--- /dev/null
+From: Hante Meuleman <hante.meuleman@broadcom.com>
+Date: Fri, 3 Jun 2016 23:31:07 +0200
+Subject: [PATCH] brcmfmac: fix skb priority handling
+
+SKBs can come with a prioriy. Currently a priority of 0..7 is
+assumed. But this assumption is incorrect. To fix this any
+priority of 0 or higher then 7 will be adjusted by calling
+cfg80211_classify8021d
+
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -2101,7 +2101,7 @@ int brcmf_fws_process_skb(struct brcmf_i
+
+ brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto));
+ /* determine the priority */
+- if (!skb->priority)
++ if ((skb->priority == 0) || (skb->priority > 7))
+ skb->priority = cfg80211_classify8021d(skb, NULL);
+
+ drvr->tx_multicast += !!multicast;
--- /dev/null
+From: Wright Feng <wright.feng@broadcom.com>
+Date: Fri, 3 Jun 2016 23:31:08 +0200
+Subject: [PATCH] brcmfmac: revise SDIO error message in
+ brcmf_sdio_drivestrengthinit
+
+The error message is given for something that is not an error here as
+the drive strength configuration may not be applicable for specific
+devices. Therefor the error message is rephrased and changed to a
+debug message.
+
+Signed-off-by: Wright Feng <wright.feng@broadcom.com>
+[arend@broadcom.com: rephrase commit message]
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3664,7 +3664,7 @@ brcmf_sdio_drivestrengthinit(struct brcm
+ str_shift = 11;
+ break;
+ default:
+- brcmf_err("No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
++ brcmf_dbg(INFO, "No SDIO driver strength init needed for chip %s rev %d pmurev %d\n",
+ ci->name, ci->chiprev, ci->pmurev);
+ break;
+ }
--- /dev/null
+From: Wright Feng <wright.feng@broadcom.com>
+Date: Fri, 3 Jun 2016 23:31:09 +0200
+Subject: [PATCH] brcmfmac: use ndev->needed_headroom to reserve additional
+ header space
+
+When using nmap tool with FMAC, the nmap packets were be dropped by kernel
+because the size was too short. The kernel message showed like
+"nmap: packet size is too short (42 <= 50)". It is caused by the packet
+length is shorter than ndev->hard_header_len. According to definition of
+LL_RESERVED_SPACE() and hard_header_len, we should use hard_header_len
+to reserve for L2 header, like ethernet header(ETH_HLEN) in our case and
+use needed_headroom for the additional headroom needed by hardware.
+
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -516,7 +516,7 @@ int brcmf_net_attach(struct brcmf_if *if
+ /* set appropriate operations */
+ ndev->netdev_ops = &brcmf_netdev_ops_pri;
+
+- ndev->hard_header_len += drvr->hdrlen;
++ ndev->needed_headroom += drvr->hdrlen;
+ ndev->ethtool_ops = &brcmf_ethtool_ops;
+
+ drvr->rxsz = ndev->mtu + ndev->hard_header_len +
--- /dev/null
+From: Hante Meuleman <hante.meuleman@broadcom.com>
+Date: Fri, 3 Jun 2016 23:31:10 +0200
+Subject: [PATCH] brcmfmac: add support for the PCIE devices 43525 and 43465
+
+This patch adds support for the new PCIE devices 43525 and 43465.
+
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Reviewed-by: Franky (Zhenhui) Lin <franky.lin@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -685,6 +685,8 @@ static u32 brcmf_chip_tcm_rambase(struct
+ case BRCM_CC_43602_CHIP_ID:
+ case BRCM_CC_4371_CHIP_ID:
+ return 0x180000;
++ case BRCM_CC_43465_CHIP_ID:
++ case BRCM_CC_43525_CHIP_ID:
+ case BRCM_CC_4365_CHIP_ID:
+ case BRCM_CC_4366_CHIP_ID:
+ return 0x200000;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -54,21 +54,25 @@ BRCMF_FW_NVRAM_DEF(43570, "brcmfmac43570
+ BRCMF_FW_NVRAM_DEF(4358, "brcmfmac4358-pcie.bin", "brcmfmac4358-pcie.txt");
+ BRCMF_FW_NVRAM_DEF(4359, "brcmfmac4359-pcie.bin", "brcmfmac4359-pcie.txt");
+ BRCMF_FW_NVRAM_DEF(4365B, "brcmfmac4365b-pcie.bin", "brcmfmac4365b-pcie.txt");
++BRCMF_FW_NVRAM_DEF(4365C, "brcmfmac4365c-pcie.bin", "brcmfmac4365c-pcie.txt");
+ BRCMF_FW_NVRAM_DEF(4366B, "brcmfmac4366b-pcie.bin", "brcmfmac4366b-pcie.txt");
+ BRCMF_FW_NVRAM_DEF(4366C, "brcmfmac4366c-pcie.bin", "brcmfmac4366c-pcie.txt");
+ BRCMF_FW_NVRAM_DEF(4371, "brcmfmac4371-pcie.bin", "brcmfmac4371-pcie.txt");
+
+ static struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = {
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43602_CHIP_ID, 0xFFFFFFFF, 43602),
++ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43465_CHIP_ID, 0xFFFFFFF0, 4366C),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350),
++ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
+- BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFFF, 4365B),
++ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0x0000000F, 4365B),
++ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4366_CHIP_ID, 0xFFFFFFF0, 4366C),
+ BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371),
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -40,7 +40,9 @@
+ #define BRCM_CC_4339_CHIP_ID 0x4339
+ #define BRCM_CC_43430_CHIP_ID 43430
+ #define BRCM_CC_4345_CHIP_ID 0x4345
++#define BRCM_CC_43465_CHIP_ID 43465
+ #define BRCM_CC_4350_CHIP_ID 0x4350
++#define BRCM_CC_43525_CHIP_ID 43525
+ #define BRCM_CC_4354_CHIP_ID 0x4354
+ #define BRCM_CC_4356_CHIP_ID 0x4356
+ #define BRCM_CC_43566_CHIP_ID 43566
--- /dev/null
+From: Wright Feng <wright.feng@broadcom.com>
+Date: Fri, 3 Jun 2016 23:31:11 +0200
+Subject: [PATCH] brcmfmac: change rx_seq check log from error print to debug
+ print
+
+The bus rx sequence is not in order because that control and event
+frames always cause immediate send, but data frames may be held
+for glomming in firmware side. It is not actually an error as the
+packets are still processed even if the RX sequence is not in order.
+Therefor the error message is rephrased and changed to a debug
+message.
+
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1382,8 +1382,7 @@ static int brcmf_sdio_hdparse(struct brc
+ return -ENXIO;
+ }
+ if (rd->seq_num != rx_seq) {
+- brcmf_err("seq %d: sequence number error, expect %d\n",
+- rx_seq, rd->seq_num);
++ brcmf_dbg(SDIO, "seq %d, expected %d\n", rx_seq, rd->seq_num);
+ bus->sdcnt.rx_badseq++;
+ rd->seq_num = rx_seq;
+ }
--- /dev/null
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Mon, 6 Jun 2016 23:03:55 +0200
+Subject: [PATCH] brcmfmac: drop unused pm_block vif attribute
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This attribute was added 3 years ago by
+commit 3eacf866559c ("brcmfmac: introduce brcmf_cfg80211_vif structure")
+but it remains unused since then. It seems we can safely drop it.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -587,7 +587,7 @@ struct wireless_dev *brcmf_ap_add_vif(st
+
+ brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
+
+- vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP, false);
++ vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP);
+ if (IS_ERR(vif))
+ return (struct wireless_dev *)vif;
+
+@@ -5114,8 +5114,7 @@ static struct cfg80211_ops brcmf_cfg8021
+ };
+
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+- enum nl80211_iftype type,
+- bool pm_block)
++ enum nl80211_iftype type)
+ {
+ struct brcmf_cfg80211_vif *vif_walk;
+ struct brcmf_cfg80211_vif *vif;
+@@ -5130,8 +5129,6 @@ struct brcmf_cfg80211_vif *brcmf_alloc_v
+ vif->wdev.wiphy = cfg->wiphy;
+ vif->wdev.iftype = type;
+
+- vif->pm_block = pm_block;
+-
+ brcmf_init_prof(&vif->profile);
+
+ if (type == NL80211_IFTYPE_AP) {
+@@ -6769,7 +6766,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ init_vif_event(&cfg->vif_event);
+ INIT_LIST_HEAD(&cfg->vif_list);
+
+- vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION, false);
++ vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
+ if (IS_ERR(vif))
+ goto wiphy_out;
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -167,7 +167,6 @@ struct vif_saved_ie {
+ * @wdev: wireless device.
+ * @profile: profile information.
+ * @sme_state: SME state using enum brcmf_vif_status bits.
+- * @pm_block: power-management blocked.
+ * @list: linked list.
+ * @mgmt_rx_reg: registered rx mgmt frame types.
+ * @mbss: Multiple BSS type, set if not first AP (not relevant for P2P).
+@@ -177,7 +176,6 @@ struct brcmf_cfg80211_vif {
+ struct wireless_dev wdev;
+ struct brcmf_cfg80211_profile profile;
+ unsigned long sme_state;
+- bool pm_block;
+ struct vif_saved_ie saved_ie;
+ struct list_head list;
+ u16 mgmt_rx_reg;
+@@ -388,8 +386,7 @@ s32 brcmf_cfg80211_down(struct net_devic
+ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
+
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+- enum nl80211_iftype type,
+- bool pm_block);
++ enum nl80211_iftype type);
+ void brcmf_free_vif(struct brcmf_cfg80211_vif *vif);
+
+ s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -2074,8 +2074,7 @@ static struct wireless_dev *brcmf_p2p_cr
+ if (p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
+ return ERR_PTR(-ENOSPC);
+
+- p2p_vif = brcmf_alloc_vif(p2p->cfg, NL80211_IFTYPE_P2P_DEVICE,
+- false);
++ p2p_vif = brcmf_alloc_vif(p2p->cfg, NL80211_IFTYPE_P2P_DEVICE);
+ if (IS_ERR(p2p_vif)) {
+ brcmf_err("could not create discovery vif\n");
+ return (struct wireless_dev *)p2p_vif;
+@@ -2175,7 +2174,7 @@ struct wireless_dev *brcmf_p2p_add_vif(s
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
+- vif = brcmf_alloc_vif(cfg, type, false);
++ vif = brcmf_alloc_vif(cfg, type);
+ if (IS_ERR(vif))
+ return (struct wireless_dev *)vif;
+ brcmf_cfg80211_arm_vif_event(cfg, vif);