1 // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) 2 /* Copyright (c) 2019 Netronome Systems, Inc. */ 3 4 #include <ctype.h> 5 #include <errno.h> 6 #include <fcntl.h> 7 #include <string.h> 8 #include <unistd.h> 9 #include <net/if.h> 10 #ifdef USE_LIBCAP 11 #include <sys/capability.h> 12 #endif 13 #include <sys/utsname.h> 14 #include <sys/vfs.h> 15 16 #include <linux/filter.h> 17 #include <linux/limits.h> 18 19 #include <bpf/bpf.h> 20 #include <bpf/libbpf.h> 21 #include <zlib.h> 22 23 #include "main.h" 24 25 #ifndef PROC_SUPER_MAGIC 26 # define PROC_SUPER_MAGIC 0x9fa0 27 #endif 28 29 enum probe_component { 30 COMPONENT_UNSPEC, 31 COMPONENT_KERNEL, 32 COMPONENT_DEVICE, 33 }; 34 35 #define BPF_HELPER_MAKE_ENTRY(name) [BPF_FUNC_ ## name] = "bpf_" # name 36 static const char * const helper_name[] = { 37 __BPF_FUNC_MAPPER(BPF_HELPER_MAKE_ENTRY) 38 }; 39 40 #undef BPF_HELPER_MAKE_ENTRY 41 42 static bool full_mode; 43 #ifdef USE_LIBCAP 44 static bool run_as_unprivileged; 45 #endif 46 47 /* Miscellaneous utility functions */ 48 49 static bool grep(const char *buffer, const char *pattern) 50 { 51 return !!strstr(buffer, pattern); 52 } 53 54 static bool check_procfs(void) 55 { 56 struct statfs st_fs; 57 58 if (statfs("/proc", &st_fs) < 0) 59 return false; 60 if ((unsigned long)st_fs.f_type != PROC_SUPER_MAGIC) 61 return false; 62 63 return true; 64 } 65 66 static void uppercase(char *str, size_t len) 67 { 68 size_t i; 69 70 for (i = 0; i < len && str[i] != '\0'; i++) 71 str[i] = toupper(str[i]); 72 } 73 74 /* Printing utility functions */ 75 76 static void 77 print_bool_feature(const char *feat_name, const char *plain_name, 78 const char *define_name, bool res, const char *define_prefix) 79 { 80 if (json_output) 81 jsonw_bool_field(json_wtr, feat_name, res); 82 else if (define_prefix) 83 printf("#define %s%sHAVE_%s\n", define_prefix, 84 res ? "" : "NO_", define_name); 85 else 86 printf("%s is %savailable\n", plain_name, res ? "" : "NOT "); 87 } 88 89 static void print_kernel_option(const char *name, const char *value, 90 const char *define_prefix) 91 { 92 char *endptr; 93 int res; 94 95 if (json_output) { 96 if (!value) { 97 jsonw_null_field(json_wtr, name); 98 return; 99 } 100 errno = 0; 101 res = strtol(value, &endptr, 0); 102 if (!errno && *endptr == '\n') 103 jsonw_int_field(json_wtr, name, res); 104 else 105 jsonw_string_field(json_wtr, name, value); 106 } else if (define_prefix) { 107 if (value) 108 printf("#define %s%s %s\n", define_prefix, 109 name, value); 110 else 111 printf("/* %s%s is not set */\n", define_prefix, name); 112 } else { 113 if (value) 114 printf("%s is set to %s\n", name, value); 115 else 116 printf("%s is not set\n", name); 117 } 118 } 119 120 static void 121 print_start_section(const char *json_title, const char *plain_title, 122 const char *define_comment, const char *define_prefix) 123 { 124 if (json_output) { 125 jsonw_name(json_wtr, json_title); 126 jsonw_start_object(json_wtr); 127 } else if (define_prefix) { 128 printf("%s\n", define_comment); 129 } else { 130 printf("%s\n", plain_title); 131 } 132 } 133 134 static void print_end_section(void) 135 { 136 if (json_output) 137 jsonw_end_object(json_wtr); 138 else 139 printf("\n"); 140 } 141 142 /* Probing functions */ 143 144 static int get_vendor_id(int ifindex) 145 { 146 char ifname[IF_NAMESIZE], path[64], buf[8]; 147 ssize_t len; 148 int fd; 149 150 if (!if_indextoname(ifindex, ifname)) 151 return -1; 152 153 snprintf(path, sizeof(path), "/sys/class/net/%s/device/vendor", ifname); 154 155 fd = open(path, O_RDONLY | O_CLOEXEC); 156 if (fd < 0) 157 return -1; 158 159 len = read(fd, buf, sizeof(buf)); 160 close(fd); 161 if (len < 0) 162 return -1; 163 if (len >= (ssize_t)sizeof(buf)) 164 return -1; 165 buf[len] = '\0'; 166 167 return strtol(buf, NULL, 0); 168 } 169 170 static int read_procfs(const char *path) 171 { 172 char *endptr, *line = NULL; 173 size_t len = 0; 174 FILE *fd; 175 int res; 176 177 fd = fopen(path, "r"); 178 if (!fd) 179 return -1; 180 181 res = getline(&line, &len, fd); 182 fclose(fd); 183 if (res < 0) 184 return -1; 185 186 errno = 0; 187 res = strtol(line, &endptr, 10); 188 if (errno || *line == '\0' || *endptr != '\n') 189 res = -1; 190 free(line); 191 192 return res; 193 } 194 195 static void probe_unprivileged_disabled(void) 196 { 197 int res; 198 199 /* No support for C-style ouptut */ 200 201 res = read_procfs("/proc/sys/kernel/unprivileged_bpf_disabled"); 202 if (json_output) { 203 jsonw_int_field(json_wtr, "unprivileged_bpf_disabled", res); 204 } else { 205 switch (res) { 206 case 0: 207 printf("bpf() syscall for unprivileged users is enabled\n"); 208 break; 209 case 1: 210 printf("bpf() syscall restricted to privileged users\n"); 211 break; 212 case -1: 213 printf("Unable to retrieve required privileges for bpf() syscall\n"); 214 break; 215 default: 216 printf("bpf() syscall restriction has unknown value %d\n", res); 217 } 218 } 219 } 220 221 static void probe_jit_enable(void) 222 { 223 int res; 224 225 /* No support for C-style ouptut */ 226 227 res = read_procfs("/proc/sys/net/core/bpf_jit_enable"); 228 if (json_output) { 229 jsonw_int_field(json_wtr, "bpf_jit_enable", res); 230 } else { 231 switch (res) { 232 case 0: 233 printf("JIT compiler is disabled\n"); 234 break; 235 case 1: 236 printf("JIT compiler is enabled\n"); 237 break; 238 case 2: 239 printf("JIT compiler is enabled with debugging traces in kernel logs\n"); 240 break; 241 case -1: 242 printf("Unable to retrieve JIT-compiler status\n"); 243 break; 244 default: 245 printf("JIT-compiler status has unknown value %d\n", 246 res); 247 } 248 } 249 } 250 251 static void probe_jit_harden(void) 252 { 253 int res; 254 255 /* No support for C-style ouptut */ 256 257 res = read_procfs("/proc/sys/net/core/bpf_jit_harden"); 258 if (json_output) { 259 jsonw_int_field(json_wtr, "bpf_jit_harden", res); 260 } else { 261 switch (res) { 262 case 0: 263 printf("JIT compiler hardening is disabled\n"); 264 break; 265 case 1: 266 printf("JIT compiler hardening is enabled for unprivileged users\n"); 267 break; 268 case 2: 269 printf("JIT compiler hardening is enabled for all users\n"); 270 break; 271 case -1: 272 printf("Unable to retrieve JIT hardening status\n"); 273 break; 274 default: 275 printf("JIT hardening status has unknown value %d\n", 276 res); 277 } 278 } 279 } 280 281 static void probe_jit_kallsyms(void) 282 { 283 int res; 284 285 /* No support for C-style ouptut */ 286 287 res = read_procfs("/proc/sys/net/core/bpf_jit_kallsyms"); 288 if (json_output) { 289 jsonw_int_field(json_wtr, "bpf_jit_kallsyms", res); 290 } else { 291 switch (res) { 292 case 0: 293 printf("JIT compiler kallsyms exports are disabled\n"); 294 break; 295 case 1: 296 printf("JIT compiler kallsyms exports are enabled for root\n"); 297 break; 298 case -1: 299 printf("Unable to retrieve JIT kallsyms export status\n"); 300 break; 301 default: 302 printf("JIT kallsyms exports status has unknown value %d\n", res); 303 } 304 } 305 } 306 307 static void probe_jit_limit(void) 308 { 309 int res; 310 311 /* No support for C-style ouptut */ 312 313 res = read_procfs("/proc/sys/net/core/bpf_jit_limit"); 314 if (json_output) { 315 jsonw_int_field(json_wtr, "bpf_jit_limit", res); 316 } else { 317 switch (res) { 318 case -1: 319 printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n"); 320 break; 321 default: 322 printf("Global memory limit for JIT compiler for unprivileged users is %d bytes\n", res); 323 } 324 } 325 } 326 327 static bool read_next_kernel_config_option(gzFile file, char *buf, size_t n, 328 char **value) 329 { 330 char *sep; 331 332 while (gzgets(file, buf, n)) { 333 if (strncmp(buf, "CONFIG_", 7)) 334 continue; 335 336 sep = strchr(buf, '='); 337 if (!sep) 338 continue; 339 340 /* Trim ending '\n' */ 341 buf[strlen(buf) - 1] = '\0'; 342 343 /* Split on '=' and ensure that a value is present. */ 344 *sep = '\0'; 345 if (!sep[1]) 346 continue; 347 348 *value = sep + 1; 349 return true; 350 } 351 352 return false; 353 } 354 355 static void probe_kernel_image_config(const char *define_prefix) 356 { 357 static const struct { 358 const char * const name; 359 bool macro_dump; 360 } options[] = { 361 /* Enable BPF */ 362 { "CONFIG_BPF", }, 363 /* Enable bpf() syscall */ 364 { "CONFIG_BPF_SYSCALL", }, 365 /* Does selected architecture support eBPF JIT compiler */ 366 { "CONFIG_HAVE_EBPF_JIT", }, 367 /* Compile eBPF JIT compiler */ 368 { "CONFIG_BPF_JIT", }, 369 /* Avoid compiling eBPF interpreter (use JIT only) */ 370 { "CONFIG_BPF_JIT_ALWAYS_ON", }, 371 /* Kernel BTF debug information available */ 372 { "CONFIG_DEBUG_INFO_BTF", }, 373 /* Kernel module BTF debug information available */ 374 { "CONFIG_DEBUG_INFO_BTF_MODULES", }, 375 376 /* cgroups */ 377 { "CONFIG_CGROUPS", }, 378 /* BPF programs attached to cgroups */ 379 { "CONFIG_CGROUP_BPF", }, 380 /* bpf_get_cgroup_classid() helper */ 381 { "CONFIG_CGROUP_NET_CLASSID", }, 382 /* bpf_skb_{,ancestor_}cgroup_id() helpers */ 383 { "CONFIG_SOCK_CGROUP_DATA", }, 384 385 /* Tracing: attach BPF to kprobes, tracepoints, etc. */ 386 { "CONFIG_BPF_EVENTS", }, 387 /* Kprobes */ 388 { "CONFIG_KPROBE_EVENTS", }, 389 /* Uprobes */ 390 { "CONFIG_UPROBE_EVENTS", }, 391 /* Tracepoints */ 392 { "CONFIG_TRACING", }, 393 /* Syscall tracepoints */ 394 { "CONFIG_FTRACE_SYSCALLS", }, 395 /* bpf_override_return() helper support for selected arch */ 396 { "CONFIG_FUNCTION_ERROR_INJECTION", }, 397 /* bpf_override_return() helper */ 398 { "CONFIG_BPF_KPROBE_OVERRIDE", }, 399 400 /* Network */ 401 { "CONFIG_NET", }, 402 /* AF_XDP sockets */ 403 { "CONFIG_XDP_SOCKETS", }, 404 /* BPF_PROG_TYPE_LWT_* and related helpers */ 405 { "CONFIG_LWTUNNEL_BPF", }, 406 /* BPF_PROG_TYPE_SCHED_ACT, TC (traffic control) actions */ 407 { "CONFIG_NET_ACT_BPF", }, 408 /* BPF_PROG_TYPE_SCHED_CLS, TC filters */ 409 { "CONFIG_NET_CLS_BPF", }, 410 /* TC clsact qdisc */ 411 { "CONFIG_NET_CLS_ACT", }, 412 /* Ingress filtering with TC */ 413 { "CONFIG_NET_SCH_INGRESS", }, 414 /* bpf_skb_get_xfrm_state() helper */ 415 { "CONFIG_XFRM", }, 416 /* bpf_get_route_realm() helper */ 417 { "CONFIG_IP_ROUTE_CLASSID", }, 418 /* BPF_PROG_TYPE_LWT_SEG6_LOCAL and related helpers */ 419 { "CONFIG_IPV6_SEG6_BPF", }, 420 /* BPF_PROG_TYPE_LIRC_MODE2 and related helpers */ 421 { "CONFIG_BPF_LIRC_MODE2", }, 422 /* BPF stream parser and BPF socket maps */ 423 { "CONFIG_BPF_STREAM_PARSER", }, 424 /* xt_bpf module for passing BPF programs to netfilter */ 425 { "CONFIG_NETFILTER_XT_MATCH_BPF", }, 426 /* bpfilter back-end for iptables */ 427 { "CONFIG_BPFILTER", }, 428 /* bpftilter module with "user mode helper" */ 429 { "CONFIG_BPFILTER_UMH", }, 430 431 /* test_bpf module for BPF tests */ 432 { "CONFIG_TEST_BPF", }, 433 434 /* Misc configs useful in BPF C programs */ 435 /* jiffies <-> sec conversion for bpf_jiffies64() helper */ 436 { "CONFIG_HZ", true, } 437 }; 438 char *values[ARRAY_SIZE(options)] = { }; 439 struct utsname utsn; 440 char path[PATH_MAX]; 441 gzFile file = NULL; 442 char buf[4096]; 443 char *value; 444 size_t i; 445 446 if (!uname(&utsn)) { 447 snprintf(path, sizeof(path), "/boot/config-%s", utsn.release); 448 449 /* gzopen also accepts uncompressed files. */ 450 file = gzopen(path, "r"); 451 } 452 453 if (!file) { 454 /* Some distributions build with CONFIG_IKCONFIG=y and put the 455 * config file at /proc/config.gz. 456 */ 457 file = gzopen("/proc/config.gz", "r"); 458 } 459 if (!file) { 460 p_info("skipping kernel config, can't open file: %s", 461 strerror(errno)); 462 goto end_parse; 463 } 464 /* Sanity checks */ 465 if (!gzgets(file, buf, sizeof(buf)) || 466 !gzgets(file, buf, sizeof(buf))) { 467 p_info("skipping kernel config, can't read from file: %s", 468 strerror(errno)); 469 goto end_parse; 470 } 471 if (strcmp(buf, "# Automatically generated file; DO NOT EDIT.\n")) { 472 p_info("skipping kernel config, can't find correct file"); 473 goto end_parse; 474 } 475 476 while (read_next_kernel_config_option(file, buf, sizeof(buf), &value)) { 477 for (i = 0; i < ARRAY_SIZE(options); i++) { 478 if ((define_prefix && !options[i].macro_dump) || 479 values[i] || strcmp(buf, options[i].name)) 480 continue; 481 482 values[i] = strdup(value); 483 } 484 } 485 486 end_parse: 487 if (file) 488 gzclose(file); 489 490 for (i = 0; i < ARRAY_SIZE(options); i++) { 491 if (define_prefix && !options[i].macro_dump) 492 continue; 493 print_kernel_option(options[i].name, values[i], define_prefix); 494 free(values[i]); 495 } 496 } 497 498 static bool probe_bpf_syscall(const char *define_prefix) 499 { 500 bool res; 501 502 bpf_prog_load(BPF_PROG_TYPE_UNSPEC, NULL, NULL, NULL, 0, NULL); 503 res = (errno != ENOSYS); 504 505 print_bool_feature("have_bpf_syscall", 506 "bpf() syscall", 507 "BPF_SYSCALL", 508 res, define_prefix); 509 510 return res; 511 } 512 513 static bool 514 probe_prog_load_ifindex(enum bpf_prog_type prog_type, 515 const struct bpf_insn *insns, size_t insns_cnt, 516 char *log_buf, size_t log_buf_sz, 517 __u32 ifindex) 518 { 519 LIBBPF_OPTS(bpf_prog_load_opts, opts, 520 .log_buf = log_buf, 521 .log_size = log_buf_sz, 522 .log_level = log_buf ? 1 : 0, 523 .prog_ifindex = ifindex, 524 ); 525 int fd; 526 527 errno = 0; 528 fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts); 529 if (fd >= 0) 530 close(fd); 531 532 return fd >= 0 && errno != EINVAL && errno != EOPNOTSUPP; 533 } 534 535 static bool probe_prog_type_ifindex(enum bpf_prog_type prog_type, __u32 ifindex) 536 { 537 /* nfp returns -EINVAL on exit(0) with TC offload */ 538 struct bpf_insn insns[2] = { 539 BPF_MOV64_IMM(BPF_REG_0, 2), 540 BPF_EXIT_INSN() 541 }; 542 543 return probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns), 544 NULL, 0, ifindex); 545 } 546 547 static void 548 probe_prog_type(enum bpf_prog_type prog_type, bool *supported_types, 549 const char *define_prefix, __u32 ifindex) 550 { 551 char feat_name[128], plain_desc[128], define_name[128]; 552 const char *plain_comment = "eBPF program_type "; 553 size_t maxlen; 554 bool res; 555 556 if (ifindex) { 557 switch (prog_type) { 558 case BPF_PROG_TYPE_SCHED_CLS: 559 case BPF_PROG_TYPE_XDP: 560 break; 561 default: 562 return; 563 } 564 565 res = probe_prog_type_ifindex(prog_type, ifindex); 566 } else { 567 res = libbpf_probe_bpf_prog_type(prog_type, NULL); 568 } 569 570 #ifdef USE_LIBCAP 571 /* Probe may succeed even if program load fails, for unprivileged users 572 * check that we did not fail because of insufficient permissions 573 */ 574 if (run_as_unprivileged && errno == EPERM) 575 res = false; 576 #endif 577 578 supported_types[prog_type] |= res; 579 580 if (!prog_type_name[prog_type]) { 581 p_info("program type name not found (type %d)", prog_type); 582 return; 583 } 584 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1; 585 if (strlen(prog_type_name[prog_type]) > maxlen) { 586 p_info("program type name too long"); 587 return; 588 } 589 590 sprintf(feat_name, "have_%s_prog_type", prog_type_name[prog_type]); 591 sprintf(define_name, "%s_prog_type", prog_type_name[prog_type]); 592 uppercase(define_name, sizeof(define_name)); 593 sprintf(plain_desc, "%s%s", plain_comment, prog_type_name[prog_type]); 594 print_bool_feature(feat_name, plain_desc, define_name, res, 595 define_prefix); 596 } 597 598 static bool probe_map_type_ifindex(enum bpf_map_type map_type, __u32 ifindex) 599 { 600 LIBBPF_OPTS(bpf_map_create_opts, opts); 601 int key_size, value_size, max_entries; 602 int fd; 603 604 opts.map_ifindex = ifindex; 605 606 key_size = sizeof(__u32); 607 value_size = sizeof(__u32); 608 max_entries = 1; 609 610 fd = bpf_map_create(map_type, NULL, key_size, value_size, max_entries, 611 &opts); 612 if (fd >= 0) 613 close(fd); 614 615 return fd >= 0; 616 } 617 618 static void 619 probe_map_type(enum bpf_map_type map_type, const char *define_prefix, 620 __u32 ifindex) 621 { 622 char feat_name[128], plain_desc[128], define_name[128]; 623 const char *plain_comment = "eBPF map_type "; 624 size_t maxlen; 625 bool res; 626 627 if (ifindex) { 628 switch (map_type) { 629 case BPF_MAP_TYPE_HASH: 630 case BPF_MAP_TYPE_ARRAY: 631 break; 632 default: 633 return; 634 } 635 636 res = probe_map_type_ifindex(map_type, ifindex); 637 } else { 638 res = libbpf_probe_bpf_map_type(map_type, NULL); 639 } 640 641 /* Probe result depends on the success of map creation, no additional 642 * check required for unprivileged users 643 */ 644 645 if (!map_type_name[map_type]) { 646 p_info("map type name not found (type %d)", map_type); 647 return; 648 } 649 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1; 650 if (strlen(map_type_name[map_type]) > maxlen) { 651 p_info("map type name too long"); 652 return; 653 } 654 655 sprintf(feat_name, "have_%s_map_type", map_type_name[map_type]); 656 sprintf(define_name, "%s_map_type", map_type_name[map_type]); 657 uppercase(define_name, sizeof(define_name)); 658 sprintf(plain_desc, "%s%s", plain_comment, map_type_name[map_type]); 659 print_bool_feature(feat_name, plain_desc, define_name, res, 660 define_prefix); 661 } 662 663 static bool 664 probe_helper_ifindex(enum bpf_func_id id, enum bpf_prog_type prog_type, 665 __u32 ifindex) 666 { 667 struct bpf_insn insns[2] = { 668 BPF_EMIT_CALL(id), 669 BPF_EXIT_INSN() 670 }; 671 char buf[4096] = {}; 672 bool res; 673 674 probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns), buf, 675 sizeof(buf), ifindex); 676 res = !grep(buf, "invalid func ") && !grep(buf, "unknown func "); 677 678 switch (get_vendor_id(ifindex)) { 679 case 0x19ee: /* Netronome specific */ 680 res = res && !grep(buf, "not supported by FW") && 681 !grep(buf, "unsupported function id"); 682 break; 683 default: 684 break; 685 } 686 687 return res; 688 } 689 690 static void 691 probe_helper_for_progtype(enum bpf_prog_type prog_type, bool supported_type, 692 const char *define_prefix, unsigned int id, 693 const char *ptype_name, __u32 ifindex) 694 { 695 bool res = false; 696 697 if (supported_type) { 698 if (ifindex) 699 res = probe_helper_ifindex(id, prog_type, ifindex); 700 else 701 res = libbpf_probe_bpf_helper(prog_type, id, NULL); 702 #ifdef USE_LIBCAP 703 /* Probe may succeed even if program load fails, for 704 * unprivileged users check that we did not fail because of 705 * insufficient permissions 706 */ 707 if (run_as_unprivileged && errno == EPERM) 708 res = false; 709 #endif 710 } 711 712 if (json_output) { 713 if (res) 714 jsonw_string(json_wtr, helper_name[id]); 715 } else if (define_prefix) { 716 printf("#define %sBPF__PROG_TYPE_%s__HELPER_%s %s\n", 717 define_prefix, ptype_name, helper_name[id], 718 res ? "1" : "0"); 719 } else { 720 if (res) 721 printf("\n\t- %s", helper_name[id]); 722 } 723 } 724 725 static void 726 probe_helpers_for_progtype(enum bpf_prog_type prog_type, bool supported_type, 727 const char *define_prefix, __u32 ifindex) 728 { 729 const char *ptype_name = prog_type_name[prog_type]; 730 char feat_name[128]; 731 unsigned int id; 732 733 if (ifindex) 734 /* Only test helpers for offload-able program types */ 735 switch (prog_type) { 736 case BPF_PROG_TYPE_SCHED_CLS: 737 case BPF_PROG_TYPE_XDP: 738 break; 739 default: 740 return; 741 } 742 743 if (json_output) { 744 sprintf(feat_name, "%s_available_helpers", ptype_name); 745 jsonw_name(json_wtr, feat_name); 746 jsonw_start_array(json_wtr); 747 } else if (!define_prefix) { 748 printf("eBPF helpers supported for program type %s:", 749 ptype_name); 750 } 751 752 for (id = 1; id < ARRAY_SIZE(helper_name); id++) { 753 /* Skip helper functions which emit dmesg messages when not in 754 * the full mode. 755 */ 756 switch (id) { 757 case BPF_FUNC_trace_printk: 758 case BPF_FUNC_trace_vprintk: 759 case BPF_FUNC_probe_write_user: 760 if (!full_mode) 761 continue; 762 /* fallthrough */ 763 default: 764 probe_helper_for_progtype(prog_type, supported_type, 765 define_prefix, id, ptype_name, 766 ifindex); 767 } 768 } 769 770 if (json_output) 771 jsonw_end_array(json_wtr); 772 else if (!define_prefix) 773 printf("\n"); 774 } 775 776 static void 777 probe_misc_feature(struct bpf_insn *insns, size_t len, 778 const char *define_prefix, __u32 ifindex, 779 const char *feat_name, const char *plain_name, 780 const char *define_name) 781 { 782 LIBBPF_OPTS(bpf_prog_load_opts, opts, 783 .prog_ifindex = ifindex, 784 ); 785 bool res; 786 int fd; 787 788 errno = 0; 789 fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", 790 insns, len, &opts); 791 res = fd >= 0 || !errno; 792 793 if (fd >= 0) 794 close(fd); 795 796 print_bool_feature(feat_name, plain_name, define_name, res, 797 define_prefix); 798 } 799 800 /* 801 * Probe for availability of kernel commit (5.3): 802 * 803 * c04c0d2b968a ("bpf: increase complexity limit and maximum program size") 804 */ 805 static void probe_large_insn_limit(const char *define_prefix, __u32 ifindex) 806 { 807 struct bpf_insn insns[BPF_MAXINSNS + 1]; 808 int i; 809 810 for (i = 0; i < BPF_MAXINSNS; i++) 811 insns[i] = BPF_MOV64_IMM(BPF_REG_0, 1); 812 insns[BPF_MAXINSNS] = BPF_EXIT_INSN(); 813 814 probe_misc_feature(insns, ARRAY_SIZE(insns), 815 define_prefix, ifindex, 816 "have_large_insn_limit", 817 "Large program size limit", 818 "LARGE_INSN_LIMIT"); 819 } 820 821 /* 822 * Probe for bounded loop support introduced in commit 2589726d12a1 823 * ("bpf: introduce bounded loops"). 824 */ 825 static void 826 probe_bounded_loops(const char *define_prefix, __u32 ifindex) 827 { 828 struct bpf_insn insns[4] = { 829 BPF_MOV64_IMM(BPF_REG_0, 10), 830 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 1), 831 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, -2), 832 BPF_EXIT_INSN() 833 }; 834 835 probe_misc_feature(insns, ARRAY_SIZE(insns), 836 define_prefix, ifindex, 837 "have_bounded_loops", 838 "Bounded loop support", 839 "BOUNDED_LOOPS"); 840 } 841 842 /* 843 * Probe for the v2 instruction set extension introduced in commit 92b31a9af73b 844 * ("bpf: add BPF_J{LT,LE,SLT,SLE} instructions"). 845 */ 846 static void 847 probe_v2_isa_extension(const char *define_prefix, __u32 ifindex) 848 { 849 struct bpf_insn insns[4] = { 850 BPF_MOV64_IMM(BPF_REG_0, 0), 851 BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 0, 1), 852 BPF_MOV64_IMM(BPF_REG_0, 1), 853 BPF_EXIT_INSN() 854 }; 855 856 probe_misc_feature(insns, ARRAY_SIZE(insns), 857 define_prefix, ifindex, 858 "have_v2_isa_extension", 859 "ISA extension v2", 860 "V2_ISA_EXTENSION"); 861 } 862 863 /* 864 * Probe for the v3 instruction set extension introduced in commit 092ed0968bb6 865 * ("bpf: verifier support JMP32"). 866 */ 867 static void 868 probe_v3_isa_extension(const char *define_prefix, __u32 ifindex) 869 { 870 struct bpf_insn insns[4] = { 871 BPF_MOV64_IMM(BPF_REG_0, 0), 872 BPF_JMP32_IMM(BPF_JLT, BPF_REG_0, 0, 1), 873 BPF_MOV64_IMM(BPF_REG_0, 1), 874 BPF_EXIT_INSN() 875 }; 876 877 probe_misc_feature(insns, ARRAY_SIZE(insns), 878 define_prefix, ifindex, 879 "have_v3_isa_extension", 880 "ISA extension v3", 881 "V3_ISA_EXTENSION"); 882 } 883 884 static void 885 section_system_config(enum probe_component target, const char *define_prefix) 886 { 887 switch (target) { 888 case COMPONENT_KERNEL: 889 case COMPONENT_UNSPEC: 890 print_start_section("system_config", 891 "Scanning system configuration...", 892 "/*** Misc kernel config items ***/", 893 define_prefix); 894 if (!define_prefix) { 895 if (check_procfs()) { 896 probe_unprivileged_disabled(); 897 probe_jit_enable(); 898 probe_jit_harden(); 899 probe_jit_kallsyms(); 900 probe_jit_limit(); 901 } else { 902 p_info("/* procfs not mounted, skipping related probes */"); 903 } 904 } 905 probe_kernel_image_config(define_prefix); 906 print_end_section(); 907 break; 908 default: 909 break; 910 } 911 } 912 913 static bool section_syscall_config(const char *define_prefix) 914 { 915 bool res; 916 917 print_start_section("syscall_config", 918 "Scanning system call availability...", 919 "/*** System call availability ***/", 920 define_prefix); 921 res = probe_bpf_syscall(define_prefix); 922 print_end_section(); 923 924 return res; 925 } 926 927 static void 928 section_program_types(bool *supported_types, const char *define_prefix, 929 __u32 ifindex) 930 { 931 unsigned int i; 932 933 print_start_section("program_types", 934 "Scanning eBPF program types...", 935 "/*** eBPF program types ***/", 936 define_prefix); 937 938 for (i = BPF_PROG_TYPE_UNSPEC + 1; i < prog_type_name_size; i++) 939 probe_prog_type(i, supported_types, define_prefix, ifindex); 940 941 print_end_section(); 942 } 943 944 static void section_map_types(const char *define_prefix, __u32 ifindex) 945 { 946 unsigned int i; 947 948 print_start_section("map_types", 949 "Scanning eBPF map types...", 950 "/*** eBPF map types ***/", 951 define_prefix); 952 953 for (i = BPF_MAP_TYPE_UNSPEC + 1; i < map_type_name_size; i++) 954 probe_map_type(i, define_prefix, ifindex); 955 956 print_end_section(); 957 } 958 959 static void 960 section_helpers(bool *supported_types, const char *define_prefix, __u32 ifindex) 961 { 962 unsigned int i; 963 964 print_start_section("helpers", 965 "Scanning eBPF helper functions...", 966 "/*** eBPF helper functions ***/", 967 define_prefix); 968 969 if (define_prefix) 970 printf("/*\n" 971 " * Use %sHAVE_PROG_TYPE_HELPER(prog_type_name, helper_name)\n" 972 " * to determine if <helper_name> is available for <prog_type_name>,\n" 973 " * e.g.\n" 974 " * #if %sHAVE_PROG_TYPE_HELPER(xdp, bpf_redirect)\n" 975 " * // do stuff with this helper\n" 976 " * #elif\n" 977 " * // use a workaround\n" 978 " * #endif\n" 979 " */\n" 980 "#define %sHAVE_PROG_TYPE_HELPER(prog_type, helper) \\\n" 981 " %sBPF__PROG_TYPE_ ## prog_type ## __HELPER_ ## helper\n", 982 define_prefix, define_prefix, define_prefix, 983 define_prefix); 984 for (i = BPF_PROG_TYPE_UNSPEC + 1; i < prog_type_name_size; i++) 985 probe_helpers_for_progtype(i, supported_types[i], define_prefix, 986 ifindex); 987 988 print_end_section(); 989 } 990 991 static void section_misc(const char *define_prefix, __u32 ifindex) 992 { 993 print_start_section("misc", 994 "Scanning miscellaneous eBPF features...", 995 "/*** eBPF misc features ***/", 996 define_prefix); 997 probe_large_insn_limit(define_prefix, ifindex); 998 probe_bounded_loops(define_prefix, ifindex); 999 probe_v2_isa_extension(define_prefix, ifindex); 1000 probe_v3_isa_extension(define_prefix, ifindex); 1001 print_end_section(); 1002 } 1003 1004 #ifdef USE_LIBCAP 1005 #define capability(c) { c, false, #c } 1006 #define capability_msg(a, i) a[i].set ? "" : a[i].name, a[i].set ? "" : ", " 1007 #endif 1008 1009 static int handle_perms(void) 1010 { 1011 #ifdef USE_LIBCAP 1012 struct { 1013 cap_value_t cap; 1014 bool set; 1015 char name[14]; /* strlen("CAP_SYS_ADMIN") */ 1016 } bpf_caps[] = { 1017 capability(CAP_SYS_ADMIN), 1018 #ifdef CAP_BPF 1019 capability(CAP_BPF), 1020 capability(CAP_NET_ADMIN), 1021 capability(CAP_PERFMON), 1022 #endif 1023 }; 1024 cap_value_t cap_list[ARRAY_SIZE(bpf_caps)]; 1025 unsigned int i, nb_bpf_caps = 0; 1026 bool cap_sys_admin_only = true; 1027 cap_flag_value_t val; 1028 int res = -1; 1029 cap_t caps; 1030 1031 caps = cap_get_proc(); 1032 if (!caps) { 1033 p_err("failed to get capabilities for process: %s", 1034 strerror(errno)); 1035 return -1; 1036 } 1037 1038 #ifdef CAP_BPF 1039 if (CAP_IS_SUPPORTED(CAP_BPF)) 1040 cap_sys_admin_only = false; 1041 #endif 1042 1043 for (i = 0; i < ARRAY_SIZE(bpf_caps); i++) { 1044 const char *cap_name = bpf_caps[i].name; 1045 cap_value_t cap = bpf_caps[i].cap; 1046 1047 if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &val)) { 1048 p_err("bug: failed to retrieve %s status: %s", cap_name, 1049 strerror(errno)); 1050 goto exit_free; 1051 } 1052 1053 if (val == CAP_SET) { 1054 bpf_caps[i].set = true; 1055 cap_list[nb_bpf_caps++] = cap; 1056 } 1057 1058 if (cap_sys_admin_only) 1059 /* System does not know about CAP_BPF, meaning that 1060 * CAP_SYS_ADMIN is the only capability required. We 1061 * just checked it, break. 1062 */ 1063 break; 1064 } 1065 1066 if ((run_as_unprivileged && !nb_bpf_caps) || 1067 (!run_as_unprivileged && nb_bpf_caps == ARRAY_SIZE(bpf_caps)) || 1068 (!run_as_unprivileged && cap_sys_admin_only && nb_bpf_caps)) { 1069 /* We are all good, exit now */ 1070 res = 0; 1071 goto exit_free; 1072 } 1073 1074 if (!run_as_unprivileged) { 1075 if (cap_sys_admin_only) 1076 p_err("missing %s, required for full feature probing; run as root or use 'unprivileged'", 1077 bpf_caps[0].name); 1078 else 1079 p_err("missing %s%s%s%s%s%s%s%srequired for full feature probing; run as root or use 'unprivileged'", 1080 capability_msg(bpf_caps, 0), 1081 #ifdef CAP_BPF 1082 capability_msg(bpf_caps, 1), 1083 capability_msg(bpf_caps, 2), 1084 capability_msg(bpf_caps, 3) 1085 #else 1086 "", "", "", "", "", "" 1087 #endif /* CAP_BPF */ 1088 ); 1089 goto exit_free; 1090 } 1091 1092 /* if (run_as_unprivileged && nb_bpf_caps > 0), drop capabilities. */ 1093 if (cap_set_flag(caps, CAP_EFFECTIVE, nb_bpf_caps, cap_list, 1094 CAP_CLEAR)) { 1095 p_err("bug: failed to clear capabilities: %s", strerror(errno)); 1096 goto exit_free; 1097 } 1098 1099 if (cap_set_proc(caps)) { 1100 p_err("failed to drop capabilities: %s", strerror(errno)); 1101 goto exit_free; 1102 } 1103 1104 res = 0; 1105 1106 exit_free: 1107 if (cap_free(caps) && !res) { 1108 p_err("failed to clear storage object for capabilities: %s", 1109 strerror(errno)); 1110 res = -1; 1111 } 1112 1113 return res; 1114 #else 1115 /* Detection assumes user has specific privileges. 1116 * We do not use libpcap so let's approximate, and restrict usage to 1117 * root user only. 1118 */ 1119 if (geteuid()) { 1120 p_err("full feature probing requires root privileges"); 1121 return -1; 1122 } 1123 1124 return 0; 1125 #endif /* USE_LIBCAP */ 1126 } 1127 1128 static int do_probe(int argc, char **argv) 1129 { 1130 enum probe_component target = COMPONENT_UNSPEC; 1131 const char *define_prefix = NULL; 1132 bool supported_types[128] = {}; 1133 __u32 ifindex = 0; 1134 char *ifname; 1135 1136 set_max_rlimit(); 1137 1138 while (argc) { 1139 if (is_prefix(*argv, "kernel")) { 1140 if (target != COMPONENT_UNSPEC) { 1141 p_err("component to probe already specified"); 1142 return -1; 1143 } 1144 target = COMPONENT_KERNEL; 1145 NEXT_ARG(); 1146 } else if (is_prefix(*argv, "dev")) { 1147 NEXT_ARG(); 1148 1149 if (target != COMPONENT_UNSPEC || ifindex) { 1150 p_err("component to probe already specified"); 1151 return -1; 1152 } 1153 if (!REQ_ARGS(1)) 1154 return -1; 1155 1156 target = COMPONENT_DEVICE; 1157 ifname = GET_ARG(); 1158 ifindex = if_nametoindex(ifname); 1159 if (!ifindex) { 1160 p_err("unrecognized netdevice '%s': %s", ifname, 1161 strerror(errno)); 1162 return -1; 1163 } 1164 } else if (is_prefix(*argv, "full")) { 1165 full_mode = true; 1166 NEXT_ARG(); 1167 } else if (is_prefix(*argv, "macros") && !define_prefix) { 1168 define_prefix = ""; 1169 NEXT_ARG(); 1170 } else if (is_prefix(*argv, "prefix")) { 1171 if (!define_prefix) { 1172 p_err("'prefix' argument can only be use after 'macros'"); 1173 return -1; 1174 } 1175 if (strcmp(define_prefix, "")) { 1176 p_err("'prefix' already defined"); 1177 return -1; 1178 } 1179 NEXT_ARG(); 1180 1181 if (!REQ_ARGS(1)) 1182 return -1; 1183 define_prefix = GET_ARG(); 1184 } else if (is_prefix(*argv, "unprivileged")) { 1185 #ifdef USE_LIBCAP 1186 run_as_unprivileged = true; 1187 NEXT_ARG(); 1188 #else 1189 p_err("unprivileged run not supported, recompile bpftool with libcap"); 1190 return -1; 1191 #endif 1192 } else { 1193 p_err("expected no more arguments, 'kernel', 'dev', 'macros' or 'prefix', got: '%s'?", 1194 *argv); 1195 return -1; 1196 } 1197 } 1198 1199 /* Full feature detection requires specific privileges. 1200 * Let's approximate, and warn if user is not root. 1201 */ 1202 if (handle_perms()) 1203 return -1; 1204 1205 if (json_output) { 1206 define_prefix = NULL; 1207 jsonw_start_object(json_wtr); 1208 } 1209 1210 section_system_config(target, define_prefix); 1211 if (!section_syscall_config(define_prefix)) 1212 /* bpf() syscall unavailable, don't probe other BPF features */ 1213 goto exit_close_json; 1214 section_program_types(supported_types, define_prefix, ifindex); 1215 section_map_types(define_prefix, ifindex); 1216 section_helpers(supported_types, define_prefix, ifindex); 1217 section_misc(define_prefix, ifindex); 1218 1219 exit_close_json: 1220 if (json_output) 1221 /* End root object */ 1222 jsonw_end_object(json_wtr); 1223 1224 return 0; 1225 } 1226 1227 static int do_help(int argc, char **argv) 1228 { 1229 if (json_output) { 1230 jsonw_null(json_wtr); 1231 return 0; 1232 } 1233 1234 fprintf(stderr, 1235 "Usage: %1$s %2$s probe [COMPONENT] [full] [unprivileged] [macros [prefix PREFIX]]\n" 1236 " %1$s %2$s help\n" 1237 "\n" 1238 " COMPONENT := { kernel | dev NAME }\n" 1239 " " HELP_SPEC_OPTIONS " }\n" 1240 "", 1241 bin_name, argv[-2]); 1242 1243 return 0; 1244 } 1245 1246 static const struct cmd cmds[] = { 1247 { "probe", do_probe }, 1248 { "help", do_help }, 1249 { 0 } 1250 }; 1251 1252 int do_feature(int argc, char **argv) 1253 { 1254 return cmd_select(cmds, argc, argv, do_help); 1255 } 1256