[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / misc / lkdtm.c

/*
 * Kprobe module for testing crash dumps
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 * Copyright (C) IBM Corporation, 2006
 *
 * Author: Ankita Garg <ankita@in.ibm.com>
 *
 * This module induces system failures at predefined crashpoints to
 * evaluate the reliability of crash dumps obtained using different dumping
 * solutions.
 *
 * It is adapted from the Linux Kernel Dump Test Tool by
 * Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
 *
 * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
 *
 * See Documentation/fault-injection/provoke-crashes.txt for instructions
 */

#include <linux/kernel.h>
#include <linux/fs.h>
#include <linux/module.h>
#include <linux/buffer_head.h>
#include <linux/kprobes.h>
#include <linux/list.h>
#include <linux/init.h>
#include <linux/interrupt.h>
#include <linux/hrtimer.h>
#include <linux/slab.h>
#include <scsi/scsi_cmnd.h>
#include <linux/debugfs.h>

#ifdef CONFIG_IDE
#include <linux/ide.h>
#endif

#define DEFAULT_COUNT 10
#define REC_NUM_DEFAULT 10

enum cname {
	INVALID,
	INT_HARDWARE_ENTRY,
	INT_HW_IRQ_EN,
	INT_TASKLET_ENTRY,
	FS_DEVRW,
	MEM_SWAPOUT,
	TIMERADD,
	SCSI_DISPATCH_CMD,
	IDE_CORE_CP,
	DIRECT,
};

enum ctype {
	NONE,
	PANIC,
	BUG,
	EXCEPTION,
	LOOP,
	OVERFLOW,
	CORRUPT_STACK,
	UNALIGNED_LOAD_STORE_WRITE,
	OVERWRITE_ALLOCATION,
	WRITE_AFTER_FREE,
};

static char* cp_name[] = {
	"INT_HARDWARE_ENTRY",
	"INT_HW_IRQ_EN",
	"INT_TASKLET_ENTRY",
	"FS_DEVRW",
	"MEM_SWAPOUT",
	"TIMERADD",
	"SCSI_DISPATCH_CMD",
	"IDE_CORE_CP",
	"DIRECT",
};

static char* cp_type[] = {
	"PANIC",
	"BUG",
	"EXCEPTION",
	"LOOP",
	"OVERFLOW",
	"CORRUPT_STACK",
	"UNALIGNED_LOAD_STORE_WRITE",
	"OVERWRITE_ALLOCATION",
	"WRITE_AFTER_FREE",
};

static struct jprobe lkdtm;

static int lkdtm_parse_commandline(void);
static void lkdtm_handler(void);

static char* cpoint_name;
static char* cpoint_type;
static int cpoint_count = DEFAULT_COUNT;
static int recur_count = REC_NUM_DEFAULT;

static enum cname cpoint = INVALID;
static enum ctype cptype = NONE;
static int count = DEFAULT_COUNT;

module_param(recur_count, int, 0644);
MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
				 "default is 10");
module_param(cpoint_name, charp, 0644);
MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed");
module_param(cpoint_type, charp, 0644);
MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\
				"hitting the crash point");
module_param(cpoint_count, int, 0644);
MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\
				"crash point is to be hit to trigger action");

static unsigned int jp_do_irq(unsigned int irq)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}

static irqreturn_t jp_handle_irq_event(unsigned int irq,
				       struct irqaction *action)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}

static void jp_tasklet_action(struct softirq_action *a)
{
	lkdtm_handler();
	jprobe_return();
}

static void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
{
	lkdtm_handler();
	jprobe_return();
}

struct scan_control;

static unsigned long jp_shrink_inactive_list(unsigned long max_scan,
					     struct zone *zone,
					     struct scan_control *sc)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}

static int jp_hrtimer_start(struct hrtimer *timer, ktime_t tim,
			    const enum hrtimer_mode mode)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}

static int jp_scsi_dispatch_cmd(struct scsi_cmnd *cmd)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}

#ifdef CONFIG_IDE
int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file,
			struct block_device *bdev, unsigned int cmd,
			unsigned long arg)
{
	lkdtm_handler();
	jprobe_return();
	return 0;
}
#endif

/* Return the crashpoint number or NONE if the name is invalid */
static enum ctype parse_cp_type(const char *what, size_t count)
{
	int i;

	for (i = 0; i < ARRAY_SIZE(cp_type); i++) {
		if (!strcmp(what, cp_type[i]))
			return i + 1;
	}

	return NONE;
}

static const char *cp_type_to_str(enum ctype type)
{
	if (type == NONE || type < 0 || type > ARRAY_SIZE(cp_type))
		return "None";

	return cp_type[type - 1];
}

static const char *cp_name_to_str(enum cname name)
{
	if (name == INVALID || name < 0 || name > ARRAY_SIZE(cp_name))
		return "INVALID";

	return cp_name[name - 1];
}


static int lkdtm_parse_commandline(void)
{
	int i;

	if (cpoint_count < 1 || recur_count < 1)
		return -EINVAL;

	count = cpoint_count;

	/* No special parameters */
	if (!cpoint_type && !cpoint_name)
		return 0;

	/* Neither or both of these need to be set */
	if (!cpoint_type || !cpoint_name)
		return -EINVAL;

	cptype = parse_cp_type(cpoint_type, strlen(cpoint_type));
	if (cptype == NONE)
		return -EINVAL;

	for (i = 0; i < ARRAY_SIZE(cp_name); i++) {
		if (!strcmp(cpoint_name, cp_name[i])) {
			cpoint = i + 1;
			return 0;
		}
	}

	/* Could not find a valid crash point */
	return -EINVAL;
}

static int recursive_loop(int a)
{
	char buf[1024];

	memset(buf,0xFF,1024);
	recur_count--;
	if (!recur_count)
		return 0;
	else
        	return recursive_loop(a);
}

static void lkdtm_do_action(enum ctype which)
{
	switch (which) {
	case PANIC:
		panic("dumptest");
		break;
	case BUG:
		BUG();
		break;
	case EXCEPTION:
		*((int *) 0) = 0;
		break;
	case LOOP:
		for (;;)
			;
		break;
	case OVERFLOW:
		(void) recursive_loop(0);
		break;
	case CORRUPT_STACK: {
		volatile u32 data[8];
		volatile u32 *p = data;

		p[12] = 0x12345678;
		break;
	}
	case UNALIGNED_LOAD_STORE_WRITE: {
		static u8 data[5] __attribute__((aligned(4))) = {1, 2,
				3, 4, 5};
		u32 *p;
		u32 val = 0x12345678;

		p = (u32 *)(data + 1);
		if (*p == 0)
			val = 0x87654321;
		*p = val;
		 break;
	}
	case OVERWRITE_ALLOCATION: {
		size_t len = 1020;
		u32 *data = kmalloc(len, GFP_KERNEL);

		data[1024 / sizeof(u32)] = 0x12345678;
		kfree(data);
		break;
	}
	case WRITE_AFTER_FREE: {
		size_t len = 1024;
		u32 *data = kmalloc(len, GFP_KERNEL);

		kfree(data);
		schedule();
		memset(data, 0x78, len);
		break;
	}
	case NONE:
	default:
		break;
	}

}

static void lkdtm_handler(void)
{
	count--;
	printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
			cp_name_to_str(cpoint), cp_type_to_str(cptype), count);

	if (count == 0) {
		lkdtm_do_action(cptype);
		count = cpoint_count;
	}
}

static int lkdtm_register_cpoint(enum cname which)
{
	int ret;

	cpoint = INVALID;
	if (lkdtm.entry != NULL)
		unregister_jprobe(&lkdtm);

	switch (which) {
	case DIRECT:
		lkdtm_do_action(cptype);
		return 0;
	case INT_HARDWARE_ENTRY:
		lkdtm.kp.symbol_name = "do_IRQ";
		lkdtm.entry = (kprobe_opcode_t*) jp_do_irq;
		break;
	case INT_HW_IRQ_EN:
		lkdtm.kp.symbol_name = "handle_IRQ_event";
		lkdtm.entry = (kprobe_opcode_t*) jp_handle_irq_event;
		break;
	case INT_TASKLET_ENTRY:
		lkdtm.kp.symbol_name = "tasklet_action";
		lkdtm.entry = (kprobe_opcode_t*) jp_tasklet_action;
		break;
	case FS_DEVRW:
		lkdtm.kp.symbol_name = "ll_rw_block";
		lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block;
		break;
	case MEM_SWAPOUT:
		lkdtm.kp.symbol_name = "shrink_inactive_list";
		lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list;
		break;
	case TIMERADD:
		lkdtm.kp.symbol_name = "hrtimer_start";
		lkdtm.entry = (kprobe_opcode_t*) jp_hrtimer_start;
		break;
	case SCSI_DISPATCH_CMD:
		lkdtm.kp.symbol_name = "scsi_dispatch_cmd";
		lkdtm.entry = (kprobe_opcode_t*) jp_scsi_dispatch_cmd;
		break;
	case IDE_CORE_CP:
#ifdef CONFIG_IDE
		lkdtm.kp.symbol_name = "generic_ide_ioctl";
		lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl;
#else
		printk(KERN_INFO "lkdtm: Crash point not available\n");
		return -EINVAL;
#endif
		break;
	default:
		printk(KERN_INFO "lkdtm: Invalid Crash Point\n");
		return -EINVAL;
	}

	cpoint = which;
	if ((ret = register_jprobe(&lkdtm)) < 0) {
		printk(KERN_INFO "lkdtm: Couldn't register jprobe\n");
		cpoint = INVALID;
	}

	return ret;
}

static ssize_t do_register_entry(enum cname which, struct file *f,
		const char __user *user_buf, size_t count, loff_t *off)
{
	char *buf;
	int err;

	if (count >= PAGE_SIZE)
		return -EINVAL;

	buf = (char *)__get_free_page(GFP_KERNEL);
	if (!buf)
		return -ENOMEM;
	if (copy_from_user(buf, user_buf, count)) {
		free_page((unsigned long) buf);
		return -EFAULT;
	}
	/* NULL-terminate and remove enter */
	buf[count] = '\0';
	strim(buf);

	cptype = parse_cp_type(buf, count);
	free_page((unsigned long) buf);

	if (cptype == NONE)
		return -EINVAL;

	err = lkdtm_register_cpoint(which);
	if (err < 0)
		return err;

	*off += count;

	return count;
}

/* Generic read callback that just prints out the available crash types */
static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
		size_t count, loff_t *off)
{
	char *buf;
	int i, n, out;

	buf = (char *)__get_free_page(GFP_KERNEL);

	n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
	for (i = 0; i < ARRAY_SIZE(cp_type); i++)
		n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]);
	buf[n] = '\0';

	out = simple_read_from_buffer(user_buf, count, off,
				      buf, n);
	free_page((unsigned long) buf);

	return out;
}

static int lkdtm_debugfs_open(struct inode *inode, struct file *file)
{
	return 0;
}


static ssize_t int_hardware_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(INT_HARDWARE_ENTRY, f, buf, count, off);
}

static ssize_t int_hw_irq_en(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(INT_HW_IRQ_EN, f, buf, count, off);
}

static ssize_t int_tasklet_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(INT_TASKLET_ENTRY, f, buf, count, off);
}

static ssize_t fs_devrw_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(FS_DEVRW, f, buf, count, off);
}

static ssize_t mem_swapout_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(MEM_SWAPOUT, f, buf, count, off);
}

static ssize_t timeradd_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(TIMERADD, f, buf, count, off);
}

static ssize_t scsi_dispatch_cmd_entry(struct file *f,
		const char __user *buf, size_t count, loff_t *off)
{
	return do_register_entry(SCSI_DISPATCH_CMD, f, buf, count, off);
}

static ssize_t ide_core_cp_entry(struct file *f, const char __user *buf,
		size_t count, loff_t *off)
{
	return do_register_entry(IDE_CORE_CP, f, buf, count, off);
}

/* Special entry to just crash directly. Available without KPROBEs */
static ssize_t direct_entry(struct file *f, const char __user *user_buf,
		size_t count, loff_t *off)
{
	enum ctype type;
	char *buf;

	if (count >= PAGE_SIZE)
		return -EINVAL;
	if (count < 1)
		return -EINVAL;

	buf = (char *)__get_free_page(GFP_KERNEL);
	if (!buf)
		return -ENOMEM;
	if (copy_from_user(buf, user_buf, count)) {
		free_page((unsigned long) buf);
		return -EFAULT;
	}
	/* NULL-terminate and remove enter */
	buf[count] = '\0';
	strim(buf);

	type = parse_cp_type(buf, count);
	free_page((unsigned long) buf);
	if (type == NONE)
		return -EINVAL;

	printk(KERN_INFO "lkdtm: Performing direct entry %s\n",
			cp_type_to_str(type));
	lkdtm_do_action(type);
	*off += count;

	return count;
}

struct crash_entry {
	const char *name;
	const struct file_operations fops;
};

static const struct crash_entry crash_entries[] = {
	{"DIRECT", {.read = lkdtm_debugfs_read,
			.open = lkdtm_debugfs_open,
			.write = direct_entry} },
	{"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read,
			.open = lkdtm_debugfs_open,
			.write = int_hardware_entry} },
	{"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read,
			.open = lkdtm_debugfs_open,
			.write = int_hw_irq_en} },
	{"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read,
			.open = lkdtm_debugfs_open,
			.write = int_tasklet_entry} },
	{"FS_DEVRW", {.read = lkdtm_debugfs_read,
			.open = lkdtm_debugfs_open,
			.write = fs_devrw_entry} },
	{"MEM_SWAPOUT", {.read = lkdtm_debugfs_read,
			.open = lkdtm_debugfs_open,
			.write = mem_swapout_entry} },
	{"TIMERADD", {.read = lkdtm_debugfs_read,
			.open = lkdtm_debugfs_open,
			.write = timeradd_entry} },
	{"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read,
			.open = lkdtm_debugfs_open,
			.write = scsi_dispatch_cmd_entry} },
	{"IDE_CORE_CP",	{.read = lkdtm_debugfs_read,
			.open = lkdtm_debugfs_open,
			.write = ide_core_cp_entry} },
};

static struct dentry *lkdtm_debugfs_root;

static int __init lkdtm_module_init(void)
{
	int ret = -EINVAL;
	int n_debugfs_entries = 1; /* Assume only the direct entry */
	int i;

	/* Register debugfs interface */
	lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
	if (!lkdtm_debugfs_root) {
		printk(KERN_ERR "lkdtm: creating root dir failed\n");
		return -ENODEV;
	}

#ifdef CONFIG_KPROBES
	n_debugfs_entries = ARRAY_SIZE(crash_entries);
#endif

	for (i = 0; i < n_debugfs_entries; i++) {
		const struct crash_entry *cur = &crash_entries[i];
		struct dentry *de;

		de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
				NULL, &cur->fops);
		if (de == NULL) {
			printk(KERN_ERR "lkdtm: could not create %s\n",
					cur->name);
			goto out_err;
		}
	}

	if (lkdtm_parse_commandline() == -EINVAL) {
		printk(KERN_INFO "lkdtm: Invalid command\n");
		goto out_err;
	}

	if (cpoint != INVALID && cptype != NONE) {
		ret = lkdtm_register_cpoint(cpoint);
		if (ret < 0) {
			printk(KERN_INFO "lkdtm: Invalid crash point %d\n",
					cpoint);
			goto out_err;
		}
		printk(KERN_INFO "lkdtm: Crash point %s of type %s registered\n",
				cpoint_name, cpoint_type);
	} else {
		printk(KERN_INFO "lkdtm: No crash points registered, enable through debugfs\n");
	}

	return 0;

out_err:
	debugfs_remove_recursive(lkdtm_debugfs_root);
	return ret;
}

static void __exit lkdtm_module_exit(void)
{
	debugfs_remove_recursive(lkdtm_debugfs_root);

	unregister_jprobe(&lkdtm);
	printk(KERN_INFO "lkdtm: Crash point unregistered\n");
}

module_init(lkdtm_module_init);
module_exit(lkdtm_module_exit);

MODULE_LICENSE("GPL");
Commit	Line	Data
8bb31b9d AG	1	/*
	2	* Kprobe module for testing crash dumps
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License as published by
	6	* the Free Software Foundation; either version 2 of the License, or
	7	* (at your option) any later version.
	8	*
	9	* This program is distributed in the hope that it will be useful,
	10	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	11	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	12	* GNU General Public License for more details.
	13	*
	14	* You should have received a copy of the GNU General Public License
	15	* along with this program; if not, write to the Free Software
	16	* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
	17	*
	18	* Copyright (C) IBM Corporation, 2006
	19	*
	20	* Author: Ankita Garg <ankita@in.ibm.com>
	21	*
	22	* This module induces system failures at predefined crashpoints to
	23	* evaluate the reliability of crash dumps obtained using different dumping
	24	* solutions.
	25	*
	26	* It is adapted from the Linux Kernel Dump Test Tool by
	27	* Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
	28	*
0347af4e	29	* Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
8bb31b9d	30	*
0347af4e	31	* See Documentation/fault-injection/provoke-crashes.txt for instructions
8bb31b9d AG	32	*/
	33
	34	#include <linux/kernel.h>
5d861d92	35	#include <linux/fs.h>
8bb31b9d	36	#include <linux/module.h>
5d861d92	37	#include <linux/buffer_head.h>
8bb31b9d	38	#include <linux/kprobes.h>
5d861d92	39	#include <linux/list.h>
8bb31b9d	40	#include <linux/init.h>
8bb31b9d	41	#include <linux/interrupt.h>
5d861d92	42	#include <linux/hrtimer.h>
5a0e3ad6	43	#include <linux/slab.h>
8bb31b9d	44	#include <scsi/scsi_cmnd.h>
0347af4e	45	#include <linux/debugfs.h>
8bb31b9d AG	46
	47	#ifdef CONFIG_IDE
	48	#include <linux/ide.h>
	49	#endif
	50
8bb31b9d AG	51	#define DEFAULT_COUNT 10
	52	#define REC_NUM_DEFAULT 10
	53
	54	enum cname {
	55	INVALID,
	56	INT_HARDWARE_ENTRY,
	57	INT_HW_IRQ_EN,
	58	INT_TASKLET_ENTRY,
	59	FS_DEVRW,
	60	MEM_SWAPOUT,
	61	TIMERADD,
	62	SCSI_DISPATCH_CMD,
0347af4e SK	63	IDE_CORE_CP,
0347af4e SK	64	DIRECT,
8bb31b9d AG	65	};
	66
	67	enum ctype {
	68	NONE,
	69	PANIC,
	70	BUG,
	71	EXCEPTION,
	72	LOOP,
0347af4e SK	73	OVERFLOW,
	74	CORRUPT_STACK,
	75	UNALIGNED_LOAD_STORE_WRITE,
	76	OVERWRITE_ALLOCATION,
	77	WRITE_AFTER_FREE,
8bb31b9d AG	78	};
	79
	80	static char* cp_name[] = {
	81	"INT_HARDWARE_ENTRY",
	82	"INT_HW_IRQ_EN",
	83	"INT_TASKLET_ENTRY",
	84	"FS_DEVRW",
	85	"MEM_SWAPOUT",
	86	"TIMERADD",
	87	"SCSI_DISPATCH_CMD",
0347af4e SK	88	"IDE_CORE_CP",
0347af4e SK	89	"DIRECT",
8bb31b9d AG	90	};
	91
	92	static char* cp_type[] = {
	93	"PANIC",
	94	"BUG",
	95	"EXCEPTION",
	96	"LOOP",
0347af4e SK	97	"OVERFLOW",
	98	"CORRUPT_STACK",
	99	"UNALIGNED_LOAD_STORE_WRITE",
	100	"OVERWRITE_ALLOCATION",
	101	"WRITE_AFTER_FREE",
8bb31b9d AG	102	};
	103
	104	static struct jprobe lkdtm;
	105
	106	static int lkdtm_parse_commandline(void);
	107	static void lkdtm_handler(void);
	108
ec1c620b AV	109	static char* cpoint_name;
ec1c620b AV	110	static char* cpoint_type;
8bb31b9d AG	111	static int cpoint_count = DEFAULT_COUNT;
	112	static int recur_count = REC_NUM_DEFAULT;
	113
	114	static enum cname cpoint = INVALID;
	115	static enum ctype cptype = NONE;
	116	static int count = DEFAULT_COUNT;
	117
	118	module_param(recur_count, int, 0644);
5d861d92 RD	119	MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
5d861d92 RD	120	"default is 10");
8bb31b9d	121	module_param(cpoint_name, charp, 0644);
5d861d92 RD	122	MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed");
	123	module_param(cpoint_type, charp, 0644);
	124	MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\
	125	"hitting the crash point");
	126	module_param(cpoint_count, int, 0644);
	127	MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\
	128	"crash point is to be hit to trigger action");
8bb31b9d	129
2118116e	130	static unsigned int jp_do_irq(unsigned int irq)
8bb31b9d AG	131	{
	132	lkdtm_handler();
	133	jprobe_return();
	134	return 0;
	135	}
	136
2118116e AB	137	static irqreturn_t jp_handle_irq_event(unsigned int irq,
2118116e AB	138	struct irqaction *action)
8bb31b9d AG	139	{
	140	lkdtm_handler();
	141	jprobe_return();
	142	return 0;
	143	}
	144
2118116e	145	static void jp_tasklet_action(struct softirq_action *a)
8bb31b9d AG	146	{
	147	lkdtm_handler();
	148	jprobe_return();
	149	}
	150
2118116e	151	static void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
8bb31b9d AG	152	{
	153	lkdtm_handler();
	154	jprobe_return();
	155	}
	156
	157	struct scan_control;
	158
2118116e AB	159	static unsigned long jp_shrink_inactive_list(unsigned long max_scan,
	160	struct zone *zone,
	161	struct scan_control *sc)
8bb31b9d AG	162	{
	163	lkdtm_handler();
	164	jprobe_return();
	165	return 0;
	166	}
	167
2118116e AB	168	static int jp_hrtimer_start(struct hrtimer *timer, ktime_t tim,
2118116e AB	169	const enum hrtimer_mode mode)
8bb31b9d AG	170	{
	171	lkdtm_handler();
	172	jprobe_return();
	173	return 0;
	174	}
	175
2118116e	176	static int jp_scsi_dispatch_cmd(struct scsi_cmnd *cmd)
8bb31b9d AG	177	{
	178	lkdtm_handler();
	179	jprobe_return();
	180	return 0;
	181	}
	182
	183	#ifdef CONFIG_IDE
	184	int jp_generic_ide_ioctl(ide_drive_t drive, struct file file,
	185	struct block_device *bdev, unsigned int cmd,
	186	unsigned long arg)
	187	{
	188	lkdtm_handler();
	189	jprobe_return();
	190	return 0;
	191	}
	192	#endif
	193
0347af4e SK	194	/* Return the crashpoint number or NONE if the name is invalid */
	195	static enum ctype parse_cp_type(const char *what, size_t count)
	196	{
	197	int i;
	198
	199	for (i = 0; i < ARRAY_SIZE(cp_type); i++) {
	200	if (!strcmp(what, cp_type[i]))
	201	return i + 1;
	202	}
	203
	204	return NONE;
	205	}
	206
	207	static const char *cp_type_to_str(enum ctype type)
	208	{
	209	if (type == NONE \|\| type < 0 \|\| type > ARRAY_SIZE(cp_type))
	210	return "None";
	211
	212	return cp_type[type - 1];
	213	}
	214
	215	static const char *cp_name_to_str(enum cname name)
	216	{
	217	if (name == INVALID \|\| name < 0 \|\| name > ARRAY_SIZE(cp_name))
	218	return "INVALID";
	219
	220	return cp_name[name - 1];
	221	}
	222
	223
8bb31b9d AG	224	static int lkdtm_parse_commandline(void)
	225	{
	226	int i;
	227
0347af4e	228	if (cpoint_count < 1 \|\| recur_count < 1)
8bb31b9d AG	229	return -EINVAL;
8bb31b9d AG	230
0347af4e SK	231	count = cpoint_count;
	232
	233	/* No special parameters */
	234	if (!cpoint_type && !cpoint_name)
	235	return 0;
	236
	237	/* Neither or both of these need to be set */
	238	if (!cpoint_type \|\| !cpoint_name)
	239	return -EINVAL;
	240
	241	cptype = parse_cp_type(cpoint_type, strlen(cpoint_type));
	242	if (cptype == NONE)
	243	return -EINVAL;
	244
	245	for (i = 0; i < ARRAY_SIZE(cp_name); i++) {
8bb31b9d AG	246	if (!strcmp(cpoint_name, cp_name[i])) {
8bb31b9d AG	247	cpoint = i + 1;
0347af4e	248	return 0;
8bb31b9d AG	249	}
	250	}
	251
0347af4e SK	252	/* Could not find a valid crash point */
0347af4e SK	253	return -EINVAL;
8bb31b9d AG	254	}
	255
	256	static int recursive_loop(int a)
	257	{
	258	char buf[1024];
	259
	260	memset(buf,0xFF,1024);
	261	recur_count--;
	262	if (!recur_count)
	263	return 0;
	264	else
	265	return recursive_loop(a);
	266	}
	267
0347af4e	268	static void lkdtm_do_action(enum ctype which)
8bb31b9d	269	{
0347af4e SK	270	switch (which) {
	271	case PANIC:
	272	panic("dumptest");
	273	break;
	274	case BUG:
	275	BUG();
	276	break;
	277	case EXCEPTION:
	278	((int ) 0) = 0;
	279	break;
	280	case LOOP:
	281	for (;;)
	282	;
	283	break;
	284	case OVERFLOW:
	285	(void) recursive_loop(0);
	286	break;
	287	case CORRUPT_STACK: {
	288	volatile u32 data[8];
	289	volatile u32 *p = data;
	290
	291	p[12] = 0x12345678;
	292	break;
	293	}
	294	case UNALIGNED_LOAD_STORE_WRITE: {
	295	static u8 data[5] __attribute__((aligned(4))) = {1, 2,
	296	3, 4, 5};
	297	u32 *p;
	298	u32 val = 0x12345678;
	299
	300	p = (u32 *)(data + 1);
	301	if (*p == 0)
	302	val = 0x87654321;
	303	*p = val;
	304	break;
	305	}
	306	case OVERWRITE_ALLOCATION: {
	307	size_t len = 1020;
	308	u32 *data = kmalloc(len, GFP_KERNEL);
	309
	310	data[1024 / sizeof(u32)] = 0x12345678;
	311	kfree(data);
	312	break;
	313	}
	314	case WRITE_AFTER_FREE: {
	315	size_t len = 1024;
	316	u32 *data = kmalloc(len, GFP_KERNEL);
	317
	318	kfree(data);
	319	schedule();
	320	memset(data, 0x78, len);
	321	break;
	322	}
	323	case NONE:
	324	default:
	325	break;
	326	}
	327
	328	}
	329
	330	static void lkdtm_handler(void)
	331	{
	332	count--;
	333	printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
334	cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
8bb31b9d AG	335
8bb31b9d AG	336	if (count == 0) {
0347af4e	337	lkdtm_do_action(cptype);
8bb31b9d AG	338	count = cpoint_count;
	339	}
	340	}
	341
0347af4e	342	static int lkdtm_register_cpoint(enum cname which)
8bb31b9d AG	343	{
	344	int ret;
	345
0347af4e SK	346	cpoint = INVALID;
	347	if (lkdtm.entry != NULL)
	348	unregister_jprobe(&lkdtm);
8bb31b9d	349
0347af4e SK	350	switch (which) {
	351	case DIRECT:
	352	lkdtm_do_action(cptype);
	353	return 0;
8bb31b9d	354	case INT_HARDWARE_ENTRY:
f58f2fa9	355	lkdtm.kp.symbol_name = "do_IRQ";
8bb31b9d AG	356	lkdtm.entry = (kprobe_opcode_t*) jp_do_irq;
	357	break;
	358	case INT_HW_IRQ_EN:
	359	lkdtm.kp.symbol_name = "handle_IRQ_event";
	360	lkdtm.entry = (kprobe_opcode_t*) jp_handle_irq_event;
	361	break;
	362	case INT_TASKLET_ENTRY:
	363	lkdtm.kp.symbol_name = "tasklet_action";
	364	lkdtm.entry = (kprobe_opcode_t*) jp_tasklet_action;
	365	break;
	366	case FS_DEVRW:
	367	lkdtm.kp.symbol_name = "ll_rw_block";
	368	lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block;
	369	break;
	370	case MEM_SWAPOUT:
18a61e4a AG	371	lkdtm.kp.symbol_name = "shrink_inactive_list";
18a61e4a AG	372	lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list;
8bb31b9d AG	373	break;
	374	case TIMERADD:
	375	lkdtm.kp.symbol_name = "hrtimer_start";
	376	lkdtm.entry = (kprobe_opcode_t*) jp_hrtimer_start;
	377	break;
	378	case SCSI_DISPATCH_CMD:
	379	lkdtm.kp.symbol_name = "scsi_dispatch_cmd";
	380	lkdtm.entry = (kprobe_opcode_t*) jp_scsi_dispatch_cmd;
	381	break;
	382	case IDE_CORE_CP:
	383	#ifdef CONFIG_IDE
	384	lkdtm.kp.symbol_name = "generic_ide_ioctl";
	385	lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl;
	386	#else
0347af4e SK	387	printk(KERN_INFO "lkdtm: Crash point not available\n");
0347af4e SK	388	return -EINVAL;
8bb31b9d AG	389	#endif
	390	break;
	391	default:
0347af4e SK	392	printk(KERN_INFO "lkdtm: Invalid Crash Point\n");
0347af4e SK	393	return -EINVAL;
8bb31b9d AG	394	}
8bb31b9d AG	395
0347af4e	396	cpoint = which;
8bb31b9d	397	if ((ret = register_jprobe(&lkdtm)) < 0) {
0347af4e SK	398	printk(KERN_INFO "lkdtm: Couldn't register jprobe\n");
	399	cpoint = INVALID;
	400	}
	401
	402	return ret;
	403	}
	404
	405	static ssize_t do_register_entry(enum cname which, struct file *f,
	406	const char __user user_buf, size_t count, loff_t off)
	407	{
	408	char *buf;
	409	int err;
	410
	411	if (count >= PAGE_SIZE)
	412	return -EINVAL;
	413
	414	buf = (char *)__get_free_page(GFP_KERNEL);
	415	if (!buf)
	416	return -ENOMEM;
	417	if (copy_from_user(buf, user_buf, count)) {
	418	free_page((unsigned long) buf);
	419	return -EFAULT;
	420	}
	421	/* NULL-terminate and remove enter */
	422	buf[count] = '\0';
	423	strim(buf);
	424
	425	cptype = parse_cp_type(buf, count);
	426	free_page((unsigned long) buf);
	427
	428	if (cptype == NONE)
	429	return -EINVAL;
	430
	431	err = lkdtm_register_cpoint(which);
	432	if (err < 0)
	433	return err;
	434
	435	*off += count;
	436
	437	return count;
	438	}
	439
	440	/* Generic read callback that just prints out the available crash types */
	441	static ssize_t lkdtm_debugfs_read(struct file f, char __user user_buf,
	442	size_t count, loff_t *off)
	443	{
	444	char *buf;
	445	int i, n, out;
	446
	447	buf = (char *)__get_free_page(GFP_KERNEL);
	448
	449	n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
	450	for (i = 0; i < ARRAY_SIZE(cp_type); i++)
	451	n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]);
	452	buf[n] = '\0';
	453
	454	out = simple_read_from_buffer(user_buf, count, off,
	455	buf, n);
	456	free_page((unsigned long) buf);
	457
	458	return out;
	459	}
	460
	461	static int lkdtm_debugfs_open(struct inode inode, struct file file)
462	{
463	return 0;
464	}
465
466
467	static ssize_t int_hardware_entry(struct file f, const char __user buf,
468	size_t count, loff_t *off)
469	{
470	return do_register_entry(INT_HARDWARE_ENTRY, f, buf, count, off);
471	}
472
473	static ssize_t int_hw_irq_en(struct file f, const char __user buf,
474	size_t count, loff_t *off)
475	{
476	return do_register_entry(INT_HW_IRQ_EN, f, buf, count, off);
477	}
478
479	static ssize_t int_tasklet_entry(struct file f, const char __user buf,
480	size_t count, loff_t *off)
481	{
482	return do_register_entry(INT_TASKLET_ENTRY, f, buf, count, off);
483	}
484
485	static ssize_t fs_devrw_entry(struct file f, const char __user buf,
486	size_t count, loff_t *off)
487	{
488	return do_register_entry(FS_DEVRW, f, buf, count, off);
489	}
490
491	static ssize_t mem_swapout_entry(struct file f, const char __user buf,
492	size_t count, loff_t *off)
493	{
494	return do_register_entry(MEM_SWAPOUT, f, buf, count, off);
495	}
496
497	static ssize_t timeradd_entry(struct file f, const char __user buf,
498	size_t count, loff_t *off)
499	{
500	return do_register_entry(TIMERADD, f, buf, count, off);
501	}
502
503	static ssize_t scsi_dispatch_cmd_entry(struct file *f,
504	const char __user buf, size_t count, loff_t off)
505	{
506	return do_register_entry(SCSI_DISPATCH_CMD, f, buf, count, off);
507	}
508
509	static ssize_t ide_core_cp_entry(struct file f, const char __user buf,
510	size_t count, loff_t *off)
511	{
512	return do_register_entry(IDE_CORE_CP, f, buf, count, off);
513	}
514
515	/* Special entry to just crash directly. Available without KPROBEs */
516	static ssize_t direct_entry(struct file f, const char __user user_buf,
517	size_t count, loff_t *off)
518	{
519	enum ctype type;
520	char *buf;
521
522	if (count >= PAGE_SIZE)
523	return -EINVAL;
524	if (count < 1)
525	return -EINVAL;
526
527	buf = (char *)__get_free_page(GFP_KERNEL);
528	if (!buf)
529	return -ENOMEM;
530	if (copy_from_user(buf, user_buf, count)) {
531	free_page((unsigned long) buf);
532	return -EFAULT;
533	}
534	/* NULL-terminate and remove enter */
535	buf[count] = '\0';
536	strim(buf);
537
538	type = parse_cp_type(buf, count);
539	free_page((unsigned long) buf);
540	if (type == NONE)
541	return -EINVAL;
542
543	printk(KERN_INFO "lkdtm: Performing direct entry %s\n",
544	cp_type_to_str(type));
545	lkdtm_do_action(type);
546	*off += count;
547
548	return count;
549	}
550
551	struct crash_entry {
552	const char *name;
553	const struct file_operations fops;
554	};
555
556	static const struct crash_entry crash_entries[] = {
557	{"DIRECT", {.read = lkdtm_debugfs_read,
558	.open = lkdtm_debugfs_open,
559	.write = direct_entry} },
560	{"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read,
561	.open = lkdtm_debugfs_open,
562	.write = int_hardware_entry} },
563	{"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read,
564	.open = lkdtm_debugfs_open,
565	.write = int_hw_irq_en} },
566	{"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read,
567	.open = lkdtm_debugfs_open,
568	.write = int_tasklet_entry} },
569	{"FS_DEVRW", {.read = lkdtm_debugfs_read,
570	.open = lkdtm_debugfs_open,
571	.write = fs_devrw_entry} },
572	{"MEM_SWAPOUT", {.read = lkdtm_debugfs_read,
573	.open = lkdtm_debugfs_open,
574	.write = mem_swapout_entry} },
575	{"TIMERADD", {.read = lkdtm_debugfs_read,
576	.open = lkdtm_debugfs_open,
577	.write = timeradd_entry} },
578	{"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read,
579	.open = lkdtm_debugfs_open,
580	.write = scsi_dispatch_cmd_entry} },
581	{"IDE_CORE_CP", {.read = lkdtm_debugfs_read,
582	.open = lkdtm_debugfs_open,
583	.write = ide_core_cp_entry} },
584	};
585
586	static struct dentry *lkdtm_debugfs_root;
587
588	static int __init lkdtm_module_init(void)
589	{
590	int ret = -EINVAL;
591	int n_debugfs_entries = 1; /* Assume only the direct entry */
592	int i;
593
594	/* Register debugfs interface */
595	lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
596	if (!lkdtm_debugfs_root) {
597	printk(KERN_ERR "lkdtm: creating root dir failed\n");
598	return -ENODEV;
599	}
600
601	#ifdef CONFIG_KPROBES
602	n_debugfs_entries = ARRAY_SIZE(crash_entries);
603	#endif
604
605	for (i = 0; i < n_debugfs_entries; i++) {
606	const struct crash_entry *cur = &crash_entries[i];
607	struct dentry *de;
608
609	de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
610	NULL, &cur->fops);
611	if (de == NULL) {
612	printk(KERN_ERR "lkdtm: could not create %s\n",
613	cur->name);
614	goto out_err;
615	}
616	}
617
618	if (lkdtm_parse_commandline() == -EINVAL) {
619	printk(KERN_INFO "lkdtm: Invalid command\n");
620	goto out_err;
621	}
622
623	if (cpoint != INVALID && cptype != NONE) {
624	ret = lkdtm_register_cpoint(cpoint);
625	if (ret < 0) {
626	printk(KERN_INFO "lkdtm: Invalid crash point %d\n",
627	cpoint);
628	goto out_err;
629	}
630	printk(KERN_INFO "lkdtm: Crash point %s of type %s registered\n",
631	cpoint_name, cpoint_type);
632	} else {
633	printk(KERN_INFO "lkdtm: No crash points registered, enable through debugfs\n");
8bb31b9d AG	634	}
8bb31b9d AG	635
8bb31b9d	636	return 0;
0347af4e SK	637
	638	out_err:
	639	debugfs_remove_recursive(lkdtm_debugfs_root);
	640	return ret;
8bb31b9d AG	641	}
8bb31b9d AG	642
2118116e	643	static void __exit lkdtm_module_exit(void)
8bb31b9d	644	{
0347af4e SK	645	debugfs_remove_recursive(lkdtm_debugfs_root);
	646
	647	unregister_jprobe(&lkdtm);
	648	printk(KERN_INFO "lkdtm: Crash point unregistered\n");
8bb31b9d AG	649	}
	650
	651	module_init(lkdtm_module_init);
	652	module_exit(lkdtm_module_exit);
	653
	654	MODULE_LICENSE("GPL");