LEDE v17.01.0-rc2: adjust config defaults

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

config/Config-devel.in

@@ -59,7 +59,7 @@ menuconfig DEVEL
 		bool "Use ccache" if DEVEL
 		default n
 		help
-		  Compiler cache; see http://ccache.samba.org/.
+		  Compiler cache; see https://ccache.samba.org/
 
 	config EXTERNAL_KERNEL_TREE
 		string "Use external kernel tree" if DEVEL

feeds.conf.default

@@ -1,4 +1,4 @@
-src-git packages https://git.lede-project.org/feed/packages.git;lede-17.01
-src-git luci https://git.lede-project.org/project/luci.git;lede-17.01
-src-git routing https://git.lede-project.org/feed/routing.git;lede-17.01
-src-git telephony https://git.lede-project.org/feed/telephony.git;lede-17.01
+src-git packages https://git.lede-project.org/feed/packages.git^06198d9c8c1ba061a0a5d566545a5c0bbce2b0a4
+src-git luci https://git.lede-project.org/project/luci.git^e306ee6c93c1ef600012f47e40dd75020d4ab555
+src-git routing https://git.lede-project.org/feed/routing.git^dd36dd47bbd75defcb3c517cafe7a19ee425f0af
+src-git telephony https://git.lede-project.org/feed/telephony.git^1f0fb2538ba6fc306198fe2a9a4b976d63adb304

include/host-build.mk

@@ -67,6 +67,12 @@ HOST_CONFIGURE_ARGS = \
 	--localstatedir=$(HOST_BUILD_PREFIX)/var \
 	--sbindir=$(HOST_BUILD_PREFIX)/bin
 
+HOST_MAKE_VARS = \
+	CFLAGS="$(HOST_CFLAGS)" \
+	CPPFLAGS="$(HOST_CPPFLAGS)" \
+	CXXFLAGS="$(HOST_CXXFLAGS)" \
+	LDFLAGS="$(HOST_LDFLAGS)"
+
 HOST_MAKE_FLAGS =
 
 HOST_CONFIGURE_CMD = $(BASH) ./configure
@@ -89,7 +95,8 @@ define Host/Configure
 endef
 
 define Host/Compile/Default
-	+$(MAKE) $(HOST_JOBS) -C $(HOST_BUILD_DIR) \
+	+$(HOST_MAKE_VARS) \
+	$(MAKE) $(HOST_JOBS) -C $(HOST_BUILD_DIR) \
 		$(HOST_MAKE_FLAGS) \
 		$(1)
 endef

include/kernel-version.mk

@@ -3,10 +3,10 @@
 LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .43
-LINUX_VERSION-4.4 = .42
+LINUX_VERSION-4.4 = .47
 
 LINUX_KERNEL_HASH-3.18.43 = 1236e8123a6ce537d5029232560966feed054ae31776fe8481dd7d18cdd5492c
-LINUX_KERNEL_HASH-4.4.42 = 324747568e92f203e3ee5ec8b291a868f58b870f1ad214fa64aa3507ed42e878
+LINUX_KERNEL_HASH-4.4.47 = ce0ac0016f37ba3e9bc8ad3765933b61c4072fcfe4c44804fc7b308cd7f94de7
 
 ifdef KERNEL_PATCHVER
   LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER)))

include/package-ipkg.mk

@@ -209,11 +209,13 @@ $(_endef)
 		( \
 			echo "#!/bin/sh"; \
 			echo "[ \"\$$$${IPKG_NO_SCRIPT}\" = \"1\" ] && exit 0"; \
+			echo "[ -x "\$$$${IPKG_INSTROOT}/lib/functions.sh" ] || exit 0"; \
 			echo ". \$$$${IPKG_INSTROOT}/lib/functions.sh"; \
 			echo "default_postinst \$$$$0 \$$$$@"; \
 		) > postinst; \
 		( \
 			echo "#!/bin/sh"; \
+			echo "[ -x "\$$$${IPKG_INSTROOT}/lib/functions.sh" ] || exit 0"; \
 			echo ". \$$$${IPKG_INSTROOT}/lib/functions.sh"; \
 			echo "default_prerm \$$$$0 \$$$$@"; \
 		) > prerm; \

include/version.mk

@@ -31,16 +31,16 @@ qstrip_escape=$(subst ','\'',$(call qstrip,$(1)))
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))
 
 VERSION_NUMBER:=$(call qstrip_escape,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),17.01-SNAPSHOT)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),17.01.0-rc2)
 
 VERSION_CODE:=$(call qstrip_escape,$(CONFIG_VERSION_CODE))
-VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),$(REVISION))
+VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r3131-42f3c1f)
 
 VERSION_NICK:=$(call qstrip_escape,$(CONFIG_VERSION_NICK))
 VERSION_NICK:=$(if $(VERSION_NICK),$(VERSION_NICK),$(RELEASE))
 
 VERSION_REPO:=$(call qstrip_escape,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.lede-project.org/releases/17.01-SNAPSHOT)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.lede-project.org/releases/17.01.0-rc2)
 
 VERSION_DIST:=$(call qstrip_escape,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),LEDE)

package/base-files/Makefile

@@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/kernel.mk
 include $(INCLUDE_DIR)/version.mk
 
 PKG_NAME:=base-files
-PKG_RELEASE:=171
+PKG_RELEASE:=172
 PKG_FLAGS:=nonshared
 
 PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
@@ -57,6 +57,7 @@ define Package/base-files/conffiles
 /etc/sysctl.d/local.conf
 /etc/sysctl.d/
 /etc/iproute2/rt_tables
+/etc/iproute2/rt_protos
 $(call $(TARGET)/conffiles)
 endef
 

package/base-files/files/bin/config_generate

@@ -226,7 +226,7 @@ generate_static_system() {
 	uci -q batch <<-EOF
 		delete system.@system[0]
 		add system system
-		set system.@system[-1].hostname='lede'
+		set system.@system[-1].hostname='LEDE'
 		set system.@system[-1].timezone='UTC'
 		set system.@system[-1].ttylogin='0'
 		set system.@system[-1].log_size='64'

package/base-files/files/etc/iproute2/rt_protos

@@ -0,0 +1,18 @@
+#
+# Reserved protocols.
+#
+0	unspec
+1	redirect
+2	kernel
+3	boot
+4	static
+8	gated
+9	ra
+10	mrt
+11	zebra
+12	bird
+13	dnrouted
+14	xorp
+15	ntk
+16	dhcp
+42	babel

package/base-files/files/lib/preinit/10_sysinfo

@@ -3,7 +3,7 @@ do_sysinfo_generic() {
 	mkdir -p /tmp/sysinfo
 	[ -e /tmp/sysinfo/board_name ] || \
 		echo "$(strings /proc/device-tree/compatible | head -1)" > /tmp/sysinfo/board_name
-	[ -n /tmp/sysinfo/model -a -e /proc/device-tree/model ] && \
+	[ ! -e /tmp/sysinfo/model -a -e /proc/device-tree/model ] && \
 		echo "$(cat /proc/device-tree/model)" > /tmp/sysinfo/model
 }
 

package/base-files/image-config.in

@@ -190,7 +190,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "http://downloads.lede-project.org/releases/17.01-SNAPSHOT"
+		default "http://downloads.lede-project.org/releases/17.01.0-rc2"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:

package/kernel/kmod-sched-cake/Makefile

@@ -12,10 +12,10 @@ PKG_NAME:=sched-cake
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://github.com/kdarbyshirebryant/sch_cake.git
-PKG_SOURCE_DATE:=2017-01-21
-PKG_SOURCE_VERSION:=69449f3c554e93bd9f7a9b708c808d11fe5dba74
-PKG_MIRROR_HASH:=51dcce8b78e3690296aff1fc22f939b4b73904b9c1d21a583d7d6af803926fac
+PKG_SOURCE_URL:=https://github.com/dtaht/sch_cake.git
+PKG_SOURCE_DATE:=2017-01-28
+PKG_SOURCE_VERSION:=9789742cfc596d48583ba4cdbc8f38d026121fa6
+PKG_MIRROR_HASH:=2a5afc45722c28ca8778eb50452eb305306e7898b32d7d6d73d3e77edf3cce99
 PKG_MAINTAINER:=Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
 
 include $(INCLUDE_DIR)/package.mk

package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh

@@ -756,7 +756,7 @@ drv_mac80211_setup() {
 	for_each_interface "ap" mac80211_prepare_vif
 
 	[ -n "$hostapd_ctrl" ] && {
-		/usr/sbin/hostapd -P /var/run/wifi-$phy.pid -B "$hostapd_conf_file"
+		/usr/sbin/hostapd -s -P /var/run/wifi-$phy.pid -B "$hostapd_conf_file"
 		ret="$?"
 		wireless_add_process "$(cat /var/run/wifi-$phy.pid)" "/usr/sbin/hostapd" 1
 		[ "$ret" != 0 ] && {

package/kernel/mac80211/patches/356-0001-brcmfmac-avoid-maybe-uninitialized-warning-in-brcmf_.patch

@@ -0,0 +1,43 @@
+From d3532ea6ce4ea501e421d130555e59edc2945f99 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 18 Oct 2016 00:13:40 +0200
+Subject: [PATCH] brcmfmac: avoid maybe-uninitialized warning in
+ brcmf_cfg80211_start_ap
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A bugfix added a sanity check around the assignment and use of the
+'is_11d' variable, which looks correct to me, but as the function is
+rather complex already, this confuses the compiler to the point where
+it can no longer figure out if the variable is always initialized
+correctly:
+
+brcm80211/brcmfmac/cfg80211.c: In function ‘brcmf_cfg80211_start_ap’:
+brcm80211/brcmfmac/cfg80211.c:4586:10: error: ‘is_11d’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
+
+This adds an initialization for the newly introduced case in which
+the variable should not really be used, in order to make the warning
+go away.
+
+Fixes: b3589dfe0212 ("brcmfmac: ignore 11d configuration errors")
+Cc: Hante Meuleman <hante.meuleman@broadcom.com>
+Cc: Arend van Spriel <arend.vanspriel@broadcom.com>
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -4516,7 +4516,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 	/* store current 11d setting */
+ 	if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
+ 				  &ifp->vif->is_11d)) {
+-		supports_11d = false;
++		is_11d = supports_11d = false;
+ 	} else {
+ 		country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
+ 					      settings->beacon.tail_len,

package/kernel/mac80211/patches/356-0002-brcmfmac-proto-add-callback-for-queuing-TX-data.patch

@@ -0,0 +1,174 @@
+From b073ac1fcf42376018f6db6acc885dfd2cc9ff02 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 26 Sep 2016 23:51:44 +0200
+Subject: [PATCH] brcmfmac: proto: add callback for queuing TX data
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So far our core code was calling brcmf_fws_process_skb which wasn't
+a proper thing to do. If case of devices using msgbuf protocol fwsignal
+shouldn't be used. It was an unnecessary extra layer simply calling
+a protocol specifix txdata function.
+
+Please note we already have txdata callback, but it's used for calls
+between bcdc and fwsignal so it couldn't be simply used there.
+
+This makes core code more generic (instead of bcdc/fwsignal specific).
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c   | 12 ++++++++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c   |  8 +++++++-
+ .../net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c   | 15 +++++----------
+ .../net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h   |  1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c |  6 +++---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c  |  2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h  |  9 +++++++++
+ 7 files changed, 38 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -326,6 +326,17 @@ brcmf_proto_bcdc_hdrpull(struct brcmf_pu
+ 	return 0;
+ }
+ 
++static int brcmf_proto_bcdc_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
++					  struct sk_buff *skb)
++{
++	struct brcmf_if *ifp = brcmf_get_ifp(drvr, ifidx);
++
++	if (!brcmf_fws_queue_skbs(drvr->fws))
++		return brcmf_proto_txdata(drvr, ifidx, 0, skb);
++
++	return brcmf_fws_process_skb(ifp, skb);
++}
++
+ static int
+ brcmf_proto_bcdc_txdata(struct brcmf_pub *drvr, int ifidx, u8 offset,
+ 			struct sk_buff *pktbuf)
+@@ -375,6 +386,7 @@ int brcmf_proto_bcdc_attach(struct brcmf
+ 	drvr->proto->hdrpull = brcmf_proto_bcdc_hdrpull;
+ 	drvr->proto->query_dcmd = brcmf_proto_bcdc_query_dcmd;
+ 	drvr->proto->set_dcmd = brcmf_proto_bcdc_set_dcmd;
++	drvr->proto->tx_queue_data = brcmf_proto_bcdc_tx_queue_data;
+ 	drvr->proto->txdata = brcmf_proto_bcdc_txdata;
+ 	drvr->proto->configure_addr_mode = brcmf_proto_bcdc_configure_addr_mode;
+ 	drvr->proto->delete_peer = brcmf_proto_bcdc_delete_peer;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -239,7 +239,13 @@ static netdev_tx_t brcmf_netdev_start_xm
+ 	if (eh->h_proto == htons(ETH_P_PAE))
+ 		atomic_inc(&ifp->pend_8021x_cnt);
+ 
+-	ret = brcmf_fws_process_skb(ifp, skb);
++	/* determine the priority */
++	if ((skb->priority == 0) || (skb->priority > 7))
++		skb->priority = cfg80211_classify8021d(skb, NULL);
++
++	ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb);
++	if (ret < 0)
++		brcmf_txfinalize(ifp, skb, false);
+ 
+ done:
+ 	if (ret) {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -2100,16 +2100,6 @@ int brcmf_fws_process_skb(struct brcmf_i
+ 	int rc = 0;
+ 
+ 	brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto));
+-	/* determine the priority */
+-	if ((skb->priority == 0) || (skb->priority > 7))
+-		skb->priority = cfg80211_classify8021d(skb, NULL);
+-
+-	if (fws->avoid_queueing) {
+-		rc = brcmf_proto_txdata(drvr, ifp->ifidx, 0, skb);
+-		if (rc < 0)
+-			brcmf_txfinalize(ifp, skb, false);
+-		return rc;
+-	}
+ 
+ 	/* set control buffer information */
+ 	skcb->if_flags = 0;
+@@ -2442,6 +2432,11 @@ void brcmf_fws_deinit(struct brcmf_pub *
+ 	kfree(fws);
+ }
+ 
++bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws)
++{
++	return !fws->avoid_queueing;
++}
++
+ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws)
+ {
+ 	if (!fws->creditmap_received)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+@@ -20,6 +20,7 @@
+ 
+ int brcmf_fws_init(struct brcmf_pub *drvr);
+ void brcmf_fws_deinit(struct brcmf_pub *drvr);
++bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
+ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
+ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb);
+ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -782,8 +782,8 @@ static int brcmf_msgbuf_schedule_txdata(
+ }
+ 
+ 
+-static int brcmf_msgbuf_txdata(struct brcmf_pub *drvr, int ifidx,
+-			       u8 offset, struct sk_buff *skb)
++static int brcmf_msgbuf_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
++				      struct sk_buff *skb)
+ {
+ 	struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
+ 	struct brcmf_flowring *flow = msgbuf->flow;
+@@ -1467,7 +1467,7 @@ int brcmf_proto_msgbuf_attach(struct brc
+ 	drvr->proto->hdrpull = brcmf_msgbuf_hdrpull;
+ 	drvr->proto->query_dcmd = brcmf_msgbuf_query_dcmd;
+ 	drvr->proto->set_dcmd = brcmf_msgbuf_set_dcmd;
+-	drvr->proto->txdata = brcmf_msgbuf_txdata;
++	drvr->proto->tx_queue_data = brcmf_msgbuf_tx_queue_data;
+ 	drvr->proto->configure_addr_mode = brcmf_msgbuf_configure_addr_mode;
+ 	drvr->proto->delete_peer = brcmf_msgbuf_delete_peer;
+ 	drvr->proto->add_tdls_peer = brcmf_msgbuf_add_tdls_peer;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
+@@ -51,7 +51,7 @@ int brcmf_proto_attach(struct brcmf_pub
+ 			  drvr->bus_if->proto_type);
+ 		goto fail;
+ 	}
+-	if ((proto->txdata == NULL) || (proto->hdrpull == NULL) ||
++	if (!proto->tx_queue_data || (proto->hdrpull == NULL) ||
+ 	    (proto->query_dcmd == NULL) || (proto->set_dcmd == NULL) ||
+ 	    (proto->configure_addr_mode == NULL) ||
+ 	    (proto->delete_peer == NULL) || (proto->add_tdls_peer == NULL)) {
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -33,6 +33,8 @@ struct brcmf_proto {
+ 			  void *buf, uint len);
+ 	int (*set_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
+ 			uint len);
++	int (*tx_queue_data)(struct brcmf_pub *drvr, int ifidx,
++			     struct sk_buff *skb);
+ 	int (*txdata)(struct brcmf_pub *drvr, int ifidx, u8 offset,
+ 		      struct sk_buff *skb);
+ 	void (*configure_addr_mode)(struct brcmf_pub *drvr, int ifidx,
+@@ -74,6 +76,13 @@ static inline int brcmf_proto_set_dcmd(s
+ {
+ 	return drvr->proto->set_dcmd(drvr, ifidx, cmd, buf, len);
+ }
++
++static inline int brcmf_proto_tx_queue_data(struct brcmf_pub *drvr, int ifidx,
++					    struct sk_buff *skb)
++{
++	return drvr->proto->tx_queue_data(drvr, ifidx, skb);
++}
++
+ static inline int brcmf_proto_txdata(struct brcmf_pub *drvr, int ifidx,
+ 				     u8 offset, struct sk_buff *skb)
+ {

package/kernel/mac80211/patches/356-0003-brcmfmac-print-name-of-connect-status-event.patch

@@ -0,0 +1,62 @@
+From e1c122d55f9ec5608ca98a9a846fd39cdf3ed7d7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 14 Oct 2016 09:45:59 +0200
+Subject: [PATCH] brcmfmac: print name of connect status event
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This simplifies debugging. Format %s (%u) comes from similar debugging
+message in brcmf_fweh_event_worker.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c     | 4 ++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h     | 2 ++
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5506,7 +5506,8 @@ brcmf_notify_connect_status_ap(struct br
+ 	u32 reason = e->reason;
+ 	struct station_info sinfo;
+ 
+-	brcmf_dbg(CONN, "event %d, reason %d\n", event, reason);
++	brcmf_dbg(CONN, "event %s (%u), reason %d\n",
++		  brcmf_fweh_event_name(event), event, reason);
+ 	if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
+ 	    ndev != cfg_to_ndev(cfg)) {
+ 		brcmf_dbg(CONN, "AP mode link down\n");
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+@@ -69,7 +69,7 @@ static struct brcmf_fweh_event_name fweh
+  *
+  * @code: code to lookup.
+  */
+-static const char *brcmf_fweh_event_name(enum brcmf_fweh_event_code code)
++const char *brcmf_fweh_event_name(enum brcmf_fweh_event_code code)
+ {
+ 	int i;
+ 	for (i = 0; i < ARRAY_SIZE(fweh_event_names); i++) {
+@@ -79,7 +79,7 @@ static const char *brcmf_fweh_event_name
+ 	return "unknown";
+ }
+ #else
+-static const char *brcmf_fweh_event_name(enum brcmf_fweh_event_code code)
++const char *brcmf_fweh_event_name(enum brcmf_fweh_event_code code)
+ {
+ 	return "nodebug";
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
+@@ -287,6 +287,8 @@ struct brcmf_fweh_info {
+ 					 void *data);
+ };
+ 
++const char *brcmf_fweh_event_name(enum brcmf_fweh_event_code code);
++
+ void brcmf_fweh_attach(struct brcmf_pub *drvr);
+ void brcmf_fweh_detach(struct brcmf_pub *drvr);
+ int brcmf_fweh_register(struct brcmf_pub *drvr, enum brcmf_fweh_event_code code,

package/kernel/mac80211/patches/356-0004-brcmfmac-update-beacon-IE-after-bss-up-and-clear-whe.patch

@@ -0,0 +1,45 @@
+From f25ba69c638b24097840a96bd3caf5599f9a3616 Mon Sep 17 00:00:00 2001
+From: Wright Feng <wefe@cypress.com>
+Date: Fri, 18 Nov 2016 09:59:52 +0800
+Subject: [PATCH] brcmfmac: update beacon IE after bss up and clear when AP
+ stopped
+
+Firmware doesn't update beacon/Probe Response vendor IEs correctly when
+bss is down, so we move brcmf_config_ap_mgmt_ie after BSS up. And host
+driver should clear IEs when AP stopped so that the IEs in host side will
+be synced with in firmware side.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -4578,8 +4578,6 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 		brcmf_configure_opensecurity(ifp);
+ 	}
+ 
+-	brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
+-
+ 	/* Parameters shared by all radio interfaces */
+ 	if (!mbss) {
+ 		if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
+@@ -4708,6 +4706,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ 		WARN_ON(1);
+ 	}
+ 
++	brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
+ 	set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
+ 	brcmf_net_setcarrier(ifp, true);
+ 
+@@ -4764,6 +4763,8 @@ static int brcmf_cfg80211_stop_ap(struct
+ 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
+ 		if (err < 0)
+ 			brcmf_err("BRCMF_C_UP error %d\n", err);
++
++		brcmf_vif_clear_mgmt_ies(ifp->vif);
+ 	} else {
+ 		bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
+ 		bss_enable.enable = cpu_to_le32(0);

package/kernel/mac80211/patches/356-ath9k-check-for-deaf-rx-path-state.patch

@@ -1,100 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 25 Jan 2017 13:00:58 +0100
-Subject: [PATCH] ath9k: check for deaf rx path state
-
-Various chips occasionally run into a state where the tx path still
-appears to be working normally, but the rx path is deaf.
-
-There is no known register signature to check for this state explicitly,
-so use the lack of rx interrupts as an indicator.
-
-This detection is prone to false positives, since a device could also
-simply be in an environment where there are no frames on the air.
-However, in this case doing a reset should be harmless since it's
-obviously not interrupting any real activity. To avoid confusion, call
-the reset counters in this case "Rx path inactive" instead of something
-like "Rx path deaf", since it may not be an indication of a real
-hardware failure.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/drivers/net/wireless/ath/ath9k/ath9k.h
-+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -1027,6 +1027,7 @@ struct ath_softc {
- 
- 	u8 gtt_cnt;
- 	u32 intrstatus;
-+	u32 rx_active;
- 	u16 ps_flags; /* PS_* */
- 	bool ps_enabled;
- 	bool ps_idle;
---- a/drivers/net/wireless/ath/ath9k/debug.c
-+++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -763,6 +763,7 @@ static int read_file_reset(struct seq_fi
- 		[RESET_TYPE_BEACON_STUCK] = "Stuck Beacon",
- 		[RESET_TYPE_MCI] = "MCI Reset",
- 		[RESET_TYPE_CALIBRATION] = "Calibration error",
-+		[RESET_TYPE_RX_INACTIVE] = "Rx path inactive",
- 		[RESET_TX_DMA_ERROR] = "Tx DMA stop error",
- 		[RESET_RX_DMA_ERROR] = "Rx DMA stop error",
- 	};
---- a/drivers/net/wireless/ath/ath9k/debug.h
-+++ b/drivers/net/wireless/ath/ath9k/debug.h
-@@ -50,6 +50,7 @@ enum ath_reset_type {
- 	RESET_TYPE_BEACON_STUCK,
- 	RESET_TYPE_MCI,
- 	RESET_TYPE_CALIBRATION,
-+	RESET_TYPE_RX_INACTIVE,
- 	RESET_TX_DMA_ERROR,
- 	RESET_RX_DMA_ERROR,
- 	__RESET_TYPE_MAX
---- a/drivers/net/wireless/ath/ath9k/link.c
-+++ b/drivers/net/wireless/ath/ath9k/link.c
-@@ -53,13 +53,27 @@ reset:
- 
- }
- 
-+static bool ath_rx_active_check(struct ath_softc *sc)
-+{
-+	if (sc->rx_active) {
-+		sc->rx_active = 0;
-+		return true;
-+	}
-+
-+	ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
-+		"rx path inactive, resetting the chip\n");
-+	ath9k_queue_reset(sc, RESET_TYPE_RX_INACTIVE);
-+	return false;
-+}
-+
- void ath_hw_check_work(struct work_struct *work)
- {
- 	struct ath_softc *sc = container_of(work, struct ath_softc,
- 					    hw_check_work.work);
- 
- 	if (!ath_hw_check(sc) ||
--	    !ath_tx_complete_check(sc))
-+	    !ath_tx_complete_check(sc) ||
-+	    !ath_rx_active_check(sc))
- 		return;
- 
- 	ieee80211_queue_delayed_work(sc->hw, &sc->hw_check_work,
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -269,6 +269,7 @@ static bool ath_complete_reset(struct at
- 	}
- 
- 	sc->gtt_cnt = 0;
-+	sc->rx_active = 1;
- 
- 	ath9k_hw_set_interrupts(ah);
- 	ath9k_hw_enable_interrupts(ah);
-@@ -452,6 +453,7 @@ void ath9k_tasklet(unsigned long data)
- 			ath_rx_tasklet(sc, 0, true);
- 
- 		ath_rx_tasklet(sc, 0, false);
-+		sc->rx_active = 1;
- 	}
- 
- 	if (status & ATH9K_INT_TX) {

package/kernel/mac80211/patches/356-ath9k-fix-race-condition-in-enabling-disabling-IRQs.patch

@@ -118,7 +118,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -375,21 +375,20 @@ void ath9k_tasklet(unsigned long data)
+@@ -374,21 +374,20 @@ void ath9k_tasklet(unsigned long data)
  	struct ath_common *common = ath9k_hw_common(ah);
  	enum ath_reset_type type;
  	unsigned long flags;
@@ -146,7 +146,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		ath_dbg(common, RESET, "FATAL: Skipping interrupts\n");
  		goto out;
  	}
-@@ -405,11 +404,6 @@ void ath9k_tasklet(unsigned long data)
+@@ -404,11 +403,6 @@ void ath9k_tasklet(unsigned long data)
  			type = RESET_TYPE_BB_WATCHDOG;
  			ath9k_queue_reset(sc, type);
  
@@ -158,7 +158,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			ath_dbg(common, RESET,
  				"BB_WATCHDOG: Skipping interrupts\n");
  			goto out;
-@@ -422,7 +416,6 @@ void ath9k_tasklet(unsigned long data)
+@@ -421,7 +415,6 @@ void ath9k_tasklet(unsigned long data)
  		if ((sc->gtt_cnt >= MAX_GTT_CNT) && !ath9k_hw_check_alive(ah)) {
  			type = RESET_TYPE_TX_GTT;
  			ath9k_queue_reset(sc, type);
@@ -166,7 +166,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			ath_dbg(common, RESET,
  				"GTT: Skipping interrupts\n");
  			goto out;
-@@ -480,7 +473,7 @@ void ath9k_tasklet(unsigned long data)
+@@ -478,7 +471,7 @@ void ath9k_tasklet(unsigned long data)
  	ath9k_btcoex_handle_interrupt(sc, status);
  
  	/* re-enable hardware interrupt */
@@ -175,7 +175,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  out:
  	spin_unlock(&sc->sc_pcu_lock);
  	ath9k_ps_restore(sc);
-@@ -544,7 +537,9 @@ irqreturn_t ath_isr(int irq, void *dev)
+@@ -542,7 +535,9 @@ irqreturn_t ath_isr(int irq, void *dev)
  		return IRQ_NONE;
  
  	/* Cache the status */
@@ -186,7 +186,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (status & SCHED_INTR)
  		sched = true;
-@@ -590,7 +585,7 @@ chip_reset:
+@@ -588,7 +583,7 @@ chip_reset:
  
  	if (sched) {
  		/* turn off every interrupt */

package/kernel/mac80211/patches/357-0001-brcmfmac-add-pcie-host-dongle-interface-rev6-support.patch

@@ -0,0 +1,490 @@
+From be4b092cab84b2ecc01ee7f4da6a044279430b6f Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:20 +0000
+Subject: [PATCH] brcmfmac: add pcie host dongle interface rev6 support
+
+In rev6 of pcie host dongle interface protocol, host needs to maximum
+supported ring number from dongle shared memory and set up ring buffer
+and ring indices offset accordingly.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  10 +-
+ .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c  |  38 +++--
+ .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.h  |   4 +
+ .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    | 171 ++++++++++++---------
+ 4 files changed, 132 insertions(+), 91 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -22,10 +22,12 @@
+ /* IDs of the 6 default common rings of msgbuf protocol */
+ #define BRCMF_H2D_MSGRING_CONTROL_SUBMIT	0
+ #define BRCMF_H2D_MSGRING_RXPOST_SUBMIT		1
++#define BRCMF_H2D_MSGRING_FLOWRING_IDSTART	2
+ #define BRCMF_D2H_MSGRING_CONTROL_COMPLETE	2
+ #define BRCMF_D2H_MSGRING_TX_COMPLETE		3
+ #define BRCMF_D2H_MSGRING_RX_COMPLETE		4
+ 
++
+ #define BRCMF_NROF_H2D_COMMON_MSGRINGS		2
+ #define BRCMF_NROF_D2H_COMMON_MSGRINGS		3
+ #define BRCMF_NROF_COMMON_MSGRINGS	(BRCMF_NROF_H2D_COMMON_MSGRINGS + \
+@@ -95,14 +97,18 @@ struct brcmf_bus_ops {
+  * @flowrings: commonrings which are dynamically created and destroyed for data.
+  * @rx_dataoffset: if set then all rx data has this this offset.
+  * @max_rxbufpost: maximum number of buffers to post for rx.
+- * @nrof_flowrings: number of flowrings.
++ * @max_flowrings: maximum number of tx flow rings supported.
++ * @max_submissionrings: maximum number of submission rings(h2d) supported.
++ * @max_completionrings: maximum number of completion rings(d2h) supported.
+  */
+ struct brcmf_bus_msgbuf {
+ 	struct brcmf_commonring *commonrings[BRCMF_NROF_COMMON_MSGRINGS];
+ 	struct brcmf_commonring **flowrings;
+ 	u32 rx_dataoffset;
+ 	u32 max_rxbufpost;
+-	u32 nrof_flowrings;
++	u16 max_flowrings;
++	u16 max_submissionrings;
++	u16 max_completionrings;
+ };
+ 
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -87,11 +87,6 @@ struct msgbuf_common_hdr {
+ 	__le32				request_id;
+ };
+ 
+-struct msgbuf_buf_addr {
+-	__le32				low_addr;
+-	__le32				high_addr;
+-};
+-
+ struct msgbuf_ioctl_req_hdr {
+ 	struct msgbuf_common_hdr	msg;
+ 	__le32				cmd;
+@@ -227,7 +222,10 @@ struct brcmf_msgbuf {
+ 	struct brcmf_commonring **commonrings;
+ 	struct brcmf_commonring **flowrings;
+ 	dma_addr_t *flowring_dma_handle;
+-	u16 nrof_flowrings;
++
++	u16 max_flowrings;
++	u16 max_submissionrings;
++	u16 max_completionrings;
+ 
+ 	u16 rx_dataoffset;
+ 	u32 max_rxbufpost;
+@@ -610,7 +608,7 @@ brcmf_msgbuf_flowring_create_worker(stru
+ 	create->msg.request_id = 0;
+ 	create->tid = brcmf_flowring_tid(msgbuf->flow, flowid);
+ 	create->flow_ring_id = cpu_to_le16(flowid +
+-					   BRCMF_NROF_H2D_COMMON_MSGRINGS);
++					   BRCMF_H2D_MSGRING_FLOWRING_IDSTART);
+ 	memcpy(create->sa, work->sa, ETH_ALEN);
+ 	memcpy(create->da, work->da, ETH_ALEN);
+ 	address = (u64)msgbuf->flowring_dma_handle[flowid];
+@@ -760,7 +758,7 @@ static void brcmf_msgbuf_txflow_worker(s
+ 	u32 flowid;
+ 
+ 	msgbuf = container_of(worker, struct brcmf_msgbuf, txflow_work);
+-	for_each_set_bit(flowid, msgbuf->flow_map, msgbuf->nrof_flowrings) {
++	for_each_set_bit(flowid, msgbuf->flow_map, msgbuf->max_flowrings) {
+ 		clear_bit(flowid, msgbuf->flow_map);
+ 		brcmf_msgbuf_txflow(msgbuf, flowid);
+ 	}
+@@ -866,7 +864,7 @@ brcmf_msgbuf_process_txstatus(struct brc
+ 	tx_status = (struct msgbuf_tx_status *)buf;
+ 	idx = le32_to_cpu(tx_status->msg.request_id);
+ 	flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
+-	flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
++	flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+ 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
+ 				     msgbuf->tx_pktids, idx);
+ 	if (!skb)
+@@ -1174,7 +1172,7 @@ brcmf_msgbuf_process_flow_ring_create_re
+ 	flowring_create_resp = (struct msgbuf_flowring_create_resp *)buf;
+ 
+ 	flowid = le16_to_cpu(flowring_create_resp->compl_hdr.flow_ring_id);
+-	flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
++	flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+ 	status =  le16_to_cpu(flowring_create_resp->compl_hdr.status);
+ 
+ 	if (status) {
+@@ -1202,7 +1200,7 @@ brcmf_msgbuf_process_flow_ring_delete_re
+ 	flowring_delete_resp = (struct msgbuf_flowring_delete_resp *)buf;
+ 
+ 	flowid = le16_to_cpu(flowring_delete_resp->compl_hdr.flow_ring_id);
+-	flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
++	flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+ 	status =  le16_to_cpu(flowring_delete_resp->compl_hdr.status);
+ 
+ 	if (status) {
+@@ -1307,7 +1305,7 @@ int brcmf_proto_msgbuf_rx_trigger(struct
+ 	brcmf_msgbuf_process_rx(msgbuf, buf);
+ 
+ 	for_each_set_bit(flowid, msgbuf->txstatus_done_map,
+-			 msgbuf->nrof_flowrings) {
++			 msgbuf->max_flowrings) {
+ 		clear_bit(flowid, msgbuf->txstatus_done_map);
+ 		commonring = msgbuf->flowrings[flowid];
+ 		qlen = brcmf_flowring_qlen(msgbuf->flow, flowid);
+@@ -1349,7 +1347,7 @@ void brcmf_msgbuf_delete_flowring(struct
+ 	delete->msg.request_id = 0;
+ 
+ 	delete->flow_ring_id = cpu_to_le16(flowid +
+-					   BRCMF_NROF_H2D_COMMON_MSGRINGS);
++					   BRCMF_H2D_MSGRING_FLOWRING_IDSTART);
+ 	delete->reason = 0;
+ 
+ 	brcmf_dbg(MSGBUF, "Send Flow Delete Req flow ID %d, ifindex %d\n",
+@@ -1427,10 +1425,10 @@ int brcmf_proto_msgbuf_attach(struct brc
+ 
+ 	if_msgbuf = drvr->bus_if->msgbuf;
+ 
+-	if (if_msgbuf->nrof_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
++	if (if_msgbuf->max_flowrings >= BRCMF_FLOWRING_HASHSIZE) {
+ 		brcmf_err("driver not configured for this many flowrings %d\n",
+-			  if_msgbuf->nrof_flowrings);
+-		if_msgbuf->nrof_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
++			  if_msgbuf->max_flowrings);
++		if_msgbuf->max_flowrings = BRCMF_FLOWRING_HASHSIZE - 1;
+ 	}
+ 
+ 	msgbuf = kzalloc(sizeof(*msgbuf), GFP_KERNEL);
+@@ -1443,7 +1441,7 @@ int brcmf_proto_msgbuf_attach(struct brc
+ 		goto fail;
+ 	}
+ 	INIT_WORK(&msgbuf->txflow_work, brcmf_msgbuf_txflow_worker);
+-	count = BITS_TO_LONGS(if_msgbuf->nrof_flowrings);
++	count = BITS_TO_LONGS(if_msgbuf->max_flowrings);
+ 	count = count * sizeof(unsigned long);
+ 	msgbuf->flow_map = kzalloc(count, GFP_KERNEL);
+ 	if (!msgbuf->flow_map)
+@@ -1479,8 +1477,8 @@ int brcmf_proto_msgbuf_attach(struct brc
+ 	msgbuf->commonrings =
+ 		(struct brcmf_commonring **)if_msgbuf->commonrings;
+ 	msgbuf->flowrings = (struct brcmf_commonring **)if_msgbuf->flowrings;
+-	msgbuf->nrof_flowrings = if_msgbuf->nrof_flowrings;
+-	msgbuf->flowring_dma_handle = kzalloc(msgbuf->nrof_flowrings *
++	msgbuf->max_flowrings = if_msgbuf->max_flowrings;
++	msgbuf->flowring_dma_handle = kzalloc(msgbuf->max_flowrings *
+ 		sizeof(*msgbuf->flowring_dma_handle), GFP_KERNEL);
+ 	if (!msgbuf->flowring_dma_handle)
+ 		goto fail;
+@@ -1501,7 +1499,7 @@ int brcmf_proto_msgbuf_attach(struct brc
+ 		goto fail;
+ 
+ 	msgbuf->flow = brcmf_flowring_attach(drvr->bus_if->dev,
+-					     if_msgbuf->nrof_flowrings);
++					     if_msgbuf->max_flowrings);
+ 	if (!msgbuf->flow)
+ 		goto fail;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.h
+@@ -31,6 +31,10 @@
+ #define BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE		32
+ #define BRCMF_H2D_TXFLOWRING_ITEMSIZE			48
+ 
++struct msgbuf_buf_addr {
++	__le32		low_addr;
++	__le32		high_addr;
++};
+ 
+ int brcmf_proto_msgbuf_rx_trigger(struct device *dev);
+ void brcmf_msgbuf_delete_flowring(struct brcmf_pub *drvr, u16 flowid);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -135,7 +135,7 @@ static struct brcmf_firmware_mapping brc
+ 						 BRCMF_PCIE_MB_INT_D2H3_DB1)
+ 
+ #define BRCMF_PCIE_MIN_SHARED_VERSION		5
+-#define BRCMF_PCIE_MAX_SHARED_VERSION		5
++#define BRCMF_PCIE_MAX_SHARED_VERSION		6
+ #define BRCMF_PCIE_SHARED_VERSION_MASK		0x00FF
+ #define BRCMF_PCIE_SHARED_DMA_INDEX		0x10000
+ #define BRCMF_PCIE_SHARED_DMA_2B_IDX		0x100000
+@@ -166,17 +166,6 @@ static struct brcmf_firmware_mapping brc
+ #define BRCMF_RING_MEM_SZ			16
+ #define BRCMF_RING_STATE_SZ			8
+ 
+-#define BRCMF_SHARED_RING_H2D_W_IDX_PTR_OFFSET	4
+-#define BRCMF_SHARED_RING_H2D_R_IDX_PTR_OFFSET	8
+-#define BRCMF_SHARED_RING_D2H_W_IDX_PTR_OFFSET	12
+-#define BRCMF_SHARED_RING_D2H_R_IDX_PTR_OFFSET	16
+-#define BRCMF_SHARED_RING_H2D_WP_HADDR_OFFSET	20
+-#define BRCMF_SHARED_RING_H2D_RP_HADDR_OFFSET	28
+-#define BRCMF_SHARED_RING_D2H_WP_HADDR_OFFSET	36
+-#define BRCMF_SHARED_RING_D2H_RP_HADDR_OFFSET	44
+-#define BRCMF_SHARED_RING_TCM_MEMLOC_OFFSET	0
+-#define BRCMF_SHARED_RING_MAX_SUB_QUEUES	52
+-
+ #define BRCMF_DEF_MAX_RXBUFPOST			255
+ 
+ #define BRCMF_CONSOLE_BUFADDR_OFFSET		8
+@@ -231,7 +220,9 @@ struct brcmf_pcie_shared_info {
+ 	struct brcmf_pcie_ringbuf *commonrings[BRCMF_NROF_COMMON_MSGRINGS];
+ 	struct brcmf_pcie_ringbuf *flowrings;
+ 	u16 max_rxbufpost;
+-	u32 nrof_flowrings;
++	u16 max_flowrings;
++	u16 max_submissionrings;
++	u16 max_completionrings;
+ 	u32 rx_dataoffset;
+ 	u32 htod_mb_data_addr;
+ 	u32 dtoh_mb_data_addr;
+@@ -241,6 +232,7 @@ struct brcmf_pcie_shared_info {
+ 	dma_addr_t scratch_dmahandle;
+ 	void *ringupd;
+ 	dma_addr_t ringupd_dmahandle;
++	u8 version;
+ };
+ 
+ struct brcmf_pcie_core_info {
+@@ -284,6 +276,36 @@ struct brcmf_pcie_ringbuf {
+ 	u8 id;
+ };
+ 
++/**
++ * struct brcmf_pcie_dhi_ringinfo - dongle/host interface shared ring info
++ *
++ * @ringmem: dongle memory pointer to ring memory location
++ * @h2d_w_idx_ptr: h2d ring write indices dongle memory pointers
++ * @h2d_r_idx_ptr: h2d ring read indices dongle memory pointers
++ * @d2h_w_idx_ptr: d2h ring write indices dongle memory pointers
++ * @d2h_r_idx_ptr: d2h ring read indices dongle memory pointers
++ * @h2d_w_idx_hostaddr: h2d ring write indices host memory pointers
++ * @h2d_r_idx_hostaddr: h2d ring read indices host memory pointers
++ * @d2h_w_idx_hostaddr: d2h ring write indices host memory pointers
++ * @d2h_r_idx_hostaddr: d2h ring reaD indices host memory pointers
++ * @max_flowrings: maximum number of tx flow rings supported.
++ * @max_submissionrings: maximum number of submission rings(h2d) supported.
++ * @max_completionrings: maximum number of completion rings(d2h) supported.
++ */
++struct brcmf_pcie_dhi_ringinfo {
++	__le32			ringmem;
++	__le32			h2d_w_idx_ptr;
++	__le32			h2d_r_idx_ptr;
++	__le32			d2h_w_idx_ptr;
++	__le32			d2h_r_idx_ptr;
++	struct msgbuf_buf_addr	h2d_w_idx_hostaddr;
++	struct msgbuf_buf_addr	h2d_r_idx_hostaddr;
++	struct msgbuf_buf_addr	d2h_w_idx_hostaddr;
++	struct msgbuf_buf_addr	d2h_r_idx_hostaddr;
++	__le16			max_flowrings;
++	__le16			max_submissionrings;
++	__le16			max_completionrings;
++};
+ 
+ static const u32 brcmf_ring_max_item[BRCMF_NROF_COMMON_MSGRINGS] = {
+ 	BRCMF_H2D_MSGRING_CONTROL_SUBMIT_MAX_ITEM,
+@@ -1054,26 +1076,35 @@ static int brcmf_pcie_init_ringbuffers(s
+ {
+ 	struct brcmf_pcie_ringbuf *ring;
+ 	struct brcmf_pcie_ringbuf *rings;
+-	u32 ring_addr;
+ 	u32 d2h_w_idx_ptr;
+ 	u32 d2h_r_idx_ptr;
+ 	u32 h2d_w_idx_ptr;
+ 	u32 h2d_r_idx_ptr;
+-	u32 addr;
+ 	u32 ring_mem_ptr;
+ 	u32 i;
+ 	u64 address;
+ 	u32 bufsz;
+-	u16 max_sub_queues;
+ 	u8 idx_offset;
+-
+-	ring_addr = devinfo->shared.ring_info_addr;
+-	brcmf_dbg(PCIE, "Base ring addr = 0x%08x\n", ring_addr);
+-	addr = ring_addr + BRCMF_SHARED_RING_MAX_SUB_QUEUES;
+-	max_sub_queues = brcmf_pcie_read_tcm16(devinfo, addr);
++	struct brcmf_pcie_dhi_ringinfo ringinfo;
++	u16 max_flowrings;
++	u16 max_submissionrings;
++	u16 max_completionrings;
++
++	memcpy_fromio(&ringinfo, devinfo->tcm + devinfo->shared.ring_info_addr,
++		      sizeof(ringinfo));
++	if (devinfo->shared.version >= 6) {
++		max_submissionrings = le16_to_cpu(ringinfo.max_submissionrings);
++		max_flowrings = le16_to_cpu(ringinfo.max_flowrings);
++		max_completionrings = le16_to_cpu(ringinfo.max_completionrings);
++	} else {
++		max_submissionrings = le16_to_cpu(ringinfo.max_flowrings);
++		max_flowrings = max_submissionrings -
++				BRCMF_NROF_H2D_COMMON_MSGRINGS;
++		max_completionrings = BRCMF_NROF_D2H_COMMON_MSGRINGS;
++	}
+ 
+ 	if (devinfo->dma_idx_sz != 0) {
+-		bufsz = (BRCMF_NROF_D2H_COMMON_MSGRINGS + max_sub_queues) *
++		bufsz = (max_submissionrings + max_completionrings) *
+ 			devinfo->dma_idx_sz * 2;
+ 		devinfo->idxbuf = dma_alloc_coherent(&devinfo->pdev->dev, bufsz,
+ 						     &devinfo->idxbuf_dmahandle,
+@@ -1083,14 +1114,10 @@ static int brcmf_pcie_init_ringbuffers(s
+ 	}
+ 
+ 	if (devinfo->dma_idx_sz == 0) {
+-		addr = ring_addr + BRCMF_SHARED_RING_D2H_W_IDX_PTR_OFFSET;
+-		d2h_w_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
+-		addr = ring_addr + BRCMF_SHARED_RING_D2H_R_IDX_PTR_OFFSET;
+-		d2h_r_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
+-		addr = ring_addr + BRCMF_SHARED_RING_H2D_W_IDX_PTR_OFFSET;
+-		h2d_w_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
+-		addr = ring_addr + BRCMF_SHARED_RING_H2D_R_IDX_PTR_OFFSET;
+-		h2d_r_idx_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
++		d2h_w_idx_ptr = le32_to_cpu(ringinfo.d2h_w_idx_ptr);
++		d2h_r_idx_ptr = le32_to_cpu(ringinfo.d2h_r_idx_ptr);
++		h2d_w_idx_ptr = le32_to_cpu(ringinfo.h2d_w_idx_ptr);
++		h2d_r_idx_ptr = le32_to_cpu(ringinfo.h2d_r_idx_ptr);
+ 		idx_offset = sizeof(u32);
+ 		devinfo->write_ptr = brcmf_pcie_write_tcm16;
+ 		devinfo->read_ptr = brcmf_pcie_read_tcm16;
+@@ -1103,34 +1130,42 @@ static int brcmf_pcie_init_ringbuffers(s
+ 		devinfo->read_ptr = brcmf_pcie_read_idx;
+ 
+ 		h2d_w_idx_ptr = 0;
+-		addr = ring_addr + BRCMF_SHARED_RING_H2D_WP_HADDR_OFFSET;
+ 		address = (u64)devinfo->idxbuf_dmahandle;
+-		brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
+-		brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
+-
+-		h2d_r_idx_ptr = h2d_w_idx_ptr + max_sub_queues * idx_offset;
+-		addr = ring_addr + BRCMF_SHARED_RING_H2D_RP_HADDR_OFFSET;
+-		address += max_sub_queues * idx_offset;
+-		brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
+-		brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
+-
+-		d2h_w_idx_ptr = h2d_r_idx_ptr + max_sub_queues * idx_offset;
+-		addr = ring_addr + BRCMF_SHARED_RING_D2H_WP_HADDR_OFFSET;
+-		address += max_sub_queues * idx_offset;
+-		brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
+-		brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
++		ringinfo.h2d_w_idx_hostaddr.low_addr =
++			cpu_to_le32(address & 0xffffffff);
++		ringinfo.h2d_w_idx_hostaddr.high_addr =
++			cpu_to_le32(address >> 32);
++
++		h2d_r_idx_ptr = h2d_w_idx_ptr +
++				max_submissionrings * idx_offset;
++		address += max_submissionrings * idx_offset;
++		ringinfo.h2d_r_idx_hostaddr.low_addr =
++			cpu_to_le32(address & 0xffffffff);
++		ringinfo.h2d_r_idx_hostaddr.high_addr =
++			cpu_to_le32(address >> 32);
++
++		d2h_w_idx_ptr = h2d_r_idx_ptr +
++				max_submissionrings * idx_offset;
++		address += max_submissionrings * idx_offset;
++		ringinfo.d2h_w_idx_hostaddr.low_addr =
++			cpu_to_le32(address & 0xffffffff);
++		ringinfo.d2h_w_idx_hostaddr.high_addr =
++			cpu_to_le32(address >> 32);
+ 
+ 		d2h_r_idx_ptr = d2h_w_idx_ptr +
+-				BRCMF_NROF_D2H_COMMON_MSGRINGS * idx_offset;
+-		addr = ring_addr + BRCMF_SHARED_RING_D2H_RP_HADDR_OFFSET;
+-		address += BRCMF_NROF_D2H_COMMON_MSGRINGS * idx_offset;
+-		brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
+-		brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
++				max_completionrings * idx_offset;
++		address += max_completionrings * idx_offset;
++		ringinfo.d2h_r_idx_hostaddr.low_addr =
++			cpu_to_le32(address & 0xffffffff);
++		ringinfo.d2h_r_idx_hostaddr.high_addr =
++			cpu_to_le32(address >> 32);
++
++		memcpy_toio(devinfo->tcm + devinfo->shared.ring_info_addr,
++			    &ringinfo, sizeof(ringinfo));
+ 		brcmf_dbg(PCIE, "Using host memory indices\n");
+ 	}
+ 
+-	addr = ring_addr + BRCMF_SHARED_RING_TCM_MEMLOC_OFFSET;
+-	ring_mem_ptr = brcmf_pcie_read_tcm32(devinfo, addr);
++	ring_mem_ptr = le32_to_cpu(ringinfo.ringmem);
+ 
+ 	for (i = 0; i < BRCMF_NROF_H2D_COMMON_MSGRINGS; i++) {
+ 		ring = brcmf_pcie_alloc_dma_and_ring(devinfo, i, ring_mem_ptr);
+@@ -1161,20 +1196,19 @@ static int brcmf_pcie_init_ringbuffers(s
+ 		ring_mem_ptr += BRCMF_RING_MEM_SZ;
+ 	}
+ 
+-	devinfo->shared.nrof_flowrings =
+-			max_sub_queues - BRCMF_NROF_H2D_COMMON_MSGRINGS;
+-	rings = kcalloc(devinfo->shared.nrof_flowrings, sizeof(*ring),
+-			GFP_KERNEL);
++	devinfo->shared.max_flowrings = max_flowrings;
++	devinfo->shared.max_submissionrings = max_submissionrings;
++	devinfo->shared.max_completionrings = max_completionrings;
++	rings = kcalloc(max_flowrings, sizeof(*ring), GFP_KERNEL);
+ 	if (!rings)
+ 		goto fail;
+ 
+-	brcmf_dbg(PCIE, "Nr of flowrings is %d\n",
+-		  devinfo->shared.nrof_flowrings);
++	brcmf_dbg(PCIE, "Nr of flowrings is %d\n", max_flowrings);
+ 
+-	for (i = 0; i < devinfo->shared.nrof_flowrings; i++) {
++	for (i = 0; i < max_flowrings; i++) {
+ 		ring = &rings[i];
+ 		ring->devinfo = devinfo;
+-		ring->id = i + BRCMF_NROF_COMMON_MSGRINGS;
++		ring->id = i + BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+ 		brcmf_commonring_register_cb(&ring->commonring,
+ 					     brcmf_pcie_ring_mb_ring_bell,
+ 					     brcmf_pcie_ring_mb_update_rptr,
+@@ -1357,17 +1391,16 @@ brcmf_pcie_init_share_ram_info(struct br
+ {
+ 	struct brcmf_pcie_shared_info *shared;
+ 	u32 addr;
+-	u32 version;
+ 
+ 	shared = &devinfo->shared;
+ 	shared->tcm_base_address = sharedram_addr;
+ 
+ 	shared->flags = brcmf_pcie_read_tcm32(devinfo, sharedram_addr);
+-	version = shared->flags & BRCMF_PCIE_SHARED_VERSION_MASK;
+-	brcmf_dbg(PCIE, "PCIe protocol version %d\n", version);
+-	if ((version > BRCMF_PCIE_MAX_SHARED_VERSION) ||
+-	    (version < BRCMF_PCIE_MIN_SHARED_VERSION)) {
+-		brcmf_err("Unsupported PCIE version %d\n", version);
++	shared->version = (u8)(shared->flags & BRCMF_PCIE_SHARED_VERSION_MASK);
++	brcmf_dbg(PCIE, "PCIe protocol version %d\n", shared->version);
++	if ((shared->version > BRCMF_PCIE_MAX_SHARED_VERSION) ||
++	    (shared->version < BRCMF_PCIE_MIN_SHARED_VERSION)) {
++		brcmf_err("Unsupported PCIE version %d\n", shared->version);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -1661,18 +1694,18 @@ static void brcmf_pcie_setup(struct devi
+ 		bus->msgbuf->commonrings[i] =
+ 				&devinfo->shared.commonrings[i]->commonring;
+ 
+-	flowrings = kcalloc(devinfo->shared.nrof_flowrings, sizeof(*flowrings),
++	flowrings = kcalloc(devinfo->shared.max_flowrings, sizeof(*flowrings),
+ 			    GFP_KERNEL);
+ 	if (!flowrings)
+ 		goto fail;
+ 
+-	for (i = 0; i < devinfo->shared.nrof_flowrings; i++)
++	for (i = 0; i < devinfo->shared.max_flowrings; i++)
+ 		flowrings[i] = &devinfo->shared.flowrings[i].commonring;
+ 	bus->msgbuf->flowrings = flowrings;
+ 
+ 	bus->msgbuf->rx_dataoffset = devinfo->shared.rx_dataoffset;
+ 	bus->msgbuf->max_rxbufpost = devinfo->shared.max_rxbufpost;
+-	bus->msgbuf->nrof_flowrings = devinfo->shared.nrof_flowrings;
++	bus->msgbuf->max_flowrings = devinfo->shared.max_flowrings;
+ 
+ 	init_waitqueue_head(&devinfo->mbdata_resp_wait);
+ 

package/kernel/mac80211/patches/357-0002-brcmfmac-add-support-for-43341-chip.patch

@@ -0,0 +1,39 @@
+From dc630dc5c753ccba97ce174f9c2894f802f9bd93 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:21 +0000
+Subject: [PATCH] brcmfmac: add support for 43341 chip
+
+This chip was already supported, but seems a device came up giving
+a different chip identifier. So adding that effectively mapping to
+the same firmware file as for 43340 chip.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c       | 1 +
+ drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -621,6 +621,7 @@ static struct brcmf_firmware_mapping brc
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
++	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -36,6 +36,7 @@
+ #define BRCM_CC_4330_CHIP_ID		0x4330
+ #define BRCM_CC_4334_CHIP_ID		0x4334
+ #define BRCM_CC_43340_CHIP_ID		43340
++#define BRCM_CC_43341_CHIP_ID		43341
+ #define BRCM_CC_43362_CHIP_ID		43362
+ #define BRCM_CC_4335_CHIP_ID		0x4335
+ #define BRCM_CC_4339_CHIP_ID		0x4339

package/kernel/mac80211/patches/357-0003-brcmfmac-move-pno-helper-functions-in-separate-sourc.patch

@@ -0,0 +1,319 @@
+From ac55136f43d3336c7b40238b779c404008229929 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:22 +0000
+Subject: [PATCH] brcmfmac: move pno helper functions in separate source file
+
+Introducing new source file for pno related functionality. Moving
+existing pno functions.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/Makefile  |   3 +-
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         |  93 ++-----------------
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 100 +++++++++++++++++++++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pno.h |  40 +++++++++
+ 4 files changed, 150 insertions(+), 86 deletions(-)
+ create mode 100644 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+ create mode 100644 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Makefile
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Makefile
+@@ -35,7 +35,8 @@ brcmfmac-objs += \
+ 		firmware.o \
+ 		feature.o \
+ 		btcoex.o \
+-		vendor.o
++		vendor.o \
++		pno.o
+ brcmfmac-$(CPTCFG_BRCMFMAC_PROTO_BCDC) += \
+ 		bcdc.o
+ brcmfmac-$(CPTCFG_BRCMFMAC_PROTO_MSGBUF) += \
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -32,6 +32,7 @@
+ #include "fwil_types.h"
+ #include "p2p.h"
+ #include "btcoex.h"
++#include "pno.h"
+ #include "cfg80211.h"
+ #include "feature.h"
+ #include "fwil.h"
+@@ -41,16 +42,6 @@
+ #include "common.h"
+ 
+ #define BRCMF_SCAN_IE_LEN_MAX		2048
+-#define BRCMF_PNO_VERSION		2
+-#define BRCMF_PNO_TIME			30
+-#define BRCMF_PNO_REPEAT		4
+-#define BRCMF_PNO_FREQ_EXPO_MAX		3
+-#define BRCMF_PNO_MAX_PFN_COUNT		16
+-#define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT	6
+-#define BRCMF_PNO_HIDDEN_BIT		2
+-#define BRCMF_PNO_WPA_AUTH_ANY		0xFFFFFFFF
+-#define BRCMF_PNO_SCAN_COMPLETE		1
+-#define BRCMF_PNO_SCAN_INCOMPLETE	0
+ 
+ #define WPA_OUI				"\x00\x50\xF2"	/* WPA OUI */
+ #define WPA_OUI_TYPE			1
+@@ -3323,76 +3314,6 @@ out_err:
+ 	return err;
+ }
+ 
+-static int brcmf_dev_pno_clean(struct net_device *ndev)
+-{
+-	int ret;
+-
+-	/* Disable pfn */
+-	ret = brcmf_fil_iovar_int_set(netdev_priv(ndev), "pfn", 0);
+-	if (ret == 0) {
+-		/* clear pfn */
+-		ret = brcmf_fil_iovar_data_set(netdev_priv(ndev), "pfnclear",
+-					       NULL, 0);
+-	}
+-	if (ret < 0)
+-		brcmf_err("failed code %d\n", ret);
+-
+-	return ret;
+-}
+-
+-static int brcmf_dev_pno_config(struct brcmf_if *ifp,
+-				struct cfg80211_sched_scan_request *request)
+-{
+-	struct brcmf_pno_param_le pfn_param;
+-	struct brcmf_pno_macaddr_le pfn_mac;
+-	s32 err;
+-	u8 *mac_mask;
+-	int i;
+-
+-	memset(&pfn_param, 0, sizeof(pfn_param));
+-	pfn_param.version = cpu_to_le32(BRCMF_PNO_VERSION);
+-
+-	/* set extra pno params */
+-	pfn_param.flags = cpu_to_le16(1 << BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
+-	pfn_param.repeat = BRCMF_PNO_REPEAT;
+-	pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
+-
+-	/* set up pno scan fr */
+-	pfn_param.scan_freq = cpu_to_le32(BRCMF_PNO_TIME);
+-
+-	err = brcmf_fil_iovar_data_set(ifp, "pfn_set", &pfn_param,
+-				       sizeof(pfn_param));
+-	if (err) {
+-		brcmf_err("pfn_set failed, err=%d\n", err);
+-		return err;
+-	}
+-
+-	/* Find out if mac randomization should be turned on */
+-	if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR))
+-		return 0;
+-
+-	pfn_mac.version = BRCMF_PFN_MACADDR_CFG_VER;
+-	pfn_mac.flags = BRCMF_PFN_MAC_OUI_ONLY | BRCMF_PFN_SET_MAC_UNASSOC;
+-
+-	memcpy(pfn_mac.mac, request->mac_addr, ETH_ALEN);
+-	mac_mask = request->mac_addr_mask;
+-	for (i = 0; i < ETH_ALEN; i++) {
+-		pfn_mac.mac[i] &= mac_mask[i];
+-		pfn_mac.mac[i] |= get_random_int() & ~(mac_mask[i]);
+-	}
+-	/* Clear multi bit */
+-	pfn_mac.mac[0] &= 0xFE;
+-	/* Set locally administered */
+-	pfn_mac.mac[0] |= 0x02;
+-
+-	err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac,
+-				       sizeof(pfn_mac));
+-	if (err)
+-		brcmf_err("pfn_macaddr failed, err=%d\n", err);
+-
+-	return err;
+-}
+-
+ static int
+ brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
+ 				struct net_device *ndev,
+@@ -3436,15 +3357,16 @@ brcmf_cfg80211_sched_scan_start(struct w
+ 
+ 	if (request->n_match_sets > 0) {
+ 		/* clean up everything */
+-		ret = brcmf_dev_pno_clean(ndev);
++		ret = brcmf_pno_clean(ifp);
+ 		if  (ret < 0) {
+ 			brcmf_err("failed error=%d\n", ret);
+ 			return ret;
+ 		}
+ 
+ 		/* configure pno */
+-		if (brcmf_dev_pno_config(ifp, request))
+-			return -EINVAL;
++		ret = brcmf_pno_config(ifp, request);
++		if (ret < 0)
++			return ret;
+ 
+ 		/* configure each match set */
+ 		for (i = 0; i < request->n_match_sets; i++) {
+@@ -3486,11 +3408,12 @@ static int brcmf_cfg80211_sched_scan_sto
+ 					  struct net_device *ndev)
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_if *ifp = netdev_priv(ndev);
+ 
+ 	brcmf_dbg(SCAN, "enter\n");
+-	brcmf_dev_pno_clean(ndev);
++	brcmf_pno_clean(ifp);
+ 	if (cfg->sched_escan)
+-		brcmf_notify_escan_complete(cfg, netdev_priv(ndev), true, true);
++		brcmf_notify_escan_complete(cfg, ifp, true, true);
+ 	return 0;
+ }
+ 
+--- /dev/null
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -0,0 +1,100 @@
++/*
++ * Copyright (c) 2016 Broadcom
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++#include <linux/netdevice.h>
++#include <net/cfg80211.h>
++
++#include "core.h"
++#include "debug.h"
++#include "pno.h"
++#include "fwil.h"
++#include "fwil_types.h"
++
++#define BRCMF_PNO_VERSION		2
++#define BRCMF_PNO_TIME			30
++#define BRCMF_PNO_REPEAT		4
++#define BRCMF_PNO_FREQ_EXPO_MAX		3
++#define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT	6
++#define BRCMF_PNO_SCAN_INCOMPLETE	0
++
++int brcmf_pno_clean(struct brcmf_if *ifp)
++{
++	int ret;
++
++	/* Disable pfn */
++	ret = brcmf_fil_iovar_int_set(ifp, "pfn", 0);
++	if (ret == 0) {
++		/* clear pfn */
++		ret = brcmf_fil_iovar_data_set(ifp, "pfnclear", NULL, 0);
++	}
++	if (ret < 0)
++		brcmf_err("failed code %d\n", ret);
++
++	return ret;
++}
++
++int brcmf_pno_config(struct brcmf_if *ifp,
++		     struct cfg80211_sched_scan_request *request)
++{
++	struct brcmf_pno_param_le pfn_param;
++	struct brcmf_pno_macaddr_le pfn_mac;
++	s32 err;
++	u8 *mac_mask;
++	int i;
++
++	memset(&pfn_param, 0, sizeof(pfn_param));
++	pfn_param.version = cpu_to_le32(BRCMF_PNO_VERSION);
++
++	/* set extra pno params */
++	pfn_param.flags = cpu_to_le16(1 << BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
++	pfn_param.repeat = BRCMF_PNO_REPEAT;
++	pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
++
++	/* set up pno scan fr */
++	pfn_param.scan_freq = cpu_to_le32(BRCMF_PNO_TIME);
++
++	err = brcmf_fil_iovar_data_set(ifp, "pfn_set", &pfn_param,
++				       sizeof(pfn_param));
++	if (err) {
++		brcmf_err("pfn_set failed, err=%d\n", err);
++		return err;
++	}
++
++	/* Find out if mac randomization should be turned on */
++	if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR))
++		return 0;
++
++	pfn_mac.version = BRCMF_PFN_MACADDR_CFG_VER;
++	pfn_mac.flags = BRCMF_PFN_MAC_OUI_ONLY | BRCMF_PFN_SET_MAC_UNASSOC;
++
++	memcpy(pfn_mac.mac, request->mac_addr, ETH_ALEN);
++	mac_mask = request->mac_addr_mask;
++	for (i = 0; i < ETH_ALEN; i++) {
++		pfn_mac.mac[i] &= mac_mask[i];
++		pfn_mac.mac[i] |= get_random_int() & ~(mac_mask[i]);
++	}
++	/* Clear multi bit */
++	pfn_mac.mac[0] &= 0xFE;
++	/* Set locally administered */
++	pfn_mac.mac[0] |= 0x02;
++
++	err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac,
++				       sizeof(pfn_mac));
++	if (err)
++		brcmf_err("pfn_macaddr failed, err=%d\n", err);
++
++	return err;
++}
++
+--- /dev/null
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
+@@ -0,0 +1,40 @@
++/*
++ * Copyright (c) 2016 Broadcom
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++#ifndef _BRCMF_PNO_H
++#define _BRCMF_PNO_H
++
++#define BRCMF_PNO_SCAN_COMPLETE		1
++#define BRCMF_PNO_WPA_AUTH_ANY		0xFFFFFFFF
++#define BRCMF_PNO_HIDDEN_BIT		2
++#define BRCMF_PNO_MAX_PFN_COUNT		16
++
++/**
++ * brcmf_pno_clean - disable and clear pno in firmware.
++ *
++ * @ifp: interface object used.
++ */
++int brcmf_pno_clean(struct brcmf_if *ifp);
++
++/**
++ * brcmf_pno_config - configure pno parameters.
++ *
++ * @ifp: interface object used.
++ * @request: scheduled scan parameters.
++ */
++int brcmf_pno_config(struct brcmf_if *ifp,
++		     struct cfg80211_sched_scan_request *request);
++
++#endif /* _BRCMF_PNO_H */

package/kernel/mac80211/patches/357-0004-brcmfmac-fix-handling-ssids-in-.sched_scan_start-cal.patch

@@ -0,0 +1,221 @@
+From 3e2e86ab19c2a43953de30089c5411c580ddb5f7 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:23 +0000
+Subject: [PATCH] brcmfmac: fix handling ssids in .sched_scan_start() callback
+
+The ssids list in the scheduled scan request were not properly taken
+into account when configuring in firmware. The hidden bit was set for
+any ssid resulting in active scanning for all. Only set it for ssids
+that are in the ssids list.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 103 ++++++++++-----------
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c |  18 ++++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pno.h |  12 ++-
+ 3 files changed, 76 insertions(+), 57 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3314,19 +3314,37 @@ out_err:
+ 	return err;
+ }
+ 
++static bool brcmf_is_ssid_active(struct cfg80211_ssid *ssid,
++				 struct cfg80211_sched_scan_request *req)
++{
++	int i;
++
++	if (!ssid || !req->ssids || !req->n_ssids)
++		return false;
++
++	for (i = 0; i < req->n_ssids; i++) {
++		if (ssid->ssid_len == req->ssids[i].ssid_len) {
++			if (!strncmp(ssid->ssid, req->ssids[i].ssid,
++				     ssid->ssid_len))
++				return true;
++		}
++	}
++	return false;
++}
++
+ static int
+ brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
+ 				struct net_device *ndev,
+-				struct cfg80211_sched_scan_request *request)
++				struct cfg80211_sched_scan_request *req)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+-	struct brcmf_pno_net_param_le pfn;
++	struct cfg80211_ssid *ssid;
+ 	int i;
+ 	int ret = 0;
+ 
+ 	brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
+-		  request->n_match_sets, request->n_ssids);
++		  req->n_match_sets, req->n_ssids);
+ 	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
+ 		brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
+ 		return -EAGAIN;
+@@ -3337,71 +3355,46 @@ brcmf_cfg80211_sched_scan_start(struct w
+ 		return -EAGAIN;
+ 	}
+ 
+-	if (!request->n_ssids || !request->n_match_sets) {
+-		brcmf_dbg(SCAN, "Invalid sched scan req!! n_ssids:%d\n",
+-			  request->n_ssids);
++	if (req->n_match_sets <= 0) {
++		brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
++			  req->n_match_sets);
+ 		return -EINVAL;
+ 	}
+ 
+-	if (request->n_ssids > 0) {
+-		for (i = 0; i < request->n_ssids; i++) {
+-			/* Active scan req for ssids */
+-			brcmf_dbg(SCAN, ">>> Active scan req for ssid (%s)\n",
+-				  request->ssids[i].ssid);
+-
+-			/* match_set ssids is a supert set of n_ssid list,
+-			 * so we need not add these set separately.
+-			 */
+-		}
++	/* clean up everything */
++	ret = brcmf_pno_clean(ifp);
++	if  (ret < 0) {
++		brcmf_err("failed error=%d\n", ret);
++		return ret;
+ 	}
+ 
+-	if (request->n_match_sets > 0) {
+-		/* clean up everything */
+-		ret = brcmf_pno_clean(ifp);
+-		if  (ret < 0) {
+-			brcmf_err("failed error=%d\n", ret);
+-			return ret;
++	/* configure pno */
++	ret = brcmf_pno_config(ifp, req);
++	if (ret < 0)
++		return ret;
++
++	/* configure each match set */
++	for (i = 0; i < req->n_match_sets; i++) {
++
++		ssid = &req->match_sets[i].ssid;
++
++		if (!ssid->ssid_len) {
++			brcmf_err("skip broadcast ssid\n");
++			continue;
+ 		}
+ 
+-		/* configure pno */
+-		ret = brcmf_pno_config(ifp, request);
++		ret = brcmf_pno_add_ssid(ifp, ssid,
++					 brcmf_is_ssid_active(ssid, req));
+ 		if (ret < 0)
+-			return ret;
+-
+-		/* configure each match set */
+-		for (i = 0; i < request->n_match_sets; i++) {
+-			struct cfg80211_ssid *ssid;
+-			u32 ssid_len;
+-
+-			ssid = &request->match_sets[i].ssid;
+-			ssid_len = ssid->ssid_len;
+-
+-			if (!ssid_len) {
+-				brcmf_err("skip broadcast ssid\n");
+-				continue;
+-			}
+-			pfn.auth = cpu_to_le32(WLAN_AUTH_OPEN);
+-			pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
+-			pfn.wsec = cpu_to_le32(0);
+-			pfn.infra = cpu_to_le32(1);
+-			pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
+-			pfn.ssid.SSID_len = cpu_to_le32(ssid_len);
+-			memcpy(pfn.ssid.SSID, ssid->ssid, ssid_len);
+-			ret = brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn,
+-						       sizeof(pfn));
+ 			brcmf_dbg(SCAN, ">>> PNO filter %s for ssid (%s)\n",
+ 				  ret == 0 ? "set" : "failed", ssid->ssid);
+-		}
+-		/* Enable the PNO */
+-		if (brcmf_fil_iovar_int_set(ifp, "pfn", 1) < 0) {
+-			brcmf_err("PNO enable failed!! ret=%d\n", ret);
+-			return -EINVAL;
+-		}
+-	} else {
+-		return -EINVAL;
+ 	}
++	/* Enable the PNO */
++	ret = brcmf_fil_iovar_int_set(ifp, "pfn", 1);
++	if (ret < 0)
++		brcmf_err("PNO enable failed!! ret=%d\n", ret);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -28,6 +28,8 @@
+ #define BRCMF_PNO_FREQ_EXPO_MAX		3
+ #define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT	6
+ #define BRCMF_PNO_SCAN_INCOMPLETE	0
++#define BRCMF_PNO_WPA_AUTH_ANY		0xFFFFFFFF
++#define BRCMF_PNO_HIDDEN_BIT		2
+ 
+ int brcmf_pno_clean(struct brcmf_if *ifp)
+ {
+@@ -98,3 +100,19 @@ int brcmf_pno_config(struct brcmf_if *if
+ 	return err;
+ }
+ 
++int brcmf_pno_add_ssid(struct brcmf_if *ifp, struct cfg80211_ssid *ssid,
++		       bool active)
++{
++	struct brcmf_pno_net_param_le pfn;
++
++	pfn.auth = cpu_to_le32(WLAN_AUTH_OPEN);
++	pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
++	pfn.wsec = cpu_to_le32(0);
++	pfn.infra = cpu_to_le32(1);
++	if (active)
++		pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
++	pfn.ssid.SSID_len = cpu_to_le32(ssid->ssid_len);
++	memcpy(pfn.ssid.SSID, ssid->ssid, ssid->ssid_len);
++	return brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn, sizeof(pfn));
++}
++
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
+@@ -17,8 +17,6 @@
+ #define _BRCMF_PNO_H
+ 
+ #define BRCMF_PNO_SCAN_COMPLETE		1
+-#define BRCMF_PNO_WPA_AUTH_ANY		0xFFFFFFFF
+-#define BRCMF_PNO_HIDDEN_BIT		2
+ #define BRCMF_PNO_MAX_PFN_COUNT		16
+ 
+ /**
+@@ -37,4 +35,14 @@ int brcmf_pno_clean(struct brcmf_if *ifp
+ int brcmf_pno_config(struct brcmf_if *ifp,
+ 		     struct cfg80211_sched_scan_request *request);
+ 
++/**
++ * brcmf_pno_add_ssid - add ssid for pno in firmware.
++ *
++ * @ifp: interface object used.
++ * @ssid: ssid information.
++ * @active: indicate this ssid needs to be actively probed.
++ */
++int brcmf_pno_add_ssid(struct brcmf_if *ifp, struct cfg80211_ssid *ssid,
++		       bool active);
++
+ #endif /* _BRCMF_PNO_H */

package/kernel/mac80211/patches/357-0005-brcmfmac-change-prototype-for-brcmf_do_escan.patch

@@ -0,0 +1,58 @@
+From ab5981c830339b945ddbedc314567a9e5f506d72 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:24 +0000
+Subject: [PATCH] brcmfmac: change prototype for brcmf_do_escan()
+
+Reduce the number of parameters as the removed ones can be obtained
+through struct brcmf_if parameter.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1080,9 +1080,9 @@ exit:
+ }
+ 
+ static s32
+-brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
+-	       struct brcmf_if *ifp, struct cfg80211_scan_request *request)
++brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
+ {
++	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+ 	s32 err;
+ 	u32 passive_scan;
+ 	struct brcmf_scan_results *results;
+@@ -1090,7 +1090,7 @@ brcmf_do_escan(struct brcmf_cfg80211_inf
+ 
+ 	brcmf_dbg(SCAN, "Enter\n");
+ 	escan->ifp = ifp;
+-	escan->wiphy = wiphy;
++	escan->wiphy = cfg->wiphy;
+ 	escan->escan_state = WL_ESCAN_STATE_SCANNING;
+ 	passive_scan = cfg->active_scan ? 0 : 1;
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
+@@ -1170,7 +1170,7 @@ brcmf_cfg80211_escan(struct wiphy *wiphy
+ 		if (err)
+ 			goto scan_out;
+ 
+-		err = brcmf_do_escan(cfg, wiphy, vif->ifp, request);
++		err = brcmf_do_escan(vif->ifp, request);
+ 		if (err)
+ 			goto scan_out;
+ 	} else {
+@@ -3289,7 +3289,7 @@ brcmf_notify_sched_scan_results(struct b
+ 
+ 		set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+ 		cfg->escan_info.run = brcmf_run_escan;
+-		err = brcmf_do_escan(cfg, wiphy, ifp, request);
++		err = brcmf_do_escan(ifp, request);
+ 		if (err) {
+ 			clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+ 			goto out_err;

package/kernel/mac80211/patches/357-0006-brcmfmac-make-internal-escan-more-generic.patch

@@ -0,0 +1,306 @@
+From fa85b30a908455ff25def3a5f319aad272ef4862 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:25 +0000
+Subject: [PATCH] brcmfmac: make internal escan more generic
+
+For scheduled scan we initiate an escan in firmware to obtain more
+info missing from the scheduled scan notification we get from firmware.
+For upcoming functionality this is also required so make it a bit
+more generic.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 187 ++++++++++++---------
+ .../broadcom/brcm80211/brcmfmac/cfg80211.h         |   4 +-
+ 2 files changed, 109 insertions(+), 82 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -757,12 +757,12 @@ s32 brcmf_notify_escan_complete(struct b
+ 	brcmf_scan_config_mpc(ifp, 1);
+ 
+ 	/*
+-	 * e-scan can be initiated by scheduled scan
++	 * e-scan can be initiated internally
+ 	 * which takes precedence.
+ 	 */
+-	if (cfg->sched_escan) {
++	if (cfg->internal_escan) {
+ 		brcmf_dbg(SCAN, "scheduled scan completed\n");
+-		cfg->sched_escan = false;
++		cfg->internal_escan = false;
+ 		if (!aborted)
+ 			cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
+ 	} else if (scan_request) {
+@@ -3013,7 +3013,7 @@ void brcmf_abort_scanning(struct brcmf_c
+ 	struct escan_info *escan = &cfg->escan_info;
+ 
+ 	set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
+-	if (cfg->scan_request) {
++	if (cfg->internal_escan || cfg->scan_request) {
+ 		escan->escan_state = WL_ESCAN_STATE_IDLE;
+ 		brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
+ 	}
+@@ -3036,7 +3036,7 @@ static void brcmf_escan_timeout(unsigned
+ 	struct brcmf_cfg80211_info *cfg =
+ 			(struct brcmf_cfg80211_info *)data;
+ 
+-	if (cfg->scan_request) {
++	if (cfg->internal_escan || cfg->scan_request) {
+ 		brcmf_err("timer expired\n");
+ 		schedule_work(&cfg->escan_timeout_work);
+ 	}
+@@ -3119,7 +3119,7 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 		if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
+ 			goto exit;
+ 
+-		if (!cfg->scan_request) {
++		if (!cfg->internal_escan && !cfg->scan_request) {
+ 			brcmf_dbg(SCAN, "result without cfg80211 request\n");
+ 			goto exit;
+ 		}
+@@ -3165,7 +3165,7 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 		cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+ 		if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
+ 			goto exit;
+-		if (cfg->scan_request) {
++		if (cfg->internal_escan || cfg->scan_request) {
+ 			brcmf_inform_bss(cfg);
+ 			aborted = status != BRCMF_E_STATUS_SUCCESS;
+ 			brcmf_notify_escan_complete(cfg, ifp, aborted, false);
+@@ -3190,6 +3190,73 @@ static void brcmf_init_escan(struct brcm
+ 		  brcmf_cfg80211_escan_timeout_worker);
+ }
+ 
++static struct cfg80211_scan_request *
++brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
++	struct cfg80211_scan_request *req;
++	size_t req_size;
++
++	req_size = sizeof(*req) +
++		   n_netinfo * sizeof(req->channels[0]) +
++		   n_netinfo * sizeof(*req->ssids);
++
++	req = kzalloc(req_size, GFP_KERNEL);
++	if (req) {
++		req->wiphy = wiphy;
++		req->ssids = (void *)(&req->channels[0]) +
++			     n_netinfo * sizeof(req->channels[0]);
++	}
++	return req;
++}
++
++static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
++					 u8 *ssid, u8 ssid_len, u8 channel)
++{
++	struct ieee80211_channel *chan;
++	enum nl80211_band band;
++	int freq;
++
++	if (channel <= CH_MAX_2G_CHANNEL)
++		band = NL80211_BAND_2GHZ;
++	else
++		band = NL80211_BAND_5GHZ;
++
++	freq = ieee80211_channel_to_frequency(channel, band);
++	if (!freq)
++		return -EINVAL;
++
++	chan = ieee80211_get_channel(req->wiphy, freq);
++	if (!chan)
++		return -EINVAL;
++
++	req->channels[req->n_channels++] = chan;
++	memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
++	req->ssids[req->n_ssids++].ssid_len = ssid_len;
++
++	return 0;
++}
++
++static int brcmf_start_internal_escan(struct brcmf_if *ifp,
++				      struct cfg80211_scan_request *request)
++{
++	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
++	int err;
++
++	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
++		/* Abort any on-going scan */
++		brcmf_abort_scanning(cfg);
++	}
++
++	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
++	cfg->escan_info.run = brcmf_run_escan;
++	err = brcmf_do_escan(ifp, request);
++	if (err) {
++		clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
++		return err;
++	}
++	cfg->internal_escan = true;
++	return 0;
++}
++
+ /* PFN result doesn't have all the info which are required by the supplicant
+  * (For e.g IEs) Do a target Escan so that sched scan results are reported
+  * via wl_inform_single_bss in the required format. Escan does require the
+@@ -3203,12 +3270,8 @@ brcmf_notify_sched_scan_results(struct b
+ 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+ 	struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
+ 	struct cfg80211_scan_request *request = NULL;
+-	struct cfg80211_ssid *ssid = NULL;
+-	struct ieee80211_channel *channel = NULL;
+ 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
+-	int err = 0;
+-	int channel_req = 0;
+-	int band = 0;
++	int i, err = 0;
+ 	struct brcmf_pno_scanresults_le *pfn_result;
+ 	u32 result_count;
+ 	u32 status;
+@@ -3234,83 +3297,47 @@ brcmf_notify_sched_scan_results(struct b
+ 	 */
+ 	WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
+ 	brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
+-	if (result_count > 0) {
+-		int i;
+-
+-		request = kzalloc(sizeof(*request), GFP_KERNEL);
+-		ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL);
+-		channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL);
+-		if (!request || !ssid || !channel) {
+-			err = -ENOMEM;
+-			goto out_err;
+-		}
++	if (!result_count) {
++		brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
++		goto out_err;
++	}
++	request = brcmf_alloc_internal_escan_request(wiphy,
++						     result_count);
++	if (!request) {
++		err = -ENOMEM;
++		goto out_err;
++	}
+ 
+-		request->wiphy = wiphy;
+-		data += sizeof(struct brcmf_pno_scanresults_le);
+-		netinfo_start = (struct brcmf_pno_net_info_le *)data;
+-
+-		for (i = 0; i < result_count; i++) {
+-			netinfo = &netinfo_start[i];
+-			if (!netinfo) {
+-				brcmf_err("Invalid netinfo ptr. index: %d\n",
+-					  i);
+-				err = -EINVAL;
+-				goto out_err;
+-			}
++	data += sizeof(struct brcmf_pno_scanresults_le);
++	netinfo_start = (struct brcmf_pno_net_info_le *)data;
+ 
+-			brcmf_dbg(SCAN, "SSID:%s Channel:%d\n",
+-				  netinfo->SSID, netinfo->channel);
+-			memcpy(ssid[i].ssid, netinfo->SSID, netinfo->SSID_len);
+-			ssid[i].ssid_len = netinfo->SSID_len;
+-			request->n_ssids++;
+-
+-			channel_req = netinfo->channel;
+-			if (channel_req <= CH_MAX_2G_CHANNEL)
+-				band = NL80211_BAND_2GHZ;
+-			else
+-				band = NL80211_BAND_5GHZ;
+-			channel[i].center_freq =
+-				ieee80211_channel_to_frequency(channel_req,
+-							       band);
+-			channel[i].band = band;
+-			channel[i].flags |= IEEE80211_CHAN_NO_HT40;
+-			request->channels[i] = &channel[i];
+-			request->n_channels++;
+-		}
+-
+-		/* assign parsed ssid array */
+-		if (request->n_ssids)
+-			request->ssids = &ssid[0];
+-
+-		if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
+-			/* Abort any on-going scan */
+-			brcmf_abort_scanning(cfg);
++	for (i = 0; i < result_count; i++) {
++		netinfo = &netinfo_start[i];
++		if (!netinfo) {
++			brcmf_err("Invalid netinfo ptr. index: %d\n",
++				  i);
++			err = -EINVAL;
++			goto out_err;
+ 		}
+ 
+-		set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+-		cfg->escan_info.run = brcmf_run_escan;
+-		err = brcmf_do_escan(ifp, request);
+-		if (err) {
+-			clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
++		brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
++			  netinfo->SSID, netinfo->channel);
++		err = brcmf_internal_escan_add_info(request,
++						    netinfo->SSID,
++						    netinfo->SSID_len,
++						    netinfo->channel);
++		if (err)
+ 			goto out_err;
+-		}
+-		cfg->sched_escan = true;
+-		cfg->scan_request = request;
+-	} else {
+-		brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
+-		goto out_err;
+ 	}
+ 
+-	kfree(ssid);
+-	kfree(channel);
+-	kfree(request);
+-	return 0;
++	err = brcmf_start_internal_escan(ifp, request);
++	if (!err)
++		goto free_req;
+ 
+ out_err:
+-	kfree(ssid);
+-	kfree(channel);
+-	kfree(request);
+ 	cfg80211_sched_scan_stopped(wiphy);
++free_req:
++	kfree(request);
+ 	return err;
+ }
+ 
+@@ -3405,7 +3432,7 @@ static int brcmf_cfg80211_sched_scan_sto
+ 
+ 	brcmf_dbg(SCAN, "enter\n");
+ 	brcmf_pno_clean(ifp);
+-	if (cfg->sched_escan)
++	if (cfg->internal_escan)
+ 		brcmf_notify_escan_complete(cfg, ifp, true, true);
+ 	return 0;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -271,7 +271,7 @@ struct brcmf_cfg80211_wowl {
+  * @pub: common driver information.
+  * @channel: current channel.
+  * @active_scan: current scan mode.
+- * @sched_escan: e-scan for scheduled scan support running.
++ * @internal_escan: indicates internally initiated e-scan is running.
+  * @ibss_starter: indicates this sta is ibss starter.
+  * @pwr_save: indicate whether dongle to support power save mode.
+  * @dongle_up: indicate whether dongle up or not.
+@@ -303,7 +303,7 @@ struct brcmf_cfg80211_info {
+ 	struct brcmf_pub *pub;
+ 	u32 channel;
+ 	bool active_scan;
+-	bool sched_escan;
++	bool internal_escan;
+ 	bool ibss_starter;
+ 	bool pwr_save;
+ 	bool dongle_up;

package/kernel/mac80211/patches/357-0007-brcmfmac-split-up-brcmf_pno_config-function.patch

@@ -0,0 +1,176 @@
+From fca6cb2f059e51dec3fcf3589a5abbbcce5b4043 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:26 +0000
+Subject: [PATCH] brcmfmac: split up brcmf_pno_config() function
+
+The brcmf_pno_config() function handles two configurations in
+firmware. Split it and have caller sort out what is needed.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 11 +++-
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 60 ++++++++++++++++------
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pno.h | 17 ++++--
+ 3 files changed, 68 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -42,6 +42,7 @@
+ #include "common.h"
+ 
+ #define BRCMF_SCAN_IE_LEN_MAX		2048
++#define BRCMF_SCHED_SCAN_PERIOD		30
+ 
+ #define WPA_OUI				"\x00\x50\xF2"	/* WPA OUI */
+ #define WPA_OUI_TYPE			1
+@@ -3396,10 +3397,18 @@ brcmf_cfg80211_sched_scan_start(struct w
+ 	}
+ 
+ 	/* configure pno */
+-	ret = brcmf_pno_config(ifp, req);
++	ret = brcmf_pno_config(ifp, BRCMF_SCHED_SCAN_PERIOD, 0, 0);
+ 	if (ret < 0)
+ 		return ret;
+ 
++	/* configure random mac */
++	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
++		ret = brcmf_pno_set_random(ifp, req->mac_addr,
++					   req->mac_addr_mask);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	/* configure each match set */
+ 	for (i = 0; i < req->n_match_sets; i++) {
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -23,10 +23,12 @@
+ #include "fwil_types.h"
+ 
+ #define BRCMF_PNO_VERSION		2
+-#define BRCMF_PNO_TIME			30
+ #define BRCMF_PNO_REPEAT		4
+ #define BRCMF_PNO_FREQ_EXPO_MAX		3
++#define BRCMF_PNO_IMMEDIATE_SCAN_BIT	3
++#define BRCMF_PNO_ENABLE_BD_SCAN_BIT	5
+ #define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT	6
++#define BRCMF_PNO_REPORT_SEPARATELY_BIT	11
+ #define BRCMF_PNO_SCAN_INCOMPLETE	0
+ #define BRCMF_PNO_WPA_AUTH_ANY		0xFFFFFFFF
+ #define BRCMF_PNO_HIDDEN_BIT		2
+@@ -47,42 +49,68 @@ int brcmf_pno_clean(struct brcmf_if *ifp
+ 	return ret;
+ }
+ 
+-int brcmf_pno_config(struct brcmf_if *ifp,
+-		     struct cfg80211_sched_scan_request *request)
++int brcmf_pno_config(struct brcmf_if *ifp, u32 scan_freq,
++		     u32 mscan, u32 bestn)
+ {
+ 	struct brcmf_pno_param_le pfn_param;
+-	struct brcmf_pno_macaddr_le pfn_mac;
++	u16 flags;
++	u32 pfnmem;
+ 	s32 err;
+-	u8 *mac_mask;
+-	int i;
+ 
+ 	memset(&pfn_param, 0, sizeof(pfn_param));
+ 	pfn_param.version = cpu_to_le32(BRCMF_PNO_VERSION);
+ 
+ 	/* set extra pno params */
+-	pfn_param.flags = cpu_to_le16(1 << BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
++	flags = BIT(BRCMF_PNO_IMMEDIATE_SCAN_BIT) |
++		BIT(BRCMF_PNO_REPORT_SEPARATELY_BIT) |
++		BIT(BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
+ 	pfn_param.repeat = BRCMF_PNO_REPEAT;
+ 	pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
+ 
+ 	/* set up pno scan fr */
+-	pfn_param.scan_freq = cpu_to_le32(BRCMF_PNO_TIME);
++	pfn_param.scan_freq = cpu_to_le32(scan_freq);
++
++	if (mscan) {
++		pfnmem = bestn;
+ 
++		/* set bestn in firmware */
++		err = brcmf_fil_iovar_int_set(ifp, "pfnmem", pfnmem);
++		if (err < 0) {
++			brcmf_err("failed to set pfnmem\n");
++			goto exit;
++		}
++		/* get max mscan which the firmware supports */
++		err = brcmf_fil_iovar_int_get(ifp, "pfnmem", &pfnmem);
++		if (err < 0) {
++			brcmf_err("failed to get pfnmem\n");
++			goto exit;
++		}
++		mscan = min_t(u32, mscan, pfnmem);
++		pfn_param.mscan = mscan;
++		pfn_param.bestn = bestn;
++		flags |= BIT(BRCMF_PNO_ENABLE_BD_SCAN_BIT);
++		brcmf_dbg(INFO, "mscan=%d, bestn=%d\n", mscan, bestn);
++	}
++
++	pfn_param.flags = cpu_to_le16(flags);
+ 	err = brcmf_fil_iovar_data_set(ifp, "pfn_set", &pfn_param,
+ 				       sizeof(pfn_param));
+-	if (err) {
++	if (err)
+ 		brcmf_err("pfn_set failed, err=%d\n", err);
+-		return err;
+-	}
+ 
+-	/* Find out if mac randomization should be turned on */
+-	if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR))
+-		return 0;
++exit:
++	return err;
++}
++
++int brcmf_pno_set_random(struct brcmf_if *ifp, u8 *mac_addr, u8 *mac_mask)
++{
++	struct brcmf_pno_macaddr_le pfn_mac;
++	int err, i;
+ 
+ 	pfn_mac.version = BRCMF_PFN_MACADDR_CFG_VER;
+ 	pfn_mac.flags = BRCMF_PFN_MAC_OUI_ONLY | BRCMF_PFN_SET_MAC_UNASSOC;
+ 
+-	memcpy(pfn_mac.mac, request->mac_addr, ETH_ALEN);
+-	mac_mask = request->mac_addr_mask;
++	memcpy(pfn_mac.mac, mac_addr, ETH_ALEN);
+ 	for (i = 0; i < ETH_ALEN; i++) {
+ 		pfn_mac.mac[i] &= mac_mask[i];
+ 		pfn_mac.mac[i] |= get_random_int() & ~(mac_mask[i]);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
+@@ -30,10 +30,21 @@ int brcmf_pno_clean(struct brcmf_if *ifp
+  * brcmf_pno_config - configure pno parameters.
+  *
+  * @ifp: interface object used.
+- * @request: scheduled scan parameters.
++ * @scan_freq: scan frequency period in seconds.
++ * @mscan: maximum number of scans stored in firmware.
++ * @bestn: maximum number of APs per scan stored in firmware.
+  */
+-int brcmf_pno_config(struct brcmf_if *ifp,
+-		     struct cfg80211_sched_scan_request *request);
++int brcmf_pno_config(struct brcmf_if *ifp, u32 scan_freq,
++		     u32 mscan, u32 bestn);
++
++/**
++ * brcmf_pno_set_random - setup randomisation mac address for pno.
++ *
++ * @ifp: interface object used.
++ * @mac_addr: MAC address used with randomisation.
++ * @mac_mask: MAC address mask used for randomisation.
++ */
++int brcmf_pno_set_random(struct brcmf_if *ifp, u8 *mac_addr, u8 *mac_mask);
+ 
+ /**
+  * brcmf_pno_add_ssid - add ssid for pno in firmware.

package/kernel/mac80211/patches/357-0008-brcmfmac-move-scheduled-scan-activation-to-pno-sourc.patch

@@ -0,0 +1,292 @@
+From 3e48611d31dd333be01576902f2dc11adefc9a06 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:27 +0000
+Subject: [PATCH] brcmfmac: move scheduled scan activation to pno source file
+
+Rework .sched_scan_start() callback moving actual configuration of
+the device in pno source file.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         |  65 +-----------
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 110 +++++++++++++++++----
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pno.h |  29 +-----
+ 3 files changed, 94 insertions(+), 110 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -42,7 +42,6 @@
+ #include "common.h"
+ 
+ #define BRCMF_SCAN_IE_LEN_MAX		2048
+-#define BRCMF_SCHED_SCAN_PERIOD		30
+ 
+ #define WPA_OUI				"\x00\x50\xF2"	/* WPA OUI */
+ #define WPA_OUI_TYPE			1
+@@ -3342,24 +3341,6 @@ free_req:
+ 	return err;
+ }
+ 
+-static bool brcmf_is_ssid_active(struct cfg80211_ssid *ssid,
+-				 struct cfg80211_sched_scan_request *req)
+-{
+-	int i;
+-
+-	if (!ssid || !req->ssids || !req->n_ssids)
+-		return false;
+-
+-	for (i = 0; i < req->n_ssids; i++) {
+-		if (ssid->ssid_len == req->ssids[i].ssid_len) {
+-			if (!strncmp(ssid->ssid, req->ssids[i].ssid,
+-				     ssid->ssid_len))
+-				return true;
+-		}
+-	}
+-	return false;
+-}
+-
+ static int
+ brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
+ 				struct net_device *ndev,
+@@ -3367,9 +3348,6 @@ brcmf_cfg80211_sched_scan_start(struct w
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+-	struct cfg80211_ssid *ssid;
+-	int i;
+-	int ret = 0;
+ 
+ 	brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
+ 		  req->n_match_sets, req->n_ssids);
+@@ -3389,48 +3367,7 @@ brcmf_cfg80211_sched_scan_start(struct w
+ 		return -EINVAL;
+ 	}
+ 
+-	/* clean up everything */
+-	ret = brcmf_pno_clean(ifp);
+-	if  (ret < 0) {
+-		brcmf_err("failed error=%d\n", ret);
+-		return ret;
+-	}
+-
+-	/* configure pno */
+-	ret = brcmf_pno_config(ifp, BRCMF_SCHED_SCAN_PERIOD, 0, 0);
+-	if (ret < 0)
+-		return ret;
+-
+-	/* configure random mac */
+-	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
+-		ret = brcmf_pno_set_random(ifp, req->mac_addr,
+-					   req->mac_addr_mask);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	/* configure each match set */
+-	for (i = 0; i < req->n_match_sets; i++) {
+-
+-		ssid = &req->match_sets[i].ssid;
+-
+-		if (!ssid->ssid_len) {
+-			brcmf_err("skip broadcast ssid\n");
+-			continue;
+-		}
+-
+-		ret = brcmf_pno_add_ssid(ifp, ssid,
+-					 brcmf_is_ssid_active(ssid, req));
+-		if (ret < 0)
+-			brcmf_dbg(SCAN, ">>> PNO filter %s for ssid (%s)\n",
+-				  ret == 0 ? "set" : "failed", ssid->ssid);
+-	}
+-	/* Enable the PNO */
+-	ret = brcmf_fil_iovar_int_set(ifp, "pfn", 1);
+-	if (ret < 0)
+-		brcmf_err("PNO enable failed!! ret=%d\n", ret);
+-
+-	return ret;
++	return brcmf_pno_start_sched_scan(ifp, req);
+ }
+ 
+ static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -32,25 +32,10 @@
+ #define BRCMF_PNO_SCAN_INCOMPLETE	0
+ #define BRCMF_PNO_WPA_AUTH_ANY		0xFFFFFFFF
+ #define BRCMF_PNO_HIDDEN_BIT		2
++#define BRCMF_PNO_SCHED_SCAN_PERIOD	30
+ 
+-int brcmf_pno_clean(struct brcmf_if *ifp)
+-{
+-	int ret;
+-
+-	/* Disable pfn */
+-	ret = brcmf_fil_iovar_int_set(ifp, "pfn", 0);
+-	if (ret == 0) {
+-		/* clear pfn */
+-		ret = brcmf_fil_iovar_data_set(ifp, "pfnclear", NULL, 0);
+-	}
+-	if (ret < 0)
+-		brcmf_err("failed code %d\n", ret);
+-
+-	return ret;
+-}
+-
+-int brcmf_pno_config(struct brcmf_if *ifp, u32 scan_freq,
+-		     u32 mscan, u32 bestn)
++static int brcmf_pno_config(struct brcmf_if *ifp, u32 scan_freq,
++			    u32 mscan, u32 bestn)
+ {
+ 	struct brcmf_pno_param_le pfn_param;
+ 	u16 flags;
+@@ -102,7 +87,8 @@ exit:
+ 	return err;
+ }
+ 
+-int brcmf_pno_set_random(struct brcmf_if *ifp, u8 *mac_addr, u8 *mac_mask)
++static int brcmf_pno_set_random(struct brcmf_if *ifp, u8 *mac_addr,
++				u8 *mac_mask)
+ {
+ 	struct brcmf_pno_macaddr_le pfn_mac;
+ 	int err, i;
+@@ -128,8 +114,8 @@ int brcmf_pno_set_random(struct brcmf_if
+ 	return err;
+ }
+ 
+-int brcmf_pno_add_ssid(struct brcmf_if *ifp, struct cfg80211_ssid *ssid,
+-		       bool active)
++static int brcmf_pno_add_ssid(struct brcmf_if *ifp, struct cfg80211_ssid *ssid,
++			      bool active)
+ {
+ 	struct brcmf_pno_net_param_le pfn;
+ 
+@@ -144,3 +130,85 @@ int brcmf_pno_add_ssid(struct brcmf_if *
+ 	return brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn, sizeof(pfn));
+ }
+ 
++static bool brcmf_is_ssid_active(struct cfg80211_ssid *ssid,
++				 struct cfg80211_sched_scan_request *req)
++{
++	int i;
++
++	if (!ssid || !req->ssids || !req->n_ssids)
++		return false;
++
++	for (i = 0; i < req->n_ssids; i++) {
++		if (ssid->ssid_len == req->ssids[i].ssid_len) {
++			if (!strncmp(ssid->ssid, req->ssids[i].ssid,
++				     ssid->ssid_len))
++				return true;
++		}
++	}
++	return false;
++}
++
++int brcmf_pno_clean(struct brcmf_if *ifp)
++{
++	int ret;
++
++	/* Disable pfn */
++	ret = brcmf_fil_iovar_int_set(ifp, "pfn", 0);
++	if (ret == 0) {
++		/* clear pfn */
++		ret = brcmf_fil_iovar_data_set(ifp, "pfnclear", NULL, 0);
++	}
++	if (ret < 0)
++		brcmf_err("failed code %d\n", ret);
++
++	return ret;
++}
++
++int brcmf_pno_start_sched_scan(struct brcmf_if *ifp,
++			       struct cfg80211_sched_scan_request *req)
++{
++	struct cfg80211_ssid *ssid;
++	int i, ret;
++
++	/* clean up everything */
++	ret = brcmf_pno_clean(ifp);
++	if  (ret < 0) {
++		brcmf_err("failed error=%d\n", ret);
++		return ret;
++	}
++
++	/* configure pno */
++	ret = brcmf_pno_config(ifp, BRCMF_PNO_SCHED_SCAN_PERIOD, 0, 0);
++	if (ret < 0)
++		return ret;
++
++	/* configure random mac */
++	if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
++		ret = brcmf_pno_set_random(ifp, req->mac_addr,
++					   req->mac_addr_mask);
++		if (ret < 0)
++			return ret;
++	}
++
++	/* configure each match set */
++	for (i = 0; i < req->n_match_sets; i++) {
++		ssid = &req->match_sets[i].ssid;
++		if (!ssid->ssid_len) {
++			brcmf_err("skip broadcast ssid\n");
++			continue;
++		}
++
++		ret = brcmf_pno_add_ssid(ifp, ssid,
++					 brcmf_is_ssid_active(ssid, req));
++		if (ret < 0)
++			brcmf_dbg(SCAN, ">>> PNO filter %s for ssid (%s)\n",
++				  ret == 0 ? "set" : "failed", ssid->ssid);
++	}
++	/* Enable the PNO */
++	ret = brcmf_fil_iovar_int_set(ifp, "pfn", 1);
++	if (ret < 0)
++		brcmf_err("PNO enable failed!! ret=%d\n", ret);
++
++	return ret;
++}
++
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
+@@ -27,33 +27,12 @@
+ int brcmf_pno_clean(struct brcmf_if *ifp);
+ 
+ /**
+- * brcmf_pno_config - configure pno parameters.
++ * brcmf_pno_start_sched_scan - initiate scheduled scan on device.
+  *
+  * @ifp: interface object used.
+- * @scan_freq: scan frequency period in seconds.
+- * @mscan: maximum number of scans stored in firmware.
+- * @bestn: maximum number of APs per scan stored in firmware.
++ * @req: configuration parameters for scheduled scan.
+  */
+-int brcmf_pno_config(struct brcmf_if *ifp, u32 scan_freq,
+-		     u32 mscan, u32 bestn);
+-
+-/**
+- * brcmf_pno_set_random - setup randomisation mac address for pno.
+- *
+- * @ifp: interface object used.
+- * @mac_addr: MAC address used with randomisation.
+- * @mac_mask: MAC address mask used for randomisation.
+- */
+-int brcmf_pno_set_random(struct brcmf_if *ifp, u8 *mac_addr, u8 *mac_mask);
+-
+-/**
+- * brcmf_pno_add_ssid - add ssid for pno in firmware.
+- *
+- * @ifp: interface object used.
+- * @ssid: ssid information.
+- * @active: indicate this ssid needs to be actively probed.
+- */
+-int brcmf_pno_add_ssid(struct brcmf_if *ifp, struct cfg80211_ssid *ssid,
+-		       bool active);
++int brcmf_pno_start_sched_scan(struct brcmf_if *ifp,
++			       struct cfg80211_sched_scan_request *req);
+ 
+ #endif /* _BRCMF_PNO_H */

package/kernel/mac80211/patches/357-0009-brcmfmac-use-provided-channels-for-scheduled-scan.patch

@@ -0,0 +1,111 @@
+From 331e789443618ca9cc3ed48ada4e670225cca036 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:28 +0000
+Subject: [PATCH] brcmfmac: use provided channels for scheduled scan
+
+User-space can provide list of channels in the schedule scan request.
+This was ignored so all channels supported and allowed by the device
+were used. This patch configures the device to use the channels as
+listed in the request.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/fwil_types.h       | 16 +++++++++++++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 26 +++++++++++++++++++++-
+ 2 files changed, 41 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -131,6 +131,7 @@
+ #define BRCMF_TXBF_MU_BFR_CAP		BIT(1)
+ 
+ #define	BRCMF_MAXPMKID			16	/* max # PMKID cache entries */
++#define BRCMF_NUMCHANNELS		64
+ 
+ #define BRCMF_PFN_MACADDR_CFG_VER	1
+ #define BRCMF_PFN_MAC_OUI_ONLY		BIT(0)
+@@ -719,6 +720,21 @@ struct brcmf_pno_param_le {
+ };
+ 
+ /**
++ * struct brcmf_pno_config_le - PNO channel configuration.
++ *
++ * @reporttype: determines what is reported.
++ * @channel_num: number of channels specified in @channel_list.
++ * @channel_list: channels to use in PNO scan.
++ * @flags: reserved.
++ */
++struct brcmf_pno_config_le {
++	__le32  reporttype;
++	__le32  channel_num;
++	__le16  channel_list[BRCMF_NUMCHANNELS];
++	__le32  flags;
++};
++
++/**
+  * struct brcmf_pno_net_param_le - scan parameters per preferred network.
+  *
+  * @ssid: ssid name and its length.
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -18,9 +18,10 @@
+ 
+ #include "core.h"
+ #include "debug.h"
+-#include "pno.h"
+ #include "fwil.h"
+ #include "fwil_types.h"
++#include "cfg80211.h"
++#include "pno.h"
+ 
+ #define BRCMF_PNO_VERSION		2
+ #define BRCMF_PNO_REPEAT		4
+@@ -34,6 +35,15 @@
+ #define BRCMF_PNO_HIDDEN_BIT		2
+ #define BRCMF_PNO_SCHED_SCAN_PERIOD	30
+ 
++static int brcmf_pno_channel_config(struct brcmf_if *ifp,
++				    struct brcmf_pno_config_le *cfg)
++{
++	cfg->reporttype = 0;
++	cfg->flags = 0;
++
++	return brcmf_fil_iovar_data_set(ifp, "pfn_cfg", cfg, sizeof(*cfg));
++}
++
+ static int brcmf_pno_config(struct brcmf_if *ifp, u32 scan_freq,
+ 			    u32 mscan, u32 bestn)
+ {
+@@ -167,7 +177,10 @@ int brcmf_pno_clean(struct brcmf_if *ifp
+ int brcmf_pno_start_sched_scan(struct brcmf_if *ifp,
+ 			       struct cfg80211_sched_scan_request *req)
+ {
++	struct brcmu_d11inf *d11inf;
++	struct brcmf_pno_config_le pno_cfg;
+ 	struct cfg80211_ssid *ssid;
++	u16 chan;
+ 	int i, ret;
+ 
+ 	/* clean up everything */
+@@ -190,6 +203,17 @@ int brcmf_pno_start_sched_scan(struct br
+ 			return ret;
+ 	}
+ 
++	/* configure channels to use */
++	d11inf = &ifp->drvr->config->d11inf;
++	for (i = 0; i < req->n_channels; i++) {
++		chan = req->channels[i]->hw_value;
++		pno_cfg.channel_list[i] = cpu_to_le16(chan);
++	}
++	if (req->n_channels) {
++		pno_cfg.channel_num = cpu_to_le32(req->n_channels);
++		brcmf_pno_channel_config(ifp, &pno_cfg);
++	}
++
+ 	/* configure each match set */
+ 	for (i = 0; i < req->n_match_sets; i++) {
+ 		ssid = &req->match_sets[i].ssid;

package/kernel/mac80211/patches/357-0010-brcmfmac-remove-restriction-from-.sched_scan_start-c.patch

@@ -0,0 +1,34 @@
+From dfe5b0d52d5880bd9d4b427e1a53c9e9e4c3c820 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:29 +0000
+Subject: [PATCH] brcmfmac: remove restriction from .sched_scan_start()
+ callback
+
+In the .sched_scan_start() callback a condition was checked whether a
+normal scan was ongoing. However, there is no need for this check as
+it is ok to start the scheduled scan irrespective whether or not a
+normal scan is ongoing.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3351,10 +3351,7 @@ brcmf_cfg80211_sched_scan_start(struct w
+ 
+ 	brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
+ 		  req->n_match_sets, req->n_ssids);
+-	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
+-		brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
+-		return -EAGAIN;
+-	}
++
+ 	if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
+ 		brcmf_err("Scanning suppressed: status (%lu)\n",
+ 			  cfg->scan_status);

package/kernel/mac80211/patches/357-0011-brcmfmac-use-requested-scan-interval-in-scheduled-sc.patch

@@ -0,0 +1,67 @@
+From c6989fd55ceb633d2f18c12ffae01b9123125c89 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:30 +0000
+Subject: [PATCH] brcmfmac: use requested scan interval in scheduled scan
+
+User-space can specify the interval for the scheduled scan. This
+interval is found in scheduled scan plan. The driver supports only
+one plan, which is legacy behaviour.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c      | 6 +++++-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h      | 6 ++++--
+ 3 files changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6312,6 +6312,7 @@ static void brcmf_wiphy_pno_params(struc
+ 	wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
+ 	wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
+ 	wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
++	wiphy->max_sched_scan_plan_interval = BRCMF_PNO_SCHED_SCAN_MAX_PERIOD;
+ 	wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+ }
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -63,6 +63,10 @@ static int brcmf_pno_config(struct brcmf
+ 	pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
+ 
+ 	/* set up pno scan fr */
++	if (scan_freq < BRCMF_PNO_SCHED_SCAN_MIN_PERIOD) {
++		brcmf_dbg(SCAN, "scan period too small, using minimum\n");
++		scan_freq = BRCMF_PNO_SCHED_SCAN_MIN_PERIOD;
++	}
+ 	pfn_param.scan_freq = cpu_to_le32(scan_freq);
+ 
+ 	if (mscan) {
+@@ -191,7 +195,7 @@ int brcmf_pno_start_sched_scan(struct br
+ 	}
+ 
+ 	/* configure pno */
+-	ret = brcmf_pno_config(ifp, BRCMF_PNO_SCHED_SCAN_PERIOD, 0, 0);
++	ret = brcmf_pno_config(ifp, req->scan_plans[0].interval, 0, 0);
+ 	if (ret < 0)
+ 		return ret;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.h
+@@ -16,8 +16,10 @@
+ #ifndef _BRCMF_PNO_H
+ #define _BRCMF_PNO_H
+ 
+-#define BRCMF_PNO_SCAN_COMPLETE		1
+-#define BRCMF_PNO_MAX_PFN_COUNT		16
++#define BRCMF_PNO_SCAN_COMPLETE			1
++#define BRCMF_PNO_MAX_PFN_COUNT			16
++#define BRCMF_PNO_SCHED_SCAN_MIN_PERIOD	10
++#define BRCMF_PNO_SCHED_SCAN_MAX_PERIOD	508
+ 
+ /**
+  * brcmf_pno_clean - disable and clear pno in firmware.

package/kernel/mac80211/patches/357-0012-brcmfmac-fix-scheduled-scan-result-handling-for-newe.patch

@@ -0,0 +1,76 @@
+From 53e3a80d80c80bf50ab64cf6c44fb0fa41aa22d8 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 23 Nov 2016 10:25:31 +0000
+Subject: [PATCH] brcmfmac: fix scheduled scan result handling for newer chips
+
+The scan results for scheduled scan as retrieved from the device
+have changed. A field has been added which is not needed. However,
+the appended info is. Luckily they are versioned so check that to
+find out the location of the appended data.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 24 +++++++++++++++++++++-
+ .../broadcom/brcm80211/brcmfmac/fwil_types.h       |  7 +++++++
+ 2 files changed, 30 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3257,6 +3257,28 @@ static int brcmf_start_internal_escan(st
+ 	return 0;
+ }
+ 
++static struct brcmf_pno_net_info_le *
++brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
++{
++	struct brcmf_pno_scanresults_v2_le *pfn_v2;
++	struct brcmf_pno_net_info_le *netinfo;
++
++	switch (pfn_v1->version) {
++	default:
++		WARN_ON(1);
++		/* fall-thru */
++	case cpu_to_le32(1):
++		netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
++		break;
++	case cpu_to_le32(2):
++		pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
++		netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
++		break;
++	}
++
++	return netinfo;
++}
++
+ /* PFN result doesn't have all the info which are required by the supplicant
+  * (For e.g IEs) Do a target Escan so that sched scan results are reported
+  * via wl_inform_single_bss in the required format. Escan does require the
+@@ -3309,7 +3331,7 @@ brcmf_notify_sched_scan_results(struct b
+ 	}
+ 
+ 	data += sizeof(struct brcmf_pno_scanresults_le);
+-	netinfo_start = (struct brcmf_pno_net_info_le *)data;
++	netinfo_start = brcmf_get_netinfo_array(pfn_result);
+ 
+ 	for (i = 0; i < result_count; i++) {
+ 		netinfo = &netinfo_start[i];
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -785,6 +785,13 @@ struct brcmf_pno_scanresults_le {
+ 	__le32 count;
+ };
+ 
++struct brcmf_pno_scanresults_v2_le {
++	__le32 version;
++	__le32 status;
++	__le32 count;
++	__le32 scan_ch_bucket;
++};
++
+ /**
+  * struct brcmf_pno_macaddr_le - to configure PNO macaddr randomization.
+  *

package/kernel/mac80211/patches/358-0001-brcmfmac-fix-memory-leak-in-brcmf_cfg80211_attach.patch

@@ -0,0 +1,47 @@
+From cb853da3a368c40300a0e940f86be582037bb082 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Fri, 9 Dec 2016 11:34:13 +0000
+Subject: [PATCH] brcmfmac: fix memory leak in brcmf_cfg80211_attach()
+
+In brcmf_cfg80211_attach() there was one error path not properly
+handled as it leaked memory allocated in brcmf_btcoex_attach().
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6866,7 +6866,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 
+ 	err = brcmf_p2p_attach(cfg, p2pdev_forced);
+ 	if (err) {
+-		brcmf_err("P2P initilisation failed (%d)\n", err);
++		brcmf_err("P2P initialisation failed (%d)\n", err);
+ 		goto wiphy_unreg_out;
+ 	}
+ 	err = brcmf_btcoex_attach(cfg);
+@@ -6891,7 +6891,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	err = brcmf_fweh_activate_events(ifp);
+ 	if (err) {
+ 		brcmf_err("FWEH activation failed (%d)\n", err);
+-		goto wiphy_unreg_out;
++		goto detach;
+ 	}
+ 
+ 	/* Fill in some of the advertised nl80211 supported features */
+@@ -6906,6 +6906,9 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 
+ 	return cfg;
+ 
++detach:
++	brcmf_btcoex_detach(cfg);
++	brcmf_p2p_detach(&cfg->p2p);
+ wiphy_unreg_out:
+ 	wiphy_unregister(cfg->wiphy);
+ priv_out:

package/kernel/mac80211/patches/358-0002-brcmfmac-fix-uninitialized-field-in-scheduled-scan-s.patch

@@ -0,0 +1,29 @@
+From 2b66325d5ea7c2a39ac69ed83b6979afe480d81a Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Fri, 9 Dec 2016 11:34:14 +0000
+Subject: [PATCH] brcmfmac: fix uninitialized field in scheduled scan ssid
+ configuration
+
+The scheduled scan ssid configuration in firmware has a flags field that
+was not initialized resulting in unexpected behaviour.
+
+Fixes: e3bdb7cc0300 ("brcmfmac: fix handling ssids in .sched_scan_start() callback")
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -137,6 +137,7 @@ static int brcmf_pno_add_ssid(struct brc
+ 	pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
+ 	pfn.wsec = cpu_to_le32(0);
+ 	pfn.infra = cpu_to_le32(1);
++	pfn.flags = 0;
+ 	if (active)
+ 		pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
+ 	pfn.ssid.SSID_len = cpu_to_le32(ssid->ssid_len);

package/kernel/mac80211/patches/359-0001-brcmfmac-fix-spelling-mistakes-on-Ivalid.patch

@@ -0,0 +1,35 @@
+From ad334bbb07b07e2873942571b0c9f3c34571bd47 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 23 Dec 2016 00:43:22 +0000
+Subject: [PATCH] brcmfmac: fix spelling mistakes on "Ivalid"
+
+Trivial fixes to spelling mistake "Ivalid" to "Invalid" in
+brcmf_err error messages.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3969,7 +3969,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 			pval |= AES_ENABLED;
+ 			break;
+ 		default:
+-			brcmf_err("Ivalid unicast security info\n");
++			brcmf_err("Invalid unicast security info\n");
+ 		}
+ 		offset++;
+ 	}
+@@ -4013,7 +4013,7 @@ brcmf_configure_wpaie(struct brcmf_if *i
+ 			wpa_auth |= WPA2_AUTH_1X_SHA256;
+ 			break;
+ 		default:
+-			brcmf_err("Ivalid key mgmt info\n");
++			brcmf_err("Invalid key mgmt info\n");
+ 		}
+ 		offset++;
+ 	}

package/kernel/mac80211/patches/360-0001-brcmfmac-avoid-writing-channel-out-of-allocated-arra.patch

@@ -28,7 +28,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -5913,7 +5913,6 @@ static int brcmf_construct_chaninfo(stru
+@@ -5823,7 +5823,6 @@ static int brcmf_construct_chaninfo(stru
  	u32 i, j;
  	u32 total;
  	u32 chaninfo;
@@ -36,7 +36,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
  
-@@ -5961,33 +5960,36 @@ static int brcmf_construct_chaninfo(stru
+@@ -5871,33 +5870,36 @@ static int brcmf_construct_chaninfo(stru
  		    ch.bw == BRCMU_CHAN_BW_80)
  			continue;
  
@@ -85,7 +85,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  			ch.bw = BRCMU_CHAN_BW_20;
  			cfg->d11inf.encchspec(&ch);
  			chaninfo = ch.chspec;
-@@ -5995,11 +5997,11 @@ static int brcmf_construct_chaninfo(stru
+@@ -5905,11 +5907,11 @@ static int brcmf_construct_chaninfo(stru
  						       &chaninfo);
  			if (!err) {
  				if (chaninfo & WL_CHAN_RADAR)

package/kernel/mac80211/patches/360-0002-brcmfmac-don-t-preset-all-channels-as-disabled.patch

@@ -17,7 +17,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -147,7 +147,6 @@ static struct ieee80211_rate __wl_rates[
+@@ -138,7 +138,6 @@ static struct ieee80211_rate __wl_rates[
  	.band			= NL80211_BAND_2GHZ,		\
  	.center_freq		= (_freq),			\
  	.hw_value		= (_channel),			\
@@ -25,7 +25,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	.max_antenna_gain	= 0,				\
  	.max_power		= 30,				\
  }
-@@ -156,7 +155,6 @@ static struct ieee80211_rate __wl_rates[
+@@ -147,7 +146,6 @@ static struct ieee80211_rate __wl_rates[
  	.band			= NL80211_BAND_5GHZ,		\
  	.center_freq		= 5000 + (5 * (_channel)),	\
  	.hw_value		= (_channel),			\

package/kernel/mac80211/patches/360-0003-brcmfmac-setup-wiphy-bands-after-registering-it-firs.patch

@@ -25,7 +25,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6564,8 +6564,7 @@ static int brcmf_setup_wiphy(struct wiph
+@@ -6475,8 +6475,7 @@ static int brcmf_setup_wiphy(struct wiph
  			wiphy->bands[NL80211_BAND_5GHZ] = band;
  		}
  	}
@@ -35,7 +35,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  }
  
  static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
-@@ -6930,6 +6929,12 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -6841,6 +6840,12 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  		goto priv_out;
  	}
  

package/kernel/mac80211/patches/361-0001-brcmfmac-make-brcmf_of_probe-more-generic.patch

@@ -1,3 +1,4 @@
+From e457a8a01a19277e96830d3d95887e0e3c1e2f26 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
 Date: Sat, 7 Jan 2017 23:43:45 +0100
 Subject: [PATCH] brcmfmac: make brcmf_of_probe more generic
@@ -13,7 +14,12 @@ Call brcmf_of_probe for all kind of devices & move extra conditions to
 the body of that funcion.
 
 Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 ---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 8 +++-----
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c     | 7 +++++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.h     | 6 ++++--
+ 3 files changed, 12 insertions(+), 9 deletions(-)
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c

package/kernel/mac80211/patches/361-0002-brcmfmac-add-support-for-BCM43455-with-modalias-sdio.patch

@@ -0,0 +1,46 @@
+From a62a77881b1b6708ffeddd9bf0529494f7b199e3 Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Mon, 16 Jan 2017 11:17:57 +0100
+Subject: [PATCH] brcmfmac: add support for BCM43455 with modalias
+ sdio:c00v02D0dA9BF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM43455 is a more recent revision of the BCM4345. Some of the BCM43455
+got a dedicated SDIO device ID which is currently not supported by
+brcmfmac.
+Adding the new sdio_device_id to brcmfmac is enough to get the BCM43455
+supported because the chip itself is already supported (due to BCM4345
+support in the driver).
+
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Reviewed-by: Andreas Färber <afaerber@suse.de>
+Tested-by: Andreas Färber <afaerber@suse.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 +
+ include/linux/mmc/sdio_ids.h                              | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -1104,6 +1104,7 @@ static const struct sdio_device_id brcmf
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4345),
++	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43455),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4356),
+ 	{ /* end: all zeroes */ }
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -36,6 +36,7 @@
+ #define SDIO_DEVICE_ID_BROADCOM_43362		0xa962
+ #define SDIO_DEVICE_ID_BROADCOM_43430		0xa9a6
+ #define SDIO_DEVICE_ID_BROADCOM_4345		0x4345
++#define SDIO_DEVICE_ID_BROADCOM_43455		0xa9bf
+ #define SDIO_DEVICE_ID_BROADCOM_4354		0x4354
+ #define SDIO_DEVICE_ID_BROADCOM_4356		0x4356
+ 

package/kernel/mac80211/patches/361-0003-brcmfmac-fix-incorrect-event-channel-deduction.patch

@@ -0,0 +1,34 @@
+From 8e290cecdd0178f3d4cf7d463c51dc7e462843b4 Mon Sep 17 00:00:00 2001
+From: Gavin Li <git@thegavinli.com>
+Date: Tue, 17 Jan 2017 15:24:05 -0800
+Subject: [PATCH] brcmfmac: fix incorrect event channel deduction
+
+brcmf_sdio_fromevntchan() was being called on the the data frame
+rather than the software header, causing some frames to be
+mischaracterized as on the event channel rather than the data channel.
+
+This fixes a major performance regression (due to dropped packets). With
+this patch the download speed jumped from 1Mbit/s back up to 40MBit/s due
+to the sheer amount of packets being incorrectly processed.
+
+Fixes: c56caa9db8ab ("brcmfmac: screening firmware event packet")
+Signed-off-by: Gavin Li <git@thegavinli.com>
+Cc: <stable@vger.kernel.org> # 4.7+
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+[kvalo@codeaurora.org: improve commit logs based on email discussion]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1661,7 +1661,7 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 					   pfirst->len, pfirst->next,
+ 					   pfirst->prev);
+ 			skb_unlink(pfirst, &bus->glom);
+-			if (brcmf_sdio_fromevntchan(pfirst->data))
++			if (brcmf_sdio_fromevntchan(&dptr[SDPCM_HWHDR_LEN]))
+ 				brcmf_rx_event(bus->sdiodev->dev, pfirst);
+ 			else
+ 				brcmf_rx_frame(bus->sdiodev->dev, pfirst,

package/kernel/mac80211/patches/362-0001-brcmfmac-drop-unneeded-function-declarations-from-he.patch

@@ -0,0 +1,63 @@
+From c8d870794d5dd42d6e05a78cc92d1ff7acf11f6a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 18 Jan 2017 11:48:51 +0100
+Subject: [PATCH] brcmfmac: drop unneeded function declarations from headers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Functions brcmf_c_prec_enq and brcmf_sdio_init don't exist so we
+really don't need their declarations. Function brcmf_parse_tlvs is used
+in cfg80211.c only so make it static and drop from header as well.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h      | 4 ----
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h | 2 --
+ 3 files changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -218,9 +218,6 @@ int brcmf_bus_get_memdump(struct brcmf_b
+  * interface functions from common layer
+  */
+ 
+-bool brcmf_c_prec_enq(struct device *dev, struct pktq *q, struct sk_buff *pkt,
+-		      int prec);
+-
+ /* Receive frame for delivery to OS.  Callee disposes of rxp. */
+ void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp, bool handle_event);
+ /* Receive async event packet from firmware. Callee disposes of rxp. */
+@@ -247,7 +244,6 @@ void brcmf_bus_add_txhdrlen(struct devic
+ 
+ #ifdef CPTCFG_BRCMFMAC_SDIO
+ void brcmf_sdio_exit(void);
+-void brcmf_sdio_init(void);
+ void brcmf_sdio_register(void);
+ #endif
+ #ifdef CPTCFG_BRCMFMAC_USB
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -326,7 +326,7 @@ u16 channel_to_chanspec(struct brcmu_d11
+  * triples, returning a pointer to the substring whose first element
+  * matches tag
+  */
+-const struct brcmf_tlv *
++static const struct brcmf_tlv *
+ brcmf_parse_tlvs(const void *buf, int buflen, uint key)
+ {
+ 	const struct brcmf_tlv *elt = buf;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -396,8 +396,6 @@ void brcmf_free_vif(struct brcmf_cfg8021
+ s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
+ 			  const u8 *vndr_ie_buf, u32 vndr_ie_len);
+ s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif);
+-const struct brcmf_tlv *
+-brcmf_parse_tlvs(const void *buf, int buflen, uint key);
+ u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
+ 			struct ieee80211_channel *ch);
+ bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,

package/kernel/mac80211/patches/362-0002-brcmfmac-move-brcmf_c_set_joinpref_default-declarati.patch

@@ -0,0 +1,41 @@
+From f5611e038172101561b570554c81e290a39517ed Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 18 Jan 2017 11:48:52 +0100
+Subject: [PATCH] brcmfmac: move brcmf_c_set_joinpref_default declaration to
+ common.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Function brcmf_c_set_joinpref_default is in common.c, so move it to the
+related header.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h | 2 ++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h   | 1 -
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
+@@ -65,6 +65,8 @@ struct brcmf_mp_device {
+ 	} bus;
+ };
+ 
++void brcmf_c_set_joinpref_default(struct brcmf_if *ifp);
++
+ struct brcmf_mp_device *brcmf_get_module_param(struct device *dev,
+ 					       enum brcmf_bus_type bus_type,
+ 					       u32 chip, u32 chiprev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -216,7 +216,6 @@ void brcmf_txflowblock_if(struct brcmf_i
+ void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
+ void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
+ void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on);
+-void brcmf_c_set_joinpref_default(struct brcmf_if *ifp);
+ int __init brcmf_core_init(void);
+ void __exit brcmf_core_exit(void);
+ 

package/kernel/mac80211/patches/362-0003-brcmfmac-drop-brcmf_bus_detach-and-inline-its-code.patch

@@ -0,0 +1,49 @@
+From bfa7295e5b4d32cdab28d4cdc3a9791f73aed089 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 18 Jan 2017 11:48:53 +0100
+Subject: [PATCH] brcmfmac: drop brcmf_bus_detach and inline its code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Driver used to call brcmf_bus_detach only from one place and it already
+contained a check for drvr not being NULL. We can get rid of this extra
+function, call brcmf_bus_stop directly and simplify the code.
+There also isn't brcmf_bus_attach function which one could expect so it
+looks more consistent this way.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1075,16 +1075,6 @@ void brcmf_bus_add_txhdrlen(struct devic
+ 	}
+ }
+ 
+-static void brcmf_bus_detach(struct brcmf_pub *drvr)
+-{
+-	brcmf_dbg(TRACE, "Enter\n");
+-
+-	if (drvr) {
+-		/* Stop the bus module */
+-		brcmf_bus_stop(drvr->bus_if);
+-	}
+-}
+-
+ void brcmf_dev_reset(struct device *dev)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+@@ -1131,7 +1121,7 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_fws_deinit(drvr);
+ 
+-	brcmf_bus_detach(drvr);
++	brcmf_bus_stop(drvr->bus_if);
+ 
+ 	brcmf_proto_detach(drvr);
+ 

package/kernel/mac80211/patches/362-0004-brcmfmac-rename-brcmf_bus_start-function-to-brcmf_bu.patch

@@ -0,0 +1,93 @@
+From e8cd47501fa0c0a591bb07d5878dcc8d63d60e57 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 18 Jan 2017 11:48:54 +0100
+Subject: [PATCH] brcmfmac: rename brcmf_bus_start function to
+ brcmf_bus_started
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This intends to make init/attach process slightly easier to follow.
+
+What driver was doing in brcmf_bus_start wasn't bus specific at all and
+function brcmf_bus_stop wasn't undoing things done there. This function
+is supposed to be called by bus specific code when the bus is ready.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h    | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c   | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c   | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c    | 2 +-
+ 6 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -238,7 +238,7 @@ void brcmf_txcomplete(struct device *dev
+ /* Configure the "global" bus state used by upper layers */
+ void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
+ 
+-int brcmf_bus_start(struct device *dev);
++int brcmf_bus_started(struct device *dev);
+ s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len);
+ void brcmf_bus_add_txhdrlen(struct device *dev, uint len);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -74,7 +74,7 @@ module_param_named(roamoff, brcmf_roamof
+ MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
+ 
+ #ifdef DEBUG
+-/* always succeed brcmf_bus_start() */
++/* always succeed brcmf_bus_started() */
+ static int brcmf_ignore_probe_fail;
+ module_param_named(ignore_probe_fail, brcmf_ignore_probe_fail, int, 0);
+ MODULE_PARM_DESC(ignore_probe_fail, "always succeed probe for debugging");
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -966,7 +966,7 @@ static int brcmf_revinfo_read(struct seq
+ 	return 0;
+ }
+ 
+-int brcmf_bus_start(struct device *dev)
++int brcmf_bus_started(struct device *dev)
+ {
+ 	int ret = -1;
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1572,7 +1572,7 @@ static int brcmf_pcie_attach_bus(struct
+ 	if (ret) {
+ 		brcmf_err("brcmf_attach failed\n");
+ 	} else {
+-		ret = brcmf_bus_start(&devinfo->pdev->dev);
++		ret = brcmf_bus_started(&devinfo->pdev->dev);
+ 		if (ret)
+ 			brcmf_err("dongle is not responding\n");
+ 	}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4065,7 +4065,7 @@ static void brcmf_sdio_firmware_callback
+ 
+ 	sdio_release_host(sdiodev->func[1]);
+ 
+-	err = brcmf_bus_start(dev);
++	err = brcmf_bus_started(dev);
+ 	if (err != 0) {
+ 		brcmf_err("dongle is not responding\n");
+ 		goto fail;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1148,7 +1148,7 @@ static int brcmf_usb_bus_setup(struct br
+ 	if (ret)
+ 		goto fail;
+ 
+-	ret = brcmf_bus_start(devinfo->dev);
++	ret = brcmf_bus_started(devinfo->dev);
+ 	if (ret)
+ 		goto fail;
+ 

package/kernel/mac80211/patches/363-brcmfmac-drop-duplicated-core-selection-from-brcmf_p.patch

@@ -0,0 +1,30 @@
+From b3d75a81f07c757ab73c9022631170c3baefe380 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 19 Jan 2017 10:51:25 +0100
+Subject: [PATCH] brcmfmac: drop duplicated core selection from
+ brcmf_pcie_attach
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It was left after reworking PCIe reset in commit 07fe2e38c7fd
+("brcmfmac: Reset PCIE devices after recognition.").
+
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -601,7 +601,6 @@ static void brcmf_pcie_attach(struct brc
+ {
+ 	u32 config;
+ 
+-	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
+ 	/* BAR1 window may not be sized properly */
+ 	brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
+ 	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_CONFIGADDR, 0x4e0);

package/kernel/mac80211/patches/364-0001-brcmfmac-provide-a-value-for-struct-wowlan_support-m.patch

@@ -0,0 +1,30 @@
+From 2ef0359031b9ed891ca381b2687186fb52b277f8 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Fri, 27 Jan 2017 12:27:45 +0000
+Subject: [PATCH] brcmfmac: provide a value for struct
+ wowlan_support::max_nd_match_sets
+
+The driver advertises support for WOWLAN_NETDETECT but did not specify
+maximum amount of netdetect match sets. This was no issue due to a bug
+in nl80211. As that has been fixed, brcmfmac also needs fixing.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6356,6 +6356,8 @@ static void brcmf_wiphy_wowl_params(stru
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
+ 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
+ 			brcmf_wowlan_support.flags |= WIPHY_WOWLAN_NET_DETECT;
++			brcmf_wowlan_support.max_nd_match_sets =
++				BRCMF_PNO_MAX_PFN_COUNT;
+ 			init_waitqueue_head(&cfg->wowl.nd_data_wait);
+ 		}
+ 	}

package/kernel/mac80211/patches/364-0002-brcmfmac-fix-handling-firmware-results-for-wowl-netd.patch

@@ -0,0 +1,39 @@
+From d29afe91af5995306d940b3dfee2419e0bb24a51 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Fri, 27 Jan 2017 12:27:46 +0000
+Subject: [PATCH] brcmfmac: fix handling firmware results for wowl netdetect
+
+For wowl netdetect the event data changed for newer chips. This
+was recently fixed for scheduled scan, but same change is needed
+for wowl netdetect. Removing now pointles += operation from both
+result handlers.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3328,7 +3328,6 @@ brcmf_notify_sched_scan_results(struct b
+ 		goto out_err;
+ 	}
+ 
+-	data += sizeof(struct brcmf_pno_scanresults_le);
+ 	netinfo_start = brcmf_get_netinfo_array(pfn_result);
+ 
+ 	for (i = 0; i < result_count; i++) {
+@@ -3476,8 +3475,7 @@ brcmf_wowl_nd_results(struct brcmf_if *i
+ 		return -EINVAL;
+ 	}
+ 
+-	data += sizeof(struct brcmf_pno_scanresults_le);
+-	netinfo = (struct brcmf_pno_net_info_le *)data;
++	netinfo = brcmf_get_netinfo_array(pfn_result);
+ 	memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
+ 	cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
+ 	cfg->wowl.nd->n_channels = 1;

package/kernel/mac80211/patches/364-0003-brcmfmac-allow-wowlan-support-to-be-per-device.patch

@@ -0,0 +1,78 @@
+From 0b57010fc18e12c19d14379cd739d4eb7c3898f3 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Fri, 27 Jan 2017 12:27:47 +0000
+Subject: [PATCH] brcmfmac: allow wowlan support to be per device
+
+The wowlan support is (partially) determined dynamic by checking the
+device/firmware capabilities. So they can differ per device. So it
+is not possible to use a static global. Instead use the global as a
+template and use kmemdup(). When kmemdup() fails the template is used
+unmodified.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 26 ++++++++++++++++------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6337,7 +6337,7 @@ static void brcmf_wiphy_pno_params(struc
+ }
+ 
+ #ifdef CONFIG_PM
+-static struct wiphy_wowlan_support brcmf_wowlan_support = {
++static const struct wiphy_wowlan_support brcmf_wowlan_support = {
+ 	.flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
+ 	.n_patterns = BRCMF_WOWL_MAXPATTERNS,
+ 	.pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
+@@ -6350,21 +6350,29 @@ static void brcmf_wiphy_wowl_params(stru
+ {
+ #ifdef CONFIG_PM
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct wiphy_wowlan_support *wowl;
++
++	wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
++		       GFP_KERNEL);
++	if (!wowl) {
++		brcmf_err("only support basic wowlan features\n");
++		wiphy->wowlan = &brcmf_wowlan_support;
++		return;
++	}
+ 
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
+ 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
+-			brcmf_wowlan_support.flags |= WIPHY_WOWLAN_NET_DETECT;
+-			brcmf_wowlan_support.max_nd_match_sets =
+-				BRCMF_PNO_MAX_PFN_COUNT;
++			wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
++			wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
+ 			init_waitqueue_head(&cfg->wowl.nd_data_wait);
+ 		}
+ 	}
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
+-		brcmf_wowlan_support.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
+-		brcmf_wowlan_support.flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
++		wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
++		wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
+ 	}
+ 
+-	wiphy->wowlan = &brcmf_wowlan_support;
++	wiphy->wowlan = wowl;
+ #endif
+ }
+ 
+@@ -6745,6 +6753,10 @@ static void brcmf_free_wiphy(struct wiph
+ 		kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
+ 		kfree(wiphy->bands[NL80211_BAND_5GHZ]);
+ 	}
++#if IS_ENABLED(CONFIG_PM)
++	if (wiphy->wowlan != &brcmf_wowlan_support)
++		kfree(wiphy->wowlan);
++#endif
+ 	wiphy_free(wiphy);
+ }
+ 

package/kernel/mac80211/patches/365-0001-brcmfmac-check-brcmf_bus_get_memdump-result-for-erro.patch

@@ -0,0 +1,55 @@
+From f4737a62033d7f3e0db740c449fc62119da7ab8a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 30 Jan 2017 16:09:51 +0100
+Subject: [PATCH] brcmfmac: check brcmf_bus_get_memdump result for error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This method may be unsupported (see: USB bus) or may just fail (see:
+SDIO bus).
+While at it rework logic in brcmf_sdio_bus_get_memdump function to avoid
+too many conditional code nesting levels.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/debug.c   | 23 +++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
+@@ -32,16 +32,25 @@ static int brcmf_debug_create_memdump(st
+ {
+ 	void *dump;
+ 	size_t ramsize;
++	int err;
+ 
+ 	ramsize = brcmf_bus_get_ramsize(bus);
+-	if (ramsize) {
+-		dump = vzalloc(len + ramsize);
+-		if (!dump)
+-			return -ENOMEM;
+-		memcpy(dump, data, len);
+-		brcmf_bus_get_memdump(bus, dump + len, ramsize);
+-		dev_coredumpv(bus->dev, dump, len + ramsize, GFP_KERNEL);
++	if (!ramsize)
++		return -ENOTSUPP;
++
++	dump = vzalloc(len + ramsize);
++	if (!dump)
++		return -ENOMEM;
++
++	memcpy(dump, data, len);
++	err = brcmf_bus_get_memdump(bus, dump + len, ramsize);
++	if (err) {
++		vfree(dump);
++		return err;
+ 	}
++
++	dev_coredumpv(bus->dev, dump, len + ramsize, GFP_KERNEL);
++
+ 	return 0;
+ }
+ 

package/kernel/mac80211/patches/365-0002-brcmfmac-be-more-verbose-when-PSM-s-watchdog-fires.patch

@@ -0,0 +1,41 @@
+From 36401cb7ffae731295a6dd1ce2b40d7ad74245f4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 30 Jan 2017 16:09:52 +0100
+Subject: [PATCH] brcmfmac: be more verbose when PSM's watchdog fires
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It's important to inform user so he knows things went wrong. He may also
+want to get memory dump for further debugging purposes.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
+@@ -58,10 +58,18 @@ static int brcmf_debug_psm_watchdog_noti
+ 					   const struct brcmf_event_msg *evtmsg,
+ 					   void *data)
+ {
++	int err;
++
+ 	brcmf_dbg(TRACE, "enter: bsscfgidx=%d\n", ifp->bsscfgidx);
+ 
+-	return brcmf_debug_create_memdump(ifp->drvr->bus_if, data,
+-					  evtmsg->datalen);
++	brcmf_err("PSM's watchdog has fired!\n");
++
++	err = brcmf_debug_create_memdump(ifp->drvr->bus_if, data,
++					 evtmsg->datalen);
++	if (err)
++		brcmf_err("Failed to get memory dump, %d\n", err);
++
++	return err;
+ }
+ 
+ void brcmf_debugfs_init(void)

package/kernel/mac80211/patches/500-ath9k_eeprom_debugfs.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1316,6 +1316,53 @@ void ath9k_deinit_debug(struct ath_softc
+@@ -1315,6 +1315,53 @@ void ath9k_deinit_debug(struct ath_softc
  	ath9k_cmn_spectral_deinit_debug(&sc->spec_priv);
  }
  
@@ -54,7 +54,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1335,6 +1382,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1334,6 +1381,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	ath9k_tx99_init_debug(sc);
  	ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
  

package/kernel/mac80211/patches/512-ath9k_channelbw_debugfs.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1363,6 +1363,52 @@ static const struct file_operations fops
+@@ -1362,6 +1362,52 @@ static const struct file_operations fops
  	.owner = THIS_MODULE
  };
  
@@ -53,7 +53,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1384,6 +1430,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1383,6 +1429,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  
  	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
  			    &fops_eeprom);

package/kernel/mac80211/patches/530-ath9k_extra_leds.patch

@@ -24,7 +24,7 @@
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -1047,9 +1057,8 @@ struct ath_softc {
+@@ -1046,9 +1056,8 @@ struct ath_softc {
  	spinlock_t chan_lock;
  
  #ifdef CPTCFG_MAC80211_LEDS
@@ -103,8 +103,7 @@
 +		      GFP_KERNEL);
 +	if (!led)
 +		return -ENOMEM;
- 
--	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, val);
++
 +	led->gpio = gpio = (struct gpio_led *) (led + 1);
 +	_name = (char *) (led->gpio + 1);
 +
@@ -117,7 +116,8 @@
 +	ret = ath_add_led(sc, led);
 +	if (unlikely(ret < 0))
 +		kfree(led);
-+
+ 
+-	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, val);
 +	return ret;
  }
  
@@ -125,11 +125,11 @@
  {
 -	if (!sc->led_registered)
 -		return;
--
--	ath_led_brightness(&sc->led_cdev, LED_OFF);
--	led_classdev_unregister(&sc->led_cdev);
 +	struct ath_led *led;
  
+-	ath_led_brightness(&sc->led_cdev, LED_OFF);
+-	led_classdev_unregister(&sc->led_cdev);
+-
 -	ath9k_hw_gpio_free(sc->sc_ah, sc->sc_ah->led_pin);
 +	while (!list_empty(&sc->leds)) {
 +		led = list_first_entry(&sc->leds, struct ath_led, list);
@@ -192,7 +192,7 @@
  #endif
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1408,6 +1408,61 @@ static const struct file_operations fops
+@@ -1407,6 +1407,61 @@ static const struct file_operations fops
  	.llseek = default_llseek,
  };
  
@@ -254,7 +254,7 @@
  
  int ath9k_init_debug(struct ath_hw *ah)
  {
-@@ -1432,6 +1487,10 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1431,6 +1486,10 @@ int ath9k_init_debug(struct ath_hw *ah)
  			    &fops_eeprom);
  	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
  			    sc, &fops_chanbw);

package/kernel/mac80211/patches/542-ath9k_debugfs_diag.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1464,6 +1464,50 @@ static const struct file_operations fops
+@@ -1463,6 +1463,50 @@ static const struct file_operations fops
  #endif
  
  
@@ -51,7 +51,7 @@
  int ath9k_init_debug(struct ath_hw *ah)
  {
  	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1491,6 +1535,8 @@ int ath9k_init_debug(struct ath_hw *ah)
+@@ -1490,6 +1534,8 @@ int ath9k_init_debug(struct ath_hw *ah)
  	debugfs_create_file("gpio_led", S_IWUSR,
  			   sc->debug.debugfs_phy, sc, &fops_gpio_led);
  #endif
@@ -125,7 +125,7 @@
  		REG_SET_BIT(ah, AR_BTCOEX_WL_LNADIV, AR_BTCOEX_WL_LNADIV_FORCE_ON);
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -529,6 +529,11 @@ irqreturn_t ath_isr(int irq, void *dev)
+@@ -527,6 +527,11 @@ irqreturn_t ath_isr(int irq, void *dev)
  	if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
  		return IRQ_HANDLED;
  

package/kernel/mac80211/patches/548-ath9k_enable_gpio_chip.patch

@@ -33,7 +33,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  struct ath_softc {
  	struct ieee80211_hw *hw;
  	struct device *dev;
-@@ -1059,6 +1068,9 @@ struct ath_softc {
+@@ -1058,6 +1067,9 @@ struct ath_softc {
  #ifdef CPTCFG_MAC80211_LEDS
  	const char *led_default_trigger;
  	struct list_head leds;

package/kernel/mac80211/patches/549-ath9k_enable_gpio_buttons.patch

@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
-@@ -1070,6 +1070,7 @@ struct ath_softc {
+@@ -1069,6 +1069,7 @@ struct ath_softc {
  	struct list_head leds;
  #ifdef CONFIG_GPIOLIB
  	struct ath9k_gpio_chip *gpiochip;

package/kernel/mac80211/patches/556-ath9k-define-all-EEPROM-fields-in-Little-Endian-form.patch

@@ -349,6 +349,16 @@ Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
 -
 -		integer = swab32(eep->modalHeader.antCtrlCommon);
 -		eep->modalHeader.antCtrlCommon = integer;
+-
+-		for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
+-			integer = swab32(eep->modalHeader.antCtrlChain[i]);
+-			eep->modalHeader.antCtrlChain[i] = integer;
+-		}
+-
+-		for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
+-			word = swab16(eep->modalHeader.spurChans[i].spurChan);
+-			eep->modalHeader.spurChans[i].spurChan = word;
+-		}
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.length);
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.checksum);
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.version);
@@ -358,18 +368,10 @@ Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.blueToothOptions);
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.deviceCap);
 +		EEPROM_FIELD_SWAB32(eep->modalHeader.antCtrlCommon);
- 
--		for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
--			integer = swab32(eep->modalHeader.antCtrlChain[i]);
--			eep->modalHeader.antCtrlChain[i] = integer;
--		}
++
 +		for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++)
 +			EEPROM_FIELD_SWAB32(eep->modalHeader.antCtrlChain[i]);
- 
--		for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
--			word = swab16(eep->modalHeader.spurChans[i].spurChan);
--			eep->modalHeader.spurChans[i].spurChan = word;
--		}
++
 +		for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++)
 +			EEPROM_FIELD_SWAB16(
 +				eep->modalHeader.spurChans[i].spurChan);
@@ -540,6 +542,16 @@ Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
 -
 -		integer = swab32(eep->modalHeader.antCtrlCommon);
 -		eep->modalHeader.antCtrlCommon = integer;
+-
+-		for (i = 0; i < AR9287_MAX_CHAINS; i++) {
+-			integer = swab32(eep->modalHeader.antCtrlChain[i]);
+-			eep->modalHeader.antCtrlChain[i] = integer;
+-		}
+-
+-		for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
+-			word = swab16(eep->modalHeader.spurChans[i].spurChan);
+-			eep->modalHeader.spurChans[i].spurChan = word;
+-		}
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.length);
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.checksum);
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.version);
@@ -549,18 +561,10 @@ Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.blueToothOptions);
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.deviceCap);
 +		EEPROM_FIELD_SWAB32(eep->modalHeader.antCtrlCommon);
- 
--		for (i = 0; i < AR9287_MAX_CHAINS; i++) {
--			integer = swab32(eep->modalHeader.antCtrlChain[i]);
--			eep->modalHeader.antCtrlChain[i] = integer;
--		}
++
 +		for (i = 0; i < AR9287_MAX_CHAINS; i++)
 +			EEPROM_FIELD_SWAB32(eep->modalHeader.antCtrlChain[i]);
- 
--		for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
--			word = swab16(eep->modalHeader.spurChans[i].spurChan);
--			eep->modalHeader.spurChans[i].spurChan = word;
--		}
++
 +		for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++)
 +			EEPROM_FIELD_SWAB16(
 +				eep->modalHeader.spurChans[i].spurChan);
@@ -712,7 +716,8 @@ Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
  	if (need_swap) {
 -		u32 integer, j;
 -		u16 word;
--
++		u32 j;
+ 
 -		word = swab16(eep->baseEepHeader.length);
 -		eep->baseEepHeader.length = word;
 -
@@ -733,8 +738,7 @@ Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
 -
 -		word = swab16(eep->baseEepHeader.blueToothOptions);
 -		eep->baseEepHeader.blueToothOptions = word;
-+		u32 j;
- 
+-
 -		word = swab16(eep->baseEepHeader.deviceCap);
 -		eep->baseEepHeader.deviceCap = word;
 +		EEPROM_FIELD_SWAB16(eep->baseEepHeader.length);

package/kernel/mac80211/patches/560-ath9k_ubnt_uap_plus_hsr.patch

@@ -343,7 +343,7 @@
  
  u8 ath9k_parse_mpdudensity(u8 mpdudensity)
  {
-@@ -650,6 +652,7 @@ void ath_reset_work(struct work_struct *
+@@ -648,6 +650,7 @@ void ath_reset_work(struct work_struct *
  static int ath9k_start(struct ieee80211_hw *hw)
  {
  	struct ath_softc *sc = hw->priv;
@@ -351,7 +351,7 @@
  	struct ath_hw *ah = sc->sc_ah;
  	struct ath_common *common = ath9k_hw_common(ah);
  	struct ieee80211_channel *curchan = sc->cur_chan->chandef.chan;
-@@ -728,6 +731,11 @@ static int ath9k_start(struct ieee80211_
+@@ -726,6 +729,11 @@ static int ath9k_start(struct ieee80211_
  					  AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
  	}
  

package/kernel/mac80211/patches/841-brcmfmac-use-wiphy_read_of_freq_limits.patch

@@ -9,7 +9,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -5974,6 +5974,9 @@ static int brcmf_construct_chaninfo(stru
+@@ -5882,6 +5882,9 @@ static int brcmf_construct_chaninfo(stru
  			continue;
  		}
  
@@ -19,7 +19,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  		/* assuming the chanspecs order is HT20,
  		 * HT40 upper, HT40 lower, and VHT80.
  		 */
-@@ -6564,6 +6567,9 @@ static int brcmf_setup_wiphy(struct wiph
+@@ -6483,6 +6486,9 @@ static int brcmf_setup_wiphy(struct wiph
  			wiphy->bands[NL80211_BAND_5GHZ] = band;
  		}
  	}

package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch

@@ -13,7 +13,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1200,6 +1200,7 @@ int __init brcmf_core_init(void)
+@@ -1196,6 +1196,7 @@ int __init brcmf_core_init(void)
  {
  	if (!schedule_work(&brcmf_driver_work))
  		return -EBUSY;

package/kernel/mac80211/patches/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch

@@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -663,9 +663,37 @@ static struct wireless_dev *brcmf_cfg802
+@@ -654,9 +654,37 @@ static struct wireless_dev *brcmf_cfg802
  						     u32 *flags,
  						     struct vif_params *params)
  {

package/kernel/mac80211/patches/862-brcmfmac-Disable-power-management.patch

@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2782,6 +2782,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+@@ -2773,6 +2773,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
  	 * preference in cfg struct to apply this to
  	 * FW later while initializing the dongle
  	 */

package/kernel/mt76/Makefile

@@ -8,9 +8,9 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2017-01-15
-PKG_SOURCE_VERSION:=85d12fea1abe8654f694dc6594781f85168aa2c2
-PKG_MIRROR_HASH:=d07c019a3f836860409c58c303195df832f5dc31168201c3fa7d23f4f5927a79
+PKG_SOURCE_DATE:=2017-01-31
+PKG_SOURCE_VERSION:=3c8caafc5e150db79f714b958a51cee8f242f309
+PKG_MIRROR_HASH:=c03c166466cb7ea825e52cd085511045e3847d927ba2bde2b8fb46595a3ed13a
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_BUILD_PARALLEL:=1

package/kernel/mwlwifi/Makefile

@@ -16,7 +16,7 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/kaloz/mwlwifi
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=88550a0261ac9718eda7f28022d239c0053e2f94
+PKG_SOURCE_VERSION:=ccdfdac28f7666474745b1f46f0769f3a2879b5f
 PKG_MIRROR_HASH:=a903d87cbd252019d2dee84ca331e3c865be611e989301aadaaee86ca4ce2435
 
 PKG_MAINTAINER:=Imre Kaloz <kaloz@openwrt.org>

package/libs/libtool/Makefile

@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libtool
 PKG_VERSION:=2.4
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/libtool
@@ -34,14 +34,14 @@ endef
 
 define Build/InstallDev
 	$(MAKE) -C $(PKG_BUILD_DIR) \
-		bindir="$(2)/bin" \
-		datadir="$(2)/share" \
-		prefix="$(2)" \
-		exec_prefix="$(2)" \
+		bindir="$(2)/libltdl/bin" \
+		datadir="$(2)/libltdl/share" \
+		prefix="$(2)/libltdl" \
+		exec_prefix="$(2)/libltdl" \
 		install
 	$(INSTALL_DIR) $(1)/usr/lib $(1)/usr/include
-	mv $(2)/lib/* $(1)/usr/lib/
-	mv $(2)/include/* $(1)/usr/include/
+	mv $(2)/libltdl/lib/* $(1)/usr/lib/
+	mv $(2)/libltdl/include/* $(1)/usr/include/
 endef
 
 define Package/libltdl/install

package/network/config/netifd/Makefile

@@ -5,9 +5,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(LEDE_GIT)/project/netifd.git
-PKG_SOURCE_DATE:=2017-01-17
-PKG_SOURCE_VERSION:=a057f6e48f383c7e81cb22aa806216878d87947b
-PKG_MIRROR_HASH:=8b74721b3c3b2912df4271f0a60c2137642eeb7753d3e656f7a508d8cac013e9
+PKG_SOURCE_DATE:=2017-01-25
+PKG_SOURCE_VERSION:=650758b16e5185505a3fbc1307949340af70b611
+PKG_MIRROR_HASH:=d09c740bc1bf6269678bd75c9af52ecd4be3d1d59402a543ceb9d4459cecfa2b
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
 PKG_LICENSE:=GPL-2.0

package/network/ipv6/odhcp6c/Makefile

@@ -10,11 +10,11 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=odhcp6c
 PKG_RELEASE:=1
 
-PKG_SOURCE_URL:=git://git.lede-project.org/project/odhcp6c.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2017-01-07
-PKG_SOURCE_VERSION:=d420f49396c627ce1072b83170889baf0720bc8b
-PKG_MIRROR_HASH:=a7c599b5600b6cca9aec221dd32fc7754e0e942b0192bd902f1e789f53345127
+PKG_SOURCE_URL:=$(LEDE_GIT)/project/odhcp6c.git
+PKG_SOURCE_DATE:=2017-01-30
+PKG_SOURCE_VERSION:=c13b6a05dbd9174356cc4b7fd1edf39445efd982
+PKG_MIRROR_HASH:=001e58f1ab6eb8903d9e47060ae037a2e4f021f1fef5032347b767f56f4664f6
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
 

package/network/services/hostapd/Makefile

@@ -242,7 +242,7 @@ define Package/eapol-test
   SECTION:=net
   CATEGORY:=Network
   VARIANT:=supplicant-full
-  DEPENDS:=$(DRV_DEPENDS)
+  DEPENDS:=$(DRV_DEPENDS) +WPA_SUPPLICANT_OPENSSL:libopenssl
 endef
 
 

package/network/services/hostapd/files/hostapd-full.config

@@ -146,6 +146,9 @@ CONFIG_IEEE80211AC=y
 # code is not needed.
 #CONFIG_NO_STDOUT_DEBUG=y
 
+# Send debug messages to syslog instead of stdout
+CONFIG_DEBUG_SYSLOG=y
+
 # Remove support for RADIUS accounting
 #CONFIG_NO_ACCOUNTING=y
 

package/network/services/hostapd/files/hostapd-mini.config

@@ -142,6 +142,9 @@ CONFIG_IEEE80211AC=y
 # code is not needed.
 #CONFIG_NO_STDOUT_DEBUG=y
 
+# Send debug messages to syslog instead of stdout
+CONFIG_DEBUG_SYSLOG=y
+
 # Remove support for RADIUS accounting
 CONFIG_NO_ACCOUNTING=y
 

package/network/services/hostapd/files/netifd.sh

@@ -158,6 +158,7 @@ hostapd_common_add_bss_config() {
 	config_add_string wpa_psk_file
 
 	config_add_boolean wps_pushbutton wps_label ext_registrar wps_pbc_in_m1
+	config_add_int wps_ap_setup_locked wps_independent
 	config_add_string wps_device_type wps_device_name wps_manufacturer wps_pin
 
 	config_add_boolean ieee80211r pmk_r1_push
@@ -191,8 +192,8 @@ hostapd_set_bss_options() {
 	json_get_vars \
 		wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey \
 		maxassoc max_inactivity disassoc_low_ack isolate auth_cache \
-		wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 \
-		wps_device_type wps_device_name wps_manufacturer wps_pin \
+		wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \
+		wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \
 		macfilter ssid wmm uapsd hidden short_preamble rsn_preauth \
 		iapp_interface eapol_version acct_server acct_secret acct_port \
 		dynamic_vlan ieee80211w
@@ -328,6 +329,7 @@ hostapd_set_bss_options() {
 		set_default wps_device_type "6-0050F204-1"
 		set_default wps_device_name "Lede AP"
 		set_default wps_manufacturer "www.lede-project.org"
+		set_default wps_independent 1
 
 		wps_state=2
 		[ -n "$wps_configured" ] && wps_state=1
@@ -337,11 +339,12 @@ hostapd_set_bss_options() {
 		append bss_conf "eap_server=1" "$N"
 		[ -n "$wps_pin" ] && append bss_conf "ap_pin=$wps_pin" "$N"
 		append bss_conf "wps_state=$wps_state" "$N"
-		append bss_conf "ap_setup_locked=0" "$N"
 		append bss_conf "device_type=$wps_device_type" "$N"
 		append bss_conf "device_name=$wps_device_name" "$N"
 		append bss_conf "manufacturer=$wps_manufacturer" "$N"
 		append bss_conf "config_methods=$config_methods" "$N"
+		append bss_conf "wps_independent=$wps_independent" "$N"
+		[ -n "$wps_ap_setup_locked" ] && append bss_conf "ap_setup_locked=$wps_ap_setup_locked" "$N"
 		[ "$wps_pbc_in_m1" -gt 0 ] && append bss_conf "pbc_in_m1=$wps_pbc_in_m1" "$N"
 	}
 

package/network/services/hostapd/patches/004-hostapd-Add-possibility-to-send-debug-messages-to-sy.patch

@@ -0,0 +1,145 @@
+From cc3dae85bd694506cdea66ae532d452fb8716297 Mon Sep 17 00:00:00 2001
+From: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
+Date: Mon, 23 Jan 2017 13:55:04 +0100
+Subject: [PATCH] hostapd: Add possibility to send debug messages to syslog
+
+We can only send module specific messages to syslog and not debug
+messages printed with wpa_printf. Add an extra command line parameter
+'-s' to allow it. The feature is enabled with compile flag
+CONFIG_DEBUG_SYSLOG as for wpa_supplicant and behaves in the same manner
+as the wpa_supplicant -s command line argument.
+
+Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
+---
+ hostapd/Android.mk    |  4 ++++
+ hostapd/Makefile      |  4 ++++
+ hostapd/defconfig     |  3 +++
+ hostapd/main.c        | 19 ++++++++++++++++++-
+ src/utils/wpa_debug.c |  2 +-
+ src/utils/wpa_debug.h |  3 +++
+ 6 files changed, 33 insertions(+), 2 deletions(-)
+
+--- a/hostapd/Android.mk
++++ b/hostapd/Android.mk
+@@ -952,6 +952,10 @@ ifdef CONFIG_NO_STDOUT_DEBUG
+ L_CFLAGS += -DCONFIG_NO_STDOUT_DEBUG
+ endif
+ 
++ifdef CONFIG_DEBUG_SYSLOG
++L_CFLAGS += -DCONFIG_DEBUG_SYSLOG
++endif
++
+ ifdef CONFIG_DEBUG_LINUX_TRACING
+ L_CFLAGS += -DCONFIG_DEBUG_LINUX_TRACING
+ endif
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -997,6 +997,10 @@ ifdef CONFIG_NO_STDOUT_DEBUG
+ CFLAGS += -DCONFIG_NO_STDOUT_DEBUG
+ endif
+ 
++ifdef CONFIG_DEBUG_SYSLOG
++CFLAGS += -DCONFIG_DEBUG_SYSLOG
++endif
++
+ ifdef CONFIG_DEBUG_LINUX_TRACING
+ CFLAGS += -DCONFIG_DEBUG_LINUX_TRACING
+ endif
+--- a/hostapd/defconfig
++++ b/hostapd/defconfig
+@@ -166,6 +166,9 @@ CONFIG_IPV6=y
+ # Disabled by default.
+ #CONFIG_DEBUG_FILE=y
+ 
++# Send debug messages to syslog instead of stdout
++#CONFIG_DEBUG_SYSLOG=y
++
+ # Add support for sending all debug messages (regardless of debug verbosity)
+ # to the Linux kernel tracing facility. This helps debug the entire stack by
+ # making it easy to record everything happening from the driver up into the
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -108,6 +108,10 @@ static void hostapd_logger_cb(void *ctx,
+ 			    module_str ? module_str : "",
+ 			    module_str ? ": " : "", txt);
+ 
++#ifdef CONFIG_DEBUG_SYSLOG
++	if (wpa_debug_syslog)
++		conf_stdout = 0;
++#endif /* CONFIG_DEBUG_SYSLOG */
+ 	if ((conf_stdout & module) && level >= conf_stdout_level) {
+ 		wpa_debug_print_timestamp();
+ 		wpa_printf(MSG_INFO, "%s", format);
+@@ -484,6 +488,9 @@ static void usage(void)
+ 		"        (records all messages regardless of debug verbosity)\n"
+ #endif /* CONFIG_DEBUG_LINUX_TRACING */
+ 		"   -i   list of interface names to use\n"
++#ifdef CONFIG_DEBUG_SYSLOG
++		"   -s   log output to syslog instead of stdout\n"
++#endif /* CONFIG_DEBUG_SYSLOG */
+ 		"   -S   start all the interfaces synchronously\n"
+ 		"   -t   include timestamps in some debug messages\n"
+ 		"   -v   show hostapd version\n");
+@@ -661,7 +668,7 @@ int main(int argc, char *argv[])
+ 	dl_list_init(&interfaces.global_ctrl_dst);
+ 
+ 	for (;;) {
+-		c = getopt(argc, argv, "b:Bde:f:hi:KP:STtu:vg:G:");
++		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:");
+ 		if (c < 0)
+ 			break;
+ 		switch (c) {
+@@ -718,6 +725,11 @@ int main(int argc, char *argv[])
+ 			bss_config = tmp_bss;
+ 			bss_config[num_bss_configs++] = optarg;
+ 			break;
++#ifdef CONFIG_DEBUG_SYSLOG
++		case 's':
++			wpa_debug_syslog = 1;
++			break;
++#endif /* CONFIG_DEBUG_SYSLOG */
+ 		case 'S':
+ 			start_ifaces_in_sync = 1;
+ 			break;
+@@ -746,6 +758,10 @@ int main(int argc, char *argv[])
+ 		wpa_debug_open_file(log_file);
+ 	else
+ 		wpa_debug_setup_stdout();
++#ifdef CONFIG_DEBUG_SYSLOG
++	if (wpa_debug_syslog)
++		wpa_debug_open_syslog();
++#endif /* CONFIG_DEBUG_SYSLOG */
+ #ifdef CONFIG_DEBUG_LINUX_TRACING
+ 	if (enable_trace_dbg) {
+ 		int tret = wpa_debug_open_linux_tracing();
+@@ -882,6 +898,7 @@ int main(int argc, char *argv[])
+ 	hostapd_global_deinit(pid_file, interfaces.eloop_initialized);
+ 	os_free(pid_file);
+ 
++	wpa_debug_close_syslog();
+ 	if (log_file)
+ 		wpa_debug_close_file();
+ 	wpa_debug_close_linux_tracing();
+--- a/src/utils/wpa_debug.c
++++ b/src/utils/wpa_debug.c
+@@ -13,7 +13,7 @@
+ #ifdef CONFIG_DEBUG_SYSLOG
+ #include <syslog.h>
+ 
+-static int wpa_debug_syslog = 0;
++int wpa_debug_syslog = 0;
+ #endif /* CONFIG_DEBUG_SYSLOG */
+ 
+ #ifdef CONFIG_DEBUG_LINUX_TRACING
+--- a/src/utils/wpa_debug.h
++++ b/src/utils/wpa_debug.h
+@@ -14,6 +14,9 @@
+ extern int wpa_debug_level;
+ extern int wpa_debug_show_keys;
+ extern int wpa_debug_timestamp;
++#ifdef CONFIG_DEBUG_SYSLOG
++extern int wpa_debug_syslog;
++#endif /* CONFIG_DEBUG_SYSLOG */
+ 
+ /* Debugging function - conditional printf and hex dump. Driver wrappers can
+  * use these for debugging purposes. */

package/network/services/hostapd/patches/100-daemonize_fix.patch

@@ -60,13 +60,13 @@
 +	if (chdir("/") < 0)
  		return -1;
 -	}
- 
+-
 -	return 0;
 -}
 -#else /* __APPLE__ */
 -#define os_daemon daemon
 -#endif /* __APPLE__ */
--
+ 
 -
 -int os_daemonize(const char *pid_file)
 -{

package/network/services/hostapd/patches/200-multicall.patch

@@ -36,7 +36,7 @@
  LIBS += $(DRV_AP_LIBS)
  
  ifdef CONFIG_L2_PACKET
-@@ -1073,6 +1079,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
+@@ -1077,6 +1083,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
  
  BCHECK=../src/drivers/build.hostapd
  
@@ -49,7 +49,7 @@
  hostapd: $(BCHECK) $(OBJS)
  	$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
  	@$(E) "  LD " $@
-@@ -1114,6 +1126,12 @@ HOBJS += ../src/crypto/aes-internal.o
+@@ -1118,6 +1130,12 @@ HOBJS += ../src/crypto/aes-internal.o
  HOBJS += ../src/crypto/aes-internal-enc.o
  endif
  
@@ -293,7 +293,7 @@
  		wpa_debug_open_file(params->wpa_debug_file_path);
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -583,6 +583,11 @@ fail:
+@@ -590,6 +590,11 @@ fail:
  	return -1;
  }
  
@@ -305,14 +305,14 @@
  
  #ifdef CONFIG_WPS
  static int gen_uuid(const char *txt_addr)
-@@ -660,6 +665,8 @@ int main(int argc, char *argv[])
+@@ -667,6 +672,8 @@ int main(int argc, char *argv[])
  	interfaces.global_ctrl_sock = -1;
  	dl_list_init(&interfaces.global_ctrl_dst);
  
 +	wpa_supplicant_event = hostapd_wpa_event;
 +	wpa_supplicant_event_global = hostapd_wpa_event_global;
  	for (;;) {
- 		c = getopt(argc, argv, "b:Bde:f:hi:KP:STtu:vg:G:");
+ 		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:");
  		if (c < 0)
 --- a/src/drivers/drivers.c
 +++ b/src/drivers/drivers.c

package/network/services/hostapd/patches/410-limit_debug_messages.patch

@@ -84,7 +84,7 @@
  	char *buf;
 --- a/src/utils/wpa_debug.h
 +++ b/src/utils/wpa_debug.h
-@@ -49,6 +49,17 @@ int wpa_debug_reopen_file(void);
+@@ -52,6 +52,17 @@ int wpa_debug_reopen_file(void);
  void wpa_debug_close_file(void);
  void wpa_debug_setup_stdout(void);
  
@@ -102,7 +102,7 @@
  /**
   * wpa_debug_printf_timestamp - Print timestamp for debug output
   *
-@@ -69,9 +80,15 @@ void wpa_debug_print_timestamp(void);
+@@ -72,9 +83,15 @@ void wpa_debug_print_timestamp(void);
   *
   * Note: New line '\n' is added to the end of the text when printing to stdout.
   */
@@ -119,7 +119,7 @@
  /**
   * wpa_hexdump - conditional hex dump
   * @level: priority level (MSG_*) of the message
-@@ -83,7 +100,13 @@ PRINTF_FORMAT(2, 3);
+@@ -86,7 +103,13 @@ PRINTF_FORMAT(2, 3);
   * output may be directed to stdout, stderr, and/or syslog based on
   * configuration. The contents of buf is printed out has hex dump.
   */
@@ -134,7 +134,7 @@
  
  static inline void wpa_hexdump_buf(int level, const char *title,
  				   const struct wpabuf *buf)
-@@ -105,7 +128,13 @@ static inline void wpa_hexdump_buf(int l
+@@ -108,7 +131,13 @@ static inline void wpa_hexdump_buf(int l
   * like wpa_hexdump(), but by default, does not include secret keys (passwords,
   * etc.) in debug output.
   */
@@ -149,7 +149,7 @@
  
  static inline void wpa_hexdump_buf_key(int level, const char *title,
  				       const struct wpabuf *buf)
-@@ -127,8 +156,14 @@ static inline void wpa_hexdump_buf_key(i
+@@ -130,8 +159,14 @@ static inline void wpa_hexdump_buf_key(i
   * the hex numbers and ASCII characters (for printable range) are shown. 16
   * bytes per line will be shown.
   */
@@ -166,7 +166,7 @@
  
  /**
   * wpa_hexdump_ascii_key - conditional hex dump, hide keys
-@@ -144,8 +179,14 @@ void wpa_hexdump_ascii(int level, const
+@@ -147,8 +182,14 @@ void wpa_hexdump_ascii(int level, const
   * bytes per line will be shown. This works like wpa_hexdump_ascii(), but by
   * default, does not include secret keys (passwords, etc.) in debug output.
   */
@@ -183,7 +183,7 @@
  
  /*
   * wpa_dbg() behaves like wpa_msg(), but it can be removed from build to reduce
-@@ -182,7 +223,12 @@ void wpa_hexdump_ascii_key(int level, co
+@@ -185,7 +226,12 @@ void wpa_hexdump_ascii_key(int level, co
   *
   * Note: New line '\n' is added to the end of the text when printing to stdout.
   */
@@ -197,7 +197,7 @@
  
  /**
   * wpa_msg_ctrl - Conditional printf for ctrl_iface monitors
-@@ -196,8 +242,13 @@ void wpa_msg(void *ctx, int level, const
+@@ -199,8 +245,13 @@ void wpa_msg(void *ctx, int level, const
   * attached ctrl_iface monitors. In other words, it can be used for frequent
   * events that do not need to be sent to syslog.
   */

package/network/services/hostapd/patches/420-indicate-features.patch

@@ -8,16 +8,16 @@
  #include "crypto/random.h"
  #include "crypto/tls.h"
  #include "common/version.h"
-@@ -668,7 +669,7 @@ int main(int argc, char *argv[])
+@@ -675,7 +676,7 @@ int main(int argc, char *argv[])
  	wpa_supplicant_event = hostapd_wpa_event;
  	wpa_supplicant_event_global = hostapd_wpa_event_global;
  	for (;;) {
--		c = getopt(argc, argv, "b:Bde:f:hi:KP:STtu:vg:G:");
-+		c = getopt(argc, argv, "b:Bde:f:hi:KP:STtu:g:G:v::");
+-		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:vg:G:");
++		c = getopt(argc, argv, "b:Bde:f:hi:KP:sSTtu:g:G:v::");
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -705,6 +706,8 @@ int main(int argc, char *argv[])
+@@ -712,6 +713,8 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_DEBUG_LINUX_TRACING */
  		case 'v':

package/network/services/hostapd/patches/450-scan_wait.patch

@@ -9,7 +9,7 @@
  
  
  #ifndef CONFIG_NO_HOSTAPD_LOGGER
-@@ -143,6 +145,14 @@ static void hostapd_logger_cb(void *ctx,
+@@ -147,6 +149,14 @@ static void hostapd_logger_cb(void *ctx,
  }
  #endif /* CONFIG_NO_HOSTAPD_LOGGER */
  
@@ -24,7 +24,7 @@
  
  /**
   * hostapd_driver_init - Preparate driver interface
-@@ -161,6 +171,8 @@ static int hostapd_driver_init(struct ho
+@@ -165,6 +175,8 @@ static int hostapd_driver_init(struct ho
  		return -1;
  	}
  
@@ -33,7 +33,7 @@
  	/* Initialize the driver interface */
  	if (!(b[0] | b[1] | b[2] | b[3] | b[4] | b[5]))
  		b = NULL;
-@@ -401,8 +413,6 @@ static void hostapd_global_deinit(const
+@@ -405,8 +417,6 @@ static void hostapd_global_deinit(const
  #endif /* CONFIG_NATIVE_WINDOWS */
  
  	eap_server_unregister_methods();
@@ -42,7 +42,7 @@
  }
  
  
-@@ -428,18 +438,6 @@ static int hostapd_global_run(struct hap
+@@ -432,18 +442,6 @@ static int hostapd_global_run(struct hap
  	}
  #endif /* EAP_SERVER_TNC */
  
@@ -61,7 +61,7 @@
  	eloop_run();
  
  	return 0;
-@@ -638,8 +636,7 @@ int main(int argc, char *argv[])
+@@ -645,8 +643,7 @@ int main(int argc, char *argv[])
  	struct hapd_interfaces interfaces;
  	int ret = 1;
  	size_t i, j;

package/network/services/mdns/Makefile

@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_URL=$(LEDE_GIT)/project/mdnsd.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2016-12-19
-PKG_SOURCE_VERSION:=be8ae8d0b5f2e8651edf0cc8f35916fc4b71d1ac
-PKG_MIRROR_HASH:=fd6e8b17407b9e6dc96f485c62f54e02a0ab27b5878c271f95749495970dacc2
+PKG_SOURCE_DATE:=2017-01-31
+PKG_SOURCE_VERSION:=9cbbb141068c12ed032736e20f982e2a0fb43edc
+PKG_MIRROR_HASH:=2b981bd2f695f4da63b51be33b42dcda132c6adab227eda2f68a5c534284aea9
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=LGPL-2.1

package/network/services/odhcpd/Makefile

@@ -10,11 +10,11 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=odhcpd
 PKG_RELEASE:=1
 
-PKG_SOURCE_URL:=git://git.lede-project.org/project/odhcpd.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2017-01-06
-PKG_SOURCE_VERSION:=ef3c5632c100fda0fa463a3ed56ff926f3f86b20
-PKG_MIRROR_HASH:=a870ae200dd4b0776f18f19051f75a6654108e8f25044d37c6d0856193c3ccf0
+PKG_SOURCE_URL:=$(LEDE_GIT)/project/odhcpd.git
+PKG_SOURCE_DATE:=2017-01-26
+PKG_SOURCE_VERSION:=c4f9ace5560562d3ba7dfefb9e422240d594a460
+PKG_MIRROR_HASH:=323a1123ce37c5f1e60366204d0ed273c0ee003e7a43010bf0882cf67629ee39
 
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0

package/network/services/openvpn/Makefile

@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=openvpn
 
 PKG_VERSION:=2.4.0
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE_URL:=http://swupdate.openvpn.net/community/releases
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
@@ -34,7 +34,11 @@ define Package/openvpn/Default
   MENU:=1
   DEPENDS:=+kmod-tun +OPENVPN_$(1)_ENABLE_LZO:liblzo +OPENVPN_$(1)_ENABLE_IPROUTE2:ip $(3)
   VARIANT:=$(1)
+ifeq ($(1),nossl)
   PROVIDES:=openvpn
+else
+  PROVIDES:=openvpn openvpn-crypto
+endif
   MAINTAINER:=Mirko Vogt <mirko@openwrt.org>
 endef
 

package/network/services/ppp/Makefile

@@ -30,7 +30,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/ppp/Default
   SECTION:=net
   CATEGORY:=Network
-  URL:=http://ppp.samba.org/
+  URL:=https://ppp.samba.org/
 endef
 
 define Package/ppp

package/network/services/samba36/Makefile

@@ -11,8 +11,8 @@ PKG_NAME:=samba
 PKG_VERSION:=3.6.25
 PKG_RELEASE:=5
 
-PKG_SOURCE_URL:=http://ftp.samba.org/pub/samba \
-	http://ftp.samba.org/pub/samba/stable
+PKG_SOURCE_URL:=https://download.samba.org/pub/samba \
+		https://download.samba.org/pub/samba/stable
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_HASH:=8f2c8a7f2bd89b0dfd228ed917815852f7c625b2bc0936304ac3ed63aaf83751
 
@@ -34,7 +34,7 @@ define Package/samba36-server
   SECTION:=net
   CATEGORY:=Network
   TITLE:=Samba 3.6 SMB/CIFS server
-  URL:=http://www.samba.org/
+  URL:=https://www.samba.org/
   DEPENDS:=+USE_GLIBC:librt $(ICONV_DEPENDS)
 endef
 
@@ -42,7 +42,7 @@ define Package/samba36-client
   SECTION:=net
   CATEGORY:=Network
   TITLE:=Samba 3.6 SMB/CIFS client
-  URL:=http://www.samba.org/
+  URL:=https://www.samba.org/
   DEPENDS:=+libreadline +libncurses
 endef
 

package/network/utils/iproute2/Makefile

@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=iproute2
 PKG_VERSION:=4.4.0
-PKG_RELEASE:=6
+PKG_RELEASE:=8
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/net/iproute2

package/network/utils/iproute2/patches/950-add-cake-to-tc.patch

@@ -1,6 +1,8 @@
+diff --git a/include/linux/pkt_sched.h b/include/linux/pkt_sched.h
+index 8d2530d..c55a9a8 100644
 --- a/include/linux/pkt_sched.h
 +++ b/include/linux/pkt_sched.h
-@@ -850,4 +850,59 @@ struct tc_pie_xstats {
+@@ -850,4 +850,60 @@ struct tc_pie_xstats {
  	__u32 maxq;             /* maximum queue size */
  	__u32 ecn_mark;         /* packets marked with ecn*/
  };
@@ -20,6 +22,7 @@
 +	TCA_CAKE_NAT,
 +	TCA_CAKE_ETHERNET,
 +	TCA_CAKE_WASH,
++	TCA_CAKE_MPU,
 +	__TCA_CAKE_MAX
 +};
 +#define TCA_CAKE_MAX	(__TCA_CAKE_MAX - 1)
@@ -60,6 +63,8 @@
 +};
 +
  #endif
+diff --git a/tc/Makefile b/tc/Makefile
+index 56acbaa..d421b8e 100644
 --- a/tc/Makefile
 +++ b/tc/Makefile
 @@ -63,6 +63,7 @@ TCMODULES += q_codel.o
@@ -70,9 +75,12 @@
  TCMODULES += q_hhf.o
  TCMODULES += e_bpf.o
  
+diff --git a/tc/q_cake.c b/tc/q_cake.c
+new file mode 100644
+index 0000000..acbe56c
 --- /dev/null
 +++ b/tc/q_cake.c
-@@ -0,0 +1,663 @@
+@@ -0,0 +1,692 @@
 +/*
 + * Common Applications Kept Enhanced  --  CAKE
 + *
@@ -126,14 +134,20 @@
 +
 +static void explain(void)
 +{
-+	fprintf(stderr, "Usage: ... cake [ bandwidth RATE | unlimited* | autorate_ingress ]\n"
-+	                "                [ rtt TIME | datacentre | lan | metro | regional | internet* | oceanic | satellite | interplanetary ]\n"
-+	                "                [ besteffort | precedence | diffserv8 | diffserv4 | diffserv-llt | diffserv3* ]\n"
-+	                "                [ flowblind | srchost | dsthost | hosts | flows | dual-srchost | dual-dsthost | triple-isolate* ] [ nat | nonat* ]\n"
-+	                "                [ ptm | atm | noatm* ] [ overhead N | conservative | raw* ]\n"
-+	                "                [ wash | nowash* ]\n"
-+	                "                [ memlimit LIMIT ]\n"
-+	                "    (* marks defaults)\n");
++	fprintf(stderr,
++"Usage: ... cake [ bandwidth RATE | unlimited* | autorate_ingress ]\n"
++"                [ rtt TIME | datacentre | lan | metro | regional |\n"
++"                  internet* | oceanic | satellite | interplanetary ]\n"
++"                [ besteffort | diffserv8 | diffserv4 | diffserv-llt |\n"
++"                  diffserv3* ]\n"
++"                [ flowblind | srchost | dsthost | hosts | flows |\n"
++"                  dual-srchost | dual-dsthost | triple-isolate* ]\n"
++"                [ nat | nonat* ]\n"
++"                [ wash | nowash * ]\n"
++"                [ memlimit LIMIT ]\n"
++"                [ ptm | atm | noatm* ] [ overhead N | conservative | raw* ]\n"
++"                [ mpu N ]\n"
++"                (* marks defaults)\n");
 +}
 +
 +static int cake_parse_opt(struct qdisc_util *qu, int argc, char **argv,
@@ -149,6 +163,7 @@
 +	bool overhead_set = false;
 +	bool overhead_override = false;
 +	int wash = -1;
++	int mpu = 0;
 +	int flowmode = -1;
 +	int nat = -1;
 +	int atm = -1;
@@ -332,6 +347,7 @@
 +			 * you may need to add vlan tag */
 +			overhead += 38;
 +			overhead_set = true;
++			mpu = 84;
 +
 +		/* Additional Ethernet-related overhead used by some ISPs */
 +		} else if (strcmp(*argv, "ether-vlan") == 0) {
@@ -347,6 +363,7 @@
 +			atm = 0;
 +			overhead += 18;
 +			overhead_set = true;
++			mpu = 64;
 +
 +		} else if (strcmp(*argv, "overhead") == 0) {
 +			char* p = NULL;
@@ -358,6 +375,15 @@
 +			}
 +			overhead_set = true;
 +
++		} else if (strcmp(*argv, "mpu") == 0) {
++			char* p = NULL;
++			NEXT_ARG();
++			mpu = strtol(*argv, &p, 10);
++			if(!p || *p || !*argv || mpu < 0 || mpu > 256) {
++				fprintf(stderr, "Illegal \"mpu\", valid range is 0 to 256\\n");
++				return -1;
++			}
++
 +		} else if (strcmp(*argv, "memlimit") == 0) {
 +			NEXT_ARG();
 +			if(get_size(&memlimit, *argv)) {
@@ -392,6 +418,8 @@
 +		unsigned zero = 0;
 +		addattr_l(n, 1024, TCA_CAKE_ETHERNET, &zero, sizeof(zero));
 +	}
++	if (mpu > 0)
++		addattr_l(n, 1024, TCA_CAKE_MPU, &mpu, sizeof(mpu));
 +	if (interval)
 +		addattr_l(n, 1024, TCA_CAKE_RTT, &interval, sizeof(interval));
 +	if (target)
@@ -420,6 +448,7 @@
 +	unsigned memlimit = 0;
 +	int overhead = 0;
 +	int ethernet = 0;
++	int mpu = 0;
 +	int atm = 0;
 +	int nat = 0;
 +	int autorate = 0;
@@ -525,6 +554,10 @@
 +	    RTA_PAYLOAD(tb[TCA_CAKE_OVERHEAD]) >= sizeof(__u32)) {
 +		overhead = rta_getattr_u32(tb[TCA_CAKE_OVERHEAD]);
 +	}
++	if (tb[TCA_CAKE_MPU] &&
++	    RTA_PAYLOAD(tb[TCA_CAKE_MPU]) >= sizeof(__u32)) {
++		mpu = rta_getattr_u32(tb[TCA_CAKE_MPU]);
++	}
 +	if (tb[TCA_CAKE_ETHERNET] &&
 +	    RTA_PAYLOAD(tb[TCA_CAKE_ETHERNET]) >= sizeof(__u32)) {
 +		ethernet = rta_getattr_u32(tb[TCA_CAKE_ETHERNET]);
@@ -558,6 +591,10 @@
 +			fprintf(f, "via-ethernet ");
 +	}
 +
++	if (mpu) {
++		fprintf(f, "mpu %d ", mpu);
++	}
++
 +	if (memlimit)
 +		fprintf(f, "memlimit %s", sprint_size(memlimit, b1));
 +

package/network/utils/tcpdump/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=tcpdump
-PKG_VERSION:=4.8.1
+PKG_VERSION:=4.9.0
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://www.tcpdump.org/release/ \
 	http://www.at.tcpdump.org/
-PKG_HASH:=20e4341ec48fcf72abcae312ea913e6ba6b958617b2f3fb496d51f0ae88d831c
+PKG_HASH:=eae98121cbb1c9adbedd9a777bf2eae9fa1c1c676424a54740311c8abcee5a5e
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
 PKG_BUILD_PARALLEL:=1

package/network/utils/tcpdump/patches/001-remove_pcap_debug.patch

@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -6260,97 +6260,6 @@ $as_echo "no" >&6; }
+@@ -6259,97 +6259,6 @@ $as_echo "no" >&6; }
      fi
  fi
  

package/network/utils/tcpdump/patches/002-remove_static_libpcap_check.patch

@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -5472,37 +5472,6 @@ $as_echo "Using $pfopen" >&6; }
+@@ -5471,37 +5471,6 @@ $as_echo "Using $pfopen" >&6; }
  		    LIBS="$LIBS $pfopen"
  	    fi
      fi
@@ -38,7 +38,7 @@
  
  	    #
  	    # Look for pcap-config.
-@@ -5658,51 +5627,6 @@ if test "x$ac_cv_lib_pcap_main" = xyes;
+@@ -5657,51 +5626,6 @@ if test "x$ac_cv_lib_pcap_main" = xyes;
    libpcap="-lpcap"
  fi
  

package/network/utils/tcpdump/patches/100-tcpdump_mini.patch

@@ -8,7 +8,7 @@
 +
 +CSRC=\
 +	tcpdump.c \
-+	util.c \
++	netdissect.c \
 +	setsignal.c \
 +	addrtoname.c \
 +	addrtostr.c \
@@ -80,10 +80,10 @@
 +
 +else
 +
- CSRC =	setsignal.c tcpdump.c util.c
+ CSRC =	setsignal.c tcpdump.c
  
  LIBNETDISSECT_SRC=\
-@@ -236,12 +312,16 @@ LIBNETDISSECT_SRC=\
+@@ -237,12 +313,16 @@ LIBNETDISSECT_SRC=\
  	strtoaddr.c \
  	util-print.c
  
@@ -100,7 +100,7 @@
  
  
  SRC =	$(CSRC) $(GENSRC) $(LOCALSRC) $(LIBNETDISSECT_SRC)
-@@ -367,10 +447,12 @@ $(PROG): $(OBJ) @V_PCAPDEP@
+@@ -373,10 +453,12 @@ $(PROG): $(OBJ) @V_PCAPDEP@
  	@rm -f $@
  	$(CC) $(FULL_CFLAGS) $(LDFLAGS) -o $@ $(OBJ) $(LIBS)
  
@@ -115,7 +115,7 @@
  	$(CC) $(FULL_CFLAGS) -o $@ -c $(srcdir)/missing/datalinks.c
 --- a/addrtoname.c
 +++ b/addrtoname.c
-@@ -564,8 +564,10 @@ linkaddr_string(netdissect_options *ndo,
+@@ -566,8 +566,10 @@ linkaddr_string(netdissect_options *ndo,
  	if (type == LINKADDR_ETHER && len == ETHER_ADDR_LEN)
  		return (etheraddr_string(ndo, ep));
  
@@ -126,7 +126,7 @@
  
  	tp = lookup_bytestring(ndo, ep, len);
  	if (tp->e_name)
-@@ -1200,6 +1202,7 @@ init_addrtoname(netdissect_options *ndo,
+@@ -1202,6 +1204,7 @@ init_addrtoname(netdissect_options *ndo,
  	init_ipxsaparray(ndo);
  }
  
@@ -134,7 +134,7 @@
  const char *
  dnaddr_string(netdissect_options *ndo, u_short dnaddr)
  {
-@@ -1219,6 +1222,7 @@ dnaddr_string(netdissect_options *ndo, u
+@@ -1221,6 +1224,7 @@ dnaddr_string(netdissect_options *ndo, u
  
  	return(tp->name);
  }
@@ -237,7 +237,7 @@
  
 --- a/print-ether.c
 +++ b/print-ether.c
-@@ -332,6 +332,7 @@ ethertype_print(netdissect_options *ndo,
+@@ -342,6 +342,7 @@ ethertype_print(netdissect_options *ndo,
  	        arp_print(ndo, p, length, caplen);
  		return (1);
  
@@ -245,27 +245,27 @@
  	case ETHERTYPE_DN:
  		decnet_print(ndo, p, length, caplen);
  		return (1);
-@@ -354,6 +355,7 @@ ethertype_print(netdissect_options *ndo,
- 	case ETHERTYPE_ISO:
- 		isoclns_print(ndo, p + 1, length - 1, length - 1);
+@@ -368,6 +369,7 @@ ethertype_print(netdissect_options *ndo,
+ 		}
+ 		isoclns_print(ndo, p + 1, length - 1, caplen - 1);
  		return(1);
 +#endif
  
  	case ETHERTYPE_PPPOED:
  	case ETHERTYPE_PPPOES:
-@@ -366,9 +368,11 @@ ethertype_print(netdissect_options *ndo,
+@@ -380,9 +382,11 @@ ethertype_print(netdissect_options *ndo,
  	        eap_print(ndo, p, length);
  		return (1);
  
 +#ifndef TCPDUMP_MINI
  	case ETHERTYPE_RRCP:
- 	        rrcp_print(ndo, p - 14 , length + 14);
+ 	        rrcp_print(ndo, p, length, src, dst);
  		return (1);
 +#endif
  
  	case ETHERTYPE_PPP:
  		if (length) {
-@@ -377,6 +381,7 @@ ethertype_print(netdissect_options *ndo,
+@@ -391,6 +395,7 @@ ethertype_print(netdissect_options *ndo,
  		}
  		return (1);
  
@@ -273,7 +273,7 @@
  	case ETHERTYPE_MPCP:
  	        mpcp_print(ndo, p, length);
  		return (1);
-@@ -389,6 +394,7 @@ ethertype_print(netdissect_options *ndo,
+@@ -403,6 +408,7 @@ ethertype_print(netdissect_options *ndo,
  	case ETHERTYPE_CFM_OLD:
  		cfm_print(ndo, p, length);
  		return (1);
@@ -281,7 +281,7 @@
  
  	case ETHERTYPE_LLDP:
  		lldp_print(ndo, p, length);
-@@ -398,6 +404,7 @@ ethertype_print(netdissect_options *ndo,
+@@ -412,6 +418,7 @@ ethertype_print(netdissect_options *ndo,
  		loopback_print(ndo, p, length);
                  return (1);
  
@@ -289,9 +289,9 @@
  	case ETHERTYPE_MPLS:
  	case ETHERTYPE_MPLS_MULTI:
  		mpls_print(ndo, p, length);
-@@ -427,6 +434,7 @@ ethertype_print(netdissect_options *ndo,
+@@ -441,6 +448,7 @@ ethertype_print(netdissect_options *ndo,
  	case ETHERTYPE_MEDSA:
- 		medsa_print(ndo, p, length, caplen);
+ 		medsa_print(ndo, p, length, caplen, src, dst);
  		return (1);
 +#endif
  
@@ -299,7 +299,7 @@
  	case ETHERTYPE_SCA:
 --- a/print-gre.c
 +++ b/print-gre.c
-@@ -203,6 +203,7 @@ gre_print_0(netdissect_options *ndo, con
+@@ -216,6 +216,7 @@ gre_print_0(netdissect_options *ndo, con
  	case ETHERTYPE_IPV6:
  		ip6_print(ndo, bp, len);
  		break;
@@ -307,9 +307,9 @@
  	case ETHERTYPE_MPLS:
  		mpls_print(ndo, bp, len);
  		break;
-@@ -218,6 +219,7 @@ gre_print_0(netdissect_options *ndo, con
+@@ -231,6 +232,7 @@ gre_print_0(netdissect_options *ndo, con
  	case ETHERTYPE_TEB:
- 		ether_print(ndo, bp, len, len, NULL, NULL);
+ 		ether_print(ndo, bp, len, ndo->ndo_snapend - bp, NULL, NULL);
  		break;
 +#endif
  	default:
@@ -317,7 +317,7 @@
  	}
 --- a/print-igmp.c
 +++ b/print-igmp.c
-@@ -304,6 +304,7 @@ igmp_print(netdissect_options *ndo,
+@@ -306,6 +306,7 @@ igmp_print(netdissect_options *ndo,
          ND_TCHECK2(bp[4], 4);
          ND_PRINT((ndo, "igmp leave %s", ipaddr_string(ndo, &bp[4])));
          break;
@@ -325,7 +325,7 @@
      case 0x13:
          ND_PRINT((ndo, "igmp dvmrp"));
          if (len < 8)
-@@ -315,6 +316,7 @@ igmp_print(netdissect_options *ndo,
+@@ -317,6 +318,7 @@ igmp_print(netdissect_options *ndo,
          ND_PRINT((ndo, "igmp pimv1"));
          pimv1_print(ndo, bp, len);
          break;
@@ -335,15 +335,15 @@
          break;
 --- a/print-ip6.c
 +++ b/print-ip6.c
-@@ -297,6 +297,7 @@ ip6_print(netdissect_options *ndo, const
- 			advance = dstopt_print(ndo, cp);
+@@ -303,6 +303,7 @@ ip6_print(netdissect_options *ndo, const
+ 				return;
  			nh = *cp;
  			break;
 +#ifndef TCPDUMP_MINI
  		case IPPROTO_FRAGMENT:
  			advance = frag6_print(ndo, cp, (const u_char *)ip6);
- 			if (ndo->ndo_snapend <= cp + advance)
-@@ -318,16 +319,19 @@ ip6_print(netdissect_options *ndo, const
+ 			if (advance < 0 || ndo->ndo_snapend <= cp + advance)
+@@ -324,16 +325,19 @@ ip6_print(netdissect_options *ndo, const
  			advance = mobility_print(ndo, cp, (const u_char *)ip6);
  			nh = *cp;
  			return;
@@ -363,7 +363,7 @@
  		case IPPROTO_TCP:
  			tcp_print(ndo, cp, len, (const u_char *)ip6, fragmented);
  			return;
-@@ -337,6 +341,7 @@ ip6_print(netdissect_options *ndo, const
+@@ -343,6 +347,7 @@ ip6_print(netdissect_options *ndo, const
  		case IPPROTO_ICMPV6:
  			icmp6_print(ndo, cp, len, (const u_char *)ip6, fragmented);
  			return;
@@ -371,7 +371,7 @@
  		case IPPROTO_AH:
  			advance = ah_print(ndo, cp);
  			nh = *cp;
-@@ -360,6 +365,7 @@ ip6_print(netdissect_options *ndo, const
+@@ -371,6 +376,7 @@ ip6_print(netdissect_options *ndo, const
  		case IPPROTO_PIM:
  			pim_print(ndo, cp, len, (const u_char *)ip6);
  			return;
@@ -379,7 +379,7 @@
  
  		case IPPROTO_OSPF:
  			ospf6_print(ndo, cp, len);
-@@ -373,9 +379,11 @@ ip6_print(netdissect_options *ndo, const
+@@ -384,9 +390,11 @@ ip6_print(netdissect_options *ndo, const
  		        ip_print(ndo, cp, len);
  			return;
  
@@ -393,17 +393,17 @@
  			gre_print(ndo, cp, len);
 --- a/print-ip.c
 +++ b/print-ip.c
-@@ -327,6 +327,7 @@ ip_print_demux(netdissect_options *ndo,
+@@ -329,6 +329,7 @@ ip_print_demux(netdissect_options *ndo,
  again:
  	switch (ipds->nh) {
  
 +#ifndef TCPDUMP_MINI
  	case IPPROTO_AH:
- 		ipds->nh = *ipds->cp;
- 		ipds->advance = ah_print(ndo, ipds->cp);
-@@ -361,7 +362,9 @@ again:
- 		ipds->nh = enh & 0xff;
- 		goto again;
+ 		if (!ND_TTEST(*ipds->cp)) {
+ 			ND_PRINT((ndo, "[|AH]"));
+@@ -367,7 +368,9 @@ again:
+ 		 */
+ 		break;
  	}
 +#endif
  
@@ -411,7 +411,7 @@
  	case IPPROTO_SCTP:
  		sctp_print(ndo, ipds->cp, (const u_char *)ipds->ip, ipds->len);
  		break;
-@@ -369,6 +372,7 @@ again:
+@@ -375,6 +378,7 @@ again:
  	case IPPROTO_DCCP:
  		dccp_print(ndo, ipds->cp, (const u_char *)ipds->ip, ipds->len);
  		break;
@@ -419,7 +419,7 @@
  
  	case IPPROTO_TCP:
  		/* pass on the MF bit plus the offset to detect fragments */
-@@ -388,6 +392,7 @@ again:
+@@ -394,6 +398,7 @@ again:
  			   ipds->off & (IP_MF|IP_OFFMASK));
  		break;
  
@@ -427,7 +427,7 @@
  	case IPPROTO_PIGP:
  		/*
  		 * XXX - the current IANA protocol number assignments
-@@ -408,14 +413,17 @@ again:
+@@ -414,14 +419,17 @@ again:
  	case IPPROTO_EIGRP:
  		eigrp_print(ndo, ipds->cp, ipds->len);
  		break;
@@ -445,7 +445,7 @@
  
  	case IPPROTO_OSPF:
  		ospf_print(ndo, ipds->cp, ipds->len, (const u_char *)ipds->ip);
-@@ -448,6 +456,7 @@ again:
+@@ -454,6 +462,7 @@ again:
  		gre_print(ndo, ipds->cp, ipds->len);
  		break;
  
@@ -453,7 +453,7 @@
  	case IPPROTO_MOBILE:
  		mobile_print(ndo, ipds->cp, ipds->len);
  		break;
-@@ -476,6 +485,7 @@ again:
+@@ -482,6 +491,7 @@ again:
  	case IPPROTO_PGM:
  		pgm_print(ndo, ipds->cp, ipds->len, (const u_char *)ipds->ip);
  		break;
@@ -463,7 +463,7 @@
  		if (ndo->ndo_nflag==0 && (proto = getprotobynumber(ipds->nh)) != NULL)
 --- a/print-llc.c
 +++ b/print-llc.c
-@@ -204,6 +204,7 @@ llc_print(netdissect_options *ndo, const
+@@ -206,6 +206,7 @@ llc_print(netdissect_options *ndo, const
  		hdrlen = 4;	/* DSAP, SSAP, 2-byte control field */
  	}
  
@@ -471,7 +471,7 @@
  	if (ssap_field == LLCSAP_GLOBAL && dsap_field == LLCSAP_GLOBAL) {
  		/*
  		 * This is an Ethernet_802.3 IPX frame; it has an
-@@ -226,6 +227,7 @@ llc_print(netdissect_options *ndo, const
+@@ -228,6 +229,7 @@ llc_print(netdissect_options *ndo, const
              ipx_print(ndo, p, length);
              return (0);		/* no LLC header */
  	}
@@ -479,7 +479,7 @@
  
  	dsap = dsap_field & ~LLC_IG;
  	ssap = ssap_field & ~LLC_GSAP;
-@@ -289,6 +291,7 @@ llc_print(netdissect_options *ndo, const
+@@ -291,6 +293,7 @@ llc_print(netdissect_options *ndo, const
  		return (hdrlen);
  	}
  
@@ -487,7 +487,7 @@
  	if (ssap == LLCSAP_IPX && dsap == LLCSAP_IPX &&
  	    control == LLC_UI) {
  		/*
-@@ -302,6 +305,7 @@ llc_print(netdissect_options *ndo, const
+@@ -304,6 +307,7 @@ llc_print(netdissect_options *ndo, const
  		ipx_print(ndo, p, length);
  		return (hdrlen);
  	}
@@ -495,7 +495,7 @@
  
  #ifdef ENABLE_SMB
  	if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI
-@@ -320,11 +324,13 @@ llc_print(netdissect_options *ndo, const
+@@ -322,11 +326,13 @@ llc_print(netdissect_options *ndo, const
  		return (hdrlen);
  	}
  #endif
@@ -509,7 +509,7 @@
  
  	if (!ndo->ndo_eflag) {
  		if (ssap == dsap) {
-@@ -458,6 +464,7 @@ snap_print(netdissect_options *ndo, cons
+@@ -480,6 +486,7 @@ snap_print(netdissect_options *ndo, cons
  
  	case OUI_CISCO:
                  switch (et) {
@@ -517,7 +517,7 @@
                  case PID_CISCO_CDP:
                          cdp_print(ndo, p, length, caplen);
                          return (1);
-@@ -470,6 +477,7 @@ snap_print(netdissect_options *ndo, cons
+@@ -492,6 +499,7 @@ snap_print(netdissect_options *ndo, cons
                  case PID_CISCO_VTP:
                          vtp_print(ndo, p, length);
                          return (1);
@@ -525,7 +525,7 @@
                  case PID_CISCO_PVST:
                  case PID_CISCO_VLANBRIDGE:
                          stp_print(ndo, p, length);
-@@ -482,6 +490,7 @@ snap_print(netdissect_options *ndo, cons
+@@ -504,6 +512,7 @@ snap_print(netdissect_options *ndo, cons
  	case OUI_RFC2684:
  		switch (et) {
  
@@ -533,7 +533,7 @@
  		case PID_RFC2684_ETH_FCS:
  		case PID_RFC2684_ETH_NOFCS:
  			/*
-@@ -543,6 +552,7 @@ snap_print(netdissect_options *ndo, cons
+@@ -565,6 +574,7 @@ snap_print(netdissect_options *ndo, cons
  			 */
  			fddi_print(ndo, p, length, caplen);
  			return (1);
@@ -543,7 +543,7 @@
  			stp_print(ndo, p, length);
 --- a/print-null.c
 +++ b/print-null.c
-@@ -114,6 +114,7 @@ null_if_print(netdissect_options *ndo, c
+@@ -116,6 +116,7 @@ null_if_print(netdissect_options *ndo, c
  		ip6_print(ndo, p, length);
  		break;
  
@@ -551,7 +551,7 @@
  	case BSD_AFNUM_ISO:
  		isoclns_print(ndo, p, length, caplen);
  		break;
-@@ -125,6 +126,7 @@ null_if_print(netdissect_options *ndo, c
+@@ -127,6 +128,7 @@ null_if_print(netdissect_options *ndo, c
  	case BSD_AFNUM_IPX:
  		ipx_print(ndo, p, length);
  		break;
@@ -561,7 +561,7 @@
  		/* unknown AF_ value */
 --- a/print-ppp.c
 +++ b/print-ppp.c
-@@ -1346,6 +1346,7 @@ trunc:
+@@ -1358,6 +1358,7 @@ trunc:
  	return 0;
  }
  
@@ -569,7 +569,7 @@
  static void
  ppp_hdlc(netdissect_options *ndo,
           const u_char *p, int length)
-@@ -1424,6 +1425,7 @@ trunc:
+@@ -1436,6 +1437,7 @@ trunc:
  	free(b);
  	ND_PRINT((ndo, "[|ppp]"));
  }
@@ -577,7 +577,7 @@
  
  
  /* PPP */
-@@ -1431,10 +1433,12 @@ static void
+@@ -1443,10 +1445,12 @@ static void
  handle_ppp(netdissect_options *ndo,
             u_int proto, const u_char *p, int length)
  {
@@ -590,7 +590,7 @@
  
  	switch (proto) {
  	case PPP_LCP: /* fall through */
-@@ -1467,6 +1471,7 @@ handle_ppp(netdissect_options *ndo,
+@@ -1479,6 +1483,7 @@ handle_ppp(netdissect_options *ndo,
  	case PPP_IPV6:
  		ip6_print(ndo, p, length);
  		break;
@@ -598,7 +598,7 @@
  	case ETHERTYPE_IPX:	/*XXX*/
  	case PPP_IPX:
  		ipx_print(ndo, p, length);
-@@ -1478,6 +1483,7 @@ handle_ppp(netdissect_options *ndo,
+@@ -1490,6 +1495,7 @@ handle_ppp(netdissect_options *ndo,
  	case PPP_MPLS_MCAST:
  		mpls_print(ndo, p, length);
  		break;
@@ -606,7 +606,7 @@
  	case PPP_COMP:
  		ND_PRINT((ndo, "compressed PPP data"));
  		break;
-@@ -1618,6 +1624,7 @@ ppp_if_print(netdissect_options *ndo,
+@@ -1630,6 +1636,7 @@ ppp_if_print(netdissect_options *ndo,
  	return (0);
  }
  
@@ -614,7 +614,7 @@
  /*
   * PPP I/F printer to use if we know that RFC 1662-style PPP in HDLC-like
   * framing, or Cisco PPP with HDLC framing as per section 4.3.1 of RFC 1547,
-@@ -1840,6 +1847,7 @@ printx:
+@@ -1857,6 +1864,7 @@ printx:
  #endif /* __bsdi__ */
  	return (hdrlength);
  }
@@ -624,7 +624,7 @@
  /*
 --- a/print-sll.c
 +++ b/print-sll.c
-@@ -236,12 +236,14 @@ recurse:
+@@ -238,12 +238,14 @@ recurse:
  		 */
  		switch (ether_type) {
  
@@ -641,7 +641,7 @@
  			/*
 --- a/print-tcp.c
 +++ b/print-tcp.c
-@@ -565,12 +565,14 @@ tcp_print(netdissect_options *ndo,
+@@ -589,12 +589,14 @@ tcp_print(netdissect_options *ndo,
                                  ND_PRINT((ndo, " %u", utoval));
                                  break;
  
@@ -656,7 +656,7 @@
  
                          case TCPOPT_FASTOPEN:
                                  datalen = len - 2;
-@@ -645,6 +647,7 @@ tcp_print(netdissect_options *ndo,
+@@ -670,6 +672,7 @@ tcp_print(netdissect_options *ndo,
                  return;
          }
  
@@ -664,7 +664,7 @@
          if (ndo->ndo_packettype) {
                  switch (ndo->ndo_packettype) {
                  case PT_ZMTP1:
-@@ -656,28 +659,36 @@ tcp_print(netdissect_options *ndo,
+@@ -681,28 +684,36 @@ tcp_print(netdissect_options *ndo,
                  }
                  return;
          }
@@ -702,7 +702,7 @@
          else if (IS_SRC_OR_DST_PORT(FTP_PORT)) {
                  ND_PRINT((ndo, ": "));
                  ftp_print(ndo, bp, length);
-@@ -694,6 +705,7 @@ tcp_print(netdissect_options *ndo,
+@@ -719,6 +730,7 @@ tcp_print(netdissect_options *ndo,
                   * XXX packet could be unaligned, it can go strange
                   */
                  ns_print(ndo, bp + 2, length - 2, 0);
@@ -710,7 +710,7 @@
          } else if (IS_SRC_OR_DST_PORT(MSDP_PORT)) {
                  msdp_print(ndo, bp, length);
          } else if (IS_SRC_OR_DST_PORT(RPKI_RTR_PORT)) {
-@@ -701,6 +713,7 @@ tcp_print(netdissect_options *ndo,
+@@ -726,6 +738,7 @@ tcp_print(netdissect_options *ndo,
          }
          else if (length > 0 && (IS_SRC_OR_DST_PORT(LDP_PORT))) {
                  ldp_print(ndo, bp, length);
@@ -720,7 +720,7 @@
                   length >= 4 && ND_TTEST2(*bp, 4)) {
 --- a/print-udp.c
 +++ b/print-udp.c
-@@ -397,10 +397,12 @@ udp_print(netdissect_options *ndo, regis
+@@ -430,10 +430,12 @@ udp_print(netdissect_options *ndo, regis
  			vat_print(ndo, (const void *)(up + 1), up);
  			break;
  
@@ -733,7 +733,7 @@
  
  		case PT_RPC:
  			rp = (const struct sunrpc_msg *)(up + 1);
-@@ -429,10 +431,12 @@ udp_print(netdissect_options *ndo, regis
+@@ -462,10 +464,12 @@ udp_print(netdissect_options *ndo, regis
  			snmp_print(ndo, (const u_char *)(up + 1), length);
  			break;
  
@@ -746,7 +746,7 @@
  
  		case PT_TFTP:
  			udpipaddr_print(ndo, ip, sport, dport);
-@@ -450,6 +454,7 @@ udp_print(netdissect_options *ndo, regis
+@@ -483,6 +487,7 @@ udp_print(netdissect_options *ndo, regis
  			radius_print(ndo, cp, length);
  			break;
  
@@ -754,7 +754,7 @@
  		case PT_VXLAN:
  			udpipaddr_print(ndo, ip, sport, dport);
  			vxlan_print(ndo, (const u_char *)(up + 1), length);
-@@ -464,6 +469,7 @@ udp_print(netdissect_options *ndo, regis
+@@ -497,6 +502,7 @@ udp_print(netdissect_options *ndo, regis
  			udpipaddr_print(ndo, ip, sport, dport);
  			lmp_print(ndo, cp, length);
  			break;
@@ -762,7 +762,7 @@
  		}
  		return;
  	}
-@@ -541,31 +547,40 @@ udp_print(netdissect_options *ndo, regis
+@@ -574,31 +580,40 @@ udp_print(netdissect_options *ndo, regis
  			ns_print(ndo, (const u_char *)(up + 1), length, 0);
  		else if (IS_SRC_OR_DST_PORT(MULTICASTDNS_PORT))
  			ns_print(ndo, (const u_char *)(up + 1), length, 1);
@@ -803,7 +803,7 @@
  		else if (IS_SRC_OR_DST_PORT(L2TP_PORT))
  			l2tp_print(ndo, (const u_char *)(up + 1), length);
  #ifdef ENABLE_SMB
-@@ -576,6 +591,7 @@ udp_print(netdissect_options *ndo, regis
+@@ -609,6 +624,7 @@ udp_print(netdissect_options *ndo, regis
  #endif
  		else if (dport == VAT_PORT)
  			vat_print(ndo, (const void *)(up + 1), up);
@@ -811,7 +811,7 @@
  		else if (IS_SRC_OR_DST_PORT(ZEPHYR_SRV_PORT) || IS_SRC_OR_DST_PORT(ZEPHYR_CLT_PORT))
  			zephyr_print(ndo, (const void *)(up + 1), length);
  		/*
-@@ -588,8 +604,11 @@ udp_print(netdissect_options *ndo, regis
+@@ -621,8 +637,11 @@ udp_print(netdissect_options *ndo, regis
  				 (const u_char *) ip);
  		else if (IS_SRC_OR_DST_PORT(RIPNG_PORT))
  			ripng_print(ndo, (const u_char *)(up + 1), length);
@@ -823,7 +823,7 @@
  		else if (IS_SRC_OR_DST_PORT(AHCP_PORT))
  			ahcp_print(ndo, (const u_char *)(up + 1), length);
  		else if (IS_SRC_OR_DST_PORT(BABEL_PORT) || IS_SRC_OR_DST_PORT(BABEL_PORT_OLD))
-@@ -603,6 +622,7 @@ udp_print(netdissect_options *ndo, regis
+@@ -636,6 +655,7 @@ udp_print(netdissect_options *ndo, regis
  			wb_print(ndo, (const void *)(up + 1), length);
  		else if (IS_SRC_OR_DST_PORT(CISCO_AUTORP_PORT))
  			cisco_autorp_print(ndo, (const void *)(up + 1), length);
@@ -831,7 +831,7 @@
  		else if (IS_SRC_OR_DST_PORT(RADIUS_PORT) ||
  			 IS_SRC_OR_DST_PORT(RADIUS_NEW_PORT) ||
  			 IS_SRC_OR_DST_PORT(RADIUS_ACCOUNTING_PORT) ||
-@@ -610,15 +630,18 @@ udp_print(netdissect_options *ndo, regis
+@@ -643,15 +663,18 @@ udp_print(netdissect_options *ndo, regis
  			 IS_SRC_OR_DST_PORT(RADIUS_CISCO_COA_PORT) ||
  			 IS_SRC_OR_DST_PORT(RADIUS_COA_PORT) )
  			radius_print(ndo, (const u_char *)(up+1), length);
@@ -850,7 +850,7 @@
  		else if (IS_SRC_OR_DST_PORT(MPLS_LSP_PING_PORT))
  			lspping_print(ndo, (const u_char *)(up + 1), length);
  		else if (dport == BFD_CONTROL_PORT ||
-@@ -636,10 +659,12 @@ udp_print(netdissect_options *ndo, regis
+@@ -669,10 +692,12 @@ udp_print(netdissect_options *ndo, regis
                          lwapp_control_print(ndo, (const u_char *)(up + 1), length, 0);
                  else if (IS_SRC_OR_DST_PORT(LWAPP_DATA_PORT))
                          lwapp_data_print(ndo, (const u_char *)(up + 1), length);
@@ -863,7 +863,7 @@
                  else if (IS_SRC_OR_DST_PORT(OTV_PORT))
  			otv_print(ndo, (const u_char *)(up + 1), length);
                  else if (IS_SRC_OR_DST_PORT(VXLAN_PORT))
-@@ -656,7 +681,9 @@ udp_print(netdissect_options *ndo, regis
+@@ -689,7 +714,9 @@ udp_print(netdissect_options *ndo, regis
  			if (ndo->ndo_vflag)
  				ND_PRINT((ndo, "kip "));
  			llap_print(ndo, cp, length);

package/system/opkg/Makefile

@@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/version.mk
 include $(INCLUDE_DIR)/feeds.mk
 
 PKG_NAME:=opkg
-PKG_RELEASE:=16
+PKG_RELEASE:=17
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=http://git.yoctoproject.org/git/opkg

package/system/opkg/patches/290-clarify-download-errors.patch

@@ -0,0 +1,61 @@
+--- a/libopkg/opkg_cmd.c
++++ b/libopkg/opkg_cmd.c
+@@ -85,6 +85,7 @@ opkg_update_cmd(int argc, char **argv)
+      char *tmp;
+      int err;
+      int failures;
++     int pkglist_dl_error;
+      char *lists_dir;
+      pkg_src_list_elt_t *iter;
+      pkg_src_t *src;
+@@ -130,15 +131,19 @@ opkg_update_cmd(int argc, char **argv)
+ 	      sprintf_alloc(&url, "%s/%s", src->value, src->gzip ? "Packages.gz" : "Packages");
+ 
+ 	  sprintf_alloc(&list_file_name, "%s/%s", lists_dir, src->name);
++	  pkglist_dl_error = 0;
+ 	  if (opkg_download(url, list_file_name, NULL, NULL, 0)) {
+ 	       failures++;
++	       pkglist_dl_error = 1;
++	       opkg_msg(NOTICE, "*** Failed to download the package list from %s\n\n",
++			    url);
+ 	  } else {
+-	       opkg_msg(NOTICE, "Updated list of available packages in %s.\n",
++	       opkg_msg(NOTICE, "Updated list of available packages in %s\n",
+ 			    list_file_name);
+ 	  }
+ 	  free(url);
+ #if defined(HAVE_GPGME) || defined(HAVE_OPENSSL) || defined(HAVE_USIGN)
+-          if (conf->check_signature) {
++          if (pkglist_dl_error == 0 && conf->check_signature) {
+               /* download detached signitures to verify the package lists */
+               /* get the url for the sig file */
+               if (src->extra_data)	/* debian style? */
+@@ -156,7 +161,7 @@ opkg_update_cmd(int argc, char **argv)
+               err = opkg_download(url, tmp_file_name, NULL, NULL, 0);
+               if (err) {
+                   failures++;
+-                  opkg_msg(NOTICE, "Signature check failed.\n");
++                  opkg_msg(NOTICE, "Signature file download failed.\n");
+               } else {
+                   err = opkg_verify_file (list_file_name, tmp_file_name);
+                   if (err == 0)
+--- a/libopkg/opkg_download.c
++++ b/libopkg/opkg_download.c
+@@ -91,7 +91,7 @@ opkg_download(const char *src, const cha
+     char *src_base = basename(src_basec);
+     char *tmp_file_location;
+ 
+-    opkg_msg(NOTICE,"Downloading %s.\n", src);
++    opkg_msg(NOTICE,"Downloading %s\n", src);
+ 
+     if (str_starts_with(src, "file:")) {
+ 	const char *file_src = src + 5;
+@@ -175,6 +175,8 @@ opkg_download(const char *src, const cha
+ 
+       if (res) {
+ 	opkg_msg(ERROR, "Failed to download %s, wget returned %d.\n", src, res);
++	if (res == 4)
++	    opkg_msg(ERROR, "Check your network settings and connectivity.\n\n");
+ 	free(tmp_file_location);
+ 	return -1;
+       }

package/system/procd/files/procd.sh

@@ -213,9 +213,12 @@ _procd_set_param() {
 			json_add_string "" "$@"
 			json_close_array
 		;;
-		nice|reload_signal)
+		nice)
 			json_add_int "$type" "$1"
 		;;
+		reload_signal)
+			json_add_int "$type" $(kill -l "$1")
+		;;
 		pidfile|user|seccomp|capabilities)
 			json_add_string "$type" "$1"
 		;;

package/system/ubus/Makefile

@@ -5,9 +5,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(LEDE_GIT)/project/ubus.git
-PKG_SOURCE_DATE:=2016-10-12
-PKG_SOURCE_VERSION:=312448a5b147c221836827a7a641e76a4514db44
-PKG_MIRROR_HASH:=adeeae238deaac2b6af77c2e4473febdcbc0f1c256734b2ff019c76b2f3f2aa6
+PKG_SOURCE_DATE:=2017-01-22
+PKG_SOURCE_VERSION:=6f4e11e1db399074273944329883f9c35e7daef6
+PKG_MIRROR_HASH:=4b80cf4ff8fa0e103d6626014404c031a9e886b8fbc422fb65a9c36b3b787585
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=LGPL-2.1

scripts/download.pl

@@ -82,7 +82,7 @@ sub download_cmd($) {
 	}
 
 	return $have_curl
-		? (qw(curl --connect-timeout 20 --retry 5 --location --insecure), shellwords($ENV{CURL_OPTIONS} || ''), $url)
+		? (qw(curl -f --connect-timeout 20 --retry 5 --location --insecure), shellwords($ENV{CURL_OPTIONS} || ''), $url)
 		: (qw(wget --tries=5 --timeout=20 --no-check-certificate --output-document=-), shellwords($ENV{WGET_OPTIONS} || ''), $url)
 	;
 }

target/linux/ar71xx/base-files/etc/board.d/01_leds

@@ -201,6 +201,9 @@ rb-750)
 	ucidef_set_led_switch "port4" "port4" "rb750:green:port4" "switch0" "0x04"
 	ucidef_set_led_switch "port5" "port5" "rb750:green:port5" "switch0" "0x02"
 	;;
+rb-941-2nd)
+	ucidef_set_led_timer "act" "act" "rb:green:act" "1000" "1000"
+	;;
 rb-2011l|\
 rb-2011uas|\
 rb-2011uias|\

target/linux/ar71xx/base-files/etc/board.d/02_network

@@ -45,7 +45,6 @@ ar71xx_setup_interfaces()
 	tl-wr741nd|\
 	tl-wr741nd-v4|\
 	tl-wr841n-v11|\
-	tl-wr841n-v7|\
 	tl-wr841n-v9|\
 	tl-wr842n-v3|\
 	whr-g301n|\
@@ -84,6 +83,7 @@ ar71xx_setup_interfaces()
 	mr900v2|\
 	mynet-rext|\
 	rb-411|\
+	rb-411u|\
 	rb-911g-2hpnd|\
 	rb-911g-5hpacd|\
 	rb-911g-5hpnd|\
@@ -239,6 +239,10 @@ ar71xx_setup_interfaces()
 	dap-2695-a1)
 		ucidef_add_switch "switch0" "0@eth0" "2:lan" "3:wan" "6@eth1"
 		;;
+	rb-941-2nd)
+		ucidef_add_switch "switch0" \
+			"0@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:wan:1"
+	;;
 	db120|\
 	rb-2011l|\
 	rb-2011uas|\
@@ -272,7 +276,6 @@ ar71xx_setup_interfaces()
 	tl-wr941nd-v5|\
 	tl-wr941nd-v6|\
 	wnr1000-v2|\
-	wnr2000-v3|\
 	wnr2000-v4|\
 	wnr2200|\
 	wnr612-v2|\
@@ -322,7 +325,8 @@ ar71xx_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"2:lan" "3:lan" "4:lan" "5:lan" "6@eth1" "0@eth0" "1:wan"
 		;;
-	gl-ar300)
+	gl-ar300|\
+	wnr2000-v3)
 		ucidef_set_interfaces_lan_wan "eth1" "eth0"
 		ucidef_add_switch "switch0" \
 			"0@eth1" "1:lan" "2:lan" "3:lan" "4:lan"
@@ -392,6 +396,11 @@ ar71xx_setup_interfaces()
 		ucidef_set_interface_raw "eth" "eth0"
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
 		;;
+	tl-wr841n-v7)
+		ucidef_set_interfaces_lan_wan "eth0" "eth1"
+		ucidef_add_switch "switch0" \
+			"0@eth0" "1:lan:1" "2:lan:2" "3:lan:3" "4:lan:4"
+		;;
 	tl-wr842n-v2)
 		ucidef_set_interfaces_lan_wan "eth1" "eth0"
 		ucidef_add_switch "switch0" \
@@ -407,10 +416,13 @@ ar71xx_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "2:lan" "3:wan"
 		;;
-	wndr3700)
+	wndr3700|\
+	wndr3700v2|\
+	wndr3800|\
+	wndr3800ch)
 		ucidef_set_interfaces_lan_wan "eth0" "eth1"
 		ucidef_add_switch "switch0" \
-			"0:lan" "1:lan" "2:lan" "3:lan" "5@eth0"
+			"0:lan:4" "1:lan:3" "2:lan:2" "3:lan:1" "5@eth0"
 
 		ucidef_add_switch_attr "switch0" "blinkrate" 2
 		ucidef_add_switch_port_attr "switch0" 1 led 6

target/linux/ar71xx/base-files/etc/diag.sh

@@ -288,7 +288,7 @@ get_status_led() {
 	rb-912uag-5hpnd)
 		status_led="rb:green:user"
 		;;
-	rb-951ui-2hnd)
+	rb-951ui-2hnd | rb-941-2nd)
 		status_led="rb:green:act"
 		;;
 	rb-sxt2n|\

target/linux/ar71xx/base-files/lib/ar71xx.sh

@@ -835,6 +835,9 @@ ar71xx_board_detect() {
 	*"RouterBOARD 912UAG-5HPnD")
 		name="rb-912uag-5hpnd"
 		;;
+	*"RouterBOARD 941-2nD")
+		name="rb-941-2nd"
+		;;
 	*"RouterBOARD 951G-2HnD")
 		name="rb-951g-2hnd"
 		;;

target/linux/ar71xx/base-files/lib/upgrade/platform.sh

@@ -7,10 +7,13 @@
 
 PART_NAME=firmware
 RAMFS_COPY_DATA=/lib/ar71xx.sh
+[ -x /usr/sbin/nandwrite ] && RAMFS_COPY_BIN=/usr/sbin/nandwrite
 
 CI_BLKSZ=65536
 CI_LDADR=0x80060000
 
+PLATFORM_DO_UPGRADE_COMBINED_SEPARATE_MTD=0
+
 platform_find_partitions() {
 	local first dev size erasesize name
 	while read dev size erasesize name; do
@@ -40,6 +43,13 @@ platform_find_kernelpart() {
 	done
 }
 
+platform_find_rootfspart() {
+	local part
+	for part in "${1%:*}" "${1#*:}"; do
+		[ "$part" != "$2" ] && echo "$part"; break
+	done
+}
+
 platform_do_upgrade_combined() {
 	local partitions=$(platform_find_partitions)
 	local kernelpart=$(platform_find_kernelpart "${partitions#*:}")
@@ -53,13 +63,22 @@ platform_do_upgrade_combined() {
 	   [ ${root_blocks:-0} -gt 0 ] && \
 	   [ ${erase_size:-0} -gt 0 ];
 	then
+		local rootfspart=$(platform_find_rootfspart "$partitions" "$kernelpart")
 		local append=""
 		[ -f "$CONF_TAR" -a "$SAVE_CONFIG" -eq 1 ] && append="-j $CONF_TAR"
 
-		( dd if="$1" bs=$CI_BLKSZ skip=1 count=$kern_blocks 2>/dev/null; \
-		  dd if="$1" bs=$CI_BLKSZ skip=$((1+$kern_blocks)) count=$root_blocks 2>/dev/null ) | \
-			mtd -r $append -F$kernelpart:$kern_length:$CI_LDADR,rootfs write - $partitions
+		if [ "$PLATFORM_DO_UPGRADE_COMBINED_SEPARATE_MTD" -ne 1 ]; then
+		    ( dd if="$1" bs=$CI_BLKSZ skip=1 count=$kern_blocks 2>/dev/null; \
+		      dd if="$1" bs=$CI_BLKSZ skip=$((1+$kern_blocks)) count=$root_blocks 2>/dev/null ) | \
+			    mtd -r $append -F$kernelpart:$kern_length:$CI_LDADR,rootfs write - $partitions
+		elif [ -n "$rootfspart" ]; then
+		    dd if="$1" bs=$CI_BLKSZ skip=1 count=$kern_blocks 2>/dev/null | \
+			    mtd write - $kernelpart
+		    dd if="$1" bs=$CI_BLKSZ skip=$((1+$kern_blocks)) count=$root_blocks 2>/dev/null | \
+			    mtd -r $append write - $rootfspart
+		fi
 	fi
+	PLATFORM_DO_UPGRADE_COMBINED_SEPARATE_MTD=0
 }
 
 tplink_get_image_hwid() {
@@ -164,6 +183,15 @@ alfa_check_image() {
 	return 0
 }
 
+platform_nand_board_name() {
+	local board=$(ar71xx_board_name)
+
+	case "$board" in
+	rb*) echo "routerboard";;
+	*) echo "$board";;
+	esac
+}
+
 platform_check_image() {
 	local board=$(ar71xx_board_name)
 	local magic="$(get_magic_word "$1")"
@@ -308,6 +336,7 @@ platform_check_image() {
 	ls-sr71|\
 	pb42|\
 	pb44|\
+	rb-941-2nd|\
 	routerstation-pro|\
 	routerstation|\
 	wp543|\
@@ -443,6 +472,10 @@ platform_check_image() {
 	tew-673gru)
 		dir825b_check_image "$1" && return 0
 		;;
+	rb*)
+		nand_do_platform_check routerboard $1
+		return $?
+		;;
 	c-60|\
 	nbg6716|\
 	r6100|\
@@ -570,6 +603,9 @@ platform_pre_upgrade() {
 	local board=$(ar71xx_board_name)
 
 	case "$board" in
+	rb-941-2nd)
+		;;
+	rb*|\
 	c-60|\
 	nbg6716|\
 	r6100|\
@@ -584,10 +620,29 @@ platform_pre_upgrade() {
 	esac
 }
 
+platform_nand_pre_upgrade() {
+	local board=$(ar71xx_board_name)
+
+	case "$board" in
+	rb*)
+		CI_KERNPART=none
+		local fw_mtd=$(find_mtd_part kernel)
+		fw_mtd="${fw_mtd/block/}"
+		[ -n "$fw_mtd" ] || return
+		mtd erase kernel
+		tar xf "$1" sysupgrade-routerboard/kernel -O | nandwrite -o "$fw_mtd" -
+		;;
+	esac
+}
+
 platform_do_upgrade() {
 	local board=$(ar71xx_board_name)
 
 	case "$board" in
+	rb-941-2nd)
+		PLATFORM_DO_UPGRADE_COMBINED_SEPARATE_MTD=1
+		platform_do_upgrade_combined "$ARGV"
+		;;
 	all0258n)
 		platform_do_upgrade_allnet "0x9f050000" "$ARGV"
 		;;

target/linux/ar71xx/base-files/sbin/wget2nand

@@ -1,85 +0,0 @@
-#!/bin/sh
-# wget2nand
-# This script can be used to download a TGZ file from your build system which
-# contains the files to be installed on the NAND flash on your RB1xx card.
-# The one parameter is the URL of the TGZ file to be downloaded.
-# Licence GPL V2
-# Author david.goodenough@linkchoose.co.uk
-# Based on cf2nand from RB532 support
-. /lib/functions.sh
-
-wget2nand_dir=/tmp/wget2nand
-mnt_kernel=$wget2nand_dir/mnt_kernel
-mnt_rootfs=$wget2nand_dir/mnt_rootfs
-src_rootfs=$wget2nand_dir/rootfs.tgz
-src_kernel=$wget2nand_dir/kernel
-
-[ -d "$wget2nand_dir" ] && {
-	echo "$wget2nand_dir already exists"
-	exit 1
-}
-
-# need to find the wget server from the command line
-url=$1
-[ -z "$url" ] && {
-        echo "No URL specified for image TGZ"
-        echo "Usage : $0 URL"
-        exit 1
-}
-
-url_kernel=$url/lede-ar71xx-mikrotik-vmlinux-lzma.elf
-url_rootfs=$url/lede-ar71xx-mikrotik-defaultnowifi-rootfs.tar.gz
-
-mtd_kernel="$(find_mtd_part 'kernel')"
-mtd_rootfs="$(find_mtd_part 'rootfs')"
-[ -z "$mtd_kernel" -o -z "$mtd_rootfs" ] && {
-	echo "Cannot find NAND Flash partitions"
-	exit 1
-}
-
-mkdir "$wget2nand_dir"
-wget $url_kernel -O "$src_kernel" || {
-	echo "Unable to download $url_kernel"
-	exit 1
-}
-
-wget $url_rootfs -O "$src_rootfs" || {
-	echo "Unable to download $url_rootfs"
-	exit 1
-}
-
-echo "Erasing filesystem..."
-mtd erase kernel 2>/dev/null >/dev/null
-mtd erase rootfs 2>/dev/null >/dev/null
-
-echo "Mounting $mtd_rootfs as new root and $mtd_kernel as kernel partition"
-
-mkdir "$mnt_kernel"
-mkdir "$mnt_rootfs"
-mount -t yaffs2 "$mtd_kernel" "$mnt_kernel"
-mount -t yaffs2 "$mtd_rootfs" "$mnt_rootfs"
-
-echo "Copying kernel..."
-cp $src_kernel $mnt_kernel/kernel || {
-       echo "Error occured while copying the kernel"
-       exit 1
-}
-chmod +x $mnt_kernel/kernel
-
-echo "Preparing filesystem..."
-( cd "$mnt_rootfs"; tar xvz -f "$src_rootfs" )
-
-# make sure everything is written before we unmount the partitions
-echo "chmod ugo+x /" > $mnt_rootfs/etc/uci-defaults/set_root_permission
-sync
-ls $mnt_kernel >/dev/null
-ls $mnt_rootfs >/dev/null
-
-echo "Cleaning up..."
-# unmount the partitions and remove the directories into which they were mounted
-umount $mnt_kernel
-umount $mnt_rootfs
-rm -rf $wget2nand_dir
-
-# all done
-echo "Image written, you can now reboot.  Remember to change the boot source to Boot from Nand"

target/linux/ar71xx/config-4.4

@@ -143,6 +143,7 @@ CONFIG_ATH79_MACH_R6100=y
 # CONFIG_ATH79_MACH_RB750 is not set
 # CONFIG_ATH79_MACH_RB91X is not set
 # CONFIG_ATH79_MACH_RB922 is not set
+# CONFIG_ATH79_MACH_RB941 is not set
 # CONFIG_ATH79_MACH_RB95X is not set
 # CONFIG_ATH79_MACH_RBSXTLITE is not set
 CONFIG_ATH79_MACH_RE450=y