--- /dev/null
+From: Brandon Philips <bphilips@suse.de>
+Subject: Avoid oops on G33 in 1MB stolen Mem case
+References: bnc#391261
+Patch-Mainline: soon (see bug for ref)
+
+This is similar to f443675affe3f16dd428e46f0f7fd3f4d703eeab which was
+reverted because it broke with older XOrg driver. This patch only fixes
+the 1MB stolen case since it causes an oops due to a calculation
+problem.
+
+This will not work with older X drivers without the accompanying patch
+but I think avoiding an oops and making it possible to work with an
+up-to-date xorg driver is reasonable.
+
+Explanation of the oops:
+
+> static void intel_i830_init_gtt_entries(void)
+...
+> } else if (IS_G33) {
+> /* G33's GTT size defined in gmch_ctrl */
+> switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) {
+> case G33_PGETBL_SIZE_1M:
+> size = 1024;
+> break;
+...
+> size += 4;
+
+size = 1028
+
+Then since we have the BIOS setting 1MB for the device in the GMCH
+control we get to here:
+
+> } else {
+> switch (gmch_ctrl & I855_GMCH_GMS_MASK) {
+> case I855_GMCH_GMS_STOLEN_1M:
+> gtt_entries = MB(1) - KB(size);
+> break;
+
+MB(1) = 1 * 1024 * 1024
+KB(1028) = 1028 * 1024
+
+MB(1) - KB(1028) = -4096
+
+> gtt_entries /= KB(4);
+> intel_private.gtt_entries = gtt_entries;
+
+We end up with -1 in gtt_entries.
+
+This leads to intel_i915_configure reading/writing to areas outside of
+mapped memory and the oops.
+
+Signed-off-by: Brandon Philips <bphilips@suse.de>
+Acked-by: Thomas Renninger <trenn@suse.de>
+
+---
+ drivers/char/agp/intel-agp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -564,6 +564,13 @@ static void intel_i830_init_gtt_entries(
+ } else {
+ switch (gmch_ctrl & I855_GMCH_GMS_MASK) {
+ case I855_GMCH_GMS_STOLEN_1M:
++ if (IS_G33) {
++ size = 0;
++ printk(KERN_WARNING PFX
++ "Warning: G33 chipset with 1MB"
++ " allocated. Older X.org Intel drivers"
++ " will not work.\n");
++ }
+ gtt_entries = MB(1) - KB(size);
+ break;
+ case I855_GMCH_GMS_STOLEN_4M: