On Sun, 2026-10-18 at 14:16 +0206, John Ogness wrote: > My issue with the /dev/kmsg design is bogus timestamps. But let's just > drop my suggestion to allow eBPF programs to call printk(). Since the RV > move to eBPF will require new user workflows anyway, the users will need > to learn these new packages, tools, and output sources. The important > thing (for me) is RV violations can still be used effectively with > ftrace/perf, which they can (using globs in bpf_trace:bpf_trace_printk > filters).
Alright, I'll focus on trace_printk for now. As I said, it's rather trivial to add another reactor later. > @gmonaco: There should be clean glob-friendly RV bpf_trace_printk > strings so that filters can be easily and reliably set up. If I leave the LTL header unmodified, you'd get something like: rv: sleep: <comm>[<pid>] violation detected It should be glob-friendly enough, but I'll try it out. I wonder if string matching brings additional overhead (trace_printk itself does, if I recall correctly), but that's probably rather minor. Gabriele
