[thirdparty/kernel/stable.git] / drivers / misc / lkdtm.c

/*
 * Kprobe module for testing crash dumps
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 * Copyright (C) IBM Corporation, 2006
 *
 * Author: Ankita Garg <ankita@in.ibm.com>
 *
 * This module induces system failures at predefined crashpoints to
 * evaluate the reliability of crash dumps obtained using different dumping
 * solutions.
 *
 * It is adapted from the Linux Kernel Dump Test Tool by
 * Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
 *
 * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
 *
 * See Documentation/fault-injection/provoke-crashes.txt for instructions
 */

#include <linux/kernel.h>
#include <linux/fs.h>
#include <linux/module.h>
#include <linux/buffer_head.h>
#include <linux/kprobes.h>
#include <linux/list.h>
#include <linux/init.h>
#include <linux/interrupt.h>
#include <linux/hrtimer.h>
#include <linux/slab.h>
#include <scsi/scsi_cmnd.h>
#include <linux/debugfs.h>

#ifdef CONFIG_IDE
#include <linux/ide.h>
#endif

#define DEFAULT_COUNT 10
#define REC_NUM_DEFAULT 10

enum cname {
	CN_INVALID,
	CN_INT_HARDWARE_ENTRY,
	CN_INT_HW_IRQ_EN,
	CN_INT_TASKLET_ENTRY,
	CN_FS_DEVRW,
	CN_MEM_SWAPOUT,
	CN_TIMERADD,
	CN_SCSI_DISPATCH_CMD,
	CN_IDE_CORE_CP,
	CN_DIRECT,
};

enum ctype {
	CT_NONE,
	CT_PANIC,
	CT_BUG,
	CT_EXCEPTION,
	CT_LOOP,
	CT_OVERFLOW,
	CT_CORRUPT_STACK,
	CT_UNALIGNED_LOAD_STORE_WRITE,
	CT_OVERWRITE_ALLOCATION,
	CT_WRITE_AFTER_FREE,
	CT_SOFTLOCKUP,
	CT_HARDLOCKUP,
	CT_HUNG_TASK,
};

static char* cp_name[] = {
	"INT_HARDWARE_ENTRY",
	"INT_HW_IRQ_EN",
	"INT_TASKLET_ENTRY",
	"FS_DEVRW",
	"MEM_SWAPOUT",
	"TIMERADD",
	"SCSI_DISPATCH_CMD",
	"IDE_CORE_CP",
	"DIRECT",
};

static char* cp_type[] = {
	"PANIC",
	"BUG",
	"EXCEPTION",
	"LOOP",
	"OVERFLOW",
	"CORRUPT_STACK",
	"UNALIGNED_LOAD_STORE_WRITE",
	"OVERWRITE_ALLOCATION",
	"WRITE_AFTER_FREE",
	"SOFTLOCKUP",
	"HARDLOCKUP",
	"HUNG_TASK",
};

static struct jprobe lkdtm;

static int lkdtm_parse_commandline(void);
static void lkdtm_handler(void);

static char* cpoint_name;
static char* cpoint_type;
static int cpoint_count = DEFAULT_COUNT;
static int recur_count = REC_NUM_DEFAULT;

static enum cname cpoint = CN_INVALID;
static enum ctype cptype = CT_NONE;
static int count = DEFAULT_COUNT;
static DEFINE_SPINLOCK(count_lock);

module_param(recur_count, int, 0644);
MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
				 "default is 10");
module_param(cpoint_name, charp, 0444);
MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed");
module_param(cpoint_type, charp, 0444);
MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\
				"hitting the crash point");
module_param(cpoint_count, int, 0644);
MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\
				"crash point is to be hit to trigger action");

static unsigned int jp_do_irq(unsigned int irq)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}

static irqreturn_t jp_handle_irq_event(unsigned int irq,
				       struct irqaction *action)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}

static void jp_tasklet_action(struct softirq_action *a)
{
	lkdtm_handler();
	jprobe_return();
}

static void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
{
	lkdtm_handler();
	jprobe_return();
}

struct scan_control;

static unsigned long jp_shrink_inactive_list(unsigned long max_scan,
					     struct zone *zone,
					     struct scan_control *sc)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}

static int jp_hrtimer_start(struct hrtimer *timer, ktime_t tim,
			    const enum hrtimer_mode mode)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}

static int jp_scsi_dispatch_cmd(struct scsi_cmnd *cmd)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}

#ifdef CONFIG_IDE
int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file,
			struct block_device *bdev, unsigned int cmd,
			unsigned long arg)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}
#endif

/* Return the crashpoint number or NONE if the name is invalid */
static enum ctype parse_cp_type(const char *what, size_t count)
{
	int i;

	for (i = 0; i < ARRAY_SIZE(cp_type); i++) {
		if (!strcmp(what, cp_type[i]))
			return i + 1;
	}

	return CT_NONE;
}

static const char *cp_type_to_str(enum ctype type)
{
	if (type == CT_NONE || type < 0 || type > ARRAY_SIZE(cp_type))
		return "None";

	return cp_type[type - 1];
}

static const char *cp_name_to_str(enum cname name)
{
	if (name == CN_INVALID || name < 0 || name > ARRAY_SIZE(cp_name))
		return "INVALID";

	return cp_name[name - 1];
}


static int lkdtm_parse_commandline(void)
{
	int i;
	unsigned long flags;

	if (cpoint_count < 1 || recur_count < 1)
		return -EINVAL;

	spin_lock_irqsave(&count_lock, flags);
	count = cpoint_count;
	spin_unlock_irqrestore(&count_lock, flags);

	/* No special parameters */
	if (!cpoint_type && !cpoint_name)
		return 0;

	/* Neither or both of these need to be set */
	if (!cpoint_type || !cpoint_name)
		return -EINVAL;

	cptype = parse_cp_type(cpoint_type, strlen(cpoint_type));
	if (cptype == CT_NONE)
		return -EINVAL;

	for (i = 0; i < ARRAY_SIZE(cp_name); i++) {
		if (!strcmp(cpoint_name, cp_name[i])) {
			cpoint = i + 1;
			return 0;
		}
	}

	/* Could not find a valid crash point */
	return -EINVAL;
}

static int recursive_loop(int a)
{
	char buf[1024];

	memset(buf,0xFF,1024);
	recur_count--;
	if (!recur_count)
		return 0;
	else
        	return recursive_loop(a);
}

static void lkdtm_do_action(enum ctype which)
{
	switch (which) {
	case CT_PANIC:
		panic("dumptest");
		break;
	case CT_BUG:
		BUG();
		break;
	case CT_EXCEPTION:
		*((int *) 0) = 0;
		break;
	case CT_LOOP:
		for (;;)
			;
		break;
	case CT_OVERFLOW:
		(void) recursive_loop(0);
		break;
	case CT_CORRUPT_STACK: {
		volatile u32 data[8];
		volatile u32 *p = data;

		p[12] = 0x12345678;
		break;
	}
	case CT_UNALIGNED_LOAD_STORE_WRITE: {
		static u8 data[5] __attribute__((aligned(4))) = {1, 2,
				3, 4, 5};
		u32 *p;
		u32 val = 0x12345678;

		p = (u32 *)(data + 1);
		if (*p == 0)
			val = 0x87654321;
		*p = val;
		 break;
	}
	case CT_OVERWRITE_ALLOCATION: {
		size_t len = 1020;
		u32 *data = kmalloc(len, GFP_KERNEL);

		data[1024 / sizeof(u32)] = 0x12345678;
		kfree(data);
		break;
	}
	case CT_WRITE_AFTER_FREE: {
		size_t len = 1024;
		u32 *data = kmalloc(len, GFP_KERNEL);

		kfree(data);
		schedule();
		memset(data, 0x78, len);
		break;
	}
	case CT_SOFTLOCKUP:
		preempt_disable();
		for (;;)
			cpu_relax();
		break;
	case CT_HARDLOCKUP:
		local_irq_disable();
		for (;;)
			cpu_relax();
		break;
	case CT_HUNG_TASK:
		set_current_state(TASK_UNINTERRUPTIBLE);
		schedule();
		break;
	case CT_NONE:
	default:
		break;
	}

}

static void lkdtm_handler(void)
{
	unsigned long flags;

	spin_lock_irqsave(&count_lock, flags);
	count--;
	printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
			cp_name_to_str(cpoint), cp_type_to_str(cptype), count);

	if (count == 0) {
		lkdtm_do_action(cptype);
		count = cpoint_count;
	}
	spin_unlock_irqrestore(&count_lock, flags);
}

static int lkdtm_register_cpoint(enum cname which)
{
	int ret;

	cpoint = CN_INVALID;
	if (lkdtm.entry != NULL)
		unregister_jprobe(&lkdtm);

	switch (which) {
	case CN_DIRECT:
		lkdtm_do_action(cptype);
		return 0;
	case CN_INT_HARDWARE_ENTRY:
		lkdtm.kp.symbol_name = "do_IRQ";
		lkdtm.entry = (kprobe_opcode_t*) jp_do_irq;
		break;
	case CN_INT_HW_IRQ_EN:
		lkdtm.kp.symbol_name = "handle_IRQ_event";
		lkdtm.entry = (kprobe_opcode_t*) jp_handle_irq_event;
		break;
	case CN_INT_TASKLET_ENTRY:
		lkdtm.kp.symbol_name = "tasklet_action";
		lkdtm.entry = (kprobe_opcode_t*) jp_tasklet_action;
		break;
	case CN_FS_DEVRW:
		lkdtm.kp.symbol_name = "ll_rw_block";
		lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block;
		break;
	case CN_MEM_SWAPOUT:
		lkdtm.kp.symbol_name = "shrink_inactive_list";
		lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list;
		break;
	case CN_TIMERADD:
		lkdtm.kp.symbol_name = "hrtimer_start";
		lkdtm.entry = (kprobe_opcode_t*) jp_hrtimer_start;
		break;
	case CN_SCSI_DISPATCH_CMD:
		lkdtm.kp.symbol_name = "scsi_dispatch_cmd";
		lkdtm.entry = (kprobe_opcode_t*) jp_scsi_dispatch_cmd;
		break;
	case CN_IDE_CORE_CP:
#ifdef CONFIG_IDE
		lkdtm.kp.symbol_name = "generic_ide_ioctl";
		lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl;
#else
		printk(KERN_INFO "lkdtm: Crash point not available\n");
		return -EINVAL;
#endif
		break;
	default:
		printk(KERN_INFO "lkdtm: Invalid Crash Point\n");
		return -EINVAL;
	}

	cpoint = which;
	if ((ret = register_jprobe(&lkdtm)) < 0) {
		printk(KERN_INFO "lkdtm: Couldn't register jprobe\n");
		cpoint = CN_INVALID;
	}

	return ret;
}

static ssize_t do_register_entry(enum cname which, struct file *f,
		const char __user *user_buf, size_t count, loff_t *off)
{
	char *buf;
	int err;

	if (count >= PAGE_SIZE)
		return -EINVAL;

	buf = (char *)__get_free_page(GFP_KERNEL);
	if (!buf)
		return -ENOMEM;
	if (copy_from_user(buf, user_buf, count)) {
		free_page((unsigned long) buf);
		return -EFAULT;
	}
	/* NULL-terminate and remove enter */
	buf[count] = '\0';
	strim(buf);

	cptype = parse_cp_type(buf, count);
	free_page((unsigned long) buf);

	if (cptype == CT_NONE)
		return -EINVAL;

	err = lkdtm_register_cpoint(which);
	if (err < 0)
		return err;

	*off += count;

	return count;
}

/* Generic read callback that just prints out the available crash types */
static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
		size_t count, loff_t *off)
{
	char *buf;
	int i, n, out;

	buf = (char *)__get_free_page(GFP_KERNEL);

	n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
	for (i = 0; i < ARRAY_SIZE(cp_type); i++)
		n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]);
	buf[n] = '\0';

	out = simple_read_from_buffer(user_buf, count, off,
				      buf, n);
	free_page((unsigned long) buf);

	return out;
}

static int lkdtm_debugfs_open(struct inode *inode, struct file *file)
{
	return 0;
}


static ssize_t int_hardware_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(CN_INT_HARDWARE_ENTRY, f, buf, count, off);
}

static ssize_t int_hw_irq_en(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(CN_INT_HW_IRQ_EN, f, buf, count, off);
}

static ssize_t int_tasklet_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(CN_INT_TASKLET_ENTRY, f, buf, count, off);
}

static ssize_t fs_devrw_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(CN_FS_DEVRW, f, buf, count, off);
}

static ssize_t mem_swapout_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(CN_MEM_SWAPOUT, f, buf, count, off);
}

static ssize_t timeradd_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(CN_TIMERADD, f, buf, count, off);
}

static ssize_t scsi_dispatch_cmd_entry(struct file *f,
		const char __user *buf, size_t count, loff_t *off)
{
	return do_register_entry(CN_SCSI_DISPATCH_CMD, f, buf, count, off);
}

static ssize_t ide_core_cp_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(CN_IDE_CORE_CP, f, buf, count, off);
}

/* Special entry to just crash directly. Available without KPROBEs */
static ssize_t direct_entry(struct file *f, const char __user *user_buf,
		size_t count, loff_t *off)
{
	enum ctype type;
	char *buf;

	if (count >= PAGE_SIZE)
		return -EINVAL;
	if (count < 1)
		return -EINVAL;

	buf = (char *)__get_free_page(GFP_KERNEL);
	if (!buf)
		return -ENOMEM;
	if (copy_from_user(buf, user_buf, count)) {
		free_page((unsigned long) buf);
		return -EFAULT;
	}
	/* NULL-terminate and remove enter */
	buf[count] = '\0';
	strim(buf);

	type = parse_cp_type(buf, count);
	free_page((unsigned long) buf);
	if (type == CT_NONE)
		return -EINVAL;

	printk(KERN_INFO "lkdtm: Performing direct entry %s\n",
			cp_type_to_str(type));
	lkdtm_do_action(type);
	*off += count;

	return count;
}

struct crash_entry {
	const char *name;
	const struct file_operations fops;
};

static const struct crash_entry crash_entries[] = {
	{"DIRECT", {.read = lkdtm_debugfs_read,
			.llseek = generic_file_llseek,
			.open = lkdtm_debugfs_open,
			.write = direct_entry} },
	{"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read,
			.llseek = generic_file_llseek,
			.open = lkdtm_debugfs_open,
			.write = int_hardware_entry} },
	{"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read,
			.llseek = generic_file_llseek,
			.open = lkdtm_debugfs_open,
			.write = int_hw_irq_en} },
	{"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read,
			.llseek = generic_file_llseek,
			.open = lkdtm_debugfs_open,
			.write = int_tasklet_entry} },
	{"FS_DEVRW", {.read = lkdtm_debugfs_read,
			.llseek = generic_file_llseek,
			.open = lkdtm_debugfs_open,
			.write = fs_devrw_entry} },
	{"MEM_SWAPOUT", {.read = lkdtm_debugfs_read,
			.llseek = generic_file_llseek,
			.open = lkdtm_debugfs_open,
			.write = mem_swapout_entry} },
	{"TIMERADD", {.read = lkdtm_debugfs_read,
			.llseek = generic_file_llseek,
			.open = lkdtm_debugfs_open,
			.write = timeradd_entry} },
	{"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read,
			.llseek = generic_file_llseek,
			.open = lkdtm_debugfs_open,
			.write = scsi_dispatch_cmd_entry} },
	{"IDE_CORE_CP",	{.read = lkdtm_debugfs_read,
			.llseek = generic_file_llseek,
			.open = lkdtm_debugfs_open,
			.write = ide_core_cp_entry} },
};

static struct dentry *lkdtm_debugfs_root;

static int __init lkdtm_module_init(void)
{
	int ret = -EINVAL;
	int n_debugfs_entries = 1; /* Assume only the direct entry */
	int i;

	/* Register debugfs interface */
	lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
	if (!lkdtm_debugfs_root) {
		printk(KERN_ERR "lkdtm: creating root dir failed\n");
		return -ENODEV;
	}

#ifdef CONFIG_KPROBES
	n_debugfs_entries = ARRAY_SIZE(crash_entries);
#endif

	for (i = 0; i < n_debugfs_entries; i++) {
		const struct crash_entry *cur = &crash_entries[i];
		struct dentry *de;

		de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
				NULL, &cur->fops);
		if (de == NULL) {
			printk(KERN_ERR "lkdtm: could not create %s\n",
					cur->name);
			goto out_err;
		}
	}

	if (lkdtm_parse_commandline() == -EINVAL) {
		printk(KERN_INFO "lkdtm: Invalid command\n");
		goto out_err;
	}

	if (cpoint != CN_INVALID && cptype != CT_NONE) {
		ret = lkdtm_register_cpoint(cpoint);
		if (ret < 0) {
			printk(KERN_INFO "lkdtm: Invalid crash point %d\n",
					cpoint);
			goto out_err;
		}
		printk(KERN_INFO "lkdtm: Crash point %s of type %s registered\n",
				cpoint_name, cpoint_type);
	} else {
		printk(KERN_INFO "lkdtm: No crash points registered, enable through debugfs\n");
	}

	return 0;

out_err:
	debugfs_remove_recursive(lkdtm_debugfs_root);
	return ret;
}

static void __exit lkdtm_module_exit(void)
{
	debugfs_remove_recursive(lkdtm_debugfs_root);

	unregister_jprobe(&lkdtm);
	printk(KERN_INFO "lkdtm: Crash point unregistered\n");
}

module_init(lkdtm_module_init);
module_exit(lkdtm_module_exit);

MODULE_LICENSE("GPL");
Commit	Line	Data
8bb31b9d AG	1	/*
	2	* Kprobe module for testing crash dumps
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License as published by
	6	* the Free Software Foundation; either version 2 of the License, or
	7	* (at your option) any later version.
	8	*
	9	* This program is distributed in the hope that it will be useful,
	10	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	11	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	12	* GNU General Public License for more details.
	13	*
	14	* You should have received a copy of the GNU General Public License
	15	* along with this program; if not, write to the Free Software
	16	* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
	17	*
	18	* Copyright (C) IBM Corporation, 2006
	19	*
	20	* Author: Ankita Garg <ankita@in.ibm.com>
	21	*
	22	* This module induces system failures at predefined crashpoints to
	23	* evaluate the reliability of crash dumps obtained using different dumping
	24	* solutions.
	25	*
	26	* It is adapted from the Linux Kernel Dump Test Tool by
	27	* Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
	28	*
0347af4e	29	* Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
8bb31b9d	30	*
0347af4e	31	* See Documentation/fault-injection/provoke-crashes.txt for instructions
8bb31b9d AG	32	*/
	33
	34	#include <linux/kernel.h>
5d861d92	35	#include <linux/fs.h>
8bb31b9d	36	#include <linux/module.h>
5d861d92	37	#include <linux/buffer_head.h>
8bb31b9d	38	#include <linux/kprobes.h>
5d861d92	39	#include <linux/list.h>
8bb31b9d	40	#include <linux/init.h>
8bb31b9d	41	#include <linux/interrupt.h>
5d861d92	42	#include <linux/hrtimer.h>
5a0e3ad6	43	#include <linux/slab.h>
8bb31b9d	44	#include <scsi/scsi_cmnd.h>
0347af4e	45	#include <linux/debugfs.h>
8bb31b9d AG	46
	47	#ifdef CONFIG_IDE
	48	#include <linux/ide.h>
	49	#endif
	50
8bb31b9d AG	51	#define DEFAULT_COUNT 10
	52	#define REC_NUM_DEFAULT 10
	53
	54	enum cname {
93e2f585 NK	55	CN_INVALID,
	56	CN_INT_HARDWARE_ENTRY,
	57	CN_INT_HW_IRQ_EN,
	58	CN_INT_TASKLET_ENTRY,
	59	CN_FS_DEVRW,
	60	CN_MEM_SWAPOUT,
	61	CN_TIMERADD,
	62	CN_SCSI_DISPATCH_CMD,
	63	CN_IDE_CORE_CP,
	64	CN_DIRECT,
8bb31b9d AG	65	};
	66
	67	enum ctype {
93e2f585 NK	68	CT_NONE,
	69	CT_PANIC,
	70	CT_BUG,
	71	CT_EXCEPTION,
	72	CT_LOOP,
	73	CT_OVERFLOW,
	74	CT_CORRUPT_STACK,
	75	CT_UNALIGNED_LOAD_STORE_WRITE,
	76	CT_OVERWRITE_ALLOCATION,
	77	CT_WRITE_AFTER_FREE,
	78	CT_SOFTLOCKUP,
	79	CT_HARDLOCKUP,
	80	CT_HUNG_TASK,
8bb31b9d AG	81	};
	82
	83	static char* cp_name[] = {
	84	"INT_HARDWARE_ENTRY",
	85	"INT_HW_IRQ_EN",
	86	"INT_TASKLET_ENTRY",
	87	"FS_DEVRW",
	88	"MEM_SWAPOUT",
	89	"TIMERADD",
	90	"SCSI_DISPATCH_CMD",
0347af4e SK	91	"IDE_CORE_CP",
0347af4e SK	92	"DIRECT",
8bb31b9d AG	93	};
	94
	95	static char* cp_type[] = {
	96	"PANIC",
	97	"BUG",
	98	"EXCEPTION",
	99	"LOOP",
0347af4e SK	100	"OVERFLOW",
	101	"CORRUPT_STACK",
	102	"UNALIGNED_LOAD_STORE_WRITE",
	103	"OVERWRITE_ALLOCATION",
	104	"WRITE_AFTER_FREE",
a48223f9 FW	105	"SOFTLOCKUP",
	106	"HARDLOCKUP",
	107	"HUNG_TASK",
8bb31b9d AG	108	};
	109
	110	static struct jprobe lkdtm;
	111
	112	static int lkdtm_parse_commandline(void);
	113	static void lkdtm_handler(void);
	114
ec1c620b AV	115	static char* cpoint_name;
ec1c620b AV	116	static char* cpoint_type;
8bb31b9d AG	117	static int cpoint_count = DEFAULT_COUNT;
	118	static int recur_count = REC_NUM_DEFAULT;
	119
93e2f585 NK	120	static enum cname cpoint = CN_INVALID;
93e2f585 NK	121	static enum ctype cptype = CT_NONE;
8bb31b9d	122	static int count = DEFAULT_COUNT;
c9b0a302	123	static DEFINE_SPINLOCK(count_lock);
8bb31b9d AG	124
8bb31b9d AG	125	module_param(recur_count, int, 0644);
5d861d92 RD	126	MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
5d861d92 RD	127	"default is 10");
dca41306	128	module_param(cpoint_name, charp, 0444);
5d861d92	129	MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed");
dca41306	130	module_param(cpoint_type, charp, 0444);
5d861d92 RD	131	MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\
	132	"hitting the crash point");
	133	module_param(cpoint_count, int, 0644);
	134	MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\
	135	"crash point is to be hit to trigger action");
8bb31b9d	136
2118116e	137	static unsigned int jp_do_irq(unsigned int irq)
8bb31b9d AG	138	{
	139	lkdtm_handler();
	140	jprobe_return();
	141	return 0;
	142	}
	143
2118116e AB	144	static irqreturn_t jp_handle_irq_event(unsigned int irq,
2118116e AB	145	struct irqaction *action)
8bb31b9d AG	146	{
	147	lkdtm_handler();
	148	jprobe_return();
	149	return 0;
	150	}
	151
2118116e	152	static void jp_tasklet_action(struct softirq_action *a)
8bb31b9d AG	153	{
	154	lkdtm_handler();
	155	jprobe_return();
	156	}
	157
2118116e	158	static void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
8bb31b9d AG	159	{
	160	lkdtm_handler();
	161	jprobe_return();
	162	}
	163
	164	struct scan_control;
	165
2118116e AB	166	static unsigned long jp_shrink_inactive_list(unsigned long max_scan,
	167	struct zone *zone,
	168	struct scan_control *sc)
8bb31b9d AG	169	{
	170	lkdtm_handler();
	171	jprobe_return();
	172	return 0;
	173	}
	174
2118116e AB	175	static int jp_hrtimer_start(struct hrtimer *timer, ktime_t tim,
2118116e AB	176	const enum hrtimer_mode mode)
8bb31b9d AG	177	{
	178	lkdtm_handler();
	179	jprobe_return();
	180	return 0;
	181	}
	182
2118116e	183	static int jp_scsi_dispatch_cmd(struct scsi_cmnd *cmd)
8bb31b9d AG	184	{
	185	lkdtm_handler();
	186	jprobe_return();
	187	return 0;
	188	}
	189
	190	#ifdef CONFIG_IDE
	191	int jp_generic_ide_ioctl(ide_drive_t drive, struct file file,
	192	struct block_device *bdev, unsigned int cmd,
	193	unsigned long arg)
	194	{
	195	lkdtm_handler();
	196	jprobe_return();
	197	return 0;
	198	}
	199	#endif
	200
0347af4e SK	201	/* Return the crashpoint number or NONE if the name is invalid */
	202	static enum ctype parse_cp_type(const char *what, size_t count)
	203	{
	204	int i;
	205
	206	for (i = 0; i < ARRAY_SIZE(cp_type); i++) {
	207	if (!strcmp(what, cp_type[i]))
	208	return i + 1;
	209	}
	210
93e2f585	211	return CT_NONE;
0347af4e SK	212	}
	213
	214	static const char *cp_type_to_str(enum ctype type)
	215	{
93e2f585	216	if (type == CT_NONE \|\| type < 0 \|\| type > ARRAY_SIZE(cp_type))
0347af4e SK	217	return "None";
	218
	219	return cp_type[type - 1];
	220	}
	221
	222	static const char *cp_name_to_str(enum cname name)
	223	{
93e2f585	224	if (name == CN_INVALID \|\| name < 0 \|\| name > ARRAY_SIZE(cp_name))
0347af4e SK	225	return "INVALID";
	226
	227	return cp_name[name - 1];
	228	}
	229
	230
8bb31b9d AG	231	static int lkdtm_parse_commandline(void)
	232	{
	233	int i;
c9b0a302	234	unsigned long flags;
8bb31b9d	235
0347af4e	236	if (cpoint_count < 1 \|\| recur_count < 1)
8bb31b9d AG	237	return -EINVAL;
8bb31b9d AG	238
c9b0a302	239	spin_lock_irqsave(&count_lock, flags);
0347af4e	240	count = cpoint_count;
c9b0a302	241	spin_unlock_irqrestore(&count_lock, flags);
0347af4e SK	242
	243	/* No special parameters */
	244	if (!cpoint_type && !cpoint_name)
	245	return 0;
	246
	247	/* Neither or both of these need to be set */
	248	if (!cpoint_type \|\| !cpoint_name)
	249	return -EINVAL;
	250
	251	cptype = parse_cp_type(cpoint_type, strlen(cpoint_type));
93e2f585	252	if (cptype == CT_NONE)
0347af4e SK	253	return -EINVAL;
	254
	255	for (i = 0; i < ARRAY_SIZE(cp_name); i++) {
8bb31b9d AG	256	if (!strcmp(cpoint_name, cp_name[i])) {
8bb31b9d AG	257	cpoint = i + 1;
0347af4e	258	return 0;
8bb31b9d AG	259	}
	260	}
	261
0347af4e SK	262	/* Could not find a valid crash point */
0347af4e SK	263	return -EINVAL;
8bb31b9d AG	264	}
	265
	266	static int recursive_loop(int a)
	267	{
	268	char buf[1024];
	269
	270	memset(buf,0xFF,1024);
	271	recur_count--;
	272	if (!recur_count)
	273	return 0;
	274	else
	275	return recursive_loop(a);
	276	}
	277
0347af4e	278	static void lkdtm_do_action(enum ctype which)
8bb31b9d	279	{
0347af4e	280	switch (which) {
93e2f585	281	case CT_PANIC:
0347af4e SK	282	panic("dumptest");
0347af4e SK	283	break;
93e2f585	284	case CT_BUG:
0347af4e SK	285	BUG();
0347af4e SK	286	break;
93e2f585	287	case CT_EXCEPTION:
0347af4e SK	288	((int ) 0) = 0;
0347af4e SK	289	break;
93e2f585	290	case CT_LOOP:
0347af4e SK	291	for (;;)
	292	;
	293	break;
93e2f585	294	case CT_OVERFLOW:
0347af4e SK	295	(void) recursive_loop(0);
0347af4e SK	296	break;
93e2f585	297	case CT_CORRUPT_STACK: {
0347af4e SK	298	volatile u32 data[8];
	299	volatile u32 *p = data;
	300
	301	p[12] = 0x12345678;
	302	break;
	303	}
93e2f585	304	case CT_UNALIGNED_LOAD_STORE_WRITE: {
0347af4e SK	305	static u8 data[5] __attribute__((aligned(4))) = {1, 2,
	306	3, 4, 5};
	307	u32 *p;
	308	u32 val = 0x12345678;
	309
	310	p = (u32 *)(data + 1);
	311	if (*p == 0)
	312	val = 0x87654321;
	313	*p = val;
	314	break;
	315	}
93e2f585	316	case CT_OVERWRITE_ALLOCATION: {
0347af4e SK	317	size_t len = 1020;
	318	u32 *data = kmalloc(len, GFP_KERNEL);
	319
	320	data[1024 / sizeof(u32)] = 0x12345678;
	321	kfree(data);
	322	break;
	323	}
93e2f585	324	case CT_WRITE_AFTER_FREE: {
0347af4e SK	325	size_t len = 1024;
	326	u32 *data = kmalloc(len, GFP_KERNEL);
	327
	328	kfree(data);
	329	schedule();
	330	memset(data, 0x78, len);
	331	break;
	332	}
93e2f585	333	case CT_SOFTLOCKUP:
a48223f9 FW	334	preempt_disable();
	335	for (;;)
	336	cpu_relax();
	337	break;
93e2f585	338	case CT_HARDLOCKUP:
a48223f9 FW	339	local_irq_disable();
	340	for (;;)
	341	cpu_relax();
	342	break;
93e2f585	343	case CT_HUNG_TASK:
a48223f9 FW	344	set_current_state(TASK_UNINTERRUPTIBLE);
	345	schedule();
	346	break;
93e2f585	347	case CT_NONE:
0347af4e SK	348	default:
	349	break;
	350	}
	351
	352	}
	353
	354	static void lkdtm_handler(void)
	355	{
c9b0a302 JH	356	unsigned long flags;
	357
	358	spin_lock_irqsave(&count_lock, flags);
0347af4e SK	359	count--;
	360	printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
	361	cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
8bb31b9d AG	362
8bb31b9d AG	363	if (count == 0) {
0347af4e	364	lkdtm_do_action(cptype);
8bb31b9d AG	365	count = cpoint_count;
8bb31b9d AG	366	}
c9b0a302	367	spin_unlock_irqrestore(&count_lock, flags);
8bb31b9d AG	368	}
8bb31b9d AG	369
0347af4e	370	static int lkdtm_register_cpoint(enum cname which)
8bb31b9d AG	371	{
	372	int ret;
	373
93e2f585	374	cpoint = CN_INVALID;
0347af4e SK	375	if (lkdtm.entry != NULL)
0347af4e SK	376	unregister_jprobe(&lkdtm);
8bb31b9d	377
0347af4e	378	switch (which) {
93e2f585	379	case CN_DIRECT:
0347af4e SK	380	lkdtm_do_action(cptype);
0347af4e SK	381	return 0;
93e2f585	382	case CN_INT_HARDWARE_ENTRY:
f58f2fa9	383	lkdtm.kp.symbol_name = "do_IRQ";
8bb31b9d AG	384	lkdtm.entry = (kprobe_opcode_t*) jp_do_irq;
8bb31b9d AG	385	break;
93e2f585	386	case CN_INT_HW_IRQ_EN:
8bb31b9d AG	387	lkdtm.kp.symbol_name = "handle_IRQ_event";
	388	lkdtm.entry = (kprobe_opcode_t*) jp_handle_irq_event;
	389	break;
93e2f585	390	case CN_INT_TASKLET_ENTRY:
8bb31b9d AG	391	lkdtm.kp.symbol_name = "tasklet_action";
	392	lkdtm.entry = (kprobe_opcode_t*) jp_tasklet_action;
	393	break;
93e2f585	394	case CN_FS_DEVRW:
8bb31b9d AG	395	lkdtm.kp.symbol_name = "ll_rw_block";
	396	lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block;
	397	break;
93e2f585	398	case CN_MEM_SWAPOUT:
18a61e4a AG	399	lkdtm.kp.symbol_name = "shrink_inactive_list";
18a61e4a AG	400	lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list;
8bb31b9d	401	break;
93e2f585	402	case CN_TIMERADD:
8bb31b9d AG	403	lkdtm.kp.symbol_name = "hrtimer_start";
	404	lkdtm.entry = (kprobe_opcode_t*) jp_hrtimer_start;
	405	break;
93e2f585	406	case CN_SCSI_DISPATCH_CMD:
8bb31b9d AG	407	lkdtm.kp.symbol_name = "scsi_dispatch_cmd";
	408	lkdtm.entry = (kprobe_opcode_t*) jp_scsi_dispatch_cmd;
	409	break;
93e2f585	410	case CN_IDE_CORE_CP:
8bb31b9d AG	411	#ifdef CONFIG_IDE
	412	lkdtm.kp.symbol_name = "generic_ide_ioctl";
	413	lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl;
	414	#else
0347af4e SK	415	printk(KERN_INFO "lkdtm: Crash point not available\n");
0347af4e SK	416	return -EINVAL;
8bb31b9d AG	417	#endif
	418	break;
	419	default:
0347af4e SK	420	printk(KERN_INFO "lkdtm: Invalid Crash Point\n");
0347af4e SK	421	return -EINVAL;
8bb31b9d AG	422	}
8bb31b9d AG	423
0347af4e	424	cpoint = which;
8bb31b9d	425	if ((ret = register_jprobe(&lkdtm)) < 0) {
0347af4e	426	printk(KERN_INFO "lkdtm: Couldn't register jprobe\n");
93e2f585	427	cpoint = CN_INVALID;
0347af4e SK	428	}
	429
	430	return ret;
	431	}
	432
	433	static ssize_t do_register_entry(enum cname which, struct file *f,
	434	const char __user user_buf, size_t count, loff_t off)
	435	{
	436	char *buf;
	437	int err;
	438
	439	if (count >= PAGE_SIZE)
	440	return -EINVAL;
	441
	442	buf = (char *)__get_free_page(GFP_KERNEL);
	443	if (!buf)
	444	return -ENOMEM;
	445	if (copy_from_user(buf, user_buf, count)) {
	446	free_page((unsigned long) buf);
	447	return -EFAULT;
	448	}
	449	/* NULL-terminate and remove enter */
	450	buf[count] = '\0';
	451	strim(buf);
	452
	453	cptype = parse_cp_type(buf, count);
	454	free_page((unsigned long) buf);
	455
93e2f585	456	if (cptype == CT_NONE)
0347af4e SK	457	return -EINVAL;
	458
	459	err = lkdtm_register_cpoint(which);
	460	if (err < 0)
	461	return err;
	462
	463	*off += count;
	464
	465	return count;
	466	}
	467
	468	/* Generic read callback that just prints out the available crash types */
	469	static ssize_t lkdtm_debugfs_read(struct file f, char __user user_buf,
	470	size_t count, loff_t *off)
	471	{
	472	char *buf;
	473	int i, n, out;
	474
	475	buf = (char *)__get_free_page(GFP_KERNEL);
	476
	477	n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
	478	for (i = 0; i < ARRAY_SIZE(cp_type); i++)
	479	n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]);
	480	buf[n] = '\0';
	481
	482	out = simple_read_from_buffer(user_buf, count, off,
	483	buf, n);
	484	free_page((unsigned long) buf);
	485
	486	return out;
	487	}
	488
	489	static int lkdtm_debugfs_open(struct inode inode, struct file file)
	490	{
	491	return 0;
	492	}
	493
	494
	495	static ssize_t int_hardware_entry(struct file f, const char __user buf,
	496	size_t count, loff_t *off)
	497	{
93e2f585	498	return do_register_entry(CN_INT_HARDWARE_ENTRY, f, buf, count, off);
0347af4e SK	499	}
	500
	501	static ssize_t int_hw_irq_en(struct file f, const char __user buf,
	502	size_t count, loff_t *off)
	503	{
93e2f585	504	return do_register_entry(CN_INT_HW_IRQ_EN, f, buf, count, off);
0347af4e SK	505	}
	506
	507	static ssize_t int_tasklet_entry(struct file f, const char __user buf,
	508	size_t count, loff_t *off)
	509	{
93e2f585	510	return do_register_entry(CN_INT_TASKLET_ENTRY, f, buf, count, off);
0347af4e SK	511	}
	512
	513	static ssize_t fs_devrw_entry(struct file f, const char __user buf,
	514	size_t count, loff_t *off)
	515	{
93e2f585	516	return do_register_entry(CN_FS_DEVRW, f, buf, count, off);
0347af4e SK	517	}
	518
	519	static ssize_t mem_swapout_entry(struct file f, const char __user buf,
	520	size_t count, loff_t *off)
	521	{
93e2f585	522	return do_register_entry(CN_MEM_SWAPOUT, f, buf, count, off);
0347af4e SK	523	}
	524
	525	static ssize_t timeradd_entry(struct file f, const char __user buf,
	526	size_t count, loff_t *off)
	527	{
93e2f585	528	return do_register_entry(CN_TIMERADD, f, buf, count, off);
0347af4e SK	529	}
	530
	531	static ssize_t scsi_dispatch_cmd_entry(struct file *f,
	532	const char __user buf, size_t count, loff_t off)
	533	{
93e2f585	534	return do_register_entry(CN_SCSI_DISPATCH_CMD, f, buf, count, off);
0347af4e SK	535	}
	536
	537	static ssize_t ide_core_cp_entry(struct file f, const char __user buf,
	538	size_t count, loff_t *off)
	539	{
93e2f585	540	return do_register_entry(CN_IDE_CORE_CP, f, buf, count, off);
0347af4e SK	541	}
	542
	543	/* Special entry to just crash directly. Available without KPROBEs */
	544	static ssize_t direct_entry(struct file f, const char __user user_buf,
	545	size_t count, loff_t *off)
	546	{
	547	enum ctype type;
	548	char *buf;
	549
	550	if (count >= PAGE_SIZE)
	551	return -EINVAL;
	552	if (count < 1)
	553	return -EINVAL;
	554
	555	buf = (char *)__get_free_page(GFP_KERNEL);
	556	if (!buf)
	557	return -ENOMEM;
	558	if (copy_from_user(buf, user_buf, count)) {
	559	free_page((unsigned long) buf);
	560	return -EFAULT;
	561	}
	562	/* NULL-terminate and remove enter */
	563	buf[count] = '\0';
	564	strim(buf);
	565
	566	type = parse_cp_type(buf, count);
	567	free_page((unsigned long) buf);
93e2f585	568	if (type == CT_NONE)
0347af4e SK	569	return -EINVAL;
	570
	571	printk(KERN_INFO "lkdtm: Performing direct entry %s\n",
	572	cp_type_to_str(type));
	573	lkdtm_do_action(type);
	574	*off += count;
	575
	576	return count;
	577	}
	578
	579	struct crash_entry {
	580	const char *name;
	581	const struct file_operations fops;
	582	};
	583
	584	static const struct crash_entry crash_entries[] = {
	585	{"DIRECT", {.read = lkdtm_debugfs_read,
05271ec4	586	.llseek = generic_file_llseek,
0347af4e SK	587	.open = lkdtm_debugfs_open,
	588	.write = direct_entry} },
	589	{"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read,
05271ec4	590	.llseek = generic_file_llseek,
0347af4e SK	591	.open = lkdtm_debugfs_open,
	592	.write = int_hardware_entry} },
	593	{"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read,
05271ec4	594	.llseek = generic_file_llseek,
0347af4e SK	595	.open = lkdtm_debugfs_open,
	596	.write = int_hw_irq_en} },
	597	{"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read,
05271ec4	598	.llseek = generic_file_llseek,
0347af4e SK	599	.open = lkdtm_debugfs_open,
	600	.write = int_tasklet_entry} },
	601	{"FS_DEVRW", {.read = lkdtm_debugfs_read,
05271ec4	602	.llseek = generic_file_llseek,
0347af4e SK	603	.open = lkdtm_debugfs_open,
	604	.write = fs_devrw_entry} },
	605	{"MEM_SWAPOUT", {.read = lkdtm_debugfs_read,
05271ec4	606	.llseek = generic_file_llseek,
0347af4e SK	607	.open = lkdtm_debugfs_open,
	608	.write = mem_swapout_entry} },
	609	{"TIMERADD", {.read = lkdtm_debugfs_read,
05271ec4	610	.llseek = generic_file_llseek,
0347af4e SK	611	.open = lkdtm_debugfs_open,
	612	.write = timeradd_entry} },
	613	{"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read,
05271ec4	614	.llseek = generic_file_llseek,
0347af4e SK	615	.open = lkdtm_debugfs_open,
	616	.write = scsi_dispatch_cmd_entry} },
	617	{"IDE_CORE_CP", {.read = lkdtm_debugfs_read,
05271ec4	618	.llseek = generic_file_llseek,
0347af4e SK	619	.open = lkdtm_debugfs_open,
	620	.write = ide_core_cp_entry} },
	621	};
	622
	623	static struct dentry *lkdtm_debugfs_root;
	624
	625	static int __init lkdtm_module_init(void)
	626	{
	627	int ret = -EINVAL;
	628	int n_debugfs_entries = 1; /* Assume only the direct entry */
	629	int i;
	630
	631	/* Register debugfs interface */
	632	lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
	633	if (!lkdtm_debugfs_root) {
	634	printk(KERN_ERR "lkdtm: creating root dir failed\n");
	635	return -ENODEV;
	636	}
	637
	638	#ifdef CONFIG_KPROBES
	639	n_debugfs_entries = ARRAY_SIZE(crash_entries);
	640	#endif
	641
	642	for (i = 0; i < n_debugfs_entries; i++) {
	643	const struct crash_entry *cur = &crash_entries[i];
	644	struct dentry *de;
	645
	646	de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
	647	NULL, &cur->fops);
	648	if (de == NULL) {
	649	printk(KERN_ERR "lkdtm: could not create %s\n",
	650	cur->name);
	651	goto out_err;
	652	}
	653	}
	654
	655	if (lkdtm_parse_commandline() == -EINVAL) {
	656	printk(KERN_INFO "lkdtm: Invalid command\n");
	657	goto out_err;
	658	}
	659
93e2f585	660	if (cpoint != CN_INVALID && cptype != CT_NONE) {
0347af4e SK	661	ret = lkdtm_register_cpoint(cpoint);
	662	if (ret < 0) {
	663	printk(KERN_INFO "lkdtm: Invalid crash point %d\n",
	664	cpoint);
	665	goto out_err;
	666	}
	667	printk(KERN_INFO "lkdtm: Crash point %s of type %s registered\n",
	668	cpoint_name, cpoint_type);
	669	} else {
	670	printk(KERN_INFO "lkdtm: No crash points registered, enable through debugfs\n");
8bb31b9d AG	671	}
8bb31b9d AG	672
8bb31b9d	673	return 0;
0347af4e SK	674
	675	out_err:
	676	debugfs_remove_recursive(lkdtm_debugfs_root);
	677	return ret;
8bb31b9d AG	678	}
8bb31b9d AG	679
2118116e	680	static void __exit lkdtm_module_exit(void)
8bb31b9d	681	{
0347af4e SK	682	debugfs_remove_recursive(lkdtm_debugfs_root);
	683
	684	unregister_jprobe(&lkdtm);
	685	printk(KERN_INFO "lkdtm: Crash point unregistered\n");
8bb31b9d AG	686	}
	687
	688	module_init(lkdtm_module_init);
	689	module_exit(lkdtm_module_exit);
	690
	691	MODULE_LICENSE("GPL");