From: Dave Hansen <haveblue@us.ibm.com>

lmb_end_of_DRAM() returns the address of the end of RAM, not the starting
address of the last page.  We've been accessing mem_map[] out of bounds for
quite a while.  But, it's just a read, so it's probably never caused a real
problem.

But, during my port of CONFIG_NONLINEAR to ppc64, I have a check to make
sure that all __va() calls are given with valid physical addresses.  This
code tripped that check.  

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 25-akpm/arch/ppc64/mm/init.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

diff -puN arch/ppc64/mm/init.c~ppc64-fix-off-by-one-in-mem_init arch/ppc64/mm/init.c
--- 25/arch/ppc64/mm/init.c~ppc64-fix-off-by-one-in-mem_init	Thu Jul 29 14:12:46 2004
+++ 25-akpm/arch/ppc64/mm/init.c	Thu Jul 29 14:12:46 2004
@@ -655,7 +655,7 @@ void __init mem_init(void)
 
 	totalram_pages += free_all_bootmem();
 
-	for (addr = KERNELBASE; addr <= (unsigned long)__va(lmb_end_of_DRAM());
+	for (addr = KERNELBASE; addr < (unsigned long)__va(lmb_end_of_DRAM());
 	     addr += PAGE_SIZE) {
 		if (!PageReserved(virt_to_page(addr)))
 			continue;
_