DPDK-dev Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v4 01/23] net/sxe2: remove software statistics devargs
From: liujie5 @ 2026-06-19  8:05 UTC (permalink / raw)
  To: stephen; +Cc: dev, Jie Liu
In-Reply-To: <20260618082723.571054-21-liujie5@linkdatatechnology.com>

From: Jie Liu <liujie5@linkdatatechnology.com>

Remove the optional drv-sw-stats device argument and make software
statistics always-on. Per-queue software statistics are point-in-time
measurements used for accumulation at queue stop/dump, so atomic
operations with rte_memory_order_relaxed add unnecessary overhead
without correctness benefit.

Also rename high_performance_mode field to no_sched_mode to match
the devargs string definition.

Changes:
- Remove sw_stats_en field from struct sxe2_devargs
- Remove RTE_ATOMIC qualifiers from sxe2_rxq_sw_stats fields
- Replace rte_atomic_fetch_add_explicit(relaxed) with plain addition
- Replace rte_atomic_store/load_explicit(relaxed) with plain assignment
- Remove sw_stats_en conditional checks in Rx fast path
- Always pass umbcast_flags to vec Rx functions
- Remove unused #include <rte_stdatomic.h>
- Rename high_performance_mode → no_sched_mode in devargs struct
- Fix int → int32_t for return type in sxe2_parse_eth_devargs

Signed-off-by: Jie Liu <liujie5@linkdatatechnology.com>
---
 drivers/net/sxe2/sxe2_ethdev.c          |  2 +-
 drivers/net/sxe2/sxe2_ethdev.h          |  3 +-
 drivers/net/sxe2/sxe2_queue.h           | 15 ++++---
 drivers/net/sxe2/sxe2_rx.c              | 55 +++++++------------------
 drivers/net/sxe2/sxe2_txrx_poll.c       | 38 ++++++-----------
 drivers/net/sxe2/sxe2_txrx_vec_common.h | 52 ++++++++++-------------
 drivers/net/sxe2/sxe2_txrx_vec_sse.c    | 29 +------------
 7 files changed, 61 insertions(+), 133 deletions(-)

diff --git a/drivers/net/sxe2/sxe2_ethdev.c b/drivers/net/sxe2/sxe2_ethdev.c
index b6cc8703a7..066e1faf7e 100644
--- a/drivers/net/sxe2/sxe2_ethdev.c
+++ b/drivers/net/sxe2/sxe2_ethdev.c
@@ -891,7 +891,7 @@ static int32_t sxe2_eth_pmd_probe_pf(struct sxe2_common_device *cdev,
 static int32_t sxe2_parse_eth_devargs(struct rte_device *dev,
 			  struct rte_eth_devargs *eth_da)
 {
-	int ret = 0;
+	int32_t ret = 0;
 
 	if (dev->devargs == NULL)
 		return 0;
diff --git a/drivers/net/sxe2/sxe2_ethdev.h b/drivers/net/sxe2/sxe2_ethdev.h
index a3706945e8..8015d9a064 100644
--- a/drivers/net/sxe2/sxe2_ethdev.h
+++ b/drivers/net/sxe2/sxe2_ethdev.h
@@ -130,9 +130,8 @@ struct sxe2_devargs {
 	uint8_t flow_dup_pattern_mode;
 	uint8_t func_flow_direct_en;
 	uint8_t fnav_stat_type;
-	uint8_t high_performance_mode;
+	uint8_t no_sched_mode;
 	uint8_t sched_layer_mode;
-	uint8_t sw_stats_en;
 	uint8_t rx_low_latency;
 };
 
diff --git a/drivers/net/sxe2/sxe2_queue.h b/drivers/net/sxe2/sxe2_queue.h
index adb4be1214..a300b66771 100644
--- a/drivers/net/sxe2/sxe2_queue.h
+++ b/drivers/net/sxe2/sxe2_queue.h
@@ -7,7 +7,6 @@
 
 #include <rte_ethdev.h>
 #include <rte_io.h>
-#include <rte_stdatomic.h>
 #include <ethdev_driver.h>
 
 #include "sxe2_drv_cmd.h"
@@ -123,13 +122,13 @@ struct sxe2_rxq_stats {
 };
 
 struct sxe2_rxq_sw_stats {
-	RTE_ATOMIC(uint64_t)pkts;
-	RTE_ATOMIC(uint64_t)bytes;
-	RTE_ATOMIC(uint64_t)drop_pkts;
-	RTE_ATOMIC(uint64_t)drop_bytes;
-	RTE_ATOMIC(uint64_t)unicast_pkts;
-	RTE_ATOMIC(uint64_t)multicast_pkts;
-	RTE_ATOMIC(uint64_t)broadcast_pkts;
+	uint64_t pkts;
+	uint64_t bytes;
+	uint64_t drop_pkts;
+	uint64_t drop_bytes;
+	uint64_t unicast_pkts;
+	uint64_t multicast_pkts;
+	uint64_t broadcast_pkts;
 };
 
 struct sxe2_rx_queue {
diff --git a/drivers/net/sxe2/sxe2_rx.c b/drivers/net/sxe2/sxe2_rx.c
index 28832d5f71..543d825166 100644
--- a/drivers/net/sxe2/sxe2_rx.c
+++ b/drivers/net/sxe2/sxe2_rx.c
@@ -479,20 +479,13 @@ int32_t __rte_cold sxe2_rxqs_all_start(struct rte_eth_dev *dev)
 			goto l_free_started_queue;
 		}
 
-		rte_atomic_store_explicit(&rxq->sw_stats.pkts, 0,
-			rte_memory_order_relaxed);
-		rte_atomic_store_explicit(&rxq->sw_stats.bytes, 0,
-			rte_memory_order_relaxed);
-		rte_atomic_store_explicit(&rxq->sw_stats.drop_pkts, 0,
-			rte_memory_order_relaxed);
-		rte_atomic_store_explicit(&rxq->sw_stats.drop_bytes, 0,
-			rte_memory_order_relaxed);
-		rte_atomic_store_explicit(&rxq->sw_stats.unicast_pkts, 0,
-			rte_memory_order_relaxed);
-		rte_atomic_store_explicit(&rxq->sw_stats.broadcast_pkts, 0,
-			rte_memory_order_relaxed);
-		rte_atomic_store_explicit(&rxq->sw_stats.multicast_pkts, 0,
-			rte_memory_order_relaxed);
+		rxq->sw_stats.pkts = 0;
+		rxq->sw_stats.bytes = 0;
+		rxq->sw_stats.drop_pkts = 0;
+		rxq->sw_stats.drop_bytes = 0;
+		rxq->sw_stats.unicast_pkts = 0;
+		rxq->sw_stats.broadcast_pkts = 0;
+		rxq->sw_stats.multicast_pkts = 0;
 	}
 	ret = 0;
 	goto l_end;
@@ -524,31 +517,15 @@ void __rte_cold sxe2_rxqs_all_stop(struct rte_eth_dev *dev)
 
 		rxq = dev->data->rx_queues[nb_rxq];
 		if (rxq) {
-			sw_stats_prev->ipackets +=
-				rte_atomic_load_explicit(&rxq->sw_stats.pkts,
-					rte_memory_order_relaxed);
-			sw_stats_prev->ierrors +=
-				rte_atomic_load_explicit(&rxq->sw_stats.drop_pkts,
-					rte_memory_order_relaxed);
-			sw_stats_prev->ibytes +=
-				rte_atomic_load_explicit(&rxq->sw_stats.bytes,
-					rte_memory_order_relaxed);
-
-			sw_stats_prev->rx_sw_unicast_packets +=
-				rte_atomic_load_explicit(&rxq->sw_stats.unicast_pkts,
-					rte_memory_order_relaxed);
-			sw_stats_prev->rx_sw_broadcast_packets +=
-				rte_atomic_load_explicit(&rxq->sw_stats.broadcast_pkts,
-					rte_memory_order_relaxed);
-			sw_stats_prev->rx_sw_multicast_packets +=
-				rte_atomic_load_explicit(&rxq->sw_stats.multicast_pkts,
-					rte_memory_order_relaxed);
-			sw_stats_prev->rx_sw_drop_packets +=
-				rte_atomic_load_explicit(&rxq->sw_stats.drop_pkts,
-					rte_memory_order_relaxed);
-			sw_stats_prev->rx_sw_drop_bytes +=
-				rte_atomic_load_explicit(&rxq->sw_stats.drop_bytes,
-					rte_memory_order_relaxed);
+			sw_stats_prev->ipackets += rxq->sw_stats.pkts;
+			sw_stats_prev->ierrors += rxq->sw_stats.drop_pkts;
+			sw_stats_prev->ibytes += rxq->sw_stats.bytes;
+
+			sw_stats_prev->rx_sw_unicast_packets += rxq->sw_stats.unicast_pkts;
+			sw_stats_prev->rx_sw_broadcast_packets += rxq->sw_stats.broadcast_pkts;
+			sw_stats_prev->rx_sw_multicast_packets += rxq->sw_stats.multicast_pkts;
+			sw_stats_prev->rx_sw_drop_packets += rxq->sw_stats.drop_pkts;
+			sw_stats_prev->rx_sw_drop_bytes += rxq->sw_stats.drop_bytes;
 		}
 	}
 }
diff --git a/drivers/net/sxe2/sxe2_txrx_poll.c b/drivers/net/sxe2/sxe2_txrx_poll.c
index b9d34afb31..947a5247ed 100644
--- a/drivers/net/sxe2/sxe2_txrx_poll.c
+++ b/drivers/net/sxe2/sxe2_txrx_poll.c
@@ -682,23 +682,17 @@ sxe2_rx_sw_stats_update(struct sxe2_rx_queue *rxq, struct rte_mbuf *mbuf,
 		union sxe2_rx_desc *rxd)
 {
 	uint64_t qword1 = rte_le_to_cpu_64(rxd->wb.status_err_ptype_len);
-	rte_atomic_fetch_add_explicit(&rxq->sw_stats.pkts, 1,
-		rte_memory_order_relaxed);
-	rte_atomic_fetch_add_explicit(&rxq->sw_stats.bytes,
-			mbuf->pkt_len + RTE_ETHER_CRC_LEN,
-			rte_memory_order_relaxed);
+	rxq->sw_stats.pkts += 1;
+	rxq->sw_stats.bytes += mbuf->pkt_len + RTE_ETHER_CRC_LEN;
 	switch (SXE2_RX_DESC_STATUS_UMBCAST_VAL_GET(qword1)) {
 	case SXE2_RX_DESC_STATUS_UNICAST:
-		rte_atomic_fetch_add_explicit(&rxq->sw_stats.unicast_pkts, 1,
-			rte_memory_order_relaxed);
+		rxq->sw_stats.unicast_pkts += 1;
 		break;
 	case SXE2_RX_DESC_STATUS_MULTICAST:
-		rte_atomic_fetch_add_explicit(&rxq->sw_stats.multicast_pkts, 1,
-			rte_memory_order_relaxed);
+		rxq->sw_stats.multicast_pkts += 1;
 		break;
 	case SXE2_RX_DESC_STATUS_BROADCAST:
-		rte_atomic_fetch_add_explicit(&rxq->sw_stats.broadcast_pkts, 1,
-			rte_memory_order_relaxed);
+		rxq->sw_stats.broadcast_pkts += 1;
 		break;
 	default:
 		break;
@@ -787,11 +781,9 @@ uint16_t sxe2_rx_pkts_scattered(void *rx_queue, struct rte_mbuf **rx_pkts, uint1
 
 		if (unlikely(qword1 & SXE2_RX_DESC_ERROR_RXE_MASK) ||
 			unlikely(qword1 & SXE2_RX_DESC_ERROR_OVERSIZE_MASK)) {
-			rte_atomic_fetch_add_explicit(&rxq->sw_stats.drop_pkts, 1,
-				rte_memory_order_relaxed);
-			rte_atomic_fetch_add_explicit(&rxq->sw_stats.drop_bytes,
-				first_seg->pkt_len - rxq->crc_len + RTE_ETHER_CRC_LEN,
-				rte_memory_order_relaxed);
+			rxq->sw_stats.drop_pkts += 1;
+			rxq->sw_stats.drop_bytes +=
+				first_seg->pkt_len - rxq->crc_len + RTE_ETHER_CRC_LEN;
 			rte_pktmbuf_free(first_seg);
 			first_seg = NULL;
 			continue;
@@ -822,8 +814,7 @@ uint16_t sxe2_rx_pkts_scattered(void *rx_queue, struct rte_mbuf **rx_pkts, uint1
 
 		sxe2_rx_mbuf_common_fields_fill(rxq, first_seg, &desc_tmp);
 
-		if (rxq->vsi->adapter->devargs.sw_stats_en)
-			sxe2_rx_sw_stats_update(rxq, first_seg, &desc_tmp);
+		sxe2_rx_sw_stats_update(rxq, first_seg, &desc_tmp);
 
 		rte_prefetch0(RTE_PTR_ADD(first_seg->buf_addr, first_seg->data_off));
 
@@ -990,11 +981,9 @@ uint16_t sxe2_rx_pkts_scattered_split(void *rx_queue, struct rte_mbuf **rx_pkts,
 
 		if (unlikely(qword1 & SXE2_RX_DESC_ERROR_RXE_MASK) ||
 			unlikely(qword1 & SXE2_RX_DESC_ERROR_OVERSIZE_MASK)) {
-			rte_atomic_fetch_add_explicit(&rxq->sw_stats.drop_pkts, 1,
-				rte_memory_order_relaxed);
-			rte_atomic_fetch_add_explicit(&rxq->sw_stats.drop_bytes,
-				first_seg->pkt_len - rxq->crc_len + RTE_ETHER_CRC_LEN,
-				rte_memory_order_relaxed);
+			rxq->sw_stats.drop_pkts += 1;
+			rxq->sw_stats.drop_bytes +=
+				first_seg->pkt_len - rxq->crc_len + RTE_ETHER_CRC_LEN;
 			rte_pktmbuf_free(first_seg);
 			first_seg = NULL;
 			continue;
@@ -1023,8 +1012,7 @@ uint16_t sxe2_rx_pkts_scattered_split(void *rx_queue, struct rte_mbuf **rx_pkts,
 		first_seg->port = rxq->port_id;
 		sxe2_rx_mbuf_common_fields_fill(rxq, first_seg, &desc_tmp);
 
-		if (rxq->vsi->adapter->devargs.sw_stats_en)
-			sxe2_rx_sw_stats_update(rxq, first_seg, &desc_tmp);
+		sxe2_rx_sw_stats_update(rxq, first_seg, &desc_tmp);
 
 		rte_prefetch0(RTE_PTR_ADD(first_seg->buf_addr, first_seg->data_off));
 
diff --git a/drivers/net/sxe2/sxe2_txrx_vec_common.h b/drivers/net/sxe2/sxe2_txrx_vec_common.h
index 6b1649c390..cc74f6e582 100644
--- a/drivers/net/sxe2/sxe2_txrx_vec_common.h
+++ b/drivers/net/sxe2/sxe2_txrx_vec_common.h
@@ -130,27 +130,20 @@ sxe2_tx_desc_fill_offloads(struct rte_mbuf *mbuf, uint64_t *desc_qw1)
 static inline void sxe2_vf_rx_vec_sw_stats_cnt(struct sxe2_rx_queue *rxq,
 		struct rte_mbuf *mbuf, uint8_t umbcast_flag)
 {
-	if (rxq->vsi->adapter->devargs.sw_stats_en) {
-		rte_atomic_fetch_add_explicit(&rxq->sw_stats.pkts, 1,
-					rte_memory_order_relaxed);
-		rte_atomic_fetch_add_explicit(&rxq->sw_stats.bytes,
-				 mbuf->pkt_len + RTE_ETHER_CRC_LEN, rte_memory_order_relaxed);
-		switch (SXE2_RX_UMBCAST_FLAGS_VAL_GET(umbcast_flag)) {
-		case SXE2_RX_DESC_STATUS_UNICAST:
-			rte_atomic_fetch_add_explicit(&rxq->sw_stats.unicast_pkts, 1,
-					rte_memory_order_relaxed);
-			break;
-		case SXE2_RX_DESC_STATUS_MULTICAST:
-			rte_atomic_fetch_add_explicit(&rxq->sw_stats.multicast_pkts, 1,
-					rte_memory_order_relaxed);
-			break;
-		case SXE2_RX_DESC_STATUS_BROADCAST:
-			rte_atomic_fetch_add_explicit(&rxq->sw_stats.broadcast_pkts, 1,
-					rte_memory_order_relaxed);
-			break;
-		default:
-			break;
-		}
+	rxq->sw_stats.pkts += 1;
+	rxq->sw_stats.bytes += mbuf->pkt_len + RTE_ETHER_CRC_LEN;
+	switch (SXE2_RX_UMBCAST_FLAGS_VAL_GET(umbcast_flag)) {
+	case SXE2_RX_DESC_STATUS_UNICAST:
+		rxq->sw_stats.unicast_pkts += 1;
+		break;
+	case SXE2_RX_DESC_STATUS_MULTICAST:
+		rxq->sw_stats.multicast_pkts += 1;
+		break;
+	case SXE2_RX_DESC_STATUS_BROADCAST:
+		rxq->sw_stats.broadcast_pkts += 1;
+		break;
+	default:
+		break;
 	}
 }
 
@@ -196,11 +189,9 @@ sxe2_rx_pkts_refactor(struct sxe2_rx_queue *rxq,
 			} else if (split_rxe_flags[buf_idx] & SXE2_RX_DESC_STATUS_EOP_MASK) {
 				continue;
 			} else {
-				rte_atomic_fetch_add_explicit(&rxq->sw_stats.drop_pkts, 1,
-					rte_memory_order_relaxed);
-				rte_atomic_fetch_add_explicit(&rxq->sw_stats.drop_bytes,
-				 first_seg->pkt_len - rxq->crc_len + RTE_ETHER_CRC_LEN,
-				 rte_memory_order_relaxed);
+				rxq->sw_stats.drop_pkts += 1;
+				rxq->sw_stats.drop_bytes +=
+					first_seg->pkt_len - rxq->crc_len + RTE_ETHER_CRC_LEN;
 				rte_pktmbuf_free(first_seg);
 				first_seg = NULL;
 				last_seg  = NULL;
@@ -218,11 +209,10 @@ sxe2_rx_pkts_refactor(struct sxe2_rx_queue *rxq,
 				mbuf_bufs[buf_idx]->data_len += rxq->crc_len;
 				mbuf_bufs[buf_idx]->pkt_len  += rxq->crc_len;
 			} else {
-				rte_atomic_fetch_add_explicit(&rxq->sw_stats.drop_pkts, 1,
-					rte_memory_order_relaxed);
-				rte_atomic_fetch_add_explicit(&rxq->sw_stats.drop_bytes,
-				 mbuf_bufs[buf_idx]->pkt_len - rxq->crc_len + RTE_ETHER_CRC_LEN,
-				 rte_memory_order_relaxed);
+				rxq->sw_stats.drop_pkts += 1;
+				rxq->sw_stats.drop_bytes +=
+					mbuf_bufs[buf_idx]->pkt_len - rxq->crc_len +
+					RTE_ETHER_CRC_LEN;
 				rte_pktmbuf_free_seg(mbuf_bufs[buf_idx]);
 				continue;
 			}
diff --git a/drivers/net/sxe2/sxe2_txrx_vec_sse.c b/drivers/net/sxe2/sxe2_txrx_vec_sse.c
index f6e3f45937..182a7dfc17 100644
--- a/drivers/net/sxe2/sxe2_txrx_vec_sse.c
+++ b/drivers/net/sxe2/sxe2_txrx_vec_sse.c
@@ -483,41 +483,16 @@ static __rte_always_inline uint16_t
 sxe2_rx_pkts_scattered_batch_vec_sse(struct sxe2_rx_queue *rxq,
 		struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 {
-	const uint64_t *split_rxe_flags64;
 	uint8_t split_rxe_flags[SXE2_RX_PKTS_BURST_BATCH_NUM_VEC] = {0};
 	uint8_t umbcast_flags[SXE2_RX_PKTS_BURST_BATCH_NUM_VEC] = {0};
 	uint16_t rx_done_num;
 	uint16_t rx_pkt_done_num;
 	rx_pkt_done_num = 0;
 
-	if (rxq->vsi->adapter->devargs.sw_stats_en) {
-		rx_done_num = sxe2_rx_pkts_common_vec_sse(rxq, rx_pkts,
-				nb_pkts, split_rxe_flags, umbcast_flags);
-	} else {
-		rx_done_num = sxe2_rx_pkts_common_vec_sse(rxq, rx_pkts,
-				nb_pkts, split_rxe_flags, NULL);
-	}
+	rx_done_num = sxe2_rx_pkts_common_vec_sse(rxq, rx_pkts,
+			nb_pkts, split_rxe_flags, umbcast_flags);
 	if (rx_done_num == 0)
 		goto l_end;
-	if (!rxq->vsi->adapter->devargs.sw_stats_en) {
-		split_rxe_flags64 = (uint64_t *)split_rxe_flags;
-		if (rxq->pkt_first_seg == NULL &&
-			split_rxe_flags64[0] == 0 &&
-			split_rxe_flags64[1] == 0 &&
-			split_rxe_flags64[2] == 0 &&
-			split_rxe_flags64[3] == 0) {
-			rx_pkt_done_num = rx_done_num;
-			goto l_end;
-		}
-		if (rxq->pkt_first_seg == NULL) {
-			while (rx_pkt_done_num < rx_done_num &&
-			       split_rxe_flags[rx_pkt_done_num] == 0)
-				rx_pkt_done_num++;
-			if (rx_pkt_done_num == rx_done_num)
-				goto l_end;
-			rxq->pkt_first_seg = rx_pkts[rx_pkt_done_num];
-		}
-	}
 	rx_pkt_done_num += sxe2_rx_pkts_refactor(rxq, &rx_pkts[rx_pkt_done_num],
 			rx_done_num - rx_pkt_done_num, &split_rxe_flags[rx_pkt_done_num],
 			&umbcast_flags[rx_pkt_done_num]);
-- 
2.52.0


^ permalink raw reply related

* [PATCH v6] net/mlx5: fix counter TAILQ race between free and query callback
From: Linhu Li @ 2026-06-18  9:14 UTC (permalink / raw)
  To: dev; +Cc: stable, dsosnowski, Linhu Li
In-Reply-To: <20260604101112.72177-1-lilinhu618@gmail.com>

flow_dv_counter_free() inserts counters into
pool->counters[pool->query_gen] under pool->csl. Meanwhile,
mlx5_flow_async_pool_query_handle() moves counters from
pool->counters[query_gen ^ 1] to the global free list via
TAILQ_CONCAT while holding only cmng->csl, not pool->csl.

The comment in flow_dv_counter_free() claims the lock is not needed
because the query callback and the release function operate on
different lists. That holds only if the free path always observes
the up-to-date query_gen. It can be violated:

1. A counter free thread (non-PMD, e.g. OVS offload thread) reads
   pool->query_gen == 0 and is about to insert into counters[0].
2. The free thread is preempted by the OS scheduler; it is a regular
   pthread, not pinned to a core.
3. The eal-intr-thread alarm fires: query_gen++ (now 1) and the async
   query is sent.
4. Hardware completes the query and the callback runs TAILQ_CONCAT on
   counters[0] (= query_gen ^ 1).
5. The free thread resumes and runs TAILQ_INSERT_TAIL on counters[0]
   concurrently with step 4 on another core.

Because the two paths take different locks, TAILQ_INSERT_TAIL and
TAILQ_CONCAT run concurrently on the same list with no synchronization
and corrupt it: the pool-local list ends up with a NULL head but a
dangling tqh_last, and the global free list tail no longer points to
the real tail. The just-freed counter and every counter inserted
afterwards become unreachable and are leaked.

Non-PMD threads can be preempted for hundreds of microseconds under
CPU pressure, which is well within the async query round-trip time,
so the window is reachable in practice.

Fix it by taking pool->csl in the query completion callback before
operating on pool->counters[query_gen], serializing the CONCAT with
any concurrent INSERT. The lock is taken once per pool per query
completion in the eal-intr-thread context, not on the datapath, so
the cost is negligible. Lock order is pool->csl then cmng->csl,
matching all other sites.

Also handle the error path: previously the counters accumulated in
pool->counters[query_gen] were abandoned when a query failed. Move
them back to the global free list to avoid a leak on persistent
query failures.

Additionally, fix a second independent race in flow_dv_counter_free():
TAILQ_INSERT_TAIL is passed &pool->counters[pool->query_gen] directly,
but the macro evaluates its head argument multiple times. Since
pool->query_gen is a volatile bit-field, if mlx5_flow_query_alarm()
increments query_gen between two evaluations of the macro, the same
insertion can operate on two different lists: the earlier steps update
counters[0] while the later steps update counters[1], leaving both
lists with inconsistent metadata and leaking the counter. Fix by
caching pool->query_gen into a local variable before calling the macro.

Fixes: ac79183dc6f7 ("net/mlx5: optimize free counter lookup")
Cc: stable@dpdk.org

Signed-off-by: Linhu Li <lilinhu618@gmail.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---

v6:
- Rebased onto latest main to resolve a release notes conflict: a new
  mlx5 entry was added upstream after v5, so this patch now adds its
  fix as a sub-bullet under the existing "Updated NVIDIA mlx5 ethernet
  driver" entry instead of a separate item.

v5:
- Added fix for Race 2: cache pool->query_gen into a local variable
  before TAILQ_INSERT_TAIL to prevent the macro from evaluating the
  volatile bit-field multiple times and crossing generation lists.
- Updated release notes: moved the fix entry under "Updated NVIDIA mlx5
  driver" in New Features instead of using a separate "Fixed Issues" section.

v4:
- Fixed commit log line length over 75 characters.

v3:
- Added release notes entry.
- Added function comment in mlx5_flow_async_pool_query_handle().
- Clarified error path comment to note it is safe for transient failures.

v2:
- Fixed Signed-off-by to use full name.

 doc/guides/rel_notes/release_26_07.rst |  2 ++
 drivers/net/mlx5/mlx5_flow.c           | 31 ++++++++++++++++++++++++++
 drivers/net/mlx5/mlx5_flow_dv.c        | 12 +++++-----
 3 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/doc/guides/rel_notes/release_26_07.rst b/doc/guides/rel_notes/release_26_07.rst
index 5d7aa8d1bf..cdbd28ef4f 100644
--- a/doc/guides/rel_notes/release_26_07.rst
+++ b/doc/guides/rel_notes/release_26_07.rst
@@ -139,6 +139,8 @@ New Features
 * **Updated NVIDIA mlx5 ethernet driver.**
 
   * Added support for selective Rx in scalar SPRQ Rx path.
+  * Fixed counter free list corruption when counter free operations race with
+    asynchronous query completions.
 
 * **Updated PCAP ethernet driver.**
 
diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c
index a95dd9dc94..b0eac185b5 100644
--- a/drivers/net/mlx5/mlx5_flow.c
+++ b/drivers/net/mlx5/mlx5_flow.c
@@ -9893,6 +9893,13 @@ void
 mlx5_flow_async_pool_query_handle(struct mlx5_dev_ctx_shared *sh,
 				  uint64_t async_id, int status)
 {
+	/*
+	 * Handle async counter pool query completion.
+	 * query_gen is flipped each round: freed counters go into [query_gen],
+	 * while this callback moves [query_gen ^ 1] to the global free list.
+	 * pool->csl must be held when operating on pool->counters[] to serialize
+	 * with concurrent free-path insertions.
+	 */
 	struct mlx5_flow_counter_pool *pool =
 		(struct mlx5_flow_counter_pool *)(uintptr_t)async_id;
 	struct mlx5_counter_stats_raw *raw_to_free;
@@ -9904,6 +9911,21 @@ mlx5_flow_async_pool_query_handle(struct mlx5_dev_ctx_shared *sh,
 
 	if (unlikely(status)) {
 		raw_to_free = pool->raw_hw;
+		/*
+		 * The query failed, so the freed counters accumulated
+		 * in the old-gen list would otherwise be stranded.
+		 * Move them back to the global free list. This is safe
+		 * for both transient and persistent failures: the
+		 * counters are still valid and can be reused.
+		 */
+		if (!TAILQ_EMPTY(&pool->counters[query_gen])) {
+			rte_spinlock_lock(&pool->csl);
+			rte_spinlock_lock(&cmng->csl[cnt_type]);
+			TAILQ_CONCAT(&cmng->counters[cnt_type],
+				     &pool->counters[query_gen], next);
+			rte_spinlock_unlock(&cmng->csl[cnt_type]);
+			rte_spinlock_unlock(&pool->csl);
+		}
 	} else {
 		raw_to_free = pool->raw;
 		if (pool->is_aged)
@@ -9913,11 +9935,20 @@ mlx5_flow_async_pool_query_handle(struct mlx5_dev_ctx_shared *sh,
 		rte_spinlock_unlock(&pool->sl);
 		/* Be sure the new raw counters data is updated in memory. */
 		rte_io_wmb();
+		/*
+		 * A counter free thread may have read a stale query_gen
+		 * before the generation was flipped and could still be
+		 * inserting into this same old-gen list. Hold pool->csl to
+		 * serialize TAILQ_CONCAT with that TAILQ_INSERT_TAIL and
+		 * avoid corrupting the list.
+		 */
 		if (!TAILQ_EMPTY(&pool->counters[query_gen])) {
+			rte_spinlock_lock(&pool->csl);
 			rte_spinlock_lock(&cmng->csl[cnt_type]);
 			TAILQ_CONCAT(&cmng->counters[cnt_type],
 				     &pool->counters[query_gen], next);
 			rte_spinlock_unlock(&cmng->csl[cnt_type]);
+			rte_spinlock_unlock(&pool->csl);
 		}
 	}
 	LIST_INSERT_HEAD(&sh->sws_cmng.free_stat_raws, raw_to_free, next);
diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index 307354c886..58ebcf87eb 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -7129,6 +7129,7 @@ flow_dv_counter_free(struct rte_eth_dev *dev, uint32_t counter)
 	struct mlx5_flow_counter_pool *pool = NULL;
 	struct mlx5_flow_counter *cnt;
 	enum mlx5_counter_type cnt_type;
+	uint32_t query_gen;
 
 	if (!counter)
 		return;
@@ -7153,16 +7154,17 @@ flow_dv_counter_free(struct rte_eth_dev *dev, uint32_t counter)
 	cnt->pool = pool;
 	/*
 	 * Put the counter back to list to be updated in none fallback mode.
-	 * Currently, we are using two list alternately, while one is in query,
+	 * Currently, we are using two lists alternately, while one is in query,
 	 * add the freed counter to the other list based on the pool query_gen
 	 * value. After query finishes, add counter the list to the global
-	 * container counter list. The list changes while query starts. In
-	 * this case, lock will not be needed as query callback and release
-	 * function both operate with the different list.
+	 * container counter list. Cache query_gen into a local variable before
+	 * TAILQ_INSERT_TAIL, since the macro evaluates its head argument
+	 * multiple times and pool->query_gen is a volatile bit-field.
 	 */
 	if (!priv->sh->sws_cmng.counter_fallback) {
 		rte_spinlock_lock(&pool->csl);
-		TAILQ_INSERT_TAIL(&pool->counters[pool->query_gen], cnt, next);
+		query_gen = pool->query_gen;
+		TAILQ_INSERT_TAIL(&pool->counters[query_gen], cnt, next);
 		rte_spinlock_unlock(&pool->csl);
 	} else {
 		cnt->dcs_when_free = cnt->dcs_when_active;
-- 
2.39.3 (Apple Git-146)


^ permalink raw reply related

* [PATCH v4 00/23] et/sxe2: added Linkdata sxe2 ethernet driver
From: liujie5 @ 2026-06-19  8:01 UTC (permalink / raw)
  To: stephen; +Cc: dev, Jie Liu
In-Reply-To: <20260618082723.571054-21-liujie5@linkdatatechnology.com>

From: Jie Liu <liujie5@linkdatatechnology.com>

This patch set implements core functionality for the SXE2 PMD,
including basic driver framework, data path setup, and advanced
offload features (VLAN, RSS,TM, PTP etc.).

V19:
 - remove software statistics devargs

Jie Liu (23):
  net/sxe2: remove software statistics devargs
  net/sxe2: support AVX512 vectorized path for Rx and Tx
  net/sxe2: add AVX2 vector data path for Rx and Tx
  net/sxe2: add supported packet types get callback
  net/sxe2: add link update callback
  net/sxe2: support L2 filtering and MAC config
  drivers: support RSS feature
  net/sxe2: support TM hierarchy and shaping
  net/sxe2: support IPsec inline protocol offload
  net/sxe2: support statistics and multi-process
  drivers: interrupt handling
  net/sxe2: add NEON vec Rx/Tx burst functions
  drivers: add support for VF representors
  net/sxe2: add support for custom UDP tunnel ports
  net/sxe2: support firmware version reading
  net/sxe2: implement get monitor address
  common/sxe2: add shared SFP module definitions
  net/sxe2: support SFP module info and EEPROM access
  net/sxe2: implement private dump info
  net/sxe2: add mbuf validation in Tx debug mode
  common/sxe2: add callback for memory event handling
  net/sxe2: add private devargs parsing
  net/sxe2: update sxe2 feature matrix docs

 doc/guides/nics/features/sxe2.ini          |   56 +
 doc/guides/nics/sxe2.rst                   |  164 ++
 drivers/common/sxe2/sxe2_common.c          |  156 ++
 drivers/common/sxe2/sxe2_common.h          |    4 +
 drivers/common/sxe2/sxe2_flow_public.h     |  633 +++++++
 drivers/common/sxe2/sxe2_ioctl_chnl.c      |  178 +-
 drivers/common/sxe2/sxe2_ioctl_chnl_func.h |   18 +
 drivers/common/sxe2/sxe2_msg.h             |  118 ++
 drivers/net/sxe2/meson.build               |   52 +
 drivers/net/sxe2/sxe2_cmd_chnl.c           | 1587 +++++++++++++++-
 drivers/net/sxe2/sxe2_cmd_chnl.h           |  139 ++
 drivers/net/sxe2/sxe2_drv_cmd.h            |  523 +++++-
 drivers/net/sxe2/sxe2_dump.c               |  302 +++
 drivers/net/sxe2/sxe2_dump.h               |   12 +
 drivers/net/sxe2/sxe2_ethdev.c             | 1513 ++++++++++++++-
 drivers/net/sxe2/sxe2_ethdev.h             |  112 +-
 drivers/net/sxe2/sxe2_ethdev_repr.c        |  609 ++++++
 drivers/net/sxe2/sxe2_ethdev_repr.h        |   32 +
 drivers/net/sxe2/sxe2_filter.c             |  895 +++++++++
 drivers/net/sxe2/sxe2_filter.h             |  100 +
 drivers/net/sxe2/sxe2_flow.c               | 1394 ++++++++++++++
 drivers/net/sxe2/sxe2_flow.h               |   30 +
 drivers/net/sxe2/sxe2_flow_define.h        |  144 ++
 drivers/net/sxe2/sxe2_flow_parse_action.c  | 1182 ++++++++++++
 drivers/net/sxe2/sxe2_flow_parse_action.h  |   23 +
 drivers/net/sxe2/sxe2_flow_parse_engine.c  |  106 ++
 drivers/net/sxe2/sxe2_flow_parse_engine.h  |   13 +
 drivers/net/sxe2/sxe2_flow_parse_pattern.c | 1935 +++++++++++++++++++
 drivers/net/sxe2/sxe2_flow_parse_pattern.h |   46 +
 drivers/net/sxe2/sxe2_ipsec.c              | 1565 ++++++++++++++++
 drivers/net/sxe2/sxe2_ipsec.h              |  254 +++
 drivers/net/sxe2/sxe2_irq.c                | 1026 ++++++++++
 drivers/net/sxe2/sxe2_irq.h                |   25 +
 drivers/net/sxe2/sxe2_mac.c                |  530 ++++++
 drivers/net/sxe2/sxe2_mac.h                |   84 +
 drivers/net/sxe2/sxe2_mp.c                 |  414 ++++
 drivers/net/sxe2/sxe2_mp.h                 |   67 +
 drivers/net/sxe2/sxe2_queue.c              |   17 +-
 drivers/net/sxe2/sxe2_queue.h              |   15 +-
 drivers/net/sxe2/sxe2_rss.c                |  584 ++++++
 drivers/net/sxe2/sxe2_rss.h                |   81 +
 drivers/net/sxe2/sxe2_rx.c                 |   93 +-
 drivers/net/sxe2/sxe2_rx.h                 |    2 +
 drivers/net/sxe2/sxe2_security.c           |  335 ++++
 drivers/net/sxe2/sxe2_security.h           |   77 +
 drivers/net/sxe2/sxe2_stats.c              |  586 ++++++
 drivers/net/sxe2/sxe2_stats.h              |   39 +
 drivers/net/sxe2/sxe2_switchdev.c          |  332 ++++
 drivers/net/sxe2/sxe2_switchdev.h          |   33 +
 drivers/net/sxe2/sxe2_tm.c                 | 1151 ++++++++++++
 drivers/net/sxe2/sxe2_tm.h                 |   76 +
 drivers/net/sxe2/sxe2_tx.c                 |    7 +
 drivers/net/sxe2/sxe2_txrx.c               | 1968 +++++++++++++++++++-
 drivers/net/sxe2/sxe2_txrx.h               |    8 +
 drivers/net/sxe2/sxe2_txrx_check_mbuf.c    |  595 ++++++
 drivers/net/sxe2/sxe2_txrx_check_mbuf.h    |   38 +
 drivers/net/sxe2/sxe2_txrx_poll.c          |  281 ++-
 drivers/net/sxe2/sxe2_txrx_vec.c           |   46 +-
 drivers/net/sxe2/sxe2_txrx_vec.h           |   38 +-
 drivers/net/sxe2/sxe2_txrx_vec_avx2.c      |  748 ++++++++
 drivers/net/sxe2/sxe2_txrx_vec_avx512.c    |  868 +++++++++
 drivers/net/sxe2/sxe2_txrx_vec_common.h    |   53 +-
 drivers/net/sxe2/sxe2_txrx_vec_neon.c      |  691 +++++++
 drivers/net/sxe2/sxe2_txrx_vec_sse.c       |   29 +-
 drivers/net/sxe2/sxe2_vsi.c                |  146 ++
 drivers/net/sxe2/sxe2_vsi.h                |   12 +-
 drivers/net/sxe2/sxe2vf_regs.h             |   85 +
 67 files changed, 24809 insertions(+), 266 deletions(-)
 create mode 100644 drivers/common/sxe2/sxe2_flow_public.h
 create mode 100644 drivers/common/sxe2/sxe2_msg.h
 create mode 100644 drivers/net/sxe2/sxe2_dump.c
 create mode 100644 drivers/net/sxe2/sxe2_dump.h
 create mode 100644 drivers/net/sxe2/sxe2_ethdev_repr.c
 create mode 100644 drivers/net/sxe2/sxe2_ethdev_repr.h
 create mode 100644 drivers/net/sxe2/sxe2_filter.c
 create mode 100644 drivers/net/sxe2/sxe2_filter.h
 create mode 100644 drivers/net/sxe2/sxe2_flow.c
 create mode 100644 drivers/net/sxe2/sxe2_flow.h
 create mode 100644 drivers/net/sxe2/sxe2_flow_define.h
 create mode 100644 drivers/net/sxe2/sxe2_flow_parse_action.c
 create mode 100644 drivers/net/sxe2/sxe2_flow_parse_action.h
 create mode 100644 drivers/net/sxe2/sxe2_flow_parse_engine.c
 create mode 100644 drivers/net/sxe2/sxe2_flow_parse_engine.h
 create mode 100644 drivers/net/sxe2/sxe2_flow_parse_pattern.c
 create mode 100644 drivers/net/sxe2/sxe2_flow_parse_pattern.h
 create mode 100644 drivers/net/sxe2/sxe2_ipsec.c
 create mode 100644 drivers/net/sxe2/sxe2_ipsec.h
 create mode 100644 drivers/net/sxe2/sxe2_irq.c
 create mode 100644 drivers/net/sxe2/sxe2_mac.c
 create mode 100644 drivers/net/sxe2/sxe2_mac.h
 create mode 100644 drivers/net/sxe2/sxe2_mp.c
 create mode 100644 drivers/net/sxe2/sxe2_mp.h
 create mode 100644 drivers/net/sxe2/sxe2_rss.c
 create mode 100644 drivers/net/sxe2/sxe2_rss.h
 create mode 100644 drivers/net/sxe2/sxe2_security.c
 create mode 100644 drivers/net/sxe2/sxe2_security.h
 create mode 100644 drivers/net/sxe2/sxe2_stats.c
 create mode 100644 drivers/net/sxe2/sxe2_stats.h
 create mode 100644 drivers/net/sxe2/sxe2_switchdev.c
 create mode 100644 drivers/net/sxe2/sxe2_switchdev.h
 create mode 100644 drivers/net/sxe2/sxe2_tm.c
 create mode 100644 drivers/net/sxe2/sxe2_tm.h
 create mode 100644 drivers/net/sxe2/sxe2_txrx_check_mbuf.c
 create mode 100644 drivers/net/sxe2/sxe2_txrx_check_mbuf.h
 create mode 100644 drivers/net/sxe2/sxe2_txrx_vec_avx2.c
 create mode 100644 drivers/net/sxe2/sxe2_txrx_vec_avx512.c
 create mode 100644 drivers/net/sxe2/sxe2_txrx_vec_neon.c
 create mode 100644 drivers/net/sxe2/sxe2vf_regs.h

-- 
2.52.0


^ permalink raw reply

* RE: [PATCH v1 0/5] prefix lcore role enum values
From: Morten Brørup @ 2026-06-19  7:54 UTC (permalink / raw)
  To: Thomas Monjalon, Stephen Hemminger
  Cc: Huisong Li, andrew.rybchenko, dev, zhanjie9
In-Reply-To: <ApV03BBBSN-iQgiffDgXRg@monjalon.net>

> From: Thomas Monjalon [mailto:thomas@monjalon.net]
> Sent: Friday, 19 June 2026 09.28
> 
> 19/06/2026 04:03, Stephen Hemminger:
> > On Wed, 17 Jun 2026 13:48:37 +0200
> > Morten Brørup <mb@smartsharesystems.com> wrote:
> >
> > > > From: Huisong Li [mailto:lihuisong@huawei.com]
> > > > Sent: Wednesday, 17 June 2026 12.28
> > > >
> > > > Add the RTE_LCORE_ prefix to the lcore role enum values in
> > > > rte_lcore_role_t
> > > > to follow DPDK naming conventions.
> > > >
> > > > - ROLE_RTE      -> RTE_LCORE_ROLE_RTE
> > > > - ROLE_OFF      -> RTE_LCORE_ROLE_OFF
> > > > - ROLE_SERVICE  -> RTE_LCORE_ROLE_SERVICE
> > > > - ROLE_NON_EAL  -> RTE_LCORE_ROLE_NON_EAL
> > > >
> > > > Old names are kept as macros aliasing to the new names to
> preserve
> > > > backward compatibility.
> > > >
> > >
> > > Series-Acked-by: Morten Brørup <mb@smartsharesystems.com>
> > >
> >
> > The problem with this patch it causes build failures now with abi
> diff.
> 
> It is probably a bug of an old version of abidiff.
> I recommend updating.

With the #define's the ABI has not changed. It's probably too indirect for abidiff to understand.
If we absolutely want to please abidiff, we could keep the existing enums and #define RTE_LCORE_ROLE_RTE ROLE_RTE for now.
But I'm in favor of what was done already.


^ permalink raw reply

* Re: [PATCH] examples/ptp_tap_relay_sw: forbid shadowed variables
From: Thomas Monjalon @ 2026-06-19  7:30 UTC (permalink / raw)
  To: Stephen Hemminger; +Cc: dev, Rajesh Kumar
In-Reply-To: <20260618130554.616501bd@phoenix.local>

18/06/2026 22:05, Stephen Hemminger:
> On Thu, 18 Jun 2026 16:25:26 +0200
> Thomas Monjalon <thomas@monjalon.net> wrote:
> 
> > By removing the compilation flag no_shadow_cflag,
> > it becomes forbidden to shadow a variable.
> > 
> > Signed-off-by: Thomas Monjalon <thomas@monjalon.net>
> > ---
> 
> Thanks, example did not exist when the first pass was done.
> 
> Acked-by: Stephen Hemminger <stephen@networkplumber.org>

Applied




^ permalink raw reply

* Re: [PATCH v1 0/5] prefix lcore role enum values
From: Thomas Monjalon @ 2026-06-19  7:28 UTC (permalink / raw)
  To: Stephen Hemminger
  Cc: Morten Brørup, Huisong Li, andrew.rybchenko, dev, zhanjie9
In-Reply-To: <20260618190339.2fc76616@phoenix.local>

19/06/2026 04:03, Stephen Hemminger:
> On Wed, 17 Jun 2026 13:48:37 +0200
> Morten Brørup <mb@smartsharesystems.com> wrote:
> 
> > > From: Huisong Li [mailto:lihuisong@huawei.com]
> > > Sent: Wednesday, 17 June 2026 12.28
> > > 
> > > Add the RTE_LCORE_ prefix to the lcore role enum values in
> > > rte_lcore_role_t
> > > to follow DPDK naming conventions.
> > > 
> > > - ROLE_RTE      -> RTE_LCORE_ROLE_RTE
> > > - ROLE_OFF      -> RTE_LCORE_ROLE_OFF
> > > - ROLE_SERVICE  -> RTE_LCORE_ROLE_SERVICE
> > > - ROLE_NON_EAL  -> RTE_LCORE_ROLE_NON_EAL
> > > 
> > > Old names are kept as macros aliasing to the new names to preserve
> > > backward compatibility.
> > >   
> > 
> > Series-Acked-by: Morten Brørup <mb@smartsharesystems.com>
> > 
> 
> The problem with this patch it causes build failures now with abi diff.

It is probably a bug of an old version of abidiff.
I recommend updating.



^ permalink raw reply

* [PATCH v2 18/18] net/dpaa: fix mbuf leak in SG fd creation
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

In dpaa_eth_mbuf_to_sg_fd(), when the allocated temp mbuf does not
have sufficient space for the SG entries, the function returned -1
without freeing 'temp', causing a memory leak. Free 'temp' before
returning the error.

Fixes: 8cffdcbe85aa ("net/dpaa: support scattered Rx")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa/dpaa_rxtx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/dpaa/dpaa_rxtx.c b/drivers/net/dpaa/dpaa_rxtx.c
index 1cda68e5af..f2011ceebb 100644
--- a/drivers/net/dpaa/dpaa_rxtx.c
+++ b/drivers/net/dpaa/dpaa_rxtx.c
@@ -990,6 +990,7 @@ dpaa_eth_mbuf_to_sg_fd(struct rte_mbuf *mbuf,
 	if (temp->buf_len < ((mbuf->nb_segs * sizeof(struct qm_sg_entry))
 				+ temp->data_off)) {
 		DPAA_PMD_ERR("Insufficient space in mbuf for SG entries");
+		rte_pktmbuf_free(temp);
 		return -1;
 	}
 
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 17/18] net/dpaa: fix null l3_len check in checksum offload
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

In dpaa_checksum(), if mbuf->l3_len is zero the L4 header pointer
calculation (l3_hdr + mbuf->l3_len) will point to the start of the
L3 header rather than the L4 header, leading to incorrect checksum
computation on a corrupt or uninitialized packet. Add an early
return guard when l3_len is zero.

Fixes: 5a8cf1bef775 ("net/dpaa: support checksum offload")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa/dpaa_rxtx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/dpaa/dpaa_rxtx.c b/drivers/net/dpaa/dpaa_rxtx.c
index c5e393159a..1cda68e5af 100644
--- a/drivers/net/dpaa/dpaa_rxtx.c
+++ b/drivers/net/dpaa/dpaa_rxtx.c
@@ -377,6 +377,8 @@ static inline void dpaa_checksum(struct rte_mbuf *mbuf)
 	struct rte_ipv6_hdr *ipv6_hdr = (struct rte_ipv6_hdr *)l3_hdr;
 
 	DPAA_DP_LOG(DEBUG, "Calculating checksum for mbuf: %p", mbuf);
+	if (mbuf->l3_len == 0)
+		return;
 
 	if (((mbuf->packet_type & RTE_PTYPE_L3_MASK) == RTE_PTYPE_L3_IPV4) ||
 	    ((mbuf->packet_type & RTE_PTYPE_L3_MASK) ==
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 16/18] net/dpaa: fix wrong buffer in xstats get by id
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

In dpaa_xstats_get_by_id(), fman_if_bmi_stats_get_all() was called
with 'values' (the output array) instead of 'values_copy' (the
scratch buffer). This caused the BMI stats to overwrite already
computed xstat values and then the subsequent loop would copy
garbage from values_copy into the output.

Pass 'values_copy' as intended so that BMI stats are fetched into
the scratch buffer and then correctly indexed into 'values'.

Fixes: d2536b006d78 ("bus/dpaa: add port buffer manager stats")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa/dpaa_ethdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c
index b7f3c4360b..a83499f332 100644
--- a/drivers/net/dpaa/dpaa_ethdev.c
+++ b/drivers/net/dpaa/dpaa_ethdev.c
@@ -928,7 +928,7 @@ dpaa_xstats_get_by_id(struct rte_eth_dev *dev, const uint64_t *ids,
 			values[i] =
 				values_copy[dpaa_xstats_strings[i].offset / 8];
 
-		fman_if_bmi_stats_get_all(dev->process_private, values);
+		fman_if_bmi_stats_get_all(dev->process_private, values_copy);
 		for (j = 0; i < stat_cnt; i++, j++)
 			values[i] = values_copy[j];
 
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 15/18] net/dpaa: remove duplicate ptype entries
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

RTE_PTYPE_L4_TCP and RTE_PTYPE_L4_UDP were listed twice in the
supported ptypes array returned by dpaa_supported_ptypes_get().
Remove the duplicate entries.

Fixes: ec503d8fa782 ("net/dpaa: update supported ptypes")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa/dpaa_ethdev.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c
index 3d6405d5fa..b7f3c4360b 100644
--- a/drivers/net/dpaa/dpaa_ethdev.c
+++ b/drivers/net/dpaa/dpaa_ethdev.c
@@ -406,8 +406,6 @@ dpaa_supported_ptypes_get(struct rte_eth_dev *dev, size_t *no_of_elements)
 		RTE_PTYPE_L4_TCP,
 		RTE_PTYPE_L4_UDP,
 		RTE_PTYPE_L4_FRAG,
-		RTE_PTYPE_L4_TCP,
-		RTE_PTYPE_L4_UDP,
 		RTE_PTYPE_L4_SCTP,
 		RTE_PTYPE_TUNNEL_ESP,
 		RTE_PTYPE_TUNNEL_GRE,
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 14/18] net/dpaa: fix xstat string typos in BMI stats table
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

Fix three issues in the xstats name table:
- 'rx_frame_discrad_count' is a misspelling, correct to
  'rx_frame_discard_count'
- 'rx_out_of_buffer_discard ' has a trailing space, remove it
- 'rx_buf_diallocate' is a misspelling, correct to
  'rx_buf_deallocate'

Fixes: d2536b006d78 ("bus/dpaa: add port buffer manager stats")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa/dpaa_ethdev.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c
index 3d3f2773a1..3d6405d5fa 100644
--- a/drivers/net/dpaa/dpaa_ethdev.c
+++ b/drivers/net/dpaa/dpaa_ethdev.c
@@ -135,13 +135,13 @@ static const struct rte_dpaa_xstats_name_off dpaa_xstats_strings[] = {
 		offsetof(struct dpaa_if_rx_bmi_stats, fmbm_rlfc)},
 	{"rx_filter_frames_count",
 		offsetof(struct dpaa_if_rx_bmi_stats, fmbm_rffc)},
-	{"rx_frame_discrad_count",
+	{"rx_frame_discard_count",
 		offsetof(struct dpaa_if_rx_bmi_stats, fmbm_rfdc)},
 	{"rx_frame_list_dma_err_count",
 		offsetof(struct dpaa_if_rx_bmi_stats, fmbm_rfldec)},
-	{"rx_out_of_buffer_discard ",
+	{"rx_out_of_buffer_discard",
 		offsetof(struct dpaa_if_rx_bmi_stats, fmbm_rodc)},
-	{"rx_buf_diallocate",
+	{"rx_buf_deallocate",
 		offsetof(struct dpaa_if_rx_bmi_stats, fmbm_rbdc)},
 };
 
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 13/18] net/dpaa: fix xstat name for tx undersized counter
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

The xstat entry mapping to 'tund' (TX undersized) was incorrectly
labeled as 'rx_undersized'. Fix the prefix to 'tx_undersized'.

Fixes: b21ed3e2a16d ("net/dpaa: support extended statistics")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa/dpaa_ethdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c
index c143e66f77..3d3f2773a1 100644
--- a/drivers/net/dpaa/dpaa_ethdev.c
+++ b/drivers/net/dpaa/dpaa_ethdev.c
@@ -125,7 +125,7 @@ static const struct rte_dpaa_xstats_name_off dpaa_xstats_strings[] = {
 		offsetof(struct dpaa_if_stats, terr)},
 	{"tx_vlan_frame",
 		offsetof(struct dpaa_if_stats, tvlan)},
-	{"rx_undersized",
+	{"tx_undersized",
 		offsetof(struct dpaa_if_stats, tund)},
 	{"rx_frame_counter",
 		offsetof(struct dpaa_if_rx_bmi_stats, fmbm_rfrc)},
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 12/18] dma/dpaa: fix out-of-bounds access in SG descriptor enqueue
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable, Vanshika Shukla
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

From: Vanshika Shukla <vanshika.shukla@nxp.com>

In fsl_qdma_enqueue_desc_sg(), the code accesses desc_ssge[num - 1]
without validating num first. If pending_num is 0, num will be 0 and
the access underflows. Add a bounds check to return -EINVAL when num
is 0 or exceeds FSL_QDMA_SG_MAX_ENTRY.

Fixes: a77261f61245 ("dma/dpaa: support scatter-gather")
Cc: stable@dpdk.org

Signed-off-by: Vanshika Shukla <vanshika.shukla@nxp.com>
---
 drivers/dma/dpaa/dpaa_qdma.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/dpaa/dpaa_qdma.c b/drivers/dma/dpaa/dpaa_qdma.c
index 74e23d2ee5..b20ff24ab6 100644
--- a/drivers/dma/dpaa/dpaa_qdma.c
+++ b/drivers/dma/dpaa/dpaa_qdma.c
@@ -1,5 +1,5 @@
 /* SPDX-License-Identifier: BSD-3-Clause
- * Copyright 2021-2024 NXP
+ * Copyright 2021-2026 NXP
  */
 
 #include <bus_dpaa_driver.h>
@@ -827,6 +827,11 @@ fsl_qdma_enqueue_desc_sg(struct fsl_qdma_queue *fsl_queue)
 		}
 	}
 
+	if (num == 0 || num > FSL_QDMA_SG_MAX_ENTRY) {
+		DPAA_QDMA_ERR("Invalid scatter-gather entry count: num=%u", num);
+		return -EINVAL;
+	}
+
 	ft->desc_ssge[num - 1].final = 1;
 	ft->desc_dsge[num - 1].final = 1;
 	csgf_src->length = total_len;
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 11/18] net/dpaa: fix port_handle leak in fm_prev_cleanup
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable, Vanshika Shukla
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

From: Vanshika Shukla <vanshika.shukla@nxp.com>

In fm_prev_cleanup(), the port_handle was not closed before being
overwritten on each iteration, causing a resource leak. Add a null
check and close the existing handle before opening a new one.

Fixes: e498f3b51f38 ("net/dpaa: improve port cleanup")
Cc: stable@dpdk.org

Signed-off-by: Vanshika Shukla <vanshika.shukla@nxp.com>
---
 drivers/net/dpaa/dpaa_flow.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/dpaa/dpaa_flow.c b/drivers/net/dpaa/dpaa_flow.c
index 417b9b6fbb..f21950f64d 100644
--- a/drivers/net/dpaa/dpaa_flow.c
+++ b/drivers/net/dpaa/dpaa_flow.c
@@ -81,6 +81,10 @@ static void fm_prev_cleanup(void)
 		devid = fm_model.device_order[i];
 		/* FM Port Open */
 		fm_model.fm_port_params[devid].h_fm = fm_info.fman_handle;
+		if (dpaa_intf.port_handle) {
+			fm_port_close(dpaa_intf.port_handle);
+			dpaa_intf.port_handle = NULL;
+		}
 		dpaa_intf.port_handle =
 				fm_port_open(&fm_model.fm_port_params[devid]);
 		dpaa_intf.scheme_handle[0] = create_device(fm_info.pcd_handle,
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 10/18] net/dpaa: fix invalid check on interrupt unregister
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable, Gagandeep Singh
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

From: Gagandeep Singh <g.singh@nxp.com>

rte_intr_callback_unregister() returns the number of callbacks
removed (>= 1) on success and a negative value on failure. The
previous check 'if (ret)' logged a spurious warning on every
successful unregister. Fix it to 'if (ret < 0)'.

Fixes: 2aa10990a8dd ("bus/dpaa: enable link state interrupt")
Cc: stable@dpdk.org

Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
---
 drivers/net/dpaa/dpaa_ethdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c
index 9a9c5ee817..c143e66f77 100644
--- a/drivers/net/dpaa/dpaa_ethdev.c
+++ b/drivers/net/dpaa/dpaa_ethdev.c
@@ -559,7 +559,7 @@ static int dpaa_eth_dev_close(struct rte_eth_dev *dev)
 		}
 		ret = rte_intr_callback_unregister(intr_handle,
 			dpaa_interrupt_handler, (void *)dev);
-		if (ret) {
+		if (ret < 0) {
 			DPAA_PMD_WARN("%s: unregister interrupt failed(%d)",
 				dev->data->name, ret);
 		}
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 09/18] net/dpaa: fix device remove
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable, Gagandeep Singh
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

From: Gagandeep Singh <g.singh@nxp.com>

Add a check to avoid closing a device that is already closed,
preventing a double-close condition during device removal.

Note: this also removes the explicit dpaa_finish() call that was
made at last-device remove time (!dpaa_valid_dev). dpaa_finish() is
registered as RTE_FINI_PRIO(dpaa_finish, 103) and will still run at
process exit, so for the normal run-then-exit path behaviour is
unchanged. For a remove-all-then-re-probe scenario, is_global_init
will remain set until exit; re-probe in a running process is not a
supported use case for this driver.

Fixes: 78ea4b4fcb52 ("bus/dpaa: improve cleanup")
Cc: stable@dpdk.org

Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
---
 drivers/net/dpaa/dpaa_ethdev.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c
index 424458857e..9a9c5ee817 100644
--- a/drivers/net/dpaa/dpaa_ethdev.c
+++ b/drivers/net/dpaa/dpaa_ethdev.c
@@ -2674,18 +2674,19 @@ static int
 rte_dpaa_remove(struct rte_dpaa_device *dpaa_dev)
 {
 	struct rte_eth_dev *eth_dev;
-	int ret;
+	int ret = 0;
 
 	PMD_INIT_FUNC_TRACE();
 
 	eth_dev = dpaa_dev->eth_dev;
-	dpaa_eth_dev_close(eth_dev);
-	ret = rte_eth_dev_release_port(eth_dev);
+	if (eth_dev->state !=  RTE_ETH_DEV_UNUSED) {
+		dpaa_eth_dev_close(eth_dev);
+		ret = rte_eth_dev_release_port(eth_dev);
+	}
 	dpaa_valid_dev--;
-	if (!dpaa_valid_dev) {
+	if (!dpaa_valid_dev)
 		rte_mempool_free(dpaa_tx_sg_pool);
-		dpaa_finish();
-	}
+
 	return ret;
 }
 
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 08/18] bus/dpaa: fix device probe issue
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable, Gagandeep Singh
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

From: Gagandeep Singh <g.singh@nxp.com>

Remove an unintended early return in the LS1043 SoC version check
that was preventing device probing from completing successfully on
LS1043A platforms.

The early return did two things: set max_push_rxq_num = 0 and skip
the DPAA_PUSH_QUEUES_NUMBER env-var override. With the return gone,
the env-var could inadvertently re-enable push mode on LS1043A, which
must remain disabled due to the FMAN push-mode errata handled in
dpaa_rxtx.c. Guard the env-var override so it only applies to
non-LS1043A SoCs.

Fixes: 164e9e13e50f ("bus/dpaa: enhance SoC version")
Cc: stable@dpdk.org

Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
---
 drivers/bus/dpaa/dpaa_bus.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/bus/dpaa/dpaa_bus.c b/drivers/bus/dpaa/dpaa_bus.c
index ee467b94d5..02a8c5882e 100644
--- a/drivers/bus/dpaa/dpaa_bus.c
+++ b/drivers/bus/dpaa/dpaa_bus.c
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: BSD-3-Clause
  *
- * Copyright 2017-2025 NXP
+ * Copyright 2017-2026 NXP
  *
  */
 /* System headers */
@@ -724,18 +724,17 @@ rte_dpaa_bus_scan(void)
 			dpaa_bus.svr_ver);
 	}
 
-	/* Disabling the default push mode for LS1043A */
+	/* Disabling the default push mode for LS1043A due to errata */
 	if (dpaa_bus.svr_ver == SVR_LS1043A_FAMILY) {
 		dpaa_bus.max_push_rxq_num = 0;
-		return 0;
+	} else {
+		penv = getenv("DPAA_PUSH_QUEUES_NUMBER");
+		if (penv)
+			dpaa_bus.max_push_rxq_num = atoi(penv);
+		if (dpaa_bus.max_push_rxq_num > DPAA_MAX_PUSH_MODE_QUEUE)
+			dpaa_bus.max_push_rxq_num = DPAA_MAX_PUSH_MODE_QUEUE;
 	}
 
-	penv = getenv("DPAA_PUSH_QUEUES_NUMBER");
-	if (penv)
-		dpaa_bus.max_push_rxq_num = atoi(penv);
-	if (dpaa_bus.max_push_rxq_num > DPAA_MAX_PUSH_MODE_QUEUE)
-		dpaa_bus.max_push_rxq_num = DPAA_MAX_PUSH_MODE_QUEUE;
-
 	/* Device list creation is only done once */
 	if (!process_once) {
 		rte_dpaa_bus_dev_build();
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 07/18] bus/dpaa: fix fd leak for ccsr mmap
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable, Jun Yang
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

The CCSR file descriptor was kept open after mmap() was done.
Close the fd immediately after mmap() as it is no longer needed,
preventing a file descriptor leak.

Fixes: 8e253882cd31 ("bus/dpaa: support interrupt portal based fd")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Signed-off-by: Jun Yang <jun.yang@nxp.com>
---
 drivers/bus/dpaa/base/qbman/bman_driver.c | 3 ++-
 drivers/bus/dpaa/base/qbman/qman_driver.c | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/bus/dpaa/base/qbman/bman_driver.c b/drivers/bus/dpaa/base/qbman/bman_driver.c
index 23e44ac10b..71a2028383 100644
--- a/drivers/bus/dpaa/base/qbman/bman_driver.c
+++ b/drivers/bus/dpaa/base/qbman/bman_driver.c
@@ -145,7 +145,7 @@ void bman_thread_irq(void)
 
 int bman_init_ccsr(const struct device_node *node)
 {
-	static int ccsr_map_fd;
+	int ccsr_map_fd;
 	uint64_t phys_addr;
 	const uint32_t *bman_addr;
 	uint64_t regs_size;
@@ -169,6 +169,7 @@ int bman_init_ccsr(const struct device_node *node)
 
 	bman_ccsr_map = mmap(NULL, regs_size, PROT_READ |
 			     PROT_WRITE, MAP_SHARED, ccsr_map_fd, phys_addr);
+	close(ccsr_map_fd);
 	if (bman_ccsr_map == MAP_FAILED) {
 		pr_err("Can not map BMan CCSR base Bman: "
 		       "0x%x Phys: 0x%" PRIx64 " size 0x%" PRIu64,
diff --git a/drivers/bus/dpaa/base/qbman/qman_driver.c b/drivers/bus/dpaa/base/qbman/qman_driver.c
index 3bab8b8337..45b094e0c6 100644
--- a/drivers/bus/dpaa/base/qbman/qman_driver.c
+++ b/drivers/bus/dpaa/base/qbman/qman_driver.c
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
  *
  * Copyright 2008-2016 Freescale Semiconductor Inc.
- * Copyright 2017-2022, 2025 NXP
+ * Copyright 2017-2022, 2025-2026 NXP
  *
  */
 
@@ -270,7 +270,7 @@ int qman_global_init(void)
 	const struct device_node *dt_node;
 	size_t lenp;
 	const u32 *chanid;
-	static int ccsr_map_fd;
+	int ccsr_map_fd;
 	const uint32_t *qman_addr;
 	uint64_t phys_addr;
 	uint64_t regs_size;
@@ -358,9 +358,9 @@ int qman_global_init(void)
 		pr_err("Can not open /dev/mem for qman ccsr map\n");
 		return ccsr_map_fd;
 	}
-
 	qman_ccsr_map = mmap(NULL, regs_size, PROT_READ | PROT_WRITE,
 			     MAP_SHARED, ccsr_map_fd, phys_addr);
+	close(ccsr_map_fd);
 	if (qman_ccsr_map == MAP_FAILED) {
 		pr_err("Can not map qman ccsr base\n");
 		return -EINVAL;
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 06/18] bus/dpaa: fix BMI RX stats register offset
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable, Jun Yang
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

From: Jun Yang <jun.yang@nxp.com>

Fix incorrect register offset for BMI RX statistics counters
in the fman.h header. The wrong offset caused incorrect stats
values to be reported.

Fixes: 0095306cdbda ("bus/dpaa: add FMan node")
Cc: stable@dpdk.org

Signed-off-by: Jun Yang <jun.yang@nxp.com>
---
 drivers/bus/dpaa/include/fman.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/bus/dpaa/include/fman.h b/drivers/bus/dpaa/include/fman.h
index c33fe81516..6e3abf1b50 100644
--- a/drivers/bus/dpaa/include/fman.h
+++ b/drivers/bus/dpaa/include/fman.h
@@ -2,7 +2,7 @@
  *
  * Copyright 2010-2012 Freescale Semiconductor, Inc.
  * All rights reserved.
- * Copyright 2019-2024 NXP
+ * Copyright 2019-2026 NXP
  *
  */
 
@@ -263,8 +263,8 @@ struct rx_bmi_regs {
 					/**< Buffer Manager pool Information-*/
 	uint32_t fmbm_acnt[FMAN_PORT_MAX_EXT_POOLS_NUM];
 					/**< Allocate Counter-*/
-	uint32_t reserved0120[16];
-					/**< 0x130/0x140 - 0x15F reserved -*/
+	uint32_t reserved0140[8];
+					/**< 0x140 - 0x15F reserved -*/
 	uint32_t fmbm_rcgm[FMAN_PORT_CG_MAP_NUM];
 					/**< Congestion Group Map*/
 	uint32_t fmbm_mpd;		/**< BM Pool Depletion  */
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 05/18] net/dpaa/fmlib: add null check in scheme delete
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable, Prashant Gupta
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

From: Prashant Gupta <prashant.gupta_3@nxp.com>

Add a null pointer check before dereferencing the scheme handle
in fm_pcd_kg_scheme_delete() to prevent potential null pointer
dereference. This matches the defensive pattern used in sibling
functions in fm_lib.c.

Fixes: 663ff698e38f ("net/dpaa: support VSP in fmlib")
Cc: stable@dpdk.org

Signed-off-by: Prashant Gupta <prashant.gupta_3@nxp.com>
---
 drivers/net/dpaa/fmlib/fm_lib.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/dpaa/fmlib/fm_lib.c b/drivers/net/dpaa/fmlib/fm_lib.c
index b35feba004..65a818372e 100644
--- a/drivers/net/dpaa/fmlib/fm_lib.c
+++ b/drivers/net/dpaa/fmlib/fm_lib.c
@@ -305,6 +305,9 @@ fm_pcd_kg_scheme_delete(t_handle h_scheme)
 
 	_fml_dbg("Calling...");
 
+	if (p_dev == NULL)
+		return E_NO_DEVICE;
+
 	p_pcd_dev =  (t_device *)p_dev->h_user_priv;
 	id.obj = UINT_TO_PTR(p_dev->id);
 
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 04/18] net/dpaa: fix modify cgr to use index
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

In dpaa_modify_cgr(), the code was always using the pointer to
the first CGR element instead of indexing by the queue index.
Fix it to use the correct CGR entry by index.

Fixes: 62f53995caaf ("net/dpaa: add frame count based tail drop with CGR")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/net/dpaa/dpaa_ethdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c
index 9f976d179b..424458857e 100644
--- a/drivers/net/dpaa/dpaa_ethdev.c
+++ b/drivers/net/dpaa/dpaa_ethdev.c
@@ -1304,7 +1304,7 @@ int dpaa_eth_rx_queue_setup(struct rte_eth_dev *dev, uint16_t queue_idx,
 		rxq->nb_desc = nb_desc;
 		/* Enable tail drop with cgr on this queue */
 		qm_cgr_cs_thres_set64(&cgr_opts.cgr.cs_thres, nb_desc, 0);
-		ret = qman_modify_cgr(dpaa_intf->cgr_rx, 0, &cgr_opts);
+		ret = qman_modify_cgr(&dpaa_intf->cgr_rx[queue_idx], 0, &cgr_opts);
 		if (ret) {
 			DPAA_PMD_WARN(
 				"rx taildrop modify fail on fqid %d (ret=%d)",
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 03/18] bus/dpaa: fix error handling in qman_query
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

Optimize error handling in qman_query() to avoid redundant
checks and properly propagate error codes.

Fixes: 06268e2cb175 ("bus/dpaa: query queue frame count support")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/bus/dpaa/base/qbman/qman.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/bus/dpaa/base/qbman/qman.c b/drivers/bus/dpaa/base/qbman/qman.c
index 2da1b3e3f7..d289df2d33 100644
--- a/drivers/bus/dpaa/base/qbman/qman.c
+++ b/drivers/bus/dpaa/base/qbman/qman.c
@@ -1955,11 +1955,11 @@ int qman_query_fq(struct qman_fq *fq, struct qm_fqd *fqd)
 		cpu_relax();
 	DPAA_ASSERT((mcr->verb & QM_MCR_VERB_MASK) == QM_MCR_VERB_QUERYFQ);
 	res = mcr->result;
-	if (res == QM_MCR_RESULT_OK)
-		*fqd = mcr->queryfq.fqd;
-	hw_fqd_to_cpu(fqd);
 	if (res != QM_MCR_RESULT_OK)
 		return -EIO;
+
+	*fqd = mcr->queryfq.fqd;
+	hw_fqd_to_cpu(fqd);
 	return 0;
 }
 
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 02/18] bus/dpaa: fix fqid endianness
From: Hemant Agrawal @ 2026-06-19  6:09 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

In qman_fq_flow_control(), the fqid field in the management
command was set using the host-endian fqid instead of the
pre-converted big-endian fqid_be. Fix it to use fqid_be
consistent with all other enqueue paths.

Fixes: c47ff048b99a ("bus/dpaa: add QMAN driver core routines")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/bus/dpaa/base/qbman/qman.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bus/dpaa/base/qbman/qman.c b/drivers/bus/dpaa/base/qbman/qman.c
index 9a99eb9785..2da1b3e3f7 100644
--- a/drivers/bus/dpaa/base/qbman/qman.c
+++ b/drivers/bus/dpaa/base/qbman/qman.c
@@ -1921,7 +1921,7 @@ int qman_fq_flow_control(struct qman_fq *fq, int xon)
 		goto out;
 	}
 	mcc = qm_mc_start(&p->p);
-	mcc->alterfq.fqid = fq->fqid;
+	mcc->alterfq.fqid = fq->fqid_be;
 	mcc->alterfq.count = 0;
 	myverb = xon ? QM_MCC_VERB_ALTER_FQXON : QM_MCC_VERB_ALTER_FQXOFF;
 
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 01/18] bus/dpaa: fix error handling of qman_create_fq
From: Hemant Agrawal @ 2026-06-19  6:08 UTC (permalink / raw)
  To: stephen, david.marchand, dev; +Cc: stable
In-Reply-To: <20260619060916.485258-1-hemant.agrawal@nxp.com>

Fix the error handling path in qman_create_fq() to properly
return error codes instead of silently ignoring failures.

Fixes: c47ff048b99a ("bus/dpaa: add QMAN driver core routines")
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
 drivers/bus/dpaa/base/qbman/qman.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/bus/dpaa/base/qbman/qman.c b/drivers/bus/dpaa/base/qbman/qman.c
index 5534e1846c..9a99eb9785 100644
--- a/drivers/bus/dpaa/base/qbman/qman.c
+++ b/drivers/bus/dpaa/base/qbman/qman.c
@@ -1579,6 +1579,9 @@ int qman_create_fq(u32 fqid, u32 flags, struct qman_fq *fq)
 err:
 	if (flags & QMAN_FQ_FLAG_DYNAMIC_FQID)
 		qman_release_fqid(fqid);
+#ifdef CONFIG_FSL_QMAN_FQ_LOOKUP
+	clear_fq_table_entry(fq->key);
+#endif
 	return -EIO;
 }
 
-- 
2.43.0


^ permalink raw reply related

* [PATCH v2 00/18] net/dpaa: bug fixes for bus, net and fmlib drivers
From: Hemant Agrawal @ 2026-06-19  6:08 UTC (permalink / raw)
  To: stephen, david.marchand, dev
In-Reply-To: <20260618141151.3990283-1-hemant.agrawal@nxp.com>

This series contains bug fixes for the DPAA PMD (bus/dpaa, net/dpaa,
net/dpaa/fmlib and dma/dpaa):

v2 changes:
- P05: Fix commit message API name (fm_pcd_kg_scheme_delete not FM_PCD_MatchTableSchemeDelete)
- P08: Guard DPAA_PUSH_QUEUES_NUMBER env-var override for LS1043A to prevent
  inadvertent re-enabling of push mode (errata)
- P09: Document dpaa_finish() call removal in commit message
- P10: Fix wrong Fixes: tag (was log macro commit, now correct interrupt commit)
- P11: Split into two patches with correct per-driver Fixes: tags
- P13: Also fix rx_buf_diallocate -> rx_buf_deallocate typo

All patches are bug fixes tagged with Fixes: and Cc: stable@dpdk.org.

Gagandeep Singh (3):
  bus/dpaa: fix device probe issue
  net/dpaa: fix device remove
  net/dpaa: fix invalid check on interrupt unregister

Hemant Agrawal (11):
  bus/dpaa: fix error handling of qman_create_fq
  bus/dpaa: fix fqid endianness
  bus/dpaa: fix error handling in qman_query
  net/dpaa: fix modify cgr to use index
  bus/dpaa: fix fd leak for ccsr mmap
  net/dpaa: fix xstat name for tx undersized counter
  net/dpaa: fix xstat string typos in BMI stats table
  net/dpaa: remove duplicate ptype entries
  net/dpaa: fix wrong buffer in xstats get by id
  net/dpaa: fix null l3_len check in checksum offload
  net/dpaa: fix mbuf leak in SG fd creation

Jun Yang (1):
  bus/dpaa: fix BMI RX stats register offset

Prashant Gupta (1):
  net/dpaa/fmlib: add null check in scheme delete

Vanshika Shukla (2):
  net/dpaa: fix port_handle leak in fm_prev_cleanup
  dma/dpaa: fix out-of-bounds access in SG descriptor enqueue

 drivers/bus/dpaa/base/qbman/bman_driver.c |  3 ++-
 drivers/bus/dpaa/base/qbman/qman.c        | 11 +++++----
 drivers/bus/dpaa/base/qbman/qman_driver.c |  6 ++---
 drivers/bus/dpaa/dpaa_bus.c               | 17 +++++++------
 drivers/bus/dpaa/include/fman.h           |  6 ++---
 drivers/dma/dpaa/dpaa_qdma.c              |  7 +++++-
 drivers/net/dpaa/dpaa_ethdev.c            | 29 +++++++++++------------
 drivers/net/dpaa/dpaa_flow.c              |  4 ++++
 drivers/net/dpaa/dpaa_rxtx.c              |  3 +++
 drivers/net/dpaa/fmlib/fm_lib.c           |  3 +++
 10 files changed, 53 insertions(+), 36 deletions(-)

-- 
2.43.0


^ permalink raw reply


This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox