rv/tlob: Add task latency over budget RV monitor

From: Wen Yang <[email protected]>

This series introduces tlob (task latency over budget), a per-task hybrid automaton RV monitor that measures elapsed wall-clock time across a user-delimited code section and fires when the time exceeds a configurable budget.

The series applies cleanly on top of:

   [1] git://git.kernel.org/pub/scm/linux/kernel/git/gmonaco/linux.git rv-fixes-7.1
       "rv fixes for v7.1"

Background
----------
The existing wwnr monitor uses a two-state DA to detect tasks that are woken but never run. tlob extends the RV framework to a three-state hybrid automaton:

running (initial) -- on CPU
waiting -- in the scheduler runqueue, not yet on CPU
sleeping -- blocked on a lock, I/O, or similar resource

A single HA clock invariant, clk_elapsed < BUDGET_NS(), is active in all states. The framework enforces it via a per-task hrtimer. On expiry, error_env_tlob is emitted, followed by detail_env_tlob which carries a per-state time breakdown (running_ns, waiting_ns, sleeping_ns) that pinpoints whether the overrun occurred in the running, waiting, or sleeping state.

Userspace interface
-------------------
Tasks are registered for monitoring by writing to the tracefs monitor file:

   # echo "p /path/to/binary:START_OFFSET STOP_OFFSET threshold=NS" \
         > /sys/kernel/tracing/rv/monitors/tlob/monitor

Two uprobes are registered at START_OFFSET (entry) and STOP_OFFSET (exit) of the delimited section. When a task executes the entry uprobe, the monitor starts; when the task reaches the exit uprobe or the budget expires, monitoring stops and the slot is returned to the pool.

Multiple uprobe pairs can be registered for the same binary or different binaries. Each task can have at most one active monitoring session; if a task hits a start uprobe while already monitored, the prior session is cancelled and a new one begins.

Series structure
----------------
Patch 1: rv/da: introduce DA_MON_ALLOCATION_STRATEGY
Consolidates per-object DA storage allocation under a compile-time selector with three strategies:
DA_ALLOC_AUTO (default) - lock-free kmalloc_nolock; unbounded
DA_ALLOC_POOL - pre-allocated fixed-size pool
DA_ALLOC_MANUAL - caller pre-inserts storage

da_handle_start_event() and da_handle_start_run_event() call da_prepare_storage() which resolves at compile time to the correct allocation function.

This patch also includes critical correctness fixes for the pool implementation:
- Add tracepoint_synchronize_unregister() in da_monitor_destroy_pool() to fix UAF where in-flight handlers access freed pool storage
- Fix duplicate hash entry race in da_create_or_get_pool() via concurrent-insert detection under RCU
- Add capacity field to fix build error (DA_MON_POOL_SIZE undeclared in da_pool_return_cb)

Patch 2: rv: add generic uprobe infrastructure for RV monitors
Introduces rv_uprobe, a thin wrapper around uprobe_consumer for RV monitors. Provides rv_uprobe_register(), rv_uprobe_unregister(), and rv_uprobe_sync() for safe teardown.

Patch 3: rv/tlob: add tlob model DOT file
The formal model used to generate tlob.h.

Patch 4: rv/ha: fix ha_invariant_passed_ns silent bypass of invariant check
Fixes a bug where ha_invariant_passed_ns() returned 0 early when env_store was invalid (U64_MAX), leaving it at U64_MAX and causing ha_check_invariant_ns() to always pass. The fix calls ha_reset_clk_ns() then ha_set_invariant_ns() on first use.

Patch 5: rv/ha: make da_monitor_reset_hook and EVENT_NONE_LBL overridable
Allows tlob to override EVENT_NONE_LBL for its start_tlob self-loop.

Patch 6: rv/tlob: add tlob hybrid automaton monitor
The main tlob implementation, including:
- Three-state HA (running/waiting/sleeping)
- Per-task hrtimer enforcement (HRTIMER_MODE_REL_HARD)
- DA_ALLOC_POOL for allocation-free hot path
- Uprobe registration via tracefs monitor file
- Per-state time accumulation (running_ns, waiting_ns, sleeping_ns)
- HIGH_RES_TIMERS dependency in Kconfig

Patches 7-9: Tests
- KUnit tests for tlob monitor
- Selftest infrastructure fixes
- tlob selftests (uprobe binding, state tracking, violation detection)

Changes since v2
----------------
All feedback from Gabriele Monaco has been addressed:

-- Patch 02 (per-task slot ordering / ha_monitor_reset_env):
Dropped from v3; rebased on top of Gabriele's series [1].

-- Patch 03 (verificationtest-ktap):
Changed to use realpath for robustness as suggested.

-- Patch 04 (pre-allocated storage pool):
Complete redesign as DA_MON_ALLOCATION_STRATEGY:
- Three strategies (AUTO/POOL/MANUAL) via compile-time macro
- da_monitor_init_prealloc() removed; da_monitor_init() selects internally
- da_create_or_get_kmalloc() removed (no viable use case)
- nomiss updated to use DA_ALLOC_MANUAL
- da_extra_cleanup() hook added for per-entry teardown

Critical bug fixes included in this patch:
- tracepoint_synchronize_unregister() added to da_monitor_destroy_pool() to prevent UAF from in-flight handlers accessing freed pool storage
- Duplicate hash entry race fixed in da_create_or_get_pool() via concurrent-insert detection and slot return under RCU
- capacity field added to fix DA_MON_POOL_SIZE undeclared build error

-- Patch 05 (generic uprobe infrastructure):
Carried unchanged into v3.

-- Patch 06 (rvgen __init arrow reset):
Carried unchanged into v3.

-- Patch 08 (tlob monitor):
Split and refactored:
- ioctl interface deferred to follow-up series (tracefs-only in v3)
- Handler simplification: three inline helpers (tlob_acc_running/ waiting/sleeping) with scoped_guard(rcu)
- do_prev/do_next flags removed (da_handle_event skips unmonitored)
- scoped_guard(rcu) and guard(mutex) applied throughout
- tlob_stop_all() removed; da_extra_cleanup() hook used instead
- start_tlob self-loop added to DOT model as suggested
- ha_setup_invariants() guards against redundant timer restart
- HIGH_RES_TIMERS dependency added to Kconfig

Additional improvements in v3
------------------------------
Beyond the v2 feedback, this version includes:

1. Simplified tlob monitor implementation:
- Removed redundant tlob_num_monitored atomic counter (da_handle_event already handles unmonitored tasks via hash lookup)
- Eliminated extra cacheline touch on every sched_switch/sched_wakeup
- Several repeated pattern simplifications.

2. Extracted common accumulation logic:
- __tlob_acc() using offsetof() replaces three nearly-identical functions
- Reduces code duplication while maintaining type safety

3. Complete test coverage:
- KUnit tests for core functionality
- Comprehensive selftests for uprobe integration, state tracking, and violation detection

Testing
-------
All patches have been tested on:
- x86_64 with CONFIG_PREEMPT_RT
- All KUnit tests pass
- All selftests pass with verificationtest-ktap

[1] git://git.kernel.org/pub/scm/linux/kernel/git/gmonaco/linux.git rv-fixes-7.1

     "rv fixes for v7.1"

Wen Yang (9):
rv/da: introduce DA_MON_ALLOCATION_STRATEGY
rv: add generic uprobe infrastructure for RV monitors rv/tlob: add tlob model DOT file
rv/ha: fix ha_invariant_passed_ns silent bypass of invariant check rv/ha: make da_monitor_reset_hook and EVENT_NONE_LBL overridable rv/tlob: add tlob hybrid automaton monitor
rv/tlob: add KUnit tests for the tlob monitor selftests/verification: fix verificationtest-ktap for out-of-tree
execution
selftests/verification: add tlob selftests

  Documentation/trace/rv/index.rst              |   1 +
  Documentation/trace/rv/monitor_tlob.rst       | 177 ++++
  include/rv/da_monitor.h                       | 276 ++++-
  include/rv/ha_monitor.h                       |  22 +-
  include/rv/rv_uprobe.h                        | 119 +++
  kernel/trace/rv/Kconfig                       |   5 +
  kernel/trace/rv/Makefile                      |   3 +
  kernel/trace/rv/monitors/nomiss/nomiss.c      |   6 +-
  kernel/trace/rv/monitors/tlob/.kunitconfig    |   6 +
  kernel/trace/rv/monitors/tlob/Kconfig         |  19 +
  kernel/trace/rv/monitors/tlob/tlob.c          | 968 ++++++++++++++++++
  kernel/trace/rv/monitors/tlob/tlob.h          | 148 +++
  kernel/trace/rv/monitors/tlob/tlob_kunit.c    |  92 ++
  kernel/trace/rv/monitors/tlob/tlob_trace.h    |  49 +
  kernel/trace/rv/rv_trace.h                    |   1 +
  kernel/trace/rv/rv_uprobe.c                   | 182 ++++
  .../testing/selftests/verification/.gitignore |   2 +
  tools/testing/selftests/verification/Makefile |  19 +-
  .../verification/test.d/tlob/Makefile         |  20 +
  .../verification/test.d/tlob/test.d/functions |   1 +
  .../verification/test.d/tlob/tlob_sym.c       | 189 ++++
  .../verification/test.d/tlob/tlob_target.c    | 138 +++
  .../verification/test.d/tlob/uprobe_bind.tc   |  37 +
  .../test.d/tlob/uprobe_detail_running.tc      |  51 +
  .../test.d/tlob/uprobe_detail_sleeping.tc     |  50 +
  .../test.d/tlob/uprobe_detail_waiting.tc      |  66 ++
  .../verification/test.d/tlob/uprobe_multi.tc  |  64 ++
  .../test.d/tlob/uprobe_no_event.tc            |  19 +
  .../test.d/tlob/uprobe_violation.tc           |  67 ++
  .../verification/verificationtest-ktap        |   4 +-
  tools/verification/models/tlob.dot            |  22 +
  31 files changed, 2789 insertions(+), 34 deletions(-)

create mode 100644 Documentation/trace/rv/monitor_tlob.rst
create mode 100644 include/rv/rv_uprobe.h
create mode 100644 kernel/trace/rv/monitors/tlob/.kunitconfig
create mode 100644 kernel/trace/rv/monitors/tlob/Kconfig
create mode 100644 kernel/trace/rv/monitors/tlob/tlob.c
create mode 100644 kernel/trace/rv/monitors/tlob/tlob.h
create mode 100644 kernel/trace/rv/monitors/tlob/tlob_kunit.c
create mode 100644 kernel/trace/rv/monitors/tlob/tlob_trace.h
create mode 100644 kernel/trace/rv/rv_uprobe.c
create mode 100644 tools/testing/selftests/verification/test.d/tlob/Makefile create mode 100644 tools/testing/selftests/verification/test.d/tlob/test.d/functions create mode 100644 tools/testing/selftests/verification/test.d/tlob/tlob_sym.c create mode 100644 tools/testing/selftests/verification/test.d/tlob/tlob_target.c create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_detail_running.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_detail_sleeping.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_detail_waiting.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_multi.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_no_event.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_violation.tc create mode 100644 tools/verification/models/tlob.dot

+/*
+ * DA_MON_POOL_SIZE must be defined before this header is included

(directly or
+ * transitively via ha_monitor.h) when DA_ALLOC_POOL is selected. In practice
+ * this means defining it after the monitor's model header (which supplies the
+ * capacity constant) and before the ha_monitor.h include.
+ */

+#if DA_MON_ALLOCATION_STRATEGY == DA_ALLOC_POOL && !defined(DA_MON_POOL_SIZE)
+# error "DA_ALLOC_POOL requires DA_MON_POOL_SIZE to be defined before including this header"

+#endif

+/*
+ * Per-object pool state.
+ *
+ * Zero-initialised by default (storage == NULL ⟹ kmalloc mode).  A

monitor
+ * opts into pool mode by defining DA_MON_ALLOCATION_STRATEGY DA_ALLOC_POOL
+ * and DA_MON_POOL_SIZE before including this header; da_monitor_init() then
+ * pre-allocates the pool internally.
+ *
+ * Because every field is wrapped in this struct and the struct itself is a
+ * per-TU static, each monitor that includes this header gets a completely
+ * independent pool.  A kmalloc monitor (e.g. nomiss) and a pool monitor
+ * (e.g. tlob) therefore coexist without any interference.
+ *
+ * da_pool_return_cb runs from softirq (non-PREEMPT_RT) or rcuc kthread
+ * (PREEMPT_RT); spin_lock_irqsave handles both.
+ */

(quoted diff) +2 -0

+struct da_per_obj_pool {
+	struct da_monitor_storage  *storage;  /* non-NULL ⟹ pool

mode */

(quoted diff) +1 -0

+	struct da_monitor_storage **free;     /* kmalloc'd pointer

stack */

(quoted diff) +2 -0

+	unsigned int                free_top;
+	unsigned int                capacity; /* total number of

slots */

include/rv/da_monitor.h +6 -0

+	spinlock_t                  lock;
+};
+
+static struct da_per_obj_pool da_pool = {
+	.lock = __SPIN_LOCK_UNLOCKED(da_pool.lock),
+};

 /*
  * da_destroy_storage - destroy the per-object storage
  *
- * The caller is responsible to synchronise writers, either with locks or
- * implicitly. For instance, if da_destroy_storage is called at sched_exit and
- * da_create_storage can never occur after that, it's safe to call this without
- * locks.
- * This function includes an RCU read-side critical section to synchronise
- * against da_monitor_destroy().
+ * Pool mode: removes from hash and returns the slot via call_rcu().
+ * Kmalloc mode: removes from hash and frees via kfree_rcu().
+ *
+ * Includes an RCU read-side critical section to synchronise against
+ * da_monitor_destroy().
  */
 static inline void da_destroy_storage(da_id_type id)
 {

include/rv/da_monitor.h +1 -0

  	kfree_rcu(mon_storage, rcu);
+#endif
  }

include/rv/da_monitor.h +5 -0

+
+/*
+ * da_monitor_init - initialise the per-object monitor
+ *
+ * Selects the allocation path at compile time based on

DA_MON_ALLOCATION_STRATEGY:
+ *   DA_ALLOC_POOL   - pre-allocates DA_MON_POOL_SIZE storage slots.
+ *   DA_ALLOC_AUTO / DA_ALLOC_MANUAL - initialises the hash table only.
+ */
 static inline int da_monitor_init(void)
 {
  hash_init(da_monitor_ht);

  return 0;
+#endif
 }

include/rv/da_monitor.h +8 -1

-static inline void da_monitor_destroy(void)
+static inline void da_monitor_destroy_pool(void)
+{
+	struct da_monitor_storage *ms;
+	struct hlist_node *tmp;
+	int bkt;
+
+	/*
+	 * Ensure all in-flight tracepoint handlers that may hold a

raw pointer

(quoted diff) +1 -0

+	 * to a pool slot (e.g. tlob_stop_task after its RCU guard

exits) have

(quoted diff) +1 -0

+	 * completed before we begin tearing down the pool.  Mirrors

the same

(quoted diff) +2 -0

+	/*
+	 * Drain any entries that were not stopped before destroy

(e.g.

(quoted diff) +1 -0

+	 * uprobe-started sessions whose stop probe never fired). 

Call

(quoted diff) +1 -0

+	 * da_extra_cleanup() before hash_del_rcu() so the hook may

safely

(quoted diff) +1 -0

+	 * call ha_cancel_timer_sync() while the monitor is still

reachable.

include/rv/da_monitor.h +3 -0

+
+	/*
+	 * rcu_barrier() drains every pending call_rcu() callback,

including

(quoted diff) +1 -0

+	 * both da_pool_return_cb() and any monitor-specific free

callbacks

From: Wen Yang <[email protected]>

The function is documented as "prepare the invariant and return the time
since reset", but on the first call (env_store == U64_MAX) it exits early without calling ha_set_invariant_ns():

  if (ha_monitor_env_invalid(ha_mon, env))  /* env_store == U64_MAX */
      return 0;   /* ha_set_invariant_ns skipped, env_store stays U64_MAX */
  ...
  ha_set_invariant_ns(ha_mon, env, expire - passed, time_ns);

This leaves env_store == U64_MAX, so ha_check_invariant_ns() always passes on the first activation regardless of elapsed time:

  return READ_ONCE(ha_mon->env_store[env]) >= time_ns;  /* U64_MAX >= any */

Fix: establish the guard before converting to the invariant:

  if (ha_monitor_env_invalid(ha_mon, env)) ha_reset_clk_ns(ha_mon, env, time_ns); /* guard: env_store = time_ns */
  passed = ha_get_env(ha_mon, env, time_ns); ha_set_invariant_ns(ha_mon, env, expire - passed, time_ns); /* invariant: env_store = time_ns + expire */

Apply the same fix to ha_invariant_passed_jiffy().

Signed-off-by Wen Yang <[email protected]>

---
 include/rv/ha_monitor.h | 17 +++++++++++++----

 1 file changed, 13 insertions(+), 4 deletions(-)

include/rv/ha_monitor.h +0 -0

index 28d3c74cabfc..e5860900a337 100644
@@ -365,16 +365,22 @@ static inline bool ha_check_invariant_ns(struct
 ha_monitor *ha_mon,
  }
  /*
   * ha_invariant_passed_ns - prepare the invariant and return the

time since reset
+ *
+ * If the env has not been initialised yet (first entry into a state with an
+ * invariant), anchor the guard clock at the current time so that the full
+ * budget is available from this point.  This preserves the documented
+ * guard→invariant ordering: ha_set_invariant_ns() is always preceded by a
+ * valid guard representation in env_store.
  */
 static inline u64 ha_invariant_passed_ns(struct ha_monitor *ha_mon, enum envs env,
     u64 expire, u64 time_ns) {

include/rv/ha_monitor.h +1 -1

-	u64 passed = 0;
+	u64 passed;

  if (env < 0 || env >= ENV_MAX_STORED)
  return 0;
  if (ha_monitor_env_invalid(ha_mon, env))

include/rv/ha_monitor.h +1 -1

-		return 0;
+		ha_reset_clk_ns(ha_mon, env, time_ns);

  passed = ha_get_env(ha_mon, env, time_ns); ha_set_invariant_ns(ha_mon, env, expire - passed, time_ns); return passed;

include/rv/ha_monitor.h +0 -0

@@ -404,16 +410,19 @@ static inline bool
 ha_check_invariant_jiffy(struct ha_monitor *ha_mon,
  }
  /*
   * ha_invariant_passed_jiffy - prepare the invariant and return the

time since reset
+ *
+ * Same first-use semantics as ha_invariant_passed_ns(): anchor the guard clock
+ * now if the env has not been initialised.
  */
 static inline u64 ha_invariant_passed_jiffy(struct ha_monitor *ha_mon, enum envs env,
        u64 expire, u64 time_ns) {

include/rv/ha_monitor.h +1 -1

-	u64 passed = 0;
+	u64 passed;

  if (env < 0 || env >= ENV_MAX_STORED)
  return 0;
  if (ha_monitor_env_invalid(ha_mon, env))

include/rv/ha_monitor.h +1 -1

-		return 0;
+		ha_reset_clk_jiffy(ha_mon, env);

  passed = ha_get_env(ha_mon, env, time_ns); ha_set_invariant_jiffy(ha_mon, env, expire - passed); return passed;

From: Wen Yang <[email protected]>

Wrap the two definitions with #ifndef guards so that HA-based monitors
can substitute their own implementations before including this header:

  /* in monitor.c, before #include <rv/ha_monitor.h> */ #define da_monitor_reset_hook  my_monitor_reset_env #define EVENT_NONE_LBL         "idle"

No behaviour change for monitors that do not override either macro.

Signed-off-by Wen Yang <[email protected]>

---
 include/rv/ha_monitor.h | 5 +++++

 1 file changed, 5 insertions(+)

include/rv/ha_monitor.h +1 -0

index e5860900a337..610da54c111f 100644
@@ -36,7 +36,10 @@ static bool ha_monitor_handle_constraint(struct
 da_monitor *da_mon,
  					 da_id_type id);
  #define da_monitor_event_hook ha_monitor_handle_constraint
  #define da_monitor_init_hook ha_monitor_init_env
+/* Allow monitors to override da_monitor_reset_hook before including

this header. */

+#ifndef da_monitor_reset_hook
 #define da_monitor_reset_hook ha_monitor_reset_env +#endif
 #define da_monitor_sync_hook() synchronize_rcu()

 #if !defined(HA_SKIP_AUTO_CLEANUP) && RV_MON_TYPE == RV_MON_PER_TASK

include/rv/ha_monitor.h +2 -0

@@ -75,7 +78,9 @@ _Static_assert(offsetof(struct ha_monitor, da_mon)
 == 0,
  #define ENV_INVALID_VALUE U64_MAX
  /* Error with no event occurs only on timeouts */
  #define EVENT_NONE EVENT_MAX
+#ifndef EVENT_NONE_LBL
  #define EVENT_NONE_LBL "none"
+#endif
  #define ENV_BUFFER_SIZE 64

 #ifdef CONFIG_RV_REACTORS

From: Wen Yang <[email protected]>

Add tlob (task latency over budget), a per-task hybrid automaton RV monitor that tracks elapsed wall-clock time across a user-delimited code section and emits error_env_tlob when the elapsed time exceeds a configurable budget.

The monitor uses RV_MON_PER_OBJ with three states (running, waiting, sleeping) driven by sched_switch and sched_wakeup tracepoints, and a single clock invariant clk_elapsed < budget enforced by an hrtimer (HRTIMER_MODE_REL_HARD).  On violation, detail_env_tlob provides a per-state time breakdown (running_ns, waiting_ns, sleeping_ns).

Per-task state is managed via DA_ALLOC_POOL to avoid allocation on the
scheduler tracepoint path.  Uprobe pairs are registered through the tracefs monitor file as "p PATH:OFFSET_START OFFSET_STOP threshold=NS".

Also adds ha_cancel_timer_sync() to ha_monitor.h, a blocking cancel variant needed by tlob's stop_task path to ensure the hrtimer callback
has completed before the per-task monitor state is freed.

Suggested-by Gabriele Monaco <[email protected]>

Signed-off-by Wen Yang <[email protected]>

---

kernel/trace/rv/Kconfig +0 -0

index e2e0033a00b9..ed2de31d0312 100644
@@ -85,6 +85,7 @@ source "kernel/trace/rv/monitors/sleep/Kconfig"

 source "kernel/trace/rv/monitors/stall/Kconfig" source "kernel/trace/rv/monitors/deadline/Kconfig" source "kernel/trace/rv/monitors/nomiss/Kconfig" +source "kernel/trace/rv/monitors/tlob/Kconfig" # Add new deadline monitors here

 # Add new monitors here

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

new file mode 100644
index 000000000000..d8e0c4794720
@@ -0,0 +1,968 @@
+#include <linux/hrtimer.h>
+#include <linux/kernel.h>
+#include <linux/ktime.h>

kernel/trace/rv/monitors/tlob/tlob.c new file +5 -0

+
+#define MODULE_NAME "tlob"
+
+#include <trace/events/sched.h>
+#include <rv_trace.h>

+/* Type for da_monitor_storage.target; must be defined before the includes. */

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+typedef struct tlob_task_state *monitor_target;
+
+/* Forward-declared so da_monitor_reset_hook works before

ha_monitor.h. */

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+static inline void tlob_reset_notify(struct da_monitor *da_mon);
+#define da_monitor_reset_hook tlob_reset_notify
+
+/* Override EVENT_NONE_LBL so the timer-fired violation shows

"budget_exceeded". */

kernel/trace/rv/monitors/tlob/tlob.c new file +6 -0

+#define EVENT_NONE_LBL "budget_exceeded"
+
+#include "tlob.h"
+
+/*
+ * DA_MON_POOL_SIZE must be defined HERE: after tlob.h (which

defines
+ * TLOB_MAX_MONITORED) and before #include <rv/ha_monitor.h> (which
+ * transitively includes da_monitor.h and expands __da_monitor_init_pool
+ * using this macro).  Placing the define before tlob.h or after
+ * ha_monitor.h both cause a build error.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+#define DA_MON_POOL_SIZE TLOB_MAX_MONITORED
+
+/*
+ * Forward-declare tlob_extra_cleanup so the #define below is valid

when
+ * da_monitor.h (included via ha_monitor.h) expands da_extra_cleanup inside
+ * da_monitor_destroy().  The full definition follows after ha_monitor.h.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +7 -0

+static inline void tlob_extra_cleanup(struct da_monitor *da_mon);
+#define da_extra_cleanup tlob_extra_cleanup
+
+#include <rv/ha_monitor.h>
+
+/*
+ * Called from da_monitor_reset() on both normal stop and hrtimer

expiry.
+ * On violation (stopping==0), emits detail_env_tlob.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +8 -0

+
+	ws = ha_get_target(ha_mon);
+	if (!ws)
+		return;
+
+	/*
+	 * Emit per-state breakdown on budget violation only.
+	 * stopping==0: timer callback owns this path (genuine

overrun).

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+	 * stopping==1: normal stop claimed ownership first; skip.
+	 */
+	if (!atomic_read(&ws->stopping)) {
+		unsigned int curr_state = READ_ONCE(da_mon-

Quoted 1 line

curr_state);

kernel/trace/rv/monitors/tlob/tlob.c new file +5 -0

+		u64 running_ns, waiting_ns, sleeping_ns, partial_ns;
+		unsigned long flags;
+
+		/*
+		 * Snapshot accumulators; partial_ns covers

curr_state time

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+		 * not yet folded in (transition-out pending).
+		 */
+		raw_spin_lock_irqsave(&ws->entry_lock, flags);
+		partial_ns   = ktime_get_ns() - ktime_to_ns(ws-

Quoted 1 line

last_ts);

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+		running_ns   = ws->running_ns  +
+			       (curr_state == running_tlob  ?

partial_ns : 0);

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+		waiting_ns   = ws->waiting_ns  +
+			       (curr_state == waiting_tlob  ?

partial_ns : 0);

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+		sleeping_ns  = ws->sleeping_ns +
+			       (curr_state == sleeping_tlob ?

partial_ns : 0);

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+		raw_spin_unlock_irqrestore(&ws->entry_lock, flags);
+
+		trace_detail_env_tlob(da_get_id(da_mon), ws-

Quoted 1 line

threshold_ns,

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+				      running_ns, waiting_ns,

sleeping_ns);

kernel/trace/rv/monitors/tlob/tlob.c new file +6 -0

+	}
+}
+
+#define BUDGET_NS(ha_mon) (ha_get_target(ha_mon)->threshold_ns)
+
+/* HA constraint functions (called by ha_monitor_handle_constraint)

*/

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+
+static u64 ha_get_env(struct ha_monitor *ha_mon, enum envs_tlob env,

u64 time_ns)

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+
+/*
+ * ha_verify_invariants - clk_elapsed < BUDGET_NS must hold in all

states.
+ *
+ * The invariant is uniform across running/waiting/sleeping; check it
+ * unconditionally rather than enumerating each state.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+static inline bool ha_verify_invariants(struct ha_monitor *ha_mon,
+					enum states curr_state, enum

events event,

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+					enum states next_state, u64

time_ns)
+{

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+	return ha_check_invariant_ns(ha_mon, clk_elapsed_tlob,

time_ns);

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+}
+
+/*
+ * Convert invariant (deadline) to guard (reset anchor) on state

transitions.
+ *
+ * The conversion is identical for every departing state; skip only self-loops.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+static inline void ha_convert_inv_guard(struct ha_monitor *ha_mon,
+					enum states curr_state, enum

events event,

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+					enum states next_state, u64

time_ns)

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+{
+	if (curr_state != next_state)
+		ha_inv_to_guard(ha_mon, clk_elapsed_tlob,

BUDGET_NS(ha_mon), time_ns);

kernel/trace/rv/monitors/tlob/tlob.c new file +5 -0

+}
+
+/* No per-event guard conditions for tlob; invariants suffice. */
+static inline bool ha_verify_guards(struct ha_monitor *ha_mon,
+				    enum states curr_state, enum

events event,

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+				    enum states next_state, u64

time_ns)
+{

kernel/trace/rv/monitors/tlob/tlob.c new file +7 -0

+	return true;
+}
+
+/*
+ * Arm or cancel the HA budget timer on state transitions.
+ *
+ * The timer must run in every monitored state

(running/waiting/sleeping),
+ * so arm it whenever next_state is any of the three.  On a self- loop caused
+ * by a non-start event the timer is already running; skip the redundant
+ * restart.  On a true state change the old timer is implicitly superseded by
+ * the new ha_start_timer_ns() call.
+ *
+ * Guard on stopping: sched_switch events can arrive after ha_cancel_timer_sync,
+ * restarting the timer and triggering an ODEBUG "activate active" splat.
+ * The _acquire pairs with the cmpxchg_release in tlob_stop_task.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+static inline void ha_setup_invariants(struct ha_monitor *ha_mon,
+				       enum states curr_state, enum

events event,

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+				       enum states next_state, u64

time_ns)

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+	if (next_state < state_max_tlob) {
+		if (!atomic_read_acquire(&ha_get_target(ha_mon)-

Quoted 1 line

stopping))

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+			ha_start_timer_ns(ha_mon, clk_elapsed_tlob,

BUDGET_NS(ha_mon), time_ns);

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+	} else {
+		ha_cancel_timer(ha_mon);
+	}
+}

+/*
+ * da_extra_cleanup - per-task teardown called by da_monitor_destroy().
+ *
+ * Claims cleanup ownership via CAS; cancels the budget timer; decrements the
+ * monitored-task counter; and schedules the slab free via call_rcu().
+ * Must run before da_monitor_reset() (i.e. before hash_del_rcu()) so that
+ * ha_cancel_timer_sync() can safely access the still-registered ha_monitor.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+static inline void tlob_extra_cleanup(struct da_monitor *da_mon)
+{

kernel/trace/rv/monitors/tlob/tlob.c new file +7 -0

+}
+
+/*
+ * __tlob_acc - accumulate elapsed ns into one per-state counter.
+ *
+ * Looks up the task's tlob_task_state under RCU, adds the interval
+ * [ws->last_ts, now] to the field at @offset within the state

struct,
+ * and updates last_ts.  Returns true if the task is monitored.
+ *
+ * entry_lock is a raw spinlock so this is safe from hardirq context.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +12 -0

+static inline bool __tlob_acc(struct task_struct *task, ktime_t now,
+			       size_t offset)
+{
+	struct tlob_task_state *ws;
+	unsigned long flags;
+
+	scoped_guard(rcu) {
+		ws = da_get_target_by_id(task->pid);
+		if (!ws)
+			return false;
+		raw_spin_lock_irqsave(&ws->entry_lock, flags);
+		*(u64 *)((char *)ws + offset) +=

ktime_to_ns(ktime_sub(now, ws->last_ts));

kernel/trace/rv/monitors/tlob/tlob.c new file +7 -0

+		ws->last_ts = now;
+		raw_spin_unlock_irqrestore(&ws->entry_lock, flags);
+	}
+	return true;
+}
+
+/* Accumulate running_ns for prev; returns true if prev is

monitored. */
+static inline bool tlob_acc_running(struct task_struct *task, ktime_t now)

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+{
+	return __tlob_acc(task, now, offsetof(struct

tlob_task_state, running_ns));

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+}
+
+/* Accumulate waiting_ns for next; returns true if next is

monitored. */
+static inline bool tlob_acc_waiting(struct task_struct *task, ktime_t now)

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+{
+	return __tlob_acc(task, now, offsetof(struct

tlob_task_state, waiting_ns));

kernel/trace/rv/monitors/tlob/tlob.c new file +11 -0

+}
+
+/*
+ * handle_sched_switch - advance the DA on every context switch.
+ *
+ * Generates three DA events:
+ *   prev, prev_state != 0  -> sleep_tlob    (running -> sleeping)
+ *   prev, prev_state == 0  -> preempt_tlob  (running -> waiting)
+ *   next                   -> switch_in_tlob (waiting -> running)
+ *
+ * A single ktime_get() at handler entry is shared by both acc calls

so that
+ * prev's running_ns and next's waiting_ns share the same context- switch
+ * timestamp; neither absorbs handler overhead into its accumulator.
+ *
+ * No waiting->sleeping edge exists: a task can only block voluntarily
+ * (call schedule()) while it is executing on CPU, which corresponds to
+ * the running DA state.  A task in the waiting state is TASK_RUNNING in
+ * kernel terms (on the runqueue) and cannot block itself.
+ *
+ * da_handle_event() is called unconditionally: it skips tasks that have no
+ * monitor entry in the hash table.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +10 -0

+static void handle_sched_switch(void *data, bool preempt_unused,
+				struct task_struct *prev,
+				struct task_struct *next,
+				unsigned int prev_state)
+{
+	ktime_t now = ktime_get();
+	bool prev_preempted = (prev_state == 0);
+
+	/*
+	 * No guard on tlob_num_monitored here: da_handle_event()

internally

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+	 * calls da_monitor_handling_event() which checks both

rv_monitoring_on()

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+	 * and da_monitoring(da_mon).  The hash lookup inside

da_get_monitor()

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+	 * simply returns NULL for unmonitored tasks, which is

equally fast as

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+	 * an atomic_read() guard.  By omitting the guard we avoid

touching the

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+	 * tlob_num_monitored cacheline on every global context-

switch.

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+	 */
+	if (tlob_acc_running(prev, now))
+		da_handle_event(prev->pid, NULL,
+				prev_preempted ? preempt_tlob :

sleep_tlob);

kernel/trace/rv/monitors/tlob/tlob.c new file +5 -0

+	if (tlob_acc_waiting(next, now))
+		da_handle_event(next->pid, NULL, switch_in_tlob);
+}
+
+/* Accumulate sleeping_ns on wakeup; returns true if task is

monitored. */
+static inline bool tlob_acc_sleeping(struct task_struct *task, ktime_t now)

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+{
+	return __tlob_acc(task, now, offsetof(struct

tlob_task_state, sleeping_ns));

kernel/trace/rv/monitors/tlob/tlob.c new file +6 -0

+}
+
+/*
+ * handle_sched_wakeup - sleeping -> waiting transition.
+ *
+ * try_to_wake_up() skips TASK_RUNNING tasks, so this never fires

for a
+ * task already in running or waiting state.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +5 -0

+static void handle_sched_wakeup(void *data, struct task_struct *p)
+{
+	ktime_t now = ktime_get();
+
+	/* Same reasoning as handle_sched_switch: rely on hash-

lookup fast path. */

kernel/trace/rv/monitors/tlob/tlob.c new file +6 -0

+	if (tlob_acc_sleeping(p, now))
+		da_handle_event(p->pid, NULL, wakeup_tlob);
+}
+
+/*
+ * handle_sched_process_exit - clean up if a task exits without

TRACE_STOP.
+ *
+ * Called in do_exit() context; the task still has a valid pid here.
+ * tlob_stop_task() returns -ESRCH if the task is not monitored, which is fine.
+ */
+static void handle_sched_process_exit(void *data, struct task_struct *p,

kernel/trace/rv/monitors/tlob/tlob.c new file +9 -0

+				       bool group_dead)
+{
+	tlob_stop_task(p);
+}
+
+
+
+/**
+ * tlob_start_task - begin monitoring @task with budget

@threshold_ns ns.
+ * @task:         Task to monitor; may be current or another task.
+ * @threshold_ns: Latency budget in nanoseconds (wall-clock; running
+ waiting + sleeping).
+ *                Must be in [1000, TLOB_MAX_THRESHOLD_NS].
+ *
+ * Returns 0, -ENODEV, -ERANGE, -EALREADY, -ENOMEM, or -ENOSPC.
+ */

TLOB_MAX_THRESHOLD_NS)

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+		return -ERANGE;
+
+	/* Serialise duplicate-check + pool-slot claim for the same

pid. */

kernel/trace/rv/monitors/tlob/tlob.c new file +17 -0

+	guard(mutex)(&tlob_start_mutex);
+
+	if (da_get_target_by_id(task->pid))
+		return -EALREADY;
+
+	ws = kmem_cache_zalloc(tlob_state_cache, GFP_KERNEL);
+	if (!ws)
+		return -ENOMEM;
+
+	ws->task = task;
+	get_task_struct(task);
+	ws->threshold_ns = threshold_ns;
+	ws->last_ts = ktime_get();
+	raw_spin_lock_init(&ws->entry_lock);
+
+	/*
+	 * da_handle_start_run_event() claims a pool slot via

da_prepare_storage(),

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+	 * initialises the monitor, and delivers start_tlob in one

step: the

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+	 * generated ha_setup_invariants() resets clk_elapsed and

arms the timer.

kernel/trace/rv/monitors/tlob/tlob.c new file +18 -0

+	 * Returns 0 if the pool is exhausted (-ENOSPC).
+	 */
+	if (!da_handle_start_run_event(task->pid, ws, start_tlob)) {
+		put_task_struct(task);
+		kmem_cache_free(tlob_state_cache, ws);
+		return -ENOSPC;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(tlob_start_task);
+
+/**
+ * tlob_stop_task - stop monitoring @task.
+ * @task: Task to stop.
+ *
+ * CAS on ws->stopping (0->1) under RCU claims cleanup ownership;
+ * the winner cancels the timer synchronously and frees all

resources.
+ *
+ * Returns 0, -EOVERFLOW (budget exceeded), -ESRCH (not monitored),
+ * or -EAGAIN (concurrent caller claimed cleanup).
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +15 -0

+int tlob_stop_task(struct task_struct *task)
+{
+	struct da_monitor *da_mon;
+	struct ha_monitor *ha_mon;
+	struct tlob_task_state *ws;
+	bool budget_exceeded;
+
+	scoped_guard(rcu) {
+		ws = da_get_target_by_id(task->pid);
+		if (!ws)
+			return -ESRCH;
+
+		da_mon = da_get_monitor(task->pid, NULL);
+		if (unlikely(!da_mon)) {
+			/* ws in hash but da_mon gone; internal

inconsistency. */

kernel/trace/rv/monitors/tlob/tlob.c new file +7 -0

+			return -ESRCH;
+		}
+
+		ha_mon = to_ha_monitor(da_mon);
+
+		/*
+		 * CAS (0->1) claims cleanup ownership under RCU (ws

guaranteed valid).

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+		 * _release pairs with atomic_read_acquire in

ha_setup_invariants.

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+		 */
+		if (atomic_cmpxchg_release(&ws->stopping, 0, 1) !=

0)

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+			return -EAGAIN;
+	}
+
+	/* Wait for in-flight timer callback before reading

da_monitoring. */

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+	ha_cancel_timer_sync(ha_mon);
+
+	/* Timer fired first -> budget exceeded; otherwise reset

normally. */

kernel/trace/rv/monitors/tlob/tlob.c new file +15 -0

+	scoped_guard(rcu) {
+		budget_exceeded = !da_monitoring(da_mon);
+		if (!budget_exceeded)
+			da_monitor_reset(da_mon);
+	}
+	da_destroy_storage(task->pid);
+
+	put_task_struct(ws->task);
+	call_rcu(&ws->rcu, tlob_free_rcu);
+	return budget_exceeded ? -EOVERFLOW : 0;
+}
+EXPORT_SYMBOL_GPL(tlob_stop_task);
+
+
+static int tlob_uprobe_entry_handler(struct rv_uprobe *p, struct

pt_regs *regs,

kernel/trace/rv/monitors/tlob/tlob.c new file +9 -0

+				     __u64 *data)
+{
+	struct tlob_uprobe_binding *b = p->priv;
+
+	tlob_start_task(current, b->threshold_ns);
+	return 0;
+}
+
+static int tlob_uprobe_stop_handler(struct rv_uprobe *p, struct

pt_regs *regs,

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+				    __u64 *data)
+{
+	tlob_stop_task(current);

kernel/trace/rv/monitors/tlob/tlob.c new file +27 -0

+	char *canon;
+	int ret;
+
+	if (binpath[0] != '/')
+		return -EINVAL;
+
+	b = kzalloc_obj(*b, GFP_KERNEL);
+	if (!b)
+		return -ENOMEM;
+
+	b->threshold_ns = threshold_ns;
+	b->offset_start = offset_start;
+	b->offset_stop  = offset_stop;
+
+	ret = kern_path(binpath, LOOKUP_FOLLOW, &path);
+	if (ret)
+		goto err_free;
+
+	if (!d_is_reg(path.dentry)) {
+		ret = -EINVAL;
+		goto err_path;
+	}
+
+	/* Reject duplicate start offset for the same binary. */
+	list_for_each_entry(tmp_b, &tlob_uprobe_list, list) {
+		if (tmp_b->offset_start == offset_start &&
+		    tmp_b->start_probe->path.dentry == path.dentry)

{

kernel/trace/rv/monitors/tlob/tlob.c new file +13 -0

+			ret = -EEXIST;
+			goto err_path;
+		}
+	}
+
+	canon = d_path(&path, pathbuf, sizeof(pathbuf));
+	if (IS_ERR(canon)) {
+		ret = PTR_ERR(canon);
+		goto err_path;
+	}
+	strscpy(b->binpath, canon, sizeof(b->binpath));
+
+	/* Both probes share b (priv) and path; attach_path refs

path itself. */

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+	b->start_probe = rv_uprobe_attach_path(&path, offset_start,
+					      

tlob_uprobe_entry_handler, NULL, b);

kernel/trace/rv/monitors/tlob/tlob.c new file +8 -0

+	if (IS_ERR(b->start_probe)) {
+		ret = PTR_ERR(b->start_probe);
+		b->start_probe = NULL;
+		goto err_path;
+	}
+
+	b->stop_probe = rv_uprobe_attach_path(&path, offset_stop,
+					     

tlob_uprobe_stop_handler, NULL, b);

kernel/trace/rv/monitors/tlob/tlob.c new file +6 -0

+err_path:
+	path_put(&path);
+err_free:
+	kfree(b);
+	return ret;
+}

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+
+/* Parse "-PATH:OFFSET_START" (ftrace uprobe_events removal

convention). */

kernel/trace/rv/monitors/tlob/tlob.c new file +5 -0

+static void __tlob_destroy_monitor(void)
+{
+	rv_this.enabled = 0;
+	/*
+	 * Remove uprobes first; rv_uprobe_sync() inside ensures all

in-flight

kernel/trace/rv/monitors/tlob/tlob.c new file +6 -0

+	 * handlers have finished before we proceed.
+	 */
+	tlob_remove_all_uprobes();
+
+	/*
+	 * da_monitor_destroy() iterates any remaining entries via

da_extra_cleanup

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+	 * (tlob_extra_cleanup), cancels their timers, and frees

their state.

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+	 * rcu_barrier() inside drains both da_pool_return_cb and

tlob_free_rcu

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+	ha_monitor_destroy();
+	kmem_cache_destroy(tlob_state_cache);
+	tlob_state_cache = NULL;
+}

rv_this.root_d, NULL,

kernel/trace/rv/monitors/tlob/tlob.c new file +8 -0

+					 &tlob_monitor_fops)) {
+			rv_unregister_monitor(&rv_this);
+			return -ENOMEM;
+		}
+	}
+
+	return 0;
+}

kernel/trace/rv/monitors/tlob/tlob.h new file +0 -0

new file mode 100644
index 000000000000..b6724e629c69
@@ -0,0 +1,148 @@

From: Wen Yang <[email protected]>

Introduce rv_uprobe, a thin wrapper around uprobe_consumer providing rv_uprobe_attach_path(), rv_uprobe_attach(), and rv_uprobe_detach() for RV monitors.  An opaque priv pointer is forwarded unchanged to entry/return handlers so monitors can carry per-binding state (e.g. a latency threshold) to the hot path without any global lookup.

rv_uprobe_detach() is fully synchronous (nosync + sync + path_put + kfree), closing the use-after-free window present in open-coded patterns where kfree() precedes uprobe_unregister_sync().

Suggested-by Gabriele Monaco <[email protected]>

Signed-off-by Wen Yang <[email protected]>

From: Wen Yang <[email protected]>

verificationtest-ktap used CWD-relative paths which broke when invoked outside the verification directory (e.g. via vng).

Resolve paths via realpath "$(dirname "$0")" so the script works from any working directory.  Accept an optional subdirectory argument interpreted relative to the script's directory.

Suggested-by Gabriele Monaco <[email protected]>

Signed-off-by Wen Yang <[email protected]>

---
 tools/testing/selftests/verification/verificationtest-ktap | 4 +++-

 1 file changed, 3 insertions(+), 1 deletion(-)

(quoted diff) +0 -0

ktap b/tools/testing/selftests/verification/verificationtest-ktap index 18f7fe324e2f..055747cef38a 100755

tools/testing/selftests/verification/verificationtest-ktap +0 -0

@@ -5,4 +5,6 @@
  #
  # Copyright (C) Arm Ltd., 2023

-../ftrace/ftracetest -K -v --rv ../verification

tools/testing/selftests/verification/verificationtest-ktap +3 -0

+dir=$(realpath "$(dirname "$0")")
+testdir=$(cd "$dir" && realpath "${1:-.}")
+"$dir/../ftrace/ftracetest" -K -v --rv "$testdir"

From: Wen Yang <[email protected]>

Add selftest coverage for the tlob uprobe monitoring interface under tools/testing/selftests/verification/.

test.d/tlob/ contains both the helper sources (tlob_target, tlob_sym) and the seven test scripts so the test suite is self-contained. tlob_target provides busy-spin, sleep, and preempt workloads; tlob_sym
resolves ELF symbol offsets for uprobe registration.

Seven test scripts exercise uprobe binding management, budget violation
detection, and per-state time accounting (running_ns, waiting_ns, sleeping_ns).

Signed-off-by Wen Yang <[email protected]>

---
 .../testing/selftests/verification/.gitignore |   2 + tools/testing/selftests/verification/Makefile |  19 +- .../verification/test.d/tlob/Makefile         |  20 ++ .../verification/test.d/tlob/test.d/functions |   1 +

+/*
+ * Valid add lines return -ENOENT (kern_path() finds no such file in the test
+ * environment) rather than 0; a non-(-EINVAL) return confirms the format was
+ * accepted by the parser.
+ */

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +8 -0

+static void tlob_parse_valid_accepted(struct kunit *test)
+{
+	char buf[128];
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(tlob_parse_valid); i++) {
+		strscpy(buf, tlob_parse_valid[i], sizeof(buf));
+		KUNIT_EXPECT_NE(test,

tlob_create_or_delete_uprobe(buf), -EINVAL);

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +11 -0

+	}
+}
+
+static void tlob_parse_invalid_rejected(struct kunit *test)
+{
+	char buf[128];
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(tlob_parse_invalid); i++) {
+		strscpy(buf, tlob_parse_invalid[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test,

tlob_create_or_delete_uprobe(buf), -EINVAL);

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +10 -0

+	}
+}
+
+static void tlob_parse_out_of_range_rejected(struct kunit *test)
+{
+	char buf[128];
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(tlob_parse_out_of_range); i++) {
+		strscpy(buf, tlob_parse_out_of_range[i],

sizeof(buf));

(quoted diff) +1 -0

+		KUNIT_EXPECT_EQ(test,

tlob_create_or_delete_uprobe(buf), -ERANGE);

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +19 -0

+	}
+}
+
+static struct kunit_case tlob_parse_cases[] = {
+	KUNIT_CASE(tlob_parse_valid_accepted),
+	KUNIT_CASE(tlob_parse_invalid_rejected),
+	KUNIT_CASE(tlob_parse_out_of_range_rejected),
+	{}
+};
+
+static struct kunit_suite tlob_parse_suite = {
+	.name       = "tlob_parse",
+	.test_cases = tlob_parse_cases,
+};
+
+kunit_test_suite(tlob_parse_suite);
+
+MODULE_DESCRIPTION("KUnit tests for the tlob RV monitor");
+MODULE_LICENSE("GPL");

From: Wen Yang <[email protected]>

Add selftest coverage for the tlob uprobe monitoring interface under tools/testing/selftests/verification/.

test.d/tlob/ contains both the helper sources (tlob_target, tlob_sym) and the seven test scripts so the test suite is self-contained. tlob_target provides busy-spin, sleep, and preempt workloads; tlob_sym
resolves ELF symbol offsets for uprobe registration.

Seven test scripts exercise uprobe binding management, budget violation
detection, and per-state time accounting (running_ns, waiting_ns, sleeping_ns).

Signed-off-by Wen Yang <[email protected]>

---
 .../testing/selftests/verification/.gitignore |   2 + tools/testing/selftests/verification/Makefile |  19 +- .../verification/test.d/tlob/Makefile         |  20 ++ .../verification/test.d/tlob/test.d/functions |   1 + .../verification/test.d/tlob/tlob_sym.c       | 189
++++++++++++++++++
 .../verification/test.d/tlob/tlob_target.c    | 138 +++++++++++++ .../verification/test.d/tlob/uprobe_bind.tc   |  37 ++++

 .../test.d/tlob/uprobe_detail_running.tc      |  51 +++++ .../test.d/tlob/uprobe_detail_sleeping.tc     |  50 +++++ .../test.d/tlob/uprobe_detail_waiting.tc      |  66 ++++++

a/tools/testing/selftests/verification/test.d/tlob/tlob_sym.c b/tools/testing/selftests/verification/test.d/tlob/tlob_sym.c new file mode 100644
index 000000000000..1b7ba1c6d95b

diff --git a/tools/testing/selftests/verification/test.d/tlob/tlob_target.c b/tools/testing/selftests/verification/test.d/tlob/tlob_target.c new file mode 100644
index 000000000000..0fdbc575d71d

tools/testing/selftests/verification/test.d/tlob/tlob_target.c new file +5 -0

@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * tlob_target.c - uprobe target binary for tlob selftests.
+ *
+ * Provides three start/stop probe pairs, each designed to exercise

a
+ * different dominant component of the detail_env_tlob ns breakdown:

+ *
+ *   tlob_busy_work    / tlob_busy_work_done    - busy-spin:
running_ns dominates
+ *   tlob_sleep_work   / tlob_sleep_work_done   - nanosleep:
sleeping_ns dominates
+ *   tlob_preempt_work / tlob_preempt_work_done - busy-spin:
waiting_ns dominates
+ *                                                (needs an RT

diff --git a/tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc b/tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc new file mode 100644
index 000000000000..1ac3db6ca7bb

tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc new file +3 -0

@@ -0,0 +1,37 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+# description: Test tlob monitor uprobe binding (visible in monitor

file, removable, duplicate rejected)

tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc new file +3 -0

+TLOB_MONITOR=monitors/tlob/monitor
+
+busy_offset=$("$TLOB_SYM" sym_offset "$UPROBE_TARGET" tlob_busy_work

2>/dev/null)
+stop_offset=$("$TLOB_SYM" sym_offset "$UPROBE_TARGET" tlob_busy_work_done 2>/dev/null)

+[ -n "$busy_offset" ] || exit_unsupported
+[ -n "$stop_offset" ] || exit_unsupported

From: Wen Yang <[email protected]>

+grep -qE "^p ${UPROBE_TARGET}:0x[0-9a-f]+ 0x[0-9a-f]+ threshold=[0- 9]+$" "$TLOB_MONITOR"

tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc new file +3 -0

+grep -q "threshold=5000000000" "$TLOB_MONITOR"
+
+! echo "p ${UPROBE_TARGET}:${busy_offset} ${stop_offset}

threshold=9999000" > "$TLOB_MONITOR" 2>/dev/null

tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc new file +3 -0

+
+echo "-${UPROBE_TARGET}:${busy_offset}" > "$TLOB_MONITOR"
+! grep -q "^p .*:0x${busy_offset#0x} " "$TLOB_MONITOR"

+! grep -q "error_env_tlob" /sys/kernel/tracing/trace

tools/testing/selftests/verification/test.d/tlob/uprobe_multi.tc new file +3 -0

+echo 0 > monitors/tlob/enable
+echo 0 > /sys/kernel/tracing/events/rv/error_env_tlob/enable
+echo > /sys/kernel/tracing/trace

diff --git a/tools/testing/selftests/verification/test.d/tlob/uprobe_violation.t c b/tools/testing/selftests/verification/test.d/tlob/uprobe_violation.t c
new file mode 100644
index 000000000000..d210d9c3a92d
--- /dev/null
+++
b/tools/testing/selftests/verification/test.d/tlob/uprobe_violation.t c

tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc new file +3 -0

@@ -0,0 +1,67 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+# description: Test tlob monitor budget violation (error_env_tlob

and detail_env_tlob fire with correct fields)

tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc new file +10 -0

+# requires: tlob:monitor
+
+RV_BINDIR="${RV_BINDIR:-$(realpath "$(dirname "${1:-$0}")")}"
+UPROBE_TARGET="${RV_BINDIR}/tlob_target"
+TLOB_SYM="${RV_BINDIR}/tlob_sym"
+[ -x "$UPROBE_TARGET" ] || exit_unsupported
+[ -x "$TLOB_SYM" ]      || exit_unsupported
+TLOB_MONITOR=monitors/tlob/monitor
+
+busy_offset=$("$TLOB_SYM" sym_offset "$UPROBE_TARGET" tlob_busy_work

2>/dev/null)
+stop_offset=$("$TLOB_SYM" sym_offset "$UPROBE_TARGET" tlob_busy_work_done 2>/dev/null)

+[ -n "$busy_offset" ] || exit_unsupported
+[ -n "$stop_offset" ] || exit_unsupported

tools/testing/selftests/verification/test.d/tlob/uprobe_violation.tc new file +12 -0

+
+"$UPROBE_TARGET" 30000 &
+busy_pid=$!
+sleep 0.05
+
+echo 1 > /sys/kernel/tracing/events/rv/error_env_tlob/enable
+echo 1 > /sys/kernel/tracing/events/rv/detail_env_tlob/enable
+echo 1 > /sys/kernel/tracing/tracing_on
+echo 1 > monitors/tlob/enable
+echo > /sys/kernel/tracing/trace
+
+# 10 µs budget - fires almost immediately; task is busy-spinning on-

CPU.
+echo "p ${UPROBE_TARGET}:${busy_offset} ${stop_offset} threshold=10000" > "$TLOB_MONITOR"

tools/testing/selftests/verification/test.d/tlob/uprobe_violation.tc new file +6 -0

+
+# wait up to 2 s for detail_env_tlob
+found=0; i=0
+while [ "$i" -lt 20 ]; do
+	sleep 0.1
+	grep -q "detail_env_tlob" /sys/kernel/tracing/trace && {

found=1; break; }

tools/testing/selftests/verification/test.d/tlob/uprobe_detail_running.tc new file +4 -0

+	i=$((i+1))
+done
+
+echo "-${UPROBE_TARGET}:${busy_offset}" > "$TLOB_MONITOR"

2>/dev/null
+kill "$busy_pid" 2>/dev/null || true; wait "$busy_pid" 2>/dev/null || true

tools/testing/selftests/verification/test.d/tlob/uprobe_violation.tc new file +8 -0

+echo 0 > /sys/kernel/tracing/events/rv/error_env_tlob/enable
+echo 0 > /sys/kernel/tracing/events/rv/detail_env_tlob/enable
+echo 0 > monitors/tlob/enable
+
+[ "$found" = "1" ]
+
+# error_env_tlob must carry the clk_elapsed environment field.
+# The event label is "budget_exceeded" when detected by the hrtimer

callback,
+# or the triggering sched event name when detected by the constraint path on a
+# preemption that races with the timer (common on PREEMPT_RT / VM). Both are

(quoted diff) +2 -0

+# valid detections; check the env field instead of the label.
+grep "error_env_tlob" /sys/kernel/tracing/trace | head -n 1 | grep -

q "clk_elapsed="

(quoted diff) +2 -0

+
+# detail_env_tlob must have all five fields with the correct

threshold

tools/testing/selftests/verification/test.d/tlob/uprobe_violation.tc new file +8 -0

+line=$(grep "detail_env_tlob" /sys/kernel/tracing/trace | head -n 1)
+echo "$line" | grep -q "pid="
+echo "$line" | grep -q "threshold_ns=10000"
+echo "$line" | grep -q "running_ns="
+echo "$line" | grep -q "waiting_ns="
+echo "$line" | grep -q "sleeping_ns="
+
+# Busy-spin keeps the task on-CPU: running_ns must exceed

sleeping_ns.

tools/testing/selftests/verification/test.d/tlob/uprobe_detail_running.tc new file +5 -0

+running=$(echo "$line" | sed 's/.*running_ns=\([0-9]*\).*/\1/')
+sleeping=$(echo "$line" | sed 's/.*sleeping_ns=\([0-9]*\).*/\1/')
+[ "$running" -gt "$sleeping" ]
+
+echo > /sys/kernel/tracing/trace

Quoted 8 lines · On Mon, 2026-06-08 at 00:13 +0800, [email protected] wrote:

From: Wen Yang <[email protected]>

Introduce rv_uprobe, a thin wrapper around uprobe_consumer providing rv_uprobe_attach_path(), rv_uprobe_attach(), and rv_uprobe_detach() for RV monitors.  An opaque priv pointer is forwarded unchanged to entry/return handlers so monitors can carry per-binding state (e.g. a latency threshold) to the hot path without any global lookup.

Quoted 6 lines

rv_uprobe_detach() is fully synchronous (nosync + sync + path_put + kfree), closing the use-after-free window present in open-coded patterns where kfree() precedes uprobe_unregister_sync().

Suggested-by Gabriele Monaco <[email protected]>

Signed-off-by Wen Yang <[email protected]>

I find your implementation solid, but I wonder if it isn't a bit overdoing it. It's good to have helper functions abstracting away the common uprobes code, but I find the number of structures used to indirect/hide the process a bit confusing.

Users of this headers still know they're using uprobes, so we don't really need to hide it that much, plus the double function pointers are an additional performance hit we could easily skip.

As I get it, we want to pass a private pointer (essentially to get the threshold in tlob) and the uprobe infrastructure doesn't allow that transparently. So let's keep on using struct embedding but a bit more cut to the bone:

	struct rv_uprobe {
		struct uprobe_consumer	uc;
		struct uprobe		*uprobe;
		void			*priv;
	};

Then handlers would use container_of() appropriately to derive the data they need.

	static int tlob_uprobe_entry_handler(struct uprobe_consumer *self, struct pt_regs *regs, __u64 *data)
	{
		struct rv_uprobe *p = container_of(self, struct rv_uprobe, uc);
		struct tlob_uprobe_binding *b = p->priv;

		...
	}

You could even define the struct directly inside your private data and save one step (and no void *):

	struct rv_uprobe {
		struct uprobe_consumer	uc;
		struct uprobe		*uprobe;
	};

	#define DECLARE_RV_UPROBE(name) struct rv_uprobe name

	// And then

	struct tlob_uprobe_binding {
		u64 threshold_ns;
		...
		DECLARE_RV_UPROBE(start);
		DECLARE_RV_UPROBE(stop);
	}

	static int tlob_uprobe_entry_handler(struct uprobe_consumer *self, struct pt_regs *regs, __u64 *data)
	{
		struct tlob_uprobe_binding *b = container_of(self, struct tlob_uprobe_binding, start.uc);

		...
	}

Now I intentionally skipped offset, as I don't really see why carry it around, and path, as we could live without it by relying on inodes (uprobes reference-track them but you'd need to save them somewhere).

Mind, I only build tested this idea (appended after). This was supported by an LLM which did a few more changes like standardising names and return values of registration functions (a bit more consistent with other stuff, you don't have to commit with that though).

By the way, do we really need the duplicate check? Would it break if a user defines it twice? If not, we could simplify the tlob_add_uprobe() even further and doing all path related checks in the library, since those aren't quite tlob specific.

Thoughts?

Gabriele

**Suggested simplification:**

---

include/rv/rv_uprobe.h +31 -72

index 9106c5c927..4fb3f50a63 100644
@@ -7,83 +7,56 @@
  #ifndef _RV_UPROBE_H
  #define _RV_UPROBE_H
 
-#include <linux/path.h>
  #include <linux/types.h>
+#include <linux/uprobes.h>
 
  struct pt_regs;
+struct inode;
 
  /**
   * struct rv_uprobe - a single uprobe registered on behalf of an RV monitor
   *
- * @offset:   byte offset within the ELF binary where the probe is installed
- * @priv:     monitor-private pointer; set at attach time, never touched by
- *            this layer; passed unchanged to entry_fn / ret_fn
- * @path:     resolved path of the probed binary (read-only after attach);
- *            callers may use path.dentry for identity comparisons
- *
- * The implementation fields (uprobe_consumer, uprobe handle, callbacks) are
- * private to rv_uprobe.c and are not exposed here; monitors must not access
- * them directly.
+ * @uc:       underlying uprobe consumer (publicly visible)
+ * @uprobe:   active uprobe structure handle
+ * @inode:    inode of the target binary (read-only after registration)
   */
  struct rv_uprobe {
-	/* public: read-only after rv_uprobe_attach*() */
-	loff_t		 offset;
-	void		*priv;
-	struct path	 path;
+	struct uprobe_consumer	uc;
+	struct uprobe		*uprobe;
+	struct inode		*inode;
  };
 
-/**
- * rv_uprobe_attach_path - register an uprobe given an already-resolved path
- * @path:     path of the target binary; rv_uprobe takes its own reference
- * @offset:   byte offset within the binary
- * @entry_fn: called on probe hit (entry); may be NULL
- * @ret_fn:   called on function return (uretprobe); may be NULL
- * @priv:     opaque pointer forwarded to callbacks unchanged
- *
- * Use this variant when the caller has already resolved the path (e.g. to
- * register multiple probes on the same binary with a single kern_path call).
- * The inode is derived internally via d_real_inode(), so inode and path are
- * always consistent.
- *
- * Returns a pointer to the new rv_uprobe on success, ERR_PTR on failure.
- */
-struct rv_uprobe *rv_uprobe_attach_path(struct path *path, loff_t offset,
-	int (*entry_fn)(struct rv_uprobe *p, struct pt_regs *regs, __u64 *data),
-	int (*ret_fn)(struct rv_uprobe *p, unsigned long func,
-			struct pt_regs *regs, __u64 *data),
-	void *priv);
+/* Seamless inline declaration of a named uprobe inside user structs */
+#define DECLARE_RV_UPROBE(name) \
+	struct rv_uprobe name
 
  /**
- * rv_uprobe_attach - resolve binpath and register an uprobe
- * @binpath:  absolute path to the target binary
- * @offset:   byte offset within the binary
- * @entry_fn: called on probe hit (entry); may be NULL
- * @ret_fn:   called on function return (uretprobe); may be NULL
- * @priv:     opaque pointer forwarded to callbacks unchanged
+ * rv_uprobe_register - resolve binpath and register an uprobe
+ * @binpath:     absolute path to the target binary
+ * @offset:      byte offset within the binary
+ * @p:           pointer to the allocated/embedded rv_uprobe structure
+ * @handler:     called on probe hit (entry); may be NULL
+ * @ret_handler: called on function return (uretprobe); may be NULL
   *
- * Resolves binpath via kern_path(), then delegates to rv_uprobe_attach_path().
+ * Resolves binpath via kern_path(), registers the uprobe directly using the
+ * embedded `uprobe_consumer`, and immediately releases the path reference.
   *
- * Returns a pointer to the new rv_uprobe on success, ERR_PTR on failure.
+ * Returns 0 on success, or a negative error code on failure.
   */
-struct rv_uprobe *rv_uprobe_attach(const char *binpath, loff_t offset,
-	int (*entry_fn)(struct rv_uprobe *p, struct pt_regs *regs, __u64 *data),
-	int (*ret_fn)(struct rv_uprobe *p, unsigned long func,
-			struct pt_regs *regs, __u64 *data),
-	void *priv);
+int rv_uprobe_register(const char *binpath, loff_t offset, struct rv_uprobe *p,
+	int (*handler)(struct uprobe_consumer *self, struct pt_regs *regs, __u64 *data),
+	int (*ret_handler)(struct uprobe_consumer *self, unsigned long func,
+			   struct pt_regs *regs, __u64 *data));
 
  /**
- * rv_uprobe_detach - synchronously unregister an uprobe and free it
- * @p:  probe to detach; may be NULL (no-op)
- *
- * Calls uprobe_unregister_nosync(), then uprobe_unregister_sync() to wait
- * for any in-progress handler to finish, then releases the path reference
- * and frees the rv_uprobe struct.  The caller's priv data is NOT freed.
+ * rv_uprobe_unregister - synchronously unregister a uprobe
+ * @p:  probe to unregister; may be NULL (no-op)
   *
- * When removing a single probe, prefer this over the three-phase API.
- * Safe to call from process context only (uprobe_unregister_sync() may
- * schedule).
+ * Dequeues the uprobe and waits synchronously for all in-flight handlers
+ * to complete.
   */
-void rv_uprobe_detach(struct rv_uprobe *p);
+void rv_uprobe_unregister(struct rv_uprobe *p);
 
  /**
   * rv_uprobe_unregister_nosync - dequeue an uprobe without waiting

@@ -91,9 +64,7 @@ void rv_uprobe_detach(struct rv_uprobe *p);
   *
   * Removes the uprobe from the uprobe subsystem but does NOT wait for
   * in-flight handlers to complete.  The caller must call rv_uprobe_sync()
- * before calling rv_uprobe_free() on the same probe.
- *
- * Use this to batch multiple deregistrations before a single rv_uprobe_sync().
+ * before freeing any container holding this probe.
   */
  void rv_uprobe_unregister_nosync(struct rv_uprobe *p);
 

@@ -101,19 +72,8 @@ void rv_uprobe_unregister_nosync(struct rv_uprobe *p);
   * rv_uprobe_sync - wait for all in-flight uprobe handlers to complete
   *
   * Global barrier: waits for every in-flight uprobe handler across the system
- * to finish.  Call once after a batch of rv_uprobe_unregister_nosync() calls
- * and before any rv_uprobe_free() call.
+ * to finish.
   */
  void rv_uprobe_sync(void);
 
-/**
- * rv_uprobe_free - release resources of a previously deregistered probe
- * @p:  probe to free; may be NULL (no-op)
- *
- * Releases the path reference and frees the rv_uprobe struct.  Must only
- * be called after rv_uprobe_sync() has returned.  The caller's priv data
- * is NOT freed.
- */
-void rv_uprobe_free(struct rv_uprobe *p);
-
  #endif /* _RV_UPROBE_H */

kernel/trace/rv/monitors/tlob/tlob.c +30 -30

index d8e0c47947..28a6c740c7 100644
@@ -252,8 +252,8 @@ struct tlob_uprobe_binding {
  	char			binpath[TLOB_MAX_PATH];
  	loff_t			offset_start;
  	loff_t			offset_stop;
-	struct rv_uprobe	*start_probe;
-	struct rv_uprobe	*stop_probe;
+	DECLARE_RV_UPROBE(start_probe);
+	DECLARE_RV_UPROBE(stop_probe);
  };
 
  /* RCU callback: free the slab once no readers remain. */

@@ -512,16 +512,16 @@ int tlob_stop_task(struct task_struct *task)
  EXPORT_SYMBOL_GPL(tlob_stop_task);
 
 
-static int tlob_uprobe_entry_handler(struct rv_uprobe *p, struct pt_regs *regs,
+static int tlob_uprobe_entry_handler(struct uprobe_consumer *self, struct pt_regs *regs,
  				     __u64 *data)
  {
-	struct tlob_uprobe_binding *b = p->priv;
+	struct tlob_uprobe_binding *b = container_of(self, struct tlob_uprobe_binding, start_probe.uc);
 
  	tlob_start_task(current, b->threshold_ns);
  	return 0;
  }
 
-static int tlob_uprobe_stop_handler(struct rv_uprobe *p, struct pt_regs *regs,
+static int tlob_uprobe_stop_handler(struct uprobe_consumer *self, struct pt_regs *regs,
  				    __u64 *data)
  {
  	tlob_stop_task(current);

@@ -537,6 +537,7 @@ static int tlob_add_uprobe(u64 threshold_ns, const char *binpath,
  {
  	struct tlob_uprobe_binding *b, *tmp_b;
  	char pathbuf[TLOB_MAX_PATH];
+	struct inode *inode;
  	struct path path;
  	char *canon;
  	int ret;

@@ -561,10 +562,12 @@ static int tlob_add_uprobe(u64 threshold_ns, const char *binpath,
  		goto err_path;
  	}
 
-	/* Reject duplicate start offset for the same binary. */
+	inode = d_real_inode(path.dentry);
+
+	/* Reject duplicate start offset for the same binary inode. */
  	list_for_each_entry(tmp_b, &tlob_uprobe_list, list) {
  		if (tmp_b->offset_start == offset_start &&
-		    tmp_b->start_probe->path.dentry == path.dentry) {
+		    tmp_b->start_probe.inode == inode) {
  			ret = -EEXIST;
  			goto err_path;
  		}

@@ -577,29 +580,25 @@ static int tlob_add_uprobe(u64 threshold_ns, const char *binpath,
  	}
  	strscpy(b->binpath, canon, sizeof(b->binpath));
 
-	/* Both probes share b (priv) and path; attach_path refs path itself. */
-	b->start_probe = rv_uprobe_attach_path(&path, offset_start,
-					       tlob_uprobe_entry_handler, NULL, b);
-	if (IS_ERR(b->start_probe)) {
-		ret = PTR_ERR(b->start_probe);
-		b->start_probe = NULL;
-		goto err_path;
-	}
+	path_put(&path);
+
+	/* Both probes are registered directly on the embedded fields */
+	ret = rv_uprobe_register(b->binpath, offset_start, &b->start_probe,
+				 tlob_uprobe_entry_handler, NULL);
+	if (ret)
+		goto err_free;
 
-	b->stop_probe = rv_uprobe_attach_path(&path, offset_stop,
-					      tlob_uprobe_stop_handler, NULL, b);
-	if (IS_ERR(b->stop_probe)) {
-		ret = PTR_ERR(b->stop_probe);
-		b->stop_probe = NULL;
+	ret = rv_uprobe_register(b->binpath, offset_stop, &b->stop_probe,
+				 tlob_uprobe_stop_handler, NULL);
+	if (ret)
  		goto err_start;
-	}
 
-	path_put(&path);
  	list_add_tail(&b->list, &tlob_uprobe_list);
  	return 0;
 
  err_start:
-	rv_uprobe_detach(b->start_probe);
+	rv_uprobe_unregister(&b->start_probe);
+	goto err_free;
  err_path:
  	path_put(&path);
  err_free:

@@ -611,21 +610,24 @@ static int tlob_remove_uprobe_by_key(loff_t offset_start, const char *binpath)
  {
  	struct tlob_uprobe_binding *b, *tmp;
  	struct path remove_path;
+	struct inode *inode;
  	int ret;
 
  	ret = kern_path(binpath, LOOKUP_FOLLOW, &remove_path);
  	if (ret)
  		return ret;
 
+	inode = d_real_inode(remove_path.dentry);
+
  	ret = -ENOENT;
  	list_for_each_entry_safe(b, tmp, &tlob_uprobe_list, list) {
  		if (b->offset_start != offset_start)
  			continue;
-		if (b->start_probe->path.dentry != remove_path.dentry)
+		if (b->start_probe.inode != inode)
  			continue;
  		list_del(&b->list);
-		rv_uprobe_detach(b->start_probe);
-		rv_uprobe_detach(b->stop_probe);
+		rv_uprobe_unregister(&b->start_probe);
+		rv_uprobe_unregister(&b->stop_probe);
  		kfree(b);
  		ret = 0;
  		break;

@@ -643,8 +645,8 @@ static void tlob_remove_all_uprobes(void)
  	mutex_lock(&tlob_uprobe_mutex);
  	list_for_each_entry_safe(b, tmp, &tlob_uprobe_list, list) {
  		list_move(&b->list, &pending);
-		rv_uprobe_unregister_nosync(b->start_probe);
-		rv_uprobe_unregister_nosync(b->stop_probe);
+		rv_uprobe_unregister_nosync(&b->start_probe);
+		rv_uprobe_unregister_nosync(&b->stop_probe);
  	}
  	mutex_unlock(&tlob_uprobe_mutex);
 

@@ -658,8 +660,6 @@ static void tlob_remove_all_uprobes(void)
  	rv_uprobe_sync();
 
  	list_for_each_entry_safe(b, tmp, &pending, list) {
-		rv_uprobe_free(b->start_probe);
-		rv_uprobe_free(b->stop_probe);
  		kfree(b);
  	}
  }

kernel/trace/rv/rv_uprobe.c +36 -127

index 3d8b764dde..69b8b0c27e 100644
@@ -10,149 +10,74 @@
  #include <linux/uprobes.h>
  #include <rv/rv_uprobe.h>
 
-/*
- * Private extension of struct rv_uprobe.  Allocated by rv_uprobe_attach*()
- * and returned to callers as &impl->pub.
- */
-struct rv_uprobe_impl {
-	struct rv_uprobe	pub;	/* must be first; callers hold &pub */
-	struct uprobe_consumer	uc;
-	struct uprobe		*uprobe;
-	int (*entry_fn)(struct rv_uprobe *p, struct pt_regs *regs, __u64 *data);
-	int (*ret_fn)(struct rv_uprobe *p, unsigned long func,
-			struct pt_regs *regs, __u64 *data);
-};
-
-static int rv_uprobe_handler(struct uprobe_consumer *uc,
-			     struct pt_regs *regs, __u64 *data)
-{
-	struct rv_uprobe_impl *impl = container_of(uc, struct rv_uprobe_impl, uc);
-
-	if (impl->entry_fn)
-		return impl->entry_fn(&impl->pub, regs, data);
-	return 0;
-}
-
-static int rv_uprobe_ret_handler(struct uprobe_consumer *uc,
-				 unsigned long func,
-				 struct pt_regs *regs, __u64 *data)
-{
-	struct rv_uprobe_impl *impl = container_of(uc, struct rv_uprobe_impl, uc);
-
-	if (impl->ret_fn)
-		return impl->ret_fn(&impl->pub, func, regs, data);
-	return 0;
-}
-
-static struct rv_uprobe *
-__rv_uprobe_attach(struct inode *inode, struct path *path, loff_t offset,
-		   int (*entry_fn)(struct rv_uprobe *p, struct pt_regs *regs, __u64 *data),
-		   int (*ret_fn)(struct rv_uprobe *p, unsigned long func,
-				   struct pt_regs *regs, __u64 *data),
-		   void *priv)
-{
-	struct rv_uprobe_impl *impl;
-	int ret;
-
-	if (!entry_fn && !ret_fn)
-		return ERR_PTR(-EINVAL);
-
-	impl = kzalloc_obj(*impl, GFP_KERNEL);
-	if (!impl)
-		return ERR_PTR(-ENOMEM);
-
-	impl->pub.offset = offset;
-	impl->pub.priv   = priv;
-	impl->entry_fn   = entry_fn;
-	impl->ret_fn     = ret_fn;
-	path_get(path);
-	impl->pub.path   = *path;
-
-	if (entry_fn)
-		impl->uc.handler     = rv_uprobe_handler;
-	if (ret_fn)
-		impl->uc.ret_handler = rv_uprobe_ret_handler;
-
-	impl->uprobe = uprobe_register(inode, offset, 0, &impl->uc);
-	if (IS_ERR(impl->uprobe)) {
-		ret = PTR_ERR(impl->uprobe);
-		path_put(&impl->pub.path);
-		kfree(impl);
-		return ERR_PTR(ret);
-	}
-
-	return &impl->pub;
-}
-
-/**
- * rv_uprobe_attach_path - register an uprobe given an already-resolved path
- */
-struct rv_uprobe *rv_uprobe_attach_path(struct path *path, loff_t offset,
-	int (*entry_fn)(struct rv_uprobe *p, struct pt_regs *regs, __u64 *data),
-	int (*ret_fn)(struct rv_uprobe *p, unsigned long func,
-			struct pt_regs *regs, __u64 *data),
-	void *priv)
-{
-	struct inode *inode = d_real_inode(path->dentry);
-
-	return __rv_uprobe_attach(inode, path, offset, entry_fn, ret_fn, priv);
-}
-EXPORT_SYMBOL_GPL(rv_uprobe_attach_path);
-
  /**
- * rv_uprobe_attach - resolve binpath and register an uprobe
+ * rv_uprobe_register - resolve binpath and register an uprobe
   */
-struct rv_uprobe *rv_uprobe_attach(const char *binpath, loff_t offset,
-	int (*entry_fn)(struct rv_uprobe *p, struct pt_regs *regs, __u64 *data),
-	int (*ret_fn)(struct rv_uprobe *p, unsigned long func,
-			struct pt_regs *regs, __u64 *data),
-	void *priv)
+int rv_uprobe_register(const char *binpath, loff_t offset, struct rv_uprobe *p,
+	int (*handler)(struct uprobe_consumer *self, struct pt_regs *regs, __u64 *data),
+	int (*ret_handler)(struct uprobe_consumer *self, unsigned long func,
+			   struct pt_regs *regs, __u64 *data))
  {
-	struct rv_uprobe *p;
+	struct inode *inode;
  	struct path path;
  	int ret;
 
+	if (!handler && !ret_handler)
+		return -EINVAL;
+
  	ret = kern_path(binpath, LOOKUP_FOLLOW, &path);
  	if (ret)
-		return ERR_PTR(ret);
+		return ret;
 
  	if (!d_is_reg(path.dentry)) {
  		path_put(&path);
-		return ERR_PTR(-EINVAL);
+		return -EINVAL;
  	}
 
-	p = rv_uprobe_attach_path(&path, offset, entry_fn, ret_fn, priv);
+	inode = d_real_inode(path.dentry);
+
+	p->uc.handler     = handler;
+	p->uc.ret_handler = ret_handler;
+	p->inode          = inode;
+
+	p->uprobe = uprobe_register(inode, offset, 0, &p->uc);
  	path_put(&path);
-	return p;
+
+	if (IS_ERR(p->uprobe)) {
+		ret = PTR_ERR(p->uprobe);
+		p->uprobe = NULL;
+		p->inode  = NULL;
+		return ret;
+	}
+
+	return 0;
  }
-EXPORT_SYMBOL_GPL(rv_uprobe_attach);
+EXPORT_SYMBOL_GPL(rv_uprobe_register);
 
  /**
- * rv_uprobe_detach - synchronously unregister an uprobe and free it
+ * rv_uprobe_unregister - synchronously unregister a uprobe
   */
-void rv_uprobe_detach(struct rv_uprobe *p)
+void rv_uprobe_unregister(struct rv_uprobe *p)
  {
-	if (!p)
+	if (!p || IS_ERR_OR_NULL(p->uprobe))
  		return;
 
  	rv_uprobe_unregister_nosync(p);
  	rv_uprobe_sync();
-	rv_uprobe_free(p);
  }
-EXPORT_SYMBOL_GPL(rv_uprobe_detach);
+EXPORT_SYMBOL_GPL(rv_uprobe_unregister);
 
  /**
   * rv_uprobe_unregister_nosync - dequeue an uprobe without waiting
   */
  void rv_uprobe_unregister_nosync(struct rv_uprobe *p)
  {
-	struct rv_uprobe_impl *impl;
-
-	if (!p)
+	if (!p || IS_ERR_OR_NULL(p->uprobe))
  		return;
 
-	impl = container_of(p, struct rv_uprobe_impl, pub);
-	uprobe_unregister_nosync(impl->uprobe, &impl->uc);
+	uprobe_unregister_nosync(p->uprobe, &p->uc);
+	p->uprobe = NULL;
+	p->inode  = NULL;
  }
  EXPORT_SYMBOL_GPL(rv_uprobe_unregister_nosync);
 

@@ -164,19 +89,3 @@ void rv_uprobe_sync(void)
  	uprobe_unregister_sync();
  }
  EXPORT_SYMBOL_GPL(rv_uprobe_sync);
-
-/**
- * rv_uprobe_free - release resources of a previously deregistered probe
- */
-void rv_uprobe_free(struct rv_uprobe *p)
-{
-	struct rv_uprobe_impl *impl;
-
-	if (!p)
-		return;
-
-	impl = container_of(p, struct rv_uprobe_impl, pub);
-	path_put(&p->path);
-	kfree(impl);
-}
-EXPORT_SYMBOL_GPL(rv_uprobe_free);