[ofa-general] [PATCHv3 for-2.6.21] IB/mthca: fix race in QP destroy

[Michael S. Tsirkin]

In QP destroy, reset QP before removing it from QP table:
otherwise we get bogus QP/unknown QP warnings
(and theoretically, crash, if the same slot is reused with the same QPN).

This fixes openfabrics bugzilla 394.

Signed-off-by: Michael S. Tsirkin <mst at mellanox.co.il>

---

> I'm not quite sure I understand why we have to synchronize against the
> completion EQ's interrupt here.

Hmm, I'm not sure myself, now.
I'm still thinking about this - the patch below is clearly correct
and seems sufficient to fix the issue pointed out by bugzilla.
So let's get it merged and I'll try to think about and address
other isses (if any) in a separate patch.

Please queue for 2.6.21.

Index: linux-2.6/drivers/infiniband/hw/mthca/mthca_qp.c
===================================================================
--- linux-2.6.orig/drivers/infiniband/hw/mthca/mthca_qp.c
+++ linux-2.6/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1393,6 +1393,10 @@ void mthca_free_qp(struct mthca_dev *dev
 	send_cq = to_mcq(qp->ibqp.send_cq);
 	recv_cq = to_mcq(qp->ibqp.recv_cq);
 
+	if (qp->state != IB_QPS_RESET)
+		mthca_MODIFY_QP(dev, qp->state, IB_QPS_RESET, qp->qpn, 0,
+				NULL, 0, &status);
+
 	/*
 	 * Lock CQs here, so that CQ polling code can do QP lookup
 	 * without taking a lock.
@@ -1409,10 +1413,6 @@ void mthca_free_qp(struct mthca_dev *dev
 
 	wait_event(qp->wait, !get_qp_refcount(dev, qp));
 
-	if (qp->state != IB_QPS_RESET)
-		mthca_MODIFY_QP(dev, qp->state, IB_QPS_RESET, qp->qpn, 0,
-				NULL, 0, &status);
-
 	/*
 	 * If this is a userspace QP, the buffers, MR, CQs and so on
 	 * will be cleaned up in userspace, so all we have to do is

-- 
MST