--- /dev/null
+From linux-kernel-owner+greg=40kroah.com-S1761718AbYBOT7Z@vger.kernel.org Fri Feb 15 12:00:56 2008
+From: Ingo Molnar <mingo@elte.hu>
+Date: Fri, 15 Feb 2008 20:58:54 +0100
+Subject: x86_64: CPA, fix cache attribute inconsistency bug
+To: stable@kernel.org
+Cc: linux-kernel@vger.kernel.org, Thomas Gleixner <tglx@linutronix.de>, Andi Kleen <andi@firstfloor.org>
+Message-ID: <20080215195854.GB15432@elte.hu>
+Content-Disposition: inline
+
+From: Ingo Molnar <mingo@elte.hu>
+
+no upstream git id as the code has been rewritten.
+
+fix CPA cache attribute bug in v2.6.23. When phys_base is nonzero
+(when CONFIG_RELOCATABLE=y) then change_page_attr_addr() miscalculates
+the secondary alias address by -14 MB (depending on the configured
+offset).
+
+The default 64-bit kernels of Fedora and Ubuntu are affected:
+
+ $ grep RELOCA /boot/config-2.6.23.9-85.fc8
+ CONFIG_RELOCATABLE=y
+
+ $ grep RELOC /boot/config-2.6.22-14-generic
+ CONFIG_RELOCATABLE=y
+
+and probably on many other distros as well.
+
+the bug affects all pages in the first 40 MB of physical RAM that
+are allocated by some subsystem that does ioremap_nocache() on them:
+
+ if (__pa(address) < KERNEL_TEXT_SIZE) {
+
+Hence we might leave page table entries with inconsistent cache
+attributes around (pages mapped at both UnCacheable and Write-Back),
+and we can also set the wrong kernel text pages to UnCacheable.
+
+the effects of this bug can be random slowdowns and other misbehavior.
+If for example AGP allocates its aperture pages into the first 40 MB
+of physical RAM, then the -14 MB bug might mark random kernel texto
+pages as uncacheable, slowing down a random portion of the 64-bit
+kernel until the AGP driver is unloaded.
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86_64/mm/pageattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86_64/mm/pageattr.c
++++ b/arch/x86_64/mm/pageattr.c
+@@ -207,7 +207,7 @@ int change_page_attr_addr(unsigned long
+ if (__pa(address) < KERNEL_TEXT_SIZE) {
+ unsigned long addr2;
+ pgprot_t prot2;
+- addr2 = __START_KERNEL_map + __pa(address);
++ addr2 = __START_KERNEL_map + __pa(address) - phys_base;
+ /* Make sure the kernel mappings stay executable */
+ prot2 = pte_pgprot(pte_mkexec(pfn_pte(0, prot)));
+ err = __change_page_attr(addr2, pfn, prot2,