Re: [PATCH v2 10/15] tools/rv: Add BPF monitors

[Alexei Starovoitov]

On Sat, Oct 17, 2026 at 07:02 PM John Ogness <john.ogness@xxxxxxxxxxxxx> wrote:
> It would be nice if it could be filtered so that only RV violation
> bpf_printk's would trigger. I do not think it is possible for a filter
> to do primitive pattern matching on @bpf_string. Or am I wrong?

not an ftrace expert, but it should be possible. bpf_string is
a dynamic string field and filters take globs on those.

> With the "new" ringbuffer and nbcon implementations, it no longer dos-es
> the kernel, so I have no problem with bpf programs calling
> printk_deferred(). And besides, userspace can already blast the
> ringbuffer and consoles via /dev/kmsg.

well, /dev/kmsg is ratelimited unless printk.devkmsg=on,
but the kfunc wouldn't be.
I still feel that bpf_stream + user space that writes into
/dev/kmsg is a better design.