Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  lockdep: fix irqs on/off ip tracing
  lockdep: minor fix for debug_show_all_locks()
  x86: restore the old swiotlb alloc_coherent behavior
  x86: use GFP_DMA for 24bit coherent_dma_mask
  swiotlb: remove panic for alloc_coherent failure
  xen: compilation fix of drivers/xen/events.c on IA64
  xen: portability clean up and some minor clean up for xencomm.c
  xen: don't reload cr3 on suspend
  kernel/resource: fix reserve_region_with_split() section mismatch
  printk: remove unused code from kernel/printk.c

Merge branch 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  irq: make variable static

Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  sched: fix documentation reference for sched_min_granularity_ns
  sched: virtual time buddy preemption
  sched: re-instate vruntime based wakeup preemption
  sched: weaken sync hint
  sched: more accurate min_vruntime accounting
  sched: fix a find_busiest_group buglet
  sched: add CONFIG_SMP consistency

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86, memory hotplug: remove wrong -1 in calling init_memory_mapping()
  x86: keep the /proc/meminfo page count correct
  x86/uv: memory allocation at initialization
  xen: fix Xen domU boot with batched mprotect

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] s390: Fix build for !CONFIG_S390_GUEST + CONFIG_VIRTIO_CONSOLE
  [S390] No more 4kb stacks.
  [S390] Change default IPL method to IPL_VM.
  [S390] tape: disable interrupts in tape_open and tape_release
  [S390] appldata: unsigned ops->size cannot be negative
  [S390] tape block: complete request with correct locking
  [S390] Fix sysdev class file creation.
  [S390] pgtables: Fix race in enable_sie vs. page table ops
  [S390] qdio: remove incorrect memset
  [S390] qdio: prevent double qdio shutdown in case of I/O errors

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata: ahci enclosure management bit mask
  libata: ahci enclosure management led sync
  pata_ninja32: suspend/resume support
  libata: Fix LBA48 on pata_it821x RAID volumes.
  libata: clear saved xfer_mode and ncq_enabled on device detach
  sata_sil24: configure max read request size to 4k
  libata: add missing kernel-doc
  libata: fix device iteration bugs
  ahci: Add support for Promise PDC42819
  ata: Switch all my stuff to a common address

Impact: fix lockdep lock-api-caller output when irqsoff tracing is enabled

81d68a96 "ftrace: trace irq disabled critical timings" added wrappers around
trace_hardirqs_on/off_caller. However these functions use
__builtin_return_address(0) to figure out which function actually disabled
or enabled irqs. The result is that we save the ips of trace_hardirqs_on/off
instead of the real caller. Not very helpful.

However since the patch from Steven the ip already gets passed. So use that
and get rid of __builtin_return_address(0) in these two functions.
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

The s390 kernel does not compile if virtio console is enabled, but guest
support is disabled:

  LD      .tmp_vmlinux1
arch/s390/kernel/built-in.o: In function `setup_arch':
/space/linux-2.5/arch/s390/kernel/setup.c:773: undefined reference to
`s390_virtio_console_init'

The fix is related to
commit 99e65c92
Author: Christian Borntraeger <borntraeger@de.ibm.com>
Date:   Fri Jul 25 15:50:04 2008 +0200
    KVM: s390: Fix guest kconfig

Which changed the build process to build kvm_virtio.c only if CONFIG_S390_GUEST
is set. We must ifdef the prototype in the header file accordingly.
Reported-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

We got a stack overflow with a small stack configuration on a 32 bit
system. It just looks like as 4kb isn't enough and too dangerous.
So lets get rid of 4kb stacks on 32 bit.

But one thing I completely dislike about the call trace below is that
just for debugging or tracing purposes sprintf gets called (cio_start_key):

	/* process condition code */
	sprintf(dbf_txt, "ccode:%d", ccode);
	CIO_TRACE_EVENT(4, dbf_txt);

But maybe its just me who thinks that this could be done better.

    <4>Kernel stack overflow.
    <4>Modules linked in: dm_multipath sunrpc bonding qeth_l2 dm_mod qeth ccwgroup vmur
    <4>CPU: 1 Not tainted 2.6.27-30.x.20081015-s390default #1
    <4>Process httpd (pid: 3807, task: 20ae2df8, ksp: 1666fb78)
    <4>Krnl PSW : 040c0000 8027098a (number+0xe/0x348)
    <4>           R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:0 CC:0 PM:0
    <4>Krnl GPRS: 00d43318 0027097c 1666f277 9666f270
    <4>           00000000 00000000 0000000a ffffffff
    <4>           9666f270 1666f228 1666f277 1666f098
    <4>           00000002 80270982 80271016 1666f098
    <4>Krnl Code: 8027097e: f0340dd0a7f1	srp	3536(4,%r0),2033(%r10),4
    <4>           80270984: 0f00		clcl	%r0,%r0
    <4>           80270986: a7840001		brc	8,80270988
    <4>          >8027098a: 18ef		lr	%r14,%r15
    <4>           8027098c: a7faff68		ahi	%r15,-152
    <4>           80270990: 18bf		lr	%r11,%r15
    <4>           80270992: 18a2		lr	%r10,%r2
    <4>           80270994: 1893		lr	%r9,%r3

Modified calltrace with annotated stackframe size of each function:

stackframe size
    |
 0 304 vsnprintf+850 [0x271016]
 1  72 sprintf+74 [0x271522]
 2  56 cio_start_key+262 [0x2d4c16]
 3  56 ccw_device_start_key+222 [0x2dfe92]
 4  56 ccw_device_start+40 [0x2dff28]
 5  48 raw3215_start_io+104 [0x30b0f8]
 6  56 raw3215_write+494 [0x30ba0a]
 7  40 con3215_write+68 [0x30bafc]
 8  40 __call_console_drivers+146 [0x12b0fa]
 9  32 _call_console_drivers+102 [0x12b192]
10  64 release_console_sem+268 [0x12b614]
11 168 vprintk+462 [0x12bca6]
12  72 printk+68 [0x12bfd0]
13 256 __print_symbol+50 [0x15a882]
14  56 __show_trace+162 [0x103d06]
15  32 show_trace+224 [0x103e70]
16  48 show_stack+152 [0x103f20]
17  56 dump_stack+126 [0x104612]
18  96 __alloc_pages_internal+592 [0x175004]
19  80 cache_alloc_refill+776 [0x196f3c]
20  40 __kmalloc+258 [0x1972ae]
21  40 __alloc_skb+94 [0x328086]
22  32 pskb_copy+50 [0x328252]
23  32 skb_realloc_headroom+110 [0x328a72]
24 104 qeth_l2_hard_start_xmit+378 [0x7803bfde]
25  56 dev_hard_start_xmit+450 [0x32ef6e]
26  56 __qdisc_run+390 [0x3425d6]
27  48 dev_queue_xmit+410 [0x331e06]
28  40 ip_finish_output+308 [0x354ac8]
29  56 ip_output+218 [0x355b6e]
30  24 ip_local_out+56 [0x354584]
31 120 ip_queue_xmit+300 [0x355cec]
32  96 tcp_transmit_skb+812 [0x367da8]
33  40 tcp_push_one+158 [0x369fda]
34 112 tcp_sendmsg+852 [0x35d5a0]
35 240 sock_sendmsg+164 [0x32035c]
36  56 kernel_sendmsg+86 [0x32064a]
37  88 sock_no_sendpage+98 [0x322b22]
38 104 tcp_sendpage+70 [0x35cc1e]
39  48 sock_sendpage+74 [0x31eb66]
40  64 pipe_to_sendpage+102 [0x1c4b2e]
41  64 __splice_from_pipe+120 [0x1c5340]
42  72 splice_from_pipe+90 [0x1c57e6]
43  56 generic_splice_sendpage+38 [0x1c5832]
44  48 do_splice_from+104 [0x1c4c38]
45  48 direct_splice_actor+52 [0x1c4c88]
46  80 splice_direct_to_actor+180 [0x1c4f80]
47  72 do_splice_direct+70 [0x1c5112]
48  64 do_sendfile+360 [0x19de18]
49  72 sys_sendfile64+126 [0x19df32]
50 336 sysc_do_restart+18 [0x111a1a]
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

allyesconfig and allmodconfig built kernels have a tape IPL record.
A the vmreader record makes much more sense, since hardly anybody will
ever IPL a kernel from tape. So change the default.
As I side effect I can test these kernels without fiddling around with
the kernel config ;)
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Get tape device lock with interrupts disabled. Otherwise lockdep will issue a
warning similar to:

=================================
[ INFO: inconsistent lock state ]
2.6.27 #1
---------------------------------
inconsistent {in-hardirq-W} -> {hardirq-on-W} usage.
vol_id/2903 [HC0[0]:SC0[0]:HE1:SE1] takes:
 (sch->lock){++..}, at: [<000003e00004c7a2>] tape_open+0x42/0x1a4 [tape]
{in-hardirq-W} state was registered at:
  [<000000000007ce5c>] __lock_acquire+0x894/0xa74
  [<000000000007d0ce>] lock_acquire+0x92/0xb8
  [<0000000000345154>] _spin_lock+0x5c/0x9c
  [<0000000000202264>] do_IRQ+0x124/0x1f0
  [<0000000000026610>] io_return+0x0/0x8

irq event stamp: 847
hardirqs last  enabled at (847): [<000000000007aca6>] trace_hardirqs_on+0x2a/0x38
hardirqs last disabled at (846): [<0000000000076ca2>] trace_hardirqs_off+0x2a/0x38
softirqs last  enabled at (0): [<000000000004909e>] copy_process+0x43e/0x11f4
softirqs last disabled at (0): [<0000000000000000>] 0x0

other info that might help us debug this:
1 lock held by vol_id/2903:
 #0:  (&bdev->bd_mutex){--..}, at: [<000000000010e0f4>] do_open+0x78/0x358

stack backtrace:
CPU: 1 Not tainted 2.6.27 #1},
Process vol_id (pid: 2903, task: 000000003d4c0000, ksp: 000000003d4e3b10)
0400000000000000 000000003d4e3830 0000000000000002 0000000000000000
       000000003d4e38d0 000000003d4e3848 000000003d4e3848 00000000000168a8
       0000000000000000 000000003d4e3b10 0000000000000000 0000000000000000
       000000003d4e3830 000000000000000c 000000003d4e3830 000000003d4e38a0
       000000000034aa98 00000000000168a8 000000003d4e3830 000000003d4e3880
Call Trace:
([<000000000001681c>] show_trace+0x138/0x158)
 [<0000000000016902>] show_stack+0xc6/0xf8
 [<00000000000170d4>] dump_stack+0xb0/0xc0
 [<0000000000078810>] print_usage_bug+0x1e8/0x228
 [<000000000007a71c>] mark_lock+0xb14/0xd24
 [<000000000007cd5a>] __lock_acquire+0x792/0xa74
 [<000000000007d0ce>] lock_acquire+0x92/0xb8
 [<0000000000345154>] _spin_lock+0x5c/0x9c
 [<000003e00004c7a2>] tape_open+0x42/0x1a4 [tape]
 [<000003e00005185c>] tapeblock_open+0x98/0xd0 [tape]
Signed-off-by: NFrank Munzert <munzert@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

unsigned ops->size cannot be negative
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

__blk_end_request must be called with request queue lock held. We need to use
blk_end_request rather than  __blk_end_request.
Signed-off-by: NFrank Munzert <munzert@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Use sysdev_class_create_file() to create create sysdev class attributes
instead of sysfs_create_file(). Using sysfs_create_file() wasn't a very
good idea since the show and store functions have a different amount of
parameters for sysfs files and sysdev class files.
In particular the pointer to the buffer is the last argument and
therefore accesses to random memory regions happened.
Still worked surprisingly well until we got a kernel panic.

Cc: stable@kernel.org
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

The current enable_sie code sets the mm->context.pgstes bit to tell
dup_mm that the new mm should have extended page tables. This bit is also
used by the s390 specific page table primitives to decide about the page
table layout - which means context.pgstes has two meanings. This can cause
any kind of bugs. For example  - e.g. shrink_zone can call
ptep_clear_flush_young while enable_sie is running. ptep_clear_flush_young
will test for context.pgstes. Since enable_sie changed that value of the old
struct mm without changing the page table layout ptep_clear_flush_young will
do the wrong thing.
The solution is to split pgstes into two bits
- one for the allocation
- one for the current state
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Remove the memset since zeroing the string is not needed and use
snprintf instead of sprintf.
Signed-off-by: NJan Glauber <jang@linux.vnet.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

In case of I/O errors on a qdio subchannel qdio_shutdown may be
called twice by the qdio driver and by zfcp. Remove the
superfluous shutdown from qdio and let the upper layer driver
handle the error condition.
Signed-off-by: NJan Glauber <jang@linux.vnet.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

When we failed to get tasklist_lock eventually (count equals 0),
we should only print " ignoring it.\n", and not print
" locked it.\n" needlessly.
Signed-off-by: NQinghuang Feng <qhfeng.kernel@gmail.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

Impact: fix crash with memory hotplug

Shuahua Li found:

| I just did some experiments on a desktop for memory hotplug and this bug
| triggered a crash in my test.
|
| Yinghai's suggestion also fixed the bug.

We don't need to round it, just remove that extra -1
Signed-off-by: NYinghai <yinghai@kernel.org>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

Enclosure management bit mask definitions.
Signed-off-by: NDavid Milburn <dmilburn@redhat.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Synchronize ahci_sw_activity and ahci_sw_activity_blink with ata_port lock.
Signed-off-by: NDavid Milburn <dmilburn@redhat.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

I had assumed that the standard recovery would be sufficient for this
hardware but it isn't. Fix up the other registers on resume as needed. See
bug #11735
Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

[http://lkml.org/lkml/2008/10/18/82]
Signed-off-by: NOndrej Zary <linux@rainbow-software.org>
Acked-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

libata EH saves xfer_mode and ncq_enabled at start to later set
DUBIOUS_XFER flag if it has changed.  These values need to be cleared
on device detach such that hot device swap doesn't accidentally miss
DUBIOUS_XFER.
Signed-off-by: NTejun Heo <tj@kernel.org>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Due to request posting limitations, bandwidth of sil3132 is limited to
around 120MB/s with the minimum pci-e payload size (128bytes) which is
used by most consumer systems.  However, write throughput can be
slightly (~3%) increased by increasing the max read requeset size.
Configure it to 4k which is the maximum supported.  This optimization
is also done by SIMG's windows driver.
Signed-off-by: NTejun Heo <tj@kernel.org>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Fix libata missing kernel-doc:

Warning(lin2628-rc2//drivers/ata/libata-core.c:4562): No description
found for parameter 'tag'
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

There were several places where only enabled devices should be
iterated over but device enabledness wasn't checked.

* IDENTIFY data 40 wire check in cable_is_40wire()
* xfer_mode/ncq_enabled saving in ata_scsi_error()
* DUBIOUS_XFER handling in ata_set_mode()

While at it, reformat comments in cable_is_40wire().
Signed-off-by: NTejun Heo <tj@kernel.org>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Add an appropriate entry for the Promise PDC42819 controller. It has an
AHCI mode and so far works correctly with board_ahci.

This chip is found on Promise's FastTrak TX2650 (2 port) and TX4650 (4 port)
software-based RAID cards (for which there is a binary driver, t3sas) and
can be found on some motherboards, for example the MSI K9A2 Platinum,
which calls the chip a Promise T3 controller.

Although this controller also supports SAS devices, its default bootup mode
is AHCI and the binary driver has to do some magic to get the chip into the
appropriate mode to drive SAS disks.

Seeing as no documentation is provided by Promise, adding this entry to the
ahci driver allows the controller to be useful to people as a SATA
controller (with no ill effects on the system if a SAS disk is connected -
probing of the port just times out with "link online but device
misclassified"), without having to resort to using the binary driver. Users
who require SAS or the proprietary software raid can get this functionality
using the binary driver.
Signed-off-by: NMark Nelson <mdnelson8@gmail.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

* 'for-linus' of git://git.kernel.dk/linux-2.6-block:
  libata: fix NCQ devices behind port multipliers
  scsi: make sure that scsi_init_shared_tag_map() doesn't overwrite existing map

For devices behind sata port multipliers, we have to make sure that
they share a tag map since all tags for that PMP must be unique.
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>

Right now callers have to check whether scsi_host->bqt is already
set up, it's much cleaner to just have scsi_init_shared_tag_map()
does this check on its own.
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>

Impact: get correct page count in /proc/meminfo

found page count in /proc/meminfo is nor correct on 1G system in VirtualBox 2.0.4

# cat /proc/meminfo
MemTotal:        1017508 kB
MemFree:          822700 kB
Buffers:            1456 kB
Cached:            26632 kB
SwapCached:            0 kB
...
Hugepagesize:       2048 kB
DirectMap4k:      4032 kB
DirectMap2M:  18446744073709549568 kB

with this patch get:
...
DirectMap4k:      4032 kB
DirectMap2M:   1044480 kB

which is consistent to kernel_page_tables
---[ Low Kernel Mapping ]---
0xffff880000000000-0xffff880000001000           4K     RW     PCD     GLB x  pte
0xffff880000001000-0xffff88000009f000         632K     RW             GLB x  pte
0xffff88000009f000-0xffff8800000a0000           4K     RW     PCD     GLB x  pte
0xffff8800000a0000-0xffff880000200000        1408K     RW             GLB x  pte
0xffff880000200000-0xffff88003fe00000        1020M     RW         PSE GLB x  pmd
0xffff88003fe00000-0xffff88003fff0000        1984K     RW             GLB NX pte
0xffff88003fff0000-0xffff880040000000          64K                           pte
0xffff880040000000-0xffff888000000000         511G                           pud
0xffff888000000000-0xffffc20000000000       58880G                           pgd
Signed-off-by: NYinghai Lu <yinghai@kernel.org>
Acked-by: NSuresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

Impact: documentation fix

sched-design-CFS.txt wrongly references sched_granularity_ns sysctl,
as its name in fact is sched_min_granularity_ns.
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
Acked-by: NPeter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: (33 commits)
  MIPS: lemote/lm2e: Added io_map_base to pci controller
  MIPS: TXx9: Make firmware parameter passing more robust
  MIPS: Markeins: Remove unnecessary define and cleanup comments, etc.
  MIPS: Markeins: Extract ll_emma2rh_* functions
  MIPS: Markeins: Remove runtime debug prints
  MIPS: EMMA: Fold arch/mips/emma/{common,markeins}/irq*.c into markeins/irq.c
  MIPS: EMMA2RH: Remove emma2rh_gpio_irq_base
  MIPS: EMMA2RH: Remove emma2rh_sw_irq_base
  MIPS: EMMA2RH: Remove emma2rh_irq_base global variable
  MIPS: EMMA2RH: Remove emma2rh_sync on read operation
  MIPS: EMMA: Move <asm/emma2rh> to <asm/emma> dir
  MIPS: EMMA: Move arch/mips/emma2rh/ into arch/mips/emma/
  MIPS: EMMA: Kconfig reorganization
  MIPS: Add CONFIG_CPU_R5500 for NEC VR5500 series processors
  MIPS: RB532: Disable the right device
  MIPS: Add support for NXP PNX833x (STB222/5) into linux kernel
  MIPS: TXx9: CONFIG_TOSHIBA_RBTX4939 spelling
  MIPS: Fix KGDB build error
  INPUT: sgi_btns: Add license specification
  MIPS: IP22: ip22-int.c header file weeding.
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  firewire: fw-sbp2: fix races
  firewire: fw-sbp2: delay first login to avoid retries
  firewire: fw-ohci: initialization failure path fixes
  firewire: fw-ohci: don't leak dma memory on module removal
  firewire: fix struct fw_node memory leak
  firewire: Survive more than 256 bus resets

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: ASoC: Blackfin: update SPORT0 port selector (v2)
  ALSA: hda - Restore default pin configs for realtek codecs
  sound: use a common working email address
  pci: use pci_ioremap_bar() in sound/

Signed-off-by: NZhang Le <r0bertz@gentoo.org>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

When booting Linux on a txx9 board with VxWorks boot loader, it crashes in
prom_getenv(), as VxWorks doesn't pass firmware parameters in a0-a3 (in my
case, the actual leftover values in these registers were 0x80002000,
0x80001fe0, 0x2000, and 0x20).

Make the parsing of argc, argv, and envp a bit more robust by checking if
argc is a number below CKSEG0, and argv/envp point to CKSEG0.
Signed-off-by: NGeert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Acked-by: NAtsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NShinya Kuribayashi <shinya.kuribayashi@necel.com>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>