lizrice / learning-ebpf

Learning eBPF, published by O'Reilly - out now! Here's where you'll find a VM config for the examples, and more

Home Page:https://www.amazon.com/Learning-eBPF-Programming-Observability-Networking/dp/1098135121

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Chapter2 confusing footnote description of tgid/pid

AliJavidiCS opened this issue · comments

Hi, Hope you're having a wonderful day!

This is a quote form bpf-helpers man page:

u64 bpf_get_current_pid_tgid(void)
Return A 64-bit integer containing the current tgid and pid, created as such: current_task->tgid << 32 | current_task->pid.

As you can see the top 32 bits contain tgid and the bottom 32 bits hold pid of the process.
In the book this is explained the other way around on page 26. The foot note of page 26 also refers to the lower 32 bits as tgid which is incorrect.

Edit: As I continued reading the book I noticed the same situation with hello-buffer-config.py, hello-ring-buffer-config.py and page 61.

This is pretty confusing but my understanding is that what we typically call "process ID" in user space is actually the thread group ID in the kernel.

From the BCC reference for this helper function:

Returns the process ID in the lower 32 bits (kernel's view of the PID, which in user space is usually presented as the thread ID), and the thread group ID in the upper 32 bits (what user space often thinks of as the PID)

So, the footnote on p26 is wrong, and could explain this better, but (assuming the user is interested in the user space view of process ID) the code is correct. I'll need to do an errata to fix this in the book but for some reason can't log into the O'Reilly author portal right now, so I'll leave this issue to track it. But I think this means the PR in #36 is not needed