0001 .. SPDX-License-Identifier: GPL-2.0
0002
0003 ============================================================
0004 Provoking crashes with Linux Kernel Dump Test Module (LKDTM)
0005 ============================================================
0006
0007 The lkdtm module provides an interface to disrupt (and usually crash)
0008 the kernel at predefined code locations to evaluate the reliability of
0009 the kernel's exception handling and to test crash dumps obtained using
0010 different dumping solutions. The module uses KPROBEs to instrument the
0011 trigger location, but can also trigger the kernel directly without KPROBE
0012 support via debugfs.
0013
0014 You can select the location of the trigger ("crash point name") and the
0015 type of action ("crash point type") either through module arguments when
0016 inserting the module, or through the debugfs interface.
0017
0018 Usage::
0019
0020 insmod lkdtm.ko [recur_count={>0}] cpoint_name=<> cpoint_type=<>
0021 [cpoint_count={>0}]
0022
0023 recur_count
0024 Recursion level for the stack overflow test. By default this is
0025 dynamically calculated based on kernel configuration, with the
0026 goal of being just large enough to exhaust the kernel stack. The
0027 value can be seen at `/sys/module/lkdtm/parameters/recur_count`.
0028
0029 cpoint_name
0030 Where in the kernel to trigger the action. It can be
0031 one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
0032 FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT.
0033
0034 cpoint_type
0035 Indicates the action to be taken on hitting the crash point.
0036 These are numerous, and best queried directly from debugfs. Some
0037 of the common ones are PANIC, BUG, EXCEPTION, LOOP, and OVERFLOW.
0038 See the contents of `/sys/kernel/debug/provoke-crash/DIRECT` for
0039 a complete list.
0040
0041 cpoint_count
0042 Indicates the number of times the crash point is to be hit
0043 before triggering the action. The default is 10 (except for
0044 DIRECT, which always fires immediately).
0045
0046 You can also induce failures by mounting debugfs and writing the type to
0047 <debugfs>/provoke-crash/<crashpoint>. E.g.::
0048
0049 mount -t debugfs debugfs /sys/kernel/debug
0050 echo EXCEPTION > /sys/kernel/debug/provoke-crash/INT_HARDWARE_ENTRY
0051
0052 The special file `DIRECT` will induce the action directly without KPROBE
0053 instrumentation. This mode is the only one available when the module is
0054 built for a kernel without KPROBEs support::
0055
0056 # Instead of having a BUG kill your shell, have it kill "cat":
0057 cat <(echo WRITE_RO) >/sys/kernel/debug/provoke-crash/DIRECT
