Merge remote-tracking branch 'upstream/master' into hardened-stdenv

32 files changed, 119 insertions, 50 deletions

diff --git a/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix b/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix
index 0460c516d29..60b461a8040 100644
--- a/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix
+++ b/pkgs/os-specific/darwin/reattach-to-user-namespace/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   name = "reattach-to-user-namespace-2.4";
   src = fetchgit {
     url = "https://github.com/ChrisJohnsen/tmux-MacOSX-pasteboard.git";
-    sha256 = "1f9q1wxq764zidnx5hbdkbbyxxzfih0l0cjpgr0pxzwbmd2q6cvv";
+    sha256 = "0hrh95di5dvpynq2yfcrgn93l077h28i6msham00byw68cx0dd3z";
     rev = "2765aeab8f337c29e260a912bf4267a2732d8640";
   };
   buildFlags = "ARCHES=x86_64";
diff --git a/pkgs/os-specific/gnu/mach/default.nix b/pkgs/os-specific/gnu/mach/default.nix
index e8c15850715..852b400ccb1 100644
--- a/pkgs/os-specific/gnu/mach/default.nix
+++ b/pkgs/os-specific/gnu/mach/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation ({
 
   src = fetchgit {
     url = "git://git.sv.gnu.org/hurd/gnumach.git";
-    sha256 = "6db17d091d410fb573e15ae5d59d860a17d78b2073f605c1dc1473f6f2c25ccc";
+    sha256 = "1q8zk8xzbiwpnvvmfgkylj4gwkvkn5n2ydy9j054qv5plnaczj1c";
     inherit rev;
   };
 
diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix
index 72f14ff2d68..a461a722915 100644
--- a/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, gpsd, libcap }:
 
 let
-  ver = "2016.0";
+  ver = "2016.1";
 in
 stdenv.mkDerivation rec {
   name = "alfred-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "1zlmcp9r1xwp6li56j5ip9x7h5gjdhh0gi6cb3f8x6ydszhynxbf";
+    sha256 = "02963m1vk9skmvdyd0j3281wslb9cwzr7bdx4dg2wxyncgrgl3ky";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index c17f7beb74f..2c8eea331cd 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, libnl }:
 
 let
-  ver = "2016.0";
+  ver = "2016.1";
 in
 stdenv.mkDerivation rec {
   name = "batctl-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "0khpw0w26j6pc1263phk086chs64p9m6a63azk62pxs1cmmbr80y";
+    sha256 = "1j83dzz12c0k7qqd01vmng64h1iq36c86r8ybp8vhb6x5mxkjm68";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index aabd36f945f..495fdc511eb 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -2,14 +2,14 @@
 
 #assert stdenv.lib.versionOlder kernel.version "3.17";
 
-let base = "batman-adv-2016.0"; in
+let base = "batman-adv-2016.1"; in
 
 stdenv.mkDerivation rec {
   name = "${base}-${kernel.version}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/${base}/${base}.tar.gz";
-    sha256 = "0r5faf12ifpj8h1fklkzvy4ck359cadk8xh1l3n7vimh67hxbxbz";
+    sha256 = "0wm0v82kdkli713q4gcq21wbd6mirqmc7xva3kmc3z6kvwlc53ai";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/disk-indicator/default.nix b/pkgs/os-specific/linux/disk-indicator/default.nix
index 4c2d0c88576..46ebc923e3b 100644
--- a/pkgs/os-specific/linux/disk-indicator/default.nix
+++ b/pkgs/os-specific/linux/disk-indicator/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   src = fetchgit {
     url = git://github.com/MeanEYE/Disk-Indicator.git;
     rev = "51ef4afd8141b8d0659cbc7dc62189c56ae9c2da";
-    sha256 = "0f8mxl3wqlap8zajdk6r9liliayp8w4xs4jy8jbwanmmppwz0nb9";
+    sha256 = "10jx6mx9qarn21p2l2jayxkn1gmqhvck1wymgsr4jmbwxl8ra5kd";
   };
 
   buildInputs = [ libX11 ];
diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix
index 81b3874cb2c..907bb70e738 100644
--- a/pkgs/os-specific/linux/dpdk/default.nix
+++ b/pkgs/os-specific/linux/dpdk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, kernel, fetchurl }:
+{ stdenv, lib, kernel, fetchurl, pkgconfig, libvirt }:
 
 assert lib.versionAtLeast kernel.version "3.18";
 
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0yrz3nnhv65v2jzz726bjswkn8ffqc1sr699qypc9m78qrdljcfn";
   };
 
+  buildInputs = [ pkgconfig libvirt ];
+
   RTE_KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
   RTE_TARGET = "x86_64-native-linuxapp-gcc";
 
@@ -18,7 +20,7 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = [ "-march=core2" ];
 
   enableParallelBuilding = true;
-  outputs = [ "out" "examples" ];
+  outputs = [ "out" "kmod" "examples" ];
 
   hardeningDisable = [ "pic" ];
 
@@ -29,11 +31,31 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    mkdir $out
-    cp -pr x86_64-native-linuxapp-gcc/{app,lib,include,kmod} $out/
+    install -m 0755 -d $out/lib
+    install -m 0644 ${RTE_TARGET}/lib/*.a $out/lib
+
+    install -m 0755 -d $out/include
+    install -m 0644 ${RTE_TARGET}/include/*.h $out/include
+
+    install -m 0755 -d $out/include/generic
+    install -m 0644 ${RTE_TARGET}/include/generic/*.h $out/include/generic
+
+    install -m 0755 -d $out/include/exec-env
+    install -m 0644 ${RTE_TARGET}/include/exec-env/*.h $out/include/exec-env
+
+    install -m 0755 -d $out/${RTE_TARGET}
+    install -m 0644 ${RTE_TARGET}/.config $out/${RTE_TARGET}
+
+    install -m 0755 -d $out/${RTE_TARGET}/include
+    install -m 0644 ${RTE_TARGET}/include/rte_config.h $out/${RTE_TARGET}/include
+
+    cp -pr mk scripts $out/
+
+    mkdir -p $kmod/lib/modules/${kernel.modDirVersion}/kernel/drivers/net
+    cp ${RTE_TARGET}/kmod/*.ko $kmod/lib/modules/${kernel.modDirVersion}/kernel/drivers/net
 
-    mkdir $examples
-    cp -pr examples/* $examples/
+    mkdir -p $examples/bin
+    find examples ${RTE_TARGET}/app -type f -executable -exec cp {} $examples/bin \;
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/firmware/rt5677/default.nix b/pkgs/os-specific/linux/firmware/rt5677/default.nix
index 46716b3f490..fe083d2ad65 100644
--- a/pkgs/os-specific/linux/firmware/rt5677/default.nix
+++ b/pkgs/os-specific/linux/firmware/rt5677/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   src = fetchgit {
     url = "https://github.com/raphael/linux-samus";
     rev = "995de6c2093797905fbcd79f1a3625dd3f50be37";
-    sha256 = "6e59f7ce24122eb9474e7863e63729de632e4c7afcb8f08534cb2102007f8381";
+    sha256 = "0a6lz9wadm47cmva136q6wd0lw03bmymf9ispnzb091a7skwacry";
   };
 
 
diff --git a/pkgs/os-specific/linux/fusionio/util.nix b/pkgs/os-specific/linux/fusionio/util.nix
index e77d596dc6f..0f1e2748c88 100644
--- a/pkgs/os-specific/linux/fusionio/util.nix
+++ b/pkgs/os-specific/linux/fusionio/util.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     cp -r $TMPDIR/{etc,usr/{bin,lib,share}} $out
     for BIN in $(find $out/bin -type f); do
       echo Patching $BIN
-      patchelf --set-interpreter "${glibc.out}/lib/ld-linux-x86-64.so.2" --set-rpath "${glibc.out}/lib:${gcc.cc}/lib:${libuuid}/lib:$out/lib" $BIN
+      patchelf --set-interpreter "${glibc.out}/lib/ld-linux-x86-64.so.2" --set-rpath "${stdenv.lib.makeLibraryPath [ glibc gcc.cc libuuid ] }:$out/lib" $BIN
 
       # Test our binary to see if it was correctly patched
       set +e
diff --git a/pkgs/os-specific/linux/gfxtablet/default.nix b/pkgs/os-specific/linux/gfxtablet/default.nix
index 394defdb19a..36397b77b77 100644
--- a/pkgs/os-specific/linux/gfxtablet/default.nix
+++ b/pkgs/os-specific/linux/gfxtablet/default.nix
@@ -5,7 +5,7 @@ let
     version="git-2013-10-21";
     name = "gfxtablet-uinput-driver-${version}";
     rev = "c4e337ae0b53a8ccdfe11b904ff129714bd25ec4";
-    sha256 = "19d96r2vw9xv82fnfwdyyyf0fja6n06mgg14va996knsn2x5l4la";
+    sha256 = "14ll9rls2mamllmpwjiv2dc6165plazv7ny9cliylafrwgb55l7p";
     url = "https://github.com/rfc2822/GfxTablet.git";
   };
   buildInputs = [
diff --git a/pkgs/os-specific/linux/ima-evm-utils/default.nix b/pkgs/os-specific/linux/ima-evm-utils/default.nix
index ad3df25df58..a58f55abecf 100644
--- a/pkgs/os-specific/linux/ima-evm-utils/default.nix
+++ b/pkgs/os-specific/linux/ima-evm-utils/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "git://git.code.sf.net/p/linux-ima/ima-evm-utils";
     rev = "4b56112c095cb5cc34dc35abac37ebfc6eadba65";
-    sha256 = "6f1ef4e84b9214448ea4a530a562a20ad1ba5a7cfefd7ddda90a56e2404f3a87";
+    sha256 = "1h3rydnaswcmlradafpw8q18zj88bbziad2vb6gn0q7ydr48f3jm";
   };
 
   buildInputs = [ autoreconfHook pkgconfig openssl attr keyutils asciidoc libxslt ];
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 485cdd76f6a..3ce65a3f6e1 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -255,6 +255,9 @@ with stdenv.lib;
     SQUASHFS_LZ4 y
   ''}
 
+  # Runtime security tests
+  DEBUG_SET_MODULE_RONX? y # Detect writes to read-only module pages
+
   # Security related features.
   STRICT_DEVMEM y # Filter access to /dev/mem
   SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
diff --git a/pkgs/os-specific/linux/kernel/linux-4.1.nix b/pkgs/os-specific/linux/kernel/linux-4.1.nix
index 57e239c1d09..1e8932ad598 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.1.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.1.20";
+  version = "4.1.25";
   extraMeta.branch = "4.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1dpq8dgj351jzm7n6330a4xriz9dxv7d9wxzj9zn9q7ya22np9gs";
+    sha256 = "0rfs5vn9ggymd426jr4gkhgk9bnn1g9c5x7k3xgfh4i08mq1920f";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index e89a53d21bf..4bc501a3ba2 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.11";
+  version = "4.4.12";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1c0lqk2q4hf8jx6myhcqgh2509d36wx87l5k5cl3xfsnrzrpclrs";
+    sha256 = "1r96jyvm44615f5zh5sn04zx7y8bllpx12lx1zjkns66i4ddv0rq";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.5.nix b/pkgs/os-specific/linux/kernel/linux-4.5.nix
index 84d48865bcb..94561ed2e54 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.5.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.5.5";
+  version = "4.5.6";
   extraMeta.branch = "4.5";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0l7wnilqqhg3im2v04g6k2x621yckdb9bpfh8s8jq9l2fixjln99";
+    sha256 = "1bdyviimgnc4zbgd9v1xk87sj9h8cprjykifriddwslqxyr2yh0y";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.6.nix b/pkgs/os-specific/linux/kernel/linux-4.6.nix
index 0a85af58473..b93550b6ea6 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.6.nix
@@ -1,13 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.6";
-  modDirVersion = "4.6.0";
+  version = "4.6.1";
   extraMeta.branch = "4.6";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "a93771cd5a8ad27798f22e9240538dfea48d3a2bf2a6a6ab415de3f02d25d866";
+    sha256 = "073vpwidl28ka3y2rd7n6dcckrppi5kalh48vsz980k9z12g9pfm";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix
index d781a5b9685..72d7cd1fba0 100644
--- a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix
@@ -10,7 +10,7 @@ import ./generic.nix (args // rec {
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/third_party/kernel";
     rev = "63a768b40c91c6f3518ea1f20d0cb664ed4e6a57";
-    sha256 = "613527a032699be32c18d3f5d8d4c215d7718279a1c372c9f371d4e6c0b9cc34";
+    sha256 = "1gysrjanvnkbvgml7ipjr119bmlqfqn2zz5ca5kjkapwrfm3cb69";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix
index fc0997eabdd..4be81409ee1 100644
--- a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix
@@ -10,7 +10,7 @@ import ./generic.nix (args // rec {
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/third_party/kernel";
     rev = "3179ec7e3f07fcc3ca35817174c5fc6584030ab3";
-    sha256 = "0hfa97fs216x8q20fsmw02kvf6mw6c6zczfjk2bpym6v7zxdzj28";
+    sha256 = "0c9ccasx9kisck23350w1xf8s7qzvgvn70xlxdbkh2b18kgm0y5f";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix b/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix
index 84d48865bcb..63db1779014 100644
--- a/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.5.5";
+  version = "4.5.7";
   extraMeta.branch = "4.5";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0l7wnilqqhg3im2v04g6k2x621yckdb9bpfh8s8jq9l2fixjln99";
+    sha256 = "0azvh7lf9kak1xcs5f9smlvx4gkf45vyandizmxhx0zyjlhacw60";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 820e9ed6e26..877e51565ac 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -95,9 +95,9 @@ rec {
   grsecurity_4_5 = grsecPatch
     { kernel    = pkgs.grsecurity_base_linux_4_5;
       patches   = [ grsecurity_fix_path_4_5 ];
-      kversion  = "4.5.5";
-      revision  = "201605291201";
-      sha256    = "0r66l5zmvlb7phlvi1pma7vzj78krl23k8lcpdqlx27szr361sda";
+      kversion  = "4.5.7";
+      revision  = "201606080852";
+      sha256    = "1vgc314nh6bd7zw9r927lnbjq29z32g0s02jgvf635y9zz550nsh";
     };
 
   grsecurity_latest = grsecurity_4_5;
diff --git a/pkgs/os-specific/linux/ldm/default.nix b/pkgs/os-specific/linux/ldm/default.nix
index 5e9b2c869ef..0c333feab1c 100644
--- a/pkgs/os-specific/linux/ldm/default.nix
+++ b/pkgs/os-specific/linux/ldm/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = meta.repositories.git;
     rev = "refs/tags/v${version}";
-    sha256 = "0kkby3a0xgh1lmkbzpsi4am2rqjv3ccgdpic99aw1c76y0ca837y";
+    sha256 = "0lxfypnbamfx6p9ar5k9wra20gvwn665l4pp2j4vsx4yi5q7rw2n";
   };
 
   buildInputs = [ udev utillinux ];
diff --git a/pkgs/os-specific/linux/lightum/default.nix b/pkgs/os-specific/linux/lightum/default.nix
index 62fbecf27d1..0ef447ed924 100644
--- a/pkgs/os-specific/linux/lightum/default.nix
+++ b/pkgs/os-specific/linux/lightum/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation {
   src = fetchgit {
     url = https://github.com/poliva/lightum;
     rev = "123e6babe0669b23d4c1dfa5511088608ff2baa8";
-    sha256 = "1r8c9mb82qgs8i7dczqx8fc7xrbn413b59xkqgjh4z1pfy75sl79";
+    sha256 = "01x24rcrkgksyvqpgkr9zafg3jgs8nqng8yf0hx0kbmcimar8dbp";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index a376e1f8459..2d743035e14 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "mcelog-${version}";
-  version = "137";
+  version = "138";
 
   src = fetchFromGitHub {
-    sha256 = "0kx4jcgs2h5jvrjyrkn92vl2wxg6ny4sipzs2mlszcr4ky27am6z";
+    sha256 = "039ycn5m3gx4n0kppxl35wcrkyva6lv64qhlqhh7034qkbqbhqiy";
     rev = "v${version}";
     repo = "mcelog";
     owner = "andikleen";
diff --git a/pkgs/os-specific/linux/mmc-utils/default.nix b/pkgs/os-specific/linux/mmc-utils/default.nix
index 8f7881b13e8..a17f687a255 100644
--- a/pkgs/os-specific/linux/mmc-utils/default.nix
+++ b/pkgs/os-specific/linux/mmc-utils/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc-utils.git";
     rev = "44f94b925894577f9ffcf2c418dd013a5e582648";
-    sha256 = "1c1g9jpyhykhmidz7mjzrf63w3xlzqkijrqz1g6j4dz6p9pv1gax";
+    sha256 = "0hkdzc71pdnscbpdpgwljcchiyancarldjyd0w609sy18bky833x";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index e67df53c9ed..e3be760700b 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -12,7 +12,7 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "361.42";
+  versionNumber = "361.45.11";
 
   # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
@@ -28,12 +28,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "10jfdrmjcddgp7kg9l3dwxjh4b7sdrg86nwaf6zalfnsc9zh8bg3";
+        sha256 = "036v7bzh9zy7zvaz2wf7zsamrynbg1yr1dll7sf1l928w059i6pb";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "04yyrzk4xzq1i386mdxfwg4dqiclvj1fm195qsqy0r79zmpc3kq4";
+        sha256 = "1f8bxmf8cr3cgzxgap5ccb1yrqyrrdig19dp282y6z9xjq27l074";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
new file mode 100644
index 00000000000..456e9a4679c
--- /dev/null
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchurl, dpdk, libpcap, utillinux }:
+
+stdenv.mkDerivation rec {
+  name = "pktgen-${version}";
+  version = "3.0.00";
+
+  src = fetchurl {
+    url = "http://dpdk.org/browse/apps/pktgen-dpdk/snapshot/pktgen-${version}.tar.gz";
+    sha256 = "703f8bd615aa4ae3a3085055483f9889dda09d082abb58afd33c1ba7c766ea65";
+  };
+
+  buildInputs = [ dpdk libpcap ];
+
+  RTE_SDK = "${dpdk}";
+  RTE_TARGET = "x86_64-native-linuxapp-gcc";
+
+  enableParallelBuilding = true;
+
+  NIX_CFLAGS_COMPILE = [ "-march=core2" ];
+
+  patchPhase = ''
+    sed -i -e s:/usr/local:$out:g lib/lua/src/luaconf.h
+    sed -i -e s:/usr/bin/lscpu:${utillinux}/bin/lscpu:g lib/common/wr_lscpu.h
+  '';
+
+  installPhase = ''
+    install -d $out/bin
+    install -m 0755 app/app/${RTE_TARGET}/app/pktgen $out/bin
+    install -d $out/lib/lua/5.3
+    install -m 0644 Pktgen.lua $out/lib/lua/5.3
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Traffic generator powered by DPDK";
+    homepage = http://dpdk.org/;
+    license = licenses.bsdOriginal;
+    platforms =  [ "x86_64-linux" ];
+    maintainers = [ maintainers.abuibrahim ];
+  };
+}
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index f5dc3145b68..0ba6c431c9f 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -2,7 +2,7 @@
 , zlib, xz, pam, acl, cryptsetup, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libapparmor, audit, lz4
 , kexectools, libmicrohttpd, linuxHeaders ? stdenv.cc.libc.linuxHeaders, libseccomp
-, iptables
+, iptables, gnu-efi
 , autoreconfHook, gettext, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
 , enableKDbus ? false
 }:
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     [ linuxHeaders pkgconfig intltool gperf libcap kmod xz pam acl
       /* cryptsetup */ libuuid m4 glib libxslt libgcrypt libgpgerror
       libmicrohttpd kexectools libseccomp libffi audit lz4 libapparmor
-      iptables
+      iptables gnu-efi
       /* FIXME: we may be able to prevent the following dependencies
          by generating an autoconf'd tarball, but that's probably not
          worth it. */
@@ -72,6 +72,11 @@ stdenv.mkDerivation rec {
       "--disable-ldconfig"
       "--disable-smack"
 
+      (if stdenv.isArm then "--disable-gnuefi" else "--enable-gnuefi")
+      "--with-efi-libdir=${gnu-efi}/lib"
+      "--with-efi-includedir=${gnu-efi}/include"
+      "--with-efi-ldsdir=${gnu-efi}/lib"
+
       "--with-sysvinit-path="
       "--with-sysvrcnd-path="
       "--with-rc-local-script-path-stop=/etc/halt.local"
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index aeb2c371c2a..c50f0185eb5 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url    = "git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/trace-cmd.git";
     rev    = "refs/tags/trace-cmd-v${version}";
-    sha256 = "42286440a45d1b24552a1d3cdb656dc648ad346fc426b5798bacdbffd3c4b226";
+    sha256 = "15d6b7l766h2mamqgphx6l6a33b1zn0yar2h7i6b24ph6kz3idxn";
   };
 
   buildInputs = [ asciidoc libxslt ];
diff --git a/pkgs/os-specific/linux/uksmtools/default.nix b/pkgs/os-specific/linux/uksmtools/default.nix
index cd7c7527fe9..4efc2d42f2b 100644
--- a/pkgs/os-specific/linux/uksmtools/default.nix
+++ b/pkgs/os-specific/linux/uksmtools/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   # This project uses git submodules, which fetchFromGitHub doesn't support:
   src = fetchgit {
-    sha256 = "0ngdmici2vgi2z02brzc3f78j1g1y9myzfxn46zlm1skg94fp692";
+    sha256 = "1nj53f24qjp0d87fzrz0y72rmv6lhxyiaqrsbd9v423h5zpmkrnj";
     rev = "9f59a3a0b494b758aa91d7d8fa04e21b5e6463c0";
     url = "https://github.com/pfactum/uksmtools.git";
   };
diff --git a/pkgs/os-specific/linux/usermount/default.nix b/pkgs/os-specific/linux/usermount/default.nix
index 6f96445ef5e..b00fc7296a0 100644
--- a/pkgs/os-specific/linux/usermount/default.nix
+++ b/pkgs/os-specific/linux/usermount/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   src = fetchgit {
     url = "https://github.com/tom5760/usermount.git";
     rev = "0d6aba3c1f8fec80de502f5b92fd8b28041cc8e4";
-    sha256 = "1bzxwq83ikljnv0f55siyd6rd0gs9v7jl9947lw6s1npa63x3b55";
+    sha256 = "0gpp0vwiwr7kgbhh26jspv3255662mnvnav6g8i2h0qxar8hf8w2";
   };
 
   buildInputs = [ pkgconfig dbus libnotify udisks2 gdk_pixbuf ];
diff --git a/pkgs/os-specific/linux/xf86-input-multitouch/default.nix b/pkgs/os-specific/linux/xf86-input-multitouch/default.nix
index 8b10136309c..80ff9922845 100644
--- a/pkgs/os-specific/linux/xf86-input-multitouch/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-multitouch/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   src = fetchgit {
     url = http://bitmath.org/git/multitouch.git;
     rev = "4d87c041f6a232aa30528d70d4b9946d1824b4ed";
-    sha256 = "79397c8f99deb2a415e8c9008a2847d973ad19ea004e732613baed707df46fc9";
+    sha256 = "1jh52d3lkmchn5xdbz4qn50d30nild1zxvfbvwwl2rbmphs5ww6y";
   };
 
   # Configuration from http://bitmath.org/code/multitouch/
diff --git a/pkgs/os-specific/linux/xf86-video-nested/default.nix b/pkgs/os-specific/linux/xf86-video-nested/default.nix
index 8b712553be9..8d3e490db87 100644
--- a/pkgs/os-specific/linux/xf86-video-nested/default.nix
+++ b/pkgs/os-specific/linux/xf86-video-nested/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
   src = fetchgit {
     url = git://anongit.freedesktop.org/xorg/driver/xf86-video-nested;
     rev = "ad48dc6eb98776a8a886f26f31c0110352fa1da4";
-    sha256 = "43a102405acdcdb346ab197b33c8fa724d2140f33754f8ee3941a0eea152735c";
+    sha256 = "0r5k9rk8mq4j51a310qvvfmhhz8a0cmcwr8pl8mkwfsgcpwxbpfg";
   };
 
   buildInputs =