Re: Error with printk and bpf_trace_printk


A few insights about bpf_trace_printk()

  • /sys/kernel/debug/tracing/trace_pipe is a global file shared by all tracers in Linux
  • Each trace stores the following fields

Task, Pid, CPU, flags, time-stamp, message which you retrieve using the bpf.trace_fields() primitive into local variables. (More about flags - refer Linux Embedded Development by Alexandru Vaduva

  • The last field (message) is what is passed from the probe through bpf_trace_printk - available as a string.
  • You could use maximum 3 print formatters in bpf_trace_printk()

Hope this helps!!!



From: iovisor-dev-bounces@... <iovisor-dev-bounces@...> on behalf of iovisor-dev-request@... <iovisor-dev-request@...>
Sent: 31 May 2017 17:30
To: iovisor-dev@...
Subject: iovisor-dev Digest, Vol 21, Issue 7
Send iovisor-dev mailing list submissions to

To subscribe or unsubscribe via the World Wide Web, visit
or, via email, send a message with subject or body 'help' to

You can reach the person managing the list at

When replying, please edit your Subject line so it is more specific
than "Re: Contents of iovisor-dev digest..."

Today's Topics:

   1. Re: Error with printk and bpf_trace_printk
      (Jesper Dangaard Brouer)
   2. reminder: IO Visor TSC/Dev Meeting (Brenden Blanco)


Message: 1
Date: Tue, 30 May 2017 14:24:37 +0200
From: Jesper Dangaard Brouer <brouer@...>
To: Adel Fuchs <adelfuchs@...>
Cc: "xdp-newbies@..." <xdp-newbies@...>,
        netdev@..., "iovisor-dev@..."
Subject: Re: [iovisor-dev] Error with printk and bpf_trace_printk
Message-ID: <20170530142437.656ec63d@...>
Content-Type: text/plain; charset=US-ASCII

Notice, there are two mailing lists (Cc'ed) that you should likely ask
these kind of questions on (instead of netdev), depending on if this is
mostly related to bpf (iovisor-dev@...) or somehow
related to XDP (xdp-newbies@...).

See my answer inlined below:

On Sun, 28 May 2017 17:48:20 +0300 Adel Fuchs <adelfuchs@...> wrote:

> I have a working eBPF program, and I'm trying to add outputs to it.
> I'm not able to use both printk and bpf_trace_printk functions. I get
> this error:
> ELF contains non-map related relo data in entry 0 pointing to section
> 8! Compiler bug?!
> Prog section 'ingress' rejected: Invalid argument (22)!
>  - Type:         3
>  - Instructions: 16 (0 over limit)
>  - License:      GPL
> Verifier analysis:
> 0: (bf) r6 = r1
> 1: (18) r1 = 0x0
> 3: (85) call bpf_unspec#0
> unknown func bpf_unspec#0
> Error fetching program/map!
> Failed to retrieve (e)BPF data!
> Are there certain "includes" that I need to add?
> In addition, I'm not sure I'm using the function correctly. I just
> wrote: printk("hi")

You obviously cannot call printk directly from and eBPF program.
I wonder how you got this compiling...

As you hinted yourself, you should be using: bpf_trace_printk().
But it is actually tricky to use... and not much help is around to
figure this out.

First of all the output end-up in this file: /sys/kernel/debug/tracing/trace_pipe
Remember to read the output use 'cat' like:

 sudo cat /sys/kernel/debug/tracing/trace_pipe

And only the first process to read the output gets the output...

I deduct you are using the TC/iproute2 examples:

Next gotcha is that, you need to provide the char* string in a very
special way to make this compile correctly.  The iproute2 provide a
helper define called "printt()" in include/bpf_api.h for this:

#ifndef printt
# define printt(fmt, ...)                                               \
        ({                                                              \
                char ____fmt[] = fmt;                                   \
                trace_printk(____fmt, sizeof(____fmt), ##__VA_ARGS__);  \

Or see my solution here:

Another gotcha I've experienced is that if you format the string
incorrectly, or use a modifier like %X, which bpf_trace_printk() does
not seem to understand, then you "hear-nothing"...  Also experienced if
using more than 3 arguments, then it fails or also go silent. Be
careful when using this somewhat "flaky" debug facility.

Do remember these bpf_trace_printk() should only be used for debugging,
as it is very slow...
Best regards,
  Jesper Dangaard Brouer
  MSc.CS, Principal Kernel Engineer at Red Hat
View Jesper Dangaard Brouer’s professional profile on LinkedIn. LinkedIn is the world's largest business network, helping professionals like Jesper Dangaard Brouer ...


Message: 2
Date: Tue, 30 May 2017 17:12:21 -0700
From: Brenden Blanco <bblanco@...>
To: iovisor-dev@...
Subject: [iovisor-dev] reminder: IO Visor TSC/Dev Meeting
Content-Type: text/plain; charset="utf-8"

Please join us tomorrow for our bi-weekly call. As usual, this meeting is
open to everybody and completely optional.
You might be interested to join if:
You want to know what is going on in BPF land
You are doing something interesting yourself with BPF and would like to
You want to know what the heck BPF is

=== IO Visor Dev/TSC Meeting ===

Every 2 weeks on Wednesday, from Wednesday, January 25, 2017, to no end date
11:00 am  |  Pacific Daylight Time (San Francisco, GMT-07:00)  |  1 hr
Blue Jeans Network - Interoperable, Cloud-based, Affordable Video Conferencing Service
Local time for a meeting, in user selected locations.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>


iovisor-dev mailing list
Discussion list for IOVisor development. To see the collection of prior postings to the list, visit the iovisor-dev Archives. Using iovisor-dev

End of iovisor-dev Digest, Vol 21, Issue 7

Join { to automatically receive all group messages.