3 files changed, 46 insertions, 33 deletions

diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 83cd85e1f847..29be3dc8ee09 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -413,12 +413,12 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                         last_addr = range->end_addr;
                         __skb_unlink(entry, &priv->tx_queue);
                         memset(&info->status, 0, sizeof(info->status));
-                        priv->tx_stats[skb_get_queue_mapping(skb)].len--;
                         entry_hdr = (struct p54_control_hdr *) entry->data;
                         entry_data = (struct p54_tx_control_allocdata *) entry_hdr->data;
                         if ((entry_hdr->magic1 & cpu_to_le16(0x4000)) != 0)
                                 pad = entry_data->align[0];
 
+                        priv->tx_stats[entry_data->hw_queue - 4].len--;
                         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
                                 if (!(payload->status & 0x01))
                                         info->flags |= IEEE80211_TX_STAT_ACK;
@@ -557,6 +557,7 @@ static int p54_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct p54_tx_control_allocdata *txhdr;
         size_t padding, len;
         u8 rate;
+        u8 cts_rate = 0x20;
 
         current_queue = &priv->tx_stats[skb_get_queue_mapping(skb)];
         if (unlikely(current_queue->len > current_queue->limit))
@@ -581,28 +582,28 @@ static int p54_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         hdr->type = (info->flags & IEEE80211_TX_CTL_NO_ACK) ? 0 : cpu_to_le16(1);
         hdr->retry1 = hdr->retry2 = info->control.retry_limit;
 
-        memset(txhdr->wep_key, 0x0, 16);
-        txhdr->padding = 0;
-        txhdr->padding2 = 0;
-
         /* TODO: add support for alternate retry TX rates */
         rate = ieee80211_get_tx_rate(dev, info)->hw_value;
-        if (info->flags & IEEE80211_TX_CTL_SHORT_PREAMBLE)
+        if (info->flags & IEEE80211_TX_CTL_SHORT_PREAMBLE) {
                 rate |= 0x10;
-        if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
+                cts_rate |= 0x10;
+        }
+        if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) {
                 rate |= 0x40;
-        else if (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)
+                cts_rate |= ieee80211_get_rts_cts_rate(dev, info)->hw_value;
+        } else if (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT) {
                 rate |= 0x20;
+                cts_rate |= ieee80211_get_rts_cts_rate(dev, info)->hw_value;
+        }
         memset(txhdr->rateset, rate, 8);
-        txhdr->wep_key_present = 0;
-        txhdr->wep_key_len = 0;
-        txhdr->frame_type = cpu_to_le32(skb_get_queue_mapping(skb) + 4);
-        txhdr->magic4 = 0;
-        txhdr->antenna = (info->antenna_sel_tx == 0) ?
+        txhdr->key_type = 0;
+        txhdr->key_len = 0;
+        txhdr->hw_queue = skb_get_queue_mapping(skb) + 4;
+        txhdr->tx_antenna = (info->antenna_sel_tx == 0) ?
                 2 : info->antenna_sel_tx - 1;
         txhdr->output_power = 0x7f; // HW Maximum
-        txhdr->magic5 = (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
-                0 : ((rate > 0x3) ? cpu_to_le32(0x33) : cpu_to_le32(0x23));
+        txhdr->cts_rate = (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
+                          0 : cts_rate;
         if (padding)
                 txhdr->align[0] = padding;
 
@@ -836,10 +837,21 @@ static int p54_start(struct ieee80211_hw *dev)
         struct p54_common *priv = dev->priv;
         int err;
 
+        if (!priv->cached_vdcf) {
+                priv->cached_vdcf = kzalloc(sizeof(struct p54_tx_control_vdcf)+
+                        priv->tx_hdr_len + sizeof(struct p54_control_hdr),
+                        GFP_KERNEL);
+
+                if (!priv->cached_vdcf)
+                        return -ENOMEM;
+        }
+
         err = priv->open(dev);
         if (!err)
                 priv->mode = IEEE80211_IF_TYPE_MNTR;
 
+        p54_init_vdcf(dev);
+
         return err;
 }
 
@@ -1019,15 +1031,6 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
         dev->extra_tx_headroom = sizeof(struct p54_control_hdr) + 4 +
                                  sizeof(struct p54_tx_control_allocdata);
 
-        priv->cached_vdcf = kzalloc(sizeof(struct p54_tx_control_vdcf) +
-              priv->tx_hdr_len + sizeof(struct p54_control_hdr), GFP_KERNEL);
-
-        if (!priv->cached_vdcf) {
-                ieee80211_free_hw(dev);
-                return NULL;
-        }
-
-        p54_init_vdcf(dev);
         mutex_init(&priv->conf_mutex);
 
         return dev;
diff --git a/drivers/net/wireless/p54/p54common.h b/drivers/net/wireless/p54/p54common.h
index 2245fcce92dc..8db6c0e8e540 100644
--- a/drivers/net/wireless/p54/p54common.h
+++ b/drivers/net/wireless/p54/p54common.h
@@ -183,16 +183,16 @@ struct p54_frame_sent_hdr {
 
 struct p54_tx_control_allocdata {
         u8 rateset[8];
-        u16 padding;
-        u8 wep_key_present;
-        u8 wep_key_len;
-        u8 wep_key[16];
-        __le32 frame_type;
-        u32 padding2;
-        __le16 magic4;
-        u8 antenna;
+        u8 unalloc0[2];
+        u8 key_type;
+        u8 key_len;
+        u8 key[16];
+        u8 hw_queue;
+        u8 unalloc1[9];
+        u8 tx_antenna;
         u8 output_power;
-        __le32 magic5;
+        u8 cts_rate;
+        u8 unalloc2[3];
         u8 align[0];
 } __attribute__ ((packed));
 
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 815c095ef797..cbaca23a9453 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -109,7 +109,17 @@ static void p54u_rx_cb(struct urb *urb)
                 urb->context = skb;
                 skb_queue_tail(&priv->rx_queue, skb);
         } else {
+                if (!priv->hw_type)
+                        skb_push(skb, sizeof(struct net2280_tx_hdr));
+
+                skb_reset_tail_pointer(skb);
                 skb_trim(skb, 0);
+                if (urb->transfer_buffer != skb_tail_pointer(skb)) {
+                        /* this should not happen */
+                        WARN_ON(1);
+                        urb->transfer_buffer = skb_tail_pointer(skb);
+                }
+
                 skb_queue_tail(&priv->rx_queue, skb);
         }