[PATCH rdma-next 08/13] RDMA/cgroup: Scope rdma cgroup device visibility to the net namespace

[Jiri Pirko <jiri@resnulli.us>]

From: Jiri Pirko <jiri@nvidia.com>

Track each rdma cgroup device's net namespace and sharing mode, then filter
name lookups and cgroupfs enumeration to devices visible from the caller's
namespace. Keep the cached sharing mode synchronized across registration,
netns moves, and runtime mode changes.

Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
 Documentation/admin-guide/cgroup-v2.rst |  7 +++++++
 drivers/infiniband/core/cgroup.c        | 12 ++++++++++++
 drivers/infiniband/core/core_priv.h     | 12 ++++++++++++
 drivers/infiniband/core/device.c        | 11 +++++++++++
 include/linux/cgroup_rdma.h             | 10 ++++++++++
 kernel/cgroup/rdma.c                    | 20 +++++++++++++++++++-
 6 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst
index 993446ab66d0..4523c1884d67 100644
--- a/Documentation/admin-guide/cgroup-v2.rst
+++ b/Documentation/admin-guide/cgroup-v2.rst
@@ -2752,6 +2752,13 @@ RDMA
 The "rdma" controller regulates the distribution and accounting of
 RDMA resources.
 
+When RDMA devices are isolated per network namespace (exclusive mode),
+device names are unique only within a network namespace. The device lines
+below are therefore scoped to the reading or writing process's network
+namespace: only devices accessible from that namespace are listed, and a
+limit is applied to the device of that name in that namespace. Configure
+limits from the same network namespace as the workloads.
+
 RDMA Interface Files
 ~~~~~~~~~~~~~~~~~~~~
 
diff --git a/drivers/infiniband/core/cgroup.c b/drivers/infiniband/core/cgroup.c
index 1f037fe01450..7a216ed45199 100644
--- a/drivers/infiniband/core/cgroup.c
+++ b/drivers/infiniband/core/cgroup.c
@@ -17,6 +17,8 @@
 void ib_device_register_rdmacg(struct ib_device *device)
 {
 	device->cg_device.name = device->name;
+	device->cg_device.netns_shared = ib_devices_shared_netns;
+	write_pnet(&device->cg_device.net, rdma_dev_net(device));
 	rdmacg_register_device(&device->cg_device);
 }
 
@@ -34,6 +36,16 @@ void ib_device_unregister_rdmacg(struct ib_device *device)
 	rdmacg_unregister_device(&device->cg_device);
 }
 
+void ib_device_rdmacg_change_netns(struct ib_device *device, struct net *net)
+{
+	write_pnet(&device->cg_device.net, net);
+}
+
+void ib_device_rdmacg_set_netns_shared(struct ib_device *device, bool shared)
+{
+	WRITE_ONCE(device->cg_device.netns_shared, shared);
+}
+
 int ib_rdmacg_try_charge(struct ib_rdmacg_object *cg_obj,
 			 struct ib_device *device,
 			 enum rdmacg_resource_type resource_index)
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index aaf330b0d333..9cd671e2db20 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -156,6 +156,8 @@ void ib_dispatch_event_clients(struct ib_event *event);
 #ifdef CONFIG_CGROUP_RDMA
 void ib_device_register_rdmacg(struct ib_device *device);
 void ib_device_unregister_rdmacg(struct ib_device *device);
+void ib_device_rdmacg_change_netns(struct ib_device *device, struct net *net);
+void ib_device_rdmacg_set_netns_shared(struct ib_device *device, bool shared);
 
 int ib_rdmacg_try_charge(struct ib_rdmacg_object *cg_obj,
 			 struct ib_device *device,
@@ -173,6 +175,16 @@ static inline void ib_device_unregister_rdmacg(struct ib_device *device)
 {
 }
 
+static inline void ib_device_rdmacg_change_netns(struct ib_device *device,
+						 struct net *net)
+{
+}
+
+static inline void ib_device_rdmacg_set_netns_shared(struct ib_device *device,
+						     bool shared)
+{
+}
+
 static inline int ib_rdmacg_try_charge(struct ib_rdmacg_object *cg_obj,
 				       struct ib_device *device,
 				       enum rdmacg_resource_type resource_index)
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 8705011fab66..3ccf4731154a 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1112,6 +1112,7 @@ static int add_all_compat_devs(void)
 int rdma_compatdev_set(u8 enable)
 {
 	struct rdma_dev_net *rnet;
+	struct ib_device *dev;
 	unsigned long index;
 	int ret = 0;
 
@@ -1134,6 +1135,12 @@ int rdma_compatdev_set(u8 enable)
 	if (ret)
 		return -EBUSY;
 
+	/* Keep each registered device's rdma cgroup visibility in sync. */
+	down_read(&devices_rwsem);
+	xa_for_each_marked(&devices, index, dev, DEVICE_REGISTERED)
+		ib_device_rdmacg_set_netns_shared(dev, enable);
+	up_read(&devices_rwsem);
+
 	if (enable)
 		ret = add_all_compat_devs();
 	else
@@ -1350,6 +1357,7 @@ static int enable_device_and_get(struct ib_device *device)
 	 */
 	refcount_set(&device->refcount, 2);
 	down_write(&devices_rwsem);
+	ib_device_rdmacg_set_netns_shared(device, ib_devices_shared_netns);
 	xa_set_mark(&devices, device->index, DEVICE_REGISTERED);
 
 	/*
@@ -1823,12 +1831,14 @@ static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
 			     "%s: failed to pick device name during namespace teardown: %d\n",
 			     __func__, ret);
 			write_pnet(&device->coredev.rdma_net, net);
+			ib_device_rdmacg_change_netns(device, net);
 			ret = 0;
 		}
 		goto rename_done;
 	}
 
 	write_pnet(&device->coredev.rdma_net, net);
+	ib_device_rdmacg_change_netns(device, net);
 	ret = device_rename(&device->dev, new_name);
 	if (ret) {
 		if (fallback_pattern) {
@@ -1842,6 +1852,7 @@ static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
 				 __func__);
 			/* Try and put things back and re-enable the device */
 			write_pnet(&device->coredev.rdma_net, cur_net);
+			ib_device_rdmacg_change_netns(device, cur_net);
 		}
 	} else {
 		strscpy(device->name, dev_name(&device->dev),
diff --git a/include/linux/cgroup_rdma.h b/include/linux/cgroup_rdma.h
index 404e746552ca..71170cb0e19e 100644
--- a/include/linux/cgroup_rdma.h
+++ b/include/linux/cgroup_rdma.h
@@ -7,6 +7,7 @@
 #define _CGROUP_RDMA_H
 
 #include <linux/cgroup.h>
+#include <net/net_namespace.h>
 
 enum rdmacg_resource_type {
 	RDMACG_RESOURCE_HCA_HANDLE,
@@ -34,6 +35,15 @@ struct rdmacg_device {
 	struct list_head	dev_node;
 	struct list_head	rpools;
 	char			*name;
+	/*
+	 * Net namespace the device belongs to. @netns_shared mirrors
+	 * ib_devices_shared_netns: when true the device is visible from every
+	 * net namespace (shared mode); otherwise @net is the only namespace
+	 * that may see and configure it. @netns_shared is updated when the
+	 * sharing mode changes, so use {READ,WRITE}_ONCE() to access it.
+	 */
+	possible_net_t		net;
+	bool			netns_shared;
 };
 
 /*
diff --git a/kernel/cgroup/rdma.c b/kernel/cgroup/rdma.c
index 5e82a03b3270..c8b4e3de7630 100644
--- a/kernel/cgroup/rdma.c
+++ b/kernel/cgroup/rdma.c
@@ -15,6 +15,7 @@
 #include <linux/cgroup.h>
 #include <linux/parser.h>
 #include <linux/cgroup_rdma.h>
+#include <linux/nsproxy.h>
 
 #define RDMACG_MAX_STR "max"
 
@@ -464,6 +465,13 @@ void rdmacg_unregister_device(struct rdmacg_device *device)
 }
 EXPORT_SYMBOL(rdmacg_unregister_device);
 
+/* netns_shared is toggled without rdmacg_mutex, hence READ_ONCE(). */
+static bool rdmacg_device_visible(const struct rdmacg_device *device)
+{
+	return READ_ONCE(device->netns_shared) ||
+	       net_eq(read_pnet(&device->net), current->nsproxy->net_ns);
+}
+
 static struct rdmacg_device *rdmacg_get_device_locked(const char *name)
 {
 	struct rdmacg_device *device;
@@ -471,7 +479,8 @@ static struct rdmacg_device *rdmacg_get_device_locked(const char *name)
 	lockdep_assert_held(&rdmacg_mutex);
 
 	list_for_each_entry(device, &rdmacg_devices, dev_node)
-		if (!strcmp(name, device->name))
+		if (rdmacg_device_visible(device) &&
+		    !strcmp(name, device->name))
 			return device;
 
 	return NULL;
@@ -626,6 +635,9 @@ static int rdmacg_resource_read(struct seq_file *sf, void *v)
 	mutex_lock(&rdmacg_mutex);
 
 	list_for_each_entry(device, &rdmacg_devices, dev_node) {
+		if (!rdmacg_device_visible(device))
+			continue;
+
 		seq_printf(sf, "%s ", device->name);
 
 		rpool = find_cg_rpool_locked(cg, device);
@@ -648,6 +660,9 @@ static int rdmacg_events_show(struct seq_file *sf, void *v)
 	mutex_lock(&rdmacg_mutex);
 
 	list_for_each_entry(device, &rdmacg_devices, dev_node) {
+		if (!rdmacg_device_visible(device))
+			continue;
+
 		rpool = find_cg_rpool_locked(cg, device);
 
 		seq_printf(sf, "%s ", device->name);
@@ -677,6 +692,9 @@ static int rdmacg_events_local_show(struct seq_file *sf, void *v)
 	mutex_lock(&rdmacg_mutex);
 
 	list_for_each_entry(device, &rdmacg_devices, dev_node) {
+		if (!rdmacg_device_visible(device))
+			continue;
+
 		rpool = find_cg_rpool_locked(cg, device);
 
 		seq_printf(sf, "%s ", device->name);
-- 
2.54.0