implicit declaration of function ‘bpf’

Question

I have been studying BPF recently, but it is not proceeding because of a very basic problem.

I included linux/bpf.h as described in man bpf(2), but GCC can not find bpf function. This code is just for the test to make sure that GCC can find bpf function.

#include <linux/bpf.h>

int main()
{
    bpf(0,(void *)0,0);
    return 0;
}

GCC output is this.

$ gcc -o test bpf.c
bpf.c: In function ‘main’:
bpf.c:5:2: warning: implicit declaration of function ‘bpf’ [-Wimplicit-function-declaration]
  bpf(0,(void *)0,0);
  ^~~
/usr/bin/ld: /tmp/cc4tjrUh.o: in function `main':
bpf.c:(.text+0x19): undefined reference to `bpf'
collect2: error: ld returned 1 exit status

I'm using Archlinux and linux kernel version is 4.20.11-arch1-1-ARCH. Please help me how to include bpf function.

Answer 1

The manual page documents the system call bpf. While this is not intuitive, there is actually no function defined in the header <linux/bpf.h> that is simply called bpf(). Instead, you can do an indirect syscall with syscall(__NR_bpf, ...) (see also man syscall).

Projects relying on this syscall often define a wrapper that looks like this:

int bpf(enum bpf_cmd cmd, union bpf_attr *attr, unsigned int size)
{
    return syscall(__NR_bpf, cmd, attr, size);
}

Here is an example from libbpf.