[PATCH bpf-next v5 0/7] Support associating BPF programs with struct_ops

Amery Hung
2025-11-04T17:26:56Z

v4 -> v5
- Simplify the API for getting associated struct_ops and dont't
expose struct_ops map lifecycle management (Andrii, Alexei)
Link: https://lore.kernel.org/bpf/20251024212914.1474337-1-ameryhung@gmail.com/

v3 -> v4
- Fix potential dangling pointer in timer callback. Protect
st_ops_assoc with RCU. The get helper now needs to be paired with
bpf_struct_ops_put()
- The command should only increase refcount once for a program
(Andrii)
- Test a struct_ops program reused in two struct_ops maps
- Test getting associated struct_ops in timer callback
Link: https://lore.kernel.org/bpf/20251017215627.722338-1-ameryhung@gmail.com/

v2 -> v3
- Change the type of st_ops_assoc from void* (i.e., kdata) to bpf_map
(Andrii)
- Fix a bug that clears BPF_PTR_POISON when a struct_ops map is freed
(Andrii)
- Return NULL if the map is not fully initialized (Martin)
- Move struct_ops map refcount inc/dec into internal helpers (Martin)
- Add libbpf API, bpf_program__assoc_struct_ops (Andrii)
Link: https://lore.kernel.org/bpf/20251016204503.3203690-1-ameryhung@gmail.com/

v1 -> v2
- Poison st_ops_assoc when reusing the program in more than one
struct_ops maps and add a helper to access the pointer (Andrii)
- Minor style and naming changes (Andrii)
Link: https://lore.kernel.org/bpf/20251010174953.2884682-1-ameryhung@gmail.com/

---

Hi,

This patchset adds a new BPF command BPF_PROG_ASSOC_STRUCT_OPS to
the bpf() syscall to allow associating a BPF program with a struct_ops.
The command is introduced to address a emerging need from struct_ops
users. As the number of subsystems adopting struct_ops grows, more
users are building their struct_ops-based solution with some help from
other BPF programs. For exmample, scx_layer uses a syscall program as
a user space trigger to refresh layers [0]. It also uses tracing program
to infer whether a task is using GPU and needs to be prioritized [1]. In
these use cases, when there are multiple struct_ops instances, the
struct_ops kfuncs called from different BPF programs, whether struct_ops
or not needs to be able to refer to a specific one, which currently is
not possible.

The new BPF command will allow users to explicitly associate a BPF
program with a struct_ops map. The libbpf wrapper can be called after
loading programs and before attaching programs and struct_ops.

Internally, it will set prog->aux->st_ops_assoc to the struct_ops
map. struct_ops kfuncs can then get the associated struct_ops struct
by calling bpf_prog_get_assoc_struct_ops() with prog->aux, which can
be acquired from a "__prog" argument. The value of the speical
argument will be fixed up by the verifier during verification.

The command conceptually associates the implementation of BPF programs
with struct_ops map, not the attachment. A program associated with the
map will take a refcount of it so that st_ops_assoc always points to a
valid struct_ops struct. struct_ops implementers can use the helper,
bpf_prog_get_assoc_struct_ops to get the pointer. The returned
struct_ops if not NULL is guaranteed to be valid and initialized.
However, it is not guarantted that the struct_ops is attached. The
struct_ops implementer still need to take stepis to track and check the
state of the struct_ops in kdata, if the use case demand the struct_ops
to be attached.

We can also consider support associating struct_ops link with BPF
programs, which on one hand make struct_ops implementer's job easier,
but might complicate libbpf workflow and does not apply to legacy
struct_ops attachment.

[0] https://github.com/sched-ext/scx/blob/main/scheds/rust/scx_layered/src/bpf/main.bpf.c#L557
[1] https://github.com/sched-ext/scx/blob/main/scheds/rust/scx_layered/src/bpf/main.bpf.c#L754

---

Amery Hung (7):
bpf: Allow verifier to fixup kernel module kfuncs
bpf: Support associating BPF program with struct_ops
bpf: Pin associated struct_ops when registering async callback
libbpf: Add support for associating BPF program with struct_ops
selftests/bpf: Test BPF_PROG_ASSOC_STRUCT_OPS command
selftests/bpf: Test ambiguous associated struct_ops
selftests/bpf: Test getting associated struct_ops in timer callback

include/linux/bpf.h | 16 ++
include/uapi/linux/bpf.h | 17 ++
kernel/bpf/bpf_struct_ops.c | 90 ++++++++
kernel/bpf/core.c | 3 +
kernel/bpf/helpers.c | 105 +++++++---
kernel/bpf/syscall.c | 46 +++++
kernel/bpf/verifier.c | 3 +-
tools/include/uapi/linux/bpf.h | 17 ++
tools/lib/bpf/bpf.c | 19 ++
tools/lib/bpf/bpf.h | 21 ++
tools/lib/bpf/libbpf.c | 30 +++
tools/lib/bpf/libbpf.h | 16 ++
tools/lib/bpf/libbpf.map | 2 +
.../bpf/prog_tests/test_struct_ops_assoc.c | 194 ++++++++++++++++++
.../selftests/bpf/progs/struct_ops_assoc.c | 105 ++++++++++
.../bpf/progs/struct_ops_assoc_in_timer.c | 77 +++++++
.../bpf/progs/struct_ops_assoc_reuse.c | 75 +++++++
.../selftests/bpf/test_kmods/bpf_testmod.c | 17 ++
.../bpf/test_kmods/bpf_testmod_kfunc.h | 1 +
19 files changed, 819 insertions(+), 35 deletions(-)
create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_assoc.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_assoc.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_assoc_in_timer.c
create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_assoc_reuse.c

--
2.47.3