[apple/xnu.git] / bsd / man / man2 / i386_get_ldt.2

.\" Copyright (c) 1980, 1991 Regents of the University of California.
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\" 3. All advertising materials mentioning features or use of this software
.\"    must display the following acknowledgement:
.\"	This product includes software developed by the University of
.\"	California, Berkeley and its contributors.
.\" 4. Neither the name of the University nor the names of its contributors
.\"    may be used to endorse or promote products derived from this software
.\"    without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.\"     from: @(#)fork.2	6.5 (Berkeley) 3/10/91
.\" $FreeBSD: /repoman/r/ncvs/src/lib/libc/i386/sys/i386_get_ldt.2,v 1.21 2004/07/02 19:07:30 ru Exp $
.\"
.Dd February 14, 2020
.Dt I386_GET_LDT 2
.Os
.Sh NAME
.Nm i386_get_ldt ,
.Nm i386_set_ldt
.Nd manage i386 per-process Local Descriptor Table entries
.Sh LIBRARY
.Lb libc
.Sh SYNOPSIS
.In architecture/i386/table.h
.In i386/user_ldt.h
.Ft int
.Fn i386_get_ldt "int start_sel" "union ldt_entry *descs" "int num_sels"
.Ft int
.Fn i386_set_ldt "int start_sel" "union ldt_entry *descs" "int num_sels"
.Sh DESCRIPTION
The
.Fn i386_get_ldt
system call
will return the list of i386 descriptors that the process has in its
LDT.
The
.Fn i386_set_ldt
system call
will set a list of i386 descriptors for the current process in its
LDT.
Both routines accept a starting selector number
.Fa start_sel ,
an array of memory that
will contain the descriptors to be set or returned
.Fa descs ,
and the number of entries to set or return
.Fa num_sels .
.Pp
The argument
.Fa descs
can be either code_desc_t, data_desc_t or call_gate_t and are defined in
.In architecture/i386/desc.h .
These structures are defined by the architecture
as disjoint bit-fields, so care must be taken in constructing them.
.Pp
If
.Fa start_sel
is
.Em LDT_AUTO_ALLOC ,
.Fa num_sels
is 1 and the descriptor pointed to by
.Fa descs
is legal, then
.Fn i386_set_ldt
will allocate a descriptor and return its
selector number.
.Pp
If
.Fa num_descs
is 1,
.Fa start_sels
is valid, and
.Fa descs
is NULL, then
.Fn i386_set_ldt
will free that descriptor
(making it available to be reallocated again later).
.Pp
If
.Fa num_descs
is 0,
.Fa start_sels
is 0 and
.Fa descs
is NULL then, as a special case,
.Fn i386_set_ldt
will free all descriptors.
.Sh NOTES
.Pp
.Fn i386_set_ldt
and
.Fn i386_get_ldt
may be used by 64-bit processes to create 32-bit (compatibility mode) code segments
(in addition to the set of other segments already specified), that, together with
additional infrastructure not provided by macOS, enables 32-bit code execution.
Some platforms may reject segments with non-zero base addresses by returning -1 and
setting errno to EINVAL.
.Sh RETURN VALUES
Upon successful completion,
.Fn i386_get_ldt
returns the number of descriptors currently in the LDT.
The
.Fn i386_set_ldt
system call
returns the first selector set.
In the case when a descriptor is allocated by the kernel, its number will
be returned.
Otherwise, a value of -1 is returned and the global
variable
.Va errno
is set to indicate the error.
.Sh ERRORS
The
.Fn i386_get_ldt
and
.Fn i386_set_ldt
system calls
will fail if:
.Bl -tag -width Er
.It Bq Er EINVAL
An inappropriate value was used for
.Fa start_sel
or
.Fa num_sels ,
or the platform does not support non-zero base addresses in custom descriptors and the descriptor base address passed to
.Fn i386_set_ldt
is non-zero.
.It Bq Er EACCES
The caller attempted to use a descriptor that would
circumvent protection or cause a failure.
.El
.Sh SEE ALSO
i386 Microprocessor Programmer's Reference Manual, Intel
.Sh WARNING
You can really hose your process using this.
Commit	Line	Data
0c530ab8 A	1	.\" Copyright (c) 1980, 1991 Regents of the University of California.
	2	.\" All rights reserved.
	3	.\"
	4	.\" Redistribution and use in source and binary forms, with or without
	5	.\" modification, are permitted provided that the following conditions
	6	.\" are met:
	7	.\" 1. Redistributions of source code must retain the above copyright
	8	.\" notice, this list of conditions and the following disclaimer.
	9	.\" 2. Redistributions in binary form must reproduce the above copyright
	10	.\" notice, this list of conditions and the following disclaimer in the
	11	.\" documentation and/or other materials provided with the distribution.
	12	.\" 3. All advertising materials mentioning features or use of this software
	13	.\" must display the following acknowledgement:
	14	.\" This product includes software developed by the University of
	15	.\" California, Berkeley and its contributors.
	16	.\" 4. Neither the name of the University nor the names of its contributors
	17	.\" may be used to endorse or promote products derived from this software
	18	.\" without specific prior written permission.
	19	.\"
	20	.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
	21	.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	22	.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	23	.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
	24	.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	25	.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	26	.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	27	.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	28	.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	29	.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	30	.\" SUCH DAMAGE.
	31	.\"
	32	.\" from: @(#)fork.2 6.5 (Berkeley) 3/10/91
	33	.\" $FreeBSD: /repoman/r/ncvs/src/lib/libc/i386/sys/i386_get_ldt.2,v 1.21 2004/07/02 19:07:30 ru Exp $
	34	.\"
f427ee49	35	.Dd February 14, 2020
0c530ab8 A	36	.Dt I386_GET_LDT 2
	37	.Os
	38	.Sh NAME
	39	.Nm i386_get_ldt ,
	40	.Nm i386_set_ldt
	41	.Nd manage i386 per-process Local Descriptor Table entries
	42	.Sh LIBRARY
	43	.Lb libc
	44	.Sh SYNOPSIS
	45	.In architecture/i386/table.h
	46	.In i386/user_ldt.h
	47	.Ft int
	48	.Fn i386_get_ldt "int start_sel" "union ldt_entry *descs" "int num_sels"
	49	.Ft int
	50	.Fn i386_set_ldt "int start_sel" "union ldt_entry *descs" "int num_sels"
	51	.Sh DESCRIPTION
	52	The
	53	.Fn i386_get_ldt
	54	system call
	55	will return the list of i386 descriptors that the process has in its
	56	LDT.
	57	The
	58	.Fn i386_set_ldt
	59	system call
	60	will set a list of i386 descriptors for the current process in its
	61	LDT.
	62	Both routines accept a starting selector number
	63	.Fa start_sel ,
	64	an array of memory that
	65	will contain the descriptors to be set or returned
	66	.Fa descs ,
	67	and the number of entries to set or return
	68	.Fa num_sels .
	69	.Pp
	70	The argument
	71	.Fa descs
	72	can be either code_desc_t, data_desc_t or call_gate_t and are defined in
	73	.In architecture/i386/desc.h .
	74	These structures are defined by the architecture
	75	as disjoint bit-fields, so care must be taken in constructing them.
	76	.Pp
	77	If
	78	.Fa start_sel
	79	is
	80	.Em LDT_AUTO_ALLOC ,
	81	.Fa num_sels
	82	is 1 and the descriptor pointed to by
	83	.Fa descs
	84	is legal, then
	85	.Fn i386_set_ldt
	86	will allocate a descriptor and return its
	87	selector number.
	88	.Pp
	89	If
	90	.Fa num_descs
	91	is 1,
	92	.Fa start_sels
	93	is valid, and
	94	.Fa descs
	95	is NULL, then
	96	.Fn i386_set_ldt
	97	will free that descriptor
	98	(making it available to be reallocated again later).
	99	.Pp
100	If
101	.Fa num_descs
102	is 0,
103	.Fa start_sels
104	is 0 and
105	.Fa descs
106	is NULL then, as a special case,
107	.Fn i386_set_ldt
108	will free all descriptors.
f427ee49 A	109	.Sh NOTES
	110	.Pp
	111	.Fn i386_set_ldt
	112	and
	113	.Fn i386_get_ldt
	114	may be used by 64-bit processes to create 32-bit (compatibility mode) code segments
	115	(in addition to the set of other segments already specified), that, together with
	116	additional infrastructure not provided by macOS, enables 32-bit code execution.
	117	Some platforms may reject segments with non-zero base addresses by returning -1 and
	118	setting errno to EINVAL.
0c530ab8 A	119	.Sh RETURN VALUES
	120	Upon successful completion,
	121	.Fn i386_get_ldt
	122	returns the number of descriptors currently in the LDT.
	123	The
	124	.Fn i386_set_ldt
	125	system call
	126	returns the first selector set.
	127	In the case when a descriptor is allocated by the kernel, its number will
	128	be returned.
	129	Otherwise, a value of -1 is returned and the global
	130	variable
	131	.Va errno
	132	is set to indicate the error.
	133	.Sh ERRORS
	134	The
	135	.Fn i386_get_ldt
	136	and
	137	.Fn i386_set_ldt
	138	system calls
	139	will fail if:
	140	.Bl -tag -width Er
	141	.It Bq Er EINVAL
	142	An inappropriate value was used for
	143	.Fa start_sel
	144	or
f427ee49 A	145	.Fa num_sels ,
	146	or the platform does not support non-zero base addresses in custom descriptors and the descriptor base address passed to
	147	.Fn i386_set_ldt
	148	is non-zero.
0c530ab8 A	149	.It Bq Er EACCES
	150	The caller attempted to use a descriptor that would
	151	circumvent protection or cause a failure.
	152	.El
	153	.Sh SEE ALSO
	154	i386 Microprocessor Programmer's Reference Manual, Intel
	155	.Sh WARNING
	156	You can really hose your process using this.