Ebpf:undefined symbol for helpers

Question

I run an up to date debian testing (with kernel 4.19).

Helpers are not found on my system (but they exist in the header, Qt jumps to them)

#include "bpf/bpf.h"

int main (){
        int r = bpf_create_map(BPF_MAP_TYPE_ARRAY,1,1,1,0);
        return 0;
}

Compilation results in

undefined reference to `bpf_create_map(bpf_map_type, int, int, int, unsigned int)'

compiled with

g++ -c -pipe -g -std=gnu++1z -Wall -W -fPIC -DQT_QML_DEBUG -I. -I../../Qt/5.13.0/gcc_64/mkspecs/linux-g++ -o main.o main.cpp
g++ -lbpf -o server main.o  

Same result with

g++ main.cpp -lbpf -o out

I have the libbpf-dev installed as well and i have the associated libraries (a and so).

What is wrong?

Update

even the following code won't work

#include <linux/bpf.h>

int main (){

        //int r = bpf_create_map(BPF_MAP_TYPE_ARRAY,1,1,1,0);
        bpf_attr attr = {};
        attr.map_type    = BPF_MAP_TYPE_ARRAY;
        attr.key_size    = 1;
        attr.value_size  = 1;
        attr.max_entries = 1;

        bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
        return 0;
}

results in

error: 'bpf' was not declared in this scope

Update2:

BTW, key size is mandated to be 4 and not 1; but it is a point aside, that was unrelated to my problem here.

Answer 1

Namespace issue due to compiling in C++, you probably want:

extern "C" {
#include "bpf/bpf.h"
}

int main()...

Regarding your second error (error: 'bpf' was not declared in this scope), this is not directly related to libbpf, this is because there is no function simply called bpf() to actually perform the syscall. Instead you have to use the syscall number. For example, libbpf defines the following:

static inline int sys_bpf(enum bpf_cmd cmd, union bpf_attr *attr,
                          unsigned int size)
{
    return syscall(__NR_bpf, cmd, attr, size);
}

... and uses sys_bpf() after that, the same way you try to call bpf() in your sample.

For the record, “BPF helpers” often designates BPF functions that you call from within a BPF program, which is not the case here. Hence some confusion in the comments, I believe.