Errata

Learning eBPF

Errata for Learning eBPF

Submit your own errata for this product.

The errata list is a list of errors and their corrections that were found after the product was released. If the error was corrected in a later version or reprint the date of the correction will be displayed in the column titled "Date Corrected".

The following errata were submitted by our customers and approved as valid errors by the author or editor.

Color key: Serious technical mistake Minor technical mistake Language or formatting error Typo Question Note Update

Version Location Description Submitted By Date submitted Date corrected
Page page 22
second last paragraph (second from bottom)

My prior submission had a bunch of typos, please ignore that altogether. Here's a version with all corrections.

The following excerpt suggests that ``counter_table.lookup(&uid);`` and ``counter_table.update(&uid, &counter);`` are not valid C syntax. That is not true! C does not support defining methods on structures, that part is correct. But C allows a function pointer to be a member of a struct. In practice and theory, if the macro ``BPF_HASH(counter_table);`` takes care of assigning a valid value to function pointers ``update`` and ``lookup``, it would be valid C code.

"If you’re thinking “that’s not proper C code!” you’re absolutely right. C doesn’t support defining methods on structures like that. 5 This is a great example where BCC’s version of C is very loosely a C-like language that BCC rewrites before it sends the code to the compiler. BCC offers some convenient shortcuts and macros that it converts into “proper” C."

I wonder if you confused this with the fact that there is no implicit "self" / "this" pointer available for struct functions to update struct state. If the intent here is to suggest something on those lines, I fear it's not very apparent without a user knowing the semantics of BPF_HASH().

Note from the Author or Editor:
There is currently a footnote 5 attached to the sentence ending "structures like that". Currently it reads "C++ does, but not C". Let's update that to:

"C++ does, but not C. Well, strictly speaking C does allow you to store a pointer to a function in a struct, so this could be syntactically valid C code. But there's no implicit "self" or "this" pointer to the struct in C the way there is in object-oriented languages, so these lines of code couldn't indicate what hash table they're supposed to act on."

Aman V. Mehra  Mar 25, 2023 
Page The Linux kernel
Page 6, paragraph 1

The text says “using cat to echo the word hello” but in fact the example uses the “echo” command not “cat”

Note from the Author or Editor:
Should say "using echo to print the word hello to the screen"
where "echo" is a command and should be in fixed-width font, and "hello" should be in italics (as it currently is)

Adam Leventhal  Apr 08, 2023 
Page Page 32
Point 6

The text mentions "hello_exec() is a program", but the program is actually called "hello_execve" in the code sample.

Note from the Author or Editor:
Thanks for spotting this! You are correct - it should indeed be hello_execve() not hello_exec()

Meowjesty  May 13, 2023 
Page P122
3rd paragraph

Text does not match program.

"... with the helper function bpf_printf() ..."

should be

"... with the helper function bpf_printk ..."

Note from the Author or Editor:
bpf_printf() should be bpf_printk()

Chris Gibson  Jan 02, 2024 
Page 36
Exercises 5.

hello_map.py

hello-map.py

Mitsuru Kariya  Jan 09, 2024 
Page 40
1st general note

The short URL ://oreil.ly/_2XDT on a link text "kernel documentation" resolves to ://docs.kernel.org/bpf/instruction-set.html, which is a broken link.
Currently ://docs.kernel.org/bpf/standardization/instruction-set.html seems to be it.
(I omitted the schema because it does not seem possible to write URLs.)

Note from the Author or Editor:
Correct, this page has been moved to this new URL in the kernel documentation

Mitsuru Kariya  Jan 09, 2024 
Page 44
2nd paragraph

The short URL //oreil.ly/yp-jW on a link text "kernel documentation" resolves to //docs.kernel.org/bpf/instruction-set.html, which is a broken link.
Currently //docs.kernel.org/bpf/standardization/instruction-set.html seems to be it.
(I omitted the schema because it does not seem possible to write URLs.)

Note from the Author or Editor:
We could be using the same short link oreil.ly/_2XDT here as on p40 since they link to the same page in the kernel documentation

Mitsuru Kariya  Jan 09, 2024 
Page 48
2nd para

The text states "The `bytes_jited` field shows that after this *conversation* the program is *108* bytes long"

a. conversation -> conversion
b. 108, the earlier texts pointed to 148

Siva Kollipara  Dec 03, 2023 
Page 53
3rs para

"There is one key-value pair in this map, and the value contains *12* bytes of data ending with a 0.

12 -> 15

the "Hello World %d" is 15 bytes.

Siva Kollipara  Dec 03, 2023 
Page 93
last para

the text shows *u64* in the macro instead of *u32*

the corresopnding BCC example on pg 61 was:
BPF_HASH(config, *u32*, struct user_msg_t);

Note from the Author or Editor:
The last line on p93 should be:
BPF_HASH(config, u32, struct user_msg_t);

Siva Kollipara  Dec 10, 2023 
Page 126
General note section

The link to Alan Maguire's blog post seem to point to the Linux source code instead.

Note from the Author or Editor:
The short link https://oreil.ly/6dNIW is pointing to the wrong URL - it should point to https://blogs.oracle.com/linux/post/bpf-a-tour-of-program-types

Daniel Pacak  Apr 17, 2023 
Page 159
First code sample, text reference 2.

'... using the helper bpf_get_current_pid_tgif'
should be
'... using the helper bpf_get_current_pid_tgid'

Note from the Author or Editor:
This errata is correct: the helper function should be bpf_get_current_pid_tgid() and not bpf_get_current_pid_tgif(). This is for note (2) in the middle of page 159

Chris Gibson  Jan 20, 2024