BPF maintainer nacks pluggable RV monitors for Linux

Alexei Starovoitov has nacked an RFC series that would let Linux Runtime Verification (RV) load deterministic-automata monitors as BPF programs, arguing there is little demand for that kind of programmability.

Gabriele Monaco of Red Hat proposed the work so operators could drop prebuilt BPF object files into a well-known path and have the existing rv userspace tool register, list, enable, and trace them the same way it handles in-kernel monitors. Monitors would attach through struct_ops, appear in tracefs, and deliver events over a ring buffer. The generator tool rvgen would gain a flag to emit BPF-oriented monitors. The stated goal is domain-specific models that are too narrow to merge upstream: stricter real-time application rules, co-kernel checks, and functional-safety models used in in-vehicle systems, all without a reboot or an out-of-tree kernel module.

Monaco pointed to active RV use validating deadline-scheduler changes and RTapp predictability, and argued BPF is a natural fit because it already supplies verified loading, maps, and a wide set of probe types.

Starovoitov disagreed. "I don't think bpf fits here. I haven't seen active use of RV and even less so of any request from people who want this kind of programmability. So Nack for now."

Steven Rostedt, who maintains the tracing side of RV, pushed back on the nack itself. Because the series only consumes existing BPF facilities and does not change the BPF core, he wrote, a BPF maintainer lacks jurisdiction to block it: "Either BPF is a tool for the kernel or it isn't. You can't judge where BPF gets used."

Nam Cao, who had asked what BPF buys over built-in monitors, said he had wanted the same pluggability for the same reasons and would review the patches. The series remains an RFC under dispute between the BPF and RV camps.