Fix failure to map memory on ppc64, ppc64le (rhbz 1518707)

6 files changed, 478 insertions, 2 deletions

diff --git a/0001-powerpc-64s-radix-Fix-128TB-512TB-virtual-address-bo.patch b/0001-powerpc-64s-radix-Fix-128TB-512TB-virtual-address-bo.patch
new file mode 100644
index 000000000..4d2bbfaf7
--- /dev/null
+++ b/0001-powerpc-64s-radix-Fix-128TB-512TB-virtual-address-bo.patch
@@ -0,0 +1,204 @@
+From aca20afc84cf8578e044c67c4949672ac98f064a Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Tue, 28 Nov 2017 11:26:54 +0100
+Subject: [PATCH 1/5] powerpc/64s/radix: Fix 128TB-512TB virtual address
+ boundary case allocation
+
+commit 85e3f1adcb9d49300b0a943bb93f9604be375bfb upstream.
+
+Radix VA space allocations test addresses against mm->task_size which
+is 512TB, even in cases where the intention is to limit allocation to
+below 128TB.
+
+This results in mmap with a hint address below 128TB but address +
+length above 128TB succeeding when it should fail (as hash does after
+the previous patch).
+
+Set the high address limit to be considered up front, and base
+subsequent allocation checks on that consistently.
+
+Fixes: f4ea6dcb08ea ("powerpc/mm: Enable mappings above 128TB")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/hugetlbpage-radix.c | 26 ++++++++++++------
+ arch/powerpc/mm/mmap.c              | 55 ++++++++++++++++++++++---------------
+ 2 files changed, 50 insertions(+), 31 deletions(-)
+
+diff --git a/arch/powerpc/mm/hugetlbpage-radix.c b/arch/powerpc/mm/hugetlbpage-radix.c
+index a12e86395025..0a3d71aae175 100644
+--- a/arch/powerpc/mm/hugetlbpage-radix.c
++++ b/arch/powerpc/mm/hugetlbpage-radix.c
+@@ -48,17 +48,28 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
+ 	struct hstate *h = hstate_file(file);
++	int fixed = (flags & MAP_FIXED);
++	unsigned long high_limit;
+ 	struct vm_unmapped_area_info info;
+ 
+-	if (unlikely(addr > mm->context.addr_limit && addr < TASK_SIZE))
+-		mm->context.addr_limit = TASK_SIZE;
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
+ 
+ 	if (len & ~huge_page_mask(h))
+ 		return -EINVAL;
+-	if (len > mm->task_size)
++	if (len > high_limit)
+ 		return -ENOMEM;
++	if (fixed) {
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
+ 
+-	if (flags & MAP_FIXED) {
++	if (unlikely(addr > mm->context.addr_limit &&
++		     mm->context.addr_limit != TASK_SIZE))
++		mm->context.addr_limit = TASK_SIZE;
++
++	if (fixed) {
+ 		if (prepare_hugepage_range(file, addr, len))
+ 			return -EINVAL;
+ 		return addr;
+@@ -67,7 +78,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ 	if (addr) {
+ 		addr = ALIGN(addr, huge_page_size(h));
+ 		vma = find_vma(mm, addr);
+-		if (mm->task_size - len >= addr &&
++		if (high_limit - len >= addr &&
+ 		    (!vma || addr + len <= vm_start_gap(vma)))
+ 			return addr;
+ 	}
+@@ -78,12 +89,9 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ 	info.length = len;
+ 	info.low_limit = PAGE_SIZE;
+-	info.high_limit = current->mm->mmap_base;
++	info.high_limit = mm->mmap_base + (high_limit - DEFAULT_MAP_WINDOW);
+ 	info.align_mask = PAGE_MASK & ~huge_page_mask(h);
+ 	info.align_offset = 0;
+ 
+-	if (addr > DEFAULT_MAP_WINDOW)
+-		info.high_limit += mm->context.addr_limit - DEFAULT_MAP_WINDOW;
+-
+ 	return vm_unmapped_area(&info);
+ }
+diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
+index 5d78b193fec4..6d476a7b5611 100644
+--- a/arch/powerpc/mm/mmap.c
++++ b/arch/powerpc/mm/mmap.c
+@@ -106,22 +106,32 @@ radix__arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ {
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
++	int fixed = (flags & MAP_FIXED);
++	unsigned long high_limit;
+ 	struct vm_unmapped_area_info info;
+ 
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
++
++	if (len > high_limit)
++		return -ENOMEM;
++	if (fixed) {
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
++
+ 	if (unlikely(addr > mm->context.addr_limit &&
+ 		     mm->context.addr_limit != TASK_SIZE))
+ 		mm->context.addr_limit = TASK_SIZE;
+ 
+-	if (len > mm->task_size - mmap_min_addr)
+-		return -ENOMEM;
+-
+-	if (flags & MAP_FIXED)
++	if (fixed)
+ 		return addr;
+ 
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
++		if (high_limit - len >= addr && addr >= mmap_min_addr &&
+ 		    (!vma || addr + len <= vm_start_gap(vma)))
+ 			return addr;
+ 	}
+@@ -129,13 +139,9 @@ radix__arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	info.flags = 0;
+ 	info.length = len;
+ 	info.low_limit = mm->mmap_base;
++	info.high_limit = high_limit;
+ 	info.align_mask = 0;
+ 
+-	if (unlikely(addr > DEFAULT_MAP_WINDOW))
+-		info.high_limit = mm->context.addr_limit;
+-	else
+-		info.high_limit = DEFAULT_MAP_WINDOW;
+-
+ 	return vm_unmapped_area(&info);
+ }
+ 
+@@ -149,37 +155,42 @@ radix__arch_get_unmapped_area_topdown(struct file *filp,
+ 	struct vm_area_struct *vma;
+ 	struct mm_struct *mm = current->mm;
+ 	unsigned long addr = addr0;
++	int fixed = (flags & MAP_FIXED);
++	unsigned long high_limit;
+ 	struct vm_unmapped_area_info info;
+ 
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
++		high_limit = TASK_SIZE;
++
++	if (len > high_limit)
++		return -ENOMEM;
++	if (fixed) {
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
++
+ 	if (unlikely(addr > mm->context.addr_limit &&
+ 		     mm->context.addr_limit != TASK_SIZE))
+ 		mm->context.addr_limit = TASK_SIZE;
+ 
+-	/* requested length too big for entire address space */
+-	if (len > mm->task_size - mmap_min_addr)
+-		return -ENOMEM;
+-
+-	if (flags & MAP_FIXED)
++	if (fixed)
+ 		return addr;
+ 
+-	/* requesting a specific address */
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+-		if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
+-				(!vma || addr + len <= vm_start_gap(vma)))
++		if (high_limit - len >= addr && addr >= mmap_min_addr &&
++		    (!vma || addr + len <= vm_start_gap(vma)))
+ 			return addr;
+ 	}
+ 
+ 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ 	info.length = len;
+ 	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
+-	info.high_limit = mm->mmap_base;
++	info.high_limit = mm->mmap_base + (high_limit - DEFAULT_MAP_WINDOW);
+ 	info.align_mask = 0;
+ 
+-	if (addr > DEFAULT_MAP_WINDOW)
+-		info.high_limit += mm->context.addr_limit - DEFAULT_MAP_WINDOW;
+-
+ 	addr = vm_unmapped_area(&info);
+ 	if (!(addr & ~PAGE_MASK))
+ 		return addr;
+-- 
+2.14.3
+
diff --git a/0002-powerpc-64s-hash-Fix-512T-hint-detection-to-use-128T.patch b/0002-powerpc-64s-hash-Fix-512T-hint-detection-to-use-128T.patch
new file mode 100644
index 000000000..fc6b806d7
--- /dev/null
+++ b/0002-powerpc-64s-hash-Fix-512T-hint-detection-to-use-128T.patch
@@ -0,0 +1,49 @@
+From 75c7f5172c113af1ea3cf094436c9e03191673e0 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Tue, 28 Nov 2017 11:26:55 +0100
+Subject: [PATCH 2/5] powerpc/64s/hash: Fix 512T hint detection to use >= 128T
+
+commit 7ece370996b694ae263025e056ad785afc1be5ab upstream.
+
+Currently userspace is able to request mmap() search between 128T-512T
+by specifying a hint address that is greater than 128T. But that means
+a hint of 128T exactly will return an address below 128T, which is
+confusing and wrong.
+
+So fix the logic to check the hint is greater than *or equal* to 128T.
+
+Fixes: f4ea6dcb08ea ("powerpc/mm: Enable mappings above 128TB")
+Suggested-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Suggested-by: Nicholas Piggin <npiggin@gmail.com>
+[mpe: Split out of Nick's bigger patch]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/slice.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
+index 45f6740dd407..48a5312103a1 100644
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -419,7 +419,7 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
+ 	/*
+ 	 * Check if we need to expland slice area.
+ 	 */
+-	if (unlikely(addr > mm->context.addr_limit &&
++	if (unlikely(addr >= mm->context.addr_limit &&
+ 		     mm->context.addr_limit != TASK_SIZE)) {
+ 		mm->context.addr_limit = TASK_SIZE;
+ 		on_each_cpu(slice_flush_segments, mm, 1);
+@@ -427,7 +427,7 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
+ 	/*
+ 	 * This mmap request can allocate upt to 512TB
+ 	 */
+-	if (addr > DEFAULT_MAP_WINDOW)
++	if (addr >= DEFAULT_MAP_WINDOW)
+ 		high_limit = mm->context.addr_limit;
+ 	else
+ 		high_limit = DEFAULT_MAP_WINDOW;
+-- 
+2.14.3
+
diff --git a/0003-powerpc-64s-hash-Fix-128TB-512TB-virtual-address-bou.patch b/0003-powerpc-64s-hash-Fix-128TB-512TB-virtual-address-bou.patch
new file mode 100644
index 000000000..009068a3b
--- /dev/null
+++ b/0003-powerpc-64s-hash-Fix-128TB-512TB-virtual-address-bou.patch
@@ -0,0 +1,129 @@
+From e90387a8d2227f95bf5e5b5ffd816d48a87466e2 Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Tue, 28 Nov 2017 11:26:56 +0100
+Subject: [PATCH 3/5] powerpc/64s/hash: Fix 128TB-512TB virtual address
+ boundary case allocation
+
+commit 6a72dc038b615229a1b285829d6c8378d15c2347 upstream.
+
+When allocating VA space with a hint that crosses 128TB, the SLB
+addr_limit variable is not expanded if addr is not > 128TB, but the
+slice allocation looks at task_size, which is 512TB. This results in
+slice_check_fit() incorrectly succeeding because the slice_count
+truncates off bit 128 of the requested mask, so the comparison to the
+available mask succeeds.
+
+Fix this by using mm->context.addr_limit instead of mm->task_size for
+testing allocation limits. This causes such allocations to fail.
+
+Fixes: f4ea6dcb08ea ("powerpc/mm: Enable mappings above 128TB")
+Reported-by: Florian Weimer <fweimer@redhat.com>
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/slice.c | 50 ++++++++++++++++++++++++-------------------------
+ 1 file changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
+index 48a5312103a1..3889201b560c 100644
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -96,7 +96,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
+ {
+ 	struct vm_area_struct *vma;
+ 
+-	if ((mm->task_size - len) < addr)
++	if ((mm->context.addr_limit - len) < addr)
+ 		return 0;
+ 	vma = find_vma(mm, addr);
+ 	return (!vma || (addr + len) <= vm_start_gap(vma));
+@@ -133,7 +133,7 @@ static void slice_mask_for_free(struct mm_struct *mm, struct slice_mask *ret)
+ 		if (!slice_low_has_vma(mm, i))
+ 			ret->low_slices |= 1u << i;
+ 
+-	if (mm->task_size <= SLICE_LOW_TOP)
++	if (mm->context.addr_limit <= SLICE_LOW_TOP)
+ 		return;
+ 
+ 	for (i = 0; i < GET_HIGH_SLICE_INDEX(mm->context.addr_limit); i++)
+@@ -412,25 +412,31 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
+ 	struct slice_mask compat_mask;
+ 	int fixed = (flags & MAP_FIXED);
+ 	int pshift = max_t(int, mmu_psize_defs[psize].shift, PAGE_SHIFT);
++	unsigned long page_size = 1UL << pshift;
+ 	struct mm_struct *mm = current->mm;
+ 	unsigned long newaddr;
+ 	unsigned long high_limit;
+ 
+-	/*
+-	 * Check if we need to expland slice area.
+-	 */
+-	if (unlikely(addr >= mm->context.addr_limit &&
+-		     mm->context.addr_limit != TASK_SIZE)) {
+-		mm->context.addr_limit = TASK_SIZE;
++	high_limit = DEFAULT_MAP_WINDOW;
++	if (addr >= high_limit)
++		high_limit = TASK_SIZE;
++
++	if (len > high_limit)
++		return -ENOMEM;
++	if (len & (page_size - 1))
++		return -EINVAL;
++	if (fixed) {
++		if (addr & (page_size - 1))
++			return -EINVAL;
++		if (addr > high_limit - len)
++			return -ENOMEM;
++	}
++
++	if (high_limit > mm->context.addr_limit) {
++		mm->context.addr_limit = high_limit;
+ 		on_each_cpu(slice_flush_segments, mm, 1);
+ 	}
+-	/*
+-	 * This mmap request can allocate upt to 512TB
+-	 */
+-	if (addr >= DEFAULT_MAP_WINDOW)
+-		high_limit = mm->context.addr_limit;
+-	else
+-		high_limit = DEFAULT_MAP_WINDOW;
++
+ 	/*
+ 	 * init different masks
+ 	 */
+@@ -446,27 +452,19 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
+ 
+ 	/* Sanity checks */
+ 	BUG_ON(mm->task_size == 0);
++	BUG_ON(mm->context.addr_limit == 0);
+ 	VM_BUG_ON(radix_enabled());
+ 
+ 	slice_dbg("slice_get_unmapped_area(mm=%p, psize=%d...\n", mm, psize);
+ 	slice_dbg(" addr=%lx, len=%lx, flags=%lx, topdown=%d\n",
+ 		  addr, len, flags, topdown);
+ 
+-	if (len > mm->task_size)
+-		return -ENOMEM;
+-	if (len & ((1ul << pshift) - 1))
+-		return -EINVAL;
+-	if (fixed && (addr & ((1ul << pshift) - 1)))
+-		return -EINVAL;
+-	if (fixed && addr > (mm->task_size - len))
+-		return -ENOMEM;
+-
+ 	/* If hint, make sure it matches our alignment restrictions */
+ 	if (!fixed && addr) {
+-		addr = _ALIGN_UP(addr, 1ul << pshift);
++		addr = _ALIGN_UP(addr, page_size);
+ 		slice_dbg(" aligned addr=%lx\n", addr);
+ 		/* Ignore hint if it's too large or overlaps a VMA */
+-		if (addr > mm->task_size - len ||
++		if (addr > high_limit - len ||
+ 		    !slice_area_is_free(mm, addr, len))
+ 			addr = 0;
+ 	}
+-- 
+2.14.3
+
diff --git a/0004-powerpc-64s-hash-Fix-fork-with-512TB-process-address.patch b/0004-powerpc-64s-hash-Fix-fork-with-512TB-process-address.patch
new file mode 100644
index 000000000..75d9d3241
--- /dev/null
+++ b/0004-powerpc-64s-hash-Fix-fork-with-512TB-process-address.patch
@@ -0,0 +1,48 @@
+From fe50aa4374f20333d9b077bbe09397d38112b081 Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Tue, 28 Nov 2017 11:26:57 +0100
+Subject: [PATCH 4/5] powerpc/64s/hash: Fix fork() with 512TB process address
+ space
+
+commit effc1b25088502fbd30305c79773de2d1f7470a6 upstream.
+
+Hash unconditionally resets the addr_limit to default (128TB) when the
+mm context is initialised. If a process has > 128TB mappings when it
+forks, the child will not get the 512TB addr_limit, so accesses to
+valid > 128TB mappings will fail in the child.
+
+Fix this by only resetting the addr_limit to default if it was 0. Non
+zero indicates it was duplicated from the parent (0 means exec()).
+
+Fixes: f4ea6dcb08ea ("powerpc/mm: Enable mappings above 128TB")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/mmu_context_book3s64.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
+index a75f63833284..bb9cdf01fc4f 100644
+--- a/arch/powerpc/mm/mmu_context_book3s64.c
++++ b/arch/powerpc/mm/mmu_context_book3s64.c
+@@ -95,11 +95,11 @@ static int hash__init_new_context(struct mm_struct *mm)
+ 		return index;
+ 
+ 	/*
+-	 * We do switch_slb() early in fork, even before we setup the
+-	 * mm->context.addr_limit. Default to max task size so that we copy the
+-	 * default values to paca which will help us to handle slb miss early.
++	 * In the case of exec, use the default limit,
++	 * otherwise inherit it from the mm we are duplicating.
+ 	 */
+-	mm->context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
++	if (!mm->context.addr_limit)
++		mm->context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
+ 
+ 	/*
+ 	 * The old code would re-promote on fork, we don't do that when using
+-- 
+2.14.3
+
diff --git a/0005-powerpc-64s-hash-Allow-MAP_FIXED-allocations-to-cros.patch b/0005-powerpc-64s-hash-Allow-MAP_FIXED-allocations-to-cros.patch
new file mode 100644
index 000000000..e7e9a4acf
--- /dev/null
+++ b/0005-powerpc-64s-hash-Allow-MAP_FIXED-allocations-to-cros.patch
@@ -0,0 +1,38 @@
+From 2beb551e379191c2a24e7db8c4fcc64fef4b921a Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Tue, 28 Nov 2017 11:26:58 +0100
+Subject: [PATCH 5/5] powerpc/64s/hash: Allow MAP_FIXED allocations to cross
+ 128TB boundary
+
+commit 35602f82d0c765f991420e319c8d3a596c921eb8 upstream.
+
+While mapping hints with a length that cross 128TB are disallowed,
+MAP_FIXED allocations that cross 128TB are allowed. These are failing
+on hash (on radix they succeed). Add an additional case for fixed
+mappings to expand the addr_limit when crossing 128TB.
+
+Fixes: f4ea6dcb08ea ("powerpc/mm: Enable mappings above 128TB")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/slice.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
+index 3889201b560c..a4f93699194b 100644
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -418,7 +418,7 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
+ 	unsigned long high_limit;
+ 
+ 	high_limit = DEFAULT_MAP_WINDOW;
+-	if (addr >= high_limit)
++	if (addr >= high_limit || (fixed && (addr + len > high_limit)))
+ 		high_limit = TASK_SIZE;
+ 
+ 	if (len > high_limit)
+-- 
+2.14.3
+
diff --git a/kernel.spec b/kernel.spec
index f98c5613f..c6c3428e9 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -42,7 +42,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 200
+%global baserelease 201
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -712,6 +712,13 @@ Patch640: qxl_cursor_fix.patch
 # rhbz 1462175
 Patch641: HID-rmi-Check-that-a-device-is-a-RMI-device-before-c.patch
 
+# rhbz 1518707
+Patch642: 0001-powerpc-64s-radix-Fix-128TB-512TB-virtual-address-bo.patch
+Patch643: 0002-powerpc-64s-hash-Fix-512T-hint-detection-to-use-128T.patch
+Patch644: 0003-powerpc-64s-hash-Fix-128TB-512TB-virtual-address-bou.patch
+Patch645: 0004-powerpc-64s-hash-Fix-fork-with-512TB-process-address.patch
+Patch646: 0005-powerpc-64s-hash-Allow-MAP_FIXED-allocations-to-cros.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2286,8 +2293,9 @@ fi
 #
 #
 %changelog
-* Wed Nov 29 2017 Jeremy Cline <jeremy@jcline.org>
+* Wed Nov 29 2017 Jeremy Cline <jeremy@jcline.org> - 4.13.16-201
 - Fix USB null pointer dereference on ThinkPad X1 (rhbz 1462175)
+- Patches ppc64, ppc64le mm failure (rhbz 1518707)
 
 * Mon Nov 27 2017 Jeremy Cline <jeremy@jcline.org> - 4.13.16-200
 - Linux v4.13.16