Fix epoch CPU admission for hot-add#5411
Open
Alan-Jowett wants to merge 18 commits into
Open
Conversation
Alan-Jowett
requested review from
LakshK98,
dthaler,
matthewige,
mikeagun,
mtfriesen,
poornagmsft and
saxena-anurag
as code owners
July 2, 2026 17:39
Alan-Jowett
force-pushed
the
alanjo/hot-add
branch
from
July 2, 2026 18:10
f425b96 to
2e5f8bd
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the runtime epoch-based memory reclamation subsystem to tolerate systems where the kernel-reported maximum logical CPU count exceeds the active CPU count at startup, and to support CPU hot-add by admitting CPUs into the epoch participant set in phases.
Changes:
- Reworks
ebpf_epochCPU tracking to allocate per-CPU backing state for the maximum CPU count while only admitting active CPUs into the consensus/participant ring (with hot-add admission via processor-change callbacks). - Adds unit tests to cover startup active-CPU subsets, hot-add admission behavior, and an unadmitted-CPU fail-fast path (child-process based).
- Adjusts libfuzzer harness/core lifecycle management and updates CI test filters and epoch documentation accordingly.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/libfuzzer/include/fuzz_helper_function.hpp | Makes ebpf core init/term optional per helper instance and hardens cleanup paths. |
| tests/libfuzzer/core_helper_fuzzer/libfuzz_harness.cpp | Centralizes ebpf core lifetime in the fuzz harness and disables per-helper core lifecycle management. |
| libs/runtime/unit/platform_unit_test.cpp | Adds unit tests for startup active subset, hot-add admission, and fail-fast on unadmitted CPU (child process). |
| libs/runtime/ebpf_epoch.c | Implements admitted-CPU ring + processor change callback path for initializing/admitting CPUs and routing epoch consensus only across admitted CPUs. |
| docs/EpochBasedMemoryManagement.md | Documents the maximum-vs-admitted CPU model and hot-add admission behavior. |
| .github/workflows/cicd.yml | Excludes the new fail-fast epoch tests from multiple CI jobs. |
| .azure/OneBranch.PullRequest.yml | Excludes the new fail-fast epoch tests from multiple Azure pipeline jobs. |
Alan-Jowett
force-pushed
the
alanjo/hot-add
branch
from
July 6, 2026 17:58
170cfa3 to
e19ef57
Compare
4 tasks
Alan-Jowett
force-pushed
the
alanjo/hot-add
branch
from
July 7, 2026 16:31
af0edd1 to
d5fad76
Compare
Alan-Jowett
enabled auto-merge
July 7, 2026 16:31
Alan-Jowett
force-pushed
the
alanjo/hot-add
branch
from
July 7, 2026 22:09
559b324 to
65c551a
Compare
Alan-Jowett
force-pushed
the
alanjo/hot-add
branch
from
July 9, 2026 15:21
65c551a to
bfb1248
Compare
Member
Author
|
@saxena-anurag You are 100% correct. I missed that the hot-add complete occurs after the CPU can be scheduled. That totally breaks my current assumption. Revisiting this. |
Alan-Jowett
marked this pull request as draft
July 9, 2026 20:53
auto-merge was automatically disabled
July 9, 2026 20:53
Pull request was converted to draft
Alan-Jowett
force-pushed
the
alanjo/hot-add
branch
from
July 13, 2026 16:39
a75dae1 to
ea52efa
Compare
Alan-Jowett
marked this pull request as ready for review
July 14, 2026 15:42
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Add formal modeling infrastructure with TLA+ and TLAPS: - TLA+ models: epoch, ring buffer, hash table - TLAPS proofs for key safety properties - CI job for TLC model checking - Docker-based TLAPS proof verification - TLATeX documentation generation
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d729ac7e-d3b0-4e13-97ba-f8aa6a2d02d9 Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d729ac7e-d3b0-4e13-97ba-f8aa6a2d02d9 Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 572a5c43-fdfe-45bd-9ac4-1e60e8530860 Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 572a5c43-fdfe-45bd-9ac4-1e60e8530860 Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 572a5c43-fdfe-45bd-9ac4-1e60e8530860 Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 572a5c43-fdfe-45bd-9ac4-1e60e8530860 Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 572a5c43-fdfe-45bd-9ac4-1e60e8530860 Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Ensure the hot-add epoch tests always unblock and join the async synchronize thread before unwinding so assertion failures do not turn into hung CI jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 572a5c43-fdfe-45bd-9ac4-1e60e8530860 Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Apply the repo formatter output for the new hot-add test synchronize helper. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 572a5c43-fdfe-45bd-9ac4-1e60e8530860 Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Alan-Jowett
force-pushed
the
alanjo/hot-add
branch
from
July 14, 2026 19:48
2a11c59 to
22e2441
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #3768.
This updates epoch CPU tracking to support systems where the maximum logical processor count exceeds the active processor count at startup.
Testing
Not run per request.
If new tests were added:
Documentation
Updated
docs/EpochBasedMemoryManagement.md.Installation
No installer impact.