Merge remote-tracking branch 'upstream/master' into hardened-stdenv

34 files changed, 167 insertions, 118 deletions

diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index 6567e478636..919799abb69 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
     substituteInPlace ./scripts/gen-offsets.sh --replace hexdump ${utillinux}/bin/hexdump
     substituteInPlace ./Documentation/Makefile --replace "2>/dev/null" ""
     substituteInPlace ./Documentation/Makefile --replace "--skip-validation" "--skip-validation -x ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl"
+    substituteInPlace ./Makefile --replace "-Werror" ""
   '';
 
   configurePhase = "make config PREFIX=$out";
@@ -31,11 +32,11 @@ stdenv.mkDerivation rec {
     make install PREFIX=$out LIBDIR=$out/lib ASCIIDOC=${asciidoc}/bin/asciidoc XMLTO=${xmlto}/bin/xmlto
   '';
 
-  meta = {
-    description = "userspace checkpoint/restore for Linux";
-    homepage    = "http://criu.org";
-    license     = stdenv.lib.licenses.gpl2;
+  meta = with stdenv.lib; {
+    description = "Userspace checkpoint/restore for Linux";
+    homepage    = https://criu.org;
+    license     = licenses.gpl2;
     platforms   = [ "x86_64-linux" ];
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    maintainers = [ maintainers.thoughtpolice ];
   };
 }
diff --git a/pkgs/os-specific/linux/freefall/default.nix b/pkgs/os-specific/linux/freefall/default.nix
index 590b6b61dd3..54be786d10d 100644
--- a/pkgs/os-specific/linux/freefall/default.nix
+++ b/pkgs/os-specific/linux/freefall/default.nix
@@ -1,13 +1,9 @@
-{ stdenv, fetchurl }:
+{ stdenv, kernel }:
 
 stdenv.mkDerivation rec {
-  name = "freefall-${version}";
-  version = "4.3";
+  inherit (kernel) version src;
 
-  src = fetchurl {
-    sha256 = "1bpkr45i4yzp32p0vpnz8mlv9lk4q2q9awf1kg9khg4a9g42qqja";
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-  };
+  name = "freefall-${version}";
 
   postPatch = ''
     cd tools/laptop/freefall
@@ -20,6 +16,8 @@ stdenv.mkDerivation rec {
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
+    inherit (kernel.meta) homepage license;
+
     description = "Free-fall protection for spinning HP/Dell laptop hard drives";
     longDescription = ''
       Provides a shock protection facility in modern laptops with spinning hard
@@ -29,7 +27,7 @@ stdenv.mkDerivation rec {
       feature, which should cause the drive to switch to idle mode and unload the
       disk heads, and an accelerometer device. It has no effect on SSD devices!
     '';
-    license = licenses.gpl2;
+
     platforms = platforms.linux;
     maintainers = with maintainers; [ nckx ];
   };
diff --git a/pkgs/os-specific/linux/fuse/builder.sh b/pkgs/os-specific/linux/fuse/builder.sh
deleted file mode 100644
index c843ae6183b..00000000000
--- a/pkgs/os-specific/linux/fuse/builder.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-source $stdenv/setup
-
-export MOUNT_FUSE_PATH=$out/sbin
-export INIT_D_PATH=$out/etc/init.d
-export UDEV_RULES_PATH=$out/etc/udev/rules.d
-
-# This is ugly.  Normally, FUSE executes $out/bin/fusermount to mount
-# the file system.  However, fusermount should be setuid root, but Nix
-# doesn't support setuid binaries, so fusermount will fail.  By
-# setting FUSERMOUNT_DIR to a non-existant path, FUSE will fall back
-# to searching for fusermount in $PATH.  The user is responsible for
-# (e.g.) setting up a setuid-wrapper for fusermount and adding it to
-# $PATH.
-export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/no-such-path\""
-
-export preBuild="sed -e 's@/bin/@$utillinux/bin/@g' -i lib/mount_util.c";
-
-genericBuild
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index 036ece4627b..d86eb2a9756 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -1,21 +1,35 @@
 { stdenv, fetchurl, utillinux }:
 
 stdenv.mkDerivation rec {
-  name = "fuse-2.9.3";
-  
-  builder = ./builder.sh;
-  
+  name = "fuse-2.9.5";
+
+  #builder = ./builder.sh;
+
   src = fetchurl {
-    url = "mirror://sourceforge/fuse/${name}.tar.gz";
-    sha256 = "071r6xjgssy8vwdn6m28qq1bqxsd2bphcd2mzhq0grf5ybm87sqb";
+    url = "https://github.com/libfuse/libfuse/releases/download/fuse_2_9_5/${name}.tar.gz";
+    sha256 = "1dfvbi1p57svbv2sfnbqwpnsk219spvjnlapf35azhgzqlf3g7sp";
   };
-  
-  configureFlags = "--disable-kernel-module";
-  
+
   buildInputs = [ utillinux ];
-  
+
   inherit utillinux;
 
+  preConfigure =
+    ''
+      export MOUNT_FUSE_PATH=$out/sbin
+      export INIT_D_PATH=$TMPDIR/etc/init.d
+      export UDEV_RULES_PATH=$out/etc/udev/rules.d
+
+      # Ensure that FUSE calls the setuid wrapper, not
+      # $out/bin/fusermount. It falls back to calling fusermount in
+      # $PATH, so it should also work on non-NixOS systems.
+      export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/var/setuid-wrappers\""
+
+      sed -e 's@/bin/@${utillinux}/bin/@g' -i lib/mount_util.c
+    '';
+
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     homepage = http://fuse.sourceforge.net/;
     description = "Kernel module and library that allows filesystems to be implemented in user space";
diff --git a/pkgs/os-specific/linux/htop/default.nix b/pkgs/os-specific/linux/htop/default.nix
deleted file mode 100644
index 946b44346ab..00000000000
--- a/pkgs/os-specific/linux/htop/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ fetchurl, stdenv, ncurses }:
-
-stdenv.mkDerivation rec {
-  name = "htop-${version}";
-  version = "2.0.1";
-
-  src = fetchurl {
-    sha256 = "0rjn9ybqx5sav7z4gn18f1q6k23nmqyb6yydfgghzdznz9nn447l";
-    url = "http://hisham.hm/htop/releases/${version}/${name}.tar.gz";
-  };
-
-  buildInputs = [ ncurses ];
-
-  meta = with stdenv.lib; {
-    description = "An interactive process viewer for Linux";
-    homepage = http://htop.sourceforge.net;
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ rob simons relrod nckx ];
-  };
-}
diff --git a/pkgs/os-specific/linux/jool/default.nix b/pkgs/os-specific/linux/jool/default.nix
index 79094ebb3e3..274d0cc4139 100644
--- a/pkgs/os-specific/linux/jool/default.nix
+++ b/pkgs/os-specific/linux/jool/default.nix
@@ -28,5 +28,7 @@ stdenv.mkDerivation {
     description = "Fairly compliant SIIT and Stateful NAT64 for Linux - kernel modules";
     platforms = platforms.linux;
     maintainers = with maintainers; [ fpletz ];
+    # kernel version 4.3 is the most recent supported version
+    broken = builtins.compareVersions kernel.version "4.3" == 1;
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index f3dd32386bc..e7e81f4877f 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -210,7 +210,7 @@ with stdenv.lib;
   OCFS2_DEBUG_MASKLOG? n
   BTRFS_FS_POSIX_ACL y
   UBIFS_FS_ADVANCED_COMPR? y
-  ${optionalString (versionAtLeast version "4.0") ''
+  ${optionalString (versionAtLeast version "4.0" && versionOlder version "4.6") ''
     NFSD_PNFS y
   ''}
   NFSD_V2_ACL y
diff --git a/pkgs/os-specific/linux/kernel/linux-3.10.nix b/pkgs/os-specific/linux/kernel/linux-3.10.nix
index d0c09d35cd0..3fe7df6b40e 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.10.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.10.99";
+  version = "3.10.101";
   extraMeta.branch = "3.10";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1hq90yn2ry36y317px7f0wy55j70ip3wlxa4qsdl9pzlndadcp24";
+    sha256 = "1g8jx6vla8bjhy3xn0s7r6awinxpfr1w8zqfzjsx88pkqbf8qd9n";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.12.nix b/pkgs/os-specific/linux/kernel/linux-3.12.nix
index f146e5f2f13..49de2c2ab0f 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.12.55";
+  version = "3.12.57";
   extraMeta.branch = "3.12";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0xg52i6zsrkzv0i2kxrsx0179lkp9f2388r06rahx0anf4ars5p2";
+    sha256 = "0qv88rvi0n45z3888w2gis35lxdx34qg2p7c2cac2szbrzv664s8";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.14.nix b/pkgs/os-specific/linux/kernel/linux-3.14.nix
index ae3ba775d41..f69fa93ea2f 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.14.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.14.63";
+  version = "3.14.65";
   extraMeta.branch = "3.14";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0q3qcgcaxjc298dgjpfn6g17lvki2p87f0zkaxs0h0g13jhykwbz";
+    sha256 = "0pqfgzinwgllvyx0cfv0vnllgvzrrpbr2yi21zgppdd1iw6nipsd";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.18.nix b/pkgs/os-specific/linux/kernel/linux-3.18.nix
index a8c86d0e618..28893ce3f9f 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.18.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.18.27";
+  version = "3.18.29";
   extraMeta.branch = "3.18";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "01lz0c3ns0yp5vnjch1pn10h43g6fr4xw7w3b6kb477083cjr7dc";
+    sha256 = "0g8vlhifl31dyghiamykrpgj6n8h5w6gh6n88ir57z6lj188vaj8";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.1.nix b/pkgs/os-specific/linux/kernel/linux-4.1.nix
index fbcfa17a8bc..57e239c1d09 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.1.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.1.17";
+  version = "4.1.20";
   extraMeta.branch = "4.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "084ij19vgm27ljrjabqqmlqn27p168nsm9grhr6rajid4n79h6ab";
+    sha256 = "1dpq8dgj351jzm7n6330a4xriz9dxv7d9wxzj9zn9q7ya22np9gs";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 36181308a8b..fecb3b05f97 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.5";
+  version = "4.4.6";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1daavrj2msl85aijh1izfm1cwf14c7mi75hldzidr1h2v629l89h";
+    sha256 = "0zapxjnawdn0km6b9pc7399zbjiyb0a28rqmsif3afc9qb2cxg53";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.5.nix b/pkgs/os-specific/linux/kernel/linux-4.5.nix
new file mode 100644
index 00000000000..790175d6e88
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/linux-4.5.nix
@@ -0,0 +1,20 @@
+{ stdenv, fetchurl, perl, buildLinux, ... } @ args:
+
+import ./generic.nix (args // rec {
+  version = "4.5";
+  modDirVersion = "4.5.0";
+  extraMeta.branch = "4.5";
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
+    sha256 = "172i3arrc34mb7nxw31iqrmbwrdnp8dmrbf8p3b3f6z006sfy3d4";
+  };
+
+  kernelPatches = args.kernelPatches;
+
+  features.iwlwifi = true;
+  features.efiBootStub = true;
+  features.needsCifsUtils = true;
+  features.canDisableNetfilterConntrackHelpers = true;
+  features.netfilterRPFilter = true;
+} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix
index fb52b14c9ae..d781a5b9685 100644
--- a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix
@@ -1,5 +1,8 @@
 { stdenv, fetchgit, perl, buildLinux, ncurses, openssh, ... } @ args:
 
+# ChromiumOS requires a 64bit build host
+assert stdenv.is64bit;
+
 import ./generic.nix (args // rec {
   version = "3.14.0";
   extraMeta.branch = "3.14";
diff --git a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix
index 9ab3f70c97f..fc0997eabdd 100644
--- a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix
@@ -1,5 +1,8 @@
 { stdenv, fetchgit, perl, buildLinux, ncurses, ... } @ args:
 
+# ChromiumOS requires a 64bit build host
+assert stdenv.is64bit;
+
 import ./generic.nix (args // rec {
   version = "3.18.0";
   extraMeta.branch = "3.18";
diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity-3.14.nix b/pkgs/os-specific/linux/kernel/linux-grsecurity-3.14.nix
index a67a91b4d0c..da628620764 100644
--- a/pkgs/os-specific/linux/kernel/linux-grsecurity-3.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-grsecurity-3.14.nix
@@ -1,5 +1,7 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
+throw "grsecurity stable is no longer supported; please update your configuration"
+
 import ./generic.nix (args // rec {
   version = "3.14.51";
   extraMeta.branch = "3.14";
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 320d4994cf2..777662718af 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -2,17 +2,17 @@
 
 let
 
-  rev = "fe4a83540ec73dfc298f16f027277355470ea9a0";
+  rev = "f4b20d47d7df7927967fcd524324b145cfc9e2f9";
 
 in import ./generic.nix (args // rec {
-  version = "3.18.y-${rev}";
+  version = "4.1.y-${rev}";
 
-  modDirVersion = "3.18.7";
+  modDirVersion = "4.1.20-v7";
 
   src = fetchurl {
     url = "https://api.github.com/repos/raspberrypi/linux/tarball/${rev}";
     name = "linux-raspberrypi-${version}.tar.gz";
-    sha256 = "05gq40f038hxjqd3sdb1914g2bzw533dyxy59sgdpybs8801x2vb";
+    sha256 = "0x17hlbi7lpmmnp24dnkync5gzj57j84j0nlrcv1lv9fahjkqsm2";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 57a825ec0a0..e58230712a9 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.5-rc7";
-  modDirVersion = "4.5.0-rc7";
-  extraMeta.branch = "4.5";
+  version = "4.6-rc1";
+  modDirVersion = "4.6.0-rc1";
+  extraMeta.branch = "4.6";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/testing/linux-${version}.tar.xz";
-    sha256 = "0z43s7ccikmqigv4insjvizs3bkx2lgjvzsz5rmmpcga28dz44kq";
+    sha256 = "1y73sjd7i48d1c8x52z59imx8g8d00wy67r5666cvwqrq8d407h0";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 1e5c64ccb8a..ad80d2ed93c 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.
-  NIX_CFLAGS_COMPILE = "-I${elfutils}/include -Wno-error=cpp";
+  NIX_CFLAGS_COMPILE = "-I${elfutils}/include -Wno-error=cpp -Wno-error=bool-compare";
   NIX_CFLAGS_LINK = "-L${elfutils}/lib";
 
   installFlags = "install install-man ASCIIDOC8=1";
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index d1a2fabf814..cb30de44a81 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "kexec-tools-${version}";
-  version = "2.0.11";
+  version = "2.0.12";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${name}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${name}.tar.xz"
     ];
-    sha256 = "1qrfka9xvy77k0rg3k0cf7xai0f9vpgsbs4l3bs8r4nvzy37j2di";
+    sha256 = "03cj7w2l5fqn72xfhl4q6z0zbziwkp9bfn0gs7gaf9i44jv6gkhl";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/os-specific/linux/ldm/default.nix b/pkgs/os-specific/linux/ldm/default.nix
index 5332fc0bf3d..5e9b2c869ef 100644
--- a/pkgs/os-specific/linux/ldm/default.nix
+++ b/pkgs/os-specific/linux/ldm/default.nix
@@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ udev utillinux ];
 
   postPatch = ''
-    sed -i '1i#include <sys/stat.h>' ldm.c
     substituteInPlace ldm.c \
       --replace "/mnt/" "${mountPath}"
+    sed '16i#include <sys/stat.h>' -i ldm.c
   '';
 
   buildFlags = "ldm";
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index 0bcc6dd5143..b3a67e70a1d 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation rec {
     license = with licenses; [ lgpl21 gpl2 mit ];
     platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
+    broken =
+      (builtins.compareVersions kernel.version "3.18" == -1) ||
+      (kernel.features.grsecurity or false);
   };
 
 }
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 43a77f4c828..fcfe4975fd7 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, pkgconfig, perl, docbook2x
+{ stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig, perl, docbook2x
 , docbook_xml_dtd_45, python3Packages
 
 # Optional Dependencies
@@ -12,11 +12,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "lxc-${version}";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchurl {
     url = "https://linuxcontainers.org/downloads/lxc/lxc-${version}.tar.gz";
-    sha256 = "1p75ff4lnkm7hq26zq09nqbdypl508csk0ix024l7j8v02i2w1wg";
+    sha256 = "1gnhgs4i2zamfdydj895inr9i072658wd47nf1ryw5710hdsv24m";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,13 @@ stdenv.mkDerivation rec {
     python3Packages.python systemd
   ];
 
-  patches = [ ./support-db2x.patch ];
+  patches = [
+    ./support-db2x.patch
+    (fetchpatch {
+      url = "https://github.com/lxc/lxc/commit/3db8dd39a797f87f8b348f1b6b44953a25f3f170.patch";
+      sha256 = "0scbzm9dqqhqsl0ri8da8a34r4qj9ph0cg68l9s7gw01vpvqbs8l";
+    })
+  ];
 
   XML_CATALOG_FILES = "${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml";
 
@@ -79,6 +85,6 @@ stdenv.mkDerivation rec {
     '';
 
     platforms = platforms.linux;
-    maintainers = with maintainers; [ simons wkennington globin ];
+    maintainers = with maintainers; [ simons wkennington globin fpletz ];
   };
 }
diff --git a/pkgs/os-specific/linux/mbpfan/default.nix b/pkgs/os-specific/linux/mbpfan/default.nix
index 75099e95f90..54de1e1108c 100644
--- a/pkgs/os-specific/linux/mbpfan/default.nix
+++ b/pkgs/os-specific/linux/mbpfan/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "mbpfan-${version}";
-  version = "1.9.0";
+  version = "1.9.1";
   src = fetchFromGitHub {
     owner = "dgraziotin";
     repo = "mbpfan";
     rev = "v${version}";
-    sha256 = "15nm1d0a0c0lzxqngrpn2qpsydsmglnn6d20djl7brpsq26j24h9";
+    sha256 = "0issn5233h2nclrmh2jzyy5y0dyyd57f1ia7gvs3bys95glcm2s5";
   };
   patches = [ ./fixes.patch ];
   postPatch = ''
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index a30558092c3..cd2cd511435 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "mcelog-${version}";
-  version = "133";
+  version = "135";
 
   src = fetchFromGitHub {
-    sha256 = "1qj9jz67bd834sgqcxhyhn9fzxg8y9vfw7gmza5ikmjm6yi6mmfr";
+    sha256 = "1bkbcb2zz7x7q893f1r8bm783jb3v7ww1yqys1hmqzn40hdwfr8p";
     rev = "v${version}";
     repo = "mcelog";
     owner = "andikleen";
diff --git a/pkgs/os-specific/linux/mxu11x0/default.nix b/pkgs/os-specific/linux/mxu11x0/default.nix
new file mode 100644
index 00000000000..4af40432403
--- /dev/null
+++ b/pkgs/os-specific/linux/mxu11x0/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitHub, kernel }:
+
+# it doesn't compile anymore on 3.14
+assert stdenv.lib.versionAtLeast kernel.version "3.18";
+
+stdenv.mkDerivation {
+  name = "mxu11x0-1.3.11-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "ellysh";
+    repo = "mxu11x0";
+    rev = "de54053d6f297785d77aba9e9c880001519ffddf";
+    sha256 = "1zmqanw22pgaj3b3lnciq33w6svm5ngg6g0k5xxwwijixg8ri3lf";
+  };
+
+  preBuild = ''
+    sed -i -e "s/\$(uname -r).*/${kernel.modDirVersion}/g" driver/mxconf
+    sed -i -e "s/\$(shell uname -r).*/${kernel.modDirVersion}/g" driver/Makefile
+    sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/mxconf
+    sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/Makefile
+  '';
+  installPhase = ''
+    install -v -D -m 644 ./driver/mxu11x0.ko "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/usb/serial/mxu11x0.ko"
+    install -v -D -m 644 ./driver/mxu11x0.ko "$out/lib/modules/${kernel.modDirVersion}/misc/mxu11x0.ko"
+  '';
+
+  dontStrip = true;
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "MOXA UPort 11x0 USB to Serial Hub driver";
+    homepage = "https://github.com/ellysh/mxu11x0";
+    license = licenses.gpl1;
+    maintainers = with maintainers; [ uralbash ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/nvidia-x11/beta.nix b/pkgs/os-specific/linux/nvidia-x11/beta.nix
index d53d5e19d40..d3111a4f75a 100644
--- a/pkgs/os-specific/linux/nvidia-x11/beta.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/beta.nix
@@ -12,7 +12,7 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "361.18";
+  versionNumber = "349.12";
 
   # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
@@ -27,13 +27,13 @@ stdenv.mkDerivation {
   src =
     if stdenv.system == "i686-linux" then
       fetchurl {
-        url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "1n6nrz59r3dgcpkcpr4yw997fygkpsdbv1x45c30w781w0j1q5s5";
+        url = "http://us.download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
+        sha256 = "0x9zfw66nxv98zpkdkymlyqzspksk850bhfmza7g7pba4yba085h";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
-        url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "12fi7vb697h38qh0f2j40q76yx9fqk6vwx20zfxhac3fvdhw2sj0";
+        url = "http://us.download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
+        sha256 = "19mfkigzffxsik3h4bsjsl481q410h804fz3rdc7chs86q4bg9h3";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 09c104f09e7..c1f165c45dd 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -19,7 +19,7 @@ buildPhase() {
         sysSrc=$(echo $kernel/lib/modules/$kernelVersion/source)
         sysOut=$(echo $kernel/lib/modules/$kernelVersion/build)
         unset src # used by the nv makefile
-        make SYSSRC=$sysSrc SYSOUT=$sysOut module "-j${NIX_BUILD_CORES}" "-l${NIX_BUILD_CORES}"
+        make SYSSRC=$sysSrc SYSOUT=$sysOut module
 
         cd ..
     fi
@@ -34,14 +34,6 @@ installPhase() {
     cp -prd *.so.* tls "$out/lib/"
     rm "$out"/lib/lib{glx,nvidia-wfb}.so.* # handled separately
 
-    # According to nvidia, we're supposed to use GLVND.
-    # But so far I've failed to make any applications run using that stack.
-    #
-    # If you want to try it, swap the two lines below.
-
-    #rm "$out"/lib/libGL.so.${versionNumber} # Non-GLVND
-    rm $out/lib/libGL.so.1.* # GLVND
-
     if test -z "$libsOnly"; then
         # Install the X drivers.
         mkdir -p $out/lib/xorg/modules
@@ -69,7 +61,7 @@ installPhase() {
       libname_short=`echo -n "$libname" | sed 's/so\..*/so/'`
 
       # nvidia's EGL stack seems to expect libGLESv2.so.2 to be available
-      if [ $(basename "$libname_short") == "libGLESv2.so" -a "$libname" != "$libname_short.2" ]; then
+      if [ $(basename "$libname_short") == "libGLESv2.so" ]; then
           ln -srnf "$libname" "$libname_short.2"
       fi
 
@@ -127,6 +119,9 @@ installPhase() {
     # For simplicity and dependency reduction, don't support the gtk3 interface.
     rm $out/lib/libnvidia-gtk3.*
 
+    # We distribute these separately in `libvdpau`
+    rm "$out"/lib/libvdpau{.*,_trace.*}
+
     # Move VDPAU libraries to their place
     mkdir "$out"/lib/vdpau
     mv "$out"/lib/libvdpau* "$out"/lib/vdpau
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 86abeeaa824..fff1135d311 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -12,7 +12,7 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "361.28";
+  versionNumber = "358.16";
 
   # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
@@ -28,12 +28,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "013l9hfjc7gyk5g2v2h71lwjmx4dqlkczsb17cz833fnadcrn4hs";
+        sha256 = "1cc0zsri92nz2mznabfd6pqckm9mlbszmysqqqh3w5mipwn898nk";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "1kq335mdmwlgp0lp9z8wrwyh48p2xv2nwdlgfj7b83vsh6ib17a4";
+        sha256 = "1xr16faam2zsx8ajwm9g9302m6qjzyjh1zd56g8jhc8jxg8h43sg";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
diff --git a/pkgs/os-specific/linux/rtl8723bs/default.nix b/pkgs/os-specific/linux/rtl8723bs/default.nix
index 1739ac1faa7..6d55c5522f4 100644
--- a/pkgs/os-specific/linux/rtl8723bs/default.nix
+++ b/pkgs/os-specific/linux/rtl8723bs/default.nix
@@ -31,5 +31,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/hadess/rtl8723bs";
     license = stdenv.lib.licenses.gpl2;
     platforms = [ "x86_64-linux" "i686-linux" ];
+    broken = !stdenv.lib.versionAtLeast kernel.version "3.19";
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index 102b935be29..75c01cfe1f7 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/csssuf/rtl8812au";
     license = stdenv.lib.licenses.gpl2;
     platforms = [ "x86_64-linux" "i686-linux" ];
+    broken = (kernel.features.grsecurity or false);
   };
 }
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index 3fbfa4fdc53..aad7d1402ab 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -17,13 +17,13 @@ assert buildKernel -> kernel != null;
 stdenv.mkDerivation rec {
   name = "spl-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
-  version = "0.6.5.4";
+  version = "0.6.5.5";
 
   src = fetchFromGitHub {
     owner = "zfsonlinux";
     repo = "spl";
     rev = "spl-${version}";
-    sha256 = "0k80xvl15ahbs0mylfl2bd5widxhngpf7dl6zq46s21wk0795jl4";
+    sha256 = "1f49qv648klg2sn1v1wzwd6ls1njjj0hrazz7msd74ayhwm0zcw7";
   };
 
   patches = [ ./const.patch ./install_prefix.patch ];
@@ -64,5 +64,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ jcumming wizeman wkennington ];
+    broken = (kernel.features.grsecurity or false);
   };
 }
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index c49f393dd16..14f016790db 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -20,13 +20,13 @@ assert buildKernel -> kernel != null && spl != null;
 stdenv.mkDerivation rec {
   name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
-  version = "0.6.5.4";
+  version = "0.6.5.5";
 
   src = fetchFromGitHub {
     owner = "zfsonlinux";
     repo = "zfs";
     rev = "zfs-${version}";
-    sha256 = "10zf1kdgmdiaaa3zmz4sz5aj5ql6v24wcwixlxbwhwc51mr46k50";
+    sha256 = "0np03p5zkx87a0a5rw629f9m4wp5gd01c1jkh5p7h63mmvaxfdda";
   };
 
   patches = [ ./nix-build.patch ];