ocp: Fix OCP telemetry timestamp field decode

.gitattributes

@@ -0,0 +1 @@
+tests/fuzz/corpus/** binary

.github/workflows/checkpatch.yml

@@ -7,18 +7,50 @@
 # Authors: Daniel Wagner <dwagner@suse.de>
 
 name: Checkpatch Review
-on: [pull_request]
+on:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 02 * * *'
+
+# A pull request reads only the caches of its own branch and of the
+# default branch. So only a run on the default branch saves the copy of
+# checkpatch.pl. A scheduled run always runs there.
 jobs:
+  refresh:
+    name: refresh checkpatch.pl
+    if: ${{ github.event_name != 'pull_request' &&
+            github.ref_name == github.event.repository.default_branch }}
+    runs-on: ubuntu-latest
+    steps:
+    - name: Fetch checkpatch.pl
+      run: |
+        curl -sSf \
+          https://raw.githubusercontent.com/torvalds/linux/master/scripts/checkpatch.pl \
+          -o checkpatch.pl
+    - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: checkpatch.pl
+        key: checkpatch-${{ github.run_id }}
+
   checkpatch:
     name: checkpatch review
+    if: ${{ github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 0
-    - name: Fetch checkpatch.pl
+    # The newest saved copy. No key is an exact match.
+    - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: checkpatch.pl
+        key: checkpatch-
+        restore-keys: checkpatch-
+    - name: Fetch checkpatch.pl if no copy was saved
       run: |
+        [ -f checkpatch.pl ] && exit 0
         curl -sSf \
           https://raw.githubusercontent.com/torvalds/linux/master/scripts/checkpatch.pl \
           -o checkpatch.pl

.github/workflows/release.yml

@@ -10,14 +10,17 @@ name: Release
 
 on:
   push:
-    branches: [master]
     tags:
-      - '**'
+      - 'v*'
+  pull_request:
+    paths:
+      - .github/workflows/release.yml
+      - scripts/build.sh
 
 jobs:
-  build:
+  create-release:
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/v') && github.repository == 'linux-nvme/nvme-cli'
+    if: github.event_name == 'push' && github.repository == 'linux-nvme/nvme-cli'
     permissions:
       contents: write
     steps:
@@ -35,3 +38,73 @@ jobs:
           gh release create "${GITHUB_REF_NAME}" "${args[@]}"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build-linux-static:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/linux-nvme/debian:latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+      - name: Mark repo as safe for git
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - name: build
+        run: |
+          scripts/build.sh static
+          VERSION="$(git describe --always --abbrev=12 --dirty)"
+          mkdir upload
+          cp .build-ci/nvme "upload/nvme-cli-${VERSION}-x86_64"
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: linux-static
+          path: upload/*
+
+  build-windows-static:
+    runs-on: windows-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+      - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2.33.0
+        with:
+          msystem: UCRT64
+          update: true
+          install: >-
+            git
+            mingw-w64-ucrt-x86_64-gcc
+            mingw-w64-ucrt-x86_64-pkgconf
+            mingw-w64-ucrt-x86_64-meson
+            mingw-w64-ucrt-x86_64-ninja
+            mingw-w64-ucrt-x86_64-json-c
+      - name: build
+        shell: msys2 {0}
+        run: |
+          set -euxo pipefail
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          scripts/build.sh -c /ucrt64/bin/gcc static_windows
+          VERSION="$(git describe --always --abbrev=12 --dirty)"
+          mkdir upload
+          cp .build-ci/nvme.exe "upload/nvme-cli-${VERSION}-x86_64.exe"
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: windows-static
+          path: upload/*
+
+  upload-release-assets:
+    runs-on: ubuntu-latest
+    needs: [create-release, build-linux-static, build-windows-static]
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        with:
+          path: upload
+          merge-multiple: true
+      - name: Upload binaries
+        run: |
+          gh release upload "${GITHUB_REF_NAME}" upload/* --clobber
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}

.github/workflows/run-nightly-tests.yml

@@ -192,18 +192,22 @@ jobs:
 
             sudo dnf install -y gcc meson git kmod iproute systemd \
             systemd-devel json-c-devel openssl-devel keyutils-libs-devel \
-            dbus-devel gcovr avahi avahi-tools ktls-utils
+            dbus-devel gcovr avahi avahi-tools ktls-utils python3
+
+            # The KMS for the KMIP phases of the nvme-keysd wringer.
+            python3 -m venv "$HOME/pykmip"
+            "$HOME/pykmip/bin/pip" install pykmip
 
             git clone https://github.com/${{ github.repository }} nvme-cli
             cd nvme-cli
             git checkout ${{ github.sha }}
 
             # Enable explicitly so a missing or too old libsystemd fails
-            # the build instead of silently skipping a daemon or the mDNS
-            # support of nvme-discoverd.
+            # the build instead of silently skipping a daemon, the mDNS
+            # support of nvme-discoverd, or the KMIP support of nvme-keysd.
             meson setup .build-ci --buildtype=release \
                 -Dnvme-discoverd=enabled -Dmdns=enabled \
-                -Dnvme-keysd=enabled -Db_coverage=true
+                -Dnvme-keysd=enabled -Dkmip=enabled -Db_coverage=true
             meson compile -C .build-ci
 
             # Test link for the mDNS phases. The mDNS traffic stays on
@@ -226,6 +230,7 @@ jobs:
                 tee daemon-results/discoverd-wringer.log
             discoverd_status=$?
             sudo env BUILD_DIR="$PWD/.build-ci" \
+                PYKMIP_PYTHON="$HOME/pykmip/bin/python" \
                 keysd/tests/wringer.sh -y 2>&1 |
                 tee daemon-results/keysd-wringer.log
             keysd_status=$?

.github/workflows/upload.yml

@@ -13,17 +13,13 @@ on:
     branches: [master]
     tags:
       - 'v*'
-  release:
-    types: [published]
 
 jobs:
   build-static:
     name: build static binary
     runs-on: ubuntu-latest
     container:
       image: ghcr.io/linux-nvme/debian:latest
-    outputs:
-      VERSION: ${{ steps.build.outputs.VERSION }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -33,13 +29,8 @@ jobs:
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       - name: build
-        id: build
         run: |
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          VERSION="$(git describe --always --abbrev=12 --dirty)"
-          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
-          echo $VERSION
-
           scripts/build.sh static
           mkdir upload
           cp .build-ci/nvme upload/nvme-cli-latest-x86_64
@@ -59,7 +50,7 @@ jobs:
     name: upload test binary
     runs-on: ubuntu-latest
     needs: build-static
-    if: ${{ (github.event_name == 'push' || github.event_name == 'release') && github.repository == 'linux-nvme/nvme-cli' }}
+    if: ${{ github.event_name == 'push' && github.repository == 'linux-nvme/nvme-cli' }}
     steps:
       - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
@@ -86,23 +77,3 @@ jobs:
             echo "put $f $(basename "$f")" >> "$SFTP_BATCH"
           done
           sftp -b "$SFTP_BATCH" "${SFTP_USERNAME}@${SFTP_SERVER}"
-
-  upload-release-assets:
-    name: upload GitHub release assets
-    runs-on: ubuntu-latest
-    needs: build-static
-    env:
-      VERSION: ${{ needs.build-static.outputs.VERSION }}
-    if: ${{ github.event_name == 'release' && github.repository == 'linux-nvme/nvme-cli' }}
-    steps:
-      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
-        with:
-          name: nvme-cli
-          path: upload
-      - name: upload versioned binary
-        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
-        with:
-          upload_url: ${{ github.event.release.upload_url }}
-          asset_path: upload/nvme-cli-${{ env.VERSION }}-x86_64
-          asset_name: nvme-cli-${{ env.VERSION }}-x86_64
-          asset_content_type: application/octet-stream

Documentation/TESTING.md

@@ -132,6 +132,38 @@ Example: Cross-build for `s390x`:
 
 The exact supported targets depend on the toolchains installed in the container.
 
+## Test names
+
+Every test is named `<component> - <test>` and is in exactly one
+group. `meson test` prints it as `<group> - nvme-cli:<component> - <test>`:
+
+- `<component>` is what the test covers: `nvme-cli`, `libnvme`,
+  `shared`, a daemon (`nvme-discoverd`, `nvme-keysd`, ...) or a plugin
+  (`micron`, `ocp`, ...).
+- `<test>` is in kebab-case and names the feature, usually the command
+  it covers. It does not repeat the component and has no `-test` or
+  `-cli` suffix. Fuzz and e2e tests start with `fuzz-` and `e2e-`.
+- A group of tests over a set of inputs uses a `/`, e.g.
+  `libnvme - header/tree` or `libnvme - nbft/rhpoc`.
+
+The group is the meson suite and says how the test runs:
+
+| Group   | What runs                                                     |
+|---------|---------------------------------------------------------------|
+| `unit`  | a test program for library or internal code                   |
+| `mock`  | the nvme binary or a daemon, with a mock where it needs a device |
+| `e2e`   | the nvme binary against a real device (`-De2e-tests=true`)    |
+| `fuzz`  | a fuzz target over its corpus (see [Fuzzing](#fuzzing))       |
+| `check` | a consistency check of the tree: headers, symbols, docs, tags |
+
+Select tests by group or by a name pattern:
+
+```shell
+meson test -C .build --suite unit --suite mock
+meson test -C .build 'micron - *'
+meson test -C .build 'nvme-cli - print'
+```
+
 ## Memory Testing
 
 ### Valgrind
@@ -193,5 +225,94 @@ meson test -C .build-asanubsan --setup asanubsan
 No wrapper binary is needed — sanitizer reports are emitted directly to stderr
 when a violation is detected.
 
+With clang, set the C++ compiler too, and let shared libraries have the
+symbols of the sanitizer runtime undefined: clang links the runtime only into
+executables.
+
+```bash
+CC=clang CXX=clang++ meson setup .build-asanubsan \
+    -Db_sanitize=address,undefined -Db_lundef=false
+```
+
 The same known limitations apply as for Valgrind: Python tests and shell script
 tests may produce false positives. Focus triage on the `nvme-cli - *` unit tests.
+
+## Fuzzing
+
+The parsers of untrusted input have fuzz targets in `tests/fuzz`: the
+command line parser (`argconfig`), the INI parser (`ini`), `nvme-cli.conf`
+(`global-config`) and `nvme-fabrics.conf` (`fabrics-conf`).
+
+The `device` target fuzzes what nvme-cli does with the data a device
+returns. It runs one of the commands which read and print something, from
+the table in `tests/fuzz/fuzz-device.c`, against the device mock of
+`tests/cli/libmock_nvme.c`, which answers every command from the input.
+It needs a dynamically linked Linux build. Its seeds named `regress-*` are
+inputs which found a bug.
+
+Every build runs them as tests of the `fuzz` suite: each target replays its
+seeds in `tests/fuzz/corpus/<target>` and then a few seconds of random
+mutations of them. The mutations come from a fixed seed, so a failure can be
+repeated, and the input which crashed a target is written to
+`fuzz-crash-<target>` in the build directory.
+
+```bash
+meson test -C .build --suite fuzz
+FUZZ_SECONDS=60 FUZZ_SEED=7 meson test -C .build --suite fuzz
+```
+
+Run in a sanitizer build (see above) they also catch memory errors which
+don't crash.
+
+For longer, coverage guided runs, build the targets for libFuzzer with clang,
+in a sanitizer build as described above:
+
+```bash
+CC=clang CXX=clang++ meson setup .build-fuzz -Dfuzzing=true \
+    -Db_sanitize=address,undefined -Db_lundef=false
+meson compile -C .build-fuzz
+```
+
+Run a target on a copy of its seeds in the build directory, so the seeds in
+the tree stay as they are. The new inputs libFuzzer finds go to the copy:
+
+```bash
+mkdir -p .build-fuzz/corpus/argconfig
+cp tests/fuzz/corpus/argconfig/* .build-fuzz/corpus/argconfig/
+.build-fuzz/tests/fuzz/fuzz-argconfig -close_fd_mask=3 \
+    -dict=tests/fuzz/argconfig.dict .build-fuzz/corpus/argconfig
+```
+
+The config targets (`ini`, `global-config`, `fabrics-conf`) use
+`tests/fuzz/config.dict`. The `device` target reads log pages, so give it
+longer inputs. A device reports sizes of up to gigabytes, which nvme-cli
+allocates: let ASan fail such an allocation instead of libFuzzer aborting the
+run as out of memory:
+
+```bash
+mkdir -p .build-fuzz/corpus/device
+cp tests/fuzz/corpus/device/* .build-fuzz/corpus/device/
+ASAN_OPTIONS=allocator_may_return_null=1:max_allocation_size_mb=1024 \
+    .build-fuzz/tests/fuzz/fuzz-device -close_fd_mask=3 -max_len=16384 \
+    -timeout=10 .build-fuzz/corpus/device
+```
+
+`scripts/build.sh fuzz` does all of this for every target in turn, each with
+one libFuzzer job per CPU on a shared corpus, for 600 seconds by default:
+
+```bash
+scripts/build.sh --fuzz-seconds 3600 fuzz
+scripts/build.sh --fuzz-targets device --fuzz-jobs 8 fuzz
+```
+
+It writes the results to `.build-ci/fuzz`: `summary.txt`, and per target the
+logs of the jobs in `logs/<target>/`, the inputs which found a bug in
+`artifacts/<target>/` and the corpus in `corpus/<target>/`. A finding stops
+only its job, a UBSan finding like a crash. The next run of `build.sh` removes
+the results; pass a `--fuzz-dir` outside of `.build-ci` to keep them, and to
+grow the corpus across runs. `scripts/build.sh -h` lists all options.
+
+When run by hand, a crashing input is written to `crash-*` in the current
+directory. Add an input which found a bug to the seeds of its target. The
+targets use the libFuzzer interface, so AFL++ can run them too
+(`afl-clang-fast` with `-fsanitize=fuzzer`).