ath6kl: Bringing in the upstream version

chromeos/drivers/ath6kl/os/linux/ioctl.c

-/*
- *
- * Copyright (c) 2004-2010 Atheros Communications Inc.
- * All rights reserved.
- *
- * 
-// This program is free software; you can redistribute it and/or modify
-// it under the terms of the GNU General Public License version 2 as
-// published by the Free Software Foundation;
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
 //
-// Software distributed under the License is distributed on an "AS
-// IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-// implied. See the License for the specific language governing
-// rights and limitations under the License.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 //
 //
- *
- */
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
 
 #include "ar6000_drv.h"
 #include "ieee80211_ioctl.h"
 #include "ar6kap_common.h"
 #include "targaddrs.h"
 #include "a_hci.h"
 #include "wlan_config.h"
 
 extern int enablerssicompensation;
 A_UINT32 tcmdRxFreq;
@@ skipping 791 matching lines @@
 
     up(&ar->arSem);
 
     return ret;
 }
 
 static int
 ar6000_ioctl_get_ap_stats(struct net_device *dev, struct ifreq *rq)
 {
     AR_SOFTC_T *ar = (AR_SOFTC_T *)ar6k_priv(dev);
-    WMI_AP_MODE_STAT cmd;
+    A_UINT32 action; /* Allocating only the desired space on the frame. Declaring is as a WMI_AP_MODE_STAT variable results in exceeding the compiler imposed limit on the maximum frame size */
     WMI_AP_MODE_STAT *pStats = &ar->arAPStats;
     int ret = 0;
 
     if (ar->arWmiReady == FALSE) {
         return -EIO;
     }
-    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
-                                sizeof(cmd)))
+    if (copy_from_user(&action, (char *)((unsigned int*)rq->ifr_data + 1),
+                                sizeof(A_UINT32)))
     {
         return -EFAULT;
     }
-    if (cmd.action == AP_CLEAR_STATS) {
+    if (action == AP_CLEAR_STATS) {
         A_UINT8 i;
         AR6000_SPIN_LOCK(&ar->arLock, 0);
         for(i = 0; i < AP_MAX_NUM_STA; i++) {
             pStats->sta[i].tx_bytes = 0;
             pStats->sta[i].tx_pkts = 0;
             pStats->sta[i].tx_error = 0;
             pStats->sta[i].tx_discard = 0;
             pStats->sta[i].rx_bytes = 0;
             pStats->sta[i].rx_pkts = 0;
             pStats->sta[i].rx_error = 0;
@@ skipping 933 matching lines @@
             break;
     }
 #ifdef USER_KEYS
     ar->user_saved_keys.keyType = keyType;
 #endif
     if (IEEE80211_CIPHER_CCKM_KRK != ik->ik_type) {
         if (NONE_CRYPT == keyType) {
             return -EIO;
         }
 
-        if (WEP_CRYPT == keyType) {
+        if ((WEP_CRYPT == keyType)&&(!ar->arConnected)) {
              int index = ik->ik_keyix;
 
             if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(ik->ik_keylen)) {
                 return -EIO;
             }
 
             A_MEMZERO(ar->arWepKeyList[index].arKey,
                             sizeof(ar->arWepKeyList[index].arKey));
             A_MEMCPY(ar->arWepKeyList[index].arKey, ik->ik_keydata, ik->ik_keylen);
             ar->arWepKeyList[index].arKeyLen = ik->ik_keylen;
@@ skipping 56 matching lines @@
     dev_hold(dev);
     rtnl_unlock();
 
     if (cmd == AR6000_IOCTL_EXTENDED) {
         /*
          * This allows for many more wireless ioctls than would otherwise
          * be available.  Applications embed the actual ioctl command in
          * the first word of the parameter block, and use the command
          * AR6000_IOCTL_EXTENDED_CMD on the ioctl call.
          */
-        get_user(cmd, (int *)rq->ifr_data);
+        if (get_user(cmd, (int *)rq->ifr_data)) {
+            ret = -EFAULT;
+            goto ioctl_done;
+        }
         userdata = (char *)(((unsigned int *)rq->ifr_data)+1);
         if(is_xioctl_allowed(ar->arNextMode, cmd) != A_OK) {
             A_PRINTF("xioctl: cmd=%d not allowed in this mode\n",cmd);
             ret = -EOPNOTSUPP;
             goto ioctl_done;
     }
     } else {
         A_STATUS ret = is_iwioctl_allowed(ar->arNextMode, cmd);
         if(ret == A_ENOTSUP) {
             A_PRINTF("iwioctl: cmd=0x%x not allowed in this mode\n", cmd);
             ret = -EOPNOTSUPP;
             goto ioctl_done;
         } else if (ret == A_ERROR) {
             /* It is not our ioctl (out of range ioctl) */
             ret = -EOPNOTSUPP;
             goto ioctl_done;
         }
         userdata = (char *)rq->ifr_data;
     }
 
     if ((ar->arWlanState == WLAN_DISABLED) &&
         ((cmd != AR6000_XIOCTRL_WMI_SET_WLAN_STATE) &&
          (cmd != AR6000_XIOCTL_GET_WLAN_SLEEP_STATE) &&
          (cmd != AR6000_XIOCTL_DIAG_READ) &&
          (cmd != AR6000_XIOCTL_DIAG_WRITE) &&
+         (cmd != AR6000_XIOCTL_SET_BT_HW_POWER_STATE) &&
+         (cmd != AR6000_XIOCTL_GET_BT_HW_POWER_STATE) &&
+         (cmd != AR6000_XIOCTL_ADD_AP_INTERFACE) &&
+         (cmd != AR6000_XIOCTL_REMOVE_AP_INTERFACE) &&
          (cmd != AR6000_IOCTL_WMI_GETREV)))
     {
         ret = -EIO;
         goto ioctl_done;
     }
 
     ret = 0;
     switch(cmd)
     {
         case IEEE80211_IOCTL_SETPARAM:
@@ skipping 89 matching lines @@
                     goto ioctl_done;
                 }
             }
             break;
         }
 #ifdef CONFIG_HOST_TCMD_SUPPORT
         case AR6000_XIOCTL_TCMD_CONT_TX:
             {
                 TCMD_CONT_TX txCmd;
 
-                if (ar->tcmdPm == TCMD_PM_SLEEP) {
+                if ((ar->tcmdPm == TCMD_PM_SLEEP) ||
+                    (ar->tcmdPm == TCMD_PM_DEEPSLEEP))
+                {
                     A_PRINTF("Can NOT send tx tcmd when target is asleep! \n");
                     ret = -EFAULT;
                     goto ioctl_done;
                 }
 
                 if(copy_from_user(&txCmd, userdata, sizeof(TCMD_CONT_TX))) {
                     ret = -EFAULT;
                     goto ioctl_done;
                 } else {
                     wmi_test_cmd(ar->arWmi,(A_UINT8 *)&txCmd, sizeof(TCMD_CONT_TX));
                 }
             }
             break;
         case AR6000_XIOCTL_TCMD_CONT_RX:
             {
                 TCMD_CONT_RX rxCmd;
 
-                if (ar->tcmdPm == TCMD_PM_SLEEP) {
+                if ((ar->tcmdPm == TCMD_PM_SLEEP) ||
+                    (ar->tcmdPm == TCMD_PM_DEEPSLEEP))
+                {
                     A_PRINTF("Can NOT send rx tcmd when target is asleep! \n");
                     ret = -EFAULT;
                     goto ioctl_done;
                 }
                 if(copy_from_user(&rxCmd, userdata, sizeof(TCMD_CONT_RX))) {
                     ret = -EFAULT;
                     goto ioctl_done;
                 }
 
                 switch(rxCmd.act)
@@ skipping 38 matching lines @@
                 ret = ar6000_init(dev);
                 rtnl_unlock();
             }
             else
             {
                 ret = BMIDone(hifDevice);
             }
             break;
 
         case AR6000_XIOCTL_BMI_READ_MEMORY:
-            get_user(address, (unsigned int *)userdata);
-            get_user(length, (unsigned int *)userdata + 1);
+             if (get_user(address, (unsigned int *)userdata) ||
+                get_user(length, (unsigned int *)userdata + 1)) {
+                ret = -EFAULT;
+                break;
+            }
+
             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Read Memory (address: 0x%x, length: %d)\n",
                              address, length));
             if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
                 A_MEMZERO(buffer, length);
                 ret = BMIReadMemory(hifDevice, address, buffer, length);
                 if (copy_to_user(rq->ifr_data, buffer, length)) {
                     ret = -EFAULT;
                 }
                 A_FREE(buffer);
             } else {
                 ret = -ENOMEM;
             }
             break;
 
         case AR6000_XIOCTL_BMI_WRITE_MEMORY:
-            get_user(address, (unsigned int *)userdata);
-            get_user(length, (unsigned int *)userdata + 1);
+             if (get_user(address, (unsigned int *)userdata) ||
+                get_user(length, (unsigned int *)userdata + 1)) {
+                ret = -EFAULT;
+                break;
+            }
             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Write Memory (address: 0x%x, length: %d)\n",
                              address, length));
             if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
                 A_MEMZERO(buffer, length);
                 if (copy_from_user(buffer, &userdata[sizeof(address) +
                                    sizeof(length)], length))
                 {
                     ret = -EFAULT;
                 } else {
                     ret = BMIWriteMemory(hifDevice, address, buffer, length);
                 }
                 A_FREE(buffer);
             } else {
                 ret = -ENOMEM;
             }
             break;
 
         case AR6000_XIOCTL_BMI_TEST:
            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("No longer supported\n"));
            ret = -EOPNOTSUPP;
            break;
 
         case AR6000_XIOCTL_BMI_EXECUTE:
-            get_user(address, (unsigned int *)userdata);
-            get_user(param, (unsigned int *)userdata + 1);
+             if (get_user(address, (unsigned int *)userdata) ||
+                get_user(param, (unsigned int *)userdata + 1)) {
+                ret = -EFAULT;
+                break;
+            }
             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Execute (address: 0x%x, param: %d)\n",
                              address, param));
             ret = BMIExecute(hifDevice, address, (A_UINT32*)&param);
-            put_user(param, (unsigned int *)rq->ifr_data); /* return value */
+            /* return value */
+            if (put_user(param, (unsigned int *)rq->ifr_data)) {
+                ret = -EFAULT;
+                break;
+            }
             break;
 
         case AR6000_XIOCTL_BMI_SET_APP_START:
-            get_user(address, (unsigned int *)userdata);
+            if (get_user(address, (unsigned int *)userdata)) {
+                ret = -EFAULT;
+                break;
+            }
             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Set App Start (address: 0x%x)\n", address));
             ret = BMISetAppStart(hifDevice, address);
             break;
 
         case AR6000_XIOCTL_BMI_READ_SOC_REGISTER:
-            get_user(address, (unsigned int *)userdata);
+            if (get_user(address, (unsigned int *)userdata)) {
+                ret = -EFAULT;
+                break;
+            }
             ret = BMIReadSOCRegister(hifDevice, address, (A_UINT32*)&param);
-            put_user(param, (unsigned int *)rq->ifr_data); /* return value */
+            /* return value */
+            if (put_user(param, (unsigned int *)rq->ifr_data)) {
+                ret = -EFAULT;
+                break;
+            }
             break;
 
         case AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER:
-            get_user(address, (unsigned int *)userdata);
-            get_user(param, (unsigned int *)userdata + 1);
+            if (get_user(address, (unsigned int *)userdata) ||
+                get_user(param, (unsigned int *)userdata + 1)) {
+                ret = -EFAULT;
+                break;
+            }
             ret = BMIWriteSOCRegister(hifDevice, address, param);
             break;
 
 #ifdef HTC_RAW_INTERFACE
         case AR6000_XIOCTL_HTC_RAW_OPEN:
             ret = A_OK;
             if (!arRawIfEnabled(ar)) {
                 /* make sure block size is set in case the target was reset since last
                   * BMI phase (i.e. flashup downloads) */
                 ret = ar6000_set_htc_params(ar->arHifDevice,
@@ skipping 17 matching lines @@
                 ret = ar6000_htc_raw_close(ar);
                 arRawIfEnabled(ar) = FALSE;
             } else {
                 ret = A_ERROR;
             }
             break;
 
         case AR6000_XIOCTL_HTC_RAW_READ:
             if (arRawIfEnabled(ar)) {
                 unsigned int streamID;
-                get_user(streamID, (unsigned int *)userdata);
-                get_user(length, (unsigned int *)userdata + 1);
+                if (get_user(streamID, (unsigned int *)userdata) ||
+                    get_user(length, (unsigned int *)userdata + 1)) {
+                    ret = -EFAULT;
+                    break;
+                }
                 buffer = (unsigned char*)rq->ifr_data + sizeof(length);
                 ret = ar6000_htc_raw_read(ar, (HTC_RAW_STREAM_ID)streamID,
                                           (char*)buffer, length);
-                put_user(ret, (unsigned int *)rq->ifr_data);
+                if (put_user(ret, (unsigned int *)rq->ifr_data)) {
+                    ret = -EFAULT;
+                    break;
+                }
             } else {
                 ret = A_ERROR;
             }
             break;
 
         case AR6000_XIOCTL_HTC_RAW_WRITE:
             if (arRawIfEnabled(ar)) {
                 unsigned int streamID;
-                get_user(streamID, (unsigned int *)userdata);
-                get_user(length, (unsigned int *)userdata + 1);
+                if (get_user(streamID, (unsigned int *)userdata) ||
+                    get_user(length, (unsigned int *)userdata + 1)) {
+                    ret = -EFAULT;
+                    break;
+                }
                 buffer = (unsigned char*)userdata + sizeof(streamID) + sizeof(length);
                 ret = ar6000_htc_raw_write(ar, (HTC_RAW_STREAM_ID)streamID,
                                            (char*)buffer, length);
-                put_user(ret, (unsigned int *)rq->ifr_data);
+                if (put_user(ret, (unsigned int *)rq->ifr_data)) {
+                    ret = -EFAULT;
+                    break;
+                }
             } else {
                 ret = A_ERROR;
             }
             break;
 #endif /* HTC_RAW_INTERFACE */
 
         case AR6000_XIOCTL_BMI_LZ_STREAM_START:
-            get_user(address, (unsigned int *)userdata);
+            if (get_user(address, (unsigned int *)userdata)) {
+                ret = -EFAULT;
+                break;
+            }
             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Start Compressed Stream (address: 0x%x)\n", address));
             ret = BMILZStreamStart(hifDevice, address);
             break;
 
         case AR6000_XIOCTL_BMI_LZ_DATA:
-            get_user(length, (unsigned int *)userdata);
+            if (get_user(length, (unsigned int *)userdata)) {
+                ret = -EFAULT;
+                break;
+            }
             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Send Compressed Data (length: %d)\n", length));
             if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
                 A_MEMZERO(buffer, length);
                 if (copy_from_user(buffer, &userdata[sizeof(length)], length))
                 {
                     ret = -EFAULT;
                 } else {
                     ret = BMILZData(hifDevice, buffer, length);
                 }
                 A_FREE(buffer);
             } else {
                 ret = -ENOMEM;
             }
             break;
 
 #if defined(CONFIG_TARGET_PROFILE_SUPPORT)
         /*
          * Optional support for Target-side profiling.
          * Not needed in production.
          */
 
         /* Configure Target-side profiling */
         case AR6000_XIOCTL_PROF_CFG:
         {
             A_UINT32 period;
             A_UINT32 nbins;
-            get_user(period, (unsigned int *)userdata);
-            get_user(nbins, (unsigned int *)userdata + 1);
+            if (get_user(period, (unsigned int *)userdata) ||
+                get_user(nbins, (unsigned int *)userdata + 1)) {
+                ret = -EFAULT;
+                break;
+            }
 
             if (wmi_prof_cfg_cmd(ar->arWmi, period, nbins) != A_OK) {
                 ret = -EIO;
             }
 
             break;
         }
 
         /* Start a profiling bucket/bin at the specified address */
         case AR6000_XIOCTL_PROF_ADDR_SET:
         {
             A_UINT32 addr;
-            get_user(addr, (unsigned int *)userdata);
+            if (get_user(addr, (unsigned int *)userdata)) {
+                ret = -EFAULT;
+                break;
+            }
 
             if (wmi_prof_addr_set_cmd(ar->arWmi, addr) != A_OK) {
                 ret = -EIO;
             }
 
             break;
         }
 
         /* START Target-side profiling */
         case AR6000_XIOCTL_PROF_START:
@@ skipping 229 matching lines @@
             } else {
                 if (wmi_bssfilter_cmd(ar->arWmi, filt.bssFilter, filt.ieMask)
                         != A_OK) {
                     ret = -EIO;
                 } else {
                     ar->arUserBssFilter = param;
                 }
             }
             break;
         }
+
         case AR6000_IOCTL_WMI_SET_SNRTHRESHOLD:
         {
             ret = ar6000_ioctl_set_snr_threshold(dev, rq);
             break;
         }
         case AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD:
         {
             ret = ar6000_ioctl_set_rssi_threshold(dev, rq);
             break;
         }
@@ skipping 31 matching lines @@
                 {
                     ret = -EIO;
                 }
             }
 
             break;
         }
         case AR6000_XIOCTL_WMI_SET_RTS:
         {
             WMI_SET_RTS_CMD rtsCmd;
-
             if (ar->arWmiReady == FALSE) {
                 ret = -EIO;
             } else if (copy_from_user(&rtsCmd, userdata,
                                    sizeof(rtsCmd)))
             {
                 ret = -EFAULT;
             } else {
                 ar->arRTS = rtsCmd.threshold;
                 if (wmi_set_rts_cmd(ar->arWmi, rtsCmd.threshold)
                        != A_OK)
@@ skipping 64 matching lines @@
             ret = ar6000_ioctl_set_error_report_bitmask(dev, rq);
             break;
         }
         case AR6000_IOCTL_WMI_SET_ASSOC_INFO:
         {
             WMI_SET_ASSOC_INFO_CMD cmd;
             A_UINT8 assocInfo[WMI_MAX_ASSOC_INFO_LEN];
 
             if (ar->arWmiReady == FALSE) {
                 ret = -EIO;
-            } else {
-                get_user(cmd.ieType, userdata);
-                if (cmd.ieType >= WMI_MAX_ASSOC_INFO_TYPE) {
-                    ret = -EIO;
-                } else {
-                    get_user(cmd.bufferSize, userdata + 1);
-                    if (cmd.bufferSize > WMI_MAX_ASSOC_INFO_LEN) {
-                        ret = -EFAULT;
-                        break;
-                    }
-                    if (copy_from_user(assocInfo, userdata + 2,
-                                       cmd.bufferSize))
-                    {
-                        ret = -EFAULT;
-                    } else {
-                        if (wmi_associnfo_cmd(ar->arWmi, cmd.ieType,
-                                                 cmd.bufferSize,
-                                                 assocInfo) != A_OK)
-                        {
-                            ret = -EIO;
-                        }
-                    }
-                }
-            }
+                break;
+            }
+
+            if (get_user(cmd.ieType, userdata)) {
+                ret = -EFAULT;
+                break;
+            }
+            if (cmd.ieType >= WMI_MAX_ASSOC_INFO_TYPE) {
+                ret = -EIO;
+                break;
+            }
+
+            if (get_user(cmd.bufferSize, userdata + 1) ||
+                (cmd.bufferSize > WMI_MAX_ASSOC_INFO_LEN) ||
+                copy_from_user(assocInfo, userdata + 2, cmd.bufferSize)) {
+                ret = -EFAULT;
+                break;
+            }
+            if (wmi_associnfo_cmd(ar->arWmi, cmd.ieType,
+                                  cmd.bufferSize, assocInfo) != A_OK) {
+                ret = -EIO;
+                break;
+            }
             break;
         }
         case AR6000_IOCTL_WMI_SET_ACCESS_PARAMS:
         {
             ret = ar6000_ioctl_set_access_params(dev, rq);
             break;
         }
         case AR6000_IOCTL_WMI_SET_DISC_TIMEOUT:
         {
             ret = ar6000_ioctl_set_disconnect_timeout(dev, rq);
@@ skipping 512 matching lines @@
             break;
         case AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS:
             ret = ar6000_ioctl_set_powersave_timers(dev, userdata);
             break;
         case AR6000_XIOCTRL_WMI_GET_POWER_MODE:
             ret = ar6000_ioctl_get_power_mode(dev, rq);
             break;
         case AR6000_XIOCTRL_WMI_SET_WLAN_STATE:
         {
             AR6000_WLAN_STATE state;
-            get_user(state, (unsigned int *)userdata);
-            if (ar6000_set_wlan_state(ar, state)!=A_OK) {
+            if (get_user(state, (unsigned int *)userdata))
+                ret = -EFAULT;
+            else if (ar6000_set_wlan_state(ar, state) != A_OK)
                 ret = -EIO;
-            }       
             break;
         }
         case AR6000_XIOCTL_WMI_GET_ROAM_DATA:
             ret = ar6000_ioctl_get_roam_data(dev, rq);
             break;
 
         case AR6000_XIOCTL_WMI_SET_BT_STATUS:
             ret = ar6000_xioctl_set_bt_status_cmd(dev, userdata);
             break;
 
@@ skipping 190 matching lines @@
                 if (wmi_set_reassocmode_cmd(ar->arWmi, setReassocMode.mode) != A_OK)
                 {
                     ret = -EIO;
                 }
             }
             break;
         }
         case AR6000_XIOCTL_DIAG_READ:
         {
             A_UINT32 addr, data;
-            get_user(addr, (unsigned int *)userdata);
+            if (get_user(addr, (unsigned int *)userdata)) {
+                ret = -EFAULT;
+                break;
+            }
             addr = TARG_VTOP(ar->arTargetType, addr);
             if (ar6000_ReadRegDiag(ar->arHifDevice, &addr, &data) != A_OK) {
                 ret = -EIO;
             }
-            put_user(data, (unsigned int *)userdata + 1);
+            if (put_user(data, (unsigned int *)userdata + 1)) {
+                ret = -EFAULT;
+                break;
+            }
             break;
         }
         case AR6000_XIOCTL_DIAG_WRITE:
         {
             A_UINT32 addr, data;
-            get_user(addr, (unsigned int *)userdata);
-            get_user(data, (unsigned int *)userdata + 1);
+            if (get_user(addr, (unsigned int *)userdata) ||
+                get_user(data, (unsigned int *)userdata + 1)) {
+                ret = -EFAULT;
+                break;
+            }
             addr = TARG_VTOP(ar->arTargetType, addr);
             if (ar6000_WriteRegDiag(ar->arHifDevice, &addr, &data) != A_OK) {
                 ret = -EIO;
             }
             break;
         }
         case AR6000_XIOCTL_WMI_SET_KEEPALIVE:
         {
              WMI_SET_KEEPALIVE_CMD setKeepAlive;
              if (ar->arWmiReady == FALSE) {
@@ skipping 133 matching lines @@
         case AR6000_XIOCTL_WMI_SET_APPIE:
         {
             WMI_SET_APPIE_CMD appIEcmd;
             A_UINT8           appIeInfo[IEEE80211_APPIE_FRAME_MAX_LEN];
             A_UINT32            fType,ieLen;
 
             if (ar->arWmiReady == FALSE) {
                 ret = -EIO;
                 goto ioctl_done;
             }
-            get_user(fType, (A_UINT32 *)userdata);
+            if (get_user(fType, (A_UINT32 *)userdata)) {
+                ret = -EFAULT;
+                break;
+            }
             appIEcmd.mgmtFrmType = fType;
             if (appIEcmd.mgmtFrmType >= IEEE80211_APPIE_NUM_OF_FRAME) {
                 ret = -EIO;
             } else {
-                get_user(ieLen, (A_UINT32 *)(userdata + 4));
+                if (get_user(ieLen, (A_UINT32 *)(userdata + 4))) {
+                    ret = -EFAULT;
+                    break;
+                }
                 appIEcmd.ieLen = ieLen;
                 A_PRINTF("WPSIE: Type-%d, Len-%d\n",appIEcmd.mgmtFrmType, appIEcmd.ieLen);
                 if (appIEcmd.ieLen > IEEE80211_APPIE_FRAME_MAX_LEN) {
                     ret = -EIO;
                     break;
                 }
                 if (copy_from_user(appIeInfo, userdata + 8, appIEcmd.ieLen)) {
                     ret = -EFAULT;
                 } else {
                     if (wmi_set_appie_cmd(ar->arWmi, appIEcmd.mgmtFrmType,
@@ skipping 51 matching lines @@
             break;
         }
         case AR6000_XIOCTL_BMI_ROMPATCH_INSTALL:
         {
             A_UINT32 ROM_addr;
             A_UINT32 RAM_addr;
             A_UINT32 nbytes;
             A_UINT32 do_activate;
             A_UINT32 rompatch_id;
 
-            get_user(ROM_addr, (A_UINT32 *)userdata);
-            get_user(RAM_addr, (A_UINT32 *)userdata + 1);
-            get_user(nbytes, (A_UINT32 *)userdata + 2);
-            get_user(do_activate, (A_UINT32 *)userdata + 3);
+            if (get_user(ROM_addr, (A_UINT32 *)userdata) ||
+                get_user(RAM_addr, (A_UINT32 *)userdata + 1) ||
+                get_user(nbytes, (A_UINT32 *)userdata + 2) ||
+                get_user(do_activate, (A_UINT32 *)userdata + 3)) {
+                ret = -EFAULT;
+                break;
+            }
             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Install rompatch from ROM: 0x%x to RAM: 0x%x  length: %d\n",
                              ROM_addr, RAM_addr, nbytes));
             ret = BMIrompatchInstall(hifDevice, ROM_addr, RAM_addr,
                                         nbytes, do_activate, &rompatch_id);
             if (ret == A_OK) {
-                put_user(rompatch_id, (unsigned int *)rq->ifr_data); /* return value */
+                /* return value */
+                if (put_user(rompatch_id, (unsigned int *)rq->ifr_data)) {
+                    ret = -EFAULT;
+                    break;
+                }
             }
             break;
         }
 
         case AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL:
         {
             A_UINT32 rompatch_id;
 
-            get_user(rompatch_id, (A_UINT32 *)userdata);
+            if (get_user(rompatch_id, (A_UINT32 *)userdata)) {
+                ret = -EFAULT;
+                break;
+            }
             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("UNinstall rompatch_id %d\n", rompatch_id));
             ret = BMIrompatchUninstall(hifDevice, rompatch_id);
             break;
         }
 
         case AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE:
         case AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE:
         {
             A_UINT32 rompatch_count;
 
-            get_user(rompatch_count, (A_UINT32 *)userdata);
+            if (get_user(rompatch_count, (A_UINT32 *)userdata)) {
+                ret = -EFAULT;
+                break;
+            }
             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Change rompatch activation count=%d\n", rompatch_count));
             length = sizeof(A_UINT32) * rompatch_count;
             if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
                 A_MEMZERO(buffer, length);
                 if (copy_from_user(buffer, &userdata[sizeof(rompatch_count)], length))
                 {
                     ret = -EFAULT;
                 } else {
                     if (cmd == AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE) {
                         ret = BMIrompatchActivate(hifDevice, rompatch_count, (A_UINT32 *)buffer);
@@ skipping 143 matching lines @@
                 if (wmi_del_wow_pattern_cmd(ar->arWmi,
                                 &delWowPattern) != A_OK)
                 {
                     ret = -EIO;
                 }
             }
             break;
         }
         case AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE:
             if (ar->arHtcTarget != NULL) {
+#ifdef ATH_DEBUG_MODULE
                 HTCDumpCreditStates(ar->arHtcTarget);
+#endif /* ATH_DEBUG_MODULE */
 #ifdef HTC_EP_STAT_PROFILING
                 {
                     HTC_ENDPOINT_STATS stats;
                     int i;
 
                     for (i = 0; i < 5; i++) {
                         if (HTCGetEndpointStatistics(ar->arHtcTarget,
                                                      i,
                                                      HTC_EP_STAT_SAMPLE_AND_CLEAR,
                                                      &stats)) {
@@ skipping 582 matching lines @@
             } else if(copy_to_user((WMI_BEACON_INT_CMD *)rq->ifr_data,
                                     &bi, sizeof(WMI_BEACON_INT_CMD))) {
                     ret = -EFAULT;
             }
             break;
         }
         case AR6000_XIOCTL_AP_GET_RTS:
         {
             WMI_SET_RTS_CMD rts;
             rts.threshold = ar->arRTS;
-
+             
             if (ar->arWmiReady == FALSE) {
                 ret = -EIO;
             } else if(copy_to_user((WMI_SET_RTS_CMD *)rq->ifr_data,
                                     &rts, sizeof(WMI_SET_RTS_CMD))) {
                     ret = -EFAULT;
             }
             break;
         }
         case AR6000_XIOCTL_FETCH_TARGET_REGS:
         {
@@ skipping 30 matching lines @@
                 wmiSleepEvent.sleepState = WMI_REPORT_SLEEP_STATUS_IS_AWAKE;
             } else {
                 wmiSleepEvent.sleepState = WMI_REPORT_SLEEP_STATUS_IS_DEEP_SLEEP;
             }
             rq->ifr_ifru.ifru_ivalue = ar->arWlanState; /* return value */
 
             ar6000_send_event_to_app(ar, WMI_REPORT_SLEEP_STATE_EVENTID, (A_UINT8*)&wmiSleepEvent,
                                      sizeof(WMI_REPORT_SLEEP_STATE_EVENTID));
             break;
         }
+#ifdef CONFIG_PM
+        case AR6000_XIOCTL_SET_BT_HW_POWER_STATE:
+        {
+            unsigned int state;
+            if (get_user(state, (unsigned int *)userdata)) {
+                ret = -EFAULT;
+                break;
+            }
+            if (ar6000_set_bt_hw_state(ar, state)!=A_OK) {
+                ret = -EIO;
+            }       
+        }
+            break;
+        case AR6000_XIOCTL_GET_BT_HW_POWER_STATE:
+            rq->ifr_ifru.ifru_ivalue = !ar->arBTOff; /* return value */
+            break;
+#endif
+
+        case AR6000_XIOCTL_WMI_SET_TX_SGI_PARAM:
+        {
+             WMI_SET_TX_SGI_PARAM_CMD SGICmd;
+
+             if (ar->arWmiReady == FALSE) {
+                 ret = -EIO;
+             } else if (copy_from_user(&SGICmd, userdata,
+                                       sizeof(SGICmd))){
+                 ret = -EFAULT;
+             } else{
+                     if (wmi_SGI_cmd(ar->arWmi, SGICmd.sgiMask, SGICmd.sgiPERThreshold) != A_OK) {
+                         ret = -EIO;
+                     }
+
+             }
+             break;
+        }
+
+        case AR6000_XIOCTL_ADD_AP_INTERFACE:
+#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
+        {
+            char ap_ifname[IFNAMSIZ] = {0,};
+            if (copy_from_user(ap_ifname, userdata, IFNAMSIZ)) {
+                ret = -EFAULT;
+            } else {
+                if (ar6000_add_ap_interface(ar, ap_ifname) != A_OK) {
+                    ret = -EIO;
+                } 
+            }
+        }
+#else
+            ret = -EOPNOTSUPP;
+#endif
+            break;
+        case AR6000_XIOCTL_REMOVE_AP_INTERFACE:
+#ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
+            if (ar6000_remove_ap_interface(ar) != A_OK) {
+                ret = -EIO;
+            } 
+#else
+            ret = -EOPNOTSUPP;
+#endif
+            break;
+
         default:
             ret = -EOPNOTSUPP;
     }
 
 ioctl_done:
     rtnl_lock(); /* restore rtnl state */
     dev_put(dev);
 
     return ret;
 }
@@ skipping 50 matching lines @@
             return 0;
 
         A_MEMZERO(a->acl_mac[acl->index],ATH_MAC_LEN);
         a->index = a->index & ~(1 << acl->index);
         a->wildcard[acl->index] = 0;
         return 1;
     }
 
     return 0;
 }