Relax the check for bad LDTE allocations. It turns out that

there is code that blindly allocates LDTEs starting at slot 6
and I quess it doesn't really matter to us if they overwrite the BSDI
syscall slot, since it isn't a BSDI binary. Also add some code to help track
down other such users (commented out for now).

Reviewed by:	deischen@

1 files changed, 21 insertions, 4 deletions

diff --git a/sys/i386/i386/sys_machdep.c b/sys/i386/i386/sys_machdep.c
index 6900e51..4d244cc 100644
--- a/sys/i386/i386/sys_machdep.c
+++ b/sys/i386/i386/sys_machdep.c
@@ -410,6 +410,11 @@ i386_get_ldt(td, args)
 	return(error);
 }
 
+#ifdef	DEBUG 
+static int ldt_warnings;
+#define NUM_LDT_WARNINGS 10
+#endif
+
 static int
 i386_set_ldt(td, args)
 	struct thread *td;
@@ -441,7 +446,7 @@ i386_set_ldt(td, args)
 			uap->start = NLDT;
 			uap->num = MAX_LD - NLDT;
 		}
-		if (uap->start < NLDT || uap->num <= 0)
+		if (uap->start <= LUDATA_SEL || uap->num <= 0)
 			return (EINVAL);
 		mtx_lock_spin(&sched_lock);
 		pldt = mdp->md_ldt;
@@ -460,10 +465,18 @@ i386_set_ldt(td, args)
 	}
 
 	if (!(uap->start == 0 && uap->num == 1)) {
+#ifdef	DEBUG
+		/* complain a for a while if using old methods */
+		if (ldt_warnings++ < NUM_LDT_WARNINGS) {
+			printf("Warning: pid %d used static ldt allocation.\n",
+			    td->td_proc->p_pid);
+			printf("See the i386_set_ldt man page for more info\n");
+		}
+#endif
 		/* verify range of descriptors to modify */
 		largest_ld = uap->start + uap->num;
-		if (uap->start < NLDT || uap->start >= MAX_LD || uap->num < 0 ||
-		    largest_ld > MAX_LD) {
+		if (uap->start <= LUDATA_SEL || uap->start >= MAX_LD ||
+		    uap->num < 0 || largest_ld > MAX_LD) {
 			return (EINVAL);
 		}
 	}
@@ -562,7 +575,11 @@ i386_set_ldt(td, args)
 again:
 		mtx_lock_spin(&sched_lock);
 		dp = &((union descriptor *)(pldt->ldt_base))[NLDT];
-		for (i = NLDT; i < pldt->ldt_len; ++i) {
+		/*
+		 * start scanning a bit up to leave room for NVidia and
+		 * Wine, which still user the "Blat" method of allocation.
+		 */
+		for (i = NLDT + 1; i < pldt->ldt_len; ++i) {
 			if (dp->sd.sd_type == SDT_SYSNULL)
 				break;
 			dp++;