Skip to content

Commit

Permalink
[Kernel] Only copy a pointer to the IDT table to avoid OOB write
Browse files Browse the repository at this point in the history
  • Loading branch information
codyd51 committed Feb 7, 2024
1 parent 65f6d6f commit d518e99
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 1 deletion.
8 changes: 8 additions & 0 deletions docs/todo.md
Original file line number Diff line number Diff line change
Expand Up @@ -312,3 +312,11 @@ Read a config/max_cpus.txt to decide when to stop booting APs
Read a config/resolution.txt to decide the resolution selected by the bootloader

Auto install LLD link? Or llvm with brew? Need lld-link for the UEFI build

// TODO(PT): It'd be nice to have some kind of font API that allowed anyone to retrieve a reference to a
// font from any point, instead of needing to pass references all the way through the control flow.
// Maybe there's an in-process font store that caches scanlines, etc, and fetches fonts from the FS.
// The 'fetch from FS' has a platform-specific implementation. To facilitate this (as the paths will be
// different on each OS), we could have an enum to model the possible font options, with an escape hatch
// 'get from this path' variant, which could perhaps hold different values depending on the OS.

5 changes: 4 additions & 1 deletion kernel/kernel/smp.c
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,11 @@ void smp_init(void) {

// Copy the IDT pointer
idt_pointer_t* current_idt = kernel_idt_pointer();
// Crash because current_idt->table_size == 0xfff, and copying to 0x9400 causes it to write outside the AP bootstrap data page
printf("Current IDT %p size %p dest %p\n", current_idt, current_idt->table_size, AP_BOOTSTRAP_PARAM_IDT);
// It's fine to copy the high-memory IDT as the bootstrap will enable paging before loading it
memcpy((void*)PMA_TO_VMA(AP_BOOTSTRAP_PARAM_IDT), current_idt, sizeof(idt_pointer_t) + current_idt->table_size);
//memcpy((void*)PMA_TO_VMA(AP_BOOTSTRAP_PARAM_IDT), current_idt, sizeof(idt_pointer_t) + current_idt->table_size);
memcpy((void*)PMA_TO_VMA(AP_BOOTSTRAP_PARAM_IDT), current_idt, sizeof(idt_pointer_t*));

// Copy the C entry point
uintptr_t ap_c_entry_point_addr = (uintptr_t)&ap_c_entry;
Expand Down

0 comments on commit d518e99

Please sign in to comment.