Adjust thread exec de-threading to reduce false fatal exits under load

docs/testing.md

@@ -91,6 +91,11 @@ What they do:
 - `make check`: fast elfuse-internal gate. Runs, in order:
   - `scripts/check-syscall-coverage.py` so any new `dispatch.tbl`
     entry without a direct or aliased test reference fails the build
+  - `scripts/check-lock-order.py` so a new file-scope `pthread_mutex_t`
+    or `pthread_rwlock_t` that the lock-ordering block at the top of
+    `src/syscall/internal.h` does not name fails the build. Membership
+    only: whether the lock belongs in the ordered list or the leaf list
+    stays a judgement for review
   - the unit suite from `tests/manifest.txt` -- deliberately narrow: the
     elfuse-internal implementation tests with no real Linux counterpart (the
     EL1 shim fast-path suite, `test-mremap-infra`, `test-mremap-fork-tracking`,

mk/config.mk

@@ -70,6 +70,46 @@ CFLAGS := -O2 -Wall -Wextra -Wpedantic \
           -Wnull-dereference -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
 
+# Warnings are errors, because this tree has none and the gates around it (the
+# syscall coverage check, the EINTR contract, the proof targets) all fail the
+# build rather than print. A compiler diagnostic that only prints is the one
+# signal here that a reader has to notice on their own.
+#
+# WERROR=0 turns it off, which is what a newer compiler with a new warning
+# wants: the flag must not be the reason a fresh clone stops building. CI keeps
+# the default so the new warning still gets found.
+WERROR ?= 1
+ifeq ($(WERROR),1)
+CFLAGS += -Werror
+endif
+
+# Hardening. This process parses input the guest fully controls (its ELF, every
+# syscall argument, FUSE frames, netlink messages, sockaddr and cmsg blobs), so
+# the cheap compiler-side checks are worth their cost here even though the
+# bounds math itself is proved in src/proved/. PIE is already the Darwin
+# default; -fstack-protector-strong and _FORTIFY_SOURCE are not.
+#
+# _FORTIFY_SOURCE is skipped under AddressSanitizer alone, which predefines it
+# to 0 on purpose (its interceptors do the same job), so redefining it is a
+# -Wmacro-redefined error under the -Werror above. UBSAN and TSAN predefine
+# nothing and keep it, which is what makes those lanes exercise the same libc
+# entry points (__memcpy_chk and the rest) the shipped binary calls.
+#
+# Every -fsanitize= argument is split on commas so the test is an exact name
+# match. A substring test for -fsanitize=address is order-dependent while
+# reading as if it were not: it answers correctly for
+# "-fsanitize=address,undefined" and wrongly for "-fsanitize=undefined,address",
+# the same request spelled the other way round, which then fails the build on
+# the macro redefinition.
+sanitize_comma := ,
+SANITIZERS := $(subst $(sanitize_comma), ,\
+                $(patsubst -fsanitize=%,%,$(filter -fsanitize=%,$(CFLAGS))))
+
+CFLAGS += -fstack-protector-strong
+ifeq ($(filter address,$(SANITIZERS)),)
+CFLAGS += -D_FORTIFY_SOURCE=2
+endif
+
 ifneq ($(strip $(ELFUSE_NR_EMBEDDER_HVC6)),)
 CFLAGS += -DELFUSE_NR_EMBEDDER_HVC6=$(ELFUSE_NR_EMBEDDER_HVC6)
 endif

mk/tests.mk

@@ -7,7 +7,7 @@
 # src/elfuse-limits.h.
 ELFUSE_HOST_NOFILE_MIN ?= $(shell bash "$(CURDIR)/tests/test-config.sh" --host-nofile)
 
-.PHONY: test-hello test-all check check-syscall-coverage check-eintr-contract check-skill-refs test-gdbstub test-coreutils test-busybox \
+.PHONY: test-hello test-all check check-syscall-coverage check-eintr-contract check-lock-order check-skill-refs test-gdbstub test-coreutils test-busybox \
         test-static-bins \
         test-dynamic test-dynamic-coreutils test-glibc-dynamic \
         test-glibc-coreutils test-perf \
@@ -72,6 +72,11 @@ check-syscall-coverage:
 check-eintr-contract:
 	@python3 scripts/check-eintr-contract.py
 
+## Verify every lock in the tree is named by the lock-order document
+check-lock-order:
+	@python3 scripts/check-lock-order.py --self-test
+	@python3 scripts/check-lock-order.py
+
 ## Verify every path, target, and section the skills name still resolves
 check-skill-refs:
 	@python3 scripts/check-skill-refs.py --self-test
@@ -210,7 +215,7 @@ check-sanitizer: $(ELFUSE_BIN) $(TEST_DEPS) $(CHECK_HOST_UNIT_BINS)
 	$(CHECK_SHARED_LANES)
 
 ## Run the unit test suite plus busybox applet validation
-check: $(ELFUSE_BIN) $(TEST_DEPS) check-syscall-coverage check-eintr-contract check-skill-refs test-config \
+check: $(ELFUSE_BIN) $(TEST_DEPS) check-syscall-coverage check-eintr-contract check-lock-order check-skill-refs test-config \
 		$(CHECK_HOST_UNIT_BINS)
 	@bash tests/driver.sh -e $(ELFUSE_BIN) -d $(TEST_DIR) -v
 	$(CHECK_SHARED_LANES)