Re: [PATCH v2 10/15] tools/rv: Add BPF monitors

On Sun, 2026-10-18 at 14:16 +0206, John Ogness wrote:

My issue with the /dev/kmsg design is bogus timestamps. But let's just
drop my suggestion to allow eBPF programs to call printk(). Since the RV
move to eBPF will require new user workflows anyway, the users will need
to learn these new packages, tools, and output sources. The important
thing (for me) is RV violations can still be used effectively with
ftrace/perf, which they can (using globs in bpf_trace:bpf_trace_printk
filters).

Alright, I'll focus on trace_printk for now. As I said, it's rather trivial to
add another reactor later.

@gmonaco: There should be clean glob-friendly RV bpf_trace_printk
strings so that filters can be easily and reliably set up.

If I leave the LTL header unmodified, you'd get something like:

  rv: sleep: <comm>[<pid>] violation detected

It should be glob-friendly enough, but I'll try it out.

I wonder if string matching brings additional overhead (trace_printk itself
does, if I recall correctly), but that's probably rather minor.

Gabriele