X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/2d21ac55c334faf3a56e5634905ed6987fc787d4..d26ffc64f583ab2d29df48f13518685602bc8832:/osfmk/i386/user_ldt.c

diff --git a/osfmk/i386/user_ldt.c b/osfmk/i386/user_ldt.c
index 87aab0426..35dd2cef7 100644
--- a/osfmk/i386/user_ldt.c
+++ b/osfmk/i386/user_ldt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000-2006 Apple Computer, Inc. All rights reserved.
+ * Copyright (c) 2000-2009 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
@@ -68,14 +68,14 @@
 
 #include <vm/vm_kern.h>
 
-#include <i386/seg.h>
-#include <i386/thread.h>
-#include <i386/user_ldt.h>
-#include <i386/mp_desc.h>
-#include <i386/proc_reg.h>
 #include <i386/machdep_call.h>
+#include <i386/user_ldt.h>
 #include <i386/mp.h>
 #include <i386/machine_routines.h>
+#include <i386/proc_reg.h>
+#include <i386/mp_desc.h>
+#include <i386/seg.h>
+#include <i386/thread.h>
 
 #include <sys/errno.h>
 
@@ -152,7 +152,7 @@ i386_set_ldt(
 		start_sel = LDTSZ_MIN;
 	    }
 		
-	    if (start_sel + num_sels > LDTSZ) {
+	    if ((uint64_t)start_sel + (uint64_t)num_sels > LDTSZ) {
 		task_unlock(task);
 		return ENOMEM;
 	    }
@@ -176,7 +176,7 @@ i386_set_ldt(
 	    }
 
 	    ldt_count = end_sel - begin_sel;
-
+	    /* XXX allocation under task lock */
 	    new_ldt = (user_ldt_t)kalloc(sizeof(struct user_ldt) + (ldt_count * sizeof(struct real_descriptor)));
 	    if (new_ldt == NULL) {
 		task_unlock(task);
@@ -212,6 +212,7 @@ i386_set_ldt(
 	     * Install new descriptors.
 	     */
 	    if (descs != 0) {
+		    /* XXX copyin under task lock */
 		err = copyin(descs, (char *)&new_ldt->ldt[start_sel - begin_sel],
 			     num_sels * sizeof(struct real_descriptor));
 		if (err != 0)
@@ -223,10 +224,9 @@ i386_set_ldt(
 	    } else {
 		bzero(&new_ldt->ldt[start_sel - begin_sel], num_sels * sizeof(struct real_descriptor));
 	    }
-
 	    /*
 	     * Validate descriptors.
-	     * Only allow descriptors with user priviledges.
+	     * Only allow descriptors with user privileges.
 	     */
 	    for (i = 0, dp = (struct real_descriptor *) &new_ldt->ldt[start_sel - begin_sel];
 		 i < num_sels;
@@ -235,7 +235,8 @@ i386_set_ldt(
 		switch (dp->access & ~ACC_A) {
 		    case 0:
 		    case ACC_P:
-			/* valid empty descriptor */
+			/* valid empty descriptor, clear Present preemptively */
+			dp->access &= (~ACC_P & 0xff);
 			break;
 		    case ACC_P | ACC_PL_U | ACC_DATA:
 		    case ACC_P | ACC_PL_U | ACC_DATA_W:
@@ -245,14 +246,18 @@ i386_set_ldt(
 		    case ACC_P | ACC_PL_U | ACC_CODE_R:
 		    case ACC_P | ACC_PL_U | ACC_CODE_C:
 		    case ACC_P | ACC_PL_U | ACC_CODE_CR:
-		    case ACC_P | ACC_PL_U | ACC_CALL_GATE_16:
-		    case ACC_P | ACC_PL_U | ACC_CALL_GATE:
 			break;
 		    default:
 			task_unlock(task);
 			user_ldt_free(new_ldt);
 			return EACCES;
 		}
+		/* Reject attempts to create segments with 64-bit granules */
+		if (dp->granularity & SZ_64) {
+			task_unlock(task);
+			user_ldt_free(new_ldt);
+			return EACCES;
+		}
 	    }
 	}
 
@@ -264,7 +269,7 @@ i386_set_ldt(
 	 * and we need to make sure the new LDT is in place
 	 * throughout the task before returning to the user.
 	 */
-	mp_rendezvous_no_intrs(user_ldt_set_action, task);
+	mp_broadcast(user_ldt_set_action, task);
 
 	task_unlock(task);
 
@@ -292,9 +297,9 @@ i386_get_ldt(
 	unsigned int	ldt_count;
 	kern_return_t	err;
 
-	if (start_sel >= 8192)
+	if (start_sel >= LDTSZ)
 	    return EINVAL;
-	if (start_sel + num_sels > 8192)
+	if ((uint64_t)start_sel + (uint64_t)num_sels > LDTSZ)
 	    return EINVAL;
 	if (descs == 0)
 	    return EINVAL;
@@ -389,7 +394,7 @@ user_ldt_set(
 	    bcopy(user_ldt->ldt, &ldtp[user_ldt->start],
 		  sizeof(struct real_descriptor) * (user_ldt->count));
 
-	    gdt_desc_p(USER_LDT)->limit_low = (sizeof(struct real_descriptor) * (user_ldt->start + user_ldt->count)) - 1;
+	    gdt_desc_p(USER_LDT)->limit_low = (uint16_t)((sizeof(struct real_descriptor) * (user_ldt->start + user_ldt->count)) - 1);
 
 	    ml_cpu_set_ldt(USER_LDT);
 	} else {