.33 patches

17 files changed, 944 insertions, 0 deletions

diff --git a/queue-2.6.33/alsa-hda-add-new-revision-for-alc662.patch b/queue-2.6.33/alsa-hda-add-new-revision-for-alc662.patch
new file mode 100644
index 0000000..d941a24
--- /dev/null
+++ b/queue-2.6.33/alsa-hda-add-new-revision-for-alc662.patch
@@ -0,0 +1,34 @@
+From cc667a72d471e79fd8e5e291ea115923cf44dca0 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Tue, 18 Oct 2011 14:07:51 +0200
+Subject: ALSA: HDA: Add new revision for ALC662
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit cc667a72d471e79fd8e5e291ea115923cf44dca0 upstream.
+
+The revision 0x100300 was found for ALC662. It seems to work well
+with patch_alc662.
+
+BugLink: http://bugs.launchpad.net/bugs/877373
+Tested-by: Shengyao Xue <Shengyao.xue@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Acked-by: Kailang Yang <kailang@realtek.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -18117,6 +18117,8 @@ static struct hda_codec_preset snd_hda_p
+ 	  .patch = patch_alc882 },
+ 	{ .id = 0x10ec0662, .rev = 0x100101, .name = "ALC662 rev1",
+ 	  .patch = patch_alc662 },
++	{ .id = 0x10ec0662, .rev = 0x100300, .name = "ALC662 rev3",
++	  .patch = patch_alc662 },
+ 	{ .id = 0x10ec0663, .name = "ALC663", .patch = patch_alc662 },
+ 	{ .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
+ 	{ .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
diff --git a/queue-2.6.33/epoll-fix-spurious-lockdep-warnings.patch b/queue-2.6.33/epoll-fix-spurious-lockdep-warnings.patch
new file mode 100644
index 0000000..a6f4204
--- /dev/null
+++ b/queue-2.6.33/epoll-fix-spurious-lockdep-warnings.patch
@@ -0,0 +1,137 @@
+From d8805e633e054c816c47cb6e727c81f156d9253d Mon Sep 17 00:00:00 2001
+From: Nelson Elhage <nelhage@nelhage.com>
+Date: Mon, 31 Oct 2011 17:13:14 -0700
+Subject: epoll: fix spurious lockdep warnings
+
+From: Nelson Elhage <nelhage@nelhage.com>
+
+commit d8805e633e054c816c47cb6e727c81f156d9253d upstream.
+
+epoll can acquire recursively acquire ep->mtx on multiple "struct
+eventpoll"s at once in the case where one epoll fd is monitoring another
+epoll fd.  This is perfectly OK, since we're careful about the lock
+ordering, but it causes spurious lockdep warnings.  Annotate the recursion
+using mutex_lock_nested, and add a comment explaining the nesting rules
+for good measure.
+
+Recent versions of systemd are triggering this, and it can also be
+demonstrated with the following trivial test program:
+
+--------------------8<--------------------
+
+int main(void) {
+   int e1, e2;
+   struct epoll_event evt = {
+       .events = EPOLLIN
+   };
+
+   e1 = epoll_create1(0);
+   e2 = epoll_create1(0);
+   epoll_ctl(e1, EPOLL_CTL_ADD, e2, &evt);
+   return 0;
+}
+--------------------8<--------------------
+
+Reported-by: Paul Bolle <pebolle@tiscali.nl>
+Tested-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: Nelson Elhage <nelhage@nelhage.com>
+Acked-by: Jason Baron <jbaron@redhat.com>
+Cc: Dave Jones <davej@redhat.com>
+Cc: Davide Libenzi <davidel@xmailserver.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/eventpoll.c |   25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -70,6 +70,15 @@
+  * simultaneous inserts (A into B and B into A) from racing and
+  * constructing a cycle without either insert observing that it is
+  * going to.
++ * It is necessary to acquire multiple "ep->mtx"es at once in the
++ * case when one epoll fd is added to another. In this case, we
++ * always acquire the locks in the order of nesting (i.e. after
++ * epoll_ctl(e1, EPOLL_CTL_ADD, e2), e1->mtx will always be acquired
++ * before e2->mtx). Since we disallow cycles of epoll file
++ * descriptors, this ensures that the mutexes are well-ordered. In
++ * order to communicate this nesting to lockdep, when walking a tree
++ * of epoll file descriptors, we use the current recursion depth as
++ * the lockdep subkey.
+  * It is possible to drop the "ep->mtx" and to use the global
+  * mutex "epmutex" (together with "ep->lock") to have it working,
+  * but having "ep->mtx" will make the interface more scalable.
+@@ -452,13 +461,15 @@ static void ep_unregister_pollwait(struc
+  * @ep: Pointer to the epoll private data structure.
+  * @sproc: Pointer to the scan callback.
+  * @priv: Private opaque data passed to the @sproc callback.
++ * @depth: The current depth of recursive f_op->poll calls.
+  *
+  * Returns: The same integer error code returned by the @sproc callback.
+  */
+ static int ep_scan_ready_list(struct eventpoll *ep,
+ 			      int (*sproc)(struct eventpoll *,
+ 					   struct list_head *, void *),
+-			      void *priv)
++			      void *priv,
++			      int depth)
+ {
+ 	int error, pwake = 0;
+ 	unsigned long flags;
+@@ -469,7 +480,7 @@ static int ep_scan_ready_list(struct eve
+ 	 * We need to lock this because we could be hit by
+ 	 * eventpoll_release_file() and epoll_ctl().
+ 	 */
+-	mutex_lock(&ep->mtx);
++	mutex_lock_nested(&ep->mtx, depth);
+ 
+ 	/*
+ 	 * Steal the ready list, and re-init the original one to the
+@@ -658,7 +669,7 @@ static int ep_read_events_proc(struct ev
+ 
+ static int ep_poll_readyevents_proc(void *priv, void *cookie, int call_nests)
+ {
+-	return ep_scan_ready_list(priv, ep_read_events_proc, NULL);
++	return ep_scan_ready_list(priv, ep_read_events_proc, NULL, call_nests + 1);
+ }
+ 
+ static unsigned int ep_eventpoll_poll(struct file *file, poll_table *wait)
+@@ -724,7 +735,7 @@ void eventpoll_release_file(struct file
+ 
+ 		ep = epi->ep;
+ 		list_del_init(&epi->fllink);
+-		mutex_lock(&ep->mtx);
++		mutex_lock_nested(&ep->mtx, 0);
+ 		ep_remove(ep, epi);
+ 		mutex_unlock(&ep->mtx);
+ 	}
+@@ -1120,7 +1131,7 @@ static int ep_send_events(struct eventpo
+ 	esed.maxevents = maxevents;
+ 	esed.events = events;
+ 
+-	return ep_scan_ready_list(ep, ep_send_events_proc, &esed);
++	return ep_scan_ready_list(ep, ep_send_events_proc, &esed, 0);
+ }
+ 
+ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
+@@ -1215,7 +1226,7 @@ static int ep_loop_check_proc(void *priv
+ 	struct rb_node *rbp;
+ 	struct epitem *epi;
+ 
+-	mutex_lock(&ep->mtx);
++	mutex_lock_nested(&ep->mtx, call_nests + 1);
+ 	for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
+ 		epi = rb_entry(rbp, struct epitem, rbn);
+ 		if (unlikely(is_file_epoll(epi->ffd.file))) {
+@@ -1357,7 +1368,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in
+ 	}
+ 
+ 
+-	mutex_lock(&ep->mtx);
++	mutex_lock_nested(&ep->mtx, 0);
+ 
+ 	/*
+ 	 * Try to lookup the file inside our RB tree, Since we grabbed "mtx"
diff --git a/queue-2.6.33/ipr-always-initiate-hard-reset-in-kdump-kernel.patch b/queue-2.6.33/ipr-always-initiate-hard-reset-in-kdump-kernel.patch
new file mode 100644
index 0000000..3a9b5ec
--- /dev/null
+++ b/queue-2.6.33/ipr-always-initiate-hard-reset-in-kdump-kernel.patch
@@ -0,0 +1,38 @@
+From 5d7c20b7fa5c6ca19e871b4050e321c99d32bd43 Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Mon, 1 Aug 2011 19:43:45 +1000
+Subject: [SCSI] ipr: Always initiate hard reset in kdump kernel
+
+From: Anton Blanchard <anton@samba.org>
+
+commit 5d7c20b7fa5c6ca19e871b4050e321c99d32bd43 upstream.
+
+During kdump testing I noticed timeouts when initialising each IPR
+adapter. While the driver has logic to detect an adapter in an
+indeterminate state, it wasn't triggering and each adapter went
+through a 5 minute timeout before finally going operational.
+
+Some analysis showed the needs_hard_reset flag wasn't getting set.
+We can check the reset_devices kernel parameter which is set by
+kdump and force a full reset. This fixes the problem.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Acked-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/ipr.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -7673,7 +7673,7 @@ static int __devinit ipr_probe_ioa(struc
+ 	uproc = readl(ioa_cfg->regs.sense_uproc_interrupt_reg);
+ 	if ((mask & IPR_PCII_HRRQ_UPDATED) == 0 || (uproc & IPR_UPROCI_RESET_ALERT))
+ 		ioa_cfg->needs_hard_reset = 1;
+-	if (interrupts & IPR_PCII_ERROR_INTERRUPTS)
++	if ((interrupts & IPR_PCII_ERROR_INTERRUPTS) || reset_devices)
+ 		ioa_cfg->needs_hard_reset = 1;
+ 	if (interrupts & IPR_PCII_IOA_UNIT_CHECKED)
+ 		ioa_cfg->ioa_unit_checked = 1;
diff --git a/queue-2.6.33/libsas-set-sas_address-and-device-type-of-rphy.patch b/queue-2.6.33/libsas-set-sas_address-and-device-type-of-rphy.patch
new file mode 100644
index 0000000..ca2cbff
--- /dev/null
+++ b/queue-2.6.33/libsas-set-sas_address-and-device-type-of-rphy.patch
@@ -0,0 +1,32 @@
+From bb041a0e9c31229071b6e56e1d0d8374af0d2038 Mon Sep 17 00:00:00 2001
+From: Jack Wang <jack_wang@usish.com>
+Date: Fri, 23 Sep 2011 14:32:32 +0800
+Subject: [SCSI] libsas: set sas_address and device type of rphy
+
+From: Jack Wang <jack_wang@usish.com>
+
+commit bb041a0e9c31229071b6e56e1d0d8374af0d2038 upstream.
+
+Libsas forget to set the sas_address and device type of rphy lead to file
+under /sys/class/sas_x show wrong value, fix that.
+
+Signed-off-by: Jack Wang <jack_wang@usish.com>
+Tested-by: Crystal Yu <crystal_yu@usish.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libsas/sas_expander.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -198,6 +198,8 @@ static void sas_set_ex_phy(struct domain
+ 	phy->virtual = dr->virtual;
+ 	phy->last_da_index = -1;
+ 
++	phy->phy->identify.sas_address = SAS_ADDR(phy->attached_sas_addr);
++	phy->phy->identify.device_type = phy->attached_dev_type;
+ 	phy->phy->identify.initiator_port_protocols = phy->attached_iproto;
+ 	phy->phy->identify.target_port_protocols = phy->attached_tproto;
+ 	phy->phy->identify.phy_identifier = phy_id;
diff --git a/queue-2.6.33/series b/queue-2.6.33/series
index a7c93cc..40b269f 100644
--- a/queue-2.6.33/series
+++ b/queue-2.6.33/series
@@ -49,3 +49,19 @@ hid-usbhid-add-support-for-sigma-micro-chip.patch
 hwmon-w83627ehf-properly-report-thermal-diode-sensors.patch
 x25-prevent-skb-overreads-when-checking-call-user-data.patch
 block-check-for-proper-length-of-iov-entries-earlier-in.patch
+staging-quatech_usb2-potential-lost-wakeup-scenario-in-tiocmiwait.patch
+usb-qcserial-add-device-id-for-hp-un2430-mobile-broadband-module.patch
+xhci-mem.c-check-for-ring-first_seg-null.patch
+ipr-always-initiate-hard-reset-in-kdump-kernel.patch
+libsas-set-sas_address-and-device-type-of-rphy.patch
+alsa-hda-add-new-revision-for-alc662.patch
+x86-fix-compilation-bug-in-kprobes-twobyte_is_boostable.patch
+epoll-fix-spurious-lockdep-warnings.patch
+usbmon-vs.-tcpdump-fix-dropped-packet-count.patch
+usb-storage-use-normalized-sense-when-emulating-autosense.patch
+usb-core-devio.c-check-for-printer-class-specific-request.patch
+usb-pid_ns-ensure-pid-is-not-freed-during.patch
+usb-cdc-acm-owen-si-30-support.patch
+usb-pl2303-add-id-for-smart-device.patch
+usb-ftdi_sio-add-pid-for-sony-ericsson-urban.patch
+usb-ftdi_sio-support-ti-luminary-micro-stellaris-bd-icdi.patch
diff --git a/queue-2.6.33/staging-quatech_usb2-potential-lost-wakeup-scenario-in-tiocmiwait.patch b/queue-2.6.33/staging-quatech_usb2-potential-lost-wakeup-scenario-in-tiocmiwait.patch
new file mode 100644
index 0000000..305f636
--- /dev/null
+++ b/queue-2.6.33/staging-quatech_usb2-potential-lost-wakeup-scenario-in-tiocmiwait.patch
@@ -0,0 +1,65 @@
+From e8df1674d383d2ecc6efa8d7dba74c03aafdfdd7 Mon Sep 17 00:00:00 2001
+From: Kautuk Consul <consul.kautuk@gmail.com>
+Date: Wed, 14 Sep 2011 08:56:21 +0530
+Subject: staging: quatech_usb2: Potential lost wakeup scenario in TIOCMIWAIT
+
+From: Kautuk Consul <consul.kautuk@gmail.com>
+
+commit e8df1674d383d2ecc6efa8d7dba74c03aafdfdd7 upstream.
+
+If the usermode app does an ioctl over this serial device  by
+using TIOCMIWAIT, then the code will wait by setting the current
+task state to TASK_INTERRUPTIBLE and then calling schedule().
+This will be woken up by the qt2_process_modem_status on URB
+completion when the port_extra->shadowMSR is set to the new
+modem status.
+
+However, this could result in a lost wakeup scenario due to a race
+in the logic in the qt2_ioctl(TIOCMIWAIT) loop and the URB completion
+for new modem status in qt2_process_modem_status.
+Due to this, the usermode app's task will continue to sleep despite a
+change in the modem status.
+
+Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/quatech_usb2/quatech_usb2.c |    9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/quatech_usb2/quatech_usb2.c
++++ b/drivers/staging/quatech_usb2/quatech_usb2.c
+@@ -921,9 +921,10 @@ static int qt2_ioctl(struct tty_struct *
+ 		dbg("%s() port %d, cmd == TIOCMIWAIT enter",
+ 			__func__, port->number);
+ 		prev_msr_value = port_extra->shadowMSR  & QT2_SERIAL_MSR_MASK;
++		barrier();
++		__set_current_state(TASK_INTERRUPTIBLE);
+ 		while (1) {
+ 			add_wait_queue(&port_extra->wait, &wait);
+-			set_current_state(TASK_INTERRUPTIBLE);
+ 			schedule();
+ 			dbg("%s(): port %d, cmd == TIOCMIWAIT here\n",
+ 				__func__, port->number);
+@@ -931,9 +932,12 @@ static int qt2_ioctl(struct tty_struct *
+ 			/* see if a signal woke us up */
+ 			if (signal_pending(current))
+ 				return -ERESTARTSYS;
++			set_current_state(TASK_INTERRUPTIBLE);
+ 			msr_value = port_extra->shadowMSR & QT2_SERIAL_MSR_MASK;
+-			if (msr_value == prev_msr_value)
++			if (msr_value == prev_msr_value) {
++				__set_current_state(TASK_RUNNING);
+ 				return -EIO;  /* no change - error */
++			}
+ 			if ((arg & TIOCM_RNG &&
+ 				((prev_msr_value & QT2_SERIAL_MSR_RI) ==
+ 					(msr_value & QT2_SERIAL_MSR_RI))) ||
+@@ -946,6 +950,7 @@ static int qt2_ioctl(struct tty_struct *
+ 				(arg & TIOCM_CTS &&
+ 				((prev_msr_value & QT2_SERIAL_MSR_CTS) ==
+ 					(msr_value & QT2_SERIAL_MSR_CTS)))) {
++				__set_current_state(TASK_RUNNING);
+ 				return 0;
+ 			}
+ 		} /* end inifinite while */
diff --git a/queue-2.6.33/usb-cdc-acm-owen-si-30-support.patch b/queue-2.6.33/usb-cdc-acm-owen-si-30-support.patch
new file mode 100644
index 0000000..62a1588
--- /dev/null
+++ b/queue-2.6.33/usb-cdc-acm-owen-si-30-support.patch
@@ -0,0 +1,43 @@
+From 65e52f41fa944cef2e6d4222b8c54f46cc575214 Mon Sep 17 00:00:00 2001
+From: Denis Pershin <dyp@perchine.com>
+Date: Sun, 4 Sep 2011 17:37:21 +0700
+Subject: usb: cdc-acm: Owen SI-30 support
+
+From: Denis Pershin <dyp@perchine.com>
+
+commit 65e52f41fa944cef2e6d4222b8c54f46cc575214 upstream.
+
+here is the patch to support Owen SI-30 device.
+This is a pulse counter controller.
+http://www.owen.ru/en/catalog/93788515
+
+usb-drivers output:
+T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  4 Spd=12  MxCh= 0
+D:  Ver= 2.00 Cls=02(commc) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
+P:  Vendor=03eb ProdID=0030 Rev=01.01
+C:  #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=0mA
+I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=00 Driver=cdc_acm
+I:  If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_acm
+
+This patch is installed on my home system which receives data from this
+controller connected to cold water counter.
+
+Signed-off-by: Denis Pershin <dyp@perchine.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1582,6 +1582,9 @@ static struct usb_device_id acm_ids[] =
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x0108), }, /* Nokia 5320 XpressMusic 2G */
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x01f5), }, /* Nokia N97, RM-505 */
+ 
++	/* Support for Owen devices */
++	{ USB_DEVICE(0x03eb, 0x0030), }, /* Owen SI30 */
++
+ 	/* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
+ 
+ 	/* control interfaces with various AT-command sets */
diff --git a/queue-2.6.33/usb-core-devio.c-check-for-printer-class-specific-request.patch b/queue-2.6.33/usb-core-devio.c-check-for-printer-class-specific-request.patch
new file mode 100644
index 0000000..38f1933
--- /dev/null
+++ b/queue-2.6.33/usb-core-devio.c-check-for-printer-class-specific-request.patch
@@ -0,0 +1,74 @@
+From 393cbb5151ecda9f9e14e3082d048dd27a1ff9f6 Mon Sep 17 00:00:00 2001
+From: Matthias Dellweg <2500@gmx.de>
+Date: Sun, 25 Sep 2011 14:26:25 +0200
+Subject: usb/core/devio.c: Check for printer class specific request
+
+From: Matthias Dellweg <2500@gmx.de>
+
+commit 393cbb5151ecda9f9e14e3082d048dd27a1ff9f6 upstream.
+
+In the usb printer class specific request get_device_id the value of
+wIndex is (interface << 8 | altsetting) instead of just interface.
+This enables the detection of some printers with libusb.
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Matthias Dellweg <2500@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c |   21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -601,9 +601,10 @@ static int findintfep(struct usb_device
+ }
+ 
+ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
+-			   unsigned int index)
++			   unsigned int request, unsigned int index)
+ {
+ 	int ret = 0;
++	struct usb_host_interface *alt_setting;
+ 
+ 	if (ps->dev->state != USB_STATE_UNAUTHENTICATED
+ 	 && ps->dev->state != USB_STATE_ADDRESS
+@@ -612,6 +613,19 @@ static int check_ctrlrecip(struct dev_st
+ 	if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
+ 		return 0;
+ 
++	/*
++	 * check for the special corner case 'get_device_id' in the printer
++	 * class specification, where wIndex is (interface << 8 | altsetting)
++	 * instead of just interface
++	 */
++	if (requesttype == 0xa1 && request == 0) {
++		alt_setting = usb_find_alt_setting(ps->dev->actconfig,
++						   index >> 8, index & 0xff);
++		if (alt_setting
++		 && alt_setting->desc.bInterfaceClass == USB_CLASS_PRINTER)
++			index >>= 8;
++	}
++
+ 	index &= 0xff;
+ 	switch (requesttype & USB_RECIP_MASK) {
+ 	case USB_RECIP_ENDPOINT:
+@@ -760,7 +774,8 @@ static int proc_control(struct dev_state
+ 
+ 	if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
+ 		return -EFAULT;
+-	ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.wIndex);
++	ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.bRequest,
++			      ctrl.wIndex);
+ 	if (ret)
+ 		return ret;
+ 	wLength = ctrl.wLength;		/* To suppress 64k PAGE_SIZE warning */
+@@ -1082,7 +1097,7 @@ static int proc_do_submiturb(struct dev_
+ 			kfree(dr);
+ 			return -EINVAL;
+ 		}
+-		ret = check_ctrlrecip(ps, dr->bRequestType,
++		ret = check_ctrlrecip(ps, dr->bRequestType, dr->bRequest,
+ 				      le16_to_cpup(&dr->wIndex));
+ 		if (ret) {
+ 			kfree(dr);
diff --git a/queue-2.6.33/usb-ftdi_sio-add-pid-for-sony-ericsson-urban.patch b/queue-2.6.33/usb-ftdi_sio-add-pid-for-sony-ericsson-urban.patch
new file mode 100644
index 0000000..e8fe46b
--- /dev/null
+++ b/queue-2.6.33/usb-ftdi_sio-add-pid-for-sony-ericsson-urban.patch
@@ -0,0 +1,47 @@
+From 74bdf22b5c3858b06af46f19d05c23e76c40a3bb Mon Sep 17 00:00:00 2001
+From: Hakan Kvist <hakan.kvist@sonyericsson.com>
+Date: Mon, 3 Oct 2011 13:41:15 +0200
+Subject: USB: ftdi_sio: add PID for Sony Ericsson Urban
+
+From: Hakan Kvist <hakan.kvist@sonyericsson.com>
+
+commit 74bdf22b5c3858b06af46f19d05c23e76c40a3bb upstream.
+
+Add PID 0xfc8a, 0xfc8b for device Sony Ericsson Urban
+
+Signed-off-by: Hakan Kvist <hakan.kvist@sonyericsson.com>
+Signed-off-by: Oskar Andero <oskar.andero@sonyericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c     |    2 ++
+ drivers/usb/serial/ftdi_sio_ids.h |    6 ++++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -205,6 +205,8 @@ static struct usb_device_id id_table_com
+ 	{ USB_DEVICE(FTDI_VID, FTDI_XF_640_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_XF_642_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_DSS20_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_URBAN_0_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_URBAN_1_PID) },
+ 	{ USB_DEVICE(FTDI_NF_RIC_VID, FTDI_NF_RIC_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_VNHCPCUSB_D_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_MTXORB_0_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -399,9 +399,11 @@
+ #define PROTEGO_SPECIAL_4	0xFC73	/* special/unknown device */
+ 
+ /*
+- * DSS-20 Sync Station for Sony Ericsson P800
++ * Sony Ericsson product ids
+  */
+-#define FTDI_DSS20_PID          0xFC82
++#define FTDI_DSS20_PID		0xFC82	/* DSS-20 Sync Station for Sony Ericsson P800 */
++#define FTDI_URBAN_0_PID	0xFC8A	/* Sony Ericsson Urban, uart #0 */
++#define FTDI_URBAN_1_PID	0xFC8B	/* Sony Ericsson Urban, uart #1 */
+ 
+ /* www.irtrans.de device */
+ #define FTDI_IRTRANS_PID 0xFC60 /* Product Id */
diff --git a/queue-2.6.33/usb-ftdi_sio-support-ti-luminary-micro-stellaris-bd-icdi.patch b/queue-2.6.33/usb-ftdi_sio-support-ti-luminary-micro-stellaris-bd-icdi.patch
new file mode 100644
index 0000000..2e36166
--- /dev/null
+++ b/queue-2.6.33/usb-ftdi_sio-support-ti-luminary-micro-stellaris-bd-icdi.patch
@@ -0,0 +1,48 @@
+From 3687f641307eeff6f7fe31a88dc39db88e89238b Mon Sep 17 00:00:00 2001
+From: Peter Stuge <peter@stuge.se>
+Date: Mon, 10 Oct 2011 03:34:54 +0200
+Subject: USB: ftdi_sio: Support TI/Luminary Micro Stellaris BD-ICDI
+ Board
+
+From: Peter Stuge <peter@stuge.se>
+
+commit 3687f641307eeff6f7fe31a88dc39db88e89238b upstream.
+
+Some Stellaris evaluation kits have the JTAG/SWD FTDI chip onboard,
+and some, like EK-LM3S9B90, come with a separate In-Circuit Debugger
+Interface Board. The ICDI board can also be used stand-alone, for
+other boards and chips than the kit it came with. The ICDI has both
+old style 20-pin JTAG connector and new style JTAG/SWD 10-pin 1.27mm
+pitch connector.
+
+Tested with EK-LM3S9B90, where the BD-ICDI board is included.
+
+Signed-off-by: Peter Stuge <peter@stuge.se>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c     |    2 ++
+ drivers/usb/serial/ftdi_sio_ids.h |    1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -744,6 +744,8 @@ static struct usb_device_id id_table_com
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++	{ USB_DEVICE(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID),
++		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -48,6 +48,7 @@
+ /* FTDI 2332C Dual channel device, side A=245 FIFO (JTAG), Side B=RS232 UART */
+ #define LMI_LM3S_DEVEL_BOARD_PID	0xbcd8
+ #define LMI_LM3S_EVAL_BOARD_PID		0xbcd9
++#define LMI_LM3S_ICDI_BOARD_PID		0xbcda
+ 
+ #define FTDI_TURTELIZER_PID	0xBDC8 /* JTAG/RS-232 adapter by egnite GmBH */
+ 
diff --git a/queue-2.6.33/usb-pid_ns-ensure-pid-is-not-freed-during.patch b/queue-2.6.33/usb-pid_ns-ensure-pid-is-not-freed-during.patch
new file mode 100644
index 0000000..7547e05
--- /dev/null
+++ b/queue-2.6.33/usb-pid_ns-ensure-pid-is-not-freed-during.patch
@@ -0,0 +1,46 @@
+From aec01c5895051849ed842dc5b8794017a7751f28 Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <serge.hallyn@canonical.com>
+Date: Mon, 26 Sep 2011 10:18:29 -0500
+Subject: USB: pid_ns: ensure pid is not freed during
+ kill_pid_info_as_uid
+
+From: Serge Hallyn <serge.hallyn@canonical.com>
+
+commit aec01c5895051849ed842dc5b8794017a7751f28 upstream.
+
+Alan Stern points out that after spin_unlock(&ps->lock) there is no
+guarantee that ps->pid won't be freed.  Since kill_pid_info_as_uid() is
+called after the spin_unlock(), the pid passed to it must be pinned.
+
+Reported-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -403,7 +403,7 @@ static void async_completed(struct urb *
+ 		sinfo.si_errno = as->status;
+ 		sinfo.si_code = SI_ASYNCIO;
+ 		sinfo.si_addr = as->userurb;
+-		pid = as->pid;
++		pid = get_pid(as->pid);
+ 		uid = as->uid;
+ 		euid = as->euid;
+ 		secid = as->secid;
+@@ -416,9 +416,11 @@ static void async_completed(struct urb *
+ 		cancel_bulk_urbs(ps, as->bulk_addr);
+ 	spin_unlock(&ps->lock);
+ 
+-	if (signr)
++	if (signr) {
+ 		kill_pid_info_as_uid(sinfo.si_signo, &sinfo, pid, uid,
+ 				      euid, secid);
++		put_pid(pid);
++	}
+ 
+ 	wake_up(&ps->wait);
+ }
diff --git a/queue-2.6.33/usb-pl2303-add-id-for-smart-device.patch b/queue-2.6.33/usb-pl2303-add-id-for-smart-device.patch
new file mode 100644
index 0000000..550da62
--- /dev/null
+++ b/queue-2.6.33/usb-pl2303-add-id-for-smart-device.patch
@@ -0,0 +1,42 @@
+From 598f0b703506da841d3459dc0c48506be14d1778 Mon Sep 17 00:00:00 2001
+From: Eric Benoit <eric@ecks.ca>
+Date: Sat, 24 Sep 2011 02:04:50 -0400
+Subject: USB: pl2303: add id for SMART device
+
+From: Eric Benoit <eric@ecks.ca>
+
+commit 598f0b703506da841d3459dc0c48506be14d1778 upstream.
+
+Add vendor and product ID for the SMART USB to serial adapter. These
+were meant to be used with their SMART Board whiteboards, but can be
+re-purposed for other tasks. Tested and working (at at least 9600 bps).
+
+Signed-off-by: Eric Benoit <eric@ecks.ca>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/pl2303.c |    1 +
+ drivers/usb/serial/pl2303.h |    5 +++++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -101,6 +101,7 @@ static struct usb_device_id id_table []
+ 	{ USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
+ 	{ USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
+ 	{ USB_DEVICE(WINCHIPHEAD_VENDOR_ID, WINCHIPHEAD_USBSER_PRODUCT_ID) },
++	{ USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
+ 	{ }					/* Terminating entry */
+ };
+ 
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -144,3 +144,8 @@
+ /* WinChipHead USB->RS 232 adapter */
+ #define WINCHIPHEAD_VENDOR_ID		0x4348
+ #define WINCHIPHEAD_USBSER_PRODUCT_ID	0x5523
++
++/* SMART USB Serial Adapter */
++#define SMART_VENDOR_ID	0x0b8c
++#define SMART_PRODUCT_ID	0x2303
++
diff --git a/queue-2.6.33/usb-qcserial-add-device-id-for-hp-un2430-mobile-broadband-module.patch b/queue-2.6.33/usb-qcserial-add-device-id-for-hp-un2430-mobile-broadband-module.patch
new file mode 100644
index 0000000..f31fd6d
--- /dev/null
+++ b/queue-2.6.33/usb-qcserial-add-device-id-for-hp-un2430-mobile-broadband-module.patch
@@ -0,0 +1,28 @@
+From 1bfac90d1b8e63a4d44158c3445d8fda3fb6d5eb Mon Sep 17 00:00:00 2001
+From: Rigbert Hamisch <rigbert@gmx.de>
+Date: Tue, 27 Sep 2011 10:46:43 +0200
+Subject: USB: qcserial: add device ID for "HP un2430 Mobile Broadband Module"
+
+From: Rigbert Hamisch <rigbert@gmx.de>
+
+commit 1bfac90d1b8e63a4d44158c3445d8fda3fb6d5eb upstream.
+
+add device ID for "HP un2430 Mobile Broadband Module"
+
+Signed-off-by: Rigbert Hamisch <rigbert@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/qcserial.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -26,6 +26,7 @@ static struct usb_device_id id_table[] =
+ 	{USB_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */
+ 	{USB_DEVICE(0x03f0, 0x1f1d)},	/* HP un2400 Gobi Modem Device */
+ 	{USB_DEVICE(0x03f0, 0x201d)},	/* HP un2400 Gobi QDL Device */
++	{USB_DEVICE(0x03f0, 0x371d)},	/* HP un2430 Mobile Broadband Module */
+ 	{USB_DEVICE(0x04da, 0x250d)},	/* Panasonic Gobi Modem device */
+ 	{USB_DEVICE(0x04da, 0x250c)},	/* Panasonic Gobi QDL device */
+ 	{USB_DEVICE(0x413c, 0x8172)},	/* Dell Gobi Modem device */
diff --git a/queue-2.6.33/usb-storage-use-normalized-sense-when-emulating-autosense.patch b/queue-2.6.33/usb-storage-use-normalized-sense-when-emulating-autosense.patch
new file mode 100644
index 0000000..bac99fe
--- /dev/null
+++ b/queue-2.6.33/usb-storage-use-normalized-sense-when-emulating-autosense.patch
@@ -0,0 +1,101 @@
+From e16da02fcdf1c5e824432f88abf42623dafdf191 Mon Sep 17 00:00:00 2001
+From: Luben Tuikov <ltuikov@yahoo.com>
+Date: Thu, 11 Nov 2010 15:43:11 -0800
+Subject: USB: storage: Use normalized sense when emulating autosense
+
+From: Luben Tuikov <ltuikov@yahoo.com>
+
+commit e16da02fcdf1c5e824432f88abf42623dafdf191 upstream.
+
+This patch solves two things:
+1) Enables autosense emulation code to correctly
+interpret descriptor format sense data, and
+2) Fixes a bug whereby the autosense emulation
+code would overwrite descriptor format sense data
+with SENSE KEY HARDWARE ERROR in fixed format, to
+incorrectly look like this:
+
+Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc]  Sense Key : Recovered Error [current] [descriptor]
+Oct 21 14:11:07 localhost kernel: Descriptor sense data with sense descriptors (in hex):
+Oct 21 14:11:07 localhost kernel:        72 01 04 1d 00 00 00 0e 09 0c 00 00 00 00 00 00
+Oct 21 14:11:07 localhost kernel:        00 4f 00 c2 00 50
+Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc]  ASC=0x4 ASCQ=0x1d
+
+Signed-off-by: Luben Tuikov <ltuikov@yahoo.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/transport.c |   34 +++++++++++++++++++---------------
+ 1 file changed, 19 insertions(+), 15 deletions(-)
+
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -693,6 +693,9 @@ void usb_stor_invoke_transport(struct sc
+ 		int temp_result;
+ 		struct scsi_eh_save ses;
+ 		int sense_size = US_SENSE_SIZE;
++		struct scsi_sense_hdr sshdr;
++		const u8 *scdd;
++		u8 fm_ili;
+ 
+ 		/* device supports and needs bigger sense buffer */
+ 		if (us->fflags & US_FL_SANE_SENSE)
+@@ -776,32 +779,30 @@ Retry_Sense:
+ 			srb->sense_buffer[7] = (US_SENSE_SIZE - 8);
+ 		}
+ 
++		scsi_normalize_sense(srb->sense_buffer, SCSI_SENSE_BUFFERSIZE,
++				     &sshdr);
++
+ 		US_DEBUGP("-- Result from auto-sense is %d\n", temp_result);
+ 		US_DEBUGP("-- code: 0x%x, key: 0x%x, ASC: 0x%x, ASCQ: 0x%x\n",
+-			  srb->sense_buffer[0],
+-			  srb->sense_buffer[2] & 0xf,
+-			  srb->sense_buffer[12], 
+-			  srb->sense_buffer[13]);
++			  sshdr.response_code, sshdr.sense_key,
++			  sshdr.asc, sshdr.ascq);
+ #ifdef CONFIG_USB_STORAGE_DEBUG
+-		usb_stor_show_sense(
+-			  srb->sense_buffer[2] & 0xf,
+-			  srb->sense_buffer[12], 
+-			  srb->sense_buffer[13]);
++		usb_stor_show_sense(sshdr.sense_key, sshdr.asc, sshdr.ascq);
+ #endif
+ 
+ 		/* set the result so the higher layers expect this data */
+ 		srb->result = SAM_STAT_CHECK_CONDITION;
+ 
++		scdd = scsi_sense_desc_find(srb->sense_buffer,
++					    SCSI_SENSE_BUFFERSIZE, 4);
++		fm_ili = (scdd ? scdd[3] : srb->sense_buffer[2]) & 0xA0;
++
+ 		/* We often get empty sense data.  This could indicate that
+ 		 * everything worked or that there was an unspecified
+ 		 * problem.  We have to decide which.
+ 		 */
+-		if (	/* Filemark 0, ignore EOM, ILI 0, no sense */
+-				(srb->sense_buffer[2] & 0xaf) == 0 &&
+-			/* No ASC or ASCQ */
+-				srb->sense_buffer[12] == 0 &&
+-				srb->sense_buffer[13] == 0) {
+-
++		if (sshdr.sense_key == 0 && sshdr.asc == 0 && sshdr.ascq == 0 &&
++		    fm_ili == 0) {
+ 			/* If things are really okay, then let's show that.
+ 			 * Zero out the sense buffer so the higher layers
+ 			 * won't realize we did an unsolicited auto-sense.
+@@ -816,7 +817,10 @@ Retry_Sense:
+ 			 */
+ 			} else {
+ 				srb->result = DID_ERROR << 16;
+-				srb->sense_buffer[2] = HARDWARE_ERROR;
++				if ((sshdr.response_code & 0x72) == 0x72)
++					srb->sense_buffer[1] = HARDWARE_ERROR;
++				else
++					srb->sense_buffer[2] = HARDWARE_ERROR;
+ 			}
+ 		}
+ 	}
diff --git a/queue-2.6.33/usbmon-vs.-tcpdump-fix-dropped-packet-count.patch b/queue-2.6.33/usbmon-vs.-tcpdump-fix-dropped-packet-count.patch
new file mode 100644
index 0000000..3ff5f19
--- /dev/null
+++ b/queue-2.6.33/usbmon-vs.-tcpdump-fix-dropped-packet-count.patch
@@ -0,0 +1,36 @@
+From 236c448cb6e7f82096101e1ace4b77f8b38f82c8 Mon Sep 17 00:00:00 2001
+From: Johannes Stezenbach <js@sig21.net>
+Date: Thu, 8 Sep 2011 15:39:15 +0200
+Subject: usbmon vs. tcpdump: fix dropped packet count
+
+From: Johannes Stezenbach <js@sig21.net>
+
+commit 236c448cb6e7f82096101e1ace4b77f8b38f82c8 upstream.
+
+Report the number of dropped packets instead of zero
+when using the binary usbmon interface with tcpdump.
+
+# tcpdump -i usbmon1 -w dump
+tcpdump: listening on usbmon1, link-type USB_LINUX_MMAPPED (USB with padded Linux header), capture size 65535 bytes
+^C2155 packets captured
+2155 packets received by filter
+1019 packets dropped by kernel
+
+Signed-off-by: Johannes Stezenbach <js@sig21.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/mon/mon_bin.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -1074,7 +1074,7 @@ static int mon_bin_ioctl(struct inode *i
+ 		nevents = mon_bin_queued(rp);
+ 
+ 		sp = (struct mon_bin_stats __user *)arg;
+-		if (put_user(rp->cnt_lost, &sp->dropped))
++		if (put_user(ndropped, &sp->dropped))
+ 			return -EFAULT;
+ 		if (put_user(nevents, &sp->queued))
+ 			return -EFAULT;
diff --git a/queue-2.6.33/x86-fix-compilation-bug-in-kprobes-twobyte_is_boostable.patch b/queue-2.6.33/x86-fix-compilation-bug-in-kprobes-twobyte_is_boostable.patch
new file mode 100644
index 0000000..77f2178
--- /dev/null
+++ b/queue-2.6.33/x86-fix-compilation-bug-in-kprobes-twobyte_is_boostable.patch
@@ -0,0 +1,96 @@
+From 315eb8a2a1b7f335d40ceeeb11b9e067475eb881 Mon Sep 17 00:00:00 2001
+From: Josh Stone <jistone@redhat.com>
+Date: Mon, 24 Oct 2011 10:15:51 -0700
+Subject: x86: Fix compilation bug in kprobes' twobyte_is_boostable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Josh Stone <jistone@redhat.com>
+
+commit 315eb8a2a1b7f335d40ceeeb11b9e067475eb881 upstream.
+
+When compiling an i386_defconfig kernel with gcc-4.6.1-9.fc15.i686, I
+noticed a warning about the asm operand for test_bit in kprobes'
+can_boost.  I discovered that this caused only the first long of
+twobyte_is_boostable[] to be output.
+
+Jakub filed and fixed gcc PR50571 to correct the warning and this output
+issue.  But to solve it for less current gcc, we can make kprobes'
+twobyte_is_boostable[] non-const, and it won't be optimized out.
+
+Before:
+
+    CC      arch/x86/kernel/kprobes.o
+  In file included from include/linux/bitops.h:22:0,
+                   from include/linux/kernel.h:17,
+                   from [...]/arch/x86/include/asm/percpu.h:44,
+                   from [...]/arch/x86/include/asm/current.h:5,
+                   from [...]/arch/x86/include/asm/processor.h:15,
+                   from [...]/arch/x86/include/asm/atomic.h:6,
+                   from include/linux/atomic.h:4,
+                   from include/linux/mutex.h:18,
+                   from include/linux/notifier.h:13,
+                   from include/linux/kprobes.h:34,
+                   from arch/x86/kernel/kprobes.c:43:
+  [...]/arch/x86/include/asm/bitops.h: In function ‘can_boost.part.1’:
+  [...]/arch/x86/include/asm/bitops.h:319:2: warning: use of memory input
+        without lvalue in asm operand 1 is deprecated [enabled by default]
+
+  $ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt
+       551:	0f a3 05 00 00 00 00 	bt     %eax,0x0
+                          554: R_386_32	.rodata.cst4
+
+  $ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o
+
+  arch/x86/kernel/kprobes.o:     file format elf32-i386
+
+  Contents of section .data:
+   0000 48000000 00000000 00000000 00000000  H...............
+  Contents of section .rodata.cst4:
+   0000 4c030000                             L...
+
+Only a single long of twobyte_is_boostable[] is in the object file.
+
+After, without the const on twobyte_is_boostable:
+
+  $ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt
+       551:	0f a3 05 20 00 00 00 	bt     %eax,0x20
+                          554: R_386_32	.data
+
+  $ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o
+
+  arch/x86/kernel/kprobes.o:     file format elf32-i386
+
+  Contents of section .data:
+   0000 48000000 00000000 00000000 00000000  H...............
+   0010 00000000 00000000 00000000 00000000  ................
+   0020 4c030000 0f000200 ffff0000 ffcff0c0  L...............
+   0030 0000ffff 3bbbfff8 03ff2ebb 26bb2e77  ....;.......&..w
+
+Now all 32 bytes are output into .data instead.
+
+Signed-off-by: Josh Stone <jistone@redhat.com>
+Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
+Cc: Jakub Jelinek <jakub@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/kprobes.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/kprobes.c
++++ b/arch/x86/kernel/kprobes.c
+@@ -74,8 +74,10 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kpr
+ 	/*
+ 	 * Undefined/reserved opcodes, conditional jump, Opcode Extension
+ 	 * Groups, and some special opcodes can not boost.
++	 * This is non-const to keep gcc from statically optimizing it out, as
++	 * variable_test_bit makes gcc think only *(unsigned long*) is used.
+ 	 */
+-static const u32 twobyte_is_boostable[256 / 32] = {
++static u32 twobyte_is_boostable[256 / 32] = {
+ 	/*      0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f          */
+ 	/*      ----------------------------------------------          */
+ 	W(0x00, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0) | /* 00 */
diff --git a/queue-2.6.33/xhci-mem.c-check-for-ring-first_seg-null.patch b/queue-2.6.33/xhci-mem.c-check-for-ring-first_seg-null.patch
new file mode 100644
index 0000000..5438d31
--- /dev/null
+++ b/queue-2.6.33/xhci-mem.c-check-for-ring-first_seg-null.patch
@@ -0,0 +1,61 @@
+From 0e6c7f746ea99089fb3263709075c20485a479ae Mon Sep 17 00:00:00 2001
+From: Kautuk Consul <consul.kautuk@gmail.com>
+Date: Mon, 19 Sep 2011 16:53:12 -0700
+Subject: xhci-mem.c: Check for ring->first_seg != NULL
+
+From: Kautuk Consul <consul.kautuk@gmail.com>
+
+commit 0e6c7f746ea99089fb3263709075c20485a479ae upstream.
+
+There are 2 situations wherein the xhci_ring* might not get freed:
+- When xhci_ring_alloc() -> xhci_segment_alloc() returns NULL and
+  we goto the fail: label in xhci_ring_alloc. In this case, the ring
+  will not get kfreed.
+- When the num_segs argument to xhci_ring_alloc is passed as 0 and
+  we try to free the rung after that.
+  ( This doesn't really happen as of now in the code but we seem to
+    be entertaining num_segs=0 in xhci_ring_alloc )
+
+This should be backported to kernels as old as 2.6.31.
+
+Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-mem.c |   22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -110,18 +110,20 @@ void xhci_ring_free(struct xhci_hcd *xhc
+ 	struct xhci_segment *seg;
+ 	struct xhci_segment *first_seg;
+ 
+-	if (!ring || !ring->first_seg)
++	if (!ring)
+ 		return;
+-	first_seg = ring->first_seg;
+-	seg = first_seg->next;
+-	xhci_dbg(xhci, "Freeing ring at %p\n", ring);
+-	while (seg != first_seg) {
+-		struct xhci_segment *next = seg->next;
+-		xhci_segment_free(xhci, seg);
+-		seg = next;
++	if (ring->first_seg) {
++		first_seg = ring->first_seg;
++		seg = first_seg->next;
++		xhci_dbg(xhci, "Freeing ring at %p\n", ring);
++		while (seg != first_seg) {
++			struct xhci_segment *next = seg->next;
++			xhci_segment_free(xhci, seg);
++			seg = next;
++		}
++		xhci_segment_free(xhci, first_seg);
++		ring->first_seg = NULL;
+ 	}
+-	xhci_segment_free(xhci, first_seg);
+-	ring->first_seg = NULL;
+ 	kfree(ring);
+ }
+