Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Merge branch 'bpftool-probes'

Quentin Monnet says:

====================
Hi,
This set adds a new command to bpftool in order to dump a list of
eBPF-related parameters for the system (or for a specific network
device) to the console. Once again, this is based on a suggestion from
Daniel.

At this time, output includes:

- Availability of bpf() system call
- Availability of bpf() system call for unprivileged users
- JIT status (enabled or not, with or without debugging traces)
- JIT hardening status
- JIT kallsyms exports status
- Global memory limit for JIT compiler for unprivileged users
- Status of kernel compilation options related to BPF features
- Availability of known eBPF program types
- Availability of known eBPF map types
- Availability of known eBPF helper functions

There are three different ways to dump this information at this time:

- Plain output dumps probe results in plain text. It is the most
flexible options for providing descriptive output to the user, but
should not be relied upon for parsing the output.
- JSON output is supported.
- A third mode, available through the "macros" keyword appended to the
command line, dumps some of those parameters (not all) as a series of
"#define" directives, that can be included into a C header file for
example.

Probes for supported program and map types, and supported helpers, are
directly added to libbpf, so that other applications (or selftests) can
reuse them as necessary.

If the user does not have root privileges (or more precisely, the
CAP_SYS_ADMIN capability) detection will be erroneous for most
parameters. Therefore, forbid non-root users to run the command.

v5:
- Move exported symbols to a new LIBBPF_0.0.2 section in libbpf.map
(patches 4 to 6).
- Minor fixes on patches 3 and 4.

v4:
- Probe bpf_jit_limit parameter (patch 2).
- Probe some additional kernel config options (patch 3).
- Minor fixes on patch 6.

v3:
- Do not probe kernel version in bpftool (just retrieve it to probe support
for kprobes in libbpf).
- Change the way results for helper support is displayed: now one list of
compatible helpers for each program type (and C-style output gets a
HAVE_PROG_TYPE_HELPER(prog_type, helper) macro to help with tests. See
patches 6, 7.
- Address other comments from feedback from v2 (please refer to individual
patches' history).

v2 (please also refer to individual patches' history):
- Move probes for prog/map types, helpers, from bpftool to libbpf.
- Move C-style output as a separate patch, and restrict it to a subset of
collected information (bpf() availability, prog/map types, helpers).
- Now probe helpers with all supported program types, and display a list of
compatible program types (as supported on the system) for each helper.
- NOT addressed: grouping compilation options for kernel into subsections
(patch 3) (I don't see an easy way of grouping them at the moment, please
see also the discussion on v1 thread).
====================

Signed-off-by: Alexei Starovoitov <ast@kernel.org>

+1147 -3
+1
tools/bpf/bpftool/Documentation/bpftool-cgroup.rst
··· 142 142 **bpftool**\ (8), 143 143 **bpftool-prog**\ (8), 144 144 **bpftool-map**\ (8), 145 + **bpftool-feature**\ (8), 145 146 **bpftool-net**\ (8), 146 147 **bpftool-perf**\ (8)
+85
tools/bpf/bpftool/Documentation/bpftool-feature.rst
··· 1 + =============== 2 + bpftool-feature 3 + =============== 4 + ------------------------------------------------------------------------------- 5 + tool for inspection of eBPF-related parameters for Linux kernel or net device 6 + ------------------------------------------------------------------------------- 7 + 8 + :Manual section: 8 9 + 10 + SYNOPSIS 11 + ======== 12 + 13 + **bpftool** [*OPTIONS*] **feature** *COMMAND* 14 + 15 + *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] } 16 + 17 + *COMMANDS* := { **probe** | **help** } 18 + 19 + MAP COMMANDS 20 + ============= 21 + 22 + | **bpftool** **feature probe** [*COMPONENT*] [**macros** [**prefix** *PREFIX*]] 23 + | **bpftool** **feature help** 24 + | 25 + | *COMPONENT* := { **kernel** | **dev** *NAME* } 26 + 27 + DESCRIPTION 28 + =========== 29 + **bpftool feature probe** [**kernel**] [**macros** [**prefix** *PREFIX*]] 30 + Probe the running kernel and dump a number of eBPF-related 31 + parameters, such as availability of the **bpf()** system call, 32 + JIT status, eBPF program types availability, eBPF helper 33 + functions availability, and more. 34 + 35 + If the **macros** keyword (but not the **-j** option) is 36 + passed, a subset of the output is dumped as a list of 37 + **#define** macros that are ready to be included in a C 38 + header file, for example. If, additionally, **prefix** is 39 + used to define a *PREFIX*, the provided string will be used 40 + as a prefix to the names of the macros: this can be used to 41 + avoid conflicts on macro names when including the output of 42 + this command as a header file. 43 + 44 + Keyword **kernel** can be omitted. If no probe target is 45 + specified, probing the kernel is the default behaviour. 46 + 47 + Note that when probed, some eBPF helpers (e.g. 48 + **bpf_trace_printk**\ () or **bpf_probe_write_user**\ ()) may 49 + print warnings to kernel logs. 50 + 51 + **bpftool feature probe dev** *NAME* [**macros** [**prefix** *PREFIX*]] 52 + Probe network device for supported eBPF features and dump 53 + results to the console. 54 + 55 + The two keywords **macros** and **prefix** have the same 56 + role as when probing the kernel. 57 + 58 + **bpftool feature help** 59 + Print short help message. 60 + 61 + OPTIONS 62 + ======= 63 + -h, --help 64 + Print short generic help message (similar to **bpftool help**). 65 + 66 + -v, --version 67 + Print version number (similar to **bpftool version**). 68 + 69 + -j, --json 70 + Generate JSON output. For commands that cannot produce JSON, this 71 + option has no effect. 72 + 73 + -p, --pretty 74 + Generate human-readable JSON output. Implies **-j**. 75 + 76 + SEE ALSO 77 + ======== 78 + **bpf**\ (2), 79 + **bpf-helpers**\ (7), 80 + **bpftool**\ (8), 81 + **bpftool-prog**\ (8), 82 + **bpftool-map**\ (8), 83 + **bpftool-cgroup**\ (8), 84 + **bpftool-net**\ (8), 85 + **bpftool-perf**\ (8)
+1
tools/bpf/bpftool/Documentation/bpftool-map.rst
··· 256 256 **bpftool**\ (8), 257 257 **bpftool-prog**\ (8), 258 258 **bpftool-cgroup**\ (8), 259 + **bpftool-feature**\ (8), 259 260 **bpftool-net**\ (8), 260 261 **bpftool-perf**\ (8)
+1
tools/bpf/bpftool/Documentation/bpftool-net.rst
··· 142 142 **bpftool-prog**\ (8), 143 143 **bpftool-map**\ (8), 144 144 **bpftool-cgroup**\ (8), 145 + **bpftool-feature**\ (8), 145 146 **bpftool-perf**\ (8)
+1
tools/bpf/bpftool/Documentation/bpftool-perf.rst
··· 84 84 **bpftool-prog**\ (8), 85 85 **bpftool-map**\ (8), 86 86 **bpftool-cgroup**\ (8), 87 + **bpftool-feature**\ (8), 87 88 **bpftool-net**\ (8)
+1
tools/bpf/bpftool/Documentation/bpftool-prog.rst
··· 258 258 **bpftool**\ (8), 259 259 **bpftool-map**\ (8), 260 260 **bpftool-cgroup**\ (8), 261 + **bpftool-feature**\ (8), 261 262 **bpftool-net**\ (8), 262 263 **bpftool-perf**\ (8)
+1
tools/bpf/bpftool/Documentation/bpftool.rst
··· 72 72 **bpftool-prog**\ (8), 73 73 **bpftool-map**\ (8), 74 74 **bpftool-cgroup**\ (8), 75 + **bpftool-feature**\ (8), 75 76 **bpftool-net**\ (8), 76 77 **bpftool-perf**\ (8)
+19
tools/bpf/bpftool/bash-completion/bpftool
··· 679 679 ;; 680 680 esac 681 681 ;; 682 + feature) 683 + case $command in 684 + probe) 685 + [[ $prev == "dev" ]] && _sysfs_get_netdevs && return 0 686 + [[ $prev == "prefix" ]] && return 0 687 + if _bpftool_search_list 'macros'; then 688 + COMPREPLY+=( $( compgen -W 'prefix' -- "$cur" ) ) 689 + else 690 + COMPREPLY+=( $( compgen -W 'macros' -- "$cur" ) ) 691 + fi 692 + _bpftool_one_of_list 'kernel dev' 693 + return 0 694 + ;; 695 + *) 696 + [[ $prev == $object ]] && \ 697 + COMPREPLY=( $( compgen -W 'help probe' -- "$cur" ) ) 698 + ;; 699 + esac 700 + ;; 682 701 esac 683 702 } && 684 703 complete -F _bpftool bpftool
+764
tools/bpf/bpftool/feature.c
··· 1 + // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) 2 + /* Copyright (c) 2019 Netronome Systems, Inc. */ 3 + 4 + #include <ctype.h> 5 + #include <errno.h> 6 + #include <string.h> 7 + #include <unistd.h> 8 + #include <net/if.h> 9 + #include <sys/utsname.h> 10 + #include <sys/vfs.h> 11 + 12 + #include <linux/filter.h> 13 + #include <linux/limits.h> 14 + 15 + #include <bpf.h> 16 + #include <libbpf.h> 17 + 18 + #include "main.h" 19 + 20 + #ifndef PROC_SUPER_MAGIC 21 + # define PROC_SUPER_MAGIC 0x9fa0 22 + #endif 23 + 24 + enum probe_component { 25 + COMPONENT_UNSPEC, 26 + COMPONENT_KERNEL, 27 + COMPONENT_DEVICE, 28 + }; 29 + 30 + #define BPF_HELPER_MAKE_ENTRY(name) [BPF_FUNC_ ## name] = "bpf_" # name 31 + static const char * const helper_name[] = { 32 + __BPF_FUNC_MAPPER(BPF_HELPER_MAKE_ENTRY) 33 + }; 34 + 35 + #undef BPF_HELPER_MAKE_ENTRY 36 + 37 + /* Miscellaneous utility functions */ 38 + 39 + static bool check_procfs(void) 40 + { 41 + struct statfs st_fs; 42 + 43 + if (statfs("/proc", &st_fs) < 0) 44 + return false; 45 + if ((unsigned long)st_fs.f_type != PROC_SUPER_MAGIC) 46 + return false; 47 + 48 + return true; 49 + } 50 + 51 + static void uppercase(char *str, size_t len) 52 + { 53 + size_t i; 54 + 55 + for (i = 0; i < len && str[i] != '\0'; i++) 56 + str[i] = toupper(str[i]); 57 + } 58 + 59 + /* Printing utility functions */ 60 + 61 + static void 62 + print_bool_feature(const char *feat_name, const char *plain_name, 63 + const char *define_name, bool res, const char *define_prefix) 64 + { 65 + if (json_output) 66 + jsonw_bool_field(json_wtr, feat_name, res); 67 + else if (define_prefix) 68 + printf("#define %s%sHAVE_%s\n", define_prefix, 69 + res ? "" : "NO_", define_name); 70 + else 71 + printf("%s is %savailable\n", plain_name, res ? "" : "NOT "); 72 + } 73 + 74 + static void print_kernel_option(const char *name, const char *value) 75 + { 76 + char *endptr; 77 + int res; 78 + 79 + /* No support for C-style ouptut */ 80 + 81 + if (json_output) { 82 + if (!value) { 83 + jsonw_null_field(json_wtr, name); 84 + return; 85 + } 86 + errno = 0; 87 + res = strtol(value, &endptr, 0); 88 + if (!errno && *endptr == '\n') 89 + jsonw_int_field(json_wtr, name, res); 90 + else 91 + jsonw_string_field(json_wtr, name, value); 92 + } else { 93 + if (value) 94 + printf("%s is set to %s\n", name, value); 95 + else 96 + printf("%s is not set\n", name); 97 + } 98 + } 99 + 100 + static void 101 + print_start_section(const char *json_title, const char *plain_title, 102 + const char *define_comment, const char *define_prefix) 103 + { 104 + if (json_output) { 105 + jsonw_name(json_wtr, json_title); 106 + jsonw_start_object(json_wtr); 107 + } else if (define_prefix) { 108 + printf("%s\n", define_comment); 109 + } else { 110 + printf("%s\n", plain_title); 111 + } 112 + } 113 + 114 + static void 115 + print_end_then_start_section(const char *json_title, const char *plain_title, 116 + const char *define_comment, 117 + const char *define_prefix) 118 + { 119 + if (json_output) 120 + jsonw_end_object(json_wtr); 121 + else 122 + printf("\n"); 123 + 124 + print_start_section(json_title, plain_title, define_comment, 125 + define_prefix); 126 + } 127 + 128 + /* Probing functions */ 129 + 130 + static int read_procfs(const char *path) 131 + { 132 + char *endptr, *line = NULL; 133 + size_t len = 0; 134 + FILE *fd; 135 + int res; 136 + 137 + fd = fopen(path, "r"); 138 + if (!fd) 139 + return -1; 140 + 141 + res = getline(&line, &len, fd); 142 + fclose(fd); 143 + if (res < 0) 144 + return -1; 145 + 146 + errno = 0; 147 + res = strtol(line, &endptr, 10); 148 + if (errno || *line == '\0' || *endptr != '\n') 149 + res = -1; 150 + free(line); 151 + 152 + return res; 153 + } 154 + 155 + static void probe_unprivileged_disabled(void) 156 + { 157 + int res; 158 + 159 + /* No support for C-style ouptut */ 160 + 161 + res = read_procfs("/proc/sys/kernel/unprivileged_bpf_disabled"); 162 + if (json_output) { 163 + jsonw_int_field(json_wtr, "unprivileged_bpf_disabled", res); 164 + } else { 165 + switch (res) { 166 + case 0: 167 + printf("bpf() syscall for unprivileged users is enabled\n"); 168 + break; 169 + case 1: 170 + printf("bpf() syscall restricted to privileged users\n"); 171 + break; 172 + case -1: 173 + printf("Unable to retrieve required privileges for bpf() syscall\n"); 174 + break; 175 + default: 176 + printf("bpf() syscall restriction has unknown value %d\n", res); 177 + } 178 + } 179 + } 180 + 181 + static void probe_jit_enable(void) 182 + { 183 + int res; 184 + 185 + /* No support for C-style ouptut */ 186 + 187 + res = read_procfs("/proc/sys/net/core/bpf_jit_enable"); 188 + if (json_output) { 189 + jsonw_int_field(json_wtr, "bpf_jit_enable", res); 190 + } else { 191 + switch (res) { 192 + case 0: 193 + printf("JIT compiler is disabled\n"); 194 + break; 195 + case 1: 196 + printf("JIT compiler is enabled\n"); 197 + break; 198 + case 2: 199 + printf("JIT compiler is enabled with debugging traces in kernel logs\n"); 200 + break; 201 + case -1: 202 + printf("Unable to retrieve JIT-compiler status\n"); 203 + break; 204 + default: 205 + printf("JIT-compiler status has unknown value %d\n", 206 + res); 207 + } 208 + } 209 + } 210 + 211 + static void probe_jit_harden(void) 212 + { 213 + int res; 214 + 215 + /* No support for C-style ouptut */ 216 + 217 + res = read_procfs("/proc/sys/net/core/bpf_jit_harden"); 218 + if (json_output) { 219 + jsonw_int_field(json_wtr, "bpf_jit_harden", res); 220 + } else { 221 + switch (res) { 222 + case 0: 223 + printf("JIT compiler hardening is disabled\n"); 224 + break; 225 + case 1: 226 + printf("JIT compiler hardening is enabled for unprivileged users\n"); 227 + break; 228 + case 2: 229 + printf("JIT compiler hardening is enabled for all users\n"); 230 + break; 231 + case -1: 232 + printf("Unable to retrieve JIT hardening status\n"); 233 + break; 234 + default: 235 + printf("JIT hardening status has unknown value %d\n", 236 + res); 237 + } 238 + } 239 + } 240 + 241 + static void probe_jit_kallsyms(void) 242 + { 243 + int res; 244 + 245 + /* No support for C-style ouptut */ 246 + 247 + res = read_procfs("/proc/sys/net/core/bpf_jit_kallsyms"); 248 + if (json_output) { 249 + jsonw_int_field(json_wtr, "bpf_jit_kallsyms", res); 250 + } else { 251 + switch (res) { 252 + case 0: 253 + printf("JIT compiler kallsyms exports are disabled\n"); 254 + break; 255 + case 1: 256 + printf("JIT compiler kallsyms exports are enabled for root\n"); 257 + break; 258 + case -1: 259 + printf("Unable to retrieve JIT kallsyms export status\n"); 260 + break; 261 + default: 262 + printf("JIT kallsyms exports status has unknown value %d\n", res); 263 + } 264 + } 265 + } 266 + 267 + static void probe_jit_limit(void) 268 + { 269 + int res; 270 + 271 + /* No support for C-style ouptut */ 272 + 273 + res = read_procfs("/proc/sys/net/core/bpf_jit_limit"); 274 + if (json_output) { 275 + jsonw_int_field(json_wtr, "bpf_jit_limit", res); 276 + } else { 277 + switch (res) { 278 + case -1: 279 + printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n"); 280 + break; 281 + default: 282 + printf("Global memory limit for JIT compiler for unprivileged users is %d bytes\n", res); 283 + } 284 + } 285 + } 286 + 287 + static char *get_kernel_config_option(FILE *fd, const char *option) 288 + { 289 + size_t line_n = 0, optlen = strlen(option); 290 + char *res, *strval, *line = NULL; 291 + ssize_t n; 292 + 293 + rewind(fd); 294 + while ((n = getline(&line, &line_n, fd)) > 0) { 295 + if (strncmp(line, option, optlen)) 296 + continue; 297 + /* Check we have at least '=', value, and '\n' */ 298 + if (strlen(line) < optlen + 3) 299 + continue; 300 + if (*(line + optlen) != '=') 301 + continue; 302 + 303 + /* Trim ending '\n' */ 304 + line[strlen(line) - 1] = '\0'; 305 + 306 + /* Copy and return config option value */ 307 + strval = line + optlen + 1; 308 + res = strdup(strval); 309 + free(line); 310 + return res; 311 + } 312 + free(line); 313 + 314 + return NULL; 315 + } 316 + 317 + static void probe_kernel_image_config(void) 318 + { 319 + static const char * const options[] = { 320 + /* Enable BPF */ 321 + "CONFIG_BPF", 322 + /* Enable bpf() syscall */ 323 + "CONFIG_BPF_SYSCALL", 324 + /* Does selected architecture support eBPF JIT compiler */ 325 + "CONFIG_HAVE_EBPF_JIT", 326 + /* Compile eBPF JIT compiler */ 327 + "CONFIG_BPF_JIT", 328 + /* Avoid compiling eBPF interpreter (use JIT only) */ 329 + "CONFIG_BPF_JIT_ALWAYS_ON", 330 + 331 + /* cgroups */ 332 + "CONFIG_CGROUPS", 333 + /* BPF programs attached to cgroups */ 334 + "CONFIG_CGROUP_BPF", 335 + /* bpf_get_cgroup_classid() helper */ 336 + "CONFIG_CGROUP_NET_CLASSID", 337 + /* bpf_skb_{,ancestor_}cgroup_id() helpers */ 338 + "CONFIG_SOCK_CGROUP_DATA", 339 + 340 + /* Tracing: attach BPF to kprobes, tracepoints, etc. */ 341 + "CONFIG_BPF_EVENTS", 342 + /* Kprobes */ 343 + "CONFIG_KPROBE_EVENTS", 344 + /* Uprobes */ 345 + "CONFIG_UPROBE_EVENTS", 346 + /* Tracepoints */ 347 + "CONFIG_TRACING", 348 + /* Syscall tracepoints */ 349 + "CONFIG_FTRACE_SYSCALLS", 350 + /* bpf_override_return() helper support for selected arch */ 351 + "CONFIG_FUNCTION_ERROR_INJECTION", 352 + /* bpf_override_return() helper */ 353 + "CONFIG_BPF_KPROBE_OVERRIDE", 354 + 355 + /* Network */ 356 + "CONFIG_NET", 357 + /* AF_XDP sockets */ 358 + "CONFIG_XDP_SOCKETS", 359 + /* BPF_PROG_TYPE_LWT_* and related helpers */ 360 + "CONFIG_LWTUNNEL_BPF", 361 + /* BPF_PROG_TYPE_SCHED_ACT, TC (traffic control) actions */ 362 + "CONFIG_NET_ACT_BPF", 363 + /* BPF_PROG_TYPE_SCHED_CLS, TC filters */ 364 + "CONFIG_NET_CLS_BPF", 365 + /* TC clsact qdisc */ 366 + "CONFIG_NET_CLS_ACT", 367 + /* Ingress filtering with TC */ 368 + "CONFIG_NET_SCH_INGRESS", 369 + /* bpf_skb_get_xfrm_state() helper */ 370 + "CONFIG_XFRM", 371 + /* bpf_get_route_realm() helper */ 372 + "CONFIG_IP_ROUTE_CLASSID", 373 + /* BPF_PROG_TYPE_LWT_SEG6_LOCAL and related helpers */ 374 + "CONFIG_IPV6_SEG6_BPF", 375 + /* BPF_PROG_TYPE_LIRC_MODE2 and related helpers */ 376 + "CONFIG_BPF_LIRC_MODE2", 377 + /* BPF stream parser and BPF socket maps */ 378 + "CONFIG_BPF_STREAM_PARSER", 379 + /* xt_bpf module for passing BPF programs to netfilter */ 380 + "CONFIG_NETFILTER_XT_MATCH_BPF", 381 + /* bpfilter back-end for iptables */ 382 + "CONFIG_BPFILTER", 383 + /* bpftilter module with "user mode helper" */ 384 + "CONFIG_BPFILTER_UMH", 385 + 386 + /* test_bpf module for BPF tests */ 387 + "CONFIG_TEST_BPF", 388 + }; 389 + char *value, *buf = NULL; 390 + struct utsname utsn; 391 + char path[PATH_MAX]; 392 + size_t i, n; 393 + ssize_t ret; 394 + FILE *fd; 395 + 396 + if (uname(&utsn)) 397 + goto no_config; 398 + 399 + snprintf(path, sizeof(path), "/boot/config-%s", utsn.release); 400 + 401 + fd = fopen(path, "r"); 402 + if (!fd && errno == ENOENT) { 403 + /* Some distributions put the config file at /proc/config, give 404 + * it a try. 405 + * Sometimes it is also at /proc/config.gz but we do not try 406 + * this one for now, it would require linking against libz. 407 + */ 408 + fd = fopen("/proc/config", "r"); 409 + } 410 + if (!fd) { 411 + p_info("skipping kernel config, can't open file: %s", 412 + strerror(errno)); 413 + goto no_config; 414 + } 415 + /* Sanity checks */ 416 + ret = getline(&buf, &n, fd); 417 + ret = getline(&buf, &n, fd); 418 + if (!buf || !ret) { 419 + p_info("skipping kernel config, can't read from file: %s", 420 + strerror(errno)); 421 + free(buf); 422 + goto no_config; 423 + } 424 + if (strcmp(buf, "# Automatically generated file; DO NOT EDIT.\n")) { 425 + p_info("skipping kernel config, can't find correct file"); 426 + free(buf); 427 + goto no_config; 428 + } 429 + free(buf); 430 + 431 + for (i = 0; i < ARRAY_SIZE(options); i++) { 432 + value = get_kernel_config_option(fd, options[i]); 433 + print_kernel_option(options[i], value); 434 + free(value); 435 + } 436 + fclose(fd); 437 + return; 438 + 439 + no_config: 440 + for (i = 0; i < ARRAY_SIZE(options); i++) 441 + print_kernel_option(options[i], NULL); 442 + } 443 + 444 + static bool probe_bpf_syscall(const char *define_prefix) 445 + { 446 + bool res; 447 + 448 + bpf_load_program(BPF_PROG_TYPE_UNSPEC, NULL, 0, NULL, 0, NULL, 0); 449 + res = (errno != ENOSYS); 450 + 451 + print_bool_feature("have_bpf_syscall", 452 + "bpf() syscall", 453 + "BPF_SYSCALL", 454 + res, define_prefix); 455 + 456 + return res; 457 + } 458 + 459 + static void 460 + probe_prog_type(enum bpf_prog_type prog_type, bool *supported_types, 461 + const char *define_prefix, __u32 ifindex) 462 + { 463 + char feat_name[128], plain_desc[128], define_name[128]; 464 + const char *plain_comment = "eBPF program_type "; 465 + size_t maxlen; 466 + bool res; 467 + 468 + if (ifindex) 469 + /* Only test offload-able program types */ 470 + switch (prog_type) { 471 + case BPF_PROG_TYPE_SCHED_CLS: 472 + case BPF_PROG_TYPE_XDP: 473 + break; 474 + default: 475 + return; 476 + } 477 + 478 + res = bpf_probe_prog_type(prog_type, ifindex); 479 + 480 + supported_types[prog_type] |= res; 481 + 482 + maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1; 483 + if (strlen(prog_type_name[prog_type]) > maxlen) { 484 + p_info("program type name too long"); 485 + return; 486 + } 487 + 488 + sprintf(feat_name, "have_%s_prog_type", prog_type_name[prog_type]); 489 + sprintf(define_name, "%s_prog_type", prog_type_name[prog_type]); 490 + uppercase(define_name, sizeof(define_name)); 491 + sprintf(plain_desc, "%s%s", plain_comment, prog_type_name[prog_type]); 492 + print_bool_feature(feat_name, plain_desc, define_name, res, 493 + define_prefix); 494 + } 495 + 496 + static void 497 + probe_map_type(enum bpf_map_type map_type, const char *define_prefix, 498 + __u32 ifindex) 499 + { 500 + char feat_name[128], plain_desc[128], define_name[128]; 501 + const char *plain_comment = "eBPF map_type "; 502 + size_t maxlen; 503 + bool res; 504 + 505 + res = bpf_probe_map_type(map_type, ifindex); 506 + 507 + maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1; 508 + if (strlen(map_type_name[map_type]) > maxlen) { 509 + p_info("map type name too long"); 510 + return; 511 + } 512 + 513 + sprintf(feat_name, "have_%s_map_type", map_type_name[map_type]); 514 + sprintf(define_name, "%s_map_type", map_type_name[map_type]); 515 + uppercase(define_name, sizeof(define_name)); 516 + sprintf(plain_desc, "%s%s", plain_comment, map_type_name[map_type]); 517 + print_bool_feature(feat_name, plain_desc, define_name, res, 518 + define_prefix); 519 + } 520 + 521 + static void 522 + probe_helpers_for_progtype(enum bpf_prog_type prog_type, bool supported_type, 523 + const char *define_prefix, __u32 ifindex) 524 + { 525 + const char *ptype_name = prog_type_name[prog_type]; 526 + char feat_name[128]; 527 + unsigned int id; 528 + bool res; 529 + 530 + if (ifindex) 531 + /* Only test helpers for offload-able program types */ 532 + switch (prog_type) { 533 + case BPF_PROG_TYPE_SCHED_CLS: 534 + case BPF_PROG_TYPE_XDP: 535 + break; 536 + default: 537 + return; 538 + } 539 + 540 + if (json_output) { 541 + sprintf(feat_name, "%s_available_helpers", ptype_name); 542 + jsonw_name(json_wtr, feat_name); 543 + jsonw_start_array(json_wtr); 544 + } else if (!define_prefix) { 545 + printf("eBPF helpers supported for program type %s:", 546 + ptype_name); 547 + } 548 + 549 + for (id = 1; id < ARRAY_SIZE(helper_name); id++) { 550 + if (!supported_type) 551 + res = false; 552 + else 553 + res = bpf_probe_helper(id, prog_type, ifindex); 554 + 555 + if (json_output) { 556 + if (res) 557 + jsonw_string(json_wtr, helper_name[id]); 558 + } else if (define_prefix) { 559 + printf("#define %sBPF__PROG_TYPE_%s__HELPER_%s %s\n", 560 + define_prefix, ptype_name, helper_name[id], 561 + res ? "1" : "0"); 562 + } else { 563 + if (res) 564 + printf("\n\t- %s", helper_name[id]); 565 + } 566 + } 567 + 568 + if (json_output) 569 + jsonw_end_array(json_wtr); 570 + else if (!define_prefix) 571 + printf("\n"); 572 + } 573 + 574 + static int do_probe(int argc, char **argv) 575 + { 576 + enum probe_component target = COMPONENT_UNSPEC; 577 + const char *define_prefix = NULL; 578 + bool supported_types[128] = {}; 579 + __u32 ifindex = 0; 580 + unsigned int i; 581 + char *ifname; 582 + 583 + /* Detection assumes user has sufficient privileges (CAP_SYS_ADMIN). 584 + * Let's approximate, and restrict usage to root user only. 585 + */ 586 + if (geteuid()) { 587 + p_err("please run this command as root user"); 588 + return -1; 589 + } 590 + 591 + set_max_rlimit(); 592 + 593 + while (argc) { 594 + if (is_prefix(*argv, "kernel")) { 595 + if (target != COMPONENT_UNSPEC) { 596 + p_err("component to probe already specified"); 597 + return -1; 598 + } 599 + target = COMPONENT_KERNEL; 600 + NEXT_ARG(); 601 + } else if (is_prefix(*argv, "dev")) { 602 + NEXT_ARG(); 603 + 604 + if (target != COMPONENT_UNSPEC || ifindex) { 605 + p_err("component to probe already specified"); 606 + return -1; 607 + } 608 + if (!REQ_ARGS(1)) 609 + return -1; 610 + 611 + target = COMPONENT_DEVICE; 612 + ifname = GET_ARG(); 613 + ifindex = if_nametoindex(ifname); 614 + if (!ifindex) { 615 + p_err("unrecognized netdevice '%s': %s", ifname, 616 + strerror(errno)); 617 + return -1; 618 + } 619 + } else if (is_prefix(*argv, "macros") && !define_prefix) { 620 + define_prefix = ""; 621 + NEXT_ARG(); 622 + } else if (is_prefix(*argv, "prefix")) { 623 + if (!define_prefix) { 624 + p_err("'prefix' argument can only be use after 'macros'"); 625 + return -1; 626 + } 627 + if (strcmp(define_prefix, "")) { 628 + p_err("'prefix' already defined"); 629 + return -1; 630 + } 631 + NEXT_ARG(); 632 + 633 + if (!REQ_ARGS(1)) 634 + return -1; 635 + define_prefix = GET_ARG(); 636 + } else { 637 + p_err("expected no more arguments, 'kernel', 'dev', 'macros' or 'prefix', got: '%s'?", 638 + *argv); 639 + return -1; 640 + } 641 + } 642 + 643 + if (json_output) { 644 + define_prefix = NULL; 645 + jsonw_start_object(json_wtr); 646 + } 647 + 648 + switch (target) { 649 + case COMPONENT_KERNEL: 650 + case COMPONENT_UNSPEC: 651 + if (define_prefix) 652 + break; 653 + 654 + print_start_section("system_config", 655 + "Scanning system configuration...", 656 + NULL, /* define_comment never used here */ 657 + NULL); /* define_prefix always NULL here */ 658 + if (check_procfs()) { 659 + probe_unprivileged_disabled(); 660 + probe_jit_enable(); 661 + probe_jit_harden(); 662 + probe_jit_kallsyms(); 663 + probe_jit_limit(); 664 + } else { 665 + p_info("/* procfs not mounted, skipping related probes */"); 666 + } 667 + probe_kernel_image_config(); 668 + if (json_output) 669 + jsonw_end_object(json_wtr); 670 + else 671 + printf("\n"); 672 + break; 673 + default: 674 + break; 675 + } 676 + 677 + print_start_section("syscall_config", 678 + "Scanning system call availability...", 679 + "/*** System call availability ***/", 680 + define_prefix); 681 + 682 + if (!probe_bpf_syscall(define_prefix)) 683 + /* bpf() syscall unavailable, don't probe other BPF features */ 684 + goto exit_close_json; 685 + 686 + print_end_then_start_section("program_types", 687 + "Scanning eBPF program types...", 688 + "/*** eBPF program types ***/", 689 + define_prefix); 690 + 691 + for (i = BPF_PROG_TYPE_UNSPEC + 1; i < ARRAY_SIZE(prog_type_name); i++) 692 + probe_prog_type(i, supported_types, define_prefix, ifindex); 693 + 694 + print_end_then_start_section("map_types", 695 + "Scanning eBPF map types...", 696 + "/*** eBPF map types ***/", 697 + define_prefix); 698 + 699 + for (i = BPF_MAP_TYPE_UNSPEC + 1; i < map_type_name_size; i++) 700 + probe_map_type(i, define_prefix, ifindex); 701 + 702 + print_end_then_start_section("helpers", 703 + "Scanning eBPF helper functions...", 704 + "/*** eBPF helper functions ***/", 705 + define_prefix); 706 + 707 + if (define_prefix) 708 + printf("/*\n" 709 + " * Use %sHAVE_PROG_TYPE_HELPER(prog_type_name, helper_name)\n" 710 + " * to determine if <helper_name> is available for <prog_type_name>,\n" 711 + " * e.g.\n" 712 + " * #if %sHAVE_PROG_TYPE_HELPER(xdp, bpf_redirect)\n" 713 + " * // do stuff with this helper\n" 714 + " * #elif\n" 715 + " * // use a workaround\n" 716 + " * #endif\n" 717 + " */\n" 718 + "#define %sHAVE_PROG_TYPE_HELPER(prog_type, helper) \\\n" 719 + " %sBPF__PROG_TYPE_ ## prog_type ## __HELPER_ ## helper\n", 720 + define_prefix, define_prefix, define_prefix, 721 + define_prefix); 722 + for (i = BPF_PROG_TYPE_UNSPEC + 1; i < ARRAY_SIZE(prog_type_name); i++) 723 + probe_helpers_for_progtype(i, supported_types[i], 724 + define_prefix, ifindex); 725 + 726 + exit_close_json: 727 + if (json_output) { 728 + /* End current "section" of probes */ 729 + jsonw_end_object(json_wtr); 730 + /* End root object */ 731 + jsonw_end_object(json_wtr); 732 + } 733 + 734 + return 0; 735 + } 736 + 737 + static int do_help(int argc, char **argv) 738 + { 739 + if (json_output) { 740 + jsonw_null(json_wtr); 741 + return 0; 742 + } 743 + 744 + fprintf(stderr, 745 + "Usage: %s %s probe [COMPONENT] [macros [prefix PREFIX]]\n" 746 + " %s %s help\n" 747 + "\n" 748 + " COMPONENT := { kernel | dev NAME }\n" 749 + "", 750 + bin_name, argv[-2], bin_name, argv[-2]); 751 + 752 + return 0; 753 + } 754 + 755 + static const struct cmd cmds[] = { 756 + { "help", do_help }, 757 + { "probe", do_probe }, 758 + { 0 } 759 + }; 760 + 761 + int do_feature(int argc, char **argv) 762 + { 763 + return cmd_select(cmds, argc, argv, do_help); 764 + }
+2 -1
tools/bpf/bpftool/main.c
··· 56 56 " %s batch file FILE\n" 57 57 " %s version\n" 58 58 "\n" 59 - " OBJECT := { prog | map | cgroup | perf | net }\n" 59 + " OBJECT := { prog | map | cgroup | perf | net | feature }\n" 60 60 " " HELP_SPEC_OPTIONS "\n" 61 61 "", 62 62 bin_name, bin_name, bin_name); ··· 187 187 { "cgroup", do_cgroup }, 188 188 { "perf", do_perf }, 189 189 { "net", do_net }, 190 + { "feature", do_feature }, 190 191 { "version", do_version }, 191 192 { 0 } 192 193 };
+4
tools/bpf/bpftool/main.h
··· 75 75 [BPF_PROG_TYPE_FLOW_DISSECTOR] = "flow_dissector", 76 76 }; 77 77 78 + extern const char * const map_type_name[]; 79 + extern const size_t map_type_name_size; 80 + 78 81 enum bpf_obj_type { 79 82 BPF_OBJ_UNKNOWN, 80 83 BPF_OBJ_PROG, ··· 148 145 int do_perf(int argc, char **arg); 149 146 int do_net(int argc, char **arg); 150 147 int do_tracelog(int argc, char **arg); 148 + int do_feature(int argc, char **argv); 151 149 152 150 int parse_u32_arg(int *argc, char ***argv, __u32 *val, const char *what); 153 151 int prog_parse_fd(int *argc, char ***argv);
+3 -1
tools/bpf/bpftool/map.c
··· 21 21 #include "json_writer.h" 22 22 #include "main.h" 23 23 24 - static const char * const map_type_name[] = { 24 + const char * const map_type_name[] = { 25 25 [BPF_MAP_TYPE_UNSPEC] = "unspec", 26 26 [BPF_MAP_TYPE_HASH] = "hash", 27 27 [BPF_MAP_TYPE_ARRAY] = "array", ··· 47 47 [BPF_MAP_TYPE_QUEUE] = "queue", 48 48 [BPF_MAP_TYPE_STACK] = "stack", 49 49 }; 50 + 51 + const size_t map_type_name_size = ARRAY_SIZE(map_type_name); 50 52 51 53 static bool map_is_per_cpu(__u32 type) 52 54 {
+1 -1
tools/lib/bpf/Build
··· 1 - libbpf-y := libbpf.o bpf.o nlattr.o btf.o libbpf_errno.o str_error.o netlink.o bpf_prog_linfo.o 1 + libbpf-y := libbpf.o bpf.o nlattr.o btf.o libbpf_errno.o str_error.o netlink.o bpf_prog_linfo.o libbpf_probes.o
+14
tools/lib/bpf/libbpf.h
··· 355 355 bpf_prog_linfo__lfind(const struct bpf_prog_linfo *prog_linfo, 356 356 __u32 insn_off, __u32 nr_skip); 357 357 358 + /* 359 + * Probe for supported system features 360 + * 361 + * Note that running many of these probes in a short amount of time can cause 362 + * the kernel to reach the maximal size of lockable memory allowed for the 363 + * user, causing subsequent probes to fail. In this case, the caller may want 364 + * to adjust that limit with setrlimit(). 365 + */ 366 + LIBBPF_API bool bpf_probe_prog_type(enum bpf_prog_type prog_type, 367 + __u32 ifindex); 368 + LIBBPF_API bool bpf_probe_map_type(enum bpf_map_type map_type, __u32 ifindex); 369 + LIBBPF_API bool bpf_probe_helper(enum bpf_func_id id, 370 + enum bpf_prog_type prog_type, __u32 ifindex); 371 + 358 372 #ifdef __cplusplus 359 373 } /* extern "C" */ 360 374 #endif
+7
tools/lib/bpf/libbpf.map
··· 124 124 local: 125 125 *; 126 126 }; 127 + 128 + LIBBPF_0.0.2 { 129 + global: 130 + bpf_probe_helper; 131 + bpf_probe_map_type; 132 + bpf_probe_prog_type; 133 + } LIBBPF_0.0.1;
+242
tools/lib/bpf/libbpf_probes.c
··· 1 + // SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) 2 + /* Copyright (c) 2019 Netronome Systems, Inc. */ 3 + 4 + #include <errno.h> 5 + #include <fcntl.h> 6 + #include <string.h> 7 + #include <stdlib.h> 8 + #include <unistd.h> 9 + #include <net/if.h> 10 + #include <sys/utsname.h> 11 + 12 + #include <linux/filter.h> 13 + #include <linux/kernel.h> 14 + 15 + #include "bpf.h" 16 + #include "libbpf.h" 17 + 18 + static bool grep(const char *buffer, const char *pattern) 19 + { 20 + return !!strstr(buffer, pattern); 21 + } 22 + 23 + static int get_vendor_id(int ifindex) 24 + { 25 + char ifname[IF_NAMESIZE], path[64], buf[8]; 26 + ssize_t len; 27 + int fd; 28 + 29 + if (!if_indextoname(ifindex, ifname)) 30 + return -1; 31 + 32 + snprintf(path, sizeof(path), "/sys/class/net/%s/device/vendor", ifname); 33 + 34 + fd = open(path, O_RDONLY); 35 + if (fd < 0) 36 + return -1; 37 + 38 + len = read(fd, buf, sizeof(buf)); 39 + close(fd); 40 + if (len < 0) 41 + return -1; 42 + if (len >= (ssize_t)sizeof(buf)) 43 + return -1; 44 + buf[len] = '\0'; 45 + 46 + return strtol(buf, NULL, 0); 47 + } 48 + 49 + static int get_kernel_version(void) 50 + { 51 + int version, subversion, patchlevel; 52 + struct utsname utsn; 53 + 54 + /* Return 0 on failure, and attempt to probe with empty kversion */ 55 + if (uname(&utsn)) 56 + return 0; 57 + 58 + if (sscanf(utsn.release, "%d.%d.%d", 59 + &version, &subversion, &patchlevel) != 3) 60 + return 0; 61 + 62 + return (version << 16) + (subversion << 8) + patchlevel; 63 + } 64 + 65 + static void 66 + probe_load(enum bpf_prog_type prog_type, const struct bpf_insn *insns, 67 + size_t insns_cnt, char *buf, size_t buf_len, __u32 ifindex) 68 + { 69 + struct bpf_load_program_attr xattr = {}; 70 + int fd; 71 + 72 + switch (prog_type) { 73 + case BPF_PROG_TYPE_CGROUP_SOCK_ADDR: 74 + xattr.expected_attach_type = BPF_CGROUP_INET4_CONNECT; 75 + break; 76 + case BPF_PROG_TYPE_KPROBE: 77 + xattr.kern_version = get_kernel_version(); 78 + break; 79 + case BPF_PROG_TYPE_UNSPEC: 80 + case BPF_PROG_TYPE_SOCKET_FILTER: 81 + case BPF_PROG_TYPE_SCHED_CLS: 82 + case BPF_PROG_TYPE_SCHED_ACT: 83 + case BPF_PROG_TYPE_TRACEPOINT: 84 + case BPF_PROG_TYPE_XDP: 85 + case BPF_PROG_TYPE_PERF_EVENT: 86 + case BPF_PROG_TYPE_CGROUP_SKB: 87 + case BPF_PROG_TYPE_CGROUP_SOCK: 88 + case BPF_PROG_TYPE_LWT_IN: 89 + case BPF_PROG_TYPE_LWT_OUT: 90 + case BPF_PROG_TYPE_LWT_XMIT: 91 + case BPF_PROG_TYPE_SOCK_OPS: 92 + case BPF_PROG_TYPE_SK_SKB: 93 + case BPF_PROG_TYPE_CGROUP_DEVICE: 94 + case BPF_PROG_TYPE_SK_MSG: 95 + case BPF_PROG_TYPE_RAW_TRACEPOINT: 96 + case BPF_PROG_TYPE_LWT_SEG6LOCAL: 97 + case BPF_PROG_TYPE_LIRC_MODE2: 98 + case BPF_PROG_TYPE_SK_REUSEPORT: 99 + case BPF_PROG_TYPE_FLOW_DISSECTOR: 100 + default: 101 + break; 102 + } 103 + 104 + xattr.prog_type = prog_type; 105 + xattr.insns = insns; 106 + xattr.insns_cnt = insns_cnt; 107 + xattr.license = "GPL"; 108 + xattr.prog_ifindex = ifindex; 109 + 110 + fd = bpf_load_program_xattr(&xattr, buf, buf_len); 111 + if (fd >= 0) 112 + close(fd); 113 + } 114 + 115 + bool bpf_probe_prog_type(enum bpf_prog_type prog_type, __u32 ifindex) 116 + { 117 + struct bpf_insn insns[2] = { 118 + BPF_MOV64_IMM(BPF_REG_0, 0), 119 + BPF_EXIT_INSN() 120 + }; 121 + 122 + if (ifindex && prog_type == BPF_PROG_TYPE_SCHED_CLS) 123 + /* nfp returns -EINVAL on exit(0) with TC offload */ 124 + insns[0].imm = 2; 125 + 126 + errno = 0; 127 + probe_load(prog_type, insns, ARRAY_SIZE(insns), NULL, 0, ifindex); 128 + 129 + return errno != EINVAL && errno != EOPNOTSUPP; 130 + } 131 + 132 + bool bpf_probe_map_type(enum bpf_map_type map_type, __u32 ifindex) 133 + { 134 + int key_size, value_size, max_entries, map_flags; 135 + struct bpf_create_map_attr attr = {}; 136 + int fd = -1, fd_inner; 137 + 138 + key_size = sizeof(__u32); 139 + value_size = sizeof(__u32); 140 + max_entries = 1; 141 + map_flags = 0; 142 + 143 + switch (map_type) { 144 + case BPF_MAP_TYPE_STACK_TRACE: 145 + value_size = sizeof(__u64); 146 + break; 147 + case BPF_MAP_TYPE_LPM_TRIE: 148 + key_size = sizeof(__u64); 149 + value_size = sizeof(__u64); 150 + map_flags = BPF_F_NO_PREALLOC; 151 + break; 152 + case BPF_MAP_TYPE_CGROUP_STORAGE: 153 + case BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE: 154 + key_size = sizeof(struct bpf_cgroup_storage_key); 155 + value_size = sizeof(__u64); 156 + max_entries = 0; 157 + break; 158 + case BPF_MAP_TYPE_QUEUE: 159 + case BPF_MAP_TYPE_STACK: 160 + key_size = 0; 161 + break; 162 + case BPF_MAP_TYPE_UNSPEC: 163 + case BPF_MAP_TYPE_HASH: 164 + case BPF_MAP_TYPE_ARRAY: 165 + case BPF_MAP_TYPE_PROG_ARRAY: 166 + case BPF_MAP_TYPE_PERF_EVENT_ARRAY: 167 + case BPF_MAP_TYPE_PERCPU_HASH: 168 + case BPF_MAP_TYPE_PERCPU_ARRAY: 169 + case BPF_MAP_TYPE_CGROUP_ARRAY: 170 + case BPF_MAP_TYPE_LRU_HASH: 171 + case BPF_MAP_TYPE_LRU_PERCPU_HASH: 172 + case BPF_MAP_TYPE_ARRAY_OF_MAPS: 173 + case BPF_MAP_TYPE_HASH_OF_MAPS: 174 + case BPF_MAP_TYPE_DEVMAP: 175 + case BPF_MAP_TYPE_SOCKMAP: 176 + case BPF_MAP_TYPE_CPUMAP: 177 + case BPF_MAP_TYPE_XSKMAP: 178 + case BPF_MAP_TYPE_SOCKHASH: 179 + case BPF_MAP_TYPE_REUSEPORT_SOCKARRAY: 180 + default: 181 + break; 182 + } 183 + 184 + if (map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS || 185 + map_type == BPF_MAP_TYPE_HASH_OF_MAPS) { 186 + /* TODO: probe for device, once libbpf has a function to create 187 + * map-in-map for offload 188 + */ 189 + if (ifindex) 190 + return false; 191 + 192 + fd_inner = bpf_create_map(BPF_MAP_TYPE_HASH, 193 + sizeof(__u32), sizeof(__u32), 1, 0); 194 + if (fd_inner < 0) 195 + return false; 196 + fd = bpf_create_map_in_map(map_type, NULL, sizeof(__u32), 197 + fd_inner, 1, 0); 198 + close(fd_inner); 199 + } else { 200 + /* Note: No other restriction on map type probes for offload */ 201 + attr.map_type = map_type; 202 + attr.key_size = key_size; 203 + attr.value_size = value_size; 204 + attr.max_entries = max_entries; 205 + attr.map_flags = map_flags; 206 + attr.map_ifindex = ifindex; 207 + 208 + fd = bpf_create_map_xattr(&attr); 209 + } 210 + if (fd >= 0) 211 + close(fd); 212 + 213 + return fd >= 0; 214 + } 215 + 216 + bool bpf_probe_helper(enum bpf_func_id id, enum bpf_prog_type prog_type, 217 + __u32 ifindex) 218 + { 219 + struct bpf_insn insns[2] = { 220 + BPF_EMIT_CALL(id), 221 + BPF_EXIT_INSN() 222 + }; 223 + char buf[4096] = {}; 224 + bool res; 225 + 226 + probe_load(prog_type, insns, ARRAY_SIZE(insns), buf, sizeof(buf), 227 + ifindex); 228 + res = !grep(buf, "invalid func ") && !grep(buf, "unknown func "); 229 + 230 + if (ifindex) { 231 + switch (get_vendor_id(ifindex)) { 232 + case 0x19ee: /* Netronome specific */ 233 + res = res && !grep(buf, "not supported by FW") && 234 + !grep(buf, "unsupported function id"); 235 + break; 236 + default: 237 + break; 238 + } 239 + } 240 + 241 + return res; 242 + }