diff --git a/SOURCES/0037-rh1276426-wifi-crash-missing-bssid.patch b/SOURCES/0037-rh1276426-wifi-crash-missing-bssid.patch
new file mode 100644
index 0000000..e3089b6
--- /dev/null
+++ b/SOURCES/0037-rh1276426-wifi-crash-missing-bssid.patch
@@ -0,0 +1,167 @@
+From 1173a2ad3fa3833b04af4023d0434e5de14638db Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Thu, 5 Nov 2015 14:39:07 +0100
+Subject: [PATCH 1/4] build: add missing GLIB_CFLAGS
+
+The library and the include paths are dragged in with DBUS_CFLAGS but we need
+more; especially the GLIB_VERSION_{MIN/MAX}_REQUIRED macros. Otherwise we get
+deprecation warnings.
+
+No master commit, since this was fixed as a side-effect of the GDBus merge.
+
+(cherry picked from commit 302914c010ae547eeb01520405bb2a55d7d30d7f)
+---
+ src/devices/bluetooth/Makefile.am | 1 +
+ src/devices/wwan/Makefile.am      | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/src/devices/bluetooth/Makefile.am b/src/devices/bluetooth/Makefile.am
+index 8ab561a..035f0e5 100644
+--- a/src/devices/bluetooth/Makefile.am
++++ b/src/devices/bluetooth/Makefile.am
+@@ -15,6 +15,7 @@ AM_CPPFLAGS = \
+ 	-DG_LOG_DOMAIN=\""NetworkManager-bluetooth"\" \
+ 	-DNETWORKMANAGER_COMPILATION \
+ 	-DNM_VERSION_MAX_ALLOWED=NM_VERSION_NEXT_STABLE \
++	$(GLIB_CFLAGS) \
+ 	$(DBUS_CFLAGS)
+ 
+ GLIB_GENERATED = nm-bt-enum-types.h nm-bt-enum-types.c
+diff --git a/src/devices/wwan/Makefile.am b/src/devices/wwan/Makefile.am
+index 7e5b190..bcc41cf 100644
+--- a/src/devices/wwan/Makefile.am
++++ b/src/devices/wwan/Makefile.am
+@@ -15,6 +15,7 @@ AM_CPPFLAGS = \
+ 	-DNETWORKMANAGER_COMPILATION \
+ 	-DNM_VERSION_MAX_ALLOWED=NM_VERSION_NEXT_STABLE \
+ 	$(DBUS_CFLAGS) \
++	$(GLIB_CFLAGS) \
+ 	$(MM_GLIB_CFLAGS)
+ 
+ BUILT_SOURCES = $(null)
+-- 
+2.5.0
+
+
+From a21f00a1e3ff099aee72c23cb553881f216f3bf5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ji=C5=99=C3=AD=20Klime=C5=A1?= <jklimes@redhat.com>
+Date: Thu, 22 Oct 2015 10:17:20 +0200
+Subject: [PATCH 2/4] wifi: do no crash when getting BSSID fails
+
+https://bodhi.fedoraproject.org/updates/NetworkManager-1.0.6-7.fc23#comment-342089
+
+(cherry picked from commit e9bc18d2a7befb032052555ffba22bc72c9b8c2f)
+(cherry picked from commit e0e043ef3918de54f8d19a3af07d3367962970e5)
+---
+ src/devices/wifi/nm-device-wifi.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/devices/wifi/nm-device-wifi.c b/src/devices/wifi/nm-device-wifi.c
+index dde743b..fc6ff4d 100644
+--- a/src/devices/wifi/nm-device-wifi.c
++++ b/src/devices/wifi/nm-device-wifi.c
+@@ -1650,7 +1650,11 @@ try_fill_ssid_for_hidden_ap (NMAccessPoint *ap)
+ 	g_return_if_fail (nm_ap_get_ssid (ap) == NULL);
+ 
+ 	bssid = nm_ap_get_address (ap);
+-	g_assert (bssid);
++	if (!bssid) {
++		nm_log_dbg (LOGD_WIFI, "failed to get BSSID for hidden AP %s",
++		            str_if_set (nm_ap_get_supplicant_path (ap), "(none)"));
++		return;
++	}
+ 
+ 	/* Look for this AP's BSSID in the seen-bssids list of a connection,
+ 	 * and if a match is found, copy over the SSID */
+-- 
+2.5.0
+
+
+From befd1c8abf26bf57b23b9c07e05acafa6a617793 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Tue, 10 Nov 2015 11:11:30 -0600
+Subject: [PATCH 3/4] wifi: don't accept any BSSes with missing BSSIDs (rh
+ #1276426)
+
+The supplicant should never be sending us BSSes without BSSIDs.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1276426
+(cherry picked from commit 7cb323d92303df8c87d0c40c1c67b4d3a065275c)
+(cherry picked from commit ebe3320e62e6f4068467f2410b93be2a05ff6d53)
+---
+ src/devices/wifi/nm-device-wifi.c | 2 +-
+ src/devices/wifi/nm-wifi-ap.c     | 5 +++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/src/devices/wifi/nm-device-wifi.c b/src/devices/wifi/nm-device-wifi.c
+index fc6ff4d..1cf221a 100644
+--- a/src/devices/wifi/nm-device-wifi.c
++++ b/src/devices/wifi/nm-device-wifi.c
+@@ -1876,7 +1876,7 @@ supplicant_iface_new_bss_cb (NMSupplicantInterface *iface,
+ 		merge_scanned_ap (self, ap);
+ 		g_object_unref (ap);
+ 	} else
+-		_LOGW (LOGD_WIFI_SCAN, "invalid AP properties received");
++		_LOGD (LOGD_WIFI_SCAN, "invalid AP properties received for %s", object_path);
+ 
+ 	/* Remove outdated access points */
+ 	schedule_scanlist_cull (self);
+diff --git a/src/devices/wifi/nm-wifi-ap.c b/src/devices/wifi/nm-wifi-ap.c
+index 1485f4c..7243002 100644
+--- a/src/devices/wifi/nm-wifi-ap.c
++++ b/src/devices/wifi/nm-wifi-ap.c
+@@ -476,9 +476,10 @@ nm_ap_new_from_properties (const char *supplicant_path, GVariant *properties)
+ 
+ 	nm_ap_set_supplicant_path (ap, supplicant_path);
+ 
+-	/* ignore APs with invalid BSSIDs */
++	/* ignore APs with invalid or missing BSSIDs */
+ 	addr = nm_ap_get_address (ap);
+-	if (   nm_utils_hwaddr_matches (addr, -1, bad_bssid1, ETH_ALEN)
++	if (   !addr
++	    || nm_utils_hwaddr_matches (addr, -1, bad_bssid1, ETH_ALEN)
+ 	    || nm_utils_hwaddr_matches (addr, -1, bad_bssid2, ETH_ALEN)) {
+ 		g_object_unref (ap);
+ 		return NULL;
+-- 
+2.5.0
+
+
+From 37ce0397d2c6a0c80019b481059ced8d53d33d9b Mon Sep 17 00:00:00 2001
+From: Thomas Haller <thaller@redhat.com>
+Date: Wed, 11 Nov 2015 18:00:33 +0100
+Subject: [PATCH 4/4] Revert "wifi: do no crash when getting BSSID fails"
+
+Since commit ebe3320e62e6f4068467f2410b93be2a05ff6d53,
+nm_ap_new_from_properties() will always return an
+AP with BSSID set. Restore the assertion during
+try_fill_ssid_for_hidden_ap().
+
+This reverts commit e0e043ef3918de54f8d19a3af07d3367962970e5.
+
+(cherry picked from commit d5373959f9245faeebb1ba32b5b2b688d073ee6c)
+(cherry picked from commit 0ff3699af5aaf9e403964bf6b52db30f78e2f069)
+---
+ src/devices/wifi/nm-device-wifi.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/src/devices/wifi/nm-device-wifi.c b/src/devices/wifi/nm-device-wifi.c
+index 1cf221a..192b22b 100644
+--- a/src/devices/wifi/nm-device-wifi.c
++++ b/src/devices/wifi/nm-device-wifi.c
+@@ -1650,11 +1650,7 @@ try_fill_ssid_for_hidden_ap (NMAccessPoint *ap)
+ 	g_return_if_fail (nm_ap_get_ssid (ap) == NULL);
+ 
+ 	bssid = nm_ap_get_address (ap);
+-	if (!bssid) {
+-		nm_log_dbg (LOGD_WIFI, "failed to get BSSID for hidden AP %s",
+-		            str_if_set (nm_ap_get_supplicant_path (ap), "(none)"));
+-		return;
+-	}
++	g_return_if_fail (bssid);
+ 
+ 	/* Look for this AP's BSSID in the seen-bssids list of a connection,
+ 	 * and if a match is found, copy over the SSID */
+-- 
+2.5.0
+
diff --git a/SOURCES/0038-rh1288110-fix-activation-eth-zero-mac.patch b/SOURCES/0038-rh1288110-fix-activation-eth-zero-mac.patch
new file mode 100644
index 0000000..76b1168
--- /dev/null
+++ b/SOURCES/0038-rh1288110-fix-activation-eth-zero-mac.patch
@@ -0,0 +1,341 @@
+From d1529eaa50aa6b838234629fcd86b129a9598bf4 Mon Sep 17 00:00:00 2001
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Sun, 13 Dec 2015 22:08:23 +0100
+Subject: [PATCH 1/3] core: simplify generation of default connection for new
+ devices
+
+Instead of using a signal for triggering the generation of a default
+connection when the device becomes managed, let the manager wait for a
+transition to UNAVAILABLE or DISCONNECTED states.
+
+This partially reverts b3b0b4625053 ("device: retry creation of
+default connection after link is initialized").
+
+(cherry picked from commit 44789e32912c48358dbb7971be57682bd330719d)
+---
+ src/devices/nm-device.c | 11 -----------
+ src/nm-manager.c        | 17 +++++------------
+ 2 files changed, 5 insertions(+), 23 deletions(-)
+
+diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
+index d4627ec..9f99478 100644
+--- a/src/devices/nm-device.c
++++ b/src/devices/nm-device.c
+@@ -95,7 +95,6 @@ enum {
+ 	REMOVED,
+ 	RECHECK_AUTO_ACTIVATE,
+ 	RECHECK_ASSUME,
+-	LINK_INITIALIZED,
+ 	LAST_SIGNAL,
+ };
+ static guint signals[LAST_SIGNAL] = { 0 };
+@@ -1515,9 +1514,6 @@ device_link_changed (NMDevice *self)
+ 		}
+ 	}
+ 
+-	if (emit_link_initialized)
+-		g_signal_emit (self, signals[LINK_INITIALIZED], 0);
+-
+ 	return G_SOURCE_REMOVE;
+ }
+ 
+@@ -9867,13 +9863,6 @@ nm_device_class_init (NMDeviceClass *klass)
+ 		              0, NULL, NULL, NULL,
+ 		              G_TYPE_NONE, 0);
+ 
+-	signals[LINK_INITIALIZED] =
+-		g_signal_new (NM_DEVICE_LINK_INITIALIZED,
+-		              G_OBJECT_CLASS_TYPE (object_class),
+-		              G_SIGNAL_RUN_FIRST,
+-		              0, NULL, NULL, NULL,
+-		              G_TYPE_NONE, 0);
+-
+ 	nm_dbus_manager_register_exported_type (nm_dbus_manager_get (),
+ 	                                        G_TYPE_FROM_CLASS (klass),
+ 	                                        &dbus_glib_nm_device_object_info);
+diff --git a/src/nm-manager.c b/src/nm-manager.c
+index a6c23b1..2d8b7a9 100644
+--- a/src/nm-manager.c
++++ b/src/nm-manager.c
+@@ -717,6 +717,7 @@ manager_device_state_changed (NMDevice *device,
+                               gpointer user_data)
+ {
+ 	NMManager *self = NM_MANAGER (user_data);
++	NMManagerPrivate *priv = NM_MANAGER_GET_PRIVATE (self);
+ 
+ 	switch (new_state) {
+ 	case NM_DEVICE_STATE_UNMANAGED:
+@@ -729,6 +730,10 @@ manager_device_state_changed (NMDevice *device,
+ 	default:
+ 		break;
+ 	}
++
++	if (   new_state == NM_DEVICE_STATE_UNAVAILABLE
++	    || new_state == NM_DEVICE_STATE_DISCONNECTED)
++		nm_settings_device_added (priv->settings, device);
+ }
+ 
+ static void device_has_pending_action_changed (NMDevice *device,
+@@ -853,14 +858,6 @@ device_removed_cb (NMDevice *device, gpointer user_data)
+ }
+ 
+ static void
+-device_link_initialized_cb (NMDevice *device, gpointer user_data)
+-{
+-	NMManagerPrivate *priv = NM_MANAGER_GET_PRIVATE (user_data);
+-
+-	nm_settings_device_added (priv->settings, device);
+-}
+-
+-static void
+ aipd_handle_event (DBusGProxy *proxy,
+                    const char *event,
+                    const char *iface,
+@@ -1821,10 +1818,6 @@ add_device (NMManager *self, NMDevice *device, gboolean try_assume)
+ 	                  G_CALLBACK (device_removed_cb),
+ 	                  self);
+ 
+-	g_signal_connect (device, NM_DEVICE_LINK_INITIALIZED,
+-	                  G_CALLBACK (device_link_initialized_cb),
+-	                  self);
+-
+ 	g_signal_connect (device, "notify::" NM_DEVICE_IP_IFACE,
+ 	                  G_CALLBACK (device_ip_iface_changed),
+ 	                  self);
+-- 
+2.5.0
+
+From 8fc5e8acaa31572d56ab5adc0880ba65d334796d Mon Sep 17 00:00:00 2001
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Mon, 14 Dec 2015 08:46:29 +0100
+Subject: [PATCH 2/3] device/trivial: split out
+ nm_device_update_initial_hw_address()
+
+(cherry picked from commit 2a0a9aa2e45b064304f827c7eed49bc80c6e3702)
+---
+ src/devices/nm-device.c | 50 ++++++++++++++++++++++++++++---------------------
+ 1 file changed, 29 insertions(+), 21 deletions(-)
+
+diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
+index 9f99478..50cb630 100644
+--- a/src/devices/nm-device.c
++++ b/src/devices/nm-device.c
+@@ -389,6 +389,7 @@ static void _set_state_full (NMDevice *self,
+                              gboolean quitting);
+ 
+ static void nm_device_update_hw_address (NMDevice *self);
++static void nm_device_update_initial_hw_address (NMDevice *self);
+ 
+ /***********************************************************/
+ 
+@@ -8882,6 +8883,33 @@ nm_device_update_hw_address (NMDevice *self)
+ 	priv->hw_addr_len = hwaddrlen;
+ }
+ 
++static void
++nm_device_update_initial_hw_address (NMDevice *self)
++{
++	NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE (self);
++
++	if (priv->hw_addr_len) {
++		priv->initial_hw_addr = g_strdup (priv->hw_addr);
++		_LOGD (LOGD_DEVICE | LOGD_HW, "read initial MAC address %s", priv->initial_hw_addr);
++
++		if (priv->ifindex > 0) {
++			guint8 buf[NM_UTILS_HWADDR_LEN_MAX];
++			size_t len = 0;
++
++			if (nm_platform_link_get_permanent_address (NM_PLATFORM_GET, priv->ifindex, buf, &len)) {
++				g_warn_if_fail (len == priv->hw_addr_len);
++				priv->perm_hw_addr = nm_utils_hwaddr_ntoa (buf, priv->hw_addr_len);
++				_LOGD (LOGD_DEVICE | LOGD_HW, "read permanent MAC address %s",
++				       priv->perm_hw_addr);
++			} else {
++				/* Fall back to current address */
++				_LOGD (LOGD_HW | LOGD_ETHER, "unable to read permanent MAC address");
++				priv->perm_hw_addr = g_strdup (priv->hw_addr);
++			}
++		}
++	}
++}
++
+ gboolean
+ nm_device_set_hw_addr (NMDevice *self, const char *addr,
+                        const char *detail, guint64 hw_log_domain)
+@@ -9117,27 +9145,7 @@ constructed (GObject *object)
+ 	int master;
+ 
+ 	nm_device_update_hw_address (self);
+-
+-	if (priv->hw_addr_len) {
+-		priv->initial_hw_addr = g_strdup (priv->hw_addr);
+-		_LOGD (LOGD_DEVICE | LOGD_HW, "read initial MAC address %s", priv->initial_hw_addr);
+-
+-		if (priv->ifindex > 0) {
+-			guint8 buf[NM_UTILS_HWADDR_LEN_MAX];
+-			size_t len = 0;
+-
+-			if (nm_platform_link_get_permanent_address (NM_PLATFORM_GET, priv->ifindex, buf, &len)) {
+-				g_warn_if_fail (len == priv->hw_addr_len);
+-				priv->perm_hw_addr = nm_utils_hwaddr_ntoa (buf, priv->hw_addr_len);
+-				_LOGD (LOGD_DEVICE | LOGD_HW, "read permanent MAC address %s",
+-				       priv->perm_hw_addr);
+-			} else {
+-				/* Fall back to current address */
+-				_LOGD (LOGD_HW | LOGD_ETHER, "unable to read permanent MAC address");
+-				priv->perm_hw_addr = g_strdup (priv->hw_addr);
+-			}
+-		}
+-	}
++	nm_device_update_initial_hw_address (self);
+ 
+ 	/* Note: initial hardware address must be read before calling get_ignore_carrier() */
+ 	if (nm_device_has_capability (self, NM_DEVICE_CAP_CARRIER_DETECT)) {
+-- 
+2.5.0
+
+From 1528c6fa3c3bc540c51dd9ba3115c83847c7d13a Mon Sep 17 00:00:00 2001
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Sun, 13 Dec 2015 22:09:59 +0100
+Subject: [PATCH 3/3] device: wait for valid MAC before making ethernet devices
+ available
+
+In certain situations, ethernet links first appear with a zero MAC
+address and then the MAC changes some time later. Currently NM does
+not deal correctly with this scenario since it initializes wrong
+@initial_hwaddr and @permanent_hwaddr on the device and tries to
+immediately activate it.
+
+To fix this, initialize the device's addresses only when the MAC
+becomes valid and make the device available only at that point.
+
+(cherry picked from commit 92149f223fbd4068f30f31d14c6aa6c8e2146161)
+---
+ src/devices/nm-device-ethernet.c | 35 +++++++++++++++++++++++++++++++++++
+ src/devices/nm-device.c          | 12 +++++++-----
+ src/devices/nm-device.h          |  3 +++
+ 3 files changed, 45 insertions(+), 5 deletions(-)
+
+diff --git a/src/devices/nm-device-ethernet.c b/src/devices/nm-device-ethernet.c
+index 7c0de88..002f1d1 100644
+--- a/src/devices/nm-device-ethernet.c
++++ b/src/devices/nm-device-ethernet.c
+@@ -1594,10 +1594,44 @@ link_changed (NMDevice *device, NMPlatformLink *info)
+ {
+ 	NMDeviceEthernet *self = NM_DEVICE_ETHERNET (device);
+ 	NMDeviceEthernetPrivate *priv = NM_DEVICE_ETHERNET_GET_PRIVATE (self);
++	static const guint8 zero_hwaddr[ETH_ALEN];
++	const guint8 *hwaddr;
++	gsize hwaddrlen = 0;
+ 
+ 	NM_DEVICE_CLASS (nm_device_ethernet_parent_class)->link_changed (device, info);
+ 	if (!priv->subchan1 && info->initialized)
+ 		_update_s390_subchannels (self);
++
++	if (!nm_device_get_initial_hw_address (device)) {
++		hwaddr = nm_platform_link_get_address (NM_PLATFORM_GET,
++		                                       nm_device_get_ifindex (self),
++		                                       &hwaddrlen);
++		if (!nm_utils_hwaddr_matches (hwaddr, hwaddrlen, zero_hwaddr, ETH_ALEN)) {
++			_LOGD (LOGD_DEVICE, "device got a valid hw address");
++			nm_device_update_hw_address (self);
++			nm_device_update_initial_hw_address (self);
++			if (nm_device_get_state (device) == NM_DEVICE_STATE_UNAVAILABLE) {
++				/*
++				 * If the device is UNAVAILABLE, any previous try to
++				 * bring it up probably has failed because of the
++				 * invalid hardware address; try again.
++				 */
++				nm_device_bring_up (self, TRUE, NULL);
++				nm_device_queue_recheck_available (device,
++				                                   NM_DEVICE_STATE_REASON_NONE,
++				                                   NM_DEVICE_STATE_REASON_NONE);
++			}
++		}
++	}
++}
++
++static gboolean
++is_available (NMDevice *device, NMDeviceCheckDevAvailableFlags flags)
++{
++	if (!NM_DEVICE_CLASS (nm_device_ethernet_parent_class)->is_available (device, flags))
++		return FALSE;
++
++	return !!nm_device_get_initial_hw_address (device);
+ }
+ 
+ static void
+@@ -1696,6 +1730,7 @@ nm_device_ethernet_class_init (NMDeviceEthernetClass *klass)
+ 	parent_class->update_connection = update_connection;
+ 	parent_class->carrier_changed = carrier_changed;
+ 	parent_class->link_changed = link_changed;
++	parent_class->is_available = is_available;
+ 
+ 	parent_class->state_changed = device_state_changed;
+ 
+diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
+index 50cb630..39977c6 100644
+--- a/src/devices/nm-device.c
++++ b/src/devices/nm-device.c
+@@ -388,9 +388,6 @@ static void _set_state_full (NMDevice *self,
+                              NMDeviceStateReason reason,
+                              gboolean quitting);
+ 
+-static void nm_device_update_hw_address (NMDevice *self);
+-static void nm_device_update_initial_hw_address (NMDevice *self);
+-
+ /***********************************************************/
+ 
+ #define QUEUED_PREFIX "queued state change to "
+@@ -8850,19 +8847,24 @@ nm_device_get_hw_address (NMDevice *self)
+ 	return priv->hw_addr_len ? priv->hw_addr : NULL;
+ }
+ 
+-static void
++void
+ nm_device_update_hw_address (NMDevice *self)
+ {
+ 	NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE (self);
+ 	int ifindex = nm_device_get_ifindex (self);
+ 	const guint8 *hwaddr;
+ 	gsize hwaddrlen = 0;
++	static const guint8 zero_hwaddr[ETH_ALEN];
+ 
+ 	if (ifindex <= 0)
+ 		return;
+ 
+ 	hwaddr = nm_platform_link_get_address (NM_PLATFORM_GET, ifindex, &hwaddrlen);
+ 
++	if (   priv->type == NM_DEVICE_TYPE_ETHERNET
++	    && nm_utils_hwaddr_matches (hwaddr, hwaddrlen, zero_hwaddr, sizeof (zero_hwaddr)))
++		hwaddrlen = 0;
++
+ 	if (hwaddrlen) {
+ 		if (!priv->hw_addr || !nm_utils_hwaddr_matches (priv->hw_addr, -1, hwaddr, hwaddrlen)) {
+ 			g_free (priv->hw_addr);
+@@ -8883,7 +8885,7 @@ nm_device_update_hw_address (NMDevice *self)
+ 	priv->hw_addr_len = hwaddrlen;
+ }
+ 
+-static void
++void
+ nm_device_update_initial_hw_address (NMDevice *self)
+ {
+ 	NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE (self);
+diff --git a/src/devices/nm-device.h b/src/devices/nm-device.h
+index 49cef8e..0ba1c1f 100644
+--- a/src/devices/nm-device.h
++++ b/src/devices/nm-device.h
+@@ -441,6 +441,9 @@ const NMPlatformIP6Route *nm_device_get_ip6_default_route (NMDevice *self, gbool
+ 
+ void nm_device_spawn_iface_helper (NMDevice *self);
+ 
++void nm_device_update_hw_address (NMDevice *self);
++void nm_device_update_initial_hw_address (NMDevice *self);
++
+ G_END_DECLS
+ 
+ /* For testing only */
+-- 
+2.5.0
+
diff --git a/SPECS/NetworkManager.spec b/SPECS/NetworkManager.spec
index 4609465..fa10731 100644
--- a/SPECS/NetworkManager.spec
+++ b/SPECS/NetworkManager.spec
@@ -10,7 +10,7 @@
 %define snapshot %{nil}
 %define git_sha %{nil}
 %define realversion 1.0.6
-%define release_version 27
+%define release_version 29
 %define epoch_version 1
 
 %define obsoletes_nmver 1:1.0.0-1
@@ -116,6 +116,8 @@ Patch33: 0033-rh1270194-wol-default-ignore.patch
 Patch34: 0034-rh1273879-fix-software-device-unmanaged.patch
 Patch35: 0035-rh1272023-vpn-cancelling.patch.patch
 Patch36: 0036-rh1267327-wifi-scan.patch
+Patch37: 0037-rh1276426-wifi-crash-missing-bssid.patch
+Patch38: 0038-rh1288110-fix-activation-eth-zero-mac.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -431,6 +433,8 @@ by nm-connection-editor and nm-applet in a non-graphical environment.
 %patch34 -p1
 %patch35 -p1
 %patch36 -p1
+%patch37 -p1
+%patch38 -p1
 
 %build
 
@@ -741,8 +745,14 @@ fi
 %endif
 
 %changelog
+* Wed Mar  9 2016 Beniamino Galvani <bgalvani@redhat.com> - 1:1.0.6-29
+- device: wait for valid MAC before activating ethernet devices (rh #1288110)
+
+* Tue Feb 16 2016 Thomas Haller <thaller@redhat.com> - 1:1.0.6-28
+- wifi: fix crash due to missing BSSID (rh #1276426)
+
 * Mon Oct 26 2015 Thomas Haller <thaller@redhat.com> - 1:1.0.6-27
-* build: update vala-tools build requirement (rh #1274000)
+- build: update vala-tools build requirement (rh #1274000)
 
 * Sat Oct 24 2015 Jiří Klimeš <jklimes@redhat.com> - 1:1.0.6-26
 - wifi: emit NEW_BSS on ScanDone to update APs in Wi-Fi device (rh #1267327)