[PATCH] audit: AUDIT_PERM support
[linux-2.6-block.git] / arch / x86_64 / kernel / ioport.c
CommitLineData
1da177e4
LT
1/*
2 * linux/arch/x86_64/kernel/ioport.c
3 *
4 * This contains the io-permission bitmap code - written by obz, with changes
5 * by Linus.
6 */
7
8#include <linux/sched.h>
9#include <linux/kernel.h>
a9415644 10#include <linux/capability.h>
1da177e4
LT
11#include <linux/errno.h>
12#include <linux/types.h>
13#include <linux/ioport.h>
14#include <linux/smp.h>
15#include <linux/smp_lock.h>
16#include <linux/stddef.h>
17#include <linux/slab.h>
18#include <linux/thread_info.h>
19
20/* Set EXTENT bits starting at BASE in BITMAP to value TURN_ON. */
21static void set_bitmap(unsigned long *bitmap, unsigned int base, unsigned int extent, int new_value)
22{
23 int i;
24 if (new_value)
25 for (i = base; i < base + extent; i++)
26 __set_bit(i, bitmap);
27 else
28 for (i = base; i < base + extent; i++)
29 clear_bit(i, bitmap);
30}
31
32/*
33 * this changes the io permissions bitmap in the current task.
34 */
35asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
36{
37 unsigned int i, max_long, bytes, bytes_updated;
38 struct thread_struct * t = &current->thread;
39 struct tss_struct * tss;
40 unsigned long *bitmap;
41
42 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
43 return -EINVAL;
44 if (turn_on && !capable(CAP_SYS_RAWIO))
45 return -EPERM;
46
47 /*
48 * If it's the first ioperm() call in this thread's lifetime, set the
49 * IO bitmap up. ioperm() is much less timing critical than clone(),
50 * this is why we delay this operation until now:
51 */
52 if (!t->io_bitmap_ptr) {
53 bitmap = kmalloc(IO_BITMAP_BYTES, GFP_KERNEL);
54 if (!bitmap)
55 return -ENOMEM;
56
57 memset(bitmap, 0xff, IO_BITMAP_BYTES);
58 t->io_bitmap_ptr = bitmap;
59 }
60
61 /*
62 * do it in the per-thread copy and in the TSS ...
63 *
64 * Disable preemption via get_cpu() - we must not switch away
65 * because the ->io_bitmap_max value must match the bitmap
66 * contents:
67 */
68 tss = &per_cpu(init_tss, get_cpu());
69
70 set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
71
72 /*
73 * Search for a (possibly new) maximum. This is simple and stupid,
74 * to keep it obviously correct:
75 */
76 max_long = 0;
77 for (i = 0; i < IO_BITMAP_LONGS; i++)
78 if (t->io_bitmap_ptr[i] != ~0UL)
79 max_long = i;
80
81 bytes = (max_long + 1) * sizeof(long);
82 bytes_updated = max(bytes, t->io_bitmap_max);
83
84 t->io_bitmap_max = bytes;
85
86 /* Update the TSS: */
87 memcpy(tss->io_bitmap, t->io_bitmap_ptr, bytes_updated);
88
89 put_cpu();
90
91 return 0;
92}
93
94/*
95 * sys_iopl has to be used when you want to access the IO ports
96 * beyond the 0x3ff range: to get the full 65536 ports bitmapped
97 * you'd need 8kB of bitmaps/process, which is a bit excessive.
98 *
99 * Here we just change the eflags value on the stack: we allow
100 * only the super-user to do it. This depends on the stack-layout
101 * on system-call entry - see also fork() and the signal handling
102 * code.
103 */
104
105asmlinkage long sys_iopl(unsigned int level, struct pt_regs *regs)
106{
107 unsigned int old = (regs->eflags >> 12) & 3;
108
109 if (level > 3)
110 return -EINVAL;
111 /* Trying to gain more privileges? */
112 if (level > old) {
113 if (!capable(CAP_SYS_RAWIO))
114 return -EPERM;
115 }
116 regs->eflags = (regs->eflags &~ 0x3000UL) | (level << 12);
117 return 0;
118}