libbpf | Automated upstream mirror for libbpf stand-alone build | Recommender System library

You have found the GitHub mirror for the project (the “original” sources are in the Linux kernel repository) and the official API documentation. The latter is generated from the source code, in particular from the comments in src/libbpf.h. It may be that the documentation is not entirely up-to-date, it seems that the description for a few functions is currently missing in the HTML-rendered documentation.

However, not all functions have been documented yet, and the ring buffer API does not have much on this side to help you. So the best I can suggest is to look at the code and at existing examples. There are at least two selftests in the kernel repository which are using ring_buffer__new(): ringbuf.c and ringbuf_multi.c.

The first one (ringbuf.c) calls it like this:

The verifier complains because your code is trying to read uninitialised data from the stack, in particular in your variable val.

If we look at your code:

As per the discussion in the comments, the map is not created because it is not actually used in your eBPF code (not provided in the question).

As you realised yourself, the branch in your code that was calling the map was in fact unreachable. Based on that, it's likely that clang compiled out this portion of code, and that the map is not used in the resulting eBPF bytecode. When preparing to load your program, bpftool (libbpf) looks at what maps are necessary, and only creates the ones that are needed for your program. It may skip maps that are defined in the ELF file if no program uses them.

One hint here is that, if the program was effectively using the map, it couldn't load successfully if the map was missing: given that your program loads, the map would necessarily be present if it was needed. Note that bpftool prog show will show you the ids of the maps used by a program.

This specific part is triggering this error:

you can use find command

TL;DR. The issue is that you're making an out-of-bound access to the packet from the verifier's point of view. You need to check the packet is long enough to actually contain the IP header first.

Reading the verifier error message.

You should add the libbpf library directory to your LD_LIBRARY_PATH variable.

The key and value should be __u32:

1. you are explicitly using perf_buffer__new_deprecated in your code - don't do this: Use perf_buffer_new instead. You should never call a function that already has 'deprecated' in it's name.

2. Take a look in the header: libbpf/libbpf.h

perf_buffer_new is defined like this: