/*      $NetBSD: kern_crashme.c,v 1.13 2026/01/03 23:59:12 riastradh Exp $      */

/*
 * Copyright (c) 2018, 2019 Matthew R. Green
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * kern_crashme.c:  special debugging routines, designed for debugging
 * kernel crashes.
 *
 * supports crashme sysctl nodes, to test various ways the system can
 * panic or crash.  you can add and remove nodes.
 */

#ifdef _KERNEL_OPT
#include "opt_ddb.h"
#endif

#include <sys/param.h>

#include <sys/crashme.h>
#include <sys/intr.h>
#include <sys/kmem.h>
#include <sys/kthread.h>
#include <sys/mutex.h>
#include <sys/sdt.h>
#include <sys/sysctl.h>
#include <sys/systm.h>

#ifdef DDB
#include <ddb/ddb.h>
#endif

#define DPRINTF(fmt, ...) \
        printf("%s:%d: " fmt "\n", __func__, __LINE__, ## __VA_ARGS__)

static int crashme_sysctl_forwarder(SYSCTLFN_PROTO);

static int crashme_panic(int);
static int crashme_null_deref(int);
static int crashme_null_jump(int);
#ifdef DDB
static int crashme_ddb(int);
#endif
#ifdef LOCKDEBUG
static int crashme_kernel_lock_spinout(int);
#endif
static int crashme_mutex_recursion(int);
static int crashme_spl_spinout(int);
static int crashme_kpreempt_spinout(int);

#define CMNODE(name, lname, func)       \
    {                                   \
        .cn_name = name,                \
        .cn_longname = lname,           \
        .cn_fn = func,                  \
    }

static crashme_node nodes[] = {
    CMNODE("panic", "plain old panic", crashme_panic),
    CMNODE("null_deref", "null dereference", crashme_null_deref),
    CMNODE("null_jump", "jump to null", crashme_null_jump),
#ifdef DDB
    CMNODE("ddb", "enter ddb directly", crashme_ddb),
#endif
#ifdef LOCKDEBUG
    CMNODE("kernel_lock_spinout", "infinite loop under kernel lock",
        crashme_kernel_lock_spinout),
#endif
    CMNODE("mutex_recursion", "enter the same mutex twice",
        crashme_mutex_recursion),
    CMNODE("spl_spinout", "infinite loop at raised spl",
        crashme_spl_spinout),
    CMNODE("kpreempt_spinout", "infinite loop with kpreempt disabled",
        crashme_kpreempt_spinout),
};
static crashme_node *first_node;
static kmutex_t crashme_lock;
static int crashme_root = -1;
static bool crashme_enable = 0;

/*
 * add a crashme node dynamically.  return -1 on failure, 0 on success.
 */
int
crashme_add(crashme_node *ncn)
{
        int rv = -1;
        crashme_node *cn;
        crashme_node *last = NULL;
        const struct sysctlnode *cnode;

        if (crashme_root == -1)
                return -1;

        mutex_enter(&crashme_lock);
        for (cn = first_node; cn; last = cn, cn = cn->cn_next) {
                if (strcmp(cn->cn_name, ncn->cn_name) == 0)
                        break;
        }
        if (!cn) {
                ncn->cn_next = NULL;

                rv = sysctl_createv(NULL, 0, NULL, &cnode,
                    CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
                    CTLTYPE_INT, ncn->cn_name,
                    SYSCTL_DESCR(ncn->cn_longname),
                    crashme_sysctl_forwarder, 0, NULL, 0,
                    CTL_DEBUG, crashme_root, CTL_CREATE, CTL_EOL);

                /* don't insert upon failure */
                if (rv == 0) {
                        ncn->cn_sysctl = cnode->sysctl_num;
                        if (last)
                                last->cn_next = ncn;
                        if (first_node == NULL)
                                first_node = ncn;
                }
        }
        mutex_exit(&crashme_lock);

        return rv == 0 ? 0 : -1;
}

/*
 * remove a crashme node.  return -1 on failure, 0 on success.
 */
int
crashme_remove(crashme_node *rcn)
{
        crashme_node *cn, *prev = NULL;

        mutex_enter(&crashme_lock);
        for (cn = first_node; cn; prev = cn, cn = cn->cn_next) {
                int rv;

                if (cn != rcn)
                        continue;

                if (cn == first_node)
                        first_node = cn->cn_next;
                if (prev)
                        prev->cn_next = cn->cn_next;

                if ((rv = sysctl_destroyv(NULL, CTL_DEBUG, crashme_root,
                            cn->cn_sysctl, CTL_EOL)) == 0)
                        printf("%s: unable to remove %s from sysctl\n",
                            __func__, cn->cn_name);
                break;
        }
        mutex_exit(&crashme_lock);

        if (cn == NULL)
                return -1;

        return 0;
}

/*
 * list or execute a crashme node
 */
static int
crashme_sysctl_forwarder(SYSCTLFN_ARGS)
{
        struct sysctlnode node;
        crashme_node *cn;
        int error, arg = 0;

        for (cn = first_node; cn; cn = cn->cn_next) {
                if (cn->cn_sysctl == rnode->sysctl_num)
                        break;
        }
        if (!cn) {
                return SET_ERROR(EINVAL);
        }

        node = *rnode;
        node.sysctl_data = &arg;
        error = sysctl_lookup(SYSCTLFN_CALL(&node));
        if (error || newp == NULL)
                return (error);

        if (!crashme_enable)
                return SET_ERROR(EACCES);

        DPRINTF("invoking \"%s\" (%s)", cn->cn_name, cn->cn_longname);
        if ((*cn->cn_fn)(arg) != 0)
                panic("crashme on %s failed!\n", cn->cn_name);
        return 0;
}

/*
 * register the various nodes with sysctl.
 */
SYSCTL_SETUP(selfdebug_crashme, "sysctl crashme setup")
{
        const struct sysctlnode *rnode;
        int rv;
        size_t n;

        mutex_init(&crashme_lock, MUTEX_DEFAULT, IPL_NONE);

        KASSERT(crashme_root == -1);

        rv = sysctl_createv(NULL, 0, NULL, &rnode,
            CTLFLAG_PERMANENT,
            CTLTYPE_NODE, "crashme",
            SYSCTL_DESCR("Crashme options"),
            NULL, 0, NULL, 0,
            CTL_DEBUG, CTL_CREATE, CTL_EOL);

        if (rv != 0) {
                printf("%s: failed to create sysctl debug.crashme: %d\n",
                    __func__, rv);
                return;
        }
        crashme_root = rnode->sysctl_num;

        rv = sysctl_createv(NULL, 0, NULL, NULL,
            CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
            CTLTYPE_BOOL, "crashme_enable",
            SYSCTL_DESCR("Enable crashme"),
            NULL, 0, &crashme_enable, 0,
            CTL_DEBUG, CTL_CREATE, CTL_EOL);
        if (rv != 0)
                printf("%s: failed to create sysctl debug.crashme_enable:"
                    " %d\n", __func__, rv);

        for (n = 0; n < __arraycount(nodes); n++) {
                if (crashme_add(&nodes[n]))
                        printf("%s: failed to create sysctl"
                            " debug.crashme.%s\n", __func__, nodes[n].cn_name);
        }
}

/*
 * actual panic functions below
 */
static int
crashme_panic(int flags)
{

        panic("crashme plain old panic");
        return -1;
}

static int
crashme_null_deref(int flags)
{

        *(volatile char *)0 = 0;
        return -1;
}

static int
crashme_null_jump(int flags)
{
        void (*volatile f)(int) = NULL;

        (*f)(flags);
        /* make sure to have a nontrivial return address here */
        return -1;
}

#ifdef DDB
static int
crashme_ddb(int flags)
{

        Debugger();
        return 0;
}
#endif

#ifdef LOCKDEBUG
static int
crashme_kernel_lock_spinout(int flags)
{

        KERNEL_LOCK(1, NULL);
        for (;;)
                __insn_barrier();
        KERNEL_UNLOCK_ONE(NULL);
        return 0;
}
#endif

static int
crashme_mutex_recursion(int flags)
{
        kmutex_t crashme_spinlock;

        switch (flags) {
        case 0:
                return 0;
        case 1:
        default:
                /*
                 * printf makes the return address of the first
                 * mutex_enter call a little more obvious, so the line
                 * number of the _return address_ for the first
                 * mutex_enter doesn't confusingly point at the second
                 * mutex_enter.
                 */
                mutex_enter(&crashme_lock);
                printf("%s: locked once\n", __func__);
                mutex_enter(&crashme_lock);
                printf("%s: locked twice\n", __func__);
                return -1;
        case 2:
                mutex_init(&crashme_spinlock, MUTEX_DEFAULT, IPL_VM);
                printf("%s: initialized\n", __func__);
                mutex_enter(&crashme_spinlock);
                printf("%s: locked once\n", __func__);
                mutex_enter(&crashme_spinlock);
                printf("%s: locked twice\n", __func__);
                return -1;
        }
}

static int
crashme_spl_spinout(int flags)
{
        int s;

        printf("%s: raising ipl to %d\n", __func__, flags);
        s = splraiseipl(makeiplcookie(flags));
        printf("%s: raised ipl to %d, s=%d\n", __func__, flags, s);
        for (;;)
                __insn_barrier();
        printf("%s: exited infinite loop!?\n", __func__);
        splx(s);
        printf("%s: lowered ipl to s=%d\n", __func__, s);

        return 0;
}

static int
crashme_kpreempt_spinout(int flags)
{

        kpreempt_disable();
        printf("%s: disabled kpreemption\n", __func__);
        for (;;)
                __insn_barrier();
        printf("%s: exited infinite loop!?\n", __func__);
        kpreempt_enable();
        printf("%s: re-enabled kpreemption\n", __func__);

        return 0;
}