diff --git a/kernel.spec b/kernel.spec
index 40edd5b..a994055 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -755,6 +755,7 @@ Patch12270: kvm-mmu-fix-conflict-access-permissions-in-direct-sp.patch
 Patch12400: input-synaptics-relax-capability-id-checks-on-new-hardware.patch
 
 Patch12410: cifs-fix-dns-resolver.patch
+Patch12420: matroxfb-fix-font-corruption.patch
 
 %endif
 
@@ -1398,6 +1399,9 @@ ApplyPatch input-synaptics-relax-capability-id-checks-on-new-hardware.patch
 # Remove __init and __exit attributes from resolver code
 ApplyPatch cifs-fix-dns-resolver.patch
 
+# RHBZ #617687
+ApplyPatch matroxfb-fix-font-corruption.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2021,6 +2025,7 @@ fi
 - Linux 2.6.34.2
 - Drop commented-out patches.
 - Drop ancient linux-2.6-mac80211-age-scan-results-on-resume.patch
+- Fix matroxfb font corruption (#617687)
 
 * Sun Aug 01 2010 Chuck Ebbert <cebbert@redhat.com>  2.6.34.2-32.rc1
 - Linux 2.6.34.2-rc1
diff --git a/matroxfb-fix-font-corruption.patch b/matroxfb-fix-font-corruption.patch
new file mode 100644
index 0000000..a3f03a5
--- /dev/null
+++ b/matroxfb-fix-font-corruption.patch
@@ -0,0 +1,23 @@
+Fix incorrect use of memcpy_toio() in matroxfb that broke in 2.6.34.
+
+Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
+
+--- linux-2.6.35-rc2/drivers/video/matrox/matroxfb_base.h	2010-06-06 05:43:24.000000000 +0200
++++ linux-2.6.35-rc3/drivers/video/matrox/matroxfb_base.h	2010-08-03 18:13:46.000000000 +0200
+@@ -151,13 +151,13 @@ static inline void mga_writel(vaddr_t va
+ static inline void mga_memcpy_toio(vaddr_t va, const void* src, int len) {
+ #if defined(__alpha__) || defined(__i386__) || defined(__x86_64__)
+ 	/*
+-	 * memcpy_toio works for us if:
++	 * iowrite32_rep works for us if:
+ 	 *  (1) Copies data as 32bit quantities, not byte after byte,
+ 	 *  (2) Performs LE ordered stores, and
+ 	 *  (3) It copes with unaligned source (destination is guaranteed to be page
+ 	 *      aligned and length is guaranteed to be multiple of 4).
+ 	 */
+-	memcpy_toio(va.vaddr, src, len);
++	iowrite32_rep(va.vaddr, src, len >> 2);
+ #else
+         u_int32_t __iomem* addr = va.vaddr;
+ 
+