Add task latency over budget RV monitor

Quoted 11 lines

+  if [ -n "$OPT_TEST_DIR" ]; then
+    # Walk up from OPT_TEST_DIR to find the nearest ancestor that contains +    # test.d/functions.  This allows a monitor subdirectory (e.g. +    # verification/test.d/tlob/) to be passed directly without placing a +    # dummy functions shim in each new subdirectory.
+    # Security: only walk within directories owned by root or the current user
+    # to prevent sourcing a functions file planted in a world-writable ancestor.
+    dir=$(realpath "$OPT_TEST_DIR" 2>/dev/null || echo "$OPT_TEST_DIR") +    while [ "$dir" != "/" ] && [ "$dir" != "//" ]; do

Quoted 8 lines

+      if [ -f "$dir/test.d/functions" ]; then
+        # Verify the directory is not world-writable to prevent LPE. +        dirperms=$(stat -c "%a" "$dir" 2>/dev/null || stat -f "%Lp" "$dir" 2>/dev/null)
+        case "$dirperms" in
+          *2|*3|*6|*7) ;; # world-writable: skip this candidate +          *)
+            TOP_DIR=$dir

[Severity: High]
Does this logic actually check directory ownership as mentioned in the comments?

It appears the code only checks if the directory is world-writable, but omits validating that it is owned by root or the current user. An attacker could potentially create a directory with standard 0755 permissions, plant a malicious test.d/functions script, and if a privileged user or automated test harness runs ftracetest against a subdirectory, the script would traverse up and source the payload.

Additionally, if the stat command fails for any reason, dirperms will be empty.
Would an empty string match the *) fallback case and cause the script to silently
fail open, accepting even a world-writable directory?

Quoted 9 lines

+            TEST_DIR=$TOP_DIR/test.d
+            break
+            ;;
+        esac
+      fi
+      dir=$(dirname "$dir")
+    done
   fi
 }

In my opinion all this stat/dirperms thing is rarely useful, you could just write the concern in a *brief* comment, saying we trust 4-5 level ups are still in the repo and we trust the repo, just to make AIs happy.

What do you think?

From: Wen Yang <[email protected]>

kernel/trace/rv/monitors/tlob/tlob.c new file +7 -0

+static inline void tlob_reset_notify(struct da_monitor *da_mon)
+{
+	struct ha_monitor *ha_mon = to_ha_monitor(da_mon);
+	struct tlob_task_state *ws;
+
+	ha_monitor_reset_env(da_mon);
+

(quoted diff) +2 -0

+
+	/* Genuine expiry: end the window so a later start takes the restart

path. */

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+	atomic_set(&ws->stopping, 1);
+
+	/* Stamped regardless of the tracepoint; tlob_stop_task() reads it.

*/

kernel/trace/rv/monitors/tlob/tlob.c new file +10 -0

+	WRITE_ONCE(ws->budget_exceeded, true);
+
+	if (!trace_detail_env_tlob_enabled())
+		return;
+
+	unsigned int curr_state = READ_ONCE(da_mon->curr_state);
+	u64 accs[TLOB_ACC_MAX], partial_ns;
+	unsigned long flags;
+
+	/* Snapshot accumulators; partial_ns covers curr_state time not yet

folded in. */

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+	raw_spin_lock_irqsave(&ws->entry_lock, flags);
+	partial_ns = ktime_get_ns() - ktime_to_ns(ws->last_ts);
+	accs[TLOB_ACC_RUNNING]  = ws->accs_ns[TLOB_ACC_RUNNING]  +
+				  (curr_state == running_tlob  ? partial_ns :

0);

(quoted diff) +2 -0

+	accs[TLOB_ACC_WAITING]  = ws->accs_ns[TLOB_ACC_WAITING]  +
+				  (curr_state == waiting_tlob  ? partial_ns :

0);

(quoted diff) +2 -0

+	accs[TLOB_ACC_SLEEPING] = ws->accs_ns[TLOB_ACC_SLEEPING] +
+				  (curr_state == sleeping_tlob ? partial_ns :

0);

kernel/trace/rv/monitors/tlob/tlob.c new file +27 -0

+	raw_spin_unlock_irqrestore(&ws->entry_lock, flags);
+
+	trace_detail_env_tlob(da_get_id(da_mon), ws->threshold_ns,
+			      accs[TLOB_ACC_RUNNING],
+			      accs[TLOB_ACC_WAITING],
+			      accs[TLOB_ACC_SLEEPING]);
+}
+
+#define BUDGET_NS(ha_mon) (ha_get_target(ha_mon)->threshold_ns)
+
+/* HA constraint functions (called by ha_monitor_handle_constraint) */
+
+static u64 ha_get_env(struct ha_monitor *ha_mon, enum envs_tlob env,
+		      u64 time_ns)
+{
+	if (env == clk_elapsed_tlob)
+		return ha_get_clk_ns(ha_mon, env, time_ns);
+	return ENV_INVALID_VALUE;
+}
+
+/*
+ * Invariant: clk_elapsed < BUDGET_NS in running/waiting/sleeping.  "stopped"
+ * is exempt: the parked period must not be measured against the old window's
+ * clock anchor (restart from "stopped" would otherwise spuriously overrun).
+ */
+static inline bool ha_verify_invariants(struct ha_monitor *ha_mon,
+					enum states curr_state, enum events

event,

kernel/trace/rv/monitors/tlob/tlob.c new file +5 -0

+					enum states next_state, u64 time_ns)
+{
+	if (curr_state == stopped_tlob)
+		return true;
+	return ha_check_invariant_ns(ha_mon, clk_elapsed_tlob, time_ns,

BUDGET_NS(ha_mon));

kernel/trace/rv/monitors/tlob/tlob.c new file +14 -0

+}
+
+/*
+ * The clock stays in guard (anchor) representation all window: env_store
+ * holds the window-start timestamp, re-anchored on start/restart.
+ * ha_invariant_passed_ns() never stores the deadline representation (the
+ * framework dropped ha_set_invariant_ns(), commit ab2900ae252b), so calling
+ * ha_inv_to_guard() here would subtract BUDGET_NS from the anchor and skew
+ * every check by one budget.  nomiss likewise never converts.
+ */
+
+/* No per-event guard conditions for tlob; invariants suffice. */
+static inline bool ha_verify_guards(struct ha_monitor *ha_mon,
+				    enum states curr_state, enum events

event,

kernel/trace/rv/monitors/tlob/tlob.c new file +14 -0

+	return true;
+}
+
+/*
+ * Guard on stopping: a sched_switch after ha_cancel_timer_sync() would
+ * re-arm the timer (ODEBUG splat).  _acquire pairs with cmpxchg_release in
+ * tlob_stop_task.
+ *
+ * Entering stopped_tlob also resets env_store to the invalid sentinel, so a
+ * restart re-anchors the clock; a stale anchor would wrap the restart's
+ * timer delay to ~U64_MAX.
+ */
+static inline void ha_setup_invariants(struct ha_monitor *ha_mon,
+				       enum states curr_state, enum events

event,

kernel/trace/rv/monitors/tlob/tlob.c new file +6 -0

+				       enum states next_state, u64 time_ns)
+{
+	if (next_state == stopped_tlob) {
+		/*
+		 * Window ending: reset env_store to the invalid sentinel so
+		 * the next window gets a fresh clock anchor.  Keep

stopping==1

(quoted diff) +1 -0

+		 * so __tlob_acc() continues to block sched events while

parked.

kernel/trace/rv/monitors/tlob/tlob.c new file +8 -0

+		/*
+		 * Restart (stopped -> running): arm the timer, then clear
+		 * stopping so __tlob_acc() admits sched events only once the
+		 * state is already running_tlob.  _release pairs with the
+		 * acquires in __tlob_acc/tlob_reset_notify.
+		 */
+		if (next_state < state_max_tlob)
+			ha_start_timer_ns(ha_mon, clk_elapsed_tlob,

BUDGET_NS(ha_mon), time_ns);

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+		atomic_set_release(&ha_get_target(ha_mon)->stopping, 0);
+		return;
+	}

kernel/trace/rv/monitors/tlob/tlob.c new file +8 -0

+
+/*
+ * Accumulate elapsed ns into accs_ns[idx] since last_ts and advance it.
+ * Returns true if monitored with an active window.  The stopping gate is
+ * what keeps scheduler events from reaching a parked task (no "stopped"
+ * self-loops, see tlob.h) and keeps accs_ns[] from growing while parked.
+ */
+static inline bool __tlob_acc(struct task_struct *task, ktime_t now,

include/rv/da_monitor.h +26 -0

+/*
+ * da_create_pool_storage - pop a free pool slot and insert it into the hash.
+ *
+ * Returns the new da_monitor, or NULL if the pool is exhausted.  Finding
+ * an existing entry for the same id fires WARN_ON_ONCE (double-start bug).
+ *
+ * Caller must hold an RCU read-side CS and the monitor's serialisation lock.
+ */
+static inline struct da_monitor *
+da_create_pool_storage(da_id_type id, monitor_target target,
+		       struct da_monitor *da_mon)
+{
+	struct da_monitor_storage *mon_storage, *existing;
+
+	if (da_mon)
+		return da_mon;
+
+	mon_storage = mempool_alloc_preallocated(&da_monitor_pool);
+	if (!mon_storage)
+		return NULL;
+	memset(mon_storage, 0, sizeof(*mon_storage));
+
+	mon_storage->id = id;
+	mon_storage->target = target;
+
+	/* Single consumer under the caller's lock; duplicate is a double-

start bug. */

include/rv/da_monitor.h +4 -0

+	hash_add_rcu(da_monitor_ht, &mon_storage->node, id);
+	return &mon_storage->rv.da_mon;
+}
+

include/rv/da_monitor.h +9 -1

  		hash_del_rcu(&mon_storage->node);
-		kfree(mon_storage);
+		if (DA_MON_ALLOCATION_STRATEGY == DA_ALLOC_POOL)
+			mempool_free(mon_storage, &da_monitor_pool);
+		else
+			kfree(mon_storage);
+	}
+
+	if (DA_MON_ALLOCATION_STRATEGY == DA_ALLOC_POOL) {
+		rcu_barrier();
+		mempool_exit(&da_monitor_pool);
  	}
  }

 /*

- * Allow the per-object monitors to run allocation manually, necessary if the
- * start condition is in a context problematic for allocation (e.g. scheduling).
- * In such case, if the storage was pre-allocated without a target, set it now.
+ * da_prepare_storage - allocate or link per-object monitor storage.
+ *
+ * Called only from da_handle_start_run_event(); must run in task context

+ * for DA_ALLOC_AUTO and DA_ALLOC_POOL (both take a spinlock_t internally).
+ * Subsequent event handlers use da_handle_event() and never allocate. */

include/rv/da_monitor.h +0 -5

-#ifdef DA_SKIP_AUTO_ALLOC
-#define da_prepare_storage da_fill_empty_storage
-#else
-#define da_prepare_storage da_create_storage
-#endif /* DA_SKIP_AUTO_ALLOC */

From: Wen Yang <[email protected]>
+/**
+ * struct rv_uprobe - embeddable uprobe handle for RV monitors
+ *
+ * Embed via DECLARE_RV_UPROBE() and pass &name to rv_uprobe_register().
+ * The caller may free the containing struct after rv_uprobe_unregister()
+ * (or rv_uprobe_unregister_nosync() + rv_uprobe_sync()) returns.
+ *
+ * @uc:     embedded uprobe_consumer; set handler/ret_handler before registering
+ * @uprobe: registered uprobe pointer (NULL when not registered)
+ * @path:   path of the probed binary, held until unregistration
+ */

include/rv/rv_uprobe.h new file +3 -0

+struct rv_uprobe {
+	struct uprobe_consumer	uc;
+	struct uprobe		*uprobe;

include/rv/rv_uprobe.h new file +8 -0

+bool rv_uprobe_is_registered(const struct rv_uprobe *p);
+
+/**
+ * rv_uprobe_register - initialise and register an uprobe
+ * @binpath: absolute path to the target binary
+ * @offset:  byte offset within the binary
+ * @p:       caller-provided rv_uprobe (embedded via DECLARE_RV_UPROBE);
+ *           p->uc.handler and/or p->uc.ret_handler must be set before this

call
+ *
+ * Resolves the path and registers p->uc with the uprobe subsystem.
+ * No heap allocation is performed.
+ *
+ * Returns 0 on success, negative errno on failure.
+ */
+int rv_uprobe_register(const char *binpath, loff_t offset, struct rv_uprobe *p);

kernel/trace/rv/rv_uprobe.c new file +11 -0

+/**
+ * rv_uprobe_unregister_nosync - dequeue an uprobe without waiting
+ */
+void rv_uprobe_unregister_nosync(struct rv_uprobe *p)
+{
+	if (!p || !p->uprobe)
+		return;
+
+	uprobe_unregister_nosync(p->uprobe, &p->uc);
+	p->uprobe = NULL;
+	/* path held; caller must call rv_uprobe_sync() then path_put(&p-

Quoted 1 line

path) */

From: Wen Yang <[email protected]>

Documentation/trace/rv/monitor_tlob.rst new file +11 -0

+
+Description
+-----------
+
+The tlob monitor tracks per-task elapsed wall-clock time (CLOCK_MONOTONIC,
+spanning running, waiting, and sleeping states) and reports a violation when
+the monitored task exceeds a configurable per-invocation budget threshold.
+
+The monitor implements a four-state hybrid automaton with a single clock
+environment variable ``clk_elapsed``.  The clock invariant
+``clk_elapsed < BUDGET_NS()`` is active in the ``running``, ``waiting``, and

+        |        |       |
+        |        |       |
+        |        v       v

+        +---------+  +---------+
+        | waiting |  | sleeping|
+        +---------+  +---------+
+             ^            v
+             |   wakeup   |
+             |            |
+             +------------+
+
+  A fourth state, ``stopped``, has no clock invariant (hence no timer). +  ``running`` reaches it on ``stop`` (``tlob_stop_task()``, window ended, +  per-task state parked rather than freed) and returns to ``running`` on +  ``start`` (``tlob_start_task()`` restarting the same task's parked +  window).

+
+  Key transitions:
+    running  --(sleep)------> sleeping   (task blocks waiting for a resource) +    running  --(preempt)----> waiting    (task preempted, back in runqueue) +    sleeping --(wakeup)-----> waiting    (resource available, enters runqueue)
+    waiting  --(switch_in)--> running    (scheduler picks task, back on CPU) +    running  --(stop)-------> stopped    (tlob_stop_task(): window ended, parked)
+    stopped  --(start)------> running    (tlob_start_task(): window restarted)
+
+  ``tlob_start_task()`` calls ``da_handle_start_run_event(task->pid, ws, start_tlob)``.
+  The ``start_tlob`` edge goes ``stopped`` -> ``running`` for both a fresh +  allocation (the initial state is ``stopped``) and a parked window's restart;
+  there is no ``start`` self-loop on ``running`` (a running task's START is +  rejected with ``-EALREADY``).  The transition triggers ``ha_setup_invariants()``,

+  which anchors ``clk_elapsed`` and arms the budget timer automatically. +  ``tlob_stop_task()`` cancels the HA timer synchronously
+  via ``ha_cancel_timer_sync()``, then dispatches the ``stop_tlob`` event +  (running -> stopped) instead of resetting the monitor: the per-task state +  is parked, not freed, so a later ``tlob_start_task()`` call for the same +  task can restart it without reallocating.  Final teardown (task exit, +  uprobe unbind, or monitor disable) is what actually calls
+  ``da_monitor_reset()`` and frees the state.

kernel/trace/rv/monitors/tlob/Kconfig new file +1 -0

+	  elapsed time exceeds a configurable per-invocation budget.

kernel/trace/rv/monitors/tlob/tlob.c new file +0 -0

new file mode 100644
index 000000000000..08b1bee884cc

kernel/trace/rv/monitors/tlob/tlob.c new file +16 -0

+struct tlob_task_state {
+	struct task_struct	*task;		/* via get_task_struct */
+	u64			threshold_ns;	/* budget in nanoseconds */
+
+	/*
+	 * Per-window: 1 = this window ended (stop or timer expiry).  Blocks
+	 * timer re-arm in ha_setup_invariants(); cleared on restart.
+	 */
+	atomic_t		stopping;
+
+	/*
+	 * Per-task, one-shot: final teardown has claimed this slot; never
+	 * reset (a window can end and restart, the task cannot).  atomic_t
+	 * so cmpxchg is well-defined on every arch.
+	 */
+	atomic_t		destroying;

kernel/trace/rv/monitors/tlob/tlob.c new file +10 -0

+	/*
+	 * Linked into binding->started_list for the whole lifetime (not just
+	 * while parked) so unbind reaping finds parked and active tasks.
+	 * Protected by tlob_ws_lock.
+	 */
+	struct list_head	started_node;
+
+	/* Serialises accs_ns[]; held briefly (hardirq-safe). */
+	raw_spinlock_t		entry_lock;
+	u64			accs_ns[TLOB_ACC_MAX]; /* per-state elapsed

ns */

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+	ktime_t			last_ts;
+
+	struct rcu_head		rcu;
+};

kernel/trace/rv/monitors/tlob/tlob.c new file +3 -0

+	guard(spinlock)(&tlob_ws_lock);
+	list_del_init(&ws->started_node);
+}

kernel/trace/rv/monitors/tlob/tlob.c new file +17 -0

+
+/**
+ * tlob_start_task - begin monitoring @task with budget @threshold_ns ns.
+ * @task:         Task to monitor; may be current or another task.
+ * @threshold_ns: Budget in ns, in [1000, TLOB_MAX_THRESHOLD_NS].
+ * @binding:      Opaque owner, recorded on fresh allocation and checked for
+ *                an exact match on restart; NULL for callers that never
+ *                restart a parked window.
+ *
+ * Allocates a fresh entry if @task has none, or restarts a parked entry in
+ * place when @binding matches (see tlob.dot: "start" fires from both
+ * running and stopped).
+ *
+ * Returns 0, -ENODEV, -ERANGE, -EALREADY, -ESRCH, or -ENOSPC (fresh start
+ * past pool capacity).
+ */
+static int tlob_start_task(struct task_struct *task, u64 threshold_ns, void

*binding)

kernel/trace/rv/monitors/tlob/tlob.c new file +35 -0

+{
+	struct tlob_task_state *ws;
+
+	if (!da_monitor_enabled())
+		return -ENODEV;
+
+	if (threshold_ns < TLOB_MIN_THRESHOLD_NS ||
+	    threshold_ns > TLOB_MAX_THRESHOLD_NS)
+		return -ERANGE;
+
+	/* Serialise duplicate-check + pool-slot claim; see tlob_ws_lock. */
+	guard(spinlock)(&tlob_ws_lock);
+
+	/*
+	 * da_get_target_by_id() uses hash_for_each_possible_rcu(), which
+	 * requires an RCU read-side critical section.
+	 */
+	scoped_guard(rcu) {
+		ws = da_get_target_by_id(task->pid);
+		if (ws) {
+			if (!atomic_read(&ws->stopping))
+				return -EALREADY;
+			if (atomic_read(&ws->destroying))
+				return -ESRCH;
+			/*
+			 * Exact match only.  An orphaned parked ws (binding
+			 * cleared while active, then parked) is not adopted:
+			 * that would need re-linking into the new binding's
+			 * started_list.  Accepted gap; the slot is reclaimed
+			 * at task exit.
+			 */
+			if (ws->binding != binding)
+				return -EALREADY;
+
+			/* Restart in place: same slot, hash entry, task ref,

list node. */

kernel/trace/rv/monitors/tlob/tlob.c new file +9 -0

+			ws->threshold_ns = threshold_ns;
+			WRITE_ONCE(ws->budget_exceeded, false);
+			memset(ws->accs_ns, 0, sizeof(ws->accs_ns));
+			ws->last_ts = ktime_get();
+
+			/*
+			 * Keep stopping set: __tlob_acc() gates out sched
+			 * events until ha_setup_invariants() clears it after
+			 * the state is running_tlob.  Clearing here would

let

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+			 * events hit stopped_tlob (INVALID transitions).
+			 */
+
+			/* Only failure here: monitor disabled since the

check above. */

kernel/trace/rv/monitors/tlob/tlob.c new file +1 -0

+			if (!da_handle_start_run_event(task->pid, ws,

start_tlob))

kernel/trace/rv/monitors/tlob/tlob.c new file +18 -0

+				return -ENODEV;
+			return 0;
+		}
+	}
+
+	ws = tlob_ws_alloc();
+	if (!ws)
+		return -ENOSPC;
+
+	ws->task = task;
+	get_task_struct(task);
+	ws->threshold_ns = threshold_ns;
+	ws->last_ts = ktime_get();
+	raw_spin_lock_init(&ws->entry_lock);
+	ws->binding = binding;
+	if (binding)
+		list_add_tail(&ws->started_node,
+			      &((struct tlob_uprobe_binding *)binding)-

Quoted 1 line

started_list);

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+
+	/* Dispatch failed (pool exhausted or monitor disabled): unwind the

slot. */

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+	if (!da_handle_start_run_event(task->pid, ws, start_tlob)) {
+		if (binding)
+			list_del_init(&ws->started_node);
+		/* stopping=1 short-circuits the reset hook; destroy before

freeing ws. */

kernel/trace/rv/monitors/tlob/tlob.c new file +34 -0

+		atomic_set(&ws->stopping, 1);
+		da_destroy_storage(task->pid);
+		put_task_struct(task);
+		tlob_ws_direct_return(ws);
+		return -ENOSPC;
+	}
+
+	return 0;
+}
+
+/**
+ * tlob_stop_task - end the current monitoring window for @task.
+ * @task: Task to stop.
+ * @binding: Opaque owner; must match ws->binding to end a normal (uprobe)
+ *           window.  NULL (task exit) skips the check.
+ *
+ * Ends the window (dispatches "stop") but does NOT free the entry: it stays
+ * parked so a later tlob_start_task() can restart it.  Call
+ * tlob_destroy_task() once @task will never restart.
+ *
+ * cmpxchg on stopping (0->1) under RCU claims ownership; the winner cancels
+ * the timer synchronously.
+ *
+ * Returns 0, -EOVERFLOW (budget exceeded), -ESRCH (not monitored),
+ * -EAGAIN (window already ended), or -EALREADY (owned by another binding).
+ */
+static int tlob_stop_task(struct task_struct *task, void *binding)
+{
+	struct ha_monitor *ha_mon;
+	struct tlob_task_state *ws;
+	bool budget_exceeded;
+
+	scoped_guard(rcu) {
+		ha_mon = ha_get_monitor(task->pid, NULL);

+ * drops the task_struct ref, removes the hash entry, whether active or parked.
+ * Idempotent via the destroying cmpxchg (same pattern as tlob_extra_cleanup()).
+ * Callers must end the window first (see handle_sched_process_exit()).
+ */

kernel/trace/rv/monitors/tlob/tlob.c new file +19 -0

+static void tlob_destroy_task(struct task_struct *task)
+{
+	struct ha_monitor *ha_mon;
+	struct tlob_task_state *ws;
+
+	scoped_guard(rcu) {
+		ha_mon = ha_get_monitor(task->pid, NULL);
+		if (!ha_mon)
+			return;
+		ws = ha_get_target(ha_mon);
+		if (WARN_ON_ONCE(!ws))
+			return;
+		if (atomic_cmpxchg_release(&ws->destroying, 0, 1) != 0)
+			return;
+	}
+
+	tlob_detach_from_binding(ws);
+
+	/* Force the window ended: @task may never have reached STOP or a

timer. */

kernel/trace/rv/monitors/tlob/tlob.c new file +17 -0

+	atomic_set(&ws->stopping, 1);
+	ha_cancel_timer_sync(ha_mon);
+
+	scoped_guard(rcu) {
+		da_monitor_reset(&ha_mon->da_mon);
+	}
+	da_destroy_storage(task->pid);
+
+	put_task_struct(ws->task);
+	call_rcu(&ws->rcu, tlob_ws_return_cb);
+}
+
+static int tlob_uprobe_entry_handler(struct uprobe_consumer *self,
+				     struct pt_regs *regs, __u64 *data)
+{
+	struct tlob_uprobe_binding *b =
+		container_of(self, struct tlob_uprobe_binding,

start_probe.uc);

kernel/trace/rv/monitors/tlob/tlob.c new file +10 -0

+
+	tlob_start_task(current, b->threshold_ns, b);
+	return 0;
+}
+
+static int tlob_uprobe_stop_handler(struct uprobe_consumer *self,
+				    struct pt_regs *regs, __u64 *data)
+{
+	struct tlob_uprobe_binding *b =
+		container_of(self, struct tlob_uprobe_binding,

stop_probe.uc);

kernel/trace/rv/monitors/tlob/tlob.c new file +23 -0

+
+	tlob_stop_task(current, b);
+	return 0;
+}
+
+/*
+ * Register start + stop entry uprobes for a binding.
+ * Called with tlob_uprobe_mutex held.
+ */
+static int tlob_add_uprobe(u64 threshold_ns, const char *binpath,
+			   loff_t offset_start, loff_t offset_stop)
+{
+	struct tlob_uprobe_binding *tmp_b;
+	char pathbuf[TLOB_MAX_PATH];
+	struct inode *inode;
+	struct path path __free(path_put) = {};
+	char *canon;
+	int ret;
+
+	if (binpath[0] != '/')
+		return -EINVAL;
+
+	struct tlob_uprobe_binding *b __free(kfree) = kzalloc_obj(*b,

GFP_KERNEL);

kernel/trace/rv/monitors/tlob/tlob.c new file +43 -0

+	if (!b)
+		return -ENOMEM;
+
+	b->threshold_ns = threshold_ns;
+	b->offset_start = offset_start;
+	b->offset_stop  = offset_stop;
+	INIT_LIST_HEAD(&b->started_list);
+
+	ret = kern_path(binpath, LOOKUP_FOLLOW, &path);
+	if (ret)
+		return ret;
+
+	if (!d_is_reg(path.dentry))
+		return -EINVAL;
+
+	inode = d_real_inode(path.dentry);
+
+	/* Reject duplicate start offset for the same binary inode. */
+	list_for_each_entry(tmp_b, &tlob_uprobe_list, list) {
+		if (tmp_b->offset_start == offset_start &&
+		    rv_uprobe_is_registered(&tmp_b->start_probe) &&
+		    d_real_inode(tmp_b->start_probe.path.dentry) == inode)
+			return -EEXIST;
+	}
+
+	canon = d_path(&path, pathbuf, sizeof(pathbuf));
+	if (IS_ERR(canon))
+		return PTR_ERR(canon);
+	strscpy(b->binpath, canon, sizeof(b->binpath));
+
+	b->start_probe.uc.handler = tlob_uprobe_entry_handler;
+	ret = rv_uprobe_register(b->binpath, offset_start, &b->start_probe);
+	if (ret)
+		return ret;
+
+	b->stop_probe.uc.handler = tlob_uprobe_stop_handler;
+	ret = rv_uprobe_register(b->binpath, offset_stop, &b->stop_probe);
+	if (ret) {
+		rv_uprobe_unregister(&b->start_probe);
+		return ret;
+	}
+
+	/* NOT "b = no_free_ptr(b)": the re-assignment would free the live

node. */

kernel/trace/rv/monitors/tlob/tlob.c new file +20 -0

+	list_add_tail(&no_free_ptr(b)->list, &tlob_uprobe_list);
+	return 0;
+}
+
+/*
+ * tlob_unbind_reap - detach every task @b started, destroy the parked ones.
+ *
+ * Caller must have unregistered @b's uprobes and called rv_uprobe_sync():
+ * no start/stop can then be in flight for @b, so started_list is safe to
+ * walk.  Active tasks are detached (binding cleared) and left running,
+ * matching unbind behaviour today; parked tasks are destroyed, or their
+ * pool slot leaks until the task next exits.
+ */
+static void tlob_unbind_reap(struct tlob_uprobe_binding *b)
+{
+	struct tlob_task_state *ws, *tmp;
+	LIST_HEAD(to_destroy);
+
+	scoped_guard(spinlock, &tlob_ws_lock) {
+		list_for_each_entry_safe(ws, tmp, &b->started_list,

started_node) {

kernel/trace/rv/monitors/tlob/tlob.c new file +4 -0

+			list_del_init(&ws->started_node);
+			ws->binding = NULL;
+			if (atomic_read(&ws->stopping))
+				list_add_tail(&ws->started_node,

&to_destroy);

kernel/trace/rv/monitors/tlob/tlob.c new file +10 -0

+		}
+	}
+
+	list_for_each_entry_safe(ws, tmp, &to_destroy, started_node) {
+		list_del_init(&ws->started_node);
+		tlob_destroy_task(ws->task);
+	}
+}
+
+static int tlob_remove_uprobe_by_key(loff_t offset_start, const char

*binpath)

kernel/trace/rv/monitors/tlob/tlob.c new file +25 -0

+{
+	struct tlob_uprobe_binding *b, *tmp;
+	struct path remove_path;
+	struct inode *inode;
+	int ret;
+
+	ret = kern_path(binpath, LOOKUP_FOLLOW, &remove_path);
+	if (ret)
+		return ret;
+
+	inode = d_real_inode(remove_path.dentry);
+
+	ret = -ENOENT;
+	list_for_each_entry_safe(b, tmp, &tlob_uprobe_list, list) {
+		if (b->offset_start != offset_start)
+			continue;
+		if (d_real_inode(b->start_probe.path.dentry) != inode)
+			continue;
+		list_del(&b->list);
+		/*
+		 * rv_uprobe_sync() may sleep; list_del() already made the
+		 * binding invisible to new readers.
+		 */
+		rv_uprobe_unregister_nosync(&b->start_probe);
+		rv_uprobe_unregister_nosync(&b->stop_probe);

kernel/trace/rv/monitors/tlob/tlob.c new file +2 -0

+	return ret;
+}

kernel/trace/rv/monitors/tlob/tlob.c new file +8 -0

+/*
+ * Parse "p PATH:OFFSET_START OFFSET_STOP threshold=NS".
+ * PATH may contain ':'; the last ':' separates path from offset.
+ * Returns 0, -EINVAL, or -ERANGE.
+ */
+VISIBLE_IF_KUNIT int tlob_parse_uprobe_line(char *buf, u64 *thr_out,
+					    char **path_out,
+					    loff_t *start_out, loff_t

*stop_out)

kernel/trace/rv/monitors/tlob/tlob.c new file +43 -0

+{
+	unsigned long long thr = 0, stop_val = 0;
+	long long start_val;
+	char *p, *path_token, *token, *colon;
+	bool got_stop = false, got_thr = false;
+	int n;
+
+	/* Must start with "p " */
+	if (buf[0] != 'p' || buf[1] != ' ')
+		return -EINVAL;
+
+	p = buf + 2;
+	while (*p == ' ')
+		p++;
+
+	/* First space-delimited token is PATH:OFFSET_START */
+	path_token = strsep(&p, " \t");
+	if (!path_token || !*path_token)
+		return -EINVAL;
+
+	/* Split at last ':' to handle paths that contain ':'. */
+	colon = strrchr(path_token, ':');
+	if (!colon || colon - path_token < 2)
+		return -EINVAL;
+	*colon = '\0';
+
+	if (path_token[0] != '/')
+		return -EINVAL;
+
+	n = 0;
+	if (sscanf(colon + 1, "%lli%n", &start_val, &n) != 1 || n == 0)
+		return -EINVAL;
+	if (start_val < 0)
+		return -EINVAL;
+
+	/* Remaining tokens: OFFSET_STOP threshold=NS */
+	while (p && (token = strsep(&p, " \t")) != NULL) {
+		if (!*token)
+			continue;
+		if (strncmp(token, "threshold=", 10) == 0) {
+			if (kstrtoull(token + 10, 0, &thr))
+				return -EINVAL;
+			if (thr < TLOB_MIN_THRESHOLD_NS || thr >

TLOB_MAX_THRESHOLD_NS)

kernel/trace/rv/monitors/tlob/tlob.c new file +19 -0

+				return -ERANGE;
+			got_thr = true;
+		} else if (!got_stop) {
+			long long sv;
+
+			n = 0;
+			if (sscanf(token, "%lli%n", &sv, &n) != 1 || n == 0)
+				return -EINVAL;
+			if (sv < 0)
+				return -EINVAL;
+			stop_val = (unsigned long long)sv;
+			got_stop = true;
+		} else {
+			return -EINVAL;
+		}
+	}
+
+	if (!got_stop || !got_thr)
+		return -EINVAL;

kernel/trace/rv/monitors/tlob/tlob.c new file +13 -0

+{
+	char *binpath, *colon;
+	long long off;
+	int n = 0;
+
+	if (buf[0] != '-')
+		return -EINVAL;
+	binpath = buf + 1;
+	if (binpath[0] != '/')
+		return -EINVAL;
+	colon = strrchr(binpath, ':');
+	if (!colon || colon - binpath < 2)
+		return -EINVAL;

kernel/trace/rv/monitors/tlob/tlob.c new file +5 -0

+
+static int tlob_create_or_delete_uprobe(char *buf)
+{
+	loff_t offset_start, offset_stop;
+	u64 threshold_ns;

From: Wen Yang <[email protected]>

Add a test case to the shared rv_monitors_test.c suite (gated by the existing CONFIG_RV_MONITORS_KUNIT_TEST, same as nomiss/sco/etc.) covering the uprobe-line parser.

tlob_parse_uprobe_line() and tlob_parse_remove_line() stay static and
unconditional: production code (tlob_create_or_delete_uprobe()) always needs them, so they can't be compiled out, and un-hiding them via VISIBLE_IF_KUNIT would tie their linkage to CONFIG_KUNIT while nothing else in tlob.c depends on it. Instead, expose them to the test only through a const rv_tlob_kunit_ops struct of function pointers, built and exported the same way nomiss.c/sco.c expose their rv_<mon>_ops:
the struct itself, its declaration in tlob_kunit.h, and its use in tlob_kunit.c are all gated on the single CONFIG_RV_MONITORS_KUNIT_TEST symbol, so there is no separate prototype to go out of sync with a visibility macro.

tlob_kunit.c follows the monitors/*/*_kunit.c convention: one rv_test_tlob() case textually included into rv_monitors_test.c, guarded by IS_REACHABLE(CONFIG_RV_MON_TLOB) with an rv_test_stub() fallback so the shared suite still builds when RV_MON_TLOB=n (that symbol is independent of CONFIG_RV_MONITORS_KUNIT_TEST). Drop the per-monitor TLOB_KUNIT_TEST Kconfig entry, .kunitconfig, and Makefile line that a standalone test module would have needed.

Cases cover valid inputs, malformed paths and offsets (including negative values), out-of-range thresholds, and valid and invalid remove lines.

Signed-off-by Wen Yang <[email protected]>

---

 kernel/trace/rv/monitors/tlob/tlob.c       | 24 ++++-- kernel/trace/rv/monitors/tlob/tlob_kunit.c | 87 ++++++++++++++++++++++ kernel/trace/rv/monitors/tlob/tlob_kunit.h | 17 +++++ kernel/trace/rv/rv_monitors_test.c         |  2 +

 4 files changed, 122 insertions(+), 8 deletions(-)

 create mode 100644 kernel/trace/rv/monitors/tlob/tlob_kunit.c create mode 100644 kernel/trace/rv/monitors/tlob/tlob_kunit.h

kernel/trace/rv/monitors/tlob/tlob.c +3 -4

index 08b1bee884cc..18150cbf57a5 100644
@@ -20,7 +20,6 @@
  #include <linux/namei.h>
  #include <linux/rv.h>
  #include <linux/slab.h>
-#include <kunit/visibility.h>
  #include <rv/instrumentation.h>
  #include <rv/rv_uprobe.h>
  #include <rv.h>

@@ -877,9 +876,9 @@ static ssize_t tlob_monitor_read(struct file *file,
   * PATH may contain ':'; the last ':' separates path from offset.
   * Returns 0, -EINVAL, or -ERANGE.
   */
-VISIBLE_IF_KUNIT int tlob_parse_uprobe_line(char *buf, u64 *thr_out,
-					    char **path_out,
-					    loff_t *start_out, loff_t
 *stop_out)
+static int tlob_parse_uprobe_line(char *buf, u64 *thr_out,
+				  char **path_out,
+				  loff_t *start_out, loff_t *stop_out)
  {
  	unsigned long long thr = 0, stop_val = 0;

  long long start_val;

kernel/trace/rv/monitors/tlob/tlob.c +0 -1

@@ -951,13 +950,12 @@ VISIBLE_IF_KUNIT int tlob_parse_uprobe_line(char *buf,
 u64 *thr_out,
  	*stop_out  = (loff_t)stop_val;
  	return 0;
  }
-EXPORT_SYMBOL_IF_KUNIT(tlob_parse_uprobe_line);

 /*
  * Parse "-PATH:OFFSET_START" (ftrace uprobe_events removal convention). */

kernel/trace/rv/monitors/tlob/tlob.c +2 -2

-VISIBLE_IF_KUNIT int tlob_parse_remove_line(char *buf, char **path_out,
-					    loff_t *start_out)
+static int tlob_parse_remove_line(char *buf, char **path_out,
+				  loff_t *start_out)

 {
  char *binpath, *colon;
  long long off;

kernel/trace/rv/monitors/tlob/tlob.c +11 -1

@@ -980,7 +978,17 @@ VISIBLE_IF_KUNIT int tlob_parse_remove_line(char *buf,
 char **path_out,
  	*start_out = (loff_t)off;
  	return 0;
  }
-EXPORT_SYMBOL_IF_KUNIT(tlob_parse_remove_line);
+
+#if IS_ENABLED(CONFIG_RV_MONITORS_KUNIT_TEST)
+#include <kunit/visibility.h>
+#include "tlob_kunit.h"
+
+const struct rv_tlob_kunit_ops rv_tlob_kunit_ops = {
+	.parse_uprobe_line = tlob_parse_uprobe_line,
+	.parse_remove_line = tlob_parse_remove_line,
+};
+EXPORT_SYMBOL_IF_KUNIT(rv_tlob_kunit_ops);
+#endif

 static int tlob_create_or_delete_uprobe(char *buf) {

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +20 -0

new file mode 100644
index 000000000000..a8987fba2533
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include "tlob_kunit.h"
+
+#if IS_REACHABLE(CONFIG_RV_MON_TLOB)
+
+/* Valid "p PATH:START STOP threshold=NS" lines. */
+static const char * const tlob_parse_valid[] = {
+	"p /usr/bin/myapp:4768 4848 threshold=5000000",
+	"p /usr/bin/myapp:0x12a0 0x12f0 threshold=10000000",
+	"p /opt/my:app/bin:0x100 0x200 threshold=1000000",
+};
+
+/* Malformed "p ..." lines that must be rejected with -EINVAL. */
+static const char * const tlob_parse_invalid[] = {
+	"p :0x100 0x200 threshold=5000",
+	"p /usr/bin/myapp:0x100 threshold=5000",
+	"p /usr/bin/myapp:-1 0x200 threshold=5000",
+	"p /usr/bin/myapp:0x100 -1 threshold=5000000",	/* negative stop

offset */

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +37 -0

+	"p /usr/bin/myapp:0x100 0x200",
+	"p /usr/bin/myapp:0x100 0x100 threshold=5000",
+};
+
+/* threshold_ns out of valid range => -ERANGE. */
+static const char * const tlob_parse_out_of_range[] = {
+	"p /usr/bin/myapp:0x100 0x200 threshold=0",
+	"p /usr/bin/myapp:0x100 0x200 threshold=999",
+	"p /usr/bin/myapp:0x100 0x200 threshold=3600000000001",
+};
+
+/* Valid "-PATH:OFFSET_START" remove lines. */
+static const char * const tlob_remove_valid[] = {
+	"-/usr/bin/myapp:0x100",
+	"-/opt/my:app/bin:0x200",
+};
+
+/* Malformed remove lines that must be rejected with -EINVAL. */
+static const char * const tlob_remove_invalid[] = {
+	"-usr/bin/myapp:0x100",
+	"-/usr/bin/myapp",
+	"-/:0x100",
+	"-/usr/bin/myapp:-1",	/* negative offset */
+	"-/usr/bin/myapp:abc",
+};
+
+static void rv_test_tlob(struct kunit *test)
+{
+	u64 thr;
+	char *path;
+	loff_t start, stop;
+	char buf[128];
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(tlob_parse_valid); i++) {
+		strscpy(buf, tlob_parse_valid[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test,

rv_tlob_kunit_ops.parse_uprobe_line(buf, &thr, &path,

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +1 -0

+									 

&start, &stop), 0);

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +5 -0

+	}
+
+	for (i = 0; i < ARRAY_SIZE(tlob_parse_invalid); i++) {
+		strscpy(buf, tlob_parse_invalid[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test,

rv_tlob_kunit_ops.parse_uprobe_line(buf, &thr, &path,

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +1 -0

+									 

&start, &stop), -EINVAL);

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +5 -0

+	}
+
+	for (i = 0; i < ARRAY_SIZE(tlob_parse_out_of_range); i++) {
+		strscpy(buf, tlob_parse_out_of_range[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test,

rv_tlob_kunit_ops.parse_uprobe_line(buf, &thr, &path,

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +1 -0

+									 

&start, &stop), -ERANGE);

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +5 -0

+	}
+
+	for (i = 0; i < ARRAY_SIZE(tlob_remove_valid); i++) {
+		strscpy(buf, tlob_remove_valid[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test,

rv_tlob_kunit_ops.parse_remove_line(buf, &path, &start), 0);

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +5 -0

+	}
+
+	for (i = 0; i < ARRAY_SIZE(tlob_remove_invalid); i++) {
+		strscpy(buf, tlob_remove_invalid[i], sizeof(buf));
+		KUNIT_EXPECT_EQ(test,

rv_tlob_kunit_ops.parse_remove_line(buf, &path, &start),

kernel/trace/rv/monitors/tlob/tlob_kunit.c new file +7 -0

+				-EINVAL);
+	}
+}
+
+#else
+#define rv_test_tlob rv_test_stub
+#endif

kernel/trace/rv/monitors/tlob/tlob_kunit.h new file +12 -0

new file mode 100644
index 000000000000..4c1081871ea3
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef __TLOB_KUNIT_H
+#define __TLOB_KUNIT_H
+
+#if IS_ENABLED(CONFIG_RV_MONITORS_KUNIT_TEST)
+
+#include <linux/types.h>
+
+extern const struct rv_tlob_kunit_ops {
+	int (*parse_uprobe_line)(char *buf, u64 *thr_out, char **path_out,
+				 loff_t *start_out, loff_t *stop_out);
+	int (*parse_remove_line)(char *buf, char **path_out, loff_t

*start_out);

kernel/trace/rv/monitors/tlob/tlob_kunit.h new file +5 -0

+} rv_tlob_kunit_ops;
+
+#endif
+
+#endif /* __TLOB_KUNIT_H */

kernel/trace/rv/rv_monitors_test.c +1 -0

index 3ad11195e664..791df0fe03e3 100644
@@ -153,6 +153,7 @@ static void rv_test_dummy(struct kunit *test)
  #include "monitors/nomiss/nomiss_kunit.c"
  #include "monitors/pagefault/pagefault_kunit.c"
  #include "monitors/sleep/sleep_kunit.c"
+#include "monitors/tlob/tlob_kunit.c"

 static struct kunit_case rv_mon_test_cases[] = {
  KUNIT_CASE(rv_test_dummy),

kernel/trace/rv/rv_monitors_test.c +1 -0

@@ -163,6 +164,7 @@ static struct kunit_case rv_mon_test_cases[] = {
  	KUNIT_CASE(rv_test_nomiss),
  	KUNIT_CASE(rv_test_pagefault),
  	KUNIT_CASE(rv_test_sleep),
+	KUNIT_CASE(rv_test_tlob),
  	{}
  };

From: Wen Yang <[email protected]>

(quoted diff) +4 -0

+
+/* start probe; busy-spin so running_ns dominates */
+noinline void tlob_busy_work(unsigned long duration_ms)
+{

(quoted diff) +33 -0

+
+	tlob_busy_work_done();
+}
+
+/* stop probe; noinline keeps the entry point visible to uprobes */
+noinline void tlob_sleep_work_done(void)
+{
+	asm volatile("" ::: "memory");
+}
+
+/* start probe; nanosleep so sleeping_ns dominates */
+noinline void tlob_sleep_work(unsigned long duration_ms)
+{
+	struct timespec ts = {
+		.tv_sec  = duration_ms / 1000,
+		.tv_nsec = (long)(duration_ms % 1000) * 1000000L,
+	};
+	nanosleep(&ts, NULL);
+	tlob_sleep_work_done();
+}
+
+/* stop probe; noinline keeps the entry point visible to uprobes */
+noinline void tlob_preempt_work_done(void)
+{
+	asm volatile("" ::: "memory");
+}
+
+/*
+ * start probe; busy-spin so an RT competitor on the same CPU drives
+ * waiting_ns (prev_state==0 -> preempt event, task stays runnable off-CPU).
+ */
+noinline void tlob_preempt_work(unsigned long duration_ms)
+{

From: Wen Yang <[email protected]>

When env_store is U64_MAX (its initial sentinel value), ha_invariant_passed_ns() returns 0 immediately without initializing env_store to the current clock.  Subsequent calls to ha_check_invariant_ns() then find env_store still at U64_MAX, causing the elapsed comparison to wrap and always report the invariant as satisfied, silently masking any violations.

Fix by calling ha_reset_clk_ns() to establish the guard on the first invocation instead of returning early.  Apply the same fix to ha_invariant_passed_jiffy().

This is a stopgap: once the RV framework reworks the per-env clock guard, this first-invocation reset should be subsumed.

Signed-off-by Wen Yang <[email protected]>

---