1 // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
2 /* Copyright (c) 2019 Netronome Systems, Inc. */
11 #include <sys/capability.h>
13 #include <sys/utsname.h>
16 #include <linux/filter.h>
17 #include <linux/limits.h>
20 #include <bpf/libbpf.h>
25 #ifndef PROC_SUPER_MAGIC
26 # define PROC_SUPER_MAGIC 0x9fa0
29 enum probe_component {
35 #define BPF_HELPER_MAKE_ENTRY(name) [BPF_FUNC_ ## name] = "bpf_" # name
36 static const char * const helper_name[] = {
37 __BPF_FUNC_MAPPER(BPF_HELPER_MAKE_ENTRY)
40 #undef BPF_HELPER_MAKE_ENTRY
42 static bool full_mode;
44 static bool run_as_unprivileged;
47 /* Miscellaneous utility functions */
49 static bool grep(const char *buffer, const char *pattern)
51 return !!strstr(buffer, pattern);
54 static bool check_procfs(void)
58 if (statfs("/proc", &st_fs) < 0)
60 if ((unsigned long)st_fs.f_type != PROC_SUPER_MAGIC)
66 static void uppercase(char *str, size_t len)
70 for (i = 0; i < len && str[i] != '\0'; i++)
71 str[i] = toupper(str[i]);
74 /* Printing utility functions */
77 print_bool_feature(const char *feat_name, const char *plain_name,
78 const char *define_name, bool res, const char *define_prefix)
81 jsonw_bool_field(json_wtr, feat_name, res);
82 else if (define_prefix)
83 printf("#define %s%sHAVE_%s\n", define_prefix,
84 res ? "" : "NO_", define_name);
86 printf("%s is %savailable\n", plain_name, res ? "" : "NOT ");
89 static void print_kernel_option(const char *name, const char *value,
90 const char *define_prefix)
97 jsonw_null_field(json_wtr, name);
101 res = strtol(value, &endptr, 0);
102 if (!errno && *endptr == '\n')
103 jsonw_int_field(json_wtr, name, res);
105 jsonw_string_field(json_wtr, name, value);
106 } else if (define_prefix) {
108 printf("#define %s%s %s\n", define_prefix,
111 printf("/* %s%s is not set */\n", define_prefix, name);
114 printf("%s is set to %s\n", name, value);
116 printf("%s is not set\n", name);
121 print_start_section(const char *json_title, const char *plain_title,
122 const char *define_comment, const char *define_prefix)
125 jsonw_name(json_wtr, json_title);
126 jsonw_start_object(json_wtr);
127 } else if (define_prefix) {
128 printf("%s\n", define_comment);
130 printf("%s\n", plain_title);
134 static void print_end_section(void)
137 jsonw_end_object(json_wtr);
142 /* Probing functions */
144 static int get_vendor_id(int ifindex)
146 char ifname[IF_NAMESIZE], path[64], buf[8];
150 if (!if_indextoname(ifindex, ifname))
153 snprintf(path, sizeof(path), "/sys/class/net/%s/device/vendor", ifname);
155 fd = open(path, O_RDONLY | O_CLOEXEC);
159 len = read(fd, buf, sizeof(buf));
163 if (len >= (ssize_t)sizeof(buf))
167 return strtol(buf, NULL, 0);
170 static long read_procfs(const char *path)
172 char *endptr, *line = NULL;
177 fd = fopen(path, "r");
181 res = getline(&line, &len, fd);
187 res = strtol(line, &endptr, 10);
188 if (errno || *line == '\0' || *endptr != '\n')
195 static void probe_unprivileged_disabled(void)
199 /* No support for C-style ouptut */
201 res = read_procfs("/proc/sys/kernel/unprivileged_bpf_disabled");
203 jsonw_int_field(json_wtr, "unprivileged_bpf_disabled", res);
207 printf("bpf() syscall for unprivileged users is enabled\n");
210 printf("bpf() syscall restricted to privileged users (without recovery)\n");
213 printf("bpf() syscall restricted to privileged users (admin can change)\n");
216 printf("Unable to retrieve required privileges for bpf() syscall\n");
219 printf("bpf() syscall restriction has unknown value %ld\n", res);
224 static void probe_jit_enable(void)
228 /* No support for C-style ouptut */
230 res = read_procfs("/proc/sys/net/core/bpf_jit_enable");
232 jsonw_int_field(json_wtr, "bpf_jit_enable", res);
236 printf("JIT compiler is disabled\n");
239 printf("JIT compiler is enabled\n");
242 printf("JIT compiler is enabled with debugging traces in kernel logs\n");
245 printf("Unable to retrieve JIT-compiler status\n");
248 printf("JIT-compiler status has unknown value %ld\n",
254 static void probe_jit_harden(void)
258 /* No support for C-style ouptut */
260 res = read_procfs("/proc/sys/net/core/bpf_jit_harden");
262 jsonw_int_field(json_wtr, "bpf_jit_harden", res);
266 printf("JIT compiler hardening is disabled\n");
269 printf("JIT compiler hardening is enabled for unprivileged users\n");
272 printf("JIT compiler hardening is enabled for all users\n");
275 printf("Unable to retrieve JIT hardening status\n");
278 printf("JIT hardening status has unknown value %ld\n",
284 static void probe_jit_kallsyms(void)
288 /* No support for C-style ouptut */
290 res = read_procfs("/proc/sys/net/core/bpf_jit_kallsyms");
292 jsonw_int_field(json_wtr, "bpf_jit_kallsyms", res);
296 printf("JIT compiler kallsyms exports are disabled\n");
299 printf("JIT compiler kallsyms exports are enabled for root\n");
302 printf("Unable to retrieve JIT kallsyms export status\n");
305 printf("JIT kallsyms exports status has unknown value %ld\n", res);
310 static void probe_jit_limit(void)
314 /* No support for C-style ouptut */
316 res = read_procfs("/proc/sys/net/core/bpf_jit_limit");
318 jsonw_int_field(json_wtr, "bpf_jit_limit", res);
322 printf("Unable to retrieve global memory limit for JIT compiler for unprivileged users\n");
325 printf("Global memory limit for JIT compiler for unprivileged users is %ld bytes\n", res);
330 static bool read_next_kernel_config_option(gzFile file, char *buf, size_t n,
335 while (gzgets(file, buf, n)) {
336 if (strncmp(buf, "CONFIG_", 7))
339 sep = strchr(buf, '=');
343 /* Trim ending '\n' */
344 buf[strlen(buf) - 1] = '\0';
346 /* Split on '=' and ensure that a value is present. */
358 static void probe_kernel_image_config(const char *define_prefix)
360 static const struct {
361 const char * const name;
366 /* Enable bpf() syscall */
367 { "CONFIG_BPF_SYSCALL", },
368 /* Does selected architecture support eBPF JIT compiler */
369 { "CONFIG_HAVE_EBPF_JIT", },
370 /* Compile eBPF JIT compiler */
371 { "CONFIG_BPF_JIT", },
372 /* Avoid compiling eBPF interpreter (use JIT only) */
373 { "CONFIG_BPF_JIT_ALWAYS_ON", },
374 /* Kernel BTF debug information available */
375 { "CONFIG_DEBUG_INFO_BTF", },
376 /* Kernel module BTF debug information available */
377 { "CONFIG_DEBUG_INFO_BTF_MODULES", },
380 { "CONFIG_CGROUPS", },
381 /* BPF programs attached to cgroups */
382 { "CONFIG_CGROUP_BPF", },
383 /* bpf_get_cgroup_classid() helper */
384 { "CONFIG_CGROUP_NET_CLASSID", },
385 /* bpf_skb_{,ancestor_}cgroup_id() helpers */
386 { "CONFIG_SOCK_CGROUP_DATA", },
388 /* Tracing: attach BPF to kprobes, tracepoints, etc. */
389 { "CONFIG_BPF_EVENTS", },
391 { "CONFIG_KPROBE_EVENTS", },
393 { "CONFIG_UPROBE_EVENTS", },
395 { "CONFIG_TRACING", },
396 /* Syscall tracepoints */
397 { "CONFIG_FTRACE_SYSCALLS", },
398 /* bpf_override_return() helper support for selected arch */
399 { "CONFIG_FUNCTION_ERROR_INJECTION", },
400 /* bpf_override_return() helper */
401 { "CONFIG_BPF_KPROBE_OVERRIDE", },
406 { "CONFIG_XDP_SOCKETS", },
407 /* BPF_PROG_TYPE_LWT_* and related helpers */
408 { "CONFIG_LWTUNNEL_BPF", },
409 /* BPF_PROG_TYPE_SCHED_ACT, TC (traffic control) actions */
410 { "CONFIG_NET_ACT_BPF", },
411 /* BPF_PROG_TYPE_SCHED_CLS, TC filters */
412 { "CONFIG_NET_CLS_BPF", },
413 /* TC clsact qdisc */
414 { "CONFIG_NET_CLS_ACT", },
415 /* Ingress filtering with TC */
416 { "CONFIG_NET_SCH_INGRESS", },
417 /* bpf_skb_get_xfrm_state() helper */
419 /* bpf_get_route_realm() helper */
420 { "CONFIG_IP_ROUTE_CLASSID", },
421 /* BPF_PROG_TYPE_LWT_SEG6_LOCAL and related helpers */
422 { "CONFIG_IPV6_SEG6_BPF", },
423 /* BPF_PROG_TYPE_LIRC_MODE2 and related helpers */
424 { "CONFIG_BPF_LIRC_MODE2", },
425 /* BPF stream parser and BPF socket maps */
426 { "CONFIG_BPF_STREAM_PARSER", },
427 /* xt_bpf module for passing BPF programs to netfilter */
428 { "CONFIG_NETFILTER_XT_MATCH_BPF", },
429 /* bpfilter back-end for iptables */
430 { "CONFIG_BPFILTER", },
431 /* bpftilter module with "user mode helper" */
432 { "CONFIG_BPFILTER_UMH", },
434 /* test_bpf module for BPF tests */
435 { "CONFIG_TEST_BPF", },
437 /* Misc configs useful in BPF C programs */
438 /* jiffies <-> sec conversion for bpf_jiffies64() helper */
439 { "CONFIG_HZ", true, }
441 char *values[ARRAY_SIZE(options)] = { };
450 snprintf(path, sizeof(path), "/boot/config-%s", utsn.release);
452 /* gzopen also accepts uncompressed files. */
453 file = gzopen(path, "r");
457 /* Some distributions build with CONFIG_IKCONFIG=y and put the
458 * config file at /proc/config.gz.
460 file = gzopen("/proc/config.gz", "r");
463 p_info("skipping kernel config, can't open file: %s",
468 if (!gzgets(file, buf, sizeof(buf)) ||
469 !gzgets(file, buf, sizeof(buf))) {
470 p_info("skipping kernel config, can't read from file: %s",
474 if (strcmp(buf, "# Automatically generated file; DO NOT EDIT.\n")) {
475 p_info("skipping kernel config, can't find correct file");
479 while (read_next_kernel_config_option(file, buf, sizeof(buf), &value)) {
480 for (i = 0; i < ARRAY_SIZE(options); i++) {
481 if ((define_prefix && !options[i].macro_dump) ||
482 values[i] || strcmp(buf, options[i].name))
485 values[i] = strdup(value);
489 for (i = 0; i < ARRAY_SIZE(options); i++) {
490 if (define_prefix && !options[i].macro_dump)
492 print_kernel_option(options[i].name, values[i], define_prefix);
501 static bool probe_bpf_syscall(const char *define_prefix)
505 bpf_prog_load(BPF_PROG_TYPE_UNSPEC, NULL, NULL, NULL, 0, NULL);
506 res = (errno != ENOSYS);
508 print_bool_feature("have_bpf_syscall",
517 probe_prog_load_ifindex(enum bpf_prog_type prog_type,
518 const struct bpf_insn *insns, size_t insns_cnt,
519 char *log_buf, size_t log_buf_sz,
522 LIBBPF_OPTS(bpf_prog_load_opts, opts,
524 .log_size = log_buf_sz,
525 .log_level = log_buf ? 1 : 0,
526 .prog_ifindex = ifindex,
531 fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts);
535 return fd >= 0 && errno != EINVAL && errno != EOPNOTSUPP;
538 static bool probe_prog_type_ifindex(enum bpf_prog_type prog_type, __u32 ifindex)
540 /* nfp returns -EINVAL on exit(0) with TC offload */
541 struct bpf_insn insns[2] = {
542 BPF_MOV64_IMM(BPF_REG_0, 2),
546 return probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns),
551 probe_prog_type(enum bpf_prog_type prog_type, const char *prog_type_str,
552 bool *supported_types, const char *define_prefix, __u32 ifindex)
554 char feat_name[128], plain_desc[128], define_name[128];
555 const char *plain_comment = "eBPF program_type ";
561 case BPF_PROG_TYPE_SCHED_CLS:
562 case BPF_PROG_TYPE_XDP:
568 res = probe_prog_type_ifindex(prog_type, ifindex);
570 res = libbpf_probe_bpf_prog_type(prog_type, NULL) > 0;
574 /* Probe may succeed even if program load fails, for unprivileged users
575 * check that we did not fail because of insufficient permissions
577 if (run_as_unprivileged && errno == EPERM)
581 supported_types[prog_type] |= res;
583 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1;
584 if (strlen(prog_type_str) > maxlen) {
585 p_info("program type name too long");
589 sprintf(feat_name, "have_%s_prog_type", prog_type_str);
590 sprintf(define_name, "%s_prog_type", prog_type_str);
591 uppercase(define_name, sizeof(define_name));
592 sprintf(plain_desc, "%s%s", plain_comment, prog_type_str);
593 print_bool_feature(feat_name, plain_desc, define_name, res,
597 static bool probe_map_type_ifindex(enum bpf_map_type map_type, __u32 ifindex)
599 LIBBPF_OPTS(bpf_map_create_opts, opts);
600 int key_size, value_size, max_entries;
603 opts.map_ifindex = ifindex;
605 key_size = sizeof(__u32);
606 value_size = sizeof(__u32);
609 fd = bpf_map_create(map_type, NULL, key_size, value_size, max_entries,
618 probe_map_type(enum bpf_map_type map_type, char const *map_type_str,
619 const char *define_prefix, __u32 ifindex)
621 char feat_name[128], plain_desc[128], define_name[128];
622 const char *plain_comment = "eBPF map_type ";
628 case BPF_MAP_TYPE_HASH:
629 case BPF_MAP_TYPE_ARRAY:
635 res = probe_map_type_ifindex(map_type, ifindex);
637 res = libbpf_probe_bpf_map_type(map_type, NULL) > 0;
640 /* Probe result depends on the success of map creation, no additional
641 * check required for unprivileged users
644 maxlen = sizeof(plain_desc) - strlen(plain_comment) - 1;
645 if (strlen(map_type_str) > maxlen) {
646 p_info("map type name too long");
650 sprintf(feat_name, "have_%s_map_type", map_type_str);
651 sprintf(define_name, "%s_map_type", map_type_str);
652 uppercase(define_name, sizeof(define_name));
653 sprintf(plain_desc, "%s%s", plain_comment, map_type_str);
654 print_bool_feature(feat_name, plain_desc, define_name, res,
659 probe_helper_ifindex(enum bpf_func_id id, enum bpf_prog_type prog_type,
662 struct bpf_insn insns[2] = {
669 probe_prog_load_ifindex(prog_type, insns, ARRAY_SIZE(insns), buf,
670 sizeof(buf), ifindex);
671 res = !grep(buf, "invalid func ") && !grep(buf, "unknown func ");
673 switch (get_vendor_id(ifindex)) {
674 case 0x19ee: /* Netronome specific */
675 res = res && !grep(buf, "not supported by FW") &&
676 !grep(buf, "unsupported function id");
686 probe_helper_for_progtype(enum bpf_prog_type prog_type, bool supported_type,
687 const char *define_prefix, unsigned int id,
688 const char *ptype_name, __u32 ifindex)
692 if (supported_type) {
694 res = probe_helper_ifindex(id, prog_type, ifindex);
696 res = libbpf_probe_bpf_helper(prog_type, id, NULL) > 0;
698 /* Probe may succeed even if program load fails, for
699 * unprivileged users check that we did not fail because of
700 * insufficient permissions
702 if (run_as_unprivileged && errno == EPERM)
709 jsonw_string(json_wtr, helper_name[id]);
710 } else if (define_prefix) {
711 printf("#define %sBPF__PROG_TYPE_%s__HELPER_%s %s\n",
712 define_prefix, ptype_name, helper_name[id],
716 printf("\n\t- %s", helper_name[id]);
723 probe_helpers_for_progtype(enum bpf_prog_type prog_type,
724 const char *prog_type_str, bool supported_type,
725 const char *define_prefix, __u32 ifindex)
729 bool probe_res = false;
732 /* Only test helpers for offload-able program types */
734 case BPF_PROG_TYPE_SCHED_CLS:
735 case BPF_PROG_TYPE_XDP:
742 sprintf(feat_name, "%s_available_helpers", prog_type_str);
743 jsonw_name(json_wtr, feat_name);
744 jsonw_start_array(json_wtr);
745 } else if (!define_prefix) {
746 printf("eBPF helpers supported for program type %s:",
750 for (id = 1; id < ARRAY_SIZE(helper_name); id++) {
751 /* Skip helper functions which emit dmesg messages when not in
755 case BPF_FUNC_trace_printk:
756 case BPF_FUNC_trace_vprintk:
757 case BPF_FUNC_probe_write_user:
762 probe_res |= probe_helper_for_progtype(prog_type, supported_type,
763 define_prefix, id, prog_type_str,
769 jsonw_end_array(json_wtr);
770 else if (!define_prefix) {
774 printf("\tProgram type not supported\n");
776 printf("\tCould not determine which helpers are available\n");
784 probe_misc_feature(struct bpf_insn *insns, size_t len,
785 const char *define_prefix, __u32 ifindex,
786 const char *feat_name, const char *plain_name,
787 const char *define_name)
789 LIBBPF_OPTS(bpf_prog_load_opts, opts,
790 .prog_ifindex = ifindex,
796 fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL",
798 res = fd >= 0 || !errno;
803 print_bool_feature(feat_name, plain_name, define_name, res,
808 * Probe for availability of kernel commit (5.3):
810 * c04c0d2b968a ("bpf: increase complexity limit and maximum program size")
812 static void probe_large_insn_limit(const char *define_prefix, __u32 ifindex)
814 struct bpf_insn insns[BPF_MAXINSNS + 1];
817 for (i = 0; i < BPF_MAXINSNS; i++)
818 insns[i] = BPF_MOV64_IMM(BPF_REG_0, 1);
819 insns[BPF_MAXINSNS] = BPF_EXIT_INSN();
821 probe_misc_feature(insns, ARRAY_SIZE(insns),
822 define_prefix, ifindex,
823 "have_large_insn_limit",
824 "Large program size limit",
829 * Probe for bounded loop support introduced in commit 2589726d12a1
830 * ("bpf: introduce bounded loops").
833 probe_bounded_loops(const char *define_prefix, __u32 ifindex)
835 struct bpf_insn insns[4] = {
836 BPF_MOV64_IMM(BPF_REG_0, 10),
837 BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 1),
838 BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, -2),
842 probe_misc_feature(insns, ARRAY_SIZE(insns),
843 define_prefix, ifindex,
844 "have_bounded_loops",
845 "Bounded loop support",
850 * Probe for the v2 instruction set extension introduced in commit 92b31a9af73b
851 * ("bpf: add BPF_J{LT,LE,SLT,SLE} instructions").
854 probe_v2_isa_extension(const char *define_prefix, __u32 ifindex)
856 struct bpf_insn insns[4] = {
857 BPF_MOV64_IMM(BPF_REG_0, 0),
858 BPF_JMP_IMM(BPF_JLT, BPF_REG_0, 0, 1),
859 BPF_MOV64_IMM(BPF_REG_0, 1),
863 probe_misc_feature(insns, ARRAY_SIZE(insns),
864 define_prefix, ifindex,
865 "have_v2_isa_extension",
871 * Probe for the v3 instruction set extension introduced in commit 092ed0968bb6
872 * ("bpf: verifier support JMP32").
875 probe_v3_isa_extension(const char *define_prefix, __u32 ifindex)
877 struct bpf_insn insns[4] = {
878 BPF_MOV64_IMM(BPF_REG_0, 0),
879 BPF_JMP32_IMM(BPF_JLT, BPF_REG_0, 0, 1),
880 BPF_MOV64_IMM(BPF_REG_0, 1),
884 probe_misc_feature(insns, ARRAY_SIZE(insns),
885 define_prefix, ifindex,
886 "have_v3_isa_extension",
892 section_system_config(enum probe_component target, const char *define_prefix)
895 case COMPONENT_KERNEL:
896 case COMPONENT_UNSPEC:
897 print_start_section("system_config",
898 "Scanning system configuration...",
899 "/*** Misc kernel config items ***/",
901 if (!define_prefix) {
902 if (check_procfs()) {
903 probe_unprivileged_disabled();
906 probe_jit_kallsyms();
909 p_info("/* procfs not mounted, skipping related probes */");
912 probe_kernel_image_config(define_prefix);
920 static bool section_syscall_config(const char *define_prefix)
924 print_start_section("syscall_config",
925 "Scanning system call availability...",
926 "/*** System call availability ***/",
928 res = probe_bpf_syscall(define_prefix);
935 section_program_types(bool *supported_types, const char *define_prefix,
938 unsigned int prog_type = BPF_PROG_TYPE_UNSPEC;
939 const char *prog_type_str;
941 print_start_section("program_types",
942 "Scanning eBPF program types...",
943 "/*** eBPF program types ***/",
948 prog_type_str = libbpf_bpf_prog_type_str(prog_type);
949 /* libbpf will return NULL for variants unknown to it. */
953 probe_prog_type(prog_type, prog_type_str, supported_types, define_prefix,
960 static void section_map_types(const char *define_prefix, __u32 ifindex)
962 unsigned int map_type = BPF_MAP_TYPE_UNSPEC;
963 const char *map_type_str;
965 print_start_section("map_types",
966 "Scanning eBPF map types...",
967 "/*** eBPF map types ***/",
972 map_type_str = libbpf_bpf_map_type_str(map_type);
973 /* libbpf will return NULL for variants unknown to it. */
977 probe_map_type(map_type, map_type_str, define_prefix, ifindex);
984 section_helpers(bool *supported_types, const char *define_prefix, __u32 ifindex)
986 unsigned int prog_type = BPF_PROG_TYPE_UNSPEC;
987 const char *prog_type_str;
989 print_start_section("helpers",
990 "Scanning eBPF helper functions...",
991 "/*** eBPF helper functions ***/",
996 " * Use %sHAVE_PROG_TYPE_HELPER(prog_type_name, helper_name)\n"
997 " * to determine if <helper_name> is available for <prog_type_name>,\n"
999 " * #if %sHAVE_PROG_TYPE_HELPER(xdp, bpf_redirect)\n"
1000 " * // do stuff with this helper\n"
1002 " * // use a workaround\n"
1005 "#define %sHAVE_PROG_TYPE_HELPER(prog_type, helper) \\\n"
1006 " %sBPF__PROG_TYPE_ ## prog_type ## __HELPER_ ## helper\n",
1007 define_prefix, define_prefix, define_prefix,
1011 prog_type_str = libbpf_bpf_prog_type_str(prog_type);
1012 /* libbpf will return NULL for variants unknown to it. */
1016 probe_helpers_for_progtype(prog_type, prog_type_str,
1017 supported_types[prog_type],
1022 print_end_section();
1025 static void section_misc(const char *define_prefix, __u32 ifindex)
1027 print_start_section("misc",
1028 "Scanning miscellaneous eBPF features...",
1029 "/*** eBPF misc features ***/",
1031 probe_large_insn_limit(define_prefix, ifindex);
1032 probe_bounded_loops(define_prefix, ifindex);
1033 probe_v2_isa_extension(define_prefix, ifindex);
1034 probe_v3_isa_extension(define_prefix, ifindex);
1035 print_end_section();
1039 #define capability(c) { c, false, #c }
1040 #define capability_msg(a, i) a[i].set ? "" : a[i].name, a[i].set ? "" : ", "
1043 static int handle_perms(void)
1049 char name[14]; /* strlen("CAP_SYS_ADMIN") */
1051 capability(CAP_SYS_ADMIN),
1053 capability(CAP_BPF),
1054 capability(CAP_NET_ADMIN),
1055 capability(CAP_PERFMON),
1058 cap_value_t cap_list[ARRAY_SIZE(bpf_caps)];
1059 unsigned int i, nb_bpf_caps = 0;
1060 bool cap_sys_admin_only = true;
1061 cap_flag_value_t val;
1065 caps = cap_get_proc();
1067 p_err("failed to get capabilities for process: %s",
1073 if (CAP_IS_SUPPORTED(CAP_BPF))
1074 cap_sys_admin_only = false;
1077 for (i = 0; i < ARRAY_SIZE(bpf_caps); i++) {
1078 const char *cap_name = bpf_caps[i].name;
1079 cap_value_t cap = bpf_caps[i].cap;
1081 if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &val)) {
1082 p_err("bug: failed to retrieve %s status: %s", cap_name,
1087 if (val == CAP_SET) {
1088 bpf_caps[i].set = true;
1089 cap_list[nb_bpf_caps++] = cap;
1092 if (cap_sys_admin_only)
1093 /* System does not know about CAP_BPF, meaning that
1094 * CAP_SYS_ADMIN is the only capability required. We
1095 * just checked it, break.
1100 if ((run_as_unprivileged && !nb_bpf_caps) ||
1101 (!run_as_unprivileged && nb_bpf_caps == ARRAY_SIZE(bpf_caps)) ||
1102 (!run_as_unprivileged && cap_sys_admin_only && nb_bpf_caps)) {
1103 /* We are all good, exit now */
1108 if (!run_as_unprivileged) {
1109 if (cap_sys_admin_only)
1110 p_err("missing %s, required for full feature probing; run as root or use 'unprivileged'",
1113 p_err("missing %s%s%s%s%s%s%s%srequired for full feature probing; run as root or use 'unprivileged'",
1114 capability_msg(bpf_caps, 0),
1116 capability_msg(bpf_caps, 1),
1117 capability_msg(bpf_caps, 2),
1118 capability_msg(bpf_caps, 3)
1120 "", "", "", "", "", ""
1121 #endif /* CAP_BPF */
1126 /* if (run_as_unprivileged && nb_bpf_caps > 0), drop capabilities. */
1127 if (cap_set_flag(caps, CAP_EFFECTIVE, nb_bpf_caps, cap_list,
1129 p_err("bug: failed to clear capabilities: %s", strerror(errno));
1133 if (cap_set_proc(caps)) {
1134 p_err("failed to drop capabilities: %s", strerror(errno));
1141 if (cap_free(caps) && !res) {
1142 p_err("failed to clear storage object for capabilities: %s",
1149 /* Detection assumes user has specific privileges.
1150 * We do not use libcap so let's approximate, and restrict usage to
1154 p_err("full feature probing requires root privileges");
1159 #endif /* USE_LIBCAP */
1162 static int do_probe(int argc, char **argv)
1164 enum probe_component target = COMPONENT_UNSPEC;
1165 const char *define_prefix = NULL;
1166 bool supported_types[128] = {};
1173 if (is_prefix(*argv, "kernel")) {
1174 if (target != COMPONENT_UNSPEC) {
1175 p_err("component to probe already specified");
1178 target = COMPONENT_KERNEL;
1180 } else if (is_prefix(*argv, "dev")) {
1183 if (target != COMPONENT_UNSPEC || ifindex) {
1184 p_err("component to probe already specified");
1190 target = COMPONENT_DEVICE;
1192 ifindex = if_nametoindex(ifname);
1194 p_err("unrecognized netdevice '%s': %s", ifname,
1198 } else if (is_prefix(*argv, "full")) {
1201 } else if (is_prefix(*argv, "macros") && !define_prefix) {
1204 } else if (is_prefix(*argv, "prefix")) {
1205 if (!define_prefix) {
1206 p_err("'prefix' argument can only be use after 'macros'");
1209 if (strcmp(define_prefix, "")) {
1210 p_err("'prefix' already defined");
1217 define_prefix = GET_ARG();
1218 } else if (is_prefix(*argv, "unprivileged")) {
1220 run_as_unprivileged = true;
1223 p_err("unprivileged run not supported, recompile bpftool with libcap");
1227 p_err("expected no more arguments, 'kernel', 'dev', 'macros' or 'prefix', got: '%s'?",
1233 /* Full feature detection requires specific privileges.
1234 * Let's approximate, and warn if user is not root.
1240 define_prefix = NULL;
1241 jsonw_start_object(json_wtr);
1244 section_system_config(target, define_prefix);
1245 if (!section_syscall_config(define_prefix))
1246 /* bpf() syscall unavailable, don't probe other BPF features */
1247 goto exit_close_json;
1248 section_program_types(supported_types, define_prefix, ifindex);
1249 section_map_types(define_prefix, ifindex);
1250 section_helpers(supported_types, define_prefix, ifindex);
1251 section_misc(define_prefix, ifindex);
1255 /* End root object */
1256 jsonw_end_object(json_wtr);
1261 static const char *get_helper_name(unsigned int id)
1263 if (id >= ARRAY_SIZE(helper_name))
1266 return helper_name[id];
1269 static int do_list_builtins(int argc, char **argv)
1271 const char *(*get_name)(unsigned int id);
1272 unsigned int id = 0;
1277 if (is_prefix(*argv, "prog_types")) {
1278 get_name = (const char *(*)(unsigned int))libbpf_bpf_prog_type_str;
1279 } else if (is_prefix(*argv, "map_types")) {
1280 get_name = (const char *(*)(unsigned int))libbpf_bpf_map_type_str;
1281 } else if (is_prefix(*argv, "attach_types")) {
1282 get_name = (const char *(*)(unsigned int))libbpf_bpf_attach_type_str;
1283 } else if (is_prefix(*argv, "link_types")) {
1284 get_name = (const char *(*)(unsigned int))libbpf_bpf_link_type_str;
1285 } else if (is_prefix(*argv, "helpers")) {
1286 get_name = get_helper_name;
1288 p_err("expected 'prog_types', 'map_types', 'attach_types', 'link_types' or 'helpers', got: %s", *argv);
1293 jsonw_start_array(json_wtr); /* root array */
1298 name = get_name(id++);
1302 jsonw_string(json_wtr, name);
1304 printf("%s\n", name);
1308 jsonw_end_array(json_wtr); /* root array */
1313 static int do_help(int argc, char **argv)
1316 jsonw_null(json_wtr);
1321 "Usage: %1$s %2$s probe [COMPONENT] [full] [unprivileged] [macros [prefix PREFIX]]\n"
1322 " %1$s %2$s list_builtins GROUP\n"
1325 " COMPONENT := { kernel | dev NAME }\n"
1326 " GROUP := { prog_types | map_types | attach_types | link_types | helpers }\n"
1327 " " HELP_SPEC_OPTIONS " }\n"
1329 bin_name, argv[-2]);
1334 static const struct cmd cmds[] = {
1335 { "probe", do_probe },
1336 { "list_builtins", do_list_builtins },
1337 { "help", do_help },
1341 int do_feature(int argc, char **argv)
1343 return cmd_select(cmds, argc, argv, do_help);