ci: run the GPU pipeline gate on both arches, measure coverage over ./..., and fix the ten defects that exposed

[dpsoft]

Two CI gaps — a gate no job had ever run, and a coverage number that was only ever about five packages. Turning them on found ten defects, nine of them in tests and build guards that could not fail.

The two CI changes

gpuprobe was in no CI job, on either architecture. TestStubDrivesThePipelineToPprofWithoutAGPU drives the whole GPU path without a GPU — probe fire, uprobe attach, BPF decode, join, pprof samples — with a synthetic producer standing in for CUDA. It needs CAP_BPF/CAP_PERFMON/CAP_CHECKPOINT_RESTORE and skips without them, so it would have stayed invisible even once listed: a skip reads the same as a pass. The step runs it under sudo and then asserts it did not skip, with a rename guard too (stricter than #178's, which a vanished test would have satisfied).

Coverage over five hand-listed packages was a number about five packages. ./cpu/… ./profile/… ./offcpu/… ./pyunwind/… ./unwind/dwarfagent/… → ./.... 28 packages with tests sat outside the measured set. #178's privileged pass deliberately stays narrow on the five — it exists to execute the BPF-gated tests, not to measure coverage.

One real product bug: #185

The gate found that every arm64 DWARF walk was abandoned, reached-root=0 against 58/58 on amd64. ehcompile.CFIEntry.CFAOffset was an int16, and perfagent_stub_run's aarch64 frame is 112 + 65536 + 6384 = 72032 bytes, so DW_CFA_def_cfa_offset 72032 wrapped to 6496. The walker computed the CFA 65536 bytes low, read a zero return address, and pushed 0x0 as a frame.

x86-64 was immune because gcc there emits DW_CFA_def_cfa_register %rbp, pinning the offset at 16 however large the frame; AAPCS64 keeps the CFA SP-rooted as the frame grows. The bug needs a function with both a >32KB frame and an SP-rooted CFA — and the gate's own producer is exactly that, because it allocates its record batches on the stack. This int16 has been truncating in every arm64 profile of a big-frame function; the gate is the first thing that ever ran there.

Verified on the runner, not inferred from green:

                   before              after
walk shape    abandoned=58         abandoned=0
              reached-root=0       reached-root=58
depth         map[3:58]            map[8:58]
caller named  0/58                 58/58

58/58 naming perfagent_fpless_caller is the load-bearing number — that frame is only reachable by unwinding a frame-pointer-less frame through CFI.

Nine checks that could not fail

#	Where	Defect
1	gpuprobe cubin seals	the "tmpfs file" case used t.TempDir(), which is ext4 on a runner → F_GET_SEALS returns EINVAL and the subtest silently became a copy of the pipe case beside it
2	internal/usdt	"the ABI pins its argument registers" checked as 8@%rdi…; AAPCS64 pins them as x0/x1/x2
3,4	gpuprobe CFI ×2	"has a live frame pointer" checked as CFATypeFP — not even an arch property: gcc/aarch64 is SP-rooted, clang/aarch64 FP-rooted, both save the FP
5	gpuprobe PC sampling	frame order was the pre-#172 root-first ordering — it asserted the bug #172 removed
6	gpuprobe PC sampling	Positive(GroupsUnresolvedName) on a counter this producer cannot reach (r.correlation = 0 by design → groups stop at the process gate)
7	shim/Makefile check-fpless	greps for mov %rsp,%rbp; on aarch64 checks 1–2 passed vacuously and check 3 failed on a function that does have a frame pointer
8	symbolize/nvsym	required all 50 Cached lookups to miss, i.e. that a background goroutine had not finished — measured, the prefetch lands at iteration 189–733
9	main_test.go	expected pid1234-…, which requires pid 1234 to be dead; on the arm64 runner it is dockerd

Also replaced three hardcoded t.Logf prediction lines with the measured rows — they printed "main: mode=FP_SAFE / reached-root == dwarf" on the arm64 run where neither was true, and actively misled the first reading of #185.

Verification

Full ./... on amd64: 37 packages, no failures. gate=success on both arches. The only red is Upload coverage: codecov-action@v3 began failing every upload repo-wide with a TLS handshake error between 21:48Z and 00:30Z — it hits a branch whose diff is only examples/*.{md,sh,rs}, and this branch uploaded fine at 21:48 with the ./... change, so it is service-side. Needs a v4 bump plus a CODECOV_TOKEN secret, separately.

Follow-ups filed rather than folded in

• unwind: a zero return address is pushed as a frame instead of ending the walk #187 — a zero return address is still pushed as a frame; needs a new WALKER_FLAG bit and walker_flags is a full __u8, so it is a record-ABI change.
• symbolize: one libc frame per stack resolves to a bare address on arm64 but not amd64 #188 — one libc frame per stack resolves to a bare address on arm64 but not amd64 (not a regression; present before unwind: on arm64 every DWARF walk is abandoned and nothing reaches root (reached-root=0, 58/58) #185's fix).
• gpuprobe gate: the stub's correlation-less PC records leave the Tier B name gate unreachable #184 — the stub's correlation-less PC records leave the Tier B name gate unreachable.

https://claude.ai/code/session_01P5889hA6CrX8ysnQkvv6im

[dpsoft]

Pushed two fixes for what ./... turned up — both are tests that nothing had ever run.

gpuprobe, both arches. The "a tmpfs file, which is sealable but not sealed" seal case used t.TempDir(), which follows TMPDIR: tmpfs on Fedora, ext4 on a runner. On ext4 F_GET_SEALS answers EINVAL, so the subtest silently became a second copy of the pipe case next to it, and the dangerous half — an object that answers F_GET_SEALS like a sealed one while the peer can still write through it — was covered by nothing. Its own assertion caught it. Now it finds a directory statfs reports as TMPFS_MAGIC and pins the seal set in the helper; with no tmpfs it fails rather than skips. Reproduced the CI failure byte-for-byte locally by pointing TMPDIR at btrfs.

Three x86-64 expectations, arm64 only. Each described a neutral property and then checked an x86 artefact of it:

• internal/usdt checked "the ABI pins its argument registers" as 8@%rdi 8@%rsi 8@%rdx; AAPCS64 pins them just as hard, as x0/x1/x2. Now per-GOARCH, and the table must have an entry so a new arch fails loudly instead of passing vacuously.
• both gpuprobe CFI tests checked "reached with a live frame pointer" as CFATypeFP. The property is that the caller's FP is saved at a known slot — FPTypeOffsetCFA. What the CFA is rooted at is an independent compiler choice:

	CFA	saved FP
gcc x86-64	FP-rooted	CFA−16
gcc aarch64	SP-rooted	CFA−32
clang aarch64	FP-rooted	CFA−32

All three save the frame pointer, all three are walkable, and all three report FPTypeOffsetCFA. CFATypeFP pinned row one and nothing else — and it is not an architecture property at all, so it would have broken again on a clang build of the very arch it passed on. walk_step reads the saved-FP slot; the CFA base is not its business. The CFATypeSP assertions on the FP-less bridge frames are untouched: under -fomit-frame-pointer there is no FP register in use, so SP-rooted is the only option on any compiler.

Measured rather than assumed — the gcc/aarch64 row from the committed hello_arm64.golden, the clang/aarch64 row from a --target=aarch64-linux-gnu compile parsed through ehcompile, the x86-64 row from the real perfagent-gpu-fpless fixture; the two arm64 expectations are the values CI itself reported.

Full ./... on amd64: 37 packages, no failures.

https://claude.ai/code/session_01P5889hA6CrX8ysnQkvv6im