[PATCH] mm/bpf: Add bpf_mem_cgroup_memory_events_local() kfunc

[PATCH] mm/bpf: Add bpf_mem_cgroup_memory_events_local() kfunc

[Hongfu Li]

From: Hongfu Li <lihongfu@kylinos.cn>

memory.events counts events for the memory cgroup and all its
ancestors, so it cannot tell which cgroup in a subtree triggered an
event. memory.events.local counts only the events of the cgroup
itself.

Expose the local counters to BPF programs with a kfunc, so that a
policy can attribute events to a specific cgroup instead of only
seeing the aggregate of the subtree.

Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
---
 mm/bpf_memcontrol.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/mm/bpf_memcontrol.c b/mm/bpf_memcontrol.c
index d8f579c28560..826f711718db 100644
--- a/mm/bpf_memcontrol.c
+++ b/mm/bpf_memcontrol.c
@@ -133,6 +133,23 @@ __bpf_kfunc unsigned long bpf_mem_cgroup_memory_events(struct mem_cgroup *memcg,
 	return atomic_long_read(&memcg->memory_events[event]);
 }
 
+/**
+ * bpf_mem_cgroup_memory_events_local - Read memory cgroup's local memory event
+ * @memcg: memory cgroup
+ * @event: memory event id
+ *
+ * Return: The current value of the local memory event counter.
+ */
+__bpf_kfunc unsigned long
+bpf_mem_cgroup_memory_events_local(struct mem_cgroup *memcg,
+				   enum memcg_memory_event event)
+{
+	if (unlikely(event >= MEMCG_NR_MEMORY_EVENTS))
+		return (unsigned long)-1;
+
+	return atomic_long_read(&memcg->memory_events_local[event]);
+}
+
 /**
  * bpf_mem_cgroup_page_state - Read memory cgroup's page state counter
  * @memcg: memory cgroup
@@ -215,6 +232,7 @@ BTF_ID_FLAGS(func, bpf_put_mem_cgroup, KF_RELEASE)
 
 BTF_ID_FLAGS(func, bpf_mem_cgroup_vm_events)
 BTF_ID_FLAGS(func, bpf_mem_cgroup_memory_events)
+BTF_ID_FLAGS(func, bpf_mem_cgroup_memory_events_local)
 BTF_ID_FLAGS(func, bpf_mem_cgroup_usage)
 BTF_ID_FLAGS(func, bpf_mem_cgroup_page_state)
 BTF_ID_FLAGS(func, bpf_mem_cgroup_flush_stats, KF_SLEEPABLE)

---
base-commit: 2c5dafa7f289d760f4492260b0988029aab478b0
change-id: 20261111-for-bpf_memctl-1111-f3b6dc2040ad

Best regards,
--  
Hongfu Li <lihongfu@kylinos.cn>

Re: [PATCH] mm/bpf: Add bpf_mem_cgroup_memory_events_local() kfunc

[Alexei Starovoitov]

On Tue, Nov 10, 2026 at 10:56 PM Hongfu Li <hongfu.li@linux.dev> wrote:
> Expose the local counters to BPF programs with a kfunc, so that a
> policy can attribute events to a specific cgroup instead of only
> seeing the aggregate of the subtree.

No. The prog can do it today without a new kfunc:

  memcg = bpf_get_mem_cgroup(css);
  if (!memcg)
          return 0;
  cnt = memcg->memory_events_local[MEMCG_OOM_KILL].counter;
  bpf_put_mem_cgroup(memcg);

memcg is a trusted pointer to a struct that is in BTF.

pw-bot: cr