drivers/staging/rt2870/common/rtusb_io.c

   1 /*
   2  *************************************************************************
   3  * Ralink Tech Inc.
   4  * 5F., No.36, Taiyuan St., Jhubei City,
   5  * Hsinchu County 302,
   6  * Taiwan, R.O.C.
   7  *
   8  * (c) Copyright 2002-2007, Ralink Technology, Inc.
   9  *
  10  * This program is free software; you can redistribute it and/or modify  *
  11  * it under the terms of the GNU General Public License as published by  *
  12  * the Free Software Foundation; either version 2 of the License, or     *
  13  * (at your option) any later version.                                   *
  14  *                                                                       *
  15  * This program is distributed in the hope that it will be useful,       *
  16  * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
  18  * GNU General Public License for more details.                          *
  19  *                                                                       *
  20  * You should have received a copy of the GNU General Public License     *
  21  * along with this program; if not, write to the                         *
  22  * Free Software Foundation, Inc.,                                       *
  23  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  24  *                                                                       *
  25  *************************************************************************
  26
  27         Module Name:
  28         rtusb_io.c
  29
  30         Abstract:
  31
  32         Revision History:
  33         Who                     When        What
  34         --------        ----------  ----------------------------------------------
  35         Name            Date        Modification logs
  36         Paul Lin    06-25-2004  created
  37 */
  38
  39 #include "../rt_config.h"
  40
  41
  42 /*
  43         ========================================================================
  44
  45         Routine Description: NIC initialization complete
  46
  47         Arguments:
  48
  49         Return Value:
  50
  51         IRQL =
  52
  53         Note:
  54
  55         ========================================================================
  56 */
  57
  58 NTSTATUS        RTUSBFirmwareRun(
  59         IN      PRTMP_ADAPTER   pAd)
  60 {
  61         NTSTATUS        Status;
  62
  63         Status = RTUSB_VendorRequest(
  64                 pAd,
  65                 USBD_TRANSFER_DIRECTION_OUT,
  66                 DEVICE_VENDOR_REQUEST_OUT,
  67                 0x01,
  68                 0x8,
  69                 0,
  70                 NULL,
  71                 0);
  72
  73         return Status;
  74 }
  75
  76
  77
  78 /*
  79         ========================================================================
  80
  81         Routine Description: Write Firmware to NIC.
  82
  83         Arguments:
  84
  85         Return Value:
  86
  87         IRQL =
  88
  89         Note:
  90
  91         ========================================================================
  92 */
  93 NTSTATUS RTUSBFirmwareWrite(
  94         IN PRTMP_ADAPTER pAd,
  95         IN PUCHAR               pFwImage,
  96         IN ULONG                FwLen)
  97 {
  98         UINT32          MacReg;
  99         NTSTATUS        Status;
 100 //      ULONG           i;
 101         USHORT          writeLen;
 102
 103         Status = RTUSBReadMACRegister(pAd, MAC_CSR0, &MacReg);
 104
 105
 106         writeLen = FwLen;
 107         RTUSBMultiWrite(pAd, FIRMWARE_IMAGE_BASE, pFwImage, writeLen);
 108
 109         Status = RTUSBWriteMACRegister(pAd, 0x7014, 0xffffffff);
 110         Status = RTUSBWriteMACRegister(pAd, 0x701c, 0xffffffff);
 111         Status = RTUSBFirmwareRun(pAd);
 112
 113 #ifdef RT30xx
 114         RTMPusecDelay(10000);
 115         RTUSBWriteMACRegister(pAd,H2M_MAILBOX_CSR,0);
 116         AsicSendCommandToMcu(pAd, 0x72, 0x00, 0x00, 0x00);//reset rf by MCU supported by new firmware
 117 #endif
 118
 119         return Status;
 120 }
 121
 122
 123 /*
 124         ========================================================================
 125
 126         Routine Description: Get current firmware operation mode (Return Value)
 127
 128         Arguments:
 129
 130         Return Value:
 131                 0 or 1 = Downloaded by host driver
 132                 others = Driver doesn't download firmware
 133
 134         IRQL =
 135
 136         Note:
 137
 138         ========================================================================
 139 */
 140 NTSTATUS        RTUSBFirmwareOpmode(
 141         IN      PRTMP_ADAPTER   pAd,
 142         OUT     PUINT32                 pValue)
 143 {
 144         NTSTATUS        Status;
 145
 146         Status = RTUSB_VendorRequest(
 147                 pAd,
 148                 (USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK),
 149                 DEVICE_VENDOR_REQUEST_IN,
 150                 0x1,
 151                 0x11,
 152                 0,
 153                 pValue,
 154                 4);
 155         return Status;
 156 }
 157 NTSTATUS        RTUSBVenderReset(
 158         IN      PRTMP_ADAPTER   pAd)
 159 {
 160         NTSTATUS        Status;
 161         DBGPRINT_RAW(RT_DEBUG_ERROR, ("-->RTUSBVenderReset\n"));
 162         Status = RTUSB_VendorRequest(
 163                 pAd,
 164                 USBD_TRANSFER_DIRECTION_OUT,
 165                 DEVICE_VENDOR_REQUEST_OUT,
 166                 0x01,
 167                 0x1,
 168                 0,
 169                 NULL,
 170                 0);
 171
 172         DBGPRINT_RAW(RT_DEBUG_ERROR, ("<--RTUSBVenderReset\n"));
 173         return Status;
 174 }
 175 /*
 176         ========================================================================
 177
 178         Routine Description: Read various length data from RT2573
 179
 180         Arguments:
 181
 182         Return Value:
 183
 184         IRQL =
 185
 186         Note:
 187
 188         ========================================================================
 189 */
 190 NTSTATUS        RTUSBMultiRead(
 191         IN      PRTMP_ADAPTER   pAd,
 192         IN      USHORT                  Offset,
 193         OUT     PUCHAR                  pData,
 194         IN      USHORT                  length)
 195 {
 196         NTSTATUS        Status;
 197
 198         Status = RTUSB_VendorRequest(
 199                 pAd,
 200                 (USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK),
 201                 DEVICE_VENDOR_REQUEST_IN,
 202                 0x7,
 203                 0,
 204                 Offset,
 205                 pData,
 206                 length);
 207
 208         return Status;
 209 }
 210
 211 /*
 212         ========================================================================
 213
 214         Routine Description: Write various length data to RT2573
 215
 216         Arguments:
 217
 218         Return Value:
 219
 220         IRQL =
 221
 222         Note:
 223
 224         ========================================================================
 225 */
 226 NTSTATUS        RTUSBMultiWrite_OneByte(
 227         IN      PRTMP_ADAPTER   pAd,
 228         IN      USHORT                  Offset,
 229         IN      PUCHAR                  pData)
 230 {
 231         NTSTATUS        Status;
 232
 233         // TODO: In 2870, use this funciton carefully cause it's not stable.
 234         Status = RTUSB_VendorRequest(
 235                 pAd,
 236                 USBD_TRANSFER_DIRECTION_OUT,
 237                 DEVICE_VENDOR_REQUEST_OUT,
 238                 0x6,
 239                 0,
 240                 Offset,
 241                 pData,
 242                 1);
 243
 244         return Status;
 245 }
 246
 247 NTSTATUS        RTUSBMultiWrite(
 248         IN      PRTMP_ADAPTER   pAd,
 249         IN      USHORT                  Offset,
 250         IN      PUCHAR                  pData,
 251         IN      USHORT                  length)
 252 {
 253         NTSTATUS        Status;
 254
 255
 256         USHORT          index = 0,Value;
 257         PUCHAR          pSrc = pData;
 258         USHORT          resude = 0;
 259
 260         resude = length % 2;
 261                 length  += resude;
 262                 do
 263                 {
 264                         Value =(USHORT)( *pSrc  | (*(pSrc + 1) << 8));
 265                 Status = RTUSBSingleWrite(pAd,Offset + index,Value);
 266             index +=2;
 267             length -= 2;
 268             pSrc = pSrc + 2;
 269         }while(length > 0);
 270
 271         return Status;
 272 }
 273
 274
 275 NTSTATUS RTUSBSingleWrite(
 276         IN      RTMP_ADAPTER    *pAd,
 277         IN      USHORT                  Offset,
 278         IN      USHORT                  Value)
 279 {
 280         NTSTATUS        Status;
 281
 282         Status = RTUSB_VendorRequest(
 283                 pAd,
 284                 USBD_TRANSFER_DIRECTION_OUT,
 285                 DEVICE_VENDOR_REQUEST_OUT,
 286                 0x2,
 287                 Value,
 288                 Offset,
 289                 NULL,
 290                 0);
 291
 292         return Status;
 293
 294 }
 295
 296
 297 /*
 298         ========================================================================
 299
 300         Routine Description: Read 32-bit MAC register
 301
 302         Arguments:
 303
 304         Return Value:
 305
 306         IRQL =
 307
 308         Note:
 309
 310         ========================================================================
 311 */
 312 NTSTATUS        RTUSBReadMACRegister(
 313         IN      PRTMP_ADAPTER   pAd,
 314         IN      USHORT                  Offset,
 315         OUT     PUINT32                 pValue)
 316 {
 317         NTSTATUS        Status;
 318         UINT32          localVal;
 319
 320         Status = RTUSB_VendorRequest(
 321                 pAd,
 322                 (USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK),
 323                 DEVICE_VENDOR_REQUEST_IN,
 324                 0x7,
 325                 0,
 326                 Offset,
 327                 &localVal,
 328                 4);
 329
 330         *pValue = le2cpu32(localVal);
 331
 332
 333         if (Status < 0)
 334                 *pValue = 0xffffffff;
 335
 336         return Status;
 337 }
 338
 339
 340 /*
 341         ========================================================================
 342
 343         Routine Description: Write 32-bit MAC register
 344
 345         Arguments:
 346
 347         Return Value:
 348
 349         IRQL =
 350
 351         Note:
 352
 353         ========================================================================
 354 */
 355 NTSTATUS        RTUSBWriteMACRegister(
 356         IN      PRTMP_ADAPTER   pAd,
 357         IN      USHORT                  Offset,
 358         IN      UINT32                  Value)
 359 {
 360         NTSTATUS        Status;
 361         UINT32          localVal;
 362
 363         localVal = Value;
 364
 365         Status = RTUSBSingleWrite(pAd, Offset, (USHORT)(localVal & 0xffff));
 366         Status = RTUSBSingleWrite(pAd, Offset + 2, (USHORT)((localVal & 0xffff0000) >> 16));
 367
 368         return Status;
 369 }
 370
 371
 372
 373 #if 1
 374 /*
 375         ========================================================================
 376
 377         Routine Description: Read 8-bit BBP register
 378
 379         Arguments:
 380
 381         Return Value:
 382
 383         IRQL =
 384
 385         Note:
 386
 387         ========================================================================
 388 */
 389 NTSTATUS        RTUSBReadBBPRegister(
 390         IN      PRTMP_ADAPTER   pAd,
 391         IN      UCHAR                   Id,
 392         IN      PUCHAR                  pValue)
 393 {
 394         BBP_CSR_CFG_STRUC       BbpCsr;
 395         UINT                    i = 0;
 396         NTSTATUS                status;
 397
 398         // Verify the busy condition
 399         do
 400         {
 401                 status = RTUSBReadMACRegister(pAd, BBP_CSR_CFG, &BbpCsr.word);
 402                 if(status >= 0)
 403                 {
 404                 if (!(BbpCsr.field.Busy == BUSY))
 405                         break;
 406                 }
 407                 printk("RTUSBReadBBPRegister(BBP_CSR_CFG_1):retry count=%d!\n", i);
 408                 i++;
 409         }
 410         while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
 411
 412         if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
 413         {
 414                 //
 415                 // Read failed then Return Default value.
 416                 //
 417                 *pValue = pAd->BbpWriteLatch[Id];
 418
 419                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
 420                 return STATUS_UNSUCCESSFUL;
 421         }
 422
 423         // Prepare for write material
 424         BbpCsr.word                             = 0;
 425         BbpCsr.field.fRead                      = 1;
 426         BbpCsr.field.Busy                       = 1;
 427         BbpCsr.field.RegNum             = Id;
 428         RTUSBWriteMACRegister(pAd, BBP_CSR_CFG, BbpCsr.word);
 429
 430         i = 0;
 431         // Verify the busy condition
 432         do
 433         {
 434                 status = RTUSBReadMACRegister(pAd, BBP_CSR_CFG, &BbpCsr.word);
 435                 if (status >= 0)
 436                 {
 437                 if (!(BbpCsr.field.Busy == BUSY))
 438                 {
 439                         *pValue = (UCHAR)BbpCsr.field.Value;
 440                         break;
 441                 }
 442                 }
 443                 printk("RTUSBReadBBPRegister(BBP_CSR_CFG_2):retry count=%d!\n", i);
 444                 i++;
 445         }
 446         while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
 447
 448         if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
 449         {
 450                 //
 451                 // Read failed then Return Default value.
 452                 //
 453                 *pValue = pAd->BbpWriteLatch[Id];
 454
 455                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
 456                 return STATUS_UNSUCCESSFUL;
 457         }
 458
 459         return STATUS_SUCCESS;
 460 }
 461 #else
 462 /*
 463         ========================================================================
 464
 465         Routine Description: Read 8-bit BBP register via firmware
 466
 467         Arguments:
 468
 469         Return Value:
 470
 471         IRQL =
 472
 473         Note:
 474
 475         ========================================================================
 476 */
 477 NTSTATUS        RTUSBReadBBPRegister(
 478         IN      PRTMP_ADAPTER   pAd,
 479         IN      UCHAR                   Id,
 480         IN      PUCHAR                  pValue)
 481 {
 482         BBP_CSR_CFG_STRUC       BbpCsr;
 483         int                                     i, k;
 484         for (i=0; i<MAX_BUSY_COUNT; i++)
 485         {
 486                 RTUSBReadMACRegister(pAd, H2M_BBP_AGENT, &BbpCsr.word);
 487                 if (BbpCsr.field.Busy == BUSY)
 488                 {
 489                         continue;
 490                 }
 491                 BbpCsr.word = 0;
 492                 BbpCsr.field.fRead = 1;
 493                 BbpCsr.field.BBP_RW_MODE = 1;
 494                 BbpCsr.field.Busy = 1;
 495                 BbpCsr.field.RegNum = Id;
 496                 RTUSBWriteMACRegister(pAd, H2M_BBP_AGENT, BbpCsr.word);
 497                 AsicSendCommandToMcu(pAd, 0x80, 0xff, 0x0, 0x0);
 498                 for (k=0; k<MAX_BUSY_COUNT; k++)
 499                 {
 500                         RTUSBReadMACRegister(pAd, H2M_BBP_AGENT, &BbpCsr.word);
 501                         if (BbpCsr.field.Busy == IDLE)
 502                                 break;
 503                 }
 504                 if ((BbpCsr.field.Busy == IDLE) &&
 505                         (BbpCsr.field.RegNum == Id))
 506                 {
 507                         *pValue = (UCHAR)BbpCsr.field.Value;
 508                         break;
 509                 }
 510         }
 511         if (BbpCsr.field.Busy == BUSY)
 512         {
 513                 DBGPRINT_ERR(("BBP read R%d=0x%x fail\n", Id, BbpCsr.word));
 514                 *pValue = pAd->BbpWriteLatch[Id];
 515                 return STATUS_UNSUCCESSFUL;
 516         }
 517         return STATUS_SUCCESS;
 518 }
 519 #endif
 520
 521 #if 1
 522 /*
 523         ========================================================================
 524
 525         Routine Description: Write 8-bit BBP register
 526
 527         Arguments:
 528
 529         Return Value:
 530
 531         IRQL =
 532
 533         Note:
 534
 535         ========================================================================
 536 */
 537 NTSTATUS        RTUSBWriteBBPRegister(
 538         IN      PRTMP_ADAPTER   pAd,
 539         IN      UCHAR                   Id,
 540         IN      UCHAR                   Value)
 541 {
 542         BBP_CSR_CFG_STRUC       BbpCsr;
 543         UINT                    i = 0;
 544         NTSTATUS                status;
 545         // Verify the busy condition
 546         do
 547         {
 548                 status = RTUSBReadMACRegister(pAd, BBP_CSR_CFG, &BbpCsr.word);
 549                 if (status >= 0)
 550                 {
 551                 if (!(BbpCsr.field.Busy == BUSY))
 552                         break;
 553                 }
 554                 printk("RTUSBWriteBBPRegister(BBP_CSR_CFG):retry count=%d!\n", i);
 555                 i++;
 556         }
 557         while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
 558
 559         if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
 560         {
 561                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
 562                 return STATUS_UNSUCCESSFUL;
 563         }
 564
 565         // Prepare for write material
 566         BbpCsr.word                             = 0;
 567         BbpCsr.field.fRead                      = 0;
 568         BbpCsr.field.Value                      = Value;
 569         BbpCsr.field.Busy                       = 1;
 570         BbpCsr.field.RegNum             = Id;
 571         RTUSBWriteMACRegister(pAd, BBP_CSR_CFG, BbpCsr.word);
 572
 573         pAd->BbpWriteLatch[Id] = Value;
 574
 575         return STATUS_SUCCESS;
 576 }
 577 #else
 578 /*
 579         ========================================================================
 580
 581         Routine Description: Write 8-bit BBP register via firmware
 582
 583         Arguments:
 584
 585         Return Value:
 586
 587         IRQL =
 588
 589         Note:
 590
 591         ========================================================================
 592 */
 593
 594 NTSTATUS        RTUSBWriteBBPRegister(
 595         IN      PRTMP_ADAPTER   pAd,
 596         IN      UCHAR                   Id,
 597         IN      UCHAR                   Value)
 598
 599 {
 600         BBP_CSR_CFG_STRUC       BbpCsr;
 601         int                                     BusyCnt;
 602         for (BusyCnt=0; BusyCnt<MAX_BUSY_COUNT; BusyCnt++)
 603         {
 604                 RTMP_IO_READ32(pAd, H2M_BBP_AGENT, &BbpCsr.word);
 605                 if (BbpCsr.field.Busy == BUSY)
 606                         continue;
 607                 BbpCsr.word = 0;
 608                 BbpCsr.field.fRead = 0;
 609                 BbpCsr.field.BBP_RW_MODE = 1;
 610                 BbpCsr.field.Busy = 1;
 611                 BbpCsr.field.Value = Value;
 612                 BbpCsr.field.RegNum = Id;
 613                 RTMP_IO_WRITE32(pAd, H2M_BBP_AGENT, BbpCsr.word);
 614                 AsicSendCommandToMcu(pAd, 0x80, 0xff, 0x0, 0x0);
 615                 pAd->BbpWriteLatch[Id] = Value;
 616                 break;
 617         }
 618         if (BusyCnt == MAX_BUSY_COUNT)
 619         {
 620                 DBGPRINT_ERR(("BBP write R%d=0x%x fail\n", Id, BbpCsr.word));
 621                 return STATUS_UNSUCCESSFUL;
 622         }
 623         return STATUS_SUCCESS;
 624 }
 625 #endif
 626 /*
 627         ========================================================================
 628
 629         Routine Description: Write RF register through MAC
 630
 631         Arguments:
 632
 633         Return Value:
 634
 635         IRQL =
 636
 637         Note:
 638
 639         ========================================================================
 640 */
 641 NTSTATUS        RTUSBWriteRFRegister(
 642         IN      PRTMP_ADAPTER   pAd,
 643         IN      UINT32                  Value)
 644 {
 645         PHY_CSR4_STRUC  PhyCsr4;
 646         UINT                    i = 0;
 647         NTSTATUS                status;
 648
 649         NdisZeroMemory(&PhyCsr4, sizeof(PHY_CSR4_STRUC));
 650         do
 651         {
 652                 status = RTUSBReadMACRegister(pAd, RF_CSR_CFG0, &PhyCsr4.word);
 653                 if (status >= 0)
 654                 {
 655                 if (!(PhyCsr4.field.Busy))
 656                         break;
 657                 }
 658                 printk("RTUSBWriteRFRegister(RF_CSR_CFG0):retry count=%d!\n", i);
 659                 i++;
 660         }
 661         while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
 662
 663         if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
 664         {
 665                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
 666                 return STATUS_UNSUCCESSFUL;
 667         }
 668
 669         RTUSBWriteMACRegister(pAd, RF_CSR_CFG0, Value);
 670
 671         return STATUS_SUCCESS;
 672 }
 673
 674 /*
 675         ========================================================================
 676
 677         Routine Description: Write RT30xx RF register through MAC
 678
 679         Arguments:
 680
 681         Return Value:
 682
 683         IRQL =
 684
 685         Note:
 686
 687         ========================================================================
 688 */
 689 NTSTATUS RT30xxWriteRFRegister(
 690         IN      PRTMP_ADAPTER   pAd,
 691         IN      UCHAR                   RegID,
 692         IN      UCHAR                   Value)
 693 {
 694         RF_CSR_CFG_STRUC        rfcsr;
 695         UINT                            i = 0;
 696
 697         do
 698         {
 699                 RTMP_IO_READ32(pAd, RF_CSR_CFG, &rfcsr.word);
 700
 701                 if (!rfcsr.field.RF_CSR_KICK)
 702                         break;
 703                 i++;
 704         }
 705         while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
 706
 707         if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
 708         {
 709                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
 710                 return STATUS_UNSUCCESSFUL;
 711         }
 712
 713         rfcsr.field.RF_CSR_WR = 1;
 714         rfcsr.field.RF_CSR_KICK = 1;
 715         rfcsr.field.TESTCSR_RFACC_REGNUM = RegID;
 716         rfcsr.field.RF_CSR_DATA = Value;
 717
 718         RTMP_IO_WRITE32(pAd, RF_CSR_CFG, rfcsr.word);
 719
 720         return STATUS_SUCCESS;
 721 }
 722
 723
 724 /*
 725         ========================================================================
 726
 727         Routine Description: Read RT30xx RF register through MAC
 728
 729         Arguments:
 730
 731         Return Value:
 732
 733         IRQL =
 734
 735         Note:
 736
 737         ========================================================================
 738 */
 739 NTSTATUS RT30xxReadRFRegister(
 740         IN      PRTMP_ADAPTER   pAd,
 741         IN      UCHAR                   RegID,
 742         IN      PUCHAR                  pValue)
 743 {
 744         RF_CSR_CFG_STRUC        rfcsr;
 745         UINT                            i=0, k=0;
 746
 747         for (i=0; i<MAX_BUSY_COUNT; i++)
 748         {
 749                 RTMP_IO_READ32(pAd, RF_CSR_CFG, &rfcsr.word);
 750
 751                 if (rfcsr.field.RF_CSR_KICK == BUSY)
 752                 {
 753                         continue;
 754                 }
 755                 rfcsr.word = 0;
 756                 rfcsr.field.RF_CSR_WR = 0;
 757                 rfcsr.field.RF_CSR_KICK = 1;
 758                 rfcsr.field.TESTCSR_RFACC_REGNUM = RegID;
 759                 RTMP_IO_WRITE32(pAd, RF_CSR_CFG, rfcsr.word);
 760                 for (k=0; k<MAX_BUSY_COUNT; k++)
 761                 {
 762                         RTMP_IO_READ32(pAd, RF_CSR_CFG, &rfcsr.word);
 763
 764                         if (rfcsr.field.RF_CSR_KICK == IDLE)
 765                                 break;
 766                 }
 767                 if ((rfcsr.field.RF_CSR_KICK == IDLE) &&
 768                         (rfcsr.field.TESTCSR_RFACC_REGNUM == RegID))
 769                 {
 770                         *pValue = (UCHAR)rfcsr.field.RF_CSR_DATA;
 771                         break;
 772                 }
 773         }
 774         if (rfcsr.field.RF_CSR_KICK == BUSY)
 775         {
 776                 DBGPRINT_ERR(("RF read R%d=0x%x fail, i[%d], k[%d]\n", RegID, rfcsr.word,i,k));
 777                 return STATUS_UNSUCCESSFUL;
 778         }
 779
 780         return STATUS_SUCCESS;
 781 }
 782
 783 /*
 784         ========================================================================
 785
 786         Routine Description:
 787
 788         Arguments:
 789
 790         Return Value:
 791
 792         IRQL =
 793
 794         Note:
 795
 796         ========================================================================
 797 */
 798 NTSTATUS        RTUSBReadEEPROM(
 799         IN      PRTMP_ADAPTER   pAd,
 800         IN      USHORT                  Offset,
 801         OUT     PUCHAR                  pData,
 802         IN      USHORT                  length)
 803 {
 804         NTSTATUS        Status = STATUS_SUCCESS;
 805
 806 #ifdef RT30xx
 807         if(pAd->bUseEfuse)
 808         {
 809                 Status =eFuseRead(pAd, Offset, pData, length);
 810         }
 811         else
 812 #endif // RT30xx //
 813         {
 814         Status = RTUSB_VendorRequest(
 815                 pAd,
 816                 (USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK),
 817                 DEVICE_VENDOR_REQUEST_IN,
 818                 0x9,
 819                 0,
 820                 Offset,
 821                 pData,
 822                 length);
 823         }
 824
 825         return Status;
 826 }
 827
 828 /*
 829         ========================================================================
 830
 831         Routine Description:
 832
 833         Arguments:
 834
 835         Return Value:
 836
 837         IRQL =
 838
 839         Note:
 840
 841         ========================================================================
 842 */
 843 NTSTATUS        RTUSBWriteEEPROM(
 844         IN      PRTMP_ADAPTER   pAd,
 845         IN      USHORT                  Offset,
 846         IN      PUCHAR                  pData,
 847         IN      USHORT                  length)
 848 {
 849         NTSTATUS        Status = STATUS_SUCCESS;
 850
 851 #ifdef RT30xx
 852         if(pAd->bUseEfuse)
 853         {
 854                 Status = eFuseWrite(pAd, Offset, pData, length);
 855         }
 856         else
 857 #endif // RT30xx //
 858         {
 859         Status = RTUSB_VendorRequest(
 860                 pAd,
 861                 USBD_TRANSFER_DIRECTION_OUT,
 862                 DEVICE_VENDOR_REQUEST_OUT,
 863                 0x8,
 864                 0,
 865                 Offset,
 866                 pData,
 867                 length);
 868         }
 869
 870         return Status;
 871 }
 872
 873 /*
 874         ========================================================================
 875
 876         Routine Description:
 877
 878         Arguments:
 879
 880         Return Value:
 881
 882         IRQL =
 883
 884         Note:
 885
 886         ========================================================================
 887 */
 888 VOID RTUSBPutToSleep(
 889         IN      PRTMP_ADAPTER   pAd)
 890 {
 891         UINT32          value;
 892
 893         // Timeout 0x40 x 50us
 894         value = (SLEEPCID<<16)+(OWNERMCU<<24)+ (0x40<<8)+1;
 895         RTUSBWriteMACRegister(pAd, 0x7010, value);
 896         RTUSBWriteMACRegister(pAd, 0x404, 0x30);
 897         //RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
 898         DBGPRINT_RAW(RT_DEBUG_ERROR, ("Sleep Mailbox testvalue %x\n", value));
 899
 900 }
 901
 902 /*
 903         ========================================================================
 904
 905         Routine Description:
 906
 907         Arguments:
 908
 909         Return Value:
 910
 911         IRQL =
 912
 913         Note:
 914
 915         ========================================================================
 916 */
 917 NTSTATUS RTUSBWakeUp(
 918         IN      PRTMP_ADAPTER   pAd)
 919 {
 920         NTSTATUS        Status;
 921
 922         Status = RTUSB_VendorRequest(
 923                 pAd,
 924                 USBD_TRANSFER_DIRECTION_OUT,
 925                 DEVICE_VENDOR_REQUEST_OUT,
 926                 0x01,
 927                 0x09,
 928                 0,
 929                 NULL,
 930                 0);
 931
 932         return Status;
 933 }
 934
 935 /*
 936         ========================================================================
 937
 938         Routine Description:
 939
 940         Arguments:
 941
 942         Return Value:
 943
 944         IRQL =
 945
 946         Note:
 947
 948         ========================================================================
 949 */
 950 VOID    RTUSBInitializeCmdQ(
 951         IN      PCmdQ   cmdq)
 952 {
 953         cmdq->head = NULL;
 954         cmdq->tail = NULL;
 955         cmdq->size = 0;
 956         cmdq->CmdQState = RT2870_THREAD_INITED;
 957 }
 958
 959 /*
 960         ========================================================================
 961
 962         Routine Description:
 963
 964         Arguments:
 965
 966         Return Value:
 967
 968         IRQL =
 969
 970         Note:
 971
 972         ========================================================================
 973 */
 974 NDIS_STATUS     RTUSBEnqueueCmdFromNdis(
 975         IN      PRTMP_ADAPTER   pAd,
 976         IN      NDIS_OID                Oid,
 977         IN      BOOLEAN                 SetInformation,
 978         IN      PVOID                   pInformationBuffer,
 979         IN      UINT32                  InformationBufferLength)
 980 {
 981         NDIS_STATUS     status;
 982         PCmdQElmt       cmdqelmt = NULL;
 983         POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;
 984
 985         if (pid_nr(pObj->RTUSBCmdThr_pid) > 0)
 986                 return (NDIS_STATUS_RESOURCES);
 987
 988         status = RTMPAllocateMemory((PVOID *)&cmdqelmt, sizeof(CmdQElmt));
 989         if ((status != NDIS_STATUS_SUCCESS) || (cmdqelmt == NULL))
 990                 return (NDIS_STATUS_RESOURCES);
 991
 992                 cmdqelmt->buffer = NULL;
 993                 if (pInformationBuffer != NULL)
 994                 {
 995                         status = RTMPAllocateMemory((PVOID *)&cmdqelmt->buffer, InformationBufferLength);
 996                         if ((status != NDIS_STATUS_SUCCESS) || (cmdqelmt->buffer == NULL))
 997                         {
 998                                 kfree(cmdqelmt);
 999                                 return (NDIS_STATUS_RESOURCES);
1000                         }
1001                         else
1002                         {
1003                                 NdisMoveMemory(cmdqelmt->buffer, pInformationBuffer, InformationBufferLength);
1004                                 cmdqelmt->bufferlength = InformationBufferLength;
1005                         }
1006                 }
1007                 else
1008                         cmdqelmt->bufferlength = 0;
1009
1010         cmdqelmt->command = Oid;
1011         cmdqelmt->CmdFromNdis = TRUE;
1012         if (SetInformation == TRUE)
1013                 cmdqelmt->SetOperation = TRUE;
1014         else
1015                 cmdqelmt->SetOperation = FALSE;
1016
1017         NdisAcquireSpinLock(&pAd->CmdQLock);
1018         if (pAd->CmdQ.CmdQState & RT2870_THREAD_CAN_DO_INSERT)
1019         {
1020                 EnqueueCmd((&pAd->CmdQ), cmdqelmt);
1021                 status = NDIS_STATUS_SUCCESS;
1022         }
1023         else
1024         {
1025                 status = NDIS_STATUS_FAILURE;
1026         }
1027         NdisReleaseSpinLock(&pAd->CmdQLock);
1028
1029         if (status == NDIS_STATUS_FAILURE)
1030         {
1031                 if (cmdqelmt->buffer)
1032                         NdisFreeMemory(cmdqelmt->buffer, cmdqelmt->bufferlength, 0);
1033                 NdisFreeMemory(cmdqelmt, sizeof(CmdQElmt), 0);
1034         }
1035         else
1036         RTUSBCMDUp(pAd);
1037
1038
1039     return(NDIS_STATUS_SUCCESS);
1040 }
1041
1042 /*
1043         ========================================================================
1044
1045         Routine Description:
1046
1047         Arguments:
1048
1049         Return Value:
1050
1051         IRQL =
1052
1053         Note:
1054
1055         ========================================================================
1056 */
1057 NDIS_STATUS RTUSBEnqueueInternalCmd(
1058         IN PRTMP_ADAPTER        pAd,
1059         IN NDIS_OID                     Oid,
1060         IN PVOID                        pInformationBuffer,
1061         IN UINT32                       InformationBufferLength)
1062 {
1063         NDIS_STATUS     status;
1064         PCmdQElmt       cmdqelmt = NULL;
1065
1066
1067         status = RTMPAllocateMemory((PVOID *)&cmdqelmt, sizeof(CmdQElmt));
1068         if ((status != NDIS_STATUS_SUCCESS) || (cmdqelmt == NULL))
1069                 return (NDIS_STATUS_RESOURCES);
1070         NdisZeroMemory(cmdqelmt, sizeof(CmdQElmt));
1071
1072         if(InformationBufferLength > 0)
1073         {
1074                 status = RTMPAllocateMemory((PVOID *)&cmdqelmt->buffer, InformationBufferLength);
1075                 if ((status != NDIS_STATUS_SUCCESS) || (cmdqelmt->buffer == NULL))
1076                 {
1077                         NdisFreeMemory(cmdqelmt, sizeof(CmdQElmt), 0);
1078                         return (NDIS_STATUS_RESOURCES);
1079                 }
1080                 else
1081                 {
1082                         NdisMoveMemory(cmdqelmt->buffer, pInformationBuffer, InformationBufferLength);
1083                         cmdqelmt->bufferlength = InformationBufferLength;
1084                 }
1085         }
1086         else
1087         {
1088                 cmdqelmt->buffer = NULL;
1089                 cmdqelmt->bufferlength = 0;
1090         }
1091
1092         cmdqelmt->command = Oid;
1093         cmdqelmt->CmdFromNdis = FALSE;
1094
1095         if (cmdqelmt != NULL)
1096         {
1097                 NdisAcquireSpinLock(&pAd->CmdQLock);
1098                 if (pAd->CmdQ.CmdQState & RT2870_THREAD_CAN_DO_INSERT)
1099                 {
1100                         EnqueueCmd((&pAd->CmdQ), cmdqelmt);
1101                         status = NDIS_STATUS_SUCCESS;
1102                 }
1103                 else
1104                 {
1105                         status = NDIS_STATUS_FAILURE;
1106                 }
1107                 NdisReleaseSpinLock(&pAd->CmdQLock);
1108
1109                 if (status == NDIS_STATUS_FAILURE)
1110                 {
1111                         if (cmdqelmt->buffer)
1112                                 NdisFreeMemory(cmdqelmt->buffer, cmdqelmt->bufferlength, 0);
1113                         NdisFreeMemory(cmdqelmt, sizeof(CmdQElmt), 0);
1114                 }
1115                 else
1116                 RTUSBCMDUp(pAd);
1117         }
1118         return(NDIS_STATUS_SUCCESS);
1119 }
1120
1121 /*
1122         ========================================================================
1123
1124         Routine Description:
1125
1126         Arguments:
1127
1128         Return Value:
1129
1130         IRQL =
1131
1132         Note:
1133
1134         ========================================================================
1135 */
1136 VOID    RTUSBDequeueCmd(
1137         IN      PCmdQ           cmdq,
1138         OUT     PCmdQElmt       *pcmdqelmt)
1139 {
1140         *pcmdqelmt = cmdq->head;
1141
1142         if (*pcmdqelmt != NULL)
1143         {
1144                 cmdq->head = cmdq->head->next;
1145                 cmdq->size--;
1146                 if (cmdq->size == 0)
1147                         cmdq->tail = NULL;
1148         }
1149 }
1150
1151 /*
1152     ========================================================================
1153           usb_control_msg - Builds a control urb, sends it off and waits for completion
1154           @dev: pointer to the usb device to send the message to
1155           @pipe: endpoint "pipe" to send the message to
1156           @request: USB message request value
1157           @requesttype: USB message request type value
1158           @value: USB message value
1159           @index: USB message index value
1160           @data: pointer to the data to send
1161           @size: length in bytes of the data to send
1162           @timeout: time in jiffies to wait for the message to complete before
1163                           timing out (if 0 the wait is forever)
1164           Context: !in_interrupt ()
1165
1166           This function sends a simple control message to a specified endpoint
1167           and waits for the message to complete, or timeout.
1168           If successful, it returns the number of bytes transferred, otherwise a negative error number.
1169
1170          Don't use this function from within an interrupt context, like a
1171           bottom half handler.  If you need an asynchronous message, or need to send
1172           a message from within interrupt context, use usb_submit_urb()
1173           If a thread in your driver uses this call, make sure your disconnect()
1174           method can wait for it to complete.  Since you don't have a handle on
1175           the URB used, you can't cancel the request.
1176
1177
1178         Routine Description:
1179
1180         Arguments:
1181
1182         Return Value:
1183
1184         Note:
1185
1186         ========================================================================
1187 */
1188 NTSTATUS    RTUSB_VendorRequest(
1189         IN      PRTMP_ADAPTER   pAd,
1190         IN      UINT32                  TransferFlags,
1191         IN      UCHAR                   RequestType,
1192         IN      UCHAR                   Request,
1193         IN      USHORT                  Value,
1194         IN      USHORT                  Index,
1195         IN      PVOID                   TransferBuffer,
1196         IN      UINT32                  TransferBufferLength)
1197 {
1198         int                             ret;
1199         POS_COOKIE              pObj = (POS_COOKIE) pAd->OS_Cookie;
1200
1201         if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))
1202         {
1203                 DBGPRINT(RT_DEBUG_ERROR, ("device disconnected\n"));
1204                 return -1;
1205         }
1206         else if (in_interrupt())
1207         {
1208                 DBGPRINT(RT_DEBUG_ERROR, ("in_interrupt, RTUSB_VendorRequest Request%02x Value%04x Offset%04x\n",Request,Value,Index));
1209
1210                 return -1;
1211         }
1212         else
1213         {
1214 #define MAX_RETRY_COUNT  10
1215
1216                 int retryCount = 0;
1217                 void    *tmpBuf = TransferBuffer;
1218
1219                 // Acquire Control token
1220                 do {
1221                 if( RequestType == DEVICE_VENDOR_REQUEST_OUT)
1222                         ret=usb_control_msg(pObj->pUsb_Dev, usb_sndctrlpipe( pObj->pUsb_Dev, 0 ), Request, RequestType, Value,Index, tmpBuf, TransferBufferLength, CONTROL_TIMEOUT_JIFFIES);
1223                 else if(RequestType == DEVICE_VENDOR_REQUEST_IN)
1224                         ret=usb_control_msg(pObj->pUsb_Dev, usb_rcvctrlpipe( pObj->pUsb_Dev, 0 ), Request, RequestType, Value,Index, tmpBuf, TransferBufferLength, CONTROL_TIMEOUT_JIFFIES);
1225                 else
1226                 {
1227                         DBGPRINT(RT_DEBUG_ERROR, ("vendor request direction is failed\n"));
1228                         ret = -1;
1229                 }
1230
1231                         retryCount++;
1232                         if (ret < 0) {
1233                                 printk("#\n");
1234                                 RTMPusecDelay(5000);
1235                         }
1236                 } while((ret < 0) && (retryCount < MAX_RETRY_COUNT));
1237
1238         if (ret < 0) {
1239 //                      DBGPRINT(RT_DEBUG_ERROR, ("USBVendorRequest failed ret=%d \n",ret));
1240                         DBGPRINT(RT_DEBUG_ERROR, ("RTUSB_VendorRequest failed(%d),TxFlags=0x%x, ReqType=%s, Req=0x%x, Index=0x%x\n",
1241                                                 ret, TransferFlags, (RequestType == DEVICE_VENDOR_REQUEST_OUT ? "OUT" : "IN"), Request, Index));
1242                         if (Request == 0x2)
1243                                 DBGPRINT(RT_DEBUG_ERROR, ("\tRequest Value=0x%04x!\n", Value));
1244
1245                         if ((TransferBuffer!= NULL) && (TransferBufferLength > 0))
1246                                 hex_dump("Failed TransferBuffer value", TransferBuffer, TransferBufferLength);
1247         }
1248         }
1249         return ret;
1250 }
1251
1252 /*
1253         ========================================================================
1254
1255         Routine Description:
1256           Creates an IRP to submite an IOCTL_INTERNAL_USB_RESET_PORT
1257           synchronously. Callers of this function must be running at
1258           PASSIVE LEVEL.
1259
1260         Arguments:
1261
1262         Return Value:
1263
1264         Note:
1265
1266         ========================================================================
1267 */
1268 NTSTATUS        RTUSB_ResetDevice(
1269         IN      PRTMP_ADAPTER   pAd)
1270 {
1271         NTSTATUS                Status = TRUE;
1272
1273         DBGPRINT_RAW(RT_DEBUG_TRACE, ("--->USB_ResetDevice\n"));
1274         //RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS);
1275         return Status;
1276 }
1277
1278 VOID CMDHandler(
1279     IN PRTMP_ADAPTER pAd)
1280 {
1281         PCmdQElmt               cmdqelmt;
1282         PUCHAR                  pData;
1283         NDIS_STATUS             NdisStatus = NDIS_STATUS_SUCCESS;
1284 //      ULONG                   Now = 0;
1285         NTSTATUS                ntStatus;
1286 //      unsigned long   IrqFlags;
1287
1288         while (pAd->CmdQ.size > 0)
1289         {
1290                 NdisStatus = NDIS_STATUS_SUCCESS;
1291
1292                 NdisAcquireSpinLock(&pAd->CmdQLock);
1293                 RTUSBDequeueCmd(&pAd->CmdQ, &cmdqelmt);
1294                 NdisReleaseSpinLock(&pAd->CmdQLock);
1295
1296                 if (cmdqelmt == NULL)
1297                         break;
1298
1299                 pData = cmdqelmt->buffer;
1300
1301                 if(!(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST) || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)))
1302                 {
1303                         switch (cmdqelmt->command)
1304                         {
1305                                 case CMDTHREAD_CHECK_GPIO:
1306                                         {
1307                                                 UINT32 data;
1308
1309                                                 {
1310                                                         // Read GPIO pin2 as Hardware controlled radio state
1311
1312                                                         RTUSBReadMACRegister( pAd, GPIO_CTRL_CFG, &data);
1313
1314                                                         if (data & 0x04)
1315                                                         {
1316                                                                 pAd->StaCfg.bHwRadio = TRUE;
1317                                                         }
1318                                                         else
1319                                                         {
1320                                                                 pAd->StaCfg.bHwRadio = FALSE;
1321                                                         }
1322
1323                                                         if(pAd->StaCfg.bRadio != (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio))
1324                                                         {
1325                                                                 pAd->StaCfg.bRadio = (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio);
1326                                                                 if(pAd->StaCfg.bRadio == TRUE)
1327                                                                 {
1328                                                                         DBGPRINT_RAW(RT_DEBUG_ERROR, ("!!! Radio On !!!\n"));
1329
1330                                                                         MlmeRadioOn(pAd);
1331                                                                         // Update extra information
1332                                                                         pAd->ExtraInfo = EXTRA_INFO_CLEAR;
1333                                                                 }
1334                                                                 else
1335                                                                 {
1336                                                                         DBGPRINT_RAW(RT_DEBUG_ERROR, ("!!! Radio Off !!!\n"));
1337
1338                                                                         MlmeRadioOff(pAd);
1339                                                                         // Update extra information
1340                                                                         pAd->ExtraInfo = HW_RADIO_OFF;
1341                                                                 }
1342                                                         }
1343                                                 }
1344                                         }
1345                                         break;
1346
1347                                 case CMDTHREAD_QKERIODIC_EXECUT:
1348                                         {
1349                                                 StaQuickResponeForRateUpExec(NULL, pAd, NULL, NULL);
1350                                         }
1351                                         break;
1352
1353                                 case CMDTHREAD_RESET_BULK_OUT:
1354                                         {
1355                                                 UINT32          MACValue;
1356                                                 UCHAR           Index;
1357                                                 int                     ret=0;
1358                                                 PHT_TX_CONTEXT  pHTTXContext;
1359 //                                              RTMP_TX_RING *pTxRing;
1360                                                 unsigned long IrqFlags;
1361
1362                                                 DBGPRINT_RAW(RT_DEBUG_TRACE, ("CmdThread : CMDTHREAD_RESET_BULK_OUT(ResetPipeid=0x%0x)===>\n", pAd->bulkResetPipeid));
1363                                                 // All transfers must be aborted or cancelled before attempting to reset the pipe.
1364                                                 //RTUSBCancelPendingBulkOutIRP(pAd);
1365                                                 // Wait 10ms to let previous packet that are already in HW FIFO to clear. by MAXLEE 12-25-2007
1366                                                 Index = 0;
1367                                                 do
1368                                                 {
1369                                                         RTUSBReadMACRegister(pAd, TXRXQ_PCNT, &MACValue);
1370                                                         if ((MACValue & 0xf00000/*0x800000*/) == 0)
1371                                                                 break;
1372                                                         Index++;
1373                                                         RTMPusecDelay(10000);
1374                                                 }while(Index < 100);
1375                                                 MACValue = 0;
1376                                                 RTUSBReadMACRegister(pAd, USB_DMA_CFG, &MACValue);
1377                                                 // To prevent Read Register error, we 2nd check the validity.
1378                                                 if ((MACValue & 0xc00000) == 0)
1379                                                         RTUSBReadMACRegister(pAd, USB_DMA_CFG, &MACValue);
1380                                                 // To prevent Read Register error, we 3rd check the validity.
1381                                                 if ((MACValue & 0xc00000) == 0)
1382                                                         RTUSBReadMACRegister(pAd, USB_DMA_CFG, &MACValue);
1383                                                 MACValue |= 0x80000;
1384                                                 RTUSBWriteMACRegister(pAd, USB_DMA_CFG, MACValue);
1385
1386                                                 // Wait 1ms to prevent next URB to bulkout before HW reset. by MAXLEE 12-25-2007
1387                                                 RTMPusecDelay(1000);
1388
1389                                                 MACValue &= (~0x80000);
1390                                                 RTUSBWriteMACRegister(pAd, USB_DMA_CFG, MACValue);
1391                                                 DBGPRINT_RAW(RT_DEBUG_TRACE, ("\tSet 0x2a0 bit19. Clear USB DMA TX path\n"));
1392
1393                                                 // Wait 5ms to prevent next URB to bulkout before HW reset. by MAXLEE 12-25-2007
1394                                                 //RTMPusecDelay(5000);
1395
1396                                                 if ((pAd->bulkResetPipeid & BULKOUT_MGMT_RESET_FLAG) == BULKOUT_MGMT_RESET_FLAG)
1397                                                 {
1398                                                         RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
1399                                                         if (pAd->MgmtRing.TxSwFreeIdx < MGMT_RING_SIZE /* pMLMEContext->bWaitingBulkOut == TRUE */)
1400                                                         {
1401                                                                 RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_MLME);
1402                                                         }
1403                                                         RTUSBKickBulkOut(pAd);
1404
1405                                                         DBGPRINT_RAW(RT_DEBUG_TRACE, ("\tTX MGMT RECOVER Done!\n"));
1406                                                 }
1407                                                 else
1408                                                 {
1409                                                         pHTTXContext = &(pAd->TxContext[pAd->bulkResetPipeid]);
1410                                                         //NdisAcquireSpinLock(&pAd->BulkOutLock[pAd->bulkResetPipeid]);
1411                                                         RTMP_INT_LOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
1412                                                         if ( pAd->BulkOutPending[pAd->bulkResetPipeid] == FALSE)
1413                                                         {
1414                                                                 pAd->BulkOutPending[pAd->bulkResetPipeid] = TRUE;
1415                                                                 pHTTXContext->IRPPending = TRUE;
1416                                                                 pAd->watchDogTxPendingCnt[pAd->bulkResetPipeid] = 1;
1417
1418                                                                 // no matter what, clean the flag
1419                                                                 RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
1420
1421                                                                 //NdisReleaseSpinLock(&pAd->BulkOutLock[pAd->bulkResetPipeid]);
1422                                                                 RTMP_INT_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
1423 /*-----------------------------------------------------------------------------------------------*/
1424 /*-----------------------------------------------------------------------------------------------*/
1425                                                                 {
1426                                                                 RTUSBInitHTTxDesc(pAd, pHTTXContext, pAd->bulkResetPipeid, pHTTXContext->BulkOutSize, (usb_complete_t)RTUSBBulkOutDataPacketComplete);
1427
1428                                                                 if((ret = RTUSB_SUBMIT_URB(pHTTXContext->pUrb))!=0)
1429                                                                 {
1430                                                                                 RTMP_INT_LOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
1431                                                                         pAd->BulkOutPending[pAd->bulkResetPipeid] = FALSE;
1432                                                                         pHTTXContext->IRPPending = FALSE;
1433                                                                                 pAd->watchDogTxPendingCnt[pAd->bulkResetPipeid] = 0;
1434                                                                                 RTMP_INT_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
1435
1436                                                                                 DBGPRINT(RT_DEBUG_ERROR, ("CmdThread : CMDTHREAD_RESET_BULK_OUT: Submit Tx URB failed %d\n", ret));
1437                                                                 }
1438                                                                         else
1439                                                                         {
1440                                                                                 RTMP_IRQ_LOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
1441                                                                                 DBGPRINT_RAW(RT_DEBUG_TRACE,("\tCMDTHREAD_RESET_BULK_OUT: TxContext[%d]:CWPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d, pending=%d!\n",
1442                                                                                                 pAd->bulkResetPipeid, pHTTXContext->CurWritePosition, pHTTXContext->NextBulkOutPosition,
1443                                                                                                                         pHTTXContext->ENextBulkOutPosition, pHTTXContext->bCopySavePad, pAd->BulkOutPending[pAd->bulkResetPipeid]));
1444                                                                                 DBGPRINT_RAW(RT_DEBUG_TRACE,("\t\tBulkOut Req=0x%lx, Complete=0x%lx, Other=0x%lx\n",
1445                                                                                                                         pAd->BulkOutReq, pAd->BulkOutComplete, pAd->BulkOutCompleteOther));
1446                                                                                 RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
1447                                                                                 DBGPRINT_RAW(RT_DEBUG_TRACE, ("\tCMDTHREAD_RESET_BULK_OUT: Submit Tx DATA URB for failed BulkReq(0x%lx) Done, status=%d!\n", pAd->bulkResetReq[pAd->bulkResetPipeid], pHTTXContext->pUrb->status));
1448
1449                                                                         }
1450                                                                 }
1451                                                         }
1452                                                         else
1453                                                         {
1454                                                                 //NdisReleaseSpinLock(&pAd->BulkOutLock[pAd->bulkResetPipeid]);
1455                                                                 //RTMP_INT_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
1456
1457                                                                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("CmdThread : TX DATA RECOVER FAIL for BulkReq(0x%lx) because BulkOutPending[%d] is TRUE!\n", pAd->bulkResetReq[pAd->bulkResetPipeid], pAd->bulkResetPipeid));
1458                                                                 if (pAd->bulkResetPipeid == 0)
1459                                                                 {
1460                                                                         UCHAR   pendingContext = 0;
1461                                                                         PHT_TX_CONTEXT pHTTXContext = (PHT_TX_CONTEXT)(&pAd->TxContext[pAd->bulkResetPipeid ]);
1462                                                                         PTX_CONTEXT pMLMEContext = (PTX_CONTEXT)(pAd->MgmtRing.Cell[pAd->MgmtRing.TxDmaIdx].AllocVa);
1463                                                                         PTX_CONTEXT pNULLContext = (PTX_CONTEXT)(&pAd->PsPollContext);
1464                                                                         PTX_CONTEXT pPsPollContext = (PTX_CONTEXT)(&pAd->NullContext);
1465
1466                                                                         if (pHTTXContext->IRPPending)
1467                                                                                 pendingContext |= 1;
1468                                                                         else if (pMLMEContext->IRPPending)
1469                                                                                 pendingContext |= 2;
1470                                                                         else if (pNULLContext->IRPPending)
1471                                                                                 pendingContext |= 4;
1472                                                                         else if (pPsPollContext->IRPPending)
1473                                                                                 pendingContext |= 8;
1474                                                                         else
1475                                                                                 pendingContext = 0;
1476
1477                                                                         DBGPRINT_RAW(RT_DEBUG_ERROR, ("\tTX Occupied by %d!\n", pendingContext));
1478                                                                 }
1479
1480                                                         // no matter what, clean the flag
1481                                                         RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
1482
1483                                                                 RTMP_INT_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
1484
1485                                                                 RTUSB_SET_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << pAd->bulkResetPipeid));
1486                                                         }
1487
1488                                                         RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
1489                                                         //RTUSBKickBulkOut(pAd);
1490                                                 }
1491
1492                                         }
1493                                         /*
1494                                                 // Don't cancel BULKIN.
1495                                                 while ((atomic_read(&pAd->PendingRx) > 0) &&
1496                                                                 (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
1497                                                 {
1498                                                         if (atomic_read(&pAd->PendingRx) > 0)
1499                                                         {
1500                                                                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("BulkIn IRP Pending!!cancel it!\n"));
1501                                                                 RTUSBCancelPendingBulkInIRP(pAd);
1502                                                         }
1503                                                         RTMPusecDelay(100000);
1504                                                 }
1505
1506                                                 if ((atomic_read(&pAd->PendingRx) == 0) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)))
1507                                                 {
1508                                                         UCHAR   i;
1509                                                         RTUSBRxPacket(pAd);
1510                                                         pAd->NextRxBulkInReadIndex = 0; // Next Rx Read index
1511                                                         pAd->NextRxBulkInIndex          = 0;    // Rx Bulk pointer
1512                                                         for (i = 0; i < (RX_RING_SIZE); i++)
1513                                                         {
1514                                                                 PRX_CONTEXT  pRxContext = &(pAd->RxContext[i]);
1515
1516                                                                 pRxContext->pAd = pAd;
1517                                                                 pRxContext->InUse               = FALSE;
1518                                                                 pRxContext->IRPPending  = FALSE;
1519                                                                 pRxContext->Readable    = FALSE;
1520                                                                 pRxContext->ReorderInUse = FALSE;
1521
1522                                                         }
1523                                                         RTUSBBulkReceive(pAd);
1524                                                         DBGPRINT_RAW(RT_DEBUG_ERROR, ("RTUSBBulkReceive\n"));
1525                                                 }*/
1526                                         DBGPRINT_RAW(RT_DEBUG_TRACE, ("CmdThread : CMDTHREAD_RESET_BULK_OUT<===\n"));
1527                                 break;
1528
1529                                 case CMDTHREAD_RESET_BULK_IN:
1530                                         DBGPRINT_RAW(RT_DEBUG_TRACE, ("CmdThread : CMDTHREAD_RESET_BULK_IN === >\n"));
1531
1532                                         // All transfers must be aborted or cancelled before attempting to reset the pipe.
1533                                         {
1534                                                 UINT32          MACValue;
1535 /*-----------------------------------------------------------------------------------------------*/
1536 /*-----------------------------------------------------------------------------------------------*/
1537                                                 {
1538                                                 //while ((atomic_read(&pAd->PendingRx) > 0) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
1539                                                 if((pAd->PendingRx > 0) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
1540                                                 {
1541                                                         DBGPRINT_RAW(RT_DEBUG_ERROR, ("BulkIn IRP Pending!!!\n"));
1542                                                         RTUSBCancelPendingBulkInIRP(pAd);
1543                                                         RTMPusecDelay(100000);
1544                                                         pAd->PendingRx = 0;
1545                                                 }
1546                                                 }
1547
1548                                                 // Wait 10ms before reading register.
1549                                                 RTMPusecDelay(10000);
1550                                                 ntStatus = RTUSBReadMACRegister(pAd, MAC_CSR0, &MACValue);
1551
1552                                                 if ((NT_SUCCESS(ntStatus) == TRUE) &&
1553                                                         (!(RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS | fRTMP_ADAPTER_RADIO_OFF |
1554                                                                                                         fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST)))))
1555                                                 {
1556                                                         UCHAR   i;
1557
1558                                                         if (RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS | fRTMP_ADAPTER_RADIO_OFF |
1559                                                                                                                 fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST)))
1560                                                                 break;
1561                                                         pAd->NextRxBulkInPosition = pAd->RxContext[pAd->NextRxBulkInIndex].BulkInOffset;
1562                                                         DBGPRINT(RT_DEBUG_TRACE, ("BULK_IN_RESET: NBIIdx=0x%x,NBIRIdx=0x%x, BIRPos=0x%lx. BIReq=x%lx, BIComplete=0x%lx, BICFail0x%lx\n",
1563                                                                         pAd->NextRxBulkInIndex,  pAd->NextRxBulkInReadIndex, pAd->NextRxBulkInPosition, pAd->BulkInReq, pAd->BulkInComplete, pAd->BulkInCompleteFail));
1564                                                         for (i = 0; i < RX_RING_SIZE; i++)
1565                                                         {
1566                                                                 DBGPRINT(RT_DEBUG_TRACE, ("\tRxContext[%d]: IRPPending=%d, InUse=%d, Readable=%d!\n"
1567                                                                         , i, pAd->RxContext[i].IRPPending, pAd->RxContext[i].InUse, pAd->RxContext[i].Readable));
1568                                                         }
1569                                                         /*
1570
1571                                                         DBGPRINT_RAW(RT_DEBUG_ERROR, ("==========================================\n"));
1572
1573                                                         pAd->NextRxBulkInReadIndex = 0; // Next Rx Read index
1574                                                         pAd->NextRxBulkInIndex          = 0;    // Rx Bulk pointer
1575                                                         for (i = 0; i < (RX_RING_SIZE); i++)
1576                                                         {
1577                                                                 PRX_CONTEXT  pRxContext = &(pAd->RxContext[i]);
1578
1579                                                                 pRxContext->pAd = pAd;
1580                                                                 pRxContext->InUse               = FALSE;
1581                                                                 pRxContext->IRPPending  = FALSE;
1582                                                                 pRxContext->Readable    = FALSE;
1583                                                                 pRxContext->ReorderInUse = FALSE;
1584
1585                                                         }*/
1586                                                         RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BULKIN_RESET);
1587                                                         for (i = 0; i < pAd->CommonCfg.NumOfBulkInIRP; i++)
1588                                                         {
1589                                                                 //RTUSBBulkReceive(pAd);
1590                                                                 PRX_CONTEXT             pRxContext;
1591                                                                 PURB                    pUrb;
1592                                                                 int                             ret = 0;
1593                                                                 unsigned long   IrqFlags;
1594
1595
1596                                                                 RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
1597                                                                 pRxContext = &(pAd->RxContext[pAd->NextRxBulkInIndex]);
1598                                                                 if ((pAd->PendingRx > 0) || (pRxContext->Readable == TRUE) || (pRxContext->InUse == TRUE))
1599                                                                 {
1600                                                                         RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
1601                                                                         break;
1602                                                                 }
1603                                                                 pRxContext->InUse = TRUE;
1604                                                                 pRxContext->IRPPending = TRUE;
1605                                                                 pAd->PendingRx++;
1606                                                                 pAd->BulkInReq++;
1607                                                                 RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
1608
1609                                                                 // Init Rx context descriptor
1610                                                                 RTUSBInitRxDesc(pAd, pRxContext);
1611                                                                 pUrb = pRxContext->pUrb;
1612                                                                 if ((ret = RTUSB_SUBMIT_URB(pUrb))!=0)
1613                                                                 {       // fail
1614
1615                                                                         RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
1616                                                                         pRxContext->InUse = FALSE;
1617                                                                         pRxContext->IRPPending = FALSE;
1618                                                                         pAd->PendingRx--;
1619                                                                         pAd->BulkInReq--;
1620                                                                         RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
1621                                                                         DBGPRINT(RT_DEBUG_ERROR, ("CMDTHREAD_RESET_BULK_IN: Submit Rx URB failed(%d), status=%d\n", ret, pUrb->status));
1622                                                                 }
1623                                                                 else
1624                                                                 {       // success
1625                                                                         DBGPRINT_RAW(RT_DEBUG_TRACE, ("CMDTHREAD_RESET_BULK_IN: Submit Rx URB Done, status=%d!\n", pUrb->status));
1626                                                                         ASSERT((pRxContext->InUse == pRxContext->IRPPending));
1627                                                                 }
1628                                                         }
1629
1630                                                 }
1631                                                 else
1632                                                 {
1633                                                         // Card must be removed
1634                                                         if (NT_SUCCESS(ntStatus) != TRUE)
1635                                                         {
1636                                                         RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST);
1637                                                                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("CMDTHREAD_RESET_BULK_IN: Read Register Failed!Card must be removed!!\n\n"));
1638                                                         }
1639                                                         else
1640                                                         {
1641                                                                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("CMDTHREAD_RESET_BULK_IN: Cannot do bulk in because flags(0x%lx) on !\n", pAd->Flags));
1642                                                 }
1643                                         }
1644                                         }
1645                                         DBGPRINT_RAW(RT_DEBUG_TRACE, ("CmdThread : CMDTHREAD_RESET_BULK_IN <===\n"));
1646                                         break;
1647
1648                                 case CMDTHREAD_SET_ASIC_WCID:
1649                                         {
1650                                                 RT_SET_ASIC_WCID        SetAsicWcid;
1651                                                 USHORT          offset;
1652                                                 UINT32          MACValue, MACRValue = 0;
1653                                                 SetAsicWcid = *((PRT_SET_ASIC_WCID)(pData));
1654
1655                                                 if (SetAsicWcid.WCID >= MAX_LEN_OF_MAC_TABLE)
1656                                                         return;
1657
1658                                                 offset = MAC_WCID_BASE + ((UCHAR)SetAsicWcid.WCID)*HW_WCID_ENTRY_SIZE;
1659
1660                                                 DBGPRINT_RAW(RT_DEBUG_TRACE, ("CmdThread : CMDTHREAD_SET_ASIC_WCID : WCID = %ld, SetTid  = %lx, DeleteTid = %lx.\n", SetAsicWcid.WCID, SetAsicWcid.SetTid, SetAsicWcid.DeleteTid));
1661                                                 MACValue = (pAd->MacTab.Content[SetAsicWcid.WCID].Addr[3]<<24)+(pAd->MacTab.Content[SetAsicWcid.WCID].Addr[2]<<16)+(pAd->MacTab.Content[SetAsicWcid.WCID].Addr[1]<<8)+(pAd->MacTab.Content[SetAsicWcid.WCID].Addr[0]);
1662                                                 DBGPRINT_RAW(RT_DEBUG_TRACE, ("1-MACValue= %x,\n", MACValue));
1663                                                 RTUSBWriteMACRegister(pAd, offset, MACValue);
1664                                                 // Read bitmask
1665                                                 RTUSBReadMACRegister(pAd, offset+4, &MACRValue);
1666                                                 if ( SetAsicWcid.DeleteTid != 0xffffffff)
1667                                                         MACRValue &= (~SetAsicWcid.DeleteTid);
1668                                                 if (SetAsicWcid.SetTid != 0xffffffff)
1669                                                         MACRValue |= (SetAsicWcid.SetTid);
1670                                                 MACRValue &= 0xffff0000;
1671
1672                                                 MACValue = (pAd->MacTab.Content[SetAsicWcid.WCID].Addr[5]<<8)+pAd->MacTab.Content[SetAsicWcid.WCID].Addr[4];
1673                                                 MACValue |= MACRValue;
1674                                                 RTUSBWriteMACRegister(pAd, offset+4, MACValue);
1675
1676                                                 DBGPRINT_RAW(RT_DEBUG_TRACE, ("2-MACValue= %x,\n", MACValue));
1677                                         }
1678                                         break;
1679
1680                                 case CMDTHREAD_SET_ASIC_WCID_CIPHER:
1681                                         {
1682                                                 RT_SET_ASIC_WCID_ATTRI  SetAsicWcidAttri;
1683                                                 USHORT          offset;
1684                                                 UINT32          MACRValue = 0;
1685                                                 SHAREDKEY_MODE_STRUC csr1;
1686                                                 SetAsicWcidAttri = *((PRT_SET_ASIC_WCID_ATTRI)(pData));
1687
1688                                                 if (SetAsicWcidAttri.WCID >= MAX_LEN_OF_MAC_TABLE)
1689                                                         return;
1690
1691                                                 offset = MAC_WCID_ATTRIBUTE_BASE + ((UCHAR)SetAsicWcidAttri.WCID)*HW_WCID_ATTRI_SIZE;
1692
1693                                                 DBGPRINT_RAW(RT_DEBUG_TRACE, ("Cmd : CMDTHREAD_SET_ASIC_WCID_CIPHER : WCID = %ld, Cipher = %lx.\n", SetAsicWcidAttri.WCID, SetAsicWcidAttri.Cipher));
1694                                                 // Read bitmask
1695                                                 RTUSBReadMACRegister(pAd, offset, &MACRValue);
1696                                                 MACRValue = 0;
1697                                                 MACRValue |= (((UCHAR)SetAsicWcidAttri.Cipher) << 1);
1698
1699                                                 RTUSBWriteMACRegister(pAd, offset, MACRValue);
1700                                                 DBGPRINT_RAW(RT_DEBUG_TRACE, ("2-offset = %x , MACValue= %x,\n", offset, MACRValue));
1701
1702                                                 offset = PAIRWISE_IVEIV_TABLE_BASE + ((UCHAR)SetAsicWcidAttri.WCID)*HW_IVEIV_ENTRY_SIZE;
1703                                                 MACRValue = 0;
1704                                                 if ( (SetAsicWcidAttri.Cipher <= CIPHER_WEP128))
1705                                                         MACRValue |= ( pAd->StaCfg.DefaultKeyId << 30);
1706                                                 else
1707                                                         MACRValue |= (0x20000000);
1708                                                 RTUSBWriteMACRegister(pAd, offset, MACRValue);
1709                                                 DBGPRINT_RAW(RT_DEBUG_TRACE, ("2-offset = %x , MACValue= %x,\n", offset, MACRValue));
1710
1711                                                 //
1712                                                 // Update cipher algorithm. WSTA always use BSS0
1713                                                 //
1714                                                 // for adhoc mode only ,because wep status slow than add key, when use zero config
1715                                                 if (pAd->StaCfg.BssType == BSS_ADHOC )
1716                                                 {
1717                                                         offset = MAC_WCID_ATTRIBUTE_BASE;
1718
1719                                                         RTUSBReadMACRegister(pAd, offset, &MACRValue);
1720                                                         MACRValue &= (~0xe);
1721                                                         MACRValue |= (((UCHAR)SetAsicWcidAttri.Cipher) << 1);
1722
1723                                                         RTUSBWriteMACRegister(pAd, offset, MACRValue);
1724
1725                                                         //Update group key cipher,,because wep status slow than add key, when use zero config
1726                                                         RTUSBReadMACRegister(pAd, SHARED_KEY_MODE_BASE+4*(0/2), &csr1.word);
1727
1728                                                         csr1.field.Bss0Key0CipherAlg = SetAsicWcidAttri.Cipher;
1729                                                         csr1.field.Bss0Key1CipherAlg = SetAsicWcidAttri.Cipher;
1730
1731                                                         RTUSBWriteMACRegister(pAd, SHARED_KEY_MODE_BASE+4*(0/2), csr1.word);
1732                                                 }
1733                                         }
1734                                         break;
1735
1736 #ifdef RT30xx
1737 //Benson modified for USB interface, avoid in interrupt when write key, 20080724 -->
1738                                 case RT_CMD_SET_KEY_TABLE: //General call for AsicAddPairwiseKeyEntry()
1739                                 {
1740                                         RT_ADD_PAIRWISE_KEY_ENTRY KeyInfo;
1741                                         KeyInfo = *((PRT_ADD_PAIRWISE_KEY_ENTRY)(pData));
1742                                         AsicAddPairwiseKeyEntry(pAd,
1743                                                                                         KeyInfo.MacAddr,
1744                                                                                         (UCHAR)KeyInfo.MacTabMatchWCID,
1745                                                                                         &KeyInfo.CipherKey);
1746                                 }
1747                                         break;
1748                                 case RT_CMD_SET_RX_WCID_TABLE: //General call for RTMPAddWcidAttributeEntry()
1749                                 {
1750                                         PMAC_TABLE_ENTRY pEntry;
1751                                         UCHAR KeyIdx = 0;
1752                                         UCHAR CipherAlg = 0;
1753                                         UCHAR ApIdx = 0;
1754
1755                                         pEntry = (PMAC_TABLE_ENTRY)(pData);
1756
1757                                                 RTMPAddWcidAttributeEntry(
1758                                                                                   pAd,
1759                                                                                   ApIdx,
1760                                                                                   KeyIdx,
1761                                                                                   CipherAlg,
1762                                                                                   pEntry);
1763                                         }
1764                                                 break;
1765 //Benson modified for USB interface, avoid in interrupt when write key, 20080724 <--
1766 #endif
1767
1768                                 case CMDTHREAD_SET_CLIENT_MAC_ENTRY:
1769                                         {
1770                                                 MAC_TABLE_ENTRY *pEntry;
1771                                                 pEntry = (MAC_TABLE_ENTRY *)pData;
1772
1773                                                 {
1774                                                         AsicRemovePairwiseKeyEntry(pAd, pEntry->apidx, (UCHAR)pEntry->Aid);
1775                                                         if ((pEntry->AuthMode <= Ndis802_11AuthModeAutoSwitch) && (pEntry->WepStatus == Ndis802_11Encryption1Enabled))
1776                                                         {
1777                                                                 UINT32 uIV = 0;
1778                                                                 PUCHAR  ptr;
1779
1780                                                                 ptr = (PUCHAR) &uIV;
1781                                                                 *(ptr + 3) = (pAd->StaCfg.DefaultKeyId << 6);
1782                                                                 AsicUpdateWCIDIVEIV(pAd, pEntry->Aid, uIV, 0);
1783                                                                 AsicUpdateWCIDAttribute(pAd, pEntry->Aid, BSS0, pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg, FALSE);
1784                                                         }
1785                                                         else if (pEntry->AuthMode == Ndis802_11AuthModeWPANone)
1786                                                         {
1787                                                                 UINT32 uIV = 0;
1788                                                                 PUCHAR  ptr;
1789
1790                                                                 ptr = (PUCHAR) &uIV;
1791                                                                 *(ptr + 3) = (pAd->StaCfg.DefaultKeyId << 6);
1792                                                                 AsicUpdateWCIDIVEIV(pAd, pEntry->Aid, uIV, 0);
1793                                                                 AsicUpdateWCIDAttribute(pAd, pEntry->Aid, BSS0, pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg, FALSE);
1794                                                         }
1795                                                         else
1796                                                         {
1797                                                                 //
1798                                                                 // Other case, disable engine.
1799                                                                 // Don't worry WPA key, we will add WPA Key after 4-Way handshaking.
1800                                                                 //
1801                                                                 USHORT   offset;
1802                                                                 offset = MAC_WCID_ATTRIBUTE_BASE + (pEntry->Aid * HW_WCID_ATTRI_SIZE);
1803                                                                 // RX_PKEY_MODE:0 for no security; RX_KEY_TAB:0 for shared key table; BSS_IDX:0
1804                                                                 RTUSBWriteMACRegister(pAd, offset, 0);
1805                                                         }
1806                                                 }
1807
1808                                                 AsicUpdateRxWCIDTable(pAd, pEntry->Aid, pEntry->Addr);
1809                                                 printk("UpdateRxWCIDTable(): Aid=%d, Addr=%02x:%02x:%02x:%02x:%02x:%02x!\n", pEntry->Aid,
1810                                                                 pEntry->Addr[0], pEntry->Addr[1], pEntry->Addr[2], pEntry->Addr[3], pEntry->Addr[4], pEntry->Addr[5]);
1811                                         }
1812                                         break;
1813                                 case CMDTHREAD_UPDATE_PROTECT:
1814                                         {
1815                                                 AsicUpdateProtect(pAd, 0, (ALLN_SETPROTECT), TRUE, 0);
1816                                         }
1817                                         break;
1818                                 case OID_802_11_ADD_WEP:
1819                                         {
1820                                                 UINT    i;
1821                                                 UINT32  KeyIdx;
1822                                                 PNDIS_802_11_WEP        pWepKey;
1823
1824                                                 DBGPRINT(RT_DEBUG_TRACE, ("CmdThread::OID_802_11_ADD_WEP  \n"));
1825
1826                                                 pWepKey = (PNDIS_802_11_WEP)pData;
1827                                                 KeyIdx = pWepKey->KeyIndex & 0x0fffffff;
1828
1829                                                 // it is a shared key
1830                                                 if ((KeyIdx >= 4) || ((pWepKey->KeyLength != 5) && (pWepKey->KeyLength != 13)))
1831                                                 {
1832                                                         NdisStatus = NDIS_STATUS_INVALID_DATA;
1833                                                         DBGPRINT(RT_DEBUG_ERROR, ("CmdThread::OID_802_11_ADD_WEP, INVALID_DATA!!\n"));
1834                                                 }
1835                                                 else
1836                                                 {
1837                                                         UCHAR CipherAlg;
1838                                                         pAd->SharedKey[BSS0][KeyIdx].KeyLen = (UCHAR) pWepKey->KeyLength;
1839                                                         NdisMoveMemory(pAd->SharedKey[BSS0][KeyIdx].Key, &pWepKey->KeyMaterial, pWepKey->KeyLength);
1840                                                         CipherAlg = (pAd->SharedKey[BSS0][KeyIdx].KeyLen == 5)? CIPHER_WEP64 : CIPHER_WEP128;
1841
1842                                                         //
1843                                                         // Change the WEP cipher to CKIP cipher if CKIP KP on.
1844                                                         // Funk UI or Meetinghouse UI will add ckip key from this path.
1845                                                         //
1846
1847                                                         if (pAd->OpMode == OPMODE_STA)
1848                                                         {
1849                                                                 pAd->MacTab.Content[BSSID_WCID].PairwiseKey.CipherAlg = pAd->SharedKey[BSS0][KeyIdx].CipherAlg;
1850                                                                 pAd->MacTab.Content[BSSID_WCID].PairwiseKey.KeyLen = pAd->SharedKey[BSS0][KeyIdx].KeyLen;
1851                                                         }
1852                                                         pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CipherAlg;
1853                                                         if (pWepKey->KeyIndex & 0x80000000)
1854                                                         {
1855                                                                 // Default key for tx (shared key)
1856                                                                 UCHAR   IVEIV[8];
1857                                                                 UINT32  WCIDAttri, Value;
1858                                                                 USHORT  offset, offset2;
1859                                                                 NdisZeroMemory(IVEIV, 8);
1860                                                                 pAd->StaCfg.DefaultKeyId = (UCHAR) KeyIdx;
1861                                                                 // Add BSSID to WCTable. because this is Tx wep key.
1862                                                                 // WCID Attribute UDF:3, BSSIdx:3, Alg:3, Keytable:1=PAIRWISE KEY, BSSIdx is 0
1863                                                                 WCIDAttri = (CipherAlg<<1)|SHAREDKEYTABLE;
1864
1865                                                                 offset = MAC_WCID_ATTRIBUTE_BASE + (BSSID_WCID* HW_WCID_ATTRI_SIZE);
1866                                                                 RTUSBWriteMACRegister(pAd, offset, WCIDAttri);
1867                                                                 // 1. IV/EIV
1868                                                                 // Specify key index to find shared key.
1869                                                                 IVEIV[3] = (UCHAR)(KeyIdx<< 6); //WEP Eiv bit off. groupkey index is not 0
1870                                                                 offset = PAIRWISE_IVEIV_TABLE_BASE + (BSS0Mcast_WCID * HW_IVEIV_ENTRY_SIZE);
1871                                                                 offset2 = PAIRWISE_IVEIV_TABLE_BASE + (BSSID_WCID* HW_IVEIV_ENTRY_SIZE);
1872                                                                 for (i=0; i<8;)
1873                                                                 {
1874                                                                         Value = IVEIV[i];
1875                                                                         Value += (IVEIV[i+1]<<8);
1876                                                                         Value += (IVEIV[i+2]<<16);
1877                                                                         Value += (IVEIV[i+3]<<24);
1878                                                                         RTUSBWriteMACRegister(pAd, offset+i, Value);
1879                                                                         RTUSBWriteMACRegister(pAd, offset2+i, Value);
1880                                                                         i+=4;
1881                                                                 }
1882
1883                                                                 // 2. WCID Attribute UDF:3, BSSIdx:3, Alg:3, Keytable:use share key, BSSIdx is 0
1884                                                                 WCIDAttri = (pAd->SharedKey[BSS0][KeyIdx].CipherAlg<<1)|SHAREDKEYTABLE;
1885                                                                 offset = MAC_WCID_ATTRIBUTE_BASE + (BSS0Mcast_WCID* HW_WCID_ATTRI_SIZE);
1886                                                                 DBGPRINT(RT_DEBUG_TRACE, ("BSS0Mcast_WCID : offset = %x, WCIDAttri = %x\n", offset, WCIDAttri));
1887                                                                 RTUSBWriteMACRegister(pAd, offset, WCIDAttri);
1888
1889                                                         }
1890                                                         AsicAddSharedKeyEntry(pAd, BSS0, (UCHAR)KeyIdx, CipherAlg, pWepKey->KeyMaterial, NULL, NULL);
1891                                                         DBGPRINT(RT_DEBUG_TRACE, ("CmdThread::OID_802_11_ADD_WEP (KeyIdx=%d, Len=%d-byte)\n", KeyIdx, pWepKey->KeyLength));
1892                                                 }
1893                                         }
1894                                         break;
1895
1896                                 case CMDTHREAD_802_11_COUNTER_MEASURE:
1897                                         break;
1898                                 default:
1899                                         DBGPRINT(RT_DEBUG_ERROR, ("--> Control Thread !! ERROR !! Unknown(cmdqelmt->command=0x%x) !! \n", cmdqelmt->command));
1900                                         break;
1901                         }
1902                 }
1903
1904                 if (cmdqelmt->CmdFromNdis == TRUE)
1905                 {
1906                                 if (cmdqelmt->buffer != NULL)
1907                                         NdisFreeMemory(cmdqelmt->buffer, cmdqelmt->bufferlength, 0);
1908
1909                         NdisFreeMemory(cmdqelmt, sizeof(CmdQElmt), 0);
1910                 }
1911                 else
1912                 {
1913                         if ((cmdqelmt->buffer != NULL) && (cmdqelmt->bufferlength != 0))
1914                                 NdisFreeMemory(cmdqelmt->buffer, cmdqelmt->bufferlength, 0);
1915             {
1916                                 NdisFreeMemory(cmdqelmt, sizeof(CmdQElmt), 0);
1917                         }
1918                 }
1919         }       /* end of while */
1920 }
1921