Loading...
Note: File does not exist in v4.6.
1// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
2/* Copyright (c) 2019 Netronome Systems, Inc. */
3
4#include <ctype.h>
5#include <errno.h>
6#include <string.h>
7#include <unistd.h>
8#include <net/if.h>
9#include <sys/utsname.h>
10#include <sys/vfs.h>
11
12#include <linux/filter.h>
13#include <linux/limits.h>
14
15#include <bpf.h>
16#include <libbpf.h>
17#include <zlib.h>
18
19#include "main.h"
20
21#ifndef PROC_SUPER_MAGIC
22# define PROC_SUPER_MAGIC 0x9fa0
23#endif
24
25enum probe_component {
26 COMPONENT_UNSPEC,
27 COMPONENT_KERNEL,
28 COMPONENT_DEVICE,
29};
30
31#define BPF_HELPER_MAKE_ENTRY(name) [BPF_FUNC_ ## name] = "bpf_" # name
32static const char * const helper_name[] = {
33 __BPF_FUNC_MAPPER(BPF_HELPER_MAKE_ENTRY)
34};
35
36#undef BPF_HELPER_MAKE_ENTRY
37
38/* Miscellaneous utility functions */
39
40static bool check_procfs(void)
41{
42 struct statfs st_fs;
43
44 if (statfs("/proc", &st_fs) < 0)
45 return false;
46 if ((unsigned long)st_fs.f_type != PROC_SUPER_MAGIC)
47 return false;
48
49 return true;
50}
51
52static void uppercase(char *str, size_t len)
53{
54 size_t i;
55
56 for (i = 0; i < len && str[i] != '\0'; i++)
57 str[i] = toupper(str[i]);
58}
59
60/* Printing utility functions */
61
62static void
63print_bool_feature(const char *feat_name, const char *plain_name,
64 const char *define_name, bool res, const char *define_prefix)
65{
66 if (json_output)
67 jsonw_bool_field(json_wtr, feat_name, res);
68 else if (define_prefix)
69 printf("#define %s%sHAVE_%s\n", define_prefix,
70 res ? "" : "NO_", define_name);
71 else
72 printf("%s is %savailable\n", plain_name, res ? "" : "NOT ");
73}
74
75static void print_kernel_option(const char *name, const char *value)
76{
77 char *endptr;
78 int res;
79
80 /* No support for C-style ouptut */
81
82 if (json_output) {
83 if (!value) {
84 jsonw_null_field(json_wtr, name);
85 return;
86 }
87 errno = 0;
88 res = strtol(value, &endptr, 0);
89 if (!errno && *endptr == '\n')
90 jsonw_int_field(json_wtr, name, res);
91 else
92 jsonw_string_field(json_wtr, name, value);
93 } else {
94 if (value)
95 printf("%s is set to %s\n", name, value);
96 else
97 printf("%s is not set\n", name);
98 }
99}
100
101static void
102print_start_section(const char *json_title, const char *plain_title,
103 const char *define_comment, const char *define_prefix)
104{
105 if (json_output) {
106 jsonw_name(json_wtr, json_title);
107 jsonw_start_object(json_wtr);
108 } else if (define_prefix) {
109 printf("%s\n", define_comment);
110 } else {
111 printf("%s\n", plain_title);
112 }
113}
114
115static void
116print_end_then_start_section(const char *json_title, const char *plain_title,
117 const char *define_comment,
118 const char *define_prefix)
119{
120 if (json_output)
121 jsonw_end_object(json_wtr);
122 else
123 printf("\n");
124
125 print_start_section(json_title, plain_title, define_comment,
126 define_prefix);
127}
128
129/* Probing functions */
130
131static int read_procfs(const char *path)
132{
133 char *endptr, *line = NULL;
134 size_t len = 0;
135 FILE *fd;
136 int res;
137
138 fd = fopen(path, "r");
139 if (!fd)
140 return -1;
141
142 res = getline(&line, &len, fd);
143 fclose(fd);
144 if (res < 0)
145 return -1;
146
147 errno = 0;
148 res = strtol(line, &endptr, 10);
149 if (errno || *line == '\0' || *endptr != '\n')
150 res = -1;
151 free(line);
152
153 return res;
154}
155
156static void probe_unprivileged_disabled(void)
157{
158 int res;
159
160 /* No support for C-style ouptut */
161
162 res = read_procfs("/proc/sys/kernel/unprivileged_bpf_disabled");
163 if (json_output) {
164 jsonw_int_field(json_wtr, "unprivileged_bpf_disabled", res);
165 } else {
166 switch (res) {
167 case 0:
168 printf("bpf() syscall for unprivileged users is enabled\n");
169 break;
170 case 1:
171 printf("bpf() syscall restricted to privileged users\n");
172 break;
173 case -1:
174 printf("Unable to retrieve required privileges for bpf() syscall\n");
175 break;
176 default:
177 printf("bpf() syscall restriction has unknown value %d\n", res);
178 }
179 }
180}
181
182static void probe_jit_enable(void)
183{
184 int res;
185
186 /* No support for C-style ouptut */
187
188 res = read_procfs("/proc/sys/net/core/bpf_jit_enable");
189 if (json_output) {
190 jsonw_int_field(json_wtr, "bpf_jit_enable", res);
191 } else {
192 switch (res) {
193 case 0:
194 printf("JIT compiler is disabled\n");
195 break;
196 case 1:
197 printf("JIT compiler is enabled\n");
198 break;
199 case 2:
200 printf("JIT compiler is enabled with debugging traces in kernel logs\n");
201 break;
202 case -1:
203 printf("Unable to retrieve JIT-compiler status\n");
204 break;
205 default:
206 printf("JIT-compiler status has unknown value %d\n",
207 res);
208 }
209 }
210}
211
212static void probe_jit_harden(void)
213{
214 int res;
215
216 /* No support for C-style ouptut */
217
218 res = read_procfs("/proc/sys/net/core/bpf_jit_harden");
219 if (json_output) {
220 jsonw_int_field(json_wtr, "bpf_jit_harden", res);
221 } else {
222 switch (res) {
223 case 0:
224 printf("JIT compiler hardening is disabled\n");
225 break;
226 case 1:
227 printf("JIT compiler hardening is enabled for unprivileged users\n");
228 break;
229 case 2:
230 printf("JIT compiler hardening is enabled for all users\n");
231 break;
232 case -1:
233 printf("Unable to retrieve JIT hardening status\n");
234 break;
235 default:
236 printf("JIT hardening status has unknown value %d\n",
237 res);
238 }
239 }
240}
241
242static void probe_jit_kallsyms(void)
243{
244 int res;
245
246 /* No support for C-style ouptut */
247
248 res = read_procfs("/proc/sys/net/core/bpf_jit_kallsyms");
249 if (json_output) {
250 jsonw_int_field(json_wtr, "bpf_jit_kallsyms", res);
251 } else {
252 switch (res) {
253 case 0:
254 printf("JIT compiler kallsyms exports are disabled\n");
255 break;
256 case 1:
257 printf("JIT compiler kallsyms exports are enabled for root\n");
258 break;
259 case -1:
260 printf("Unable to retrieve JIT kallsyms export status\n");
261 break;
262 default:
263 printf("JIT kallsyms exports status has unknown value %d\n", res);
264 }
265 }
266}
267
268static void probe_jit_limit(void)
269{
270 int res;
271
272 /* No support for C-style ouptut */
273
274 res = read_procfs("/proc/sys/net/core/bpf_jit_limit");
275 if (json_output) {
276 jsonw_int_field(json_wtr, "bpf_jit_limit", res);
277 } else {
278 switch (res) {
279 case -1:
280 printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n");
281 break;
282 default:
283 printf("Global memory limit for JIT compiler for unprivileged users is %d bytes\n", res);
284 }
285 }
286}
287
288static bool read_next_kernel_config_option(gzFile file, char *buf, size_t n,
289 char **value)
290{
291 char *sep;
292
293 while (gzgets(file, buf, n)) {
294 if (strncmp(buf, "CONFIG_", 7))
295 continue;
296
297 sep = strchr(buf, '=');
298 if (!sep)
299 continue;
300
301 /* Trim ending '\n' */
302 buf[strlen(buf) - 1] = '\0';
303
304 /* Split on '=' and ensure that a value is present. */
305 *sep = '\0';
306 if (!sep[1])
307 continue;
308
309 *value = sep + 1;
310 return true;
311 }
312
313 return false;
314}
315
316static void probe_kernel_image_config(void)
317{
318 static const char * const options[] = {
319 /* Enable BPF */
320 "CONFIG_BPF",
321 /* Enable bpf() syscall */
322 "CONFIG_BPF_SYSCALL",
323 /* Does selected architecture support eBPF JIT compiler */
324 "CONFIG_HAVE_EBPF_JIT",
325 /* Compile eBPF JIT compiler */
326 "CONFIG_BPF_JIT",
327 /* Avoid compiling eBPF interpreter (use JIT only) */
328 "CONFIG_BPF_JIT_ALWAYS_ON",
329
330 /* cgroups */
331 "CONFIG_CGROUPS",
332 /* BPF programs attached to cgroups */
333 "CONFIG_CGROUP_BPF",
334 /* bpf_get_cgroup_classid() helper */
335 "CONFIG_CGROUP_NET_CLASSID",
336 /* bpf_skb_{,ancestor_}cgroup_id() helpers */
337 "CONFIG_SOCK_CGROUP_DATA",
338
339 /* Tracing: attach BPF to kprobes, tracepoints, etc. */
340 "CONFIG_BPF_EVENTS",
341 /* Kprobes */
342 "CONFIG_KPROBE_EVENTS",
343 /* Uprobes */
344 "CONFIG_UPROBE_EVENTS",
345 /* Tracepoints */
346 "CONFIG_TRACING",
347 /* Syscall tracepoints */
348 "CONFIG_FTRACE_SYSCALLS",
349 /* bpf_override_return() helper support for selected arch */
350 "CONFIG_FUNCTION_ERROR_INJECTION",
351 /* bpf_override_return() helper */
352 "CONFIG_BPF_KPROBE_OVERRIDE",
353
354 /* Network */
355 "CONFIG_NET",
356 /* AF_XDP sockets */
357 "CONFIG_XDP_SOCKETS",
358 /* BPF_PROG_TYPE_LWT_* and related helpers */
359 "CONFIG_LWTUNNEL_BPF",
360 /* BPF_PROG_TYPE_SCHED_ACT, TC (traffic control) actions */
361 "CONFIG_NET_ACT_BPF",
362 /* BPF_PROG_TYPE_SCHED_CLS, TC filters */
363 "CONFIG_NET_CLS_BPF",
364 /* TC clsact qdisc */
365 "CONFIG_NET_CLS_ACT",
366 /* Ingress filtering with TC */
367 "CONFIG_NET_SCH_INGRESS",
368 /* bpf_skb_get_xfrm_state() helper */
369 "CONFIG_XFRM",
370 /* bpf_get_route_realm() helper */
371 "CONFIG_IP_ROUTE_CLASSID",
372 /* BPF_PROG_TYPE_LWT_SEG6_LOCAL and related helpers */
373 "CONFIG_IPV6_SEG6_BPF",
374 /* BPF_PROG_TYPE_LIRC_MODE2 and related helpers */
375 "CONFIG_BPF_LIRC_MODE2",
376 /* BPF stream parser and BPF socket maps */
377 "CONFIG_BPF_STREAM_PARSER",
378 /* xt_bpf module for passing BPF programs to netfilter */
379 "CONFIG_NETFILTER_XT_MATCH_BPF",
380 /* bpfilter back-end for iptables */
381 "CONFIG_BPFILTER",
382 /* bpftilter module with "user mode helper" */
383 "CONFIG_BPFILTER_UMH",
384
385 /* test_bpf module for BPF tests */
386 "CONFIG_TEST_BPF",
387 };
388 char *values[ARRAY_SIZE(options)] = { };
389 struct utsname utsn;
390 char path[PATH_MAX];
391 gzFile file = NULL;
392 char buf[4096];
393 char *value;
394 size_t i;
395
396 if (!uname(&utsn)) {
397 snprintf(path, sizeof(path), "/boot/config-%s", utsn.release);
398
399 /* gzopen also accepts uncompressed files. */
400 file = gzopen(path, "r");
401 }
402
403 if (!file) {
404 /* Some distributions build with CONFIG_IKCONFIG=y and put the
405 * config file at /proc/config.gz.
406 */
407 file = gzopen("/proc/config.gz", "r");
408 }
409 if (!file) {
410 p_info("skipping kernel config, can't open file: %s",
411 strerror(errno));
412 goto end_parse;
413 }
414 /* Sanity checks */
415 if (!gzgets(file, buf, sizeof(buf)) ||
416 !gzgets(file, buf, sizeof(buf))) {
417 p_info("skipping kernel config, can't read from file: %s",
418 strerror(errno));
419 goto end_parse;
420 }
421 if (strcmp(buf, "# Automatically generated file; DO NOT EDIT.\n")) {
422 p_info("skipping kernel config, can't find correct file");
423 goto end_parse;
424 }
425
426 while (read_next_kernel_config_option(file, buf, sizeof(buf), &value)) {
427 for (i = 0; i < ARRAY_SIZE(options); i++) {
428 if (values[i] || strcmp(buf, options[i]))
429 continue;
430
431 values[i] = strdup(value);
432 }
433 }
434
435end_parse:
436 if (file)
437 gzclose(file);
438
439 for (i = 0; i < ARRAY_SIZE(options); i++) {
440 print_kernel_option(options[i], values[i]);
441 free(values[i]);
442 }
443}
444
445static bool probe_bpf_syscall(const char *define_prefix)
446{
447 bool res;
448
449 bpf_load_program(BPF_PROG_TYPE_UNSPEC, NULL, 0, NULL, 0, NULL, 0);
450 res = (errno != ENOSYS);
451
452 print_bool_feature("have_bpf_syscall",
453 "bpf() syscall",
454 "BPF_SYSCALL",
455 res, define_prefix);
456
457 return res;
458}
459
460static void
461probe_prog_type(enum bpf_prog_type prog_type, bool *supported_types,
462 const char *define_prefix, __u32 ifindex)
463{
464 char feat_name[128], plain_desc[128], define_name[128];
465 const char *plain_comment = "eBPF program_type ";
466 size_t maxlen;
467 bool res;
468
469 if (ifindex)
470 /* Only test offload-able program types */
471 switch (prog_type) {
472 case BPF_PROG_TYPE_SCHED_CLS:
473 case BPF_PROG_TYPE_XDP:
474 break;
475 default:
476 return;
477 }
478
479 res = bpf_probe_prog_type(prog_type, ifindex);
480
481 supported_types[prog_type] |= res;
482
483 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1;
484 if (strlen(prog_type_name[prog_type]) > maxlen) {
485 p_info("program type name too long");
486 return;
487 }
488
489 sprintf(feat_name, "have_%s_prog_type", prog_type_name[prog_type]);
490 sprintf(define_name, "%s_prog_type", prog_type_name[prog_type]);
491 uppercase(define_name, sizeof(define_name));
492 sprintf(plain_desc, "%s%s", plain_comment, prog_type_name[prog_type]);
493 print_bool_feature(feat_name, plain_desc, define_name, res,
494 define_prefix);
495}
496
497static void
498probe_map_type(enum bpf_map_type map_type, const char *define_prefix,
499 __u32 ifindex)
500{
501 char feat_name[128], plain_desc[128], define_name[128];
502 const char *plain_comment = "eBPF map_type ";
503 size_t maxlen;
504 bool res;
505
506 res = bpf_probe_map_type(map_type, ifindex);
507
508 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1;
509 if (strlen(map_type_name[map_type]) > maxlen) {
510 p_info("map type name too long");
511 return;
512 }
513
514 sprintf(feat_name, "have_%s_map_type", map_type_name[map_type]);
515 sprintf(define_name, "%s_map_type", map_type_name[map_type]);
516 uppercase(define_name, sizeof(define_name));
517 sprintf(plain_desc, "%s%s", plain_comment, map_type_name[map_type]);
518 print_bool_feature(feat_name, plain_desc, define_name, res,
519 define_prefix);
520}
521
522static void
523probe_helpers_for_progtype(enum bpf_prog_type prog_type, bool supported_type,
524 const char *define_prefix, __u32 ifindex)
525{
526 const char *ptype_name = prog_type_name[prog_type];
527 char feat_name[128];
528 unsigned int id;
529 bool res;
530
531 if (ifindex)
532 /* Only test helpers for offload-able program types */
533 switch (prog_type) {
534 case BPF_PROG_TYPE_SCHED_CLS:
535 case BPF_PROG_TYPE_XDP:
536 break;
537 default:
538 return;
539 }
540
541 if (json_output) {
542 sprintf(feat_name, "%s_available_helpers", ptype_name);
543 jsonw_name(json_wtr, feat_name);
544 jsonw_start_array(json_wtr);
545 } else if (!define_prefix) {
546 printf("eBPF helpers supported for program type %s:",
547 ptype_name);
548 }
549
550 for (id = 1; id < ARRAY_SIZE(helper_name); id++) {
551 if (!supported_type)
552 res = false;
553 else
554 res = bpf_probe_helper(id, prog_type, ifindex);
555
556 if (json_output) {
557 if (res)
558 jsonw_string(json_wtr, helper_name[id]);
559 } else if (define_prefix) {
560 printf("#define %sBPF__PROG_TYPE_%s__HELPER_%s %s\n",
561 define_prefix, ptype_name, helper_name[id],
562 res ? "1" : "0");
563 } else {
564 if (res)
565 printf("\n\t- %s", helper_name[id]);
566 }
567 }
568
569 if (json_output)
570 jsonw_end_array(json_wtr);
571 else if (!define_prefix)
572 printf("\n");
573}
574
575static int do_probe(int argc, char **argv)
576{
577 enum probe_component target = COMPONENT_UNSPEC;
578 const char *define_prefix = NULL;
579 bool supported_types[128] = {};
580 __u32 ifindex = 0;
581 unsigned int i;
582 char *ifname;
583
584 /* Detection assumes user has sufficient privileges (CAP_SYS_ADMIN).
585 * Let's approximate, and restrict usage to root user only.
586 */
587 if (geteuid()) {
588 p_err("please run this command as root user");
589 return -1;
590 }
591
592 set_max_rlimit();
593
594 while (argc) {
595 if (is_prefix(*argv, "kernel")) {
596 if (target != COMPONENT_UNSPEC) {
597 p_err("component to probe already specified");
598 return -1;
599 }
600 target = COMPONENT_KERNEL;
601 NEXT_ARG();
602 } else if (is_prefix(*argv, "dev")) {
603 NEXT_ARG();
604
605 if (target != COMPONENT_UNSPEC || ifindex) {
606 p_err("component to probe already specified");
607 return -1;
608 }
609 if (!REQ_ARGS(1))
610 return -1;
611
612 target = COMPONENT_DEVICE;
613 ifname = GET_ARG();
614 ifindex = if_nametoindex(ifname);
615 if (!ifindex) {
616 p_err("unrecognized netdevice '%s': %s", ifname,
617 strerror(errno));
618 return -1;
619 }
620 } else if (is_prefix(*argv, "macros") && !define_prefix) {
621 define_prefix = "";
622 NEXT_ARG();
623 } else if (is_prefix(*argv, "prefix")) {
624 if (!define_prefix) {
625 p_err("'prefix' argument can only be use after 'macros'");
626 return -1;
627 }
628 if (strcmp(define_prefix, "")) {
629 p_err("'prefix' already defined");
630 return -1;
631 }
632 NEXT_ARG();
633
634 if (!REQ_ARGS(1))
635 return -1;
636 define_prefix = GET_ARG();
637 } else {
638 p_err("expected no more arguments, 'kernel', 'dev', 'macros' or 'prefix', got: '%s'?",
639 *argv);
640 return -1;
641 }
642 }
643
644 if (json_output) {
645 define_prefix = NULL;
646 jsonw_start_object(json_wtr);
647 }
648
649 switch (target) {
650 case COMPONENT_KERNEL:
651 case COMPONENT_UNSPEC:
652 if (define_prefix)
653 break;
654
655 print_start_section("system_config",
656 "Scanning system configuration...",
657 NULL, /* define_comment never used here */
658 NULL); /* define_prefix always NULL here */
659 if (check_procfs()) {
660 probe_unprivileged_disabled();
661 probe_jit_enable();
662 probe_jit_harden();
663 probe_jit_kallsyms();
664 probe_jit_limit();
665 } else {
666 p_info("/* procfs not mounted, skipping related probes */");
667 }
668 probe_kernel_image_config();
669 if (json_output)
670 jsonw_end_object(json_wtr);
671 else
672 printf("\n");
673 break;
674 default:
675 break;
676 }
677
678 print_start_section("syscall_config",
679 "Scanning system call availability...",
680 "/*** System call availability ***/",
681 define_prefix);
682
683 if (!probe_bpf_syscall(define_prefix))
684 /* bpf() syscall unavailable, don't probe other BPF features */
685 goto exit_close_json;
686
687 print_end_then_start_section("program_types",
688 "Scanning eBPF program types...",
689 "/*** eBPF program types ***/",
690 define_prefix);
691
692 for (i = BPF_PROG_TYPE_UNSPEC + 1; i < ARRAY_SIZE(prog_type_name); i++)
693 probe_prog_type(i, supported_types, define_prefix, ifindex);
694
695 print_end_then_start_section("map_types",
696 "Scanning eBPF map types...",
697 "/*** eBPF map types ***/",
698 define_prefix);
699
700 for (i = BPF_MAP_TYPE_UNSPEC + 1; i < map_type_name_size; i++)
701 probe_map_type(i, define_prefix, ifindex);
702
703 print_end_then_start_section("helpers",
704 "Scanning eBPF helper functions...",
705 "/*** eBPF helper functions ***/",
706 define_prefix);
707
708 if (define_prefix)
709 printf("/*\n"
710 " * Use %sHAVE_PROG_TYPE_HELPER(prog_type_name, helper_name)\n"
711 " * to determine if <helper_name> is available for <prog_type_name>,\n"
712 " * e.g.\n"
713 " * #if %sHAVE_PROG_TYPE_HELPER(xdp, bpf_redirect)\n"
714 " * // do stuff with this helper\n"
715 " * #elif\n"
716 " * // use a workaround\n"
717 " * #endif\n"
718 " */\n"
719 "#define %sHAVE_PROG_TYPE_HELPER(prog_type, helper) \\\n"
720 " %sBPF__PROG_TYPE_ ## prog_type ## __HELPER_ ## helper\n",
721 define_prefix, define_prefix, define_prefix,
722 define_prefix);
723 for (i = BPF_PROG_TYPE_UNSPEC + 1; i < ARRAY_SIZE(prog_type_name); i++)
724 probe_helpers_for_progtype(i, supported_types[i],
725 define_prefix, ifindex);
726
727exit_close_json:
728 if (json_output) {
729 /* End current "section" of probes */
730 jsonw_end_object(json_wtr);
731 /* End root object */
732 jsonw_end_object(json_wtr);
733 }
734
735 return 0;
736}
737
738static int do_help(int argc, char **argv)
739{
740 if (json_output) {
741 jsonw_null(json_wtr);
742 return 0;
743 }
744
745 fprintf(stderr,
746 "Usage: %s %s probe [COMPONENT] [macros [prefix PREFIX]]\n"
747 " %s %s help\n"
748 "\n"
749 " COMPONENT := { kernel | dev NAME }\n"
750 "",
751 bin_name, argv[-2], bin_name, argv[-2]);
752
753 return 0;
754}
755
756static const struct cmd cmds[] = {
757 { "probe", do_probe },
758 { "help", do_help },
759 { 0 }
760};
761
762int do_feature(int argc, char **argv)
763{
764 return cmd_select(cmds, argc, argv, do_help);
765}