[PATCH 00/11] net/dpaa2: fixes and improvements

[PATCH 00/11] net/dpaa2: fixes and improvements

[Maxime Leroy]

Various fixes and improvements for the dpaa2 net driver and fslmc bus.

Patches 1-2, 4-5 fix resource leaks on port close and in error paths.

Patch 3 fixes a misleading Rx descriptor limit warning.

Patches 6-7 replace getenv-based configuration with proper devargs
for taildrop and data stashing options. There are still 8 remaining getenv
calls in the driver that should be converted to devargs.
Note: the taildrop disable path has never been reachable until now
and is untested. NXP maintainers should validate this feature.

Patch 8 fixes link status not updating after port stop/start when
link state change interrupts are enabled.
Patch 9 is a minor cleanup in the same area.

Patches 10-11 fix devargs propagation on DPNI hotplug.

Maxime Leroy (11):
  net/dpaa2: fix queue block memory leak on port close
  net/dpaa2: fix rx error queue memory leak on port close
  net/dpaa2: warn on rx descriptor limit only in high perf buffer mode
  net/dpaa2: fix rx error queue leak in alloc error path
  net/dpaa2: fix resource leak on softparser failure
  net/dpaa2: add devargs to disable Rx taildrop
  net/dpaa2: replace data stashing getenv with devargs
  net/dpaa2: fix link not up after port stop/start
  net/dpaa2: use CHECK_INTERVAL macro in set_link_down
  bus/fslmc: fix devargs not propagated on hotplug
  bus/fslmc: remove dead blocklist check in plug path

 drivers/bus/fslmc/fslmc_bus.c           | 12 ++---
 drivers/bus/fslmc/portal/dpaa2_hw_pvt.h | 16 +++---
 drivers/net/dpaa2/dpaa2_ethdev.c        | 69 +++++++++++++++++--------
 drivers/net/dpaa2/dpaa2_ethdev.h        |  3 ++
 drivers/net/dpaa2/mc/fsl_dpni.h         |  6 +++
 5 files changed, 71 insertions(+), 35 deletions(-)

-- 
2.43.0

[PATCH 01/11] net/dpaa2: fix queue block memory leak on port close

[Maxime Leroy]

Commit ae2661c3ea2d ("net/dpaa2: fix queue free cleanup") added
priv->rx_vq[i] = NULL inside the cleanup loop. This NULLs rx_vq[0]
on the first iteration, so the subsequent rte_free(priv->rx_vq[0])
becomes rte_free(NULL) — a no-op — leaking the entire mc_q block
(all RX + TX + TX conf queue structs) on every port close.

Save the base pointer before the loop and free that instead.

Fixes: 46d02eeaaeb8 ("net/dpaa2: fix queue freeing")
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index b3a79f18d3..cef819650b 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -661,6 +661,9 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 
 	/* Queue allocation base */
 	if (priv->rx_vq[0]) {
+		/* Save base pointer before the loop NULLs rx_vq[] entries */
+		void *mc_q = priv->rx_vq[0];
+
 		/* cleaning up queue storage */
 		for (i = 0; i < priv->nb_rx_queues; i++) {
 			dpaa2_q = priv->rx_vq[i];
@@ -691,8 +694,7 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 		}
 
 		/*free memory for all queues (RX+TX) */
-		rte_free(priv->rx_vq[0]);
-		priv->rx_vq[0] = NULL;
+		rte_free(mc_q);
 	}
 }
 
-- 
2.43.0

[PATCH 02/11] net/dpaa2: fix rx error queue memory leak on port close

[Maxime Leroy]

The rx_err_vq is allocated separately with rte_zmalloc() in
dpaa2_alloc_rx_tx_queues(), but dpaa2_free_rx_tx_queues() only frees
its q_storage contents via dpaa2_queue_storage_free() — the struct
dpaa2_queue itself is never freed, leaking memory on every port close.

Add the missing rte_free() and NULL assignment.

Fixes: 46d02eeaaeb8 ("net/dpaa2: fix queue freeing")
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index cef819650b..b75b934b17 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -691,6 +691,8 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 		if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
 			dpaa2_q = priv->rx_err_vq;
 			dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
+			rte_free(priv->rx_err_vq);
+			priv->rx_err_vq = NULL;
 		}
 
 		/*free memory for all queues (RX+TX) */
-- 
2.43.0

[PATCH 03/11] net/dpaa2: warn on rx descriptor limit only in high perf buffer mode

[Maxime Leroy]

The Rx descriptor count warning fires unconditionally when the total
exceeds 11264, but this limit only applies when the DPNI is created
with the high performance buffer option (0x80000000). When using normal
buffers, there is no such limit and the warning is
misleading noise.

Check the DPNI options to only warn when the high performance buffer
mode is active.

Fixes: 35dc25d12792 ("net/dpaa2: warn on high Rx descriptor number")
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 18 +++++++++++-------
 drivers/net/dpaa2/mc/fsl_dpni.h  |  6 ++++++
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index b75b934b17..088a07eba5 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -74,8 +74,9 @@ int dpaa2_timestamp_dynfield_offset = -1;
 
 bool dpaa2_print_parser_result;
 
+/* Rx descriptor limit when DPNI uses high performance buffers */
 #define MAX_NB_RX_DESC		11264
-int total_nb_rx_desc;
+static int total_nb_rx_desc;
 
 int dpaa2_valid_dev;
 struct rte_mempool *dpaa2_tx_sg_pool;
@@ -902,11 +903,13 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	DPAA2_PMD_DEBUG("dev =%p, queue =%d, pool = %p, conf =%p",
 			dev, rx_queue_id, mb_pool, rx_conf);
 
-	total_nb_rx_desc += nb_rx_desc;
-	if (total_nb_rx_desc > MAX_NB_RX_DESC) {
-		DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
-			       MAX_NB_RX_DESC);
-		DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
+	if (priv->options & DPNI_OPT_HIGH_PERF_BUFFER) {
+		total_nb_rx_desc += nb_rx_desc;
+		if (total_nb_rx_desc > MAX_NB_RX_DESC) {
+			DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
+				       MAX_NB_RX_DESC);
+			DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
+		}
 	}
 
 	if (!priv->bp_list || priv->bp_list->mp != mb_pool) {
@@ -1211,7 +1214,8 @@ dpaa2_dev_rx_queue_release(struct rte_eth_dev *dev, uint16_t rx_queue_id)
 	memset(&cfg, 0, sizeof(struct dpni_queue));
 	PMD_INIT_FUNC_TRACE();
 
-	total_nb_rx_desc -= dpaa2_q->nb_desc;
+	if (priv->options & DPNI_OPT_HIGH_PERF_BUFFER)
+		total_nb_rx_desc -= dpaa2_q->nb_desc;
 
 	if (dpaa2_q->cgid != DPAA2_INVALID_CGID) {
 		options = DPNI_QUEUE_OPT_CLEAR_CGID;
diff --git a/drivers/net/dpaa2/mc/fsl_dpni.h b/drivers/net/dpaa2/mc/fsl_dpni.h
index fcc6d4726e..82d6830acc 100644
--- a/drivers/net/dpaa2/mc/fsl_dpni.h
+++ b/drivers/net/dpaa2/mc/fsl_dpni.h
@@ -121,6 +121,12 @@ struct fsl_mc_io;
  * The stashing is enabled by default.
  */
 #define DPNI_OPT_STASHING_DIS			0x002000
+/*
+ * High performance buffer mode.
+ * The total number of Rx descriptors is limited to 11264 in this mode.
+ * When not set, the DPNI uses normal buffers and has no such limit.
+ */
+#define DPNI_OPT_HIGH_PERF_BUFFER		0x80000000
 /**
  * Software sequence maximum layout size
  */
-- 
2.43.0

[PATCH 04/11] net/dpaa2: fix rx error queue leak in alloc error path

[Maxime Leroy]

In dpaa2_alloc_rx_tx_queues(), the fail: path frees the error queue's
q_storage but never frees the rx_err_vq struct itself, which was
separately allocated with rte_zmalloc(). This has been missing since
the error queue was first introduced.

Also replace the DPAAX_RX_ERROR_QUEUE_FLAG check with a direct
priv->rx_err_vq NULL check, which is safe because rx_err_vq is
zero-initialized and only set when the flag is active. This avoids a
NULL dereference if rx_err_vq allocation itself fails and also
simplifies the cleanup in dpaa2_free_rx_tx_queues() for consistency.

As a defensive measure, also add a NULL guard to the
dpaa2_queue_storage_free() macro to prevent NULL pointer dereference from
callers in error paths.

Fixes: 4690a6114ff6 ("net/dpaa2: enable error queues optionally")
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/bus/fslmc/portal/dpaa2_hw_pvt.h | 16 +++++++++-------
 drivers/net/dpaa2/dpaa2_ethdev.c        |  8 +++++---
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h b/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
index 10bc191645..e625a5c035 100644
--- a/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
+++ b/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
@@ -223,13 +223,15 @@ struct swp_active_dqs {
 
 #define dpaa2_queue_storage_free(q, num) \
 ({ \
-	int i; \
-	\
-	for (i = 0; i < (num); i++) { \
-		if ((q)->q_storage[i]) { \
-			dpaa2_free_dq_storage((q)->q_storage[i]); \
-			rte_free((q)->q_storage[i]); \
-			(q)->q_storage[i] = NULL; \
+	if (q) { \
+		int i; \
+		\
+		for (i = 0; i < (num); i++) { \
+			if ((q)->q_storage[i]) { \
+				dpaa2_free_dq_storage((q)->q_storage[i]); \
+				rte_free((q)->q_storage[i]); \
+				(q)->q_storage[i] = NULL; \
+			} \
 		} \
 	} \
 })
diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 088a07eba5..61dcfafff6 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -621,9 +621,11 @@ dpaa2_alloc_rx_tx_queues(struct rte_eth_dev *dev)
 		priv->rx_vq[i--] = NULL;
 	}
 
-	if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
+	if (priv->rx_err_vq) {
 		dpaa2_q = priv->rx_err_vq;
 		dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
+		rte_free(dpaa2_q);
+		priv->rx_err_vq = NULL;
 	}
 
 	rte_free(mc_q);
@@ -689,10 +691,10 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 				priv->tx_conf_vq[i] = NULL;
 			}
 		}
-		if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
+		if (priv->rx_err_vq) {
 			dpaa2_q = priv->rx_err_vq;
 			dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
-			rte_free(priv->rx_err_vq);
+			rte_free(dpaa2_q);
 			priv->rx_err_vq = NULL;
 		}
 
-- 
2.43.0

[PATCH 05/11] net/dpaa2: fix resource leak on softparser failure

[Maxime Leroy]

When soft parser loading or enabling fails during probe, the error
path returns directly instead of going through the init_err label.
This skips dpaa2_dev_close() and leaks all resources allocated during
probe (queues, MAC addresses, extract params).

Fixes: 72ec7a678e70 ("net/dpaa2: add soft parser driver")
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 61dcfafff6..3658e24dd2 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -3164,7 +3164,7 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		if (ret < 0) {
 			DPAA2_PMD_ERR(" Error(%d) in loading softparser",
 				      ret);
-			return ret;
+			goto init_err;
 		}
 
 		ret = dpaa2_eth_enable_wriop_soft_parser(priv,
@@ -3172,7 +3172,7 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		if (ret < 0) {
 			DPAA2_PMD_ERR(" Error(%d) in enabling softparser",
 				      ret);
-			return ret;
+			goto init_err;
 		}
 	}
 
-- 
2.43.0

[PATCH 06/11] net/dpaa2: add devargs to disable Rx taildrop

[Maxime Leroy]

The DPAA2_RX_TAILDROP_OFF flag was defined and checked in
dpaa2_dev_rx_queue_setup(), but never set — making the taildrop
disable path dead code.

Wire it to a new "drv_no_taildrop" devargs, following the existing
pattern (drv_loopback, drv_no_prefetch, etc.).

Also move dpaa2_q->nb_desc assignment before the taildrop if/else
so that the descriptor count is always tracked correctly, regardless
of whether taildrop is enabled or disabled.

Usage: fslmc:dpni.1,drv_no_taildrop=1

Note: the taildrop disable path has never been reachable until now
and is untested. NXP maintainers should validate this feature.

Fixes: 23d6a87ee2ea ("net/dpaa2: add support for tail drop on queue")
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 3658e24dd2..578ad98b8e 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -34,6 +34,7 @@
 #define DRIVER_TX_CONF "drv_tx_conf"
 #define DRIVER_RX_PARSE_ERR_DROP "drv_rx_parse_drop"
 #define DRIVER_ERROR_QUEUE  "drv_err_queue"
+#define DRIVER_NO_TAILDROP  "drv_no_taildrop"
 #define CHECK_INTERVAL         100  /* 100ms */
 #define MAX_REPEAT_TIME        90   /* 9s (90 * 100ms) in total */
 
@@ -929,7 +930,6 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	dpaa2_q = priv->rx_vq[rx_queue_id];
 	dpaa2_q->mb_pool = mb_pool; /**< mbuf pool to populate RX ring. */
 	dpaa2_q->bp_array = rte_dpaa2_bpid_info;
-	dpaa2_q->nb_desc = UINT16_MAX;
 	dpaa2_q->offloads = rx_conf->offloads;
 
 	/*Get the flow id from given VQ id*/
@@ -982,11 +982,12 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 		return ret;
 	}
 
+	dpaa2_q->nb_desc = nb_rx_desc;
+
 	if (!(priv->flags & DPAA2_RX_TAILDROP_OFF)) {
 		struct dpni_taildrop taildrop;
 
 		taildrop.enable = 1;
-		dpaa2_q->nb_desc = nb_rx_desc;
 		/* Private CGR will use tail drop length as nb_rx_desc.
 		 * for rest cases we can use standard byte based tail drop.
 		 * There is no HW restriction, but number of CGRs are limited,
@@ -2932,6 +2933,11 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		DPAA2_PMD_INFO("Rx loopback mode");
 	}
 
+	if (dpaa2_get_devargs(dev->devargs, DRIVER_NO_TAILDROP)) {
+		priv->flags |= DPAA2_RX_TAILDROP_OFF;
+		DPAA2_PMD_INFO("Rx taildrop disabled");
+	}
+
 	/* For secondary processes, the primary has done all the work */
 	if (rte_eal_process_type() != RTE_PROC_PRIMARY) {
 		/* In case of secondary, only burst and ops API need to be
@@ -3418,5 +3424,6 @@ RTE_PMD_REGISTER_PARAM_STRING(NET_DPAA2_PMD_DRIVER_NAME,
 		DRIVER_NO_PREFETCH_MODE "=<int>"
 		DRIVER_TX_CONF "=<int>"
 		DRIVER_RX_PARSE_ERR_DROP "=<int>"
-		DRIVER_ERROR_QUEUE "=<int>");
+		DRIVER_ERROR_QUEUE "=<int>"
+		DRIVER_NO_TAILDROP "=<int>");
 RTE_LOG_REGISTER_DEFAULT(dpaa2_logtype_pmd, NOTICE);
-- 
2.43.0

[PATCH 07/11] net/dpaa2: replace data stashing getenv with devargs

[Maxime Leroy]

Replace the getenv("DPAA2_DATA_STASHING_OFF") call with a proper
devargs option "drv_no_data_stashing", aligned with the existing
DPDK devargs pattern used by drv_loopback, drv_no_prefetch, etc.

  fslmc:dpni.1,drv_no_data_stashing=1

Fixes: c794f2cab6cc ("net/dpaa2: support FLC stashing")
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 11 +++++++++--
 drivers/net/dpaa2/dpaa2_ethdev.h |  3 +++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 578ad98b8e..0a68365de2 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -35,6 +35,7 @@
 #define DRIVER_RX_PARSE_ERR_DROP "drv_rx_parse_drop"
 #define DRIVER_ERROR_QUEUE  "drv_err_queue"
 #define DRIVER_NO_TAILDROP  "drv_no_taildrop"
+#define DRIVER_NO_DATA_STASHING "drv_no_data_stashing"
 #define CHECK_INTERVAL         100  /* 100ms */
 #define MAX_REPEAT_TIME        90   /* 9s (90 * 100ms) in total */
 
@@ -961,7 +962,7 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 		options |= DPNI_QUEUE_OPT_FLC;
 		cfg.flc.stash_control = true;
 		dpaa2_flc_stashing_clear_all(&cfg.flc.value);
-		if (getenv("DPAA2_DATA_STASHING_OFF")) {
+		if (priv->flags & DPAA2_DATA_STASHING_OFF) {
 			dpaa2_flc_stashing_set(DPAA2_FLC_DATA_STASHING, 0,
 				&cfg.flc.value);
 			dpaa2_q->data_stashing_off = 1;
@@ -2938,6 +2939,11 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		DPAA2_PMD_INFO("Rx taildrop disabled");
 	}
 
+	if (dpaa2_get_devargs(dev->devargs, DRIVER_NO_DATA_STASHING)) {
+		priv->flags |= DPAA2_DATA_STASHING_OFF;
+		DPAA2_PMD_INFO("Data stashing disabled");
+	}
+
 	/* For secondary processes, the primary has done all the work */
 	if (rte_eal_process_type() != RTE_PROC_PRIMARY) {
 		/* In case of secondary, only burst and ops API need to be
@@ -3425,5 +3431,6 @@ RTE_PMD_REGISTER_PARAM_STRING(NET_DPAA2_PMD_DRIVER_NAME,
 		DRIVER_TX_CONF "=<int>"
 		DRIVER_RX_PARSE_ERR_DROP "=<int>"
 		DRIVER_ERROR_QUEUE "=<int>"
-		DRIVER_NO_TAILDROP "=<int>");
+		DRIVER_NO_TAILDROP "=<int>"
+		DRIVER_NO_DATA_STASHING "=<int>");
 RTE_LOG_REGISTER_DEFAULT(dpaa2_logtype_pmd, NOTICE);
diff --git a/drivers/net/dpaa2/dpaa2_ethdev.h b/drivers/net/dpaa2/dpaa2_ethdev.h
index 86b3022ddb..4da47a543a 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.h
+++ b/drivers/net/dpaa2/dpaa2_ethdev.h
@@ -97,6 +97,9 @@
  */
 #define DPAA2_TX_DYNAMIC_CONF_ENABLE	RTE_BIT32(9)
 
+/* Disable data stashing (prefetch of packet data into CPU cache) */
+#define DPAA2_DATA_STASHING_OFF		RTE_BIT32(10)
+
 #define DPAAX_RX_ERROR_QUEUE_FLAG	RTE_BIT32(11)
 
 /* DPDMUX index for DPMAC */
-- 
2.43.0

[PATCH 08/11] net/dpaa2: fix link not up after port stop/start

[Maxime Leroy]

When LSC (Link State Change) interrupts are enabled, the link status
is only updated by interrupt events -- rte_eth_link_get_nowait() reads
the cached value without querying the hardware.

During dev_start(), dpaa2_dev_set_link_up() was called immediately
after dpni_enable(), before LSC interrupts were registered. The MAC
needs ~30ms to renegotiate after being re-enabled, so the initial
link query returned link down. By the time the link came up, the LSC
interrupt handler was not yet installed, so the link-up event was
missed and the cached link status remained down permanently.

The issue does not occur on the first dev_start() after probe because
dpni_reset() during probe does not bring the MAC down -- the kernel
dpmac driver keeps the physical link up. Only dpni_disable() during
dev_stop() causes the MAC to go down, requiring a full renegotiation
on the next dpni_enable().

The problem is more likely to occur with many queues: the queue setup
loop (dpni_get_queue for each RX queue) between dpni_enable() and the
LSC interrupt registration adds MC portal round-trips, giving the MAC
more time to complete negotiation before interrupts are armed. This
makes the link-up event more likely to be missed.

Move dpaa2_dev_set_link_up() after the LSC interrupt setup so that
any link-up event occurring during MAC negotiation is properly caught.

Fixes: c5acbb5ea20e ("net/dpaa2: support link status event")
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 0a68365de2..885f43de19 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -1393,9 +1393,6 @@ dpaa2_dev_start(struct rte_eth_dev *dev)
 		return ret;
 	}
 
-	/* Power up the phy. Needed to make the link go UP */
-	dpaa2_dev_set_link_up(dev);
-
 	for (i = 0; i < data->nb_rx_queues; i++) {
 		dpaa2_q = data->rx_queues[i];
 		ret = dpni_get_queue(dpni, CMD_PRI_LOW, priv->token,
@@ -1463,6 +1460,12 @@ dpaa2_dev_start(struct rte_eth_dev *dev)
 		dpaa2_eth_setup_irqs(dev, 1);
 	}
 
+	/* Power up the phy. Needed to make the link go UP.
+	 * Called after LSC interrupt setup so that the link-up
+	 * event is not missed if the MAC negotiates quickly.
+	 */
+	dpaa2_dev_set_link_up(dev);
+
 	/* Change the tx burst function if ordered queues are used */
 	if (priv->en_ordered)
 		dev->tx_pkt_burst = dpaa2_dev_tx_ordered;
-- 
2.43.0

[PATCH 09/11] net/dpaa2: use CHECK_INTERVAL macro in set_link_down

[Maxime Leroy]

Replace hardcoded rte_delay_us(100 * 1000) with
rte_delay_ms(CHECK_INTERVAL) for consistency with the rest of the
driver.

No functional change.

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 885f43de19..888be4e467 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -2355,7 +2355,7 @@ dpaa2_dev_set_link_down(struct rte_eth_dev *dev)
 		}
 		if (dpni_enabled)
 			/* Allow the MC some slack */
-			rte_delay_us(100 * 1000);
+			rte_delay_ms(CHECK_INTERVAL);
 	} while (dpni_enabled && --retries);
 
 	if (!retries) {
-- 
2.43.0

[PATCH 10/11] bus/fslmc: fix devargs not propagated on hotplug

[Maxime Leroy]

When a device is hotplugged via rte_dev_probe(), the EAL adds the
devargs to its global list before calling the bus plug callback.
However, fslmc_bus_plug() never refreshes dev->device.devargs from
the EAL list -- it was only set during the initial bus scan.

As a result, PMD-specific devargs (e.g. drv_no_taildrop) passed
through rte_dev_probe() are silently ignored by the driver.

Refresh devargs from the EAL list in fslmc_bus_plug() before probing,
the same way it is done during the initial bus scan.

Fixes: b5721f271cbf ("bus/fslmc: support DPNI hotplug")
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/bus/fslmc/fslmc_bus.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/bus/fslmc/fslmc_bus.c b/drivers/bus/fslmc/fslmc_bus.c
index abdb0ad50d..a539753649 100644
--- a/drivers/bus/fslmc/fslmc_bus.c
+++ b/drivers/bus/fslmc/fslmc_bus.c
@@ -596,6 +596,11 @@ fslmc_bus_plug(struct rte_device *rte_dev)
 			struct rte_dpaa2_device, device);
 	struct rte_dpaa2_driver *drv;
 
+	/* Refresh devargs from the EAL devargs list, as they may
+	 * have been added after the initial bus scan (e.g. hotplug).
+	 */
+	dev->device.devargs = fslmc_devargs_lookup(dev);
+
 	TAILQ_FOREACH(drv, &rte_fslmc_bus.driver_list, next) {
 		ret = rte_fslmc_match(drv, dev);
 		if (ret)
-- 
2.43.0

[PATCH 11/11] bus/fslmc: remove dead blocklist check in plug path

[Maxime Leroy]

The plug callback is only reached via rte_dev_probe() which adds the
device to the EAL devargs list with RTE_DEV_ALLOWED policy. There is
no way to reach fslmc_bus_plug() with a blocked device, making the
blocklist check dead code.

Remove it.

Fixes: b5721f271cbf ("bus/fslmc: support DPNI hotplug")
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/bus/fslmc/fslmc_bus.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/drivers/bus/fslmc/fslmc_bus.c b/drivers/bus/fslmc/fslmc_bus.c
index a539753649..6be48754e3 100644
--- a/drivers/bus/fslmc/fslmc_bus.c
+++ b/drivers/bus/fslmc/fslmc_bus.c
@@ -612,13 +612,6 @@ fslmc_bus_plug(struct rte_device *rte_dev)
 		if (rte_dev_is_probed(&dev->device))
 			continue;
 
-		if (dev->device.devargs &&
-		    dev->device.devargs->policy == RTE_DEV_BLOCKED) {
-			DPAA2_BUS_DEBUG("%s Blocked, skipping",
-				      dev->device.name);
-			continue;
-		}
-
 		ret = drv->probe(drv, dev);
 		if (ret) {
 			DPAA2_BUS_ERR("Unable to probe");
-- 
2.43.0

Re: [PATCH 10/11] bus/fslmc: fix devargs not propagated on hotplug

[David Marchand]

On Wed, 18 Feb 2026 at 17:06, Maxime Leroy <maxime@leroys.fr> wrote:
>
> When a device is hotplugged via rte_dev_probe(), the EAL adds the
> devargs to its global list before calling the bus plug callback.
> However, fslmc_bus_plug() never refreshes dev->device.devargs from
> the EAL list -- it was only set during the initial bus scan.
>
> As a result, PMD-specific devargs (e.g. drv_no_taildrop) passed
> through rte_dev_probe() are silently ignored by the driver.
>
> Refresh devargs from the EAL list in fslmc_bus_plug() before probing,
> the same way it is done during the initial bus scan.
>
> Fixes: b5721f271cbf ("bus/fslmc: support DPNI hotplug")
> Signed-off-by: Maxime Leroy <maxime@leroys.fr>
> ---
>  drivers/bus/fslmc/fslmc_bus.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/bus/fslmc/fslmc_bus.c b/drivers/bus/fslmc/fslmc_bus.c
> index abdb0ad50d..a539753649 100644
> --- a/drivers/bus/fslmc/fslmc_bus.c
> +++ b/drivers/bus/fslmc/fslmc_bus.c
> @@ -596,6 +596,11 @@ fslmc_bus_plug(struct rte_device *rte_dev)
>                         struct rte_dpaa2_device, device);
>         struct rte_dpaa2_driver *drv;
>
> +       /* Refresh devargs from the EAL devargs list, as they may
> +        * have been added after the initial bus scan (e.g. hotplug).
> +        */
> +       dev->device.devargs = fslmc_devargs_lookup(dev);
> +
>         TAILQ_FOREACH(drv, &rte_fslmc_bus.driver_list, next) {
>                 ret = rte_fslmc_match(drv, dev);
>                 if (ret)

This looks like a strange location for a fix.

The hotplug path calls this bus ->scan() which is supposed to refresh
the devices.
Could you double check if something is wrong on this side?


-- 
David Marchand

Re: [PATCH 11/11] bus/fslmc: remove dead blocklist check in plug path

[David Marchand]

On Wed, 18 Feb 2026 at 17:06, Maxime Leroy <maxime@leroys.fr> wrote:
>
> The plug callback is only reached via rte_dev_probe() which adds the
> device to the EAL devargs list with RTE_DEV_ALLOWED policy. There is
> no way to reach fslmc_bus_plug() with a blocked device, making the
> blocklist check dead code.
>
> Remove it.
>
> Fixes: b5721f271cbf ("bus/fslmc: support DPNI hotplug")
> Signed-off-by: Maxime Leroy <maxime@leroys.fr>

Checking for RTE_DEV_BLOCKED does not seem needed as the scanning part
will affect this bus device list first.
The strange thing is that it is probably consistent with other buses...

The scan/probe code would need some cleanup / consolidation on the EAL
side, but that's a separate topic.

Overall, this change does not seem wrong, my only concern is
disaligning with other buses.


-- 
David Marchand

Re: [PATCH 00/11] net/dpaa2: fixes and improvements

[Stephen Hemminger]

On Wed, 18 Feb 2026 17:04:42 +0100
Maxime Leroy <maxime@leroys.fr> wrote:

> Various fixes and improvements for the dpaa2 net driver and fslmc bus.
> 
> Patches 1-2, 4-5 fix resource leaks on port close and in error paths.
> 
> Patch 3 fixes a misleading Rx descriptor limit warning.
> 
> Patches 6-7 replace getenv-based configuration with proper devargs
> for taildrop and data stashing options. There are still 8 remaining getenv
> calls in the driver that should be converted to devargs.
> Note: the taildrop disable path has never been reachable until now
> and is untested. NXP maintainers should validate this feature.
> 
> Patch 8 fixes link status not updating after port stop/start when
> link state change interrupts are enabled.
> Patch 9 is a minor cleanup in the same area.
> 
> Patches 10-11 fix devargs propagation on DPNI hotplug.

Looks good, shouldn't the patches with Fixes: tag be marked
as Cc: stable@dpdk.org for backport?

Re: [PATCH 00/11] net/dpaa2: fixes and improvements

[Stephen Hemminger]

On Wed, 18 Feb 2026 17:04:42 +0100
Maxime Leroy <maxime@leroys.fr> wrote:

> Various fixes and improvements for the dpaa2 net driver and fslmc bus.
> 
> Patches 1-2, 4-5 fix resource leaks on port close and in error paths.
> 
> Patch 3 fixes a misleading Rx descriptor limit warning.
> 
> Patches 6-7 replace getenv-based configuration with proper devargs
> for taildrop and data stashing options. There are still 8 remaining getenv
> calls in the driver that should be converted to devargs.
> Note: the taildrop disable path has never been reachable until now
> and is untested. NXP maintainers should validate this feature.
> 
> Patch 8 fixes link status not updating after port stop/start when
> link state change interrupts are enabled.
> Patch 9 is a minor cleanup in the same area.
> 
> Patches 10-11 fix devargs propagation on DPNI hotplug.

I decided to ask AI "what remaining bugs are still found by review
after applying these patches"

# dpaa2: remaining issues after Leroy series (v26.03-rc1)

The Leroy 11-patch series covers the resource leak and softparser
cleanup bugs well.  The items below are what is left.

---

## 1. NULL deref and packet leak in dump_err_pkts()  (dpaa2_rxtx.c ~729-746)

Three related problems in the same function:

(a) `mbuf` is NULL-checked on line 729 (`if (mbuf)`) but the very next
    statement dereferences `mbuf->nb_segs` unconditionally — crashes
    when mbuf is NULL.

(b) In the multi-segment path the while-loop walks `mbuf` to NULL, then
    `rte_pktmbuf_free(mbuf)` frees NULL — no-op — so the packet is
    never freed.

(c) `sprintf(title, "Payload seg[%d]", i)` writes into a 32-byte stack
    buffer with no bounds check.

Suggested fix: save the head pointer before iterating, move the hexdump
and free inside the NULL guard, and switch to `snprintf`.

## 2. Unbounded SG chain walk in eth_sg_fd_to_mbuf()  (dpaa2_rxtx.c:334)

```c
while (!DPAA2_SG_IS_FINAL(sge)) {
    sge = &sgt[i++];
    ...
}
```

No upper bound on `i`.  If hardware or corrupt DMA data fails to set
the FINAL bit, this walks past the end of the SGT buffer.  Adding
`&& i < DPAA2_MAX_SGS` to the loop condition is the minimal fix.

## 3. MAC stats path can deref NULL DMA pointers  (dpaa2_ethdev.c ~2005-2024)

`dpaa2_dev_mac_setup_stats()` is void-returning and can fail silently
(malloc or IOVA mapping failure), setting both DMA pointers to NULL.
The caller in `dpaa2_dev_xstats_get()` does not check and proceeds to
pass zero IOVAs to firmware and dereference `cnt_values_dma_mem`.
Either make the setup function return an error code or add a NULL guard
before use.

## 4. sw_td label in dpaa2_dev_tx() may double-free  (dpaa2_rxtx.c ~1516-1523)

At the `sw_td:` label, `bufs` has already been advanced past the
prepared frames and `num_tx` counts packets already handed to HW.
The loop frees `num_tx` packets via `*bufs++`, which are the same
buffers HW will also release — potential double-free.  Needs someone
with the HW context to verify the intended semantics.

## 5. dpaa2_dev_loopback_rx() always returns 0  (dpaa2_rxtx.c:2144)

The function updates internal counters correctly but unconditionally
returns 0, so the framework never sees received traffic.  Should
probably return `num_rx`.

## 6. Burst mode info reports only the first matching offload  (dpaa2_ethdev.c ~464-506)

Both `dpaa2_dev_rx_burst_mode_get()` and the TX variant break out of
the offload loop after the first match.  When multiple offloads are
enabled only the first is shown in `mode->info`.  The loop should
concatenate all matching strings.

Re: [PATCH 10/11] bus/fslmc: fix devargs not propagated on hotplug

[Maxime Leroy]

Le mer. 18 févr. 2026 à 17:45, David Marchand
<david.marchand@redhat.com> a écrit :
>
> On Wed, 18 Feb 2026 at 17:06, Maxime Leroy <maxime@leroys.fr> wrote:
> >
> > When a device is hotplugged via rte_dev_probe(), the EAL adds the
> > devargs to its global list before calling the bus plug callback.
> > However, fslmc_bus_plug() never refreshes dev->device.devargs from
> > the EAL list -- it was only set during the initial bus scan.
> >
> > As a result, PMD-specific devargs (e.g. drv_no_taildrop) passed
> > through rte_dev_probe() are silently ignored by the driver.
> >
> > Refresh devargs from the EAL list in fslmc_bus_plug() before probing,
> > the same way it is done during the initial bus scan.
> >
> > Fixes: b5721f271cbf ("bus/fslmc: support DPNI hotplug")
> > Signed-off-by: Maxime Leroy <maxime@leroys.fr>
> > ---
> >  drivers/bus/fslmc/fslmc_bus.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/drivers/bus/fslmc/fslmc_bus.c b/drivers/bus/fslmc/fslmc_bus.c
> > index abdb0ad50d..a539753649 100644
> > --- a/drivers/bus/fslmc/fslmc_bus.c
> > +++ b/drivers/bus/fslmc/fslmc_bus.c
> > @@ -596,6 +596,11 @@ fslmc_bus_plug(struct rte_device *rte_dev)
> >                         struct rte_dpaa2_device, device);
> >         struct rte_dpaa2_driver *drv;
> >
> > +       /* Refresh devargs from the EAL devargs list, as they may
> > +        * have been added after the initial bus scan (e.g. hotplug).
> > +        */
> > +       dev->device.devargs = fslmc_devargs_lookup(dev);
> > +
> >         TAILQ_FOREACH(drv, &rte_fslmc_bus.driver_list, next) {
> >                 ret = rte_fslmc_match(drv, dev);
> >                 if (ret)
>
> This looks like a strange location for a fix.
>
> The hotplug path calls this bus ->scan() which is supposed to refresh
> the devices.
> Could you double check if something is wrong on this side?
>
Hi David,

rte_fslmc_scan() is guarded by a process_once flag and returns
immediately after the initial bus scan. During hotplug,
local_dev_probe() does call bus->scan(), but it is a no-op -
scan_one_fslmc_device()
(which calls fslmc_devargs_lookup()) is never reached.

The device already exists in the bus device list from the initial
scan, so find_device() succeeds, but its devargs pointer is stale
(NULL).

You are right that insert_in_device_list() does not handle the comp ==
0 case (unlike PCI which refreshes the existing object and frees the
duplicate). Fixing that and removing process_once would allow scan to
properly refresh devargs on rescan.

However it is a larger change: beyond the dedup fix, device_count
would need to be kept consistent, and fslmc_vfio_process_group()
removes infrastructure objects (DPMCP, DPRC, excess DPIO) from the
device list during the initial probe, so a rescan would re-insert them
as new entries that would need to be handled as well.

Making the fslmc bus scan re-entrant is a significant rework of a
critical code path, for a use case (true hotplug of dynamically
created devices) that is not common on NXP platforms.
I think this is best left to the NXP maintainers who know this code
intimately. My use case is grout, which uses the EAL hotplug API to
late-probe devices that already exist in the DPRC at boot time.

That said, you are right that scan is the proper place for this fix.
Rather than making it fully re-entrant, a simpler approach is to
refresh devargs on existing devices when scan is called again:

 if (process_once) {
     DPAA2_BUS_DEBUG("Fslmc bus already scanned. Not rescanning");
     TAILQ_FOREACH(dev, &rte_fslmc_bus.device_list, next)
         dev->device.devargs = fslmc_devargs_lookup(dev);
     return 0;
 }

Let me know what you think of this approach.

-------------------------------
Maxime Leroy
maxime@leroys.fr

Re: [PATCH 00/11] net/dpaa2: fixes and improvements

[Maxime Leroy]

Le mer. 18 févr. 2026 à 18:07, Stephen Hemminger
<stephen@networkplumber.org> a écrit :
>
> On Wed, 18 Feb 2026 17:04:42 +0100
> Maxime Leroy <maxime@leroys.fr> wrote:
>
> > Various fixes and improvements for the dpaa2 net driver and fslmc bus.
> >
> > Patches 1-2, 4-5 fix resource leaks on port close and in error paths.
> >
> > Patch 3 fixes a misleading Rx descriptor limit warning.
> >
> > Patches 6-7 replace getenv-based configuration with proper devargs
> > for taildrop and data stashing options. There are still 8 remaining getenv
> > calls in the driver that should be converted to devargs.
> > Note: the taildrop disable path has never been reachable until now
> > and is untested. NXP maintainers should validate this feature.
> >
> > Patch 8 fixes link status not updating after port stop/start when
> > link state change interrupts are enabled.
> > Patch 9 is a minor cleanup in the same area.
> >
> > Patches 10-11 fix devargs propagation on DPNI hotplug.
>
> Looks good, shouldn't the patches with Fixes: tag be marked
> as Cc: stable@dpdk.org for backport?

Good point, I will send a v2 with Cc: stable@dpdk.org on the patches
with Fixes: tags, and reorder the series (fixes first, then
improvements) to make backporting easier.

Re: [PATCH 02/11] net/dpaa2: fix rx error queue memory leak on port close

[Hemant Agrawal]

On 18-02-2026 21:34, Maxime Leroy wrote:
> The rx_err_vq is allocated separately with rte_zmalloc() in
> dpaa2_alloc_rx_tx_queues(), but dpaa2_free_rx_tx_queues() only frees
> its q_storage contents via dpaa2_queue_storage_free() — the struct
> dpaa2_queue itself is never freed, leaking memory on every port close.
>
> Add the missing rte_free() and NULL assignment.
>
> Fixes: 46d02eeaaeb8 ("net/dpaa2: fix queue freeing")
> Signed-off-by: Maxime Leroy <maxime@leroys.fr>
> ---
>   drivers/net/dpaa2/dpaa2_ethdev.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
> index cef819650b..b75b934b17 100644
> --- a/drivers/net/dpaa2/dpaa2_ethdev.c
> +++ b/drivers/net/dpaa2/dpaa2_ethdev.c
> @@ -691,6 +691,8 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
>   		if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
>   			dpaa2_q = priv->rx_err_vq;
>   			dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
> +			rte_free(priv->rx_err_vq);
> +			priv->rx_err_vq = NULL;
>   		}
>   
>   		/*free memory for all queues (RX+TX) */
Similar change is also required in error handling path of 
dpaa2_alloc_rx_tx_queues

Re: [PATCH 03/11] net/dpaa2: warn on rx descriptor limit only in high perf buffer mode

[Hemant Agrawal]

Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>

Re: [PATCH 02/11] net/dpaa2: fix rx error queue memory leak on port close

[Hemant Agrawal]

On 19-02-2026 16:26, Hemant Agrawal wrote:
>
> On 18-02-2026 21:34, Maxime Leroy wrote:
>> The rx_err_vq is allocated separately with rte_zmalloc() in
>> dpaa2_alloc_rx_tx_queues(), but dpaa2_free_rx_tx_queues() only frees
>> its q_storage contents via dpaa2_queue_storage_free() — the struct
>> dpaa2_queue itself is never freed, leaking memory on every port close.
>>
>> Add the missing rte_free() and NULL assignment.
>>
>> Fixes: 46d02eeaaeb8 ("net/dpaa2: fix queue freeing")
>> Signed-off-by: Maxime Leroy <maxime@leroys.fr>
>> ---
>>   drivers/net/dpaa2/dpaa2_ethdev.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c 
>> b/drivers/net/dpaa2/dpaa2_ethdev.c
>> index cef819650b..b75b934b17 100644
>> --- a/drivers/net/dpaa2/dpaa2_ethdev.c
>> +++ b/drivers/net/dpaa2/dpaa2_ethdev.c
>> @@ -691,6 +691,8 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
>>           if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
>>               dpaa2_q = priv->rx_err_vq;
>>               dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
>> +            rte_free(priv->rx_err_vq);
>> +            priv->rx_err_vq = NULL;
>>           }
>>             /*free memory for all queues (RX+TX) */
> Similar change is also required in error handling path of 
> dpaa2_alloc_rx_tx_queues
ok, you have it covered in 04/11 patch, may be combine this and 04/11 patch

Re: [PATCH 06/11] net/dpaa2: add devargs to disable Rx taildrop

[Hemant Agrawal]

Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>

Re: [PATCH 07/11] net/dpaa2: replace data stashing getenv with devargs

[Hemant Agrawal]

On 18-02-2026 21:34, Maxime Leroy wrote:
> Replace the getenv("DPAA2_DATA_STASHING_OFF") call with a proper
> devargs option "drv_no_data_stashing", aligned with the existing
> DPDK devargs pattern used by drv_loopback, drv_no_prefetch, etc.
>
>    fslmc:dpni.1,drv_no_data_stashing=1
>
> Fixes: c794f2cab6cc ("net/dpaa2: support FLC stashing")
> Signed-off-by: Maxime Leroy <maxime@leroys.fr>
> ---
>   drivers/net/dpaa2/dpaa2_ethdev.c | 11 +++++++++--
>   drivers/net/dpaa2/dpaa2_ethdev.h |  3 +++
>   2 files changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
> index 578ad98b8e..0a68365de2 100644
> --- a/drivers/net/dpaa2/dpaa2_ethdev.c
> +++ b/drivers/net/dpaa2/dpaa2_ethdev.c
> @@ -35,6 +35,7 @@
>   #define DRIVER_RX_PARSE_ERR_DROP "drv_rx_parse_drop"
>   #define DRIVER_ERROR_QUEUE  "drv_err_queue"
>   #define DRIVER_NO_TAILDROP  "drv_no_taildrop"
> +#define DRIVER_NO_DATA_STASHING "drv_no_data_stashing"
>   #define CHECK_INTERVAL         100  /* 100ms */
>   #define MAX_REPEAT_TIME        90   /* 9s (90 * 100ms) in total */
>   
> @@ -961,7 +962,7 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
>   		options |= DPNI_QUEUE_OPT_FLC;
>   		cfg.flc.stash_control = true;
>   		dpaa2_flc_stashing_clear_all(&cfg.flc.value);
> -		if (getenv("DPAA2_DATA_STASHING_OFF")) {
> +		if (priv->flags & DPAA2_DATA_STASHING_OFF) {

I will not like to remove it completely.  Can we OR it priv->flags ?

devargs are good. In most cases DPDK based application has specific set 
of devargs hard coded. They need to re-build if they want different boot 
args.

This is one of the env, which is used by customer to dynamically tune 
the system for performance without the need to re-build their app every 
time.


>   			dpaa2_flc_stashing_set(DPAA2_FLC_DATA_STASHING, 0,
>   				&cfg.flc.value);
>   			dpaa2_q->data_stashing_off = 1;
> @@ -2938,6 +2939,11 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
>   		DPAA2_PMD_INFO("Rx taildrop disabled");
>   	}
>   
> +	if (dpaa2_get_devargs(dev->devargs, DRIVER_NO_DATA_STASHING)) {
> +		priv->flags |= DPAA2_DATA_STASHING_OFF;
> +		DPAA2_PMD_INFO("Data stashing disabled");
> +	}
> +
>   	/* For secondary processes, the primary has done all the work */
>   	if (rte_eal_process_type() != RTE_PROC_PRIMARY) {
>   		/* In case of secondary, only burst and ops API need to be
> @@ -3425,5 +3431,6 @@ RTE_PMD_REGISTER_PARAM_STRING(NET_DPAA2_PMD_DRIVER_NAME,
>   		DRIVER_TX_CONF "=<int>"
>   		DRIVER_RX_PARSE_ERR_DROP "=<int>"
>   		DRIVER_ERROR_QUEUE "=<int>"
> -		DRIVER_NO_TAILDROP "=<int>");
> +		DRIVER_NO_TAILDROP "=<int>"
> +		DRIVER_NO_DATA_STASHING "=<int>");
>   RTE_LOG_REGISTER_DEFAULT(dpaa2_logtype_pmd, NOTICE);
> diff --git a/drivers/net/dpaa2/dpaa2_ethdev.h b/drivers/net/dpaa2/dpaa2_ethdev.h
> index 86b3022ddb..4da47a543a 100644
> --- a/drivers/net/dpaa2/dpaa2_ethdev.h
> +++ b/drivers/net/dpaa2/dpaa2_ethdev.h
> @@ -97,6 +97,9 @@
>    */
>   #define DPAA2_TX_DYNAMIC_CONF_ENABLE	RTE_BIT32(9)
>   
> +/* Disable data stashing (prefetch of packet data into CPU cache) */
> +#define DPAA2_DATA_STASHING_OFF		RTE_BIT32(10)
> +
>   #define DPAAX_RX_ERROR_QUEUE_FLAG	RTE_BIT32(11)
>   
>   /* DPDMUX index for DPMAC */

Re: [PATCH 08/11] net/dpaa2: fix link not up after port stop/start

[Hemant Agrawal]

Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>

Re: [PATCH 09/11] net/dpaa2: use CHECK_INTERVAL macro in set_link_down

[Hemant Agrawal]

Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>

Re: [PATCH 10/11] bus/fslmc: fix devargs not propagated on hotplug

[David Marchand]

Hello,

On Thu, 19 Feb 2026 at 10:06, Maxime Leroy <maxime@leroys.fr> wrote:
> > > diff --git a/drivers/bus/fslmc/fslmc_bus.c b/drivers/bus/fslmc/fslmc_bus.c
> > > index abdb0ad50d..a539753649 100644
> > > --- a/drivers/bus/fslmc/fslmc_bus.c
> > > +++ b/drivers/bus/fslmc/fslmc_bus.c
> > > @@ -596,6 +596,11 @@ fslmc_bus_plug(struct rte_device *rte_dev)
> > >                         struct rte_dpaa2_device, device);
> > >         struct rte_dpaa2_driver *drv;
> > >
> > > +       /* Refresh devargs from the EAL devargs list, as they may
> > > +        * have been added after the initial bus scan (e.g. hotplug).
> > > +        */
> > > +       dev->device.devargs = fslmc_devargs_lookup(dev);
> > > +
> > >         TAILQ_FOREACH(drv, &rte_fslmc_bus.driver_list, next) {
> > >                 ret = rte_fslmc_match(drv, dev);
> > >                 if (ret)
> >
> > This looks like a strange location for a fix.
> >
> > The hotplug path calls this bus ->scan() which is supposed to refresh
> > the devices.
> > Could you double check if something is wrong on this side?
> >
> Hi David,
>
> rte_fslmc_scan() is guarded by a process_once flag and returns
> immediately after the initial bus scan. During hotplug,
> local_dev_probe() does call bus->scan(), but it is a no-op -
> scan_one_fslmc_device()
> (which calls fslmc_devargs_lookup()) is never reached.
>
> The device already exists in the bus device list from the initial
> scan, so find_device() succeeds, but its devargs pointer is stale
> (NULL).
>
> You are right that insert_in_device_list() does not handle the comp ==
> 0 case (unlike PCI which refreshes the existing object and frees the
> duplicate). Fixing that and removing process_once would allow scan to
> properly refresh devargs on rescan.
>
> However it is a larger change: beyond the dedup fix, device_count
> would need to be kept consistent, and fslmc_vfio_process_group()
> removes infrastructure objects (DPMCP, DPRC, excess DPIO) from the
> device list during the initial probe, so a rescan would re-insert them
> as new entries that would need to be handled as well.
>
> Making the fslmc bus scan re-entrant is a significant rework of a
> critical code path, for a use case (true hotplug of dynamically
> created devices) that is not common on NXP platforms.
> I think this is best left to the NXP maintainers who know this code
> intimately. My use case is grout, which uses the EAL hotplug API to
> late-probe devices that already exist in the DPRC at boot time.

Ok, thanks for the explanations.
I agree, it seems too intrusive for fixing this issue.


>
> That said, you are right that scan is the proper place for this fix.
> Rather than making it fully re-entrant, a simpler approach is to
> refresh devargs on existing devices when scan is called again:
>
>  if (process_once) {
>      DPAA2_BUS_DEBUG("Fslmc bus already scanned. Not rescanning");
>      TAILQ_FOREACH(dev, &rte_fslmc_bus.device_list, next)
>          dev->device.devargs = fslmc_devargs_lookup(dev);
>      return 0;
>  }
>
> Let me know what you think of this approach.

That seems a good trade off, as it avoids mixing responsibilities in
this bus code.

What do you think Hemant?


-- 
David Marchand

[PATCH v2 00/17] net/dpaa2: fixes and improvements

[Maxime Leroy]

Various fixes and improvements for the dpaa2 net driver and fslmc bus.

Patches 1-6 fix resource leaks on port close, error paths, link status
and devargs propagation on hotplug.

Patches 7-14 fix additional bugs: spurious VLAN insertion, error packet
dump crash, packet type classification, checksum offload flags, software
taildrop buffer access, burst mode info reporting, SG table walk bounds,
and MAC stats DMA allocation.

Patch 15 is a minor cleanup in the link status area.

Patches 16-17 add devargs alternatives for getenv-based configuration
of taildrop and data stashing options.

Changes since v1:
- Add Cc: stable@dpdk.org on patches with Fixes: tags (Stephen)
- Reorder series: fixes first, then improvements (Stephen)
- Patch 2: squash with former patch 4 (Hemant)
- Patch 6: move devargs refresh from plug to scan rescan path (David)
- Patch 17: keep getenv for backward compatibility, add devargs as
  alternative instead of replacement
- Drop former patch 11 (bus/fslmc: remove dead blocklist check) to
  avoid disaligning with other buses (David)
- New patches 8, 11-14 fixing issues reported by Stephen
- New patches 7, 9-10 fixing VLAN insertion and packet classification
  issues

Maxime Leroy (17):
  net/dpaa2: fix queue block memory leak on port close
  net/dpaa2: fix rx error queue memory leaks
  net/dpaa2: warn on rx descriptor limit only in high perf buffer mode
  net/dpaa2: fix resource leak on softparser failure
  net/dpaa2: fix link not up after port stop/start
  bus/fslmc: fix devargs not propagated on hotplug
  net/dpaa2: fix spurious VLAN insertion on non-VLAN packets
  net/dpaa2: fix error packet dump crash and memory leak
  net/dpaa2: fix L4 packet type classification in slow parse path
  net/dpaa2: fix L3/L4 checksum offload flags
  net/dpaa2: fix software taildrop buffer access
  net/dpaa2: fix burst mode info to report active burst function
  net/dpaa2: add SG table walk upper bound in Rx path
  net/dpaa2: fix MAC stats DMA buffer allocation per xstats call
  net/dpaa2: use CHECK_INTERVAL macro in set_link_down
  net/dpaa2: add devargs to disable Rx taildrop
  net/dpaa2: add devargs alternative for data stashing getenv

 drivers/bus/fslmc/fslmc_bus.c           |   4 +
 drivers/bus/fslmc/portal/dpaa2_hw_pvt.h |  16 +-
 drivers/net/dpaa2/dpaa2_ethdev.c        | 211 ++++++++++++------------
 drivers/net/dpaa2/dpaa2_ethdev.h        |   3 +
 drivers/net/dpaa2/dpaa2_rxtx.c          |  85 +++++-----
 drivers/net/dpaa2/mc/fsl_dpni.h         |   6 +
 6 files changed, 164 insertions(+), 161 deletions(-)

-- 
2.43.0

[PATCH v2 01/17] net/dpaa2: fix queue block memory leak on port close

[Maxime Leroy]

Commit ae2661c3ea2d ("net/dpaa2: fix queue free cleanup") added
priv->rx_vq[i] = NULL inside the cleanup loop. This NULLs rx_vq[0]
on the first iteration, so the subsequent rte_free(priv->rx_vq[0])
becomes rte_free(NULL) — a no-op — leaking the entire mc_q block
(all RX + TX + TX conf queue structs) on every port close.

Save the base pointer before the loop and free that instead.

Fixes: 46d02eeaaeb8 ("net/dpaa2: fix queue freeing")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index b3a79f18d3..cef819650b 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -661,6 +661,9 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 
 	/* Queue allocation base */
 	if (priv->rx_vq[0]) {
+		/* Save base pointer before the loop NULLs rx_vq[] entries */
+		void *mc_q = priv->rx_vq[0];
+
 		/* cleaning up queue storage */
 		for (i = 0; i < priv->nb_rx_queues; i++) {
 			dpaa2_q = priv->rx_vq[i];
@@ -691,8 +694,7 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 		}
 
 		/*free memory for all queues (RX+TX) */
-		rte_free(priv->rx_vq[0]);
-		priv->rx_vq[0] = NULL;
+		rte_free(mc_q);
 	}
 }
 
-- 
2.43.0

[PATCH v2 02/17] net/dpaa2: fix rx error queue memory leaks

[Maxime Leroy]

The rx_err_vq is allocated separately with rte_zmalloc() in
dpaa2_alloc_rx_tx_queues(), but is never properly freed in two paths:

1. On port close: dpaa2_free_rx_tx_queues() only frees the q_storage
contents via dpaa2_queue_storage_free() — the dpaa2_queue struct itself
is never freed, leaking memory on every port close.

2. On allocation error: the fail: path frees the error queue's
   q_storage but never frees the rx_err_vq struct itself, which was
   separately allocated with rte_zmalloc(). This has been missing
   since the error queue was first introduced.

Add the missing rte_free() calls and NULL assignments in both paths.

Also replace the DPAAX_RX_ERROR_QUEUE_FLAG check with a direct
priv->rx_err_vq NULL check, which is safe because rx_err_vq is
zero-initialized and only set when the flag is active. This avoids a
NULL dereference if rx_err_vq allocation itself fails and also
simplifies the cleanup in dpaa2_free_rx_tx_queues() for consistency.

As a defensive measure, also add a NULL guard to the
dpaa2_queue_storage_free() macro to prevent NULL pointer dereference
from callers in error paths.

Fixes: 46d02eeaaeb8 ("net/dpaa2: fix queue freeing")
Fixes: 4690a6114ff6 ("net/dpaa2: enable error queues optionally")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/bus/fslmc/portal/dpaa2_hw_pvt.h | 16 +++++++++-------
 drivers/net/dpaa2/dpaa2_ethdev.c        |  8 ++++++--
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h b/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
index 10bc191645..e625a5c035 100644
--- a/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
+++ b/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
@@ -223,13 +223,15 @@ struct swp_active_dqs {
 
 #define dpaa2_queue_storage_free(q, num) \
 ({ \
-	int i; \
-	\
-	for (i = 0; i < (num); i++) { \
-		if ((q)->q_storage[i]) { \
-			dpaa2_free_dq_storage((q)->q_storage[i]); \
-			rte_free((q)->q_storage[i]); \
-			(q)->q_storage[i] = NULL; \
+	if (q) { \
+		int i; \
+		\
+		for (i = 0; i < (num); i++) { \
+			if ((q)->q_storage[i]) { \
+				dpaa2_free_dq_storage((q)->q_storage[i]); \
+				rte_free((q)->q_storage[i]); \
+				(q)->q_storage[i] = NULL; \
+			} \
 		} \
 	} \
 })
diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index cef819650b..eb8333458e 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -620,9 +620,11 @@ dpaa2_alloc_rx_tx_queues(struct rte_eth_dev *dev)
 		priv->rx_vq[i--] = NULL;
 	}
 
-	if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
+	if (priv->rx_err_vq) {
 		dpaa2_q = priv->rx_err_vq;
 		dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
+		rte_free(dpaa2_q);
+		priv->rx_err_vq = NULL;
 	}
 
 	rte_free(mc_q);
@@ -688,9 +690,11 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 				priv->tx_conf_vq[i] = NULL;
 			}
 		}
-		if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
+		if (priv->rx_err_vq) {
 			dpaa2_q = priv->rx_err_vq;
 			dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
+			rte_free(dpaa2_q);
+			priv->rx_err_vq = NULL;
 		}
 
 		/*free memory for all queues (RX+TX) */
-- 
2.43.0

[PATCH v2 03/17] net/dpaa2: warn on rx descriptor limit only in high perf buffer mode

[Maxime Leroy]

The Rx descriptor count warning fires unconditionally when the total
exceeds 11264, but this limit only applies when the DPNI is created
with the high performance buffer option (0x80000000). When using normal
buffers, there is no such limit and the warning is
misleading noise.

Check the DPNI options to only warn when the high performance buffer
mode is active.

Fixes: 35dc25d12792 ("net/dpaa2: warn on high Rx descriptor number")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 18 +++++++++++-------
 drivers/net/dpaa2/mc/fsl_dpni.h  |  6 ++++++
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index eb8333458e..61dcfafff6 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -74,8 +74,9 @@ int dpaa2_timestamp_dynfield_offset = -1;
 
 bool dpaa2_print_parser_result;
 
+/* Rx descriptor limit when DPNI uses high performance buffers */
 #define MAX_NB_RX_DESC		11264
-int total_nb_rx_desc;
+static int total_nb_rx_desc;
 
 int dpaa2_valid_dev;
 struct rte_mempool *dpaa2_tx_sg_pool;
@@ -904,11 +905,13 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	DPAA2_PMD_DEBUG("dev =%p, queue =%d, pool = %p, conf =%p",
 			dev, rx_queue_id, mb_pool, rx_conf);
 
-	total_nb_rx_desc += nb_rx_desc;
-	if (total_nb_rx_desc > MAX_NB_RX_DESC) {
-		DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
-			       MAX_NB_RX_DESC);
-		DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
+	if (priv->options & DPNI_OPT_HIGH_PERF_BUFFER) {
+		total_nb_rx_desc += nb_rx_desc;
+		if (total_nb_rx_desc > MAX_NB_RX_DESC) {
+			DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
+				       MAX_NB_RX_DESC);
+			DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
+		}
 	}
 
 	if (!priv->bp_list || priv->bp_list->mp != mb_pool) {
@@ -1213,7 +1216,8 @@ dpaa2_dev_rx_queue_release(struct rte_eth_dev *dev, uint16_t rx_queue_id)
 	memset(&cfg, 0, sizeof(struct dpni_queue));
 	PMD_INIT_FUNC_TRACE();
 
-	total_nb_rx_desc -= dpaa2_q->nb_desc;
+	if (priv->options & DPNI_OPT_HIGH_PERF_BUFFER)
+		total_nb_rx_desc -= dpaa2_q->nb_desc;
 
 	if (dpaa2_q->cgid != DPAA2_INVALID_CGID) {
 		options = DPNI_QUEUE_OPT_CLEAR_CGID;
diff --git a/drivers/net/dpaa2/mc/fsl_dpni.h b/drivers/net/dpaa2/mc/fsl_dpni.h
index fcc6d4726e..82d6830acc 100644
--- a/drivers/net/dpaa2/mc/fsl_dpni.h
+++ b/drivers/net/dpaa2/mc/fsl_dpni.h
@@ -121,6 +121,12 @@ struct fsl_mc_io;
  * The stashing is enabled by default.
  */
 #define DPNI_OPT_STASHING_DIS			0x002000
+/*
+ * High performance buffer mode.
+ * The total number of Rx descriptors is limited to 11264 in this mode.
+ * When not set, the DPNI uses normal buffers and has no such limit.
+ */
+#define DPNI_OPT_HIGH_PERF_BUFFER		0x80000000
 /**
  * Software sequence maximum layout size
  */
-- 
2.43.0

[PATCH v2 04/17] net/dpaa2: fix resource leak on softparser failure

[Maxime Leroy]

When soft parser loading or enabling fails during probe, the error
path returns directly instead of going through the init_err label.
This skips dpaa2_dev_close() and leaks all resources allocated during
probe (queues, MAC addresses, extract params).

Fixes: 72ec7a678e70 ("net/dpaa2: add soft parser driver")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 61dcfafff6..3658e24dd2 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -3164,7 +3164,7 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		if (ret < 0) {
 			DPAA2_PMD_ERR(" Error(%d) in loading softparser",
 				      ret);
-			return ret;
+			goto init_err;
 		}
 
 		ret = dpaa2_eth_enable_wriop_soft_parser(priv,
@@ -3172,7 +3172,7 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		if (ret < 0) {
 			DPAA2_PMD_ERR(" Error(%d) in enabling softparser",
 				      ret);
-			return ret;
+			goto init_err;
 		}
 	}
 
-- 
2.43.0

[PATCH v2 05/17] net/dpaa2: fix link not up after port stop/start

[Maxime Leroy]

When LSC (Link State Change) interrupts are enabled, the link status
is only updated by interrupt events -- rte_eth_link_get_nowait() reads
the cached value without querying the hardware.

During dev_start(), dpaa2_dev_set_link_up() was called immediately
after dpni_enable(), before LSC interrupts were registered. The MAC
needs ~30ms to renegotiate after being re-enabled, so the initial
link query returned link down. By the time the link came up, the LSC
interrupt handler was not yet installed, so the link-up event was
missed and the cached link status remained down permanently.

The issue does not occur on the first dev_start() after probe because
dpni_reset() during probe does not bring the MAC down -- the kernel
dpmac driver keeps the physical link up. Only dpni_disable() during
dev_stop() causes the MAC to go down, requiring a full renegotiation
on the next dpni_enable().

The problem is more likely to occur with many queues: the queue setup
loop (dpni_get_queue for each RX queue) between dpni_enable() and the
LSC interrupt registration adds MC portal round-trips, giving the MAC
more time to complete negotiation before interrupts are armed. This
makes the link-up event more likely to be missed.

Move dpaa2_dev_set_link_up() after the LSC interrupt setup so that
any link-up event occurring during MAC negotiation is properly caught.

Fixes: c5acbb5ea20e ("net/dpaa2: support link status event")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 3658e24dd2..e58b93c564 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -1391,9 +1391,6 @@ dpaa2_dev_start(struct rte_eth_dev *dev)
 		return ret;
 	}
 
-	/* Power up the phy. Needed to make the link go UP */
-	dpaa2_dev_set_link_up(dev);
-
 	for (i = 0; i < data->nb_rx_queues; i++) {
 		dpaa2_q = data->rx_queues[i];
 		ret = dpni_get_queue(dpni, CMD_PRI_LOW, priv->token,
@@ -1461,6 +1458,12 @@ dpaa2_dev_start(struct rte_eth_dev *dev)
 		dpaa2_eth_setup_irqs(dev, 1);
 	}
 
+	/* Power up the phy. Needed to make the link go UP.
+	 * Called after LSC interrupt setup so that the link-up
+	 * event is not missed if the MAC negotiates quickly.
+	 */
+	dpaa2_dev_set_link_up(dev);
+
 	/* Change the tx burst function if ordered queues are used */
 	if (priv->en_ordered)
 		dev->tx_pkt_burst = dpaa2_dev_tx_ordered;
-- 
2.43.0

[PATCH v2 06/17] bus/fslmc: fix devargs not propagated on hotplug

[Maxime Leroy]

When a device is hotplugged via rte_dev_probe(), the EAL adds the
devargs to its global list before calling the bus scan and then probe.
However, when the fslmc bus is rescanned, it returns early without
refreshing devargs on existing devices.

As a result, PMD-specific devargs (e.g. drv_no_taildrop) passed
through rte_dev_probe() are silently ignored by the driver.

Refresh devargs from the EAL list on all existing devices when rescan
is triggered, before returning early.

Fixes: b5721f271cbf ("bus/fslmc: support DPNI hotplug")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/bus/fslmc/fslmc_bus.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bus/fslmc/fslmc_bus.c b/drivers/bus/fslmc/fslmc_bus.c
index abdb0ad50d..d058441a3f 100644
--- a/drivers/bus/fslmc/fslmc_bus.c
+++ b/drivers/bus/fslmc/fslmc_bus.c
@@ -322,7 +322,11 @@ rte_fslmc_scan(void)
 	char *group_name;
 
 	if (process_once) {
+		struct rte_dpaa2_device *dev;
+
 		DPAA2_BUS_DEBUG("Fslmc bus already scanned. Not rescanning");
+		TAILQ_FOREACH(dev, &rte_fslmc_bus.device_list, next)
+			dev->device.devargs = fslmc_devargs_lookup(dev);
 		return 0;
 	}
 	process_once = 1;
-- 
2.43.0

[PATCH v2 07/17] net/dpaa2: fix spurious VLAN insertion on non-VLAN packets

[Maxime Leroy]

The VLAN insert check in dpaa2_dev_tx() tested the per-packet flag
OR the port-level txmode offload:

  if (ol_flags & RTE_MBUF_F_TX_VLAN ||
      txmode.offloads & RTE_ETH_TX_OFFLOAD_VLAN_INSERT)

When VLAN_INSERT is enabled in txmode, this causes rte_vlan_insert()
to be called on every packet regardless of the per-packet flag, inserting
a VLAN header with whatever stale value is in vlan_tci (typically 0).

The port-level offload only advertises the capability. The actual trigger
must be the per-packet RTE_MBUF_F_TX_VLAN flag, as done by every other
DPDK driver (Intel, mlx5, virtio, vhost, af_packet, etc.).

Fixes: 9e5c3d3c7778 ("net/dpaa2: support VLAN insert offload")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 7cbd3f33ae..5a98f295a7 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -1346,10 +1346,8 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 				    priv->bp_list->dpaa2_ops_index &&
 				    (*bufs)->nb_segs == 1 &&
 				    rte_mbuf_refcnt_read((*bufs)) == 1)) {
-					if (unlikely(((*bufs)->ol_flags
-						& RTE_MBUF_F_TX_VLAN) ||
-						(eth_data->dev_conf.txmode.offloads
-						& RTE_ETH_TX_OFFLOAD_VLAN_INSERT))) {
+					if (unlikely((*bufs)->ol_flags
+						& RTE_MBUF_F_TX_VLAN)) {
 						ret = rte_vlan_insert(bufs);
 						if (ret)
 							goto send_n_return;
@@ -1402,9 +1400,7 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 				goto send_n_return;
 			}
 
-			if (unlikely(((*bufs)->ol_flags & RTE_MBUF_F_TX_VLAN) ||
-				(eth_data->dev_conf.txmode.offloads
-				& RTE_ETH_TX_OFFLOAD_VLAN_INSERT))) {
+			if (unlikely((*bufs)->ol_flags & RTE_MBUF_F_TX_VLAN)) {
 				int ret = rte_vlan_insert(bufs);
 				if (ret)
 					goto send_n_return;
-- 
2.43.0

[PATCH v2 08/17] net/dpaa2: fix error packet dump crash and memory leak

[Maxime Leroy]

Fix three bugs in dump_err_pkts():

1. NULL pointer dereference: mbuf was checked for NULL but then
   dereferenced unconditionally on the next line.

2. Memory leak on multi-segment packets: the while loop walked
   mbuf to NULL, so the subsequent rte_pktmbuf_free(mbuf) was a
   no-op and the packet was never freed. Use a separate iterator
   variable and free the original mbuf pointer.

3. Segment index not reset between packets: variable i was
   initialized once at function scope and never reset inside the
   do/while loop, so hexdump titles had wrong segment numbers.
   Make it local to the multi-segment block.

Not tested, found by code review.

Fixes: 8b49427e73 ("net/dpaa2: add Rx error queue support")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 31 +++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 5a98f295a7..0de52cbef2 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -651,7 +651,7 @@ dump_err_pkts(struct dpaa2_queue *dpaa2_q)
 	const struct qbman_fd *fd;
 	struct qbman_pull_desc pulldesc;
 	struct rte_eth_dev_data *eth_data = dpaa2_q->eth_data;
-	uint32_t lcore_id = rte_lcore_id(), i = 0;
+	uint32_t lcore_id = rte_lcore_id();
 	void *v_addr, *hw_annot_addr;
 	struct dpaa2_fas *fas;
 	struct rte_mbuf *mbuf;
@@ -726,24 +726,27 @@ dump_err_pkts(struct dpaa2_queue *dpaa2_q)
 			DPAA2_GET_FD_OFFSET(fd), DPAA2_GET_FD_ERR(fd),
 			fas->status);
 
-		if (mbuf)
+		if (mbuf) {
 			__rte_mbuf_sanity_check(mbuf, 1);
-		if (mbuf->nb_segs > 1) {
-			while (mbuf) {
-				sprintf(title, "Payload seg[%d]", i);
-				rte_hexdump(stderr, title,
+			if (mbuf->nb_segs > 1) {
+				struct rte_mbuf *seg = mbuf;
+				int i = 0;
+
+				while (seg) {
+					sprintf(title, "Payload seg[%d]", i);
+					rte_hexdump(stderr, title,
+						(char *)seg->buf_addr + seg->data_off,
+						seg->data_len);
+					seg = seg->next;
+					i++;
+				}
+			} else {
+				rte_hexdump(stderr, "Payload",
 					(char *)mbuf->buf_addr + mbuf->data_off,
 					mbuf->data_len);
-				mbuf = mbuf->next;
-				i++;
 			}
-		} else {
-			rte_hexdump(stderr, "Payload",
-				(char *)mbuf->buf_addr + mbuf->data_off,
-				mbuf->data_len);
+			rte_pktmbuf_free(mbuf);
 		}
-
-		rte_pktmbuf_free(mbuf);
 		dq_storage++;
 		num_rx++;
 	} while (pending);
-- 
2.43.0

[PATCH v2 09/17] net/dpaa2: fix L4 packet type classification in slow parse path

[Maxime Leroy]

RTE_PTYPE_L4_* values are not independent bits but mutually exclusive
values in a single field. The code set RTE_PTYPE_L4_NONFRAG (0x600)
first then OR'd the specific L4 type on top, corrupting the result:
- TCP: 0x600 | 0x100 = 0x700 (undefined)
- UDP: 0x600 | 0x200 = 0x600 (UDP lost, still NONFRAG)
- SCTP: 0x600 | 0x400 = 0x600 (SCTP lost, still NONFRAG)
- ICMP: 0x600 | 0x500 = 0x700 (undefined)

Move RTE_PTYPE_L4_NONFRAG to the final else fallback so it is only
set when no known L4 protocol is identified, matching how
rte_net_get_ptype() handles L4 classification.

Also remove the L3_IP_UNKNOWN_PROTOCOL check that OR'd
RTE_PTYPE_UNKNOWN (0x0), which was a no-op. That case is now
correctly covered by the NONFRAG fallback.

Not tested, found by code review.

Fixes: 5765e0b7c875 ("net/dpaa2: add parse function for LX2 device")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 0de52cbef2..9c908f87b1 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -212,24 +212,18 @@ dpaa2_dev_rx_parse_slow(struct rte_mbuf *mbuf,
 	    L3_IP_N_MORE_FRAGMENT)) {
 		pkt_type |= RTE_PTYPE_L4_FRAG;
 		goto parse_done;
-	} else {
-		pkt_type |= RTE_PTYPE_L4_NONFRAG;
 	}
 
 	if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_UDP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_UDP;
-
 	else if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_TCP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_TCP;
-
 	else if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_SCTP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_SCTP;
-
 	else if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_ICMP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_ICMP;
-
-	else if (BIT_ISSET_AT_POS(annotation->word4, L3_IP_UNKNOWN_PROTOCOL))
-		pkt_type |= RTE_PTYPE_UNKNOWN;
+	else
+		pkt_type |= RTE_PTYPE_L4_NONFRAG;
 
 parse_done:
 	return pkt_type;
-- 
2.43.0

[PATCH v2 10/17] net/dpaa2: fix L3/L4 checksum offload flags

[Maxime Leroy]

The WRIOP FAS (Frame Annotation Status) field provides independent
bits for L3/L4 checksum validation (L3CV/L4CV) and error (L3CE/L4CE).

Two problems:

1. The driver used 'else if' between the L3 and L4 error checks, so
   when both checksums were bad only the L3 error was reported and
   the L4 error was silently lost. Use two independent 'if' statements
   instead, matching how other drivers (i40e, ixgbe, bnxt) handle this.

2. The driver never reported GOOD checksums. When validation was
   performed (L3CV/L4CV set) but no error was flagged (L3CE/L4CE
   clear), report RTE_MBUF_F_RX_IP_CKSUM_GOOD / RTE_MBUF_F_RX_L4_CKSUM_GOOD.

Fix both issues in dpaa2_dev_rx_parse_slow() and dpaa2_dev_rx_parse().

Not tested, found by code review.

Cc: stable@dpdk.org
Fixes: 870354264644 ("net/dpaa2: fix L3/L4 checksum results")

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 9c908f87b1..689e5e7ee7 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -203,8 +203,13 @@ dpaa2_dev_rx_parse_slow(struct rte_mbuf *mbuf,
 
 	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_BAD;
-	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_GOOD;
+
+	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_BAD;
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_GOOD;
 
 	if (BIT_ISSET_AT_POS(annotation->word4, L3_IP_1_FIRST_FRAGMENT |
 	    L3_IP_1_MORE_FRAGMENT |
@@ -240,8 +245,13 @@ dpaa2_dev_rx_parse(struct rte_mbuf *mbuf, void *hw_annot_addr)
 
 	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_BAD;
-	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_GOOD;
+
+	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_BAD;
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_GOOD;
 
 	if (unlikely(dpaa2_print_parser_result))
 		dpaa2_print_parse_result(annotation);
-- 
2.43.0

[PATCH v2 11/17] net/dpaa2: fix software taildrop buffer access

[Maxime Leroy]

The sw_td path in dpaa2_dev_tx() reads from the wrong position in the
bufs array. When the goto fires, bufs has already been advanced past
the num_tx successfully sent packets. The first loop then reads num_tx
more entries starting from bufs, going past the end of the input array.
Additionally, the buf_to_free segments for already-enqueued packets
are never freed, leaking memory.

Replace the buggy sw_td code with the same pattern used in
dpaa2_dev_tx_ordered(): free buf_to_free segments first, then use
rte_pktmbuf_free_bulk() to drop remaining unsent packets.

Not tested, found by code review.

Cc: stable@dpdk.org
Fixes: c3ffe74d85be ("net/dpaa2: support software taildrop")

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 689e5e7ee7..8275ba9780 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -1517,21 +1517,15 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 
 	return num_tx;
 sw_td:
-	loop = 0;
-	while (loop < num_tx) {
-		if (unlikely(RTE_MBUF_HAS_EXTBUF(*bufs)))
-			rte_pktmbuf_free(*bufs);
-		bufs++;
-		loop++;
+	for (loop = 0; loop < free_count; loop++) {
+		if (buf_to_free[loop].pkt_id < num_tx)
+			rte_pktmbuf_free_seg(buf_to_free[loop].seg);
 	}
 
 	/* free the pending buffers */
-	while (nb_pkts) {
-		rte_pktmbuf_free(*bufs);
-		bufs++;
-		nb_pkts--;
-		num_tx++;
-	}
+	rte_pktmbuf_free_bulk(bufs, nb_pkts);
+
+	num_tx += nb_pkts;
 	dpaa2_q->tx_pkts += num_tx;
 
 	return num_tx;
-- 
2.43.0

[PATCH v2 12/17] net/dpaa2: fix burst mode info to report active burst function

[Maxime Leroy]

The burst_mode_get functions were incorrectly listing configured
offload flags instead of reporting the active burst function, unlike
every other PMD (i40e, mlx5, ixgbe, hns3) which match on the burst
function pointer. On top of that, snprintf + break meant only the
first matching offload was ever shown.

Rewrite both functions to match on the actual rx_pkt_burst/tx_pkt_burst
function pointer, consistent with the rest of the codebase.

Not tested, found by code review.

Fixes: ddbc2b6658d0 ("net/dpaa2: add Tx/Rx burst mode info")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 76 +++++++++-----------------------
 1 file changed, 22 insertions(+), 54 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index e58b93c564..3875164794 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -443,34 +443,18 @@ dpaa2_dev_rx_burst_mode_get(struct rte_eth_dev *dev,
 	__rte_unused uint16_t queue_id,
 	struct rte_eth_burst_mode *mode)
 {
-	struct rte_eth_conf *eth_conf = &dev->data->dev_conf;
-	int ret = -EINVAL;
-	unsigned int i;
-	const struct burst_info {
-		uint64_t flags;
-		const char *output;
-	} rx_offload_map[] = {
-			{RTE_ETH_RX_OFFLOAD_CHECKSUM, " Checksum,"},
-			{RTE_ETH_RX_OFFLOAD_SCTP_CKSUM, " SCTP csum,"},
-			{RTE_ETH_RX_OFFLOAD_OUTER_IPV4_CKSUM, " Outer IPV4 csum,"},
-			{RTE_ETH_RX_OFFLOAD_OUTER_UDP_CKSUM, " Outer UDP csum,"},
-			{RTE_ETH_RX_OFFLOAD_VLAN_STRIP, " VLAN strip,"},
-			{RTE_ETH_RX_OFFLOAD_VLAN_FILTER, " VLAN filter,"},
-			{RTE_ETH_RX_OFFLOAD_TIMESTAMP, " Timestamp,"},
-			{RTE_ETH_RX_OFFLOAD_RSS_HASH, " RSS,"},
-			{RTE_ETH_RX_OFFLOAD_SCATTER, " Scattered,"}
-	};
+	eth_rx_burst_t pkt_burst = dev->rx_pkt_burst;
+
+	if (pkt_burst == dpaa2_dev_prefetch_rx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Scalar Prefetch");
+	else if (pkt_burst == dpaa2_dev_rx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Scalar");
+	else if (pkt_burst == dpaa2_dev_loopback_rx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Loopback");
+	else
+		return -EINVAL;
 
-	/* Update Rx offload info */
-	for (i = 0; i < RTE_DIM(rx_offload_map); i++) {
-		if (eth_conf->rxmode.offloads & rx_offload_map[i].flags) {
-			snprintf(mode->info, sizeof(mode->info), "%s",
-				rx_offload_map[i].output);
-			ret = 0;
-			break;
-		}
-	}
-	return ret;
+	return 0;
 }
 
 static int
@@ -478,34 +462,18 @@ dpaa2_dev_tx_burst_mode_get(struct rte_eth_dev *dev,
 			__rte_unused uint16_t queue_id,
 			struct rte_eth_burst_mode *mode)
 {
-	struct rte_eth_conf *eth_conf = &dev->data->dev_conf;
-	int ret = -EINVAL;
-	unsigned int i;
-	const struct burst_info {
-		uint64_t flags;
-		const char *output;
-	} tx_offload_map[] = {
-			{RTE_ETH_TX_OFFLOAD_VLAN_INSERT, " VLAN Insert,"},
-			{RTE_ETH_TX_OFFLOAD_IPV4_CKSUM, " IPV4 csum,"},
-			{RTE_ETH_TX_OFFLOAD_UDP_CKSUM, " UDP csum,"},
-			{RTE_ETH_TX_OFFLOAD_TCP_CKSUM, " TCP csum,"},
-			{RTE_ETH_TX_OFFLOAD_SCTP_CKSUM, " SCTP csum,"},
-			{RTE_ETH_TX_OFFLOAD_OUTER_IPV4_CKSUM, " Outer IPV4 csum,"},
-			{RTE_ETH_TX_OFFLOAD_MT_LOCKFREE, " MT lockfree,"},
-			{RTE_ETH_TX_OFFLOAD_MBUF_FAST_FREE, " MBUF free disable,"},
-			{RTE_ETH_TX_OFFLOAD_MULTI_SEGS, " Scattered,"}
-	};
+	eth_tx_burst_t pkt_burst = dev->tx_pkt_burst;
+
+	if (pkt_burst == dpaa2_dev_tx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Scalar");
+	else if (pkt_burst == dpaa2_dev_tx_ordered)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Ordered");
+	else if (pkt_burst == rte_eth_pkt_burst_dummy)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Dummy");
+	else
+		return -EINVAL;
 
-	/* Update Tx offload info */
-	for (i = 0; i < RTE_DIM(tx_offload_map); i++) {
-		if (eth_conf->txmode.offloads & tx_offload_map[i].flags) {
-			snprintf(mode->info, sizeof(mode->info), "%s",
-				tx_offload_map[i].output);
-			ret = 0;
-			break;
-		}
-	}
-	return ret;
+	return 0;
 }
 
 static int
-- 
2.43.0

[PATCH v2 13/17] net/dpaa2: add SG table walk upper bound in Rx path

[Maxime Leroy]

If hardware or corrupt DMA data fails to set the FINAL bit in the
scatter-gather table, the while loop in eth_sg_fd_to_mbuf() walks
past the end of the SGT buffer. Add DPAA2_MAX_SGS as an upper bound.

Not tested, found by code review.

Fixes: 774e9ea91971 ("net/dpaa2: add support for multi seg buffers")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 8275ba9780..b316e23e87 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -335,7 +335,7 @@ eth_sg_fd_to_mbuf(const struct qbman_fd *fd,
 			(void **)&first_seg, 1, 1);
 #endif
 	cur_seg = first_seg;
-	while (!DPAA2_SG_IS_FINAL(sge)) {
+	while (!DPAA2_SG_IS_FINAL(sge) && i < DPAA2_MAX_SGS) {
 		sge = &sgt[i++];
 		sg_addr = (size_t)DPAA2_IOVA_TO_VADDR(
 				DPAA2_GET_FLE_ADDR(sge));
-- 
2.43.0

[PATCH v2 14/17] net/dpaa2: fix MAC stats DMA buffer allocation per xstats call

[Maxime Leroy]

dpaa2_dev_mac_setup_stats() allocates and frees DMA buffers on every
xstats_get() call. This is wasteful and not thread-safe: concurrent
callers can overwrite priv pointers, leading to use-after-free. It
also does not check for allocation failure before passing IOVAs to
the MC firmware.

Move the DMA buffer allocation to dpaa2_dev_init() (only when MC
version supports MAC stats) and free them in dpaa2_dev_close(). In
xstats_get(), just check if the buffers were allocated.

Not tested, found by code review.

Fixes: d1cdef2ab5 ("net/dpaa2: add dpmac counters in xstats")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 65 +++++++++++++++-----------------
 1 file changed, 30 insertions(+), 35 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 3875164794..d5e30ce5fb 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -1550,6 +1550,11 @@ dpaa2_dev_close(struct rte_eth_dev *dev)
 
 	rte_free(priv->extract.qos_extract_param);
 
+	rte_free(priv->cnt_idx_dma_mem);
+	rte_free(priv->cnt_values_dma_mem);
+	priv->cnt_idx_dma_mem = NULL;
+	priv->cnt_values_dma_mem = NULL;
+
 	DPAA2_PMD_INFO("%s: netdev deleted", dev->data->name);
 	return 0;
 }
@@ -1905,7 +1910,6 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
 	unsigned int i = 0, j = 0, num = RTE_DIM(dpaa2_xstats_strings);
 	struct dpaa2_dev_priv *priv = dev->data->dev_private;
 	union dpni_statistics value[13] = {};
-	struct mc_version mc_ver_info = {0};
 	struct dpni_rx_tc_policing_cfg cfg;
 	uint8_t page_id, stats_id;
 	uint64_t *cnt_values;
@@ -1976,44 +1980,24 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
 		i++;
 	}
 
-	if (mc_get_version(dpni, CMD_PRI_LOW, &mc_ver_info))
-		DPAA2_PMD_WARN("Unable to obtain MC version");
-
-	/* mac_statistics supported on MC version > 10.39.0 */
-	if (mc_ver_info.major >= MC_VER_MAJOR &&
-	    mc_ver_info.minor >= MC_VER_MINOR &&
-	    mc_ver_info.revision > 0) {
-		dpaa2_dev_mac_setup_stats(dev);
-		retcode = dpni_get_mac_statistics(dpni, CMD_PRI_LOW, priv->token,
-						  priv->cnt_idx_iova,
-						  priv->cnt_values_iova,
-						  DPAA2_MAC_NUM_STATS);
-		if (retcode) {
-			while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
-				xstats[i].id = i;
-				xstats[i].value = 0;
-				i++;
-			}
-		}
-		if (!retcode) {
-			cnt_values = priv->cnt_values_dma_mem;
-			while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
-				/* mac counters value */
-				xstats[i].id = i;
-				xstats[i].value = rte_le_to_cpu_64(*cnt_values++);
-				i++;
-			}
-		}
-		rte_free(priv->cnt_values_dma_mem);
-		rte_free(priv->cnt_idx_dma_mem);
-		priv->cnt_idx_dma_mem = NULL;
-		priv->cnt_values_dma_mem = NULL;
-	} else {
+	if (priv->cnt_idx_dma_mem &&
+	    !dpni_get_mac_statistics(dpni, CMD_PRI_LOW, priv->token,
+				    priv->cnt_idx_iova,
+				    priv->cnt_values_iova,
+				    DPAA2_MAC_NUM_STATS)) {
+		cnt_values = priv->cnt_values_dma_mem;
 		while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
 			xstats[i].id = i;
-			xstats[i].value = 0;
+			xstats[i].value = rte_le_to_cpu_64(*cnt_values++);
 			i++;
 		}
+		return i;
+	}
+
+	while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
+		xstats[i].id = i;
+		xstats[i].value = 0;
+		i++;
 	}
 
 	return i;
@@ -3155,6 +3139,17 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 
 	priv->speed_capa = dpaa2_dev_get_speed_capability(eth_dev);
 
+	/* mac_statistics supported on MC version > 10.39.0 */
+	{
+		struct mc_version mc_ver_info = {0};
+
+		if (!mc_get_version(dpni_dev, CMD_PRI_LOW, &mc_ver_info) &&
+		    mc_ver_info.major >= MC_VER_MAJOR &&
+		    mc_ver_info.minor >= MC_VER_MINOR &&
+		    mc_ver_info.revision > 0)
+			dpaa2_dev_mac_setup_stats(eth_dev);
+	}
+
 	return 0;
 init_err:
 	dpaa2_dev_close(eth_dev);
-- 
2.43.0

[PATCH v2 15/17] net/dpaa2: use CHECK_INTERVAL macro in set_link_down

[Maxime Leroy]

Replace hardcoded rte_delay_us(100 * 1000) with
rte_delay_ms(CHECK_INTERVAL) for consistency with the rest of the
driver.

No functional change.

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index d5e30ce5fb..a70e6895c8 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -2305,7 +2305,7 @@ dpaa2_dev_set_link_down(struct rte_eth_dev *dev)
 		}
 		if (dpni_enabled)
 			/* Allow the MC some slack */
-			rte_delay_us(100 * 1000);
+			rte_delay_ms(CHECK_INTERVAL);
 	} while (dpni_enabled && --retries);
 
 	if (!retries) {
-- 
2.43.0

[PATCH v2 16/17] net/dpaa2: add devargs to disable Rx taildrop

[Maxime Leroy]

The DPAA2_RX_TAILDROP_OFF flag was defined and checked in
dpaa2_dev_rx_queue_setup(), but never set — making the taildrop
disable path dead code.

Wire it to a new "drv_no_taildrop" devargs, following the existing
pattern (drv_loopback, drv_no_prefetch, etc.).

Also move dpaa2_q->nb_desc assignment before the taildrop if/else
so that the descriptor count is always tracked correctly, regardless
of whether taildrop is enabled or disabled.

Usage: fslmc:dpni.1,drv_no_taildrop=1

Note: the taildrop disable path has never been reachable until now
and is untested. NXP maintainers should validate this feature.

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index a70e6895c8..d9d8ba26a9 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -34,6 +34,7 @@
 #define DRIVER_TX_CONF "drv_tx_conf"
 #define DRIVER_RX_PARSE_ERR_DROP "drv_rx_parse_drop"
 #define DRIVER_ERROR_QUEUE  "drv_err_queue"
+#define DRIVER_NO_TAILDROP  "drv_no_taildrop"
 #define CHECK_INTERVAL         100  /* 100ms */
 #define MAX_REPEAT_TIME        90   /* 9s (90 * 100ms) in total */
 
@@ -897,7 +898,6 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	dpaa2_q = priv->rx_vq[rx_queue_id];
 	dpaa2_q->mb_pool = mb_pool; /**< mbuf pool to populate RX ring. */
 	dpaa2_q->bp_array = rte_dpaa2_bpid_info;
-	dpaa2_q->nb_desc = UINT16_MAX;
 	dpaa2_q->offloads = rx_conf->offloads;
 
 	/*Get the flow id from given VQ id*/
@@ -950,11 +950,12 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 		return ret;
 	}
 
+	dpaa2_q->nb_desc = nb_rx_desc;
+
 	if (!(priv->flags & DPAA2_RX_TAILDROP_OFF)) {
 		struct dpni_taildrop taildrop;
 
 		taildrop.enable = 1;
-		dpaa2_q->nb_desc = nb_rx_desc;
 		/* Private CGR will use tail drop length as nb_rx_desc.
 		 * for rest cases we can use standard byte based tail drop.
 		 * There is no HW restriction, but number of CGRs are limited,
@@ -2887,6 +2888,11 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		DPAA2_PMD_INFO("Rx loopback mode");
 	}
 
+	if (dpaa2_get_devargs(dev->devargs, DRIVER_NO_TAILDROP)) {
+		priv->flags |= DPAA2_RX_TAILDROP_OFF;
+		DPAA2_PMD_INFO("Rx taildrop disabled");
+	}
+
 	/* For secondary processes, the primary has done all the work */
 	if (rte_eal_process_type() != RTE_PROC_PRIMARY) {
 		/* In case of secondary, only burst and ops API need to be
@@ -3384,5 +3390,6 @@ RTE_PMD_REGISTER_PARAM_STRING(NET_DPAA2_PMD_DRIVER_NAME,
 		DRIVER_NO_PREFETCH_MODE "=<int>"
 		DRIVER_TX_CONF "=<int>"
 		DRIVER_RX_PARSE_ERR_DROP "=<int>"
-		DRIVER_ERROR_QUEUE "=<int>");
+		DRIVER_ERROR_QUEUE "=<int>"
+		DRIVER_NO_TAILDROP "=<int>");
 RTE_LOG_REGISTER_DEFAULT(dpaa2_logtype_pmd, NOTICE);
-- 
2.43.0

[PATCH v2 17/17] net/dpaa2: add devargs alternative for data stashing getenv

[Maxime Leroy]

The DPAA2_DATA_STASHING_OFF environment variable is used by customers
to dynamically disable data stashing without rebuilding their
application. Add a devargs option "drv_no_data_stashing" as an
alternative, consistent with the existing devargs pattern (drv_loopback,
drv_no_prefetch, drv_no_taildrop), while keeping the getenv for
backward compatibility.

Move the check from dpaa2_dev_rx_queue_setup() to dpaa2_dev_init(),
consistent with how other driver flags are handled.

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 12 ++++++++++--
 drivers/net/dpaa2/dpaa2_ethdev.h |  3 +++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index d9d8ba26a9..31fdef8598 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -35,6 +35,7 @@
 #define DRIVER_RX_PARSE_ERR_DROP "drv_rx_parse_drop"
 #define DRIVER_ERROR_QUEUE  "drv_err_queue"
 #define DRIVER_NO_TAILDROP  "drv_no_taildrop"
+#define DRIVER_NO_DATA_STASHING "drv_no_data_stashing"
 #define CHECK_INTERVAL         100  /* 100ms */
 #define MAX_REPEAT_TIME        90   /* 9s (90 * 100ms) in total */
 
@@ -929,7 +930,7 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 		options |= DPNI_QUEUE_OPT_FLC;
 		cfg.flc.stash_control = true;
 		dpaa2_flc_stashing_clear_all(&cfg.flc.value);
-		if (getenv("DPAA2_DATA_STASHING_OFF")) {
+		if (priv->flags & DPAA2_DATA_STASHING_OFF) {
 			dpaa2_flc_stashing_set(DPAA2_FLC_DATA_STASHING, 0,
 				&cfg.flc.value);
 			dpaa2_q->data_stashing_off = 1;
@@ -2893,6 +2894,12 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		DPAA2_PMD_INFO("Rx taildrop disabled");
 	}
 
+	if (dpaa2_get_devargs(dev->devargs, DRIVER_NO_DATA_STASHING) ||
+	    getenv("DPAA2_DATA_STASHING_OFF")) {
+		priv->flags |= DPAA2_DATA_STASHING_OFF;
+		DPAA2_PMD_INFO("Data stashing disabled");
+	}
+
 	/* For secondary processes, the primary has done all the work */
 	if (rte_eal_process_type() != RTE_PROC_PRIMARY) {
 		/* In case of secondary, only burst and ops API need to be
@@ -3391,5 +3398,6 @@ RTE_PMD_REGISTER_PARAM_STRING(NET_DPAA2_PMD_DRIVER_NAME,
 		DRIVER_TX_CONF "=<int>"
 		DRIVER_RX_PARSE_ERR_DROP "=<int>"
 		DRIVER_ERROR_QUEUE "=<int>"
-		DRIVER_NO_TAILDROP "=<int>");
+		DRIVER_NO_TAILDROP "=<int>"
+		DRIVER_NO_DATA_STASHING "=<int>");
 RTE_LOG_REGISTER_DEFAULT(dpaa2_logtype_pmd, NOTICE);
diff --git a/drivers/net/dpaa2/dpaa2_ethdev.h b/drivers/net/dpaa2/dpaa2_ethdev.h
index 86b3022ddb..4da47a543a 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.h
+++ b/drivers/net/dpaa2/dpaa2_ethdev.h
@@ -97,6 +97,9 @@
  */
 #define DPAA2_TX_DYNAMIC_CONF_ENABLE	RTE_BIT32(9)
 
+/* Disable data stashing (prefetch of packet data into CPU cache) */
+#define DPAA2_DATA_STASHING_OFF		RTE_BIT32(10)
+
 #define DPAAX_RX_ERROR_QUEUE_FLAG	RTE_BIT32(11)
 
 /* DPDMUX index for DPMAC */
-- 
2.43.0

Re: [PATCH v2 11/17] net/dpaa2: fix software taildrop buffer access

[Stephen Hemminger]

On Thu, 26 Feb 2026 15:33:35 +0100
Maxime Leroy <maxime@leroys.fr> wrote:

> The sw_td path in dpaa2_dev_tx() reads from the wrong position in the
> bufs array. When the goto fires, bufs has already been advanced past
> the num_tx successfully sent packets. The first loop then reads num_tx
> more entries starting from bufs, going past the end of the input array.
> Additionally, the buf_to_free segments for already-enqueued packets
> are never freed, leaking memory.
> 
> Replace the buggy sw_td code with the same pattern used in
> dpaa2_dev_tx_ordered(): free buf_to_free segments first, then use
> rte_pktmbuf_free_bulk() to drop remaining unsent packets.
> 
> Not tested, found by code review.
> 
> Cc: stable@dpdk.org
> Fixes: c3ffe74d85be ("net/dpaa2: support software taildrop")
> 
> Reported-by: Stephen Hemminger <stephen@networkplumber.org>
> Signed-off-by: Maxime Leroy <maxime@leroys.fr>
> ---
>  drivers/net/dpaa2/dpaa2_rxtx.c | 18 ++++++------------
>  1 file changed, 6 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
> index 689e5e7ee7..8275ba9780 100644
> --- a/drivers/net/dpaa2/dpaa2_rxtx.c
> +++ b/drivers/net/dpaa2/dpaa2_rxtx.c
> @@ -1517,21 +1517,15 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
>  
>  	return num_tx;
>  sw_td:
> -	loop = 0;
> -	while (loop < num_tx) {
> -		if (unlikely(RTE_MBUF_HAS_EXTBUF(*bufs)))
> -			rte_pktmbuf_free(*bufs);
> -		bufs++;
> -		loop++;
> +	for (loop = 0; loop < free_count; loop++) {
> +		if (buf_to_free[loop].pkt_id < num_tx)
> +			rte_pktmbuf_free_seg(buf_to_free[loop].seg);
>  	}
>  
>  	/* free the pending buffers */
> -	while (nb_pkts) {
> -		rte_pktmbuf_free(*bufs);
> -		bufs++;
> -		nb_pkts--;
> -		num_tx++;
> -	}
> +	rte_pktmbuf_free_bulk(bufs, nb_pkts);

It is unsafe to use free_bulk on transmit path because packets in
burst might come from different pools. An example would be a router
forwarding from two incoming NIC's to one outgoing NIC. 

Unlikely, but using bulk here is incorrect.

You are right though old code had other bugs.

Re: [PATCH v2 08/17] net/dpaa2: fix error packet dump crash and memory leak

[Stephen Hemminger]

On Thu, 26 Feb 2026 15:33:32 +0100
Maxime Leroy <maxime@leroys.fr> wrote:

> Fix three bugs in dump_err_pkts():
> 
> 1. NULL pointer dereference: mbuf was checked for NULL but then
>    dereferenced unconditionally on the next line.
> 
> 2. Memory leak on multi-segment packets: the while loop walked
>    mbuf to NULL, so the subsequent rte_pktmbuf_free(mbuf) was a
>    no-op and the packet was never freed. Use a separate iterator
>    variable and free the original mbuf pointer.
> 
> 3. Segment index not reset between packets: variable i was
>    initialized once at function scope and never reset inside the
>    do/while loop, so hexdump titles had wrong segment numbers.
>    Make it local to the multi-segment block.
> 
> Not tested, found by code review.
> 
> Fixes: 8b49427e73 ("net/dpaa2: add Rx error queue support")
> Cc: stable@dpdk.org

You need to use longer (12 character) SHAs on Fixes tags now.
Same problem in patch 14

Re: [PATCH v2 03/17] net/dpaa2: warn on rx descriptor limit only in high perf buffer mode

[Stephen Hemminger]

On Thu, 26 Feb 2026 15:33:27 +0100
Maxime Leroy <maxime@leroys.fr> wrote:

> The Rx descriptor count warning fires unconditionally when the total
> exceeds 11264, but this limit only applies when the DPNI is created
> with the high performance buffer option (0x80000000). When using normal
> buffers, there is no such limit and the warning is
> misleading noise.
> 
> Check the DPNI options to only warn when the high performance buffer
> mode is active.
> 
> Fixes: 35dc25d12792 ("net/dpaa2: warn on high Rx descriptor number")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Maxime Leroy <maxime@leroys.fr>
> Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>

DPDK check git log wants shorter Subject

Headline too long:
	net/dpaa2: warn on rx descriptor limit only in high perf buffer mode
	net/dpaa2: fix L4 packet type classification in slow parse path
	net/dpaa2: fix burst mode info to report active burst function
	net/dpaa2: fix MAC stats DMA buffer allocation per xstats call

Re: [PATCH v2 00/17] net/dpaa2: fixes and improvements

[Stephen Hemminger]

On Thu, 26 Feb 2026 15:33:24 +0100
Maxime Leroy <maxime@leroys.fr> wrote:

> Various fixes and improvements for the dpaa2 net driver and fslmc bus.
> 
> Patches 1-6 fix resource leaks on port close, error paths, link status
> and devargs propagation on hotplug.
> 
> Patches 7-14 fix additional bugs: spurious VLAN insertion, error packet
> dump crash, packet type classification, checksum offload flags, software
> taildrop buffer access, burst mode info reporting, SG table walk bounds,
> and MAC stats DMA allocation.
> 
> Patch 15 is a minor cleanup in the link status area.
> 
> Patches 16-17 add devargs alternatives for getenv-based configuration
> of taildrop and data stashing options.
> 
> Changes since v1:
> - Add Cc: stable@dpdk.org on patches with Fixes: tags (Stephen)
> - Reorder series: fixes first, then improvements (Stephen)
> - Patch 2: squash with former patch 4 (Hemant)
> - Patch 6: move devargs refresh from plug to scan rescan path (David)
> - Patch 17: keep getenv for backward compatibility, add devargs as
>   alternative instead of replacement
> - Drop former patch 11 (bus/fslmc: remove dead blocklist check) to
>   avoid disaligning with other buses (David)
> - New patches 8, 11-14 fixing issues reported by Stephen
> - New patches 7, 9-10 fixing VLAN insertion and packet classification
>   issues
> 
> Maxime Leroy (17):
>   net/dpaa2: fix queue block memory leak on port close
>   net/dpaa2: fix rx error queue memory leaks
>   net/dpaa2: warn on rx descriptor limit only in high perf buffer mode
>   net/dpaa2: fix resource leak on softparser failure
>   net/dpaa2: fix link not up after port stop/start
>   bus/fslmc: fix devargs not propagated on hotplug
>   net/dpaa2: fix spurious VLAN insertion on non-VLAN packets
>   net/dpaa2: fix error packet dump crash and memory leak
>   net/dpaa2: fix L4 packet type classification in slow parse path
>   net/dpaa2: fix L3/L4 checksum offload flags
>   net/dpaa2: fix software taildrop buffer access
>   net/dpaa2: fix burst mode info to report active burst function
>   net/dpaa2: add SG table walk upper bound in Rx path
>   net/dpaa2: fix MAC stats DMA buffer allocation per xstats call
>   net/dpaa2: use CHECK_INTERVAL macro in set_link_down
>   net/dpaa2: add devargs to disable Rx taildrop
>   net/dpaa2: add devargs alternative for data stashing getenv
> 
>  drivers/bus/fslmc/fslmc_bus.c           |   4 +
>  drivers/bus/fslmc/portal/dpaa2_hw_pvt.h |  16 +-
>  drivers/net/dpaa2/dpaa2_ethdev.c        | 211 ++++++++++++------------
>  drivers/net/dpaa2/dpaa2_ethdev.h        |   3 +
>  drivers/net/dpaa2/dpaa2_rxtx.c          |  85 +++++-----
>  drivers/net/dpaa2/mc/fsl_dpni.h         |   6 +
>  6 files changed, 164 insertions(+), 161 deletions(-)
> 

Please fix the free bulk bug on Transmit and revise
patches so that check-git-log.sh does not complain so much.

Re: [PATCH v2 11/17] net/dpaa2: fix software taildrop buffer access

[David Marchand]

On Thu, 26 Feb 2026 at 20:22, Stephen Hemminger
<stephen@networkplumber.org> wrote:
>
> On Thu, 26 Feb 2026 15:33:35 +0100
> Maxime Leroy <maxime@leroys.fr> wrote:
>
> > The sw_td path in dpaa2_dev_tx() reads from the wrong position in the
> > bufs array. When the goto fires, bufs has already been advanced past
> > the num_tx successfully sent packets. The first loop then reads num_tx
> > more entries starting from bufs, going past the end of the input array.
> > Additionally, the buf_to_free segments for already-enqueued packets
> > are never freed, leaking memory.
> >
> > Replace the buggy sw_td code with the same pattern used in
> > dpaa2_dev_tx_ordered(): free buf_to_free segments first, then use
> > rte_pktmbuf_free_bulk() to drop remaining unsent packets.
> >
> > Not tested, found by code review.
> >
> > Cc: stable@dpdk.org
> > Fixes: c3ffe74d85be ("net/dpaa2: support software taildrop")
> >
> > Reported-by: Stephen Hemminger <stephen@networkplumber.org>
> > Signed-off-by: Maxime Leroy <maxime@leroys.fr>
> > ---
> >  drivers/net/dpaa2/dpaa2_rxtx.c | 18 ++++++------------
> >  1 file changed, 6 insertions(+), 12 deletions(-)
> >
> > diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
> > index 689e5e7ee7..8275ba9780 100644
> > --- a/drivers/net/dpaa2/dpaa2_rxtx.c
> > +++ b/drivers/net/dpaa2/dpaa2_rxtx.c
> > @@ -1517,21 +1517,15 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
> >
> >       return num_tx;
> >  sw_td:
> > -     loop = 0;
> > -     while (loop < num_tx) {
> > -             if (unlikely(RTE_MBUF_HAS_EXTBUF(*bufs)))
> > -                     rte_pktmbuf_free(*bufs);
> > -             bufs++;
> > -             loop++;
> > +     for (loop = 0; loop < free_count; loop++) {
> > +             if (buf_to_free[loop].pkt_id < num_tx)
> > +                     rte_pktmbuf_free_seg(buf_to_free[loop].seg);
> >       }
> >
> >       /* free the pending buffers */
> > -     while (nb_pkts) {
> > -             rte_pktmbuf_free(*bufs);
> > -             bufs++;
> > -             nb_pkts--;
> > -             num_tx++;
> > -     }
> > +     rte_pktmbuf_free_bulk(bufs, nb_pkts);
>
> It is unsafe to use free_bulk on transmit path because packets in
> burst might come from different pools. An example would be a router
> forwarding from two incoming NIC's to one outgoing NIC.

Is it?

IIUC, this helper was added specifically to handle mbufs from multiple mempools.

static void
__rte_pktmbuf_free_seg_via_array(struct rte_mbuf *m,
        struct rte_mbuf ** const pending, unsigned int * const
nb_pending,
        const unsigned int pending_sz)
{
        m = rte_pktmbuf_prefree_seg(m);
        if (likely(m != NULL)) {
                if (*nb_pending == pending_sz ||
                    (*nb_pending > 0 && m->pool != pending[0]->pool))
{
                        rte_mempool_put_bulk(pending[0]->pool,
                                        (void **)pending,
*nb_pending);
                        *nb_pending = 0;
                }

                pending[(*nb_pending)++] = m;
        }
}

void rte_pktmbuf_free_bulk(struct rte_mbuf **mbufs, unsigned int
count)
        for (idx = 0; idx < count; idx++) {
                m = mbufs[idx];
                do {
                        m_next = m->next;
                        __rte_pktmbuf_free_seg_via_array(m,
                                        pending, &nb_pending,
                                        RTE_PKTMBUF_FREE_PENDING_SZ);
                        m = m_next;
                } while (m != NULL);
}


-- 
David Marchand

RE: [PATCH v2 11/17] net/dpaa2: fix software taildrop buffer access

[Morten Brørup]

> From: David Marchand [mailto:david.marchand@redhat.com]
> Sent: Friday, 27 February 2026 10.24
> 
> On Thu, 26 Feb 2026 at 20:22, Stephen Hemminger
> <stephen@networkplumber.org> wrote:
> >
> > On Thu, 26 Feb 2026 15:33:35 +0100
> > Maxime Leroy <maxime@leroys.fr> wrote:
> >
> > > The sw_td path in dpaa2_dev_tx() reads from the wrong position in
> the
> > > bufs array. When the goto fires, bufs has already been advanced
> past
> > > the num_tx successfully sent packets. The first loop then reads
> num_tx
> > > more entries starting from bufs, going past the end of the input
> array.
> > > Additionally, the buf_to_free segments for already-enqueued packets
> > > are never freed, leaking memory.
> > >
> > > Replace the buggy sw_td code with the same pattern used in
> > > dpaa2_dev_tx_ordered(): free buf_to_free segments first, then use
> > > rte_pktmbuf_free_bulk() to drop remaining unsent packets.
> > >
> > > Not tested, found by code review.
> > >
> > > Cc: stable@dpdk.org
> > > Fixes: c3ffe74d85be ("net/dpaa2: support software taildrop")
> > >
> > > Reported-by: Stephen Hemminger <stephen@networkplumber.org>
> > > Signed-off-by: Maxime Leroy <maxime@leroys.fr>
> > > ---
> > >  drivers/net/dpaa2/dpaa2_rxtx.c | 18 ++++++------------
> > >  1 file changed, 6 insertions(+), 12 deletions(-)
> > >
> > > diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c
> b/drivers/net/dpaa2/dpaa2_rxtx.c
> > > index 689e5e7ee7..8275ba9780 100644
> > > --- a/drivers/net/dpaa2/dpaa2_rxtx.c
> > > +++ b/drivers/net/dpaa2/dpaa2_rxtx.c
> > > @@ -1517,21 +1517,15 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf
> **bufs, uint16_t nb_pkts)
> > >
> > >       return num_tx;
> > >  sw_td:
> > > -     loop = 0;
> > > -     while (loop < num_tx) {
> > > -             if (unlikely(RTE_MBUF_HAS_EXTBUF(*bufs)))
> > > -                     rte_pktmbuf_free(*bufs);
> > > -             bufs++;
> > > -             loop++;
> > > +     for (loop = 0; loop < free_count; loop++) {
> > > +             if (buf_to_free[loop].pkt_id < num_tx)
> > > +                     rte_pktmbuf_free_seg(buf_to_free[loop].seg);
> > >       }
> > >
> > >       /* free the pending buffers */
> > > -     while (nb_pkts) {
> > > -             rte_pktmbuf_free(*bufs);
> > > -             bufs++;
> > > -             nb_pkts--;
> > > -             num_tx++;
> > > -     }
> > > +     rte_pktmbuf_free_bulk(bufs, nb_pkts);
> >
> > It is unsafe to use free_bulk on transmit path because packets in
> > burst might come from different pools. An example would be a router
> > forwarding from two incoming NIC's to one outgoing NIC.
> 
> Is it?
> 
> IIUC, this helper was added specifically to handle mbufs from multiple
> mempools.
> 
> static void
> __rte_pktmbuf_free_seg_via_array(struct rte_mbuf *m,
>         struct rte_mbuf ** const pending, unsigned int * const
> nb_pending,
>         const unsigned int pending_sz)
> {
>         m = rte_pktmbuf_prefree_seg(m);
>         if (likely(m != NULL)) {
>                 if (*nb_pending == pending_sz ||
>                     (*nb_pending > 0 && m->pool != pending[0]->pool))
> {
>                         rte_mempool_put_bulk(pending[0]->pool,
>                                         (void **)pending,
> *nb_pending);
>                         *nb_pending = 0;
>                 }
> 
>                 pending[(*nb_pending)++] = m;
>         }
> }
> 
> void rte_pktmbuf_free_bulk(struct rte_mbuf **mbufs, unsigned int
> count)
>         for (idx = 0; idx < count; idx++) {
>                 m = mbufs[idx];
>                 do {
>                         m_next = m->next;
>                         __rte_pktmbuf_free_seg_via_array(m,
>                                         pending, &nb_pending,
>                                         RTE_PKTMBUF_FREE_PENDING_SZ);
>                         m = m_next;
>                 } while (m != NULL);
> }
> 
> 
> --
> David Marchand

I guess rte_pktmbuf_free_bulk() was mistaken for rte_mbuf_raw_free_bulk().

The first is perfectly good to free from a mix of multiple mempools, the latter takes the mempool as a parameter.

Re: [PATCH v2 00/17] net/dpaa2: fixes and improvements

[David Marchand]

On Thu, 26 Feb 2026 at 20:26, Stephen Hemminger
<stephen@networkplumber.org> wrote:
>
> On Thu, 26 Feb 2026 15:33:24 +0100
> Maxime Leroy <maxime@leroys.fr> wrote:
>
> > Various fixes and improvements for the dpaa2 net driver and fslmc bus.
> >
> > Patches 1-6 fix resource leaks on port close, error paths, link status
> > and devargs propagation on hotplug.
> >
> > Patches 7-14 fix additional bugs: spurious VLAN insertion, error packet
> > dump crash, packet type classification, checksum offload flags, software
> > taildrop buffer access, burst mode info reporting, SG table walk bounds,
> > and MAC stats DMA allocation.
> >
> > Patch 15 is a minor cleanup in the link status area.
> >
> > Patches 16-17 add devargs alternatives for getenv-based configuration
> > of taildrop and data stashing options.
> >
> > Changes since v1:
> > - Add Cc: stable@dpdk.org on patches with Fixes: tags (Stephen)
> > - Reorder series: fixes first, then improvements (Stephen)
> > - Patch 2: squash with former patch 4 (Hemant)
> > - Patch 6: move devargs refresh from plug to scan rescan path (David)
> > - Patch 17: keep getenv for backward compatibility, add devargs as
> >   alternative instead of replacement
> > - Drop former patch 11 (bus/fslmc: remove dead blocklist check) to
> >   avoid disaligning with other buses (David)
> > - New patches 8, 11-14 fixing issues reported by Stephen
> > - New patches 7, 9-10 fixing VLAN insertion and packet classification
> >   issues
> >
> > Maxime Leroy (17):
> >   net/dpaa2: fix queue block memory leak on port close
> >   net/dpaa2: fix rx error queue memory leaks
> >   net/dpaa2: warn on rx descriptor limit only in high perf buffer mode
> >   net/dpaa2: fix resource leak on softparser failure
> >   net/dpaa2: fix link not up after port stop/start
> >   bus/fslmc: fix devargs not propagated on hotplug
> >   net/dpaa2: fix spurious VLAN insertion on non-VLAN packets
> >   net/dpaa2: fix error packet dump crash and memory leak
> >   net/dpaa2: fix L4 packet type classification in slow parse path
> >   net/dpaa2: fix L3/L4 checksum offload flags
> >   net/dpaa2: fix software taildrop buffer access
> >   net/dpaa2: fix burst mode info to report active burst function
> >   net/dpaa2: add SG table walk upper bound in Rx path
> >   net/dpaa2: fix MAC stats DMA buffer allocation per xstats call
> >   net/dpaa2: use CHECK_INTERVAL macro in set_link_down
> >   net/dpaa2: add devargs to disable Rx taildrop
> >   net/dpaa2: add devargs alternative for data stashing getenv
> >
> >  drivers/bus/fslmc/fslmc_bus.c           |   4 +
> >  drivers/bus/fslmc/portal/dpaa2_hw_pvt.h |  16 +-
> >  drivers/net/dpaa2/dpaa2_ethdev.c        | 211 ++++++++++++------------
> >  drivers/net/dpaa2/dpaa2_ethdev.h        |   3 +
> >  drivers/net/dpaa2/dpaa2_rxtx.c          |  85 +++++-----
> >  drivers/net/dpaa2/mc/fsl_dpni.h         |   6 +
> >  6 files changed, 164 insertions(+), 161 deletions(-)
> >
>
> Please fix the free bulk bug on Transmit and revise

As I replied in other thread, I see no bug on usage of free bulk (not
the raw helper).

> patches so that check-git-log.sh does not complain so much.

Maxime, this will need a new revision on those warnings.

Hemant, in the mean time, could NXP review/test on real hw?


Thanks.

-- 
David Marchand

Re: [PATCH v2 00/17] net/dpaa2: fixes and improvements

[Stephen Hemminger]

On Thu, 5 Mar 2026 17:55:39 +0100
David Marchand <david.marchand@redhat.com> wrote:

> > Please fix the free bulk bug on Transmit and revise  
> 
> As I replied in other thread, I see no bug on usage of free bulk (not
> the raw helper).

There is no requirement that all packets in one tx burst come from the
same mempool. And free_bulk assumes that all packets in the array
can go back to the mempool of the first element.

Re: [PATCH v2 00/17] net/dpaa2: fixes and improvements

[Maxime Leroy]

Hi Stephen,

Le jeu. 5 mars 2026 à 18:57, Stephen Hemminger
<stephen@networkplumber.org> a écrit :
>
> On Thu, 5 Mar 2026 17:55:39 +0100
> David Marchand <david.marchand@redhat.com> wrote:
>
> > > Please fix the free bulk bug on Transmit and revise
> >
> > As I replied in other thread, I see no bug on usage of free bulk (not
> > the raw helper).
>
> There is no requirement that all packets in one tx burst come from the
> same mempool. And free_bulk assumes that all packets in the array
> can go back to the mempool of the first element.

rte_pktmbuf_free_bulk() handles mbufs from different mempools
correctly. It was specifically designed for this, see 0f824df6f8c5
("mbuf: add bulk free function").

It uses an internal helper __rte_pktmbuf_free_seg_via_array() that
batches consecutive mbufs from the same pool, and flushes via
rte_mempool_put_bulk() when the pool changes:

 if (*nb_pending == pending_sz ||
     (*nb_pending > 0 && m->pool != pending[0]->pool)) {
     rte_mempool_put_bulk(pending[0]->pool,
             (void **)pending, *nb_pending);
     *nb_pending = 0;
 }
 pending[(*nb_pending)++] = m;

It also walks m->next for multi-segment packets.

Perhaps you are thinking of rte_mbuf_raw_free_bulk(), which does
assume a single mempool and is only safe to use when
RTE_ETH_TX_OFFLOAD_MBUF_FAST_FREE is set.

See for example i40e_tx_free_bufs() which guards
rte_mbuf_raw_free_bulk() behind a MBUF_FAST_FREE check.

Regards,

Maxime

[PATCH v3 00/17] net/dpaa2: fixes and improvements

[Maxime Leroy]

Various fixes and improvements for the dpaa2 net driver and fslmc bus.

Patches 1-6 fix resource leaks on port close, error paths, link status
and devargs propagation on hotplug.

Patches 7-14 fix additional bugs: spurious VLAN insertion, error packet
dump crash, packet type classification, checksum offload flags, software
taildrop buffer access, burst mode info reporting, SG table walk bounds,
and MAC stats DMA allocation.

Patch 15 is a minor cleanup in the link status area.

Patches 16-17 add devargs alternatives for getenv-based configuration
of taildrop and data stashing options.

Changes since v2:
- Fix checkpatch warnings: short SHA in Fixes tag (patch 14),
  long line in commit message (patch 10)
- Fix check-git-log warnings: shorten headlines (patches 3, 9, 12, 14),
  fix tag order Fixes/Cc (patches 10, 11), fix wrong Fixes reference
  (patch 8), remove colon after function name in commit body (patch 8),
  lowercase macro name in headline (patch 15)

Changes since v1:
- Add Cc: stable@dpdk.org on patches with Fixes: tags (Stephen)
- Reorder series: fixes first, then improvements (Stephen)
- Patch 2: squash with former patch 4 (Hemant)
- Patch 6: move devargs refresh from plug to scan rescan path (David)
- Patch 17: keep getenv for backward compatibility, add devargs as
  alternative instead of replacement
- Drop former patch 11 (bus/fslmc: remove dead blocklist check) to
  avoid disaligning with other buses (David)
- New patches 8, 11-14 fixing issues reported by Stephen
- New patches 7, 9-10 fixing VLAN insertion and packet classification
  issues

Maxime Leroy (17):
  net/dpaa2: fix queue block memory leak on port close
  net/dpaa2: fix Rx error queue memory leaks
  net/dpaa2: warn on Rx descriptor limit in high perf mode
  net/dpaa2: fix resource leak on softparser failure
  net/dpaa2: fix link not up after port stop/start
  bus/fslmc: fix devargs not propagated on hotplug
  net/dpaa2: fix spurious VLAN insertion on non-VLAN packets
  net/dpaa2: fix error packet dump crash and memory leak
  net/dpaa2: fix L4 packet type in slow parse path
  net/dpaa2: fix L3/L4 checksum offload flags
  net/dpaa2: fix software taildrop buffer access
  net/dpaa2: fix burst mode info report
  net/dpaa2: add SG table walk upper bound in Rx path
  net/dpaa2: fix MAC stats DMA alloc per xstats call
  net/dpaa2: use check interval macro in link down path
  net/dpaa2: add devargs to disable Rx taildrop
  net/dpaa2: add devargs alternative for data stashing getenv

 drivers/bus/fslmc/fslmc_bus.c           |   4 +
 drivers/bus/fslmc/portal/dpaa2_hw_pvt.h |  16 +-
 drivers/net/dpaa2/dpaa2_ethdev.c        | 211 ++++++++++++------------
 drivers/net/dpaa2/dpaa2_ethdev.h        |   3 +
 drivers/net/dpaa2/dpaa2_rxtx.c          |  85 +++++-----
 drivers/net/dpaa2/mc/fsl_dpni.h         |   6 +
 6 files changed, 164 insertions(+), 161 deletions(-)

-- 
2.43.0

[PATCH v3 01/17] net/dpaa2: fix queue block memory leak on port close

[Maxime Leroy]

Commit ae2661c3ea2d ("net/dpaa2: fix queue free cleanup") added
priv->rx_vq[i] = NULL inside the cleanup loop. This NULLs rx_vq[0]
on the first iteration, so the subsequent rte_free(priv->rx_vq[0])
becomes rte_free(NULL) — a no-op — leaking the entire mc_q block
(all RX + TX + TX conf queue structs) on every port close.

Save the base pointer before the loop and free that instead.

Fixes: 46d02eeaaeb8 ("net/dpaa2: fix queue freeing")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index b3a79f18d3..cef819650b 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -661,6 +661,9 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 
 	/* Queue allocation base */
 	if (priv->rx_vq[0]) {
+		/* Save base pointer before the loop NULLs rx_vq[] entries */
+		void *mc_q = priv->rx_vq[0];
+
 		/* cleaning up queue storage */
 		for (i = 0; i < priv->nb_rx_queues; i++) {
 			dpaa2_q = priv->rx_vq[i];
@@ -691,8 +694,7 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 		}
 
 		/*free memory for all queues (RX+TX) */
-		rte_free(priv->rx_vq[0]);
-		priv->rx_vq[0] = NULL;
+		rte_free(mc_q);
 	}
 }
 
-- 
2.43.0

[PATCH v3 02/17] net/dpaa2: fix Rx error queue memory leaks

[Maxime Leroy]

The rx_err_vq is allocated separately with rte_zmalloc() in
dpaa2_alloc_rx_tx_queues(), but is never properly freed in two paths:

1. On port close: dpaa2_free_rx_tx_queues() only frees the q_storage
contents via dpaa2_queue_storage_free() — the dpaa2_queue struct itself
is never freed, leaking memory on every port close.

2. On allocation error: the fail: path frees the error queue's
   q_storage but never frees the rx_err_vq struct itself, which was
   separately allocated with rte_zmalloc(). This has been missing
   since the error queue was first introduced.

Add the missing rte_free() calls and NULL assignments in both paths.

Also replace the DPAAX_RX_ERROR_QUEUE_FLAG check with a direct
priv->rx_err_vq NULL check, which is safe because rx_err_vq is
zero-initialized and only set when the flag is active. This avoids a
NULL dereference if rx_err_vq allocation itself fails and also
simplifies the cleanup in dpaa2_free_rx_tx_queues() for consistency.

As a defensive measure, also add a NULL guard to the
dpaa2_queue_storage_free() macro to prevent NULL pointer dereference
from callers in error paths.

Fixes: 46d02eeaaeb8 ("net/dpaa2: fix queue freeing")
Fixes: 4690a6114ff6 ("net/dpaa2: enable error queues optionally")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/bus/fslmc/portal/dpaa2_hw_pvt.h | 16 +++++++++-------
 drivers/net/dpaa2/dpaa2_ethdev.c        |  8 ++++++--
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h b/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
index 10bc191645..e625a5c035 100644
--- a/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
+++ b/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
@@ -223,13 +223,15 @@ struct swp_active_dqs {
 
 #define dpaa2_queue_storage_free(q, num) \
 ({ \
-	int i; \
-	\
-	for (i = 0; i < (num); i++) { \
-		if ((q)->q_storage[i]) { \
-			dpaa2_free_dq_storage((q)->q_storage[i]); \
-			rte_free((q)->q_storage[i]); \
-			(q)->q_storage[i] = NULL; \
+	if (q) { \
+		int i; \
+		\
+		for (i = 0; i < (num); i++) { \
+			if ((q)->q_storage[i]) { \
+				dpaa2_free_dq_storage((q)->q_storage[i]); \
+				rte_free((q)->q_storage[i]); \
+				(q)->q_storage[i] = NULL; \
+			} \
 		} \
 	} \
 })
diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index cef819650b..eb8333458e 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -620,9 +620,11 @@ dpaa2_alloc_rx_tx_queues(struct rte_eth_dev *dev)
 		priv->rx_vq[i--] = NULL;
 	}
 
-	if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
+	if (priv->rx_err_vq) {
 		dpaa2_q = priv->rx_err_vq;
 		dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
+		rte_free(dpaa2_q);
+		priv->rx_err_vq = NULL;
 	}
 
 	rte_free(mc_q);
@@ -688,9 +690,11 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 				priv->tx_conf_vq[i] = NULL;
 			}
 		}
-		if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
+		if (priv->rx_err_vq) {
 			dpaa2_q = priv->rx_err_vq;
 			dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
+			rte_free(dpaa2_q);
+			priv->rx_err_vq = NULL;
 		}
 
 		/*free memory for all queues (RX+TX) */
-- 
2.43.0

[PATCH v3 03/17] net/dpaa2: warn on Rx descriptor limit in high perf mode

[Maxime Leroy]

The Rx descriptor count warning fires unconditionally when the total
exceeds 11264, but this limit only applies when the DPNI is created
with the high performance buffer option (0x80000000). When using normal
buffers, there is no such limit and the warning is
misleading noise.

Check the DPNI options to only warn when the high performance buffer
mode is active.

Fixes: 35dc25d12792 ("net/dpaa2: warn on high Rx descriptor number")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 18 +++++++++++-------
 drivers/net/dpaa2/mc/fsl_dpni.h  |  6 ++++++
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index eb8333458e..61dcfafff6 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -74,8 +74,9 @@ int dpaa2_timestamp_dynfield_offset = -1;
 
 bool dpaa2_print_parser_result;
 
+/* Rx descriptor limit when DPNI uses high performance buffers */
 #define MAX_NB_RX_DESC		11264
-int total_nb_rx_desc;
+static int total_nb_rx_desc;
 
 int dpaa2_valid_dev;
 struct rte_mempool *dpaa2_tx_sg_pool;
@@ -904,11 +905,13 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	DPAA2_PMD_DEBUG("dev =%p, queue =%d, pool = %p, conf =%p",
 			dev, rx_queue_id, mb_pool, rx_conf);
 
-	total_nb_rx_desc += nb_rx_desc;
-	if (total_nb_rx_desc > MAX_NB_RX_DESC) {
-		DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
-			       MAX_NB_RX_DESC);
-		DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
+	if (priv->options & DPNI_OPT_HIGH_PERF_BUFFER) {
+		total_nb_rx_desc += nb_rx_desc;
+		if (total_nb_rx_desc > MAX_NB_RX_DESC) {
+			DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
+				       MAX_NB_RX_DESC);
+			DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
+		}
 	}
 
 	if (!priv->bp_list || priv->bp_list->mp != mb_pool) {
@@ -1213,7 +1216,8 @@ dpaa2_dev_rx_queue_release(struct rte_eth_dev *dev, uint16_t rx_queue_id)
 	memset(&cfg, 0, sizeof(struct dpni_queue));
 	PMD_INIT_FUNC_TRACE();
 
-	total_nb_rx_desc -= dpaa2_q->nb_desc;
+	if (priv->options & DPNI_OPT_HIGH_PERF_BUFFER)
+		total_nb_rx_desc -= dpaa2_q->nb_desc;
 
 	if (dpaa2_q->cgid != DPAA2_INVALID_CGID) {
 		options = DPNI_QUEUE_OPT_CLEAR_CGID;
diff --git a/drivers/net/dpaa2/mc/fsl_dpni.h b/drivers/net/dpaa2/mc/fsl_dpni.h
index fcc6d4726e..82d6830acc 100644
--- a/drivers/net/dpaa2/mc/fsl_dpni.h
+++ b/drivers/net/dpaa2/mc/fsl_dpni.h
@@ -121,6 +121,12 @@ struct fsl_mc_io;
  * The stashing is enabled by default.
  */
 #define DPNI_OPT_STASHING_DIS			0x002000
+/*
+ * High performance buffer mode.
+ * The total number of Rx descriptors is limited to 11264 in this mode.
+ * When not set, the DPNI uses normal buffers and has no such limit.
+ */
+#define DPNI_OPT_HIGH_PERF_BUFFER		0x80000000
 /**
  * Software sequence maximum layout size
  */
-- 
2.43.0

[PATCH v3 04/17] net/dpaa2: fix resource leak on softparser failure

[Maxime Leroy]

When soft parser loading or enabling fails during probe, the error
path returns directly instead of going through the init_err label.
This skips dpaa2_dev_close() and leaks all resources allocated during
probe (queues, MAC addresses, extract params).

Fixes: 72ec7a678e70 ("net/dpaa2: add soft parser driver")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 61dcfafff6..3658e24dd2 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -3164,7 +3164,7 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		if (ret < 0) {
 			DPAA2_PMD_ERR(" Error(%d) in loading softparser",
 				      ret);
-			return ret;
+			goto init_err;
 		}
 
 		ret = dpaa2_eth_enable_wriop_soft_parser(priv,
@@ -3172,7 +3172,7 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		if (ret < 0) {
 			DPAA2_PMD_ERR(" Error(%d) in enabling softparser",
 				      ret);
-			return ret;
+			goto init_err;
 		}
 	}
 
-- 
2.43.0

[PATCH v3 05/17] net/dpaa2: fix link not up after port stop/start

[Maxime Leroy]

When LSC (Link State Change) interrupts are enabled, the link status
is only updated by interrupt events -- rte_eth_link_get_nowait() reads
the cached value without querying the hardware.

During dev_start(), dpaa2_dev_set_link_up() was called immediately
after dpni_enable(), before LSC interrupts were registered. The MAC
needs ~30ms to renegotiate after being re-enabled, so the initial
link query returned link down. By the time the link came up, the LSC
interrupt handler was not yet installed, so the link-up event was
missed and the cached link status remained down permanently.

The issue does not occur on the first dev_start() after probe because
dpni_reset() during probe does not bring the MAC down -- the kernel
dpmac driver keeps the physical link up. Only dpni_disable() during
dev_stop() causes the MAC to go down, requiring a full renegotiation
on the next dpni_enable().

The problem is more likely to occur with many queues: the queue setup
loop (dpni_get_queue for each RX queue) between dpni_enable() and the
LSC interrupt registration adds MC portal round-trips, giving the MAC
more time to complete negotiation before interrupts are armed. This
makes the link-up event more likely to be missed.

Move dpaa2_dev_set_link_up() after the LSC interrupt setup so that
any link-up event occurring during MAC negotiation is properly caught.

Fixes: c5acbb5ea20e ("net/dpaa2: support link status event")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 3658e24dd2..e58b93c564 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -1391,9 +1391,6 @@ dpaa2_dev_start(struct rte_eth_dev *dev)
 		return ret;
 	}
 
-	/* Power up the phy. Needed to make the link go UP */
-	dpaa2_dev_set_link_up(dev);
-
 	for (i = 0; i < data->nb_rx_queues; i++) {
 		dpaa2_q = data->rx_queues[i];
 		ret = dpni_get_queue(dpni, CMD_PRI_LOW, priv->token,
@@ -1461,6 +1458,12 @@ dpaa2_dev_start(struct rte_eth_dev *dev)
 		dpaa2_eth_setup_irqs(dev, 1);
 	}
 
+	/* Power up the phy. Needed to make the link go UP.
+	 * Called after LSC interrupt setup so that the link-up
+	 * event is not missed if the MAC negotiates quickly.
+	 */
+	dpaa2_dev_set_link_up(dev);
+
 	/* Change the tx burst function if ordered queues are used */
 	if (priv->en_ordered)
 		dev->tx_pkt_burst = dpaa2_dev_tx_ordered;
-- 
2.43.0

[PATCH v3 06/17] bus/fslmc: fix devargs not propagated on hotplug

[Maxime Leroy]

When a device is hotplugged via rte_dev_probe(), the EAL adds the
devargs to its global list before calling the bus scan and then probe.
However, when the fslmc bus is rescanned, it returns early without
refreshing devargs on existing devices.

As a result, PMD-specific devargs (e.g. drv_no_taildrop) passed
through rte_dev_probe() are silently ignored by the driver.

Refresh devargs from the EAL list on all existing devices when rescan
is triggered, before returning early.

Fixes: b5721f271cbf ("bus/fslmc: support DPNI hotplug")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/bus/fslmc/fslmc_bus.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bus/fslmc/fslmc_bus.c b/drivers/bus/fslmc/fslmc_bus.c
index abdb0ad50d..d058441a3f 100644
--- a/drivers/bus/fslmc/fslmc_bus.c
+++ b/drivers/bus/fslmc/fslmc_bus.c
@@ -322,7 +322,11 @@ rte_fslmc_scan(void)
 	char *group_name;
 
 	if (process_once) {
+		struct rte_dpaa2_device *dev;
+
 		DPAA2_BUS_DEBUG("Fslmc bus already scanned. Not rescanning");
+		TAILQ_FOREACH(dev, &rte_fslmc_bus.device_list, next)
+			dev->device.devargs = fslmc_devargs_lookup(dev);
 		return 0;
 	}
 	process_once = 1;
-- 
2.43.0

[PATCH v3 07/17] net/dpaa2: fix spurious VLAN insertion on non-VLAN packets

[Maxime Leroy]

The VLAN insert check in dpaa2_dev_tx() tested the per-packet flag
OR the port-level txmode offload:

  if (ol_flags & RTE_MBUF_F_TX_VLAN ||
      txmode.offloads & RTE_ETH_TX_OFFLOAD_VLAN_INSERT)

When VLAN_INSERT is enabled in txmode, this causes rte_vlan_insert()
to be called on every packet regardless of the per-packet flag, inserting
a VLAN header with whatever stale value is in vlan_tci (typically 0).

The port-level offload only advertises the capability. The actual trigger
must be the per-packet RTE_MBUF_F_TX_VLAN flag, as done by every other
DPDK driver (Intel, mlx5, virtio, vhost, af_packet, etc.).

Fixes: 0ebce6129bc6 ("net/dpaa2: support new ethdev offload APIs")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 7cbd3f33ae..5a98f295a7 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -1346,10 +1346,8 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 				    priv->bp_list->dpaa2_ops_index &&
 				    (*bufs)->nb_segs == 1 &&
 				    rte_mbuf_refcnt_read((*bufs)) == 1)) {
-					if (unlikely(((*bufs)->ol_flags
-						& RTE_MBUF_F_TX_VLAN) ||
-						(eth_data->dev_conf.txmode.offloads
-						& RTE_ETH_TX_OFFLOAD_VLAN_INSERT))) {
+					if (unlikely((*bufs)->ol_flags
+						& RTE_MBUF_F_TX_VLAN)) {
 						ret = rte_vlan_insert(bufs);
 						if (ret)
 							goto send_n_return;
@@ -1402,9 +1400,7 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 				goto send_n_return;
 			}
 
-			if (unlikely(((*bufs)->ol_flags & RTE_MBUF_F_TX_VLAN) ||
-				(eth_data->dev_conf.txmode.offloads
-				& RTE_ETH_TX_OFFLOAD_VLAN_INSERT))) {
+			if (unlikely((*bufs)->ol_flags & RTE_MBUF_F_TX_VLAN)) {
 				int ret = rte_vlan_insert(bufs);
 				if (ret)
 					goto send_n_return;
-- 
2.43.0

[PATCH v3 08/17] net/dpaa2: fix error packet dump crash and memory leak

[Maxime Leroy]

Fix three bugs in dump_err_pkts().

1. NULL pointer dereference: mbuf was checked for NULL but then
   dereferenced unconditionally on the next line.

2. Memory leak on multi-segment packets: the while loop walked
   mbuf to NULL, so the subsequent rte_pktmbuf_free(mbuf) was a
   no-op and the packet was never freed. Use a separate iterator
   variable and free the original mbuf pointer.

3. Segment index not reset between packets: variable i was
   initialized once at function scope and never reset inside the
   do/while loop, so hexdump titles had wrong segment numbers.
   Make it local to the multi-segment block.

Not tested, found by code review.

Fixes: f9465bdcef9d ("net/dpaa2: fix error frame dump")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 31 +++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 5a98f295a7..0de52cbef2 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -651,7 +651,7 @@ dump_err_pkts(struct dpaa2_queue *dpaa2_q)
 	const struct qbman_fd *fd;
 	struct qbman_pull_desc pulldesc;
 	struct rte_eth_dev_data *eth_data = dpaa2_q->eth_data;
-	uint32_t lcore_id = rte_lcore_id(), i = 0;
+	uint32_t lcore_id = rte_lcore_id();
 	void *v_addr, *hw_annot_addr;
 	struct dpaa2_fas *fas;
 	struct rte_mbuf *mbuf;
@@ -726,24 +726,27 @@ dump_err_pkts(struct dpaa2_queue *dpaa2_q)
 			DPAA2_GET_FD_OFFSET(fd), DPAA2_GET_FD_ERR(fd),
 			fas->status);
 
-		if (mbuf)
+		if (mbuf) {
 			__rte_mbuf_sanity_check(mbuf, 1);
-		if (mbuf->nb_segs > 1) {
-			while (mbuf) {
-				sprintf(title, "Payload seg[%d]", i);
-				rte_hexdump(stderr, title,
+			if (mbuf->nb_segs > 1) {
+				struct rte_mbuf *seg = mbuf;
+				int i = 0;
+
+				while (seg) {
+					sprintf(title, "Payload seg[%d]", i);
+					rte_hexdump(stderr, title,
+						(char *)seg->buf_addr + seg->data_off,
+						seg->data_len);
+					seg = seg->next;
+					i++;
+				}
+			} else {
+				rte_hexdump(stderr, "Payload",
 					(char *)mbuf->buf_addr + mbuf->data_off,
 					mbuf->data_len);
-				mbuf = mbuf->next;
-				i++;
 			}
-		} else {
-			rte_hexdump(stderr, "Payload",
-				(char *)mbuf->buf_addr + mbuf->data_off,
-				mbuf->data_len);
+			rte_pktmbuf_free(mbuf);
 		}
-
-		rte_pktmbuf_free(mbuf);
 		dq_storage++;
 		num_rx++;
 	} while (pending);
-- 
2.43.0

[PATCH v3 09/17] net/dpaa2: fix L4 packet type in slow parse path

[Maxime Leroy]

RTE_PTYPE_L4_* values are not independent bits but mutually exclusive
values in a single field. The code set RTE_PTYPE_L4_NONFRAG (0x600)
first then OR'd the specific L4 type on top, corrupting the result:
- TCP: 0x600 | 0x100 = 0x700 (undefined)
- UDP: 0x600 | 0x200 = 0x600 (UDP lost, still NONFRAG)
- SCTP: 0x600 | 0x400 = 0x600 (SCTP lost, still NONFRAG)
- ICMP: 0x600 | 0x500 = 0x700 (undefined)

Move RTE_PTYPE_L4_NONFRAG to the final else fallback so it is only
set when no known L4 protocol is identified, matching how
rte_net_get_ptype() handles L4 classification.

Also remove the L3_IP_UNKNOWN_PROTOCOL check that OR'd
RTE_PTYPE_UNKNOWN (0x0), which was a no-op. That case is now
correctly covered by the NONFRAG fallback.

Not tested, found by code review.

Fixes: a5fc38d422a7 ("net/dpaa2: support Rx packet parsing")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 0de52cbef2..9c908f87b1 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -212,24 +212,18 @@ dpaa2_dev_rx_parse_slow(struct rte_mbuf *mbuf,
 	    L3_IP_N_MORE_FRAGMENT)) {
 		pkt_type |= RTE_PTYPE_L4_FRAG;
 		goto parse_done;
-	} else {
-		pkt_type |= RTE_PTYPE_L4_NONFRAG;
 	}
 
 	if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_UDP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_UDP;
-
 	else if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_TCP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_TCP;
-
 	else if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_SCTP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_SCTP;
-
 	else if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_ICMP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_ICMP;
-
-	else if (BIT_ISSET_AT_POS(annotation->word4, L3_IP_UNKNOWN_PROTOCOL))
-		pkt_type |= RTE_PTYPE_UNKNOWN;
+	else
+		pkt_type |= RTE_PTYPE_L4_NONFRAG;
 
 parse_done:
 	return pkt_type;
-- 
2.43.0

[PATCH v3 10/17] net/dpaa2: fix L3/L4 checksum offload flags

[Maxime Leroy]

The WRIOP FAS (Frame Annotation Status) field provides independent
bits for L3/L4 checksum validation (L3CV/L4CV) and error (L3CE/L4CE).

Two problems:

1. The driver used 'else if' between the L3 and L4 error checks, so
   when both checksums were bad only the L3 error was reported and
   the L4 error was silently lost. Use two independent 'if' statements
   instead, matching how other drivers (i40e, ixgbe, bnxt) handle this.

2. The driver never reported GOOD checksums. When validation was
   performed (L3CV/L4CV set) but no error was flagged (L3CE/L4CE
   clear), report RTE_MBUF_F_RX_IP_CKSUM_GOOD /
   RTE_MBUF_F_RX_L4_CKSUM_GOOD.

Fix both issues in dpaa2_dev_rx_parse_slow() and dpaa2_dev_rx_parse().

Not tested, found by code review.

Fixes: 870354264644 ("net/dpaa2: fix L3/L4 checksum results")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 9c908f87b1..689e5e7ee7 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -203,8 +203,13 @@ dpaa2_dev_rx_parse_slow(struct rte_mbuf *mbuf,
 
 	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_BAD;
-	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_GOOD;
+
+	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_BAD;
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_GOOD;
 
 	if (BIT_ISSET_AT_POS(annotation->word4, L3_IP_1_FIRST_FRAGMENT |
 	    L3_IP_1_MORE_FRAGMENT |
@@ -240,8 +245,13 @@ dpaa2_dev_rx_parse(struct rte_mbuf *mbuf, void *hw_annot_addr)
 
 	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_BAD;
-	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_GOOD;
+
+	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_BAD;
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_GOOD;
 
 	if (unlikely(dpaa2_print_parser_result))
 		dpaa2_print_parse_result(annotation);
-- 
2.43.0

[PATCH v3 11/17] net/dpaa2: fix software taildrop buffer access

[Maxime Leroy]

The sw_td path in dpaa2_dev_tx() reads from the wrong position in the
bufs array. When the goto fires, bufs has already been advanced past
the num_tx successfully sent packets. The first loop then reads num_tx
more entries starting from bufs, going past the end of the input array.
Additionally, the buf_to_free segments for already-enqueued packets
are never freed, leaking memory.

Replace the buggy sw_td code with the same pattern used in
dpaa2_dev_tx_ordered(): free buf_to_free segments first, then use
rte_pktmbuf_free_bulk() to drop remaining unsent packets.

Not tested, found by code review.

Fixes: c3ffe74d85be ("net/dpaa2: support software taildrop")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 689e5e7ee7..8275ba9780 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -1517,21 +1517,15 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 
 	return num_tx;
 sw_td:
-	loop = 0;
-	while (loop < num_tx) {
-		if (unlikely(RTE_MBUF_HAS_EXTBUF(*bufs)))
-			rte_pktmbuf_free(*bufs);
-		bufs++;
-		loop++;
+	for (loop = 0; loop < free_count; loop++) {
+		if (buf_to_free[loop].pkt_id < num_tx)
+			rte_pktmbuf_free_seg(buf_to_free[loop].seg);
 	}
 
 	/* free the pending buffers */
-	while (nb_pkts) {
-		rte_pktmbuf_free(*bufs);
-		bufs++;
-		nb_pkts--;
-		num_tx++;
-	}
+	rte_pktmbuf_free_bulk(bufs, nb_pkts);
+
+	num_tx += nb_pkts;
 	dpaa2_q->tx_pkts += num_tx;
 
 	return num_tx;
-- 
2.43.0

[PATCH v3 12/17] net/dpaa2: fix burst mode info report

[Maxime Leroy]

The burst_mode_get functions were incorrectly listing configured
offload flags instead of reporting the active burst function, unlike
every other PMD (i40e, mlx5, ixgbe, hns3) which match on the burst
function pointer. On top of that, snprintf + break meant only the
first matching offload was ever shown.

Rewrite both functions to match on the actual rx_pkt_burst/tx_pkt_burst
function pointer, consistent with the rest of the codebase.

Not tested, found by code review.

Fixes: ddbc2b6658d0 ("net/dpaa2: add Tx/Rx burst mode info")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 76 +++++++++-----------------------
 1 file changed, 22 insertions(+), 54 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index e58b93c564..3875164794 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -443,34 +443,18 @@ dpaa2_dev_rx_burst_mode_get(struct rte_eth_dev *dev,
 	__rte_unused uint16_t queue_id,
 	struct rte_eth_burst_mode *mode)
 {
-	struct rte_eth_conf *eth_conf = &dev->data->dev_conf;
-	int ret = -EINVAL;
-	unsigned int i;
-	const struct burst_info {
-		uint64_t flags;
-		const char *output;
-	} rx_offload_map[] = {
-			{RTE_ETH_RX_OFFLOAD_CHECKSUM, " Checksum,"},
-			{RTE_ETH_RX_OFFLOAD_SCTP_CKSUM, " SCTP csum,"},
-			{RTE_ETH_RX_OFFLOAD_OUTER_IPV4_CKSUM, " Outer IPV4 csum,"},
-			{RTE_ETH_RX_OFFLOAD_OUTER_UDP_CKSUM, " Outer UDP csum,"},
-			{RTE_ETH_RX_OFFLOAD_VLAN_STRIP, " VLAN strip,"},
-			{RTE_ETH_RX_OFFLOAD_VLAN_FILTER, " VLAN filter,"},
-			{RTE_ETH_RX_OFFLOAD_TIMESTAMP, " Timestamp,"},
-			{RTE_ETH_RX_OFFLOAD_RSS_HASH, " RSS,"},
-			{RTE_ETH_RX_OFFLOAD_SCATTER, " Scattered,"}
-	};
+	eth_rx_burst_t pkt_burst = dev->rx_pkt_burst;
+
+	if (pkt_burst == dpaa2_dev_prefetch_rx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Scalar Prefetch");
+	else if (pkt_burst == dpaa2_dev_rx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Scalar");
+	else if (pkt_burst == dpaa2_dev_loopback_rx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Loopback");
+	else
+		return -EINVAL;
 
-	/* Update Rx offload info */
-	for (i = 0; i < RTE_DIM(rx_offload_map); i++) {
-		if (eth_conf->rxmode.offloads & rx_offload_map[i].flags) {
-			snprintf(mode->info, sizeof(mode->info), "%s",
-				rx_offload_map[i].output);
-			ret = 0;
-			break;
-		}
-	}
-	return ret;
+	return 0;
 }
 
 static int
@@ -478,34 +462,18 @@ dpaa2_dev_tx_burst_mode_get(struct rte_eth_dev *dev,
 			__rte_unused uint16_t queue_id,
 			struct rte_eth_burst_mode *mode)
 {
-	struct rte_eth_conf *eth_conf = &dev->data->dev_conf;
-	int ret = -EINVAL;
-	unsigned int i;
-	const struct burst_info {
-		uint64_t flags;
-		const char *output;
-	} tx_offload_map[] = {
-			{RTE_ETH_TX_OFFLOAD_VLAN_INSERT, " VLAN Insert,"},
-			{RTE_ETH_TX_OFFLOAD_IPV4_CKSUM, " IPV4 csum,"},
-			{RTE_ETH_TX_OFFLOAD_UDP_CKSUM, " UDP csum,"},
-			{RTE_ETH_TX_OFFLOAD_TCP_CKSUM, " TCP csum,"},
-			{RTE_ETH_TX_OFFLOAD_SCTP_CKSUM, " SCTP csum,"},
-			{RTE_ETH_TX_OFFLOAD_OUTER_IPV4_CKSUM, " Outer IPV4 csum,"},
-			{RTE_ETH_TX_OFFLOAD_MT_LOCKFREE, " MT lockfree,"},
-			{RTE_ETH_TX_OFFLOAD_MBUF_FAST_FREE, " MBUF free disable,"},
-			{RTE_ETH_TX_OFFLOAD_MULTI_SEGS, " Scattered,"}
-	};
+	eth_tx_burst_t pkt_burst = dev->tx_pkt_burst;
+
+	if (pkt_burst == dpaa2_dev_tx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Scalar");
+	else if (pkt_burst == dpaa2_dev_tx_ordered)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Ordered");
+	else if (pkt_burst == rte_eth_pkt_burst_dummy)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Dummy");
+	else
+		return -EINVAL;
 
-	/* Update Tx offload info */
-	for (i = 0; i < RTE_DIM(tx_offload_map); i++) {
-		if (eth_conf->txmode.offloads & tx_offload_map[i].flags) {
-			snprintf(mode->info, sizeof(mode->info), "%s",
-				tx_offload_map[i].output);
-			ret = 0;
-			break;
-		}
-	}
-	return ret;
+	return 0;
 }
 
 static int
-- 
2.43.0

[PATCH v3 13/17] net/dpaa2: add SG table walk upper bound in Rx path

[Maxime Leroy]

If hardware or corrupt DMA data fails to set the FINAL bit in the
scatter-gather table, the while loop in eth_sg_fd_to_mbuf() walks
past the end of the SGT buffer. Add DPAA2_MAX_SGS as an upper bound.

Not tested, found by code review.

Fixes: 774e9ea91992 ("net/dpaa2: add support for multi seg buffers")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 8275ba9780..b316e23e87 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -335,7 +335,7 @@ eth_sg_fd_to_mbuf(const struct qbman_fd *fd,
 			(void **)&first_seg, 1, 1);
 #endif
 	cur_seg = first_seg;
-	while (!DPAA2_SG_IS_FINAL(sge)) {
+	while (!DPAA2_SG_IS_FINAL(sge) && i < DPAA2_MAX_SGS) {
 		sge = &sgt[i++];
 		sg_addr = (size_t)DPAA2_IOVA_TO_VADDR(
 				DPAA2_GET_FLE_ADDR(sge));
-- 
2.43.0

[PATCH v3 14/17] net/dpaa2: fix MAC stats DMA alloc per xstats call

[Maxime Leroy]

dpaa2_dev_mac_setup_stats() allocates and frees DMA buffers on every
xstats_get() call. This is wasteful and not thread-safe: concurrent
callers can overwrite priv pointers, leading to use-after-free. It
also does not check for allocation failure before passing IOVAs to
the MC firmware.

Move the DMA buffer allocation to dpaa2_dev_init() (only when MC
version supports MAC stats) and free them in dpaa2_dev_close(). In
xstats_get(), just check if the buffers were allocated.

Not tested, found by code review.

Fixes: d1cdef2ab592 ("net/dpaa2: add dpmac counters in xstats")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 65 +++++++++++++++-----------------
 1 file changed, 30 insertions(+), 35 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 3875164794..d5e30ce5fb 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -1550,6 +1550,11 @@ dpaa2_dev_close(struct rte_eth_dev *dev)
 
 	rte_free(priv->extract.qos_extract_param);
 
+	rte_free(priv->cnt_idx_dma_mem);
+	rte_free(priv->cnt_values_dma_mem);
+	priv->cnt_idx_dma_mem = NULL;
+	priv->cnt_values_dma_mem = NULL;
+
 	DPAA2_PMD_INFO("%s: netdev deleted", dev->data->name);
 	return 0;
 }
@@ -1905,7 +1910,6 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
 	unsigned int i = 0, j = 0, num = RTE_DIM(dpaa2_xstats_strings);
 	struct dpaa2_dev_priv *priv = dev->data->dev_private;
 	union dpni_statistics value[13] = {};
-	struct mc_version mc_ver_info = {0};
 	struct dpni_rx_tc_policing_cfg cfg;
 	uint8_t page_id, stats_id;
 	uint64_t *cnt_values;
@@ -1976,44 +1980,24 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
 		i++;
 	}
 
-	if (mc_get_version(dpni, CMD_PRI_LOW, &mc_ver_info))
-		DPAA2_PMD_WARN("Unable to obtain MC version");
-
-	/* mac_statistics supported on MC version > 10.39.0 */
-	if (mc_ver_info.major >= MC_VER_MAJOR &&
-	    mc_ver_info.minor >= MC_VER_MINOR &&
-	    mc_ver_info.revision > 0) {
-		dpaa2_dev_mac_setup_stats(dev);
-		retcode = dpni_get_mac_statistics(dpni, CMD_PRI_LOW, priv->token,
-						  priv->cnt_idx_iova,
-						  priv->cnt_values_iova,
-						  DPAA2_MAC_NUM_STATS);
-		if (retcode) {
-			while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
-				xstats[i].id = i;
-				xstats[i].value = 0;
-				i++;
-			}
-		}
-		if (!retcode) {
-			cnt_values = priv->cnt_values_dma_mem;
-			while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
-				/* mac counters value */
-				xstats[i].id = i;
-				xstats[i].value = rte_le_to_cpu_64(*cnt_values++);
-				i++;
-			}
-		}
-		rte_free(priv->cnt_values_dma_mem);
-		rte_free(priv->cnt_idx_dma_mem);
-		priv->cnt_idx_dma_mem = NULL;
-		priv->cnt_values_dma_mem = NULL;
-	} else {
+	if (priv->cnt_idx_dma_mem &&
+	    !dpni_get_mac_statistics(dpni, CMD_PRI_LOW, priv->token,
+				    priv->cnt_idx_iova,
+				    priv->cnt_values_iova,
+				    DPAA2_MAC_NUM_STATS)) {
+		cnt_values = priv->cnt_values_dma_mem;
 		while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
 			xstats[i].id = i;
-			xstats[i].value = 0;
+			xstats[i].value = rte_le_to_cpu_64(*cnt_values++);
 			i++;
 		}
+		return i;
+	}
+
+	while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
+		xstats[i].id = i;
+		xstats[i].value = 0;
+		i++;
 	}
 
 	return i;
@@ -3155,6 +3139,17 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 
 	priv->speed_capa = dpaa2_dev_get_speed_capability(eth_dev);
 
+	/* mac_statistics supported on MC version > 10.39.0 */
+	{
+		struct mc_version mc_ver_info = {0};
+
+		if (!mc_get_version(dpni_dev, CMD_PRI_LOW, &mc_ver_info) &&
+		    mc_ver_info.major >= MC_VER_MAJOR &&
+		    mc_ver_info.minor >= MC_VER_MINOR &&
+		    mc_ver_info.revision > 0)
+			dpaa2_dev_mac_setup_stats(eth_dev);
+	}
+
 	return 0;
 init_err:
 	dpaa2_dev_close(eth_dev);
-- 
2.43.0

[PATCH v3 15/17] net/dpaa2: use check interval macro in link down path

[Maxime Leroy]

Replace hardcoded rte_delay_us(100 * 1000) with
rte_delay_ms(CHECK_INTERVAL) for consistency with the rest of the
driver.

No functional change.

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index d5e30ce5fb..a70e6895c8 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -2305,7 +2305,7 @@ dpaa2_dev_set_link_down(struct rte_eth_dev *dev)
 		}
 		if (dpni_enabled)
 			/* Allow the MC some slack */
-			rte_delay_us(100 * 1000);
+			rte_delay_ms(CHECK_INTERVAL);
 	} while (dpni_enabled && --retries);
 
 	if (!retries) {
-- 
2.43.0

[PATCH v3 16/17] net/dpaa2: add devargs to disable Rx taildrop

[Maxime Leroy]

The DPAA2_RX_TAILDROP_OFF flag was defined and checked in
dpaa2_dev_rx_queue_setup(), but never set — making the taildrop
disable path dead code.

Wire it to a new "drv_no_taildrop" devargs, following the existing
pattern (drv_loopback, drv_no_prefetch, etc.).

Also move dpaa2_q->nb_desc assignment before the taildrop if/else
so that the descriptor count is always tracked correctly, regardless
of whether taildrop is enabled or disabled.

Usage: fslmc:dpni.1,drv_no_taildrop=1

Note: the taildrop disable path has never been reachable until now
and is untested. NXP maintainers should validate this feature.

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index a70e6895c8..d9d8ba26a9 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -34,6 +34,7 @@
 #define DRIVER_TX_CONF "drv_tx_conf"
 #define DRIVER_RX_PARSE_ERR_DROP "drv_rx_parse_drop"
 #define DRIVER_ERROR_QUEUE  "drv_err_queue"
+#define DRIVER_NO_TAILDROP  "drv_no_taildrop"
 #define CHECK_INTERVAL         100  /* 100ms */
 #define MAX_REPEAT_TIME        90   /* 9s (90 * 100ms) in total */
 
@@ -897,7 +898,6 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	dpaa2_q = priv->rx_vq[rx_queue_id];
 	dpaa2_q->mb_pool = mb_pool; /**< mbuf pool to populate RX ring. */
 	dpaa2_q->bp_array = rte_dpaa2_bpid_info;
-	dpaa2_q->nb_desc = UINT16_MAX;
 	dpaa2_q->offloads = rx_conf->offloads;
 
 	/*Get the flow id from given VQ id*/
@@ -950,11 +950,12 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 		return ret;
 	}
 
+	dpaa2_q->nb_desc = nb_rx_desc;
+
 	if (!(priv->flags & DPAA2_RX_TAILDROP_OFF)) {
 		struct dpni_taildrop taildrop;
 
 		taildrop.enable = 1;
-		dpaa2_q->nb_desc = nb_rx_desc;
 		/* Private CGR will use tail drop length as nb_rx_desc.
 		 * for rest cases we can use standard byte based tail drop.
 		 * There is no HW restriction, but number of CGRs are limited,
@@ -2887,6 +2888,11 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		DPAA2_PMD_INFO("Rx loopback mode");
 	}
 
+	if (dpaa2_get_devargs(dev->devargs, DRIVER_NO_TAILDROP)) {
+		priv->flags |= DPAA2_RX_TAILDROP_OFF;
+		DPAA2_PMD_INFO("Rx taildrop disabled");
+	}
+
 	/* For secondary processes, the primary has done all the work */
 	if (rte_eal_process_type() != RTE_PROC_PRIMARY) {
 		/* In case of secondary, only burst and ops API need to be
@@ -3384,5 +3390,6 @@ RTE_PMD_REGISTER_PARAM_STRING(NET_DPAA2_PMD_DRIVER_NAME,
 		DRIVER_NO_PREFETCH_MODE "=<int>"
 		DRIVER_TX_CONF "=<int>"
 		DRIVER_RX_PARSE_ERR_DROP "=<int>"
-		DRIVER_ERROR_QUEUE "=<int>");
+		DRIVER_ERROR_QUEUE "=<int>"
+		DRIVER_NO_TAILDROP "=<int>");
 RTE_LOG_REGISTER_DEFAULT(dpaa2_logtype_pmd, NOTICE);
-- 
2.43.0

[PATCH v3 17/17] net/dpaa2: add devargs alternative for data stashing getenv

[Maxime Leroy]

The DPAA2_DATA_STASHING_OFF environment variable is used by customers
to dynamically disable data stashing without rebuilding their
application. Add a devargs option "drv_no_data_stashing" as an
alternative, consistent with the existing devargs pattern (drv_loopback,
drv_no_prefetch, drv_no_taildrop), while keeping the getenv for
backward compatibility.

Move the check from dpaa2_dev_rx_queue_setup() to dpaa2_dev_init(),
consistent with how other driver flags are handled.

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 12 ++++++++++--
 drivers/net/dpaa2/dpaa2_ethdev.h |  3 +++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index d9d8ba26a9..31fdef8598 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -35,6 +35,7 @@
 #define DRIVER_RX_PARSE_ERR_DROP "drv_rx_parse_drop"
 #define DRIVER_ERROR_QUEUE  "drv_err_queue"
 #define DRIVER_NO_TAILDROP  "drv_no_taildrop"
+#define DRIVER_NO_DATA_STASHING "drv_no_data_stashing"
 #define CHECK_INTERVAL         100  /* 100ms */
 #define MAX_REPEAT_TIME        90   /* 9s (90 * 100ms) in total */
 
@@ -929,7 +930,7 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 		options |= DPNI_QUEUE_OPT_FLC;
 		cfg.flc.stash_control = true;
 		dpaa2_flc_stashing_clear_all(&cfg.flc.value);
-		if (getenv("DPAA2_DATA_STASHING_OFF")) {
+		if (priv->flags & DPAA2_DATA_STASHING_OFF) {
 			dpaa2_flc_stashing_set(DPAA2_FLC_DATA_STASHING, 0,
 				&cfg.flc.value);
 			dpaa2_q->data_stashing_off = 1;
@@ -2893,6 +2894,12 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		DPAA2_PMD_INFO("Rx taildrop disabled");
 	}
 
+	if (dpaa2_get_devargs(dev->devargs, DRIVER_NO_DATA_STASHING) ||
+	    getenv("DPAA2_DATA_STASHING_OFF")) {
+		priv->flags |= DPAA2_DATA_STASHING_OFF;
+		DPAA2_PMD_INFO("Data stashing disabled");
+	}
+
 	/* For secondary processes, the primary has done all the work */
 	if (rte_eal_process_type() != RTE_PROC_PRIMARY) {
 		/* In case of secondary, only burst and ops API need to be
@@ -3391,5 +3398,6 @@ RTE_PMD_REGISTER_PARAM_STRING(NET_DPAA2_PMD_DRIVER_NAME,
 		DRIVER_TX_CONF "=<int>"
 		DRIVER_RX_PARSE_ERR_DROP "=<int>"
 		DRIVER_ERROR_QUEUE "=<int>"
-		DRIVER_NO_TAILDROP "=<int>");
+		DRIVER_NO_TAILDROP "=<int>"
+		DRIVER_NO_DATA_STASHING "=<int>");
 RTE_LOG_REGISTER_DEFAULT(dpaa2_logtype_pmd, NOTICE);
diff --git a/drivers/net/dpaa2/dpaa2_ethdev.h b/drivers/net/dpaa2/dpaa2_ethdev.h
index 86b3022ddb..4da47a543a 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.h
+++ b/drivers/net/dpaa2/dpaa2_ethdev.h
@@ -97,6 +97,9 @@
  */
 #define DPAA2_TX_DYNAMIC_CONF_ENABLE	RTE_BIT32(9)
 
+/* Disable data stashing (prefetch of packet data into CPU cache) */
+#define DPAA2_DATA_STASHING_OFF		RTE_BIT32(10)
+
 #define DPAAX_RX_ERROR_QUEUE_FLAG	RTE_BIT32(11)
 
 /* DPDMUX index for DPMAC */
-- 
2.43.0

Re: [PATCH v2 11/17] net/dpaa2: fix software taildrop buffer access

[Stephen Hemminger]

On Fri, 27 Feb 2026 22:29:34 +0100
Morten Brørup <mb@smartsharesystems.com> wrote:

> > > It is unsafe to use free_bulk on transmit path because packets in
> > > burst might come from different pools. An example would be a router
> > > forwarding from two incoming NIC's to one outgoing NIC.  
> > 
> > Is it?
> > 
> > IIUC, this helper was added specifically to handle mbufs from multiple
> > mempools.

never mind, that was old brain cells, looks like it got fixed.

Re: [PATCH v3 17/17] net/dpaa2: add devargs alternative for data stashing getenv

[Stephen Hemminger]

On Fri,  6 Mar 2026 14:30:35 +0100
Maxime Leroy <maxime@leroys.fr> wrote:

> The DPAA2_DATA_STASHING_OFF environment variable is used by customers
> to dynamically disable data stashing without rebuilding their
> application. Add a devargs option "drv_no_data_stashing" as an
> alternative, consistent with the existing devargs pattern (drv_loopback,
> drv_no_prefetch, drv_no_taildrop), while keeping the getenv for
> backward compatibility.
> 
> Move the check from dpaa2_dev_rx_queue_setup() to dpaa2_dev_init(),
> consistent with how other driver flags are handled.
> 
> Signed-off-by: Maxime Leroy <maxime@leroys.fr>

FYI use of environment variables in drivers should have been more
strongly discouraged. In future will add that to automated review to
add adding environment variables as a warning.

Re: [PATCH v3 00/17] net/dpaa2: fixes and improvements

[Stephen Hemminger]

On Fri,  6 Mar 2026 14:30:18 +0100
Maxime Leroy <maxime@leroys.fr> wrote:

> Various fixes and improvements for the dpaa2 net driver and fslmc bus.
> 
> Patches 1-6 fix resource leaks on port close, error paths, link status
> and devargs propagation on hotplug.
> 
> Patches 7-14 fix additional bugs: spurious VLAN insertion, error packet
> dump crash, packet type classification, checksum offload flags, software
> taildrop buffer access, burst mode info reporting, SG table walk bounds,
> and MAC stats DMA allocation.
> 
> Patch 15 is a minor cleanup in the link status area.
> 
> Patches 16-17 add devargs alternatives for getenv-based configuration
> of taildrop and data stashing options.
> 
> Changes since v2:
> - Fix checkpatch warnings: short SHA in Fixes tag (patch 14),
>   long line in commit message (patch 10)
> - Fix check-git-log warnings: shorten headlines (patches 3, 9, 12, 14),
>   fix tag order Fixes/Cc (patches 10, 11), fix wrong Fixes reference
>   (patch 8), remove colon after function name in commit body (patch 8),
>   lowercase macro name in headline (patch 15)
> 
> Changes since v1:
> - Add Cc: stable@dpdk.org on patches with Fixes: tags (Stephen)
> - Reorder series: fixes first, then improvements (Stephen)
> - Patch 2: squash with former patch 4 (Hemant)
> - Patch 6: move devargs refresh from plug to scan rescan path (David)
> - Patch 17: keep getenv for backward compatibility, add devargs as
>   alternative instead of replacement
> - Drop former patch 11 (bus/fslmc: remove dead blocklist check) to
>   avoid disaligning with other buses (David)
> - New patches 8, 11-14 fixing issues reported by Stephen
> - New patches 7, 9-10 fixing VLAN insertion and packet classification
>   issues
> 
> Maxime Leroy (17):
>   net/dpaa2: fix queue block memory leak on port close
>   net/dpaa2: fix Rx error queue memory leaks
>   net/dpaa2: warn on Rx descriptor limit in high perf mode
>   net/dpaa2: fix resource leak on softparser failure
>   net/dpaa2: fix link not up after port stop/start
>   bus/fslmc: fix devargs not propagated on hotplug
>   net/dpaa2: fix spurious VLAN insertion on non-VLAN packets
>   net/dpaa2: fix error packet dump crash and memory leak
>   net/dpaa2: fix L4 packet type in slow parse path
>   net/dpaa2: fix L3/L4 checksum offload flags
>   net/dpaa2: fix software taildrop buffer access
>   net/dpaa2: fix burst mode info report
>   net/dpaa2: add SG table walk upper bound in Rx path
>   net/dpaa2: fix MAC stats DMA alloc per xstats call
>   net/dpaa2: use check interval macro in link down path
>   net/dpaa2: add devargs to disable Rx taildrop
>   net/dpaa2: add devargs alternative for data stashing getenv
> 
>  drivers/bus/fslmc/fslmc_bus.c           |   4 +
>  drivers/bus/fslmc/portal/dpaa2_hw_pvt.h |  16 +-
>  drivers/net/dpaa2/dpaa2_ethdev.c        | 211 ++++++++++++------------
>  drivers/net/dpaa2/dpaa2_ethdev.h        |   3 +
>  drivers/net/dpaa2/dpaa2_rxtx.c          |  85 +++++-----
>  drivers/net/dpaa2/mc/fsl_dpni.h         |   6 +
>  6 files changed, 164 insertions(+), 161 deletions(-)
> 

Applied to next-net, minor edits to first commit message to fix
the reference commit; problem reported by checkpatches

Re: [PATCH v3 00/17] net/dpaa2: fixes and improvements

[Maxime Leroy]

Le ven. 6 mars 2026 à 19:51, Stephen Hemminger
<stephen@networkplumber.org> a écrit :
>
> On Fri,  6 Mar 2026 14:30:18 +0100
> Maxime Leroy <maxime@leroys.fr> wrote:
>
> > Various fixes and improvements for the dpaa2 net driver and fslmc bus.
> >
> > Patches 1-6 fix resource leaks on port close, error paths, link status
> > and devargs propagation on hotplug.
> >
> > Patches 7-14 fix additional bugs: spurious VLAN insertion, error packet
> > dump crash, packet type classification, checksum offload flags, software
> > taildrop buffer access, burst mode info reporting, SG table walk bounds,
> > and MAC stats DMA allocation.
> >
> > Patch 15 is a minor cleanup in the link status area.
> >
> > Patches 16-17 add devargs alternatives for getenv-based configuration
> > of taildrop and data stashing options.
> >
> > Changes since v2:
> > - Fix checkpatch warnings: short SHA in Fixes tag (patch 14),
> >   long line in commit message (patch 10)
> > - Fix check-git-log warnings: shorten headlines (patches 3, 9, 12, 14),
> >   fix tag order Fixes/Cc (patches 10, 11), fix wrong Fixes reference
> >   (patch 8), remove colon after function name in commit body (patch 8),
> >   lowercase macro name in headline (patch 15)
> >
> > Changes since v1:
> > - Add Cc: stable@dpdk.org on patches with Fixes: tags (Stephen)
> > - Reorder series: fixes first, then improvements (Stephen)
> > - Patch 2: squash with former patch 4 (Hemant)
> > - Patch 6: move devargs refresh from plug to scan rescan path (David)
> > - Patch 17: keep getenv for backward compatibility, add devargs as
> >   alternative instead of replacement
> > - Drop former patch 11 (bus/fslmc: remove dead blocklist check) to
> >   avoid disaligning with other buses (David)
> > - New patches 8, 11-14 fixing issues reported by Stephen
> > - New patches 7, 9-10 fixing VLAN insertion and packet classification
> >   issues
> >
> > Maxime Leroy (17):
> >   net/dpaa2: fix queue block memory leak on port close
> >   net/dpaa2: fix Rx error queue memory leaks
> >   net/dpaa2: warn on Rx descriptor limit in high perf mode
> >   net/dpaa2: fix resource leak on softparser failure
> >   net/dpaa2: fix link not up after port stop/start
> >   bus/fslmc: fix devargs not propagated on hotplug
> >   net/dpaa2: fix spurious VLAN insertion on non-VLAN packets
> >   net/dpaa2: fix error packet dump crash and memory leak
> >   net/dpaa2: fix L4 packet type in slow parse path
> >   net/dpaa2: fix L3/L4 checksum offload flags
> >   net/dpaa2: fix software taildrop buffer access
> >   net/dpaa2: fix burst mode info report
> >   net/dpaa2: add SG table walk upper bound in Rx path
> >   net/dpaa2: fix MAC stats DMA alloc per xstats call
> >   net/dpaa2: use check interval macro in link down path
> >   net/dpaa2: add devargs to disable Rx taildrop
> >   net/dpaa2: add devargs alternative for data stashing getenv
> >
> >  drivers/bus/fslmc/fslmc_bus.c           |   4 +
> >  drivers/bus/fslmc/portal/dpaa2_hw_pvt.h |  16 +-
> >  drivers/net/dpaa2/dpaa2_ethdev.c        | 211 ++++++++++++------------
> >  drivers/net/dpaa2/dpaa2_ethdev.h        |   3 +
> >  drivers/net/dpaa2/dpaa2_rxtx.c          |  85 +++++-----
> >  drivers/net/dpaa2/mc/fsl_dpni.h         |   6 +
> >  6 files changed, 164 insertions(+), 161 deletions(-)
> >
>
> Applied to next-net, minor edits to first commit message to fix
> the reference commit; problem reported by checkpatches

Hi Stephen,

Thanks for the merge. However, I was not expecting the series to be
merged without an ACK from NXP maintainers.
Many of the issues were found through code review only and marked as
“not tested”, with only minimal runtime checks on my side. I would
feel more comfortable with an ACK from NXP.

Hemant, could you please take a look at the series when you have a chance?

Thanks,

Maxime

Re: [PATCH v3 00/17] net/dpaa2: fixes and improvements

[Hemant Agrawal]

On 09-03-2026 15:15, Maxime Leroy wrote:
> Le ven. 6 mars 2026 à 19:51, Stephen Hemminger
> <stephen@networkplumber.org> a écrit :
>> On Fri,  6 Mar 2026 14:30:18 +0100
>> Maxime Leroy <maxime@leroys.fr> wrote:
>>
>>> Various fixes and improvements for the dpaa2 net driver and fslmc bus.
>>>
>>> Patches 1-6 fix resource leaks on port close, error paths, link status
>>> and devargs propagation on hotplug.
>>>
>>> Patches 7-14 fix additional bugs: spurious VLAN insertion, error packet
>>> dump crash, packet type classification, checksum offload flags, software
>>> taildrop buffer access, burst mode info reporting, SG table walk bounds,
>>> and MAC stats DMA allocation.
>>>
>>> Patch 15 is a minor cleanup in the link status area.
>>>
>>> Patches 16-17 add devargs alternatives for getenv-based configuration
>>> of taildrop and data stashing options.
>>>
>>> Changes since v2:
>>> - Fix checkpatch warnings: short SHA in Fixes tag (patch 14),
>>>    long line in commit message (patch 10)
>>> - Fix check-git-log warnings: shorten headlines (patches 3, 9, 12, 14),
>>>    fix tag order Fixes/Cc (patches 10, 11), fix wrong Fixes reference
>>>    (patch 8), remove colon after function name in commit body (patch 8),
>>>    lowercase macro name in headline (patch 15)
>>>
>>> Changes since v1:
>>> - Add Cc: stable@dpdk.org on patches with Fixes: tags (Stephen)
>>> - Reorder series: fixes first, then improvements (Stephen)
>>> - Patch 2: squash with former patch 4 (Hemant)
>>> - Patch 6: move devargs refresh from plug to scan rescan path (David)
>>> - Patch 17: keep getenv for backward compatibility, add devargs as
>>>    alternative instead of replacement
>>> - Drop former patch 11 (bus/fslmc: remove dead blocklist check) to
>>>    avoid disaligning with other buses (David)
>>> - New patches 8, 11-14 fixing issues reported by Stephen
>>> - New patches 7, 9-10 fixing VLAN insertion and packet classification
>>>    issues
>>>
>>> Maxime Leroy (17):
>>>    net/dpaa2: fix queue block memory leak on port close
>>>    net/dpaa2: fix Rx error queue memory leaks
>>>    net/dpaa2: warn on Rx descriptor limit in high perf mode
>>>    net/dpaa2: fix resource leak on softparser failure
>>>    net/dpaa2: fix link not up after port stop/start
>>>    bus/fslmc: fix devargs not propagated on hotplug
>>>    net/dpaa2: fix spurious VLAN insertion on non-VLAN packets
>>>    net/dpaa2: fix error packet dump crash and memory leak
>>>    net/dpaa2: fix L4 packet type in slow parse path
>>>    net/dpaa2: fix L3/L4 checksum offload flags
>>>    net/dpaa2: fix software taildrop buffer access
>>>    net/dpaa2: fix burst mode info report
>>>    net/dpaa2: add SG table walk upper bound in Rx path
>>>    net/dpaa2: fix MAC stats DMA alloc per xstats call
>>>    net/dpaa2: use check interval macro in link down path
>>>    net/dpaa2: add devargs to disable Rx taildrop
>>>    net/dpaa2: add devargs alternative for data stashing getenv
>>>
>>>   drivers/bus/fslmc/fslmc_bus.c           |   4 +
>>>   drivers/bus/fslmc/portal/dpaa2_hw_pvt.h |  16 +-
>>>   drivers/net/dpaa2/dpaa2_ethdev.c        | 211 ++++++++++++------------
>>>   drivers/net/dpaa2/dpaa2_ethdev.h        |   3 +
>>>   drivers/net/dpaa2/dpaa2_rxtx.c          |  85 +++++-----
>>>   drivers/net/dpaa2/mc/fsl_dpni.h         |   6 +
>>>   6 files changed, 164 insertions(+), 161 deletions(-)
>>>
>> Applied to next-net, minor edits to first commit message to fix
>> the reference commit; problem reported by checkpatches
> Hi Stephen,
>
> Thanks for the merge. However, I was not expecting the series to be
> merged without an ACK from NXP maintainers.
> Many of the issues were found through code review only and marked as
> “not tested”, with only minimal runtime checks on my side. I would
> feel more comfortable with an ACK from NXP.
>
> Hemant, could you please take a look at the series when you have a chance?
Yes, we will be testing it soon.
> Thanks,
>
> Maxime

Re: [PATCH v3 03/17] net/dpaa2: warn on Rx descriptor limit in high perf mode

[Hemant Agrawal]

On 06-03-2026 19:00, Maxime Leroy wrote:
> The Rx descriptor count warning fires unconditionally when the total
> exceeds 11264, but this limit only applies when the DPNI is created
> with the high performance buffer option (0x80000000). When using normal
> buffers, there is no such limit and the warning is
> misleading noise.
>
> Check the DPNI options to only warn when the high performance buffer
> mode is active.
>
> Fixes: 35dc25d12792 ("net/dpaa2: warn on high Rx descriptor number")
> Cc: stable@dpdk.org
>
> Signed-off-by: Maxime Leroy <maxime@leroys.fr>
> Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
> ---
>   drivers/net/dpaa2/dpaa2_ethdev.c | 18 +++++++++++-------
>   drivers/net/dpaa2/mc/fsl_dpni.h  |  6 ++++++
>   2 files changed, 17 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
> index eb8333458e..61dcfafff6 100644
> --- a/drivers/net/dpaa2/dpaa2_ethdev.c
> +++ b/drivers/net/dpaa2/dpaa2_ethdev.c
> @@ -74,8 +74,9 @@ int dpaa2_timestamp_dynfield_offset = -1;
>   
>   bool dpaa2_print_parser_result;
>   
> +/* Rx descriptor limit when DPNI uses high performance buffers */
>   #define MAX_NB_RX_DESC		11264
> -int total_nb_rx_desc;
> +static int total_nb_rx_desc;
>   
>   int dpaa2_valid_dev;
>   struct rte_mempool *dpaa2_tx_sg_pool;
> @@ -904,11 +905,13 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
>   	DPAA2_PMD_DEBUG("dev =%p, queue =%d, pool = %p, conf =%p",
>   			dev, rx_queue_id, mb_pool, rx_conf);
>   
> -	total_nb_rx_desc += nb_rx_desc;
> -	if (total_nb_rx_desc > MAX_NB_RX_DESC) {
> -		DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
> -			       MAX_NB_RX_DESC);
> -		DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
> +	if (priv->options & DPNI_OPT_HIGH_PERF_BUFFER) {
> +		total_nb_rx_desc += nb_rx_desc;
> +		if (total_nb_rx_desc > MAX_NB_RX_DESC) {
> +			DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
> +				       MAX_NB_RX_DESC);
> +			DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
> +		}
>   	}
>   

how about not changing the calculation, but only the warning.

     total_nb_rx_desc += nb_rx_desc;
     if (total_nb_rx_desc > MAX_NB_RX_DESC_IN_PEB &&
         (priv->options & DPNI_OPT_V1_PFDR_IN_PEB)) {
         DPAA2_PMD_WARN("RX descriptor exceeds limit(%d) to load PFDR in 
PEB",
             MAX_NB_RX_DESC_IN_PEB);
         DPAA2_PMD_WARN("Suggest removing 0x%08x from DPNI creating 
options(0x%08x)",
             DPNI_OPT_V1_PFDR_IN_PEB, priv->options);
         DPAA2_PMD_WARN("Or reduce RX descriptor number(%d) per queue",  
nb_rx_desc);
     }


>   	if (!priv->bp_list || priv->bp_list->mp != mb_pool) {
> @@ -1213,7 +1216,8 @@ dpaa2_dev_rx_queue_release(struct rte_eth_dev *dev, uint16_t rx_queue_id)
>   	memset(&cfg, 0, sizeof(struct dpni_queue));
>   	PMD_INIT_FUNC_TRACE();
>   
> -	total_nb_rx_desc -= dpaa2_q->nb_desc;
> +	if (priv->options & DPNI_OPT_HIGH_PERF_BUFFER)
> +		total_nb_rx_desc -= dpaa2_q->nb_desc;
>   
>   	if (dpaa2_q->cgid != DPAA2_INVALID_CGID) {
>   		options = DPNI_QUEUE_OPT_CLEAR_CGID;
> diff --git a/drivers/net/dpaa2/mc/fsl_dpni.h b/drivers/net/dpaa2/mc/fsl_dpni.h
> index fcc6d4726e..82d6830acc 100644
> --- a/drivers/net/dpaa2/mc/fsl_dpni.h
> +++ b/drivers/net/dpaa2/mc/fsl_dpni.h
> @@ -121,6 +121,12 @@ struct fsl_mc_io;
>    * The stashing is enabled by default.
>    */
>   #define DPNI_OPT_STASHING_DIS			0x002000
> +/*
> + * High performance buffer mode.
> + * The total number of Rx descriptors is limited to 11264 in this mode.
> + * When not set, the DPNI uses normal buffers and has no such limit.
> + */
> +#define DPNI_OPT_HIGH_PERF_BUFFER		0x80000000
Or use: #define DPNI_OPT_V1_PFDR_IN_PEB
>   /**
>    * Software sequence maximum layout size
>    */

Re: [PATCH v3 03/17] net/dpaa2: warn on Rx descriptor limit in high perf mode

[Maxime Leroy]

On Thu, Mar 12, 2026 at 10:27 AM Hemant Agrawal
<hemant.agrawal@oss.nxp.com> wrote:
>
>
> On 06-03-2026 19:00, Maxime Leroy wrote:
> > The Rx descriptor count warning fires unconditionally when the total
> > exceeds 11264, but this limit only applies when the DPNI is created
> > with the high performance buffer option (0x80000000). When using normal
> > buffers, there is no such limit and the warning is
> > misleading noise.
> >
> > Check the DPNI options to only warn when the high performance buffer
> > mode is active.
> >
> > Fixes: 35dc25d12792 ("net/dpaa2: warn on high Rx descriptor number")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Maxime Leroy <maxime@leroys.fr>
> > Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
> > ---
> >   drivers/net/dpaa2/dpaa2_ethdev.c | 18 +++++++++++-------
> >   drivers/net/dpaa2/mc/fsl_dpni.h  |  6 ++++++
> >   2 files changed, 17 insertions(+), 7 deletions(-)
> >
> > diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
> > index eb8333458e..61dcfafff6 100644
> > --- a/drivers/net/dpaa2/dpaa2_ethdev.c
> > +++ b/drivers/net/dpaa2/dpaa2_ethdev.c
> > @@ -74,8 +74,9 @@ int dpaa2_timestamp_dynfield_offset = -1;
> >
> >   bool dpaa2_print_parser_result;
> >
> > +/* Rx descriptor limit when DPNI uses high performance buffers */
> >   #define MAX_NB_RX_DESC              11264
> > -int total_nb_rx_desc;
> > +static int total_nb_rx_desc;
> >
> >   int dpaa2_valid_dev;
> >   struct rte_mempool *dpaa2_tx_sg_pool;
> > @@ -904,11 +905,13 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
> >       DPAA2_PMD_DEBUG("dev =%p, queue =%d, pool = %p, conf =%p",
> >                       dev, rx_queue_id, mb_pool, rx_conf);
> >
> > -     total_nb_rx_desc += nb_rx_desc;
> > -     if (total_nb_rx_desc > MAX_NB_RX_DESC) {
> > -             DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
> > -                            MAX_NB_RX_DESC);
> > -             DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
> > +     if (priv->options & DPNI_OPT_HIGH_PERF_BUFFER) {
> > +             total_nb_rx_desc += nb_rx_desc;
> > +             if (total_nb_rx_desc > MAX_NB_RX_DESC) {
> > +                     DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
> > +                                    MAX_NB_RX_DESC);
> > +                     DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
> > +             }
> >       }
> >
>
> how about not changing the calculation, but only the warning.
yes, indeed.

>
>      total_nb_rx_desc += nb_rx_desc;
>      if (total_nb_rx_desc > MAX_NB_RX_DESC_IN_PEB &&
>          (priv->options & DPNI_OPT_V1_PFDR_IN_PEB)) {
>          DPAA2_PMD_WARN("RX descriptor exceeds limit(%d) to load PFDR in
> PEB",
>              MAX_NB_RX_DESC_IN_PEB);
>          DPAA2_PMD_WARN("Suggest removing 0x%08x from DPNI creating
> options(0x%08x)",
>              DPNI_OPT_V1_PFDR_IN_PEB, priv->options);
>          DPAA2_PMD_WARN("Or reduce RX descriptor number(%d) per queue",
> nb_rx_desc);
>      }
>
>
> >       if (!priv->bp_list || priv->bp_list->mp != mb_pool) {
> > @@ -1213,7 +1216,8 @@ dpaa2_dev_rx_queue_release(struct rte_eth_dev *dev, uint16_t rx_queue_id)
> >       memset(&cfg, 0, sizeof(struct dpni_queue));
> >       PMD_INIT_FUNC_TRACE();
> >
> > -     total_nb_rx_desc -= dpaa2_q->nb_desc;
> > +     if (priv->options & DPNI_OPT_HIGH_PERF_BUFFER)
> > +             total_nb_rx_desc -= dpaa2_q->nb_desc;
> >
> >       if (dpaa2_q->cgid != DPAA2_INVALID_CGID) {
> >               options = DPNI_QUEUE_OPT_CLEAR_CGID;
> > diff --git a/drivers/net/dpaa2/mc/fsl_dpni.h b/drivers/net/dpaa2/mc/fsl_dpni.h
> > index fcc6d4726e..82d6830acc 100644
> > --- a/drivers/net/dpaa2/mc/fsl_dpni.h
> > +++ b/drivers/net/dpaa2/mc/fsl_dpni.h
> > @@ -121,6 +121,12 @@ struct fsl_mc_io;
> >    * The stashing is enabled by default.
> >    */
> >   #define DPNI_OPT_STASHING_DIS                       0x002000
> > +/*
> > + * High performance buffer mode.
> > + * The total number of Rx descriptors is limited to 11264 in this mode.
> > + * When not set, the DPNI uses normal buffers and has no such limit.
> > + */
> > +#define DPNI_OPT_HIGH_PERF_BUFFER            0x80000000
> Or use: #define DPNI_OPT_V1_PFDR_IN_PEB
yes, indeed.

I will apply your suggestions and wait for your comments on the
remaining 16 patches before sending v4.

Thanks,

Maxime

Re: [PATCH v3 00/17] net/dpaa2: fixes and improvements

[Hemant Agrawal]

Hi Maxime,

On 09-03-2026 15:59, Hemant Agrawal wrote:
>
> On 09-03-2026 15:15, Maxime Leroy wrote:
>> Le ven. 6 mars 2026 à 19:51, Stephen Hemminger
>> <stephen@networkplumber.org> a écrit :
>>> On Fri,  6 Mar 2026 14:30:18 +0100
>>> Maxime Leroy <maxime@leroys.fr> wrote:
>>>
>>>> Various fixes and improvements for the dpaa2 net driver and fslmc bus.
>>>>
>>>> Patches 1-6 fix resource leaks on port close, error paths, link status
>>>> and devargs propagation on hotplug.
>>>>
>>>> Patches 7-14 fix additional bugs: spurious VLAN insertion, error 
>>>> packet
>>>> dump crash, packet type classification, checksum offload flags, 
>>>> software
>>>> taildrop buffer access, burst mode info reporting, SG table walk 
>>>> bounds,
>>>> and MAC stats DMA allocation.
>>>>
>>>> Patch 15 is a minor cleanup in the link status area.
>>>>
>>>> Patches 16-17 add devargs alternatives for getenv-based configuration
>>>> of taildrop and data stashing options.
>>>>
>>>> Changes since v2:
>>>> - Fix checkpatch warnings: short SHA in Fixes tag (patch 14),
>>>>    long line in commit message (patch 10)
>>>> - Fix check-git-log warnings: shorten headlines (patches 3, 9, 12, 
>>>> 14),
>>>>    fix tag order Fixes/Cc (patches 10, 11), fix wrong Fixes reference
>>>>    (patch 8), remove colon after function name in commit body 
>>>> (patch 8),
>>>>    lowercase macro name in headline (patch 15)
>>>>
>>>> Changes since v1:
>>>> - Add Cc: stable@dpdk.org on patches with Fixes: tags (Stephen)
>>>> - Reorder series: fixes first, then improvements (Stephen)
>>>> - Patch 2: squash with former patch 4 (Hemant)
>>>> - Patch 6: move devargs refresh from plug to scan rescan path (David)
>>>> - Patch 17: keep getenv for backward compatibility, add devargs as
>>>>    alternative instead of replacement
>>>> - Drop former patch 11 (bus/fslmc: remove dead blocklist check) to
>>>>    avoid disaligning with other buses (David)
>>>> - New patches 8, 11-14 fixing issues reported by Stephen
>>>> - New patches 7, 9-10 fixing VLAN insertion and packet classification
>>>>    issues
>>>>
>>>> Maxime Leroy (17):
>>>>    net/dpaa2: fix queue block memory leak on port close
>>>>    net/dpaa2: fix Rx error queue memory leaks
>>>>    net/dpaa2: warn on Rx descriptor limit in high perf mode
>>>>    net/dpaa2: fix resource leak on softparser failure
>>>>    net/dpaa2: fix link not up after port stop/start
>>>>    bus/fslmc: fix devargs not propagated on hotplug
>>>>    net/dpaa2: fix spurious VLAN insertion on non-VLAN packets
>>>>    net/dpaa2: fix error packet dump crash and memory leak
>>>>    net/dpaa2: fix L4 packet type in slow parse path
>>>>    net/dpaa2: fix L3/L4 checksum offload flags
>>>>    net/dpaa2: fix software taildrop buffer access
>>>>    net/dpaa2: fix burst mode info report
>>>>    net/dpaa2: add SG table walk upper bound in Rx path
>>>>    net/dpaa2: fix MAC stats DMA alloc per xstats call
>>>>    net/dpaa2: use check interval macro in link down path
>>>>    net/dpaa2: add devargs to disable Rx taildrop
>>>>    net/dpaa2: add devargs alternative for data stashing getenv
>>>>
>>>>   drivers/bus/fslmc/fslmc_bus.c           |   4 +
>>>>   drivers/bus/fslmc/portal/dpaa2_hw_pvt.h |  16 +-
>>>>   drivers/net/dpaa2/dpaa2_ethdev.c        | 211 
>>>> ++++++++++++------------
>>>>   drivers/net/dpaa2/dpaa2_ethdev.h        |   3 +
>>>>   drivers/net/dpaa2/dpaa2_rxtx.c          |  85 +++++-----
>>>>   drivers/net/dpaa2/mc/fsl_dpni.h         |   6 +
>>>>   6 files changed, 164 insertions(+), 161 deletions(-)
>>>>
>>> Applied to next-net, minor edits to first commit message to fix
>>> the reference commit; problem reported by checkpatches
>> Hi Stephen,
>>
>> Thanks for the merge. However, I was not expecting the series to be
>> merged without an ACK from NXP maintainers.
>> Many of the issues were found through code review only and marked as
>> “not tested”, with only minimal runtime checks on my side. I would
>> feel more comfortable with an ACK from NXP.
>>
>> Hemant, could you please take a look at the series when you have a 
>> chance?
> Yes, we will be testing it soon.
Once you address my other comment, you can add my ack to the series.

Series-

Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>

>> Thanks,
>>
>> Maxime

[PATCH v4 00/17] net/dpaa2: fixes and improvements

[Maxime Leroy]

Various fixes and improvements for the dpaa2 net driver and fslmc bus.

Patches 1-6 fix resource leaks on port close, error paths, link status
and devargs propagation on hotplug.

Patches 7-14 fix additional bugs: spurious VLAN insertion, error packet
dump crash, packet type classification, checksum offload flags, software
taildrop buffer access, burst mode info reporting, SG table walk bounds,
and MAC stats DMA allocation.

Patch 15 is a minor cleanup in the link status area.

Patches 16-17 add devargs alternatives for getenv-based configuration
of taildrop and data stashing options.

Changes since v3:
- Patch 3: rename DPNI_OPT_HIGH_PERF_BUFFER to DPNI_OPT_V1_PFDR_IN_PEB,
  rename MAX_NB_RX_DESC to MAX_NB_RX_DESC_IN_PEB, keep total_nb_rx_desc
  calculation unconditional and only guard the warning, update warning
  messages to suggest removing the option or reducing descriptors (Hemant)

Changes since v2:
- Fix checkpatch warnings: short SHA in Fixes tag (patch 14),
  long line in commit message (patch 10)
- Fix check-git-log warnings: shorten headlines (patches 3, 9, 12, 14),
  fix tag order Fixes/Cc (patches 10, 11), fix wrong Fixes reference
  (patch 8), remove colon after function name in commit body (patch 8),
  lowercase macro name in headline (patch 15)

Changes since v1:
- Add Cc: stable@dpdk.org on patches with Fixes: tags (Stephen)
- Reorder series: fixes first, then improvements (Stephen)
- Patch 2: squash with former patch 4 (Hemant)
- Patch 6: move devargs refresh from plug to scan rescan path (David)
- Patch 17: keep getenv for backward compatibility, add devargs as
  alternative instead of replacement
- Drop former patch 11 (bus/fslmc: remove dead blocklist check) to
  avoid disaligning with other buses (David)
- New patches 8, 11-14 fixing issues reported by Stephen
- New patches 7, 9-10 fixing VLAN insertion and packet classification
  issues

Maxime Leroy (17):
  net/dpaa2: fix queue block memory leak on port close
  net/dpaa2: fix Rx error queue memory leaks
  net/dpaa2: warn on Rx descriptor limit in high perf mode
  net/dpaa2: fix resource leak on softparser failure
  net/dpaa2: fix link not up after port stop/start
  bus/fslmc: fix devargs not propagated on hotplug
  net/dpaa2: fix spurious VLAN insertion on non-VLAN packets
  net/dpaa2: fix error packet dump crash and memory leak
  net/dpaa2: fix L4 packet type in slow parse path
  net/dpaa2: fix L3/L4 checksum offload flags
  net/dpaa2: fix software taildrop buffer access
  net/dpaa2: fix burst mode info report
  net/dpaa2: add SG table walk upper bound in Rx path
  net/dpaa2: fix MAC stats DMA alloc per xstats call
  net/dpaa2: use check interval macro in link down path
  net/dpaa2: add devargs to disable Rx taildrop
  net/dpaa2: add devargs alternative for data stashing getenv

 drivers/bus/fslmc/fslmc_bus.c           |   4 +
 drivers/bus/fslmc/portal/dpaa2_hw_pvt.h |  16 +-
 drivers/net/dpaa2/dpaa2_ethdev.c        | 210 ++++++++++++------------
 drivers/net/dpaa2/dpaa2_ethdev.h        |   3 +
 drivers/net/dpaa2/dpaa2_rxtx.c          |  85 +++++-----
 drivers/net/dpaa2/mc/fsl_dpni.h         |   6 +
 6 files changed, 164 insertions(+), 160 deletions(-)

-- 
2.43.0

[PATCH v4 01/17] net/dpaa2: fix queue block memory leak on port close

[Maxime Leroy]

Commit ae2661c3ea2d ("net/dpaa2: fix queue free cleanup") added
priv->rx_vq[i] = NULL inside the cleanup loop. This NULLs rx_vq[0]
on the first iteration, so the subsequent rte_free(priv->rx_vq[0])
becomes rte_free(NULL) — a no-op — leaking the entire mc_q block
(all RX + TX + TX conf queue structs) on every port close.

Save the base pointer before the loop and free that instead.

Fixes: 46d02eeaaeb8 ("net/dpaa2: fix queue freeing")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index b3a79f18d3..cef819650b 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -661,6 +661,9 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 
 	/* Queue allocation base */
 	if (priv->rx_vq[0]) {
+		/* Save base pointer before the loop NULLs rx_vq[] entries */
+		void *mc_q = priv->rx_vq[0];
+
 		/* cleaning up queue storage */
 		for (i = 0; i < priv->nb_rx_queues; i++) {
 			dpaa2_q = priv->rx_vq[i];
@@ -691,8 +694,7 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 		}
 
 		/*free memory for all queues (RX+TX) */
-		rte_free(priv->rx_vq[0]);
-		priv->rx_vq[0] = NULL;
+		rte_free(mc_q);
 	}
 }
 
-- 
2.43.0

[PATCH v4 02/17] net/dpaa2: fix Rx error queue memory leaks

[Maxime Leroy]

The rx_err_vq is allocated separately with rte_zmalloc() in
dpaa2_alloc_rx_tx_queues(), but is never properly freed in two paths:

1. On port close: dpaa2_free_rx_tx_queues() only frees the q_storage
contents via dpaa2_queue_storage_free() — the dpaa2_queue struct itself
is never freed, leaking memory on every port close.

2. On allocation error: the fail: path frees the error queue's
   q_storage but never frees the rx_err_vq struct itself, which was
   separately allocated with rte_zmalloc(). This has been missing
   since the error queue was first introduced.

Add the missing rte_free() calls and NULL assignments in both paths.

Also replace the DPAAX_RX_ERROR_QUEUE_FLAG check with a direct
priv->rx_err_vq NULL check, which is safe because rx_err_vq is
zero-initialized and only set when the flag is active. This avoids a
NULL dereference if rx_err_vq allocation itself fails and also
simplifies the cleanup in dpaa2_free_rx_tx_queues() for consistency.

As a defensive measure, also add a NULL guard to the
dpaa2_queue_storage_free() macro to prevent NULL pointer dereference
from callers in error paths.

Fixes: 46d02eeaaeb8 ("net/dpaa2: fix queue freeing")
Fixes: 4690a6114ff6 ("net/dpaa2: enable error queues optionally")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/bus/fslmc/portal/dpaa2_hw_pvt.h | 16 +++++++++-------
 drivers/net/dpaa2/dpaa2_ethdev.c        |  8 ++++++--
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h b/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
index 10bc191645..e625a5c035 100644
--- a/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
+++ b/drivers/bus/fslmc/portal/dpaa2_hw_pvt.h
@@ -223,13 +223,15 @@ struct swp_active_dqs {
 
 #define dpaa2_queue_storage_free(q, num) \
 ({ \
-	int i; \
-	\
-	for (i = 0; i < (num); i++) { \
-		if ((q)->q_storage[i]) { \
-			dpaa2_free_dq_storage((q)->q_storage[i]); \
-			rte_free((q)->q_storage[i]); \
-			(q)->q_storage[i] = NULL; \
+	if (q) { \
+		int i; \
+		\
+		for (i = 0; i < (num); i++) { \
+			if ((q)->q_storage[i]) { \
+				dpaa2_free_dq_storage((q)->q_storage[i]); \
+				rte_free((q)->q_storage[i]); \
+				(q)->q_storage[i] = NULL; \
+			} \
 		} \
 	} \
 })
diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index cef819650b..eb8333458e 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -620,9 +620,11 @@ dpaa2_alloc_rx_tx_queues(struct rte_eth_dev *dev)
 		priv->rx_vq[i--] = NULL;
 	}
 
-	if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
+	if (priv->rx_err_vq) {
 		dpaa2_q = priv->rx_err_vq;
 		dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
+		rte_free(dpaa2_q);
+		priv->rx_err_vq = NULL;
 	}
 
 	rte_free(mc_q);
@@ -688,9 +690,11 @@ dpaa2_free_rx_tx_queues(struct rte_eth_dev *dev)
 				priv->tx_conf_vq[i] = NULL;
 			}
 		}
-		if (priv->flags & DPAAX_RX_ERROR_QUEUE_FLAG) {
+		if (priv->rx_err_vq) {
 			dpaa2_q = priv->rx_err_vq;
 			dpaa2_queue_storage_free(dpaa2_q, RTE_MAX_LCORE);
+			rte_free(dpaa2_q);
+			priv->rx_err_vq = NULL;
 		}
 
 		/*free memory for all queues (RX+TX) */
-- 
2.43.0

[PATCH v4 03/17] net/dpaa2: warn on Rx descriptor limit in high perf mode

[Maxime Leroy]

The Rx descriptor count warning fires unconditionally when the total
exceeds 11264, but this limit only applies when the DPNI is created
with the high performance buffer option (0x80000000). When using normal
buffers, there is no such limit and the warning is
misleading noise.

Check the DPNI options to only warn when the high performance buffer
mode is active.

Fixes: 35dc25d12792 ("net/dpaa2: warn on high Rx descriptor number")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 17 +++++++++++------
 drivers/net/dpaa2/mc/fsl_dpni.h  |  6 ++++++
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index eb8333458e..605c75ad70 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -74,8 +74,9 @@ int dpaa2_timestamp_dynfield_offset = -1;
 
 bool dpaa2_print_parser_result;
 
-#define MAX_NB_RX_DESC		11264
-int total_nb_rx_desc;
+/* Rx descriptor limit when DPNI loads PFDRs in PEB */
+#define MAX_NB_RX_DESC_IN_PEB	11264
+static int total_nb_rx_desc;
 
 int dpaa2_valid_dev;
 struct rte_mempool *dpaa2_tx_sg_pool;
@@ -905,10 +906,14 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 			dev, rx_queue_id, mb_pool, rx_conf);
 
 	total_nb_rx_desc += nb_rx_desc;
-	if (total_nb_rx_desc > MAX_NB_RX_DESC) {
-		DPAA2_PMD_WARN("Total nb_rx_desc exceeds %d limit. Please use Normal buffers",
-			       MAX_NB_RX_DESC);
-		DPAA2_PMD_WARN("To use Normal buffers, run 'export DPNI_NORMAL_BUF=1' before running dynamic_dpl.sh script");
+	if (total_nb_rx_desc > MAX_NB_RX_DESC_IN_PEB &&
+	    (priv->options & DPNI_OPT_V1_PFDR_IN_PEB)) {
+		DPAA2_PMD_WARN("RX descriptor exceeds limit(%d) to load PFDR in PEB",
+			       MAX_NB_RX_DESC_IN_PEB);
+		DPAA2_PMD_WARN("Suggest removing 0x%08x from DPNI creating options(0x%08x)",
+			       DPNI_OPT_V1_PFDR_IN_PEB, priv->options);
+		DPAA2_PMD_WARN("Or reduce RX descriptor number(%d) per queue",
+			       nb_rx_desc);
 	}
 
 	if (!priv->bp_list || priv->bp_list->mp != mb_pool) {
diff --git a/drivers/net/dpaa2/mc/fsl_dpni.h b/drivers/net/dpaa2/mc/fsl_dpni.h
index fcc6d4726e..42d633eaf8 100644
--- a/drivers/net/dpaa2/mc/fsl_dpni.h
+++ b/drivers/net/dpaa2/mc/fsl_dpni.h
@@ -121,6 +121,12 @@ struct fsl_mc_io;
  * The stashing is enabled by default.
  */
 #define DPNI_OPT_STASHING_DIS			0x002000
+/*
+ * PFDR in PEB mode (v1 layout).
+ * The total number of Rx descriptors is limited to 11264 in this mode.
+ * When not set, PFDRs are stored in DDR and there is no such limit.
+ */
+#define DPNI_OPT_V1_PFDR_IN_PEB		0x80000000
 /**
  * Software sequence maximum layout size
  */
-- 
2.43.0

[PATCH v4 04/17] net/dpaa2: fix resource leak on softparser failure

[Maxime Leroy]

When soft parser loading or enabling fails during probe, the error
path returns directly instead of going through the init_err label.
This skips dpaa2_dev_close() and leaks all resources allocated during
probe (queues, MAC addresses, extract params).

Fixes: 72ec7a678e70 ("net/dpaa2: add soft parser driver")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 605c75ad70..5e0a897ed3 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -3165,7 +3165,7 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		if (ret < 0) {
 			DPAA2_PMD_ERR(" Error(%d) in loading softparser",
 				      ret);
-			return ret;
+			goto init_err;
 		}
 
 		ret = dpaa2_eth_enable_wriop_soft_parser(priv,
@@ -3173,7 +3173,7 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		if (ret < 0) {
 			DPAA2_PMD_ERR(" Error(%d) in enabling softparser",
 				      ret);
-			return ret;
+			goto init_err;
 		}
 	}
 
-- 
2.43.0

[PATCH v4 05/17] net/dpaa2: fix link not up after port stop/start

[Maxime Leroy]

When LSC (Link State Change) interrupts are enabled, the link status
is only updated by interrupt events -- rte_eth_link_get_nowait() reads
the cached value without querying the hardware.

During dev_start(), dpaa2_dev_set_link_up() was called immediately
after dpni_enable(), before LSC interrupts were registered. The MAC
needs ~30ms to renegotiate after being re-enabled, so the initial
link query returned link down. By the time the link came up, the LSC
interrupt handler was not yet installed, so the link-up event was
missed and the cached link status remained down permanently.

The issue does not occur on the first dev_start() after probe because
dpni_reset() during probe does not bring the MAC down -- the kernel
dpmac driver keeps the physical link up. Only dpni_disable() during
dev_stop() causes the MAC to go down, requiring a full renegotiation
on the next dpni_enable().

The problem is more likely to occur with many queues: the queue setup
loop (dpni_get_queue for each RX queue) between dpni_enable() and the
LSC interrupt registration adds MC portal round-trips, giving the MAC
more time to complete negotiation before interrupts are armed. This
makes the link-up event more likely to be missed.

Move dpaa2_dev_set_link_up() after the LSC interrupt setup so that
any link-up event occurring during MAC negotiation is properly caught.

Fixes: c5acbb5ea20e ("net/dpaa2: support link status event")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 5e0a897ed3..cae81d3a20 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -1392,9 +1392,6 @@ dpaa2_dev_start(struct rte_eth_dev *dev)
 		return ret;
 	}
 
-	/* Power up the phy. Needed to make the link go UP */
-	dpaa2_dev_set_link_up(dev);
-
 	for (i = 0; i < data->nb_rx_queues; i++) {
 		dpaa2_q = data->rx_queues[i];
 		ret = dpni_get_queue(dpni, CMD_PRI_LOW, priv->token,
@@ -1462,6 +1459,12 @@ dpaa2_dev_start(struct rte_eth_dev *dev)
 		dpaa2_eth_setup_irqs(dev, 1);
 	}
 
+	/* Power up the phy. Needed to make the link go UP.
+	 * Called after LSC interrupt setup so that the link-up
+	 * event is not missed if the MAC negotiates quickly.
+	 */
+	dpaa2_dev_set_link_up(dev);
+
 	/* Change the tx burst function if ordered queues are used */
 	if (priv->en_ordered)
 		dev->tx_pkt_burst = dpaa2_dev_tx_ordered;
-- 
2.43.0

[PATCH v4 06/17] bus/fslmc: fix devargs not propagated on hotplug

[Maxime Leroy]

When a device is hotplugged via rte_dev_probe(), the EAL adds the
devargs to its global list before calling the bus scan and then probe.
However, when the fslmc bus is rescanned, it returns early without
refreshing devargs on existing devices.

As a result, PMD-specific devargs (e.g. drv_no_taildrop) passed
through rte_dev_probe() are silently ignored by the driver.

Refresh devargs from the EAL list on all existing devices when rescan
is triggered, before returning early.

Fixes: b5721f271cbf ("bus/fslmc: support DPNI hotplug")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/bus/fslmc/fslmc_bus.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bus/fslmc/fslmc_bus.c b/drivers/bus/fslmc/fslmc_bus.c
index abdb0ad50d..d058441a3f 100644
--- a/drivers/bus/fslmc/fslmc_bus.c
+++ b/drivers/bus/fslmc/fslmc_bus.c
@@ -322,7 +322,11 @@ rte_fslmc_scan(void)
 	char *group_name;
 
 	if (process_once) {
+		struct rte_dpaa2_device *dev;
+
 		DPAA2_BUS_DEBUG("Fslmc bus already scanned. Not rescanning");
+		TAILQ_FOREACH(dev, &rte_fslmc_bus.device_list, next)
+			dev->device.devargs = fslmc_devargs_lookup(dev);
 		return 0;
 	}
 	process_once = 1;
-- 
2.43.0

[PATCH v4 07/17] net/dpaa2: fix spurious VLAN insertion on non-VLAN packets

[Maxime Leroy]

The VLAN insert check in dpaa2_dev_tx() tested the per-packet flag
OR the port-level txmode offload:

  if (ol_flags & RTE_MBUF_F_TX_VLAN ||
      txmode.offloads & RTE_ETH_TX_OFFLOAD_VLAN_INSERT)

When VLAN_INSERT is enabled in txmode, this causes rte_vlan_insert()
to be called on every packet regardless of the per-packet flag, inserting
a VLAN header with whatever stale value is in vlan_tci (typically 0).

The port-level offload only advertises the capability. The actual trigger
must be the per-packet RTE_MBUF_F_TX_VLAN flag, as done by every other
DPDK driver (Intel, mlx5, virtio, vhost, af_packet, etc.).

Fixes: 0ebce6129bc6 ("net/dpaa2: support new ethdev offload APIs")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 7cbd3f33ae..5a98f295a7 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -1346,10 +1346,8 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 				    priv->bp_list->dpaa2_ops_index &&
 				    (*bufs)->nb_segs == 1 &&
 				    rte_mbuf_refcnt_read((*bufs)) == 1)) {
-					if (unlikely(((*bufs)->ol_flags
-						& RTE_MBUF_F_TX_VLAN) ||
-						(eth_data->dev_conf.txmode.offloads
-						& RTE_ETH_TX_OFFLOAD_VLAN_INSERT))) {
+					if (unlikely((*bufs)->ol_flags
+						& RTE_MBUF_F_TX_VLAN)) {
 						ret = rte_vlan_insert(bufs);
 						if (ret)
 							goto send_n_return;
@@ -1402,9 +1400,7 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 				goto send_n_return;
 			}
 
-			if (unlikely(((*bufs)->ol_flags & RTE_MBUF_F_TX_VLAN) ||
-				(eth_data->dev_conf.txmode.offloads
-				& RTE_ETH_TX_OFFLOAD_VLAN_INSERT))) {
+			if (unlikely((*bufs)->ol_flags & RTE_MBUF_F_TX_VLAN)) {
 				int ret = rte_vlan_insert(bufs);
 				if (ret)
 					goto send_n_return;
-- 
2.43.0

[PATCH v4 08/17] net/dpaa2: fix error packet dump crash and memory leak

[Maxime Leroy]

Fix three bugs in dump_err_pkts().

1. NULL pointer dereference: mbuf was checked for NULL but then
   dereferenced unconditionally on the next line.

2. Memory leak on multi-segment packets: the while loop walked
   mbuf to NULL, so the subsequent rte_pktmbuf_free(mbuf) was a
   no-op and the packet was never freed. Use a separate iterator
   variable and free the original mbuf pointer.

3. Segment index not reset between packets: variable i was
   initialized once at function scope and never reset inside the
   do/while loop, so hexdump titles had wrong segment numbers.
   Make it local to the multi-segment block.

Not tested, found by code review.

Fixes: f9465bdcef9d ("net/dpaa2: fix error frame dump")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 31 +++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 5a98f295a7..0de52cbef2 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -651,7 +651,7 @@ dump_err_pkts(struct dpaa2_queue *dpaa2_q)
 	const struct qbman_fd *fd;
 	struct qbman_pull_desc pulldesc;
 	struct rte_eth_dev_data *eth_data = dpaa2_q->eth_data;
-	uint32_t lcore_id = rte_lcore_id(), i = 0;
+	uint32_t lcore_id = rte_lcore_id();
 	void *v_addr, *hw_annot_addr;
 	struct dpaa2_fas *fas;
 	struct rte_mbuf *mbuf;
@@ -726,24 +726,27 @@ dump_err_pkts(struct dpaa2_queue *dpaa2_q)
 			DPAA2_GET_FD_OFFSET(fd), DPAA2_GET_FD_ERR(fd),
 			fas->status);
 
-		if (mbuf)
+		if (mbuf) {
 			__rte_mbuf_sanity_check(mbuf, 1);
-		if (mbuf->nb_segs > 1) {
-			while (mbuf) {
-				sprintf(title, "Payload seg[%d]", i);
-				rte_hexdump(stderr, title,
+			if (mbuf->nb_segs > 1) {
+				struct rte_mbuf *seg = mbuf;
+				int i = 0;
+
+				while (seg) {
+					sprintf(title, "Payload seg[%d]", i);
+					rte_hexdump(stderr, title,
+						(char *)seg->buf_addr + seg->data_off,
+						seg->data_len);
+					seg = seg->next;
+					i++;
+				}
+			} else {
+				rte_hexdump(stderr, "Payload",
 					(char *)mbuf->buf_addr + mbuf->data_off,
 					mbuf->data_len);
-				mbuf = mbuf->next;
-				i++;
 			}
-		} else {
-			rte_hexdump(stderr, "Payload",
-				(char *)mbuf->buf_addr + mbuf->data_off,
-				mbuf->data_len);
+			rte_pktmbuf_free(mbuf);
 		}
-
-		rte_pktmbuf_free(mbuf);
 		dq_storage++;
 		num_rx++;
 	} while (pending);
-- 
2.43.0

[PATCH v4 09/17] net/dpaa2: fix L4 packet type in slow parse path

[Maxime Leroy]

RTE_PTYPE_L4_* values are not independent bits but mutually exclusive
values in a single field. The code set RTE_PTYPE_L4_NONFRAG (0x600)
first then OR'd the specific L4 type on top, corrupting the result:
- TCP: 0x600 | 0x100 = 0x700 (undefined)
- UDP: 0x600 | 0x200 = 0x600 (UDP lost, still NONFRAG)
- SCTP: 0x600 | 0x400 = 0x600 (SCTP lost, still NONFRAG)
- ICMP: 0x600 | 0x500 = 0x700 (undefined)

Move RTE_PTYPE_L4_NONFRAG to the final else fallback so it is only
set when no known L4 protocol is identified, matching how
rte_net_get_ptype() handles L4 classification.

Also remove the L3_IP_UNKNOWN_PROTOCOL check that OR'd
RTE_PTYPE_UNKNOWN (0x0), which was a no-op. That case is now
correctly covered by the NONFRAG fallback.

Not tested, found by code review.

Fixes: a5fc38d422a7 ("net/dpaa2: support Rx packet parsing")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 0de52cbef2..9c908f87b1 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -212,24 +212,18 @@ dpaa2_dev_rx_parse_slow(struct rte_mbuf *mbuf,
 	    L3_IP_N_MORE_FRAGMENT)) {
 		pkt_type |= RTE_PTYPE_L4_FRAG;
 		goto parse_done;
-	} else {
-		pkt_type |= RTE_PTYPE_L4_NONFRAG;
 	}
 
 	if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_UDP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_UDP;
-
 	else if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_TCP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_TCP;
-
 	else if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_SCTP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_SCTP;
-
 	else if (BIT_ISSET_AT_POS(annotation->word4, L3_PROTO_ICMP_PRESENT))
 		pkt_type |= RTE_PTYPE_L4_ICMP;
-
-	else if (BIT_ISSET_AT_POS(annotation->word4, L3_IP_UNKNOWN_PROTOCOL))
-		pkt_type |= RTE_PTYPE_UNKNOWN;
+	else
+		pkt_type |= RTE_PTYPE_L4_NONFRAG;
 
 parse_done:
 	return pkt_type;
-- 
2.43.0

[PATCH v4 10/17] net/dpaa2: fix L3/L4 checksum offload flags

[Maxime Leroy]

The WRIOP FAS (Frame Annotation Status) field provides independent
bits for L3/L4 checksum validation (L3CV/L4CV) and error (L3CE/L4CE).

Two problems:

1. The driver used 'else if' between the L3 and L4 error checks, so
   when both checksums were bad only the L3 error was reported and
   the L4 error was silently lost. Use two independent 'if' statements
   instead, matching how other drivers (i40e, ixgbe, bnxt) handle this.

2. The driver never reported GOOD checksums. When validation was
   performed (L3CV/L4CV set) but no error was flagged (L3CE/L4CE
   clear), report RTE_MBUF_F_RX_IP_CKSUM_GOOD /
   RTE_MBUF_F_RX_L4_CKSUM_GOOD.

Fix both issues in dpaa2_dev_rx_parse_slow() and dpaa2_dev_rx_parse().

Not tested, found by code review.

Fixes: 870354264644 ("net/dpaa2: fix L3/L4 checksum results")
Cc: stable@dpdk.org

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 9c908f87b1..689e5e7ee7 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -203,8 +203,13 @@ dpaa2_dev_rx_parse_slow(struct rte_mbuf *mbuf,
 
 	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_BAD;
-	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_GOOD;
+
+	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_BAD;
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_GOOD;
 
 	if (BIT_ISSET_AT_POS(annotation->word4, L3_IP_1_FIRST_FRAGMENT |
 	    L3_IP_1_MORE_FRAGMENT |
@@ -240,8 +245,13 @@ dpaa2_dev_rx_parse(struct rte_mbuf *mbuf, void *hw_annot_addr)
 
 	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_BAD;
-	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L3CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_IP_CKSUM_GOOD;
+
+	if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CE))
 		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_BAD;
+	else if (BIT_ISSET_AT_POS(annotation->word1, DPAA2_ETH_FAS_L4CV))
+		mbuf->ol_flags |= RTE_MBUF_F_RX_L4_CKSUM_GOOD;
 
 	if (unlikely(dpaa2_print_parser_result))
 		dpaa2_print_parse_result(annotation);
-- 
2.43.0

[PATCH v4 11/17] net/dpaa2: fix software taildrop buffer access

[Maxime Leroy]

The sw_td path in dpaa2_dev_tx() reads from the wrong position in the
bufs array. When the goto fires, bufs has already been advanced past
the num_tx successfully sent packets. The first loop then reads num_tx
more entries starting from bufs, going past the end of the input array.
Additionally, the buf_to_free segments for already-enqueued packets
are never freed, leaking memory.

Replace the buggy sw_td code with the same pattern used in
dpaa2_dev_tx_ordered(): free buf_to_free segments first, then use
rte_pktmbuf_free_bulk() to drop remaining unsent packets.

Not tested, found by code review.

Fixes: c3ffe74d85be ("net/dpaa2: support software taildrop")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 689e5e7ee7..8275ba9780 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -1517,21 +1517,15 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 
 	return num_tx;
 sw_td:
-	loop = 0;
-	while (loop < num_tx) {
-		if (unlikely(RTE_MBUF_HAS_EXTBUF(*bufs)))
-			rte_pktmbuf_free(*bufs);
-		bufs++;
-		loop++;
+	for (loop = 0; loop < free_count; loop++) {
+		if (buf_to_free[loop].pkt_id < num_tx)
+			rte_pktmbuf_free_seg(buf_to_free[loop].seg);
 	}
 
 	/* free the pending buffers */
-	while (nb_pkts) {
-		rte_pktmbuf_free(*bufs);
-		bufs++;
-		nb_pkts--;
-		num_tx++;
-	}
+	rte_pktmbuf_free_bulk(bufs, nb_pkts);
+
+	num_tx += nb_pkts;
 	dpaa2_q->tx_pkts += num_tx;
 
 	return num_tx;
-- 
2.43.0

[PATCH v4 12/17] net/dpaa2: fix burst mode info report

[Maxime Leroy]

The burst_mode_get functions were incorrectly listing configured
offload flags instead of reporting the active burst function, unlike
every other PMD (i40e, mlx5, ixgbe, hns3) which match on the burst
function pointer. On top of that, snprintf + break meant only the
first matching offload was ever shown.

Rewrite both functions to match on the actual rx_pkt_burst/tx_pkt_burst
function pointer, consistent with the rest of the codebase.

Not tested, found by code review.

Fixes: ddbc2b6658d0 ("net/dpaa2: add Tx/Rx burst mode info")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 76 +++++++++-----------------------
 1 file changed, 22 insertions(+), 54 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index cae81d3a20..18d8bf5444 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -443,34 +443,18 @@ dpaa2_dev_rx_burst_mode_get(struct rte_eth_dev *dev,
 	__rte_unused uint16_t queue_id,
 	struct rte_eth_burst_mode *mode)
 {
-	struct rte_eth_conf *eth_conf = &dev->data->dev_conf;
-	int ret = -EINVAL;
-	unsigned int i;
-	const struct burst_info {
-		uint64_t flags;
-		const char *output;
-	} rx_offload_map[] = {
-			{RTE_ETH_RX_OFFLOAD_CHECKSUM, " Checksum,"},
-			{RTE_ETH_RX_OFFLOAD_SCTP_CKSUM, " SCTP csum,"},
-			{RTE_ETH_RX_OFFLOAD_OUTER_IPV4_CKSUM, " Outer IPV4 csum,"},
-			{RTE_ETH_RX_OFFLOAD_OUTER_UDP_CKSUM, " Outer UDP csum,"},
-			{RTE_ETH_RX_OFFLOAD_VLAN_STRIP, " VLAN strip,"},
-			{RTE_ETH_RX_OFFLOAD_VLAN_FILTER, " VLAN filter,"},
-			{RTE_ETH_RX_OFFLOAD_TIMESTAMP, " Timestamp,"},
-			{RTE_ETH_RX_OFFLOAD_RSS_HASH, " RSS,"},
-			{RTE_ETH_RX_OFFLOAD_SCATTER, " Scattered,"}
-	};
+	eth_rx_burst_t pkt_burst = dev->rx_pkt_burst;
+
+	if (pkt_burst == dpaa2_dev_prefetch_rx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Scalar Prefetch");
+	else if (pkt_burst == dpaa2_dev_rx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Scalar");
+	else if (pkt_burst == dpaa2_dev_loopback_rx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Loopback");
+	else
+		return -EINVAL;
 
-	/* Update Rx offload info */
-	for (i = 0; i < RTE_DIM(rx_offload_map); i++) {
-		if (eth_conf->rxmode.offloads & rx_offload_map[i].flags) {
-			snprintf(mode->info, sizeof(mode->info), "%s",
-				rx_offload_map[i].output);
-			ret = 0;
-			break;
-		}
-	}
-	return ret;
+	return 0;
 }
 
 static int
@@ -478,34 +462,18 @@ dpaa2_dev_tx_burst_mode_get(struct rte_eth_dev *dev,
 			__rte_unused uint16_t queue_id,
 			struct rte_eth_burst_mode *mode)
 {
-	struct rte_eth_conf *eth_conf = &dev->data->dev_conf;
-	int ret = -EINVAL;
-	unsigned int i;
-	const struct burst_info {
-		uint64_t flags;
-		const char *output;
-	} tx_offload_map[] = {
-			{RTE_ETH_TX_OFFLOAD_VLAN_INSERT, " VLAN Insert,"},
-			{RTE_ETH_TX_OFFLOAD_IPV4_CKSUM, " IPV4 csum,"},
-			{RTE_ETH_TX_OFFLOAD_UDP_CKSUM, " UDP csum,"},
-			{RTE_ETH_TX_OFFLOAD_TCP_CKSUM, " TCP csum,"},
-			{RTE_ETH_TX_OFFLOAD_SCTP_CKSUM, " SCTP csum,"},
-			{RTE_ETH_TX_OFFLOAD_OUTER_IPV4_CKSUM, " Outer IPV4 csum,"},
-			{RTE_ETH_TX_OFFLOAD_MT_LOCKFREE, " MT lockfree,"},
-			{RTE_ETH_TX_OFFLOAD_MBUF_FAST_FREE, " MBUF free disable,"},
-			{RTE_ETH_TX_OFFLOAD_MULTI_SEGS, " Scattered,"}
-	};
+	eth_tx_burst_t pkt_burst = dev->tx_pkt_burst;
+
+	if (pkt_burst == dpaa2_dev_tx)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Scalar");
+	else if (pkt_burst == dpaa2_dev_tx_ordered)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Ordered");
+	else if (pkt_burst == rte_eth_pkt_burst_dummy)
+		snprintf(mode->info, sizeof(mode->info), "%s", "Dummy");
+	else
+		return -EINVAL;
 
-	/* Update Tx offload info */
-	for (i = 0; i < RTE_DIM(tx_offload_map); i++) {
-		if (eth_conf->txmode.offloads & tx_offload_map[i].flags) {
-			snprintf(mode->info, sizeof(mode->info), "%s",
-				tx_offload_map[i].output);
-			ret = 0;
-			break;
-		}
-	}
-	return ret;
+	return 0;
 }
 
 static int
-- 
2.43.0

[PATCH v4 13/17] net/dpaa2: add SG table walk upper bound in Rx path

[Maxime Leroy]

If hardware or corrupt DMA data fails to set the FINAL bit in the
scatter-gather table, the while loop in eth_sg_fd_to_mbuf() walks
past the end of the SGT buffer. Add DPAA2_MAX_SGS as an upper bound.

Not tested, found by code review.

Fixes: 774e9ea91992 ("net/dpaa2: add support for multi seg buffers")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 8275ba9780..b316e23e87 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -335,7 +335,7 @@ eth_sg_fd_to_mbuf(const struct qbman_fd *fd,
 			(void **)&first_seg, 1, 1);
 #endif
 	cur_seg = first_seg;
-	while (!DPAA2_SG_IS_FINAL(sge)) {
+	while (!DPAA2_SG_IS_FINAL(sge) && i < DPAA2_MAX_SGS) {
 		sge = &sgt[i++];
 		sg_addr = (size_t)DPAA2_IOVA_TO_VADDR(
 				DPAA2_GET_FLE_ADDR(sge));
-- 
2.43.0

[PATCH v4 14/17] net/dpaa2: fix MAC stats DMA alloc per xstats call

[Maxime Leroy]

dpaa2_dev_mac_setup_stats() allocates and frees DMA buffers on every
xstats_get() call. This is wasteful and not thread-safe: concurrent
callers can overwrite priv pointers, leading to use-after-free. It
also does not check for allocation failure before passing IOVAs to
the MC firmware.

Move the DMA buffer allocation to dpaa2_dev_init() (only when MC
version supports MAC stats) and free them in dpaa2_dev_close(). In
xstats_get(), just check if the buffers were allocated.

Not tested, found by code review.

Fixes: d1cdef2ab592 ("net/dpaa2: add dpmac counters in xstats")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 65 +++++++++++++++-----------------
 1 file changed, 30 insertions(+), 35 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 18d8bf5444..9c384f6430 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -1551,6 +1551,11 @@ dpaa2_dev_close(struct rte_eth_dev *dev)
 
 	rte_free(priv->extract.qos_extract_param);
 
+	rte_free(priv->cnt_idx_dma_mem);
+	rte_free(priv->cnt_values_dma_mem);
+	priv->cnt_idx_dma_mem = NULL;
+	priv->cnt_values_dma_mem = NULL;
+
 	DPAA2_PMD_INFO("%s: netdev deleted", dev->data->name);
 	return 0;
 }
@@ -1906,7 +1911,6 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
 	unsigned int i = 0, j = 0, num = RTE_DIM(dpaa2_xstats_strings);
 	struct dpaa2_dev_priv *priv = dev->data->dev_private;
 	union dpni_statistics value[13] = {};
-	struct mc_version mc_ver_info = {0};
 	struct dpni_rx_tc_policing_cfg cfg;
 	uint8_t page_id, stats_id;
 	uint64_t *cnt_values;
@@ -1977,44 +1981,24 @@ dpaa2_dev_xstats_get(struct rte_eth_dev *dev,
 		i++;
 	}
 
-	if (mc_get_version(dpni, CMD_PRI_LOW, &mc_ver_info))
-		DPAA2_PMD_WARN("Unable to obtain MC version");
-
-	/* mac_statistics supported on MC version > 10.39.0 */
-	if (mc_ver_info.major >= MC_VER_MAJOR &&
-	    mc_ver_info.minor >= MC_VER_MINOR &&
-	    mc_ver_info.revision > 0) {
-		dpaa2_dev_mac_setup_stats(dev);
-		retcode = dpni_get_mac_statistics(dpni, CMD_PRI_LOW, priv->token,
-						  priv->cnt_idx_iova,
-						  priv->cnt_values_iova,
-						  DPAA2_MAC_NUM_STATS);
-		if (retcode) {
-			while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
-				xstats[i].id = i;
-				xstats[i].value = 0;
-				i++;
-			}
-		}
-		if (!retcode) {
-			cnt_values = priv->cnt_values_dma_mem;
-			while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
-				/* mac counters value */
-				xstats[i].id = i;
-				xstats[i].value = rte_le_to_cpu_64(*cnt_values++);
-				i++;
-			}
-		}
-		rte_free(priv->cnt_values_dma_mem);
-		rte_free(priv->cnt_idx_dma_mem);
-		priv->cnt_idx_dma_mem = NULL;
-		priv->cnt_values_dma_mem = NULL;
-	} else {
+	if (priv->cnt_idx_dma_mem &&
+	    !dpni_get_mac_statistics(dpni, CMD_PRI_LOW, priv->token,
+				    priv->cnt_idx_iova,
+				    priv->cnt_values_iova,
+				    DPAA2_MAC_NUM_STATS)) {
+		cnt_values = priv->cnt_values_dma_mem;
 		while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
 			xstats[i].id = i;
-			xstats[i].value = 0;
+			xstats[i].value = rte_le_to_cpu_64(*cnt_values++);
 			i++;
 		}
+		return i;
+	}
+
+	while (i >= (num - DPAA2_MAC_NUM_STATS) && i < num) {
+		xstats[i].id = i;
+		xstats[i].value = 0;
+		i++;
 	}
 
 	return i;
@@ -3156,6 +3140,17 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 
 	priv->speed_capa = dpaa2_dev_get_speed_capability(eth_dev);
 
+	/* mac_statistics supported on MC version > 10.39.0 */
+	{
+		struct mc_version mc_ver_info = {0};
+
+		if (!mc_get_version(dpni_dev, CMD_PRI_LOW, &mc_ver_info) &&
+		    mc_ver_info.major >= MC_VER_MAJOR &&
+		    mc_ver_info.minor >= MC_VER_MINOR &&
+		    mc_ver_info.revision > 0)
+			dpaa2_dev_mac_setup_stats(eth_dev);
+	}
+
 	return 0;
 init_err:
 	dpaa2_dev_close(eth_dev);
-- 
2.43.0

[PATCH v4 15/17] net/dpaa2: use check interval macro in link down path

[Maxime Leroy]

Replace hardcoded rte_delay_us(100 * 1000) with
rte_delay_ms(CHECK_INTERVAL) for consistency with the rest of the
driver.

No functional change.

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 9c384f6430..3091077269 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -2306,7 +2306,7 @@ dpaa2_dev_set_link_down(struct rte_eth_dev *dev)
 		}
 		if (dpni_enabled)
 			/* Allow the MC some slack */
-			rte_delay_us(100 * 1000);
+			rte_delay_ms(CHECK_INTERVAL);
 	} while (dpni_enabled && --retries);
 
 	if (!retries) {
-- 
2.43.0

[PATCH v4 16/17] net/dpaa2: add devargs to disable Rx taildrop

[Maxime Leroy]

The DPAA2_RX_TAILDROP_OFF flag was defined and checked in
dpaa2_dev_rx_queue_setup(), but never set — making the taildrop
disable path dead code.

Wire it to a new "drv_no_taildrop" devargs, following the existing
pattern (drv_loopback, drv_no_prefetch, etc.).

Also move dpaa2_q->nb_desc assignment before the taildrop if/else
so that the descriptor count is always tracked correctly, regardless
of whether taildrop is enabled or disabled.

Usage: fslmc:dpni.1,drv_no_taildrop=1

Note: the taildrop disable path has never been reachable until now
and is untested. NXP maintainers should validate this feature.

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index 3091077269..f128093d90 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -34,6 +34,7 @@
 #define DRIVER_TX_CONF "drv_tx_conf"
 #define DRIVER_RX_PARSE_ERR_DROP "drv_rx_parse_drop"
 #define DRIVER_ERROR_QUEUE  "drv_err_queue"
+#define DRIVER_NO_TAILDROP  "drv_no_taildrop"
 #define CHECK_INTERVAL         100  /* 100ms */
 #define MAX_REPEAT_TIME        90   /* 9s (90 * 100ms) in total */
 
@@ -899,7 +900,6 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	dpaa2_q = priv->rx_vq[rx_queue_id];
 	dpaa2_q->mb_pool = mb_pool; /**< mbuf pool to populate RX ring. */
 	dpaa2_q->bp_array = rte_dpaa2_bpid_info;
-	dpaa2_q->nb_desc = UINT16_MAX;
 	dpaa2_q->offloads = rx_conf->offloads;
 
 	/*Get the flow id from given VQ id*/
@@ -952,11 +952,12 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 		return ret;
 	}
 
+	dpaa2_q->nb_desc = nb_rx_desc;
+
 	if (!(priv->flags & DPAA2_RX_TAILDROP_OFF)) {
 		struct dpni_taildrop taildrop;
 
 		taildrop.enable = 1;
-		dpaa2_q->nb_desc = nb_rx_desc;
 		/* Private CGR will use tail drop length as nb_rx_desc.
 		 * for rest cases we can use standard byte based tail drop.
 		 * There is no HW restriction, but number of CGRs are limited,
@@ -2888,6 +2889,11 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		DPAA2_PMD_INFO("Rx loopback mode");
 	}
 
+	if (dpaa2_get_devargs(dev->devargs, DRIVER_NO_TAILDROP)) {
+		priv->flags |= DPAA2_RX_TAILDROP_OFF;
+		DPAA2_PMD_INFO("Rx taildrop disabled");
+	}
+
 	/* For secondary processes, the primary has done all the work */
 	if (rte_eal_process_type() != RTE_PROC_PRIMARY) {
 		/* In case of secondary, only burst and ops API need to be
@@ -3385,5 +3391,6 @@ RTE_PMD_REGISTER_PARAM_STRING(NET_DPAA2_PMD_DRIVER_NAME,
 		DRIVER_NO_PREFETCH_MODE "=<int>"
 		DRIVER_TX_CONF "=<int>"
 		DRIVER_RX_PARSE_ERR_DROP "=<int>"
-		DRIVER_ERROR_QUEUE "=<int>");
+		DRIVER_ERROR_QUEUE "=<int>"
+		DRIVER_NO_TAILDROP "=<int>");
 RTE_LOG_REGISTER_DEFAULT(dpaa2_logtype_pmd, NOTICE);
-- 
2.43.0

[PATCH v4 17/17] net/dpaa2: add devargs alternative for data stashing getenv

[Maxime Leroy]

The DPAA2_DATA_STASHING_OFF environment variable is used by customers
to dynamically disable data stashing without rebuilding their
application. Add a devargs option "drv_no_data_stashing" as an
alternative, consistent with the existing devargs pattern (drv_loopback,
drv_no_prefetch, drv_no_taildrop), while keeping the getenv for
backward compatibility.

Move the check from dpaa2_dev_rx_queue_setup() to dpaa2_dev_init(),
consistent with how other driver flags are handled.

Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa2/dpaa2_ethdev.c | 12 ++++++++++--
 drivers/net/dpaa2/dpaa2_ethdev.h |  3 +++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_ethdev.c b/drivers/net/dpaa2/dpaa2_ethdev.c
index f128093d90..9cc81f7a47 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.c
+++ b/drivers/net/dpaa2/dpaa2_ethdev.c
@@ -35,6 +35,7 @@
 #define DRIVER_RX_PARSE_ERR_DROP "drv_rx_parse_drop"
 #define DRIVER_ERROR_QUEUE  "drv_err_queue"
 #define DRIVER_NO_TAILDROP  "drv_no_taildrop"
+#define DRIVER_NO_DATA_STASHING "drv_no_data_stashing"
 #define CHECK_INTERVAL         100  /* 100ms */
 #define MAX_REPEAT_TIME        90   /* 9s (90 * 100ms) in total */
 
@@ -931,7 +932,7 @@ dpaa2_dev_rx_queue_setup(struct rte_eth_dev *dev,
 		options |= DPNI_QUEUE_OPT_FLC;
 		cfg.flc.stash_control = true;
 		dpaa2_flc_stashing_clear_all(&cfg.flc.value);
-		if (getenv("DPAA2_DATA_STASHING_OFF")) {
+		if (priv->flags & DPAA2_DATA_STASHING_OFF) {
 			dpaa2_flc_stashing_set(DPAA2_FLC_DATA_STASHING, 0,
 				&cfg.flc.value);
 			dpaa2_q->data_stashing_off = 1;
@@ -2894,6 +2895,12 @@ dpaa2_dev_init(struct rte_eth_dev *eth_dev)
 		DPAA2_PMD_INFO("Rx taildrop disabled");
 	}
 
+	if (dpaa2_get_devargs(dev->devargs, DRIVER_NO_DATA_STASHING) ||
+	    getenv("DPAA2_DATA_STASHING_OFF")) {
+		priv->flags |= DPAA2_DATA_STASHING_OFF;
+		DPAA2_PMD_INFO("Data stashing disabled");
+	}
+
 	/* For secondary processes, the primary has done all the work */
 	if (rte_eal_process_type() != RTE_PROC_PRIMARY) {
 		/* In case of secondary, only burst and ops API need to be
@@ -3392,5 +3399,6 @@ RTE_PMD_REGISTER_PARAM_STRING(NET_DPAA2_PMD_DRIVER_NAME,
 		DRIVER_TX_CONF "=<int>"
 		DRIVER_RX_PARSE_ERR_DROP "=<int>"
 		DRIVER_ERROR_QUEUE "=<int>"
-		DRIVER_NO_TAILDROP "=<int>");
+		DRIVER_NO_TAILDROP "=<int>"
+		DRIVER_NO_DATA_STASHING "=<int>");
 RTE_LOG_REGISTER_DEFAULT(dpaa2_logtype_pmd, NOTICE);
diff --git a/drivers/net/dpaa2/dpaa2_ethdev.h b/drivers/net/dpaa2/dpaa2_ethdev.h
index 86b3022ddb..4da47a543a 100644
--- a/drivers/net/dpaa2/dpaa2_ethdev.h
+++ b/drivers/net/dpaa2/dpaa2_ethdev.h
@@ -97,6 +97,9 @@
  */
 #define DPAA2_TX_DYNAMIC_CONF_ENABLE	RTE_BIT32(9)
 
+/* Disable data stashing (prefetch of packet data into CPU cache) */
+#define DPAA2_DATA_STASHING_OFF		RTE_BIT32(10)
+
 #define DPAAX_RX_ERROR_QUEUE_FLAG	RTE_BIT32(11)
 
 /* DPDMUX index for DPMAC */
-- 
2.43.0

Re: [PATCH v4 00/17] net/dpaa2: fixes and improvements

[Stephen Hemminger]

On Wed, 25 Mar 2026 21:45:27 +0100
Maxime Leroy <maxime@leroys.fr> wrote:

> Various fixes and improvements for the dpaa2 net driver and fslmc bus.
> 
> Patches 1-6 fix resource leaks on port close, error paths, link status
> and devargs propagation on hotplug.
> 
> Patches 7-14 fix additional bugs: spurious VLAN insertion, error packet
> dump crash, packet type classification, checksum offload flags, software
> taildrop buffer access, burst mode info reporting, SG table walk bounds,
> and MAC stats DMA allocation.
> 
> Patch 15 is a minor cleanup in the link status area.
> 
> Patches 16-17 add devargs alternatives for getenv-based configuration
> of taildrop and data stashing options.
> 
> Changes since v3:
> - Patch 3: rename DPNI_OPT_HIGH_PERF_BUFFER to DPNI_OPT_V1_PFDR_IN_PEB,
>   rename MAX_NB_RX_DESC to MAX_NB_RX_DESC_IN_PEB, keep total_nb_rx_desc
>   calculation unconditional and only guard the warning, update warning
>   messages to suggest removing the option or reducing descriptors (Hemant)
> 
> Changes since v2:
> - Fix checkpatch warnings: short SHA in Fixes tag (patch 14),
>   long line in commit message (patch 10)
> - Fix check-git-log warnings: shorten headlines (patches 3, 9, 12, 14),
>   fix tag order Fixes/Cc (patches 10, 11), fix wrong Fixes reference
>   (patch 8), remove colon after function name in commit body (patch 8),
>   lowercase macro name in headline (patch 15)
> 
> Changes since v1:
> - Add Cc: stable@dpdk.org on patches with Fixes: tags (Stephen)
> - Reorder series: fixes first, then improvements (Stephen)
> - Patch 2: squash with former patch 4 (Hemant)
> - Patch 6: move devargs refresh from plug to scan rescan path (David)
> - Patch 17: keep getenv for backward compatibility, add devargs as
>   alternative instead of replacement
> - Drop former patch 11 (bus/fslmc: remove dead blocklist check) to
>   avoid disaligning with other buses (David)
> - New patches 8, 11-14 fixing issues reported by Stephen
> - New patches 7, 9-10 fixing VLAN insertion and packet classification
>   issues
> 
> Maxime Leroy (17):
>   net/dpaa2: fix queue block memory leak on port close
>   net/dpaa2: fix Rx error queue memory leaks
>   net/dpaa2: warn on Rx descriptor limit in high perf mode
>   net/dpaa2: fix resource leak on softparser failure
>   net/dpaa2: fix link not up after port stop/start
>   bus/fslmc: fix devargs not propagated on hotplug
>   net/dpaa2: fix spurious VLAN insertion on non-VLAN packets
>   net/dpaa2: fix error packet dump crash and memory leak
>   net/dpaa2: fix L4 packet type in slow parse path
>   net/dpaa2: fix L3/L4 checksum offload flags
>   net/dpaa2: fix software taildrop buffer access
>   net/dpaa2: fix burst mode info report
>   net/dpaa2: add SG table walk upper bound in Rx path
>   net/dpaa2: fix MAC stats DMA alloc per xstats call
>   net/dpaa2: use check interval macro in link down path
>   net/dpaa2: add devargs to disable Rx taildrop
>   net/dpaa2: add devargs alternative for data stashing getenv
> 
>  drivers/bus/fslmc/fslmc_bus.c           |   4 +
>  drivers/bus/fslmc/portal/dpaa2_hw_pvt.h |  16 +-
>  drivers/net/dpaa2/dpaa2_ethdev.c        | 210 ++++++++++++------------
>  drivers/net/dpaa2/dpaa2_ethdev.h        |   3 +
>  drivers/net/dpaa2/dpaa2_rxtx.c          |  85 +++++-----
>  drivers/net/dpaa2/mc/fsl_dpni.h         |   6 +
>  6 files changed, 164 insertions(+), 160 deletions(-)
> 

Review was clean. Added to next-net