Merge branch 'master' into multiple-outputs

56 files changed, 1260 insertions, 985 deletions

diff --git a/pkgs/os-specific/linux/acpi/default.nix b/pkgs/os-specific/linux/acpi/default.nix
index 6bb44d7db44..d694a9e5ed2 100644
--- a/pkgs/os-specific/linux/acpi/default.nix
+++ b/pkgs/os-specific/linux/acpi/default.nix
@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = {
+    description = "Show battery status and other ACPI information";
     longDescription = ''
       Linux ACPI client is a small command-line
       program that attempts to replicate the functionality of
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index da71eb8c709..858be431a91 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     homepage = http://apparmor.net/;
-    description = "A Linux application security system";
+    description = "Linux application security system";
     license = licenses.gpl2;
     maintainers = [ maintainers.phreedom ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/broadcom-sta-v6/default.nix b/pkgs/os-specific/linux/broadcom-sta-v6/default.nix
new file mode 100644
index 00000000000..db4337c0ff2
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta-v6/default.nix
@@ -0,0 +1,49 @@
+{ stdenv, fetchurl, kernelDev }:
+let
+  version = "6_30_223_141";
+in
+stdenv.mkDerivation {
+  name = "broadcom-sta-${version}-${kernelDev.version}";
+
+  src = if stdenv.system == "i686-linux" then (
+    fetchurl {
+      url = "http://www.broadcom.com/docs/linux_sta/hybrid-v35-nodebug-pcoem-${version}.tar.gz";
+      sha256 = "19wra62dpm0x0byksh871yxr128b4v13kzkzqv56igjfpzv36z6m";
+    } ) else (
+    fetchurl {
+      url = "http://www.broadcom.com/docs/linux_sta/hybrid-v35_64-nodebug-pcoem-${version}.tar.gz";
+      sha256 = "0jlvch7d3khmmg5kp80x4ka33hidj8yykqjcqq6j56z2g6wb4dsz";
+    }
+  );
+
+  buildInputs = [ kernelDev ];
+  patches = [
+    ./linux-recent.patch
+    ./license.patch
+  ];
+
+  makeFlags = "KBASE=${kernelDev}/lib/modules/${kernelDev.modDirVersion}";
+
+  unpackPhase = ''
+      sourceRoot=broadcom-sta
+      mkdir "$sourceRoot"
+      tar xvf "$src" -C "$sourceRoot"
+  '';
+
+  installPhase =
+    ''
+      binDir="$out/lib/modules/${kernelDev.modDirVersion}/kernel/net/wireless/"
+      docDir="$out/share/doc/broadcom-sta/"
+      mkdir -p "$binDir" "$docDir"
+      cp wl.ko "$binDir"
+      cp lib/LICENSE.txt "$docDir"
+    '';
+
+  meta = {
+    description = "Kernel module driver for some Broadcom's wireless cards";
+    homepage = http://www.broadcom.com/support/802.11/linux_sta.php;
+    license = "unfree-redistributable";
+    maintainers = with stdenv.lib.maintainers; [ phreedom vcunat ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/broadcom-sta-v6/license.patch b/pkgs/os-specific/linux/broadcom-sta-v6/license.patch
new file mode 100644
index 00000000000..aebb4636519
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta-v6/license.patch
@@ -0,0 +1,13 @@
+diff -Naur hybrid-portsrc-x86_32-v5_10_91_9.orig/src/wl/sys/wl_linux.c hybrid-portsrc-x86_32-v5_10_91_9/src/wl/sys/wl_linux.c
+--- hybrid-portsrc-x86_32-v5_10_91_9.orig/src/wl/sys/wl_linux.c	2009-04-23 02:48:59.000000000 +0900
++++ hybrid-portsrc-x86_32-v5_10_91_9/src/wl/sys/wl_linux.c	2009-05-08 00:48:20.000000000 +0900
+@@ -171,6 +171,8 @@
+ static void wl_free_if(wl_info_t *wl, wl_if_t *wlif);
+ static void wl_get_driver_info(struct net_device *dev, struct ethtool_drvinfo *info);
+ 
++MODULE_LICENSE("MIXED/Proprietary");
++
+ #if defined(WL_CONFIG_RFKILL)
+ #include <linux/rfkill.h>
+ static int wl_init_rfkill(wl_info_t *wl);
+
diff --git a/pkgs/os-specific/linux/broadcom-sta-v6/linux-recent.patch b/pkgs/os-specific/linux/broadcom-sta-v6/linux-recent.patch
new file mode 100644
index 00000000000..97a331a2bd7
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta-v6/linux-recent.patch
@@ -0,0 +1,126 @@
+--- a/src/wl/sys/wl_linux.c	2013-08-01 08:52:22.000000000 +0200
++++ b/src/wl/sys/wl_linux.c	2013-09-13 14:25:36.463020788 +0200
+@@ -910,7 +910,11 @@
+ 	pci_set_drvdata(pdev, NULL);
+ }
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+ static struct pci_driver wl_pci_driver = {
++#else
++static struct pci_driver wl_pci_driver __refdata = {
++#endif
+ 	name:		"wl",
+ 	probe:		wl_pci_probe,
+ 	suspend:	wl_suspend,
+@@ -3235,7 +3239,7 @@
+ void
+ wl_tkip_printstats(wl_info_t *wl, bool group_key)
+ {
+-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14) && LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
+ 	char debug_buf[512];
+ 	int idx;
+ 	if (wl->tkipmodops) {
+@@ -3408,6 +3412,7 @@
+ 	return 0;
+ }
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
+ static int
+ wl_proc_read(char *buffer, char **start, off_t offset, int length, int *eof, void *data)
+ {
+@@ -3462,19 +3467,90 @@
+ 	return length;
+ }
+ 
++#else
++
++static int
++wl_proc_read(struct seq_file *seq, void *offset)
++{
++	wl_info_t * wl = (wl_info_t *)seq->private;
++	int bcmerror, to_user;
++
++	WL_LOCK(wl);
++	bcmerror = wlc_ioctl(wl->wlc, WLC_GET_MONITOR, &to_user, sizeof(int), NULL);
++	WL_UNLOCK(wl);
++
++	seq_printf(seq, "%d\n", to_user);
++	return bcmerror;
++}
++
++static ssize_t wl_proc_write(struct file *file, const char __user *buff,
++			     size_t length, loff_t *ppos)
++{
++	struct seq_file *seq = file->private_data;
++	wl_info_t * wl = (wl_info_t *)seq->private;
++	int bcmerror, from_user = 0;
++
++	if (length != 1) {
++		WL_ERROR(("%s: Invalid data length\n", __FUNCTION__));
++		return -EIO;
++	}
++
++	if (copy_from_user(&from_user, buff, 1)) {
++		WL_ERROR(("%s: copy from user failed\n", __FUNCTION__));
++		return -EFAULT;
++	}
++
++	if (from_user >= 0x30)
++		from_user -= 0x30;
++
++	WL_LOCK(wl);
++	bcmerror = wlc_ioctl(wl->wlc, WLC_SET_MONITOR, &from_user, sizeof(int), NULL);
++	WL_UNLOCK(wl);
++
++	if (bcmerror < 0) {
++		WL_ERROR(("%s: SET_MONITOR failed with %d\n", __FUNCTION__, bcmerror));
++		return -EIO;
++	}
++	*ppos += length;
++	return length;
++}
++
++static int wl_proc_open(struct inode *inode, struct file *file)
++{
++	return single_open(file, wl_proc_read, PDE_DATA(inode));
++}
++
++static const struct file_operations wl_proc_fops = {
++	.owner = THIS_MODULE,
++	.open = wl_proc_open,
++	.read = seq_read,
++	.write = wl_proc_write,
++	.llseek = seq_lseek,
++	.release = single_release,
++};
++#endif
++
+ static int
+ wl_reg_proc_entry(wl_info_t *wl)
+ {
+ 	char tmp[32];
+ 	sprintf(tmp, "%s%d", HYBRID_PROC, wl->pub->unit);
+-	if ((wl->proc_entry = create_proc_entry(tmp, 0644, NULL)) == NULL) {
++
++#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
++	wl->proc_entry = create_proc_entry(tmp, 0644, NULL);
++	if (wl->proc_entry) {
++		wl->proc_entry->read_proc = wl_proc_read;
++		wl->proc_entry->write_proc = wl_proc_write;
++		wl->proc_entry->data = wl;
++	} 
++#else
++	wl->proc_entry = proc_create_data(tmp, 0644, NULL, &wl_proc_fops, wl);
++#endif
++	if (!wl->proc_entry) {
+ 		WL_ERROR(("%s: create_proc_entry %s failed\n", __FUNCTION__, tmp));
+ 		ASSERT(0);
+ 		return -1;
+ 	}
+-	wl->proc_entry->read_proc = wl_proc_read;
+-	wl->proc_entry->write_proc = wl_proc_write;
+-	wl->proc_entry->data = wl;
+ 	return 0;
+ }
+ #ifdef WLOFFLD
diff --git a/pkgs/os-specific/linux/conspy/default.nix b/pkgs/os-specific/linux/conspy/default.nix
new file mode 100644
index 00000000000..44689cd5d62
--- /dev/null
+++ b/pkgs/os-specific/linux/conspy/default.nix
@@ -0,0 +1,37 @@
+{stdenv, fetchurl, autoconf, automake, ncurses}:
+let
+  s = # Generated upstream information
+  rec {
+    baseName="conspy";
+    version="1.8";
+    name="${baseName}-${version}";
+    hash=sha256;
+    url="http://ace-host.stuart.id.au/russell/files/conspy/conspy-1.8.tar.gz";
+    sha256="1jc2maqp4w4mzlr3s8yni03w1p9sir5hb7gha3ffxj4n32nx42dq";
+  };
+  buildInputs = [
+    autoconf automake ncurses
+  ];
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
+  src = fetchurl {
+    inherit (s) url sha256;
+    curlOpts = " -A application/octet-stream ";
+  };
+  preConfigure = ''
+    touch NEWS
+    echo "EPL 1.0" > COPYING
+    aclocal
+    automake --add-missing
+    autoconf
+  '';
+  meta = {
+    inherit (s) version;
+    description = "Linux text console viewer";
+    license = stdenv.lib.licenses.epl10 ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/conspy/default.upstream b/pkgs/os-specific/linux/conspy/default.upstream
new file mode 100644
index 00000000000..db0c0fd9680
--- /dev/null
+++ b/pkgs/os-specific/linux/conspy/default.upstream
@@ -0,0 +1 @@
+url http://ace-host.stuart.id.au/russell/files/conspy/
diff --git a/pkgs/os-specific/linux/dstat/default.nix b/pkgs/os-specific/linux/dstat/default.nix
index fb454c78788..138b4ff468f 100644
--- a/pkgs/os-specific/linux/dstat/default.nix
+++ b/pkgs/os-specific/linux/dstat/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = http://dag.wieers.com/home-made/dstat/;
-    description = "Versatile resource statistics tool.";
+    description = "Versatile resource statistics tool";
     license = "GPLv2";
     platforms = stdenv.lib.platforms.linux;
     maintainers = [ ];
diff --git a/pkgs/os-specific/linux/forktty/default.nix b/pkgs/os-specific/linux/forktty/default.nix
new file mode 100644
index 00000000000..6402b5c69d8
--- /dev/null
+++ b/pkgs/os-specific/linux/forktty/default.nix
@@ -0,0 +1,36 @@
+{stdenv, fetchurl}:
+let
+  s = # Generated upstream information
+  rec {
+    baseName="forktty";
+    version="1.3";
+    name="${baseName}-${version}";
+    hash="0nd55zdqly6nl98k9lc7j751x86cw9hayx1qn0725f22r1x3j5zb";
+    url="http://sunsite.unc.edu/pub/linux/utils/terminal/forktty-1.3.tgz";
+    sha256="0nd55zdqly6nl98k9lc7j751x86cw9hayx1qn0725f22r1x3j5zb";
+  };
+  buildInputs = [
+  ];
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
+  src = fetchurl {
+    inherit (s) url sha256;
+  };
+  preBuild = ''
+    sed -e s@/usr/bin/ginstall@install@g -i Makefile
+  '';
+  preInstall = ''
+    mkdir -p "$out/bin"
+    mkdir -p "$out/share/man/man8"
+  '';
+  makeFlags='' prefix="''${out}" manprefix="''${out}/share/" '';
+  meta = {
+    inherit (s) version;
+    description = ''Tool to detach from controlling TTY and attach to another'';
+    license = stdenv.lib.licenses.gpl2 ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/forktty/default.upstream b/pkgs/os-specific/linux/forktty/default.upstream
new file mode 100644
index 00000000000..45cb775a0ae
--- /dev/null
+++ b/pkgs/os-specific/linux/forktty/default.upstream
@@ -0,0 +1,2 @@
+url http://sunsite.unc.edu/pub/linux/utils/terminal/
+version_link 'forktty.*tgz'
diff --git a/pkgs/os-specific/linux/gfxtablet/default.nix b/pkgs/os-specific/linux/gfxtablet/default.nix
new file mode 100644
index 00000000000..394defdb19a
--- /dev/null
+++ b/pkgs/os-specific/linux/gfxtablet/default.nix
@@ -0,0 +1,35 @@
+{stdenv, fetchgit, linuxHeaders}:
+let
+  s = # Generated upstream information
+  rec {
+    version="git-2013-10-21";
+    name = "gfxtablet-uinput-driver-${version}";
+    rev = "c4e337ae0b53a8ccdfe11b904ff129714bd25ec4";
+    sha256 = "19d96r2vw9xv82fnfwdyyyf0fja6n06mgg14va996knsn2x5l4la";
+    url = "https://github.com/rfc2822/GfxTablet.git";
+  };
+  buildInputs = [
+    linuxHeaders
+  ];
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
+  src = fetchgit {
+    inherit (s) url sha256 rev;
+  };
+  preBuild = ''cd driver-uinput'';
+  installPhase = ''
+    mkdir -p "$out/bin"
+    cp networktablet "$out/bin"
+    mkdir -p "$out/share/doc/gfxtablet/"
+    cp ../*.md "$out/share/doc/gfxtablet/"
+  '';
+  meta = {
+    inherit (s) version;
+    description = ''Uinput driver for Android GfxTablet tablet-as-input-device app'';
+    license = stdenv.lib.licenses.mit ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
index b8e5055f056..410fa6a7ad6 100644
--- a/pkgs/os-specific/linux/hostapd/default.nix
+++ b/pkgs/os-specific/linux/hostapd/default.nix
@@ -2,11 +2,11 @@
 stdenv.mkDerivation rec {
 
   name = "hostapd-${version}";
-  version = "1.0";
+  version = "2.0";
 
   src = fetchurl {
-    url = "http://w1.fi/releases/${name}.tar.gz";
-    sha256 = "1k6z2g0g324593a7ybd76bywvj0gnf9cybqaj2sq5ks6gv5rsbh0";
+    url = "http://hostap.epitest.fi/releases/${name}.tar.gz";
+    sha256 = "262ce394b930bccc3d65fb99ee380f28d36444978f524c845a98e8e29f4e9d35";
   };
 
   buildInputs = [ libnl openssl pkgconfig ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   preInstall = "mkdir -p $out/bin";
 
   meta = with stdenv.lib; {
-    homepage = http://w1.fi/hostapd/;
+    homepage = http://hostap.epitest.fi;
     description = "A user space daemon for access point and authentication servers";
     license = licenses.gpl2;
     maintainers = [ maintainers.phreedom ];
diff --git a/pkgs/os-specific/linux/i7z/default.nix b/pkgs/os-specific/linux/i7z/default.nix
index 2d0fde3c783..33ac05aef47 100644
--- a/pkgs/os-specific/linux/i7z/default.nix
+++ b/pkgs/os-specific/linux/i7z/default.nix
@@ -1,19 +1,15 @@
 { stdenv, fetchurl, qt4, ncurses}:
 
 stdenv.mkDerivation rec {
-  name = "i7z-0.27.1";
+  name = "i7z-0.27.2";
 
   src = fetchurl {
     url = "http://i7z.googlecode.com/files/${name}.tar.gz";
-    sha256 = "0n3pry1qmpq4basnny3gddls2zlwz0813ixnas87092rvlgjhbc6";
+    sha256 = "1wa7ix6m75wl3k2n88sz0x8cckvlzqklja2gvzqfw5rcfdjjvxx7";
   };
 
   buildInputs = [qt4 ncurses];
 
-  patchPhase = ''
-    substituteInPlace Makefile --replace "/usr/sbin" "$out/sbin"
-  '';
-
   buildPhase = ''
     make
     cd GUI
@@ -24,15 +20,15 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    pwd
     ensureDir $out/sbin
-    make install
+    make install prefix=$out
     install -Dm755 GUI/i7z_GUI $out/sbin/i7z-gui
   '';
 
   meta = {
     description = "A better i7 (and now i3, i5) reporting tool for Linux";
     homepage = http://code.google.com/p/i7z;
+    repositories.git = https://github.com/ajaiantilal/i7z.git;
     license = "GPLv2";
     maintainers = [ stdenv.lib.maintainers.bluescreen303 ];
   };
diff --git a/pkgs/os-specific/linux/iotop/default.nix b/pkgs/os-specific/linux/iotop/default.nix
index e394b612388..8e181d3d5cf 100644
--- a/pkgs/os-specific/linux/iotop/default.nix
+++ b/pkgs/os-specific/linux/iotop/default.nix
@@ -1,16 +1,22 @@
 { stdenv, fetchurl, buildPythonPackage, pythonPackages }:
 
 buildPythonPackage rec {
-  name = "iotop-0.4.1";
+  name = "iotop-0.6";
   namePrefix = "";
 
   src = fetchurl {
     url = "http://guichaz.free.fr/iotop/files/${name}.tar.bz2";
-    sha256 = "1dfvw3khr2rvqllvs9wad9ca3ld4i7szqf0ibq87rn36ickrf3ll";
+    sha256 = "0nzprs6zqax0cwq8h7hnszdl3d2m4c2d4vjfxfxbnjfs9sia5pis";
   };
 
   pythonPath = [ pythonPackages.curses ];
 
+  postInstall =
+    ''
+      # Put the man page in the right place.
+      mv $out/lib/python*/site-packages/iotop-*/share $out
+    '';
+
   doCheck = false;
 
   meta = {
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index d4f7c4e6718..01a605aac30 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -86,9 +86,6 @@ with stdenv.lib;
   ''}
   BCMA_HOST_PCI y
 
-  # Some settings to make sure that fbcondecor works - in particular,
-  # disable tileblitting and the drivers that need it.
-
   # Enable various FB devices.
   FB y
   FB_EFI y
@@ -169,6 +166,9 @@ with stdenv.lib;
   SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
   DEVKMEM n # Disable /dev/kmem
   CC_STACKPROTECTOR y # Detect buffer overflows on the stack
+  ${optionalString (versionAtLeast version "3.12") ''
+    USER_NS y # Support for user namespaces
+  ''}
 
   # Misc. options.
   8139TOO_8129 y
@@ -242,6 +242,8 @@ with stdenv.lib;
     CGROUP_MEM_RES_CTLR_SWAP y
   ''}
   DEVPTS_MULTIPLE_INSTANCES y
+  BLK_DEV_THROTTLING y
+  CFQ_GROUP_IOSCHED y
 
   # Enable staging drivers.  These are somewhat experimental, but
   # they generally don't hurt.
diff --git a/pkgs/os-specific/linux/kernel/linux-3.0.nix b/pkgs/os-specific/linux/kernel/linux-3.0.nix
index 48197ae14ca..30b70035dfa 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.0.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.0.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.0.88";
+  version = "3.0.99";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1icfkbn9a5cpwiax1xklvpqyjcvqij3dwib009fipp53z4pn5bz4";
+    sha256 = "1p31gq9kzwfks980y6rb2mjyagj8lrh6y156a550v7mk0bd4fzdi";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.10.nix b/pkgs/os-specific/linux/kernel/linux-3.10.nix
index fa57fdd93dd..65660619857 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.10.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.10.10";
+  version = "3.10.15";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "01cpg6j1jsjh4vgvmia12y6rci4gqb967gc0gqpz5gcimzg4bb5p";
+    sha256 = "07wjh58sylbbw9hwxd5xvbz3dxd05iar8ahzk90lki38m5157ffk";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.11.nix b/pkgs/os-specific/linux/kernel/linux-3.11.nix
index 34b2d488289..6531895d8a7 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.11.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.11.nix
@@ -1,12 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.11";
-  modDirVersion = "3.11.0";
+  version = "3.11.6";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1yfpa4fzhsn4r5dwkcf3azy0vqdms865jaikn3fdwbabmpqchgl0";
+    sha256 = "0klbyx6qy3ifwrwh5w7yzk6m6jd32flkk73z95bih3ihmbnbzlvs";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.12.nix b/pkgs/os-specific/linux/kernel/linux-3.12.nix
new file mode 100644
index 00000000000..f0929af1d29
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@@ -0,0 +1,16 @@
+{ stdenv, fetchurl, ... } @ args:
+
+import ./generic.nix (args // rec {
+  version = "3.12-rc3";
+
+  src = fetchurl {
+    url = "https://www.kernel.org/pub/linux/kernel/v3.0/testing/linux-${version}.tar.xz";
+    sha256 = "1rayb0f4n81yp9ghcws0v36dpqyl9ks3naf37p2qy7jvrwagmj28";
+  };
+
+  features.iwlwifi = true;
+  features.efiBootStub = true;
+  features.needsCifsUtils = true;
+  features.canDisableNetfilterConntrackHelpers = true;
+  features.netfilterRPFilter = true;
+})
diff --git a/pkgs/os-specific/linux/kernel/linux-3.2.nix b/pkgs/os-specific/linux/kernel/linux-3.2.nix
index 7597a9c695e..ae065499c65 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.2.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.2.50";
+  version = "3.2.52";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0yg936syhay9x0qxqxdqrgi6ijdqklhqdrd8zk7l4zvgxaayaj68";
+    sha256 = "1wpr5xs6vg0xjlzrlbkv7bjvv34psw57crkdh4lybghi4rgrmkzl";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.4.nix b/pkgs/os-specific/linux/kernel/linux-3.4.nix
index 5bcb8aaf250..47393b0ae74 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.4.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.4.60";
+  version = "3.4.67";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "16pg9sdsf5nwp1lc583dcbn1ay67b7yb55xg8cgv63bvmh4h3vrb";
+    sha256 = "1ndzlwhxvlm4lr86240h3ysxhmdkgdcp0n6qhid5nwrmxf5fpb1d";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 561cdc8f957..613f40c6fc9 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -131,12 +131,14 @@ rec {
       patch = ./mips-ext3-n32.patch;
     };
 
-  grsecurity_2_9_1_3_2_50 =
-    { name = "grsecurity-2.9.1-3.2.50";
+  grsecurity_2_9_1_3_2_52 =
+    { name = "grsecurity-2.9.1-3.2.52";
       patch = fetchurl {
-        url = http://grsecurity.net/stable/grsecurity-2.9.1-3.2.50-201308052151.patch;
-        sha256 = "178y68bx4h4r9gq1p4izbjah8vhjmb3yvr3sfjglz8blxxahgd6n";
+        url = http://grsecurity.net/stable/grsecurity-2.9.1-3.2.52-201310271550.patch;
+        sha256 = "08y4y323y2lfvdj67gmg3ca8gaf3snhr3pyrmgvj877avaz0475m";
       };
+      # The grsec kernel patch seems to include the apparmor patches as of 2.9.1-3.2.52
+      features.apparmor = true;
     };
 
 }
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index 0feba1b1c31..09594a5c59e 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -1,17 +1,18 @@
-{ stdenv, fetchurl, zlib, xz}:
+{ stdenv, fetchurl, zlib }:
+
+stdenv.mkDerivation rec {
+  name = "kexec-tools-2.0.4";
 
-stdenv.mkDerivation {
-  name = "kexectools-2.0.3";
-  
   src = fetchurl {
-    url = http://horms.net/projects/kexec/kexec-tools/kexec-tools-2.0.3.tar.xz;
-    sha256 = "1ac6szvm6pdhn5b8ba5l06rx09rylsqhgv1l6wmy4b5b1hrbip52";
+    url = "http://horms.net/projects/kexec/kexec-tools/${name}.tar.xz";
+    sha256 = "1ikqm4w125h060dsvg9brri6ma51qn76mjjff6s1bss6sw0apxg5";
   };
 
-  buildInputs = [ xz zlib ];
-  
+  buildInputs = [ zlib ];
+
   meta = {
-    homepage = http://horms.net/projects/kexec/kexec-tools/;
-    description = "Tools related to the kexec linux feature";
+    homepage = http://horms.net/projects/kexec/kexec-tools;
+    description = "Tools related to the kexec Linux feature";
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/lvm2/assume-uevent-generated.patch b/pkgs/os-specific/linux/lvm2/assume-uevent-generated.patch
deleted file mode 100644
index 4098d042fd5..00000000000
--- a/pkgs/os-specific/linux/lvm2/assume-uevent-generated.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-Work around LVM/cryptsetup errors like:
-
-  semid 32768: semop failed for cookie 0xd4d41f4: incorrect semaphore state
-  Failed to set a proper state for notification semaphore identified by cookie value 223166964 (0xd4d41f4) to initialize waiting for incoming notifications.
-
-and (when running "cryptsetup --debug"):
-
-  Uevent not generated! Calling udev_complete internally to avoid process lock-up.
-
-Here for some reason libdm *thinks* that the uevent hasn't been
-emitted, so it calls udev_complete.  But the uevent actually *has*
-been emitted, so udev calls ‘dmsetup udevcomplete’ as well, leading to
-a race.
-
-This is probably a reoccurence of the problem described here:
-
-  http://www.redhat.com/archives/dm-devel/2011-August/msg00075.html
-  http://www.redhat.com/archives/linux-lvm/2011-September/msg00023.html
-
-which was fixed in the kernel, so it's not clear why it's surfacing
-again.  Maybe netlink_broadcast_filtered() has started returning some
-other bogus error code.
-  
-diff -ru -x '*~' LVM2.2.02.98/libdm/ioctl/libdm-iface.c LVM2.2.02.98-new/libdm/ioctl/libdm-iface.c
---- LVM2.2.02.98/libdm/ioctl/libdm-iface.c	2012-10-15 10:24:58.000000000 -0400
-+++ LVM2.2.02.98-new/libdm/ioctl/libdm-iface.c	2012-10-15 14:19:06.774363736 -0400
-@@ -1754,9 +1754,12 @@
- 
- 	if (ioctl_with_uevent && dm_udev_get_sync_support() &&
- 	    !_check_uevent_generated(dmi)) {
-+		log_debug("warning: Uevent might not be generated!");
-+#if 0
- 		log_debug("Uevent not generated! Calling udev_complete "
- 			  "internally to avoid process lock-up.");
- 		_udev_complete(dmt);
-+#endif
- 	}
- 
- 	if (!_dm_ioctl_unmangle_names(dmt->type, dmi))
diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix
index ec68304c935..53127e4458c 100644
--- a/pkgs/os-specific/linux/lvm2/default.nix
+++ b/pkgs/os-specific/linux/lvm2/default.nix
@@ -1,19 +1,17 @@
 { stdenv, fetchurl, pkgconfig, udev, utillinux, coreutils }:
 
 let
-  v = "2.02.98";
+  v = "2.02.100";
 in
 
 stdenv.mkDerivation {
   name = "lvm2-${v}";
 
   src = fetchurl {
-    url = "ftp://sources.redhat.com/pub/lvm2/old/LVM2.${v}.tgz";
-    sha256 = "0r6q6z8ip6q5qgkzng0saljassp4912k6i21ra10vq7pzrc0l0vi";
+    url = "ftp://sources.redhat.com/pub/lvm2/releases/LVM2.${v}.tgz";
+    md5 = "9629cf5728544d7e637cafde1f73d777";
   };
 
-  patches = [ ./assume-uevent-generated.patch ];
-
   configureFlags =
     "--disable-readline --enable-udev_rules --enable-udev_sync --enable-pkgconfig --enable-applib";
 
@@ -24,7 +22,11 @@ stdenv.mkDerivation {
       substituteInPlace scripts/lvmdump.sh \
         --replace /usr/bin/tr ${coreutils}/bin/tr
       substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
-        --replace /usr/sbin/lvm $out/sbin/lvm
+        --replace /usr/sbin/lvm $out/sbin/lvm \
+        --replace /usr/bin/udevadm ${udev}/bin/udevadm
+
+      sed -i /DEFAULT_SYS_DIR/d Makefile.in
+      sed -i /DEFAULT_PROFILE_DIR/d conf/Makefile.in
     '';
 
   #patches = [ ./purity.patch ];
@@ -39,6 +41,11 @@ stdenv.mkDerivation {
     ''
       substituteInPlace $out/lib/udev/rules.d/13-dm-disk.rules \
         --replace $out/sbin/blkid ${utillinux}/sbin/blkid
+
+      # Systemd stuff
+      mkdir -p $out/etc/systemd/system $out/lib/systemd/system-generators
+      cp scripts/blk_availability_systemd_red_hat.service $out/etc/systemd/system
+      cp scripts/lvm2_activation_generator_systemd_red_hat $out/lib/systemd/system-generators
     '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index c1dec8b926a..5a9b3587870 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -1,20 +1,18 @@
-{ stdenv, fetchurl, libcap, apparmor, perl, docbook2x, docbook_xml_dtd_45 }:
+{ stdenv, autoreconfHook, fetchurl, libcap, apparmor, perl, docbook2x
+, docbook_xml_dtd_45, gnutls, pkgconfig
+}:
 
 stdenv.mkDerivation rec {
-  name = "lxc-0.9.0";
+  name = "lxc-1.0.0.alpha1-92-g8111adf";
 
   src = fetchurl {
-    url = "mirror://sourceforge/lxc/${name}.tar.gz";
-    sha256 = "0821clxymkgp71n720xj5ngs22s2v8jks68f5j4vypycwvm6f5qy";
+    url = "http://github.com/lxc/lxc/archive/${name}.tar.gz";
+    sha256 = "05hjrn79wyjnm4ynf8y0j7pk2hwfrzp4dzwynxq4z2wxlc1ficd5";
   };
 
-  buildInputs = [ libcap apparmor perl docbook2x ];
+  buildInputs = [ libcap apparmor perl docbook2x gnutls autoreconfHook pkgconfig ];
 
-  patches = [
-    ./dont-run-ldconfig.patch
-    ./install-localstatedir-in-store.patch
-    ./support-db2x.patch
-  ];
+  patches = [ ./install-localstatedir-in-store.patch ./support-db2x.patch ];
 
   preConfigure = "export XML_CATALOG_FILES=${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml";
 
diff --git a/pkgs/os-specific/linux/lxc/dont-run-ldconfig.patch b/pkgs/os-specific/linux/lxc/dont-run-ldconfig.patch
deleted file mode 100644
index 6904eec5175..00000000000
--- a/pkgs/os-specific/linux/lxc/dont-run-ldconfig.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff -ubr lxc-0.9.0-orig/src/lxc/Makefile.am lxc-0.9.0/src/lxc/Makefile.am
---- lxc-0.9.0-orig/src/lxc/Makefile.am	2013-04-15 10:50:22.898102973 +0200
-+++ lxc-0.9.0/src/lxc/Makefile.am	2013-04-15 10:50:44.264862808 +0200
-@@ -193,7 +193,6 @@
- 	mkdir -p $(DESTDIR)$(datadir)/lxc
- 	install -c -m 644 lxc.functions $(DESTDIR)$(datadir)/lxc
- 	mv $(DESTDIR)$(libdir)/liblxc.so $(DESTDIR)$(libdir)/liblxc.so.$(VERSION)
--	/sbin/ldconfig -l $(DESTDIR)$(libdir)/liblxc.so.$(VERSION)
- 	cd $(DESTDIR)$(libdir); \
- 	ln -sf liblxc.so.$(VERSION) liblxc.so.$(firstword $(subst ., ,$(VERSION))); \
- 	ln -sf liblxc.so.$(firstword $(subst ., ,$(VERSION))) liblxc.so
-diff -ubr lxc-0.9.0-orig/src/lxc/Makefile.in lxc-0.9.0/src/lxc/Makefile.in
---- lxc-0.9.0-orig/src/lxc/Makefile.in	2013-04-15 10:50:22.898102973 +0200
-+++ lxc-0.9.0/src/lxc/Makefile.in	2013-04-15 10:51:08.755810177 +0200
-@@ -1519,7 +1519,6 @@
- 	mkdir -p $(DESTDIR)$(datadir)/lxc
- 	install -c -m 644 lxc.functions $(DESTDIR)$(datadir)/lxc
- 	mv $(DESTDIR)$(libdir)/liblxc.so $(DESTDIR)$(libdir)/liblxc.so.$(VERSION)
--	/sbin/ldconfig -l $(DESTDIR)$(libdir)/liblxc.so.$(VERSION)
- 	cd $(DESTDIR)$(libdir); \
- 	ln -sf liblxc.so.$(VERSION) liblxc.so.$(firstword $(subst ., ,$(VERSION))); \
- 	ln -sf liblxc.so.$(firstword $(subst ., ,$(VERSION))) liblxc.so
diff --git a/pkgs/os-specific/linux/lxc/install-localstatedir-in-store.patch b/pkgs/os-specific/linux/lxc/install-localstatedir-in-store.patch
index 061875aa3b6..d45335a0232 100644
--- a/pkgs/os-specific/linux/lxc/install-localstatedir-in-store.patch
+++ b/pkgs/os-specific/linux/lxc/install-localstatedir-in-store.patch
@@ -1,7 +1,8 @@
-diff -ubr lxc-0.9.0-orig/Makefile.am lxc-0.9.0/Makefile.am
---- lxc-0.9.0-orig/Makefile.am	2013-04-15 10:50:22.899103057 +0200
-+++ lxc-0.9.0/Makefile.am	2013-04-15 10:58:41.189504254 +0200
-@@ -25,8 +25,8 @@
+diff --git a/Makefile.am b/Makefile.am
+index eac2bfd..8f040d3 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -25,8 +25,8 @@ pcdatadir = $(libdir)/pkgconfig
  pcdata_DATA = lxc.pc
  
  install-data-local:
@@ -12,17 +13,3 @@ diff -ubr lxc-0.9.0-orig/Makefile.am lxc-0.9.0/Makefile.am
  
  ChangeLog::
  	@touch ChangeLog
-diff -ubr lxc-0.9.0-orig/Makefile.in lxc-0.9.0/Makefile.in
---- lxc-0.9.0-orig/Makefile.in	2013-04-15 10:50:22.899103057 +0200
-+++ lxc-0.9.0/Makefile.in	2013-04-15 10:58:58.817870957 +0200
-@@ -805,8 +805,8 @@
- 
- 
- install-data-local:
--	$(MKDIR_P) $(DESTDIR)$(LXCPATH)
--	$(MKDIR_P) $(DESTDIR)$(localstatedir)/cache/lxc
-+	$(MKDIR_P) $(out)$(LXCPATH)
-+	$(MKDIR_P) $(out)$(localstatedir)/cache/lxc
- 
- ChangeLog::
- 	@touch ChangeLog
diff --git a/pkgs/os-specific/linux/lxc/support-db2x.patch b/pkgs/os-specific/linux/lxc/support-db2x.patch
index 8be7f5f0a92..4662ca2e504 100644
--- a/pkgs/os-specific/linux/lxc/support-db2x.patch
+++ b/pkgs/os-specific/linux/lxc/support-db2x.patch
@@ -1,29 +1,16 @@
-diff -ubr lxc-0.9.0-orig/configure lxc-0.9.0/configure
---- lxc-0.9.0-orig/configure	2013-04-15 10:50:22.899103057 +0200
-+++ lxc-0.9.0/configure	2013-04-15 11:08:08.696539776 +0200
-@@ -4792,7 +4792,7 @@
- 
- 	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for docbook2x-man" >&5
- $as_echo_n "checking for docbook2x-man... " >&6; }
--	for name in docbook2x-man db2x_docbook2man; do
-+	for name in docbook2x-man db2x_docbook2man docbook2man; do
- 		if "$name" --help >/dev/null 2>&1; then
- 			db2xman="$name"
- 			break;
-@@ -8353,4 +8353,3 @@
-   { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
- $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
+diff --git a/configure.ac b/configure.ac
+index 92a4690..4dd341b 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -91,9 +91,9 @@ if test "x$enable_doc" = "xyes" -o "x$enable_doc" = "xauto"; then
+ 	AC_SUBST(db2xman)
  fi
--
-diff -ubr lxc-0.9.0-orig/configure.ac lxc-0.9.0/configure.ac
---- lxc-0.9.0-orig/configure.ac	2013-04-15 10:50:22.896102806 +0200
-+++ lxc-0.9.0/configure.ac	2013-04-15 11:07:52.399582819 +0200
-@@ -67,7 +67,7 @@
- 	db2xman=""
+ AM_CONDITIONAL([ENABLE_DOCBOOK], [test "x$db2xman" != "x"])
+-AM_CONDITIONAL([USE_DOCBOOK2X], [test "x$db2xman" != "xdocbook2man"])
++AM_CONDITIONAL([USE_DOCBOOK2X], [test "x$db2xman" != "no-no-no"])
  
- 	AC_MSG_CHECKING(for docbook2x-man)
--	for name in docbook2x-man db2x_docbook2man; do
-+	for name in docbook2x-man db2x_docbook2man docbook2man; do
- 		if "$name" --help >/dev/null 2>&1; then
- 			db2xman="$name"
- 			break;
+-if test "x$db2xman" = "xdocbook2man"; then
++if test "x$db2xman" = "no-no-no"; then
+ 	docdtd="\"-//Davenport//DTD DocBook V3.0//EN\""
+ else
+ 	docdtd="\"-//OASIS//DTD DocBook XML\" \"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd\""
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index ad7cea18084..d96a4943625 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, microcode2ucode }:
 
-let version = "20130808"; in
+let version = "20130906"; in
 
 stdenv.mkDerivation {
   name = "microcode-intel-${version}";
 
   src = fetchurl {
-    url = "http://downloadmirror.intel.com/23082/eng/microcode-${version}.tgz";
-    sha256 = "19v0059v6dxv7ly57wgqy9nkjjnmprgwz4s94khdf213k5vikpfm";
+    url = "http://downloadmirror.intel.com/23166/eng/microcode-${version}.tgz";
+    sha256 = "11k327icvijadq2zkgkc3sqwzraip9cviqm25566g09523ds0svv";
   };
 
   buildInputs = [ microcode2ucode ];
diff --git a/pkgs/os-specific/linux/mountall/default.nix b/pkgs/os-specific/linux/mountall/default.nix
deleted file mode 100644
index 4cad810cc5f..00000000000
--- a/pkgs/os-specific/linux/mountall/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, libnih, dbus, udev, gettext, autoreconfHook }:
-
-stdenv.mkDerivation {
-  name = "mountall-2.35";
-
-  src = fetchurl {
-    url = https://launchpad.net/ubuntu/+archive/primary/+files/mountall_2.35.tar.gz;
-    sha256 = "1k52d4x75balnwcsqgznvzrdqgbp2dqnrzw0n25kajdcwr192wwy";
-  };
-
-  patches = [ ./no-plymouth.patch ./fix-usr1-race.patch ];
-
-  buildInputs = [ pkgconfig libnih dbus.libs udev gettext autoreconfHook ];
-
-  makeFlags = "initramfshookdir=$(out)/share/initramfs-tools/hooks upstart_jobs_initramfs_configdir=$(out)/share/initramfs-tools/event-driven/upstart-jobs";
-
-  meta = {
-    homepage = https://launchpad.net/ubuntu/+source/mountall;
-    description = "Utility to mount all filesystems and emit Upstart events";
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/mountall/fix-usr1-race.patch b/pkgs/os-specific/linux/mountall/fix-usr1-race.patch
deleted file mode 100644
index e970b77733c..00000000000
--- a/pkgs/os-specific/linux/mountall/fix-usr1-race.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff -ru mountall-2.35-orig/src/mountall.c mountall-2.35/src/mountall.c
---- mountall-2.35-orig/src/mountall.c	2012-03-20 11:01:14.035898815 +0100
-+++ mountall-2.35/src/mountall.c	2012-03-20 11:20:39.194786311 +0100
-@@ -3746,6 +3746,12 @@
- 		exit (EXIT_ERROR);
- 	}
- 
-+	/* SIGUSR1 tells us that a network device came up.  Install
-+           the handler before daemonising so that the mountall-net job
-+           won't kill us by sending USR1. */
-+	nih_signal_set_handler (SIGUSR1, nih_signal_handler);
-+	NIH_MUST (nih_signal_add_handler (NULL, SIGUSR1, usr1_handler, NULL));
-+
- 	/* Become daemon */
- 	if (daemonise) {
- 		pid_t pid;
-@@ -3799,10 +3805,6 @@
- 	nih_signal_set_handler (SIGTERM, nih_signal_handler);
- 	NIH_MUST (nih_signal_add_handler (NULL, SIGTERM, nih_main_term_signal, NULL));
- 
--	/* SIGUSR1 tells us that a network device came up */
--	nih_signal_set_handler (SIGUSR1, nih_signal_handler);
--	NIH_MUST (nih_signal_add_handler (NULL, SIGUSR1, usr1_handler, NULL));
--
- 	/* Check for force-fsck on the kernel command line */
- 	cmdline = fopen ("/proc/cmdline", "r");
- 	if (cmdline) {
diff --git a/pkgs/os-specific/linux/mountall/no-plymouth.patch b/pkgs/os-specific/linux/mountall/no-plymouth.patch
deleted file mode 100644
index 890dab9bc88..00000000000
--- a/pkgs/os-specific/linux/mountall/no-plymouth.patch
+++ /dev/null
@@ -1,295 +0,0 @@
-diff -ru -x '*~' mountall-2.31-orig/configure.ac mountall-2.31/configure.ac
---- mountall-2.31-orig/configure.ac	2011-07-15 14:00:15.000000000 +0200
-+++ mountall-2.31/configure.ac	2011-07-25 00:13:13.000000000 +0200
-@@ -29,7 +29,7 @@
- PKG_CHECK_MODULES([NIH_DBUS], [libnih-dbus >= 1.0.0])
- PKG_CHECK_MODULES([DBUS], [dbus-1 >= 1.2.16])
- PKG_CHECK_MODULES([UDEV], [libudev >= 146])
--PKG_CHECK_MODULES([PLYMOUTH], [ply-boot-client >= 0.8.0])
-+#PKG_CHECK_MODULES([PLYMOUTH], [ply-boot-client >= 0.8.0])
- 
- # Checks for header files.
- 
-diff -ru -x '*~' mountall-2.31-orig/src/mountall.c mountall-2.31/src/mountall.c
---- mountall-2.31-orig/src/mountall.c	2011-07-15 14:00:15.000000000 +0200
-+++ mountall-2.31/src/mountall.c	2011-07-25 00:21:13.000000000 +0200
-@@ -64,8 +64,10 @@
- #include <nih-dbus/dbus_proxy.h>
- #include <nih-dbus/errors.h>
- 
-+#if 0
- #include <ply-event-loop.h>
- #include <ply-boot-client.h>
-+#endif
- 
- #include "ioprio.h"
- 
-@@ -219,15 +221,19 @@
- void   boredom_timeout       (void *data, NihTimer *timer);
- 
- int    plymouth_connect      (void);
-+#if 0
- void   plymouth_disconnected (void *user_data, ply_boot_client_t *client);
-+#endif
- 
- void   plymouth_progress     (Mount *mnt, int progress);
- void   plymouth_update       (int only_clear);
- 
-+#if 0
- void   plymouth_response     (void *user_data, ply_boot_client_t *client);
- void   plymouth_failed       (void *user_data, ply_boot_client_t *client);
- void   plymouth_answer       (void *user_data, const char *keys,
- 			      ply_boot_client_t *client);
-+#endif
- 
- void   usr1_handler          (void *data, NihSignal *signal);
- int    set_dev_wait_time        (NihOption *option, const char *arg);
-@@ -247,8 +253,10 @@
-  **/
- size_t num_local = 0;
- size_t num_local_mounted = 0;
-+size_t num_local_failed = 0;
- size_t num_remote = 0;
- size_t num_remote_mounted = 0;
-+size_t num_remote_failed = 0;
- size_t num_virtual = 0;
- size_t num_virtual_mounted = 0;
- size_t num_swap = 0;
-@@ -318,6 +326,7 @@
-  **/
- static struct udev *udev = NULL;
- 
-+#if 0
- /**
-  * ply_event_loop:
-  *
-@@ -331,6 +340,7 @@
-  * Plymouth boot client.
-  **/
- static ply_boot_client_t *ply_boot_client = NULL;
-+#endif
- 
- /**
-  * plymouth_error:
-@@ -1253,11 +1263,12 @@
- 			nih_debug ("%s is root filesystem", MOUNT_NAME (mnt));
- 			tag = TAG_LOCAL;
- 		} else if (is_remote (mnt)) {
--			if ((! strcmp (mnt->mountpoint, "/usr"))
-+			if ((! has_option (mnt, "nobootwait", FALSE)) && (
-+                            (! strcmp (mnt->mountpoint, "/usr"))
- 			    || (! strcmp (mnt->mountpoint, "/var"))
- 			    || (! strncmp (mnt->mountpoint, "/usr/", 5))
- 			    || (! strncmp (mnt->mountpoint, "/var/", 5))
--			    || (has_option (mnt, "bootwait", FALSE)))
-+			    || (has_option (mnt, "bootwait", FALSE))))
- 			{
- 				tag = TAG_REMOTE;
- 			} else {
-@@ -1566,7 +1577,8 @@
- 	/* Enforce local only after virtual filesystems triggered */
- 	if ((! local_triggered)
- 	    && virtual_triggered
--	    && (num_local_mounted == num_local)) {
-+	    && (num_local_mounted == num_local)
-+	    && (num_local_failed == 0)) {
- 		nih_info (_("%s finished"), "local");
- 		emit_event ("local-filesystems", NULL);
- 		local_triggered = TRUE;
-@@ -1575,7 +1587,8 @@
- 	/* Enforce remote only after virtual filesystems triggrered */
- 	if ((! remote_triggered)
- 	    && virtual_triggered
--	    && (num_remote_mounted == num_remote)) {
-+	    && (num_remote_mounted == num_remote)
-+	    && (num_remote_failed == 0)) {
- 		nih_info (_("%s finished"), "remote");
- 		emit_event ("remote-filesystems", NULL);
- 		remote_triggered = TRUE;
-@@ -1585,7 +1598,9 @@
- 	if ((! filesystem_triggered)
- 	    && virtual_triggered
- 	    && local_triggered
--	    && remote_triggered) {
-+	    && remote_triggered
-+	    && (num_local_failed == 0)
-+	    && (num_remote_failed == 0)) {
- 		nih_info (_("All filesystems mounted"));
- 		emit_event ("filesystem", NULL);
- 		filesystem_triggered = TRUE;
-@@ -1599,9 +1614,9 @@
- 		swap_triggered = TRUE;
- 	}
- 
--	nih_info ("local %zi/%zi remote %zi/%zi virtual %zi/%zi swap %zi/%zi",
--		   num_local_mounted, num_local,
--		   num_remote_mounted, num_remote,
-+	nih_info ("local %zi/%zi/%zi remote %zi/%zi/%zi virtual %zi/%zi swap %zi/%zi",
-+		   num_local_mounted, num_local, num_local_failed,
-+		   num_remote_mounted, num_remote, num_remote_failed,
- 		   num_virtual_mounted, num_virtual,
- 		   num_swap_mounted, num_swap);
- }
-@@ -2442,12 +2457,14 @@
- 	if (no_events)
- 		return;
- 
-+#if 0
- 	/* Flush the Plymouth connection to ensure all updates are sent,
- 	 * since the event may kill plymouth.
- 	 */
- 	if (ply_boot_client)
- 		ply_boot_client_flush (ply_boot_client);
--
-+#endif
-+        
- 	env = NIH_MUST (nih_str_array_new (NULL));
- 
- 	if (mnt) {
-@@ -3026,6 +3043,7 @@
- int
- plymouth_connect (void)
- {
-+#if 0
- 	/* If we were already connected, just re-use that connection */
- 	if (ply_boot_client)
- 		return TRUE;
-@@ -3052,8 +3070,13 @@
- 	nih_info (_("Connected to Plymouth"));
- 
- 	return TRUE;
-+#else
-+        return FALSE;
-+#endif
- }
- 
-+
-+#if 0
- void
- plymouth_disconnected (void *             user_data,
- 		       ply_boot_client_t *client)
-@@ -3066,6 +3089,7 @@
- 	ply_boot_client_free (ply_boot_client);
- 	ply_boot_client = NULL;
- }
-+#endif
- 
- 
- void
-@@ -3076,6 +3100,7 @@
- 
- 	nih_assert (mnt != NULL);
- 
-+#if 0
- 	/* No Plymouth => no progress information */
- 	if (! plymouth_connect ())
- 		return;
-@@ -3105,6 +3130,7 @@
- 				       plymouth_response,
- 				       plymouth_failed,
- 				       NULL);
-+#endif
- }
- 
- void
-@@ -3120,20 +3146,31 @@
- 		NIH_LIST_FOREACH (mounts, iter) {
- 			Mount *mnt = (Mount *)iter;
- 
--			if (mnt->error <= ERROR_BORED)
-+			if (mnt->error == ERROR_NONE)
- 				continue;
- 
--			nih_error (_("Skipping mounting %s since Plymouth is not available"),
-+			nih_error (_("Could not mount %s"),
- 				   MOUNT_NAME (mnt));
- 
- 			mnt->error = ERROR_NONE;
- 
-+			if (mnt->tag == TAG_LOCAL) {
-+			    num_local_failed++;
-+			    emit_event ("mount-failed", mnt);
-+			}
-+			
-+			if (mnt->tag == TAG_REMOTE) {
-+			    num_remote_failed++;
-+			    emit_event ("mount-failed", mnt);
-+			}
-+
- 			skip_mount (mnt);
- 		}
- 
- 		return;
- 	}
- 
-+#if 0
- 	/* If we're already displaying messages, don't change them unless
- 	 * the message is no longer valid for that mount point; otherwise
- 	 * clear the message.
-@@ -3244,8 +3281,10 @@
- 							   plymouth_answer,
- 							   plymouth_failed,
- 							   NULL);
-+#endif
- }
- 
-+#if 0
- void
- plymouth_response (void *             user_data,
- 		   ply_boot_client_t *client)
-@@ -3364,6 +3403,7 @@
- 		break;
- 	}
- }
-+#endif
- 
- /*
-  * set_dev_wait_time:
-@@ -3399,7 +3439,6 @@
-         return err;
- }
- 
--
- /**
-  * stop_mountpoint_timer:
-  * @mountpoint: mountpoint whose timer you want to stop.
-@@ -3673,6 +3712,7 @@
- 				    (NihIoWatcher)udev_monitor_watcher,
- 				    udev_monitor));
- 
-+#if 0
- 	/* Initialise a Plymouth event loop; this is an epoll instance that
- 	 * we can poll within our own main loop and call out to when needs
- 	 * be.
-@@ -3686,6 +3726,7 @@
- 
- 	/* Attempt an early connection to Plymouth */
- 	plymouth_connect ();
-+#endif
- 
- 	mounts = NIH_MUST (nih_list_new (NULL));
- 
-@@ -3698,7 +3739,9 @@
- 	 * from /etc/fstab and /proc/self/mountinfo to find out what else
- 	 * we need to do.
- 	 */
-+#if 0
- 	parse_fstab (BUILTIN_FSTAB);
-+#endif
- 	parse_fstab (_PATH_MNTTAB);
- 	parse_mountinfo ();
- 
-@@ -3822,10 +3865,12 @@
- 	/* Flush the D-Bus connection to ensure all messages are sent */
- 	dbus_connection_flush (connection);
- 
-+#if 0
- 	/* Flush the Plymouth connection to ensure all updates are sent */
- 	if (ply_boot_client)
- 		ply_boot_client_flush (ply_boot_client);
--
-+#endif
-+        
- 	return ret;
- }
- 
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index f8413b0e541..35595a7b8f4 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -10,7 +10,7 @@ with stdenv.lib;
 
 let
 
-  versionNumber = "319.49";
+  versionNumber = "319.60";
 
 in
 
@@ -28,12 +28,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://us.download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "1ngss9zw109a5xfr3vvhf1ajqjvvqc7j3dzw9h56vddck6kpbc22";
+        sha256 = "0kjidkwd2b5aik74663mxk3ffq4a3fmaybq2aq1lcbfhvvh49j6j";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://us.download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "1i68jfms8033p2x0r3z4fdjcmkkhbi6yizzc0ck9ydagdgg3liwp";
+        sha256 = "0fhrxcfsw2jaycnz9gr04c9w585wydx8kpm6rjjbw19wkf8hlq3z";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
diff --git a/pkgs/os-specific/linux/pam_ccreds/default.nix b/pkgs/os-specific/linux/pam_ccreds/default.nix
index 4d48c86dd14..7f84918156c 100644
--- a/pkgs/os-specific/linux/pam_ccreds/default.nix
+++ b/pkgs/os-specific/linux/pam_ccreds/default.nix
@@ -14,6 +14,6 @@ stdenv.mkDerivation {
   buildInputs = [pam openssl db];
   meta = {
     homepage = "http://www.padl.com/OSS/pam_ccreds.html";
-    description = "The pam_ccreds module provides the means for Linux workstations to locally authenticate using an enterprise identity when the network is unavailable.";
+    description = "PAM module to locally authenticate using an enterprise identity when the network is unavailable";
   };
 }
diff --git a/pkgs/os-specific/linux/pam_krb5/default.nix b/pkgs/os-specific/linux/pam_krb5/default.nix
index 62f9b5c119b..5f95811e0f6 100644
--- a/pkgs/os-specific/linux/pam_krb5/default.nix
+++ b/pkgs/os-specific/linux/pam_krb5/default.nix
@@ -14,6 +14,10 @@ stdenv.mkDerivation {
   meta = {
 #    homepage = "http://www.eyrie.org/~eagle/software/pam-krb5";
     homepage = "https://fedorahosted.org/pam_krb5/";
-    description = "The pam_krb5 module allows PAM-aware applications to authenticate users by performing an AS exchange with a Kerberos KDC. It can optionally convert Kerberos 5 credentials to Kerberos IV credentials and/or use them to set up AFS tokens for a user's session.";
+    description = "PAM module allowing PAM-aware applications to authenticate users by performing an AS exchange with a Kerberos KDC";
+    longDescription = ''
+      pam_krb5 can optionally convert Kerberos 5 credentials to Kerberos IV
+      credentials and/or use them to set up AFS tokens for a user's session.
+    '';
   };
 }
diff --git a/pkgs/os-specific/linux/splashutils/default.nix b/pkgs/os-specific/linux/splashutils/default.nix
deleted file mode 100644
index 86bdd7eee9b..00000000000
--- a/pkgs/os-specific/linux/splashutils/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ stdenv, fetchurl, zlib, libjpeg }:
-
-stdenv.mkDerivation {
-  name = "splashutils-1.5.4.3";
-
-  src = fetchurl {
-    url = http://dev.gentoo.org/~spock/projects/splashutils/current/splashutils-1.5.4.3.tar.bz2;
-    sha256 = "0vn0ifqp9a3bmprzx2yr82hgq8m2y5xv8qcifs2plz6p3lidagpg";
-  };
-
-  buildInputs = [ zlib libjpeg ];
-  
-  configureFlags = "--without-ttf --without-png --without-gpm --with-themedir=/etc/splash KLCC=gcc";
-
-  dontDisableStatic = true;
-
-  preConfigure = ''
-    configureFlags="$configureFlags --with-essential-prefix=$out"
-    substituteInPlace src/common.h \
-      --replace 'FBSPLASH_DIR"/sys"' '"/sys"' \
-      --replace 'FBSPLASH_DIR"/proc"' '"/proc"'
-    substituteInPlace src/Makefile.in \
-      --replace '-all-static' "" \
-      --replace '-static' ""
-  '';
-
-  CPP = "gcc -E";
-  CXXCPP = "g++ -E";
-  NIX_CFLAGS_COMPILE = "-fPIC";
-
-  passthru = {
-    helperName = "sbin/fbcondecor_helper";
-    controlName = "sbin/fbcondecor_ctl";
-    helperProcFile = "/proc/sys/kernel/fbcondecor";
-  };
-}
diff --git a/pkgs/os-specific/linux/systemd/0001-Make-systemctl-daemon-reexec-do-the-right-thing-on-N.patch b/pkgs/os-specific/linux/systemd/0001-Make-systemctl-daemon-reexec-do-the-right-thing-on-N.patch
deleted file mode 100644
index bcc8d8f32f7..00000000000
--- a/pkgs/os-specific/linux/systemd/0001-Make-systemctl-daemon-reexec-do-the-right-thing-on-N.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 8f861550827e750fb56954c3f91a2f565abb42bb Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 15:44:33 +0100
-Subject: [PATCH 1/9] Make "systemctl daemon-reexec" do the right thing on
- NixOS
-
----
- src/core/main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/core/main.c b/src/core/main.c
-index 7fc06be..7575223 100644
---- a/src/core/main.c
-+++ b/src/core/main.c
-@@ -1857,7 +1857,7 @@ finish:
-                         char_array_0(sfd);
- 
-                         i = 0;
--                        args[i++] = SYSTEMD_BINARY_PATH;
-+                        args[i++] = "/run/current-system/systemd/lib/systemd/systemd";
-                         if (switch_root_dir)
-                                 args[i++] = "--switched-root";
-                         args[i++] = arg_running_as == SYSTEMD_SYSTEM ? "--system" : "--user";
--- 
-1.8.2.1
-
diff --git a/pkgs/os-specific/linux/systemd/0002-Ignore-duplicate-paths-in-systemctl-start.patch b/pkgs/os-specific/linux/systemd/0002-Ignore-duplicate-paths-in-systemctl-start.patch
deleted file mode 100644
index 27ac6183efc..00000000000
--- a/pkgs/os-specific/linux/systemd/0002-Ignore-duplicate-paths-in-systemctl-start.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 2afcee0b4da066fb5f8fc00b749d88f5bd9df3d3 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 15:45:01 +0100
-Subject: [PATCH 2/9] Ignore duplicate paths in "systemctl start"
-
----
- src/systemctl/systemctl.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/systemctl/systemctl.c b/src/systemctl/systemctl.c
-index 3cca861..16791a2 100644
---- a/src/systemctl/systemctl.c
-+++ b/src/systemctl/systemctl.c
-@@ -1867,7 +1867,7 @@ static int start_unit_one(
-                         return log_oom();
- 
-                 r = set_consume(s, p);
--                if (r < 0) {
-+                if (r < 0 && r != -EEXIST) {
-                         log_error("Failed to add path to set.");
-                         return r;
-                 }
--- 
-1.8.2.1
-
diff --git a/pkgs/os-specific/linux/systemd/0003-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0003-Start-device-units-for-uninitialised-encrypted-devic.patch
deleted file mode 100644
index ad162fa789a..00000000000
--- a/pkgs/os-specific/linux/systemd/0003-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From b288ca7d376e3a78368a2b59529ebe5ba812babf Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 15:46:30 +0100
-Subject: [PATCH 3/9] Start device units for uninitialised encrypted devices
-
-This is necessary because the NixOS service that initialises the
-filesystem depends on the appearance of the device unit.  Also, this
-makes more sense to me: the device is ready; it's the filesystem
-that's not, but taking care of that is the responsibility of the mount
-unit.  (However, this ignores the fsck unit, so it's not perfect...)
----
- rules/99-systemd.rules.in | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/rules/99-systemd.rules.in b/rules/99-systemd.rules.in
-index d17bdd9..040b10e 100644
---- a/rules/99-systemd.rules.in
-+++ b/rules/99-systemd.rules.in
-@@ -14,10 +14,6 @@ KERNEL=="vport*", TAG+="systemd"
- SUBSYSTEM=="block", KERNEL!="ram*|loop*", TAG+="systemd"
- SUBSYSTEM=="block", KERNEL!="ram*|loop*", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
- 
--# Ignore encrypted devices with no identified superblock on it, since
--# we are probably still calling mke2fs or mkswap on it.
--SUBSYSTEM=="block", KERNEL!="ram*|loop*", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
--
- # Ignore raid devices that are not yet assembled and started
- SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
- SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
--- 
-1.8.2.1
-
diff --git a/pkgs/os-specific/linux/systemd/0004-Set-switch-to-configuration-hints-for-some-units.patch b/pkgs/os-specific/linux/systemd/0004-Set-switch-to-configuration-hints-for-some-units.patch
deleted file mode 100644
index 7fe18f378f9..00000000000
--- a/pkgs/os-specific/linux/systemd/0004-Set-switch-to-configuration-hints-for-some-units.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 7a498e661f3d111fa09700a6cfa62cfd6733b1cc Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 15:48:19 +0100
-Subject: [PATCH 4/9] Set switch-to-configuration hints for some units
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Target units like local-fs.target need ‘X-StopOnReconfiguration=yes’
-to ensure dependencies *on* that target properly take into account the
-dependencies *of* the target.
-
-‘X-RestartIfChanged=no’ is necessary for systemd-journald.service
-because restarting it causes services connected to journald to stop
-logging.
-
-‘X-RestartIfChanged=no’ is necessary for systemd-user-sessions.service
-to prevent all user sessions from being killed when this unit changes.
----
- units/local-fs.target                  | 2 ++
- units/remote-fs.target                 | 2 ++
- units/systemd-journald.service.in      | 5 +++++
- units/systemd-user-sessions.service.in | 3 +++
- 4 files changed, 12 insertions(+)
-
-diff --git a/units/local-fs.target b/units/local-fs.target
-index 18c3d74..a09054c 100644
---- a/units/local-fs.target
-+++ b/units/local-fs.target
-@@ -11,3 +11,5 @@ Documentation=man:systemd.special(7)
- After=local-fs-pre.target
- OnFailure=emergency.target
- OnFailureIsolate=no
-+
-+X-StopOnReconfiguration=yes
-diff --git a/units/remote-fs.target b/units/remote-fs.target
-index 09213e8..47b4cf5 100644
---- a/units/remote-fs.target
-+++ b/units/remote-fs.target
-@@ -10,5 +10,7 @@ Description=Remote File Systems
- Documentation=man:systemd.special(7)
- After=remote-fs-pre.target
- 
-+X-StopOnReconfiguration=yes
-+
- [Install]
- WantedBy=multi-user.target
-diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in
-index ab2e50c..9563a7d 100644
---- a/units/systemd-journald.service.in
-+++ b/units/systemd-journald.service.in
-@@ -24,3 +24,8 @@ CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG C
- # Increase the default a bit in order to allow many simultaneous
- # services being run since we keep one fd open per service.
- LimitNOFILE=16384
-+
-+# Don't restart journald, since that causes services connected to
-+# journald to stop logging (see
-+# https://bugs.freedesktop.org/show_bug.cgi?id=56043).
-+X-RestartIfChanged=no
-diff --git a/units/systemd-user-sessions.service.in b/units/systemd-user-sessions.service.in
-index 0869e73..b6ed958 100644
---- a/units/systemd-user-sessions.service.in
-+++ b/units/systemd-user-sessions.service.in
-@@ -15,3 +15,6 @@ Type=oneshot
- RemainAfterExit=yes
- ExecStart=@rootlibexecdir@/systemd-user-sessions start
- ExecStop=@rootlibexecdir@/systemd-user-sessions stop
-+
-+# Restart kills all active sessions.
-+X-RestartIfChanged=no
--- 
-1.8.2.1
-
diff --git a/pkgs/os-specific/linux/systemd/0005-sysinit.target-Drop-the-dependency-on-local-fs.targe.patch b/pkgs/os-specific/linux/systemd/0005-sysinit.target-Drop-the-dependency-on-local-fs.targe.patch
deleted file mode 100644
index 78683f0cf08..00000000000
--- a/pkgs/os-specific/linux/systemd/0005-sysinit.target-Drop-the-dependency-on-local-fs.targe.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From e6bbe5fa858bd8196c8e1f264904679e6bda426d Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 15:56:03 +0100
-Subject: [PATCH 5/9] sysinit.target: Drop the dependency on local-fs.target
- and swap.target
-
-Having all services with DefaultDependencies=yes depend on
-local-fs.target is annoying, because some of those services might be
-necessary to mount local filesystems.  For instance, Charon's
-send-keys feature requires sshd to be running in order to receive LUKS
-encryption keys, which in turn requires dhcpcd, and so on.  So we drop
-this dependency (and swap.target as well for consistency).  If
-services require a specific mount, they should use RequiresMountsFor
-in any case.
----
- units/sysinit.target | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/units/sysinit.target b/units/sysinit.target
-index 8f4fb8f..e0f0147 100644
---- a/units/sysinit.target
-+++ b/units/sysinit.target
-@@ -9,6 +9,5 @@
- Description=System Initialization
- Documentation=man:systemd.special(7)
- Conflicts=emergency.service emergency.target
--Wants=local-fs.target swap.target
--After=local-fs.target swap.target emergency.service emergency.target
-+After=emergency.service emergency.target
- RefuseManualStart=yes
--- 
-1.8.2.1
-
diff --git a/pkgs/os-specific/linux/systemd/0006-Don-t-call-plymouth-quit.patch b/pkgs/os-specific/linux/systemd/0006-Don-t-call-plymouth-quit.patch
deleted file mode 100644
index e440f6113dc..00000000000
--- a/pkgs/os-specific/linux/systemd/0006-Don-t-call-plymouth-quit.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 4731a9074538e9e24d2b81fc737917b064e194e6 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 8 Jan 2013 18:36:28 +0100
-Subject: [PATCH 6/9] Don't call "plymouth quit"
-
-NixOS doesn't use Plymouth (yet).
----
- units/emergency.service.in | 1 -
- units/rescue.service.m4.in | 1 -
- 2 files changed, 2 deletions(-)
-
-diff --git a/units/emergency.service.in b/units/emergency.service.in
-index 442f0e0..6b7eafd 100644
---- a/units/emergency.service.in
-+++ b/units/emergency.service.in
-@@ -15,7 +15,6 @@ Before=shutdown.target
- [Service]
- Environment=HOME=/root
- WorkingDirectory=/root
--ExecStartPre=-/bin/plymouth quit
- ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type "journalctl -xb" to view\\nsystem logs, "systemctl reboot" to reboot, "systemctl default" to try again\\nto boot into default mode.'
- ExecStart=-/sbin/sulogin
- ExecStopPost=@SYSTEMCTL@ --fail --no-block default
-diff --git a/units/rescue.service.m4.in b/units/rescue.service.m4.in
-index 269797a..2c640f4 100644
---- a/units/rescue.service.m4.in
-+++ b/units/rescue.service.m4.in
-@@ -16,7 +16,6 @@ Before=shutdown.target
- [Service]
- Environment=HOME=/root
- WorkingDirectory=/root
--ExecStartPre=-/bin/plymouth quit
- ExecStartPre=-/bin/echo -e 'Welcome to rescue mode! Type "systemctl default" or ^D to enter default mode.\\nType "journalctl -xb" to view system logs. Type "systemctl reboot" to reboot.'
- ExecStart=-/sbin/sulogin
- ExecStopPost=-@SYSTEMCTL@ --fail --no-block default
--- 
-1.8.2.1
-
diff --git a/pkgs/os-specific/linux/systemd/0007-Ignore-IPv6-link-local-addresses.patch b/pkgs/os-specific/linux/systemd/0007-Ignore-IPv6-link-local-addresses.patch
deleted file mode 100644
index 9c322c9fc59..00000000000
--- a/pkgs/os-specific/linux/systemd/0007-Ignore-IPv6-link-local-addresses.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From f0c362873860526579bf9bda216005fd5a0936dd Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Mon, 4 Feb 2013 12:41:14 +0100
-Subject: [PATCH 7/9] Ignore IPv6 link-local addresses
-
-Returning IPv6 link-local addresses is a bad idea, because they only
-work if an application connects specifically over the corresponding
-interface.  So you get errors like:
-
-  $ curl -6 http://my-machine/
-  curl: (7) Failed to connect to fe80::d6be:d9ff:fe1b:8477: Invalid argument
-
-To prevent this, this patch filters out link-local addresses.  So if
-you don't have a routable IPv6 address, nss-myhostname will fall back
-to returning ::1.
----
- src/nss-myhostname/netlink.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/nss-myhostname/netlink.c b/src/nss-myhostname/netlink.c
-index b1ef912..4f2ab5c 100644
---- a/src/nss-myhostname/netlink.c
-+++ b/src/nss-myhostname/netlink.c
-@@ -113,6 +113,10 @@ static int read_reply(int fd, struct address **list, unsigned *n_list) {
-                     ifaddrmsg->ifa_scope == RT_SCOPE_NOWHERE)
-                         continue;
- 
-+                if (ifaddrmsg->ifa_family == AF_INET6 &&
-+                    ifaddrmsg->ifa_scope == RT_SCOPE_LINK)
-+                        continue;
-+
-                 if (ifaddrmsg->ifa_flags & IFA_F_DEPRECATED)
-                         continue;
- 
--- 
-1.8.2.1
-
diff --git a/pkgs/os-specific/linux/systemd/0008-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0008-Don-t-try-to-unmount-nix-or-nix-store.patch
deleted file mode 100644
index 803227031f7..00000000000
--- a/pkgs/os-specific/linux/systemd/0008-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 0112df74e576dd683c132ec33861b7099dc94454 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Fri, 12 Apr 2013 13:16:57 +0200
-Subject: [PATCH 8/9] Don't try to unmount /nix or /nix/store
-
-They'll still be remounted read-only.
-
-https://github.com/NixOS/nixos/issues/126
----
- src/core/umount.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/core/umount.c b/src/core/umount.c
-index 1e95ad7..9f0e471 100644
---- a/src/core/umount.c
-+++ b/src/core/umount.c
-@@ -435,6 +435,8 @@ static int mount_points_list_umount(MountPoint **head, bool *changed, bool log_e
-                  * anyway, since we are running from it. They have
-                  * already been remounted ro. */
-                 if (path_equal(m->path, "/")
-+                    || path_equal(m->path, "/nix")
-+                    || path_equal(m->path, "/nix/store")
- #ifndef HAVE_SPLIT_USR
-                     || path_equal(m->path, "/usr")
- #endif
--- 
-1.8.2.1
-
diff --git a/pkgs/os-specific/linux/systemd/0009-Start-ctrl-alt-del.target-irreversibly.patch b/pkgs/os-specific/linux/systemd/0009-Start-ctrl-alt-del.target-irreversibly.patch
deleted file mode 100644
index d0bade9ba5b..00000000000
--- a/pkgs/os-specific/linux/systemd/0009-Start-ctrl-alt-del.target-irreversibly.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From ed7c22c76e1399861ec8e0216f08a7f9419eea50 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Tue, 7 May 2013 14:03:13 +0200
-Subject: [PATCH 9/9] Start ctrl-alt-del.target irreversibly
-
-This makes ctrl-alt-del reboots more robust, just like "systemctl
-reboot".
----
- src/core/manager.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/core/manager.c b/src/core/manager.c
-index c7f8f20..0508628 100644
---- a/src/core/manager.c
-+++ b/src/core/manager.c
-@@ -1372,7 +1372,7 @@ static int manager_process_signal_fd(Manager *m) {
- 
-                 case SIGINT:
-                         if (m->running_as == SYSTEMD_SYSTEM) {
--                                manager_start_target(m, SPECIAL_CTRL_ALT_DEL_TARGET, JOB_REPLACE);
-+                                manager_start_target(m, SPECIAL_CTRL_ALT_DEL_TARGET, JOB_REPLACE_IRREVERSIBLY);
-                                 break;
-                         }
- 
--- 
-1.8.2.1
-
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 4f0157e48ca..4e6c64d4c7b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchurl, pkgconfig, intltool, gperf, libcap, dbus, kmod
 , xz, pam, acl, cryptsetup, libuuid, m4, utillinux
 , glib, kbd, libxslt, coreutils, libgcrypt, sysvtools, docbook_xsl
+, kexectools
 }:
 
 assert stdenv.isLinux;
@@ -17,16 +18,11 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "man" "libudev" ];
 
   patches =
-    [ ./0001-Make-systemctl-daemon-reexec-do-the-right-thing-on-N.patch
-      ./0002-Ignore-duplicate-paths-in-systemctl-start.patch
-      ./0003-Start-device-units-for-uninitialised-encrypted-devic.patch
-      ./0004-Set-switch-to-configuration-hints-for-some-units.patch
-      ./0005-sysinit.target-Drop-the-dependency-on-local-fs.targe.patch
-      ./0006-Don-t-call-plymouth-quit.patch
-      ./0007-Ignore-IPv6-link-local-addresses.patch
-      ./0008-Don-t-try-to-unmount-nix-or-nix-store.patch
-      ./0009-Start-ctrl-alt-del.target-irreversibly.patch
-    ] ++ stdenv.lib.optional stdenv.isArm ./libc-bug-accept4-arm.patch;
+    [ # These are all changes between upstream and
+      # https://github.com/edolstra/systemd/tree/nixos-v203.
+      ./fixes.patch
+    ]
+    ++ stdenv.lib.optional stdenv.isArm ./libc-bug-accept4-arm.patch;
 
   buildInputs =
     [ pkgconfig intltool gperf libcap dbus.libs kmod xz pam acl
@@ -52,7 +48,7 @@ stdenv.mkDerivation rec {
     ''
       # FIXME: patch this in systemd properly (and send upstream).
       # FIXME: use sulogin from util-linux once updated.
-      for i in src/remount-fs/remount-fs.c src/core/mount.c src/core/swap.c src/fsck/fsck.c units/emergency.service.in units/rescue.service.m4.in src/journal/cat.c; do
+      for i in src/remount-fs/remount-fs.c src/core/mount.c src/core/swap.c src/fsck/fsck.c units/emergency.service.in units/rescue.service.m4.in src/journal/cat.c src/core/shutdown.c; do
         test -e $i
         substituteInPlace $i \
           --replace /bin/mount ${utillinux.bin}/bin/mount \
@@ -62,7 +58,8 @@ stdenv.mkDerivation rec {
           --replace /sbin/fsck ${utillinux.bin}/sbin/fsck \
           --replace /bin/echo ${coreutils}/bin/echo \
           --replace /bin/cat ${coreutils}/bin/cat \
-          --replace /sbin/sulogin ${sysvtools}/sbin/sulogin
+          --replace /sbin/sulogin ${sysvtools}/sbin/sulogin \
+          --replace /sbin/kexec ${kexectools}/sbin/kexec
       done
 
       substituteInPlace src/journal/catalog.c \
diff --git a/pkgs/os-specific/linux/systemd/fix-tests-1.patch b/pkgs/os-specific/linux/systemd/fix-tests-1.patch
deleted file mode 100644
index 14bb0fa2708..00000000000
--- a/pkgs/os-specific/linux/systemd/fix-tests-1.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-Signed-off-by: Ramkumar Ramachandra <artag...@gmail.com>
----
- Ramkumar Ramachandra wrote:
- > $ ./test-id128
- > random: a08ea8ed34594d4bbd953dd182ec86f9
- > Assertion 'sd_id128_get_machine(&id) == 0' failed at
- > src/test/test-id128.c:41, function main(). Aborting.
- > [1]    8017 abort (core dumped)  ./test-id128
- 
- Okay, this test fails because I don't have a /etc/machine-id -- I
- thought systemd is supposed to create it?  However, from the logic in
- src/core/machine-id-setup.c, it looks like although open() is called
- with O_CREAT on /etc/machine-id, systemd barfs if the file isn't
- present.  How about changing this?
-
- src/core/machine-id-setup.c |   12 +++++-------
- src/test/test-id128.c       |    6 ++++--
- 2 files changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/src/core/machine-id-setup.c b/src/core/machine-id-setup.c
-index 7f4c23b..3f21d58 100644
---- a/src/core/machine-id-setup.c
-+++ b/src/core/machine-id-setup.c
-@@ -168,12 +168,8 @@ int machine_id_setup(void) {
-                 writable = true;
-         else {
-                 fd = open("/etc/machine-id", O_RDONLY|O_CLOEXEC|O_NOCTTY);
--                if (fd < 0) {
--                        umask(m);
--                        log_error("Cannot open /etc/machine-id: %m");
--                        return -errno;
--                }
--
-+                if (fd < 0)
-+                        goto generate;
-                 writable = false;
-         }
- 
-@@ -192,7 +188,9 @@ int machine_id_setup(void) {
-                 }
-         }
- 
--        /* Hmm, so, the id currently stored is not useful, then let's
-+generate:
-+        /* Hmm, so, either /etc/machine-id doesn't exist, the id
-+         * currently stored is not useful, then let's
-          * generate one */
- 
-         r = generate(id);
-diff --git a/src/test/test-id128.c b/src/test/test-id128.c
-index bfd743e..60902d0 100644
---- a/src/test/test-id128.c
-+++ b/src/test/test-id128.c
-@@ -38,8 +38,10 @@ int main(int argc, char *argv[]) {
-         assert_se(sd_id128_from_string(t, &id2) == 0);
-         assert_se(sd_id128_equal(id, id2));
- 
--        assert_se(sd_id128_get_machine(&id) == 0);
--        printf("machine: %s\n", sd_id128_to_string(id, t));
-+        if (sd_id128_get_machine(&id) < 0)
-+                printf("machine: run systemd-machine-id-setup first\n");
-+        else
-+                printf("machine: %s\n", sd_id128_to_string(id, t));
- 
-         assert_se(sd_id128_get_boot(&id) == 0);
-         printf("boot: %s\n", sd_id128_to_string(id, t));
--- 
-1.7.8.1.362.g5d6df.dirty
diff --git a/pkgs/os-specific/linux/systemd/fixes.patch b/pkgs/os-specific/linux/systemd/fixes.patch
new file mode 100644
index 00000000000..0ad420cd35c
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/fixes.patch
@@ -0,0 +1,757 @@
+diff --git a/man/systemd.special.xml b/man/systemd.special.xml
+index 7164b1e..29401eb 100644
+--- a/man/systemd.special.xml
++++ b/man/systemd.special.xml
+@@ -381,7 +381,7 @@
+                                         this unit during
+                                         installation. This is best
+                                         configured via
+-                                        <varname>WantedBy=multi-uer.target</varname>
++                                        <varname>WantedBy=multi-user.target</varname>
+                                         in the unit's
+                                         <literal>[Install]</literal>
+                                         section.</para>
+diff --git a/rules/80-net-name-slot.rules b/rules/80-net-name-slot.rules
+index 15b5bc4..c5f1b38 100644
+--- a/rules/80-net-name-slot.rules
++++ b/rules/80-net-name-slot.rules
+@@ -1,6 +1,6 @@
+ # do not edit this file, it will be overwritten on update
+ 
+-ACTION=="remove", GOTO="net_name_slot_end"
++ACTION!="add", GOTO="net_name_slot_end"
+ SUBSYSTEM!="net", GOTO="net_name_slot_end"
+ NAME!="", GOTO="net_name_slot_end"
+ 
+diff --git a/rules/99-systemd.rules.in b/rules/99-systemd.rules.in
+index d17bdd9..040b10e 100644
+--- a/rules/99-systemd.rules.in
++++ b/rules/99-systemd.rules.in
+@@ -14,10 +14,6 @@ KERNEL=="vport*", TAG+="systemd"
+ SUBSYSTEM=="block", KERNEL!="ram*|loop*", TAG+="systemd"
+ SUBSYSTEM=="block", KERNEL!="ram*|loop*", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
+ 
+-# Ignore encrypted devices with no identified superblock on it, since
+-# we are probably still calling mke2fs or mkswap on it.
+-SUBSYSTEM=="block", KERNEL!="ram*|loop*", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
+-
+ # Ignore raid devices that are not yet assembled and started
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
+diff --git a/src/core/cgroup-semantics.c b/src/core/cgroup-semantics.c
+index 82b02bb..7df9d01 100644
+--- a/src/core/cgroup-semantics.c
++++ b/src/core/cgroup-semantics.c
+@@ -255,7 +255,7 @@ static int map_blkio(const CGroupSemantics *s, const char *value, char **ret) {
+ }
+ 
+ static const CGroupSemantics semantics[] = {
+-        { "cpu",     "cpu.shares",                 "CPUShare",              false, parse_cpu_shares,          NULL,       NULL },
++        { "cpu",     "cpu.shares",                 "CPUShares",             false, parse_cpu_shares,          NULL,       NULL },
+         { "memory",  "memory.soft_limit_in_bytes", "MemorySoftLimit",       false, parse_memory_limit,        NULL,       NULL },
+         { "memory",  "memory.limit_in_bytes",      "MemoryLimit",           false, parse_memory_limit,        NULL,       NULL },
+         { "devices", "devices.allow",              "DeviceAllow",           true,  parse_device,              map_device, NULL },
+diff --git a/src/core/dbus-execute.h b/src/core/dbus-execute.h
+index 91d70e5..698102f 100644
+--- a/src/core/dbus-execute.h
++++ b/src/core/dbus-execute.h
+@@ -63,7 +63,7 @@
+         "  <property name=\"CPUSchedulingPolicy\" type=\"i\" access=\"read\"/>\n" \
+         "  <property name=\"CPUSchedulingPriority\" type=\"i\" access=\"read\"/>\n" \
+         "  <property name=\"CPUAffinity\" type=\"ay\" access=\"read\"/>\n" \
+-        "  <property name=\"TimerSlackNS\" type=\"t\" access=\"read\"/>\n" \
++        "  <property name=\"TimerSlackNSec\" type=\"t\" access=\"read\"/>\n" \
+         "  <property name=\"CPUSchedulingResetOnFork\" type=\"b\" access=\"read\"/>\n" \
+         "  <property name=\"NonBlocking\" type=\"b\" access=\"read\"/>\n" \
+         "  <property name=\"StandardInput\" type=\"s\" access=\"read\"/>\n" \
+diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
+index 56b02a1..2b6d799 100644
+--- a/src/core/dbus-manager.c
++++ b/src/core/dbus-manager.c
+@@ -1550,7 +1550,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
+                 _cleanup_strv_free_ char **l = NULL;
+                 char **e = NULL;
+ 
+-                SELINUX_ACCESS_CHECK(connection, message, "reboot");
++                SELINUX_ACCESS_CHECK(connection, message, "reload");
+ 
+                 r = bus_parse_strv(message, &l);
+                 if (r == -ENOMEM)
+@@ -1577,7 +1577,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
+                 _cleanup_strv_free_ char **l = NULL;
+                 char **e = NULL;
+ 
+-                SELINUX_ACCESS_CHECK(connection, message, "reboot");
++                SELINUX_ACCESS_CHECK(connection, message, "reload");
+ 
+                 r = bus_parse_strv(message, &l);
+                 if (r == -ENOMEM)
+@@ -1605,7 +1605,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
+                 char **f = NULL;
+                 DBusMessageIter iter;
+ 
+-                SELINUX_ACCESS_CHECK(connection, message, "reboot");
++                SELINUX_ACCESS_CHECK(connection, message, "reload");
+ 
+                 if (!dbus_message_iter_init(message, &iter))
+                         goto oom;
+diff --git a/src/core/dbus-swap.c b/src/core/dbus-swap.c
+index 2e99fba..e72749a 100644
+--- a/src/core/dbus-swap.c
++++ b/src/core/dbus-swap.c
+@@ -93,6 +93,7 @@ static DEFINE_BUS_PROPERTY_APPEND_ENUM(bus_swap_append_swap_result, swap_result,
+ static const BusProperty bus_swap_properties[] = {
+         { "What",       bus_property_append_string, "s", offsetof(Swap, what),  true },
+         { "Priority",   bus_swap_append_priority,   "i", 0 },
++        { "TimeoutUSec",bus_property_append_usec,   "t", offsetof(Swap, timeout_usec)},
+         BUS_EXEC_COMMAND_PROPERTY("ExecActivate",   offsetof(Swap, exec_command[SWAP_EXEC_ACTIVATE]),   false),
+         BUS_EXEC_COMMAND_PROPERTY("ExecDeactivate", offsetof(Swap, exec_command[SWAP_EXEC_DEACTIVATE]), false),
+         { "ControlPID", bus_property_append_pid,    "u", offsetof(Swap, control_pid) },
+diff --git a/src/core/main.c b/src/core/main.c
+index 7fc06be..101ce79 100644
+--- a/src/core/main.c
++++ b/src/core/main.c
+@@ -1590,14 +1590,14 @@ int main(int argc, char *argv[]) {
+                         log_error("Failed to adjust timer slack: %m");
+ 
+         if (arg_capability_bounding_set_drop) {
+-                r = capability_bounding_set_drop(arg_capability_bounding_set_drop, true);
++                r = capability_bounding_set_drop_usermode(arg_capability_bounding_set_drop);
+                 if (r < 0) {
+-                        log_error("Failed to drop capability bounding set: %s", strerror(-r));
++                        log_error("Failed to drop capability bounding set of usermode helpers: %s", strerror(-r));
+                         goto finish;
+                 }
+-                r = capability_bounding_set_drop_usermode(arg_capability_bounding_set_drop);
++                r = capability_bounding_set_drop(arg_capability_bounding_set_drop, true);
+                 if (r < 0) {
+-                        log_error("Failed to drop capability bounding set of usermode helpers: %s", strerror(-r));
++                        log_error("Failed to drop capability bounding set: %s", strerror(-r));
+                         goto finish;
+                 }
+         }
+@@ -1650,6 +1650,7 @@ int main(int argc, char *argv[]) {
+         /* This will close all file descriptors that were opened, but
+          * not claimed by any unit. */
+         fdset_free(fds);
++        fds = NULL;
+ 
+         if (serialization) {
+                 fclose(serialization);
+@@ -1857,7 +1858,7 @@ finish:
+                         char_array_0(sfd);
+ 
+                         i = 0;
+-                        args[i++] = SYSTEMD_BINARY_PATH;
++                        args[i++] = "/run/current-system/systemd/lib/systemd/systemd";
+                         if (switch_root_dir)
+                                 args[i++] = "--switched-root";
+                         args[i++] = arg_running_as == SYSTEMD_SYSTEM ? "--system" : "--user";
+diff --git a/src/core/manager.c b/src/core/manager.c
+index c7f8f20..0508628 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -1372,7 +1372,7 @@ static int manager_process_signal_fd(Manager *m) {
+ 
+                 case SIGINT:
+                         if (m->running_as == SYSTEMD_SYSTEM) {
+-                                manager_start_target(m, SPECIAL_CTRL_ALT_DEL_TARGET, JOB_REPLACE);
++                                manager_start_target(m, SPECIAL_CTRL_ALT_DEL_TARGET, JOB_REPLACE_IRREVERSIBLY);
+                                 break;
+                         }
+ 
+diff --git a/src/core/service.c b/src/core/service.c
+index 3617c24..4d0e2ad 100644
+--- a/src/core/service.c
++++ b/src/core/service.c
+@@ -2642,6 +2642,9 @@ static int service_serialize(Unit *u, FILE *f, FDSet *fds) {
+         if (s->exec_context.var_tmp_dir)
+                 unit_serialize_item(u, f, "var-tmp-dir", s->exec_context.var_tmp_dir);
+ 
++        if (s->forbid_restart)
++                unit_serialize_item(u, f, "forbid-restart", yes_no(s->forbid_restart));
++
+         return 0;
+ }
+ 
+@@ -2776,6 +2779,14 @@ static int service_deserialize_item(Unit *u, const char *key, const char *value,
+                         return log_oom();
+ 
+                 s->exec_context.var_tmp_dir = t;
++        } else if (streq(key, "forbid-restart")) {
++                int b;
++
++                b = parse_boolean(value);
++                if (b < 0)
++                        log_debug_unit(u->id, "Failed to parse forbid-restart value %s", value);
++                else
++                        s->forbid_restart = b;
+         } else
+                 log_debug_unit(u->id, "Unknown serialization key '%s'", key);
+ 
+diff --git a/src/core/snapshot.c b/src/core/snapshot.c
+index a63eccd..a6807eb 100644
+--- a/src/core/snapshot.c
++++ b/src/core/snapshot.c
+@@ -217,8 +217,10 @@ int snapshot_create(Manager *m, const char *name, bool cleanup, DBusError *e, Sn
+                         if (asprintf(&n, "snapshot-%u.snapshot", ++ m->n_snapshots) < 0)
+                                 return -ENOMEM;
+ 
+-                        if (!manager_get_unit(m, n))
++                        if (!manager_get_unit(m, n)) {
++                                name = n;
+                                 break;
++                        }
+ 
+                         free(n);
+                 }
+diff --git a/src/core/umount.c b/src/core/umount.c
+index 1e95ad7..9f0e471 100644
+--- a/src/core/umount.c
++++ b/src/core/umount.c
+@@ -435,6 +435,8 @@ static int mount_points_list_umount(MountPoint **head, bool *changed, bool log_e
+                  * anyway, since we are running from it. They have
+                  * already been remounted ro. */
+                 if (path_equal(m->path, "/")
++                    || path_equal(m->path, "/nix")
++                    || path_equal(m->path, "/nix/store")
+ #ifndef HAVE_SPLIT_USR
+                     || path_equal(m->path, "/usr")
+ #endif
+diff --git a/src/cryptsetup/cryptsetup-generator.c b/src/cryptsetup/cryptsetup-generator.c
+index 81b7708..edd0b40 100644
+--- a/src/cryptsetup/cryptsetup-generator.c
++++ b/src/cryptsetup/cryptsetup-generator.c
+@@ -111,6 +111,7 @@ static int create_disk(
+                 "Conflicts=umount.target\n"
+                 "DefaultDependencies=no\n"
+                 "BindsTo=dev-mapper-%i.device\n"
++                "IgnoreOnIsolate=true\n"
+                 "After=systemd-readahead-collect.service systemd-readahead-replay.service\n",
+                 f);
+ 
+diff --git a/src/fstab-generator/fstab-generator.c b/src/fstab-generator/fstab-generator.c
+index c17299f..6b3e67e 100644
+--- a/src/fstab-generator/fstab-generator.c
++++ b/src/fstab-generator/fstab-generator.c
+@@ -351,7 +351,7 @@ static int add_mount(
+ 
+         if (automount && !path_equal(where, "/")) {
+                 automount_name = unit_name_from_path(where, ".automount");
+-                if (!name)
++                if (!automount_name)
+                         return log_oom();
+ 
+                 automount_unit = strjoin(arg_dest, "/", automount_name, NULL);
+@@ -596,9 +596,9 @@ static int parse_proc_cmdline(void) {
+                 } else if (startswith(word, "rd.fstab=")) {
+ 
+                         if (in_initrd()) {
+-                                r = parse_boolean(word + 6);
++                                r = parse_boolean(word + 9);
+                                 if (r < 0)
+-                                        log_warning("Failed to parse fstab switch %s. Ignoring.", word + 6);
++                                        log_warning("Failed to parse fstab switch %s. Ignoring.", word + 9);
+                                 else
+                                         arg_enabled = r;
+                         }
+diff --git a/src/journal/journal-file.c b/src/journal/journal-file.c
+index 38499a6..bb80905 100644
+--- a/src/journal/journal-file.c
++++ b/src/journal/journal-file.c
+@@ -907,6 +907,8 @@ static int journal_file_append_field(
+ 
+         osize = offsetof(Object, field.payload) + size;
+         r = journal_file_append_object(f, OBJECT_FIELD, osize, &o, &p);
++        if (r < 0)
++                return r;
+ 
+         o->field.hash = htole64(hash);
+         memcpy(o->field.payload, field, size);
+diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
+index 88163c0..e09ba4c 100644
+--- a/src/journal/journald-server.c
++++ b/src/journal/journald-server.c
+@@ -333,8 +333,10 @@ void server_rotate(Server *s) {
+                 if (r < 0)
+                         if (f)
+                                 log_error("Failed to rotate %s: %s", f->path, strerror(-r));
+-                        else
++                        else {
+                                 log_error("Failed to create user journal: %s", strerror(-r));
++                                hashmap_remove(s->user_journals, k);
++                        }
+                 else {
+                         hashmap_replace(s->user_journals, k, f);
+                         server_fix_perms(s, f, PTR_TO_UINT32(k));
+@@ -975,7 +977,8 @@ int process_event(Server *s, struct epoll_event *ev) {
+                 ssize_t n;
+ 
+                 if (ev->events != EPOLLIN) {
+-                        log_error("Got invalid event from epoll.");
++                        log_error("Got invalid event from epoll for %s: %"PRIx32,
++                                  "signal fd", ev->events);
+                         return -EIO;
+                 }
+ 
+@@ -1024,8 +1027,12 @@ int process_event(Server *s, struct epoll_event *ev) {
+         } else if (ev->data.fd == s->dev_kmsg_fd) {
+                 int r;
+ 
+-                if (ev->events != EPOLLIN) {
+-                        log_error("Got invalid event from epoll.");
++                if (ev->events & EPOLLERR)
++                        log_warning("/dev/kmsg buffer overrun, some messages lost.");
++
++                if (!(ev->events & EPOLLIN)) {
++                        log_error("Got invalid event from epoll for %s: %"PRIx32,
++                                  "/dev/kmsg", ev->events);
+                         return -EIO;
+                 }
+ 
+@@ -1039,7 +1046,9 @@ int process_event(Server *s, struct epoll_event *ev) {
+                    ev->data.fd == s->syslog_fd) {
+ 
+                 if (ev->events != EPOLLIN) {
+-                        log_error("Got invalid event from epoll.");
++                        log_error("Got invalid event from epoll for %s: %"PRIx32,
++                                  ev->data.fd == s->native_fd ? "native fd" : "syslog fd",
++                                  ev->events);
+                         return -EIO;
+                 }
+ 
+@@ -1140,12 +1149,7 @@ int process_event(Server *s, struct epoll_event *ev) {
+                                 char *e;
+ 
+                                 if (n > 0 && n_fds == 0) {
+-                                        e = memchr(s->buffer, '\n', n);
+-                                        if (e)
+-                                                *e = 0;
+-                                        else
+-                                                s->buffer[n] = 0;
+-
++                                        s->buffer[n] = 0;
+                                         server_process_syslog_message(s, strstrip(s->buffer), ucred, tv, label, label_len);
+                                 } else if (n_fds > 0)
+                                         log_warning("Got file descriptors via syslog socket. Ignoring.");
+@@ -1167,7 +1171,8 @@ int process_event(Server *s, struct epoll_event *ev) {
+         } else if (ev->data.fd == s->stdout_fd) {
+ 
+                 if (ev->events != EPOLLIN) {
+-                        log_error("Got invalid event from epoll.");
++                        log_error("Got invalid event from epoll for %s: %"PRIx32,
++                                  "stdout fd", ev->events);
+                         return -EIO;
+                 }
+ 
+@@ -1178,6 +1183,8 @@ int process_event(Server *s, struct epoll_event *ev) {
+                 StdoutStream *stream;
+ 
+                 if ((ev->events|EPOLLIN|EPOLLHUP) != (EPOLLIN|EPOLLHUP)) {
++                        log_error("Got invalid event from epoll for %s: %"PRIx32,
++                                  "stdout stream", ev->events);
+                         log_error("Got invalid event from epoll.");
+                         return -EIO;
+                 }
+diff --git a/src/journal/mmap-cache.c b/src/journal/mmap-cache.c
+index 54bf114..bd197d0 100644
+--- a/src/journal/mmap-cache.c
++++ b/src/journal/mmap-cache.c
+@@ -308,9 +308,13 @@ static void mmap_cache_free(MMapCache *m) {
+         while ((c = hashmap_first(m->contexts)))
+                 context_free(c);
+ 
++        hashmap_free(m->contexts);
++
+         while ((f = hashmap_first(m->fds)))
+                 fd_free(f);
+ 
++        hashmap_free(m->fds);
++
+         while (m->unused)
+                 window_free(m->unused);
+ 
+diff --git a/src/libsystemd-bus/bus-internal.c b/src/libsystemd-bus/bus-internal.c
+index 0e66f3d..cac948e 100644
+--- a/src/libsystemd-bus/bus-internal.c
++++ b/src/libsystemd-bus/bus-internal.c
+@@ -63,7 +63,7 @@ bool object_path_is_valid(const char *p) {
+ 
+ bool interface_name_is_valid(const char *p) {
+         const char *q;
+-        bool dot, found_dot;
++        bool dot, found_dot = false;
+ 
+         if (isempty(p))
+                 return false;
+@@ -103,7 +103,7 @@ bool interface_name_is_valid(const char *p) {
+ 
+ bool service_name_is_valid(const char *p) {
+         const char *q;
+-        bool dot, found_dot, unique;
++        bool dot, found_dot = false, unique;
+ 
+         if (isempty(p))
+                 return false;
+diff --git a/src/libsystemd-bus/sd-bus.c b/src/libsystemd-bus/sd-bus.c
+index 7d6d848..b0eb2f1 100644
+--- a/src/libsystemd-bus/sd-bus.c
++++ b/src/libsystemd-bus/sd-bus.c
+@@ -1088,11 +1088,11 @@ static int dispatch_rqueue(sd_bus *bus, sd_bus_message **m) {
+                 if (r == 0)
+                         return ret;
+ 
+-                r = 1;
++                ret = 1;
+         } while (!z);
+ 
+         *m = z;
+-        return 1;
++        return ret;
+ }
+ 
+ int sd_bus_send(sd_bus *bus, sd_bus_message *m, uint64_t *serial) {
+diff --git a/src/libudev/libudev-enumerate.c b/src/libudev/libudev-enumerate.c
+index 5ccaabd..100c1fb 100644
+--- a/src/libudev/libudev-enumerate.c
++++ b/src/libudev/libudev-enumerate.c
+@@ -299,7 +299,7 @@ _public_ struct udev_list_entry *udev_enumerate_get_list_entry(struct udev_enume
+                         /* skip to be delayed devices, and move the to
+                          * the point where the prefix changes. We can
+                          * only move one item at a time. */
+-                        if (!move_later) {
++                        if (move_later == -1) {
+                                 move_later_prefix = devices_delay_later(udev_enumerate->udev, entry->syspath);
+ 
+                                 if (move_later_prefix > 0) {
+@@ -718,6 +718,8 @@ static bool match_subsystem(struct udev_enumerate *udev_enumerate, const char *s
+ {
+         struct udev_list_entry *list_entry;
+ 
++        subsystem = subsystem ? : "";
++
+         udev_list_entry_foreach(list_entry, udev_list_get_entry(&udev_enumerate->subsystem_nomatch_list)) {
+                 if (fnmatch(udev_list_entry_get_name(list_entry), subsystem, 0) == 0)
+                         return false;
+@@ -826,23 +828,27 @@ nomatch:
+ static int parent_add_child(struct udev_enumerate *enumerate, const char *path)
+ {
+         struct udev_device *dev;
++        int r = 0;
+ 
+         dev = udev_device_new_from_syspath(enumerate->udev, path);
+         if (dev == NULL)
+                 return -ENODEV;
+ 
+         if (!match_subsystem(enumerate, udev_device_get_subsystem(dev)))
+-                return 0;
++                goto nomatch;
+         if (!match_sysname(enumerate, udev_device_get_sysname(dev)))
+-                return 0;
++                goto nomatch;
+         if (!match_property(enumerate, dev))
+-                return 0;
++                goto nomatch;
+         if (!match_sysattr(enumerate, dev))
+-                return 0;
++                goto nomatch;
+ 
+         syspath_add(enumerate, udev_device_get_syspath(dev));
++        r = 1;
++
++nomatch:
+         udev_device_unref(dev);
+-        return 1;
++        return r;
+ }
+ 
+ static int parent_crawl_children(struct udev_enumerate *enumerate, const char *path, int maxdepth)
+diff --git a/src/libudev/libudev.sym b/src/libudev/libudev.sym
+index 8e09430..1e6f885 100644
+--- a/src/libudev/libudev.sym
++++ b/src/libudev/libudev.sym
+@@ -109,5 +109,6 @@ global:
+ } LIBUDEV_189;
+ 
+ LIBUDEV_199 {
++global:
+         udev_device_set_sysattr_value;
+ } LIBUDEV_196;
+diff --git a/src/modules-load/modules-load.c b/src/modules-load/modules-load.c
+index 7b19ee0..49ee420 100644
+--- a/src/modules-load/modules-load.c
++++ b/src/modules-load/modules-load.c
+@@ -302,8 +302,8 @@ int main(int argc, char *argv[]) {
+ 
+                 STRV_FOREACH(i, arg_proc_cmdline_modules) {
+                         k = load_module(ctx, *i);
+-                        if (k < 0)
+-                                r = EXIT_FAILURE;
++                        if (k < 0 && r == 0)
++                                r = k;
+                 }
+ 
+                 r = conf_files_list_nulstr(&files, ".conf", NULL, conf_file_dirs);
+diff --git a/src/nss-myhostname/netlink.c b/src/nss-myhostname/netlink.c
+index b1ef912..4f2ab5c 100644
+--- a/src/nss-myhostname/netlink.c
++++ b/src/nss-myhostname/netlink.c
+@@ -113,6 +113,10 @@ static int read_reply(int fd, struct address **list, unsigned *n_list) {
+                     ifaddrmsg->ifa_scope == RT_SCOPE_NOWHERE)
+                         continue;
+ 
++                if (ifaddrmsg->ifa_family == AF_INET6 &&
++                    ifaddrmsg->ifa_scope == RT_SCOPE_LINK)
++                        continue;
++
+                 if (ifaddrmsg->ifa_flags & IFA_F_DEPRECATED)
+                         continue;
+ 
+diff --git a/src/shared/efivars.c b/src/shared/efivars.c
+index 8d004ba..99340c9 100644
+--- a/src/shared/efivars.c
++++ b/src/shared/efivars.c
+@@ -383,7 +383,8 @@ int efi_get_boot_options(uint16_t **options) {
+                 list[count ++] = id;
+         }
+ 
+-        qsort(list, count, sizeof(uint16_t), cmp_uint16);
++        if (list)
++                qsort(list, count, sizeof(uint16_t), cmp_uint16);
+ 
+         *options = list;
+         return count;
+diff --git a/src/shared/env-util.c b/src/shared/env-util.c
+index 6a52fb9..598222c 100644
+--- a/src/shared/env-util.c
++++ b/src/shared/env-util.c
+@@ -406,7 +406,9 @@ char **strv_env_clean_log(char **e, const char *message) {
+                 e[k++] = *p;
+         }
+ 
+-        e[k] = NULL;
++        if (e)
++                e[k] = NULL;
++
+         return e;
+ }
+ 
+diff --git a/src/shared/log.c b/src/shared/log.c
+index 27317f7..8f4995a 100644
+--- a/src/shared/log.c
++++ b/src/shared/log.c
+@@ -115,16 +115,20 @@ void log_close_syslog(void) {
+ 
+ static int create_log_socket(int type) {
+         int fd;
++        struct timeval tv;
+ 
+-        /* All output to the syslog/journal fds we do asynchronously,
+-         * and if the buffers are full we just drop the messages */
+-
+-        fd = socket(AF_UNIX, type|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
++        fd = socket(AF_UNIX, type|SOCK_CLOEXEC, 0);
+         if (fd < 0)
+                 return -errno;
+ 
+         fd_inc_sndbuf(fd, SNDBUF_SIZE);
+ 
++        /* We need a blocking fd here since we'd otherwise lose
++        messages way too early. However, let's not hang forever in the
++        unlikely case of a deadlock. */
++        timeval_store(&tv, 1*USEC_PER_MINUTE);
++        setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
++
+         return fd;
+ }
+ 
+diff --git a/src/shared/polkit.c b/src/shared/polkit.c
+index cea7074..1c5e9e3 100644
+--- a/src/shared/polkit.c
++++ b/src/shared/polkit.c
+@@ -38,12 +38,8 @@ int verify_polkit(
+ 
+ #ifdef ENABLE_POLKIT
+         DBusMessage *m = NULL, *reply = NULL;
+-        const char *unix_process = "unix-process", *pid = "pid", *starttime = "start-time", *cancel_id = "";
++        const char *system_bus_name = "system-bus-name", *name = "name", *cancel_id = "";
+         uint32_t flags = interactive ? 1 : 0;
+-        pid_t pid_raw;
+-        uint32_t pid_u32;
+-        unsigned long long starttime_raw;
+-        uint64_t starttime_u64;
+         DBusMessageIter iter_msg, iter_struct, iter_array, iter_dict, iter_variant;
+         int r;
+         dbus_bool_t authorized = FALSE, challenge = FALSE;
+@@ -68,14 +64,6 @@ int verify_polkit(
+ 
+ #ifdef ENABLE_POLKIT
+ 
+-        pid_raw = bus_get_unix_process_id(c, sender, error);
+-        if (pid_raw == 0)
+-                return -EINVAL;
+-
+-        r = get_starttime_of_pid(pid_raw, &starttime_raw);
+-        if (r < 0)
+-                return r;
+-
+         m = dbus_message_new_method_call(
+                         "org.freedesktop.PolicyKit1",
+                         "/org/freedesktop/PolicyKit1/Authority",
+@@ -86,22 +74,13 @@ int verify_polkit(
+ 
+         dbus_message_iter_init_append(m, &iter_msg);
+ 
+-        pid_u32 = (uint32_t) pid_raw;
+-        starttime_u64 = (uint64_t) starttime_raw;
+-
+         if (!dbus_message_iter_open_container(&iter_msg, DBUS_TYPE_STRUCT, NULL, &iter_struct) ||
+-            !dbus_message_iter_append_basic(&iter_struct, DBUS_TYPE_STRING, &unix_process) ||
++            !dbus_message_iter_append_basic(&iter_struct, DBUS_TYPE_STRING, &system_bus_name) ||
+             !dbus_message_iter_open_container(&iter_struct, DBUS_TYPE_ARRAY, "{sv}", &iter_array) ||
+             !dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict) ||
+-            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &pid) ||
+-            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "u", &iter_variant) ||
+-            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT32, &pid_u32) ||
+-            !dbus_message_iter_close_container(&iter_dict, &iter_variant) ||
+-            !dbus_message_iter_close_container(&iter_array, &iter_dict) ||
+-            !dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict) ||
+-            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &starttime) ||
+-            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "t", &iter_variant) ||
+-            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT64, &starttime_u64) ||
++            !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &name) ||
++            !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "s", &iter_variant) ||
++            !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_STRING, &sender) ||
+             !dbus_message_iter_close_container(&iter_dict, &iter_variant) ||
+             !dbus_message_iter_close_container(&iter_array, &iter_dict) ||
+             !dbus_message_iter_close_container(&iter_struct, &iter_array) ||
+diff --git a/src/systemctl/systemctl.c b/src/systemctl/systemctl.c
+index 3cca861..f6052dd 100644
+--- a/src/systemctl/systemctl.c
++++ b/src/systemctl/systemctl.c
+@@ -1482,7 +1482,7 @@ static DBusHandlerResult wait_filter(DBusConnection *connection, DBusMessage *me
+ 
+         } else if (dbus_message_is_signal(message, "org.freedesktop.systemd1.Manager", "JobRemoved")) {
+                 uint32_t id;
+-                const char *path, *result, *unit;
++                const char *path, *result, *unit, *r;
+ 
+                 if (dbus_message_get_args(message, &error,
+                                           DBUS_TYPE_UINT32, &id,
+@@ -1491,7 +1491,11 @@ static DBusHandlerResult wait_filter(DBusConnection *connection, DBusMessage *me
+                                           DBUS_TYPE_STRING, &result,
+                                           DBUS_TYPE_INVALID)) {
+ 
+-                        free(set_remove(d->set, (char*) path));
++                        r = set_remove(d->set, (char*) path);
++                        if (!r)
++                                return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
++
++                        free(r);
+ 
+                         if (!isempty(result))
+                                 d->result = strdup(result);
+@@ -1511,7 +1515,11 @@ static DBusHandlerResult wait_filter(DBusConnection *connection, DBusMessage *me
+                         /* Compatibility with older systemd versions <
+                          * 183 during upgrades. This should be dropped
+                          * one day. */
+-                        free(set_remove(d->set, (char*) path));
++                        r = set_remove(d->set, (char*) path);
++                        if (!r)
++                                return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
++
++                        free(r);
+ 
+                         if (*result)
+                                 d->result = strdup(result);
+@@ -1867,7 +1875,7 @@ static int start_unit_one(
+                         return log_oom();
+ 
+                 r = set_consume(s, p);
+-                if (r < 0) {
++                if (r < 0 && r != -EEXIST) {
+                         log_error("Failed to add path to set.");
+                         return r;
+                 }
+diff --git a/units/emergency.service.in b/units/emergency.service.in
+index 442f0e0..6b7eafd 100644
+--- a/units/emergency.service.in
++++ b/units/emergency.service.in
+@@ -15,7 +15,6 @@ Before=shutdown.target
+ [Service]
+ Environment=HOME=/root
+ WorkingDirectory=/root
+-ExecStartPre=-/bin/plymouth quit
+ ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type "journalctl -xb" to view\\nsystem logs, "systemctl reboot" to reboot, "systemctl default" to try again\\nto boot into default mode.'
+ ExecStart=-/sbin/sulogin
+ ExecStopPost=@SYSTEMCTL@ --fail --no-block default
+diff --git a/units/local-fs.target b/units/local-fs.target
+index 18c3d74..a09054c 100644
+--- a/units/local-fs.target
++++ b/units/local-fs.target
+@@ -11,3 +11,5 @@ Documentation=man:systemd.special(7)
+ After=local-fs-pre.target
+ OnFailure=emergency.target
+ OnFailureIsolate=no
++
++X-StopOnReconfiguration=yes
+diff --git a/units/remote-fs.target b/units/remote-fs.target
+index 09213e8..47b4cf5 100644
+--- a/units/remote-fs.target
++++ b/units/remote-fs.target
+@@ -10,5 +10,7 @@ Description=Remote File Systems
+ Documentation=man:systemd.special(7)
+ After=remote-fs-pre.target
+ 
++X-StopOnReconfiguration=yes
++
+ [Install]
+ WantedBy=multi-user.target
+diff --git a/units/rescue.service.m4.in b/units/rescue.service.m4.in
+index 269797a..2c640f4 100644
+--- a/units/rescue.service.m4.in
++++ b/units/rescue.service.m4.in
+@@ -16,7 +16,6 @@ Before=shutdown.target
+ [Service]
+ Environment=HOME=/root
+ WorkingDirectory=/root
+-ExecStartPre=-/bin/plymouth quit
+ ExecStartPre=-/bin/echo -e 'Welcome to rescue mode! Type "systemctl default" or ^D to enter default mode.\\nType "journalctl -xb" to view system logs. Type "systemctl reboot" to reboot.'
+ ExecStart=-/sbin/sulogin
+ ExecStopPost=-@SYSTEMCTL@ --fail --no-block default
+diff --git a/units/sysinit.target b/units/sysinit.target
+index 8f4fb8f..e0f0147 100644
+--- a/units/sysinit.target
++++ b/units/sysinit.target
+@@ -9,6 +9,5 @@
+ Description=System Initialization
+ Documentation=man:systemd.special(7)
+ Conflicts=emergency.service emergency.target
+-Wants=local-fs.target swap.target
+-After=local-fs.target swap.target emergency.service emergency.target
++After=emergency.service emergency.target
+ RefuseManualStart=yes
+diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in
+index ab2e50c..9563a7d 100644
+--- a/units/systemd-journald.service.in
++++ b/units/systemd-journald.service.in
+@@ -24,3 +24,8 @@ CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG C
+ # Increase the default a bit in order to allow many simultaneous
+ # services being run since we keep one fd open per service.
+ LimitNOFILE=16384
++
++# Don't restart journald, since that causes services connected to
++# journald to stop logging (see
++# https://bugs.freedesktop.org/show_bug.cgi?id=56043).
++X-RestartIfChanged=no
+diff --git a/units/systemd-user-sessions.service.in b/units/systemd-user-sessions.service.in
+index 0869e73..b6ed958 100644
+--- a/units/systemd-user-sessions.service.in
++++ b/units/systemd-user-sessions.service.in
+@@ -15,3 +15,6 @@ Type=oneshot
+ RemainAfterExit=yes
+ ExecStart=@rootlibexecdir@/systemd-user-sessions start
+ ExecStop=@rootlibexecdir@/systemd-user-sessions stop
++
++# Restart kills all active sessions.
++X-RestartIfChanged=no
diff --git a/pkgs/os-specific/linux/systemd/no-global-install.patch b/pkgs/os-specific/linux/systemd/no-global-install.patch
deleted file mode 100644
index 6567251d57a..00000000000
--- a/pkgs/os-specific/linux/systemd/no-global-install.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/Makefile.am b/Makefile.am
-index 05bf582..aa16a7c 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -2568,11 +2568,6 @@ endif
- # "adm" and "wheel".
- libsystemd-journal-install-hook:
- 	libname=libsystemd-journal.so && $(move-to-rootlibdir)
--	$(MKDIR_P) $(DESTDIR)/var/log/journal
--	-chown 0:0 $(DESTDIR)/var/log/journal
--	-chmod 755 $(DESTDIR)/var/log/journal
--	-setfacl -nm g:adm:rx,d:g:adm:rx $(DESTDIR)/var/log/journal/
--	-setfacl -nm g:wheel:rx,d:g:wheel:rx $(DESTDIR)/var/log/journal/
- 
- libsystemd-journal-uninstall-hook:
- 	rm -f $(DESTDIR)$(rootlibdir)/libsystemd-journal.so*
-@@ -3676,9 +3671,6 @@ if HAVE_SYSV_COMPAT
- sysvinit_DATA = \
- 	docs/sysvinit/README
- 
--varlog_DATA = \
--	docs/var-log/README
--
- docs/sysvinit/README: docs/sysvinit/README.in
- 	$(SED_PROCESS)
- 
diff --git a/pkgs/os-specific/linux/ttysnoop/default.nix b/pkgs/os-specific/linux/ttysnoop/default.nix
new file mode 100644
index 00000000000..670c9608344
--- /dev/null
+++ b/pkgs/os-specific/linux/ttysnoop/default.nix
@@ -0,0 +1,38 @@
+{stdenv, fetchurl}:
+let
+  s = # Generated upstream information
+  rec {
+    baseName="ttysnoop";
+    version="0.12d.k26";
+    name="${baseName}-${version}";
+    hash="0jb2zchaiqmmickj0la7wjw3sf9vy65qfhhs11yrzx4mmwkp0395";
+    url="http://sysd.org/stas/files/active/0/ttysnoop-0.12d.k26.tar.gz";
+    sha256="0jb2zchaiqmmickj0la7wjw3sf9vy65qfhhs11yrzx4mmwkp0395";
+  };
+  buildInputs = [
+  ];
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
+  src = fetchurl {
+    inherit (s) url sha256;
+  };
+  preBuild = ''
+    sed -e "s@/sbin@$out/sbin@g" -i Makefile
+    sed -e "s@/usr/man@$out/share/man@g" -i Makefile
+    mkdir -p "$out/share/man/man8"
+    mkdir -p "$out/sbin"
+  '';
+  postInstall = ''
+    mkdir -p "$out/etc"
+    cp snooptab.dist "$out/etc/snooptab"
+  '';
+  meta = {
+    inherit (s) version;
+    description = "A tool to clone input and output of another tty/pty to the current one";
+    license = stdenv.lib.licenses.gpl2 ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/ttysnoop/default.upstream b/pkgs/os-specific/linux/ttysnoop/default.upstream
new file mode 100644
index 00000000000..905a639c31e
--- /dev/null
+++ b/pkgs/os-specific/linux/ttysnoop/default.upstream
@@ -0,0 +1,3 @@
+url http://sysd.org/stas/node/35
+ensure_choice
+version '.*-([0-9a-z.]+)[.]tar[.].*' '\1'
diff --git a/pkgs/os-specific/linux/udisks-glue/default.nix b/pkgs/os-specific/linux/udisks-glue/default.nix
new file mode 100644
index 00000000000..9f99d5e9f20
--- /dev/null
+++ b/pkgs/os-specific/linux/udisks-glue/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchurl, pkgconfig, automake, autoconf, udisks, dbus_glib, glib, confuse }:
+
+stdenv.mkDerivation {
+  name = "udisks-glue-1.3.5";
+
+  src = fetchurl {
+    url = "https://github.com/fernandotcl/udisks-glue/archive/release-1.3.5.tar.gz";
+    sha256 = "317d25bf249278dc8f6a5dcf18f760512427c772b9afe3cfe34e6e1baa258176";
+  };
+
+  buildInputs = [ automake autoconf pkgconfig udisks dbus_glib glib confuse ];
+
+  preConfigure = "sh autogen.sh";
+
+  meta = {
+    homepage = https://github.com/fernandotcl/udisks-glue;
+    description = "A tool to associate udisks events to user-defined actions";
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [pSub];
+    license = "free";
+  };
+}
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 8f244c3d645..d5dc292ac33 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
         --replace /usr/bin/dbus-send ${dbus_tools}/bin/dbus-send
     '';
 
+  NIX_CFLAGS_LINK = "-lgcc_s";
+
   installFlags = "historydir=$(TMPDIR)/foo";
 
   meta = {
diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index b7d139a534f..aff730e387a 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -4,8 +4,8 @@ let
 
   # Obtained from http://www.linux-usb.org/usb.ids.bz2.
   usbids = fetchurl {
-    url = http://tarballs.nixos.org/usb.ids.20120920.bz2;
-    sha256 = "0sz860g7grf6kx22p49s6j8h85c69ymcw16a8110klzfl9hl9hli";
+    url = http://tarballs.nixos.org/usb.ids.20130821.bz2;
+    sha256 = "0x7mf4h5h5wjzhygfr4lc8yz0cwm7mahxrnp5nkxcmawmyxwsg53";
   };
 
 in
@@ -20,8 +20,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig libusb1 ];
 
-  # currently up-to-date
-  #preBuild = "bunzip2 < ${usbids} > usb.ids";
+  preBuild = "bunzip2 < ${usbids} > usb.ids";
+
+  postInstall =
+    ''
+      rm $out/sbin/update-usbids.sh
+      substituteInPlace $out/bin/lsusb.py \
+        --replace /usr/share/usb.ids $out/share/usb.ids
+    '';
 
   meta = {
     homepage = http://www.linux-usb.org/;
diff --git a/pkgs/os-specific/linux/x86info/default.nix b/pkgs/os-specific/linux/x86info/default.nix
index 297991ff4d9..6cd2a431a60 100644
--- a/pkgs/os-specific/linux/x86info/default.nix
+++ b/pkgs/os-specific/linux/x86info/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    description = "An identification utility for the x86 series of processors.";
+    description = "Identification utility for the x86 series of processors";
     longDescription =
     ''
       x86info will identify all Intel/AMD/Centaur/Cyrix/VIA CPUs. It leverages