summaryrefslogtreecommitdiffstats
path: root/src/spdk/test/app
diff options
context:
space:
mode:
Diffstat (limited to 'src/spdk/test/app')
-rw-r--r--src/spdk/test/app/Makefile44
-rw-r--r--src/spdk/test/app/bdev_svc/.gitignore1
-rw-r--r--src/spdk/test/app/bdev_svc/Makefile63
-rw-r--r--src/spdk/test/app/bdev_svc/bdev_svc.c112
-rw-r--r--src/spdk/test/app/fuzz/Makefile48
-rw-r--r--src/spdk/test/app/fuzz/common/fuzz_common.h303
-rwxr-xr-xsrc/spdk/test/app/fuzz/common/fuzz_rpc.py106
-rw-r--r--src/spdk/test/app/fuzz/iscsi_fuzz/.gitignore1
-rw-r--r--src/spdk/test/app/fuzz/iscsi_fuzz/Makefile51
-rw-r--r--src/spdk/test/app/fuzz/iscsi_fuzz/README.md27
-rw-r--r--src/spdk/test/app/fuzz/iscsi_fuzz/iscsi_fuzz.c1092
-rw-r--r--src/spdk/test/app/fuzz/nvme_fuzz/.gitignore1
-rw-r--r--src/spdk/test/app/fuzz/nvme_fuzz/Makefile49
-rw-r--r--src/spdk/test/app/fuzz/nvme_fuzz/README.md52
-rw-r--r--src/spdk/test/app/fuzz/nvme_fuzz/example.json290
-rw-r--r--src/spdk/test/app/fuzz/nvme_fuzz/nvme_fuzz.c931
-rw-r--r--src/spdk/test/app/fuzz/vhost_fuzz/.gitignore1
-rw-r--r--src/spdk/test/app/fuzz/vhost_fuzz/Makefile42
-rw-r--r--src/spdk/test/app/fuzz/vhost_fuzz/README.md46
-rw-r--r--src/spdk/test/app/fuzz/vhost_fuzz/example.json95
-rw-r--r--src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz.c1146
-rw-r--r--src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz.h41
-rw-r--r--src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz_rpc.c108
-rw-r--r--src/spdk/test/app/histogram_perf/.gitignore1
-rw-r--r--src/spdk/test/app/histogram_perf/Makefile43
-rw-r--r--src/spdk/test/app/histogram_perf/histogram_perf.c102
-rw-r--r--src/spdk/test/app/jsoncat/.gitignore1
-rw-r--r--src/spdk/test/app/jsoncat/Makefile43
-rw-r--r--src/spdk/test/app/jsoncat/jsoncat.c192
-rwxr-xr-xsrc/spdk/test/app/match/match332
-rw-r--r--src/spdk/test/app/stub/.gitignore1
-rw-r--r--src/spdk/test/app/stub/Makefile49
-rw-r--r--src/spdk/test/app/stub/stub.c203
33 files changed, 5617 insertions, 0 deletions
diff --git a/src/spdk/test/app/Makefile b/src/spdk/test/app/Makefile
new file mode 100644
index 000000000..2eb259018
--- /dev/null
+++ b/src/spdk/test/app/Makefile
@@ -0,0 +1,44 @@
+#
+# BSD LICENSE
+#
+# Copyright (c) Intel Corporation.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in
+# the documentation and/or other materials provided with the
+# distribution.
+# * Neither the name of Intel Corporation nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+SPDK_ROOT_DIR := $(abspath $(CURDIR)/../..)
+include $(SPDK_ROOT_DIR)/mk/spdk.common.mk
+
+DIRS-y += bdev_svc fuzz histogram_perf jsoncat stub
+
+.PHONY: all clean $(DIRS-y)
+
+all: $(DIRS-y)
+clean: $(DIRS-y)
+
+include $(SPDK_ROOT_DIR)/mk/spdk.subdirs.mk
diff --git a/src/spdk/test/app/bdev_svc/.gitignore b/src/spdk/test/app/bdev_svc/.gitignore
new file mode 100644
index 000000000..77ddb987e
--- /dev/null
+++ b/src/spdk/test/app/bdev_svc/.gitignore
@@ -0,0 +1 @@
+bdev_svc
diff --git a/src/spdk/test/app/bdev_svc/Makefile b/src/spdk/test/app/bdev_svc/Makefile
new file mode 100644
index 000000000..1736d57f0
--- /dev/null
+++ b/src/spdk/test/app/bdev_svc/Makefile
@@ -0,0 +1,63 @@
+#
+# BSD LICENSE
+#
+# Copyright (c) Intel Corporation.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in
+# the documentation and/or other materials provided with the
+# distribution.
+# * Neither the name of Intel Corporation nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+SPDK_ROOT_DIR := $(abspath $(CURDIR)/../../..)
+include $(SPDK_ROOT_DIR)/mk/spdk.common.mk
+include $(SPDK_ROOT_DIR)/mk/spdk.modules.mk
+
+APP = bdev_svc
+
+C_SRCS := bdev_svc.c
+
+SPDK_LIB_LIST = $(ALL_MODULES_LIST)
+SPDK_LIB_LIST += $(EVENT_BDEV_SUBSYSTEM)
+SPDK_LIB_LIST += nvmf event log trace conf thread util bdev accel rpc jsonrpc json sock blobfs_bdev
+SPDK_LIB_LIST += app_rpc log_rpc bdev_rpc notify
+
+ifeq ($(OS),Linux)
+SPDK_LIB_LIST += event_nbd nbd
+endif
+
+ifeq ($(CONFIG_FC),y)
+ifneq ($(strip $(CONFIG_FC_PATH)),)
+SYS_LIBS += -L$(CONFIG_FC_PATH)
+endif
+SYS_LIBS += -lufc
+endif
+
+# libfuse3 is required internally by blobfs_bdev
+ifeq ($(CONFIG_FUSE),y)
+LIBS+= -L/usr/local/lib -lfuse3
+endif
+
+include $(SPDK_ROOT_DIR)/mk/spdk.app.mk
diff --git a/src/spdk/test/app/bdev_svc/bdev_svc.c b/src/spdk/test/app/bdev_svc/bdev_svc.c
new file mode 100644
index 000000000..84580d3f6
--- /dev/null
+++ b/src/spdk/test/app/bdev_svc/bdev_svc.c
@@ -0,0 +1,112 @@
+/*-
+ * BSD LICENSE
+ *
+ * Copyright (c) Intel Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name of Intel Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "spdk/stdinc.h"
+
+#include "spdk/env.h"
+#include "spdk/event.h"
+
+static char g_path[256];
+static bool g_unaffinitize_thread = false;
+
+static void
+bdev_svc_usage(void)
+{
+}
+
+static int
+bdev_svc_parse_arg(int ch, char *arg)
+{
+ return 0;
+}
+
+static void
+bdev_svc_start(void *arg1)
+{
+ int fd;
+ int shm_id = (intptr_t)arg1;
+
+ if (g_unaffinitize_thread) {
+ spdk_unaffinitize_thread();
+ }
+
+ snprintf(g_path, sizeof(g_path), "/var/run/spdk_bdev%d", shm_id);
+ fd = open(g_path, O_CREAT | O_EXCL | O_RDWR, S_IFREG);
+ if (fd < 0) {
+ fprintf(stderr, "could not create sentinel file %s\n", g_path);
+ exit(1);
+ }
+ close(fd);
+}
+
+static void
+bdev_svc_shutdown(void)
+{
+ unlink(g_path);
+ spdk_app_stop(0);
+}
+
+int
+main(int argc, char **argv)
+{
+ int rc;
+ struct spdk_app_opts opts = {};
+
+ /* default value in opts structure */
+ spdk_app_opts_init(&opts);
+
+ opts.name = "bdev_svc";
+ opts.shutdown_cb = bdev_svc_shutdown;
+
+ if ((rc = spdk_app_parse_args(argc, argv, &opts, "", NULL,
+ bdev_svc_parse_arg, bdev_svc_usage)) !=
+ SPDK_APP_PARSE_ARGS_SUCCESS) {
+ exit(rc);
+ }
+
+ /* User did not specify a reactor mask. Test scripts may do this when using
+ * bdev_svc as a primary process to speed up nvme test programs by running
+ * them as secondary processes. In that case, we will unaffinitize the thread
+ * in the bdev_svc_start routine, which will allow the scheduler to move this
+ * thread so it doesn't conflict with pinned threads in the secondary processes.
+ */
+ if (opts.reactor_mask == NULL) {
+ g_unaffinitize_thread = true;
+ }
+
+ rc = spdk_app_start(&opts, bdev_svc_start, (void *)(intptr_t)opts.shm_id);
+
+ spdk_app_fini();
+
+ return rc;
+}
diff --git a/src/spdk/test/app/fuzz/Makefile b/src/spdk/test/app/fuzz/Makefile
new file mode 100644
index 000000000..1f0a81b92
--- /dev/null
+++ b/src/spdk/test/app/fuzz/Makefile
@@ -0,0 +1,48 @@
+#
+# BSD LICENSE
+#
+# Copyright (c) Intel Corporation.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in
+# the documentation and/or other materials provided with the
+# distribution.
+# * Neither the name of Intel Corporation nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+SPDK_ROOT_DIR := $(abspath $(CURDIR)/../../..)
+include $(SPDK_ROOT_DIR)/mk/spdk.common.mk
+
+DIRS-y += nvme_fuzz
+DIRS-y += iscsi_fuzz
+
+ifeq ($(OS),Linux)
+DIRS-$(CONFIG_VIRTIO) += vhost_fuzz
+endif
+.PHONY: all clean $(DIRS-y)
+
+all: $(DIRS-y)
+clean: $(DIRS-y)
+
+include $(SPDK_ROOT_DIR)/mk/spdk.subdirs.mk
diff --git a/src/spdk/test/app/fuzz/common/fuzz_common.h b/src/spdk/test/app/fuzz/common/fuzz_common.h
new file mode 100644
index 000000000..7619f4fb1
--- /dev/null
+++ b/src/spdk/test/app/fuzz/common/fuzz_common.h
@@ -0,0 +1,303 @@
+/*-
+ * BSD LICENSE
+ *
+ * Copyright (c) Intel Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name of Intel Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "spdk/stdinc.h"
+#include "spdk/env.h"
+#include "spdk/file.h"
+#include "spdk/base64.h"
+#include "spdk/json.h"
+
+#define DEFAULT_RUNTIME 30 /* seconds */
+#define MAX_RUNTIME_S 86400 /* 24 hours */
+#define IO_TIMEOUT_S 5
+
+#define UNSIGNED_2BIT_MAX ((1 << 2) - 1)
+#define UNSIGNED_4BIT_MAX ((1 << 4) - 1)
+#define UNSIGNED_8BIT_MAX ((1 << 8) - 1)
+
+typedef bool (*json_parse_fn)(void *ele, struct spdk_json_val *val, size_t num_vals);
+
+static void
+fuzz_fill_random_bytes(char *character_repr, size_t len, unsigned int *rand_seed)
+{
+ size_t i;
+
+ for (i = 0; i < len; i++) {
+ character_repr[i] = rand_r(rand_seed) % UINT8_MAX;
+ }
+}
+
+static uint64_t
+fuzz_refresh_timeout(void)
+{
+ uint64_t current_ticks;
+ uint64_t new_timeout_ticks;
+
+ current_ticks = spdk_get_ticks();
+
+ new_timeout_ticks = current_ticks + IO_TIMEOUT_S * spdk_get_ticks_hz();
+ assert(new_timeout_ticks > current_ticks);
+
+ return new_timeout_ticks;
+}
+
+static char *
+fuzz_get_value_base_64_buffer(void *item, size_t len)
+{
+ char *value_string;
+ size_t total_size;
+ int rc;
+
+ /* Null pointer */
+ total_size = spdk_base64_get_encoded_strlen(len) + 1;
+
+ value_string = calloc(1, total_size);
+ if (value_string == NULL) {
+ return NULL;
+ }
+
+ rc = spdk_base64_encode(value_string, item, len);
+ if (rc < 0) {
+ free(value_string);
+ return NULL;
+ }
+
+ return value_string;
+}
+
+static int
+fuzz_get_base_64_buffer_value(void *item, size_t len, char *buf, size_t buf_len)
+{
+ size_t size_of_data;
+ char *new_buf;
+ int rc;
+
+ new_buf = malloc(buf_len + 1);
+ if (new_buf == NULL) {
+ return -ENOMEM;
+ }
+
+ snprintf(new_buf, buf_len + 1, "%s", buf);
+
+ size_of_data = spdk_base64_get_decoded_len(buf_len);
+
+ if (size_of_data < len) {
+ free(new_buf);
+ return -EINVAL;
+ }
+
+ rc = spdk_base64_decode(item, &size_of_data, new_buf);
+
+ if (rc || size_of_data != len) {
+ free(new_buf);
+ return -EINVAL;
+ }
+
+ free(new_buf);
+ return 0;
+}
+
+static ssize_t
+read_json_into_buffer(const char *filename, struct spdk_json_val **values, void **file_data)
+{
+ FILE *file = fopen(filename, "r");
+ size_t file_data_size;
+ ssize_t num_json_values = 0, rc;
+
+ if (file == NULL) {
+ /* errno is set by fopen */
+ return 0;
+ }
+
+ *file_data = spdk_posix_file_load(file, &file_data_size);
+ if (*file_data == NULL) {
+ fclose(file);
+ return 0;
+ }
+
+ fclose(file);
+
+ num_json_values = spdk_json_parse(*file_data, file_data_size, NULL, 0, NULL,
+ SPDK_JSON_PARSE_FLAG_ALLOW_COMMENTS);
+
+ *values = calloc(num_json_values, sizeof(**values));
+ if (values == NULL) {
+ free(*file_data);
+ *file_data = NULL;
+ return 0;
+ }
+
+ rc = spdk_json_parse(*file_data, file_data_size, *values, num_json_values, NULL,
+ SPDK_JSON_PARSE_FLAG_ALLOW_COMMENTS);
+ if (num_json_values != rc) {
+ free(*values);
+ *values = NULL;
+ free(*file_data);
+ *file_data = NULL;
+ return 0;
+ }
+
+ return num_json_values;
+}
+
+static size_t
+double_arr_size(void **buffer, size_t num_ele, size_t ele_size)
+{
+ void *tmp;
+ size_t new_num_ele, allocation_size;
+
+ if (num_ele > SIZE_MAX / 2) {
+ return 0;
+ }
+
+ new_num_ele = num_ele * 2;
+
+ if (new_num_ele > SIZE_MAX / ele_size) {
+ return 0;
+ }
+
+ allocation_size = new_num_ele * ele_size;
+
+ tmp = realloc(*buffer, allocation_size);
+ if (tmp != NULL) {
+ *buffer = tmp;
+ return new_num_ele;
+ }
+
+ return 0;
+}
+
+static uint64_t
+fuzz_parse_args_into_array(const char *file, void **arr, size_t ele_size, const char *obj_name,
+ json_parse_fn cb_fn)
+{
+ ssize_t i, num_json_values;
+ struct spdk_json_val *values = NULL, *values_head = NULL, *obj_start;
+ void *file_data = NULL;;
+ char *arr_idx_pointer;
+ size_t num_arr_elements, arr_elements_used, values_in_obj;
+ bool rc;
+
+ num_json_values = read_json_into_buffer(file, &values_head, &file_data);
+ values = values_head;
+ if (num_json_values == 0 || values == NULL) {
+ if (file_data != NULL) {
+ free(file_data);
+ }
+ fprintf(stderr, "The file provided does not exist or we were unable to parse it.\n");
+ return 0;
+ }
+
+ num_arr_elements = 10;
+ arr_elements_used = 0;
+ *arr = calloc(num_arr_elements, ele_size);
+ arr_idx_pointer = (char *)*arr;
+ if (arr_idx_pointer == NULL) {
+ free(values);
+ free(file_data);
+ return 0;
+ }
+
+ i = 0;
+ while (i < num_json_values) {
+ if (values->type != SPDK_JSON_VAL_NAME) {
+ i++;
+ values++;
+ continue;
+ }
+
+ if (!strncmp(values->start, obj_name, values->len)) {
+ i++;
+ values++;
+ assert(values->type == SPDK_JSON_VAL_OBJECT_BEGIN);
+ obj_start = values;
+ values_in_obj = spdk_json_val_len(obj_start);
+ values += values_in_obj;
+ i += values_in_obj;
+
+ rc = cb_fn((void *)arr_idx_pointer, obj_start, values_in_obj);
+ if (rc == false) {
+ fprintf(stderr, "failed to parse file after %lu elements.\n", arr_elements_used);
+ goto fail;
+ }
+
+ arr_idx_pointer += ele_size;
+ arr_elements_used++;
+ if (arr_elements_used == num_arr_elements) {
+ num_arr_elements = double_arr_size(arr, num_arr_elements, ele_size);
+ if (num_arr_elements == 0) {
+ fprintf(stderr, "failed to allocate enough space for all json elements in your file.\n");
+ goto fail;
+ } else {
+ /* reset the array element position in case the pointer changed. */
+ arr_idx_pointer = ((char *)*arr) + arr_elements_used * ele_size;
+ }
+ }
+
+ continue;
+ } else {
+ i++;
+ values++;
+ continue;
+ }
+ }
+
+ if (arr_elements_used == 0) {
+ goto fail;
+ }
+
+ free(values_head);
+ free(file_data);
+ return arr_elements_used;
+fail:
+ free(values_head);
+ free(file_data);
+ free(*arr);
+ *arr = NULL;
+ return 0;
+}
+
+static int
+fuzz_parse_json_num(struct spdk_json_val *val, uint64_t max_val, uint64_t *val_ptr)
+{
+ uint64_t tmp_val;
+ int rc;
+
+ rc = spdk_json_number_to_uint64(val, &tmp_val);
+ if (rc || tmp_val > max_val) {
+ return -EINVAL;
+ } else {
+ *val_ptr = tmp_val;
+ return 0;
+ }
+}
diff --git a/src/spdk/test/app/fuzz/common/fuzz_rpc.py b/src/spdk/test/app/fuzz/common/fuzz_rpc.py
new file mode 100755
index 000000000..05cb67ed8
--- /dev/null
+++ b/src/spdk/test/app/fuzz/common/fuzz_rpc.py
@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+
+from rpc.client import print_dict, JSONRPCException
+
+import logging
+import argparse
+import rpc
+import sys
+import shlex
+
+try:
+ from shlex import quote
+except ImportError:
+ from pipes import quote
+
+
+def print_array(a):
+ print(" ".join((quote(v) for v in a)))
+
+
+def _fuzz_vhost_create_dev(client, socket, is_blk, use_bogus_buffer, use_valid_buffer, test_scsi_tmf, valid_lun):
+ """Create a new device in the vhost fuzzer.
+
+ Args:
+ socket: A valid unix domain socket for the dev to bind to.
+ is_blk: if set, create a virtio_blk device, otherwise use scsi.
+ use_bogus_buffer: if set, pass an invalid memory address as a buffer accompanying requests.
+ use_valid_buffer: if set, pass in a valid memory buffer with requests. Overrides use_bogus_buffer.
+ test_scsi_tmf: Test scsi management commands on the given device. Valid if and only if is_blk is false.
+ valid_lun: Supply only a valid lun number when submitting commands to the given device. Valid if and only if is_blk is false.
+
+ Returns:
+ True or False
+ """
+
+ params = {"socket": socket,
+ "is_blk": is_blk,
+ "use_bogus_buffer": use_bogus_buffer,
+ "use_valid_buffer": use_valid_buffer,
+ "test_scsi_tmf": test_scsi_tmf,
+ "valid_lun": valid_lun}
+
+ return client.call("fuzz_vhost_create_dev", params)
+
+
+if __name__ == "__main__":
+ parser = argparse.ArgumentParser(
+ description='SPDK RPC command line interface. NOTE: spdk/scripts/ is expected in PYTHONPATH')
+ parser.add_argument('-s', dest='server_addr',
+ help='RPC domain socket path or IP address', default='/var/tmp/spdk.sock')
+ parser.add_argument('-p', dest='port',
+ help='RPC port number (if server_addr is IP address)',
+ default=5260, type=int)
+ parser.add_argument('-t', dest='timeout',
+ help='Timeout as a floating point number expressed in seconds waiting for response. Default: 60.0',
+ default=60.0, type=float)
+ parser.add_argument('-v', dest='verbose', action='store_const', const="INFO",
+ help='Set verbose mode to INFO', default="ERROR")
+ parser.add_argument('--verbose', dest='verbose', choices=['DEBUG', 'INFO', 'ERROR'],
+ help="""Set verbose level. """)
+ subparsers = parser.add_subparsers(help='RPC methods')
+
+ def fuzz_vhost_create_dev(args):
+ _fuzz_vhost_create_dev(
+ args.client,
+ args.socket,
+ args.is_blk,
+ args.use_bogus_buffer,
+ args.use_valid_buffer,
+ args.test_scsi_tmf,
+ args.valid_lun)
+
+ p = subparsers.add_parser('fuzz_vhost_create_dev', help="Add a new device to the vhost fuzzer.")
+ p.add_argument('-s', '--socket', help="Path to a valid unix domain socket for dev binding.")
+ p.add_argument('-b', '--is-blk', help='The specified socket corresponds to a vhost-blk dev.', action='store_true')
+ p.add_argument('-u', '--use-bogus-buffer', help='Pass bogus buffer addresses with requests when fuzzing.', action='store_true')
+ p.add_argument('-v', '--use-valid-buffer', help='Pass valid buffers when fuzzing. overrides use-bogus-buffer.', action='store_true')
+ p.add_argument('-m', '--test-scsi-tmf', help='for a scsi device, test scsi management commands.', action='store_true')
+ p.add_argument('-l', '--valid-lun', help='for a scsi device, test only using valid lun IDs.', action='store_true')
+ p.set_defaults(func=fuzz_vhost_create_dev)
+
+ def call_rpc_func(args):
+ try:
+ args.func(args)
+ except JSONRPCException as ex:
+ print(ex.message)
+ exit(1)
+
+ def execute_script(parser, client, fd):
+ for rpc_call in map(str.rstrip, fd):
+ if not rpc_call.strip():
+ continue
+ args = parser.parse_args(shlex.split(rpc_call))
+ args.client = client
+ call_rpc_func(args)
+
+ args = parser.parse_args()
+ args.client = rpc.client.JSONRPCClient(args.server_addr, args.port, args.timeout, log_level=getattr(logging, args.verbose.upper()))
+ if hasattr(args, 'func'):
+ call_rpc_func(args)
+ elif sys.stdin.isatty():
+ # No arguments and no data piped through stdin
+ parser.print_help()
+ exit(1)
+ else:
+ execute_script(parser, args.client, sys.stdin)
diff --git a/src/spdk/test/app/fuzz/iscsi_fuzz/.gitignore b/src/spdk/test/app/fuzz/iscsi_fuzz/.gitignore
new file mode 100644
index 000000000..3982bd220
--- /dev/null
+++ b/src/spdk/test/app/fuzz/iscsi_fuzz/.gitignore
@@ -0,0 +1 @@
+iscsi_fuzz
diff --git a/src/spdk/test/app/fuzz/iscsi_fuzz/Makefile b/src/spdk/test/app/fuzz/iscsi_fuzz/Makefile
new file mode 100644
index 000000000..0131e089a
--- /dev/null
+++ b/src/spdk/test/app/fuzz/iscsi_fuzz/Makefile
@@ -0,0 +1,51 @@
+#
+# Copyright (c) Intel Corporation.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in
+# the documentation and/or other materials provided with the
+# distribution.
+# * Neither the name of Intel Corporation nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+SPDK_ROOT_DIR := $(abspath $(CURDIR)/../../../..)
+include $(SPDK_ROOT_DIR)/mk/spdk.common.mk
+include $(SPDK_ROOT_DIR)/mk/spdk.modules.mk
+
+APP = iscsi_fuzz
+
+CFLAGS += -I$(SPDK_ROOT_DIR)/lib
+CFLAGS += -I$(SPDK_ROOT_DIR)/include
+
+C_SRCS := iscsi_fuzz.c
+
+ISCSI_OBJS = md5 param conn tgt_node init_grp portal_grp
+
+LIBS += $(SCSI_OBJS:%=$(SPDK_ROOT_DIR)/lib/scsi/%.o)
+LIBS += $(ISCSI_OBJS:%=$(SPDK_ROOT_DIR)/lib/iscsi/%.o)
+
+SPDK_LIB_LIST += $(SOCK_MODULES_LIST)
+SPDK_LIB_LIST += conf event json jsonrpc log scsi bdev notify rpc sock thread trace util
+
+include $(SPDK_ROOT_DIR)/mk/spdk.app.mk
diff --git a/src/spdk/test/app/fuzz/iscsi_fuzz/README.md b/src/spdk/test/app/fuzz/iscsi_fuzz/README.md
new file mode 100644
index 000000000..c9ef02e6a
--- /dev/null
+++ b/src/spdk/test/app/fuzz/iscsi_fuzz/README.md
@@ -0,0 +1,27 @@
+# Overview
+
+This application is intended to fuzz test the iSCSI target by submitting
+randomized PDU commands through a simulated iSCSI initiator.
+
+# Input
+
+1. iSCSI initiator send a login request PDU to iSCSI Target. Once a session is connected,
+2. iSCSI initiator send huge amount and random PDUs continuously to iSCSI Target.
+3. iSCSI initiator send a logout request PDU to iSCSI Target in the end.
+Especially, iSCSI initiator need to build different bhs according to different bhs opcode.
+Then iSCSI initiator will receive all kinds of responsed opcodes from iSCSI Target.
+The application will terminate when run time expires (see the -t flag).
+
+# Output
+
+By default, the fuzzer will print commands that:
+1. Complete successfully back from the target, or
+2. Are outstanding at the time of a connection error occurs.
+Commands are dumped as named objects in json format which can then be supplied back to the
+script for targeted debugging on a subsequent run.
+
+At the end of each test run, a summary is printed in the following format:
+
+~~~
+device 0x11c3b90 stats: Sent 1543 valid opcode PDUs, 16215 invalid opcode PDUs.
+~~~
diff --git a/src/spdk/test/app/fuzz/iscsi_fuzz/iscsi_fuzz.c b/src/spdk/test/app/fuzz/iscsi_fuzz/iscsi_fuzz.c
new file mode 100644
index 000000000..359b95981
--- /dev/null
+++ b/src/spdk/test/app/fuzz/iscsi_fuzz/iscsi_fuzz.c
@@ -0,0 +1,1092 @@
+/*-
+ * BSD LICENSE
+ *
+ * Copyright (c) Intel Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name of Intel Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "spdk/stdinc.h"
+#include "spdk/conf.h"
+#include "spdk/event.h"
+#include "spdk/util.h"
+#include "spdk/string.h"
+#include "spdk/likely.h"
+#include "spdk/json.h"
+#include "spdk/endian.h"
+#include "spdk/bdev.h"
+#include "spdk/notify.h"
+#include "spdk/scsi.h"
+#include "spdk_internal/mock.h"
+#include "spdk/scsi_spec.h"
+#include "iscsi/conn.h"
+#include "iscsi/iscsi.c"
+#include "scsi/scsi_internal.h"
+#include "spdk/sock.h"
+
+#define GET_PDU_LOOP_COUNT 16
+#define DEFAULT_RUNTIME 30 /* seconds */
+#define MAX_RUNTIME_S 86400 /* 24 hours */
+
+/* Global run state */
+uint64_t g_runtime_ticks;
+int g_runtime;
+int g_num_active_threads;
+bool g_run = true;
+bool g_is_valid_opcode = true;
+
+struct spdk_log_flag SPDK_LOG_ISCSI = {
+ .name = "iscsi",
+ .enabled = false,
+};
+
+/* Global resources */
+TAILQ_HEAD(, spdk_iscsi_pdu) g_get_pdu_list;
+TAILQ_HEAD(, fuzz_iscsi_dev_ctx) g_dev_list = TAILQ_HEAD_INITIALIZER(g_dev_list);
+struct spdk_poller *g_app_completion_poller;
+void *g_valid_buffer;
+unsigned int g_random_seed;
+char *g_tgt_ip = "127.0.0.1";
+char *g_tgt_port = "3260";
+/* TBD: Discovery login to get target information. We use fixed IQN for target for now. */
+char *g_tgt_name = "iqn.2016-06.io.spdk:disk1";
+char *g_init_name = "iqn.2016-06.io.spdk:fuzzinit";
+
+struct fuzz_iscsi_iov_ctx {
+ struct iovec iov_req;
+ struct iovec iov_data;
+ struct iovec iov_resp;
+};
+
+struct fuzz_iscsi_io_ctx {
+ struct fuzz_iscsi_iov_ctx iov_ctx;
+ union {
+ struct iscsi_bhs *bhs;
+ struct iscsi_bhs_nop_out *nop_out_req;
+ struct iscsi_bhs_scsi_req *scsi_req;
+ struct iscsi_bhs_task_req *task_req;
+ struct iscsi_bhs_login_req *login_req;
+ struct iscsi_bhs_text_req *text_req;
+ struct iscsi_bhs_data_out *data_out_req;
+ struct iscsi_bhs_logout_req *logout_req;
+ struct iscsi_bhs_snack_req *snack_req;
+ } req;
+};
+
+struct fuzz_iscsi_dev_ctx {
+ struct spdk_iscsi_sess sess;
+ struct spdk_iscsi_conn *conn;
+ struct fuzz_iscsi_io_ctx io_ctx;
+
+ struct spdk_thread *thread;
+ struct spdk_poller *poller;
+ unsigned int random_seed, current_cmd_sn;
+ uint64_t num_sent_pdus;
+ uint64_t num_valid_pdus;
+
+ TAILQ_ENTRY(fuzz_iscsi_dev_ctx) link;
+};
+
+static void
+fuzz_fill_random_bytes(char *character_repr, size_t len, unsigned int *rand_seed)
+{
+ size_t i;
+
+ for (i = 0; i < len; i++) {
+ character_repr[i] = rand_r(rand_seed) % UINT8_MAX;
+ }
+}
+
+static char *
+fuzz_get_value_base_64_buffer(void *item, size_t len)
+{
+ char *value_string;
+ size_t total_size;
+ int rc;
+
+ /* Null pointer */
+ total_size = spdk_base64_get_encoded_strlen(len) + 1;
+
+ value_string = calloc(1, total_size);
+ if (value_string == NULL) {
+ return NULL;
+ }
+
+ rc = spdk_base64_encode(value_string, item, len);
+ if (rc < 0) {
+ free(value_string);
+ return NULL;
+ }
+
+ return value_string;
+}
+
+int
+iscsi_chap_get_authinfo(struct iscsi_chap_auth *auth, const char *authuser,
+ int ag_tag)
+{
+ return 0;
+}
+
+void
+shutdown_iscsi_conns_done(void)
+{
+ return;
+}
+
+void
+iscsi_put_pdu(struct spdk_iscsi_pdu *pdu)
+{
+ if (!pdu) {
+ return;
+ }
+
+ pdu->ref--;
+ if (pdu->ref < 0) {
+ pdu->ref = 0;
+ }
+
+ if (pdu->ref == 0) {
+ if (pdu->data) {
+ free(pdu->data);
+ }
+ free(pdu);
+ }
+}
+
+struct spdk_iscsi_pdu *
+iscsi_get_pdu(struct spdk_iscsi_conn *conn)
+{
+ struct spdk_iscsi_pdu *pdu;
+
+ pdu = calloc(1, sizeof(*pdu));
+ if (!pdu) {
+ return NULL;
+ }
+
+ pdu->ref = 1;
+ pdu->conn = conn;
+
+ return pdu;
+}
+
+static void
+iscsi_task_free(struct spdk_scsi_task *scsi_task)
+{
+ struct spdk_iscsi_task *task = iscsi_task_from_scsi_task(scsi_task);
+
+ assert(task->parent == NULL);
+
+ iscsi_task_disassociate_pdu(task);
+ assert(task->conn->pending_task_cnt > 0);
+ task->conn->pending_task_cnt--;
+ free(task);
+}
+
+struct spdk_iscsi_task *
+iscsi_task_get(struct spdk_iscsi_conn *conn, struct spdk_iscsi_task *parent,
+ spdk_scsi_task_cpl cpl_fn)
+{
+ struct spdk_iscsi_task *task;
+
+ /* iSCSI subtask is not necessary for now. */
+ assert(parent == NULL);
+
+ task = calloc(1, sizeof(*task));
+ if (!task) {
+ printf("Unable to get task\n");
+ abort();
+ }
+
+ task->conn = conn;
+ assert(conn->pending_task_cnt < UINT32_MAX);
+ conn->pending_task_cnt++;
+ spdk_scsi_task_construct(&task->scsi, cpl_fn, iscsi_task_free);
+
+ return task;
+}
+
+static void
+cleanup(void)
+{
+ struct fuzz_iscsi_dev_ctx *dev_ctx, *tmp;
+
+ TAILQ_FOREACH_SAFE(dev_ctx, &g_dev_list, link, tmp) {
+ printf("device %p stats: Sent %lu valid opcode PDUs, %lu invalid opcode PDUs.\n",
+ dev_ctx, dev_ctx->num_valid_pdus,
+ dev_ctx->num_sent_pdus - dev_ctx->num_valid_pdus);
+ free(dev_ctx);
+ }
+
+ spdk_free(g_valid_buffer);
+}
+
+/* data dumping functions begin */
+static int
+dump_iscsi_cmd(void *ctx, const void *data, size_t size)
+{
+ fprintf(stderr, "%s\n", (const char *)data);
+ return 0;
+}
+
+static void
+print_scsi_io_data(struct spdk_json_write_ctx *w, struct fuzz_iscsi_io_ctx *io_ctx)
+{
+ char *data_segment_len;
+
+ data_segment_len = fuzz_get_value_base_64_buffer((void *)io_ctx->req.bhs->data_segment_len,
+ sizeof(io_ctx->req.bhs->data_segment_len));
+
+ spdk_json_write_named_uint32(w, "opcode", io_ctx->req.bhs->opcode);
+ spdk_json_write_named_uint32(w, "immediate", io_ctx->req.bhs->immediate);
+ spdk_json_write_named_uint32(w, "reserved", io_ctx->req.bhs->reserved);
+ spdk_json_write_named_uint32(w, "total_ahs_len", io_ctx->req.bhs->total_ahs_len);
+ spdk_json_write_named_string(w, "data_segment_len", data_segment_len);
+ spdk_json_write_named_uint32(w, "itt", io_ctx->req.bhs->itt);
+ spdk_json_write_named_uint32(w, "exp_stat_sn", io_ctx->req.bhs->exp_stat_sn);
+
+ free(data_segment_len);
+}
+
+static void
+print_req_obj(struct fuzz_iscsi_dev_ctx *dev_ctx, struct fuzz_iscsi_io_ctx *io_ctx)
+{
+ struct spdk_json_write_ctx *w;
+
+ w = spdk_json_write_begin(dump_iscsi_cmd, NULL, SPDK_JSON_WRITE_FLAG_FORMATTED);
+ spdk_json_write_named_object_begin(w, "bhs");
+ print_scsi_io_data(w, io_ctx);
+ spdk_json_write_object_end(w);
+ spdk_json_write_end(w);
+}
+
+/* data dumping functions end */
+
+/* dev initialization begin */
+static int
+fuzz_iscsi_dev_init(void)
+{
+ struct fuzz_iscsi_dev_ctx *dev_ctx;
+ int rc = 0;
+
+ dev_ctx = calloc(1, sizeof(*dev_ctx));
+ if (dev_ctx == NULL) {
+ return -ENOMEM;
+ }
+
+ dev_ctx->thread = spdk_get_thread();
+ if (dev_ctx->thread == NULL) {
+ fprintf(stderr, "Unable to get a thread for a fuzz device.\n");
+ rc = -EINVAL;
+ goto error_out;
+ }
+
+ dev_ctx->current_cmd_sn = 0;
+
+ TAILQ_INSERT_TAIL(&g_dev_list, dev_ctx, link);
+ return 0;
+
+error_out:
+ free(dev_ctx);
+ return rc;
+}
+/* dev initialization end */
+
+/* build requests begin */
+static void
+prep_iscsi_pdu_bhs_opcode_cmd(struct fuzz_iscsi_dev_ctx *dev_ctx, struct fuzz_iscsi_io_ctx *io_ctx)
+{
+ io_ctx->iov_ctx.iov_req.iov_len = sizeof(struct iscsi_bhs);
+ fuzz_fill_random_bytes((char *)io_ctx->req.bhs, sizeof(struct iscsi_bhs),
+ &dev_ctx->random_seed);
+}
+/* build requests end */
+
+static int
+iscsi_pdu_hdr_op_login_rsp(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
+{
+ return 0;
+}
+
+static int
+iscsi_fuzz_pdu_hdr_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
+{
+ int opcode;
+ int rc = 0;
+
+ opcode = pdu->bhs.opcode;
+ if (opcode == ISCSI_OP_LOGIN_RSP) {
+ return iscsi_pdu_hdr_op_login_rsp(conn, pdu);
+ }
+
+ switch (opcode) {
+ case ISCSI_OP_LOGOUT_RSP:
+ fprintf(stderr, "Received logout hdr_handle response opcode(0x26) from Target.\n");
+ conn->is_logged_out = true;
+ break;
+ case ISCSI_OP_NOPIN:
+ case ISCSI_OP_SCSI_RSP:
+ case ISCSI_OP_TASK_RSP:
+ case ISCSI_OP_TEXT_RSP:
+ case ISCSI_OP_SCSI_DATAIN:
+ case ISCSI_OP_R2T:
+ case ISCSI_OP_ASYNC:
+ case ISCSI_OP_VENDOR_3C:
+ case ISCSI_OP_VENDOR_3D:
+ case ISCSI_OP_VENDOR_3E:
+ fprintf(stderr, "Received hdr_handle response opcode from Target is 0x%x.\n", pdu->bhs.opcode);
+ break;
+ case ISCSI_OP_REJECT:
+ fprintf(stderr, "Received rejected hdr_handle response opcode(0x3f) from Target.\n");
+ break;
+ default:
+ rc = -1;
+ break;
+ }
+
+ return rc;
+}
+
+static int
+iscsi_pdu_payload_op_login_rsp(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
+{
+ struct iscsi_bhs_login_rsp *rsph;
+
+ rsph = (struct iscsi_bhs_login_rsp *)&pdu->bhs;
+ if (rsph == NULL) {
+ return -1;
+ }
+
+ assert(rsph->tsih != 0);
+ assert(rsph->status_class == 0);
+ assert(ISCSI_BHS_LOGIN_GET_TBIT(rsph->flags));
+ assert(!(rsph->flags & ISCSI_LOGIN_CONTINUE));
+ assert((rsph->flags & ISCSI_LOGIN_NEXT_STAGE_MASK) == ISCSI_LOGIN_NEXT_STAGE_3);
+
+ /* We got the Login Final Response and move to Full-Feature Phase. */
+ conn->full_feature = 1;
+ return 0;
+}
+
+static int
+iscsi_fuzz_pdu_payload_handle(struct spdk_iscsi_conn *conn, struct spdk_iscsi_pdu *pdu)
+{
+ int opcode;
+ int rc = 0;
+
+ opcode = pdu->bhs.opcode;
+ fprintf(stderr, "Received payload_handle response opcode from Target is 0x%x.\n", opcode);
+
+ switch (opcode) {
+ case ISCSI_OP_LOGIN_RSP:
+ rc = iscsi_pdu_payload_op_login_rsp(conn, pdu);
+ break;
+ case ISCSI_OP_NOPIN:
+ case ISCSI_OP_SCSI_RSP:
+ case ISCSI_OP_TASK_RSP:
+ case ISCSI_OP_TEXT_RSP:
+ case ISCSI_OP_SCSI_DATAIN:
+ case ISCSI_OP_R2T:
+ case ISCSI_OP_ASYNC:
+ case ISCSI_OP_VENDOR_3C:
+ case ISCSI_OP_VENDOR_3D:
+ case ISCSI_OP_VENDOR_3E:
+ case ISCSI_OP_REJECT:
+ break;
+ default:
+ rc = -1;
+ break;
+ }
+
+ return rc;
+}
+
+static int
+iscsi_fuzz_read_pdu(struct spdk_iscsi_conn *conn)
+{
+ enum iscsi_pdu_recv_state prev_state;
+ struct spdk_iscsi_pdu *pdu;
+ uint32_t data_len;
+ int rc;
+
+ do {
+ prev_state = conn->pdu_recv_state;
+ pdu = conn->pdu_in_progress;
+
+ switch (conn->pdu_recv_state) {
+ case ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY:
+ assert(conn->pdu_in_progress == NULL);
+
+ conn->pdu_in_progress = iscsi_get_pdu(conn);
+ if (conn->pdu_in_progress == NULL) {
+ return SPDK_ISCSI_CONNECTION_FATAL;
+ }
+ TAILQ_INSERT_TAIL(&g_get_pdu_list, conn->pdu_in_progress, tailq);
+ conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR;
+ break;
+ case ISCSI_PDU_RECV_STATE_AWAIT_PDU_HDR:
+ if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
+ rc = iscsi_conn_read_data(conn,
+ ISCSI_BHS_LEN - pdu->bhs_valid_bytes,
+ (uint8_t *)&pdu->bhs + pdu->bhs_valid_bytes);
+ if (rc < 0) {
+ conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
+ break;
+ }
+ pdu->bhs_valid_bytes += rc;
+ if (pdu->bhs_valid_bytes < ISCSI_BHS_LEN) {
+ return 0;
+ }
+ }
+
+ pdu->data_segment_len = ISCSI_ALIGN(DGET24(pdu->bhs.data_segment_len));
+
+ rc = iscsi_fuzz_pdu_hdr_handle(conn, pdu);
+ if (rc < 0) {
+ printf("Critical error is detected. Close the connection\n");
+ conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
+ break;
+ }
+
+ if (conn->is_logged_out) {
+ printf("pdu received after logout\n");
+ conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
+ break;
+ }
+
+ conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD;
+ break;
+ case ISCSI_PDU_RECV_STATE_AWAIT_PDU_PAYLOAD:
+ data_len = pdu->data_segment_len;
+ if (data_len != 0 && pdu->data_buf == NULL) {
+ pdu->data_buf = calloc(1, data_len);
+ if (pdu->data_buf == NULL) {
+ return 0;
+ }
+ pdu->data = pdu->data_buf;
+ }
+
+ /* copy the actual data into local buffer */
+ if (pdu->data_valid_bytes < data_len) {
+ rc = iscsi_conn_read_data_segment(conn, pdu, data_len);
+ if (rc < 0) {
+ conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
+ break;
+ }
+ pdu->data_valid_bytes += rc;
+ if (pdu->data_valid_bytes < data_len) {
+ return 0;
+ }
+ }
+
+ /* All data for this PDU has now been read from the socket. */
+ spdk_trace_record(TRACE_ISCSI_READ_PDU, conn->id, pdu->data_valid_bytes,
+ (uintptr_t)pdu, pdu->bhs.opcode);
+
+ if (!pdu->is_rejected) {
+ rc = iscsi_fuzz_pdu_payload_handle(conn, pdu);
+ } else {
+ rc = 0;
+ }
+ if (rc == 0) {
+ spdk_trace_record(TRACE_ISCSI_TASK_EXECUTED, 0, 0, (uintptr_t)pdu, 0);
+ conn->pdu_in_progress = NULL;
+ conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY;
+ return 1;
+ } else {
+ conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_ERROR;
+ }
+ break;
+ case ISCSI_PDU_RECV_STATE_ERROR:
+ return SPDK_ISCSI_CONNECTION_FATAL;
+ default:
+ assert(false);
+ printf("code should not come here\n");
+ break;
+ }
+ } while (prev_state != conn->pdu_recv_state);
+
+ return 0;
+}
+
+#define GET_PDU_LOOP_COUNT 16
+
+static int
+fuzz_iscsi_handle_incoming_pdus(struct spdk_iscsi_conn *conn)
+{
+ int i, rc;
+
+ /* Read new PDUs from network */
+ for (i = 0; i < GET_PDU_LOOP_COUNT; i++) {
+ rc = iscsi_fuzz_read_pdu(conn);
+ if (rc == 0) {
+ break;
+ } else if (rc < 0) {
+ return rc;
+ }
+ }
+
+ return i;
+}
+
+static void
+fuzz_iscsi_send_login_request(struct fuzz_iscsi_dev_ctx *dev_ctx, uint8_t session_type)
+{
+ struct fuzz_iscsi_io_ctx *io_ctx = NULL;
+ struct spdk_iscsi_pdu *req_pdu;
+ struct iscsi_bhs_login_req *login_req;
+ struct spdk_iscsi_conn *conn = dev_ctx->conn;
+
+ req_pdu = iscsi_get_pdu(conn);
+ req_pdu->writev_offset = 0;
+ req_pdu->hdigest_valid_bytes = 0;
+ req_pdu->ahs_valid_bytes = 0;
+ req_pdu->data_buf_len = 8192;
+ req_pdu->data = calloc(1, 8192);
+ assert(req_pdu->data != NULL);
+ req_pdu->data_segment_len = 0;
+
+ login_req = (struct iscsi_bhs_login_req *)&req_pdu->bhs;
+ io_ctx = &dev_ctx->io_ctx;
+ io_ctx->req.login_req = login_req;
+ io_ctx->req.login_req->version_min = 0;
+ /* a new session */
+ io_ctx->req.login_req->tsih = 0;
+
+ req_pdu->bhs.opcode = ISCSI_OP_LOGIN;
+ req_pdu->bhs.immediate = 1;
+ req_pdu->bhs.reserved = 0;
+ req_pdu->bhs_valid_bytes = ISCSI_BHS_LEN;
+ req_pdu->bhs.total_ahs_len = 0;
+
+ /* An initiator that chooses to operate without iSCSI security and with
+ * all the operational parameters taking the default values issues the
+ * Login with the T bit set to 1, the CSG set to
+ * LoginOperationalNegotiation, and the NSG set to FullFeaturePhase.
+ *
+ * Byte / 0 | 1 | 2 | 3 |
+ * |0 1 2 3 4 5 6 7|0 1 2 3 4 5 6 7|0 1 2 3 4 5 6 7|0 1 2 3 4 5 6 7|
+ * +---------------+---------------+---------------+---------------+
+ * 0|.|1| 0x03 |T|C|.|.|CSG|NSG| Version-max | Version-min |
+ */
+ req_pdu->bhs.flags = ISCSI_LOGIN_TRANSIT | (ISCSI_OPERATIONAL_NEGOTIATION_PHASE << 2) |
+ ISCSI_FULL_FEATURE_PHASE;
+
+ req_pdu->data_segment_len = iscsi_append_text(conn, "InitiatorName", g_init_name,
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "HeaderDigest", "None",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "DataDigest", "None",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "DefaultTime2Wait", "2",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "DefaultTime2Retain", "0",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "IFMarker", "No",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "OFMarker", "No",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "ErrorRecoveryLevel", "0",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+
+ if (session_type == SESSION_TYPE_DISCOVERY) {
+ /* Discovery PDU */
+ conn->sess->session_type = SESSION_TYPE_DISCOVERY;
+ req_pdu->data_segment_len = iscsi_append_text(conn, "SessionType", "Discovery",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "MaxRecvDataSegmentLength", "32768",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ } else {
+ /* Login PDU */
+ conn->sess->session_type = SESSION_TYPE_NORMAL;
+ req_pdu->data_segment_len = iscsi_append_text(conn, "SessionType", "Normal",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "TargetName", g_tgt_name,
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "InitialR2T", "No",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "ImmediateData", "Yes",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "MaxBurstLength", "16776192",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "FirstBurstLength", "262144",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "MaxOutstandingR2T", "1",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "MaxConnections", "1",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "DataPDUInOrder", "Yes",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "DataSequenceInOrder", "Yes",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ req_pdu->data_segment_len = iscsi_append_text(conn, "MaxRecvDataSegmentLength", "262144",
+ req_pdu->data, req_pdu->data_buf_len, req_pdu->data_segment_len);
+ }
+
+ DSET24(req_pdu->bhs.data_segment_len, req_pdu->data_segment_len);
+ iscsi_conn_write_pdu(conn, req_pdu, iscsi_conn_pdu_generic_complete, NULL);
+}
+
+static void
+fuzz_iscsi_send_logout_request(struct fuzz_iscsi_dev_ctx *dev_ctx)
+{
+ struct fuzz_iscsi_io_ctx *io_ctx = NULL;
+ struct spdk_iscsi_pdu *req_pdu;
+ struct iscsi_bhs_logout_req *logout_req;
+ struct spdk_iscsi_conn *conn = dev_ctx->conn;
+
+ conn->is_logged_out = true;
+
+ req_pdu = iscsi_get_pdu(conn);
+ req_pdu->writev_offset = 0;
+ req_pdu->hdigest_valid_bytes = 0;
+ req_pdu->ahs_valid_bytes = 0;
+ req_pdu->data_buf_len = 0;
+
+ logout_req = (struct iscsi_bhs_logout_req *)&req_pdu->bhs;
+ io_ctx = &dev_ctx->io_ctx;
+ io_ctx->req.logout_req = logout_req;
+
+ req_pdu->bhs.opcode = ISCSI_OP_LOGOUT;
+ req_pdu->bhs.immediate = 1;
+ req_pdu->bhs.reserved = 0;
+ req_pdu->bhs_valid_bytes = ISCSI_BHS_LEN;
+ req_pdu->bhs.total_ahs_len = 0;
+ req_pdu->bhs.flags = 0;
+
+ DSET24(req_pdu->bhs.data_segment_len, 0);
+ iscsi_conn_write_pdu(conn, req_pdu, iscsi_conn_pdu_generic_complete, conn);
+}
+
+static void
+iscsi_fuzz_conn_reset(struct spdk_iscsi_conn *conn, struct spdk_iscsi_sess *sess)
+{
+ conn->sess = sess;
+ conn->data_in_cnt = 0;
+ conn->params = NULL;
+ conn->header_digest = true;
+ conn->data_digest = false;
+ conn->header_digest = 0;
+ conn->MaxRecvDataSegmentLength = 8192;
+ conn->full_feature = 0;
+ conn->pdu_recv_state = ISCSI_PDU_RECV_STATE_AWAIT_PDU_READY;
+ conn->pdu_in_progress = NULL;
+ conn->is_logged_out = 0;
+}
+
+static void
+iscsi_fuzz_sock_connect(struct spdk_iscsi_conn *conn)
+{
+ const char *host = g_tgt_ip;
+ const char *port = g_tgt_port;
+ char saddr[INET6_ADDRSTRLEN], caddr[INET6_ADDRSTRLEN];
+ uint16_t cport, sport;
+ int rc = 0;
+
+ conn->sock = spdk_sock_connect(host, spdk_strtol(port, 10), NULL);
+ if (conn->sock == NULL) {
+ fprintf(stderr, "connect error(%d): %s\n", errno, spdk_strerror(errno));
+ spdk_sock_close(&conn->sock);
+ return;
+ }
+ fprintf(stderr, "\nConnecting to the server on %s:%s\n", host, port);
+
+ rc = spdk_sock_getaddr(conn->sock, saddr, sizeof(saddr), &sport, caddr, sizeof(caddr), &cport);
+ if (rc < 0) {
+ fprintf(stderr, "Cannot get connection addresses\n");
+ spdk_sock_close(&conn->sock);
+ return;
+ }
+
+ fprintf(stderr, "Connection accepted from (%s, %hu) to (%s, %hu)\n", caddr, cport, saddr, sport);
+
+}
+
+static void
+check_successful_op(struct fuzz_iscsi_dev_ctx *dev_ctx, struct fuzz_iscsi_io_ctx *io_ctx)
+{
+ if (g_is_valid_opcode) {
+ fprintf(stderr, "Sent a valid opcode PDU.\n");
+ dev_ctx->num_valid_pdus++;
+ } else {
+ fprintf(stderr, "Sent an invalid opcode PDU.\n");
+ }
+}
+
+/* submit requests begin */
+static void
+dev_submit_requests(struct fuzz_iscsi_dev_ctx *dev_ctx)
+{
+ struct fuzz_iscsi_io_ctx *io_ctx = NULL;
+ uint8_t opcode;
+ struct spdk_iscsi_pdu *req_pdu;
+ struct iscsi_bhs *bhs;
+ struct iscsi_bhs_nop_out *nop_out_req;
+ struct iscsi_bhs_scsi_req *scsi_req;
+ struct iscsi_bhs_task_req *task_req;
+ struct iscsi_bhs_text_req *text_req;
+ struct iscsi_bhs_data_out *data_out_req;
+ struct iscsi_bhs_snack_req *snack_req;
+ unsigned int rand_seed;
+ bool is_p99;
+
+ g_is_valid_opcode = true;
+
+ /* Random PDU */
+ opcode = rand() % 0x3f;
+ fprintf(stderr, "Random request bhs.opcode of Initiator is 0x%x.\n", opcode);
+
+ if ((opcode == ISCSI_OP_LOGIN) || (opcode == ISCSI_OP_LOGOUT)) {
+ /* only need send next */
+ fprintf(stderr, "LOGIN and LOGOUT opcodes are ignored here.\n");
+ return;
+ }
+
+ req_pdu = iscsi_get_pdu(dev_ctx->conn);
+ req_pdu->writev_offset = 0;
+ req_pdu->hdigest_valid_bytes = 0;
+ req_pdu->ahs_valid_bytes = 0;
+ req_pdu->data_buf_len = 0;
+
+ dev_ctx->conn->sess->session_type = SESSION_TYPE_NORMAL;
+
+ io_ctx = &dev_ctx->io_ctx;
+
+ switch (opcode) {
+ case ISCSI_OP_NOPOUT:
+ nop_out_req = (struct iscsi_bhs_nop_out *)&req_pdu->bhs;
+ io_ctx->req.nop_out_req = nop_out_req;
+ break;
+ case ISCSI_OP_SCSI:
+ scsi_req = (struct iscsi_bhs_scsi_req *)&req_pdu->bhs;
+ io_ctx->req.scsi_req = scsi_req;
+ break;
+ case ISCSI_OP_TASK:
+ task_req = (struct iscsi_bhs_task_req *)&req_pdu->bhs;
+ io_ctx->req.task_req = task_req;
+ break;
+ case ISCSI_OP_TEXT:
+ text_req = (struct iscsi_bhs_text_req *)&req_pdu->bhs;
+ io_ctx->req.text_req = text_req;
+ break;
+ case ISCSI_OP_SCSI_DATAOUT:
+ data_out_req = (struct iscsi_bhs_data_out *)&req_pdu->bhs;
+ io_ctx->req.data_out_req = data_out_req;
+ break;
+ case ISCSI_OP_SNACK:
+ snack_req = (struct iscsi_bhs_snack_req *)&req_pdu->bhs;
+ io_ctx->req.snack_req = snack_req;
+ break;
+ default:
+ bhs = (struct iscsi_bhs *)&req_pdu->bhs;
+ io_ctx->req.bhs = bhs;
+ g_is_valid_opcode = false;
+ break;
+ }
+
+ prep_iscsi_pdu_bhs_opcode_cmd(dev_ctx, io_ctx);
+ io_ctx->req.bhs->opcode = opcode;
+ req_pdu->bhs.opcode = opcode;
+ req_pdu->bhs.immediate = 1;
+ req_pdu->bhs.reserved = 0;
+ req_pdu->bhs_valid_bytes = ISCSI_BHS_LEN;
+ req_pdu->bhs.total_ahs_len = 0;
+ req_pdu->bhs.stat_sn = 0;
+ DSET24(req_pdu->bhs.data_segment_len, 0);
+
+ if (opcode <= ISCSI_OP_TEXT) {
+ rand_seed = time(NULL);
+ is_p99 = rand_r(&rand_seed) % 100 == 0 ? true : false;
+ if (!is_p99) { /* Remaining 1% */
+ switch (opcode) {
+ case ISCSI_OP_NOPOUT:
+ if (req_pdu->bhs.immediate) {
+ io_ctx->req.nop_out_req->cmd_sn = dev_ctx->current_cmd_sn;
+ } else {
+ io_ctx->req.nop_out_req->cmd_sn = dev_ctx->current_cmd_sn++;
+ }
+ break;
+ case ISCSI_OP_SCSI:
+ if (req_pdu->bhs.immediate) {
+ io_ctx->req.scsi_req->cmd_sn = dev_ctx->current_cmd_sn;
+ } else {
+ io_ctx->req.scsi_req->cmd_sn = dev_ctx->current_cmd_sn++;
+ }
+ break;
+ case ISCSI_OP_TASK:
+ if (req_pdu->bhs.immediate) {
+ io_ctx->req.task_req->cmd_sn = dev_ctx->current_cmd_sn;
+ } else {
+ io_ctx->req.task_req->cmd_sn = dev_ctx->current_cmd_sn++;
+ }
+ break;
+ case ISCSI_OP_TEXT:
+ if (req_pdu->bhs.immediate) {
+ io_ctx->req.text_req->cmd_sn = dev_ctx->current_cmd_sn;
+ } else {
+ io_ctx->req.text_req->cmd_sn = dev_ctx->current_cmd_sn++;
+ }
+ break;
+ default:
+ break;
+ }
+ }
+ }
+
+ if (opcode == ISCSI_OP_SCSI) {
+ /* avoid ((R_bit != 0) && (W_bit != 0)) is true */
+ io_ctx->req.scsi_req->read_bit = 0;
+ io_ctx->req.scsi_req->write_bit = 0;
+ }
+
+ if (opcode == ISCSI_OP_TEXT) {
+ /* avoid: (F_bit && C_bit) is true */
+ io_ctx->req.text_req->flags = 0;
+ /* avoid: correct itt is not equal to the current itt */
+ io_ctx->req.text_req->itt = 0;
+ }
+
+ fprintf(stderr, "Dumping this request bhs contents now.\n");
+ print_req_obj(dev_ctx, io_ctx);
+
+ check_successful_op(dev_ctx, io_ctx);
+ dev_ctx->num_sent_pdus++;
+
+ iscsi_conn_write_pdu(dev_ctx->conn, req_pdu,
+ iscsi_conn_pdu_generic_complete, NULL);
+}
+/* submit requests end */
+
+static int
+poll_dev(void *ctx)
+{
+ struct fuzz_iscsi_dev_ctx *dev_ctx = ctx;
+ struct spdk_iscsi_conn *conn = dev_ctx->conn;
+ uint64_t current_ticks;
+ struct spdk_iscsi_pdu *pdu, *tmp;
+
+ current_ticks = spdk_get_ticks();
+ if (current_ticks > g_runtime_ticks) {
+ g_run = false;
+ }
+
+ if (!g_run) {
+ /* Logout PDU */
+ fuzz_iscsi_send_logout_request(dev_ctx);
+ fuzz_iscsi_handle_incoming_pdus(conn);
+
+ TAILQ_FOREACH_SAFE(pdu, &g_get_pdu_list, tailq, tmp) {
+ TAILQ_REMOVE(&g_get_pdu_list, pdu, tailq);
+ iscsi_put_pdu(pdu);
+ }
+
+ spdk_sock_close(&conn->sock);
+
+ TAILQ_FOREACH_SAFE(pdu, &conn->write_pdu_list, tailq, tmp) {
+ TAILQ_REMOVE(&conn->write_pdu_list, pdu, tailq);
+ iscsi_put_pdu(pdu);
+ }
+
+ free(conn);
+
+ spdk_poller_unregister(&dev_ctx->poller);
+ __sync_sub_and_fetch(&g_num_active_threads, 1);
+
+ return -1;
+ }
+
+ if (conn->is_logged_out) {
+ spdk_sock_close(&conn->sock);
+ iscsi_fuzz_conn_reset(conn, &dev_ctx->sess);
+ iscsi_fuzz_sock_connect(conn);
+ usleep(1000);
+
+ /* Login PDU */
+ fuzz_iscsi_send_login_request(dev_ctx, SESSION_TYPE_NORMAL);
+ } else if (conn->full_feature == 1) {
+ dev_submit_requests(dev_ctx);
+ }
+
+ spdk_sock_flush(conn->sock);
+
+ fuzz_iscsi_handle_incoming_pdus(conn);
+
+ return 0;
+}
+
+static void
+start_io(void *ctx)
+{
+ struct fuzz_iscsi_dev_ctx *dev_ctx = ctx;
+
+ dev_ctx->sess.ExpCmdSN = 0;
+ dev_ctx->sess.MaxCmdSN = 64;
+ dev_ctx->sess.MaxBurstLength = SPDK_ISCSI_MAX_RECV_DATA_SEGMENT_LENGTH;
+ dev_ctx->sess.MaxOutstandingR2T = 1;
+ dev_ctx->sess.tag = 1;
+ dev_ctx->sess.tsih = 256;
+
+ dev_ctx->conn = calloc(1, sizeof(*dev_ctx->conn));
+ assert(dev_ctx->conn != NULL);
+ TAILQ_INIT(&dev_ctx->conn->write_pdu_list);
+
+ iscsi_fuzz_conn_reset(dev_ctx->conn, &dev_ctx->sess);
+ iscsi_fuzz_sock_connect(dev_ctx->conn);
+ usleep(1000);
+
+ /* Login PDU */
+ fuzz_iscsi_send_login_request(dev_ctx, SESSION_TYPE_NORMAL);
+
+ if (g_random_seed) {
+ dev_ctx->random_seed = g_random_seed;
+ } else {
+ dev_ctx->random_seed = spdk_get_ticks();
+ }
+
+ dev_ctx->poller = SPDK_POLLER_REGISTER(poll_dev, dev_ctx, 0);
+ if (dev_ctx->poller == NULL) {
+ return;
+ }
+}
+
+static int
+check_app_completion(void *ctx)
+{
+ if (g_num_active_threads == 0) {
+ spdk_poller_unregister(&g_app_completion_poller);
+ printf("Fuzzing completed. Shutting down the fuzz application.\n\n");
+ cleanup();
+ spdk_app_stop(0);
+ }
+ return 0;
+}
+
+static void
+begin_iscsi_fuzz(void *ctx)
+{
+ struct fuzz_iscsi_dev_ctx *dev_ctx;
+ int rc;
+
+ g_runtime_ticks = spdk_get_ticks() + g_runtime * spdk_get_ticks_hz();
+
+ g_valid_buffer = spdk_malloc(0x1000, 0x200, NULL, SPDK_ENV_LCORE_ID_ANY, SPDK_MALLOC_SHARE);
+ if (g_valid_buffer == NULL) {
+ fprintf(stderr, "Failed to allocate a valid buffer for random PDUs\n");
+ goto out;
+ }
+
+ rc = fuzz_iscsi_dev_init();
+ if (rc) {
+ fprintf(stderr, "fuzz_iscsi_dev_init() failed.\n");
+ goto out;
+ }
+
+ TAILQ_FOREACH(dev_ctx, &g_dev_list, link) {
+ assert(dev_ctx->thread != NULL);
+ spdk_thread_send_msg(dev_ctx->thread, start_io, dev_ctx);
+ __sync_add_and_fetch(&g_num_active_threads, 1);
+ }
+
+ g_app_completion_poller = SPDK_POLLER_REGISTER(check_app_completion, NULL, 1000000);
+ if (g_app_completion_poller == NULL) {
+ fprintf(stderr, "Failed to register a poller for test completion checking.\n");
+ goto out;
+ }
+
+ return;
+out:
+ cleanup();
+ spdk_app_stop(0);
+}
+
+static void
+iscsi_fuzz_usage(void)
+{
+ fprintf(stderr, " -T <path> iSCSI Target IP address.\n");
+ fprintf(stderr, " -S <integer> Seed value for test.\n");
+ fprintf(stderr,
+ " -t <integer> Time in seconds to run the fuzz test. Only valid if -j is not specified.\n");
+}
+
+static int
+iscsi_fuzz_parse(int ch, char *arg)
+{
+ int64_t error_test;
+
+ switch (ch) {
+ case 'T':
+ g_tgt_ip = optarg;
+ break;
+ case 'S':
+ error_test = spdk_strtol(arg, 10);
+ if (error_test < 0) {
+ fprintf(stderr, "Invalid value supplied for the random seed.\n");
+ return -1;
+ } else {
+ g_random_seed = error_test;
+ }
+ break;
+ case 't':
+ g_runtime = spdk_strtol(optarg, 10);
+ if (g_runtime <= 0 || g_runtime > MAX_RUNTIME_S) {
+ fprintf(stderr, "You must supply a positive runtime value less than %d.\n", MAX_RUNTIME_S);
+ return -1;
+ }
+ break;
+ case '?':
+ default:
+ iscsi_fuzz_usage();
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+int
+main(int argc, char **argv)
+{
+ struct spdk_app_opts opts = {};
+ int rc;
+
+ g_runtime = DEFAULT_RUNTIME;
+ srand((unsigned)time(0));
+
+ TAILQ_INIT(&g_get_pdu_list);
+
+ spdk_app_opts_init(&opts);
+ opts.name = "iscsi_fuzz";
+
+ if ((rc = spdk_app_parse_args(argc, argv, &opts, "T:S:t:", NULL, iscsi_fuzz_parse,
+ iscsi_fuzz_usage) != SPDK_APP_PARSE_ARGS_SUCCESS)) {
+ return rc;
+ }
+
+ rc = spdk_app_start(&opts, begin_iscsi_fuzz, NULL);
+
+ return rc;
+}
diff --git a/src/spdk/test/app/fuzz/nvme_fuzz/.gitignore b/src/spdk/test/app/fuzz/nvme_fuzz/.gitignore
new file mode 100644
index 000000000..801146458
--- /dev/null
+++ b/src/spdk/test/app/fuzz/nvme_fuzz/.gitignore
@@ -0,0 +1 @@
+nvme_fuzz
diff --git a/src/spdk/test/app/fuzz/nvme_fuzz/Makefile b/src/spdk/test/app/fuzz/nvme_fuzz/Makefile
new file mode 100644
index 000000000..b7ad5e172
--- /dev/null
+++ b/src/spdk/test/app/fuzz/nvme_fuzz/Makefile
@@ -0,0 +1,49 @@
+#
+# Copyright (c) Intel Corporation.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in
+# the documentation and/or other materials provided with the
+# distribution.
+# * Neither the name of Intel Corporation nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+SPDK_ROOT_DIR := $(abspath $(CURDIR)/../../../..)
+include $(SPDK_ROOT_DIR)/mk/spdk.common.mk
+include $(SPDK_ROOT_DIR)/mk/spdk.modules.mk
+
+APP = nvme_fuzz
+
+CFLAGS += -I$(SPDK_ROOT_DIR)/test/app/fuzz/common
+
+C_SRCS := nvme_fuzz.c
+
+SPDK_LIB_LIST += $(SOCK_MODULES_LIST)
+SPDK_LIB_LIST += conf event json jsonrpc log nvme rpc sock thread trace util
+
+ifeq ($(CONFIG_RDMA),y)
+SPDK_LIB_LIST += rdma
+endif
+
+include $(SPDK_ROOT_DIR)/mk/spdk.app.mk
diff --git a/src/spdk/test/app/fuzz/nvme_fuzz/README.md b/src/spdk/test/app/fuzz/nvme_fuzz/README.md
new file mode 100644
index 000000000..2f188b5b8
--- /dev/null
+++ b/src/spdk/test/app/fuzz/nvme_fuzz/README.md
@@ -0,0 +1,52 @@
+# Overview
+
+This application is intended to fuzz test the NVMe-oF target or a physical NVMe drive by
+submitting randomized NVMe commands through the SPDK NVMe initiator. Both local and remote
+drives are configured through a .ini style config file (See the -C option on the application).
+Multiple controllers and namespaces can be exposed to the fuzzer at a time. In order to
+handle multiple namespaces, the fuzzer will round robin assign a thread to each namespace and
+submit commands to that thread at a set queue depth. (currently 128 for I/O, 16 for Admin). The
+application will terminate under three conditions:
+
+1. The user specified run time expires (see the -t flag).
+2. One of the target controllers stops completing I/O operations back to the fuzzer i.e. controller timeout.
+3. The user specified a json file containing operations to run and the fuzzer has received valid completions for all of them.
+
+# Output
+
+By default, the fuzzer will print commands that:
+
+1. Complete successfully back from the target, or
+2. Are outstanding at the time of a controller timeout.
+
+Commands are dumped as named objects in json format which can then be supplied back to the
+script for targeted debugging on a subsequent run. See `Debugging` below.
+By default no output is generated when a specific command is returned with a failed status.
+This can be overridden with the -V flag. if -V is specified, each command will be dumped as
+it is completed in the JSON format specified above.
+At the end of each test run, a summary is printed for each namespace in the following format:
+
+~~~
+NS: 0x200079262300 admin qp, Total commands completed: 462459, total successful commands: 1960, random_seed: 4276918833
+~~~
+
+# Debugging
+
+If a controller hangs when processing I/O generated by the fuzzer, the fuzzer will stop
+submitting I/O and dump out all outstanding I/O on the qpair that timed out. The I/O are
+dumped as valid json. You can combine the dumped commands from the fuzzer into a json
+array in a file and then pass them to the fuzzer using the -j option. Please see the
+example.json file in this directory for an example of a properly formed array of command
+structures.
+
+Please note that you can also craft your own custom command values by using the output
+from the fuzzer as a template.
+
+# JSON Format
+
+Most of the variables in the spdk_nvme_cmd structure are represented as numbers in JSON.
+The only exception to this rule is the dptr union. This is a 16 byte union structure that
+is represented as a base64 string. If writing custom commands for input, please note this
+distinction or the application will be unable to load your custom input.
+
+Happy Fuzzing!
diff --git a/src/spdk/test/app/fuzz/nvme_fuzz/example.json b/src/spdk/test/app/fuzz/nvme_fuzz/example.json
new file mode 100644
index 000000000..95540746e
--- /dev/null
+++ b/src/spdk/test/app/fuzz/nvme_fuzz/example.json
@@ -0,0 +1,290 @@
+{
+"struct spdk_nvme_cmd": {
+ "opc": 7,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 24,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 43,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 12,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 7,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 24,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 43,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 12,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 7,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 24,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 43,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 12,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 7,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 24,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 43,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ },
+ "struct spdk_nvme_cmd": {
+ "opc": 12,
+ "fuse": 1,
+ "rsvd1": 13,
+ "psdt": 1,
+ "cid": 56732,
+ "nsid": 1,
+ "rsvd2": 1516848792,
+ "rsvd3": 1233945838,
+ "mptr": 3452736735,
+ "dptr": "FHENPcH+xM0tioD+0SrNrQ==",
+ "cdw10": 3190735246,
+ "cdw11": 2629178873,
+ "cdw12": 138580308,
+ "cdw13": 1603605200,
+ "cdw14": 3031880384,
+ "cdw15": 644909208
+ }
+}
diff --git a/src/spdk/test/app/fuzz/nvme_fuzz/nvme_fuzz.c b/src/spdk/test/app/fuzz/nvme_fuzz/nvme_fuzz.c
new file mode 100644
index 000000000..127bc1bff
--- /dev/null
+++ b/src/spdk/test/app/fuzz/nvme_fuzz/nvme_fuzz.c
@@ -0,0 +1,931 @@
+/*-
+ * BSD LICENSE
+ *
+ * Copyright (c) Intel Corporation. All rights reserved.
+ * Copyright (c) 2019 Mellanox Technologies LTD. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name of Intel Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "spdk/stdinc.h"
+#include "spdk/conf.h"
+#include "spdk/env.h"
+#include "spdk/event.h"
+#include "spdk/util.h"
+#include "spdk/string.h"
+#include "spdk/nvme_spec.h"
+#include "spdk/nvme.h"
+#include "spdk/likely.h"
+#include "spdk/json.h"
+#include "fuzz_common.h"
+
+#define UNIQUE_OPCODES 256
+
+const char g_nvme_cmd_json_name[] = "struct spdk_nvme_cmd";
+char *g_conf_file;
+char *g_json_file = NULL;
+uint64_t g_runtime_ticks;
+unsigned int g_seed_value = 0;
+int g_runtime;
+
+int g_num_active_threads = 0;
+uint32_t g_admin_depth = 16;
+uint32_t g_io_depth = 128;
+
+bool g_valid_ns_only = false;
+bool g_verbose_mode = false;
+bool g_run_admin_commands = false;
+bool g_run;
+
+struct spdk_poller *g_app_completion_poller;
+bool g_successful_io_opcodes[UNIQUE_OPCODES] = {0};
+bool g_successful_admin_opcodes[UNIQUE_OPCODES] = {0};
+
+struct spdk_nvme_cmd *g_cmd_array;
+size_t g_cmd_array_size;
+
+/* I need context objects here because I need to keep track of all I/O that are in flight. */
+struct nvme_fuzz_request {
+ struct spdk_nvme_cmd cmd;
+ struct nvme_fuzz_qp *qp;
+ TAILQ_ENTRY(nvme_fuzz_request) link;
+};
+
+struct nvme_fuzz_trid {
+ struct spdk_nvme_transport_id trid;
+ TAILQ_ENTRY(nvme_fuzz_trid) tailq;
+};
+
+struct nvme_fuzz_ctrlr {
+ struct spdk_nvme_ctrlr *ctrlr;
+ TAILQ_ENTRY(nvme_fuzz_ctrlr) tailq;
+};
+
+struct nvme_fuzz_qp {
+ struct spdk_nvme_qpair *qpair;
+ /* array of context objects equal in length to the queue depth */
+ struct nvme_fuzz_request *req_ctx;
+ TAILQ_HEAD(, nvme_fuzz_request) free_ctx_objs;
+ TAILQ_HEAD(, nvme_fuzz_request) outstanding_ctx_objs;
+ unsigned int random_seed;
+ uint64_t completed_cmd_counter;
+ uint64_t submitted_cmd_counter;
+ uint64_t successful_completed_cmd_counter;
+ uint64_t timeout_tsc;
+ uint32_t num_cmds_outstanding;
+ bool timed_out;
+ bool is_admin;
+};
+
+struct nvme_fuzz_ns {
+ struct spdk_nvme_ns *ns;
+ struct spdk_nvme_ctrlr *ctrlr;
+ struct spdk_thread *thread;
+ struct spdk_poller *req_poller;
+ struct nvme_fuzz_qp io_qp;
+ struct nvme_fuzz_qp a_qp;
+ uint32_t nsid;
+ TAILQ_ENTRY(nvme_fuzz_ns) tailq;
+};
+
+static TAILQ_HEAD(, nvme_fuzz_ns) g_ns_list = TAILQ_HEAD_INITIALIZER(g_ns_list);
+static TAILQ_HEAD(, nvme_fuzz_ctrlr) g_ctrlr_list = TAILQ_HEAD_INITIALIZER(g_ctrlr_list);
+static TAILQ_HEAD(, nvme_fuzz_trid) g_trid_list = TAILQ_HEAD_INITIALIZER(g_trid_list);
+
+static bool
+parse_nvme_cmd_obj(void *item, struct spdk_json_val *value, size_t num_values)
+{
+ struct spdk_nvme_cmd *cmd = item;
+ struct spdk_json_val *next_val;
+ uint64_t tmp_val;
+ size_t i = 0;
+
+ while (i < num_values) {
+ if (value->type == SPDK_JSON_VAL_NAME) {
+ next_val = value + 1;
+ if (!strncmp(value->start, "opc", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UNSIGNED_8BIT_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->opc = tmp_val;
+ }
+ } else if (!strncmp(value->start, "fuse", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UNSIGNED_2BIT_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->fuse = tmp_val;
+ }
+ } else if (!strncmp(value->start, "rsvd1", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UNSIGNED_4BIT_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->rsvd1 = tmp_val;
+ }
+ } else if (!strncmp(value->start, "psdt", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UNSIGNED_2BIT_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->psdt = tmp_val;
+ }
+ } else if (!strncmp(value->start, "cid", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT16_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->cid = tmp_val;
+ }
+ } else if (!strncmp(value->start, "nsid", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT32_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->nsid = tmp_val;
+ }
+ } else if (!strncmp(value->start, "rsvd2", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT32_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->rsvd2 = tmp_val;
+ }
+ } else if (!strncmp(value->start, "rsvd3", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT32_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->rsvd3 = tmp_val;
+ }
+ } else if (!strncmp(value->start, "mptr", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT64_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->mptr = tmp_val;
+ }
+ } else if (!strncmp(value->start, "dptr", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_STRING) {
+ if (fuzz_get_base_64_buffer_value(&cmd->dptr, sizeof(cmd->dptr), (char *)next_val->start,
+ next_val->len)) {
+ goto invalid;
+ }
+ }
+ } else if (!strncmp(value->start, "cdw10", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT32_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->cdw10 = tmp_val;
+ }
+ } else if (!strncmp(value->start, "cdw11", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT32_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->cdw11 = tmp_val;
+ }
+ } else if (!strncmp(value->start, "cdw12", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT32_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->cdw12 = tmp_val;
+ }
+ } else if (!strncmp(value->start, "cdw13", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT32_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->cdw13 = tmp_val;
+ }
+ } else if (!strncmp(value->start, "cdw14", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT32_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->cdw14 = tmp_val;
+ }
+ } else if (!strncmp(value->start, "cdw15", value->len)) {
+ if (next_val->type == SPDK_JSON_VAL_NUMBER) {
+ if (fuzz_parse_json_num(next_val, UINT32_MAX, &tmp_val)) {
+ goto invalid;
+ }
+ cmd->cdw15 = tmp_val;
+ }
+ }
+ }
+ i++;
+ value++;
+ }
+ return true;
+
+invalid:
+ fprintf(stderr, "Invalid value supplied for cmd->%.*s: %.*s\n", value->len, (char *)value->start,
+ next_val->len, (char *)next_val->start);
+ return false;
+}
+
+static void
+report_successful_opcodes(bool *array, int length)
+{
+ int i;
+
+ for (i = 0; i < length; i++) {
+ if (array[i] == true) {
+ printf("%d, ", i);
+ }
+ }
+ printf("\n");
+}
+
+static int
+print_nvme_cmd(void *cb_ctx, const void *data, size_t size)
+{
+ fprintf(stderr, "%s\n", (const char *)data);
+ return 0;
+}
+
+static void
+json_dump_nvme_cmd(struct spdk_nvme_cmd *cmd)
+{
+ struct spdk_json_write_ctx *w;
+ char *dptr_value;
+
+ dptr_value = fuzz_get_value_base_64_buffer(&cmd->dptr, sizeof(cmd->dptr));
+ if (dptr_value == NULL) {
+ fprintf(stderr, "Unable to allocate buffer context for printing command.\n");
+ return;
+ }
+
+ w = spdk_json_write_begin(print_nvme_cmd, cmd, SPDK_JSON_WRITE_FLAG_FORMATTED);
+ if (w == NULL) {
+ fprintf(stderr, "Unable to allocate json context for printing command.\n");
+ free(dptr_value);
+ return;
+ }
+
+ spdk_json_write_named_object_begin(w, g_nvme_cmd_json_name);
+ spdk_json_write_named_uint32(w, "opc", cmd->opc);
+ spdk_json_write_named_uint32(w, "fuse", cmd->fuse);
+ spdk_json_write_named_uint32(w, "rsvd1", cmd->rsvd1);
+ spdk_json_write_named_uint32(w, "psdt", cmd->psdt);
+ spdk_json_write_named_uint32(w, "cid", cmd->cid);
+ spdk_json_write_named_uint32(w, "nsid", cmd->nsid);
+ spdk_json_write_named_uint32(w, "rsvd2", cmd->rsvd2);
+ spdk_json_write_named_uint32(w, "rsvd3", cmd->rsvd3);
+ spdk_json_write_named_uint32(w, "mptr", cmd->mptr);
+ spdk_json_write_named_string(w, "dptr", dptr_value);
+ spdk_json_write_named_uint32(w, "cdw10", cmd->cdw10);
+ spdk_json_write_named_uint32(w, "cdw11", cmd->cdw11);
+ spdk_json_write_named_uint32(w, "cdw12", cmd->cdw12);
+ spdk_json_write_named_uint32(w, "cdw13", cmd->cdw13);
+ spdk_json_write_named_uint32(w, "cdw14", cmd->cdw14);
+ spdk_json_write_named_uint32(w, "cdw15", cmd->cdw15);
+ spdk_json_write_object_end(w);
+
+ free(dptr_value);
+ spdk_json_write_end(w);
+}
+
+static void
+json_dump_nvme_cmd_list(struct nvme_fuzz_qp *qp)
+{
+ struct nvme_fuzz_request *ctx;
+
+ TAILQ_FOREACH(ctx, &qp->outstanding_ctx_objs, link) {
+ json_dump_nvme_cmd(&ctx->cmd);
+ }
+}
+
+static void
+handle_timeout(struct nvme_fuzz_qp *qp, bool is_admin)
+{
+ fprintf(stderr, "An %s queue has timed out. Dumping all outstanding commands from that queue\n",
+ is_admin ? "Admin" : "I/O");
+ json_dump_nvme_cmd_list(qp);
+ qp->timed_out = true;
+}
+
+static void submit_ns_cmds(struct nvme_fuzz_ns *ns_entry);
+
+static void
+nvme_fuzz_cpl_cb(void *cb_arg, const struct spdk_nvme_cpl *cpl)
+{
+ struct nvme_fuzz_request *ctx = cb_arg;
+ struct nvme_fuzz_qp *qp = ctx->qp;
+
+ qp->completed_cmd_counter++;
+ if (spdk_unlikely(cpl->status.sc == SPDK_NVME_SC_SUCCESS)) {
+ fprintf(stderr, "The following %s command (command num %lu) completed successfully\n",
+ qp->is_admin ? "Admin" : "I/O", qp->completed_cmd_counter);
+ qp->successful_completed_cmd_counter++;
+ json_dump_nvme_cmd(&ctx->cmd);
+
+ if (qp->is_admin) {
+ __sync_bool_compare_and_swap(&g_successful_admin_opcodes[ctx->cmd.opc], false, true);
+ } else {
+ __sync_bool_compare_and_swap(&g_successful_io_opcodes[ctx->cmd.opc], false, true);
+ }
+ } else if (g_verbose_mode == true) {
+ fprintf(stderr, "The following %s command (command num %lu) failed as expected.\n",
+ qp->is_admin ? "Admin" : "I/O", qp->completed_cmd_counter);
+ json_dump_nvme_cmd(&ctx->cmd);
+ }
+
+ qp->timeout_tsc = fuzz_refresh_timeout();
+ TAILQ_REMOVE(&qp->outstanding_ctx_objs, ctx, link);
+ TAILQ_INSERT_HEAD(&qp->free_ctx_objs, ctx, link);
+ assert(qp->num_cmds_outstanding > 0);
+ qp->num_cmds_outstanding--;
+}
+
+static int
+poll_for_completions(void *arg)
+{
+ struct nvme_fuzz_ns *ns_entry = arg;
+ uint64_t current_ticks = spdk_get_ticks();
+ uint64_t *counter;
+ if (!ns_entry->io_qp.timed_out) {
+ spdk_nvme_qpair_process_completions(ns_entry->io_qp.qpair, 0);
+ /* SAlways have to process admin completions for the purposes of keep alive. */
+ spdk_nvme_ctrlr_process_admin_completions(ns_entry->ctrlr);
+ }
+
+ if (g_cmd_array) {
+ if (g_run_admin_commands) {
+ counter = &ns_entry->a_qp.submitted_cmd_counter;
+ } else {
+ counter = &ns_entry->io_qp.submitted_cmd_counter;
+ }
+
+ if (*counter >= g_cmd_array_size) {
+ g_run = false;
+ }
+ } else {
+ if (current_ticks > g_runtime_ticks) {
+ g_run = false;
+ }
+ }
+
+ if (ns_entry->a_qp.timeout_tsc < current_ticks && !ns_entry->a_qp.timed_out &&
+ ns_entry->a_qp.num_cmds_outstanding > 0) {
+ handle_timeout(&ns_entry->a_qp, true);
+ }
+
+ if (ns_entry->io_qp.timeout_tsc < current_ticks && !ns_entry->io_qp.timed_out &&
+ ns_entry->io_qp.num_cmds_outstanding > 0) {
+ handle_timeout(&ns_entry->io_qp, false);
+ }
+
+ submit_ns_cmds(ns_entry);
+
+ if (g_run) {
+ return 0;
+ }
+ /*
+ * We either processed all I/O properly and can shut down normally, or we
+ * had a qp time out and we need to exit without reducing the values to 0.
+ */
+ if (ns_entry->io_qp.num_cmds_outstanding == 0 &&
+ ns_entry->a_qp.num_cmds_outstanding == 0) {
+ goto exit_handler;
+ } else if (ns_entry->io_qp.timed_out && (!g_run_admin_commands || ns_entry->a_qp.timed_out)) {
+ goto exit_handler;
+ } else {
+ return 0;
+ }
+
+exit_handler:
+ spdk_poller_unregister(&ns_entry->req_poller);
+ __sync_sub_and_fetch(&g_num_active_threads, 1);
+ spdk_thread_exit(ns_entry->thread);
+ return 0;
+}
+
+static void
+prep_nvme_cmd(struct nvme_fuzz_ns *ns_entry, struct nvme_fuzz_qp *qp, struct nvme_fuzz_request *ctx)
+{
+ if (g_cmd_array) {
+ memcpy(&ctx->cmd, &g_cmd_array[qp->submitted_cmd_counter], sizeof(ctx->cmd));
+ } else {
+ fuzz_fill_random_bytes((char *)&ctx->cmd, sizeof(ctx->cmd), &qp->random_seed);
+
+ if (g_valid_ns_only) {
+ ctx->cmd.nsid = ns_entry->nsid;
+ }
+ }
+}
+
+static int
+submit_qp_cmds(struct nvme_fuzz_ns *ns, struct nvme_fuzz_qp *qp)
+{
+ struct nvme_fuzz_request *ctx;
+ int rc;
+
+ if (qp->timed_out) {
+ return 0;
+ }
+ /* If we are reading from an array, we need to stop after the last one. */
+ while ((qp->submitted_cmd_counter < g_cmd_array_size || g_cmd_array_size == 0) &&
+ !TAILQ_EMPTY(&qp->free_ctx_objs)) {
+ ctx = TAILQ_FIRST(&qp->free_ctx_objs);
+ do {
+ prep_nvme_cmd(ns, qp, ctx);
+ } while (qp->is_admin && ctx->cmd.opc == SPDK_NVME_OPC_ASYNC_EVENT_REQUEST);
+
+ TAILQ_REMOVE(&qp->free_ctx_objs, ctx, link);
+ TAILQ_INSERT_HEAD(&qp->outstanding_ctx_objs, ctx, link);
+ qp->num_cmds_outstanding++;
+ qp->submitted_cmd_counter++;
+ if (qp->is_admin) {
+ rc = spdk_nvme_ctrlr_cmd_admin_raw(ns->ctrlr, &ctx->cmd, NULL, 0, nvme_fuzz_cpl_cb, ctx);
+ } else {
+ rc = spdk_nvme_ctrlr_cmd_io_raw(ns->ctrlr, qp->qpair, &ctx->cmd, NULL, 0, nvme_fuzz_cpl_cb, ctx);
+ }
+ if (rc) {
+ return rc;
+ }
+ }
+ return 0;
+}
+
+static void
+submit_ns_cmds(struct nvme_fuzz_ns *ns_entry)
+{
+ int rc;
+
+ if (!g_run) {
+ return;
+ }
+
+ if (g_run_admin_commands) {
+ rc = submit_qp_cmds(ns_entry, &ns_entry->a_qp);
+ if (rc) {
+ goto err_exit;
+ }
+ }
+
+ if (g_cmd_array == NULL || !g_run_admin_commands) {
+ rc = submit_qp_cmds(ns_entry, &ns_entry->io_qp);
+ }
+err_exit:
+ if (rc) {
+ /*
+ * I see the prospect of having a broken qpair on one ns as interesting
+ * enough to recommend stopping the application.
+ */
+ fprintf(stderr, "Unable to submit command with rc %d\n", rc);
+ g_run = false;
+ }
+}
+
+static void
+free_namespaces(void)
+{
+ struct nvme_fuzz_ns *ns, *tmp;
+
+ TAILQ_FOREACH_SAFE(ns, &g_ns_list, tailq, tmp) {
+ printf("NS: %p I/O qp, Total commands completed: %lu, total successful commands: %lu, random_seed: %u\n",
+ ns->ns,
+ ns->io_qp.completed_cmd_counter, ns->io_qp.successful_completed_cmd_counter, ns->io_qp.random_seed);
+ printf("NS: %p admin qp, Total commands completed: %lu, total successful commands: %lu, random_seed: %u\n",
+ ns->ns,
+ ns->a_qp.completed_cmd_counter, ns->a_qp.successful_completed_cmd_counter, ns->a_qp.random_seed);
+
+ TAILQ_REMOVE(&g_ns_list, ns, tailq);
+ if (ns->io_qp.qpair) {
+ spdk_nvme_ctrlr_free_io_qpair(ns->io_qp.qpair);
+ }
+ if (ns->io_qp.req_ctx) {
+ free(ns->io_qp.req_ctx);
+ }
+ if (ns->a_qp.req_ctx) {
+ free(ns->a_qp.req_ctx);
+ }
+ free(ns);
+ }
+}
+
+static void
+free_controllers(void)
+{
+ struct nvme_fuzz_ctrlr *ctrlr, *tmp;
+
+ TAILQ_FOREACH_SAFE(ctrlr, &g_ctrlr_list, tailq, tmp) {
+ TAILQ_REMOVE(&g_ctrlr_list, ctrlr, tailq);
+ spdk_nvme_detach(ctrlr->ctrlr);
+ free(ctrlr);
+ }
+}
+
+static void
+free_trids(void)
+{
+ struct nvme_fuzz_trid *trid, *tmp;
+
+ TAILQ_FOREACH_SAFE(trid, &g_trid_list, tailq, tmp) {
+ TAILQ_REMOVE(&g_trid_list, trid, tailq);
+ free(trid);
+ }
+}
+
+static void
+register_ns(struct spdk_nvme_ctrlr *ctrlr, struct spdk_nvme_ns *ns, uint32_t nsid)
+{
+ struct nvme_fuzz_ns *ns_entry;
+
+ ns_entry = calloc(1, sizeof(struct nvme_fuzz_ns));
+ if (ns_entry == NULL) {
+ fprintf(stderr, "Unable to allocate an entry for a namespace\n");
+ return;
+ }
+
+ ns_entry->ns = ns;
+ ns_entry->ctrlr = ctrlr;
+ ns_entry->nsid = nsid;
+
+ TAILQ_INIT(&ns_entry->io_qp.free_ctx_objs);
+ TAILQ_INIT(&ns_entry->io_qp.outstanding_ctx_objs);
+ if (g_run_admin_commands) {
+ ns_entry->a_qp.qpair = NULL;
+ TAILQ_INIT(&ns_entry->a_qp.free_ctx_objs);
+ TAILQ_INIT(&ns_entry->a_qp.outstanding_ctx_objs);
+ }
+ TAILQ_INSERT_TAIL(&g_ns_list, ns_entry, tailq);
+}
+
+static void
+register_ctrlr(struct spdk_nvme_ctrlr *ctrlr)
+{
+ struct nvme_fuzz_ctrlr *ctrlr_entry;
+ uint32_t nsid;
+ struct spdk_nvme_ns *ns;
+
+ ctrlr_entry = calloc(1, sizeof(struct nvme_fuzz_ctrlr));
+ if (ctrlr_entry == NULL) {
+ fprintf(stderr, "Unable to allocate an entry for a controller\n");
+ return;
+ }
+
+ ctrlr_entry->ctrlr = ctrlr;
+ TAILQ_INSERT_TAIL(&g_ctrlr_list, ctrlr_entry, tailq);
+
+ for (nsid = spdk_nvme_ctrlr_get_first_active_ns(ctrlr); nsid != 0;
+ nsid = spdk_nvme_ctrlr_get_next_active_ns(ctrlr, nsid)) {
+ ns = spdk_nvme_ctrlr_get_ns(ctrlr, nsid);
+ if (ns == NULL) {
+ continue;
+ }
+ register_ns(ctrlr, ns, nsid);
+ }
+}
+
+static void
+attach_cb(void *cb_ctx, const struct spdk_nvme_transport_id *trid,
+ struct spdk_nvme_ctrlr *ctrlr, const struct spdk_nvme_ctrlr_opts *opts)
+{
+ register_ctrlr(ctrlr);
+}
+
+static bool
+probe_cb(void *cb_ctx, const struct spdk_nvme_transport_id *trid, struct spdk_nvme_ctrlr_opts *opts)
+{
+ printf("Controller trtype %s\ttraddr %s\n", spdk_nvme_transport_id_trtype_str(trid->trtype),
+ trid->traddr);
+
+ return true;
+}
+
+static int
+prep_qpair(struct nvme_fuzz_ns *ns, struct nvme_fuzz_qp *qp, uint32_t max_qdepth)
+{
+ uint32_t i;
+
+ /* ensure that each qpair gets a unique random seed for maximum command dispersion. */
+
+ if (g_seed_value != 0) {
+ qp->random_seed = g_seed_value;
+ } else {
+ /* Take the low 32 bits of spdk_get_ticks. This should be more granular than time(). */
+ qp->random_seed = spdk_get_ticks();
+ }
+
+ qp->timeout_tsc = fuzz_refresh_timeout();
+
+ qp->req_ctx = calloc(max_qdepth, sizeof(struct nvme_fuzz_request));
+ if (qp->req_ctx == NULL) {
+ fprintf(stderr, "Unable to allocate I/O contexts for I/O qpair.\n");
+ return -1;
+ }
+
+ for (i = 0; i < max_qdepth; i++) {
+ qp->req_ctx[i].qp = qp;
+ TAILQ_INSERT_HEAD(&qp->free_ctx_objs, &qp->req_ctx[i], link);
+ }
+
+ return 0;
+}
+
+static int
+prepare_qpairs(void)
+{
+ struct spdk_nvme_io_qpair_opts opts;
+ struct nvme_fuzz_ns *ns_entry;
+
+ TAILQ_FOREACH(ns_entry, &g_ns_list, tailq) {
+ spdk_nvme_ctrlr_get_default_io_qpair_opts(ns_entry->ctrlr, &opts, sizeof(opts));
+ ns_entry->io_qp.qpair = spdk_nvme_ctrlr_alloc_io_qpair(ns_entry->ctrlr, &opts, sizeof(opts));
+ if (ns_entry->io_qp.qpair == NULL) {
+ fprintf(stderr, "Unable to create a qpair for a namespace\n");
+ return -1;
+ }
+
+ ns_entry->io_qp.is_admin = false;
+ if (prep_qpair(ns_entry, &ns_entry->io_qp, g_io_depth) != 0) {
+ fprintf(stderr, "Unable to allocate request contexts for I/O qpair.\n");
+ return -1;
+ }
+
+ if (g_run_admin_commands) {
+ ns_entry->a_qp.is_admin = true;
+ if (prep_qpair(ns_entry, &ns_entry->a_qp, g_admin_depth) != 0) {
+ fprintf(stderr, "Unable to allocate request contexts for admin qpair.\n");
+ return -1;
+ }
+ }
+ }
+ return 0;
+}
+
+static void
+start_ns_poller(void *ctx)
+{
+ struct nvme_fuzz_ns *ns_entry = ctx;
+
+ ns_entry->req_poller = SPDK_POLLER_REGISTER(poll_for_completions, ns_entry, 0);
+ submit_ns_cmds(ns_entry);
+}
+
+static int
+check_app_completion(void *ctx)
+{
+
+ if (g_num_active_threads <= 0) {
+ spdk_poller_unregister(&g_app_completion_poller);
+ if (g_cmd_array) {
+ free(g_cmd_array);
+ }
+ printf("Fuzzing completed. Shutting down the fuzz application\n\n");
+ printf("Dumping successful admin opcodes:\n");
+ report_successful_opcodes(g_successful_admin_opcodes, UNIQUE_OPCODES);
+ printf("Dumping successful io opcodes:\n");
+ report_successful_opcodes(g_successful_io_opcodes, UNIQUE_OPCODES);
+ free_namespaces();
+ free_controllers();
+ free_trids();
+ spdk_app_stop(0);
+ }
+ return 0;
+}
+
+static void
+begin_fuzz(void *ctx)
+{
+ struct nvme_fuzz_ns *ns_entry;
+ struct nvme_fuzz_trid *trid;
+ int rc;
+
+ if (!spdk_iommu_is_enabled()) {
+ /* Don't set rc to an error code here. We don't want to fail an automated test based on this. */
+ fprintf(stderr, "The IOMMU must be enabled to run this program to avoid unsafe memory accesses.\n");
+ rc = 0;
+ goto out;
+ }
+
+ TAILQ_FOREACH(trid, &g_trid_list, tailq) {
+ if (spdk_nvme_probe(&trid->trid, trid, probe_cb, attach_cb, NULL) != 0) {
+ fprintf(stderr, "spdk_nvme_probe() failed for transport address '%s'\n",
+ trid->trid.traddr);
+ rc = -1;
+ goto out;
+ }
+ }
+
+ if (TAILQ_EMPTY(&g_ns_list)) {
+ fprintf(stderr, "No valid NVMe Namespaces to fuzz\n");
+ rc = -EINVAL;
+ goto out;
+ }
+
+ rc = prepare_qpairs();
+
+ if (rc < 0) {
+ fprintf(stderr, "Unable to prepare the qpairs\n");
+ goto out;
+ }
+
+ g_runtime_ticks = spdk_get_ticks() + g_runtime * spdk_get_ticks_hz();
+
+ /* Assigning all of the threads and then starting them makes cleanup easier. */
+ TAILQ_FOREACH(ns_entry, &g_ns_list, tailq) {
+ ns_entry->thread = spdk_thread_create(NULL, NULL);
+ if (ns_entry->thread == NULL) {
+ fprintf(stderr, "Failed to allocate thread for namespace.\n");
+ goto out;
+ }
+ }
+
+ TAILQ_FOREACH(ns_entry, &g_ns_list, tailq) {
+ spdk_thread_send_msg(ns_entry->thread, start_ns_poller, ns_entry);
+ __sync_add_and_fetch(&g_num_active_threads, 1);
+ }
+
+ g_app_completion_poller = SPDK_POLLER_REGISTER(check_app_completion, NULL, 1000000);
+ return;
+out:
+ printf("Shutting down the fuzz application\n");
+ free_namespaces();
+ free_controllers();
+ free_trids();
+ spdk_app_stop(rc);
+}
+
+static int
+parse_trids(void)
+{
+ struct spdk_conf *config = NULL;
+ struct spdk_conf_section *sp;
+ const char *trid_char;
+ struct nvme_fuzz_trid *current_trid;
+ int num_subsystems = 0;
+ int rc = 0;
+
+ if (g_conf_file) {
+ config = spdk_conf_allocate();
+ if (!config) {
+ fprintf(stderr, "Unable to allocate an spdk_conf object\n");
+ return -1;
+ }
+
+ rc = spdk_conf_read(config, g_conf_file);
+ if (rc) {
+ fprintf(stderr, "Unable to convert the conf file into a readable system\n");
+ rc = -1;
+ goto exit;
+ }
+
+ sp = spdk_conf_find_section(config, "Nvme");
+
+ if (sp == NULL) {
+ fprintf(stderr, "No Nvme configuration in conf file\n");
+ goto exit;
+ }
+
+ while ((trid_char = spdk_conf_section_get_nmval(sp, "TransportID", num_subsystems, 0)) != NULL) {
+ current_trid = malloc(sizeof(struct nvme_fuzz_trid));
+ if (!current_trid) {
+ fprintf(stderr, "Unable to allocate memory for transport ID\n");
+ rc = -1;
+ goto exit;
+ }
+ rc = spdk_nvme_transport_id_parse(&current_trid->trid, trid_char);
+
+ if (rc < 0) {
+ fprintf(stderr, "failed to parse transport ID: %s\n", trid_char);
+ free(current_trid);
+ rc = -1;
+ goto exit;
+ }
+ TAILQ_INSERT_TAIL(&g_trid_list, current_trid, tailq);
+ num_subsystems++;
+ }
+ }
+
+exit:
+ if (config != NULL) {
+ spdk_conf_free(config);
+ }
+ return rc;
+}
+
+static void
+nvme_fuzz_usage(void)
+{
+ fprintf(stderr, " -a Perform admin commands. if -j is specified, \
+only admin commands will run. Otherwise they will be run in tandem with I/O commands.\n");
+ fprintf(stderr, " -C <path> Path to a configuration file.\n");
+ fprintf(stderr,
+ " -j <path> Path to a json file containing named objects of type spdk_nvme_cmd. If this option is specified, -t will be ignored.\n");
+ fprintf(stderr, " -N Target only valid namespace with commands. \
+This helps dig deeper into other errors besides invalid namespace.\n");
+ fprintf(stderr, " -S <integer> Seed value for test.\n");
+ fprintf(stderr,
+ " -t <integer> Time in seconds to run the fuzz test. Only valid if -j is not specified.\n");
+ fprintf(stderr, " -V Enable logging of each submitted command.\n");
+}
+
+static int
+nvme_fuzz_parse(int ch, char *arg)
+{
+ int64_t error_test;
+
+ switch (ch) {
+ case 'a':
+ g_run_admin_commands = true;
+ break;
+ case 'C':
+ g_conf_file = optarg;
+ break;
+ case 'j':
+ g_json_file = optarg;
+ break;
+ case 'N':
+ g_valid_ns_only = true;
+ break;
+ case 'S':
+ error_test = spdk_strtol(arg, 10);
+ if (error_test < 0) {
+ fprintf(stderr, "Invalid value supplied for the random seed.\n");
+ return -1;
+ } else {
+ g_seed_value = error_test;
+ }
+ break;
+ case 't':
+ g_runtime = spdk_strtol(optarg, 10);
+ if (g_runtime < 0 || g_runtime > MAX_RUNTIME_S) {
+ fprintf(stderr, "You must supply a positive runtime value less than 86401.\n");
+ return -1;
+ }
+ break;
+ case 'V':
+ g_verbose_mode = true;
+ break;
+ case '?':
+ default:
+ return -EINVAL;
+ }
+ return 0;
+}
+
+int
+main(int argc, char **argv)
+{
+ struct spdk_app_opts opts = {};
+ int rc;
+
+ spdk_app_opts_init(&opts);
+ opts.name = "nvme_fuzz";
+
+ g_runtime = DEFAULT_RUNTIME;
+ g_run = true;
+
+ if ((rc = spdk_app_parse_args(argc, argv, &opts, "aC:j:NS:t:V", NULL, nvme_fuzz_parse,
+ nvme_fuzz_usage) != SPDK_APP_PARSE_ARGS_SUCCESS)) {
+ return rc;
+ }
+
+ if (g_conf_file) {
+ parse_trids();
+ }
+
+ if (g_json_file != NULL) {
+ g_cmd_array_size = fuzz_parse_args_into_array(g_json_file, (void **)&g_cmd_array,
+ sizeof(struct spdk_nvme_cmd), g_nvme_cmd_json_name, parse_nvme_cmd_obj);
+ if (g_cmd_array_size == 0) {
+ fprintf(stderr, "The provided json file did not contain any valid commands. Exiting.");
+ return -EINVAL;
+ }
+ }
+
+ rc = spdk_app_start(&opts, begin_fuzz, NULL);
+
+ return rc;
+}
diff --git a/src/spdk/test/app/fuzz/vhost_fuzz/.gitignore b/src/spdk/test/app/fuzz/vhost_fuzz/.gitignore
new file mode 100644
index 000000000..2df201f3f
--- /dev/null
+++ b/src/spdk/test/app/fuzz/vhost_fuzz/.gitignore
@@ -0,0 +1 @@
+vhost_fuzz
diff --git a/src/spdk/test/app/fuzz/vhost_fuzz/Makefile b/src/spdk/test/app/fuzz/vhost_fuzz/Makefile
new file mode 100644
index 000000000..69b8d1866
--- /dev/null
+++ b/src/spdk/test/app/fuzz/vhost_fuzz/Makefile
@@ -0,0 +1,42 @@
+#
+# Copyright (c) Intel Corporation.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in
+# the documentation and/or other materials provided with the
+# distribution.
+# * Neither the name of Intel Corporation nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+SPDK_ROOT_DIR := $(abspath $(CURDIR)/../../../..)
+include $(SPDK_ROOT_DIR)/mk/spdk.common.mk
+
+APP = vhost_fuzz
+
+CFLAGS += -I$(SPDK_ROOT_DIR)/test/app/fuzz/common
+
+C_SRCS := vhost_fuzz_rpc.c vhost_fuzz.c
+
+SPDK_LIB_LIST += event conf json jsonrpc rpc util log sock trace thread virtio
+include $(SPDK_ROOT_DIR)/mk/spdk.app.mk
diff --git a/src/spdk/test/app/fuzz/vhost_fuzz/README.md b/src/spdk/test/app/fuzz/vhost_fuzz/README.md
new file mode 100644
index 000000000..ab9656c5b
--- /dev/null
+++ b/src/spdk/test/app/fuzz/vhost_fuzz/README.md
@@ -0,0 +1,46 @@
+# Overview
+
+This application is intended to fuzz test the SPDK vhost target by supplying
+malformed or invalid requests across a unix domain socket. This fuzzer
+currently supports fuzzing both vhost block and vhost scsi devices. When
+fuzzing a vhost scsi device, users can select whether to fuzz the scsi I/O
+queue or the scsi admin queue. Please see the NVMe fuzzer readme for information
+on how output is generated, debugging procedures, and the JSON format expected
+when supplying preconstructed values to the fuzzer.
+
+# Request Types
+
+Like the NVMe fuzzer, there is an example json file showing the types of requests
+that the application accepts. Since the vhost application accepts both vhost block
+and vhost scsi commands, there are three distinct object types that can be passed in
+to the application.
+
+1. vhost_blk_cmd
+2. vhost_scsi_cmd
+3. vhost_scsi_mgmt_cmd
+
+Each one of these objects contains distinct data types and they should not be used interchangeably.
+
+All three of the data types begin with three iovec structures describing the request, data, and response
+memory locations. By default, these values are overwritten by the application even when supplied as part
+of a json file. This is because the request and resp data pointers are intended to point to portions of
+the data structure.
+
+If you want to override these iovec values using a json file, you can specify the -k option.
+In most cases, this will just result in the application failing all I/O immediately since
+the request will no longer point to a valid memory location.
+
+It is possible to supply all three types of requests in a single array to the application. They will be parsed and
+submitted to the proper block devices.
+
+# RPC
+
+The vhost fuzzer differs from the NVMe fuzzer in that it expects devices to be configured via rpc. The fuzzer should
+always be started with the --wait-for-rpc argument. Please see below for an example of starting the fuzzer.
+
+~~~
+./test/app/fuzz/vhost_fuzz/vhost_fuzz -t 30 --wait-for-rpc &
+./scripts/rpc.py fuzz_vhost_create_dev -s ./Vhost.1 -b -V
+./scripts/rpc.py fuzz_vhost_create_dev -s ./naa.VhostScsi0.1 -l -V
+./scripts/rpc.py framework_start_init
+~~~
diff --git a/src/spdk/test/app/fuzz/vhost_fuzz/example.json b/src/spdk/test/app/fuzz/vhost_fuzz/example.json
new file mode 100644
index 000000000..9157350f8
--- /dev/null
+++ b/src/spdk/test/app/fuzz/vhost_fuzz/example.json
@@ -0,0 +1,95 @@
+{
+ "vhost_scsi_mgmt_cmd": {
+ "req_iov": {
+ "iov_base": "20007960ff60",
+ "iov_len": 51
+ },
+ "data_iov": {
+ "iov_base": "2000794dbe00",
+ "iov_len": 1024
+ },
+ "resp_iov": {
+ "iov_base": "20007960ff98",
+ "iov_len": 108
+ },
+ "lun": "AQA5vBf3KyE=",
+ "tag": 6163879237324549222,
+ "task_attr": 247,
+ "prio": 242,
+ "crn": 169,
+ "cdb": "ErxZ/qpHBau8gPzjbpotpbTnOW/2g0ns2yRh4jhe5kc="
+ },
+ "vhost_scsi_mgmt_cmd": {
+ "req_iov": {
+ "iov_base": "20007960fe78",
+ "iov_len": 51
+ },
+ "data_iov": {
+ "iov_base": "2000794dbe00",
+ "iov_len": 1024
+ },
+ "resp_iov": {
+ "iov_base": "20007960feb0",
+ "iov_len": 108
+ },
+ "lun": "AQAwWRrhAoo=",
+ "tag": 10457151189012466200,
+ "task_attr": 97,
+ "prio": 158,
+ "crn": 41,
+ "cdb": "Ejjxdzl8KwRDhq+MPfY3J3niYfAHj+2irE8Q2vIfQIk="
+ },
+ "vhost_scsi_cmd": {
+ "req_iov": {
+ "iov_base": "20007960fe78",
+ "iov_len": 24
+ },
+ "data_iov": {
+ "iov_base": "20007960fe78",
+ "iov_len": 1024
+ },
+ "resp_iov": {
+ "iov_base": "20007960fe78",
+ "iov_len": 5
+ },
+ "type": 3,
+ "subtype": 872683406,
+ "lun": "LdaLkHOIQxI=",
+ "tag": 8452696012704506104
+ },
+ "vhost_scsi_cmd": {
+ "req_iov": {
+ "iov_base": "20007960fe78",
+ "iov_len": 24
+ },
+ "data_iov": {
+ "iov_base": "20007960fe78",
+ "iov_len": 1024
+ },
+ "resp_iov": {
+ "iov_base": "20007960fe78",
+ "iov_len": 5
+ },
+ "type": 3,
+ "subtype": 872683406,
+ "lun": "LdaLkHOIQxI=",
+ "tag": 8452696012704506104
+ },
+ "vhost_blk_cmd": {
+ "req_iov": {
+ "iov_base": "20007960fe78",
+ "iov_len": 24
+ },
+ "data_iov": {
+ "iov_base": "20007960fe78",
+ "iov_len": 1024
+ },
+ "resp_iov": {
+ "iov_base": "20007960fe78",
+ "iov_len": 5
+ },
+ "type": 2,
+ "ioprio": 4343,
+ "sector": 24323523
+ }
+}
diff --git a/src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz.c b/src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz.c
new file mode 100644
index 000000000..47dbfbc65
--- /dev/null
+++ b/src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz.c
@@ -0,0 +1,1146 @@
+/*-
+ * BSD LICENSE
+ *
+ * Copyright (c) Intel Corporation. All rights reserved.
+ * Copyright (c) 2019 Mellanox Technologies LTD. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name of Intel Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "spdk/stdinc.h"
+#include "spdk/conf.h"
+#include "spdk/env.h"
+#include "spdk/json.h"
+#include "spdk/event.h"
+#include "spdk/likely.h"
+#include "spdk/util.h"
+#include "spdk/string.h"
+#include "spdk_internal/virtio.h"
+#include "spdk_internal/vhost_user.h"
+
+#include "fuzz_common.h"
+#include "vhost_fuzz.h"
+
+#include <linux/virtio_blk.h>
+#include <linux/virtio_scsi.h>
+
+/* Features desired/implemented by virtio blk. */
+#define VIRTIO_BLK_DEV_SUPPORTED_FEATURES \
+ (1ULL << VIRTIO_BLK_F_BLK_SIZE | \
+ 1ULL << VIRTIO_BLK_F_TOPOLOGY | \
+ 1ULL << VIRTIO_BLK_F_MQ | \
+ 1ULL << VIRTIO_BLK_F_RO | \
+ 1ULL << VIRTIO_BLK_F_DISCARD | \
+ 1ULL << VIRTIO_RING_F_EVENT_IDX | \
+ 1ULL << VHOST_USER_F_PROTOCOL_FEATURES)
+
+/* Features desired/implemented by virtio scsi. */
+#define VIRTIO_SCSI_DEV_SUPPORTED_FEATURES \
+ (1ULL << VIRTIO_SCSI_F_INOUT | \
+ 1ULL << VIRTIO_SCSI_F_HOTPLUG | \
+ 1ULL << VIRTIO_RING_F_EVENT_IDX | \
+ 1ULL << VHOST_USER_F_PROTOCOL_FEATURES)
+
+#define VIRTIO_DEV_FIXED_QUEUES 2
+#define VIRTIO_SCSI_CONTROLQ 0
+#define VIRTIO_SCSI_EVENTQ 1
+#define VIRTIO_REQUESTQ 2
+#define FUZZ_MAX_QUEUES 3
+
+#define FUZZ_QUEUE_DEPTH 128
+
+#define BLK_IO_NAME "vhost_blk_cmd"
+#define SCSI_IO_NAME "vhost_scsi_cmd"
+#define SCSI_MGMT_NAME "vhost_scsi_mgmt_cmd"
+
+struct fuzz_vhost_iov_ctx {
+ struct iovec iov_req;
+ struct iovec iov_data;
+ struct iovec iov_resp;
+};
+
+struct fuzz_vhost_io_ctx {
+ struct fuzz_vhost_iov_ctx iovs;
+ union {
+ struct virtio_blk_outhdr blk_req;
+ struct virtio_scsi_cmd_req scsi_req;
+ struct virtio_scsi_ctrl_tmf_req scsi_tmf_req;
+ } req;
+ union {
+ uint8_t blk_resp;
+ struct virtio_scsi_cmd_resp scsi_resp;
+ union {
+ struct virtio_scsi_ctrl_tmf_resp scsi_tmf_resp;
+ struct virtio_scsi_ctrl_an_resp an_resp;
+ } scsi_tmf_resp;
+ } resp;
+
+ TAILQ_ENTRY(fuzz_vhost_io_ctx) link;
+};
+
+struct fuzz_vhost_dev_ctx {
+ struct virtio_dev virtio_dev;
+ struct spdk_thread *thread;
+ struct spdk_poller *poller;
+
+ struct fuzz_vhost_io_ctx *io_ctx_array;
+ TAILQ_HEAD(, fuzz_vhost_io_ctx) free_io_ctx;
+ TAILQ_HEAD(, fuzz_vhost_io_ctx) outstanding_io_ctx;
+
+ unsigned int random_seed;
+
+ uint64_t submitted_io;
+ uint64_t completed_io;
+ uint64_t successful_io;
+ uint64_t timeout_tsc;
+
+ bool socket_is_blk;
+ bool test_scsi_tmf;
+ bool valid_lun;
+ bool use_bogus_buffer;
+ bool use_valid_buffer;
+ bool timed_out;
+
+ TAILQ_ENTRY(fuzz_vhost_dev_ctx) link;
+};
+
+/* Global run state */
+uint64_t g_runtime_ticks;
+int g_runtime;
+int g_num_active_threads;
+bool g_run = true;
+bool g_verbose_mode = false;
+
+/* Global resources */
+TAILQ_HEAD(, fuzz_vhost_dev_ctx) g_dev_list = TAILQ_HEAD_INITIALIZER(g_dev_list);
+struct spdk_poller *g_run_poller;
+void *g_valid_buffer;
+unsigned int g_random_seed;
+
+
+/* Global parameters and resources for parsed commands */
+bool g_keep_iov_pointers = false;
+char *g_json_file = NULL;
+struct fuzz_vhost_io_ctx *g_blk_cmd_array = NULL;
+struct fuzz_vhost_io_ctx *g_scsi_cmd_array = NULL;
+struct fuzz_vhost_io_ctx *g_scsi_mgmt_cmd_array = NULL;
+
+size_t g_blk_cmd_array_size;
+size_t g_scsi_cmd_array_size;
+size_t g_scsi_mgmt_cmd_array_size;
+
+static void
+cleanup(void)
+{
+ struct fuzz_vhost_dev_ctx *dev_ctx, *tmp;
+ printf("Fuzzing completed.\n");
+ TAILQ_FOREACH_SAFE(dev_ctx, &g_dev_list, link, tmp) {
+ printf("device %p stats: Completed I/O: %lu, Successful I/O: %lu\n", dev_ctx,
+ dev_ctx->completed_io, dev_ctx->successful_io);
+ virtio_dev_release_queue(&dev_ctx->virtio_dev, VIRTIO_REQUESTQ);
+ if (!dev_ctx->socket_is_blk) {
+ virtio_dev_release_queue(&dev_ctx->virtio_dev, VIRTIO_SCSI_EVENTQ);
+ virtio_dev_release_queue(&dev_ctx->virtio_dev, VIRTIO_SCSI_CONTROLQ);
+ }
+ virtio_dev_stop(&dev_ctx->virtio_dev);
+ virtio_dev_destruct(&dev_ctx->virtio_dev);
+ if (dev_ctx->io_ctx_array) {
+ spdk_free(dev_ctx->io_ctx_array);
+ }
+ free(dev_ctx);
+ }
+
+ spdk_free(g_valid_buffer);
+
+ if (g_blk_cmd_array) {
+ free(g_blk_cmd_array);
+ }
+ if (g_scsi_cmd_array) {
+ free(g_scsi_cmd_array);
+ }
+ if (g_scsi_mgmt_cmd_array) {
+ free(g_scsi_mgmt_cmd_array);
+ }
+}
+
+/* Get a memory address that is random and not located in our hugepage memory. */
+static void *
+get_invalid_mem_address(uint64_t length)
+{
+ uint64_t chosen_address = 0x0;
+
+ while (true) {
+ chosen_address = rand();
+ chosen_address = (chosen_address << 32) | rand();
+ if (spdk_vtophys((void *)chosen_address, &length) == SPDK_VTOPHYS_ERROR) {
+ return (void *)chosen_address;
+ }
+ }
+ return NULL;
+}
+
+/* dev initialization code begin. */
+static int
+virtio_dev_init(struct virtio_dev *vdev, const char *socket_path, uint64_t flags,
+ uint16_t max_queues)
+{
+ int rc;
+
+ rc = virtio_user_dev_init(vdev, "dev_ctx", socket_path, 1024);
+ if (rc != 0) {
+ fprintf(stderr, "Failed to initialize virtual bdev\n");
+ return rc;
+ }
+
+ rc = virtio_dev_reset(vdev, flags);
+ if (rc != 0) {
+ return rc;
+ }
+
+ rc = virtio_dev_start(vdev, max_queues, VIRTIO_DEV_FIXED_QUEUES);
+ if (rc != 0) {
+ return rc;
+ }
+
+ rc = virtio_dev_acquire_queue(vdev, VIRTIO_REQUESTQ);
+ if (rc < 0) {
+ fprintf(stderr, "Couldn't get an unused queue for the io_channel.\n");
+ virtio_dev_stop(vdev);
+ return rc;
+ }
+ return 0;
+}
+
+static int
+blk_dev_init(struct virtio_dev *vdev, const char *socket_path, uint16_t max_queues)
+{
+ uint16_t host_max_queues;
+ int rc;
+
+ if (virtio_dev_has_feature(vdev, VIRTIO_BLK_F_MQ)) {
+ rc = virtio_dev_read_dev_config(vdev, offsetof(struct virtio_blk_config, num_queues),
+ &host_max_queues, sizeof(host_max_queues));
+ if (rc) {
+ fprintf(stderr, "%s: config read failed: %s\n", vdev->name, spdk_strerror(-rc));
+ return rc;
+ }
+ } else {
+ host_max_queues = 1;
+ }
+
+ if (max_queues == 0) {
+ fprintf(stderr, "%s: requested 0 request queues (%"PRIu16" available).\n",
+ vdev->name, host_max_queues);
+ return -EINVAL;
+ }
+
+ if (max_queues > host_max_queues) {
+ fprintf(stderr, "%s: requested %"PRIu16" request queues "
+ "but only %"PRIu16" available.\n",
+ vdev->name, max_queues, host_max_queues);
+ max_queues = host_max_queues;
+ }
+
+ return virtio_dev_init(vdev, socket_path, VIRTIO_BLK_DEV_SUPPORTED_FEATURES, max_queues);
+}
+
+static int
+scsi_dev_init(struct virtio_dev *vdev, const char *socket_path, uint16_t max_queues)
+{
+ int rc;
+
+ rc = virtio_dev_init(vdev, socket_path, VIRTIO_SCSI_DEV_SUPPORTED_FEATURES, max_queues);
+ if (rc != 0) {
+ return rc;
+ }
+
+ rc = virtio_dev_acquire_queue(vdev, VIRTIO_SCSI_CONTROLQ);
+ if (rc != 0) {
+ SPDK_ERRLOG("Failed to acquire the controlq.\n");
+ return rc;
+ }
+
+ rc = virtio_dev_acquire_queue(vdev, VIRTIO_SCSI_EVENTQ);
+ if (rc != 0) {
+ SPDK_ERRLOG("Failed to acquire the eventq.\n");
+ virtio_dev_release_queue(vdev, VIRTIO_SCSI_CONTROLQ);
+ return rc;
+ }
+
+ return 0;
+}
+
+int
+fuzz_vhost_dev_init(const char *socket_path, bool is_blk_dev, bool use_bogus_buffer,
+ bool use_valid_buffer, bool valid_lun, bool test_scsi_tmf)
+{
+ struct fuzz_vhost_dev_ctx *dev_ctx;
+ int rc = 0, i;
+
+ dev_ctx = calloc(1, sizeof(*dev_ctx));
+ if (dev_ctx == NULL) {
+ return -ENOMEM;
+ }
+
+ dev_ctx->socket_is_blk = is_blk_dev;
+ dev_ctx->use_bogus_buffer = use_bogus_buffer;
+ dev_ctx->use_valid_buffer = use_valid_buffer;
+ dev_ctx->valid_lun = valid_lun;
+ dev_ctx->test_scsi_tmf = test_scsi_tmf;
+
+ TAILQ_INIT(&dev_ctx->free_io_ctx);
+ TAILQ_INIT(&dev_ctx->outstanding_io_ctx);
+
+ assert(sizeof(*dev_ctx->io_ctx_array) <= UINT64_MAX / FUZZ_QUEUE_DEPTH);
+ dev_ctx->io_ctx_array = spdk_malloc(sizeof(*dev_ctx->io_ctx_array) * FUZZ_QUEUE_DEPTH, 0x0, NULL,
+ SPDK_ENV_LCORE_ID_ANY, SPDK_MALLOC_SHARE);
+ if (dev_ctx->io_ctx_array == NULL) {
+ free(dev_ctx);
+ return -ENOMEM;
+ }
+
+ for (i = 0; i < FUZZ_QUEUE_DEPTH; i++) {
+ TAILQ_INSERT_HEAD(&dev_ctx->free_io_ctx, &dev_ctx->io_ctx_array[i], link);
+ }
+
+ dev_ctx->thread = spdk_thread_create(NULL, NULL);
+ if (dev_ctx->thread == NULL) {
+ fprintf(stderr, "Unable to allocate a thread for a fuzz device.\n");
+ rc = -ENOMEM;
+ goto error_out;
+ }
+
+ if (is_blk_dev) {
+ rc = blk_dev_init(&dev_ctx->virtio_dev, socket_path, FUZZ_MAX_QUEUES);
+ } else {
+ rc = scsi_dev_init(&dev_ctx->virtio_dev, socket_path, FUZZ_MAX_QUEUES);
+ }
+
+ if (rc) {
+ fprintf(stderr, "Unable to prepare the device to perform I/O.\n");
+ goto error_out;
+ }
+
+ TAILQ_INSERT_TAIL(&g_dev_list, dev_ctx, link);
+ return 0;
+
+error_out:
+ spdk_free(dev_ctx->io_ctx_array);
+ free(dev_ctx);
+ return rc;
+}
+/* dev initialization code end */
+
+/* data dumping functions begin */
+static int
+dump_virtio_cmd(void *ctx, const void *data, size_t size)
+{
+ fprintf(stderr, "%s\n", (const char *)data);
+ return 0;
+}
+
+static void
+print_blk_io_data(struct spdk_json_write_ctx *w, struct fuzz_vhost_io_ctx *io_ctx)
+{
+ spdk_json_write_named_uint32(w, "type", io_ctx->req.blk_req.type);
+ spdk_json_write_named_uint32(w, "ioprio", io_ctx->req.blk_req.ioprio);
+ spdk_json_write_named_uint64(w, "sector", io_ctx->req.blk_req.sector);
+}
+
+static void
+print_scsi_tmf_io_data(struct spdk_json_write_ctx *w, struct fuzz_vhost_io_ctx *io_ctx)
+{
+ char *lun_data;
+
+ lun_data = fuzz_get_value_base_64_buffer(io_ctx->req.scsi_tmf_req.lun,
+ sizeof(io_ctx->req.scsi_tmf_req.lun));
+
+ spdk_json_write_named_uint32(w, "type", io_ctx->req.scsi_tmf_req.type);
+ spdk_json_write_named_uint32(w, "subtype", io_ctx->req.scsi_tmf_req.subtype);
+ spdk_json_write_named_string(w, "lun", lun_data);
+ spdk_json_write_named_uint64(w, "tag", io_ctx->req.scsi_tmf_req.tag);
+
+ free(lun_data);
+}
+
+static void
+print_scsi_io_data(struct spdk_json_write_ctx *w, struct fuzz_vhost_io_ctx *io_ctx)
+{
+ char *lun_data;
+ char *cdb_data;
+
+ lun_data = fuzz_get_value_base_64_buffer(io_ctx->req.scsi_req.lun,
+ sizeof(io_ctx->req.scsi_req.lun));
+ cdb_data = fuzz_get_value_base_64_buffer(io_ctx->req.scsi_req.cdb,
+ sizeof(io_ctx->req.scsi_req.cdb));
+
+ spdk_json_write_named_string(w, "lun", lun_data);
+ spdk_json_write_named_uint64(w, "tag", io_ctx->req.scsi_req.tag);
+ spdk_json_write_named_uint32(w, "task_attr", io_ctx->req.scsi_req.task_attr);
+ spdk_json_write_named_uint32(w, "prio", io_ctx->req.scsi_req.prio);
+ spdk_json_write_named_uint32(w, "crn", io_ctx->req.scsi_req.crn);
+ spdk_json_write_named_string(w, "cdb", cdb_data);
+
+ free(lun_data);
+ free(cdb_data);
+}
+
+static void
+print_iov_obj(struct spdk_json_write_ctx *w, const char *iov_name, struct iovec *iov)
+{
+ /* "0x" + up to 16 digits + null terminator */
+ char hex_addr[19];
+ int rc;
+
+ rc = snprintf(hex_addr, 19, "%lx", (uintptr_t)iov->iov_base);
+
+ /* default to 0. */
+ if (rc < 0 || rc >= 19) {
+ hex_addr[0] = '0';
+ hex_addr[1] = '\0';
+ }
+
+ spdk_json_write_named_object_begin(w, iov_name);
+ spdk_json_write_named_string(w, "iov_base", hex_addr);
+ spdk_json_write_named_uint64(w, "iov_len", iov->iov_len);
+ spdk_json_write_object_end(w);
+}
+
+static void
+print_iovs(struct spdk_json_write_ctx *w, struct fuzz_vhost_io_ctx *io_ctx)
+{
+ print_iov_obj(w, "req_iov", &io_ctx->iovs.iov_req);
+ print_iov_obj(w, "data_iov", &io_ctx->iovs.iov_data);
+ print_iov_obj(w, "resp_iov", &io_ctx->iovs.iov_resp);
+}
+
+static void
+print_req_obj(struct fuzz_vhost_dev_ctx *dev_ctx, struct fuzz_vhost_io_ctx *io_ctx)
+{
+
+ struct spdk_json_write_ctx *w;
+
+ w = spdk_json_write_begin(dump_virtio_cmd, NULL, SPDK_JSON_WRITE_FLAG_FORMATTED);
+
+ if (dev_ctx->socket_is_blk) {
+ spdk_json_write_named_object_begin(w, BLK_IO_NAME);
+ print_iovs(w, io_ctx);
+ print_blk_io_data(w, io_ctx);
+ } else if (dev_ctx->test_scsi_tmf) {
+ spdk_json_write_named_object_begin(w, SCSI_MGMT_NAME);
+ print_iovs(w, io_ctx);
+ print_scsi_tmf_io_data(w, io_ctx);
+ } else {
+ spdk_json_write_named_object_begin(w, SCSI_IO_NAME);
+ print_iovs(w, io_ctx);
+ print_scsi_io_data(w, io_ctx);
+ }
+ spdk_json_write_object_end(w);
+ spdk_json_write_end(w);
+}
+
+static void
+dump_outstanding_io(struct fuzz_vhost_dev_ctx *dev_ctx)
+{
+ struct fuzz_vhost_io_ctx *io_ctx, *tmp;
+
+ TAILQ_FOREACH_SAFE(io_ctx, &dev_ctx->outstanding_io_ctx, link, tmp) {
+ print_req_obj(dev_ctx, io_ctx);
+ TAILQ_REMOVE(&dev_ctx->outstanding_io_ctx, io_ctx, link);
+ TAILQ_INSERT_TAIL(&dev_ctx->free_io_ctx, io_ctx, link);
+ }
+}
+/* data dumping functions end */
+
+/* data parsing functions begin */
+static int
+hex_value(uint8_t c)
+{
+#define V(x, y) [x] = y + 1
+ static const int8_t val[256] = {
+ V('0', 0), V('1', 1), V('2', 2), V('3', 3), V('4', 4),
+ V('5', 5), V('6', 6), V('7', 7), V('8', 8), V('9', 9),
+ V('A', 0xA), V('B', 0xB), V('C', 0xC), V('D', 0xD), V('E', 0xE), V('F', 0xF),
+ V('a', 0xA), V('b', 0xB), V('c', 0xC), V('d', 0xD), V('e', 0xE), V('f', 0xF),
+ };
+#undef V
+
+ return val[c] - 1;
+}
+
+static int
+fuzz_json_decode_hex_uint64(const struct spdk_json_val *val, void *out)
+{
+ uint64_t *out_val = out;
+ size_t i;
+ char *val_pointer = val->start;
+ int current_val;
+
+ if (val->len > 16) {
+ return -EINVAL;
+ }
+
+ *out_val = 0;
+ for (i = 0; i < val->len; i++) {
+ *out_val = *out_val << 4;
+ current_val = hex_value(*val_pointer);
+ if (current_val < 0) {
+ return -EINVAL;
+ }
+ *out_val += current_val;
+ val_pointer++;
+ }
+
+ return 0;
+}
+
+static const struct spdk_json_object_decoder fuzz_vhost_iov_decoders[] = {
+ {"iov_base", offsetof(struct iovec, iov_base), fuzz_json_decode_hex_uint64},
+ {"iov_len", offsetof(struct iovec, iov_len), spdk_json_decode_uint64},
+};
+
+static size_t
+parse_iov_struct(struct iovec *iovec, struct spdk_json_val *value)
+{
+ int rc;
+
+ if (value->type != SPDK_JSON_VAL_OBJECT_BEGIN) {
+ return -1;
+ }
+
+ rc = spdk_json_decode_object(value,
+ fuzz_vhost_iov_decoders,
+ SPDK_COUNTOF(fuzz_vhost_iov_decoders),
+ iovec);
+ if (rc) {
+ return -1;
+ }
+
+ while (value->type != SPDK_JSON_VAL_OBJECT_END) {
+ value++;
+ rc++;
+ }
+
+ /* The +1 instructs the calling function to skip over the OBJECT_END function. */
+ rc += 1;
+ return rc;
+}
+
+static bool
+parse_vhost_blk_cmds(void *item, struct spdk_json_val *value, size_t num_values)
+{
+ struct fuzz_vhost_io_ctx *io_ctx = item;
+ struct spdk_json_val *prev_value;
+ int nested_object_size;
+ uint64_t tmp_val;
+ size_t i = 0;
+
+ while (i < num_values) {
+ nested_object_size = 1;
+ if (value->type == SPDK_JSON_VAL_NAME) {
+ prev_value = value;
+ value++;
+ i++;
+ if (!strncmp(prev_value->start, "req_iov", prev_value->len)) {
+ nested_object_size = parse_iov_struct(&io_ctx->iovs.iov_req, value);
+ } else if (!strncmp(prev_value->start, "data_iov", prev_value->len)) {
+ nested_object_size = parse_iov_struct(&io_ctx->iovs.iov_data, value);
+ } else if (!strncmp(prev_value->start, "resp_iov", prev_value->len)) {
+ nested_object_size = parse_iov_struct(&io_ctx->iovs.iov_data, value);
+ } else if (!strncmp(prev_value->start, "type", prev_value->len)) {
+ if (fuzz_parse_json_num(value, UINT32_MAX, &tmp_val)) {
+ nested_object_size = -1;
+ } else {
+ io_ctx->req.blk_req.type = tmp_val;
+ }
+ } else if (!strncmp(prev_value->start, "ioprio", prev_value->len)) {
+ if (fuzz_parse_json_num(value, UINT32_MAX, &tmp_val)) {
+ nested_object_size = -1;
+ } else {
+ io_ctx->req.blk_req.ioprio = tmp_val;
+ }
+ } else if (!strncmp(prev_value->start, "sector", prev_value->len)) {
+ if (fuzz_parse_json_num(value, UINT64_MAX, &tmp_val)) {
+ nested_object_size = -1;
+ } else {
+ io_ctx->req.blk_req.sector = tmp_val;
+ }
+ }
+ }
+ if (nested_object_size < 0) {
+ fprintf(stderr, "Invalid value supplied for io_ctx->%.*s: %.*s\n", prev_value->len,
+ (char *)prev_value->start, value->len, (char *)value->start);
+ return false;
+ }
+ value += nested_object_size;
+ i += nested_object_size;
+ }
+ return true;
+}
+
+static bool
+parse_vhost_scsi_cmds(void *item, struct spdk_json_val *value, size_t num_values)
+{
+ struct fuzz_vhost_io_ctx *io_ctx = item;
+ struct spdk_json_val *prev_value;
+ int nested_object_size;
+ uint64_t tmp_val;
+ size_t i = 0;
+
+ while (i < num_values) {
+ nested_object_size = 1;
+ if (value->type == SPDK_JSON_VAL_NAME) {
+ prev_value = value;
+ value++;
+ i++;
+ if (!strncmp(prev_value->start, "req_iov", prev_value->len)) {
+ nested_object_size = parse_iov_struct(&io_ctx->iovs.iov_req, value);
+ } else if (!strncmp(prev_value->start, "data_iov", prev_value->len)) {
+ nested_object_size = parse_iov_struct(&io_ctx->iovs.iov_data, value);
+ } else if (!strncmp(prev_value->start, "resp_iov", prev_value->len)) {
+ nested_object_size = parse_iov_struct(&io_ctx->iovs.iov_data, value);
+ } else if (!strncmp(prev_value->start, "lun", prev_value->len)) {
+ if (fuzz_get_base_64_buffer_value(&io_ctx->req.scsi_req.lun,
+ sizeof(io_ctx->req.scsi_req.lun),
+ (char *)value->start,
+ value->len)) {
+ nested_object_size = -1;
+ }
+ } else if (!strncmp(prev_value->start, "tag", prev_value->len)) {
+ if (fuzz_parse_json_num(value, UINT64_MAX, &tmp_val)) {
+ nested_object_size = -1;
+ } else {
+ io_ctx->req.scsi_req.tag = tmp_val;
+ }
+ } else if (!strncmp(prev_value->start, "task_attr", prev_value->len)) {
+ if (fuzz_parse_json_num(value, UINT8_MAX, &tmp_val)) {
+ nested_object_size = -1;
+ } else {
+ io_ctx->req.scsi_req.task_attr = tmp_val;
+ }
+ } else if (!strncmp(prev_value->start, "prio", prev_value->len)) {
+ if (fuzz_parse_json_num(value, UINT8_MAX, &tmp_val)) {
+ nested_object_size = -1;
+ } else {
+ io_ctx->req.scsi_req.prio = tmp_val;
+ }
+ } else if (!strncmp(prev_value->start, "crn", prev_value->len)) {
+ if (fuzz_parse_json_num(value, UINT8_MAX, &tmp_val)) {
+ nested_object_size = -1;
+ } else {
+ io_ctx->req.scsi_req.crn = tmp_val;
+ }
+ } else if (!strncmp(prev_value->start, "cdb", prev_value->len)) {
+ if (fuzz_get_base_64_buffer_value(&io_ctx->req.scsi_req.cdb,
+ sizeof(io_ctx->req.scsi_req.cdb),
+ (char *)value->start,
+ value->len)) {
+ nested_object_size = -1;
+ }
+ }
+ }
+ if (nested_object_size < 0) {
+ fprintf(stderr, "Invalid value supplied for io_ctx->%.*s: %.*s\n", prev_value->len,
+ (char *)prev_value->start, value->len, (char *)value->start);
+ return false;
+ }
+ value += nested_object_size;
+ i += nested_object_size;
+ }
+ return true;
+
+}
+
+static bool
+parse_vhost_scsi_mgmt_cmds(void *item, struct spdk_json_val *value, size_t num_values)
+{
+ struct fuzz_vhost_io_ctx *io_ctx = item;
+ struct spdk_json_val *prev_value;
+ int nested_object_size;
+ uint64_t tmp_val;
+ size_t i = 0;
+
+ while (i < num_values) {
+ nested_object_size = 1;
+ if (value->type == SPDK_JSON_VAL_NAME) {
+ prev_value = value;
+ value++;
+ i++;
+ if (!strncmp(prev_value->start, "req_iov", prev_value->len)) {
+ nested_object_size = parse_iov_struct(&io_ctx->iovs.iov_req, value);
+ } else if (!strncmp(prev_value->start, "data_iov", prev_value->len)) {
+ nested_object_size = parse_iov_struct(&io_ctx->iovs.iov_data, value);
+ } else if (!strncmp(prev_value->start, "resp_iov", prev_value->len)) {
+ nested_object_size = parse_iov_struct(&io_ctx->iovs.iov_data, value);
+ } else if (!strncmp(prev_value->start, "type", prev_value->len)) {
+ if (fuzz_parse_json_num(value, UINT32_MAX, &tmp_val)) {
+ nested_object_size = -1;
+ } else {
+ io_ctx->req.scsi_tmf_req.type = tmp_val;
+ }
+ } else if (!strncmp(prev_value->start, "subtype", prev_value->len)) {
+ if (fuzz_parse_json_num(value, UINT32_MAX, &tmp_val)) {
+ nested_object_size = -1;
+ } else {
+ io_ctx->req.scsi_tmf_req.subtype = tmp_val;
+ }
+ } else if (!strncmp(prev_value->start, "lun", prev_value->len)) {
+ if (fuzz_get_base_64_buffer_value(&io_ctx->req.scsi_tmf_req.lun,
+ sizeof(io_ctx->req.scsi_tmf_req.lun),
+ (char *)value->start,
+ value->len)) {
+ nested_object_size = -1;
+ }
+ } else if (!strncmp(prev_value->start, "tag", prev_value->len)) {
+ if (fuzz_parse_json_num(value, UINT64_MAX, &tmp_val)) {
+ nested_object_size = -1;
+ } else {
+ io_ctx->req.scsi_tmf_req.tag = tmp_val;
+ }
+ }
+ }
+ if (nested_object_size < 0) {
+ fprintf(stderr, "Invalid value supplied for io_ctx->%.*s: %.*s\n", prev_value->len,
+ (char *)prev_value->start, value->len, (char *)value->start);
+ return false;
+ }
+ value += nested_object_size;
+ i += nested_object_size;
+ }
+ return true;
+}
+/* data parsing functions end */
+
+/* build requests begin */
+static void
+craft_io_from_array(struct fuzz_vhost_io_ctx *src_ctx, struct fuzz_vhost_io_ctx *dest_ctx)
+{
+ if (g_keep_iov_pointers) {
+ dest_ctx->iovs = src_ctx->iovs;
+ }
+ dest_ctx->req = src_ctx->req;
+}
+
+static void
+craft_virtio_scsi_req(struct fuzz_vhost_dev_ctx *dev_ctx, struct fuzz_vhost_io_ctx *io_ctx)
+{
+ io_ctx->iovs.iov_req.iov_len = sizeof(io_ctx->req.scsi_req);
+ io_ctx->iovs.iov_resp.iov_len = sizeof(io_ctx->resp.scsi_resp);
+ fuzz_fill_random_bytes((char *)&io_ctx->req.scsi_req, sizeof(io_ctx->req.scsi_req),
+ &dev_ctx->random_seed);
+ /* TODO: set up the logic to find all luns on the target. Right now we are just assuming the first is OK. */
+ if (dev_ctx->valid_lun) {
+ io_ctx->req.scsi_req.lun[0] = 1;
+ io_ctx->req.scsi_req.lun[1] = 0;
+ }
+}
+
+static void
+craft_virtio_scsi_tmf_req(struct fuzz_vhost_dev_ctx *dev_ctx, struct fuzz_vhost_io_ctx *io_ctx)
+{
+ io_ctx->iovs.iov_req.iov_len = sizeof(io_ctx->req.scsi_tmf_req);
+ io_ctx->iovs.iov_resp.iov_len = sizeof(io_ctx->resp.scsi_tmf_resp);
+ fuzz_fill_random_bytes((char *)&io_ctx->req.scsi_tmf_req, sizeof(io_ctx->req.scsi_tmf_req),
+ &dev_ctx->random_seed);
+ /* TODO: set up the logic to find all luns on the target. Right now we are just assuming the first is OK. */
+ if (dev_ctx->valid_lun) {
+ io_ctx->req.scsi_tmf_req.lun[0] = 1;
+ io_ctx->req.scsi_tmf_req.lun[1] = 0;
+ }
+
+ /* Valid controlqueue commands have to be of type 0, 1, or 2. Any others just return immediately from the target. */
+ /* Try to only test the opcodes that will exercise extra paths in the target side. But allow for at least one invalid value. */
+ io_ctx->req.scsi_tmf_req.type = rand() % 4;
+}
+
+static void
+craft_virtio_blk_req(struct fuzz_vhost_io_ctx *io_ctx)
+{
+ io_ctx->iovs.iov_req.iov_len = sizeof(io_ctx->req.blk_req);
+ io_ctx->iovs.iov_resp.iov_len = sizeof(io_ctx->resp.blk_resp);
+ io_ctx->req.blk_req.type = rand();
+ io_ctx->req.blk_req.sector = rand();
+}
+
+static void
+craft_virtio_req_rsp_pair(struct fuzz_vhost_dev_ctx *dev_ctx, struct fuzz_vhost_io_ctx *io_ctx)
+{
+ struct fuzz_vhost_iov_ctx *iovs = &io_ctx->iovs;
+
+ /*
+ * Always set these buffer values up front.
+ * If the user wants to override this with the json values,
+ * they can specify -k when starting the app. */
+ iovs->iov_req.iov_base = &io_ctx->req;
+ if (dev_ctx->use_bogus_buffer) {
+ iovs->iov_data.iov_len = rand();
+ iovs->iov_data.iov_base = get_invalid_mem_address(iovs->iov_data.iov_len);
+ } else if (dev_ctx->use_valid_buffer) {
+ iovs->iov_data.iov_len = 1024;
+ iovs->iov_data.iov_base = g_valid_buffer;
+ }
+ iovs->iov_resp.iov_base = &io_ctx->resp;
+
+ if (dev_ctx->socket_is_blk && g_blk_cmd_array) {
+ craft_io_from_array(&g_blk_cmd_array[dev_ctx->submitted_io], io_ctx);
+ return;
+ } else if (dev_ctx->test_scsi_tmf && g_scsi_mgmt_cmd_array) {
+ craft_io_from_array(&g_scsi_mgmt_cmd_array[dev_ctx->submitted_io], io_ctx);
+ return;
+ } else if (g_scsi_cmd_array) {
+ craft_io_from_array(&g_scsi_cmd_array[dev_ctx->submitted_io], io_ctx);
+ return;
+ }
+
+ if (dev_ctx->socket_is_blk) {
+ craft_virtio_blk_req(io_ctx);
+ } else if (dev_ctx->test_scsi_tmf) {
+ craft_virtio_scsi_tmf_req(dev_ctx, io_ctx);
+ } else {
+ craft_virtio_scsi_req(dev_ctx, io_ctx);
+ }
+}
+/* build requests end */
+
+/* submit requests begin */
+static uint64_t
+get_max_num_io(struct fuzz_vhost_dev_ctx *dev_ctx)
+{
+ if (dev_ctx->socket_is_blk) {
+ return g_blk_cmd_array_size;
+ } else if (dev_ctx->test_scsi_tmf) {
+ return g_scsi_mgmt_cmd_array_size;
+ } else {
+ return g_scsi_cmd_array_size;
+ }
+}
+
+static int
+submit_virtio_req_rsp_pair(struct fuzz_vhost_dev_ctx *dev_ctx, struct virtqueue *vq,
+ struct fuzz_vhost_io_ctx *io_ctx)
+{
+ struct fuzz_vhost_iov_ctx *iovs = &io_ctx->iovs;
+ int num_iovs = 2, rc;
+
+ num_iovs += dev_ctx->use_bogus_buffer || dev_ctx->use_valid_buffer ? 1 : 0;
+
+ rc = virtqueue_req_start(vq, io_ctx, num_iovs);
+ if (rc) {
+ return rc;
+ }
+ virtqueue_req_add_iovs(vq, &iovs->iov_req, 1, SPDK_VIRTIO_DESC_RO);
+ /* blk and scsi requests favor different orders for the iov objects. */
+ if (dev_ctx->socket_is_blk) {
+ if (dev_ctx->use_bogus_buffer || dev_ctx->use_valid_buffer) {
+ virtqueue_req_add_iovs(vq, &iovs->iov_data, 1, SPDK_VIRTIO_DESC_WR);
+ }
+ virtqueue_req_add_iovs(vq, &iovs->iov_resp, 1, SPDK_VIRTIO_DESC_WR);
+ } else {
+ virtqueue_req_add_iovs(vq, &iovs->iov_resp, 1, SPDK_VIRTIO_DESC_WR);
+ if (dev_ctx->use_bogus_buffer || dev_ctx->use_valid_buffer) {
+ virtqueue_req_add_iovs(vq, &iovs->iov_data, 1, SPDK_VIRTIO_DESC_WR);
+ }
+ }
+ virtqueue_req_flush(vq);
+ return 0;
+}
+
+static void
+dev_submit_requests(struct fuzz_vhost_dev_ctx *dev_ctx, struct virtqueue *vq,
+ uint64_t max_io_to_submit)
+{
+ struct fuzz_vhost_io_ctx *io_ctx;
+ int rc;
+
+ while (!TAILQ_EMPTY(&dev_ctx->free_io_ctx) && dev_ctx->submitted_io < max_io_to_submit) {
+ io_ctx = TAILQ_FIRST(&dev_ctx->free_io_ctx);
+ craft_virtio_req_rsp_pair(dev_ctx, io_ctx);
+ rc = submit_virtio_req_rsp_pair(dev_ctx, vq, io_ctx);
+ if (rc == 0) {
+ TAILQ_REMOVE(&dev_ctx->free_io_ctx, io_ctx, link);
+ TAILQ_INSERT_TAIL(&dev_ctx->outstanding_io_ctx, io_ctx, link);
+ dev_ctx->submitted_io++;
+ } else if (rc == -ENOMEM) {
+ /* There are just not enough available buffers right now. try later. */
+ return;
+ } else if (rc == -EINVAL) {
+ /* The virtqueue must be broken. We know we can fit at least three descriptors */
+ fprintf(stderr, "One of the virtqueues for dev %p is broken. stopping all devices.\n", dev_ctx);
+ g_run = 0;
+ }
+ }
+}
+/* submit requests end */
+
+/* complete requests begin */
+static void
+check_successful_op(struct fuzz_vhost_dev_ctx *dev_ctx, struct fuzz_vhost_io_ctx *io_ctx)
+{
+ bool is_successful = false;
+
+ if (dev_ctx->socket_is_blk) {
+ if (io_ctx->resp.blk_resp == 0) {
+ is_successful = true;
+ }
+ } else if (dev_ctx->test_scsi_tmf) {
+ if (io_ctx->resp.scsi_tmf_resp.scsi_tmf_resp.response == 0 &&
+ io_ctx->resp.scsi_tmf_resp.an_resp.response == 0) {
+ is_successful = true;
+ }
+ } else {
+ if (io_ctx->resp.scsi_resp.status == 0) {
+ is_successful = true;
+ }
+ }
+
+ if (is_successful) {
+ fprintf(stderr, "An I/O completed without an error status. This could be worth looking into.\n");
+ fprintf(stderr,
+ "There is also a good chance that the target just failed before setting a status.\n");
+ dev_ctx->successful_io++;
+ print_req_obj(dev_ctx, io_ctx);
+ } else if (g_verbose_mode) {
+ fprintf(stderr, "The following I/O failed as expected.\n");
+ print_req_obj(dev_ctx, io_ctx);
+ }
+}
+
+static void
+complete_io(struct fuzz_vhost_dev_ctx *dev_ctx, struct fuzz_vhost_io_ctx *io_ctx)
+{
+ TAILQ_REMOVE(&dev_ctx->outstanding_io_ctx, io_ctx, link);
+ TAILQ_INSERT_HEAD(&dev_ctx->free_io_ctx, io_ctx, link);
+ check_successful_op(dev_ctx, io_ctx);
+ dev_ctx->completed_io++;
+ dev_ctx->timeout_tsc = fuzz_refresh_timeout();
+}
+
+static int
+poll_dev(void *ctx)
+{
+ struct fuzz_vhost_dev_ctx *dev_ctx = ctx;
+ struct virtqueue *vq;
+ struct fuzz_vhost_io_ctx *io_ctx[FUZZ_QUEUE_DEPTH];
+ int num_active_threads;
+ uint64_t max_io_to_complete = UINT64_MAX;
+ uint64_t current_ticks;
+ uint32_t len[FUZZ_QUEUE_DEPTH];
+ uint16_t num_cpl, i;
+
+ if (g_json_file) {
+ max_io_to_complete = get_max_num_io(dev_ctx);
+ }
+
+ if (!dev_ctx->socket_is_blk && dev_ctx->test_scsi_tmf) {
+ vq = dev_ctx->virtio_dev.vqs[VIRTIO_SCSI_CONTROLQ];
+ } else {
+ vq = dev_ctx->virtio_dev.vqs[VIRTIO_REQUESTQ];
+ }
+
+ num_cpl = virtio_recv_pkts(vq, (void **)io_ctx, len, FUZZ_QUEUE_DEPTH);
+
+ for (i = 0; i < num_cpl; i++) {
+ complete_io(dev_ctx, io_ctx[i]);
+ }
+
+ current_ticks = spdk_get_ticks();
+
+ if (current_ticks > dev_ctx->timeout_tsc) {
+ dev_ctx->timed_out = true;
+ g_run = false;
+ fprintf(stderr, "The VQ on device %p timed out. Dumping contents now.\n", dev_ctx);
+ dump_outstanding_io(dev_ctx);
+ }
+
+ if (current_ticks > g_runtime_ticks) {
+ g_run = 0;
+ }
+
+ if (!g_run || dev_ctx->completed_io >= max_io_to_complete) {
+ if (TAILQ_EMPTY(&dev_ctx->outstanding_io_ctx)) {
+ spdk_poller_unregister(&dev_ctx->poller);
+ num_active_threads = __sync_sub_and_fetch(&g_num_active_threads, 1);
+ if (num_active_threads == 0) {
+ g_run = 0;
+ }
+ spdk_thread_exit(dev_ctx->thread);
+ }
+ return 0;
+ }
+
+ dev_submit_requests(dev_ctx, vq, max_io_to_complete);
+ return 0;
+}
+/* complete requests end */
+
+static void
+start_io(void *ctx)
+{
+ struct fuzz_vhost_dev_ctx *dev_ctx = ctx;
+
+ if (g_random_seed) {
+ dev_ctx->random_seed = g_random_seed;
+ } else {
+ dev_ctx->random_seed = spdk_get_ticks();
+ }
+
+ dev_ctx->timeout_tsc = fuzz_refresh_timeout();
+
+ dev_ctx->poller = SPDK_POLLER_REGISTER(poll_dev, dev_ctx, 0);
+ if (dev_ctx->poller == NULL) {
+ return;
+ }
+
+}
+
+static int
+end_fuzz(void *ctx)
+{
+ if (!g_run && !g_num_active_threads) {
+ spdk_poller_unregister(&g_run_poller);
+ cleanup();
+ spdk_app_stop(0);
+ }
+ return 0;
+}
+
+static void
+begin_fuzz(void *ctx)
+{
+ struct fuzz_vhost_dev_ctx *dev_ctx;
+
+ g_runtime_ticks = spdk_get_ticks() + spdk_get_ticks_hz() * g_runtime;
+
+ g_valid_buffer = spdk_malloc(0x1000, 0x200, NULL, SPDK_ENV_LCORE_ID_ANY, SPDK_MALLOC_SHARE);
+ if (g_valid_buffer == NULL) {
+ fprintf(stderr, "Failed to allocate a valid buffer for I/O\n");
+ goto out;
+ }
+
+ g_run_poller = SPDK_POLLER_REGISTER(end_fuzz, NULL, 0);
+ if (g_run_poller == NULL) {
+ fprintf(stderr, "Failed to register a poller for test completion checking.\n");
+ }
+
+ TAILQ_FOREACH(dev_ctx, &g_dev_list, link) {
+ assert(dev_ctx->thread != NULL);
+ spdk_thread_send_msg(dev_ctx->thread, start_io, dev_ctx);
+ __sync_add_and_fetch(&g_num_active_threads, 1);
+ }
+
+ return;
+out:
+ cleanup();
+ spdk_app_stop(0);
+}
+
+static void
+fuzz_vhost_usage(void)
+{
+ fprintf(stderr, " -j <path> Path to a json file containing named objects.\n");
+ fprintf(stderr,
+ " -k Keep the iov pointer addresses from the json file. only valid with -j.\n");
+ fprintf(stderr, " -S <integer> Seed value for test.\n");
+ fprintf(stderr, " -t <integer> Time in seconds to run the fuzz test.\n");
+ fprintf(stderr, " -V Enable logging of each submitted command.\n");
+}
+
+static int
+fuzz_vhost_parse(int ch, char *arg)
+{
+ int64_t error_test;
+
+ switch (ch) {
+ case 'j':
+ g_json_file = optarg;
+ break;
+ case 'k':
+ g_keep_iov_pointers = true;
+ break;
+ case 'S':
+ error_test = spdk_strtol(arg, 10);
+ if (error_test < 0) {
+ fprintf(stderr, "Invalid value supplied for the random seed.\n");
+ return -1;
+ } else {
+ g_random_seed = spdk_strtol(arg, 10);
+ }
+ break;
+ case 't':
+ g_runtime = spdk_strtol(arg, 10);
+ if (g_runtime < 0 || g_runtime > MAX_RUNTIME_S) {
+ fprintf(stderr, "You must supply a positive runtime value less than 86401.\n");
+ return -1;
+ }
+ break;
+ case 'V':
+ g_verbose_mode = true;
+ break;
+ case '?':
+ default:
+ return -EINVAL;
+ }
+ return 0;
+}
+
+int
+main(int argc, char **argv)
+{
+ struct spdk_app_opts opts = {};
+ int rc;
+
+ spdk_app_opts_init(&opts);
+ opts.name = "vhost_fuzz";
+ g_runtime = DEFAULT_RUNTIME;
+
+ rc = spdk_app_parse_args(argc, argv, &opts, "j:kS:t:V", NULL, fuzz_vhost_parse, fuzz_vhost_usage);
+ if (rc != SPDK_APP_PARSE_ARGS_SUCCESS) {
+ fprintf(stderr, "Unable to parse the application arguments.\n");
+ return -1;
+ }
+
+ if (g_json_file != NULL) {
+ g_blk_cmd_array_size = fuzz_parse_args_into_array(g_json_file,
+ (void **)&g_blk_cmd_array,
+ sizeof(struct fuzz_vhost_io_ctx),
+ BLK_IO_NAME, parse_vhost_blk_cmds);
+ g_scsi_cmd_array_size = fuzz_parse_args_into_array(g_json_file,
+ (void **)&g_scsi_cmd_array,
+ sizeof(struct fuzz_vhost_io_ctx),
+ SCSI_IO_NAME, parse_vhost_scsi_cmds);
+ g_scsi_mgmt_cmd_array_size = fuzz_parse_args_into_array(g_json_file,
+ (void **)&g_scsi_mgmt_cmd_array,
+ sizeof(struct fuzz_vhost_io_ctx),
+ SCSI_IO_NAME, parse_vhost_scsi_mgmt_cmds);
+ if (g_blk_cmd_array_size == 0 && g_scsi_cmd_array_size == 0 && g_scsi_mgmt_cmd_array_size == 0) {
+ fprintf(stderr, "The provided json file did not contain any valid commands. Exiting.\n");
+ return -EINVAL;
+ }
+ }
+
+ spdk_app_start(&opts, begin_fuzz, NULL);
+}
diff --git a/src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz.h b/src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz.h
new file mode 100644
index 000000000..df71a846d
--- /dev/null
+++ b/src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz.h
@@ -0,0 +1,41 @@
+/*-
+ * BSD LICENSE
+ *
+ * Copyright (c) Intel Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name of Intel Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef VHOST_FUZZ_H
+#define VHOST_FUZZ_H
+
+int fuzz_vhost_dev_init(const char *socket_path, bool is_blk_dev, bool use_bogus_buffer,
+ bool use_valid_buffer, bool valid_lun, bool test_scsi_tmf);
+
+#endif
diff --git a/src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz_rpc.c b/src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz_rpc.c
new file mode 100644
index 000000000..b60e3f097
--- /dev/null
+++ b/src/spdk/test/app/fuzz/vhost_fuzz/vhost_fuzz_rpc.c
@@ -0,0 +1,108 @@
+/*-
+ * BSD LICENSE
+ *
+ * Copyright (c) Intel Corporation. All rights reserved.
+ * Copyright (c) 2018 Mellanox Technologies LTD. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name of Intel Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "spdk/stdinc.h"
+#include "spdk/rpc.h"
+#include "spdk/util.h"
+
+#include "vhost_fuzz.h"
+
+struct rpc_fuzz_vhost_dev_create {
+ char *socket;
+ bool is_blk;
+ bool use_bogus_buffer;
+ bool use_valid_buffer;
+ bool valid_lun;
+ bool test_scsi_tmf;
+};
+
+static const struct spdk_json_object_decoder rpc_fuzz_vhost_dev_create_decoders[] = {
+ {"socket", offsetof(struct rpc_fuzz_vhost_dev_create, socket), spdk_json_decode_string},
+ {"is_blk", offsetof(struct rpc_fuzz_vhost_dev_create, is_blk), spdk_json_decode_bool, true},
+ {"use_bogus_buffer", offsetof(struct rpc_fuzz_vhost_dev_create, use_bogus_buffer), spdk_json_decode_bool, true},
+ {"use_valid_buffer", offsetof(struct rpc_fuzz_vhost_dev_create, use_valid_buffer), spdk_json_decode_bool, true},
+ {"valid_lun", offsetof(struct rpc_fuzz_vhost_dev_create, valid_lun), spdk_json_decode_bool, true},
+ {"test_scsi_tmf", offsetof(struct rpc_fuzz_vhost_dev_create, test_scsi_tmf), spdk_json_decode_bool, true},
+};
+
+static void
+spdk_rpc_fuzz_vhost_create_dev(struct spdk_jsonrpc_request *request,
+ const struct spdk_json_val *params)
+{
+ struct spdk_json_write_ctx *w;
+ struct rpc_fuzz_vhost_dev_create req = {0};
+ int rc;
+
+ if (spdk_json_decode_object(params, rpc_fuzz_vhost_dev_create_decoders,
+ SPDK_COUNTOF(rpc_fuzz_vhost_dev_create_decoders), &req)) {
+ fprintf(stderr, "Unable to parse the request.\n");
+ spdk_jsonrpc_send_error_response(request, SPDK_JSONRPC_ERROR_INVALID_PARAMS,
+ "Unable to parse the object parameters.\n");
+ return;
+ }
+
+ if (strlen(req.socket) > PATH_MAX) {
+ fprintf(stderr, "Socket address is too long.\n");
+ spdk_jsonrpc_send_error_response(request, SPDK_JSONRPC_ERROR_INVALID_PARAMS,
+ "Unable to parse the object parameters.\n");
+ free(req.socket);
+ return;
+ }
+
+ rc = fuzz_vhost_dev_init(req.socket, req.is_blk, req.use_bogus_buffer, req.use_valid_buffer,
+ req.valid_lun, req.test_scsi_tmf);
+
+ if (rc != 0) {
+ if (rc == -ENOMEM) {
+ fprintf(stderr, "No valid memory for device initialization.\n");
+ spdk_jsonrpc_send_error_response(request, SPDK_JSONRPC_ERROR_INTERNAL_ERROR,
+ "No memory returned from host.\n");
+ } else if (rc == -EINVAL) {
+ fprintf(stderr, "Invalid device parameters provided.\n");
+ spdk_jsonrpc_send_error_response(request, SPDK_JSONRPC_ERROR_INVALID_PARAMS,
+ "Parameters provided were invalid.\n");
+ } else {
+ fprintf(stderr, "unknown error from the guest.\n");
+ spdk_jsonrpc_send_error_response(request, SPDK_JSONRPC_ERROR_INTERNAL_ERROR,
+ "Unexpected error code.\n");
+ }
+ } else {
+ w = spdk_jsonrpc_begin_result(request);
+ spdk_json_write_bool(w, true);
+ spdk_jsonrpc_end_result(request, w);
+ }
+
+ free(req.socket);
+ return;
+}
+SPDK_RPC_REGISTER("fuzz_vhost_create_dev", spdk_rpc_fuzz_vhost_create_dev, SPDK_RPC_STARTUP);
diff --git a/src/spdk/test/app/histogram_perf/.gitignore b/src/spdk/test/app/histogram_perf/.gitignore
new file mode 100644
index 000000000..c77b05312
--- /dev/null
+++ b/src/spdk/test/app/histogram_perf/.gitignore
@@ -0,0 +1 @@
+histogram_perf
diff --git a/src/spdk/test/app/histogram_perf/Makefile b/src/spdk/test/app/histogram_perf/Makefile
new file mode 100644
index 000000000..b60c704a8
--- /dev/null
+++ b/src/spdk/test/app/histogram_perf/Makefile
@@ -0,0 +1,43 @@
+#
+# BSD LICENSE
+#
+# Copyright (c) Intel Corporation.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in
+# the documentation and/or other materials provided with the
+# distribution.
+# * Neither the name of Intel Corporation nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+SPDK_ROOT_DIR := $(abspath $(CURDIR)/../../..)
+include $(SPDK_ROOT_DIR)/mk/spdk.common.mk
+
+APP = histogram_perf
+
+C_SRCS = histogram_perf.c
+
+SPDK_LIB_LIST = thread util log
+
+include $(SPDK_ROOT_DIR)/mk/spdk.app.mk
diff --git a/src/spdk/test/app/histogram_perf/histogram_perf.c b/src/spdk/test/app/histogram_perf/histogram_perf.c
new file mode 100644
index 000000000..5d9de5274
--- /dev/null
+++ b/src/spdk/test/app/histogram_perf/histogram_perf.c
@@ -0,0 +1,102 @@
+/*-
+ * BSD LICENSE
+ *
+ * Copyright (c) Intel Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name of Intel Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "spdk/stdinc.h"
+
+#include "spdk/env.h"
+#include "spdk/util.h"
+#include "spdk/histogram_data.h"
+
+/*
+ * This applications is a simple test app used to test the performance of
+ * tallying datapoints with struct spdk_histogram_data. It can be used
+ * to measure the effect of changes to the spdk_histogram_data implementation.
+ *
+ * There are no command line parameters currently - it just tallies
+ * datapoints for 10 seconds in a default-sized histogram structure and
+ * then prints out the number of tallies performed.
+ */
+
+static void
+usage(const char *prog)
+{
+ printf("usage: %s\n", prog);
+ printf("Options:\n");
+}
+
+int
+main(int argc, char **argv)
+{
+ struct spdk_histogram_data *h;
+ struct spdk_env_opts opts;
+ uint64_t tsc[128], t, end_tsc, count;
+ uint32_t i;
+ int ch;
+ int rc = 0;
+
+ while ((ch = getopt(argc, argv, "")) != -1) {
+ switch (ch) {
+ default:
+ usage(argv[0]);
+ return 1;
+ }
+ }
+
+ spdk_env_opts_init(&opts);
+ if (spdk_env_init(&opts)) {
+ printf("Err: Unable to initialize SPDK env\n");
+ return 1;
+ }
+
+ for (i = 0; i < SPDK_COUNTOF(tsc); i++) {
+ tsc[i] = spdk_get_ticks();
+ }
+
+ end_tsc = spdk_get_ticks() + (10 * spdk_get_ticks_hz());
+ count = 0;
+ h = spdk_histogram_data_alloc();
+
+ while (true) {
+ t = spdk_get_ticks();
+ spdk_histogram_data_tally(h, t - tsc[count % 128]);
+ count++;
+ if (t > end_tsc) {
+ break;
+ }
+ }
+
+ printf("count = %ju\n", count);
+ spdk_histogram_data_free(h);
+
+ return rc;
+}
diff --git a/src/spdk/test/app/jsoncat/.gitignore b/src/spdk/test/app/jsoncat/.gitignore
new file mode 100644
index 000000000..3e6db4f0e
--- /dev/null
+++ b/src/spdk/test/app/jsoncat/.gitignore
@@ -0,0 +1 @@
+jsoncat
diff --git a/src/spdk/test/app/jsoncat/Makefile b/src/spdk/test/app/jsoncat/Makefile
new file mode 100644
index 000000000..2635e501b
--- /dev/null
+++ b/src/spdk/test/app/jsoncat/Makefile
@@ -0,0 +1,43 @@
+#
+# BSD LICENSE
+#
+# Copyright (c) Intel Corporation.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in
+# the documentation and/or other materials provided with the
+# distribution.
+# * Neither the name of Intel Corporation nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+SPDK_ROOT_DIR := $(abspath $(CURDIR)/../../..)
+include $(SPDK_ROOT_DIR)/mk/spdk.common.mk
+
+APP = jsoncat
+
+C_SRCS = jsoncat.c
+
+SPDK_LIB_LIST = json thread util log
+
+include $(SPDK_ROOT_DIR)/mk/spdk.app.mk
diff --git a/src/spdk/test/app/jsoncat/jsoncat.c b/src/spdk/test/app/jsoncat/jsoncat.c
new file mode 100644
index 000000000..e932b54bd
--- /dev/null
+++ b/src/spdk/test/app/jsoncat/jsoncat.c
@@ -0,0 +1,192 @@
+/*-
+ * BSD LICENSE
+ *
+ * Copyright (c) Intel Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name of Intel Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* Simple JSON "cat" utility */
+
+#include "spdk/stdinc.h"
+
+#include "spdk/json.h"
+#include "spdk/file.h"
+
+static void
+usage(const char *prog)
+{
+ printf("usage: %s [-c] [-f] file.json\n", prog);
+ printf("Options:\n");
+ printf("-c\tallow comments in input (non-standard)\n");
+ printf("-f\tformatted output (default: compact output)\n");
+}
+
+static void
+print_json_error(FILE *pf, int rc, const char *filename)
+{
+ switch (rc) {
+ case SPDK_JSON_PARSE_INVALID:
+ fprintf(pf, "%s: invalid JSON\n", filename);
+ break;
+ case SPDK_JSON_PARSE_INCOMPLETE:
+ fprintf(pf, "%s: incomplete JSON\n", filename);
+ break;
+ case SPDK_JSON_PARSE_MAX_DEPTH_EXCEEDED:
+ fprintf(pf, "%s: maximum nesting depth exceeded\n", filename);
+ break;
+ default:
+ fprintf(pf, "%s: unknown JSON parse error\n", filename);
+ break;
+ }
+}
+
+static int
+json_write_cb(void *cb_ctx, const void *data, size_t size)
+{
+ FILE *f = cb_ctx;
+ size_t rc;
+
+ rc = fwrite(data, 1, size, f);
+ return rc == size ? 0 : -1;
+}
+
+static int
+process_file(const char *filename, FILE *f, uint32_t parse_flags, uint32_t write_flags)
+{
+ size_t size;
+ void *buf, *end;
+ ssize_t rc;
+ struct spdk_json_val *values;
+ size_t num_values;
+ struct spdk_json_write_ctx *w;
+
+ buf = spdk_posix_file_load(f, &size);
+ if (buf == NULL) {
+ fprintf(stderr, "%s: file read error\n", filename);
+ return 1;
+ }
+
+ rc = spdk_json_parse(buf, size, NULL, 0, NULL, parse_flags);
+ if (rc <= 0) {
+ print_json_error(stderr, rc, filename);
+ free(buf);
+ return 1;
+ }
+
+ num_values = (size_t)rc;
+ values = calloc(num_values, sizeof(*values));
+ if (values == NULL) {
+ perror("values calloc");
+ free(buf);
+ return 1;
+ }
+
+ rc = spdk_json_parse(buf, size, values, num_values, &end,
+ parse_flags | SPDK_JSON_PARSE_FLAG_DECODE_IN_PLACE);
+ if (rc <= 0) {
+ print_json_error(stderr, rc, filename);
+ free(values);
+ free(buf);
+ return 1;
+ }
+
+ w = spdk_json_write_begin(json_write_cb, stdout, write_flags);
+ if (w == NULL) {
+ fprintf(stderr, "json_write_begin failed\n");
+ free(values);
+ free(buf);
+ return 1;
+ }
+
+ spdk_json_write_val(w, values);
+ spdk_json_write_end(w);
+ printf("\n");
+
+ if (end != buf + size) {
+ fprintf(stderr, "%s: garbage at end of file\n", filename);
+ free(values);
+ free(buf);
+ return 1;
+ }
+
+ free(values);
+ free(buf);
+ return 0;
+}
+
+int
+main(int argc, char **argv)
+{
+ FILE *f;
+ int ch;
+ int rc;
+ uint32_t parse_flags = 0, write_flags = 0;
+ const char *filename;
+
+ while ((ch = getopt(argc, argv, "cf")) != -1) {
+ switch (ch) {
+ case 'c':
+ parse_flags |= SPDK_JSON_PARSE_FLAG_ALLOW_COMMENTS;
+ break;
+ case 'f':
+ write_flags |= SPDK_JSON_WRITE_FLAG_FORMATTED;
+ break;
+ default:
+ usage(argv[0]);
+ return 1;
+ }
+ }
+
+ if (optind == argc) {
+ filename = "-";
+ } else if (optind == argc - 1) {
+ filename = argv[optind];
+ } else {
+ usage(argv[0]);
+ return 1;
+ }
+
+ if (strcmp(filename, "-") == 0) {
+ f = stdin;
+ } else {
+ f = fopen(filename, "r");
+ if (f == NULL) {
+ perror("fopen");
+ return 1;
+ }
+ }
+
+ rc = process_file(filename, f, parse_flags, write_flags);
+
+ if (f != stdin) {
+ fclose(f);
+ }
+
+ return rc;
+}
diff --git a/src/spdk/test/app/match/match b/src/spdk/test/app/match/match
new file mode 100755
index 000000000..63fee5203
--- /dev/null
+++ b/src/spdk/test/app/match/match
@@ -0,0 +1,332 @@
+#!/usr/bin/env perl
+#
+# Copyright 2014-2017, Intel Corporation
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in
+# the documentation and/or other materials provided with the
+# distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+#
+# match -- compare an output file with expected results
+#
+# usage: match [-adoqv] [match-file]...
+#
+# this script compares the output from a test run, stored in a file, with
+# the expected output. comparison is done line-by-line until either all
+# lines compare correctly (exit code 0) or a miscompare is found (exit
+# code nonzero).
+#
+# expected output is stored in a ".match" file, which contains a copy of
+# the expected output with embedded tokens for things that should not be
+# exact matches. the supported tokens are:
+#
+# $(N) an integer (i.e. one or more decimal digits)
+# $(NC) one or more decimal digits with comma separators
+# $(FP) a floating point number
+# $(S) ascii string
+# $(X) hex number
+# $(XX) hex number prefixed with 0x
+# $(W) whitespace
+# $(nW) non-whitespace
+# $(*) any string
+# $(DD) output of a "dd" run
+# $(OPT) line is optional (may be missing, matched if found)
+# $(OPX) ends a contiguous list of $(OPT)...$(OPX) lines, at least
+# one of which must match
+#
+# Additionally, if any "X.ignore" file exists, strings or phrases found per
+# line in the file will be ignored if found as a substring in the
+# corresponding output file (making it easy to skip entire output lines).
+#
+# arguments are:
+#
+# -a find all files of the form "X.match" in the current
+# directory and match them again the corresponding file "X".
+#
+# -o custom output filename - only one match file can be given
+#
+# -d debug -- show lots of debug output
+#
+# -q don't print log files on mismatch
+#
+# -v verbose -- show every line as it is being matched
+#
+
+use strict;
+use Getopt::Std;
+use Encode;
+use v5.16;
+
+select STDERR;
+binmode(STDOUT, ":utf8");
+binmode(STDERR, ":utf8");
+
+my $Me = $0;
+$Me =~ s,.*/,,;
+
+our ($opt_a, $opt_d, $opt_q, $opt_v, $opt_o);
+
+$SIG{HUP} = $SIG{INT} = $SIG{TERM} = $SIG{__DIE__} = sub {
+ die @_ if $^S;
+ my $errstr = shift;
+ die "FAIL: $Me: $errstr";
+};
+
+sub usage {
+ my $msg = shift;
+
+ warn "$Me: $msg\n" if $msg;
+ warn "Usage: $Me [-adqv] [match-file]...\n";
+ warn " or: $Me [-dqv] -o output-file match-file...\n";
+ exit 1;
+}
+
+getopts('adoqv') or usage;
+
+my %match2file;
+
+if ($opt_a) {
+ usage("-a and filename arguments are mutually exclusive")
+ if $#ARGV != -1;
+ opendir(DIR, '.') or die "opendir: .: $!\n";
+ my @matchfiles = grep { /(.*)\.match$/ && -f $1 } readdir(DIR);
+ closedir(DIR);
+ die "no files found to process\n" unless @matchfiles;
+ foreach my $mfile (@matchfiles) {
+ die "$mfile: $!\n" unless open(F, $mfile);
+ close(F);
+ my $ofile = $mfile;
+ $ofile =~ s/\.match$//;
+ die "$mfile found but cannot open $ofile: $!\n"
+ unless open(F, $ofile);
+ close(F);
+ $match2file{$mfile} = $ofile;
+ }
+} elsif ($opt_o) {
+ usage("-o argument requires two paths") if $#ARGV != 1;
+
+ $match2file{$ARGV[1]} = $ARGV[0];
+} else {
+ usage("no match-file arguments found") if $#ARGV == -1;
+
+ # to improve the failure case, check all filename args exist and
+ # are provided in pairs now, before going through and processing them
+ foreach my $mfile (@ARGV) {
+ my $ofile = $mfile;
+ usage("$mfile: not a .match file") unless
+ $ofile =~ s/\.match$//;
+ usage("$mfile: $!") unless open(F, $mfile);
+ close(F);
+ usage("$ofile: $!") unless open(F, $ofile);
+ close(F);
+ $match2file{$mfile} = $ofile;
+ }
+}
+
+my $mfile;
+my $ofile;
+my $ifile;
+print "Files to be processed:\n" if $opt_v;
+foreach $mfile (sort keys %match2file) {
+ $ofile = $match2file{$mfile};
+ $ifile = $ofile . ".ignore";
+ $ifile = undef unless (-f $ifile);
+ if ($opt_v) {
+ print " match-file \"$mfile\" output-file \"$ofile\"";
+ if ($ifile) {
+ print " ignore-file $ifile\n";
+ } else {
+ print "\n";
+ }
+ }
+ match($mfile, $ofile, $ifile);
+}
+
+exit 0;
+
+#
+# strip_it - user can optionally ignore lines from files that contain
+# any number of substrings listed in a file called "X.ignore" where X
+# is the name of the output file.
+#
+sub strip_it {
+ my ($ifile, $file, $input) = @_;
+ # if there is no ignore file just return unaltered input
+ return $input unless $ifile;
+ my @lines_in = split /^/, $input;
+ my $output;
+ my $line_in;
+ my @i_file = split /^/, snarf($ifile);
+ my $i_line;
+ my $ignore_it = 0;
+
+ foreach $line_in (@lines_in) {
+ my @i_lines = @i_file;
+ foreach $i_line (@i_lines) {
+ # Check if both ignore and input lines are new lines
+ if ($i_line eq "\n" && $line_in eq "\n") {
+ $ignore_it = 1;
+ last;
+ }
+ # Find the ignore string in input line
+ chomp($i_line);
+ if (index($line_in, $i_line) != -1 && length($i_line) != 0) {
+ $ignore_it = 1;
+ last;
+ }
+ }
+ if ($ignore_it == 0) {
+ $output .= $line_in;
+ } elsif($opt_v) {
+ print "Ignoring (from $file): $line_in";
+ }
+ $ignore_it = 0;
+ }
+ return $output;
+}
+
+#
+# match -- process a match-file, output-file pair
+#
+sub match {
+ my ($mfile, $ofile, $ifile) = @_;
+ my $pat;
+ my $output = snarf($ofile);
+ $output = strip_it($ifile, $ofile, $output);
+ my $all_lines = $output;
+ my $line_pat = 0;
+ my $line_out = 0;
+ my $opt = 0;
+ my $opx = 0;
+ my $opt_found = 0;
+ my $fstr = snarf($mfile);
+ $fstr = strip_it($ifile, $mfile, $fstr);
+ for (split /^/, $fstr) {
+ $pat = $_;
+ $line_pat++;
+ $line_out++;
+ s/([*+?|{}.\\^\$\[()])/\\$1/g;
+ s/\\\$\\\(FP\\\)/[-+]?\\d*\\.?\\d+([eE][-+]?\\d+)?/g;
+ s/\\\$\\\(N\\\)/[-+]?\\d+/g;
+ s/\\\$\\\(NC\\\)/[-+]?\\d+(,[0-9]+)*/g;
+ s/\\\$\\\(\\\*\\\)/\\p{Print}*/g;
+ s/\\\$\\\(S\\\)/\\P{IsC}+/g;
+ s/\\\$\\\(X\\\)/\\p{XPosixXDigit}+/g;
+ s/\\\$\\\(XX\\\)/0x\\p{XPosixXDigit}+/g;
+ s/\\\$\\\(W\\\)/\\p{Blank}*/g;
+ s/\\\$\\\(nW\\\)/\\p{Graph}*/g;
+ s/\\\$\\\(DD\\\)/\\d+\\+\\d+ records in\n\\d+\\+\\d+ records out\n\\d+ bytes \\\(\\d+ .B\\\) copied, [.0-9e-]+[^,]*, [.0-9]+ .B.s/g;
+ if (s/\\\$\\\(OPT\\\)//) {
+ $opt = 1;
+ } elsif (s/\\\$\\\(OPX\\\)//) {
+ $opx = 1;
+ } else {
+ $opt_found = 0;
+ }
+
+ if ($opt_v) {
+ my @lines = split /\n/, $output;
+ my $line;
+ if (@lines) {
+ $line = $lines[0];
+ } else {
+ $line = "[EOF]";
+ }
+
+ printf("%s:%-3d %s%s:%-3d %s\n", $mfile, $line_pat, $pat, $ofile, $line_out, $line);
+ }
+
+ print " => /$_/\n" if $opt_d;
+ print " [$output]\n" if $opt_d;
+ unless ($output =~ s/^$_//) {
+ if ($opt || ($opx && $opt_found)) {
+ printf("%s:%-3d [skipping optional line]\n", $ofile, $line_out) if $opt_v;
+ $line_out--;
+ $opt = 0;
+ } else {
+ if (!$opt_v) {
+ if ($opt_q) {
+ print "[MATCHING FAILED]\n";
+ } else {
+ print "[MATCHING FAILED, COMPLETE FILE ($ofile) BELOW]\n$all_lines\n[EOF]\n";
+ }
+ $opt_v = 1;
+ match($mfile, $ofile);
+ }
+
+ die "$mfile:$line_pat did not match pattern\n";
+ }
+ } elsif ($opt) {
+ $opt_found = 1;
+ }
+ $opx = 0;
+ }
+
+ if ($output ne '') {
+ if (!$opt_v) {
+ if ($opt_q) {
+ print "[MATCHING FAILED]\n";
+ } else {
+ print "[MATCHING FAILED, COMPLETE FILE ($ofile) BELOW]\n$all_lines\n[EOF]\n";
+ }
+ }
+
+ # make it a little more print-friendly...
+ $output =~ s/\n/\\n/g;
+ die "line $line_pat: unexpected output: \"$output\"\n";
+ }
+}
+
+
+#
+# snarf -- slurp an entire file into memory
+#
+sub snarf {
+ my ($file) = @_;
+ my $fh;
+ open($fh, '<', $file) or die "$file $!\n";
+
+ local $/;
+ $_ = <$fh>;
+ close $fh;
+
+ # check known encodings or die
+ my $decoded;
+ my @encodings = ("UTF-8", "UTF-16", "UTF-16LE", "UTF-16BE");
+
+ foreach my $enc (@encodings) {
+ eval { $decoded = decode( $enc, $_, Encode::FB_CROAK ) };
+
+ if (!$@) {
+ $decoded =~ s/\R/\n/g;
+ return $decoded;
+ }
+ }
+
+ die "$Me: ERROR: Unknown file encoding";
+}
diff --git a/src/spdk/test/app/stub/.gitignore b/src/spdk/test/app/stub/.gitignore
new file mode 100644
index 000000000..39802f642
--- /dev/null
+++ b/src/spdk/test/app/stub/.gitignore
@@ -0,0 +1 @@
+stub
diff --git a/src/spdk/test/app/stub/Makefile b/src/spdk/test/app/stub/Makefile
new file mode 100644
index 000000000..79ca8a912
--- /dev/null
+++ b/src/spdk/test/app/stub/Makefile
@@ -0,0 +1,49 @@
+#
+# BSD LICENSE
+#
+# Copyright (c) Intel Corporation.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+# * Redistributions in binary form must reproduce the above copyright
+# notice, this list of conditions and the following disclaimer in
+# the documentation and/or other materials provided with the
+# distribution.
+# * Neither the name of Intel Corporation nor the names of its
+# contributors may be used to endorse or promote products derived
+# from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+SPDK_ROOT_DIR := $(abspath $(CURDIR)/../../..)
+include $(SPDK_ROOT_DIR)/mk/spdk.common.mk
+include $(SPDK_ROOT_DIR)/mk/spdk.modules.mk
+
+APP = stub
+
+C_SRCS := stub.c
+
+SPDK_LIB_LIST = $(SOCK_MODULES_LIST)
+SPDK_LIB_LIST += event conf nvme log trace rpc jsonrpc json thread util sock notify
+
+ifeq ($(CONFIG_RDMA),y)
+SPDK_LIB_LIST += rdma
+endif
+
+include $(SPDK_ROOT_DIR)/mk/spdk.app.mk
diff --git a/src/spdk/test/app/stub/stub.c b/src/spdk/test/app/stub/stub.c
new file mode 100644
index 000000000..83d9f706f
--- /dev/null
+++ b/src/spdk/test/app/stub/stub.c
@@ -0,0 +1,203 @@
+/*-
+ * BSD LICENSE
+ *
+ * Copyright (c) Intel Corporation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ * * Neither the name of Intel Corporation nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "spdk/stdinc.h"
+
+#include "spdk/event.h"
+#include "spdk/nvme.h"
+#include "spdk/string.h"
+#include "spdk/thread.h"
+
+static char g_path[256];
+static struct spdk_poller *g_poller;
+
+struct ctrlr_entry {
+ struct spdk_nvme_ctrlr *ctrlr;
+ struct ctrlr_entry *next;
+};
+
+static struct ctrlr_entry *g_controllers = NULL;
+
+static void
+cleanup(void)
+{
+ struct ctrlr_entry *ctrlr_entry = g_controllers;
+
+ while (ctrlr_entry) {
+ struct ctrlr_entry *next = ctrlr_entry->next;
+
+ spdk_nvme_detach(ctrlr_entry->ctrlr);
+ free(ctrlr_entry);
+ ctrlr_entry = next;
+ }
+}
+
+static void
+usage(char *executable_name)
+{
+ printf("%s [options]\n", executable_name);
+ printf("options:\n");
+ printf(" -i shared memory ID [required]\n");
+ printf(" -m mask core mask for DPDK\n");
+ printf(" -n channel number of memory channels used for DPDK\n");
+ printf(" -p core master (primary) core for DPDK\n");
+ printf(" -s size memory size in MB for DPDK\n");
+ printf(" -H show this usage\n");
+}
+
+static bool
+probe_cb(void *cb_ctx, const struct spdk_nvme_transport_id *trid,
+ struct spdk_nvme_ctrlr_opts *opts)
+{
+ /*
+ * Set the io_queue_size to UINT16_MAX to initialize
+ * the controller with the possible largest queue size.
+ */
+ opts->io_queue_size = UINT16_MAX;
+ return true;
+}
+
+static void
+attach_cb(void *cb_ctx, const struct spdk_nvme_transport_id *trid,
+ struct spdk_nvme_ctrlr *ctrlr, const struct spdk_nvme_ctrlr_opts *opts)
+{
+ struct ctrlr_entry *entry;
+
+ entry = malloc(sizeof(struct ctrlr_entry));
+ if (entry == NULL) {
+ fprintf(stderr, "Malloc error\n");
+ exit(1);
+ }
+
+ entry->ctrlr = ctrlr;
+ entry->next = g_controllers;
+ g_controllers = entry;
+}
+
+static int
+stub_sleep(void *arg)
+{
+ usleep(1000 * 1000);
+ return 0;
+}
+
+static void
+stub_start(void *arg1)
+{
+ int shm_id = (intptr_t)arg1;
+
+ spdk_unaffinitize_thread();
+
+ if (spdk_nvme_probe(NULL, NULL, probe_cb, attach_cb, NULL) != 0) {
+ fprintf(stderr, "spdk_nvme_probe() failed\n");
+ exit(1);
+ }
+
+ snprintf(g_path, sizeof(g_path), "/var/run/spdk_stub%d", shm_id);
+ if (mknod(g_path, S_IFREG, 0) != 0) {
+ fprintf(stderr, "could not create sentinel file %s\n", g_path);
+ exit(1);
+ }
+
+ g_poller = SPDK_POLLER_REGISTER(stub_sleep, NULL, 0);
+}
+
+static void
+stub_shutdown(void)
+{
+ spdk_poller_unregister(&g_poller);
+ unlink(g_path);
+ spdk_app_stop(0);
+}
+
+int
+main(int argc, char **argv)
+{
+ int ch;
+ struct spdk_app_opts opts = {};
+ long int val;
+
+ /* default value in opts structure */
+ spdk_app_opts_init(&opts);
+
+ opts.name = "stub";
+ opts.rpc_addr = NULL;
+
+ while ((ch = getopt(argc, argv, "i:m:n:p:s:H")) != -1) {
+ if (ch == 'm') {
+ opts.reactor_mask = optarg;
+ } else if (ch == '?') {
+ usage(argv[0]);
+ exit(1);
+ } else {
+ val = spdk_strtol(optarg, 10);
+ if (val < 0) {
+ fprintf(stderr, "Converting a string to integer failed\n");
+ exit(1);
+ }
+ switch (ch) {
+ case 'i':
+ opts.shm_id = val;
+ break;
+ case 'n':
+ opts.mem_channel = val;
+ break;
+ case 'p':
+ opts.master_core = val;
+ break;
+ case 's':
+ opts.mem_size = val;
+ break;
+ case 'H':
+ default:
+ usage(argv[0]);
+ exit(EXIT_SUCCESS);
+ }
+ }
+ }
+
+ if (opts.shm_id < 0) {
+ fprintf(stderr, "%s: -i shared memory ID must be specified\n", argv[0]);
+ usage(argv[0]);
+ exit(1);
+ }
+
+ opts.shutdown_cb = stub_shutdown;
+
+ ch = spdk_app_start(&opts, stub_start, (void *)(intptr_t)opts.shm_id);
+
+ cleanup();
+ spdk_app_fini();
+
+ return ch;
+}