1 // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) 2 /* Copyright (c) 2019 Netronome Systems, Inc. */ 3 4 #include <ctype.h> 5 #include <errno.h> 6 #include <fcntl.h> 7 #include <string.h> 8 #include <unistd.h> 9 #include <net/if.h> 10 #ifdef USE_LIBCAP 11 #include <sys/capability.h> 12 #endif 13 #include <sys/utsname.h> 14 #include <sys/vfs.h> 15 16 #include <linux/filter.h> 17 #include <linux/limits.h> 18 19 #include <bpf/bpf.h> 20 #include <bpf/libbpf.h> 21 #include <zlib.h> 22 23 #include "main.h" 24 25 #ifndef PROC_SUPER_MAGIC 26 # define PROC_SUPER_MAGIC 0x9fa0 27 #endif 28 29 enum probe_component { 30 COMPONENT_UNSPEC, 31 COMPONENT_KERNEL, 32 COMPONENT_DEVICE, 33 }; 34 35 #define BPF_HELPER_MAKE_ENTRY(name) [BPF_FUNC_ ## name] = "bpf_" # name 36 static const char * const helper_name[] = { 37 __BPF_FUNC_MAPPER(BPF_HELPER_MAKE_ENTRY) 38 }; 39 40 #undef BPF_HELPER_MAKE_ENTRY 41 42 static bool full_mode; 43 #ifdef USE_LIBCAP 44 static bool run_as_unprivileged; 45 #endif 46 47 /* Miscellaneous utility functions */ 48 49 static bool grep(const char *buffer, const char *pattern) 50 { 51 return !!strstr(buffer, pattern); 52 } 53 54 static bool check_procfs(void) 55 { 56 struct statfs st_fs; 57 58 if (statfs("/proc", &st_fs) < 0) 59 return false; 60 if ((unsigned long)st_fs.f_type != PROC_SUPER_MAGIC) 61 return false; 62 63 return true; 64 } 65 66 static void uppercase(char *str, size_t len) 67 { 68 size_t i; 69 70 for (i = 0; i < len && str[i] != '\0'; i++) 71 str[i] = toupper(str[i]); 72 } 73 74 /* Printing utility functions */ 75 76 static void 77 print_bool_feature(const char *feat_name, const char *plain_name, 78 const char *define_name, bool res, const char *define_prefix) 79 { 80 if (json_output) 81 jsonw_bool_field(json_wtr, feat_name, res); 82 else if (define_prefix) 83 printf("#define %s%sHAVE_%s\n", define_prefix, 84 res ? "" : "NO_", define_name); 85 else 86 printf("%s is %savailable\n", plain_name, res ? "" : "NOT "); 87 } 88 89 static void print_kernel_option(const char *name, const char *value, 90 const char *define_prefix) 91 { 92 char *endptr; 93 int res; 94 95 if (json_output) { 96 if (!value) { 97 jsonw_null_field(json_wtr, name); 98 return; 99 } 100 errno = 0; 101 res = strtol(value, &endptr, 0); 102 if (!errno && *endptr == '\n') 103 jsonw_int_field(json_wtr, name, res); 104 else 105 jsonw_string_field(json_wtr, name, value); 106 } else if (define_prefix) { 107 if (value) 108 printf("#define %s%s %s\n", define_prefix, 109 name, value); 110 else 111 printf("/* %s%s is not set */\n", define_prefix, name); 112 } else { 113 if (value) 114 printf("%s is set to %s\n", name, value); 115 else 116 printf("%s is not set\n", name); 117 } 118 } 119 120 static void 121 print_start_section(const char *json_title, const char *plain_title, 122 const char *define_comment, const char *define_prefix) 123 { 124 if (json_output) { 125 jsonw_name(json_wtr, json_title); 126 jsonw_start_object(json_wtr); 127 } else if (define_prefix) { 128 printf("%s\n", define_comment); 129 } else { 130 printf("%s\n", plain_title); 131 } 132 } 133 134 static void print_end_section(void) 135 { 136 if (json_output) 137 jsonw_end_object(json_wtr); 138 else 139 printf("\n"); 140 } 141 142 /* Probing functions */ 143 144 static int get_vendor_id(int ifindex) 145 { 146 char ifname[IF_NAMESIZE], path[64], buf[8]; 147 ssize_t len; 148 int fd; 149 150 if (!if_indextoname(ifindex, ifname)) 151 return -1; 152 153 snprintf(path, sizeof(path), "/sys/class/net/%s/device/vendor", ifname); 154 155 fd = open(path, O_RDONLY | O_CLOEXEC); 156 if (fd < 0) 157 return -1; 158 159 len = read(fd, buf, sizeof(buf)); 160 close(fd); 161 if (len < 0) 162 return -1; 163 if (len >= (ssize_t)sizeof(buf)) 164 return -1; 165 buf[len] = '\0'; 166 167 return strtol(buf, NULL, 0); 168 } 169 170 static int read_procfs(const char *path) 171 { 172 char *endptr, *line = NULL; 173 size_t len = 0; 174 FILE *fd; 175 int res; 176 177 fd = fopen(path, "r"); 178 if (!fd) 179 return -1; 180 181 res = getline(&line, &len, fd); 182 fclose(fd); 183 if (res < 0) 184 return -1; 185 186 errno = 0; 187 res = strtol(line, &endptr, 10); 188 if (errno || *line == '\0' || *endptr != '\n') 189 res = -1; 190 free(line); 191 192 return res; 193 } 194 195 static void probe_unprivileged_disabled(void) 196 { 197 int res; 198 199 /* No support for C-style ouptut */ 200 201 res = read_procfs("/proc/sys/kernel/unprivileged_bpf_disabled"); 202 if (json_output) { 203 jsonw_int_field(json_wtr, "unprivileged_bpf_disabled", res); 204 } else { 205 switch (res) { 206 case 0: 207 printf("bpf() syscall for unprivileged users is enabled\n"); 208 break; 209 case 1: 210 printf("bpf() syscall restricted to privileged users (without recovery)\n"); 211 break; 212 case 2: 213 printf("bpf() syscall restricted to privileged users (admin can change)\n"); 214 break; 215 case -1: 216 printf("Unable to retrieve required privileges for bpf() syscall\n"); 217 break; 218 default: 219 printf("bpf() syscall restriction has unknown value %d\n", res); 220 } 221 } 222 } 223 224 static void probe_jit_enable(void) 225 { 226 int res; 227 228 /* No support for C-style ouptut */ 229 230 res = read_procfs("/proc/sys/net/core/bpf_jit_enable"); 231 if (json_output) { 232 jsonw_int_field(json_wtr, "bpf_jit_enable", res); 233 } else { 234 switch (res) { 235 case 0: 236 printf("JIT compiler is disabled\n"); 237 break; 238 case 1: 239 printf("JIT compiler is enabled\n"); 240 break; 241 case 2: 242 printf("JIT compiler is enabled with debugging traces in kernel logs\n"); 243 break; 244 case -1: 245 printf("Unable to retrieve JIT-compiler status\n"); 246 break; 247 default: 248 printf("JIT-compiler status has unknown value %d\n", 249 res); 250 } 251 } 252 } 253 254 static void probe_jit_harden(void) 255 { 256 int res; 257 258 /* No support for C-style ouptut */ 259 260 res = read_procfs("/proc/sys/net/core/bpf_jit_harden"); 261 if (json_output) { 262 jsonw_int_field(json_wtr, "bpf_jit_harden", res); 263 } else { 264 switch (res) { 265 case 0: 266 printf("JIT compiler hardening is disabled\n"); 267 break; 268 case 1: 269 printf("JIT compiler hardening is enabled for unprivileged users\n"); 270 break; 271 case 2: 272 printf("JIT compiler hardening is enabled for all users\n"); 273 break; 274 case -1: 275 printf("Unable to retrieve JIT hardening status\n"); 276 break; 277 default: 278 printf("JIT hardening status has unknown value %d\n", 279 res); 280 } 281 } 282 } 283 284 static void probe_jit_kallsyms(void) 285 { 286 int res; 287 288 /* No support for C-style ouptut */ 289 290 res = read_procfs("/proc/sys/net/core/bpf_jit_kallsyms"); 291 if (json_output) { 292 jsonw_int_field(json_wtr, "bpf_jit_kallsyms", res); 293 } else { 294 switch (res) { 295 case 0: 296 printf("JIT compiler kallsyms exports are disabled\n"); 297 break; 298 case 1: 299 printf("JIT compiler kallsyms exports are enabled for root\n"); 300 break; 301 case -1: 302 printf("Unable to retrieve JIT kallsyms export status\n"); 303 break; 304 default: 305 printf("JIT kallsyms exports status has unknown value %d\n", res); 306 } 307 } 308 } 309 310 static void probe_jit_limit(void) 311 { 312 int res; 313 314 /* No support for C-style ouptut */ 315 316 res = read_procfs("/proc/sys/net/core/bpf_jit_limit"); 317 if (json_output) { 318 jsonw_int_field(json_wtr, "bpf_jit_limit", res); 319 } else { 320 switch (res) { 321 case -1: 322 printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n"); 323 break; 324 default: 325 printf("Global memory limit for JIT compiler for unprivileged users is %d bytes\n", res); 326 } 327 } 328 } 329 330 static bool read_next_kernel_config_option(gzFile file, char *buf, size_t n, 331 char **value) 332 { 333 char *sep; 334 335 while (gzgets(file, buf, n)) { 336 if (strncmp(buf, "CONFIG_", 7)) 337 continue; 338 339 sep = strchr(buf, '='); 340 if (!sep) 341 continue; 342 343 /* Trim ending '\n' */ 344 buf[strlen(buf) - 1] = '\0'; 345 346 /* Split on '=' and ensure that a value is present. */ 347 *sep = '\0'; 348 if (!sep[1]) 349 continue; 350 351 *value = sep + 1; 352 return true; 353 } 354 355 return false; 356 } 357 358 static void probe_kernel_image_config(const char *define_prefix) 359 { 360 static const struct { 361 const char * const name; 362 bool macro_dump; 363 } options[] = { 364 /* Enable BPF */ 365 { "CONFIG_BPF", }, 366 /* Enable bpf() syscall */ 367 { "CONFIG_BPF_SYSCALL", }, 368 /* Does selected architecture support eBPF JIT compiler */ 369 { "CONFIG_HAVE_EBPF_JIT", }, 370 /* Compile eBPF JIT compiler */ 371 { "CONFIG_BPF_JIT", }, 372 /* Avoid compiling eBPF interpreter (use JIT only) */ 373 { "CONFIG_BPF_JIT_ALWAYS_ON", }, 374 /* Kernel BTF debug information available */ 375 { "CONFIG_DEBUG_INFO_BTF", }, 376 /* Kernel module BTF debug information available */ 377 { "CONFIG_DEBUG_INFO_BTF_MODULES", }, 378 379 /* cgroups */ 380 { "CONFIG_CGROUPS", }, 381 /* BPF programs attached to cgroups */ 382 { "CONFIG_CGROUP_BPF", }, 383 /* bpf_get_cgroup_classid() helper */ 384 { "CONFIG_CGROUP_NET_CLASSID", }, 385 /* bpf_skb_{,ancestor_}cgroup_id() helpers */ 386 { "CONFIG_SOCK_CGROUP_DATA", }, 387 388 /* Tracing: attach BPF to kprobes, tracepoints, etc. */ 389 { "CONFIG_BPF_EVENTS", }, 390 /* Kprobes */ 391 { "CONFIG_KPROBE_EVENTS", }, 392 /* Uprobes */ 393 { "CONFIG_UPROBE_EVENTS", }, 394 /* Tracepoints */ 395 { "CONFIG_TRACING", }, 396 /* Syscall tracepoints */ 397 { "CONFIG_FTRACE_SYSCALLS", }, 398 /* bpf_override_return() helper support for selected arch */ 399 { "CONFIG_FUNCTION_ERROR_INJECTION", }, 400 /* bpf_override_return() helper */ 401 { "CONFIG_BPF_KPROBE_OVERRIDE", }, 402 403 /* Network */ 404 { "CONFIG_NET", }, 405 /* AF_XDP sockets */ 406 { "CONFIG_XDP_SOCKETS", }, 407 /* BPF_PROG_TYPE_LWT_* and related helpers */ 408 { "CONFIG_LWTUNNEL_BPF", }, 409 /* BPF_PROG_TYPE_SCHED_ACT, TC (traffic control) actions */ 410 { "CONFIG_NET_ACT_BPF", }, 411 /* BPF_PROG_TYPE_SCHED_CLS, TC filters */ 412 { "CONFIG_NET_CLS_BPF", }, 413 /* TC clsact qdisc */ 414 { "CONFIG_NET_CLS_ACT", }, 415 /* Ingress filtering with TC */ 416 { "CONFIG_NET_SCH_INGRESS", }, 417 /* bpf_skb_get_xfrm_state() helper */ 418 { "CONFIG_XFRM", }, 419 /* bpf_get_route_realm() helper */ 420 { "CONFIG_IP_ROUTE_CLASSID", }, 421 /* BPF_PROG_TYPE_LWT_SEG6_LOCAL and related helpers */ 422 { "CONFIG_IPV6_SEG6_BPF", }, 423 /* BPF_PROG_TYPE_LIRC_MODE2 and related helpers */ 424 { "CONFIG_BPF_LIRC_MODE2", }, 425 /* BPF stream parser and BPF socket maps */ 426 { "CONFIG_BPF_STREAM_PARSER", }, 427 /* xt_bpf module for passing BPF programs to netfilter */ 428 { "CONFIG_NETFILTER_XT_MATCH_BPF", }, 429 /* bpfilter back-end for iptables */ 430 { "CONFIG_BPFILTER", }, 431 /* bpftilter module with "user mode helper" */ 432 { "CONFIG_BPFILTER_UMH", }, 433 434 /* test_bpf module for BPF tests */ 435 { "CONFIG_TEST_BPF", }, 436 437 /* Misc configs useful in BPF C programs */ 438 /* jiffies <-> sec conversion for bpf_jiffies64() helper */ 439 { "CONFIG_HZ", true, } 440 }; 441 char *values[ARRAY_SIZE(options)] = { }; 442 struct utsname utsn; 443 char path[PATH_MAX]; 444 gzFile file = NULL; 445 char buf[4096]; 446 char *value; 447 size_t i; 448 449 if (!uname(&utsn)) { 450 snprintf(path, sizeof(path), "/boot/config-%s", utsn.release); 451 452 /* gzopen also accepts uncompressed files. */ 453 file = gzopen(path, "r"); 454 } 455 456 if (!file) { 457 /* Some distributions build with CONFIG_IKCONFIG=y and put the 458 * config file at /proc/config.gz. 459 */ 460 file = gzopen("/proc/config.gz", "r"); 461 } 462 if (!file) { 463 p_info("skipping kernel config, can't open file: %s", 464 strerror(errno)); 465 goto end_parse; 466 } 467 /* Sanity checks */ 468 if (!gzgets(file, buf, sizeof(buf)) || 469 !gzgets(file, buf, sizeof(buf))) { 470 p_info("skipping kernel config, can't read from file: %s", 471 strerror(errno)); 472 goto end_parse; 473 } 474 if (strcmp(buf, "# Automatically generated file; DO NOT EDIT.\n")) { 475 p_info("skipping kernel config, can't find correct file"); 476 goto end_parse; 477 } 478 479 while (read_next_kernel_config_option(file, buf, sizeof(buf), &value)) { 480 for (i = 0; i < ARRAY_SIZE(options); i++) { 481 if ((define_prefix && !options[i].macro_dump) || 482 values[i] || strcmp(buf, options[i].name)) 483 continue; 484 485 values[i] = strdup(value); 486 } 487 } 488 489 end_parse: 490 if (file) 491 gzclose(file); 492 493 for (i = 0; i < ARRAY_SIZE(options); i++) { 494 if (define_prefix && !options[i].macro_dump) 495 continue; 496 print_kernel_option(options[i].name, values[i], define_prefix); 497 free(values[i]); 498 } 499 } 500 501 static bool probe_bpf_syscall(const char *define_prefix) 502 { 503 bool res; 504 505 bpf_prog_load(BPF_PROG_TYPE_UNSPEC, NULL, NULL, NULL, 0, NULL); 506 res = (errno != ENOSYS); 507 508 print_bool_feature("have_bpf_syscall", 509 "bpf() syscall", 510 "BPF_SYSCALL", 511 res, define_prefix); 512 513 return res; 514 } 515 516 static bool 517 probe_prog_load_ifindex(enum bpf_prog_type prog_type, 518 const struct bpf_insn *insns, size_t insns_cnt, 519 char *log_buf, size_t log_buf_sz, 520 __u32 ifindex) 521 { 522 LIBBPF_OPTS(bpf_prog_load_opts, opts, 523 .log_buf = log_buf, 524 .log_size = log_buf_sz, 525 .log_level = log_buf ? 1 : 0, 526 .prog_ifindex = ifindex, 527 ); 528 int fd; 529 530 errno = 0; 531 fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts); 532 if (fd >= 0) 533 close(fd); 534 535 return fd >= 0 && errno != EINVAL && errno != EOPNOTSUPP; 536 } 537 538 static bool probe_prog_type_ifindex(enum bpf_prog_type prog_type, __u32 ifindex) 539 { 540 /* nfp returns -EINVAL on exit(0) with TC offload */ 541 struct bpf_insn insns[2] = { 542 BPF_MOV64_IMM(BPF_REG_0, 2), 543 BPF_EXIT_INSN() 544 }; 545 546 return probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns), 547 NULL, 0, ifindex); 548 } 549 550 static void 551 probe_prog_type(enum bpf_prog_type prog_type, bool *supported_types, 552 const char *define_prefix, __u32 ifindex) 553 { 554 char feat_name[128], plain_desc[128], define_name[128]; 555 const char *plain_comment = "eBPF program_type "; 556 size_t maxlen; 557 bool res; 558 559 if (ifindex) { 560 switch (prog_type) { 561 case BPF_PROG_TYPE_SCHED_CLS: 562 case BPF_PROG_TYPE_XDP: 563 break; 564 default: 565 return; 566 } 567 568 res = probe_prog_type_ifindex(prog_type, ifindex); 569 } else { 570 res = libbpf_probe_bpf_prog_type(prog_type, NULL); 571 } 572 573 #ifdef USE_LIBCAP 574 /* Probe may succeed even if program load fails, for unprivileged users 575 * check that we did not fail because of insufficient permissions 576 */ 577 if (run_as_unprivileged && errno == EPERM) 578 res = false; 579 #endif 580 581 supported_types[prog_type] |= res; 582 583 if (!prog_type_name[prog_type]) { 584 p_info("program type name not found (type %d)", prog_type); 585 return; 586 } 587 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1; 588 if (strlen(prog_type_name[prog_type]) > maxlen) { 589 p_info("program type name too long"); 590 return; 591 } 592 593 sprintf(feat_name, "have_%s_prog_type", prog_type_name[prog_type]); 594 sprintf(define_name, "%s_prog_type", prog_type_name[prog_type]); 595 uppercase(define_name, sizeof(define_name)); 596 sprintf(plain_desc, "%s%s", plain_comment, prog_type_name[prog_type]); 597 print_bool_feature(feat_name, plain_desc, define_name, res, 598 define_prefix); 599 } 600 601 static bool probe_map_type_ifindex(enum bpf_map_type map_type, __u32 ifindex) 602 { 603 LIBBPF_OPTS(bpf_map_create_opts, opts); 604 int key_size, value_size, max_entries; 605 int fd; 606 607 opts.map_ifindex = ifindex; 608 609 key_size = sizeof(__u32); 610 value_size = sizeof(__u32); 611 max_entries = 1; 612 613 fd = bpf_map_create(map_type, NULL, key_size, value_size, max_entries, 614 &opts); 615 if (fd >= 0) 616 close(fd); 617 618 return fd >= 0; 619 } 620 621 static void 622 probe_map_type(enum bpf_map_type map_type, const char *define_prefix, 623 __u32 ifindex) 624 { 625 char feat_name[128], plain_desc[128], define_name[128]; 626 const char *plain_comment = "eBPF map_type "; 627 size_t maxlen; 628 bool res; 629 630 if (ifindex) { 631 switch (map_type) { 632 case BPF_MAP_TYPE_HASH: 633 case BPF_MAP_TYPE_ARRAY: 634 break; 635 default: 636 return; 637 } 638 639 res = probe_map_type_ifindex(map_type, ifindex); 640 } else { 641 res = libbpf_probe_bpf_map_type(map_type, NULL); 642 } 643 644 /* Probe result depends on the success of map creation, no additional 645 * check required for unprivileged users 646 */ 647 648 if (!map_type_name[map_type]) { 649 p_info("map type name not found (type %d)", map_type); 650 return; 651 } 652 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1; 653 if (strlen(map_type_name[map_type]) > maxlen) { 654 p_info("map type name too long"); 655 return; 656 } 657 658 sprintf(feat_name, "have_%s_map_type", map_type_name[map_type]); 659 sprintf(define_name, "%s_map_type", map_type_name[map_type]); 660 uppercase(define_name, sizeof(define_name)); 661 sprintf(plain_desc, "%s%s", plain_comment, map_type_name[map_type]); 662 print_bool_feature(feat_name, plain_desc, define_name, res, 663 define_prefix); 664 } 665 666 static bool 667 probe_helper_ifindex(enum bpf_func_id id, enum bpf_prog_type prog_type, 668 __u32 ifindex) 669 { 670 struct bpf_insn insns[2] = { 671 BPF_EMIT_CALL(id), 672 BPF_EXIT_INSN() 673 }; 674 char buf[4096] = {}; 675 bool res; 676 677 probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns), buf, 678 sizeof(buf), ifindex); 679 res = !grep(buf, "invalid func ") && !grep(buf, "unknown func "); 680 681 switch (get_vendor_id(ifindex)) { 682 case 0x19ee: /* Netronome specific */ 683 res = res && !grep(buf, "not supported by FW") && 684 !grep(buf, "unsupported function id"); 685 break; 686 default: 687 break; 688 } 689 690 return res; 691 } 692 693 static void 694 probe_helper_for_progtype(enum bpf_prog_type prog_type, bool supported_type, 695 const char *define_prefix, unsigned int id, 696 const char *ptype_name, __u32 ifindex) 697 { 698 bool res = false; 699 700 if (supported_type) { 701 if (ifindex) 702 res = probe_helper_ifindex(id, prog_type, ifindex); 703 else 704 res = libbpf_probe_bpf_helper(prog_type, id, NULL); 705 #ifdef USE_LIBCAP 706 /* Probe may succeed even if program load fails, for 707 * unprivileged users check that we did not fail because of 708 * insufficient permissions 709 */ 710 if (run_as_unprivileged && errno == EPERM) 711 res = false; 712 #endif 713 } 714 715 if (json_output) { 716 if (res) 717 jsonw_string(json_wtr, helper_name[id]); 718 } else if (define_prefix) { 719 printf("#define %sBPF__PROG_TYPE_%s__HELPER_%s %s\n", 720 define_prefix, ptype_name, helper_name[id], 721 res ? "1" : "0"); 722 } else { 723 if (res) 724 printf("\n\t- %s", helper_name[id]); 725 } 726 } 727 728 static void 729 probe_helpers_for_progtype(enum bpf_prog_type prog_type, bool supported_type, 730 const char *define_prefix, __u32 ifindex) 731 { 732 const char *ptype_name = prog_type_name[prog_type]; 733 char feat_name[128]; 734 unsigned int id; 735 736 if (ifindex) 737 /* Only test helpers for offload-able program types */ 738 switch (prog_type) { 739 case BPF_PROG_TYPE_SCHED_CLS: 740 case BPF_PROG_TYPE_XDP: 741 break; 742 default: 743 return; 744 } 745 746 if (json_output) { 747 sprintf(feat_name, "%s_available_helpers", ptype_name); 748 jsonw_name(json_wtr, feat_name); 749 jsonw_start_array(json_wtr); 750 } else if (!define_prefix) { 751 printf("eBPF helpers supported for program type %s:", 752 ptype_name); 753 } 754 755 for (id = 1; id < ARRAY_SIZE(helper_name); id++) { 756 /* Skip helper functions which emit dmesg messages when not in 757 * the full mode. 758 */ 759 switch (id) { 760 case BPF_FUNC_trace_printk: 761 case BPF_FUNC_trace_vprintk: 762 case BPF_FUNC_probe_write_user: 763 if (!full_mode) 764 continue; 765 /* fallthrough */ 766 default: 767 probe_helper_for_progtype(prog_type, supported_type, 768 define_prefix, id, ptype_name, 769 ifindex); 770 } 771 } 772 773 if (json_output) 774 jsonw_end_array(json_wtr); 775 else if (!define_prefix) 776 printf("\n"); 777 } 778 779 static void 780 probe_misc_feature(struct bpf_insn *insns, size_t len, 781 const char *define_prefix, __u32 ifindex, 782 const char *feat_name, const char *plain_name, 783 const char *define_name) 784 { 785 LIBBPF_OPTS(bpf_prog_load_opts, opts, 786 .prog_ifindex = ifindex, 787 ); 788 bool res; 789 int fd; 790 791 errno = 0; 792 fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", 793 insns, len, &opts); 794 res = fd >= 0 || !errno; 795 796 if (fd >= 0) 797 close(fd); 798 799 print_bool_feature(feat_name, plain_name, define_name, res, 800 define_prefix); 801 } 802 803 /* 804 * Probe for availability of kernel commit (5.3): 805 * 806 * c04c0d2b968a ("bpf: increase complexity limit and maximum program size") 807 */ 808 static void probe_large_insn_limit(const char *define_prefix, __u32 ifindex) 809 { 810 struct bpf_insn insns[BPF_MAXINSNS + 1]; 811 int i; 812 813 for (i = 0; i < BPF_MAXINSNS; i++) 814 insns[i] = BPF_MOV64_IMM(BPF_REG_0, 1); 815 insns[BPF_MAXINSNS] = BPF_EXIT_INSN(); 816 817 probe_misc_feature(insns, ARRAY_SIZE(insns), 818 define_prefix, ifindex, 819 "have_large_insn_limit", 820 "Large program size limit", 821 "LARGE_INSN_LIMIT"); 822 } 823 824 /* 825 * Probe for bounded loop support introduced in commit 2589726d12a1 826 * ("bpf: introduce bounded loops"). 827 */ 828 static void 829 probe_bounded_loops(const char *define_prefix, __u32 ifindex) 830 { 831 struct bpf_insn insns[4] = { 832 BPF_MOV64_IMM(BPF_REG_0, 10), 833 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 1), 834 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, -2), 835 BPF_EXIT_INSN() 836 }; 837 838 probe_misc_feature(insns, ARRAY_SIZE(insns), 839 define_prefix, ifindex, 840 "have_bounded_loops", 841 "Bounded loop support", 842 "BOUNDED_LOOPS"); 843 } 844 845 /* 846 * Probe for the v2 instruction set extension introduced in commit 92b31a9af73b 847 * ("bpf: add BPF_J{LT,LE,SLT,SLE} instructions"). 848 */ 849 static void 850 probe_v2_isa_extension(const char *define_prefix, __u32 ifindex) 851 { 852 struct bpf_insn insns[4] = { 853 BPF_MOV64_IMM(BPF_REG_0, 0), 854 BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 0, 1), 855 BPF_MOV64_IMM(BPF_REG_0, 1), 856 BPF_EXIT_INSN() 857 }; 858 859 probe_misc_feature(insns, ARRAY_SIZE(insns), 860 define_prefix, ifindex, 861 "have_v2_isa_extension", 862 "ISA extension v2", 863 "V2_ISA_EXTENSION"); 864 } 865 866 /* 867 * Probe for the v3 instruction set extension introduced in commit 092ed0968bb6 868 * ("bpf: verifier support JMP32"). 869 */ 870 static void 871 probe_v3_isa_extension(const char *define_prefix, __u32 ifindex) 872 { 873 struct bpf_insn insns[4] = { 874 BPF_MOV64_IMM(BPF_REG_0, 0), 875 BPF_JMP32_IMM(BPF_JLT, BPF_REG_0, 0, 1), 876 BPF_MOV64_IMM(BPF_REG_0, 1), 877 BPF_EXIT_INSN() 878 }; 879 880 probe_misc_feature(insns, ARRAY_SIZE(insns), 881 define_prefix, ifindex, 882 "have_v3_isa_extension", 883 "ISA extension v3", 884 "V3_ISA_EXTENSION"); 885 } 886 887 static void 888 section_system_config(enum probe_component target, const char *define_prefix) 889 { 890 switch (target) { 891 case COMPONENT_KERNEL: 892 case COMPONENT_UNSPEC: 893 print_start_section("system_config", 894 "Scanning system configuration...", 895 "/*** Misc kernel config items ***/", 896 define_prefix); 897 if (!define_prefix) { 898 if (check_procfs()) { 899 probe_unprivileged_disabled(); 900 probe_jit_enable(); 901 probe_jit_harden(); 902 probe_jit_kallsyms(); 903 probe_jit_limit(); 904 } else { 905 p_info("/* procfs not mounted, skipping related probes */"); 906 } 907 } 908 probe_kernel_image_config(define_prefix); 909 print_end_section(); 910 break; 911 default: 912 break; 913 } 914 } 915 916 static bool section_syscall_config(const char *define_prefix) 917 { 918 bool res; 919 920 print_start_section("syscall_config", 921 "Scanning system call availability...", 922 "/*** System call availability ***/", 923 define_prefix); 924 res = probe_bpf_syscall(define_prefix); 925 print_end_section(); 926 927 return res; 928 } 929 930 static void 931 section_program_types(bool *supported_types, const char *define_prefix, 932 __u32 ifindex) 933 { 934 unsigned int i; 935 936 print_start_section("program_types", 937 "Scanning eBPF program types...", 938 "/*** eBPF program types ***/", 939 define_prefix); 940 941 for (i = BPF_PROG_TYPE_UNSPEC + 1; i < prog_type_name_size; i++) 942 probe_prog_type(i, supported_types, define_prefix, ifindex); 943 944 print_end_section(); 945 } 946 947 static void section_map_types(const char *define_prefix, __u32 ifindex) 948 { 949 unsigned int i; 950 951 print_start_section("map_types", 952 "Scanning eBPF map types...", 953 "/*** eBPF map types ***/", 954 define_prefix); 955 956 for (i = BPF_MAP_TYPE_UNSPEC + 1; i < map_type_name_size; i++) 957 probe_map_type(i, define_prefix, ifindex); 958 959 print_end_section(); 960 } 961 962 static void 963 section_helpers(bool *supported_types, const char *define_prefix, __u32 ifindex) 964 { 965 unsigned int i; 966 967 print_start_section("helpers", 968 "Scanning eBPF helper functions...", 969 "/*** eBPF helper functions ***/", 970 define_prefix); 971 972 if (define_prefix) 973 printf("/*\n" 974 " * Use %sHAVE_PROG_TYPE_HELPER(prog_type_name, helper_name)\n" 975 " * to determine if <helper_name> is available for <prog_type_name>,\n" 976 " * e.g.\n" 977 " * #if %sHAVE_PROG_TYPE_HELPER(xdp, bpf_redirect)\n" 978 " * // do stuff with this helper\n" 979 " * #elif\n" 980 " * // use a workaround\n" 981 " * #endif\n" 982 " */\n" 983 "#define %sHAVE_PROG_TYPE_HELPER(prog_type, helper) \\\n" 984 " %sBPF__PROG_TYPE_ ## prog_type ## __HELPER_ ## helper\n", 985 define_prefix, define_prefix, define_prefix, 986 define_prefix); 987 for (i = BPF_PROG_TYPE_UNSPEC + 1; i < prog_type_name_size; i++) 988 probe_helpers_for_progtype(i, supported_types[i], define_prefix, 989 ifindex); 990 991 print_end_section(); 992 } 993 994 static void section_misc(const char *define_prefix, __u32 ifindex) 995 { 996 print_start_section("misc", 997 "Scanning miscellaneous eBPF features...", 998 "/*** eBPF misc features ***/", 999 define_prefix); 1000 probe_large_insn_limit(define_prefix, ifindex); 1001 probe_bounded_loops(define_prefix, ifindex); 1002 probe_v2_isa_extension(define_prefix, ifindex); 1003 probe_v3_isa_extension(define_prefix, ifindex); 1004 print_end_section(); 1005 } 1006 1007 #ifdef USE_LIBCAP 1008 #define capability(c) { c, false, #c } 1009 #define capability_msg(a, i) a[i].set ? "" : a[i].name, a[i].set ? "" : ", " 1010 #endif 1011 1012 static int handle_perms(void) 1013 { 1014 #ifdef USE_LIBCAP 1015 struct { 1016 cap_value_t cap; 1017 bool set; 1018 char name[14]; /* strlen("CAP_SYS_ADMIN") */ 1019 } bpf_caps[] = { 1020 capability(CAP_SYS_ADMIN), 1021 #ifdef CAP_BPF 1022 capability(CAP_BPF), 1023 capability(CAP_NET_ADMIN), 1024 capability(CAP_PERFMON), 1025 #endif 1026 }; 1027 cap_value_t cap_list[ARRAY_SIZE(bpf_caps)]; 1028 unsigned int i, nb_bpf_caps = 0; 1029 bool cap_sys_admin_only = true; 1030 cap_flag_value_t val; 1031 int res = -1; 1032 cap_t caps; 1033 1034 caps = cap_get_proc(); 1035 if (!caps) { 1036 p_err("failed to get capabilities for process: %s", 1037 strerror(errno)); 1038 return -1; 1039 } 1040 1041 #ifdef CAP_BPF 1042 if (CAP_IS_SUPPORTED(CAP_BPF)) 1043 cap_sys_admin_only = false; 1044 #endif 1045 1046 for (i = 0; i < ARRAY_SIZE(bpf_caps); i++) { 1047 const char *cap_name = bpf_caps[i].name; 1048 cap_value_t cap = bpf_caps[i].cap; 1049 1050 if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &val)) { 1051 p_err("bug: failed to retrieve %s status: %s", cap_name, 1052 strerror(errno)); 1053 goto exit_free; 1054 } 1055 1056 if (val == CAP_SET) { 1057 bpf_caps[i].set = true; 1058 cap_list[nb_bpf_caps++] = cap; 1059 } 1060 1061 if (cap_sys_admin_only) 1062 /* System does not know about CAP_BPF, meaning that 1063 * CAP_SYS_ADMIN is the only capability required. We 1064 * just checked it, break. 1065 */ 1066 break; 1067 } 1068 1069 if ((run_as_unprivileged && !nb_bpf_caps) || 1070 (!run_as_unprivileged && nb_bpf_caps == ARRAY_SIZE(bpf_caps)) || 1071 (!run_as_unprivileged && cap_sys_admin_only && nb_bpf_caps)) { 1072 /* We are all good, exit now */ 1073 res = 0; 1074 goto exit_free; 1075 } 1076 1077 if (!run_as_unprivileged) { 1078 if (cap_sys_admin_only) 1079 p_err("missing %s, required for full feature probing; run as root or use 'unprivileged'", 1080 bpf_caps[0].name); 1081 else 1082 p_err("missing %s%s%s%s%s%s%s%srequired for full feature probing; run as root or use 'unprivileged'", 1083 capability_msg(bpf_caps, 0), 1084 #ifdef CAP_BPF 1085 capability_msg(bpf_caps, 1), 1086 capability_msg(bpf_caps, 2), 1087 capability_msg(bpf_caps, 3) 1088 #else 1089 "", "", "", "", "", "" 1090 #endif /* CAP_BPF */ 1091 ); 1092 goto exit_free; 1093 } 1094 1095 /* if (run_as_unprivileged && nb_bpf_caps > 0), drop capabilities. */ 1096 if (cap_set_flag(caps, CAP_EFFECTIVE, nb_bpf_caps, cap_list, 1097 CAP_CLEAR)) { 1098 p_err("bug: failed to clear capabilities: %s", strerror(errno)); 1099 goto exit_free; 1100 } 1101 1102 if (cap_set_proc(caps)) { 1103 p_err("failed to drop capabilities: %s", strerror(errno)); 1104 goto exit_free; 1105 } 1106 1107 res = 0; 1108 1109 exit_free: 1110 if (cap_free(caps) && !res) { 1111 p_err("failed to clear storage object for capabilities: %s", 1112 strerror(errno)); 1113 res = -1; 1114 } 1115 1116 return res; 1117 #else 1118 /* Detection assumes user has specific privileges. 1119 * We do not use libpcap so let's approximate, and restrict usage to 1120 * root user only. 1121 */ 1122 if (geteuid()) { 1123 p_err("full feature probing requires root privileges"); 1124 return -1; 1125 } 1126 1127 return 0; 1128 #endif /* USE_LIBCAP */ 1129 } 1130 1131 static int do_probe(int argc, char **argv) 1132 { 1133 enum probe_component target = COMPONENT_UNSPEC; 1134 const char *define_prefix = NULL; 1135 bool supported_types[128] = {}; 1136 __u32 ifindex = 0; 1137 char *ifname; 1138 1139 set_max_rlimit(); 1140 1141 while (argc) { 1142 if (is_prefix(*argv, "kernel")) { 1143 if (target != COMPONENT_UNSPEC) { 1144 p_err("component to probe already specified"); 1145 return -1; 1146 } 1147 target = COMPONENT_KERNEL; 1148 NEXT_ARG(); 1149 } else if (is_prefix(*argv, "dev")) { 1150 NEXT_ARG(); 1151 1152 if (target != COMPONENT_UNSPEC || ifindex) { 1153 p_err("component to probe already specified"); 1154 return -1; 1155 } 1156 if (!REQ_ARGS(1)) 1157 return -1; 1158 1159 target = COMPONENT_DEVICE; 1160 ifname = GET_ARG(); 1161 ifindex = if_nametoindex(ifname); 1162 if (!ifindex) { 1163 p_err("unrecognized netdevice '%s': %s", ifname, 1164 strerror(errno)); 1165 return -1; 1166 } 1167 } else if (is_prefix(*argv, "full")) { 1168 full_mode = true; 1169 NEXT_ARG(); 1170 } else if (is_prefix(*argv, "macros") && !define_prefix) { 1171 define_prefix = ""; 1172 NEXT_ARG(); 1173 } else if (is_prefix(*argv, "prefix")) { 1174 if (!define_prefix) { 1175 p_err("'prefix' argument can only be use after 'macros'"); 1176 return -1; 1177 } 1178 if (strcmp(define_prefix, "")) { 1179 p_err("'prefix' already defined"); 1180 return -1; 1181 } 1182 NEXT_ARG(); 1183 1184 if (!REQ_ARGS(1)) 1185 return -1; 1186 define_prefix = GET_ARG(); 1187 } else if (is_prefix(*argv, "unprivileged")) { 1188 #ifdef USE_LIBCAP 1189 run_as_unprivileged = true; 1190 NEXT_ARG(); 1191 #else 1192 p_err("unprivileged run not supported, recompile bpftool with libcap"); 1193 return -1; 1194 #endif 1195 } else { 1196 p_err("expected no more arguments, 'kernel', 'dev', 'macros' or 'prefix', got: '%s'?", 1197 *argv); 1198 return -1; 1199 } 1200 } 1201 1202 /* Full feature detection requires specific privileges. 1203 * Let's approximate, and warn if user is not root. 1204 */ 1205 if (handle_perms()) 1206 return -1; 1207 1208 if (json_output) { 1209 define_prefix = NULL; 1210 jsonw_start_object(json_wtr); 1211 } 1212 1213 section_system_config(target, define_prefix); 1214 if (!section_syscall_config(define_prefix)) 1215 /* bpf() syscall unavailable, don't probe other BPF features */ 1216 goto exit_close_json; 1217 section_program_types(supported_types, define_prefix, ifindex); 1218 section_map_types(define_prefix, ifindex); 1219 section_helpers(supported_types, define_prefix, ifindex); 1220 section_misc(define_prefix, ifindex); 1221 1222 exit_close_json: 1223 if (json_output) 1224 /* End root object */ 1225 jsonw_end_object(json_wtr); 1226 1227 return 0; 1228 } 1229 1230 static int do_help(int argc, char **argv) 1231 { 1232 if (json_output) { 1233 jsonw_null(json_wtr); 1234 return 0; 1235 } 1236 1237 fprintf(stderr, 1238 "Usage: %1$s %2$s probe [COMPONENT] [full] [unprivileged] [macros [prefix PREFIX]]\n" 1239 " %1$s %2$s help\n" 1240 "\n" 1241 " COMPONENT := { kernel | dev NAME }\n" 1242 " " HELP_SPEC_OPTIONS " }\n" 1243 "", 1244 bin_name, argv[-2]); 1245 1246 return 0; 1247 } 1248 1249 static const struct cmd cmds[] = { 1250 { "probe", do_probe }, 1251 { "help", do_help }, 1252 { 0 } 1253 }; 1254 1255 int do_feature(int argc, char **argv) 1256 { 1257 return cmd_select(cmds, argc, argv, do_help); 1258 } 1259