Errata

Linux Observability with BPF

Errata for Linux Observability with BPF

Submit your own errata for this product.

The errata list is a list of errors and their corrections that were found after the product was released.

The following errata were submitted by our customers and have not yet been approved or disproved by the author or editor. They solely represent the opinion of the customer.

Color Key: Serious technical mistake Minor technical mistake Language or formatting error Typo Question Note Update

Version Location Description Submitted by Date submitted
00
See description

Chapter 3. BPF Maps - Working with BFP Maps - Iterating Over Elements in a BPF Map

In the output of the bpf_map_get_next_key() example where the map mutates:

Deleteing key '2' typo -> Deleting key '2' (extra 'e')

Loic  Jan 17, 2020 
00
Chapter 3. BPF Maps - Concurrent Access to Map Elements - 4th paragraph

This map must be annotated with BPF Type Format (BTF) so the verifier knows how to intepret the structure -> typo "intepret" -> "interpret"

Loic  Jan 18, 2020 
1
Ch.8, in Seccomp is cbpf

"zeccomp" is used instead of "seccomp"

Maxime Guerreiro  Nov 09, 2019 
Printed Page 1
2nd paragraph

In first sentence - "approaches this problem from an different angle" - "an" should be "a"

Weston Steimel  Jan 15, 2020 
Printed Page 2
2nd paragraph

"raise in popularity" should be "rise in popularity"

Weston Steimel  Jan 15, 2020 
4
Chapter 4 : Tracing with BPF, First source code listing in URETPROBES section

The code listing to demonstrate use of URETPROBES in a go program is explained via numbered annotations below the listing.
In this case, the code listing is actually a copy of the previous code listing and not what the annotations explain.

Anadi  Nov 26, 2019 
4
Chapter 4 : Tracing with BPF, All source code listings using python and BCC

The signature of fn_name argument supplied to bpf.attach_kprobe does not work with latest bcc version. The bcc samples here (https://github.com/iovisor/bcc/tree/master/examples/tracing) actually require 'the one and only' void* ctx parameter.

Anadi  Nov 26, 2019 
Printed Page 8
1st paragraph

Typo: "circustances" instead of "circumstances"

Hans Wippel  Dec 20, 2019 
PDF Page 9
Last code snippet

The command to build the BPF loader specifies the library "elf" to be linked, but if I'm right the required library is "bpf". So the command should specify "-l bpf" instead of the current "-l elf".

Anonymous  Nov 13, 2019 
PDF Page 13, 14 and 156
3rd, 4th and 3rd paragraph, correspondingly

Typo using the name of the project Cilium (https://cilium.io), double 'L' is being used, whereas only one should be used.

Anonymous  Nov 12, 2019 
Printed Page 13
Paragraph 3

The claim that BPF_PROG_TYPE_CGROUP_SKB "is similar to BPF_PROG_TYPE_SOCKET_FILTER" seems wrong, since the socket filters are read-only but cgroup programs can re-route packets. Perhaps it meant to say they are similar to BPF_PROG_TYPE_XDP.

David MacKenzie  Dec 07, 2021 
Printed Page 14
3rd paragraph

The description in this paragraph sounds like RTO should stand for "retransmission time out".

Hans Wippel  Dec 20, 2019 
Printed Page 17
Fourth paragraph of the BPF Verifier section

DAG stands for Directed Acyclic Graph and not Direct Acyclic Graph

CEll  Dec 01, 2019 
Printed Page 17
5th paragraph

The paragraph mentions that conditions for rejecting the code follow, but the bullet points below mention the conditions the code has to fulfill for not getting rejected.

Hans Wippel  Dec 20, 2019 
Printed Page 19
Paragraph 1

"The way a program structured" is missing "is".

David MacKenzie  Dec 07, 2021 
Printed Page 19
Paragraph 2

Text refers to a ".BFT" metadata section. That looks like a typo for ".BTF". If it is not, that confusing difference should be called out in the text. This same likely typo is on page 82, second to last paragraph, "all of the BFT types".

David MacKenzie  Dec 07, 2021 
Printed Page 22
3rd paragraph

"unsigned integers" should be "signed integers" to better match the following example code.

Hans Wippel  Dec 20, 2019 
Printed Page 22
Code example 1

The comment saying "size of the keys" should be "size of the key" and "size of the values" should be "size of the value". The difference is subtle but important, to distinguish between the size of one element from the size of the whole map.

David MacKenzie  Dec 07, 2021 
Printed Page 23
Section header

Section header reads "Working with BFP Maps". It should be: "Working with BPF maps"

CEll  Dec 02, 2019 
Printed Page 28
3rd paragraph

This paragraph suggest that multiple operations exist and some are described in the following two sections. Then, the next section starts with "The final operation we look at in this section".

Hans Wippel  Dec 20, 2019 
Printed Page 31
4th paragraph

Typo: "semaphone" should be "semaphore"

Hans Wippel  Dec 20, 2019 
Printed Page 33
5th paragraph

In the last code example on this page, "key.v4_addr = ip4;" should be "key.v4_addr = ipv4;".

Hans Wippel  Dec 20, 2019 
Printed Page 35
3rd paragraph

With the colon, the paragraph suggests that the map is declared below this paragraph and not above it.

Hans Wippel  Dec 20, 2019 
Printed Page 36
3rd paragraph

Should ".value_size = sizeof(u32);" be ".value_size = sizeof(struct data_t);"?

Hans Wippel  Dec 20, 2019 
Printed Page 36
Third code block

This code block right-shifts the result of bpf_get_current_pid_tgid(). About half the examples in this book do this, and about half don't. Why? See examples on pages 54, 58, 64, 68.

David MacKenzie  Dec 07, 2021 
Printed Page 36
Code block 2

Why does the events map have max_entries = 2?

David MacKenzie  Dec 07, 2021 
Printed Page 38
Penultimate sentence of the first paragraph

"...as long as you don't mind loosing elements...": should be "losing" instead of "loosing"

CEll  Dec 03, 2019 
Printed Page 39
last paragraph of the section LPM Trie Maps

The book states that IP 192.168.1.1/32 matches both ranges 192.168.0.0/24 and 192.168.1.0/24. I think that the authors meant ranges 192.168.1.0/24 and 192.168.0.0/16

Mikolaj Pawlikowski  Dec 06, 2019 
Printed Page 41
Paragraph 4

"read the rest elements in the map" is missing "of the".

David MacKenzie  Dec 07, 2021 
Printed Page 42
Last paragraph

Because stack maps use last-in, first-out, I believe "retrieve them in the same order in which we inserted them" should be something like "retrieve them in the reverse of insertion order"

Weston Steimel  Jan 15, 2020 
Printed Page 44
6th paragraph

The last paragraph before the code example mentions that the map is populated with several elements, but in the example only one element is inserted.

Hans Wippel  Dec 20, 2019 
Printed Page 44
6th paragraph

Is the bpf_create_map() helper new here and needs more explanation?

Hans Wippel  Dec 20, 2019 
Printed Page 45
1st paragraph

The bullet (1) explaining the example code mentions that the map size is one. The bpf_create_map() parameters look like the map size could be 100.

Hans Wippel  Dec 20, 2019 
Printed Page 45
2nd paragraph

Typo: "pbf_obj_pin" should be "bpf_obj_pin".

Hans Wippel  Dec 20, 2019 
Printed Page 45
2nd paragraph

The directory listing shows a file called "/sys/fs/bpf/my_map", but in the example code the file_path is "/sys/fs/bpf/my_array".

Hans Wippel  Dec 20, 2019 
Printed Page 50
1st paragraph

In the first code example, bullet (4) should be one line further down to match the description below.

Hans Wippel  Dec 20, 2019 
Printed Page 53
2nd paragraph

In the description of bullet (2), "pbf_prog_load" should be "bpf_prog_load.

Hans Wippel  Dec 20, 2019 
Printed Page 54
Bullet point 2

The statement "This call needs to know that the object we want to trace, hello-bpf, is the absolute path to the object file." is ambiguous and apparently false, since the code referenced contains no absolute paths. What is it trying to say?

David MacKenzie  Dec 07, 2021 
Printed Page 59
Paragraph 5

"there is only a Ruby process running on our machine" should say "there is only ONE Ruby process running on our machine". As written, nothing but that Ruby process is running on the machine, which is obviously false.

David MacKenzie  Dec 07, 2021 
Printed Page 60
Paragraph 2

The text should state that it is switching from Ruby back to Python for the next code snippet. It took me awhile to figure out what was going on.

David MacKenzie  Dec 07, 2021 
Printed Page 65
Code example 2

The python code iterates through a variable "cache" which has not been defined in Python, only in the string of C code, so how can that loop work?

David MacKenzie  Dec 07, 2021 
Printed Page 65
Code block 2

The test of stack_id contains a redundant clause. Either check for < 0 or check for == -errno.EFAULT, but checking for both is redundant. Also, the initialization line = [] could be moved into the else clause.

David MacKenzie  Dec 07, 2021 
Printed Page 67
5th paragraph

In the code example, bullets (1), (2), and (3) are on the wrong line.

Hans Wippel  Dec 20, 2019 
Printed Page 68
Code block

Why is the parameter "void ctx" instead of "void *ctx"? Also on page 70, "void filename, void argv, void envp" looks like the asterisks are missing.

David MacKenzie  Dec 07, 2021 
PDF Page 69
Second paragraph , notation written for marker numeric two

"pbf_prog_load" this text has to be changed to "bpf_prog_load"

Bhaskar Chowdhury  Dec 02, 2019 
Printed Page 70
1st paragraph

The paragraph mentions that a python library is imported in the code example, but that is in the next code example.

Hans Wippel  Dec 20, 2019 
Printed Page 71
1st paragraph

The descriptions of the bullets (1), (2), (3), (4), and (5) do not match the positions of the bullets in the code example.

Hans Wippel  Dec 20, 2019 
Printed Page 85
Second to last paragraph

"You can also associate update elements in those maps" doesn't make sense, with two verbs in a row; the word "associate" seems to be spurious.

David MacKenzie  Dec 07, 2021 
Printed Page 95
7th paragraph

In the description of "jset #0x1fff jt 12 6", should "13 bytes of data" be "13 bits of data"?

Hans Wippel  Dec 20, 2019 
Printed Page 106
Paragraph below bolded section Classless qdiscs mid page

In the first sentence "A classless qdiscs is a qdisc" qdiscs should be singular "qdisc"

Weston Steimel  Jan 23, 2020 
Printed Page 106
Page 106 Paragraph below bolded section Classless qdiscs mid page

Second sentence "This means that is not possible to attach filters to classless qdiscs" "is" should be "it's"

Weston Steimel  Jan 23, 2020 
Printed Page 108
3rd paragraph

In the code example, "h_proto" is not set.

Hans Wippel  Dec 20, 2019 
Printed Page 109
3rd paragraph

In the last code example, what are the values of "ip_total_length", "ip_hlen", "tcp_hlen", and "poffset"? What is the function header?

Hans Wippel  Dec 20, 2019 
Printed Page 110
3rd paragraph

This paragraph first mentions we can compile the program as we did before. But then, it mentions that we cannot compile this program in the same way.

Hans Wippel  Dec 20, 2019 
Printed Page 117
3rd paragraph

In Figure 7-1, are RX and TX swapped?

Hans Wippel  Dec 20, 2019 
Printed Page 124
Code block 1

The nmap example output shows TCP port 22 (ssh) still reachable, but the XDP program installed on that interface on the previous page drops all TCP packets, which includes the ssh port.

David MacKenzie  Dec 10, 2021 
Printed Page 131
3rd paragraph

The paragraph mentions that TCP packets are always dropped with XDP_DROP. But the next paragraph mentions another check for the destination port. Maybe, the "always do XDP_DROP" part should be removed.

Hans Wippel  Dec 20, 2019 
Printed Page 133
6th paragraph

In the load balancing use case, what about XDP redirect?

Hans Wippel  Dec 20, 2019 
Printed Page 142
4th paragraph

Typo: "part contains our the list" should be "part contains the list",

Hans Wippel  Dec 20, 2019 
Printed Page 143
6th paragraph

In the "Seccomp Is cBPF" info box, "you might wondering" should be "you might be wondering".

Hans Wippel  Dec 20, 2019 
Printed Page 143
6th paragraph

In the "Seccomp Is cBPF" info box, in the first bullet list item, "registries" should be "registers".

Hans Wippel  Dec 20, 2019 
Printed Page 145
5th paragraph

The paragraphs contains a question about Seccomp with eBPF instead of cBPF. Is something missing in this section? Is it related to LSM hooks somehow, because they are mentioned in the following paragraph?

Hans Wippel  Dec 20, 2019 
Printed Page 153
1st paragraph

In the third item of the bullet list, "and in Kubernetes, and a service virtual IP" should be "and in Kubernetes, a service virtual IP".

Hans Wippel  Dec 20, 2019