1 // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
2 /* Copyright (c) 2019 Netronome Systems, Inc. */
9 #include <sys/utsname.h>
12 #include <linux/filter.h>
13 #include <linux/limits.h>
16 #include <bpf/libbpf.h>
21 #ifndef PROC_SUPER_MAGIC
22 # define PROC_SUPER_MAGIC 0x9fa0
25 enum probe_component
{
31 #define BPF_HELPER_MAKE_ENTRY(name) [BPF_FUNC_ ## name] = "bpf_" # name
32 static const char * const helper_name
[] = {
33 __BPF_FUNC_MAPPER(BPF_HELPER_MAKE_ENTRY
)
36 #undef BPF_HELPER_MAKE_ENTRY
38 /* Miscellaneous utility functions */
40 static bool check_procfs(void)
44 if (statfs("/proc", &st_fs
) < 0)
46 if ((unsigned long)st_fs
.f_type
!= PROC_SUPER_MAGIC
)
52 static void uppercase(char *str
, size_t len
)
56 for (i
= 0; i
< len
&& str
[i
] != '\0'; i
++)
57 str
[i
] = toupper(str
[i
]);
60 /* Printing utility functions */
63 print_bool_feature(const char *feat_name
, const char *plain_name
,
64 const char *define_name
, bool res
, const char *define_prefix
)
67 jsonw_bool_field(json_wtr
, feat_name
, res
);
68 else if (define_prefix
)
69 printf("#define %s%sHAVE_%s\n", define_prefix
,
70 res
? "" : "NO_", define_name
);
72 printf("%s is %savailable\n", plain_name
, res
? "" : "NOT ");
75 static void print_kernel_option(const char *name
, const char *value
)
80 /* No support for C-style ouptut */
84 jsonw_null_field(json_wtr
, name
);
88 res
= strtol(value
, &endptr
, 0);
89 if (!errno
&& *endptr
== '\n')
90 jsonw_int_field(json_wtr
, name
, res
);
92 jsonw_string_field(json_wtr
, name
, value
);
95 printf("%s is set to %s\n", name
, value
);
97 printf("%s is not set\n", name
);
102 print_start_section(const char *json_title
, const char *plain_title
,
103 const char *define_comment
, const char *define_prefix
)
106 jsonw_name(json_wtr
, json_title
);
107 jsonw_start_object(json_wtr
);
108 } else if (define_prefix
) {
109 printf("%s\n", define_comment
);
111 printf("%s\n", plain_title
);
116 print_end_then_start_section(const char *json_title
, const char *plain_title
,
117 const char *define_comment
,
118 const char *define_prefix
)
121 jsonw_end_object(json_wtr
);
125 print_start_section(json_title
, plain_title
, define_comment
,
129 /* Probing functions */
131 static int read_procfs(const char *path
)
133 char *endptr
, *line
= NULL
;
138 fd
= fopen(path
, "r");
142 res
= getline(&line
, &len
, fd
);
148 res
= strtol(line
, &endptr
, 10);
149 if (errno
|| *line
== '\0' || *endptr
!= '\n')
156 static void probe_unprivileged_disabled(void)
160 /* No support for C-style ouptut */
162 res
= read_procfs("/proc/sys/kernel/unprivileged_bpf_disabled");
164 jsonw_int_field(json_wtr
, "unprivileged_bpf_disabled", res
);
168 printf("bpf() syscall for unprivileged users is enabled\n");
171 printf("bpf() syscall restricted to privileged users\n");
174 printf("Unable to retrieve required privileges for bpf() syscall\n");
177 printf("bpf() syscall restriction has unknown value %d\n", res
);
182 static void probe_jit_enable(void)
186 /* No support for C-style ouptut */
188 res
= read_procfs("/proc/sys/net/core/bpf_jit_enable");
190 jsonw_int_field(json_wtr
, "bpf_jit_enable", res
);
194 printf("JIT compiler is disabled\n");
197 printf("JIT compiler is enabled\n");
200 printf("JIT compiler is enabled with debugging traces in kernel logs\n");
203 printf("Unable to retrieve JIT-compiler status\n");
206 printf("JIT-compiler status has unknown value %d\n",
212 static void probe_jit_harden(void)
216 /* No support for C-style ouptut */
218 res
= read_procfs("/proc/sys/net/core/bpf_jit_harden");
220 jsonw_int_field(json_wtr
, "bpf_jit_harden", res
);
224 printf("JIT compiler hardening is disabled\n");
227 printf("JIT compiler hardening is enabled for unprivileged users\n");
230 printf("JIT compiler hardening is enabled for all users\n");
233 printf("Unable to retrieve JIT hardening status\n");
236 printf("JIT hardening status has unknown value %d\n",
242 static void probe_jit_kallsyms(void)
246 /* No support for C-style ouptut */
248 res
= read_procfs("/proc/sys/net/core/bpf_jit_kallsyms");
250 jsonw_int_field(json_wtr
, "bpf_jit_kallsyms", res
);
254 printf("JIT compiler kallsyms exports are disabled\n");
257 printf("JIT compiler kallsyms exports are enabled for root\n");
260 printf("Unable to retrieve JIT kallsyms export status\n");
263 printf("JIT kallsyms exports status has unknown value %d\n", res
);
268 static void probe_jit_limit(void)
272 /* No support for C-style ouptut */
274 res
= read_procfs("/proc/sys/net/core/bpf_jit_limit");
276 jsonw_int_field(json_wtr
, "bpf_jit_limit", res
);
280 printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n");
283 printf("Global memory limit for JIT compiler for unprivileged users is %d bytes\n", res
);
288 static bool read_next_kernel_config_option(gzFile file
, char *buf
, size_t n
,
293 while (gzgets(file
, buf
, n
)) {
294 if (strncmp(buf
, "CONFIG_", 7))
297 sep
= strchr(buf
, '=');
301 /* Trim ending '\n' */
302 buf
[strlen(buf
) - 1] = '\0';
304 /* Split on '=' and ensure that a value is present. */
316 static void probe_kernel_image_config(void)
318 static const char * const options
[] = {
321 /* Enable bpf() syscall */
322 "CONFIG_BPF_SYSCALL",
323 /* Does selected architecture support eBPF JIT compiler */
324 "CONFIG_HAVE_EBPF_JIT",
325 /* Compile eBPF JIT compiler */
327 /* Avoid compiling eBPF interpreter (use JIT only) */
328 "CONFIG_BPF_JIT_ALWAYS_ON",
332 /* BPF programs attached to cgroups */
334 /* bpf_get_cgroup_classid() helper */
335 "CONFIG_CGROUP_NET_CLASSID",
336 /* bpf_skb_{,ancestor_}cgroup_id() helpers */
337 "CONFIG_SOCK_CGROUP_DATA",
339 /* Tracing: attach BPF to kprobes, tracepoints, etc. */
342 "CONFIG_KPROBE_EVENTS",
344 "CONFIG_UPROBE_EVENTS",
347 /* Syscall tracepoints */
348 "CONFIG_FTRACE_SYSCALLS",
349 /* bpf_override_return() helper support for selected arch */
350 "CONFIG_FUNCTION_ERROR_INJECTION",
351 /* bpf_override_return() helper */
352 "CONFIG_BPF_KPROBE_OVERRIDE",
357 "CONFIG_XDP_SOCKETS",
358 /* BPF_PROG_TYPE_LWT_* and related helpers */
359 "CONFIG_LWTUNNEL_BPF",
360 /* BPF_PROG_TYPE_SCHED_ACT, TC (traffic control) actions */
361 "CONFIG_NET_ACT_BPF",
362 /* BPF_PROG_TYPE_SCHED_CLS, TC filters */
363 "CONFIG_NET_CLS_BPF",
364 /* TC clsact qdisc */
365 "CONFIG_NET_CLS_ACT",
366 /* Ingress filtering with TC */
367 "CONFIG_NET_SCH_INGRESS",
368 /* bpf_skb_get_xfrm_state() helper */
370 /* bpf_get_route_realm() helper */
371 "CONFIG_IP_ROUTE_CLASSID",
372 /* BPF_PROG_TYPE_LWT_SEG6_LOCAL and related helpers */
373 "CONFIG_IPV6_SEG6_BPF",
374 /* BPF_PROG_TYPE_LIRC_MODE2 and related helpers */
375 "CONFIG_BPF_LIRC_MODE2",
376 /* BPF stream parser and BPF socket maps */
377 "CONFIG_BPF_STREAM_PARSER",
378 /* xt_bpf module for passing BPF programs to netfilter */
379 "CONFIG_NETFILTER_XT_MATCH_BPF",
380 /* bpfilter back-end for iptables */
382 /* bpftilter module with "user mode helper" */
383 "CONFIG_BPFILTER_UMH",
385 /* test_bpf module for BPF tests */
388 char *values
[ARRAY_SIZE(options
)] = { };
397 snprintf(path
, sizeof(path
), "/boot/config-%s", utsn
.release
);
399 /* gzopen also accepts uncompressed files. */
400 file
= gzopen(path
, "r");
404 /* Some distributions build with CONFIG_IKCONFIG=y and put the
405 * config file at /proc/config.gz.
407 file
= gzopen("/proc/config.gz", "r");
410 p_info("skipping kernel config, can't open file: %s",
415 if (!gzgets(file
, buf
, sizeof(buf
)) ||
416 !gzgets(file
, buf
, sizeof(buf
))) {
417 p_info("skipping kernel config, can't read from file: %s",
421 if (strcmp(buf
, "# Automatically generated file; DO NOT EDIT.\n")) {
422 p_info("skipping kernel config, can't find correct file");
426 while (read_next_kernel_config_option(file
, buf
, sizeof(buf
), &value
)) {
427 for (i
= 0; i
< ARRAY_SIZE(options
); i
++) {
428 if (values
[i
] || strcmp(buf
, options
[i
]))
431 values
[i
] = strdup(value
);
439 for (i
= 0; i
< ARRAY_SIZE(options
); i
++) {
440 print_kernel_option(options
[i
], values
[i
]);
445 static bool probe_bpf_syscall(const char *define_prefix
)
449 bpf_load_program(BPF_PROG_TYPE_UNSPEC
, NULL
, 0, NULL
, 0, NULL
, 0);
450 res
= (errno
!= ENOSYS
);
452 print_bool_feature("have_bpf_syscall",
461 probe_prog_type(enum bpf_prog_type prog_type
, bool *supported_types
,
462 const char *define_prefix
, __u32 ifindex
)
464 char feat_name
[128], plain_desc
[128], define_name
[128];
465 const char *plain_comment
= "eBPF program_type ";
470 /* Only test offload-able program types */
472 case BPF_PROG_TYPE_SCHED_CLS
:
473 case BPF_PROG_TYPE_XDP
:
479 res
= bpf_probe_prog_type(prog_type
, ifindex
);
481 supported_types
[prog_type
] |= res
;
483 maxlen
= sizeof(plain_desc
) - strlen(plain_comment
) - 1;
484 if (strlen(prog_type_name
[prog_type
]) > maxlen
) {
485 p_info("program type name too long");
489 sprintf(feat_name
, "have_%s_prog_type", prog_type_name
[prog_type
]);
490 sprintf(define_name
, "%s_prog_type", prog_type_name
[prog_type
]);
491 uppercase(define_name
, sizeof(define_name
));
492 sprintf(plain_desc
, "%s%s", plain_comment
, prog_type_name
[prog_type
]);
493 print_bool_feature(feat_name
, plain_desc
, define_name
, res
,
498 probe_map_type(enum bpf_map_type map_type
, const char *define_prefix
,
501 char feat_name
[128], plain_desc
[128], define_name
[128];
502 const char *plain_comment
= "eBPF map_type ";
506 res
= bpf_probe_map_type(map_type
, ifindex
);
508 maxlen
= sizeof(plain_desc
) - strlen(plain_comment
) - 1;
509 if (strlen(map_type_name
[map_type
]) > maxlen
) {
510 p_info("map type name too long");
514 sprintf(feat_name
, "have_%s_map_type", map_type_name
[map_type
]);
515 sprintf(define_name
, "%s_map_type", map_type_name
[map_type
]);
516 uppercase(define_name
, sizeof(define_name
));
517 sprintf(plain_desc
, "%s%s", plain_comment
, map_type_name
[map_type
]);
518 print_bool_feature(feat_name
, plain_desc
, define_name
, res
,
523 probe_helpers_for_progtype(enum bpf_prog_type prog_type
, bool supported_type
,
524 const char *define_prefix
, __u32 ifindex
)
526 const char *ptype_name
= prog_type_name
[prog_type
];
532 /* Only test helpers for offload-able program types */
534 case BPF_PROG_TYPE_SCHED_CLS
:
535 case BPF_PROG_TYPE_XDP
:
542 sprintf(feat_name
, "%s_available_helpers", ptype_name
);
543 jsonw_name(json_wtr
, feat_name
);
544 jsonw_start_array(json_wtr
);
545 } else if (!define_prefix
) {
546 printf("eBPF helpers supported for program type %s:",
550 for (id
= 1; id
< ARRAY_SIZE(helper_name
); id
++) {
554 res
= bpf_probe_helper(id
, prog_type
, ifindex
);
558 jsonw_string(json_wtr
, helper_name
[id
]);
559 } else if (define_prefix
) {
560 printf("#define %sBPF__PROG_TYPE_%s__HELPER_%s %s\n",
561 define_prefix
, ptype_name
, helper_name
[id
],
565 printf("\n\t- %s", helper_name
[id
]);
570 jsonw_end_array(json_wtr
);
571 else if (!define_prefix
)
576 probe_large_insn_limit(const char *define_prefix
, __u32 ifindex
)
580 res
= bpf_probe_large_insn_limit(ifindex
);
581 print_bool_feature("have_large_insn_limit",
582 "Large program size limit",
583 "HAVE_LARGE_INSN_LIMIT",
587 static int do_probe(int argc
, char **argv
)
589 enum probe_component target
= COMPONENT_UNSPEC
;
590 const char *define_prefix
= NULL
;
591 bool supported_types
[128] = {};
596 /* Detection assumes user has sufficient privileges (CAP_SYS_ADMIN).
597 * Let's approximate, and restrict usage to root user only.
600 p_err("please run this command as root user");
607 if (is_prefix(*argv
, "kernel")) {
608 if (target
!= COMPONENT_UNSPEC
) {
609 p_err("component to probe already specified");
612 target
= COMPONENT_KERNEL
;
614 } else if (is_prefix(*argv
, "dev")) {
617 if (target
!= COMPONENT_UNSPEC
|| ifindex
) {
618 p_err("component to probe already specified");
624 target
= COMPONENT_DEVICE
;
626 ifindex
= if_nametoindex(ifname
);
628 p_err("unrecognized netdevice '%s': %s", ifname
,
632 } else if (is_prefix(*argv
, "macros") && !define_prefix
) {
635 } else if (is_prefix(*argv
, "prefix")) {
636 if (!define_prefix
) {
637 p_err("'prefix' argument can only be use after 'macros'");
640 if (strcmp(define_prefix
, "")) {
641 p_err("'prefix' already defined");
648 define_prefix
= GET_ARG();
650 p_err("expected no more arguments, 'kernel', 'dev', 'macros' or 'prefix', got: '%s'?",
657 define_prefix
= NULL
;
658 jsonw_start_object(json_wtr
);
662 case COMPONENT_KERNEL
:
663 case COMPONENT_UNSPEC
:
667 print_start_section("system_config",
668 "Scanning system configuration...",
669 NULL
, /* define_comment never used here */
670 NULL
); /* define_prefix always NULL here */
671 if (check_procfs()) {
672 probe_unprivileged_disabled();
675 probe_jit_kallsyms();
678 p_info("/* procfs not mounted, skipping related probes */");
680 probe_kernel_image_config();
682 jsonw_end_object(json_wtr
);
690 print_start_section("syscall_config",
691 "Scanning system call availability...",
692 "/*** System call availability ***/",
695 if (!probe_bpf_syscall(define_prefix
))
696 /* bpf() syscall unavailable, don't probe other BPF features */
697 goto exit_close_json
;
699 print_end_then_start_section("program_types",
700 "Scanning eBPF program types...",
701 "/*** eBPF program types ***/",
704 for (i
= BPF_PROG_TYPE_UNSPEC
+ 1; i
< ARRAY_SIZE(prog_type_name
); i
++)
705 probe_prog_type(i
, supported_types
, define_prefix
, ifindex
);
707 print_end_then_start_section("map_types",
708 "Scanning eBPF map types...",
709 "/*** eBPF map types ***/",
712 for (i
= BPF_MAP_TYPE_UNSPEC
+ 1; i
< map_type_name_size
; i
++)
713 probe_map_type(i
, define_prefix
, ifindex
);
715 print_end_then_start_section("helpers",
716 "Scanning eBPF helper functions...",
717 "/*** eBPF helper functions ***/",
722 " * Use %sHAVE_PROG_TYPE_HELPER(prog_type_name, helper_name)\n"
723 " * to determine if <helper_name> is available for <prog_type_name>,\n"
725 " * #if %sHAVE_PROG_TYPE_HELPER(xdp, bpf_redirect)\n"
726 " * // do stuff with this helper\n"
728 " * // use a workaround\n"
731 "#define %sHAVE_PROG_TYPE_HELPER(prog_type, helper) \\\n"
732 " %sBPF__PROG_TYPE_ ## prog_type ## __HELPER_ ## helper\n",
733 define_prefix
, define_prefix
, define_prefix
,
735 for (i
= BPF_PROG_TYPE_UNSPEC
+ 1; i
< ARRAY_SIZE(prog_type_name
); i
++)
736 probe_helpers_for_progtype(i
, supported_types
[i
],
737 define_prefix
, ifindex
);
739 print_end_then_start_section("misc",
740 "Scanning miscellaneous eBPF features...",
741 "/*** eBPF misc features ***/",
743 probe_large_insn_limit(define_prefix
, ifindex
);
747 /* End current "section" of probes */
748 jsonw_end_object(json_wtr
);
749 /* End root object */
750 jsonw_end_object(json_wtr
);
756 static int do_help(int argc
, char **argv
)
759 jsonw_null(json_wtr
);
764 "Usage: %s %s probe [COMPONENT] [macros [prefix PREFIX]]\n"
767 " COMPONENT := { kernel | dev NAME }\n"
769 bin_name
, argv
[-2], bin_name
, argv
[-2]);
774 static const struct cmd cmds
[] = {
775 { "probe", do_probe
},
780 int do_feature(int argc
, char **argv
)
782 return cmd_select(cmds
, argc
, argv
, do_help
);