#!/bin/sh
# DF-1064 build -- build the kernel-module harness that proves the
# cpu-dimension OOB write at runtime.
#
# The vulnerable path (madt_{lapic,x2apic}_pass2_callback ->
# lapic_set_cpuid + CPUID_TO_ACPIID) is only reached at boot from a
# firmware-provided MADT and is NOT callable from userspace on a running
# system.  QEMU's -acpitable appends a second MADT and the kernel's
# sdt_search() returns the first match, so a boot-time repro via -acpitable
# does not exercise the bug (this was confirmed in the DF-1042 sibling
# run).  We therefore prove the primitive directly: this kld module
# reproduces the exact writes the crafted MADT (gen_madt.py with 300
# enabled entries) forces the pass2 callbacks to make when arg->cpu
# reaches 256, and observes the resulting BSS corruption.
#
# Also regenerate the conceptual MADT trigger (the data an attacker who
# controls the firmware/hypervisor would supply).
set -e
cd "$(dirname "$0")"
python3 gen_madt.py > malicious_madt.aml
# Build the kernel module against the running kernel's obj tree.
make KERNCONF=X86_64_GENERIC 2>&1
echo "BUILD_OK"