[PATCH for-next v4 0/4] RDMA/bnxt_re: Update the toggle page handling of CQ and SRQ

[Selvin Xavier <selvin.xavier@broadcom.com>]

Based on the suggestion from Jason (
https://patchwork.kernel.org/project/linux-rdma/patch/20260615224751.232802-5-selvin.xavier@broadcom.com/)
, adding the uverb object to retrieve the CQ an SRQ structures while getting the
toggle mem. To work with older rdma-core, retain the existing code with
modification.
The rdma-core pull request is here: https://github.com/linux-rdma/rdma-core/pull/1761
Please review and apply the series.
Thanks,
Selvin Xavier

v3 -> v4:
 - Fix a NULL pointer possibility by adding a check for res_uobj->object
 - Locking changes in patch1 based on Leon's comment
 - The kref of the mmap entry (patch 3 of the previous series) is folded
   into the patch 2 of this series that fixes the lifetime of the toggle
   pages.
 - Adds a clearing of the MAYWRITE option, so that read-only mapping
   can't later be upgraded.
 - v3: https://lore.kernel.org/linux-rdma/20260713135830.1934471-1-selvin.xavier@broadcom.com/

v2 -> v3:
 - Patch2 fixes toggle-page lifetime by making the rdma_user_mmap_entry
   the sole owner of the page
 - Patch 3 adds a reference to the uobject in the legacy path to avoid
   the usage of the page va after the resource destroy.
 - v2: https://lore.kernel.org/linux-rdma/20260624223927.521882-1-selvin.xavier@broadcom.com/

v1->v2 :
 - Fix the error cleanup for SRQ and CQ create paths
 - Fix a synchronization issue for the legacy path which can cause a
   UAF
 - v1: https://lore.kernel.org/linux-rdma/20260622100528.132463-1-selvin.xavier@broadcom.com/

Selvin Xavier (4):
  RDMA/bnxt_re: Replace per-device hash tables with per-context XArrays
  RDMA/bnxt_re: Defer toggle page free to rdma_user_mmap_entry teardown
  RDMA/bnxt_re: Fix toggle page UAF in GET_TOGGLE_MEM with mmap entry
    refcount
  RDMA/bnxt_re: Add uverbs object handle path for CQ/SRQ toggle page


Selvin Xavier (4):
  RDMA/bnxt_re: Replace per-device hash tables with per-context XArrays
  RDMA/bnxt_re: Defer toggle page free to rdma_user_mmap_entry teardown
  RDMA/bnxt_re: Add uverbs object handle path for CQ/SRQ toggle page
  RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap

 drivers/infiniband/hw/bnxt_re/bnxt_re.h  |   6 -
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 125 +++++++++++++---
 drivers/infiniband/hw/bnxt_re/ib_verbs.h |   8 +-
 drivers/infiniband/hw/bnxt_re/main.c     |   4 -
 drivers/infiniband/hw/bnxt_re/uapi.c     | 183 +++++++++++++++--------
 include/uapi/rdma/bnxt_re-abi.h          |   4 +
 6 files changed, 233 insertions(+), 97 deletions(-)

-- 
2.39.3