1 // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) 2 /* Copyright (c) 2019 Netronome Systems, Inc. */ 3 4 #include <ctype.h> 5 #include <errno.h> 6 #include <fcntl.h> 7 #include <string.h> 8 #include <unistd.h> 9 #include <net/if.h> 10 #ifdef USE_LIBCAP 11 #include <sys/capability.h> 12 #endif 13 #include <sys/vfs.h> 14 15 #include <linux/filter.h> 16 #include <linux/limits.h> 17 18 #include <bpf/bpf.h> 19 #include <bpf/libbpf.h> 20 21 #include "main.h" 22 23 #ifndef PROC_SUPER_MAGIC 24 # define PROC_SUPER_MAGIC 0x9fa0 25 #endif 26 27 enum probe_component { 28 COMPONENT_UNSPEC, 29 COMPONENT_KERNEL, 30 COMPONENT_DEVICE, 31 }; 32 33 #define BPF_HELPER_MAKE_ENTRY(name) [BPF_FUNC_ ## name] = "bpf_" # name 34 static const char * const helper_name[] = { 35 __BPF_FUNC_MAPPER(BPF_HELPER_MAKE_ENTRY) 36 }; 37 38 #undef BPF_HELPER_MAKE_ENTRY 39 40 static bool full_mode; 41 #ifdef USE_LIBCAP 42 static bool run_as_unprivileged; 43 #endif 44 45 /* Miscellaneous utility functions */ 46 47 static bool grep(const char *buffer, const char *pattern) 48 { 49 return !!strstr(buffer, pattern); 50 } 51 52 static bool check_procfs(void) 53 { 54 struct statfs st_fs; 55 56 if (statfs("/proc", &st_fs) < 0) 57 return false; 58 if ((unsigned long)st_fs.f_type != PROC_SUPER_MAGIC) 59 return false; 60 61 return true; 62 } 63 64 static void uppercase(char *str, size_t len) 65 { 66 size_t i; 67 68 for (i = 0; i < len && str[i] != '\0'; i++) 69 str[i] = toupper(str[i]); 70 } 71 72 /* Printing utility functions */ 73 74 static void 75 print_bool_feature(const char *feat_name, const char *plain_name, 76 const char *define_name, bool res, const char *define_prefix) 77 { 78 if (json_output) 79 jsonw_bool_field(json_wtr, feat_name, res); 80 else if (define_prefix) 81 printf("#define %s%sHAVE_%s\n", define_prefix, 82 res ? "" : "NO_", define_name); 83 else 84 printf("%s is %savailable\n", plain_name, res ? "" : "NOT "); 85 } 86 87 static void print_kernel_option(const char *name, const char *value, 88 const char *define_prefix) 89 { 90 char *endptr; 91 int res; 92 93 if (json_output) { 94 if (!value) { 95 jsonw_null_field(json_wtr, name); 96 return; 97 } 98 errno = 0; 99 res = strtol(value, &endptr, 0); 100 if (!errno && *endptr == '\n') 101 jsonw_int_field(json_wtr, name, res); 102 else 103 jsonw_string_field(json_wtr, name, value); 104 } else if (define_prefix) { 105 if (value) 106 printf("#define %s%s %s\n", define_prefix, 107 name, value); 108 else 109 printf("/* %s%s is not set */\n", define_prefix, name); 110 } else { 111 if (value) 112 printf("%s is set to %s\n", name, value); 113 else 114 printf("%s is not set\n", name); 115 } 116 } 117 118 static void 119 print_start_section(const char *json_title, const char *plain_title, 120 const char *define_comment, const char *define_prefix) 121 { 122 if (json_output) { 123 jsonw_name(json_wtr, json_title); 124 jsonw_start_object(json_wtr); 125 } else if (define_prefix) { 126 printf("%s\n", define_comment); 127 } else { 128 printf("%s\n", plain_title); 129 } 130 } 131 132 static void print_end_section(void) 133 { 134 if (json_output) 135 jsonw_end_object(json_wtr); 136 else 137 printf("\n"); 138 } 139 140 /* Probing functions */ 141 142 static int get_vendor_id(int ifindex) 143 { 144 char ifname[IF_NAMESIZE], path[64], buf[8]; 145 ssize_t len; 146 int fd; 147 148 if (!if_indextoname(ifindex, ifname)) 149 return -1; 150 151 snprintf(path, sizeof(path), "/sys/class/net/%s/device/vendor", ifname); 152 153 fd = open(path, O_RDONLY | O_CLOEXEC); 154 if (fd < 0) 155 return -1; 156 157 len = read(fd, buf, sizeof(buf)); 158 close(fd); 159 if (len < 0) 160 return -1; 161 if (len >= (ssize_t)sizeof(buf)) 162 return -1; 163 buf[len] = '\0'; 164 165 return strtol(buf, NULL, 0); 166 } 167 168 static long read_procfs(const char *path) 169 { 170 char *endptr, *line = NULL; 171 size_t len = 0; 172 FILE *fd; 173 long res; 174 175 fd = fopen(path, "r"); 176 if (!fd) 177 return -1; 178 179 res = getline(&line, &len, fd); 180 fclose(fd); 181 if (res < 0) 182 return -1; 183 184 errno = 0; 185 res = strtol(line, &endptr, 10); 186 if (errno || *line == '\0' || *endptr != '\n') 187 res = -1; 188 free(line); 189 190 return res; 191 } 192 193 static void probe_unprivileged_disabled(void) 194 { 195 long res; 196 197 /* No support for C-style output */ 198 199 res = read_procfs("/proc/sys/kernel/unprivileged_bpf_disabled"); 200 if (json_output) { 201 jsonw_int_field(json_wtr, "unprivileged_bpf_disabled", res); 202 } else { 203 switch (res) { 204 case 0: 205 printf("bpf() syscall for unprivileged users is enabled\n"); 206 break; 207 case 1: 208 printf("bpf() syscall restricted to privileged users (without recovery)\n"); 209 break; 210 case 2: 211 printf("bpf() syscall restricted to privileged users (admin can change)\n"); 212 break; 213 case -1: 214 printf("Unable to retrieve required privileges for bpf() syscall\n"); 215 break; 216 default: 217 printf("bpf() syscall restriction has unknown value %ld\n", res); 218 } 219 } 220 } 221 222 static void probe_jit_enable(void) 223 { 224 long res; 225 226 /* No support for C-style output */ 227 228 res = read_procfs("/proc/sys/net/core/bpf_jit_enable"); 229 if (json_output) { 230 jsonw_int_field(json_wtr, "bpf_jit_enable", res); 231 } else { 232 switch (res) { 233 case 0: 234 printf("JIT compiler is disabled\n"); 235 break; 236 case 1: 237 printf("JIT compiler is enabled\n"); 238 break; 239 case 2: 240 printf("JIT compiler is enabled with debugging traces in kernel logs\n"); 241 break; 242 case -1: 243 printf("Unable to retrieve JIT-compiler status\n"); 244 break; 245 default: 246 printf("JIT-compiler status has unknown value %ld\n", 247 res); 248 } 249 } 250 } 251 252 static void probe_jit_harden(void) 253 { 254 long res; 255 256 /* No support for C-style output */ 257 258 res = read_procfs("/proc/sys/net/core/bpf_jit_harden"); 259 if (json_output) { 260 jsonw_int_field(json_wtr, "bpf_jit_harden", res); 261 } else { 262 switch (res) { 263 case 0: 264 printf("JIT compiler hardening is disabled\n"); 265 break; 266 case 1: 267 printf("JIT compiler hardening is enabled for unprivileged users\n"); 268 break; 269 case 2: 270 printf("JIT compiler hardening is enabled for all users\n"); 271 break; 272 case -1: 273 printf("Unable to retrieve JIT hardening status\n"); 274 break; 275 default: 276 printf("JIT hardening status has unknown value %ld\n", 277 res); 278 } 279 } 280 } 281 282 static void probe_jit_kallsyms(void) 283 { 284 long res; 285 286 /* No support for C-style output */ 287 288 res = read_procfs("/proc/sys/net/core/bpf_jit_kallsyms"); 289 if (json_output) { 290 jsonw_int_field(json_wtr, "bpf_jit_kallsyms", res); 291 } else { 292 switch (res) { 293 case 0: 294 printf("JIT compiler kallsyms exports are disabled\n"); 295 break; 296 case 1: 297 printf("JIT compiler kallsyms exports are enabled for root\n"); 298 break; 299 case -1: 300 printf("Unable to retrieve JIT kallsyms export status\n"); 301 break; 302 default: 303 printf("JIT kallsyms exports status has unknown value %ld\n", res); 304 } 305 } 306 } 307 308 static void probe_jit_limit(void) 309 { 310 long res; 311 312 /* No support for C-style output */ 313 314 res = read_procfs("/proc/sys/net/core/bpf_jit_limit"); 315 if (json_output) { 316 jsonw_int_field(json_wtr, "bpf_jit_limit", res); 317 } else { 318 switch (res) { 319 case -1: 320 printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n"); 321 break; 322 default: 323 printf("Global memory limit for JIT compiler for unprivileged users is %ld bytes\n", res); 324 } 325 } 326 } 327 328 static void probe_kernel_image_config(const char *define_prefix) 329 { 330 struct kernel_config_option options[] = { 331 /* Enable BPF */ 332 { "CONFIG_BPF", }, 333 /* Enable bpf() syscall */ 334 { "CONFIG_BPF_SYSCALL", }, 335 /* Does selected architecture support eBPF JIT compiler */ 336 { "CONFIG_HAVE_EBPF_JIT", }, 337 /* Compile eBPF JIT compiler */ 338 { "CONFIG_BPF_JIT", }, 339 /* Avoid compiling eBPF interpreter (use JIT only) */ 340 { "CONFIG_BPF_JIT_ALWAYS_ON", }, 341 /* Kernel BTF debug information available */ 342 { "CONFIG_DEBUG_INFO_BTF", }, 343 /* Kernel module BTF debug information available */ 344 { "CONFIG_DEBUG_INFO_BTF_MODULES", }, 345 346 /* cgroups */ 347 { "CONFIG_CGROUPS", }, 348 /* BPF programs attached to cgroups */ 349 { "CONFIG_CGROUP_BPF", }, 350 /* bpf_get_cgroup_classid() helper */ 351 { "CONFIG_CGROUP_NET_CLASSID", }, 352 /* bpf_skb_{,ancestor_}cgroup_id() helpers */ 353 { "CONFIG_SOCK_CGROUP_DATA", }, 354 355 /* Tracing: attach BPF to kprobes, tracepoints, etc. */ 356 { "CONFIG_BPF_EVENTS", }, 357 /* Kprobes */ 358 { "CONFIG_KPROBE_EVENTS", }, 359 /* Uprobes */ 360 { "CONFIG_UPROBE_EVENTS", }, 361 /* Tracepoints */ 362 { "CONFIG_TRACING", }, 363 /* Syscall tracepoints */ 364 { "CONFIG_FTRACE_SYSCALLS", }, 365 /* bpf_override_return() helper support for selected arch */ 366 { "CONFIG_FUNCTION_ERROR_INJECTION", }, 367 /* bpf_override_return() helper */ 368 { "CONFIG_BPF_KPROBE_OVERRIDE", }, 369 370 /* Network */ 371 { "CONFIG_NET", }, 372 /* AF_XDP sockets */ 373 { "CONFIG_XDP_SOCKETS", }, 374 /* BPF_PROG_TYPE_LWT_* and related helpers */ 375 { "CONFIG_LWTUNNEL_BPF", }, 376 /* BPF_PROG_TYPE_SCHED_ACT, TC (traffic control) actions */ 377 { "CONFIG_NET_ACT_BPF", }, 378 /* BPF_PROG_TYPE_SCHED_CLS, TC filters */ 379 { "CONFIG_NET_CLS_BPF", }, 380 /* TC clsact qdisc */ 381 { "CONFIG_NET_CLS_ACT", }, 382 /* Ingress filtering with TC */ 383 { "CONFIG_NET_SCH_INGRESS", }, 384 /* bpf_skb_get_xfrm_state() helper */ 385 { "CONFIG_XFRM", }, 386 /* bpf_get_route_realm() helper */ 387 { "CONFIG_IP_ROUTE_CLASSID", }, 388 /* BPF_PROG_TYPE_LWT_SEG6_LOCAL and related helpers */ 389 { "CONFIG_IPV6_SEG6_BPF", }, 390 /* BPF_PROG_TYPE_LIRC_MODE2 and related helpers */ 391 { "CONFIG_BPF_LIRC_MODE2", }, 392 /* BPF stream parser and BPF socket maps */ 393 { "CONFIG_BPF_STREAM_PARSER", }, 394 /* xt_bpf module for passing BPF programs to netfilter */ 395 { "CONFIG_NETFILTER_XT_MATCH_BPF", }, 396 397 /* Misc configs useful in BPF C programs */ 398 /* jiffies <-> sec conversion for bpf_jiffies64() helper */ 399 { "CONFIG_HZ", true, } 400 }; 401 char *values[ARRAY_SIZE(options)] = { }; 402 size_t i; 403 404 if (read_kernel_config(options, ARRAY_SIZE(options), values, 405 define_prefix)) 406 return; 407 408 for (i = 0; i < ARRAY_SIZE(options); i++) { 409 if (define_prefix && !options[i].macro_dump) 410 continue; 411 print_kernel_option(options[i].name, values[i], define_prefix); 412 free(values[i]); 413 } 414 } 415 416 static bool probe_bpf_syscall(const char *define_prefix) 417 { 418 bool res; 419 420 bpf_prog_load(BPF_PROG_TYPE_UNSPEC, NULL, NULL, NULL, 0, NULL); 421 res = (errno != ENOSYS); 422 423 print_bool_feature("have_bpf_syscall", 424 "bpf() syscall", 425 "BPF_SYSCALL", 426 res, define_prefix); 427 428 return res; 429 } 430 431 static bool 432 probe_prog_load_ifindex(enum bpf_prog_type prog_type, 433 const struct bpf_insn *insns, size_t insns_cnt, 434 char *log_buf, size_t log_buf_sz, 435 __u32 ifindex) 436 { 437 LIBBPF_OPTS(bpf_prog_load_opts, opts, 438 .log_buf = log_buf, 439 .log_size = log_buf_sz, 440 .log_level = log_buf ? 1 : 0, 441 .prog_ifindex = ifindex, 442 ); 443 int fd; 444 445 errno = 0; 446 fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts); 447 if (fd >= 0) 448 close(fd); 449 450 return fd >= 0 && errno != EINVAL && errno != EOPNOTSUPP; 451 } 452 453 static bool probe_prog_type_ifindex(enum bpf_prog_type prog_type, __u32 ifindex) 454 { 455 /* nfp returns -EINVAL on exit(0) with TC offload */ 456 struct bpf_insn insns[2] = { 457 BPF_MOV64_IMM(BPF_REG_0, 2), 458 BPF_EXIT_INSN() 459 }; 460 461 return probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns), 462 NULL, 0, ifindex); 463 } 464 465 static void 466 probe_prog_type(enum bpf_prog_type prog_type, const char *prog_type_str, 467 bool *supported_types, const char *define_prefix, __u32 ifindex) 468 { 469 char feat_name[128], plain_desc[128], define_name[128]; 470 const char *plain_comment = "eBPF program_type "; 471 size_t maxlen; 472 bool res; 473 474 if (ifindex) { 475 switch (prog_type) { 476 case BPF_PROG_TYPE_SCHED_CLS: 477 case BPF_PROG_TYPE_XDP: 478 break; 479 default: 480 return; 481 } 482 483 res = probe_prog_type_ifindex(prog_type, ifindex); 484 } else { 485 res = libbpf_probe_bpf_prog_type(prog_type, NULL) > 0; 486 } 487 488 #ifdef USE_LIBCAP 489 /* Probe may succeed even if program load fails, for unprivileged users 490 * check that we did not fail because of insufficient permissions 491 */ 492 if (run_as_unprivileged && errno == EPERM) 493 res = false; 494 #endif 495 496 supported_types[prog_type] |= res; 497 498 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1; 499 if (strlen(prog_type_str) > maxlen) { 500 p_info("program type name too long"); 501 return; 502 } 503 504 sprintf(feat_name, "have_%s_prog_type", prog_type_str); 505 sprintf(define_name, "%s_prog_type", prog_type_str); 506 uppercase(define_name, sizeof(define_name)); 507 sprintf(plain_desc, "%s%s", plain_comment, prog_type_str); 508 print_bool_feature(feat_name, plain_desc, define_name, res, 509 define_prefix); 510 } 511 512 static bool probe_map_type_ifindex(enum bpf_map_type map_type, __u32 ifindex) 513 { 514 LIBBPF_OPTS(bpf_map_create_opts, opts); 515 int key_size, value_size, max_entries; 516 int fd; 517 518 opts.map_ifindex = ifindex; 519 520 key_size = sizeof(__u32); 521 value_size = sizeof(__u32); 522 max_entries = 1; 523 524 fd = bpf_map_create(map_type, NULL, key_size, value_size, max_entries, 525 &opts); 526 if (fd >= 0) 527 close(fd); 528 529 return fd >= 0; 530 } 531 532 static void 533 probe_map_type(enum bpf_map_type map_type, char const *map_type_str, 534 const char *define_prefix, __u32 ifindex) 535 { 536 char feat_name[128], plain_desc[128], define_name[128]; 537 const char *plain_comment = "eBPF map_type "; 538 size_t maxlen; 539 bool res; 540 541 if (ifindex) { 542 switch (map_type) { 543 case BPF_MAP_TYPE_HASH: 544 case BPF_MAP_TYPE_ARRAY: 545 break; 546 default: 547 return; 548 } 549 550 res = probe_map_type_ifindex(map_type, ifindex); 551 } else { 552 res = libbpf_probe_bpf_map_type(map_type, NULL) > 0; 553 } 554 555 /* Probe result depends on the success of map creation, no additional 556 * check required for unprivileged users 557 */ 558 559 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1; 560 if (strlen(map_type_str) > maxlen) { 561 p_info("map type name too long"); 562 return; 563 } 564 565 sprintf(feat_name, "have_%s_map_type", map_type_str); 566 sprintf(define_name, "%s_map_type", map_type_str); 567 uppercase(define_name, sizeof(define_name)); 568 sprintf(plain_desc, "%s%s", plain_comment, map_type_str); 569 print_bool_feature(feat_name, plain_desc, define_name, res, 570 define_prefix); 571 } 572 573 static bool 574 probe_helper_ifindex(enum bpf_func_id id, enum bpf_prog_type prog_type, 575 __u32 ifindex) 576 { 577 struct bpf_insn insns[2] = { 578 BPF_EMIT_CALL(id), 579 BPF_EXIT_INSN() 580 }; 581 char buf[4096] = {}; 582 bool res; 583 584 probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns), buf, 585 sizeof(buf), ifindex); 586 res = !grep(buf, "invalid func ") && !grep(buf, "unknown func ") && 587 !grep(buf, "program of this type cannot use helper "); 588 589 switch (get_vendor_id(ifindex)) { 590 case 0x19ee: /* Netronome specific */ 591 res = res && !grep(buf, "not supported by FW") && 592 !grep(buf, "unsupported function id"); 593 break; 594 default: 595 break; 596 } 597 598 return res; 599 } 600 601 static bool 602 probe_helper_for_progtype(enum bpf_prog_type prog_type, bool supported_type, 603 const char *define_prefix, unsigned int id, 604 const char *ptype_name, __u32 ifindex) 605 { 606 bool res = false; 607 608 if (supported_type) { 609 if (ifindex) 610 res = probe_helper_ifindex(id, prog_type, ifindex); 611 else 612 res = libbpf_probe_bpf_helper(prog_type, id, NULL) > 0; 613 #ifdef USE_LIBCAP 614 /* Probe may succeed even if program load fails, for 615 * unprivileged users check that we did not fail because of 616 * insufficient permissions 617 */ 618 if (run_as_unprivileged && errno == EPERM) 619 res = false; 620 #endif 621 } 622 623 if (json_output) { 624 if (res) 625 jsonw_string(json_wtr, helper_name[id]); 626 } else if (define_prefix) { 627 printf("#define %sBPF__PROG_TYPE_%s__HELPER_%s %s\n", 628 define_prefix, ptype_name, helper_name[id], 629 res ? "1" : "0"); 630 } else { 631 if (res) 632 printf("\n\t- %s", helper_name[id]); 633 } 634 635 return res; 636 } 637 638 static void 639 probe_helpers_for_progtype(enum bpf_prog_type prog_type, 640 const char *prog_type_str, bool supported_type, 641 const char *define_prefix, __u32 ifindex) 642 { 643 char feat_name[128]; 644 unsigned int id; 645 bool probe_res = false; 646 647 if (ifindex) 648 /* Only test helpers for offload-able program types */ 649 switch (prog_type) { 650 case BPF_PROG_TYPE_SCHED_CLS: 651 case BPF_PROG_TYPE_XDP: 652 break; 653 default: 654 return; 655 } 656 657 if (json_output) { 658 sprintf(feat_name, "%s_available_helpers", prog_type_str); 659 jsonw_name(json_wtr, feat_name); 660 jsonw_start_array(json_wtr); 661 } else if (!define_prefix) { 662 printf("eBPF helpers supported for program type %s:", 663 prog_type_str); 664 } 665 666 for (id = 1; id < ARRAY_SIZE(helper_name); id++) { 667 /* Skip helper functions which emit dmesg messages when not in 668 * the full mode. 669 */ 670 switch (id) { 671 case BPF_FUNC_trace_printk: 672 case BPF_FUNC_trace_vprintk: 673 case BPF_FUNC_probe_write_user: 674 if (!full_mode) 675 continue; 676 fallthrough; 677 default: 678 probe_res |= probe_helper_for_progtype(prog_type, supported_type, 679 define_prefix, id, prog_type_str, 680 ifindex); 681 } 682 } 683 684 if (json_output) 685 jsonw_end_array(json_wtr); 686 else if (!define_prefix) { 687 printf("\n"); 688 if (!probe_res) { 689 if (!supported_type) 690 printf("\tProgram type not supported\n"); 691 else 692 printf("\tCould not determine which helpers are available\n"); 693 } 694 } 695 696 697 } 698 699 static void 700 probe_misc_feature(struct bpf_insn *insns, size_t len, 701 const char *define_prefix, __u32 ifindex, 702 const char *feat_name, const char *plain_name, 703 const char *define_name) 704 { 705 LIBBPF_OPTS(bpf_prog_load_opts, opts, 706 .prog_ifindex = ifindex, 707 ); 708 bool res; 709 int fd; 710 711 errno = 0; 712 fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", 713 insns, len, &opts); 714 res = fd >= 0 || !errno; 715 716 if (fd >= 0) 717 close(fd); 718 719 print_bool_feature(feat_name, plain_name, define_name, res, 720 define_prefix); 721 } 722 723 /* 724 * Probe for availability of kernel commit (5.3): 725 * 726 * c04c0d2b968a ("bpf: increase complexity limit and maximum program size") 727 */ 728 static void probe_large_insn_limit(const char *define_prefix, __u32 ifindex) 729 { 730 struct bpf_insn insns[BPF_MAXINSNS + 1]; 731 int i; 732 733 for (i = 0; i < BPF_MAXINSNS; i++) 734 insns[i] = BPF_MOV64_IMM(BPF_REG_0, 1); 735 insns[BPF_MAXINSNS] = BPF_EXIT_INSN(); 736 737 probe_misc_feature(insns, ARRAY_SIZE(insns), 738 define_prefix, ifindex, 739 "have_large_insn_limit", 740 "Large program size limit", 741 "LARGE_INSN_LIMIT"); 742 } 743 744 /* 745 * Probe for bounded loop support introduced in commit 2589726d12a1 746 * ("bpf: introduce bounded loops"). 747 */ 748 static void 749 probe_bounded_loops(const char *define_prefix, __u32 ifindex) 750 { 751 struct bpf_insn insns[4] = { 752 BPF_MOV64_IMM(BPF_REG_0, 10), 753 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 1), 754 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, -2), 755 BPF_EXIT_INSN() 756 }; 757 758 probe_misc_feature(insns, ARRAY_SIZE(insns), 759 define_prefix, ifindex, 760 "have_bounded_loops", 761 "Bounded loop support", 762 "BOUNDED_LOOPS"); 763 } 764 765 /* 766 * Probe for the v2 instruction set extension introduced in commit 92b31a9af73b 767 * ("bpf: add BPF_J{LT,LE,SLT,SLE} instructions"). 768 */ 769 static void 770 probe_v2_isa_extension(const char *define_prefix, __u32 ifindex) 771 { 772 struct bpf_insn insns[4] = { 773 BPF_MOV64_IMM(BPF_REG_0, 0), 774 BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 0, 1), 775 BPF_MOV64_IMM(BPF_REG_0, 1), 776 BPF_EXIT_INSN() 777 }; 778 779 probe_misc_feature(insns, ARRAY_SIZE(insns), 780 define_prefix, ifindex, 781 "have_v2_isa_extension", 782 "ISA extension v2", 783 "V2_ISA_EXTENSION"); 784 } 785 786 /* 787 * Probe for the v3 instruction set extension introduced in commit 092ed0968bb6 788 * ("bpf: verifier support JMP32"). 789 */ 790 static void 791 probe_v3_isa_extension(const char *define_prefix, __u32 ifindex) 792 { 793 struct bpf_insn insns[4] = { 794 BPF_MOV64_IMM(BPF_REG_0, 0), 795 BPF_JMP32_IMM(BPF_JLT, BPF_REG_0, 0, 1), 796 BPF_MOV64_IMM(BPF_REG_0, 1), 797 BPF_EXIT_INSN() 798 }; 799 800 probe_misc_feature(insns, ARRAY_SIZE(insns), 801 define_prefix, ifindex, 802 "have_v3_isa_extension", 803 "ISA extension v3", 804 "V3_ISA_EXTENSION"); 805 } 806 807 /* 808 * Probe for the v4 instruction set extension introduced in commit 1f9a1ea821ff 809 * ("bpf: Support new sign-extension load insns"). 810 */ 811 static void 812 probe_v4_isa_extension(const char *define_prefix, __u32 ifindex) 813 { 814 struct bpf_insn insns[5] = { 815 BPF_MOV64_IMM(BPF_REG_0, 0), 816 BPF_JMP32_IMM(BPF_JEQ, BPF_REG_0, 1, 1), 817 BPF_JMP32_A(1), 818 BPF_MOV64_IMM(BPF_REG_0, 1), 819 BPF_EXIT_INSN() 820 }; 821 822 probe_misc_feature(insns, ARRAY_SIZE(insns), 823 define_prefix, ifindex, 824 "have_v4_isa_extension", 825 "ISA extension v4", 826 "V4_ISA_EXTENSION"); 827 } 828 829 static void 830 section_system_config(enum probe_component target, const char *define_prefix) 831 { 832 switch (target) { 833 case COMPONENT_KERNEL: 834 case COMPONENT_UNSPEC: 835 print_start_section("system_config", 836 "Scanning system configuration...", 837 "/*** Misc kernel config items ***/", 838 define_prefix); 839 if (!define_prefix) { 840 if (check_procfs()) { 841 probe_unprivileged_disabled(); 842 probe_jit_enable(); 843 probe_jit_harden(); 844 probe_jit_kallsyms(); 845 probe_jit_limit(); 846 } else { 847 p_info("/* procfs not mounted, skipping related probes */"); 848 } 849 } 850 probe_kernel_image_config(define_prefix); 851 print_end_section(); 852 break; 853 default: 854 break; 855 } 856 } 857 858 static bool section_syscall_config(const char *define_prefix) 859 { 860 bool res; 861 862 print_start_section("syscall_config", 863 "Scanning system call availability...", 864 "/*** System call availability ***/", 865 define_prefix); 866 res = probe_bpf_syscall(define_prefix); 867 print_end_section(); 868 869 return res; 870 } 871 872 static void 873 section_program_types(bool *supported_types, const char *define_prefix, 874 __u32 ifindex) 875 { 876 unsigned int prog_type = BPF_PROG_TYPE_UNSPEC; 877 const char *prog_type_str; 878 879 print_start_section("program_types", 880 "Scanning eBPF program types...", 881 "/*** eBPF program types ***/", 882 define_prefix); 883 884 while (true) { 885 prog_type++; 886 prog_type_str = libbpf_bpf_prog_type_str(prog_type); 887 /* libbpf will return NULL for variants unknown to it. */ 888 if (!prog_type_str) 889 break; 890 891 probe_prog_type(prog_type, prog_type_str, supported_types, define_prefix, 892 ifindex); 893 } 894 895 print_end_section(); 896 } 897 898 static void section_map_types(const char *define_prefix, __u32 ifindex) 899 { 900 unsigned int map_type = BPF_MAP_TYPE_UNSPEC; 901 const char *map_type_str; 902 903 print_start_section("map_types", 904 "Scanning eBPF map types...", 905 "/*** eBPF map types ***/", 906 define_prefix); 907 908 while (true) { 909 map_type++; 910 map_type_str = libbpf_bpf_map_type_str(map_type); 911 /* libbpf will return NULL for variants unknown to it. */ 912 if (!map_type_str) 913 break; 914 915 probe_map_type(map_type, map_type_str, define_prefix, ifindex); 916 } 917 918 print_end_section(); 919 } 920 921 static void 922 section_helpers(bool *supported_types, const char *define_prefix, __u32 ifindex) 923 { 924 unsigned int prog_type = BPF_PROG_TYPE_UNSPEC; 925 const char *prog_type_str; 926 927 print_start_section("helpers", 928 "Scanning eBPF helper functions...", 929 "/*** eBPF helper functions ***/", 930 define_prefix); 931 932 if (define_prefix) 933 printf("/*\n" 934 " * Use %sHAVE_PROG_TYPE_HELPER(prog_type_name, helper_name)\n" 935 " * to determine if <helper_name> is available for <prog_type_name>,\n" 936 " * e.g.\n" 937 " * #if %sHAVE_PROG_TYPE_HELPER(xdp, bpf_redirect)\n" 938 " * // do stuff with this helper\n" 939 " * #elif\n" 940 " * // use a workaround\n" 941 " * #endif\n" 942 " */\n" 943 "#define %sHAVE_PROG_TYPE_HELPER(prog_type, helper) \\\n" 944 " %sBPF__PROG_TYPE_ ## prog_type ## __HELPER_ ## helper\n", 945 define_prefix, define_prefix, define_prefix, 946 define_prefix); 947 while (true) { 948 prog_type++; 949 prog_type_str = libbpf_bpf_prog_type_str(prog_type); 950 /* libbpf will return NULL for variants unknown to it. */ 951 if (!prog_type_str) 952 break; 953 954 probe_helpers_for_progtype(prog_type, prog_type_str, 955 supported_types[prog_type], 956 define_prefix, 957 ifindex); 958 } 959 960 print_end_section(); 961 } 962 963 static void section_misc(const char *define_prefix, __u32 ifindex) 964 { 965 print_start_section("misc", 966 "Scanning miscellaneous eBPF features...", 967 "/*** eBPF misc features ***/", 968 define_prefix); 969 probe_large_insn_limit(define_prefix, ifindex); 970 probe_bounded_loops(define_prefix, ifindex); 971 probe_v2_isa_extension(define_prefix, ifindex); 972 probe_v3_isa_extension(define_prefix, ifindex); 973 probe_v4_isa_extension(define_prefix, ifindex); 974 print_end_section(); 975 } 976 977 #ifdef USE_LIBCAP 978 #define capability(c) { c, false, #c } 979 #define capability_msg(a, i) a[i].set ? "" : a[i].name, a[i].set ? "" : ", " 980 #endif 981 982 static int handle_perms(void) 983 { 984 #ifdef USE_LIBCAP 985 struct { 986 cap_value_t cap; 987 bool set; 988 char name[14]; /* strlen("CAP_SYS_ADMIN") */ 989 } bpf_caps[] = { 990 capability(CAP_SYS_ADMIN), 991 #ifdef CAP_BPF 992 capability(CAP_BPF), 993 capability(CAP_NET_ADMIN), 994 capability(CAP_PERFMON), 995 #endif 996 }; 997 cap_value_t cap_list[ARRAY_SIZE(bpf_caps)]; 998 unsigned int i, nb_bpf_caps = 0; 999 bool cap_sys_admin_only = true; 1000 cap_flag_value_t val; 1001 int res = -1; 1002 cap_t caps; 1003 1004 caps = cap_get_proc(); 1005 if (!caps) { 1006 p_err("failed to get capabilities for process: %s", 1007 strerror(errno)); 1008 return -1; 1009 } 1010 1011 #ifdef CAP_BPF 1012 if (CAP_IS_SUPPORTED(CAP_BPF)) 1013 cap_sys_admin_only = false; 1014 #endif 1015 1016 for (i = 0; i < ARRAY_SIZE(bpf_caps); i++) { 1017 const char *cap_name = bpf_caps[i].name; 1018 cap_value_t cap = bpf_caps[i].cap; 1019 1020 if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &val)) { 1021 p_err("bug: failed to retrieve %s status: %s", cap_name, 1022 strerror(errno)); 1023 goto exit_free; 1024 } 1025 1026 if (val == CAP_SET) { 1027 bpf_caps[i].set = true; 1028 cap_list[nb_bpf_caps++] = cap; 1029 } 1030 1031 if (cap_sys_admin_only) 1032 /* System does not know about CAP_BPF, meaning that 1033 * CAP_SYS_ADMIN is the only capability required. We 1034 * just checked it, break. 1035 */ 1036 break; 1037 } 1038 1039 if ((run_as_unprivileged && !nb_bpf_caps) || 1040 (!run_as_unprivileged && nb_bpf_caps == ARRAY_SIZE(bpf_caps)) || 1041 (!run_as_unprivileged && cap_sys_admin_only && nb_bpf_caps)) { 1042 /* We are all good, exit now */ 1043 res = 0; 1044 goto exit_free; 1045 } 1046 1047 if (!run_as_unprivileged) { 1048 if (cap_sys_admin_only) 1049 p_err("missing %s, required for full feature probing; run as root or use 'unprivileged'", 1050 bpf_caps[0].name); 1051 else 1052 p_err("missing %s%s%s%s%s%s%s%srequired for full feature probing; run as root or use 'unprivileged'", 1053 capability_msg(bpf_caps, 0), 1054 #ifdef CAP_BPF 1055 capability_msg(bpf_caps, 1), 1056 capability_msg(bpf_caps, 2), 1057 capability_msg(bpf_caps, 3) 1058 #else 1059 "", "", "", "", "", "" 1060 #endif /* CAP_BPF */ 1061 ); 1062 goto exit_free; 1063 } 1064 1065 /* if (run_as_unprivileged && nb_bpf_caps > 0), drop capabilities. */ 1066 if (cap_set_flag(caps, CAP_EFFECTIVE, nb_bpf_caps, cap_list, 1067 CAP_CLEAR)) { 1068 p_err("bug: failed to clear capabilities: %s", strerror(errno)); 1069 goto exit_free; 1070 } 1071 1072 if (cap_set_proc(caps)) { 1073 p_err("failed to drop capabilities: %s", strerror(errno)); 1074 goto exit_free; 1075 } 1076 1077 res = 0; 1078 1079 exit_free: 1080 if (cap_free(caps) && !res) { 1081 p_err("failed to clear storage object for capabilities: %s", 1082 strerror(errno)); 1083 res = -1; 1084 } 1085 1086 return res; 1087 #else 1088 /* Detection assumes user has specific privileges. 1089 * We do not use libcap so let's approximate, and restrict usage to 1090 * root user only. 1091 */ 1092 if (geteuid()) { 1093 p_err("full feature probing requires root privileges"); 1094 return -1; 1095 } 1096 1097 return 0; 1098 #endif /* USE_LIBCAP */ 1099 } 1100 1101 static int do_probe(int argc, char **argv) 1102 { 1103 enum probe_component target = COMPONENT_UNSPEC; 1104 const char *define_prefix = NULL; 1105 bool supported_types[128] = {}; 1106 __u32 ifindex = 0; 1107 char *ifname; 1108 1109 set_max_rlimit(); 1110 1111 while (argc) { 1112 if (is_prefix(*argv, "kernel")) { 1113 if (target != COMPONENT_UNSPEC) { 1114 p_err("component to probe already specified"); 1115 return -1; 1116 } 1117 target = COMPONENT_KERNEL; 1118 NEXT_ARG(); 1119 } else if (is_prefix(*argv, "dev")) { 1120 NEXT_ARG(); 1121 1122 if (target != COMPONENT_UNSPEC || ifindex) { 1123 p_err("component to probe already specified"); 1124 return -1; 1125 } 1126 if (!REQ_ARGS(1)) 1127 return -1; 1128 1129 target = COMPONENT_DEVICE; 1130 ifname = GET_ARG(); 1131 ifindex = if_nametoindex(ifname); 1132 if (!ifindex) { 1133 p_err("unrecognized netdevice '%s': %s", ifname, 1134 strerror(errno)); 1135 return -1; 1136 } 1137 } else if (is_prefix(*argv, "full")) { 1138 full_mode = true; 1139 NEXT_ARG(); 1140 } else if (is_prefix(*argv, "macros") && !define_prefix) { 1141 define_prefix = ""; 1142 NEXT_ARG(); 1143 } else if (is_prefix(*argv, "prefix")) { 1144 if (!define_prefix) { 1145 p_err("'prefix' argument can only be use after 'macros'"); 1146 return -1; 1147 } 1148 if (strcmp(define_prefix, "")) { 1149 p_err("'prefix' already defined"); 1150 return -1; 1151 } 1152 NEXT_ARG(); 1153 1154 if (!REQ_ARGS(1)) 1155 return -1; 1156 define_prefix = GET_ARG(); 1157 } else if (is_prefix(*argv, "unprivileged")) { 1158 #ifdef USE_LIBCAP 1159 run_as_unprivileged = true; 1160 NEXT_ARG(); 1161 #else 1162 p_err("unprivileged run not supported, recompile bpftool with libcap"); 1163 return -1; 1164 #endif 1165 } else { 1166 p_err("expected no more arguments, 'kernel', 'dev', 'macros' or 'prefix', got: '%s'?", 1167 *argv); 1168 return -1; 1169 } 1170 } 1171 1172 /* Full feature detection requires specific privileges. 1173 * Let's approximate, and warn if user is not root. 1174 */ 1175 if (handle_perms()) 1176 return -1; 1177 1178 if (json_output) { 1179 define_prefix = NULL; 1180 jsonw_start_object(json_wtr); 1181 } 1182 1183 section_system_config(target, define_prefix); 1184 if (!section_syscall_config(define_prefix)) 1185 /* bpf() syscall unavailable, don't probe other BPF features */ 1186 goto exit_close_json; 1187 section_program_types(supported_types, define_prefix, ifindex); 1188 section_map_types(define_prefix, ifindex); 1189 section_helpers(supported_types, define_prefix, ifindex); 1190 section_misc(define_prefix, ifindex); 1191 1192 exit_close_json: 1193 if (json_output) 1194 /* End root object */ 1195 jsonw_end_object(json_wtr); 1196 1197 return 0; 1198 } 1199 1200 static const char *get_helper_name(unsigned int id) 1201 { 1202 if (id >= ARRAY_SIZE(helper_name)) 1203 return NULL; 1204 1205 return helper_name[id]; 1206 } 1207 1208 static int do_list_builtins(int argc, char **argv) 1209 { 1210 const char *(*get_name)(unsigned int id); 1211 unsigned int id = 0; 1212 1213 if (argc < 1) 1214 usage(); 1215 1216 if (is_prefix(*argv, "prog_types")) { 1217 get_name = (const char *(*)(unsigned int))libbpf_bpf_prog_type_str; 1218 } else if (is_prefix(*argv, "map_types")) { 1219 get_name = (const char *(*)(unsigned int))libbpf_bpf_map_type_str; 1220 } else if (is_prefix(*argv, "attach_types")) { 1221 get_name = (const char *(*)(unsigned int))libbpf_bpf_attach_type_str; 1222 } else if (is_prefix(*argv, "link_types")) { 1223 get_name = (const char *(*)(unsigned int))libbpf_bpf_link_type_str; 1224 } else if (is_prefix(*argv, "helpers")) { 1225 get_name = get_helper_name; 1226 } else { 1227 p_err("expected 'prog_types', 'map_types', 'attach_types', 'link_types' or 'helpers', got: %s", *argv); 1228 return -1; 1229 } 1230 1231 if (json_output) 1232 jsonw_start_array(json_wtr); /* root array */ 1233 1234 while (true) { 1235 const char *name; 1236 1237 name = get_name(id++); 1238 if (!name) 1239 break; 1240 if (json_output) 1241 jsonw_string(json_wtr, name); 1242 else 1243 printf("%s\n", name); 1244 } 1245 1246 if (json_output) 1247 jsonw_end_array(json_wtr); /* root array */ 1248 1249 return 0; 1250 } 1251 1252 static int do_help(int argc, char **argv) 1253 { 1254 if (json_output) { 1255 jsonw_null(json_wtr); 1256 return 0; 1257 } 1258 1259 fprintf(stderr, 1260 "Usage: %1$s %2$s probe [COMPONENT] [full] [unprivileged] [macros [prefix PREFIX]]\n" 1261 " %1$s %2$s list_builtins GROUP\n" 1262 " %1$s %2$s help\n" 1263 "\n" 1264 " COMPONENT := { kernel | dev NAME }\n" 1265 " GROUP := { prog_types | map_types | attach_types | link_types | helpers }\n" 1266 " " HELP_SPEC_OPTIONS " }\n" 1267 "", 1268 bin_name, argv[-2]); 1269 1270 return 0; 1271 } 1272 1273 static const struct cmd cmds[] = { 1274 { "probe", do_probe }, 1275 { "list_builtins", do_list_builtins }, 1276 { "help", do_help }, 1277 { 0 } 1278 }; 1279 1280 int do_feature(int argc, char **argv) 1281 { 1282 return cmd_select(cmds, argc, argv, do_help); 1283 } 1284