Merge branch 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

* 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (1519 commits)
  staging: et131x: Remove redundant check and return statement
  staging: et131x: Mainly whitespace changes to appease checkpatch
  staging: et131x: Remove last of the forward declarations
  staging: et131x: Remove even more forward declarations
  staging: et131x: Remove yet more forward declarations
  staging: et131x: Remove more forward declarations
  staging: et131x: Remove forward declaration of et131x_adapter_setup
  staging: et131x: Remove some forward declarations
  staging: et131x: Remove unused rx_ring.recv_packet_pool
  staging: et131x: Remove call to find pci pm capability
  staging: et131x: Remove redundant et131x_reset_recv() call
  staging: et131x: Remove unused rx_ring.recv_buffer_pool
  Staging: bcm: Fix three initialization errors in InterfaceDld.c
  Staging: bcm: Fix coding style issues in InterfaceDld.c
  staging:iio:dac: Add AD5360 driver
  staging:iio:trigger:bfin-timer: Fix compile error
  Staging: vt6655: add some range checks before memcpy()
  Staging: vt6655: whitespace fixes to iotcl.c
  Staging: vt6656: add some range checks before memcpy()
  Staging: vt6656: whitespace cleanups in ioctl.c
  ...

Fix up conflicts in:
 - drivers/{Kconfig,Makefile}, drivers/staging/{Kconfig,Makefile}:
	vg driver movement
 - drivers/staging/brcm80211/brcmfmac/{dhd_linux.c,mac80211_if.c}:
	driver removal vs now stale changes
 - drivers/staging/rtl8192e/r8192E_core.c:
	driver removal vs now stale changes
 - drivers/staging/et131x/et131*:
	driver consolidation into one file, tried to do fixups

5 files changed, 522 insertions, 626 deletions

diff --git a/drivers/staging/vt6656/dpc.c b/drivers/staging/vt6656/dpc.c
index cb817ced5184..c0edf97535dc 100644
--- a/drivers/staging/vt6656/dpc.c
+++ b/drivers/staging/vt6656/dpc.c
@@ -1109,30 +1109,12 @@ static BOOL s_bAPModeRxCtl (
                                        &Status
                                        );
                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: send vMgrDeAuthenBeginSta 3\n");
-                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BSSID:%02x-%02x-%02x=%02x-%02x-%02x \n",
-                                p802_11Header->abyAddr3[0],
-                                p802_11Header->abyAddr3[1],
-                                p802_11Header->abyAddr3[2],
-                                p802_11Header->abyAddr3[3],
-                                p802_11Header->abyAddr3[4],
-                                p802_11Header->abyAddr3[5]
-                               );
-                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ADDR2:%02x-%02x-%02x=%02x-%02x-%02x \n",
-                                p802_11Header->abyAddr2[0],
-                                p802_11Header->abyAddr2[1],
-                                p802_11Header->abyAddr2[2],
-                                p802_11Header->abyAddr2[3],
-                                p802_11Header->abyAddr2[4],
-                                p802_11Header->abyAddr2[5]
-                               );
-                    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ADDR1:%02x-%02x-%02x=%02x-%02x-%02x \n",
-                                p802_11Header->abyAddr1[0],
-                                p802_11Header->abyAddr1[1],
-                                p802_11Header->abyAddr1[2],
-                                p802_11Header->abyAddr1[3],
-                                p802_11Header->abyAddr1[4],
-                                p802_11Header->abyAddr1[5]
-                               );
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BSSID:%pM\n",
+				p802_11Header->abyAddr3);
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ADDR2:%pM\n",
+				p802_11Header->abyAddr2);
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ADDR1:%pM\n",
+				p802_11Header->abyAddr1);
                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: wFrameCtl= %x\n", p802_11Header->wFrameCtl );
                     return TRUE;
             }
diff --git a/drivers/staging/vt6656/ioctl.c b/drivers/staging/vt6656/ioctl.c
index cfe9c95d7807..49390026dea3 100644
--- a/drivers/staging/vt6656/ioctl.c
+++ b/drivers/staging/vt6656/ioctl.c
@@ -40,665 +40,603 @@
 #include "rndis.h"
 #include "rf.h"
 
-/*---------------------  Static Definitions -------------------------*/
-
-/*---------------------  Static Classes  ----------------------------*/
-
-/*---------------------  Static Variables  --------------------------*/
-//static int          msglevel                =MSG_LEVEL_DEBUG;
-static int          msglevel                =MSG_LEVEL_INFO;
-
-    SWPAResult wpa_Result;
-
-/*---------------------  Static Functions  --------------------------*/
-
-/*---------------------  Export Variables  --------------------------*/
-
-int private_ioctl(PSDevice pDevice, struct ifreq *rq) {
-
-	PSCmdRequest        pReq = (PSCmdRequest)rq;
-    PSMgmtObject        pMgmt = &(pDevice->sMgmtObj);
-	int 		        result = 0;
-    PWLAN_IE_SSID       pItemSSID;
-    SCmdBSSJoin         sJoinCmd;
-    SCmdZoneTypeSet sZoneTypeCmd;
-    SCmdScan            sScanCmd;
-    SCmdStartAP         sStartAPCmd;
-    SCmdSetWEP          sWEPCmd;
-    SCmdValue           sValue;
-    SBSSIDList          sList;
-    SNodeList           sNodeList;
-    PSBSSIDList         pList;
-    PSNodeList          pNodeList;
-    unsigned int                cbListCount;
-    PKnownBSS           pBSS;
-    PKnownNodeDB        pNode;
-    unsigned int                ii, jj;
-    SCmdLinkStatus      sLinkStatus;
-    BYTE                abySuppRates[] = {WLAN_EID_SUPP_RATES, 4, 0x02, 0x04, 0x0B, 0x16};
-    BYTE                abyNullAddr[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
-    DWORD               dwKeyIndex= 0;
-    BYTE                abyScanSSID[WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1];
-    signed long                ldBm;
-
-    pReq->wResult = 0;
-
-    switch(pReq->wCmdCode) {
-
-    case WLAN_CMD_BSS_SCAN:
-
-        if (copy_from_user(&sScanCmd, pReq->data, sizeof(SCmdScan))) {
+SWPAResult wpa_Result;
+static int msglevel = MSG_LEVEL_INFO;
+
+int private_ioctl(PSDevice pDevice, struct ifreq *rq)
+{
+
+	PSCmdRequest	pReq = (PSCmdRequest)rq;
+	PSMgmtObject	pMgmt = &(pDevice->sMgmtObj);
+	int		result = 0;
+	PWLAN_IE_SSID	pItemSSID;
+	SCmdBSSJoin	sJoinCmd;
+	SCmdZoneTypeSet	sZoneTypeCmd;
+	SCmdScan	sScanCmd;
+	SCmdStartAP	sStartAPCmd;
+	SCmdSetWEP	sWEPCmd;
+	SCmdValue	sValue;
+	SBSSIDList	sList;
+	SNodeList	sNodeList;
+	PSBSSIDList	pList;
+	PSNodeList	pNodeList;
+	unsigned int	cbListCount;
+	PKnownBSS	pBSS;
+	PKnownNodeDB	pNode;
+	unsigned int	ii, jj;
+	SCmdLinkStatus	sLinkStatus;
+	BYTE		abySuppRates[] = {WLAN_EID_SUPP_RATES, 4, 0x02, 0x04, 0x0B, 0x16};
+	BYTE		abyNullAddr[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+	DWORD		dwKeyIndex = 0;
+	BYTE		abyScanSSID[WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1];
+	signed long	ldBm;
+
+	pReq->wResult = 0;
+
+	switch (pReq->wCmdCode) {
+	case WLAN_CMD_BSS_SCAN:
+		if (copy_from_user(&sScanCmd, pReq->data, sizeof(SCmdScan))) {
 			result = -EFAULT;
 			break;
 		}
 
-        pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid;
-        if (pItemSSID->len != 0) {
-            memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
-            memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
-        }
-        spin_lock_irq(&pDevice->lock);
+		pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid;
+		if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+			return -EINVAL;
+		if (pItemSSID->len != 0) {
+			memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
+			memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
+		}
+		spin_lock_irq(&pDevice->lock);
 
-	if (memcmp(pMgmt->abyCurrBSSID, &abyNullAddr[0], 6) == 0)
-		BSSvClearBSSList((void *) pDevice, FALSE);
-	else
-		BSSvClearBSSList((void *) pDevice, pDevice->bLinkPass);
+		if (memcmp(pMgmt->abyCurrBSSID, &abyNullAddr[0], 6) == 0)
+			BSSvClearBSSList((void *)pDevice, FALSE);
+		else
+			BSSvClearBSSList((void *)pDevice, pDevice->bLinkPass);
 
-	DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_BSS_SCAN..begin\n");
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_BSS_SCAN..begin\n");
 
-	if (pItemSSID->len != 0)
-		bScheduleCommand((void *) pDevice,
-				 WLAN_CMD_BSSID_SCAN,
-				 abyScanSSID);
-	else
-		bScheduleCommand((void *) pDevice, WLAN_CMD_BSSID_SCAN, NULL);
+		if (pItemSSID->len != 0)
+			bScheduleCommand((void *)pDevice,
+					 WLAN_CMD_BSSID_SCAN,
+					 abyScanSSID);
+		else
+			bScheduleCommand((void *) pDevice, WLAN_CMD_BSSID_SCAN, NULL);
 
-        spin_unlock_irq(&pDevice->lock);
-        break;
+		spin_unlock_irq(&pDevice->lock);
+		break;
 
-    case WLAN_CMD_ZONETYPE_SET:
-	//mike add :cann't support.
-           result=-EOPNOTSUPP;
-	  break;
+	case WLAN_CMD_ZONETYPE_SET:
+		result = -EOPNOTSUPP;
+		break;
 
-        if (copy_from_user(&sZoneTypeCmd, pReq->data, sizeof(SCmdZoneTypeSet))) {
+		if (copy_from_user(&sZoneTypeCmd, pReq->data, sizeof(SCmdZoneTypeSet))) {
 			result = -EFAULT;
 			break;
 		}
 
-          if(sZoneTypeCmd.bWrite==TRUE) {
-	  //////write zonetype
-                if(sZoneTypeCmd.ZoneType == ZoneType_USA) {
-                  //set to USA
-                   printk("set_ZoneType:USA\n");
-		}
-                else if(sZoneTypeCmd.ZoneType == ZoneType_Japan) {
-                  //set to Japan
-                  printk("set_ZoneType:Japan\n");
-		}
-	       else if(sZoneTypeCmd.ZoneType == ZoneType_Europe) {
-                  //set to Europe
-                  printk("set_ZoneType:Europe\n");
-		}
-            }
-	else {
-          ///////read zonetype
-	  BYTE                       zonetype=0;
-
-
-           if(zonetype == 0x00)  { //USA
-             sZoneTypeCmd.ZoneType = ZoneType_USA;
-           }
-	 else if(zonetype == 0x01) { //Japan
-             sZoneTypeCmd.ZoneType = ZoneType_Japan;
-	  }
-	 else if(zonetype == 0x02) { //Europe
-             sZoneTypeCmd.ZoneType = ZoneType_Europe;
-	 }
-	 else { //Unknown ZoneType
-	        printk("Error:ZoneType[%x] Unknown ???\n",zonetype);
-	         result = -EFAULT;
+		if (sZoneTypeCmd.bWrite == TRUE) {
+			/* write zonetype */
+			if (sZoneTypeCmd.ZoneType == ZoneType_USA) {
+				/* set to USA */
+				printk("set_ZoneType:USA\n");
+			} else if (sZoneTypeCmd.ZoneType == ZoneType_Japan) {
+				/* set to Japan */
+				printk("set_ZoneType:Japan\n");
+			} else if (sZoneTypeCmd.ZoneType == ZoneType_Europe) {
+				/* set to Europe */
+				printk("set_ZoneType:Europe\n");
+			}
+		} else {
+			/* read zonetype */
+			BYTE zonetype = 0;
+
+			if (zonetype == 0x00) {        /* USA */
+				sZoneTypeCmd.ZoneType = ZoneType_USA;
+			} else if (zonetype == 0x01) { /* Japan */
+				sZoneTypeCmd.ZoneType = ZoneType_Japan;
+			} else if (zonetype == 0x02) { /* Europe */
+				sZoneTypeCmd.ZoneType = ZoneType_Europe;
+			} else {                       /* Unknown ZoneType */
+				printk("Error:ZoneType[%x] Unknown ???\n", zonetype);
+				result = -EFAULT;
+				break;
+			}
+
+			if (copy_to_user(pReq->data, &sZoneTypeCmd,
+						sizeof(SCmdZoneTypeSet))) {
+				result = -EFAULT;
+				break;
+			}
+		}
 		break;
-	 }
-	   if (copy_to_user(pReq->data, &sZoneTypeCmd, sizeof(SCmdZoneTypeSet))) {
+	case WLAN_CMD_BSS_JOIN:
+		if (copy_from_user(&sJoinCmd, pReq->data, sizeof(SCmdBSSJoin))) {
 			result = -EFAULT;
 			break;
 		}
-	}
 
-	     break;
+		pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid;
+		if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+			return -EINVAL;
+		memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
+		memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
+		if (sJoinCmd.wBSSType == ADHOC) {
+			pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to adhoc mode\n");
+		} else {
+			pMgmt->eConfigMode = WMAC_CONFIG_ESS_STA;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to STA mode\n");
+		}
+		if (sJoinCmd.bPSEnable == TRUE) {
+			pDevice->ePSMode = WMAC_POWER_FAST;
+			pMgmt->wListenInterval = 2;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Power Saving On\n");
+		} else {
+			pDevice->ePSMode = WMAC_POWER_CAM;
+			pMgmt->wListenInterval = 1;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Power Saving Off\n");
+		}
+
+		if (sJoinCmd.bShareKeyAuth == TRUE) {
+			pMgmt->bShareKeyAlgorithm = TRUE;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Share Key\n");
+		} else {
+			pMgmt->bShareKeyAlgorithm = FALSE;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Open System\n");
+		}
 
-    case WLAN_CMD_BSS_JOIN:
+		pDevice->uChannel = sJoinCmd.uChannel;
+		netif_stop_queue(pDevice->dev);
+		spin_lock_irq(&pDevice->lock);
+		pMgmt->eCurrState = WMAC_STATE_IDLE;
+		bScheduleCommand((void *) pDevice,
+				 WLAN_CMD_BSSID_SCAN,
+				 pMgmt->abyDesireSSID);
+		bScheduleCommand((void *) pDevice, WLAN_CMD_SSID, NULL);
+		spin_unlock_irq(&pDevice->lock);
+		break;
 
-        if (copy_from_user(&sJoinCmd, pReq->data, sizeof(SCmdBSSJoin))) {
+	case WLAN_CMD_SET_WEP:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_WEP Key.\n");
+		memset(&sWEPCmd, 0, sizeof(SCmdSetWEP));
+		if (copy_from_user(&sWEPCmd, pReq->data, sizeof(SCmdSetWEP))) {
 			result = -EFAULT;
 			break;
 		}
-
-        pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid;
-        memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
-		memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
-	    if (sJoinCmd.wBSSType == ADHOC) {
-	        pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;
-	        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to adhoc mode\n");
-	    }
-	    else {
-	        pMgmt->eConfigMode = WMAC_CONFIG_ESS_STA;
-	        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to STA mode\n");
-	    }
-	    if (sJoinCmd.bPSEnable == TRUE) {
-            pDevice->ePSMode = WMAC_POWER_FAST;
-//            pDevice->ePSMode = WMAC_POWER_MAX;
-            pMgmt->wListenInterval = 2;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Power Saving On\n");
-        }
-        else {
-            pDevice->ePSMode = WMAC_POWER_CAM;
-            pMgmt->wListenInterval = 1;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Power Saving Off \n");
-        }
-
-        if (sJoinCmd.bShareKeyAuth == TRUE){
-            pMgmt->bShareKeyAlgorithm = TRUE;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Share Key \n");
-        }
-        else {
-            pMgmt->bShareKeyAlgorithm = FALSE;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Open System \n");
-        }
-	    pDevice->uChannel = sJoinCmd.uChannel;
-        netif_stop_queue(pDevice->dev);
-        spin_lock_irq(&pDevice->lock);
-        pMgmt->eCurrState = WMAC_STATE_IDLE;
-	bScheduleCommand((void *) pDevice,
-			 WLAN_CMD_BSSID_SCAN,
-			 pMgmt->abyDesireSSID);
-	bScheduleCommand((void *) pDevice, WLAN_CMD_SSID, NULL);
-        spin_unlock_irq(&pDevice->lock);
-        break;
-
-    case WLAN_CMD_SET_WEP:
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_WEP Key. \n");
-        memset(&sWEPCmd, 0 ,sizeof(SCmdSetWEP));
-        if (copy_from_user(&sWEPCmd, pReq->data, sizeof(SCmdSetWEP))) {
-			result = -EFAULT;
+		if (sWEPCmd.bEnableWep != TRUE) {
+			int uu;
+
+			pDevice->bEncryptionEnable = FALSE;
+			pDevice->eEncryptionStatus = Ndis802_11EncryptionDisabled;
+			spin_lock_irq(&pDevice->lock);
+			for (uu = 0; uu < MAX_KEY_TABLE; uu++)
+				MACvDisableKeyEntry(pDevice, uu);
+			spin_unlock_irq(&pDevice->lock);
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WEP function disable.\n");
 			break;
 		}
-	    if (sWEPCmd.bEnableWep != TRUE) {
-	        int uu;
-
-            pDevice->bEncryptionEnable = FALSE;
-            pDevice->eEncryptionStatus = Ndis802_11EncryptionDisabled;
-            spin_lock_irq(&pDevice->lock);
-	    for (uu = 0; uu < MAX_KEY_TABLE; uu++)
-		MACvDisableKeyEntry(pDevice, uu);
-            spin_unlock_irq(&pDevice->lock);
-	    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WEP function disable.\n");
-            break;
-        }
-
-        for (ii = 0; ii < WLAN_WEP_NKEYS; ii ++) {
-            if (sWEPCmd.bWepKeyAvailable[ii]) {
-                if (ii == sWEPCmd.byKeyIndex)
-//2006-1207-01<Modify>by Einsn Liu
-//		    dwKeyIndex|= (1 << 31);
-                    dwKeyIndex=ii|(1 << 31);
-                else
-                    dwKeyIndex = ii;
-                spin_lock_irq(&pDevice->lock);
-                KeybSetDefaultKey(  pDevice,
-                                    &(pDevice->sKey),
-                                    dwKeyIndex,
-                                    sWEPCmd.auWepKeyLength[ii],
-                                    NULL,
-                                    (PBYTE)&sWEPCmd.abyWepKey[ii][0],
-                                    KEY_CTL_WEP
-                                  );
-               spin_unlock_irq(&pDevice->lock);
-
-            }
-        }
-        pDevice->byKeyIndex = sWEPCmd.byKeyIndex;
-        pDevice->bTransmitKey = TRUE;
-        pDevice->bEncryptionEnable = TRUE;
-        pDevice->eEncryptionStatus = Ndis802_11Encryption1Enabled;
-
-        break;
-
-    case WLAN_CMD_GET_LINK:
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_GET_LINK status. \n");
-
-        memset(sLinkStatus.abySSID, 0 , WLAN_SSID_MAXLEN + 1);
-
-        if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA)
-            sLinkStatus.wBSSType = ADHOC;
-        else
-            sLinkStatus.wBSSType = INFRA;
-
-        if (pMgmt->eCurrState == WMAC_STATE_JOINTED)
-            sLinkStatus.byState = ADHOC_JOINTED;
-        else
-            sLinkStatus.byState = ADHOC_STARTED;
-
-        sLinkStatus.uChannel = pMgmt->uCurrChannel;
-        if (pDevice->bLinkPass == TRUE) {
-            sLinkStatus.bLink = TRUE;
- 		    pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
-		    memcpy(sLinkStatus.abySSID, pItemSSID->abySSID, pItemSSID->len);
-		    memcpy(sLinkStatus.abyBSSID, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
-		    sLinkStatus.uLinkRate = pMgmt->sNodeDBTable[0].wTxDataRate;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO" Link Success ! \n");
-        }
-        else {
-            sLinkStatus.bLink = FALSE;
-        }
-        if (copy_to_user(pReq->data, &sLinkStatus, sizeof(SCmdLinkStatus))) {
+
+		for (ii = 0; ii < WLAN_WEP_NKEYS; ii++) {
+			if (sWEPCmd.bWepKeyAvailable[ii]) {
+				if (ii == sWEPCmd.byKeyIndex)
+					dwKeyIndex = ii | (1 << 31);
+				else
+					dwKeyIndex = ii;
+				spin_lock_irq(&pDevice->lock);
+				KeybSetDefaultKey(pDevice, &(pDevice->sKey),
+						  dwKeyIndex,
+						  sWEPCmd.auWepKeyLength[ii],
+						  NULL,
+						  (PBYTE)&sWEPCmd.abyWepKey[ii][0],
+						  KEY_CTL_WEP);
+				spin_unlock_irq(&pDevice->lock);
+			}
+		}
+		pDevice->byKeyIndex = sWEPCmd.byKeyIndex;
+		pDevice->bTransmitKey = TRUE;
+		pDevice->bEncryptionEnable = TRUE;
+		pDevice->eEncryptionStatus = Ndis802_11Encryption1Enabled;
+		break;
+
+	case WLAN_CMD_GET_LINK:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_GET_LINK status.\n");
+
+		memset(sLinkStatus.abySSID, 0, WLAN_SSID_MAXLEN + 1);
+
+		if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA)
+			sLinkStatus.wBSSType = ADHOC;
+		else
+			sLinkStatus.wBSSType = INFRA;
+
+		if (pMgmt->eCurrState == WMAC_STATE_JOINTED)
+			sLinkStatus.byState = ADHOC_JOINTED;
+		else
+			sLinkStatus.byState = ADHOC_STARTED;
+
+		sLinkStatus.uChannel = pMgmt->uCurrChannel;
+		if (pDevice->bLinkPass == TRUE) {
+			sLinkStatus.bLink = TRUE;
+			pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
+			memcpy(sLinkStatus.abySSID, pItemSSID->abySSID, pItemSSID->len);
+			memcpy(sLinkStatus.abyBSSID, pMgmt->abyCurrBSSID, WLAN_BSSID_LEN);
+			sLinkStatus.uLinkRate = pMgmt->sNodeDBTable[0].wTxDataRate;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Link Success!\n");
+		} else {
+			sLinkStatus.bLink = FALSE;
+			sLinkStatus.uLinkRate = 0;
+		}
+		if (copy_to_user(pReq->data, &sLinkStatus,
+					sizeof(SCmdLinkStatus))) {
 			result = -EFAULT;
 			break;
 		}
+		break;
 
-        break;
-
-    case WLAN_CMD_GET_LISTLEN:
+	case WLAN_CMD_GET_LISTLEN:
 		cbListCount = 0;
 		pBSS = &(pMgmt->sBSSList[0]);
-        for (ii = 0; ii < MAX_BSS_NUM; ii++) {
-            pBSS = &(pMgmt->sBSSList[ii]);
-            if (!pBSS->bActive)
-                continue;
-            cbListCount++;
-        }
-        sList.uItem = cbListCount;
-        if (copy_to_user(pReq->data, &sList, sizeof(SBSSIDList))) {
+		for (ii = 0; ii < MAX_BSS_NUM; ii++) {
+			pBSS = &(pMgmt->sBSSList[ii]);
+			if (!pBSS->bActive)
+				continue;
+			cbListCount++;
+		}
+		sList.uItem = cbListCount;
+		if (copy_to_user(pReq->data, &sList, sizeof(SBSSIDList))) {
 			result = -EFAULT;
 			break;
 		}
-        pReq->wResult = 0;
-        break;
+		pReq->wResult = 0;
+		break;
 
-    case WLAN_CMD_GET_LIST:
-        if (copy_from_user(&sList, pReq->data, sizeof(SBSSIDList))) {
+	case WLAN_CMD_GET_LIST:
+		if (copy_from_user(&sList, pReq->data, sizeof(SBSSIDList))) {
 			result = -EFAULT;
 			break;
 		}
-        pList = (PSBSSIDList)kmalloc(sizeof(SBSSIDList) + (sList.uItem * sizeof(SBSSIDItem)), (int)GFP_ATOMIC);
-        if (pList == NULL) {
-            result = -ENOMEM;
-            break;
-        }
+		pList = (PSBSSIDList)kmalloc(sizeof(SBSSIDList) + (sList.uItem * sizeof(SBSSIDItem)), (int)GFP_ATOMIC);
+		if (pList == NULL) {
+			result = -ENOMEM;
+			break;
+		}
 		pList->uItem = sList.uItem;
 		pBSS = &(pMgmt->sBSSList[0]);
-        for (ii = 0, jj = 0; jj < MAX_BSS_NUM ; jj++) {
-            pBSS = &(pMgmt->sBSSList[jj]);
-            if (pBSS->bActive) {
-    		    pList->sBSSIDList[ii].uChannel = pBSS->uChannel;
-    		    pList->sBSSIDList[ii].wBeaconInterval = pBSS->wBeaconInterval;
-    		    pList->sBSSIDList[ii].wCapInfo = pBSS->wCapInfo;
-    		    RFvRSSITodBm(pDevice, (BYTE)(pBSS->uRSSI), &ldBm);
-		    pList->sBSSIDList[ii].uRSSI = (unsigned int) ldBm;
-//    		    pList->sBSSIDList[ii].uRSSI = pBSS->uRSSI;
-    		    memcpy(pList->sBSSIDList[ii].abyBSSID, pBSS->abyBSSID, WLAN_BSSID_LEN);
-    		    pItemSSID = (PWLAN_IE_SSID)pBSS->abySSID;
-    		    memset(pList->sBSSIDList[ii].abySSID, 0, WLAN_SSID_MAXLEN + 1);
-    		    memcpy(pList->sBSSIDList[ii].abySSID, pItemSSID->abySSID, pItemSSID->len);
-                if (WLAN_GET_CAP_INFO_ESS(pBSS->wCapInfo)) {
-    		        pList->sBSSIDList[ii].byNetType = INFRA;
-                }
-                else {
-    		        pList->sBSSIDList[ii].byNetType = ADHOC;
-    		    }
-    		    if (WLAN_GET_CAP_INFO_PRIVACY(pBSS->wCapInfo)) {
-    		        pList->sBSSIDList[ii].bWEPOn = TRUE;
-                }
-                else {
-    		        pList->sBSSIDList[ii].bWEPOn = FALSE;
-    		    }
-    		    ii ++;
-    		    if (ii >= pList->uItem)
-    		        break;
-            }
-        }
-
-        if (copy_to_user(pReq->data, pList, sizeof(SBSSIDList) + (sList.uItem * sizeof(SBSSIDItem)))) {
+		for (ii = 0, jj = 0; jj < MAX_BSS_NUM ; jj++) {
+			pBSS = &(pMgmt->sBSSList[jj]);
+			if (pBSS->bActive) {
+				pList->sBSSIDList[ii].uChannel = pBSS->uChannel;
+				pList->sBSSIDList[ii].wBeaconInterval = pBSS->wBeaconInterval;
+				pList->sBSSIDList[ii].wCapInfo = pBSS->wCapInfo;
+				RFvRSSITodBm(pDevice, (BYTE)(pBSS->uRSSI), &ldBm);
+				pList->sBSSIDList[ii].uRSSI = (unsigned int) ldBm;
+				/* pList->sBSSIDList[ii].uRSSI = pBSS->uRSSI; */
+				memcpy(pList->sBSSIDList[ii].abyBSSID, pBSS->abyBSSID, WLAN_BSSID_LEN);
+				pItemSSID = (PWLAN_IE_SSID)pBSS->abySSID;
+				memset(pList->sBSSIDList[ii].abySSID, 0, WLAN_SSID_MAXLEN + 1);
+				memcpy(pList->sBSSIDList[ii].abySSID, pItemSSID->abySSID, pItemSSID->len);
+				if (WLAN_GET_CAP_INFO_ESS(pBSS->wCapInfo)) {
+					pList->sBSSIDList[ii].byNetType = INFRA;
+				} else {
+					pList->sBSSIDList[ii].byNetType = ADHOC;
+				}
+				if (WLAN_GET_CAP_INFO_PRIVACY(pBSS->wCapInfo)) {
+					pList->sBSSIDList[ii].bWEPOn = TRUE;
+				} else {
+					pList->sBSSIDList[ii].bWEPOn = FALSE;
+				}
+				ii++;
+				if (ii >= pList->uItem)
+					break;
+			}
+		}
+
+		if (copy_to_user(pReq->data, pList, sizeof(SBSSIDList) + (sList.uItem * sizeof(SBSSIDItem)))) {
 			result = -EFAULT;
 			break;
 		}
-        kfree(pList);
-        pReq->wResult = 0;
-        break;
+		kfree(pList);
+		pReq->wResult = 0;
+		break;
 
-    case WLAN_CMD_GET_MIB:
-        if (copy_to_user(pReq->data, &(pDevice->s802_11Counter), sizeof(SDot11MIBCount))) {
+	case WLAN_CMD_GET_MIB:
+		if (copy_to_user(pReq->data, &(pDevice->s802_11Counter), sizeof(SDot11MIBCount))) {
 			result = -EFAULT;
 			break;
 		}
-        break;
+		break;
 
-    case WLAN_CMD_GET_STAT:
-        if (copy_to_user(pReq->data, &(pDevice->scStatistic), sizeof(SStatCounter))) {
+	case WLAN_CMD_GET_STAT:
+		if (copy_to_user(pReq->data, &(pDevice->scStatistic), sizeof(SStatCounter))) {
 			result = -EFAULT;
 			break;
 		}
-        break;
-    case WLAN_CMD_STOP_MAC:
-
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_STOP_MAC\n");
-        // Todo xxxxxx
-        netif_stop_queue(pDevice->dev);
-        spin_lock_irq(&pDevice->lock);
-        if (pDevice->bRadioOff == FALSE) {
-            CARDbRadioPowerOff(pDevice);
-        }
-        pDevice->bLinkPass = FALSE;
-        ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_SLOW);
-        memset(pMgmt->abyCurrBSSID, 0, 6);
-        pMgmt->eCurrState = WMAC_STATE_IDLE;
-//        del_timer(&pDevice->sTimerCommand);
-//        del_timer(&pMgmt->sTimerSecondCallback);
-        pDevice->bCmdRunning = FALSE;
-        spin_unlock_irq(&pDevice->lock);
-
-        break;
-
-    case WLAN_CMD_START_MAC:
-
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_START_MAC\n");
-        // Todo xxxxxxx
-        if (pDevice->bRadioOff == TRUE)
-            CARDbRadioPowerOn(pDevice);
-        break;
+		break;
+	case WLAN_CMD_STOP_MAC:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_STOP_MAC\n");
+		/* Todo xxxxxx */
+		netif_stop_queue(pDevice->dev);
+		spin_lock_irq(&pDevice->lock);
+		if (pDevice->bRadioOff == FALSE) {
+			CARDbRadioPowerOff(pDevice);
+		}
+		pDevice->bLinkPass = FALSE;
+		ControlvMaskByte(pDevice, MESSAGE_REQUEST_MACREG, MAC_REG_PAPEDELAY, LEDSTS_STS, LEDSTS_SLOW);
+		memset(pMgmt->abyCurrBSSID, 0, 6);
+		pMgmt->eCurrState = WMAC_STATE_IDLE;
+		/* del_timer(&pDevice->sTimerCommand); */
+		/* del_timer(&pMgmt->sTimerSecondCallback); */
+		pDevice->bCmdRunning = FALSE;
+		spin_unlock_irq(&pDevice->lock);
+		break;
 
-    case WLAN_CMD_SET_HOSTAPD:
+	case WLAN_CMD_START_MAC:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_START_MAC\n");
+		/* Todo xxxxxxx */
+		if (pDevice->bRadioOff == TRUE)
+			CARDbRadioPowerOn(pDevice);
+		break;
 
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOSTAPD\n");
+	case WLAN_CMD_SET_HOSTAPD:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOSTAPD\n");
 
-        if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
+		if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
 			result = -EFAULT;
 			break;
 		}
 		if (sValue.dwValue == 1) {
-            if (vt6656_hostap_set_hostapd(pDevice, 1, 1) == 0){
-                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable HOSTAP\n");
-            }
-            else {
-			    result = -EFAULT;
-			    break;
+			if (vt6656_hostap_set_hostapd(pDevice, 1, 1) == 0) {
+				DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable HOSTAP\n");
+			} else {
+				result = -EFAULT;
+				break;
 			}
-        }
-        else {
-            vt6656_hostap_set_hostapd(pDevice, 0, 1);
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable HOSTAP\n");
-        }
-
-        break;
-
-    case WLAN_CMD_SET_HOSTAPD_STA:
-
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOSTAPD_STA\n");
+		} else {
+			vt6656_hostap_set_hostapd(pDevice, 0, 1);
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable HOSTAP\n");
+		}
+		break;
 
-        break;
-    case WLAN_CMD_SET_802_1X:
+	case WLAN_CMD_SET_HOSTAPD_STA:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOSTAPD_STA\n");
+		break;
 
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_802_1X\n");
-        if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
+	case WLAN_CMD_SET_802_1X:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_802_1X\n");
+		if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
 			result = -EFAULT;
 			break;
 		}
 
 		if (sValue.dwValue == 1) {
-            pDevice->bEnable8021x = TRUE;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable 802.1x\n");
-        }
-        else {
-            pDevice->bEnable8021x = FALSE;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable 802.1x\n");
-        }
-
-        break;
-
-
-    case WLAN_CMD_SET_HOST_WEP:
+			pDevice->bEnable8021x = TRUE;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable 802.1x\n");
+		} else {
+			pDevice->bEnable8021x = FALSE;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable 802.1x\n");
+		}
+		break;
 
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOST_WEP\n");
-        if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
+	case WLAN_CMD_SET_HOST_WEP:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_HOST_WEP\n");
+		if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
 			result = -EFAULT;
 			break;
 		}
 
 		if (sValue.dwValue == 1) {
-            pDevice->bEnableHostWEP = TRUE;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable HostWEP\n");
-        }
-        else {
-            pDevice->bEnableHostWEP = FALSE;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable HostWEP\n");
-        }
-
-        break;
+			pDevice->bEnableHostWEP = TRUE;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Enable HostWEP\n");
+		} else {
+			pDevice->bEnableHostWEP = FALSE;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Disable HostWEP\n");
+		}
+		break;
 
-    case WLAN_CMD_SET_WPA:
-         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_WPA\n");
+	case WLAN_CMD_SET_WPA:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_SET_WPA\n");
 
-        if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
+		if (copy_from_user(&sValue, pReq->data, sizeof(SCmdValue))) {
 			result = -EFAULT;
 			break;
 		}
 		if (sValue.dwValue == 1) {
-                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "up wpadev\n");
-		   memcpy(pDevice->wpadev->dev_addr,
-			  pDevice->dev->dev_addr,
-			  ETH_ALEN);
-		   pDevice->bWPADEVUp = TRUE;
-        }
-        else {
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "close wpadev\n");
-	   pDevice->bWPADEVUp = FALSE;
-        }
-
-        break;
-
-    case WLAN_CMD_AP_START:
-
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_AP_START\n");
-        if (pDevice->bRadioOff == TRUE) {
-            CARDbRadioPowerOn(pDevice);
-            add_timer(&pMgmt->sTimerSecondCallback);
-        }
-        if (copy_from_user(&sStartAPCmd, pReq->data, sizeof(SCmdStartAP))) {
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "up wpadev\n");
+			memcpy(pDevice->wpadev->dev_addr, pDevice->dev->dev_addr,
+			       ETH_ALEN);
+			pDevice->bWPADEVUp = TRUE;
+		} else {
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "close wpadev\n");
+			pDevice->bWPADEVUp = FALSE;
+		}
+		break;
+
+	case WLAN_CMD_AP_START:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "WLAN_CMD_AP_START\n");
+		if (pDevice->bRadioOff == TRUE) {
+			CARDbRadioPowerOn(pDevice);
+			add_timer(&pMgmt->sTimerSecondCallback);
+		}
+		if (copy_from_user(&sStartAPCmd, pReq->data, sizeof(SCmdStartAP))) {
 			result = -EFAULT;
 			break;
 		}
 
-	    if (sStartAPCmd.wBSSType == AP) {
-	        pMgmt->eConfigMode = WMAC_CONFIG_AP;
-	        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to AP mode\n");
-	    }
-	    else {
-	        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct BSS type not set to AP mode\n");
+		if (sStartAPCmd.wBSSType == AP) {
+			pMgmt->eConfigMode = WMAC_CONFIG_AP;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct set to AP mode\n");
+		} else {
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ioct BSS type not set to AP mode\n");
 			result = -EFAULT;
 			break;
-	    }
-
+		}
 
-	    if (sStartAPCmd.wBBPType == PHY80211g) {
-            pMgmt->byAPBBType = PHY_TYPE_11G;
-        }
-        else if (sStartAPCmd.wBBPType == PHY80211a) {
-                 pMgmt->byAPBBType = PHY_TYPE_11A;
-        }
-        else {
-            pMgmt->byAPBBType = PHY_TYPE_11B;
-        }
+		if (sStartAPCmd.wBBPType == PHY80211g) {
+			pMgmt->byAPBBType = PHY_TYPE_11G;
+		} else if (sStartAPCmd.wBBPType == PHY80211a) {
+			pMgmt->byAPBBType = PHY_TYPE_11A;
+		} else {
+			pMgmt->byAPBBType = PHY_TYPE_11B;
+		}
 
-        pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid;
-        memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
+		pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid;
+		if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+			return -EINVAL;
+		memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
 		memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
 
-	    if ((sStartAPCmd.uChannel > 0)&&(sStartAPCmd.uChannel <= 14))
-	        pDevice->uChannel = sStartAPCmd.uChannel;
-
-	    if ((sStartAPCmd.uBeaconInt >= 20) && (sStartAPCmd.uBeaconInt <= 1000))
-            pMgmt->wIBSSBeaconPeriod = sStartAPCmd.uBeaconInt;
-        else
-            pMgmt->wIBSSBeaconPeriod = 100;
-
-        if (sStartAPCmd.bShareKeyAuth == TRUE){
-            pMgmt->bShareKeyAlgorithm = TRUE;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Share Key \n");
-        }
-        else {
-            pMgmt->bShareKeyAlgorithm = FALSE;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Open System \n");
-        }
-        memcpy(pMgmt->abyIBSSSuppRates, abySuppRates, 6);
-
-        if (sStartAPCmd.byBasicRate & BIT3) {
-            pMgmt->abyIBSSSuppRates[2] |= BIT7;
-            pMgmt->abyIBSSSuppRates[3] |= BIT7;
-            pMgmt->abyIBSSSuppRates[4] |= BIT7;
-            pMgmt->abyIBSSSuppRates[5] |= BIT7;
-        }else if (sStartAPCmd.byBasicRate & BIT2) {
-             pMgmt->abyIBSSSuppRates[2] |= BIT7;
-             pMgmt->abyIBSSSuppRates[3] |= BIT7;
-             pMgmt->abyIBSSSuppRates[4] |= BIT7;
-        }else if (sStartAPCmd.byBasicRate & BIT1) {
-             pMgmt->abyIBSSSuppRates[2] |= BIT7;
-             pMgmt->abyIBSSSuppRates[3] |= BIT7;
-        }else if (sStartAPCmd.byBasicRate & BIT1) {
-             pMgmt->abyIBSSSuppRates[2] |= BIT7;
-        }else {
-            //default 1,2M
-             pMgmt->abyIBSSSuppRates[2] |= BIT7;
-             pMgmt->abyIBSSSuppRates[3] |= BIT7;
-        }
-
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Support Rate= %x %x %x %x\n",
-                pMgmt->abyIBSSSuppRates[2],
-                pMgmt->abyIBSSSuppRates[3],
-                pMgmt->abyIBSSSuppRates[4],
-                pMgmt->abyIBSSSuppRates[5]
-                );
-
-        netif_stop_queue(pDevice->dev);
-        spin_lock_irq(&pDevice->lock);
-	bScheduleCommand((void *) pDevice, WLAN_CMD_RUN_AP, NULL);
-        spin_unlock_irq(&pDevice->lock);
-        break;
-
-    case WLAN_CMD_GET_NODE_CNT:
+		if ((sStartAPCmd.uChannel > 0) && (sStartAPCmd.uChannel <= 14))
+			pDevice->uChannel = sStartAPCmd.uChannel;
+
+		if ((sStartAPCmd.uBeaconInt >= 20) && (sStartAPCmd.uBeaconInt <= 1000))
+			pMgmt->wIBSSBeaconPeriod = sStartAPCmd.uBeaconInt;
+		else
+			pMgmt->wIBSSBeaconPeriod = 100;
+
+		if (sStartAPCmd.bShareKeyAuth == TRUE) {
+			pMgmt->bShareKeyAlgorithm = TRUE;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Share Key\n");
+		} else {
+			pMgmt->bShareKeyAlgorithm = FALSE;
+			DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Open System\n");
+		}
+		memcpy(pMgmt->abyIBSSSuppRates, abySuppRates, 6);
+
+		if (sStartAPCmd.byBasicRate & BIT3) {
+			pMgmt->abyIBSSSuppRates[2] |= BIT7;
+			pMgmt->abyIBSSSuppRates[3] |= BIT7;
+			pMgmt->abyIBSSSuppRates[4] |= BIT7;
+			pMgmt->abyIBSSSuppRates[5] |= BIT7;
+		} else if (sStartAPCmd.byBasicRate & BIT2) {
+			pMgmt->abyIBSSSuppRates[2] |= BIT7;
+			pMgmt->abyIBSSSuppRates[3] |= BIT7;
+			pMgmt->abyIBSSSuppRates[4] |= BIT7;
+		} else if (sStartAPCmd.byBasicRate & BIT1) {
+			pMgmt->abyIBSSSuppRates[2] |= BIT7;
+			pMgmt->abyIBSSSuppRates[3] |= BIT7;
+		} else if (sStartAPCmd.byBasicRate & BIT1) {
+			pMgmt->abyIBSSSuppRates[2] |= BIT7;
+		} else {
+			/* default 1,2M */
+			pMgmt->abyIBSSSuppRates[2] |= BIT7;
+			pMgmt->abyIBSSSuppRates[3] |= BIT7;
+		}
 
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Support Rate= %x %x %x %x\n",
+			pMgmt->abyIBSSSuppRates[2],
+			pMgmt->abyIBSSSuppRates[3],
+			pMgmt->abyIBSSSuppRates[4],
+			pMgmt->abyIBSSSuppRates[5]);
+
+		netif_stop_queue(pDevice->dev);
+		spin_lock_irq(&pDevice->lock);
+		bScheduleCommand((void *)pDevice, WLAN_CMD_RUN_AP, NULL);
+		spin_unlock_irq(&pDevice->lock);
+		break;
+
+	case WLAN_CMD_GET_NODE_CNT:
 		cbListCount = 0;
 		pNode = &(pMgmt->sNodeDBTable[0]);
-        for (ii = 0; ii < (MAX_NODE_NUM + 1); ii++) {
-            pNode = &(pMgmt->sNodeDBTable[ii]);
-            if (!pNode->bActive)
-                continue;
-            cbListCount++;
-        }
-
-        sNodeList.uItem = cbListCount;
-        if (copy_to_user(pReq->data, &sNodeList, sizeof(SNodeList))) {
+		for (ii = 0; ii < (MAX_NODE_NUM + 1); ii++) {
+			pNode = &(pMgmt->sNodeDBTable[ii]);
+			if (!pNode->bActive)
+				continue;
+			cbListCount++;
+		}
+
+		sNodeList.uItem = cbListCount;
+		if (copy_to_user(pReq->data, &sNodeList, sizeof(SNodeList))) {
 			result = -EFAULT;
 			break;
 		}
-        pReq->wResult = 0;
-        break;
-
-    case WLAN_CMD_GET_NODE_LIST:
+		pReq->wResult = 0;
+		break;
 
-        if (copy_from_user(&sNodeList, pReq->data, sizeof(SNodeList))) {
+	case WLAN_CMD_GET_NODE_LIST:
+		if (copy_from_user(&sNodeList, pReq->data, sizeof(SNodeList))) {
 			result = -EFAULT;
 			break;
 		}
-        pNodeList = (PSNodeList)kmalloc(sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)), (int)GFP_ATOMIC);
-        if (pNodeList == NULL) {
-            result = -ENOMEM;
-            break;
-        }
+		pNodeList = (PSNodeList)kmalloc(sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)), (int)GFP_ATOMIC);
+		if (pNodeList == NULL) {
+			result = -ENOMEM;
+			break;
+		}
 		pNodeList->uItem = sNodeList.uItem;
 		pNode = &(pMgmt->sNodeDBTable[0]);
-        for (ii = 0, jj = 0; ii < (MAX_NODE_NUM + 1); ii++) {
-            pNode = &(pMgmt->sNodeDBTable[ii]);
-            if (pNode->bActive) {
-    		    pNodeList->sNodeList[jj].wAID = pNode->wAID;
-    		    memcpy(pNodeList->sNodeList[jj].abyMACAddr, pNode->abyMACAddr, WLAN_ADDR_LEN);
-    		    pNodeList->sNodeList[jj].wTxDataRate = pNode->wTxDataRate;
-    		    pNodeList->sNodeList[jj].wInActiveCount = (WORD)pNode->uInActiveCount;
-    		    pNodeList->sNodeList[jj].wEnQueueCnt = (WORD)pNode->wEnQueueCnt;
-    		    pNodeList->sNodeList[jj].wFlags = (WORD)pNode->dwFlags;
-    		    pNodeList->sNodeList[jj].bPWBitOn = pNode->bPSEnable;
-    		    pNodeList->sNodeList[jj].byKeyIndex = pNode->byKeyIndex;
-    		    pNodeList->sNodeList[jj].wWepKeyLength = pNode->uWepKeyLength;
-    		    memcpy(&(pNodeList->sNodeList[jj].abyWepKey[0]), &(pNode->abyWepKey[0]), WEP_KEYMAXLEN);
-                DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "key= %2.2X:%2.2X:%2.2X:%2.2X:%2.2X\n",
-                            pNodeList->sNodeList[jj].abyWepKey[0],
-                            pNodeList->sNodeList[jj].abyWepKey[1],
-                            pNodeList->sNodeList[jj].abyWepKey[2],
-                            pNodeList->sNodeList[jj].abyWepKey[3],
-                            pNodeList->sNodeList[jj].abyWepKey[4]
-                           );
-    		    pNodeList->sNodeList[jj].bIsInFallback = pNode->bIsInFallback;
-    		    pNodeList->sNodeList[jj].uTxFailures = pNode->uTxFailures;
-    		    pNodeList->sNodeList[jj].uTxAttempts = pNode->uTxAttempts;
-    		    pNodeList->sNodeList[jj].wFailureRatio = (WORD)pNode->uFailureRatio;
-    		    jj ++;
-    		    if (jj >= pNodeList->uItem)
-    		        break;
-    		}
-		}
-        if (copy_to_user(pReq->data, pNodeList, sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)))) {
+		for (ii = 0, jj = 0; ii < (MAX_NODE_NUM + 1); ii++) {
+			pNode = &(pMgmt->sNodeDBTable[ii]);
+			if (pNode->bActive) {
+				pNodeList->sNodeList[jj].wAID = pNode->wAID;
+				memcpy(pNodeList->sNodeList[jj].abyMACAddr, pNode->abyMACAddr, WLAN_ADDR_LEN);
+				pNodeList->sNodeList[jj].wTxDataRate = pNode->wTxDataRate;
+				pNodeList->sNodeList[jj].wInActiveCount = (WORD)pNode->uInActiveCount;
+				pNodeList->sNodeList[jj].wEnQueueCnt = (WORD)pNode->wEnQueueCnt;
+				pNodeList->sNodeList[jj].wFlags = (WORD)pNode->dwFlags;
+				pNodeList->sNodeList[jj].bPWBitOn = pNode->bPSEnable;
+				pNodeList->sNodeList[jj].byKeyIndex = pNode->byKeyIndex;
+				pNodeList->sNodeList[jj].wWepKeyLength = pNode->uWepKeyLength;
+				memcpy(&(pNodeList->sNodeList[jj].abyWepKey[0]), &(pNode->abyWepKey[0]), WEP_KEYMAXLEN);
+				DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "key= %2.2X:%2.2X:%2.2X:%2.2X:%2.2X\n",
+					pNodeList->sNodeList[jj].abyWepKey[0],
+					pNodeList->sNodeList[jj].abyWepKey[1],
+					pNodeList->sNodeList[jj].abyWepKey[2],
+					pNodeList->sNodeList[jj].abyWepKey[3],
+					pNodeList->sNodeList[jj].abyWepKey[4]);
+				pNodeList->sNodeList[jj].bIsInFallback = pNode->bIsInFallback;
+				pNodeList->sNodeList[jj].uTxFailures = pNode->uTxFailures;
+				pNodeList->sNodeList[jj].uTxAttempts = pNode->uTxAttempts;
+				pNodeList->sNodeList[jj].wFailureRatio = (WORD)pNode->uFailureRatio;
+				jj++;
+				if (jj >= pNodeList->uItem)
+					break;
+			}
+		}
+		if (copy_to_user(pReq->data, pNodeList, sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)))) {
 			result = -EFAULT;
 			break;
 		}
-        kfree(pNodeList);
-        pReq->wResult = 0;
-        break;
-
-    case 0xFF:
-        memset(wpa_Result.ifname,0,sizeof(wpa_Result.ifname));
-	    wpa_Result.proto = 0;
-	    wpa_Result.key_mgmt = 0;
-	    wpa_Result.eap_type = 0;
-	    wpa_Result.authenticated = FALSE;
-	      pDevice->fWPA_Authened = FALSE;
-        if (copy_from_user(&wpa_Result, pReq->data, sizeof(wpa_Result))) {
-            result = -EFAULT;
+		kfree(pNodeList);
+		pReq->wResult = 0;
+		break;
+
+	case 0xFF:
+		memset(wpa_Result.ifname, 0, sizeof(wpa_Result.ifname));
+		wpa_Result.proto = 0;
+		wpa_Result.key_mgmt = 0;
+		wpa_Result.eap_type = 0;
+		wpa_Result.authenticated = FALSE;
+		pDevice->fWPA_Authened = FALSE;
+		if (copy_from_user(&wpa_Result, pReq->data, sizeof(wpa_Result))) {
+			result = -EFAULT;
 			break;
 		}
-//DavidWang  for some AP maybe good authenticate
-   if(wpa_Result.key_mgmt==0x20)
-      pMgmt->Cisco_cckm =1;
-    else
-    pMgmt->Cisco_cckm =0;
-
-
-if(wpa_Result.authenticated==TRUE) {
-   {
-     union iwreq_data      wrqu;
-
-     pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
-
-     memset(&wrqu, 0, sizeof(wrqu));
-     wrqu.data.flags = RT_WPACONNECTED_EVENT_FLAG;
-     wrqu.data.length =pItemSSID->len;
-     wireless_send_event(pDevice->dev, IWEVCUSTOM, &wrqu, pItemSSID->abySSID);
-   }
-         pDevice->fWPA_Authened = TRUE;           //is successful peer to wpa_Result.authenticated?
-}
+		/* for some AP maybe good authenticate */
+		if (wpa_Result.key_mgmt == 0x20)
+			pMgmt->Cisco_cckm = 1;
+		else
+			pMgmt->Cisco_cckm = 0;
+
+		if (wpa_Result.authenticated == TRUE) {
+			{
+				union iwreq_data wrqu;
+
+				pItemSSID = (PWLAN_IE_SSID)pMgmt->abyCurrSSID;
+				memset(&wrqu, 0, sizeof(wrqu));
+				wrqu.data.flags = RT_WPACONNECTED_EVENT_FLAG;
+				wrqu.data.length = pItemSSID->len;
+				wireless_send_event(pDevice->dev, IWEVCUSTOM, &wrqu, pItemSSID->abySSID);
+			}
 
-        //printk("get private wpa_supplicant announce WPA SM\n");
-	//printk("wpa-->ifname=%s\n",wpa_Result.ifname);
-	//printk("wpa-->proto=%d\n",wpa_Result.proto);
-	//printk("wpa-->key-mgmt=%d\n",wpa_Result.key_mgmt);
-	//printk("wpa-->eap_type=%d\n",wpa_Result.eap_type);
-	//printk("wpa-->authenticated is %s\n",(wpa_Result.authenticated==TRUE)?"TRUE":"FALSE");
+			pDevice->fWPA_Authened = TRUE; /* is successful peer to wpa_Result.authenticated? */
+		}
 
-	pReq->wResult = 0;
-        break;
+		pReq->wResult = 0;
+		break;
 
-    default:
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Private command not support..\n");
-    }
+	default:
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Private command not support..\n");
+	}
 
-    return result;
+	return result;
 }
diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index 1ff394074cba..27521b69ce08 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -611,17 +611,10 @@ static BOOL device_init_registers(PSDevice pDevice, DEVICE_INIT_TYPE InitType)
 
         // if exist SW network address, use SW network address.
 
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Network address = %02x-%02x-%02x=%02x-%02x-%02x\n",
-            pDevice->abyCurrentNetAddr[0],
-            pDevice->abyCurrentNetAddr[1],
-            pDevice->abyCurrentNetAddr[2],
-            pDevice->abyCurrentNetAddr[3],
-            pDevice->abyCurrentNetAddr[4],
-            pDevice->abyCurrentNetAddr[5]);
+	DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Network address = %pM\n",
+		pDevice->abyCurrentNetAddr);
     }
 
-
-
     // Set BB and packet type at the same time.
     // Set Short Slot Time, xIFS, and RSPINF.
     if (pDevice->byBBType == BB_TYPE_11A) {
diff --git a/drivers/staging/vt6656/wmgr.c b/drivers/staging/vt6656/wmgr.c
index d67748f90b14..f08e2d15c7b3 100644
--- a/drivers/staging/vt6656/wmgr.c
+++ b/drivers/staging/vt6656/wmgr.c
@@ -2477,14 +2477,8 @@ void vMgrCreateOwnIBSS(void *hDeviceContext,
     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
         // AP mode BSSID = MAC addr
         memcpy(pMgmt->abyCurrBSSID, pMgmt->abyMACAddr, WLAN_ADDR_LEN);
-        DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"AP beacon created BSSID:%02x-%02x-%02x-%02x-%02x-%02x \n",
-                      pMgmt->abyCurrBSSID[0],
-                      pMgmt->abyCurrBSSID[1],
-                      pMgmt->abyCurrBSSID[2],
-                      pMgmt->abyCurrBSSID[3],
-                      pMgmt->abyCurrBSSID[4],
-                      pMgmt->abyCurrBSSID[5]
-                    );
+		DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"AP beacon created BSSID:"
+			"%pM\n", pMgmt->abyCurrBSSID);
     }
 
     if (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA) {
@@ -2506,14 +2500,8 @@ void vMgrCreateOwnIBSS(void *hDeviceContext,
         pMgmt->abyCurrBSSID[0] |= IEEE_ADDR_UNIVERSAL;
 
 
-        DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"Adhoc beacon created bssid:%02x-%02x-%02x-%02x-%02x-%02x \n",
-                      pMgmt->abyCurrBSSID[0],
-                      pMgmt->abyCurrBSSID[1],
-                      pMgmt->abyCurrBSSID[2],
-                      pMgmt->abyCurrBSSID[3],
-                      pMgmt->abyCurrBSSID[4],
-                      pMgmt->abyCurrBSSID[5]
-                    );
+		DBG_PRT(MSG_LEVEL_INFO, KERN_INFO"Adhoc beacon created bssid:"
+			"%pM\n", pMgmt->abyCurrBSSID);
     }
 
     // set BSSID filter
@@ -2878,14 +2866,8 @@ void vMgrJoinBSSBegin(void *hDeviceContext, PCMD_STATUS pStatus)
             ControlvMaskByte(pDevice,MESSAGE_REQUEST_MACREG,MAC_REG_PAPEDELAY,LEDSTS_STS,LEDSTS_INTER);
             memcpy(pDevice->abyBSSID, pCurr->abyBSSID, WLAN_BSSID_LEN);
 
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Join IBSS ok:%02x-%02x-%02x-%02x-%02x-%02x \n",
-                  pMgmt->abyCurrBSSID[0],
-                  pMgmt->abyCurrBSSID[1],
-                  pMgmt->abyCurrBSSID[2],
-                  pMgmt->abyCurrBSSID[3],
-                  pMgmt->abyCurrBSSID[4],
-                  pMgmt->abyCurrBSSID[5]
-                );
+		DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Join IBSS ok:%pM\n",
+			pMgmt->abyCurrBSSID);
             // Preamble type auto-switch: if AP can receive short-preamble cap,
             // and if registry setting is short preamble we can turn on too.
 
@@ -2983,13 +2965,8 @@ s_vMgrSynchBSS (
 
     memcpy(pMgmt->abyCurrBSSID, pCurr->abyBSSID, 6);
 
-    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Sync:set CurrBSSID address = %02x-%02x-%02x=%02x-%02x-%02x\n",
-        pMgmt->abyCurrBSSID[0],
-        pMgmt->abyCurrBSSID[1],
-        pMgmt->abyCurrBSSID[2],
-        pMgmt->abyCurrBSSID[3],
-        pMgmt->abyCurrBSSID[4],
-        pMgmt->abyCurrBSSID[5]);
+	DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Sync:set CurrBSSID address = "
+		"%pM\n", pMgmt->abyCurrBSSID);
 
     if (pCurr->eNetworkTypeInUse == PHY_TYPE_11A) {
         if ((pDevice->eConfigPHYMode == PHY_TYPE_11A) ||
@@ -4334,14 +4311,8 @@ s_vMgrRxProbeRequest(
         sFrame.pBuf = (PBYTE)pRxPacket->p80211Header;
         vMgrDecodeProbeRequest(&sFrame);
 /*
-        DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe request rx:MAC addr:%02x-%02x-%02x=%02x-%02x-%02x \n",
-                  sFrame.pHdr->sA3.abyAddr2[0],
-                  sFrame.pHdr->sA3.abyAddr2[1],
-                  sFrame.pHdr->sA3.abyAddr2[2],
-                  sFrame.pHdr->sA3.abyAddr2[3],
-                  sFrame.pHdr->sA3.abyAddr2[4],
-                  sFrame.pHdr->sA3.abyAddr2[5]
-                );
+	DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Probe request rx:MAC addr:%pM\n",
+		sFrame.pHdr->sA3.abyAddr2);
 */
         if (sFrame.pSSID->len != 0) {
             if (sFrame.pSSID->len != ((PWLAN_IE_SSID)pMgmt->abyCurrSSID)->len)
diff --git a/drivers/staging/vt6656/wpactl.c b/drivers/staging/vt6656/wpactl.c
index 9216df01829e..2fa4f845a755 100644
--- a/drivers/staging/vt6656/wpactl.c
+++ b/drivers/staging/vt6656/wpactl.c
@@ -229,6 +229,9 @@ int wpa_set_wpadev(PSDevice pDevice, int val)
         return ret;
     }
 
+	if (param->u.wpa_key.key && param->u.wpa_key.key_len > sizeof(abyKey))
+		return -EINVAL;
+
     spin_unlock_irq(&pDevice->lock);
     if(param->u.wpa_key.key && fcpfkernel) {
        memcpy(&abyKey[0], param->u.wpa_key.key, param->u.wpa_key.key_len);
@@ -269,6 +272,10 @@ int wpa_set_wpadev(PSDevice pDevice, int val)
         return ret;
 	}
 
+
+	if (param->u.wpa_key.seq && param->u.wpa_key.seq_len > sizeof(abySeq))
+		return -EINVAL;
+
     spin_unlock_irq(&pDevice->lock);
         if(param->u.wpa_key.seq && fcpfkernel) {
            memcpy(&abySeq[0], param->u.wpa_key.seq, param->u.wpa_key.seq_len);
@@ -772,9 +779,14 @@ static int wpa_set_associate(PSDevice pDevice,
     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wpa_ie_len = %d\n", param->u.wpa_associate.wpa_ie_len);
     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Roaming dBm = %d\n", param->u.wpa_associate.roam_dbm);  //Davidwang
 
-	if (param->u.wpa_associate.wpa_ie &&
-	    copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))
-	    return -EINVAL;
+	if (param->u.wpa_associate.wpa_ie) {
+		if (param->u.wpa_associate.wpa_ie_len > sizeof(abyWPAIE))
+			return -EINVAL;
+
+		if (copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie,
+					param->u.wpa_associate.wpa_ie_len))
+			return -EFAULT;
+	}
 
 	if (param->u.wpa_associate.mode == 1)
 	    pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;