SUGGEST THREAD MOVE TO NON-WORKING HARDWARE
It appears a patch has been developed and submitted to the kernel group. Doesn't seem to be been listed for commit to to trunk yet, but here it is (add prefix and remove whirespace due to posting rules)
a r t i c l e .gmane.org/gmane.linux.kernel.wireless.general/15111
While my expertise is quite limited, seems in prior code Intel prohibited frame tx in monitor mode, and this patch creates VAP equivalents as an alternative (along with other work).
This patch is meant to be applied to 2.6.26 (or 2.6.27 in theory) - from what I understand of BT3beta incorporating this patch will be non-trivial (kernel upgrade.. dependencies?). Wonder if the team are keeping the dev tree in-sync with kernel development - lack of progressive beta releases even incorporating known bugfixes makes me suspect otherwise. mac80211 changes will probably break any attempt at a backport.
Added: Since this patch creates extra interfaces it may enable some extra functionality, iirc some tool can use a second station interface for extra features (testing assoc with key maybe? don't member.)
Intel dev's seemed resistant to enabling injection while in monitor mode but stuff like hostapd needs it so they rolled over - makes it more likely this patch will become mainline.
This patch hasn't been queued for commit to WIRELESS-TESTING ('bleeding edge' trunk which is used as staging for wireless-next). It may require validation - if you test this patch, PLEASE EMAIL THE LIST WITH CONFIRMATION OF FUNCTIONALITY - (replace whitespace for url) g i t.kernel.org/?p=linux/kernel/git/linville/wireless-testing.git
Note the iwl driver still doesn't work in ap, wds and maybe ibss modes.
Beware the current pre-commit patches have at least one moderate regression issue with station mode.
Also there's a 'frag fix' (I think for mac80211) that is required from frag attacks and may be a dependency, dunno if it's in mainline or not.
Be interested to hear from anyone who manages to work this into a patched BT3 build!
Great to see progress on this, even if the iwl4965 is a crap card.. Tx 16dBm/39mW and Rx sens 54Mbit/-74 dBm; 6 Mbps/-90 dBm
UPDATE: This patch was ignored by the wireless developers. The author will not be updating it (and it will probably not apply against the current codebase) due to the huge and frequent changes to the iwl driver at the moment - it's a fast-moving target, and unless the devs commit to incorporating a revised patch into the trunk at a particular point I don't blame the author for refusing to recode.
This might settle down once intel finish work on support for the iwl5050 wimax/wifi chipset due to be released in a few months.