summaryrefslogtreecommitdiffstats
path: root/main
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2010-06-10 08:20:58 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2010-06-10 08:20:58 +0000
commit45efbf454e73ac59911d4237d3701af4ccf196f7 (patch)
treed01524cfadc6c7c9839c9841ee5aa108391a2be0 /main
parentc8e30a4b6ada735f6233ed83c1c2e485f1daf4bb (diff)
downloadaports-45efbf454e73ac59911d4237d3701af4ccf196f7.tar.bz2
aports-45efbf454e73ac59911d4237d3701af4ccf196f7.tar.xz
main/linux-pae: upgrade to .15 and sync up with linux-grsec
Diffstat (limited to 'main')
-rw-r--r--main/linux-pae/0005-r8169-fix-broken-register-writes.patch52
-rw-r--r--main/linux-pae/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch120
-rw-r--r--main/linux-pae/0008-r8169-clean-up-my-printk-uglyness.patch36
-rw-r--r--main/linux-pae/APKBUILD38
-rw-r--r--main/linux-pae/kernelconfig.x8665
-rw-r--r--main/linux-pae/r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch56
-rw-r--r--main/linux-pae/r8169-fix-random-mdio_write-failures.patch48
-rw-r--r--main/linux-pae/x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch48
-rw-r--r--main/linux-pae/xfrm-fix-policy-unreferencing-on-larval-drop.patch14
9 files changed, 251 insertions, 226 deletions
diff --git a/main/linux-pae/0005-r8169-fix-broken-register-writes.patch b/main/linux-pae/0005-r8169-fix-broken-register-writes.patch
deleted file mode 100644
index bfa8df290..000000000
--- a/main/linux-pae/0005-r8169-fix-broken-register-writes.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 89f350c4ec426b4c1db6ef269546940365d918e1 Mon Sep 17 00:00:00 2001
-From: Francois Romieu <romieu@fr.zoreil.com>
-Date: Sat, 27 Mar 2010 19:35:46 -0700
-Subject: [PATCH 05/18] r8169: fix broken register writes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is quite similar to b39fe41f481d20c201012e4483e76c203802dda7
-though said registers are not even documented as 64-bit registers
-- as opposed to the initial TxDescStartAddress ones - but as single
-bytes which must be combined into 32 bits at the MMIO read/write
-level before being merged into a 64 bit logical entity.
-
-Credits go to Ben Hutchings <ben@decadent.org.uk> for the MAR
-registers (aka "multicast is broken for ages on ARM) and to
-Timo Teräs <timo.teras@iki.fi> for the MAC registers.
-
-Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-(cherry picked from commit 78f1cd02457252e1ffbc6caa44a17424a45286b8)
----
- drivers/net/r8169.c | 4 ++--
- 1 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 0fe2fc9..24599b5 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -2827,8 +2827,8 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
- spin_lock_irq(&tp->lock);
-
- RTL_W8(Cfg9346, Cfg9346_Unlock);
-- RTL_W32(MAC0, low);
- RTL_W32(MAC4, high);
-+ RTL_W32(MAC0, low);
- RTL_W8(Cfg9346, Cfg9346_Lock);
-
- spin_unlock_irq(&tp->lock);
-@@ -4795,8 +4795,8 @@ static void rtl_set_rx_mode(struct net_device *dev)
- mc_filter[1] = swab32(data);
- }
-
-- RTL_W32(MAR0 + 0, mc_filter[0]);
- RTL_W32(MAR0 + 4, mc_filter[1]);
-+ RTL_W32(MAR0 + 0, mc_filter[0]);
-
- RTL_W32(RxConfig, tmp);
-
---
-1.7.0.2
-
diff --git a/main/linux-pae/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch b/main/linux-pae/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
deleted file mode 100644
index 03ea13fa1..000000000
--- a/main/linux-pae/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From a60cfaf3df9cd0cddbc24695434ed5bfa917d505 Mon Sep 17 00:00:00 2001
-From: Neil Horman <nhorman@redhat.com>
-Date: Mon, 29 Mar 2010 13:16:02 -0700
-Subject: [PATCH 06/18] r8169: offical fix for CVE-2009-4537 (overlength frame DMAs)
-
-Official patch to fix the r8169 frame length check error.
-
-Based on this initial thread:
-http://marc.info/?l=linux-netdev&m=126202972828626&w=1
-This is the official patch to fix the frame length problems in the r8169
-driver. As noted in the previous thread, while this patch incurs a performance
-hit on the driver, its possible to improve performance dynamically by updating
-the mtu and rx_copybreak values at runtime to return performance to what it was
-for those NICS which are unaffected by the ideosyncracy (if there are any).
-
-Summary:
-
- A while back Eric submitted a patch for r8169 in which the proper
-allocated frame size was written to RXMaxSize to prevent the NIC from dmaing too
-much data. This was done in commit fdd7b4c3302c93f6833e338903ea77245eb510b4. A
-long time prior to that however, Francois posted
-126fa4b9ca5d9d7cb7d46f779ad3bd3631ca387c, which expiclitly disabled the MaxSize
-setting due to the fact that the hardware behaved in odd ways when overlong
-frames were received on NIC's supported by this driver. This was mentioned in a
-security conference recently:
-http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html
-
-It seems that if we can't enable frame size filtering, then, as Eric correctly
-noticed, we can find ourselves DMA-ing too much data to a buffer, causing
-corruption. As a result is seems that we are forced to allocate a frame which
-is ready to handle a maximally sized receive.
-
-This obviously has performance issues with it, so to mitigate that issue, this
-patch does two things:
-
-1) Raises the copybreak value to the frame allocation size, which should force
-appropriately sized packets to get allocated on rx, rather than a full new 16k
-buffer.
-
-2) This patch only disables frame filtering initially (i.e., during the NIC
-open), changing the MTU results in ring buffer allocation of a size in relation
-to the new mtu (along with a warning indicating that this is dangerous).
-
-Because of item (2), individuals who can't cope with the performance hit (or can
-otherwise filter frames to prevent the bug), or who have hardware they are sure
-is unaffected by this issue, can manually lower the copybreak and reset the mtu
-such that performance is restored easily.
-
-Signed-off-by: Neil Horman <nhorman@redhat.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-(cherry picked from commit c0cd884af045338476b8e69a61fceb3f34ff22f1)
----
- drivers/net/r8169.c | 29 ++++++++++++++++++++++++-----
- 1 files changed, 24 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 24599b5..1484528 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -186,7 +186,12 @@ static struct pci_device_id rtl8169_pci_tbl[] = {
-
- MODULE_DEVICE_TABLE(pci, rtl8169_pci_tbl);
-
--static int rx_copybreak = 200;
-+/*
-+ * we set our copybreak very high so that we don't have
-+ * to allocate 16k frames all the time (see note in
-+ * rtl8169_open()
-+ */
-+static int rx_copybreak = 16383;
- static int use_dac;
- static struct {
- u32 msg_enable;
-@@ -3245,9 +3250,13 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
- }
-
- static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
-- struct net_device *dev)
-+ unsigned int mtu)
- {
-- unsigned int max_frame = dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
-+ unsigned int max_frame = mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
-+
-+ if (max_frame != 16383)
-+ printk(KERN_WARNING "WARNING! Changing of MTU on this NIC"
-+ "May lead to frame reception errors!\n");
-
- tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
- }
-@@ -3259,7 +3268,17 @@ static int rtl8169_open(struct net_device *dev)
- int retval = -ENOMEM;
-
-
-- rtl8169_set_rxbufsize(tp, dev);
-+ /*
-+ * Note that we use a magic value here, its wierd I know
-+ * its done because, some subset of rtl8169 hardware suffers from
-+ * a problem in which frames received that are longer than
-+ * the size set in RxMaxSize register return garbage sizes
-+ * when received. To avoid this we need to turn off filtering,
-+ * which is done by setting a value of 16383 in the RxMaxSize register
-+ * and allocating 16k frames to handle the largest possible rx value
-+ * thats what the magic math below does.
-+ */
-+ rtl8169_set_rxbufsize(tp, 16383 - VLAN_ETH_HLEN - ETH_FCS_LEN);
-
- /*
- * Rx and Tx desscriptors needs 256 bytes alignment.
-@@ -3912,7 +3931,7 @@ static int rtl8169_change_mtu(struct net_device *dev, int new_mtu)
-
- rtl8169_down(dev);
-
-- rtl8169_set_rxbufsize(tp, dev);
-+ rtl8169_set_rxbufsize(tp, dev->mtu);
-
- ret = rtl8169_init_ring(dev);
- if (ret < 0)
---
-1.7.0.2
-
diff --git a/main/linux-pae/0008-r8169-clean-up-my-printk-uglyness.patch b/main/linux-pae/0008-r8169-clean-up-my-printk-uglyness.patch
deleted file mode 100644
index dff3fd211..000000000
--- a/main/linux-pae/0008-r8169-clean-up-my-printk-uglyness.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From d1c9ac562923fa0b1738fceb4c7bafac3ab936ba Mon Sep 17 00:00:00 2001
-From: Neil Horman <nhorman@tuxdriver.com>
-Date: Thu, 1 Apr 2010 07:30:07 +0000
-Subject: [PATCH 08/18] r8169: clean up my printk uglyness
-
-Fix formatting on r8169 printk
-
-Brandon Philips noted that I had a spacing issue in my printk for the
-last r8169 patch that made it quite ugly. Fix that up and add the PFX
-macro to it as well so it looks like the other r8169 printks
-
-Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-(cherry picked from commit 93f4d91d879acfcb0ba9c2725e3133fcff2dfd1e)
----
- drivers/net/r8169.c | 4 ++--
- 1 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index bed1d47..790555e 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -3255,8 +3255,8 @@ static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
- unsigned int max_frame = mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
-
- if (max_frame != 16383)
-- printk(KERN_WARNING "WARNING! Changing of MTU on this NIC"
-- "May lead to frame reception errors!\n");
-+ printk(KERN_WARNING PFX "WARNING! Changing of MTU on this "
-+ "NIC may lead to frame reception errors!\n");
-
- tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
- }
---
-1.7.0.2
-
diff --git a/main/linux-pae/APKBUILD b/main/linux-pae/APKBUILD
index 95d20f1ac..fa5b0431d 100644
--- a/main/linux-pae/APKBUILD
+++ b/main/linux-pae/APKBUILD
@@ -2,9 +2,9 @@
_flavor=pae
pkgname=linux-${_flavor}
-pkgver=2.6.32.11
+pkgver=2.6.32.15
_kernver=2.6.32
-pkgrel=1
+pkgrel=0
pkgdesc="Linux kernel with PAE enabled"
url=http://www.kernel.org
depends="mkinitfs linux-firmware"
@@ -17,10 +17,7 @@ source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
0002-gre-fix-hard-header-destination-address-checking.patch
0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
0004-arp-flush-arp-cache-on-device-change.patch
- 0005-r8169-fix-broken-register-writes.patch
- 0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
0007-r8169-Fix-rtl8169_rx_interrupt.patch
- 0008-r8169-clean-up-my-printk-uglyness.patch
0009-ipsec-Fix-bogus-bundle-flowi.patch
0010-xfrm-Remove-xfrm_state_genid.patch
0011-xfrm_user-verify-policy-direction-at-XFRM_MSG_POLEXP.patch
@@ -31,6 +28,10 @@ source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
0016-xfrm-remove-policy-garbage-collection.patch
0017-flow-delayed-deletion-of-flow-cache-entries.patch
0018-xfrm-Fix-crashes-in-xfrm_lookup.patch
+ xfrm-fix-policy-unreferencing-on-larval-drop.patch
+ r8169-fix-random-mdio_write-failures.patch
+ r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch
+ x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch
kernelconfig.x86
"
subpackages="$pkgname-dev"
@@ -44,10 +45,14 @@ prepare() {
bunzip2 -c < ../patch-$pkgver.bz2 | patch -p1 -N || return 1
fi
- for i in ../*.diff ../*.patch; do
- [ -f $i ] || continue
- msg "Applying $i..."
- patch -s -p1 -N < $i || return 1
+ # first apply patches in specified order
+ for i in $source; do
+ case $i in
+ *.patch)
+ msg "Applying $i..."
+ patch -s -p1 -N < "$srcdir"/$i || return 1
+ ;;
+ esac
done
mkdir -p "$srcdir"/build
@@ -66,7 +71,9 @@ menuconfig() {
build() {
cd "$srcdir"/build
- make CC="${CC:-gcc}" || return 1
+ make CC="${CC:--gcc}" \
+ KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-Alpine" \
+ || return 1
}
package() {
@@ -131,14 +138,11 @@ dev() {
}
md5sums="260551284ac224c3a43c4adac7df4879 linux-2.6.32.tar.bz2
-855c248334a71ef5ca3d8cb89d51334f patch-2.6.32.11.bz2
+5c9251844c2819eddee4dba1293bd46d patch-2.6.32.15.bz2
437317f88ec13ace8d39c31983a41696 0002-gre-fix-hard-header-destination-address-checking.patch
151b29a161178ed39d62a08f21f3484d 0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
776adeeb5272093574f8836c5037dd7d 0004-arp-flush-arp-cache-on-device-change.patch
-afa06334c81f21c20571286a83d3d928 0005-r8169-fix-broken-register-writes.patch
-c538c0f735d79fd71b47dde02bf1f790 0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
5f8b9a76d95319c5b1aa26b54a42e6b5 0007-r8169-Fix-rtl8169_rx_interrupt.patch
-f878c802700e3babd03be3505119c5c2 0008-r8169-clean-up-my-printk-uglyness.patch
cf168620efa63479a6e03da78906e32f 0009-ipsec-Fix-bogus-bundle-flowi.patch
3af4b5ae1afae3278b0070f585b874e3 0010-xfrm-Remove-xfrm_state_genid.patch
9f284c3fd5ab38cef4544efc1f50c6ba 0011-xfrm_user-verify-policy-direction-at-XFRM_MSG_POLEXP.patch
@@ -149,4 +153,8 @@ c09b82b89a49ba2a3836a0bc3a3312f4 0015-xfrm-cache-bundles-instead-of-policies-fo
41618efb65ab9ddacfb59a1cde9b4edd 0016-xfrm-remove-policy-garbage-collection.patch
3b83f0972ab715819d1119b120a987e7 0017-flow-delayed-deletion-of-flow-cache-entries.patch
45a676c7a1759fec60b724d557b4e295 0018-xfrm-Fix-crashes-in-xfrm_lookup.patch
-bf15e3ee69e03319dab0d59e08b67195 kernelconfig.x86"
+c7e606c11c05ff03012b21c3fe0ece47 xfrm-fix-policy-unreferencing-on-larval-drop.patch
+ce4a74190febe13713bab1b886dd5bee r8169-fix-random-mdio_write-failures.patch
+b41ee19f13498fb25992fd60cd1126d4 r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch
+a1bcf76870b63a4a4035a8948fb758e2 x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch
+970a1dc0f8c6c3e3227a77934eafd68e kernelconfig.x86"
diff --git a/main/linux-pae/kernelconfig.x86 b/main/linux-pae/kernelconfig.x86
index 2b424ce7b..951f1f886 100644
--- a/main/linux-pae/kernelconfig.x86
+++ b/main/linux-pae/kernelconfig.x86
@@ -1,7 +1,7 @@
#
# Automatically generated make config: don't edit
-# Linux kernel version: 2.6.32.10
-# Tue Mar 23 13:08:19 2010
+# Linux kernel version: 2.6.32.15
+# Thu Jun 10 08:10:37 2010
#
# CONFIG_64BIT is not set
CONFIG_X86_32=y
@@ -311,6 +311,7 @@ CONFIG_ARCH_PHYS_ADDR_T_64BIT=y
CONFIG_ARCH_FLATMEM_ENABLE=y
CONFIG_ARCH_SPARSEMEM_ENABLE=y
CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ILLEGAL_POINTER_VALUE=0
CONFIG_SELECT_MEMORY_MODEL=y
CONFIG_FLATMEM_MANUAL=y
# CONFIG_DISCONTIGMEM_MANUAL is not set
@@ -3959,7 +3960,65 @@ CONFIG_XEN_DEV_EVTCHN=y
CONFIG_XENFS=y
CONFIG_XEN_COMPAT_XENFS=y
CONFIG_XEN_SYS_HYPERVISOR=y
-# CONFIG_STAGING is not set
+CONFIG_STAGING=y
+# CONFIG_STAGING_EXCLUDE_BUILD is not set
+# CONFIG_ET131X is not set
+# CONFIG_SLICOSS is not set
+# CONFIG_VIDEO_GO7007 is not set
+# CONFIG_VIDEO_CX25821 is not set
+# CONFIG_USB_IP_COMMON is not set
+# CONFIG_W35UND is not set
+# CONFIG_PRISM2_USB is not set
+# CONFIG_ECHO is not set
+# CONFIG_POCH is not set
+# CONFIG_OTUS is not set
+# CONFIG_RT2860 is not set
+# CONFIG_RT2870 is not set
+# CONFIG_RT3090 is not set
+# CONFIG_COMEDI is not set
+# CONFIG_ASUS_OLED is not set
+# CONFIG_PANEL is not set
+# CONFIG_ALTERA_PCIE_CHDMA is not set
+# CONFIG_RTL8187SE is not set
+# CONFIG_RTL8192SU is not set
+# CONFIG_RTL8192E is not set
+# CONFIG_TRANZPORT is not set
+
+#
+# Android
+#
+
+#
+# Qualcomm MSM Camera And Video
+#
+
+#
+# Camera Sensor Selection
+#
+# CONFIG_INPUT_GPIO is not set
+# CONFIG_DST is not set
+# CONFIG_POHMELFS is not set
+# CONFIG_B3DFG is not set
+# CONFIG_IDE_PHISON is not set
+# CONFIG_PLAN9AUTH is not set
+# CONFIG_LINE6_USB is not set
+# CONFIG_DRM_RADEON_KMS is not set
+# CONFIG_USB_SERIAL_QUATECH2 is not set
+# CONFIG_USB_SERIAL_QUATECH_USB2 is not set
+# CONFIG_VT6655 is not set
+# CONFIG_VT6656 is not set
+# CONFIG_FB_UDL is not set
+CONFIG_HYPERV=m
+CONFIG_HYPERV_STORAGE=m
+CONFIG_HYPERV_BLOCK=m
+CONFIG_HYPERV_NET=m
+# CONFIG_VME_BUS is not set
+
+#
+# RAR Register Driver
+#
+# CONFIG_RAR_REGISTER is not set
+# CONFIG_IIO is not set
CONFIG_X86_PLATFORM_DEVICES=y
CONFIG_ACER_WMI=m
CONFIG_ASUS_LAPTOP=m
diff --git a/main/linux-pae/r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch b/main/linux-pae/r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch
new file mode 100644
index 000000000..bd111e877
--- /dev/null
+++ b/main/linux-pae/r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch
@@ -0,0 +1,56 @@
+From patchwork Wed Jun 9 05:22:10 2010
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Subject: r8169: fix mdio_read and update mdio_write according to hw specs
+Date: Tue, 08 Jun 2010 19:22:10 -0000
+From: =?utf-8?b?VGltbyBUZXLDpHMgPHRpbW8udGVyYXNAaWtpLmZpPg==?=
+X-Patchwork-Id: 55049
+Message-Id: <1276060930-15697-1-git-send-email-timo.teras@iki.fi>
+To: netdev@vger.kernel.org
+Cc: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>,
+ Francois Romieu <romieu@fr.zoreil.com>, Hayeswang <hayeswang@realtek.com>
+
+Realtek confirmed that a 20us delay is needed after mdio_read and
+mdio_write operations. Reduce the delay in mdio_write, and add it
+to mdio_read too. Also add a comment that the 20us is from hw specs.
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+Cc: Francois Romieu <romieu@fr.zoreil.com>
+Cc: Hayeswang <hayeswang@realtek.com>
+
+---
+drivers/net/r8169.c | 12 +++++++++---
+ 1 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
+index 03a8318..96b6cfb 100644
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -560,10 +560,10 @@ static void mdio_write(void __iomem *ioaddr, int reg_addr, int value)
+ udelay(25);
+ }
+ /*
+- * Some configurations require a small delay even after the write
+- * completed indication or the next write might fail.
++ * According to hardware specs a 20us delay is required after write
++ * complete indication, but before sending next command.
+ */
+- udelay(25);
++ udelay(20);
+ }
+
+ static int mdio_read(void __iomem *ioaddr, int reg_addr)
+@@ -583,6 +583,12 @@ static int mdio_read(void __iomem *ioaddr, int reg_addr)
+ }
+ udelay(25);
+ }
++ /*
++ * According to hardware specs a 20us delay is required after read
++ * complete indication, but before sending next command.
++ */
++ udelay(20);
++
+ return value;
+ }
+
diff --git a/main/linux-pae/r8169-fix-random-mdio_write-failures.patch b/main/linux-pae/r8169-fix-random-mdio_write-failures.patch
new file mode 100644
index 000000000..1e2beadd0
--- /dev/null
+++ b/main/linux-pae/r8169-fix-random-mdio_write-failures.patch
@@ -0,0 +1,48 @@
+From 024a07bacf8287a6ddfa83e9d5b951c5e8b4070e Mon Sep 17 00:00:00 2001
+From: =?utf8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Sun, 6 Jun 2010 15:38:47 -0700
+Subject: [PATCH 1/1] r8169: fix random mdio_write failures
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf8
+Content-Transfer-Encoding: 8bit
+
+Some configurations need delay between the "write completed" indication
+and new write to work reliably.
+
+Realtek driver seems to use longer delay when polling the "write complete"
+bit, so it waits long enough between writes with high probability (but
+could probably break too). This patch adds a new udelay to make sure we
+wait unconditionally some time after the write complete indication.
+
+This caused a regression with XID 18000000 boards when the board specific
+phy configuration writing many mdio registers was added in commit
+2e955856ff (r8169: phy init for the 8169scd). Some of the configration
+mdio writes would almost always fail, and depending on failure might leave
+the PHY in non-working state.
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+Acked-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/r8169.c | 5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
+index 217e709..03a8318 100644
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -559,6 +559,11 @@ static void mdio_write(void __iomem *ioaddr, int reg_addr, int value)
+ break;
+ udelay(25);
+ }
++ /*
++ * Some configurations require a small delay even after the write
++ * completed indication or the next write might fail.
++ */
++ udelay(25);
+ }
+
+ static int mdio_read(void __iomem *ioaddr, int reg_addr)
+--
+1.7.1
+
diff --git a/main/linux-pae/x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch b/main/linux-pae/x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch
new file mode 100644
index 000000000..a4f94d7fa
--- /dev/null
+++ b/main/linux-pae/x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch
@@ -0,0 +1,48 @@
+From f1f6baf8f1df29be38003089787e378567ce0086 Mon Sep 17 00:00:00 2001
+From: H. Peter Anvin <hpa@zytor.com>
+Date: Wed, 17 Feb 2010 18:32:06 -0800
+Subject: [PATCH] x86, setup: When restoring the screen, update boot_params.screen_info
+
+When we restore the screen content after a mode change, we return the
+cursor to its former position. However, we need to also update
+boot_params.screen_info accordingly, so that the decompression code
+knows where on the screen the cursor is. Just in case the video BIOS
+does something extra screwy, read the cursor position back from the
+BIOS instead of relying on it doing the right thing.
+
+While we're at it, make sure we cap the cursor position to the new
+screen coordinates.
+
+Reported-by: Wim Osterholt <wim@djo.tudelft.nl>
+Bugzilla-Reference: http://bugzilla.kernel.org/show_bug.cgi?id=15329
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+---
+ arch/x86/boot/video.c | 7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
+index f767164..43eda28 100644
+--- a/arch/x86/boot/video.c
++++ b/arch/x86/boot/video.c
+@@ -298,11 +298,18 @@ static void restore_screen(void)
+ }
+
+ /* Restore cursor position */
++ if (saved.curx >= xs)
++ saved.curx = xs-1;
++ if (saved.cury >= ys)
++ saved.cury = ys-1;
++
+ initregs(&ireg);
+ ireg.ah = 0x02; /* Set cursor position */
+ ireg.dh = saved.cury;
+ ireg.dl = saved.curx;
+ intcall(0x10, &ireg, NULL);
++
++ store_cursor_position();
+ }
+
+ void set_video(void)
+--
+1.7.1
+
diff --git a/main/linux-pae/xfrm-fix-policy-unreferencing-on-larval-drop.patch b/main/linux-pae/xfrm-fix-policy-unreferencing-on-larval-drop.patch
new file mode 100644
index 000000000..25dc0dcdc
--- /dev/null
+++ b/main/linux-pae/xfrm-fix-policy-unreferencing-on-larval-drop.patch
@@ -0,0 +1,14 @@
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 31f4ba4..f4ea3a0 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1805,7 +1805,7 @@ restart:
+ /* EREMOTE tells the caller to generate
+ * a one-shot blackhole route. */
+ dst_release(dst);
+- xfrm_pols_put(pols, num_pols);
++ xfrm_pols_put(pols, drop_pols);
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
+ return -EREMOTE;
+ }
+