ci: fix TSan aborting at init on the nested-LXC runner

The ThreadSanitizer job runs on Docker nested in an unprivileged LXC container, whose kernel randomizes mmap addresses beyond the range TSan's fixed shadow mapping expects. TSan aborted at init with "unexpected memory mapping" before any test ran. Disable ASLR per-process with `setarch -R`, which needs the personality(2) syscall that Docker's default seccomp profile blocks; seccomp=unconfined on the container permits it. Verified on the runner that both are required: setarch -R alone gets EPERM, seccomp alone still aborts, both together run clean. Scoped to the tsan job, which runs only our own test binaries. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fix: deliver EOF sentinel only when the ring is freshly empty
2026-07-17 20:01:57 +02:00 · 2026-07-14 23:14:45 +02:00 · 2026-07-14 23:14:45 +02:00 · 2026-07-14 23:14:45 +02:00
2 changed files with 22 additions and 4 deletions
@@ -18,6 +18,15 @@ jobs:
    runs-on: linux/amd64
    container:
      image: gitea.tourolle.paris/dtourolle/kpnpp-builder:latest
      # This runner is Docker nested in an unprivileged LXC container, whose
      # kernel randomizes mmap addresses beyond the range TSan's fixed shadow
      # mapping expects, so TSan aborts at init with "unexpected memory
      # mapping". The fix is to disable ASLR per-process with `setarch -R`
      # (below), which needs the personality(2) syscall that Docker's default
      # seccomp profile blocks. seccomp=unconfined permits it. Verified on the
      # runner: setarch -R alone gets EPERM, seccomp alone still aborts, both
      # together run clean. Scoped to this job, which runs only our own tests.
      options: --security-opt seccomp=unconfined
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
@@ -54,13 +63,14 @@ jobs:
        # the full picture for lock-order issues.
        env:
          TSAN_OPTIONS: "halt_on_error=1 second_deadlock_stack=1"
-        run: ./build/tests/kpn_tests_stress
+        # setarch -R disables ASLR for this process; see the container comment.
        run: setarch -R ./build/tests/kpn_tests_stress
      - name: Run unit tests under TSan
        working-directory: tsan-${{ github.run_id }}
        env:
          TSAN_OPTIONS: "halt_on_error=1 second_deadlock_stack=1"
-        run: ./build/tests/kpn_tests
+        run: setarch -R ./build/tests/kpn_tests
      - name: Cleanup
        if: always()
@@ -63,7 +63,15 @@ endif()
 include(CTest)
 include(Catch)
-catch_discover_tests(kpn_tests)
+
 # DISCOVERY_MODE PRE_TEST defers test enumeration to `ctest` run time. The
 # default (POST_BUILD) runs each test binary during the build to list its
 # cases — which fails a sanitizer build: a TSan/ASan binary needs a fixed
 # address-space layout and aborts on startup ("unexpected memory mapping")
 # under the container's ASLR, breaking the build before any test runs. The
 # tsan.yaml job invokes the binaries directly (not via ctest), so deferring
 # discovery costs nothing there and keeps `ctest` working for normal builds.
 catch_discover_tests(kpn_tests DISCOVERY_MODE PRE_TEST)
 # Register the stress suite under its own label so CI can run / time it
 # separately from the fast unit tests.
-catch_discover_tests(kpn_tests_stress PROPERTIES LABELS "stress")
+catch_discover_tests(kpn_tests_stress DISCOVERY_MODE PRE_TEST PROPERTIES LABELS "stress")
Author	SHA1	Message	Date
dtourolleandClaude Opus 4.8	ec19137ed9	ci: fix TSan aborting at init on the nested-LXC runner 🚦 CI / changes (pull_request) Successful in 6s Details 🚦 CI / docker (pull_request) Has been skipped Details 🚦 CI / test (pull_request) Successful in 4m32s Details 🚦 CI / tsan (pull_request) Successful in 2m54s Details 🚦 CI / docs (pull_request) Has been skipped Details The ThreadSanitizer job runs on Docker nested in an unprivileged LXC container, whose kernel randomizes mmap addresses beyond the range TSan's fixed shadow mapping expects. TSan aborted at init with "unexpected memory mapping" before any test ran. Disable ASLR per-process with `setarch -R`, which needs the personality(2) syscall that Docker's default seccomp profile blocks; seccomp=unconfined on the container permits it. Verified on the runner that both are required: setarch -R alone gets EPERM, seccomp alone still aborts, both together run clean. Scoped to the tsan job, which runs only our own test binaries. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-17 20:01:57 +02:00
dtourolleandClaude Opus 4.8	a0c4bf580e	fix: deliver EOF sentinel only when the ring is freshly empty 🚦 CI / changes (pull_request) Successful in 4s Details 🚦 CI / docker (pull_request) Has been skipped Details 🚦 CI / test (pull_request) Successful in 7m30s Details 🚦 CI / tsan (pull_request) Failing after 2m21s Details 🚦 CI / docs (pull_request) Has been skipped Details Channel<T>::pop() surfaced the out-of-band sentinel from its empty branch using the tail_ snapshot taken at the top of the loop. Under contention the producer can push more values and the sentinel in the window between that snapshot and take_sentinel(), so pop() could return the sentinel while real values still sat in the ring — the sentinel jumping ahead of values pushed before it. No value was lost (a consumer that keeps draining still receives them, and approx_size() keeps counting them so a PoolNode reschedules), but a consumer treating the sentinel as a hard "last message" barrier would act on EOF early. Re-confirm emptiness against a fresh tail_ load before taking the sentinel. Costs one acquire-load on the empty-ring path only; never runs in steady state. The spin and post-spin takes already reload tail_ on the line above them; try_pop_now() already reads tail_ fresh in the same branch — both were correct and are unchanged. The two sentinel stress cases now assert the strict "sentinel is last, after every value" ordering (previously relaxed to avoid the flake this fixes). Verified TSan-clean (2606 assertions, no data races) over repeated runs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-14 23:14:45 +02:00
dtourolleandClaude Opus 4.8	3ac2242df1	docs: rewrite SPEC.md to match the implemented library The spec had drifted far from the code. Key corrections: - Execution model is reactive (PoolNode submits fire_once() to a ThreadPool when inputs are ready), not one blocking thread per node - Channel<T> is a lock-free SPSC ring buffer (atomic wait/notify + spin-before-sleep), not a mutex+CV queue - Remove latch<> ports (never implemented) - NodeErrorHandler returns bool (skip vs stop); per-node - Document new subsystems: scheduler, InterruptNode, Router/FilterNode, MainThreadNode, SharedResource, DebugHub, diagnostics/stats layer - Update StaticNetwork, Python auto_bind layer, examples 01-16 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-14 23:14:45 +02:00
dtourolleandClaude Opus 4.8	399ee4cf9b	test: add ThreadSanitizer verification for lock-free Channel<T> Add a contended SPSC stress suite (tests/test_channel_stress.cpp) that actually exercises the ring's memory-ordering pairing and spin/futex/ lost-wakeup logic, plus the CMake and CI plumbing to run it under TSan: - KPN_SANITIZER cache var + kpn_sanitizer_flags() helper (no-op when unset) - kpn_tests_stress executable, labelled "stress" for CTest - reusable tsan.yaml workflow (gcc:14 builder image, already ships libtsan) - ci.yaml gains a tsan job on the same code/dockerfile triggers as test Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-14 23:14:45 +02:00