projects/linux·blob master · refs

1286 lines · 30.4 KiB

1// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
2/* Copyright (c) 2019 Netronome Systems, Inc. */
3
4#include <ctype.h>
5#include <errno.h>
6#include <fcntl.h>
7#include <string.h>
8#include <unistd.h>
9#include <net/if.h>
10#ifdef USE_LIBCAP
11#include <sys/capability.h>
12#endif
13#include <sys/vfs.h>
14
15#include <linux/filter.h>
16#include <linux/limits.h>
17
18#include <bpf/bpf.h>
19#include <bpf/libbpf.h>
20
21#include "main.h"
22
23#ifndef PROC_SUPER_MAGIC
24# define PROC_SUPER_MAGIC 0x9fa0
25#endif
26
27enum probe_component {
28 COMPONENT_UNSPEC,
29 COMPONENT_KERNEL,
30 COMPONENT_DEVICE,
31};
32
33#define BPF_HELPER_MAKE_ENTRY(name) [BPF_FUNC_ ## name] = "bpf_" # name
34static const char * const helper_name[] = {
35 __BPF_FUNC_MAPPER(BPF_HELPER_MAKE_ENTRY)
36};
37
38#undef BPF_HELPER_MAKE_ENTRY
39
40static bool full_mode;
41#ifdef USE_LIBCAP
42static bool run_as_unprivileged;
43#endif
44
45/* Miscellaneous utility functions */
46
47static bool grep(const char *buffer, const char *pattern)
48{
49 return !!strstr(buffer, pattern);
50}
51
52static bool check_procfs(void)
53{
54 struct statfs st_fs;
55
56 if (statfs("/proc", &st_fs) < 0)
57 return false;
58 if ((unsigned long)st_fs.f_type != PROC_SUPER_MAGIC)
59 return false;
60
61 return true;
62}
63
64static void uppercase(char *str, size_t len)
65{
66 size_t i;
67
68 for (i = 0; i < len && str[i] != '\0'; i++)
69 str[i] = toupper(str[i]);
70}
71
72/* Printing utility functions */
73
74static void
75print_bool_feature(const char *feat_name, const char *plain_name,
76 const char *define_name, bool res, const char *define_prefix)
77{
78 if (json_output)
79 jsonw_bool_field(json_wtr, feat_name, res);
80 else if (define_prefix)
81 printf("#define %s%sHAVE_%s\n", define_prefix,
82 res ? "" : "NO_", define_name);
83 else
84 printf("%s is %savailable\n", plain_name, res ? "" : "NOT ");
85}
86
87static void print_kernel_option(const char *name, const char *value,
88 const char *define_prefix)
89{
90 char *endptr;
91 int res;
92
93 if (json_output) {
94 if (!value) {
95 jsonw_null_field(json_wtr, name);
96 return;
97 }
98 errno = 0;
99 res = strtol(value, &endptr, 0);
100 if (!errno && *endptr == '\n')
101 jsonw_int_field(json_wtr, name, res);
102 else
103 jsonw_string_field(json_wtr, name, value);
104 } else if (define_prefix) {
105 if (value)
106 printf("#define %s%s %s\n", define_prefix,
107 name, value);
108 else
109 printf("/* %s%s is not set */\n", define_prefix, name);
110 } else {
111 if (value)
112 printf("%s is set to %s\n", name, value);
113 else
114 printf("%s is not set\n", name);
115 }
116}
117
118static void
119print_start_section(const char *json_title, const char *plain_title,
120 const char *define_comment, const char *define_prefix)
121{
122 if (json_output) {
123 jsonw_name(json_wtr, json_title);
124 jsonw_start_object(json_wtr);
125 } else if (define_prefix) {
126 printf("%s\n", define_comment);
127 } else {
128 printf("%s\n", plain_title);
129 }
130}
131
132static void print_end_section(void)
133{
134 if (json_output)
135 jsonw_end_object(json_wtr);
136 else
137 printf("\n");
138}
139
140/* Probing functions */
141
142static int get_vendor_id(int ifindex)
143{
144 char ifname[IF_NAMESIZE], path[64], buf[8];
145 ssize_t len;
146 int fd;
147
148 if (!if_indextoname(ifindex, ifname))
149 return -1;
150
151 snprintf(path, sizeof(path), "/sys/class/net/%s/device/vendor", ifname);
152
153 fd = open(path, O_RDONLY | O_CLOEXEC);
154 if (fd < 0)
155 return -1;
156
157 len = read(fd, buf, sizeof(buf));
158 close(fd);
159 if (len < 0)
160 return -1;
161 if (len >= (ssize_t)sizeof(buf))
162 return -1;
163 buf[len] = '\0';
164
165 return strtol(buf, NULL, 0);
166}
167
168static long read_procfs(const char *path)
169{
170 char *endptr, *line = NULL;
171 size_t len = 0;
172 FILE *fd;
173 long res;
174
175 fd = fopen(path, "r");
176 if (!fd)
177 return -1;
178
179 res = getline(&line, &len, fd);
180 fclose(fd);
181 if (res < 0)
182 return -1;
183
184 errno = 0;
185 res = strtol(line, &endptr, 10);
186 if (errno || *line == '\0' || *endptr != '\n')
187 res = -1;
188 free(line);
189
190 return res;
191}
192
193static void probe_unprivileged_disabled(void)
194{
195 long res;
196
197 /* No support for C-style output */
198
199 res = read_procfs("/proc/sys/kernel/unprivileged_bpf_disabled");
200 if (json_output) {
201 jsonw_int_field(json_wtr, "unprivileged_bpf_disabled", res);
202 } else {
203 switch (res) {
204 case 0:
205 printf("bpf() syscall for unprivileged users is enabled\n");
206 break;
207 case 1:
208 printf("bpf() syscall restricted to privileged users (without recovery)\n");
209 break;
210 case 2:
211 printf("bpf() syscall restricted to privileged users (admin can change)\n");
212 break;
213 case -1:
214 printf("Unable to retrieve required privileges for bpf() syscall\n");
215 break;
216 default:
217 printf("bpf() syscall restriction has unknown value %ld\n", res);
218 }
219 }
220}
221
222static void probe_jit_enable(void)
223{
224 long res;
225
226 /* No support for C-style output */
227
228 res = read_procfs("/proc/sys/net/core/bpf_jit_enable");
229 if (json_output) {
230 jsonw_int_field(json_wtr, "bpf_jit_enable", res);
231 } else {
232 switch (res) {
233 case 0:
234 printf("JIT compiler is disabled\n");
235 break;
236 case 1:
237 printf("JIT compiler is enabled\n");
238 break;
239 case 2:
240 printf("JIT compiler is enabled with debugging traces in kernel logs\n");
241 break;
242 case -1:
243 printf("Unable to retrieve JIT-compiler status\n");
244 break;
245 default:
246 printf("JIT-compiler status has unknown value %ld\n",
247 res);
248 }
249 }
250}
251
252static void probe_jit_harden(void)
253{
254 long res;
255
256 /* No support for C-style output */
257
258 res = read_procfs("/proc/sys/net/core/bpf_jit_harden");
259 if (json_output) {
260 jsonw_int_field(json_wtr, "bpf_jit_harden", res);
261 } else {
262 switch (res) {
263 case 0:
264 printf("JIT compiler hardening is disabled\n");
265 break;
266 case 1:
267 printf("JIT compiler hardening is enabled for unprivileged users\n");
268 break;
269 case 2:
270 printf("JIT compiler hardening is enabled for all users\n");
271 break;
272 case -1:
273 printf("Unable to retrieve JIT hardening status\n");
274 break;
275 default:
276 printf("JIT hardening status has unknown value %ld\n",
277 res);
278 }
279 }
280}
281
282static void probe_jit_kallsyms(void)
283{
284 long res;
285
286 /* No support for C-style output */
287
288 res = read_procfs("/proc/sys/net/core/bpf_jit_kallsyms");
289 if (json_output) {
290 jsonw_int_field(json_wtr, "bpf_jit_kallsyms", res);
291 } else {
292 switch (res) {
293 case 0:
294 printf("JIT compiler kallsyms exports are disabled\n");
295 break;
296 case 1:
297 printf("JIT compiler kallsyms exports are enabled for root\n");
298 break;
299 case -1:
300 printf("Unable to retrieve JIT kallsyms export status\n");
301 break;
302 default:
303 printf("JIT kallsyms exports status has unknown value %ld\n", res);
304 }
305 }
306}
307
308static void probe_jit_limit(void)
309{
310 long res;
311
312 /* No support for C-style output */
313
314 res = read_procfs("/proc/sys/net/core/bpf_jit_limit");
315 if (json_output) {
316 jsonw_int_field(json_wtr, "bpf_jit_limit", res);
317 } else {
318 switch (res) {
319 case -1:
320 printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n");
321 break;
322 default:
323 printf("Global memory limit for JIT compiler for unprivileged users is %ld bytes\n", res);
324 }
325 }
326}
327
328static void probe_kernel_image_config(const char *define_prefix)
329{
330 struct kernel_config_option options[] = {
331 /* Enable BPF */
332 { "CONFIG_BPF", },
333 /* Enable bpf() syscall */
334 { "CONFIG_BPF_SYSCALL", },
335 /* Does selected architecture support eBPF JIT compiler */
336 { "CONFIG_HAVE_EBPF_JIT", },
337 /* Compile eBPF JIT compiler */
338 { "CONFIG_BPF_JIT", },
339 /* Avoid compiling eBPF interpreter (use JIT only) */
340 { "CONFIG_BPF_JIT_ALWAYS_ON", },
341 /* Kernel BTF debug information available */
342 { "CONFIG_DEBUG_INFO_BTF", },
343 /* Kernel module BTF debug information available */
344 { "CONFIG_DEBUG_INFO_BTF_MODULES", },
345
346 /* cgroups */
347 { "CONFIG_CGROUPS", },
348 /* BPF programs attached to cgroups */
349 { "CONFIG_CGROUP_BPF", },
350 /* bpf_get_cgroup_classid() helper */
351 { "CONFIG_CGROUP_NET_CLASSID", },
352 /* bpf_skb_{,ancestor_}cgroup_id() helpers */
353 { "CONFIG_SOCK_CGROUP_DATA", },
354
355 /* Tracing: attach BPF to kprobes, tracepoints, etc. */
356 { "CONFIG_BPF_EVENTS", },
357 /* Kprobes */
358 { "CONFIG_KPROBE_EVENTS", },
359 /* Uprobes */
360 { "CONFIG_UPROBE_EVENTS", },
361 /* Tracepoints */
362 { "CONFIG_TRACING", },
363 /* Syscall tracepoints */
364 { "CONFIG_FTRACE_SYSCALLS", },
365 /* bpf_override_return() helper support for selected arch */
366 { "CONFIG_FUNCTION_ERROR_INJECTION", },
367 /* bpf_override_return() helper */
368 { "CONFIG_BPF_KPROBE_OVERRIDE", },
369
370 /* Network */
371 { "CONFIG_NET", },
372 /* AF_XDP sockets */
373 { "CONFIG_XDP_SOCKETS", },
374 /* BPF_PROG_TYPE_LWT_* and related helpers */
375 { "CONFIG_LWTUNNEL_BPF", },
376 /* BPF_PROG_TYPE_SCHED_ACT, TC (traffic control) actions */
377 { "CONFIG_NET_ACT_BPF", },
378 /* BPF_PROG_TYPE_SCHED_CLS, TC filters */
379 { "CONFIG_NET_CLS_BPF", },
380 /* TC clsact qdisc */
381 { "CONFIG_NET_CLS_ACT", },
382 /* Ingress filtering with TC */
383 { "CONFIG_NET_SCH_INGRESS", },
384 /* bpf_skb_get_xfrm_state() helper */
385 { "CONFIG_XFRM", },
386 /* bpf_get_route_realm() helper */
387 { "CONFIG_IP_ROUTE_CLASSID", },
388 /* BPF_PROG_TYPE_LWT_SEG6_LOCAL and related helpers */
389 { "CONFIG_IPV6_SEG6_BPF", },
390 /* BPF_PROG_TYPE_LIRC_MODE2 and related helpers */
391 { "CONFIG_BPF_LIRC_MODE2", },
392 /* BPF stream parser and BPF socket maps */
393 { "CONFIG_BPF_STREAM_PARSER", },
394 /* xt_bpf module for passing BPF programs to netfilter */
395 { "CONFIG_NETFILTER_XT_MATCH_BPF", },
396
397 /* test_bpf module for BPF tests */
398 { "CONFIG_TEST_BPF", },
399
400 /* Misc configs useful in BPF C programs */
401 /* jiffies <-> sec conversion for bpf_jiffies64() helper */
402 { "CONFIG_HZ", true, }
403 };
404 char *values[ARRAY_SIZE(options)] = { };
405 size_t i;
406
407 if (read_kernel_config(options, ARRAY_SIZE(options), values,
408 define_prefix))
409 return;
410
411 for (i = 0; i < ARRAY_SIZE(options); i++) {
412 if (define_prefix && !options[i].macro_dump)
413 continue;
414 print_kernel_option(options[i].name, values[i], define_prefix);
415 free(values[i]);
416 }
417}
418
419static bool probe_bpf_syscall(const char *define_prefix)
420{
421 bool res;
422
423 bpf_prog_load(BPF_PROG_TYPE_UNSPEC, NULL, NULL, NULL, 0, NULL);
424 res = (errno != ENOSYS);
425
426 print_bool_feature("have_bpf_syscall",
427 "bpf() syscall",
428 "BPF_SYSCALL",
429 res, define_prefix);
430
431 return res;
432}
433
434static bool
435probe_prog_load_ifindex(enum bpf_prog_type prog_type,
436 const struct bpf_insn *insns, size_t insns_cnt,
437 char *log_buf, size_t log_buf_sz,
438 __u32 ifindex)
439{
440 LIBBPF_OPTS(bpf_prog_load_opts, opts,
441 .log_buf = log_buf,
442 .log_size = log_buf_sz,
443 .log_level = log_buf ? 1 : 0,
444 .prog_ifindex = ifindex,
445 );
446 int fd;
447
448 errno = 0;
449 fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts);
450 if (fd >= 0)
451 close(fd);
452
453 return fd >= 0 && errno != EINVAL && errno != EOPNOTSUPP;
454}
455
456static bool probe_prog_type_ifindex(enum bpf_prog_type prog_type, __u32 ifindex)
457{
458 /* nfp returns -EINVAL on exit(0) with TC offload */
459 struct bpf_insn insns[2] = {
460 BPF_MOV64_IMM(BPF_REG_0, 2),
461 BPF_EXIT_INSN()
462 };
463
464 return probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns),
465 NULL, 0, ifindex);
466}
467
468static void
469probe_prog_type(enum bpf_prog_type prog_type, const char *prog_type_str,
470 bool *supported_types, const char *define_prefix, __u32 ifindex)
471{
472 char feat_name[128], plain_desc[128], define_name[128];
473 const char *plain_comment = "eBPF program_type ";
474 size_t maxlen;
475 bool res;
476
477 if (ifindex) {
478 switch (prog_type) {
479 case BPF_PROG_TYPE_SCHED_CLS:
480 case BPF_PROG_TYPE_XDP:
481 break;
482 default:
483 return;
484 }
485
486 res = probe_prog_type_ifindex(prog_type, ifindex);
487 } else {
488 res = libbpf_probe_bpf_prog_type(prog_type, NULL) > 0;
489 }
490
491#ifdef USE_LIBCAP
492 /* Probe may succeed even if program load fails, for unprivileged users
493 * check that we did not fail because of insufficient permissions
494 */
495 if (run_as_unprivileged && errno == EPERM)
496 res = false;
497#endif
498
499 supported_types[prog_type] |= res;
500
501 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1;
502 if (strlen(prog_type_str) > maxlen) {
503 p_info("program type name too long");
504 return;
505 }
506
507 sprintf(feat_name, "have_%s_prog_type", prog_type_str);
508 sprintf(define_name, "%s_prog_type", prog_type_str);
509 uppercase(define_name, sizeof(define_name));
510 sprintf(plain_desc, "%s%s", plain_comment, prog_type_str);
511 print_bool_feature(feat_name, plain_desc, define_name, res,
512 define_prefix);
513}
514
515static bool probe_map_type_ifindex(enum bpf_map_type map_type, __u32 ifindex)
516{
517 LIBBPF_OPTS(bpf_map_create_opts, opts);
518 int key_size, value_size, max_entries;
519 int fd;
520
521 opts.map_ifindex = ifindex;
522
523 key_size = sizeof(__u32);
524 value_size = sizeof(__u32);
525 max_entries = 1;
526
527 fd = bpf_map_create(map_type, NULL, key_size, value_size, max_entries,
528 &opts);
529 if (fd >= 0)
530 close(fd);
531
532 return fd >= 0;
533}
534
535static void
536probe_map_type(enum bpf_map_type map_type, char const *map_type_str,
537 const char *define_prefix, __u32 ifindex)
538{
539 char feat_name[128], plain_desc[128], define_name[128];
540 const char *plain_comment = "eBPF map_type ";
541 size_t maxlen;
542 bool res;
543
544 if (ifindex) {
545 switch (map_type) {
546 case BPF_MAP_TYPE_HASH:
547 case BPF_MAP_TYPE_ARRAY:
548 break;
549 default:
550 return;
551 }
552
553 res = probe_map_type_ifindex(map_type, ifindex);
554 } else {
555 res = libbpf_probe_bpf_map_type(map_type, NULL) > 0;
556 }
557
558 /* Probe result depends on the success of map creation, no additional
559 * check required for unprivileged users
560 */
561
562 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1;
563 if (strlen(map_type_str) > maxlen) {
564 p_info("map type name too long");
565 return;
566 }
567
568 sprintf(feat_name, "have_%s_map_type", map_type_str);
569 sprintf(define_name, "%s_map_type", map_type_str);
570 uppercase(define_name, sizeof(define_name));
571 sprintf(plain_desc, "%s%s", plain_comment, map_type_str);
572 print_bool_feature(feat_name, plain_desc, define_name, res,
573 define_prefix);
574}
575
576static bool
577probe_helper_ifindex(enum bpf_func_id id, enum bpf_prog_type prog_type,
578 __u32 ifindex)
579{
580 struct bpf_insn insns[2] = {
581 BPF_EMIT_CALL(id),
582 BPF_EXIT_INSN()
583 };
584 char buf[4096] = {};
585 bool res;
586
587 probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns), buf,
588 sizeof(buf), ifindex);
589 res = !grep(buf, "invalid func ") && !grep(buf, "unknown func ") &&
590 !grep(buf, "program of this type cannot use helper ");
591
592 switch (get_vendor_id(ifindex)) {
593 case 0x19ee: /* Netronome specific */
594 res = res && !grep(buf, "not supported by FW") &&
595 !grep(buf, "unsupported function id");
596 break;
597 default:
598 break;
599 }
600
601 return res;
602}
603
604static bool
605probe_helper_for_progtype(enum bpf_prog_type prog_type, bool supported_type,
606 const char *define_prefix, unsigned int id,
607 const char *ptype_name, __u32 ifindex)
608{
609 bool res = false;
610
611 if (supported_type) {
612 if (ifindex)
613 res = probe_helper_ifindex(id, prog_type, ifindex);
614 else
615 res = libbpf_probe_bpf_helper(prog_type, id, NULL) > 0;
616#ifdef USE_LIBCAP
617 /* Probe may succeed even if program load fails, for
618 * unprivileged users check that we did not fail because of
619 * insufficient permissions
620 */
621 if (run_as_unprivileged && errno == EPERM)
622 res = false;
623#endif
624 }
625
626 if (json_output) {
627 if (res)
628 jsonw_string(json_wtr, helper_name[id]);
629 } else if (define_prefix) {
630 printf("#define %sBPF__PROG_TYPE_%s__HELPER_%s %s\n",
631 define_prefix, ptype_name, helper_name[id],
632 res ? "1" : "0");
633 } else {
634 if (res)
635 printf("\n\t- %s", helper_name[id]);
636 }
637
638 return res;
639}
640
641static void
642probe_helpers_for_progtype(enum bpf_prog_type prog_type,
643 const char *prog_type_str, bool supported_type,
644 const char *define_prefix, __u32 ifindex)
645{
646 char feat_name[128];
647 unsigned int id;
648 bool probe_res = false;
649
650 if (ifindex)
651 /* Only test helpers for offload-able program types */
652 switch (prog_type) {
653 case BPF_PROG_TYPE_SCHED_CLS:
654 case BPF_PROG_TYPE_XDP:
655 break;
656 default:
657 return;
658 }
659
660 if (json_output) {
661 sprintf(feat_name, "%s_available_helpers", prog_type_str);
662 jsonw_name(json_wtr, feat_name);
663 jsonw_start_array(json_wtr);
664 } else if (!define_prefix) {
665 printf("eBPF helpers supported for program type %s:",
666 prog_type_str);
667 }
668
669 for (id = 1; id < ARRAY_SIZE(helper_name); id++) {
670 /* Skip helper functions which emit dmesg messages when not in
671 * the full mode.
672 */
673 switch (id) {
674 case BPF_FUNC_trace_printk:
675 case BPF_FUNC_trace_vprintk:
676 case BPF_FUNC_probe_write_user:
677 if (!full_mode)
678 continue;
679 fallthrough;
680 default:
681 probe_res |= probe_helper_for_progtype(prog_type, supported_type,
682 define_prefix, id, prog_type_str,
683 ifindex);
684 }
685 }
686
687 if (json_output)
688 jsonw_end_array(json_wtr);
689 else if (!define_prefix) {
690 printf("\n");
691 if (!probe_res) {
692 if (!supported_type)
693 printf("\tProgram type not supported\n");
694 else
695 printf("\tCould not determine which helpers are available\n");
696 }
697 }
698
699
700}
701
702static void
703probe_misc_feature(struct bpf_insn *insns, size_t len,
704 const char *define_prefix, __u32 ifindex,
705 const char *feat_name, const char *plain_name,
706 const char *define_name)
707{
708 LIBBPF_OPTS(bpf_prog_load_opts, opts,
709 .prog_ifindex = ifindex,
710 );
711 bool res;
712 int fd;
713
714 errno = 0;
715 fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL",
716 insns, len, &opts);
717 res = fd >= 0 || !errno;
718
719 if (fd >= 0)
720 close(fd);
721
722 print_bool_feature(feat_name, plain_name, define_name, res,
723 define_prefix);
724}
725
726/*
727 * Probe for availability of kernel commit (5.3):
728 *
729 * c04c0d2b968a ("bpf: increase complexity limit and maximum program size")
730 */
731static void probe_large_insn_limit(const char *define_prefix, __u32 ifindex)
732{
733 struct bpf_insn insns[BPF_MAXINSNS + 1];
734 int i;
735
736 for (i = 0; i < BPF_MAXINSNS; i++)
737 insns[i] = BPF_MOV64_IMM(BPF_REG_0, 1);
738 insns[BPF_MAXINSNS] = BPF_EXIT_INSN();
739
740 probe_misc_feature(insns, ARRAY_SIZE(insns),
741 define_prefix, ifindex,
742 "have_large_insn_limit",
743 "Large program size limit",
744 "LARGE_INSN_LIMIT");
745}
746
747/*
748 * Probe for bounded loop support introduced in commit 2589726d12a1
749 * ("bpf: introduce bounded loops").
750 */
751static void
752probe_bounded_loops(const char *define_prefix, __u32 ifindex)
753{
754 struct bpf_insn insns[4] = {
755 BPF_MOV64_IMM(BPF_REG_0, 10),
756 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 1),
757 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, -2),
758 BPF_EXIT_INSN()
759 };
760
761 probe_misc_feature(insns, ARRAY_SIZE(insns),
762 define_prefix, ifindex,
763 "have_bounded_loops",
764 "Bounded loop support",
765 "BOUNDED_LOOPS");
766}
767
768/*
769 * Probe for the v2 instruction set extension introduced in commit 92b31a9af73b
770 * ("bpf: add BPF_J{LT,LE,SLT,SLE} instructions").
771 */
772static void
773probe_v2_isa_extension(const char *define_prefix, __u32 ifindex)
774{
775 struct bpf_insn insns[4] = {
776 BPF_MOV64_IMM(BPF_REG_0, 0),
777 BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 0, 1),
778 BPF_MOV64_IMM(BPF_REG_0, 1),
779 BPF_EXIT_INSN()
780 };
781
782 probe_misc_feature(insns, ARRAY_SIZE(insns),
783 define_prefix, ifindex,
784 "have_v2_isa_extension",
785 "ISA extension v2",
786 "V2_ISA_EXTENSION");
787}
788
789/*
790 * Probe for the v3 instruction set extension introduced in commit 092ed0968bb6
791 * ("bpf: verifier support JMP32").
792 */
793static void
794probe_v3_isa_extension(const char *define_prefix, __u32 ifindex)
795{
796 struct bpf_insn insns[4] = {
797 BPF_MOV64_IMM(BPF_REG_0, 0),
798 BPF_JMP32_IMM(BPF_JLT, BPF_REG_0, 0, 1),
799 BPF_MOV64_IMM(BPF_REG_0, 1),
800 BPF_EXIT_INSN()
801 };
802
803 probe_misc_feature(insns, ARRAY_SIZE(insns),
804 define_prefix, ifindex,
805 "have_v3_isa_extension",
806 "ISA extension v3",
807 "V3_ISA_EXTENSION");
808}
809
810/*
811 * Probe for the v4 instruction set extension introduced in commit 1f9a1ea821ff
812 * ("bpf: Support new sign-extension load insns").
813 */
814static void
815probe_v4_isa_extension(const char *define_prefix, __u32 ifindex)
816{
817 struct bpf_insn insns[5] = {
818 BPF_MOV64_IMM(BPF_REG_0, 0),
819 BPF_JMP32_IMM(BPF_JEQ, BPF_REG_0, 1, 1),
820 BPF_JMP32_A(1),
821 BPF_MOV64_IMM(BPF_REG_0, 1),
822 BPF_EXIT_INSN()
823 };
824
825 probe_misc_feature(insns, ARRAY_SIZE(insns),
826 define_prefix, ifindex,
827 "have_v4_isa_extension",
828 "ISA extension v4",
829 "V4_ISA_EXTENSION");
830}
831
832static void
833section_system_config(enum probe_component target, const char *define_prefix)
834{
835 switch (target) {
836 case COMPONENT_KERNEL:
837 case COMPONENT_UNSPEC:
838 print_start_section("system_config",
839 "Scanning system configuration...",
840 "/*** Misc kernel config items ***/",
841 define_prefix);
842 if (!define_prefix) {
843 if (check_procfs()) {
844 probe_unprivileged_disabled();
845 probe_jit_enable();
846 probe_jit_harden();
847 probe_jit_kallsyms();
848 probe_jit_limit();
849 } else {
850 p_info("/* procfs not mounted, skipping related probes */");
851 }
852 }
853 probe_kernel_image_config(define_prefix);
854 print_end_section();
855 break;
856 default:
857 break;
858 }
859}
860
861static bool section_syscall_config(const char *define_prefix)
862{
863 bool res;
864
865 print_start_section("syscall_config",
866 "Scanning system call availability...",
867 "/*** System call availability ***/",
868 define_prefix);
869 res = probe_bpf_syscall(define_prefix);
870 print_end_section();
871
872 return res;
873}
874
875static void
876section_program_types(bool *supported_types, const char *define_prefix,
877 __u32 ifindex)
878{
879 unsigned int prog_type = BPF_PROG_TYPE_UNSPEC;
880 const char *prog_type_str;
881
882 print_start_section("program_types",
883 "Scanning eBPF program types...",
884 "/*** eBPF program types ***/",
885 define_prefix);
886
887 while (true) {
888 prog_type++;
889 prog_type_str = libbpf_bpf_prog_type_str(prog_type);
890 /* libbpf will return NULL for variants unknown to it. */
891 if (!prog_type_str)
892 break;
893
894 probe_prog_type(prog_type, prog_type_str, supported_types, define_prefix,
895 ifindex);
896 }
897
898 print_end_section();
899}
900
901static void section_map_types(const char *define_prefix, __u32 ifindex)
902{
903 unsigned int map_type = BPF_MAP_TYPE_UNSPEC;
904 const char *map_type_str;
905
906 print_start_section("map_types",
907 "Scanning eBPF map types...",
908 "/*** eBPF map types ***/",
909 define_prefix);
910
911 while (true) {
912 map_type++;
913 map_type_str = libbpf_bpf_map_type_str(map_type);
914 /* libbpf will return NULL for variants unknown to it. */
915 if (!map_type_str)
916 break;
917
918 probe_map_type(map_type, map_type_str, define_prefix, ifindex);
919 }
920
921 print_end_section();
922}
923
924static void
925section_helpers(bool *supported_types, const char *define_prefix, __u32 ifindex)
926{
927 unsigned int prog_type = BPF_PROG_TYPE_UNSPEC;
928 const char *prog_type_str;
929
930 print_start_section("helpers",
931 "Scanning eBPF helper functions...",
932 "/*** eBPF helper functions ***/",
933 define_prefix);
934
935 if (define_prefix)
936 printf("/*\n"
937 " * Use %sHAVE_PROG_TYPE_HELPER(prog_type_name, helper_name)\n"
938 " * to determine if <helper_name> is available for <prog_type_name>,\n"
939 " * e.g.\n"
940 " * #if %sHAVE_PROG_TYPE_HELPER(xdp, bpf_redirect)\n"
941 " * // do stuff with this helper\n"
942 " * #elif\n"
943 " * // use a workaround\n"
944 " * #endif\n"
945 " */\n"
946 "#define %sHAVE_PROG_TYPE_HELPER(prog_type, helper) \\\n"
947 " %sBPF__PROG_TYPE_ ## prog_type ## __HELPER_ ## helper\n",
948 define_prefix, define_prefix, define_prefix,
949 define_prefix);
950 while (true) {
951 prog_type++;
952 prog_type_str = libbpf_bpf_prog_type_str(prog_type);
953 /* libbpf will return NULL for variants unknown to it. */
954 if (!prog_type_str)
955 break;
956
957 probe_helpers_for_progtype(prog_type, prog_type_str,
958 supported_types[prog_type],
959 define_prefix,
960 ifindex);
961 }
962
963 print_end_section();
964}
965
966static void section_misc(const char *define_prefix, __u32 ifindex)
967{
968 print_start_section("misc",
969 "Scanning miscellaneous eBPF features...",
970 "/*** eBPF misc features ***/",
971 define_prefix);
972 probe_large_insn_limit(define_prefix, ifindex);
973 probe_bounded_loops(define_prefix, ifindex);
974 probe_v2_isa_extension(define_prefix, ifindex);
975 probe_v3_isa_extension(define_prefix, ifindex);
976 probe_v4_isa_extension(define_prefix, ifindex);
977 print_end_section();
978}
979
980#ifdef USE_LIBCAP
981#define capability(c) { c, false, #c }
982#define capability_msg(a, i) a[i].set ? "" : a[i].name, a[i].set ? "" : ", "
983#endif
984
985static int handle_perms(void)
986{
987#ifdef USE_LIBCAP
988 struct {
989 cap_value_t cap;
990 bool set;
991 char name[14]; /* strlen("CAP_SYS_ADMIN") */
992 } bpf_caps[] = {
993 capability(CAP_SYS_ADMIN),
994#ifdef CAP_BPF
995 capability(CAP_BPF),
996 capability(CAP_NET_ADMIN),
997 capability(CAP_PERFMON),
998#endif
999 };
1000 cap_value_t cap_list[ARRAY_SIZE(bpf_caps)];
1001 unsigned int i, nb_bpf_caps = 0;
1002 bool cap_sys_admin_only = true;
1003 cap_flag_value_t val;
1004 int res = -1;
1005 cap_t caps;
1006
1007 caps = cap_get_proc();
1008 if (!caps) {
1009 p_err("failed to get capabilities for process: %s",
1010 strerror(errno));
1011 return -1;
1012 }
1013
1014#ifdef CAP_BPF
1015 if (CAP_IS_SUPPORTED(CAP_BPF))
1016 cap_sys_admin_only = false;
1017#endif
1018
1019 for (i = 0; i < ARRAY_SIZE(bpf_caps); i++) {
1020 const char *cap_name = bpf_caps[i].name;
1021 cap_value_t cap = bpf_caps[i].cap;
1022
1023 if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &val)) {
1024 p_err("bug: failed to retrieve %s status: %s", cap_name,
1025 strerror(errno));
1026 goto exit_free;
1027 }
1028
1029 if (val == CAP_SET) {
1030 bpf_caps[i].set = true;
1031 cap_list[nb_bpf_caps++] = cap;
1032 }
1033
1034 if (cap_sys_admin_only)
1035 /* System does not know about CAP_BPF, meaning that
1036 * CAP_SYS_ADMIN is the only capability required. We
1037 * just checked it, break.
1038 */
1039 break;
1040 }
1041
1042 if ((run_as_unprivileged && !nb_bpf_caps) ||
1043 (!run_as_unprivileged && nb_bpf_caps == ARRAY_SIZE(bpf_caps)) ||
1044 (!run_as_unprivileged && cap_sys_admin_only && nb_bpf_caps)) {
1045 /* We are all good, exit now */
1046 res = 0;
1047 goto exit_free;
1048 }
1049
1050 if (!run_as_unprivileged) {
1051 if (cap_sys_admin_only)
1052 p_err("missing %s, required for full feature probing; run as root or use 'unprivileged'",
1053 bpf_caps[0].name);
1054 else
1055 p_err("missing %s%s%s%s%s%s%s%srequired for full feature probing; run as root or use 'unprivileged'",
1056 capability_msg(bpf_caps, 0),
1057#ifdef CAP_BPF
1058 capability_msg(bpf_caps, 1),
1059 capability_msg(bpf_caps, 2),
1060 capability_msg(bpf_caps, 3)
1061#else
1062 "", "", "", "", "", ""
1063#endif /* CAP_BPF */
1064 );
1065 goto exit_free;
1066 }
1067
1068 /* if (run_as_unprivileged && nb_bpf_caps > 0), drop capabilities. */
1069 if (cap_set_flag(caps, CAP_EFFECTIVE, nb_bpf_caps, cap_list,
1070 CAP_CLEAR)) {
1071 p_err("bug: failed to clear capabilities: %s", strerror(errno));
1072 goto exit_free;
1073 }
1074
1075 if (cap_set_proc(caps)) {
1076 p_err("failed to drop capabilities: %s", strerror(errno));
1077 goto exit_free;
1078 }
1079
1080 res = 0;
1081
1082exit_free:
1083 if (cap_free(caps) && !res) {
1084 p_err("failed to clear storage object for capabilities: %s",
1085 strerror(errno));
1086 res = -1;
1087 }
1088
1089 return res;
1090#else
1091 /* Detection assumes user has specific privileges.
1092 * We do not use libcap so let's approximate, and restrict usage to
1093 * root user only.
1094 */
1095 if (geteuid()) {
1096 p_err("full feature probing requires root privileges");
1097 return -1;
1098 }
1099
1100 return 0;
1101#endif /* USE_LIBCAP */
1102}
1103
1104static int do_probe(int argc, char **argv)
1105{
1106 enum probe_component target = COMPONENT_UNSPEC;
1107 const char *define_prefix = NULL;
1108 bool supported_types[128] = {};
1109 __u32 ifindex = 0;
1110 char *ifname;
1111
1112 set_max_rlimit();
1113
1114 while (argc) {
1115 if (is_prefix(*argv, "kernel")) {
1116 if (target != COMPONENT_UNSPEC) {
1117 p_err("component to probe already specified");
1118 return -1;
1119 }
1120 target = COMPONENT_KERNEL;
1121 NEXT_ARG();
1122 } else if (is_prefix(*argv, "dev")) {
1123 NEXT_ARG();
1124
1125 if (target != COMPONENT_UNSPEC || ifindex) {
1126 p_err("component to probe already specified");
1127 return -1;
1128 }
1129 if (!REQ_ARGS(1))
1130 return -1;
1131
1132 target = COMPONENT_DEVICE;
1133 ifname = GET_ARG();
1134 ifindex = if_nametoindex(ifname);
1135 if (!ifindex) {
1136 p_err("unrecognized netdevice '%s': %s", ifname,
1137 strerror(errno));
1138 return -1;
1139 }
1140 } else if (is_prefix(*argv, "full")) {
1141 full_mode = true;
1142 NEXT_ARG();
1143 } else if (is_prefix(*argv, "macros") && !define_prefix) {
1144 define_prefix = "";
1145 NEXT_ARG();
1146 } else if (is_prefix(*argv, "prefix")) {
1147 if (!define_prefix) {
1148 p_err("'prefix' argument can only be use after 'macros'");
1149 return -1;
1150 }
1151 if (strcmp(define_prefix, "")) {
1152 p_err("'prefix' already defined");
1153 return -1;
1154 }
1155 NEXT_ARG();
1156
1157 if (!REQ_ARGS(1))
1158 return -1;
1159 define_prefix = GET_ARG();
1160 } else if (is_prefix(*argv, "unprivileged")) {
1161#ifdef USE_LIBCAP
1162 run_as_unprivileged = true;
1163 NEXT_ARG();
1164#else
1165 p_err("unprivileged run not supported, recompile bpftool with libcap");
1166 return -1;
1167#endif
1168 } else {
1169 p_err("expected no more arguments, 'kernel', 'dev', 'macros' or 'prefix', got: '%s'?",
1170 *argv);
1171 return -1;
1172 }
1173 }
1174
1175 /* Full feature detection requires specific privileges.
1176 * Let's approximate, and warn if user is not root.
1177 */
1178 if (handle_perms())
1179 return -1;
1180
1181 if (json_output) {
1182 define_prefix = NULL;
1183 jsonw_start_object(json_wtr);
1184 }
1185
1186 section_system_config(target, define_prefix);
1187 if (!section_syscall_config(define_prefix))
1188 /* bpf() syscall unavailable, don't probe other BPF features */
1189 goto exit_close_json;
1190 section_program_types(supported_types, define_prefix, ifindex);
1191 section_map_types(define_prefix, ifindex);
1192 section_helpers(supported_types, define_prefix, ifindex);
1193 section_misc(define_prefix, ifindex);
1194
1195exit_close_json:
1196 if (json_output)
1197 /* End root object */
1198 jsonw_end_object(json_wtr);
1199
1200 return 0;
1201}
1202
1203static const char *get_helper_name(unsigned int id)
1204{
1205 if (id >= ARRAY_SIZE(helper_name))
1206 return NULL;
1207
1208 return helper_name[id];
1209}
1210
1211static int do_list_builtins(int argc, char **argv)
1212{
1213 const char *(*get_name)(unsigned int id);
1214 unsigned int id = 0;
1215
1216 if (argc < 1)
1217 usage();
1218
1219 if (is_prefix(*argv, "prog_types")) {
1220 get_name = (const char *(*)(unsigned int))libbpf_bpf_prog_type_str;
1221 } else if (is_prefix(*argv, "map_types")) {
1222 get_name = (const char *(*)(unsigned int))libbpf_bpf_map_type_str;
1223 } else if (is_prefix(*argv, "attach_types")) {
1224 get_name = (const char *(*)(unsigned int))libbpf_bpf_attach_type_str;
1225 } else if (is_prefix(*argv, "link_types")) {
1226 get_name = (const char *(*)(unsigned int))libbpf_bpf_link_type_str;
1227 } else if (is_prefix(*argv, "helpers")) {
1228 get_name = get_helper_name;
1229 } else {
1230 p_err("expected 'prog_types', 'map_types', 'attach_types', 'link_types' or 'helpers', got: %s", *argv);
1231 return -1;
1232 }
1233
1234 if (json_output)
1235 jsonw_start_array(json_wtr); /* root array */
1236
1237 while (true) {
1238 const char *name;
1239
1240 name = get_name(id++);
1241 if (!name)
1242 break;
1243 if (json_output)
1244 jsonw_string(json_wtr, name);
1245 else
1246 printf("%s\n", name);
1247 }
1248
1249 if (json_output)
1250 jsonw_end_array(json_wtr); /* root array */
1251
1252 return 0;
1253}
1254
1255static int do_help(int argc, char **argv)
1256{
1257 if (json_output) {
1258 jsonw_null(json_wtr);
1259 return 0;
1260 }
1261
1262 fprintf(stderr,
1263 "Usage: %1$s %2$s probe [COMPONENT] [full] [unprivileged] [macros [prefix PREFIX]]\n"
1264 " %1$s %2$s list_builtins GROUP\n"
1265 " %1$s %2$s help\n"
1266 "\n"
1267 " COMPONENT := { kernel | dev NAME }\n"
1268 " GROUP := { prog_types | map_types | attach_types | link_types | helpers }\n"
1269 " " HELP_SPEC_OPTIONS " }\n"
1270 "",
1271 bin_name, argv[-2]);
1272
1273 return 0;
1274}
1275
1276static const struct cmd cmds[] = {
1277 { "probe", do_probe },
1278 { "list_builtins", do_list_builtins },
1279 { "help", do_help },
1280 { 0 }
1281};
1282
1283int do_feature(int argc, char **argv)
1284{
1285 return cmd_select(cmds, argc, argv, do_help);
1286}