--- /dev/null
+From andi@firstfloor.org Sat Aug 25 17:05:13 2018
+From: Andi Kleen <andi@firstfloor.org>
+Date: Sat, 25 Aug 2018 06:50:15 -0700
+Subject: x86/mm/pat: Fix L1TF stable backport for CPA
+To: stable@vger.kernel.org
+Cc: x86@kernel.org, linux-kernel@vger.kernel.org, bernhard.kaindl@thalesgroup.com, Andi Kleen <ak@linux.intel.com>
+Message-ID: <20180825135015.33547-1-andi@firstfloor.org>
+
+From: Andi Kleen <ak@linux.intel.com>
+
+Patch for stable only to fix boot resets caused by the L1TF patches.
+
+Stable trees reverted the following patch
+
+Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
+
+ This reverts commit 87e2bd898d3a79a8c609f183180adac47879a2a4 which is
+ commit edc3b9129cecd0f0857112136f5b8b1bc1d45918 upstream.
+
+but the L1TF patch backported here
+
+ x86/mm/pat: Make set_memory_np() L1TF safe
+
+ commit 958f79b9ee55dfaf00c8106ed1c22a2919e0028b upstream
+
+ set_memory_np() is used to mark kernel mappings not present, but it has
+ it's own open coded mechanism which does not have the L1TF protection of
+ inverting the address bits.
+
+assumed that cpa->pfn contains a PFN. With the above patch reverted
+it does not, which causes the PMD to be set to an incorrect address
+shifted by 12 bits, which can cause early boot reset on some
+systems, like an Apollo Lake embedded system.
+
+Convert the address to a PFN before passing it to pmd_pfn()
+
+Thanks to Bernhard for bisecting and testing.
+
+Cc: stable@vger.kernel.org # 4.4 and 4.9
+Reported-by: Bernhard Kaindl <bernhard.kaindl@thalesgroup.com>
+Tested-by: Bernhard Kaindl <bernhard.kaindl@thalesgroup.com>
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/pageattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -1006,7 +1006,7 @@ static int populate_pmd(struct cpa_data
+
+ pmd = pmd_offset(pud, start);
+
+- set_pmd(pmd, pmd_mkhuge(pfn_pmd(cpa->pfn,
++ set_pmd(pmd, pmd_mkhuge(pfn_pmd(cpa->pfn >> PAGE_SHIFT,
+ canon_pgprot(pmd_pgprot))));
+
+ start += PMD_SIZE;