RE: [PATCH v2] IB/mlx4: delete allocated id_map_entry while sending REJ

[Praveen Kannoju]

Oracle Confidential

Gentle reminder for reviewing the updated patch.

-
Praveen.


Oracle Confidential
+AD4- -----Original Message-----
+AD4- From: Praveen Kannoju +ADw-praveen.kannoju+AEA-oracle.com+AD4-
+AD4- Sent: Monday, June 15, 2026 10:52 PM
+AD4- To: Praveen Kannoju +ADw-praveen.kannoju+AEA-oracle.com+AD4AOw- yishaih+AEA-nvidia.com+ADs-
+AD4- jgg+AEA-ziepe.ca+ADs- leon+AEA-kernel.org+ADs- linux-rdma+AEA-vger.kernel.org+ADs- linux-
+AD4- kernel+AEA-vger.kernel.org
+AD4- Cc: Manjunath Patil +ADw-manjunath.b.patil+AEA-oracle.com+AD4AOw- Anand Khoje
+AD4- +ADw-anand.a.khoje+AEA-oracle.com+AD4-
+AD4- Subject: RE: +AFs-PATCH v2+AF0- IB/mlx4: delete allocated id+AF8-map+AF8-entry while sending
+AD4- REJ
+AD4-
+AD4- Confidential - Oracle Restricted +AFw-Including External Recipients
+AD4-
+AD4- Hi Leon,
+AD4-
+AD4- You had earlier asked for the kmemleak output for v1 of this patch.
+AD4-
+AD4- This is not expected to show up in kmemleak output. The leaked
+AD4- +AGA-id+AF8-map+AF8-entry+AGA- is not orphaned from the kernel object graph: after allocation,
+AD4- it remains linked from +AGA-sriov-+AD4-cm+AF8-list+AGA- and is also indexed by the driver+IBk-s id-
+AD4- map data structures. Kmemleak reports allocations that become unreachable
+AD4- from scanned roots. As long as the driver retains a reference to an
+AD4- +AGA-id+AF8-map+AF8-entry+AGA- in those live containers, kmemleak will treat the object as
+AD4- reachable, even if the CM protocol lifetime indicates that the entry should
+AD4- have been deleted when REJ was sent.
+AD4-
+AD4- -
+AD4- Praveen.
+AD4-
+AD4-
+AD4-
+AD4- Confidential - Oracle Restricted +AFw-Including External Recipients
+AD4- +AD4- -----Original Message-----
+AD4- +AD4- From: Praveen Kumar Kannoju +ADw-praveen.kannoju+AEA-oracle.com+AD4-
+AD4- +AD4- Sent: Monday, June 15, 2026 10:48 PM
+AD4- +AD4- To: yishaih+AEA-nvidia.com+ADs- jgg+AEA-ziepe.ca+ADs- leon+AEA-kernel.org+ADs- linux-
+AD4- +AD4- rdma+AEA-vger.kernel.org+ADs- linux-kernel+AEA-vger.kernel.org
+AD4- +AD4- Cc: Manjunath Patil +ADw-manjunath.b.patil+AEA-oracle.com+AD4AOw- Anand Khoje
+AD4- +AD4- +ADw-anand.a.khoje+AEA-oracle.com+AD4AOw- Praveen Kannoju
+AD4- +AD4- +ADw-praveen.kannoju+AEA-oracle.com+AD4-
+AD4- +AD4- Subject: +AFs-PATCH v2+AF0- IB/mlx4: delete allocated id+AF8-map+AF8-entry while
+AD4- +AD4- sending REJ
+AD4- +AD4-
+AD4- +AD4- The mlx4 CM paravirtualization layer rewrites a VF's local
+AD4- +AD4- communication ID to a PF-visible ID when CM MADs are sent from the VF.
+AD4- +AD4- For messages that start or advance a connection from the VF side, such
+AD4- +AD4- as REQ, REP, MRA and SIDR+AF8-REQ, mlx4+AF8-ib+AF8-multiplex+AF8-cm+AF8-handler()
+AD4- +AD4- allocates an id+AF8-map+AF8-entry when no existing mapping is found.
+AD4- +AD4-
+AD4- +AD4- A REJ is different because it is a terminal response to an already
+AD4- +AD4- known exchange. It should either find an existing id+AF8-map+AF8-entry,
+AD4- +AD4- rewrite the local communication ID, and schedule that entry for
+AD4- +AD4- deletion, or it should pass through unchanged when no mapping exists.
+AD4- +AD4-
+AD4- +AD4- Some REJ messages, such as rejects for an inbound REQ before an MRA or
+AD4- +AD4- REP was sent, do not have an id+AF8-map+AF8-entry because their local+AF8-comm+AF8-id is
+AD4- zero.
+AD4- +AD4- Timeout REJ messages are handled in the initial lookup branch, but a
+AD4- +AD4- lookup miss there must not fall through to id+AF8-map+AF8-alloc()+ADs- such a miss
+AD4- +AD4- means there is no existing mapping to translate or delete for the REJ.
+AD4- +AD4-
+AD4- +AD4- Commit 227a0e142e37 (+ACI-IB/mlx4: Add support for REJ due to timeout+ACI-)
+AD4- +AD4- added the timeout REJ case to the initial branch so an outgoing
+AD4- +AD4- timeout REJ could reuse the id+AF8-map+AF8-entry that was created when the
+AD4- +AD4- VF's REQ was multiplexed. Reusing that entry is the useful part: it
+AD4- +AD4- rewrites the timeout REJ local+AF8-comm+AF8-id to the same PF-visible ID that
+AD4- +AD4- was sent in the REQ. If the lookup misses, allocating a new
+AD4- +AD4- id+AF8-map+AF8-entry does not help because the peer has never seen that new PF-
+AD4- visible ID, and REJ is not starting a new exchange.
+AD4- +AD4-
+AD4- +AD4- Keep timeout REJ handling in the initial lookup branch, but return
+AD4- +AD4- before allocation if no mapping is found. Handle the other REJ cases
+AD4- +AD4- with the same lookup-only behavior. When a mapping is found, translate
+AD4- +AD4- the local communication ID and schedule delayed deletion, as is
+AD4- +AD4- already done for DREQ and for received REJ in the demux path. When no
+AD4- +AD4- mapping is found, keep the existing pass-through behavior.
+AD4- +AD4-
+AD4- +AD4- Signed-off-by: Praveen Kumar Kannoju +ADw-praveen.kannoju+AEA-oracle.com+AD4-
+AD4- +AD4- ---
+AD4- +AD4-  drivers/infiniband/hw/mlx4/cm.c +AHw- 13 +-+-+-+-+-+-+-+-+-+----
+AD4- +AD4-  1 file changed, 10 insertions(+-), 3 deletions(-)
+AD4- +AD4-
+AD4- +AD4- diff --git a/drivers/infiniband/hw/mlx4/cm.c
+AD4- +AD4- b/drivers/infiniband/hw/mlx4/cm.c index 63a868a3822f..202fd5365e35
+AD4- +AD4- 100644
+AD4- +AD4- --- a/drivers/infiniband/hw/mlx4/cm.c
+AD4- +AD4- +-+-+- b/drivers/infiniband/hw/mlx4/cm.c
+AD4- +AD4- +AEAAQA- -315,14 +-315,20 +AEAAQA- int mlx4+AF8-ib+AF8-multiplex+AF8-cm+AF8-handler(struct
+AD4- +AD4- ib+AF8-device +ACo-ibdev, int port, int slave+AF8-id
+AD4- +AD4-               id +AD0- id+AF8-map+AF8-get(ibdev, +ACY-pv+AF8-cm+AF8-id, slave+AF8-id, sl+AF8-cm+AF8-id)+ADs-
+AD4- +AD4-               if (id)
+AD4- +AD4-                       goto cont+ADs-
+AD4- +AD4- +-             if (mad-+AD4-mad+AF8-hdr.attr+AF8-id +AD0APQ- CM+AF8-REJ+AF8-ATTR+AF8-ID)
+AD4- +AD4- +-                     return 0+ADs-
+AD4- +AD4-               id +AD0- id+AF8-map+AF8-alloc(ibdev, slave+AF8-id, sl+AF8-cm+AF8-id)+ADs-
+AD4- +AD4-               if (IS+AF8-ERR(id)) +AHs-
+AD4- +AD4-                       mlx4+AF8-ib+AF8-warn(ibdev, +ACIAJQ-s: id+AHs-slave: +ACU-d, sl+AF8-cm+AF8-id:
+AD4- +AD4- 0x+ACU-x+AH0- Failed to id+AF8-map+AF8-alloc+AFw-n+ACI-,
+AD4- +AD4-                               +AF8AXw-func+AF8AXw-, slave+AF8-id, sl+AF8-cm+AF8-id)+ADs-
+AD4- +AD4-                       return PTR+AF8-ERR(id)+ADs-
+AD4- +AD4-               +AH0-
+AD4- +AD4- -     +AH0- else if (mad-+AD4-mad+AF8-hdr.attr+AF8-id +AD0APQ- CM+AF8-REJ+AF8-ATTR+AF8-ID +AHwAfA-
+AD4- +AD4- -                mad-+AD4-mad+AF8-hdr.attr+AF8-id +AD0APQ- CM+AF8-SIDR+AF8-REP+AF8-ATTR+AF8-ID) +AHs-
+AD4- +AD4- +-     +AH0- else if (mad-+AD4-mad+AF8-hdr.attr+AF8-id +AD0APQ- CM+AF8-REJ+AF8-ATTR+AF8-ID) +AHs-
+AD4- +AD4- +-             sl+AF8-cm+AF8-id +AD0- get+AF8-local+AF8-comm+AF8-id(mad)+ADs-
+AD4- +AD4- +-             id +AD0- id+AF8-map+AF8-get(ibdev, +ACY-pv+AF8-cm+AF8-id, slave+AF8-id, sl+AF8-cm+AF8-id)+ADs-
+AD4- +AD4- +-             if (+ACE-id)
+AD4- +AD4- +-                     return 0+ADs-
+AD4- +AD4- +-     +AH0- else if (mad-+AD4-mad+AF8-hdr.attr+AF8-id +AD0APQ- CM+AF8-SIDR+AF8-REP+AF8-ATTR+AF8-ID) +AHs-
+AD4- +AD4-               return 0+ADs-
+AD4- +AD4-       +AH0- else +AHs-
+AD4- +AD4-               sl+AF8-cm+AF8-id +AD0- get+AF8-local+AF8-comm+AF8-id(mad)+ADs- +AEAAQA- -338,7 +-342,8 +AEAAQA-
+AD4- +AD4- int mlx4+AF8-ib+AF8-multiplex+AF8-cm+AF8-handler(struct ib+AF8-device +ACo-ibdev, int port,
+AD4- +AD4- int slave+AF8-id
+AD4- +AD4-  cont:
+AD4- +AD4-       set+AF8-local+AF8-comm+AF8-id(mad, id-+AD4-pv+AF8-cm+AF8-id)+ADs-
+AD4- +AD4-
+AD4- +AD4- -     if (mad-+AD4-mad+AF8-hdr.attr+AF8-id +AD0APQ- CM+AF8-DREQ+AF8-ATTR+AF8-ID)
+AD4- +AD4- +-     if (mad-+AD4-mad+AF8-hdr.attr+AF8-id +AD0APQ- CM+AF8-DREQ+AF8-ATTR+AF8-ID +AHwAfA-
+AD4- +AD4- +-         mad-+AD4-mad+AF8-hdr.attr+AF8-id +AD0APQ- CM+AF8-REJ+AF8-ATTR+AF8-ID)
+AD4- +AD4-               schedule+AF8-delayed(ibdev, id)+ADs-
+AD4- +AD4-       return 0+ADs-
+AD4- +AD4-  +AH0-
+AD4- +AD4- --
+AD4- +AD4- 2.43.7