--- /dev/null
+From ad6930056b58ed4a06925aa96c27185a2a35ceb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 10:37:40 -0400
+Subject: btrfs: call btrfs_orig_bbio_end_io in btrfs_end_bio_work
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 45c2f36871955b51b4ce083c447388d8c72d6b91 ]
+
+When I implemented the storage layer bio splitting, I was under the
+assumption that we'll never split metadata bios. But Qu reminded me that
+this can actually happen with very old file systems with unaligned
+metadata chunks and RAID0.
+
+I still haven't seen such a case in practice, but we better handled this
+case, especially as it is fairly easily to do not calling the ->end_іo
+method directly in btrfs_end_io_work, and using the proper
+btrfs_orig_bbio_end_io helper instead.
+
+In addition to the old file system with unaligned metadata chunks case
+documented in the commit log, the combination of the new scrub code
+with Johannes pending raid-stripe-tree also triggers this case. We
+spent some time debugging it and found that this patch solves
+the problem.
+
+Fixes: 103c19723c80 ("btrfs: split the bio submission path into a separate file")
+CC: stable@vger.kernel.org # 6.3+
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Tested-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/bio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/bio.c b/fs/btrfs/bio.c
+index 726592868e9c5..ada899613486a 100644
+--- a/fs/btrfs/bio.c
++++ b/fs/btrfs/bio.c
+@@ -307,7 +307,7 @@ static void btrfs_end_bio_work(struct work_struct *work)
+
+ /* Metadata reads are checked and repaired by the submitter. */
+ if (bbio->bio.bi_opf & REQ_META)
+- bbio->end_io(bbio);
++ btrfs_orig_bbio_end_io(bbio);
+ else
+ btrfs_check_read_bio(bbio, bbio->bio.bi_private);
+ }
+--
+2.39.2
+
--- /dev/null
+From 7f5e5c15d83a787af0ea234b5141e0f742618b29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Feb 2023 10:18:29 -0800
+Subject: firmware: qcom_scm: Use fixed width src vm bitmap
+
+From: Elliot Berman <quic_eberman@quicinc.com>
+
+[ Upstream commit 968a26a07f75377afbd4f7bb18ef587a1443c244 ]
+
+The maximum VMID for assign_mem is 63. Use a u64 to represent this
+bitmap instead of architecture-dependent "unsigned int" which varies in
+size on 32-bit and 64-bit platforms.
+
+Acked-by: Kalle Valo <kvalo@kernel.org> (ath10k)
+Tested-by: Gokul krishna Krishnakumar <quic_gokukris@quicinc.com>
+Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230213181832.3489174-1-quic_eberman@quicinc.com
+Stable-dep-of: a6e766dea0a2 ("misc: fastrpc: Pass proper scm arguments for secure map request")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom_scm.c | 12 +++++++-----
+ drivers/misc/fastrpc.c | 2 +-
+ drivers/net/wireless/ath/ath10k/qmi.c | 4 ++--
+ drivers/remoteproc/qcom_q6v5_mss.c | 8 ++++----
+ drivers/remoteproc/qcom_q6v5_pas.c | 2 +-
+ drivers/soc/qcom/rmtfs_mem.c | 2 +-
+ include/linux/firmware/qcom/qcom_scm.h | 2 +-
+ 7 files changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index 5f281cb1ae6ba..75cf3556b99a1 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -905,7 +905,7 @@ static int __qcom_scm_assign_mem(struct device *dev, phys_addr_t mem_region,
+ * Return negative errno on failure or 0 on success with @srcvm updated.
+ */
+ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+- unsigned int *srcvm,
++ u64 *srcvm,
+ const struct qcom_scm_vmperm *newvm,
+ unsigned int dest_cnt)
+ {
+@@ -922,9 +922,9 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ __le32 *src;
+ void *ptr;
+ int ret, i, b;
+- unsigned long srcvm_bits = *srcvm;
++ u64 srcvm_bits = *srcvm;
+
+- src_sz = hweight_long(srcvm_bits) * sizeof(*src);
++ src_sz = hweight64(srcvm_bits) * sizeof(*src);
+ mem_to_map_sz = sizeof(*mem_to_map);
+ dest_sz = dest_cnt * sizeof(*destvm);
+ ptr_sz = ALIGN(src_sz, SZ_64) + ALIGN(mem_to_map_sz, SZ_64) +
+@@ -937,8 +937,10 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ /* Fill source vmid detail */
+ src = ptr;
+ i = 0;
+- for_each_set_bit(b, &srcvm_bits, BITS_PER_LONG)
+- src[i++] = cpu_to_le32(b);
++ for (b = 0; b < BITS_PER_TYPE(u64); b++) {
++ if (srcvm_bits & BIT(b))
++ src[i++] = cpu_to_le32(b);
++ }
+
+ /* Fill details of mem buff to map */
+ mem_to_map = ptr + ALIGN(src_sz, SZ_64);
+diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
+index 2be67022263bd..f3f2671d7ac7c 100644
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -262,7 +262,7 @@ struct fastrpc_channel_ctx {
+ int domain_id;
+ int sesscount;
+ int vmcount;
+- u32 perms;
++ u64 perms;
+ struct qcom_scm_vmperm vmperms[FASTRPC_MAX_VMIDS];
+ struct rpmsg_device *rpdev;
+ struct fastrpc_session_ctx session[FASTRPC_MAX_SESSIONS];
+diff --git a/drivers/net/wireless/ath/ath10k/qmi.c b/drivers/net/wireless/ath/ath10k/qmi.c
+index 90f457b8e1feb..038c5903c0dc1 100644
+--- a/drivers/net/wireless/ath/ath10k/qmi.c
++++ b/drivers/net/wireless/ath/ath10k/qmi.c
+@@ -33,7 +33,7 @@ static int ath10k_qmi_map_msa_permission(struct ath10k_qmi *qmi,
+ {
+ struct qcom_scm_vmperm dst_perms[3];
+ struct ath10k *ar = qmi->ar;
+- unsigned int src_perms;
++ u64 src_perms;
+ u32 perm_count;
+ int ret;
+
+@@ -65,7 +65,7 @@ static int ath10k_qmi_unmap_msa_permission(struct ath10k_qmi *qmi,
+ {
+ struct qcom_scm_vmperm dst_perms;
+ struct ath10k *ar = qmi->ar;
+- unsigned int src_perms;
++ u64 src_perms;
+ int ret;
+
+ src_perms = BIT(QCOM_SCM_VMID_MSS_MSA) | BIT(QCOM_SCM_VMID_WLAN);
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index ab053084f7a22..1ba711bc01000 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -235,8 +235,8 @@ struct q6v5 {
+ bool has_qaccept_regs;
+ bool has_ext_cntl_regs;
+ bool has_vq6;
+- int mpss_perm;
+- int mba_perm;
++ u64 mpss_perm;
++ u64 mba_perm;
+ const char *hexagon_mdt_image;
+ int version;
+ };
+@@ -414,7 +414,7 @@ static void q6v5_pds_disable(struct q6v5 *qproc, struct device **pds,
+ }
+ }
+
+-static int q6v5_xfer_mem_ownership(struct q6v5 *qproc, int *current_perm,
++static int q6v5_xfer_mem_ownership(struct q6v5 *qproc, u64 *current_perm,
+ bool local, bool remote, phys_addr_t addr,
+ size_t size)
+ {
+@@ -967,7 +967,7 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw,
+ unsigned long dma_attrs = DMA_ATTR_FORCE_CONTIGUOUS;
+ dma_addr_t phys;
+ void *metadata;
+- int mdata_perm;
++ u64 mdata_perm;
+ int xferop_ret;
+ size_t size;
+ void *ptr;
+diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
+index 0871108fb4dc5..c99a205426851 100644
+--- a/drivers/remoteproc/qcom_q6v5_pas.c
++++ b/drivers/remoteproc/qcom_q6v5_pas.c
+@@ -94,7 +94,7 @@ struct qcom_adsp {
+ size_t region_assign_size;
+
+ int region_assign_idx;
+- int region_assign_perms;
++ u64 region_assign_perms;
+
+ struct qcom_rproc_glink glink_subdev;
+ struct qcom_rproc_subdev smd_subdev;
+diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c
+index 538fa182169a4..0d31377f178d5 100644
+--- a/drivers/soc/qcom/rmtfs_mem.c
++++ b/drivers/soc/qcom/rmtfs_mem.c
+@@ -31,7 +31,7 @@ struct qcom_rmtfs_mem {
+
+ unsigned int client_id;
+
+- unsigned int perms;
++ u64 perms;
+ };
+
+ static ssize_t qcom_rmtfs_mem_show(struct device *dev,
+diff --git a/include/linux/firmware/qcom/qcom_scm.h b/include/linux/firmware/qcom/qcom_scm.h
+index 1e449a5d7f5c1..250ea4efb7cb6 100644
+--- a/include/linux/firmware/qcom/qcom_scm.h
++++ b/include/linux/firmware/qcom/qcom_scm.h
+@@ -94,7 +94,7 @@ extern int qcom_scm_mem_protect_video_var(u32 cp_start, u32 cp_size,
+ u32 cp_nonpixel_start,
+ u32 cp_nonpixel_size);
+ extern int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+- unsigned int *src,
++ u64 *src,
+ const struct qcom_scm_vmperm *newvm,
+ unsigned int dest_cnt);
+
+--
+2.39.2
+
--- /dev/null
+From 3f3c5e2a92ae3e2f8d8aa3fa7389addcffc481af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 16:25:47 +0100
+Subject: misc: fastrpc: Pass proper scm arguments for secure map request
+
+From: Ekansh Gupta <quic_ekangupt@quicinc.com>
+
+[ Upstream commit a6e766dea0a22918735176e4af862d535962f11e ]
+
+If a map request is made with securemap attribute, the memory
+ownership needs to be reassigned to new VMID to allow access
+from protection domain. Currently only DSP VMID is passed to
+the reassign call which is incorrect as only a combination of
+HLOS and DSP VMID is allowed for memory ownership reassignment
+and passing only DSP VMID will cause assign call failure.
+
+Also pass proper restoring permissions to HLOS as the source
+permission will now carry both HLOS and DSP VMID permission.
+
+Change is also made to get valid physical address from
+scatter/gather for this allocation request.
+
+Fixes: e90d91190619 ("misc: fastrpc: Add support to secure memory map")
+Cc: stable <stable@kernel.org>
+Tested-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
+Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230523152550.438363-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/fastrpc.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
+index f3f2671d7ac7c..30d4d0476248f 100644
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -316,12 +316,14 @@ static void fastrpc_free_map(struct kref *ref)
+ if (map->table) {
+ if (map->attr & FASTRPC_ATTR_SECUREMAP) {
+ struct qcom_scm_vmperm perm;
++ int vmid = map->fl->cctx->vmperms[0].vmid;
++ u64 src_perms = BIT(QCOM_SCM_VMID_HLOS) | BIT(vmid);
+ int err = 0;
+
+ perm.vmid = QCOM_SCM_VMID_HLOS;
+ perm.perm = QCOM_SCM_PERM_RWX;
+ err = qcom_scm_assign_mem(map->phys, map->size,
+- &map->fl->cctx->perms, &perm, 1);
++ &src_perms, &perm, 1);
+ if (err) {
+ dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d",
+ map->phys, map->size, err);
+@@ -787,8 +789,12 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+ goto map_err;
+ }
+
+- map->phys = sg_dma_address(map->table->sgl);
+- map->phys += ((u64)fl->sctx->sid << 32);
++ if (attr & FASTRPC_ATTR_SECUREMAP) {
++ map->phys = sg_phys(map->table->sgl);
++ } else {
++ map->phys = sg_dma_address(map->table->sgl);
++ map->phys += ((u64)fl->sctx->sid << 32);
++ }
+ map->size = len;
+ map->va = sg_virt(map->table->sgl);
+ map->len = len;
+@@ -798,9 +804,15 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+ * If subsystem VMIDs are defined in DTSI, then do
+ * hyp_assign from HLOS to those VM(s)
+ */
++ u64 src_perms = BIT(QCOM_SCM_VMID_HLOS);
++ struct qcom_scm_vmperm dst_perms[2] = {0};
++
++ dst_perms[0].vmid = QCOM_SCM_VMID_HLOS;
++ dst_perms[0].perm = QCOM_SCM_PERM_RW;
++ dst_perms[1].vmid = fl->cctx->vmperms[0].vmid;
++ dst_perms[1].perm = QCOM_SCM_PERM_RWX;
+ map->attr = attr;
+- err = qcom_scm_assign_mem(map->phys, (u64)map->size, &fl->cctx->perms,
+- fl->cctx->vmperms, fl->cctx->vmcount);
++ err = qcom_scm_assign_mem(map->phys, (u64)map->size, &src_perms, dst_perms, 2);
+ if (err) {
+ dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d",
+ map->phys, map->size, err);
+--
+2.39.2
+