Re: [PATCH v2 10/15] tools/rv: Add BPF monitors

On Sat, Oct 17, 2026 at 07:02 PM John Ogness [off-list ref] wrote:

It would be nice if it could be filtered so that only RV violation
bpf_printk's would trigger. I do not think it is possible for a filter
to do primitive pattern matching on @bpf_string. Or am I wrong?

not an ftrace expert, but it should be possible. bpf_string is
a dynamic string field and filters take globs on those.

With the "new" ringbuffer and nbcon implementations, it no longer dos-es
the kernel, so I have no problem with bpf programs calling
printk_deferred(). And besides, userspace can already blast the
ringbuffer and consoles via /dev/kmsg.

well, /dev/kmsg is ratelimited unless printk.devkmsg=on,
but the kfunc wouldn't be.
I still feel that bpf_stream + user space that writes into
/dev/kmsg is a better design.