Re: [PATCH v2 10/15] tools/rv: Add BPF monitors

[Gabriele Monaco <gmonaco@redhat.com>]

On Sun, 2026-10-18 at 14:16 +0206, John Ogness wrote:
> My issue with the /dev/kmsg design is bogus timestamps. But let's just
> drop my suggestion to allow eBPF programs to call printk(). Since the RV
> move to eBPF will require new user workflows anyway, the users will need
> to learn these new packages, tools, and output sources. The important
> thing (for me) is RV violations can still be used effectively with
> ftrace/perf, which they can (using globs in bpf_trace:bpf_trace_printk
> filters).

Alright, I'll focus on trace_printk for now. As I said, it's rather trivial to
add another reactor later.

> @gmonaco: There should be clean glob-friendly RV bpf_trace_printk
> strings so that filters can be easily and reliably set up.

If I leave the LTL header unmodified, you'd get something like:

  rv: sleep: <comm>[<pid>] violation detected

It should be glob-friendly enough, but I'll try it out.

I wonder if string matching brings additional overhead (trace_printk itself
does, if I recall correctly), but that's probably rather minor.

Gabriele