3.0 patches

8 files changed, 491 insertions, 0 deletions

diff --git a/queue-3.0/asoc-davinci-add-missing-break-statement.patch b/queue-3.0/asoc-davinci-add-missing-break-statement.patch
new file mode 100644
index 0000000000..9019bc919e
--- /dev/null
+++ b/queue-3.0/asoc-davinci-add-missing-break-statement.patch
@@ -0,0 +1,32 @@
+From 82d1d521036eb3f5aae48b847f939d99a44c18bb Mon Sep 17 00:00:00 2001
+From: "Rajashekhara, Sudhakar" <sudhakar.raj@ti.com>
+Date: Wed, 20 Jul 2011 17:37:18 +0530
+Subject: ASoC: davinci: add missing break statement
+
+From: "Rajashekhara, Sudhakar" <sudhakar.raj@ti.com>
+
+commit 82d1d521036eb3f5aae48b847f939d99a44c18bb upstream.
+
+In davinci_vcif_trigger() function, a break() statement was missing
+causing the davinci_vcif_stop() function to be called as a fallback
+after calling davinci_vcif_start().
+
+Signed-off-by: Rajashekhara, Sudhakar <sudhakar.raj@ti.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/davinci/davinci-vcif.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/davinci/davinci-vcif.c
++++ b/sound/soc/davinci/davinci-vcif.c
+@@ -159,6 +159,7 @@ static int davinci_vcif_trigger(struct s
+ 	case SNDRV_PCM_TRIGGER_RESUME:
+ 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+ 		davinci_vcif_start(substream);
++		break;
+ 	case SNDRV_PCM_TRIGGER_STOP:
+ 	case SNDRV_PCM_TRIGGER_SUSPEND:
+ 	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
diff --git a/queue-3.0/asoc-davinci-fix-codec-start-and-stop-functions.patch b/queue-3.0/asoc-davinci-fix-codec-start-and-stop-functions.patch
new file mode 100644
index 0000000000..551e5a5e76
--- /dev/null
+++ b/queue-3.0/asoc-davinci-fix-codec-start-and-stop-functions.patch
@@ -0,0 +1,52 @@
+From 3012f43eaf7592d8121426918e43e3b5db013aff Mon Sep 17 00:00:00 2001
+From: "Rajashekhara, Sudhakar" <sudhakar.raj@ti.com>
+Date: Wed, 20 Jul 2011 17:36:04 +0530
+Subject: ASoC: davinci: fix codec start and stop functions
+
+From: "Rajashekhara, Sudhakar" <sudhakar.raj@ti.com>
+
+commit 3012f43eaf7592d8121426918e43e3b5db013aff upstream.
+
+According to DM365 voice codec data sheet at [1], before starting
+recording or playback, ADC/DAC modules should follow a reset and
+enable cycle. Writing a 1 to the ADC/DAC bit in the register resets
+the module and clearing the bit to 0 will enable the module. But the
+driver seems to be doing the reverse of it.
+
+[1] http://focus.ti.com/lit/ug/sprufi9b/sprufi9b.pdf
+
+Signed-off-by: Rajashekhara, Sudhakar <sudhakar.raj@ti.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/davinci/davinci-vcif.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/davinci/davinci-vcif.c
++++ b/sound/soc/davinci/davinci-vcif.c
+@@ -62,9 +62,9 @@ static void davinci_vcif_start(struct sn
+ 	w = readl(davinci_vc->base + DAVINCI_VC_CTRL);
+ 
+ 	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+-		MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTDAC, 1);
++		MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTDAC, 0);
+ 	else
+-		MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTADC, 1);
++		MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTADC, 0);
+ 
+ 	writel(w, davinci_vc->base + DAVINCI_VC_CTRL);
+ }
+@@ -80,9 +80,9 @@ static void davinci_vcif_stop(struct snd
+ 	/* Reset transmitter/receiver and sample rate/frame sync generators */
+ 	w = readl(davinci_vc->base + DAVINCI_VC_CTRL);
+ 	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+-		MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTDAC, 0);
++		MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTDAC, 1);
+ 	else
+-		MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTADC, 0);
++		MOD_REG_BIT(w, DAVINCI_VC_CTRL_RSTADC, 1);
+ 
+ 	writel(w, davinci_vc->base + DAVINCI_VC_CTRL);
+ }
diff --git a/queue-3.0/asoc-mark-cache-as-dirty-when-suspending.patch b/queue-3.0/asoc-mark-cache-as-dirty-when-suspending.patch
new file mode 100644
index 0000000000..7057b8c271
--- /dev/null
+++ b/queue-3.0/asoc-mark-cache-as-dirty-when-suspending.patch
@@ -0,0 +1,36 @@
+From 7be4ba24a3ea53bc8ade841635e4d4a59e98ceb5 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Mon, 18 Jul 2011 13:17:13 +0900
+Subject: ASoC: Mark cache as dirty when suspending
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 7be4ba24a3ea53bc8ade841635e4d4a59e98ceb5 upstream.
+
+Since quite a few drivers are not managing to flag the cache as needing
+to be resynced after suspend and it's a reasonable thing to do flag the
+cache as needing sync automatically when suspending.
+
+The expectation is that systems will mainly only keep the CODEC powered
+when doing audio through the CODEC so we won't actually suspend the
+device anyway; drivers which want to can override this behaviour when
+they resume.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/soc-core.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1124,6 +1124,7 @@ int snd_soc_suspend(struct device *dev)
+ 			case SND_SOC_BIAS_OFF:
+ 				codec->driver->suspend(codec, PMSG_SUSPEND);
+ 				codec->suspended = 1;
++				codec->cache_sync = 1;
+ 				break;
+ 			default:
+ 				dev_dbg(codec->dev, "CODEC is on over suspend\n");
diff --git a/queue-3.0/ath6kl-cache-firmware.patch b/queue-3.0/ath6kl-cache-firmware.patch
new file mode 100644
index 0000000000..838833c043
--- /dev/null
+++ b/queue-3.0/ath6kl-cache-firmware.patch
@@ -0,0 +1,169 @@
+From b42a7b1bc7c0f535dfe35b2c934f239c60bb8d30 Mon Sep 17 00:00:00 2001
+From: Kalle Valo <kvalo@qca.qualcomm.com>
+Date: Mon, 13 Jun 2011 11:54:18 +0300
+Subject: ath6kl: cache firmware
+
+From: Kalle Valo <kvalo@qca.qualcomm.com>
+
+commit b42a7b1bc7c0f535dfe35b2c934f239c60bb8d30 upstream.
+
+Drivers should not request firmware during resume. Fix ath6kl to
+cache the firmware instead.
+
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/ath6kl/os/linux/ar6000_drv.c         |   49 +++++++++++++------
+ drivers/staging/ath6kl/os/linux/include/ar6000_drv.h |    9 +++
+ 2 files changed, 43 insertions(+), 15 deletions(-)
+
+--- a/drivers/staging/ath6kl/os/linux/ar6000_drv.c
++++ b/drivers/staging/ath6kl/os/linux/ar6000_drv.c
+@@ -954,9 +954,13 @@ ar6000_transfer_bin_file(struct ar6_soft
+     const char *filename;
+     const struct firmware *fw_entry;
+     u32 fw_entry_size;
++    u8 **buf;
++    size_t *buf_len;
+ 
+     switch (file) {
+         case AR6K_OTP_FILE:
++		buf = &ar->fw_otp;
++		buf_len = &ar->fw_otp_len;
+             if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                 filename = AR6003_REV1_OTP_FILE;
+             } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+@@ -970,6 +974,8 @@ ar6000_transfer_bin_file(struct ar6_soft
+             break;
+ 
+         case AR6K_FIRMWARE_FILE:
++		buf = &ar->fw;
++		buf_len = &ar->fw_len;
+             if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                 filename = AR6003_REV1_FIRMWARE_FILE;
+             } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+@@ -1028,6 +1034,8 @@ ar6000_transfer_bin_file(struct ar6_soft
+             break;
+ 
+         case AR6K_PATCH_FILE:
++		buf = &ar->fw_patch;
++		buf_len = &ar->fw_patch_len;
+             if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                 filename = AR6003_REV1_PATCH_FILE;
+             } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+@@ -1041,6 +1049,8 @@ ar6000_transfer_bin_file(struct ar6_soft
+             break;
+ 
+         case AR6K_BOARD_DATA_FILE:
++		buf = &ar->fw_data;
++		buf_len = &ar->fw_data_len;
+             if (ar->arVersion.target_ver == AR6003_REV1_VERSION) {
+                 filename = AR6003_REV1_BOARD_DATA_FILE;
+             } else if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+@@ -1057,23 +1067,29 @@ ar6000_transfer_bin_file(struct ar6_soft
+             AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown file type: %d\n", file));
+             return A_ERROR;
+     }
+-    if ((A_REQUEST_FIRMWARE(&fw_entry, filename, ((struct device *)ar->osDevInfo.pOSDevice))) != 0)
+-    {
+-        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get %s\n", filename));
+-        return A_ENOENT;
++
++    if (*buf == NULL) {
++	    if ((A_REQUEST_FIRMWARE(&fw_entry, filename, ((struct device *)ar->osDevInfo.pOSDevice))) != 0) {
++		    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get %s\n", filename));
++		    return A_ENOENT;
++	    }
++
++	    *buf = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
++	    *buf_len = fw_entry->size;
++	    A_RELEASE_FIRMWARE(fw_entry);
+     }
+ 
+ #ifdef SOFTMAC_FILE_USED
+-    if (file==AR6K_BOARD_DATA_FILE && fw_entry->data) {
+-        ar6000_softmac_update(ar, (u8 *)fw_entry->data, fw_entry->size);
++    if (file==AR6K_BOARD_DATA_FILE && *buf_len) {
++        ar6000_softmac_update(ar, *buf, *buf_len);
+     }
+ #endif 
+ 
+ 
+-    fw_entry_size = fw_entry->size;
++    fw_entry_size = *buf_len;
+ 
+     /* Load extended board data for AR6003 */
+-    if ((file==AR6K_BOARD_DATA_FILE) && (fw_entry->data)) {
++    if ((file==AR6K_BOARD_DATA_FILE) && *buf) {
+         u32 board_ext_address;
+         u32 board_ext_data_size;
+         u32 board_data_size;
+@@ -1089,14 +1105,13 @@ ar6000_transfer_bin_file(struct ar6_soft
+         AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("Board extended Data download address: 0x%x\n", board_ext_address));
+ 
+         /* check whether the target has allocated memory for extended board data and file contains extended board data */
+-        if ((board_ext_address) && (fw_entry->size == (board_data_size + board_ext_data_size))) {
++        if ((board_ext_address) && (*buf_len == (board_data_size + board_ext_data_size))) {
+             u32 param;
+ 
+-            status = BMIWriteMemory(ar->arHifDevice, board_ext_address, (u8 *)(fw_entry->data + board_data_size), board_ext_data_size);
++            status = BMIWriteMemory(ar->arHifDevice, board_ext_address, (u8 *)(*buf + board_data_size), board_ext_data_size);
+ 
+             if (status) {
+                 AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI operation failed: %d\n", __LINE__));
+-                A_RELEASE_FIRMWARE(fw_entry);
+                 return A_ERROR;
+             }
+ 
+@@ -1110,17 +1125,16 @@ ar6000_transfer_bin_file(struct ar6_soft
+     }
+ 
+     if (compressed) {
+-        status = BMIFastDownload(ar->arHifDevice, address, (u8 *)fw_entry->data, fw_entry_size);
++        status = BMIFastDownload(ar->arHifDevice, address, *buf, fw_entry_size);
+     } else {
+-        status = BMIWriteMemory(ar->arHifDevice, address, (u8 *)fw_entry->data, fw_entry_size);
++        status = BMIWriteMemory(ar->arHifDevice, address, *buf, fw_entry_size);
+     }
+ 
+     if (status) {
+         AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI operation failed: %d\n", __LINE__));
+-        A_RELEASE_FIRMWARE(fw_entry);
+         return A_ERROR;
+     }
+-    A_RELEASE_FIRMWARE(fw_entry);
++
+     return 0;
+ }
+ 
+@@ -2088,6 +2102,11 @@ ar6000_destroy(struct net_device *dev, u
+     ar6000_remove_ap_interface();
+ #endif /*CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT */
+ 
++    kfree(ar->fw_otp);
++    kfree(ar->fw);
++    kfree(ar->fw_patch);
++    kfree(ar->fw_data);
++
+     AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("-ar6000_destroy \n"));
+ }
+ 
+--- a/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h
++++ b/drivers/staging/ath6kl/os/linux/include/ar6000_drv.h
+@@ -651,6 +651,15 @@ struct ar6_softc {
+     void                    *arApDev;
+ #endif
+     u8 arAutoAuthStage;
++
++	u8 *fw_otp;
++	size_t fw_otp_len;
++	u8 *fw;
++	size_t fw_len;
++	u8 *fw_patch;
++	size_t fw_patch_len;
++	u8 *fw_data;
++	size_t fw_data_len;
+ };
+ 
+ #ifdef CONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
diff --git a/queue-3.0/ath6kl-fix-crash-when-interface-is-closed-but-scan-is.patch b/queue-3.0/ath6kl-fix-crash-when-interface-is-closed-but-scan-is.patch
new file mode 100644
index 0000000000..0dd4556b24
--- /dev/null
+++ b/queue-3.0/ath6kl-fix-crash-when-interface-is-closed-but-scan-is.patch
@@ -0,0 +1,97 @@
+From 98ab5c7755b5cc9e1a8f2a57ccb22eac5e13ec50 Mon Sep 17 00:00:00 2001
+From: Kalle Valo <kvalo@qca.qualcomm.com>
+Date: Mon, 13 Jun 2011 11:54:06 +0300
+Subject: ath6kl: fix crash when interface is closed but scan is
+ ongoing
+
+From: Kalle Valo <kvalo@qca.qualcomm.com>
+
+commit 98ab5c7755b5cc9e1a8f2a57ccb22eac5e13ec50 upstream.
+
+When ath6kl module was resumed while a scan was ongoing, for example during
+suspend, the driver would crash in ar6k_cfg80211_scanComplete_event():
+
+[26581.586440] Call Trace:
+[26581.586440]  [<f99ffeda>] ? ar6k_cfg80211_scanComplete_event+0xaa/0xaa [ath6kl]
+[26581.586440]  [<f9a0a020>] wmi_iterate_nodes+0xb/0xd [ath6kl]
+[26581.586440]  [<f99ffe78>] ar6k_cfg80211_scanComplete_event+0x48/0xaa [ath6kl]
+[26581.586440]  [<f9a038ae>] ar6000_close+0x77/0x7e [ath6kl]
+[26581.586440]  [<c139c25d>] __dev_close_many+0x87/0xab
+[26581.586440]  [<c139c30a>] dev_close_many+0x54/0xab
+[26581.586440]  [<c139c437>] rollback_registered_many+0xa5/0x19e
+[26581.586440]  [<c139c595>] rollback_registered+0x23/0x2f
+[26581.586440]  [<c139c5ed>] unregister_netdevice_queue+0x4c/0x69
+[26581.586440]  [<c139c6b2>] unregister_netdev+0x18/0x1f
+[26581.586440]  [<f9a00d4c>] ar6000_destroy+0xf8/0x115 [ath6kl]
+[26581.586440]  [<f9a0c765>] ar6k_cleanup_module+0x20/0x29 [ath6kl]
+[26581.586440]  [<c1062843>] sys_delete_module+0x181/0x1d9
+[26581.586440]  [<c105876b>] ? lock_release_holdtime+0x2b/0xcd
+[26581.586440]  [<c10b55dc>] ? sys_munmap+0x3b/0x42
+[26581.586440]  [<c14a99dc>] ? restore_all+0xf/0xf
+[26581.586440]  [<c14aeb6c>] sysenter_do_call+0x12/0x32
+[26581.586440] Code: 89 53 6c 75 07 89 d8 e8 c0 ff ff ff 89 f0 e8 2c f2 a9 c7 5b 5e 5d c3 55 89 e5 57 56 53 89 c3 83 ec 08 89 55 f0 8d 78 04 89 4d ec <8b> b0 b8 00 00 00 46 89 b0 b8 00 00 00 89 f8 e8 ae ed a9 c7 8b
+
+Fix the function not to iterate nodes when the scan is aborted. The nodes
+are already freed when the module is being unloaded. Patch "ath6kl: Fix a
+kernel panic furing suspend/resume" tried to fix this already but it wasn't
+enough as a pointer was still used even after the null check. This patch
+removes the null check entirely as the wmi structure is not accessed anymore
+during module unload.
+
+Also fix a bug where the status was checked as a bitfield with '&' operator.
+But it's not a bitfield, just a regular (enum like) value.
+
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/ath6kl/os/linux/cfg80211.c |   31 ++++++++++++++++-------------
+ 1 file changed, 18 insertions(+), 13 deletions(-)
+
+--- a/drivers/staging/ath6kl/os/linux/cfg80211.c
++++ b/drivers/staging/ath6kl/os/linux/cfg80211.c
+@@ -867,26 +867,31 @@ ar6k_cfg80211_scanComplete_event(struct
+ 
+     AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: status %d\n", __func__, status));
+ 
+-    if(ar->scan_request)
+-    {
+-        /* Translate data to cfg80211 mgmt format */
+-	if (ar->arWmi)
+-		wmi_iterate_nodes(ar->arWmi, ar6k_cfg80211_scan_node, ar->wdev->wiphy);
++    if (!ar->scan_request)
++	    return;
+ 
+-        cfg80211_scan_done(ar->scan_request,
+-            ((status & A_ECANCELED) || (status & A_EBUSY)) ? true : false);
++    if ((status == A_ECANCELED) || (status == A_EBUSY)) {
++	    cfg80211_scan_done(ar->scan_request, true);
++	    goto out;
++    }
++
++    /* Translate data to cfg80211 mgmt format */
++    wmi_iterate_nodes(ar->arWmi, ar6k_cfg80211_scan_node, ar->wdev->wiphy);
+ 
+-        if(ar->scan_request->n_ssids &&
+-           ar->scan_request->ssids[0].ssid_len) {
++    cfg80211_scan_done(ar->scan_request, false);
++
++    if(ar->scan_request->n_ssids &&
++       ar->scan_request->ssids[0].ssid_len) {
+             u8 i;
+ 
+             for (i = 0; i < ar->scan_request->n_ssids; i++) {
+-                wmi_probedSsid_cmd(ar->arWmi, i+1, DISABLE_SSID_FLAG,
+-                                   0, NULL);
++		    wmi_probedSsid_cmd(ar->arWmi, i+1, DISABLE_SSID_FLAG,
++				       0, NULL);
+             }
+-        }
+-        ar->scan_request = NULL;
+     }
++
++out:
++    ar->scan_request = NULL;
+ }
+ 
+ static int
diff --git a/queue-3.0/ath9k_hw-fix-incorrect-key_miss-handling.patch b/queue-3.0/ath9k_hw-fix-incorrect-key_miss-handling.patch
new file mode 100644
index 0000000000..19c782a26a
--- /dev/null
+++ b/queue-3.0/ath9k_hw-fix-incorrect-key_miss-handling.patch
@@ -0,0 +1,55 @@
+From 0472ade031b5c0c69c21cf96acf64c50eb9ba3c2 Mon Sep 17 00:00:00 2001
+From: Senthil Balasubramanian <senthilb@qca.qualcomm.com>
+Date: Tue, 12 Jul 2011 00:02:56 +0530
+Subject: ath9k_hw: Fix incorrect key_miss handling
+
+From: Senthil Balasubramanian <senthilb@qca.qualcomm.com>
+
+commit 0472ade031b5c0c69c21cf96acf64c50eb9ba3c2 upstream.
+
+Decryping frames on key_miss handling shouldn't be done for Michael
+MIC failed frames as h/w would have already decrypted such frames
+successfully anyway.
+
+Also leaving CRC and PHY error(where the frame is going to be dropped
+anyway), we are left to prcoess Decrypt error for which s/w decrypt is
+selected anway and so having key_miss as a separate check doesn't serve
+anything. So making key_miss handling mutually exlusive with other RX
+status handling makes much more sense.
+
+This patch addresses an issue with STA not reporting MIC failure events
+resulting in STA being disconnected immediately.
+
+Signed-off-by: Senthil Balasubramanian <senthilb@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_mac.c |    3 +--
+ drivers/net/wireless/ath/ath9k/mac.c        |    3 +--
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+@@ -629,8 +629,7 @@ int ath9k_hw_process_rxdesc_edma(struct
+ 			rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+ 		else if (rxsp->status11 & AR_MichaelErr)
+ 			rxs->rs_status |= ATH9K_RXERR_MIC;
+-
+-		if (rxsp->status11 & AR_KeyMiss)
++		else if (rxsp->status11 & AR_KeyMiss)
+ 			rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+ 	}
+ 
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -645,8 +645,7 @@ int ath9k_hw_rxprocdesc(struct ath_hw *a
+ 			rs->rs_status |= ATH9K_RXERR_DECRYPT;
+ 		else if (ads.ds_rxstatus8 & AR_MichaelErr)
+ 			rs->rs_status |= ATH9K_RXERR_MIC;
+-
+-		if (ads.ds_rxstatus8 & AR_KeyMiss)
++		else if (ads.ds_rxstatus8 & AR_KeyMiss)
+ 			rs->rs_status |= ATH9K_RXERR_DECRYPT;
+ 	}
+ 
diff --git a/queue-3.0/cifs-fix-oops-while-mounting-with-prefixpath.patch b/queue-3.0/cifs-fix-oops-while-mounting-with-prefixpath.patch
new file mode 100644
index 0000000000..158b018b61
--- /dev/null
+++ b/queue-3.0/cifs-fix-oops-while-mounting-with-prefixpath.patch
@@ -0,0 +1,43 @@
+From f5bc1e755d23d022bf948904386337fc3e5e29a8 Mon Sep 17 00:00:00 2001
+From: Pavel Shilovsky <piastryyy@gmail.com>
+Date: Mon, 25 Jul 2011 17:59:10 +0400
+Subject: CIFS: Fix oops while mounting with prefixpath
+
+From: Pavel Shilovsky <piastryyy@gmail.com>
+
+commit f5bc1e755d23d022bf948904386337fc3e5e29a8 upstream.
+
+commit fec11dd9a0109fe52fd631e5c510778d6cbff6cc caused
+a regression when we have already mounted //server/share/a
+and want to mount //server/share/a/b.
+
+The problem is that lookup_one_len calls __lookup_hash
+with nd pointer as NULL. Then __lookup_hash calls
+do_revalidate in the case when dentry exists and we end
+up with NULL pointer deference in cifs_d_revalidate:
+
+if (nd->flags & LOOKUP_RCU)
+	return -ECHILD;
+
+Fix this by checking nd for NULL.
+
+Signed-off-by: Pavel Shilovsky <piastryyy@gmail.com>
+Reviewed-by: Shirish Pargaonkar <shirishp@us.ibm.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/dir.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -641,7 +641,7 @@ lookup_out:
+ static int
+ cifs_d_revalidate(struct dentry *direntry, struct nameidata *nd)
+ {
+-	if (nd->flags & LOOKUP_RCU)
++	if (nd && (nd->flags & LOOKUP_RCU))
+ 		return -ECHILD;
+ 
+ 	if (direntry->d_inode) {
diff --git a/queue-3.0/series b/queue-3.0/series
index 230ac3fc2b..fb43c636ff 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -17,3 +17,10 @@ rtc-fix-hrtimer-deadlock.patch
 rtc-limit-frequency.patch
 drivers-rtc-rtc-tegra.c-properly-initialize-spinlock.patch
 arm-pxa-cm-x300-fix-v3020-rtc-functionality.patch
+asoc-davinci-add-missing-break-statement.patch
+asoc-davinci-fix-codec-start-and-stop-functions.patch
+asoc-mark-cache-as-dirty-when-suspending.patch
+ath6kl-cache-firmware.patch
+ath6kl-fix-crash-when-interface-is-closed-but-scan-is.patch
+ath9k_hw-fix-incorrect-key_miss-handling.patch
+cifs-fix-oops-while-mounting-with-prefixpath.patch