--- /dev/null
+--- kernel-power-2.6.28.orig/arch/arm/Kconfig
++++ kernel-power-2.6.28/arch/arm/Kconfig
+@@ -722,6 +722,22 @@
+
+ source "drivers/pcmcia/Kconfig"
+
++config ARM_ERRATA_430973
++ bool "ARM errata: Stale prediction on replaced interworking branch"
++ depends on CPU_V7
++ help
++ This option enables the workaround for the 430973 Cortex-A8
++ (r1p0..r1p2) erratum. If a code sequence containing an ARM/Thumb
++ interworking branch is replaced with another code sequence at the
++ same virtual address, whether due to self-modifying code or virtual
++ to physical address re-mapping, Cortex-A8 does not recover from the
++ stale interworking branch prediction. This results in Cortex-A8
++ executing the new code sequence in the incorrect ARM or Thumb state.
++ The workaround enables the BTB/BTAC operations by setting ACTLR.IBE
++ and also flushes the branch target cache at every context switch.
++ Note that setting specific bits in the ACTLR register may not be
++ available in non-secure mode.
++
+ endmenu
+
+ menu "Kernel Features"
+--- kernel-power-2.6.28.orig/arch/arm/mm/proc-v7.S
++++ kernel-power-2.6.28/arch/arm/mm/proc-v7.S
+@@ -90,7 +90,10 @@
+ #ifdef CONFIG_MMU
+ mov r2, #0
+ ldr r1, [r1, #MM_CONTEXT_ID] @ get mm->context.id
+- orr r0, r0, #TTB_RGN_OC_WB
++ orr r0, r0, #TTB_RGN_OC_WB @ mark PTWs outer cacheable, WB
++#ifdef CONFIG_ARM_ERRATA_430973
++ mcr p15, 0, r2, c7, c5, 6 @ flush BTAC/BTB
++#endif
+ mcr p15, 0, r2, c13, c0, 1 @ set reserved context ID
+ isb
+ 1: mcr p15, 0, r0, c2, c0, 0 @ set TTB 0
+@@ -171,6 +174,11 @@
+ stmia r12, {r0-r5, r7, r9, r11, lr}
+ bl v7_flush_dcache_all
+ ldmia r12, {r0-r5, r7, r9, r11, lr}
++#ifdef CONFIG_ARM_ERRATA_430973
++ mrc p15, 0, r10, c1, c0, 1 @ read aux control register
++ orr r10, r10, #(1 << 6) @ set IBE to 1
++ mcr p15, 0, r10, c1, c0, 1 @ write aux control register
++#endif
+ mov r10, #0
+ #ifdef HARVARD_CACHE
+ mcr p15, 0, r10, c7, c5, 0 @ I+BTB cache invalidate