document that this call needs securelevel <= 0, or

machdep.allowapeture > 0; feedback naddy@ and jmc@, ok deraadt@

1 files changed, 13 insertions, 4 deletions

diff --git a/lib/libarch/i386/i386_iopl.2 b/lib/libarch/i386/i386_iopl.2
index 5c6db6b60b4..5a8cc0bee8a 100644
--- a/lib/libarch/i386/i386_iopl.2
+++ b/lib/libarch/i386/i386_iopl.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: i386_iopl.2,v 1.12 2004/03/12 17:56:06 jmc Exp $
+.\"	$OpenBSD: i386_iopl.2,v 1.13 2006/02/24 01:07:20 djm Exp $
 .\"	$NetBSD: i386_iopl.2,v 1.3 1996/02/27 22:57:25 jtc Exp $
 .\"
 .\" Copyright (c) 1996 The NetBSD Foundation, Inc.
@@ -50,7 +50,13 @@
 .Fn i386_iopl
 sets the i386 I/O privilege level to the value specified by
 .Ar iopl .
-This call is restricted to the superuser.
+.Pp
+This call may only be made by the superuser.
+Additionally, it is only permitted when the
+.Xr securelevel 7
+is less than or equal to 0 or the
+.Va machdep.allowaperture
+sysctl has been set to a non-zero value.
 .Pp
 .Sy Note:
 Code using the
@@ -70,11 +76,14 @@ is set to indicate the error.
 will fail if:
 .Bl -tag -width [EINVAL]
 .It Bq Er EPERM
-The caller was not the superuser.
+The caller was not the superuser, or the securelevel is non-zero and
+.Va machdep.allowaperture
+has not been set to a non-zero value.
 .El
 .Sh SEE ALSO
 .Xr i386_get_ioperm 2 ,
-.Xr i386_set_ioperm 2
+.Xr i386_set_ioperm 2 ,
+.Xr securelevel 7
 .Sh REFERENCES
 .Rs
 .%A Intel