daniel/danos
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

build: a new compile-time ceiling declares itself or does not land

Browse Source 
The convention that tunables live in system/parameters.zig with their
reasoning attached predates this and got 2% compliance — 5 of 235. A
convention with no teeth is how a bare `const maximum_devices = 64` reached
an AMD desktop and cost it USB and storage. This is the same rule with a
gate behind it.

tools/check-bounds.py finds every bound-shaped declaration — a `maximum_*`
const with a literal value, or a type with a literal array length — and
requires the five-field block above it: what it counts, who decides its
size, what it protects, what happens at the limit, and how anyone finds out.

The at-limit vocabulary is closed: refuse, degrade, truncate, grow. There is
deliberately no way to spell "silent", no way to spell "drop", and nothing
meaning "allow", so the behaviours that did the damage cannot be written
down. Truncation is legal only carrying a marker the reader can see, which
is why klog_maximum_message qualifies and a USB descriptor cut at 512 bytes
does not.

An array length that names a declared bound is not itself a bound; only
literal lengths are flagged, which pushes ceilings toward having names.

The 273 that predate the rule are allowlisted so this lands without a
tree-wide sweep in front of it, and that list may only shrink: declaring a
bound means deleting its line, and the check fails on a stale entry too.
Nothing may be added.

Wired into `zig build test` and available alone as `zig build bounds`. Not
in the default build — it reads the whole tree, and a red bounds check
should not stop you booting a kernel.

Five are now declared rather than allowlisted. Writing them out is its own
argument: maximum_devices reads "protects: nothing — this is a sizing guess
about someone else's computer", and maximum_tasks now carries the fact that
it has been raised twice, each time by something that outgrew it.

Verified the gate refuses an undeclared bound, a declared one using
forbidden vocabulary, and an allowlist entry that has since been declared.
Suite 115/115.
This commit is contained in:
Daniel Samson
2026-08-08 11:27:27 +01:00
parent 568823a4fb
commit f4eb88e7d2
7 changed files with 537 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/bounds-allowlist.txt
+285
View File
@@ -0,0 +1,285 @@
# Bounds that predate the rule (docs/os-development/bounds.md).
#
# Generated from the tree as it stood when the check landed, so the gate could start
# without a 278-site sweep in front of it. Every line is a compile-time ceiling that
# has not yet said what it counts, who decides its size, what it protects, what
# happens when it is reached, or how anyone finds out.
#
# **This list may only shrink.** Declaring a bound means deleting its line; the check
# fails if a listed bound is now declared, and fails if a listed bound has vanished.
# Nothing may be added to it — a new ceiling declares itself or does not land.
#
# docs/fixed-bounds-audit.md is the analysis of how they got here.
boot/efi.zig:buffer
boot/efi.zig:info_buffer
boot/efi.zig:maximum_bundled
boot/efi.zig:maximum_tree_depth
library/device/acpi/aml/interpreter.zig:argbuf
library/device/acpi/aml/interpreter.zig:args
library/device/acpi/aml/interpreter.zig:locals
library/device/acpi/aml/interpreter.zig:maximum_segments
library/device/acpi/aml/interpreter.zig:notify_queue
library/device/acpi/aml/namespace.zig:segment
library/device/acpi/aml/parser.zig:maximum_segments
library/device/driver/driver.zig:lookup_attempts
library/device/model/device-abi.zig:hid
library/device/model/device-abi.zig:maximum_device_resources
library/device/pci/pci.zig:bar_virtual
library/device/pci/pci.zig:bars
library/device/registry/device-registry.zig:cols
library/device/registry/device-registry.zig:rules
library/device/registry/device-registry.zig:rules
library/device/registry/device-registry.zig:rules
library/device/registry/device-registry.zig:rules
library/device/registry/device-registry.zig:rules
library/kernel/channel.zig:bind_attempts
library/kernel/channel.zig:name_maximum
library/kernel/channel.zig:path_maximum
library/kernel/file-system.zig:name_buffer
library/kernel/file-system.zig:out
library/kernel/logging.zig:buffer
library/kernel/process.zig:blob
library/kernel/process.zig:receive
library/kernel/process.zig:table
library/kernel/service.zig:subscriber_capacity
library/kernel/start.zig:buffer
library/kernel/thread.zig:readers
library/kernel/thread.zig:writers
library/protocol/device-manager/device-manager-protocol.zig:hid
library/protocol/display/display-protocol.zig:max_modes
library/protocol/envelope/envelope.zig:packet_maximum
library/protocol/envelope/envelope.zig:post_maximum
library/protocol/power/power-protocol.zig:hid
library/protocol/scanout/scanout-protocol.zig:max_modes
library/protocol/usb-transfer/usb-transfer-protocol.zig:max_report_data
library/protocol/usb-transfer/usb-transfer-protocol.zig:max_reported_endpoints
library/protocol/usb-transfer/usb-transfer-protocol.zig:setup
system/abi.zig:errno_maximum
system/abi.zig:klog_maximum_message
system/abi.zig:maximum_process_name
system/boot-handoff.zig:kernel_segments
system/drivers/pci-bus/pci-bus.zig:line
system/drivers/pci-bus/pci-bus.zig:sub_buffer
system/drivers/ps2-bus/mouse-packet.zig:bytes
system/drivers/ps2-bus/scancode.zig:pressed
system/drivers/ps2-bus/scancode.zig:set2_base
system/drivers/ps2-bus/scancode.zig:set2_extended
system/drivers/usb-hid/hid-report.zig:keys
system/drivers/usb-hid/keyboard.zig:receive
system/drivers/usb-hid/mouse.zig:receive
system/drivers/usb-storage/bulk-only-transport.zig:cdb
system/drivers/usb-storage/scsi.zig:op_read_capacity_10
system/drivers/usb-storage/usb-storage.zig:capacity_bytes
system/drivers/usb-xhci-bus/usb-xhci-bus.zig:hid_buffer
system/drivers/usb-xhci-bus/usb-xhci-bus.zig:maker_buffer
system/drivers/usb-xhci-bus/usb-xhci-bus.zig:maker_buffer
system/drivers/usb-xhci-bus/usb-xhci-bus.zig:prev_connected
system/drivers/usb-xhci-bus/usb-xhci-bus.zig:product_buffer
system/drivers/usb-xhci-bus/usb-xhci-bus.zig:product_buffer
system/drivers/usb-xhci-bus/usb-xhci-library.zig:blob
system/drivers/usb-xhci-bus/usb-xhci-library.zig:buffer
system/drivers/usb-xhci-bus/usb-xhci-library.zig:bytes
system/drivers/usb-xhci-bus/usb-xhci-library.zig:data
system/drivers/usb-xhci-bus/usb-xhci-library.zig:descriptor
system/drivers/usb-xhci-bus/usb-xhci-library.zig:head
system/drivers/usb-xhci-bus/usb-xhci-library.zig:header
system/drivers/usb-xhci-bus/usb-xhci-library.zig:max_devices
system/drivers/usb-xhci-bus/usb-xhci-library.zig:max_endpoints_per_interface
system/drivers/usb-xhci-bus/usb-xhci-library.zig:max_interfaces
system/drivers/usb-xhci-bus/usb-xhci-library.zig:max_subscriptions
system/drivers/usb-xhci-bus/usb-xhci-library.zig:port_changes
system/drivers/usb-xhci-bus/usb-xhci-library.zig:raw
system/drivers/usb-xhci-bus/usb-xhci-library.zig:report_queue_capacity
system/drivers/usb-xhci-bus/usb-xhci-library.zig:request_set_hub_depth
system/drivers/virtio-gpu/virtio-gpu-protocol.zig:edid
system/drivers/virtio-gpu/virtio-gpu-protocol.zig:max_scanouts
system/drivers/virtio-gpu/virtio-gpu.zig:descriptors
system/drivers/virtio-gpu/virtio-gpu.zig:max_height
system/drivers/virtio-gpu/virtio-gpu.zig:max_width
system/initial-ramdisk.zig:buffer
system/initial-ramdisk.zig:buffer
system/initial-ramdisk.zig:maximum_name
system/kernel/acpi.zig:APIC
system/kernel/acpi.zig:BERT
system/kernel/acpi.zig:CPEP
system/kernel/acpi.zig:DMAR
system/kernel/acpi.zig:DSDT
system/kernel/acpi.zig:ECDT
system/kernel/acpi.zig:EINJ
system/kernel/acpi.zig:ERST
system/kernel/acpi.zig:FACP
system/kernel/acpi.zig:FACS
system/kernel/acpi.zig:HEST
system/kernel/acpi.zig:HPET
system/kernel/acpi.zig:IVRS
system/kernel/acpi.zig:MCFG
system/kernel/acpi.zig:MPST
system/kernel/acpi.zig:MSCT
system/kernel/acpi.zig:PMTT
system/kernel/acpi.zig:PSDT
system/kernel/acpi.zig:RASF
system/kernel/acpi.zig:RSDT
system/kernel/acpi.zig:SBST
system/kernel/acpi.zig:SLIT
system/kernel/acpi.zig:SPCR
system/kernel/acpi.zig:SRAT
system/kernel/acpi.zig:SSDT
system/kernel/acpi.zig:XSDT
system/kernel/acpi.zig:aml_block_len
system/kernel/acpi.zig:aml_block_physical
system/kernel/acpi.zig:holes
system/kernel/acpi.zig:maximum_rmrr
system/kernel/acpi.zig:nb
system/kernel/acpi.zig:nb
system/kernel/acpi.zig:nb
system/kernel/acpi.zig:oem_id
system/kernel/acpi.zig:oem_id
system/kernel/acpi.zig:oem_id
system/kernel/acpi.zig:oem_table_id
system/kernel/acpi.zig:overrides
system/kernel/acpi.zig:rmrr_limit_offset
system/kernel/acpi.zig:signature
system/kernel/acpi.zig:signature
system/kernel/acpi.zig:signature
system/kernel/architecture/x86_64/cpu.zig:irq_vector_count
system/kernel/architecture/x86_64/idt.zig:gate_count
system/kernel/architecture/x86_64/ioapic.zig:overrides
system/kernel/architecture/x86_64/iommu-amd.zig:buffer
system/kernel/architecture/x86_64/iommu-amd.zig:buffer
system/kernel/architecture/x86_64/iommu-intel.zig:buffer
system/kernel/architecture/x86_64/iommu-intel.zig:buffer
system/kernel/architecture/x86_64/iommu-intel.zig:context_table
system/kernel/device-model.zig:buffer
system/kernel/device-model.zig:cbuf
system/kernel/device-model.zig:hid_buffer
system/kernel/device-model.zig:maximum_resources
system/kernel/device-model.zig:name_buffer
system/kernel/device-model.zig:rbuf
system/kernel/heap.zig:heap_maximum
system/kernel/ipc-synchronous.zig:MESSAGE_MAXIMUM
system/kernel/ipc-synchronous.zig:POST_MAXIMUM
system/kernel/ipc-synchronous.zig:notify_buffer
system/kernel/ipc-synchronous.zig:post_capacity
system/kernel/irq.zig:maximum_gsi
system/kernel/irq.zig:msi_bound
system/kernel/irq.zig:msi_owner
system/kernel/irq.zig:vector_gsi
system/kernel/kernel.zig:buffer
system/kernel/kernel.zig:buffer
system/kernel/kernel.zig:buffer
system/kernel/kernel.zig:isos
system/kernel/kernel.zig:maximum_wake_attempts
system/kernel/log-ring.zig:message
system/kernel/log-ring.zig:out
system/kernel/log.zig:buffer
system/kernel/log.zig:maximum_sinks
system/kernel/log.zig:message
system/kernel/log.zig:ring_capacity
system/kernel/process.zig:chunk
system/kernel/process.zig:chunk
system/kernel/process.zig:chunk
system/kernel/process.zig:chunk
system/kernel/process.zig:exit_record_capacity
system/kernel/process.zig:exit_subscriber_capacity
system/kernel/process.zig:maximum_argument_bytes
system/kernel/process.zig:maximum_arguments
system/kernel/process.zig:maximum_dma_regions
system/kernel/process.zig:maximum_mmap_pages
system/kernel/process.zig:maximum_mount_prefix
system/kernel/process.zig:maximum_mount_rewrite
system/kernel/process.zig:maximum_pages
system/kernel/process.zig:maximum_resolve_path
system/kernel/process.zig:maximum_segments
system/kernel/process.zig:maximum_shared_memory_pages
system/kernel/process.zig:name_buffer
system/kernel/process.zig:timer_capacity
system/kernel/process.zig:word_bytes
system/kernel/process.zig:write_buffer
system/kernel/scheduler.zig:ipc_maximum_handles
system/kernel/scheduler.zig:maximum_space_mappings
system/kernel/vfs.zig:maximum_directories
system/kernel/vfs.zig:maximum_mounts
system/kernel/vfs.zig:maximum_prefix
system/kernel/vfs.zig:maximum_rewrite
system/services/acpi/acpi.zig:blocks
system/services/acpi/acpi.zig:buffer
system/services/acpi/acpi.zig:hid
system/services/acpi/acpi.zig:mmio_scratch
system/services/acpi/acpi.zig:name
system/services/acpi/acpi.zig:registered
system/services/device-manager/device-manager.zig:arguments
system/services/device-manager/device-manager.zig:id_text
system/services/device-manager/device-manager.zig:maximum_children
system/services/device-manager/device-manager.zig:maximum_drivers
system/services/device-manager/device-manager.zig:name_buffer
system/services/device-manager/device-manager.zig:registry_rules
system/services/device-manager/device-manager.zig:registry_source
system/services/display/backend.zig:device_table
system/services/display/backend.zig:line
system/services/display/compositor.zig:capacity
system/services/display/compositor.zig:maximum_columns
system/services/display/compositor.zig:maximum_rects
system/services/display/compositor.zig:maximum_rows
system/services/display/display.zig:line
system/services/display/display.zig:line
system/services/display/display.zig:line
system/services/display/display.zig:list
system/services/display/display.zig:maximum_layers
system/services/display/display.zig:mode_list
system/services/fat/engine.zig:buf
system/services/fat/engine.zig:buf
system/services/fat/engine.zig:buf
system/services/fat/engine.zig:buffer
system/services/fat/engine.zig:cached_back
system/services/fat/engine.zig:chunk
system/services/fat/engine.zig:chunk
system/services/fat/engine.zig:chunk
system/services/fat/engine.zig:device_back
system/services/fat/engine.zig:display
system/services/fat/engine.zig:long_name
system/services/fat/engine.zig:long_name
system/services/fat/engine.zig:long_name
system/services/fat/engine.zig:max_transfer_sectors
system/services/fat/engine.zig:pair
system/services/fat/engine.zig:pair
system/services/fat/engine.zig:payload
system/services/fat/engine.zig:payload
system/services/fat/engine.zig:payload
system/services/fat/engine.zig:readback
system/services/fat/engine.zig:run
system/services/fat/engine.zig:run
system/services/fat/engine.zig:short
system/services/fat/engine.zig:short
system/services/fat/engine.zig:short
system/services/fat/engine.zig:stem
system/services/fat/engine.zig:tail_buffer
system/services/fat/engine.zig:units
system/services/fat/engine.zig:value
system/services/fat/engine.zig:value
system/services/fat/engine.zig:window
system/services/fat/on-disk.zig:filesystem_type
system/services/fat/on-disk.zig:filesystem_type
system/services/fat/on-disk.zig:jump
system/services/fat/on-disk.zig:name
system/services/fat/on-disk.zig:name1
system/services/fat/on-disk.zig:name2
system/services/fat/on-disk.zig:name3
system/services/fat/on-disk.zig:oem_name
system/services/fat/on-disk.zig:volume_label
system/services/fat/on-disk.zig:volume_label
system/services/init/init.zig:binary
system/services/init/init.zig:init_csv
system/services/init/init.zig:max_service_args
system/services/init/init.zig:max_services
system/services/init/init.zig:maximum_bindings
system/services/init/init.zig:maximum_grants
system/services/init/init.zig:maximum_name
system/services/init/init.zig:maximum_restarts
system/services/init/init.zig:process_table
system/services/init/init.zig:protocol_csv
system/services/logger/logger.zig:chunk
system/services/logger/logger.zig:gap_line
system/services/logger/logger.zig:line
system/services/logger/logger.zig:line
system/services/logger/logger.zig:maximum_files
system/services/logger/logger.zig:stamp