17 files changed, 113 insertions, 62 deletions
diff --git a/pkgs/os-specific/linux/cramfsswap/default.nix b/pkgs/os-specific/linux/cramfsswap/default.nix
index 6a309197dd7b..440f99b0ad6f 100644
--- a/pkgs/os-specific/linux/cramfsswap/default.nix
+++ b/pkgs/os-specific/linux/cramfsswap/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   name = "cramfsswap-1.4.1";
   builder = ./builder.sh;
   src = fetchurl {
-    url = http://ftp.debian.org/debian/pool/main/c/cramfsswap/cramfsswap_1.4.1.tar.gz;
+    url = mirror://debian/pool/main/c/cramfsswap/cramfsswap_1.4.1.tar.gz;
     sha256 = "0c6lbx1inkbcvvhh3y6fvfaq3w7d1zv7psgpjs5f3zjk1jysi9qd";
   };
 
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 50ea3f6a0675..4e3ede284b45 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, devicemapper, libgcrypt, libuuid, pkgconfig, popt
+{ stdenv, fetchurl, devicemapper, openssl, libuuid, pkgconfig, popt
 , enablePython ? false, python ? null
 }:
 
@@ -12,10 +12,10 @@ stdenv.mkDerivation rec {
     sha256 = "0878vwblazms1dac2ds7vyz8pgi1aac8870ccnl2s0v2sv428g62";
   };
 
-  configureFlags = [ "--enable-cryptsetup-reencrypt" ]
+  configureFlags = [ "--enable-cryptsetup-reencrypt" "--with-crypto_backend=openssl" ]
                 ++ stdenv.lib.optional enablePython "--enable-python";
 
-  buildInputs = [ devicemapper libgcrypt libuuid pkgconfig popt ]
+  buildInputs = [ devicemapper openssl libuuid pkgconfig popt ]
              ++ stdenv.lib.optional enablePython python;
 
   meta = {
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 6ac468774ad1..8ab80ee1e4d0 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "firmware-linux-nonfree-${version}";
-  version = "2015-03-20";
+  version = "2015-05-13";
 
   src = fetchgit {
-    url = "git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
-    rev = "f404336ba808cbd57547196e13367079a23b822c";
-    sha256 = "0avz5vxax2b3s4gafib47vih1lbq78agdmpjcjnnnykw2kschkwa";
+    url = "http://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
+    rev = "3161bfa479d5e9ed4f46b57df9bcecbbc4f8eb3c";
+    sha256 = "0np6vwcnas3pzp38man3cs8j5ijs0p3skyzla19sfxzpwmjvfpjq";
   };
 
   preInstall = ''
diff --git a/pkgs/os-specific/linux/kbdlight/default.nix b/pkgs/os-specific/linux/kbdlight/default.nix
new file mode 100644
index 000000000000..1bc07f357a8a
--- /dev/null
+++ b/pkgs/os-specific/linux/kbdlight/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "kbdlight-${version}";
+  version = "1.3";
+
+  src = fetchFromGitHub {
+    owner = "hobarrera";
+    repo = "kbdlight";
+    rev = "v${version}";
+    sha256 = "1f08aid1xrbl4sb5447gkip9lnvkia1c4ap0v8zih5s9w8v72bny";
+  };
+
+  preConfigure = ''
+    substituteInPlace Makefile \
+      --replace /usr/local $out
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/hobarrera/kbdlight;
+    description = "A very simple application that changes MacBooks' keyboard backlight level";
+    license = licenses.isc;
+    maintainers = [ maintainers.womfoo ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 5fdfdb3b6a13..25b707614ed0 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -190,18 +190,26 @@ with stdenv.lib;
   OCFS2_DEBUG_MASKLOG? n
   BTRFS_FS_POSIX_ACL y
   UBIFS_FS_ADVANCED_COMPR? y
+  ${optionalString (versionAtLeast version "4.0") ''
+    NFSD_PNFS y
+  ''}
+  NFSD_V2_ACL y
+  NFSD_V3 y
+  NFSD_V3_ACL y
+  NFSD_V4 y
+  ${optionalString (versionAtLeast version "3.11") ''
+    NFSD_V4_SECURITY_LABEL y
+  ''}
+  NFS_FSCACHE y
   ${optionalString (versionAtLeast version "3.6") ''
     NFS_SWAP y
   ''}
+  NFS_V3_ACL y
   ${optionalString (versionAtLeast version "3.11") ''
     NFS_V4_1 y  # NFSv4.1 client support
     NFS_V4_2 y
+    NFS_V4_SECURITY_LABEL y
   ''}
-  NFSD_V2_ACL y
-  NFSD_V3 y
-  NFSD_V3_ACL y
-  NFSD_V4 y
-  NFS_FSCACHE y
   CIFS_XATTR y
   CIFS_POSIX y
   CIFS_FSCACHE y
@@ -226,7 +234,9 @@ with stdenv.lib;
   # Security related features.
   STRICT_DEVMEM y # Filter access to /dev/mem
   SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
-  DEVKMEM? n # Disable /dev/kmem
+  ${optionalString (!(features.grsecurity or false)) ''
+    DEVKMEM n # Disable /dev/kmem
+  ''}
   ${if versionOlder version "3.14" then ''
     CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
   '' else ''
@@ -292,6 +302,9 @@ with stdenv.lib;
   LOGO n # not needed
   MEDIA_ATTACH y
   MEGARAID_NEWGEN y
+  ${optionalString (versionAtLeast version "3.15") ''
+    MLX4_EN_VXLAN y
+  ''}
   MODVERSIONS y
   MOUSE_PS2_ELANTECH y # Elantech PS/2 protocol extension
   MTRR_SANITIZER y
@@ -367,15 +380,34 @@ with stdenv.lib;
 
   # Virtualisation.
   PARAVIRT? y
-  ${if versionAtLeast version "3.10" then ''
-    HYPERVISOR_GUEST? y
-  '' else ''
-    PARAVIRT_GUEST? y
-  ''}
-  KVM_GUEST? y
+  ${optionalString (!(features.grsecurity or false))
+    (if versionAtLeast version "3.10" then ''
+      HYPERVISOR_GUEST y
+    '' else ''
+      PARAVIRT_GUEST? y
+    '')
+  }
+  KVM_APIC_ARCHITECTURE y
+  KVM_ASYNC_PF y
   ${optionalString (versionOlder version "3.7") ''
     KVM_CLOCK? y
   ''}
+  ${optionalString (versionAtLeast version "4.0") ''
+    KVM_COMPAT y
+  ''}
+  ${optionalString (versionAtLeast version "3.10") ''
+    KVM_DEVICE_ASSIGNMENT? y
+  ''}
+  ${optionalString (versionAtLeast version "4.0") ''
+    KVM_GENERIC_DIRTYLOG_READ_PROTECT y
+  ''}
+  ${optionalString (!features.grsecurity or true) ''
+    KVM_GUEST y
+  ''}
+  KVM_MMIO y
+  ${optionalString (versionAtLeast version "3.13") ''
+    KVM_VFIO y
+  ''}
   XEN? y
   XEN_DOM0? y
   ${optionalString ((versionAtLeast version "3.18") && (features.xen_dom0 or false))  ''
diff --git a/pkgs/os-specific/linux/kernel/linux-3.10.nix b/pkgs/os-specific/linux/kernel/linux-3.10.nix
index a6ceb5b09547..b270f0852f64 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.10.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.10.77";
+  version = "3.10.79";
   extraMeta.branch = "3.10";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1vx2sg0pab3b3rflwhxrimwx18azqayys8zidzr6sv0x7ir9bc31";
+    sha256 = "0m30c9v4pvim72ha8ya8w6y691a8zkcrhxhj43kh668q1yqpqvkp";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.12.nix b/pkgs/os-specific/linux/kernel/linux-3.12.nix
index 810087b55a76..2646bf93b0ac 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.12.42";
+  version = "3.12.43";
   extraMeta.branch = "3.12";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0vp6yllal2gcyng1kklp9n8r18fhcb1m1ssavjbcbfax5chi7w5s";
+    sha256 = "08nsppn3rpwydkq0pd8k8fgjfm67y2nbbrcz1hri227crxxx13dm";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.14.nix b/pkgs/os-specific/linux/kernel/linux-3.14.nix
index 75ab538ddf5e..52fa5eba109e 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.14.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.14.41";
+  version = "3.14.43";
   # Remember to update grsecurity!
   extraMeta.branch = "3.14";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0qghsf648nvzsh2x44x3w0d8lciml8rj6dvglqvmq1zcg492k8i2";
+    sha256 = "1m5gdzff46xm24p5x5ajxka99g0maf1y50nj59mbjccbqx3s7kvf";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.18.nix b/pkgs/os-specific/linux/kernel/linux-3.18.nix
index eb694497931d..592086b65474 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.18.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.18.13";
+  version = "3.18.14";
   extraMeta.branch = "3.18";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "043bqjvbamzi201csgnw7hsf8810qm0dn7x9p0kc7s9p9jnyq79n";
+    sha256 = "1xh0vvn1l2g1kkg54f0mg0inbpsiqs24ybgsakksmcpcadjgqk1i";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.19.nix b/pkgs/os-specific/linux/kernel/linux-3.19.nix
index 03c0db556263..90c5f9e31d3f 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.19.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.19.7";
+  version = "3.19.8";
   extraMeta.branch = "3.19";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0xd38f7g5yfn0b6b2l4qr022f9hcr82ddbysjs4npbgk5ms7341k";
+    sha256 = "0yg2mlq0h9my6k1bg3b255w4qnyx609ngh1nhssx3gbzslwf0jyg";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.2.nix b/pkgs/os-specific/linux/kernel/linux-3.2.nix
index 54cf9bc9324a..2fc240f6196d 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.2.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.2.68";
+  version = "3.2.69";
   extraMeta.branch = "3.2";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0yz3k3qqr13r6fa2f8i83rryiawy4rrd7qk2zx6jxq6byfd31ba2";
+    sha256 = "0fs7aj3vn51dlx7yfgkx05qpki2msh6j2irwajd9bw0l26cbycd3";
   };
 
   # We don't provide these patches if grsecurity is enabled, because
diff --git a/pkgs/os-specific/linux/kernel/linux-4.0.nix b/pkgs/os-specific/linux/kernel/linux-4.0.nix
index a5dafd4c8066..9c7fb2c3bd8d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.0.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.0.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.0.2";
+  version = "4.0.4";
   # Remember to update grsecurity!
   extraMeta.branch = "4.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1jq4583wwqmwqkqlkck57fxw18xszng92b6ma3avf0djd11b2izz";
+    sha256 = "1j5l87z6gd05cqzg680id0x1nk38kd6sjffd2lifl0fz5k6iqr9h";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 4e5facc4483b..348b26b3d3b1 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -65,17 +65,17 @@ rec {
   };
 
   grsecurity_stable = grsecPatch
-    { kversion  = "3.14.41";
-      revision  = "201505101121";
+    { kversion  = "3.14.43";
+      revision  = "201505191737";
       branch    = "stable";
-      sha256    = "1jiwc6qvimccmlm62sfp2ch173h7ki1h11facywpnb4wms7izk6g";
+      sha256    = "1ijrqmdwpdbkp10lhjw8msv0y02d98v5xgq6xb62ksrdb6k27fiw";
     };
 
   grsecurity_unstable = grsecPatch
-    { kversion  = "4.0.2";
-      revision  = "201505101122";
+    { kversion  = "4.0.4";
+      revision  = "201505182014";
       branch    = "test";
-      sha256    = "14fi31xwlgirbwk7f1xh8vanjxk8b473rz7z38savl4nx2wr5r24";
+      sha256    = "1l1s00zbyzr53p46yj6yh75dbayg9kigv5r6g9mr5irfs5p8s2ay";
     };
 
   grsec_fix_path =
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 1ffdaa36e965..8157270d67d7 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -1,7 +1,5 @@
 { stdenv, fetchurl, attr, perl }:
 
-assert stdenv.isLinux;
-
 stdenv.mkDerivation rec {
   name = "libcap-${version}";
   version = "2.24";
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 9939a5525747..8115aa1055be 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -9,13 +9,13 @@ let
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "lxc-1.1.1";
+  name = "lxc-1.1.2";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxc";
     rev = name;
-    sha256 = "04zpznd364862y3dwn97klvwfw9i2b6n1lh4fkci0z74c6z9svql";
+    sha256 = "149nq630h9bg87hb3cn086ci0cz29l7fp3i6qf1mqxv7hnildm8p";
   };
 
   buildInputs = [
@@ -41,18 +41,13 @@ stdenv.mkDerivation rec {
     "--enable-tests"
   ];
 
-  installFlags = [ "DESTDIR=\${out}" ];
-
-  postInstall = ''
-    mv $out/$out/* $out
-    DIR=$out/$out
-    while rmdir $DIR 2>/dev/null; do
-      DIR="$(dirname "$DIR")"
-    done
-
-    # Remove the unneeded var/lib directories
-    rm -rf $out/var
-  '';
+  installFlags = [
+    "localstatedir=\${TMPDIR}"
+    "sysconfdir=\${out}/etc"
+    "sysconfigdir=\${out}/etc/default"
+    "READMEdir=\${TMPDIR}/var/lib/lxc/rootfs"
+    "LXCPATH=\${TMPDIR}/var/lib/lxc"
+  ];
 
   meta = {
     homepage = "http://lxc.sourceforge.net";
diff --git a/pkgs/os-specific/linux/spl/git.nix b/pkgs/os-specific/linux/spl/git.nix
index 7559562965d2..0748da25f16e 100644
--- a/pkgs/os-specific/linux/spl/git.nix
+++ b/pkgs/os-specific/linux/spl/git.nix
@@ -1,12 +1,12 @@
 { callPackage, fetchgit, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "2015-04-08";
+  version = "2015-04-24";
 
   src = fetchgit {
     url = git://github.com/zfsonlinux/spl.git;
-    rev = "cd69f020e4b0f9c416dd07a264e48c9488a7633f";
-    sha256 = "1fy5zlh8cs65s52vixkp00ihrlrhs2frd6vwxwjqmpzyb7fnh3m8";
+    rev = "62e2eb2329d99f7c39bcda47bc9ecb2887608fa5";
+    sha256 = "1i59sps2y0mgm9sj4a0h03xl0hlgiym4637j5j6zc5g125zzcnrd";
   };
 
   patches = [ ./const.patch ./install_prefix.patch ];
diff --git a/pkgs/os-specific/linux/zfs/git.nix b/pkgs/os-specific/linux/zfs/git.nix
index a7d312c40414..130a02c86e8e 100644
--- a/pkgs/os-specific/linux/zfs/git.nix
+++ b/pkgs/os-specific/linux/zfs/git.nix
@@ -1,12 +1,12 @@
 { callPackage, stdenv, fetchgit, spl_git, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "2015-04-08";
+  version = "2015-05-13";
 
   src = fetchgit {
     url = git://github.com/zfsonlinux/zfs.git;
-    rev = "d07a16360c1ee219b8820f80d035e56a18c58b84";
-    sha256 = "0yyc0n960bzd4fmrg1mwp0xy1db7yn90g33ds44chh4g74mrfgdz";
+    rev = "7fec46b9d8967109ad289d208e8cf36a0c16e40c";
+    sha256 = "0gvzw6vn7wyq2g9psv0fdars7ssidqc5l85x4yym5niccy1xl437";
   };
 
   patches = [ ./nix-build.patch ];