#!/bin/sh
# DF-1042 build -- build the kernel-module harness that proves the
# lapic_set_cpuid OOB write at runtime.
#
# The vulnerable path (madt_x2apic_pass2_callback -> lapic_set_cpuid) is only
# reached at boot from a firmware-provided MADT and is NOT callable from
# userspace on a running system.  QEMU's -acpitable appends a second MADT and
# the kernel's sdt_search() returns the first match, so a boot-time repro via
# -acpetable does not exercise the bug.  We therefore prove the primitive
# directly: this kld module calls the real exported lapic_set_cpuid() symbol
# with the exact OOB argument (cpu=1, apic_id=256) that the crafted MADT
# (gen_madt.py, LocalApicId=256) would force the pass2 callback to pass, and
# observes the resulting BSS corruption.
#
# (Also generate the conceptual MADT trigger; it is the data an attacker who
#  controls the firmware/hypervisor would supply.)
set -e
cd "$(dirname "$0")"
python3 gen_madt.py > malicious_madt.aml
# Build the kernel module against the running kernel's obj tree.
make KERNCONF=X86_64_GENERIC 2>&1
echo "BUILD_OK"