src/patches/suse-2.6.27.39/patches.suse/crasher-26.diff

   1 From: Chris Mason <mason@suse.com>
   2 Subject: slab testing module
   3
   4 ---
   5  drivers/char/Kconfig   |    5 +
   6  drivers/char/Makefile  |    1
   7  drivers/char/crasher.c |  225 +++++++++++++++++++++++++++++++++++++++++++++++++
   8  3 files changed, 231 insertions(+)
   9
  10 --- a/drivers/char/Kconfig
  11 +++ b/drivers/char/Kconfig
  12 @@ -1104,5 +1104,10 @@ config DEVPORT
  13
  14  source "drivers/s390/char/Kconfig"
  15
  16 +config CRASHER
  17 +       tristate "Crasher Module"
  18 +       help
  19 +         Slab cache memory tester.  Only use this as a module
  20 +
  21  endmenu
  22
  23 --- a/drivers/char/Makefile
  24 +++ b/drivers/char/Makefile
  25 @@ -105,6 +105,7 @@ obj-$(CONFIG_IPMI_HANDLER)  += ipmi/
  26
  27  obj-$(CONFIG_HANGCHECK_TIMER)  += hangcheck-timer.o
  28  obj-$(CONFIG_TCG_TPM)          += tpm/
  29 +obj-$(CONFIG_CRASHER)          += crasher.o
  30
  31  obj-$(CONFIG_PS3_FLASH)                += ps3flash.o
  32
  33 --- /dev/null
  34 +++ b/drivers/char/crasher.c
  35 @@ -0,0 +1,225 @@
  36 +/*
  37 + * crasher.c, it breaks things
  38 + */
  39 +
  40 +
  41 +#include <linux/module.h>
  42 +#include <linux/types.h>
  43 +#include <linux/kernel.h>
  44 +#include <linux/init.h>
  45 +#include <linux/slab.h>
  46 +#include <linux/completion.h>
  47 +#include <linux/jiffies.h>
  48 +#include <linux/sched.h>
  49 +#include <linux/moduleparam.h>
  50 +
  51 +static int module_exiting;
  52 +static struct completion startup = COMPLETION_INITIALIZER(startup);
  53 +static unsigned long rand_seed = 152L;
  54 +static unsigned long seed = 152L;
  55 +static int threads = 1;
  56 +static int call_panic;
  57 +static int call_bug;
  58 +static int trap_null, call_null, jump_null;
  59 +static long trap_read, trap_write, call_bad, jump_bad;
  60 +
  61 +module_param(seed, ulong, 0);
  62 +module_param(call_panic, bool, 0);
  63 +module_param(call_bug, bool, 0);
  64 +module_param(trap_null, bool, 0);
  65 +module_param(trap_read, long, 0);
  66 +module_param(trap_write, long, 0);
  67 +module_param(call_null, bool, 0);
  68 +module_param(call_bad, long, 0);
  69 +module_param(jump_null, bool, 0);
  70 +module_param(jump_bad, long, 0);
  71 +module_param(threads, int, 0);
  72 +MODULE_PARM_DESC(seed, "random seed for memory tests");
  73 +MODULE_PARM_DESC(call_panic, "test option. call panic() and render the system unusable.");
  74 +MODULE_PARM_DESC(call_bug, "test option. call BUG() and render the system unusable.");
  75 +MODULE_PARM_DESC(trap_null, "test option. dereference a NULL pointer to simulate a crash and render the system unusable.");
  76 +MODULE_PARM_DESC(trap_read, "test option. read from an invalid address to simulate a crash and render the system unusable.");
  77 +MODULE_PARM_DESC(trap_write, "test option. write to an invalid address to simulate a crash and render the system unusable.");
  78 +MODULE_PARM_DESC(call_null, "test option. call a NULL pointer to simulate a crash and render the system unusable.");
  79 +MODULE_PARM_DESC(call_bad, "test option. call an invalid address to simulate a crash and render the system unusable.");
  80 +MODULE_PARM_DESC(jump_null, "test option. jump to a NULL pointer to simulate a crash and render the system unusable.");
  81 +MODULE_PARM_DESC(jump_bad, "test option. jump to an invalid address to simulate a crash and render the system unusable.");
  82 +MODULE_PARM_DESC(threads, "number of threads to run");
  83 +MODULE_LICENSE("GPL");
  84 +
  85 +#define NUM_ALLOC 24
  86 +#define NUM_SIZES 8
  87 +static int sizes[]  = { 32, 64, 128, 192, 256, 1024, 2048, 4096 };
  88 +
  89 +struct mem_buf {
  90 +    char *buf;
  91 +    int size;
  92 +};
  93 +
  94 +static unsigned long crasher_random(void)
  95 +{
  96 +        rand_seed = rand_seed*69069L+1;
  97 +        return rand_seed^jiffies;
  98 +}
  99 +
 100 +void crasher_srandom(unsigned long entropy)
 101 +{
 102 +        rand_seed ^= entropy;
 103 +        crasher_random();
 104 +}
 105 +
 106 +static char *mem_alloc(int size) {
 107 +       char *p = kmalloc(size, GFP_KERNEL);
 108 +       int i;
 109 +       if (!p)
 110 +               return p;
 111 +       for (i = 0 ; i < size; i++)
 112 +               p[i] = (i % 119) + 8;
 113 +       return p;
 114 +}
 115 +
 116 +static void mem_check(char *p, int size) {
 117 +       int i;
 118 +       if (!p)
 119 +               return;
 120 +       for (i = 0 ; i < size; i++) {
 121 +               if (p[i] != ((i % 119) + 8)) {
 122 +                       printk(KERN_CRIT "verify error at %lX offset %d "
 123 +                              " wanted %d found %d size %d\n",
 124 +                              (unsigned long)(p + i), i, (i % 119) + 8,
 125 +                              p[i], size);
 126 +               }
 127 +       }
 128 +       // try and trigger slab poisoning for people using this buffer
 129 +       // wrong
 130 +       memset(p, 0, size);
 131 +}
 132 +
 133 +static void mem_verify(void) {
 134 +       struct mem_buf bufs[NUM_ALLOC];
 135 +       struct mem_buf *b;
 136 +       int index;
 137 +       int size;
 138 +       unsigned long sleep;
 139 +       memset(bufs, 0, sizeof(struct mem_buf) * NUM_ALLOC);
 140 +       while(!module_exiting) {
 141 +               index = crasher_random() % NUM_ALLOC;
 142 +               b = bufs + index;
 143 +               if (b->size) {
 144 +                       mem_check(b->buf, b->size);
 145 +                       kfree(b->buf);
 146 +                       b->buf = NULL;
 147 +                       b->size = 0;
 148 +               } else {
 149 +                       size = crasher_random() % NUM_SIZES;
 150 +                       size = sizes[size];
 151 +                       b->buf = mem_alloc(size);
 152 +                       b->size = size;
 153 +               }
 154 +               sleep = crasher_random() % (HZ / 10);
 155 +               set_current_state(TASK_INTERRUPTIBLE);
 156 +               schedule_timeout(sleep);
 157 +               set_current_state(TASK_RUNNING);
 158 +       }
 159 +       for (index = 0 ; index < NUM_ALLOC ; index++) {
 160 +               b = bufs + index;
 161 +               if (b->size) {
 162 +                       mem_check(b->buf, b->size);
 163 +                       kfree(b->buf);
 164 +               }
 165 +       }
 166 +}
 167 +
 168 +static int crasher_thread(void *unused)
 169 +{
 170 +       daemonize("crasher");
 171 +       complete(&startup);
 172 +       mem_verify();
 173 +       complete(&startup);
 174 +       return 0;
 175 +}
 176 +
 177 +static int __init crasher_init(void)
 178 +{
 179 +       int i;
 180 +       init_completion(&startup);
 181 +       crasher_srandom(seed);
 182 +
 183 +       if (call_panic) {
 184 +               panic("test panic from crasher module. Good Luck.\n");
 185 +               return -EFAULT;
 186 +       }
 187 +       if (call_bug) {
 188 +               printk("triggering BUG\n");
 189 +               BUG_ON(1);
 190 +               return -EFAULT;
 191 +       }
 192 +
 193 +       if (trap_null) {
 194 +               volatile char *p = NULL;
 195 +               printk("dereferencing NULL pointer.\n");
 196 +               p[0] = '\n';
 197 +               return -EFAULT;
 198 +       }
 199 +       if (trap_read) {
 200 +               const volatile char *p = (char *)trap_read;
 201 +               printk("reading from invalid(?) address %p.\n", p);
 202 +               return p[0] ? -EFAULT : -EACCES;
 203 +       }
 204 +       if (trap_write) {
 205 +               volatile char *p = (char *)trap_write;
 206 +               printk("writing to invalid(?) address %p.\n", p);
 207 +               p[0] = ' ';
 208 +               return -EFAULT;
 209 +       }
 210 +
 211 +       if (call_null) {
 212 +               void(*f)(void) = NULL;
 213 +               printk("calling NULL pointer.\n");
 214 +               f();
 215 +               return -EFAULT;
 216 +       }
 217 +       if (call_bad) {
 218 +               void(*f)(void) = (void(*)(void))call_bad;
 219 +               printk("calling invalid(?) address %p.\n", f);
 220 +               f();
 221 +               return -EFAULT;
 222 +       }
 223 +
 224 +       /* These two depend on the compiler doing tail call optimization. */
 225 +       if (jump_null) {
 226 +               int(*f)(void) = NULL;
 227 +               printk("jumping to NULL.\n");
 228 +               return f();
 229 +       }
 230 +       if (jump_bad) {
 231 +               int(*f)(void) = (int(*)(void))jump_bad;
 232 +               printk("jumping to invalid(?) address %p.\n", f);
 233 +               return f();
 234 +       }
 235 +
 236 +       printk("crasher module (%d threads).  Testing sizes: ", threads);
 237 +       for (i = 0 ; i < NUM_SIZES ; i++)
 238 +               printk("%d ", sizes[i]);
 239 +       printk("\n");
 240 +
 241 +       for (i = 0 ; i < threads ; i++)
 242 +               kernel_thread(crasher_thread, crasher_thread,
 243 +                             CLONE_FS | CLONE_FILES);
 244 +       for (i = 0 ; i < threads ; i++)
 245 +               wait_for_completion(&startup);
 246 +       return 0;
 247 +}
 248 +
 249 +static void __exit crasher_exit(void)
 250 +{
 251 +       int i;
 252 +       module_exiting = 1;
 253 +       for (i = 0 ; i < threads ; i++)
 254 +               wait_for_completion(&startup);
 255 +       printk("all crasher threads done\n");
 256 +       return;
 257 +}
 258 +
 259 +module_init(crasher_init);
 260 +module_exit(crasher_exit);