--- /dev/null
+From fce2ff728f95b8894db14f51c9274dc56c37616f Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 5 Aug 2020 15:35:18 +0200
+Subject: nl80211: fix NL80211_ATTR_HE_6GHZ_CAPABILITY usage
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit fce2ff728f95b8894db14f51c9274dc56c37616f upstream.
+
+In nl80211_set_station(), we check NL80211_ATTR_HE_6GHZ_CAPABILITY
+and then use NL80211_ATTR_HE_CAPABILITY, which is clearly wrong.
+Fix this to use NL80211_ATTR_HE_6GHZ_CAPABILITY as well.
+
+Cc: stable@vger.kernel.org
+Fixes: 43e64bf301fd ("cfg80211: handle 6 GHz capability of new station")
+Link: https://lore.kernel.org/r/20200805153516.310cef625955.I0abc04dc8abb2c7c005c88ef8fa2d0e3c9fb95c4@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/nl80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -6010,7 +6010,7 @@ static int nl80211_set_station(struct sk
+
+ if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
+ params.he_6ghz_capa =
+- nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
++ nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
+
+ if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
+ params.airtime_weight =
--- /dev/null
+From 3c58f737231e2c8cbf543a09d84d8c8e80e05e43 Mon Sep 17 00:00:00 2001
+From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+Date: Thu, 18 Jun 2020 15:16:31 +0200
+Subject: scsi: target: tcmu: Optimize use of flush_dcache_page
+
+From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+
+commit 3c58f737231e2c8cbf543a09d84d8c8e80e05e43 upstream.
+
+(scatter|gather)_data_area() need to flush dcache after writing data to or
+before reading data from a page in uio data area. The two routines are
+able to handle data transfer to/from such a page in fragments and flush the
+cache after each fragment was copied by calling the wrapper
+tcmu_flush_dcache_range().
+
+That means:
+
+1) flush_dcache_page() can be called multiple times for the same page.
+
+2) Calling flush_dcache_page() indirectly using the wrapper does not make
+ sense, because each call of the wrapper is for one single page only and
+ the calling routine already has the correct page pointer.
+
+Change (scatter|gather)_data_area() such that, instead of calling
+tcmu_flush_dcache_range() before/after each memcpy, it now calls
+flush_dcache_page() before unmapping a page (when writing is complete for
+that page) or after mapping a page (when starting to read the page).
+
+After this change only calls to tcmu_flush_dcache_range() for addresses in
+vmalloc'ed command ring are left over.
+
+The patch was tested on ARM with kernel 4.19.118 and 5.7.2
+
+Link: https://lore.kernel.org/r/20200618131632.32748-2-bstroesser@ts.fujitsu.com
+Tested-by: JiangYu <lnsyyj@hotmail.com>
+Tested-by: Daniel Meyerholt <dxm523@gmail.com>
+Acked-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_user.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -676,8 +676,10 @@ static void scatter_data_area(struct tcm
+ from = kmap_atomic(sg_page(sg)) + sg->offset;
+ while (sg_remaining > 0) {
+ if (block_remaining == 0) {
+- if (to)
++ if (to) {
++ flush_dcache_page(page);
+ kunmap_atomic(to);
++ }
+
+ block_remaining = DATA_BLOCK_SIZE;
+ dbi = tcmu_cmd_get_dbi(tcmu_cmd);
+@@ -722,7 +724,6 @@ static void scatter_data_area(struct tcm
+ memcpy(to + offset,
+ from + sg->length - sg_remaining,
+ copy_bytes);
+- tcmu_flush_dcache_range(to, copy_bytes);
+ }
+
+ sg_remaining -= copy_bytes;
+@@ -731,8 +732,10 @@ static void scatter_data_area(struct tcm
+ kunmap_atomic(from - sg->offset);
+ }
+
+- if (to)
++ if (to) {
++ flush_dcache_page(page);
+ kunmap_atomic(to);
++ }
+ }
+
+ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
+@@ -778,13 +781,13 @@ static void gather_data_area(struct tcmu
+ dbi = tcmu_cmd_get_dbi(cmd);
+ page = tcmu_get_block_page(udev, dbi);
+ from = kmap_atomic(page);
++ flush_dcache_page(page);
+ }
+ copy_bytes = min_t(size_t, sg_remaining,
+ block_remaining);
+ if (read_len < copy_bytes)
+ copy_bytes = read_len;
+ offset = DATA_BLOCK_SIZE - block_remaining;
+- tcmu_flush_dcache_range(from, copy_bytes);
+ memcpy(to + sg->length - sg_remaining, from + offset,
+ copy_bytes);
+