libertas: fix buffer overrun
[safe/jmp/linux-2.6] / drivers / net / wireless / libertas / debugfs.c
index b0a76c5..0aa0ce3 100644 (file)
@@ -10,6 +10,7 @@
 #include "decl.h"
 #include "host.h"
 #include "debugfs.h"
+#include "cmd.h"
 
 static struct dentry *lbs_dir;
 static char *szStates[] = {
@@ -18,7 +19,7 @@ static char *szStates[] = {
 };
 
 #ifdef PROC_DEBUG
-static void lbs_debug_init(struct lbs_private *priv, struct net_device *dev);
+static void lbs_debug_init(struct lbs_private *priv);
 #endif
 
 static int open_file_generic(struct inode *inode, struct file *file)
@@ -45,9 +46,9 @@ static ssize_t lbs_dev_info(struct file *file, char __user *userbuf,
        ssize_t res;
 
        pos += snprintf(buf+pos, len-pos, "state = %s\n",
-                               szStates[priv->adapter->connect_status]);
+                               szStates[priv->connect_status]);
        pos += snprintf(buf+pos, len-pos, "region_code = %02x\n",
-                               (u32) priv->adapter->regioncode);
+                               (u32) priv->regioncode);
 
        res = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
 
@@ -70,14 +71,14 @@ static ssize_t lbs_getscantable(struct file *file, char __user *userbuf,
        pos += snprintf(buf+pos, len-pos,
                "# | ch  | rssi |       bssid       |   cap    | Qual | SSID \n");
 
-       mutex_lock(&priv->adapter->lock);
-       list_for_each_entry (iter_bss, &priv->adapter->network_list, list) {
+       mutex_lock(&priv->lock);
+       list_for_each_entry (iter_bss, &priv->network_list, list) {
                u16 ibss = (iter_bss->capability & WLAN_CAPABILITY_IBSS);
                u16 privacy = (iter_bss->capability & WLAN_CAPABILITY_PRIVACY);
                u16 spectrum_mgmt = (iter_bss->capability & WLAN_CAPABILITY_SPECTRUM_MGMT);
 
                pos += snprintf(buf+pos, len-pos,
-                       "%02u| %03d | %04ld | %s |",
+                       "%02u| %03d | %04d | %s |",
                        numscansdone, iter_bss->channel, iter_bss->rssi,
                        print_mac(mac, iter_bss->bssid));
                pos += snprintf(buf+pos, len-pos, " %04x-", iter_bss->capability);
@@ -90,7 +91,7 @@ static ssize_t lbs_getscantable(struct file *file, char __user *userbuf,
 
                numscansdone++;
        }
-       mutex_unlock(&priv->adapter->lock);
+       mutex_unlock(&priv->lock);
 
        res = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
 
@@ -103,241 +104,66 @@ static ssize_t lbs_sleepparams_write(struct file *file,
                                loff_t *ppos)
 {
        struct lbs_private *priv = file->private_data;
-       ssize_t buf_size, res;
+       ssize_t buf_size, ret;
+       struct sleep_params sp;
        int p1, p2, p3, p4, p5, p6;
        unsigned long addr = get_zeroed_page(GFP_KERNEL);
        char *buf = (char *)addr;
 
        buf_size = min(count, len - 1);
        if (copy_from_user(buf, user_buf, buf_size)) {
-               res = -EFAULT;
+               ret = -EFAULT;
                goto out_unlock;
        }
-       res = sscanf(buf, "%d %d %d %d %d %d", &p1, &p2, &p3, &p4, &p5, &p6);
-       if (res != 6) {
-               res = -EFAULT;
+       ret = sscanf(buf, "%d %d %d %d %d %d", &p1, &p2, &p3, &p4, &p5, &p6);
+       if (ret != 6) {
+               ret = -EINVAL;
                goto out_unlock;
        }
-       priv->adapter->sp.sp_error = p1;
-       priv->adapter->sp.sp_offset = p2;
-       priv->adapter->sp.sp_stabletime = p3;
-       priv->adapter->sp.sp_calcontrol = p4;
-       priv->adapter->sp.sp_extsleepclk = p5;
-       priv->adapter->sp.sp_reserved = p6;
-
-       res = lbs_prepare_and_send_command(priv,
-                               CMD_802_11_SLEEP_PARAMS,
-                               CMD_ACT_SET,
-                               CMD_OPTION_WAITFORRSP, 0, NULL);
-
-       if (!res)
-               res = count;
-       else
-               res = -EINVAL;
+       sp.sp_error = p1;
+       sp.sp_offset = p2;
+       sp.sp_stabletime = p3;
+       sp.sp_calcontrol = p4;
+       sp.sp_extsleepclk = p5;
+       sp.sp_reserved = p6;
+
+       ret = lbs_cmd_802_11_sleep_params(priv, CMD_ACT_SET, &sp);
+       if (!ret)
+               ret = count;
+       else if (ret > 0)
+               ret = -EINVAL;
 
 out_unlock:
        free_page(addr);
-       return res;
+       return ret;
 }
 
 static ssize_t lbs_sleepparams_read(struct file *file, char __user *userbuf,
                                  size_t count, loff_t *ppos)
 {
        struct lbs_private *priv = file->private_data;
-       struct lbs_adapter *adapter = priv->adapter;
-       ssize_t res;
+       ssize_t ret;
        size_t pos = 0;
+       struct sleep_params sp;
        unsigned long addr = get_zeroed_page(GFP_KERNEL);
        char *buf = (char *)addr;
 
-       res = lbs_prepare_and_send_command(priv,
-                               CMD_802_11_SLEEP_PARAMS,
-                               CMD_ACT_GET,
-                               CMD_OPTION_WAITFORRSP, 0, NULL);
-       if (res) {
-               res = -EFAULT;
+       ret = lbs_cmd_802_11_sleep_params(priv, CMD_ACT_GET, &sp);
+       if (ret)
                goto out_unlock;
-       }
-
-       pos += snprintf(buf, len, "%d %d %d %d %d %d\n", adapter->sp.sp_error,
-                       adapter->sp.sp_offset, adapter->sp.sp_stabletime,
-                       adapter->sp.sp_calcontrol, adapter->sp.sp_extsleepclk,
-                       adapter->sp.sp_reserved);
 
-       res = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+       pos += snprintf(buf, len, "%d %d %d %d %d %d\n", sp.sp_error,
+                       sp.sp_offset, sp.sp_stabletime,
+                       sp.sp_calcontrol, sp.sp_extsleepclk,
+                       sp.sp_reserved);
 
-out_unlock:
-       free_page(addr);
-       return res;
-}
-
-static ssize_t lbs_extscan(struct file *file, const char __user *userbuf,
-                                 size_t count, loff_t *ppos)
-{
-       struct lbs_private *priv = file->private_data;
-       ssize_t res, buf_size;
-       union iwreq_data wrqu;
-       unsigned long addr = get_zeroed_page(GFP_KERNEL);
-       char *buf = (char *)addr;
-
-       buf_size = min(count, len - 1);
-       if (copy_from_user(buf, userbuf, buf_size)) {
-               res = -EFAULT;
-               goto out_unlock;
-       }
-
-       lbs_send_specific_ssid_scan(priv, buf, strlen(buf)-1, 0);
-
-       memset(&wrqu, 0, sizeof(union iwreq_data));
-       wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
+       ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
 
 out_unlock:
        free_page(addr);
-       return count;
-}
-
-static void lbs_parse_bssid(char *buf, size_t count,
-       struct lbs_ioctl_user_scan_cfg *scan_cfg)
-{
-       char *hold;
-       unsigned int mac[ETH_ALEN];
-
-       hold = strstr(buf, "bssid=");
-       if (!hold)
-               return;
-       hold += 6;
-       sscanf(hold, "%02x:%02x:%02x:%02x:%02x:%02x",
-              mac, mac+1, mac+2, mac+3, mac+4, mac+5);
-       memcpy(scan_cfg->bssid, mac, ETH_ALEN);
-}
-
-static void lbs_parse_ssid(char *buf, size_t count,
-       struct lbs_ioctl_user_scan_cfg *scan_cfg)
-{
-       char *hold, *end;
-       ssize_t size;
-
-       hold = strstr(buf, "ssid=");
-       if (!hold)
-               return;
-       hold += 5;
-       end = strchr(hold, ' ');
-       if (!end)
-               end = buf + count - 1;
-
-       size = min((size_t)IW_ESSID_MAX_SIZE, (size_t) (end - hold));
-       strncpy(scan_cfg->ssid, hold, size);
-
-       return;
-}
-
-static int lbs_parse_clear(char *buf, size_t count, const char *tag)
-{
-       char *hold;
-       int val;
-
-       hold = strstr(buf, tag);
-       if (!hold)
-               return 0;
-       hold += strlen(tag);
-       sscanf(hold, "%d", &val);
-
-       if (val != 0)
-               val = 1;
-
-       return val;
-}
-
-static int lbs_parse_dur(char *buf, size_t count,
-       struct lbs_ioctl_user_scan_cfg *scan_cfg)
-{
-       char *hold;
-       int val;
-
-       hold = strstr(buf, "dur=");
-       if (!hold)
-               return 0;
-       hold += 4;
-       sscanf(hold, "%d", &val);
-
-       return val;
-}
-
-static void lbs_parse_type(char *buf, size_t count,
-       struct lbs_ioctl_user_scan_cfg *scan_cfg)
-{
-       char *hold;
-       int val;
-
-       hold = strstr(buf, "type=");
-       if (!hold)
-               return;
-       hold += 5;
-       sscanf(hold, "%d", &val);
-
-       /* type=1,2 or 3 */
-       if (val < 1 || val > 3)
-               return;
-
-       scan_cfg->bsstype = val;
-
-       return;
-}
-
-static ssize_t lbs_setuserscan(struct file *file,
-                                   const char __user *userbuf,
-                                   size_t count, loff_t *ppos)
-{
-       struct lbs_private *priv = file->private_data;
-       ssize_t res, buf_size;
-       struct lbs_ioctl_user_scan_cfg *scan_cfg;
-       union iwreq_data wrqu;
-       int dur;
-       char *buf = (char *)get_zeroed_page(GFP_KERNEL);
-
-       if (!buf)
-               return -ENOMEM;
-               
-       buf_size = min(count, len - 1);
-       if (copy_from_user(buf, userbuf, buf_size)) {
-               res = -EFAULT;
-               goto out_buf;
-       }
-
-       scan_cfg = kzalloc(sizeof(struct lbs_ioctl_user_scan_cfg), GFP_KERNEL);
-       if (!scan_cfg) {
-               res = -ENOMEM;
-               goto out_buf;
-       }
-       res = count;
-
-       scan_cfg->bsstype = LBS_SCAN_BSS_TYPE_ANY;
-
-       dur = lbs_parse_dur(buf, count, scan_cfg);
-       lbs_parse_bssid(buf, count, scan_cfg);
-       scan_cfg->clear_bssid = lbs_parse_clear(buf, count, "clear_bssid=");
-       lbs_parse_ssid(buf, count, scan_cfg);
-       scan_cfg->clear_ssid = lbs_parse_clear(buf, count, "clear_ssid=");
-       lbs_parse_type(buf, count, scan_cfg);
-
-       lbs_scan_networks(priv, scan_cfg, 1);
-       wait_event_interruptible(priv->adapter->cmd_pending,
-                                priv->adapter->surpriseremoved || !priv->adapter->nr_cmd_pending);
-
-       if (priv->adapter->surpriseremoved)
-               goto out_scan_cfg;
-
-       memset(&wrqu, 0x00, sizeof(union iwreq_data));
-       wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
-
- out_scan_cfg:
-       kfree(scan_cfg);
- out_buf:
-       free_page((unsigned long)buf);
-       return res;
+       return ret;
 }
 
-
 /*
  * When calling CMD_802_11_SUBSCRIBE_EVENT with CMD_ACT_GET, me might
  * get a bunch of vendor-specific TLVs (a.k.a. IEs) back from the
@@ -354,20 +180,19 @@ static ssize_t lbs_setuserscan(struct file *file,
  * and returns a pointer to the first data byte of the TLV, or to NULL
  * if the TLV hasn't been found.
  */
-static void *lbs_tlv_find(u16 tlv_type, const u8 *tlv, u16 size)
+static void *lbs_tlv_find(uint16_t tlv_type, const uint8_t *tlv, uint16_t size)
 {
-       __le16 le_type = cpu_to_le16(tlv_type);
-       ssize_t pos = 0;
        struct mrvlietypesheader *tlv_h;
+       uint16_t length;
+       ssize_t pos = 0;
+
        while (pos < size) {
-               u16 length;
                tlv_h = (struct mrvlietypesheader *) tlv;
-               if (tlv_h->type == le_type)
-                       return tlv_h;
-               if (tlv_h->len == 0)
+               if (!tlv_h->len)
                        return NULL;
-               length = le16_to_cpu(tlv_h->len) +
-                       sizeof(struct mrvlietypesheader);
+               if (tlv_h->type == cpu_to_le16(tlv_type))
+                       return tlv_h;
+               length = le16_to_cpu(tlv_h->len) + sizeof(*tlv_h);
                pos += length;
                tlv += length;
        }
@@ -375,98 +200,100 @@ static void *lbs_tlv_find(u16 tlv_type, const u8 *tlv, u16 size)
 }
 
 
-/*
- * This just gets the bitmap of currently subscribed events. Used when
- * adding an additonal event subscription.
- */
-static u16 lbs_get_events_bitmap(struct lbs_private *priv)
-{
-       ssize_t res;
-
-       struct cmd_ds_802_11_subscribe_event *events = kzalloc(
-               sizeof(struct cmd_ds_802_11_subscribe_event),
-               GFP_KERNEL);
-
-       res = lbs_prepare_and_send_command(priv,
-                       CMD_802_11_SUBSCRIBE_EVENT, CMD_ACT_GET,
-                       CMD_OPTION_WAITFORRSP, 0, events);
-
-       if (res) {
-               kfree(events);
-               return 0;
-       }
-       return le16_to_cpu(events->events);
-}
-
-
-static ssize_t lbs_threshold_read(
-       u16 tlv_type, u16 event_mask,
-       struct file *file, char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_threshold_read(uint16_t tlv_type, uint16_t event_mask,
+                                 struct file *file, char __user *userbuf,
+                                 size_t count, loff_t *ppos)
 {
+       struct cmd_ds_802_11_subscribe_event *subscribed;
+       struct mrvlietypes_thresholds *got;
        struct lbs_private *priv = file->private_data;
-       ssize_t res = 0;
+       ssize_t ret = 0;
        size_t pos = 0;
-       unsigned long addr = get_zeroed_page(GFP_KERNEL);
-       char *buf = (char *)addr;
+       char *buf;
        u8 value;
        u8 freq;
+       int events = 0;
 
-       struct cmd_ds_802_11_subscribe_event *events = kzalloc(
-               sizeof(struct cmd_ds_802_11_subscribe_event),
-               GFP_KERNEL);
-       struct mrvlietypes_thresholds *got;
+       buf = (char *)get_zeroed_page(GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
 
-       res = lbs_prepare_and_send_command(priv,
-                       CMD_802_11_SUBSCRIBE_EVENT, CMD_ACT_GET,
-                       CMD_OPTION_WAITFORRSP, 0, events);
-       if (res) {
-               kfree(events);
-               return res;
+       subscribed = kzalloc(sizeof(*subscribed), GFP_KERNEL);
+       if (!subscribed) {
+               ret = -ENOMEM;
+               goto out_page;
        }
 
-       got = lbs_tlv_find(tlv_type, events->tlv, sizeof(events->tlv));
+       subscribed->hdr.size = cpu_to_le16(sizeof(*subscribed));
+       subscribed->action = cpu_to_le16(CMD_ACT_GET);
+
+       ret = lbs_cmd_with_response(priv, CMD_802_11_SUBSCRIBE_EVENT, subscribed);
+       if (ret)
+               goto out_cmd;
+
+       got = lbs_tlv_find(tlv_type, subscribed->tlv, sizeof(subscribed->tlv));
        if (got) {
                value = got->value;
                freq  = got->freq;
-       }
-       kfree(events);
+               events = le16_to_cpu(subscribed->events);
 
-       if (got)
                pos += snprintf(buf, len, "%d %d %d\n", value, freq,
-                       !!(le16_to_cpu(events->events) & event_mask));
+                               !!(events & event_mask));
+       }
 
-       res = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+       ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
 
-       free_page(addr);
-       return res;
+ out_cmd:
+       kfree(subscribed);
+
+ out_page:
+       free_page((unsigned long)buf);
+       return ret;
 }
 
 
-static ssize_t lbs_threshold_write(
-       u16 tlv_type, u16 event_mask,
-       struct file *file,
-       const char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_threshold_write(uint16_t tlv_type, uint16_t event_mask,
+                                  struct file *file,
+                                  const char __user *userbuf, size_t count,
+                                  loff_t *ppos)
 {
-       struct lbs_private *priv = file->private_data;
-       ssize_t res, buf_size;
-       int value, freq, curr_mask, new_mask;
-       unsigned long addr = get_zeroed_page(GFP_KERNEL);
-       char *buf = (char *)addr;
        struct cmd_ds_802_11_subscribe_event *events;
+       struct mrvlietypes_thresholds *tlv;
+       struct lbs_private *priv = file->private_data;
+       ssize_t buf_size;
+       int value, freq, new_mask;
+       uint16_t curr_mask;
+       char *buf;
+       int ret;
+
+       buf = (char *)get_zeroed_page(GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
 
        buf_size = min(count, len - 1);
        if (copy_from_user(buf, userbuf, buf_size)) {
-               res = -EFAULT;
-               goto out_unlock;
+               ret = -EFAULT;
+               goto out_page;
        }
-       res = sscanf(buf, "%d %d %d", &value, &freq, &new_mask);
-       if (res != 3) {
-               res = -EFAULT;
-               goto out_unlock;
+       ret = sscanf(buf, "%d %d %d", &value, &freq, &new_mask);
+       if (ret != 3) {
+               ret = -EINVAL;
+               goto out_page;
        }
-       curr_mask = lbs_get_events_bitmap(priv);
+       events = kzalloc(sizeof(*events), GFP_KERNEL);
+       if (!events) {
+               ret = -ENOMEM;
+               goto out_page;
+       }
+
+       events->hdr.size = cpu_to_le16(sizeof(*events));
+       events->action = cpu_to_le16(CMD_ACT_GET);
+
+       ret = lbs_cmd_with_response(priv, CMD_802_11_SUBSCRIBE_EVENT, events);
+       if (ret)
+               goto out_events;
+
+       curr_mask = le16_to_cpu(events->events);
 
        if (new_mask)
                new_mask = curr_mask | event_mask;
@@ -474,152 +301,132 @@ static ssize_t lbs_threshold_write(
                new_mask = curr_mask & ~event_mask;
 
        /* Now everything is set and we can send stuff down to the firmware */
-       events = kzalloc(
-               sizeof(struct cmd_ds_802_11_subscribe_event),
-               GFP_KERNEL);
-       if (events) {
-               struct mrvlietypes_thresholds *tlv =
-                       (struct mrvlietypes_thresholds *) events->tlv;
-               events->action = cpu_to_le16(CMD_ACT_SET);
-               events->events = cpu_to_le16(new_mask);
-               tlv->header.type = cpu_to_le16(tlv_type);
-               tlv->header.len = cpu_to_le16(
-                       sizeof(struct mrvlietypes_thresholds) -
-                       sizeof(struct mrvlietypesheader));
-               tlv->value = value;
-               if (tlv_type != TLV_TYPE_BCNMISS)
-                       tlv->freq = freq;
-               lbs_prepare_and_send_command(priv,
-                       CMD_802_11_SUBSCRIBE_EVENT, CMD_ACT_SET,
-                       CMD_OPTION_WAITFORRSP, 0, events);
-               kfree(events);
-       }
 
-       res = count;
-out_unlock:
-       free_page(addr);
-       return res;
+       tlv = (void *)events->tlv;
+
+       events->action = cpu_to_le16(CMD_ACT_SET);
+       events->events = cpu_to_le16(new_mask);
+       tlv->header.type = cpu_to_le16(tlv_type);
+       tlv->header.len = cpu_to_le16(sizeof(*tlv) - sizeof(tlv->header));
+       tlv->value = value;
+       if (tlv_type != TLV_TYPE_BCNMISS)
+               tlv->freq = freq;
+
+       /* The command header, the action, the event mask, and one TLV */
+       events->hdr.size = cpu_to_le16(sizeof(events->hdr) + 4 + sizeof(*tlv));
+
+       ret = lbs_cmd_with_response(priv, CMD_802_11_SUBSCRIBE_EVENT, events);
+
+       if (!ret)
+               ret = count;
+ out_events:
+       kfree(events);
+ out_page:
+       free_page((unsigned long)buf);
+       return ret;
 }
 
 
-static ssize_t lbs_lowrssi_read(
-       struct file *file, char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_lowrssi_read(struct file *file, char __user *userbuf,
+                               size_t count, loff_t *ppos)
 {
        return lbs_threshold_read(TLV_TYPE_RSSI_LOW, CMD_SUBSCRIBE_RSSI_LOW,
-               file, userbuf, count, ppos);
+                                 file, userbuf, count, ppos);
 }
 
 
-static ssize_t lbs_lowrssi_write(
-       struct file *file, const char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_lowrssi_write(struct file *file, const char __user *userbuf,
+                                size_t count, loff_t *ppos)
 {
        return lbs_threshold_write(TLV_TYPE_RSSI_LOW, CMD_SUBSCRIBE_RSSI_LOW,
-               file, userbuf, count, ppos);
+                                  file, userbuf, count, ppos);
 }
 
 
-static ssize_t lbs_lowsnr_read(
-       struct file *file, char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_lowsnr_read(struct file *file, char __user *userbuf,
+                              size_t count, loff_t *ppos)
 {
        return lbs_threshold_read(TLV_TYPE_SNR_LOW, CMD_SUBSCRIBE_SNR_LOW,
-               file, userbuf, count, ppos);
+                                 file, userbuf, count, ppos);
 }
 
 
-static ssize_t lbs_lowsnr_write(
-       struct file *file, const char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_lowsnr_write(struct file *file, const char __user *userbuf,
+                               size_t count, loff_t *ppos)
 {
        return lbs_threshold_write(TLV_TYPE_SNR_LOW, CMD_SUBSCRIBE_SNR_LOW,
-               file, userbuf, count, ppos);
+                                  file, userbuf, count, ppos);
 }
 
 
-static ssize_t lbs_failcount_read(
-       struct file *file, char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_failcount_read(struct file *file, char __user *userbuf,
+                                 size_t count, loff_t *ppos)
 {
        return lbs_threshold_read(TLV_TYPE_FAILCOUNT, CMD_SUBSCRIBE_FAILCOUNT,
-               file, userbuf, count, ppos);
+                                 file, userbuf, count, ppos);
 }
 
 
-static ssize_t lbs_failcount_write(
-       struct file *file, const char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_failcount_write(struct file *file, const char __user *userbuf,
+                                  size_t count, loff_t *ppos)
 {
        return lbs_threshold_write(TLV_TYPE_FAILCOUNT, CMD_SUBSCRIBE_FAILCOUNT,
-               file, userbuf, count, ppos);
+                                  file, userbuf, count, ppos);
 }
 
 
-static ssize_t lbs_highrssi_read(
-       struct file *file, char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_highrssi_read(struct file *file, char __user *userbuf,
+                                size_t count, loff_t *ppos)
 {
        return lbs_threshold_read(TLV_TYPE_RSSI_HIGH, CMD_SUBSCRIBE_RSSI_HIGH,
-               file, userbuf, count, ppos);
+                                 file, userbuf, count, ppos);
 }
 
 
-static ssize_t lbs_highrssi_write(
-       struct file *file, const char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_highrssi_write(struct file *file, const char __user *userbuf,
+                                 size_t count, loff_t *ppos)
 {
        return lbs_threshold_write(TLV_TYPE_RSSI_HIGH, CMD_SUBSCRIBE_RSSI_HIGH,
-               file, userbuf, count, ppos);
+                                  file, userbuf, count, ppos);
 }
 
 
-static ssize_t lbs_highsnr_read(
-       struct file *file, char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_highsnr_read(struct file *file, char __user *userbuf,
+                               size_t count, loff_t *ppos)
 {
        return lbs_threshold_read(TLV_TYPE_SNR_HIGH, CMD_SUBSCRIBE_SNR_HIGH,
-               file, userbuf, count, ppos);
+                                 file, userbuf, count, ppos);
 }
 
 
-static ssize_t lbs_highsnr_write(
-       struct file *file, const char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_highsnr_write(struct file *file, const char __user *userbuf,
+                                size_t count, loff_t *ppos)
 {
        return lbs_threshold_write(TLV_TYPE_SNR_HIGH, CMD_SUBSCRIBE_SNR_HIGH,
-               file, userbuf, count, ppos);
+                                  file, userbuf, count, ppos);
 }
 
-static ssize_t lbs_bcnmiss_read(
-       struct file *file, char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_bcnmiss_read(struct file *file, char __user *userbuf,
+                               size_t count, loff_t *ppos)
 {
        return lbs_threshold_read(TLV_TYPE_BCNMISS, CMD_SUBSCRIBE_BCNMISS,
-               file, userbuf, count, ppos);
+                                 file, userbuf, count, ppos);
 }
 
 
-static ssize_t lbs_bcnmiss_write(
-       struct file *file, const char __user *userbuf,
-       size_t count, loff_t *ppos)
+static ssize_t lbs_bcnmiss_write(struct file *file, const char __user *userbuf,
+                                size_t count, loff_t *ppos)
 {
        return lbs_threshold_write(TLV_TYPE_BCNMISS, CMD_SUBSCRIBE_BCNMISS,
-               file, userbuf, count, ppos);
+                                  file, userbuf, count, ppos);
 }
 
 
 
-
-
-
-
-
 static ssize_t lbs_rdmac_read(struct file *file, char __user *userbuf,
                                  size_t count, loff_t *ppos)
 {
        struct lbs_private *priv = file->private_data;
-       struct lbs_adapter *adapter = priv->adapter;
        struct lbs_offset_value offval;
        ssize_t pos = 0;
        int ret;
@@ -634,7 +441,7 @@ static ssize_t lbs_rdmac_read(struct file *file, char __user *userbuf,
                                CMD_OPTION_WAITFORRSP, 0, &offval);
        mdelay(10);
        pos += snprintf(buf+pos, len-pos, "MAC[0x%x] = 0x%08x\n",
-                               priv->mac_offset, adapter->offsetvalue.value);
+                               priv->mac_offset, priv->offsetvalue.value);
 
        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
        free_page(addr);
@@ -702,7 +509,6 @@ static ssize_t lbs_rdbbp_read(struct file *file, char __user *userbuf,
                                  size_t count, loff_t *ppos)
 {
        struct lbs_private *priv = file->private_data;
-       struct lbs_adapter *adapter = priv->adapter;
        struct lbs_offset_value offval;
        ssize_t pos = 0;
        int ret;
@@ -717,7 +523,7 @@ static ssize_t lbs_rdbbp_read(struct file *file, char __user *userbuf,
                                CMD_OPTION_WAITFORRSP, 0, &offval);
        mdelay(10);
        pos += snprintf(buf+pos, len-pos, "BBP[0x%x] = 0x%08x\n",
-                               priv->bbp_offset, adapter->offsetvalue.value);
+                               priv->bbp_offset, priv->offsetvalue.value);
 
        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
        free_page(addr);
@@ -786,7 +592,6 @@ static ssize_t lbs_rdrf_read(struct file *file, char __user *userbuf,
                                  size_t count, loff_t *ppos)
 {
        struct lbs_private *priv = file->private_data;
-       struct lbs_adapter *adapter = priv->adapter;
        struct lbs_offset_value offval;
        ssize_t pos = 0;
        int ret;
@@ -801,7 +606,7 @@ static ssize_t lbs_rdrf_read(struct file *file, char __user *userbuf,
                                CMD_OPTION_WAITFORRSP, 0, &offval);
        mdelay(10);
        pos += snprintf(buf+pos, len-pos, "RF[0x%x] = 0x%08x\n",
-                               priv->rf_offset, adapter->offsetvalue.value);
+                               priv->rf_offset, priv->offsetvalue.value);
 
        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
        free_page(addr);
@@ -885,8 +690,6 @@ static struct lbs_debugfs_files debugfs_files[] = {
                                        write_file_dummy), },
        { "sleepparams", 0644, FOPS(lbs_sleepparams_read,
                                lbs_sleepparams_write), },
-       { "extscan", 0600, FOPS(NULL, lbs_extscan), },
-       { "setuserscan", 0600, FOPS(NULL, lbs_setuserscan), },
 };
 
 static struct lbs_debugfs_files debugfs_events_files[] = {
@@ -975,7 +778,7 @@ void lbs_debugfs_init_one(struct lbs_private *priv, struct net_device *dev)
        }
 
 #ifdef PROC_DEBUG
-       lbs_debug_init(priv, dev);
+       lbs_debug_init(priv);
 #endif
 exit:
        return;
@@ -1008,8 +811,8 @@ void lbs_debugfs_remove_one(struct lbs_private *priv)
 
 #ifdef PROC_DEBUG
 
-#define item_size(n)   (FIELD_SIZEOF(struct lbs_adapter, n))
-#define item_addr(n)   (offsetof(struct lbs_adapter, n))
+#define item_size(n)   (FIELD_SIZEOF(struct lbs_private, n))
+#define item_addr(n)   (offsetof(struct lbs_private, n))
 
 
 struct debug_data {
@@ -1018,10 +821,9 @@ struct debug_data {
        size_t addr;
 };
 
-/* To debug any member of struct lbs_adapter, simply add one line here.
+/* To debug any member of struct lbs_private, simply add one line here.
  */
 static struct debug_data items[] = {
-       {"intcounter", item_size(intcounter), item_addr(intcounter)},
        {"psmode", item_size(psmode), item_addr(psmode)},
        {"psstate", item_size(psstate), item_addr(psstate)},
 };
@@ -1149,7 +951,7 @@ static struct file_operations lbs_debug_fops = {
  *  @param dev     pointer net_device
  *  @return       N/A
  */
-static void lbs_debug_init(struct lbs_private *priv, struct net_device *dev)
+static void lbs_debug_init(struct lbs_private *priv)
 {
        int i;
 
@@ -1157,7 +959,7 @@ static void lbs_debug_init(struct lbs_private *priv, struct net_device *dev)
                return;
 
        for (i = 0; i < num_of_items; i++)
-               items[i].addr += (size_t) priv->adapter;
+               items[i].addr += (size_t) priv;
 
        priv->debugfs_debug = debugfs_create_file("debug", 0644,
                                                  priv->debugfs_dir, &items[0],