1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
|
.\" Copyright (c) 1995 Michael Chastain (mec@duracef.shout.net), 22 July 1995.
.\" Copyright (c) 2015 Andrew Lutomirski
.\"
.\" SPDX-License-Identifier: GPL-2.0-or-later
.\"
.TH modify_ldt 2 2023-03-30 "Linux man-pages 6.05.01"
.SH NAME
modify_ldt \- get or set a per-process LDT entry
.SH LIBRARY
Standard C library
.RI ( libc ", " \-lc )
.SH SYNOPSIS
.nf
.BR "#include <asm/ldt.h>" " /* Definition of " "struct user_desc" " */"
.BR "#include <sys/syscall.h>" " /* Definition of " SYS_* " constants */"
.B #include <unistd.h>
.PP
.BI "int syscall(SYS_modify_ldt, int " func ", void " ptr [. bytecount ],
.BI " unsigned long " bytecount );
.fi
.PP
.IR Note :
glibc provides no wrapper for
.BR modify_ldt (),
necessitating the use of
.BR syscall (2).
.SH DESCRIPTION
.BR modify_ldt ()
reads or writes the local descriptor table (LDT) for a process.
The LDT
is an array of segment descriptors that can be referenced by user code.
Linux allows processes to configure a per-process (actually per-mm) LDT.
For more information about the LDT, see the Intel Software Developer's
Manual or the AMD Architecture Programming Manual.
.PP
When
.I func
is 0,
.BR modify_ldt ()
reads the LDT into the memory pointed to by
.IR ptr .
The number of bytes read is the smaller of
.I bytecount
and the actual size of the LDT, although the kernel may act as though
the LDT is padded with additional trailing zero bytes.
On success,
.BR modify_ldt ()
will return the number of bytes read.
.PP
When
.I func
is 1 or 0x11,
.BR modify_ldt ()
modifies the LDT entry indicated by
.IR ptr\->entry_number .
.I ptr
points to a
.I user_desc
structure
and
.I bytecount
must equal the size of this structure.
.PP
The
.I user_desc
structure is defined in \fI<asm/ldt.h>\fP as:
.PP
.in +4n
.EX
struct user_desc {
unsigned int entry_number;
unsigned int base_addr;
unsigned int limit;
unsigned int seg_32bit:1;
unsigned int contents:2;
unsigned int read_exec_only:1;
unsigned int limit_in_pages:1;
unsigned int seg_not_present:1;
unsigned int useable:1;
};
.EE
.in
.PP
In Linux 2.4 and earlier, this structure was named
.IR modify_ldt_ldt_s .
.PP
The
.I contents
field is the segment type (data, expand-down data, non-conforming code, or
conforming code).
The other fields match their descriptions in the CPU manual, although
.BR modify_ldt ()
cannot set the hardware-defined "accessed" bit described in the CPU manual.
.PP
A
.I user_desc
is considered "empty" if
.I read_exec_only
and
.I seg_not_present
are set to 1 and all of the other fields are 0.
An LDT entry can be cleared by setting it to an "empty"
.I user_desc
or, if
.I func
is 1, by setting both
.I base
and
.I limit
to 0.
.PP
A conforming code segment (i.e., one with
.IR contents==3 )
will be rejected if
.I
func
is 1 or if
.I seg_not_present
is 0.
.PP
When
.I func
is 2,
.BR modify_ldt ()
will read zeros.
This appears to be a leftover from Linux 2.4.
.SH RETURN VALUE
On success,
.BR modify_ldt ()
returns either the actual number of bytes read (for reading)
or 0 (for writing).
On failure,
.BR modify_ldt ()
returns \-1 and sets
.I errno
to indicate the error.
.SH ERRORS
.TP
.B EFAULT
.I ptr
points outside the address space.
.TP
.B EINVAL
.I ptr
is 0,
or
.I func
is 1 and
.I bytecount
is not equal to the size of the structure
.IR user_desc ,
or
.I func
is 1 or 0x11 and the new LDT entry has invalid values.
.TP
.B ENOSYS
.I func
is neither 0, 1, 2, nor 0x11.
.SH STANDARDS
Linux.
.SH NOTES
.BR modify_ldt ()
should not be used for thread-local storage, as it slows down context
switches and only supports a limited number of threads.
Threading libraries should use
.BR set_thread_area (2)
or
.BR arch_prctl (2)
instead, except on extremely old kernels that do not support those system
calls.
.PP
The normal use for
.BR modify_ldt ()
is to run legacy 16-bit or segmented 32-bit code.
Not all kernels allow 16-bit segments to be installed, however.
.PP
Even on 64-bit kernels,
.BR modify_ldt ()
cannot be used to create a long mode (i.e., 64-bit) code segment.
The undocumented field "lm" in
.I user_desc
is not useful, and, despite its name,
does not result in a long mode segment.
.SH BUGS
On 64-bit kernels before Linux 3.19,
.\" commit e30ab185c490e9a9381385529e0fd32f0a399495
setting the "lm" bit in
.I user_desc
prevents the descriptor from being considered empty.
Keep in mind that the
"lm" bit does not exist in the 32-bit headers, but these buggy kernels
will still notice the bit even when set in a 32-bit process.
.SH SEE ALSO
.BR arch_prctl (2),
.BR set_thread_area (2),
.BR vm86 (2)
|
