1. The Portability Problem in Kernel Logging

In standard C user-space code you often use %lu for an unsigned long or %d for an int. This works when your code only runs on one architecture. The moment your kernel module needs to work on both a 32-bit ARM board (where unsigned long is 4 bytes) and a 64-bit x86 server (where it is 8 bytes), using %lu for a size_t variable will produce wrong output or compiler warnings on one of the two platforms.

2. size_t and ssize_t — The Most Common Pitfall

These two types are widely used across kernel APIs. size_t represents the size of a memory region or a buffer and is always unsigned. ssize_t is the signed counterpart, used for return values from functions that can return either a byte count or a negative error code.

Their actual underlying type varies by architecture:

The correct format specifiers to use regardless of architecture:

size_t  bytes_written = get_buffer_usage();
ssize_t result        = read_from_device();

/* CORRECT — portable on all architectures */
pr_info("bytes written: %zu\n", bytes_written);
pr_info("read result:   %zd\n", result);

/* WRONG — may fail on 64-bit systems */
pr_info("bytes written: %u\n",  bytes_written);  /* truncates on 64-bit */
pr_info("read result:   %d\n",  result);          /* truncates on 64-bit */

3. Kernel Pointer Format Specifiers

Printing raw memory addresses in kernel logs is more complex than in user-space code because the kernel must balance two competing concerns: debugging usefulness and security. Exposing real kernel virtual addresses in the log leaks information about kernel memory layout, which helps attackers defeat KASLR (Kernel Address Space Layout Randomisation).

Linux 6.x provides three distinct pointer format specifiers for different situations:

void *kernel_buf = kmalloc(256, GFP_KERNEL);
phys_addr_t phys = virt_to_phys(kernel_buf);

/* Safe in production — hashed address */
pr_info("buffer at: %pK\n", kernel_buf);

/* For physical addresses — must pass by reference */
pr_info("physical address: %pa\n", &phys);

/* DEBUG ONLY — prints real address, remove before shipping */
pr_debug("raw debug address: %px\n", kernel_buf);

4. Physical Addresses With %pa

In device driver work you frequently deal with physical memory addresses — the addresses your hardware DMA engine uses to access memory directly. These are represented as phys_addr_t in the kernel, a type whose width depends on the physical address space of the SoC.

The %pa specifier handles this correctly across all platforms, but it requires you to pass the address by pointer (a pointer to the phys_addr_t variable), not by value. This is different from all other format specifiers and is easy to get wrong.

/* Printing a physical address correctly */
phys_addr_t dev_base = 0x40020000;  /* example peripheral base address */

/* CORRECT — pass by reference */
pr_info("peripheral base: %pa\n", &dev_base);

/* WRONG — passing by value causes wrong output */
pr_info("peripheral base: %pa\n", dev_base);  /* BUG: missing & */

5. Printing Raw Buffers as Hex Data

When debugging protocol drivers or memory content, you often want to dump a block of bytes as a hex string in the kernel log. The %*ph specifier does this for short buffers.

unsigned char packet[8] = {0x01, 0x02, 0xAB, 0xCD, 0x00, 0xFF, 0x10, 0x20};

/* Print up to 64 bytes as hex — width given by first argument */
pr_info("packet: %*ph\n", (int)sizeof(packet), packet);
/* Output: packet: 01 02 ab cd 00 ff 10 20 */

/* Compact format — no spaces between bytes */
pr_info("compact: %*phC\n", (int)sizeof(packet), packet);

#include <linux/printk.h>

/* Dumping a large buffer — for more than 64 bytes */
void dump_my_buffer(const void *buf, size_t len)
{
    print_hex_dump_bytes("mydriver: ", DUMP_PREFIX_OFFSET, buf, len);
    /* Produces multi-line output with offset, hex, and ASCII columns */
}

6. Network Address Format Specifiers

Network drivers and protocol stacks frequently need to log IP addresses. Using a raw integer with %u or %x gives an unreadable number. Linux provides dedicated specifiers that produce human-readable dotted-decimal (IPv4) and colon-separated (IPv6) notation directly.

#include <linux/inet.h>

/* IPv4 — pass a pointer to the address, NOT the value */
__be32 ipv4_addr = in_aton("192.168.1.100");
pr_info("source IP: %pI4\n", &ipv4_addr);
/* Output: source IP: 192.168.1.100 */

/* IPv4 in little-endian byte order */
pr_info("source IP LE: %pI4b\n", &ipv4_addr);

/* IPv6 — pass a pointer to struct in6_addr */
struct in6_addr ipv6_addr;
pr_info("IPv6 addr: %pI6\n", &ipv6_addr);
/* Output: IPv6 addr: 2001:0db8:85a3:0000:0000:8a2e:0370:7334 */

/* IPv6 compressed form — collapses consecutive zero groups */
pr_info("IPv6 compressed: %pI6c\n", &ipv6_addr);

7. Complete Portable Format Specifier Reference

8. Why %p Alone Is Dangerous Since Linux 4.15

Before Linux 4.15, using %p in a printk() call printed the raw kernel virtual address. This was a significant security hole because KASLR (Kernel Address Space Layout Randomisation) randomises where the kernel loads each boot, and exposing real addresses in the kernel log allows an attacker who can read dmesg to trivially bypass KASLR.

Starting with Linux 4.15, plain %p prints a one-way hash of the pointer instead of its real value. The hash is consistent within one boot session but changes every reboot. This means:

• Two different pointers may hash to the same printed value
• The same pointer prints a different value after each reboot
• You cannot use the output to compute the real address
• The output is useless for debugging