tools/bpf/bpftool/feature.c

   1 // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
   2 /* Copyright (c) 2019 Netronome Systems, Inc. */
   3
   4 #include <ctype.h>
   5 #include <errno.h>
   6 #include <fcntl.h>
   7 #include <string.h>
   8 #include <unistd.h>
   9 #include <net/if.h>
  10 #ifdef USE_LIBCAP
  11 #include <sys/capability.h>
  12 #endif
  13 #include <sys/utsname.h>
  14 #include <sys/vfs.h>
  15
  16 #include <linux/filter.h>
  17 #include <linux/limits.h>
  18
  19 #include <bpf/bpf.h>
  20 #include <bpf/libbpf.h>
  21 #include <zlib.h>
  22
  23 #include "main.h"
  24
  25 #ifndef PROC_SUPER_MAGIC
  26 # define PROC_SUPER_MAGIC       0x9fa0
  27 #endif
  28
  29 enum probe_component {
  30         COMPONENT_UNSPEC,
  31         COMPONENT_KERNEL,
  32         COMPONENT_DEVICE,
  33 };
  34
  35 #define BPF_HELPER_MAKE_ENTRY(name)     [BPF_FUNC_ ## name] = "bpf_" # name
  36 static const char * const helper_name[] = {
  37         __BPF_FUNC_MAPPER(BPF_HELPER_MAKE_ENTRY)
  38 };
  39
  40 #undef BPF_HELPER_MAKE_ENTRY
  41
  42 static bool full_mode;
  43 #ifdef USE_LIBCAP
  44 static bool run_as_unprivileged;
  45 #endif
  46
  47 /* Miscellaneous utility functions */
  48
  49 static bool grep(const char *buffer, const char *pattern)
  50 {
  51         return !!strstr(buffer, pattern);
  52 }
  53
  54 static bool check_procfs(void)
  55 {
  56         struct statfs st_fs;
  57
  58         if (statfs("/proc", &st_fs) < 0)
  59                 return false;
  60         if ((unsigned long)st_fs.f_type != PROC_SUPER_MAGIC)
  61                 return false;
  62
  63         return true;
  64 }
  65
  66 static void uppercase(char *str, size_t len)
  67 {
  68         size_t i;
  69
  70         for (i = 0; i < len && str[i] != '\0'; i++)
  71                 str[i] = toupper(str[i]);
  72 }
  73
  74 /* Printing utility functions */
  75
  76 static void
  77 print_bool_feature(const char *feat_name, const char *plain_name,
  78                    const char *define_name, bool res, const char *define_prefix)
  79 {
  80         if (json_output)
  81                 jsonw_bool_field(json_wtr, feat_name, res);
  82         else if (define_prefix)
  83                 printf("#define %s%sHAVE_%s\n", define_prefix,
  84                        res ? "" : "NO_", define_name);
  85         else
  86                 printf("%s is %savailable\n", plain_name, res ? "" : "NOT ");
  87 }
  88
  89 static void print_kernel_option(const char *name, const char *value,
  90                                 const char *define_prefix)
  91 {
  92         char *endptr;
  93         int res;
  94
  95         if (json_output) {
  96                 if (!value) {
  97                         jsonw_null_field(json_wtr, name);
  98                         return;
  99                 }
 100                 errno = 0;
 101                 res = strtol(value, &endptr, 0);
 102                 if (!errno && *endptr == '\n')
 103                         jsonw_int_field(json_wtr, name, res);
 104                 else
 105                         jsonw_string_field(json_wtr, name, value);
 106         } else if (define_prefix) {
 107                 if (value)
 108                         printf("#define %s%s %s\n", define_prefix,
 109                                name, value);
 110                 else
 111                         printf("/* %s%s is not set */\n", define_prefix, name);
 112         } else {
 113                 if (value)
 114                         printf("%s is set to %s\n", name, value);
 115                 else
 116                         printf("%s is not set\n", name);
 117         }
 118 }
 119
 120 static void
 121 print_start_section(const char *json_title, const char *plain_title,
 122                     const char *define_comment, const char *define_prefix)
 123 {
 124         if (json_output) {
 125                 jsonw_name(json_wtr, json_title);
 126                 jsonw_start_object(json_wtr);
 127         } else if (define_prefix) {
 128                 printf("%s\n", define_comment);
 129         } else {
 130                 printf("%s\n", plain_title);
 131         }
 132 }
 133
 134 static void print_end_section(void)
 135 {
 136         if (json_output)
 137                 jsonw_end_object(json_wtr);
 138         else
 139                 printf("\n");
 140 }
 141
 142 /* Probing functions */
 143
 144 static int get_vendor_id(int ifindex)
 145 {
 146         char ifname[IF_NAMESIZE], path[64], buf[8];
 147         ssize_t len;
 148         int fd;
 149
 150         if (!if_indextoname(ifindex, ifname))
 151                 return -1;
 152
 153         snprintf(path, sizeof(path), "/sys/class/net/%s/device/vendor", ifname);
 154
 155         fd = open(path, O_RDONLY | O_CLOEXEC);
 156         if (fd < 0)
 157                 return -1;
 158
 159         len = read(fd, buf, sizeof(buf));
 160         close(fd);
 161         if (len < 0)
 162                 return -1;
 163         if (len >= (ssize_t)sizeof(buf))
 164                 return -1;
 165         buf[len] = '\0';
 166
 167         return strtol(buf, NULL, 0);
 168 }
 169
 170 static long read_procfs(const char *path)
 171 {
 172         char *endptr, *line = NULL;
 173         size_t len = 0;
 174         FILE *fd;
 175         long res;
 176
 177         fd = fopen(path, "r");
 178         if (!fd)
 179                 return -1;
 180
 181         res = getline(&line, &len, fd);
 182         fclose(fd);
 183         if (res < 0)
 184                 return -1;
 185
 186         errno = 0;
 187         res = strtol(line, &endptr, 10);
 188         if (errno || *line == '\0' || *endptr != '\n')
 189                 res = -1;
 190         free(line);
 191
 192         return res;
 193 }
 194
 195 static void probe_unprivileged_disabled(void)
 196 {
 197         long res;
 198
 199         /* No support for C-style ouptut */
 200
 201         res = read_procfs("/proc/sys/kernel/unprivileged_bpf_disabled");
 202         if (json_output) {
 203                 jsonw_int_field(json_wtr, "unprivileged_bpf_disabled", res);
 204         } else {
 205                 switch (res) {
 206                 case 0:
 207                         printf("bpf() syscall for unprivileged users is enabled\n");
 208                         break;
 209                 case 1:
 210                         printf("bpf() syscall restricted to privileged users (without recovery)\n");
 211                         break;
 212                 case 2:
 213                         printf("bpf() syscall restricted to privileged users (admin can change)\n");
 214                         break;
 215                 case -1:
 216                         printf("Unable to retrieve required privileges for bpf() syscall\n");
 217                         break;
 218                 default:
 219                         printf("bpf() syscall restriction has unknown value %ld\n", res);
 220                 }
 221         }
 222 }
 223
 224 static void probe_jit_enable(void)
 225 {
 226         long res;
 227
 228         /* No support for C-style ouptut */
 229
 230         res = read_procfs("/proc/sys/net/core/bpf_jit_enable");
 231         if (json_output) {
 232                 jsonw_int_field(json_wtr, "bpf_jit_enable", res);
 233         } else {
 234                 switch (res) {
 235                 case 0:
 236                         printf("JIT compiler is disabled\n");
 237                         break;
 238                 case 1:
 239                         printf("JIT compiler is enabled\n");
 240                         break;
 241                 case 2:
 242                         printf("JIT compiler is enabled with debugging traces in kernel logs\n");
 243                         break;
 244                 case -1:
 245                         printf("Unable to retrieve JIT-compiler status\n");
 246                         break;
 247                 default:
 248                         printf("JIT-compiler status has unknown value %ld\n",
 249                                res);
 250                 }
 251         }
 252 }
 253
 254 static void probe_jit_harden(void)
 255 {
 256         long res;
 257
 258         /* No support for C-style ouptut */
 259
 260         res = read_procfs("/proc/sys/net/core/bpf_jit_harden");
 261         if (json_output) {
 262                 jsonw_int_field(json_wtr, "bpf_jit_harden", res);
 263         } else {
 264                 switch (res) {
 265                 case 0:
 266                         printf("JIT compiler hardening is disabled\n");
 267                         break;
 268                 case 1:
 269                         printf("JIT compiler hardening is enabled for unprivileged users\n");
 270                         break;
 271                 case 2:
 272                         printf("JIT compiler hardening is enabled for all users\n");
 273                         break;
 274                 case -1:
 275                         printf("Unable to retrieve JIT hardening status\n");
 276                         break;
 277                 default:
 278                         printf("JIT hardening status has unknown value %ld\n",
 279                                res);
 280                 }
 281         }
 282 }
 283
 284 static void probe_jit_kallsyms(void)
 285 {
 286         long res;
 287
 288         /* No support for C-style ouptut */
 289
 290         res = read_procfs("/proc/sys/net/core/bpf_jit_kallsyms");
 291         if (json_output) {
 292                 jsonw_int_field(json_wtr, "bpf_jit_kallsyms", res);
 293         } else {
 294                 switch (res) {
 295                 case 0:
 296                         printf("JIT compiler kallsyms exports are disabled\n");
 297                         break;
 298                 case 1:
 299                         printf("JIT compiler kallsyms exports are enabled for root\n");
 300                         break;
 301                 case -1:
 302                         printf("Unable to retrieve JIT kallsyms export status\n");
 303                         break;
 304                 default:
 305                         printf("JIT kallsyms exports status has unknown value %ld\n", res);
 306                 }
 307         }
 308 }
 309
 310 static void probe_jit_limit(void)
 311 {
 312         long res;
 313
 314         /* No support for C-style ouptut */
 315
 316         res = read_procfs("/proc/sys/net/core/bpf_jit_limit");
 317         if (json_output) {
 318                 jsonw_int_field(json_wtr, "bpf_jit_limit", res);
 319         } else {
 320                 switch (res) {
 321                 case -1:
 322                         printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n");
 323                         break;
 324                 default:
 325                         printf("Global memory limit for JIT compiler for unprivileged users is %ld bytes\n", res);
 326                 }
 327         }
 328 }
 329
 330 static bool read_next_kernel_config_option(gzFile file, char *buf, size_t n,
 331                                            char **value)
 332 {
 333         char *sep;
 334
 335         while (gzgets(file, buf, n)) {
 336                 if (strncmp(buf, "CONFIG_", 7))
 337                         continue;
 338
 339                 sep = strchr(buf, '=');
 340                 if (!sep)
 341                         continue;
 342
 343                 /* Trim ending '\n' */
 344                 buf[strlen(buf) - 1] = '\0';
 345
 346                 /* Split on '=' and ensure that a value is present. */
 347                 *sep = '\0';
 348                 if (!sep[1])
 349                         continue;
 350
 351                 *value = sep + 1;
 352                 return true;
 353         }
 354
 355         return false;
 356 }
 357
 358 static void probe_kernel_image_config(const char *define_prefix)
 359 {
 360         static const struct {
 361                 const char * const name;
 362                 bool macro_dump;
 363         } options[] = {
 364                 /* Enable BPF */
 365                 { "CONFIG_BPF", },
 366                 /* Enable bpf() syscall */
 367                 { "CONFIG_BPF_SYSCALL", },
 368                 /* Does selected architecture support eBPF JIT compiler */
 369                 { "CONFIG_HAVE_EBPF_JIT", },
 370                 /* Compile eBPF JIT compiler */
 371                 { "CONFIG_BPF_JIT", },
 372                 /* Avoid compiling eBPF interpreter (use JIT only) */
 373                 { "CONFIG_BPF_JIT_ALWAYS_ON", },
 374                 /* Kernel BTF debug information available */
 375                 { "CONFIG_DEBUG_INFO_BTF", },
 376                 /* Kernel module BTF debug information available */
 377                 { "CONFIG_DEBUG_INFO_BTF_MODULES", },
 378
 379                 /* cgroups */
 380                 { "CONFIG_CGROUPS", },
 381                 /* BPF programs attached to cgroups */
 382                 { "CONFIG_CGROUP_BPF", },
 383                 /* bpf_get_cgroup_classid() helper */
 384                 { "CONFIG_CGROUP_NET_CLASSID", },
 385                 /* bpf_skb_{,ancestor_}cgroup_id() helpers */
 386                 { "CONFIG_SOCK_CGROUP_DATA", },
 387
 388                 /* Tracing: attach BPF to kprobes, tracepoints, etc. */
 389                 { "CONFIG_BPF_EVENTS", },
 390                 /* Kprobes */
 391                 { "CONFIG_KPROBE_EVENTS", },
 392                 /* Uprobes */
 393                 { "CONFIG_UPROBE_EVENTS", },
 394                 /* Tracepoints */
 395                 { "CONFIG_TRACING", },
 396                 /* Syscall tracepoints */
 397                 { "CONFIG_FTRACE_SYSCALLS", },
 398                 /* bpf_override_return() helper support for selected arch */
 399                 { "CONFIG_FUNCTION_ERROR_INJECTION", },
 400                 /* bpf_override_return() helper */
 401                 { "CONFIG_BPF_KPROBE_OVERRIDE", },
 402
 403                 /* Network */
 404                 { "CONFIG_NET", },
 405                 /* AF_XDP sockets */
 406                 { "CONFIG_XDP_SOCKETS", },
 407                 /* BPF_PROG_TYPE_LWT_* and related helpers */
 408                 { "CONFIG_LWTUNNEL_BPF", },
 409                 /* BPF_PROG_TYPE_SCHED_ACT, TC (traffic control) actions */
 410                 { "CONFIG_NET_ACT_BPF", },
 411                 /* BPF_PROG_TYPE_SCHED_CLS, TC filters */
 412                 { "CONFIG_NET_CLS_BPF", },
 413                 /* TC clsact qdisc */
 414                 { "CONFIG_NET_CLS_ACT", },
 415                 /* Ingress filtering with TC */
 416                 { "CONFIG_NET_SCH_INGRESS", },
 417                 /* bpf_skb_get_xfrm_state() helper */
 418                 { "CONFIG_XFRM", },
 419                 /* bpf_get_route_realm() helper */
 420                 { "CONFIG_IP_ROUTE_CLASSID", },
 421                 /* BPF_PROG_TYPE_LWT_SEG6_LOCAL and related helpers */
 422                 { "CONFIG_IPV6_SEG6_BPF", },
 423                 /* BPF_PROG_TYPE_LIRC_MODE2 and related helpers */
 424                 { "CONFIG_BPF_LIRC_MODE2", },
 425                 /* BPF stream parser and BPF socket maps */
 426                 { "CONFIG_BPF_STREAM_PARSER", },
 427                 /* xt_bpf module for passing BPF programs to netfilter  */
 428                 { "CONFIG_NETFILTER_XT_MATCH_BPF", },
 429
 430                 /* test_bpf module for BPF tests */
 431                 { "CONFIG_TEST_BPF", },
 432
 433                 /* Misc configs useful in BPF C programs */
 434                 /* jiffies <-> sec conversion for bpf_jiffies64() helper */
 435                 { "CONFIG_HZ", true, }
 436         };
 437         char *values[ARRAY_SIZE(options)] = { };
 438         struct utsname utsn;
 439         char path[PATH_MAX];
 440         gzFile file = NULL;
 441         char buf[4096];
 442         char *value;
 443         size_t i;
 444
 445         if (!uname(&utsn)) {
 446                 snprintf(path, sizeof(path), "/boot/config-%s", utsn.release);
 447
 448                 /* gzopen also accepts uncompressed files. */
 449                 file = gzopen(path, "r");
 450         }
 451
 452         if (!file) {
 453                 /* Some distributions build with CONFIG_IKCONFIG=y and put the
 454                  * config file at /proc/config.gz.
 455                  */
 456                 file = gzopen("/proc/config.gz", "r");
 457         }
 458         if (!file) {
 459                 p_info("skipping kernel config, can't open file: %s",
 460                        strerror(errno));
 461                 goto end_parse;
 462         }
 463         /* Sanity checks */
 464         if (!gzgets(file, buf, sizeof(buf)) ||
 465             !gzgets(file, buf, sizeof(buf))) {
 466                 p_info("skipping kernel config, can't read from file: %s",
 467                        strerror(errno));
 468                 goto end_parse;
 469         }
 470         if (strcmp(buf, "# Automatically generated file; DO NOT EDIT.\n")) {
 471                 p_info("skipping kernel config, can't find correct file");
 472                 goto end_parse;
 473         }
 474
 475         while (read_next_kernel_config_option(file, buf, sizeof(buf), &value)) {
 476                 for (i = 0; i < ARRAY_SIZE(options); i++) {
 477                         if ((define_prefix && !options[i].macro_dump) ||
 478                             values[i] || strcmp(buf, options[i].name))
 479                                 continue;
 480
 481                         values[i] = strdup(value);
 482                 }
 483         }
 484
 485         for (i = 0; i < ARRAY_SIZE(options); i++) {
 486                 if (define_prefix && !options[i].macro_dump)
 487                         continue;
 488                 print_kernel_option(options[i].name, values[i], define_prefix);
 489                 free(values[i]);
 490         }
 491
 492 end_parse:
 493         if (file)
 494                 gzclose(file);
 495 }
 496
 497 static bool probe_bpf_syscall(const char *define_prefix)
 498 {
 499         bool res;
 500
 501         bpf_prog_load(BPF_PROG_TYPE_UNSPEC, NULL, NULL, NULL, 0, NULL);
 502         res = (errno != ENOSYS);
 503
 504         print_bool_feature("have_bpf_syscall",
 505                            "bpf() syscall",
 506                            "BPF_SYSCALL",
 507                            res, define_prefix);
 508
 509         return res;
 510 }
 511
 512 static bool
 513 probe_prog_load_ifindex(enum bpf_prog_type prog_type,
 514                         const struct bpf_insn *insns, size_t insns_cnt,
 515                         char *log_buf, size_t log_buf_sz,
 516                         __u32 ifindex)
 517 {
 518         LIBBPF_OPTS(bpf_prog_load_opts, opts,
 519                     .log_buf = log_buf,
 520                     .log_size = log_buf_sz,
 521                     .log_level = log_buf ? 1 : 0,
 522                     .prog_ifindex = ifindex,
 523                    );
 524         int fd;
 525
 526         errno = 0;
 527         fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts);
 528         if (fd >= 0)
 529                 close(fd);
 530
 531         return fd >= 0 && errno != EINVAL && errno != EOPNOTSUPP;
 532 }
 533
 534 static bool probe_prog_type_ifindex(enum bpf_prog_type prog_type, __u32 ifindex)
 535 {
 536         /* nfp returns -EINVAL on exit(0) with TC offload */
 537         struct bpf_insn insns[2] = {
 538                 BPF_MOV64_IMM(BPF_REG_0, 2),
 539                 BPF_EXIT_INSN()
 540         };
 541
 542         return probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns),
 543                                        NULL, 0, ifindex);
 544 }
 545
 546 static void
 547 probe_prog_type(enum bpf_prog_type prog_type, const char *prog_type_str,
 548                 bool *supported_types, const char *define_prefix, __u32 ifindex)
 549 {
 550         char feat_name[128], plain_desc[128], define_name[128];
 551         const char *plain_comment = "eBPF program_type ";
 552         size_t maxlen;
 553         bool res;
 554
 555         if (ifindex) {
 556                 switch (prog_type) {
 557                 case BPF_PROG_TYPE_SCHED_CLS:
 558                 case BPF_PROG_TYPE_XDP:
 559                         break;
 560                 default:
 561                         return;
 562                 }
 563
 564                 res = probe_prog_type_ifindex(prog_type, ifindex);
 565         } else {
 566                 res = libbpf_probe_bpf_prog_type(prog_type, NULL) > 0;
 567         }
 568
 569 #ifdef USE_LIBCAP
 570         /* Probe may succeed even if program load fails, for unprivileged users
 571          * check that we did not fail because of insufficient permissions
 572          */
 573         if (run_as_unprivileged && errno == EPERM)
 574                 res = false;
 575 #endif
 576
 577         supported_types[prog_type] |= res;
 578
 579         maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1;
 580         if (strlen(prog_type_str) > maxlen) {
 581                 p_info("program type name too long");
 582                 return;
 583         }
 584
 585         sprintf(feat_name, "have_%s_prog_type", prog_type_str);
 586         sprintf(define_name, "%s_prog_type", prog_type_str);
 587         uppercase(define_name, sizeof(define_name));
 588         sprintf(plain_desc, "%s%s", plain_comment, prog_type_str);
 589         print_bool_feature(feat_name, plain_desc, define_name, res,
 590                            define_prefix);
 591 }
 592
 593 static bool probe_map_type_ifindex(enum bpf_map_type map_type, __u32 ifindex)
 594 {
 595         LIBBPF_OPTS(bpf_map_create_opts, opts);
 596         int key_size, value_size, max_entries;
 597         int fd;
 598
 599         opts.map_ifindex = ifindex;
 600
 601         key_size = sizeof(__u32);
 602         value_size = sizeof(__u32);
 603         max_entries = 1;
 604
 605         fd = bpf_map_create(map_type, NULL, key_size, value_size, max_entries,
 606                             &opts);
 607         if (fd >= 0)
 608                 close(fd);
 609
 610         return fd >= 0;
 611 }
 612
 613 static void
 614 probe_map_type(enum bpf_map_type map_type, char const *map_type_str,
 615                const char *define_prefix, __u32 ifindex)
 616 {
 617         char feat_name[128], plain_desc[128], define_name[128];
 618         const char *plain_comment = "eBPF map_type ";
 619         size_t maxlen;
 620         bool res;
 621
 622         if (ifindex) {
 623                 switch (map_type) {
 624                 case BPF_MAP_TYPE_HASH:
 625                 case BPF_MAP_TYPE_ARRAY:
 626                         break;
 627                 default:
 628                         return;
 629                 }
 630
 631                 res = probe_map_type_ifindex(map_type, ifindex);
 632         } else {
 633                 res = libbpf_probe_bpf_map_type(map_type, NULL) > 0;
 634         }
 635
 636         /* Probe result depends on the success of map creation, no additional
 637          * check required for unprivileged users
 638          */
 639
 640         maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1;
 641         if (strlen(map_type_str) > maxlen) {
 642                 p_info("map type name too long");
 643                 return;
 644         }
 645
 646         sprintf(feat_name, "have_%s_map_type", map_type_str);
 647         sprintf(define_name, "%s_map_type", map_type_str);
 648         uppercase(define_name, sizeof(define_name));
 649         sprintf(plain_desc, "%s%s", plain_comment, map_type_str);
 650         print_bool_feature(feat_name, plain_desc, define_name, res,
 651                            define_prefix);
 652 }
 653
 654 static bool
 655 probe_helper_ifindex(enum bpf_func_id id, enum bpf_prog_type prog_type,
 656                      __u32 ifindex)
 657 {
 658         struct bpf_insn insns[2] = {
 659                 BPF_EMIT_CALL(id),
 660                 BPF_EXIT_INSN()
 661         };
 662         char buf[4096] = {};
 663         bool res;
 664
 665         probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns), buf,
 666                                 sizeof(buf), ifindex);
 667         res = !grep(buf, "invalid func ") && !grep(buf, "unknown func ");
 668
 669         switch (get_vendor_id(ifindex)) {
 670         case 0x19ee: /* Netronome specific */
 671                 res = res && !grep(buf, "not supported by FW") &&
 672                         !grep(buf, "unsupported function id");
 673                 break;
 674         default:
 675                 break;
 676         }
 677
 678         return res;
 679 }
 680
 681 static bool
 682 probe_helper_for_progtype(enum bpf_prog_type prog_type, bool supported_type,
 683                           const char *define_prefix, unsigned int id,
 684                           const char *ptype_name, __u32 ifindex)
 685 {
 686         bool res = false;
 687
 688         if (supported_type) {
 689                 if (ifindex)
 690                         res = probe_helper_ifindex(id, prog_type, ifindex);
 691                 else
 692                         res = libbpf_probe_bpf_helper(prog_type, id, NULL) > 0;
 693 #ifdef USE_LIBCAP
 694                 /* Probe may succeed even if program load fails, for
 695                  * unprivileged users check that we did not fail because of
 696                  * insufficient permissions
 697                  */
 698                 if (run_as_unprivileged && errno == EPERM)
 699                         res = false;
 700 #endif
 701         }
 702
 703         if (json_output) {
 704                 if (res)
 705                         jsonw_string(json_wtr, helper_name[id]);
 706         } else if (define_prefix) {
 707                 printf("#define %sBPF__PROG_TYPE_%s__HELPER_%s %s\n",
 708                        define_prefix, ptype_name, helper_name[id],
 709                        res ? "1" : "0");
 710         } else {
 711                 if (res)
 712                         printf("\n\t- %s", helper_name[id]);
 713         }
 714
 715         return res;
 716 }
 717
 718 static void
 719 probe_helpers_for_progtype(enum bpf_prog_type prog_type,
 720                            const char *prog_type_str, bool supported_type,
 721                            const char *define_prefix, __u32 ifindex)
 722 {
 723         char feat_name[128];
 724         unsigned int id;
 725         bool probe_res = false;
 726
 727         if (ifindex)
 728                 /* Only test helpers for offload-able program types */
 729                 switch (prog_type) {
 730                 case BPF_PROG_TYPE_SCHED_CLS:
 731                 case BPF_PROG_TYPE_XDP:
 732                         break;
 733                 default:
 734                         return;
 735                 }
 736
 737         if (json_output) {
 738                 sprintf(feat_name, "%s_available_helpers", prog_type_str);
 739                 jsonw_name(json_wtr, feat_name);
 740                 jsonw_start_array(json_wtr);
 741         } else if (!define_prefix) {
 742                 printf("eBPF helpers supported for program type %s:",
 743                        prog_type_str);
 744         }
 745
 746         for (id = 1; id < ARRAY_SIZE(helper_name); id++) {
 747                 /* Skip helper functions which emit dmesg messages when not in
 748                  * the full mode.
 749                  */
 750                 switch (id) {
 751                 case BPF_FUNC_trace_printk:
 752                 case BPF_FUNC_trace_vprintk:
 753                 case BPF_FUNC_probe_write_user:
 754                         if (!full_mode)
 755                                 continue;
 756                         fallthrough;
 757                 default:
 758                         probe_res |= probe_helper_for_progtype(prog_type, supported_type,
 759                                                   define_prefix, id, prog_type_str,
 760                                                   ifindex);
 761                 }
 762         }
 763
 764         if (json_output)
 765                 jsonw_end_array(json_wtr);
 766         else if (!define_prefix) {
 767                 printf("\n");
 768                 if (!probe_res) {
 769                         if (!supported_type)
 770                                 printf("\tProgram type not supported\n");
 771                         else
 772                                 printf("\tCould not determine which helpers are available\n");
 773                 }
 774         }
 775
 776
 777 }
 778
 779 static void
 780 probe_misc_feature(struct bpf_insn *insns, size_t len,
 781                    const char *define_prefix, __u32 ifindex,
 782                    const char *feat_name, const char *plain_name,
 783                    const char *define_name)
 784 {
 785         LIBBPF_OPTS(bpf_prog_load_opts, opts,
 786                 .prog_ifindex = ifindex,
 787         );
 788         bool res;
 789         int fd;
 790
 791         errno = 0;
 792         fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL",
 793                            insns, len, &opts);
 794         res = fd >= 0 || !errno;
 795
 796         if (fd >= 0)
 797                 close(fd);
 798
 799         print_bool_feature(feat_name, plain_name, define_name, res,
 800                            define_prefix);
 801 }
 802
 803 /*
 804  * Probe for availability of kernel commit (5.3):
 805  *
 806  * c04c0d2b968a ("bpf: increase complexity limit and maximum program size")
 807  */
 808 static void probe_large_insn_limit(const char *define_prefix, __u32 ifindex)
 809 {
 810         struct bpf_insn insns[BPF_MAXINSNS + 1];
 811         int i;
 812
 813         for (i = 0; i < BPF_MAXINSNS; i++)
 814                 insns[i] = BPF_MOV64_IMM(BPF_REG_0, 1);
 815         insns[BPF_MAXINSNS] = BPF_EXIT_INSN();
 816
 817         probe_misc_feature(insns, ARRAY_SIZE(insns),
 818                            define_prefix, ifindex,
 819                            "have_large_insn_limit",
 820                            "Large program size limit",
 821                            "LARGE_INSN_LIMIT");
 822 }
 823
 824 /*
 825  * Probe for bounded loop support introduced in commit 2589726d12a1
 826  * ("bpf: introduce bounded loops").
 827  */
 828 static void
 829 probe_bounded_loops(const char *define_prefix, __u32 ifindex)
 830 {
 831         struct bpf_insn insns[4] = {
 832                 BPF_MOV64_IMM(BPF_REG_0, 10),
 833                 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 1),
 834                 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, -2),
 835                 BPF_EXIT_INSN()
 836         };
 837
 838         probe_misc_feature(insns, ARRAY_SIZE(insns),
 839                            define_prefix, ifindex,
 840                            "have_bounded_loops",
 841                            "Bounded loop support",
 842                            "BOUNDED_LOOPS");
 843 }
 844
 845 /*
 846  * Probe for the v2 instruction set extension introduced in commit 92b31a9af73b
 847  * ("bpf: add BPF_J{LT,LE,SLT,SLE} instructions").
 848  */
 849 static void
 850 probe_v2_isa_extension(const char *define_prefix, __u32 ifindex)
 851 {
 852         struct bpf_insn insns[4] = {
 853                 BPF_MOV64_IMM(BPF_REG_0, 0),
 854                 BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 0, 1),
 855                 BPF_MOV64_IMM(BPF_REG_0, 1),
 856                 BPF_EXIT_INSN()
 857         };
 858
 859         probe_misc_feature(insns, ARRAY_SIZE(insns),
 860                            define_prefix, ifindex,
 861                            "have_v2_isa_extension",
 862                            "ISA extension v2",
 863                            "V2_ISA_EXTENSION");
 864 }
 865
 866 /*
 867  * Probe for the v3 instruction set extension introduced in commit 092ed0968bb6
 868  * ("bpf: verifier support JMP32").
 869  */
 870 static void
 871 probe_v3_isa_extension(const char *define_prefix, __u32 ifindex)
 872 {
 873         struct bpf_insn insns[4] = {
 874                 BPF_MOV64_IMM(BPF_REG_0, 0),
 875                 BPF_JMP32_IMM(BPF_JLT, BPF_REG_0, 0, 1),
 876                 BPF_MOV64_IMM(BPF_REG_0, 1),
 877                 BPF_EXIT_INSN()
 878         };
 879
 880         probe_misc_feature(insns, ARRAY_SIZE(insns),
 881                            define_prefix, ifindex,
 882                            "have_v3_isa_extension",
 883                            "ISA extension v3",
 884                            "V3_ISA_EXTENSION");
 885 }
 886
 887 static void
 888 section_system_config(enum probe_component target, const char *define_prefix)
 889 {
 890         switch (target) {
 891         case COMPONENT_KERNEL:
 892         case COMPONENT_UNSPEC:
 893                 print_start_section("system_config",
 894                                     "Scanning system configuration...",
 895                                     "/*** Misc kernel config items ***/",
 896                                     define_prefix);
 897                 if (!define_prefix) {
 898                         if (check_procfs()) {
 899                                 probe_unprivileged_disabled();
 900                                 probe_jit_enable();
 901                                 probe_jit_harden();
 902                                 probe_jit_kallsyms();
 903                                 probe_jit_limit();
 904                         } else {
 905                                 p_info("/* procfs not mounted, skipping related probes */");
 906                         }
 907                 }
 908                 probe_kernel_image_config(define_prefix);
 909                 print_end_section();
 910                 break;
 911         default:
 912                 break;
 913         }
 914 }
 915
 916 static bool section_syscall_config(const char *define_prefix)
 917 {
 918         bool res;
 919
 920         print_start_section("syscall_config",
 921                             "Scanning system call availability...",
 922                             "/*** System call availability ***/",
 923                             define_prefix);
 924         res = probe_bpf_syscall(define_prefix);
 925         print_end_section();
 926
 927         return res;
 928 }
 929
 930 static void
 931 section_program_types(bool *supported_types, const char *define_prefix,
 932                       __u32 ifindex)
 933 {
 934         unsigned int prog_type = BPF_PROG_TYPE_UNSPEC;
 935         const char *prog_type_str;
 936
 937         print_start_section("program_types",
 938                             "Scanning eBPF program types...",
 939                             "/*** eBPF program types ***/",
 940                             define_prefix);
 941
 942         while (true) {
 943                 prog_type++;
 944                 prog_type_str = libbpf_bpf_prog_type_str(prog_type);
 945                 /* libbpf will return NULL for variants unknown to it. */
 946                 if (!prog_type_str)
 947                         break;
 948
 949                 probe_prog_type(prog_type, prog_type_str, supported_types, define_prefix,
 950                                 ifindex);
 951         }
 952
 953         print_end_section();
 954 }
 955
 956 static void section_map_types(const char *define_prefix, __u32 ifindex)
 957 {
 958         unsigned int map_type = BPF_MAP_TYPE_UNSPEC;
 959         const char *map_type_str;
 960
 961         print_start_section("map_types",
 962                             "Scanning eBPF map types...",
 963                             "/*** eBPF map types ***/",
 964                             define_prefix);
 965
 966         while (true) {
 967                 map_type++;
 968                 map_type_str = libbpf_bpf_map_type_str(map_type);
 969                 /* libbpf will return NULL for variants unknown to it. */
 970                 if (!map_type_str)
 971                         break;
 972
 973                 probe_map_type(map_type, map_type_str, define_prefix, ifindex);
 974         }
 975
 976         print_end_section();
 977 }
 978
 979 static void
 980 section_helpers(bool *supported_types, const char *define_prefix, __u32 ifindex)
 981 {
 982         unsigned int prog_type = BPF_PROG_TYPE_UNSPEC;
 983         const char *prog_type_str;
 984
 985         print_start_section("helpers",
 986                             "Scanning eBPF helper functions...",
 987                             "/*** eBPF helper functions ***/",
 988                             define_prefix);
 989
 990         if (define_prefix)
 991                 printf("/*\n"
 992                        " * Use %sHAVE_PROG_TYPE_HELPER(prog_type_name, helper_name)\n"
 993                        " * to determine if <helper_name> is available for <prog_type_name>,\n"
 994                        " * e.g.\n"
 995                        " *      #if %sHAVE_PROG_TYPE_HELPER(xdp, bpf_redirect)\n"
 996                        " *              // do stuff with this helper\n"
 997                        " *      #elif\n"
 998                        " *              // use a workaround\n"
 999                        " *      #endif\n"
1000                        " */\n"
1001                        "#define %sHAVE_PROG_TYPE_HELPER(prog_type, helper)      \\\n"
1002                        "        %sBPF__PROG_TYPE_ ## prog_type ## __HELPER_ ## helper\n",
1003                        define_prefix, define_prefix, define_prefix,
1004                        define_prefix);
1005         while (true) {
1006                 prog_type++;
1007                 prog_type_str = libbpf_bpf_prog_type_str(prog_type);
1008                 /* libbpf will return NULL for variants unknown to it. */
1009                 if (!prog_type_str)
1010                         break;
1011
1012                 probe_helpers_for_progtype(prog_type, prog_type_str,
1013                                            supported_types[prog_type],
1014                                            define_prefix,
1015                                            ifindex);
1016         }
1017
1018         print_end_section();
1019 }
1020
1021 static void section_misc(const char *define_prefix, __u32 ifindex)
1022 {
1023         print_start_section("misc",
1024                             "Scanning miscellaneous eBPF features...",
1025                             "/*** eBPF misc features ***/",
1026                             define_prefix);
1027         probe_large_insn_limit(define_prefix, ifindex);
1028         probe_bounded_loops(define_prefix, ifindex);
1029         probe_v2_isa_extension(define_prefix, ifindex);
1030         probe_v3_isa_extension(define_prefix, ifindex);
1031         print_end_section();
1032 }
1033
1034 #ifdef USE_LIBCAP
1035 #define capability(c) { c, false, #c }
1036 #define capability_msg(a, i) a[i].set ? "" : a[i].name, a[i].set ? "" : ", "
1037 #endif
1038
1039 static int handle_perms(void)
1040 {
1041 #ifdef USE_LIBCAP
1042         struct {
1043                 cap_value_t cap;
1044                 bool set;
1045                 char name[14];  /* strlen("CAP_SYS_ADMIN") */
1046         } bpf_caps[] = {
1047                 capability(CAP_SYS_ADMIN),
1048 #ifdef CAP_BPF
1049                 capability(CAP_BPF),
1050                 capability(CAP_NET_ADMIN),
1051                 capability(CAP_PERFMON),
1052 #endif
1053         };
1054         cap_value_t cap_list[ARRAY_SIZE(bpf_caps)];
1055         unsigned int i, nb_bpf_caps = 0;
1056         bool cap_sys_admin_only = true;
1057         cap_flag_value_t val;
1058         int res = -1;
1059         cap_t caps;
1060
1061         caps = cap_get_proc();
1062         if (!caps) {
1063                 p_err("failed to get capabilities for process: %s",
1064                       strerror(errno));
1065                 return -1;
1066         }
1067
1068 #ifdef CAP_BPF
1069         if (CAP_IS_SUPPORTED(CAP_BPF))
1070                 cap_sys_admin_only = false;
1071 #endif
1072
1073         for (i = 0; i < ARRAY_SIZE(bpf_caps); i++) {
1074                 const char *cap_name = bpf_caps[i].name;
1075                 cap_value_t cap = bpf_caps[i].cap;
1076
1077                 if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &val)) {
1078                         p_err("bug: failed to retrieve %s status: %s", cap_name,
1079                               strerror(errno));
1080                         goto exit_free;
1081                 }
1082
1083                 if (val == CAP_SET) {
1084                         bpf_caps[i].set = true;
1085                         cap_list[nb_bpf_caps++] = cap;
1086                 }
1087
1088                 if (cap_sys_admin_only)
1089                         /* System does not know about CAP_BPF, meaning that
1090                          * CAP_SYS_ADMIN is the only capability required. We
1091                          * just checked it, break.
1092                          */
1093                         break;
1094         }
1095
1096         if ((run_as_unprivileged && !nb_bpf_caps) ||
1097             (!run_as_unprivileged && nb_bpf_caps == ARRAY_SIZE(bpf_caps)) ||
1098             (!run_as_unprivileged && cap_sys_admin_only && nb_bpf_caps)) {
1099                 /* We are all good, exit now */
1100                 res = 0;
1101                 goto exit_free;
1102         }
1103
1104         if (!run_as_unprivileged) {
1105                 if (cap_sys_admin_only)
1106                         p_err("missing %s, required for full feature probing; run as root or use 'unprivileged'",
1107                               bpf_caps[0].name);
1108                 else
1109                         p_err("missing %s%s%s%s%s%s%s%srequired for full feature probing; run as root or use 'unprivileged'",
1110                               capability_msg(bpf_caps, 0),
1111 #ifdef CAP_BPF
1112                               capability_msg(bpf_caps, 1),
1113                               capability_msg(bpf_caps, 2),
1114                               capability_msg(bpf_caps, 3)
1115 #else
1116                                 "", "", "", "", "", ""
1117 #endif /* CAP_BPF */
1118                                 );
1119                 goto exit_free;
1120         }
1121
1122         /* if (run_as_unprivileged && nb_bpf_caps > 0), drop capabilities. */
1123         if (cap_set_flag(caps, CAP_EFFECTIVE, nb_bpf_caps, cap_list,
1124                          CAP_CLEAR)) {
1125                 p_err("bug: failed to clear capabilities: %s", strerror(errno));
1126                 goto exit_free;
1127         }
1128
1129         if (cap_set_proc(caps)) {
1130                 p_err("failed to drop capabilities: %s", strerror(errno));
1131                 goto exit_free;
1132         }
1133
1134         res = 0;
1135
1136 exit_free:
1137         if (cap_free(caps) && !res) {
1138                 p_err("failed to clear storage object for capabilities: %s",
1139                       strerror(errno));
1140                 res = -1;
1141         }
1142
1143         return res;
1144 #else
1145         /* Detection assumes user has specific privileges.
1146          * We do not use libcap so let's approximate, and restrict usage to
1147          * root user only.
1148          */
1149         if (geteuid()) {
1150                 p_err("full feature probing requires root privileges");
1151                 return -1;
1152         }
1153
1154         return 0;
1155 #endif /* USE_LIBCAP */
1156 }
1157
1158 static int do_probe(int argc, char **argv)
1159 {
1160         enum probe_component target = COMPONENT_UNSPEC;
1161         const char *define_prefix = NULL;
1162         bool supported_types[128] = {};
1163         __u32 ifindex = 0;
1164         char *ifname;
1165
1166         set_max_rlimit();
1167
1168         while (argc) {
1169                 if (is_prefix(*argv, "kernel")) {
1170                         if (target != COMPONENT_UNSPEC) {
1171                                 p_err("component to probe already specified");
1172                                 return -1;
1173                         }
1174                         target = COMPONENT_KERNEL;
1175                         NEXT_ARG();
1176                 } else if (is_prefix(*argv, "dev")) {
1177                         NEXT_ARG();
1178
1179                         if (target != COMPONENT_UNSPEC || ifindex) {
1180                                 p_err("component to probe already specified");
1181                                 return -1;
1182                         }
1183                         if (!REQ_ARGS(1))
1184                                 return -1;
1185
1186                         target = COMPONENT_DEVICE;
1187                         ifname = GET_ARG();
1188                         ifindex = if_nametoindex(ifname);
1189                         if (!ifindex) {
1190                                 p_err("unrecognized netdevice '%s': %s", ifname,
1191                                       strerror(errno));
1192                                 return -1;
1193                         }
1194                 } else if (is_prefix(*argv, "full")) {
1195                         full_mode = true;
1196                         NEXT_ARG();
1197                 } else if (is_prefix(*argv, "macros") && !define_prefix) {
1198                         define_prefix = "";
1199                         NEXT_ARG();
1200                 } else if (is_prefix(*argv, "prefix")) {
1201                         if (!define_prefix) {
1202                                 p_err("'prefix' argument can only be use after 'macros'");
1203                                 return -1;
1204                         }
1205                         if (strcmp(define_prefix, "")) {
1206                                 p_err("'prefix' already defined");
1207                                 return -1;
1208                         }
1209                         NEXT_ARG();
1210
1211                         if (!REQ_ARGS(1))
1212                                 return -1;
1213                         define_prefix = GET_ARG();
1214                 } else if (is_prefix(*argv, "unprivileged")) {
1215 #ifdef USE_LIBCAP
1216                         run_as_unprivileged = true;
1217                         NEXT_ARG();
1218 #else
1219                         p_err("unprivileged run not supported, recompile bpftool with libcap");
1220                         return -1;
1221 #endif
1222                 } else {
1223                         p_err("expected no more arguments, 'kernel', 'dev', 'macros' or 'prefix', got: '%s'?",
1224                               *argv);
1225                         return -1;
1226                 }
1227         }
1228
1229         /* Full feature detection requires specific privileges.
1230          * Let's approximate, and warn if user is not root.
1231          */
1232         if (handle_perms())
1233                 return -1;
1234
1235         if (json_output) {
1236                 define_prefix = NULL;
1237                 jsonw_start_object(json_wtr);
1238         }
1239
1240         section_system_config(target, define_prefix);
1241         if (!section_syscall_config(define_prefix))
1242                 /* bpf() syscall unavailable, don't probe other BPF features */
1243                 goto exit_close_json;
1244         section_program_types(supported_types, define_prefix, ifindex);
1245         section_map_types(define_prefix, ifindex);
1246         section_helpers(supported_types, define_prefix, ifindex);
1247         section_misc(define_prefix, ifindex);
1248
1249 exit_close_json:
1250         if (json_output)
1251                 /* End root object */
1252                 jsonw_end_object(json_wtr);
1253
1254         return 0;
1255 }
1256
1257 static const char *get_helper_name(unsigned int id)
1258 {
1259         if (id >= ARRAY_SIZE(helper_name))
1260                 return NULL;
1261
1262         return helper_name[id];
1263 }
1264
1265 static int do_list_builtins(int argc, char **argv)
1266 {
1267         const char *(*get_name)(unsigned int id);
1268         unsigned int id = 0;
1269
1270         if (argc < 1)
1271                 usage();
1272
1273         if (is_prefix(*argv, "prog_types")) {
1274                 get_name = (const char *(*)(unsigned int))libbpf_bpf_prog_type_str;
1275         } else if (is_prefix(*argv, "map_types")) {
1276                 get_name = (const char *(*)(unsigned int))libbpf_bpf_map_type_str;
1277         } else if (is_prefix(*argv, "attach_types")) {
1278                 get_name = (const char *(*)(unsigned int))libbpf_bpf_attach_type_str;
1279         } else if (is_prefix(*argv, "link_types")) {
1280                 get_name = (const char *(*)(unsigned int))libbpf_bpf_link_type_str;
1281         } else if (is_prefix(*argv, "helpers")) {
1282                 get_name = get_helper_name;
1283         } else {
1284                 p_err("expected 'prog_types', 'map_types', 'attach_types', 'link_types' or 'helpers', got: %s", *argv);
1285                 return -1;
1286         }
1287
1288         if (json_output)
1289                 jsonw_start_array(json_wtr);    /* root array */
1290
1291         while (true) {
1292                 const char *name;
1293
1294                 name = get_name(id++);
1295                 if (!name)
1296                         break;
1297                 if (json_output)
1298                         jsonw_string(json_wtr, name);
1299                 else
1300                         printf("%s\n", name);
1301         }
1302
1303         if (json_output)
1304                 jsonw_end_array(json_wtr);      /* root array */
1305
1306         return 0;
1307 }
1308
1309 static int do_help(int argc, char **argv)
1310 {
1311         if (json_output) {
1312                 jsonw_null(json_wtr);
1313                 return 0;
1314         }
1315
1316         fprintf(stderr,
1317                 "Usage: %1$s %2$s probe [COMPONENT] [full] [unprivileged] [macros [prefix PREFIX]]\n"
1318                 "       %1$s %2$s list_builtins GROUP\n"
1319                 "       %1$s %2$s help\n"
1320                 "\n"
1321                 "       COMPONENT := { kernel | dev NAME }\n"
1322                 "       GROUP := { prog_types | map_types | attach_types | link_types | helpers }\n"
1323                 "       " HELP_SPEC_OPTIONS " }\n"
1324                 "",
1325                 bin_name, argv[-2]);
1326
1327         return 0;
1328 }
1329
1330 static const struct cmd cmds[] = {
1331         { "probe",              do_probe },
1332         { "list_builtins",      do_list_builtins },
1333         { "help",               do_help },
1334         { 0 }
1335 };
1336
1337 int do_feature(int argc, char **argv)
1338 {
1339         return cmd_select(cmds, argc, argv, do_help);
1340 }