rv/tlob: Add task latency over budget RV monitor

From: Wen Yang <[email protected]>

Per-object DA storage allocation is currently limited to kmalloc on demand. Add a compile-time selector so monitors can choose among three strategies:

  DA_ALLOC_AUTO   (default) - kmalloc per object on the monitor path DA_ALLOC_POOL             - pre-allocated fixed-size llist pool; selected by defining DA_MON_POOL_SIZE DA_ALLOC_MANUAL           - caller pre-inserts storage; framework only links the target field

The pool strategy uses a lock-free llist (cmpxchg, no spinlock) so pool release is safe from RCU callback context without acquiring a lock. Moving allocation before the measurement window also prevents kmalloc latency.

nomiss is updated to DA_ALLOC_MANUAL.

Suggested-by Gabriele Monaco <[email protected]>

Signed-off-by Wen Yang <[email protected]>

---
 include/rv/da_monitor.h                  | 247 +++++++++++++++++++---- include/rv/ha_monitor.h                  |   6 + kernel/trace/rv/monitors/nomiss/nomiss.c |   6 +-

 3 files changed, 221 insertions(+), 38 deletions(-)

include/rv/da_monitor.h +0 -0

index 34b8fba9ecd4..9c9acc123e3b 100644
@@ -14,7 +14,56 @@
  #ifndef _RV_DA_MONITOR_H
  #define _RV_DA_MONITOR_H

+/*
+ * Allocation strategies for RV_MON_PER_OBJ monitors.
+ *
+ * Select the strategy with a single define before including this header:
+ *
+ *   #define DA_MON_POOL_SIZE N          - pool mode; N pre-allocated slots.
+ *                                         Implies DA_ALLOC_POOL automatically.
+ *   #define DA_MON_ALLOCATION_STRATEGY \
+ *           DA_ALLOC_MANUAL             - manual mode (see below).
+ *   (neither)                           - auto mode (default).
+ *
+ * Do not define both DA_MON_POOL_SIZE and DA_MON_ALLOCATION_STRATEGY.
+ *
+ * DA_ALLOC_AUTO   - lock-free kmalloc on the hot path; unbounded capacity.
+ * DA_ALLOC_POOL   - pre-allocated fixed-size pool; set by defining DA_MON_POOL_SIZE.
+ * DA_ALLOC_MANUAL - caller inserts storage before da_handle_start_event();
+ *                   the framework only links the target field.
+ */

include/rv/da_monitor.h +3 -0

+#define DA_ALLOC_AUTO   0
+#define DA_ALLOC_POOL   1
+#define DA_ALLOC_MANUAL 2

include/rv/da_monitor.h +6 -0

+
+#ifndef DA_MON_ALLOCATION_STRATEGY
+#define DA_MON_ALLOCATION_STRATEGY DA_ALLOC_AUTO
+#endif
+
+/*

+
 #include <rv/automata.h>
+#include <linux/llist.h>
 #include <linux/rv.h>
 #include <linux/stringify.h>
 #include <linux/bug.h>

include/rv/da_monitor.h +0 -0

@@ -66,6 +115,16 @@ static struct rv_monitor rv_this;
  #define da_monitor_sync_hook()
  #endif

include/rv/da_monitor.h +10 -0

+/*
+ * Per-object teardown hook, called after da_monitor_reset_all() +
+ * da_monitor_sync_hook() and before hash_del_rcu() for each entry.
+ * All HA timer callbacks have completed at this point.
+ * Define before including this header.  Default: no-op.
+ */
+#ifndef da_extra_cleanup
+#define da_extra_cleanup(da_mon)
+#endif
+

 /*
  * Type for the target id, default to int but can be overridden.
  * A long type can work as hash table key (PER_OBJ) but will be downgraded to

include/rv/da_monitor.h +1 -0

+	struct llist_node free_node;
  };

 #ifndef DA_MONITOR_HT_BITS

include/rv/da_monitor.h +0 -0

@@ -495,18 +560,6 @@ static inline da_id_type da_get_id(struct da_monitor
 *da_mon)

  return container_of(da_mon, struct da_monitor_storage, rv.da_mon)-

Quoted 1 line

id;

 }

include/rv/da_monitor.h +0 -12

-/*
- * da_create_or_get - create the per-object storage if not already there
- *
- * This needs a lookup so should be guarded by RCU, the condition is checked
- * directly in da_create_storage()
- */
-static inline void da_create_or_get(da_id_type id, monitor_target target)
-{
-	guard(rcu)();
-	da_create_storage(id, target, da_get_monitor(id, target));
-}
-

 /*
  * da_fill_empty_storage - store the target in a pre-allocated storage *

include/rv/da_monitor.h +0 -0

@@ -537,15 +590,79 @@ static inline monitor_target
 da_get_target_by_id(da_id_type id)
  	return mon_storage->target;
  }

+/*
+ * Lock-free llist (cmpxchg) rather than kmem_cache/mempool: on
+ * PREEMPT_RT spinlock_t becomes a sleeping lock, which is forbidden
+ * in the rcuc kthread context where RCU callbacks run.

+ *
+ * Multiple producers (any context, any CPU) call llist_add; a single
+ * consumer (llist_del_first, serialised by the monitor's start lock)

+ * needs no additional synchronisation.
+ *
+ * Per-TU statics: each PER_OBJ monitor gets its own pool instance;
+ * da_pool_storage and da_pool_free_list are NULL/empty and the pool
+ * paths are dead code for non-pool monitors.
+ */

include/rv/da_monitor.h +2 -0

+static struct da_monitor_storage *da_pool_storage;
+static LLIST_HEAD(da_pool_free_list);

+++ b/kernel/trace/rv/monitors/nomiss/nomiss.c

include/rv/da_monitor.h +0 -0

@@ -17,8 +17,8 @@

 #define RV_MON_TYPE RV_MON_PER_OBJ
 #define HA_TIMER_TYPE HA_TIMER_WHEEL
-/* The start condition is on sched_switch, it's dangerous to allocate there */

include/rv/da_monitor.h +1 -1

-#define DA_SKIP_AUTO_ALLOC
+/* Allocate storage in sched_setscheduler; sched_switch is too hot to alloc.

*/
+#define DA_MON_ALLOCATION_STRATEGY DA_ALLOC_MANUAL typedef struct sched_dl_entity *monitor_target; #include "nomiss.h"
 #include <rv/ha_monitor.h>

From: Wen Yang <[email protected]>

include/rv/ha_monitor.h +0 -0

index 28d3c74cabfc..83199f90afe8 100644
@@ -365,6 +365,12 @@ static inline bool ha_check_invariant_ns(struct
 ha_monitor *ha_mon,
  }
  /*
   * ha_invariant_passed_ns - prepare the invariant and return the time since

reset
+ *
+ * If the env has not been initialised yet (first entry into a state with an

+ * invariant), anchor the guard clock at the current time so that the full
+ * budget is available from this point.  This preserves the documented
+ * guard->invariant ordering: ha_set_invariant_ns() is always preceded by a
+ * valid guard representation in env_store.
  */
 static inline u64 ha_invariant_passed_ns(struct ha_monitor *ha_mon, enum envs env,
     u64 expire, u64 time_ns)

From: Wen Yang <[email protected]>

When env_store is U64_MAX (its initial sentinel value), ha_invariant_passed_ns() returns 0 immediately without initializing env_store to the current clock.  Subsequent calls to ha_check_invariant_ns() then find env_store still at U64_MAX, causing the elapsed comparison to wrap and always report the invariant as satisfied, silently masking any violations.

Fix by calling ha_reset_clk_ns() to establish the guard on the first invocation instead of returning early.  Apply the same fix to ha_invariant_passed_jiffy().

Signed-off-by Wen Yang <[email protected]>

---
 include/rv/ha_monitor.h | 8 ++++----

 1 file changed, 4 insertions(+), 4 deletions(-)

include/rv/ha_monitor.h +0 -0

index 83199f90afe8..dddf5694bcc8 100644
@@ -375,12 +375,12 @@ static inline bool ha_check_invariant_ns(struct
 ha_monitor *ha_mon,

 static inline u64 ha_invariant_passed_ns(struct ha_monitor *ha_mon, enum envs env,
     u64 expire, u64 time_ns)
 {

include/rv/ha_monitor.h +1 -1

-	u64 passed = 0;
+	u64 passed;

  if (env < 0 || env >= ENV_MAX_STORED)
  return 0;
  if (ha_monitor_env_invalid(ha_mon, env))

include/rv/ha_monitor.h +1 -1

-		return 0;
+		ha_reset_clk_ns(ha_mon, env, time_ns);

  passed = ha_get_env(ha_mon, env, time_ns); ha_set_invariant_ns(ha_mon, env, expire - passed, time_ns); return passed;

include/rv/ha_monitor.h +0 -0

@@ -414,12 +414,12 @@ static inline bool ha_check_invariant_jiffy(struct
 ha_monitor *ha_mon,

 static inline u64 ha_invariant_passed_jiffy(struct ha_monitor *ha_mon, enum envs env,
        u64 expire, u64 time_ns)
 {

include/rv/ha_monitor.h +1 -1

-	u64 passed = 0;
+	u64 passed;

  if (env < 0 || env >= ENV_MAX_STORED)
  return 0;
  if (ha_monitor_env_invalid(ha_mon, env))

include/rv/ha_monitor.h +1 -1

-		return 0;
+		ha_reset_clk_jiffy(ha_mon, env);

  passed = ha_get_env(ha_mon, env, time_ns); ha_set_invariant_jiffy(ha_mon, env, expire - passed); return passed;

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+static DEFINE_SPINLOCK(tlob_start_lock);
+
+/* Per-uprobe-binding state: a start + stop probe pair for one binary region.

*/

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+struct tlob_uprobe_binding {
+	struct list_head	list;
+	u64			threshold_ns;

+ *
+ * No per-entry ha_cancel_timer_sync(): da_monitor_destroy() calls
+ * da_monitor_reset_all() + synchronize_rcu() before this hook, and
+ * ha_mon_destroying prevents new timer callbacks from running.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +33 -0

+static inline void tlob_extra_cleanup(struct da_monitor *da_mon)
+{
+	struct ha_monitor *ha_mon = to_ha_monitor(da_mon);
+	struct tlob_task_state *ws = ha_get_target(ha_mon);
+
+	if (!ws)
+		return;
+
+	if (atomic_cmpxchg_release(&ws->stopping, 0, 1) != 0)
+		return;
+
+	put_task_struct(ws->task);
+	/*
+	 * da_monitor_destroy() has already called synchronize_rcu(); no
+	 * reader holds ws.  Return the slot directly without call_rcu.
+	 */
+	llist_add(&ws->free_node, &tlob_ws_free_list);
+}
+
+static inline bool __tlob_acc(struct task_struct *task, ktime_t now,
+			       enum tlob_acc_idx idx)
+{
+	struct tlob_task_state *ws;
+	unsigned long flags;
+
+	guard(rcu)();
+	ws = da_get_target_by_id(task->pid);
+	if (!ws)
+		return false;
+	raw_spin_lock_irqsave(&ws->entry_lock, flags);
+	ws->accs_ns[idx] += ktime_to_ns(ktime_sub(now, ws->last_ts));
+	ws->last_ts = now;
+	raw_spin_unlock_irqrestore(&ws->entry_lock, flags);

kernel/trace/rv/monitors/tlob/tlob.c new file +65 -0

+static inline bool tlob_acc_waiting(struct task_struct *task, ktime_t now)
+{
+	return __tlob_acc(task, now, TLOB_ACC_WAITING);
+}
+
+/*
+ * handle_sched_switch - advance the DA on every context switch.
+ *
+ * Generates three DA events:
+ *   prev, prev_state != 0  -> sleep_tlob    (running -> sleeping)
+ *   prev, prev_state == 0  -> preempt_tlob  (running -> waiting)
+ *   next                   -> switch_in_tlob (waiting -> running)
+ *
+ * A single ktime_get() at handler entry is shared by both acc calls so that
+ * prev's running_ns and next's waiting_ns share the same context-switch
+ * timestamp; neither absorbs handler overhead into its accumulator.
+ *
+ * No waiting->sleeping edge exists: a task can only block voluntarily
+ * (call schedule()) while it is executing on CPU, which corresponds to
+ * the running DA state.  A task in the waiting state is TASK_RUNNING in
+ * kernel terms (on the runqueue) and cannot block itself.
+ *
+ * da_handle_event() is called unconditionally: it skips tasks that have no
+ * monitor entry in the hash table.
+ */
+static void handle_sched_switch(void *data, bool preempt_unused,
+				struct task_struct *prev,
+				struct task_struct *next,
+				unsigned int prev_state)
+{
+	ktime_t now = ktime_get();
+	bool prev_preempted = (prev_state == 0);
+
+	if (tlob_acc_running(prev, now))
+		da_handle_event(prev->pid, NULL,
+				prev_preempted ? preempt_tlob : sleep_tlob);
+	if (tlob_acc_waiting(next, now))
+		da_handle_event(next->pid, NULL, switch_in_tlob);
+}
+
+/* Accumulate sleeping_ns on wakeup; returns true if task is monitored. */
+static inline bool tlob_acc_sleeping(struct task_struct *task, ktime_t now)
+{
+	return __tlob_acc(task, now, TLOB_ACC_SLEEPING);
+}
+
+/*
+ * handle_sched_wakeup - sleeping -> waiting transition.
+ *
+ * try_to_wake_up() skips TASK_RUNNING tasks, so this never fires for a
+ * task already in running or waiting state.
+ */
+static void handle_sched_wakeup(void *data, struct task_struct *p)
+{
+	ktime_t now = ktime_get();
+
+	if (tlob_acc_sleeping(p, now))
+		da_handle_event(p->pid, NULL, wakeup_tlob);
+}
+
+/*
+ * handle_sched_process_exit - clean up if a task exits without TRACE_STOP.
+ *
+ * Called in do_exit() context; the task still has a valid pid here.
+ * tlob_stop_task() returns -ESRCH if the task is not monitored, which is

fine.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +27 -0

+static void handle_sched_process_exit(void *data, struct task_struct *p,
+				       bool group_dead)
+{
+	tlob_stop_task(p);
+}
+
+/**
+ * tlob_start_task - begin monitoring @task with budget @threshold_ns ns.
+ * @task:         Task to monitor; may be current or another task.
+ * @threshold_ns: Latency budget in nanoseconds (wall-clock; running +
+ *                waiting + sleeping).
+ *                Must be in [1000, TLOB_MAX_THRESHOLD_NS].
+ *
+ * Returns 0, -ENODEV, -ERANGE, -EALREADY, or -ENOSPC (pool at capacity).
+ */
+int tlob_start_task(struct task_struct *task, u64 threshold_ns)
+{
+	struct tlob_task_state *ws;
+
+	if (!da_monitor_enabled())
+		return -ENODEV;
+
+	if (threshold_ns < TLOB_MIN_THRESHOLD_NS ||
+	    threshold_ns > TLOB_MAX_THRESHOLD_NS)
+		return -ERANGE;
+
+	/* Serialise duplicate-check + pool-slot claim; see tlob_start_lock.

*/

kernel/trace/rv/monitors/tlob/tlob.c new file +22 -0

+	scoped_guard(rcu) {
+		if (da_get_target_by_id(task->pid))
+			return -EALREADY;
+	}
+
+	/*
+	 * Both tlob_ws_alloc() and da_handle_start_run_event() pop from
+	 * pre-allocated pools of size TLOB_MAX_MONITORED; NULL return means
+	 * the pool is at capacity.
+	 */
+	ws = tlob_ws_alloc();
+	if (!ws)
+		return -ENOSPC;
+
+	ws->task = task;
+	get_task_struct(task);
+	ws->threshold_ns = threshold_ns;
+	ws->last_ts = ktime_get();
+	raw_spin_lock_init(&ws->entry_lock);
+
+	/*
+	 * da_handle_start_run_event() claims a pool slot via

da_prepare_storage(),

(quoted diff) +2 -0

+	 * initialises the monitor, and delivers start_tlob in one step: the
+	 * generated ha_setup_invariants() resets clk_elapsed and arms the

timer.

kernel/trace/rv/monitors/tlob/tlob.c new file +40 -0

+	if (!da_handle_start_run_event(task->pid, ws, start_tlob)) {
+		put_task_struct(task);
+		tlob_ws_direct_return(ws);
+		return -ENOSPC;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(tlob_start_task);
+
+/**
+ * tlob_stop_task - stop monitoring @task.
+ * @task: Task to stop.
+ *
+ * CAS on ws->stopping (0->1) under RCU claims cleanup ownership;
+ * the winner cancels the timer synchronously and frees all resources.
+ *
+ * Returns 0, -EOVERFLOW (budget exceeded), -ESRCH (not monitored),
+ * or -EAGAIN (concurrent caller claimed cleanup).
+ */
+int tlob_stop_task(struct task_struct *task)
+{
+	struct da_monitor *da_mon;
+	struct ha_monitor *ha_mon;
+	struct tlob_task_state *ws;
+	bool budget_exceeded;
+
+	scoped_guard(rcu) {
+		ws = da_get_target_by_id(task->pid);
+		if (!ws)
+			return -ESRCH;
+
+		da_mon = da_get_monitor(task->pid, NULL);
+		if (unlikely(WARN_ON_ONCE(!da_mon)))
+			return -ESRCH;
+
+		ha_mon = to_ha_monitor(da_mon);
+
+		/*
+		 * CAS (0->1) claims cleanup ownership under RCU (ws

guaranteed valid).

(quoted diff) +1 -0

+		 * _release pairs with atomic_read_acquire in

ha_setup_invariants.

kernel/trace/rv/monitors/tlob/tlob.c new file +11 -0

+		 */
+		if (atomic_cmpxchg_release(&ws->stopping, 0, 1) != 0)
+			return -EAGAIN;
+	}
+	/*
+	 * ws and ha_mon are used below outside the RCU guard.  This is safe:
+	 * the winning CAS (stopping: 0->1) is the only path that frees ws,
+	 * and da_destroy_storage() below is the only call that returns the
+	 * pool slot.  No concurrent path can free either object.
+	 */
+

From: Wen Yang <[email protected]>

+++ b/kernel/trace/rv/Kconfig

(quoted diff) +0 -0

@@ -59,6 +59,13 @@ config RV_PER_TASK_MONITORS

    This option configures the maximum number of per-task RV monitors that can run
    simultaneously.

+
 source "kernel/trace/rv/monitors/wip/Kconfig"
 source "kernel/trace/rv/monitors/wwnr/Kconfig"

+++ b/kernel/trace/rv/rv_uprobe.c

kernel/trace/rv/rv_uprobe.c new file +22 -0

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Generic uprobe infrastructure for RV monitors.
+ *
+ * struct rv_uprobe embeds struct uprobe_consumer directly.  This is safe
+ * because rv_uprobe_sync() calls uprobe_unregister_sync(), which calls
+ * synchronize_rcu_tasks_trace().  handler_chain() runs under
+ * rcu_read_lock_trace(), so after synchronize_rcu_tasks_trace() returns,
+ * all in-flight handler_chain() iterations, including any pending
+ * uc->cons_node.next reads, have completed on all CPUs.  The caller may
+ * then free the struct containing rv_uprobe immediately.
+ */
+#include <linux/dcache.h>
+#include <linux/fs.h>
+#include <linux/namei.h>
+#include <linux/uprobes.h>
+#include <rv/rv_uprobe.h>
+
+/**
+ * rv_uprobe_register - initialise and register an uprobe
+ */
+int rv_uprobe_register(const char *binpath, loff_t offset, struct rv_uprobe

*p)

kernel/trace/rv/rv_uprobe.c new file +10 -0

+
+	ret = kern_path(binpath, LOOKUP_FOLLOW, &path);
+	if (ret)
+		return ret;
+
+	if (!d_is_reg(path.dentry)) {
+		path_put(&path);
+		return -EINVAL;
+	}
+

kernel/trace/rv/rv_uprobe.c new file +55 -0

+	if (IS_ERR(p->uprobe)) {
+		ret = PTR_ERR(p->uprobe);
+		p->uprobe = NULL;
+		p->inode = NULL;
+		return ret;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(rv_uprobe_register);
+
+/**
+ * rv_uprobe_is_registered - test whether an uprobe is currently active
+ */
+bool rv_uprobe_is_registered(const struct rv_uprobe *p)
+{
+	return p && p->uprobe;
+}
+EXPORT_SYMBOL_GPL(rv_uprobe_is_registered);
+
+/**
+ * rv_uprobe_unregister - synchronously unregister a uprobe
+ */
+void rv_uprobe_unregister(struct rv_uprobe *p)
+{
+	if (!p || !p->uprobe)
+		return;
+
+	rv_uprobe_unregister_nosync(p);
+	rv_uprobe_sync();
+}
+EXPORT_SYMBOL_GPL(rv_uprobe_unregister);
+
+/**
+ * rv_uprobe_unregister_nosync - dequeue an uprobe without waiting
+ */
+void rv_uprobe_unregister_nosync(struct rv_uprobe *p)
+{
+	if (!p || !p->uprobe)
+		return;
+
+	uprobe_unregister_nosync(p->uprobe, &p->uc);
+	p->uprobe = NULL;
+	p->inode = NULL;
+}
+EXPORT_SYMBOL_GPL(rv_uprobe_unregister_nosync);
+
+/**
+ * rv_uprobe_sync - wait for all in-flight uprobe handlers to complete
+ */
+void rv_uprobe_sync(void)
+{
+	uprobe_unregister_sync();
+}
+EXPORT_SYMBOL_GPL(rv_uprobe_sync);

From: Wen Yang <[email protected]>

Add seven ftrace-style test scripts for the tlob RV monitor under tools/testing/selftests/verification/test.d/tlob/.  The tests cover uprobe binding management, budget violation detection, and per-state time accounting.

Helper binaries tlob_target and tlob_sym are included in the same directory so the suite is self-contained.  tlob_sym resolves ELF symbol offsets for uprobe registration; tlob_target provides busy-spin, sleep, and preempt workloads.

ftracetest is updated to walk up the directory tree when searching for test.d/functions, so monitor subdirectories can be passed as the test directory without placing a dummy functions shim in each new directory.

Signed-off-by Wen Yang <[email protected]>

---
 tools/testing/selftests/ftrace/ftracetest     |  18 +- .../testing/selftests/verification/.gitignore |   2 + tools/testing/selftests/verification/Makefile |  19 +- .../verification/test.d/tlob/Makefile         |  28 +++ .../test.d/tlob/run_tlob_tests.sh             |  90 ++++++++ .../verification/test.d/tlob/tlob_sym.c       | 209 ++++++++++++++++++ .../verification/test.d/tlob/tlob_target.c    | 138 ++++++++++++ .../verification/test.d/tlob/uprobe_bind.tc   |  37 ++++ .../test.d/tlob/uprobe_detail_running.tc      |  51 +++++ .../test.d/tlob/uprobe_detail_sleeping.tc     |  50 +++++ .../test.d/tlob/uprobe_detail_waiting.tc      |  66 ++++++ .../verification/test.d/tlob/uprobe_multi.tc  |  64 ++++++ .../test.d/tlob/uprobe_no_event.tc            |  19 ++ .../test.d/tlob/uprobe_violation.tc           |  67 ++++++

 14 files changed, 854 insertions(+), 4 deletions(-)

 create mode 100644 tools/testing/selftests/verification/test.d/tlob/Makefile create mode 100755 tools/testing/selftests/verification/test.d/tlob/run_tlob_tests.sh create mode 100644 tools/testing/selftests/verification/test.d/tlob/tlob_sym.c create mode 100644 tools/testing/selftests/verification/test.d/tlob/tlob_target.c create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_detail_running.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_detail_sleeping.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_detail_waiting.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_multi.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_no_event.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_violation.tc

tools/testing/selftests/ftrace/ftracetest +0 -0

index 0a56bf209f6c..91c007b0a74a 100755
@@ -159,9 +159,21 @@ parse_opts() { # opts

   if [ -n "$OPT_TEST_CASES" ]; then TEST_CASES=$OPT_TEST_CASES
   fi
-  if [ -n "$OPT_TEST_DIR" -a -f "$OPT_TEST_DIR"/test.d/functions ]; then -    TOP_DIR=$OPT_TEST_DIR
-    TEST_DIR=$TOP_DIR/test.d
+  if [ -n "$OPT_TEST_DIR" ]; then
+    # Walk up from OPT_TEST_DIR to find the nearest ancestor containing +    # test.d/functions, allowing monitor subdirectories to be passed directly.
+    dir=$OPT_TEST_DIR
+    while [ "$dir" != "/" ]; do
+      if [ -f "$dir/test.d/functions" ]; then
+        TOP_DIR=$dir

+        TEST_DIR=$TOP_DIR/test.d
+        break
+      fi
+      dir=$(dirname "$dir")
+    done
+    if [ -z "$TOP_DIR" ]; then
+      errexit "no test.d/functions found above $OPT_TEST_DIR" +    fi

   fi
 }

tools/testing/selftests/verification/.gitignore +0 -0

index 2659417cb2c7..cbbd03ee16c7 100644
@@ -1,2 +1,4 @@
  # SPDX-License-Identifier: GPL-2.0-only

 logs

tools/testing/selftests/verification/.gitignore +2 -0

+test.d/tlob/tlob_sym
+test.d/tlob/tlob_target

tools/testing/selftests/verification/Makefile +0 -1

index aa8790c22a71..0b32bdfdb8db 100644
@@ -1,8 +1,25 @@
  # SPDX-License-Identifier: GPL-2.0
-all:

 TEST_PROGS := verificationtest-ktap
 TEST_FILES := test.d settings
 EXTRA_CLEAN := $(OUTPUT)/logs/*

tools/testing/selftests/verification/Makefile +2 -0

+BUILD_SUBDIRS := test.d/tlob
+

 include ../lib.mk

tools/testing/selftests/verification/Makefile +13 -0

+
+all: $(patsubst %,_build_%,$(BUILD_SUBDIRS))
+
+clean: $(patsubst %,_clean_%,$(BUILD_SUBDIRS))
+
+.PHONY: $(patsubst %,_build_%,$(BUILD_SUBDIRS)) \
+        $(patsubst %,_clean_%,$(BUILD_SUBDIRS))
+
+$(patsubst %,_build_%,$(BUILD_SUBDIRS)): _build_%:
+	$(MAKE) -C $* OUTDIR="$(OUTPUT)" TOOLS_INCLUDES="$(TOOLS_INCLUDES)"
+
+$(patsubst %,_clean_%,$(BUILD_SUBDIRS)): _clean_%:
+	$(MAKE) -C $* OUTDIR="$(OUTPUT)" clean

tools/testing/selftests/verification/test.d/tlob/Makefile new file +1 -0

new file mode 100644
index 000000000000..05a2d2599c4e
@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: GPL-2.0

tools/testing/selftests/verification/test.d/tlob/Makefile new file +17 -0

+
+.PHONY: all
+all: tlob_sym tlob_target
+
+tlob_sym: tlob_sym.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+tlob_target: tlob_target.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+.PHONY: run_tests
+run_tests: all
+	@./run_tlob_tests.sh
+
+.PHONY: clean
+clean:
+	$(RM) tlob_sym tlob_target

diff --git a/tools/testing/selftests/verification/test.d/tlob/run_tlob_tests.sh b/tools/testing/selftests/verification/test.d/tlob/run_tlob_tests.sh new file mode 100755
index 000000000000..cd949756e713

tools/testing/selftests/verification/test.d/tlob/run_tlob_tests.sh new file +1 -0

@@ -0,0 +1,90 @@
+#!/bin/bash

tools/testing/selftests/verification/test.d/tlob/run_tlob_tests.sh new file +69 -0

+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FTRACETEST="$SCRIPT_DIR/../../../ftrace/ftracetest"
+LOGDIR="$SCRIPT_DIR/../../logs"
+VERBOSE=""
+KEEP=""
+EXTRA_ARGS=""
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -v|--verbose)
+            VERBOSE="-v"
+            shift
+            ;;
+        -k|--keep)
+            KEEP="-k"
+            shift
+            ;;
+        -l|--logdir)
+            LOGDIR="$2"
+            shift 2
+            ;;
+        -h|--help)
+            echo "Usage: $0 [options]"
+            echo ""
+            echo "Options:"
+            echo "  -v, --verbose    Verbose output"
+            echo "  -k, --keep       Keep test logs"
+            echo "  -l, --logdir DIR Log directory (default: ../../logs)"
+            echo "  -h, --help       Show this help"
+            echo ""
+            echo "Examples:"
+            echo "  $0                           # Run all tlob tests"
+            echo "  $0 -v                        # Run with verbose output"
+            echo "  $0 -v -l /tmp/tlob-logs      # Custom log directory"
+            echo ""
+            echo "With vng:"
+            echo "  vng -v --rwdir $LOGDIR -- $0"
+            exit 0
+            ;;
+        *)
+            EXTRA_ARGS="$EXTRA_ARGS $1"
+            shift
+            ;;
+    esac
+done
+
+# Build test helpers
+echo "Building tlob test helpers..."
+make -C "$SCRIPT_DIR" all
+
+# Check ftracetest exists
+if [ ! -x "$FTRACETEST" ]; then
+    echo "Error: $FTRACETEST not found or not executable"
+    echo "Make sure you're running from the correct directory"
+    exit 1
+fi
+
+# Create log directory
+mkdir -p "$LOGDIR"
+
+# Run tests
+echo "Running tlob selftests..."
+echo "Log directory: $LOGDIR"
+echo ""
+

I tried to refactor it to follow more standard selftest building, avoiding to maintain things ourselves. The only drawback is that you'd have to move the tlob_*.c files to selftests/verification , then we can still use RV_BINDIR but support it only via Makefile and run_tlob_tests.sh (so let's drop defining it in all tests and save inconvenience if things ever change).

From: Wen Yang <[email protected]>

kernel/trace/rv/monitors/tlob/Kconfig +0 -0

index aa43382073d2..402ef2e5c076 100644
@@ -10,3 +10,10 @@ config RV_MON_TLOB

    monitor.  tlob tracks per-task elapsed wall-clock time across a user-delimited code section and emits error_env_tlob when the elapsed time exceeds a configurable per-invocation budget.

kernel/trace/rv/monitors/tlob/Kconfig +7 -0

+
+config TLOB_KUNIT_TEST
+	tristate "KUnit tests for tlob monitor" if !KUNIT_ALL_TESTS
+	depends on RV_MON_TLOB && KUNIT
+	default KUNIT_ALL_TESTS
+	help
+	  Enable KUnit unit tests for the tlob RV monitor.

kernel/trace/rv/monitors/tlob/tlob.c +2 -1

index b45e84195131..a6f9c371646c 100644
@@ -708,7 +708,7 @@ static ssize_t tlob_monitor_read(struct file *file,
   * PATH may contain ':'; the last ':' separates path from offset.
   * Returns 0, -EINVAL, or -ERANGE.
   */
-static int tlob_parse_uprobe_line(char *buf, u64 *thr_out,
+VISIBLE_IF_KUNIT int tlob_parse_uprobe_line(char *buf, u64 *thr_out,
  				  char **path_out,
  				  loff_t *start_out, loff_t *stop_out)
  {

@@ -782,6 +782,7 @@ static int tlob_parse_uprobe_line(char *buf, u64 *thr_out,
  	*stop_out  = (loff_t)stop_val;
  	return 0;
  }
+EXPORT_SYMBOL_IF_KUNIT(tlob_parse_uprobe_line);

 /*
  * Parse "-PATH:OFFSET_START" (ftrace uprobe_events removal convention).

kernel/trace/rv/monitors/tlob/tlob.c +1 -0

@@ -810,8 +811,9 @@ VISIBLE_IF_KUNIT int tlob_parse_remove_line(char *buf,
 char **path_out,
  	*start_out = (loff_t)off;
  	return 0;
  }
+EXPORT_SYMBOL_IF_KUNIT(tlob_parse_remove_line);

 {
  loff_t offset_start, offset_stop;
  u64 threshold_ns;

kernel/trace/rv/monitors/tlob/tlob.c +0 -1

@@ -836,7 +838,6 @@ VISIBLE_IF_KUNIT int tlob_create_or_delete_uprobe(char
 *buf)
  	mutex_unlock(&tlob_uprobe_mutex);
  	return ret;
  }
-EXPORT_SYMBOL_IF_KUNIT(tlob_create_or_delete_uprobe);

 static ssize_t tlob_monitor_write(struct file *file, const char __user *ubuf,

kernel/trace/rv/monitors/tlob/tlob.h +0 -0

index fceeba748c85..15bdf3b7fade 100644
@@ -145,7 +145,9 @@ int tlob_start_task(struct task_struct *task, u64
 threshold_ns);
  int tlob_stop_task(struct task_struct *task);

 #if IS_ENABLED(CONFIG_KUNIT)

 #endif /* CONFIG_KUNIT */

 #endif /* _RV_TLOB_H */

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +0 -0

new file mode 100644
index 000000000000..7448f3fab959

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +19 -0

+#include <kunit/test.h>
+
+#include "tlob.h"
+
+MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING");
+
+/* Valid "p PATH:START STOP threshold=NS" lines. */
+static const char * const tlob_parse_valid[] = {
+	"p /usr/bin/myapp:4768 4848 threshold=5000000",
+	"p /usr/bin/myapp:0x12a0 0x12f0 threshold=10000000",
+	"p /opt/my:app/bin:0x100 0x200 threshold=1000000",
+};
+
+/* Malformed "p ..." lines that must be rejected with -EINVAL. */
+static const char * const tlob_parse_invalid[] = {
+	"p :0x100 0x200 threshold=5000",
+	"p /usr/bin/myapp:0x100 threshold=5000",
+	"p /usr/bin/myapp:-1 0x200 threshold=5000",
+	"p /usr/bin/myapp:0x100 -1 threshold=5000000",	/* negative stop

offset */

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +37 -0

+	"p /usr/bin/myapp:0x100 0x200",
+	"p /usr/bin/myapp:0x100 0x100 threshold=5000",
+};
+
+/* threshold_ns out of valid range => -ERANGE. */
+static const char * const tlob_parse_out_of_range[] = {
+	"p /usr/bin/myapp:0x100 0x200 threshold=0",
+	"p /usr/bin/myapp:0x100 0x200 threshold=999",
+	"p /usr/bin/myapp:0x100 0x200 threshold=3600000000001",
+};
+
+/* Valid "-PATH:OFFSET_START" remove lines. */
+static const char * const tlob_remove_valid[] = {
+	"-/usr/bin/myapp:0x100",
+	"-/opt/my:app/bin:0x200",
+};
+
+/* Malformed remove lines that must be rejected with -EINVAL. */
+static const char * const tlob_remove_invalid[] = {
+	"-usr/bin/myapp:0x100",
+	"-/usr/bin/myapp",
+	"-/:0x100",
+	"-/usr/bin/myapp:-1",	/* negative offset */
+	"-/usr/bin/myapp:abc",
+};
+
+static void tlob_parse_valid_accepted(struct kunit *test)
+{
+	u64 thr;
+	char *path;
+	loff_t start, stop;
+	char buf[128];
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(tlob_parse_valid); i++) {
+		strscpy(buf, tlob_parse_valid[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test, tlob_parse_uprobe_line(buf, &thr,

&path,

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +1 -0

+							     &start, &stop),

0);

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +14 -0

+	}
+}
+
+static void tlob_parse_invalid_rejected(struct kunit *test)
+{
+	u64 thr;
+	char *path;
+	loff_t start, stop;
+	char buf[128];
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(tlob_parse_invalid); i++) {
+		strscpy(buf, tlob_parse_invalid[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test, tlob_parse_uprobe_line(buf, &thr,

&path,

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +15 -1

+							     &start, &stop),
-EINVAL);
+	}
+}
+
+static void tlob_parse_out_of_range_rejected(struct kunit *test)
+{
+	u64 thr;
+	char *path;
+	loff_t start, stop;
+	char buf[128];
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(tlob_parse_out_of_range); i++) {
+		strscpy(buf, tlob_parse_out_of_range[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test, tlob_parse_uprobe_line(buf, &thr,

&path,

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +14 -1

+							     &start, &stop),
-ERANGE);
+	}
+}
+
+static void tlob_remove_valid_accepted(struct kunit *test)
+{
+	char *path;
+	loff_t start;
+	char buf[128];
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(tlob_remove_valid); i++) {
+		strscpy(buf, tlob_remove_valid[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test, tlob_parse_remove_line(buf, &path,

&start), 0);

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +13 -0

+	}
+}
+
+static void tlob_remove_invalid_rejected(struct kunit *test)
+{
+	char *path;
+	loff_t start;
+	char buf[128];
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(tlob_remove_invalid); i++) {
+		strscpy(buf, tlob_remove_invalid[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test, tlob_parse_remove_line(buf, &path,

&start), -EINVAL);

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +21 -0

+	}
+}
+
+static struct kunit_case tlob_parse_cases[] = {
+	KUNIT_CASE(tlob_parse_valid_accepted),
+	KUNIT_CASE(tlob_parse_invalid_rejected),
+	KUNIT_CASE(tlob_parse_out_of_range_rejected),
+	KUNIT_CASE(tlob_remove_valid_accepted),
+	KUNIT_CASE(tlob_remove_invalid_rejected),
+	{}
+};
+
+static struct kunit_suite tlob_parse_suite = {
+	.name       = "tlob_parse",
+	.test_cases = tlob_parse_cases,
+};
+
+kunit_test_suite(tlob_parse_suite);
+
+MODULE_DESCRIPTION("KUnit tests for the tlob RV monitor");
+MODULE_LICENSE("GPL");

From: Wen Yang <[email protected]>

This series introduces tlob (task latency over budget), a per-task hybrid automaton RV monitor that measures elapsed wall-clock time across a user-delimited code section and emits an error when the elapsed time exceeds a configurable budget.

The monitor tracks three states (running, waiting, sleeping) driven by sched_switch and sched_wakeup tracepoints.  A single clock invariant, clk_elapsed < BUDGET_NS(), is enforced by a per-task hrtimer (HRTIMER_MODE_REL_HARD).  On expiry, error_env_tlob is emitted, followed by detail_env_tlob carrying a per-state time breakdown (running_ns, waiting_ns, sleeping_ns).

Tasks are registered for monitoring by writing to the tracefs monitor file:

  echo "p /path/to/binary:OFFSET_START OFFSET_STOP threshold=NS" \
       > /sys/kernel/tracing/rv/monitors/tlob/monitor

Two uprobes delimit the measured section without modifying the target binary.  Multiple uprobe pairs can be active simultaneously.

Series structure
----------------
Patch 1: rv/da: introduce DA_MON_ALLOCATION_STRATEGY Compile-time allocation strategy selector for per-object DA storage. Three strategies: DA_ALLOC_AUTO (default kmalloc), DA_ALLOC_POOL (pre-allocated llist pool), DA_ALLOC_MANUAL (caller-managed).

Patch 2: rv: add generic uprobe infrastructure for RV monitors Thin wrapper over uprobe_consumer for path resolution, registration, and safe synchronous teardown.

Patch 3: rv/tlob: add tlob model DOT file Graphviz DOT specification of the tlob hybrid automaton.

Patch 4: rv/ha: fix ha_invariant_passed_ns silent bypass Without this fix, ha_invariant_passed_ns() returns 0 on first call and leaves env_store at U64_MAX.  Every subsequent state transition resets the hrtimer to the full budget instead of the remaining time, so the budget never expires for tasks that transition between states.  This causes tlob's detail_sleeping and detail_waiting selftests to hang.

  This patch is a minimal fix in the current dual-representation framework. Nam's series [1] refactors ha_monitor.h to a single-representation model; once it lands, tlob will need to be updated to the new API and this patch will be superseded by Gabriele's planned framework-level initialisation improvement.  We carry it here to keep the series self-contained and testable.

  [1]
https://lore.kernel.org/lkml/08188c28f274da63a3f8549add3086a92aef45e5.1780908661.git.namcao@linutronix.de

Patches 5: rv/ha: make da_monitor_reset_hook and EVENT_NONE_LBL #ifndef guards for da_monitor_reset_hook and EVENT_NONE_LBL.

Patch 6: rv/tlob: add tlob hybrid automaton monitor Main tlob implementation.

Patches 7-8: Tests
  KUnit tests for the uprobe-line parser; seven ftrace-style selftests.

Changes since v3
----------------
Patch 1 (rv/da):
- Pool redesigned from spinlock+pointer-stack to lock-free llist (cmpxchg-based): pool release from RCU callback context is now safe without acquiring a lock
- DA_MON_POOL_SIZE alone selects pool mode; no separate DA_MON_ALLOCATION_STRATEGY define required for monitors
- All strategy dispatch uses plain C if() (no ifdeffery in functions)
- da_monitor_destroy_pool() calls da_monitor_reset_all() and da_monitor_sync_hook() before the hash iteration, preventing hrtimer UAF when timer callbacks are still in flight

Patch 2 (rv_uprobe):
- struct rv_uprobe now embeds struct uprobe_consumer directly; no separate heap allocation per probe, no rv_uprobe_free()
- path_put() moved after uprobe_register() to keep the inode referenced across the call as required by the uprobe API

Patch 6 (tlob monitor):
- da_get_target_by_id() wrapped in scoped_guard(rcu) in tlob_start_task(): hash_for_each_possible_rcu() requires an explicit RCU read-side CS on PREEMPT_RT where spinlock_t does not provide one
- tlob_monitor_read() releases mutex before simple_read_from_buffer() to avoid holding the mutex across copy_to_user()
- kmem_cache replaced with a pre-allocated llist pool for tlob_task_state, eliminating GFP_ATOMIC in the measurement window
- EXPORT_SYMBOL_IF_KUNIT added for tlob_parse_uprobe_line() and tlob_parse_remove_line() (required when CONFIG_TLOB_KUNIT_TEST=m)
- tlob_parse_remove_line() rejects negative offsets
- Unnecessary includes removed; Kconfig entry placed after the deadline monitors marker

Patch 7 (KUnit):
- Tests now call tlob_parse_uprobe_line() and tlob_parse_remove_line() directly; no tracepoint enrollment, no uprobe or filesystem state

Patch 8 (selftests):
- ftracetest walk-up algorithm (Gabriele's suggestion) incorporated; the separate verificationtest-ktap fix patch is dropped and the series shrinks from 9 to 8 patches
- All test scripts use "! cmd || false" throughout

Testing
-------
Tested on x86_64 with CONFIG_PREEMPT_RT=y (kernel 7.1 + virtme-ng):
- All KUnit tests pass
- All 7 selftests pass (uprobe_bind, uprobe_violation, uprobe_no_event, uprobe_multi, uprobe_detail_{running,sleeping,waiting})

Wen Yang (8):
  rv/da: introduce DA_MON_ALLOCATION_STRATEGY
  rv: add generic uprobe infrastructure for RV monitors rv/tlob: add tlob model DOT file
  rv/ha: fix ha_invariant_passed_ns silent bypass of invariant check rv/ha: make da_monitor_reset_hook and EVENT_NONE_LBL overridable rv/tlob: add tlob hybrid automaton monitor
  rv/tlob: add KUnit tests for the tlob monitor selftests/verification: add tlob selftests

 Documentation/trace/rv/index.rst              |   1 + Documentation/trace/rv/monitor_tlob.rst       | 177 ++++ include/rv/da_monitor.h                       | 247 ++++- include/rv/ha_monitor.h                       |  24 +- include/rv/rv_uprobe.h                        |  93 ++ kernel/trace/rv/Kconfig                       |   8 + kernel/trace/rv/Makefile                      |   3 + kernel/trace/rv/monitors/nomiss/nomiss.c      |   6 +- kernel/trace/rv/monitors/tlob/.kunitconfig    |   8 + kernel/trace/rv/monitors/tlob/Kconfig         |  19 + kernel/trace/rv/monitors/tlob/tlob.c          | 970 ++++++++++++++++++ kernel/trace/rv/monitors/tlob/tlob.h          | 153 +++ kernel/trace/rv/monitors/tlob/tlob_kunit.c    | 139 +++ kernel/trace/rv/monitors/tlob/tlob_trace.h    |  52 + kernel/trace/rv/rv_trace.h                    |   1 + kernel/trace/rv/rv_uprobe.c                   | 104 ++ tools/testing/selftests/ftrace/ftracetest     |  18 +- .../testing/selftests/verification/.gitignore |   2 + tools/testing/selftests/verification/Makefile |  19 +- .../verification/test.d/tlob/Makefile         |  28 + .../test.d/tlob/run_tlob_tests.sh             |  90 ++ .../verification/test.d/tlob/tlob_sym.c       | 209 ++++ .../verification/test.d/tlob/tlob_target.c    | 138 +++ .../verification/test.d/tlob/uprobe_bind.tc   |  37 + .../test.d/tlob/uprobe_detail_running.tc      |  51 + .../test.d/tlob/uprobe_detail_sleeping.tc     |  50 + .../test.d/tlob/uprobe_detail_waiting.tc      |  66 ++ .../verification/test.d/tlob/uprobe_multi.tc  |  64 ++ .../test.d/tlob/uprobe_no_event.tc            |  19 + .../test.d/tlob/uprobe_violation.tc           |  67 ++ tools/verification/models/tlob.dot            |  22 +

 31 files changed, 2839 insertions(+), 46 deletions(-)

 create mode 100644 Documentation/trace/rv/monitor_tlob.rst create mode 100644 include/rv/rv_uprobe.h
 create mode 100644 kernel/trace/rv/monitors/tlob/.kunitconfig create mode 100644 kernel/trace/rv/monitors/tlob/Kconfig
 create mode 100644 kernel/trace/rv/monitors/tlob/tlob.c
 create mode 100644 kernel/trace/rv/monitors/tlob/tlob.h
 create mode 100644 kernel/trace/rv/monitors/tlob/tlob_kunit.c create mode 100644 kernel/trace/rv/monitors/tlob/tlob_trace.h create mode 100644 kernel/trace/rv/rv_uprobe.c
 create mode 100644 tools/testing/selftests/verification/test.d/tlob/Makefile create mode 100755 tools/testing/selftests/verification/test.d/tlob/run_tlob_tests.sh create mode 100644 tools/testing/selftests/verification/test.d/tlob/tlob_sym.c create mode 100644 tools/testing/selftests/verification/test.d/tlob/tlob_target.c create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_bind.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_detail_running.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_detail_sleeping.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_detail_waiting.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_multi.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_no_event.tc create mode 100644 tools/testing/selftests/verification/test.d/tlob/uprobe_violation.tc create mode 100644 tools/verification/models/tlob.dot

From: Wen Yang <[email protected]>

Add seven ftrace-style test scripts for the tlob RV monitor under tools/testing/selftests/verification/test.d/tlob/.  The tests cover uprobe binding management, budget violation detection, and per-state time accounting.

Helper binaries tlob_target and tlob_sym are included in the same directory so the suite is self-contained.  tlob_sym resolves ELF symbol offsets for uprobe registration; tlob_target provides busy-spin, sleep, and preempt workloads.

ftracetest is updated to walk up the directory tree when searching for test.d/functions, so monitor subdirectories can be passed as the test directory without placing a dummy functions shim in each new directory.

Signed-off-by Wen Yang <[email protected]>

---

+"$UPROBE_TARGET" 30000 &       # busy mode: tlob_busy_work fires every 200 ms +busy_pid=$!
+"$UPROBE_TARGET" 30000 sleep & # sleep mode: tlob_sleep_work fires every 200 ms

tools/testing/selftests/verification/test.d/tlob/uprobe_multi.tc new file +11 -0

+sleep_pid=$!
+sleep 0.05
+
+echo 1 > /sys/kernel/tracing/events/rv/error_env_tlob/enable
+echo 1 > /sys/kernel/tracing/events/rv/detail_env_tlob/enable
+echo 1 > /sys/kernel/tracing/tracing_on
+echo 1 > monitors/tlob/enable
+echo > /sys/kernel/tracing/trace
+
+# Binding A: 5 s budget on the busy probe - must not fire in 200 ms loops.
+echo "p ${UPROBE_TARGET}:${busy_offset} ${busy_stop} threshold=5000000000" >

"$TLOB_MONITOR"

(quoted diff) +2 -0

+# Binding B: 10 us budget on the sleep probe - fires on first invocation.
+echo "p ${UPROBE_TARGET}:${sleep_offset} ${sleep_stop} threshold=10000" >

"$TLOB_MONITOR"

tools/testing/selftests/verification/test.d/tlob/uprobe_multi.tc new file +6 -0

+
+# Wait up to 2 s for error_env_tlob from binding B.
+found=0; i=0
+while [ "$i" -lt 20 ]; do
+	sleep 0.1
+	grep -q "error_env_tlob" /sys/kernel/tracing/trace && { found=1;

break; }

tools/testing/selftests/verification/test.d/tlob/uprobe_multi.tc new file +14 -0

+
+echo "-${UPROBE_TARGET}:${busy_offset}" > "$TLOB_MONITOR" 2>/dev/null
+echo "-${UPROBE_TARGET}:${sleep_offset}" > "$TLOB_MONITOR" 2>/dev/null
+kill "$sleep_pid" 2>/dev/null || true; wait "$sleep_pid" 2>/dev/null || true
+kill "$busy_pid" 2>/dev/null || true; wait "$busy_pid" 2>/dev/null || true
+
+echo 0 > monitors/tlob/enable
+echo 0 > /sys/kernel/tracing/events/rv/error_env_tlob/enable
+echo 0 > /sys/kernel/tracing/events/rv/detail_env_tlob/enable
+
+[ "$found" = "1" ]
+# error_env_tlob payload: clock variable must be present.
+# The event field can be "budget_exceeded" (hrtimer path) or the DA event
+# name ("sleep", "preempt") depending on which fires first; don't constrain

it.
+grep "error_env_tlob" /sys/kernel/tracing/trace | head -n 1 | grep -q "clk_elapsed="

tools/testing/selftests/verification/test.d/tlob/uprobe_multi.tc new file +4 -0

+# detail_env_tlob must appear alongside the error.
+grep -q "detail_env_tlob" /sys/kernel/tracing/trace
+
+echo > /sys/kernel/tracing/trace

diff --git a/tools/testing/selftests/verification/test.d/tlob/uprobe_no_event.tc b/tools/testing/selftests/verification/test.d/tlob/uprobe_no_event.tc new file mode 100644
index 000000000000..bb2eeef17019

tools/testing/selftests/verification/test.d/tlob/uprobe_no_event.tc new file +3 -0

@@ -0,0 +1,19 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+# description: Test tlob monitor no spurious events without active uprobe

binding

Quoted 12 lines · On Wed, 2026-07-08 at 23:38 +0800, [email protected] wrote:

From: Wen Yang <[email protected]>

Per-object DA storage allocation is currently limited to kmalloc on demand. Add a compile-time selector so monitors can choose among three strategies:

  DA_ALLOC_AUTO   (default) - kmalloc per object on the monitor path DA_ALLOC_POOL             - pre-allocated fixed-size llist pool; selected by defining DA_MON_POOL_SIZE DA_ALLOC_MANUAL           - caller pre-inserts storage; framework only links the target field

Quoted 4 lines

The pool strategy uses a lock-free llist (cmpxchg, no spinlock) so pool release is safe from RCU callback context without acquiring a lock. Moving allocation before the measurement window also prevents kmalloc latency.

Measurement window here is tlob's, remember RV isn't itself a measurement tool (yet, perhaps).
And isn't this also happening with other methods? We're trying to do allocation when the monitor starts (so before this measurement window).

I'm a bit puzzled since you're mentioning it many times, when have we done /allocations/ from RCU callbacks?
We surely do deallocations (kfree_rcu) but allocations are at most in RCU read-side critical sections and it's perfectly fine to take sleeping spinlocks there (that's a special kind of sleep under PREEMPT_RT). Besides I'm not quite sure spinlocks are that bad in RCU callbacks either (kfree surely takes them).
I'm not sure what you mean here but I don't think deallocation was ever a problem, was it?

Quoted 41 lines

nomiss is updated to DA_ALLOC_MANUAL.

Suggested-by Gabriele Monaco <[email protected]>

Signed-off-by Wen Yang <[email protected]>

---
  include/rv/da_monitor.h                  | 247 +++++++++++++++++++----
  include/rv/ha_monitor.h                  |   6 +
  kernel/trace/rv/monitors/nomiss/nomiss.c |   6 +-
  3 files changed, 221 insertions(+), 38 deletions(-)

include/rv/da_monitor.h +7 -0

index 34b8fba9ecd4..9c9acc123e3b 100644
@@ -14,7 +14,56 @@
  #ifndef _RV_DA_MONITOR_H
  #define _RV_DA_MONITOR_H
 
+/*
+ * Allocation strategies for RV_MON_PER_OBJ monitors.
+ *
+ * Select the strategy with a single define before including this header:
+ *
+ *   #define DA_MON_POOL_SIZE N          - pool mode; N pre-allocated slots.
+ *                                         Implies DA_ALLOC_POOL

automatically.
+ *   #define DA_MON_ALLOCATION_STRATEGY \
+ *           DA_ALLOC_MANUAL             - manual mode (see below).
+ *   (neither)                           - auto mode (default).
+ *
+ * Do not define both DA_MON_POOL_SIZE and DA_MON_ALLOCATION_STRATEGY.
+ *
+ * DA_ALLOC_AUTO   - lock-free kmalloc on the hot path; unbounded capacity.
+ * DA_ALLOC_POOL   - pre-allocated fixed-size pool; set by defining DA_MON_POOL_SIZE.
+ * DA_ALLOC_MANUAL - caller inserts storage before da_handle_start_event();
+ *                   the framework only links the target field.
+ */

include/rv/da_monitor.h +3 -0

+#define DA_ALLOC_AUTO   0
+#define DA_ALLOC_POOL   1
+#define DA_ALLOC_MANUAL 2

include/rv/da_monitor.h line 47

Quoted 10 lines

include/rv/da_monitor.h +10 -0

+
+#ifdef DA_MON_POOL_SIZE
+#ifdef DA_MON_ALLOCATION_STRATEGY
+#error "Define only one of DA_MON_POOL_SIZE or DA_MON_ALLOCATION_STRATEGY"
+#endif
+#if DA_MON_POOL_SIZE == 0
+#error "DA_MON_POOL_SIZE must be non-zero"
+#endif
+#define DA_MON_ALLOCATION_STRATEGY DA_ALLOC_POOL
+#endif

Longer ifdefs should have comments to make them readable, like

   #endif /* DA_MON_POOL_SIZE */

Quoted 6 lines

include/rv/da_monitor.h +6 -0

+
+#ifndef DA_MON_ALLOCATION_STRATEGY
+#define DA_MON_ALLOCATION_STRATEGY DA_ALLOC_AUTO
+#endif
+
+/*

include/rv/da_monitor.h line 63

Quoted 10 lines

include/rv/da_monitor.h +10 -0

+ * Provide a zero default so da_monitor_init() can reference
+ * DA_MON_POOL_SIZE in a plain C if() without an #if guard; the
+ * compiler eliminates the dead branch.
+ */
+#ifndef DA_MON_POOL_SIZE
+#if DA_MON_ALLOCATION_STRATEGY == DA_ALLOC_POOL
+#error "DA_ALLOC_POOL requires DA_MON_POOL_SIZE to be defined and non-zero"
+#endif
+#define DA_MON_POOL_SIZE 0
+#endif

Same here, better to have a comment.

Quoted 24 lines

include/rv/da_monitor.h +12 -0

+
  #include <rv/automata.h>
+#include <linux/llist.h>
  #include <linux/rv.h>
  #include <linux/stringify.h>
  #include <linux/bug.h>

@@ -66,6 +115,16 @@ static struct rv_monitor rv_this;
  #define da_monitor_sync_hook()
  #endif
 
+/*
+ * Per-object teardown hook, called after da_monitor_reset_all() +
+ * da_monitor_sync_hook() and before hash_del_rcu() for each entry.
+ * All HA timer callbacks have completed at this point.
+ * Define before including this header.  Default: no-op.
+ */
+#ifndef da_extra_cleanup
+#define da_extra_cleanup(da_mon)
+#endif
+
  /*
   * Type for the target id, default to int but can be overridden.
   * A long type can work as hash table key (PER_OBJ) but will be downgraded to

include/rv/da_monitor.h struct da_monitor_storage { · line 470

Quoted 8 lines

include/rv/da_monitor.h +5 -0

@@ -404,6 +463,12 @@ struct da_monitor_storage {
  	union rv_task_monitor rv;
  	struct hlist_node node;
  	struct rcu_head rcu;
+	/*
+	 * Mutually exclusive with rcu: rcu is live during the RCU callback
+	 * flight; free_node when the slot is in da_pool_free_list.
+	 * Present in all monitors to avoid #if-gating the pool helpers.
+	 */

I really don't understand much more about it by this comment, perhaps drop it here and make the separate usages clearer later?

By the way, if they are /really/ mutually exclusive and you want to save space, why not having them in an anonymous union?

Quoted 26 lines

include/rv/da_monitor.h +1 -12

+	struct llist_node free_node;
  };
 
  #ifndef DA_MONITOR_HT_BITS

@@ -495,18 +560,6 @@ static inline da_id_type da_get_id(struct da_monitor
 *da_mon)
  	return container_of(da_mon, struct da_monitor_storage, rv.da_mon)-
 > id;
  }
 
-/*
- * da_create_or_get - create the per-object storage if not already there
- *
- * This needs a lookup so should be guarded by RCU, the condition is checked
- * directly in da_create_storage()
- */
-static inline void da_create_or_get(da_id_type id, monitor_target target)
-{
-	guard(rcu)();
-	da_create_storage(id, target, da_get_monitor(id, target));
-}
-
  /*

  * da_fill_empty_storage - store the target in a pre-allocated storage *

include/rv/da_monitor.h static inline monitor_target · line 597

Quoted 8 lines

include/rv/da_monitor.h +4 -0

@@ -537,15 +590,79 @@ static inline monitor_target
 da_get_target_by_id(da_id_type id)
  	return mon_storage->target;
  }
 
+/*
+ * Lock-free llist (cmpxchg) rather than kmem_cache/mempool: on
+ * PREEMPT_RT spinlock_t becomes a sleeping lock, which is forbidden
+ * in the rcuc kthread context where RCU callbacks run.

This comment kind of implies we were using a kmem_cache, it's great for a changelog and helped me understand why you're doing this, but doesn't belong to the final version as is.

include/rv/da_monitor.h static inline monitor_target da_get_target_by_id(da_id_type id) · line 599

Quoted 3 lines

include/rv/da_monitor.h +3 -0

+ *
+ * Multiple producers (any context, any CPU) call llist_add; a single
+ * consumer (llist_del_first, serialised by the monitor's start lock)

Which monitor's start lock? There is no such a thing defined anywhere, maybe you wanted to say that monitors using this allocation scheme MUST lock during their start event. This by the way needs to be a global lock among all instances of the monitor (as you're indeed doing in tlob).

With that in mind, I don't really see how this is better than the original mempool: you still need to lock. There's nothing wrong in freeing stuff from RCU callbacks, that's what they're for.

Quoted 10 lines

include/rv/da_monitor.h +8 -0

+ * needs no additional synchronisation.
+ *
+ * Per-TU statics: each PER_OBJ monitor gets its own pool instance;
+ * da_pool_storage and da_pool_free_list are NULL/empty and the pool
+ * paths are dead code for non-pool monitors.
+ */
 
+static struct da_monitor_storage *da_pool_storage;
+static LLIST_HEAD(da_pool_free_list);

...

Quoted 15 lines

+++ b/kernel/trace/rv/monitors/nomiss/nomiss.c

include/rv/da_monitor.h +2 -2

@@ -17,8 +17,8 @@
 
  #define RV_MON_TYPE RV_MON_PER_OBJ
  #define HA_TIMER_TYPE HA_TIMER_WHEEL
-/* The start condition is on sched_switch, it's dangerous to allocate there
 */
-#define DA_SKIP_AUTO_ALLOC
+/* Allocate storage in sched_setscheduler; sched_switch is too hot to alloc.
 */
+#define DA_MON_ALLOCATION_STRATEGY DA_ALLOC_MANUAL
  typedef struct sched_dl_entity *monitor_target;

 #include "nomiss.h"
 #include <rv/ha_monitor.h>

include/rv/da_monitor.h static void handle_sys_enter(void *data, struct pt_regs · line 219

Quoted 7 lines

include/rv/da_monitor.h +1 -1

@@ -214,7 +214,7 @@ static void handle_sys_enter(void *data, struct pt_regs
 *regs, long id)
  	if (p->policy == SCHED_DEADLINE)
  		da_reset(EXPAND_ID_TASK(p));
  	else if (new_policy == SCHED_DEADLINE)
-		da_create_or_get(EXPAND_ID_TASK(p));
+		da_create_empty_storage(get_entity_id(&p->dl, task_cpu(p),
 DL_TASK));

I'm starting to doubt this is the right thing to do. We do have the target (p) and that function doesn't check if the id already has a storage (which shouldn't happen but well, doesn't hurt checking).

This simplification is probably just not worth it, and doesn't look related to the rest of the change.

Quoted 8 lines · On Wed, 2026-07-08 at 23:38 +0800, [email protected] wrote:

From: Wen Yang <[email protected]>

+++ b/kernel/trace/rv/Kconfig

(quoted diff) +0 -0

@@ -59,6 +59,13 @@ config RV_PER_TASK_MONITORS
  	  This option configures the maximum number of per-task RV monitors

that can run
    simultaneously.

kernel/trace/rv/Kconfig config RV_PER_TASK_MONITORS · line 67

Quoted 6 lines

kernel/trace/rv/Kconfig +6 -0

+config RV_UPROBE
+	bool
+	depends on RV && UPROBES
+	help
+	  Generic uprobe infrastructure for RV monitors.  Provides path
+	  resolution, registration, and safe synchronous teardown.

This isn't exposed, it's selected automatically when required, I don't even think the help text is visible (menuconfig doesn't show it), do we really need it?

Quoted 4 lines

+
 source "kernel/trace/rv/monitors/wip/Kconfig"
 source "kernel/trace/rv/monitors/wwnr/Kconfig"

...

Quoted 25 lines

+++ b/kernel/trace/rv/rv_uprobe.c

kernel/trace/rv/rv_uprobe.c new file +22 -0

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Generic uprobe infrastructure for RV monitors.
+ *
+ * struct rv_uprobe embeds struct uprobe_consumer directly.  This is safe
+ * because rv_uprobe_sync() calls uprobe_unregister_sync(), which calls
+ * synchronize_rcu_tasks_trace().  handler_chain() runs under
+ * rcu_read_lock_trace(), so after synchronize_rcu_tasks_trace() returns,
+ * all in-flight handler_chain() iterations, including any pending
+ * uc->cons_node.next reads, have completed on all CPUs.  The caller may
+ * then free the struct containing rv_uprobe immediately.
+ */
+#include <linux/dcache.h>
+#include <linux/fs.h>
+#include <linux/namei.h>
+#include <linux/uprobes.h>
+#include <rv/rv_uprobe.h>
+
+/**
+ * rv_uprobe_register - initialise and register an uprobe
+ */
+int rv_uprobe_register(const char *binpath, loff_t offset, struct rv_uprobe

*p)

kernel/trace/rv/rv_uprobe.c line 29

Quoted 7 lines

kernel/trace/rv/rv_uprobe.c new file +7 -0

+{
+	struct inode *inode;
+	struct path path;
+	int ret;
+
+	if (!p->uc.handler && !p->uc.ret_handler)
+		return -EINVAL;

uprobe_register() does this already, do we need it here too?

Quoted 10 lines

kernel/trace/rv/rv_uprobe.c new file +10 -0

+
+	ret = kern_path(binpath, LOOKUP_FOLLOW, &path);
+	if (ret)
+		return ret;
+
+	if (!d_is_reg(path.dentry)) {
+		path_put(&path);
+		return -EINVAL;
+	}
+

kernel/trace/rv/rv_uprobe.c line 49

Quoted 10 lines

kernel/trace/rv/rv_uprobe.c new file +10 -0

+	inode = d_real_inode(path.dentry);
+	p->inode = inode;
+
+	/*
+	 * uprobe_register() requires the inode (and mount) to remain
+	 * referenced across the call.  Keep the path alive until after
+	 * uprobe_register() has stored its own reference, then release it.
+	 */
+	p->uprobe = uprobe_register(inode, offset, 0, &p->uc);
+	path_put(&path);

I believe I was mistaken here, as sashiko pointed out, uprobe_register() doesn't keep a reference to the inode, (explicitly stated in it's docs:
"Caller of uprobe_register() is required to keep @inode (and the containing mount) referenced.").

We should probably revert back to holding path instead of inode and putting it after synchronous cleanup. That's also what BPF does.

Quoted 56 lines

kernel/trace/rv/rv_uprobe.c new file +55 -0

+	if (IS_ERR(p->uprobe)) {
+		ret = PTR_ERR(p->uprobe);
+		p->uprobe = NULL;
+		p->inode = NULL;
+		return ret;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(rv_uprobe_register);
+
+/**
+ * rv_uprobe_is_registered - test whether an uprobe is currently active
+ */
+bool rv_uprobe_is_registered(const struct rv_uprobe *p)
+{
+	return p && p->uprobe;
+}
+EXPORT_SYMBOL_GPL(rv_uprobe_is_registered);
+
+/**
+ * rv_uprobe_unregister - synchronously unregister a uprobe
+ */
+void rv_uprobe_unregister(struct rv_uprobe *p)
+{
+	if (!p || !p->uprobe)
+		return;
+
+	rv_uprobe_unregister_nosync(p);
+	rv_uprobe_sync();
+}
+EXPORT_SYMBOL_GPL(rv_uprobe_unregister);
+
+/**
+ * rv_uprobe_unregister_nosync - dequeue an uprobe without waiting
+ */
+void rv_uprobe_unregister_nosync(struct rv_uprobe *p)
+{
+	if (!p || !p->uprobe)
+		return;
+
+	uprobe_unregister_nosync(p->uprobe, &p->uc);
+	p->uprobe = NULL;
+	p->inode = NULL;
+}
+EXPORT_SYMBOL_GPL(rv_uprobe_unregister_nosync);
+
+/**
+ * rv_uprobe_sync - wait for all in-flight uprobe handlers to complete
+ */
+void rv_uprobe_sync(void)
+{
+	uprobe_unregister_sync();
+}
+EXPORT_SYMBOL_GPL(rv_uprobe_sync);

kernel/trace/rv/monitors/tlob/tlob.c line 260

Quoted 11 lines · On Wed, 2026-07-08 at 23:38 +0800, [email protected] wrote:

From: Wen Yang <[email protected]>

kernel/trace/rv/monitors/tlob/tlob.c new file +9 -0

+/* Uprobe binding list; protected by tlob_uprobe_mutex. */
+static LIST_HEAD(tlob_uprobe_list);
+static DEFINE_MUTEX(tlob_uprobe_mutex);
+
+/*
+ * Serialises duplicate-check + da_handle_start_run_event() per pid.
+ * spinlock_t not raw_spinlock_t: uprobe handlers run under Tasks Trace
+ * SRCU (rcu_read_lock_trace()), which permits sleeping on PREEMPT_RT.
+ */

I don't think these comments add much value. spinlock_t is allowed in RCU critical sections anyway (it's some sort of preemption and RCU is preemptible under PREEMPT_RT).

Of course if it isn't really required we don't use a raw spinlock, you don't need a justification here.

Quoted 7 lines

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+static DEFINE_SPINLOCK(tlob_start_lock);
+
+/* Per-uprobe-binding state: a start + stop probe pair for one binary region.

*/

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+struct tlob_uprobe_binding {
+	struct list_head	list;
+	u64			threshold_ns;

kernel/trace/rv/monitors/tlob/tlob.c line 276

Quoted 10 lines

kernel/trace/rv/monitors/tlob/tlob.c new file +10 -0

+	char			binpath[TLOB_MAX_PATH];
+	loff_t			offset_start;
+	loff_t			offset_stop;
+	DECLARE_RV_UPROBE(start_probe);
+	DECLARE_RV_UPROBE(stop_probe);
+};
+
+/*
+ * Per-task teardown invoked by da_monitor_destroy() for each hash entry.
+ * CAS on stopping (0->1) claims exclusive cleanup ownership.

I find reading acronyms extremely annoying, since non-locking algorithms are already complex on their own, why don't you just say cmpxchg (which is searchable) instead of CAS. Sure CAS isn't an obscure acronym but I could find at least another 4 different definitions in the kernel tree.

Quoted 38 lines

+ *
+ * No per-entry ha_cancel_timer_sync(): da_monitor_destroy() calls
+ * da_monitor_reset_all() + synchronize_rcu() before this hook, and
+ * ha_mon_destroying prevents new timer callbacks from running.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +33 -0

+static inline void tlob_extra_cleanup(struct da_monitor *da_mon)
+{
+	struct ha_monitor *ha_mon = to_ha_monitor(da_mon);
+	struct tlob_task_state *ws = ha_get_target(ha_mon);
+
+	if (!ws)
+		return;
+
+	if (atomic_cmpxchg_release(&ws->stopping, 0, 1) != 0)
+		return;
+
+	put_task_struct(ws->task);
+	/*
+	 * da_monitor_destroy() has already called synchronize_rcu(); no
+	 * reader holds ws.  Return the slot directly without call_rcu.
+	 */
+	llist_add(&ws->free_node, &tlob_ws_free_list);
+}
+
+static inline bool __tlob_acc(struct task_struct *task, ktime_t now,
+			       enum tlob_acc_idx idx)
+{
+	struct tlob_task_state *ws;
+	unsigned long flags;
+
+	guard(rcu)();
+	ws = da_get_target_by_id(task->pid);
+	if (!ws)
+		return false;
+	raw_spin_lock_irqsave(&ws->entry_lock, flags);
+	ws->accs_ns[idx] += ktime_to_ns(ktime_sub(now, ws->last_ts));
+	ws->last_ts = now;
+	raw_spin_unlock_irqrestore(&ws->entry_lock, flags);

kernel/trace/rv/monitors/tlob/tlob.c line 324

Quoted 10 lines

kernel/trace/rv/monitors/tlob/tlob.c new file +10 -0

+	return true;
+}
+
+/* Accumulate running_ns for prev; returns true if prev is monitored. */
+static inline bool tlob_acc_running(struct task_struct *task, ktime_t now)
+{
+	return __tlob_acc(task, now, TLOB_ACC_RUNNING);
+}
+
+/* Accumulate waiting_ns for next; returns true if next is monitored. */

There's no next and prev here, plus you're describing __tlob_acc()'s behaviour 3 times, I'd say just document that (even if it isn't the primary facing function) and that's all.

Quoted 95 lines

kernel/trace/rv/monitors/tlob/tlob.c new file +65 -0

+static inline bool tlob_acc_waiting(struct task_struct *task, ktime_t now)
+{
+	return __tlob_acc(task, now, TLOB_ACC_WAITING);
+}
+
+/*
+ * handle_sched_switch - advance the DA on every context switch.
+ *
+ * Generates three DA events:
+ *   prev, prev_state != 0  -> sleep_tlob    (running -> sleeping)
+ *   prev, prev_state == 0  -> preempt_tlob  (running -> waiting)
+ *   next                   -> switch_in_tlob (waiting -> running)
+ *
+ * A single ktime_get() at handler entry is shared by both acc calls so that
+ * prev's running_ns and next's waiting_ns share the same context-switch
+ * timestamp; neither absorbs handler overhead into its accumulator.
+ *
+ * No waiting->sleeping edge exists: a task can only block voluntarily
+ * (call schedule()) while it is executing on CPU, which corresponds to
+ * the running DA state.  A task in the waiting state is TASK_RUNNING in
+ * kernel terms (on the runqueue) and cannot block itself.
+ *
+ * da_handle_event() is called unconditionally: it skips tasks that have no
+ * monitor entry in the hash table.
+ */
+static void handle_sched_switch(void *data, bool preempt_unused,
+				struct task_struct *prev,
+				struct task_struct *next,
+				unsigned int prev_state)
+{
+	ktime_t now = ktime_get();
+	bool prev_preempted = (prev_state == 0);
+
+	if (tlob_acc_running(prev, now))
+		da_handle_event(prev->pid, NULL,
+				prev_preempted ? preempt_tlob : sleep_tlob);
+	if (tlob_acc_waiting(next, now))
+		da_handle_event(next->pid, NULL, switch_in_tlob);
+}
+
+/* Accumulate sleeping_ns on wakeup; returns true if task is monitored. */
+static inline bool tlob_acc_sleeping(struct task_struct *task, ktime_t now)
+{
+	return __tlob_acc(task, now, TLOB_ACC_SLEEPING);
+}
+
+/*
+ * handle_sched_wakeup - sleeping -> waiting transition.
+ *
+ * try_to_wake_up() skips TASK_RUNNING tasks, so this never fires for a
+ * task already in running or waiting state.
+ */
+static void handle_sched_wakeup(void *data, struct task_struct *p)
+{
+	ktime_t now = ktime_get();
+
+	if (tlob_acc_sleeping(p, now))
+		da_handle_event(p->pid, NULL, wakeup_tlob);
+}
+
+/*
+ * handle_sched_process_exit - clean up if a task exits without TRACE_STOP.
+ *
+ * Called in do_exit() context; the task still has a valid pid here.
+ * tlob_stop_task() returns -ESRCH if the task is not monitored, which is

fine.
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +27 -0

+static void handle_sched_process_exit(void *data, struct task_struct *p,
+				       bool group_dead)
+{
+	tlob_stop_task(p);
+}
+
+/**
+ * tlob_start_task - begin monitoring @task with budget @threshold_ns ns.
+ * @task:         Task to monitor; may be current or another task.
+ * @threshold_ns: Latency budget in nanoseconds (wall-clock; running +
+ *                waiting + sleeping).
+ *                Must be in [1000, TLOB_MAX_THRESHOLD_NS].
+ *
+ * Returns 0, -ENODEV, -ERANGE, -EALREADY, or -ENOSPC (pool at capacity).
+ */
+int tlob_start_task(struct task_struct *task, u64 threshold_ns)
+{
+	struct tlob_task_state *ws;
+
+	if (!da_monitor_enabled())
+		return -ENODEV;
+
+	if (threshold_ns < TLOB_MIN_THRESHOLD_NS ||
+	    threshold_ns > TLOB_MAX_THRESHOLD_NS)
+		return -ERANGE;
+
+	/* Serialise duplicate-check + pool-slot claim; see tlob_start_lock.

*/

kernel/trace/rv/monitors/tlob/tlob.c line 424

Quoted 7 lines

kernel/trace/rv/monitors/tlob/tlob.c new file +7 -0

+	guard(spinlock)(&tlob_start_lock);
+
+	/*
+	 * __da_get_mon_storage() uses hash_for_each_possible_rcu(), which
+	 * requires an RCU read-side critical section.  On PREEMPT_RT,
+	 * spinlock_t is an rt_mutex and does not satisfy this requirement.
+	 */

Also this is probably misleading, getting the monitor requires RCU, then the fact some in some configuration something other than read_lock_rcu() would work too (e.g. disabling preemption) is irrelevant.

Quoted 26 lines

kernel/trace/rv/monitors/tlob/tlob.c new file +22 -0

+	scoped_guard(rcu) {
+		if (da_get_target_by_id(task->pid))
+			return -EALREADY;
+	}
+
+	/*
+	 * Both tlob_ws_alloc() and da_handle_start_run_event() pop from
+	 * pre-allocated pools of size TLOB_MAX_MONITORED; NULL return means
+	 * the pool is at capacity.
+	 */
+	ws = tlob_ws_alloc();
+	if (!ws)
+		return -ENOSPC;
+
+	ws->task = task;
+	get_task_struct(task);
+	ws->threshold_ns = threshold_ns;
+	ws->last_ts = ktime_get();
+	raw_spin_lock_init(&ws->entry_lock);
+
+	/*
+	 * da_handle_start_run_event() claims a pool slot via

da_prepare_storage(),

(quoted diff) +2 -0

+	 * initialises the monitor, and delivers start_tlob in one step: the
+	 * generated ha_setup_invariants() resets clk_elapsed and arms the

timer.

Review

Quoted 2 lines

(quoted diff) +2 -0

+	 * Returns 0 if the da_monitor_storage pool is exhausted.
+	 */

And try not to be too specific about the internal implementation of the library, that can change without notice, we don't want to have to update all comments.

Here it is indeed non-trivial to assume no space if da_handle_start_run_event() fails, but that's only consequence of the fact that this ws is certainly new (by construction) and the monitor is
enabled: da_handle_start_run_event() can only fail if allocation failed.

da_handle_start_* functions return 1 if an event was handled, this is by the way not documented..

You could simply say something like:

da_handle_start_run_event() returns false if no event was handled, in
this case it can happen only if memory allocation failed

Quoted 54 lines

kernel/trace/rv/monitors/tlob/tlob.c new file +40 -0

+	if (!da_handle_start_run_event(task->pid, ws, start_tlob)) {
+		put_task_struct(task);
+		tlob_ws_direct_return(ws);
+		return -ENOSPC;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(tlob_start_task);
+
+/**
+ * tlob_stop_task - stop monitoring @task.
+ * @task: Task to stop.
+ *
+ * CAS on ws->stopping (0->1) under RCU claims cleanup ownership;
+ * the winner cancels the timer synchronously and frees all resources.
+ *
+ * Returns 0, -EOVERFLOW (budget exceeded), -ESRCH (not monitored),
+ * or -EAGAIN (concurrent caller claimed cleanup).
+ */
+int tlob_stop_task(struct task_struct *task)
+{
+	struct da_monitor *da_mon;
+	struct ha_monitor *ha_mon;
+	struct tlob_task_state *ws;
+	bool budget_exceeded;
+
+	scoped_guard(rcu) {
+		ws = da_get_target_by_id(task->pid);
+		if (!ws)
+			return -ESRCH;
+
+		da_mon = da_get_monitor(task->pid, NULL);
+		if (unlikely(WARN_ON_ONCE(!da_mon)))
+			return -ESRCH;
+
+		ha_mon = to_ha_monitor(da_mon);
+
+		/*
+		 * CAS (0->1) claims cleanup ownership under RCU (ws

guaranteed valid).

(quoted diff) +1 -0

+		 * _release pairs with atomic_read_acquire in

ha_setup_invariants.

kernel/trace/rv/monitors/tlob/tlob.c new file +11 -0

+		 */
+		if (atomic_cmpxchg_release(&ws->stopping, 0, 1) != 0)
+			return -EAGAIN;
+	}
+	/*
+	 * ws and ha_mon are used below outside the RCU guard.  This is safe:
+	 * the winning CAS (stopping: 0->1) is the only path that frees ws,
+	 * and da_destroy_storage() below is the only call that returns the
+	 * pool slot.  No concurrent path can free either object.
+	 */
+

kernel/trace/rv/monitors/tlob/tlob.c line 512

Quoted 10 lines

kernel/trace/rv/monitors/tlob/tlob.c new file +10 -0

+	/* Wait for in-flight timer callback before reading da_monitoring. */
+	ha_cancel_timer_sync(ha_mon);
+
+	/* Timer fired first -> budget exceeded; otherwise reset normally. */
+	scoped_guard(rcu) {
+		budget_exceeded = !da_monitoring(da_mon);
+		if (!budget_exceeded)
+			da_monitor_reset(da_mon);
+	}
+	da_destroy_storage(task->pid);

Here you're playing with the state machine, that looks fragile from a monitor code.
You could probably have budget_exceeded as part of your target and set it from tlob_reset_notify() when you know there was an expiration.

Perhaps "stop" could be yet another event in the state machine, bringing to the "stopped" state, which would automatically call reset(), you only need to grab ws->stopping before handling the event for tlob_reset_notify() to work as expected.
Though you'd probably still need ha_cancel_timer_sync() for the rare but not impossible in-flight timer not yet in RCU critical section..