search

oxidecomputer / phbl

Pico Host Boot Loader
Mozilla Public License 2.0
98 stars 7 forks source link

Don't try to forge provenance from a nil pointer #23

Closed dancrossnyc closed 1 year ago

dancrossnyc commented 1 year ago

As pointed out by Ben Kimock in issue #22, NULL carries no provenance, and attempting to forge a dereferenceable pointer from NULL is UB.

Remove that paradigm from phbl by applying different techniques:

  1. Where we just need a pointer to get its address and nothing else, core::ptr::invalid serves nicely.
  2. When we want to get a pointer from a freshly-mapped address, as when loading the kernel, ask the page table to use its provenance to create the pointer. Indeed, the page table can even validate that it properly maps the given address.
  3. For early UART initialization, introduce an MMIO_BASE symbol in assembly language that we can leverage to get a provenance-providing pointer.

I believe these changes together address address the UB issue, but would appreciate @saethlin's input. Thank you again!

Fixes: #22 Signed-off-by: Dan Cross cross@oxidecomputer.com

dancrossnyc commented 1 year ago

FYI, tested on Gimlet.

dancrossnyc commented 1 year ago

I'm going to go ahead and submit this now, but probably follow-up with some other things.