Reported by syzkaller:

	kasan: GPF could be caused by NULL-ptr deref or user memory access
	general protection fault: 0000 [#1] PREEMPT SMP KASAN
	RIP: 0010:__apic_accept_irq+0x46/0x740 arch/x86/kvm/lapic.c:1029
	Call Trace:
	kvm_apic_set_irq+0xb4/0x140 arch/x86/kvm/lapic.c:558
	stimer_notify_direct arch/x86/kvm/hyperv.c:648 [inline]
	stimer_expiration arch/x86/kvm/hyperv.c:659 [inline]
	kvm_hv_process_stimers+0x594/0x1650 arch/x86/kvm/hyperv.c:686
	vcpu_enter_guest+0x2b2a/0x54b0 arch/x86/kvm/x86.c:7896
	vcpu_run+0x393/0xd40 arch/x86/kvm/x86.c:8152
	kvm_arch_vcpu_ioctl_run+0x636/0x900 arch/x86/kvm/x86.c:8360
	kvm_vcpu_ioctl+0x6cf/0xaf0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2765

The testcase programs HV_X64_MSR_STIMERn_CONFIG/HV_X64_MSR_STIMERn_COUNT,
in addition, there is no lapic in the kernel, the counters value are small
enough in order that kvm_hv_process_stimers() inject this already-expired
timer interrupt into the guest through lapic in the kernel which triggers
the NULL deferencing. This patch fixes it by don't advertise direct mode
synthetic timers and discarding the inject when lapic is not in kernel.

syzkaller source: https://syzkaller.appspot.com/x/repro.c?x=1752fe0a600000

Reported-by: syzbot+dff25ee91f0c7d5c1695@syzkaller.appspotmail.com
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Zapping collapsible sptes, a.k.a. 4k sptes that can be promoted into a
large page, is only necessary when changing only the dirty logging flag
of a memory region.  If the memslot is also being moved, then all sptes
for the memslot are zapped when it is invalidated.  When a memslot is
being created, it is impossible for there to be existing dirty mappings,
e.g. KVM can have MMIO sptes, but not present, and thus dirty, sptes.

Note, the comment and logic are shamelessly borrowed from MIPS's version
of kvm_arch_commit_memory_region().

Fixes: 3ea3b7fa ("kvm: mmu: lazy collapse small sptes into large sptes")
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Remove the duplication code in run_test() of dirty_log_test because
after some reordering of functions now we can directly use the outcome
of vm_create().

Meanwhile, with the new VM_MODE_PXXV48_4K, we can safely revert
b442324b too where we stick the x86_64 PA width to 39 bits for
dirty_log_test.
Reviewed-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

The naming VM_MODE_P52V48_4K is explicit but unclear when used on
x86_64 machines, because x86_64 machines are having various physical
address width rather than some static values.  Here's some examples:

  - Intel Xeon E3-1220:  36 bits
  - Intel Core i7-8650:  39 bits
  - AMD   EPYC 7251:     48 bits

All of them are using 48 bits linear address width but with totally
different physical address width (and most of the old machines should
be less than 52 bits).

Let's create a new guest mode called VM_MODE_PXXV48_4K for current
x86_64 tests and make it as the default to replace the old naming of
VM_MODE_P52V48_4K because it shows more clearly that the PA width is
not really a constant.  Meanwhile we also stop assuming all the x86
machines are having 52 bits PA width but instead we fetch the real
vm->pa_bits from CPUID 0x80000008 during runtime.

We currently make this exclusively used by x86_64 but no other arch.

As a slight touch up, moving DEBUG macro from dirty_log_test.c to
kvm_util.h so lib can use it too.
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Since we've just removed the dependency of vm type in previous patch,
now we can create the vm much earlier.  Note that to move it earlier
we used an approximation of number of extra pages but it should be
fine.

This prepares for the follow up patches to finally remove the
duplication of guest mode parsings.
Reviewed-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Rather than passing the vm type from the top level to the end of vm
creation, let's simply keep that as an internal of kvm_vm struct and
decide the type in _vm_create().  Several reasons for doing this:

- The vm type is only decided by physical address width and currently
  only used in aarch64, so we've got enough information as long as
  we're passing vm_guest_mode into _vm_create(),

- This removes a loop dependency between the vm->type and creation of
  vms.  That's why now we need to parse vm_guest_mode twice sometimes,
  once in run_test() and then again in _vm_create().  The follow up
  patches will move on to clean up that as well so we can have a
  single place to decide guest machine types and so.

Note that this patch will slightly change the behavior of aarch64
tests in that previously most vm_create() callers will directly pass
in type==0 into _vm_create() but now the type will depend on
vm_guest_mode, however it shouldn't affect any user because all
vm_create() users of aarch64 will be using VM_MODE_DEFAULT guest
mode (which is VM_MODE_P40V48_4K) so at last type will still be zero.
Reviewed-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

It was discovered that after commit 65efa61d ("selftests: kvm: provide
common function to enable eVMCS") hyperv_cpuid selftest is failing on AMD.
The reason is that the commit changed _vcpu_ioctl() to vcpu_ioctl() in the
test and this one can't fail.

Instead of fixing the test is seems to make more sense to not announce
KVM_CAP_HYPERV_ENLIGHTENED_VMCS support if it is definitely missing
(on svm and in case kvm_intel.nested=0).
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Since commit 5158917c ("KVM: x86: nVMX: Allow nested_enable_evmcs to
be NULL") the code in x86.c is prepared to see nested_enable_evmcs being
NULL and in VMX case it actually is when nesting is disabled. Remove the
unneeded stub from SVM code.
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Hyper-V provides direct tlb flush function which helps
L1 Hypervisor to handle Hyper-V tlb flush request from
L2 guest. Add the function support for VMX.
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Hyper-V direct tlb flush function should be enabled for
guest that only uses Hyper-V hypercall. User space
hypervisor(e.g, Qemu) can disable KVM identification in
CPUID and just exposes Hyper-V identification to make
sure the precondition. Add new KVM capability KVM_CAP_
HYPERV_DIRECT_TLBFLUSH for user space to enable Hyper-V
direct tlb function and this function is default to be
disabled in KVM.
Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

The struct hv_vp_assist_page was defined incorrectly.
The "vtl_control" should be u64[3], "nested_enlightenments
_control" should be a u64 and there are 7 reserved bytes
following "enlighten_vmentry". Fix the definition.
Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

These MSRs should be enumerated by KVM_GET_MSR_INDEX_LIST, so that
userspace knows that these MSRs may be part of the vCPU state.
Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Eric Hankland <ehankland@google.com>
Reviewed-by: Peter Shier <pshier@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Pull MFD updates from Lee Jones:
 "New Drivers:
   - Add support for Merrifield Basin Cove PMIC

  New Device Support:
   - Add support for Intel Tiger Lake to Intel LPSS PCI
   - Add support for Intel Sky Lake to Intel LPSS PCI
   - Add support for ST-Ericsson DB8520 to DB8500 PRCMU

  New Functionality:
   - Add RTC and PWRC support to MT6323

  Fix-ups:
   - Clean-up include files; davinci_voicecodec, asic3, sm501, mt6397
   - Ignore return values from debugfs_create*(); ab3100-*, ab8500-debugfs, aat2870-core
   - Device Tree changes; rn5t618, mt6397
   - Use new I2C API; tps80031, 88pm860x-core, ab3100-core, bcm590xx,
                      da9150-core, max14577, max77693, max77843, max8907,
                      max8925-i2c, max8997, max8998, palmas, twl-core,
   - Remove obsolete code; da9063, jz4740-adc
   - Simplify semantics; timberdale, htc-i2cpld
   - Add 'fall-through' tags; omap-usb-host, db8500-prcmu
   - Remove superfluous prints; ab8500-debugfs, db8500-prcmu, fsl-imx25-tsadc,
                                intel_soc_pmic_bxtwc, qcom_rpm, sm501
   - Trivial rename/whitespace/typo fixes; mt6397-core, MAINTAINERS
   - Reorganise code structure; mt6397-*
   - Improve code consistency; intel-lpss
   - Use MODULE_SOFTDEP() helper; intel-lpss
   - Use DEFINE_RES_*() helpers; mt6397-core

  Bug Fixes:
   - Clean-up resources; max77620
   - Prevent input events being dropped on resume; intel-lpss-pci
   - Prevent sleeping in IRQ context; ezx-pcap"

* tag 'mfd-next-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (48 commits)
  mfd: mt6323: Add MT6323 RTC and PWRC
  mfd: mt6323: Replace boilerplate resource code with DEFINE_RES_* macros
  mfd: mt6397: Add mutex include
  dt-bindings: mfd: mediatek: Add MT6323 Power Controller
  dt-bindings: mfd: mediatek: Update RTC to include MT6323
  dt-bindings: mfd: mediatek: mt6397: Change to relative paths
  mfd: db8500-prcmu: Support the higher DB8520 ARMSS
  mfd: intel-lpss: Use MODULE_SOFTDEP() instead of implicit request
  mfd: htc-i2cpld: Drop check because i2c_unregister_device() is NULL safe
  mfd: sm501: Include the GPIO driver header
  mfd: intel-lpss: Add Intel Skylake ACPI IDs
  mfd: intel-lpss: Consistently use GENMASK()
  mfd: Add support for Merrifield Basin Cove PMIC
  mfd: ezx-pcap: Replace mutex_lock with spin_lock
  mfd: asic3: Include the right header
  MAINTAINERS: altera-sysmgr: Fix typo in a filepath
  mfd: mt6397: Extract IRQ related code from core driver
  mfd: mt6397: Rename macros to something more readable
  mfd: Remove dev_err() usage after platform_get_irq()
  mfd: db8500-prcmu: Mark expected switch fall-throughs
  ...

Pull backlight updates from Lee Jones:
 "Core Frameworks
   - Obtain scale type through sysfs

  New Functionality:
   - Provide Device Tree functionality in rave-sp-backlight
   - Calculate if scale type is (non-)linear in pwm_bl

  Fix-ups:
   - Simplify code in lm3630a_bl
   - Trivial rename/whitespace/typo fixes in lms283gf05
   - Remove superfluous NULL check in tosa_lcd
   - Fix power state initialisation in gpio_backlight
   - List supported file in MAINTAINERS

  Bug Fixes:
   - Kconfig - default to not building unless requested in
     {LED,BACKLIGHT}_CLASS_DEVICE"

* tag 'backlight-next-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
  backlight: pwm_bl: Set scale type for brightness curves specified in the DT
  backlight: pwm_bl: Set scale type for CIE 1931 curves
  backlight: Expose brightness curve type through sysfs
  MAINTAINERS: Add entry for stable backlight sysfs ABI documentation
  backlight: gpio-backlight: Correct initial power state handling
  video: backlight: tosa_lcd: drop check because i2c_unregister_device() is NULL safe
  video: backlight: Drop default m for {LCD,BACKLIGHT_CLASS_DEVICE}
  backlight: lms283gf05: Fix a typo in the description passed to 'devm_gpio_request_one()'
  backlight: lm3630a: Switch to use fwnode_property_count_uXX()
  backlight: rave-sp: Leave initial state and register with correct device

Pull PCI updates from Bjorn Helgaas:
 "Enumeration:

   - Consolidate _HPP/_HPX stuff in pci-acpi.c and simplify it
     (Krzysztof Wilczynski)

   - Fix incorrect PCIe device types and remove dev->has_secondary_link
     to simplify code that deals with upstream/downstream ports (Mika
     Westerberg)

   - After suspend, restore Resizable BAR size bits correctly for 1MB
     BARs (Sumit Saxena)

   - Enable PCI_MSI_IRQ_DOMAIN support for RISC-V (Wesley Terpstra)

  Virtualization:

   - Add ACS quirks for iProc PAXB (Abhinav Ratna), Amazon Annapurna
     Labs (Ali Saidi)

   - Move sysfs SR-IOV functions to iov.c (Kelsey Skunberg)

   - Remove group write permissions from sysfs sriov_numvfs,
     sriov_drivers_autoprobe (Kelsey Skunberg)

  Hotplug:

   - Simplify pciehp indicator control (Denis Efremov)

  Peer-to-peer DMA:

   - Allow P2P DMA between root ports for whitelisted bridges (Logan
     Gunthorpe)

   - Whitelist some Intel host bridges for P2P DMA (Logan Gunthorpe)

   - DMA map P2P DMA requests that traverse host bridge (Logan
     Gunthorpe)

  Amazon Annapurna Labs host bridge driver:

   - Add DT binding and controller driver (Jonathan Chocron)

  Hyper-V host bridge driver:

   - Fix hv_pci_dev->pci_slot use-after-free (Dexuan Cui)

   - Fix PCI domain number collisions (Haiyang Zhang)

   - Use instance ID bytes 4 & 5 as PCI domain numbers (Haiyang Zhang)

   - Fix build errors on non-SYSFS config (Randy Dunlap)

  i.MX6 host bridge driver:

   - Limit DBI register length (Stefan Agner)

  Intel VMD host bridge driver:

   - Fix config addressing issues (Jon Derrick)

  Layerscape host bridge driver:

   - Add bar_fixed_64bit property to endpoint driver (Xiaowei Bao)

   - Add CONFIG_PCI_LAYERSCAPE_EP to build EP/RC drivers separately
     (Xiaowei Bao)

  Mediatek host bridge driver:

   - Add MT7629 controller support (Jianjun Wang)

  Mobiveil host bridge driver:

   - Fix CPU base address setup (Hou Zhiqiang)

   - Make "num-lanes" property optional (Hou Zhiqiang)

  Tegra host bridge driver:

   - Fix OF node reference leak (Nishka Dasgupta)

   - Disable MSI for root ports to work around design problem (Vidya
     Sagar)

   - Add Tegra194 DT binding and controller support (Vidya Sagar)

   - Add support for sideband pins and slot regulators (Vidya Sagar)

   - Add PIPE2UPHY support (Vidya Sagar)

  Misc:

   - Remove unused pci_block_cfg_access() et al (Kelsey Skunberg)

   - Unexport pci_bus_get(), etc (Kelsey Skunberg)

   - Hide PM, VC, link speed, ATS, ECRC, PTM constants and interfaces in
     the PCI core (Kelsey Skunberg)

   - Clean up sysfs DEVICE_ATTR() usage (Kelsey Skunberg)

   - Mark expected switch fall-through (Gustavo A. R. Silva)

   - Propagate errors for optional regulators and PHYs (Thierry Reding)

   - Fix kernel command line resource_alignment parameter issues (Logan
     Gunthorpe)"

* tag 'pci-v5.4-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (112 commits)
  PCI: Add pci_irq_vector() and other stubs when !CONFIG_PCI
  arm64: tegra: Add PCIe slot supply information in p2972-0000 platform
  arm64: tegra: Add configuration for PCIe C5 sideband signals
  PCI: tegra: Add support to enable slot regulators
  PCI: tegra: Add support to configure sideband pins
  PCI: vmd: Fix shadow offsets to reflect spec changes
  PCI: vmd: Fix config addressing when using bus offsets
  PCI: dwc: Add validation that PCIe core is set to correct mode
  PCI: dwc: al: Add Amazon Annapurna Labs PCIe controller driver
  dt-bindings: PCI: Add Amazon's Annapurna Labs PCIe host bridge binding
  PCI: Add quirk to disable MSI-X support for Amazon's Annapurna Labs Root Port
  PCI/VPD: Prevent VPD access for Amazon's Annapurna Labs Root Port
  PCI: Add ACS quirk for Amazon Annapurna Labs root ports
  PCI: Add Amazon's Annapurna Labs vendor ID
  MAINTAINERS: Add PCI native host/endpoint controllers designated reviewer
  PCI: hv: Use bytes 4 and 5 from instance ID as the PCI domain numbers
  dt-bindings: PCI: tegra: Add PCIe slot supplies regulator entries
  dt-bindings: PCI: tegra: Add sideband pins configuration entries
  PCI: tegra: Add Tegra194 PCIe support
  PCI: Get rid of dev->has_secondary_link flag
  ...

Pull smack updates from Casey Schaufler:
 "Four patches for v5.4. Nothing is major.

  All but one are in response to mechanically detected potential issues.
  The remaining patch cleans up kernel-doc notations"

* tag 'smack-for-5.4-rc1' of git://github.com/cschaufler/smack-next:
  smack: use GFP_NOFS while holding inode_smack::smk_lock
  security: smack: Fix possible null-pointer dereferences in smack_socket_sock_rcv_skb()
  smack: fix some kernel-doc notations
  Smack: Don't ignore other bprm->unsafe flags if LSM_UNSAFE_PTRACE is set

  - Fix typos and whitespace errors (Bjorn Helgaas, Krzysztof Wilczynski)

  - Remove unnecessary "return" statements (Krzysztof Wilczynski)

  - Correct of_irq_parse_pci() function documentation (Lubomir Rintel)

* pci/trivial:
  PCI: Remove unnecessary returns
  PCI: OF: Correct of_irq_parse_pci() documentation
  PCI: Fix typos and whitespace errors

  - Fix VMD config addressing to ignore starting bus offset (Jon Derrick)

  - Fix VMD shadow offset scratchpad address (Jon Derrick)

* remotes/lorenzo/pci/vmd:
  PCI: vmd: Fix shadow offsets to reflect spec changes
  PCI: vmd: Fix config addressing when using bus offsets

  - Fix Tegra OF node reference leak (Nishka Dasgupta)

  - Add #defines for PCIe Data Link Feature and Physical Layer 16.0 GT/s
    features (Vidya Sagar)

  - Disable MSI for Tegra Root Ports since they don't support using MSI for
    all Root Port events (Vidya Sagar)

  - Group DesignWare write-protected register writes together (Vidya Sagar)

  - Move DesignWare capability search interfaces so they can be used by
    both host and endpoint drivers (Vidya Sagar)

  - Add DesignWare extended capability search interfaces (Vidya Sagar)

  - Export dw_pcie_wait_for_link() so drivers can be modules (Vidya Sagar)

  - Add "snps,enable-cdm-check" DT binding for Configuration Dependent
    Module (CDM) register checking (Vidya Sagar)

  - Add DesignWare support for "snps,enable-cdm-check" CDM checking (Vidya
    Sagar)

  - Add "supports-clkreq" DT binding for host drivers to decide whether to
    advertise low power features (Vidya Sagar)

  - Add DT binding for Tegra194 (Vidya Sagar)

  - Add DT binding for Tegra194 P2U (PIPE to UPHY) block (Vidya Sagar)

  - Add support for Tegra194 P2U (PIPE to UPHY) (Vidya Sagar)

  - Add support for Tegra194 host controller (Vidya Sagar)

  - Add Tegra support for sideband PERST# and CLKREQ# for C5 (Vidya Sagar)

  - Add Tegra support for slot regulators for p2972-0000 platform (Vidya
    Sagar)

* lorenzo/pci/tegra:
  arm64: tegra: Add PCIe slot supply information in p2972-0000 platform
  arm64: tegra: Add configuration for PCIe C5 sideband signals
  PCI: tegra: Add support to enable slot regulators
  PCI: tegra: Add support to configure sideband pins
  dt-bindings: PCI: tegra: Add PCIe slot supplies regulator entries
  dt-bindings: PCI: tegra: Add sideband pins configuration entries
  PCI: tegra: Add Tegra194 PCIe support
  phy: tegra: Add PCIe PIPE2UPHY support
  dt-bindings: PHY: P2U: Add Tegra194 P2U block
  dt-bindings: PCI: tegra: Add device tree support for Tegra194
  dt-bindings: Add PCIe supports-clkreq property
  PCI: dwc: Add support to enable CDM register check
  dt-bindings: PCI: designware: Add binding for CDM register check
  PCI: dwc: Export dw_pcie_wait_for_link() API
  PCI: dwc: Add extended configuration space capability search API
  PCI: dwc: Move config space capability search API
  PCI: dwc: Group DBI registers writes requiring unlocking
  PCI: Disable MSI for Tegra root ports
  PCI: Add #defines for some of PCIe spec r4.0 features
  PCI: tegra: Fix OF node reference leak

  - Fix mobiveil inbound window CPU base address setup (Hou Zhiqiang)

* remotes/lorenzo/pci/mobiveil:
  PCI: mobiveil: Fix the CPU base address setup in inbound window

  - Propagate regulator_get_optional() errors so callers can distinguish
    real errors from optional regulators that are absent (Thierry Reding)

  - Propagate devm_of_phy_get() errors so callers can distinguish
    real errors from optional PHYs that are absent (Thierry Reding)

  - Add Andrew Murray as PCI native driver reviewer (Lorenzo Pieralisi)

* remotes/lorenzo/pci/misc:
  MAINTAINERS: Add PCI native host/endpoint controllers designated reviewer
  PCI: iproc: Propagate errors for optional PHYs
  PCI: histb: Propagate errors for optional regulators
  PCI: armada8x: Propagate errors for optional PHYs
  PCI: imx6: Propagate errors for optional regulators
  PCI: exynos: Propagate errors for optional PHYs
  PCI: rockchip: Propagate errors for optional regulators

  - Add mediatek support for MT7629 (Jianjun Wang)

* remotes/lorenzo/pci/mediatek:
  PCI: mediatek: Add controller support for MT7629
  dt-bindings: PCI: Add support for MT7629

  - Mark Layerscape endpoint BARs 2 and 4 as 64-bit (Xiaowei Bao)

  - Add CONFIG_PCI_LAYERSCAPE_EP so EP/RC can be built separately (Xiaowei
    Bao)

* remotes/lorenzo/pci/layerscape:
  PCI: layerscape: Add CONFIG_PCI_LAYERSCAPE_EP to build EP/RC separately
  PCI: layerscape: Add the bar_fixed_64bit property to the endpoint driver

  - Reduce i.MX 6Quad DBI register length to avoid aborts from accessing
    invalid registers (Stefan Agner)

* remotes/lorenzo/pci/imx:
  PCI: imx6: Limit DBI register length

  - Fix Hyper-V use-after-free in pci_dev removal (Dexuan Cui)

  - Fix Hyper-V build error in non-sysfs config (Randy Dunlap)

  - Reallocate to avoid Hyper-V domain number collisions (Haiyang Zhang)

  - Use Hyper-V instance ID bytes 4-5 to reduce domain collisions (Haiyang
    Zhang)

* remotes/lorenzo/pci/hv:
  PCI: hv: Use bytes 4 and 5 from instance ID as the PCI domain numbers
  PCI: hv: Detect and fix Hyper-V PCI domain number collision
  PCI: pci-hyperv: Fix build errors on non-SYSFS config
  PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it

  - Make kirin_dw_pcie_ops constant (Nishka Dasgupta)

  - Make DesignWare "num-lanes" property optional and remove from relevant
    DTs (Hou Zhiqiang)

* remotes/lorenzo/pci/dwc:
  arm64: dts: fsl: Remove num-lanes property from PCIe nodes
  ARM: dts: ls1021a: Remove num-lanes property from PCIe nodes
  PCI: dwc: Return directly when num-lanes is not found
  dt-bindings: PCI: designware: Remove the num-lanes from Required properties
  PCI: kirin: Make structure kirin_dw_pcie_ops constant

  - Add driver for Amazon Annapurna Labs PCIe controller (Jonathan Chocron)

  - Disable MSI-X since Annapurna Labs advertises it, but it's broken
    (Jonathan Chocron)

  - Disable VPD since Annapurna Labs advertises it, but it's broken
    (Jonathan Chocron)

  - Add ACS quirk since Annapurna Labs doesn't support ACS but does provide
    some equivalent protections (Ali Saidi)

* remotes/lorenzo/pci/al:
  PCI: dwc: Add validation that PCIe core is set to correct mode
  PCI: dwc: al: Add Amazon Annapurna Labs PCIe controller driver
  dt-bindings: PCI: Add Amazon's Annapurna Labs PCIe host bridge binding
  PCI: Add quirk to disable MSI-X support for Amazon's Annapurna Labs Root Port
  PCI/VPD: Prevent VPD access for Amazon's Annapurna Labs Root Port
  PCI: Add ACS quirk for Amazon Annapurna Labs root ports
  PCI: Add Amazon's Annapurna Labs vendor ID

# Conflicts:
#	drivers/pci/quirks.c

  - Convert pci_resource_to_user() to a weak function to remove
    HAVE_ARCH_PCI_RESOURCE_TO_USER #defines (Denis Efremov)

  - Use PCI_SRIOV_NUM_BARS for idiomatic loop structure (Denis Efremov)

  - Fix Resizable BAR size suspend/restore for 1MB BARs (Sumit Saxena)

  - Correct "pci=resource_alignment" example in documentation (Alexey
    Kardashevskiy)

* pci/resource:
  PCI: Correct pci=resource_alignment parameter example
  PCI: Restore Resizable BAR size bits correctly for 1MB BARs
  PCI: Use PCI_SRIOV_NUM_BARS in loops instead of PCI_IOV_RESOURCE_END
  PCI: Convert pci_resource_to_user() to a weak function

# Conflicts:
#	drivers/pci/pci.c

  - Cleanup pciehp LED/indicator control with a new consolidated
    pciehp_set_indicators() interface that controls both Attention and
    Power Indicators (Denis Efremov)

* pci/pciehp:
  PCI: pciehp: Refer to "Indicators" instead of "LEDs" in comments
  PCI: pciehp: Remove pciehp_green_led_{on,off,blink}()
  PCI: pciehp: Remove pciehp_set_attention_status()
  PCI: pciehp: Combine adjacent indicator updates
  PCI: pciehp: Add pciehp_set_indicators() to set both indicators

  - Move P2PCMA PCI bus offset from generic dev_pagemap to
    pci_p2pdma_pagemap (Logan Gunthorpe)

  - Add provider's pci_dev to pci_p2pdma_pagemap (Logan Gunthorpe)

  - Apply host bridge whitelist for ACS (Logan Gunthorpe)

  - Whitelist some Intel host bridges for P2PDMA (Logan Gunthorpe)

  - Add attrs to pci_p2pdma_map_sg() to match dma_map_sg() (Logan
    Gunthorpe)

  - Add pci_p2pdma_unmap_sg() (Logan Gunthorpe)

  - Store P2PDMA mapping method in xarray (Logan Gunthorpe)

  - Map requests that traverse a host bridge (Logan Gunthorpe)

  - Allow IOMMU for host bridge whitelist (Logan Gunthorpe)

* pci/p2pdma:
  PCI/P2PDMA: Update pci_p2pdma_distance_many() documentation
  PCI/P2PDMA: Allow IOMMU for host bridge whitelist
  PCI/P2PDMA: dma_map() requests that traverse the host bridge
  PCI/P2PDMA: Store mapping method in an xarray
  PCI/P2PDMA: Factor out __pci_p2pdma_map_sg()
  PCI/P2PDMA: Introduce pci_p2pdma_unmap_sg()
  PCI/P2PDMA: Add attrs argument to pci_p2pdma_map_sg()
  PCI/P2PDMA: Whitelist some Intel host bridges
  PCI/P2PDMA: Factor out host_bridge_whitelist()
  PCI/P2PDMA: Apply host bridge whitelist for ACS
  PCI/P2PDMA: Factor out __upstream_bridge_distance()
  PCI/P2PDMA: Add constants for map type results to upstream_bridge_distance()
  PCI/P2PDMA: Add provider's pci_dev to pci_p2pdma_pagemap struct
  PCI/P2PDMA: Introduce private pagemap structure

  - Enable PCI_MSI_IRQ_DOMAIN support for RISC-V (Wesley Terpstra)

* pci/msi:
  PCI/MSI: Enable PCI_MSI_IRQ_DOMAIN support for RISC-V

  - Use devm_add_action_or_reset() helper (Fuqian Huang)

  - Mark expected switch fall-through (Gustavo A. R. Silva)

  - Convert sysfs device attributes from __ATTR() to DEVICE_ATTR() (Kelsey
    Skunberg)

  - Convert sysfs file permissions from S_IRUSR etc to octal (Kelsey
    Skunberg)

  - Move SR-IOV sysfs functions to iov.c (Kelsey Skunberg)

  - Add pci_info_ratelimited() to ratelimit PCI messages separately
    (Krzysztof Wilczynski)

  - Fix "'static' not at beginning of declaration" warnings (Krzysztof
    Wilczynski)

  - Clean up resource_alignment parameter to not require static buffer
    (Logan Gunthorpe)

  - Add ACS quirk for iProc PAXB (Abhinav Ratna)

  - Add pci_irq_vector() and other stubs for !CONFIG_PCI (Herbert Xu)

* pci/misc:
  PCI: Add pci_irq_vector() and other stubs when !CONFIG_PCI
  PCI: Add ACS quirk for iProc PAXB
  PCI: Force trailing new line to resource_alignment_param in sysfs
  PCI: Move pci_[get|set]_resource_alignment_param() into their callers
  PCI: Clean up resource_alignment parameter to not require static buffer
  PCI: Use static const struct, not const static struct
  PCI: Add pci_info_ratelimited() to ratelimit PCI separately
  PCI/IOV: Remove group write permission from sriov_numvfs, sriov_drivers_autoprobe
  PCI/IOV: Move sysfs SR-IOV functions to iov.c
  PCI: sysfs: Change permissions from symbolic to octal
  PCI: sysfs: Change DEVICE_ATTR() to DEVICE_ATTR_WO()
  PCI: sysfs: Define device attributes with DEVICE_ATTR*()
  PCI: Mark expected switch fall-through
  PCI: Use devm_add_action_or_reset()

  - Consolidate _HPP & _HPX code in pci-acpi.h and remove unnecessary
    struct hotplug_program_ops (Krzysztof Wilczynski)

  - Fixup PCIe device types to remove the need for dev->has_secondary_link
    (Mika Westerberg)

* pci/enumeration:
  PCI: Get rid of dev->has_secondary_link flag
  PCI: Make pcie_downstream_port() available outside of access.c
  PCI/ACPI: Remove unnecessary struct hotplug_program_ops
  PCI/ACPI: Move _HPP & _HPX functions to pci-acpi.c
  PCI/ACPI: Rename _HPX structs from hpp_* to hpx_*

  - Move many symbols from public linux/pci.h to subsystem-private
    drivers/pci/pci.h (Kelsey Skunberg)

  - Unexport pci_bus_get() and pci_bus_sem since they're not needed by
    modules (Kelsey Skunberg)

  - Remove unused pci_block_cfg_access() et al (Kelsey Skunberg)

* pci/encapsulate:
  PCI: Make pci_set_of_node(), etc private
  PCI: Make pci_enable_ptm() private
  PCI: Make pcie_set_ecrc_checking(), pcie_ecrc_get_policy() private
  PCI: Make pci_ats_init() private
  PCI: Make pcie_update_link_speed() private
  PCI: Make pci_bus_get(), pci_bus_put() private
  PCI: Make pci_hotplug_io_size, mem_size, and bus_size private
  PCI: Make pci_save_vc_state(), pci_restore_vc_state(), etc private
  PCI: Make pci_get_host_bridge_device(), pci_put_host_bridge_device() private
  PCI: Make pci_check_pme_status(), pci_pme_wakeup_bus() private
  PCI: Make PCI_PM_* delay times private
  PCI: Unexport pci_bus_sem
  PCI: Unexport pci_bus_get() and pci_bus_put()
  PCI: Remove pci_block_cfg_access() et al (unused)

  - Consolidate ASPM interfaces in linux/pci.h (Krzysztof Wilczynski)

* pci/aspm:
  PCI: Move ASPM declarations to linux/pci.h

Pull livepatching fix from Jiri Kosina:
 "Error handling fix in livepatching module notifier, from Miroslav
  Benes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching:
  livepatch: Nullify obj->mod in klp_module_coming()'s error path

Pull HID updates from Jiri Kosina:

 - syzbot memory corruption fixes for hidraw, Prodikeys, Logitech and
   Sony drivers from Alan Stern and Roderick Colenbrander

 - stuck 'fn' key fix for hid-apple from Joao Moreno

 - proper propagation of EPOLLOUT from hiddev and hidraw, from Fabian
   Henneke

 - fixes for handling power management for intel-ish devices with NO_D3
   flag set, from Zhang Lixu

 - extension of supported usage range for customer page, as some
   Logitech devices are actually making use of it. From Olivier Gay.

 - hid-multitouch is no longer filtering mice node creation, from
   Benjamin Tissoires

 - MobileStudio Pro 13 support, from Ping Cheng

 - a few other device ID additions and assorted smaller fixes

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (27 commits)
  HID: core: fix dmesg flooding if report field larger than 32bit
  HID: core: Add printk_once variants to hid_warn() etc
  HID: core: reformat and reduce hid_printk macros
  HID: prodikeys: Fix general protection fault during probe
  HID: wacom: add new MobileStudio Pro 13 support
  HID: sony: Fix memory corruption issue on cleanup.
  HID: i2c-hid: modify quirks for weida's devices
  HID: apple: Fix stuck function keys when using FN
  HID: sb0540: add support for Creative SB0540 IR receivers
  HID: Add quirk for HP X500 PIXART OEM mouse
  HID: logitech-dj: Fix crash when initial logi_dj_recv_query_paired_devices fails
  hid-logitech-dj: add the new Lightspeed receiver
  HID: logitech-dj: add support of the G700(s) receiver
  HID: multitouch: add support for the Smart Tech panel
  HID: multitouch: do not filter mice nodes
  HID: do not call hid_set_drvdata(hdev, NULL) in drivers
  HID: wacom: do not call hid_set_drvdata(hdev, NULL)
  HID: logitech: Fix general protection fault caused by Logitech driver
  HID: hidraw: Fix invalid read in hidraw_ioctl
  HID: wacom: support named keys on older devices
  ...

Pull SafeSetID fix from Micah Morton:
 "Jann Horn sent some patches to fix some bugs in SafeSetID for 5.3.
  After he had done his testing there were a couple small code tweaks
  that went in and caused this bug.

  From what I can see SafeSetID is broken in 5.3 and crashes the kernel
  every time during initialization if you try to use it. I came across
  this bug when backporting Jann's changes for 5.3 to older kernels
  (4.14 and 4.19). I've tested on a Chrome OS device with those kernels
  and verified that this change fixes things.

  It doesn't seem super useful to have this bake in linux-next, since it
  is completely broken in 5.3 and nobody noticed"

* tag 'safesetid-bugfix-5.4' of git://github.com/micah-morton/linux:
  LSM: SafeSetID: Stop releasing uninitialized ruleset

Pull selinux updates from Paul Moore:

 - Add LSM hooks, and SELinux access control hooks, for dnotify,
   fanotify, and inotify watches. This has been discussed with both the
   LSM and fs/notify folks and everybody is good with these new hooks.

 - The LSM stacking changes missed a few calls to current_security() in
   the SELinux code; we fix those and remove current_security() for
   good.

 - Improve our network object labeling cache so that we always return
   the object's label, even when under memory pressure. Previously we
   would return an error if we couldn't allocate a new cache entry, now
   we always return the label even if we can't create a new cache entry
   for it.

 - Convert the sidtab atomic_t counter to a normal u32 with
   READ/WRITE_ONCE() and memory barrier protection.

 - A few patches to policydb.c to clean things up (remove forward
   declarations, long lines, bad variable names, etc)

* tag 'selinux-pr-20190917' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  lsm: remove current_security()
  selinux: fix residual uses of current_security() for the SELinux blob
  selinux: avoid atomic_t usage in sidtab
  fanotify, inotify, dnotify, security: add security hook for fs notifications
  selinux: always return a secid from the network caches if we find one
  selinux: policydb - rename type_val_to_struct_array
  selinux: policydb - fix some checkpatch.pl warnings
  selinux: shuffle around policydb.c to get rid of forward declarations

Pull crypto fixes froim Herbert Xu:
 "This fixes the following issues:

   - potential boot hang in hwrng

   - missing switch/break in talitos

   - bugs and warnings in hisilicon

   - build warning in inside-secure"

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: hisilicon - avoid unused function warning
  hwrng: core - don't wait on add_early_randomness()
  crypto: hisilicon - Fix return value check in hisi_zip_acompress()
  crypto: hisilicon - Matching the dma address for dma_pool_free()
  crypto: hisilicon - Fix double free in sec_free_hw_sgl()
  crypto: inside-secure - Fix unused variable warning when CONFIG_PCI=n
  crypto: talitos - fix missing break in switch statement