The 'sub r3, r3, r5' check to determine the compressed kernel size in
arch/arm/boot/compressed/head.S doesn't work properly, since at that
point, r3 will have been overwritten by cache_on().

What we can do is to use sp instead, which does not get clobbered in
the meanwhile.  Using sp will give us a slightly higher compressed
kernel image size guess than when using r3, but that's safe.

Bug reported by John Cooper and David Anders.

Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>

Index: linux-2.6.18/arch/arm/boot/compressed/head.S
===================================================================
--- linux-2.6.18.orig/arch/arm/boot/compressed/head.S
+++ linux-2.6.18/arch/arm/boot/compressed/head.S
@@ -240,7 +240,7 @@ not_relocated:	mov	r0, #0
  */
 		cmp	r4, r2
 		bhs	wont_overwrite
-		sub	r3, r3, r5		@ compressed kernel size
+		sub	r3, sp, r5		@ > compressed kernel image
 		add	r0, r4, r3, lsl #2	@ allow for 4x expansion
 		cmp	r0, r5
 		bls	wont_overwrite