On 2026-10-19, Gabriele Monaco <[email protected]> wrote: >> @gmonaco: There should be clean glob-friendly RV bpf_trace_printk >> strings so that filters can be easily and reliably set up. > > If I leave the LTL header unmodified, you'd get something like: > > rv: sleep: <comm>[<pid>] violation detected > > It should be glob-friendly enough, but I'll try it out.
If transition-events will also be included (should be optional for performance reasons), a better format may be: rv: violation: sleep: <comm>[<pid>] <violation text> rv: event: sleep: <comm>[<pid>] <event text> > I wonder if string matching brings additional overhead (trace_printk > itself does, if I recall correctly), but that's probably rather minor. For production environments, I expect that trace_printk's are only occurring for violations, in which case the cost of a string compare will probably be irrelevant. Are these trace_printk's available without getting the scary kernel warning when kernel code uses trace_printk()? We do want RV support to be enabled in production kernels. John
