|SUCCESS| [v27, 25/25] doc: update release notes with NXP DPAA changes
dpdklab at iol.unh.edu
dpdklab at iol.unh.edu
Fri Oct 16 15:32:56 CEST 2026
Test-Label: ai-code-review
Test-Status: SUCCESS
https://dpdk.org/patch/171519
_AI Code Review_
=== Patch Review: series.patch (via Claude) ===
Review date: 2026-10-16
# DPDK Patch Review
## Patch 01: net/dpaa: fix double close and null deref on remove
**Errors:**
None.
**Warnings:**
None.
**Info:**
The patch fixes:
1. Double-close: `dpaa_eth_dev_close()` called unconditionally then again if state != UNUSED
2. NULL dereference: `eth_dev` dereferenced without checking `rte_eth_dev_allocated()` result
Both are correctness bugs caught by the patch. The fix checks `eth_dev != NULL` before accessing it, closes once only when `state != RTE_ETH_DEV_UNUSED`, and logs the close result before releasing.
---
## Patch 02: net/dpaa: fix probe success when FMC init fails
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct fix: `dpaa_port_fmc_init()` failure jumped to `free_rx` without setting `ret`, returning 0 (success) on failure. Now assigns `ret = num_rx_fqs` to propagate the error.
---
## Patch 03: net/dpaa: fix resource leak on probe failure
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct fix: when the shared Tx SG mempool creation fails, `rte_dpaa_probe()` returned `-ENOMEM` directly, skipping `dpaa_eth_dev_close()` and `rte_eth_dev_release_port()`. The patch adds `close_dev` and `release_port` labels to unwind through cleanup, matching the existing `dpaa_dev_init()` failure path.
---
## Patch 04: net/dpaa: fix free port resources on close
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: `dpaa_eth_dev_close()` returned early for offline (O/H) and ONIC ports before freeing `tx_conf_queues` and `cgr_tx`. The patch adds a `clean_1` label after the port-type-specific code, jumps there for O/H/ONIC, and frees `tx_conf_queues` unconditionally. Also moves the `free_tx` cleanup to the probe error path so `tx_conf_queues` is freed on failure.
---
## Patch 05: bus/dpaa: fix FQD dest wq channel decoding
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct fix: `qman_shutdown_fq()` decoded `dest_wq` as `channel = dest_wq & 0x7; wq = dest_wq >> 3;` but the hardware layout is `wq = bits 2:0, channel = bits 15:3`. The comparison `channel >= qm_channel_pool1 && channel < qm_channel_pool1 + 15` would never match for pool-channel FQs with the swapped encoding. The patch corrects it to `channel = qm_fqd_get_chan(&mcr->queryfq.fqd); wq = qm_fqd_get_wq(&mcr->queryfq.fqd);` using accessor macros that extract the fields in the right order.
---
## Patch 06: bus/dpaa: fix hang on FQ shutdown
**Errors:**
None.
**Warnings:**
None.
**Info:**
The patch fixes three issues in `qman_shutdown_fq()`:
1. Uses `fq->qp` when available instead of always using the calling thread's affine portal, so a queue can be drained on the portal it is bound to.
2. Rejects channels not drainable from software (DCP portal range) and dedicated channels that are not ours with `-EBUSY` instead of spinning forever.
3. Bounds the wait for FQRN by `QMAN_FQRN_WAIT_MAX` instead of `do { } while (!found_fqrn);` and restores the portal SDQCR on every path.
All changes address correctness bugs: unbounded loops, failure to drain, and stale SDQCR state.
---
## Patch 07: mempool/dpaa: fix write after free on pool free
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: `dpaa_mbuf_free_pool()` freed `mp->pool_data` then wrote to `bp_info->bp`, where `bp_info` is `DPAA_MEMPOOL_TO_POOL_INFO(mp)` which is `mp->pool_data`. The fix clears `bp_info->bp = NULL` before `rte_free(bp_info)` and frees `bp_info` directly rather than `mp->pool_data`.
---
## Patch 08: dma/dpaa: fix data validation on the completion path
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: `fsl_qdma_data_validation()` is a byte-by-byte software compare of transferred data that runs on every completion when enabled. The patch gates it behind `s_data_validation`, off by default, so the compare is skipped unless explicitly requested.
---
## Patch 09: net/dpaa: prefix fmlib device helpers
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: `create_device()` and `get_device_id()` are global symbols with no driver prefix, causing clashes when DPDK is linked statically. The patch renames them to `fm_create_device()` and `fm_get_device_id()` to match the `fm_` prefix used by the rest of fmlib.
---
## Patch 10: bus/dpaa: accept QDMA device name in devargs
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: `rte_dpaa_bus_parse()` recognises fmX-macY, fmX-ohY, fmX-onicY and dpaa_sec-N, but not dpaa_qdma-N. A QDMA name therefore falls through to the `fm%u-mac%u sscanf()`, which does not match, returning `-EINVAL`. The documented usage `-a dpaa_bus:dpaa_qdma-1,dpaa_dma_err_check=1` fails in `rte_devargs_parse()` and aborts EAL init. The patch adds a case for `dpaa_qdma-%u`.
---
## Patch 11: bus/dpaa: refine fman naming
**Errors:**
None.
**Warnings:**
None.
**Info:**
Refactoring: renames `ccsr_map` to `memac_map` (it maps the MEMAC register space not generic CCSR) and `bmi_map` to `rx_bmi_map` (to distinguish from TX BMI). No functional change.
---
## Patch 12: bus/dpaa: scan max BPID from DTS
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: the patch derives `bman_pool_max` from the `fsl,bpid-range` device tree property (start + count) instead of from the BMan portal IP revision, clamping to `BMAN_MAX_POOLS` (64) to prevent writing past the SCN registers. Also makes a missing `fsl,bman` node or failed CCSR map fatal instead of only logged.
---
## Patch 13: drivers: add process-type guards for secondary process
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: `dpaa_qdma_probe()` registers `struct fsl_qdma_engine` from shared memory, but `reg_base` in it is a process-private mmap only valid in the primary. A secondary that probes would advertise a dmadev with unmapped MMIO. The patch rejects secondary probe with `-ENOTSUP`. In `rte_dpaa_remove()`, the device count decrement and shared mempool free are primary-only, so a secondary now releases just its local ethdev port and returns.
---
## Patch 14: bus/dpaa: scan pool channel range from DTS
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: `qman_shutdown_fq()` bounds the pool channel range with a hardcoded 15 channels past `qm_channel_pool1`. The patch reads the actual count from `fsl,pool-channel-range` in the device tree and stores it in `qm_channel_pool_num`, exposed via `dpaa_get_qm_channel_pool_num()`. The shutdown path now uses the DTS-derived bound instead of hardcoded 15. Also warns if the DTS start differs from the compiled default.
---
## Patch 15: drivers: add BMI Tx statistics
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: adds support for BMI Tx statistics counters. Extends `fman_if_bmi_stats_*()` to read/reset both Rx and Tx BMI registers, adds `struct dpaa_if_tx_bmi_stats`, and updates xstats with 5 new Tx counters. Handles NULL `regs` and `tx_regs` pointers by reporting zero for unavailable register blocks.
---
## Patch 16: net/dpaa: optimize FM deconfig
**Errors:**
None.
**Warnings:**
None.
**Info:**
Consolidates FM deconfiguration: moves `dpaa_fm_deconfig()` call to a single location after freeing configuration memory, removes duplicate call earlier in `dpaa_eth_dev_close()`, and calls `dpaa_port_vsp_cleanup()` if `num_profiles` is set. No functional change.
---
## Patch 17: net/dpaa: optimize FMC MAC type parsing
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: for ls104xa, MAC9 and MAC10's type can be 10G/2.5G/1G depending on serdes configuration. The old code derived the MAC index from `pport->number + start_idx`, which failed for these MACs. The patch parses the MAC index directly from `pport->name` using `dpaa_port_fmc_get_idx_from_name()` and compares it to `fif->mac_idx`.
---
## Patch 18: drivers: release DPAA bpid on driver destructor
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: a BPID allocated by `dpaa_mbuf_create_pool()` is only returned from `dpaa_mbuf_free_pool()`, so an application that exits without `rte_mempool_free()` leaks it until reboot. The patch tracks allocated BPIDs in a static `s_dpaa_bpid_allocated_flag[]` table and adds an `RTE_FINI_PRIO(dpaa_mpool_finish, 104)` destructor that releases any still in use at exit. Also switches to `rte_zmalloc()` for `bp_info` and uses `FSL_BM_BURST_MAX` for bulk acquire.
---
## Patch 19: dma/dpaa: add devargs for SG and errata workaround
**Errors:**
None.
**Warnings:**
None.
**Info:**
Adds three device arguments:
- `dpaa_dma_sg_disable`: submit each descriptor individually instead of batching
- `dpaa_dma_data_validation`: enable read-back-and-compare helper
- `dpaa_dma_pci_read_disable`: skip ERR050757 source descriptor programming (only with `RTE_DMA_DPAA_ERRATA_ERR050757`)
Also updates dmadev documentation. No functional change when devargs are not used.
---
## Patch 20: net/dpaa: create max Rx queues in FMCLESS mode
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: in FMCLESS mode, the old code created `rte_lcore_count()` Rx queues, assuming one per lcore. The patch creates `DPAA_MAX_NUM_PCD_QUEUES` instead, since several queues may be polled from the same core. `configure()` selects how many are used.
---
## Patch 21: bus/dpaa: optimize DPAA multi-entry buffer pool operations
**Errors:**
None.
**Warnings:**
None.
**Info:**
Adds a big-endian hardware buffer descriptor overlay (`struct bm_hw_buf_desc`) to `bm_buffer` so a release or acquire entry can be built/parsed with one 8-byte access instead of separate 16-bit and 32-bit halves. `bm_buffer_set64_to_be()` writes the whole descriptor in one store, clearing reserved and bpid fields. In the release ring, `bufs[0]` overlaps the verb, so only bpid and address are stored there; the rest are copied in one `memcpy`.
---
## Patch 22: bus/dpaa: improve log macro usages
**Errors:**
None.
**Warnings:**
None.
**Info:**
Refactoring: replaces `DPAA_BUS_LOG(LEVEL, ...)` calls with shorthand macros (`DPAA_BUS_INFO`, `DPAA_BUS_ERR`, `DPAA_BUS_WARN`, `DPAA_BUS_DEBUG`) for consistency. No functional change.
---
## Patch 23: net/dpaa: enhance VSP port support
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct fixes:
1. Maps `fman_onic` to `OH_OFFLINE_PARSING` in `get_rx_port_type()` so ONIC ports get the right port type.
2. Replaces parallel `vsp_handle[]` and `vsp_bpid[]` arrays with one `struct dpaa_if_vsp` per profile, storing bpid and size by value instead of as a pointer to mempool private data (which is freed before the port).
3. Bounds the VSP ID in `dpaa_eth_rx_queue_bp_check()` against `DPAA_VSP_PROFILE_MAX_NUM`.
4. Handles shared-MAC base profile in `dpaa_port_vsp_update()` before freeing handles.
5. Returns `-EINVAL` for bad VSP ID or no profiles.
6. Cleans up all `DPAA_VSP_PROFILE_MAX_NUM` profiles and clears `bp_num`.
---
## Patch 24: drivers: improve DPAA crypto fq resource handling
**Errors:**
None.
**Warnings:**
None.
**Info:**
Correct: releases resources on probe failure and on uninit, allocates FQID ranges with a single ioctl instead of one per FQID, and only releases an FQID if its queue actually shut down (a failed shutdown leaves it live in QMan). Exports `qman_release_fqid_range()` from the bus. Affines a portal in `dpaa_sec_uninit()` before calling `qman_shutdown_fq()`, since it can run on a thread that never did.
---
## Patch 25: doc: update release notes with NXP DPAA changes
**Errors:**
None.
**Warnings:**
None.
**Info:**
Adds a "Updated NXP DPAA drivers" release notes entry with three sub-bullets summarising:
1. FMCLESS mode defaults to max Rx queues per port instead of lcore count
2. fmlib `create_device()` and `get_device_id()` renamed with `fm_` prefix
3. DMA devargs for SG batching, data validation, and ERR050757 control
---
# Summary
This 25-patch series fixes correctness bugs (resource leaks, double-free, use-after-free, unbounded loops, bit field decoding, wrong shutdown portal), improves naming to avoid static linking clashes, adds runtime controls for DMA behaviour, and enhances VSP and BPID management. All patches are correct.
**Review-Result: CLEAN**
More information about the test-report
mailing list