Re: [PATCH 7/9] rv: Do not rely on clean monitor when initialising HA

[Wen Yang]

The ha_mon_initializing flag correctly
guards the init path against stale monitoring=1 (from either a previous
different monitor type or a race during teardown of the previous instance).


Reviewed-by: Wen Yang <wen.y...@linux.dev>


On 5/12/26 22:02, Gabriele Monaco wrote:

Hybrid Automata monitors hook into the DA implementation when doing
da_monitor_reset(). This function is called both on initialisation and
teardown, HA monitors try to cancel a timer only when it's initialised
relying on the da_mon->monitoring flag. This flag could however be
corrupted during initialisation. This happens for instance on per-task
monitors that share the same storage with different type of monitors
like LTL or in case of races during a previous teardown.

Stop relying on the monitoring flag during initialisation, assume that
can have any value, so skip timer cancellation in any case when a local
flag is set. New monitors (e.g. new tasks) are always zero-initialised
so they are safe.

Reported-by: Wen Yang <wen.y...@linux.dev>
Closes: 
https://lore.kernel.org/lkml/d02c656aada7d071f083460a5c9a454363669b61.1778522945.git.wen.y...@linux.dev
Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type")
Signed-off-by: Gabriele Monaco <gmon...@redhat.com>
---
  include/rv/ha_monitor.h                       | 31 ++++++++++++++++++-
  kernel/trace/rv/monitors/nomiss/nomiss.c      |  4 +--
  kernel/trace/rv/monitors/opid/opid.c          |  4 +--
  kernel/trace/rv/monitors/stall/stall.c        |  4 +--
  .../rvgen/rvgen/templates/dot2k/main.c        |  4 +--
  5 files changed, 38 insertions(+), 9 deletions(-)

diff --git a/include/rv/ha_monitor.h b/include/rv/ha_monitor.h
index 47ff1a41febe..11ae85bad492 100644
--- a/include/rv/ha_monitor.h
+++ b/include/rv/ha_monitor.h
@@ -116,6 +116,35 @@ static enum hrtimer_restart 
ha_monitor_timer_callback(struct hrtimer *hrtimer);
  #define ha_get_ns() 0
  #endif /* HA_CLK_NS */

+static bool ha_mon_initializing;

+
+static int ha_monitor_init(void)
+{
+       int ret;
+
+       ha_mon_initializing = true;
+       ret = da_monitor_init();
+       ha_mon_initializing = false;
+       return ret;
+}
+
+static void ha_monitor_destroy(void)
+{
+       da_monitor_destroy();
+}
+
+/*
+ * ha_monitor_uninitialized - are fields like the timer initialized?
+ *
+ * On a clean monitor, we can assume an active monitor (monitoring) is
+ * initialized, however the monitoring field cannot be trusted during
+ * initialization.
+ */
+static inline bool ha_monitor_uninitialized(struct da_monitor *da_mon)
+{
+       return ha_mon_initializing || !da_monitoring(da_mon);
+}
+
  /* Should be supplied by the monitor */
  static u64 ha_get_env(struct ha_monitor *ha_mon, enum envs env, u64 time_ns);
  static bool ha_verify_constraint(struct ha_monitor *ha_mon,
@@ -160,7 +189,7 @@ static inline void ha_monitor_reset_env(struct da_monitor 
*da_mon)
        struct ha_monitor *ha_mon = to_ha_monitor(da_mon);

/* Initialisation resets the monitor before initialising the timer */

-       if (likely(da_monitoring(da_mon)))
+       if (likely(!ha_monitor_uninitialized(da_mon)))
                ha_cancel_timer(ha_mon);
  }

diff --git a/kernel/trace/rv/monitors/nomiss/nomiss.c b/kernel/trace/rv/monitors/nomiss/nomiss.c

index 31f90f3638d8..8ead8783c29f 100644
--- a/kernel/trace/rv/monitors/nomiss/nomiss.c
+++ b/kernel/trace/rv/monitors/nomiss/nomiss.c
@@ -227,7 +227,7 @@ static int enable_nomiss(void)
  {
        int retval;

- retval = da_monitor_init();

+       retval = ha_monitor_init();
        if (retval)
                return retval;

@@ -263,7 +263,7 @@ static void disable_nomiss(void)

        rv_detach_trace_probe("nomiss", sched_switch, handle_sched_switch);
        rv_detach_trace_probe("nomiss", sched_wakeup, handle_sched_wakeup);

- da_monitor_destroy();

+       ha_monitor_destroy();
  }

static struct rv_monitor rv_this = {

diff --git a/kernel/trace/rv/monitors/opid/opid.c 
b/kernel/trace/rv/monitors/opid/opid.c
index 4594c7c46601..2922318c6112 100644
--- a/kernel/trace/rv/monitors/opid/opid.c
+++ b/kernel/trace/rv/monitors/opid/opid.c
@@ -73,7 +73,7 @@ static int enable_opid(void)
  {
        int retval;

- retval = da_monitor_init();

+       retval = ha_monitor_init();
        if (retval)
                return retval;

@@ -90,7 +90,7 @@ static void disable_opid(void)

        rv_detach_trace_probe("opid", sched_set_need_resched_tp, 
handle_sched_need_resched);
        rv_detach_trace_probe("opid", sched_waking, handle_sched_waking);

- da_monitor_destroy();

+       ha_monitor_destroy();
  }

/*

diff --git a/kernel/trace/rv/monitors/stall/stall.c 
b/kernel/trace/rv/monitors/stall/stall.c
index 9ccfda6b0e73..3c38fb1a0159 100644
--- a/kernel/trace/rv/monitors/stall/stall.c
+++ b/kernel/trace/rv/monitors/stall/stall.c
@@ -103,7 +103,7 @@ static int enable_stall(void)
  {
        int retval;

- retval = da_monitor_init();

+       retval = ha_monitor_init();
        if (retval)
                return retval;

@@ -120,7 +120,7 @@ static void disable_stall(void)

        rv_detach_trace_probe("stall", sched_switch, handle_sched_switch);
        rv_detach_trace_probe("stall", sched_wakeup, handle_sched_wakeup);

- da_monitor_destroy();

+       ha_monitor_destroy();
  }

static struct rv_monitor rv_this = {

diff --git a/tools/verification/rvgen/rvgen/templates/dot2k/main.c 
b/tools/verification/rvgen/rvgen/templates/dot2k/main.c
index bf0999f6657a..889446760e3c 100644
--- a/tools/verification/rvgen/rvgen/templates/dot2k/main.c
+++ b/tools/verification/rvgen/rvgen/templates/dot2k/main.c
@@ -35,7 +35,7 @@ static int enable_%%MODEL_NAME%%(void)
  {
        int retval;

- retval = da_monitor_init();

+       retval = %%MONITOR_CLASS%%_monitor_init();
        if (retval)
                return retval;

@@ -50,7 +50,7 @@ static void disable_%%MODEL_NAME%%(void) %%TRACEPOINT_DETACH%% - da_monitor_destroy();

+       %%MONITOR_CLASS%%_monitor_destroy();
  }

/*