1diff --git a/src/wl/sys/wl_cfg80211_hybrid.c b/src/wl/sys/wl_cfg80211_hybrid.c
2index 4b3298f..c45ad48 100644
3--- a/src/wl/sys/wl_cfg80211_hybrid.c
4+++ b/src/wl/sys/wl_cfg80211_hybrid.c
5@@ -41,6 +41,7 @@
6 #include <wlioctl.h>
7 #include <proto/802.11.h>
8 #include <wl_cfg80211_hybrid.h>
9+#include <wl_linux.h>
10
11 #define EVENT_TYPE(e) dtoh32((e)->event_type)
12 #define EVENT_FLAGS(e) dtoh16((e)->flags)
13@@ -442,30 +443,7 @@ static void key_endian_to_host(struct wl_wsec_key *key)
14 static s32
15 wl_dev_ioctl(struct net_device *dev, u32 cmd, void *arg, u32 len)
16 {
17- struct ifreq ifr;
18- struct wl_ioctl ioc;
19- mm_segment_t fs;
20- s32 err = 0;
21-
22- BUG_ON(len < sizeof(int));
23-
24- memset(&ioc, 0, sizeof(ioc));
25- ioc.cmd = cmd;
26- ioc.buf = arg;
27- ioc.len = len;
28- strcpy(ifr.ifr_name, dev->name);
29- ifr.ifr_data = (caddr_t)&ioc;
30-
31- fs = get_fs();
32- set_fs(KERNEL_DS);
33-#if defined(WL_USE_NETDEV_OPS)
34- err = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
35-#else
36- err = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
37-#endif
38- set_fs(fs);
39-
40- return err;
41+ return wlc_ioctl_internal(dev, cmd, arg, len);
42 }
43
44 static s32
45diff --git a/src/wl/sys/wl_iw.c b/src/wl/sys/wl_iw.c
46index 9c3c74e..e346b15 100644
47--- a/src/wl/sys/wl_iw.c
48+++ b/src/wl/sys/wl_iw.c
49@@ -37,6 +37,7 @@ typedef const struct si_pub si_t;
50
51 #include <wl_dbg.h>
52 #include <wl_iw.h>
53+#include <wl_linux.h>
54
55 extern bool wl_iw_conn_status_str(uint32 event_type, uint32 status,
56 uint32 reason, char* stringBuf, uint buflen);
57@@ -103,29 +104,7 @@ dev_wlc_ioctl(
58 int len
59 )
60 {
61- struct ifreq ifr;
62- wl_ioctl_t ioc;
63- mm_segment_t fs;
64- int ret;
65-
66- memset(&ioc, 0, sizeof(ioc));
67- ioc.cmd = cmd;
68- ioc.buf = arg;
69- ioc.len = len;
70-
71- strcpy(ifr.ifr_name, dev->name);
72- ifr.ifr_data = (caddr_t) &ioc;
73-
74- fs = get_fs();
75- set_fs(KERNEL_DS);
76-#if defined(WL_USE_NETDEV_OPS)
77- ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
78-#else
79- ret = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
80-#endif
81- set_fs(fs);
82-
83- return ret;
84+ return wlc_ioctl_internal(dev, cmd, arg, len);
85 }
86
87 static int
88diff --git a/src/wl/sys/wl_linux.c b/src/wl/sys/wl_linux.c
89index c990c70..5bb9480 100644
90--- a/src/wl/sys/wl_linux.c
91+++ b/src/wl/sys/wl_linux.c
92@@ -1664,10 +1664,7 @@ wl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
93 goto done2;
94 }
95
96- if (segment_eq(get_fs(), KERNEL_DS))
97- buf = ioc.buf;
98-
99- else if (ioc.buf) {
100+ if (ioc.buf) {
101 if (!(buf = (void *) MALLOC(wl->osh, MAX(ioc.len, WLC_IOCTL_MAXLEN)))) {
102 bcmerror = BCME_NORESOURCE;
103 goto done2;
104@@ -1688,7 +1685,7 @@ wl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
105 WL_UNLOCK(wl);
106
107 done1:
108- if (ioc.buf && (ioc.buf != buf)) {
109+ if (ioc.buf) {
110 if (copy_to_user(ioc.buf, buf, ioc.len))
111 bcmerror = BCME_BADADDR;
112 MFREE(wl->osh, buf, MAX(ioc.len, WLC_IOCTL_MAXLEN));
113@@ -1701,6 +1698,39 @@ done2:
114 return (OSL_ERROR(bcmerror));
115 }
116
117+int
118+wlc_ioctl_internal(struct net_device *dev, int cmd, void *buf, int len)
119+{
120+ wl_info_t *wl;
121+ wl_if_t *wlif;
122+ int bcmerror;
123+
124+ if (!dev)
125+ return -ENETDOWN;
126+
127+ wl = WL_INFO(dev);
128+ wlif = WL_DEV_IF(dev);
129+ if (wlif == NULL || wl == NULL || wl->dev == NULL)
130+ return -ENETDOWN;
131+
132+ bcmerror = 0;
133+
134+ WL_TRACE(("wl%d: wlc_ioctl_internal: cmd 0x%x\n", wl->pub->unit, cmd));
135+
136+ WL_LOCK(wl);
137+ if (!capable(CAP_NET_ADMIN)) {
138+ bcmerror = BCME_EPERM;
139+ } else {
140+ bcmerror = wlc_ioctl(wl->wlc, cmd, buf, len, wlif->wlcif);
141+ }
142+ WL_UNLOCK(wl);
143+
144+ ASSERT(VALID_BCMERROR(bcmerror));
145+ if (bcmerror != 0)
146+ wl->pub->bcmerror = bcmerror;
147+ return (OSL_ERROR(bcmerror));
148+}
149+
150 static struct net_device_stats*
151 wl_get_stats(struct net_device *dev)
152 {
153diff --git a/src/wl/sys/wl_linux.h b/src/wl/sys/wl_linux.h
154index 5b1048e..c8c1f41 100644
155--- a/src/wl/sys/wl_linux.h
156+++ b/src/wl/sys/wl_linux.h
157@@ -22,6 +22,7 @@
158 #define _wl_linux_h_
159
160 #include <wlc_types.h>
161+#include <wlc_pub.h>
162
163 typedef struct wl_timer {
164 struct timer_list timer;
165@@ -187,6 +188,7 @@ extern irqreturn_t wl_isr(int irq, void *dev_id, struct pt_regs *ptregs);
166 extern int __devinit wl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
167 extern void wl_free(wl_info_t *wl);
168 extern int wl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd);
169+extern int wlc_ioctl_internal(struct net_device *dev, int cmd, void *buf, int len);
170 extern struct net_device * wl_netdev_get(wl_info_t *wl);
171
172 #endif
173diff --git a/src/wl/sys/wlc_pub.h b/src/wl/sys/wlc_pub.h
174index 53a98b8..2b5a029 100644
175--- a/src/wl/sys/wlc_pub.h
176+++ b/src/wl/sys/wlc_pub.h
177@@ -24,6 +24,7 @@
178
179 #include <wlc_types.h>
180 #include <wlc_utils.h>
181+#include <siutils.h>
182 #include "proto/802.11.h"
183 #include "proto/bcmevent.h"
184