Re: [PATCH 7/9] rv: Do not rely on clean monitor when initialising HA

[Wen Yang <wen.yang@linux.dev>]

The ha_mon_initializing flag correctly
guards the init path against stale monitoring=1 (from either a previous
different monitor type or a race during teardown of the previous instance).


Reviewed-by: Wen Yang <wen.yang@linux.dev>


On 5/12/26 22:02, Gabriele Monaco wrote:
> Hybrid Automata monitors hook into the DA implementation when doing
> da_monitor_reset(). This function is called both on initialisation and
> teardown, HA monitors try to cancel a timer only when it's initialised
> relying on the da_mon->monitoring flag. This flag could however be
> corrupted during initialisation. This happens for instance on per-task
> monitors that share the same storage with different type of monitors
> like LTL or in case of races during a previous teardown.
> 
> Stop relying on the monitoring flag during initialisation, assume that
> can have any value, so skip timer cancellation in any case when a local
> flag is set. New monitors (e.g. new tasks) are always zero-initialised
> so they are safe.
> 
> Reported-by: Wen Yang <wen.yang@linux.dev>
> Closes: https://lore.kernel.org/lkml/d02c656aada7d071f083460a5c9a454363669b61.1778522945.git.wen.yang@linux.dev
> Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type")
> Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
> ---
>   include/rv/ha_monitor.h                       | 31 ++++++++++++++++++-
>   kernel/trace/rv/monitors/nomiss/nomiss.c      |  4 +--
>   kernel/trace/rv/monitors/opid/opid.c          |  4 +--
>   kernel/trace/rv/monitors/stall/stall.c        |  4 +--
>   .../rvgen/rvgen/templates/dot2k/main.c        |  4 +--
>   5 files changed, 38 insertions(+), 9 deletions(-)
> 
> diff --git a/include/rv/ha_monitor.h b/include/rv/ha_monitor.h
> index 47ff1a41febe..11ae85bad492 100644
> --- a/include/rv/ha_monitor.h
> +++ b/include/rv/ha_monitor.h
> @@ -116,6 +116,35 @@ static enum hrtimer_restart ha_monitor_timer_callback(struct hrtimer *hrtimer);
>   #define ha_get_ns() 0
>   #endif /* HA_CLK_NS */
>   
> +static bool ha_mon_initializing;
> +
> +static int ha_monitor_init(void)
> +{
> +	int ret;
> +
> +	ha_mon_initializing = true;
> +	ret = da_monitor_init();
> +	ha_mon_initializing = false;
> +	return ret;
> +}
> +
> +static void ha_monitor_destroy(void)
> +{
> +	da_monitor_destroy();
> +}
> +
> +/*
> + * ha_monitor_uninitialized - are fields like the timer initialized?
> + *
> + * On a clean monitor, we can assume an active monitor (monitoring) is
> + * initialized, however the monitoring field cannot be trusted during
> + * initialization.
> + */
> +static inline bool ha_monitor_uninitialized(struct da_monitor *da_mon)
> +{
> +	return ha_mon_initializing || !da_monitoring(da_mon);
> +}
> +
>   /* Should be supplied by the monitor */
>   static u64 ha_get_env(struct ha_monitor *ha_mon, enum envs env, u64 time_ns);
>   static bool ha_verify_constraint(struct ha_monitor *ha_mon,
> @@ -160,7 +189,7 @@ static inline void ha_monitor_reset_env(struct da_monitor *da_mon)
>   	struct ha_monitor *ha_mon = to_ha_monitor(da_mon);
>   
>   	/* Initialisation resets the monitor before initialising the timer */
> -	if (likely(da_monitoring(da_mon)))
> +	if (likely(!ha_monitor_uninitialized(da_mon)))
>   		ha_cancel_timer(ha_mon);
>   }
>   
> diff --git a/kernel/trace/rv/monitors/nomiss/nomiss.c b/kernel/trace/rv/monitors/nomiss/nomiss.c
> index 31f90f3638d8..8ead8783c29f 100644
> --- a/kernel/trace/rv/monitors/nomiss/nomiss.c
> +++ b/kernel/trace/rv/monitors/nomiss/nomiss.c
> @@ -227,7 +227,7 @@ static int enable_nomiss(void)
>   {
>   	int retval;
>   
> -	retval = da_monitor_init();
> +	retval = ha_monitor_init();
>   	if (retval)
>   		return retval;
>   
> @@ -263,7 +263,7 @@ static void disable_nomiss(void)
>   	rv_detach_trace_probe("nomiss", sched_switch, handle_sched_switch);
>   	rv_detach_trace_probe("nomiss", sched_wakeup, handle_sched_wakeup);
>   
> -	da_monitor_destroy();
> +	ha_monitor_destroy();
>   }
>   
>   static struct rv_monitor rv_this = {
> diff --git a/kernel/trace/rv/monitors/opid/opid.c b/kernel/trace/rv/monitors/opid/opid.c
> index 4594c7c46601..2922318c6112 100644
> --- a/kernel/trace/rv/monitors/opid/opid.c
> +++ b/kernel/trace/rv/monitors/opid/opid.c
> @@ -73,7 +73,7 @@ static int enable_opid(void)
>   {
>   	int retval;
>   
> -	retval = da_monitor_init();
> +	retval = ha_monitor_init();
>   	if (retval)
>   		return retval;
>   
> @@ -90,7 +90,7 @@ static void disable_opid(void)
>   	rv_detach_trace_probe("opid", sched_set_need_resched_tp, handle_sched_need_resched);
>   	rv_detach_trace_probe("opid", sched_waking, handle_sched_waking);
>   
> -	da_monitor_destroy();
> +	ha_monitor_destroy();
>   }
>   
>   /*
> diff --git a/kernel/trace/rv/monitors/stall/stall.c b/kernel/trace/rv/monitors/stall/stall.c
> index 9ccfda6b0e73..3c38fb1a0159 100644
> --- a/kernel/trace/rv/monitors/stall/stall.c
> +++ b/kernel/trace/rv/monitors/stall/stall.c
> @@ -103,7 +103,7 @@ static int enable_stall(void)
>   {
>   	int retval;
>   
> -	retval = da_monitor_init();
> +	retval = ha_monitor_init();
>   	if (retval)
>   		return retval;
>   
> @@ -120,7 +120,7 @@ static void disable_stall(void)
>   	rv_detach_trace_probe("stall", sched_switch, handle_sched_switch);
>   	rv_detach_trace_probe("stall", sched_wakeup, handle_sched_wakeup);
>   
> -	da_monitor_destroy();
> +	ha_monitor_destroy();
>   }
>   
>   static struct rv_monitor rv_this = {
> diff --git a/tools/verification/rvgen/rvgen/templates/dot2k/main.c b/tools/verification/rvgen/rvgen/templates/dot2k/main.c
> index bf0999f6657a..889446760e3c 100644
> --- a/tools/verification/rvgen/rvgen/templates/dot2k/main.c
> +++ b/tools/verification/rvgen/rvgen/templates/dot2k/main.c
> @@ -35,7 +35,7 @@ static int enable_%%MODEL_NAME%%(void)
>   {
>   	int retval;
>   
> -	retval = da_monitor_init();
> +	retval = %%MONITOR_CLASS%%_monitor_init();
>   	if (retval)
>   		return retval;
>   
> @@ -50,7 +50,7 @@ static void disable_%%MODEL_NAME%%(void)
>   
>   %%TRACEPOINT_DETACH%%
>   
> -	da_monitor_destroy();
> +	%%MONITOR_CLASS%%_monitor_destroy();
>   }
>   
>   /*