xref: /linux/tools/lib/bpf/libbpf_probes.c (revision dd093fb0)
1 // SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
2 /* Copyright (c) 2019 Netronome Systems, Inc. */
3 
4 #include <errno.h>
5 #include <fcntl.h>
6 #include <string.h>
7 #include <stdlib.h>
8 #include <unistd.h>
9 #include <net/if.h>
10 #include <sys/utsname.h>
11 
12 #include <linux/btf.h>
13 #include <linux/filter.h>
14 #include <linux/kernel.h>
15 
16 #include "bpf.h"
17 #include "libbpf.h"
18 #include "libbpf_internal.h"
19 
20 static int probe_prog_load(enum bpf_prog_type prog_type,
21 			   const struct bpf_insn *insns, size_t insns_cnt,
22 			   char *log_buf, size_t log_buf_sz)
23 {
24 	LIBBPF_OPTS(bpf_prog_load_opts, opts,
25 		.log_buf = log_buf,
26 		.log_size = log_buf_sz,
27 		.log_level = log_buf ? 1 : 0,
28 	);
29 	int fd, err, exp_err = 0;
30 	const char *exp_msg = NULL;
31 	char buf[4096];
32 
33 	switch (prog_type) {
34 	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
35 		opts.expected_attach_type = BPF_CGROUP_INET4_CONNECT;
36 		break;
37 	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
38 		opts.expected_attach_type = BPF_CGROUP_GETSOCKOPT;
39 		break;
40 	case BPF_PROG_TYPE_SK_LOOKUP:
41 		opts.expected_attach_type = BPF_SK_LOOKUP;
42 		break;
43 	case BPF_PROG_TYPE_KPROBE:
44 		opts.kern_version = get_kernel_version();
45 		break;
46 	case BPF_PROG_TYPE_LIRC_MODE2:
47 		opts.expected_attach_type = BPF_LIRC_MODE2;
48 		break;
49 	case BPF_PROG_TYPE_TRACING:
50 	case BPF_PROG_TYPE_LSM:
51 		opts.log_buf = buf;
52 		opts.log_size = sizeof(buf);
53 		opts.log_level = 1;
54 		if (prog_type == BPF_PROG_TYPE_TRACING)
55 			opts.expected_attach_type = BPF_TRACE_FENTRY;
56 		else
57 			opts.expected_attach_type = BPF_MODIFY_RETURN;
58 		opts.attach_btf_id = 1;
59 
60 		exp_err = -EINVAL;
61 		exp_msg = "attach_btf_id 1 is not a function";
62 		break;
63 	case BPF_PROG_TYPE_EXT:
64 		opts.log_buf = buf;
65 		opts.log_size = sizeof(buf);
66 		opts.log_level = 1;
67 		opts.attach_btf_id = 1;
68 
69 		exp_err = -EINVAL;
70 		exp_msg = "Cannot replace kernel functions";
71 		break;
72 	case BPF_PROG_TYPE_SYSCALL:
73 		opts.prog_flags = BPF_F_SLEEPABLE;
74 		break;
75 	case BPF_PROG_TYPE_STRUCT_OPS:
76 		exp_err = -524; /* -ENOTSUPP */
77 		break;
78 	case BPF_PROG_TYPE_UNSPEC:
79 	case BPF_PROG_TYPE_SOCKET_FILTER:
80 	case BPF_PROG_TYPE_SCHED_CLS:
81 	case BPF_PROG_TYPE_SCHED_ACT:
82 	case BPF_PROG_TYPE_TRACEPOINT:
83 	case BPF_PROG_TYPE_XDP:
84 	case BPF_PROG_TYPE_PERF_EVENT:
85 	case BPF_PROG_TYPE_CGROUP_SKB:
86 	case BPF_PROG_TYPE_CGROUP_SOCK:
87 	case BPF_PROG_TYPE_LWT_IN:
88 	case BPF_PROG_TYPE_LWT_OUT:
89 	case BPF_PROG_TYPE_LWT_XMIT:
90 	case BPF_PROG_TYPE_SOCK_OPS:
91 	case BPF_PROG_TYPE_SK_SKB:
92 	case BPF_PROG_TYPE_CGROUP_DEVICE:
93 	case BPF_PROG_TYPE_SK_MSG:
94 	case BPF_PROG_TYPE_RAW_TRACEPOINT:
95 	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
96 	case BPF_PROG_TYPE_LWT_SEG6LOCAL:
97 	case BPF_PROG_TYPE_SK_REUSEPORT:
98 	case BPF_PROG_TYPE_FLOW_DISSECTOR:
99 	case BPF_PROG_TYPE_CGROUP_SYSCTL:
100 		break;
101 	default:
102 		return -EOPNOTSUPP;
103 	}
104 
105 	fd = bpf_prog_load(prog_type, NULL, "GPL", insns, insns_cnt, &opts);
106 	err = -errno;
107 	if (fd >= 0)
108 		close(fd);
109 	if (exp_err) {
110 		if (fd >= 0 || err != exp_err)
111 			return 0;
112 		if (exp_msg && !strstr(buf, exp_msg))
113 			return 0;
114 		return 1;
115 	}
116 	return fd >= 0 ? 1 : 0;
117 }
118 
119 int libbpf_probe_bpf_prog_type(enum bpf_prog_type prog_type, const void *opts)
120 {
121 	struct bpf_insn insns[] = {
122 		BPF_MOV64_IMM(BPF_REG_0, 0),
123 		BPF_EXIT_INSN()
124 	};
125 	const size_t insn_cnt = ARRAY_SIZE(insns);
126 	int ret;
127 
128 	if (opts)
129 		return libbpf_err(-EINVAL);
130 
131 	ret = probe_prog_load(prog_type, insns, insn_cnt, NULL, 0);
132 	return libbpf_err(ret);
133 }
134 
135 int libbpf__load_raw_btf(const char *raw_types, size_t types_len,
136 			 const char *str_sec, size_t str_len)
137 {
138 	struct btf_header hdr = {
139 		.magic = BTF_MAGIC,
140 		.version = BTF_VERSION,
141 		.hdr_len = sizeof(struct btf_header),
142 		.type_len = types_len,
143 		.str_off = types_len,
144 		.str_len = str_len,
145 	};
146 	int btf_fd, btf_len;
147 	__u8 *raw_btf;
148 
149 	btf_len = hdr.hdr_len + hdr.type_len + hdr.str_len;
150 	raw_btf = malloc(btf_len);
151 	if (!raw_btf)
152 		return -ENOMEM;
153 
154 	memcpy(raw_btf, &hdr, sizeof(hdr));
155 	memcpy(raw_btf + hdr.hdr_len, raw_types, hdr.type_len);
156 	memcpy(raw_btf + hdr.hdr_len + hdr.type_len, str_sec, hdr.str_len);
157 
158 	btf_fd = bpf_btf_load(raw_btf, btf_len, NULL);
159 
160 	free(raw_btf);
161 	return btf_fd;
162 }
163 
164 static int load_local_storage_btf(void)
165 {
166 	const char strs[] = "\0bpf_spin_lock\0val\0cnt\0l";
167 	/* struct bpf_spin_lock {
168 	 *   int val;
169 	 * };
170 	 * struct val {
171 	 *   int cnt;
172 	 *   struct bpf_spin_lock l;
173 	 * };
174 	 */
175 	__u32 types[] = {
176 		/* int */
177 		BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */
178 		/* struct bpf_spin_lock */                      /* [2] */
179 		BTF_TYPE_ENC(1, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4),
180 		BTF_MEMBER_ENC(15, 1, 0), /* int val; */
181 		/* struct val */                                /* [3] */
182 		BTF_TYPE_ENC(15, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 2), 8),
183 		BTF_MEMBER_ENC(19, 1, 0), /* int cnt; */
184 		BTF_MEMBER_ENC(23, 2, 32),/* struct bpf_spin_lock l; */
185 	};
186 
187 	return libbpf__load_raw_btf((char *)types, sizeof(types),
188 				     strs, sizeof(strs));
189 }
190 
191 static int probe_map_create(enum bpf_map_type map_type)
192 {
193 	LIBBPF_OPTS(bpf_map_create_opts, opts);
194 	int key_size, value_size, max_entries;
195 	__u32 btf_key_type_id = 0, btf_value_type_id = 0;
196 	int fd = -1, btf_fd = -1, fd_inner = -1, exp_err = 0, err = 0;
197 
198 	key_size	= sizeof(__u32);
199 	value_size	= sizeof(__u32);
200 	max_entries	= 1;
201 
202 	switch (map_type) {
203 	case BPF_MAP_TYPE_STACK_TRACE:
204 		value_size	= sizeof(__u64);
205 		break;
206 	case BPF_MAP_TYPE_LPM_TRIE:
207 		key_size	= sizeof(__u64);
208 		value_size	= sizeof(__u64);
209 		opts.map_flags	= BPF_F_NO_PREALLOC;
210 		break;
211 	case BPF_MAP_TYPE_CGROUP_STORAGE:
212 	case BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE:
213 		key_size	= sizeof(struct bpf_cgroup_storage_key);
214 		value_size	= sizeof(__u64);
215 		max_entries	= 0;
216 		break;
217 	case BPF_MAP_TYPE_QUEUE:
218 	case BPF_MAP_TYPE_STACK:
219 		key_size	= 0;
220 		break;
221 	case BPF_MAP_TYPE_SK_STORAGE:
222 	case BPF_MAP_TYPE_INODE_STORAGE:
223 	case BPF_MAP_TYPE_TASK_STORAGE:
224 	case BPF_MAP_TYPE_CGRP_STORAGE:
225 		btf_key_type_id = 1;
226 		btf_value_type_id = 3;
227 		value_size = 8;
228 		max_entries = 0;
229 		opts.map_flags = BPF_F_NO_PREALLOC;
230 		btf_fd = load_local_storage_btf();
231 		if (btf_fd < 0)
232 			return btf_fd;
233 		break;
234 	case BPF_MAP_TYPE_RINGBUF:
235 	case BPF_MAP_TYPE_USER_RINGBUF:
236 		key_size = 0;
237 		value_size = 0;
238 		max_entries = sysconf(_SC_PAGE_SIZE);
239 		break;
240 	case BPF_MAP_TYPE_STRUCT_OPS:
241 		/* we'll get -ENOTSUPP for invalid BTF type ID for struct_ops */
242 		opts.btf_vmlinux_value_type_id = 1;
243 		exp_err = -524; /* -ENOTSUPP */
244 		break;
245 	case BPF_MAP_TYPE_BLOOM_FILTER:
246 		key_size = 0;
247 		max_entries = 1;
248 		break;
249 	case BPF_MAP_TYPE_HASH:
250 	case BPF_MAP_TYPE_ARRAY:
251 	case BPF_MAP_TYPE_PROG_ARRAY:
252 	case BPF_MAP_TYPE_PERF_EVENT_ARRAY:
253 	case BPF_MAP_TYPE_PERCPU_HASH:
254 	case BPF_MAP_TYPE_PERCPU_ARRAY:
255 	case BPF_MAP_TYPE_CGROUP_ARRAY:
256 	case BPF_MAP_TYPE_LRU_HASH:
257 	case BPF_MAP_TYPE_LRU_PERCPU_HASH:
258 	case BPF_MAP_TYPE_ARRAY_OF_MAPS:
259 	case BPF_MAP_TYPE_HASH_OF_MAPS:
260 	case BPF_MAP_TYPE_DEVMAP:
261 	case BPF_MAP_TYPE_DEVMAP_HASH:
262 	case BPF_MAP_TYPE_SOCKMAP:
263 	case BPF_MAP_TYPE_CPUMAP:
264 	case BPF_MAP_TYPE_XSKMAP:
265 	case BPF_MAP_TYPE_SOCKHASH:
266 	case BPF_MAP_TYPE_REUSEPORT_SOCKARRAY:
267 		break;
268 	case BPF_MAP_TYPE_UNSPEC:
269 	default:
270 		return -EOPNOTSUPP;
271 	}
272 
273 	if (map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS ||
274 	    map_type == BPF_MAP_TYPE_HASH_OF_MAPS) {
275 		fd_inner = bpf_map_create(BPF_MAP_TYPE_HASH, NULL,
276 					  sizeof(__u32), sizeof(__u32), 1, NULL);
277 		if (fd_inner < 0)
278 			goto cleanup;
279 
280 		opts.inner_map_fd = fd_inner;
281 	}
282 
283 	if (btf_fd >= 0) {
284 		opts.btf_fd = btf_fd;
285 		opts.btf_key_type_id = btf_key_type_id;
286 		opts.btf_value_type_id = btf_value_type_id;
287 	}
288 
289 	fd = bpf_map_create(map_type, NULL, key_size, value_size, max_entries, &opts);
290 	err = -errno;
291 
292 cleanup:
293 	if (fd >= 0)
294 		close(fd);
295 	if (fd_inner >= 0)
296 		close(fd_inner);
297 	if (btf_fd >= 0)
298 		close(btf_fd);
299 
300 	if (exp_err)
301 		return fd < 0 && err == exp_err ? 1 : 0;
302 	else
303 		return fd >= 0 ? 1 : 0;
304 }
305 
306 int libbpf_probe_bpf_map_type(enum bpf_map_type map_type, const void *opts)
307 {
308 	int ret;
309 
310 	if (opts)
311 		return libbpf_err(-EINVAL);
312 
313 	ret = probe_map_create(map_type);
314 	return libbpf_err(ret);
315 }
316 
317 int libbpf_probe_bpf_helper(enum bpf_prog_type prog_type, enum bpf_func_id helper_id,
318 			    const void *opts)
319 {
320 	struct bpf_insn insns[] = {
321 		BPF_EMIT_CALL((__u32)helper_id),
322 		BPF_EXIT_INSN(),
323 	};
324 	const size_t insn_cnt = ARRAY_SIZE(insns);
325 	char buf[4096];
326 	int ret;
327 
328 	if (opts)
329 		return libbpf_err(-EINVAL);
330 
331 	/* we can't successfully load all prog types to check for BPF helper
332 	 * support, so bail out with -EOPNOTSUPP error
333 	 */
334 	switch (prog_type) {
335 	case BPF_PROG_TYPE_TRACING:
336 	case BPF_PROG_TYPE_EXT:
337 	case BPF_PROG_TYPE_LSM:
338 	case BPF_PROG_TYPE_STRUCT_OPS:
339 		return -EOPNOTSUPP;
340 	default:
341 		break;
342 	}
343 
344 	buf[0] = '\0';
345 	ret = probe_prog_load(prog_type, insns, insn_cnt, buf, sizeof(buf));
346 	if (ret < 0)
347 		return libbpf_err(ret);
348 
349 	/* If BPF verifier doesn't recognize BPF helper ID (enum bpf_func_id)
350 	 * at all, it will emit something like "invalid func unknown#181".
351 	 * If BPF verifier recognizes BPF helper but it's not supported for
352 	 * given BPF program type, it will emit "unknown func bpf_sys_bpf#166".
353 	 * In both cases, provided combination of BPF program type and BPF
354 	 * helper is not supported by the kernel.
355 	 * In all other cases, probe_prog_load() above will either succeed (e.g.,
356 	 * because BPF helper happens to accept no input arguments or it
357 	 * accepts one input argument and initial PTR_TO_CTX is fine for
358 	 * that), or we'll get some more specific BPF verifier error about
359 	 * some unsatisfied conditions.
360 	 */
361 	if (ret == 0 && (strstr(buf, "invalid func ") || strstr(buf, "unknown func ")))
362 		return 0;
363 	return 1; /* assume supported */
364 }
365