Re: [PATCH for-next v3 1/4] RDMA/bnxt_re: Replace per-device hash tables with per-context XArrays

[Leon Romanovsky <leon@kernel.org>]

On Mon, Jul 13, 2026 at 06:58:27AM -0700, Selvin Xavier wrote:
> The CQ and SRQ hash tables (cq_hash, srq_hash) on struct bnxt_re_dev
> were used exclusively to look up a toggle-page pointer from a
> user-space-supplied hardware queue ID in the GET_TOGGLE_MEM
> ioctl handler. This approach has couple of problems. First,
> because the tables are per-device, any user can look up another
> user's CQ or SRQ by guessing the hardware queue ID. Second,
> concurrent add and remove operations on the hash table are not
> protected by any lock, leaving a race window.
> 
> The correct fix is to retrieve the CQ and SRQ objects via the uverbs
> object handle, which gives built-in ownership verification and reference
> pinning for the duration of the ioctl. That is added in the next patch of
> this series.
> 
> To maintain backward compatibility with older rdma-core versions that
> do not send a uverbs object handle, the driver must continue to support
> the existing TYPE + RES_ID lookup path. This patch replaces the per-device
> hash tables with per-ucontext XArrays (cq_xa and srq_xa on struct
> bnxt_re_ucontext), which narrows the lookup scope to the calling context,
> eliminating the cross-user visibility. Also adds Xarray locking mechanism
> for synchronization.
> 
> The GET_TOGGLE_MEM ioctl handler is updated to call xa_load()
> in place of the now-removed bnxt_re_search_for_cq()/
> bnxt_re_search_for_srq() helpers. No ABI changes are required.
> 
> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
> ---
>  drivers/infiniband/hw/bnxt_re/bnxt_re.h  |  5 --
>  drivers/infiniband/hw/bnxt_re/ib_verbs.c | 76 ++++++++++++++++++------
>  drivers/infiniband/hw/bnxt_re/ib_verbs.h |  6 +-
>  drivers/infiniband/hw/bnxt_re/main.c     |  4 --
>  drivers/infiniband/hw/bnxt_re/uapi.c     | 75 ++++++++---------------
>  5 files changed, 87 insertions(+), 79 deletions(-)

<...>

> +		if (uctx) {
> +			xa_lock(&uctx->srq_xa);
> +			__xa_erase(&uctx->srq_xa, srq->qplib_srq.id);
> +			xa_unlock(&uctx->srq_xa);

Something very minor, there is no need in this lock->__erase->unlock
pattern, use xa_erase() directly as it will perform locking internally.

> +			free_page((unsigned long)srq->uctx_srq_page);

It is worth to get rid of get_zeroed_page/free_page too.
https://lore.kernel.org/linux-rdma/20260713-b4-rdma-v2-0-65d2a1a5180c@kernel.org/T/#t

Thanks