A few insights about bpf_trace_printk()
* /sys/kernel/debug/tracing/trace_pipe is a global file shared by all tracers in Linux * Each trace stores the following fields Task, Pid, CPU, flags, time-stamp, message which you retrieve using the bpf.trace_fields() primitive into local variables. (More about flags - refer Linux Embedded Development by Alexandru Vaduva et.al.) * The last field (message) is what is passed from the probe through bpf_trace_printk - available as a string. * You could use maximum 3 print formatters in bpf_trace_printk() Hope this helps!!! Thanks, Reena ________________________________ From: [email protected] <[email protected]> on behalf of [email protected] <[email protected]> Sent: 31 May 2017 17:30 To: [email protected] Subject: iovisor-dev Digest, Vol 21, Issue 7 Send iovisor-dev mailing list submissions to [email protected] To subscribe or unsubscribe via the World Wide Web, visit https://lists.iovisor.org/mailman/listinfo/iovisor-dev or, via email, send a message with subject or body 'help' to [email protected] You can reach the person managing the list at [email protected] When replying, please edit your Subject line so it is more specific than "Re: Contents of iovisor-dev digest..." Today's Topics: 1. Re: Error with printk and bpf_trace_printk (Jesper Dangaard Brouer) 2. reminder: IO Visor TSC/Dev Meeting (Brenden Blanco) ---------------------------------------------------------------------- Message: 1 Date: Tue, 30 May 2017 14:24:37 +0200 From: Jesper Dangaard Brouer <[email protected]> To: Adel Fuchs <[email protected]> Cc: "[email protected]" <[email protected]>, [email protected], "[email protected]" <[email protected]> Subject: Re: [iovisor-dev] Error with printk and bpf_trace_printk Message-ID: <[email protected]> Content-Type: text/plain; charset=US-ASCII Notice, there are two mailing lists (Cc'ed) that you should likely ask these kind of questions on (instead of netdev), depending on if this is mostly related to bpf ([email protected]) or somehow related to XDP ([email protected]). See my answer inlined below: On Sun, 28 May 2017 17:48:20 +0300 Adel Fuchs <[email protected]> wrote: > I have a working eBPF program, and I'm trying to add outputs to it. > I'm not able to use both printk and bpf_trace_printk functions. I get > this error: > > ELF contains non-map related relo data in entry 0 pointing to section > 8! Compiler bug?! > > Prog section 'ingress' rejected: Invalid argument (22)! > - Type: 3 > - Instructions: 16 (0 over limit) > - License: GPL > > Verifier analysis: > > 0: (bf) r6 = r1 > 1: (18) r1 = 0x0 > 3: (85) call bpf_unspec#0 > unknown func bpf_unspec#0 > > Error fetching program/map! > Failed to retrieve (e)BPF data! > > Are there certain "includes" that I need to add? > In addition, I'm not sure I'm using the function correctly. I just > wrote: printk("hi") You obviously cannot call printk directly from and eBPF program. I wonder how you got this compiling... As you hinted yourself, you should be using: bpf_trace_printk(). But it is actually tricky to use... and not much help is around to figure this out. First of all the output end-up in this file: /sys/kernel/debug/tracing/trace_pipe Remember to read the output use 'cat' like: sudo cat /sys/kernel/debug/tracing/trace_pipe And only the first process to read the output gets the output... I deduct you are using the TC/iproute2 examples: https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git/tree/examples/bpf Next gotcha is that, you need to provide the char* string in a very special way to make this compile correctly. The iproute2 provide a helper define called "printt()" in include/bpf_api.h for this: #ifndef printt # define printt(fmt, ...) \ ({ \ char ____fmt[] = fmt; \ trace_printk(____fmt, sizeof(____fmt), ##__VA_ARGS__); \ }) #endif Or see my solution here: [1] https://github.com/netoptimizer/prototype-kernel/blob/master/kernel/samples/bpf/xdp_ddos01_blacklist_kern.c#L86:L99 Another gotcha I've experienced is that if you format the string incorrectly, or use a modifier like %X, which bpf_trace_printk() does not seem to understand, then you "hear-nothing"... Also experienced if using more than 3 arguments, then it fails or also go silent. Be careful when using this somewhat "flaky" debug facility. Do remember these bpf_trace_printk() should only be used for debugging, as it is very slow... -- Best regards, Jesper Dangaard Brouer MSc.CS, Principal Kernel Engineer at Red Hat LinkedIn: http://www.linkedin.com/in/brouer [http://m.c.lnkd.licdn.com/mpr/mpr/shrinknp_200_200/AAEAAQAAAAAAAAcAAAAAJDg0MmE0ZjkyLTYzMDEtNDQwOC1iZWJiLTFmZjkyZmRiOTFlNA.jpg]<http://www.linkedin.com/in/brouer> Jesper Dangaard Brouer | LinkedIn<http://www.linkedin.com/in/brouer> www.linkedin.com View Jesper Dangaard Brouer’s professional profile on LinkedIn. LinkedIn is the world's largest business network, helping professionals like Jesper Dangaard Brouer ... ------------------------------ Message: 2 Date: Tue, 30 May 2017 17:12:21 -0700 From: Brenden Blanco <[email protected]> To: [email protected] Subject: [iovisor-dev] reminder: IO Visor TSC/Dev Meeting Message-ID: <CAH9hs-+=AzXRsgkhCU+4R2K81QPUokaO=vJaEjxP=nvdlnt...@mail.gmail.com> Content-Type: text/plain; charset="utf-8" Please join us tomorrow for our bi-weekly call. As usual, this meeting is open to everybody and completely optional. You might be interested to join if: You want to know what is going on in BPF land You are doing something interesting yourself with BPF and would like to share You want to know what the heck BPF is === IO Visor Dev/TSC Meeting === Every 2 weeks on Wednesday, from Wednesday, January 25, 2017, to no end date 11:00 am | Pacific Daylight Time (San Francisco, GMT-07:00) | 1 hr https://bluejeans.com/568677804/ Blue Jeans Network | Video Collaboration in the Cloud<https://bluejeans.com/568677804/> bluejeans.com Blue Jeans Network - Interoperable, Cloud-based, Affordable Video Conferencing Service https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=5&day=31&hour=18&min=0&sec=0&p1=900 [https://c.tadst.com/gfx/og/tadlogo-facebook.png]<https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=5&day=31&hour=18&min=0&sec=0&p1=900> The World Clock Meeting Planner - Details<https://www.timeanddate.com/worldclock/meetingdetails.html?year=2017&month=5&day=31&hour=18&min=0&sec=0&p1=900> www.timeanddate.com Local time for a meeting, in user selected locations. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.iovisor.org/pipermail/iovisor-dev/attachments/20170530/59c57dee/attachment-0001.html> ------------------------------ _______________________________________________ iovisor-dev mailing list [email protected] https://lists.iovisor.org/mailman/listinfo/iovisor-dev iovisor-dev Info Page<https://lists.iovisor.org/mailman/listinfo/iovisor-dev> lists.iovisor.org Discussion list for IOVisor development. To see the collection of prior postings to the list, visit the iovisor-dev Archives. Using iovisor-dev End of iovisor-dev Digest, Vol 21, Issue 7 ******************************************
_______________________________________________ iovisor-dev mailing list [email protected] https://lists.iovisor.org/mailman/listinfo/iovisor-dev
