Merge remote-tracking branch 'upstream/master' into hardened-stdenv

8 files changed, 214 insertions, 414 deletions

diff --git a/pkgs/os-specific/linux/broadcom-sta/default.nix b/pkgs/os-specific/linux/broadcom-sta/default.nix
index 64a0c3138c9b..28b23a61ff06 100644
--- a/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -1,43 +1,47 @@
 { stdenv, fetchurl, kernel }:
+
 let
-  version = "6.30.223.248";
+  version = "6.30.223.271";
+  hashes = {
+    i686-linux   = "1kaqa2dw3nb8k23ffvx46g8jj3wdhz8xa6jp1v3wb35cjfr712sg";
+    x86_64-linux = "1gj485qqr190idilacpxwgqyw21il03zph2rddizgj7fbd6pfyaz";
+  };
+
+  arch = stdenv.lib.optionalString (stdenv.system == "x86_64-linux") "_64";
+  tarballVersion = stdenv.lib.replaceStrings ["."] ["_"] version;
+  tarball = "hybrid-v35${arch}-nodebug-pcoem-${tarballVersion}.tar.gz";
 in
 stdenv.mkDerivation {
   name = "broadcom-sta-${version}-${kernel.version}";
 
-  src = if stdenv.system == "i686-linux" then (
-    fetchurl {
-      url = http://www.broadcom.com/docs/linux_sta/hybrid-v35-nodebug-pcoem-6_30_223_248.tar.gz;
-      sha256 = "1bd13pq5hj4yzp32rx71sg1i5wkzdsg1s32xsywb48lw88x595mi";
-    } ) else (
-    fetchurl {
-      url = http://www.broadcom.com/docs/linux_sta/hybrid-v35_64-nodebug-pcoem-6_30_223_248.tar.gz;
-      sha256 = "08ihbhwnqpnazskw9rlrk0alanp4x70kl8bsy2vg962iq334r69x";
-    }
-  );
+  src = fetchurl {
+    url = "http://www.broadcom.com/docs/linux_sta/${tarball}";
+    sha256 = hashes.${stdenv.system};
+  };
 
   patches = [
+    ./i686-build-failure.patch
     ./license.patch
-    ./linux-recent.patch
+    ./linux-4.7.patch
+    ./null-pointer-fix.patch
     ./gcc.patch
   ];
 
   makeFlags = "KBASE=${kernel.dev}/lib/modules/${kernel.modDirVersion}";
 
   unpackPhase = ''
-      sourceRoot=broadcom-sta
-      mkdir "$sourceRoot"
-      tar xvf "$src" -C "$sourceRoot"
+    sourceRoot=broadcom-sta
+    mkdir "$sourceRoot"
+    tar xvf "$src" -C "$sourceRoot"
   '';
 
-  installPhase =
-    ''
-      binDir="$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
-      docDir="$out/share/doc/broadcom-sta/"
-      mkdir -p "$binDir" "$docDir"
-      cp wl.ko "$binDir"
-      cp lib/LICENSE.txt "$docDir"
-    '';
+  installPhase = ''
+    binDir="$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+    docDir="$out/share/doc/broadcom-sta/"
+    mkdir -p "$binDir" "$docDir"
+    cp wl.ko "$binDir"
+    cp lib/LICENSE.txt "$docDir"
+  '';
 
   meta = {
     description = "Kernel module driver for some Broadcom's wireless cards";
diff --git a/pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch b/pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch
new file mode 100644
index 000000000000..cfa16075409b
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch
@@ -0,0 +1,18 @@
+https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=fe47ae6e1a5005b2e82f7eab57b5c3820453293a
+https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=4ea1636b04dbd66536fa387bae2eea463efc705b
+
+diff -ru a/src/shared/linux_osl.c b/src/shared/linux_osl.c
+--- a/src/shared/linux_osl.c	2015-09-19 01:47:15.000000000 +0300
++++ b/src/shared/linux_osl.c	2015-11-21 15:20:30.585902518 +0200
+@@ -932,7 +932,11 @@
+ 	uint cycles;
+ 
+ #if defined(__i386__)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 3, 0)
++	cycles = (u32)rdtsc();
++#else
+ 	rdtscl(cycles);
++#endif
+ #else
+ 	cycles = 0;
+ #endif 
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch b/pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch
new file mode 100644
index 000000000000..566680a09140
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch
@@ -0,0 +1,109 @@
+Since Linux 4.7, the enum ieee80211_band is no longer used
+
+This shall cause no problem's since both enums ieee80211_band
+and nl80211_band were added in the same commit:
+https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=13ae75b103e07304a34ab40c9136e9f53e06475c
+
+This patch refactors the references of IEEE80211_BAND_* to NL80211_BAND_*
+
+Reference:
+https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=57fbcce37be7c1d2622b56587c10ade00e96afa3
+
+--- a/src/wl/sys/wl_cfg80211_hybrid.c	2016-06-13 11:57:36.159340297 -0500
++++ b/src/wl/sys/wl_cfg80211_hybrid.c	2016-06-13 11:58:18.442323435 -0500
+@@ -236,7 +236,7 @@
+ #endif				
+ 
+ #define CHAN2G(_channel, _freq, _flags) {			\
+-	.band			= IEEE80211_BAND_2GHZ,		\
++	.band			= NL80211_BAND_2GHZ,		\
+ 	.center_freq		= (_freq),			\
+ 	.hw_value		= (_channel),			\
+ 	.flags			= (_flags),			\
+@@ -245,7 +245,7 @@
+ }
+ 
+ #define CHAN5G(_channel, _flags) {				\
+-	.band			= IEEE80211_BAND_5GHZ,		\
++	.band			= NL80211_BAND_5GHZ,		\
+ 	.center_freq		= 5000 + (5 * (_channel)),	\
+ 	.hw_value		= (_channel),			\
+ 	.flags			= (_flags),			\
+@@ -379,7 +379,7 @@
+ };
+ 
+ static struct ieee80211_supported_band __wl_band_2ghz = {
+-	.band = IEEE80211_BAND_2GHZ,
++	.band = NL80211_BAND_2GHZ,
+ 	.channels = __wl_2ghz_channels,
+ 	.n_channels = ARRAY_SIZE(__wl_2ghz_channels),
+ 	.bitrates = wl_g_rates,
+@@ -387,7 +387,7 @@
+ };
+ 
+ static struct ieee80211_supported_band __wl_band_5ghz_a = {
+-	.band = IEEE80211_BAND_5GHZ,
++	.band = NL80211_BAND_5GHZ,
+ 	.channels = __wl_5ghz_a_channels,
+ 	.n_channels = ARRAY_SIZE(__wl_5ghz_a_channels),
+ 	.bitrates = wl_a_rates,
+@@ -395,7 +395,7 @@
+ };
+ 
+ static struct ieee80211_supported_band __wl_band_5ghz_n = {
+-	.band = IEEE80211_BAND_5GHZ,
++	.band = NL80211_BAND_5GHZ,
+ 	.channels = __wl_5ghz_n_channels,
+ 	.n_channels = ARRAY_SIZE(__wl_5ghz_n_channels),
+ 	.bitrates = wl_a_rates,
+@@ -1876,8 +1876,8 @@
+ 	wdev->wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
+ #endif
+ 	wdev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_ADHOC);
+-	wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
+-	wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_a; 
++	wdev->wiphy->bands[NL80211_BAND_2GHZ] = &__wl_band_2ghz;
++	wdev->wiphy->bands[NL80211_BAND_5GHZ] = &__wl_band_5ghz_a; 
+ 	wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+ 	wdev->wiphy->cipher_suites = __wl_cipher_suites;
+ 	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
+@@ -2000,7 +2000,7 @@
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
+ 	freq = ieee80211_channel_to_frequency(notif_bss_info->channel,
+ 		(notif_bss_info->channel <= CH_MAX_2G_CHANNEL) ?
+-		IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ);
++		NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
+ #else
+ 	freq = ieee80211_channel_to_frequency(notif_bss_info->channel);
+ #endif
+@@ -2116,7 +2116,7 @@
+ 				return err;
+ 			}
+ 			chan = wf_chspec_ctlchan(chanspec);
+-			band = (chan <= CH_MAX_2G_CHANNEL) ? IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
++			band = (chan <= CH_MAX_2G_CHANNEL) ? NL80211_BAND_2GHZ : NL80211_BAND_5GHZ;
+ 			freq = ieee80211_channel_to_frequency(chan, band);
+ 			channel = ieee80211_get_channel(wiphy, freq);
+ 			cfg80211_ibss_joined(ndev, (u8 *)&wl->bssid, channel, GFP_KERNEL);
+@@ -2250,10 +2250,10 @@
+ 		join_params->params.chanspec_list[0] =
+ 		    ieee80211_frequency_to_channel(chan->center_freq);
+ 
+-		if (chan->band == IEEE80211_BAND_2GHZ) {
++		if (chan->band == NL80211_BAND_2GHZ) {
+ 			chanspec |= WL_CHANSPEC_BAND_2G;
+ 		}
+-		else if (chan->band == IEEE80211_BAND_5GHZ) {
++		else if (chan->band == NL80211_BAND_5GHZ) {
+ 			chanspec |= WL_CHANSPEC_BAND_5G;
+ 		}
+ 		else {
+@@ -2885,7 +2885,7 @@
+ 
+ 	if (phy == 'n' || phy == 'a' || phy == 'v') {
+ 		wiphy = wl_to_wiphy(wl);
+-		wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_n;
++		wiphy->bands[NL80211_BAND_5GHZ] = &__wl_band_5ghz_n;
+ 	}
+ 
+ 	return err;
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-recent.patch b/pkgs/os-specific/linux/broadcom-sta/linux-recent.patch
deleted file mode 100644
index a690558eb5b8..000000000000
--- a/pkgs/os-specific/linux/broadcom-sta/linux-recent.patch
+++ /dev/null
@@ -1,386 +0,0 @@
---- a/src/wl/sys/wl_cfg80211_hybrid.c	2014-06-26 12:42:08.000000000 +0200
-+++ b/src/wl/sys/wl_cfg80211_hybrid.c	2015-04-13 13:20:08.140013177 +0200
-@@ -63,8 +63,13 @@
- static s32 wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
-            struct cfg80211_ibss_params *params);
- static s32 wl_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 16, 0)
- static s32 wl_cfg80211_get_station(struct wiphy *wiphy,
-            struct net_device *dev, u8 *mac, struct station_info *sinfo);
-+#else
-+static s32 wl_cfg80211_get_station(struct wiphy *wiphy,
-+           struct net_device *dev, const u8 *mac, struct station_info *sinfo);
-+#endif
- static s32 wl_cfg80211_set_power_mgmt(struct wiphy *wiphy,
-            struct net_device *dev, bool enabled, s32 timeout);
- static int wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
-@@ -1387,7 +1392,7 @@
- 	key_endian_to_host(&key);
- 
- 	params.key_len = (u8) min_t(u8, DOT11_MAX_KEY_SIZE, key.len);
--	memcpy(params.key, key.data, params.key_len);
-+	memcpy((char *)params.key, key.data, params.key_len);
- 
- 	if ((err = wl_dev_ioctl(dev, WLC_GET_WSEC, &wsec, sizeof(wsec)))) {
- 		return err;
-@@ -1421,9 +1426,15 @@
- 	return err;
- }
- 
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 16, 0)
- static s32
- wl_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
-                         u8 *mac, struct station_info *sinfo)
-+#else
-+static s32
-+wl_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
-+                        const u8 *mac, struct station_info *sinfo)
-+#endif
- {
- 	struct wl_cfg80211_priv *wl = wiphy_to_wl(wiphy);
- 	scb_val_t scb_val;
-@@ -1441,7 +1452,11 @@
- 		WL_DBG(("Could not get rate (%d)\n", err));
- 	} else {
- 		rate = dtoh32(rate);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0)
- 		sinfo->filled |= STATION_INFO_TX_BITRATE;
-+#else
-+		sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
-+#endif
- 		sinfo->txrate.legacy = rate * 5;
- 		WL_DBG(("Rate %d Mbps\n", (rate / 2)));
- 	}
-@@ -1454,7 +1469,11 @@
- 			return err;
- 		}
- 		rssi = dtoh32(scb_val.val);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0)
- 		sinfo->filled |= STATION_INFO_SIGNAL;
-+#else
-+		sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
-+#endif
- 		sinfo->signal = rssi;
- 		WL_DBG(("RSSI %d dBm\n", rssi));
- 	}
-@@ -2010,9 +2029,15 @@
- 
- 	notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
- 	notify_ielen = le32_to_cpu(bi->ie_length);
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)
- 	cbss = cfg80211_inform_bss(wiphy, channel, (const u8 *)(bi->BSSID.octet),
- 		0, beacon_proberesp->capab_info, beacon_proberesp->beacon_int,
- 		(const u8 *)notify_ie, notify_ielen, signal, GFP_KERNEL);
-+#else
-+	cbss = cfg80211_inform_bss(wiphy, channel, CFG80211_BSS_FTYPE_UNKNOWN, (const u8 *)(bi->BSSID.octet),
-+		0, beacon_proberesp->capab_info, beacon_proberesp->beacon_int,
-+		(const u8 *)notify_ie, notify_ielen, signal, GFP_KERNEL);
-+#endif
- 
- 	if (unlikely(!cbss))
- 		return -ENOMEM;
-@@ -2047,7 +2072,11 @@
- 		}
- 		else if ((event == WLC_E_LINK && ~(flags & WLC_EVENT_MSG_LINK)) ||
- 			event == WLC_E_DEAUTH_IND || event == WLC_E_DISASSOC_IND) {
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
-+			cfg80211_disconnected(ndev, 0, NULL, 0, false, GFP_KERNEL);
-+#else
- 			cfg80211_disconnected(ndev, 0, NULL, 0, GFP_KERNEL);
-+#endif
- 			clear_bit(WL_STATUS_CONNECTED, &wl->status);
- 			wl_link_down(wl);
- 			wl_init_prof(wl->profile);
-@@ -2071,7 +2100,26 @@
- 			wl_get_assoc_ies(wl);
- 			memcpy(&wl->bssid, &e->addr, ETHER_ADDR_LEN);
- 			wl_update_bss_info(wl);
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
-+			{
-+				struct wl_bss_info *bi;
-+				u16 bss_info_channel;
-+				struct ieee80211_channel *channel;
-+				u32 freq;
-+
-+				bi = (struct wl_bss_info *)(wl->extra_buf + 4);
-+				bss_info_channel = bi->ctl_ch ? bi->ctl_ch : CHSPEC_CHANNEL(bi->chanspec);
-+
-+				freq = ieee80211_channel_to_frequency(bss_info_channel,
-+				       (bss_info_channel <= CH_MAX_2G_CHANNEL) ?
-+				       IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ);
-+
-+				channel = ieee80211_get_channel(wl_to_wiphy(wl), freq);
-+				cfg80211_ibss_joined(ndev, (u8 *)&wl->bssid, channel, GFP_KERNEL);
-+			}
-+#else
- 			cfg80211_ibss_joined(ndev, (u8 *)&wl->bssid, GFP_KERNEL);
-+#endif
- 			set_bit(WL_STATUS_CONNECTED, &wl->status);
- 			wl->profile->active = true;
- 		}
-@@ -2629,7 +2677,15 @@
- 
- void wl_cfg80211_detach(struct net_device *ndev)
- {
--	struct wl_cfg80211_priv *wl = ndev_to_wl(ndev);
-+	struct wl_cfg80211_priv *wl;
-+	struct wireless_dev *wdev;
-+	
-+	wdev = ndev->ieee80211_ptr;
-+	if (wdev == NULL) {
-+                printk(KERN_ERR "[%s()] in ndev=%p: IEEE80211ptr=%p\n", __FUNCTION__, ndev, wdev);
-+                return;
-+        }
-+	wl = ndev_to_wl(ndev);
- 
- 	wl_deinit_cfg80211_priv(wl);
- 	wl_free_wdev(wl);
---- a/src/wl/sys/wl_dbg.h	2014-06-26 12:42:08.000000000 +0200
-+++ b/src/wl/sys/wl_dbg.h	2015-04-13 13:19:52.443345832 +0200
-@@ -55,10 +55,12 @@
- 
- #define WL_NONE(args)
- 
-+#define FORCE_TRACE_LEVEL(fmt, ...) do { printk(KERN_ERR fmt, ## __VA_ARGS__); } while (0) /* ## is GCC specific syntax to remove comma when single arg */
-+
- #ifdef BCMDBG_ERR
- #define	WL_ERROR(args)		WL_PRINT(args)
- #else
--#define	WL_ERROR(args)
-+#define	WL_ERROR(args)		FORCE_TRACE_LEVEL args
- #endif 
- #define	WL_TRACE(args)
- #define WL_APSTA_UPDN(args)
---- a/src/wl/sys/wl_linux.c	2014-06-26 12:42:08.000000000 +0200
-+++ b/src/wl/sys/wl_linux.c	2015-04-13 13:19:52.443345832 +0200
-@@ -878,7 +878,7 @@
- static SIMPLE_DEV_PM_OPS(wl_pm_ops, wl_suspend, wl_resume);
- #endif
- 
--static struct pci_driver wl_pci_driver = {
-+static struct pci_driver wl_pci_driver __refdata = {
- 	.name =		"wl",
- 	.probe =	wl_pci_probe,
- 	.remove =	__devexit_p(wl_remove),
-@@ -1270,6 +1270,7 @@
- 		MFREE(wl->osh, wlif->dev, sizeof(struct net_device));
- #else
- 		free_netdev(wlif->dev);
-+		wlif->dev = NULL;
- #endif 
- 	}
- 
-@@ -1307,7 +1308,12 @@
- 	dev->priv = priv_link;
- #else
- 
-+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 17, 0))
- 	dev = alloc_netdev(sizeof(priv_link_t), intf_name, ether_setup);
-+#else
-+	dev = alloc_netdev(sizeof(priv_link_t), intf_name, NET_NAME_UNKNOWN,
-+			   ether_setup);
-+#endif
- 	if (!dev) {
- 		WL_ERROR(("wl%d: %s: alloc_netdev failed\n",
- 			(wl->pub)?wl->pub->unit:wlif->subunit, __FUNCTION__));
-@@ -1651,11 +1657,7 @@
- 	}
- 
- 	WL_LOCK(wl);
--	if (!capable(CAP_NET_ADMIN)) {
--		bcmerror = BCME_EPERM;
--	} else {
--		bcmerror = wlc_ioctl(wl->wlc, ioc.cmd, buf, ioc.len, wlif->wlcif);
--	}
-+	bcmerror = wlc_ioctl(wl->wlc, ioc.cmd, buf, ioc.len, wlif->wlcif);
- 	WL_UNLOCK(wl);
- 
- done1:
-@@ -2157,8 +2159,8 @@
- 	wlif = WL_DEV_IF(dev);
- 	wl = WL_INFO(dev);
- 
-+	skb->prev = NULL;
- 	if (WL_ALL_PASSIVE_ENAB(wl) || (WL_RTR() && WL_CONFIG_SMP())) {
--		skb->prev = NULL;
- 
- 		TXQ_LOCK(wl);
- 
-@@ -2455,8 +2457,10 @@
- 		p80211msg_t *phdr;
- 
- 		len = sizeof(p80211msg_t) + oskb->len - D11_PHY_HDR_LEN;
--		if ((skb = dev_alloc_skb(len)) == NULL)
-+		if ((skb = dev_alloc_skb(len)) == NULL) {
-+			WL_ERROR(("in %s:%d [%s()] dev_alloc_skb() failure!", __FILE__, __LINE__, __FUNCTION__));
- 			return;
-+		}
- 
- 		skb_put(skb, len);
- 		phdr = (p80211msg_t*)skb->data;
-@@ -2535,8 +2539,10 @@
- 			rtap_len = sizeof(wl_radiotap_ht_brcm_2_t);
- 
- 		len = rtap_len + (oskb->len - D11_PHY_HDR_LEN);
--		if ((skb = dev_alloc_skb(len)) == NULL)
-+		if ((skb = dev_alloc_skb(len)) == NULL) {
-+			WL_ERROR(("in %s:%d [%s()] dev_alloc_skb() failure!", __FILE__, __LINE__, __FUNCTION__));
- 			return;
-+		}
- 
- 		skb_put(skb, len);
- 
-@@ -2664,8 +2670,10 @@
- 			len += amsdu_len;
- 		}
- 
--		if ((skb = dev_alloc_skb(len)) == NULL)
-+		if ((skb = dev_alloc_skb(len)) == NULL) {
-+			WL_ERROR(("in %s:%d [%s()] dev_alloc_skb() failure!", __FILE__, __LINE__, __FUNCTION__));
- 			return;
-+		}
- 
- 		skb_put(skb, len);
- 
-@@ -2990,7 +2998,7 @@
- }
- 
- void
--wl_set_monitor(wl_info_t *wl, int val)
-+wl_set_monitor(wl_info_t *wl, int val) /* public => is called by wlc_hybrid.o_shipped */
- {
- 	const char *devname;
- 	wl_if_t *wlif;
-@@ -3224,42 +3232,75 @@
- #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
- static int
- wl_proc_read(char *buffer, char **start, off_t offset, int length, int *eof, void *data)
-+{
-+	wl_info_t * wl = (wl_info_t *)data;
- #else
- static ssize_t
--wl_proc_read(struct file *filp, char __user *buffer, size_t length, loff_t *data)
--#endif
-+wl_proc_read(struct file *filp, char __user *buffer, size_t length, loff_t *offp)
- {
--	wl_info_t * wl = (wl_info_t *)data;
--	int to_user;
--	int len;
-+	wl_info_t * wl = PDE_DATA(file_inode(filp));
-+#endif
-+	int bcmerror, len;
-+	int to_user = 0;
-+	char tmp[8];
- 
- #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
- 	if (offset > 0) {
- 		*eof = 1;
- 		return 0;
- 	}
-+#else
-+	if (*offp > 0) { /* for example, stop: cat /proc/brcm_monitor0 */
-+		return 0; /* 0 <=> EOF */
-+	}
- #endif
- 
--	if (!length) {
--		WL_ERROR(("%s: Not enough return buf space\n", __FUNCTION__));
--		return 0;
--	}
- 	WL_LOCK(wl);
--	wlc_ioctl(wl->wlc, WLC_GET_MONITOR, &to_user, sizeof(int), NULL);
--	len = sprintf(buffer, "%d\n", to_user);
--	WL_UNLOCK(wl);
--	return len;
-+	bcmerror = wlc_ioctl(wl->wlc, WLC_GET_MONITOR, &to_user, sizeof(int), NULL);
-+ 	WL_UNLOCK(wl);
-+
-+	if (bcmerror != BCME_OK) {
-+		WL_ERROR(("%s: GET_MONITOR failed with %d\n", __FUNCTION__, bcmerror));
-+		return -EIO;
-+	}
-+
-+ 	len = snprintf(tmp, ARRAY_SIZE(tmp), "%d\n", to_user);
-+	tmp[ARRAY_SIZE(tmp) - 1] = '\0';
-+	if (len >= ARRAY_SIZE(tmp)) {
-+		printk(KERN_ERR "%s:%d [%s()] output would be truncated (ret=%d)!", __FILE__, __LINE__, __FUNCTION__, len);
-+		return -ERANGE;
-+	}
-+	else if (len < 0) {
-+		printk(KERN_ERR "%s:%d [%s()] unable to convert value (ret=%d)!", __FILE__, __LINE__, __FUNCTION__, len);
-+		return len;
-+	}
-+	if (length < len) {
-+		printk(KERN_ERR "%s:%d [%s()] user buffer is too small (at least=%d ; user=%d)!", __FILE__, __LINE__, __FUNCTION__, len, (int)length);
-+		return -EMSGSIZE;
-+	}
-+	if (copy_to_user(buffer, tmp, len) != 0) {
-+		printk(KERN_ERR "%s:%d [%s()] unable to copy data!", __FILE__, __LINE__, __FUNCTION__);
-+		return -EFAULT;
-+	}
-+	
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)
-+	*offp += len;
-+#endif
-+
-+ 	return len;
- }
- 
- #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
- static int
- wl_proc_write(struct file *filp, const char *buff, unsigned long length, void *data)
-+{
-+	wl_info_t * wl = (wl_info_t *)data;
- #else
- static ssize_t
--wl_proc_write(struct file *filp, const char __user *buff, size_t length, loff_t *data)
--#endif
-+wl_proc_write(struct file *filp, const char __user *buff, size_t length, loff_t *offp)
- {
--	wl_info_t * wl = (wl_info_t *)data;
-+	wl_info_t * wl = PDE_DATA(file_inode(filp));
-+#endif
- 	int from_user = 0;
- 	int bcmerror;
- 
-@@ -3270,7 +3311,11 @@
- 	}
- 	if (copy_from_user(&from_user, buff, 1)) {
- 		WL_ERROR(("%s: copy from user failed\n", __FUNCTION__));
--		return -EIO;
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
-+ 		return -EIO;
-+#else
-+		return -EFAULT;
-+#endif
- 	}
- 
- 	if (from_user >= 0x30)
-@@ -3280,10 +3325,15 @@
- 	bcmerror = wlc_ioctl(wl->wlc, WLC_SET_MONITOR, &from_user, sizeof(int), NULL);
- 	WL_UNLOCK(wl);
- 
--	if (bcmerror < 0) {
-+	if (bcmerror != BCME_OK) {
- 		WL_ERROR(("%s: SET_MONITOR failed with %d\n", __FUNCTION__, bcmerror));
- 		return -EIO;
- 	}
-+	
-+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 0)) && 0 /* no need to update offset because this file should only trigger action... */
-+	*offp += length;
-+#endif
-+
- 	return length;
- }
- 
-@@ -3304,8 +3354,8 @@
- 	if ((wl->proc_entry = create_proc_entry(tmp, 0644, NULL)) == NULL) {
- 		WL_ERROR(("%s: create_proc_entry %s failed\n", __FUNCTION__, tmp));
- #else
--	if ((wl->proc_entry = proc_create(tmp, 0644, NULL, &wl_fops)) == NULL) {
--		WL_ERROR(("%s: proc_create %s failed\n", __FUNCTION__, tmp));
-+	if ((wl->proc_entry = proc_create_data(tmp, 0644, NULL, &wl_fops, wl)) == NULL) {
-+		WL_ERROR(("%s: proc_create_data %s failed\n", __FUNCTION__, tmp));
- #endif
- 		ASSERT(0);
- 		return -1;
diff --git a/pkgs/os-specific/linux/broadcom-sta/null-pointer-fix.patch b/pkgs/os-specific/linux/broadcom-sta/null-pointer-fix.patch
new file mode 100644
index 000000000000..763797294307
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/null-pointer-fix.patch
@@ -0,0 +1,13 @@
+diff -urN a/src/wl/sys/wl_linux.c b/src/wl/sys/wl_linux.c
+--- a/src/wl/sys/wl_linux.c	2015-01-06 12:33:42.981659618 +0100
++++ b/src/wl/sys/wl_linux.c	2015-01-06 12:34:05.647395418 +0100
+@@ -2157,8 +2157,8 @@
+ 	wlif = WL_DEV_IF(dev);
+ 	wl = WL_INFO(dev);
+ 
++	skb->prev = NULL;
+ 	if (WL_ALL_PASSIVE_ENAB(wl) || (WL_RTR() && WL_CONFIG_SMP())) {
+-		skb->prev = NULL;
+ 
+ 		TXQ_LOCK(wl);
+ 
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index e538a527f507..375f0e3b0b42 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -94,8 +94,8 @@ rec {
 
   grsecurity_testing = grsecPatch
     { kver   = "4.6.5";
-      grrev  = "201607272152";
-      sha256 = "120rj3cpvbchihj3w3i9j2fxvap3270kfxjfznw2ljglzf7pi8zc";
+      grrev  = "201607312210";
+      sha256 = "17dnp6w092kvqxqxbdgjpl4mrsn2wkb7z8q5d8ck7dfanpmqap0w";
     };
 
   # This patch relaxes grsec constraints on the location of usermode helpers,
diff --git a/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch b/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch
new file mode 100644
index 000000000000..8d1436c50940
--- /dev/null
+++ b/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch
@@ -0,0 +1,40 @@
+diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-fb.c NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-fb.c
+--- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-fb.c	2016-07-31 19:07:06.595038290 -0400
++++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-fb.c	2016-07-31 19:09:18.532197060 -0400
+@@ -114,7 +114,7 @@
+      * We don't support any planar format, pick up first buffer only.
+      */
+ 
+-    gem = drm_gem_object_lookup(dev, file, cmd->handles[0]);
++    gem = drm_gem_object_lookup(file, cmd->handles[0]);
+ 
+     if (gem == NULL)
+     {
+diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-gem.c NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-gem.c
+--- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-gem.c	2016-07-31 19:07:06.595038290 -0400
++++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-gem.c	2016-07-31 19:08:56.187492736 -0400
+@@ -408,7 +408,7 @@
+ 
+     mutex_lock(&dev->struct_mutex);
+ 
+-    gem = drm_gem_object_lookup(dev, file, handle);
++    gem = drm_gem_object_lookup(file, handle);
+ 
+     if (gem == NULL)
+     {
+diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-uvm/uvm_linux.h NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-uvm/uvm_linux.h
+--- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-uvm/uvm_linux.h	2016-07-31 19:07:06.600038448 -0400
++++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-uvm/uvm_linux.h	2016-07-31 19:08:06.506926763 -0400
+@@ -554,12 +554,6 @@
+     INIT_RADIX_TREE(tree, GFP_NOWAIT);
+ }
+ 
+-static bool radix_tree_empty(struct radix_tree_root *tree)
+-{
+-    void *dummy;
+-    return radix_tree_gang_lookup(tree, &dummy, 0, 1) == 0;
+-}
+-
+ 
+ #if !defined(NV_USLEEP_RANGE_PRESENT)
+ static void __sched usleep_range(unsigned long min, unsigned long max)
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 30a3a912d43b..8ca01b7499e2 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -12,7 +12,7 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "361.45.11";
+  versionNumber = "367.35";
 
   # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
@@ -28,12 +28,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "036v7bzh9zy7zvaz2wf7zsamrynbg1yr1dll7sf1l928w059i6pb";
+        sha256 = "05g36bxcfk21ab8b0ay3zy21k5nd71468p9y1nbflx7ghpx25jrq";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "1f8bxmf8cr3cgzxgap5ccb1yrqyrrdig19dp282y6z9xjq27l074";
+        sha256 = "0m4k8f0212l63h22wk6hgi8fbfsgxqih5mizsw4ixqqmjd75av4a";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
@@ -53,6 +53,8 @@ stdenv.mkDerivation {
     [ gtk atk pango glib gdk_pixbuf cairo ] );
   programPath = makeLibraryPath [ xorg.libXv ];
 
+  patches = if versionAtLeast kernel.version "4.7" then [ ./365.35-kernel-4.7.patch ] else [];
+
   buildInputs = [ perl nukeReferences ];
 
   hardeningDisable = [ "pic" "format" ];