12 files changed, 402 insertions, 228 deletions

diff --git a/net/ieee80211/ieee80211_crypt_tkip.c b/net/ieee80211/ieee80211_crypt_tkip.c
index 93def94c1b32..3fa5df2e1f0b 100644
--- a/net/ieee80211/ieee80211_crypt_tkip.c
+++ b/net/ieee80211/ieee80211_crypt_tkip.c
@@ -501,8 +501,11 @@ static int michael_mic(struct ieee80211_tkip_data *tkey, u8 * key, u8 * hdr,
 static void michael_mic_hdr(struct sk_buff *skb, u8 * hdr)
 {
         struct ieee80211_hdr_4addr *hdr11;
+        u16 stype;
 
         hdr11 = (struct ieee80211_hdr_4addr *)skb->data;
+        stype  = WLAN_FC_GET_STYPE(le16_to_cpu(hdr11->frame_ctl));
+
         switch (le16_to_cpu(hdr11->frame_ctl) &
                 (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
         case IEEE80211_FCTL_TODS:
@@ -523,7 +526,13 @@ static void michael_mic_hdr(struct sk_buff *skb, u8 * hdr)
                 break;
         }
 
-        hdr[12] = 0;            /* priority */
+        if (stype & IEEE80211_STYPE_QOS_DATA) {
+                const struct ieee80211_hdr_3addrqos *qoshdr =
+                        (struct ieee80211_hdr_3addrqos *)skb->data;
+                hdr[12] = le16_to_cpu(qoshdr->qos_ctl) & IEEE80211_QCTL_TID;
+        } else
+                hdr[12] = 0;            /* priority */
+
         hdr[13] = hdr[14] = hdr[15] = 0;        /* reserved */
 }
 
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 604b7b0097bc..2bf567fd5a17 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -369,7 +369,6 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 
         /* Put this code here so that we avoid duplicating it in all
          * Rx paths. - Jean II */
-#ifdef CONFIG_WIRELESS_EXT
 #ifdef IW_WIRELESS_SPY          /* defined in iw_handler.h */
         /* If spy monitoring on */
         if (ieee->spy_data.spy_number > 0) {
@@ -398,7 +397,6 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                 wireless_spy_update(ieee->dev, hdr->addr2, &wstats);
         }
 #endif                          /* IW_WIRELESS_SPY */
-#endif                          /* CONFIG_WIRELESS_EXT */
 
 #ifdef NOT_YET
         hostap_update_rx_stats(local->ap, hdr, rx_stats);
@@ -1692,8 +1690,8 @@ void ieee80211_rx_mgt(struct ieee80211_device *ieee,
                                      WLAN_FC_GET_STYPE(le16_to_cpu
                                                        (header->frame_ctl)));
 
-                IEEE80211_WARNING("%s: IEEE80211_REASSOC_REQ received\n",
-                                  ieee->dev->name);
+                IEEE80211_DEBUG_MGMT("%s: IEEE80211_REASSOC_REQ received\n",
+                                     ieee->dev->name);
                 if (ieee->handle_reassoc_request != NULL)
                         ieee->handle_reassoc_request(ieee->dev,
                                                     (struct ieee80211_reassoc_request *)
@@ -1705,8 +1703,8 @@ void ieee80211_rx_mgt(struct ieee80211_device *ieee,
                                      WLAN_FC_GET_STYPE(le16_to_cpu
                                                        (header->frame_ctl)));
 
-                IEEE80211_WARNING("%s: IEEE80211_ASSOC_REQ received\n",
-                                  ieee->dev->name);
+                IEEE80211_DEBUG_MGMT("%s: IEEE80211_ASSOC_REQ received\n",
+                                     ieee->dev->name);
                 if (ieee->handle_assoc_request != NULL)
                         ieee->handle_assoc_request(ieee->dev);
                 break;
@@ -1722,10 +1720,10 @@ void ieee80211_rx_mgt(struct ieee80211_device *ieee,
                 IEEE80211_DEBUG_MGMT("received UNKNOWN (%d)\n",
                                      WLAN_FC_GET_STYPE(le16_to_cpu
                                                        (header->frame_ctl)));
-                IEEE80211_WARNING("%s: Unknown management packet: %d\n",
-                                  ieee->dev->name,
-                                  WLAN_FC_GET_STYPE(le16_to_cpu
-                                                    (header->frame_ctl)));
+                IEEE80211_DEBUG_MGMT("%s: Unknown management packet: %d\n",
+                                     ieee->dev->name,
+                                     WLAN_FC_GET_STYPE(le16_to_cpu
+                                                       (header->frame_ctl)));
                 break;
         }
 }
diff --git a/net/ieee80211/ieee80211_tx.c b/net/ieee80211/ieee80211_tx.c
index 8b4332f53394..6a5de1b84459 100644
--- a/net/ieee80211/ieee80211_tx.c
+++ b/net/ieee80211/ieee80211_tx.c
@@ -220,13 +220,43 @@ static struct ieee80211_txb *ieee80211_alloc_txb(int nr_frags, int txb_size,
         return txb;
 }
 
+static int ieee80211_classify(struct sk_buff *skb)
+{
+        struct ethhdr *eth;
+        struct iphdr *ip;
+
+        eth = (struct ethhdr *)skb->data;
+        if (eth->h_proto != __constant_htons(ETH_P_IP))
+                return 0;
+
+        ip = skb->nh.iph;
+        switch (ip->tos & 0xfc) {
+        case 0x20:
+                return 2;
+        case 0x40:
+                return 1;
+        case 0x60:
+                return 3;
+        case 0x80:
+                return 4;
+        case 0xa0:
+                return 5;
+        case 0xc0:
+                return 6;
+        case 0xe0:
+                return 7;
+        default:
+                return 0;
+        }
+}
+
 /* Incoming skb is converted to a txb which consists of
  * a block of 802.11 fragment packets (stored as skbs) */
 int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ieee80211_device *ieee = netdev_priv(dev);
         struct ieee80211_txb *txb = NULL;
-        struct ieee80211_hdr_3addr *frag_hdr;
+        struct ieee80211_hdr_3addrqos *frag_hdr;
         int i, bytes_per_frag, nr_frags, bytes_last_frag, frag_size,
             rts_required;
         unsigned long flags;
@@ -234,9 +264,10 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
         int ether_type, encrypt, host_encrypt, host_encrypt_msdu, host_build_iv;
         int bytes, fc, hdr_len;
         struct sk_buff *skb_frag;
-        struct ieee80211_hdr_3addr header = {   /* Ensure zero initialized */
+        struct ieee80211_hdr_3addrqos header = {/* Ensure zero initialized */
                 .duration_id = 0,
-                .seq_ctl = 0
+                .seq_ctl = 0,
+                .qos_ctl = 0
         };
         u8 dest[ETH_ALEN], src[ETH_ALEN];
         struct ieee80211_crypt_data *crypt;
@@ -282,12 +313,6 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
         memcpy(dest, skb->data, ETH_ALEN);
         memcpy(src, skb->data + ETH_ALEN, ETH_ALEN);
 
-        /* Advance the SKB to the start of the payload */
-        skb_pull(skb, sizeof(struct ethhdr));
-
-        /* Determine total amount of storage required for TXB packets */
-        bytes = skb->len + SNAP_SIZE + sizeof(u16);
-
         if (host_encrypt || host_build_iv)
                 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
                     IEEE80211_FCTL_PROTECTED;
@@ -306,9 +331,23 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
                 memcpy(header.addr2, src, ETH_ALEN);
                 memcpy(header.addr3, ieee->bssid, ETH_ALEN);
         }
-        header.frame_ctl = cpu_to_le16(fc);
         hdr_len = IEEE80211_3ADDR_LEN;
 
+        if (ieee->is_qos_active && ieee->is_qos_active(dev, skb)) {
+                fc |= IEEE80211_STYPE_QOS_DATA;
+                hdr_len += 2;
+
+                skb->priority = ieee80211_classify(skb);
+                header.qos_ctl |= skb->priority & IEEE80211_QCTL_TID;
+        }
+        header.frame_ctl = cpu_to_le16(fc);
+
+        /* Advance the SKB to the start of the payload */
+        skb_pull(skb, sizeof(struct ethhdr));
+
+        /* Determine total amount of storage required for TXB packets */
+        bytes = skb->len + SNAP_SIZE + sizeof(u16);
+
         /* Encrypt msdu first on the whole data packet. */
         if ((host_encrypt || host_encrypt_msdu) &&
             crypt && crypt->ops && crypt->ops->encrypt_msdu) {
@@ -402,7 +441,7 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
         if (rts_required) {
                 skb_frag = txb->fragments[0];
                 frag_hdr =
-                    (struct ieee80211_hdr_3addr *)skb_put(skb_frag, hdr_len);
+                    (struct ieee80211_hdr_3addrqos *)skb_put(skb_frag, hdr_len);
 
                 /*
                  * Set header frame_ctl to the RTS.
@@ -433,7 +472,7 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
                                     crypt->ops->extra_mpdu_prefix_len);
 
                 frag_hdr =
-                    (struct ieee80211_hdr_3addr *)skb_put(skb_frag, hdr_len);
+                    (struct ieee80211_hdr_3addrqos *)skb_put(skb_frag, hdr_len);
                 memcpy(frag_hdr, &header, hdr_len);
 
                 /* If this is not the last fragment, then add the MOREFRAGS
@@ -516,7 +555,8 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
 /* Incoming 802.11 strucure is converted to a TXB
  * a block of 802.11 fragment packets (stored as skbs) */
 int ieee80211_tx_frame(struct ieee80211_device *ieee,
-                       struct ieee80211_hdr *frame, int len)
+                       struct ieee80211_hdr *frame, int hdr_len, int total_len,
+                       int encrypt_mpdu)
 {
         struct ieee80211_txb *txb = NULL;
         unsigned long flags;
@@ -526,6 +566,9 @@ int ieee80211_tx_frame(struct ieee80211_device *ieee,
 
         spin_lock_irqsave(&ieee->lock, flags);
 
+        if (encrypt_mpdu && !ieee->sec.encrypt)
+                encrypt_mpdu = 0;
+
         /* If there is no driver handler to take the TXB, dont' bother
          * creating it... */
         if (!ieee->hard_start_xmit) {
@@ -533,32 +576,41 @@ int ieee80211_tx_frame(struct ieee80211_device *ieee,
                 goto success;
         }
 
-        if (unlikely(len < 24)) {
+        if (unlikely(total_len < 24)) {
                 printk(KERN_WARNING "%s: skb too small (%d).\n",
-                       ieee->dev->name, len);
+                       ieee->dev->name, total_len);
                 goto success;
         }
 
+        if (encrypt_mpdu)
+                frame->frame_ctl |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+
         /* When we allocate the TXB we allocate enough space for the reserve
          * and full fragment bytes (bytes_per_frag doesn't include prefix,
          * postfix, header, FCS, etc.) */
-        txb = ieee80211_alloc_txb(1, len, ieee->tx_headroom, GFP_ATOMIC);
+        txb = ieee80211_alloc_txb(1, total_len, ieee->tx_headroom, GFP_ATOMIC);
         if (unlikely(!txb)) {
                 printk(KERN_WARNING "%s: Could not allocate TXB\n",
                        ieee->dev->name);
                 goto failed;
         }
         txb->encrypted = 0;
-        txb->payload_size = len;
+        txb->payload_size = total_len;
 
         skb_frag = txb->fragments[0];
 
-        memcpy(skb_put(skb_frag, len), frame, len);
+        memcpy(skb_put(skb_frag, total_len), frame, total_len);
 
         if (ieee->config &
             (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
                 skb_put(skb_frag, 4);
 
+        /* To avoid overcomplicating things, we do the corner-case frame
+         * encryption in software. The only real situation where encryption is
+         * needed here is during software-based shared key authentication. */
+        if (encrypt_mpdu)
+                ieee80211_encrypt_fragment(ieee, skb_frag, hdr_len);
+
       success:
         spin_unlock_irqrestore(&ieee->lock, flags);
 
diff --git a/net/ieee80211/ieee80211_wx.c b/net/ieee80211/ieee80211_wx.c
index b885fd189403..a78c4f845f66 100644
--- a/net/ieee80211/ieee80211_wx.c
+++ b/net/ieee80211/ieee80211_wx.c
@@ -50,7 +50,8 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
         char *p;
         struct iw_event iwe;
         int i, j;
-        u8 max_rate, rate;
+        char *current_val;      /* For rates */
+        u8 rate;
 
         /* First entry *MUST* be the AP MAC address */
         iwe.cmd = SIOCGIWAP;
@@ -107,9 +108,13 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
         start = iwe_stream_add_point(start, stop, &iwe, network->ssid);
 
         /* Add basic and extended rates */
-        max_rate = 0;
-        p = custom;
-        p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
+        /* Rate : stuffing multiple values in a single event require a bit
+         * more of magic - Jean II */
+        current_val = start + IW_EV_LCP_LEN;
+        iwe.cmd = SIOCGIWRATE;
+        /* Those two flags are ignored... */
+        iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+
         for (i = 0, j = 0; i < network->rates_len;) {
                 if (j < network->rates_ex_len &&
                     ((network->rates_ex[j] & 0x7F) <
@@ -117,28 +122,21 @@ static char *ieee80211_translate_scan(struct ieee80211_device *ieee,
                         rate = network->rates_ex[j++] & 0x7F;
                 else
                         rate = network->rates[i++] & 0x7F;
-                if (rate > max_rate)
-                        max_rate = rate;
-                p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
-                              "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
+                /* Bit rate given in 500 kb/s units (+ 0x80) */
+                iwe.u.bitrate.value = ((rate & 0x7f) * 500000);
+                /* Add new value to event */
+                current_val = iwe_stream_add_value(start, current_val, stop, &iwe, IW_EV_PARAM_LEN);
         }
         for (; j < network->rates_ex_len; j++) {
                 rate = network->rates_ex[j] & 0x7F;
-                p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
-                              "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
-                if (rate > max_rate)
-                        max_rate = rate;
+                /* Bit rate given in 500 kb/s units (+ 0x80) */
+                iwe.u.bitrate.value = ((rate & 0x7f) * 500000);
+                /* Add new value to event */
+                current_val = iwe_stream_add_value(start, current_val, stop, &iwe, IW_EV_PARAM_LEN);
         }
-
-        iwe.cmd = SIOCGIWRATE;
-        iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
-        iwe.u.bitrate.value = max_rate * 500000;
-        start = iwe_stream_add_event(start, stop, &iwe, IW_EV_PARAM_LEN);
-
-        iwe.cmd = IWEVCUSTOM;
-        iwe.u.data.length = p - custom;
-        if (iwe.u.data.length)
-                start = iwe_stream_add_point(start, stop, &iwe, custom);
+        /* Check if we added any rate */
+        if((current_val - start) > IW_EV_LCP_LEN)
+                start = current_val;
 
         /* Add quality statistics */
         iwe.cmd = IWEVQUAL;
@@ -505,7 +503,7 @@ int ieee80211_wx_get_encode(struct ieee80211_device *ieee,
         len = sec->key_sizes[key];
         memcpy(keybuf, sec->keys[key], len);
 
-        erq->length = (len >= 0 ? len : 0);
+        erq->length = len;
         erq->flags |= IW_ENCODE_ENABLED;
 
         if (ieee->open_wep)
diff --git a/net/ieee80211/softmac/Kconfig b/net/ieee80211/softmac/Kconfig
index f2a27cc6ecb1..2811651cb134 100644
--- a/net/ieee80211/softmac/Kconfig
+++ b/net/ieee80211/softmac/Kconfig
@@ -2,6 +2,7 @@ config IEEE80211_SOFTMAC
         tristate "Software MAC add-on to the IEEE 802.11 networking stack"
         depends on IEEE80211 && EXPERIMENTAL
         select WIRELESS_EXT
+        select IEEE80211_CRYPT_WEP
         ---help---
         This option enables the hardware independent software MAC addon
         for the IEEE 802.11 networking stack.
diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c
index 57ea9f6f465c..5e9a90651d04 100644
--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
+++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
@@ -82,51 +82,52 @@ ieee80211softmac_assoc_timeout(void *d)
         ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_TIMEOUT, NULL);
 }
 
-/* Sends out a disassociation request to the desired AP */
-static void
-ieee80211softmac_disassoc(struct ieee80211softmac_device *mac, u16 reason)
+void
+ieee80211softmac_disassoc(struct ieee80211softmac_device *mac)
 {
         unsigned long flags;
+
+        spin_lock_irqsave(&mac->lock, flags);
+        if (mac->associnfo.associating)
+                cancel_delayed_work(&mac->associnfo.timeout);
+
+        netif_carrier_off(mac->dev);
+
+        mac->associated = 0;
+        mac->associnfo.bssvalid = 0;
+        mac->associnfo.associating = 0;
+        ieee80211softmac_init_txrates(mac);
+        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
+        spin_unlock_irqrestore(&mac->lock, flags);
+}
+
+/* Sends out a disassociation request to the desired AP */
+void
+ieee80211softmac_send_disassoc_req(struct ieee80211softmac_device *mac, u16 reason)
+{
         struct ieee80211softmac_network *found;
 
         if (mac->associnfo.bssvalid && mac->associated) {
                 found = ieee80211softmac_get_network_by_bssid(mac, mac->associnfo.bssid);
                 if (found)
                         ieee80211softmac_send_mgt_frame(mac, found, IEEE80211_STYPE_DISASSOC, reason);
-        } else if (mac->associnfo.associating) {
-                cancel_delayed_work(&mac->associnfo.timeout);
         }
 
-        /* Change our state */
-        spin_lock_irqsave(&mac->lock, flags);
-        /* Do NOT clear bssvalid as that will break ieee80211softmac_assoc_work! */
-        mac->associated = 0;
-        mac->associnfo.associating = 0;
-        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
-        spin_unlock_irqrestore(&mac->lock, flags);
+        ieee80211softmac_disassoc(mac);
 }
 
 static inline int
 we_support_all_basic_rates(struct ieee80211softmac_device *mac, u8 *from, u8 from_len)
 {
-        int idx, search, found;
-        u8 rate, search_rate;
+        int idx;
+        u8 rate;
 
         for (idx = 0; idx < (from_len); idx++) {
                 rate = (from)[idx];
                 if (!(rate & IEEE80211_BASIC_RATE_MASK))
                         continue;
-                found = 0;
                 rate &= ~IEEE80211_BASIC_RATE_MASK;
-                for (search = 0; search < mac->ratesinfo.count; search++) {
-                        search_rate = mac->ratesinfo.rates[search];
-                        search_rate &= ~IEEE80211_BASIC_RATE_MASK;
-                        if (rate == search_rate) {
-                                found = 1;
-                                break;
-                        }
-                }
-                if (!found)
+                if (!ieee80211softmac_ratesinfo_rate_supported(&mac->ratesinfo, rate))
                         return 0;
         }
         return 1;
@@ -163,12 +164,28 @@ network_matches_request(struct ieee80211softmac_device *mac, struct ieee80211_ne
 }
 
 static void
-ieee80211softmac_assoc_notify(struct net_device *dev, void *context)
+ieee80211softmac_assoc_notify_scan(struct net_device *dev, int event_type, void *context)
 {
         struct ieee80211softmac_device *mac = ieee80211_priv(dev);
         ieee80211softmac_assoc_work((void*)mac);
 }
 
+static void
+ieee80211softmac_assoc_notify_auth(struct net_device *dev, int event_type, void *context)
+{
+        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
+
+        switch (event_type) {
+        case IEEE80211SOFTMAC_EVENT_AUTHENTICATED:
+                ieee80211softmac_assoc_work((void*)mac);
+                break;
+        case IEEE80211SOFTMAC_EVENT_AUTH_FAILED:
+        case IEEE80211SOFTMAC_EVENT_AUTH_TIMEOUT:
+                ieee80211softmac_disassoc(mac);
+                break;
+        }
+}
+
 /* This function is called to handle userspace requests (asynchronously) */
 void
 ieee80211softmac_assoc_work(void *d)
@@ -176,14 +193,18 @@ ieee80211softmac_assoc_work(void *d)
         struct ieee80211softmac_device *mac = (struct ieee80211softmac_device *)d;
         struct ieee80211softmac_network *found = NULL;
         struct ieee80211_network *net = NULL, *best = NULL;
+        int bssvalid;
         unsigned long flags;
-        
+
+        /* ieee80211_disassoc might clear this */
+        bssvalid = mac->associnfo.bssvalid;
+
         /* meh */
         if (mac->associated)
-                ieee80211softmac_disassoc(mac, WLAN_REASON_DISASSOC_STA_HAS_LEFT);
+                ieee80211softmac_send_disassoc_req(mac, WLAN_REASON_DISASSOC_STA_HAS_LEFT);
 
         /* try to find the requested network in our list, if we found one already */
-        if (mac->associnfo.bssvalid || mac->associnfo.bssfixed)
+        if (bssvalid || mac->associnfo.bssfixed)
                 found = ieee80211softmac_get_network_by_bssid(mac, mac->associnfo.bssid);       
         
         /* Search the ieee80211 networks for this network if we didn't find it by bssid,
@@ -244,7 +265,7 @@ ieee80211softmac_assoc_work(void *d)
                          * Maybe we can hope to have more memory after scanning finishes ;)
                          */
                         dprintk(KERN_INFO PFX "Associate: Scanning for networks first.\n");
-                        ieee80211softmac_notify(mac->dev, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, ieee80211softmac_assoc_notify, NULL);
+                        ieee80211softmac_notify(mac->dev, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, ieee80211softmac_assoc_notify_scan, NULL);
                         if (ieee80211softmac_start_scan(mac))
                                 dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n");
                         return;
@@ -279,7 +300,7 @@ ieee80211softmac_assoc_work(void *d)
                  * otherwise adding the notification would be racy. */
                 if (!ieee80211softmac_auth_req(mac, found)) {
                         dprintk(KERN_INFO PFX "cannot associate without being authenticated, requested authentication\n");
-                        ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify, NULL, GFP_KERNEL);
+                        ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify_auth, NULL, GFP_KERNEL);
                 } else {
                         printkl(KERN_WARNING PFX "Not authenticated, but requesting authentication failed. Giving up to associate\n");
                         ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_FAILED, found);
@@ -297,6 +318,9 @@ ieee80211softmac_associated(struct ieee80211softmac_device *mac,
         struct ieee80211softmac_network *net)
 {
         mac->associnfo.associating = 0;
+        mac->associnfo.supported_rates = net->supported_rates;
+        ieee80211softmac_recalc_txrates(mac);
+
         mac->associated = 1;
         if (mac->set_bssid_filter)
                 mac->set_bssid_filter(mac->dev, net->bssid);
@@ -380,7 +404,6 @@ ieee80211softmac_handle_disassoc(struct net_device * dev,
                                  struct ieee80211_disassoc *disassoc)
 {
         struct ieee80211softmac_device *mac = ieee80211_priv(dev);
-        unsigned long flags;
 
         if (unlikely(!mac->running))
                 return -ENODEV;
@@ -392,14 +415,11 @@ ieee80211softmac_handle_disassoc(struct net_device * dev,
                 return 0;
 
         dprintk(KERN_INFO PFX "got disassoc frame\n");
-        netif_carrier_off(dev);
-        spin_lock_irqsave(&mac->lock, flags);
-        mac->associnfo.bssvalid = 0;
-        mac->associated = 0;
-        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
+        ieee80211softmac_disassoc(mac);
+
+        /* try to reassociate */
         schedule_work(&mac->associnfo.work);
-        spin_unlock_irqrestore(&mac->lock, flags);
-        
+
         return 0;
 }
 
diff --git a/net/ieee80211/softmac/ieee80211softmac_auth.c b/net/ieee80211/softmac/ieee80211softmac_auth.c
index 06e332624665..90b8484e509b 100644
--- a/net/ieee80211/softmac/ieee80211softmac_auth.c
+++ b/net/ieee80211/softmac/ieee80211softmac_auth.c
@@ -107,6 +107,7 @@ ieee80211softmac_auth_queue(void *data)
         printkl(KERN_WARNING PFX "Authentication timed out with "MAC_FMT"\n", MAC_ARG(net->bssid));
         /* Remove this item from the queue */
         spin_lock_irqsave(&mac->lock, flags);
+        net->authenticating = 0;
         ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_AUTH_TIMEOUT, net);
         cancel_delayed_work(&auth->work); /* just to make sure... */
         list_del(&auth->list);
@@ -212,13 +213,13 @@ ieee80211softmac_auth_resp(struct net_device *dev, struct ieee80211_auth *auth)
                         aq->state = IEEE80211SOFTMAC_AUTH_SHARED_RESPONSE; 
                         spin_unlock_irqrestore(&mac->lock, flags);
 
-                        /* Switch to correct channel for this network */
-                        mac->set_channel(mac->dev, net->channel);
-                        
-                        /* Send our response (How to encrypt?) */
+                        /* Send our response */
                         ieee80211softmac_send_mgt_frame(mac, aq->net, IEEE80211_STYPE_AUTH, aq->state);
-                        break;
+                        return 0;
                 case IEEE80211SOFTMAC_AUTH_SHARED_PASS:
+                        kfree(net->challenge);
+                        net->challenge = NULL;
+                        net->challenge_len = 0;
                         /* Check the status code of the response */
                         switch(auth->status) {
                         case WLAN_STATUS_SUCCESS:
@@ -229,6 +230,7 @@ ieee80211softmac_auth_resp(struct net_device *dev, struct ieee80211_auth *auth)
                                 spin_unlock_irqrestore(&mac->lock, flags);
                                 printkl(KERN_NOTICE PFX "Shared Key Authentication completed with "MAC_FMT"\n", 
                                         MAC_ARG(net->bssid));
+                                ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_AUTHENTICATED, net);
                                 break;
                         default:
                                 printkl(KERN_NOTICE PFX "Shared Key Authentication with "MAC_FMT" failed, error code: %i\n", 
@@ -279,6 +281,9 @@ ieee80211softmac_deauth_from_net(struct ieee80211softmac_device *mac,
         struct list_head *list_ptr;
         unsigned long flags;
 
+        /* deauthentication implies disassociation */
+        ieee80211softmac_disassoc(mac);
+
         /* Lock and reset status flags */
         spin_lock_irqsave(&mac->lock, flags);
         net->authenticating = 0;
diff --git a/net/ieee80211/softmac/ieee80211softmac_event.c b/net/ieee80211/softmac/ieee80211softmac_event.c
index 8cc8f3f0f8e7..f34fa2ef666b 100644
--- a/net/ieee80211/softmac/ieee80211softmac_event.c
+++ b/net/ieee80211/softmac/ieee80211softmac_event.c
@@ -38,7 +38,8 @@
  * The event context is private and can only be used from
  * within this module. Its meaning varies with the event
  * type:
- *  SCAN_FINISHED:      no special meaning
+ *  SCAN_FINISHED,
+ *  DISASSOCIATED:      NULL
  *  ASSOCIATED,
  *  ASSOCIATE_FAILED,
  *  ASSOCIATE_TIMEOUT,
@@ -59,15 +60,15 @@
  */
 
 static char *event_descriptions[IEEE80211SOFTMAC_EVENT_LAST+1] = {
-        "scan finished",
-        "associated",
+        NULL, /* scan finished */
+        NULL, /* associated */
         "associating failed",
         "associating timed out",
         "authenticated",
         "authenticating failed",
         "authenticating timed out",
         "associating failed because no suitable network was found",
-        "disassociated",
+        NULL, /* disassociated */
 };
 
 
@@ -77,7 +78,7 @@ ieee80211softmac_notify_callback(void *d)
         struct ieee80211softmac_event event = *(struct ieee80211softmac_event*) d;
         kfree(d);
         
-        event.fun(event.mac->dev, event.context);
+        event.fun(event.mac->dev, event.event_type, event.context);
 }
 
 int
@@ -136,30 +137,24 @@ ieee80211softmac_call_events_locked(struct ieee80211softmac_device *mac, int eve
                 int we_event;
                 char *msg = NULL;
 
+                memset(&wrqu, '\0', sizeof (union iwreq_data));
+
                 switch(event) {
                 case IEEE80211SOFTMAC_EVENT_ASSOCIATED:
                         network = (struct ieee80211softmac_network *)event_ctx;
-                        wrqu.data.length = 0;
-                        wrqu.data.flags = 0;
                         memcpy(wrqu.ap_addr.sa_data, &network->bssid[0], ETH_ALEN);
-                        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-                        we_event = SIOCGIWAP;
-                        break;
+                        /* fall through */
                 case IEEE80211SOFTMAC_EVENT_DISASSOCIATED:
-                        wrqu.data.length = 0;
-                        wrqu.data.flags = 0;
-                        memset(&wrqu, '\0', sizeof (union iwreq_data));
                         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
                         we_event = SIOCGIWAP;
                         break;
                 case IEEE80211SOFTMAC_EVENT_SCAN_FINISHED:
-                        wrqu.data.length = 0;
-                        wrqu.data.flags = 0;
-                        memset(&wrqu, '\0', sizeof (union iwreq_data));
                         we_event = SIOCGIWSCAN;
                         break;
                 default:
                         msg = event_descriptions[event];
+                        if (!msg)
+                                msg = "SOFTMAC EVENT BUG";
                         wrqu.data.length = strlen(msg);
                         we_event = IWEVCUSTOM;
                         break;
@@ -172,6 +167,9 @@ ieee80211softmac_call_events_locked(struct ieee80211softmac_device *mac, int eve
                         if ((eventptr->event_type == event || eventptr->event_type == -1)
                                 && (eventptr->event_context == NULL || eventptr->event_context == event_ctx)) {
                                 list_del(&eventptr->list);
+                                /* User may have subscribed to ANY event, so
+                                 * we tell them which event triggered it. */
+                                eventptr->event_type = event;
                                 schedule_work(&eventptr->work);
                         }
                 }
diff --git a/net/ieee80211/softmac/ieee80211softmac_io.c b/net/ieee80211/softmac/ieee80211softmac_io.c
index cc6cd56c85b1..09541611e48c 100644
--- a/net/ieee80211/softmac/ieee80211softmac_io.c
+++ b/net/ieee80211/softmac/ieee80211softmac_io.c
@@ -149,6 +149,56 @@ ieee80211softmac_hdr_3addr(struct ieee80211softmac_device *mac,
          * shouldn't the sequence number be in ieee80211? */
 }
 
+static u16
+ieee80211softmac_capabilities(struct ieee80211softmac_device *mac,
+        struct ieee80211softmac_network *net)
+{
+        u16 capability = 0;
+
+        /* ESS and IBSS bits are set according to the current mode */
+        switch (mac->ieee->iw_mode) {
+        case IW_MODE_INFRA:
+                capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
+                break;
+        case IW_MODE_ADHOC:
+                capability = cpu_to_le16(WLAN_CAPABILITY_IBSS);
+                break;
+        case IW_MODE_AUTO:
+                capability = net->capabilities &
+                        (WLAN_CAPABILITY_ESS|WLAN_CAPABILITY_IBSS);
+                break;
+        default:
+                /* bleh. we don't ever go to these modes */
+                printk(KERN_ERR PFX "invalid iw_mode!\n");
+                break;
+        }
+
+        /* CF Pollable / CF Poll Request */
+        /* Needs to be implemented, for now, the 0's == not supported */
+
+        /* Privacy Bit */
+        capability |= mac->ieee->sec.level ?
+                cpu_to_le16(WLAN_CAPABILITY_PRIVACY) : 0;
+
+        /* Short Preamble */
+        /* Always supported: we probably won't ever be powering devices which
+         * dont support this... */
+        capability |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+
+        /* PBCC */
+        /* Not widely used */
+
+        /* Channel Agility */
+        /* Not widely used */
+
+        /* Short Slot */
+        /* Will be implemented later */
+
+        /* DSSS-OFDM */
+        /* Not widely used */
+
+        return capability;
+}
 
 /*****************************************************************************
  * Create Management packets
@@ -179,27 +229,6 @@ ieee80211softmac_assoc_req(struct ieee80211_assoc_request **pkt,
                 return 0;
         ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_ASSOC_REQ, net->bssid, net->bssid);
 
-        /* Fill in capability Info */
-        switch (mac->ieee->iw_mode) {
-        case IW_MODE_INFRA:
-                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
-                break;
-        case IW_MODE_ADHOC:
-                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_IBSS);
-                break;
-        case IW_MODE_AUTO:
-                (*pkt)->capability = net->capabilities & (WLAN_CAPABILITY_ESS|WLAN_CAPABILITY_IBSS);
-                break;
-        default:
-                /* bleh. we don't ever go to these modes */
-                printk(KERN_ERR PFX "invalid iw_mode!\n");
-                break;
-        }
-        /* Need to add this
-        (*pkt)->capability |= mac->ieee->short_slot ? 
-                        cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME) : 0;
-         */
-        (*pkt)->capability |= mac->ieee->sec.level ? cpu_to_le16(WLAN_CAPABILITY_PRIVACY) : 0;
         /* Fill in Listen Interval (?) */
         (*pkt)->listen_interval = cpu_to_le16(10);
         
@@ -239,17 +268,9 @@ ieee80211softmac_reassoc_req(struct ieee80211_reassoc_request **pkt,
                 return 0;
         ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_REASSOC_REQ, net->bssid, net->bssid);
 
-        /* Fill in capability Info */
-        (*pkt)->capability = mac->ieee->iw_mode == IW_MODE_MASTER ? 
-                                cpu_to_le16(WLAN_CAPABILITY_ESS) :
-                                cpu_to_le16(WLAN_CAPABILITY_IBSS);
-        /*
-        (*pkt)->capability |= mac->ieee->short_slot ? 
-                        cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME) : 0;
-         */
-        (*pkt)->capability |= mac->ieee->sec.level ?
-                        cpu_to_le16(WLAN_CAPABILITY_PRIVACY) : 0;
-                
+        /* Fill in the capabilities */
+        (*pkt)->capability = ieee80211softmac_capabilities(mac, net);
+
         /* Fill in Listen Interval (?) */
         (*pkt)->listen_interval = cpu_to_le16(10);
         /* Fill in the current AP MAC */
@@ -268,26 +289,27 @@ ieee80211softmac_reassoc_req(struct ieee80211_reassoc_request **pkt,
 static u32
 ieee80211softmac_auth(struct ieee80211_auth **pkt, 
         struct ieee80211softmac_device *mac, struct ieee80211softmac_network *net,
-        u16 transaction, u16 status)
+        u16 transaction, u16 status, int *encrypt_mpdu)
 {
         u8 *data;
+        int auth_mode = mac->ieee->sec.auth_mode;
+        int is_shared_response = (auth_mode == WLAN_AUTH_SHARED_KEY
+                && transaction == IEEE80211SOFTMAC_AUTH_SHARED_RESPONSE);
+
         /* Allocate Packet */
         (*pkt) = (struct ieee80211_auth *)ieee80211softmac_alloc_mgt(
                 2 +             /* Auth Algorithm */
                 2 +             /* Auth Transaction Seq */
                 2 +             /* Status Code */
                  /* Challenge Text IE */
-                mac->ieee->open_wep ? 0 : 
-                1 + 1 + WLAN_AUTH_CHALLENGE_LEN
-        );      
+                is_shared_response ? 0 : 1 + 1 + net->challenge_len
+        );
         if (unlikely((*pkt) == NULL))
                 return 0;
         ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_AUTH, net->bssid, net->bssid);
                 
         /* Algorithm */
-        (*pkt)->algorithm = mac->ieee->open_wep ? 
-                cpu_to_le16(WLAN_AUTH_OPEN) :
-                cpu_to_le16(WLAN_AUTH_SHARED_KEY);
+        (*pkt)->algorithm = cpu_to_le16(auth_mode);
         /* Transaction */
         (*pkt)->transaction = cpu_to_le16(transaction);
         /* Status */
@@ -295,18 +317,20 @@ ieee80211softmac_auth(struct ieee80211_auth **pkt,
         
         data = (u8 *)(*pkt)->info_element;
         /* Challenge Text */
-        if(!mac->ieee->open_wep){
+        if (is_shared_response) {
                 *data = MFIE_TYPE_CHALLENGE;
                 data++;
                 
                 /* Copy the challenge in */
-                // *data = challenge length
-                // data += sizeof(u16);
-                // memcpy(data, challenge, challenge length);
-                // data += challenge length;
-                
-                /* Add the full size to the packet length */
-        }
+                *data = net->challenge_len;
+                data++;
+                memcpy(data, net->challenge, net->challenge_len);
+                data += net->challenge_len;
+
+                /* Make sure this frame gets encrypted with the shared key */
+                *encrypt_mpdu = 1;
+        } else
+                *encrypt_mpdu = 0;
 
         /* Return the packet size */
         return (data - (u8 *)(*pkt));
@@ -396,6 +420,7 @@ ieee80211softmac_send_mgt_frame(struct ieee80211softmac_device *mac,
 {
         void *pkt = NULL;
         u32 pkt_size = 0;
+        int encrypt_mpdu = 0;
 
         switch(type) {
         case IEEE80211_STYPE_ASSOC_REQ:
@@ -405,7 +430,7 @@ ieee80211softmac_send_mgt_frame(struct ieee80211softmac_device *mac,
                 pkt_size = ieee80211softmac_reassoc_req((struct ieee80211_reassoc_request **)(&pkt), mac, (struct ieee80211softmac_network *)ptrarg);
                 break;
         case IEEE80211_STYPE_AUTH:
-                pkt_size = ieee80211softmac_auth((struct ieee80211_auth **)(&pkt), mac, (struct ieee80211softmac_network *)ptrarg, (u16)(arg & 0xFFFF), (u16) (arg >> 16));
+                pkt_size = ieee80211softmac_auth((struct ieee80211_auth **)(&pkt), mac, (struct ieee80211softmac_network *)ptrarg, (u16)(arg & 0xFFFF), (u16) (arg >> 16), &encrypt_mpdu);
                 break;
         case IEEE80211_STYPE_DISASSOC:
         case IEEE80211_STYPE_DEAUTH:
@@ -434,52 +459,8 @@ ieee80211softmac_send_mgt_frame(struct ieee80211softmac_device *mac,
          * or get rid of it alltogether?
          * Does this work for you now?
          */
-        ieee80211_tx_frame(mac->ieee, (struct ieee80211_hdr *)pkt, pkt_size);
-
-        kfree(pkt);
-        return 0;
-}
-
-
-/* Create an rts/cts frame */
-static u32
-ieee80211softmac_rts_cts(struct ieee80211_hdr_2addr **pkt,
-        struct ieee80211softmac_device *mac, struct ieee80211softmac_network *net, 
-        u32 type)
-{
-        /* Allocate Packet */
-        (*pkt) = kmalloc(IEEE80211_2ADDR_LEN, GFP_ATOMIC);      
-        memset(*pkt, 0, IEEE80211_2ADDR_LEN);
-        if((*pkt) == NULL)
-                return 0;
-        ieee80211softmac_hdr_2addr(mac, (*pkt), type, net->bssid);
-        return IEEE80211_2ADDR_LEN;
-}
-
-
-/* Sends a control packet */
-static int
-ieee80211softmac_send_ctl_frame(struct ieee80211softmac_device *mac,
-        struct ieee80211softmac_network *net, u32 type, u32 arg)
-{
-        void *pkt = NULL;
-        u32 pkt_size = 0;
-        
-        switch(type) {
-        case IEEE80211_STYPE_RTS:
-        case IEEE80211_STYPE_CTS:
-                pkt_size = ieee80211softmac_rts_cts((struct ieee80211_hdr_2addr **)(&pkt), mac, net, type);
-                break;
-        default:
-                printkl(KERN_DEBUG PFX "Unsupported Control Frame type: %i\n", type);
-                return -EINVAL;
-        }
-
-        if(pkt_size == 0)
-                return -ENOMEM;
-        
-        /* Send the packet to the ieee80211 layer for tx */
-        ieee80211_tx_frame(mac->ieee, (struct ieee80211_hdr *) pkt, pkt_size);
+        ieee80211_tx_frame(mac->ieee, (struct ieee80211_hdr *)pkt,
+                IEEE80211_3ADDR_LEN, pkt_size, encrypt_mpdu);
 
         kfree(pkt);
         return 0;
diff --git a/net/ieee80211/softmac/ieee80211softmac_module.c b/net/ieee80211/softmac/ieee80211softmac_module.c
index 6252be2c0db9..4b2e57d12418 100644
--- a/net/ieee80211/softmac/ieee80211softmac_module.c
+++ b/net/ieee80211/softmac/ieee80211softmac_module.c
@@ -26,6 +26,7 @@
 
 #include "ieee80211softmac_priv.h"
 #include <linux/sort.h>
+#include <linux/etherdevice.h>
 
 struct net_device *alloc_ieee80211softmac(int sizeof_priv)
 {
@@ -61,14 +62,6 @@ struct net_device *alloc_ieee80211softmac(int sizeof_priv)
         softmac->wait_for_scan = ieee80211softmac_wait_for_scan_implementation;
         softmac->stop_scan = ieee80211softmac_stop_scan_implementation;
 
-        //TODO: The mcast rate has to be assigned dynamically somewhere (in scanning, association. Not sure...)
-        //      It has to be set to the highest rate all stations in the current network can handle.
-        softmac->txrates.mcast_rate = IEEE80211_CCK_RATE_1MB;
-        softmac->txrates.mcast_fallback = IEEE80211_CCK_RATE_1MB;
-        /* This is reassigned in ieee80211softmac_start to sane values. */
-        softmac->txrates.default_rate = IEEE80211_CCK_RATE_1MB;
-        softmac->txrates.default_fallback = IEEE80211_CCK_RATE_1MB;
-
         /* to start with, we can't send anything ... */
         netif_carrier_off(dev);
         
@@ -170,15 +163,82 @@ static void ieee80211softmac_start_check_rates(struct ieee80211softmac_device *m
         }
 }
 
-void ieee80211softmac_start(struct net_device *dev)
+int ieee80211softmac_ratesinfo_rate_supported(struct ieee80211softmac_ratesinfo *ri, u8 rate)
+{
+        int search;
+        u8 search_rate;
+
+        for (search = 0; search < ri->count; search++) {
+                search_rate = ri->rates[search];
+                search_rate &= ~IEEE80211_BASIC_RATE_MASK;
+                if (rate == search_rate)
+                        return 1;
+        }
+
+        return 0;
+}
+
+/* Finds the highest rate which is:
+ *  1. Present in ri (optionally a basic rate)
+ *  2. Supported by the device
+ *  3. Less than or equal to the user-defined rate
+ */
+static u8 highest_supported_rate(struct ieee80211softmac_device *mac,
+        struct ieee80211softmac_ratesinfo *ri, int basic_only)
+{
+        u8 user_rate = mac->txrates.user_rate;
+        int i;
+
+        if (ri->count == 0) {
+                dprintk(KERN_ERR PFX "empty ratesinfo?\n");
+                return IEEE80211_CCK_RATE_1MB;
+        }
+
+        for (i = ri->count - 1; i >= 0; i--) {
+                u8 rate = ri->rates[i];
+                if (basic_only && !(rate & IEEE80211_BASIC_RATE_MASK))
+                        continue;
+                rate &= ~IEEE80211_BASIC_RATE_MASK;
+                if (rate > user_rate)
+                        continue;
+                if (ieee80211softmac_ratesinfo_rate_supported(&mac->ratesinfo, rate))
+                        return rate;
+        }
+
+        /* If we haven't found a suitable rate by now, just trust the user */
+        return user_rate;
+}
+
+void ieee80211softmac_recalc_txrates(struct ieee80211softmac_device *mac)
+{
+        struct ieee80211softmac_txrates *txrates = &mac->txrates;
+        struct ieee80211softmac_txrates oldrates;
+        u32 change = 0;
+
+        if (mac->txrates_change)
+                oldrates = mac->txrates;
+
+        change |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT;
+        txrates->default_rate = highest_supported_rate(mac, &mac->associnfo.supported_rates, 0);
+
+        change |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT_FBACK;
+        txrates->default_fallback = lower_rate(mac, txrates->default_rate);
+
+        change |= IEEE80211SOFTMAC_TXRATECHG_MCAST;
+        txrates->mcast_rate = highest_supported_rate(mac, &mac->associnfo.supported_rates, 1);
+
+        if (mac->txrates_change)
+                mac->txrates_change(mac->dev, change, &oldrates);
+
+}
+
+void ieee80211softmac_init_txrates(struct ieee80211softmac_device *mac)
 {
-        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
         struct ieee80211_device *ieee = mac->ieee;
         u32 change = 0;
+        struct ieee80211softmac_txrates *txrates = &mac->txrates;
         struct ieee80211softmac_txrates oldrates;
 
-        ieee80211softmac_start_check_rates(mac);
-
         /* TODO: We need some kind of state machine to lower the default rates
          *       if we loose too many packets.
          */
@@ -193,22 +253,37 @@ void ieee80211softmac_start(struct net_device *dev)
            more reliable. Note similar logic in
            ieee80211softmac_wx_set_rate() */     
         if (ieee->modulation & IEEE80211_CCK_MODULATION) {
-                mac->txrates.default_rate = IEEE80211_CCK_RATE_11MB;
-                change |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT;
-                mac->txrates.default_fallback = IEEE80211_CCK_RATE_5MB;
-                change |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT_FBACK;
+                txrates->user_rate = IEEE80211_CCK_RATE_11MB;
         } else if (ieee->modulation & IEEE80211_OFDM_MODULATION) {
-                mac->txrates.default_rate = IEEE80211_OFDM_RATE_54MB;
-                change |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT;
-                mac->txrates.default_fallback = IEEE80211_OFDM_RATE_24MB;
-                change |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT_FBACK;
+                txrates->user_rate = IEEE80211_OFDM_RATE_54MB;
         } else
                 assert(0);
+
+        txrates->default_rate = IEEE80211_CCK_RATE_1MB;
+        change |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT;
+
+        txrates->default_fallback = IEEE80211_CCK_RATE_1MB;
+        change |= IEEE80211SOFTMAC_TXRATECHG_DEFAULT_FBACK;
+
+        txrates->mcast_rate = IEEE80211_CCK_RATE_1MB;
+        change |= IEEE80211SOFTMAC_TXRATECHG_MCAST;
+
+        txrates->mgt_mcast_rate = IEEE80211_CCK_RATE_1MB;
+        change |= IEEE80211SOFTMAC_TXRATECHG_MGT_MCAST;
+
         if (mac->txrates_change)
-                mac->txrates_change(dev, change, &oldrates);
+                mac->txrates_change(mac->dev, change, &oldrates);
 
         mac->running = 1;
 }
+
+void ieee80211softmac_start(struct net_device *dev)
+{
+        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
+
+        ieee80211softmac_start_check_rates(mac);
+        ieee80211softmac_init_txrates(mac);
+}
 EXPORT_SYMBOL_GPL(ieee80211softmac_start);
 
 void ieee80211softmac_stop(struct net_device *dev)
diff --git a/net/ieee80211/softmac/ieee80211softmac_priv.h b/net/ieee80211/softmac/ieee80211softmac_priv.h
index 65d9816c8ecc..fa1f8e3acfc0 100644
--- a/net/ieee80211/softmac/ieee80211softmac_priv.h
+++ b/net/ieee80211/softmac/ieee80211softmac_priv.h
@@ -116,7 +116,10 @@ ieee80211softmac_get_network_by_essid(struct ieee80211softmac_device *mac,
         struct ieee80211softmac_essid *essid);
 
 /* Rates related */
+int ieee80211softmac_ratesinfo_rate_supported(struct ieee80211softmac_ratesinfo *ri, u8 rate);
 u8 ieee80211softmac_lower_rate_delta(struct ieee80211softmac_device *mac, u8 rate, int delta);
+void ieee80211softmac_init_txrates(struct ieee80211softmac_device *mac);
+void ieee80211softmac_recalc_txrates(struct ieee80211softmac_device *mac);
 static inline u8 lower_rate(struct ieee80211softmac_device *mac, u8 rate) {
         return ieee80211softmac_lower_rate_delta(mac, rate, 1);
 }
@@ -150,6 +153,8 @@ int ieee80211softmac_handle_disassoc(struct net_device * dev,
 int ieee80211softmac_handle_reassoc_req(struct net_device * dev,
                                         struct ieee80211_reassoc_request * reassoc);
 void ieee80211softmac_assoc_timeout(void *d);
+void ieee80211softmac_send_disassoc_req(struct ieee80211softmac_device *mac, u16 reason);
+void ieee80211softmac_disassoc(struct ieee80211softmac_device *mac);
 
 /* some helper functions */
 static inline int ieee80211softmac_scan_handlers_check_self(struct ieee80211softmac_device *sm)
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index 27edb2b5581a..22aa6199185b 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -211,8 +211,8 @@ ieee80211softmac_wx_set_rate(struct net_device *net_dev,
         if (is_ofdm && !(ieee->modulation & IEEE80211_OFDM_MODULATION))
                 goto out_unlock;
 
-        mac->txrates.default_rate = rate;
-        mac->txrates.default_fallback = lower_rate(mac, rate);
+        mac->txrates.user_rate = rate;
+        ieee80211softmac_recalc_txrates(mac);
         err = 0;
 
 out_unlock:     
@@ -431,3 +431,35 @@ ieee80211softmac_wx_get_genie(struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_get_genie);
 
+int
+ieee80211softmac_wx_set_mlme(struct net_device *dev,
+                             struct iw_request_info *info,
+                             union iwreq_data *wrqu,
+                             char *extra)
+{
+        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
+        struct iw_mlme *mlme = (struct iw_mlme *)extra;
+        u16 reason = cpu_to_le16(mlme->reason_code);
+        struct ieee80211softmac_network *net;
+
+        if (memcmp(mac->associnfo.bssid, mlme->addr.sa_data, ETH_ALEN)) {
+                printk(KERN_DEBUG PFX "wx_set_mlme: requested operation on net we don't use\n");
+                return -EINVAL;
+        }
+
+        switch (mlme->cmd) {
+        case IW_MLME_DEAUTH:
+                net = ieee80211softmac_get_network_by_bssid_locked(mac, mlme->addr.sa_data);
+                if (!net) {
+                        printk(KERN_DEBUG PFX "wx_set_mlme: we should know the net here...\n");
+                        return -EINVAL;
+                }
+                return ieee80211softmac_deauth_req(mac, net, reason);
+        case IW_MLME_DISASSOC:
+                ieee80211softmac_send_disassoc_req(mac, reason);
+                return 0;
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+EXPORT_SYMBOL_GPL(ieee80211softmac_wx_set_mlme);