Commit | Line | Data |
---|---|---|
8bb31b9d AG |
1 | /* |
2 | * Kprobe module for testing crash dumps | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License as published by | |
6 | * the Free Software Foundation; either version 2 of the License, or | |
7 | * (at your option) any later version. | |
8 | * | |
9 | * This program is distributed in the hope that it will be useful, | |
10 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
12 | * GNU General Public License for more details. | |
13 | * | |
14 | * You should have received a copy of the GNU General Public License | |
15 | * along with this program; if not, write to the Free Software | |
16 | * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. | |
17 | * | |
18 | * Copyright (C) IBM Corporation, 2006 | |
19 | * | |
20 | * Author: Ankita Garg <ankita@in.ibm.com> | |
21 | * | |
22 | * This module induces system failures at predefined crashpoints to | |
23 | * evaluate the reliability of crash dumps obtained using different dumping | |
24 | * solutions. | |
25 | * | |
26 | * It is adapted from the Linux Kernel Dump Test Tool by | |
27 | * Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net> | |
28 | * | |
0347af4e | 29 | * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net> |
8bb31b9d | 30 | * |
0347af4e | 31 | * See Documentation/fault-injection/provoke-crashes.txt for instructions |
8bb31b9d | 32 | */ |
feac6e21 | 33 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
8bb31b9d AG |
34 | |
35 | #include <linux/kernel.h> | |
5d861d92 | 36 | #include <linux/fs.h> |
8bb31b9d | 37 | #include <linux/module.h> |
5d861d92 | 38 | #include <linux/buffer_head.h> |
8bb31b9d | 39 | #include <linux/kprobes.h> |
5d861d92 | 40 | #include <linux/list.h> |
8bb31b9d | 41 | #include <linux/init.h> |
8bb31b9d | 42 | #include <linux/interrupt.h> |
5d861d92 | 43 | #include <linux/hrtimer.h> |
5a0e3ad6 | 44 | #include <linux/slab.h> |
8bb31b9d | 45 | #include <scsi/scsi_cmnd.h> |
0347af4e | 46 | #include <linux/debugfs.h> |
cc33c537 | 47 | #include <linux/vmalloc.h> |
9ae113ce | 48 | #include <linux/mman.h> |
8bb31b9d AG |
49 | |
50 | #ifdef CONFIG_IDE | |
51 | #include <linux/ide.h> | |
52 | #endif | |
53 | ||
7d196ac3 KC |
54 | /* |
55 | * Make sure our attempts to over run the kernel stack doesn't trigger | |
56 | * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we | |
57 | * recurse past the end of THREAD_SIZE by default. | |
58 | */ | |
59 | #if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0) | |
60 | #define REC_STACK_SIZE (CONFIG_FRAME_WARN / 2) | |
61 | #else | |
62 | #define REC_STACK_SIZE (THREAD_SIZE / 8) | |
63 | #endif | |
64 | #define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2) | |
65 | ||
8bb31b9d | 66 | #define DEFAULT_COUNT 10 |
cc33c537 | 67 | #define EXEC_SIZE 64 |
8bb31b9d AG |
68 | |
69 | enum cname { | |
93e2f585 NK |
70 | CN_INVALID, |
71 | CN_INT_HARDWARE_ENTRY, | |
72 | CN_INT_HW_IRQ_EN, | |
73 | CN_INT_TASKLET_ENTRY, | |
74 | CN_FS_DEVRW, | |
75 | CN_MEM_SWAPOUT, | |
76 | CN_TIMERADD, | |
77 | CN_SCSI_DISPATCH_CMD, | |
78 | CN_IDE_CORE_CP, | |
79 | CN_DIRECT, | |
8bb31b9d AG |
80 | }; |
81 | ||
82 | enum ctype { | |
93e2f585 NK |
83 | CT_NONE, |
84 | CT_PANIC, | |
85 | CT_BUG, | |
65892723 | 86 | CT_WARNING, |
93e2f585 NK |
87 | CT_EXCEPTION, |
88 | CT_LOOP, | |
89 | CT_OVERFLOW, | |
90 | CT_CORRUPT_STACK, | |
91 | CT_UNALIGNED_LOAD_STORE_WRITE, | |
92 | CT_OVERWRITE_ALLOCATION, | |
93 | CT_WRITE_AFTER_FREE, | |
94 | CT_SOFTLOCKUP, | |
95 | CT_HARDLOCKUP, | |
274a5855 | 96 | CT_SPINLOCKUP, |
93e2f585 | 97 | CT_HUNG_TASK, |
cc33c537 KC |
98 | CT_EXEC_DATA, |
99 | CT_EXEC_STACK, | |
100 | CT_EXEC_KMALLOC, | |
101 | CT_EXEC_VMALLOC, | |
9ae113ce KC |
102 | CT_EXEC_USERSPACE, |
103 | CT_ACCESS_USERSPACE, | |
104 | CT_WRITE_RO, | |
8bb31b9d AG |
105 | }; |
106 | ||
107 | static char* cp_name[] = { | |
108 | "INT_HARDWARE_ENTRY", | |
109 | "INT_HW_IRQ_EN", | |
110 | "INT_TASKLET_ENTRY", | |
111 | "FS_DEVRW", | |
112 | "MEM_SWAPOUT", | |
113 | "TIMERADD", | |
114 | "SCSI_DISPATCH_CMD", | |
0347af4e SK |
115 | "IDE_CORE_CP", |
116 | "DIRECT", | |
8bb31b9d AG |
117 | }; |
118 | ||
119 | static char* cp_type[] = { | |
120 | "PANIC", | |
121 | "BUG", | |
65892723 | 122 | "WARNING", |
8bb31b9d AG |
123 | "EXCEPTION", |
124 | "LOOP", | |
0347af4e SK |
125 | "OVERFLOW", |
126 | "CORRUPT_STACK", | |
127 | "UNALIGNED_LOAD_STORE_WRITE", | |
128 | "OVERWRITE_ALLOCATION", | |
129 | "WRITE_AFTER_FREE", | |
a48223f9 FW |
130 | "SOFTLOCKUP", |
131 | "HARDLOCKUP", | |
274a5855 | 132 | "SPINLOCKUP", |
a48223f9 | 133 | "HUNG_TASK", |
cc33c537 KC |
134 | "EXEC_DATA", |
135 | "EXEC_STACK", | |
136 | "EXEC_KMALLOC", | |
137 | "EXEC_VMALLOC", | |
9ae113ce KC |
138 | "EXEC_USERSPACE", |
139 | "ACCESS_USERSPACE", | |
140 | "WRITE_RO", | |
8bb31b9d AG |
141 | }; |
142 | ||
143 | static struct jprobe lkdtm; | |
144 | ||
145 | static int lkdtm_parse_commandline(void); | |
146 | static void lkdtm_handler(void); | |
147 | ||
ec1c620b AV |
148 | static char* cpoint_name; |
149 | static char* cpoint_type; | |
8bb31b9d AG |
150 | static int cpoint_count = DEFAULT_COUNT; |
151 | static int recur_count = REC_NUM_DEFAULT; | |
152 | ||
93e2f585 NK |
153 | static enum cname cpoint = CN_INVALID; |
154 | static enum ctype cptype = CT_NONE; | |
8bb31b9d | 155 | static int count = DEFAULT_COUNT; |
aa2c96d6 | 156 | static DEFINE_SPINLOCK(count_lock); |
274a5855 | 157 | static DEFINE_SPINLOCK(lock_me_up); |
8bb31b9d | 158 | |
cc33c537 KC |
159 | static u8 data_area[EXEC_SIZE]; |
160 | ||
9ae113ce KC |
161 | static const unsigned long rodata = 0xAA55AA55; |
162 | ||
8bb31b9d | 163 | module_param(recur_count, int, 0644); |
7d196ac3 | 164 | MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test"); |
dca41306 | 165 | module_param(cpoint_name, charp, 0444); |
5d861d92 | 166 | MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed"); |
dca41306 | 167 | module_param(cpoint_type, charp, 0444); |
5d861d92 RD |
168 | MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\ |
169 | "hitting the crash point"); | |
170 | module_param(cpoint_count, int, 0644); | |
171 | MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\ | |
172 | "crash point is to be hit to trigger action"); | |
8bb31b9d | 173 | |
2118116e | 174 | static unsigned int jp_do_irq(unsigned int irq) |
8bb31b9d AG |
175 | { |
176 | lkdtm_handler(); | |
177 | jprobe_return(); | |
178 | return 0; | |
179 | } | |
180 | ||
2118116e AB |
181 | static irqreturn_t jp_handle_irq_event(unsigned int irq, |
182 | struct irqaction *action) | |
8bb31b9d AG |
183 | { |
184 | lkdtm_handler(); | |
185 | jprobe_return(); | |
186 | return 0; | |
187 | } | |
188 | ||
2118116e | 189 | static void jp_tasklet_action(struct softirq_action *a) |
8bb31b9d AG |
190 | { |
191 | lkdtm_handler(); | |
192 | jprobe_return(); | |
193 | } | |
194 | ||
2118116e | 195 | static void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[]) |
8bb31b9d AG |
196 | { |
197 | lkdtm_handler(); | |
198 | jprobe_return(); | |
199 | } | |
200 | ||
201 | struct scan_control; | |
202 | ||
2118116e AB |
203 | static unsigned long jp_shrink_inactive_list(unsigned long max_scan, |
204 | struct zone *zone, | |
205 | struct scan_control *sc) | |
8bb31b9d AG |
206 | { |
207 | lkdtm_handler(); | |
208 | jprobe_return(); | |
209 | return 0; | |
210 | } | |
211 | ||
2118116e AB |
212 | static int jp_hrtimer_start(struct hrtimer *timer, ktime_t tim, |
213 | const enum hrtimer_mode mode) | |
8bb31b9d AG |
214 | { |
215 | lkdtm_handler(); | |
216 | jprobe_return(); | |
217 | return 0; | |
218 | } | |
219 | ||
2118116e | 220 | static int jp_scsi_dispatch_cmd(struct scsi_cmnd *cmd) |
8bb31b9d AG |
221 | { |
222 | lkdtm_handler(); | |
223 | jprobe_return(); | |
224 | return 0; | |
225 | } | |
226 | ||
227 | #ifdef CONFIG_IDE | |
44629432 | 228 | static int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file, |
8bb31b9d AG |
229 | struct block_device *bdev, unsigned int cmd, |
230 | unsigned long arg) | |
231 | { | |
232 | lkdtm_handler(); | |
233 | jprobe_return(); | |
234 | return 0; | |
235 | } | |
236 | #endif | |
237 | ||
0347af4e SK |
238 | /* Return the crashpoint number or NONE if the name is invalid */ |
239 | static enum ctype parse_cp_type(const char *what, size_t count) | |
240 | { | |
241 | int i; | |
242 | ||
243 | for (i = 0; i < ARRAY_SIZE(cp_type); i++) { | |
244 | if (!strcmp(what, cp_type[i])) | |
245 | return i + 1; | |
246 | } | |
247 | ||
93e2f585 | 248 | return CT_NONE; |
0347af4e SK |
249 | } |
250 | ||
251 | static const char *cp_type_to_str(enum ctype type) | |
252 | { | |
93e2f585 | 253 | if (type == CT_NONE || type < 0 || type > ARRAY_SIZE(cp_type)) |
0347af4e SK |
254 | return "None"; |
255 | ||
256 | return cp_type[type - 1]; | |
257 | } | |
258 | ||
259 | static const char *cp_name_to_str(enum cname name) | |
260 | { | |
93e2f585 | 261 | if (name == CN_INVALID || name < 0 || name > ARRAY_SIZE(cp_name)) |
0347af4e SK |
262 | return "INVALID"; |
263 | ||
264 | return cp_name[name - 1]; | |
265 | } | |
266 | ||
267 | ||
8bb31b9d AG |
268 | static int lkdtm_parse_commandline(void) |
269 | { | |
270 | int i; | |
aa2c96d6 | 271 | unsigned long flags; |
8bb31b9d | 272 | |
0347af4e | 273 | if (cpoint_count < 1 || recur_count < 1) |
8bb31b9d AG |
274 | return -EINVAL; |
275 | ||
aa2c96d6 | 276 | spin_lock_irqsave(&count_lock, flags); |
0347af4e | 277 | count = cpoint_count; |
aa2c96d6 | 278 | spin_unlock_irqrestore(&count_lock, flags); |
0347af4e SK |
279 | |
280 | /* No special parameters */ | |
281 | if (!cpoint_type && !cpoint_name) | |
282 | return 0; | |
283 | ||
284 | /* Neither or both of these need to be set */ | |
285 | if (!cpoint_type || !cpoint_name) | |
286 | return -EINVAL; | |
287 | ||
288 | cptype = parse_cp_type(cpoint_type, strlen(cpoint_type)); | |
93e2f585 | 289 | if (cptype == CT_NONE) |
0347af4e SK |
290 | return -EINVAL; |
291 | ||
292 | for (i = 0; i < ARRAY_SIZE(cp_name); i++) { | |
8bb31b9d AG |
293 | if (!strcmp(cpoint_name, cp_name[i])) { |
294 | cpoint = i + 1; | |
0347af4e | 295 | return 0; |
8bb31b9d AG |
296 | } |
297 | } | |
298 | ||
0347af4e SK |
299 | /* Could not find a valid crash point */ |
300 | return -EINVAL; | |
8bb31b9d AG |
301 | } |
302 | ||
7d196ac3 | 303 | static int recursive_loop(int remaining) |
8bb31b9d | 304 | { |
7d196ac3 | 305 | char buf[REC_STACK_SIZE]; |
8bb31b9d | 306 | |
7d196ac3 KC |
307 | /* Make sure compiler does not optimize this away. */ |
308 | memset(buf, (remaining & 0xff) | 0x1, REC_STACK_SIZE); | |
309 | if (!remaining) | |
8bb31b9d AG |
310 | return 0; |
311 | else | |
7d196ac3 | 312 | return recursive_loop(remaining - 1); |
8bb31b9d AG |
313 | } |
314 | ||
cc33c537 KC |
315 | static void do_nothing(void) |
316 | { | |
317 | return; | |
318 | } | |
319 | ||
629c66a2 KC |
320 | static noinline void corrupt_stack(void) |
321 | { | |
322 | /* Use default char array length that triggers stack protection. */ | |
323 | char data[8]; | |
324 | ||
325 | memset((void *)data, 0, 64); | |
326 | } | |
327 | ||
cc33c537 KC |
328 | static void execute_location(void *dst) |
329 | { | |
330 | void (*func)(void) = dst; | |
331 | ||
332 | memcpy(dst, do_nothing, EXEC_SIZE); | |
333 | func(); | |
334 | } | |
335 | ||
9ae113ce KC |
336 | static void execute_user_location(void *dst) |
337 | { | |
5123662a | 338 | /* Intentionally crossing kernel/user memory boundary. */ |
9ae113ce KC |
339 | void (*func)(void) = dst; |
340 | ||
5123662a | 341 | if (copy_to_user((void __user *)dst, do_nothing, EXEC_SIZE)) |
9ae113ce KC |
342 | return; |
343 | func(); | |
344 | } | |
345 | ||
0347af4e | 346 | static void lkdtm_do_action(enum ctype which) |
8bb31b9d | 347 | { |
0347af4e | 348 | switch (which) { |
93e2f585 | 349 | case CT_PANIC: |
0347af4e SK |
350 | panic("dumptest"); |
351 | break; | |
93e2f585 | 352 | case CT_BUG: |
0347af4e SK |
353 | BUG(); |
354 | break; | |
65892723 KC |
355 | case CT_WARNING: |
356 | WARN_ON(1); | |
357 | break; | |
93e2f585 | 358 | case CT_EXCEPTION: |
0347af4e SK |
359 | *((int *) 0) = 0; |
360 | break; | |
93e2f585 | 361 | case CT_LOOP: |
0347af4e SK |
362 | for (;;) |
363 | ; | |
364 | break; | |
93e2f585 | 365 | case CT_OVERFLOW: |
7d196ac3 | 366 | (void) recursive_loop(recur_count); |
0347af4e | 367 | break; |
629c66a2 KC |
368 | case CT_CORRUPT_STACK: |
369 | corrupt_stack(); | |
0347af4e | 370 | break; |
93e2f585 | 371 | case CT_UNALIGNED_LOAD_STORE_WRITE: { |
0347af4e SK |
372 | static u8 data[5] __attribute__((aligned(4))) = {1, 2, |
373 | 3, 4, 5}; | |
374 | u32 *p; | |
375 | u32 val = 0x12345678; | |
376 | ||
377 | p = (u32 *)(data + 1); | |
378 | if (*p == 0) | |
379 | val = 0x87654321; | |
380 | *p = val; | |
381 | break; | |
382 | } | |
93e2f585 | 383 | case CT_OVERWRITE_ALLOCATION: { |
0347af4e SK |
384 | size_t len = 1020; |
385 | u32 *data = kmalloc(len, GFP_KERNEL); | |
386 | ||
387 | data[1024 / sizeof(u32)] = 0x12345678; | |
388 | kfree(data); | |
389 | break; | |
390 | } | |
93e2f585 | 391 | case CT_WRITE_AFTER_FREE: { |
0347af4e SK |
392 | size_t len = 1024; |
393 | u32 *data = kmalloc(len, GFP_KERNEL); | |
394 | ||
395 | kfree(data); | |
396 | schedule(); | |
397 | memset(data, 0x78, len); | |
398 | break; | |
399 | } | |
93e2f585 | 400 | case CT_SOFTLOCKUP: |
a48223f9 FW |
401 | preempt_disable(); |
402 | for (;;) | |
403 | cpu_relax(); | |
404 | break; | |
93e2f585 | 405 | case CT_HARDLOCKUP: |
a48223f9 FW |
406 | local_irq_disable(); |
407 | for (;;) | |
408 | cpu_relax(); | |
409 | break; | |
274a5855 KC |
410 | case CT_SPINLOCKUP: |
411 | /* Must be called twice to trigger. */ | |
412 | spin_lock(&lock_me_up); | |
5123662a KC |
413 | /* Let sparse know we intended to exit holding the lock. */ |
414 | __release(&lock_me_up); | |
274a5855 | 415 | break; |
93e2f585 | 416 | case CT_HUNG_TASK: |
a48223f9 FW |
417 | set_current_state(TASK_UNINTERRUPTIBLE); |
418 | schedule(); | |
419 | break; | |
cc33c537 KC |
420 | case CT_EXEC_DATA: |
421 | execute_location(data_area); | |
422 | break; | |
423 | case CT_EXEC_STACK: { | |
424 | u8 stack_area[EXEC_SIZE]; | |
425 | execute_location(stack_area); | |
426 | break; | |
427 | } | |
428 | case CT_EXEC_KMALLOC: { | |
429 | u32 *kmalloc_area = kmalloc(EXEC_SIZE, GFP_KERNEL); | |
430 | execute_location(kmalloc_area); | |
431 | kfree(kmalloc_area); | |
432 | break; | |
433 | } | |
434 | case CT_EXEC_VMALLOC: { | |
435 | u32 *vmalloc_area = vmalloc(EXEC_SIZE); | |
436 | execute_location(vmalloc_area); | |
437 | vfree(vmalloc_area); | |
438 | break; | |
439 | } | |
9ae113ce KC |
440 | case CT_EXEC_USERSPACE: { |
441 | unsigned long user_addr; | |
442 | ||
443 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE, | |
444 | PROT_READ | PROT_WRITE | PROT_EXEC, | |
445 | MAP_ANONYMOUS | MAP_PRIVATE, 0); | |
446 | if (user_addr >= TASK_SIZE) { | |
447 | pr_warn("Failed to allocate user memory\n"); | |
448 | return; | |
449 | } | |
450 | execute_user_location((void *)user_addr); | |
451 | vm_munmap(user_addr, PAGE_SIZE); | |
452 | break; | |
453 | } | |
454 | case CT_ACCESS_USERSPACE: { | |
455 | unsigned long user_addr, tmp; | |
456 | unsigned long *ptr; | |
457 | ||
458 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE, | |
459 | PROT_READ | PROT_WRITE | PROT_EXEC, | |
460 | MAP_ANONYMOUS | MAP_PRIVATE, 0); | |
461 | if (user_addr >= TASK_SIZE) { | |
462 | pr_warn("Failed to allocate user memory\n"); | |
463 | return; | |
464 | } | |
465 | ||
466 | ptr = (unsigned long *)user_addr; | |
467 | tmp = *ptr; | |
468 | tmp += 0xc0dec0de; | |
469 | *ptr = tmp; | |
470 | ||
471 | vm_munmap(user_addr, PAGE_SIZE); | |
472 | ||
473 | break; | |
474 | } | |
475 | case CT_WRITE_RO: { | |
476 | unsigned long *ptr; | |
477 | ||
478 | ptr = (unsigned long *)&rodata; | |
479 | *ptr ^= 0xabcd1234; | |
480 | ||
481 | break; | |
482 | } | |
93e2f585 | 483 | case CT_NONE: |
0347af4e SK |
484 | default: |
485 | break; | |
486 | } | |
487 | ||
488 | } | |
489 | ||
490 | static void lkdtm_handler(void) | |
491 | { | |
aa2c96d6 | 492 | unsigned long flags; |
92618184 | 493 | bool do_it = false; |
aa2c96d6 JH |
494 | |
495 | spin_lock_irqsave(&count_lock, flags); | |
0347af4e | 496 | count--; |
feac6e21 KC |
497 | pr_info("Crash point %s of type %s hit, trigger in %d rounds\n", |
498 | cp_name_to_str(cpoint), cp_type_to_str(cptype), count); | |
8bb31b9d AG |
499 | |
500 | if (count == 0) { | |
92618184 | 501 | do_it = true; |
8bb31b9d AG |
502 | count = cpoint_count; |
503 | } | |
aa2c96d6 | 504 | spin_unlock_irqrestore(&count_lock, flags); |
92618184 CW |
505 | |
506 | if (do_it) | |
507 | lkdtm_do_action(cptype); | |
8bb31b9d AG |
508 | } |
509 | ||
0347af4e | 510 | static int lkdtm_register_cpoint(enum cname which) |
8bb31b9d AG |
511 | { |
512 | int ret; | |
513 | ||
93e2f585 | 514 | cpoint = CN_INVALID; |
0347af4e SK |
515 | if (lkdtm.entry != NULL) |
516 | unregister_jprobe(&lkdtm); | |
8bb31b9d | 517 | |
0347af4e | 518 | switch (which) { |
93e2f585 | 519 | case CN_DIRECT: |
0347af4e SK |
520 | lkdtm_do_action(cptype); |
521 | return 0; | |
93e2f585 | 522 | case CN_INT_HARDWARE_ENTRY: |
f58f2fa9 | 523 | lkdtm.kp.symbol_name = "do_IRQ"; |
8bb31b9d AG |
524 | lkdtm.entry = (kprobe_opcode_t*) jp_do_irq; |
525 | break; | |
93e2f585 | 526 | case CN_INT_HW_IRQ_EN: |
8bb31b9d AG |
527 | lkdtm.kp.symbol_name = "handle_IRQ_event"; |
528 | lkdtm.entry = (kprobe_opcode_t*) jp_handle_irq_event; | |
529 | break; | |
93e2f585 | 530 | case CN_INT_TASKLET_ENTRY: |
8bb31b9d AG |
531 | lkdtm.kp.symbol_name = "tasklet_action"; |
532 | lkdtm.entry = (kprobe_opcode_t*) jp_tasklet_action; | |
533 | break; | |
93e2f585 | 534 | case CN_FS_DEVRW: |
8bb31b9d AG |
535 | lkdtm.kp.symbol_name = "ll_rw_block"; |
536 | lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block; | |
537 | break; | |
93e2f585 | 538 | case CN_MEM_SWAPOUT: |
18a61e4a AG |
539 | lkdtm.kp.symbol_name = "shrink_inactive_list"; |
540 | lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list; | |
8bb31b9d | 541 | break; |
93e2f585 | 542 | case CN_TIMERADD: |
8bb31b9d AG |
543 | lkdtm.kp.symbol_name = "hrtimer_start"; |
544 | lkdtm.entry = (kprobe_opcode_t*) jp_hrtimer_start; | |
545 | break; | |
93e2f585 | 546 | case CN_SCSI_DISPATCH_CMD: |
8bb31b9d AG |
547 | lkdtm.kp.symbol_name = "scsi_dispatch_cmd"; |
548 | lkdtm.entry = (kprobe_opcode_t*) jp_scsi_dispatch_cmd; | |
549 | break; | |
93e2f585 | 550 | case CN_IDE_CORE_CP: |
8bb31b9d AG |
551 | #ifdef CONFIG_IDE |
552 | lkdtm.kp.symbol_name = "generic_ide_ioctl"; | |
553 | lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl; | |
554 | #else | |
feac6e21 | 555 | pr_info("Crash point not available\n"); |
0347af4e | 556 | return -EINVAL; |
8bb31b9d AG |
557 | #endif |
558 | break; | |
559 | default: | |
feac6e21 | 560 | pr_info("Invalid Crash Point\n"); |
0347af4e | 561 | return -EINVAL; |
8bb31b9d AG |
562 | } |
563 | ||
0347af4e | 564 | cpoint = which; |
8bb31b9d | 565 | if ((ret = register_jprobe(&lkdtm)) < 0) { |
feac6e21 | 566 | pr_info("Couldn't register jprobe\n"); |
93e2f585 | 567 | cpoint = CN_INVALID; |
0347af4e SK |
568 | } |
569 | ||
570 | return ret; | |
571 | } | |
572 | ||
573 | static ssize_t do_register_entry(enum cname which, struct file *f, | |
574 | const char __user *user_buf, size_t count, loff_t *off) | |
575 | { | |
576 | char *buf; | |
577 | int err; | |
578 | ||
579 | if (count >= PAGE_SIZE) | |
580 | return -EINVAL; | |
581 | ||
582 | buf = (char *)__get_free_page(GFP_KERNEL); | |
583 | if (!buf) | |
584 | return -ENOMEM; | |
585 | if (copy_from_user(buf, user_buf, count)) { | |
586 | free_page((unsigned long) buf); | |
587 | return -EFAULT; | |
588 | } | |
589 | /* NULL-terminate and remove enter */ | |
590 | buf[count] = '\0'; | |
591 | strim(buf); | |
592 | ||
593 | cptype = parse_cp_type(buf, count); | |
594 | free_page((unsigned long) buf); | |
595 | ||
93e2f585 | 596 | if (cptype == CT_NONE) |
0347af4e SK |
597 | return -EINVAL; |
598 | ||
599 | err = lkdtm_register_cpoint(which); | |
600 | if (err < 0) | |
601 | return err; | |
602 | ||
603 | *off += count; | |
604 | ||
605 | return count; | |
606 | } | |
607 | ||
608 | /* Generic read callback that just prints out the available crash types */ | |
609 | static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf, | |
610 | size_t count, loff_t *off) | |
611 | { | |
612 | char *buf; | |
613 | int i, n, out; | |
614 | ||
615 | buf = (char *)__get_free_page(GFP_KERNEL); | |
086ff4b3 AC |
616 | if (buf == NULL) |
617 | return -ENOMEM; | |
0347af4e SK |
618 | |
619 | n = snprintf(buf, PAGE_SIZE, "Available crash types:\n"); | |
620 | for (i = 0; i < ARRAY_SIZE(cp_type); i++) | |
621 | n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]); | |
622 | buf[n] = '\0'; | |
623 | ||
624 | out = simple_read_from_buffer(user_buf, count, off, | |
625 | buf, n); | |
626 | free_page((unsigned long) buf); | |
627 | ||
628 | return out; | |
629 | } | |
630 | ||
631 | static int lkdtm_debugfs_open(struct inode *inode, struct file *file) | |
632 | { | |
633 | return 0; | |
634 | } | |
635 | ||
636 | ||
637 | static ssize_t int_hardware_entry(struct file *f, const char __user *buf, | |
638 | size_t count, loff_t *off) | |
639 | { | |
93e2f585 | 640 | return do_register_entry(CN_INT_HARDWARE_ENTRY, f, buf, count, off); |
0347af4e SK |
641 | } |
642 | ||
643 | static ssize_t int_hw_irq_en(struct file *f, const char __user *buf, | |
644 | size_t count, loff_t *off) | |
645 | { | |
93e2f585 | 646 | return do_register_entry(CN_INT_HW_IRQ_EN, f, buf, count, off); |
0347af4e SK |
647 | } |
648 | ||
649 | static ssize_t int_tasklet_entry(struct file *f, const char __user *buf, | |
650 | size_t count, loff_t *off) | |
651 | { | |
93e2f585 | 652 | return do_register_entry(CN_INT_TASKLET_ENTRY, f, buf, count, off); |
0347af4e SK |
653 | } |
654 | ||
655 | static ssize_t fs_devrw_entry(struct file *f, const char __user *buf, | |
656 | size_t count, loff_t *off) | |
657 | { | |
93e2f585 | 658 | return do_register_entry(CN_FS_DEVRW, f, buf, count, off); |
0347af4e SK |
659 | } |
660 | ||
661 | static ssize_t mem_swapout_entry(struct file *f, const char __user *buf, | |
662 | size_t count, loff_t *off) | |
663 | { | |
93e2f585 | 664 | return do_register_entry(CN_MEM_SWAPOUT, f, buf, count, off); |
0347af4e SK |
665 | } |
666 | ||
667 | static ssize_t timeradd_entry(struct file *f, const char __user *buf, | |
668 | size_t count, loff_t *off) | |
669 | { | |
93e2f585 | 670 | return do_register_entry(CN_TIMERADD, f, buf, count, off); |
0347af4e SK |
671 | } |
672 | ||
673 | static ssize_t scsi_dispatch_cmd_entry(struct file *f, | |
674 | const char __user *buf, size_t count, loff_t *off) | |
675 | { | |
93e2f585 | 676 | return do_register_entry(CN_SCSI_DISPATCH_CMD, f, buf, count, off); |
0347af4e SK |
677 | } |
678 | ||
679 | static ssize_t ide_core_cp_entry(struct file *f, const char __user *buf, | |
680 | size_t count, loff_t *off) | |
681 | { | |
93e2f585 | 682 | return do_register_entry(CN_IDE_CORE_CP, f, buf, count, off); |
0347af4e SK |
683 | } |
684 | ||
685 | /* Special entry to just crash directly. Available without KPROBEs */ | |
686 | static ssize_t direct_entry(struct file *f, const char __user *user_buf, | |
687 | size_t count, loff_t *off) | |
688 | { | |
689 | enum ctype type; | |
690 | char *buf; | |
691 | ||
692 | if (count >= PAGE_SIZE) | |
693 | return -EINVAL; | |
694 | if (count < 1) | |
695 | return -EINVAL; | |
696 | ||
697 | buf = (char *)__get_free_page(GFP_KERNEL); | |
698 | if (!buf) | |
699 | return -ENOMEM; | |
700 | if (copy_from_user(buf, user_buf, count)) { | |
701 | free_page((unsigned long) buf); | |
702 | return -EFAULT; | |
703 | } | |
704 | /* NULL-terminate and remove enter */ | |
705 | buf[count] = '\0'; | |
706 | strim(buf); | |
707 | ||
708 | type = parse_cp_type(buf, count); | |
709 | free_page((unsigned long) buf); | |
93e2f585 | 710 | if (type == CT_NONE) |
0347af4e SK |
711 | return -EINVAL; |
712 | ||
feac6e21 | 713 | pr_info("Performing direct entry %s\n", cp_type_to_str(type)); |
0347af4e SK |
714 | lkdtm_do_action(type); |
715 | *off += count; | |
716 | ||
717 | return count; | |
718 | } | |
719 | ||
720 | struct crash_entry { | |
721 | const char *name; | |
722 | const struct file_operations fops; | |
723 | }; | |
724 | ||
725 | static const struct crash_entry crash_entries[] = { | |
726 | {"DIRECT", {.read = lkdtm_debugfs_read, | |
05271ec4 | 727 | .llseek = generic_file_llseek, |
0347af4e SK |
728 | .open = lkdtm_debugfs_open, |
729 | .write = direct_entry} }, | |
730 | {"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read, | |
05271ec4 | 731 | .llseek = generic_file_llseek, |
0347af4e SK |
732 | .open = lkdtm_debugfs_open, |
733 | .write = int_hardware_entry} }, | |
734 | {"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read, | |
05271ec4 | 735 | .llseek = generic_file_llseek, |
0347af4e SK |
736 | .open = lkdtm_debugfs_open, |
737 | .write = int_hw_irq_en} }, | |
738 | {"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read, | |
05271ec4 | 739 | .llseek = generic_file_llseek, |
0347af4e SK |
740 | .open = lkdtm_debugfs_open, |
741 | .write = int_tasklet_entry} }, | |
742 | {"FS_DEVRW", {.read = lkdtm_debugfs_read, | |
05271ec4 | 743 | .llseek = generic_file_llseek, |
0347af4e SK |
744 | .open = lkdtm_debugfs_open, |
745 | .write = fs_devrw_entry} }, | |
746 | {"MEM_SWAPOUT", {.read = lkdtm_debugfs_read, | |
05271ec4 | 747 | .llseek = generic_file_llseek, |
0347af4e SK |
748 | .open = lkdtm_debugfs_open, |
749 | .write = mem_swapout_entry} }, | |
750 | {"TIMERADD", {.read = lkdtm_debugfs_read, | |
05271ec4 | 751 | .llseek = generic_file_llseek, |
0347af4e SK |
752 | .open = lkdtm_debugfs_open, |
753 | .write = timeradd_entry} }, | |
754 | {"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read, | |
05271ec4 | 755 | .llseek = generic_file_llseek, |
0347af4e SK |
756 | .open = lkdtm_debugfs_open, |
757 | .write = scsi_dispatch_cmd_entry} }, | |
758 | {"IDE_CORE_CP", {.read = lkdtm_debugfs_read, | |
05271ec4 | 759 | .llseek = generic_file_llseek, |
0347af4e SK |
760 | .open = lkdtm_debugfs_open, |
761 | .write = ide_core_cp_entry} }, | |
762 | }; | |
763 | ||
764 | static struct dentry *lkdtm_debugfs_root; | |
765 | ||
766 | static int __init lkdtm_module_init(void) | |
767 | { | |
768 | int ret = -EINVAL; | |
769 | int n_debugfs_entries = 1; /* Assume only the direct entry */ | |
770 | int i; | |
771 | ||
772 | /* Register debugfs interface */ | |
773 | lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL); | |
774 | if (!lkdtm_debugfs_root) { | |
feac6e21 | 775 | pr_err("creating root dir failed\n"); |
0347af4e SK |
776 | return -ENODEV; |
777 | } | |
778 | ||
779 | #ifdef CONFIG_KPROBES | |
780 | n_debugfs_entries = ARRAY_SIZE(crash_entries); | |
781 | #endif | |
782 | ||
783 | for (i = 0; i < n_debugfs_entries; i++) { | |
784 | const struct crash_entry *cur = &crash_entries[i]; | |
785 | struct dentry *de; | |
786 | ||
787 | de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root, | |
788 | NULL, &cur->fops); | |
789 | if (de == NULL) { | |
feac6e21 | 790 | pr_err("could not create %s\n", cur->name); |
0347af4e SK |
791 | goto out_err; |
792 | } | |
793 | } | |
794 | ||
795 | if (lkdtm_parse_commandline() == -EINVAL) { | |
feac6e21 | 796 | pr_info("Invalid command\n"); |
0347af4e SK |
797 | goto out_err; |
798 | } | |
799 | ||
93e2f585 | 800 | if (cpoint != CN_INVALID && cptype != CT_NONE) { |
0347af4e SK |
801 | ret = lkdtm_register_cpoint(cpoint); |
802 | if (ret < 0) { | |
feac6e21 | 803 | pr_info("Invalid crash point %d\n", cpoint); |
0347af4e SK |
804 | goto out_err; |
805 | } | |
feac6e21 KC |
806 | pr_info("Crash point %s of type %s registered\n", |
807 | cpoint_name, cpoint_type); | |
0347af4e | 808 | } else { |
feac6e21 | 809 | pr_info("No crash points registered, enable through debugfs\n"); |
8bb31b9d AG |
810 | } |
811 | ||
8bb31b9d | 812 | return 0; |
0347af4e SK |
813 | |
814 | out_err: | |
815 | debugfs_remove_recursive(lkdtm_debugfs_root); | |
816 | return ret; | |
8bb31b9d AG |
817 | } |
818 | ||
2118116e | 819 | static void __exit lkdtm_module_exit(void) |
8bb31b9d | 820 | { |
0347af4e SK |
821 | debugfs_remove_recursive(lkdtm_debugfs_root); |
822 | ||
823 | unregister_jprobe(&lkdtm); | |
feac6e21 | 824 | pr_info("Crash point unregistered\n"); |
8bb31b9d AG |
825 | } |
826 | ||
827 | module_init(lkdtm_module_init); | |
828 | module_exit(lkdtm_module_exit); | |
829 | ||
830 | MODULE_LICENSE("GPL"); |