14 files changed, 191 insertions, 80 deletions

diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index aa6dfb811c71..181a146b4768 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1220,6 +1220,7 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
         rt2x00_set_field32(&word, TXD_W0_RETRY_MODE,
                            test_bit(ENTRY_TXD_RETRY_MODE, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, skb->len);
         rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, CIPHER_NONE);
         rt2x00_desc_write(txd, 0, word);
 }
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 3558cb210747..cd5af656932d 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -633,6 +633,16 @@ static void rt2500usb_reset_tuner(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->link.vgc_level = value;
 }
 
+/*
+ * NOTE: This function is directly ported from legacy driver, but
+ * despite it being declared it was never called. Although link tuning
+ * sounds like a good idea, and usually works well for the other drivers,
+ * it does _not_ work with rt2500usb. Enabling this function will result
+ * in TX capabilities only until association kicks in. Immediately
+ * after the successful association all TX frames will be kept in the
+ * hardware queue and never transmitted.
+ */
+#if 0
 static void rt2500usb_link_tuner(struct rt2x00_dev *rt2x00dev)
 {
         int rssi = rt2x00_get_link_rssi(&rt2x00dev->link);
@@ -752,6 +762,9 @@ dynamic_cca_tune:
                 rt2x00dev->link.vgc_level = r17;
         }
 }
+#else
+#define rt2500usb_link_tuner    NULL
+#endif
 
 /*
  * Initialization functions.
@@ -1121,6 +1134,7 @@ static void rt2500usb_write_beacon(struct queue_entry *entry)
         int pipe = usb_sndbulkpipe(usb_dev, 1);
         int length;
         u16 reg;
+        u32 word, len;
 
         /*
          * Add the descriptor in front of the skb.
@@ -1130,6 +1144,17 @@ static void rt2500usb_write_beacon(struct queue_entry *entry)
         skbdesc->desc = entry->skb->data;
 
         /*
+         * Adjust the beacon databyte count. The current number is
+         * calculated before this function gets called, but falsely
+         * assumes that the descriptor was already present in the SKB.
+         */
+        rt2x00_desc_read(skbdesc->desc, 0, &word);
+        len  = rt2x00_get_field32(word, TXD_W0_DATABYTE_COUNT);
+        len += skbdesc->desc_len;
+        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, len);
+        rt2x00_desc_write(skbdesc->desc, 0, word);
+
+        /*
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
@@ -1364,6 +1389,9 @@ static int rt2500usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                 rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
                 rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
                 EEPROM(rt2x00dev, "BBPtune vgc: 0x%04x\n", word);
+        } else {
+                rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
         }
 
         rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R17, &word);
@@ -1372,9 +1400,6 @@ static int rt2500usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                 rt2x00_set_field16(&word, EEPROM_BBPTUNE_R17_HIGH, 0x41);
                 rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R17, word);
                 EEPROM(rt2x00dev, "BBPtune r17: 0x%04x\n", word);
-        } else {
-                rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
-                rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
         }
 
         rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R24, &word);
@@ -1650,7 +1675,6 @@ static void rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
          * Initialize all hw fields.
          */
         rt2x00dev->hw->flags =
-            IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE |
             IEEE80211_HW_RX_INCLUDES_FCS |
             IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
             IEEE80211_HW_SIGNAL_DBM;
@@ -1726,6 +1750,7 @@ static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
         __set_bit(DRIVER_REQUIRE_ATIM_QUEUE, &rt2x00dev->flags);
         __set_bit(DRIVER_REQUIRE_BEACON_GUARD, &rt2x00dev->flags);
         __set_bit(DRIVER_REQUIRE_SCHEDULED, &rt2x00dev->flags);
+        __set_bit(CONFIG_DISABLE_LINK_TUNING, &rt2x00dev->flags);
 
         /*
          * Set the rssi offset.
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 07b03b3c7ef1..8b10ea41b204 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -108,7 +108,10 @@
 #define SHORT_PIFS              ( SIFS + SHORT_SLOT_TIME )
 #define DIFS                    ( PIFS + SLOT_TIME )
 #define SHORT_DIFS              ( SHORT_PIFS + SHORT_SLOT_TIME )
-#define EIFS                    ( SIFS + (8 * (IEEE80211_HEADER + ACK_SIZE)) )
+#define EIFS                    ( SIFS + DIFS + \
+                                  (8 * (IEEE80211_HEADER + ACK_SIZE)) )
+#define SHORT_EIFS              ( SIFS + SHORT_DIFS + \
+                                  (8 * (IEEE80211_HEADER + ACK_SIZE)) )
 
 /*
  * Chipset identification
@@ -365,6 +368,12 @@ struct rt2x00_intf {
 #define DELAYED_CONFIG_ERP              0x00000002
 #define DELAYED_LED_ASSOC               0x00000004
 
+        /*
+         * Software sequence counter, this is only required
+         * for hardware which doesn't support hardware
+         * sequence counting.
+         */
+        spinlock_t seqlock;
         u16 seqno;
 };
 
@@ -597,6 +606,7 @@ enum rt2x00_flags {
         DEVICE_STARTED_SUSPEND,
         DEVICE_ENABLED_RADIO,
         DEVICE_DISABLED_RADIO_HW,
+        DEVICE_DIRTY_CONFIG,
 
         /*
          * Driver features
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index f20ca712504f..d134c3be539a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -254,6 +254,8 @@ config:
                         libconf.ant.rx = default_ant->rx;
                 else if (active_ant->rx == ANTENNA_SW_DIVERSITY)
                         libconf.ant.rx = ANTENNA_B;
+                else
+                        libconf.ant.rx = active_ant->rx;
 
                 if (conf->antenna_sel_tx)
                         libconf.ant.tx = conf->antenna_sel_tx;
@@ -261,6 +263,8 @@ config:
                         libconf.ant.tx = default_ant->tx;
                 else if (active_ant->tx == ANTENNA_SW_DIVERSITY)
                         libconf.ant.tx = ANTENNA_B;
+                else
+                        libconf.ant.tx = active_ant->tx;
         }
 
         if (flags & CONFIG_UPDATE_SLOT_TIME) {
@@ -271,7 +275,7 @@ config:
                 libconf.sifs = SIFS;
                 libconf.pifs = short_slot_time ? SHORT_PIFS : PIFS;
                 libconf.difs = short_slot_time ? SHORT_DIFS : DIFS;
-                libconf.eifs = EIFS;
+                libconf.eifs = short_slot_time ? SHORT_EIFS : EIFS;
         }
 
         libconf.conf = conf;
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 300cf061035f..6bee1d611bbf 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -372,9 +372,6 @@ static ssize_t rt2x00debug_write_##__name(struct file *file,	\
         if (*offset)                                            \
                 return 0;                                       \
                                                                 \
-        if (!capable(CAP_NET_ADMIN))                            \
-                return -EPERM;                                  \
-                                                                \
         if (intf->offset_##__name >= debug->__name.word_count)  \
                 return -EINVAL;                                 \
                                                                 \
@@ -454,7 +451,7 @@ static struct dentry *rt2x00debug_create_file_driver(const char *name,
         data += sprintf(data, "compiled: %s %s\n", __DATE__, __TIME__);
         blob->size = strlen(blob->data);
 
-        return debugfs_create_blob(name, S_IRUGO, intf->driver_folder, blob);
+        return debugfs_create_blob(name, S_IRUSR, intf->driver_folder, blob);
 }
 
 static struct dentry *rt2x00debug_create_file_chipset(const char *name,
@@ -482,7 +479,7 @@ static struct dentry *rt2x00debug_create_file_chipset(const char *name,
         data += sprintf(data, "rf length: %d\n", debug->rf.word_count);
         blob->size = strlen(blob->data);
 
-        return debugfs_create_blob(name, S_IRUGO, intf->driver_folder, blob);
+        return debugfs_create_blob(name, S_IRUSR, intf->driver_folder, blob);
 }
 
 void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
@@ -517,7 +514,7 @@ void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
         if (IS_ERR(intf->chipset_entry))
                 goto exit;
 
-        intf->dev_flags = debugfs_create_file("dev_flags", S_IRUGO,
+        intf->dev_flags = debugfs_create_file("dev_flags", S_IRUSR,
                                               intf->driver_folder, intf,
                                               &rt2x00debug_fop_dev_flags);
         if (IS_ERR(intf->dev_flags))
@@ -532,7 +529,7 @@ void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
 ({                                                              \
         (__intf)->__name##_off_entry =                          \
             debugfs_create_u32(__stringify(__name) "_offset",   \
-                               S_IRUGO | S_IWUSR,               \
+                               S_IRUSR | S_IWUSR,               \
                                (__intf)->register_folder,       \
                                &(__intf)->offset_##__name);     \
         if (IS_ERR((__intf)->__name##_off_entry))               \
@@ -540,7 +537,7 @@ void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
                                                                 \
         (__intf)->__name##_val_entry =                          \
             debugfs_create_file(__stringify(__name) "_value",   \
-                                S_IRUGO | S_IWUSR,              \
+                                S_IRUSR | S_IWUSR,              \
                                 (__intf)->register_folder,      \
                                 (__intf), &rt2x00debug_fop_##__name);\
         if (IS_ERR((__intf)->__name##_val_entry))               \
@@ -560,7 +557,7 @@ void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
                 goto exit;
 
         intf->queue_frame_dump_entry =
-            debugfs_create_file("dump", S_IRUGO, intf->queue_folder,
+            debugfs_create_file("dump", S_IRUSR, intf->queue_folder,
                                 intf, &rt2x00debug_fop_queue_dump);
         if (IS_ERR(intf->queue_frame_dump_entry))
                 goto exit;
@@ -569,7 +566,7 @@ void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
         init_waitqueue_head(&intf->frame_dump_waitqueue);
 
         intf->queue_stats_entry =
-            debugfs_create_file("queue", S_IRUGO, intf->queue_folder,
+            debugfs_create_file("queue", S_IRUSR, intf->queue_folder,
                                 intf, &rt2x00debug_fop_queue_stats);
 
         return;
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 8c93eb8353b0..f42283ad7b02 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1013,6 +1013,7 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->intf_associated = 0;
 
         __set_bit(DEVICE_STARTED, &rt2x00dev->flags);
+        __set_bit(DEVICE_DIRTY_CONFIG, &rt2x00dev->flags);
 
         return 0;
 }
@@ -1237,9 +1238,9 @@ int rt2x00lib_resume(struct rt2x00_dev *rt2x00dev)
         /*
          * Reconfigure device.
          */
-        rt2x00lib_config(rt2x00dev, &rt2x00dev->hw->conf, 1);
-        if (!rt2x00dev->hw->conf.radio_enabled)
-                rt2x00lib_disable_radio(rt2x00dev);
+        retval = rt2x00mac_config(rt2x00dev->hw, &rt2x00dev->hw->conf);
+        if (retval)
+                goto exit;
 
         /*
          * Iterator over each active interface to
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index f2c9b0e79b5f..c5fb3a72cf37 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -125,13 +125,6 @@ void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
 void rt2x00queue_free_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
 
 /**
- * rt2x00queue_free_skb - free a skb
- * @rt2x00dev: Pointer to &struct rt2x00_dev.
- * @skb: The skb to free.
- */
-void rt2x00queue_free_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb);
-
-/**
  * rt2x00queue_write_tx_frame - Write TX frame to hardware
  * @queue: Queue over which the frame should be send
  * @skb: The skb to send
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index f1dcbaa80c3c..bd422fd6a894 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -63,7 +63,7 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
          */
         memcpy(skb->cb, frag_skb->cb, sizeof(skb->cb));
         rts_info = IEEE80211_SKB_CB(skb);
-        rts_info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        rts_info->control.hw_key = NULL;
         rts_info->flags &= ~IEEE80211_TX_CTL_USE_RTS_CTS;
         rts_info->flags &= ~IEEE80211_TX_CTL_USE_CTS_PROTECT;
         rts_info->flags &= ~IEEE80211_TX_CTL_REQ_TX_STATUS;
@@ -83,6 +83,7 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
                                   (struct ieee80211_rts *)(skb->data));
 
         if (rt2x00queue_write_tx_frame(queue, skb)) {
+                dev_kfree_skb_any(skb);
                 WARNING(rt2x00dev, "Failed to send RTS/CTS frame.\n");
                 return NETDEV_TX_BUSY;
         }
@@ -96,7 +97,6 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *ieee80211hdr = (struct ieee80211_hdr *)skb->data;
         enum data_queue_qid qid = skb_get_queue_mapping(skb);
-        struct rt2x00_intf *intf = vif_to_intf(tx_info->control.vif);
         struct data_queue *queue;
         u16 frame_control;
 
@@ -152,18 +152,6 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 }
         }
 
-        /*
-         * XXX: This is as wrong as the old mac80211 code was,
-         *      due to beacons not getting sequence numbers assigned
-         *      properly.
-         */
-        if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
-                if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
-                        intf->seqno += 0x10;
-                ieee80211hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
-                ieee80211hdr->seq_ctrl |= cpu_to_le16(intf->seqno);
-        }
-
         if (rt2x00queue_write_tx_frame(queue, skb)) {
                 ieee80211_stop_queue(rt2x00dev->hw, qid);
                 return NETDEV_TX_BUSY;
@@ -259,6 +247,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
                 rt2x00dev->intf_sta_count++;
 
         spin_lock_init(&intf->lock);
+        spin_lock_init(&intf->seqlock);
         intf->beacon = entry;
 
         if (conf->type == IEEE80211_IF_TYPE_AP)
@@ -322,6 +311,7 @@ EXPORT_SYMBOL_GPL(rt2x00mac_remove_interface);
 int rt2x00mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
+        int force_reconfig;
 
         /*
          * Mac80211 might be calling this function while we are trying
@@ -341,7 +331,17 @@ int rt2x00mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
                         rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
         }
 
-        rt2x00lib_config(rt2x00dev, conf, 0);
+        /*
+         * When the DEVICE_DIRTY_CONFIG flag is set, the device has recently
+         * been started and the configuration must be forced upon the hardware.
+         * Otherwise registers will not be intialized correctly and could
+         * result in non-working hardware because essential registers aren't
+         * initialized.
+         */
+        force_reconfig =
+            __test_and_clear_bit(DEVICE_DIRTY_CONFIG, &rt2x00dev->flags);
+
+        rt2x00lib_config(rt2x00dev, conf, force_reconfig);
 
         /*
          * Reenable RX only if the radio should be on.
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 7f442030f5ad..898cdd7f57d9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -120,6 +120,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(entry->skb);
+        struct rt2x00_intf *intf = vif_to_intf(tx_info->control.vif);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)entry->skb->data;
         struct ieee80211_rate *rate =
             ieee80211_get_tx_rate(rt2x00dev->hw, tx_info);
@@ -127,6 +128,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         unsigned int data_length;
         unsigned int duration;
         unsigned int residual;
+        unsigned long irqflags;
 
         memset(txdesc, 0, sizeof(*txdesc));
 
@@ -200,6 +202,31 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         }
 
         /*
+         * Hardware should insert sequence counter.
+         * FIXME: We insert a software sequence counter first for
+         * hardware that doesn't support hardware sequence counting.
+         *
+         * This is wrong because beacons are not getting sequence
+         * numbers assigned properly.
+         *
+         * A secondary problem exists for drivers that cannot toggle
+         * sequence counting per-frame, since those will override the
+         * sequence counter given by mac80211.
+         */
+        if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
+                spin_lock_irqsave(&intf->seqlock, irqflags);
+
+                if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags))
+                        intf->seqno += 0x10;
+                hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+                hdr->seq_ctrl |= cpu_to_le16(intf->seqno);
+
+                spin_unlock_irqrestore(&intf->seqlock, irqflags);
+
+                __set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
+        }
+
+        /*
          * PLCP setup
          * Length calculation depends on OFDM/CCK rate.
          */
@@ -466,9 +493,12 @@ void rt2x00queue_init_rx(struct rt2x00_dev *rt2x00dev)
         if (!rt2x00dev->ops->lib->init_rxentry)
                 return;
 
-        for (i = 0; i < queue->limit; i++)
+        for (i = 0; i < queue->limit; i++) {
+                queue->entries[i].flags = 0;
+
                 rt2x00dev->ops->lib->init_rxentry(rt2x00dev,
                                                   &queue->entries[i]);
+        }
 }
 
 void rt2x00queue_init_tx(struct rt2x00_dev *rt2x00dev)
@@ -482,9 +512,12 @@ void rt2x00queue_init_tx(struct rt2x00_dev *rt2x00dev)
                 if (!rt2x00dev->ops->lib->init_txentry)
                         continue;
 
-                for (i = 0; i < queue->limit; i++)
+                for (i = 0; i < queue->limit; i++) {
+                        queue->entries[i].flags = 0;
+
                         rt2x00dev->ops->lib->init_txentry(rt2x00dev,
                                                           &queue->entries[i]);
+                }
         }
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index 8945945c892e..a4a8c57004db 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -199,6 +199,7 @@ struct txdone_entry_desc {
  * @ENTRY_TXD_RTS_FRAME: This frame is a RTS frame.
  * @ENTRY_TXD_CTS_FRAME: This frame is a CTS-to-self frame.
  * @ENTRY_TXD_OFDM_RATE: This frame is send out with an OFDM rate.
+ * @ENTRY_TXD_GENERATE_SEQ: This frame requires sequence counter.
  * @ENTRY_TXD_FIRST_FRAGMENT: This is the first frame.
  * @ENTRY_TXD_MORE_FRAG: This frame is followed by another fragment.
  * @ENTRY_TXD_REQ_TIMESTAMP: Require timestamp to be inserted.
@@ -210,6 +211,7 @@ enum txentry_desc_flags {
         ENTRY_TXD_RTS_FRAME,
         ENTRY_TXD_CTS_FRAME,
         ENTRY_TXD_OFDM_RATE,
+        ENTRY_TXD_GENERATE_SEQ,
         ENTRY_TXD_FIRST_FRAGMENT,
         ENTRY_TXD_MORE_FRAG,
         ENTRY_TXD_REQ_TIMESTAMP,
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 83862e7f7aec..8d76bb2e0312 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -122,6 +122,38 @@ int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_vendor_request_buff);
 
+int rt2x00usb_vendor_request_large_buff(struct rt2x00_dev *rt2x00dev,
+                                        const u8 request, const u8 requesttype,
+                                        const u16 offset, const void *buffer,
+                                        const u16 buffer_length,
+                                        const int timeout)
+{
+        int status = 0;
+        unsigned char *tb;
+        u16 off, len, bsize;
+
+        mutex_lock(&rt2x00dev->usb_cache_mutex);
+
+        tb  = (char *)buffer;
+        off = offset;
+        len = buffer_length;
+        while (len && !status) {
+                bsize = min_t(u16, CSR_CACHE_SIZE, len);
+                status = rt2x00usb_vendor_req_buff_lock(rt2x00dev, request,
+                                                        requesttype, off, tb,
+                                                        bsize, timeout);
+
+                tb  += bsize;
+                len -= bsize;
+                off += bsize;
+        }
+
+        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+
+        return status;
+}
+EXPORT_SYMBOL_GPL(rt2x00usb_vendor_request_large_buff);
+
 /*
  * TX data handlers.
  */
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index aad794adf52c..3b4a67417f95 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -70,8 +70,7 @@
 /*
  * Cache size
  */
-#define CSR_CACHE_SIZE                  8
-#define CSR_CACHE_SIZE_FIRMWARE         64
+#define CSR_CACHE_SIZE                  64
 
 /*
  * USB request types.
@@ -172,6 +171,25 @@ int rt2x00usb_vendor_req_buff_lock(struct rt2x00_dev *rt2x00dev,
                                    const u16 buffer_length, const int timeout);
 
 /**
+ * rt2x00usb_vendor_request_large_buff - Send register command to device (buffered)
+ * @rt2x00dev: Pointer to &struct rt2x00_dev
+ * @request: USB vendor command (See &enum rt2x00usb_vendor_request)
+ * @requesttype: Request type &USB_VENDOR_REQUEST_*
+ * @offset: Register start offset to perform action on
+ * @buffer: Buffer where information will be read/written to by device
+ * @buffer_length: Size of &buffer
+ * @timeout: Operation timeout
+ *
+ * This function is used to transfer register data in blocks larger
+ * then CSR_CACHE_SIZE. Use for firmware upload, keys and beacons.
+ */
+int rt2x00usb_vendor_request_large_buff(struct rt2x00_dev *rt2x00dev,
+                                        const u8 request, const u8 requesttype,
+                                        const u16 offset, const void *buffer,
+                                        const u16 buffer_length,
+                                        const int timeout);
+
+/**
  * rt2x00usb_vendor_request_sw - Send single register command to device
  * @rt2x00dev: Pointer to &struct rt2x00_dev
  * @request: USB vendor command (See &enum rt2x00usb_vendor_request)
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index f7c1f92c1448..087e90b328cd 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1004,6 +1004,11 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev, const void *data,
         }
 
         /*
+         * Hardware needs another millisecond before it is ready.
+         */
+        msleep(1);
+
+        /*
          * Reset MAC and BBP registers.
          */
         reg = 0;
@@ -1544,7 +1549,8 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W1_CWMIN, txdesc->cw_min);
         rt2x00_set_field32(&word, TXD_W1_CWMAX, txdesc->cw_max);
         rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, IEEE80211_HEADER);
-        rt2x00_set_field32(&word, TXD_W1_HW_SEQUENCE, 1);
+        rt2x00_set_field32(&word, TXD_W1_HW_SEQUENCE,
+                           test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W1_BUFFER_COUNT, 1);
         rt2x00_desc_write(txd, 1, word);
 
@@ -2278,7 +2284,6 @@ static void rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
          * Initialize all hw fields.
          */
         rt2x00dev->hw->flags =
-            IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE |
             IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
             IEEE80211_HW_SIGNAL_DBM;
         rt2x00dev->hw->extra_tx_headroom = 0;
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index d383735ab8f2..9761eaaa08be 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -890,9 +890,6 @@ static int rt73usb_load_firmware(struct rt2x00_dev *rt2x00dev, const void *data,
         unsigned int i;
         int status;
         u32 reg;
-        const char *ptr = data;
-        char *cache;
-        int buflen;
 
         /*
          * Wait for stable hardware.
@@ -911,31 +908,12 @@ static int rt73usb_load_firmware(struct rt2x00_dev *rt2x00dev, const void *data,
 
         /*
          * Write firmware to device.
-         * We setup a seperate cache for this action,
-         * since we are going to write larger chunks of data
-         * then normally used cache size.
          */
-        cache = kmalloc(CSR_CACHE_SIZE_FIRMWARE, GFP_KERNEL);
-        if (!cache) {
-                ERROR(rt2x00dev, "Failed to allocate firmware cache.\n");
-                return -ENOMEM;
-        }
-
-        for (i = 0; i < len; i += CSR_CACHE_SIZE_FIRMWARE) {
-                buflen = min_t(int, len - i, CSR_CACHE_SIZE_FIRMWARE);
-
-                memcpy(cache, ptr, buflen);
-
-                rt2x00usb_vendor_request(rt2x00dev, USB_MULTI_WRITE,
-                                         USB_VENDOR_REQUEST_OUT,
-                                         FIRMWARE_IMAGE_BASE + i, 0,
-                                         cache, buflen,
-                                         REGISTER_TIMEOUT32(buflen));
-
-                ptr += buflen;
-        }
-
-        kfree(cache);
+        rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
+                                            USB_VENDOR_REQUEST_OUT,
+                                            FIRMWARE_IMAGE_BASE,
+                                            data, len,
+                                            REGISTER_TIMEOUT32(len));
 
         /*
          * Send firmware request to device to load firmware,
@@ -1303,7 +1281,8 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W1_CWMIN, txdesc->cw_min);
         rt2x00_set_field32(&word, TXD_W1_CWMAX, txdesc->cw_max);
         rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, IEEE80211_HEADER);
-        rt2x00_set_field32(&word, TXD_W1_HW_SEQUENCE, 1);
+        rt2x00_set_field32(&word, TXD_W1_HW_SEQUENCE,
+                           test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
         rt2x00_desc_write(txd, 1, word);
 
         rt2x00_desc_read(txd, 2, &word);
@@ -1352,6 +1331,7 @@ static void rt73usb_write_beacon(struct queue_entry *entry)
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         unsigned int beacon_base;
         u32 reg;
+        u32 word, len;
 
         /*
          * Add the descriptor in front of the skb.
@@ -1361,6 +1341,17 @@ static void rt73usb_write_beacon(struct queue_entry *entry)
         skbdesc->desc = entry->skb->data;
 
         /*
+         * Adjust the beacon databyte count. The current number is
+         * calculated before this function gets called, but falsely
+         * assumes that the descriptor was already present in the SKB.
+         */
+        rt2x00_desc_read(skbdesc->desc, 0, &word);
+        len  = rt2x00_get_field32(word, TXD_W0_DATABYTE_COUNT);
+        len += skbdesc->desc_len;
+        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, len);
+        rt2x00_desc_write(skbdesc->desc, 0, word);
+
+        /*
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
@@ -1374,10 +1365,10 @@ static void rt73usb_write_beacon(struct queue_entry *entry)
          * Write entire beacon with descriptor to register.
          */
         beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
-        rt2x00usb_vendor_request(rt2x00dev, USB_MULTI_WRITE,
-                                 USB_VENDOR_REQUEST_OUT, beacon_base, 0,
-                                 entry->skb->data, entry->skb->len,
-                                 REGISTER_TIMEOUT32(entry->skb->len));
+        rt2x00usb_vendor_request_large_buff(rt2x00dev, USB_MULTI_WRITE,
+                                            USB_VENDOR_REQUEST_OUT, beacon_base,
+                                            entry->skb->data, entry->skb->len,
+                                            REGISTER_TIMEOUT32(entry->skb->len));
 
         /*
          * Clean up the beacon skb.
@@ -1871,7 +1862,6 @@ static void rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
          * Initialize all hw fields.
          */
         rt2x00dev->hw->flags =
-            IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE |
             IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
             IEEE80211_HW_SIGNAL_DBM;
         rt2x00dev->hw->extra_tx_headroom = TXD_DESC_SIZE;