|WARNING| [v17, 23/23] doc: update release notes with NXP DPAA changes

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/170170

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-09-29

# DPAA Patch Series Review

This is a 23-patch series addressing various improvements and fixes for the NXP DPAA drivers. I'll organize my findings by patch and severity level.

---

## Patch 01/23: net/dpaa: fix device remove

**Errors:**
None

**Warnings:**
None

**Info:**
- The patch fixes a double-call to `dpaa_eth_dev_close()` and adds proper error checking. The logic is now clearer and correct.

---

## Patch 02/23: net/dpaa: fix free port resources on close

**Errors:**
None

**Warnings:**
None

**Info:**
- Resource leak fix for `tx_conf_queues`. The allocation is in `dpaa_dev_init()` and now correctly freed in both `dpaa_eth_dev_close()` and on the error paths of `dpaa_dev_init()`.
- The early return from close for offline/ONIC ports is changed to a `goto` to reach the common cleanup, which is the correct fix.

---

## Patch 03/23: bus/dpaa: fix FQD dest wq channel decoding

**Errors:**
None

**Warnings:**
None

**Info:**
- Bit field extraction bug fix. The old code swapped the channel and work queue parts of the descriptor field. The new `qm_fqd_get_chan()` and `qm_fqd_get_wq()` helpers extract the correct bit ranges.

---

## Patch 04/23: bus/dpaa: refine fman naming

**Errors:**
None

**Warnings:**
None

**Info:**
- Renaming for clarity: `ccsr_map` -> `memac_map`, `bmi_map` -> `rx_bmi_map`. No functional change.

---

## Patch 05/23: bus/dpaa: scan max BPID from DTS

**Errors:**

**Potential buffer overflow:**
```c
if (start + count > BMAN_MAX_POOLS) {
    pr_warn("BPID range %u+%u exceeds max %u, clamping\n",
        start, count, BMAN_MAX_POOLS);
    bman_pool_max = BMAN_MAX_POOLS;
}
```
If `start + count` overflows (e.g., `start = UINT32_MAX - 10`, `count = 20`), the comparison is bypassed and `bman_pool_max` is set to a wrapped value. The DTS should not supply such values, but this is still a possible integer overflow.

**Suggested fix:** Check for overflow before the comparison:
```c
if (count > BMAN_MAX_POOLS || start > BMAN_MAX_POOLS - count) {
    pr_warn("BPID range %u+%u exceeds max %u, clamping\n",
        start, count, BMAN_MAX_POOLS);
    bman_pool_max = BMAN_MAX_POOLS;
}
```

**Warnings:**
None

---

## Patch 06/23: drivers: add process-type guards for secondary process

**Errors:**
None

**Warnings:**
None

**Info:**
- Correct secondary process handling. The QDMA probe early-returns for secondary (MMIO pointers are process-private), and `rte_dpaa_remove()` only does primary-only bookkeeping when running as primary.

---

## Patch 07/23: drivers: shutdown DPAA FQ by fq descriptor

**Errors:**
None

**Warnings:**
None

**Info:**
- Passing the full `struct qman_fq` instead of just the FQID allows `qman_shutdown_fq()` to access the channel-affine portal for push-mode Rx queues.

---

## Patch 08/23: drivers: add DPAA cgrid cleanup support

**Errors:**
None

**Warnings:**
None

**Info:**
- Congestion group cleanup: the patch adds `qman_pending_fq_by_cgrid()` to find stale FQs before deleting a CGR, shuts them down, and releases the CGRID range. Error paths in `dpaa_dev_init()` are corrected to delete created CGRs before freeing the arrays.

---

## Patch 09/23: bus/dpaa: improve FQ shutdown with channel validation

**Errors:**
None

**Warnings:**
None

**Info:**
- Channel validation and pool-channel handling are improved. The hardcoded check is replaced with DTS-derived values, and the dedicated vs. pool channel logic is clarified.

---

## Patch 10/23: drivers: add BMI Tx statistics

**Errors:**
None

**Warnings:**
None

**Info:**
- Adds Tx BMI statistics counters, extends `fman_if_bmi_stats_get_all()` to return both Rx and Tx counters, and updates the xstats table.

---

## Patch 11/23: net/dpaa: optimize FM deconfig

**Errors:**
None

**Warnings:**
None

**Info:**
- Consolidates FM deconfig to a single location. The logic is clearer: deconfig is called once from close, after FQ shutdown.

---

## Patch 12/23: net/dpaa: optimize FMC MAC type parsing

**Errors:**
None

**Warnings:**
None

**Info:**
- MAC index identification now uses the port name parsing helper instead of hardcoded MAC type and port number logic, allowing ls104xa MAC9/MAC10 to work correctly.

---

## Patch 13/23: drivers: release DPAA bpid on driver destructor

**Errors:**
None

**Warnings:**
None

**Info:**
- BPID leak fix: allocated BPIDs are now tracked and released from a driver destructor at process teardown.

---

## Patch 14/23: dma/dpaa: add devargs for SG and errata workaround

**Errors:**
None

**Warnings:**
None

**Info:**
- New device arguments to configure scatter-gather batching, data validation, and ERR050757 workaround at runtime. No functional change to the default behavior.

---

## Patch 15/23: net/dpaa: support Rx/Tx taildrop threshold devarg

**Errors:**
None

**Warnings:**
None

**Info:**
- New device arguments `drv_rx_taildrop` and `drv_tx_taildrop` to configure congestion thresholds per port.

---

## Patch 16/23: net/dpaa: support fmcless rxq number as devargs

**Errors:**
None

**Warnings:**
None

**Info:**
- New device argument `drv_fmcless_rxq` to set the number of Rx queues in FMCLESS mode.

---

## Patch 17/23: net/dpaa: support non fmX-macY type of shared Ethernet name

**Errors:**
None

**Warnings:**
None

**Info:**
- New device argument `drv_sh_if_name` to provide the kernel interface name when it differs from `fmX-macY`.

---

## Patch 18/23: bus/dpaa: optimize DPAA multi-entry buffer pool operations

**Errors:**
None

**Warnings:**
None

**Info:**
- Adds `struct bm_hw_buf_desc` overlay to the `bm_buffer` union and new helpers to build/parse descriptors in a single 8-byte access, reducing overhead.

---

## Patch 19/23: bus/dpaa: improve log macro usages

**Errors:**
None

**Warnings:**
None

**Info:**
- Mechanical replacement of `DPAA_BUS_LOG(LEVEL, ...)` with shorthand macros. No functional change.

---

## Patch 20/23: net/dpaa: enhance VSP port support

**Errors:**
None

**Warnings:**
None

**Info:**
- VSP port configuration improvements: adds `fman_onic` handling to `get_rx_port_type()`, replaces parallel `vsp_handle[]`/`vsp_bpid[]` arrays with a single `struct dpaa_if_vsp`, bounds the VSP ID, and fixes cleanup logic.

---

## Patch 21/23: drivers: add offline (O/H) port device support

**Errors:**

**Missing bounds check on MAC index:**
In `drivers/bus/dpaa/base/fman/fman.c`, the following code reads `cell_idx_host` from the device tree and assigns it to `__if->__if.mac_idx` without validating it against `FMAN_MAX_MAC_IDX_NUM`:

```c
cell_idx_host = of_read_number(cell_idx, lenp / sizeof(phandle));
__if->__if.mac_idx = cell_idx_host;
```

The patch adds a bounds check later in the same function for offline ports:

```c
if (cell_idx_host >= FMAN_MAX_MAC_IDX_NUM) {
    FMAN_ERR(-EINVAL, "%s: cell-index(%" PRIu64 ") >= max(%d)",
             oh_node->full_name, cell_idx_host, FMAN_MAX_MAC_IDX_NUM);
    goto err;
}
```

and in `fman_if_init_onic()`:

```c
if (cell_idx_host >= FMAN_MAX_MAC_IDX_NUM) {
    FMAN_ERR(-EINVAL, "%s: cell-index(%" PRIu64 ") >= max(%d)",
             tx_oh_node->full_name, cell_idx_host, FMAN_MAX_MAC_IDX_NUM);
    goto err;
}
```

**However**, there is an earlier assignment to `__if->__if.mac_idx` from `cell_idx_host` (around line 547 in the context of the patch) that does **not** have this check. If `cell_idx_host` is out of range at that earlier point, the assignment proceeds unchecked.

**Suggested fix:** Add the bounds check immediately after reading `cell_idx_host` and before the first assignment to `mac_idx`:

```c
cell_idx_host = of_read_number(cell_idx, lenp / sizeof(phandle));
if (cell_idx_host >= FMAN_MAX_MAC_IDX_NUM) {
    FMAN_ERR(-EINVAL, "%s: cell-index(%" PRIu64 ") >= max(%d)",
             oh_node->full_name, cell_idx_host, FMAN_MAX_MAC_IDX_NUM);
    goto err;
}
__if->__if.mac_idx = cell_idx_host;
```

**Warnings:**
None

**Info:**
- Offline (O/H) port device support is added. The patch includes a new PMD `dpaa_oldev.c` and the `rte_pmd_dpaa_oldev.h` header with experimental APIs for classification and LGW info.

---

## Patch 22/23: crypto/dpaa_sec: improve crypto fq resource handling

**Errors:**
None

**Warnings:**
None

**Info:**
- Crypto FQ resource handling: the patch adds `dpaa_sec_uninit()` to shut down FQs and release FQIDs on device close, and modifies `dpaa_sec_dev_init()` to allocate FQIDs in bulk and clean them up on error paths.

---

## Patch 23/23: doc: update release notes with NXP DPAA changes

**Errors:**
None

**Warnings:**
None

**Info:**
- Release notes are updated to document the new features and device arguments added by this series.

---

## Summary

**Errors (must fix):**

**Patch 05/23:**
- Potential integer overflow in BPID range calculation. Check `start + count` overflow before comparing against `BMAN_MAX_POOLS`.

**Patch 21/23:**
- Missing bounds check on `cell_idx_host` before the first assignment to `__if->__if.mac_idx` in `fman_if_init()`. The check exists for offline and ONIC ports but is missing for the earlier assignment.

**Warnings:**
None after removing false positives.

**Info:**
- The series is generally well structured and addresses multiple resource leaks, error path bugs, and configuration improvements.
- Correctness bugs are properly fixed: resource leaks in patches 02 and 13, the channel decoding bug in patch 03, and the CGR cleanup in patch 08.
- New features and device arguments are documented and added cleanly.