// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)/* Copyright (C) 2017-2018 Netronome Systems, Inc. */ #ifndef _GNU_SOURCE#define _GNU_SOURCE#endif#include <assert.h>#include <ctype.h>#include <errno.h>#include <fcntl.h>#include <ftw.h>#include <libgen.h>#include <mntent.h>#include <stdbool.h>#include <stdio.h>#include <stdlib.h>#include <string.h>#include <unistd.h>#include <net/if.h>#include <sys/mount.h>#include <sys/resource.h>#include <sys/stat.h>#include <sys/vfs.h>#include <sys/utsname.h> #include <linux/filter.h>#include <linux/limits.h>#include <linux/magic.h>#include <linux/unistd.h> #include <bpf/bpf.h>#include <bpf/hashmap.h>#include <bpf/libbpf.h> /* libbpf_num_possible_cpus */#include <bpf/btf.h>#include <zlib.h> #include "main.h" #ifndef BPF_FS_MAGIC#define BPF_FS_MAGIC 0xcafe4a11#endif void p_err(const char *fmt, ...){ va_list ap; va_start(ap, fmt); if (json_output) { jsonw_start_object(json_wtr); jsonw_name(json_wtr, "error"); jsonw_vprintf_enquote(json_wtr, fmt, ap); jsonw_end_object(json_wtr); } else { fprintf(stderr, "Error: "); vfprintf(stderr, fmt, ap); fprintf(stderr, "\n"); } va_end(ap);} void p_info(const char *fmt, ...){ va_list ap; if (json_output) return; va_start(ap, fmt); vfprintf(stderr, fmt, ap); fprintf(stderr, "\n"); va_end(ap);} static bool is_bpffs(const char *path){ struct statfs st_fs; if (statfs(path, &st_fs) < 0) return false; return (unsigned long)st_fs.f_type == BPF_FS_MAGIC;} /* Probe whether kernel switched from memlock-based (RLIMIT_MEMLOCK) to * memcg-based memory accounting for BPF maps and programs. This was done in * commit 97306be45fbe ("Merge branch 'switch to memcg-based memory * accounting'"), in Linux 5.11. * * Libbpf also offers to probe for memcg-based accounting vs rlimit, but does * so by checking for the availability of a given BPF helper and this has * failed on some kernels with backports in the past, see commit 6b4384ff1088 * ("Revert "bpftool: Use libbpf 1.0 API mode instead of RLIMIT_MEMLOCK""). * Instead, we can probe by lowering the process-based rlimit to 0, trying to * load a BPF object, and resetting the rlimit. If the load succeeds then * memcg-based accounting is supported. * * This would be too dangerous to do in the library, because multithreaded * applications might attempt to load items while the rlimit is at 0. Given * that bpftool is single-threaded, this is fine to do here. */static bool known_to_need_rlimit(void){ struct rlimit rlim_init, rlim_cur_zero = {}; struct bpf_insn insns[] = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }; size_t insn_cnt = ARRAY_SIZE(insns); union bpf_attr attr; int prog_fd, err; memset(&attr, 0, sizeof(attr)); attr.prog_type = BPF_PROG_TYPE_SOCKET_FILTER; attr.insns = ptr_to_u64(insns); attr.insn_cnt = insn_cnt; attr.license = ptr_to_u64("GPL"); if (getrlimit(RLIMIT_MEMLOCK, &rlim_init)) return false; /* Drop the soft limit to zero. We maintain the hard limit to its * current value, because lowering it would be a permanent operation * for unprivileged users. */ rlim_cur_zero.rlim_max = rlim_init.rlim_max; if (setrlimit(RLIMIT_MEMLOCK, &rlim_cur_zero)) return false; /* Do not use bpf_prog_load() from libbpf here, because it calls * bump_rlimit_memlock(), interfering with the current probe. */ prog_fd = syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr)); err = errno; /* reset soft rlimit to its initial value */ setrlimit(RLIMIT_MEMLOCK, &rlim_init); if (prog_fd < 0) return err == EPERM; close(prog_fd); return false;} void set_max_rlimit(void){ struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY }; if (known_to_need_rlimit()) setrlimit(RLIMIT_MEMLOCK, &rinf);} static intmnt_fs(const char *target, const char *type, char *buff, size_t bufflen){ bool bind_done = false; while (mount("", target, "none", MS_PRIVATE | MS_REC, NULL)) { if (errno != EINVAL || bind_done) { snprintf(buff, bufflen, "mount --make-private %s failed: %s", target, strerror(errno)); return -1; } if (mount(target, target, "none", MS_BIND, NULL)) { snprintf(buff, bufflen, "mount --bind %s %s failed: %s", target, target, strerror(errno)); return -1; } bind_done = true; } if (mount(type, target, type, 0, "mode=0700")) { snprintf(buff, bufflen, "mount -t %s %s %s failed: %s", type, type, target, strerror(errno)); return -1; } return 0;} int mount_tracefs(const char *target){ char err_str[ERR_MAX_LEN]; int err; err = mnt_fs(target, "tracefs", err_str, ERR_MAX_LEN); if (err) { err_str[ERR_MAX_LEN - 1] = '\0'; p_err("can't mount tracefs: %s", err_str); } return err;} int open_obj_pinned(const char *path, bool quiet, const struct bpf_obj_get_opts *opts){ char *pname; int fd = -1; pname = strdup(path); if (!pname) { if (!quiet) p_err("mem alloc failed"); goto out_ret; } fd = bpf_obj_get_opts(pname, opts); if (fd < 0) { if (!quiet) p_err("bpf obj get (%s): %s", pname, errno == EACCES && !is_bpffs(dirname(pname)) ? "directory not in bpf file system (bpffs)" : strerror(errno)); goto out_free; } out_free: free(pname);out_ret: return fd;} int open_obj_pinned_any(const char *path, enum bpf_obj_type exp_type, const struct bpf_obj_get_opts *opts){ enum bpf_obj_type type; int fd; fd = open_obj_pinned(path, false, opts); if (fd < 0) return -1; type = get_fd_type(fd); if (type < 0) { close(fd); return type; } if (type != exp_type) { p_err("incorrect object type: %s", get_fd_type_name(type)); close(fd); return -1; } return fd;} int create_and_mount_bpffs_dir(const char *dir_name){ char err_str[ERR_MAX_LEN]; bool dir_exists; int err = 0; if (is_bpffs(dir_name)) return err; dir_exists = access(dir_name, F_OK) == 0; if (!dir_exists) { char *temp_name; char *parent_name; temp_name = strdup(dir_name); if (!temp_name) { p_err("mem alloc failed"); return -1; } parent_name = dirname(temp_name); if (is_bpffs(parent_name)) { /* nothing to do if already mounted */ free(temp_name); return err; } if (access(parent_name, F_OK) == -1) { p_err("can't create dir '%s' to pin BPF object: parent dir '%s' doesn't exist", dir_name, parent_name); free(temp_name); return -1; } free(temp_name); } if (block_mount) { p_err("no BPF file system found, not mounting it due to --nomount option"); return -1; } if (!dir_exists) { err = mkdir(dir_name, S_IRWXU); if (err) { p_err("failed to create dir '%s': %s", dir_name, strerror(errno)); return err; } } err = mnt_fs(dir_name, "bpf", err_str, ERR_MAX_LEN); if (err) { err_str[ERR_MAX_LEN - 1] = '\0'; p_err("can't mount BPF file system on given dir '%s': %s", dir_name, err_str); if (!dir_exists) rmdir(dir_name); } return err;} int mount_bpffs_for_file(const char *file_name){ char err_str[ERR_MAX_LEN]; char *temp_name; char *dir; int err = 0; if (access(file_name, F_OK) != -1) { p_err("can't pin BPF object: path '%s' already exists", file_name); return -1; } temp_name = strdup(file_name); if (!temp_name) { p_err("mem alloc failed"); return -1; } dir = dirname(temp_name); if (is_bpffs(dir)) /* nothing to do if already mounted */ goto out_free; if (access(dir, F_OK) == -1) { p_err("can't pin BPF object: dir '%s' doesn't exist", dir); err = -1; goto out_free; } if (block_mount) { p_err("no BPF file system found, not mounting it due to --nomount option"); err = -1; goto out_free; } err = mnt_fs(dir, "bpf", err_str, ERR_MAX_LEN); if (err) { err_str[ERR_MAX_LEN - 1] = '\0'; p_err("can't mount BPF file system to pin the object '%s': %s", file_name, err_str); } out_free: free(temp_name); return err;} int do_pin_fd(int fd, const char *name){ int err; err = mount_bpffs_for_file(name); if (err) return err; err = bpf_obj_pin(fd, name); if (err) p_err("can't pin the object (%s): %s", name, strerror(errno)); return err;} int do_pin_any(int argc, char **argv, int (*get_fd)(int *, char ***)){ int err; int fd; if (!REQ_ARGS(3)) return -EINVAL; fd = get_fd(&argc, &argv); if (fd < 0) return fd; err = do_pin_fd(fd, *argv); close(fd); return err;} const char *get_fd_type_name(enum bpf_obj_type type){ static const char * const names[] = { [BPF_OBJ_UNKNOWN] = "unknown", [BPF_OBJ_PROG] = "prog", [BPF_OBJ_MAP] = "map", [BPF_OBJ_LINK] = "link", }; if (type < 0 || type >= ARRAY_SIZE(names) || !names[type]) return names[BPF_OBJ_UNKNOWN]; return names[type];} void get_prog_full_name(const struct bpf_prog_info *prog_info, int prog_fd, char *name_buff, size_t buff_len){ const char *prog_name = prog_info->name; const struct btf_type *func_type; struct bpf_func_info finfo = {}; struct bpf_prog_info info = {}; __u32 info_len = sizeof(info); struct btf *prog_btf = NULL; if (buff_len <= BPF_OBJ_NAME_LEN || strlen(prog_info->name) < BPF_OBJ_NAME_LEN - 1) goto copy_name; if (!prog_info->btf_id || prog_info->nr_func_info == 0) goto copy_name; info.nr_func_info = 1; info.func_info_rec_size = prog_info->func_info_rec_size; if (info.func_info_rec_size > sizeof(finfo)) info.func_info_rec_size = sizeof(finfo); info.func_info = ptr_to_u64(&finfo); if (bpf_prog_get_info_by_fd(prog_fd, &info, &info_len)) goto copy_name; prog_btf = btf__load_from_kernel_by_id(info.btf_id); if (!prog_btf) goto copy_name; func_type = btf__type_by_id(prog_btf, finfo.type_id); if (!func_type || !btf_is_func(func_type)) goto copy_name; prog_name = btf__name_by_offset(prog_btf, func_type->name_off); copy_name: snprintf(name_buff, buff_len, "%s", prog_name); if (prog_btf) btf__free(prog_btf);} int get_fd_type(int fd){ char path[PATH_MAX]; char buf[512]; ssize_t n; snprintf(path, sizeof(path), "/proc/self/fd/%d", fd); n = readlink(path, buf, sizeof(buf)); if (n < 0) { p_err("can't read link type: %s", strerror(errno)); return -1; } if (n == sizeof(buf)) { p_err("can't read link type: path too long!"); return -1; } buf[n] = '\0'; if (strstr(buf, "bpf-map")) return BPF_OBJ_MAP; else if (strstr(buf, "bpf-prog")) return BPF_OBJ_PROG; else if (strstr(buf, "bpf-link")) return BPF_OBJ_LINK; return BPF_OBJ_UNKNOWN;} char *get_fdinfo(int fd, const char *key){ char path[PATH_MAX]; char *line = NULL; size_t line_n = 0; ssize_t n; FILE *fdi; snprintf(path, sizeof(path), "/proc/self/fdinfo/%d", fd); fdi = fopen(path, "r"); if (!fdi) return NULL; while ((n = getline(&line, &line_n, fdi)) > 0) { char *value;Lines 1–500 of 1308. Load more
// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) /* Copyright (C) 2017-2018 Netronome Systems, Inc. */ #ifndef _GNU_SOURCE #define _GNU_SOURCE #endif #include <assert.h> #include <ctype.h> #include <errno.h> #include <fcntl.h> #include <ftw.h> #include <libgen.h> #include <mntent.h> #include <stdbool.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <net/if.h> #include <sys/mount.h> #include <sys/resource.h> #include <sys/stat.h> #include <sys/vfs.h> #include <sys/utsname.h> #include <linux/filter.h> #include <linux/limits.h> #include <linux/magic.h> #include <linux/unistd.h> #include <bpf/bpf.h> #include <bpf/hashmap.h> #include <bpf/libbpf.h> /* libbpf_num_possible_cpus */ #include <bpf/btf.h> #include <zlib.h> #include "main.h" #ifndef BPF_FS_MAGIC #define BPF_FS_MAGIC 0xcafe4a11 #endif void p_err(const char *fmt, ...) { va_list ap; va_start(ap, fmt); if (json_output) { jsonw_start_object(json_wtr); jsonw_name(json_wtr, "error"); jsonw_vprintf_enquote(json_wtr, fmt, ap); jsonw_end_object(json_wtr); } else { fprintf(stderr, "Error: "); vfprintf(stderr, fmt, ap); fprintf(stderr, "\n"); } va_end(ap); } void p_info(const char *fmt, ...) { va_list ap; if (json_output) return; va_start(ap, fmt); vfprintf(stderr, fmt, ap); fprintf(stderr, "\n"); va_end(ap); } static bool is_bpffs(const char *path) { struct statfs st_fs; if (statfs(path, &st_fs) < 0) return false; return (unsigned long)st_fs.f_type == BPF_FS_MAGIC; } /* Probe whether kernel switched from memlock-based (RLIMIT_MEMLOCK) to * memcg-based memory accounting for BPF maps and programs. This was done in * commit 97306be45fbe ("Merge branch 'switch to memcg-based memory * accounting'"), in Linux 5.11. * * Libbpf also offers to probe for memcg-based accounting vs rlimit, but does * so by checking for the availability of a given BPF helper and this has * failed on some kernels with backports in the past, see commit 6b4384ff1088 * ("Revert "bpftool: Use libbpf 1.0 API mode instead of RLIMIT_MEMLOCK""). * Instead, we can probe by lowering the process-based rlimit to 0, trying to * load a BPF object, and resetting the rlimit. If the load succeeds then * memcg-based accounting is supported. * * This would be too dangerous to do in the library, because multithreaded * applications might attempt to load items while the rlimit is at 0. Given * that bpftool is single-threaded, this is fine to do here. */ static bool known_to_need_rlimit(void) { struct rlimit rlim_init, rlim_cur_zero = {}; struct bpf_insn insns[] = { BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }; size_t insn_cnt = ARRAY_SIZE(insns); union bpf_attr attr; int prog_fd, err; memset(&attr, 0, sizeof(attr)); attr.prog_type = BPF_PROG_TYPE_SOCKET_FILTER; attr.insns = ptr_to_u64(insns); attr.insn_cnt = insn_cnt; attr.license = ptr_to_u64("GPL"); if (getrlimit(RLIMIT_MEMLOCK, &rlim_init)) return false; /* Drop the soft limit to zero. We maintain the hard limit to its * current value, because lowering it would be a permanent operation * for unprivileged users. */ rlim_cur_zero.rlim_max = rlim_init.rlim_max; if (setrlimit(RLIMIT_MEMLOCK, &rlim_cur_zero)) return false; /* Do not use bpf_prog_load() from libbpf here, because it calls * bump_rlimit_memlock(), interfering with the current probe. */ prog_fd = syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr)); err = errno; /* reset soft rlimit to its initial value */ setrlimit(RLIMIT_MEMLOCK, &rlim_init); if (prog_fd < 0) return err == EPERM; close(prog_fd); return false; } void set_max_rlimit(void) { struct rlimit rinf = { RLIM_INFINITY, RLIM_INFINITY }; if (known_to_need_rlimit()) setrlimit(RLIMIT_MEMLOCK, &rinf); } static int mnt_fs(const char *target, const char *type, char *buff, size_t bufflen) { bool bind_done = false; while (mount("", target, "none", MS_PRIVATE | MS_REC, NULL)) { if (errno != EINVAL || bind_done) { snprintf(buff, bufflen, "mount --make-private %s failed: %s", target, strerror(errno)); return -1; } if (mount(target, target, "none", MS_BIND, NULL)) { snprintf(buff, bufflen, "mount --bind %s %s failed: %s", target, target, strerror(errno)); return -1; } bind_done = true; } if (mount(type, target, type, 0, "mode=0700")) { snprintf(buff, bufflen, "mount -t %s %s %s failed: %s", type, type, target, strerror(errno)); return -1; } return 0; } int mount_tracefs(const char *target) { char err_str[ERR_MAX_LEN]; int err; err = mnt_fs(target, "tracefs", err_str, ERR_MAX_LEN); if (err) { err_str[ERR_MAX_LEN - 1] = '\0'; p_err("can't mount tracefs: %s", err_str); } return err; } int open_obj_pinned(const char *path, bool quiet, const struct bpf_obj_get_opts *opts) { char *pname; int fd = -1; pname = strdup(path); if (!pname) { if (!quiet) p_err("mem alloc failed"); goto out_ret; } fd = bpf_obj_get_opts(pname, opts); if (fd < 0) { if (!quiet) p_err("bpf obj get (%s): %s", pname, errno == EACCES && !is_bpffs(dirname(pname)) ? "directory not in bpf file system (bpffs)" : strerror(errno)); goto out_free; } out_free: free(pname); out_ret: return fd; } int open_obj_pinned_any(const char *path, enum bpf_obj_type exp_type, const struct bpf_obj_get_opts *opts) { enum bpf_obj_type type; int fd; fd = open_obj_pinned(path, false, opts); if (fd < 0) return -1; type = get_fd_type(fd); if (type < 0) { close(fd); return type; } if (type != exp_type) { p_err("incorrect object type: %s", get_fd_type_name(type)); close(fd); return -1; } return fd; } int create_and_mount_bpffs_dir(const char *dir_name) { char err_str[ERR_MAX_LEN]; bool dir_exists; int err = 0; if (is_bpffs(dir_name)) return err; dir_exists = access(dir_name, F_OK) == 0; if (!dir_exists) { char *temp_name; char *parent_name; temp_name = strdup(dir_name); if (!temp_name) { p_err("mem alloc failed"); return -1; } parent_name = dirname(temp_name); if (is_bpffs(parent_name)) { /* nothing to do if already mounted */ free(temp_name); return err; } if (access(parent_name, F_OK) == -1) { p_err("can't create dir '%s' to pin BPF object: parent dir '%s' doesn't exist", dir_name, parent_name); free(temp_name); return -1; } free(temp_name); } if (block_mount) { p_err("no BPF file system found, not mounting it due to --nomount option"); return -1; } if (!dir_exists) { err = mkdir(dir_name, S_IRWXU); if (err) { p_err("failed to create dir '%s': %s", dir_name, strerror(errno)); return err; } } err = mnt_fs(dir_name, "bpf", err_str, ERR_MAX_LEN); if (err) { err_str[ERR_MAX_LEN - 1] = '\0'; p_err("can't mount BPF file system on given dir '%s': %s", dir_name, err_str); if (!dir_exists) rmdir(dir_name); } return err; } int mount_bpffs_for_file(const char *file_name) { char err_str[ERR_MAX_LEN]; char *temp_name; char *dir; int err = 0; if (access(file_name, F_OK) != -1) { p_err("can't pin BPF object: path '%s' already exists", file_name); return -1; } temp_name = strdup(file_name); if (!temp_name) { p_err("mem alloc failed"); return -1; } dir = dirname(temp_name); if (is_bpffs(dir)) /* nothing to do if already mounted */ goto out_free; if (access(dir, F_OK) == -1) { p_err("can't pin BPF object: dir '%s' doesn't exist", dir); err = -1; goto out_free; } if (block_mount) { p_err("no BPF file system found, not mounting it due to --nomount option"); err = -1; goto out_free; } err = mnt_fs(dir, "bpf", err_str, ERR_MAX_LEN); if (err) { err_str[ERR_MAX_LEN - 1] = '\0'; p_err("can't mount BPF file system to pin the object '%s': %s", file_name, err_str); } out_free: free(temp_name); return err; } int do_pin_fd(int fd, const char *name) { int err; err = mount_bpffs_for_file(name); if (err) return err; err = bpf_obj_pin(fd, name); if (err) p_err("can't pin the object (%s): %s", name, strerror(errno)); return err; } int do_pin_any(int argc, char **argv, int (*get_fd)(int *, char ***)) { int err; int fd; if (!REQ_ARGS(3)) return -EINVAL; fd = get_fd(&argc, &argv); if (fd < 0) return fd; err = do_pin_fd(fd, *argv); close(fd); return err; } const char *get_fd_type_name(enum bpf_obj_type type) { static const char * const names[] = { [BPF_OBJ_UNKNOWN] = "unknown", [BPF_OBJ_PROG] = "prog", [BPF_OBJ_MAP] = "map", [BPF_OBJ_LINK] = "link", }; if (type < 0 || type >= ARRAY_SIZE(names) || !names[type]) return names[BPF_OBJ_UNKNOWN]; return names[type]; } void get_prog_full_name(const struct bpf_prog_info *prog_info, int prog_fd, char *name_buff, size_t buff_len) { const char *prog_name = prog_info->name; const struct btf_type *func_type; struct bpf_func_info finfo = {}; struct bpf_prog_info info = {}; __u32 info_len = sizeof(info); struct btf *prog_btf = NULL; if (buff_len <= BPF_OBJ_NAME_LEN || strlen(prog_info->name) < BPF_OBJ_NAME_LEN - 1) goto copy_name; if (!prog_info->btf_id || prog_info->nr_func_info == 0) goto copy_name; info.nr_func_info = 1; info.func_info_rec_size = prog_info->func_info_rec_size; if (info.func_info_rec_size > sizeof(finfo)) info.func_info_rec_size = sizeof(finfo); info.func_info = ptr_to_u64(&finfo); if (bpf_prog_get_info_by_fd(prog_fd, &info, &info_len)) goto copy_name; prog_btf = btf__load_from_kernel_by_id(info.btf_id); if (!prog_btf) goto copy_name; func_type = btf__type_by_id(prog_btf, finfo.type_id); if (!func_type || !btf_is_func(func_type)) goto copy_name; prog_name = btf__name_by_offset(prog_btf, func_type->name_off); copy_name: snprintf(name_buff, buff_len, "%s", prog_name); if (prog_btf) btf__free(prog_btf); } int get_fd_type(int fd) { char path[PATH_MAX]; char buf[512]; ssize_t n; snprintf(path, sizeof(path), "/proc/self/fd/%d", fd); n = readlink(path, buf, sizeof(buf)); if (n < 0) { p_err("can't read link type: %s", strerror(errno)); return -1; } if (n == sizeof(buf)) { p_err("can't read link type: path too long!"); return -1; } buf[n] = '\0'; if (strstr(buf, "bpf-map")) return BPF_OBJ_MAP; else if (strstr(buf, "bpf-prog")) return BPF_OBJ_PROG; else if (strstr(buf, "bpf-link")) return BPF_OBJ_LINK; return BPF_OBJ_UNKNOWN; } char *get_fdinfo(int fd, const char *key) { char path[PATH_MAX]; char *line = NULL; size_t line_n = 0; ssize_t n; FILE *fdi; snprintf(path, sizeof(path), "/proc/self/fdinfo/%d", fd); fdi = fopen(path, "r"); if (!fdi) return NULL; while ((n = getline(&line, &line_n, fdi)) > 0) { char *value;