Re: [PATCH v2 10/15] tools/rv: Add BPF monitors

[Gabriele Monaco <gmonaco@redhat.com>]

On Thu, 2026-10-22 at 10:25 +0200, Nam Cao wrote:
> What about we refactor the in-kernel monitors' trace events into a
> single one. I am picturing two functions for ALL classes and ALL
> monitors:
> 
>     void rv_error(const char *monitor_name, const char *message);
>     void rv_event(const char *monitor_name, const char *message);
> 
> which trigger the tracepoints. And we make those kfuncs. This allows
> sharing trace events between in-kernel monitors and BPF monitors.
> 
> Then everything else (kernel reactors, users, perhaps even eBPF reactors
> in the future) hook into those tracepoints.

That could work, though we'd lose some ergonomics around filtering events, not
so much in the unified tracepoint thing but in what fields events have. We would
need to parse a string (so I wonder if globs can express constraints like
matching whole words or we'd need to arrange the format to accommodate glob
limitations).

On the other hand if we still want to keep fields, we are going to need
event/error pairs for both DA and LTL and a way to match monitors with their
class (needed if you want to surgically enable the right events for your
monitors).

Both can work and what you propose is clearly simpler to implement, I can have a
look.

Thanks,
Gabriele