[PATCH AUTOSEL 6.18-5.15] dpaa2-switch: fix handling of NAPI on the remove path

for (i = 0; i < ethsw->sw_attr.num_ifs; i++) {
    unregister_netdev(port_priv->netdev);
    dpaa2_switch_remove_port(ethsw, i);  // calls free_netdev()
}

for (i = 0; i < ethsw->sw_attr.num_ifs; i++)
    unregister_netdev(ethsw->ports[i]->netdev);

for (i = 0; i < DPAA2_SWITCH_RX_NUM_FQS; i++)
    netif_napi_del(&ethsw->fq[i].napi);

for (i = 0; i < ethsw->sw_attr.num_ifs; i++)
    dpaa2_switch_remove_port(ethsw, i);

  4. With `num_ifs > 1` and ports up, unregistering/freeing port 0 first
     deletes NAPI while `napi_users > 0` and NAPI still enabled.
- **Record:** Confirmed WARN/crash path on multi-port switch removal.

### Step 2.4: Fix quality
- **Record:** Fix is minimal, mirrors standard netdev teardown ordering,
  and matches the probe-side explicit `netif_napi_add()`. Low regression
  risk; no API or locking changes.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
- Remove loop structure: `44baaa43d7cc` (2018-03-14, original staging
  ethsw driver).
- `dpaa2_switch_remove_port()` split: `860fe1f87eca` (2021-08-19).
- Shared NAPI design: `0b1b713704588` (2021-03-10, Ioana Ciornei).
- **Record:** Bug latent since shared NAPI was introduced in 2021;
  remove path never updated for shared-NAPI lifecycle.

### Step 3.2: Fixes: tag
- **Record:** Not applicable — no `Fixes:` tag present.

### Step 3.3: Related file history
- Recent dpaa2-switch fixes in this tree include IRQ validation,
  refcount leaks, buffer pool seeding — all independent.
- Patch is **5/5** of series “dpaa2-switch: various improvements”
  (patches 1–4 cover FDB, RX error path, VLAN). Patch 5 only touches
  `dpaa2_switch_remove()` and is **standalone**.
- **Record:** No prerequisite commits required for this fix.

### Step 3.4: Author context
- Ioana Ciornei is the original author of shared NAPI management and an
  active dpaa2-switch contributor.
- **Record:** Author has deep subsystem knowledge; fix is credible.

### Step 3.5: Dependencies
- Uses `DPAA2_SWITCH_RX_NUM_FQS` (defined as 2 in `dpaa2-switch.h`),
  `netif_napi_del()`, and existing `dpaa2_switch_remove_port()` — all
  present in this tree.
- **Record:** Applies standalone; no structural dependencies on unmerged
  series patches 1–4.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original discussion
- **Series:** `[PATCH net-next 0/5] dpaa2-switch: various improvements`
  (Ioana Ciornei, 2026-05-28).
- **Patch:** `[PATCH net-next 5/5] dpaa2-switch: fix handling of NAPI on
  the remove path`
- **URLs:** lkml.iu.edu/2605.3/08494.html, patchew.org series page.
- Cover letter notes these are long-standing bugs found during LAG
  support review.
- **Record:** Patch 5 is independently committable; no NAKs found in
  available sources.

### Step 4.2: Reviewers
- **To:** netdev maintainers (Andrew Lunn, David Miller, Jakub Kicinski,
  Paolo Abeni, etc.)
- Merged by Jakub Kicinski.
- **Record:** Standard netdev review path; maintainer merge confirmed.

### Step 4.3: Bug report
- No syzbot or user crash report; bug found during code review.
- **Record:** Review-discovered but mechanism is verifiable in code.

### Step 4.4: Series context
- Patches 1–4: FDB management, RX error path, VLAN dedup, VLAN flag
  changes — unrelated to NAPI teardown.
- **Record:** Patch 5 can be backported alone.

### Step 4.5: Stable list history
- No stable-list discussion found for this specific fix.
- **Record:** Not previously nominated for stable (expected).

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
- `dpaa2_switch_remove()` — modified
- `dpaa2_switch_remove_port()` — called after fix (unchanged)
- `dpaa2_switch_disable_ctrl_if_napi()` — called via `ndo_stop` during
  unregister
- `netdev_napi_exit()` / `__netif_napi_del_locked()` — core NAPI
  deletion

### Step 5.2: Callers
- `dpaa2_switch_remove()` is the `.remove` callback for the DPAA2 switch
  MC device driver (line 3529).
- **Record:** Triggered on device unbind, module unload, or hot-unplug
  of DPSW object.

### Step 5.3: Callees
- `unregister_netdev()` → `ndo_stop` → `dpaa2_switch_port_stop()` →
  `dpaa2_switch_disable_ctrl_if_napi()`
- `netif_napi_del()` → `__netif_napi_del_locked()`
- `dpaa2_switch_remove_port()` → `free_netdev()` → `netdev_napi_exit()`
- **Record:** Fix ensures correct ordering across these teardown
  primitives.

### Step 5.4: Reachability
- **Trigger:** Removal of a DPAA2 switch with 2+ ports where at least
  one port was brought up (NAPI enabled).
- **Record:** Reachable on normal driver unload / device removal on NXP
  DPAA2 platforms (LS1088, LX2160, etc.); not userspace-syscall
  reachable, but real admin/PM path.

### Step 5.5: Similar patterns
- Probe error path (`err_unregister_ports` then `err_free_netdev`)
  already separates unregister from free — remove path was the outlier.
- **Record:** Fix aligns remove path with the safer pattern already used
  on probe error.

---

## PHASE 6: CROSS-REFERENCE AGAINST LOCAL TREE

### Step 6.1: Buggy code present?
- **Record:** YES. Current `dpaa2_switch_remove()` at lines 3304–3308
  still interleaves `unregister_netdev()` and
  `dpaa2_switch_remove_port()` in one loop. Shared NAPI code present
  since `0b1b713704588` (ancestor of HEAD).

### Step 6.2: Backport complications
- Diff applies cleanly against current file; line numbers match commit
  base (`505ccaa93ee41`).
- **Record:** Clean apply expected; no rework needed.

### Step 6.3: Related fixes already present?
- No existing fix for this NAPI teardown issue in tree.
- **Record:** Fix not yet applied; still needed.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: Subsystem
- **Subsystem:** `drivers/net/ethernet/freescale/dpaa2/` — DPAA2
  Ethernet switch driver (`CONFIG_FSL_DPAA2_SWITCH`)
- **Criticality:** IMPORTANT (platform-specific networking driver, not
  core kernel)

### Step 7.2: Activity
- dpaa2-switch actively maintained with multiple recent stable-worthy
  fixes (IRQ bounds, refcount leaks, buffer pool).
- **Record:** Mature driver with ongoing maintenance.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who is affected
- Users of NXP Layerscape SoCs with DPAA2 switch
  (`FSL_DPAA2_SWITCH=y/m`).
- **Record:** Platform-specific but affects all multi-port switch
  teardown on those systems.

### Step 8.2: Trigger conditions
- Switch device removal/unbind with `num_ifs >= 2` and ports that were
  opened (NAPI enabled).
- **Record:** Common on module unload or firmware/MC object teardown;
  not exotic.

### Step 8.3: Failure severity
- `WARN_ON` in `__netif_napi_del_locked()` when deleting enabled NAPI.
- Potential use-after-free or crash if NAPI poll runs against freed
  structures.
- **Record:** Severity **HIGH** (kernel WARN/oops on driver removal);
  not data corruption, but can leave system in bad state during
  teardown.

### Step 8.4: Risk-benefit
- **Benefit:** HIGH for affected DPAA2 switch users — prevents broken
  teardown.
- **Risk:** VERY LOW — 15-line reordering in one function, no new APIs.
- **Record:** Strong benefit/risk ratio.

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence summary

**FOR backport:**
- Fixes a real, verifiable bug in driver removal path
- Bug present since 2021 shared-NAPI design; affects this 6.18.y tree
- Small, surgical, obviously correct fix
- Maintainer-merged; standalone (no series dependencies)
- Prevents WARN/oops on multi-port switch teardown
- Aligns remove path with safer probe-error pattern

**AGAINST backport:**
- Platform-specific driver (limited user base vs. core subsystems)
- No syzbot report or user crash report (review-discovered)
- Only triggers on device removal, not steady-state operation

**Unresolved:** None that affect the decision.

### Step 9.2: Stable rules checklist
1. Obviously correct and tested? **PASS** — logic verified against NAPI
   refcount design; maintainer merged.
2. Fixes a real bug? **PASS** — multi-port remove path deletes enabled
   shared NAPI.
3. Important issue? **PASS** — WARN/oops on driver removal (HIGH
   severity for teardown).
4. Small and contained? **PASS** — one function, +10/−5 lines.
5. No new features or APIs? **PASS** — teardown ordering fix only.
6. Can apply to local tree? **PASS** — buggy code present; clean apply
   expected.

### Step 9.3: Exception categories
- **Record:** None (not a quirk/ID/DT/build/doc fix) — standard bug fix.

### Step 9.4: Decision rationale
This commit fixes a long-standing teardown bug in the DPAA2 switch
driver where shared NAPI instances attached to port 0 are deleted via
`free_netdev()` before all ports are brought down. The fix is minimal,
self-contained, applies cleanly to the 6.18.44 tree, and prevents kernel
warnings/crashes during driver removal on multi-port switches — a path
that stable enterprise/embedded users hit during upgrades, module
reloads, and device hot-unplug.

---

## Verification

- **[Phase 1]** `git describe HEAD` → `v6.18.44`; parsed subject, tags,
  body from provided commit message
- **[Phase 2]** Read `dpaa2_switch_remove()` (lines 3290–3321),
  `dpaa2_switch_remove_port()` (3006–3014), NAPI enable/disable
  (649–681), probe NAPI add (3460–3462)
- **[Phase 2]** Read `free_netdev()` / `netdev_napi_exit()` /
  `__netif_napi_del_locked()` in `net/core/dev.c` (12066–12116,
  7601–7628)
- **[Phase 3]** `git blame` on remove loop (lines 3304–3308) → original
  2018 code; `860fe1f87eca` added `remove_port`; `0b1b713704588`
  introduced shared NAPI
- **[Phase 3]** `git merge-base --is-ancestor 0b1b713704588 HEAD` →
  shared NAPI commit is in tree
- **[Phase 3]** `git log --oneline -20 --
  drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c` → no duplicate
  NAPI fix present
- **[Phase 4]** Web search + lkml.iu.edu/2605.3/08494.html → confirmed
  patch 5/5 of “various improvements” series; standalone
- **[Phase 4]** Patchew/Ratatoskr → series patches 1–4 are FDB/VLAN/RX
  fixes, independent of patch 5
- **[Phase 4]** lore.kernel.org fetch blocked (Anubis); used lkml.iu.edu
  mirror instead
- **[Phase 5]** Confirmed `.remove` callback at line 3529; traced
  `ndo_stop` → `dpaa2_switch_disable_ctrl_if_napi()`
- **[Phase 6]** Buggy interleaved loop confirmed at lines 3304–3308 in
  local tree
- **[Phase 6]** `DPAA2_SWITCH_RX_NUM_FQS` = 2 in `dpaa2-switch.h`;
  `netif_napi_del` available in `include/linux/netdevice.h`
- **[Phase 6]** No `netif_napi_del` in current file — fix adds needed
  explicit deletion
- **[Phase 7]** `CONFIG_FSL_DPAA2_SWITCH` in
  `drivers/net/ethernet/freescale/dpaa2/Kconfig`
- **[Phase 8]** Failure mode: `WARN_ON` in `__netif_napi_del_locked`
  when NAPI still enabled; severity HIGH for teardown

**YES**

 .../net/ethernet/freescale/dpaa2/dpaa2-switch.c   | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
index c65ecb187af3d..ff187e2202966 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
@@ -3307,7 +3307,6 @@ static void dpaa2_switch_teardown(struct fsl_mc_device *sw_dev)
 
 static void dpaa2_switch_remove(struct fsl_mc_device *sw_dev)
 {
-	struct ethsw_port_priv *port_priv;
 	struct ethsw_core *ethsw;
 	struct device *dev;
 	int i;
@@ -3319,11 +3318,17 @@ static void dpaa2_switch_remove(struct fsl_mc_device *sw_dev)
 
 	dpsw_disable(ethsw->mc_io, 0, ethsw->dpsw_handle);
 
-	for (i = 0; i < ethsw->sw_attr.num_ifs; i++) {
-		port_priv = ethsw->ports[i];
-		unregister_netdev(port_priv->netdev);
+	/* Unregister all the netdevs so that they are brought down and the
+	 * shared NAPI instances gets disabled.
+	 */
+	for (i = 0; i < ethsw->sw_attr.num_ifs; i++)
+		unregister_netdev(ethsw->ports[i]->netdev);
+
+	for (i = 0; i < DPAA2_SWITCH_RX_NUM_FQS; i++)
+		netif_napi_del(&ethsw->fq[i].napi);
+
+	for (i = 0; i < ethsw->sw_attr.num_ifs; i++)
 		dpaa2_switch_remove_port(ethsw, i);
-	}
 
 	kfree(ethsw->fdbs);
 	kfree(ethsw->filter_blocks);
-- 
2.53.0