1 /* SPDX-License-Identifier: BSD-3-Clause 2 * Copyright (c) Intel Corporation. All rights reserved. 3 */ 4 5 #include "spdk/stdinc.h" 6 #include "spdk/conf.h" 7 #include "spdk/env.h" 8 #include "spdk/event.h" 9 #include "spdk/util.h" 10 #include "spdk/string.h" 11 #include "spdk/nvme_spec.h" 12 #include "spdk/nvme.h" 13 #include "spdk/likely.h" 14 #include "spdk/file.h" 15 16 static const uint8_t *g_data; 17 static bool g_trid_specified = false; 18 static int32_t g_time_in_sec = 10; 19 static char *g_corpus_dir; 20 static uint8_t *g_repro_data; 21 static size_t g_repro_size; 22 static pthread_t g_fuzz_td; 23 static pthread_t g_reactor_td; 24 static bool g_in_fuzzer; 25 26 #define MAX_COMMANDS 5 27 28 struct fuzz_command { 29 struct spdk_nvme_cmd cmd; 30 void *buf; 31 uint32_t len; 32 }; 33 34 static struct fuzz_command g_cmds[MAX_COMMANDS]; 35 36 typedef void (*fuzz_build_cmd_fn)(struct fuzz_command *cmd); 37 38 struct fuzz_type { 39 fuzz_build_cmd_fn fn; 40 uint32_t bytes_per_cmd; 41 bool is_admin; 42 }; 43 44 static void 45 fuzz_admin_command(struct fuzz_command *cmd) 46 { 47 memcpy(&cmd->cmd, g_data, sizeof(cmd->cmd)); 48 g_data += sizeof(cmd->cmd); 49 50 /* ASYNC_EVENT_REQUEST won't complete, so pick a different opcode. */ 51 if (cmd->cmd.opc == SPDK_NVME_OPC_ASYNC_EVENT_REQUEST) { 52 cmd->cmd.opc = SPDK_NVME_OPC_SET_FEATURES; 53 } 54 55 /* NVME_OPC_FABRIC is special for fabric transport, so pick a different opcode. */ 56 if (cmd->cmd.opc == SPDK_NVME_OPC_FABRIC) { 57 cmd->cmd.opc = SPDK_NVME_OPC_SET_FEATURES; 58 } 59 60 /* Fuzz a normal operation, so set a zero value in Fused field. */ 61 cmd->cmd.fuse = 0; 62 } 63 64 static void 65 fuzz_admin_get_log_page_command(struct fuzz_command *cmd) 66 { 67 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 68 69 cmd->cmd.opc = SPDK_NVME_OPC_GET_LOG_PAGE; 70 71 /* Only fuzz some of the more interesting parts of the GET_LOG_PAGE command. */ 72 73 cmd->cmd.cdw10_bits.get_log_page.numdl = ((uint16_t)g_data[0] << 8) + (uint16_t)g_data[1]; 74 cmd->cmd.cdw10_bits.get_log_page.lid = g_data[2]; 75 cmd->cmd.cdw10_bits.get_log_page.lsp = g_data[3] & (0x60 >> 5); 76 cmd->cmd.cdw10_bits.get_log_page.rae = g_data[3] & (0x80 >> 7); 77 78 cmd->cmd.cdw11_bits.get_log_page.numdu = g_data[3] & (0x18 >> 3); 79 80 /* Log Page Offset Lower */ 81 cmd->cmd.cdw12 = ((uint16_t)g_data[4] << 8) + (uint16_t)g_data[5]; 82 83 /* Offset Type */ 84 cmd->cmd.cdw14 = g_data[3] & (0x01 >> 0); 85 86 /* Log Page Offset Upper */ 87 cmd->cmd.cdw13 = g_data[3] & (0x06 >> 1); 88 89 g_data += 6; 90 } 91 92 static void 93 fuzz_admin_identify_command(struct fuzz_command *cmd) 94 { 95 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 96 97 cmd->cmd.opc = SPDK_NVME_OPC_IDENTIFY; 98 99 cmd->cmd.cdw10_bits.identify.cns = g_data[0]; 100 cmd->cmd.cdw10_bits.identify.cntid = ((uint16_t)g_data[1] << 8) + (uint16_t)g_data[2]; 101 102 cmd->cmd.cdw11_bits.identify.nvmsetid = ((uint16_t)g_data[3] << 8) + (uint16_t)g_data[4]; 103 cmd->cmd.cdw11_bits.identify.csi = g_data[5]; 104 105 /* UUID index, bits 0-6 are used */ 106 cmd->cmd.cdw14 = (g_data[6] & 0x7f); 107 108 g_data += 7; 109 } 110 111 static void 112 fuzz_admin_abort_command(struct fuzz_command *cmd) 113 { 114 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 115 cmd->cmd.opc = SPDK_NVME_OPC_ABORT; 116 117 cmd->cmd.cdw10_bits.abort.sqid = ((uint16_t)g_data[0] << 8) + (uint16_t)g_data[1]; 118 cmd->cmd.cdw10_bits.abort.cid = ((uint16_t)g_data[2] << 8) + (uint16_t)g_data[3]; 119 120 g_data += 4; 121 } 122 123 static void 124 fuzz_admin_create_io_completion_queue_command(struct fuzz_command *cmd) 125 { 126 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 127 cmd->cmd.opc = SPDK_NVME_OPC_CREATE_IO_CQ; 128 129 cmd->cmd.cdw10_bits.create_io_q.qid = ((uint16_t)g_data[0] << 8) + (uint16_t)g_data[1]; 130 cmd->cmd.cdw10_bits.create_io_q.qsize = ((uint16_t)g_data[2] << 8) + (uint16_t)g_data[3]; 131 132 cmd->cmd.cdw11_bits.create_io_cq.iv = ((uint16_t)g_data[4] << 8) + (uint16_t)g_data[5]; 133 cmd->cmd.cdw11_bits.create_io_cq.pc = (g_data[6] >> 7) & 0x01; 134 cmd->cmd.cdw11_bits.create_io_cq.ien = (g_data[6] >> 6) & 0x01; 135 136 g_data += 7; 137 } 138 139 static void 140 fuzz_admin_create_io_submission_queue_command(struct fuzz_command *cmd) 141 { 142 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 143 cmd->cmd.opc = SPDK_NVME_OPC_CREATE_IO_SQ; 144 145 cmd->cmd.cdw10_bits.create_io_q.qid = ((uint16_t)g_data[0] << 8) + (uint16_t)g_data[1]; 146 cmd->cmd.cdw10_bits.create_io_q.qsize = ((uint16_t)g_data[2] << 8) + (uint16_t)g_data[3]; 147 148 cmd->cmd.cdw11_bits.create_io_sq.cqid = ((uint16_t)g_data[4] << 8) + (uint16_t)g_data[5]; 149 cmd->cmd.cdw11_bits.create_io_sq.qprio = (g_data[6] >> 6) & 0x03; 150 cmd->cmd.cdw11_bits.create_io_sq.pc = (g_data[6] >> 5) & 0x01; 151 152 /* NVM Set Identifier */ 153 cmd->cmd.cdw12 = ((uint16_t)g_data[7] << 8) + (uint16_t)g_data[8]; 154 155 g_data += 9; 156 } 157 158 static void 159 fuzz_admin_delete_io_completion_queue_command(struct fuzz_command *cmd) 160 { 161 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 162 cmd->cmd.opc = SPDK_NVME_OPC_DELETE_IO_CQ; 163 164 cmd->cmd.cdw10_bits.delete_io_q.qid = ((uint16_t)g_data[0] << 8) + (uint16_t)g_data[1]; 165 166 g_data += 2; 167 } 168 169 static void 170 fuzz_admin_delete_io_submission_queue_command(struct fuzz_command *cmd) 171 { 172 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 173 cmd->cmd.opc = SPDK_NVME_OPC_DELETE_IO_SQ; 174 175 cmd->cmd.cdw10_bits.delete_io_q.qid = ((uint16_t)g_data[0] << 8) + (uint16_t)g_data[1]; 176 177 g_data += 2; 178 } 179 180 static void 181 fuzz_admin_namespace_attachment_command(struct fuzz_command *cmd) 182 { 183 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 184 cmd->cmd.opc = SPDK_NVME_OPC_NS_ATTACHMENT; 185 186 cmd->cmd.cdw10_bits.ns_attach.sel = (g_data[0] >> 4) & 0x0f; 187 188 g_data += 1; 189 } 190 191 static void 192 fuzz_admin_namespace_management_command(struct fuzz_command *cmd) 193 { 194 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 195 cmd->cmd.opc = SPDK_NVME_OPC_NS_MANAGEMENT; 196 197 cmd->cmd.cdw10_bits.ns_manage.sel = (g_data[0] >> 4) & 0x0f; 198 199 g_data += 1; 200 } 201 202 static void 203 fuzz_admin_security_receive_command(struct fuzz_command *cmd) 204 { 205 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 206 cmd->cmd.opc = SPDK_NVME_OPC_SECURITY_RECEIVE; 207 208 cmd->cmd.cdw10_bits.sec_send_recv.secp = g_data[0]; 209 cmd->cmd.cdw10_bits.sec_send_recv.spsp1 = g_data[1]; 210 cmd->cmd.cdw10_bits.sec_send_recv.spsp0 = g_data[2]; 211 cmd->cmd.cdw10_bits.sec_send_recv.nssf = g_data[3]; 212 213 /* Allocation Length(AL) */ 214 cmd->cmd.cdw11 = ((uint32_t)g_data[4] << 24) + ((uint32_t)g_data[5] << 16) + 215 ((uint32_t)g_data[6] << 8) + (uint32_t)g_data[7]; 216 217 g_data += 8; 218 } 219 220 static void 221 fuzz_admin_security_send_command(struct fuzz_command *cmd) 222 { 223 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 224 cmd->cmd.opc = SPDK_NVME_OPC_SECURITY_SEND; 225 226 cmd->cmd.cdw10_bits.sec_send_recv.secp = g_data[0]; 227 cmd->cmd.cdw10_bits.sec_send_recv.spsp1 = g_data[1]; 228 cmd->cmd.cdw10_bits.sec_send_recv.spsp0 = g_data[2]; 229 cmd->cmd.cdw10_bits.sec_send_recv.nssf = g_data[3]; 230 231 /* Transfer Length(TL) */ 232 cmd->cmd.cdw11 = (uint32_t)(g_data[4] << 24) + ((uint32_t)g_data[5] << 16) + 233 ((uint32_t)g_data[6] << 8) + (uint32_t)g_data[7]; 234 235 g_data += 8; 236 } 237 238 static void 239 fuzz_admin_directive_send_command(struct fuzz_command *cmd) 240 { 241 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 242 cmd->cmd.opc = SPDK_NVME_OPC_DIRECTIVE_SEND; 243 244 cmd->cmd.cdw10 = ((uint32_t)g_data[0] << 24) + ((uint32_t)g_data[1] << 16) + 245 ((uint32_t)g_data[2] << 8) + (uint32_t)g_data[3]; 246 247 cmd->cmd.cdw11_bits.directive.dspec = ((uint16_t)g_data[4] << 8) + (uint16_t)g_data[5]; 248 cmd->cmd.cdw11_bits.directive.dtype = g_data[6]; 249 cmd->cmd.cdw11_bits.directive.doper = g_data[7]; 250 251 g_data += 8; 252 } 253 254 static void 255 fuzz_admin_directive_receive_command(struct fuzz_command *cmd) 256 { 257 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 258 cmd->cmd.opc = SPDK_NVME_OPC_DIRECTIVE_RECEIVE; 259 260 cmd->cmd.cdw10 = ((uint32_t)g_data[0] << 24) + ((uint32_t)g_data[1] << 16) + 261 ((uint32_t)g_data[2] << 8) + (uint32_t)g_data[3]; 262 263 cmd->cmd.cdw11_bits.directive.dspec = ((uint16_t)g_data[4] << 8) + (uint16_t)g_data[5]; 264 cmd->cmd.cdw11_bits.directive.dtype = g_data[6]; 265 cmd->cmd.cdw11_bits.directive.doper = g_data[7]; 266 267 g_data += 8; 268 } 269 270 static void feat_arbitration(struct fuzz_command *cmd) 271 { 272 cmd->cmd.cdw11_bits.feat_arbitration.bits.hpw = g_data[2]; 273 cmd->cmd.cdw11_bits.feat_arbitration.bits.mpw = g_data[3]; 274 cmd->cmd.cdw11_bits.feat_arbitration.bits.lpw = g_data[4]; 275 cmd->cmd.cdw11_bits.feat_arbitration.bits.ab = g_data[5] & 0x07; 276 } 277 278 static void feat_power_management(struct fuzz_command *cmd) 279 { 280 cmd->cmd.cdw11_bits.feat_power_management.bits.wh = g_data[2] & 0x07; 281 cmd->cmd.cdw11_bits.feat_power_management.bits.ps = (g_data[2] >> 3) & 0x1f; 282 } 283 284 static void feat_lba_range_type(struct fuzz_command *cmd) 285 { 286 cmd->cmd.cdw11_bits.feat_lba_range_type.bits.num = (g_data[2] >> 2) & 0x3f; 287 } 288 289 static void feat_temperature_threshold(struct fuzz_command *cmd) 290 { 291 cmd->cmd.cdw11_bits.feat_temp_threshold.bits.thsel = g_data[2] & 0x03; 292 cmd->cmd.cdw11_bits.feat_temp_threshold.bits.tmpsel = (g_data[2] >> 2) & 0x0f; 293 cmd->cmd.cdw11_bits.feat_temp_threshold.bits.tmpth = ((uint16_t)g_data[3] << 8) + 294 (uint16_t)g_data[4]; 295 } 296 297 static void feat_error_recover(struct fuzz_command *cmd) 298 { 299 cmd->cmd.cdw11_bits.feat_error_recovery.bits.dulbe = g_data[2] & 0x01; 300 cmd->cmd.cdw11_bits.feat_error_recovery.bits.tler = ((uint16_t)g_data[3] << 8) + 301 (uint16_t)g_data[4]; 302 } 303 304 static void feat_volatile_write_cache(struct fuzz_command *cmd) 305 { 306 cmd->cmd.cdw11_bits.feat_volatile_write_cache.bits.wce = g_data[2] & 0x01; 307 } 308 309 static void feat_number_of_queues(struct fuzz_command *cmd) 310 { 311 cmd->cmd.cdw11_bits.feat_num_of_queues.bits.ncqr = ((uint16_t)g_data[2] << 8) + (uint16_t)g_data[3]; 312 cmd->cmd.cdw11_bits.feat_num_of_queues.bits.nsqr = ((uint16_t)g_data[4] << 8) + (uint16_t)g_data[5]; 313 } 314 315 static void feat_interrupt_coalescing(struct fuzz_command *cmd) 316 { 317 cmd->cmd.cdw11_bits.feat_interrupt_coalescing.bits.time = g_data[2]; 318 cmd->cmd.cdw11_bits.feat_interrupt_coalescing.bits.thr = g_data[3]; 319 } 320 321 static void feat_interrupt_vector_configuration(struct fuzz_command *cmd) 322 { 323 cmd->cmd.cdw11_bits.feat_interrupt_vector_configuration.bits.cd = g_data[2] & 0x01; 324 cmd->cmd.cdw11_bits.feat_interrupt_vector_configuration.bits.iv = ((uint16_t)g_data[3] << 8) + 325 (uint16_t)g_data[4]; 326 } 327 328 static void feat_write_atomicity(struct fuzz_command *cmd) 329 { 330 cmd->cmd.cdw11_bits.feat_write_atomicity.bits.dn = g_data[2] & 0x01; 331 } 332 333 static void feat_async_event_cfg(struct fuzz_command *cmd) 334 { 335 cmd->cmd.cdw11_bits.feat_async_event_cfg.bits.ana_change_notice = g_data[2] & 0x01; 336 cmd->cmd.cdw11_bits.feat_async_event_cfg.bits.discovery_log_change_notice = (g_data[2] >> 1) & 0x01; 337 cmd->cmd.cdw11_bits.feat_async_event_cfg.bits.fw_activation_notice = (g_data[2] >> 2) & 0x01; 338 cmd->cmd.cdw11_bits.feat_async_event_cfg.bits.ns_attr_notice = (g_data[2] >> 3) & 0x01; 339 cmd->cmd.cdw11_bits.feat_async_event_cfg.bits.telemetry_log_notice = (g_data[2] >> 4) & 0x01; 340 341 cmd->cmd.cdw11_bits.feat_async_event_cfg.bits.crit_warn.bits.available_spare = g_data[3] & 0x01; 342 cmd->cmd.cdw11_bits.feat_async_event_cfg.bits.crit_warn.bits.device_reliability = 343 (g_data[3] >> 1) & 0x01; 344 cmd->cmd.cdw11_bits.feat_async_event_cfg.bits.crit_warn.bits.read_only = (g_data[3] >> 2) & 0x01; 345 cmd->cmd.cdw11_bits.feat_async_event_cfg.bits.crit_warn.bits.temperature = (g_data[3] >> 3) & 0x01; 346 cmd->cmd.cdw11_bits.feat_async_event_cfg.bits.crit_warn.bits.volatile_memory_backup = 347 (g_data[3] >> 4) & 0x01; 348 } 349 350 static void feat_keep_alive_timer(struct fuzz_command *cmd) 351 { 352 cmd->cmd.cdw11_bits.feat_keep_alive_timer.bits.kato = ((uint32_t)g_data[2] << 24) + (( 353 uint32_t)g_data[3] << 16) + 354 ((uint32_t)g_data[4] << 8) + (uint32_t)g_data[5]; 355 } 356 357 static void feat_host_identifier(struct fuzz_command *cmd) 358 { 359 cmd->cmd.cdw11_bits.feat_host_identifier.bits.exhid = g_data[2] & 0x01; 360 } 361 362 static void feat_rsv_notification_mask(struct fuzz_command *cmd) 363 { 364 cmd->cmd.cdw11_bits.feat_rsv_notification_mask.bits.regpre = g_data[2] & 0x01; 365 cmd->cmd.cdw11_bits.feat_rsv_notification_mask.bits.respre = (g_data[2] >> 1) & 0x01; 366 cmd->cmd.cdw11_bits.feat_rsv_notification_mask.bits.resrel = (g_data[2] >> 2) & 0x01; 367 } 368 369 static void feat_rsv_persistence(struct fuzz_command *cmd) 370 { 371 cmd->cmd.cdw11_bits.feat_rsv_persistence.bits.ptpl = g_data[2] & 0x01; 372 } 373 374 static void 375 fuzz_admin_set_features_command(struct fuzz_command *cmd) 376 { 377 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 378 cmd->cmd.opc = SPDK_NVME_OPC_SET_FEATURES; 379 380 cmd->cmd.cdw10_bits.set_features.fid = g_data[0]; 381 cmd->cmd.cdw10_bits.set_features.sv = (g_data[1] >> 7) & 0x01; 382 383 switch (cmd->cmd.cdw10_bits.set_features.fid) { 384 case SPDK_NVME_FEAT_ARBITRATION: 385 feat_arbitration(cmd); 386 break; 387 case SPDK_NVME_FEAT_POWER_MANAGEMENT: 388 feat_power_management(cmd); 389 break; 390 case SPDK_NVME_FEAT_LBA_RANGE_TYPE: 391 feat_lba_range_type(cmd); 392 break; 393 case SPDK_NVME_FEAT_TEMPERATURE_THRESHOLD: 394 feat_temperature_threshold(cmd); 395 break; 396 case SPDK_NVME_FEAT_ERROR_RECOVERY: 397 feat_error_recover(cmd); 398 break; 399 case SPDK_NVME_FEAT_VOLATILE_WRITE_CACHE: 400 feat_volatile_write_cache(cmd); 401 break; 402 case SPDK_NVME_FEAT_NUMBER_OF_QUEUES: 403 feat_number_of_queues(cmd); 404 break; 405 case SPDK_NVME_FEAT_INTERRUPT_COALESCING: 406 feat_interrupt_coalescing(cmd); 407 break; 408 case SPDK_NVME_FEAT_INTERRUPT_VECTOR_CONFIGURATION: 409 feat_interrupt_vector_configuration(cmd); 410 break; 411 case SPDK_NVME_FEAT_WRITE_ATOMICITY: 412 feat_write_atomicity(cmd); 413 break; 414 case SPDK_NVME_FEAT_ASYNC_EVENT_CONFIGURATION: 415 feat_async_event_cfg(cmd); 416 break; 417 case SPDK_NVME_FEAT_KEEP_ALIVE_TIMER: 418 feat_keep_alive_timer(cmd); 419 break; 420 case SPDK_NVME_FEAT_HOST_IDENTIFIER: 421 feat_host_identifier(cmd); 422 break; 423 case SPDK_NVME_FEAT_HOST_RESERVE_MASK: 424 feat_rsv_notification_mask(cmd); 425 break; 426 case SPDK_NVME_FEAT_HOST_RESERVE_PERSIST: 427 feat_rsv_persistence(cmd); 428 break; 429 430 default: 431 break; 432 } 433 434 /* Use g_data[2] through g_data[5] for feature-specific 435 bits and set g_data[6] for cdw14 every iteration 436 UUID index, bits 0-6 are used */ 437 cmd->cmd.cdw14 = (g_data[6] & 0x7f); 438 439 g_data += 7; 440 } 441 442 static void 443 fuzz_admin_get_features_command(struct fuzz_command *cmd) 444 { 445 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 446 cmd->cmd.opc = SPDK_NVME_OPC_GET_FEATURES; 447 448 cmd->cmd.cdw10_bits.get_features.fid = g_data[0]; 449 cmd->cmd.cdw10_bits.get_features.sel = (g_data[1] >> 5) & 0x07; 450 451 switch (cmd->cmd.cdw10_bits.set_features.fid) { 452 case SPDK_NVME_FEAT_ARBITRATION: 453 feat_arbitration(cmd); 454 break; 455 case SPDK_NVME_FEAT_POWER_MANAGEMENT: 456 feat_power_management(cmd); 457 break; 458 case SPDK_NVME_FEAT_LBA_RANGE_TYPE: 459 feat_lba_range_type(cmd); 460 break; 461 case SPDK_NVME_FEAT_TEMPERATURE_THRESHOLD: 462 feat_temperature_threshold(cmd); 463 break; 464 case SPDK_NVME_FEAT_ERROR_RECOVERY: 465 feat_error_recover(cmd); 466 break; 467 case SPDK_NVME_FEAT_VOLATILE_WRITE_CACHE: 468 feat_volatile_write_cache(cmd); 469 break; 470 case SPDK_NVME_FEAT_NUMBER_OF_QUEUES: 471 feat_number_of_queues(cmd); 472 break; 473 case SPDK_NVME_FEAT_INTERRUPT_COALESCING: 474 feat_interrupt_coalescing(cmd); 475 break; 476 case SPDK_NVME_FEAT_INTERRUPT_VECTOR_CONFIGURATION: 477 feat_interrupt_vector_configuration(cmd); 478 break; 479 case SPDK_NVME_FEAT_WRITE_ATOMICITY: 480 feat_write_atomicity(cmd); 481 break; 482 case SPDK_NVME_FEAT_ASYNC_EVENT_CONFIGURATION: 483 feat_async_event_cfg(cmd); 484 break; 485 case SPDK_NVME_FEAT_KEEP_ALIVE_TIMER: 486 feat_keep_alive_timer(cmd); 487 break; 488 489 default: 490 break; 491 } 492 493 /* Use g_data[2] through g_data[5] for feature-specific 494 bits and set g_data[6] for cdw14 every iteration 495 UUID index, bits 0-6 are used */ 496 cmd->cmd.cdw14 = (g_data[6] & 0x7f); 497 498 g_data += 7; 499 } 500 501 static void 502 fuzz_nvm_read_command(struct fuzz_command *cmd) 503 { 504 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 505 cmd->cmd.opc = SPDK_NVME_OPC_READ; 506 507 cmd->cmd.cdw10 = ((uint32_t)g_data[0] << 24) + ((uint32_t)g_data[1] << 16) + 508 ((uint32_t)g_data[2] << 8) + (uint32_t)g_data[3]; 509 cmd->cmd.cdw11 = ((uint32_t)g_data[4] << 24) + ((uint32_t)g_data[5] << 16) + 510 ((uint32_t)g_data[6] << 8) + (uint32_t)g_data[7]; 511 cmd->cmd.cdw12 = ((uint32_t)g_data[8] << 24) + ((uint32_t)g_data[9] << 16) + 512 ((uint32_t)g_data[10] << 8) + (uint32_t)g_data[11]; 513 cmd->cmd.cdw13 = g_data[12]; 514 cmd->cmd.cdw14 = ((uint32_t)g_data[13] << 24) + ((uint32_t)g_data[14] << 16) + 515 ((uint32_t)g_data[15] << 8) + (uint32_t)g_data[16]; 516 cmd->cmd.cdw15 = ((uint32_t)g_data[17] << 24) + ((uint32_t)g_data[18] << 16) + 517 ((uint32_t)g_data[19] << 8) + (uint32_t)g_data[20]; 518 519 g_data += 21; 520 } 521 522 static void 523 fuzz_nvm_write_command(struct fuzz_command *cmd) 524 { 525 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 526 cmd->cmd.opc = SPDK_NVME_OPC_WRITE; 527 528 cmd->cmd.cdw10 = ((uint32_t)g_data[0] << 24) + ((uint32_t)g_data[1] << 16) + 529 ((uint32_t)g_data[2] << 8) + (uint32_t)g_data[3]; 530 cmd->cmd.cdw11 = ((uint32_t)g_data[4] << 24) + ((uint32_t)g_data[5] << 16) + 531 ((uint32_t)g_data[6] << 8) + (uint32_t)g_data[7]; 532 cmd->cmd.cdw12 = ((uint32_t)g_data[8] << 24) + ((uint32_t)g_data[9] << 16) + 533 ((uint32_t)g_data[10] << 8) + (uint32_t)g_data[11]; 534 cmd->cmd.cdw13 = ((uint32_t)g_data[12] << 24) + ((uint32_t)g_data[13] << 16) + 535 ((uint32_t)g_data[14] << 8) + (uint32_t)g_data[15]; 536 cmd->cmd.cdw14 = ((uint32_t)g_data[16] << 24) + ((uint32_t)g_data[17] << 16) + 537 ((uint32_t)g_data[18] << 8) + (uint32_t)g_data[19]; 538 cmd->cmd.cdw15 = ((uint32_t)g_data[20] << 24) + ((uint32_t)g_data[21] << 16) + 539 ((uint32_t)g_data[22] << 8) + (uint32_t)g_data[23]; 540 541 g_data += 24; 542 } 543 544 static void 545 fuzz_nvm_write_zeroes_command(struct fuzz_command *cmd) 546 { 547 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 548 cmd->cmd.opc = SPDK_NVME_OPC_WRITE_ZEROES; 549 550 cmd->cmd.cdw10 = ((uint32_t)g_data[0] << 24) + ((uint32_t)g_data[1] << 16) + 551 ((uint32_t)g_data[2] << 8) + (uint32_t)g_data[3]; 552 cmd->cmd.cdw11 = ((uint32_t)g_data[4] << 24) + ((uint32_t)g_data[5] << 16) + 553 ((uint32_t)g_data[6] << 8) + (uint32_t)g_data[7]; 554 cmd->cmd.cdw12 = ((uint32_t)g_data[8] << 24) + ((uint32_t)g_data[9] << 16) + 555 ((uint32_t)g_data[10] << 8) + (uint32_t)g_data[11]; 556 cmd->cmd.cdw14 = ((uint32_t)g_data[12] << 24) + ((uint32_t)g_data[13] << 16) + 557 ((uint32_t)g_data[14] << 8) + (uint32_t)g_data[15]; 558 cmd->cmd.cdw15 = ((uint32_t)g_data[16] << 24) + ((uint32_t)g_data[17] << 16) + 559 ((uint32_t)g_data[18] << 8) + (uint32_t)g_data[19]; 560 561 g_data += 20; 562 } 563 564 static void 565 fuzz_nvm_write_uncorrectable_command(struct fuzz_command *cmd) 566 { 567 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 568 cmd->cmd.opc = SPDK_NVME_OPC_WRITE_UNCORRECTABLE; 569 570 cmd->cmd.cdw10 = ((uint32_t)g_data[0] << 24) + ((uint32_t)g_data[1] << 16) + 571 ((uint32_t)g_data[2] << 8) + (uint32_t)g_data[3]; 572 cmd->cmd.cdw11 = ((uint32_t)g_data[4] << 24) + ((uint32_t)g_data[5] << 16) + 573 ((uint32_t)g_data[6] << 8) + (uint32_t)g_data[7]; 574 cmd->cmd.cdw12 = (g_data[8] << 8) + g_data[9]; 575 576 g_data += 10; 577 } 578 579 static void 580 fuzz_nvm_reservation_acquire_command(struct fuzz_command *cmd) 581 { 582 struct spdk_nvme_reservation_acquire_data *payload = cmd->buf; 583 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 584 cmd->cmd.opc = SPDK_NVME_OPC_RESERVATION_ACQUIRE; 585 586 cmd->cmd.cdw10_bits.resv_acquire.rtype = g_data[0]; 587 cmd->cmd.cdw10_bits.resv_acquire.iekey = (g_data[1] >> 7) & 0x01; 588 cmd->cmd.cdw10_bits.resv_acquire.racqa = (g_data[1] >> 4) & 0x07; 589 590 payload->crkey = ((uint64_t)g_data[2] << 56) + ((uint64_t)g_data[3] << 48) + 591 ((uint64_t)g_data[4] << 40) + ((uint64_t)g_data[5] << 32) + 592 ((uint64_t)g_data[6] << 24) + ((uint64_t)g_data[7] << 16) + 593 ((uint64_t)g_data[8] << 8) + (uint64_t)g_data[9]; 594 595 payload->prkey = ((uint64_t)g_data[10] << 56) + ((uint64_t)g_data[11] << 48) + 596 ((uint64_t)g_data[12] << 40) + ((uint64_t)g_data[13] << 32) + 597 ((uint64_t)g_data[14] << 24) + ((uint64_t)g_data[15] << 16) + 598 ((uint64_t)g_data[16] << 8) + (uint64_t)g_data[17]; 599 600 cmd->len = sizeof(struct spdk_nvme_reservation_acquire_data); 601 602 g_data += 18; 603 } 604 605 static void 606 fuzz_nvm_reservation_release_command(struct fuzz_command *cmd) 607 { 608 struct spdk_nvme_reservation_key_data *payload = cmd->buf; 609 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 610 cmd->cmd.opc = SPDK_NVME_OPC_RESERVATION_RELEASE; 611 612 cmd->cmd.cdw10_bits.resv_release.rtype = g_data[0]; 613 cmd->cmd.cdw10_bits.resv_release.iekey = (g_data[1] >> 7) & 0x01; 614 cmd->cmd.cdw10_bits.resv_release.rrela = (g_data[1] >> 4) & 0x07; 615 616 payload->crkey = ((uint64_t)g_data[2] << 56) + ((uint64_t)g_data[3] << 48) + 617 ((uint64_t)g_data[4] << 40) + ((uint64_t)g_data[5] << 32) + 618 ((uint64_t)g_data[6] << 24) + ((uint64_t)g_data[7] << 16) + 619 ((uint64_t)g_data[8] << 8) + (uint64_t)g_data[9]; 620 621 cmd->len = sizeof(struct spdk_nvme_reservation_key_data); 622 623 g_data += 10; 624 } 625 626 static void 627 fuzz_nvm_reservation_register_command(struct fuzz_command *cmd) 628 { 629 struct spdk_nvme_reservation_register_data *payload = cmd->buf; 630 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 631 cmd->cmd.opc = SPDK_NVME_OPC_RESERVATION_REGISTER; 632 633 cmd->cmd.cdw10_bits.resv_register.cptpl = (g_data[0] >> 6) & 0x03; 634 cmd->cmd.cdw10_bits.resv_register.iekey = (g_data[0] >> 5) & 0x01; 635 cmd->cmd.cdw10_bits.resv_register.rrega = (g_data[0] >> 2) & 0x07; 636 637 payload->crkey = ((uint64_t)g_data[1] << 56) + ((uint64_t)g_data[2] << 48) + 638 ((uint64_t)g_data[3] << 40) + ((uint64_t)g_data[4] << 32) + 639 ((uint64_t)g_data[5] << 24) + ((uint64_t)g_data[6] << 16) + 640 ((uint64_t)g_data[7] << 8) + (uint64_t)g_data[8]; 641 642 payload->nrkey = ((uint64_t)g_data[9] << 56) + ((uint64_t)g_data[10] << 48) + 643 ((uint64_t)g_data[11] << 40) + ((uint64_t)g_data[12] << 32) + 644 ((uint64_t)g_data[13] << 24) + ((uint64_t)g_data[14] << 16) + 645 ((uint64_t)g_data[15] << 8) + (uint64_t)g_data[16]; 646 647 648 cmd->len = sizeof(struct spdk_nvme_reservation_register_data); 649 650 g_data += 17; 651 } 652 653 static void 654 fuzz_nvm_reservation_report_command(struct fuzz_command *cmd) 655 { 656 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 657 cmd->cmd.opc = SPDK_NVME_OPC_RESERVATION_REPORT; 658 659 cmd->cmd.cdw10 = ((uint32_t)g_data[0] << 24) + ((uint32_t)g_data[1] << 16) + 660 ((uint32_t)g_data[2] << 8) + (uint32_t)g_data[3]; 661 662 cmd->cmd.cdw11_bits.resv_report.eds = (g_data[4] >> 7) & 0x01; 663 664 g_data += 5; 665 } 666 667 static void 668 fuzz_nvm_compare_command(struct fuzz_command *cmd) 669 { 670 memset(&cmd->cmd, 0, sizeof(cmd->cmd)); 671 cmd->cmd.opc = SPDK_NVME_OPC_COMPARE; 672 673 cmd->cmd.cdw10 = ((uint32_t)g_data[0] << 24) + ((uint32_t)g_data[1] << 16) + 674 ((uint32_t)g_data[2] << 8) + (uint32_t)g_data[3]; 675 cmd->cmd.cdw11 = ((uint32_t)g_data[4] << 24) + ((uint32_t)g_data[5] << 16) + 676 ((uint32_t)g_data[6] << 8) + (uint32_t)g_data[7]; 677 cmd->cmd.cdw12 = ((uint32_t)g_data[8] << 24) + ((uint32_t)g_data[9] << 16) + 678 ((uint32_t)g_data[10] << 8) + (uint32_t)g_data[11]; 679 cmd->cmd.cdw14 = ((uint32_t)g_data[12] << 24) + ((uint32_t)g_data[13] << 16) + 680 ((uint32_t)g_data[14] << 8) + (uint32_t)g_data[15]; 681 cmd->cmd.cdw15 = ((uint32_t)g_data[16] << 24) + ((uint32_t)g_data[17] << 16) + 682 ((uint32_t)g_data[18] << 8) + (uint32_t)g_data[19]; 683 684 g_data += 20; 685 } 686 687 static struct fuzz_type g_fuzzers[] = { 688 { .fn = fuzz_admin_command, .bytes_per_cmd = sizeof(struct spdk_nvme_cmd), .is_admin = true}, 689 { .fn = fuzz_admin_get_log_page_command, .bytes_per_cmd = 6, .is_admin = true}, 690 { .fn = fuzz_admin_identify_command, .bytes_per_cmd = 7, .is_admin = true}, 691 { .fn = fuzz_admin_abort_command, .bytes_per_cmd = 4, .is_admin = true}, 692 { .fn = fuzz_admin_create_io_completion_queue_command, .bytes_per_cmd = 7, .is_admin = true}, 693 { .fn = fuzz_admin_create_io_submission_queue_command, .bytes_per_cmd = 9, .is_admin = true}, 694 { .fn = fuzz_admin_delete_io_completion_queue_command, .bytes_per_cmd = 2, .is_admin = true}, 695 { .fn = fuzz_admin_delete_io_submission_queue_command, .bytes_per_cmd = 2, .is_admin = true}, 696 { .fn = fuzz_admin_namespace_attachment_command, .bytes_per_cmd = 1, .is_admin = true}, 697 { .fn = fuzz_admin_namespace_management_command, .bytes_per_cmd = 1, .is_admin = true}, 698 { .fn = fuzz_admin_security_receive_command, .bytes_per_cmd = 8, .is_admin = true}, 699 { .fn = fuzz_admin_security_send_command, .bytes_per_cmd = 8, .is_admin = true}, 700 { .fn = fuzz_admin_directive_send_command, .bytes_per_cmd = 8, .is_admin = true}, 701 { .fn = fuzz_admin_directive_receive_command, .bytes_per_cmd = 8, .is_admin = true}, 702 { .fn = fuzz_admin_set_features_command, .bytes_per_cmd = 7, .is_admin = true}, 703 { .fn = fuzz_admin_get_features_command, .bytes_per_cmd = 7, .is_admin = true}, 704 { .fn = fuzz_nvm_read_command, .bytes_per_cmd = 21, .is_admin = false}, 705 { .fn = fuzz_nvm_write_command, .bytes_per_cmd = 24, .is_admin = false}, 706 { .fn = fuzz_nvm_write_zeroes_command, .bytes_per_cmd = 20, .is_admin = false}, 707 { .fn = fuzz_nvm_write_uncorrectable_command, .bytes_per_cmd = 10, .is_admin = false}, 708 { .fn = fuzz_nvm_reservation_acquire_command, .bytes_per_cmd = 18, .is_admin = false}, 709 { .fn = fuzz_nvm_reservation_release_command, .bytes_per_cmd = 10, .is_admin = false}, 710 { .fn = fuzz_nvm_reservation_register_command, .bytes_per_cmd = 17, .is_admin = false}, 711 { .fn = fuzz_nvm_reservation_report_command, .bytes_per_cmd = 5, .is_admin = false}, 712 { .fn = fuzz_nvm_compare_command, .bytes_per_cmd = 20, .is_admin = false}, 713 { .fn = NULL, .bytes_per_cmd = 0, .is_admin = 0} 714 }; 715 716 #define NUM_FUZZERS (SPDK_COUNTOF(g_fuzzers) - 1) 717 718 static struct fuzz_type *g_fuzzer; 719 720 struct spdk_nvme_transport_id g_trid; 721 static struct spdk_nvme_ctrlr *g_ctrlr; 722 static struct spdk_nvme_qpair *g_io_qpair; 723 static void 724 nvme_fuzz_cpl_cb(void *cb_arg, const struct spdk_nvme_cpl *cpl) 725 { 726 int *outstanding = cb_arg; 727 728 assert(*outstanding > 0); 729 (*outstanding)--; 730 } 731 732 static int 733 run_cmds(uint32_t queue_depth) 734 { 735 int rc, outstanding = 0; 736 uint32_t i; 737 738 for (i = 0; i < queue_depth; i++) { 739 struct fuzz_command *cmd = &g_cmds[i]; 740 741 g_fuzzer->fn(cmd); 742 outstanding++; 743 if (g_fuzzer->is_admin) { 744 rc = spdk_nvme_ctrlr_cmd_admin_raw(g_ctrlr, &cmd->cmd, cmd->buf, cmd->len, nvme_fuzz_cpl_cb, 745 &outstanding); 746 } else { 747 rc = spdk_nvme_ctrlr_cmd_io_raw(g_ctrlr, g_io_qpair, &cmd->cmd, cmd->buf, cmd->len, 748 nvme_fuzz_cpl_cb, &outstanding); 749 } 750 if (rc) { 751 return rc; 752 } 753 } 754 755 while (outstanding > 0) { 756 spdk_nvme_qpair_process_completions(g_io_qpair, 0); 757 spdk_nvme_ctrlr_process_admin_completions(g_ctrlr); 758 } 759 return 0; 760 } 761 762 static int TestOneInput(const uint8_t *data, size_t size) 763 { 764 struct spdk_nvme_detach_ctx *detach_ctx = NULL; 765 766 g_ctrlr = spdk_nvme_connect(&g_trid, NULL, 0); 767 if (g_ctrlr == NULL) { 768 fprintf(stderr, "spdk_nvme_connect() failed for transport address '%s'\n", 769 g_trid.traddr); 770 spdk_app_stop(-1); 771 } 772 773 g_io_qpair = spdk_nvme_ctrlr_alloc_io_qpair(g_ctrlr, NULL, 0); 774 if (g_io_qpair == NULL) { 775 fprintf(stderr, "spdk_nvme_ctrlr_alloc_io_qpair failed\n"); 776 spdk_app_stop(-1); 777 } 778 779 g_data = data; 780 781 run_cmds(size / g_fuzzer->bytes_per_cmd); 782 spdk_nvme_ctrlr_free_io_qpair(g_io_qpair); 783 spdk_nvme_detach_async(g_ctrlr, &detach_ctx); 784 785 if (detach_ctx) { 786 spdk_nvme_detach_poll(detach_ctx); 787 } 788 789 return 0; 790 } 791 792 int LLVMFuzzerRunDriver(int *argc, char ***argv, int (*UserCb)(const uint8_t *Data, size_t Size)); 793 794 static void exit_handler(void) 795 { 796 if (g_in_fuzzer) { 797 spdk_app_stop(0); 798 pthread_join(g_reactor_td, NULL); 799 } 800 } 801 802 static void * 803 start_fuzzer(void *ctx) 804 { 805 char *_argv[] = { 806 "spdk", 807 "-len_control=0", 808 "-detect_leaks=1", 809 NULL, 810 NULL, 811 NULL 812 }; 813 char time_str[128]; 814 char len_str[128]; 815 char **argv = _argv; 816 int argc = SPDK_COUNTOF(_argv); 817 uint32_t len; 818 819 spdk_unaffinitize_thread(); 820 len = MAX_COMMANDS * g_fuzzer->bytes_per_cmd; 821 snprintf(len_str, sizeof(len_str), "-max_len=%d", len); 822 argv[argc - 3] = len_str; 823 snprintf(time_str, sizeof(time_str), "-max_total_time=%d", g_time_in_sec); 824 argv[argc - 2] = time_str; 825 argv[argc - 1] = g_corpus_dir; 826 827 g_in_fuzzer = true; 828 atexit(exit_handler); 829 if (g_repro_data) { 830 printf("Running single test based on reproduction data file.\n"); 831 TestOneInput(g_repro_data, g_repro_size); 832 printf("Done.\n"); 833 } else { 834 LLVMFuzzerRunDriver(&argc, &argv, TestOneInput); 835 /* TODO: in the normal case, LLVMFuzzerRunDriver never returns - it calls exit() 836 * directly and we never get here. But this behavior isn't really documented 837 * anywhere by LLVM, so call spdk_app_stop(0) if it does return, which will 838 * result in the app exiting like a normal SPDK application (spdk_app_start() 839 * returns to main(). 840 */ 841 } 842 g_in_fuzzer = false; 843 spdk_app_stop(0); 844 845 return NULL; 846 } 847 848 static void 849 begin_fuzz(void *ctx) 850 { 851 int i; 852 853 g_reactor_td = pthread_self(); 854 855 for (i = 0; i < MAX_COMMANDS; i++) { 856 g_cmds[i].buf = spdk_malloc(4096, 0, NULL, SPDK_ENV_LCORE_ID_ANY, SPDK_MALLOC_DMA); 857 assert(g_cmds[i].buf); 858 g_cmds[i].len = 4096; 859 } 860 861 pthread_create(&g_fuzz_td, NULL, start_fuzzer, NULL); 862 } 863 864 static void 865 nvme_fuzz_usage(void) 866 { 867 fprintf(stderr, " -D Path of corpus directory.\n"); 868 fprintf(stderr, " -F Transport ID for subsystem that should be fuzzed.\n"); 869 fprintf(stderr, " -N Name of reproduction data file.\n"); 870 fprintf(stderr, " -t Time to run fuzz tests (in seconds). Default: 10\n"); 871 fprintf(stderr, " -Z Fuzzer to run (0 to %lu)\n", NUM_FUZZERS - 1); 872 } 873 874 static int 875 nvme_fuzz_parse(int ch, char *arg) 876 { 877 long long tmp; 878 int rc; 879 FILE *repro_file; 880 881 switch (ch) { 882 case 'D': 883 g_corpus_dir = strdup(optarg); 884 break; 885 case 'F': 886 if (g_trid_specified) { 887 fprintf(stderr, "Can only specify one trid\n"); 888 return -1; 889 } 890 g_trid_specified = true; 891 rc = spdk_nvme_transport_id_parse(&g_trid, optarg); 892 if (rc < 0) { 893 fprintf(stderr, "failed to parse transport ID: %s\n", optarg); 894 return -1; 895 } 896 break; 897 case 'N': 898 repro_file = fopen(optarg, "r"); 899 if (repro_file == NULL) { 900 fprintf(stderr, "could not open %s: %s\n", optarg, spdk_strerror(errno)); 901 return -1; 902 } 903 g_repro_data = spdk_posix_file_load(repro_file, &g_repro_size); 904 if (g_repro_data == NULL) { 905 fprintf(stderr, "could not load data for file %s\n", optarg); 906 return -1; 907 } 908 break; 909 case 't': 910 case 'Z': 911 tmp = spdk_strtoll(optarg, 10); 912 if (tmp < 0 || tmp >= INT_MAX) { 913 fprintf(stderr, "Invalid value '%s' for option -%c.\n", optarg, ch); 914 return -EINVAL; 915 } 916 switch (ch) { 917 case 't': 918 g_time_in_sec = tmp; 919 break; 920 case 'Z': 921 if ((unsigned long)tmp >= NUM_FUZZERS) { 922 fprintf(stderr, "Invalid fuzz type %lld (max %lu)\n", tmp, NUM_FUZZERS - 1); 923 return -EINVAL; 924 } 925 g_fuzzer = &g_fuzzers[tmp]; 926 break; 927 } 928 break; 929 case '?': 930 default: 931 return -EINVAL; 932 } 933 return 0; 934 } 935 936 static void 937 fuzz_shutdown(void) 938 { 939 /* If the user terminates the fuzzer prematurely, it is likely due 940 * to an input hang. So raise a SIGSEGV signal which will cause the 941 * fuzzer to generate a crash file for the last input. 942 * 943 * Note that the fuzzer will always generate a crash file, even if 944 * we get our TestOneInput() function (which is called by the fuzzer) 945 * to pthread_exit(). So just doing the SIGSEGV here in all cases is 946 * simpler than trying to differentiate between hung inputs and 947 * an impatient user. 948 */ 949 pthread_kill(g_fuzz_td, SIGSEGV); 950 } 951 952 int 953 main(int argc, char **argv) 954 { 955 struct spdk_app_opts opts = {}; 956 int rc; 957 958 spdk_app_opts_init(&opts, sizeof(opts)); 959 opts.name = "nvme_fuzz"; 960 opts.shutdown_cb = fuzz_shutdown; 961 962 if ((rc = spdk_app_parse_args(argc, argv, &opts, "D:F:N:t:Z:", NULL, nvme_fuzz_parse, 963 nvme_fuzz_usage) != SPDK_APP_PARSE_ARGS_SUCCESS)) { 964 return rc; 965 } 966 967 if (!g_corpus_dir) { 968 fprintf(stderr, "Must specify corpus dir with -D option\n"); 969 return -1; 970 } 971 972 if (!g_trid_specified) { 973 fprintf(stderr, "Must specify trid with -F option\n"); 974 return -1; 975 } 976 977 if (!g_fuzzer) { 978 fprintf(stderr, "Must specify fuzzer with -Z option\n"); 979 return -1; 980 } 981 982 rc = spdk_app_start(&opts, begin_fuzz, NULL); 983 984 spdk_app_fini(); 985 return rc; 986 } 987