Re: [PATCH v1 01/14] mm: introduce bpf struct ops for OOM handling

[Song Liu]

On Mon, Oct 6, 2025 at 5:42 PM Roman Gushchin <roman.gushchin@xxxxxxxxx> wrote:
[...]
> >> >
> >> > So, there cannot be bpf_link__attach_cgroup(), but there can be (at
> >> > least conceptually) bpf_map__attach_cgroup(), where map is struct_ops
> >> > map.
> >>
> >> I see...
> >> So basically when a struct ops map is created we have a fd and then
> >> we can attach it (theoretically multiple times) using BPF_LINK_CREATE.
> >
> > Yes, exactly. "theoretically" part is true right now because of how
> > things are wired up internally, but this must be fixable
>
> Ok, one more question: do you think it's better to alter the existing
> bpf_struct_ops.reg() callback and add the bpf_attr parameter
> or add the new .attach() callback?

IIUC, bpf_struct_ops_link is just for bpf_struct_ops.reg(). The
attach() operation can be separate, and it doesn't need to be
implemented in sys_bpf() syscall. BPF TCP congestion control
uses setsockopt() to do the attach(). Current sched_ext does
the attach as part of reg(). Tejun is proposing to use reg() for
sub scheduler [1]. In my earlier patch set for fanotify-bpf, I
was planning to use ioctl on the fanotify fd [2]. I think these
all work for the given use case.

I am not sure what is the best option for cgroup oom killer. There
are multiple options. Technically, it can even be a sysfs entry.
We can use it as:

# load and pin oom killers first
$ cat /sys/fs/cgroup/user.slice/oom.killer
[oom_a] oom_b oom_c
$ echo oom_b > /sys/fs/cgroup/user.slice/oom.killer
$ cat /sys/fs/cgroup/user.slice/oom.killer
oom_a [oom_b] oom_c

Note that, I am not proposing to use sysfs entries for oom killer.
I just want to say it is an option.

Given attach() can be implemented in different ways, we probably
don't need to add it to bpf_struct_ops. But if that turns out to be
the best option, I would not argue against it. OTOH, I think it is
better to keep reg() and attach() separate, though sched_ext is
using reg() for both options.

Does this make sense?

Thanks,
Song

[1] https://lore.kernel.org/bpf/20250920005931.2753828-1-tj@xxxxxxxxxx/
[2] https://lore.kernel.org/bpf/20241114084345.1564165-1-song@xxxxxxxxxx/