drivers/misc/lkdtm.c

   1 /*
   2  * Kprobe module for testing crash dumps
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License as published by
   6  * the Free Software Foundation; either version 2 of the License, or
   7  * (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, write to the Free Software
  16  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  17  *
  18  * Copyright (C) IBM Corporation, 2006
  19  *
  20  * Author: Ankita Garg <ankita@in.ibm.com>
  21  *
  22  * This module induces system failures at predefined crashpoints to
  23  * evaluate the reliability of crash dumps obtained using different dumping
  24  * solutions.
  25  *
  26  * It is adapted from the Linux Kernel Dump Test Tool by
  27  * Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
  28  *
  29  * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
  30  *
  31  * See Documentation/fault-injection/provoke-crashes.txt for instructions
  32  */
  33
  34 #include <linux/kernel.h>
  35 #include <linux/fs.h>
  36 #include <linux/module.h>
  37 #include <linux/buffer_head.h>
  38 #include <linux/kprobes.h>
  39 #include <linux/list.h>
  40 #include <linux/init.h>
  41 #include <linux/interrupt.h>
  42 #include <linux/hrtimer.h>
  43 #include <linux/slab.h>
  44 #include <scsi/scsi_cmnd.h>
  45 #include <linux/debugfs.h>
  46
  47 #ifdef CONFIG_IDE
  48 #include <linux/ide.h>
  49 #endif
  50
  51 #define DEFAULT_COUNT 10
  52 #define REC_NUM_DEFAULT 10
  53
  54 enum cname {
  55         CN_INVALID,
  56         CN_INT_HARDWARE_ENTRY,
  57         CN_INT_HW_IRQ_EN,
  58         CN_INT_TASKLET_ENTRY,
  59         CN_FS_DEVRW,
  60         CN_MEM_SWAPOUT,
  61         CN_TIMERADD,
  62         CN_SCSI_DISPATCH_CMD,
  63         CN_IDE_CORE_CP,
  64         CN_DIRECT,
  65 };
  66
  67 enum ctype {
  68         CT_NONE,
  69         CT_PANIC,
  70         CT_BUG,
  71         CT_EXCEPTION,
  72         CT_LOOP,
  73         CT_OVERFLOW,
  74         CT_CORRUPT_STACK,
  75         CT_UNALIGNED_LOAD_STORE_WRITE,
  76         CT_OVERWRITE_ALLOCATION,
  77         CT_WRITE_AFTER_FREE,
  78         CT_SOFTLOCKUP,
  79         CT_HARDLOCKUP,
  80         CT_HUNG_TASK,
  81 };
  82
  83 static char* cp_name[] = {
  84         "INT_HARDWARE_ENTRY",
  85         "INT_HW_IRQ_EN",
  86         "INT_TASKLET_ENTRY",
  87         "FS_DEVRW",
  88         "MEM_SWAPOUT",
  89         "TIMERADD",
  90         "SCSI_DISPATCH_CMD",
  91         "IDE_CORE_CP",
  92         "DIRECT",
  93 };
  94
  95 static char* cp_type[] = {
  96         "PANIC",
  97         "BUG",
  98         "EXCEPTION",
  99         "LOOP",
 100         "OVERFLOW",
 101         "CORRUPT_STACK",
 102         "UNALIGNED_LOAD_STORE_WRITE",
 103         "OVERWRITE_ALLOCATION",
 104         "WRITE_AFTER_FREE",
 105         "SOFTLOCKUP",
 106         "HARDLOCKUP",
 107         "HUNG_TASK",
 108 };
 109
 110 static struct jprobe lkdtm;
 111
 112 static int lkdtm_parse_commandline(void);
 113 static void lkdtm_handler(void);
 114
 115 static char* cpoint_name;
 116 static char* cpoint_type;
 117 static int cpoint_count = DEFAULT_COUNT;
 118 static int recur_count = REC_NUM_DEFAULT;
 119
 120 static enum cname cpoint = CN_INVALID;
 121 static enum ctype cptype = CT_NONE;
 122 static int count = DEFAULT_COUNT;
 123
 124 module_param(recur_count, int, 0644);
 125 MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
 126                                  "default is 10");
 127 module_param(cpoint_name, charp, 0444);
 128 MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed");
 129 module_param(cpoint_type, charp, 0444);
 130 MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\
 131                                 "hitting the crash point");
 132 module_param(cpoint_count, int, 0644);
 133 MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\
 134                                 "crash point is to be hit to trigger action");
 135
 136 static unsigned int jp_do_irq(unsigned int irq)
 137 {
 138         lkdtm_handler();
 139         jprobe_return();
 140         return 0;
 141 }
 142
 143 static irqreturn_t jp_handle_irq_event(unsigned int irq,
 144                                        struct irqaction *action)
 145 {
 146         lkdtm_handler();
 147         jprobe_return();
 148         return 0;
 149 }
 150
 151 static void jp_tasklet_action(struct softirq_action *a)
 152 {
 153         lkdtm_handler();
 154         jprobe_return();
 155 }
 156
 157 static void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
 158 {
 159         lkdtm_handler();
 160         jprobe_return();
 161 }
 162
 163 struct scan_control;
 164
 165 static unsigned long jp_shrink_inactive_list(unsigned long max_scan,
 166                                              struct zone *zone,
 167                                              struct scan_control *sc)
 168 {
 169         lkdtm_handler();
 170         jprobe_return();
 171         return 0;
 172 }
 173
 174 static int jp_hrtimer_start(struct hrtimer *timer, ktime_t tim,
 175                             const enum hrtimer_mode mode)
 176 {
 177         lkdtm_handler();
 178         jprobe_return();
 179         return 0;
 180 }
 181
 182 static int jp_scsi_dispatch_cmd(struct scsi_cmnd *cmd)
 183 {
 184         lkdtm_handler();
 185         jprobe_return();
 186         return 0;
 187 }
 188
 189 #ifdef CONFIG_IDE
 190 int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file,
 191                         struct block_device *bdev, unsigned int cmd,
 192                         unsigned long arg)
 193 {
 194         lkdtm_handler();
 195         jprobe_return();
 196         return 0;
 197 }
 198 #endif
 199
 200 /* Return the crashpoint number or NONE if the name is invalid */
 201 static enum ctype parse_cp_type(const char *what, size_t count)
 202 {
 203         int i;
 204
 205         for (i = 0; i < ARRAY_SIZE(cp_type); i++) {
 206                 if (!strcmp(what, cp_type[i]))
 207                         return i + 1;
 208         }
 209
 210         return CT_NONE;
 211 }
 212
 213 static const char *cp_type_to_str(enum ctype type)
 214 {
 215         if (type == CT_NONE || type < 0 || type > ARRAY_SIZE(cp_type))
 216                 return "None";
 217
 218         return cp_type[type - 1];
 219 }
 220
 221 static const char *cp_name_to_str(enum cname name)
 222 {
 223         if (name == CN_INVALID || name < 0 || name > ARRAY_SIZE(cp_name))
 224                 return "INVALID";
 225
 226         return cp_name[name - 1];
 227 }
 228
 229
 230 static int lkdtm_parse_commandline(void)
 231 {
 232         int i;
 233
 234         if (cpoint_count < 1 || recur_count < 1)
 235                 return -EINVAL;
 236
 237         count = cpoint_count;
 238
 239         /* No special parameters */
 240         if (!cpoint_type && !cpoint_name)
 241                 return 0;
 242
 243         /* Neither or both of these need to be set */
 244         if (!cpoint_type || !cpoint_name)
 245                 return -EINVAL;
 246
 247         cptype = parse_cp_type(cpoint_type, strlen(cpoint_type));
 248         if (cptype == CT_NONE)
 249                 return -EINVAL;
 250
 251         for (i = 0; i < ARRAY_SIZE(cp_name); i++) {
 252                 if (!strcmp(cpoint_name, cp_name[i])) {
 253                         cpoint = i + 1;
 254                         return 0;
 255                 }
 256         }
 257
 258         /* Could not find a valid crash point */
 259         return -EINVAL;
 260 }
 261
 262 static int recursive_loop(int a)
 263 {
 264         char buf[1024];
 265
 266         memset(buf,0xFF,1024);
 267         recur_count--;
 268         if (!recur_count)
 269                 return 0;
 270         else
 271                 return recursive_loop(a);
 272 }
 273
 274 static void lkdtm_do_action(enum ctype which)
 275 {
 276         switch (which) {
 277         case CT_PANIC:
 278                 panic("dumptest");
 279                 break;
 280         case CT_BUG:
 281                 BUG();
 282                 break;
 283         case CT_EXCEPTION:
 284                 *((int *) 0) = 0;
 285                 break;
 286         case CT_LOOP:
 287                 for (;;)
 288                         ;
 289                 break;
 290         case CT_OVERFLOW:
 291                 (void) recursive_loop(0);
 292                 break;
 293         case CT_CORRUPT_STACK: {
 294                 volatile u32 data[8];
 295                 volatile u32 *p = data;
 296
 297                 p[12] = 0x12345678;
 298                 break;
 299         }
 300         case CT_UNALIGNED_LOAD_STORE_WRITE: {
 301                 static u8 data[5] __attribute__((aligned(4))) = {1, 2,
 302                                 3, 4, 5};
 303                 u32 *p;
 304                 u32 val = 0x12345678;
 305
 306                 p = (u32 *)(data + 1);
 307                 if (*p == 0)
 308                         val = 0x87654321;
 309                 *p = val;
 310                  break;
 311         }
 312         case CT_OVERWRITE_ALLOCATION: {
 313                 size_t len = 1020;
 314                 u32 *data = kmalloc(len, GFP_KERNEL);
 315
 316                 data[1024 / sizeof(u32)] = 0x12345678;
 317                 kfree(data);
 318                 break;
 319         }
 320         case CT_WRITE_AFTER_FREE: {
 321                 size_t len = 1024;
 322                 u32 *data = kmalloc(len, GFP_KERNEL);
 323
 324                 kfree(data);
 325                 schedule();
 326                 memset(data, 0x78, len);
 327                 break;
 328         }
 329         case CT_SOFTLOCKUP:
 330                 preempt_disable();
 331                 for (;;)
 332                         cpu_relax();
 333                 break;
 334         case CT_HARDLOCKUP:
 335                 local_irq_disable();
 336                 for (;;)
 337                         cpu_relax();
 338                 break;
 339         case CT_HUNG_TASK:
 340                 set_current_state(TASK_UNINTERRUPTIBLE);
 341                 schedule();
 342                 break;
 343         case CT_NONE:
 344         default:
 345                 break;
 346         }
 347
 348 }
 349
 350 static void lkdtm_handler(void)
 351 {
 352         count--;
 353         printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
 354                         cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
 355
 356         if (count == 0) {
 357                 lkdtm_do_action(cptype);
 358                 count = cpoint_count;
 359         }
 360 }
 361
 362 static int lkdtm_register_cpoint(enum cname which)
 363 {
 364         int ret;
 365
 366         cpoint = CN_INVALID;
 367         if (lkdtm.entry != NULL)
 368                 unregister_jprobe(&lkdtm);
 369
 370         switch (which) {
 371         case CN_DIRECT:
 372                 lkdtm_do_action(cptype);
 373                 return 0;
 374         case CN_INT_HARDWARE_ENTRY:
 375                 lkdtm.kp.symbol_name = "do_IRQ";
 376                 lkdtm.entry = (kprobe_opcode_t*) jp_do_irq;
 377                 break;
 378         case CN_INT_HW_IRQ_EN:
 379                 lkdtm.kp.symbol_name = "handle_IRQ_event";
 380                 lkdtm.entry = (kprobe_opcode_t*) jp_handle_irq_event;
 381                 break;
 382         case CN_INT_TASKLET_ENTRY:
 383                 lkdtm.kp.symbol_name = "tasklet_action";
 384                 lkdtm.entry = (kprobe_opcode_t*) jp_tasklet_action;
 385                 break;
 386         case CN_FS_DEVRW:
 387                 lkdtm.kp.symbol_name = "ll_rw_block";
 388                 lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block;
 389                 break;
 390         case CN_MEM_SWAPOUT:
 391                 lkdtm.kp.symbol_name = "shrink_inactive_list";
 392                 lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list;
 393                 break;
 394         case CN_TIMERADD:
 395                 lkdtm.kp.symbol_name = "hrtimer_start";
 396                 lkdtm.entry = (kprobe_opcode_t*) jp_hrtimer_start;
 397                 break;
 398         case CN_SCSI_DISPATCH_CMD:
 399                 lkdtm.kp.symbol_name = "scsi_dispatch_cmd";
 400                 lkdtm.entry = (kprobe_opcode_t*) jp_scsi_dispatch_cmd;
 401                 break;
 402         case CN_IDE_CORE_CP:
 403 #ifdef CONFIG_IDE
 404                 lkdtm.kp.symbol_name = "generic_ide_ioctl";
 405                 lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl;
 406 #else
 407                 printk(KERN_INFO "lkdtm: Crash point not available\n");
 408                 return -EINVAL;
 409 #endif
 410                 break;
 411         default:
 412                 printk(KERN_INFO "lkdtm: Invalid Crash Point\n");
 413                 return -EINVAL;
 414         }
 415
 416         cpoint = which;
 417         if ((ret = register_jprobe(&lkdtm)) < 0) {
 418                 printk(KERN_INFO "lkdtm: Couldn't register jprobe\n");
 419                 cpoint = CN_INVALID;
 420         }
 421
 422         return ret;
 423 }
 424
 425 static ssize_t do_register_entry(enum cname which, struct file *f,
 426                 const char __user *user_buf, size_t count, loff_t *off)
 427 {
 428         char *buf;
 429         int err;
 430
 431         if (count >= PAGE_SIZE)
 432                 return -EINVAL;
 433
 434         buf = (char *)__get_free_page(GFP_KERNEL);
 435         if (!buf)
 436                 return -ENOMEM;
 437         if (copy_from_user(buf, user_buf, count)) {
 438                 free_page((unsigned long) buf);
 439                 return -EFAULT;
 440         }
 441         /* NULL-terminate and remove enter */
 442         buf[count] = '\0';
 443         strim(buf);
 444
 445         cptype = parse_cp_type(buf, count);
 446         free_page((unsigned long) buf);
 447
 448         if (cptype == CT_NONE)
 449                 return -EINVAL;
 450
 451         err = lkdtm_register_cpoint(which);
 452         if (err < 0)
 453                 return err;
 454
 455         *off += count;
 456
 457         return count;
 458 }
 459
 460 /* Generic read callback that just prints out the available crash types */
 461 static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
 462                 size_t count, loff_t *off)
 463 {
 464         char *buf;
 465         int i, n, out;
 466
 467         buf = (char *)__get_free_page(GFP_KERNEL);
 468
 469         n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
 470         for (i = 0; i < ARRAY_SIZE(cp_type); i++)
 471                 n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]);
 472         buf[n] = '\0';
 473
 474         out = simple_read_from_buffer(user_buf, count, off,
 475                                       buf, n);
 476         free_page((unsigned long) buf);
 477
 478         return out;
 479 }
 480
 481 static int lkdtm_debugfs_open(struct inode *inode, struct file *file)
 482 {
 483         return 0;
 484 }
 485
 486
 487 static ssize_t int_hardware_entry(struct file *f, const char __user *buf,
 488                 size_t count, loff_t *off)
 489 {
 490         return do_register_entry(CN_INT_HARDWARE_ENTRY, f, buf, count, off);
 491 }
 492
 493 static ssize_t int_hw_irq_en(struct file *f, const char __user *buf,
 494                 size_t count, loff_t *off)
 495 {
 496         return do_register_entry(CN_INT_HW_IRQ_EN, f, buf, count, off);
 497 }
 498
 499 static ssize_t int_tasklet_entry(struct file *f, const char __user *buf,
 500                 size_t count, loff_t *off)
 501 {
 502         return do_register_entry(CN_INT_TASKLET_ENTRY, f, buf, count, off);
 503 }
 504
 505 static ssize_t fs_devrw_entry(struct file *f, const char __user *buf,
 506                 size_t count, loff_t *off)
 507 {
 508         return do_register_entry(CN_FS_DEVRW, f, buf, count, off);
 509 }
 510
 511 static ssize_t mem_swapout_entry(struct file *f, const char __user *buf,
 512                 size_t count, loff_t *off)
 513 {
 514         return do_register_entry(CN_MEM_SWAPOUT, f, buf, count, off);
 515 }
 516
 517 static ssize_t timeradd_entry(struct file *f, const char __user *buf,
 518                 size_t count, loff_t *off)
 519 {
 520         return do_register_entry(CN_TIMERADD, f, buf, count, off);
 521 }
 522
 523 static ssize_t scsi_dispatch_cmd_entry(struct file *f,
 524                 const char __user *buf, size_t count, loff_t *off)
 525 {
 526         return do_register_entry(CN_SCSI_DISPATCH_CMD, f, buf, count, off);
 527 }
 528
 529 static ssize_t ide_core_cp_entry(struct file *f, const char __user *buf,
 530                 size_t count, loff_t *off)
 531 {
 532         return do_register_entry(CN_IDE_CORE_CP, f, buf, count, off);
 533 }
 534
 535 /* Special entry to just crash directly. Available without KPROBEs */
 536 static ssize_t direct_entry(struct file *f, const char __user *user_buf,
 537                 size_t count, loff_t *off)
 538 {
 539         enum ctype type;
 540         char *buf;
 541
 542         if (count >= PAGE_SIZE)
 543                 return -EINVAL;
 544         if (count < 1)
 545                 return -EINVAL;
 546
 547         buf = (char *)__get_free_page(GFP_KERNEL);
 548         if (!buf)
 549                 return -ENOMEM;
 550         if (copy_from_user(buf, user_buf, count)) {
 551                 free_page((unsigned long) buf);
 552                 return -EFAULT;
 553         }
 554         /* NULL-terminate and remove enter */
 555         buf[count] = '\0';
 556         strim(buf);
 557
 558         type = parse_cp_type(buf, count);
 559         free_page((unsigned long) buf);
 560         if (type == CT_NONE)
 561                 return -EINVAL;
 562
 563         printk(KERN_INFO "lkdtm: Performing direct entry %s\n",
 564                         cp_type_to_str(type));
 565         lkdtm_do_action(type);
 566         *off += count;
 567
 568         return count;
 569 }
 570
 571 struct crash_entry {
 572         const char *name;
 573         const struct file_operations fops;
 574 };
 575
 576 static const struct crash_entry crash_entries[] = {
 577         {"DIRECT", {.read = lkdtm_debugfs_read,
 578                         .llseek = generic_file_llseek,
 579                         .open = lkdtm_debugfs_open,
 580                         .write = direct_entry} },
 581         {"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read,
 582                         .llseek = generic_file_llseek,
 583                         .open = lkdtm_debugfs_open,
 584                         .write = int_hardware_entry} },
 585         {"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read,
 586                         .llseek = generic_file_llseek,
 587                         .open = lkdtm_debugfs_open,
 588                         .write = int_hw_irq_en} },
 589         {"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read,
 590                         .llseek = generic_file_llseek,
 591                         .open = lkdtm_debugfs_open,
 592                         .write = int_tasklet_entry} },
 593         {"FS_DEVRW", {.read = lkdtm_debugfs_read,
 594                         .llseek = generic_file_llseek,
 595                         .open = lkdtm_debugfs_open,
 596                         .write = fs_devrw_entry} },
 597         {"MEM_SWAPOUT", {.read = lkdtm_debugfs_read,
 598                         .llseek = generic_file_llseek,
 599                         .open = lkdtm_debugfs_open,
 600                         .write = mem_swapout_entry} },
 601         {"TIMERADD", {.read = lkdtm_debugfs_read,
 602                         .llseek = generic_file_llseek,
 603                         .open = lkdtm_debugfs_open,
 604                         .write = timeradd_entry} },
 605         {"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read,
 606                         .llseek = generic_file_llseek,
 607                         .open = lkdtm_debugfs_open,
 608                         .write = scsi_dispatch_cmd_entry} },
 609         {"IDE_CORE_CP", {.read = lkdtm_debugfs_read,
 610                         .llseek = generic_file_llseek,
 611                         .open = lkdtm_debugfs_open,
 612                         .write = ide_core_cp_entry} },
 613 };
 614
 615 static struct dentry *lkdtm_debugfs_root;
 616
 617 static int __init lkdtm_module_init(void)
 618 {
 619         int ret = -EINVAL;
 620         int n_debugfs_entries = 1; /* Assume only the direct entry */
 621         int i;
 622
 623         /* Register debugfs interface */
 624         lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
 625         if (!lkdtm_debugfs_root) {
 626                 printk(KERN_ERR "lkdtm: creating root dir failed\n");
 627                 return -ENODEV;
 628         }
 629
 630 #ifdef CONFIG_KPROBES
 631         n_debugfs_entries = ARRAY_SIZE(crash_entries);
 632 #endif
 633
 634         for (i = 0; i < n_debugfs_entries; i++) {
 635                 const struct crash_entry *cur = &crash_entries[i];
 636                 struct dentry *de;
 637
 638                 de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
 639                                 NULL, &cur->fops);
 640                 if (de == NULL) {
 641                         printk(KERN_ERR "lkdtm: could not create %s\n",
 642                                         cur->name);
 643                         goto out_err;
 644                 }
 645         }
 646
 647         if (lkdtm_parse_commandline() == -EINVAL) {
 648                 printk(KERN_INFO "lkdtm: Invalid command\n");
 649                 goto out_err;
 650         }
 651
 652         if (cpoint != CN_INVALID && cptype != CT_NONE) {
 653                 ret = lkdtm_register_cpoint(cpoint);
 654                 if (ret < 0) {
 655                         printk(KERN_INFO "lkdtm: Invalid crash point %d\n",
 656                                         cpoint);
 657                         goto out_err;
 658                 }
 659                 printk(KERN_INFO "lkdtm: Crash point %s of type %s registered\n",
 660                                 cpoint_name, cpoint_type);
 661         } else {
 662                 printk(KERN_INFO "lkdtm: No crash points registered, enable through debugfs\n");
 663         }
 664
 665         return 0;
 666
 667 out_err:
 668         debugfs_remove_recursive(lkdtm_debugfs_root);
 669         return ret;
 670 }
 671
 672 static void __exit lkdtm_module_exit(void)
 673 {
 674         debugfs_remove_recursive(lkdtm_debugfs_root);
 675
 676         unregister_jprobe(&lkdtm);
 677         printk(KERN_INFO "lkdtm: Crash point unregistered\n");
 678 }
 679
 680 module_init(lkdtm_module_init);
 681 module_exit(lkdtm_module_exit);
 682
 683 MODULE_LICENSE("GPL");