int tx_headroom; /* required headroom for hardware/radiotap */
 
+       /* count for keys needing tailroom space allocation */
+       int crypto_tx_tailroom_needed_cnt;
+
        /* Tasklet and skb queue to process calls from IRQ mode. All frames
         * added to skb_queue will be processed, but frames in
         * skb_queue_unreliable may be dropped if the total length of these
 
 
        if (!ret) {
                key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
+
+               if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                       key->local->crypto_tx_tailroom_needed_cnt--;
+
                return 0;
        }
 
                          key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 
        key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
+
+       if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+               key->local->crypto_tx_tailroom_needed_cnt++;
 }
 
 void ieee80211_key_removed(struct ieee80211_key_conf *key_conf)
                ieee80211_aes_key_free(key->u.ccmp.tfm);
        if (key->conf.cipher == WLAN_CIPHER_SUITE_AES_CMAC)
                ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
-       if (key->local)
+       if (key->local) {
                ieee80211_debugfs_key_remove(key);
+               key->local->crypto_tx_tailroom_needed_cnt--;
+       }
 
        kfree(key);
 }
 
        ieee80211_debugfs_key_add(key);
 
+       key->local->crypto_tx_tailroom_needed_cnt++;
+
        ret = ieee80211_key_enable_hw_accel(key);
 
        mutex_unlock(&sdata->local->key_mtx);
 
        mutex_lock(&sdata->local->key_mtx);
 
-       list_for_each_entry(key, &sdata->key_list, list)
+       sdata->local->crypto_tx_tailroom_needed_cnt = 0;
+
+       list_for_each_entry(key, &sdata->key_list, list) {
+               sdata->local->crypto_tx_tailroom_needed_cnt++;
                ieee80211_key_enable_hw_accel(key);
+       }
 
        mutex_unlock(&sdata->local->key_mtx);
 }
 
 {
        int tail_need = 0;
 
-       /*
-        * This could be optimised, devices that do full hardware
-        * crypto (including TKIP MMIC) need no tailroom... But we
-        * have no drivers for such devices currently.
-        */
-       if (may_encrypt) {
+       if (may_encrypt && local->crypto_tx_tailroom_needed_cnt) {
                tail_need = IEEE80211_ENCRYPT_TAILROOM;
                tail_need -= skb_tailroom(skb);
                tail_need = max_t(int, tail_need, 0);