--- /dev/null
+From 70264367a243a68b1d5636ffb570183449803cbe Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+Date: Mon, 18 Feb 2013 16:36:13 +0100
+Subject: ARM: 7653/2: do not scale loops_per_jiffy when using a constant delay clock
+
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+
+commit 70264367a243a68b1d5636ffb570183449803cbe upstream.
+
+When udelay() is implemented using an architected timer, it is wrong
+to scale loops_per_jiffy when changing the CPU clock frequency since
+the timer clock remains constant.
+
+The lpj should probably become an implementation detail relevant to
+the CPU loop based delay routine only and more confined to it. In the
+mean time this is the minimal fix needed to have expected delays with
+the timer based implementation when cpufreq is also in use.
+
+Reported-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Nicolas Pitre <nico@linaro.org>
+Tested-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Liviu Dudau <Liviu.Dudau@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/delay.h | 1 +
+ arch/arm/kernel/smp.c | 3 +++
+ arch/arm/lib/delay.c | 1 +
+ 3 files changed, 5 insertions(+)
+
+--- a/arch/arm/include/asm/delay.h
++++ b/arch/arm/include/asm/delay.h
+@@ -24,6 +24,7 @@ extern struct arm_delay_ops {
+ void (*delay)(unsigned long);
+ void (*const_udelay)(unsigned long);
+ void (*udelay)(unsigned long);
++ bool const_clock;
+ } arm_delay_ops;
+
+ #define __delay(n) arm_delay_ops.delay(n)
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -693,6 +693,9 @@ static int cpufreq_callback(struct notif
+ if (freq->flags & CPUFREQ_CONST_LOOPS)
+ return NOTIFY_OK;
+
++ if (arm_delay_ops.const_clock)
++ return NOTIFY_OK;
++
+ if (!per_cpu(l_p_j_ref, cpu)) {
+ per_cpu(l_p_j_ref, cpu) =
+ per_cpu(cpu_data, cpu).loops_per_jiffy;
+--- a/arch/arm/lib/delay.c
++++ b/arch/arm/lib/delay.c
+@@ -77,6 +77,7 @@ void __init register_current_timer_delay
+ arm_delay_ops.delay = __timer_delay;
+ arm_delay_ops.const_udelay = __timer_const_udelay;
+ arm_delay_ops.udelay = __timer_udelay;
++ arm_delay_ops.const_clock = true;
+ delay_calibrated = true;
+ } else {
+ pr_info("Ignoring duplicate/late registration of read_current_timer delay\n");
--- /dev/null
+From 69dde4c52dbac2891b49ff9723d9c84efc5baf6f Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Mon, 18 Feb 2013 17:51:20 +0100
+Subject: ARM: 7654/1: Preserve L_PTE_VALID in pte_modify()
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit 69dde4c52dbac2891b49ff9723d9c84efc5baf6f upstream.
+
+Following commit 26ffd0d4 (ARM: mm: introduce present, faulting entries
+for PAGE_NONE), if a page has been mapped as PROT_NONE, the L_PTE_VALID
+bit is cleared by the set_pte_ext() code. With LPAE the software and
+hardware pte share the same location and subsequent modifications of pte
+range (change_protection()) will leave the L_PTE_VALID bit cleared.
+
+This patch adds the L_PTE_VALID bit to the newprot mask in pte_modify().
+
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Reported-by: Subash Patel <subash.rp@samsung.com>
+Tested-by: Subash Patel <subash.rp@samsung.com>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/pgtable.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/include/asm/pgtable.h
++++ b/arch/arm/include/asm/pgtable.h
+@@ -240,7 +240,8 @@ static inline pte_t pte_mkspecial(pte_t
+
+ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
+ {
+- const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER | L_PTE_NONE;
++ const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER |
++ L_PTE_NONE | L_PTE_VALID;
+ pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
+ return pte;
+ }
--- /dev/null
+From b255188f90e2bade1bd11a986dd1ca4861869f4d Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Mon, 25 Feb 2013 16:10:42 +0000
+Subject: ARM: fix scheduling while atomic warning in alignment handling code
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit b255188f90e2bade1bd11a986dd1ca4861869f4d upstream.
+
+Paolo Pisati reports that IPv6 triggers this warning:
+
+BUG: scheduling while atomic: swapper/0/0/0x40000100
+Modules linked in:
+[<c001b1c4>] (unwind_backtrace+0x0/0xf0) from [<c0503c5c>] (__schedule_bug+0x48/0x5c)
+[<c0503c5c>] (__schedule_bug+0x48/0x5c) from [<c0508608>] (__schedule+0x700/0x740)
+[<c0508608>] (__schedule+0x700/0x740) from [<c007007c>] (__cond_resched+0x24/0x34)
+[<c007007c>] (__cond_resched+0x24/0x34) from [<c05086dc>] (_cond_resched+0x3c/0x44)
+[<c05086dc>] (_cond_resched+0x3c/0x44) from [<c0021f6c>] (do_alignment+0x178/0x78c)
+[<c0021f6c>] (do_alignment+0x178/0x78c) from [<c00083e0>] (do_DataAbort+0x34/0x98)
+[<c00083e0>] (do_DataAbort+0x34/0x98) from [<c0509a60>] (__dabt_svc+0x40/0x60)
+Exception stack(0xc0763d70 to 0xc0763db8)
+3d60: e97e805e e97e806e 2c000000 11000000
+3d80: ea86bb00 0000002c 00000011 e97e807e c076d2a8 e97e805e e97e806e 0000002c
+3da0: 3d000000 c0763dbc c04b98fc c02a8490 00000113 ffffffff
+[<c0509a60>] (__dabt_svc+0x40/0x60) from [<c02a8490>] (__csum_ipv6_magic+0x8/0xc8)
+
+Fix this by using probe_kernel_address() stead of __get_user().
+
+Reported-by: Paolo Pisati <p.pisati@gmail.com>
+Tested-by: Paolo Pisati <p.pisati@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/alignment.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -749,7 +749,6 @@ do_alignment(unsigned long addr, unsigne
+ unsigned long instr = 0, instrptr;
+ int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs);
+ unsigned int type;
+- mm_segment_t fs;
+ unsigned int fault;
+ u16 tinstr = 0;
+ int isize = 4;
+@@ -760,16 +759,15 @@ do_alignment(unsigned long addr, unsigne
+
+ instrptr = instruction_pointer(regs);
+
+- fs = get_fs();
+- set_fs(KERNEL_DS);
+ if (thumb_mode(regs)) {
+- fault = __get_user(tinstr, (u16 *)(instrptr & ~1));
++ u16 *ptr = (u16 *)(instrptr & ~1);
++ fault = probe_kernel_address(ptr, tinstr);
+ if (!fault) {
+ if (cpu_architecture() >= CPU_ARCH_ARMv7 &&
+ IS_T32(tinstr)) {
+ /* Thumb-2 32-bit */
+ u16 tinst2 = 0;
+- fault = __get_user(tinst2, (u16 *)(instrptr+2));
++ fault = probe_kernel_address(ptr + 1, tinst2);
+ instr = (tinstr << 16) | tinst2;
+ thumb2_32b = 1;
+ } else {
+@@ -778,8 +776,7 @@ do_alignment(unsigned long addr, unsigne
+ }
+ }
+ } else
+- fault = __get_user(instr, (u32 *)instrptr);
+- set_fs(fs);
++ fault = probe_kernel_address(instrptr, instr);
+
+ if (fault) {
+ type = TYPE_FAULT;
--- /dev/null
+From 5e4ba617c1b584b2e376f31a63bd4e734109318a Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Mon, 25 Feb 2013 16:09:12 +0000
+Subject: ARM: VFP: fix emulation of second VFP instruction
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 5e4ba617c1b584b2e376f31a63bd4e734109318a upstream.
+
+Martin Storsjö reports that the sequence:
+
+ ee312ac1 vsub.f32 s4, s3, s2
+ ee702ac0 vsub.f32 s5, s1, s0
+ e59f0028 ldr r0, [pc, #40]
+ ee111a90 vmov r1, s3
+
+on Raspberry Pi (implementor 41 architecture 1 part 20 variant b rev 5)
+where s3 is a denormal and s2 is zero results in incorrect behaviour -
+the instruction "vsub.f32 s5, s1, s0" is not executed:
+
+ VFP: bounce: trigger ee111a90 fpexc d0000780
+ VFP: emulate: INST=0xee312ac1 SCR=0x00000000
+ ...
+
+As we can see, the instruction triggering the exception is the "vmov"
+instruction, and we emulate the "vsub.f32 s4, s3, s2" but fail to
+properly take account of the FPEXC_FP2V flag in FPEXC. This is because
+the test for the second instruction register being valid is bogus, and
+will always skip emulation of the second instruction.
+
+Reported-by: Martin Storsjö <martin@martin.st>
+Tested-by: Martin Storsjö <martin@martin.st>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/vfp/vfpmodule.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -413,7 +413,7 @@ void VFP_bounce(u32 trigger, u32 fpexc,
+ * If there isn't a second FP instruction, exit now. Note that
+ * the FPEXC.FP2V bit is valid only if FPEXC.EX is 1.
+ */
+- if (fpexc ^ (FPEXC_EX | FPEXC_FP2V))
++ if ((fpexc & (FPEXC_EX | FPEXC_FP2V)) != (FPEXC_EX | FPEXC_FP2V))
+ goto exit;
+
+ /*
--- /dev/null
+arm-vfp-fix-emulation-of-second-vfp-instruction.patch
+arm-fix-scheduling-while-atomic-warning-in-alignment-handling-code.patch
+arm-7653-2-do-not-scale-loops_per_jiffy-when-using-a-constant-delay-clock.patch
+arm-7654-1-preserve-l_pte_valid-in-pte_modify.patch