fix double close and null deref on remove

**Error: NULL pointer dereference**
`rte_dpaa_remove()` calls `dpaa_eth_dev_close(eth_dev)` before checking `eth_dev != NULL`. The first call is unconditional so a NULL `eth_dev` will crash. The fix adds the NULL check before the first call.

**Fixed correctly** -- no further issues in this patch.

---

### Patch 02/27: net/dpaa: fix probe success when FMC init fails

**Error: Wrong error propagation**
The jump to `free_rx` returns `ret = 0` (success) when `dpaa_port_fmc_init()` fails. The fix sets `ret = num_rx_fqs` (the error from FMC init) before the goto.

**Fixed correctly** -- no further issues.

---

### Patch 03/27: net/dpaa: fix resource leak on probe failure

**Error: Early return skips cleanup**
When SG pool creation fails, the old code does `return -ENOMEM` directly after `dpaa_dev_init()` has already succeeded, leaking everything allocated in that function. The fix unwinds through `close_dev:` and `release_port:` labels.

**Fixed correctly** -- no further issues.

---

### Patch 04/27: net/dpaa: fix free port resources on close

**Error: Missing resource release**
`dpaa_intf->tx_conf_queues` is allocated but never freed; leaks on every close and probe failure. The fix adds `rte_free()` and NULL assignment.

The fix also adds a `goto clean_1` for offline/ONIC ports so they jump past the MAC-related cleanup but still reach the common resource release. The `free_rx` label cleanup has changed order: the fix moves CGR release after FQ shutdown (the CGRs should not be freed until the FQs referencing them are gone).

**Fixed correctly** -- no further issues.

---

### Patch 05/27: bus/dpaa: fix FQD dest wq channel decoding

**Error: Wrong bit extraction**
The old code extracted `channel = dest_wq & 0x7` (bits 2:0) and `wq = dest_wq >> 3` (bits 15:3), but the hardware descriptor puts the work queue in bits 2:0 and the channel in bits 15:3. The fix adds accessor helpers `qm_fqd_get_chan()` and `qm_fqd_get_wq()` that shift/mask correctly.

**Fixed correctly** -- no further issues.

---

### Patch 06/27: bus/dpaa: accept QDMA device name in devargs

**Error: Unchecked sscanf parse failure**
`rte_dpaa_bus_parse()` parses `"dpaa_qdma-%u"` but the new code does not check the `sscanf()` return before the range checks on `i`. If sscanf fails (returns 0), the code proceeds with an uninitialized `i`. The fix adds `!= 1` to the condition.

**Fixed correctly** -- the new code checks `sscanf(...) != 1 || i < 1 || i > RTE_DPAA_QDMA_DEVICES`.

---

### Patch 07/27: bus/dpaa: refine fman naming

**No correctness bugs** -- this is a refactoring patch renaming `ccsr_map` to `memac_map` and `bmi_map` to `rx_bmi_map`. No functional change.

---

### Patch 08/27: bus/dpaa: scan max BPID from DTS

**Warning: Potential out-of-bounds**
The code reads `start` and `count` from the DTS `fsl,bpid-range` property and then checks:
```c
if (start + count > BMAN_MAX_POOLS) {
    pr_warn(...);
    bman_pool_max = BMAN_MAX_POOLS;
} else {
    bman_pool_max = start + count;
}
```
This is safe **if** `start + count` does not overflow `uint32_t`. Since `start` and `count` are read as `rte_be32_t` from the DTS, an addition could overflow before the comparison. The clamp to `BMAN_MAX_POOLS` prevents an out-of-bounds write, but the warning would print a wrapped value. In practice the DTS is not malicious so this is **unlikely to occur**.

**Not a real bug in practice** -- the DTS is trusted kernel configuration. The code is safe. (Do not flag.)

---

### Patch 09/27: drivers: add process-type guards for secondary process

**Error: Probe and resource management on resources not owned by secondary**

The commit message explains: `dma/dpaa` allocates `struct fsl_qdma_engine` in shared memory, but the register pointers in it are process-private mmaps from the primary. A secondary that probes would advertise a dmadev whose MMIO is not mapped in its address space. The fix rejects the probe with `-ENOTSUP` for secondaries.

Similarly, `net/dpaa`'s `rte_dpaa_remove()` decrements the global device count and frees the shared Tx SG pool when it reaches zero, but these are only set up by the primary. A secondary must not run that code. The fix adds an early return for secondaries that only releases the local ethdev port.

**Fixed correctly** -- no further issues.

---

### Patch 10/27: drivers: shutdown DPAA FQ by fq descriptor

**No new correctness bugs** -- this refactors `qman_shutdown_fq()` to take `struct qman_fq*` instead of `u32 fqid`, so the caller can pass the portal handle (`fq->qp`) and the function can drain the FQ on that portal if it exists, falling back to the affine portal otherwise. Adds a wrapper `qman_shutdown_fq_by_fqid()` for the one caller that only has an fqid (cleaning up stale queues).

The implementation is correct.

---

### Patch 11/27: drivers: add DPAA cgrid cleanup support

**Error: CGR delete without checking for stale FQs**
The new code deletes Rx and Tx CGRs on device close, but a CGR must have no member FQs left when deleted. An FQ left behind by a previous run is not owned by this process, so the code cannot just call `qman_shutdown_fq()` on it. The fix adds `dpaa_cgr_stale_fq_cleanup()` which scans the FQID space for FQs still referencing the CGR's CGRID range and shuts them down before deleting the CGR.

The new `qman_pending_fq_by_cgrid_range()` function is added to find such FQs. The implementation walks the FQID space (24-bit, up to 0x00FFFFFF), queries each FQ, and checks if it is in the CGRID range. The loop is bounded by `QMAN_MAX_FQID` so it will terminate.

The code correctly releases the allocated CGRIDs with `qman_release_cgrid_range()` after all CGRs are deleted. The probe error path also correctly deletes any created CGRs before releasing the CGRID range, to avoid leaking portal list nodes.

**Fixed correctly** -- the new pattern is sound.

---

### Patch 12/27: bus/dpaa: improve FQ shutdown with channel validation

**Error: FQ scheduled on another portal's dedicated channel**
The old code tried to drain an FQ scheduled on another portal's dedicated channel by setting `SDQCR` to `QM_SDQCR_CHANNELS_DEDICATED`, but that only dequeues **this portal's own channel**, so the FQRN would never arrive and the drain loop would spin forever. The fix returns `-EBUSY` for such FQs. Push-mode Rx queues are exactly this case.

The new code also bounds the FQRN wait loop by `QMAN_FQRN_WAIT_MAX` (10 million iterations) instead of spinning unbounded, so a queue that refuses to retire cannot hang the caller.

The fix reads `pool-channel-range` from the DTS and uses it to validate the FQ's channel, replacing the hardcoded range check.

**Fixed correctly** -- the early `-EBUSY` return prevents the infinite loop, and the bounded wait prevents hangs even if the FQ does enter the drain path but never retires.

---

### Patch 13/27: drivers: add BMI Tx statistics

**No correctness bugs** -- adds Tx BMI statistics registers to the existing read helpers. The code correctly checks for NULL `regs` and `tx_regs` pointers before accessing them, so offline/ONIC ports (which do not have these register blocks) report zero for the stats rather than crashing.

---

### Patch 14/27: net/dpaa: optimize FM deconfig

**No correctness bugs** -- refactors to call `dpaa_fm_deconfig()` once from a single location instead of twice from different paths. The early return for ports without VSPs is moved out of `dpaa_fm_deconfig()` and into its caller, so the function always expects a valid port_handle.

---

### Patch 15/27: net/dpaa: optimize FMC MAC type parsing

**No correctness bugs** -- replaces hardcoded MAC-index-to-port-number arithmetic with parsing the port name from the FMC model. The ls104xa MAC9/MAC10 can be 10G/2.5G/1G depending on serdes config, so the port type can no longer be inferred from the index. The new code calls `dpaa_port_fmc_get_idx_from_name()` which extracts the index from the port name string in the FMC model. The parsing is bounded and returns `-EINVAL` if the name does not match.

---

### Patch 16/27: mempool/dpaa: fix write after free on pool free

**Error: Write into freed memory**
The old code does:
```c
rte_free(mp->pool_data);
bp_info->bp = NULL;
```
But `bp_info` is `DPAA_MEMPOOL_TO_POOL_INFO(mp)`, which is `mp->pool_data`, so the write to `bp_info->bp` happens **after** the allocation has been freed.

The fix clears `bp_info->bp` first, then frees `bp_info` directly (instead of the alias `mp->pool_data`).

**Fixed correctly** -- no write-after-free remains.

---

### Patch 17/27: drivers: release DPAA bpid on driver destructor

**Error: BPID leak at process exit**
A BPID allocated by `dpaa_mbuf_create_pool()` is only returned to the kernel allocator from `dpaa_mbuf_free_pool()`. An application that exits without calling `rte_mempool_free()` leaks the BPID until the board is rebooted. The fix adds a driver destructor (`RTE_FINI_PRIO(..., 104)`) that releases any BPID still marked in use in a static per-BPID table.

The destructor cannot touch the `bman_pool` object because EAL memory may already be unmapped, so the new `bman_free_bpid()` function releases the ID from the recorded flags alone.

`rte_dpaa_bpid_info` is deliberately **not** freed in the destructor because it is EAL memory and `rte_eal_memory_detach()` runs before destructors. In a secondary it is not even a local allocation (the Rx path installs the primary's array), so freeing it would release the primary's live table.

**Fixed correctly** -- the destructor only releases BPIDs, leaving the shared BPID info array to process teardown.

---

### Patch 18/27: dma/dpaa: add devargs for SG and errata workaround

**No correctness bugs** -- adds runtime devargs to control existing driver features (SG batching, data validation, ERR050757 programming). The features already existed; the patch makes them configurable instead of always-on. The default behavior is unchanged (SG batching on, data validation off, ERR050757 on when built with the macro).

---

### Patch 19/27: net/dpaa: support Rx/Tx taildrop threshold devarg

**No correctness bugs** -- adds per-port `drv_rx_taildrop` and `drv_tx_taildrop` device arguments to configure congestion thresholds at probe time. The parsing uses the new `dpaa_get_devargs_int()` helper which returns 1 on success, 0 if the key is absent, and `-EINVAL` on parse error. The code correctly checks the range of the parsed value (long) before narrowing to uint16_t, so a value like 4294967296 is flagged as out-of-range instead of silently truncating to 0.

The thresholds are reset to defaults at the start of `dpaa_dev_init()` so a value from one port is not inherited by the next.

---

### Patch 20/27: net/dpaa: support fmcless rxq number as devargs

**No correctness bugs** -- adds `drv_fmcless_rxq` device argument to set the number of Rx queues in FMCLESS mode. The parsing checks the range before narrowing from long to int. The default is changed from `rte_lcore_count()` to `DPAA_MAX_NUM_PCD_QUEUES` (the hardware maximum) because several queues may run on the same core.

---

### Patch 21/27: net/dpaa: support non fmX-macY type of shared Ethernet name

**No correctness bugs** -- adds `drv_sh_if_name` device argument to provide the kernel Linux interface name for a shared MAC when it differs from the `fmX-macY` DPDK name. The new `dpaa_get_devargs_str()` helper copies the value into a caller-supplied buffer using `rte_strscpy()` which is bounds-checked and NUL-terminates.

---

### Patch 22/27: bus/dpaa: optimize DPAA multi-entry buffer pool operations

**No correctness bugs** -- adds a big-endian overlay `struct bm_hw_buf_desc` to `struct bm_buffer` so the descriptor can be read/written in a single 8-byte access. The new `bm_buffer_set64_to_be()` writes the whole descriptor in one store, which also clears the reserved byte and bpid field so no uninitialized stack content is published. The `bm_buffer_get64_from_be()` macro reads the address back.

When releasing to the ring, entry 0 is written on its own (because copying it would trip the valid bit), entries 1..n-1 are copied in a single memcpy. The same pattern is already used in the old code; the patch just optimizes it.

---

### Patch 23/27: bus/dpaa: improve log macro usages

**No correctness bugs** -- replaces `DPAA_BUS_LOG(LEVEL, ...)` calls with shorthand macros (`DPAA_BUS_INFO`, `DPAA_BUS_ERR`, etc.) for consistency. No functional change.

---

### Patch 24/27: net/dpaa: enhance VSP port support

**Error: VSP ID not bounds-checked before indexing vsp[] array**
The old code indexed `dpaa_intf->vsp[]` with `vsp_id` without checking it against `DPAA_VSP_PROFILE_MAX_NUM`. The ID comes from FMC profile IDs and the DTS vsp-window, so neither is guaranteed to be in range. The fix adds a bounds check in `dpaa_eth_rx_queue_bp_check()` (the first place the array is indexed) and in `dpaa_port_vsp_configure()`. Returns `-EINVAL` if out of range.

The fix also moves the shared-MAC base profile special case from `dpaa_port_vsp_configure()` up into `dpaa_port_vsp_update()`, so the early return happens before any handle is freed.

**Fixed