main/linux-pae: upgrade to .15 and sync up with linux-grsec

9 files changed, 251 insertions, 226 deletions

diff --git a/main/linux-pae/0005-r8169-fix-broken-register-writes.patch b/main/linux-pae/0005-r8169-fix-broken-register-writes.patch
deleted file mode 100644
index bfa8df290..000000000
--- a/main/linux-pae/0005-r8169-fix-broken-register-writes.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 89f350c4ec426b4c1db6ef269546940365d918e1 Mon Sep 17 00:00:00 2001
-From: Francois Romieu <romieu@fr.zoreil.com>
-Date: Sat, 27 Mar 2010 19:35:46 -0700
-Subject: [PATCH 05/18] r8169: fix broken register writes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is quite similar to b39fe41f481d20c201012e4483e76c203802dda7
-though said registers are not even documented as 64-bit registers
-- as opposed to the initial TxDescStartAddress ones - but as single
-bytes which must be combined into 32 bits at the MMIO read/write
-level before being merged into a 64 bit logical entity.
-
-Credits go to Ben Hutchings <ben@decadent.org.uk> for the MAR
-registers (aka "multicast is broken for ages on ARM) and to
-Timo Teräs <timo.teras@iki.fi> for the MAC registers.
-
-Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-(cherry picked from commit 78f1cd02457252e1ffbc6caa44a17424a45286b8)
----
- drivers/net/r8169.c |    4 ++--
- 1 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 0fe2fc9..24599b5 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -2827,8 +2827,8 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
- 	spin_lock_irq(&tp->lock);
- 
- 	RTL_W8(Cfg9346, Cfg9346_Unlock);
--	RTL_W32(MAC0, low);
- 	RTL_W32(MAC4, high);
-+	RTL_W32(MAC0, low);
- 	RTL_W8(Cfg9346, Cfg9346_Lock);
- 
- 	spin_unlock_irq(&tp->lock);
-@@ -4795,8 +4795,8 @@ static void rtl_set_rx_mode(struct net_device *dev)
- 		mc_filter[1] = swab32(data);
- 	}
- 
--	RTL_W32(MAR0 + 0, mc_filter[0]);
- 	RTL_W32(MAR0 + 4, mc_filter[1]);
-+	RTL_W32(MAR0 + 0, mc_filter[0]);
- 
- 	RTL_W32(RxConfig, tmp);
- 
--- 
-1.7.0.2
-
diff --git a/main/linux-pae/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch b/main/linux-pae/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
deleted file mode 100644
index 03ea13fa1..000000000
--- a/main/linux-pae/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From a60cfaf3df9cd0cddbc24695434ed5bfa917d505 Mon Sep 17 00:00:00 2001
-From: Neil Horman <nhorman@redhat.com>
-Date: Mon, 29 Mar 2010 13:16:02 -0700
-Subject: [PATCH 06/18] r8169: offical fix for CVE-2009-4537 (overlength frame DMAs)
-
-Official patch to fix the r8169 frame length check error.
-
-Based on this initial thread:
-http://marc.info/?l=linux-netdev&m=126202972828626&w=1
-This is the official patch to fix the frame length problems in the r8169
-driver.  As noted in the previous thread, while this patch incurs a performance
-hit on the driver, its possible to improve performance dynamically by updating
-the mtu and rx_copybreak values at runtime to return performance to what it was
-for those NICS which are unaffected by the ideosyncracy (if there are any).
-
-Summary:
-
-    A while back Eric submitted a patch for r8169 in which the proper
-allocated frame size was written to RXMaxSize to prevent the NIC from dmaing too
-much data.  This was done in commit fdd7b4c3302c93f6833e338903ea77245eb510b4.  A
-long time prior to that however, Francois posted
-126fa4b9ca5d9d7cb7d46f779ad3bd3631ca387c, which expiclitly disabled the MaxSize
-setting due to the fact that the hardware behaved in odd ways when overlong
-frames were received on NIC's supported by this driver.  This was mentioned in a
-security conference recently:
-http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html
-
-It seems that if we can't enable frame size filtering, then, as Eric correctly
-noticed, we can find ourselves DMA-ing too much data to a buffer, causing
-corruption.  As a result is seems that we are forced to allocate a frame which
-is ready to handle a maximally sized receive.
-
-This obviously has performance issues with it, so to mitigate that issue, this
-patch does two things:
-
-1) Raises the copybreak value to the frame allocation size, which should force
-appropriately sized packets to get allocated on rx, rather than a full new 16k
-buffer.
-
-2) This patch only disables frame filtering initially (i.e., during the NIC
-open), changing the MTU results in ring buffer allocation of a size in relation
-to the new mtu (along with a warning indicating that this is dangerous).
-
-Because of item (2), individuals who can't cope with the performance hit (or can
-otherwise filter frames to prevent the bug), or who have hardware they are sure
-is unaffected by this issue, can manually lower the copybreak and reset the mtu
-such that performance is restored easily.
-
-Signed-off-by: Neil Horman <nhorman@redhat.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-(cherry picked from commit c0cd884af045338476b8e69a61fceb3f34ff22f1)
----
- drivers/net/r8169.c |   29 ++++++++++++++++++++++++-----
- 1 files changed, 24 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 24599b5..1484528 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -186,7 +186,12 @@ static struct pci_device_id rtl8169_pci_tbl[] = {
- 
- MODULE_DEVICE_TABLE(pci, rtl8169_pci_tbl);
- 
--static int rx_copybreak = 200;
-+/*
-+ * we set our copybreak very high so that we don't have
-+ * to allocate 16k frames all the time (see note in
-+ * rtl8169_open()
-+ */
-+static int rx_copybreak = 16383;
- static int use_dac;
- static struct {
- 	u32 msg_enable;
-@@ -3245,9 +3250,13 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
- }
- 
- static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
--				  struct net_device *dev)
-+				  unsigned int mtu)
- {
--	unsigned int max_frame = dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
-+	unsigned int max_frame = mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
-+
-+	if (max_frame != 16383)
-+		printk(KERN_WARNING "WARNING! Changing of MTU on this NIC"
-+			"May lead to frame reception errors!\n");
- 
- 	tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
- }
-@@ -3259,7 +3268,17 @@ static int rtl8169_open(struct net_device *dev)
- 	int retval = -ENOMEM;
- 
- 
--	rtl8169_set_rxbufsize(tp, dev);
-+	/*
-+	 * Note that we use a magic value here, its wierd I know
-+	 * its done because, some subset of rtl8169 hardware suffers from
-+	 * a problem in which frames received that are longer than
-+	 * the size set in RxMaxSize register return garbage sizes
-+	 * when received.  To avoid this we need to turn off filtering,
-+	 * which is done by setting a value of 16383 in the RxMaxSize register
-+	 * and allocating 16k frames to handle the largest possible rx value
-+	 * thats what the magic math below does.
-+	 */
-+	rtl8169_set_rxbufsize(tp, 16383 - VLAN_ETH_HLEN - ETH_FCS_LEN);
- 
- 	/*
- 	 * Rx and Tx desscriptors needs 256 bytes alignment.
-@@ -3912,7 +3931,7 @@ static int rtl8169_change_mtu(struct net_device *dev, int new_mtu)
- 
- 	rtl8169_down(dev);
- 
--	rtl8169_set_rxbufsize(tp, dev);
-+	rtl8169_set_rxbufsize(tp, dev->mtu);
- 
- 	ret = rtl8169_init_ring(dev);
- 	if (ret < 0)
--- 
-1.7.0.2
-
diff --git a/main/linux-pae/0008-r8169-clean-up-my-printk-uglyness.patch b/main/linux-pae/0008-r8169-clean-up-my-printk-uglyness.patch
deleted file mode 100644
index dff3fd211..000000000
--- a/main/linux-pae/0008-r8169-clean-up-my-printk-uglyness.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From d1c9ac562923fa0b1738fceb4c7bafac3ab936ba Mon Sep 17 00:00:00 2001
-From: Neil Horman <nhorman@tuxdriver.com>
-Date: Thu, 1 Apr 2010 07:30:07 +0000
-Subject: [PATCH 08/18] r8169: clean up my printk uglyness
-
-Fix formatting on r8169 printk
-
-Brandon Philips noted that I had a spacing issue in my printk for the
-last r8169 patch that made it quite ugly.  Fix that up and add the PFX
-macro to it as well so it looks like the other r8169 printks
-
-Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-(cherry picked from commit 93f4d91d879acfcb0ba9c2725e3133fcff2dfd1e)
----
- drivers/net/r8169.c |    4 ++--
- 1 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index bed1d47..790555e 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -3255,8 +3255,8 @@ static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
- 	unsigned int max_frame = mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
- 
- 	if (max_frame != 16383)
--		printk(KERN_WARNING "WARNING! Changing of MTU on this NIC"
--			"May lead to frame reception errors!\n");
-+		printk(KERN_WARNING PFX "WARNING! Changing of MTU on this "
-+			"NIC may lead to frame reception errors!\n");
- 
- 	tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
- }
--- 
-1.7.0.2
-
diff --git a/main/linux-pae/APKBUILD b/main/linux-pae/APKBUILD
index 95d20f1ac..fa5b0431d 100644
--- a/main/linux-pae/APKBUILD
+++ b/main/linux-pae/APKBUILD
@@ -2,9 +2,9 @@
 
 _flavor=pae
 pkgname=linux-${_flavor}
-pkgver=2.6.32.11
+pkgver=2.6.32.15
 _kernver=2.6.32
-pkgrel=1
+pkgrel=0
 pkgdesc="Linux kernel with PAE enabled"
 url=http://www.kernel.org
 depends="mkinitfs linux-firmware"
@@ -17,10 +17,7 @@ source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	0002-gre-fix-hard-header-destination-address-checking.patch
 	0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
 	0004-arp-flush-arp-cache-on-device-change.patch
-	0005-r8169-fix-broken-register-writes.patch
-	0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
 	0007-r8169-Fix-rtl8169_rx_interrupt.patch
-	0008-r8169-clean-up-my-printk-uglyness.patch
 	0009-ipsec-Fix-bogus-bundle-flowi.patch
 	0010-xfrm-Remove-xfrm_state_genid.patch
 	0011-xfrm_user-verify-policy-direction-at-XFRM_MSG_POLEXP.patch
@@ -31,6 +28,10 @@ source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	0016-xfrm-remove-policy-garbage-collection.patch
 	0017-flow-delayed-deletion-of-flow-cache-entries.patch
 	0018-xfrm-Fix-crashes-in-xfrm_lookup.patch
+	xfrm-fix-policy-unreferencing-on-larval-drop.patch
+	r8169-fix-random-mdio_write-failures.patch
+	r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch
+	x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch
 	kernelconfig.x86
 	"
 subpackages="$pkgname-dev"
@@ -44,10 +45,14 @@ prepare() {
 		bunzip2 -c < ../patch-$pkgver.bz2 | patch -p1 -N || return 1
 	fi
 
-	for i in ../*.diff ../*.patch; do
-		[ -f $i ] || continue
-		msg "Applying $i..."
-		patch -s -p1 -N < $i || return 1
+	# first apply patches in specified order
+	for i in $source; do
+		case $i in
+		*.patch)
+			msg "Applying $i..."
+			patch -s -p1 -N < "$srcdir"/$i || return 1
+			;;
+		esac
 	done
 
 	mkdir -p "$srcdir"/build
@@ -66,7 +71,9 @@ menuconfig() {
 
 build() {
 	cd "$srcdir"/build
-	make CC="${CC:-gcc}" || return 1
+	make CC="${CC:--gcc}" \
+		KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-Alpine" \
+		|| return 1
 }
 
 package() {
@@ -131,14 +138,11 @@ dev() {
 }
 
 md5sums="260551284ac224c3a43c4adac7df4879  linux-2.6.32.tar.bz2
-855c248334a71ef5ca3d8cb89d51334f  patch-2.6.32.11.bz2
+5c9251844c2819eddee4dba1293bd46d  patch-2.6.32.15.bz2
 437317f88ec13ace8d39c31983a41696  0002-gre-fix-hard-header-destination-address-checking.patch
 151b29a161178ed39d62a08f21f3484d  0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
 776adeeb5272093574f8836c5037dd7d  0004-arp-flush-arp-cache-on-device-change.patch
-afa06334c81f21c20571286a83d3d928  0005-r8169-fix-broken-register-writes.patch
-c538c0f735d79fd71b47dde02bf1f790  0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
 5f8b9a76d95319c5b1aa26b54a42e6b5  0007-r8169-Fix-rtl8169_rx_interrupt.patch
-f878c802700e3babd03be3505119c5c2  0008-r8169-clean-up-my-printk-uglyness.patch
 cf168620efa63479a6e03da78906e32f  0009-ipsec-Fix-bogus-bundle-flowi.patch
 3af4b5ae1afae3278b0070f585b874e3  0010-xfrm-Remove-xfrm_state_genid.patch
 9f284c3fd5ab38cef4544efc1f50c6ba  0011-xfrm_user-verify-policy-direction-at-XFRM_MSG_POLEXP.patch
@@ -149,4 +153,8 @@ c09b82b89a49ba2a3836a0bc3a3312f4  0015-xfrm-cache-bundles-instead-of-policies-fo
 41618efb65ab9ddacfb59a1cde9b4edd  0016-xfrm-remove-policy-garbage-collection.patch
 3b83f0972ab715819d1119b120a987e7  0017-flow-delayed-deletion-of-flow-cache-entries.patch
 45a676c7a1759fec60b724d557b4e295  0018-xfrm-Fix-crashes-in-xfrm_lookup.patch
-bf15e3ee69e03319dab0d59e08b67195  kernelconfig.x86"
+c7e606c11c05ff03012b21c3fe0ece47  xfrm-fix-policy-unreferencing-on-larval-drop.patch
+ce4a74190febe13713bab1b886dd5bee  r8169-fix-random-mdio_write-failures.patch
+b41ee19f13498fb25992fd60cd1126d4  r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch
+a1bcf76870b63a4a4035a8948fb758e2  x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch
+970a1dc0f8c6c3e3227a77934eafd68e  kernelconfig.x86"
diff --git a/main/linux-pae/kernelconfig.x86 b/main/linux-pae/kernelconfig.x86
index 2b424ce7b..951f1f886 100644
--- a/main/linux-pae/kernelconfig.x86
+++ b/main/linux-pae/kernelconfig.x86
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.32.10
-# Tue Mar 23 13:08:19 2010
+# Linux kernel version: 2.6.32.15
+# Thu Jun 10 08:10:37 2010
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -311,6 +311,7 @@ CONFIG_ARCH_PHYS_ADDR_T_64BIT=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ILLEGAL_POINTER_VALUE=0
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
 # CONFIG_DISCONTIGMEM_MANUAL is not set
@@ -3959,7 +3960,65 @@ CONFIG_XEN_DEV_EVTCHN=y
 CONFIG_XENFS=y
 CONFIG_XEN_COMPAT_XENFS=y
 CONFIG_XEN_SYS_HYPERVISOR=y
-# CONFIG_STAGING is not set
+CONFIG_STAGING=y
+# CONFIG_STAGING_EXCLUDE_BUILD is not set
+# CONFIG_ET131X is not set
+# CONFIG_SLICOSS is not set
+# CONFIG_VIDEO_GO7007 is not set
+# CONFIG_VIDEO_CX25821 is not set
+# CONFIG_USB_IP_COMMON is not set
+# CONFIG_W35UND is not set
+# CONFIG_PRISM2_USB is not set
+# CONFIG_ECHO is not set
+# CONFIG_POCH is not set
+# CONFIG_OTUS is not set
+# CONFIG_RT2860 is not set
+# CONFIG_RT2870 is not set
+# CONFIG_RT3090 is not set
+# CONFIG_COMEDI is not set
+# CONFIG_ASUS_OLED is not set
+# CONFIG_PANEL is not set
+# CONFIG_ALTERA_PCIE_CHDMA is not set
+# CONFIG_RTL8187SE is not set
+# CONFIG_RTL8192SU is not set
+# CONFIG_RTL8192E is not set
+# CONFIG_TRANZPORT is not set
+
+#
+# Android
+#
+
+#
+# Qualcomm MSM Camera And Video
+#
+
+#
+# Camera Sensor Selection
+#
+# CONFIG_INPUT_GPIO is not set
+# CONFIG_DST is not set
+# CONFIG_POHMELFS is not set
+# CONFIG_B3DFG is not set
+# CONFIG_IDE_PHISON is not set
+# CONFIG_PLAN9AUTH is not set
+# CONFIG_LINE6_USB is not set
+# CONFIG_DRM_RADEON_KMS is not set
+# CONFIG_USB_SERIAL_QUATECH2 is not set
+# CONFIG_USB_SERIAL_QUATECH_USB2 is not set
+# CONFIG_VT6655 is not set
+# CONFIG_VT6656 is not set
+# CONFIG_FB_UDL is not set
+CONFIG_HYPERV=m
+CONFIG_HYPERV_STORAGE=m
+CONFIG_HYPERV_BLOCK=m
+CONFIG_HYPERV_NET=m
+# CONFIG_VME_BUS is not set
+
+#
+# RAR Register Driver
+#
+# CONFIG_RAR_REGISTER is not set
+# CONFIG_IIO is not set
 CONFIG_X86_PLATFORM_DEVICES=y
 CONFIG_ACER_WMI=m
 CONFIG_ASUS_LAPTOP=m
diff --git a/main/linux-pae/r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch b/main/linux-pae/r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch
new file mode 100644
index 000000000..bd111e877
--- /dev/null
+++ b/main/linux-pae/r8169-fix-mdio_read-and-update-mdio_write-according-to-hw-specs.patch
@@ -0,0 +1,56 @@
+From patchwork Wed Jun  9 05:22:10 2010
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Subject: r8169: fix mdio_read and update mdio_write according to hw specs
+Date: Tue, 08 Jun 2010 19:22:10 -0000
+From: =?utf-8?b?VGltbyBUZXLDpHMgPHRpbW8udGVyYXNAaWtpLmZpPg==?=
+X-Patchwork-Id: 55049
+Message-Id: <1276060930-15697-1-git-send-email-timo.teras@iki.fi>
+To: netdev@vger.kernel.org
+Cc: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>,
+	Francois Romieu <romieu@fr.zoreil.com>, Hayeswang <hayeswang@realtek.com>
+
+Realtek confirmed that a 20us delay is needed after mdio_read and
+mdio_write operations. Reduce the delay in mdio_write, and add it
+to mdio_read too. Also add a comment that the 20us is from hw specs.
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+Cc: Francois Romieu <romieu@fr.zoreil.com>
+Cc: Hayeswang <hayeswang@realtek.com>
+
+---
+drivers/net/r8169.c |   12 +++++++++---
+ 1 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
+index 03a8318..96b6cfb 100644
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -560,10 +560,10 @@ static void mdio_write(void __iomem *ioaddr, int reg_addr, int value)
+ 		udelay(25);
+ 	}
+ 	/*
+-	 * Some configurations require a small delay even after the write
+-	 * completed indication or the next write might fail.
++	 * According to hardware specs a 20us delay is required after write
++	 * complete indication, but before sending next command.
+ 	 */
+-	udelay(25);
++	udelay(20);
+ }
+ 
+ static int mdio_read(void __iomem *ioaddr, int reg_addr)
+@@ -583,6 +583,12 @@ static int mdio_read(void __iomem *ioaddr, int reg_addr)
+ 		}
+ 		udelay(25);
+ 	}
++	/*
++	 * According to hardware specs a 20us delay is required after read
++	 * complete indication, but before sending next command.
++	 */
++	udelay(20);
++
+ 	return value;
+ }
+ 
diff --git a/main/linux-pae/r8169-fix-random-mdio_write-failures.patch b/main/linux-pae/r8169-fix-random-mdio_write-failures.patch
new file mode 100644
index 000000000..1e2beadd0
--- /dev/null
+++ b/main/linux-pae/r8169-fix-random-mdio_write-failures.patch
@@ -0,0 +1,48 @@
+From 024a07bacf8287a6ddfa83e9d5b951c5e8b4070e Mon Sep 17 00:00:00 2001
+From: =?utf8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Sun, 6 Jun 2010 15:38:47 -0700
+Subject: [PATCH 1/1] r8169: fix random mdio_write failures
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf8
+Content-Transfer-Encoding: 8bit
+
+Some configurations need delay between the "write completed" indication
+and new write to work reliably.
+
+Realtek driver seems to use longer delay when polling the "write complete"
+bit, so it waits long enough between writes with high probability (but
+could probably break too). This patch adds a new udelay to make sure we
+wait unconditionally some time after the write complete indication.
+
+This caused a regression with XID 18000000 boards when the board specific
+phy configuration writing many mdio registers was added in commit
+2e955856ff (r8169: phy init for the 8169scd). Some of the configration
+mdio writes would almost always fail, and depending on failure might leave
+the PHY in non-working state.
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+Acked-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/r8169.c |    5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
+index 217e709..03a8318 100644
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -559,6 +559,11 @@ static void mdio_write(void __iomem *ioaddr, int reg_addr, int value)
+ 			break;
+ 		udelay(25);
+ 	}
++	/*
++	 * Some configurations require a small delay even after the write
++	 * completed indication or the next write might fail.
++	 */
++	udelay(25);
+ }
+ 
+ static int mdio_read(void __iomem *ioaddr, int reg_addr)
+-- 
+1.7.1
+
diff --git a/main/linux-pae/x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch b/main/linux-pae/x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch
new file mode 100644
index 000000000..a4f94d7fa
--- /dev/null
+++ b/main/linux-pae/x86-setup-When-restoring-the-screen-update-boot_params-screen_info.patch
@@ -0,0 +1,48 @@
+From f1f6baf8f1df29be38003089787e378567ce0086 Mon Sep 17 00:00:00 2001
+From: H. Peter Anvin <hpa@zytor.com>
+Date: Wed, 17 Feb 2010 18:32:06 -0800
+Subject: [PATCH] x86, setup: When restoring the screen, update boot_params.screen_info
+
+When we restore the screen content after a mode change, we return the
+cursor to its former position.  However, we need to also update
+boot_params.screen_info accordingly, so that the decompression code
+knows where on the screen the cursor is.  Just in case the video BIOS
+does something extra screwy, read the cursor position back from the
+BIOS instead of relying on it doing the right thing.
+
+While we're at it, make sure we cap the cursor position to the new
+screen coordinates.
+
+Reported-by: Wim Osterholt <wim@djo.tudelft.nl>
+Bugzilla-Reference: http://bugzilla.kernel.org/show_bug.cgi?id=15329
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+---
+ arch/x86/boot/video.c |    7 +++++++
+ 1 files changed, 7 insertions(+), 0 deletions(-)
+
+diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
+index f767164..43eda28 100644
+--- a/arch/x86/boot/video.c
++++ b/arch/x86/boot/video.c
+@@ -298,11 +298,18 @@ static void restore_screen(void)
+ 	}
+ 
+ 	/* Restore cursor position */
++	if (saved.curx >= xs)
++		saved.curx = xs-1;
++	if (saved.cury >= ys)
++		saved.cury = ys-1;
++
+ 	initregs(&ireg);
+ 	ireg.ah = 0x02;		/* Set cursor position */
+ 	ireg.dh = saved.cury;
+ 	ireg.dl = saved.curx;
+ 	intcall(0x10, &ireg, NULL);
++
++	store_cursor_position();
+ }
+ 
+ void set_video(void)
+-- 
+1.7.1
+
diff --git a/main/linux-pae/xfrm-fix-policy-unreferencing-on-larval-drop.patch b/main/linux-pae/xfrm-fix-policy-unreferencing-on-larval-drop.patch
new file mode 100644
index 000000000..25dc0dcdc
--- /dev/null
+++ b/main/linux-pae/xfrm-fix-policy-unreferencing-on-larval-drop.patch
@@ -0,0 +1,14 @@
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 31f4ba4..f4ea3a0 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1805,7 +1805,7 @@ restart:
+ 			/* EREMOTE tells the caller to generate
+ 			 * a one-shot blackhole route. */
+ 			dst_release(dst);
+-			xfrm_pols_put(pols, num_pols);
++			xfrm_pols_put(pols, drop_pols);
+ 			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
+ 			return -EREMOTE;
+ 		}
+