^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) .. SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) ============================================================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) Provoking crashes with Linux Kernel Dump Test Module (LKDTM)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) ============================================================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) The lkdtm module provides an interface to disrupt (and usually crash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) the kernel at predefined code locations to evaluate the reliability of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) the kernel's exception handling and to test crash dumps obtained using
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) different dumping solutions. The module uses KPROBEs to instrument the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) trigger location, but can also trigger the kernel directly without KPROBE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) support via debugfs.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) You can select the location of the trigger ("crash point name") and the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) type of action ("crash point type") either through module arguments when
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) inserting the module, or through the debugfs interface.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) Usage::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) insmod lkdtm.ko [recur_count={>0}] cpoint_name=<> cpoint_type=<>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) [cpoint_count={>0}]
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) recur_count
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) Recursion level for the stack overflow test. By default this is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) dynamically calculated based on kernel configuration, with the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) goal of being just large enough to exhaust the kernel stack. The
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) value can be seen at `/sys/module/lkdtm/parameters/recur_count`.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) cpoint_name
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) Where in the kernel to trigger the action. It can be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) IDE_CORE_CP, or DIRECT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) cpoint_type
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) Indicates the action to be taken on hitting the crash point.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) These are numerous, and best queried directly from debugfs. Some
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) of the common ones are PANIC, BUG, EXCEPTION, LOOP, and OVERFLOW.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) See the contents of `/sys/kernel/debug/provoke-crash/DIRECT` for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) a complete list.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) cpoint_count
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) Indicates the number of times the crash point is to be hit
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) before triggering the action. The default is 10 (except for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) DIRECT, which always fires immediately).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) You can also induce failures by mounting debugfs and writing the type to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) <debugfs>/provoke-crash/<crashpoint>. E.g.::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) mount -t debugfs debugfs /sys/kernel/debug
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) echo EXCEPTION > /sys/kernel/debug/provoke-crash/INT_HARDWARE_ENTRY
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) The special file `DIRECT` will induce the action directly without KPROBE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) instrumentation. This mode is the only one available when the module is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) built for a kernel without KPROBEs support::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) # Instead of having a BUG kill your shell, have it kill "cat":
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) cat <(echo WRITE_RO) >/sys/kernel/debug/provoke-crash/DIRECT