2 * Linux Kernel Dump Test Module for testing kernel crashes conditions:
3 * induces system failures at predefined crashpoints and under predefined
4 * operational conditions in order to evaluate the reliability of kernel
5 * sanity checking and crash dumps obtained using different dumping
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
22 * Copyright (C) IBM Corporation, 2006
24 * Author: Ankita Garg <ankita@in.ibm.com>
26 * It is adapted from the Linux Kernel Dump Test Tool by
27 * Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
29 * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
31 * See Documentation/fault-injection/provoke-crashes.txt for instructions
35 #include <linux/module.h>
36 #include <linux/buffer_head.h>
37 #include <linux/kprobes.h>
38 #include <linux/list.h>
39 #include <linux/init.h>
40 #include <linux/interrupt.h>
41 #include <linux/hrtimer.h>
42 #include <linux/slab.h>
43 #include <scsi/scsi_cmnd.h>
44 #include <linux/debugfs.h>
47 #include <linux/ide.h>
50 #define DEFAULT_COUNT 10
52 static int lkdtm_debugfs_open(struct inode
*inode
, struct file
*file
);
53 static ssize_t
lkdtm_debugfs_read(struct file
*f
, char __user
*user_buf
,
54 size_t count
, loff_t
*off
);
55 static ssize_t
direct_entry(struct file
*f
, const char __user
*user_buf
,
56 size_t count
, loff_t
*off
);
59 static void lkdtm_handler(void);
60 static ssize_t
lkdtm_debugfs_entry(struct file
*f
,
61 const char __user
*user_buf
,
62 size_t count
, loff_t
*off
);
65 /* jprobe entry point handlers. */
66 static unsigned int jp_do_irq(unsigned int irq
)
73 static irqreturn_t
jp_handle_irq_event(unsigned int irq
,
74 struct irqaction
*action
)
81 static void jp_tasklet_action(struct softirq_action
*a
)
87 static void jp_ll_rw_block(int rw
, int nr
, struct buffer_head
*bhs
[])
95 static unsigned long jp_shrink_inactive_list(unsigned long max_scan
,
97 struct scan_control
*sc
)
104 static int jp_hrtimer_start(struct hrtimer
*timer
, ktime_t tim
,
105 const enum hrtimer_mode mode
)
112 static int jp_scsi_dispatch_cmd(struct scsi_cmnd
*cmd
)
120 static int jp_generic_ide_ioctl(ide_drive_t
*drive
, struct file
*file
,
121 struct block_device
*bdev
, unsigned int cmd
,
134 const struct file_operations fops
;
135 struct jprobe jprobe
;
138 #define CRASHPOINT(_name, _write, _symbol, _entry) \
142 .read = lkdtm_debugfs_read, \
143 .llseek = generic_file_llseek, \
144 .open = lkdtm_debugfs_open, \
148 .kp.symbol_name = _symbol, \
149 .entry = (kprobe_opcode_t *)_entry, \
153 /* Define the possible places where we can trigger a crash point. */
154 struct crashpoint crashpoints
[] = {
155 CRASHPOINT("DIRECT", direct_entry
,
157 #ifdef CONFIG_KPROBES
158 CRASHPOINT("INT_HARDWARE_ENTRY", lkdtm_debugfs_entry
,
159 "do_IRQ", jp_do_irq
),
160 CRASHPOINT("INT_HW_IRQ_EN", lkdtm_debugfs_entry
,
161 "handle_IRQ_event", jp_handle_irq_event
),
162 CRASHPOINT("INT_TASKLET_ENTRY", lkdtm_debugfs_entry
,
163 "tasklet_action", jp_tasklet_action
),
164 CRASHPOINT("FS_DEVRW", lkdtm_debugfs_entry
,
165 "ll_rw_block", jp_ll_rw_block
),
166 CRASHPOINT("MEM_SWAPOUT", lkdtm_debugfs_entry
,
167 "shrink_inactive_list", jp_shrink_inactive_list
),
168 CRASHPOINT("TIMERADD", lkdtm_debugfs_entry
,
169 "hrtimer_start", jp_hrtimer_start
),
170 CRASHPOINT("SCSI_DISPATCH_CMD", lkdtm_debugfs_entry
,
171 "scsi_dispatch_cmd", jp_scsi_dispatch_cmd
),
173 CRASHPOINT("IDE_CORE_CP", lkdtm_debugfs_entry
,
174 "generic_ide_ioctl", jp_generic_ide_ioctl
),
186 #define CRASHTYPE(_name) \
188 .name = __stringify(_name), \
189 .func = lkdtm_ ## _name, \
192 /* Define the possible types of crashes that can be triggered. */
193 struct crashtype crashtypes
[] = {
197 CRASHTYPE(EXCEPTION
),
200 CRASHTYPE(CORRUPT_STACK
),
201 CRASHTYPE(UNALIGNED_LOAD_STORE_WRITE
),
202 CRASHTYPE(OVERWRITE_ALLOCATION
),
203 CRASHTYPE(WRITE_AFTER_FREE
),
204 CRASHTYPE(READ_AFTER_FREE
),
205 CRASHTYPE(WRITE_BUDDY_AFTER_FREE
),
206 CRASHTYPE(READ_BUDDY_AFTER_FREE
),
207 CRASHTYPE(SOFTLOCKUP
),
208 CRASHTYPE(HARDLOCKUP
),
209 CRASHTYPE(SPINLOCKUP
),
210 CRASHTYPE(HUNG_TASK
),
211 CRASHTYPE(EXEC_DATA
),
212 CRASHTYPE(EXEC_STACK
),
213 CRASHTYPE(EXEC_KMALLOC
),
214 CRASHTYPE(EXEC_VMALLOC
),
215 CRASHTYPE(EXEC_RODATA
),
216 CRASHTYPE(EXEC_USERSPACE
),
217 CRASHTYPE(ACCESS_USERSPACE
),
219 CRASHTYPE(WRITE_RO_AFTER_INIT
),
220 CRASHTYPE(WRITE_KERN
),
221 CRASHTYPE(ATOMIC_UNDERFLOW
),
222 CRASHTYPE(ATOMIC_OVERFLOW
),
223 CRASHTYPE(USERCOPY_HEAP_SIZE_TO
),
224 CRASHTYPE(USERCOPY_HEAP_SIZE_FROM
),
225 CRASHTYPE(USERCOPY_HEAP_FLAG_TO
),
226 CRASHTYPE(USERCOPY_HEAP_FLAG_FROM
),
227 CRASHTYPE(USERCOPY_STACK_FRAME_TO
),
228 CRASHTYPE(USERCOPY_STACK_FRAME_FROM
),
229 CRASHTYPE(USERCOPY_STACK_BEYOND
),
230 CRASHTYPE(USERCOPY_KERNEL
),
234 /* Global jprobe entry and crashtype. */
235 static struct jprobe
*lkdtm_jprobe
;
236 struct crashpoint
*lkdtm_crashpoint
;
237 struct crashtype
*lkdtm_crashtype
;
239 /* Module parameters */
240 static int recur_count
= -1;
241 module_param(recur_count
, int, 0644);
242 MODULE_PARM_DESC(recur_count
, " Recursion level for the stack overflow test");
244 static char* cpoint_name
;
245 module_param(cpoint_name
, charp
, 0444);
246 MODULE_PARM_DESC(cpoint_name
, " Crash Point, where kernel is to be crashed");
248 static char* cpoint_type
;
249 module_param(cpoint_type
, charp
, 0444);
250 MODULE_PARM_DESC(cpoint_type
, " Crash Point Type, action to be taken on "\
251 "hitting the crash point");
253 static int cpoint_count
= DEFAULT_COUNT
;
254 module_param(cpoint_count
, int, 0644);
255 MODULE_PARM_DESC(cpoint_count
, " Crash Point Count, number of times the "\
256 "crash point is to be hit to trigger action");
259 /* Return the crashtype number or NULL if the name is invalid */
260 static struct crashtype
*find_crashtype(const char *name
)
264 for (i
= 0; i
< ARRAY_SIZE(crashtypes
); i
++) {
265 if (!strcmp(name
, crashtypes
[i
].name
))
266 return &crashtypes
[i
];
273 * This is forced noinline just so it distinctly shows up in the stackdump
274 * which makes validation of expected lkdtm crashes easier.
276 static noinline
void lkdtm_do_action(struct crashtype
*crashtype
)
278 BUG_ON(!crashtype
|| !crashtype
->func
);
282 static int lkdtm_register_cpoint(struct crashpoint
*crashpoint
,
283 struct crashtype
*crashtype
)
287 /* If this doesn't have a symbol, just call immediately. */
288 if (!crashpoint
->jprobe
.kp
.symbol_name
) {
289 lkdtm_do_action(crashtype
);
293 if (lkdtm_jprobe
!= NULL
)
294 unregister_jprobe(lkdtm_jprobe
);
296 lkdtm_crashpoint
= crashpoint
;
297 lkdtm_crashtype
= crashtype
;
298 lkdtm_jprobe
= &crashpoint
->jprobe
;
299 ret
= register_jprobe(lkdtm_jprobe
);
301 pr_info("Couldn't register jprobe %s\n",
302 crashpoint
->jprobe
.kp
.symbol_name
);
304 lkdtm_crashpoint
= NULL
;
305 lkdtm_crashtype
= NULL
;
311 #ifdef CONFIG_KPROBES
312 /* Global crash counter and spinlock. */
313 static int crash_count
= DEFAULT_COUNT
;
314 static DEFINE_SPINLOCK(crash_count_lock
);
316 /* Called by jprobe entry points. */
317 static void lkdtm_handler(void)
322 BUG_ON(!lkdtm_crashpoint
|| !lkdtm_crashtype
);
324 spin_lock_irqsave(&crash_count_lock
, flags
);
326 pr_info("Crash point %s of type %s hit, trigger in %d rounds\n",
327 lkdtm_crashpoint
->name
, lkdtm_crashtype
->name
, crash_count
);
329 if (crash_count
== 0) {
331 crash_count
= cpoint_count
;
333 spin_unlock_irqrestore(&crash_count_lock
, flags
);
336 lkdtm_do_action(lkdtm_crashtype
);
339 static ssize_t
lkdtm_debugfs_entry(struct file
*f
,
340 const char __user
*user_buf
,
341 size_t count
, loff_t
*off
)
343 struct crashpoint
*crashpoint
= file_inode(f
)->i_private
;
344 struct crashtype
*crashtype
= NULL
;
348 if (count
>= PAGE_SIZE
)
351 buf
= (char *)__get_free_page(GFP_KERNEL
);
354 if (copy_from_user(buf
, user_buf
, count
)) {
355 free_page((unsigned long) buf
);
358 /* NULL-terminate and remove enter */
362 crashtype
= find_crashtype(buf
);
363 free_page((unsigned long)buf
);
368 err
= lkdtm_register_cpoint(crashpoint
, crashtype
);
378 /* Generic read callback that just prints out the available crash types */
379 static ssize_t
lkdtm_debugfs_read(struct file
*f
, char __user
*user_buf
,
380 size_t count
, loff_t
*off
)
385 buf
= (char *)__get_free_page(GFP_KERNEL
);
389 n
= snprintf(buf
, PAGE_SIZE
, "Available crash types:\n");
390 for (i
= 0; i
< ARRAY_SIZE(crashtypes
); i
++) {
391 n
+= snprintf(buf
+ n
, PAGE_SIZE
- n
, "%s\n",
396 out
= simple_read_from_buffer(user_buf
, count
, off
,
398 free_page((unsigned long) buf
);
403 static int lkdtm_debugfs_open(struct inode
*inode
, struct file
*file
)
408 /* Special entry to just crash directly. Available without KPROBEs */
409 static ssize_t
direct_entry(struct file
*f
, const char __user
*user_buf
,
410 size_t count
, loff_t
*off
)
412 struct crashtype
*crashtype
;
415 if (count
>= PAGE_SIZE
)
420 buf
= (char *)__get_free_page(GFP_KERNEL
);
423 if (copy_from_user(buf
, user_buf
, count
)) {
424 free_page((unsigned long) buf
);
427 /* NULL-terminate and remove enter */
431 crashtype
= find_crashtype(buf
);
432 free_page((unsigned long) buf
);
436 pr_info("Performing direct entry %s\n", crashtype
->name
);
437 lkdtm_do_action(crashtype
);
443 static struct dentry
*lkdtm_debugfs_root
;
445 static int __init
lkdtm_module_init(void)
447 struct crashpoint
*crashpoint
= NULL
;
448 struct crashtype
*crashtype
= NULL
;
452 /* Neither or both of these need to be set */
453 if ((cpoint_type
|| cpoint_name
) && !(cpoint_type
&& cpoint_name
)) {
454 pr_err("Need both cpoint_type and cpoint_name or neither\n");
459 crashtype
= find_crashtype(cpoint_type
);
461 pr_err("Unknown crashtype '%s'\n", cpoint_type
);
467 for (i
= 0; i
< ARRAY_SIZE(crashpoints
); i
++) {
468 if (!strcmp(cpoint_name
, crashpoints
[i
].name
))
469 crashpoint
= &crashpoints
[i
];
472 /* Refuse unknown crashpoints. */
474 pr_err("Invalid crashpoint %s\n", cpoint_name
);
479 #ifdef CONFIG_KPROBES
480 /* Set crash count. */
481 crash_count
= cpoint_count
;
484 /* Handle test-specific initialization. */
485 lkdtm_bugs_init(&recur_count
);
487 lkdtm_usercopy_init();
489 /* Register debugfs interface */
490 lkdtm_debugfs_root
= debugfs_create_dir("provoke-crash", NULL
);
491 if (!lkdtm_debugfs_root
) {
492 pr_err("creating root dir failed\n");
496 /* Install debugfs trigger files. */
497 for (i
= 0; i
< ARRAY_SIZE(crashpoints
); i
++) {
498 struct crashpoint
*cur
= &crashpoints
[i
];
501 de
= debugfs_create_file(cur
->name
, 0644, lkdtm_debugfs_root
,
504 pr_err("could not create crashpoint %s\n", cur
->name
);
509 /* Install crashpoint if one was selected. */
511 ret
= lkdtm_register_cpoint(crashpoint
, crashtype
);
513 pr_info("Invalid crashpoint %s\n", crashpoint
->name
);
516 pr_info("Crash point %s of type %s registered\n",
517 crashpoint
->name
, cpoint_type
);
519 pr_info("No crash points registered, enable through debugfs\n");
525 debugfs_remove_recursive(lkdtm_debugfs_root
);
529 static void __exit
lkdtm_module_exit(void)
531 debugfs_remove_recursive(lkdtm_debugfs_root
);
533 /* Handle test-specific clean-up. */
534 lkdtm_usercopy_exit();
536 unregister_jprobe(lkdtm_jprobe
);
537 pr_info("Crash point unregistered\n");
540 module_init(lkdtm_module_init
);
541 module_exit(lkdtm_module_exit
);
543 MODULE_LICENSE("GPL");
544 MODULE_DESCRIPTION("Kernel crash testing module");