16 files changed, 404 insertions, 171 deletions

diff --git a/net/ieee80211/Kconfig b/net/ieee80211/Kconfig
index dbb08528ddf5..f7e84e9d13ad 100644
--- a/net/ieee80211/Kconfig
+++ b/net/ieee80211/Kconfig
@@ -58,6 +58,7 @@ config IEEE80211_CRYPT_TKIP
         depends on IEEE80211 && NET_RADIO
         select CRYPTO
         select CRYPTO_MICHAEL_MIC
+        select CRC32
         ---help---
         Include software based cipher suites in support of IEEE 802.11i
         (aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with TKIP enabled
diff --git a/net/ieee80211/ieee80211_crypt.c b/net/ieee80211/ieee80211_crypt.c
index cb71d794a7d1..5ed0a98b2d76 100644
--- a/net/ieee80211/ieee80211_crypt.c
+++ b/net/ieee80211/ieee80211_crypt.c
@@ -110,11 +110,10 @@ int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops)
         unsigned long flags;
         struct ieee80211_crypto_alg *alg;
 
-        alg = kmalloc(sizeof(*alg), GFP_KERNEL);
+        alg = kzalloc(sizeof(*alg), GFP_KERNEL);
         if (alg == NULL)
                 return -ENOMEM;
 
-        memset(alg, 0, sizeof(*alg));
         alg->ops = ops;
 
         spin_lock_irqsave(&ieee80211_crypto_lock, flags);
diff --git a/net/ieee80211/ieee80211_crypt_ccmp.c b/net/ieee80211/ieee80211_crypt_ccmp.c
index 78b2d13e80e3..35aa3426c3fa 100644
--- a/net/ieee80211/ieee80211_crypt_ccmp.c
+++ b/net/ieee80211/ieee80211_crypt_ccmp.c
@@ -9,7 +9,7 @@
  * more details.
  */
 
-#include <linux/config.h>
+#include <linux/err.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -49,7 +49,7 @@ struct ieee80211_ccmp_data {
 
         int key_idx;
 
-        struct crypto_tfm *tfm;
+        struct crypto_cipher *tfm;
 
         /* scratch buffers for virt_to_page() (crypto API) */
         u8 tx_b0[AES_BLOCK_LEN], tx_b[AES_BLOCK_LEN],
@@ -57,36 +57,26 @@ struct ieee80211_ccmp_data {
         u8 rx_b0[AES_BLOCK_LEN], rx_b[AES_BLOCK_LEN], rx_a[AES_BLOCK_LEN];
 };
 
-static void ieee80211_ccmp_aes_encrypt(struct crypto_tfm *tfm,
-                                       const u8 pt[16], u8 ct[16])
+static inline void ieee80211_ccmp_aes_encrypt(struct crypto_cipher *tfm,
+                                              const u8 pt[16], u8 ct[16])
 {
-        struct scatterlist src, dst;
-
-        src.page = virt_to_page(pt);
-        src.offset = offset_in_page(pt);
-        src.length = AES_BLOCK_LEN;
-
-        dst.page = virt_to_page(ct);
-        dst.offset = offset_in_page(ct);
-        dst.length = AES_BLOCK_LEN;
-
-        crypto_cipher_encrypt(tfm, &dst, &src, AES_BLOCK_LEN);
+        crypto_cipher_encrypt_one(tfm, ct, pt);
 }
 
 static void *ieee80211_ccmp_init(int key_idx)
 {
         struct ieee80211_ccmp_data *priv;
 
-        priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
+        priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
         if (priv == NULL)
                 goto fail;
-        memset(priv, 0, sizeof(*priv));
         priv->key_idx = key_idx;
 
-        priv->tfm = crypto_alloc_tfm("aes", 0);
-        if (priv->tfm == NULL) {
+        priv->tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(priv->tfm)) {
                 printk(KERN_DEBUG "ieee80211_crypt_ccmp: could not allocate "
                        "crypto API aes\n");
+                priv->tfm = NULL;
                 goto fail;
         }
 
@@ -95,7 +85,7 @@ static void *ieee80211_ccmp_init(int key_idx)
       fail:
         if (priv) {
                 if (priv->tfm)
-                        crypto_free_tfm(priv->tfm);
+                        crypto_free_cipher(priv->tfm);
                 kfree(priv);
         }
 
@@ -106,7 +96,7 @@ static void ieee80211_ccmp_deinit(void *priv)
 {
         struct ieee80211_ccmp_data *_priv = priv;
         if (_priv && _priv->tfm)
-                crypto_free_tfm(_priv->tfm);
+                crypto_free_cipher(_priv->tfm);
         kfree(priv);
 }
 
@@ -117,7 +107,7 @@ static inline void xor_block(u8 * b, u8 * a, size_t len)
                 b[i] ^= a[i];
 }
 
-static void ccmp_init_blocks(struct crypto_tfm *tfm,
+static void ccmp_init_blocks(struct crypto_cipher *tfm,
                              struct ieee80211_hdr_4addr *hdr,
                              u8 * pn, size_t dlen, u8 * b0, u8 * auth, u8 * s0)
 {
@@ -273,6 +263,27 @@ static int ieee80211_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
         return 0;
 }
 
+/*
+ * deal with seq counter wrapping correctly.
+ * refer to timer_after() for jiffies wrapping handling
+ */
+static inline int ccmp_replay_check(u8 *pn_n, u8 *pn_o)
+{
+        u32 iv32_n, iv16_n;
+        u32 iv32_o, iv16_o;
+
+        iv32_n = (pn_n[0] << 24) | (pn_n[1] << 16) | (pn_n[2] << 8) | pn_n[3];
+        iv16_n = (pn_n[4] << 8) | pn_n[5];
+
+        iv32_o = (pn_o[0] << 24) | (pn_o[1] << 16) | (pn_o[2] << 8) | pn_o[3];
+        iv16_o = (pn_o[4] << 8) | pn_o[5];
+
+        if ((s32)iv32_n - (s32)iv32_o < 0 ||
+            (iv32_n == iv32_o && iv16_n <= iv16_o))
+                return 1;
+        return 0;
+}
+
 static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
 {
         struct ieee80211_ccmp_data *key = priv;
@@ -325,7 +336,7 @@ static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         pn[5] = pos[0];
         pos += 8;
 
-        if (memcmp(pn, key->rx_pn, CCMP_PN_LEN) <= 0) {
+        if (ccmp_replay_check(pn, key->rx_pn)) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "CCMP: replay detected: STA=" MAC_FMT
                                " previous PN %02x%02x%02x%02x%02x%02x "
@@ -379,7 +390,7 @@ static int ieee80211_ccmp_set_key(void *key, int len, u8 * seq, void *priv)
 {
         struct ieee80211_ccmp_data *data = priv;
         int keyidx;
-        struct crypto_tfm *tfm = data->tfm;
+        struct crypto_cipher *tfm = data->tfm;
 
         keyidx = data->key_idx;
         memset(data, 0, sizeof(*data));
diff --git a/net/ieee80211/ieee80211_crypt_tkip.c b/net/ieee80211/ieee80211_crypt_tkip.c
index 3fa5df2e1f0b..4200ec509866 100644
--- a/net/ieee80211/ieee80211_crypt_tkip.c
+++ b/net/ieee80211/ieee80211_crypt_tkip.c
@@ -9,7 +9,7 @@
  * more details.
  */
 
-#include <linux/config.h>
+#include <linux/err.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -53,8 +53,10 @@ struct ieee80211_tkip_data {
 
         int key_idx;
 
-        struct crypto_tfm *tfm_arc4;
-        struct crypto_tfm *tfm_michael;
+        struct crypto_blkcipher *rx_tfm_arc4;
+        struct crypto_hash *rx_tfm_michael;
+        struct crypto_blkcipher *tx_tfm_arc4;
+        struct crypto_hash *tx_tfm_michael;
 
         /* scratch buffers for virt_to_page() (crypto API) */
         u8 rx_hdr[16], tx_hdr[16];
@@ -86,17 +88,39 @@ static void *ieee80211_tkip_init(int key_idx)
 
         priv->key_idx = key_idx;
 
-        priv->tfm_arc4 = crypto_alloc_tfm("arc4", 0);
-        if (priv->tfm_arc4 == NULL) {
+        priv->tx_tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0,
+                                                CRYPTO_ALG_ASYNC);
+        if (IS_ERR(priv->tx_tfm_arc4)) {
                 printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
                        "crypto API arc4\n");
+                priv->tx_tfm_arc4 = NULL;
                 goto fail;
         }
 
-        priv->tfm_michael = crypto_alloc_tfm("michael_mic", 0);
-        if (priv->tfm_michael == NULL) {
+        priv->tx_tfm_michael = crypto_alloc_hash("michael_mic", 0,
+                                                 CRYPTO_ALG_ASYNC);
+        if (IS_ERR(priv->tx_tfm_michael)) {
                 printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
                        "crypto API michael_mic\n");
+                priv->tx_tfm_michael = NULL;
+                goto fail;
+        }
+
+        priv->rx_tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0,
+                                                CRYPTO_ALG_ASYNC);
+        if (IS_ERR(priv->rx_tfm_arc4)) {
+                printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
+                       "crypto API arc4\n");
+                priv->rx_tfm_arc4 = NULL;
+                goto fail;
+        }
+
+        priv->rx_tfm_michael = crypto_alloc_hash("michael_mic", 0,
+                                                 CRYPTO_ALG_ASYNC);
+        if (IS_ERR(priv->rx_tfm_michael)) {
+                printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
+                       "crypto API michael_mic\n");
+                priv->rx_tfm_michael = NULL;
                 goto fail;
         }
 
@@ -104,10 +128,14 @@ static void *ieee80211_tkip_init(int key_idx)
 
       fail:
         if (priv) {
-                if (priv->tfm_michael)
-                        crypto_free_tfm(priv->tfm_michael);
-                if (priv->tfm_arc4)
-                        crypto_free_tfm(priv->tfm_arc4);
+                if (priv->tx_tfm_michael)
+                        crypto_free_hash(priv->tx_tfm_michael);
+                if (priv->tx_tfm_arc4)
+                        crypto_free_blkcipher(priv->tx_tfm_arc4);
+                if (priv->rx_tfm_michael)
+                        crypto_free_hash(priv->rx_tfm_michael);
+                if (priv->rx_tfm_arc4)
+                        crypto_free_blkcipher(priv->rx_tfm_arc4);
                 kfree(priv);
         }
 
@@ -117,10 +145,16 @@ static void *ieee80211_tkip_init(int key_idx)
 static void ieee80211_tkip_deinit(void *priv)
 {
         struct ieee80211_tkip_data *_priv = priv;
-        if (_priv && _priv->tfm_michael)
-                crypto_free_tfm(_priv->tfm_michael);
-        if (_priv && _priv->tfm_arc4)
-                crypto_free_tfm(_priv->tfm_arc4);
+        if (_priv) {
+                if (_priv->tx_tfm_michael)
+                        crypto_free_hash(_priv->tx_tfm_michael);
+                if (_priv->tx_tfm_arc4)
+                        crypto_free_blkcipher(_priv->tx_tfm_arc4);
+                if (_priv->rx_tfm_michael)
+                        crypto_free_hash(_priv->rx_tfm_michael);
+                if (_priv->rx_tfm_arc4)
+                        crypto_free_blkcipher(_priv->rx_tfm_arc4);
+        }
         kfree(priv);
 }
 
@@ -319,6 +353,7 @@ static int ieee80211_tkip_hdr(struct sk_buff *skb, int hdr_len,
 static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
 {
         struct ieee80211_tkip_data *tkey = priv;
+        struct blkcipher_desc desc = { .tfm = tkey->tx_tfm_arc4 };
         int len;
         u8 rc4key[16], *pos, *icv;
         u32 crc;
@@ -352,18 +387,30 @@ static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
         icv[2] = crc >> 16;
         icv[3] = crc >> 24;
 
-        crypto_cipher_setkey(tkey->tfm_arc4, rc4key, 16);
+        crypto_blkcipher_setkey(tkey->tx_tfm_arc4, rc4key, 16);
         sg.page = virt_to_page(pos);
         sg.offset = offset_in_page(pos);
         sg.length = len + 4;
-        crypto_cipher_encrypt(tkey->tfm_arc4, &sg, &sg, len + 4);
+        return crypto_blkcipher_encrypt(&desc, &sg, &sg, len + 4);
+}
 
+/*
+ * deal with seq counter wrapping correctly.
+ * refer to timer_after() for jiffies wrapping handling
+ */
+static inline int tkip_replay_check(u32 iv32_n, u16 iv16_n,
+                                    u32 iv32_o, u16 iv16_o)
+{
+        if ((s32)iv32_n - (s32)iv32_o < 0 ||
+            (iv32_n == iv32_o && iv16_n <= iv16_o))
+                return 1;
         return 0;
 }
 
 static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
 {
         struct ieee80211_tkip_data *tkey = priv;
+        struct blkcipher_desc desc = { .tfm = tkey->rx_tfm_arc4 };
         u8 rc4key[16];
         u8 keyidx, *pos;
         u32 iv32;
@@ -415,8 +462,7 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24);
         pos += 8;
 
-        if (iv32 < tkey->rx_iv32 ||
-            (iv32 == tkey->rx_iv32 && iv16 <= tkey->rx_iv16)) {
+        if (tkip_replay_check(iv32, iv16, tkey->rx_iv32, tkey->rx_iv16)) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "TKIP: replay detected: STA=" MAC_FMT
                                " previous TSC %08x%04x received TSC "
@@ -435,11 +481,18 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
 
         plen = skb->len - hdr_len - 12;
 
-        crypto_cipher_setkey(tkey->tfm_arc4, rc4key, 16);
+        crypto_blkcipher_setkey(tkey->rx_tfm_arc4, rc4key, 16);
         sg.page = virt_to_page(pos);
         sg.offset = offset_in_page(pos);
         sg.length = plen + 4;
-        crypto_cipher_decrypt(tkey->tfm_arc4, &sg, &sg, plen + 4);
+        if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4)) {
+                if (net_ratelimit()) {
+                        printk(KERN_DEBUG ": TKIP: failed to decrypt "
+                               "received packet from " MAC_FMT "\n",
+                               MAC_ARG(hdr->addr2));
+                }
+                return -7;
+        }
 
         crc = ~crc32_le(~0, pos, plen);
         icv[0] = crc;
@@ -473,12 +526,13 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         return keyidx;
 }
 
-static int michael_mic(struct ieee80211_tkip_data *tkey, u8 * key, u8 * hdr,
+static int michael_mic(struct crypto_hash *tfm_michael, u8 * key, u8 * hdr,
                        u8 * data, size_t data_len, u8 * mic)
 {
+        struct hash_desc desc;
         struct scatterlist sg[2];
 
-        if (tkey->tfm_michael == NULL) {
+        if (tfm_michael == NULL) {
                 printk(KERN_WARNING "michael_mic: tfm_michael == NULL\n");
                 return -1;
         }
@@ -490,12 +544,12 @@ static int michael_mic(struct ieee80211_tkip_data *tkey, u8 * key, u8 * hdr,
         sg[1].offset = offset_in_page(data);
         sg[1].length = data_len;
 
-        crypto_digest_init(tkey->tfm_michael);
-        crypto_digest_setkey(tkey->tfm_michael, key, 8);
-        crypto_digest_update(tkey->tfm_michael, sg, 2);
-        crypto_digest_final(tkey->tfm_michael, mic);
+        if (crypto_hash_setkey(tfm_michael, key, 8))
+                return -1;
 
-        return 0;
+        desc.tfm = tfm_michael;
+        desc.flags = 0;
+        return crypto_hash_digest(&desc, sg, data_len + 16, mic);
 }
 
 static void michael_mic_hdr(struct sk_buff *skb, u8 * hdr)
@@ -529,7 +583,7 @@ static void michael_mic_hdr(struct sk_buff *skb, u8 * hdr)
         if (stype & IEEE80211_STYPE_QOS_DATA) {
                 const struct ieee80211_hdr_3addrqos *qoshdr =
                         (struct ieee80211_hdr_3addrqos *)skb->data;
-                hdr[12] = le16_to_cpu(qoshdr->qos_ctl) & IEEE80211_QCTL_TID;
+                hdr[12] = qoshdr->qos_ctl & cpu_to_le16(IEEE80211_QCTL_TID);
         } else
                 hdr[12] = 0;            /* priority */
 
@@ -551,7 +605,7 @@ static int ieee80211_michael_mic_add(struct sk_buff *skb, int hdr_len,
 
         michael_mic_hdr(skb, tkey->tx_hdr);
         pos = skb_put(skb, 8);
-        if (michael_mic(tkey, &tkey->key[16], tkey->tx_hdr,
+        if (michael_mic(tkey->tx_tfm_michael, &tkey->key[16], tkey->tx_hdr,
                         skb->data + hdr_len, skb->len - 8 - hdr_len, pos))
                 return -1;
 
@@ -589,7 +643,7 @@ static int ieee80211_michael_mic_verify(struct sk_buff *skb, int keyidx,
                 return -1;
 
         michael_mic_hdr(skb, tkey->rx_hdr);
-        if (michael_mic(tkey, &tkey->key[24], tkey->rx_hdr,
+        if (michael_mic(tkey->rx_tfm_michael, &tkey->key[24], tkey->rx_hdr,
                         skb->data + hdr_len, skb->len - 8 - hdr_len, mic))
                 return -1;
         if (memcmp(mic, skb->data + skb->len - 8, 8) != 0) {
@@ -619,14 +673,18 @@ static int ieee80211_tkip_set_key(void *key, int len, u8 * seq, void *priv)
 {
         struct ieee80211_tkip_data *tkey = priv;
         int keyidx;
-        struct crypto_tfm *tfm = tkey->tfm_michael;
-        struct crypto_tfm *tfm2 = tkey->tfm_arc4;
+        struct crypto_hash *tfm = tkey->tx_tfm_michael;
+        struct crypto_blkcipher *tfm2 = tkey->tx_tfm_arc4;
+        struct crypto_hash *tfm3 = tkey->rx_tfm_michael;
+        struct crypto_blkcipher *tfm4 = tkey->rx_tfm_arc4;
 
         keyidx = tkey->key_idx;
         memset(tkey, 0, sizeof(*tkey));
         tkey->key_idx = keyidx;
-        tkey->tfm_michael = tfm;
-        tkey->tfm_arc4 = tfm2;
+        tkey->tx_tfm_michael = tfm;
+        tkey->tx_tfm_arc4 = tfm2;
+        tkey->rx_tfm_michael = tfm3;
+        tkey->rx_tfm_arc4 = tfm4;
         if (len == TKIP_KEY_LEN) {
                 memcpy(tkey->key, key, TKIP_KEY_LEN);
                 tkey->key_set = 1;
diff --git a/net/ieee80211/ieee80211_crypt_wep.c b/net/ieee80211/ieee80211_crypt_wep.c
index 649e581fa565..1b2efff11d39 100644
--- a/net/ieee80211/ieee80211_crypt_wep.c
+++ b/net/ieee80211/ieee80211_crypt_wep.c
@@ -9,7 +9,7 @@
  * more details.
  */
 
-#include <linux/config.h>
+#include <linux/err.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -33,26 +33,34 @@ struct prism2_wep_data {
         u8 key[WEP_KEY_LEN + 1];
         u8 key_len;
         u8 key_idx;
-        struct crypto_tfm *tfm;
+        struct crypto_blkcipher *tx_tfm;
+        struct crypto_blkcipher *rx_tfm;
 };
 
 static void *prism2_wep_init(int keyidx)
 {
         struct prism2_wep_data *priv;
 
-        priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
+        priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
         if (priv == NULL)
                 goto fail;
-        memset(priv, 0, sizeof(*priv));
         priv->key_idx = keyidx;
 
-        priv->tfm = crypto_alloc_tfm("arc4", 0);
-        if (priv->tfm == NULL) {
+        priv->tx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(priv->tx_tfm)) {
                 printk(KERN_DEBUG "ieee80211_crypt_wep: could not allocate "
                        "crypto API arc4\n");
+                priv->tx_tfm = NULL;
                 goto fail;
         }
 
+        priv->rx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(priv->rx_tfm)) {
+                printk(KERN_DEBUG "ieee80211_crypt_wep: could not allocate "
+                       "crypto API arc4\n");
+                priv->rx_tfm = NULL;
+                goto fail;
+        }
         /* start WEP IV from a random value */
         get_random_bytes(&priv->iv, 4);
 
@@ -60,8 +68,10 @@ static void *prism2_wep_init(int keyidx)
 
       fail:
         if (priv) {
-                if (priv->tfm)
-                        crypto_free_tfm(priv->tfm);
+                if (priv->tx_tfm)
+                        crypto_free_blkcipher(priv->tx_tfm);
+                if (priv->rx_tfm)
+                        crypto_free_blkcipher(priv->rx_tfm);
                 kfree(priv);
         }
         return NULL;
@@ -70,8 +80,12 @@ static void *prism2_wep_init(int keyidx)
 static void prism2_wep_deinit(void *priv)
 {
         struct prism2_wep_data *_priv = priv;
-        if (_priv && _priv->tfm)
-                crypto_free_tfm(_priv->tfm);
+        if (_priv) {
+                if (_priv->tx_tfm)
+                        crypto_free_blkcipher(_priv->tx_tfm);
+                if (_priv->rx_tfm)
+                        crypto_free_blkcipher(_priv->rx_tfm);
+        }
         kfree(priv);
 }
 
@@ -122,6 +136,7 @@ static int prism2_wep_build_iv(struct sk_buff *skb, int hdr_len,
 static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
 {
         struct prism2_wep_data *wep = priv;
+        struct blkcipher_desc desc = { .tfm = wep->tx_tfm };
         u32 crc, klen, len;
         u8 *pos, *icv;
         struct scatterlist sg;
@@ -153,13 +168,11 @@ static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
         icv[2] = crc >> 16;
         icv[3] = crc >> 24;
 
-        crypto_cipher_setkey(wep->tfm, key, klen);
+        crypto_blkcipher_setkey(wep->tx_tfm, key, klen);
         sg.page = virt_to_page(pos);
         sg.offset = offset_in_page(pos);
         sg.length = len + 4;
-        crypto_cipher_encrypt(wep->tfm, &sg, &sg, len + 4);
-
-        return 0;
+        return crypto_blkcipher_encrypt(&desc, &sg, &sg, len + 4);
 }
 
 /* Perform WEP decryption on given buffer. Buffer includes whole WEP part of
@@ -172,6 +185,7 @@ static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
 static int prism2_wep_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
 {
         struct prism2_wep_data *wep = priv;
+        struct blkcipher_desc desc = { .tfm = wep->rx_tfm };
         u32 crc, klen, plen;
         u8 key[WEP_KEY_LEN + 3];
         u8 keyidx, *pos, icv[4];
@@ -196,11 +210,12 @@ static int prism2_wep_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         /* Apply RC4 to data and compute CRC32 over decrypted data */
         plen = skb->len - hdr_len - 8;
 
-        crypto_cipher_setkey(wep->tfm, key, klen);
+        crypto_blkcipher_setkey(wep->rx_tfm, key, klen);
         sg.page = virt_to_page(pos);
         sg.offset = offset_in_page(pos);
         sg.length = plen + 4;
-        crypto_cipher_decrypt(wep->tfm, &sg, &sg, plen + 4);
+        if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4))
+                return -7;
 
         crc = ~crc32_le(~0, pos, plen);
         icv[0] = crc;
diff --git a/net/ieee80211/ieee80211_geo.c b/net/ieee80211/ieee80211_geo.c
index 192243ab35ed..305a09de85a5 100644
--- a/net/ieee80211/ieee80211_geo.c
+++ b/net/ieee80211/ieee80211_geo.c
@@ -24,7 +24,6 @@
 
 ******************************************************************************/
 #include <linux/compiler.h>
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/if_arp.h>
 #include <linux/in6.h>
diff --git a/net/ieee80211/ieee80211_module.c b/net/ieee80211/ieee80211_module.c
index 2cb84d84f671..13b1e5fff7e4 100644
--- a/net/ieee80211/ieee80211_module.c
+++ b/net/ieee80211/ieee80211_module.c
@@ -31,7 +31,6 @@
 *******************************************************************************/
 
 #include <linux/compiler.h>
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/if_arp.h>
 #include <linux/in6.h>
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 2bf567fd5a17..770704183a1b 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -14,7 +14,6 @@
  */
 
 #include <linux/compiler.h>
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/if_arp.h>
 #include <linux/in6.h>
@@ -369,6 +368,7 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 
         /* Put this code here so that we avoid duplicating it in all
          * Rx paths. - Jean II */
+#ifdef CONFIG_WIRELESS_EXT
 #ifdef IW_WIRELESS_SPY          /* defined in iw_handler.h */
         /* If spy monitoring on */
         if (ieee->spy_data.spy_number > 0) {
@@ -397,15 +397,16 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                 wireless_spy_update(ieee->dev, hdr->addr2, &wstats);
         }
 #endif                          /* IW_WIRELESS_SPY */
+#endif                          /* CONFIG_WIRELESS_EXT */
 
 #ifdef NOT_YET
         hostap_update_rx_stats(local->ap, hdr, rx_stats);
 #endif
 
         if (ieee->iw_mode == IW_MODE_MONITOR) {
-                ieee80211_monitor_rx(ieee, skb, rx_stats);
                 stats->rx_packets++;
                 stats->rx_bytes += skb->len;
+                ieee80211_monitor_rx(ieee, skb, rx_stats);
                 return 1;
         }
 
@@ -778,33 +779,44 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
         return 0;
 }
 
-/* Filter out unrelated packets, call ieee80211_rx[_mgt] */
-int ieee80211_rx_any(struct ieee80211_device *ieee,
+/* Filter out unrelated packets, call ieee80211_rx[_mgt]
+ * This function takes over the skb, it should not be used again after calling
+ * this function. */
+void ieee80211_rx_any(struct ieee80211_device *ieee,
                      struct sk_buff *skb, struct ieee80211_rx_stats *stats)
 {
         struct ieee80211_hdr_4addr *hdr;
         int is_packet_for_us;
         u16 fc;
 
-        if (ieee->iw_mode == IW_MODE_MONITOR)
-                return ieee80211_rx(ieee, skb, stats) ? 0 : -EINVAL;
+        if (ieee->iw_mode == IW_MODE_MONITOR) {
+                if (!ieee80211_rx(ieee, skb, stats))
+                        dev_kfree_skb_irq(skb);
+                return;
+        }
+
+        if (skb->len < sizeof(struct ieee80211_hdr))
+                goto drop_free;
 
         hdr = (struct ieee80211_hdr_4addr *)skb->data;
         fc = le16_to_cpu(hdr->frame_ctl);
 
         if ((fc & IEEE80211_FCTL_VERS) != 0)
-                return -EINVAL;
+                goto drop_free;
                 
         switch (fc & IEEE80211_FCTL_FTYPE) {
         case IEEE80211_FTYPE_MGMT:
+                if (skb->len < sizeof(struct ieee80211_hdr_3addr))
+                        goto drop_free;
                 ieee80211_rx_mgt(ieee, hdr, stats);
-                return 0;
+                dev_kfree_skb_irq(skb);
+                return;
         case IEEE80211_FTYPE_DATA:
                 break;
         case IEEE80211_FTYPE_CTL:
-                return 0;
+                return;
         default:
-                return -EINVAL;
+                return;
         }
 
         is_packet_for_us = 0;
@@ -848,8 +860,14 @@ int ieee80211_rx_any(struct ieee80211_device *ieee,
         }
 
         if (is_packet_for_us)
-                return (ieee80211_rx(ieee, skb, stats) ? 0 : -EINVAL);
-        return 0;
+                if (!ieee80211_rx(ieee, skb, stats))
+                        dev_kfree_skb_irq(skb);
+        return;
+
+drop_free:
+        dev_kfree_skb_irq(skb);
+        ieee->stats.rx_dropped++;
+        return;
 }
 
 #define MGMT_FRAME_FIXED_PART_LENGTH            0x24
@@ -1060,13 +1078,16 @@ static int ieee80211_parse_info_param(struct ieee80211_info_element
 
         while (length >= sizeof(*info_element)) {
                 if (sizeof(*info_element) + info_element->len > length) {
-                        IEEE80211_DEBUG_MGMT("Info elem: parse failed: "
-                                             "info_element->len + 2 > left : "
-                                             "info_element->len+2=%zd left=%d, id=%d.\n",
-                                             info_element->len +
-                                             sizeof(*info_element),
-                                             length, info_element->id);
-                        return 1;
+                        IEEE80211_ERROR("Info elem: parse failed: "
+                                        "info_element->len + 2 > left : "
+                                        "info_element->len+2=%zd left=%d, id=%d.\n",
+                                        info_element->len +
+                                        sizeof(*info_element),
+                                        length, info_element->id);
+                        /* We stop processing but don't return an error here
+                         * because some misbehaviour APs break this rule. ie.
+                         * Orinoco AP1000. */
+                        break;
                 }
 
                 switch (info_element->id) {
@@ -1165,6 +1186,7 @@ static int ieee80211_parse_info_param(struct ieee80211_info_element
 
                 case MFIE_TYPE_ERP_INFO:
                         network->erp_value = info_element->data[0];
+                        network->flags |= NETWORK_HAS_ERP_VALUE;
                         IEEE80211_DEBUG_MGMT("MFIE_TYPE_ERP_SET: %d\n",
                                              network->erp_value);
                         break;
@@ -1728,5 +1750,6 @@ void ieee80211_rx_mgt(struct ieee80211_device *ieee,
         }
 }
 
+EXPORT_SYMBOL_GPL(ieee80211_rx_any);
 EXPORT_SYMBOL(ieee80211_rx_mgt);
 EXPORT_SYMBOL(ieee80211_rx);
diff --git a/net/ieee80211/ieee80211_tx.c b/net/ieee80211/ieee80211_tx.c
index 6a5de1b84459..ae254497ba3d 100644
--- a/net/ieee80211/ieee80211_tx.c
+++ b/net/ieee80211/ieee80211_tx.c
@@ -24,7 +24,6 @@
 
 ******************************************************************************/
 #include <linux/compiler.h>
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/if_arp.h>
 #include <linux/in6.h>
@@ -338,7 +337,7 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
                 hdr_len += 2;
 
                 skb->priority = ieee80211_classify(skb);
-                header.qos_ctl |= skb->priority & IEEE80211_QCTL_TID;
+                header.qos_ctl |= cpu_to_le16(skb->priority & IEEE80211_QCTL_TID);
         }
         header.frame_ctl = cpu_to_le16(fc);
 
@@ -533,13 +532,6 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
                         return 0;
                 }
 
-                if (ret == NETDEV_TX_BUSY) {
-                        printk(KERN_ERR "%s: NETDEV_TX_BUSY returned; "
-                               "driver should report queue full via "
-                               "ieee_device->is_queue_full.\n",
-                               ieee->dev->name);
-                }
-
                 ieee80211_txb_free(txb);
         }
 
@@ -563,10 +555,13 @@ int ieee80211_tx_frame(struct ieee80211_device *ieee,
         struct net_device_stats *stats = &ieee->stats;
         struct sk_buff *skb_frag;
         int priority = -1;
+        int fraglen = total_len;
+        int headroom = ieee->tx_headroom;
+        struct ieee80211_crypt_data *crypt = ieee->crypt[ieee->tx_keyidx];
 
         spin_lock_irqsave(&ieee->lock, flags);
 
-        if (encrypt_mpdu && !ieee->sec.encrypt)
+        if (encrypt_mpdu && (!ieee->sec.encrypt || !crypt))
                 encrypt_mpdu = 0;
 
         /* If there is no driver handler to take the TXB, dont' bother
@@ -582,20 +577,24 @@ int ieee80211_tx_frame(struct ieee80211_device *ieee,
                 goto success;
         }
 
-        if (encrypt_mpdu)
+        if (encrypt_mpdu) {
                 frame->frame_ctl |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+                fraglen += crypt->ops->extra_mpdu_prefix_len +
+                           crypt->ops->extra_mpdu_postfix_len;
+                headroom += crypt->ops->extra_mpdu_prefix_len;
+        }
 
         /* When we allocate the TXB we allocate enough space for the reserve
          * and full fragment bytes (bytes_per_frag doesn't include prefix,
          * postfix, header, FCS, etc.) */
-        txb = ieee80211_alloc_txb(1, total_len, ieee->tx_headroom, GFP_ATOMIC);
+        txb = ieee80211_alloc_txb(1, fraglen, headroom, GFP_ATOMIC);
         if (unlikely(!txb)) {
                 printk(KERN_WARNING "%s: Could not allocate TXB\n",
                        ieee->dev->name);
                 goto failed;
         }
         txb->encrypted = 0;
-        txb->payload_size = total_len;
+        txb->payload_size = fraglen;
 
         skb_frag = txb->fragments[0];
 
diff --git a/net/ieee80211/ieee80211_wx.c b/net/ieee80211/ieee80211_wx.c
index a78c4f845f66..5cb9cfd35397 100644
--- a/net/ieee80211/ieee80211_wx.c
+++ b/net/ieee80211/ieee80211_wx.c
@@ -369,11 +369,10 @@ int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
                 struct ieee80211_crypt_data *new_crypt;
 
                 /* take WEP into use */
-                new_crypt = kmalloc(sizeof(struct ieee80211_crypt_data),
+                new_crypt = kzalloc(sizeof(struct ieee80211_crypt_data),
                                     GFP_KERNEL);
                 if (new_crypt == NULL)
                         return -ENOMEM;
-                memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
                 new_crypt->ops = ieee80211_get_crypto_ops("WEP");
                 if (!new_crypt->ops) {
                         request_module("ieee80211_crypt_wep");
@@ -616,13 +615,11 @@ int ieee80211_wx_set_encodeext(struct ieee80211_device *ieee,
 
                 ieee80211_crypt_delayed_deinit(ieee, crypt);
 
-                new_crypt = (struct ieee80211_crypt_data *)
-                    kmalloc(sizeof(*new_crypt), GFP_KERNEL);
+                new_crypt = kzalloc(sizeof(*new_crypt), GFP_KERNEL);
                 if (new_crypt == NULL) {
                         ret = -ENOMEM;
                         goto done;
                 }
-                memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
                 new_crypt->ops = ops;
                 if (new_crypt->ops && try_module_get(new_crypt->ops->owner))
                         new_crypt->priv = new_crypt->ops->init(idx);
diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c
index 5e9a90651d04..589f6d2c548a 100644
--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
+++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
@@ -47,9 +47,7 @@ ieee80211softmac_assoc(struct ieee80211softmac_device *mac, struct ieee80211soft
         
         dprintk(KERN_INFO PFX "sent association request!\n");
 
-        /* Change the state to associating */
         spin_lock_irqsave(&mac->lock, flags);
-        mac->associnfo.associating = 1;
         mac->associated = 0; /* just to make sure */
 
         /* Set a timer for timeout */
@@ -63,6 +61,7 @@ void
 ieee80211softmac_assoc_timeout(void *d)
 {
         struct ieee80211softmac_device *mac = (struct ieee80211softmac_device *)d;
+        struct ieee80211softmac_network *n;
         unsigned long flags;
 
         spin_lock_irqsave(&mac->lock, flags);
@@ -75,11 +74,12 @@ ieee80211softmac_assoc_timeout(void *d)
         mac->associnfo.associating = 0;
         mac->associnfo.bssvalid = 0;
         mac->associated = 0;
+
+        n = ieee80211softmac_get_network_by_bssid_locked(mac, mac->associnfo.bssid);
         spin_unlock_irqrestore(&mac->lock, flags);
 
         dprintk(KERN_INFO PFX "assoc request timed out!\n");
-        /* FIXME: we need to know the network here. that requires a bit of restructuring */
-        ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_TIMEOUT, NULL);
+        ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_TIMEOUT, n);
 }
 
 void
@@ -96,7 +96,7 @@ ieee80211softmac_disassoc(struct ieee80211softmac_device *mac)
         mac->associated = 0;
         mac->associnfo.bssvalid = 0;
         mac->associnfo.associating = 0;
-        ieee80211softmac_init_txrates(mac);
+        ieee80211softmac_init_bss(mac);
         ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
         spin_unlock_irqrestore(&mac->lock, flags);
 }
@@ -203,6 +203,10 @@ ieee80211softmac_assoc_work(void *d)
         if (mac->associated)
                 ieee80211softmac_send_disassoc_req(mac, WLAN_REASON_DISASSOC_STA_HAS_LEFT);
 
+        spin_lock_irqsave(&mac->lock, flags);
+        mac->associnfo.associating = 1;
+        spin_unlock_irqrestore(&mac->lock, flags);
+
         /* try to find the requested network in our list, if we found one already */
         if (bssvalid || mac->associnfo.bssfixed)
                 found = ieee80211softmac_get_network_by_bssid(mac, mac->associnfo.bssid);       
@@ -295,19 +299,32 @@ ieee80211softmac_assoc_work(void *d)
         memcpy(mac->associnfo.associate_essid.data, found->essid.data, IW_ESSID_MAX_SIZE + 1);
         
         /* we found a network! authenticate (if necessary) and associate to it. */
-        if (!found->authenticated) {
+        if (found->authenticating) {
+                dprintk(KERN_INFO PFX "Already requested authentication, waiting...\n");
+                if(!mac->associnfo.assoc_wait) {
+                        mac->associnfo.assoc_wait = 1;
+                        ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify_auth, NULL, GFP_KERNEL);
+                }
+                return;
+        }
+        if (!found->authenticated && !found->authenticating) {
                 /* This relies on the fact that _auth_req only queues the work,
                  * otherwise adding the notification would be racy. */
                 if (!ieee80211softmac_auth_req(mac, found)) {
-                        dprintk(KERN_INFO PFX "cannot associate without being authenticated, requested authentication\n");
-                        ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify_auth, NULL, GFP_KERNEL);
+                        if(!mac->associnfo.assoc_wait) {
+                                dprintk(KERN_INFO PFX "Cannot associate without being authenticated, requested authentication\n");
+                                mac->associnfo.assoc_wait = 1;
+                                ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify_auth, NULL, GFP_KERNEL);
+                        }
                 } else {
                         printkl(KERN_WARNING PFX "Not authenticated, but requesting authentication failed. Giving up to associate\n");
+                        mac->associnfo.assoc_wait = 0;
                         ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_FAILED, found);
                 }
                 return;
         }
         /* finally! now we can start associating */
+        mac->associnfo.assoc_wait = 0;
         ieee80211softmac_assoc(mac, found);
 }
 
@@ -317,11 +334,19 @@ ieee80211softmac_associated(struct ieee80211softmac_device *mac,
         struct ieee80211_assoc_response * resp,
         struct ieee80211softmac_network *net)
 {
+        u16 cap = le16_to_cpu(resp->capability);
+        u8 erp_value = net->erp_value;
+
         mac->associnfo.associating = 0;
-        mac->associnfo.supported_rates = net->supported_rates;
+        mac->bssinfo.supported_rates = net->supported_rates;
         ieee80211softmac_recalc_txrates(mac);
 
         mac->associated = 1;
+
+        mac->associnfo.short_preamble_available =
+                (cap & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0;
+        ieee80211softmac_process_erp(mac, erp_value);
+
         if (mac->set_bssid_filter)
                 mac->set_bssid_filter(mac->dev, net->bssid);
         memcpy(mac->ieee->bssid, net->bssid, ETH_ALEN);
@@ -334,9 +359,9 @@ ieee80211softmac_associated(struct ieee80211softmac_device *mac,
 int
 ieee80211softmac_handle_assoc_response(struct net_device * dev,
                                        struct ieee80211_assoc_response * resp,
-                                       struct ieee80211_network * _ieee80211_network_do_not_use)
+                                       struct ieee80211_network * _ieee80211_network)
 {
-        /* NOTE: the network parameter has to be ignored by
+        /* NOTE: the network parameter has to be mostly ignored by
          *       this code because it is the ieee80211's pointer
          *       to the struct, not ours (we made a copy)
          */
@@ -368,6 +393,11 @@ ieee80211softmac_handle_assoc_response(struct net_device * dev,
         /* now that we know it was for us, we can cancel the timeout */
         cancel_delayed_work(&mac->associnfo.timeout);
 
+        /* if the association response included an ERP IE, update our saved
+         * copy */
+        if (_ieee80211_network->flags & NETWORK_HAS_ERP_VALUE)
+                network->erp_value = _ieee80211_network->erp_value;
+
         switch (status) {
                 case 0:
                         dprintk(KERN_INFO PFX "associated!\n");
diff --git a/net/ieee80211/softmac/ieee80211softmac_auth.c b/net/ieee80211/softmac/ieee80211softmac_auth.c
index 90b8484e509b..4cef39e171d0 100644
--- a/net/ieee80211/softmac/ieee80211softmac_auth.c
+++ b/net/ieee80211/softmac/ieee80211softmac_auth.c
@@ -36,8 +36,9 @@ ieee80211softmac_auth_req(struct ieee80211softmac_device *mac,
         struct ieee80211softmac_auth_queue_item *auth;
         unsigned long flags;
         
-        if (net->authenticating)
+        if (net->authenticating || net->authenticated)
                 return 0;
+        net->authenticating = 1;
 
         /* Add the network if it's not already added */
         ieee80211softmac_add_network(mac, net);
@@ -92,7 +93,6 @@ ieee80211softmac_auth_queue(void *data)
                         return;
                 }
                 net->authenticated = 0;
-                net->authenticating = 1;
                 /* add a timeout call so we eventually give up waiting for an auth reply */
                 schedule_delayed_work(&auth->work, IEEE80211SOFTMAC_AUTH_TIMEOUT);
                 auth->retry--;
@@ -116,6 +116,16 @@ ieee80211softmac_auth_queue(void *data)
         kfree(auth);
 }
 
+/* Sends a response to an auth challenge (for shared key auth). */
+static void
+ieee80211softmac_auth_challenge_response(void *_aq)
+{
+        struct ieee80211softmac_auth_queue_item *aq = _aq;
+
+        /* Send our response */
+        ieee80211softmac_send_mgt_frame(aq->mac, aq->net, IEEE80211_STYPE_AUTH, aq->state);
+}
+
 /* Handle the auth response from the AP
  * This should be registered with ieee80211 as handle_auth 
  */
@@ -197,24 +207,30 @@ ieee80211softmac_auth_resp(struct net_device *dev, struct ieee80211_auth *auth)
                 case IEEE80211SOFTMAC_AUTH_SHARED_CHALLENGE:
                         /* Check to make sure we have a challenge IE */
                         data = (u8 *)auth->info_element;
-                        if(*data++ != MFIE_TYPE_CHALLENGE){
+                        if (*data++ != MFIE_TYPE_CHALLENGE) {
                                 printkl(KERN_NOTICE PFX "Shared Key Authentication failed due to a missing challenge.\n");
                                 break;  
                         }
                         /* Save the challenge */
                         spin_lock_irqsave(&mac->lock, flags);
                         net->challenge_len = *data++;   
-                        if(net->challenge_len > WLAN_AUTH_CHALLENGE_LEN)
+                        if (net->challenge_len > WLAN_AUTH_CHALLENGE_LEN)
                                 net->challenge_len = WLAN_AUTH_CHALLENGE_LEN;
-                        if(net->challenge != NULL)
+                        if (net->challenge != NULL)
                                 kfree(net->challenge);
                         net->challenge = kmalloc(net->challenge_len, GFP_ATOMIC);
                         memcpy(net->challenge, data, net->challenge_len);
                         aq->state = IEEE80211SOFTMAC_AUTH_SHARED_RESPONSE; 
-                        spin_unlock_irqrestore(&mac->lock, flags);
 
-                        /* Send our response */
-                        ieee80211softmac_send_mgt_frame(mac, aq->net, IEEE80211_STYPE_AUTH, aq->state);
+                        /* We reuse the work struct from the auth request here.
+                         * It is safe to do so as each one is per-request, and
+                         * at this point (dealing with authentication response)
+                         * we have obviously already sent the initial auth
+                         * request. */
+                        cancel_delayed_work(&aq->work);
+                        INIT_WORK(&aq->work, &ieee80211softmac_auth_challenge_response, (void *)aq);
+                        schedule_work(&aq->work);
+                        spin_unlock_irqrestore(&mac->lock, flags);
                         return 0;
                 case IEEE80211SOFTMAC_AUTH_SHARED_PASS:
                         kfree(net->challenge);
diff --git a/net/ieee80211/softmac/ieee80211softmac_io.c b/net/ieee80211/softmac/ieee80211softmac_io.c
index 09541611e48c..82bfddbf33a2 100644
--- a/net/ieee80211/softmac/ieee80211softmac_io.c
+++ b/net/ieee80211/softmac/ieee80211softmac_io.c
@@ -96,8 +96,7 @@ ieee80211softmac_alloc_mgt(u32 size)
         if(size > IEEE80211_DATA_LEN)
                 return NULL;
         /* Allocate the frame */
-        data = kmalloc(size, GFP_ATOMIC);
-        memset(data, 0, size);
+        data = kzalloc(size, GFP_ATOMIC);
         return data;
 }
 
@@ -229,6 +228,9 @@ ieee80211softmac_assoc_req(struct ieee80211_assoc_request **pkt,
                 return 0;
         ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_ASSOC_REQ, net->bssid, net->bssid);
 
+        /* Fill in the capabilities */
+        (*pkt)->capability = ieee80211softmac_capabilities(mac, net);
+
         /* Fill in Listen Interval (?) */
         (*pkt)->listen_interval = cpu_to_le16(10);
         
@@ -465,3 +467,17 @@ ieee80211softmac_send_mgt_frame(struct ieee80211softmac_device *mac,
         kfree(pkt);
         return 0;
 }
+
+/* Beacon handling */
+int ieee80211softmac_handle_beacon(struct net_device *dev,
+        struct ieee80211_beacon *beacon,
+        struct ieee80211_network *network)
+{
+        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
+
+        if (mac->associated && memcmp(network->bssid, mac->associnfo.bssid, ETH_ALEN) == 0)
+                ieee80211softmac_process_erp(mac, network->erp_value);
+
+        return 0;
+}
+
diff --git a/net/ieee80211/softmac/ieee80211softmac_module.c b/net/ieee80211/softmac/ieee80211softmac_module.c
index 4b2e57d12418..addea1cf73ae 100644
--- a/net/ieee80211/softmac/ieee80211softmac_module.c
+++ b/net/ieee80211/softmac/ieee80211softmac_module.c
@@ -44,6 +44,7 @@ struct net_device *alloc_ieee80211softmac(int sizeof_priv)
         softmac->ieee->handle_assoc_response = ieee80211softmac_handle_assoc_response;
         softmac->ieee->handle_reassoc_request = ieee80211softmac_handle_reassoc_req;
         softmac->ieee->handle_disassoc = ieee80211softmac_handle_disassoc;
+        softmac->ieee->handle_beacon = ieee80211softmac_handle_beacon;
         softmac->scaninfo = NULL;
 
         softmac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
@@ -178,21 +179,14 @@ int ieee80211softmac_ratesinfo_rate_supported(struct ieee80211softmac_ratesinfo
         return 0;
 }
 
-/* Finds the highest rate which is:
- *  1. Present in ri (optionally a basic rate)
- *  2. Supported by the device
- *  3. Less than or equal to the user-defined rate
- */
-static u8 highest_supported_rate(struct ieee80211softmac_device *mac,
+u8 ieee80211softmac_highest_supported_rate(struct ieee80211softmac_device *mac,
         struct ieee80211softmac_ratesinfo *ri, int basic_only)
 {
         u8 user_rate = mac->txrates.user_rate;
         int i;
 
-        if (ri->count == 0) {
-                dprintk(KERN_ERR PFX "empty ratesinfo?\n");
+        if (ri->count == 0)
                 return IEEE80211_CCK_RATE_1MB;
-        }
 
         for (i = ri->count - 1; i >= 0; i--) {
                 u8 rate = ri->rates[i];
@@ -208,36 +202,61 @@ static u8 highest_supported_rate(struct ieee80211softmac_device *mac,
         /* If we haven't found a suitable rate by now, just trust the user */
         return user_rate;
 }
+EXPORT_SYMBOL_GPL(ieee80211softmac_highest_supported_rate);
+
+void ieee80211softmac_process_erp(struct ieee80211softmac_device *mac,
+        u8 erp_value)
+{
+        int use_protection;
+        int short_preamble;
+        u32 changes = 0;
+
+        /* Barker preamble mode */
+        short_preamble = ((erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0
+                          && mac->associnfo.short_preamble_available) ? 1 : 0;
+
+        /* Protection needed? */
+        use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
+
+        if (mac->bssinfo.short_preamble != short_preamble) {
+                changes |= IEEE80211SOFTMAC_BSSINFOCHG_SHORT_PREAMBLE;
+                mac->bssinfo.short_preamble = short_preamble;
+        }
+
+        if (mac->bssinfo.use_protection != use_protection) {
+                changes |= IEEE80211SOFTMAC_BSSINFOCHG_PROTECTION;
+                mac->bssinfo.use_protection = use_protection;
+        }
+
+        if (mac->bssinfo_change && changes)
+                mac->bssinfo_change(mac->dev, changes);
+}
 
 void ieee80211softmac_recalc_txrates(struct ieee80211softmac_device *mac)
 {
         struct ieee80211softmac_txrates *txrates = &mac->txrates;
-        struct ieee80211softmac_txrates oldrates;
         u32 change = 0;
 
-        if (mac->txrates_change)
-                oldrates = mac->txrates;
-
         change |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT;
-        txrates->default_rate = highest_supported_rate(mac, &mac->associnfo.supported_rates, 0);
+        txrates->default_rate = ieee80211softmac_highest_supported_rate(mac, &mac->bssinfo.supported_rates, 0);
 
         change |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT_FBACK;
         txrates->default_fallback = lower_rate(mac, txrates->default_rate);
 
         change |= IEEE80211SOFTMAC_TXRATECHG_MCAST;
-        txrates->mcast_rate = highest_supported_rate(mac, &mac->associnfo.supported_rates, 1);
+        txrates->mcast_rate = ieee80211softmac_highest_supported_rate(mac, &mac->bssinfo.supported_rates, 1);
 
         if (mac->txrates_change)
-                mac->txrates_change(mac->dev, change, &oldrates);
+                mac->txrates_change(mac->dev, change);
 
 }
 
-void ieee80211softmac_init_txrates(struct ieee80211softmac_device *mac)
+void ieee80211softmac_init_bss(struct ieee80211softmac_device *mac)
 {
         struct ieee80211_device *ieee = mac->ieee;
         u32 change = 0;
         struct ieee80211softmac_txrates *txrates = &mac->txrates;
-        struct ieee80211softmac_txrates oldrates;
+        struct ieee80211softmac_bss_info *bssinfo = &mac->bssinfo;
 
         /* TODO: We need some kind of state machine to lower the default rates
          *       if we loose too many packets.
@@ -245,8 +264,6 @@ void ieee80211softmac_init_txrates(struct ieee80211softmac_device *mac)
         /* Change the default txrate to the highest possible value.
          * The txrate machine will lower it, if it is too high.
          */
-        if (mac->txrates_change)
-                oldrates = mac->txrates;
         /* FIXME: We don't correctly handle backing down to lower
            rates, so 801.11g devices start off at 11M for now. People
            can manually change it if they really need to, but 11M is
@@ -272,7 +289,23 @@ void ieee80211softmac_init_txrates(struct ieee80211softmac_device *mac)
         change |= IEEE80211SOFTMAC_TXRATECHG_MGT_MCAST;
 
         if (mac->txrates_change)
-                mac->txrates_change(mac->dev, change, &oldrates);
+                mac->txrates_change(mac->dev, change);
+
+        change = 0;
+
+        bssinfo->supported_rates.count = 0;
+        memset(bssinfo->supported_rates.rates, 0,
+                sizeof(bssinfo->supported_rates.rates));
+        change |= IEEE80211SOFTMAC_BSSINFOCHG_RATES;
+
+        bssinfo->short_preamble = 0;
+        change |= IEEE80211SOFTMAC_BSSINFOCHG_SHORT_PREAMBLE;
+
+        bssinfo->use_protection = 0;
+        change |= IEEE80211SOFTMAC_BSSINFOCHG_PROTECTION;
+
+        if (mac->bssinfo_change)
+                mac->bssinfo_change(mac->dev, change);
 
         mac->running = 1;
 }
@@ -282,7 +315,7 @@ void ieee80211softmac_start(struct net_device *dev)
         struct ieee80211softmac_device *mac = ieee80211_priv(dev);
 
         ieee80211softmac_start_check_rates(mac);
-        ieee80211softmac_init_txrates(mac);
+        ieee80211softmac_init_bss(mac);
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_start);
 
@@ -335,7 +368,6 @@ u8 ieee80211softmac_lower_rate_delta(struct ieee80211softmac_device *mac, u8 rat
 static void ieee80211softmac_add_txrates_badness(struct ieee80211softmac_device *mac,
                                                  int amount)
 {
-        struct ieee80211softmac_txrates oldrates;
         u8 default_rate = mac->txrates.default_rate;
         u8 default_fallback = mac->txrates.default_fallback;
         u32 changes = 0;
@@ -348,8 +380,6 @@ printk("badness %d\n", mac->txrate_badness);
         mac->txrate_badness += amount;
         if (mac->txrate_badness <= -1000) {
                 /* Very small badness. Try a faster bitrate. */
-                if (mac->txrates_change)
-                        memcpy(&oldrates, &mac->txrates, sizeof(oldrates));
                 default_rate = raise_rate(mac, default_rate);
                 changes |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT;
                 default_fallback = get_fallback_rate(mac, default_rate);
@@ -358,8 +388,6 @@ printk("badness %d\n", mac->txrate_badness);
 printk("Bitrate raised to %u\n", default_rate);
         } else if (mac->txrate_badness >= 10000) {
                 /* Very high badness. Try a slower bitrate. */
-                if (mac->txrates_change)
-                        memcpy(&oldrates, &mac->txrates, sizeof(oldrates));
                 default_rate = lower_rate(mac, default_rate);
                 changes |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT;
                 default_fallback = get_fallback_rate(mac, default_rate);
@@ -372,7 +400,7 @@ printk("Bitrate lowered to %u\n", default_rate);
         mac->txrates.default_fallback = default_fallback;
 
         if (changes && mac->txrates_change)
-                mac->txrates_change(mac->dev, changes, &oldrates);
+                mac->txrates_change(mac->dev, changes);
 }
 
 void ieee80211softmac_fragment_lost(struct net_device *dev,
@@ -416,7 +444,11 @@ ieee80211softmac_create_network(struct ieee80211softmac_device *mac,
         memcpy(&softnet->supported_rates.rates[softnet->supported_rates.count], net->rates_ex, net->rates_ex_len);
         softnet->supported_rates.count += net->rates_ex_len;
         sort(softnet->supported_rates.rates, softnet->supported_rates.count, sizeof(softnet->supported_rates.rates[0]), rate_cmp, NULL);
-        
+
+        /* we save the ERP value because it is needed at association time, and
+         * many AP's do not include an ERP IE in the association response. */
+        softnet->erp_value = net->erp_value;
+
         softnet->capabilities = net->capability;
         return softnet;
 }
diff --git a/net/ieee80211/softmac/ieee80211softmac_priv.h b/net/ieee80211/softmac/ieee80211softmac_priv.h
index fa1f8e3acfc0..0642e090b8a7 100644
--- a/net/ieee80211/softmac/ieee80211softmac_priv.h
+++ b/net/ieee80211/softmac/ieee80211softmac_priv.h
@@ -116,9 +116,11 @@ ieee80211softmac_get_network_by_essid(struct ieee80211softmac_device *mac,
         struct ieee80211softmac_essid *essid);
 
 /* Rates related */
+void ieee80211softmac_process_erp(struct ieee80211softmac_device *mac,
+        u8 erp_value);
 int ieee80211softmac_ratesinfo_rate_supported(struct ieee80211softmac_ratesinfo *ri, u8 rate);
 u8 ieee80211softmac_lower_rate_delta(struct ieee80211softmac_device *mac, u8 rate, int delta);
-void ieee80211softmac_init_txrates(struct ieee80211softmac_device *mac);
+void ieee80211softmac_init_bss(struct ieee80211softmac_device *mac);
 void ieee80211softmac_recalc_txrates(struct ieee80211softmac_device *mac);
 static inline u8 lower_rate(struct ieee80211softmac_device *mac, u8 rate) {
         return ieee80211softmac_lower_rate_delta(mac, rate, 1);
@@ -133,6 +135,9 @@ static inline u8 get_fallback_rate(struct ieee80211softmac_device *mac, u8 rate)
 /*** prototypes from _io.c */
 int ieee80211softmac_send_mgt_frame(struct ieee80211softmac_device *mac,
         void* ptrarg, u32 type, u32 arg);
+int ieee80211softmac_handle_beacon(struct net_device *dev,
+        struct ieee80211_beacon *beacon,
+        struct ieee80211_network *network);
 
 /*** prototypes from _auth.c */
 /* do these have to go into the public header? */
@@ -189,6 +194,7 @@ struct ieee80211softmac_network {
             authenticated:1,
             auth_desynced_once:1;
 
+        u8 erp_value;                           /* Saved ERP value */
         u16 capabilities;                       /* Capabilities bitfield */
         u8 challenge_len;                       /* Auth Challenge length */
         char *challenge;                        /* Challenge Text */
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index 0e65ff4e33fc..2aa779d18f38 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -70,15 +70,47 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
                               char *extra)
 {
         struct ieee80211softmac_device *sm = ieee80211_priv(net_dev);
+        struct ieee80211softmac_network *n;
+        struct ieee80211softmac_auth_queue_item *authptr;
         int length = 0;
         unsigned long flags;
-        
+
+        /* Check if we're already associating to this or another network
+         * If it's another network, cancel and start over with our new network
+         * If it's our network, ignore the change, we're already doing it!
+         */
+        if((sm->associnfo.associating || sm->associated) &&
+           (data->essid.flags && data->essid.length)) {
+                /* Get the associating network */
+                n = ieee80211softmac_get_network_by_bssid(sm, sm->associnfo.bssid);
+                if(n && n->essid.len == data->essid.length &&
+                   !memcmp(n->essid.data, extra, n->essid.len)) {
+                        dprintk(KERN_INFO PFX "Already associating or associated to "MAC_FMT"\n",
+                                MAC_ARG(sm->associnfo.bssid));
+                        return 0;
+                } else {
+                        dprintk(KERN_INFO PFX "Canceling existing associate request!\n");
+                        spin_lock_irqsave(&sm->lock,flags);
+                        /* Cancel assoc work */
+                        cancel_delayed_work(&sm->associnfo.work);
+                        /* We don't have to do this, but it's a little cleaner */
+                        list_for_each_entry(authptr, &sm->auth_queue, list)
+                                cancel_delayed_work(&authptr->work);
+                        sm->associnfo.bssvalid = 0;
+                        sm->associnfo.bssfixed = 0;
+                        spin_unlock_irqrestore(&sm->lock,flags);
+                        flush_scheduled_work();
+                }
+        }
+
+
         spin_lock_irqsave(&sm->lock, flags);
-        
+
         sm->associnfo.static_essid = 0;
+        sm->associnfo.assoc_wait = 0;
 
-        if (data->essid.flags && data->essid.length && extra /*required?*/) {
-                length = min(data->essid.length - 1, IW_ESSID_MAX_SIZE);
+        if (data->essid.flags && data->essid.length) {
+                length = min((int)data->essid.length, IW_ESSID_MAX_SIZE);
                 if (length) {
                         memcpy(sm->associnfo.req_essid.data, extra, length);
                         sm->associnfo.static_essid = 1;