From 39ccedfd9e55c95e440c26611a1db750b92b83bf Mon Sep 17 00:00:00 2001 From: Wen Yang Date: Tue, 15 Sep 2026 03:13:34 +0800 Subject: [PATCH 1/5] rv: Use LD_WAIT_SPIN as the reactor lockdep wait type MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rv_react() overrides the lockdep wait type to LD_WAIT_FREE to enforce that reactor callbacks take no locks. But callbacks run in the context of the triggering tracepoint, which can be preemptible task context on any kernel. A timer interrupt firing during the callback makes the interrupt-exit path schedule and take rq->__lock (LD_WAIT_SPIN) while the LD_WAIT_FREE override is still held, producing a spurious "Invalid wait context" warning: [ BUG: Invalid wait context ] context-{5:5} 1 lock held by kunit_try_catch/209: #0: (rv_react_map-wait-type-override){+.+.}-{1:1} kunit_try_catch/209 is trying to lock: ffff8a743ed3e8a0 (&rq->__lock){-...}-{2:2} Use LD_WAIT_SPIN instead of LD_WAIT_FREE, which causes false-positive warnings in preemptible contexts due to scheduler preemption taking rq->__lock. Fixes: 69d8895cb9a9 ("rv: Add explicit lockdep context for reactors") Reviewed-by: Gabriele Monaco Signed-off-by: Wen Yang Cc: Thomas Weißschuh Link: https://lore.kernel.org/r/5586dd00789a0f904cc299cd8889744b8c6f8dc9.1789412799.git.wen.yang@linux.dev Signed-off-by: Gabriele Monaco --- kernel/trace/rv/rv_reactors.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/kernel/trace/rv/rv_reactors.c b/kernel/trace/rv/rv_reactors.c index 2f5fc8d18dea..ff7d478227c3 100644 --- a/kernel/trace/rv/rv_reactors.c +++ b/kernel/trace/rv/rv_reactors.c @@ -465,7 +465,15 @@ int init_rv_reactors(struct dentry *root_dir) void rv_react(struct rv_monitor *monitor, const char *msg, ...) { - static DEFINE_WAIT_OVERRIDE_MAP(rv_react_map, LD_WAIT_FREE); + /* + * Reactors must not explicitly take locks, so they should be + * LD_WAIT_FREE. However, reactor callbacks can run with preemption + * enabled, meaning the preempting code (e.g. the scheduler taking + * rq->__lock at LD_WAIT_SPIN) may violate that constraint. Use + * LD_WAIT_SPIN to avoid false-positive lockdep reports. + * But you should still NOT be using locks in reactors. + */ + static DEFINE_WAIT_OVERRIDE_MAP(rv_react_map, LD_WAIT_SPIN); va_list args; if (!rv_reacting_on() || !monitor->react) From cd34b37a7d56b0e0daf0e82d50453599459e2496 Mon Sep 17 00:00:00 2001 From: Wen Yang Date: Tue, 15 Sep 2026 03:13:35 +0800 Subject: [PATCH 2/5] rv: Propagate rv_register_reactor() error from reactor init Both register_react_printk() and register_react_panic() ignore the return value of rv_register_reactor() and always return 0. If the registration fails (e.g. a duplicate reactor name), the init functions silently report success even though the reactor was not registered. Propagate the error from rv_register_reactor() so a failed registration is reported instead of being silently ignored. Reviewed-by: Gabriele Monaco Reviewed-by: Nam Cao Signed-off-by: Wen Yang Link: https://lore.kernel.org/r/1684c66520cee66ba86224f2b9e473c7dd2416ee.1789412799.git.wen.yang@linux.dev Signed-off-by: Gabriele Monaco --- kernel/trace/rv/reactor_panic.c | 3 +-- kernel/trace/rv/reactor_printk.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/kernel/trace/rv/reactor_panic.c b/kernel/trace/rv/reactor_panic.c index 76537b8a4343..db7116ceafff 100644 --- a/kernel/trace/rv/reactor_panic.c +++ b/kernel/trace/rv/reactor_panic.c @@ -26,8 +26,7 @@ static struct rv_reactor rv_panic = { static int __init register_react_panic(void) { - rv_register_reactor(&rv_panic); - return 0; + return rv_register_reactor(&rv_panic); } static void __exit unregister_react_panic(void) diff --git a/kernel/trace/rv/reactor_printk.c b/kernel/trace/rv/reactor_printk.c index 48c934e315b3..002a10f6aa7b 100644 --- a/kernel/trace/rv/reactor_printk.c +++ b/kernel/trace/rv/reactor_printk.c @@ -25,8 +25,7 @@ static struct rv_reactor rv_printk = { static int __init register_react_printk(void) { - rv_register_reactor(&rv_printk); - return 0; + return rv_register_reactor(&rv_printk); } static void __exit unregister_react_printk(void) From 89a6f8102948afa5d0851a6eebf5d7b166a42a6f Mon Sep 17 00:00:00 2001 From: Wen Yang Date: Tue, 15 Sep 2026 03:13:36 +0800 Subject: [PATCH 3/5] rv: Export rv_register_reactor() and rv_unregister_reactor() rv_react() is exported to modules, but the reactor registration helpers are not. Export them with EXPORT_SYMBOL_GPL() so reactor modules and the tristate KUnit test module can register and unregister reactors without hitting undefined symbol errors at link time(modpost). Commit 3d3800b4f7f4 ("rv: Remove reactor's reference counter") noted that module-based reactors, if supported, should be pinned with try_module_get()/module_put() to prevent unloading under an active monitor. This patch does not add that support. The only in-tree module consumer, the tristate KUnit reactor test module, registers and unregisters its reactor within a controlled test lifecycle. The actual pinning is left to a follow-up series that adds support for loadable-module reactors. Reviewed-by: Gabriele Monaco Signed-off-by: Wen Yang Link: https://lore.kernel.org/r/94b7ec120a92b9368541ac050601e66be8fe653a.1789412799.git.wen.yang@linux.dev Signed-off-by: Gabriele Monaco --- kernel/trace/rv/rv_reactors.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/rv/rv_reactors.c b/kernel/trace/rv/rv_reactors.c index ff7d478227c3..8e57a95d446b 100644 --- a/kernel/trace/rv/rv_reactors.c +++ b/kernel/trace/rv/rv_reactors.c @@ -314,6 +314,7 @@ int rv_register_reactor(struct rv_reactor *reactor) guard(mutex)(&rv_interface_lock); return __rv_register_reactor(reactor); } +EXPORT_SYMBOL_GPL(rv_register_reactor); /** * rv_unregister_reactor - unregister a rv reactor. @@ -327,6 +328,7 @@ int rv_unregister_reactor(struct rv_reactor *reactor) list_del(&reactor->list); return 0; } +EXPORT_SYMBOL_GPL(rv_unregister_reactor); /* * reacting_on interface. From 47fad7f891c61e19d17c67c3d39bdfb7c06743b5 Mon Sep 17 00:00:00 2001 From: Wen Yang Date: Tue, 15 Sep 2026 03:13:37 +0800 Subject: [PATCH 4/5] rv: Add KUnit tests for reactor registration and dispatch Add KUnit tests covering the reactor register/unregister lifecycle (including duplicate and name-length rejection) and rv_react() dispatch (a no-op without a callback, exactly one invocation with one). The mdelay() callback keeps the CPU busy so a timer interrupt lands inside rv_react()'s lockdep context, exercising the LD_WAIT_SPIN wait type from the previous patch; a spurious lockdep splat there would show up in the test output. The dispatch tests rely on reacting_on being enabled, since rv_react() returns early when it is off. Reviewed-by: Gabriele Monaco Signed-off-by: Wen Yang Link: https://lore.kernel.org/r/7d213b110815da45595ad8cd7bcce5641fac3404.1789412799.git.wen.yang@linux.dev Signed-off-by: Gabriele Monaco --- kernel/trace/rv/Kconfig | 12 +++ kernel/trace/rv/Makefile | 1 + kernel/trace/rv/rv_reactors_kunit.c | 111 ++++++++++++++++++++++++++++ 3 files changed, 124 insertions(+) create mode 100644 kernel/trace/rv/rv_reactors_kunit.c diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig index efa930f94ea4..9bfd429ffdea 100644 --- a/kernel/trace/rv/Kconfig +++ b/kernel/trace/rv/Kconfig @@ -113,6 +113,18 @@ config RV_REACT_PANIC Enables the panic reactor. The panic reactor emits a printk() message if an exception is found and panic()s the system. +config RV_REACTORS_KUNIT + tristate "KUnit tests for RV reactors" if !KUNIT_ALL_TESTS + depends on KUNIT + depends on RV_REACTORS + default KUNIT_ALL_TESTS + help + Enable KUnit tests for RV reactor registration and dispatch. + These tests verify the register/unregister lifecycle, duplicate + rejection, and that rv_react() correctly invokes callbacks. + + If unsure, say N. + config RV_MONITORS_KUNIT_TEST tristate "KUnit tests for RV monitors" if !KUNIT_ALL_TESTS depends on KUNIT && RV && RV_REACTORS diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile index cdbf68c84f5a..c895d81dfdad 100644 --- a/kernel/trace/rv/Makefile +++ b/kernel/trace/rv/Makefile @@ -25,4 +25,5 @@ obj-$(CONFIG_RV_MON_WAKEUP) += monitors/wakeup/wakeup.o obj-$(CONFIG_RV_REACTORS) += rv_reactors.o obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o obj-$(CONFIG_RV_REACT_PANIC) += reactor_panic.o +obj-$(CONFIG_RV_REACTORS_KUNIT) += rv_reactors_kunit.o obj-$(CONFIG_RV_MONITORS_KUNIT_TEST) += rv_monitors_test.o diff --git a/kernel/trace/rv/rv_reactors_kunit.c b/kernel/trace/rv/rv_reactors_kunit.c new file mode 100644 index 000000000000..3850c6dda288 --- /dev/null +++ b/kernel/trace/rv/rv_reactors_kunit.c @@ -0,0 +1,111 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * KUnit tests for RV reactor registration and dispatch. + * + * The dispatch tests rely on reacting_on being enabled, since rv_react() + * returns early when it is off. It is on by default when the suites run + * built-in; as a module, re-enable it if disabled via + * /sys/kernel/tracing/rv/reacting_on. + */ + +#include +#include +#include +#include +#include "rv.h" + +static struct rv_reactor test_reactor = { + .name = "kunit_test_reactor", + .description = "KUnit test reactor", +}; + +static void reactor_teardown(void *arg) +{ + rv_unregister_reactor(&test_reactor); +} + +static void register_test_reactor(struct kunit *test) +{ + KUNIT_ASSERT_EQ(test, rv_register_reactor(&test_reactor), 0); + KUNIT_ASSERT_EQ(test, + kunit_add_action_or_reset(test, reactor_teardown, NULL), 0); +} + +static void test_double_register(struct kunit *test) +{ + register_test_reactor(test); + KUNIT_EXPECT_EQ(test, rv_register_reactor(&test_reactor), -EINVAL); +} + +static const char long_reactor_name[] = "kunit_reactor_name_too_long_xxx_"; +static_assert(sizeof(long_reactor_name) - 1 >= MAX_RV_REACTOR_NAME_SIZE, + "long_reactor_name must be at least MAX_RV_REACTOR_NAME_SIZE chars"); + +static void test_name_too_long(struct kunit *test) +{ + static struct rv_reactor long_reactor = { + .name = long_reactor_name, + }; + + KUNIT_EXPECT_EQ(test, rv_register_reactor(&long_reactor), -EINVAL); +} + +static struct kunit_case rv_reactor_registration_cases[] = { + KUNIT_CASE(test_double_register), + KUNIT_CASE(test_name_too_long), + {} +}; + +static struct kunit_suite rv_reactor_registration_suite = { + .name = "rv_reactor_registration", + .test_cases = rv_reactor_registration_cases, +}; + +static int react_call_count; + +__printf(1, 0) static void mock_react(const char *msg, va_list args) +{ + react_call_count++; + /* Busy-wait so a timer interrupt fires inside rv_react(). */ + mdelay(20); +} + +static void test_react_no_callback(struct kunit *test) +{ + struct rv_monitor monitor = { + .name = "kunit_null_react", + }; + + react_call_count = 0; + rv_react(&monitor, "no callback"); + + KUNIT_EXPECT_EQ(test, react_call_count, 0); +} + +static void test_react_callback_invoked(struct kunit *test) +{ + struct rv_monitor monitor = { + .name = "kunit_dispatch_monitor", + .react = mock_react, + }; + + react_call_count = 0; + rv_react(&monitor, "callback invocation test"); + KUNIT_EXPECT_EQ(test, react_call_count, 1); +} + +static struct kunit_case rv_react_dispatch_cases[] = { + KUNIT_CASE(test_react_no_callback), + KUNIT_CASE(test_react_callback_invoked), + {} +}; + +static struct kunit_suite rv_react_dispatch_suite = { + .name = "rv_react_dispatch", + .test_cases = rv_react_dispatch_cases, +}; + +kunit_test_suites(&rv_reactor_registration_suite, &rv_react_dispatch_suite); + +MODULE_LICENSE("GPL"); +MODULE_DESCRIPTION("KUnit tests for RV reactor registration and dispatch"); From 5e9bdf2924c9041ff1520b528db6104626e9ef41 Mon Sep 17 00:00:00 2001 From: Nam Cao Date: Thu, 1 Oct 2026 06:42:18 +0200 Subject: [PATCH 5/5] rv/rtapp/wakeup: Use "rv_this" the rv_monitor variable Commit d9e4c61a12dd ("rv: Use generic rv_this for the rv_monitor variable in LTL") renamed the rv_monitor variable to rv_this. But rtapp/wakeup monitor was late to the party and missed that. So for this monitor, rv_this is an empty struct. The reactor fails to work, because rv_react() checks monitor->react and sees NULL. Correct to "rv_this" and make the reactor work again. Signed-off-by: Nam Cao Fixes: d9e4c61a12dd ("rv: Use generic rv_this for the rv_monitor variable in LTL") Link: https://lore.kernel.org/r/20261001044218.3508990-1-namcao@linutronix.de Signed-off-by: Gabriele Monaco --- kernel/trace/rv/monitors/wakeup/wakeup.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/trace/rv/monitors/wakeup/wakeup.c b/kernel/trace/rv/monitors/wakeup/wakeup.c index 01b47416f24e..2e803e79181e 100644 --- a/kernel/trace/rv/monitors/wakeup/wakeup.c +++ b/kernel/trace/rv/monitors/wakeup/wakeup.c @@ -128,7 +128,7 @@ static void disable_wakeup(void) ltl_monitor_destroy(); } -static struct rv_monitor rv_wakeup = { +static struct rv_monitor rv_this = { .name = "wakeup", .description = "Monitor that real-time tasks are not woken by lower-priority tasks", .enable = enable_wakeup, @@ -137,12 +137,12 @@ static struct rv_monitor rv_wakeup = { static int __init register_wakeup(void) { - return rv_register_monitor(&rv_wakeup, &rv_rtapp); + return rv_register_monitor(&rv_this, &rv_rtapp); } static void __exit unregister_wakeup(void) { - rv_unregister_monitor(&rv_wakeup); + rv_unregister_monitor(&rv_this); } module_init(register_wakeup);