Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Testing SSD Firmware with State Data-Aware Fuzzing: Accelerating Coverage in Nondeterministic I/O Environments

Gangho Yoon, Eunseok Lee

TL;DR

This paper tackles the challenge of testing SSD firmware under nondeterministic I/O by introducing a state data-aware fuzzing approach. The method leverages real-time SSD internal state and case-based reasoning to reuse test sequences that induce threshold-driven maintenance routines, enabling rapid coverage of long-running firmware paths. Empirical results on the FEMU emulator show the state-aware fuzzer matches AFL++ coverage with about 67% fewer commands and detects a similar or greater fraction of crashes/hangs, even when the I/O command space is expanded. The work demonstrates practical gains in coverage efficiency and defect discovery, and suggests broader applicability to other storage firmware and embedded systems, with future work on real hardware validation and distributed fuzzing.

Abstract

Solid-State Drive (SSD) firmware manages complex internal states, including flash memory maintenance. Due to nondeterministic I/O operations, traditional testing methods struggle to rapidly achieve coverage of firmware code areas that require extensive I/O accumulation. To address this challenge, we propose a state data-aware fuzzing approach that leverages SSD firmware's internal state to guide input generation under nondeterministic I/O conditions and accelerate coverage discovery. Our experiments with an open-source SSD firmware emulator show that the proposed method achieves the same firmware test coverage as a state-of-the-art coverage-based fuzzer (AFL++) while requiring approximately 67% fewer commands, without reducing the number of crashes or hangs detected. Moreover, we extend our experiments by incorporating various I/O commands beyond basic write/read operations to reflect real user scenarios, and we confirm that our strategy remains effective even for multiple types of I/O tests. We further validate the effectiveness of state data-aware fuzzing for firmware testing under I/O environments and suggest that this approach can be extended to other storage firmware or threshold-based embedded systems in the future.

Testing SSD Firmware with State Data-Aware Fuzzing: Accelerating Coverage in Nondeterministic I/O Environments

TL;DR

This paper tackles the challenge of testing SSD firmware under nondeterministic I/O by introducing a state data-aware fuzzing approach. The method leverages real-time SSD internal state and case-based reasoning to reuse test sequences that induce threshold-driven maintenance routines, enabling rapid coverage of long-running firmware paths. Empirical results on the FEMU emulator show the state-aware fuzzer matches AFL++ coverage with about 67% fewer commands and detects a similar or greater fraction of crashes/hangs, even when the I/O command space is expanded. The work demonstrates practical gains in coverage efficiency and defect discovery, and suggests broader applicability to other storage firmware and embedded systems, with future work on real hardware validation and distributed fuzzing.

Abstract

Solid-State Drive (SSD) firmware manages complex internal states, including flash memory maintenance. Due to nondeterministic I/O operations, traditional testing methods struggle to rapidly achieve coverage of firmware code areas that require extensive I/O accumulation. To address this challenge, we propose a state data-aware fuzzing approach that leverages SSD firmware's internal state to guide input generation under nondeterministic I/O conditions and accelerate coverage discovery. Our experiments with an open-source SSD firmware emulator show that the proposed method achieves the same firmware test coverage as a state-of-the-art coverage-based fuzzer (AFL++) while requiring approximately 67% fewer commands, without reducing the number of crashes or hangs detected. Moreover, we extend our experiments by incorporating various I/O commands beyond basic write/read operations to reflect real user scenarios, and we confirm that our strategy remains effective even for multiple types of I/O tests. We further validate the effectiveness of state data-aware fuzzing for firmware testing under I/O environments and suggest that this approach can be extended to other storage firmware or threshold-based embedded systems in the future.
Paper Structure (30 sections, 3 figures, 2 tables)

This paper contains 30 sections, 3 figures, 2 tables.

Table of Contents

  1. INTRODUCTION
  2. BACKGROUND AND RELATED WORK
  3. SSD Firmware’s State-Based and Nondeterministic Behavior
  4. Threshold-Based Maintenance Logic Requiring I/O Accumulation
  5. Coverage-Based Fuzzing (CGF) and the Use of State Information
  6. Overcoming Nondeterministic I/O and Reinforcement Learning
  7. METHODS
  8. Overview
  9. Implementation
  10. Rationale: Case-Based Reasoning and State Data Usage
  11. Why Use State Variables?
  12. Necessity of Test Sequence Reuse
  13. Test Sequence Ontology
  14. EXPERIMENTAL SETUP
  15. Research Questions (RQ)
  16. ...and 15 more sections

Figures (3)

  • Figure 1: State Data-Aware Fuzzer Overview.
  • Figure 2: State value changes. When the value reaches 190, internal firmware maintenance logic is triggered.
  • Figure 3: Distribution of Command Operations. Later Test Sequences have more Write and Flush Commands.