diff --git a/core/rtw_io.c b/core/rtw_io.c
index 4a18add..9eaf92a 100644
--- a/core/rtw_io.c
+++ b/core/rtw_io.c
@@ -104,38 +104,34 @@ u8 _rtw_read8(_adapter *adapter, u32 addr)
 
 u16 _rtw_read16(_adapter *adapter, u32 addr)
 {
-	u16 r_val;
-	//struct	io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	__le16 r_val;
 	struct io_priv *pio_priv = &adapter->iopriv;
 	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
-	u16	(*_read16)(struct intf_hdl *pintfhdl, u32 addr);
-	_func_enter_;
+	__le16	(*_read16)(struct intf_hdl *pintfhdl, u32 addr);
+_func_enter_;
 	_read16 = pintfhdl->io_ops._read16;
 
 	r_val = _read16(pintfhdl, addr);
-	_func_exit_;
+_func_exit_;
 	return rtw_le16_to_cpu(r_val);
 }
 
 u32 _rtw_read32(_adapter *adapter, u32 addr)
 {
-	u32 r_val;
-	//struct	io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	__le32 r_val;
 	struct io_priv *pio_priv = &adapter->iopriv;
 	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
-	u32	(*_read32)(struct intf_hdl *pintfhdl, u32 addr);
-	_func_enter_;
+	__le32	(*_read32)(struct intf_hdl *pintfhdl, u32 addr);
+_func_enter_;
 	_read32 = pintfhdl->io_ops._read32;
 
 	r_val = _read32(pintfhdl, addr);
-	_func_exit_;
+_func_exit_;
 	return rtw_le32_to_cpu(r_val);
-
 }
 
 int _rtw_write8(_adapter *adapter, u32 addr, u8 val)
 {
-	//struct	io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
 	struct io_priv *pio_priv = &adapter->iopriv;
 	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
 	int (*_write8)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
@@ -151,10 +147,9 @@ int _rtw_write8(_adapter *adapter, u32 addr, u8 val)
 
 int _rtw_write16(_adapter *adapter, u32 addr, u16 val)
 {
-	//struct	io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
 	struct io_priv *pio_priv = &adapter->iopriv;
 	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
-	int (*_write16)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+	int (*_write16)(struct intf_hdl *pintfhdl, u32 addr, __le16 val);
 	int ret;
 	__le16 ival;
 	_func_enter_;
@@ -168,10 +163,9 @@ int _rtw_write16(_adapter *adapter, u32 addr, u16 val)
 }
 int _rtw_write32(_adapter *adapter, u32 addr, u32 val)
 {
-	//struct	io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
 	struct io_priv *pio_priv = &adapter->iopriv;
 	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
-	int (*_write32)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+	int (*_write32)(struct intf_hdl *pintfhdl, u32 addr, __le32 val);
 	int ret;
 	__le32 ival;
 	_func_enter_;
@@ -186,7 +180,6 @@ int _rtw_write32(_adapter *adapter, u32 addr, u32 val)
 
 int _rtw_writeN(_adapter *adapter, u32 addr ,u32 length , u8 *pdata)
 {
-	//struct	io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
 	struct io_priv *pio_priv = &adapter->iopriv;
         struct	intf_hdl	*pintfhdl = (struct intf_hdl*)(&(pio_priv->intf));
 	int (*_writeN)(struct intf_hdl *pintfhdl, u32 addr,u32 length, u8 *pdata);
@@ -201,7 +194,6 @@ int _rtw_writeN(_adapter *adapter, u32 addr ,u32 length , u8 *pdata)
 }
 int _rtw_write8_async(_adapter *adapter, u32 addr, u8 val)
 {
-	//struct	io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
 	struct io_priv *pio_priv = &adapter->iopriv;
 	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
 	int (*_write8_async)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
@@ -214,33 +206,37 @@ int _rtw_write8_async(_adapter *adapter, u32 addr, u8 val)
 
 	return RTW_STATUS_CODE(ret);
 }
+
 int _rtw_write16_async(_adapter *adapter, u32 addr, u16 val)
 {
-	//struct	io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
 	struct io_priv *pio_priv = &adapter->iopriv;
 	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
-	int (*_write16_async)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+	int (*_write16_async)(struct intf_hdl *pintfhdl, u32 addr, __le16 val);
 	int ret;
-	_func_enter_;
+	__le16 ival;
+
+_func_enter_;
 	_write16_async = pintfhdl->io_ops._write16_async;
-	val = rtw_cpu_to_le16(val);
-	ret = _write16_async(pintfhdl, addr, val);
-	_func_exit_;
+	ival = rtw_cpu_to_le16(val);
+	ret = _write16_async(pintfhdl, addr, ival);
+_func_exit_;
 
 	return RTW_STATUS_CODE(ret);
 }
+
 int _rtw_write32_async(_adapter *adapter, u32 addr, u32 val)
 {
-	//struct	io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
 	struct io_priv *pio_priv = &adapter->iopriv;
 	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
-	int (*_write32_async)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+	int (*_write32_async)(struct intf_hdl *pintfhdl, u32 addr, __le32 val);
 	int ret;
-	_func_enter_;
+	__le32 ival;
+
+_func_enter_;
 	_write32_async = pintfhdl->io_ops._write32_async;
-	val = rtw_cpu_to_le32(val);
-	ret = _write32_async(pintfhdl, addr, val);
-	_func_exit_;
+	ival = rtw_cpu_to_le32(val);
+	ret = _write32_async(pintfhdl, addr, ival);
+_func_exit_;
 
 	return RTW_STATUS_CODE(ret);
 }
@@ -248,7 +244,6 @@ int _rtw_write32_async(_adapter *adapter, u32 addr, u32 val)
 void _rtw_read_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
 {
 	void (*_read_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
-	//struct	io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
 	struct io_priv *pio_priv = &adapter->iopriv;
 	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
 
diff --git a/core/rtw_security.c b/core/rtw_security.c
index 475865c..32d190c 100644
--- a/core/rtw_security.c
+++ b/core/rtw_security.c
@@ -254,17 +254,14 @@ void rtw_wep_decrypt(_adapter  *padapter, u8 *precvframe)
 
 _func_enter_;
 
-	pframe=(unsigned char *)((union recv_frame*)precvframe)->u.hdr.rx_data;
+	pframe = (unsigned char *)((union recv_frame*)precvframe)->u.hdr.rx_data;
 
 	//start to decrypt recvframe
-	if ((prxattrib->encrypt==_WEP40_)||(prxattrib->encrypt==_WEP104_))
-	{
+	if ((prxattrib->encrypt==_WEP40_)||(prxattrib->encrypt==_WEP104_)) {
 		iv=pframe+prxattrib->hdrlen;
-		//keyindex=(iv[3]&0x3);
 		keyindex = prxattrib->key_index;
 		keylength=psecuritypriv->dot11DefKeylen[keyindex];
 		_rtw_memcpy(&wepkey[0], iv, 3);
-		//_rtw_memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[psecuritypriv->dot11PrivacyKeyIndex].skey[0],keylength);
 		_rtw_memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[keyindex].skey[0],keylength);
 		length= ((union recv_frame *)precvframe)->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len;
 
@@ -275,20 +272,19 @@ _func_enter_;
 		arcfour_encrypt(&mycontext, payload, payload,  length);
 
 		//calculate icv and compare the icv
-		*((unsigned long *)crc)=le32_to_cpu(getcrc32(payload,length-4));
+		*((u32 *)crc) = le32_to_cpu(getcrc32(payload, length - 4));
 
-		if (crc[3]!=payload[length-1] || crc[2]!=payload[length-2] || crc[1]!=payload[length-3] || crc[0]!=payload[length-4])
-		{
-			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_wep_decrypt:icv error crc[3](%x)!=payload[length-1](%x) || crc[2](%x)!=payload[length-2](%x) || crc[1](%x)!=payload[length-3](%x) || crc[0](%x)!=payload[length-4](%x)\n",
-						crc[3],payload[length-1],crc[2],payload[length-2],crc[1],payload[length-3],crc[0],payload[length-4]));
+		if (crc[3] != payload[length-1] ||
+		    crc[2] != payload[length-2] ||
+		    crc[1] != payload[length-3] ||
+		    crc[0] != payload[length-4]) {
+			RT_TRACE(_module_rtl871x_security_c_, _drv_err_,
+				 ("rtw_wep_decrypt:icv error crc (%4ph) != payload (%4ph)\n",
+				 &crc, &payload[length-4]));
 		}
-
 	}
-
 _func_exit_;
-
 	return;
-
 }
 
 //3		=====TKIP related=====
@@ -829,27 +825,25 @@ _func_enter_;
 			arcfour_init(&mycontext, rc4key,16);
 			arcfour_encrypt(&mycontext, payload, payload, length);
 
-			*((u32 *)crc)=le32_to_cpu(getcrc32(payload,length-4));
+			*((u32 *)crc) = le32_to_cpu(getcrc32(payload, length-4));
 
-			if (crc[3]!=payload[length-1] || crc[2]!=payload[length-2] || crc[1]!=payload[length-3] || crc[0]!=payload[length-4])
-			{
-			    RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_wep_decrypt:icv error crc[3](%x)!=payload[length-1](%x) || crc[2](%x)!=payload[length-2](%x) || crc[1](%x)!=payload[length-3](%x) || crc[0](%x)!=payload[length-4](%x)\n",
-						crc[3],payload[length-1],crc[2],payload[length-2],crc[1],payload[length-3],crc[0],payload[length-4]));
+			if (crc[3] != payload[length-1] ||
+			    crc[2] != payload[length-2] ||
+			    crc[1] != payload[length-3] ||
+			    crc[0] != payload[length-4]) {
+				RT_TRACE(_module_rtl871x_security_c_, _drv_err_,
+					 ("rtw_wep_decrypt:icv error crc (%4ph) != payload (%4ph)\n",
+					 &crc, &payload[length-4]));
 				res=_FAIL;
 			}
-
-
-		}
-		else{
+		} else {
 			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_tkip_decrypt: stainfo==NULL!!!\n"));
 			res=_FAIL;
 		}
-
 	}
 _func_exit_;
 exit:
 	return res;
-
 }
 
 
diff --git a/include/rtw_io.h b/include/rtw_io.h
index 14c531e..a9644bd 100644
--- a/include/rtw_io.h
+++ b/include/rtw_io.h
@@ -132,20 +132,19 @@ struct intf_priv;
 struct intf_hdl;
 struct io_queue;
 
-struct _io_ops
-{
+struct _io_ops {
 		u8 (*_read8)(struct intf_hdl *pintfhdl, u32 addr);
-		u16 (*_read16)(struct intf_hdl *pintfhdl, u32 addr);
-		u32 (*_read32)(struct intf_hdl *pintfhdl, u32 addr);
+		__le16 (*_read16)(struct intf_hdl *pintfhdl, u32 addr);
+		__le32 (*_read32)(struct intf_hdl *pintfhdl, u32 addr);
 
 		int (*_write8)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
-		int (*_write16)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
-		int (*_write32)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+		int (*_write16)(struct intf_hdl *pintfhdl, u32 addr, __le16 val);
+		int (*_write32)(struct intf_hdl *pintfhdl, u32 addr, __le32 val);
 		int (*_writeN)(struct intf_hdl *pintfhdl, u32 addr, u32 length, u8 *pdata);
 
 		int (*_write8_async)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
-		int (*_write16_async)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
-		int (*_write32_async)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+		int (*_write16_async)(struct intf_hdl *pintfhdl, u32 addr, __le16 val);
+		int (*_write32_async)(struct intf_hdl *pintfhdl, u32 addr, __le32 val);
 
 		void (*_read_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
 		void (*_write_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
@@ -161,7 +160,6 @@ struct _io_ops
 
 		void (*_read_port_cancel)(struct intf_hdl *pintfhdl);
 		void (*_write_port_cancel)(struct intf_hdl *pintfhdl);
-
 };
 
 struct io_req {
diff --git a/os_dep/rtw_android.c b/os_dep/rtw_android.c
index 29de925..fe413d1 100644
--- a/os_dep/rtw_android.c
+++ b/os_dep/rtw_android.c
@@ -97,7 +97,7 @@ typedef struct cmd_tlv {
 #endif /* PNO_SUPPORT */
 
 typedef struct android_wifi_priv_cmd {
-	char *buf;
+	const char __user *buf;
 	int used_len;
 	int total_len;
 } android_wifi_priv_cmd;