Re: [PATCH v26 00/26] NXP DPAA driver enhancements and fixes

[Stephen Hemminger <stephen@networkplumber.org>]

On Thu, 15 Oct 2026 19:41:18 +0530
Hemant Agrawal <hemant.agrawal@nxp.com> wrote:

> This series collects a set of fixes and enhancements for the NXP DPAA
> bus, mempool, dma, crypto and net drivers targeting 26.11.
> 
> It includes memory-leak and resource-cleanup fixes on the device
> remove/close paths, more robust frame queue shutdown, secondary-process
> safety guards, BPID lifecycle handling, and several new features:
> enhanced virtual storage profile (VSP) port support, fmcless Rx queue
> configuration, non fmX-macY shared Ethernet naming, and DMA
> scatter-gather and errata-workaround devargs. Documentation and release
> notes are updated accordingly.
> 
> v26:
> * bus/dpaa: split the FQ shutdown hang fix out as its own patch with
>   Fixes/Cc: stable, and keep the DTS pool-channel-range scan as a
>   separate feature patch.
> * dma/dpaa: split the data-validation gating out as its own fix with
>   Fixes/Cc: stable, ahead of the SG/errata devargs feature patch.
> * bus/dpaa: fixed "scan max BPID from DTS" commit message to describe
>   the bman_ip_rev removal and the now-fatal missing-node/CCSR-map
>   paths, and moved the BPID range log from pr_info() to
>   DPAA_BUS_DEBUG() so it no longer prints to stdout on every start.
> * net/dpaa: fixed use-after-free in VSP: the per-profile buffer pool
>   is now stored by BPID and size instead of a dpaa_bp_info pointer,
>   which could be freed by dpaa_mbuf_free_pool() while the port was
>   still around.
> * bus/dpaa: stopped bman_release_fast() from writing the verb byte of
>   a multi-entry release command before the rest of the entry is
>   built.
> * dma/dpaa: propagated the enqueue status instead of forcing -EIO on
>   a transient ring-full condition in the non-SG path.
> * crypto/dpaa_sec: affined a portal in dpaa_sec_uninit() before
>   calling qman_shutdown_fq(), and stopped releasing the FQID of a
>   queue that failed to shut down on the probe error paths, matching
>   the rule the normal uninit path already follows.
> * drivers: made the DPAA QDMA secondary-process probe return a
>   positive value instead of -ENOTSUP, so the bus skips the device
>   quietly instead of logging three errors.
> * net/dpaa: dropped the drv_fmcless_rxq devarg; FMCLESS mode now
>   always creates the maximum number of queues and lets
>   rte_eth_dev_configure() decide how many are used.
> * net/dpaa: renamed the global fmlib create_device() and
>   get_device_id() helpers to fm_create_device() and
>   fm_get_device_id(), the only two global symbols in the driver
>   without the fm_/dpaa_ prefix.
> * doc: updated the release notes to match the bullets above instead
>   of the devargs from the previous version.


Semi-automated AI review is still seeing some issues, don't feel it is ready to merge.

Review of [PATCH v26 00/26] NXP DPAA fixes and enhancements

Series applies cleanly to main and every commit builds with
-Dwerror=true.

v25 Error (VSP use after free) and the v25 Warnings on 11, 17, 19,
20, 23 and 24 are addressed. Dropping the drv_sh_if_name and
drv_fmcless_rxq devargs is the right call.


Warning
=======

[PATCH v26 12/26] bus/dpaa: scan pool channel range from DTS

qm_channel_pool_num now comes straight from the DTS and bounds the
pool channel test in qman_shutdown_fq():

  qm_channel_pool_num = rte_be_to_cpu_32(chanid[1]);

The SDQCR pool field is 15 bits, and QM_SDQCR_CHANNELS_POOL_CONV()
computes 0x00008000 >> (channel + 1 - pool1). A count of 16 selects no
channel at all, so the drain never sees the FQRN; a count of 32 or more
is an undefined shift. A count of 0 makes every pool channel FQ fail
as a DCP channel. The old code hardcoded 15. Clamp it the same way 08
clamps the BPID range:

  if (qm_channel_pool_num == 0)
          return -EINVAL;
  if (qm_channel_pool_num > 15) {
          pr_warn("pool-channel-range count %u > 15, clamping\n",
                  qm_channel_pool_num);
          qm_channel_pool_num = 15;
  }

[PATCH v26 20/26] net/dpaa: support fmcless rxq number as devargs

The devarg is gone but the subject and commit message still describe
it ("configured per port through the 'drv_fmcless_rxq' device
argument", "a malformed value fails the probe"). The patch only
changes the FMCLESS default. Suggested message:

  net/dpaa: create max Rx queues in FMCLESS mode

  In FMCLESS mode, create DPAA_MAX_NUM_PCD_QUEUES Rx frame queues
  instead of one per lcore, since several queues may be polled from
  the same core. configure() selects how many are used.

[PATCH v26 24/26] drivers: improve DPAA crypto fq resource handling

The new teardown in dpaa_sec_uninit() and in the init_error paths
shuts down the FQs and releases the FQIDs, but never frees the
qman_fq_lookup_table slot that qman_create_fq() took:

  if (unlikely(find_empty_fq_table_entry(&fq->key, fq))) {

The table has CONFIG_FSL_QMAN_FQ_LOOKUP_MAX (32K) entries and each
probe takes RTE_DPAA_MAX_RX_QUEUE + max_nb_queue_pairs (4098). About
eight remove/probe cycles exhaust it and qman_create_fq() returns
-ENOMEM. Every leaked slot also points into dev_private, which
rte_cryptodev_pmd_destroy() frees.

qman_destroy_fq() clears the slot, but it is not exported and only
does so for an FQ in the oos state, which qman_shutdown_fq() does not
set. Export it with RTE_EXPORT_INTERNAL_SYMBOL, and after each
successful shutdown:

  fq->state = qman_fq_state_oos;
  qman_destroy_fq(fq, 0);

(The FQs are created without QMAN_FQ_FLAG_DYNAMIC_FQID, so this does
not release the FQID a second time.) The same applies to the TXQ in
init_error1 when qman_init_fq() fails after qman_create_fq()
succeeded.


Info
====

[PATCH v26 11/26] bus/dpaa: fix hang on FQ shutdown

Does not cherry-pick onto main without 10, which is not a fix and will
not go to stable. Move it ahead of 10 so stable gets it as-is.

[PATCH v26 25/26] net/dpaa: prefix fmlib device helpers

Two unprefixed globals are still left in net/dpaa:

  drivers/net/dpaa/dpaa_flow.c:37:
    const uint8_t mac_idx[] = {-1, 0, 1, 2, 3, 4, 5, 6, 7, 0, 1};
  drivers/net/dpaa/dpaa_fmc.c:205:
    struct fmc_model_t *g_fmc_model;

mac_idx[] has no users; remove it. g_fmc_model is only used in
dpaa_fmc.c; make it static. Renaming internal symbols does not need a
release note, and "every global symbol of the driver carries a prefix"
does not hold yet. Drop that bullet from 26.

Still open from v25, unchanged, optional:
  04  pre-existing: dpaa_dev_init() error path frees cgr_rx/cgr_tx
      without qman_delete_cgr(); the portal cgr_cbs list keeps the
      freed nodes
  12  QMAN_MAX_FQID, QMAN_CHANNEL_PME and QMAN_CHANNEL_PME_REV3 unused;
      dpaa_get_qm_channel_pool_num() is bus-internal and needs no
      export
  15  FMC_PORT_NAME_OFFLINE branch unreachable; offline/ONIC fifs log
      "Unknown mac_type" at ERR
  21  bm_buffer_get64_from_be() should be a static inline function
  24  fqids[RTE_DPAA_MAX_RX_QUEUE] is 16 KB on the probe stack