From 6b2eef15db34c310b868a07bbe7520971f06ae07 Mon Sep 17 00:00:00 2001 From: japabu Date: Thu, 1 Oct 2026 09:08:58 +0200 Subject: [PATCH 1/2] issues: a panic is never an accident, decided and enforced in seven crates The owner decided a rule graded by what a panic costs: no panic at all at an input boundary, no implicit panic in the kernel or the system services, normal Rust for apps, ports, tests and tooling. He asked that it be recorded, not done now. The track carries the rule, what holds today and the five stages with their exits. Measured for it: - `rg -o '\.unwrap\(\)|\.expect\(' kernel/src | wc -l` is 157 (154 lines by `rg -c`). - `cargo clippy --target x86_64-unknown-none -- -W clippy::indexing_slicing -W clippy::arithmetic_side_effects -W clippy::unwrap_used -W clippy::expect_used -W clippy::panic -W clippy::unreachable -W clippy::cast_possible_truncation --message-format=json`, in kernel/, counted per lint code with jq: 2,008 findings in the kernel crate. - `rustc -Z unstable-options --print target-spec-json` gives `"panic-strategy": "abort"` for x86_64-unknown-none and aarch64-unknown-none-softfloat. The no-panic README calls its attribute "useless in code built with panic = abort", so a link proof has to come from a host build. - A scratch crate run under the seven lints drew no warning for `assert!`, `copy_from_slice` or `split_at`. It drew one each for `a[3]` and `panic!`. The brief expected `issues/` to hold the two crafted-ELF panics an overflow check found, and it holds neither. The closed entry left the tracker at fa2799ded, yet seven comments still cite `issues/` for it, and the tree's rule is to file that rather than fix it here. The second file records it. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016t9wjdQkB8SH7bmfUoiy6L --- ...-cite-crafted-elf-panics-no-issue-holds.md | 17 +++++ issues/kernel/a-panic-is-never-an-accident.md | 69 +++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100644 issues/build/seven-comments-cite-crafted-elf-panics-no-issue-holds.md create mode 100644 issues/kernel/a-panic-is-never-an-accident.md diff --git a/issues/build/seven-comments-cite-crafted-elf-panics-no-issue-holds.md b/issues/build/seven-comments-cite-crafted-elf-panics-no-issue-holds.md new file mode 100644 index 00000000000..570dc89bd1c --- /dev/null +++ b/issues/build/seven-comments-cite-crafted-elf-panics-no-issue-holds.md @@ -0,0 +1,17 @@ +--- +status: open +kind: tooling +opened: 2026-10-01 +--- + +# Seven comments cite crafted-ELF panics in `issues/`, and no issue holds them + +`git grep -n 'crafted-ELF' HEAD -- '*.toml' src/` finds the citation at +`Cargo.toml:211,231`, `bootloader/Cargo.toml:45`, `kernel/Cargo.toml:376`, +`userland/Cargo.toml:69` and `src/build.rs:410,635`. No issue names either +panic: `git grep -i -e phnum -e 'gnu\.hash' -e bloom_shift 1e4d3e0ec -- issues/` +exits 1. The closed entry left the tracker at `fa2799ded`, and `da3f56573` +then rewrote the citations' path to `issues/`. + +**Exit**: the clause is deleted at all seven sites, and the `git grep` above +finds no `issues/` citation. diff --git a/issues/kernel/a-panic-is-never-an-accident.md b/issues/kernel/a-panic-is-never-an-accident.md new file mode 100644 index 00000000000..460a2d62439 --- /dev/null +++ b/issues/kernel/a-panic-is-never-an-accident.md @@ -0,0 +1,69 @@ +--- +status: open +kind: track +opened: 2026-10-01 +--- + +# A panic is never an accident: the rule is decided, and seven crates enforce it + +The owner has decided the rule below. Outside seven crates nothing enforces it +yet, and that is the present-state weakness. + +| Tier | Rule | +|---|---| +| 1. Input boundaries: everything that reads bytes from outside the code's own trust (disk and partition formats, filesystems, ELF loading, microcode, network packets, USB descriptors, ACPI and PCI tables, system-call arguments, IPC messages, device registers and DMA data) | No panic at all. Clippy denies `indexing_slicing`, `arithmetic_side_effects`, `unwrap_used`, `expect_used`, `panic`, `unreachable` and truncating casts. Each parser's entry point also carries a link-time no-panic proof. | +| 2. The whole kernel | No implicit panic: the same lints are denied. A deliberate stop for a broken internal invariant stays (fail fast), but it is spelled out with its reason where a reviewer sees it, as an `#[expect(…, reason = …)]` or a named invariant. A type that makes the broken state unrepresentable is preferred over any stop. | +| 3. System services: init, logd, blockd, fsd, netd, compositor, soundd, sshd | The same rule as the kernel. | +| 4. Apps, ports, test code and build tooling | Normal Rust. | + +**Today.** +- Seven crates carry the lints (`rg -l 'clippy::indexing_slicing' --glob '*.rs'`). + `toyos-net-wire`, `-ip`, `-tcp`, `-udp`, `toyos-dhcp` and `toyos-gpt` forbid + five of them outside tests, plus `as_conversions` in place of truncating + casts. `toyos-transport` forbids four and denies `indexing_slicing` and + `as_conversions`, with one `#[allow]` at `toyos-transport/src/queue.rs:21`. + No crate denies `unreachable`. +- The kernel has 157 `.unwrap()`/`.expect(` calls on 154 lines + (`rg -o '\.unwrap\(\)|\.expect\(' kernel/src | wc -l`; `rg -c` counts + lines). Running `cargo clippy --target x86_64-unknown-none` in `kernel/` + with the seven lints as warnings reports 2,008 findings at default features: 992 + `arithmetic_side_effects`, 408 `indexing_slicing`, 394 + `cast_possible_truncation`, 109 `expect_used`, 60 `panic`, 29 `unwrap_used` + and 16 `unreachable`. +- `overflow-checks = true` is set in `[profile.toyos]` (`Cargo.toml:254`, + `kernel/Cargo.toml:387`, `userland/Cargo.toml:85`), so an overflow stops the + program. Overflow checks found the two crafted-ELF kernel panics, from + `e_phoff = u64::MAX` and from a `.gnu.hash` `bloom_shift` of 32 or more. + `issues/` holds neither. They are closed at `56aea566a:specs/known-issues.md:440`, + and their tests are `toyos-elf/tests/crafted.rs:113` and + `toyos-elf/tests/tables.rs:615`. +- The review of PR #653 at `38318d18b` found a length check at + `toyos-microcode/src/lib.rs:203` that no test covers. It guards the panicking + slice `table[EXT_HEADER..]` at `:213`. + +**Constraints.** +- The lints do not see `assert!`, `copy_from_slice`, `split_at` or a panic + inside a callee: on a crate holding the first three beside `a[3]` and + `panic!`, they warned on those two alone. +- The no-panic proof needs unwinding: its README says "The attribute is useless + in code built with `panic = "abort"`". Both kernel targets print + `"panic-strategy": "abort"` from `rustc -Z unstable-options --print + target-spec-json`, so the proof has to come from a host build. +- `--clippy` lints no userland program, because the `toyos` toolchain ships no + clippy (`src/clippy.rs:7-8`). + +**Stages, in order.** +1. Tier 1, one area at a time. An area's exit is its crate or kernel module + denying the lints under `cargo run -- --clippy`. `toyos-elf` is + `issues/design-debt/elf-domain-lint-line-not-yet-added.md`. +2. The link-time proof on the parser entry points: works or not, measured. The + exit is a host build that refuses to link an entry point with a panicking + path, or a `rejected` issue with the measurement. +3. The kernel, one module at a time, under `--clippy`. The stage ends when + `kernel/src/main.rs` denies the lints for the whole crate. +4. The system services. A service's exit is its crate root denying the lints + under a clippy run that reaches userland. +5. The rule goes into `.claude/agents/reviewer.md` beside "Edges". + +**Mutation**: adding one `buf[i]` to a module that denies the lints turns +`cargo run -- --clippy` red. From f469e9022fd03fd0e7212412ad68d303de40b6ee Mon Sep 17 00:00:00 2001 From: japabu Date: Thu, 1 Oct 2026 09:49:24 +0200 Subject: [PATCH 2/2] issues: the no-panic track names the owner's set and gates a bare #[allow]; seven crafted-ELF clauses go MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Answers the review of 6b2eef15d on PR #665. The set covers every operation that can panic on input. Each lint name was checked against clippy 0.1.98 (48a229ceae) on a scratch crate under `#![deny(unknown_lints)]`. All fifteen drew a finding on their own form. A bogus `clippy::no_such_lint_control` was refused, and it was the only error (exit 101). The set adds these to PR #653's nine: - `string_slice`, because `indexing_slicing` drew nothing on `&s[1..]` and `string_slice` did; - `cast_possible_truncation`, which the owner names; - `disallowed_methods` naming `slice::split_at` and `slice::copy_from_slice`; - `disallowed_macros` naming `core::assert`, `assert_eq` and `assert_ne`. Each of those configured names fired. What the set does not see, measured: `a << b`, `a >> b`, `1u64 << b`, `a.pow(b)` and `a.abs()` drew no finding. Built with `-C overflow-checks=on`, the shift, the `pow` and the `abs` each exit 101: "attempt to shift left with overflow", "attempt to exponentiate with overflow", "attempt to negate with overflow". The gate: - `#![forbid(clippy::indexing_slicing)]` turns an inner `#[expect(…, reason)]` into E0453, and an inner `#![allow(…, reason)]` too. - With `allow_attributes` and `allow_attributes_without_reason` on, an outer `#[allow]` draws the first lint, with or without a reason. - A bare `#[allow]`, `#![allow]` or `#[expect]` draws the second. - An inner `#![allow(…, reason = …)]` draws neither. Stage 3's exit closes that hole with a `--ci host` step. clippy.toml: with a parent file listing `copy_from_slice` and a child listing `split_at`, the child crate drew only `split_at`. With the child's file removed, it drew only `copy_from_slice`. Only the nearest file is read. The count. `cargo clippy --target x86_64-unknown-none --message-format=json` ran in kernel/ with the set as `-W`. The two methods and three macros were added to a copy of the root clippy.toml, passed through CLIPPY_CONF_DIR. It exits 101 under the kernel's `-Dwarnings`. Counted by code with jq: - 992 arithmetic_side_effects - 408 indexing_slicing - 394 cast_possible_truncation - 208 disallowed_macros (200 assert, 8 assert_eq) - 109 expect_used - 60 panic - 39 disallowed_methods (all copy_from_slice) - 29 unwrap_used - 16 unreachable - 14 panic_in_result_fn - 5 string_slice That is 2,274. Beside them are 26 allow_attributes and 28 allow_attributes_without_reason. Seven clauses cited `issues/` for crafted-ELF panics that the tracker closed at fa2799ded. They sat at Cargo.toml (two), bootloader/, kernel/ and userland/Cargo.toml, and src/build.rs (two). All are deleted, with the file that recorded them. None of the five files is a sysroot input. Also deleted, as REMOVEs: - the "seven crates" claim; - the boundary and service lists; - "where a reviewer sees it"; - the per-crate inventory; - the rg count; - the crafted-ELF history; - the microcode citation; - the constraint's provenance; - stage 5; - the mutation line. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016t9wjdQkB8SH7bmfUoiy6L --- Cargo.toml | 8 +- bootloader/Cargo.toml | 5 +- ...-cite-crafted-elf-panics-no-issue-holds.md | 17 ---- issues/kernel/a-panic-is-never-an-accident.md | 93 +++++++++---------- kernel/Cargo.toml | 5 +- src/build.rs | 9 +- userland/Cargo.toml | 5 +- 7 files changed, 57 insertions(+), 85 deletions(-) delete mode 100644 issues/build/seven-comments-cite-crafted-elf-panics-no-issue-holds.md diff --git a/Cargo.toml b/Cargo.toml index c65155c62bd..751b41e5b0a 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -207,8 +207,7 @@ opt-level = 2 # `opt-level = 0`. Nothing fail-fast is traded for it — `opt-level` does not # touch `debug-assertions`, which cargo still passes as `on` (checked with # `cargo build -p toyos-fat32 -v`), and rustc derives `overflow-checks` from -# that. The pure crates' hostile-input tests keep both knobs that *found* the -# two crafted-ELF kernel panics in `issues/`. +# that. # # **One member depends on this line for correctness rather than for speed, and # its own manifest says so at length — this is the other half of that @@ -227,9 +226,8 @@ opt-level = 3 # The one profile every guest binary is built with. Optimised, because an # unoptimised guest mismeasures everything under TCG; -# debug-assertions and overflow-checks on, because fail-fast beats speed here -# and both crafted-ELF kernel panics in `issues/` were *found* by -# an overflow check. `--release` would turn the last two off silently, so this +# debug-assertions and overflow-checks on, because fail-fast beats speed here. +# `--release` would turn the last two off silently, so this # build system no longer has the flag. # # It is declared here rather than in `toyos-ld/Cargo.toml` because cargo diff --git a/bootloader/Cargo.toml b/bootloader/Cargo.toml index 7e57aadd824..d2073464a7f 100644 --- a/bootloader/Cargo.toml +++ b/bootloader/Cargo.toml @@ -41,9 +41,8 @@ uefi-services = { version = "0.23.0", features = ["panic_handler", "logger"] } # The one profile every guest binary is built with. Optimised, because an # unoptimised guest mismeasures everything under TCG; -# debug-assertions and overflow-checks on, because fail-fast beats speed here -# and both crafted-ELF kernel panics in `issues/` were *found* by -# an overflow check. `--release` would turn the last two off silently, so this +# debug-assertions and overflow-checks on, because fail-fast beats speed here. +# `--release` would turn the last two off silently, so this # build system no longer has the flag. [profile.toyos] inherits = "dev" diff --git a/issues/build/seven-comments-cite-crafted-elf-panics-no-issue-holds.md b/issues/build/seven-comments-cite-crafted-elf-panics-no-issue-holds.md deleted file mode 100644 index 570dc89bd1c..00000000000 --- a/issues/build/seven-comments-cite-crafted-elf-panics-no-issue-holds.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -status: open -kind: tooling -opened: 2026-10-01 ---- - -# Seven comments cite crafted-ELF panics in `issues/`, and no issue holds them - -`git grep -n 'crafted-ELF' HEAD -- '*.toml' src/` finds the citation at -`Cargo.toml:211,231`, `bootloader/Cargo.toml:45`, `kernel/Cargo.toml:376`, -`userland/Cargo.toml:69` and `src/build.rs:410,635`. No issue names either -panic: `git grep -i -e phnum -e 'gnu\.hash' -e bloom_shift 1e4d3e0ec -- issues/` -exits 1. The closed entry left the tracker at `fa2799ded`, and `da3f56573` -then rewrote the citations' path to `issues/`. - -**Exit**: the clause is deleted at all seven sites, and the `git grep` above -finds no `issues/` citation. diff --git a/issues/kernel/a-panic-is-never-an-accident.md b/issues/kernel/a-panic-is-never-an-accident.md index 460a2d62439..2276a72fb21 100644 --- a/issues/kernel/a-panic-is-never-an-accident.md +++ b/issues/kernel/a-panic-is-never-an-accident.md @@ -4,47 +4,44 @@ kind: track opened: 2026-10-01 --- -# A panic is never an accident: the rule is decided, and seven crates enforce it - -The owner has decided the rule below. Outside seven crates nothing enforces it -yet, and that is the present-state weakness. +# A panic is never an accident: the owner's rule, not yet enforced | Tier | Rule | |---|---| -| 1. Input boundaries: everything that reads bytes from outside the code's own trust (disk and partition formats, filesystems, ELF loading, microcode, network packets, USB descriptors, ACPI and PCI tables, system-call arguments, IPC messages, device registers and DMA data) | No panic at all. Clippy denies `indexing_slicing`, `arithmetic_side_effects`, `unwrap_used`, `expect_used`, `panic`, `unreachable` and truncating casts. Each parser's entry point also carries a link-time no-panic proof. | -| 2. The whole kernel | No implicit panic: the same lints are denied. A deliberate stop for a broken internal invariant stays (fail fast), but it is spelled out with its reason where a reviewer sees it, as an `#[expect(…, reason = …)]` or a named invariant. A type that makes the broken state unrepresentable is preferred over any stop. | -| 3. System services: init, logd, blockd, fsd, netd, compositor, soundd, sshd | The same rule as the kernel. | +| 1. Input boundaries | No panic at all: the set below is forbidden. Where the build allows, each parser's entry point also carries a link-time no-panic proof. | +| 2. The kernel | No implicit panic: the set is denied. A deliberate stop for a broken internal invariant stays (fail fast), as an `#[expect(…, reason = "…")]` whose reason names the invariant. A type that makes the broken state unrepresentable is preferred over any stop. | +| 3. System services | The same rule as the kernel. | | 4. Apps, ports, test code and build tooling | Normal Rust. | -**Today.** -- Seven crates carry the lints (`rg -l 'clippy::indexing_slicing' --glob '*.rs'`). - `toyos-net-wire`, `-ip`, `-tcp`, `-udp`, `toyos-dhcp` and `toyos-gpt` forbid - five of them outside tests, plus `as_conversions` in place of truncating - casts. `toyos-transport` forbids four and denies `indexing_slicing` and - `as_conversions`, with one `#[allow]` at `toyos-transport/src/queue.rs:21`. - No crate denies `unreachable`. -- The kernel has 157 `.unwrap()`/`.expect(` calls on 154 lines - (`rg -o '\.unwrap\(\)|\.expect\(' kernel/src | wc -l`; `rg -c` counts - lines). Running `cargo clippy --target x86_64-unknown-none` in `kernel/` - with the seven lints as warnings reports 2,008 findings at default features: 992 - `arithmetic_side_effects`, 408 `indexing_slicing`, 394 - `cast_possible_truncation`, 109 `expect_used`, 60 `panic`, 29 `unwrap_used` - and 16 `unreachable`. -- `overflow-checks = true` is set in `[profile.toyos]` (`Cargo.toml:254`, - `kernel/Cargo.toml:387`, `userland/Cargo.toml:85`), so an overflow stops the - program. Overflow checks found the two crafted-ELF kernel panics, from - `e_phoff = u64::MAX` and from a `.gnu.hash` `bloom_shift` of 32 or more. - `issues/` holds neither. They are closed at `56aea566a:specs/known-issues.md:440`, - and their tests are `toyos-elf/tests/crafted.rs:113` and - `toyos-elf/tests/tables.rs:615`. -- The review of PR #653 at `38318d18b` found a length check at - `toyos-microcode/src/lib.rs:203` that no test covers. It guards the panicking - slice `table[EXT_HEADER..]` at `:213`. +**The set**, every name checked against clippy 0.1.98 (`48a229ceae`): +- indexing and slicing: `clippy::indexing_slicing`, and `clippy::string_slice`, + because the first does not fire on slicing a `str`; +- arithmetic: `clippy::arithmetic_side_effects`. `[profile.toyos]` sets + `overflow-checks`, so arithmetic is a panicking form; +- `clippy::unwrap_used`, `clippy::expect_used`, `clippy::panic`, + `clippy::unreachable`, `clippy::todo`, `clippy::unimplemented`, + `clippy::panic_in_result_fn`; +- truncating casts: `clippy::cast_possible_truncation`. A truncating `as` does + not panic; the owner names it, and for tiers 1 to 3 that overrides its + rejection in `issues/build/clippy-stage-two-is-lints-one-at-a-time.md`; +- standard functions: `clippy::disallowed_methods` naming `slice::split_at` and + `slice::copy_from_slice`, and `clippy::disallowed_macros` naming + `core::assert`, `core::assert_eq` and `core::assert_ne`. + +**Today.** No crate carries the set: none names `string_slice`, +`panic_in_result_fn`, `todo`, `unimplemented` or `cast_possible_truncation`. +In `kernel/`, `cargo clippy --target x86_64-unknown-none` with the set as +warnings reports 2,274 findings, 992 of them `arithmetic_side_effects`, 408 +`indexing_slicing`, 394 `cast_possible_truncation` and 208 `disallowed_macros`. **Constraints.** -- The lints do not see `assert!`, `copy_from_slice`, `split_at` or a panic - inside a callee: on a crate holding the first three beside `a[3]` and - `panic!`, they warned on those two alone. +- The set does not see a shift by a variable amount, `pow` or `abs`, though + each panics under `overflow-checks`; nor a standard function it does not + name, nor a panic inside a callee. +- `clippy::allow_attributes` checks outer attributes alone: an inner + `#![allow(…, reason = "…")]` passes it and `allow_attributes_without_reason`. +- `disallowed_methods` and `disallowed_macros` read the nearest `clippy.toml` + alone, and the root's reaches every crate beneath it, tier 4 included. - The no-panic proof needs unwinding: its README says "The attribute is useless in code built with `panic = "abort"`". Both kernel targets print `"panic-strategy": "abort"` from `rustc -Z unstable-options --print @@ -53,17 +50,19 @@ yet, and that is the present-state weakness. clippy (`src/clippy.rs:7-8`). **Stages, in order.** -1. Tier 1, one area at a time. An area's exit is its crate or kernel module - denying the lints under `cargo run -- --clippy`. `toyos-elf` is - `issues/design-debt/elf-domain-lint-line-not-yet-added.md`. +1. Tier 1, one area at a time. The first exit is one declaration of the set + that every tier-1 crate reads in place of its own copy. An area's exit is + its crate or kernel module forbidding the set under `cargo run -- --clippy`; + `forbid` refuses any inner `#[allow]` or `#[expect]` of it, the `#[allow]` + in `issues/design-debt/elf-domain-lint-line-not-yet-added.md`'s exit too. 2. The link-time proof on the parser entry points: works or not, measured. The - exit is a host build that refuses to link an entry point with a panicking - path, or a `rejected` issue with the measurement. -3. The kernel, one module at a time, under `--clippy`. The stage ends when - `kernel/src/main.rs` denies the lints for the whole crate. -4. The system services. A service's exit is its crate root denying the lints - under a clippy run that reaches userland. -5. The rule goes into `.claude/agents/reviewer.md` beside "Edges". - -**Mutation**: adding one `buf[i]` to a module that denies the lints turns -`cargo run -- --clippy` red. + exit is a step of `cargo run -- --ci host` whose host build refuses to link + an entry point with a panicking path, or a `rejected` issue with the + measurement. +3. The kernel, one module at a time. The stage ends when `kernel/src/main.rs` + denies the set and forbids `clippy::allow_attributes` and + `clippy::allow_attributes_without_reason` under `--clippy`, and a step of + `--ci host` refuses an inner `#![allow]`: then every exception is an + `#[expect(…, reason = "…")]`, and a bare `#[allow]` fails the gate. +4. The system services. The first exit is a userland shape in `src/clippy.rs`; + a service's exit is its crate root under stage 3's attributes. diff --git a/kernel/Cargo.toml b/kernel/Cargo.toml index 5beca3f086b..85c4228f971 100644 --- a/kernel/Cargo.toml +++ b/kernel/Cargo.toml @@ -372,9 +372,8 @@ user-writable-gsbase = [] # The one profile every guest binary is built with. # Optimised, because an unoptimised guest mismeasures everything under TCG; -# debug-assertions and overflow-checks on, because fail-fast beats speed here -# and both crafted-ELF kernel panics in `issues/` were *found* by -# an overflow check. `--release` would turn the last two off silently, so this +# debug-assertions and overflow-checks on, because fail-fast beats speed here. +# `--release` would turn the last two off silently, so this # build system no longer has the flag. [profile.toyos] inherits = "dev" diff --git a/src/build.rs b/src/build.rs index f8932e7a13d..f2ae538a9ef 100644 --- a/src/build.rs +++ b/src/build.rs @@ -405,10 +405,7 @@ fn config_crates(root: &Path, config: &SystemConfig) -> Vec { /// it in. /// /// One name, passed to every `cargo build` here and declared by every crate -/// root the image is made of. `--release` used to be a flag on `cargo run`, and -/// it silently turned `debug-assertions` and `overflow-checks` off — the two -/// knobs `issues/`'s crafted-ELF panics were *found* by. There is -/// no longer a second profile to pick, which is why there is no longer a flag. +/// root the image is made of. pub const PROFILE: &str = "toyos"; /// What every guest `cargo` and `rustc` here runs with: the toolchain directory @@ -632,9 +629,7 @@ fn contains_subslice(haystack: &[u8], needle: &[u8]) -> bool { /// [`PROFILE`] states them and `--release` is gone from this build system, so /// the way they can still be lost is somebody editing `[profile.toyos]`. This /// asks the artifact rather than the manifest, which is the only question worth -/// asking: `issues/`'s two crafted-ELF kernel panics were both -/// *found* by an overflow check, and one of them had no configuration in which -/// it was an error return. +/// asking. fn assert_overflow_checked(what: &str, image: &[u8]) { let found = contains_subslice(image, OVERFLOW_CHECK_MARKER); assert!( diff --git a/userland/Cargo.toml b/userland/Cargo.toml index 55b8b482f91..70cbde36cfa 100644 --- a/userland/Cargo.toml +++ b/userland/Cargo.toml @@ -65,9 +65,8 @@ winit = { git = "https://github.com/ToyOSOrg/winit", branch = "toyos-0.30.13" } # The one profile every guest binary is built with. # Optimised, because an unoptimised guest mismeasures everything under TCG; -# debug-assertions and overflow-checks on, because fail-fast beats speed here -# and both crafted-ELF kernel panics in `issues/` were *found* by -# an overflow check. `--release` would turn the last two off silently, so this +# debug-assertions and overflow-checks on, because fail-fast beats speed here. +# `--release` would turn the last two off silently, so this # build system no longer has the flag. # # What it replaces here: dependencies at 2 through `package."*"`, doom and the